From 0c904fa1536c9afff4f81d62fc043047edeb8e84 Mon Sep 17 00:00:00 2001 From: purplerain Date: Wed, 6 Sep 2023 22:21:59 +0000 Subject: [PATCH] sync code with last improvements from OpenBSD --- lib/libcrypto/man/ASN1_OBJECT_new.3 | 25 +- lib/libcrypto/man/EVP_CIPHER_meth_new.3 | 171 +- lib/libcrypto/man/EVP_CIPHER_nid.3 | 34 +- lib/libcrypto/man/OBJ_nid2obj.3 | 379 +- lib/libcrypto/objects/obj_dat.c | 20 +- sbin/pfctl/pfctl_radix.c | 4 +- sbin/unwind/frontend.c | 8 +- sbin/unwind/libunbound/config.h | 9 +- sbin/unwind/libunbound/daemon/acl_list.h | 8 +- sbin/unwind/libunbound/daemon/stats.h | 7 + sbin/unwind/libunbound/daemon/worker.h | 4 +- sbin/unwind/libunbound/dns64/dns64.c | 4 +- sbin/unwind/libunbound/dnstap/dnstap.h | 4 +- .../unwind/libunbound/iterator/iter_delegpt.c | 39 + .../unwind/libunbound/iterator/iter_delegpt.h | 25 + .../libunbound/iterator/iter_resptype.c | 7 + sbin/unwind/libunbound/iterator/iter_scrub.c | 43 +- sbin/unwind/libunbound/iterator/iter_utils.c | 45 +- sbin/unwind/libunbound/iterator/iter_utils.h | 7 +- sbin/unwind/libunbound/iterator/iterator.c | 268 +- sbin/unwind/libunbound/iterator/iterator.h | 33 +- sbin/unwind/libunbound/libunbound/context.c | 1 + sbin/unwind/libunbound/libunbound/context.h | 6 + .../unwind/libunbound/libunbound/libunbound.c | 39 +- sbin/unwind/libunbound/libunbound/libworker.c | 17 +- .../libunbound/libunbound/unbound-event.h | 9 +- sbin/unwind/libunbound/libunbound/unbound.h | 116 +- sbin/unwind/libunbound/services/authzone.c | 11 +- sbin/unwind/libunbound/services/cache/dns.c | 58 +- sbin/unwind/libunbound/services/cache/infra.c | 75 +- sbin/unwind/libunbound/services/cache/infra.h | 5 +- .../libunbound/services/listen_dnsport.c | 153 +- sbin/unwind/libunbound/services/localzone.c | 20 +- sbin/unwind/libunbound/services/localzone.h | 2 + sbin/unwind/libunbound/services/mesh.c | 385 +- sbin/unwind/libunbound/services/mesh.h | 14 +- sbin/unwind/libunbound/services/modstack.c | 10 +- .../libunbound/services/outside_network.c | 28 + sbin/unwind/libunbound/services/rpz.c | 230 +- sbin/unwind/libunbound/services/rpz.h | 16 +- sbin/unwind/libunbound/sldns/rrdef.c | 12 +- sbin/unwind/libunbound/sldns/rrdef.h | 7 +- sbin/unwind/libunbound/sldns/str2wire.c | 94 +- sbin/unwind/libunbound/sldns/str2wire.h | 4 +- sbin/unwind/libunbound/sldns/wire2str.c | 19 +- sbin/unwind/libunbound/util/Makefile.inc | 7 +- sbin/unwind/libunbound/util/config_file.c | 162 +- sbin/unwind/libunbound/util/config_file.h | 72 +- sbin/unwind/libunbound/util/configlexer.c | 6354 +++++++++-------- sbin/unwind/libunbound/util/configlexer.lex | 28 +- sbin/unwind/libunbound/util/configparser.h | 638 +- sbin/unwind/libunbound/util/configparser.y | 180 +- sbin/unwind/libunbound/util/data/msgencode.c | 148 +- sbin/unwind/libunbound/util/data/msgencode.h | 42 +- sbin/unwind/libunbound/util/data/msgparse.c | 98 +- sbin/unwind/libunbound/util/data/msgparse.h | 18 +- sbin/unwind/libunbound/util/data/msgreply.c | 95 +- sbin/unwind/libunbound/util/data/msgreply.h | 30 +- sbin/unwind/libunbound/util/edns.c | 59 + sbin/unwind/libunbound/util/edns.h | 59 + sbin/unwind/libunbound/util/fptr_wlist.c | 8 + sbin/unwind/libunbound/util/iana_ports.inc | 5 + sbin/unwind/libunbound/util/module.c | 16 +- sbin/unwind/libunbound/util/module.h | 14 +- sbin/unwind/libunbound/util/net_help.c | 70 +- sbin/unwind/libunbound/util/net_help.h | 23 + sbin/unwind/libunbound/util/netevent.c | 257 +- sbin/unwind/libunbound/util/netevent.h | 70 +- sbin/unwind/libunbound/util/regional.c | 2 +- sbin/unwind/libunbound/util/rfc_1982.c | 75 + sbin/unwind/libunbound/util/rfc_1982.h | 63 + sbin/unwind/libunbound/util/siphash.c | 192 + sbin/unwind/libunbound/util/siphash.h | 43 + sbin/unwind/libunbound/util/storage/lruhash.c | 25 +- sbin/unwind/libunbound/util/storage/lruhash.h | 5 +- .../unwind/libunbound/util/storage/slabhash.c | 18 + .../unwind/libunbound/util/storage/slabhash.h | 9 + sbin/unwind/libunbound/util/timehist.c | 44 +- sbin/unwind/libunbound/util/timeval_func.c | 113 + sbin/unwind/libunbound/util/timeval_func.h | 53 + sbin/unwind/libunbound/util/tube.c | 53 +- sbin/unwind/libunbound/validator/autotrust.c | 2 + sbin/unwind/libunbound/validator/val_kcache.c | 10 +- sbin/unwind/libunbound/validator/val_kcache.h | 4 +- sbin/unwind/libunbound/validator/val_kentry.c | 48 +- sbin/unwind/libunbound/validator/val_kentry.h | 37 +- sbin/unwind/libunbound/validator/val_neg.c | 7 +- sbin/unwind/libunbound/validator/val_nsec.c | 19 +- sbin/unwind/libunbound/validator/val_nsec.h | 5 +- .../libunbound/validator/val_sigcrypt.c | 43 +- sbin/unwind/libunbound/validator/val_utils.c | 19 +- sbin/unwind/libunbound/validator/validator.c | 137 +- share/man/man5/bsd.port.mk.5 | 303 +- sys/arch/amd64/amd64/vmm_machdep.c | 4 +- sys/arch/amd64/include/vmmvar.h | 6 +- sys/arch/arm64/dev/apldc.c | 25 +- sys/dev/pci/if_em.c | 4 +- sys/dev/pci/if_em_hw.c | 45 +- sys/dev/pci/if_em_hw.h | 4 +- sys/dev/pci/ksmn.c | 3 +- sys/uvm/uvm_fault.c | 17 +- usr.bin/make/defines.h | 10 +- usr.bin/make/lst.h | 15 +- usr.bin/make/lst.lib/lst.h | 15 +- usr.sbin/makefs/cd9660/iso.h | 14 +- usr.sbin/radiusd/parse.y | 7 +- usr.sbin/radiusd/radiusd.c | 20 +- usr.sbin/unbound/Makefile.in | 37 +- usr.sbin/unbound/README.md | 3 +- usr.sbin/unbound/acx_nlnetlabs.m4 | 32 +- usr.sbin/unbound/acx_python.m4 | 61 +- usr.sbin/unbound/cachedb/cachedb.c | 74 +- usr.sbin/unbound/cachedb/redis.c | 28 +- usr.sbin/unbound/config.guess | 51 +- usr.sbin/unbound/config.h.in | 25 +- usr.sbin/unbound/config.sub | 72 +- usr.sbin/unbound/configure | 167 +- usr.sbin/unbound/configure.ac | 28 +- usr.sbin/unbound/daemon/acl_list.c | 2 + usr.sbin/unbound/daemon/acl_list.h | 8 +- usr.sbin/unbound/daemon/cachedump.c | 35 +- usr.sbin/unbound/daemon/daemon.c | 87 +- usr.sbin/unbound/daemon/daemon.h | 6 + usr.sbin/unbound/daemon/remote.c | 80 +- usr.sbin/unbound/daemon/remote.h | 2 +- usr.sbin/unbound/daemon/stats.c | 33 +- usr.sbin/unbound/daemon/stats.h | 7 + usr.sbin/unbound/daemon/worker.c | 336 +- usr.sbin/unbound/daemon/worker.h | 4 +- usr.sbin/unbound/dns64/dns64.c | 4 +- usr.sbin/unbound/dnstap/dnstap.c | 7 +- usr.sbin/unbound/dnstap/dnstap.h | 4 +- .../unbound/dnstap/unbound-dnstap-socket.c | 39 +- usr.sbin/unbound/doc/Changelog | 409 ++ usr.sbin/unbound/doc/README | 2 +- usr.sbin/unbound/doc/README.DNS64 | 20 + usr.sbin/unbound/doc/example.conf.in | 48 +- usr.sbin/unbound/doc/libunbound.3.in | 4 +- usr.sbin/unbound/doc/unbound-anchor.8.in | 2 +- usr.sbin/unbound/doc/unbound-checkconf.8.in | 2 +- usr.sbin/unbound/doc/unbound-control.8.in | 66 +- usr.sbin/unbound/doc/unbound-host.1.in | 2 +- usr.sbin/unbound/doc/unbound.8.in | 4 +- usr.sbin/unbound/doc/unbound.conf.5.in | 181 +- usr.sbin/unbound/edns-subnet/subnetmod.c | 28 +- usr.sbin/unbound/iterator/iter_delegpt.c | 39 + usr.sbin/unbound/iterator/iter_delegpt.h | 25 + usr.sbin/unbound/iterator/iter_resptype.c | 7 + usr.sbin/unbound/iterator/iter_scrub.c | 43 +- usr.sbin/unbound/iterator/iter_utils.c | 45 +- usr.sbin/unbound/iterator/iter_utils.h | 5 +- usr.sbin/unbound/iterator/iterator.c | 260 +- usr.sbin/unbound/iterator/iterator.h | 31 +- usr.sbin/unbound/libunbound/context.c | 1 + usr.sbin/unbound/libunbound/context.h | 6 + usr.sbin/unbound/libunbound/libunbound.c | 39 +- usr.sbin/unbound/libunbound/libworker.c | 17 +- usr.sbin/unbound/libunbound/unbound-event.h | 9 +- usr.sbin/unbound/libunbound/unbound.h | 24 +- usr.sbin/unbound/services/authzone.c | 11 +- usr.sbin/unbound/services/cache/dns.c | 58 +- usr.sbin/unbound/services/cache/infra.c | 75 +- usr.sbin/unbound/services/cache/infra.h | 5 +- usr.sbin/unbound/services/listen_dnsport.c | 73 +- usr.sbin/unbound/services/localzone.c | 20 +- usr.sbin/unbound/services/localzone.h | 2 + usr.sbin/unbound/services/mesh.c | 299 +- usr.sbin/unbound/services/mesh.h | 14 +- usr.sbin/unbound/services/modstack.c | 10 +- usr.sbin/unbound/services/outside_network.c | 28 + usr.sbin/unbound/services/rpz.c | 230 +- usr.sbin/unbound/services/rpz.h | 16 +- usr.sbin/unbound/sldns/rrdef.c | 12 +- usr.sbin/unbound/sldns/rrdef.h | 7 +- usr.sbin/unbound/sldns/str2wire.c | 74 +- usr.sbin/unbound/sldns/str2wire.h | 4 +- usr.sbin/unbound/sldns/wire2str.c | 5 +- usr.sbin/unbound/smallapp/unbound-anchor.c | 3 +- usr.sbin/unbound/smallapp/unbound-checkconf.c | 2 +- usr.sbin/unbound/smallapp/unbound-control.c | 52 +- usr.sbin/unbound/smallapp/unbound-host.c | 5 +- usr.sbin/unbound/testcode/dohclient.c | 10 +- usr.sbin/unbound/testcode/fake_event.c | 17 +- usr.sbin/unbound/testcode/lock_verify.c | 2 + usr.sbin/unbound/testcode/perf.c | 8 + usr.sbin/unbound/testcode/replay.c | 17 +- usr.sbin/unbound/testcode/streamtcp.c | 18 +- usr.sbin/unbound/testcode/testpkts.c | 73 +- usr.sbin/unbound/testcode/testpkts.h | 16 +- usr.sbin/unbound/testcode/unitlruhash.c | 22 +- usr.sbin/unbound/testcode/unitmain.c | 416 ++ usr.sbin/unbound/util/config_file.c | 52 +- usr.sbin/unbound/util/config_file.h | 32 +- usr.sbin/unbound/util/configlexer.lex | 12 + usr.sbin/unbound/util/configparser.y | 166 +- usr.sbin/unbound/util/data/msgencode.c | 146 +- usr.sbin/unbound/util/data/msgencode.h | 40 +- usr.sbin/unbound/util/data/msgparse.c | 98 +- usr.sbin/unbound/util/data/msgparse.h | 18 +- usr.sbin/unbound/util/data/msgreply.c | 87 +- usr.sbin/unbound/util/data/msgreply.h | 30 +- usr.sbin/unbound/util/edns.c | 59 + usr.sbin/unbound/util/edns.h | 59 + usr.sbin/unbound/util/fptr_wlist.c | 8 + usr.sbin/unbound/util/iana_ports.inc | 5 + usr.sbin/unbound/util/module.c | 16 +- usr.sbin/unbound/util/module.h | 14 +- usr.sbin/unbound/util/net_help.c | 64 + usr.sbin/unbound/util/net_help.h | 23 + usr.sbin/unbound/util/netevent.c | 91 +- usr.sbin/unbound/util/netevent.h | 4 +- usr.sbin/unbound/util/regional.c | 2 +- usr.sbin/unbound/util/rfc_1982.c | 74 + usr.sbin/unbound/util/rfc_1982.h | 63 + usr.sbin/unbound/util/siphash.c | 187 + usr.sbin/unbound/util/siphash.h | 43 + usr.sbin/unbound/util/storage/lruhash.c | 25 +- usr.sbin/unbound/util/storage/lruhash.h | 5 +- usr.sbin/unbound/util/storage/slabhash.c | 18 + usr.sbin/unbound/util/storage/slabhash.h | 9 + usr.sbin/unbound/util/timehist.c | 18 +- usr.sbin/unbound/util/timeval_func.c | 113 + usr.sbin/unbound/util/timeval_func.h | 53 + usr.sbin/unbound/util/tube.c | 53 +- usr.sbin/unbound/validator/autotrust.c | 2 + usr.sbin/unbound/validator/val_kcache.c | 10 +- usr.sbin/unbound/validator/val_kcache.h | 4 +- usr.sbin/unbound/validator/val_kentry.c | 46 +- usr.sbin/unbound/validator/val_kentry.h | 35 +- usr.sbin/unbound/validator/val_neg.c | 7 +- usr.sbin/unbound/validator/val_nsec.c | 15 +- usr.sbin/unbound/validator/val_nsec.h | 5 +- usr.sbin/unbound/validator/val_sigcrypt.c | 43 +- usr.sbin/unbound/validator/val_utils.c | 17 +- usr.sbin/unbound/validator/validator.c | 131 +- 235 files changed, 12410 insertions(+), 6193 deletions(-) create mode 100644 sbin/unwind/libunbound/util/rfc_1982.c create mode 100644 sbin/unwind/libunbound/util/rfc_1982.h create mode 100644 sbin/unwind/libunbound/util/siphash.c create mode 100644 sbin/unwind/libunbound/util/siphash.h create mode 100644 sbin/unwind/libunbound/util/timeval_func.c create mode 100644 sbin/unwind/libunbound/util/timeval_func.h create mode 100644 usr.sbin/unbound/util/rfc_1982.c create mode 100644 usr.sbin/unbound/util/rfc_1982.h create mode 100644 usr.sbin/unbound/util/siphash.c create mode 100644 usr.sbin/unbound/util/siphash.h create mode 100644 usr.sbin/unbound/util/timeval_func.c create mode 100644 usr.sbin/unbound/util/timeval_func.h diff --git a/lib/libcrypto/man/ASN1_OBJECT_new.3 b/lib/libcrypto/man/ASN1_OBJECT_new.3 index 6aa4723c7..3e2eac02e 100644 --- a/lib/libcrypto/man/ASN1_OBJECT_new.3 +++ b/lib/libcrypto/man/ASN1_OBJECT_new.3 @@ -1,10 +1,10 @@ -.\" $OpenBSD: ASN1_OBJECT_new.3,v 1.15 2021/12/15 20:07:51 schwarze Exp $ +.\" $OpenBSD: ASN1_OBJECT_new.3,v 1.16 2023/09/05 15:01:39 schwarze Exp $ .\" full merge up to: OpenSSL 99d63d4 Mar 19 12:28:58 2016 -0400 .\" .\" This file is a derived work. .\" The changes are covered by the following Copyright and license: .\" -.\" Copyright (c) 2017, 2021 Ingo Schwarze +.\" Copyright (c) 2017, 2021, 2023 Ingo Schwarze .\" .\" Permission to use, copy, modify, and distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -65,7 +65,7 @@ .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED .\" OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: December 15 2021 $ +.Dd $Mdocdate: September 5 2023 $ .Dt ASN1_OBJECT_NEW 3 .Os .Sh NAME @@ -207,3 +207,22 @@ first appeared in SSLeay 0.5.1 and in SSLeay 0.8.0. These functions have been available since .Ox 2.4 . +.Sh BUGS +The function +.Fn ASN1_OBJECT_new +is not useful for any practical purpose because the library does not +provide any function capable of adding data to an existing object. +Consequently, if the application program creates an object with +.Fn ASN1_OBJECT_new , +that object will always remain empty. +.Pp +Similarly, if an +.Fa nid +of +.Dv NID_undef +is passed to +.Fn ASN1_OBJECT_create , +or if +.Dv NULL +is passed for any of its pointer arguments, the returned object +will permanently remain incomplete. diff --git a/lib/libcrypto/man/EVP_CIPHER_meth_new.3 b/lib/libcrypto/man/EVP_CIPHER_meth_new.3 index 0ecb87340..f66248f0c 100644 --- a/lib/libcrypto/man/EVP_CIPHER_meth_new.3 +++ b/lib/libcrypto/man/EVP_CIPHER_meth_new.3 @@ -1,6 +1,23 @@ -.\" $OpenBSD: EVP_CIPHER_meth_new.3,v 1.2 2023/08/26 15:14:28 schwarze Exp $ +.\" $OpenBSD: EVP_CIPHER_meth_new.3,v 1.4 2023/09/05 14:37:00 schwarze Exp $ .\" selective merge up to: OpenSSL b0edda11 Mar 20 13:00:17 2018 +0000 .\" +.\" This file is a derived work. +.\" The changes are covered by the following Copyright and license: +.\" +.\" Copyright (c) 2023 Ingo Schwarze +.\" +.\" Permission to use, copy, modify, and distribute this software for any +.\" purpose with or without fee is hereby granted, provided that the above +.\" copyright notice and this permission notice appear in all copies. +.\" +.\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES +.\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF +.\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR +.\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES +.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN +.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF +.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. +.\" .\" The original file was written by Richard Levitte .\" Copyright (c) 2015 The OpenSSL Project. .\" All rights reserved. @@ -49,7 +66,7 @@ .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED .\" OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: August 26 2023 $ +.Dd $Mdocdate: September 5 2023 $ .Dt EVP_CIPHER_METH_NEW 3 .Os .Sh NAME @@ -184,75 +201,116 @@ Zero or more of the following flags can be OR'ed into the .Fa flags argument: .Bl -tag -width Ds -.It EVP_CIPH_VARIABLE_LENGTH -This cipher is of variable length. -.It EVP_CIPH_CUSTOM_IV -Storing and initialising the IV is left entirely to the implementation. -.It EVP_CIPH_ALWAYS_CALL_INIT -Set this if the implementation's -.Fn init -function should be called even if -.Fa key -is -.Dv NULL . -.It EVP_CIPH_CTRL_INIT -Set this to have the implementation's -.Fn ctrl -function called with command code -.Dv EVP_CTRL_INIT -early in its setup. -.It EVP_CIPH_CUSTOM_KEY_LENGTH -Checking and setting the key length after creating the -.Vt EVP_CIPHER -is left to the implementation. -Whenever someone uses +.It Dv EVP_CIPH_VARIABLE_LENGTH +This cipher has a variable key length, and the function .Xr EVP_CIPHER_CTX_set_key_length 3 -on a -.Vt EVP_CIPHER -with this flag set, the implementation's -.Fn ctrl -function will be called with the control code +can be used with it. +.It Dv EVP_CIPH_CUSTOM_IV +Instruct +.Xr EVP_CipherInit_ex 3 +and similar initialization functions to leave storing and initialising +the IV entirely to the implementation. +If this flag is set, +the implementation is typically expected to do that in its +.Fa init +function. +.It Dv EVP_CIPH_ALWAYS_CALL_INIT +Instruct +.Xr EVP_CipherInit_ex 3 +and similar initialization functions to call the implementation's +.Fa init +function even if the +.Fa key +argument is +.Dv NULL . +.It Dv EVP_CIPH_CTRL_INIT +Instruct +.Xr EVP_CipherInit_ex 3 +and similar initialization functions to call the implementation's +.Fa ctrl +function with a command +.Fa type +of +.Dv EVP_CTRL_INIT +early during the setup. +.It Dv EVP_CIPH_CUSTOM_KEY_LENGTH +Instruct +.Xr EVP_CIPHER_CTX_set_key_length 3 +to not check and set the key length itself, +but to leave that to the implementation by instead calling its +.Fa ctrl +function with a command +.Fa type +of .Dv EVP_CTRL_SET_KEY_LENGTH and the key length in .Fa arg . -.It EVP_CIPH_NO_PADDING -Don't use standard block padding. -.It EVP_CIPH_RAND_KEY -Making a key with random content is left to the implementation. -This is done by calling the implementation's -.Fn ctrl -function with the control code +.It Dv EVP_CIPH_NO_PADDING +Instruct +.Xr EVP_CipherFinal_ex 3 +and similar finalization functions to not use standard block padding +but instead report an error if the total amount of data +to be encrypted or decrypted is not a multiple of the block size. +.It Dv EVP_CIPH_RAND_KEY +Instruct +.Xr EVP_CIPHER_CTX_rand_key 3 +to not generate a random key using +.Xr arc4random_buf 3 +but instead leave that to the implementation by calling the +.Fa ctrl +function with a command +.Fa type +of .Dv EVP_CTRL_RAND_KEY and the pointer to the key memory storage in .Fa ptr . -.It EVP_CIPH_CUSTOM_COPY -Set this to have the implementation's -.Fn ctrl -function called with command code +.It Dv EVP_CIPH_CUSTOM_COPY +Instruct +.Xr EVP_CIPHER_CTX_copy 3 +to call the implementation's +.Fa ctrl +function with a command +.Fa type +of .Dv EVP_CTRL_COPY -at the end of -.Xr EVP_CIPHER_CTX_copy 3 . +and the destination +.Fa "EVP_CIPHER_CTX *out" +in the +.Fa ptr +argument immediately before returning successfully. The intended use is for further things to deal with after the implementation specific data block has been copied. -The destination -.Vt EVP_CIPHER_CTX -object is passed to the control with the -.Fa ptr -parameter. The implementation-specific data block is reached with .Xr EVP_CIPHER_CTX_get_cipher_data 3 . -.It EVP_CIPH_FLAG_DEFAULT_ASN1 -Use the default EVP routines to pass IV to and from ASN.1. -.It EVP_CIPH_FLAG_LENGTH_BITS +.It Dv EVP_CIPH_FLAG_DEFAULT_ASN1 +Instruct +.Xr EVP_CIPHER_param_to_asn1 3 +to use +.Xr ASN1_TYPE_set_octetstring 3 +if no +.Fa set_asn1_parameters +function is installed, and instruct +.Xr EVP_CIPHER_asn1_to_param 3 +to use +.Xr ASN1_TYPE_get_octetstring 3 +if no +.Fa get_asn1_parameters +function is installed. +.It Dv EVP_CIPH_FLAG_LENGTH_BITS Signals that the length of the input buffer for encryption / decryption is to be understood as the number of bits instead of bytes for this implementation. This is only useful for CFB1 ciphers. -.It EVP_CIPH_FLAG_CUSTOM_CIPHER -This indicates that the implementation takes care of everything, +.It Dv EVP_CIPH_FLAG_CUSTOM_CIPHER +Instruct +.Xr EVP_CipherUpdate 3 , +.Xr EVP_CipherFinal_ex 3 , +and similar encryption, decryption, and finalization functions +that the implementation's +.Fa do_cipher +function takes care of everything, including padding, buffering and finalization. -The EVP routines will simply give them control and do nothing more. -.It EVP_CIPH_FLAG_AEAD_CIPHER +.It Dv EVP_CIPH_FLAG_AEAD_CIPHER This indicates that this is an AEAD cipher implementation. .El .Pp @@ -261,7 +319,9 @@ sets the size of the EVP_CIPHER's implementation context so that it can be automatically allocated. .Pp .Fn EVP_CIPHER_meth_set_init -sets the cipher init function for +sets the +.Fa init +function for .Fa cipher . The cipher init function is called by .Xr EVP_CipherInit 3 , @@ -269,6 +329,7 @@ The cipher init function is called by .Xr EVP_EncryptInit 3 , .Xr EVP_EncryptInit_ex 3 , .Xr EVP_DecryptInit 3 , +and .Xr EVP_DecryptInit_ex 3 . .Pp .Fn EVP_CIPHER_meth_set_do_cipher diff --git a/lib/libcrypto/man/EVP_CIPHER_nid.3 b/lib/libcrypto/man/EVP_CIPHER_nid.3 index 1c0683980..1feff4f34 100644 --- a/lib/libcrypto/man/EVP_CIPHER_nid.3 +++ b/lib/libcrypto/man/EVP_CIPHER_nid.3 @@ -1,4 +1,4 @@ -.\" $OpenBSD: EVP_CIPHER_nid.3,v 1.2 2023/09/01 17:28:21 schwarze Exp $ +.\" $OpenBSD: EVP_CIPHER_nid.3,v 1.3 2023/09/05 14:54:21 schwarze Exp $ .\" full merge up to: OpenSSL man3/EVP_EncryptInit.pod .\" 0874d7f2 Oct 11 13:13:47 2022 +0100 .\" @@ -66,12 +66,13 @@ .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED .\" OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: September 1 2023 $ +.Dd $Mdocdate: September 5 2023 $ .Dt EVP_CIPHER_NID 3 .Os .Sh NAME .Nm EVP_CIPHER_nid , .Nm EVP_CIPHER_CTX_nid , +.Nm EVP_CIPHER_name , .Nm EVP_CIPHER_type , .Nm EVP_CIPHER_CTX_type , .Nm EVP_CIPHER_block_size , @@ -91,6 +92,10 @@ .Fo EVP_CIPHER_CTX_nid .Fa "const EVP_CIPHER_CTX *ctx" .Fc +.Ft const char * +.Fo EVP_CIPHER_name +.Fa "const EVP_CIPHER *cipher" +.Fc .Ft int .Fo EVP_CIPHER_type .Fa "const EVP_CIPHER *ctx" @@ -137,6 +142,12 @@ returns the NID of the cipher that .Fa ctx is configured to use. .Pp +.Fn EVP_CIPHER_name +converts the NID of the +.Fa cipher +to its short name with +.Xr OBJ_nid2sn 3 . +.Pp .Fn EVP_CIPHER_type returns the NID associated with the ASN.1 OBJECT IDENTIFIER of the .Fa cipher , @@ -196,12 +207,27 @@ and the return value of returns the cipher mode of the cipher that .Fa ctx is configured to use. +.Pp +.Fn EVP_CIPHER_name , +.Fn EVP_CIPHER_CTX_type , +.Fn EVP_CIPHER_mode , +and +.Fn EVP_CIPHER_CTX_mode +are implemented as macros. .Sh RETURN VALUES .Fn EVP_CIPHER_nid and .Fn EVP_CIPHER_CTX_nid return an NID. .Pp +.Fn EVP_CIPHER_name +returns a pointer to a string that is owned by an internal library object or +.Dv NULL +if the NID is neither built into the library nor added to the global +object table by one of the functions documented in the manual page +.Xr OBJ_create 3 , +of if the object does not contain a short name. +.Pp .Fn EVP_CIPHER_type and .Fn EVP_CIPHER_CTX_type @@ -264,6 +290,10 @@ and .Fn EVP_CIPHER_CTX_mode first appeared in OpenSSL 0.9.6 and have been available since .Ox 2.9 . +.Pp +.Fn EVP_CIPHER_name +first appeared in OpenSSL 0.9.7 and has been available since +.Ox 3.2 . .Sh CAVEATS The behaviour of the functions taking an .Vt EVP_CIPHER_CTX diff --git a/lib/libcrypto/man/OBJ_nid2obj.3 b/lib/libcrypto/man/OBJ_nid2obj.3 index 62d67ac74..4e420b831 100644 --- a/lib/libcrypto/man/OBJ_nid2obj.3 +++ b/lib/libcrypto/man/OBJ_nid2obj.3 @@ -1,11 +1,11 @@ -.\" $OpenBSD: OBJ_nid2obj.3,v 1.20 2023/07/21 05:02:53 tb Exp $ +.\" $OpenBSD: OBJ_nid2obj.3,v 1.21 2023/09/05 13:50:22 schwarze Exp $ .\" full merge up to: OpenSSL c264592d May 14 11:28:00 2006 +0000 .\" selective merge up to: OpenSSL 35fd9953 May 28 14:49:38 2019 +0200 .\" .\" This file is a derived work. .\" The changes are covered by the following Copyright and license: .\" -.\" Copyright (c) 2017, 2021 Ingo Schwarze +.\" Copyright (c) 2017, 2021, 2023 Ingo Schwarze .\" .\" Permission to use, copy, modify, and distribute this software for any .\" purpose with or without fee is hereby granted, provided that the above @@ -67,7 +67,7 @@ .\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED .\" OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: July 21 2023 $ +.Dd $Mdocdate: September 5 2023 $ .Dt OBJ_NID2OBJ 3 .Os .Sh NAME @@ -89,19 +89,19 @@ .In openssl/objects.h .Ft ASN1_OBJECT * .Fo OBJ_nid2obj -.Fa "int n" +.Fa "int nid" .Fc .Ft const char * .Fo OBJ_nid2ln -.Fa "int n" +.Fa "int nid" .Fc .Ft const char * .Fo OBJ_nid2sn -.Fa "int n" +.Fa "int nid" .Fc .Ft int .Fo OBJ_obj2nid -.Fa "const ASN1_OBJECT *o" +.Fa "const ASN1_OBJECT *object" .Fc .Ft int .Fo OBJ_ln2nid @@ -124,7 +124,7 @@ .Fo OBJ_obj2txt .Fa "char *buf" .Fa "int buf_len" -.Fa "const ASN1_OBJECT *a" +.Fa "const ASN1_OBJECT *object" .Fa "int no_name" .Fc .Ft int @@ -134,86 +134,102 @@ .Fc .Ft ASN1_OBJECT * .Fo OBJ_dup -.Fa "const ASN1_OBJECT *o" +.Fa "const ASN1_OBJECT *object" .Fc .In openssl/asn1.h .Ft int .Fo i2t_ASN1_OBJECT .Fa "char *buf" .Fa "int buf_len" -.Fa "const ASN1_OBJECT *a" +.Fa "const ASN1_OBJECT *object" .Fc .Ft int .Fo i2a_ASN1_OBJECT .Fa "BIO *out_bio" -.Fa "const ASN1_OBJECT *a" +.Fa "const ASN1_OBJECT *object" .Fc .Sh DESCRIPTION The ASN.1 object utility functions process .Vt ASN1_OBJECT -structures which are a representation of the ASN.1 OBJECT IDENTIFIER -(OID) type. -For convenience, OIDs are usually represented in source code as -numeric identifiers, or NIDs. -OpenSSL has an internal table of OIDs that are generated when the -library is built, and their corresponding NIDs are available as -defined constants. -For the functions below, application code should treat all returned -values \(em OIDs, NIDs, or names \(em as constants. +structures, in the following called +.Dq objects . +An object represents an ASN.1 +.Vt OBJECT IDENTIFIER +.Pq OID . +The library maintains an internal global table of objects. +Many of these objects are built into the library +and contained in the global table by default. +The application program can add additional objects to the global table +by using functions documented in the +.Xr OBJ_create 3 +manual page. +Consequently, there are three classes of objects: +built-in table objects, user-defined table objects, and non-table objects. .Pp -.Fn OBJ_nid2obj , -.Fn OBJ_nid2ln , +In addition to the OID, each object can hold +a long name, a short name, and a numerical identifier (NID). +Even though the concept of NIDs is specific to the library +and not standardized, using the NID is often the most convenient way +for source code to refer to a specific OID. +The NIDs of the built-in objects are available as defined constants. +.Pp +Built-in table objects have certain advantages +over objects that are not in the global table: +for example, their NIDs can be used in C language switch statements. +They are also shared: +there is only a single static constant structure for each built-on OID. +.Pp +Some functions operate on table objects only: +.Pp +.Fn OBJ_nid2obj +retrieves the table object associated with the +.Fa nid . +.Fn OBJ_nid2ln and .Fn OBJ_nid2sn -convert the NID -.Fa n -to an -.Vt ASN1_OBJECT -structure, its long name, and its short name, respectively, or return -.Dv NULL -if an error occurred. +retrieve its long and short name, respectively. .Pp -.Fn OBJ_obj2nid , -.Fn OBJ_ln2nid , +.Fn OBJ_obj2nid +retrieves the NID associated with the given +.Fa object , +which is either the NID stored in the +.Fa object +itself, if any, or otherwise the NID stored in a table object +containing the same OID. +.Pp +.Fn OBJ_ln2nid and .Fn OBJ_sn2nid -return the corresponding NID for the object -.Fa o , -the long name -.Fa ln , +retrieve the NID from the table object with the long name +.Fa ln or the short name .Fa sn , -respectively, or -.Dv NID_undef -if an error occurred. +respectively. .Pp .Fn OBJ_txt2nid -returns the NID corresponding to text string -.Fa s . -.Fa s -can be a long name, a short name, or the numerical representation -of an object. +retrieves the NID from the table object described by the text string +.Fa s , +which can be a long name, a short name, +or the numerical representation of an OID. +.Pp +The remaining functions can be used both on table objects +and on objects that are not in the global table: .Pp .Fn OBJ_txt2obj -converts the text string -.Fa s -into an -.Vt ASN1_OBJECT -structure. +retrieves or creates an object matching the text string +.Fa s . If .Fa no_name -is 0 then long names and short names will be interpreted as well as -numerical forms. +is 1, only the numerical representation of an OID is accepted. If .Fa no_name -is 1, only the numerical form is acceptable. +is 0, long names and short names are accepted as well. .Pp .Fn OBJ_obj2txt -converts the -.Vt ASN1_OBJECT -.Fa a -into a textual representation. -The representation is written as a NUL terminated string to +writes a NUL terminated textual representation +of the OID contained in the given +.Fa object +into .Fa buf . At most .Fa buf_len @@ -221,8 +237,13 @@ bytes are written, truncating the result if necessary. The total amount of space required is returned. If .Fa no_name -is 0 and the object has a long or short name, then that will be used, -otherwise the numerical form will be used. +is 0 and the table object containing the same OID +contains a long name, the long name is written. +Otherwise, if +.Fa no_name +is 0 and the table object containing the same OID +contains a short name, the short name is written. +Otherwise, the numerical representation of the OID is written. .Pp .Fn i2t_ASN1_OBJECT is the same as @@ -232,18 +253,18 @@ with set to 0. .Pp .Fn i2a_ASN1_OBJECT -writes a textual representation of -.Fa a +writes a textual representation of the OID contained in the given +.Fa object to .Fa out_bio using .Xr BIO_write 3 . It does not write a terminating NUL byte. -If -.Fa a -is +If the +.Fa object +argument is .Dv NULL -or contains no data, it writes the 4-byte string +or contains no OID, it writes the 4-byte string .Qq NULL . If .Fn i2t_ASN1_OBJECT @@ -255,103 +276,128 @@ Otherwise, it writes the string constructed with .Fn i2t_ASN1_OBJECT . .Pp .Fn OBJ_cmp -compares +tests whether .Fa a -to -.Fa b . -If the two are identical, 0 is returned. +and +.Fa b +represent the same ASN.1 +.Vt OBJECT IDENTIFIER . +Any names and NIDs contained in the two objects are ignored, +even if they differ between both objects. .Pp .Fn OBJ_dup -returns a deep copy of -.Fa o -if -.Fa o -is marked as dynamically allocated. -The new object and all data contained in it is marked as dynamically +returns a deep copy of the given +.Fa object +if it is marked as dynamically allocated. +The new object and all data contained in it are marked as dynamically allocated. -If -.Fa o +If the given +.Fa object is not marked as dynamically allocated, .Fn OBJ_dup -just returns -.Fa o +just returns a pointer to the +.Fa object itself. -.Pp -Objects can have a short name, a long name, and a numerical -identifier (NID) associated with them. -A standard set of objects is represented in an internal table. -The appropriate values are defined in the header file -.In openssl/objects.h . -.Pp -For example, the OID for commonName has the following definitions: -.Bd -literal -#define SN_commonName "CN" -#define LN_commonName "commonName" -#define NID_commonName 13 -.Ed -.Pp -New objects can be added by calling -.Xr OBJ_create 3 . -.Pp -Table objects have certain advantages over other objects: for example -their NIDs can be used in a C language switch statement. -They are also static constant structures which are shared: that is there -is only a single constant structure for each table object. -.Pp -Objects which are not in the table have the NID value -.Dv NID_undef . -.Pp -Objects do not need to be in the internal tables to be processed: -the functions -.Fn OBJ_txt2obj -and -.Fn OBJ_obj2txt -can process the numerical form of an OID. .Sh RETURN VALUES -.Fn OBJ_nid2obj , -.Fn OBJ_txt2obj , -and -.Fn OBJ_dup -return an -.Vt ASN1_OBJECT -object or +Application code should treat all returned values \(em +objects, names, and NIDs \(em as constants. +.Pp +.Fn OBJ_nid2obj +returns a pointer to a table object owned by the library or .Dv NULL -if an error occurs. +if no matching table object is found. .Pp .Fn OBJ_nid2ln and .Fn OBJ_nid2sn -return a valid string or +return a pointer to a string owned by a table object or .Dv NULL -on error. -.Pp -.Fn OBJ_obj2nid , -.Fn OBJ_ln2nid , -.Fn OBJ_sn2nid , +if no matching table object is found. +For +.Dv NID_undef , +they return the constant static strings +.Qq undefined and -.Fn OBJ_txt2nid -return a NID or +.Qq UNDEF , +respectively. +.Pp +.Fn OBJ_obj2nid +returns an NID on success, or .Dv NID_undef -on error. +if +.Fa object +is +.Dv NULL , +does not contain an OID, +if no table object matching the OID is found, +or if the matching object does not contain an NID. +.Pp +.Fn OBJ_ln2nid +and +.Fn OBJ_sn2nid +return an NID on success or +.Dv NID_undef +if no matching table object is found +or if the matching object does not contain an NID. +.Pp +.Fn OBJ_txt2nid +returns an NID on success or +.Dv NID_undef +if parsing of +.Fa s +or memory allocation fails, if no matching table object is found, +or if the matching object does not contain an NID. +.Pp +.Fn OBJ_txt2obj +returns a pointer to a table object owned by the library if lookup of +.Fa s +as a long or short name succeeds. +Otherwise, it returns a newly created object, +transferring ownership to the caller, or +.Dv NULL +if parsing of +.Fa s +or memory allocation fails. .Pp .Fn OBJ_obj2txt and .Fn i2t_ASN1_OBJECT return the amount of space required in bytes, -including the terminating NUL byte. -.Pp -.Fn i2a_ASN1_OBJECT -returns the number of bytes written, even if -.Fa a -is invalid or contains invalid data, -but a negative value if memory allocation or a write operation fails. +including the terminating NUL byte, +or zero if an error occurs before the required space can be calculated, +in particular if +.Fa buf_len +is negative, +.Fa object +is +.Dv NULL +or does not contain an OID, +or if memory allocation fails. .Pp .Fn OBJ_cmp -returns 0 if the contents of -.Fa a -and -.Fa b -are identical, or non-zero otherwise. +returns 0 if both objects refer to the same OID +or neither of them are associated with any OID, +or a non-zero value if at least one of them refers to an OID +but the other one does not refer to the same OID. +.Pp +.Fn OBJ_dup +returns the pointer to the original +.Fa object +if it is not marked as dynamically allocated. +Otherwise, it returns a newly created object, +transferring ownership to the caller, or +.Dv NULL +if +.Fa object +is +.Dv NULL +or memory allocation fails. +.Pp +.Fn i2a_ASN1_OBJECT +returns the number of bytes written, even if the given +.Fa object +is invalid or contains invalid data, +but a negative value if memory allocation or a write operation fails. .Pp In some cases of failure of .Fn OBJ_nid2obj , @@ -367,23 +413,23 @@ and the reason can be determined with .Xr ERR_get_error 3 . .Sh EXAMPLES -Create an object for +Retrieve the object for .Sy commonName : .Bd -literal -offset indent -ASN1_OBJECT *o; -o = OBJ_nid2obj(NID_commonName); +ASN1_OBJECT *object; +object = OBJ_nid2obj(NID_commonName); .Ed .Pp -Check if an object is +Check whether an object contains the OID for .Sy commonName : .Bd -literal -offset indent -if (OBJ_obj2nid(obj) == NID_commonName) +if (OBJ_obj2nid(object) == NID_commonName) /* Do something */ .Ed .Pp Create a new object directly: .Bd -literal -offset indent -obj = OBJ_txt2obj("1.2.3.4", 1); +object = OBJ_txt2obj("1.2.3.4", 1); .Ed .Sh SEE ALSO .Xr ASN1_OBJECT_new 3 , @@ -416,7 +462,52 @@ first appeared in OpenSSL 0.9.2b. first appeared in OpenSSL 0.9.4. Both functions have been available since .Ox 2.6 . +.Sh CAVEATS +The API contract of +.Fn OBJ_txt2obj +when called with a +.Fa no_name +argument of 0 and of +.Fn OBJ_dup +is scary in so far as the caller cannot find out from the returned +object whether it is owned by the library or whether ownership was +transferred to the caller. +Consequently, it is best practice to assume that ownership of the object +may have been transferred and call +.Xr ASN1_OBJECT_free 3 +on the returned object when the caller no longer needs it. +In case the library retained ownership of the returned object, +.Xr ASN1_OBJECT_free 3 +has no effect and is harmless. +.Pp +Objects returned from +.Fn OBJ_txt2obj +with a +.Fa no_name +argument of 1 always require +.Xr ASN1_OBJECT_free 3 +to prevent memory leaks. +.Pp +Objects returned from +.Fn OBJ_nid2obj +never require +.Xr ASN1_OBJECT_free 3 , +but calling it anyway has no effect and is harmless. .Sh BUGS +Usually, an object is expected to contain an NID other than +.Dv NID_undef +if and only if it is a table object. +However, this is not an invariant guaranteed by the API. +In particular, +.Xr ASN1_OBJECT_create 3 +allows the creation of non-table objects containing bogus NIDs. +.Fn OBJ_obj2nid +returns such bogus NIDs even though +.Fn OBJ_nid2obj +cannot use them for retrieval. +On top of that, the global table contains one built-in object with an NID of +.Dv NID_undef . +.Pp .Fn OBJ_obj2txt is awkward and messy to use: it doesn't follow the convention of other OpenSSL functions where the buffer can be set to diff --git a/lib/libcrypto/objects/obj_dat.c b/lib/libcrypto/objects/obj_dat.c index 9c4c3179f..6cfbf8f77 100644 --- a/lib/libcrypto/objects/obj_dat.c +++ b/lib/libcrypto/objects/obj_dat.c @@ -1,4 +1,4 @@ -/* $OpenBSD: obj_dat.c,v 1.60 2023/08/17 09:28:43 tb Exp $ */ +/* $OpenBSD: obj_dat.c,v 1.61 2023/09/05 14:59:00 tb Exp $ */ /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) * All rights reserved. * @@ -208,15 +208,6 @@ added_obj_cmp(const ADDED_OBJ *ca, const ADDED_OBJ *cb) } static IMPLEMENT_LHASH_COMP_FN(added_obj, ADDED_OBJ) -static int -init_added(void) -{ - if (added != NULL) - return (1); - added = lh_ADDED_OBJ_new(); - return (added != NULL); -} - static void cleanup1_doall(ADDED_OBJ *a) { @@ -289,13 +280,16 @@ LCRYPTO_ALIAS(OBJ_new_nid); int OBJ_add_object(const ASN1_OBJECT *obj) { - ASN1_OBJECT *o; + ASN1_OBJECT *o = NULL; ADDED_OBJ *ao[4] = {NULL, NULL, NULL, NULL}, *aop; int i; if (added == NULL) - if (!init_added()) - return (0); + added = lh_ADDED_OBJ_new(); + if (added == NULL) + goto err; + if (obj == NULL || obj->nid == NID_undef) + goto err; if ((o = OBJ_dup(obj)) == NULL) goto err; if (!(ao[ADDED_NID] = malloc(sizeof(ADDED_OBJ)))) diff --git a/sbin/pfctl/pfctl_radix.c b/sbin/pfctl/pfctl_radix.c index b30b36df3..446329daf 100644 --- a/sbin/pfctl/pfctl_radix.c +++ b/sbin/pfctl/pfctl_radix.c @@ -1,4 +1,4 @@ -/* $OpenBSD: pfctl_radix.c,v 1.37 2020/01/15 22:31:51 kn Exp $ */ +/* $OpenBSD: pfctl_radix.c,v 1.38 2023/09/05 15:37:07 robert Exp $ */ /* * Copyright (c) 2002 Cedric Berger @@ -53,7 +53,7 @@ extern int dev; -static int pfr_next_token(char buf[], FILE *); +static int pfr_next_token(char buf[BUF_SIZE], FILE *); int diff --git a/sbin/unwind/frontend.c b/sbin/unwind/frontend.c index 3bc7b485c..ff59a38b2 100644 --- a/sbin/unwind/frontend.c +++ b/sbin/unwind/frontend.c @@ -1,4 +1,4 @@ -/* $OpenBSD: frontend.c,v 1.78 2023/04/30 23:46:52 jsg Exp $ */ +/* $OpenBSD: frontend.c,v 1.79 2023/09/05 15:44:39 florian Exp $ */ /* * Copyright (c) 2018 Florian Obser @@ -773,7 +773,7 @@ handle_query(struct pending_query *pq) } rcode = parse_edns_from_query_pkt(pq->qbuf, &pq->edns, NULL, NULL, - pq->region); + NULL, 0, pq->region); if (rcode != LDNS_RCODE_NOERROR) { error_answer(pq, rcode); goto send_answer; @@ -927,7 +927,7 @@ synthesize_dns64_answer(struct pending_query *pq) rinfo->qdcount, rinfo->ttl, rinfo->prefetch_ttl, rinfo->serve_expired_ttl, rinfo->an_numrrsets, rinfo->ns_numrrsets, rinfo->ar_numrrsets, rinfo->rrset_count, - rinfo->security); + rinfo->security, rinfo->reason_bogus); if (!synth_rinfo) goto srvfail; @@ -1059,7 +1059,7 @@ resend_dns64_query(struct pending_query *opq) } rcode = parse_edns_from_query_pkt(pq->qbuf, &pq->edns, NULL, NULL, - pq->region); + NULL, 0, pq->region); if (rcode != LDNS_RCODE_NOERROR) { error_answer(pq, rcode); goto send_answer; diff --git a/sbin/unwind/libunbound/config.h b/sbin/unwind/libunbound/config.h index d3f00435c..eac77c3b0 100644 --- a/sbin/unwind/libunbound/config.h +++ b/sbin/unwind/libunbound/config.h @@ -368,6 +368,9 @@ /* Define if we have LibreSSL */ #define HAVE_LIBRESSL 1 +/* Define to 1 if you have the header file. */ +/* #undef HAVE_LINUX_NET_TSTAMP_H */ + /* Define to 1 if you have the `localtime_r' function. */ #define HAVE_LOCALTIME_R 1 @@ -773,7 +776,7 @@ #define PACKAGE_NAME "unbound" /* Define to the full name and version of this package. */ -#define PACKAGE_STRING "unbound 1.17.0" +#define PACKAGE_STRING "unbound 1.18.0" /* Define to the one symbol short name of this package. */ #define PACKAGE_TARNAME "unbound" @@ -782,7 +785,7 @@ #define PACKAGE_URL "" /* Define to the version of this package. */ -#define PACKAGE_VERSION "1.17.0" +#define PACKAGE_VERSION "1.18.0" /* default pidfile location */ #define PIDFILE "" @@ -805,7 +808,7 @@ #define ROOT_CERT_FILE "/var/unbound/etc/icannbundle.pem" /* version number for resource files */ -#define RSRC_PACKAGE_VERSION 1,17,0,0 +#define RSRC_PACKAGE_VERSION 1,18,0,0 /* Directory to chdir to */ #define RUN_DIR "/var/unbound/etc" diff --git a/sbin/unwind/libunbound/daemon/acl_list.h b/sbin/unwind/libunbound/daemon/acl_list.h index 72f86d763..db1087610 100644 --- a/sbin/unwind/libunbound/daemon/acl_list.h +++ b/sbin/unwind/libunbound/daemon/acl_list.h @@ -64,8 +64,12 @@ enum acl_access { acl_allow, /** allow full access for all queries, recursion and cache snooping */ acl_allow_snoop, - /** allow full access for recursion queries and set RD flag regardless of request */ - acl_allow_setrd + /** allow full access for recursion queries and set RD flag regardless + * of request */ + acl_allow_setrd, + /** allow full access for recursion (+RD) queries if valid cookie + * present or stateful transport */ + acl_allow_cookie }; /** diff --git a/sbin/unwind/libunbound/daemon/stats.h b/sbin/unwind/libunbound/daemon/stats.h index 5756f38a1..48decffb4 100644 --- a/sbin/unwind/libunbound/daemon/stats.h +++ b/sbin/unwind/libunbound/daemon/stats.h @@ -126,4 +126,11 @@ void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c, */ void server_stats_insrcode(struct ub_server_stats* stats, struct sldns_buffer* buf); +/** + * Add DNS Cookie stats for this query + * @param stats: the stats + * @param edns: edns record + */ +void server_stats_downstream_cookie(struct ub_server_stats* stats, + struct edns_data* edns); #endif /* DAEMON_STATS_H */ diff --git a/sbin/unwind/libunbound/daemon/worker.h b/sbin/unwind/libunbound/daemon/worker.h index d4d337a7a..520da5018 100644 --- a/sbin/unwind/libunbound/daemon/worker.h +++ b/sbin/unwind/libunbound/daemon/worker.h @@ -118,7 +118,7 @@ struct worker { /** do we need to restart or quit (on signal) */ int need_to_exit; /** allocation cache for this thread */ - struct alloc_cache alloc; + struct alloc_cache *alloc; /** per thread statistics */ struct ub_server_stats stats; /** thread scratch regional */ @@ -131,6 +131,8 @@ struct worker { /** dnstap environment, changed for this thread */ struct dt_env dtenv; #endif + /** reuse existing cache on reload if other conditions allow it. */ + int reuse_cache; }; /** diff --git a/sbin/unwind/libunbound/dns64/dns64.c b/sbin/unwind/libunbound/dns64/dns64.c index 7010662a4..f74bfef2e 100644 --- a/sbin/unwind/libunbound/dns64/dns64.c +++ b/sbin/unwind/libunbound/dns64/dns64.c @@ -59,7 +59,7 @@ ******************************************************************************/ /** - * This is the default DNS64 prefix that is used whent he dns64 module is listed + * This is the default DNS64 prefix that is used when the dns64 module is listed * in module-config but when the dns64-prefix variable is not present. */ static const char DEFAULT_DNS64_PREFIX[] = "64:ff9b::/96"; @@ -841,7 +841,7 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate cp = construct_reply_info_base(super->region, rep->flags, rep->qdcount, rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl, rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets, - rep->rrset_count, rep->security); + rep->rrset_count, rep->security, LDNS_EDE_NONE); if(!cp) return; diff --git a/sbin/unwind/libunbound/dnstap/dnstap.h b/sbin/unwind/libunbound/dnstap/dnstap.h index 449fae727..169bdc2c6 100644 --- a/sbin/unwind/libunbound/dnstap/dnstap.h +++ b/sbin/unwind/libunbound/dnstap/dnstap.h @@ -126,13 +126,15 @@ dt_delete(struct dt_env *env); * @param rsock: local (service) address/port. * @param cptype: comm_udp or comm_tcp. * @param qmsg: query message. + * @param tstamp: timestamp or NULL if none provided. */ void dt_msg_send_client_query(struct dt_env *env, struct sockaddr_storage *qsock, struct sockaddr_storage *rsock, enum comm_point_type cptype, - struct sldns_buffer *qmsg); + struct sldns_buffer *qmsg, + struct timeval* tstamp); /** * Create and send a new dnstap "Message" event of type CLIENT_RESPONSE. diff --git a/sbin/unwind/libunbound/iterator/iter_delegpt.c b/sbin/unwind/libunbound/iterator/iter_delegpt.c index fd07aaa13..c8b9a3ffe 100644 --- a/sbin/unwind/libunbound/iterator/iter_delegpt.c +++ b/sbin/unwind/libunbound/iterator/iter_delegpt.c @@ -321,6 +321,45 @@ void delegpt_log(enum verbosity_value v, struct delegpt* dp) } } +int +delegpt_addr_on_result_list(struct delegpt* dp, struct delegpt_addr* find) +{ + struct delegpt_addr* a = dp->result_list; + while(a) { + if(a == find) + return 1; + a = a->next_result; + } + return 0; +} + +void +delegpt_usable_list_remove_addr(struct delegpt* dp, struct delegpt_addr* del) +{ + struct delegpt_addr* usa = dp->usable_list, *prev = NULL; + while(usa) { + if(usa == del) { + /* snip off the usable list */ + if(prev) + prev->next_usable = usa->next_usable; + else dp->usable_list = usa->next_usable; + return; + } + prev = usa; + usa = usa->next_usable; + } +} + +void +delegpt_add_to_result_list(struct delegpt* dp, struct delegpt_addr* a) +{ + if(delegpt_addr_on_result_list(dp, a)) + return; + delegpt_usable_list_remove_addr(dp, a); + a->next_result = dp->result_list; + dp->result_list = a; +} + void delegpt_add_unused_targets(struct delegpt* dp) { diff --git a/sbin/unwind/libunbound/iterator/iter_delegpt.h b/sbin/unwind/libunbound/iterator/iter_delegpt.h index 586597a69..49f6f6b81 100644 --- a/sbin/unwind/libunbound/iterator/iter_delegpt.h +++ b/sbin/unwind/libunbound/iterator/iter_delegpt.h @@ -457,4 +457,29 @@ int delegpt_add_target_mlc(struct delegpt* dp, uint8_t* name, size_t namelen, /** get memory in use by dp */ size_t delegpt_get_mem(struct delegpt* dp); +/** + * See if the addr is on the result list. + * @param dp: delegation point. + * @param find: the pointer is searched for on the result list. + * @return 1 if found, 0 if not found. + */ +int delegpt_addr_on_result_list(struct delegpt* dp, struct delegpt_addr* find); + +/** + * Remove the addr from the usable list. + * @param dp: the delegation point. + * @param del: the addr to remove from the list, the pointer is searched for. + */ +void delegpt_usable_list_remove_addr(struct delegpt* dp, + struct delegpt_addr* del); + +/** + * Add the delegpt_addr back to the result list, if it is not already on + * the result list. Also removes it from the usable list. + * @param dp: delegation point. + * @param a: addr to add, nothing happens if it is already on the result list. + * It is removed from the usable list. + */ +void delegpt_add_to_result_list(struct delegpt* dp, struct delegpt_addr* a); + #endif /* ITERATOR_ITER_DELEGPT_H */ diff --git a/sbin/unwind/libunbound/iterator/iter_resptype.c b/sbin/unwind/libunbound/iterator/iter_resptype.c index c2b824a0f..e85595b84 100644 --- a/sbin/unwind/libunbound/iterator/iter_resptype.c +++ b/sbin/unwind/libunbound/iterator/iter_resptype.c @@ -284,6 +284,13 @@ response_type_from_server(int rdset, /* If we've gotten this far, this is NOERROR/NODATA (which could * be an entirely empty message) */ + /* but ignore entirely empty messages, noerror/nodata has a soa + * negative ttl value in the authority section, this makes it try + * again at another authority. And turns it from a 5 second empty + * message into a 5 second servfail response. */ + if(msg->rep->an_numrrsets == 0 && msg->rep->ns_numrrsets == 0 && + msg->rep->ar_numrrsets == 0) + return RESPONSE_TYPE_THROWAWAY; /* check if recursive answer; saying it has empty cache */ if( (msg->rep->flags&BIT_RA) && !(msg->rep->flags&BIT_AA) && !rdset) return RESPONSE_TYPE_REC_LAME; diff --git a/sbin/unwind/libunbound/iterator/iter_scrub.c b/sbin/unwind/libunbound/iterator/iter_scrub.c index f093c1bf9..d1fedcd0f 100644 --- a/sbin/unwind/libunbound/iterator/iter_scrub.c +++ b/sbin/unwind/libunbound/iterator/iter_scrub.c @@ -346,6 +346,26 @@ soa_in_auth(struct msg_parse* msg) return 0; } +/** Check if type is allowed in the authority section */ +static int +type_allowed_in_authority_section(uint16_t tp) +{ + if(tp == LDNS_RR_TYPE_SOA || tp == LDNS_RR_TYPE_NS || + tp == LDNS_RR_TYPE_DS || tp == LDNS_RR_TYPE_NSEC || + tp == LDNS_RR_TYPE_NSEC3) + return 1; + return 0; +} + +/** Check if type is allowed in the additional section */ +static int +type_allowed_in_additional_section(uint16_t tp) +{ + if(tp == LDNS_RR_TYPE_A || tp == LDNS_RR_TYPE_AAAA) + return 1; + return 0; +} + /** * This routine normalizes a response. This includes removing "irrelevant" * records from the answer and additional sections and (re)synthesizing @@ -355,11 +375,13 @@ soa_in_auth(struct msg_parse* msg) * @param msg: msg to normalize. * @param qinfo: original query. * @param region: where to allocate synthesized CNAMEs. + * @param env: module env with config options. * @return 0 on error. */ static int scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, - struct query_info* qinfo, struct regional* region) + struct query_info* qinfo, struct regional* region, + struct module_env* env) { uint8_t* sname = qinfo->qname; size_t snamelen = qinfo->qname_len; @@ -511,6 +533,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, /* Mark additional names from AUTHORITY */ while(rrset && rrset->section == LDNS_SECTION_AUTHORITY) { + /* protect internals of recursor by making sure to del these */ if(rrset->type==LDNS_RR_TYPE_DNAME || rrset->type==LDNS_RR_TYPE_CNAME || rrset->type==LDNS_RR_TYPE_A || @@ -519,6 +542,13 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, "RRset:", pkt, msg, prev, &rrset); continue; } + /* Allowed list of types in the authority section */ + if(env->cfg->harden_unknown_additional && + !type_allowed_in_authority_section(rrset->type)) { + remove_rrset("normalize: removing irrelevant " + "RRset:", pkt, msg, prev, &rrset); + continue; + } /* only one NS set allowed in authority section */ if(rrset->type==LDNS_RR_TYPE_NS) { /* NS set must be pertinent to the query */ @@ -576,7 +606,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, * found in ANSWER and AUTHORITY. */ /* These records have not been marked OK previously */ while(rrset && rrset->section == LDNS_SECTION_ADDITIONAL) { - /* FIXME: what about other types? */ if(rrset->type==LDNS_RR_TYPE_A || rrset->type==LDNS_RR_TYPE_AAAA) { @@ -589,6 +618,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, continue; } } + /* protect internals of recursor by making sure to del these */ if(rrset->type==LDNS_RR_TYPE_DNAME || rrset->type==LDNS_RR_TYPE_CNAME || rrset->type==LDNS_RR_TYPE_NS) { @@ -596,6 +626,13 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, "RRset:", pkt, msg, prev, &rrset); continue; } + /* Allowed list of types in the additional section */ + if(env->cfg->harden_unknown_additional && + !type_allowed_in_additional_section(rrset->type)) { + remove_rrset("normalize: removing irrelevant " + "RRset:", pkt, msg, prev, &rrset); + continue; + } prev = rrset; rrset = rrset->rrset_all_next; } @@ -846,7 +883,7 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg, } /* normalize the response, this cleans up the additional. */ - if(!scrub_normalize(pkt, msg, qinfo, region)) + if(!scrub_normalize(pkt, msg, qinfo, region, env)) return 0; /* delete all out-of-zone information */ if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie)) diff --git a/sbin/unwind/libunbound/iterator/iter_utils.c b/sbin/unwind/libunbound/iterator/iter_utils.c index 56b184a02..10a8ec3eb 100644 --- a/sbin/unwind/libunbound/iterator/iter_utils.c +++ b/sbin/unwind/libunbound/iterator/iter_utils.c @@ -71,6 +71,11 @@ /** time when nameserver glue is said to be 'recent' */ #define SUSPICION_RECENT_EXPIRY 86400 +/** if NAT64 is enabled and no NAT64 prefix is configured, first fall back to + * DNS64 prefix. If that is not configured, fall back to this default value. + */ +static const char DEFAULT_NAT64_PREFIX[] = "64:ff9b::/96"; + /** fillup fetch policy array */ static void fetch_fill(struct iter_env* ie, const char* str) @@ -142,6 +147,7 @@ caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg) int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg) { + const char *nat64_prefix; int i; /* target fetch policy */ if(!read_fetch_policy(iter_env, cfg->target_fetch_policy)) @@ -172,9 +178,35 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg) } } + + nat64_prefix = cfg->nat64_prefix; + if(!nat64_prefix) + nat64_prefix = cfg->dns64_prefix; + if(!nat64_prefix) + nat64_prefix = DEFAULT_NAT64_PREFIX; + if(!netblockstrtoaddr(nat64_prefix, 0, &iter_env->nat64_prefix_addr, + &iter_env->nat64_prefix_addrlen, + &iter_env->nat64_prefix_net)) { + log_err("cannot parse nat64-prefix netblock: %s", nat64_prefix); + return 0; + } + if(!addr_is_ip6(&iter_env->nat64_prefix_addr, + iter_env->nat64_prefix_addrlen)) { + log_err("nat64-prefix is not IPv6: %s", cfg->nat64_prefix); + return 0; + } + if(!prefixnet_is_nat64(iter_env->nat64_prefix_net)) { + log_err("nat64-prefix length it not 32, 40, 48, 56, 64 or 96: %s", + nat64_prefix); + return 0; + } + iter_env->supports_ipv6 = cfg->do_ip6; iter_env->supports_ipv4 = cfg->do_ip4; + iter_env->use_nat64 = cfg->do_nat64; iter_env->outbound_msg_retry = cfg->outbound_msg_retry; + iter_env->max_sent_count = cfg->max_sent_count; + iter_env->max_query_restarts = cfg->max_query_restarts; return 1; } @@ -238,7 +270,8 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env, if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) { return -1; /* there is no ip6 available */ } - if(!iter_env->supports_ipv4 && !addr_is_ip6(&a->addr, a->addrlen)) { + if(!iter_env->supports_ipv4 && !iter_env->use_nat64 && + !addr_is_ip6(&a->addr, a->addrlen)) { return -1; /* there is no ip4 available */ } /* check lameness - need zone , class info */ @@ -745,10 +778,15 @@ iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp) int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, - struct delegpt* dp, int supports_ipv4, int supports_ipv6) + struct delegpt* dp, int supports_ipv4, int supports_ipv6, + int use_nat64) { struct delegpt_ns* ns; struct delegpt_addr* a; + + if(supports_ipv6 && use_nat64) + supports_ipv4 = 1; + /* check: * o RD qflag is on. * o no addresses are provided. @@ -1308,8 +1346,7 @@ void iter_dec_attempts(struct delegpt* dp, int d, int outbound_msg_retry) for(a=dp->target_list; a; a = a->next_target) { if(a->attempts >= outbound_msg_retry) { /* add back to result list */ - a->next_result = dp->result_list; - dp->result_list = a; + delegpt_add_to_result_list(dp, a); } if(a->attempts > d) a->attempts -= d; diff --git a/sbin/unwind/libunbound/iterator/iter_utils.h b/sbin/unwind/libunbound/iterator/iter_utils.h index 850be96a6..fa860fa68 100644 --- a/sbin/unwind/libunbound/iterator/iter_utils.h +++ b/sbin/unwind/libunbound/iterator/iter_utils.h @@ -189,10 +189,13 @@ void iter_mark_pside_cycle_targets(struct module_qstate* qstate, * if not, then the IPv4 addresses are useless. * @param supports_ipv6: if we support ipv6 for lookups to the target. * if not, then the IPv6 addresses are useless. + * @param use_nat64: if we support NAT64 for lookups to the target. + * if yes, IPv4 addresses are useful even if we don't support IPv4. * @return true if dp is useless. */ -int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, - struct delegpt* dp, int supports_ipv4, int supports_ipv6); +int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, + struct delegpt* dp, int supports_ipv4, int supports_ipv6, + int use_nat64); /** * See if qname has DNSSEC needs. This is true if there is a trust anchor above diff --git a/sbin/unwind/libunbound/iterator/iterator.c b/sbin/unwind/libunbound/iterator/iterator.c index 2f3ad06fe..1548dfcae 100644 --- a/sbin/unwind/libunbound/iterator/iterator.c +++ b/sbin/unwind/libunbound/iterator/iterator.c @@ -255,7 +255,7 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super) log_err("out of memory adding missing"); } delegpt_mark_neg(dpns, qstate->qinfo.qtype); - if((dpns->got4 == 2 || !ie->supports_ipv4) && + if((dpns->got4 == 2 || (!ie->supports_ipv4 && !ie->use_nat64)) && (dpns->got6 == 2 || !ie->supports_ipv6)) { dpns->resolved = 1; /* mark as failed */ target_count_increase_nx(super_iq, 1); @@ -302,81 +302,65 @@ error_response(struct module_qstate* qstate, int id, int rcode) static int error_response_cache(struct module_qstate* qstate, int id, int rcode) { - if(!qstate->no_cache_store) { - /* store in cache */ - struct reply_info err; - if(qstate->prefetch_leeway > NORR_TTL) { - verbose(VERB_ALGO, "error response for prefetch in cache"); - /* attempt to adjust the cache entry prefetch */ - if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo, - NORR_TTL, qstate->query_flags)) - return error_response(qstate, id, rcode); - /* if that fails (not in cache), fall through to store err */ - } - if(qstate->env->cfg->serve_expired) { - /* if serving expired contents, and such content is - * already available, don't overwrite this servfail */ - struct msgreply_entry* msg; - if((msg=msg_cache_lookup(qstate->env, - qstate->qinfo.qname, qstate->qinfo.qname_len, - qstate->qinfo.qtype, qstate->qinfo.qclass, - qstate->query_flags, 0, - qstate->env->cfg->serve_expired_ttl_reset)) - != NULL) { - if(qstate->env->cfg->serve_expired_ttl_reset) { - struct reply_info* rep = - (struct reply_info*)msg->entry.data; - if(rep && *qstate->env->now + - qstate->env->cfg->serve_expired_ttl > - rep->serve_expired_ttl) { - rep->serve_expired_ttl = - *qstate->env->now + - qstate->env->cfg->serve_expired_ttl; - } - } - lock_rw_unlock(&msg->entry.lock); - return error_response(qstate, id, rcode); - } - /* serving expired contents, but nothing is cached - * at all, so the servfail cache entry is useful - * (stops waste of time on this servfail NORR_TTL) */ - } else { - /* don't overwrite existing (non-expired) data in - * cache with a servfail */ - struct msgreply_entry* msg; - if((msg=msg_cache_lookup(qstate->env, - qstate->qinfo.qname, qstate->qinfo.qname_len, - qstate->qinfo.qtype, qstate->qinfo.qclass, - qstate->query_flags, *qstate->env->now, 0)) - != NULL) { - struct reply_info* rep = (struct reply_info*) - msg->entry.data; - if(FLAGS_GET_RCODE(rep->flags) == - LDNS_RCODE_NOERROR || - FLAGS_GET_RCODE(rep->flags) == - LDNS_RCODE_NXDOMAIN) { - /* we have a good entry, - * don't overwrite */ - lock_rw_unlock(&msg->entry.lock); - return error_response(qstate, id, rcode); - } - lock_rw_unlock(&msg->entry.lock); - } - - } - memset(&err, 0, sizeof(err)); - err.flags = (uint16_t)(BIT_QR | BIT_RA); - FLAGS_SET_RCODE(err.flags, rcode); - err.qdcount = 1; - err.ttl = NORR_TTL; - err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl); - err.serve_expired_ttl = NORR_TTL; - /* do not waste time trying to validate this servfail */ - err.security = sec_status_indeterminate; - verbose(VERB_ALGO, "store error response in message cache"); - iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL, - qstate->query_flags, qstate->qstarttime); + struct reply_info err; + struct msgreply_entry* msg; + if(qstate->no_cache_store) { + return error_response(qstate, id, rcode); } + if(qstate->prefetch_leeway > NORR_TTL) { + verbose(VERB_ALGO, "error response for prefetch in cache"); + /* attempt to adjust the cache entry prefetch */ + if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo, + NORR_TTL, qstate->query_flags)) + return error_response(qstate, id, rcode); + /* if that fails (not in cache), fall through to store err */ + } + if((msg=msg_cache_lookup(qstate->env, + qstate->qinfo.qname, qstate->qinfo.qname_len, + qstate->qinfo.qtype, qstate->qinfo.qclass, + qstate->query_flags, 0, + qstate->env->cfg->serve_expired_ttl_reset)) != NULL) { + struct reply_info* rep = (struct reply_info*)msg->entry.data; + if(qstate->env->cfg->serve_expired && + qstate->env->cfg->serve_expired_ttl_reset && rep && + *qstate->env->now + qstate->env->cfg->serve_expired_ttl + > rep->serve_expired_ttl) { + verbose(VERB_ALGO, "reset serve-expired-ttl for " + "response in cache"); + rep->serve_expired_ttl = *qstate->env->now + + qstate->env->cfg->serve_expired_ttl; + } + if(rep && (FLAGS_GET_RCODE(rep->flags) == + LDNS_RCODE_NOERROR || + FLAGS_GET_RCODE(rep->flags) == + LDNS_RCODE_NXDOMAIN || + FLAGS_GET_RCODE(rep->flags) == + LDNS_RCODE_YXDOMAIN) && + (qstate->env->cfg->serve_expired || + *qstate->env->now <= rep->ttl)) { + /* we have a good entry, don't overwrite */ + lock_rw_unlock(&msg->entry.lock); + return error_response(qstate, id, rcode); + } + lock_rw_unlock(&msg->entry.lock); + /* nothing interesting is cached (already error response or + * expired good record when we don't serve expired), so this + * servfail cache entry is useful (stops waste of time on this + * servfail NORR_TTL) */ + } + /* store in cache */ + memset(&err, 0, sizeof(err)); + err.flags = (uint16_t)(BIT_QR | BIT_RA); + FLAGS_SET_RCODE(err.flags, rcode); + err.qdcount = 1; + err.ttl = NORR_TTL; + err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl); + err.serve_expired_ttl = NORR_TTL; + /* do not waste time trying to validate this servfail */ + err.security = sec_status_indeterminate; + verbose(VERB_ALGO, "store error response in message cache"); + iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL, + qstate->query_flags, qstate->qstarttime); return error_response(qstate, id, rcode); } @@ -590,6 +574,54 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq, return 1; } +/** fill fail address for later recovery */ +static void +fill_fail_addr(struct iter_qstate* iq, struct sockaddr_storage* addr, + socklen_t addrlen) +{ + if(addrlen == 0) { + iq->fail_addr_type = 0; + return; + } + if(((struct sockaddr_in*)addr)->sin_family == AF_INET) { + iq->fail_addr_type = 4; + memcpy(&iq->fail_addr.in, + &((struct sockaddr_in*)addr)->sin_addr, + sizeof(iq->fail_addr.in)); + } +#ifdef AF_INET6 + else if(((struct sockaddr_in*)addr)->sin_family == AF_INET6) { + iq->fail_addr_type = 6; + memcpy(&iq->fail_addr.in6, + &((struct sockaddr_in6*)addr)->sin6_addr, + sizeof(iq->fail_addr.in6)); + } +#endif + else { + iq->fail_addr_type = 0; + } +} + +/** print fail addr to string */ +static void +print_fail_addr(struct iter_qstate* iq, char* buf, size_t len) +{ + if(iq->fail_addr_type == 4) { + if(inet_ntop(AF_INET, &iq->fail_addr.in, buf, + (socklen_t)len) == 0) + (void)strlcpy(buf, "(inet_ntop error)", len); + } +#ifdef AF_INET6 + else if(iq->fail_addr_type == 6) { + if(inet_ntop(AF_INET6, &iq->fail_addr.in6, buf, + (socklen_t)len) == 0) + (void)strlcpy(buf, "(inet_ntop error)", len); + } +#endif + else + (void)strlcpy(buf, "", len); +} + /** add response specific error information for log servfail */ static void errinf_reply(struct module_qstate* qstate, struct iter_qstate* iq) @@ -597,16 +629,14 @@ errinf_reply(struct module_qstate* qstate, struct iter_qstate* iq) if(qstate->env->cfg->val_log_level < 2 && !qstate->env->cfg->log_servfail) return; if((qstate->reply && qstate->reply->remote_addrlen != 0) || - (iq->fail_reply && iq->fail_reply->remote_addrlen != 0)) { + (iq->fail_addr_type != 0)) { char from[256], frm[512]; if(qstate->reply && qstate->reply->remote_addrlen != 0) addr_to_str(&qstate->reply->remote_addr, qstate->reply->remote_addrlen, from, sizeof(from)); else - addr_to_str(&iq->fail_reply->remote_addr, - iq->fail_reply->remote_addrlen, from, - sizeof(from)); + print_fail_addr(iq, from, sizeof(from)); snprintf(frm, sizeof(frm), "from %s", from); errinf(qstate, frm); } @@ -1137,7 +1167,7 @@ generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq, * Generate a NS check request to obtain authoritative information * on an NS rrset. * - * @param qstate: the qtstate that triggered the need to prime. + * @param qstate: the qstate that triggered the need to prime. * @param iq: iterator query state. * @param id: module id. */ @@ -1314,7 +1344,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq, /* We enforce a maximum number of query restarts. This is primarily a * cheap way to prevent CNAME loops. */ - if(iq->query_restart_count > MAX_RESTART_COUNT) { + if(iq->query_restart_count > ie->max_query_restarts) { verbose(VERB_QUERY, "request has exceeded the maximum number" " of query restarts with %d", iq->query_restart_count); errinf(qstate, "request has exceeded the maximum number " @@ -1451,6 +1481,19 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq, errinf(qstate, "malloc failure for forward zone"); return error_response(qstate, id, LDNS_RCODE_SERVFAIL); } + if((qstate->query_flags&BIT_RD)==0) { + /* If the server accepts RD=0 queries and forwards + * with RD=1, then if the server is listed as an NS + * entry, it starts query loops. Stop that loop by + * disallowing the query. The RD=0 was previously used + * to check the cache with allow_snoop. For stubs, + * the iterator pass would have primed the stub and + * then cached information can be used for further + * queries. */ + verbose(VERB_ALGO, "cannot forward RD=0 query, to stop query loops"); + errinf(qstate, "cannot forward RD=0 query"); + return error_response(qstate, id, LDNS_RCODE_SERVFAIL); + } iq->refetch_glue = 0; iq->minimisation_state = DONOT_MINIMISE_STATE; /* the request has been forwarded. @@ -1560,18 +1603,19 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq, /* see if this dp not useless. * It is useless if: - * o all NS items are required glue. + * o all NS items are required glue. * or the query is for NS item that is required glue. * o no addresses are provided. * o RD qflag is on. * Instead, go up one level, and try to get even further - * If the root was useless, use safety belt information. + * If the root was useless, use safety belt information. * Only check cache returns, because replies for servers * could be useless but lead to loops (bumping into the * same server reply) if useless-checked. */ - if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags, - iq->dp, ie->supports_ipv4, ie->supports_ipv6)) { + if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags, + iq->dp, ie->supports_ipv4, ie->supports_ipv6, + ie->use_nat64)) { struct delegpt* retdp = NULL; if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen, iq->qchase.qclass, &retdp)) { if(retdp) { @@ -1932,7 +1976,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq, break; } /* Send the A request. */ - if(ie->supports_ipv4 && + if((ie->supports_ipv4 || ie->use_nat64) && ((ns->lame && !ns->done_pside4) || (!ns->lame && !ns->got4))) { if(!generate_target_query(qstate, iq, id, @@ -2085,14 +2129,14 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq, /* if this nameserver is at a delegation point, but that * delegation point is a stub and we cannot go higher, skip*/ if( ((ie->supports_ipv6 && !ns->done_pside6) || - (ie->supports_ipv4 && !ns->done_pside4)) && + ((ie->supports_ipv4 || ie->use_nat64) && !ns->done_pside4)) && !can_have_last_resort(qstate->env, ns->name, ns->namelen, iq->qchase.qclass, NULL)) { log_nametypeclass(VERB_ALGO, "cannot pside lookup ns " "because it is also a stub/forward,", ns->name, LDNS_RR_TYPE_NS, iq->qchase.qclass); if(ie->supports_ipv6) ns->done_pside6 = 1; - if(ie->supports_ipv4) ns->done_pside4 = 1; + if(ie->supports_ipv4 || ie->use_nat64) ns->done_pside4 = 1; continue; } /* query for parent-side A and AAAA for nameservers */ @@ -2117,7 +2161,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq, return 0; } } - if(ie->supports_ipv4 && !ns->done_pside4) { + if((ie->supports_ipv4 || ie->use_nat64) && !ns->done_pside4) { /* Send the A request. */ if(!generate_parentside_target_query(qstate, iq, id, ns->name, ns->namelen, @@ -2259,6 +2303,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, int tf_policy; struct delegpt_addr* target; struct outbound_entry* outq; + struct sockaddr_storage real_addr; + socklen_t real_addrlen; int auth_fallback = 0; uint8_t* qout_orig = NULL; size_t qout_orig_len = 0; @@ -2276,14 +2322,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, iq->num_current_queries, iq->sent_count); /* Make sure that we haven't run away */ - /* FIXME: is this check even necessary? */ if(iq->referral_count > MAX_REFERRAL_COUNT) { verbose(VERB_QUERY, "request has exceeded the maximum " "number of referrrals with %d", iq->referral_count); errinf(qstate, "exceeded the maximum of referrals"); return error_response(qstate, id, LDNS_RCODE_SERVFAIL); } - if(iq->sent_count > MAX_SENT_COUNT) { + if(iq->sent_count > ie->max_sent_count) { verbose(VERB_QUERY, "request has exceeded the maximum " "number of sends with %d", iq->sent_count); errinf(qstate, "exceeded the maximum number of sends"); @@ -2385,7 +2430,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, } if(!ie->supports_ipv6) delegpt_no_ipv6(iq->dp); - if(!ie->supports_ipv4) + if(!ie->supports_ipv4 && !ie->use_nat64) delegpt_no_ipv4(iq->dp); delegpt_log(VERB_ALGO, iq->dp); @@ -2630,7 +2675,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, * the original query is one that matched too, so we have * caps_server+1 number of matching queries now */ if(iq->caps_server+1 >= naddr*3 || - iq->caps_server*2+2 >= MAX_SENT_COUNT) { + iq->caps_server*2+2 >= (size_t)ie->max_sent_count) { /* *2 on sentcount check because ipv6 may fail */ /* we're done, process the response */ verbose(VERB_ALGO, "0x20 fallback had %d responses " @@ -2806,12 +2851,24 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, /* We have a valid target. */ if(verbosity >= VERB_QUERY) { log_query_info(VERB_QUERY, "sending query:", &iq->qinfo_out); - log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, + log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, &target->addr, target->addrlen); verbose(VERB_ALGO, "dnssec status: %s%s", iq->dnssec_expected?"expected": "not expected", iq->dnssec_lame_query?" but lame_query anyway": ""); } + + real_addr = target->addr; + real_addrlen = target->addrlen; + + if(ie->use_nat64 && target->addr.ss_family == AF_INET) { + addr_to_nat64(&target->addr, &ie->nat64_prefix_addr, + ie->nat64_prefix_addrlen, ie->nat64_prefix_net, + &real_addr, &real_addrlen); + log_name_addr(VERB_QUERY, "applied NAT64:", + iq->dp->name, &real_addr, real_addrlen); + } + fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query)); outq = (*qstate->env->send_query)(&iq->qinfo_out, iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), @@ -2822,7 +2879,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, !qstate->blacklist&&(!iter_qname_indicates_dnssec(qstate->env, &iq->qinfo_out)||target->attempts==1)?0:BIT_CD), iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted( - ie, iq), sq_check_ratelimit, &target->addr, target->addrlen, + ie, iq), sq_check_ratelimit, &real_addr, real_addrlen, iq->dp->name, iq->dp->namelen, (iq->dp->tcp_upstream || qstate->env->cfg->tcp_upstream), (iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream), @@ -2839,7 +2896,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, return error_response(qstate, id, LDNS_RCODE_SERVFAIL); } log_addr(VERB_QUERY, "error sending query to auth server", - &target->addr, target->addrlen); + &real_addr, real_addrlen); if(qstate->env->cfg->qname_minimisation) iq->minimisation_state = SKIP_MINIMISE_STATE; return next_state(iq, QUERYTARGETS_STATE); @@ -2883,7 +2940,7 @@ static int processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, struct iter_env* ie, int id) { - int dnsseclame = 0; + int dnsseclame = 0, origtypecname = 0; enum response_type type; iq->num_current_queries--; @@ -2966,6 +3023,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, /* YXDOMAIN is a permanent error, no need to retry */ type = RESPONSE_TYPE_ANSWER; } + if(type == RESPONSE_TYPE_CNAME) + origtypecname = 1; if(type == RESPONSE_TYPE_CNAME && iq->response->rep->an_numrrsets >= 1 && ntohs(iq->response->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DNAME) { uint8_t* sname = NULL; @@ -3051,11 +3110,14 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, iq->minimisation_state = DONOT_MINIMISE_STATE; } if(FLAGS_GET_RCODE(iq->response->rep->flags) == - LDNS_RCODE_NXDOMAIN) { + LDNS_RCODE_NXDOMAIN && !origtypecname) { /* Stop resolving when NXDOMAIN is DNSSEC * signed. Based on assumption that nameservers * serving signed zones do not return NXDOMAIN * for empty-non-terminals. */ + /* If this response is actually a CNAME type, + * the nxdomain rcode may not be for the qname, + * and so it is not the final response. */ if(iq->dnssec_expected) return final_state(iq); /* Make subrequest to validate intermediate @@ -3183,7 +3245,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, (*qstate->env->detach_subs)(qstate); iq->num_target_queries = 0; iq->response = NULL; - iq->fail_reply = NULL; + iq->fail_addr_type = 0; verbose(VERB_ALGO, "cleared outbound list for next round"); return next_state(iq, QUERYTARGETS_STATE); } else if(type == RESPONSE_TYPE_CNAME) { @@ -3565,7 +3627,7 @@ processTargetResponse(struct module_qstate* qstate, int id, } else { verbose(VERB_ALGO, "iterator TargetResponse failed"); delegpt_mark_neg(dpns, qstate->qinfo.qtype); - if((dpns->got4 == 2 || !ie->supports_ipv4) && + if((dpns->got4 == 2 || (!ie->supports_ipv4 && !ie->use_nat64)) && (dpns->got6 == 2 || !ie->supports_ipv6)) { dpns->resolved = 1; /* fail the target */ /* do not count cached answers */ @@ -3810,6 +3872,9 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq, /* make sure QR flag is on */ iq->response->rep->flags |= BIT_QR; + /* explicitly set the EDE string to NULL */ + iq->response->rep->reason_bogus_str = NULL; + /* we have finished processing this query */ qstate->ext_state[id] = module_finished; @@ -3988,7 +4053,8 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq, } /* parse message */ - iq->fail_reply = qstate->reply; + fill_fail_addr(iq, &qstate->reply->remote_addr, + qstate->reply->remote_addrlen); prs = (struct msg_parse*)regional_alloc(qstate->env->scratch, sizeof(struct msg_parse)); if(!prs) { diff --git a/sbin/unwind/libunbound/iterator/iterator.h b/sbin/unwind/libunbound/iterator/iterator.h index e35718cf3..fad7f03e6 100644 --- a/sbin/unwind/libunbound/iterator/iterator.h +++ b/sbin/unwind/libunbound/iterator/iterator.h @@ -63,12 +63,8 @@ struct rbtree_type; /** max number of nxdomains allowed for target lookups for a query and * its subqueries when fallback has kicked in */ #define MAX_TARGET_NX_FALLBACK (MAX_TARGET_NX*2) -/** max number of query restarts. Determines max number of CNAME chain. */ -#define MAX_RESTART_COUNT 11 /** max number of referrals. Makes sure resolver does not run away */ #define MAX_REFERRAL_COUNT 130 -/** max number of queries-sent-out. Make sure large NS set does not loop */ -#define MAX_SENT_COUNT 32 /** max number of queries for which to perform dnsseclameness detection, * (rrsigs missing detection) after that, just pick up that response */ #define DNSSEC_LAME_DETECT_COUNT 4 @@ -107,7 +103,7 @@ extern int BLACKLIST_PENALTY; #define RTT_BAND 400 /** - * Global state for the iterator. + * Global state for the iterator. */ struct iter_env { /** A flag to indicate whether or not we have an IPv6 route */ @@ -116,6 +112,18 @@ struct iter_env { /** A flag to indicate whether or not we have an IPv4 route */ int supports_ipv4; + /** A flag to locally apply NAT64 to make IPv4 addrs into IPv6 */ + int use_nat64; + + /** NAT64 prefix address, cf. dns64_env->prefix_addr */ + struct sockaddr_storage nat64_prefix_addr; + + /** sizeof(sockaddr_in6) */ + socklen_t nat64_prefix_addrlen; + + /** CIDR mask length of NAT64 prefix */ + int nat64_prefix_net; + /** A set of inetaddrs that should never be queried. */ struct iter_donotq* donotq; @@ -145,6 +153,12 @@ struct iter_env { /** number of retries on outgoing queries */ int outbound_msg_retry; + + /** number of queries_sent */ + int max_sent_count; + + /** max number of query restarts to limit length of CNAME chain */ + int max_query_restarts; }; /** @@ -437,7 +451,14 @@ struct iter_qstate { /** true if there have been parse failures of reply packets */ int parse_failures; /** a failure printout address for last received answer */ - struct comm_reply* fail_reply; + union { + struct in_addr in; +#ifdef AF_INET6 + struct in6_addr in6; +#endif + } fail_addr; + /** which fail_addr, 0 is nothing, 4 or 6 */ + int fail_addr_type; }; /** diff --git a/sbin/unwind/libunbound/libunbound/context.c b/sbin/unwind/libunbound/libunbound/context.c index c8d911f13..f7c0a2cd5 100644 --- a/sbin/unwind/libunbound/libunbound/context.c +++ b/sbin/unwind/libunbound/libunbound/context.c @@ -70,6 +70,7 @@ context_finalize(struct ub_ctx* ctx) } else { log_init(cfg->logfile, cfg->use_syslog, NULL); } + ctx->pipe_pid = getpid(); cfg_apply_local_port_policy(cfg, 65536); config_apply(cfg); if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env)) diff --git a/sbin/unwind/libunbound/libunbound/context.h b/sbin/unwind/libunbound/libunbound/context.h index c0c86fb52..c0fc80e57 100644 --- a/sbin/unwind/libunbound/libunbound/context.h +++ b/sbin/unwind/libunbound/libunbound/context.h @@ -89,6 +89,12 @@ struct ub_ctx { pid_t bg_pid; /** tid of bg worker thread */ ub_thread_type bg_tid; + /** pid when pipes are created. This was the process when the + * setup was called. Helps with clean up, so we can tell after a fork + * which side of the fork the delete is on. */ + pid_t pipe_pid; + /** when threaded, the worker that exists in the created thread. */ + struct libworker* thread_worker; /** do threading (instead of forking) for async resolution */ int dothread; diff --git a/sbin/unwind/libunbound/libunbound/libunbound.c b/sbin/unwind/libunbound/libunbound/libunbound.c index ea5ef24bb..80a82bb47 100644 --- a/sbin/unwind/libunbound/libunbound/libunbound.c +++ b/sbin/unwind/libunbound/libunbound/libunbound.c @@ -305,11 +305,31 @@ ub_ctx_delete(struct ub_ctx* ctx) int do_stop = 1; if(!ctx) return; + /* if the delete is called but it has forked, and before the fork + * the context was finalized, then the bg worker is not stopped + * from here. There is one worker, but two contexts that refer to + * it and only one should clean up, the one with getpid == pipe_pid.*/ + if(ctx->created_bg && ctx->pipe_pid != getpid()) { + do_stop = 0; +#ifndef USE_WINSOCK + /* Stop events from getting deregistered, if the backend is + * epoll, the epoll fd is the same as the other process. + * That process should deregister them. */ + if(ctx->qq_pipe->listen_com) + ctx->qq_pipe->listen_com->event_added = 0; + if(ctx->qq_pipe->res_com) + ctx->qq_pipe->res_com->event_added = 0; + if(ctx->rr_pipe->listen_com) + ctx->rr_pipe->listen_com->event_added = 0; + if(ctx->rr_pipe->res_com) + ctx->rr_pipe->res_com->event_added = 0; +#endif + } /* see if bg thread is created and if threads have been killed */ /* no locks, because those may be held by terminated threads */ /* for processes the read pipe is closed and we see that on read */ #ifdef HAVE_PTHREAD - if(ctx->created_bg && ctx->dothread) { + if(ctx->created_bg && ctx->dothread && do_stop) { if(pthread_kill(ctx->bg_tid, 0) == ESRCH) { /* thread has been killed */ do_stop = 0; @@ -318,6 +338,23 @@ ub_ctx_delete(struct ub_ctx* ctx) #endif /* HAVE_PTHREAD */ if(do_stop) ub_stop_bg(ctx); + if(ctx->created_bg && ctx->pipe_pid != getpid() && ctx->thread_worker) { + /* This delete is happening from a different process. Delete + * the thread worker from this process memory space. The + * thread is not there to do so, so it is freed here. */ + struct ub_event_base* evbase = comm_base_internal( + ctx->thread_worker->base); + libworker_delete_event(ctx->thread_worker); + ctx->thread_worker = NULL; +#ifdef USE_MINI_EVENT + ub_event_base_free(evbase); +#else + /* cannot event_base_free, because the epoll_fd cleanup + * in libevent could stop the original event_base in the + * other process from working. */ + free(evbase); +#endif + } libworker_delete_event(ctx->event_worker); modstack_desetup(&ctx->mods, ctx->env); diff --git a/sbin/unwind/libunbound/libunbound/libworker.c b/sbin/unwind/libunbound/libunbound/libworker.c index 11bf5f9db..104244937 100644 --- a/sbin/unwind/libunbound/libunbound/libworker.c +++ b/sbin/unwind/libunbound/libunbound/libworker.c @@ -168,14 +168,12 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb) hints_delete(w->env->hints); w->env->hints = NULL; } - if(cfg->ssl_upstream || (cfg->tls_cert_bundle && cfg->tls_cert_bundle[0]) || cfg->tls_win_cert) { - w->sslctx = connect_sslctx_create(NULL, NULL, - cfg->tls_cert_bundle, cfg->tls_win_cert); - if(!w->sslctx) { - /* to make the setup fail after unlock */ - hints_delete(w->env->hints); - w->env->hints = NULL; - } + w->sslctx = connect_sslctx_create(NULL, NULL, + cfg->tls_cert_bundle, cfg->tls_win_cert); + if(!w->sslctx) { + /* to make the setup fail after unlock */ + hints_delete(w->env->hints); + w->env->hints = NULL; } if(!w->is_bg || w->is_bg_thread) { lock_basic_unlock(&ctx->cfglock); @@ -395,6 +393,7 @@ int libworker_bg(struct ub_ctx* ctx) w = libworker_setup(ctx, 1, NULL); if(!w) return UB_NOMEM; w->is_bg_thread = 1; + ctx->thread_worker = w; #ifdef ENABLE_LOCK_CHECKS w->thread_num = 1; /* for nicer DEBUG checklocks */ #endif @@ -604,6 +603,8 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q, edns->opt_list_out = NULL; edns->opt_list_inplace_cb_out = NULL; edns->padding_block_size = 0; + edns->cookie_present = 0; + edns->cookie_valid = 0; if(sldns_buffer_capacity(w->back->udp_buff) < 65535) edns->udp_size = (uint16_t)sldns_buffer_capacity( w->back->udp_buff); diff --git a/sbin/unwind/libunbound/libunbound/unbound-event.h b/sbin/unwind/libunbound/libunbound/unbound-event.h index a5d5c038b..5ca81908a 100644 --- a/sbin/unwind/libunbound/libunbound/unbound-event.h +++ b/sbin/unwind/libunbound/libunbound/unbound-event.h @@ -52,8 +52,8 @@ * unbound was compiled with, otherwise it wouldn't work, the event and * event_base structures would be different. */ -#ifndef _UB_UNBOUND_EVENT_H -#define _UB_UNBOUND_EVENT_H +#ifndef UB_UNBOUND_EVENT_H +#define UB_UNBOUND_EVENT_H #ifdef __cplusplus extern "C" { @@ -230,7 +230,7 @@ int ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base); * @param callback: this is called on completion of the resolution. * It is called as: * void callback(void* mydata, int rcode, void* packet, int packet_len, - * int sec, char* why_bogus) + * int sec, char* why_bogus, int was_ratelimited) * with mydata: the same as passed here, you may pass NULL, * with rcode: 0 on no error, nonzero for mostly SERVFAIL situations, * this is a DNS rcode. @@ -241,6 +241,7 @@ int ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base); * with packet_len: length in bytes of the packet buffer. * with sec: 0 if insecure, 1 if bogus, 2 if DNSSEC secure. * with why_bogus: text string explaining why it is bogus (or NULL). + * with was_ratelimited: if the query was ratelimited. * These point to buffers inside unbound; do not deallocate the packet or * error string. * @@ -261,4 +262,4 @@ int ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype, } #endif -#endif /* _UB_UNBOUND_H */ +#endif /* UB_UNBOUND_EVENT_H */ diff --git a/sbin/unwind/libunbound/libunbound/unbound.h b/sbin/unwind/libunbound/libunbound/unbound.h index c779d183e..bb8e8acf0 100644 --- a/sbin/unwind/libunbound/libunbound/unbound.h +++ b/sbin/unwind/libunbound/libunbound/unbound.h @@ -4,22 +4,22 @@ * Copyright (c) 2007, NLnet Labs. All rights reserved. * * This software is open source. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. - * + * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. - * + * * Neither the name of the NLNET LABS nor the names of its contributors may * be used to endorse or promote products derived from this software without * specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR @@ -36,7 +36,7 @@ /** * \file * - * This file contains functions to resolve DNS queries and + * This file contains functions to resolve DNS queries and * validate the answers. Synchronously and asynchronously. * * Several ways to use this interface from an application wishing @@ -65,7 +65,7 @@ * ... or process() calls my_callback() with results. * * ... if the application has nothing more to do, wait for answer - * ub_wait(ctx); + * ub_wait(ctx); * * Application threaded. Blocking. * Blocking, same as above. The current thread does the work. @@ -83,7 +83,7 @@ * CRYPTO_set_id_callback and CRYPTO_set_locking_callback. * * If no threading is compiled in, the above async example uses fork(2) to - * create a process to perform the work. The forked process exits when the + * create a process to perform the work. The forked process exits when the * calling process exits, or ctx_delete() is called. * Otherwise, for asynchronous with threading, a worker thread is created. * @@ -94,8 +94,8 @@ * The second calls another worker thread (or process) to perform the work. * And no buffers need to be set up, but a context-switch happens. */ -#ifndef _UB_UNBOUND_H -#define _UB_UNBOUND_H +#ifndef UB_UNBOUND_H +#define UB_UNBOUND_H #ifdef __cplusplus extern "C" { @@ -128,10 +128,10 @@ struct ub_result { /** the class asked for */ int qclass; - /** - * a list of network order DNS rdata items, terminated with a + /** + * a list of network order DNS rdata items, terminated with a * NULL pointer, so that data[0] is the first result entry, - * data[1] the second, and the last entry is NULL. + * data[1] the second, and the last entry is NULL. * If there was no data, data[0] is NULL. */ char** data; @@ -139,8 +139,8 @@ struct ub_result { /** the length in bytes of the data items, len[i] for data[i] */ int* len; - /** - * canonical name for the result (the final cname). + /** + * canonical name for the result (the final cname). * zero terminated string. * May be NULL if no canonical name exists. */ @@ -165,9 +165,9 @@ struct ub_result { */ int havedata; - /** + /** * If there was no data, and the domain did not exist, this is true. - * If it is false, and there was no data, then the domain name + * If it is false, and there was no data, then the domain name * is purported to exist, but the requested data type is not available. */ int nxdomain; @@ -182,19 +182,19 @@ struct ub_result { */ int secure; - /** - * If the result was not secure (secure==0), and this result is due + /** + * If the result was not secure (secure==0), and this result is due * to a security failure, bogus is true. * This means the data has been actively tampered with, signatures - * failed, expected signatures were not present, timestamps on + * failed, expected signatures were not present, timestamps on * signatures were out of date and so on. * - * If !secure and !bogus, this can happen if the data is not secure - * because security is disabled for that domain name. + * If !secure and !bogus, this can happen if the data is not secure + * because security is disabled for that domain name. * This means the data is from a domain where data is not signed. */ int bogus; - + /** * If the result is bogus this contains a string (zero terminated) * that describes the failure. There may be other errors as well @@ -222,7 +222,7 @@ struct ub_result { * The readable function definition looks like: * void my_callback(void* my_arg, int err, struct ub_result* result); * It is called with - * void* my_arg: your pointer to a (struct of) data of your choice, + * void* my_arg: your pointer to a (struct of) data of your choice, * or NULL. * int err: if 0 all is OK, otherwise an error occurred and no results * are forthcoming. @@ -301,8 +301,8 @@ int ub_ctx_set_option(struct ub_ctx* ctx, const char* opt, const char* val); * This is a power-users interface that lets you specify all sorts * of options. * @param str: the string is malloced and returned here. NULL on error. - * The caller must free() the string. In cases with multiple - * entries (auto-trust-anchor-file), a newline delimited list is + * The caller must free() the string. In cases with multiple + * entries (auto-trust-anchor-file), a newline delimited list is * returned in the string. * @return 0 if OK else an error code (malloc failure, syntax error). */ @@ -321,10 +321,10 @@ int ub_ctx_get_option(struct ub_ctx* ctx, const char* opt, char** str); int ub_ctx_config(struct ub_ctx* ctx, const char* fname); /** - * Set machine to forward DNS queries to, the caching resolver to use. - * IP4 or IP6 address. Forwards all DNS requests to that machine, which - * is expected to run a recursive resolver. If the proxy is not - * DNSSEC-capable, validation may fail. Can be called several times, in + * Set machine to forward DNS queries to, the caching resolver to use. + * IP4 or IP6 address. Forwards all DNS requests to that machine, which + * is expected to run a recursive resolver. If the proxy is not + * DNSSEC-capable, validation may fail. Can be called several times, in * that case the addresses are used as backup servers. * * To read the list of nameservers from /etc/resolv.conf (from DHCP or so), @@ -389,7 +389,7 @@ int ub_ctx_resolvconf(struct ub_ctx* ctx, const char* fname); /** * Read list of hosts from the filename given. - * Usually "/etc/hosts". + * Usually "/etc/hosts". * These addresses are not flagged as DNSSEC secure when queried for. * * @param ctx: context. @@ -403,7 +403,7 @@ int ub_ctx_hosts(struct ub_ctx* ctx, const char* fname); /** * Add a trust anchor to the given context. * The trust anchor is a string, on one line, that holds a valid DNSKEY or - * DS RR. + * DS RR. * @param ctx: context. * At this time it is only possible to add trusted keys before the * first resolve is done. @@ -465,7 +465,7 @@ int ub_ctx_debugout(struct ub_ctx* ctx, void* out); * Set debug verbosity for the context * Output is directed to stderr. * @param ctx: context. - * @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed, + * @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed, * and 3 is lots. * @return 0 if OK, else error. */ @@ -474,10 +474,10 @@ int ub_ctx_debuglevel(struct ub_ctx* ctx, int d); /** * Set a context behaviour for asynchronous action. * @param ctx: context. - * @param dothread: if true, enables threading and a call to resolve_async() + * @param dothread: if true, enables threading and a call to resolve_async() * creates a thread to handle work in the background. * If false, a process is forked to handle work in the background. - * Changes to this setting after async() calls have been made have + * Changes to this setting after async() calls have been made have * no effect (delete and re-create the context to change). * @return 0 if OK, else error. */ @@ -495,7 +495,7 @@ int ub_poll(struct ub_ctx* ctx); /** * Wait for a context to finish with results. Calls ub_process() after - * the wait for you. After the wait, there are no more outstanding + * the wait for you. After the wait, there are no more outstanding * asynchronous queries. * @param ctx: context. * @return: 0 if OK, else error. @@ -530,11 +530,11 @@ int ub_process(struct ub_ctx* ctx); * @param rrtype: type of RR in host order, 1 is A (address). * @param rrclass: class of RR in host order, 1 is IN (for internet). * @param result: the result data is returned in a newly allocated result - * structure. May be NULL on return, return value is set to an error + * structure. May be NULL on return, return value is set to an error * in that case (out of memory). * @return 0 if OK, else error. */ -int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype, +int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype, int rrclass, struct ub_result** result); /** @@ -561,11 +561,11 @@ int ub_resolve(struct ub_ctx* ctx, const char* name, int rrtype, * If an error happens during processing, your callback will be called * with error set to a nonzero value (and result==NULL). * @param async_id: if you pass a non-NULL value, an identifier number is - * returned for the query as it is in progress. It can be used to + * returned for the query as it is in progress. It can be used to * cancel the query. * @return 0 if OK, else error. */ -int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype, +int ub_resolve_async(struct ub_ctx* ctx, const char* name, int rrtype, int rrclass, void* mydata, ub_callback_type callback, int* async_id); /** @@ -589,7 +589,7 @@ int ub_cancel(struct ub_ctx* ctx, int async_id); */ void ub_resolve_free(struct ub_result* result); -/** +/** * Convert error value to a human readable string. * @param err: error code from one of the libunbound functions. * The error codes are from the type enum ub_ctx_err. @@ -605,7 +605,7 @@ const char* ub_strerror(int err); int ub_ctx_print_local_zones(struct ub_ctx* ctx); /** - * Add a new zone with the zonetype to the local authority info of the + * Add a new zone with the zonetype to the local authority info of the * library. * @param ctx: context. Is finalized by the routine. * @param zone_name: name of the zone in text, "example.com" @@ -613,7 +613,7 @@ int ub_ctx_print_local_zones(struct ub_ctx* ctx); * @param zone_type: type of the zone (like for unbound.conf) in text. * @return 0 if OK, else error. */ -int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name, +int ub_ctx_zone_add(struct ub_ctx* ctx, const char *zone_name, const char *zone_type); /** @@ -649,7 +649,7 @@ int ub_ctx_data_remove(struct ub_ctx* ctx, const char *data); */ const char* ub_version(void); -/** +/** * Some global statistics that are not in struct stats_info, * this struct is shared on a shm segment (shm-key in unbound.conf) */ @@ -695,13 +695,22 @@ struct ub_server_stats { long long num_queries; /** number of queries that have been dropped/ratelimited by ip. */ long long num_queries_ip_ratelimited; + /** number of queries with a valid DNS Cookie. */ + long long num_queries_cookie_valid; + /** number of queries with only the client part of the DNS Cookie. */ + long long num_queries_cookie_client; + /** number of queries with invalid DNS Cookie. */ + long long num_queries_cookie_invalid; /** number of queries that had a cache-miss. */ long long num_queries_missed_cache; /** number of prefetch queries - cachehits with prefetch */ long long num_queries_prefetch; - + /** number of queries which are too late to process */ + long long num_queries_timed_out; + /** the longest wait time in the queue */ + long long max_query_time_us; /** - * Sum of the querylistsize of the worker for + * Sum of the querylistsize of the worker for * every query that missed cache. To calculate average. */ long long sum_query_list_size; @@ -773,12 +782,12 @@ struct ub_server_stats { long long tcp_accept_usage; /** expired answers served from cache */ long long ans_expired; - /** histogram data exported to array + /** histogram data exported to array * if the array is the same size, no data is lost, and * if all histograms are same size (is so by default) then * adding up works well. */ long long hist[UB_STATS_BUCKET_NUM]; - + /** number of message cache entries */ long long msg_cache_count; /** number of rrset cache entries */ @@ -788,6 +797,11 @@ struct ub_server_stats { /** number of key cache entries */ long long key_cache_count; + /** maximum number of collisions in the msg cache */ + long long msg_cache_max_collisions; + /** maximum number of collisions in the rrset cache */ + long long rrset_cache_max_collisions; + /** number of queries that used dnscrypt */ long long num_query_dnscrypt_crypted; /** number of queries that queried dnscrypt certificates */ @@ -819,6 +833,8 @@ struct ub_server_stats { /** number of queries answered from edns-subnet specific data, and * the answer was from the edns-subnet cache. */ long long num_query_subnet_cache; + /** number of queries served from cachedb */ + long long num_query_cachedb; /** number of bytes in the stream wait buffers */ long long mem_stream_wait; /** number of bytes in the HTTP2 query buffers */ @@ -831,7 +847,7 @@ struct ub_server_stats { long long rpz_action[UB_STATS_RPZ_ACTION_NUM]; }; -/** +/** * Statistics to send over the control pipe when asked * This struct is made to be memcopied, sent in binary. * shm mapped with (number+1) at num_threads+1, with first as total @@ -860,4 +876,4 @@ struct ub_stats_info { } #endif -#endif /* _UB_UNBOUND_H */ +#endif /* UB_UNBOUND_H */ diff --git a/sbin/unwind/libunbound/services/authzone.c b/sbin/unwind/libunbound/services/authzone.c index 6de1e4319..cd3ef8dbb 100644 --- a/sbin/unwind/libunbound/services/authzone.c +++ b/sbin/unwind/libunbound/services/authzone.c @@ -1306,8 +1306,8 @@ az_remove_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len, auth_data_delete(node); } if(z->rpz) { - rpz_remove_rr(z->rpz, z->namelen, dname, dname_len, rr_type, - rr_class, rdata, rdatalen); + rpz_remove_rr(z->rpz, z->name, z->namelen, dname, dname_len, + rr_type, rr_class, rdata, rdatalen); } return 1; } @@ -2756,6 +2756,7 @@ az_change_dnames(struct dns_msg* msg, uint8_t* oldname, uint8_t* newname, == 0) { msg->rep->rrsets[i]->rk.dname = newname; msg->rep->rrsets[i]->rk.dname_len = newlen; + msg->rep->rrsets[i]->entry.hash = rrset_key_hash(&msg->rep->rrsets[i]->rk); } } } @@ -5419,6 +5420,8 @@ xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env) edns.opt_list_out = NULL; edns.opt_list_inplace_cb_out = NULL; edns.padding_block_size = 0; + edns.cookie_present = 0; + edns.cookie_valid = 0; if(sldns_buffer_capacity(buf) < 65535) edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); else edns.udp_size = 65535; @@ -6612,6 +6615,8 @@ xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env) edns.opt_list_out = NULL; edns.opt_list_inplace_cb_out = NULL; edns.padding_block_size = 0; + edns.cookie_present = 0; + edns.cookie_valid = 0; if(sldns_buffer_capacity(buf) < 65535) edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); else edns.udp_size = 65535; @@ -7509,7 +7514,7 @@ static void add_rrlist_rrsigs_into_data(struct packed_rrset_data* data, size_t j; if(!rrlist[i]) continue; - if(rrlist[i] && rrlist[i]->type == LDNS_RR_TYPE_ZONEMD && + if(rrlist[i]->type == LDNS_RR_TYPE_ZONEMD && query_dname_compare(z->name, node->name)==0) { /* omit RRSIGs over type ZONEMD at apex */ continue; diff --git a/sbin/unwind/libunbound/services/cache/dns.c b/sbin/unwind/libunbound/services/cache/dns.c index b6e569734..9b4ad5888 100644 --- a/sbin/unwind/libunbound/services/cache/dns.c +++ b/sbin/unwind/libunbound/services/cache/dns.c @@ -132,31 +132,6 @@ msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen, slabhash_remove(env->msg_cache, h, &k); } -/** remove servfail msg cache entry */ -static void -msg_del_servfail(struct module_env* env, struct query_info* qinfo, - uint32_t flags) -{ - struct msgreply_entry* e; - /* see if the entry is servfail, and then remove it, so that - * lookups move from the cacheresponse stage to the recursionresponse - * stage */ - e = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len, - qinfo->qtype, qinfo->qclass, flags, 0, 0); - if(!e) return; - /* we don't check for the ttl here, also expired servfail entries - * are removed. If the user uses serve-expired, they would still be - * used to answer from cache */ - if(FLAGS_GET_RCODE(((struct reply_info*)e->entry.data)->flags) - != LDNS_RCODE_SERVFAIL) { - lock_rw_unlock(&e->entry.lock); - return; - } - lock_rw_unlock(&e->entry.lock); - msg_cache_remove(env, qinfo->qname, qinfo->qname_len, qinfo->qtype, - qinfo->qclass, flags); -} - void dns_cache_store_msg(struct module_env* env, struct query_info* qinfo, hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside, @@ -182,13 +157,20 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo, /* we do not store the message, but we did store the RRs, * which could be useful for delegation information */ verbose(VERB_ALGO, "TTL 0: dropped msg from cache"); - free(rep); - /* if the message is SERVFAIL in cache, remove that SERVFAIL, + reply_info_delete(rep, NULL); + /* if the message is in the cache, remove that msg, * so that the TTL 0 response can be returned for future - * responses (i.e. don't get answered by the servfail from + * responses (i.e. don't get answered from * cache, but instead go to recursion to get this TTL0 - * response). */ - msg_del_servfail(env, qinfo, flags); + * response). + * Possible messages that could be in the cache: + * - SERVFAIL + * - NXDOMAIN + * - NODATA + * - an older record that is expired + * - an older record that did not yet expire */ + msg_cache_remove(env, qinfo->qname, qinfo->qname_len, + qinfo->qtype, qinfo->qclass, flags); return; } @@ -610,6 +592,7 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num) if(!msg->rep) return NULL; msg->rep->reason_bogus = LDNS_EDE_NONE; + msg->rep->reason_bogus_str = NULL; if(num > RR_COUNT_MAX) return NULL; /* integer overflow protection */ msg->rep->rrsets = (struct ub_packed_rrset_key**) @@ -636,6 +619,14 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r, r->serve_expired_ttl < now) { return NULL; } + /* Ignore expired failure answers */ + if(FLAGS_GET_RCODE(r->flags) != + LDNS_RCODE_NOERROR && + FLAGS_GET_RCODE(r->flags) != + LDNS_RCODE_NXDOMAIN && + FLAGS_GET_RCODE(r->flags) != + LDNS_RCODE_YXDOMAIN) + return 0; } else { return NULL; } @@ -664,6 +655,10 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r, msg->rep->rrset_count = r->rrset_count; msg->rep->authoritative = r->authoritative; msg->rep->reason_bogus = r->reason_bogus; + if(r->reason_bogus_str) { + msg->rep->reason_bogus_str = regional_strdup(region, r->reason_bogus_str); + } + if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) { return NULL; } @@ -1067,7 +1062,6 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf, /* ttl must be relative ;i.e. 0..86400 not time(0)+86400. * the env->now is added to message and RRsets in this routine. */ /* the leeway is used to invalidate other rrsets earlier */ - if(is_referral) { /* store rrsets */ struct rrset_ref ref; @@ -1084,7 +1078,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf, ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS && !pside) ? qstarttime:*env->now + leeway)); } - free(rep); + reply_info_delete(rep, NULL); return 1; } else { /* store msg, and rrsets */ diff --git a/sbin/unwind/libunbound/services/cache/infra.c b/sbin/unwind/libunbound/services/cache/infra.c index 537cb949c..31462d13a 100644 --- a/sbin/unwind/libunbound/services/cache/infra.c +++ b/sbin/unwind/libunbound/services/cache/infra.c @@ -67,6 +67,11 @@ int infra_dp_ratelimit = 0; * in queries per second. */ int infra_ip_ratelimit = 0; +/** ratelimit value for client ip addresses, + * in queries per second. + * For clients with a valid DNS Cookie. */ +int infra_ip_ratelimit_cookie = 0; + size_t infra_sizefunc(void* k, void* ATTR_UNUSED(d)) { @@ -1051,9 +1056,50 @@ infra_get_mem(struct infra_cache* infra) return s; } +/* Returns 1 if the limit has not been exceeded, 0 otherwise. */ +static int +check_ip_ratelimit(struct sockaddr_storage* addr, socklen_t addrlen, + struct sldns_buffer* buffer, int premax, int max, int has_cookie) +{ + int limit; + + if(has_cookie) limit = infra_ip_ratelimit_cookie; + else limit = infra_ip_ratelimit; + + /* Disabled */ + if(limit == 0) return 1; + + if(premax <= limit && max > limit) { + char client_ip[128], qnm[LDNS_MAX_DOMAINLEN+1+12+12]; + addr_to_str(addr, addrlen, client_ip, sizeof(client_ip)); + qnm[0]=0; + if(sldns_buffer_limit(buffer)>LDNS_HEADER_SIZE && + LDNS_QDCOUNT(sldns_buffer_begin(buffer))!=0) { + (void)sldns_wire2str_rrquestion_buf( + sldns_buffer_at(buffer, LDNS_HEADER_SIZE), + sldns_buffer_limit(buffer)-LDNS_HEADER_SIZE, + qnm, sizeof(qnm)); + if(strlen(qnm)>0 && qnm[strlen(qnm)-1]=='\n') + qnm[strlen(qnm)-1] = 0; /*remove newline*/ + if(strchr(qnm, '\t')) + *strchr(qnm, '\t') = ' '; + if(strchr(qnm, '\t')) + *strchr(qnm, '\t') = ' '; + verbose(VERB_OPS, "ip_ratelimit exceeded %s %d%s %s", + client_ip, limit, + has_cookie?"(cookie)":"", qnm); + } else { + verbose(VERB_OPS, "ip_ratelimit exceeded %s %d%s (no query name)", + client_ip, limit, + has_cookie?"(cookie)":""); + } + } + return (max <= limit); +} + int infra_ip_ratelimit_inc(struct infra_cache* infra, struct sockaddr_storage* addr, socklen_t addrlen, time_t timenow, - int backoff, struct sldns_buffer* buffer) + int has_cookie, int backoff, struct sldns_buffer* buffer) { int max; struct lruhash_entry* entry; @@ -1070,31 +1116,8 @@ int infra_ip_ratelimit_inc(struct infra_cache* infra, (*cur)++; max = infra_rate_max(entry->data, timenow, backoff); lock_rw_unlock(&entry->lock); - - if(premax <= infra_ip_ratelimit && max > infra_ip_ratelimit) { - char client_ip[128], qnm[LDNS_MAX_DOMAINLEN+1+12+12]; - addr_to_str(addr, addrlen, client_ip, sizeof(client_ip)); - qnm[0]=0; - if(sldns_buffer_limit(buffer)>LDNS_HEADER_SIZE && - LDNS_QDCOUNT(sldns_buffer_begin(buffer))!=0) { - (void)sldns_wire2str_rrquestion_buf( - sldns_buffer_at(buffer, LDNS_HEADER_SIZE), - sldns_buffer_limit(buffer)-LDNS_HEADER_SIZE, - qnm, sizeof(qnm)); - if(strlen(qnm)>0 && qnm[strlen(qnm)-1]=='\n') - qnm[strlen(qnm)-1] = 0; /*remove newline*/ - if(strchr(qnm, '\t')) - *strchr(qnm, '\t') = ' '; - if(strchr(qnm, '\t')) - *strchr(qnm, '\t') = ' '; - verbose(VERB_OPS, "ip_ratelimit exceeded %s %d %s", - client_ip, infra_ip_ratelimit, qnm); - } else { - verbose(VERB_OPS, "ip_ratelimit exceeded %s %d (no query name)", - client_ip, infra_ip_ratelimit); - } - } - return (max <= infra_ip_ratelimit); + return check_ip_ratelimit(addr, addrlen, buffer, premax, max, + has_cookie); } /* create */ diff --git a/sbin/unwind/libunbound/services/cache/infra.h b/sbin/unwind/libunbound/services/cache/infra.h index faf7fd2f3..525073bf3 100644 --- a/sbin/unwind/libunbound/services/cache/infra.h +++ b/sbin/unwind/libunbound/services/cache/infra.h @@ -153,6 +153,8 @@ struct rate_key { /** ip ratelimit, 0 is off */ extern int infra_ip_ratelimit; +/** ip ratelimit for DNS Cookie clients, 0 is off */ +extern int infra_ip_ratelimit_cookie; /** * key for ip_ratelimit lookups, a source IP. @@ -419,13 +421,14 @@ int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name, * @param addr: client address * @param addrlen: client address length * @param timenow: what time it is now. + * @param has_cookie: if the request came with a DNS Cookie. * @param backoff: if backoff is enabled. * @param buffer: with query for logging. * @return 1 if it could be incremented. 0 if the increment overshot the * ratelimit and the query should be dropped. */ int infra_ip_ratelimit_inc(struct infra_cache* infra, struct sockaddr_storage* addr, socklen_t addrlen, time_t timenow, - int backoff, struct sldns_buffer* buffer); + int has_cookie, int backoff, struct sldns_buffer* buffer); /** * Get memory used by the infra cache. diff --git a/sbin/unwind/libunbound/services/listen_dnsport.c b/sbin/unwind/libunbound/services/listen_dnsport.c index 95606aff5..60f9b41e5 100644 --- a/sbin/unwind/libunbound/services/listen_dnsport.c +++ b/sbin/unwind/libunbound/services/listen_dnsport.c @@ -4,22 +4,22 @@ * Copyright (c) 2007, NLnet Labs. All rights reserved. * * This software is open source. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. - * + * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. - * + * * Neither the name of the NLNET LABS nor the names of its contributors may * be used to endorse or promote products derived from this software without * specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR @@ -79,9 +79,11 @@ #ifdef HAVE_NET_IF_H #include #endif - +#ifdef HAVE_LINUX_NET_TSTAMP_H +#include +#endif /** number of queued TCP connections for listen() */ -#define TCP_BACKLOG 256 +#define TCP_BACKLOG 256 #ifndef THREADS_DISABLED /** lock on the counter of stream buffer memory */ @@ -187,7 +189,7 @@ systemd_get_activated(int family, int socktype, int listen, log_err("systemd sd_listen_fds(): %s", strerror(-r)); return -1; } - + for(i = 0; i < r; i++) { if(sd_is_socket(SD_LISTEN_FDS_START + i, family, socktype, listen)) { s = SD_LISTEN_FDS_START + i; @@ -253,7 +255,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr, return -1; } #else - if(WSAGetLastError() == WSAEAFNOSUPPORT || + if(WSAGetLastError() == WSAEAFNOSUPPORT || WSAGetLastError() == WSAEPROTONOSUPPORT) { *noproto = 1; return -1; @@ -270,7 +272,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr, #endif if(listen) { #ifdef SO_REUSEADDR - if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, + if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, (socklen_t)sizeof(on)) < 0) { log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s", sock_strerror(errno)); @@ -368,9 +370,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr, socklen_t slen = (socklen_t)sizeof(got); # ifdef SO_RCVBUFFORCE /* Linux specific: try to use root permission to override - * system limits on rcvbuf. The limit is stored in + * system limits on rcvbuf. The limit is stored in * /proc/sys/net/core/rmem_max or sysctl net.core.rmem_max */ - if(setsockopt(s, SOL_SOCKET, SO_RCVBUFFORCE, (void*)&rcv, + if(setsockopt(s, SOL_SOCKET, SO_RCVBUFFORCE, (void*)&rcv, (socklen_t)sizeof(rcv)) < 0) { if(errno != EPERM) { log_err("setsockopt(..., SO_RCVBUFFORCE, " @@ -381,7 +383,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr, return -1; } # endif /* SO_RCVBUFFORCE */ - if(setsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&rcv, + if(setsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&rcv, (socklen_t)sizeof(rcv)) < 0) { log_err("setsockopt(..., SO_RCVBUF, " "...) failed: %s", sock_strerror(errno)); @@ -392,7 +394,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr, } /* check if we got the right thing or if system * reduced to some system max. Warn if so */ - if(getsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&got, + if(getsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&got, &slen) >= 0 && got < rcv/2) { log_warn("so-rcvbuf %u was not granted. " "Got %u. To fix: start with " @@ -413,9 +415,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr, socklen_t slen = (socklen_t)sizeof(got); # ifdef SO_SNDBUFFORCE /* Linux specific: try to use root permission to override - * system limits on sndbuf. The limit is stored in + * system limits on sndbuf. The limit is stored in * /proc/sys/net/core/wmem_max or sysctl net.core.wmem_max */ - if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd, + if(setsockopt(s, SOL_SOCKET, SO_SNDBUFFORCE, (void*)&snd, (socklen_t)sizeof(snd)) < 0) { if(errno != EPERM) { log_err("setsockopt(..., SO_SNDBUFFORCE, " @@ -426,7 +428,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr, return -1; } # endif /* SO_SNDBUFFORCE */ - if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd, + if(setsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&snd, (socklen_t)sizeof(snd)) < 0) { log_err("setsockopt(..., SO_SNDBUF, " "...) failed: %s", sock_strerror(errno)); @@ -437,7 +439,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr, } /* check if we got the right thing or if system * reduced to some system max. Warn if so */ - if(getsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&got, + if(getsockopt(s, SOL_SOCKET, SO_SNDBUF, (void*)&got, &slen) >= 0 && got < snd/2) { log_warn("so-sndbuf %u was not granted. " "Got %u. To fix: start with " @@ -469,7 +471,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr, # endif ) { int val=(v6only==2)?0:1; - if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, + if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, (void*)&val, (socklen_t)sizeof(val)) < 0) { log_err("setsockopt(..., IPV6_V6ONLY" ", ...) failed: %s", sock_strerror(errno)); @@ -576,7 +578,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr, int action; # if defined(IP_PMTUDISC_OMIT) action = IP_PMTUDISC_OMIT; - if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER, + if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER, &action, (socklen_t)sizeof(action)) < 0) { if (errno != EINVAL) { @@ -609,7 +611,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr, /* the IP_DONTFRAG option if defined in the 11.0 OSX headers, * but does not work on that version, so we exclude it */ int off = 0; - if (setsockopt(s, IPPROTO_IP, IP_DONTFRAG, + if (setsockopt(s, IPPROTO_IP, IP_DONTFRAG, &off, (socklen_t)sizeof(off)) < 0) { log_err("setsockopt(..., IP_DONTFRAG, ...) failed: %s", strerror(errno)); @@ -647,7 +649,7 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr, if(WSAGetLastError() != WSAEADDRINUSE && WSAGetLastError() != WSAEADDRNOTAVAIL && !(WSAGetLastError() == WSAEACCES && verbosity < 4 && !listen)) { - log_err_addr("can't bind socket", + log_err_addr("can't bind socket", wsa_strerror(WSAGetLastError()), (struct sockaddr_storage*)addr, addrlen); } @@ -749,7 +751,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto, } #endif #ifdef SO_REUSEADDR - if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, + if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, (socklen_t)sizeof(on)) < 0) { log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s", sock_strerror(errno)); @@ -793,7 +795,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto, && !got_fd_from_systemd # endif ) { - if(setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, + if(setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, (void*)&on, (socklen_t)sizeof(on)) < 0) { log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s", sock_strerror(errno)); @@ -845,7 +847,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto, addr->ai_addrlen); } #else - log_err_addr("can't bind socket", + log_err_addr("can't bind socket", wsa_strerror(WSAGetLastError()), (struct sockaddr_storage*)addr->ai_addr, addr->ai_addrlen); @@ -873,7 +875,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto, /* 5 is recommended on linux */ qlen = 5; #endif - if ((setsockopt(s, IPPROTO_TCP, TCP_FASTOPEN, &qlen, + if ((setsockopt(s, IPPROTO_TCP, TCP_FASTOPEN, &qlen, sizeof(qlen))) == -1 ) { #ifdef ENOPROTOOPT /* squelch ENOPROTOOPT: freebsd server mode with kernel support @@ -999,7 +1001,7 @@ err: * Create socket from getaddrinfo results */ static int -make_sock(int stype, const char* ifname, const char* port, +make_sock(int stype, const char* ifname, const char* port, struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd, int* reuseport, int transparent, int tcp_mss, int nodelay, int freebind, int use_systemd, int dscp, struct unbound_socket* ub_sock) @@ -1015,10 +1017,10 @@ make_sock(int stype, const char* ifname, const char* port, return -1; } #endif - log_err("node %s:%s getaddrinfo: %s %s", + log_err("node %s:%s getaddrinfo: %s %s", ifname?ifname:"default", port, gai_strerror(r), #ifdef EAI_SYSTEM - r==EAI_SYSTEM?(char*)strerror(errno):"" + (r==EAI_SYSTEM?(char*)strerror(errno):"") #else "" #endif @@ -1055,7 +1057,7 @@ make_sock(int stype, const char* ifname, const char* port, /** make socket and first see if ifname contains port override info */ static int -make_sock_port(int stype, const char* ifname, const char* port, +make_sock_port(int stype, const char* ifname, const char* port, struct addrinfo *hints, int v6only, int* noip6, size_t rcv, size_t snd, int* reuseport, int transparent, int tcp_mss, int nodelay, int freebind, int use_systemd, int dscp, struct unbound_socket* ub_sock) @@ -1114,9 +1116,28 @@ port_insert(struct listen_port** list, int s, enum listen_type ftype, return 1; } +/** set fd to receive software timestamps */ +static int +set_recvtimestamp(int s) +{ +#ifdef HAVE_LINUX_NET_TSTAMP_H + int opt = SOF_TIMESTAMPING_RX_SOFTWARE | SOF_TIMESTAMPING_SOFTWARE; + if (setsockopt(s, SOL_SOCKET, SO_TIMESTAMPNS, (void*)&opt, (socklen_t)sizeof(opt)) < 0) { + log_err("setsockopt(..., SO_TIMESTAMPNS, ...) failed: %s", + strerror(errno)); + return 0; + } + return 1; +#else + log_err("packets timestamping is not supported on this platform"); + (void)s; + return 0; +#endif +} + /** set fd to receive source address packet info */ static int -set_recvpktinfo(int s, int family) +set_recvpktinfo(int s, int family) { #if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || (defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)) || defined(IP_PKTINFO) int on = 1; @@ -1214,6 +1235,9 @@ if_is_ssl(const char* ifname, const char* port, int ssl_port, * @param use_systemd: if true, fetch sockets from systemd. * @param dnscrypt_port: dnscrypt service port number * @param dscp: DSCP to use. + * @param sock_queue_timeout: the sock_queue_timeout from config. Seconds to + * wait to discard if UDP packets have waited for long in the socket + * buffer. * @return: returns false on error. */ static int @@ -1223,7 +1247,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, struct config_strlist* tls_additional_port, int https_port, struct config_strlist* proxy_protocol_port, int* reuseport, int transparent, int tcp_mss, int freebind, - int http2_nodelay, int use_systemd, int dnscrypt_port, int dscp) + int http2_nodelay, int use_systemd, int dnscrypt_port, int dscp, + int sock_queue_timeout) { int s, noip6=0; int is_https = if_is_https(ifname, port, https_port); @@ -1252,7 +1277,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, &noip6, rcv, snd, reuseport, transparent, tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock)) == -1) { - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); if(noip6) { log_warn("IPv6 protocol not available"); @@ -1263,15 +1289,20 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, /* getting source addr packet info is highly non-portable */ if(!set_recvpktinfo(s, hints->ai_family)) { sock_close(s); - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); return 0; } + if (sock_queue_timeout && !set_recvtimestamp(s)) { + log_warn("socket timestamping is not available"); + } if(!port_insert(list, s, is_dnscrypt ?listen_type_udpancil_dnscrypt:listen_type_udpancil, is_pp2, ub_sock)) { sock_close(s); - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); return 0; } @@ -1283,7 +1314,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, &noip6, rcv, snd, reuseport, transparent, tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock)) == -1) { - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); if(noip6) { log_warn("IPv6 protocol not available"); @@ -1291,11 +1323,15 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, } return 0; } + if (sock_queue_timeout && !set_recvtimestamp(s)) { + log_warn("socket timestamping is not available"); + } if(!port_insert(list, s, is_dnscrypt ?listen_type_udp_dnscrypt:listen_type_udp, is_pp2, ub_sock)) { sock_close(s); - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); return 0; } @@ -1318,7 +1354,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1, &noip6, 0, 0, reuseport, transparent, tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock)) == -1) { - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); if(noip6) { /*log_warn("IPv6 protocol not available");*/ @@ -1330,7 +1367,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, verbose(VERB_ALGO, "setup TCP for SSL service"); if(!port_insert(list, s, port_type, is_pp2, ub_sock)) { sock_close(s); - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); return 0; } @@ -1338,7 +1376,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, return 1; } -/** +/** * Add items to commpoint list in front. * @param c: commpoint to add. * @param front: listen struct. @@ -1389,7 +1427,7 @@ void listen_desetup_locks(void) } } -struct listen_dnsport* +struct listen_dnsport* listen_create(struct comm_base* base, struct listen_port* ports, size_t bufsize, int tcp_accept_count, int tcp_idle_timeout, int harden_large_queries, uint32_t http_max_streams, @@ -1525,10 +1563,10 @@ listen_list_delete(struct listen_list* list) } } -void +void listen_delete(struct listen_dnsport* front) { - if(!front) + if(!front) return; listen_list_delete(front->cps); #ifdef USE_DNSCRYPT @@ -1802,7 +1840,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, reuseport, cfg->ip_transparent, cfg->tcp_mss, cfg->ip_freebind, cfg->http_nodelay, cfg->use_systemd, - cfg->dnscrypt_port, cfg->ip_dscp)) { + cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) { listening_ports_free(list); return NULL; } @@ -1819,7 +1857,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, reuseport, cfg->ip_transparent, cfg->tcp_mss, cfg->ip_freebind, cfg->http_nodelay, cfg->use_systemd, - cfg->dnscrypt_port, cfg->ip_dscp)) { + cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) { listening_ports_free(list); return NULL; } @@ -1838,7 +1876,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, reuseport, cfg->ip_transparent, cfg->tcp_mss, cfg->ip_freebind, cfg->http_nodelay, cfg->use_systemd, - cfg->dnscrypt_port, cfg->ip_dscp)) { + cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) { listening_ports_free(list); return NULL; } @@ -1854,7 +1892,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, reuseport, cfg->ip_transparent, cfg->tcp_mss, cfg->ip_freebind, cfg->http_nodelay, cfg->use_systemd, - cfg->dnscrypt_port, cfg->ip_dscp)) { + cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) { listening_ports_free(list); return NULL; } @@ -1872,7 +1910,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, reuseport, cfg->ip_transparent, cfg->tcp_mss, cfg->ip_freebind, cfg->http_nodelay, cfg->use_systemd, - cfg->dnscrypt_port, cfg->ip_dscp)) { + cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) { listening_ports_free(list); return NULL; } @@ -1888,7 +1926,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, reuseport, cfg->ip_transparent, cfg->tcp_mss, cfg->ip_freebind, cfg->http_nodelay, cfg->use_systemd, - cfg->dnscrypt_port, cfg->ip_dscp)) { + cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) { listening_ports_free(list); return NULL; } @@ -1908,7 +1946,8 @@ void listening_ports_free(struct listen_port* list) } /* rc_ports don't have ub_socket */ if(list->socket) { - freeaddrinfo(list->socket->addr); + if(list->socket->addr) + freeaddrinfo(list->socket->addr); free(list->socket); } free(list); @@ -1919,8 +1958,8 @@ void listening_ports_free(struct listen_port* list) size_t listen_get_mem(struct listen_dnsport* listen) { struct listen_list* p; - size_t s = sizeof(*listen) + sizeof(*listen->base) + - sizeof(*listen->udp_buff) + + size_t s = sizeof(*listen) + sizeof(*listen->base) + + sizeof(*listen->udp_buff) + sldns_buffer_capacity(listen->udp_buff); #ifdef USE_DNSCRYPT s += sizeof(*listen->dnscrypt_udp_buff); @@ -2001,7 +2040,7 @@ void tcp_req_info_clear(struct tcp_req_info* req) } req->open_req_list = NULL; req->num_open_req = 0; - + /* free pending writable result packets */ item = req->done_req_list; while(item) { @@ -2060,7 +2099,7 @@ tcp_req_info_setup_listen(struct tcp_req_info* req) wr = 1; if(!req->read_is_closed) rd = 1; - + if(wr) { req->cp->tcp_is_reading = 0; comm_point_stop_listening(req->cp); @@ -2196,7 +2235,7 @@ tcp_req_info_handle_readdone(struct tcp_req_info* req) } req->in_worker_handle = 0; /* it should be waiting in the mesh for recursion. - * If mesh failed to add a new entry and called commpoint_drop_reply. + * If mesh failed to add a new entry and called commpoint_drop_reply. * Then the mesh state has been cleared. */ if(req->is_drop) { /* the reply has been dropped, stream has been closed. */ @@ -2256,7 +2295,7 @@ tcp_req_info_add_result(struct tcp_req_info* req, uint8_t* buf, size_t len) last = req->done_req_list; while(last && last->next) last = last->next; - + /* create new element */ item = (struct tcp_req_done_item*)malloc(sizeof(*item)); if(!item) { @@ -2615,7 +2654,7 @@ static int http2_query_read_done(struct http2_session* h2_session, "buffer already assigned to stream"); return -1; } - + /* the c->buffer might be used by mesh_send_reply and no be cleard * need to be cleared before use */ sldns_buffer_clear(h2_session->c->buffer); diff --git a/sbin/unwind/libunbound/services/localzone.c b/sbin/unwind/libunbound/services/localzone.c index 3536b7aaa..44da22d78 100644 --- a/sbin/unwind/libunbound/services/localzone.c +++ b/sbin/unwind/libunbound/services/localzone.c @@ -1308,6 +1308,7 @@ local_encode(struct query_info* qinfo, struct module_env* env, else rep.ns_numrrsets = 1; rep.rrset_count = 1; rep.rrsets = &rrset; + rep.reason_bogus = LDNS_EDE_NONE; udpsize = edns->udp_size; edns->edns_version = EDNS_ADVERTISED_VERSION; edns->udp_size = EDNS_ADVERTISED_SIZE; @@ -1603,7 +1604,7 @@ local_zone_does_not_cover(struct local_zone* z, struct query_info* qinfo, struct local_data key; struct local_data* ld = NULL; struct local_rrset* lr = NULL; - if(z->type == local_zone_always_transparent) + if(z->type == local_zone_always_transparent || z->type == local_zone_block_a) return 1; if(z->type != local_zone_transparent && z->type != local_zone_typetransparent @@ -1679,6 +1680,16 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env, } else if(lz_type == local_zone_typetransparent || lz_type == local_zone_always_transparent) { /* no NODATA or NXDOMAINS for this zone type */ + return 0; + } else if(lz_type == local_zone_block_a) { + /* Return NODATA for all A queries */ + if(qinfo->qtype == LDNS_RR_TYPE_A) { + local_error_encode(qinfo, env, edns, repinfo, buf, temp, + LDNS_RCODE_NOERROR, (LDNS_RCODE_NOERROR|BIT_AA), + LDNS_EDE_NONE, NULL); + return 1; + } + return 0; } else if(lz_type == local_zone_always_null) { /* 0.0.0.0 or ::0 or noerror/nodata for this zone type, @@ -1846,7 +1857,8 @@ local_zones_answer(struct local_zones* zones, struct module_env* env, if(z && (lzt == local_zone_transparent || lzt == local_zone_typetransparent || lzt == local_zone_inform || - lzt == local_zone_always_transparent) && + lzt == local_zone_always_transparent || + lzt == local_zone_block_a) && local_zone_does_not_cover(z, qinfo, labs)) { lock_rw_unlock(&z->lock); z = NULL; @@ -1894,6 +1906,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env, if(lzt != local_zone_always_refuse && lzt != local_zone_always_transparent + && lzt != local_zone_block_a && lzt != local_zone_always_nxdomain && lzt != local_zone_always_nodata && lzt != local_zone_always_deny @@ -1924,6 +1937,7 @@ const char* local_zone_type2str(enum localzone_type t) case local_zone_inform_deny: return "inform_deny"; case local_zone_inform_redirect: return "inform_redirect"; case local_zone_always_transparent: return "always_transparent"; + case local_zone_block_a: return "block_a"; case local_zone_always_refuse: return "always_refuse"; case local_zone_always_nxdomain: return "always_nxdomain"; case local_zone_always_nodata: return "always_nodata"; @@ -1958,6 +1972,8 @@ int local_zone_str2type(const char* type, enum localzone_type* t) *t = local_zone_inform_redirect; else if(strcmp(type, "always_transparent") == 0) *t = local_zone_always_transparent; + else if(strcmp(type, "block_a") == 0) + *t = local_zone_block_a; else if(strcmp(type, "always_refuse") == 0) *t = local_zone_always_refuse; else if(strcmp(type, "always_nxdomain") == 0) diff --git a/sbin/unwind/libunbound/services/localzone.h b/sbin/unwind/libunbound/services/localzone.h index 19534f750..4456893ee 100644 --- a/sbin/unwind/libunbound/services/localzone.h +++ b/sbin/unwind/libunbound/services/localzone.h @@ -88,6 +88,8 @@ enum localzone_type { local_zone_inform_redirect, /** resolve normally, even when there is local data */ local_zone_always_transparent, + /** resolve normally, even when there is local data but return NODATA for A queries */ + local_zone_block_a, /** answer with error, even when there is local data */ local_zone_always_refuse, /** answer with nxdomain, even when there is local data */ diff --git a/sbin/unwind/libunbound/services/mesh.c b/sbin/unwind/libunbound/services/mesh.c index 9007b6e08..52d14a2d1 100644 --- a/sbin/unwind/libunbound/services/mesh.c +++ b/sbin/unwind/libunbound/services/mesh.c @@ -4,22 +4,22 @@ * Copyright (c) 2007, NLnet Labs. All rights reserved. * * This software is open source. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. - * + * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. - * + * * Neither the name of the NLNET LABS nor the names of its contributors may * be used to endorse or promote products derived from this software without * specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR @@ -63,82 +63,13 @@ #include "util/data/dname.h" #include "respip/respip.h" #include "services/listen_dnsport.h" +#include "util/timeval_func.h" #ifdef CLIENT_SUBNET #include "edns-subnet/subnetmod.h" #include "edns-subnet/edns-subnet.h" #endif -/** subtract timers and the values do not overflow or become negative */ -static void -timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start) -{ -#ifndef S_SPLINT_S - time_t end_usec = end->tv_usec; - d->tv_sec = end->tv_sec - start->tv_sec; - if(end_usec < start->tv_usec) { - end_usec += 1000000; - d->tv_sec--; - } - d->tv_usec = end_usec - start->tv_usec; -#endif -} - -/** add timers and the values do not overflow or become negative */ -static void -timeval_add(struct timeval* d, const struct timeval* add) -{ -#ifndef S_SPLINT_S - d->tv_sec += add->tv_sec; - d->tv_usec += add->tv_usec; - if(d->tv_usec >= 1000000 ) { - d->tv_usec -= 1000000; - d->tv_sec++; - } -#endif -} - -/** divide sum of timers to get average */ -static void -timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d) -{ -#ifndef S_SPLINT_S - size_t leftover; - if(d <= 0) { - avg->tv_sec = 0; - avg->tv_usec = 0; - return; - } - avg->tv_sec = sum->tv_sec / d; - avg->tv_usec = sum->tv_usec / d; - /* handle fraction from seconds divide */ - leftover = sum->tv_sec - avg->tv_sec*d; - if(leftover <= 0) - leftover = 0; - avg->tv_usec += (((long long)leftover)*((long long)1000000))/d; - if(avg->tv_sec < 0) - avg->tv_sec = 0; - if(avg->tv_usec < 0) - avg->tv_usec = 0; -#endif -} - -/** histogram compare of time values */ -static int -timeval_smaller(const struct timeval* x, const struct timeval* y) -{ -#ifndef S_SPLINT_S - if(x->tv_sec < y->tv_sec) - return 1; - else if(x->tv_sec == y->tv_sec) { - if(x->tv_usec <= y->tv_usec) - return 1; - else return 0; - } - else return 0; -#endif -} - /** * Compare two response-ip client info entries for the purpose of mesh state * compare. It returns 0 if ci_a and ci_b are considered equal; otherwise @@ -249,7 +180,7 @@ mesh_state_ref_compare(const void* ap, const void* bp) return mesh_state_compare(a->s, b->s); } -struct mesh_area* +struct mesh_area* mesh_create(struct module_stack* stack, struct module_env* env) { struct mesh_area* mesh = calloc(1, sizeof(struct mesh_area)); @@ -275,6 +206,7 @@ mesh_create(struct module_stack* stack, struct module_env* env) mesh->stats_jostled = 0; mesh->stats_dropped = 0; mesh->ans_expired = 0; + mesh->ans_cachedb = 0; mesh->max_reply_states = env->cfg->num_queries_per_thread; mesh->max_forever_states = (mesh->max_reply_states+1)/2; #ifndef S_SPLINT_S @@ -298,7 +230,7 @@ mesh_delete_helper(rbnode_type* n) * traversal and rbtree rebalancing do not work together */ } -void +void mesh_delete(struct mesh_area* mesh) { if(!mesh) @@ -341,7 +273,7 @@ int mesh_make_new_space(struct mesh_area* mesh, sldns_buffer* qbuf) if(m && m->reply_list && m->list_select == mesh_jostle_list) { /* how old is it? */ struct timeval age; - timeval_subtract(&age, mesh->env->now_tv, + timeval_subtract(&age, mesh->env->now_tv, &m->reply_list->start_time); if(timeval_smaller(&mesh->jostle_max, &age)) { /* its a goner */ @@ -517,6 +449,8 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo, comm_point_send_reply(rep); return; } + /* set detached (it is now) */ + mesh->num_detached_states++; if(unique) mesh_state_make_unique(s); s->s.rpz_passthru = rpz_passthru; @@ -525,13 +459,14 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo, s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in, s->s.region); if(!s->s.edns_opts_front_in) { - log_err("mesh_state_create: out of memory; SERVFAIL"); + log_err("edns_opt_copy_region: out of memory; SERVFAIL"); if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv)) edns->opt_list_inplace_cb_out = NULL; error_encode(r_buffer, LDNS_RCODE_SERVFAIL, qinfo, qid, qflags, edns); comm_point_send_reply(rep); + mesh_state_delete(&s->s); return; } } @@ -543,8 +478,6 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo, #endif rbtree_insert(&mesh->all, &s->node); log_assert(n != NULL); - /* set detached (it is now) */ - mesh->num_detached_states++; added = 1; } if(!s->reply_list && !s->cb_list) { @@ -585,11 +518,11 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo, /* move to either the forever or the jostle_list */ if(mesh->num_forever_states < mesh->max_forever_states) { mesh->num_forever_states ++; - mesh_list_insert(s, &mesh->forever_first, + mesh_list_insert(s, &mesh->forever_first, &mesh->forever_last); s->list_select = mesh_forever_list; } else { - mesh_list_insert(s, &mesh->jostle_first, + mesh_list_insert(s, &mesh->jostle_first, &mesh->jostle_last); s->list_select = mesh_jostle_list; } @@ -610,9 +543,9 @@ servfail_mem: return; } -int +int mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, - uint16_t qflags, struct edns_data* edns, sldns_buffer* buf, + uint16_t qflags, struct edns_data* edns, sldns_buffer* buf, uint16_t qid, mesh_cb_func_type cb, void* cb_arg, int rpz_passthru) { struct mesh_state* s = NULL; @@ -637,6 +570,8 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, if(!s) { return 0; } + /* set detached (it is now) */ + mesh->num_detached_states++; if(unique) mesh_state_make_unique(s); s->s.rpz_passthru = rpz_passthru; @@ -644,6 +579,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in, s->s.region); if(!s->s.edns_opts_front_in) { + mesh_state_delete(&s->s); return 0; } } @@ -654,8 +590,6 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, #endif rbtree_insert(&mesh->all, &s->node); log_assert(n != NULL); - /* set detached (it is now) */ - mesh->num_detached_states++; added = 1; } if(!s->reply_list && !s->cb_list) { @@ -672,6 +606,8 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, } /* add serve expired timer if not already there */ if(timeout && !mesh_serve_expired_init(s, timeout)) { + if(added) + mesh_state_delete(&s->s); return 0; } /* update statistics */ @@ -773,7 +709,7 @@ static void mesh_schedule_prefetch(struct mesh_area* mesh, * attached its own ECS data. */ static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh, struct query_info* qinfo, uint16_t qflags, time_t leeway, int run, - int rpz_passthru, struct comm_reply* rep, struct edns_option* edns_list) + int rpz_passthru, struct sockaddr_storage* addr, struct edns_option* edns_list) { struct mesh_state* s = NULL; struct edns_option* opt = NULL; @@ -803,20 +739,10 @@ static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh, return; } } else { - /* Fake the ECS data from the client's IP */ - struct ecs_data ecs; - memset(&ecs, 0, sizeof(ecs)); - subnet_option_from_ss(&rep->client_addr, &ecs, mesh->env->cfg); - if(ecs.subnet_validdata == 0) { - log_err("prefetch_subnet subnet_option_from_ss: invalid data"); - return; - } - subnet_ecs_opt_list_append(&ecs, &s->s.edns_opts_front_in, - &s->s, s->s.region); - if(!s->s.edns_opts_front_in) { - log_err("prefetch_subnet subnet_ecs_opt_list_append: out of memory"); - return; - } + /* Store the client's address. Later in the subnet module, + * it is decided whether to include an ECS option or not. + */ + s->s.client_addr = *addr; } #ifdef UNBOUND_DEBUG n = @@ -863,14 +789,14 @@ static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh, void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo, uint16_t qflags, time_t leeway, int rpz_passthru, - struct comm_reply* rep, struct edns_option* opt_list) + struct sockaddr_storage* addr, struct edns_option* opt_list) { + (void)addr; (void)opt_list; - (void)rep; #ifdef CLIENT_SUBNET - if(rep) + if(addr) mesh_schedule_prefetch_subnet(mesh, qinfo, qflags, leeway, 1, - rpz_passthru, rep, opt_list); + rpz_passthru, addr, opt_list); else #endif mesh_schedule_prefetch(mesh, qinfo, qflags, leeway, 1, @@ -900,7 +826,7 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo, int i; if(!region) return NULL; - mstate = (struct mesh_state*)regional_alloc(region, + mstate = (struct mesh_state*)regional_alloc(region, sizeof(struct mesh_state)); if(!mstate) { alloc_reg_release(env->alloc, region); @@ -970,19 +896,13 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo, return mstate; } -int -mesh_state_is_unique(struct mesh_state* mstate) -{ - return mstate->unique != NULL; -} - void mesh_state_make_unique(struct mesh_state* mstate) { mstate->unique = mstate; } -void +void mesh_state_cleanup(struct mesh_state* mstate) { struct mesh_area* mesh; @@ -1028,7 +948,7 @@ mesh_state_cleanup(struct mesh_state* mstate) alloc_reg_release(mstate->s.env->alloc, mstate->s.region); } -void +void mesh_state_delete(struct module_qstate* qstate) { struct mesh_area* mesh; @@ -1041,10 +961,10 @@ mesh_state_delete(struct module_qstate* qstate) mesh_detach_subs(&mstate->s); if(mstate->list_select == mesh_forever_list) { mesh->num_forever_states --; - mesh_list_remove(mstate, &mesh->forever_first, + mesh_list_remove(mstate, &mesh->forever_first, &mesh->forever_last); } else if(mstate->list_select == mesh_jostle_list) { - mesh_list_remove(mstate, &mesh->jostle_first, + mesh_list_remove(mstate, &mesh->jostle_first, &mesh->jostle_last); } if(!mstate->reply_list && !mstate->cb_list @@ -1116,7 +1036,7 @@ void mesh_detach_subs(struct module_qstate* qstate) if(!ref->s->reply_list && !ref->s->cb_list && ref->s->super_set.count == 0) { mesh->num_detached_states++; - log_assert(mesh->num_detached_states + + log_assert(mesh->num_detached_states + mesh->num_reply_states <= mesh->all.count); } } @@ -1181,7 +1101,7 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo, if(!mesh_state_attachment(qstate->mesh_info, sub)) return 0; /* if it was a duplicate attachment, the count was not zero before */ - if(!sub->reply_list && !sub->cb_list && was_detached && + if(!sub->reply_list && !sub->cb_list && was_detached && sub->super_set.count == 1) { /* it used to be detached, before this one got added */ log_assert(mesh->num_detached_states > 0); @@ -1251,7 +1171,7 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep, else secure = 0; if(!rep && rcode == LDNS_RCODE_NOERROR) rcode = LDNS_RCODE_SERVFAIL; - if(!rcode && (rep->security == sec_status_bogus || + if(!rcode && rep && (rep->security == sec_status_bogus || rep->security == sec_status_secure_sentinel_fail)) { if(!(reason = errinf_to_str_bogus(&m->s))) rcode = LDNS_RCODE_SERVFAIL; @@ -1280,10 +1200,10 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep, if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, LDNS_RCODE_NOERROR, &r->edns, NULL, m->s.region, start_time) || - !reply_info_answer_encode(&m->s.qinfo, rep, r->qid, - r->qflags, r->buf, 0, 1, - m->s.env->scratch, udp_size, &r->edns, - (int)(r->edns.bits & EDNS_DO), secure)) + !reply_info_answer_encode(&m->s.qinfo, rep, r->qid, + r->qflags, r->buf, 0, 1, + m->s.env->scratch, udp_size, &r->edns, + (int)(r->edns.bits & EDNS_DO), secure)) { fptr_ok(fptr_whitelist_mesh_cb(r->cb)); (*r->cb)(r->cb_arg, LDNS_RCODE_SERVFAIL, r->buf, @@ -1291,7 +1211,8 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep, } else { fptr_ok(fptr_whitelist_mesh_cb(r->cb)); (*r->cb)(r->cb_arg, LDNS_RCODE_NOERROR, r->buf, - rep->security, reason, was_ratelimited); + (rep?rep->security:sec_status_unchecked), + reason, was_ratelimited); } } free(reason); @@ -1311,10 +1232,36 @@ mesh_is_rpz_respip_tcponly_action(struct mesh_state const* m) } static inline int -mesh_is_udp(struct mesh_reply const* r) { +mesh_is_udp(struct mesh_reply const* r) +{ return r->query_reply.c->type == comm_udp; } +static inline void +mesh_find_and_attach_ede_and_reason(struct mesh_state* m, + struct reply_info* rep, struct mesh_reply* r) +{ + /* OLD note: + * During validation the EDE code can be received via two + * code paths. One code path fills the reply_info EDE, and + * the other fills it in the errinf_strlist. These paths + * intersect at some points, but where is opaque due to + * the complexity of the validator. At the time of writing + * we make the choice to prefer the EDE from errinf_strlist + * but a compelling reason to do otherwise is just as valid + * NEW note: + * The compelling reason is that with caching support, the value + * in the reply_info is cached. + * The reason members of the reply_info struct should be + * updated as they are already cached. No reason to + * try and find the EDE information in errinf anymore. + */ + if(rep->reason_bogus != LDNS_EDE_NONE) { + edns_opt_list_append_ede(&r->edns.opt_list_out, + m->s.region, rep->reason_bogus, rep->reason_bogus_str); + } +} + /** * Send reply to mesh reply entry * @param m: mesh state to send it for. @@ -1346,7 +1293,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep, /* examine security status */ if(m->s.env->need_to_validate && (!(r->qflags&BIT_CD) || - m->s.env->cfg->ignore_cd) && rep && + m->s.env->cfg->ignore_cd) && rep && (rep->security <= sec_status_bogus || rep->security == sec_status_secure_sentinel_fail)) { rcode = LDNS_RCODE_SERVFAIL; @@ -1401,40 +1348,17 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep, if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode, &r->edns, &r->query_reply, m->s.region, &r->start_time)) r->edns.opt_list_inplace_cb_out = NULL; - } else { + } else { if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, rcode, &r->edns, &r->query_reply, m->s.region, &r->start_time)) r->edns.opt_list_inplace_cb_out = NULL; } - /* Send along EDE BOGUS EDNS0 option when answer is bogus */ - if(m->s.env->cfg->ede && rcode == LDNS_RCODE_SERVFAIL && - m->s.env->need_to_validate && (!(r->qflags&BIT_CD) || - m->s.env->cfg->ignore_cd) && rep && - (rep->security <= sec_status_bogus || - rep->security == sec_status_secure_sentinel_fail)) { - char *reason = m->s.env->cfg->val_log_level >= 2 - ? errinf_to_str_bogus(&m->s) : NULL; - - /* During validation the EDE code can be received via two - * code paths. One code path fills the reply_info EDE, and - * the other fills it in the errinf_strlist. These paths - * intersect at some points, but where is opaque due to - * the complexity of the validator. At the time of writing - * we make the choice to prefer the EDE from errinf_strlist - * but a compelling reason to do otherwise is just as valid - */ - sldns_ede_code reason_bogus = errinf_to_reason_bogus(&m->s); - if ((reason_bogus == LDNS_EDE_DNSSEC_BOGUS && - rep->reason_bogus != LDNS_EDE_NONE) || - reason_bogus == LDNS_EDE_NONE) { - reason_bogus = rep->reason_bogus; - } - - if(reason_bogus != LDNS_EDE_NONE) { - edns_opt_list_append_ede(&r->edns.opt_list_out, - m->s.region, reason_bogus, reason); - } - free(reason); + /* Send along EDE EDNS0 option when SERVFAILing; usually + * DNSSEC validation failures */ + /* Since we are SERVFAILing here, CD bit and rep->security + * is already handled. */ + if(m->s.env->cfg->ede && rep) { + mesh_find_and_attach_ede_and_reason(m, rep, r); } error_encode(r_buffer, rcode, &m->s.qinfo, r->qid, r->qflags, &r->edns); @@ -1449,12 +1373,22 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep, r->edns.bits &= EDNS_DO; m->s.qinfo.qname = r->qname; m->s.qinfo.local_alias = r->local_alias; + + /* Attach EDE without SERVFAIL if the validation failed. + * Need to explicitly check for rep->security otherwise failed + * validation paths may attach to a secure answer. */ + if(m->s.env->cfg->ede && rep && + (rep->security <= sec_status_bogus || + rep->security == sec_status_secure_sentinel_fail)) { + mesh_find_and_attach_ede_and_reason(m, rep, r); + } + if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, LDNS_RCODE_NOERROR, &r->edns, &r->query_reply, m->s.region, &r->start_time) || - !reply_info_answer_encode(&m->s.qinfo, rep, r->qid, + !reply_info_answer_encode(&m->s.qinfo, rep, r->qid, r->qflags, r_buffer, 0, 1, m->s.env->scratch, udp_size, &r->edns, (int)(r->edns.bits & EDNS_DO), - secure)) + secure)) { if(!inplace_cb_reply_servfail_call(m->s.env, &m->s.qinfo, &m->s, rep, LDNS_RCODE_SERVFAIL, &r->edns, &r->query_reply, m->s.region, &r->start_time)) @@ -1503,6 +1437,7 @@ void mesh_query_done(struct mesh_state* mstate) struct reply_info* rep = (mstate->s.return_msg? mstate->s.return_msg->rep:NULL); struct timeval tv = {0, 0}; + int i = 0; /* No need for the serve expired timer anymore; we are going to reply. */ if(mstate->s.serve_expired_data) { comm_timer_delete(mstate->s.serve_expired_data->timer); @@ -1522,6 +1457,7 @@ void mesh_query_done(struct mesh_state* mstate) } } for(r = mstate->reply_list; r; r = r->next) { + i++; tv = r->start_time; /* if a response-ip address block has been stored the @@ -1533,16 +1469,6 @@ void mesh_query_done(struct mesh_state* mstate) mstate->s.qinfo.qclass, r->local_alias, &r->query_reply.client_addr, r->query_reply.client_addrlen); - if(mstate->s.env->cfg->stat_extended && - mstate->s.respip_action_info->rpz_used) { - if(mstate->s.respip_action_info->rpz_disabled) - mstate->s.env->mesh->rpz_action[RPZ_DISABLED_ACTION]++; - if(mstate->s.respip_action_info->rpz_cname_override) - mstate->s.env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++; - else - mstate->s.env->mesh->rpz_action[respip_action_to_rpz_action( - mstate->s.respip_action_info->action)]++; - } } /* if this query is determined to be dropped during the @@ -1573,6 +1499,27 @@ void mesh_query_done(struct mesh_state* mstate) prev_buffer = r_buffer; } } + /* Account for each reply sent. */ + if(i > 0 && mstate->s.respip_action_info && + mstate->s.respip_action_info->addrinfo && + mstate->s.env->cfg->stat_extended && + mstate->s.respip_action_info->rpz_used) { + if(mstate->s.respip_action_info->rpz_disabled) + mstate->s.env->mesh->rpz_action[RPZ_DISABLED_ACTION] += i; + if(mstate->s.respip_action_info->rpz_cname_override) + mstate->s.env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION] += i; + else + mstate->s.env->mesh->rpz_action[respip_action_to_rpz_action( + mstate->s.respip_action_info->action)] += i; + } + if(!mstate->s.is_drop && i > 0) { + if(mstate->s.env->cfg->stat_extended + && mstate->s.is_cachedb_answer) { + mstate->s.env->mesh->ans_cachedb += i; + } + } + + /* Mesh area accounting */ if(mstate->reply_list) { mstate->reply_list = NULL; if(!mstate->reply_list && !mstate->cb_list) { @@ -1585,6 +1532,7 @@ void mesh_query_done(struct mesh_state* mstate) mstate->s.env->mesh->num_detached_states++; } mstate->replies_sent = 1; + while((c = mstate->cb_list) != NULL) { /* take this cb off the list; so that the list can be * changed, eg. by adds from the callback routine */ @@ -1611,7 +1559,7 @@ void mesh_walk_supers(struct mesh_area* mesh, struct mesh_state* mstate) /* callback the function to inform super of result */ fptr_ok(fptr_whitelist_mod_inform_super( mesh->mods.mod[ref->s->s.curmod]->inform_super)); - (*mesh->mods.mod[ref->s->s.curmod]->inform_super)(&mstate->s, + (*mesh->mods.mod[ref->s->s.curmod]->inform_super)(&mstate->s, ref->s->s.curmod, &ref->s->s); /* copy state that is always relevant to super */ copy_state_to_super(&mstate->s, ref->s->s.curmod, &ref->s->s); @@ -1635,7 +1583,7 @@ struct mesh_state* mesh_area_find(struct mesh_area* mesh, * desire aggregation).*/ key.unique = NULL; key.s.client_info = cinfo; - + result = (struct mesh_state*)rbtree_search(&mesh->all, &key); return result; } @@ -1644,7 +1592,7 @@ int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns, sldns_buffer* buf, mesh_cb_func_type cb, void* cb_arg, uint16_t qid, uint16_t qflags) { - struct mesh_cb* r = regional_alloc(s->s.region, + struct mesh_cb* r = regional_alloc(s->s.region, sizeof(struct mesh_cb)); if(!r) return 0; @@ -1776,7 +1724,7 @@ mesh_copy_qinfo(struct mesh_state* mstate, struct query_info** qinfop, * Handles module finished. * @param mesh: the mesh area. * @param mstate: currently active mesh state. - * Deleted if finished, calls _done and _supers to + * Deleted if finished, calls _done and _supers to * send replies to clients and inform other mesh states. * This in turn may create additional runnable mesh states. * @param s: state at which the current module exited. @@ -1810,7 +1758,7 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate, } if(s == module_restart_next) { int curmod = mstate->s.curmod; - for(; mstate->s.curmod < mesh->mods.num; + for(; mstate->s.curmod < mesh->mods.num; mstate->s.curmod++) { fptr_ok(fptr_whitelist_mod_clear( mesh->mods.mod[mstate->s.curmod]->clear)); @@ -1842,9 +1790,21 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate, if(s == module_finished) { if(mstate->s.curmod == 0) { struct query_info* qinfo = NULL; + struct edns_option* opt_list = NULL; + struct sockaddr_storage addr; uint16_t qflags; int rpz_p = 0; +#ifdef CLIENT_SUBNET + struct edns_option* ecs; + if(mstate->s.need_refetch && mstate->reply_list && + modstack_find(&mesh->mods, "subnetcache") != -1 && + mstate->s.env->unique_mesh) { + addr = mstate->reply_list->query_reply.client_addr; + } else +#endif + memset(&addr, 0, sizeof(addr)); + mesh_query_done(mstate); mesh_walk_supers(mesh, mstate); @@ -1854,13 +1814,28 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate, * we need to make a copy of the query info here. */ if(mstate->s.need_refetch) { mesh_copy_qinfo(mstate, &qinfo, &qflags); +#ifdef CLIENT_SUBNET + /* Make also a copy of the ecs option if any */ + if((ecs = edns_opt_list_find( + mstate->s.edns_opts_front_in, + mstate->s.env->cfg->client_subnet_opcode)) != NULL) { + (void)edns_opt_list_append(&opt_list, + ecs->opt_code, ecs->opt_len, + ecs->opt_data, + mstate->s.env->scratch); + } +#endif rpz_p = mstate->s.rpz_passthru; } - mesh_state_delete(&mstate->s); if(qinfo) { - mesh_schedule_prefetch(mesh, qinfo, qflags, - 0, 1, rpz_p); + mesh_state_delete(&mstate->s); + mesh_new_prefetch(mesh, qinfo, qflags, 0, + rpz_p, + addr.ss_family!=AF_UNSPEC?&addr:NULL, + opt_list); + } else { + mesh_state_delete(&mstate->s); } return 0; } @@ -1888,7 +1863,7 @@ void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate, mstate->s.reply = NULL; regional_free_all(mstate->s.env->scratch); s = mstate->s.ext_state[mstate->s.curmod]; - verbose(VERB_ALGO, "mesh_run: %s module exit state is %s", + verbose(VERB_ALGO, "mesh_run: %s module exit state is %s", mesh->mods.mod[mstate->s.curmod]->name, strextstate(s)); e = NULL; if(mesh_continue(mesh, mstate, s, &ev)) @@ -1908,14 +1883,14 @@ void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate, } } -void +void mesh_log_list(struct mesh_area* mesh) { char buf[30]; struct mesh_state* m; int num = 0; RBTREE_FOR(m, struct mesh_state*, &mesh->all) { - snprintf(buf, sizeof(buf), "%d%s%s%s%s%s%s mod%d %s%s", + snprintf(buf, sizeof(buf), "%d%s%s%s%s%s%s mod%d %s%s", num++, (m->s.is_priming)?"p":"", /* prime */ (m->s.is_valrec)?"v":"", /* prime */ (m->s.query_flags&BIT_RD)?"RD":"", @@ -1924,18 +1899,18 @@ mesh_log_list(struct mesh_area* mesh) (m->sub_set.count!=0)?"c":"", /* children */ m->s.curmod, (m->reply_list)?"rep":"", /*hasreply*/ (m->cb_list)?"cb":"" /* callbacks */ - ); + ); log_query_info(VERB_ALGO, buf, &m->s.qinfo); } } -void +void mesh_stats(struct mesh_area* mesh, const char* str) { verbose(VERB_DETAIL, "%s %u recursion states (%u with reply, " "%u detached), %u waiting replies, %u recursion replies " - "sent, %d replies dropped, %d states jostled out", - str, (unsigned)mesh->all.count, + "sent, %d replies dropped, %d states jostled out", + str, (unsigned)mesh->all.count, (unsigned)mesh->num_reply_states, (unsigned)mesh->num_detached_states, (unsigned)mesh->num_reply_addrs, @@ -1944,7 +1919,7 @@ mesh_stats(struct mesh_area* mesh, const char* str) (unsigned)mesh->stats_jostled); if(mesh->replies_sent > 0) { struct timeval avg; - timeval_divide(&avg, &mesh->replies_sum_wait, + timeval_divide(&avg, &mesh->replies_sum_wait, mesh->replies_sent); log_info("average recursion processing time " ARG_LL "d.%6.6d sec", @@ -1954,7 +1929,7 @@ mesh_stats(struct mesh_area* mesh, const char* str) } } -void +void mesh_stats_clear(struct mesh_area* mesh) { if(!mesh) @@ -1968,12 +1943,13 @@ mesh_stats_clear(struct mesh_area* mesh) mesh->ans_secure = 0; mesh->ans_bogus = 0; mesh->ans_expired = 0; + mesh->ans_cachedb = 0; memset(&mesh->ans_rcode[0], 0, sizeof(size_t)*UB_STATS_RCODE_NUM); memset(&mesh->rpz_action[0], 0, sizeof(size_t)*UB_STATS_RPZ_ACTION_NUM); mesh->ans_nodata = 0; } -size_t +size_t mesh_get_mem(struct mesh_area* mesh) { struct mesh_state* m; @@ -1987,7 +1963,7 @@ mesh_get_mem(struct mesh_area* mesh) return s; } -int +int mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo, uint16_t flags, int prime, int valrec) { @@ -2104,6 +2080,7 @@ mesh_serve_expired_callback(void* arg) struct timeval tv = {0, 0}; int must_validate = (!(qstate->query_flags&BIT_CD) || qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate; + int i = 0; if(!qstate->serve_expired_data) return; verbose(VERB_ALGO, "Serve expired: Trying to reply with expired data"); comm_timer_delete(qstate->serve_expired_data->timer); @@ -2175,6 +2152,7 @@ mesh_serve_expired_callback(void* arg) log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep); for(r = mstate->reply_list; r; r = r->next) { + i++; tv = r->start_time; /* If address info is returned, it means the action should be an @@ -2184,16 +2162,6 @@ mesh_serve_expired_callback(void* arg) qstate->qinfo.qtype, qstate->qinfo.qclass, r->local_alias, &r->query_reply.client_addr, r->query_reply.client_addrlen); - - if(qstate->env->cfg->stat_extended && actinfo.rpz_used) { - if(actinfo.rpz_disabled) - qstate->env->mesh->rpz_action[RPZ_DISABLED_ACTION]++; - if(actinfo.rpz_cname_override) - qstate->env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++; - else - qstate->env->mesh->rpz_action[ - respip_action_to_rpz_action(actinfo.action)]++; - } } /* Add EDE Stale Answer (RCF8914). Ignore global ede as this is @@ -2213,11 +2181,23 @@ mesh_serve_expired_callback(void* arg) tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate); prev = r; prev_buffer = r_buffer; - - /* Account for each reply sent. */ - mesh->ans_expired++; - } + /* Account for each reply sent. */ + if(i > 0) { + mesh->ans_expired += i; + if(actinfo.addrinfo && qstate->env->cfg->stat_extended && + actinfo.rpz_used) { + if(actinfo.rpz_disabled) + qstate->env->mesh->rpz_action[RPZ_DISABLED_ACTION] += i; + if(actinfo.rpz_cname_override) + qstate->env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION] += i; + else + qstate->env->mesh->rpz_action[ + respip_action_to_rpz_action(actinfo.action)] += i; + } + } + + /* Mesh area accounting */ if(mstate->reply_list) { mstate->reply_list = NULL; if(!mstate->reply_list && !mstate->cb_list) { @@ -2228,6 +2208,7 @@ mesh_serve_expired_callback(void* arg) } } } + while((c = mstate->cb_list) != NULL) { /* take this cb off the list; so that the list can be * changed, eg. by adds from the callback routine */ diff --git a/sbin/unwind/libunbound/services/mesh.h b/sbin/unwind/libunbound/services/mesh.h index 25121a67b..d926cfc9d 100644 --- a/sbin/unwind/libunbound/services/mesh.h +++ b/sbin/unwind/libunbound/services/mesh.h @@ -114,6 +114,8 @@ struct mesh_area { size_t stats_dropped; /** stats, number of expired replies sent */ size_t ans_expired; + /** stats, number of cached replies from cachedb */ + size_t ans_cachedb; /** number of replies sent */ size_t replies_sent; /** sum of waiting times for the replies */ @@ -335,13 +337,13 @@ int mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, * @param leeway: TTL leeway what to expire earlier for this update. * @param rpz_passthru: if true, the rpz passthru was previously found and * further rpz processing is stopped. - * @param rep: comm_reply for the client; to be used when subnet is enabled. + * @param addr: sockaddr_storage for the client; to be used with subnet. * @param opt_list: edns opt_list from the client; to be used when subnet is * enabled. */ void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo, uint16_t qflags, time_t leeway, int rpz_passthru, - struct comm_reply* rep, struct edns_option* opt_list); + struct sockaddr_storage* addr, struct edns_option* opt_list); /** * Handle new event from the wire. A serviced query has returned. @@ -478,14 +480,6 @@ struct mesh_state* mesh_state_create(struct module_env* env, struct query_info* qinfo, struct respip_client_info* cinfo, uint16_t qflags, int prime, int valrec); -/** - * Check if the mesh state is unique. - * A unique mesh state uses it's unique member to point to itself, else NULL. - * @param mstate: mesh state to check. - * @return true if the mesh state is unique, false otherwise. - */ -int mesh_state_is_unique(struct mesh_state* mstate); - /** * Make a mesh state unique. * A unique mesh state uses it's unique member to point to itself. diff --git a/sbin/unwind/libunbound/services/modstack.c b/sbin/unwind/libunbound/services/modstack.c index da8e623c1..a90d7178c 100644 --- a/sbin/unwind/libunbound/services/modstack.c +++ b/sbin/unwind/libunbound/services/modstack.c @@ -120,12 +120,16 @@ modstack_config(struct module_stack* stack, const char* module_conf) stack->mod[i] = module_factory(&module_conf); if(!stack->mod[i]) { char md[256]; + char * s = md; snprintf(md, sizeof(md), "%s", module_conf); - if(strchr(md, ' ')) *(strchr(md, ' ')) = 0; - if(strchr(md, '\t')) *(strchr(md, '\t')) = 0; + /* Leading spaces are present on errors. */ + while (*s && isspace((unsigned char)*s)) + s++; + if(strchr(s, ' ')) *(strchr(s, ' ')) = 0; + if(strchr(s, '\t')) *(strchr(s, '\t')) = 0; log_err("Unknown value in module-config, module: '%s'." " This module is not present (not compiled in)," - " See the list of linked modules with unbound -V", md); + " See the list of linked modules with unbound -V", s); return 0; } } diff --git a/sbin/unwind/libunbound/services/outside_network.c b/sbin/unwind/libunbound/services/outside_network.c index a4529ade5..2a219cbc6 100644 --- a/sbin/unwind/libunbound/services/outside_network.c +++ b/sbin/unwind/libunbound/services/outside_network.c @@ -551,8 +551,27 @@ reuse_tcp_find(struct outside_network* outnet, struct sockaddr_storage* addr, log_assert(&key_p != ((struct reuse_tcp*)result)->pending); } /* not found, return null */ + + /* It is possible that we search for something before the first element + * in the tree. Replace a null pointer with the first element. + */ + if (!result) { + verbose(VERB_CLIENT, "reuse_tcp_find: taking first"); + result = rbtree_first(&outnet->tcp_reuse); + } + if(!result || result == RBTREE_NULL) return NULL; + + /* It is possible that we got the previous address, but that the + * address we are looking for is in the tree. If the address we got + * is less than the address we are looking, then take the next entry. + */ + if (reuse_cmp_addrportssl(result->key, &key_p.reuse) < 0) { + verbose(VERB_CLIENT, "reuse_tcp_find: key too low"); + result = rbtree_next(result); + } + verbose(VERB_CLIENT, "reuse_tcp_find check inexact match"); /* inexact match, find one of possibly several connections to the * same destination address, with the correct port, ssl, and @@ -620,6 +639,15 @@ outnet_tcp_take_into_use(struct waiting_tcp* w) log_assert(w->addrlen > 0); pend->c->tcp_do_toggle_rw = 0; pend->c->tcp_do_close = 0; + + /* Consistency check, if we have ssl_upstream but no sslctx, then + * log an error and return failure. + */ + if (w->ssl_upstream && !w->outnet->sslctx) { + log_err("SSL upstream requested but no SSL context"); + return 0; + } + /* open socket */ s = outnet_get_tcp_fd(&w->addr, w->addrlen, w->outnet->tcp_mss, w->outnet->ip_dscp); diff --git a/sbin/unwind/libunbound/services/rpz.c b/sbin/unwind/libunbound/services/rpz.c index e876f3f94..6ce83cb66 100644 --- a/sbin/unwind/libunbound/services/rpz.c +++ b/sbin/unwind/libunbound/services/rpz.c @@ -1188,6 +1188,22 @@ rpz_find_zone(struct local_zones* zones, uint8_t* qname, size_t qname_len, uint1 return z; } +/** Find entry for RR type in the list of rrsets for the clientip. */ +static struct local_rrset* +rpz_find_synthesized_rrset(uint16_t qtype, + struct clientip_synthesized_rr* data) +{ + struct local_rrset* cursor = data->data; + while( cursor != NULL) { + struct packed_rrset_key* packed_rrset = &cursor->rrset->rk; + if(htons(qtype) == packed_rrset->type) { + return cursor; + } + cursor = cursor->next; + } + return NULL; +} + /** * Remove RR from RPZ's local-data * @param z: local-zone for RPZ, holding write lock @@ -1270,15 +1286,15 @@ rpz_rrset_delete_rr(struct resp_addr* raddr, uint16_t rr_type, uint8_t* rdata, } -/** Remove RR from RPZ's local-zone */ +/** Remove RR from rpz localzones structure */ static void -rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, - enum rpz_action a, uint16_t rr_type, uint16_t rr_class, - uint8_t* rdatawl, size_t rdatalen) +rpz_remove_local_zones_trigger(struct local_zones* zones, uint8_t* dname, + size_t dnamelen, enum rpz_action a, uint16_t rr_type, + uint16_t rr_class, uint8_t* rdatawl, size_t rdatalen) { struct local_zone* z; int delete_zone = 1; - z = rpz_find_zone(r->local_zones, dname, dnamelen, rr_class, + z = rpz_find_zone(zones, dname, dnamelen, rr_class, 1 /* only exact */, 1 /* wr lock */, 1 /* keep lock*/); if(!z) { verbose(VERB_ALGO, "rpz: cannot remove RR from IXFR, " @@ -1290,15 +1306,24 @@ rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, dnamelen, rr_type, rdatawl, rdatalen); else if(a != localzone_type_to_rpz_action(z->type)) { lock_rw_unlock(&z->lock); - lock_rw_unlock(&r->local_zones->lock); + lock_rw_unlock(&zones->lock); return; } lock_rw_unlock(&z->lock); if(delete_zone) { - local_zones_del_zone(r->local_zones, z); + local_zones_del_zone(zones, z); } - lock_rw_unlock(&r->local_zones->lock); - return; + lock_rw_unlock(&zones->lock); +} + +/** Remove RR from RPZ's local-zone */ +static void +rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, + enum rpz_action a, uint16_t rr_type, uint16_t rr_class, + uint8_t* rdatawl, size_t rdatalen) +{ + rpz_remove_local_zones_trigger(r->local_zones, dname, dnamelen, + a, rr_type, rr_class, rdatawl, rdatalen); } static void @@ -1335,15 +1360,159 @@ rpz_remove_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, lock_rw_unlock(&r->respip_set->lock); } +/** find and remove type from list of local_rrset entries*/ +static void +del_local_rrset_from_list(struct local_rrset** list_head, uint16_t dtype) +{ + struct local_rrset* prev=NULL, *p=*list_head; + while(p && ntohs(p->rrset->rk.type) != dtype) { + prev = p; + p = p->next; + } + if(!p) + return; /* rrset type not found */ + /* unlink it */ + if(prev) prev->next = p->next; + else *list_head = p->next; + /* no memory recycling for zone deletions ... */ +} + +/** Delete client-ip trigger RR from its RRset and perhaps also the rrset + * from the linked list. Returns if the local data is empty and the node can + * be deleted too, or not. */ +static int rpz_remove_clientip_rr(struct clientip_synthesized_rr* node, + uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen) +{ + struct local_rrset* rrset; + struct packed_rrset_data* d; + size_t index; + rrset = rpz_find_synthesized_rrset(rr_type, node); + if(rrset == NULL) + return 0; /* type not found, ignore */ + d = (struct packed_rrset_data*)rrset->rrset->entry.data; + if(!packed_rrset_find_rr(d, rdatawl, rdatalen, &index)) + return 0; /* RR not found, ignore */ + if(d->count == 1) { + /* regional alloc'd */ + /* delete the type entry from the list */ + del_local_rrset_from_list(&node->data, rr_type); + /* if the list is empty, the node can be removed too */ + if(node->data == NULL) + return 1; + } else if (d->count > 1) { + if(!local_rrset_remove_rr(d, index)) + return 0; + } + return 0; +} + +/** remove trigger RR from clientip_syntheized set tree. */ +static void +rpz_clientip_remove_trigger_rr(struct clientip_synthesized_rrset* set, + struct sockaddr_storage* addr, socklen_t addrlen, int net, + enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen) +{ + struct clientip_synthesized_rr* node; + int delete_node = 1; + + lock_rw_wrlock(&set->lock); + node = (struct clientip_synthesized_rr*)addr_tree_find(&set->entries, + addr, addrlen, net); + if(node == NULL) { + /* netblock not found */ + verbose(VERB_ALGO, "rpz: cannot remove RR from IXFR, " + "RPZ address, netblock not found"); + lock_rw_unlock(&set->lock); + return; + } + lock_rw_wrlock(&node->lock); + if(a == RPZ_LOCAL_DATA_ACTION) { + /* remove RR, signal whether entry can be removed */ + delete_node = rpz_remove_clientip_rr(node, rr_type, rdatawl, + rdatalen); + } else if(a != node->action) { + /* ignore the RR with different action specification */ + delete_node = 0; + } + if(delete_node) { + rbtree_delete(&set->entries, node->node.node.key); + } + lock_rw_unlock(&set->lock); + lock_rw_unlock(&node->lock); + if(delete_node) { + lock_rw_destroy(&node->lock); + } +} + +/** Remove clientip trigger RR from RPZ. */ +static void +rpz_remove_clientip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, + enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen) +{ + struct sockaddr_storage addr; + socklen_t addrlen; + int net, af; + if(a == RPZ_INVALID_ACTION) + return; + if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af)) + return; + rpz_clientip_remove_trigger_rr(r->client_set, &addr, addrlen, net, + a, rr_type, rdatawl, rdatalen); +} + +/** Remove nsip trigger RR from RPZ. */ +static void +rpz_remove_nsip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, + enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen) +{ + struct sockaddr_storage addr; + socklen_t addrlen; + int net, af; + if(a == RPZ_INVALID_ACTION) + return; + if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af)) + return; + rpz_clientip_remove_trigger_rr(r->ns_set, &addr, addrlen, net, + a, rr_type, rdatawl, rdatalen); +} + +/** Remove nsdname trigger RR from RPZ. */ +static void +rpz_remove_nsdname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, + enum rpz_action a, uint16_t rr_type, uint16_t rr_class, + uint8_t* rdatawl, size_t rdatalen) +{ + uint8_t* dname_stripped = NULL; + size_t dnamelen_stripped = 0; + if(a == RPZ_INVALID_ACTION) + return; + if(!rpz_strip_nsdname_suffix(dname, dnamelen, &dname_stripped, + &dnamelen_stripped)) + return; + rpz_remove_local_zones_trigger(r->nsdname_zones, dname_stripped, + dnamelen_stripped, a, rr_type, rr_class, rdatawl, rdatalen); + free(dname_stripped); +} + void -rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen, - uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, size_t rdatalen) +rpz_remove_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname, + size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, + size_t rdatalen) { size_t policydnamelen; enum rpz_trigger t; enum rpz_action a; uint8_t* policydname; + if(rpz_type_ignored(rr_type)) { + /* this rpz action is not valid, eg. this is the SOA or NS RR */ + return; + } + if(!dname_subdomain_c(dname, azname)) { + /* not subdomain of the RPZ zone. */ + return; + } + if(!(policydname = calloc(1, LDNS_MAX_DOMAINLEN + 1))) return; @@ -1358,13 +1527,28 @@ rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen, return; } t = rpz_dname_to_trigger(policydname, policydnamelen); + if(t == RPZ_INVALID_TRIGGER) { + /* skipping invalid trigger */ + free(policydname); + return; + } if(t == RPZ_QNAME_TRIGGER) { rpz_remove_qname_trigger(r, policydname, policydnamelen, a, rr_type, rr_class, rdatawl, rdatalen); } else if(t == RPZ_RESPONSE_IP_TRIGGER) { rpz_remove_response_ip_trigger(r, policydname, policydnamelen, a, rr_type, rdatawl, rdatalen); + } else if(t == RPZ_CLIENT_IP_TRIGGER) { + rpz_remove_clientip_trigger(r, policydname, policydnamelen, a, + rr_type, rdatawl, rdatalen); + } else if(t == RPZ_NSIP_TRIGGER) { + rpz_remove_nsip_trigger(r, policydname, policydnamelen, a, + rr_type, rdatawl, rdatalen); + } else if(t == RPZ_NSDNAME_TRIGGER) { + rpz_remove_nsdname_trigger(r, policydname, policydnamelen, a, + rr_type, rr_class, rdatawl, rdatalen); } + /* else it was an unsupported trigger, also skipped. */ free(policydname); } @@ -1563,21 +1747,6 @@ rpz_local_encode(struct module_env* env, struct query_info* qinfo, return 1; } -static struct local_rrset* -rpz_find_synthesized_rrset(uint16_t qtype, - struct clientip_synthesized_rr* data) -{ - struct local_rrset* cursor = data->data; - while( cursor != NULL) { - struct packed_rrset_key* packed_rrset = &cursor->rrset->rk; - if(htons(qtype) == packed_rrset->type) { - return cursor; - } - cursor = cursor->next; - } - return NULL; -} - /** allocate SOA record ubrrsetkey in region */ static struct ub_packed_rrset_key* make_soa_ubrrset(struct auth_zone* auth_zone, struct auth_rrset* soa, @@ -1713,7 +1882,8 @@ rpz_synthesize_nodata(struct rpz* ATTR_UNUSED(r), struct module_qstate* ms, 0, /* ns */ 0, /* ar */ 0, /* total */ - sec_status_insecure); + sec_status_insecure, + LDNS_EDE_NONE); if(msg->rep) msg->rep->authoritative = 1; if(!rpz_add_soa(msg->rep, ms, az)) @@ -1742,7 +1912,8 @@ rpz_synthesize_nxdomain(struct rpz* r, struct module_qstate* ms, 0, /* ns */ 0, /* ar */ 0, /* total */ - sec_status_insecure); + sec_status_insecure, + LDNS_EDE_NONE); if(msg->rep) msg->rep->authoritative = 1; if(!rpz_add_soa(msg->rep, ms, az)) @@ -1772,7 +1943,8 @@ rpz_synthesize_localdata_from_rrset(struct rpz* ATTR_UNUSED(r), struct module_qs 0, /* ns */ 0, /* ar */ 1, /* total */ - sec_status_insecure); + sec_status_insecure, + LDNS_EDE_NONE); if(new_reply_info == NULL) { log_err("out of memory"); return NULL; diff --git a/sbin/unwind/libunbound/services/rpz.h b/sbin/unwind/libunbound/services/rpz.h index 53781197a..e6d8bf566 100644 --- a/sbin/unwind/libunbound/services/rpz.h +++ b/sbin/unwind/libunbound/services/rpz.h @@ -84,10 +84,11 @@ enum rpz_action { RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/ }; -struct clientip_synthesized_rrset{ +struct clientip_synthesized_rrset { struct regional* region; struct rbtree_type entries; - lock_rw_type lock; /* lock on the respip tree */ + /** lock on the entries tree */ + lock_rw_type lock; }; struct clientip_synthesized_rr { @@ -95,10 +96,6 @@ struct clientip_synthesized_rr { struct addr_tree_node node; /** lock on the node item */ lock_rw_type lock; - /** tag bitlist */ - uint8_t* taglist; - /** length of the taglist (in bytes) */ - size_t taglen; /** action for this address span */ enum rpz_action action; /** "local data" for this node */ @@ -152,6 +149,7 @@ int rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dna /** * Delete policy matching RR, used for IXFR. * @param r: the rpz to add the policy to. + * @param azname: dname of the auth-zone * @param aznamelen: the length of the auth-zone name * @param dname: dname of the RR * @param dnamelen: length of the dname @@ -160,9 +158,9 @@ int rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dna * @param rdatawl: rdata of the RR, prepended with the rdata size * @param rdatalen: length if the RR, including the prepended rdata size */ -void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, - size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, - size_t rdatalen); +void rpz_remove_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, + uint8_t* dname, size_t dnamelen, uint16_t rr_type, uint16_t rr_class, + uint8_t* rdatawl, size_t rdatalen); /** * Walk over the RPZ zones to find and apply a QNAME trigger policy. diff --git a/sbin/unwind/libunbound/sldns/rrdef.c b/sbin/unwind/libunbound/sldns/rrdef.c index 322eff096..e81ebb1fc 100644 --- a/sbin/unwind/libunbound/sldns/rrdef.c +++ b/sbin/unwind/libunbound/sldns/rrdef.c @@ -702,7 +702,11 @@ sldns_get_rr_type_by_name(const char *name) /* TYPEXX representation */ if (strlen(name) > 4 && strncasecmp(name, "TYPE", 4) == 0) { - return atoi(name + 4); + unsigned int a = atoi(name + 4); + if (a > LDNS_RR_TYPE_LAST) { + return (enum sldns_enum_rr_type)0; + } + return a; } /* Normal types */ @@ -740,7 +744,11 @@ sldns_get_rr_class_by_name(const char *name) /* CLASSXX representation */ if (strlen(name) > 5 && strncasecmp(name, "CLASS", 5) == 0) { - return atoi(name + 5); + unsigned int a = atoi(name + 5); + if (a > LDNS_RR_CLASS_LAST) { + return (enum sldns_enum_rr_class)0; + } + return a; } /* Normal types */ diff --git a/sbin/unwind/libunbound/sldns/rrdef.h b/sbin/unwind/libunbound/sldns/rrdef.h index 999c22307..1a5091d06 100644 --- a/sbin/unwind/libunbound/sldns/rrdef.h +++ b/sbin/unwind/libunbound/sldns/rrdef.h @@ -433,10 +433,12 @@ enum sldns_enum_edns_option LDNS_EDNS_DHU = 6, /* RFC6975 */ LDNS_EDNS_N3U = 7, /* RFC6975 */ LDNS_EDNS_CLIENT_SUBNET = 8, /* RFC7871 */ + LDNS_EDNS_COOKIE = 10, /* RFC7873 */ LDNS_EDNS_KEEPALIVE = 11, /* draft-ietf-dnsop-edns-tcp-keepalive*/ LDNS_EDNS_PADDING = 12, /* RFC7830 */ LDNS_EDNS_EDE = 15, /* RFC8914 */ - LDNS_EDNS_CLIENT_TAG = 16 /* draft-bellis-dnsop-edns-tags-01 */ + LDNS_EDNS_CLIENT_TAG = 16, /* draft-bellis-dnsop-edns-tags-01 */ + LDNS_EDNS_UNBOUND_CACHEDB_TESTFRAME_TEST = 65534 }; typedef enum sldns_enum_edns_option sldns_edns_option; @@ -482,6 +484,9 @@ typedef enum sldns_enum_ede_code sldns_ede_code; #define LDNS_TSIG_ERROR_BADNAME 20 #define LDNS_TSIG_ERROR_BADALG 21 +/** DNS Cookie extended rcode */ +#define LDNS_EXT_RCODE_BADCOOKIE 23 + /** * Contains all information about resource record types. * diff --git a/sbin/unwind/libunbound/sldns/str2wire.c b/sbin/unwind/libunbound/sldns/str2wire.c index 303d49ba6..45e247613 100644 --- a/sbin/unwind/libunbound/sldns/str2wire.c +++ b/sbin/unwind/libunbound/sldns/str2wire.c @@ -357,7 +357,7 @@ rrinternal_get_delims(sldns_rdf_type rdftype, size_t r_cnt, size_t r_max) break; default : break; } - return "\n\t "; + return "\n\t "; } /* Syntactic sugar for sldns_rr_new_frm_str_internal */ @@ -448,7 +448,7 @@ rrinternal_parse_unknown(sldns_buffer* strbuf, char* token, size_t token_len, sldns_buffer_position(strbuf)); } hex_data_size = (size_t)atoi(token); - if(hex_data_size > LDNS_MAX_RDFLEN || + if(hex_data_size > LDNS_MAX_RDFLEN || *rr_cur_len + hex_data_size > *rr_len) { return RET_ERR(LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL, sldns_buffer_position(strbuf)); @@ -567,7 +567,7 @@ sldns_parse_rdf_token(sldns_buffer* strbuf, char* token, size_t token_len, /* check if not quoted yet, and we have encountered quotes */ if(!*quoted && sldns_rdf_type_maybe_quoted(rdftype) && slen >= 2 && - (token[0] == '"' || token[0] == '\'') && + (token[0] == '"' || token[0] == '\'') && (token[slen-1] == '"' || token[slen-1] == '\'')) { /* move token two smaller (quotes) with endnull */ memmove(token, token+1, slen-2); @@ -698,7 +698,7 @@ static int sldns_str2wire_check_svcbparams(uint8_t* rdata, uint16_t rdata_len) mandatory = svcparams[i]; } - /* 4. verify that all the SvcParamKeys in mandatory are present */ + /* Verify that all the SvcParamKeys in mandatory are present */ if(mandatory) { /* Divide by sizeof(uint16_t)*/ uint16_t mandatory_nkeys = sldns_read_uint16(mandatory + 2) / sizeof(uint16_t); @@ -785,7 +785,7 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len, token[2]=='\t')) { was_unknown_rr_format = 1; if((status=rrinternal_parse_unknown(strbuf, token, - token_len, rr, rr_len, &rr_cur_len, + token_len, rr, rr_len, &rr_cur_len, pre_data_pos)) != 0) return status; } else if(token_strlen > 0 || quoted) { @@ -844,7 +844,7 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len, if (rr_type == LDNS_RR_TYPE_SVCB || rr_type == LDNS_RR_TYPE_HTTPS) { size_t rdata_len = rr_cur_len - dname_len - 10; uint8_t *rdata = rr+dname_len + 10; - + /* skip 1st rdata field SvcPriority (uint16_t) */ if (rdata_len < sizeof(uint16_t)) return LDNS_WIREPARSE_ERR_OK; @@ -1123,36 +1123,40 @@ sldns_str2wire_svcparam_key_lookup(const char *key, size_t key_len) return key_value; } else switch (key_len) { - case sizeof("mandatory")-1: - if (!strncmp(key, "mandatory", sizeof("mandatory")-1)) - return SVCB_KEY_MANDATORY; - if (!strncmp(key, "echconfig", sizeof("echconfig")-1)) - return SVCB_KEY_ECH; /* allow "echconfig" as well as "ech" */ + case 3: + if (!strncmp(key, "ech", key_len)) + return SVCB_KEY_ECH; break; - case sizeof("alpn")-1: - if (!strncmp(key, "alpn", sizeof("alpn")-1)) + case 4: + if (!strncmp(key, "alpn", key_len)) return SVCB_KEY_ALPN; - if (!strncmp(key, "port", sizeof("port")-1)) + if (!strncmp(key, "port", key_len)) return SVCB_KEY_PORT; break; - case sizeof("no-default-alpn")-1: - if (!strncmp( key , "no-default-alpn" - , sizeof("no-default-alpn")-1)) - return SVCB_KEY_NO_DEFAULT_ALPN; + case 7: + if (!strncmp(key, "dohpath", key_len)) + return SVCB_KEY_DOHPATH; break; - case sizeof("ipv4hint")-1: - if (!strncmp(key, "ipv4hint", sizeof("ipv4hint")-1)) + case 8: + if (!strncmp(key, "ipv4hint", key_len)) return SVCB_KEY_IPV4HINT; - if (!strncmp(key, "ipv6hint", sizeof("ipv6hint")-1)) + if (!strncmp(key, "ipv6hint", key_len)) return SVCB_KEY_IPV6HINT; break; - case sizeof("ech")-1: - if (!strncmp(key, "ech", sizeof("ech")-1)) - return SVCB_KEY_ECH; + case 9: + if (!strncmp(key, "mandatory", key_len)) + return SVCB_KEY_MANDATORY; + if (!strncmp(key, "echconfig", key_len)) + return SVCB_KEY_ECH; /* allow "echconfig" as well as "ech" */ + break; + + case 15: + if (!strncmp(key, "no-default-alpn", key_len)) + return SVCB_KEY_NO_DEFAULT_ALPN; break; default: @@ -1477,7 +1481,7 @@ sldns_str2wire_svcbparam_alpn_value(const char* val, size_t str_len; size_t dst_len; size_t val_len; - + val_len = strlen(val); if (val_len > sizeof(unescaped_dst)) { @@ -1511,7 +1515,34 @@ sldns_str2wire_svcbparam_alpn_value(const char* val, sldns_write_uint16(rd + 2, dst_len); memcpy(rd + 4, unescaped_dst, dst_len); *rd_len = 4 + dst_len; - + + return LDNS_WIREPARSE_ERR_OK; +} + +static int +sldns_str2wire_svcbparam_dohpath_value(const char* val, + uint8_t* rd, size_t* rd_len) +{ + size_t val_len; + + /* RFC6570#section-2.1 + * "The characters outside of expressions in a URI Template string are + * intended to be copied literally" + * Practically this means we do not have to look for "double escapes" + * like in the alpn value list. + */ + + val_len = strlen(val); + + if (*rd_len < 4 + val_len) { + return LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL; + } + + sldns_write_uint16(rd, SVCB_KEY_DOHPATH); + sldns_write_uint16(rd + 2, val_len); + memcpy(rd + 4, val, val_len); + *rd_len = 4 + val_len; + return LDNS_WIREPARSE_ERR_OK; } @@ -1535,6 +1566,7 @@ sldns_str2wire_svcparam_value(const char *key, size_t key_len, case SVCB_KEY_PORT: case SVCB_KEY_IPV4HINT: case SVCB_KEY_IPV6HINT: + case SVCB_KEY_DOHPATH: return LDNS_WIREPARSE_ERR_SVCB_MISSING_PARAM; #endif default: @@ -1566,6 +1598,8 @@ sldns_str2wire_svcparam_value(const char *key, size_t key_len, return sldns_str2wire_svcbparam_ech_value(val, rd, rd_len); case SVCB_KEY_ALPN: return sldns_str2wire_svcbparam_alpn_value(val, rd, rd_len); + case SVCB_KEY_DOHPATH: + return sldns_str2wire_svcbparam_dohpath_value(val, rd, rd_len); default: str_len = strlen(val); if (*rd_len < 4 + str_len) @@ -1593,7 +1627,7 @@ static int sldns_str2wire_svcparam_buf(const char* str, uint8_t* rd, size_t* rd_ /* case: key=value */ if (eq_pos != NULL && eq_pos[1]) { val_in = eq_pos + 1; - + /* unescape characters and "" blocks */ if (*val_in == '"') { val_in++; @@ -1610,11 +1644,11 @@ static int sldns_str2wire_svcparam_buf(const char* str, uint8_t* rd, size_t* rd_ } *val_out = 0; - return sldns_str2wire_svcparam_value(str, eq_pos - str, - unescaped_val[0] ? unescaped_val : NULL, rd, rd_len); + return sldns_str2wire_svcparam_value(str, eq_pos - str, + unescaped_val[0] ? unescaped_val : NULL, rd, rd_len); } /* case: key= */ - else if (eq_pos != NULL && !(eq_pos[1])) { + else if (eq_pos != NULL && !(eq_pos[1])) { return sldns_str2wire_svcparam_value(str, eq_pos - str, NULL, rd, rd_len); } /* case: key */ diff --git a/sbin/unwind/libunbound/sldns/str2wire.h b/sbin/unwind/libunbound/sldns/str2wire.h index baee4236f..5e4d146d3 100644 --- a/sbin/unwind/libunbound/sldns/str2wire.h +++ b/sbin/unwind/libunbound/sldns/str2wire.h @@ -38,7 +38,8 @@ struct sldns_struct_lookup_table; #define SVCB_KEY_IPV4HINT 4 #define SVCB_KEY_ECH 5 #define SVCB_KEY_IPV6HINT 6 -#define SVCPARAMKEY_COUNT 7 +#define SVCB_KEY_DOHPATH 7 +#define SVCPARAMKEY_COUNT 8 #define MAX_NUMBER_OF_SVCPARAMS 64 @@ -236,6 +237,7 @@ uint8_t* sldns_wirerr_get_rdatawl(uint8_t* rr, size_t len, size_t dname_len); #define LDNS_WIREPARSE_ERR_SVCB_NO_DEFAULT_ALPN_VALUE 385 #define LDNS_WIREPARSE_ERR_SVCPARAM_BROKEN_RDATA 386 + /** * Get reference to a constant string for the (parse) error. * @param e: error return value diff --git a/sbin/unwind/libunbound/sldns/wire2str.c b/sbin/unwind/libunbound/sldns/wire2str.c index 74d1b62df..e6278ff56 100644 --- a/sbin/unwind/libunbound/sldns/wire2str.c +++ b/sbin/unwind/libunbound/sldns/wire2str.c @@ -159,7 +159,7 @@ static sldns_lookup_table sldns_wireparse_errors_data[] = { "Mandatory SvcParamKey is missing"}, { LDNS_WIREPARSE_ERR_SVCB_MANDATORY_DUPLICATE_KEY, "Keys in SvcParam mandatory MUST be unique" }, - { LDNS_WIREPARSE_ERR_SVCB_MANDATORY_IN_MANDATORY, + { LDNS_WIREPARSE_ERR_SVCB_MANDATORY_IN_MANDATORY, "mandatory MUST not be included as mandatory parameter" }, { LDNS_WIREPARSE_ERR_SVCB_PORT_VALUE_SYNTAX, "Could not parse port SvcParamValue" }, @@ -224,7 +224,7 @@ sldns_lookup_table* sldns_tsig_errors = sldns_tsig_errors_data; /* draft-ietf-dnsop-svcb-https-06: 6. Initial SvcParamKeys */ const char *svcparamkey_strs[] = { "mandatory", "alpn", "no-default-alpn", "port", - "ipv4hint", "ech", "ipv6hint" + "ipv4hint", "ech", "ipv6hint", "dohpath" }; char* sldns_wire2str_pkt(uint8_t* data, size_t len) @@ -487,7 +487,7 @@ int sldns_wire2str_rr_scan(uint8_t** d, size_t* dlen, char** s, size_t* slen, uint8_t* rr = *d; size_t rrlen = *dlen, dname_off, rdlen, ordlen; uint16_t rrtype = 0; - + if(*dlen >= 3 && (*d)[0]==0 && sldns_read_uint16((*d)+1)==LDNS_RR_TYPE_OPT) { /* perform EDNS OPT processing */ @@ -1119,7 +1119,7 @@ static int sldns_wire2str_svcparam_alpn2str(char** s, w += sldns_str_print(s, slen, "%s", ","); } w += sldns_str_print(s, slen, "\""); - + return w; } @@ -1139,7 +1139,7 @@ static int sldns_wire2str_svcparam_ech2str(char** s, (*s) += size; (*slen) -= size; - w += sldns_str_print(s, slen, "\""); + w += sldns_str_print(s, slen, "\""); return w + size; } @@ -1162,7 +1162,7 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl /* verify that we have data_len data */ if (data_len > *dlen) - return -1; + return -1; written_chars += sldns_print_svcparamkey(s, slen, svcparamkey); if (!data_len) { @@ -1174,6 +1174,7 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl case SVCB_KEY_IPV4HINT: case SVCB_KEY_IPV6HINT: case SVCB_KEY_MANDATORY: + case SVCB_KEY_DOHPATH: return -1; default: return written_chars; @@ -1201,6 +1202,8 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl case SVCB_KEY_ECH: r = sldns_wire2str_svcparam_ech2str(s, slen, data_len, *d); break; + case SVCB_KEY_DOHPATH: + /* fallthrough */ default: r = sldns_str_print(s, slen, "=\""); @@ -1222,7 +1225,7 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl } if (r <= 0) return -1; /* wireformat error */ - + written_chars += r; *d += data_len; *dlen -= data_len; @@ -1551,7 +1554,7 @@ int sldns_wire2str_nsec_scan(uint8_t** d, size_t* dl, char** s, size_t* sl) unsigned i, bit, window, block_len; uint16_t t; int w = 0; - + /* check for errors */ while(pl) { if(pl < 2) return -1; diff --git a/sbin/unwind/libunbound/util/Makefile.inc b/sbin/unwind/libunbound/util/Makefile.inc index 33478fda7..a245c5352 100644 --- a/sbin/unwind/libunbound/util/Makefile.inc +++ b/sbin/unwind/libunbound/util/Makefile.inc @@ -1,11 +1,12 @@ -# $OpenBSD: Makefile.inc,v 1.5 2022/10/22 16:37:57 florian Exp $ +# $OpenBSD: Makefile.inc,v 1.6 2023/09/05 15:44:02 florian Exp $ .PATH: ${.CURDIR}/libunbound/util SRCS+= alloc.c as112.c config_file.c configlexer.c configparser.y edns.c \ fptr_wlist.c locks.c mini_event.c module.c net_help.c netevent.c \ - proxy_protocol.c random.c rbtree.c regional.c rtt.c tcp_conn_limit.c \ - timehist.c tube.c ub_event_pluggable.c util_log.c winsock_event.c + proxy_protocol.c random.c rbtree.c regional.c rfc_1982.c rtt.c siphash.c \ + tcp_conn_limit.c timehist.c timeval_func.c tube.c ub_event_pluggable.c \ + util_log.c winsock_event.c util_log.c: ln -s ${.CURDIR}/libunbound/util/log.c $@ diff --git a/sbin/unwind/libunbound/util/config_file.c b/sbin/unwind/libunbound/util/config_file.c index cc54c4e8d..b7aed66dc 100644 --- a/sbin/unwind/libunbound/util/config_file.c +++ b/sbin/unwind/libunbound/util/config_file.c @@ -4,22 +4,22 @@ * Copyright (c) 2007, NLnet Labs. All rights reserved. * * This software is open source. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. - * + * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. - * + * * Neither the name of the NLNET LABS nor the names of its contributors may * be used to endorse or promote products derived from this software without * specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR @@ -55,6 +55,7 @@ #include "util/regional.h" #include "util/fptr_wlist.h" #include "util/data/dname.h" +#include "util/random.h" #include "util/rtt.h" #include "services/cache/infra.h" #include "sldns/wire2str.h" @@ -87,7 +88,10 @@ struct config_parser_state* cfg_parser = 0; /** init ports possible for use */ static void init_outgoing_availports(int* array, int num); -struct config_file* +/** init cookie with random data */ +static void init_cookie_secret(uint8_t* cookie_secret, size_t cookie_secret_len); + +struct config_file* config_create(void) { struct config_file* cfg; @@ -99,6 +103,7 @@ config_create(void) cfg->stat_interval = 0; cfg->stat_cumulative = 0; cfg->stat_extended = 0; + cfg->stat_inhibit_zero = 1; cfg->num_threads = 1; cfg->port = UNBOUND_DNS_PORT; cfg->do_ip4 = 1; @@ -115,6 +120,7 @@ config_create(void) cfg->tcp_auth_query_timeout = 3 * 1000; /* 3s in millisecs */ cfg->do_tcp_keepalive = 0; cfg->tcp_keepalive_timeout = 120 * 1000; /* 120s in millisecs */ + cfg->sock_queue_timeout = 0; /* do not check timeout */ cfg->ssl_service_key = NULL; cfg->ssl_service_pem = NULL; cfg->ssl_port = UNBOUND_DNS_OVER_TLS_PORT; @@ -152,7 +158,7 @@ config_create(void) cfg->outgoing_num_ports = 48; /* windows is limited in num fds */ cfg->num_queries_per_thread = 24; cfg->outgoing_num_tcp = 2; /* leaves 64-52=12 for: 4if,1stop,thread4 */ - cfg->incoming_num_tcp = 2; + cfg->incoming_num_tcp = 2; #endif cfg->stream_wait_size = 4 * 1024 * 1024; cfg->edns_buffer_size = 1232; /* from DNS flagday recommendation */ @@ -232,6 +238,7 @@ config_create(void) cfg->harden_below_nxdomain = 1; cfg->harden_referral_path = 0; cfg->harden_algo_downgrade = 0; + cfg->harden_unknown_additional = 0; cfg->use_caps_bits_for_id = 0; cfg->caps_whitelist = NULL; cfg->private_address = NULL; @@ -299,14 +306,14 @@ config_create(void) cfg->minimal_responses = 1; cfg->rrset_roundrobin = 1; cfg->unknown_server_time_limit = 376; - cfg->max_udp_size = 4096; - if(!(cfg->server_key_file = strdup(RUN_DIR"/unbound_server.key"))) + cfg->max_udp_size = 1232; /* value taken from edns_buffer_size */ + if(!(cfg->server_key_file = strdup(RUN_DIR"/unbound_server.key"))) goto error_exit; - if(!(cfg->server_cert_file = strdup(RUN_DIR"/unbound_server.pem"))) + if(!(cfg->server_cert_file = strdup(RUN_DIR"/unbound_server.pem"))) goto error_exit; - if(!(cfg->control_key_file = strdup(RUN_DIR"/unbound_control.key"))) + if(!(cfg->control_key_file = strdup(RUN_DIR"/unbound_control.key"))) goto error_exit; - if(!(cfg->control_cert_file = strdup(RUN_DIR"/unbound_control.pem"))) + if(!(cfg->control_cert_file = strdup(RUN_DIR"/unbound_control.pem"))) goto error_exit; #ifdef CLIENT_SUBNET @@ -314,7 +321,7 @@ config_create(void) #else if(!(cfg->module_conf = strdup("validator iterator"))) goto error_exit; #endif - if(!(cfg->val_nsec3_key_iterations = + if(!(cfg->val_nsec3_key_iterations = strdup("1024 150 2048 150 4096 150"))) goto error_exit; #if defined(DNSTAP_SOCKET_PATH) if(!(cfg->dnstap_socket_path = strdup(DNSTAP_SOCKET_PATH))) @@ -323,6 +330,7 @@ config_create(void) cfg->dnstap_bidirectional = 1; cfg->dnstap_tls = 1; cfg->disable_dnssec_lame_check = 0; + cfg->ip_ratelimit_cookie = 0; cfg->ip_ratelimit = 0; cfg->ratelimit = 0; cfg->ip_ratelimit_slabs = 4; @@ -336,6 +344,8 @@ config_create(void) cfg->ip_ratelimit_backoff = 0; cfg->ratelimit_backoff = 0; cfg->outbound_msg_retry = 5; + cfg->max_sent_count = 32; + cfg->max_query_restarts = 11; cfg->qname_minimisation = 1; cfg->qname_minimisation_strict = 0; cfg->shm_enable = 0; @@ -364,11 +374,17 @@ config_create(void) cfg->ipsecmod_whitelist = NULL; cfg->ipsecmod_strict = 0; #endif + cfg->do_answer_cookie = 0; + memset(cfg->cookie_secret, 0, sizeof(cfg->cookie_secret)); + cfg->cookie_secret_len = 16; + init_cookie_secret(cfg->cookie_secret, cfg->cookie_secret_len); #ifdef USE_CACHEDB if(!(cfg->cachedb_backend = strdup("testframe"))) goto error_exit; if(!(cfg->cachedb_secret = strdup("default"))) goto error_exit; #ifdef USE_REDIS if(!(cfg->redis_server_host = strdup("127.0.0.1"))) goto error_exit; + cfg->redis_server_path = NULL; + cfg->redis_server_password = NULL; cfg->redis_timeout = 100; cfg->redis_server_port = 6379; cfg->redis_expire_records = 0; @@ -484,10 +500,10 @@ int config_set_option(struct config_file* cfg, const char* opt, /* not supported, library must have 1 thread in bgworker */ return 0; } else if(strcmp(opt, "outgoing-port-permit:") == 0) { - return cfg_mark_ports(val, 1, + return cfg_mark_ports(val, 1, cfg->outgoing_avail_ports, 65536); } else if(strcmp(opt, "outgoing-port-avoid:") == 0) { - return cfg_mark_ports(val, 0, + return cfg_mark_ports(val, 0, cfg->outgoing_avail_ports, 65536); } else if(strcmp(opt, "local-zone:") == 0) { return cfg_parse_local_zone(cfg, val); @@ -501,7 +517,7 @@ int config_set_option(struct config_file* cfg, const char* opt, if(atoi(val) == 0) return 0; cfg->val_date_override = (uint32_t)atoi(val); } - } else if(strcmp(opt, "local-data-ptr:") == 0) { + } else if(strcmp(opt, "local-data-ptr:") == 0) { char* ptr = cfg_ptr_reverse((char*)opt); return cfg_strlist_insert(&cfg->local_data, ptr); } else if(strcmp(opt, "logfile:") == 0) { @@ -516,6 +532,7 @@ int config_set_option(struct config_file* cfg, const char* opt, else S_YNO("use-syslog:", use_syslog) else S_STR("log-identity:", log_identity) else S_YNO("extended-statistics:", stat_extended) + else S_YNO("statistics-inhibit-zero:", stat_inhibit_zero) else S_YNO("statistics-cumulative:", stat_cumulative) else S_YNO("shm-enable:", shm_enable) else S_NUMBER_OR_ZERO("shm-key:", shm_key) @@ -536,6 +553,7 @@ int config_set_option(struct config_file* cfg, const char* opt, else S_NUMBER_NONZERO("tcp-reuse-timeout:", tcp_reuse_timeout) else S_YNO("edns-tcp-keepalive:", do_tcp_keepalive) else S_NUMBER_NONZERO("edns-tcp-keepalive-timeout:", tcp_keepalive_timeout) + else S_NUMBER_OR_ZERO("sock-queue-timeout:", sock_queue_timeout) else S_YNO("ssl-upstream:", ssl_upstream) else S_YNO("tls-upstream:", ssl_upstream) else S_STR("ssl-service-key:", ssl_service_key) @@ -645,6 +663,7 @@ int config_set_option(struct config_file* cfg, const char* opt, else S_YNO("harden-below-nxdomain:", harden_below_nxdomain) else S_YNO("harden-referral-path:", harden_referral_path) else S_YNO("harden-algo-downgrade:", harden_algo_downgrade) + else S_YNO("harden-unknown-additional:", harden_unknown_additional) else S_YNO("use-caps-for-id:", use_caps_bits_for_id) else S_STRLIST("caps-whitelist:", caps_whitelist) else S_SIZET_OR_ZERO("unwanted-reply-threshold:", unwanted_threshold) @@ -680,7 +699,7 @@ int config_set_option(struct config_file* cfg, const char* opt, else if(strcmp(opt, "serve-expired-reply-ttl:") == 0) { IS_NUMBER_OR_ZERO; cfg->serve_expired_reply_ttl = atoi(val); SERVE_EXPIRED_REPLY_TTL=(time_t)cfg->serve_expired_reply_ttl;} else S_NUMBER_OR_ZERO("serve-expired-client-timeout:", serve_expired_client_timeout) - else S_YNO("ede:", ede) + else S_YNO("ede:", ede) else S_YNO("ede-serve-expired:", ede_serve_expired) else S_YNO("serve-original-ttl:", serve_original_ttl) else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations) @@ -761,6 +780,10 @@ int config_set_option(struct config_file* cfg, const char* opt, else S_POW2("dnscrypt-nonce-cache-slabs:", dnscrypt_nonce_cache_slabs) #endif + else if(strcmp(opt, "ip-ratelimit-cookie:") == 0) { + IS_NUMBER_OR_ZERO; cfg->ip_ratelimit_cookie = atoi(val); + infra_ip_ratelimit_cookie=cfg->ip_ratelimit_cookie; + } else if(strcmp(opt, "ip-ratelimit:") == 0) { IS_NUMBER_OR_ZERO; cfg->ip_ratelimit = atoi(val); infra_ip_ratelimit=cfg->ip_ratelimit; @@ -778,6 +801,8 @@ int config_set_option(struct config_file* cfg, const char* opt, else S_YNO("ip-ratelimit-backoff:", ip_ratelimit_backoff) else S_YNO("ratelimit-backoff:", ratelimit_backoff) else S_NUMBER_NONZERO("outbound-msg-retry:", outbound_msg_retry) + else S_NUMBER_NONZERO("max-sent-count:", max_sent_count) + else S_NUMBER_NONZERO("max-query-restarts:", max_query_restarts) else S_SIZET_NONZERO("fast-server-num:", fast_server_num) else S_NUMBER_OR_ZERO("fast-server-permil:", fast_server_permil) else S_YNO("qname-minimisation:", qname_minimisation) @@ -806,7 +831,7 @@ int config_set_option(struct config_file* cfg, const char* opt, { IS_NUMBER_OR_ZERO; cfg->val_max_restart = (int32_t)atoi(val); } else if (strcmp(opt, "outgoing-interface:") == 0) { char* d = strdup(val); - char** oi = + char** oi = (char**)reallocarray(NULL, (size_t)cfg->num_out_ifs+1, sizeof(char*)); if(!d || !oi) { free(d); free(oi); return -1; } if(cfg->out_ifs && cfg->num_out_ifs) { @@ -901,7 +926,7 @@ config_collate_cat(struct config_strlist* list) for(s=list; s; s=s->next) total += strlen(s->str) + 1; /* len + newline */ left = total+1; /* one extra for nul at end */ - r = malloc(left); + r = malloc(left); if(!r) return NULL; w = r; @@ -980,7 +1005,7 @@ config_collate_cat(struct config_strlist* list) } int -config_get_option(struct config_file* cfg, const char* opt, +config_get_option(struct config_file* cfg, const char* opt, void (*func)(char*,void*), void* arg) { char buf[1024], nopt[64]; @@ -996,6 +1021,7 @@ config_get_option(struct config_file* cfg, const char* opt, else O_DEC(opt, "statistics-interval", stat_interval) else O_YNO(opt, "statistics-cumulative", stat_cumulative) else O_YNO(opt, "extended-statistics", stat_extended) + else O_YNO(opt, "statistics-inhibit-zero", stat_inhibit_zero) else O_YNO(opt, "shm-enable", shm_enable) else O_DEC(opt, "shm-key", shm_key) else O_YNO(opt, "use-syslog", use_syslog) @@ -1055,6 +1081,7 @@ config_get_option(struct config_file* cfg, const char* opt, else O_DEC(opt, "tcp-reuse-timeout", tcp_reuse_timeout) else O_YNO(opt, "edns-tcp-keepalive", do_tcp_keepalive) else O_DEC(opt, "edns-tcp-keepalive-timeout", tcp_keepalive_timeout) + else O_DEC(opt, "sock-queue-timeout", sock_queue_timeout) else O_YNO(opt, "ssl-upstream", ssl_upstream) else O_YNO(opt, "tls-upstream", ssl_upstream) else O_STR(opt, "ssl-service-key", ssl_service_key) @@ -1110,6 +1137,7 @@ config_get_option(struct config_file* cfg, const char* opt, else O_YNO(opt, "harden-below-nxdomain", harden_below_nxdomain) else O_YNO(opt, "harden-referral-path", harden_referral_path) else O_YNO(opt, "harden-algo-downgrade", harden_algo_downgrade) + else O_YNO(opt, "harden-unknown-additional", harden_unknown_additional) else O_YNO(opt, "use-caps-for-id", use_caps_bits_for_id) else O_LST(opt, "caps-whitelist", caps_whitelist) else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold) @@ -1225,6 +1253,7 @@ config_get_option(struct config_file* cfg, const char* opt, else O_LST(opt, "python-script", python_script) else O_LST(opt, "dynlib-file", dynlib_file) else O_YNO(opt, "disable-dnssec-lame-check", disable_dnssec_lame_check) + else O_DEC(opt, "ip-ratelimit-cookie", ip_ratelimit_cookie) else O_DEC(opt, "ip-ratelimit", ip_ratelimit) else O_DEC(opt, "ratelimit", ratelimit) else O_MEM(opt, "ip-ratelimit-size", ip_ratelimit_size) @@ -1238,6 +1267,8 @@ config_get_option(struct config_file* cfg, const char* opt, else O_YNO(opt, "ip-ratelimit-backoff", ip_ratelimit_backoff) else O_YNO(opt, "ratelimit-backoff", ratelimit_backoff) else O_UNS(opt, "outbound-msg-retry", outbound_msg_retry) + else O_UNS(opt, "max-sent-count", max_sent_count) + else O_UNS(opt, "max-query-restarts", max_query_restarts) else O_DEC(opt, "fast-server-num", fast_server_num) else O_DEC(opt, "fast-server-permil", fast_server_permil) else O_DEC(opt, "val-sig-skew-min", val_sig_skew_min) @@ -1278,6 +1309,8 @@ config_get_option(struct config_file* cfg, const char* opt, #ifdef USE_REDIS else O_STR(opt, "redis-server-host", redis_server_host) else O_DEC(opt, "redis-server-port", redis_server_port) + else O_STR(opt, "redis-server-path", redis_server_path) + else O_STR(opt, "redis-server-password", redis_server_password) else O_DEC(opt, "redis-timeout", redis_timeout) else O_YNO(opt, "redis-expire-records", redis_expire_records) #endif /* USE_REDIS */ @@ -1313,7 +1346,7 @@ create_cfg_parser(struct config_file* cfg, char* filename, const char* chroot) init_cfg_parse(); } -int +int config_read(struct config_file* cfg, const char* filename, const char* chroot) { FILE *in; @@ -1353,7 +1386,7 @@ config_read(struct config_file* cfg, const char* filename, const char* chroot) if(r == GLOB_NOMATCH) { verbose(VERB_QUERY, "include: " "no matches for %s", fname); - return 1; + return 1; } else if(r == GLOB_NOSPACE) { log_err("include: %s: " "fnametern out of memory", fname); @@ -1552,7 +1585,7 @@ config_del_strbytelist(struct config_strbytelist* p) } } -void +void config_delete(struct config_file* cfg) { if(!cfg) return; @@ -1629,6 +1662,7 @@ config_delete(struct config_file* cfg) free(cfg->server_cert_file); free(cfg->control_key_file); free(cfg->control_cert_file); + free(cfg->nat64_prefix); free(cfg->dns64_prefix); config_delstrlist(cfg->dns64_ignore_aaaa); free(cfg->dnstap_socket_path); @@ -1654,6 +1688,8 @@ config_delete(struct config_file* cfg) free(cfg->cachedb_secret); #ifdef USE_REDIS free(cfg->redis_server_host); + free(cfg->redis_server_path); + free(cfg->redis_server_password); #endif /* USE_REDIS */ #endif /* USE_CACHEDB */ #ifdef USE_IPSET @@ -1663,7 +1699,21 @@ config_delete(struct config_file* cfg) free(cfg); } -static void +static void +init_cookie_secret(uint8_t* cookie_secret, size_t cookie_secret_len) +{ + struct ub_randstate *rand = ub_initstate(NULL); + + if (!rand) + fatal_exit("could not init random generator"); + while (cookie_secret_len) { + *cookie_secret++ = (uint8_t)ub_random(rand); + cookie_secret_len--; + } + ub_randfree(rand); +} + +static void init_outgoing_availports(int* a, int num) { /* generated with make iana_update */ @@ -1676,7 +1726,7 @@ init_outgoing_availports(int* a, int num) for(i=1024; istr = item; s->next = NULL; - + if (*head==NULL) { *head = s; } else { @@ -1922,11 +1972,11 @@ cfg_strlist_append_ex(struct config_strlist** head, char* item) } last->next = s; } - - return 1; + + return 1; } -int +int cfg_str2list_insert(struct config_str2list** head, char* item, char* i2) { struct config_str2list *s; @@ -1948,7 +1998,7 @@ cfg_str2list_insert(struct config_str2list** head, char* item, char* i2) return 1; } -int +int cfg_str3list_insert(struct config_str3list** head, char* item, char* i2, char* i3) { @@ -1984,7 +2034,7 @@ cfg_strbytelist_insert(struct config_strbytelist** head, char* item, return 1; } -time_t +time_t cfg_convert_timeval(const char* str) { time_t t; @@ -1992,7 +2042,7 @@ cfg_convert_timeval(const char* str) memset(&tm, 0, sizeof(tm)); if(strlen(str) < 14) return 0; - if(sscanf(str, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon, + if(sscanf(str, "%4d%2d%2d%2d%2d%2d", &tm.tm_year, &tm.tm_mon, &tm.tm_mday, &tm.tm_hour, &tm.tm_min, &tm.tm_sec) != 6) return 0; tm.tm_year -= 1900; @@ -2009,7 +2059,7 @@ cfg_convert_timeval(const char* str) return t; } -int +int cfg_count_numbers(const char* s) { /* format ::= (sp num)+ sp */ @@ -2044,7 +2094,7 @@ static int isalldigit(const char* str, size_t l) return 1; } -int +int cfg_parse_memsize(const char* str, size_t* res) { size_t len; @@ -2060,11 +2110,11 @@ cfg_parse_memsize(const char* str, size_t* res) /* check appended num */ while(len>0 && str[len-1]==' ') len--; - if(len > 1 && str[len-1] == 'b') + if(len > 1 && str[len-1] == 'b') len--; - else if(len > 1 && str[len-1] == 'B') + else if(len > 1 && str[len-1] == 'B') len--; - + if(len > 1 && tolower((unsigned char)str[len-1]) == 'g') mult = 1024*1024*1024; else if(len > 1 && tolower((unsigned char)str[len-1]) == 'm') @@ -2151,7 +2201,7 @@ uint8_t* config_parse_taglist(struct config_file* cfg, char* str, log_err("out of memory"); return 0; } - + /* parse */ s = str; while((p=strsep(&s, " \t\n")) != NULL) { @@ -2237,7 +2287,7 @@ int taglist_intersect(uint8_t* list1, size_t list1len, const uint8_t* list2, return 0; } -void +void config_apply(struct config_file* config) { MAX_TTL = (time_t)config->max_ttl; @@ -2279,7 +2329,7 @@ void config_lookup_uid(struct config_file* cfg) #endif } -/** +/** * Calculate string length of full pathname in original filesys * @param fname: the path name to convert. * Must not be null or empty. @@ -2293,7 +2343,7 @@ strlen_after_chroot(const char* fname, struct config_file* cfg, int use_chdir) { size_t len = 0; int slashit = 0; - if(cfg->chrootdir && cfg->chrootdir[0] && + if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(cfg->chrootdir, fname, strlen(cfg->chrootdir)) == 0) { /* already full pathname, return it */ return strlen(fname); @@ -2316,8 +2366,8 @@ strlen_after_chroot(const char* fname, struct config_file* cfg, int use_chdir) /* prepend chdir */ if(slashit && cfg->directory[0] != '/') len++; - if(cfg->chrootdir && cfg->chrootdir[0] && - strncmp(cfg->chrootdir, cfg->directory, + if(cfg->chrootdir && cfg->chrootdir[0] && + strncmp(cfg->chrootdir, cfg->directory, strlen(cfg->chrootdir)) == 0) len += strlen(cfg->directory)-strlen(cfg->chrootdir); else len += strlen(cfg->directory); @@ -2340,7 +2390,7 @@ fname_after_chroot(const char* fname, struct config_file* cfg, int use_chdir) return NULL; buf[0] = 0; /* is fname already in chroot ? */ - if(cfg->chrootdir && cfg->chrootdir[0] && + if(cfg->chrootdir && cfg->chrootdir[0] && strncmp(cfg->chrootdir, fname, strlen(cfg->chrootdir)) == 0) { /* already full pathname, return it */ (void)strlcpy(buf, fname, len); @@ -2366,10 +2416,10 @@ fname_after_chroot(const char* fname, struct config_file* cfg, int use_chdir) if(slashit && cfg->directory[0] != '/') (void)strlcat(buf, "/", len); /* is the directory already in the chroot? */ - if(cfg->chrootdir && cfg->chrootdir[0] && - strncmp(cfg->chrootdir, cfg->directory, + if(cfg->chrootdir && cfg->chrootdir[0] && + strncmp(cfg->chrootdir, cfg->directory, strlen(cfg->chrootdir)) == 0) - (void)strlcat(buf, cfg->directory+strlen(cfg->chrootdir), + (void)strlcat(buf, cfg->directory+strlen(cfg->chrootdir), len); else (void)strlcat(buf, cfg->directory, len); slashit = 1; @@ -2406,7 +2456,7 @@ static char* last_space_pos(const char* str) return (sp>tab)?sp:tab; } -int +int cfg_parse_local_zone(struct config_file* cfg, const char* val) { const char *type, *name_end, *name; @@ -2441,11 +2491,11 @@ cfg_parse_local_zone(struct config_file* cfg, const char* val) } if(strcmp(type, "nodefault")==0) { - return cfg_strlist_insert(&cfg->local_zones_nodefault, + return cfg_strlist_insert(&cfg->local_zones_nodefault, strdup(name)); #ifdef USE_IPSET } else if(strcmp(type, "ipset")==0) { - return cfg_strlist_insert(&cfg->local_zones_ipset, + return cfg_strlist_insert(&cfg->local_zones_ipset, strdup(name)); #endif } else { @@ -2500,7 +2550,7 @@ char* cfg_ptr_reverse(char* str) const char* hex = "0123456789abcdef"; char *p = buf; int i; - memmove(ad, &((struct sockaddr_in6*)&addr)->sin6_addr, + memmove(ad, &((struct sockaddr_in6*)&addr)->sin6_addr, sizeof(ad)); for(i=15; i>=0; i--) { uint8_t b = ad[i]; @@ -2512,7 +2562,7 @@ char* cfg_ptr_reverse(char* str) snprintf(buf+16*4, sizeof(buf)-16*4, "ip6.arpa. "); } else { uint8_t ad[4]; - memmove(ad, &((struct sockaddr_in*)&addr)->sin_addr, + memmove(ad, &((struct sockaddr_in*)&addr)->sin_addr, sizeof(ad)); snprintf(buf, sizeof(buf), "%u.%u.%u.%u.in-addr.arpa. ", (unsigned)ad[3], (unsigned)ad[2], diff --git a/sbin/unwind/libunbound/util/config_file.h b/sbin/unwind/libunbound/util/config_file.h index b1406913a..452f3c6a7 100644 --- a/sbin/unwind/libunbound/util/config_file.h +++ b/sbin/unwind/libunbound/util/config_file.h @@ -4,22 +4,22 @@ * Copyright (c) 2007, NLnet Labs. All rights reserved. * * This software is open source. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. - * + * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. - * + * * Neither the name of the NLNET LABS nor the names of its contributors may * be used to endorse or promote products derived from this software without * specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR @@ -76,6 +76,8 @@ struct config_file { int stat_cumulative; /** if true, the statistics are kept in greater detail */ int stat_extended; + /** if true, inhibits a lot of =0 lines from the extended stats output */ + int stat_inhibit_zero; /** number of threads to create */ int num_threads; @@ -86,6 +88,8 @@ struct config_file { int do_ip4; /** do ip6 query support. */ int do_ip6; + /** do nat64 on queries */ + int do_nat64; /** prefer ip4 upstream queries. */ int prefer_ip4; /** prefer ip6 upstream queries. */ @@ -114,6 +118,8 @@ struct config_file { int do_tcp_keepalive; /** tcp keepalive timeout, in msec */ int tcp_keepalive_timeout; + /** timeout of packets sitting in the socket queue */ + int sock_queue_timeout; /** proxy protocol ports */ struct config_strlist* proxy_protocol_port; @@ -230,7 +236,7 @@ struct config_file { /** interface description strings (IP addresses) */ char **ifs; - /** number of outgoing interfaces to open. + /** number of outgoing interfaces to open. * If 0 default all interfaces. */ int num_out_ifs; /** outgoing interface description strings (IP addresses) */ @@ -249,7 +255,7 @@ struct config_file { /** list of donotquery addresses, linked list */ struct config_strlist* donotqueryaddrs; #ifdef CLIENT_SUBNET - /** list of servers we send edns-client-subnet option to and + /** list of servers we send edns-client-subnet option to and * accept option from, linked list */ struct config_strlist* client_subnet; /** list of zones we send edns-client-subnet option for */ @@ -290,6 +296,9 @@ struct config_file { int harden_referral_path; /** harden against algorithm downgrade */ int harden_algo_downgrade; + /** harden against unknown records in the authority section and in + * the additional section */ + int harden_unknown_additional; /** use 0x20 bits in query as random ID bits */ int use_caps_bits_for_id; /** 0x20 whitelist, domains that do not use capsforid */ @@ -362,7 +371,7 @@ struct config_file { /** the module configuration string */ char* module_conf; - + /** files with trusted DS and DNSKEYs in zonefile format, list */ struct config_strlist* trust_anchor_file_list; /** list of trustanchor keys, linked list */ @@ -387,7 +396,7 @@ struct config_file { /** max number of query restarts, number of IPs to probe */ int32_t val_max_restart; /** this value sets the number of seconds before revalidating bogus */ - int bogus_ttl; + int bogus_ttl; /** should validator clean additional section for secure msgs */ int val_clean_additional; /** log bogus messages by the validator */ @@ -533,6 +542,9 @@ struct config_file { /** ignore AAAAs for these domain names and use A record anyway */ struct config_strlist* dns64_ignore_aaaa; + /* NAT64 prefix; if unset defaults to dns64_prefix */ + char* nat64_prefix; + /** true to enable dnstap support */ int dnstap; /** using bidirectional frame streams if true */ @@ -578,6 +590,9 @@ struct config_file { /** ratelimit for ip addresses. 0 is off, otherwise qps (unless overridden) */ int ip_ratelimit; + /** ratelimit for ip addresses with a valid DNS Cookie. 0 is off, + * otherwise qps (unless overridden) */ + int ip_ratelimit_cookie; /** number of slabs for ip_ratelimit cache */ size_t ip_ratelimit_slabs; /** memory size in bytes for ip_ratelimit cache */ @@ -608,6 +623,11 @@ struct config_file { /** number of retries on outgoing queries */ int outbound_msg_retry; + /** max sent queries per qstate; resets on query restarts (e.g., + * CNAMES) and referrals */ + int max_sent_count; + /** max number of query restarts; determines max length of CNAME chain */ + int max_query_restarts; /** minimise outgoing QNAME and hide original QTYPE if possible */ int qname_minimisation; /** minimise QNAME in strict mode, minimise according to RFC. @@ -684,12 +704,23 @@ struct config_file { char* redis_server_host; /** redis server's TCP port */ int redis_server_port; + /** redis server's unix path. Or "", NULL if unused */ + char* redis_server_path; + /** redis server's AUTH password. Or "", NULL if unused */ + char* redis_server_password; /** timeout (in ms) for communication with the redis server */ int redis_timeout; /** set timeout on redis records based on DNS response ttl */ int redis_expire_records; #endif #endif + /** Downstream DNS Cookies */ + /** do answer with server cookie when request contained cookie option */ + int do_answer_cookie; + /** cookie secret */ + uint8_t cookie_secret[40]; + /** cookie secret length */ + size_t cookie_secret_len; /* ipset module */ #ifdef USE_IPSET @@ -802,7 +833,7 @@ struct config_view { struct config_strlist* local_zones_ipset; #endif /** Fallback to global local_zones when there is no match in the view - * view specific tree. 1 for yes, 0 for no */ + * view specific tree. 1 for yes, 0 for no */ int isfirst; /** predefined actions for particular IP address responses */ struct config_str2list* respip_actions; @@ -877,7 +908,7 @@ struct config_file* config_create_forlib(void); * @param config: where options are stored into, must be freshly created. * @param filename: name of configfile. If NULL nothing is done. * @param chroot: if not NULL, the chroot dir currently in use (for include). - * @return: false on error. In that case errno is set, ENOENT means + * @return: false on error. In that case errno is set, ENOENT means * file not found. */ int config_read(struct config_file* config, const char* filename, @@ -912,16 +943,16 @@ void config_lookup_uid(struct config_file* config); int config_set_option(struct config_file* config, const char* option, const char* value); -/** +/** * Call print routine for the given option. * @param cfg: config. - * @param opt: option name without trailing :. + * @param opt: option name without trailing :. * This is different from config_set_option. * @param func: print func, called as (str, arg) for every data element. * @param arg: user argument for print func. * @return false if the option name is not supported (syntax error). */ -int config_get_option(struct config_file* cfg, const char* opt, +int config_get_option(struct config_file* cfg, const char* opt, void (*func)(char*,void*), void* arg); /** @@ -941,7 +972,7 @@ int config_get_option_list(struct config_file* cfg, const char* opt, * @param str: string. malloced, caller must free it. * @return 0=OK, 1=syntax error, 2=malloc failed. */ -int config_get_option_collate(struct config_file* cfg, const char* opt, +int config_get_option_collate(struct config_file* cfg, const char* opt, char** str); /** @@ -1136,7 +1167,7 @@ int cfg_count_numbers(const char* str); * k=1024, m=1024*1024, g=1024*1024*1024. * @param str: string * @param res: result is stored here, size in bytes. - * @return: true if parsed correctly, or 0 on a parse error (and an error + * @return: true if parsed correctly, or 0 on a parse error (and an error * is logged). */ int cfg_parse_memsize(const char* str, size_t* res); @@ -1170,7 +1201,7 @@ int find_tag_id(struct config_file* cfg, const char* tag); /** * parse taglist from string into bytestring with bitlist. * @param cfg: the config structure (with tagnames) - * @param str: the string to parse. Parse puts 0 bytes in string. + * @param str: the string to parse. Parse puts 0 bytes in string. * @param listlen: returns length of in bytes. * @return malloced bytes with a bitlist of the tags. or NULL on parse error * or malloc failure. @@ -1213,7 +1244,7 @@ int cfg_parse_local_zone(struct config_file* cfg, const char* val); * @param allow: give true if this range is permitted. * @param avail: the array from cfg. * @param num: size of the array (65536). - * @return: true if parsed correctly, or 0 on a parse error (and an error + * @return: true if parsed correctly, or 0 on a parse error (and an error * is logged). */ int cfg_mark_ports(const char* str, int allow, int* avail, int num); @@ -1241,7 +1272,7 @@ void cfg_apply_local_port_policy(struct config_file* cfg, int num); */ int cfg_scan_ports(int* avail, int num); -/** +/** * Convert a filename to full pathname in original filesys * @param fname: the path name to convert. * Must not be null or empty. @@ -1250,7 +1281,7 @@ int cfg_scan_ports(int* avail, int num); * @return pointer to malloced buffer which is: [chroot][chdir]fname * or NULL on malloc failure. */ -char* fname_after_chroot(const char* fname, struct config_file* cfg, +char* fname_after_chroot(const char* fname, struct config_file* cfg, int use_chdir); /** @@ -1335,4 +1366,3 @@ int if_is_dnscrypt(const char* ifname, const char* port, int dnscrypt_port); #endif #endif /* UTIL_CONFIG_FILE_H */ - diff --git a/sbin/unwind/libunbound/util/configlexer.c b/sbin/unwind/libunbound/util/configlexer.c index 2209c86d0..461789c98 100644 --- a/sbin/unwind/libunbound/util/configlexer.c +++ b/sbin/unwind/libunbound/util/configlexer.c @@ -5,7 +5,7 @@ #define YY_INT_ALIGNED short int -/* $OpenBSD: configlexer.c,v 1.16 2022/10/22 16:37:57 florian Exp $ */ +/* $OpenBSD: configlexer.c,v 1.17 2023/09/05 15:44:02 florian Exp $ */ /* A lexical scanner generated by flex */ @@ -27,7 +27,7 @@ /* end standard C headers. */ -/* $OpenBSD: configlexer.c,v 1.16 2022/10/22 16:37:57 florian Exp $ */ +/* $OpenBSD: configlexer.c,v 1.17 2023/09/05 15:44:02 florian Exp $ */ /* flex integer type definitions */ @@ -368,8 +368,8 @@ static void yy_fatal_error (yyconst char msg[] ); *yy_cp = '\0'; \ (yy_c_buf_p) = yy_cp; -#define YY_NUM_RULES 369 -#define YY_END_OF_BUFFER 370 +#define YY_NUM_RULES 381 +#define YY_END_OF_BUFFER 382 /* This struct is not used in this scanner, but its presence is necessary. */ struct yy_trans_info @@ -377,409 +377,423 @@ struct yy_trans_info flex_int32_t yy_verify; flex_int32_t yy_nxt; }; -static yyconst flex_int16_t yy_accept[3646] = +static yyconst flex_int16_t yy_accept[3778] = { 0, - 1, 1, 343, 343, 347, 347, 351, 351, 355, 355, - 1, 1, 359, 359, 363, 363, 370, 367, 1, 341, - 341, 368, 2, 368, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 343, 344, 344, 345, - 368, 347, 348, 348, 349, 368, 354, 351, 352, 352, - 353, 368, 355, 356, 356, 357, 368, 366, 342, 2, - 346, 368, 366, 362, 359, 360, 360, 361, 368, 363, - 364, 364, 365, 368, 367, 0, 1, 2, 2, 2, - 2, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 1, 1, 355, 355, 359, 359, 363, 363, 367, 367, + 1, 1, 371, 371, 375, 375, 382, 379, 1, 353, + 353, 380, 2, 380, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 355, 356, 356, 357, + 380, 359, 360, 360, 361, 380, 366, 363, 364, 364, + 365, 380, 367, 368, 368, 369, 380, 378, 354, 2, + 358, 380, 378, 374, 371, 372, 372, 373, 380, 375, + 376, 376, 377, 380, 379, 0, 1, 2, 2, 2, + 2, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 343, - 0, 347, 0, 354, 0, 351, 355, 0, 366, 0, - 2, 2, 366, 362, 0, 359, 363, 0, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 355, 0, 359, 0, 366, 0, 363, 367, 0, 378, + 0, 2, 2, 378, 374, 0, 371, 375, 0, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 366, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 378, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 339, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 133, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 143, 367, 367, 367, 367, - 367, 367, 367, 366, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 351, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 136, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 146, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 115, 367, 338, 367, 367, 367, - 367, 367, 367, 367, 367, 8, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 378, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 118, 379, + 379, 350, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 134, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 148, 367, 367, 366, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 8, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 137, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 151, 379, 379, + 378, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 331, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 341, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 366, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 69, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 260, 367, 14, - 15, 367, 19, 18, 367, 367, 240, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 378, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 71, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 265, 379, 14, 15, 379, 379, 20, 19, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 141, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 238, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 3, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 244, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 144, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 242, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 366, 367, 367, 367, 367, 367, 367, 367, 325, 367, - 367, 324, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 3, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 378, 379, 379, 379, 379, 379, 379, 379, 379, 333, + 379, 379, 332, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 350, 367, 367, 367, 367, 367, 367, 367, - 367, 68, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 72, 367, - 294, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 332, 333, 367, 367, 367, 367, 367, 367, 367, 367, - 73, 367, 367, 142, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 137, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 227, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 362, 379, 379, 379, + 379, 379, 379, 379, 379, 70, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 74, 379, 302, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 342, 343, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 75, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 21, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 169, 367, 367, 367, - 367, 367, 366, 350, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 113, 367, 367, 367, 367, - 367, 367, 367, 302, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 145, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 140, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 231, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 22, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 172, 379, 379, 379, 379, 379, + 378, 362, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 196, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 168, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 112, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 116, 379, 379, 379, 379, + 379, 379, 379, 310, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 16, 379, 379, 379, 379, 379, + 379, 379, 379, 199, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 171, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 35, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 36, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 70, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 140, 367, 367, 367, 366, 367, 367, - 367, 367, 367, 132, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 71, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 115, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 37, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 38, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 72, 379, - 367, 367, 264, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 197, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 58, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 143, + 379, 379, 379, 378, 379, 379, 379, 379, 379, 379, + 135, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 73, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 269, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 200, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 282, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 63, 367, 64, 367, 367, - 367, 367, 367, 116, 367, 117, 367, 367, 367, 367, - 367, 114, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 7, 367, 367, 367, 367, - 366, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 60, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 288, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 65, 379, 66, + 379, 379, 379, 379, 379, 379, 119, 379, 120, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 249, - 367, 367, 367, 367, 172, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 265, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 49, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 59, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 219, + 379, 379, 379, 379, 117, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 7, 379, + 379, 379, 379, 378, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 254, 379, 379, 379, 379, 175, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 270, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 218, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 16, 17, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 74, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 226, 367, 367, 367, 367, 367, 367, 119, - 367, 118, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 210, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 51, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 61, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 222, 379, 221, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 17, 18, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 149, 367, - 367, 367, 366, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 107, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 95, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 239, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 100, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 76, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 230, 379, 379, 379, 379, 379, 379, 379, 122, + 379, 121, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 213, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 152, 379, + 379, 379, 378, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 110, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 97, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 67, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 213, 214, 367, 367, - 367, 296, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 6, 367, 367, 367, 367, - 367, 367, 367, 315, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 300, 367, 367, 367, 367, 367, 367, - 367, 326, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 243, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 102, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 69, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 216, + 217, 379, 379, 379, 304, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 46, 367, 367, 367, - 367, 367, 48, 367, 367, 367, 96, 367, 367, 367, - 367, 367, 56, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 366, 367, 206, 367, 367, 367, - 144, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 231, 367, 207, 367, 367, 367, 246, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 57, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 146, 125, 367, 126, 367, 367, 367, 367, 124, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 6, 379, 379, 379, 379, 379, 379, 379, 323, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 308, + 379, 379, 379, 379, 379, 379, 379, 334, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 48, 379, 379, 379, 379, 379, 50, + 379, 379, 379, 98, 379, 379, 379, 379, 379, 58, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 165, 367, - 367, 54, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 281, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 208, 367, 367, 367, 367, 367, 211, 367, - 217, 367, 367, 367, 367, 367, 367, 245, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 111, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 138, 367, 367, 367, + 379, 378, 379, 209, 379, 379, 379, 147, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 235, + 379, 379, 210, 379, 379, 379, 250, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 59, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 149, + 128, 379, 129, 379, 379, 379, 379, 127, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 168, 379, + 379, 56, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 65, 367, 367, 367, 29, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 20, 367, 367, 367, 367, 367, 367, 367, - 30, 39, 367, 177, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 204, 367, - 367, 366, 367, 367, 367, 367, 367, 367, 82, 84, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 304, 367, 367, 367, 367, 261, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 286, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 211, 379, 379, 379, 379, 379, 214, 379, + 220, 379, 379, 379, 379, 379, 379, 379, 379, 249, + 379, 379, 379, 379, 379, 379, 253, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 114, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 141, + 379, 379, 379, 379, 379, 379, 379, 379, 67, 379, + 379, 379, 379, 31, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 21, 379, 379, 379, - 367, 367, 127, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 164, 367, 50, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 255, 367, 367, - 367, 367, 367, 367, 367, 319, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 171, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 313, - 367, 367, 367, 367, 237, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 329, 367, 367, 367, 367, + 379, 379, 379, 379, 32, 41, 379, 180, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 207, 379, 379, 378, 379, 379, 379, 379, + 346, 379, 379, 84, 86, 379, 379, 379, 379, 379, + 379, 379, 347, 379, 379, 379, 379, 379, 379, 312, + 379, 379, 379, 379, 266, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 130, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 167, 379, 52, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 189, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 120, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 184, 367, 198, 367, 367, 367, 367, 367, - 367, 367, 366, 367, 152, 367, 367, 367, 367, 367, - 106, 367, 367, 367, 367, 229, 367, 367, 367, 367, - 367, 367, 247, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 273, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 260, 379, 379, 379, 379, 379, + 379, 379, 379, 327, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 174, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 321, + 379, 379, 379, 379, 241, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 339, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 192, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 145, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 188, - 367, 367, 367, 367, 367, 367, 367, 85, 367, 86, - 367, 367, 367, 367, 367, 258, 367, 367, 367, 367, - 66, 322, 367, 367, 367, 367, 367, 94, 199, 367, - 220, 367, 250, 367, 367, 212, 297, 367, 367, 367, - 367, 367, 367, 78, 367, 201, 367, 367, 367, 367, - 367, 367, 9, 367, 367, 367, 367, 367, 110, 367, - 367, 367, 367, 367, 367, 286, 367, 367, 367, 367, - 228, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 123, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 187, 379, 201, 379, 379, 379, + 379, 379, 379, 379, 378, 379, 155, 379, 379, 379, + 379, 379, 109, 379, 379, 379, 379, 233, 379, 379, + 379, 379, 379, 379, 251, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 278, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 148, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 366, 367, 367, 367, 367, - 187, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 173, 367, 303, 367, 367, 367, 367, 367, 272, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 241, 367, 367, 367, 367, 367, 367, 295, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 191, 379, 379, 379, 379, 379, 379, 379, + 87, 379, 88, 379, 379, 379, 379, 379, 263, 379, + 379, 379, 379, 379, 68, 330, 379, 379, 379, 379, + 379, 96, 202, 379, 223, 379, 255, 379, 379, 215, + 305, 379, 379, 379, 379, 300, 379, 379, 379, 80, + 379, 204, 379, 379, 379, 379, 379, 379, 9, 379, + 379, 379, 379, 379, 113, 379, 379, 379, 379, 379, + 379, 292, 379, 379, 379, 379, 379, 232, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 170, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 323, 367, 200, - 367, 367, 367, 367, 367, 367, 367, 367, 77, 79, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 109, 367, 367, 367, 367, 367, 367, 284, 367, 367, - 367, 367, 299, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 233, 37, 31, 33, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 38, 367, 32, 34, 367, 40, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 378, 379, 379, 379, 379, 190, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 176, 379, 311, 379, 379, 379, 379, 379, 277, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 245, 379, 379, 379, 379, 379, 379, 303, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 173, 379, 379, 379, - 367, 367, 367, 367, 367, 105, 367, 183, 367, 367, - 367, 367, 367, 367, 367, 366, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 235, 232, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 76, 367, - 367, 367, 147, 367, 128, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 166, 51, 367, 367, 367, - 358, 13, 367, 367, 367, 367, 367, 367, 367, 153, - 367, 367, 367, 367, 367, 367, 367, 317, 367, 320, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 331, 379, + 203, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 79, 81, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 112, 379, 379, 379, 379, 379, 379, 290, + 379, 379, 379, 379, 379, 379, 307, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 237, 379, 39, 33, 35, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 40, 379, + 34, 36, 379, 42, 379, 379, 379, 379, 379, 379, - 367, 367, 12, 367, 367, 22, 367, 367, 367, 367, - 367, 367, 367, 290, 367, 367, 367, 367, 301, 367, - 367, 367, 367, 80, 367, 243, 367, 367, 367, 367, - 367, 234, 367, 367, 75, 367, 367, 367, 367, 367, - 367, 23, 367, 367, 47, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 182, 181, 367, - 367, 358, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 236, 230, 367, 248, 367, 367, 305, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 194, 367, 367, 367, 367, 367, 367, 367, + 379, 108, 379, 186, 379, 379, 379, 379, 379, 379, + 379, 378, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 239, 236, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 78, 379, 379, 379, 150, 379, + 131, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 169, 53, 379, 379, 379, 370, 13, 379, + 379, 379, 379, 379, 379, 379, 156, 379, 379, 379, + 379, 379, 379, 379, 379, 325, 379, 328, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 87, 367, 367, 367, 367, 367, - 367, 367, 285, 367, 367, 367, 367, 216, 367, 367, - 367, 367, 367, 242, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 292, 367, 367, 367, 327, 328, - 179, 367, 367, 367, 81, 367, 367, 367, 367, 190, - 367, 367, 367, 121, 123, 122, 367, 367, 367, 25, - 367, 367, 174, 367, 176, 367, 221, 367, 367, 367, - 367, 180, 367, 367, 367, 367, 251, 367, 367, 367, - 367, 367, 367, 367, 155, 367, 367, 367, 367, 367, + 379, 12, 379, 379, 23, 379, 379, 379, 379, 379, + 379, 379, 296, 379, 379, 379, 379, 379, 379, 309, + 379, 379, 379, 379, 82, 379, 247, 379, 379, 379, + 379, 379, 238, 379, 379, 379, 379, 77, 379, 379, + 379, 379, 379, 379, 24, 379, 379, 49, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 185, 184, 379, 379, 370, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 240, 234, 379, 252, 379, 379, + 313, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 197, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 263, 367, 367, - 367, 367, 367, 367, 367, 336, 367, 27, 367, 298, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 92, 222, 367, - 367, 257, 367, 367, 283, 367, 321, 367, 215, 367, - 367, 367, 367, 367, 293, 60, 367, 367, 367, 367, - 367, 367, 367, 4, 367, 367, 367, 367, 136, 367, - 154, 367, 367, 367, 195, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 254, 41, 42, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 89, 379, + 379, 379, 379, 379, 379, 379, 379, 291, 379, 379, + 379, 379, 219, 379, 379, 379, 379, 379, 379, 246, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 298, 379, 379, 379, 335, 379, 337, 336, 182, 379, + 379, 379, 83, 379, 379, 379, 379, 193, 379, 379, + 379, 379, 379, 124, 126, 125, 379, 379, 379, 26, + 379, 379, 177, 379, 179, 379, 224, 379, 379, 379, + 379, 183, 379, 379, 379, 379, 256, 379, 379, 379, - 367, 367, 367, 306, 367, 367, 367, 367, 367, 367, - 367, 271, 367, 367, 367, 367, 367, 367, 367, 367, - 225, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 91, 90, 367, 367, 61, - 367, 367, 289, 367, 259, 367, 367, 367, 367, 367, - 11, 367, 367, 367, 367, 340, 367, 367, 367, 367, - 135, 367, 367, 367, 367, 367, 223, 97, 367, 367, - 44, 367, 367, 367, 367, 367, 367, 367, 367, 186, - 367, 367, 367, 367, 367, 367, 367, 157, 367, 367, - 367, 367, 262, 367, 367, 367, 367, 367, 270, 367, + 379, 379, 379, 379, 158, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 268, 379, 379, + 379, 379, 379, 379, 379, 348, 379, 28, 379, 306, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 94, 225, + 379, 379, 262, 379, 379, 379, 289, 379, 329, 379, + 218, 379, 379, 301, 379, 379, 379, 299, 62, 379, + 379, 379, 379, 379, 379, 379, 4, 379, 379, 379, + 379, 379, 139, 379, 157, 379, 379, 379, 198, 30, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 150, 367, 367, 367, 129, 131, 130, - 367, 367, 367, 99, 103, 98, 167, 367, 367, 367, - 367, 88, 367, 256, 291, 367, 367, 367, 367, 367, - 367, 10, 367, 367, 367, 367, 367, 287, 330, 367, - 367, 367, 367, 367, 367, 335, 43, 367, 367, 367, - 367, 367, 185, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 104, 102, - 367, 55, 367, 367, 89, 367, 318, 367, 367, 367, - 367, 24, 367, 367, 367, 367, 367, 209, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 259, + 43, 44, 379, 379, 379, 379, 379, 379, 379, 314, + 379, 379, 379, 379, 379, 379, 379, 276, 379, 379, + 379, 379, 379, 379, 379, 379, 228, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 93, 92, 379, 379, 63, 379, 379, 287, + 295, 379, 264, 379, 379, 379, 379, 379, 11, 379, + 379, 379, 379, 352, 379, 379, 379, 379, 379, 138, + 379, 379, 379, 379, 379, 379, 226, 99, 379, 379, + 46, 379, 379, 379, 379, 379, 379, 379, 379, 189, - 367, 367, 367, 367, 224, 367, 367, 367, 367, 367, - 367, 367, 367, 205, 367, 367, 175, 83, 367, 367, - 367, 367, 367, 307, 367, 367, 367, 367, 367, 367, - 367, 267, 367, 367, 266, 151, 367, 367, 101, 52, - 367, 367, 158, 159, 162, 163, 160, 161, 93, 316, - 367, 367, 288, 139, 367, 367, 367, 26, 367, 178, - 367, 367, 367, 367, 203, 367, 253, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 192, 191, - 45, 367, 367, 367, 367, 367, 367, 367, 367, 367, + 379, 379, 379, 379, 379, 379, 379, 160, 379, 379, + 379, 379, 267, 379, 379, 379, 379, 379, 275, 379, + 379, 379, 379, 153, 379, 379, 379, 132, 134, 133, + 379, 379, 379, 101, 105, 100, 379, 170, 379, 379, + 379, 379, 90, 379, 261, 297, 379, 379, 379, 379, + 379, 379, 10, 379, 379, 379, 379, 379, 293, 340, + 379, 379, 379, 379, 379, 379, 379, 379, 345, 45, + 379, 379, 379, 379, 379, 188, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 314, 367, 367, 367, 367, 108, - 367, 252, 367, 280, 311, 367, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 337, 367, 53, 62, - 5, 367, 367, 244, 367, 367, 312, 367, 367, 367, - 367, 367, 367, 367, 367, 367, 268, 28, 367, 367, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 269, 367, 367, 367, 156, 367, 367, 367, 367, 367, - 367, 367, 367, 193, 367, 202, 367, 367, 367, 367, - 367, 367, 367, 367, 367, 308, 367, 367, 367, 367, + 379, 106, 104, 379, 379, 57, 379, 379, 91, 379, + 326, 379, 379, 379, 379, 25, 379, 379, 379, 379, + 379, 212, 379, 379, 338, 379, 379, 379, 379, 227, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 208, + 379, 379, 178, 85, 379, 379, 379, 379, 379, 315, + 379, 379, 379, 379, 379, 379, 379, 272, 379, 379, + 271, 154, 379, 379, 103, 379, 54, 379, 379, 161, + 162, 165, 166, 163, 164, 95, 324, 379, 379, 294, + 142, 379, 379, 379, 379, 27, 379, 181, 379, 379, + 379, 379, 206, 379, 258, 379, 379, 379, 379, 379, - 367, 367, 367, 367, 367, 367, 367, 367, 367, 367, - 367, 367, 367, 334, 367, 367, 276, 367, 367, 367, - 367, 367, 309, 367, 367, 367, 367, 367, 367, 310, - 367, 367, 367, 274, 367, 277, 278, 367, 367, 367, - 367, 367, 275, 279, 0 + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 195, 194, 229, + 47, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 322, 379, 379, 379, 379, + 111, 379, 257, 379, 285, 319, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 349, 379, 107, + 55, 64, 5, 379, 379, 248, 379, 379, 320, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 273, 29, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + + 379, 379, 274, 379, 379, 379, 159, 379, 379, 379, + 379, 379, 379, 379, 379, 196, 379, 205, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 316, 379, 379, + 379, 379, 379, 379, 379, 379, 379, 379, 379, 379, + 379, 379, 379, 379, 379, 344, 379, 379, 281, 379, + 379, 379, 379, 379, 317, 379, 379, 379, 379, 379, + 379, 318, 379, 379, 379, 279, 379, 282, 283, 379, + 379, 379, 379, 379, 280, 284, 0 } ; static yyconst flex_int32_t yy_ec[256] = @@ -822,821 +836,851 @@ static yyconst flex_int32_t yy_meta[41] = 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 } ; -static yyconst flex_int16_t yy_base[3664] = +static yyconst flex_int16_t yy_base[3796] = { 0, 0, 0, 38, 41, 44, 46, 59, 65, 71, 77, - 90, 112, 96, 118, 124, 136, 4156, 2779, 81, 7110, - 7110, 7110, 129, 52, 130, 63, 131, 152, 70, 140, - 149, 156, 57, 88, 76, 173, 175, 95, 197, 145, - 185, 199, 208, 213, 178, 123, 2391, 7110, 7110, 7110, - 107, 2147, 7110, 7110, 7110, 154, 2117, 1982, 7110, 7110, - 7110, 245, 1770, 7110, 7110, 7110, 163, 1609, 7110, 249, - 7110, 253, 148, 1509, 1480, 7110, 7110, 7110, 257, 1324, - 7110, 7110, 7110, 233, 1201, 263, 201, 0, 267, 0, - 0, 165, 191, 221, 252, 205, 181, 265, 92, 261, + 90, 112, 96, 118, 124, 136, 4433, 4347, 81, 7350, + 7350, 7350, 129, 52, 137, 63, 130, 159, 70, 132, + 134, 146, 57, 88, 76, 166, 177, 95, 199, 155, + 187, 201, 210, 172, 156, 148, 4272, 7350, 7350, 7350, + 107, 4232, 7350, 7350, 7350, 190, 3938, 3683, 7350, 7350, + 7350, 239, 3467, 7350, 7350, 7350, 203, 3285, 7350, 243, + 7350, 247, 212, 2761, 2193, 7350, 7350, 7350, 251, 1857, + 7350, 7350, 7350, 228, 1817, 257, 261, 0, 264, 0, + 0, 258, 262, 260, 195, 170, 251, 265, 269, 92, - 216, 263, 271, 272, 210, 279, 274, 282, 278, 291, - 283, 286, 276, 285, 295, 293, 306, 314, 297, 313, - 317, 311, 315, 319, 321, 331, 327, 332, 336, 322, - 339, 337, 346, 345, 347, 348, 353, 351, 357, 284, - 358, 359, 369, 360, 380, 365, 381, 379, 375, 366, - 367, 389, 390, 394, 393, 395, 396, 403, 404, 1026, - 419, 993, 422, 933, 429, 800, 757, 433, 713, 437, - 441, 0, 433, 515, 447, 479, 364, 452, 411, 445, - 426, 446, 447, 448, 449, 450, 451, 453, 452, 456, - 470, 234, 463, 473, 481, 479, 476, 483, 486, 493, + 270, 259, 275, 276, 277, 278, 288, 284, 286, 283, + 293, 179, 290, 292, 302, 306, 307, 310, 315, 314, + 318, 317, 325, 327, 328, 319, 335, 331, 336, 139, + 337, 342, 347, 350, 351, 353, 339, 360, 352, 363, + 356, 364, 366, 370, 374, 383, 379, 380, 389, 378, + 392, 225, 393, 395, 400, 399, 402, 403, 405, 408, + 1704, 425, 1563, 427, 1366, 435, 1178, 1061, 439, 1021, + 443, 447, 0, 424, 923, 451, 831, 375, 455, 443, + 455, 432, 451, 452, 453, 454, 215, 457, 456, 458, + 459, 462, 460, 480, 467, 472, 482, 419, 486, 487, - 488, 489, 495, 491, 501, 508, 505, 506, 504, 510, - 512, 513, 460, 514, 517, 529, 518, 516, 526, 538, - 539, 550, 543, 534, 551, 552, 400, 559, 555, 563, - 558, 570, 565, 574, 566, 569, 571, 576, 573, 577, - 580, 581, 578, 584, 585, 587, 589, 598, 599, 590, - 602, 596, 611, 607, 616, 612, 614, 613, 617, 541, - 627, 628, 620, 629, 630, 624, 633, 641, 637, 649, - 644, 635, 645, 647, 648, 652, 651, 656, 653, 668, - 670, 669, 672, 679, 665, 675, 666, 678, 682, 681, - 691, 654, 686, 693, 698, 683, 696, 699, 687, 702, + 493, 478, 503, 485, 495, 505, 499, 498, 515, 512, + 514, 513, 517, 520, 521, 470, 522, 523, 539, 525, + 524, 526, 547, 548, 552, 556, 534, 561, 566, 532, + 568, 564, 565, 573, 570, 577, 576, 585, 580, 581, + 572, 582, 584, 586, 590, 589, 591, 594, 599, 595, + 600, 613, 604, 601, 617, 605, 622, 615, 618, 630, + 608, 626, 623, 632, 635, 643, 644, 636, 645, 640, + 537, 646, 649, 656, 659, 658, 641, 657, 654, 661, + 663, 665, 667, 668, 670, 679, 682, 678, 681, 690, + 687, 689, 688, 692, 693, 696, 669, 705, 695, 708, - 704, 705, 710, 711, 708, 7110, 718, 714, 721, 722, - 729, 726, 731, 733, 740, 741, 716, 725, 737, 739, - 744, 746, 748, 750, 742, 751, 755, 753, 759, 763, - 770, 765, 772, 785, 767, 773, 777, 778, 786, 774, - 780, 798, 812, 790, 808, 809, 795, 813, 814, 815, - 816, 818, 822, 819, 833, 821, 823, 830, 836, 837, - 839, 840, 847, 842, 7110, 844, 852, 866, 853, 862, - 865, 849, 869, 871, 850, 881, 877, 874, 891, 913, - 878, 884, 882, 886, 889, 7110, 896, 893, 937, 895, - 902, 923, 918, 906, 919, 920, 921, 925, 947, 928, + 711, 700, 709, 713, 715, 717, 719, 718, 722, 723, + 728, 724, 7350, 731, 730, 735, 736, 745, 742, 740, + 747, 754, 755, 750, 751, 756, 753, 757, 759, 760, + 761, 764, 767, 771, 768, 773, 775, 788, 781, 779, + 794, 780, 790, 792, 815, 795, 796, 804, 799, 823, + 810, 821, 826, 827, 828, 830, 831, 829, 837, 840, + 800, 841, 850, 835, 852, 853, 854, 855, 856, 857, + 865, 861, 7350, 863, 870, 877, 879, 881, 882, 888, + 895, 890, 869, 896, 900, 899, 903, 912, 934, 904, + 907, 901, 905, 917, 7350, 919, 918, 958, 914, 927, - 926, 943, 961, 958, 942, 948, 945, 959, 967, 972, - 969, 971, 973, 974, 983, 883, 976, 975, 989, 978, - 979, 984, 990, 994, 997, 1003, 1007, 1008, 1009, 999, - 1001, 1013, 1014, 1017, 1025, 1048, 1021, 1019, 1030, 1020, - 1037, 1042, 1022, 1038, 1050, 1049, 1051, 1039, 1040, 1055, - 1058, 1067, 1060, 1063, 1076, 1071, 1074, 1077, 1078, 1079, - 1081, 1080, 1085, 1086, 1087, 1088, 1095, 1093, 1094, 1101, - 1103, 1096, 1109, 1107, 7110, 1111, 7110, 1113, 1114, 1115, - 1116, 1118, 1119, 1120, 1121, 7110, 1123, 1126, 1127, 1137, - 1128, 1138, 1145, 1152, 1130, 1148, 1149, 1150, 1151, 1155, + 945, 941, 942, 940, 949, 943, 946, 962, 948, 967, + 968, 969, 981, 979, 976, 978, 980, 982, 986, 989, + 1000, 1005, 990, 997, 999, 1007, 926, 992, 1011, 1017, + 1003, 1012, 1018, 1019, 1022, 1024, 1020, 1027, 1033, 1038, + 1039, 1031, 1028, 1044, 1041, 1048, 1045, 1068, 1052, 1049, + 1051, 1066, 1055, 1069, 1071, 1072, 1075, 1074, 1083, 1076, + 1090, 1080, 1095, 1097, 1087, 1098, 1107, 1104, 1103, 1084, + 1106, 1109, 1112, 1110, 1115, 1116, 1117, 1120, 1119, 1125, + 1126, 1124, 1127, 1132, 1136, 1137, 1142, 1138, 7350, 1150, + 1145, 7350, 1147, 1148, 1149, 1152, 1151, 1154, 1153, 1155, - 1158, 1169, 1156, 1161, 1172, 1159, 1174, 1171, 1168, 1177, - 1175, 1182, 1178, 1184, 1185, 1186, 1205, 7110, 1187, 1188, - 1195, 1192, 1198, 1203, 1202, 1212, 1223, 1214, 1215, 1222, - 1226, 1239, 1227, 1230, 1191, 1234, 1236, 1247, 1237, 1249, - 1243, 1251, 1245, 1252, 1254, 1255, 1259, 1261, 1265, 1266, - 1268, 7110, 1267, 1271, 1278, 1285, 1280, 1272, 1269, 1283, - 1286, 1289, 1290, 1291, 1293, 1296, 1298, 1300, 1308, 1303, - 1311, 1309, 1310, 1312, 1314, 1317, 1316, 1318, 1323, 1331, - 1328, 1333, 1336, 1344, 1343, 1346, 1353, 1355, 1340, 1348, - 1350, 1356, 1352, 1351, 1360, 1361, 1366, 1363, 1365, 1372, + 7350, 1157, 1162, 1163, 1171, 1164, 1182, 1179, 1187, 1169, + 1184, 1185, 1186, 1190, 1191, 1192, 1200, 1195, 1199, 1203, + 1205, 1207, 1208, 1210, 1209, 1211, 1217, 1214, 1218, 1216, + 1220, 1224, 1240, 7350, 1225, 1226, 1227, 1234, 1233, 1244, + 1235, 1253, 1258, 1250, 1264, 1255, 1261, 1268, 1272, 1275, + 1276, 868, 1277, 1280, 1278, 1282, 1284, 1286, 1285, 1292, + 1288, 1290, 1296, 1295, 1294, 1302, 1305, 7350, 1306, 1310, + 1316, 1324, 1309, 1308, 1319, 1322, 1331, 1326, 1327, 1328, + 1329, 1333, 1330, 1339, 1344, 1340, 1337, 1352, 1356, 1348, + 1355, 1351, 1353, 1357, 1361, 1363, 1359, 1377, 1367, 1370, - 1373, 1374, 1375, 1377, 1378, 1382, 1380, 1385, 1387, 1388, - 1390, 1389, 1391, 1398, 1397, 1399, 1404, 1401, 1417, 1403, - 1406, 1420, 1423, 1410, 1414, 7110, 1432, 1427, 1430, 1431, - 1434, 1437, 1438, 1442, 1441, 1444, 1447, 1445, 1446, 1449, - 1452, 1453, 1454, 1455, 1456, 1462, 1469, 1464, 1473, 1480, - 1479, 1481, 1467, 1483, 1484, 1487, 1488, 1495, 1491, 1499, - 1500, 1490, 1501, 1494, 1514, 1504, 1505, 1511, 1525, 1502, - 1520, 1522, 1512, 1523, 1526, 1528, 1534, 1542, 1538, 1539, - 1546, 1547, 1541, 1549, 1543, 1553, 1556, 1557, 1558, 1559, - 1560, 1567, 1564, 1563, 1569, 1570, 1565, 1571, 1579, 1573, + 1374, 1383, 1384, 1386, 1388, 1395, 1397, 1390, 1392, 1393, + 1398, 1394, 1400, 1402, 1403, 1404, 1407, 1412, 1411, 1420, + 1416, 1417, 1422, 1418, 1424, 1425, 1427, 1428, 1429, 1432, + 1437, 1435, 1439, 1441, 1443, 1456, 1444, 1447, 1445, 1450, + 1460, 1469, 1458, 1461, 7350, 1477, 1470, 1475, 1480, 1481, + 1482, 1483, 1473, 1487, 1236, 1490, 1491, 1492, 1494, 1495, + 1497, 1502, 1498, 1499, 1501, 1500, 1508, 1521, 1518, 1511, + 1525, 1510, 1527, 1528, 1529, 1531, 1532, 1534, 1535, 1542, + 1538, 1550, 1537, 1541, 1548, 1549, 1557, 1555, 1558, 1559, + 1567, 1562, 1560, 1570, 1552, 1573, 1576, 1577, 1582, 1586, - 1587, 1577, 1586, 1589, 1592, 1593, 1594, 1595, 1598, 1596, - 1602, 1603, 1604, 1605, 1610, 1617, 1606, 1625, 1618, 1608, - 1619, 1626, 1628, 1634, 1635, 1636, 1637, 1638, 1639, 1641, - 1642, 1648, 1645, 1651, 1652, 1655, 1657, 1656, 1670, 1662, - 1671, 1672, 1659, 1675, 1677, 1679, 1660, 1683, 1685, 1688, - 1690, 1680, 7110, 1678, 1702, 1691, 1699, 1698, 1700, 1701, - 1712, 1705, 1707, 1704, 1708, 1709, 1734, 7110, 1715, 7110, - 7110, 1718, 7110, 7110, 1717, 1721, 7110, 1716, 1731, 1723, - 1724, 1741, 1747, 1749, 1744, 1742, 1751, 1752, 1763, 1773, - 1758, 1759, 1761, 1766, 1767, 1762, 1779, 1776, 1768, 1788, + 1587, 1588, 1595, 1590, 1592, 1452, 1596, 1602, 1597, 1598, + 1601, 1605, 1606, 1607, 1614, 1609, 1611, 1621, 1622, 1610, + 1612, 1626, 1624, 1640, 1630, 1632, 1633, 1635, 1641, 1642, + 1643, 1648, 1644, 1649, 1651, 1652, 1653, 1658, 1659, 1655, + 1664, 1665, 1657, 1674, 1675, 1677, 1678, 1680, 1683, 1681, + 1686, 1690, 1684, 1687, 1693, 1695, 1700, 1701, 1702, 1703, + 1705, 1715, 1706, 1718, 1719, 1714, 1720, 1722, 1724, 1725, + 1726, 1731, 1732, 1735, 1738, 1736, 7350, 1740, 1748, 1744, + 1746, 1749, 1750, 1751, 1752, 1760, 1756, 1758, 1755, 1757, + 1761, 1783, 7350, 1769, 7350, 7350, 1771, 1772, 7350, 7350, - 1789, 1769, 1795, 1802, 1790, 1805, 1800, 1803, 1809, 1807, - 1811, 1813, 1817, 1819, 1820, 1822, 1823, 1824, 1826, 1720, - 1828, 1825, 1833, 1830, 1834, 1836, 1835, 1843, 1846, 1839, - 1855, 7110, 1853, 1856, 1842, 1865, 1862, 1866, 1868, 1863, - 1864, 1874, 1876, 1870, 1877, 1879, 1881, 1880, 1882, 1883, - 1886, 1889, 1892, 1890, 1894, 1897, 1896, 1902, 7110, 1903, - 1904, 1906, 1910, 1907, 1908, 1917, 1909, 1918, 1919, 1920, - 1932, 1924, 1934, 1925, 1927, 1936, 1929, 1937, 1939, 7110, - 1947, 1952, 1941, 1954, 1944, 1948, 1956, 1957, 1958, 1960, - 1961, 1963, 1964, 1966, 1977, 1972, 1974, 1973, 1975, 1983, + 1777, 1774, 7350, 1775, 1787, 1790, 1778, 1796, 1806, 1808, + 1801, 1798, 1804, 1791, 1819, 1820, 1810, 1823, 1814, 1815, + 1825, 1826, 1836, 1837, 1834, 1843, 1831, 1844, 1849, 1860, + 1851, 1861, 1855, 1863, 1864, 1866, 1872, 1873, 1877, 1845, + 1767, 1867, 1879, 1874, 1880, 1881, 1884, 1882, 1887, 1890, + 1888, 1892, 1893, 1902, 1895, 1908, 1911, 7350, 1898, 1918, + 1909, 1913, 1914, 1922, 1919, 1923, 1925, 1920, 1921, 1931, + 1936, 1933, 1937, 1938, 1939, 1942, 1940, 1941, 1948, 1943, + 1950, 1952, 1955, 1954, 1966, 1957, 1958, 7350, 1965, 1967, + 1968, 1973, 1970, 1969, 1980, 1981, 1971, 1982, 1984, 1989, - 1987, 1980, 1990, 1991, 1999, 1992, 1995, 2000, 2001, 2002, - 2003, 2005, 2006, 2008, 2012, 2013, 2020, 2016, 2024, 2017, - 2019, 2035, 2040, 2022, 2033, 2036, 2037, 2038, 2043, 2047, - 2051, 2046, 2050, 2053, 2060, 2055, 2058, 2061, 2062, 2069, - 2071, 2063, 2073, 2080, 2064, 2074, 2083, 2076, 7110, 2082, - 2084, 7110, 2089, 2090, 2091, 2113, 2092, 2096, 2099, 2104, - 2101, 2105, 2108, 2097, 2115, 2107, 2131, 2119, 2127, 2132, - 2135, 2137, 2133, 2138, 2139, 2140, 2144, 2146, 2149, 2151, - 2159, 2162, 2166, 2168, 2170, 2169, 2171, 2172, 2174, 2194, - 2173, 2175, 2176, 2177, 2178, 2181, 2188, 2182, 2183, 2184, + 1986, 1993, 1987, 1990, 1998, 1999, 2001, 2003, 7350, 2008, + 2005, 2011, 2012, 2013, 2015, 2016, 2018, 2021, 2022, 2024, + 2025, 2026, 2027, 2028, 2035, 2031, 2037, 2039, 2041, 2044, + 2046, 2051, 2050, 2056, 2054, 2057, 2062, 2063, 2065, 2066, + 2067, 2068, 2069, 2071, 2073, 2081, 2083, 2070, 2086, 2078, + 2079, 2095, 2100, 2097, 2096, 2098, 2102, 2103, 2104, 2112, + 2114, 2113, 2109, 2117, 2125, 2111, 2121, 2122, 2123, 2126, + 2138, 2133, 2135, 2145, 2134, 2141, 2136, 2147, 2143, 7350, + 2149, 2150, 7350, 2153, 2154, 2155, 2177, 2158, 2159, 2165, + 2157, 2168, 2170, 2171, 2179, 2178, 2184, 2183, 2191, 2187, - 2187, 2199, 2207, 2204, 2205, 2210, 2211, 2212, 2216, 2219, - 2221, 2222, 7110, 2229, 2232, 2224, 2226, 2233, 2244, 2236, - 2237, 7110, 2239, 2240, 2245, 2253, 2250, 2251, 2252, 2254, - 2255, 2258, 2260, 2262, 2264, 2275, 2263, 2282, 7110, 2267, - 7110, 2265, 2266, 2284, 2268, 2277, 2285, 2290, 2288, 2292, - 7110, 7110, 2294, 2295, 2300, 2302, 2312, 2298, 2308, 2309, - 7110, 2310, 2317, 7110, 2314, 2313, 2321, 2319, 2320, 2325, - 2327, 2329, 2331, 2336, 2332, 2343, 2334, 2339, 2347, 7110, - 2350, 2335, 2348, 2353, 2354, 2355, 2356, 2357, 2363, 2360, - 7110, 2364, 2366, 2367, 2380, 2376, 2377, 2378, 2381, 2387, + 2199, 2200, 2202, 2203, 2207, 2201, 2209, 2211, 2205, 2214, + 2212, 2215, 2224, 2222, 2231, 2235, 2233, 2239, 2242, 2237, + 2238, 2240, 2260, 2241, 2243, 2249, 2244, 2245, 2247, 2254, + 2250, 2251, 2255, 2265, 2270, 2271, 2278, 2276, 2273, 2275, + 2282, 2277, 2283, 2291, 2288, 2294, 7350, 2302, 2297, 2299, + 2303, 2304, 2311, 2307, 2306, 7350, 2310, 2313, 2315, 2326, + 2321, 2309, 2324, 2316, 2323, 2327, 2332, 2333, 2334, 2335, + 2338, 2345, 7350, 2340, 7350, 2346, 2348, 2349, 2352, 2359, + 2350, 2351, 2354, 2358, 2361, 2362, 7350, 7350, 2370, 2371, + 2377, 2363, 2384, 2385, 2380, 2381, 2382, 7350, 2383, 2393, - 2379, 2383, 2385, 2389, 2390, 2399, 2400, 2401, 2404, 2406, - 2413, 2410, 2414, 7110, 2412, 2398, 2418, 2425, 2421, 2423, - 2420, 2424, 2427, 2428, 2430, 2431, 2436, 2437, 2435, 2441, - 2442, 2443, 2450, 2451, 2452, 2453, 2456, 2447, 2457, 2460, - 2461, 2468, 2463, 2465, 2469, 2470, 7110, 2473, 2476, 2477, - 2478, 2482, 2480, 171, 2484, 2486, 2490, 2489, 2496, 2504, - 2491, 2499, 2512, 2497, 2509, 2508, 2515, 2507, 2516, 2517, - 2518, 2519, 2524, 2525, 2523, 7110, 2527, 2529, 2528, 2532, - 2535, 2534, 2539, 7110, 2545, 2536, 2551, 2560, 2550, 2548, - 2561, 2552, 2563, 2565, 2567, 2566, 2568, 2575, 2573, 2570, + 7350, 2390, 2388, 2397, 2398, 2401, 2402, 2404, 2406, 2405, + 2413, 2408, 2415, 2410, 2411, 2417, 7350, 2423, 2426, 2414, + 2427, 2433, 2430, 2434, 2436, 2437, 2439, 7350, 2444, 2440, + 2447, 2445, 2454, 2458, 2452, 2449, 2459, 2463, 2455, 2460, + 2465, 2468, 2469, 2476, 2478, 2480, 2481, 2483, 2490, 2487, + 2495, 7350, 2491, 2475, 2477, 2500, 2498, 2502, 2499, 2504, + 2505, 2506, 2507, 2509, 2511, 2516, 2515, 2517, 2518, 2519, + 2528, 2529, 2521, 2532, 2534, 2525, 2531, 2539, 2540, 2546, + 2541, 2543, 2547, 2548, 7350, 2549, 2554, 2555, 2556, 2557, + 2550, 280, 2560, 2564, 2565, 2567, 2569, 2571, 2576, 2580, - 2576, 2577, 7110, 2583, 2586, 2588, 2579, 2589, 2597, 2595, - 2590, 2592, 2598, 2600, 2606, 2602, 2608, 2610, 2611, 2613, - 2616, 2615, 2624, 2614, 2619, 2626, 2623, 2625, 2628, 2627, - 2633, 2636, 2643, 2641, 7110, 2648, 2645, 2649, 2647, 2650, - 2652, 2654, 2653, 2672, 2656, 2662, 2664, 2673, 2678, 2667, - 2681, 2688, 2684, 2689, 2693, 2698, 2695, 2699, 2705, 2696, - 2707, 2709, 2703, 2710, 2719, 2711, 2715, 2716, 2718, 2722, - 2730, 2731, 2729, 2733, 2726, 2727, 2744, 2738, 2750, 2756, - 2746, 7110, 2755, 2748, 2742, 2758, 2760, 2767, 2764, 2765, - 2770, 2768, 2771, 2772, 2774, 2778, 2783, 2784, 2657, 2781, + 2587, 2588, 2583, 2584, 2590, 2591, 2593, 2594, 2597, 2595, + 2585, 2598, 2605, 2603, 2606, 7350, 2614, 2609, 2611, 2615, + 2616, 2617, 2619, 7350, 2627, 2620, 2634, 2641, 2636, 2628, + 2644, 2626, 2632, 2646, 7350, 2648, 2649, 2651, 2658, 2654, + 2656, 2660, 2657, 7350, 2662, 2664, 2667, 2665, 2673, 2675, + 2674, 2666, 2677, 2680, 2684, 2682, 2686, 2688, 2689, 2690, + 2691, 2695, 2698, 2694, 2710, 2702, 2703, 2706, 2712, 2707, + 2716, 2714, 2717, 2719, 2724, 2720, 7350, 2731, 2721, 2729, + 2730, 2732, 2735, 2739, 2737, 2747, 2745, 2748, 2750, 2753, + 2765, 2755, 2758, 2775, 2756, 2771, 2772, 2783, 2780, 2782, - 2786, 2790, 2788, 2794, 2797, 2796, 2798, 2801, 2808, 2805, - 2810, 2811, 7110, 2812, 2816, 2799, 2817, 2825, 2819, 2828, - 2829, 2831, 2822, 2832, 2833, 2835, 2837, 2838, 2841, 2840, - 2848, 2845, 2847, 2849, 2846, 7110, 2858, 2852, 2859, 2863, - 2862, 2865, 2866, 2873, 2877, 2879, 2881, 2883, 2869, 2885, - 2886, 2889, 7110, 2896, 2898, 2894, 2895, 2903, 2901, 2904, - 2905, 2907, 2908, 7110, 2909, 2911, 2912, 2915, 2913, 2917, - 2924, 2925, 2920, 7110, 2927, 2931, 2932, 2934, 2935, 2936, - 2937, 2938, 2941, 2942, 2944, 2943, 2957, 2946, 2953, 7110, - 2949, 2965, 2960, 2963, 2966, 2970, 2971, 2973, 2975, 2976, + 2759, 2779, 2789, 2791, 2786, 2792, 2799, 2801, 2802, 2798, + 2797, 2803, 2804, 2809, 2819, 2814, 2821, 2811, 2822, 2812, + 2823, 2824, 2828, 2830, 2836, 2835, 7350, 2840, 2838, 2845, + 2848, 2847, 2855, 2850, 2851, 2852, 2858, 2860, 2861, 2862, + 2863, 2870, 2867, 2871, 2874, 2875, 2879, 2876, 2878, 2885, + 2886, 2888, 2891, 2894, 2895, 2898, 2900, 2899, 7350, 2903, + 2902, 2908, 2909, 2912, 2914, 2916, 2919, 2917, 2921, 2923, + 2924, 2926, 2928, 2929, 2930, 2931, 2938, 2935, 2941, 2937, + 2936, 7350, 2949, 2943, 2947, 2956, 2953, 2957, 2955, 2959, + 2965, 2966, 2969, 2972, 2973, 2974, 2975, 2976, 7350, 2984, - 2977, 2981, 7110, 2993, 2871, 2989, 2998, 2982, 2990, 2994, - 2999, 3002, 3003, 2996, 3005, 3006, 3009, 7110, 3010, 3013, - 3015, 3017, 3019, 3020, 3021, 3028, 3027, 3026, 3030, 3032, - 3035, 3036, 3034, 3043, 3037, 3047, 3041, 3045, 3054, 3055, - 3057, 3058, 3060, 3061, 3070, 3071, 3068, 3073, 3076, 3077, - 3069, 3078, 3079, 3087, 3092, 3094, 3089, 3095, 7110, 3098, - 3100, 3093, 3091, 3101, 3105, 3103, 3107, 3110, 3106, 3108, - 3120, 3121, 3112, 3128, 3130, 3123, 3132, 3134, 3136, 3137, - 3139, 3138, 3140, 3141, 3148, 3145, 3147, 3149, 3158, 3151, - 3156, 3169, 3154, 3161, 3164, 3165, 3166, 3168, 3171, 3172, + 2985, 2981, 2983, 2993, 2990, 2992, 2994, 2996, 2997, 7350, + 2998, 3000, 3002, 3001, 3004, 3006, 3013, 3014, 3009, 3010, + 7350, 3025, 3020, 3022, 3023, 3026, 3027, 3028, 3030, 3032, + 3033, 3035, 3039, 3036, 3048, 3037, 3045, 7350, 3049, 3057, + 3055, 3061, 3059, 3062, 3063, 3064, 3066, 3072, 3075, 3069, + 7350, 3086, 3084, 3085, 3093, 3089, 3065, 3094, 3090, 3097, + 3098, 3099, 3100, 3101, 3104, 7350, 3105, 3107, 3109, 3110, + 3114, 3113, 3115, 3122, 3121, 3123, 3126, 3128, 3129, 3132, + 3130, 3135, 3136, 3141, 3137, 3138, 3148, 3150, 3153, 3151, + 3156, 3157, 3160, 3164, 3168, 3167, 3170, 3173, 3174, 3163, - 3176, 3178, 3174, 3179, 3188, 3190, 3195, 3186, 3197, 3196, - 3199, 3202, 3203, 3204, 7110, 3207, 3208, 3205, 3212, 3215, - 3218, 3219, 3227, 3222, 3226, 3234, 3230, 3229, 3236, 3238, - 3241, 3242, 3243, 3250, 3246, 7110, 3247, 7110, 3248, 3249, - 3252, 3261, 3256, 7110, 3267, 7110, 3257, 3271, 3262, 3264, - 3268, 7110, 3272, 3273, 3277, 3274, 3279, 3281, 3285, 3286, - 3287, 3288, 3289, 3296, 3291, 3295, 3298, 3302, 3301, 3305, - 3308, 3310, 3311, 3313, 3312, 3315, 3319, 3320, 3321, 3328, - 3330, 3331, 3332, 3333, 3334, 7110, 3338, 3341, 3335, 3346, - 3343, 3345, 3347, 3353, 3354, 3355, 3356, 3360, 3358, 3362, + 3175, 3178, 3182, 3190, 3191, 3186, 3188, 7350, 3193, 3194, + 3195, 3197, 3199, 3200, 3201, 3202, 3205, 3203, 3212, 3213, + 3207, 3217, 3225, 3228, 3226, 3229, 3231, 3232, 3233, 3234, + 3235, 3237, 3238, 3247, 3240, 3243, 3244, 3248, 3249, 3258, + 3253, 3259, 3266, 3255, 3262, 3267, 3268, 3269, 3270, 3276, + 3273, 3277, 3278, 3280, 3281, 3282, 3284, 3298, 3303, 3299, + 3291, 3293, 3305, 3307, 3308, 3309, 7350, 3312, 3313, 3310, + 3314, 3317, 3323, 3319, 3332, 3327, 3331, 3335, 3336, 3339, + 3345, 3337, 3338, 3346, 3340, 3353, 3351, 7350, 3348, 7350, + 3358, 3354, 3359, 3361, 3369, 3365, 7350, 3368, 7350, 3370, - 3367, 3370, 3364, 3371, 3374, 3381, 3383, 3375, 3390, 7110, - 3385, 3388, 3389, 3392, 7110, 3396, 3393, 3402, 3404, 3397, - 3394, 3400, 3406, 3413, 3407, 3410, 3416, 3420, 3424, 3427, - 3428, 7110, 3421, 3429, 3419, 3437, 3442, 3433, 3445, 3449, - 3446, 3452, 3454, 3456, 3458, 3435, 3459, 3460, 3461, 3462, - 3470, 3472, 3473, 3469, 3482, 3468, 3475, 3484, 3485, 3471, - 3478, 3486, 3487, 3488, 3492, 3494, 3493, 3495, 3496, 3497, - 3503, 3509, 7110, 3501, 3512, 3504, 3521, 3510, 3518, 3519, - 3514, 3523, 3531, 3527, 7110, 3538, 3525, 3535, 3529, 3542, - 3533, 3546, 3547, 3549, 3550, 3551, 3554, 3553, 3552, 7110, + 3372, 3374, 3376, 3377, 7350, 3378, 3379, 3382, 3380, 3383, + 3386, 3384, 3388, 3391, 3396, 3394, 3404, 3405, 3407, 3395, + 3397, 3411, 3414, 3417, 3415, 3419, 3420, 3423, 3422, 3424, + 3426, 3430, 3427, 3432, 3433, 3435, 3440, 3442, 7350, 3453, + 3445, 3441, 3450, 3456, 3443, 3457, 3458, 3460, 3462, 3464, + 3465, 3463, 3469, 3470, 3476, 3479, 3480, 3481, 3482, 3486, + 3498, 3483, 3499, 3495, 7350, 3494, 3497, 3502, 3504, 7350, + 3506, 3505, 3512, 3514, 3509, 3507, 3516, 3517, 3518, 3522, + 3524, 3526, 3527, 3534, 3532, 3535, 7350, 3539, 3542, 3541, + 3549, 3544, 3550, 3557, 3559, 3555, 3561, 3563, 3571, 3567, - 3555, 7110, 3556, 3569, 3558, 3564, 3573, 3574, 3576, 3578, - 3580, 3582, 3583, 3584, 3586, 3589, 3590, 3594, 3595, 3598, - 3596, 3615, 3600, 3597, 3602, 3611, 3612, 3613, 3616, 3626, - 3618, 3617, 7110, 7110, 3619, 3621, 3633, 3628, 3635, 3636, - 3637, 3640, 3647, 3643, 3646, 3649, 3650, 3658, 7110, 3653, - 3654, 3660, 3661, 3662, 3671, 3663, 3673, 3680, 3678, 3675, - 3685, 3684, 7110, 3677, 3686, 3693, 3688, 3695, 3702, 7110, - 3691, 7110, 3692, 3694, 3703, 3706, 3705, 3707, 3708, 3709, - 3712, 3715, 3717, 3720, 3730, 3732, 3733, 3727, 3735, 3723, - 3728, 3737, 3739, 3742, 3750, 3745, 3747, 3748, 7110, 3752, + 3556, 3558, 3568, 3570, 3575, 3579, 3583, 3586, 3584, 3588, + 3581, 3591, 3593, 3594, 3585, 3595, 3597, 3598, 3600, 3602, + 3605, 3607, 3606, 3601, 3609, 3608, 3611, 3618, 7350, 3622, + 3623, 3614, 3637, 3628, 3629, 3632, 3633, 3636, 3640, 3642, + 7350, 3644, 3638, 3649, 3650, 3655, 3646, 3653, 3659, 3660, + 3663, 3664, 3666, 3665, 3668, 7350, 3670, 7350, 3669, 3686, + 3676, 3681, 3687, 3682, 3688, 3693, 3695, 3696, 3697, 3698, + 3701, 3705, 3706, 3709, 3707, 3710, 3712, 3713, 3714, 3718, + 3730, 3717, 3729, 3720, 3721, 3732, 3733, 3735, 3743, 3739, + 3741, 7350, 7350, 3745, 3746, 3748, 3752, 3756, 3754, 3757, - 3749, 3753, 3754, 3758, 3760, 3768, 3761, 3762, 7110, 3764, - 3771, 3774, 3772, 3776, 3782, 3779, 3783, 3786, 3788, 3789, - 3790, 3792, 3794, 7110, 3793, 3796, 3807, 3799, 3800, 3802, - 3810, 3814, 3820, 7110, 3821, 3813, 3829, 3825, 3815, 3828, - 3831, 3832, 3833, 3835, 3836, 3837, 3838, 3839, 3844, 3845, - 3841, 3840, 3847, 3858, 3859, 3850, 3869, 3857, 3861, 7110, - 3871, 3866, 3872, 3873, 3874, 3875, 3876, 3878, 3881, 3884, - 3886, 3896, 3897, 3888, 3893, 3899, 3901, 3903, 3908, 3910, - 7110, 3911, 3904, 3918, 3916, 3915, 3923, 3925, 3917, 3927, - 3929, 3919, 3930, 3931, 3933, 3941, 3939, 3949, 3945, 3935, + 3759, 3766, 3768, 3761, 3765, 3767, 3777, 7350, 3769, 3780, + 3781, 3782, 3784, 3794, 3789, 3791, 3799, 3792, 3796, 3806, + 3802, 7350, 3801, 3804, 3805, 3815, 3812, 3811, 3822, 7350, + 3818, 7350, 3813, 3817, 3823, 3827, 3828, 3829, 3830, 3831, + 3834, 3837, 3839, 3845, 3852, 3854, 3855, 3849, 3857, 3841, + 3850, 3859, 3864, 3860, 3871, 3867, 3869, 3870, 7350, 3875, + 3872, 3876, 3877, 3879, 3881, 3890, 3884, 3883, 7350, 3887, + 3891, 3894, 3896, 3901, 3903, 3904, 3905, 3907, 3910, 3913, + 3911, 3912, 3915, 3920, 7350, 3914, 3921, 3928, 3924, 3929, + 3931, 3935, 3939, 3930, 3944, 7350, 3940, 3946, 3954, 3952, - 3947, 3946, 3954, 3950, 3952, 3953, 3956, 7110, 3968, 3963, - 3969, 3971, 3974, 3975, 3982, 3978, 3979, 3980, 3989, 3981, - 3991, 3983, 3986, 3993, 3996, 3997, 7110, 7110, 4005, 3998, - 4000, 7110, 4002, 4006, 4016, 4012, 4014, 4015, 4018, 4019, - 4020, 4021, 4024, 4022, 4030, 7110, 4037, 4034, 4038, 4035, - 4042, 4050, 4041, 7110, 4040, 4051, 4053, 4056, 4054, 4057, - 4058, 4060, 4062, 4064, 4066, 4067, 4068, 4070, 4080, 4081, - 4073, 4077, 4082, 7110, 4083, 4084, 4090, 4088, 4089, 4091, - 4096, 7110, 4097, 4100, 4098, 4101, 4105, 4109, 4115, 4112, - 4118, 4120, 4121, 4124, 4122, 4125, 4126, 4129, 4136, 4132, + 3949, 3956, 3957, 3953, 3959, 3962, 3964, 3963, 3965, 3966, + 3967, 3969, 3971, 3974, 3972, 3985, 3986, 3978, 3988, 3995, + 3977, 7350, 3994, 3999, 4000, 4001, 4002, 4003, 4007, 4008, + 4012, 4014, 4004, 4016, 4025, 4006, 4020, 4028, 4030, 4031, + 4038, 4033, 7350, 4040, 4037, 4045, 4042, 4043, 4044, 4047, + 4052, 4046, 4053, 4057, 4059, 4054, 4062, 4063, 4060, 4071, + 4070, 4072, 4073, 4077, 4078, 4087, 4079, 4080, 4082, 4083, + 7350, 4102, 4090, 4092, 4103, 4097, 4094, 4112, 4110, 4111, + 4113, 4115, 4116, 4117, 4120, 4121, 4122, 4125, 4126, 7350, + 7350, 4128, 4129, 4130, 7350, 4132, 4135, 4144, 4133, 4137, - 4133, 4134, 4131, 4138, 4151, 4153, 7110, 4147, 4154, 4140, - 4158, 4162, 7110, 4167, 4174, 4175, 7110, 4177, 4155, 4159, - 4172, 4182, 7110, 4178, 4179, 4180, 4185, 4187, 4194, 4189, - 4197, 4196, 4198, 4193, 4199, 4202, 7110, 4203, 4200, 4201, - 7110, 4205, 4209, 4221, 4223, 4207, 4224, 4225, 4228, 4226, - 4229, 7110, 4230, 7110, 4234, 4236, 4239, 7110, 4241, 4242, - 4244, 4246, 4243, 4250, 4251, 4257, 4259, 4247, 4261, 4262, - 4263, 4264, 4266, 4275, 4265, 4272, 4273, 4274, 7110, 4277, - 4276, 4284, 4286, 4279, 4296, 4292, 4290, 4285, 4298, 4287, - 7110, 7110, 4305, 7110, 4307, 4308, 4309, 4311, 7110, 4313, + 4136, 4148, 4145, 4149, 4151, 4159, 4155, 4160, 4163, 4157, + 4169, 7350, 4171, 4167, 4176, 4173, 4175, 4180, 4177, 7350, + 4178, 4190, 4187, 4189, 4191, 4188, 4192, 4195, 4196, 4198, + 4201, 4202, 4205, 4206, 4215, 4217, 4208, 4218, 4219, 7350, + 4216, 4213, 4221, 4225, 4222, 4229, 4227, 7350, 4230, 4234, + 4240, 4237, 4244, 4251, 4245, 4252, 4247, 4260, 4255, 4257, + 4261, 4262, 4264, 4265, 4266, 4274, 4269, 4273, 4270, 4277, + 4279, 4281, 4289, 7350, 4283, 4291, 4294, 4295, 4297, 7350, + 4299, 4309, 4310, 7350, 4311, 4301, 4312, 4306, 4319, 7350, + 4316, 4320, 4321, 4322, 4315, 4331, 4326, 4335, 4337, 4330, - 4312, 4320, 4315, 4316, 4319, 4318, 4323, 4329, 7110, 4331, - 4333, 7110, 4335, 4338, 4345, 4340, 4341, 4342, 4343, 4346, - 4350, 4349, 4353, 4355, 4356, 4357, 4352, 4366, 4361, 4374, - 4360, 4379, 7110, 4362, 4372, 4377, 4387, 4384, 4380, 4388, - 4392, 4390, 7110, 4394, 4401, 4393, 4404, 4405, 7110, 4406, - 7110, 4396, 4407, 4408, 4417, 4413, 4424, 7110, 4421, 4422, - 4426, 4427, 4428, 4429, 4430, 4434, 4437, 4438, 4440, 4447, - 4443, 4444, 4442, 4451, 4458, 7110, 4446, 4449, 4452, 4462, - 4467, 4459, 4469, 4471, 4478, 4474, 4473, 4476, 4477, 4481, - 4483, 4486, 4488, 4490, 4492, 4482, 7110, 4498, 4496, 4501, + 4332, 4334, 4338, 7350, 4341, 4342, 4346, 7350, 4344, 4354, + 4355, 4359, 4363, 4345, 4366, 4364, 4367, 4368, 4369, 7350, + 4371, 4380, 7350, 4381, 4373, 4382, 7350, 4375, 4377, 4386, + 4393, 4388, 4390, 4394, 4398, 4403, 4396, 4400, 4404, 4405, + 4406, 4407, 4414, 4411, 4417, 4413, 4418, 7350, 4427, 4415, + 4421, 4425, 4420, 4435, 4437, 4438, 4423, 4442, 4441, 7350, + 7350, 4449, 7350, 4452, 4443, 4445, 4451, 7350, 4453, 4456, + 4463, 4458, 4464, 4460, 4466, 4469, 4472, 4473, 7350, 4477, + 4478, 7350, 4474, 4482, 4489, 4484, 4485, 4486, 4490, 4493, + 4495, 4491, 4499, 4501, 4500, 4502, 4503, 4507, 4505, 4523, - 4504, 4512, 4507, 4509, 4510, 7110, 4514, 4515, 4516, 7110, - 4517, 4513, 4523, 4528, 4524, 4529, 4531, 4534, 4535, 4537, - 4538, 4536, 7110, 4540, 4543, 4539, 4556, 4557, 4545, 4546, - 7110, 7110, 4563, 7110, 4565, 4544, 4558, 4548, 4568, 4570, - 4575, 4572, 4577, 4578, 4580, 4583, 4584, 4585, 7110, 4586, - 4594, 4590, 4601, 4597, 4608, 4603, 4607, 4604, 7110, 7110, - 4610, 4613, 4611, 4617, 4618, 4621, 4622, 4629, 4625, 4626, - 4632, 4636, 4643, 7110, 4634, 4635, 4642, 4644, 7110, 4645, - 4647, 4648, 4650, 4649, 4651, 4656, 4653, 4657, 4658, 4660, - 4663, 4661, 4674, 4666, 4668, 4675, 4677, 4678, 4681, 4682, + 4509, 4524, 7350, 4518, 4519, 4521, 4535, 4528, 4525, 4536, + 4544, 4531, 7350, 4547, 4548, 4537, 4553, 4554, 7350, 4556, + 7350, 4541, 4557, 4560, 4562, 4563, 4567, 4574, 4569, 7350, + 4571, 4570, 4576, 4577, 4578, 4579, 7350, 4580, 4586, 4588, + 4590, 4592, 4599, 4595, 4594, 4597, 4602, 4605, 7350, 4598, + 4604, 4610, 4615, 4619, 4616, 4611, 4621, 4629, 4625, 4631, + 4624, 4628, 4635, 4637, 4638, 4645, 4643, 4648, 4632, 7350, + 4647, 4654, 4655, 4640, 4665, 4656, 4658, 4660, 7350, 4662, + 4669, 4671, 4673, 7350, 4670, 4674, 4677, 4680, 4684, 4685, + 4687, 4688, 4689, 4692, 4693, 4690, 7350, 4697, 4698, 4691, - 4683, 4688, 7110, 4690, 4685, 4691, 4692, 4696, 4699, 4702, - 4703, 4700, 4705, 4713, 7110, 4714, 7110, 4709, 4706, 4725, - 4715, 4708, 4733, 4730, 4734, 4727, 4718, 4736, 4738, 4743, - 4746, 4739, 4748, 4749, 4752, 4753, 4754, 7110, 4757, 4759, - 4761, 4763, 4769, 4771, 4773, 7110, 4774, 4765, 4776, 4777, - 4781, 4783, 4784, 4787, 4788, 4791, 4792, 4793, 4795, 4800, - 4797, 4801, 4802, 4804, 4805, 7110, 4808, 4815, 4809, 4817, - 4812, 4820, 4821, 4823, 4831, 4834, 4822, 4829, 4835, 7110, - 4836, 4838, 4840, 4848, 7110, 4843, 4845, 4846, 4849, 4850, - 4853, 4855, 4856, 4858, 4862, 7110, 4866, 4859, 4868, 4867, + 4696, 4707, 4713, 4699, 7350, 7350, 4715, 7350, 4718, 4700, + 4716, 4719, 4720, 4726, 4728, 4729, 4733, 4725, 4730, 4736, + 4739, 4741, 7350, 4742, 4752, 4747, 4756, 4757, 4759, 4760, + 7350, 4758, 4748, 7350, 7350, 4765, 4770, 4767, 4773, 4774, + 4777, 4762, 7350, 4784, 4781, 4782, 4788, 4790, 4797, 7350, + 4794, 4779, 4800, 4792, 7350, 4793, 4801, 4802, 4805, 4803, + 4809, 4807, 4810, 4811, 4813, 4815, 4817, 4819, 4824, 4822, + 4826, 4828, 4831, 4832, 4833, 4836, 4837, 4842, 7350, 4839, + 4844, 4845, 4848, 4850, 4853, 4856, 4857, 4854, 4858, 4865, + 4868, 7350, 4861, 7350, 4869, 4860, 4880, 4870, 4871, 4884, - 4870, 4871, 4872, 4876, 4882, 4884, 4878, 4891, 7110, 4892, - 4885, 4890, 4896, 4898, 4899, 4900, 4903, 4904, 7110, 4905, - 4913, 4914, 4907, 4926, 4931, 4906, 4917, 4934, 4924, 4933, - 4915, 4935, 4936, 4937, 4941, 4942, 4943, 4944, 4945, 4955, - 4960, 4958, 7110, 4946, 7110, 4947, 4956, 4963, 4974, 4969, - 4971, 4972, 4976, 4975, 7110, 4961, 4982, 4984, 4979, 4987, - 7110, 4988, 4985, 4989, 4990, 7110, 5003, 4986, 4992, 4993, - 5008, 5009, 7110, 5014, 5015, 5011, 5023, 5025, 5020, 5022, - 5024, 5026, 5028, 5030, 5031, 5032, 5041, 5034, 5037, 7110, - 5039, 5046, 5052, 5053, 5054, 5036, 5047, 5055, 5057, 5063, + 4885, 4889, 4881, 4887, 4888, 4893, 4895, 4898, 4899, 4904, + 4900, 4905, 4908, 4909, 7350, 4917, 4918, 4907, 4923, 4925, + 4927, 4929, 4930, 7350, 4931, 4912, 4933, 4938, 4940, 4942, + 4943, 4945, 4946, 4948, 4951, 4949, 4956, 4958, 4959, 4952, + 4967, 4960, 4970, 4965, 4963, 7350, 4971, 4975, 4972, 4981, + 4978, 4983, 4984, 4986, 4992, 4995, 4985, 4987, 4997, 7350, + 4998, 5000, 5006, 5007, 7350, 5003, 5009, 5010, 5011, 5012, + 5015, 5017, 5020, 5022, 5027, 7350, 5030, 5018, 5032, 5021, + 5031, 5034, 5040, 5041, 5043, 5045, 5046, 5050, 7350, 5057, + 5047, 5056, 5058, 5060, 5062, 5064, 5069, 5066, 5071, 5072, - 5060, 7110, 5064, 5065, 5066, 5067, 5068, 5070, 5071, 5072, - 5084, 5083, 5079, 5076, 5081, 5088, 5090, 5092, 5097, 7110, - 5093, 5098, 5099, 5108, 5109, 5110, 5115, 7110, 5111, 7110, - 5112, 5116, 5121, 5124, 5128, 7110, 5131, 5132, 5119, 5136, - 7110, 7110, 5138, 5139, 5140, 5144, 5141, 7110, 7110, 5147, - 7110, 5148, 7110, 5149, 5151, 7110, 7110, 5101, 5153, 5154, - 5155, 5156, 5158, 7110, 5165, 7110, 5168, 5169, 5170, 5172, - 5159, 5173, 7110, 5174, 5177, 5182, 5183, 5185, 7110, 5176, - 5187, 5191, 5204, 5190, 5186, 7110, 5200, 5202, 5203, 5206, - 7110, 5209, 5212, 5213, 5207, 5214, 5215, 5216, 5123, 5217, + 7350, 5073, 5074, 5080, 5081, 5088, 5089, 5084, 5086, 5097, + 5094, 5095, 5092, 5093, 5104, 5102, 5103, 5109, 5110, 5111, + 5113, 5114, 5121, 5124, 7350, 5116, 7350, 5123, 5125, 5129, + 5132, 5137, 5131, 5141, 5139, 5133, 7350, 5135, 5145, 5148, + 5149, 5150, 7350, 5154, 5152, 5156, 5157, 7350, 5160, 5162, + 5158, 5165, 5173, 5174, 7350, 5180, 5181, 5182, 5176, 5189, + 5185, 5191, 5186, 5192, 5195, 5188, 5196, 5197, 5205, 5203, + 5201, 7350, 5204, 5209, 5211, 5213, 5214, 5216, 5220, 5221, + 5222, 5224, 5227, 7350, 5228, 5230, 5231, 5232, 5234, 5235, + 5236, 5237, 5244, 5243, 5245, 5253, 5247, 5255, 5257, 5258, - 5219, 5220, 5229, 5226, 5227, 5230, 5237, 5239, 5241, 5243, - 5244, 5245, 5248, 5249, 5251, 5254, 5257, 5258, 5259, 5260, - 5261, 5265, 5267, 5264, 5273, 5275, 5268, 5277, 5284, 5285, - 5286, 5270, 5288, 5287, 5289, 5295, 5291, 5302, 5297, 5299, - 5303, 5304, 5306, 5305, 5308, 5312, 5313, 5317, 5315, 5318, - 7110, 5311, 5321, 5322, 5331, 5325, 5332, 5335, 5342, 5347, - 5348, 7110, 5350, 7110, 5352, 5336, 5344, 5338, 5356, 7110, - 5358, 5359, 5360, 5361, 5363, 5364, 5365, 5366, 5362, 5369, - 5373, 7110, 5375, 5389, 5376, 5370, 5385, 5396, 7110, 5391, - 5398, 5383, 5393, 5399, 5402, 5403, 5404, 5405, 5408, 5406, + 5259, 5261, 7350, 5266, 5267, 5264, 5268, 5277, 5273, 5270, + 7350, 5275, 7350, 5279, 5282, 5285, 5287, 5288, 7350, 5291, + 5292, 5295, 5297, 5299, 7350, 7350, 5301, 5308, 5303, 5310, + 5304, 7350, 7350, 5312, 7350, 5306, 7350, 5314, 5316, 7350, + 7350, 5317, 5318, 5319, 5320, 7350, 5321, 5325, 5334, 7350, + 5336, 7350, 5345, 5327, 5342, 5338, 5329, 5348, 7350, 5331, + 5346, 5340, 5355, 5357, 7350, 5358, 5359, 5360, 5369, 5361, + 5362, 7350, 5365, 5370, 5371, 5372, 5375, 7350, 5380, 5383, + 5384, 5376, 5378, 5385, 5395, 5386, 5396, 5397, 5401, 5399, + 5402, 5403, 5407, 5406, 5409, 5415, 5417, 5419, 5408, 5425, - 5407, 5413, 5416, 5410, 5419, 5420, 7110, 5428, 5432, 5435, - 5421, 5433, 5434, 5436, 5438, 5440, 5442, 5443, 5444, 5446, - 5447, 5448, 5454, 5460, 5457, 5465, 5470, 7110, 5453, 7110, - 5471, 5473, 5474, 5461, 5477, 5478, 5475, 5479, 7110, 7110, - 5476, 5484, 5485, 5490, 5491, 5487, 5494, 5497, 5499, 5500, - 7110, 5501, 5503, 5507, 5511, 5510, 5512, 7110, 5517, 5519, - 5520, 5522, 7110, 5523, 5524, 5526, 5527, 5537, 5529, 5542, - 5538, 5544, 5531, 5534, 5545, 5550, 7110, 7110, 7110, 7110, - 5551, 5554, 5556, 5557, 5558, 5559, 5560, 5564, 5566, 5562, - 5563, 5567, 7110, 5578, 7110, 7110, 5574, 7110, 5580, 5581, + 5421, 5426, 5428, 5432, 5434, 5430, 5436, 5437, 5438, 5440, + 5441, 5444, 5445, 5447, 5451, 5448, 5453, 5454, 5455, 5460, + 5463, 5465, 5467, 5468, 5474, 5469, 5476, 5471, 5479, 5477, + 5480, 5481, 5484, 5489, 5482, 5485, 5492, 5493, 5496, 7350, + 5498, 5500, 5502, 5507, 5503, 5509, 5513, 5520, 5524, 5526, + 7350, 5528, 7350, 5530, 5515, 5521, 5534, 5535, 7350, 5536, + 5537, 5538, 5539, 5540, 5541, 5542, 5543, 5546, 5547, 5551, + 7350, 5554, 5567, 5548, 5557, 5568, 5570, 7350, 5571, 5573, + 5574, 5575, 5576, 5505, 5581, 5582, 5583, 5586, 5578, 5584, + 5591, 5590, 5604, 5585, 5595, 5606, 7350, 5608, 5610, 5617, - 5584, 5586, 5568, 5588, 5590, 7110, 5591, 7110, 5596, 5599, - 5592, 5603, 5609, 5600, 5593, 5611, 5613, 5614, 5615, 5616, - 5623, 5621, 5624, 5622, 5627, 5629, 5631, 7110, 7110, 5635, - 5639, 5640, 5642, 5644, 5645, 5646, 5653, 5651, 5652, 5654, - 5656, 5658, 5659, 5667, 5668, 5664, 5665, 5673, 7110, 5674, - 5670, 5676, 7110, 5678, 7110, 5682, 5683, 5684, 5685, 5686, - 5691, 5692, 5693, 5695, 5697, 7110, 7110, 5696, 5711, 5706, - 7110, 7110, 5698, 5707, 5708, 5710, 5716, 5713, 5718, 7110, - 5721, 5722, 5723, 5719, 5725, 5733, 5726, 7110, 5735, 7110, - 5736, 5738, 5744, 5739, 5747, 5752, 5748, 5755, 5754, 5751, + 5614, 5615, 5616, 5599, 5620, 5619, 5622, 5623, 5625, 5626, + 5627, 5628, 5629, 5630, 5640, 5637, 5648, 5652, 7350, 5641, + 7350, 5644, 5647, 5655, 5654, 5656, 5657, 5658, 5659, 5662, + 7350, 7350, 5664, 5665, 5668, 5670, 5672, 5673, 5676, 5678, + 5680, 5682, 7350, 5685, 5688, 5690, 5693, 5699, 5692, 7350, + 5694, 5701, 5704, 5702, 5706, 5708, 7350, 5712, 5711, 5713, + 5714, 5719, 5716, 5728, 5725, 5722, 5729, 5732, 5733, 5737, + 7350, 5734, 7350, 7350, 7350, 5738, 5740, 5741, 5743, 5746, + 5747, 5748, 5756, 5757, 5758, 5751, 5752, 5754, 7350, 5771, + 7350, 7350, 5768, 7350, 5774, 5762, 5775, 5777, 5764, 5778, - 5757, 5758, 7110, 5760, 5761, 7110, 5768, 5767, 5771, 5765, - 5772, 5777, 5773, 7110, 5778, 5780, 5785, 5790, 7110, 5792, - 5793, 5794, 5787, 7110, 5801, 7110, 5795, 5802, 5804, 5809, - 5805, 7110, 5806, 5810, 7110, 5813, 5819, 5821, 5822, 5814, - 5823, 7110, 5829, 5824, 7110, 5830, 5832, 5833, 5838, 5839, - 5841, 5835, 5843, 5844, 5851, 5847, 5849, 7110, 7110, 5862, - 5852, 135, 5865, 5855, 5860, 5863, 5866, 5873, 5868, 5870, - 5876, 7110, 7110, 5877, 7110, 5871, 5881, 7110, 5869, 5885, - 5886, 5889, 5890, 5891, 5892, 5896, 5898, 5899, 5900, 5901, - 5902, 5908, 7110, 5920, 5923, 5905, 5926, 5927, 5929, 5931, + 5781, 7350, 5782, 7350, 5786, 5788, 5784, 5795, 5801, 5798, + 5790, 5805, 5806, 5802, 5792, 5796, 5817, 5815, 5818, 5808, + 5816, 5825, 5827, 7350, 7350, 5822, 5829, 5830, 5837, 5834, + 5838, 5832, 5847, 5840, 5845, 5842, 5848, 5849, 5852, 5859, + 5860, 5856, 5855, 5865, 7350, 5862, 5866, 5872, 7350, 5858, + 7350, 5874, 5876, 5877, 5868, 5878, 5880, 5883, 5884, 5887, + 5890, 5888, 7350, 7350, 5895, 5903, 5898, 7350, 7350, 5899, + 5900, 5901, 5905, 5907, 5902, 5908, 7350, 5910, 5914, 5911, + 5915, 5916, 5917, 5929, 5922, 7350, 5931, 7350, 5933, 5934, + 5936, 5926, 5943, 5945, 5940, 5942, 5950, 5948, 5949, 5952, - 5933, 5935, 5937, 5938, 5939, 5918, 5940, 5941, 5942, 5945, - 5947, 5948, 5949, 5951, 7110, 5958, 5963, 5952, 5960, 5965, - 5966, 5967, 7110, 5974, 5970, 5979, 5976, 7110, 5983, 5980, - 5984, 5986, 5987, 7110, 5988, 5991, 5998, 5999, 5992, 5994, - 6000, 6002, 6004, 6015, 7110, 6005, 6007, 6008, 7110, 7110, - 7110, 6020, 6022, 6019, 7110, 6027, 6023, 6010, 6028, 7110, - 6030, 6031, 6032, 7110, 7110, 7110, 6034, 6036, 6038, 7110, - 6042, 6045, 7110, 6043, 7110, 6048, 7110, 6049, 6051, 6052, - 6057, 7110, 6058, 6060, 6050, 6067, 7110, 6075, 6077, 6079, - 6061, 6065, 6072, 6081, 7110, 6088, 6084, 6087, 6094, 6080, + 5956, 7350, 5954, 5955, 7350, 5964, 5962, 5966, 5967, 5969, + 5972, 5973, 7350, 5974, 5976, 5979, 5980, 5982, 5987, 7350, + 5990, 5991, 5992, 5984, 7350, 5999, 7350, 5996, 6000, 6001, + 6008, 6006, 7350, 6004, 6009, 6010, 6011, 7350, 6015, 6020, + 6022, 6023, 6025, 6027, 7350, 6032, 6017, 7350, 6028, 6034, + 6036, 6042, 6039, 6044, 6045, 6046, 6047, 6055, 6051, 6052, + 7350, 7350, 6059, 6057, 123, 6066, 6063, 6067, 6068, 6069, + 6076, 6071, 6073, 6079, 7350, 7350, 6080, 7350, 6074, 6081, + 7350, 6072, 6089, 6090, 6083, 6093, 6094, 6095, 6099, 6103, + 6104, 6105, 6106, 6107, 6109, 7350, 6125, 6128, 6110, 6131, - 6083, 6090, 6096, 6097, 6105, 6100, 6103, 7110, 6104, 6107, - 6109, 6116, 6110, 6106, 6113, 7110, 6118, 7110, 6120, 7110, - 6122, 6123, 6124, 6126, 6131, 6127, 6132, 6133, 6134, 6142, - 6144, 6146, 6147, 6148, 6150, 6153, 6154, 7110, 7110, 6164, - 6156, 7110, 6160, 6168, 7110, 6157, 7110, 6172, 7110, 6159, - 6161, 6176, 6169, 6179, 7110, 7110, 6183, 6180, 6186, 6193, - 6188, 6190, 6191, 7110, 6196, 6192, 6194, 6199, 7110, 6207, - 7110, 6202, 6209, 6212, 7110, 6204, 6215, 6219, 6205, 6208, - 6224, 6216, 6221, 6225, 6235, 6231, 6232, 6233, 6237, 6234, - 6238, 6239, 6246, 7110, 7110, 7110, 6240, 6248, 6257, 6255, + 6132, 6134, 6136, 6138, 6140, 6142, 6143, 6144, 6121, 6114, + 6145, 6146, 6149, 6150, 6152, 6153, 6154, 6156, 7350, 6163, + 6166, 6157, 6167, 6170, 6171, 6175, 6172, 7350, 6179, 6181, + 6184, 6186, 7350, 6193, 6185, 6187, 6198, 6195, 6199, 7350, + 6189, 6201, 6203, 6205, 6206, 6210, 6211, 6212, 6213, 6220, + 7350, 6217, 6216, 6224, 7350, 6221, 7350, 7350, 7350, 6218, + 6232, 6226, 7350, 6235, 6237, 6238, 6239, 7350, 6242, 6244, + 6245, 6252, 6247, 7350, 7350, 7350, 6248, 6250, 6249, 7350, + 6256, 6266, 7350, 6253, 7350, 6261, 7350, 6262, 6264, 6270, + 6268, 7350, 6274, 6272, 6275, 6280, 7350, 6287, 6291, 6293, - 6256, 6264, 6260, 7110, 6261, 6263, 6265, 6267, 6275, 6271, - 6273, 7110, 6279, 6274, 6276, 6277, 6281, 6283, 6282, 6284, - 7110, 6295, 6297, 6300, 6303, 6304, 6305, 6307, 6312, 6314, - 6316, 6309, 6317, 6325, 6321, 7110, 7110, 6324, 6320, 7110, - 6328, 6330, 7110, 6331, 7110, 6332, 6333, 6334, 6335, 6337, - 7110, 6340, 6341, 6342, 6344, 7110, 6345, 6347, 6349, 6352, - 7110, 6346, 6366, 6359, 6362, 6363, 7110, 7110, 6369, 6371, - 7110, 6373, 6375, 6374, 6382, 6377, 6378, 6384, 6387, 7110, - 6391, 6393, 6385, 6394, 6396, 6397, 6400, 7110, 6399, 6402, - 6403, 6404, 7110, 6408, 6411, 6412, 6410, 6413, 7110, 6415, + 6288, 6278, 6283, 6294, 7350, 6301, 6300, 6303, 6307, 6296, + 6304, 6309, 6310, 6311, 6318, 6313, 6320, 7350, 6317, 6322, + 6323, 6324, 6326, 6331, 6332, 7350, 6333, 7350, 6335, 7350, + 6336, 6337, 6339, 6340, 6342, 6341, 6343, 6348, 6354, 6355, + 6358, 6360, 6363, 6364, 6365, 6367, 6369, 6370, 7350, 7350, + 6377, 6373, 7350, 6374, 6384, 6386, 7350, 6379, 7350, 6393, + 7350, 6381, 6388, 7350, 6390, 6394, 6396, 7350, 7350, 6399, + 6402, 6403, 6411, 6406, 6408, 6409, 7350, 6413, 6416, 6415, + 6417, 6419, 7350, 6426, 7350, 6421, 6431, 6427, 7350, 7350, + 6423, 6424, 6437, 6439, 6433, 6440, 6443, 6444, 6447, 6446, - 6416, 6425, 6417, 7110, 6428, 6432, 6433, 7110, 7110, 7110, - 6438, 6440, 6441, 7110, 7110, 7110, 7110, 6443, 6444, 6434, - 6451, 7110, 6447, 7110, 7110, 6455, 6459, 6463, 6465, 6469, - 6468, 7110, 6470, 6471, 6474, 6458, 6477, 7110, 7110, 6478, - 6481, 6482, 6483, 6485, 6486, 7110, 7110, 6487, 6489, 6490, - 6495, 6492, 7110, 6493, 6498, 6500, 6505, 6508, 6516, 6518, - 6510, 6519, 6520, 6527, 6528, 6513, 6530, 6523, 6531, 6534, - 6533, 6541, 6543, 6542, 6547, 6550, 6551, 6553, 7110, 7110, - 6555, 7110, 6557, 6559, 7110, 6560, 7110, 6562, 6564, 6570, - 6572, 7110, 6574, 6576, 6580, 6582, 6565, 7110, 6577, 6584, + 6457, 6449, 6452, 6453, 6459, 6454, 6467, 6471, 6475, 7350, + 7350, 7350, 6465, 6461, 6478, 6480, 6482, 6489, 6484, 7350, + 6486, 6488, 6490, 6492, 6499, 6496, 6498, 7350, 6494, 6500, + 6501, 6503, 6505, 6508, 6507, 6510, 7350, 6521, 6525, 6529, + 6512, 6522, 6530, 6532, 6534, 6538, 6539, 6541, 6542, 6543, + 6515, 6544, 7350, 7350, 6546, 6547, 7350, 6551, 6553, 7350, + 7350, 6554, 7350, 6556, 6557, 6558, 6559, 6560, 7350, 6565, + 6562, 6566, 6568, 7350, 6567, 6571, 6575, 6584, 6572, 7350, + 6586, 6595, 6570, 6591, 6592, 6593, 7350, 7350, 6594, 6600, + 7350, 6602, 6603, 6605, 6612, 6609, 6614, 6617, 6613, 7350, - 6588, 6585, 6589, 6590, 7110, 6593, 6595, 6597, 6598, 6599, - 6603, 6604, 6607, 7110, 6602, 6609, 7110, 7110, 6600, 6616, - 6611, 6620, 6622, 7110, 6623, 6630, 6625, 6627, 6628, 6631, - 6629, 7110, 6635, 6633, 7110, 7110, 6634, 6636, 7110, 7110, - 6643, 6644, 7110, 7110, 7110, 7110, 7110, 7110, 7110, 7110, - 6648, 6652, 7110, 7110, 6646, 6657, 6661, 7110, 6663, 7110, - 6650, 6658, 6666, 6654, 7110, 6665, 7110, 6668, 6671, 6672, - 6285, 6675, 6680, 6676, 6678, 6683, 6684, 6685, 6687, 6686, - 6692, 6688, 6694, 6698, 6699, 6706, 6696, 6707, 7110, 7110, - 7110, 6708, 6709, 6714, 6711, 6724, 6725, 6728, 6731, 6717, + 6607, 6620, 6623, 6624, 6626, 6627, 6628, 7350, 6629, 6630, + 6632, 6633, 7350, 6636, 6635, 6638, 6640, 6641, 7350, 6642, + 6645, 6663, 6659, 7350, 6648, 6666, 6658, 7350, 7350, 7350, + 6673, 6675, 6676, 7350, 7350, 7350, 6662, 7350, 6679, 6681, + 6670, 6683, 7350, 6684, 7350, 7350, 6688, 6693, 6697, 6701, + 6705, 6692, 7350, 6704, 6698, 6711, 6667, 6706, 7350, 7350, + 6713, 6714, 6708, 6716, 6717, 6719, 6721, 6723, 7350, 7350, + 6724, 6725, 6726, 6729, 6727, 7350, 6733, 6735, 6745, 6737, + 6747, 6753, 6755, 6741, 6757, 6758, 6765, 6766, 6750, 6761, + 6763, 6768, 6769, 6771, 6778, 6785, 6780, 6782, 6788, 6783, - 6719, 6732, 6733, 6737, 6721, 6734, 6747, 6740, 6743, 6745, - 6752, 6744, 6757, 6759, 7110, 6761, 6748, 6753, 6766, 7110, - 6762, 7110, 6767, 7110, 7110, 6769, 6770, 6773, 6774, 6782, - 6784, 6775, 6779, 6780, 6783, 6787, 7110, 6791, 7110, 7110, - 7110, 6794, 6796, 7110, 6795, 6797, 7110, 6798, 6800, 6802, - 6804, 6806, 6803, 6807, 6808, 6811, 7110, 7110, 6814, 6820, - 6823, 6825, 6826, 6833, 6828, 6830, 6832, 6836, 6839, 6846, - 7110, 6844, 6845, 6848, 7110, 6849, 6851, 6852, 6854, 6855, - 6862, 6857, 6864, 7110, 6860, 7110, 6866, 6863, 6878, 6867, - 6868, 6869, 6879, 6884, 6881, 7110, 6871, 6890, 6885, 6892, + 6789, 7350, 7350, 6792, 6793, 7350, 6796, 6797, 7350, 6799, + 7350, 6801, 6803, 6805, 6809, 7350, 6811, 6813, 6815, 6819, + 6816, 7350, 6820, 6822, 7350, 6824, 6825, 6826, 6827, 7350, + 6828, 6831, 6832, 6836, 6833, 6837, 6840, 6844, 6854, 7350, + 6841, 6858, 7350, 7350, 6846, 6731, 6839, 6859, 6849, 7350, + 6863, 6861, 6862, 6868, 6869, 6871, 6870, 7350, 6872, 6874, + 7350, 7350, 6875, 6877, 7350, 6880, 7350, 6882, 6884, 7350, + 7350, 7350, 7350, 7350, 7350, 7350, 7350, 6885, 6891, 7350, + 7350, 6887, 6896, 6898, 6902, 7350, 6906, 7350, 6893, 6903, + 6907, 6899, 7350, 6909, 7350, 6910, 6913, 6915, 6925, 6914, + + 6917, 6921, 6922, 6926, 6930, 6928, 6932, 6931, 6936, 6937, + 6935, 6938, 6949, 6939, 6952, 6943, 6955, 7350, 7350, 7350, + 7350, 6945, 6957, 6962, 6964, 6966, 6967, 6970, 6972, 6974, + 6975, 6976, 6978, 6980, 6981, 6982, 6990, 6986, 6987, 6989, + 6992, 6988, 7002, 7004, 7010, 7350, 7012, 6998, 6996, 7017, + 7350, 7005, 7350, 7007, 7350, 7350, 7019, 7021, 7023, 7014, + 7030, 7032, 7027, 7029, 7028, 7034, 7036, 7350, 7038, 7350, + 7350, 7350, 7350, 7040, 7043, 7350, 7044, 7045, 7350, 7046, + 7048, 7050, 7051, 7052, 7054, 7055, 7057, 7068, 7350, 7350, + 7056, 7059, 7070, 7072, 7074, 7081, 7082, 7080, 7086, 7087, + + 7078, 7090, 7350, 7094, 7095, 7099, 7350, 7101, 7088, 7096, + 7102, 7104, 7112, 7108, 7109, 7350, 7110, 7350, 7114, 7116, + 7115, 7117, 7118, 7119, 7129, 7126, 7133, 7350, 7124, 7134, + 7138, 7139, 7141, 7143, 7144, 7145, 7153, 7149, 7156, 7160, + 7155, 7161, 7147, 7165, 7163, 7350, 7172, 7167, 7350, 7169, + 7173, 7175, 7176, 7179, 7350, 7184, 7177, 7181, 7187, 7190, + 7185, 7350, 7198, 7202, 7199, 7350, 7203, 7350, 7350, 7204, + 7191, 7193, 7214, 7216, 7350, 7350, 7350, 7230, 7237, 7244, + 7251, 7258, 7265, 7272, 88, 7279, 7286, 7293, 7300, 7307, + 7314, 7321, 7328, 7335, 7342 - 6895, 6898, 6899, 6888, 6901, 6905, 6909, 6913, 6908, 6914, - 6916, 6917, 6918, 7110, 6920, 6923, 7110, 6924, 6925, 6926, - 6927, 6931, 7110, 6934, 6928, 6936, 6938, 6941, 6943, 7110, - 6949, 6952, 6953, 7110, 6954, 7110, 7110, 6956, 6944, 6957, - 6965, 6967, 7110, 7110, 7110, 6990, 6997, 7004, 7011, 7018, - 7025, 7032, 88, 7039, 7046, 7053, 7060, 7067, 7074, 7081, - 7088, 7095, 7102 } ; -static yyconst flex_int16_t yy_def[3664] = +static yyconst flex_int16_t yy_def[3796] = { 0, - 3645, 1, 3646, 3646, 3647, 3647, 3648, 3648, 3649, 3649, - 3650, 3650, 3651, 3651, 3652, 3652, 3645, 3653, 3645, 3645, - 3645, 3645, 3654, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3655, 3645, 3645, 3645, - 3655, 3656, 3645, 3645, 3645, 3656, 3657, 3645, 3645, 3645, - 3645, 3657, 3658, 3645, 3645, 3645, 3658, 3659, 3645, 3660, - 3645, 3659, 3659, 3661, 3645, 3645, 3645, 3645, 3661, 3662, - 3645, 3645, 3645, 3662, 3653, 3653, 3645, 3663, 3654, 3663, - 3654, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3777, 1, 3778, 3778, 3779, 3779, 3780, 3780, 3781, 3781, + 3782, 3782, 3783, 3783, 3784, 3784, 3777, 3785, 3777, 3777, + 3777, 3777, 3786, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3787, 3777, 3777, 3777, + 3787, 3788, 3777, 3777, 3777, 3788, 3789, 3777, 3777, 3777, + 3777, 3789, 3790, 3777, 3777, 3777, 3790, 3791, 3777, 3792, + 3777, 3791, 3791, 3793, 3777, 3777, 3777, 3777, 3793, 3794, + 3777, 3777, 3777, 3794, 3785, 3785, 3777, 3795, 3786, 3795, + 3786, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3655, - 3655, 3656, 3656, 3657, 3657, 3645, 3658, 3658, 3659, 3659, - 3660, 3660, 3659, 3661, 3661, 3645, 3662, 3662, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3787, 3787, 3788, 3788, 3789, 3789, 3777, 3790, 3790, 3791, + 3791, 3792, 3792, 3791, 3793, 3793, 3777, 3794, 3794, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3659, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3791, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3659, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3659, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3659, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645, - 3645, 3653, 3645, 3645, 3653, 3653, 3645, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3777, 3777, 3785, 3785, 3777, 3777, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3659, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3645, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3645, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, - 3653, 3653, 3659, 3659, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3791, 3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3659, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3791, 3785, 3785, 3785, 3785, 3785, 3785, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3659, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3791, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3777, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3653, 3659, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3777, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3645, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3659, 3653, 3645, 3653, 3653, 3653, - 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3645, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3645, 3645, 3653, 3645, 3653, 3653, 3653, 3653, 3645, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, + 3785, 3791, 3785, 3777, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3777, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3645, 3645, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3659, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3777, 3777, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3791, 3785, 3785, 3785, 3785, + 3777, 3785, 3785, 3777, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3659, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3645, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3645, 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, - 3645, 3653, 3645, 3653, 3653, 3645, 3645, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3791, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3659, 3653, 3653, 3653, 3653, - 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3777, 3777, 3785, 3785, 3785, 3785, + 3785, 3777, 3777, 3785, 3777, 3785, 3777, 3785, 3785, 3777, + 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3777, + 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3645, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3645, 3645, 3653, 3645, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3791, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3659, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653, 3653, - 3645, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3777, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3777, 3785, 3777, 3777, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3777, 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3645, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3645, 3653, - 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, - 3653, 3659, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3645, 3653, 3645, 3653, 3653, 3645, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3791, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3777, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3777, 3785, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3777, 3785, 3785, 3785, 3777, 3777, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3645, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3645, 3645, - 3645, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3645, 3645, 3645, 3653, 3653, 3653, 3645, - 3653, 3653, 3645, 3653, 3645, 3653, 3645, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, + 3785, 3777, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3777, 3777, 3785, 3785, 3791, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3777, 3777, 3785, 3777, 3785, 3785, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, - 3653, 3645, 3653, 3653, 3645, 3653, 3645, 3653, 3645, 3653, - 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3645, 3653, - 3645, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3645, 3645, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3777, 3785, 3785, 3785, 3777, 3785, 3777, 3777, 3777, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3777, 3777, 3777, 3785, 3785, 3785, 3777, + 3785, 3785, 3777, 3785, 3777, 3785, 3777, 3785, 3785, 3785, + 3785, 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653, 3645, - 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3645, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, - 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653, - 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3653, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3777, + 3785, 3785, 3777, 3785, 3785, 3785, 3777, 3785, 3777, 3785, + 3777, 3785, 3785, 3777, 3785, 3785, 3785, 3777, 3777, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3777, 3785, 3785, 3785, 3777, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3645, 3645, 3645, - 3653, 3653, 3653, 3645, 3645, 3645, 3645, 3653, 3653, 3653, - 3653, 3645, 3653, 3645, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, - 3653, 3645, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3777, 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3777, 3785, 3785, 3777, 3785, 3785, 3777, + 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3777, 3785, 3785, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, - 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3645, 3645, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3645, 3653, 3653, 3645, 3645, 3653, 3653, 3645, 3645, - 3653, 3653, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, - 3653, 3653, 3645, 3645, 3653, 3653, 3653, 3645, 3653, 3645, - 3653, 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, - 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3777, 3777, 3777, + 3785, 3785, 3785, 3777, 3777, 3777, 3785, 3777, 3785, 3785, + 3785, 3785, 3777, 3785, 3777, 3777, 3785, 3785, 3785, 3785, + 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, 3777, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3777, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3645, - 3653, 3645, 3653, 3645, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3645, 3645, - 3645, 3653, 3653, 3645, 3653, 3653, 3645, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3645, 3645, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3645, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3645, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3653, 3653, 3645, 3653, 3653, 3653, 3653, + 3785, 3777, 3777, 3785, 3785, 3777, 3785, 3785, 3777, 3785, + 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, + 3785, 3777, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3777, 3777, 3785, 3785, 3785, 3785, 3785, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3777, 3777, 3785, 3785, 3777, 3785, 3777, 3785, 3785, 3777, + 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3785, 3785, 3777, + 3777, 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3785, + 3785, 3785, 3777, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3777, 3777, + 3777, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, + 3777, 3785, 3777, 3785, 3777, 3777, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777, + 3777, 3777, 3777, 3785, 3785, 3777, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3777, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + + 3785, 3785, 3777, 3785, 3785, 3785, 3777, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, 3785, + 3785, 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3777, 3785, + 3785, 3785, 3785, 3785, 3777, 3785, 3785, 3785, 3785, 3785, + 3785, 3777, 3785, 3785, 3785, 3777, 3785, 3777, 3777, 3785, + 3785, 3785, 3785, 3785, 3777, 3777, 0, 3777, 3777, 3777, + 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, + 3777, 3777, 3777, 3777, 3777 - 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, 3653, - 3653, 3653, 3653, 3645, 3653, 3653, 3645, 3653, 3653, 3653, - 3653, 3653, 3645, 3653, 3653, 3653, 3653, 3653, 3653, 3645, - 3653, 3653, 3653, 3645, 3653, 3645, 3645, 3653, 3653, 3653, - 3653, 3653, 3645, 3645, 0, 3645, 3645, 3645, 3645, 3645, - 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, - 3645, 3645, 3645 } ; -static yyconst flex_int16_t yy_nxt[7151] = +static yyconst flex_int16_t yy_nxt[7391] = { 0, 18, 19, 20, 21, 22, 23, 22, 18, 18, 18, 18, 18, 22, 24, 25, 26, 27, 28, 29, 30, @@ -1645,788 +1689,814 @@ static yyconst flex_int16_t yy_nxt[7151] = 48, 49, 50, 48, 49, 50, 53, 54, 53, 54, 55, 51, 55, 85, 51, 85, 85, 56, 85, 56, 58, 59, 60, 61, 85, 22, 58, 59, 60, 61, - 86, 22, 62, 64, 65, 66, 86, 97, 62, 64, - 65, 66, 87, 86, 67, 119, 88, 108, 85, 86, + 86, 22, 62, 64, 65, 66, 86, 98, 62, 64, + 65, 66, 87, 86, 67, 120, 88, 109, 85, 86, 67, 19, 20, 21, 69, 70, 71, 75, 76, 77, - 78, 86, 22, 72, 121, 86, 120, 109, 86, 79, - 160, 160, 73, 19, 20, 21, 69, 70, 71, 75, - 76, 77, 78, 187, 22, 72, 81, 82, 83, 130, - 90, 79, 90, 90, 73, 90, 86, 84, 81, 82, - 83, 90, 91, 86, 86, 98, 92, 93, 170, 84, - 94, 159, 99, 86, 110, 95, 100, 162, 86, 101, - 162, 170, 86, 112, 96, 86, 167, 167, 111, 86, - 102, 113, 137, 115, 103, 173, 116, 104, 86, 105, - 106, 179, 114, 117, 170, 118, 86, 122, 86, 126, - 107, 86, 156, 127, 86, 123, 157, 184, 86, 138, - - 158, 124, 87, 139, 86, 125, 88, 128, 180, 129, - 86, 131, 86, 140, 141, 132, 142, 143, 86, 133, - 144, 86, 148, 86, 149, 134, 86, 145, 135, 86, - 152, 146, 147, 150, 86, 136, 177, 177, 183, 151, - 153, 181, 196, 189, 154, 155, 164, 86, 164, 164, - 90, 164, 90, 90, 169, 90, 169, 169, 174, 169, - 174, 174, 172, 174, 85, 86, 85, 85, 90, 85, - 90, 90, 291, 90, 86, 85, 86, 182, 86, 90, - 91, 185, 190, 188, 86, 86, 197, 86, 191, 86, - 192, 86, 86, 208, 186, 86, 86, 86, 86, 86, - - 200, 199, 193, 194, 86, 198, 86, 195, 86, 201, - 86, 202, 247, 210, 206, 203, 204, 207, 209, 86, - 211, 216, 212, 205, 86, 213, 86, 86, 86, 218, - 86, 219, 86, 221, 86, 86, 227, 222, 214, 215, - 86, 228, 226, 224, 86, 86, 217, 230, 225, 86, - 86, 220, 86, 223, 231, 233, 234, 229, 86, 86, - 86, 86, 232, 236, 86, 238, 86, 242, 235, 239, - 86, 86, 86, 86, 244, 240, 237, 178, 86, 86, - 86, 241, 86, 245, 243, 250, 253, 254, 86, 246, - 255, 249, 86, 86, 86, 256, 251, 248, 262, 259, - - 252, 263, 86, 86, 261, 265, 86, 86, 86, 86, - 260, 269, 257, 86, 266, 258, 86, 86, 264, 268, - 270, 272, 160, 160, 86, 162, 267, 271, 162, 275, - 164, 273, 164, 164, 341, 164, 167, 167, 169, 86, - 169, 169, 90, 169, 90, 90, 170, 90, 174, 274, - 174, 174, 276, 174, 172, 177, 177, 278, 86, 86, - 86, 86, 86, 86, 86, 86, 86, 277, 280, 86, - 283, 286, 282, 86, 279, 281, 86, 289, 288, 285, - 176, 292, 284, 86, 290, 287, 86, 293, 294, 86, - 295, 321, 86, 298, 86, 296, 86, 303, 299, 86, - - 305, 86, 86, 300, 86, 306, 86, 308, 86, 301, - 302, 304, 297, 309, 86, 312, 310, 86, 86, 86, - 307, 86, 314, 86, 315, 86, 86, 86, 175, 86, - 86, 86, 322, 316, 311, 323, 329, 317, 319, 86, - 318, 320, 86, 324, 313, 332, 325, 86, 326, 330, - 336, 86, 86, 333, 86, 331, 86, 334, 338, 339, - 327, 378, 328, 86, 86, 86, 342, 337, 86, 335, - 344, 86, 86, 343, 340, 345, 86, 346, 86, 86, - 347, 349, 86, 86, 86, 348, 86, 86, 351, 86, - 86, 86, 350, 86, 86, 353, 359, 86, 86, 354, - - 86, 357, 86, 86, 352, 364, 360, 358, 355, 86, - 365, 86, 86, 361, 356, 86, 362, 366, 370, 368, - 86, 367, 363, 373, 86, 86, 86, 86, 376, 86, - 86, 369, 375, 86, 379, 380, 382, 86, 371, 372, - 86, 86, 86, 86, 387, 374, 86, 385, 86, 377, - 86, 384, 381, 386, 86, 383, 389, 86, 86, 390, - 170, 86, 86, 393, 86, 86, 86, 86, 388, 86, - 412, 392, 394, 396, 398, 400, 391, 401, 86, 86, - 395, 86, 86, 86, 397, 86, 404, 402, 86, 399, - 403, 86, 86, 405, 86, 86, 86, 407, 411, 86, - - 86, 413, 406, 409, 86, 408, 86, 414, 415, 86, - 417, 86, 86, 418, 416, 86, 419, 86, 86, 410, - 421, 86, 422, 86, 86, 426, 170, 86, 428, 86, - 420, 86, 423, 424, 86, 86, 430, 429, 86, 86, - 425, 427, 86, 431, 86, 433, 86, 435, 436, 438, - 86, 434, 86, 86, 86, 86, 439, 86, 442, 86, - 432, 86, 443, 86, 86, 441, 86, 445, 86, 448, - 168, 440, 86, 437, 446, 450, 86, 453, 86, 444, - 86, 454, 447, 86, 449, 86, 86, 86, 452, 462, - 86, 86, 451, 86, 465, 464, 466, 455, 86, 86, - - 470, 166, 469, 86, 463, 471, 476, 456, 86, 467, - 457, 86, 468, 472, 473, 458, 459, 460, 461, 474, - 477, 86, 86, 480, 475, 86, 86, 86, 86, 86, - 486, 86, 86, 488, 86, 86, 86, 484, 485, 478, - 487, 481, 479, 86, 482, 483, 86, 489, 492, 86, - 86, 491, 86, 86, 497, 86, 498, 86, 499, 490, - 86, 493, 86, 86, 516, 86, 86, 500, 496, 494, - 503, 505, 495, 504, 501, 86, 510, 502, 86, 86, - 506, 508, 86, 509, 86, 511, 507, 86, 517, 518, - 86, 86, 519, 515, 86, 86, 86, 86, 512, 86, - - 533, 513, 86, 514, 86, 520, 86, 521, 86, 86, - 535, 532, 538, 522, 536, 86, 537, 523, 534, 170, - 540, 579, 524, 549, 550, 525, 86, 526, 539, 527, - 551, 86, 86, 86, 86, 552, 86, 553, 86, 86, - 555, 86, 528, 558, 554, 529, 165, 530, 557, 531, - 86, 556, 541, 542, 560, 86, 86, 559, 86, 562, - 86, 86, 543, 544, 545, 546, 547, 561, 564, 548, - 563, 86, 86, 570, 86, 568, 566, 571, 565, 573, - 86, 569, 86, 574, 86, 86, 86, 86, 86, 86, - 578, 86, 86, 581, 567, 572, 86, 86, 576, 582, - - 583, 577, 86, 86, 575, 580, 163, 86, 585, 588, - 86, 584, 86, 586, 86, 589, 86, 587, 590, 591, - 86, 86, 86, 596, 593, 594, 86, 86, 612, 598, - 86, 597, 86, 86, 86, 86, 592, 615, 86, 161, - 595, 613, 599, 86, 601, 600, 602, 603, 614, 617, - 86, 86, 86, 86, 624, 86, 618, 619, 604, 616, - 605, 86, 86, 86, 86, 621, 606, 620, 86, 622, - 626, 86, 623, 86, 607, 608, 86, 629, 609, 610, - 86, 625, 611, 630, 86, 627, 628, 86, 631, 86, - 86, 86, 86, 86, 86, 636, 634, 635, 86, 86, - - 86, 86, 632, 637, 642, 638, 86, 86, 86, 86, - 644, 633, 641, 643, 86, 646, 86, 640, 639, 645, - 86, 647, 86, 649, 86, 651, 86, 86, 86, 86, - 648, 86, 86, 86, 86, 653, 86, 657, 655, 86, - 86, 86, 650, 86, 664, 666, 659, 652, 669, 654, - 86, 86, 656, 658, 660, 665, 661, 662, 86, 668, - 663, 86, 86, 86, 86, 86, 673, 667, 86, 86, - 671, 86, 86, 672, 86, 670, 677, 679, 674, 680, - 676, 86, 86, 675, 86, 86, 682, 86, 86, 678, - 86, 86, 683, 687, 686, 86, 689, 86, 86, 86, - - 86, 86, 685, 681, 86, 86, 684, 721, 86, 704, - 688, 86, 692, 690, 86, 86, 86, 691, 86, 693, - 701, 706, 702, 703, 694, 86, 695, 86, 86, 708, - 705, 707, 696, 712, 697, 86, 86, 698, 699, 86, - 86, 709, 711, 86, 700, 710, 717, 86, 716, 86, - 86, 714, 86, 713, 715, 719, 86, 718, 86, 720, - 86, 724, 86, 726, 86, 86, 730, 86, 86, 723, - 722, 727, 86, 729, 86, 725, 728, 733, 86, 86, - 86, 86, 86, 734, 86, 86, 731, 737, 739, 738, - 732, 170, 741, 86, 736, 740, 86, 735, 86, 86, - - 743, 744, 86, 86, 86, 742, 86, 748, 750, 86, - 745, 86, 753, 86, 746, 754, 86, 749, 756, 752, - 747, 86, 86, 86, 86, 86, 758, 86, 755, 86, - 86, 86, 762, 751, 757, 761, 86, 178, 767, 759, - 763, 86, 760, 768, 86, 770, 86, 764, 771, 86, - 765, 772, 766, 86, 769, 773, 86, 86, 774, 86, - 775, 86, 776, 86, 86, 86, 86, 777, 86, 86, - 782, 778, 781, 86, 86, 780, 86, 785, 86, 86, - 790, 784, 779, 783, 786, 86, 86, 86, 86, 789, - 86, 86, 792, 86, 796, 86, 794, 788, 86, 787, - - 86, 86, 86, 86, 86, 803, 799, 791, 793, 795, - 86, 86, 86, 797, 86, 804, 86, 86, 801, 86, - 806, 798, 800, 86, 802, 807, 805, 86, 808, 809, - 86, 811, 810, 86, 812, 813, 86, 816, 814, 818, - 86, 815, 817, 86, 86, 86, 820, 86, 821, 819, - 86, 86, 823, 824, 86, 86, 825, 86, 86, 86, - 86, 832, 86, 830, 828, 86, 86, 86, 86, 86, - 822, 826, 827, 829, 833, 86, 839, 86, 837, 831, - 86, 176, 86, 840, 836, 834, 86, 838, 835, 841, - 842, 843, 86, 86, 86, 844, 86, 86, 846, 845, - - 86, 86, 851, 86, 86, 849, 853, 86, 86, 852, - 847, 848, 86, 86, 86, 86, 854, 86, 86, 856, - 850, 858, 175, 857, 86, 86, 859, 86, 855, 862, - 860, 861, 865, 86, 866, 86, 86, 870, 86, 86, - 868, 86, 867, 863, 864, 869, 871, 86, 872, 875, - 873, 86, 86, 879, 86, 86, 86, 877, 880, 86, - 86, 881, 86, 876, 883, 874, 86, 878, 885, 86, - 86, 86, 86, 86, 891, 884, 86, 86, 86, 882, - 86, 892, 86, 86, 86, 893, 86, 886, 887, 888, - 86, 889, 86, 890, 901, 898, 896, 894, 895, 86, - - 86, 900, 86, 897, 899, 86, 86, 86, 86, 86, - 902, 86, 908, 903, 904, 86, 86, 86, 86, 86, - 918, 86, 170, 86, 905, 910, 907, 906, 916, 909, - 86, 86, 86, 911, 912, 913, 914, 915, 86, 86, - 921, 86, 919, 922, 917, 920, 924, 86, 86, 86, - 86, 86, 86, 923, 86, 86, 929, 928, 86, 930, - 932, 86, 927, 925, 86, 86, 933, 926, 86, 86, - 86, 935, 86, 86, 936, 170, 934, 940, 931, 938, - 941, 939, 937, 86, 86, 86, 944, 942, 86, 943, - 86, 86, 86, 86, 948, 949, 86, 945, 86, 950, - - 952, 86, 954, 86, 86, 946, 947, 951, 953, 956, - 955, 86, 86, 86, 86, 86, 958, 86, 86, 962, - 86, 86, 86, 959, 957, 86, 963, 964, 86, 86, - 86, 86, 961, 86, 86, 965, 86, 86, 960, 977, - 978, 1029, 967, 975, 86, 981, 966, 86, 976, 968, - 980, 979, 969, 982, 86, 86, 970, 86, 983, 971, - 86, 984, 86, 985, 86, 86, 972, 973, 986, 974, - 990, 86, 86, 987, 86, 86, 86, 999, 988, 86, - 86, 86, 86, 168, 1002, 989, 86, 991, 992, 86, - 993, 998, 86, 994, 1006, 1000, 1004, 1001, 995, 1003, - - 1007, 86, 86, 86, 996, 997, 1008, 1010, 86, 1012, - 1014, 1011, 1005, 86, 1013, 86, 86, 1009, 86, 1015, - 86, 1017, 86, 1018, 86, 1019, 86, 1020, 1016, 1022, - 86, 1021, 86, 86, 1023, 86, 86, 86, 86, 86, - 1026, 86, 1030, 86, 1033, 1024, 86, 86, 86, 86, - 1037, 1039, 86, 1031, 1025, 86, 86, 1027, 1028, 86, - 1032, 1035, 1040, 1043, 1038, 1034, 86, 1041, 86, 86, - 1036, 1042, 1045, 1047, 1044, 86, 86, 86, 86, 86, - 1046, 86, 1049, 86, 1048, 1050, 1051, 86, 1052, 86, - 86, 1053, 86, 86, 86, 86, 86, 1055, 1056, 86, - - 1057, 1061, 86, 86, 1065, 86, 1064, 86, 1054, 86, - 86, 1063, 1059, 1058, 1062, 86, 86, 86, 1060, 86, - 86, 86, 86, 86, 1073, 1068, 1069, 1066, 1071, 1072, - 86, 86, 86, 86, 1067, 1074, 1075, 86, 86, 1079, - 86, 1077, 86, 1070, 1080, 86, 1078, 86, 1082, 86, - 86, 1081, 86, 1083, 86, 1088, 1076, 86, 1085, 1084, - 86, 86, 1090, 1089, 1091, 86, 1086, 86, 1087, 86, - 86, 86, 1093, 86, 86, 1092, 86, 86, 1094, 86, - 1101, 1095, 1099, 166, 1104, 86, 86, 86, 86, 1096, - 86, 1098, 1097, 86, 1105, 1102, 86, 1100, 1103, 1106, - - 86, 1111, 1107, 86, 86, 86, 1110, 1108, 86, 1113, - 1109, 1114, 86, 86, 86, 86, 86, 1112, 86, 86, - 1125, 86, 1117, 1119, 1115, 86, 86, 1126, 1116, 86, - 86, 1128, 86, 86, 1118, 86, 1120, 86, 1122, 1133, - 1121, 1123, 1131, 1127, 1129, 1124, 86, 1132, 86, 86, - 86, 86, 1130, 86, 1140, 1137, 86, 1139, 1141, 86, - 86, 1135, 1142, 86, 86, 1134, 86, 1145, 86, 1136, - 1147, 86, 1138, 86, 86, 86, 86, 86, 1153, 1144, - 1149, 1143, 86, 1154, 170, 1150, 86, 86, 1146, 86, - 1156, 1155, 1148, 86, 1157, 86, 86, 86, 1151, 1158, - - 1152, 1160, 86, 86, 86, 86, 1173, 1159, 1161, 86, - 86, 1163, 86, 1174, 86, 1164, 1176, 86, 86, 1162, - 86, 86, 1178, 1165, 1180, 1166, 86, 1175, 86, 1167, - 165, 1168, 86, 1181, 1182, 1169, 1179, 1170, 1183, 1177, - 86, 1185, 1171, 1184, 86, 86, 86, 1172, 86, 1187, - 86, 86, 86, 86, 1186, 1190, 1193, 86, 1192, 86, - 163, 1188, 86, 1189, 86, 1191, 1194, 1198, 1197, 1201, - 1199, 1196, 86, 1202, 1195, 86, 1205, 1200, 1204, 86, - 1203, 86, 86, 86, 86, 86, 86, 86, 86, 86, - 86, 86, 1220, 1217, 86, 86, 86, 86, 1216, 1221, - - 86, 86, 1219, 1218, 1207, 1208, 1206, 86, 1209, 1222, - 1224, 1223, 86, 1210, 1228, 1211, 1225, 86, 86, 1226, - 86, 1212, 1229, 86, 86, 86, 1213, 1214, 1227, 86, - 1230, 1235, 86, 1215, 86, 86, 1238, 86, 1236, 86, - 1232, 1231, 86, 1233, 1241, 86, 86, 1234, 1239, 86, - 86, 1243, 86, 86, 1244, 1237, 1240, 86, 86, 1242, - 1249, 1246, 1247, 86, 86, 86, 86, 86, 86, 1245, - 1252, 86, 1250, 86, 1248, 86, 86, 86, 86, 86, - 86, 86, 1254, 1251, 1257, 1256, 1258, 1253, 86, 1261, - 86, 1255, 1263, 1260, 1259, 86, 1262, 86, 86, 1264, - - 1266, 86, 1265, 86, 1267, 86, 1270, 86, 86, 1275, - 1271, 86, 1272, 86, 1274, 86, 1268, 1273, 1269, 1276, - 1277, 86, 86, 86, 1281, 86, 86, 86, 1283, 1282, - 86, 1284, 86, 86, 86, 1279, 1278, 1286, 86, 1280, - 86, 1285, 86, 1293, 86, 86, 1287, 86, 86, 86, - 1295, 1300, 86, 1288, 1289, 1291, 86, 1297, 1290, 1292, - 86, 86, 1296, 86, 1299, 1294, 86, 86, 86, 86, - 86, 1302, 1303, 86, 1298, 1306, 86, 86, 1305, 86, - 86, 1307, 1301, 1309, 1304, 1308, 1311, 1312, 1313, 86, - 86, 86, 86, 86, 86, 1310, 86, 1316, 86, 1314, - - 86, 1317, 86, 86, 161, 1321, 1323, 1324, 1325, 1315, - 1318, 86, 86, 86, 86, 1319, 1322, 86, 1320, 86, - 1328, 1330, 1326, 86, 1327, 86, 86, 86, 1329, 1332, - 1331, 86, 1334, 86, 86, 1336, 86, 86, 86, 1335, - 86, 86, 1337, 86, 86, 1339, 1338, 1342, 86, 86, - 86, 1333, 1343, 1345, 86, 86, 86, 1349, 1350, 1340, - 86, 1344, 1341, 86, 86, 86, 86, 1347, 1353, 86, - 86, 1352, 1346, 86, 86, 1348, 86, 1358, 86, 1354, - 1351, 86, 86, 86, 1355, 1356, 86, 1360, 1364, 86, - 86, 86, 1357, 170, 1359, 86, 1366, 86, 1365, 86, - - 1367, 1361, 86, 86, 86, 1363, 1376, 1372, 1362, 86, - 86, 1369, 86, 1368, 1370, 1371, 1374, 86, 1373, 1377, - 86, 86, 86, 1380, 1375, 86, 1378, 1379, 86, 86, - 86, 86, 86, 1381, 1382, 1384, 86, 86, 86, 1390, - 86, 86, 86, 1383, 1387, 86, 1385, 86, 86, 86, - 1401, 1386, 86, 1388, 1394, 1389, 1391, 1396, 86, 1392, - 1393, 86, 1400, 86, 86, 86, 1397, 1395, 1398, 1402, - 1404, 1399, 1403, 86, 86, 1405, 86, 1406, 86, 86, - 86, 86, 1413, 86, 1407, 1410, 86, 1409, 86, 86, - 86, 1414, 86, 1412, 1408, 1418, 86, 1415, 1411, 86, - - 1416, 86, 86, 86, 1419, 86, 1420, 1422, 86, 1417, - 86, 86, 1421, 86, 1423, 86, 1428, 1424, 1425, 86, - 1426, 86, 1431, 86, 86, 1429, 86, 86, 86, 86, - 1427, 1438, 86, 1432, 1430, 1436, 86, 86, 86, 86, - 86, 86, 1433, 1437, 1435, 1434, 86, 1439, 1441, 86, - 1448, 1442, 1440, 1444, 86, 1450, 86, 1443, 86, 1445, - 86, 86, 86, 86, 1447, 86, 86, 86, 1453, 86, - 86, 1446, 1456, 1451, 1449, 86, 1452, 86, 1457, 1458, - 86, 1455, 1526, 1454, 1459, 86, 86, 1463, 1460, 1461, - 1462, 86, 1464, 1471, 86, 1473, 1465, 86, 1474, 1466, - - 1467, 86, 86, 1472, 1468, 1477, 86, 1475, 86, 86, - 1469, 86, 86, 1478, 1470, 1476, 86, 1479, 86, 1480, - 86, 1482, 86, 86, 86, 1483, 1487, 1484, 86, 86, - 1481, 86, 86, 1488, 1490, 86, 1485, 1493, 1494, 86, - 86, 1486, 86, 86, 86, 1491, 86, 1495, 1489, 1498, - 1496, 86, 1497, 1492, 1499, 86, 1500, 86, 1501, 86, - 1502, 86, 1503, 86, 1505, 1504, 1506, 1507, 86, 86, - 1508, 86, 1509, 86, 1514, 1511, 1510, 86, 86, 1515, - 86, 86, 1513, 86, 86, 86, 1516, 86, 1518, 1512, - 1524, 86, 86, 1520, 86, 1519, 86, 86, 1525, 86, - - 1517, 86, 1527, 86, 1521, 1523, 1522, 86, 1529, 86, - 86, 86, 86, 1528, 86, 1530, 1531, 1532, 86, 1535, - 1536, 86, 1538, 86, 86, 86, 1539, 1533, 1540, 86, - 86, 1542, 86, 1537, 1541, 86, 1534, 1544, 86, 1543, - 1546, 86, 86, 1547, 86, 86, 86, 1552, 86, 1548, - 86, 86, 1545, 86, 86, 1557, 1549, 1555, 86, 86, - 86, 86, 86, 1558, 1560, 86, 1550, 1551, 1554, 1559, - 1553, 86, 86, 1556, 1562, 86, 86, 1561, 86, 86, - 1563, 1565, 86, 1567, 86, 1564, 86, 1568, 1629, 1566, - 86, 1569, 86, 1570, 86, 1572, 86, 1571, 86, 86, - - 1574, 1573, 86, 1578, 1575, 1579, 1576, 86, 86, 86, - 1582, 86, 1580, 1581, 86, 1577, 86, 86, 86, 1586, - 86, 86, 86, 1583, 86, 86, 86, 1588, 170, 1585, - 86, 1594, 1595, 86, 1597, 1590, 1584, 86, 86, 1596, - 86, 1587, 1589, 1591, 86, 86, 1592, 86, 86, 86, - 86, 86, 1605, 1593, 86, 86, 86, 86, 1598, 86, - 1602, 1609, 86, 1603, 1599, 1600, 86, 1601, 1604, 1610, - 86, 1612, 1614, 86, 1606, 1608, 86, 1615, 86, 86, - 1607, 1613, 1611, 86, 86, 1617, 86, 1618, 86, 86, - 86, 1616, 1626, 1623, 86, 86, 1624, 1619, 1625, 1620, - - 1628, 1621, 86, 86, 1622, 1631, 86, 86, 1627, 86, - 1632, 86, 86, 1630, 1633, 86, 86, 1636, 86, 86, - 1637, 1638, 86, 86, 1641, 1635, 86, 1639, 86, 1634, - 86, 1646, 86, 86, 86, 1650, 1647, 1643, 1640, 86, - 86, 86, 1642, 86, 1644, 86, 1645, 86, 86, 86, - 86, 1648, 1651, 1649, 86, 1652, 86, 1659, 86, 1654, - 86, 1658, 1653, 1655, 1656, 1660, 1657, 86, 86, 1664, - 86, 86, 1661, 86, 86, 1668, 1663, 1669, 1670, 1662, - 1666, 86, 86, 86, 86, 1665, 86, 1672, 1673, 86, - 86, 86, 86, 1667, 1678, 1671, 1674, 1677, 1675, 1679, - - 86, 1680, 86, 1681, 86, 86, 86, 86, 86, 1682, - 1685, 86, 1676, 86, 86, 1687, 86, 1686, 86, 86, - 86, 86, 1688, 86, 1693, 86, 1689, 1692, 1683, 1695, - 1684, 1691, 1690, 86, 86, 1699, 86, 1701, 1696, 1694, - 1700, 86, 1702, 86, 1698, 86, 1704, 86, 1697, 86, - 86, 86, 86, 86, 86, 1712, 1703, 1708, 86, 1707, - 86, 86, 86, 1713, 86, 1716, 1705, 86, 1706, 86, - 1709, 86, 1711, 1710, 86, 1718, 1719, 86, 86, 86, - 1714, 86, 86, 1717, 86, 86, 1720, 86, 1715, 86, - 1728, 86, 86, 1721, 1729, 1725, 1722, 1723, 1724, 86, - - 1727, 86, 1733, 86, 1735, 1726, 1730, 1734, 86, 86, - 86, 1731, 86, 1732, 1736, 86, 86, 86, 86, 1741, - 86, 86, 1737, 1742, 1739, 86, 1745, 1738, 86, 1740, - 1749, 86, 86, 1746, 1751, 86, 1743, 1750, 1744, 86, - 86, 1754, 86, 86, 1748, 1747, 1756, 86, 1755, 86, - 1752, 86, 1753, 1757, 86, 86, 86, 1762, 1763, 86, - 86, 86, 86, 86, 1760, 86, 1767, 1766, 1768, 86, - 86, 1758, 1759, 1771, 86, 86, 1761, 86, 1764, 1770, - 86, 86, 1765, 1772, 86, 86, 86, 86, 1776, 1769, - 86, 1773, 86, 1774, 86, 1781, 1779, 1775, 86, 86, - - 86, 86, 86, 1787, 86, 1788, 1785, 1777, 86, 86, - 1778, 86, 1780, 1782, 86, 86, 1786, 1789, 86, 1784, - 1783, 86, 1794, 86, 86, 86, 86, 1799, 86, 1790, - 1791, 1797, 86, 86, 86, 1802, 1800, 1795, 1793, 1792, - 1798, 86, 1796, 86, 86, 86, 86, 86, 86, 1806, - 1809, 86, 1808, 1801, 86, 1805, 170, 1810, 86, 86, - 86, 1811, 1804, 1803, 1812, 1807, 86, 86, 86, 86, - 1820, 86, 1813, 86, 1815, 86, 1814, 86, 1821, 1824, - 86, 1818, 1826, 86, 86, 1816, 1817, 86, 86, 1828, - 1830, 1822, 1825, 1819, 86, 1823, 86, 1832, 86, 1829, - - 1834, 86, 86, 86, 1827, 86, 86, 86, 1831, 86, - 86, 1836, 1833, 86, 1837, 86, 1839, 86, 1840, 86, - 86, 1835, 1844, 86, 1841, 1842, 86, 1845, 1843, 86, - 1838, 1852, 86, 86, 86, 1847, 1849, 86, 1846, 1850, - 86, 86, 86, 1856, 1854, 1853, 86, 1857, 86, 1848, - 86, 1851, 1862, 1859, 1860, 86, 1863, 1858, 86, 86, - 1855, 1869, 86, 1867, 1864, 86, 1865, 86, 1866, 86, - 1861, 86, 86, 86, 86, 86, 1868, 1874, 1873, 1875, - 1876, 86, 86, 86, 86, 86, 86, 1877, 86, 1878, - 1870, 86, 1871, 1880, 1872, 86, 1881, 86, 86, 86, - - 86, 86, 1883, 1882, 1879, 86, 86, 86, 86, 86, - 86, 1884, 1893, 1892, 86, 1887, 86, 86, 1885, 1888, - 1886, 1889, 86, 86, 1890, 86, 1896, 86, 1899, 1895, - 1898, 86, 86, 1891, 86, 1894, 86, 1897, 86, 1904, - 86, 1903, 86, 1900, 86, 1906, 86, 1901, 86, 1907, - 1908, 86, 1902, 1910, 1911, 86, 1912, 1905, 1909, 86, - 86, 1913, 86, 86, 86, 86, 86, 86, 86, 86, - 1927, 86, 1917, 1914, 1919, 1920, 1928, 86, 1921, 1918, - 1916, 1922, 86, 1923, 1915, 1926, 86, 86, 1924, 86, - 1932, 86, 1931, 86, 1925, 86, 86, 86, 1929, 86, - - 1936, 1935, 86, 86, 1937, 1930, 1933, 86, 86, 86, - 86, 86, 1946, 86, 1934, 86, 1940, 1947, 1944, 1939, - 1942, 1938, 1945, 1943, 86, 86, 86, 1941, 86, 86, - 86, 86, 86, 1953, 86, 1948, 1955, 1949, 1954, 86, - 1951, 86, 1956, 1950, 1960, 1952, 86, 1959, 86, 86, - 86, 1963, 1958, 86, 1965, 1964, 86, 1957, 1962, 86, - 86, 1969, 86, 86, 1961, 1973, 86, 86, 1966, 1967, - 1974, 86, 1968, 86, 86, 86, 86, 1970, 1980, 1978, - 1975, 1972, 1976, 1971, 86, 1982, 86, 1983, 86, 1979, - 86, 86, 1986, 86, 1981, 1977, 1984, 86, 86, 86, - - 1990, 86, 1985, 1987, 86, 86, 86, 86, 86, 1994, - 1988, 1992, 1995, 1989, 1991, 86, 86, 1993, 86, 86, - 86, 86, 86, 2000, 1996, 86, 1997, 1999, 86, 2001, - 86, 2003, 2007, 86, 2002, 1998, 86, 2009, 2004, 2010, - 86, 86, 2005, 86, 2006, 86, 86, 2013, 86, 2011, - 86, 2017, 86, 2012, 2008, 86, 2014, 2019, 86, 2015, - 86, 86, 86, 86, 2023, 86, 86, 86, 2018, 2016, - 2025, 86, 2026, 86, 86, 86, 2021, 86, 2028, 2022, - 2020, 86, 2024, 2030, 86, 170, 2029, 86, 2032, 86, - 2034, 2027, 86, 2033, 2037, 86, 86, 2035, 2031, 86, - - 2041, 86, 86, 86, 2036, 86, 86, 86, 2039, 86, - 2043, 2038, 86, 86, 2048, 86, 2042, 2044, 2040, 2045, - 86, 2051, 2052, 86, 2049, 2046, 86, 86, 86, 2047, - 2053, 2050, 2054, 86, 86, 2056, 2057, 2058, 86, 2055, - 2059, 86, 86, 2060, 86, 86, 86, 2061, 86, 86, - 86, 86, 86, 86, 86, 2066, 2067, 86, 86, 2071, - 86, 2068, 2072, 86, 2080, 2062, 2064, 2065, 2063, 2069, - 86, 86, 86, 2070, 86, 2073, 2075, 2077, 2078, 86, - 2074, 2079, 86, 2076, 86, 86, 86, 86, 86, 86, - 2087, 86, 2090, 2091, 86, 2081, 2092, 86, 2083, 86, - - 2082, 86, 2085, 2088, 2084, 2089, 86, 2086, 2094, 86, - 86, 2095, 86, 2099, 86, 2101, 86, 86, 2103, 2093, - 2100, 86, 2096, 86, 86, 2105, 2102, 2097, 86, 86, - 86, 86, 86, 2098, 2106, 2104, 86, 2109, 86, 2108, - 86, 2112, 86, 86, 86, 2111, 86, 2113, 86, 2115, - 2110, 2116, 86, 2107, 86, 2117, 2119, 2118, 86, 86, - 86, 2127, 86, 86, 2114, 86, 86, 86, 2124, 86, - 2120, 2121, 2122, 2130, 2131, 2132, 86, 2123, 2125, 2126, - 2133, 86, 86, 2128, 86, 2129, 2136, 86, 86, 2139, - 2134, 86, 86, 86, 86, 86, 86, 2135, 2137, 86, - - 2140, 2143, 86, 2138, 86, 2145, 86, 2148, 2149, 86, - 86, 86, 2141, 86, 2142, 86, 2146, 2151, 86, 86, - 2144, 2147, 2153, 2156, 2154, 86, 2158, 86, 86, 86, - 2150, 86, 86, 86, 86, 86, 2152, 86, 2164, 2161, - 2155, 2157, 2162, 86, 2167, 2169, 2160, 86, 86, 2159, - 86, 86, 2168, 86, 86, 86, 2173, 2172, 2175, 2166, - 2163, 2165, 2171, 86, 86, 2176, 86, 86, 2170, 86, - 86, 86, 2174, 86, 2177, 86, 2178, 86, 2182, 86, - 86, 86, 2184, 86, 2187, 2179, 86, 2188, 2189, 2183, - 86, 2180, 2181, 86, 86, 86, 86, 86, 2185, 2192, - - 2197, 86, 86, 86, 86, 2191, 2190, 2186, 2196, 86, - 86, 86, 2203, 86, 86, 2193, 2194, 2202, 86, 2195, - 2204, 2206, 86, 2199, 2200, 86, 2198, 2205, 86, 2201, - 2210, 86, 2207, 86, 86, 86, 2208, 86, 86, 86, - 2214, 2209, 86, 2218, 86, 86, 86, 86, 2212, 86, - 2223, 86, 2221, 86, 2211, 3645, 2213, 2222, 2215, 2216, - 86, 2220, 2217, 2219, 86, 2224, 86, 86, 86, 2226, - 2225, 86, 86, 2229, 2231, 86, 2230, 2238, 2227, 2232, - 86, 2233, 2235, 2228, 2236, 86, 2234, 86, 86, 2240, - 86, 86, 86, 86, 2237, 86, 2242, 2239, 86, 2244, - - 86, 2246, 86, 2241, 2248, 2243, 86, 86, 2249, 86, - 86, 86, 170, 86, 86, 86, 86, 2252, 86, 2256, - 86, 2257, 86, 2258, 2247, 2245, 2251, 2253, 2254, 3645, - 2250, 2262, 2255, 2259, 86, 2260, 86, 86, 86, 86, - 2261, 86, 86, 86, 2263, 2265, 2264, 86, 2267, 86, - 2268, 2266, 86, 2270, 86, 86, 86, 86, 2274, 86, - 86, 2269, 2273, 86, 86, 2275, 2271, 2272, 2276, 2277, - 86, 2279, 86, 2278, 86, 86, 86, 86, 86, 86, - 2280, 2284, 2286, 2281, 2285, 86, 86, 86, 86, 86, - 86, 2291, 86, 2282, 2288, 2283, 2287, 86, 86, 86, - - 86, 2290, 2292, 86, 2289, 86, 2294, 2293, 2295, 86, - 2297, 86, 2296, 2302, 2298, 2299, 2301, 2303, 86, 2300, - 86, 86, 86, 2304, 86, 86, 86, 2310, 86, 86, - 2312, 86, 86, 86, 2313, 2315, 86, 2305, 2306, 2309, - 2307, 2308, 86, 2317, 86, 2311, 86, 2318, 86, 2314, - 2316, 86, 2321, 86, 86, 86, 86, 2320, 86, 86, - 2326, 2323, 86, 86, 2327, 86, 86, 2322, 86, 86, - 86, 2319, 2328, 86, 86, 86, 2325, 2324, 2330, 86, - 2331, 2337, 2333, 2329, 2332, 86, 2338, 86, 2335, 2336, - 86, 2334, 86, 86, 2340, 2343, 2339, 86, 2341, 2346, - - 86, 86, 2345, 86, 2349, 86, 86, 86, 2344, 86, - 2350, 2342, 2352, 2348, 86, 2347, 2353, 86, 86, 86, - 86, 86, 2355, 2351, 2354, 2356, 86, 2358, 2357, 2359, - 86, 2363, 2361, 2360, 86, 86, 2364, 86, 2366, 86, - 86, 86, 86, 86, 2369, 2362, 2368, 86, 2370, 2365, - 86, 86, 2371, 86, 2375, 86, 86, 86, 2379, 86, - 86, 2376, 86, 2380, 86, 86, 2367, 2378, 2372, 2373, - 2377, 86, 86, 2374, 2385, 86, 2383, 2384, 2382, 2381, - 86, 2386, 86, 2387, 86, 2390, 86, 86, 2392, 86, - 86, 86, 2391, 2396, 86, 86, 86, 2388, 2394, 86, - - 2398, 86, 2399, 86, 2389, 86, 2395, 2393, 2397, 86, - 2401, 86, 2400, 2402, 86, 2403, 2406, 86, 2404, 2408, - 86, 2405, 86, 86, 2409, 86, 86, 86, 86, 86, - 86, 2411, 2410, 2414, 2415, 2412, 86, 86, 2407, 2413, - 2419, 86, 86, 2416, 86, 2418, 2417, 86, 86, 86, - 86, 86, 86, 86, 2427, 2420, 86, 86, 86, 86, - 2421, 86, 2422, 2423, 2425, 2428, 2426, 2433, 2429, 86, - 86, 86, 2430, 2424, 2431, 2432, 86, 2434, 86, 2440, - 2438, 86, 2435, 86, 2437, 86, 2439, 2443, 86, 2445, - 86, 86, 2442, 86, 2444, 2436, 86, 86, 86, 86, - - 2448, 2452, 2449, 170, 2456, 3645, 2441, 86, 2454, 2446, - 86, 2450, 2447, 2455, 86, 2457, 86, 86, 2451, 2458, - 86, 86, 2461, 86, 86, 2453, 86, 2462, 2459, 2466, - 86, 86, 2467, 2465, 86, 86, 2470, 2460, 86, 86, - 2472, 2463, 86, 2471, 2473, 86, 2468, 86, 86, 86, - 2475, 2476, 2464, 2469, 2474, 86, 86, 86, 86, 2478, - 86, 86, 86, 86, 86, 2481, 86, 2484, 2477, 86, - 86, 86, 2490, 86, 86, 2488, 86, 2479, 2483, 86, - 2491, 86, 2485, 2480, 2482, 2486, 2487, 86, 86, 2492, - 86, 86, 2493, 2489, 86, 86, 86, 2494, 86, 2499, - - 2502, 86, 2497, 86, 86, 86, 2496, 2495, 2500, 86, - 2498, 2503, 86, 86, 2501, 86, 86, 2504, 86, 86, - 2513, 86, 86, 2505, 2506, 2511, 86, 86, 86, 3645, - 2518, 86, 2507, 2516, 2509, 2515, 2508, 2510, 86, 2512, - 86, 2519, 2514, 86, 2517, 2520, 86, 86, 2521, 86, - 2522, 86, 86, 2523, 2529, 2524, 86, 2527, 2528, 86, - 2530, 86, 86, 2525, 2526, 86, 86, 86, 2534, 2536, - 86, 2535, 86, 2537, 86, 2538, 86, 2531, 86, 2533, - 2532, 2541, 86, 2542, 86, 2539, 86, 86, 2540, 86, - 86, 2543, 2544, 2548, 86, 2549, 86, 86, 2545, 2551, - - 86, 86, 2547, 2553, 86, 86, 86, 2556, 86, 2546, - 86, 2555, 2557, 86, 86, 86, 2550, 86, 86, 2552, - 2554, 86, 86, 2559, 2558, 86, 2563, 2564, 86, 2566, - 86, 2561, 2560, 86, 86, 86, 86, 2562, 2568, 2570, - 2569, 2565, 86, 2567, 86, 2571, 2573, 86, 86, 86, - 2576, 86, 2579, 86, 2574, 2580, 86, 2575, 86, 86, - 2572, 86, 86, 86, 2577, 2586, 86, 2585, 86, 86, - 2578, 86, 86, 2582, 2588, 86, 2581, 2584, 2591, 86, - 86, 86, 2583, 86, 86, 86, 2589, 2587, 2593, 86, - 2590, 86, 2592, 2601, 2594, 86, 2599, 86, 86, 2605, - - 2597, 2595, 2596, 86, 86, 86, 2600, 2602, 2607, 86, - 2606, 86, 86, 86, 2608, 2598, 86, 86, 86, 86, - 86, 2612, 2603, 2614, 2604, 2610, 86, 86, 86, 3645, - 86, 2615, 2616, 2618, 2611, 2617, 2609, 86, 2619, 86, - 2620, 2622, 2623, 2613, 86, 2621, 86, 86, 86, 86, - 86, 2624, 2627, 2625, 86, 86, 86, 86, 86, 86, - 86, 2626, 2634, 2629, 2630, 2631, 2632, 2635, 86, 86, - 2628, 86, 2633, 86, 86, 2636, 86, 2640, 2639, 2637, - 2638, 2641, 86, 2642, 86, 86, 2645, 86, 86, 170, - 2649, 2643, 86, 2644, 2646, 86, 2651, 86, 86, 86, - - 86, 86, 86, 86, 2659, 86, 86, 2652, 2647, 2653, - 2648, 2650, 3645, 2654, 2655, 2657, 86, 2656, 2661, 2658, - 2662, 86, 86, 2663, 86, 2660, 2664, 86, 86, 2666, - 2667, 2665, 2668, 86, 2670, 86, 86, 86, 86, 86, - 2672, 86, 2669, 86, 86, 86, 2676, 86, 2677, 86, - 86, 2671, 86, 2673, 86, 2679, 2680, 2674, 2685, 86, - 86, 2678, 2681, 2675, 2682, 86, 86, 86, 86, 2686, - 86, 2683, 2684, 86, 2688, 2689, 86, 86, 86, 86, - 86, 86, 2691, 86, 86, 86, 2690, 2696, 2687, 86, - 2698, 2699, 86, 2701, 86, 2695, 86, 86, 2692, 2693, - - 2694, 86, 2700, 86, 2697, 86, 86, 2702, 2705, 2707, - 86, 86, 86, 2703, 86, 2711, 2712, 2710, 2708, 2734, - 2704, 86, 86, 86, 86, 86, 2706, 2709, 86, 86, - 2714, 2713, 86, 2715, 86, 2718, 86, 86, 2769, 2716, - 2719, 86, 2720, 2717, 86, 86, 2726, 2721, 2722, 86, - 2724, 86, 86, 86, 86, 2725, 2728, 86, 2723, 2730, - 86, 86, 86, 2729, 86, 2727, 86, 86, 86, 86, - 2739, 86, 86, 2737, 2738, 2741, 2732, 2740, 86, 2731, - 2733, 86, 86, 86, 2743, 86, 86, 86, 2736, 86, - 86, 2746, 2735, 2748, 2745, 86, 86, 2751, 86, 86, - - 86, 2744, 2742, 86, 86, 2752, 2747, 2749, 2750, 2753, - 2754, 2755, 2758, 86, 2757, 86, 86, 86, 2759, 86, - 86, 2756, 86, 2762, 2763, 86, 86, 86, 86, 86, - 86, 2764, 86, 86, 2768, 2760, 2766, 2761, 2765, 86, - 86, 2767, 86, 86, 2770, 2772, 2771, 2773, 2776, 2777, - 86, 2778, 86, 2779, 86, 2780, 86, 86, 86, 2774, - 2775, 86, 86, 2784, 86, 2785, 2783, 86, 2786, 2781, - 86, 86, 86, 86, 86, 3645, 2782, 86, 86, 2793, - 86, 86, 2787, 86, 2789, 2795, 86, 2796, 86, 2798, - 86, 2788, 2797, 2790, 2792, 2791, 2794, 86, 86, 86, - - 86, 86, 86, 2802, 86, 2800, 2803, 2806, 86, 2799, - 86, 2801, 86, 2807, 2808, 86, 86, 86, 86, 86, - 2804, 86, 2805, 2815, 86, 170, 86, 2817, 86, 2811, - 86, 86, 2810, 2813, 86, 86, 2809, 2816, 86, 2818, - 2814, 2812, 2821, 2819, 86, 86, 2820, 2824, 86, 86, - 2826, 86, 2825, 2827, 2828, 86, 2822, 86, 2823, 2829, - 86, 86, 2830, 86, 2831, 86, 2832, 2833, 2834, 86, - 2835, 86, 86, 86, 86, 86, 86, 86, 86, 86, - 2843, 3645, 86, 86, 2836, 2841, 86, 2847, 86, 86, - 2838, 2837, 2848, 2845, 2840, 2839, 86, 2842, 86, 2844, - - 2846, 2849, 86, 2850, 86, 2851, 86, 2852, 2853, 86, - 2855, 86, 86, 2854, 2856, 86, 86, 86, 86, 86, - 86, 86, 2859, 86, 2857, 2866, 86, 2865, 2867, 86, - 2858, 2860, 86, 86, 86, 2861, 2862, 2863, 2864, 2870, - 2871, 86, 2873, 2868, 2872, 86, 86, 86, 86, 86, - 2869, 86, 2874, 86, 2880, 86, 86, 86, 2879, 86, - 86, 86, 2876, 3645, 2875, 2878, 86, 86, 2877, 2888, - 86, 2884, 2886, 86, 86, 2887, 2881, 2882, 86, 2883, - 2889, 2885, 2890, 86, 86, 2891, 86, 86, 86, 86, - 86, 86, 86, 2892, 2895, 2896, 2897, 86, 86, 2894, - - 86, 2902, 2903, 86, 86, 2893, 2906, 86, 2898, 2900, - 86, 2899, 86, 86, 86, 2901, 86, 2909, 2905, 2904, - 86, 2907, 2914, 86, 86, 86, 2912, 2908, 2913, 2910, - 86, 2911, 86, 86, 2919, 86, 86, 86, 2915, 86, - 86, 2923, 86, 2922, 86, 2916, 2921, 86, 2920, 2924, - 86, 86, 2917, 2918, 2926, 86, 2927, 86, 86, 2930, - 2929, 2925, 2932, 86, 86, 2933, 2928, 86, 2935, 86, - 86, 86, 86, 86, 2942, 86, 86, 86, 2931, 86, - 86, 86, 2939, 2936, 2937, 2938, 2940, 86, 2941, 2934, - 2945, 86, 2946, 86, 86, 2944, 2943, 86, 2947, 86, - - 2951, 86, 2949, 86, 86, 86, 86, 2950, 2948, 86, - 2952, 2953, 86, 86, 2955, 2958, 86, 2956, 2960, 2954, - 2957, 2959, 86, 2962, 170, 2961, 86, 86, 86, 86, - 2967, 3645, 2964, 2963, 86, 86, 86, 86, 2969, 2968, - 86, 2972, 86, 2973, 86, 2971, 2965, 2966, 86, 2977, - 2970, 2975, 86, 86, 2978, 86, 2976, 86, 86, 86, - 2982, 2974, 2979, 2980, 86, 86, 86, 86, 2983, 86, - 2984, 86, 86, 2981, 2989, 2990, 2985, 86, 86, 2987, - 86, 86, 2991, 86, 2986, 2993, 86, 86, 2995, 86, - 2992, 86, 2996, 2988, 2994, 86, 86, 86, 86, 86, - - 2998, 2999, 3000, 2997, 86, 86, 86, 3005, 86, 86, - 86, 86, 3002, 3003, 3004, 3007, 3001, 3006, 3009, 86, - 86, 86, 3645, 86, 86, 3010, 86, 3008, 3015, 86, - 3011, 86, 86, 3016, 86, 86, 86, 3020, 86, 86, - 3012, 3013, 3014, 3018, 3019, 3023, 86, 3021, 86, 86, - 3017, 86, 86, 3022, 3030, 3027, 3028, 86, 3024, 3031, - 86, 86, 3033, 3025, 86, 86, 3034, 86, 86, 3026, - 86, 86, 3035, 86, 86, 3040, 3037, 3029, 86, 3032, - 86, 86, 3038, 3041, 86, 86, 86, 3039, 3042, 3045, - 86, 86, 3047, 86, 3645, 3036, 3043, 3049, 86, 3044, - - 86, 3046, 3050, 86, 3051, 86, 86, 86, 86, 3054, - 3052, 3048, 3053, 3055, 86, 86, 3059, 86, 86, 86, - 3057, 3060, 86, 86, 3063, 3064, 86, 86, 3056, 3058, - 3061, 3065, 86, 3066, 86, 86, 86, 86, 3067, 3062, - 3068, 3070, 86, 86, 3073, 86, 86, 3074, 86, 3069, - 3075, 86, 86, 3077, 86, 3071, 86, 86, 3081, 3082, - 86, 3078, 86, 3072, 86, 86, 3083, 3076, 86, 3084, - 3085, 3080, 3086, 86, 3079, 86, 86, 3087, 86, 86, - 3092, 86, 86, 86, 86, 3091, 86, 3094, 3095, 86, - 86, 3088, 3097, 3089, 86, 3096, 3090, 3098, 86, 86, - - 3101, 3100, 86, 86, 86, 86, 3093, 3099, 3104, 86, - 3108, 86, 86, 86, 86, 86, 3110, 3645, 86, 3102, - 3103, 86, 3105, 3107, 3111, 3106, 3109, 3115, 3112, 3114, - 3117, 86, 3116, 86, 3113, 3118, 86, 3119, 3120, 86, - 86, 3121, 86, 3122, 86, 3123, 86, 3124, 86, 3125, - 86, 86, 86, 86, 86, 86, 3127, 3129, 86, 3131, - 86, 86, 86, 3133, 86, 86, 3126, 3130, 3140, 3134, - 3138, 86, 3128, 86, 3132, 3139, 86, 3142, 86, 86, - 86, 3135, 3136, 86, 3137, 3143, 3145, 86, 3141, 86, - 3146, 3147, 86, 86, 3148, 3149, 86, 86, 3144, 86, - - 86, 86, 3150, 3155, 86, 86, 3151, 86, 3152, 3153, - 3156, 86, 86, 86, 3158, 86, 3157, 86, 86, 3154, - 86, 86, 3163, 86, 3160, 3167, 3159, 3164, 86, 3166, - 3161, 3165, 86, 86, 3169, 86, 86, 3162, 3168, 3171, - 86, 86, 3175, 86, 86, 86, 3170, 86, 3173, 86, - 3172, 86, 3182, 3176, 3179, 86, 86, 3177, 86, 3174, - 3180, 86, 86, 86, 86, 86, 3187, 3185, 3183, 3186, - 86, 86, 3178, 86, 86, 3181, 3189, 3191, 86, 3188, - 86, 3192, 3184, 3197, 3193, 86, 3190, 3194, 86, 3195, - 86, 3196, 86, 86, 86, 3201, 86, 86, 3198, 3200, - - 86, 86, 3202, 86, 3199, 3203, 3204, 86, 3206, 86, - 86, 3205, 3210, 86, 3208, 3212, 86, 86, 86, 86, - 86, 3213, 86, 86, 3207, 3214, 86, 3215, 3209, 86, - 3216, 86, 3221, 86, 3218, 86, 86, 86, 3211, 86, - 86, 3219, 3217, 3225, 86, 86, 86, 86, 3222, 3223, - 3224, 3220, 3230, 3226, 3229, 86, 3227, 86, 3232, 86, - 86, 86, 3236, 86, 3228, 3237, 86, 86, 3233, 86, - 86, 3239, 86, 86, 86, 3231, 3240, 86, 3234, 3242, - 3243, 86, 86, 3241, 3245, 86, 3238, 3235, 3246, 86, - 3247, 3244, 86, 86, 3248, 3251, 86, 3250, 3249, 86, - - 3254, 86, 3256, 86, 86, 86, 86, 86, 3253, 86, - 3258, 3261, 86, 3252, 3262, 86, 3264, 86, 86, 3259, - 86, 86, 86, 3257, 3255, 86, 3260, 3267, 86, 86, - 3265, 3268, 86, 3269, 86, 3263, 3271, 86, 86, 3266, - 3273, 3270, 3276, 3274, 86, 86, 86, 86, 86, 3280, - 86, 86, 86, 86, 3282, 3283, 3272, 3278, 3275, 86, - 3284, 86, 3281, 3277, 3287, 3285, 3279, 3288, 86, 86, - 86, 3290, 3289, 86, 86, 3293, 86, 86, 86, 3292, - 86, 3286, 3296, 3294, 86, 3299, 86, 86, 86, 86, - 86, 3291, 86, 3304, 86, 86, 86, 86, 86, 3295, - - 3500, 3297, 3298, 3303, 3300, 3301, 3307, 3308, 86, 3309, - 86, 3306, 3310, 86, 3302, 3305, 86, 86, 86, 3314, - 86, 3311, 86, 3313, 3315, 86, 3316, 86, 3317, 86, - 86, 3312, 3320, 86, 86, 3318, 3322, 86, 86, 3321, - 3324, 86, 3325, 86, 86, 86, 86, 86, 86, 3323, - 86, 3331, 3332, 86, 86, 86, 3319, 86, 86, 86, - 86, 3338, 86, 3326, 3339, 86, 3329, 3327, 3328, 3337, - 3330, 3335, 86, 3341, 3334, 86, 86, 3340, 3336, 86, - 3333, 3344, 86, 3346, 86, 3347, 86, 86, 86, 3350, - 86, 86, 3342, 3348, 3343, 86, 3353, 86, 86, 3352, - - 86, 3349, 3351, 3345, 86, 3354, 86, 86, 3355, 86, - 86, 3356, 86, 86, 3359, 86, 86, 86, 3357, 3361, - 3362, 86, 3360, 86, 86, 86, 86, 3358, 86, 86, - 86, 3371, 3374, 3372, 3363, 3375, 3364, 3365, 86, 3366, - 3367, 86, 3368, 3369, 3370, 86, 86, 86, 3377, 3373, - 3379, 86, 3380, 86, 86, 3382, 86, 86, 3381, 3378, - 86, 3376, 3383, 3385, 86, 3645, 3384, 3387, 86, 3388, - 3389, 86, 86, 3390, 3391, 3386, 86, 3392, 86, 3393, - 3394, 86, 86, 86, 86, 3395, 3398, 86, 3396, 3399, - 86, 86, 3401, 3397, 86, 86, 86, 3405, 86, 86, - - 86, 3404, 86, 86, 3400, 86, 86, 3409, 86, 3408, - 3645, 86, 3414, 86, 3402, 3403, 3413, 3410, 86, 3406, - 3411, 86, 3416, 86, 3412, 3407, 86, 3415, 3417, 86, - 3418, 86, 86, 86, 3423, 3425, 86, 3420, 3419, 3424, - 86, 86, 3421, 86, 86, 3422, 86, 86, 3645, 3429, - 3433, 3426, 3430, 3432, 86, 86, 86, 3428, 3427, 3435, - 86, 3434, 3436, 86, 86, 3431, 86, 3439, 86, 3440, - 86, 3438, 86, 86, 3443, 86, 3444, 86, 86, 3437, - 3645, 3441, 3445, 86, 3446, 86, 3447, 86, 3448, 86, - 86, 3442, 3449, 86, 3450, 86, 3453, 86, 86, 3452, - - 3454, 86, 86, 86, 3451, 3458, 86, 3455, 86, 3460, - 86, 86, 86, 86, 3456, 86, 86, 86, 3464, 3465, - 86, 3467, 86, 3457, 86, 3462, 3461, 3459, 3463, 86, - 3466, 3468, 3469, 86, 3471, 86, 86, 3474, 86, 3473, - 86, 86, 86, 86, 86, 3476, 86, 86, 86, 86, - 3470, 3482, 3475, 3472, 3480, 3481, 86, 86, 3479, 86, - 3477, 86, 3478, 86, 3483, 86, 3486, 86, 3487, 3489, - 86, 86, 3488, 3490, 86, 3491, 86, 3485, 86, 86, - 3493, 86, 3484, 3494, 86, 86, 3492, 3495, 86, 86, - 3499, 86, 3496, 86, 3502, 3498, 86, 86, 86, 86, - - 86, 86, 3503, 3501, 3497, 86, 3511, 86, 3509, 86, - 3504, 86, 86, 3506, 3505, 3508, 3513, 3510, 3515, 86, - 86, 86, 86, 3507, 86, 3517, 3520, 86, 3512, 3516, - 86, 3514, 86, 3521, 86, 3518, 3522, 86, 86, 3523, - 3524, 86, 3519, 3525, 86, 86, 86, 86, 3528, 3526, - 86, 3529, 3527, 86, 3533, 3530, 86, 86, 86, 3531, - 86, 86, 3532, 3536, 3537, 86, 86, 3534, 3535, 3539, - 86, 3540, 86, 3541, 86, 86, 3542, 3538, 3544, 86, - 86, 3547, 86, 86, 3548, 3543, 86, 86, 86, 3551, - 3545, 3552, 86, 86, 3549, 86, 86, 86, 3546, 3557, - - 86, 3556, 3553, 3558, 86, 3554, 3550, 86, 86, 86, - 86, 86, 3555, 86, 3562, 86, 86, 86, 3564, 86, - 86, 86, 3561, 3571, 86, 3569, 3570, 86, 3559, 3560, - 3566, 3563, 3567, 86, 3565, 3568, 86, 3575, 86, 86, - 3577, 86, 3578, 86, 3576, 86, 86, 3572, 3579, 86, - 3580, 3573, 86, 3583, 3581, 3574, 3584, 86, 86, 86, - 3586, 86, 86, 3585, 86, 86, 3587, 86, 86, 3592, - 86, 3582, 3589, 86, 3595, 86, 86, 86, 3596, 86, - 86, 86, 86, 3588, 86, 3597, 3590, 3591, 3598, 3593, - 3594, 86, 86, 3603, 86, 3602, 3599, 86, 86, 3600, - - 3601, 86, 3604, 86, 3607, 86, 3609, 3605, 86, 3610, - 3606, 86, 86, 3614, 86, 3645, 3611, 3608, 86, 3612, - 3613, 86, 86, 3615, 3616, 3617, 86, 86, 3618, 86, - 86, 86, 3623, 86, 3619, 3621, 86, 86, 86, 86, - 86, 86, 3625, 3626, 86, 3629, 3630, 86, 3620, 86, - 3622, 86, 3633, 3634, 86, 3624, 86, 86, 3627, 3628, - 3631, 3636, 86, 3635, 3637, 86, 86, 86, 3632, 86, - 86, 3645, 3639, 3638, 3640, 3645, 3641, 3643, 86, 3644, - 86, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3642, + 78, 86, 22, 72, 122, 86, 121, 110, 86, 79, + 161, 161, 73, 19, 20, 21, 69, 70, 71, 75, + 76, 77, 78, 189, 22, 72, 81, 82, 83, 131, + 90, 79, 90, 90, 73, 90, 171, 84, 81, 82, + 83, 90, 91, 86, 99, 86, 111, 86, 113, 84, + 86, 100, 86, 92, 93, 101, 114, 94, 102, 86, + 112, 86, 95, 116, 96, 236, 117, 115, 86, 86, + 157, 97, 86, 118, 158, 119, 160, 103, 159, 86, + 123, 104, 138, 86, 105, 86, 106, 107, 124, 153, + 86, 127, 86, 163, 125, 128, 163, 108, 126, 154, + + 86, 139, 184, 155, 156, 140, 168, 168, 86, 129, + 209, 130, 86, 132, 86, 141, 142, 133, 143, 144, + 183, 134, 145, 86, 149, 171, 150, 135, 86, 146, + 136, 178, 178, 147, 148, 151, 289, 137, 86, 174, + 165, 152, 165, 165, 90, 165, 90, 90, 170, 90, + 170, 170, 175, 170, 175, 175, 173, 175, 85, 268, + 85, 85, 87, 85, 86, 90, 88, 90, 90, 85, + 90, 86, 86, 86, 180, 86, 90, 91, 86, 181, + 182, 186, 86, 86, 185, 187, 191, 192, 86, 86, + 86, 86, 190, 171, 193, 200, 86, 86, 188, 86, + + 194, 86, 195, 86, 203, 86, 86, 196, 197, 211, + 199, 202, 198, 204, 201, 86, 205, 206, 207, 86, + 86, 210, 219, 86, 213, 208, 215, 86, 86, 216, + 86, 86, 86, 224, 214, 212, 222, 225, 86, 231, + 86, 86, 217, 218, 86, 230, 221, 220, 86, 86, + 86, 234, 86, 226, 229, 86, 223, 227, 235, 238, + 86, 232, 228, 86, 86, 86, 86, 240, 233, 86, + 237, 242, 245, 86, 246, 243, 86, 86, 239, 86, + 248, 244, 241, 86, 251, 247, 254, 86, 179, 249, + 258, 86, 86, 86, 261, 250, 86, 255, 253, 259, + + 257, 256, 86, 252, 260, 86, 86, 266, 86, 264, + 270, 262, 86, 86, 263, 86, 86, 274, 86, 271, + 265, 86, 269, 277, 267, 273, 301, 275, 161, 161, + 163, 272, 86, 163, 276, 278, 165, 171, 165, 165, + 279, 165, 168, 168, 170, 86, 170, 170, 90, 170, + 90, 90, 175, 90, 175, 175, 86, 175, 178, 178, + 173, 280, 281, 283, 86, 86, 86, 86, 86, 86, + 86, 86, 86, 86, 286, 86, 292, 282, 288, 284, + 86, 287, 295, 86, 291, 86, 294, 296, 285, 290, + 299, 86, 293, 86, 297, 86, 300, 302, 86, 86, + + 86, 328, 303, 311, 305, 298, 86, 310, 86, 306, + 312, 86, 86, 315, 307, 313, 86, 314, 86, 304, + 308, 309, 319, 316, 317, 86, 86, 86, 86, 321, + 86, 318, 322, 86, 86, 86, 86, 86, 86, 86, + 329, 330, 323, 336, 324, 86, 326, 86, 325, 327, + 86, 320, 86, 331, 339, 338, 332, 337, 333, 341, + 86, 86, 340, 343, 393, 86, 348, 344, 345, 86, + 334, 342, 335, 346, 86, 349, 351, 86, 86, 86, + 352, 86, 350, 86, 354, 86, 86, 353, 347, 86, + 86, 355, 357, 86, 86, 86, 356, 86, 86, 86, + + 359, 361, 86, 86, 86, 360, 358, 86, 86, 367, + 362, 365, 86, 86, 86, 366, 368, 86, 86, 363, + 372, 86, 374, 364, 370, 373, 86, 369, 86, 378, + 86, 86, 375, 371, 376, 86, 86, 382, 385, 86, + 377, 383, 381, 86, 384, 86, 379, 380, 86, 86, + 388, 389, 391, 86, 86, 387, 86, 86, 86, 86, + 394, 395, 86, 396, 386, 392, 398, 171, 390, 86, + 86, 86, 86, 399, 86, 402, 86, 401, 86, 403, + 86, 86, 86, 86, 405, 407, 410, 397, 409, 411, + 400, 86, 86, 404, 86, 86, 412, 414, 406, 413, + + 86, 86, 86, 86, 408, 86, 86, 421, 86, 86, + 426, 423, 422, 86, 418, 415, 416, 420, 86, 417, + 419, 86, 86, 424, 86, 425, 86, 428, 86, 429, + 86, 86, 86, 431, 433, 86, 86, 86, 438, 434, + 427, 86, 440, 86, 86, 435, 430, 432, 86, 86, + 436, 441, 442, 86, 445, 86, 437, 439, 86, 443, + 86, 447, 448, 86, 86, 446, 86, 86, 86, 86, + 86, 454, 86, 86, 86, 455, 444, 86, 457, 453, + 86, 86, 451, 450, 86, 460, 86, 449, 86, 462, + 452, 456, 86, 86, 86, 465, 458, 466, 459, 461, + + 464, 86, 474, 86, 467, 86, 463, 86, 86, 86, + 476, 483, 86, 86, 486, 487, 468, 86, 502, 469, + 490, 475, 484, 86, 470, 471, 472, 473, 86, 485, + 488, 477, 177, 478, 86, 489, 86, 491, 492, 86, + 86, 86, 86, 86, 86, 479, 480, 481, 86, 482, + 86, 499, 501, 86, 86, 503, 495, 493, 496, 500, + 494, 497, 498, 86, 504, 86, 86, 86, 86, 86, + 86, 507, 512, 505, 86, 513, 86, 514, 86, 508, + 506, 86, 86, 86, 519, 511, 515, 509, 518, 510, + 86, 531, 86, 516, 86, 86, 517, 520, 523, 521, + + 524, 86, 526, 86, 745, 522, 527, 533, 86, 86, + 532, 534, 86, 86, 86, 525, 86, 86, 86, 528, + 86, 535, 529, 549, 530, 86, 536, 86, 537, 551, + 86, 86, 86, 552, 538, 554, 176, 548, 539, 86, + 86, 550, 565, 540, 553, 556, 541, 86, 542, 566, + 543, 555, 567, 86, 86, 171, 86, 568, 86, 86, + 569, 86, 86, 544, 597, 574, 545, 570, 546, 576, + 547, 86, 572, 557, 558, 86, 571, 573, 575, 577, + 86, 86, 86, 559, 560, 561, 562, 563, 581, 86, + 564, 86, 86, 86, 86, 86, 580, 583, 582, 86, + + 588, 579, 86, 86, 589, 86, 578, 591, 587, 585, + 86, 586, 86, 86, 596, 584, 86, 590, 86, 592, + 86, 598, 594, 593, 86, 86, 595, 600, 601, 599, + 86, 86, 86, 86, 171, 86, 602, 86, 608, 607, + 86, 86, 609, 610, 86, 603, 86, 604, 605, 606, + 612, 86, 86, 615, 86, 613, 617, 86, 86, 631, + 611, 86, 86, 616, 86, 86, 621, 622, 86, 633, + 614, 632, 619, 618, 169, 620, 636, 635, 623, 86, + 624, 86, 86, 634, 86, 86, 625, 86, 86, 86, + 640, 638, 639, 86, 626, 627, 86, 86, 628, 629, + + 86, 641, 630, 86, 643, 637, 644, 645, 86, 642, + 86, 86, 648, 647, 649, 646, 86, 86, 652, 86, + 86, 650, 86, 86, 653, 86, 655, 654, 86, 86, + 86, 651, 86, 86, 656, 657, 661, 86, 86, 86, + 86, 665, 660, 663, 664, 86, 667, 659, 658, 86, + 86, 86, 666, 662, 668, 86, 670, 672, 86, 673, + 86, 86, 86, 86, 86, 86, 86, 86, 86, 675, + 86, 669, 679, 671, 677, 86, 86, 86, 686, 167, + 681, 674, 86, 676, 86, 678, 680, 691, 682, 688, + 683, 687, 86, 684, 690, 86, 685, 86, 86, 86, + + 86, 689, 695, 86, 86, 86, 693, 699, 86, 694, + 702, 692, 86, 86, 698, 701, 86, 696, 86, 697, + 86, 86, 86, 86, 86, 705, 708, 86, 700, 86, + 86, 86, 704, 86, 703, 710, 712, 86, 86, 86, + 86, 709, 711, 706, 707, 713, 86, 86, 86, 86, + 715, 727, 714, 86, 716, 726, 854, 86, 724, 717, + 725, 718, 729, 86, 730, 728, 86, 719, 86, 720, + 731, 86, 721, 722, 86, 740, 732, 86, 734, 723, + 733, 86, 735, 739, 737, 86, 741, 738, 86, 86, + 86, 86, 744, 86, 747, 86, 749, 86, 86, 86, + + 742, 86, 736, 86, 743, 86, 753, 86, 86, 86, + 746, 751, 750, 752, 756, 86, 748, 757, 86, 86, + 754, 86, 86, 86, 760, 755, 758, 762, 761, 171, + 759, 764, 86, 763, 765, 86, 766, 86, 769, 86, + 86, 86, 86, 86, 86, 772, 86, 778, 774, 768, + 86, 767, 86, 86, 770, 773, 777, 86, 771, 780, + 776, 86, 779, 781, 86, 86, 86, 775, 86, 86, + 86, 783, 86, 782, 86, 786, 86, 787, 784, 166, + 86, 785, 795, 86, 792, 788, 796, 86, 791, 793, + 86, 798, 789, 794, 797, 790, 86, 86, 799, 86, + + 800, 86, 801, 86, 802, 86, 86, 86, 86, 803, + 86, 86, 808, 86, 807, 86, 86, 86, 806, 811, + 86, 804, 812, 810, 86, 86, 805, 816, 815, 86, + 86, 86, 809, 86, 818, 86, 820, 86, 86, 822, + 86, 86, 86, 813, 814, 86, 829, 825, 86, 817, + 86, 821, 86, 819, 86, 823, 86, 86, 86, 830, + 86, 837, 824, 86, 826, 86, 827, 912, 828, 86, + 831, 86, 832, 86, 86, 836, 838, 833, 840, 839, + 834, 835, 86, 86, 844, 842, 86, 841, 86, 843, + 86, 846, 845, 86, 86, 86, 86, 847, 850, 849, + + 86, 851, 852, 86, 86, 86, 858, 86, 86, 856, + 86, 86, 86, 86, 86, 86, 855, 859, 853, 848, + 861, 86, 865, 86, 86, 857, 863, 869, 867, 860, + 864, 86, 862, 866, 86, 870, 871, 868, 86, 872, + 86, 86, 86, 873, 86, 86, 874, 86, 86, 880, + 86, 86, 878, 883, 86, 86, 881, 882, 876, 877, + 875, 86, 86, 86, 887, 86, 885, 879, 86, 888, + 86, 86, 86, 86, 894, 86, 164, 891, 886, 884, + 86, 889, 896, 86, 890, 898, 86, 899, 897, 86, + 86, 892, 893, 904, 895, 86, 900, 901, 902, 86, + + 86, 86, 908, 86, 910, 86, 906, 909, 86, 86, + 86, 86, 905, 903, 86, 86, 907, 914, 86, 86, + 86, 921, 86, 86, 86, 86, 922, 86, 913, 916, + 911, 915, 917, 923, 86, 86, 918, 86, 919, 86, + 920, 926, 928, 86, 927, 86, 86, 931, 86, 924, + 925, 929, 930, 86, 86, 86, 86, 86, 934, 933, + 938, 86, 86, 932, 86, 86, 86, 935, 86, 948, + 86, 86, 86, 940, 937, 936, 946, 86, 86, 939, + 941, 949, 942, 943, 944, 945, 947, 86, 86, 951, + 86, 86, 950, 86, 86, 954, 86, 86, 952, 86, + + 86, 958, 953, 86, 959, 962, 86, 955, 86, 957, + 960, 963, 956, 86, 86, 86, 86, 162, 86, 171, + 965, 961, 970, 966, 971, 968, 964, 86, 86, 967, + 969, 86, 86, 86, 972, 86, 973, 86, 86, 86, + 977, 974, 975, 980, 86, 86, 981, 983, 86, 86, + 976, 86, 978, 86, 982, 987, 984, 86, 985, 86, + 979, 86, 86, 86, 86, 86, 990, 994, 86, 86, + 86, 86, 986, 86, 86, 991, 988, 995, 996, 989, + 86, 1008, 86, 993, 86, 86, 997, 86, 86, 992, + 86, 86, 1058, 1011, 999, 998, 86, 1007, 1000, 1010, + + 86, 1001, 1009, 86, 86, 1002, 1013, 1015, 1003, 86, + 1012, 86, 1014, 1016, 86, 1004, 1005, 86, 1006, 86, + 1017, 86, 1018, 86, 1022, 1019, 1023, 86, 86, 1020, + 86, 1021, 86, 86, 1024, 1025, 86, 1026, 86, 86, + 1027, 1033, 1036, 1032, 86, 1028, 1035, 86, 1034, 86, + 86, 1029, 1030, 1038, 1031, 1040, 86, 86, 86, 1043, + 1057, 1042, 86, 1037, 86, 1045, 1041, 1046, 86, 1039, + 179, 1048, 1047, 86, 86, 1049, 86, 86, 1052, 86, + 86, 1051, 1044, 1050, 1053, 86, 86, 86, 1054, 1056, + 86, 1055, 86, 86, 86, 86, 1060, 86, 1064, 1059, + + 86, 86, 1063, 86, 1067, 86, 86, 1061, 86, 1071, + 1065, 86, 1062, 1072, 1066, 86, 1076, 1069, 1074, 1068, + 1073, 86, 86, 1075, 86, 1077, 86, 86, 1070, 1081, + 1083, 86, 86, 86, 86, 86, 86, 1082, 86, 1085, + 1078, 1084, 1086, 1087, 86, 1079, 86, 1080, 1088, 86, + 86, 86, 86, 86, 86, 86, 86, 1092, 1090, 1093, + 1094, 86, 1098, 86, 1089, 86, 1101, 86, 86, 1091, + 86, 86, 1095, 1102, 1099, 1097, 1100, 1096, 86, 86, + 86, 86, 86, 86, 86, 1110, 86, 1105, 1103, 1106, + 1104, 1108, 1109, 86, 86, 86, 1116, 86, 1111, 86, + + 86, 1117, 86, 86, 1114, 1107, 86, 1119, 1112, 1113, + 1115, 86, 86, 1118, 86, 1120, 86, 1128, 86, 1125, + 1122, 86, 1121, 1127, 86, 86, 86, 1126, 86, 86, + 1130, 86, 1124, 1132, 86, 86, 1123, 86, 86, 86, + 86, 86, 1142, 1139, 86, 1129, 1137, 1131, 86, 1133, + 86, 1134, 86, 1143, 86, 1136, 1135, 86, 1140, 86, + 1141, 1138, 1144, 86, 86, 1148, 1152, 86, 1145, 86, + 86, 1147, 1149, 1146, 1151, 86, 86, 1150, 86, 86, + 86, 86, 86, 86, 86, 1155, 86, 1157, 1163, 1153, + 1164, 86, 86, 1166, 86, 1154, 86, 1165, 1156, 86, + + 1158, 1160, 1169, 1159, 1161, 1167, 1162, 1170, 86, 86, + 86, 86, 1168, 86, 1171, 86, 86, 86, 1177, 1178, + 1175, 1179, 86, 1173, 86, 86, 86, 86, 1172, 1180, + 86, 1174, 1183, 1185, 86, 86, 86, 1176, 86, 86, + 1181, 1187, 1188, 1182, 1184, 1191, 86, 86, 86, 86, + 1192, 171, 1194, 1186, 86, 1189, 86, 1190, 86, 1195, + 86, 1193, 86, 86, 1198, 1199, 86, 86, 86, 1196, + 86, 86, 86, 1213, 1197, 1200, 1212, 1202, 86, 1203, + 1216, 86, 1214, 86, 86, 1215, 1201, 1204, 1218, 1205, + 86, 86, 86, 1206, 177, 1207, 86, 86, 1223, 1208, + + 86, 1209, 1221, 1224, 86, 1220, 1210, 1219, 1217, 1225, + 1222, 1211, 86, 86, 86, 86, 86, 1227, 86, 1233, + 86, 1230, 86, 1235, 86, 86, 1226, 86, 86, 1228, + 1229, 1231, 1232, 1239, 1238, 86, 1234, 86, 1242, 1236, + 1241, 1237, 1243, 1240, 86, 1244, 86, 1245, 86, 1246, + 86, 86, 86, 86, 86, 86, 86, 86, 86, 1261, + 86, 1258, 86, 86, 86, 1262, 1257, 86, 86, 1260, + 1248, 1249, 1247, 86, 1250, 1263, 1259, 1264, 86, 1251, + 1265, 1252, 1266, 86, 86, 1270, 86, 1253, 86, 86, + 86, 86, 1254, 1255, 1271, 86, 86, 1267, 1272, 1256, + + 1269, 86, 1268, 1277, 86, 1278, 1273, 86, 1275, 1280, + 86, 1274, 86, 1281, 1276, 86, 86, 86, 1285, 86, + 86, 1283, 86, 86, 86, 1286, 86, 1279, 86, 86, + 1284, 1282, 1288, 1291, 86, 1289, 86, 86, 1287, 86, + 86, 1293, 1294, 1292, 1290, 86, 86, 86, 86, 1295, + 1296, 86, 1303, 86, 1301, 1299, 1300, 1298, 86, 86, + 1297, 86, 86, 86, 86, 86, 1309, 86, 1302, 1304, + 1308, 86, 86, 1305, 86, 86, 86, 1319, 1311, 1314, + 1315, 1306, 1310, 86, 86, 1312, 1313, 1307, 1316, 1317, + 86, 1320, 1321, 86, 86, 86, 86, 86, 86, 1318, + + 1326, 86, 1322, 86, 1328, 1327, 86, 1329, 1324, 1323, + 86, 86, 1325, 1331, 86, 86, 1330, 86, 86, 86, + 1338, 86, 1340, 86, 86, 1332, 86, 86, 86, 1342, + 86, 1334, 1336, 1337, 1333, 1335, 86, 1344, 1341, 86, + 86, 1339, 1345, 86, 1343, 1347, 86, 86, 1346, 86, + 86, 1348, 86, 86, 1351, 1352, 1350, 86, 86, 1349, + 86, 1358, 86, 1354, 1353, 86, 1356, 86, 86, 1355, + 1359, 86, 86, 86, 1360, 1362, 86, 1363, 86, 1357, + 1361, 86, 86, 1369, 1367, 1370, 1364, 1371, 86, 86, + 86, 86, 1365, 86, 86, 1368, 86, 1374, 1366, 1372, + + 86, 1373, 1376, 86, 86, 1375, 1378, 1380, 86, 1377, + 1379, 86, 86, 86, 1382, 86, 1381, 86, 86, 86, + 86, 1383, 86, 1385, 86, 1388, 1384, 1389, 86, 86, + 86, 86, 86, 1391, 86, 1395, 1396, 1386, 86, 1387, + 1390, 86, 86, 1393, 86, 86, 1399, 86, 1392, 1397, + 1398, 1394, 86, 86, 86, 1404, 86, 1400, 1401, 86, + 86, 86, 86, 171, 1402, 1406, 1410, 86, 86, 86, + 86, 1403, 1405, 86, 1412, 1413, 1411, 86, 86, 1407, + 86, 1409, 86, 1414, 86, 1418, 1408, 1415, 1421, 86, + 1417, 1419, 1416, 86, 1423, 1424, 86, 86, 86, 1420, + + 86, 86, 1426, 86, 86, 1427, 86, 86, 86, 1428, + 86, 86, 1425, 1422, 1434, 1431, 86, 1433, 86, 86, + 1429, 1430, 86, 1432, 86, 1435, 1438, 86, 86, 86, + 86, 1436, 86, 86, 1449, 1442, 1439, 1444, 1437, 86, + 86, 86, 1440, 1441, 1448, 86, 1445, 86, 1446, 86, + 1443, 1447, 1450, 1451, 86, 1453, 1452, 86, 1455, 86, + 1454, 86, 86, 1456, 86, 1461, 1458, 86, 1457, 86, + 86, 86, 1462, 86, 1466, 86, 1460, 86, 86, 86, + 86, 1459, 1467, 1463, 1464, 1468, 86, 86, 86, 1465, + 86, 1470, 1471, 86, 1473, 86, 1472, 86, 1469, 86, + + 1476, 86, 86, 86, 86, 1474, 1479, 86, 86, 1477, + 1478, 86, 1475, 1480, 1484, 86, 86, 1487, 1486, 86, + 86, 1481, 1483, 86, 1482, 86, 1485, 86, 1490, 86, + 86, 1497, 86, 86, 86, 1488, 1489, 86, 1499, 1492, + 1491, 1493, 86, 86, 86, 86, 1494, 1496, 86, 1500, + 86, 1502, 86, 1498, 1507, 1495, 1501, 1505, 86, 1508, + 86, 86, 1506, 86, 1504, 1503, 86, 1512, 86, 86, + 1523, 86, 86, 1529, 176, 1510, 1511, 1509, 86, 1513, + 1521, 1520, 1522, 1514, 86, 86, 1515, 1516, 86, 1524, + 1526, 1517, 86, 86, 1525, 86, 86, 1518, 1527, 86, + + 1528, 1519, 86, 1531, 86, 86, 1536, 1532, 1537, 1533, + 86, 86, 86, 1530, 86, 86, 86, 86, 1538, 1534, + 1539, 1541, 86, 1535, 86, 86, 1544, 86, 1546, 1547, + 1540, 1542, 86, 1545, 86, 86, 86, 86, 1549, 1548, + 1543, 86, 1555, 86, 1557, 1550, 1558, 1559, 86, 86, + 1551, 86, 1552, 86, 1553, 1556, 1554, 1561, 86, 1560, + 86, 86, 1566, 86, 86, 86, 1562, 1567, 86, 1565, + 1570, 86, 1568, 86, 86, 86, 86, 1576, 1563, 1564, + 86, 1577, 1572, 86, 86, 1571, 1569, 86, 86, 86, + 1575, 86, 86, 1573, 1574, 1579, 1578, 1581, 86, 86, + + 1583, 86, 1580, 1582, 86, 1584, 1588, 86, 86, 1587, + 1590, 86, 86, 86, 1592, 86, 86, 1585, 1591, 1593, + 1594, 86, 86, 1589, 1597, 86, 1586, 86, 1599, 86, + 86, 1596, 86, 1600, 86, 1601, 86, 86, 1605, 86, + 1595, 86, 86, 86, 86, 1610, 1608, 1598, 86, 86, + 86, 86, 1613, 1611, 86, 1602, 86, 1603, 1604, 1607, + 86, 1606, 86, 1612, 1609, 1615, 86, 1614, 86, 86, + 86, 1616, 86, 1617, 1618, 1620, 1621, 1622, 86, 86, + 1619, 1623, 86, 1625, 1624, 86, 86, 86, 86, 86, + 1626, 1631, 1632, 1628, 86, 1629, 86, 86, 86, 1633, + + 1635, 1634, 1630, 86, 1627, 86, 86, 86, 1639, 86, + 86, 86, 1636, 86, 171, 86, 1641, 86, 1638, 86, + 1647, 1648, 86, 86, 1637, 1643, 86, 86, 1649, 1644, + 1640, 1642, 1651, 86, 1650, 86, 86, 1645, 86, 86, + 86, 86, 1646, 86, 1659, 86, 86, 1652, 86, 86, + 86, 1656, 86, 1653, 1657, 1654, 1655, 1663, 86, 1658, + 1665, 86, 86, 1667, 1669, 1660, 1662, 1664, 86, 1670, + 86, 1661, 86, 1666, 86, 86, 86, 86, 86, 86, + 1673, 1668, 86, 1672, 1678, 86, 1671, 1679, 86, 1674, + 1681, 1675, 1676, 1683, 1680, 1677, 1682, 86, 86, 86, + + 1686, 1684, 86, 86, 1689, 1687, 86, 86, 1691, 1685, + 86, 86, 86, 86, 86, 1692, 1693, 86, 86, 1696, + 86, 1688, 86, 86, 1701, 1690, 86, 86, 86, 1705, + 1694, 1702, 1698, 1695, 86, 86, 86, 1697, 1699, 86, + 1700, 86, 86, 86, 1703, 86, 1706, 1704, 86, 86, + 86, 86, 1707, 1713, 86, 1709, 1714, 1710, 1708, 1715, + 1711, 86, 1712, 86, 86, 1717, 86, 1720, 1716, 86, + 86, 1725, 1719, 86, 1724, 1726, 86, 86, 1722, 1721, + 86, 86, 1718, 86, 1728, 1729, 86, 86, 86, 1734, + 1723, 86, 1731, 1730, 1727, 86, 1733, 1735, 1736, 86, + + 1737, 86, 1738, 86, 86, 1741, 86, 86, 86, 1732, + 86, 1742, 86, 86, 86, 86, 86, 1743, 86, 1749, + 86, 1739, 1748, 1740, 1745, 86, 86, 1746, 1744, 1747, + 86, 1752, 1755, 1751, 1753, 1757, 1750, 1756, 86, 86, + 1758, 86, 86, 1760, 86, 86, 86, 86, 86, 1754, + 86, 86, 1764, 86, 1768, 1763, 86, 86, 1769, 1759, + 86, 86, 86, 1761, 1762, 1774, 86, 1765, 86, 1767, + 1766, 86, 86, 1777, 1770, 86, 1772, 1771, 1776, 86, + 86, 86, 86, 86, 1779, 1775, 86, 1778, 1773, 86, + 86, 86, 1787, 86, 86, 86, 1788, 86, 171, 1780, + + 1781, 1782, 1783, 1784, 86, 1786, 86, 1785, 1795, 1791, + 1792, 86, 86, 1789, 1790, 1793, 86, 1794, 86, 1796, + 86, 86, 86, 86, 1800, 86, 86, 86, 1801, 1798, + 86, 1804, 86, 1797, 1799, 1808, 86, 1809, 1805, 1810, + 86, 1802, 1813, 1803, 86, 86, 1807, 1806, 86, 86, + 86, 86, 86, 86, 1814, 1811, 1815, 1812, 86, 86, + 1821, 86, 1816, 1822, 86, 1824, 86, 86, 1819, 1818, + 1817, 86, 86, 1820, 86, 1827, 1828, 1826, 86, 1823, + 1830, 86, 86, 86, 1832, 86, 1831, 86, 1825, 86, + 86, 86, 86, 86, 1836, 86, 86, 86, 1829, 86, + + 1841, 86, 1839, 1833, 86, 1834, 1835, 86, 86, 86, + 86, 1847, 1842, 1837, 1845, 1838, 1840, 86, 86, 1848, + 86, 1846, 1843, 1844, 86, 1851, 1850, 86, 86, 1849, + 86, 1854, 86, 86, 1859, 86, 86, 86, 1857, 86, + 86, 1860, 1855, 86, 1862, 86, 86, 1853, 86, 1852, + 1856, 1858, 1866, 86, 86, 86, 86, 1865, 86, 1861, + 1868, 1870, 1863, 86, 1864, 1869, 86, 1871, 1872, 171, + 86, 86, 1867, 86, 1874, 86, 86, 86, 86, 1881, + 169, 1882, 86, 86, 1875, 1873, 1880, 1878, 1885, 86, + 1876, 1877, 86, 86, 86, 86, 86, 1889, 1887, 86, + + 1879, 1886, 1883, 1884, 1890, 1891, 1893, 86, 86, 1896, + 86, 86, 86, 1894, 1888, 86, 1892, 86, 86, 86, + 86, 1895, 86, 1898, 1899, 86, 1901, 86, 1902, 86, + 86, 86, 1907, 1906, 1897, 86, 1903, 86, 1904, 86, + 86, 1914, 1900, 1911, 1905, 86, 1912, 86, 86, 1909, + 1915, 1916, 86, 1908, 86, 86, 1922, 86, 1913, 1910, + 1919, 1918, 86, 86, 1924, 1921, 1925, 1917, 86, 86, + 86, 86, 86, 1926, 86, 1927, 86, 1928, 1929, 1920, + 86, 86, 1931, 86, 86, 1930, 1936, 1923, 86, 1932, + 1937, 1935, 86, 1938, 86, 1940, 86, 86, 86, 86, + + 1933, 86, 1939, 1934, 86, 1943, 86, 86, 86, 1942, + 86, 86, 1944, 86, 86, 86, 1945, 1941, 86, 86, + 86, 86, 86, 1956, 86, 1947, 1955, 86, 1946, 1950, + 1948, 86, 1951, 1949, 1952, 86, 86, 1953, 1958, 1954, + 1961, 86, 86, 1957, 1962, 86, 86, 1959, 1960, 86, + 86, 86, 1967, 86, 1969, 86, 1971, 86, 1964, 86, + 1966, 1963, 86, 86, 1970, 1965, 86, 1973, 86, 1975, + 1968, 1972, 86, 86, 1976, 1974, 86, 86, 86, 86, + 1977, 86, 86, 86, 167, 1980, 1982, 1983, 1990, 86, + 1984, 1979, 1981, 1991, 86, 86, 1978, 1985, 1986, 86, + + 86, 86, 1989, 1987, 1994, 1995, 86, 1988, 86, 86, + 86, 86, 1992, 1993, 86, 1998, 1999, 2000, 86, 86, + 86, 1996, 86, 86, 2002, 86, 86, 86, 1997, 2012, + 86, 86, 2005, 86, 86, 2007, 2004, 2011, 2008, 2001, + 2010, 2003, 86, 86, 2006, 86, 86, 2015, 86, 2013, + 2019, 2009, 86, 2014, 86, 2020, 86, 2021, 86, 86, + 2017, 86, 2025, 2016, 2018, 86, 2022, 86, 2026, 86, + 86, 2029, 86, 2031, 86, 2030, 2028, 2024, 86, 86, + 86, 86, 86, 2023, 2039, 2027, 2035, 2032, 2033, 2040, + 86, 2034, 2036, 86, 86, 86, 2041, 86, 2038, 2037, + + 2044, 2046, 86, 2048, 86, 86, 2049, 86, 2042, 86, + 2050, 2045, 86, 2052, 86, 86, 2043, 86, 86, 86, + 2047, 2053, 2057, 2051, 86, 86, 86, 2059, 86, 2061, + 86, 86, 2056, 2060, 2054, 86, 86, 2055, 2058, 2062, + 86, 86, 86, 86, 86, 2063, 2067, 86, 2066, 2064, + 86, 2068, 86, 2070, 86, 2065, 2069, 2074, 86, 2076, + 2071, 2077, 86, 86, 2072, 86, 2073, 86, 86, 2080, + 86, 2078, 86, 86, 2081, 2079, 2084, 86, 2086, 2075, + 86, 2082, 86, 86, 86, 86, 2085, 2090, 86, 86, + 86, 2083, 86, 2092, 86, 2093, 86, 86, 2088, 2095, + + 86, 2089, 2087, 86, 86, 2091, 2097, 86, 2096, 171, + 2101, 2099, 2094, 2100, 86, 2104, 86, 86, 86, 2098, + 86, 2102, 2108, 86, 86, 86, 86, 86, 86, 2103, + 2106, 2109, 2111, 86, 86, 2116, 2105, 86, 2110, 2107, + 2112, 86, 86, 86, 86, 2113, 2114, 2120, 86, 2117, + 2119, 166, 86, 86, 2115, 2121, 2123, 86, 2124, 86, + 2118, 2126, 86, 2122, 2127, 86, 86, 86, 2125, 86, + 86, 2129, 86, 2130, 2128, 86, 86, 86, 86, 86, + 86, 2135, 86, 2136, 86, 86, 2131, 86, 2137, 2140, + 86, 86, 2138, 2133, 2132, 2134, 2141, 2139, 86, 86, + + 2148, 86, 2149, 2144, 2146, 2143, 2147, 86, 86, 2142, + 2145, 2150, 86, 86, 86, 86, 86, 86, 2156, 86, + 86, 86, 2159, 2151, 2160, 86, 2161, 86, 2163, 86, + 2154, 2152, 2153, 86, 2157, 2155, 2158, 2162, 86, 2164, + 2165, 86, 2168, 86, 86, 2170, 86, 2172, 2169, 2171, + 86, 86, 2174, 86, 2166, 86, 86, 86, 86, 86, + 86, 2176, 2167, 2178, 2179, 86, 86, 86, 2173, 2182, + 86, 2181, 86, 86, 2187, 86, 86, 2189, 2175, 2180, + 2185, 2186, 2177, 86, 86, 86, 86, 2183, 2184, 2188, + 86, 86, 86, 86, 2197, 86, 86, 2190, 2191, 2192, + + 86, 2201, 2200, 86, 2193, 86, 2194, 86, 2195, 2202, + 86, 2196, 2198, 2199, 2203, 86, 86, 2204, 2206, 2209, + 2205, 2207, 2208, 86, 86, 86, 86, 2213, 86, 86, + 86, 2215, 2210, 86, 86, 86, 2218, 2219, 86, 86, + 2221, 86, 86, 86, 2211, 86, 86, 2212, 86, 86, + 86, 2226, 2223, 2216, 2224, 2214, 2217, 86, 86, 2220, + 2230, 86, 86, 2229, 86, 2227, 2228, 2222, 86, 2225, + 86, 2233, 86, 86, 2236, 2237, 86, 2232, 2240, 2231, + 86, 2234, 86, 2242, 86, 2241, 86, 2245, 86, 86, + 86, 86, 2246, 86, 2235, 2244, 2238, 2248, 2239, 2249, + + 86, 86, 86, 86, 86, 86, 2243, 2250, 86, 86, + 2247, 86, 2255, 2251, 86, 86, 2252, 2257, 86, 86, + 2260, 86, 2261, 2256, 2262, 2253, 86, 2254, 86, 86, + 86, 86, 86, 2258, 86, 86, 2265, 2270, 86, 2269, + 86, 2263, 86, 86, 2259, 164, 2264, 86, 2268, 2267, + 86, 2275, 2266, 86, 2276, 2273, 2277, 86, 86, 2271, + 86, 2272, 2274, 2279, 86, 86, 2278, 2280, 86, 2281, + 86, 2282, 2284, 86, 86, 86, 2283, 86, 86, 86, + 2288, 2292, 86, 86, 2286, 162, 86, 86, 2295, 2285, + 86, 2297, 86, 2287, 86, 2298, 86, 2289, 2290, 2291, + + 2293, 2294, 86, 2296, 86, 2300, 2299, 86, 86, 2305, + 86, 2306, 86, 2304, 86, 2301, 2307, 2309, 2310, 86, + 2302, 2308, 86, 86, 86, 86, 2314, 2303, 86, 86, + 2312, 2313, 86, 86, 86, 86, 2318, 2316, 2320, 86, + 2311, 2315, 2322, 86, 86, 86, 2317, 171, 86, 2323, + 86, 86, 2326, 2319, 86, 86, 2331, 86, 86, 86, + 86, 2321, 2324, 2327, 2330, 2325, 2328, 86, 86, 2333, + 2332, 2334, 86, 2337, 2329, 2335, 86, 86, 2336, 86, + 86, 86, 86, 2338, 86, 2339, 86, 2340, 86, 2342, + 86, 2341, 2343, 86, 86, 86, 2346, 2344, 2345, 86, + + 2347, 86, 2348, 86, 2349, 2350, 86, 86, 2352, 86, + 2351, 86, 2353, 86, 2354, 2355, 86, 86, 86, 86, + 86, 2362, 2357, 2360, 86, 2361, 86, 86, 86, 2356, + 86, 86, 3777, 86, 86, 2358, 86, 2359, 86, 2364, + 86, 2367, 2363, 2370, 2365, 2366, 2369, 2371, 86, 2373, + 86, 86, 2368, 2372, 86, 86, 86, 2376, 86, 2374, + 2377, 2379, 86, 2375, 86, 86, 86, 2378, 2380, 86, + 2386, 86, 2381, 86, 2382, 2389, 86, 86, 2388, 86, + 2383, 2384, 86, 2385, 2392, 86, 86, 86, 2387, 2394, + 86, 86, 2395, 2390, 2393, 86, 2398, 86, 86, 86, + + 2391, 2397, 86, 86, 86, 2400, 86, 2403, 86, 2404, + 2396, 2399, 86, 86, 86, 86, 86, 2405, 86, 3777, + 86, 2401, 86, 2402, 2407, 2406, 2408, 2410, 2409, 2412, + 2414, 86, 86, 2413, 86, 2415, 86, 86, 86, 2417, + 2418, 86, 2411, 2419, 86, 2416, 2423, 2424, 86, 86, + 86, 2421, 2427, 3777, 86, 2422, 2420, 86, 2426, 2425, + 86, 86, 2428, 2431, 2429, 2430, 86, 86, 2432, 86, + 86, 2433, 2436, 86, 2434, 86, 86, 2439, 2435, 2437, + 86, 2442, 86, 86, 86, 2438, 2444, 86, 2446, 86, + 86, 86, 86, 86, 2449, 2440, 2448, 2445, 2450, 86, + + 2441, 86, 2443, 86, 2451, 86, 2455, 86, 86, 2459, + 86, 86, 86, 2456, 2460, 86, 2447, 86, 86, 2452, + 2457, 2453, 2458, 86, 86, 2454, 2461, 2465, 86, 86, + 2462, 2463, 86, 2466, 86, 2464, 2470, 86, 86, 2468, + 2467, 86, 86, 2471, 86, 86, 2472, 2476, 86, 2474, + 86, 86, 2478, 86, 2469, 2473, 86, 2475, 86, 2479, + 86, 86, 2477, 2482, 2483, 2480, 2481, 86, 86, 86, + 2486, 86, 2488, 86, 2487, 86, 2484, 2489, 86, 2485, + 2491, 2490, 86, 86, 86, 2492, 86, 86, 2493, 2495, + 86, 2496, 2501, 86, 2494, 2498, 2497, 86, 86, 2500, + + 86, 86, 86, 86, 86, 86, 86, 2499, 2509, 86, + 86, 86, 86, 86, 2513, 2502, 2503, 2505, 2504, 2507, + 86, 2508, 2510, 2511, 2512, 2514, 86, 2506, 86, 86, + 2516, 86, 86, 86, 2517, 2515, 2520, 2519, 86, 86, + 2525, 86, 86, 86, 2521, 2527, 86, 2518, 2524, 86, + 2522, 2526, 86, 2530, 86, 86, 2528, 2531, 2523, 2534, + 171, 86, 2529, 2536, 2538, 86, 2539, 2532, 2537, 86, + 86, 86, 86, 86, 2533, 86, 2540, 2543, 86, 2541, + 86, 2542, 2535, 86, 2544, 2548, 86, 86, 2549, 2547, + 86, 2552, 86, 2551, 86, 86, 2554, 86, 2545, 2553, + + 2555, 86, 2550, 86, 2557, 86, 86, 86, 2556, 2546, + 86, 2558, 2559, 86, 86, 86, 86, 2560, 86, 2563, + 86, 2566, 86, 86, 86, 2561, 86, 2572, 86, 2570, + 86, 2562, 86, 2565, 2573, 86, 2568, 86, 2564, 86, + 2567, 86, 2575, 2569, 86, 86, 86, 2574, 2571, 86, + 86, 2581, 86, 2576, 2584, 86, 2579, 86, 86, 2578, + 2585, 86, 2582, 86, 2580, 2577, 86, 86, 2583, 86, + 86, 86, 2595, 86, 86, 2596, 2586, 2587, 86, 2593, + 2588, 86, 86, 86, 86, 2601, 2589, 2599, 2591, 2597, + 2590, 2592, 2594, 86, 86, 2598, 2603, 86, 86, 2600, + + 86, 86, 86, 2604, 2602, 2605, 86, 2606, 86, 2610, + 2611, 86, 86, 86, 2612, 2608, 2613, 86, 86, 2609, + 86, 86, 86, 2617, 2607, 86, 2618, 3777, 2614, 2619, + 86, 86, 2620, 2615, 2616, 2621, 86, 2622, 86, 2625, + 86, 2626, 86, 86, 86, 2629, 86, 2623, 2627, 2628, + 2624, 86, 2632, 86, 2633, 86, 86, 2635, 86, 86, + 2637, 86, 86, 2631, 86, 86, 2630, 2639, 2640, 86, + 2641, 86, 86, 86, 2643, 2634, 86, 2636, 86, 2638, + 86, 2644, 2646, 86, 86, 86, 2642, 2650, 86, 2649, + 2645, 86, 2647, 2652, 86, 2648, 86, 86, 86, 86, + + 86, 2654, 2656, 2655, 2651, 86, 2657, 2659, 86, 2653, + 86, 86, 2662, 86, 2666, 2661, 86, 2660, 2665, 86, + 86, 2658, 86, 86, 86, 86, 2663, 2672, 86, 2671, + 86, 86, 2664, 86, 86, 86, 2667, 2668, 2674, 2670, + 86, 2676, 2678, 86, 86, 86, 2669, 86, 2681, 2673, + 2675, 2679, 2680, 86, 86, 2677, 86, 2686, 86, 86, + 86, 2688, 2682, 86, 2692, 2683, 2689, 2687, 2684, 86, + 86, 86, 2693, 86, 2694, 86, 2695, 86, 2696, 86, + 2685, 2690, 86, 2691, 86, 86, 86, 86, 2700, 2701, + 2698, 2703, 2704, 86, 86, 2707, 2708, 86, 2705, 86, + + 2697, 86, 86, 2699, 2711, 86, 86, 86, 86, 2706, + 86, 2702, 2712, 2713, 2710, 86, 86, 86, 2709, 2715, + 2716, 2723, 86, 86, 86, 2718, 86, 86, 2724, 86, + 2714, 2719, 2720, 2721, 86, 2717, 86, 86, 86, 2730, + 2722, 2725, 86, 2729, 86, 86, 86, 2728, 86, 2726, + 86, 2731, 171, 2733, 86, 2734, 2727, 2735, 86, 2732, + 2740, 86, 86, 86, 2738, 86, 2736, 86, 2737, 86, + 86, 86, 2742, 86, 2739, 86, 2747, 2741, 86, 2743, + 2748, 2744, 2746, 2756, 2745, 2751, 86, 86, 2752, 86, + 2750, 2749, 2753, 86, 86, 86, 2757, 2754, 86, 86, + + 2755, 86, 86, 2759, 86, 86, 2761, 2758, 86, 86, + 86, 2765, 2766, 2760, 86, 2763, 86, 86, 86, 2768, + 2762, 2769, 86, 2771, 86, 2770, 86, 86, 2764, 86, + 2767, 2772, 2773, 86, 86, 86, 2778, 86, 2774, 2777, + 86, 86, 2775, 86, 86, 86, 2780, 86, 86, 86, + 86, 2788, 2785, 2779, 2776, 2787, 86, 86, 86, 2790, + 86, 2784, 2789, 2781, 2782, 2783, 86, 2791, 86, 2786, + 86, 86, 86, 2797, 86, 2801, 2795, 86, 2792, 86, + 86, 86, 2800, 86, 2802, 2804, 86, 2793, 86, 2794, + 86, 2798, 86, 2796, 2803, 86, 2799, 2805, 86, 2808, + + 86, 86, 2810, 2809, 86, 86, 2806, 2811, 86, 2807, + 86, 2813, 86, 2815, 86, 2817, 86, 86, 2816, 86, + 2812, 86, 2819, 86, 2821, 86, 2820, 86, 2818, 86, + 86, 86, 86, 86, 86, 2825, 2814, 2822, 86, 2829, + 86, 2823, 86, 2830, 86, 2824, 2831, 86, 2832, 86, + 2827, 86, 2833, 86, 2828, 86, 2835, 2826, 86, 86, + 2834, 86, 2840, 2839, 2837, 2841, 2838, 2836, 86, 2843, + 86, 86, 86, 86, 86, 86, 2847, 2850, 86, 2846, + 2842, 2845, 86, 86, 86, 86, 2851, 2844, 86, 86, + 2849, 86, 2848, 86, 2856, 2857, 86, 86, 86, 86, + + 2860, 2863, 2858, 2852, 2853, 2854, 2855, 2859, 86, 86, + 86, 2861, 86, 2862, 86, 86, 86, 2867, 2871, 86, + 86, 86, 86, 2864, 2865, 2870, 2866, 2873, 86, 2874, + 86, 2875, 86, 2876, 86, 2868, 2869, 2872, 86, 86, + 2877, 86, 2880, 86, 2879, 86, 2881, 86, 2882, 86, + 86, 86, 2878, 86, 86, 2883, 2889, 86, 86, 2891, + 86, 86, 2885, 2892, 86, 2894, 86, 86, 86, 2884, + 2888, 2886, 2893, 86, 2887, 2896, 86, 2890, 86, 2895, + 86, 86, 86, 2899, 86, 2897, 2902, 86, 2904, 86, + 86, 2903, 86, 86, 86, 171, 2898, 86, 86, 2913, + + 2900, 2901, 86, 2907, 2911, 86, 86, 2912, 2909, 86, + 2905, 86, 2906, 86, 2914, 86, 86, 2908, 86, 2910, + 86, 2915, 86, 2920, 2916, 2955, 86, 2922, 86, 2917, + 2921, 2923, 2924, 86, 86, 2918, 2925, 86, 2919, 86, + 2926, 86, 2927, 86, 2928, 2930, 2929, 86, 86, 86, + 86, 86, 86, 86, 86, 86, 86, 2939, 3777, 86, + 86, 86, 2937, 2932, 86, 2943, 2931, 86, 2934, 2933, + 86, 2944, 2936, 2935, 2938, 2946, 2940, 2941, 2942, 2945, + 86, 86, 2949, 86, 86, 2951, 86, 86, 86, 86, + 2948, 86, 2947, 2950, 86, 86, 86, 86, 86, 86, + + 3777, 2961, 2963, 86, 86, 2952, 2953, 2954, 86, 2956, + 2960, 2962, 86, 2957, 2958, 2959, 2964, 86, 2965, 86, + 2968, 86, 2969, 86, 2970, 2967, 2966, 86, 86, 86, + 86, 2974, 86, 86, 2977, 86, 86, 2976, 86, 86, + 86, 86, 86, 86, 2973, 2971, 2972, 2975, 2984, 2986, + 86, 2981, 2982, 86, 86, 2985, 2978, 86, 2979, 2980, + 86, 86, 2983, 2987, 2988, 86, 2990, 86, 86, 86, + 86, 86, 86, 2989, 2994, 86, 2996, 86, 86, 2991, + 2992, 86, 3002, 86, 3001, 86, 86, 2993, 3005, 86, + 2995, 86, 2997, 86, 2998, 86, 3000, 2999, 86, 3008, + + 3003, 86, 3006, 86, 3004, 86, 86, 86, 3007, 3011, + 3012, 3013, 86, 3009, 86, 86, 3010, 86, 3014, 86, + 3020, 86, 3015, 3018, 86, 86, 86, 86, 3024, 86, + 3023, 3025, 86, 3022, 3016, 86, 3017, 3021, 86, 3019, + 3027, 86, 86, 3028, 3029, 86, 86, 86, 3026, 3033, + 86, 86, 3035, 86, 86, 3038, 86, 3031, 3030, 86, + 86, 86, 3036, 3045, 86, 86, 3032, 86, 3034, 86, + 86, 86, 3039, 3040, 3041, 86, 3037, 86, 3042, 3043, + 3044, 86, 3047, 3048, 86, 3046, 3049, 86, 86, 3051, + 86, 86, 3050, 3052, 86, 86, 3054, 86, 3053, 86, + + 3055, 86, 3056, 86, 3058, 86, 3059, 3061, 86, 86, + 3057, 86, 3060, 3062, 86, 86, 3063, 3065, 171, 86, + 3067, 86, 3064, 3068, 3070, 3777, 3066, 3069, 86, 86, + 86, 86, 3072, 3071, 3074, 86, 3073, 3075, 86, 3076, + 86, 3078, 86, 86, 3080, 86, 3079, 86, 3077, 3081, + 86, 86, 3082, 86, 3085, 86, 3083, 3086, 86, 3084, + 86, 86, 86, 3087, 3088, 86, 3092, 3093, 86, 86, + 3090, 86, 86, 86, 3094, 86, 3089, 3096, 86, 86, + 3095, 86, 3097, 3100, 3098, 86, 3091, 86, 3099, 86, + 86, 86, 3101, 86, 3102, 3103, 86, 86, 3108, 3104, + + 86, 86, 3106, 86, 3105, 3107, 3111, 3110, 86, 3109, + 3113, 86, 86, 86, 86, 86, 86, 3114, 86, 3119, + 86, 86, 3120, 86, 86, 3124, 3112, 86, 86, 86, + 86, 3115, 3122, 3116, 3117, 86, 3123, 3118, 3126, 86, + 3121, 3128, 86, 3125, 86, 3127, 86, 86, 3133, 86, + 3135, 3132, 3136, 86, 3129, 86, 86, 3139, 86, 3130, + 3140, 86, 86, 86, 3134, 86, 3131, 86, 86, 86, + 3141, 3146, 3137, 3138, 3143, 86, 3144, 86, 3147, 86, + 86, 3145, 86, 3148, 3151, 86, 86, 86, 3153, 86, + 3142, 3155, 86, 86, 3157, 86, 3150, 86, 3149, 3158, + + 86, 3152, 3159, 86, 86, 86, 3162, 3154, 3160, 86, + 3161, 3163, 86, 86, 86, 3167, 3156, 86, 3165, 86, + 3168, 86, 86, 86, 86, 3173, 3166, 3174, 86, 3164, + 86, 3169, 3175, 86, 3176, 86, 86, 3170, 86, 3177, + 86, 86, 3171, 3172, 3180, 86, 3183, 86, 3181, 86, + 3184, 3178, 86, 3179, 3185, 86, 3187, 86, 86, 86, + 86, 3182, 3191, 3192, 86, 86, 3194, 3186, 86, 3193, + 86, 3188, 86, 3196, 3190, 3195, 86, 3189, 3197, 86, + 86, 86, 86, 3202, 86, 86, 86, 86, 3201, 86, + 3204, 3205, 86, 86, 86, 3207, 86, 3208, 3206, 3198, + + 3199, 3200, 86, 86, 3211, 3210, 86, 86, 86, 3203, + 3209, 3214, 86, 3212, 3213, 3218, 86, 86, 86, 86, + 86, 3220, 86, 86, 3777, 3215, 3217, 86, 3216, 3221, + 3224, 3219, 3225, 3222, 86, 3227, 3240, 3226, 86, 3223, + 3228, 86, 3229, 3230, 86, 86, 3231, 86, 3232, 86, + 3233, 86, 3234, 86, 3235, 86, 86, 86, 86, 86, + 3239, 3237, 86, 86, 3242, 86, 86, 86, 3244, 86, + 86, 3236, 3241, 3251, 3245, 3249, 86, 3238, 3250, 86, + 86, 3243, 3253, 86, 86, 86, 3246, 3247, 86, 3248, + 3254, 3257, 86, 3255, 86, 3252, 3259, 86, 86, 86, + + 86, 3258, 86, 3256, 3260, 3261, 86, 3262, 86, 3263, + 3264, 86, 86, 3268, 86, 3269, 86, 3265, 86, 86, + 3267, 3266, 3270, 86, 86, 86, 86, 3276, 3271, 86, + 86, 86, 3277, 86, 86, 3273, 3282, 86, 3279, 86, + 3274, 3280, 3272, 3278, 3283, 86, 3275, 3285, 86, 3281, + 86, 86, 86, 3284, 3289, 86, 3290, 86, 86, 3292, + 86, 86, 86, 86, 3286, 86, 86, 3291, 3295, 86, + 3288, 3296, 3293, 3298, 86, 86, 3287, 86, 3299, 86, + 3301, 86, 3302, 86, 3303, 86, 3294, 86, 86, 3297, + 3304, 86, 3305, 86, 3308, 3300, 86, 3309, 3306, 3310, + + 86, 86, 3307, 3311, 86, 3312, 86, 86, 3317, 86, + 3313, 3314, 3316, 86, 86, 3315, 86, 86, 3318, 3320, + 86, 3319, 86, 86, 86, 3326, 86, 3321, 3324, 3322, + 86, 86, 3328, 86, 3329, 86, 86, 86, 3332, 86, + 3330, 3331, 3325, 3323, 86, 86, 86, 3337, 86, 86, + 86, 3327, 86, 86, 86, 86, 86, 3341, 3333, 3334, + 3335, 86, 3338, 3339, 3342, 3340, 3336, 86, 86, 3345, + 3343, 86, 3346, 86, 3349, 3344, 86, 86, 86, 3353, + 86, 3354, 86, 86, 3356, 3350, 86, 86, 3347, 3357, + 86, 3348, 86, 3359, 86, 3351, 3360, 86, 3361, 86, + + 3358, 86, 3355, 86, 3352, 3363, 86, 86, 3366, 86, + 3364, 3369, 86, 3362, 3368, 86, 86, 3365, 3372, 86, + 3374, 86, 86, 3367, 86, 3371, 86, 3376, 86, 86, + 86, 3380, 86, 3381, 86, 3370, 86, 86, 3383, 86, + 86, 3375, 3373, 3377, 86, 3384, 86, 3378, 3379, 3387, + 86, 3388, 86, 86, 3382, 3391, 86, 86, 3385, 86, + 86, 3389, 86, 3386, 3396, 86, 86, 86, 3393, 3394, + 86, 3400, 86, 3390, 86, 3392, 3777, 3398, 86, 3395, + 86, 3397, 3401, 3402, 86, 3407, 3399, 3403, 86, 3404, + 3405, 86, 3408, 86, 3406, 86, 3410, 86, 3409, 86, + + 3413, 86, 86, 86, 3412, 86, 3416, 86, 3414, 86, + 3419, 86, 86, 86, 86, 3411, 86, 3424, 86, 3420, + 86, 86, 3441, 86, 3415, 86, 3417, 3418, 86, 3423, + 3431, 3421, 3427, 3428, 86, 86, 3426, 3429, 86, 3422, + 3425, 3430, 86, 86, 3434, 86, 3435, 86, 3433, 3432, + 3436, 86, 86, 3438, 86, 86, 86, 86, 3443, 86, + 86, 3437, 3442, 3445, 86, 3446, 86, 86, 3439, 86, + 86, 86, 86, 86, 3452, 86, 3444, 3453, 86, 86, + 86, 86, 3440, 86, 86, 86, 3447, 3459, 86, 3461, + 3450, 3448, 3449, 3458, 3451, 3456, 3460, 86, 3455, 86, + + 3457, 3454, 3463, 3464, 86, 86, 86, 86, 86, 3777, + 3466, 3467, 3469, 86, 3470, 86, 86, 3462, 86, 3473, + 86, 3471, 86, 3465, 3478, 86, 86, 86, 3468, 3476, + 86, 3477, 3472, 86, 3474, 3475, 86, 86, 3479, 86, + 86, 86, 86, 86, 3482, 86, 86, 3484, 86, 86, + 3485, 86, 3483, 86, 86, 86, 3480, 3481, 86, 3494, + 3495, 86, 3486, 3777, 3490, 3487, 3488, 3489, 3491, 3492, + 3497, 86, 86, 3777, 3493, 86, 86, 3498, 3496, 86, + 86, 3499, 3500, 86, 3501, 3502, 86, 3503, 86, 86, + 3505, 3506, 86, 3504, 86, 3509, 86, 86, 3523, 3507, + + 3511, 86, 3508, 3512, 3513, 86, 86, 3514, 3515, 3519, + 86, 86, 3510, 3516, 86, 3517, 3518, 86, 86, 86, + 3521, 86, 3520, 3522, 86, 3525, 86, 86, 3526, 86, + 86, 3530, 86, 3524, 86, 3529, 86, 86, 86, 86, + 86, 3527, 86, 3535, 86, 3534, 86, 3597, 86, 3528, + 86, 3536, 3531, 3539, 86, 3537, 3532, 3540, 86, 3541, + 86, 3542, 3533, 86, 3538, 3543, 86, 3544, 86, 3545, + 86, 86, 3549, 3551, 86, 3546, 86, 3550, 86, 86, + 3547, 86, 86, 3548, 86, 3777, 3555, 3556, 3552, 3553, + 3558, 86, 3559, 86, 3561, 86, 86, 3554, 86, 3560, + + 3562, 86, 86, 3557, 3565, 86, 86, 3564, 3567, 86, + 86, 3563, 86, 3570, 86, 3571, 86, 3572, 86, 3568, + 3566, 3573, 86, 3574, 86, 3575, 86, 3576, 86, 86, + 3569, 3577, 86, 86, 3580, 86, 3581, 86, 86, 86, + 86, 86, 3579, 3586, 86, 86, 86, 3582, 3588, 86, + 86, 3583, 86, 86, 86, 3578, 3585, 86, 3592, 86, + 3584, 3589, 86, 3590, 3587, 3591, 3593, 86, 3602, 3594, + 3595, 86, 86, 3599, 86, 86, 86, 3596, 3598, 3601, + 3600, 86, 86, 86, 86, 86, 3604, 86, 86, 3603, + 86, 3608, 3610, 86, 3612, 86, 3609, 86, 86, 3607, + + 86, 3605, 3606, 3615, 86, 3611, 86, 3616, 3618, 86, + 3619, 86, 86, 3617, 3620, 86, 86, 3614, 3621, 86, + 86, 3613, 86, 86, 3624, 3623, 86, 86, 86, 3622, + 86, 3632, 3625, 3629, 86, 86, 3626, 3628, 86, 86, + 3630, 86, 3631, 86, 86, 86, 3627, 3633, 86, 86, + 86, 86, 86, 3639, 3634, 3641, 86, 3635, 86, 3636, + 3638, 3640, 86, 3643, 3646, 86, 3637, 3644, 86, 3642, + 86, 3645, 3649, 3648, 3651, 86, 3647, 86, 3653, 86, + 86, 3654, 3655, 86, 3656, 86, 3652, 86, 86, 86, + 3650, 86, 3659, 86, 86, 86, 3660, 3664, 3661, 86, + + 86, 86, 86, 86, 3668, 86, 3657, 3667, 3658, 86, + 3663, 86, 3666, 3665, 3670, 86, 3671, 86, 86, 3662, + 86, 3669, 3672, 86, 3673, 86, 3674, 86, 3675, 3676, + 86, 3679, 86, 3677, 86, 3680, 86, 3683, 3678, 3684, + 86, 86, 86, 86, 3681, 86, 3682, 86, 3689, 86, + 3690, 86, 3688, 86, 3685, 3686, 86, 86, 86, 86, + 3687, 86, 3694, 86, 86, 86, 3696, 86, 86, 86, + 86, 3693, 86, 3701, 3691, 3702, 3692, 3698, 3699, 3695, + 3703, 86, 3697, 86, 3707, 86, 3700, 86, 3709, 3704, + 3705, 86, 3708, 86, 86, 86, 3710, 3715, 3711, 86, + + 86, 86, 3706, 86, 3712, 3713, 3716, 86, 86, 86, + 3714, 3718, 86, 3717, 86, 86, 3721, 86, 3719, 3724, + 3720, 86, 86, 86, 3727, 86, 3728, 86, 86, 86, + 86, 86, 86, 3731, 3722, 3726, 3723, 86, 3729, 86, + 3725, 3730, 86, 3735, 3736, 3734, 86, 86, 3739, 3732, + 3733, 86, 86, 3741, 86, 3742, 86, 86, 86, 3737, + 86, 3743, 86, 3738, 3744, 3746, 86, 3747, 86, 86, + 3740, 3748, 3749, 86, 86, 3750, 86, 3745, 86, 3752, + 86, 3751, 86, 3753, 3755, 86, 86, 3757, 86, 86, + 86, 3758, 86, 3761, 86, 3754, 3762, 86, 86, 3756, + + 86, 3765, 3766, 86, 86, 3767, 86, 3759, 3760, 3763, + 3768, 86, 86, 3764, 3769, 86, 86, 86, 3777, 3770, + 3777, 3771, 3772, 3773, 3777, 3774, 3775, 86, 3776, 86, 47, 47, 47, 47, 47, 47, 47, 52, 52, 52, - 52, 52, 52, 52, 57, 57, 57, 57, 57, 57, 57, 63, 63, 63, 63, 63, 63, 63, 68, 68, 68, 68, 68, 68, 68, 74, 74, 74, 74, 74, 74, 74, 80, 80, 80, 80, 80, 80, 80, 89, - 89, 3645, 89, 89, 89, 89, 160, 160, 3645, 3645, - 3645, 160, 160, 162, 162, 3645, 3645, 162, 3645, 162, - 164, 3645, 3645, 3645, 3645, 3645, 164, 167, 167, 3645, - 3645, 3645, 167, 167, 169, 3645, 3645, 3645, 3645, 3645, - 169, 171, 171, 3645, 171, 171, 171, 171, 174, 3645, - 3645, 3645, 3645, 3645, 174, 177, 177, 3645, 3645, 3645, + 89, 3777, 89, 89, 89, 89, 161, 161, 3777, 3777, + 3777, 161, 161, 163, 163, 3777, 3777, 163, 3777, 163, - 177, 177, 90, 90, 3645, 90, 90, 90, 90, 17, - 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, - 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, - 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, - 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645 + 165, 3777, 3777, 3777, 3777, 3777, 165, 168, 168, 3777, + 3777, 3777, 168, 168, 170, 3777, 3777, 3777, 3777, 3777, + 170, 172, 172, 3777, 172, 172, 172, 172, 175, 3777, + 3777, 3777, 3777, 3777, 175, 178, 178, 3777, 3777, 3777, + 178, 178, 90, 90, 3777, 90, 90, 90, 90, 17, + 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, + 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, + 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, + 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777 } ; -static yyconst flex_int16_t yy_chk[7151] = +static yyconst flex_int16_t yy_chk[7391] = { 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, @@ -2436,784 +2506,810 @@ static yyconst flex_int16_t yy_chk[7151] = 5, 3, 6, 24, 4, 24, 24, 5, 24, 6, 7, 7, 7, 7, 24, 7, 8, 8, 8, 8, 33, 8, 7, 9, 9, 9, 26, 26, 8, 10, - 10, 10, 19, 29, 9, 33, 19, 29, 3653, 35, + 10, 10, 19, 29, 9, 33, 19, 29, 3785, 35, 10, 11, 11, 11, 11, 11, 11, 13, 13, 13, - 13, 34, 13, 11, 35, 99, 34, 29, 38, 13, + 13, 34, 13, 11, 35, 100, 34, 29, 38, 13, 51, 51, 11, 12, 12, 12, 12, 12, 12, 14, - 14, 14, 14, 99, 14, 12, 15, 15, 15, 38, - 23, 14, 23, 23, 12, 23, 46, 15, 16, 16, - 16, 23, 23, 25, 27, 27, 25, 25, 2962, 16, - 25, 46, 27, 30, 30, 25, 27, 56, 40, 27, - 56, 73, 31, 31, 25, 28, 67, 67, 30, 32, - 28, 31, 40, 32, 28, 73, 32, 28, 92, 28, - 28, 92, 31, 32, 1154, 32, 36, 36, 37, 37, - 28, 45, 45, 37, 97, 36, 45, 97, 41, 41, - - 45, 36, 87, 41, 93, 36, 87, 37, 93, 37, - 39, 39, 42, 41, 41, 39, 41, 42, 96, 39, - 42, 43, 43, 105, 43, 39, 44, 42, 39, 101, - 44, 42, 42, 43, 94, 39, 84, 84, 96, 43, - 44, 94, 105, 101, 44, 44, 62, 192, 62, 62, - 70, 62, 70, 70, 72, 70, 72, 72, 79, 72, - 79, 79, 70, 79, 86, 95, 86, 86, 89, 86, - 89, 89, 192, 89, 100, 86, 102, 95, 98, 89, - 89, 98, 102, 100, 103, 104, 106, 107, 102, 113, - 102, 109, 106, 113, 98, 108, 111, 140, 114, 112, - - 108, 107, 103, 103, 110, 106, 116, 104, 115, 108, - 119, 109, 140, 115, 111, 110, 110, 112, 114, 117, - 116, 118, 117, 110, 122, 117, 120, 118, 123, 119, - 121, 120, 124, 121, 125, 130, 124, 121, 117, 117, - 127, 125, 123, 122, 126, 128, 118, 127, 122, 129, - 132, 120, 131, 121, 128, 130, 131, 126, 134, 133, - 135, 136, 129, 133, 138, 135, 137, 137, 132, 135, - 139, 141, 142, 144, 139, 135, 134, 177, 146, 150, - 151, 136, 143, 139, 138, 143, 144, 145, 149, 139, - 146, 142, 148, 145, 147, 147, 143, 141, 150, 148, - - 143, 151, 152, 153, 149, 153, 155, 154, 156, 157, - 148, 155, 147, 227, 153, 147, 158, 159, 152, 154, - 156, 158, 161, 161, 179, 163, 153, 157, 163, 179, - 165, 159, 165, 165, 227, 165, 168, 168, 170, 181, - 170, 170, 171, 170, 171, 171, 173, 171, 175, 173, - 175, 175, 180, 175, 171, 178, 178, 181, 180, 182, - 183, 184, 185, 186, 187, 189, 188, 180, 183, 190, - 185, 188, 184, 213, 182, 183, 193, 191, 190, 187, - 176, 193, 186, 191, 191, 189, 194, 194, 195, 197, - 196, 213, 196, 197, 195, 196, 198, 198, 197, 199, - - 200, 201, 202, 197, 204, 200, 200, 202, 203, 197, - 197, 199, 196, 203, 205, 206, 204, 209, 207, 208, - 201, 206, 207, 210, 208, 211, 212, 214, 174, 218, - 215, 217, 214, 209, 205, 215, 217, 210, 212, 219, - 211, 212, 216, 216, 206, 220, 216, 224, 216, 218, - 223, 220, 221, 221, 260, 219, 223, 222, 225, 226, - 216, 260, 216, 222, 225, 226, 228, 224, 229, 222, - 230, 231, 228, 229, 226, 231, 230, 232, 233, 235, - 233, 234, 236, 232, 237, 233, 239, 234, 236, 238, - 240, 243, 235, 241, 242, 238, 243, 244, 245, 239, - - 246, 241, 247, 250, 237, 248, 244, 242, 239, 252, - 248, 248, 249, 245, 240, 251, 246, 249, 253, 251, - 254, 250, 247, 255, 253, 256, 258, 257, 258, 255, - 259, 252, 257, 263, 261, 262, 264, 266, 254, 254, - 261, 262, 264, 265, 269, 256, 267, 267, 272, 259, - 269, 266, 263, 268, 268, 265, 270, 271, 273, 271, - 274, 275, 270, 273, 277, 276, 279, 292, 269, 278, - 292, 272, 274, 276, 278, 280, 271, 281, 285, 287, - 275, 280, 282, 281, 277, 283, 284, 282, 286, 279, - 283, 288, 284, 285, 290, 289, 296, 287, 291, 293, - - 299, 293, 286, 289, 291, 288, 294, 294, 295, 297, - 297, 295, 298, 298, 296, 300, 299, 301, 302, 290, - 301, 305, 302, 303, 304, 307, 169, 308, 309, 317, - 300, 307, 303, 304, 309, 310, 311, 310, 318, 312, - 305, 308, 311, 312, 313, 313, 314, 315, 316, 317, - 319, 314, 320, 315, 316, 325, 318, 321, 321, 322, - 312, 323, 322, 324, 326, 320, 328, 324, 327, 327, - 167, 319, 329, 316, 325, 329, 330, 331, 332, 323, - 335, 332, 326, 331, 328, 333, 336, 340, 330, 335, - 337, 338, 329, 341, 338, 337, 338, 333, 334, 339, - - 340, 166, 339, 344, 336, 341, 344, 334, 347, 338, - 334, 342, 338, 342, 342, 334, 334, 334, 334, 343, - 345, 345, 346, 347, 343, 343, 348, 349, 350, 351, - 352, 352, 354, 354, 356, 353, 357, 350, 351, 346, - 353, 348, 346, 358, 349, 349, 355, 355, 358, 359, - 360, 357, 361, 362, 363, 364, 364, 366, 364, 356, - 363, 359, 372, 375, 375, 367, 369, 364, 362, 360, - 367, 369, 361, 368, 364, 370, 372, 366, 371, 368, - 370, 371, 373, 371, 374, 373, 370, 378, 376, 377, - 377, 381, 378, 374, 376, 383, 416, 382, 373, 384, - - 382, 373, 385, 373, 379, 379, 388, 379, 390, 387, - 383, 381, 387, 379, 384, 391, 385, 379, 382, 394, - 388, 416, 379, 390, 391, 379, 380, 380, 387, 380, - 392, 393, 395, 396, 397, 392, 392, 393, 398, 401, - 394, 400, 380, 397, 393, 380, 164, 380, 396, 380, - 389, 395, 389, 389, 399, 405, 402, 398, 407, 401, - 399, 406, 389, 389, 389, 389, 389, 400, 403, 389, - 402, 404, 408, 407, 403, 405, 404, 408, 403, 410, - 409, 406, 411, 411, 412, 410, 413, 414, 418, 417, - 415, 420, 421, 418, 404, 409, 415, 422, 413, 419, - - 419, 414, 419, 423, 412, 417, 162, 424, 421, 424, - 425, 420, 430, 422, 431, 425, 426, 423, 426, 426, - 427, 428, 429, 429, 427, 428, 432, 433, 437, 431, - 434, 430, 438, 440, 437, 443, 426, 440, 435, 160, - 428, 438, 432, 439, 434, 433, 435, 435, 439, 442, - 441, 444, 448, 449, 449, 442, 443, 444, 435, 441, - 435, 436, 446, 445, 447, 446, 436, 445, 450, 447, - 451, 451, 448, 453, 436, 436, 454, 454, 436, 436, - 452, 450, 436, 455, 456, 452, 453, 457, 456, 455, - 458, 459, 460, 462, 461, 461, 459, 460, 463, 464, - - 465, 466, 457, 461, 466, 462, 468, 469, 467, 472, - 468, 458, 465, 467, 470, 470, 471, 464, 463, 469, - 474, 471, 473, 473, 476, 476, 478, 479, 480, 481, - 472, 482, 483, 484, 485, 479, 487, 483, 481, 488, - 489, 491, 474, 495, 490, 492, 485, 478, 495, 480, - 490, 492, 482, 484, 487, 491, 487, 488, 493, 494, - 489, 496, 497, 498, 499, 494, 498, 493, 500, 503, - 497, 501, 506, 497, 504, 496, 502, 504, 499, 505, - 501, 509, 502, 500, 508, 505, 506, 507, 511, 503, - 510, 513, 507, 511, 510, 512, 513, 514, 515, 516, - - 519, 520, 509, 505, 535, 522, 508, 535, 521, 522, - 512, 523, 516, 514, 85, 525, 524, 515, 517, 517, - 519, 524, 520, 521, 517, 526, 517, 528, 529, 526, - 523, 525, 517, 529, 517, 530, 527, 517, 517, 531, - 533, 527, 528, 534, 517, 527, 532, 536, 531, 537, - 539, 530, 532, 529, 530, 533, 541, 532, 543, 534, - 538, 538, 540, 540, 542, 544, 544, 545, 546, 537, - 536, 541, 547, 543, 548, 539, 542, 547, 549, 550, - 553, 551, 559, 548, 554, 558, 545, 551, 554, 553, - 546, 555, 556, 557, 550, 555, 560, 549, 556, 561, - - 558, 559, 562, 563, 564, 557, 565, 563, 565, 566, - 560, 567, 568, 568, 561, 569, 570, 564, 571, 567, - 562, 569, 572, 573, 571, 574, 573, 575, 570, 577, - 576, 578, 577, 566, 572, 576, 579, 80, 580, 574, - 578, 581, 575, 580, 580, 582, 582, 578, 583, 583, - 578, 584, 579, 589, 581, 585, 585, 584, 586, 586, - 587, 590, 588, 591, 594, 593, 587, 588, 588, 592, - 593, 589, 592, 595, 596, 591, 598, 596, 599, 597, - 601, 595, 590, 594, 597, 600, 601, 602, 603, 600, - 604, 605, 603, 607, 607, 606, 605, 599, 608, 598, - - 609, 610, 612, 611, 613, 614, 610, 602, 604, 606, - 615, 614, 616, 608, 618, 615, 620, 617, 612, 621, - 617, 609, 611, 624, 613, 617, 616, 625, 617, 617, - 619, 619, 618, 622, 620, 621, 623, 624, 622, 627, - 628, 623, 625, 629, 630, 627, 629, 631, 630, 628, - 632, 633, 631, 632, 635, 634, 633, 636, 638, 639, - 637, 640, 640, 638, 636, 641, 642, 643, 644, 645, - 630, 634, 635, 637, 641, 646, 647, 648, 645, 639, - 653, 75, 647, 648, 644, 642, 649, 646, 643, 649, - 650, 650, 651, 650, 652, 651, 654, 655, 653, 652, - - 656, 657, 658, 662, 659, 656, 660, 664, 658, 659, - 654, 655, 660, 661, 663, 670, 661, 666, 667, 663, - 657, 665, 74, 664, 668, 673, 665, 665, 662, 668, - 666, 667, 669, 671, 670, 672, 674, 674, 669, 675, - 672, 676, 671, 668, 668, 673, 675, 677, 676, 678, - 677, 679, 680, 681, 683, 678, 685, 680, 681, 681, - 682, 682, 684, 679, 684, 677, 686, 680, 686, 687, - 688, 689, 690, 691, 692, 685, 694, 693, 697, 683, - 692, 693, 695, 696, 698, 694, 700, 687, 688, 689, - 702, 690, 699, 691, 701, 699, 697, 695, 696, 703, - - 701, 700, 704, 698, 699, 705, 706, 707, 708, 710, - 702, 709, 708, 703, 704, 711, 712, 713, 714, 717, - 717, 720, 68, 715, 705, 710, 707, 706, 715, 709, - 716, 719, 721, 711, 712, 712, 713, 714, 718, 722, - 720, 723, 718, 721, 716, 719, 723, 724, 725, 726, - 727, 728, 729, 722, 730, 731, 728, 727, 733, 729, - 731, 732, 726, 724, 734, 735, 732, 725, 736, 738, - 737, 734, 743, 747, 735, 740, 733, 739, 730, 737, - 740, 738, 736, 739, 741, 742, 743, 741, 744, 742, - 745, 754, 746, 752, 747, 748, 748, 744, 749, 749, - - 750, 750, 752, 751, 756, 745, 746, 749, 751, 755, - 754, 758, 757, 759, 760, 755, 757, 764, 762, 761, - 763, 765, 766, 758, 756, 761, 762, 763, 769, 778, - 775, 772, 760, 820, 776, 764, 780, 781, 759, 775, - 776, 820, 766, 769, 779, 780, 765, 767, 772, 767, - 779, 778, 767, 781, 782, 786, 767, 785, 782, 767, - 783, 783, 784, 784, 787, 788, 767, 767, 785, 767, - 789, 791, 792, 786, 793, 796, 789, 792, 787, 794, - 795, 799, 802, 63, 795, 788, 790, 790, 790, 798, - 790, 791, 797, 790, 798, 793, 797, 794, 790, 796, - - 799, 800, 801, 805, 790, 790, 800, 802, 803, 804, - 805, 803, 797, 807, 804, 804, 808, 801, 806, 806, - 810, 808, 809, 809, 811, 810, 812, 811, 807, 813, - 813, 812, 814, 815, 814, 816, 817, 818, 822, 819, - 817, 821, 821, 824, 824, 815, 823, 825, 827, 826, - 828, 830, 830, 822, 816, 835, 828, 818, 819, 829, - 823, 826, 831, 834, 829, 825, 833, 831, 831, 834, - 827, 833, 836, 838, 835, 837, 840, 841, 836, 838, - 837, 839, 840, 844, 839, 841, 842, 842, 843, 843, - 845, 844, 846, 848, 847, 849, 850, 846, 847, 851, - - 848, 852, 852, 854, 856, 853, 855, 855, 845, 857, - 856, 854, 850, 849, 853, 858, 860, 861, 851, 862, - 864, 865, 867, 863, 865, 860, 861, 857, 863, 864, - 866, 868, 869, 870, 858, 866, 867, 872, 874, 871, - 875, 869, 877, 862, 871, 871, 870, 873, 873, 876, - 878, 872, 879, 874, 883, 879, 868, 885, 876, 875, - 881, 886, 881, 879, 882, 882, 877, 884, 878, 887, - 888, 889, 884, 890, 891, 883, 892, 893, 885, 894, - 892, 886, 890, 58, 895, 896, 898, 897, 899, 887, - 895, 889, 888, 902, 896, 893, 900, 891, 894, 897, - - 901, 902, 898, 903, 904, 906, 901, 899, 907, 904, - 900, 905, 905, 908, 909, 910, 911, 903, 912, 913, - 916, 914, 908, 910, 906, 915, 916, 917, 907, 918, - 920, 919, 921, 917, 909, 924, 911, 919, 913, 924, - 912, 914, 922, 918, 920, 915, 925, 923, 922, 926, - 927, 928, 921, 923, 930, 927, 929, 929, 931, 932, - 930, 926, 932, 933, 931, 925, 934, 935, 936, 926, - 937, 937, 928, 935, 938, 939, 942, 945, 941, 934, - 939, 933, 940, 941, 941, 940, 943, 946, 936, 948, - 943, 942, 938, 944, 944, 950, 947, 951, 940, 945, - - 940, 947, 953, 954, 955, 957, 957, 946, 948, 958, - 964, 951, 959, 958, 961, 953, 960, 960, 962, 950, - 966, 963, 962, 954, 964, 955, 956, 959, 965, 956, - 57, 956, 968, 965, 966, 956, 963, 956, 967, 961, - 969, 968, 956, 967, 967, 970, 973, 956, 971, 970, - 972, 974, 975, 976, 969, 972, 974, 977, 973, 978, - 52, 970, 979, 971, 980, 972, 975, 979, 978, 982, - 980, 977, 981, 983, 976, 982, 986, 981, 985, 983, - 984, 984, 986, 985, 987, 988, 991, 989, 992, 993, - 994, 995, 995, 992, 996, 998, 999, 1000, 991, 996, - - 1001, 997, 994, 993, 988, 989, 987, 990, 990, 997, - 999, 998, 1002, 990, 1003, 990, 1000, 1004, 1005, 1001, - 1003, 990, 1004, 1006, 1007, 1008, 990, 990, 1002, 1009, - 1005, 1010, 1010, 990, 1011, 1012, 1014, 1016, 1011, 1017, - 1007, 1006, 1014, 1008, 1017, 1015, 1018, 1009, 1015, 1020, - 1021, 1019, 1023, 1024, 1020, 1012, 1016, 1019, 1025, 1018, - 1026, 1023, 1024, 1027, 1028, 1029, 1026, 1030, 1031, 1021, - 1029, 1032, 1027, 1033, 1025, 1034, 1037, 1035, 1042, 1043, - 1040, 1045, 1031, 1028, 1034, 1033, 1035, 1030, 1036, 1038, - 1046, 1032, 1042, 1037, 1036, 1038, 1040, 1044, 1047, 1043, - - 1045, 1049, 1044, 1048, 1046, 1050, 1049, 1053, 1054, 1056, - 1050, 1058, 1053, 1055, 1055, 1056, 1047, 1054, 1048, 1057, - 1058, 1059, 1060, 1062, 1063, 1057, 1066, 1065, 1065, 1063, - 1063, 1065, 1068, 1069, 1067, 1060, 1059, 1067, 1070, 1062, - 1071, 1066, 1072, 1074, 1073, 1075, 1068, 1077, 1082, 1074, - 1076, 1082, 1078, 1069, 1070, 1072, 1076, 1078, 1071, 1073, - 1079, 1083, 1077, 1081, 1081, 1075, 1084, 1085, 1086, 1087, - 1088, 1084, 1085, 1090, 1079, 1088, 1089, 1092, 1087, 1093, - 1094, 1089, 1083, 1092, 1086, 1090, 1094, 1095, 1096, 1096, - 1097, 1098, 1101, 1095, 1099, 1093, 1102, 1099, 1103, 1097, - - 1100, 1100, 1104, 1105, 47, 1104, 1106, 1107, 1108, 1098, - 1101, 1116, 1106, 1107, 1108, 1102, 1105, 1109, 1103, 1110, - 1111, 1113, 1109, 1112, 1110, 1115, 1111, 1113, 1112, 1116, - 1115, 1117, 1118, 1121, 1119, 1120, 1120, 1122, 1118, 1119, - 1123, 1124, 1121, 1125, 1126, 1123, 1122, 1126, 1129, 1127, - 1128, 1117, 1127, 1129, 1130, 1131, 1132, 1133, 1134, 1124, - 1138, 1128, 1125, 1133, 1134, 1135, 1136, 1131, 1137, 1137, - 1139, 1136, 1130, 1140, 1141, 1132, 1143, 1142, 1144, 1138, - 1135, 1142, 1145, 1146, 1139, 1140, 1148, 1144, 1149, 1149, - 1150, 1151, 1141, 1153, 1143, 1152, 1151, 1155, 1150, 1156, - - 1152, 1145, 1158, 1157, 1161, 1148, 1162, 1158, 1146, 1159, - 1164, 1155, 1162, 1153, 1156, 1157, 1160, 1160, 1159, 1163, - 1168, 1166, 1165, 1166, 1161, 1163, 1164, 1165, 1167, 1169, - 1170, 1171, 1172, 1167, 1168, 1170, 1175, 1173, 1174, 1177, - 1177, 1179, 1178, 1169, 1173, 1180, 1171, 1182, 1181, 1186, - 1186, 1172, 1183, 1174, 1181, 1175, 1178, 1183, 1185, 1179, - 1180, 1190, 1185, 1189, 1187, 1192, 1183, 1182, 1183, 1187, - 1189, 1183, 1188, 1188, 1191, 1190, 1193, 1191, 1194, 1196, - 1195, 1197, 1198, 1200, 1192, 1195, 1199, 1194, 1198, 1201, - 1202, 1199, 1207, 1197, 1193, 1204, 1204, 1200, 1196, 1205, - - 1201, 1206, 1208, 1211, 1205, 1212, 1206, 1208, 1210, 1202, - 1209, 1213, 1207, 1214, 1209, 1216, 1214, 1210, 1211, 1215, - 1212, 1217, 1216, 1218, 1219, 1214, 1220, 1224, 1222, 1221, - 1213, 1223, 1225, 1217, 1215, 1221, 1227, 1223, 1228, 1226, - 1230, 1229, 1218, 1222, 1220, 1219, 1231, 1224, 1226, 1232, - 1233, 1227, 1225, 1229, 1234, 1236, 1233, 1228, 1237, 1230, - 1239, 1236, 1238, 1240, 1232, 1241, 1243, 1242, 1239, 1245, - 1299, 1231, 1242, 1237, 1234, 1246, 1238, 1247, 1243, 1244, - 1250, 1241, 1299, 1240, 1244, 1244, 1248, 1248, 1245, 1246, - 1247, 1249, 1249, 1250, 1251, 1252, 1249, 1253, 1253, 1249, - - 1249, 1252, 1254, 1251, 1249, 1256, 1255, 1254, 1257, 1260, - 1249, 1256, 1258, 1257, 1249, 1255, 1263, 1258, 1259, 1259, - 1261, 1261, 1262, 1264, 1266, 1262, 1265, 1262, 1267, 1268, - 1260, 1269, 1265, 1266, 1268, 1270, 1263, 1271, 1272, 1275, - 1276, 1264, 1273, 1271, 1272, 1269, 1274, 1273, 1267, 1276, - 1274, 1278, 1275, 1270, 1276, 1285, 1276, 1277, 1276, 1281, - 1276, 1284, 1277, 1279, 1279, 1278, 1280, 1280, 1283, 1280, - 1281, 1286, 1283, 1287, 1288, 1285, 1284, 1289, 1290, 1288, - 1288, 1292, 1287, 1291, 1293, 1294, 1289, 1295, 1291, 1286, - 1297, 1296, 18, 1293, 1300, 1292, 1297, 1298, 1298, 1301, - - 1290, 1303, 1300, 1302, 1294, 1296, 1295, 1304, 1302, 1306, - 1305, 1307, 1316, 1301, 1308, 1303, 1304, 1305, 1310, 1308, - 1309, 1309, 1311, 1311, 1312, 1314, 1312, 1306, 1314, 1315, - 1317, 1316, 1319, 1310, 1315, 1323, 1307, 1318, 1318, 1317, - 1320, 1320, 1321, 1321, 1322, 1324, 1325, 1326, 1326, 1322, - 1327, 1328, 1319, 1330, 1329, 1331, 1323, 1329, 1332, 1335, - 1333, 1331, 1334, 1332, 1334, 1338, 1324, 1325, 1328, 1333, - 1327, 1337, 1339, 1330, 1337, 1341, 1340, 1335, 1342, 1343, - 1338, 1340, 1349, 1342, 1405, 1339, 1344, 1343, 1405, 1341, - 1345, 1344, 1346, 1345, 1347, 1347, 1348, 1346, 1350, 1351, - - 1349, 1348, 1352, 1354, 1350, 1355, 1351, 1356, 1357, 1354, - 1358, 1355, 1356, 1357, 1359, 1352, 1358, 1360, 1361, 1362, - 1362, 1363, 1365, 1359, 1366, 1367, 1369, 1365, 1368, 1361, - 1370, 1371, 1372, 1373, 1375, 1367, 1360, 1371, 1372, 1373, - 1375, 1363, 1366, 1368, 1376, 1377, 1369, 1378, 1379, 1380, - 1381, 1382, 1382, 1370, 1383, 1384, 1386, 1385, 1376, 1388, - 1379, 1386, 1391, 1380, 1376, 1377, 1389, 1378, 1381, 1387, - 1387, 1389, 1392, 1393, 1383, 1385, 1394, 1392, 1392, 1395, - 1384, 1391, 1388, 1396, 1397, 1394, 1398, 1395, 1399, 1400, - 1401, 1393, 1401, 1399, 1402, 1408, 1399, 1396, 1400, 1397, - - 1404, 1398, 1406, 1409, 1398, 1407, 1404, 1410, 1402, 1414, - 1407, 1407, 1411, 1406, 1408, 1412, 1413, 1411, 1415, 1416, - 1412, 1413, 1417, 1419, 1416, 1410, 1420, 1414, 1421, 1409, - 1422, 1422, 1423, 1424, 1425, 1426, 1423, 1419, 1415, 1428, - 1427, 1426, 1417, 1429, 1420, 1430, 1421, 1433, 1431, 1432, - 1435, 1424, 1427, 1425, 1437, 1428, 1434, 1435, 1438, 1430, - 1436, 1434, 1429, 1431, 1432, 1436, 1433, 1439, 1440, 1440, - 1441, 1442, 1437, 1443, 1444, 1444, 1439, 1445, 1446, 1438, - 1442, 1447, 1451, 1445, 1446, 1441, 1448, 1448, 1449, 1449, - 1450, 1452, 1453, 1443, 1454, 1447, 1450, 1453, 1451, 1455, - - 1454, 1456, 1457, 1457, 1463, 1455, 1462, 1456, 1458, 1458, - 1460, 1460, 1452, 1461, 1464, 1462, 1466, 1461, 1465, 1469, - 1467, 1470, 1463, 1468, 1468, 1473, 1464, 1467, 1458, 1470, - 1458, 1466, 1465, 1471, 1472, 1474, 1476, 1475, 1471, 1469, - 1474, 1474, 1475, 1475, 1473, 1477, 1477, 1478, 1472, 1479, - 1480, 1482, 1481, 1483, 1484, 1485, 1476, 1481, 1486, 1480, - 1487, 1485, 1488, 1486, 1490, 1489, 1478, 1493, 1479, 1491, - 1482, 1489, 1484, 1483, 1494, 1491, 1492, 1495, 1496, 1497, - 1487, 1498, 1492, 1490, 1499, 1500, 1493, 1503, 1488, 1501, - 1501, 1502, 1504, 1494, 1502, 1498, 1495, 1496, 1497, 1508, - - 1500, 1505, 1506, 1506, 1508, 1499, 1503, 1507, 1507, 1510, - 1509, 1504, 1511, 1505, 1509, 1512, 1513, 1514, 1518, 1514, - 1516, 1517, 1510, 1514, 1512, 1519, 1517, 1511, 1520, 1513, - 1521, 1521, 1522, 1518, 1523, 1524, 1514, 1522, 1516, 1525, - 1523, 1526, 1528, 1527, 1520, 1519, 1528, 1526, 1527, 1529, - 1524, 1530, 1525, 1529, 1531, 1532, 1533, 1534, 1535, 1535, - 1537, 1539, 1540, 1534, 1532, 1541, 1541, 1540, 1542, 1543, - 1547, 1530, 1531, 1547, 1542, 1549, 1533, 1550, 1537, 1545, - 1545, 1551, 1539, 1548, 1548, 1553, 1554, 1556, 1553, 1543, - 1555, 1549, 1557, 1550, 1558, 1558, 1556, 1551, 1559, 1560, - - 1561, 1562, 1563, 1564, 1565, 1565, 1562, 1554, 1566, 1564, - 1555, 1567, 1557, 1559, 1569, 1568, 1563, 1566, 1570, 1561, - 1560, 1571, 1571, 1572, 1573, 1575, 1574, 1576, 1576, 1567, - 1568, 1574, 1577, 1578, 1579, 1579, 1577, 1572, 1570, 1569, - 1575, 1580, 1573, 1581, 1582, 1583, 1584, 1585, 1589, 1583, - 1587, 1587, 1585, 1578, 1588, 1582, 1591, 1588, 1592, 1590, - 1593, 1589, 1581, 1580, 1590, 1584, 1594, 1595, 1596, 1597, - 1597, 1599, 1591, 1598, 1593, 1600, 1592, 1603, 1598, 1601, - 1601, 1595, 1603, 1602, 1604, 1594, 1594, 1605, 1608, 1605, - 1607, 1599, 1602, 1596, 1606, 1600, 1607, 1609, 1611, 1606, - - 1612, 1612, 1613, 1609, 1604, 1614, 1617, 1621, 1608, 1616, - 1620, 1614, 1611, 1622, 1616, 1618, 1618, 1619, 1619, 1623, - 1625, 1613, 1623, 1626, 1620, 1621, 1624, 1624, 1622, 1627, - 1617, 1629, 1635, 1628, 1633, 1626, 1628, 1629, 1625, 1628, - 1630, 1631, 1634, 1633, 1631, 1630, 1638, 1634, 1646, 1627, - 1636, 1628, 1639, 1636, 1637, 1637, 1640, 1635, 1639, 1641, - 1631, 1646, 1640, 1644, 1641, 1642, 1642, 1643, 1643, 1644, - 1638, 1645, 1647, 1648, 1649, 1650, 1645, 1651, 1650, 1652, - 1653, 1656, 1654, 1651, 1660, 1652, 1653, 1654, 1657, 1655, - 1647, 1661, 1648, 1657, 1649, 1655, 1658, 1658, 1659, 1662, - - 1663, 1664, 1660, 1659, 1656, 1665, 1667, 1666, 1668, 1669, - 1670, 1661, 1670, 1669, 1674, 1664, 1671, 1676, 1662, 1665, - 1663, 1666, 1672, 1678, 1667, 1675, 1674, 1681, 1677, 1672, - 1676, 1679, 1680, 1668, 1677, 1671, 1682, 1675, 1687, 1682, - 1684, 1681, 1689, 1678, 1683, 1683, 1691, 1679, 1688, 1684, - 1686, 1686, 1680, 1688, 1689, 1690, 1690, 1682, 1687, 1692, - 1693, 1691, 1694, 1695, 1696, 1699, 1698, 1697, 1701, 1703, - 1705, 1705, 1695, 1692, 1697, 1698, 1706, 1706, 1698, 1696, - 1694, 1699, 1704, 1701, 1693, 1704, 1707, 1708, 1701, 1709, - 1710, 1710, 1709, 1711, 1703, 1712, 1713, 1714, 1707, 1715, - - 1714, 1713, 1716, 1717, 1715, 1708, 1711, 1718, 1719, 1721, - 1724, 1720, 1723, 1723, 1712, 1725, 1718, 1724, 1721, 1717, - 1720, 1716, 1722, 1720, 1726, 1727, 1728, 1719, 1722, 1729, - 1732, 1731, 1735, 1730, 1736, 1725, 1731, 1726, 1730, 1730, - 1728, 1738, 1732, 1727, 1738, 1729, 1737, 1737, 1739, 1740, - 1741, 1741, 1736, 1742, 1742, 1741, 1744, 1735, 1740, 1745, - 1743, 1744, 1746, 1747, 1739, 1748, 1750, 1751, 1742, 1743, - 1748, 1748, 1743, 1752, 1753, 1754, 1756, 1745, 1755, 1753, - 1750, 1747, 1751, 1746, 1755, 1757, 1757, 1758, 1760, 1754, - 1764, 1759, 1761, 1758, 1756, 1752, 1759, 1762, 1761, 1765, - - 1766, 1767, 1760, 1762, 1771, 1773, 1766, 1774, 1768, 1769, - 1764, 1768, 1771, 1765, 1767, 1769, 1775, 1768, 1777, 1776, - 1778, 1779, 1780, 1777, 1773, 1781, 1774, 1776, 1782, 1778, - 1783, 1780, 1784, 1784, 1779, 1775, 1790, 1785, 1781, 1786, - 1788, 1791, 1782, 1785, 1783, 1786, 1787, 1789, 1789, 1787, - 1792, 1793, 1793, 1788, 1784, 1794, 1790, 1795, 1796, 1791, - 1797, 1798, 1801, 1795, 1800, 1800, 1802, 1803, 1794, 1792, - 1802, 1804, 1803, 1805, 1807, 1808, 1797, 1810, 1805, 1798, - 1796, 1806, 1801, 1807, 1811, 1813, 1806, 1812, 1810, 1814, - 1812, 1804, 1816, 1811, 1815, 1815, 1817, 1813, 1808, 1818, - - 1819, 1819, 1820, 1821, 1814, 1822, 1825, 1823, 1817, 1826, - 1821, 1816, 1828, 1829, 1827, 1830, 1820, 1822, 1818, 1823, - 1827, 1830, 1831, 1831, 1828, 1825, 1836, 1832, 1839, 1826, - 1832, 1829, 1833, 1833, 1835, 1836, 1837, 1838, 1838, 1835, - 1839, 1840, 1837, 1840, 1841, 1842, 1843, 1841, 1844, 1845, - 1846, 1847, 1848, 1852, 1851, 1846, 1847, 1849, 1850, 1851, - 1853, 1848, 1852, 1856, 1858, 1842, 1844, 1845, 1843, 1849, - 1858, 1854, 1855, 1850, 1859, 1852, 1854, 1855, 1856, 1862, - 1853, 1857, 1857, 1854, 1861, 1863, 1864, 1865, 1866, 1867, - 1866, 1868, 1868, 1869, 1869, 1859, 1870, 1870, 1862, 1871, - - 1861, 1874, 1864, 1867, 1863, 1867, 1875, 1865, 1872, 1872, - 1873, 1873, 1876, 1877, 1877, 1879, 1878, 1883, 1882, 1871, - 1878, 1879, 1874, 1880, 1882, 1884, 1880, 1875, 1886, 1885, - 1889, 1884, 1892, 1876, 1885, 1883, 1887, 1888, 1888, 1887, - 1890, 1891, 1891, 1893, 1894, 1890, 1895, 1892, 1900, 1894, - 1889, 1895, 1897, 1886, 1896, 1896, 1898, 1897, 1899, 1902, - 1901, 1903, 1898, 1904, 1893, 1905, 1906, 1903, 1900, 1907, - 1899, 1899, 1899, 1906, 1907, 1909, 1910, 1899, 1901, 1902, - 1909, 1909, 1911, 1904, 1912, 1905, 1912, 1913, 1914, 1915, - 1910, 1916, 1917, 1918, 1920, 1915, 1922, 1911, 1913, 1923, - - 1916, 1919, 1919, 1914, 1921, 1921, 1924, 1924, 1925, 1925, - 1926, 1930, 1917, 1931, 1918, 1933, 1922, 1929, 1929, 1934, - 1920, 1923, 1931, 1935, 1933, 1936, 1937, 1937, 1938, 1935, - 1926, 1939, 1940, 1941, 1942, 1944, 1930, 1943, 1943, 1940, - 1934, 1936, 1941, 1945, 1947, 1949, 1939, 1948, 1950, 1938, - 1947, 1949, 1948, 1955, 1953, 1951, 1953, 1952, 1956, 1945, - 1942, 1944, 1951, 1952, 1956, 1957, 1957, 1959, 1950, 1958, - 1960, 1961, 1955, 1962, 1958, 1963, 1959, 1964, 1963, 1965, - 1966, 1967, 1965, 1968, 1968, 1960, 1971, 1969, 1970, 1964, - 1972, 1961, 1962, 1969, 1970, 1973, 1975, 1976, 1966, 1973, - - 1978, 1978, 1979, 1977, 1980, 1972, 1971, 1967, 1977, 1981, - 1983, 1985, 1985, 1984, 1986, 1973, 1975, 1984, 1987, 1976, - 1986, 1988, 1988, 1980, 1981, 1990, 1979, 1987, 1989, 1983, - 1991, 1991, 1989, 1992, 1993, 1995, 1990, 1994, 1996, 1997, - 1995, 1990, 1998, 1999, 2003, 2000, 2001, 2002, 1993, 1999, - 2004, 2004, 2002, 2010, 1992, 17, 1994, 2003, 1996, 1997, - 2008, 2001, 1998, 2000, 2005, 2005, 2006, 2009, 2019, 2008, - 2006, 2011, 2020, 2010, 2012, 2012, 2011, 2020, 2009, 2014, - 2014, 2015, 2016, 2009, 2018, 2021, 2015, 2015, 2016, 2022, - 2018, 2024, 2025, 2026, 2019, 2022, 2025, 2021, 2027, 2027, - - 2028, 2029, 2030, 2024, 2031, 2026, 2034, 2029, 2032, 2032, - 2031, 2033, 2035, 2039, 2040, 2036, 2038, 2035, 2042, 2040, - 2046, 2042, 2043, 2043, 2030, 2028, 2034, 2036, 2038, 0, - 2033, 2047, 2039, 2044, 2044, 2045, 2045, 2047, 2048, 2050, - 2046, 2049, 2051, 2053, 2048, 2050, 2049, 2055, 2053, 2056, - 2055, 2051, 2057, 2057, 2059, 2060, 2063, 2061, 2062, 2062, - 2068, 2056, 2061, 2064, 2065, 2063, 2059, 2060, 2064, 2065, - 2066, 2067, 2067, 2066, 2069, 2070, 2071, 2072, 2075, 2073, - 2068, 2072, 2074, 2069, 2073, 2076, 2077, 2078, 2074, 2081, - 2080, 2080, 2084, 2070, 2076, 2071, 2075, 2082, 2088, 2083, - - 2090, 2078, 2080, 2087, 2077, 2086, 2082, 2081, 2083, 2085, - 2085, 2089, 2084, 2090, 2086, 2087, 2089, 2093, 2093, 2088, - 2095, 2096, 2097, 2095, 2098, 2101, 2100, 2102, 2103, 2104, - 2104, 2106, 2105, 2102, 2105, 2107, 2107, 2096, 2097, 2101, - 2098, 2100, 2108, 2110, 2110, 2103, 2111, 2111, 2113, 2106, - 2108, 2114, 2115, 2116, 2117, 2118, 2119, 2114, 2115, 2120, - 2120, 2117, 2122, 2121, 2121, 2127, 2123, 2116, 2124, 2125, - 2126, 2113, 2121, 2131, 2129, 2134, 2119, 2118, 2123, 2128, - 2124, 2130, 2126, 2122, 2125, 2135, 2130, 2130, 2128, 2129, - 2136, 2127, 2132, 2139, 2132, 2134, 2131, 2138, 2132, 2137, - - 2137, 2140, 2136, 2142, 2140, 2141, 2146, 2144, 2135, 2152, - 2141, 2132, 2144, 2139, 2145, 2138, 2145, 2147, 2148, 2150, - 2153, 2154, 2147, 2142, 2146, 2148, 2156, 2152, 2150, 2153, - 2155, 2157, 2155, 2154, 2159, 2160, 2159, 2157, 2161, 2161, - 2162, 2163, 2164, 2165, 2164, 2156, 2163, 2166, 2165, 2160, - 2167, 2168, 2166, 2169, 2170, 2173, 2171, 2172, 2174, 2177, - 2170, 2171, 2178, 2174, 2174, 2179, 2162, 2173, 2167, 2168, - 2172, 2175, 2182, 2169, 2180, 2180, 2178, 2179, 2177, 2175, - 2181, 2181, 2183, 2182, 2184, 2185, 2187, 2186, 2187, 2188, - 2189, 2185, 2186, 2190, 2190, 2196, 2191, 2183, 2189, 2192, - - 2192, 2193, 2193, 2194, 2184, 2195, 2189, 2188, 2191, 2199, - 2195, 2198, 2194, 2196, 2200, 2198, 2200, 2201, 2199, 2202, - 2203, 2199, 2204, 2205, 2202, 2202, 2212, 2207, 2208, 2209, - 2211, 2204, 2203, 2208, 2209, 2205, 2213, 2215, 2201, 2207, - 2214, 2214, 2216, 2211, 2217, 2213, 2212, 2218, 2219, 2222, - 2220, 2221, 2226, 2224, 2222, 2215, 2225, 2236, 2229, 2230, - 2216, 2238, 2217, 2218, 2220, 2224, 2221, 2229, 2225, 2227, - 2228, 2237, 2226, 2219, 2227, 2228, 2233, 2230, 2235, 2238, - 2236, 2239, 2233, 2240, 2235, 2242, 2237, 2241, 2241, 2243, - 2243, 2244, 2240, 2245, 2242, 2233, 2246, 2247, 2248, 2250, - - 2246, 2251, 2247, 2252, 2254, 0, 2239, 2251, 2253, 2244, - 2254, 2248, 2245, 2253, 2253, 2255, 2256, 2258, 2250, 2256, - 2257, 2255, 2261, 2261, 2263, 2252, 2262, 2262, 2257, 2264, - 2264, 2265, 2265, 2263, 2266, 2267, 2268, 2258, 2269, 2270, - 2270, 2262, 2268, 2269, 2271, 2271, 2266, 2275, 2276, 2272, - 2273, 2275, 2262, 2267, 2272, 2277, 2273, 2278, 2280, 2277, - 2281, 2282, 2284, 2283, 2285, 2281, 2287, 2284, 2276, 2286, - 2288, 2289, 2290, 2290, 2292, 2288, 2291, 2278, 2283, 2294, - 2291, 2295, 2285, 2280, 2282, 2286, 2287, 2293, 2296, 2292, - 2297, 2298, 2293, 2289, 2299, 2300, 2301, 2294, 2305, 2299, - - 2302, 2302, 2297, 2304, 2306, 2307, 2296, 2295, 2300, 2308, - 2298, 2304, 2309, 2312, 2301, 2310, 2311, 2305, 2313, 2319, - 2314, 2322, 2318, 2306, 2307, 2312, 2314, 2316, 2321, 0, - 2321, 2327, 2308, 2319, 2310, 2318, 2309, 2311, 2320, 2313, - 2326, 2322, 2316, 2324, 2320, 2323, 2323, 2325, 2324, 2328, - 2325, 2329, 2332, 2326, 2332, 2327, 2330, 2330, 2331, 2331, - 2333, 2333, 2334, 2328, 2329, 2335, 2336, 2337, 2337, 2339, - 2339, 2337, 2340, 2340, 2341, 2341, 2342, 2334, 2348, 2336, - 2335, 2343, 2343, 2344, 2344, 2342, 2345, 2347, 2342, 2349, - 2350, 2345, 2347, 2351, 2351, 2352, 2352, 2353, 2348, 2354, - - 2354, 2355, 2350, 2356, 2356, 2357, 2358, 2359, 2359, 2349, - 2361, 2358, 2360, 2360, 2362, 2363, 2353, 2364, 2365, 2355, - 2357, 2367, 2369, 2362, 2361, 2371, 2367, 2368, 2368, 2370, - 2370, 2364, 2363, 2372, 2373, 2377, 2374, 2365, 2372, 2374, - 2373, 2369, 2378, 2371, 2375, 2375, 2376, 2376, 2379, 2381, - 2379, 2382, 2383, 2383, 2377, 2384, 2386, 2378, 2387, 2388, - 2375, 2384, 2389, 2390, 2381, 2391, 2391, 2390, 2392, 2393, - 2382, 2394, 2398, 2387, 2393, 2395, 2386, 2389, 2397, 2397, - 2400, 2399, 2388, 2401, 2402, 2403, 2394, 2392, 2399, 2404, - 2395, 2407, 2398, 2407, 2400, 2405, 2405, 2406, 2411, 2410, - - 2403, 2401, 2402, 2412, 2408, 2410, 2406, 2408, 2412, 2413, - 2411, 2414, 2415, 2416, 2413, 2404, 2417, 2418, 2420, 2426, - 2423, 2417, 2408, 2420, 2408, 2415, 2421, 2422, 2431, 0, - 2427, 2421, 2422, 2424, 2416, 2423, 2414, 2429, 2425, 2424, - 2426, 2428, 2429, 2418, 2425, 2427, 2430, 2428, 2432, 2433, - 2434, 2430, 2433, 2431, 2435, 2436, 2437, 2438, 2439, 2444, - 2446, 2432, 2440, 2435, 2436, 2437, 2438, 2441, 2440, 2447, - 2434, 2442, 2439, 2441, 2456, 2442, 2448, 2448, 2447, 2444, - 2446, 2449, 2450, 2450, 2451, 2452, 2452, 2449, 2454, 2453, - 2456, 2450, 2459, 2451, 2453, 2457, 2458, 2458, 2463, 2468, - - 2460, 2462, 2464, 2465, 2468, 2469, 2470, 2459, 2454, 2460, - 2454, 2457, 0, 2462, 2463, 2465, 2467, 2464, 2470, 2467, - 2471, 2471, 2472, 2472, 2476, 2469, 2474, 2474, 2475, 2476, - 2477, 2475, 2478, 2479, 2480, 2480, 2477, 2481, 2478, 2482, - 2482, 2483, 2479, 2484, 2485, 2486, 2486, 2488, 2487, 2496, - 2489, 2481, 2491, 2483, 2487, 2489, 2491, 2484, 2496, 2492, - 2497, 2488, 2492, 2485, 2493, 2493, 2494, 2495, 2498, 2497, - 2499, 2494, 2495, 2501, 2499, 2500, 2500, 2503, 2504, 2505, - 2506, 2507, 2503, 2508, 2509, 2510, 2501, 2508, 2498, 2514, - 2510, 2511, 2513, 2513, 2515, 2507, 2512, 2511, 2504, 2505, - - 2506, 2516, 2512, 2517, 2509, 2518, 2521, 2514, 2517, 2519, - 2519, 2522, 2523, 2515, 2558, 2524, 2525, 2523, 2521, 2558, - 2516, 2524, 2525, 2526, 2529, 2531, 2518, 2522, 2527, 2532, - 2527, 2526, 2539, 2529, 2533, 2533, 2599, 2534, 2599, 2531, - 2534, 2535, 2535, 2532, 2537, 2538, 2544, 2537, 2538, 2540, - 2540, 2543, 2544, 2545, 2547, 2543, 2546, 2546, 2539, 2550, - 2550, 2552, 2554, 2547, 2555, 2545, 2559, 2560, 2561, 2562, - 2563, 2563, 2571, 2561, 2562, 2567, 2554, 2565, 2565, 2552, - 2555, 2567, 2568, 2569, 2569, 2570, 2572, 2574, 2560, 2580, - 2575, 2572, 2559, 2575, 2571, 2576, 2577, 2578, 2578, 2585, - - 2581, 2570, 2568, 2584, 2582, 2580, 2574, 2576, 2577, 2581, - 2582, 2583, 2587, 2587, 2585, 2588, 2589, 2583, 2588, 2590, - 2595, 2584, 2592, 2592, 2593, 2593, 2594, 2596, 2597, 2598, - 2600, 2594, 2601, 2602, 2598, 2589, 2596, 2590, 2595, 2604, - 2605, 2597, 2603, 2606, 2600, 2602, 2601, 2603, 2606, 2607, - 2607, 2608, 2608, 2609, 2609, 2610, 2610, 2611, 2612, 2604, - 2605, 2613, 2614, 2614, 2615, 2615, 2613, 2616, 2616, 2611, - 2617, 2618, 2619, 2620, 2621, 0, 2612, 2624, 2622, 2623, - 2623, 2627, 2617, 2632, 2619, 2625, 2625, 2626, 2626, 2628, - 2628, 2618, 2627, 2620, 2622, 2621, 2624, 2629, 2630, 2631, - - 2634, 2633, 2635, 2632, 2637, 2630, 2633, 2636, 2636, 2629, - 2639, 2631, 2640, 2637, 2638, 2638, 2641, 2642, 2644, 2643, - 2634, 2645, 2635, 2645, 2652, 2646, 2647, 2647, 2649, 2641, - 2648, 2650, 2640, 2643, 2653, 2654, 2639, 2646, 2656, 2648, - 2644, 2642, 2652, 2649, 2655, 2657, 2650, 2655, 2658, 2666, - 2657, 2668, 2656, 2658, 2659, 2659, 2653, 2667, 2654, 2660, - 2660, 2661, 2661, 2663, 2663, 2665, 2665, 2666, 2667, 2669, - 2668, 2671, 2672, 2673, 2674, 2679, 2675, 2676, 2677, 2678, - 2677, 0, 2680, 2686, 2669, 2675, 2681, 2681, 2683, 2685, - 2672, 2671, 2683, 2679, 2674, 2673, 2692, 2676, 2687, 2678, - - 2680, 2684, 2684, 2685, 2690, 2686, 2693, 2687, 2688, 2688, - 2691, 2691, 2694, 2690, 2692, 2695, 2696, 2697, 2698, 2700, - 2701, 2699, 2695, 2704, 2693, 2702, 2702, 2701, 2703, 2703, - 2694, 2696, 2705, 2706, 2711, 2697, 2698, 2699, 2700, 2706, - 2708, 2708, 2710, 2704, 2709, 2709, 2712, 2713, 2710, 2714, - 2705, 2715, 2711, 2716, 2717, 2717, 2718, 2719, 2716, 2720, - 2721, 2722, 2713, 0, 2712, 2715, 2729, 2723, 2714, 2725, - 2725, 2721, 2723, 2724, 2734, 2724, 2718, 2719, 2726, 2720, - 2726, 2722, 2727, 2727, 2731, 2729, 2732, 2733, 2737, 2741, - 2735, 2736, 2738, 2731, 2734, 2735, 2736, 2742, 2743, 2733, - - 2746, 2743, 2744, 2744, 2745, 2732, 2747, 2747, 2737, 2741, - 2748, 2738, 2749, 2750, 2752, 2742, 2753, 2750, 2746, 2745, - 2754, 2748, 2756, 2756, 2755, 2757, 2754, 2749, 2755, 2752, - 2759, 2753, 2760, 2761, 2762, 2762, 2764, 2765, 2757, 2766, - 2767, 2767, 2769, 2766, 2773, 2759, 2765, 2774, 2764, 2768, - 2768, 2771, 2760, 2761, 2770, 2770, 2771, 2772, 2775, 2774, - 2773, 2769, 2776, 2776, 2781, 2781, 2772, 2782, 2783, 2783, - 2784, 2785, 2786, 2787, 2790, 2790, 2791, 2788, 2775, 2789, - 2792, 2803, 2787, 2784, 2785, 2786, 2788, 2797, 2789, 2782, - 2794, 2794, 2797, 2799, 2800, 2792, 2791, 2801, 2799, 2802, - - 2803, 2804, 2801, 2805, 2807, 2811, 2815, 2802, 2800, 2809, - 2804, 2805, 2810, 2814, 2809, 2812, 2812, 2810, 2814, 2807, - 2811, 2813, 2813, 2816, 2816, 2815, 2817, 2818, 2819, 2820, - 2821, 0, 2818, 2817, 2822, 2824, 2821, 2823, 2823, 2822, - 2825, 2826, 2826, 2827, 2827, 2825, 2819, 2820, 2830, 2833, - 2824, 2831, 2831, 2832, 2833, 2833, 2832, 2834, 2835, 2836, - 2837, 2830, 2834, 2835, 2838, 2839, 2837, 2840, 2838, 2841, - 2839, 2842, 2843, 2836, 2844, 2845, 2840, 2846, 2847, 2842, - 2844, 2845, 2846, 2851, 2841, 2848, 2848, 2850, 2851, 2852, - 2847, 2854, 2852, 2843, 2850, 2856, 2857, 2858, 2859, 2860, - - 2856, 2857, 2858, 2854, 2861, 2862, 2863, 2863, 2864, 2868, - 2865, 2873, 2860, 2861, 2862, 2865, 2859, 2864, 2869, 2870, - 2874, 2875, 0, 2876, 2869, 2870, 2878, 2868, 2877, 2877, - 2873, 2879, 2884, 2878, 2881, 2882, 2883, 2883, 2885, 2887, - 2874, 2875, 2876, 2881, 2882, 2886, 2886, 2884, 2889, 2891, - 2879, 2892, 2894, 2885, 2895, 2892, 2893, 2893, 2887, 2896, - 2895, 2897, 2898, 2889, 2900, 2896, 2899, 2899, 2898, 2891, - 2901, 2902, 2900, 2904, 2905, 2907, 2902, 2894, 2910, 2897, - 2908, 2907, 2904, 2908, 2909, 2911, 2913, 2905, 2909, 2912, - 2912, 2915, 2915, 2916, 0, 2901, 2910, 2917, 2917, 2911, - - 2923, 2913, 2918, 2918, 2920, 2920, 2921, 2922, 2927, 2923, - 2921, 2916, 2922, 2925, 2925, 2928, 2930, 2929, 2931, 2933, - 2928, 2930, 2930, 2934, 2934, 2936, 2936, 2940, 2927, 2929, - 2931, 2937, 2937, 2938, 2938, 2939, 2941, 2944, 2939, 2933, - 2940, 2943, 2943, 2946, 2947, 2947, 2948, 2948, 2952, 2941, - 2949, 2949, 2950, 2951, 2951, 2944, 2953, 2954, 2955, 2956, - 2956, 2952, 2957, 2946, 2955, 2961, 2957, 2950, 2964, 2960, - 2961, 2954, 2963, 2965, 2953, 2960, 2966, 2963, 2963, 2967, - 2968, 2969, 2979, 2970, 2976, 2967, 2968, 2970, 2971, 2971, - 2974, 2964, 2976, 2965, 2977, 2974, 2966, 2977, 2980, 2981, - - 2981, 2980, 2982, 2983, 2984, 2985, 2969, 2979, 2983, 2986, - 2987, 2987, 2988, 2989, 2990, 2991, 2989, 0, 2996, 2982, - 2982, 2992, 2984, 2986, 2989, 2985, 2988, 2994, 2990, 2992, - 2995, 3006, 2994, 2994, 2991, 2995, 2995, 2996, 2997, 2997, - 2998, 2998, 2999, 2999, 3000, 3000, 3001, 3001, 3002, 3002, - 3003, 3004, 3005, 3007, 3008, 3009, 3004, 3006, 3010, 3008, - 3011, 3012, 3013, 3010, 3014, 3018, 3003, 3007, 3018, 3011, - 3016, 3016, 3005, 3019, 3009, 3017, 3017, 3020, 3020, 3021, - 3022, 3012, 3013, 3025, 3014, 3021, 3024, 3024, 3019, 3027, - 3025, 3026, 3026, 3030, 3027, 3029, 3029, 3031, 3022, 3032, - - 3033, 3035, 3030, 3036, 3036, 3039, 3031, 3040, 3032, 3033, - 3037, 3037, 3038, 3041, 3039, 3042, 3038, 3043, 3046, 3035, - 3047, 3048, 3044, 3058, 3041, 3048, 3040, 3044, 3044, 3047, - 3042, 3046, 3054, 3052, 3053, 3053, 3057, 3043, 3052, 3056, - 3056, 3059, 3061, 3061, 3062, 3063, 3054, 3067, 3058, 3068, - 3057, 3069, 3072, 3062, 3068, 3071, 3074, 3063, 3072, 3059, - 3069, 3076, 3078, 3085, 3079, 3080, 3080, 3078, 3074, 3079, - 3081, 3083, 3067, 3084, 3091, 3071, 3083, 3085, 3092, 3081, - 3086, 3086, 3076, 3091, 3086, 3093, 3084, 3088, 3088, 3089, - 3089, 3090, 3090, 3100, 3094, 3096, 3101, 3097, 3092, 3094, - - 3098, 3096, 3097, 3102, 3093, 3098, 3099, 3099, 3101, 3103, - 3104, 3100, 3105, 3106, 3103, 3107, 3107, 3109, 3105, 3114, - 3110, 3109, 3111, 3113, 3102, 3110, 3115, 3111, 3104, 3112, - 3112, 3117, 3119, 3119, 3114, 3121, 3122, 3123, 3106, 3124, - 3126, 3115, 3113, 3124, 3125, 3127, 3128, 3129, 3121, 3122, - 3123, 3117, 3129, 3125, 3128, 3130, 3126, 3131, 3131, 3132, - 3133, 3134, 3135, 3135, 3127, 3136, 3136, 3137, 3132, 3141, - 3146, 3140, 3150, 3143, 3151, 3130, 3140, 3140, 3133, 3143, - 3144, 3144, 3153, 3141, 3148, 3148, 3137, 3134, 3150, 3152, - 3151, 3146, 3154, 3158, 3152, 3157, 3157, 3154, 3153, 3159, - - 3160, 3161, 3162, 3162, 3163, 3166, 3160, 3167, 3159, 3165, - 3165, 3168, 3168, 3158, 3170, 3172, 3173, 3176, 3179, 3166, - 3170, 3180, 3173, 3163, 3161, 3174, 3167, 3177, 3177, 3182, - 3174, 3178, 3178, 3179, 3183, 3172, 3181, 3181, 3184, 3176, - 3182, 3180, 3185, 3183, 3186, 3187, 3188, 3190, 3185, 3189, - 3189, 3191, 3192, 3197, 3191, 3192, 3181, 3187, 3184, 3193, - 3193, 3198, 3190, 3186, 3199, 3197, 3188, 3200, 3200, 3201, - 3199, 3202, 3201, 3203, 3205, 3206, 3206, 3202, 3207, 3205, - 3208, 3198, 3209, 3207, 3210, 3211, 3211, 3214, 3209, 3215, - 3216, 3203, 3213, 3217, 3217, 3219, 3218, 3220, 3471, 3208, - - 3471, 3210, 3210, 3216, 3213, 3214, 3220, 3222, 3222, 3223, - 3223, 3219, 3224, 3224, 3215, 3218, 3225, 3226, 3227, 3228, - 3228, 3225, 3232, 3227, 3229, 3229, 3230, 3230, 3231, 3231, - 3233, 3226, 3234, 3239, 3235, 3232, 3238, 3238, 3234, 3235, - 3241, 3241, 3242, 3242, 3244, 3246, 3247, 3248, 3249, 3239, - 3250, 3250, 3252, 3252, 3253, 3254, 3233, 3255, 3257, 3262, - 3258, 3259, 3259, 3244, 3260, 3260, 3248, 3246, 3247, 3258, - 3249, 3255, 3264, 3263, 3254, 3265, 3266, 3262, 3257, 3263, - 3253, 3266, 3269, 3270, 3270, 3272, 3272, 3274, 3273, 3275, - 3276, 3277, 3264, 3273, 3265, 3275, 3278, 3278, 3283, 3277, - - 3279, 3274, 3276, 3269, 3281, 3279, 3282, 3284, 3281, 3285, - 3286, 3282, 3289, 3287, 3285, 3290, 3291, 3292, 3283, 3287, - 3289, 3294, 3286, 3297, 3295, 3296, 3298, 3284, 3300, 3301, - 3303, 3298, 3302, 3300, 3290, 3303, 3291, 3292, 3302, 3294, - 3295, 3305, 3296, 3296, 3297, 3306, 3307, 3320, 3306, 3301, - 3311, 3311, 3312, 3312, 3313, 3318, 3318, 3319, 3313, 3307, - 3323, 3305, 3319, 3321, 3321, 0, 3320, 3326, 3326, 3327, - 3327, 3336, 3327, 3328, 3328, 3323, 3328, 3329, 3329, 3330, - 3330, 3331, 3330, 3333, 3334, 3331, 3335, 3335, 3333, 3336, - 3337, 3340, 3340, 3334, 3341, 3342, 3343, 3344, 3344, 3345, - - 3348, 3343, 3349, 3350, 3337, 3352, 3354, 3350, 3351, 3349, - 0, 3355, 3356, 3356, 3341, 3342, 3355, 3351, 3357, 3345, - 3352, 3358, 3358, 3361, 3354, 3348, 3366, 3357, 3359, 3359, - 3360, 3360, 3362, 3363, 3364, 3365, 3368, 3362, 3361, 3364, - 3364, 3365, 3363, 3367, 3369, 3363, 3371, 3370, 0, 3369, - 3373, 3366, 3370, 3372, 3372, 3374, 3373, 3368, 3367, 3375, - 3375, 3374, 3376, 3376, 3377, 3371, 3378, 3381, 3381, 3383, - 3383, 3378, 3384, 3386, 3388, 3388, 3389, 3389, 3397, 3377, - 0, 3384, 3390, 3390, 3391, 3391, 3393, 3393, 3394, 3394, - 3399, 3386, 3395, 3395, 3396, 3396, 3400, 3400, 3402, 3399, - - 3401, 3401, 3403, 3404, 3397, 3406, 3406, 3402, 3407, 3408, - 3408, 3409, 3410, 3419, 3403, 3415, 3411, 3412, 3412, 3413, - 3413, 3416, 3416, 3404, 3421, 3410, 3409, 3407, 3411, 3420, - 3415, 3419, 3420, 3422, 3422, 3423, 3425, 3426, 3427, 3425, - 3428, 3429, 3431, 3426, 3430, 3428, 3434, 3437, 3433, 3438, - 3421, 3437, 3427, 3423, 3433, 3434, 3441, 3442, 3431, 3455, - 3429, 3451, 3430, 3461, 3438, 3452, 3451, 3464, 3452, 3456, - 3456, 3462, 3455, 3457, 3457, 3459, 3459, 3442, 3466, 3463, - 3462, 3468, 3441, 3463, 3469, 3470, 3461, 3464, 3472, 3474, - 3470, 3475, 3466, 3473, 3473, 3469, 3476, 3477, 3478, 3480, - - 3479, 3482, 3474, 3472, 3468, 3481, 3482, 3483, 3480, 3487, - 3475, 3484, 3485, 3477, 3476, 3479, 3484, 3481, 3486, 3486, - 3488, 3492, 3493, 3478, 3495, 3488, 3494, 3494, 3483, 3487, - 3500, 3485, 3501, 3495, 3505, 3492, 3496, 3496, 3497, 3497, - 3498, 3498, 3493, 3499, 3499, 3502, 3503, 3506, 3502, 3500, - 3504, 3503, 3501, 3508, 3507, 3504, 3509, 3512, 3510, 3505, - 3507, 3517, 3506, 3510, 3511, 3511, 3518, 3508, 3509, 3513, - 3513, 3514, 3514, 3516, 3516, 3521, 3517, 3512, 3519, 3519, - 3523, 3526, 3526, 3527, 3527, 3518, 3528, 3529, 3532, 3530, - 3521, 3531, 3533, 3534, 3528, 3530, 3535, 3531, 3523, 3536, - - 3536, 3535, 3532, 3538, 3538, 3533, 3529, 3542, 3545, 3543, - 3546, 3548, 3534, 3549, 3546, 3550, 3553, 3551, 3549, 3552, - 3554, 3555, 3545, 3556, 3556, 3554, 3555, 3559, 3542, 3543, - 3551, 3548, 3552, 3560, 3550, 3553, 3561, 3562, 3562, 3563, - 3564, 3565, 3565, 3566, 3563, 3567, 3564, 3559, 3566, 3568, - 3567, 3560, 3569, 3570, 3568, 3561, 3572, 3572, 3573, 3570, - 3574, 3574, 3576, 3573, 3577, 3578, 3576, 3579, 3580, 3581, - 3582, 3569, 3578, 3585, 3585, 3581, 3588, 3583, 3587, 3587, - 3590, 3591, 3592, 3577, 3597, 3588, 3579, 3580, 3588, 3582, - 3583, 3589, 3593, 3593, 3595, 3592, 3589, 3594, 3599, 3590, - - 3591, 3604, 3594, 3598, 3598, 3600, 3600, 3595, 3601, 3601, - 3597, 3602, 3603, 3605, 3605, 0, 3602, 3599, 3606, 3603, - 3604, 3609, 3607, 3606, 3607, 3608, 3608, 3610, 3609, 3611, - 3612, 3613, 3615, 3615, 3610, 3612, 3616, 3618, 3619, 3620, - 3621, 3625, 3618, 3619, 3622, 3622, 3624, 3624, 3611, 3626, - 3613, 3627, 3627, 3628, 3628, 3616, 3629, 3639, 3620, 3621, - 3625, 3631, 3631, 3629, 3632, 3632, 3633, 3635, 3626, 3638, - 3640, 0, 3635, 3633, 3638, 0, 3639, 3641, 3641, 3642, - 3642, 0, 0, 0, 0, 0, 0, 0, 0, 3640, - 3646, 3646, 3646, 3646, 3646, 3646, 3646, 3647, 3647, 3647, - - 3647, 3647, 3647, 3647, 3648, 3648, 3648, 3648, 3648, 3648, - 3648, 3649, 3649, 3649, 3649, 3649, 3649, 3649, 3650, 3650, - 3650, 3650, 3650, 3650, 3650, 3651, 3651, 3651, 3651, 3651, - 3651, 3651, 3652, 3652, 3652, 3652, 3652, 3652, 3652, 3654, - 3654, 0, 3654, 3654, 3654, 3654, 3655, 3655, 0, 0, - 0, 3655, 3655, 3656, 3656, 0, 0, 3656, 0, 3656, - 3657, 0, 0, 0, 0, 0, 3657, 3658, 3658, 0, - 0, 0, 3658, 3658, 3659, 0, 0, 0, 0, 0, - 3659, 3660, 3660, 0, 3660, 3660, 3660, 3660, 3661, 0, - 0, 0, 0, 0, 3661, 3662, 3662, 0, 0, 0, - - 3662, 3662, 3663, 3663, 0, 3663, 3663, 3663, 3663, 3645, - 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, - 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, - 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, - 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645, 3645 + 14, 14, 14, 100, 14, 12, 15, 15, 15, 38, + 23, 14, 23, 23, 12, 23, 3065, 15, 16, 16, + 16, 23, 23, 27, 27, 30, 30, 31, 31, 16, + 25, 27, 130, 25, 25, 27, 31, 25, 27, 32, + 30, 46, 25, 32, 25, 130, 32, 31, 40, 45, + 45, 25, 28, 32, 45, 32, 46, 28, 45, 36, + 36, 28, 40, 96, 28, 44, 28, 28, 36, 44, + 37, 37, 112, 56, 36, 37, 56, 28, 36, 44, + + 41, 41, 96, 44, 44, 41, 67, 67, 95, 37, + 112, 37, 39, 39, 42, 41, 41, 39, 41, 42, + 95, 39, 42, 43, 43, 73, 43, 39, 187, 42, + 39, 84, 84, 42, 42, 43, 187, 39, 152, 73, + 62, 43, 62, 62, 70, 62, 70, 70, 72, 70, + 72, 72, 79, 72, 79, 79, 70, 79, 86, 152, + 86, 86, 87, 86, 97, 89, 87, 89, 89, 86, + 89, 92, 102, 94, 92, 93, 89, 89, 98, 93, + 94, 98, 99, 101, 97, 99, 102, 102, 103, 104, + 105, 106, 101, 1192, 103, 107, 110, 108, 99, 109, + + 103, 107, 103, 113, 109, 114, 111, 104, 104, 114, + 106, 108, 105, 109, 107, 115, 110, 111, 111, 116, + 117, 113, 119, 118, 116, 111, 118, 120, 119, 118, + 122, 121, 126, 122, 117, 115, 121, 122, 123, 126, + 124, 125, 118, 118, 128, 125, 120, 119, 127, 129, + 131, 128, 137, 122, 124, 132, 121, 123, 129, 132, + 133, 127, 123, 134, 135, 139, 136, 134, 127, 141, + 131, 136, 137, 138, 138, 136, 140, 142, 133, 143, + 140, 136, 135, 144, 141, 139, 144, 145, 178, 140, + 146, 150, 147, 148, 148, 140, 146, 144, 143, 146, + + 145, 144, 149, 142, 147, 151, 153, 150, 154, 149, + 154, 148, 156, 155, 148, 157, 158, 156, 159, 154, + 149, 160, 153, 159, 151, 155, 198, 157, 162, 162, + 164, 154, 198, 164, 158, 160, 166, 174, 166, 166, + 174, 166, 169, 169, 171, 182, 171, 171, 172, 171, + 172, 172, 176, 172, 176, 176, 180, 176, 179, 179, + 172, 180, 181, 182, 183, 184, 185, 186, 181, 189, + 188, 190, 191, 193, 185, 192, 190, 181, 186, 183, + 195, 185, 193, 216, 189, 196, 192, 194, 184, 188, + 196, 202, 191, 194, 194, 197, 197, 199, 204, 199, + + 200, 216, 199, 202, 200, 195, 201, 201, 205, 200, + 203, 208, 207, 205, 200, 203, 203, 204, 206, 199, + 200, 200, 209, 206, 207, 210, 212, 211, 209, 210, + 213, 208, 211, 214, 215, 217, 218, 221, 220, 222, + 217, 218, 212, 220, 213, 230, 215, 227, 214, 215, + 271, 209, 219, 219, 223, 222, 219, 221, 219, 225, + 223, 224, 224, 226, 271, 225, 230, 227, 228, 226, + 219, 225, 219, 229, 228, 231, 233, 232, 233, 229, + 234, 231, 232, 235, 236, 241, 234, 235, 229, 237, + 236, 237, 238, 239, 240, 242, 237, 243, 238, 244, + + 240, 242, 246, 245, 247, 241, 239, 248, 250, 247, + 243, 245, 249, 251, 254, 246, 248, 253, 256, 243, + 252, 261, 253, 244, 250, 252, 252, 249, 258, 257, + 255, 259, 254, 251, 255, 257, 263, 260, 263, 262, + 256, 261, 259, 260, 262, 264, 258, 258, 265, 268, + 266, 267, 269, 270, 277, 265, 266, 267, 269, 272, + 272, 273, 273, 274, 264, 270, 275, 279, 268, 274, + 278, 276, 275, 276, 280, 278, 281, 277, 282, 279, + 283, 284, 297, 285, 281, 283, 286, 274, 285, 287, + 276, 288, 286, 280, 289, 287, 288, 290, 282, 289, + + 291, 293, 292, 290, 284, 294, 295, 297, 299, 296, + 302, 299, 298, 302, 294, 291, 292, 296, 298, 293, + 295, 300, 303, 300, 301, 301, 304, 304, 305, 305, + 306, 308, 307, 307, 308, 309, 310, 312, 314, 309, + 303, 311, 316, 315, 314, 310, 306, 307, 316, 317, + 311, 317, 318, 320, 320, 319, 312, 315, 318, 319, + 321, 322, 323, 324, 325, 321, 327, 322, 323, 326, + 328, 328, 329, 330, 331, 329, 319, 332, 331, 327, + 333, 335, 325, 324, 334, 334, 336, 323, 337, 336, + 326, 330, 340, 342, 339, 338, 332, 339, 333, 335, + + 337, 338, 342, 343, 340, 344, 336, 341, 346, 347, + 344, 346, 349, 361, 349, 349, 341, 348, 361, 341, + 351, 343, 347, 351, 341, 341, 341, 341, 345, 348, + 350, 345, 177, 345, 352, 350, 350, 352, 353, 353, + 354, 355, 358, 356, 357, 345, 345, 345, 364, 345, + 359, 358, 360, 360, 362, 362, 355, 354, 356, 359, + 354, 357, 357, 363, 363, 365, 366, 367, 368, 369, + 370, 366, 371, 364, 372, 372, 374, 372, 371, 367, + 365, 552, 383, 375, 376, 370, 372, 368, 375, 369, + 376, 383, 377, 372, 378, 379, 374, 377, 379, 378, + + 379, 380, 381, 382, 552, 378, 382, 385, 381, 384, + 384, 386, 386, 385, 392, 380, 387, 390, 393, 382, + 391, 387, 382, 391, 382, 388, 388, 399, 388, 392, + 394, 397, 396, 393, 388, 396, 175, 390, 388, 427, + 400, 391, 399, 388, 394, 397, 388, 389, 389, 400, + 389, 396, 401, 404, 402, 403, 406, 401, 401, 407, + 402, 409, 405, 389, 427, 406, 389, 402, 389, 408, + 389, 398, 404, 398, 398, 408, 403, 405, 407, 409, + 410, 411, 412, 398, 398, 398, 398, 398, 413, 415, + 398, 416, 414, 417, 413, 418, 412, 414, 413, 419, + + 418, 411, 420, 423, 419, 428, 410, 421, 417, 415, + 424, 416, 425, 421, 426, 414, 431, 420, 422, 422, + 426, 428, 424, 423, 429, 432, 425, 430, 430, 429, + 430, 433, 434, 437, 170, 435, 431, 436, 437, 436, + 438, 443, 438, 438, 442, 432, 439, 433, 434, 435, + 439, 440, 441, 441, 445, 440, 443, 444, 447, 449, + 438, 446, 450, 442, 451, 449, 447, 447, 453, 451, + 440, 450, 445, 444, 168, 446, 454, 453, 447, 452, + 447, 448, 454, 452, 455, 456, 448, 458, 457, 460, + 458, 456, 457, 462, 448, 448, 459, 470, 448, 448, + + 465, 459, 448, 461, 461, 455, 462, 463, 463, 460, + 464, 466, 466, 465, 467, 464, 469, 468, 470, 471, + 467, 468, 472, 474, 471, 473, 473, 472, 475, 476, + 477, 469, 479, 478, 473, 474, 478, 482, 480, 481, + 483, 482, 477, 480, 481, 484, 484, 476, 475, 485, + 486, 488, 483, 479, 485, 487, 487, 490, 491, 491, + 493, 494, 495, 490, 497, 496, 499, 498, 500, 494, + 502, 486, 498, 488, 496, 503, 504, 506, 505, 167, + 500, 493, 510, 495, 505, 497, 499, 510, 502, 507, + 502, 506, 508, 503, 509, 507, 504, 511, 512, 513, + + 509, 508, 513, 514, 515, 516, 512, 517, 518, 512, + 520, 511, 519, 517, 516, 519, 520, 514, 521, 515, + 522, 523, 525, 524, 526, 522, 525, 528, 518, 530, + 527, 529, 521, 531, 520, 527, 529, 532, 535, 536, + 537, 526, 528, 523, 524, 530, 539, 538, 541, 655, + 532, 538, 531, 533, 533, 537, 655, 540, 535, 533, + 536, 533, 540, 544, 541, 539, 542, 533, 546, 533, + 542, 543, 533, 533, 547, 548, 543, 545, 544, 533, + 543, 548, 545, 547, 546, 549, 548, 546, 550, 551, + 553, 555, 551, 554, 554, 556, 556, 557, 559, 558, + + 549, 561, 545, 562, 550, 560, 560, 565, 564, 563, + 553, 558, 557, 559, 563, 566, 555, 564, 567, 569, + 561, 574, 573, 570, 567, 562, 565, 570, 569, 571, + 566, 572, 575, 571, 573, 576, 574, 572, 577, 578, + 579, 580, 581, 583, 577, 580, 582, 586, 582, 576, + 587, 575, 584, 586, 578, 581, 585, 585, 579, 588, + 584, 590, 587, 589, 592, 588, 593, 583, 591, 589, + 594, 591, 597, 590, 595, 594, 596, 595, 592, 165, + 599, 593, 600, 600, 598, 596, 601, 601, 597, 598, + 598, 603, 596, 599, 602, 596, 602, 603, 604, 604, + + 605, 605, 606, 608, 607, 609, 610, 612, 606, 607, + 607, 611, 612, 613, 611, 614, 615, 616, 610, 615, + 617, 608, 616, 614, 619, 618, 609, 620, 619, 621, + 622, 624, 613, 620, 622, 623, 624, 625, 626, 626, + 627, 628, 629, 617, 618, 630, 633, 629, 632, 621, + 631, 625, 633, 623, 634, 627, 635, 637, 639, 634, + 638, 638, 628, 640, 630, 706, 631, 706, 632, 636, + 635, 643, 636, 641, 644, 637, 639, 636, 641, 640, + 636, 636, 642, 647, 646, 643, 653, 642, 648, 644, + 646, 648, 647, 649, 650, 651, 652, 649, 651, 650, + + 654, 652, 653, 656, 657, 658, 659, 659, 660, 657, + 661, 663, 664, 666, 665, 662, 656, 660, 654, 649, + 662, 667, 666, 672, 670, 658, 664, 670, 668, 661, + 665, 669, 663, 667, 668, 671, 671, 669, 671, 672, + 673, 674, 675, 673, 676, 677, 674, 678, 679, 680, + 683, 681, 678, 683, 684, 680, 681, 682, 676, 677, + 675, 685, 686, 682, 687, 695, 685, 679, 688, 687, + 687, 689, 690, 693, 691, 692, 163, 690, 686, 684, + 691, 688, 693, 694, 689, 695, 696, 696, 694, 697, + 698, 690, 690, 700, 692, 699, 697, 698, 699, 700, + + 701, 702, 703, 704, 704, 705, 702, 703, 703, 707, + 709, 710, 701, 699, 711, 708, 702, 708, 712, 713, + 714, 715, 716, 720, 717, 721, 716, 715, 707, 710, + 705, 709, 711, 717, 718, 719, 712, 723, 713, 722, + 714, 720, 722, 725, 721, 726, 727, 724, 728, 718, + 719, 722, 723, 724, 729, 730, 731, 733, 727, 726, + 731, 732, 734, 725, 735, 736, 737, 728, 740, 740, + 743, 738, 739, 733, 730, 729, 738, 741, 742, 732, + 734, 741, 735, 735, 736, 737, 739, 744, 745, 743, + 746, 747, 742, 748, 750, 746, 749, 753, 744, 751, + + 754, 750, 745, 752, 751, 754, 755, 747, 756, 749, + 752, 755, 748, 757, 758, 759, 760, 161, 761, 763, + 757, 753, 762, 758, 763, 760, 756, 766, 762, 759, + 761, 764, 765, 767, 764, 768, 765, 769, 770, 771, + 769, 766, 767, 772, 772, 773, 773, 774, 774, 776, + 768, 775, 770, 778, 773, 779, 775, 780, 776, 781, + 771, 779, 782, 783, 784, 785, 782, 786, 789, 787, + 790, 788, 778, 786, 791, 783, 780, 787, 788, 781, + 841, 797, 794, 785, 797, 798, 789, 802, 804, 784, + 801, 807, 841, 802, 791, 790, 792, 794, 792, 801, + + 805, 792, 798, 806, 814, 792, 805, 807, 792, 808, + 804, 812, 806, 808, 811, 792, 792, 813, 792, 809, + 809, 810, 810, 817, 814, 811, 815, 819, 820, 812, + 85, 813, 815, 816, 816, 816, 818, 816, 821, 822, + 816, 818, 821, 817, 827, 816, 820, 825, 819, 823, + 824, 816, 816, 823, 816, 824, 826, 828, 840, 827, + 840, 826, 829, 822, 831, 829, 825, 830, 833, 823, + 80, 831, 830, 830, 832, 832, 834, 835, 835, 836, + 842, 834, 828, 833, 836, 837, 838, 844, 837, 839, + 839, 838, 843, 845, 846, 848, 843, 847, 847, 842, + + 849, 851, 846, 850, 850, 852, 853, 844, 855, 854, + 848, 859, 845, 855, 849, 854, 859, 852, 857, 851, + 856, 856, 861, 857, 857, 860, 862, 863, 853, 864, + 866, 860, 865, 868, 869, 864, 866, 865, 867, 868, + 861, 867, 869, 870, 870, 862, 872, 863, 871, 871, + 873, 874, 875, 877, 878, 876, 880, 875, 873, 876, + 877, 879, 881, 881, 872, 882, 884, 884, 883, 874, + 886, 887, 878, 885, 882, 880, 883, 879, 889, 885, + 890, 891, 894, 893, 897, 894, 892, 889, 886, 890, + 887, 892, 893, 895, 896, 898, 900, 899, 895, 901, + + 903, 900, 900, 904, 898, 891, 902, 902, 896, 897, + 899, 905, 906, 901, 907, 903, 908, 911, 911, 908, + 905, 910, 904, 910, 912, 913, 914, 908, 915, 916, + 913, 917, 907, 915, 918, 919, 906, 920, 921, 922, + 923, 924, 925, 922, 926, 912, 920, 914, 925, 916, + 927, 917, 928, 926, 929, 919, 918, 930, 923, 931, + 924, 921, 927, 933, 932, 931, 935, 935, 928, 934, + 936, 930, 932, 929, 934, 937, 938, 933, 939, 940, + 941, 942, 943, 948, 944, 938, 945, 940, 946, 936, + 947, 950, 951, 949, 946, 937, 947, 948, 939, 949, + + 941, 943, 952, 942, 944, 950, 945, 953, 952, 955, + 954, 956, 951, 953, 954, 957, 958, 959, 959, 960, + 957, 961, 963, 956, 966, 960, 962, 961, 955, 962, + 964, 956, 965, 967, 967, 968, 969, 958, 965, 970, + 963, 969, 970, 964, 966, 971, 972, 975, 973, 977, + 971, 971, 973, 968, 976, 970, 979, 970, 974, 974, + 978, 972, 981, 982, 977, 978, 984, 985, 986, 975, + 991, 988, 989, 989, 976, 979, 988, 982, 990, 984, + 992, 992, 990, 993, 994, 991, 981, 985, 994, 986, + 987, 996, 995, 987, 75, 987, 998, 997, 999, 987, + + 1000, 987, 997, 999, 999, 996, 987, 995, 993, 1000, + 998, 987, 1001, 1002, 1006, 1003, 1004, 1002, 1009, 1006, + 1005, 1004, 1007, 1008, 1008, 1011, 1001, 1010, 1012, 1002, + 1003, 1004, 1005, 1012, 1011, 1014, 1007, 1013, 1015, 1009, + 1014, 1010, 1016, 1013, 1015, 1017, 1017, 1018, 1016, 1019, + 1020, 1021, 1018, 1022, 1024, 1019, 1025, 1027, 1028, 1028, + 1029, 1025, 1026, 1031, 1032, 1029, 1024, 1030, 1033, 1027, + 1021, 1022, 1020, 1023, 1023, 1030, 1026, 1031, 1034, 1023, + 1032, 1023, 1033, 1035, 1036, 1037, 1039, 1023, 1040, 1038, + 1042, 1037, 1023, 1023, 1038, 1041, 1043, 1034, 1039, 1023, + + 1036, 1045, 1035, 1044, 1044, 1045, 1040, 1046, 1042, 1048, + 1049, 1041, 1050, 1049, 1043, 1048, 1051, 1052, 1053, 1055, + 1054, 1051, 1062, 1057, 1053, 1054, 1058, 1046, 1059, 1064, + 1052, 1050, 1057, 1060, 1061, 1058, 1065, 1063, 1055, 1060, + 1066, 1062, 1063, 1061, 1059, 1067, 1068, 1069, 1070, 1064, + 1065, 1071, 1072, 1074, 1070, 1068, 1069, 1067, 1072, 1076, + 1066, 1077, 1078, 1081, 1082, 1079, 1080, 1083, 1071, 1074, + 1079, 1084, 1080, 1076, 1085, 1086, 1092, 1092, 1082, 1085, + 1086, 1077, 1081, 1089, 1090, 1083, 1084, 1078, 1089, 1090, + 1091, 1093, 1094, 1095, 1096, 1097, 1099, 1093, 1094, 1091, + + 1100, 1103, 1095, 1102, 1102, 1100, 1100, 1102, 1097, 1096, + 1104, 1105, 1099, 1104, 1106, 1107, 1103, 1108, 1110, 1109, + 1111, 1112, 1113, 1114, 1115, 1105, 1111, 1120, 1113, 1115, + 1116, 1107, 1109, 1110, 1106, 1108, 1118, 1118, 1114, 1119, + 1121, 1112, 1119, 1123, 1116, 1121, 1122, 1124, 1120, 1125, + 1126, 1122, 1127, 1130, 1125, 1126, 1124, 1129, 1132, 1123, + 1131, 1133, 1136, 1129, 1127, 1135, 1131, 1133, 1139, 1130, + 1134, 1134, 1137, 1140, 1135, 1137, 1138, 1138, 1141, 1132, + 1136, 1142, 1143, 1144, 1142, 1145, 1139, 1146, 1154, 1144, + 1155, 1145, 1140, 1146, 1147, 1143, 1148, 1149, 1141, 1147, + + 1150, 1148, 1151, 1149, 1153, 1150, 1154, 1156, 1151, 1153, + 1155, 1157, 1159, 1156, 1158, 1158, 1157, 1160, 1161, 1162, + 1163, 1159, 1164, 1161, 1165, 1164, 1160, 1165, 1167, 1166, + 1168, 1169, 1170, 1167, 1173, 1171, 1172, 1162, 1176, 1163, + 1166, 1171, 1172, 1169, 1177, 1174, 1175, 1175, 1168, 1173, + 1174, 1170, 1178, 1179, 1181, 1180, 1182, 1176, 1177, 1180, + 1183, 1184, 1186, 1191, 1178, 1182, 1187, 1187, 1188, 1189, + 1190, 1179, 1181, 1193, 1189, 1190, 1188, 1194, 1195, 1183, + 1196, 1186, 1197, 1191, 1198, 1196, 1184, 1193, 1199, 1199, + 1195, 1197, 1194, 1200, 1201, 1202, 1203, 1204, 1211, 1198, + + 1201, 1202, 1204, 1205, 1206, 1205, 1207, 1208, 1210, 1206, + 1209, 1212, 1203, 1200, 1212, 1209, 1214, 1211, 1213, 1215, + 1207, 1208, 1218, 1210, 1219, 1213, 1217, 1217, 1220, 1221, + 1222, 1214, 1223, 1226, 1226, 1221, 1218, 1223, 1215, 1232, + 1225, 1230, 1219, 1220, 1225, 1233, 1223, 1227, 1223, 1229, + 1222, 1223, 1227, 1228, 1228, 1230, 1229, 1231, 1232, 1234, + 1231, 1236, 1237, 1233, 1238, 1239, 1236, 1240, 1234, 1241, + 1243, 1239, 1240, 1242, 1245, 1245, 1238, 1246, 1248, 1252, + 1247, 1237, 1246, 1241, 1242, 1247, 1249, 1251, 1250, 1243, + 1253, 1249, 1250, 1254, 1252, 1256, 1251, 1255, 1248, 1257, + + 1255, 1258, 1259, 1260, 1261, 1253, 1257, 1264, 1262, 1255, + 1256, 1263, 1254, 1258, 1262, 1266, 1267, 1265, 1264, 1268, + 1270, 1259, 1261, 1265, 1260, 1269, 1263, 1272, 1268, 1271, + 1273, 1275, 1274, 1276, 1279, 1266, 1267, 1275, 1278, 1270, + 1269, 1271, 1280, 1281, 1278, 1282, 1272, 1274, 1283, 1279, + 1285, 1281, 1284, 1276, 1286, 1273, 1280, 1284, 1287, 1286, + 1286, 1288, 1285, 1289, 1283, 1282, 1290, 1290, 1292, 1295, + 1295, 1293, 1301, 1301, 74, 1288, 1289, 1287, 1291, 1291, + 1293, 1292, 1294, 1291, 1296, 1297, 1291, 1291, 1294, 1296, + 1298, 1291, 1302, 1299, 1297, 1300, 1298, 1291, 1299, 1305, + + 1300, 1291, 1303, 1303, 1304, 1306, 1307, 1304, 1308, 1304, + 1311, 1310, 1307, 1302, 1308, 1309, 1312, 1313, 1309, 1305, + 1310, 1312, 1314, 1306, 1318, 1320, 1315, 1316, 1317, 1318, + 1311, 1313, 1315, 1316, 1317, 1319, 1321, 1322, 1320, 1319, + 1314, 1323, 1322, 1324, 1324, 1321, 1325, 1325, 1326, 1325, + 1321, 1329, 1321, 1328, 1321, 1323, 1321, 1328, 1330, 1326, + 1332, 1331, 1333, 1334, 1335, 1336, 1329, 1333, 1333, 1332, + 1336, 1337, 1334, 1338, 1339, 1340, 1341, 1342, 1330, 1331, + 1343, 1343, 1338, 1342, 1344, 1337, 1335, 1345, 1346, 1348, + 1341, 1349, 1347, 1339, 1340, 1345, 1344, 1347, 1350, 1351, + + 1349, 1352, 1346, 1348, 1353, 1350, 1354, 1354, 1355, 1353, + 1356, 1356, 1358, 1357, 1358, 1361, 1360, 1351, 1357, 1360, + 1361, 1362, 1363, 1355, 1364, 1364, 1352, 1365, 1366, 1366, + 1368, 1363, 1367, 1367, 1369, 1368, 1370, 1371, 1372, 1372, + 1362, 1373, 1374, 1375, 1376, 1377, 1375, 1365, 1378, 1381, + 1380, 1377, 1380, 1378, 1379, 1369, 1384, 1370, 1371, 1374, + 1385, 1373, 1383, 1379, 1376, 1383, 1387, 1381, 1389, 1386, + 1388, 1384, 1390, 1385, 1386, 1388, 1389, 1390, 1391, 1392, + 1387, 1391, 1393, 1393, 1392, 1394, 1395, 1396, 1397, 1398, + 1394, 1400, 1401, 1396, 1402, 1397, 1403, 1400, 1401, 1402, + + 1404, 1403, 1398, 1405, 1395, 1406, 1404, 1407, 1408, 1408, + 1409, 1411, 1405, 1412, 1414, 1413, 1411, 1415, 1407, 1416, + 1417, 1418, 1419, 1420, 1406, 1413, 1417, 1418, 1419, 1414, + 1409, 1412, 1422, 1423, 1420, 1424, 1425, 1415, 1422, 1426, + 1427, 1428, 1416, 1429, 1429, 1430, 1431, 1423, 1432, 1434, + 1436, 1426, 1433, 1423, 1427, 1424, 1425, 1433, 1437, 1428, + 1435, 1435, 1439, 1437, 1440, 1430, 1432, 1434, 1441, 1440, + 1440, 1431, 1443, 1436, 1442, 1444, 1445, 1446, 1457, 1447, + 1443, 1439, 1450, 1442, 1447, 1448, 1441, 1447, 1449, 1444, + 1449, 1445, 1446, 1452, 1448, 1446, 1450, 1453, 1454, 1452, + + 1455, 1453, 1456, 1459, 1457, 1455, 1455, 1458, 1459, 1454, + 1460, 1461, 1462, 1463, 1464, 1460, 1461, 1465, 1467, 1464, + 1468, 1456, 1469, 1470, 1470, 1458, 1472, 1471, 1473, 1474, + 1462, 1471, 1467, 1463, 1475, 1474, 1476, 1465, 1468, 1477, + 1469, 1478, 1479, 1481, 1472, 1480, 1475, 1473, 1482, 1483, + 1485, 1486, 1476, 1482, 1484, 1478, 1483, 1479, 1477, 1484, + 1480, 1487, 1481, 1488, 1490, 1486, 1489, 1489, 1485, 1491, + 1492, 1494, 1488, 1493, 1493, 1495, 1500, 1494, 1491, 1490, + 1496, 1495, 1487, 1497, 1497, 1498, 1498, 1499, 1501, 1503, + 1492, 1502, 1500, 1499, 1496, 1503, 1502, 1504, 1505, 1506, + + 1506, 1507, 1507, 1504, 1505, 1509, 1509, 1510, 1511, 1501, + 1512, 1510, 1513, 1514, 1515, 1516, 1518, 1511, 1517, 1517, + 1521, 1507, 1516, 1507, 1513, 1519, 1520, 1514, 1512, 1515, + 1522, 1520, 1523, 1519, 1521, 1524, 1518, 1523, 1523, 1525, + 1524, 1524, 1526, 1526, 1527, 1528, 1529, 1530, 1531, 1522, + 1532, 1533, 1530, 1535, 1534, 1529, 1536, 1537, 1535, 1525, + 1534, 1538, 1539, 1527, 1528, 1540, 1541, 1531, 1544, 1533, + 1532, 1540, 1542, 1543, 1536, 1545, 1538, 1537, 1542, 1543, + 1546, 1547, 1548, 1549, 1545, 1541, 1551, 1544, 1539, 1550, + 1552, 1553, 1553, 1554, 1555, 1556, 1554, 1557, 68, 1546, + + 1547, 1548, 1549, 1550, 1561, 1552, 1562, 1551, 1561, 1557, + 1558, 1558, 1560, 1555, 1556, 1559, 1559, 1560, 1563, 1562, + 1564, 1565, 1566, 1570, 1566, 1568, 1569, 1571, 1566, 1564, + 1572, 1569, 1574, 1563, 1565, 1573, 1573, 1574, 1570, 1575, + 1576, 1566, 1578, 1568, 1577, 1575, 1572, 1571, 1578, 1579, + 1582, 1583, 1580, 1585, 1579, 1576, 1580, 1577, 1581, 1584, + 1586, 1589, 1581, 1587, 1587, 1591, 1586, 1592, 1584, 1583, + 1582, 1591, 1593, 1585, 1594, 1594, 1595, 1593, 1596, 1589, + 1598, 1598, 1595, 1600, 1601, 1601, 1600, 1602, 1592, 1603, + 1604, 1606, 1607, 1609, 1606, 1608, 1610, 1612, 1596, 1611, + + 1611, 1613, 1609, 1602, 1614, 1603, 1604, 1616, 1620, 1615, + 1621, 1617, 1612, 1607, 1615, 1608, 1610, 1617, 1618, 1618, + 1619, 1616, 1613, 1614, 1622, 1621, 1620, 1623, 1625, 1619, + 1624, 1624, 1626, 1627, 1629, 1629, 1628, 1630, 1627, 1631, + 1633, 1630, 1625, 1632, 1632, 1634, 1635, 1623, 1636, 1622, + 1626, 1628, 1636, 1637, 1642, 1638, 1645, 1635, 1641, 1631, + 1638, 1641, 1633, 1643, 1634, 1640, 1640, 1642, 1643, 1644, + 1646, 1647, 1637, 1648, 1645, 1649, 1652, 1650, 1651, 1651, + 63, 1652, 1653, 1654, 1646, 1644, 1650, 1648, 1655, 1655, + 1647, 1647, 1656, 1657, 1658, 1659, 1662, 1659, 1657, 1660, + + 1649, 1656, 1653, 1654, 1660, 1661, 1663, 1666, 1664, 1667, + 1667, 1661, 1663, 1664, 1658, 1668, 1662, 1669, 1672, 1671, + 1676, 1666, 1675, 1669, 1671, 1673, 1673, 1674, 1674, 1677, + 1678, 1679, 1679, 1678, 1668, 1680, 1675, 1681, 1676, 1682, + 1683, 1684, 1672, 1683, 1677, 1685, 1683, 1684, 1686, 1681, + 1685, 1686, 1688, 1680, 1690, 1689, 1692, 1692, 1683, 1682, + 1689, 1688, 1691, 1693, 1694, 1691, 1695, 1686, 1696, 1701, + 1694, 1702, 1695, 1696, 1697, 1697, 1698, 1698, 1699, 1690, + 1700, 1703, 1701, 1704, 1699, 1700, 1706, 1693, 1705, 1702, + 1707, 1705, 1706, 1708, 1711, 1710, 1707, 1709, 1715, 1708, + + 1703, 1710, 1709, 1704, 1712, 1713, 1713, 1714, 1716, 1712, + 1717, 1718, 1714, 1719, 1724, 1720, 1715, 1711, 1721, 1723, + 1722, 1726, 1725, 1726, 1727, 1717, 1725, 1732, 1716, 1720, + 1718, 1728, 1721, 1719, 1722, 1730, 1731, 1723, 1728, 1724, + 1732, 1734, 1735, 1727, 1733, 1736, 1737, 1730, 1731, 1738, + 1733, 1743, 1738, 1739, 1739, 1740, 1742, 1742, 1735, 1747, + 1737, 1734, 1744, 1745, 1740, 1736, 1748, 1744, 1746, 1746, + 1738, 1743, 1749, 1750, 1747, 1745, 1751, 1752, 1754, 1753, + 1748, 1755, 1759, 1757, 58, 1751, 1753, 1754, 1761, 1761, + 1754, 1750, 1752, 1762, 1762, 1764, 1749, 1755, 1757, 1760, + + 1763, 1765, 1760, 1757, 1765, 1766, 1766, 1759, 1767, 1768, + 1769, 1770, 1763, 1764, 1771, 1769, 1770, 1771, 1772, 1773, + 1775, 1767, 1774, 1776, 1773, 1777, 1778, 1779, 1768, 1782, + 1782, 1780, 1776, 1784, 1785, 1778, 1775, 1781, 1778, 1772, + 1780, 1774, 1783, 1781, 1777, 1786, 1787, 1785, 1788, 1783, + 1789, 1779, 1790, 1784, 1791, 1789, 1789, 1790, 1794, 1795, + 1787, 1796, 1796, 1786, 1788, 1797, 1791, 1799, 1797, 1798, + 1800, 1800, 1801, 1801, 1804, 1800, 1799, 1795, 1805, 1802, + 1806, 1803, 1809, 1794, 1807, 1798, 1803, 1801, 1802, 1807, + 1807, 1802, 1804, 1810, 1811, 1812, 1809, 1813, 1806, 1805, + + 1812, 1814, 1815, 1816, 1816, 1818, 1817, 1814, 1810, 1819, + 1818, 1813, 1817, 1820, 1823, 1821, 1811, 1824, 1825, 1820, + 1815, 1821, 1826, 1819, 1828, 1827, 1833, 1828, 1826, 1829, + 1834, 1831, 1825, 1828, 1823, 1829, 1835, 1824, 1827, 1831, + 1836, 1837, 1838, 1839, 1840, 1833, 1837, 1841, 1836, 1834, + 1842, 1838, 1843, 1840, 1850, 1835, 1839, 1844, 1844, 1845, + 1841, 1846, 1848, 1851, 1842, 1845, 1843, 1846, 1847, 1849, + 1849, 1847, 1852, 1854, 1850, 1848, 1853, 1853, 1855, 1844, + 1856, 1851, 1857, 1858, 1855, 1861, 1854, 1860, 1860, 1862, + 1863, 1852, 1864, 1862, 1865, 1863, 1868, 1867, 1857, 1865, + + 1870, 1858, 1856, 1866, 1871, 1861, 1867, 1872, 1866, 1873, + 1872, 1870, 1864, 1871, 1874, 1875, 1875, 1876, 1877, 1868, + 1878, 1873, 1879, 1879, 1881, 1882, 1880, 1886, 1883, 1874, + 1877, 1880, 1882, 1884, 1887, 1888, 1876, 1889, 1881, 1878, + 1883, 1888, 1890, 1894, 1891, 1884, 1886, 1892, 1892, 1889, + 1891, 57, 1893, 1897, 1887, 1893, 1895, 1895, 1897, 1898, + 1890, 1899, 1901, 1894, 1900, 1900, 1904, 1899, 1898, 1902, + 1903, 1902, 1905, 1903, 1901, 1906, 1908, 1907, 1909, 1910, + 1911, 1908, 1912, 1909, 1913, 1915, 1904, 1914, 1910, 1913, + 1921, 1918, 1911, 1906, 1905, 1907, 1914, 1912, 1916, 1917, + + 1919, 1919, 1920, 1916, 1917, 1915, 1918, 1923, 1920, 1914, + 1916, 1921, 1924, 1925, 1926, 1927, 1928, 1933, 1928, 1936, + 1929, 1930, 1930, 1923, 1931, 1931, 1932, 1932, 1934, 1934, + 1926, 1924, 1925, 1937, 1929, 1927, 1929, 1933, 1935, 1935, + 1936, 1938, 1939, 1939, 1940, 1941, 1942, 1944, 1940, 1942, + 1945, 1941, 1946, 1944, 1937, 1947, 1948, 1949, 1946, 1952, + 1950, 1948, 1938, 1950, 1951, 1951, 1953, 1956, 1945, 1954, + 1954, 1953, 1955, 1959, 1959, 1957, 1958, 1961, 1947, 1952, + 1957, 1958, 1949, 1961, 1960, 1962, 1963, 1955, 1956, 1960, + 1964, 1965, 1967, 1968, 1966, 1969, 1970, 1962, 1962, 1962, + + 1966, 1970, 1969, 1973, 1962, 1974, 1963, 1977, 1964, 1972, + 1976, 1965, 1967, 1968, 1972, 1972, 1975, 1973, 1975, 1978, + 1974, 1976, 1977, 1979, 1980, 1978, 1981, 1982, 1982, 1983, + 1984, 1984, 1979, 1985, 1986, 1987, 1987, 1988, 1988, 1989, + 1992, 1992, 1993, 1994, 1980, 1996, 1999, 1981, 1997, 2001, + 2000, 1998, 1994, 1985, 1996, 1983, 1986, 1998, 2003, 1989, + 2002, 2002, 2004, 2001, 2005, 1999, 2000, 1993, 2007, 1997, + 2010, 2005, 2006, 2008, 2008, 2009, 2009, 2004, 2013, 2003, + 2014, 2006, 2011, 2015, 2013, 2014, 2016, 2018, 2017, 2015, + 2019, 2021, 2019, 2018, 2007, 2017, 2010, 2022, 2011, 2023, + + 2023, 2026, 2024, 2022, 2025, 2027, 2016, 2024, 2028, 2029, + 2021, 2030, 2029, 2025, 2031, 2032, 2026, 2031, 2033, 2034, + 2034, 2037, 2035, 2030, 2036, 2027, 2042, 2028, 2035, 2041, + 2036, 2038, 2039, 2032, 2043, 2045, 2039, 2044, 2044, 2043, + 2047, 2037, 2046, 2049, 2033, 52, 2038, 2050, 2042, 2041, + 2052, 2050, 2039, 2051, 2051, 2047, 2052, 2053, 2055, 2045, + 2057, 2046, 2049, 2054, 2054, 2056, 2053, 2055, 2059, 2056, + 2060, 2057, 2058, 2058, 2061, 2062, 2057, 2063, 2064, 2065, + 2062, 2066, 2067, 2069, 2060, 47, 2068, 2066, 2069, 2059, + 2070, 2071, 2071, 2061, 2072, 2072, 2075, 2063, 2064, 2065, + + 2067, 2068, 2073, 2070, 2076, 2075, 2073, 2077, 2078, 2079, + 2079, 2081, 2081, 2078, 2086, 2076, 2082, 2083, 2085, 2088, + 2076, 2082, 2082, 2083, 2085, 2087, 2089, 2077, 2095, 2091, + 2087, 2088, 2089, 2092, 2093, 2094, 2094, 2092, 2096, 2097, + 2086, 2091, 2098, 2100, 2096, 2101, 2093, 2102, 2098, 2099, + 2099, 2103, 2102, 2095, 2105, 2106, 2109, 2109, 2114, 2107, + 18, 2097, 2100, 2103, 2107, 2101, 2105, 2110, 2111, 2111, + 2110, 2112, 2112, 2115, 2106, 2113, 2113, 2116, 2114, 2115, + 2117, 2118, 2119, 2116, 2121, 2117, 2125, 2118, 2128, 2121, + 2129, 2119, 2122, 2122, 2124, 2126, 2126, 2124, 2125, 2130, + + 2128, 2132, 2129, 2133, 2130, 2131, 2131, 2134, 2133, 2137, + 2132, 2135, 2134, 2138, 2135, 2136, 2136, 2139, 2140, 2141, + 2142, 2143, 2138, 2141, 2144, 2142, 2146, 2143, 2150, 2137, + 2145, 2147, 17, 2153, 2151, 2139, 2157, 2140, 2152, 2145, + 2149, 2149, 2144, 2151, 2146, 2147, 2150, 2152, 2154, 2154, + 2155, 2156, 2149, 2153, 2159, 2158, 2165, 2157, 2166, 2155, + 2158, 2162, 2162, 2156, 2167, 2164, 2169, 2159, 2164, 2170, + 2171, 2172, 2165, 2174, 2166, 2174, 2171, 2173, 2173, 2175, + 2167, 2169, 2176, 2170, 2177, 2177, 2178, 2183, 2172, 2180, + 2180, 2181, 2181, 2175, 2178, 2184, 2185, 2186, 2187, 2188, + + 2176, 2184, 2185, 2189, 2192, 2187, 2190, 2190, 2191, 2191, + 2183, 2186, 2193, 2195, 2194, 2196, 2197, 2191, 2199, 0, + 2198, 2188, 2201, 2189, 2193, 2192, 2194, 2196, 2195, 2198, + 2200, 2204, 2205, 2199, 2206, 2200, 2200, 2202, 2209, 2202, + 2202, 2208, 2197, 2202, 2212, 2201, 2206, 2207, 2207, 2210, + 2216, 2204, 2210, 0, 2222, 2205, 2202, 2211, 2209, 2208, + 2214, 2215, 2211, 2215, 2212, 2214, 2217, 2218, 2216, 2220, + 2223, 2217, 2222, 2224, 2218, 2225, 2226, 2225, 2220, 2223, + 2227, 2228, 2229, 2232, 2231, 2224, 2231, 2228, 2233, 2233, + 2234, 2235, 2236, 2238, 2236, 2226, 2235, 2232, 2238, 2239, + + 2227, 2240, 2229, 2241, 2239, 2242, 2243, 2245, 2244, 2247, + 2246, 2250, 2243, 2244, 2247, 2247, 2234, 2251, 2248, 2240, + 2245, 2241, 2246, 2252, 2256, 2242, 2248, 2253, 2253, 2255, + 2250, 2251, 2254, 2254, 2257, 2252, 2258, 2261, 2259, 2256, + 2255, 2262, 2258, 2259, 2260, 2269, 2260, 2263, 2263, 2262, + 2264, 2265, 2265, 2274, 2257, 2261, 2267, 2262, 2266, 2266, + 2271, 2268, 2264, 2269, 2271, 2267, 2268, 2272, 2273, 2276, + 2273, 2277, 2275, 2278, 2274, 2280, 2272, 2275, 2275, 2272, + 2277, 2276, 2281, 2285, 2282, 2278, 2283, 2286, 2280, 2282, + 2287, 2283, 2288, 2288, 2281, 2286, 2285, 2289, 2290, 2287, + + 2291, 2292, 2293, 2296, 2300, 2294, 2295, 2286, 2296, 2301, + 2298, 2299, 2304, 2310, 2301, 2289, 2290, 2292, 2291, 2294, + 2302, 2295, 2298, 2299, 2300, 2302, 2303, 2293, 2307, 2311, + 2304, 2309, 2312, 2313, 2307, 2303, 2310, 2309, 2318, 2314, + 2315, 2315, 2316, 2319, 2311, 2317, 2317, 2307, 2314, 2320, + 2312, 2316, 2321, 2320, 2322, 2324, 2318, 2321, 2313, 2325, + 2326, 2333, 2319, 2327, 2328, 2325, 2329, 2322, 2327, 2327, + 2328, 2332, 2329, 2330, 2324, 2342, 2330, 2336, 2336, 2332, + 2338, 2333, 2326, 2337, 2337, 2339, 2339, 2340, 2340, 2338, + 2341, 2344, 2352, 2342, 2345, 2346, 2346, 2344, 2337, 2345, + + 2347, 2347, 2341, 2348, 2349, 2354, 2356, 2351, 2348, 2337, + 2349, 2351, 2352, 2353, 2357, 2358, 2360, 2353, 2359, 2357, + 2362, 2360, 2361, 2363, 2364, 2354, 2365, 2366, 2366, 2364, + 2367, 2356, 2368, 2359, 2367, 2370, 2362, 2369, 2358, 2371, + 2361, 2372, 2369, 2363, 2373, 2374, 2375, 2368, 2365, 2376, + 2377, 2375, 2380, 2370, 2378, 2378, 2373, 2381, 2382, 2372, + 2380, 2383, 2376, 2384, 2374, 2371, 2385, 2388, 2377, 2386, + 2387, 2389, 2390, 2396, 2393, 2391, 2381, 2382, 2390, 2388, + 2383, 2391, 2395, 2398, 2399, 2398, 2384, 2396, 2386, 2393, + 2385, 2387, 2389, 2397, 2403, 2395, 2400, 2400, 2401, 2397, + + 2404, 2405, 2402, 2401, 2399, 2402, 2406, 2403, 2407, 2407, + 2408, 2408, 2409, 2411, 2409, 2405, 2410, 2410, 2412, 2406, + 2418, 2413, 2414, 2414, 2404, 2426, 2414, 0, 2411, 2416, + 2416, 2417, 2417, 2412, 2413, 2418, 2419, 2419, 2420, 2421, + 2421, 2422, 2422, 2423, 2425, 2426, 2427, 2420, 2423, 2425, + 2420, 2428, 2429, 2429, 2430, 2430, 2431, 2432, 2432, 2433, + 2434, 2434, 2436, 2428, 2435, 2440, 2427, 2436, 2437, 2437, + 2438, 2438, 2439, 2442, 2440, 2431, 2445, 2433, 2444, 2435, + 2441, 2441, 2443, 2443, 2447, 2449, 2439, 2448, 2448, 2447, + 2442, 2451, 2444, 2450, 2450, 2445, 2452, 2453, 2457, 2454, + + 2458, 2452, 2454, 2453, 2449, 2455, 2455, 2456, 2456, 2451, + 2459, 2461, 2459, 2462, 2464, 2458, 2466, 2457, 2463, 2463, + 2464, 2455, 2467, 2468, 2469, 2470, 2461, 2471, 2471, 2470, + 2472, 2478, 2462, 2473, 2480, 2474, 2466, 2467, 2473, 2469, + 2475, 2475, 2477, 2477, 2481, 2479, 2468, 2482, 2480, 2472, + 2474, 2478, 2479, 2483, 2484, 2475, 2485, 2485, 2486, 2487, + 2491, 2487, 2481, 2488, 2490, 2482, 2488, 2486, 2483, 2492, + 2490, 2493, 2491, 2494, 2492, 2495, 2493, 2496, 2494, 2498, + 2484, 2488, 2497, 2488, 2499, 2500, 2502, 2503, 2498, 2499, + 2496, 2502, 2503, 2504, 2505, 2506, 2507, 2508, 2504, 2509, + + 2495, 2506, 2507, 2497, 2510, 2513, 2514, 2511, 2512, 2505, + 2510, 2500, 2511, 2512, 2509, 2516, 2517, 2515, 2508, 2514, + 2515, 2522, 2518, 2519, 2520, 2517, 2521, 2522, 2523, 2526, + 2513, 2518, 2519, 2520, 2523, 2516, 2528, 2524, 2529, 2531, + 2521, 2524, 2530, 2530, 2533, 2531, 2536, 2529, 2538, 2526, + 2532, 2532, 2535, 2533, 2534, 2534, 2528, 2535, 2539, 2532, + 2540, 2540, 2541, 2542, 2538, 2545, 2536, 2544, 2536, 2546, + 2547, 2551, 2542, 2549, 2539, 2550, 2549, 2541, 2552, 2544, + 2550, 2545, 2547, 2559, 2546, 2553, 2553, 2554, 2554, 2559, + 2552, 2551, 2556, 2556, 2557, 2558, 2560, 2557, 2561, 2563, + + 2558, 2566, 2560, 2562, 2562, 2564, 2564, 2561, 2565, 2567, + 2568, 2568, 2569, 2563, 2571, 2566, 2570, 2573, 2569, 2571, + 2565, 2573, 2574, 2575, 2575, 2574, 2576, 2577, 2567, 2578, + 2570, 2576, 2577, 2579, 2580, 2581, 2582, 2582, 2578, 2581, + 2583, 2585, 2579, 2586, 2587, 2588, 2585, 2589, 2590, 2591, + 2592, 2593, 2590, 2583, 2580, 2592, 2594, 2593, 2595, 2595, + 2597, 2589, 2594, 2586, 2587, 2588, 2596, 2596, 2598, 2591, + 2599, 2600, 2601, 2602, 2602, 2607, 2600, 2606, 2597, 2604, + 2605, 2607, 2606, 2610, 2608, 2610, 2609, 2598, 2612, 2599, + 2608, 2604, 2614, 2601, 2609, 2615, 2605, 2612, 2616, 2616, + + 2617, 2618, 2618, 2617, 2620, 2621, 2614, 2620, 2622, 2615, + 2623, 2622, 2624, 2624, 2627, 2628, 2629, 2631, 2627, 2636, + 2621, 2628, 2630, 2630, 2634, 2634, 2631, 2638, 2629, 2639, + 2642, 2643, 2644, 2645, 2647, 2642, 2623, 2636, 2648, 2647, + 2654, 2638, 2657, 2648, 2660, 2639, 2649, 2649, 2651, 2651, + 2644, 2656, 2653, 2662, 2645, 2655, 2655, 2643, 2653, 2661, + 2654, 2658, 2661, 2660, 2657, 2662, 2658, 2656, 2663, 2664, + 2664, 2666, 2667, 2668, 2670, 2671, 2669, 2673, 2673, 2668, + 2663, 2667, 2669, 2674, 2675, 2676, 2674, 2666, 2677, 2682, + 2671, 2683, 2670, 2679, 2679, 2680, 2680, 2681, 2684, 2686, + + 2683, 2686, 2681, 2675, 2676, 2676, 2677, 2682, 2685, 2687, + 2688, 2684, 2690, 2685, 2689, 2691, 2692, 2690, 2694, 2694, + 2693, 2699, 2695, 2687, 2688, 2693, 2689, 2696, 2696, 2697, + 2697, 2698, 2698, 2699, 2701, 2691, 2692, 2695, 2700, 2702, + 2700, 2703, 2703, 2706, 2702, 2704, 2704, 2705, 2705, 2707, + 2708, 2709, 2701, 2710, 2711, 2706, 2712, 2712, 2713, 2714, + 2714, 2716, 2708, 2715, 2715, 2717, 2717, 2718, 2719, 2707, + 2711, 2709, 2716, 2720, 2710, 2719, 2721, 2713, 2722, 2718, + 2723, 2724, 2726, 2722, 2728, 2720, 2725, 2725, 2727, 2727, + 2730, 2726, 2729, 2731, 2732, 2735, 2721, 2733, 2736, 2736, + + 2723, 2724, 2734, 2730, 2734, 2737, 2738, 2735, 2732, 2739, + 2728, 2741, 2729, 2742, 2737, 2743, 2745, 2731, 2784, 2733, + 2744, 2738, 2746, 2744, 2739, 2784, 2747, 2746, 2755, 2741, + 2745, 2747, 2748, 2748, 2756, 2742, 2749, 2749, 2743, 2750, + 2750, 2752, 2752, 2754, 2754, 2756, 2755, 2757, 2758, 2760, + 2761, 2762, 2763, 2764, 2765, 2766, 2767, 2766, 0, 2768, + 2769, 2774, 2764, 2758, 2770, 2770, 2757, 2772, 2761, 2760, + 2775, 2772, 2763, 2762, 2765, 2774, 2767, 2768, 2769, 2773, + 2773, 2776, 2777, 2777, 2779, 2780, 2780, 2781, 2782, 2783, + 2776, 2789, 2775, 2779, 2785, 2786, 2787, 2790, 2794, 2788, + + 0, 2790, 2792, 2792, 2791, 2781, 2782, 2783, 2795, 2785, + 2789, 2791, 2804, 2786, 2787, 2788, 2793, 2793, 2794, 2796, + 2798, 2798, 2799, 2799, 2800, 2796, 2795, 2801, 2802, 2803, + 2800, 2804, 2806, 2805, 2807, 2807, 2808, 2806, 2809, 2810, + 2811, 2812, 2813, 2814, 2803, 2801, 2802, 2805, 2814, 2816, + 2816, 2811, 2812, 2815, 2820, 2815, 2808, 2822, 2809, 2810, + 2823, 2817, 2813, 2817, 2818, 2818, 2822, 2825, 2824, 2826, + 2827, 2828, 2829, 2820, 2826, 2830, 2828, 2833, 2834, 2823, + 2824, 2835, 2836, 2836, 2835, 2837, 2838, 2825, 2839, 2839, + 2827, 2840, 2829, 2841, 2830, 2842, 2834, 2833, 2844, 2842, + + 2837, 2845, 2840, 2846, 2838, 2849, 2847, 2851, 2841, 2846, + 2847, 2848, 2848, 2844, 2852, 2854, 2845, 2853, 2849, 2855, + 2856, 2856, 2851, 2854, 2859, 2858, 2860, 2861, 2861, 2863, + 2860, 2862, 2862, 2859, 2852, 2866, 2853, 2858, 2865, 2855, + 2864, 2864, 2867, 2865, 2866, 2868, 2869, 2872, 2863, 2870, + 2870, 2876, 2876, 2877, 2878, 2879, 2879, 2868, 2867, 2880, + 2881, 2882, 2877, 2886, 2886, 2887, 2869, 2888, 2872, 2883, + 2884, 2885, 2880, 2881, 2882, 2896, 2878, 2899, 2883, 2884, + 2885, 2893, 2888, 2890, 2890, 2887, 2893, 2895, 2897, 2896, + 2898, 2900, 2895, 2897, 2901, 2903, 2899, 2907, 2898, 2905, + + 2900, 2906, 2901, 2911, 2905, 2915, 2906, 2908, 2908, 2916, + 2903, 2910, 2907, 2909, 2909, 2914, 2910, 2912, 2912, 2913, + 2914, 2920, 2911, 2915, 2917, 0, 2913, 2916, 2918, 2921, + 2917, 2919, 2919, 2918, 2921, 2926, 2920, 2922, 2922, 2923, + 2923, 2927, 2927, 2928, 2929, 2932, 2928, 2930, 2926, 2929, + 2929, 2931, 2930, 2934, 2933, 2936, 2931, 2934, 2935, 2932, + 2933, 2937, 2938, 2935, 2936, 2939, 2940, 2941, 2943, 2942, + 2938, 2950, 2940, 2941, 2942, 2946, 2937, 2944, 2944, 2947, + 2943, 2955, 2946, 2950, 2947, 2948, 2939, 2952, 2948, 2953, + 2954, 2956, 2952, 2957, 2953, 2954, 2958, 2959, 2959, 2955, + + 2960, 2962, 2957, 2961, 2956, 2958, 2962, 2961, 2965, 2960, + 2966, 2967, 2970, 2971, 2972, 2975, 2966, 2967, 2973, 2974, + 2974, 2976, 2975, 2978, 2980, 2980, 2965, 2979, 2981, 2982, + 2983, 2970, 2978, 2971, 2972, 2985, 2979, 2973, 2982, 2992, + 2976, 2984, 2984, 2981, 2987, 2983, 2989, 2990, 2991, 2991, + 2993, 2990, 2994, 2995, 2985, 2996, 2993, 2997, 2994, 2987, + 2998, 2998, 2999, 2997, 2992, 3000, 2989, 3003, 3004, 3001, + 2999, 3006, 2995, 2996, 3001, 3007, 3003, 3006, 3007, 3008, + 3009, 3004, 3010, 3008, 3011, 3011, 3012, 3014, 3014, 3015, + 3000, 3016, 3016, 3017, 3018, 3018, 3010, 3024, 3009, 3019, + + 3019, 3012, 3021, 3021, 3022, 3023, 3024, 3015, 3022, 3028, + 3023, 3026, 3026, 3029, 3030, 3031, 3017, 3034, 3029, 3032, + 3031, 3031, 3035, 3036, 3037, 3037, 3030, 3039, 3039, 3028, + 3047, 3032, 3040, 3040, 3041, 3041, 3042, 3034, 3043, 3042, + 3044, 3049, 3035, 3036, 3046, 3046, 3050, 3050, 3047, 3051, + 3051, 3043, 3053, 3044, 3052, 3052, 3054, 3054, 3055, 3056, + 3057, 3049, 3058, 3059, 3059, 3060, 3063, 3053, 3058, 3060, + 3064, 3055, 3063, 3066, 3057, 3064, 3067, 3056, 3066, 3066, + 3068, 3069, 3070, 3071, 3072, 3082, 3073, 3079, 3070, 3071, + 3073, 3074, 3074, 3077, 3080, 3079, 3085, 3080, 3077, 3067, + + 3068, 3069, 3083, 3084, 3084, 3083, 3086, 3087, 3088, 3072, + 3082, 3086, 3089, 3085, 3085, 3090, 3090, 3091, 3092, 3093, + 3094, 3092, 3095, 3099, 0, 3087, 3089, 3110, 3088, 3092, + 3095, 3091, 3097, 3093, 3109, 3098, 3110, 3097, 3097, 3094, + 3098, 3098, 3099, 3100, 3100, 3101, 3101, 3102, 3102, 3103, + 3103, 3104, 3104, 3105, 3105, 3106, 3107, 3108, 3111, 3112, + 3109, 3107, 3113, 3114, 3112, 3115, 3116, 3117, 3114, 3118, + 3122, 3106, 3111, 3122, 3115, 3120, 3120, 3108, 3121, 3121, + 3123, 3113, 3124, 3124, 3125, 3127, 3116, 3117, 3126, 3118, + 3125, 3129, 3129, 3126, 3130, 3123, 3131, 3131, 3135, 3132, + + 3136, 3130, 3141, 3127, 3132, 3134, 3134, 3135, 3138, 3136, + 3137, 3137, 3139, 3142, 3142, 3143, 3143, 3138, 3144, 3145, + 3141, 3139, 3144, 3146, 3147, 3148, 3149, 3150, 3145, 3153, + 3152, 3160, 3150, 3150, 3156, 3147, 3160, 3154, 3153, 3162, + 3148, 3154, 3146, 3152, 3161, 3161, 3149, 3164, 3164, 3156, + 3165, 3166, 3167, 3162, 3169, 3169, 3170, 3170, 3171, 3172, + 3173, 3177, 3179, 3178, 3165, 3172, 3184, 3171, 3178, 3181, + 3167, 3179, 3173, 3182, 3186, 3188, 3166, 3189, 3184, 3182, + 3188, 3191, 3189, 3190, 3190, 3194, 3177, 3193, 3195, 3181, + 3191, 3202, 3193, 3196, 3196, 3186, 3203, 3196, 3194, 3198, + + 3198, 3201, 3195, 3199, 3199, 3200, 3200, 3204, 3206, 3210, + 3201, 3202, 3204, 3207, 3206, 3203, 3208, 3211, 3207, 3209, + 3209, 3208, 3212, 3213, 3214, 3215, 3216, 3210, 3213, 3211, + 3219, 3215, 3217, 3217, 3219, 3220, 3221, 3222, 3222, 3223, + 3220, 3221, 3214, 3212, 3224, 3225, 3227, 3229, 3229, 3231, + 3232, 3216, 3233, 3234, 3236, 3235, 3237, 3234, 3223, 3224, + 3225, 3238, 3231, 3232, 3235, 3233, 3227, 3239, 3240, 3238, + 3236, 3241, 3239, 3242, 3242, 3237, 3243, 3244, 3245, 3246, + 3246, 3247, 3247, 3248, 3251, 3243, 3252, 3254, 3240, 3251, + 3251, 3241, 3258, 3254, 3262, 3244, 3255, 3255, 3256, 3256, + + 3252, 3263, 3248, 3265, 3245, 3260, 3260, 3266, 3265, 3267, + 3262, 3270, 3270, 3258, 3267, 3271, 3272, 3263, 3273, 3274, + 3275, 3275, 3276, 3266, 3273, 3272, 3278, 3278, 3280, 3279, + 3281, 3282, 3282, 3284, 3286, 3271, 3291, 3292, 3287, 3284, + 3288, 3276, 3274, 3279, 3287, 3288, 3295, 3280, 3281, 3293, + 3293, 3294, 3294, 3296, 3286, 3297, 3297, 3298, 3291, 3300, + 3299, 3295, 3302, 3292, 3301, 3303, 3304, 3306, 3298, 3299, + 3301, 3305, 3305, 3296, 3314, 3297, 0, 3303, 3313, 3300, + 3307, 3302, 3306, 3307, 3308, 3315, 3304, 3308, 3309, 3309, + 3313, 3315, 3316, 3316, 3314, 3317, 3318, 3319, 3317, 3321, + + 3322, 3322, 3318, 3323, 3321, 3324, 3325, 3329, 3323, 3326, + 3327, 3327, 3325, 3330, 3331, 3319, 3332, 3333, 3333, 3329, + 3335, 3334, 3351, 3336, 3324, 3341, 3326, 3326, 3351, 3332, + 3341, 3330, 3336, 3338, 3338, 3342, 3335, 3339, 3339, 3331, + 3334, 3340, 3340, 3343, 3344, 3344, 3345, 3345, 3343, 3342, + 3346, 3346, 3347, 3348, 3348, 3349, 3350, 3352, 3355, 3355, + 3356, 3347, 3352, 3358, 3358, 3359, 3359, 3362, 3349, 3364, + 3365, 3366, 3367, 3368, 3368, 3371, 3356, 3370, 3370, 3372, + 3375, 3373, 3350, 3383, 3376, 3379, 3362, 3377, 3377, 3379, + 3366, 3364, 3365, 3376, 3367, 3373, 3378, 3378, 3372, 3381, + + 3375, 3371, 3382, 3383, 3384, 3385, 3386, 3389, 3382, 0, + 3385, 3386, 3390, 3390, 3392, 3392, 3393, 3381, 3394, 3395, + 3401, 3393, 3396, 3384, 3401, 3395, 3399, 3397, 3389, 3398, + 3398, 3399, 3394, 3402, 3396, 3397, 3403, 3404, 3402, 3405, + 3406, 3407, 3409, 3410, 3405, 3411, 3412, 3407, 3415, 3414, + 3409, 3416, 3406, 3417, 3418, 3420, 3403, 3404, 3421, 3418, + 3420, 3425, 3410, 0, 3415, 3411, 3412, 3414, 3416, 3416, + 3422, 3427, 3423, 0, 3417, 3437, 3422, 3423, 3421, 3426, + 3457, 3425, 3426, 3441, 3427, 3431, 3431, 3432, 3432, 3433, + 3437, 3439, 3439, 3433, 3440, 3442, 3442, 3444, 3457, 3440, + + 3447, 3447, 3441, 3448, 3448, 3452, 3448, 3449, 3449, 3452, + 3449, 3455, 3444, 3450, 3450, 3451, 3451, 3454, 3451, 3458, + 3455, 3463, 3454, 3456, 3456, 3461, 3461, 3462, 3462, 3464, + 3465, 3466, 3466, 3458, 3467, 3465, 3468, 3471, 3472, 3473, + 3475, 3463, 3474, 3473, 3546, 3472, 3477, 3546, 3478, 3464, + 3480, 3474, 3467, 3478, 3484, 3475, 3468, 3479, 3479, 3480, + 3481, 3481, 3471, 3489, 3477, 3482, 3482, 3483, 3483, 3484, + 3485, 3486, 3487, 3488, 3490, 3485, 3491, 3487, 3487, 3488, + 3486, 3492, 3493, 3486, 3494, 0, 3492, 3493, 3489, 3490, + 3495, 3495, 3496, 3497, 3498, 3498, 3500, 3491, 3496, 3497, + + 3499, 3499, 3501, 3494, 3504, 3504, 3505, 3501, 3507, 3507, + 3508, 3500, 3510, 3512, 3512, 3513, 3513, 3514, 3514, 3508, + 3505, 3515, 3515, 3517, 3517, 3518, 3518, 3519, 3519, 3521, + 3510, 3520, 3520, 3523, 3524, 3524, 3526, 3526, 3527, 3528, + 3529, 3531, 3523, 3532, 3532, 3533, 3535, 3527, 3534, 3534, + 3536, 3528, 3547, 3537, 3541, 3521, 3531, 3538, 3538, 3545, + 3529, 3535, 3549, 3536, 3533, 3537, 3539, 3539, 3552, 3541, + 3542, 3542, 3548, 3548, 3552, 3553, 3551, 3545, 3547, 3551, + 3549, 3554, 3555, 3557, 3556, 3559, 3554, 3560, 3563, 3553, + 3564, 3559, 3563, 3566, 3566, 3568, 3560, 3569, 3578, 3557, + + 3582, 3555, 3556, 3578, 3579, 3564, 3589, 3579, 3583, 3583, + 3584, 3584, 3592, 3582, 3585, 3585, 3590, 3569, 3587, 3587, + 3591, 3568, 3594, 3596, 3591, 3590, 3597, 3600, 3598, 3589, + 3601, 3601, 3592, 3598, 3602, 3603, 3594, 3597, 3599, 3604, + 3599, 3606, 3600, 3605, 3608, 3607, 3596, 3602, 3611, 3609, + 3610, 3612, 3614, 3608, 3603, 3610, 3616, 3604, 3622, 3605, + 3607, 3609, 3613, 3612, 3615, 3615, 3606, 3613, 3617, 3611, + 3623, 3614, 3622, 3617, 3624, 3624, 3616, 3625, 3626, 3626, + 3627, 3627, 3628, 3628, 3629, 3629, 3625, 3630, 3631, 3632, + 3623, 3633, 3632, 3634, 3635, 3636, 3633, 3637, 3634, 3638, + + 3639, 3642, 3640, 3637, 3641, 3641, 3630, 3640, 3631, 3649, + 3636, 3648, 3639, 3638, 3643, 3643, 3644, 3644, 3652, 3635, + 3654, 3642, 3645, 3645, 3647, 3647, 3648, 3660, 3649, 3650, + 3650, 3657, 3657, 3652, 3658, 3658, 3659, 3661, 3654, 3662, + 3663, 3665, 3664, 3661, 3659, 3662, 3660, 3666, 3667, 3667, + 3669, 3669, 3666, 3674, 3663, 3664, 3675, 3677, 3678, 3680, + 3665, 3681, 3678, 3682, 3683, 3684, 3681, 3685, 3686, 3691, + 3687, 3677, 3692, 3686, 3674, 3687, 3675, 3683, 3684, 3680, + 3688, 3688, 3682, 3693, 3694, 3694, 3685, 3695, 3696, 3691, + 3692, 3701, 3695, 3698, 3696, 3697, 3697, 3702, 3698, 3699, + + 3700, 3709, 3693, 3702, 3699, 3700, 3704, 3704, 3705, 3710, + 3701, 3706, 3706, 3705, 3708, 3711, 3710, 3712, 3708, 3713, + 3709, 3714, 3715, 3717, 3717, 3713, 3719, 3719, 3721, 3720, + 3722, 3723, 3724, 3721, 3711, 3715, 3712, 3729, 3720, 3726, + 3714, 3720, 3725, 3725, 3726, 3724, 3727, 3730, 3730, 3722, + 3723, 3731, 3732, 3732, 3733, 3733, 3734, 3735, 3736, 3727, + 3743, 3734, 3738, 3729, 3735, 3737, 3737, 3738, 3741, 3739, + 3731, 3739, 3740, 3740, 3742, 3741, 3745, 3736, 3744, 3743, + 3748, 3742, 3750, 3744, 3747, 3747, 3751, 3750, 3752, 3753, + 3757, 3751, 3754, 3754, 3758, 3745, 3756, 3756, 3761, 3748, + + 3759, 3759, 3760, 3760, 3771, 3761, 3772, 3752, 3753, 3757, + 3763, 3763, 3765, 3758, 3764, 3764, 3767, 3770, 0, 3765, + 0, 3767, 3770, 3771, 0, 3772, 3773, 3773, 3774, 3774, + 3778, 3778, 3778, 3778, 3778, 3778, 3778, 3779, 3779, 3779, + 3779, 3779, 3779, 3779, 3780, 3780, 3780, 3780, 3780, 3780, + 3780, 3781, 3781, 3781, 3781, 3781, 3781, 3781, 3782, 3782, + 3782, 3782, 3782, 3782, 3782, 3783, 3783, 3783, 3783, 3783, + 3783, 3783, 3784, 3784, 3784, 3784, 3784, 3784, 3784, 3786, + 3786, 0, 3786, 3786, 3786, 3786, 3787, 3787, 0, 0, + 0, 3787, 3787, 3788, 3788, 0, 0, 3788, 0, 3788, + + 3789, 0, 0, 0, 0, 0, 3789, 3790, 3790, 0, + 0, 0, 3790, 3790, 3791, 0, 0, 0, 0, 0, + 3791, 3792, 3792, 0, 3792, 3792, 3792, 3792, 3793, 0, + 0, 0, 0, 0, 3793, 3794, 3794, 0, 0, 0, + 3794, 3794, 3795, 3795, 0, 3795, 3795, 3795, 3795, 3777, + 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, + 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, + 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, + 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777, 3777 } ; static yy_state_type yy_last_accepting_state; @@ -3428,7 +3524,7 @@ static void config_end_include(void) #define YY_NO_INPUT 1 #endif -#line 3430 "" +#line 3526 "" #define INITIAL 0 #define quotedstring 1 @@ -3646,7 +3742,7 @@ YY_DECL { #line 211 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -#line 3648 "" +#line 3744 "" while ( 1 ) /* loops until end-of-file is reached */ { @@ -3679,13 +3775,13 @@ yy_match: while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) { yy_current_state = (int) yy_def[yy_current_state]; - if ( yy_current_state >= 3646 ) + if ( yy_current_state >= 3778 ) yy_c = yy_meta[(unsigned int) yy_c]; } yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c]; ++yy_cp; } - while ( yy_base[yy_current_state] != 7110 ); + while ( yy_base[yy_current_state] != 7350 ); yy_find_action: yy_act = yy_accept[yy_current_state]; @@ -3712,13 +3808,13 @@ do_action: /* This label is used only to access EOF actions. */ case 1: YY_RULE_SETUP #line 212 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ +{ LEXOUT(("SP ")); /* ignore */ } YY_BREAK case 2: YY_RULE_SETUP #line 214 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ +{ /* note that flex makes the longest match and '.' is any but not nl */ LEXOUT(("comment(%s) ", yytext)); /* ignore */ } YY_BREAK @@ -3790,137 +3886,137 @@ YY_RULE_SETUP case 16: YY_RULE_SETUP #line 230 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PREFER_IP4) } +{ YDVAR(1, VAR_DO_NAT64) } YY_BREAK case 17: YY_RULE_SETUP #line 231 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PREFER_IP6) } +{ YDVAR(1, VAR_PREFER_IP4) } YY_BREAK case 18: YY_RULE_SETUP #line 232 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DO_UDP) } +{ YDVAR(1, VAR_PREFER_IP6) } YY_BREAK case 19: YY_RULE_SETUP #line 233 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DO_TCP) } +{ YDVAR(1, VAR_DO_UDP) } YY_BREAK case 20: YY_RULE_SETUP #line 234 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TCP_UPSTREAM) } +{ YDVAR(1, VAR_DO_TCP) } YY_BREAK case 21: YY_RULE_SETUP #line 235 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TCP_MSS) } +{ YDVAR(1, VAR_TCP_UPSTREAM) } YY_BREAK case 22: YY_RULE_SETUP #line 236 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_OUTGOING_TCP_MSS) } +{ YDVAR(1, VAR_TCP_MSS) } YY_BREAK case 23: YY_RULE_SETUP #line 237 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TCP_IDLE_TIMEOUT) } +{ YDVAR(1, VAR_OUTGOING_TCP_MSS) } YY_BREAK case 24: YY_RULE_SETUP #line 238 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MAX_REUSE_TCP_QUERIES) } +{ YDVAR(1, VAR_TCP_IDLE_TIMEOUT) } YY_BREAK case 25: YY_RULE_SETUP #line 239 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TCP_REUSE_TIMEOUT) } +{ YDVAR(1, VAR_MAX_REUSE_TCP_QUERIES) } YY_BREAK case 26: YY_RULE_SETUP #line 240 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TCP_AUTH_QUERY_TIMEOUT) } +{ YDVAR(1, VAR_TCP_REUSE_TIMEOUT) } YY_BREAK case 27: YY_RULE_SETUP #line 241 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_EDNS_TCP_KEEPALIVE) } +{ YDVAR(1, VAR_TCP_AUTH_QUERY_TIMEOUT) } YY_BREAK case 28: YY_RULE_SETUP #line 242 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_EDNS_TCP_KEEPALIVE_TIMEOUT) } +{ YDVAR(1, VAR_EDNS_TCP_KEEPALIVE) } YY_BREAK case 29: YY_RULE_SETUP #line 243 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SSL_UPSTREAM) } +{ YDVAR(1, VAR_EDNS_TCP_KEEPALIVE_TIMEOUT) } YY_BREAK case 30: YY_RULE_SETUP #line 244 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SSL_UPSTREAM) } +{ YDVAR(1, VAR_SOCK_QUEUE_TIMEOUT) } YY_BREAK case 31: YY_RULE_SETUP #line 245 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SSL_SERVICE_KEY) } +{ YDVAR(1, VAR_SSL_UPSTREAM) } YY_BREAK case 32: YY_RULE_SETUP #line 246 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SSL_SERVICE_KEY) } +{ YDVAR(1, VAR_SSL_UPSTREAM) } YY_BREAK case 33: YY_RULE_SETUP #line 247 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SSL_SERVICE_PEM) } +{ YDVAR(1, VAR_SSL_SERVICE_KEY) } YY_BREAK case 34: YY_RULE_SETUP #line 248 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SSL_SERVICE_PEM) } +{ YDVAR(1, VAR_SSL_SERVICE_KEY) } YY_BREAK case 35: YY_RULE_SETUP #line 249 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SSL_PORT) } +{ YDVAR(1, VAR_SSL_SERVICE_PEM) } YY_BREAK case 36: YY_RULE_SETUP #line 250 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SSL_PORT) } +{ YDVAR(1, VAR_SSL_SERVICE_PEM) } YY_BREAK case 37: YY_RULE_SETUP #line 251 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TLS_CERT_BUNDLE) } +{ YDVAR(1, VAR_SSL_PORT) } YY_BREAK case 38: YY_RULE_SETUP #line 252 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TLS_CERT_BUNDLE) } +{ YDVAR(1, VAR_SSL_PORT) } YY_BREAK case 39: YY_RULE_SETUP #line 253 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TLS_WIN_CERT) } +{ YDVAR(1, VAR_TLS_CERT_BUNDLE) } YY_BREAK case 40: YY_RULE_SETUP #line 254 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TLS_WIN_CERT) } +{ YDVAR(1, VAR_TLS_CERT_BUNDLE) } YY_BREAK case 41: YY_RULE_SETUP #line 255 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TLS_ADDITIONAL_PORT) } +{ YDVAR(1, VAR_TLS_WIN_CERT) } YY_BREAK case 42: YY_RULE_SETUP #line 256 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TLS_ADDITIONAL_PORT) } +{ YDVAR(1, VAR_TLS_WIN_CERT) } YY_BREAK case 43: YY_RULE_SETUP @@ -3935,1529 +4031,1589 @@ YY_RULE_SETUP case 45: YY_RULE_SETUP #line 259 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TLS_SESSION_TICKET_KEYS) } +{ YDVAR(1, VAR_TLS_ADDITIONAL_PORT) } YY_BREAK case 46: YY_RULE_SETUP #line 260 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TLS_CIPHERS) } +{ YDVAR(1, VAR_TLS_ADDITIONAL_PORT) } YY_BREAK case 47: YY_RULE_SETUP #line 261 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TLS_CIPHERSUITES) } +{ YDVAR(1, VAR_TLS_SESSION_TICKET_KEYS) } YY_BREAK case 48: YY_RULE_SETUP #line 262 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TLS_USE_SNI) } +{ YDVAR(1, VAR_TLS_CIPHERS) } YY_BREAK case 49: YY_RULE_SETUP #line 263 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HTTPS_PORT) } +{ YDVAR(1, VAR_TLS_CIPHERSUITES) } YY_BREAK case 50: YY_RULE_SETUP #line 264 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HTTP_ENDPOINT) } +{ YDVAR(1, VAR_TLS_USE_SNI) } YY_BREAK case 51: YY_RULE_SETUP #line 265 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HTTP_MAX_STREAMS) } +{ YDVAR(1, VAR_HTTPS_PORT) } YY_BREAK case 52: YY_RULE_SETUP #line 266 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HTTP_QUERY_BUFFER_SIZE) } +{ YDVAR(1, VAR_HTTP_ENDPOINT) } YY_BREAK case 53: YY_RULE_SETUP #line 267 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HTTP_RESPONSE_BUFFER_SIZE) } +{ YDVAR(1, VAR_HTTP_MAX_STREAMS) } YY_BREAK case 54: YY_RULE_SETUP #line 268 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HTTP_NODELAY) } +{ YDVAR(1, VAR_HTTP_QUERY_BUFFER_SIZE) } YY_BREAK case 55: YY_RULE_SETUP #line 269 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HTTP_NOTLS_DOWNSTREAM) } +{ YDVAR(1, VAR_HTTP_RESPONSE_BUFFER_SIZE) } YY_BREAK case 56: YY_RULE_SETUP #line 270 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_USE_SYSTEMD) } +{ YDVAR(1, VAR_HTTP_NODELAY) } YY_BREAK case 57: YY_RULE_SETUP #line 271 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DO_DAEMONIZE) } +{ YDVAR(1, VAR_HTTP_NOTLS_DOWNSTREAM) } YY_BREAK case 58: YY_RULE_SETUP #line 272 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INTERFACE) } +{ YDVAR(1, VAR_USE_SYSTEMD) } YY_BREAK case 59: YY_RULE_SETUP #line 273 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INTERFACE) } +{ YDVAR(1, VAR_DO_DAEMONIZE) } YY_BREAK case 60: YY_RULE_SETUP #line 274 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_OUTGOING_INTERFACE) } +{ YDVAR(1, VAR_INTERFACE) } YY_BREAK case 61: YY_RULE_SETUP #line 275 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INTERFACE_AUTOMATIC) } +{ YDVAR(1, VAR_INTERFACE) } YY_BREAK case 62: YY_RULE_SETUP #line 276 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INTERFACE_AUTOMATIC_PORTS) } +{ YDVAR(1, VAR_OUTGOING_INTERFACE) } YY_BREAK case 63: YY_RULE_SETUP #line 277 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SO_RCVBUF) } +{ YDVAR(1, VAR_INTERFACE_AUTOMATIC) } YY_BREAK case 64: YY_RULE_SETUP #line 278 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SO_SNDBUF) } +{ YDVAR(1, VAR_INTERFACE_AUTOMATIC_PORTS) } YY_BREAK case 65: YY_RULE_SETUP #line 279 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SO_REUSEPORT) } +{ YDVAR(1, VAR_SO_RCVBUF) } YY_BREAK case 66: YY_RULE_SETUP #line 280 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IP_TRANSPARENT) } +{ YDVAR(1, VAR_SO_SNDBUF) } YY_BREAK case 67: YY_RULE_SETUP #line 281 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IP_FREEBIND) } +{ YDVAR(1, VAR_SO_REUSEPORT) } YY_BREAK case 68: YY_RULE_SETUP #line 282 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IP_DSCP) } +{ YDVAR(1, VAR_IP_TRANSPARENT) } YY_BREAK case 69: YY_RULE_SETUP #line 283 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CHROOT) } +{ YDVAR(1, VAR_IP_FREEBIND) } YY_BREAK case 70: YY_RULE_SETUP #line 284 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_USERNAME) } +{ YDVAR(1, VAR_IP_DSCP) } YY_BREAK case 71: YY_RULE_SETUP #line 285 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DIRECTORY) } +{ YDVAR(1, VAR_CHROOT) } YY_BREAK case 72: YY_RULE_SETUP #line 286 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOGFILE) } +{ YDVAR(1, VAR_USERNAME) } YY_BREAK case 73: YY_RULE_SETUP #line 287 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PIDFILE) } +{ YDVAR(1, VAR_DIRECTORY) } YY_BREAK case 74: YY_RULE_SETUP #line 288 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ROOT_HINTS) } +{ YDVAR(1, VAR_LOGFILE) } YY_BREAK case 75: YY_RULE_SETUP #line 289 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STREAM_WAIT_SIZE) } +{ YDVAR(1, VAR_PIDFILE) } YY_BREAK case 76: YY_RULE_SETUP #line 290 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_EDNS_BUFFER_SIZE) } +{ YDVAR(1, VAR_ROOT_HINTS) } YY_BREAK case 77: YY_RULE_SETUP #line 291 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MSG_BUFFER_SIZE) } +{ YDVAR(1, VAR_STREAM_WAIT_SIZE) } YY_BREAK case 78: YY_RULE_SETUP #line 292 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MSG_CACHE_SIZE) } +{ YDVAR(1, VAR_EDNS_BUFFER_SIZE) } YY_BREAK case 79: YY_RULE_SETUP #line 293 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MSG_CACHE_SLABS) } +{ YDVAR(1, VAR_MSG_BUFFER_SIZE) } YY_BREAK case 80: YY_RULE_SETUP #line 294 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RRSET_CACHE_SIZE) } +{ YDVAR(1, VAR_MSG_CACHE_SIZE) } YY_BREAK case 81: YY_RULE_SETUP #line 295 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RRSET_CACHE_SLABS) } +{ YDVAR(1, VAR_MSG_CACHE_SLABS) } YY_BREAK case 82: YY_RULE_SETUP #line 296 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHE_MAX_TTL) } +{ YDVAR(1, VAR_RRSET_CACHE_SIZE) } YY_BREAK case 83: YY_RULE_SETUP #line 297 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHE_MAX_NEGATIVE_TTL) } +{ YDVAR(1, VAR_RRSET_CACHE_SLABS) } YY_BREAK case 84: YY_RULE_SETUP #line 298 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHE_MIN_TTL) } +{ YDVAR(1, VAR_CACHE_MAX_TTL) } YY_BREAK case 85: YY_RULE_SETUP #line 299 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INFRA_HOST_TTL) } +{ YDVAR(1, VAR_CACHE_MAX_NEGATIVE_TTL) } YY_BREAK case 86: YY_RULE_SETUP #line 300 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INFRA_LAME_TTL) } +{ YDVAR(1, VAR_CACHE_MIN_TTL) } YY_BREAK case 87: YY_RULE_SETUP #line 301 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INFRA_CACHE_SLABS) } +{ YDVAR(1, VAR_INFRA_HOST_TTL) } YY_BREAK case 88: YY_RULE_SETUP #line 302 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) } +{ YDVAR(1, VAR_INFRA_LAME_TTL) } YY_BREAK case 89: YY_RULE_SETUP #line 303 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) } +{ YDVAR(1, VAR_INFRA_CACHE_SLABS) } YY_BREAK case 90: YY_RULE_SETUP #line 304 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) } +{ YDVAR(1, VAR_INFRA_CACHE_NUMHOSTS) } YY_BREAK case 91: YY_RULE_SETUP #line 305 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INFRA_CACHE_MAX_RTT) } +{ YDVAR(1, VAR_INFRA_CACHE_LAME_SIZE) } YY_BREAK case 92: YY_RULE_SETUP #line 306 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INFRA_KEEP_PROBING) } +{ YDVAR(1, VAR_INFRA_CACHE_MIN_RTT) } YY_BREAK case 93: YY_RULE_SETUP #line 307 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) } +{ YDVAR(1, VAR_INFRA_CACHE_MAX_RTT) } YY_BREAK case 94: YY_RULE_SETUP #line 308 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_JOSTLE_TIMEOUT) } +{ YDVAR(1, VAR_INFRA_KEEP_PROBING) } YY_BREAK case 95: YY_RULE_SETUP #line 309 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DELAY_CLOSE) } +{ YDVAR(1, VAR_NUM_QUERIES_PER_THREAD) } YY_BREAK case 96: YY_RULE_SETUP #line 310 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_UDP_CONNECT) } +{ YDVAR(1, VAR_JOSTLE_TIMEOUT) } YY_BREAK case 97: YY_RULE_SETUP #line 311 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TARGET_FETCH_POLICY) } +{ YDVAR(1, VAR_DELAY_CLOSE) } YY_BREAK case 98: YY_RULE_SETUP #line 312 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) } +{ YDVAR(1, VAR_UDP_CONNECT) } YY_BREAK case 99: YY_RULE_SETUP #line 313 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HARDEN_LARGE_QUERIES) } +{ YDVAR(1, VAR_TARGET_FETCH_POLICY) } YY_BREAK case 100: YY_RULE_SETUP #line 314 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HARDEN_GLUE) } +{ YDVAR(1, VAR_HARDEN_SHORT_BUFSIZE) } YY_BREAK case 101: YY_RULE_SETUP #line 315 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) } +{ YDVAR(1, VAR_HARDEN_LARGE_QUERIES) } YY_BREAK case 102: YY_RULE_SETUP #line 316 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) } +{ YDVAR(1, VAR_HARDEN_GLUE) } YY_BREAK case 103: YY_RULE_SETUP #line 317 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) } +{ YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) } YY_BREAK case 104: YY_RULE_SETUP #line 318 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) } +{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) } YY_BREAK case 105: YY_RULE_SETUP #line 319 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_USE_CAPS_FOR_ID) } +{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) } YY_BREAK case 106: YY_RULE_SETUP #line 320 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CAPS_WHITELIST) } +{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) } YY_BREAK case 107: YY_RULE_SETUP #line 321 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CAPS_WHITELIST) } +{ YDVAR(1, VAR_HARDEN_UNKNOWN_ADDITIONAL) } YY_BREAK case 108: YY_RULE_SETUP #line 322 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) } +{ YDVAR(1, VAR_USE_CAPS_FOR_ID) } YY_BREAK case 109: YY_RULE_SETUP #line 323 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PRIVATE_ADDRESS) } +{ YDVAR(1, VAR_CAPS_WHITELIST) } YY_BREAK case 110: YY_RULE_SETUP #line 324 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PRIVATE_DOMAIN) } +{ YDVAR(1, VAR_CAPS_WHITELIST) } YY_BREAK case 111: YY_RULE_SETUP #line 325 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PREFETCH_KEY) } +{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) } YY_BREAK case 112: YY_RULE_SETUP #line 326 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PREFETCH) } +{ YDVAR(1, VAR_PRIVATE_ADDRESS) } YY_BREAK case 113: YY_RULE_SETUP #line 327 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DENY_ANY) } +{ YDVAR(1, VAR_PRIVATE_DOMAIN) } YY_BREAK case 114: YY_RULE_SETUP #line 328 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_STUB_ZONE) } +{ YDVAR(1, VAR_PREFETCH_KEY) } YY_BREAK case 115: YY_RULE_SETUP #line 329 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_NAME) } +{ YDVAR(1, VAR_PREFETCH) } YY_BREAK case 116: YY_RULE_SETUP #line 330 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STUB_ADDR) } +{ YDVAR(1, VAR_DENY_ANY) } YY_BREAK case 117: YY_RULE_SETUP #line 331 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STUB_HOST) } +{ YDVAR(0, VAR_STUB_ZONE) } YY_BREAK case 118: YY_RULE_SETUP #line 332 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STUB_PRIME) } +{ YDVAR(1, VAR_NAME) } YY_BREAK case 119: YY_RULE_SETUP #line 333 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STUB_FIRST) } +{ YDVAR(1, VAR_STUB_ADDR) } YY_BREAK case 120: YY_RULE_SETUP #line 334 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STUB_NO_CACHE) } +{ YDVAR(1, VAR_STUB_HOST) } YY_BREAK case 121: YY_RULE_SETUP #line 335 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STUB_SSL_UPSTREAM) } +{ YDVAR(1, VAR_STUB_PRIME) } YY_BREAK case 122: YY_RULE_SETUP #line 336 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STUB_SSL_UPSTREAM) } +{ YDVAR(1, VAR_STUB_FIRST) } YY_BREAK case 123: YY_RULE_SETUP #line 337 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STUB_TCP_UPSTREAM) } +{ YDVAR(1, VAR_STUB_NO_CACHE) } YY_BREAK case 124: YY_RULE_SETUP #line 338 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_FORWARD_ZONE) } +{ YDVAR(1, VAR_STUB_SSL_UPSTREAM) } YY_BREAK case 125: YY_RULE_SETUP #line 339 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FORWARD_ADDR) } +{ YDVAR(1, VAR_STUB_SSL_UPSTREAM) } YY_BREAK case 126: YY_RULE_SETUP #line 340 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FORWARD_HOST) } +{ YDVAR(1, VAR_STUB_TCP_UPSTREAM) } YY_BREAK case 127: YY_RULE_SETUP #line 341 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FORWARD_FIRST) } +{ YDVAR(0, VAR_FORWARD_ZONE) } YY_BREAK case 128: YY_RULE_SETUP #line 342 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FORWARD_NO_CACHE) } +{ YDVAR(1, VAR_FORWARD_ADDR) } YY_BREAK case 129: YY_RULE_SETUP #line 343 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) } +{ YDVAR(1, VAR_FORWARD_HOST) } YY_BREAK case 130: YY_RULE_SETUP #line 344 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) } +{ YDVAR(1, VAR_FORWARD_FIRST) } YY_BREAK case 131: YY_RULE_SETUP #line 345 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FORWARD_TCP_UPSTREAM) } +{ YDVAR(1, VAR_FORWARD_NO_CACHE) } YY_BREAK case 132: YY_RULE_SETUP #line 346 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_AUTH_ZONE) } +{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) } YY_BREAK case 133: YY_RULE_SETUP #line 347 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_RPZ) } +{ YDVAR(1, VAR_FORWARD_SSL_UPSTREAM) } YY_BREAK case 134: YY_RULE_SETUP #line 348 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TAGS) } +{ YDVAR(1, VAR_FORWARD_TCP_UPSTREAM) } YY_BREAK case 135: YY_RULE_SETUP #line 349 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) } +{ YDVAR(0, VAR_AUTH_ZONE) } YY_BREAK case 136: YY_RULE_SETUP #line 350 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) } +{ YDVAR(0, VAR_RPZ) } YY_BREAK case 137: YY_RULE_SETUP #line 351 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RPZ_LOG) } +{ YDVAR(1, VAR_TAGS) } YY_BREAK case 138: YY_RULE_SETUP #line 352 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RPZ_LOG_NAME) } +{ YDVAR(1, VAR_RPZ_ACTION_OVERRIDE) } YY_BREAK case 139: YY_RULE_SETUP #line 353 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RPZ_SIGNAL_NXDOMAIN_RA) } +{ YDVAR(1, VAR_RPZ_CNAME_OVERRIDE) } YY_BREAK case 140: YY_RULE_SETUP #line 354 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ZONEFILE) } +{ YDVAR(1, VAR_RPZ_LOG) } YY_BREAK case 141: YY_RULE_SETUP #line 355 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MASTER) } +{ YDVAR(1, VAR_RPZ_LOG_NAME) } YY_BREAK case 142: YY_RULE_SETUP #line 356 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MASTER) } +{ YDVAR(1, VAR_RPZ_SIGNAL_NXDOMAIN_RA) } YY_BREAK case 143: YY_RULE_SETUP #line 357 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_URL) } +{ YDVAR(1, VAR_ZONEFILE) } YY_BREAK case 144: YY_RULE_SETUP #line 358 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ALLOW_NOTIFY) } +{ YDVAR(1, VAR_MASTER) } YY_BREAK case 145: YY_RULE_SETUP #line 359 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FOR_DOWNSTREAM) } +{ YDVAR(1, VAR_MASTER) } YY_BREAK case 146: YY_RULE_SETUP #line 360 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FOR_UPSTREAM) } +{ YDVAR(1, VAR_URL) } YY_BREAK case 147: YY_RULE_SETUP #line 361 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FALLBACK_ENABLED) } +{ YDVAR(1, VAR_ALLOW_NOTIFY) } YY_BREAK case 148: YY_RULE_SETUP #line 362 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_VIEW) } +{ YDVAR(1, VAR_FOR_DOWNSTREAM) } YY_BREAK case 149: YY_RULE_SETUP #line 363 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VIEW_FIRST) } +{ YDVAR(1, VAR_FOR_UPSTREAM) } YY_BREAK case 150: YY_RULE_SETUP #line 364 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) } +{ YDVAR(1, VAR_FALLBACK_ENABLED) } YY_BREAK case 151: YY_RULE_SETUP #line 365 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) } +{ YDVAR(0, VAR_VIEW) } YY_BREAK case 152: YY_RULE_SETUP #line 366 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_ACCESS_CONTROL) } +{ YDVAR(1, VAR_VIEW_FIRST) } YY_BREAK case 153: YY_RULE_SETUP #line 367 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_INTERFACE_ACTION) } +{ YDVAR(1, VAR_DO_NOT_QUERY_ADDRESS) } YY_BREAK case 154: YY_RULE_SETUP #line 368 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SEND_CLIENT_SUBNET) } +{ YDVAR(1, VAR_DO_NOT_QUERY_LOCALHOST) } YY_BREAK case 155: YY_RULE_SETUP #line 369 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CLIENT_SUBNET_ZONE) } +{ YDVAR(2, VAR_ACCESS_CONTROL) } YY_BREAK case 156: YY_RULE_SETUP #line 370 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) } +{ YDVAR(2, VAR_INTERFACE_ACTION) } YY_BREAK case 157: YY_RULE_SETUP #line 371 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) } +{ YDVAR(1, VAR_SEND_CLIENT_SUBNET) } YY_BREAK case 158: YY_RULE_SETUP #line 372 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) } +{ YDVAR(1, VAR_CLIENT_SUBNET_ZONE) } YY_BREAK case 159: YY_RULE_SETUP #line 373 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) } +{ YDVAR(1, VAR_CLIENT_SUBNET_ALWAYS_FORWARD) } YY_BREAK case 160: YY_RULE_SETUP #line 374 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) } +{ YDVAR(1, VAR_CLIENT_SUBNET_OPCODE) } YY_BREAK case 161: YY_RULE_SETUP #line 375 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) } +{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV4) } YY_BREAK case 162: YY_RULE_SETUP #line 376 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) } +{ YDVAR(1, VAR_MAX_CLIENT_SUBNET_IPV6) } YY_BREAK case 163: YY_RULE_SETUP #line 377 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) } +{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV4) } YY_BREAK case 164: YY_RULE_SETUP #line 378 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HIDE_IDENTITY) } +{ YDVAR(1, VAR_MIN_CLIENT_SUBNET_IPV6) } YY_BREAK case 165: YY_RULE_SETUP #line 379 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HIDE_VERSION) } +{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV4) } YY_BREAK case 166: YY_RULE_SETUP #line 380 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) } +{ YDVAR(1, VAR_MAX_ECS_TREE_SIZE_IPV6) } YY_BREAK case 167: YY_RULE_SETUP #line 381 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HIDE_HTTP_USER_AGENT) } +{ YDVAR(1, VAR_HIDE_IDENTITY) } YY_BREAK case 168: YY_RULE_SETUP #line 382 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IDENTITY) } +{ YDVAR(1, VAR_HIDE_VERSION) } YY_BREAK case 169: YY_RULE_SETUP #line 383 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VERSION) } +{ YDVAR(1, VAR_HIDE_TRUSTANCHOR) } YY_BREAK case 170: YY_RULE_SETUP #line 384 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_HTTP_USER_AGENT) } +{ YDVAR(1, VAR_HIDE_HTTP_USER_AGENT) } YY_BREAK case 171: YY_RULE_SETUP #line 385 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MODULE_CONF) } +{ YDVAR(1, VAR_IDENTITY) } YY_BREAK case 172: YY_RULE_SETUP #line 386 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DLV_ANCHOR) } +{ YDVAR(1, VAR_VERSION) } YY_BREAK case 173: YY_RULE_SETUP #line 387 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DLV_ANCHOR_FILE) } +{ YDVAR(1, VAR_HTTP_USER_AGENT) } YY_BREAK case 174: YY_RULE_SETUP #line 388 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) } +{ YDVAR(1, VAR_MODULE_CONF) } YY_BREAK case 175: YY_RULE_SETUP #line 389 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) } +{ YDVAR(1, VAR_DLV_ANCHOR) } YY_BREAK case 176: YY_RULE_SETUP #line 390 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) } +{ YDVAR(1, VAR_DLV_ANCHOR_FILE) } YY_BREAK case 177: YY_RULE_SETUP #line 391 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TRUST_ANCHOR) } +{ YDVAR(1, VAR_TRUST_ANCHOR_FILE) } YY_BREAK case 178: YY_RULE_SETUP #line 392 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) } +{ YDVAR(1, VAR_AUTO_TRUST_ANCHOR_FILE) } YY_BREAK case 179: YY_RULE_SETUP #line 393 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ROOT_KEY_SENTINEL) } +{ YDVAR(1, VAR_TRUSTED_KEYS_FILE) } YY_BREAK case 180: YY_RULE_SETUP #line 394 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) } +{ YDVAR(1, VAR_TRUST_ANCHOR) } YY_BREAK case 181: YY_RULE_SETUP #line 395 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) } +{ YDVAR(1, VAR_TRUST_ANCHOR_SIGNALING) } YY_BREAK case 182: YY_RULE_SETUP #line 396 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) } +{ YDVAR(1, VAR_ROOT_KEY_SENTINEL) } YY_BREAK case 183: YY_RULE_SETUP #line 397 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_MAX_RESTART) } +{ YDVAR(1, VAR_VAL_OVERRIDE_DATE) } YY_BREAK case 184: YY_RULE_SETUP #line 398 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_BOGUS_TTL) } +{ YDVAR(1, VAR_VAL_SIG_SKEW_MIN) } YY_BREAK case 185: YY_RULE_SETUP #line 399 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) } +{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) } YY_BREAK case 186: YY_RULE_SETUP #line 400 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) } +{ YDVAR(1, VAR_VAL_MAX_RESTART) } YY_BREAK case 187: YY_RULE_SETUP #line 401 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_AGGRESSIVE_NSEC) } +{ YDVAR(1, VAR_BOGUS_TTL) } YY_BREAK case 188: YY_RULE_SETUP #line 402 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IGNORE_CD_FLAG) } +{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) } YY_BREAK case 189: YY_RULE_SETUP #line 403 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVE_EXPIRED) } +{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) } YY_BREAK case 190: YY_RULE_SETUP #line 404 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) } +{ YDVAR(1, VAR_AGGRESSIVE_NSEC) } YY_BREAK case 191: YY_RULE_SETUP #line 405 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) } +{ YDVAR(1, VAR_IGNORE_CD_FLAG) } YY_BREAK case 192: YY_RULE_SETUP #line 406 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVE_EXPIRED_REPLY_TTL) } +{ YDVAR(1, VAR_SERVE_EXPIRED) } YY_BREAK case 193: YY_RULE_SETUP #line 407 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVE_EXPIRED_CLIENT_TIMEOUT) } +{ YDVAR(1, VAR_SERVE_EXPIRED_TTL) } YY_BREAK case 194: YY_RULE_SETUP #line 408 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_EDE_SERVE_EXPIRED) } +{ YDVAR(1, VAR_SERVE_EXPIRED_TTL_RESET) } YY_BREAK case 195: YY_RULE_SETUP #line 409 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVE_ORIGINAL_TTL) } +{ YDVAR(1, VAR_SERVE_EXPIRED_REPLY_TTL) } YY_BREAK case 196: YY_RULE_SETUP #line 410 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FAKE_DSA) } +{ YDVAR(1, VAR_SERVE_EXPIRED_CLIENT_TIMEOUT) } YY_BREAK case 197: YY_RULE_SETUP #line 411 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FAKE_SHA1) } +{ YDVAR(1, VAR_EDE_SERVE_EXPIRED) } YY_BREAK case 198: YY_RULE_SETUP #line 412 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_VAL_LOG_LEVEL) } +{ YDVAR(1, VAR_SERVE_ORIGINAL_TTL) } YY_BREAK case 199: YY_RULE_SETUP #line 413 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_KEY_CACHE_SIZE) } +{ YDVAR(1, VAR_FAKE_DSA) } YY_BREAK case 200: YY_RULE_SETUP #line 414 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_KEY_CACHE_SLABS) } +{ YDVAR(1, VAR_FAKE_SHA1) } YY_BREAK case 201: YY_RULE_SETUP #line 415 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_NEG_CACHE_SIZE) } +{ YDVAR(1, VAR_VAL_LOG_LEVEL) } YY_BREAK case 202: YY_RULE_SETUP #line 416 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) } +{ YDVAR(1, VAR_KEY_CACHE_SIZE) } YY_BREAK case 203: YY_RULE_SETUP -#line 418 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) } +#line 417 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_KEY_CACHE_SLABS) } YY_BREAK case 204: YY_RULE_SETUP -#line 419 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ZONEMD_CHECK) } +#line 418 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_NEG_CACHE_SIZE) } YY_BREAK case 205: YY_RULE_SETUP -#line 420 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ZONEMD_REJECT_ABSENCE) } +#line 419 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) } YY_BREAK case 206: YY_RULE_SETUP #line 421 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_ADD_HOLDDOWN) } +{ YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) } YY_BREAK case 207: YY_RULE_SETUP #line 422 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DEL_HOLDDOWN) } +{ YDVAR(1, VAR_ZONEMD_CHECK) } YY_BREAK case 208: YY_RULE_SETUP #line 423 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_KEEP_MISSING) } +{ YDVAR(1, VAR_ZONEMD_REJECT_ABSENCE) } YY_BREAK case 209: YY_RULE_SETUP #line 424 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) } +{ YDVAR(1, VAR_ADD_HOLDDOWN) } YY_BREAK case 210: YY_RULE_SETUP #line 425 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_USE_SYSLOG) } +{ YDVAR(1, VAR_DEL_HOLDDOWN) } YY_BREAK case 211: YY_RULE_SETUP #line 426 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_IDENTITY) } +{ YDVAR(1, VAR_KEEP_MISSING) } YY_BREAK case 212: YY_RULE_SETUP #line 427 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_TIME_ASCII) } +{ YDVAR(1, VAR_PERMIT_SMALL_HOLDDOWN) } YY_BREAK case 213: YY_RULE_SETUP #line 428 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_QUERIES) } +{ YDVAR(1, VAR_USE_SYSLOG) } YY_BREAK case 214: YY_RULE_SETUP #line 429 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_REPLIES) } +{ YDVAR(1, VAR_LOG_IDENTITY) } YY_BREAK case 215: YY_RULE_SETUP #line 430 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_TAG_QUERYREPLY) } +{ YDVAR(1, VAR_LOG_TIME_ASCII) } YY_BREAK case 216: YY_RULE_SETUP #line 431 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_LOCAL_ACTIONS) } +{ YDVAR(1, VAR_LOG_QUERIES) } YY_BREAK case 217: YY_RULE_SETUP #line 432 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOG_SERVFAIL) } +{ YDVAR(1, VAR_LOG_REPLIES) } YY_BREAK case 218: YY_RULE_SETUP #line 433 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_LOCAL_ZONE) } +{ YDVAR(1, VAR_LOG_TAG_QUERYREPLY) } YY_BREAK case 219: YY_RULE_SETUP #line 434 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOCAL_DATA) } +{ YDVAR(1, VAR_LOG_LOCAL_ACTIONS) } YY_BREAK case 220: YY_RULE_SETUP #line 435 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOCAL_DATA_PTR) } +{ YDVAR(1, VAR_LOG_SERVFAIL) } YY_BREAK case 221: YY_RULE_SETUP #line 436 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) } +{ YDVAR(2, VAR_LOCAL_ZONE) } YY_BREAK case 222: YY_RULE_SETUP #line 437 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_INSECURE_LAN_ZONES) } +{ YDVAR(1, VAR_LOCAL_DATA) } YY_BREAK case 223: YY_RULE_SETUP #line 438 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STATISTICS_INTERVAL) } +{ YDVAR(1, VAR_LOCAL_DATA_PTR) } YY_BREAK case 224: YY_RULE_SETUP #line 439 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) } +{ YDVAR(1, VAR_UNBLOCK_LAN_ZONES) } YY_BREAK case 225: YY_RULE_SETUP #line 440 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_EXTENDED_STATISTICS) } +{ YDVAR(1, VAR_INSECURE_LAN_ZONES) } YY_BREAK case 226: YY_RULE_SETUP #line 441 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SHM_ENABLE) } +{ YDVAR(1, VAR_STATISTICS_INTERVAL) } YY_BREAK case 227: YY_RULE_SETUP #line 442 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SHM_KEY) } +{ YDVAR(1, VAR_STATISTICS_CUMULATIVE) } YY_BREAK case 228: YY_RULE_SETUP #line 443 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_REMOTE_CONTROL) } +{ YDVAR(1, VAR_EXTENDED_STATISTICS) } YY_BREAK case 229: YY_RULE_SETUP #line 444 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CONTROL_ENABLE) } +{ YDVAR(1, VAR_STATISTICS_INHIBIT_ZERO) } YY_BREAK case 230: YY_RULE_SETUP #line 445 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CONTROL_INTERFACE) } +{ YDVAR(1, VAR_SHM_ENABLE) } YY_BREAK case 231: YY_RULE_SETUP #line 446 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CONTROL_PORT) } +{ YDVAR(1, VAR_SHM_KEY) } YY_BREAK case 232: YY_RULE_SETUP #line 447 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CONTROL_USE_CERT) } +{ YDVAR(0, VAR_REMOTE_CONTROL) } YY_BREAK case 233: YY_RULE_SETUP #line 448 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVER_KEY_FILE) } +{ YDVAR(1, VAR_CONTROL_ENABLE) } YY_BREAK case 234: YY_RULE_SETUP #line 449 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_SERVER_CERT_FILE) } +{ YDVAR(1, VAR_CONTROL_INTERFACE) } YY_BREAK case 235: YY_RULE_SETUP #line 450 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CONTROL_KEY_FILE) } +{ YDVAR(1, VAR_CONTROL_PORT) } YY_BREAK case 236: YY_RULE_SETUP #line 451 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CONTROL_CERT_FILE) } +{ YDVAR(1, VAR_CONTROL_USE_CERT) } YY_BREAK case 237: YY_RULE_SETUP #line 452 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PYTHON_SCRIPT) } +{ YDVAR(1, VAR_SERVER_KEY_FILE) } YY_BREAK case 238: YY_RULE_SETUP #line 453 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_PYTHON) } +{ YDVAR(1, VAR_SERVER_CERT_FILE) } YY_BREAK case 239: YY_RULE_SETUP #line 454 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DYNLIB_FILE) } +{ YDVAR(1, VAR_CONTROL_KEY_FILE) } YY_BREAK case 240: YY_RULE_SETUP #line 455 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_DYNLIB) } +{ YDVAR(1, VAR_CONTROL_CERT_FILE) } YY_BREAK case 241: YY_RULE_SETUP #line 456 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DOMAIN_INSECURE) } +{ YDVAR(1, VAR_PYTHON_SCRIPT) } YY_BREAK case 242: YY_RULE_SETUP #line 457 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MINIMAL_RESPONSES) } +{ YDVAR(0, VAR_PYTHON) } YY_BREAK case 243: YY_RULE_SETUP #line 458 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RRSET_ROUNDROBIN) } +{ YDVAR(1, VAR_DYNLIB_FILE) } YY_BREAK case 244: YY_RULE_SETUP #line 459 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) } +{ YDVAR(0, VAR_DYNLIB) } YY_BREAK case 245: YY_RULE_SETUP #line 460 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_MAX_UDP_SIZE) } +{ YDVAR(1, VAR_DOMAIN_INSECURE) } YY_BREAK case 246: YY_RULE_SETUP #line 461 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNS64_PREFIX) } +{ YDVAR(1, VAR_MINIMAL_RESPONSES) } YY_BREAK case 247: YY_RULE_SETUP #line 462 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNS64_SYNTHALL) } +{ YDVAR(1, VAR_RRSET_ROUNDROBIN) } YY_BREAK case 248: YY_RULE_SETUP #line 463 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNS64_IGNORE_AAAA) } +{ YDVAR(1, VAR_UNKNOWN_SERVER_TIME_LIMIT) } YY_BREAK case 249: YY_RULE_SETUP #line 464 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DEFINE_TAG) } +{ YDVAR(1, VAR_MAX_UDP_SIZE) } YY_BREAK case 250: YY_RULE_SETUP #line 465 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_LOCAL_ZONE_TAG) } +{ YDVAR(1, VAR_DNS64_PREFIX) } YY_BREAK case 251: YY_RULE_SETUP #line 466 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) } +{ YDVAR(1, VAR_DNS64_SYNTHALL) } YY_BREAK case 252: YY_RULE_SETUP #line 467 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) } +{ YDVAR(1, VAR_DNS64_IGNORE_AAAA) } YY_BREAK case 253: YY_RULE_SETUP #line 468 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) } +{ YDVAR(1, VAR_NAT64_PREFIX) } YY_BREAK case 254: YY_RULE_SETUP #line 469 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) } +{ YDVAR(1, VAR_DEFINE_TAG) } YY_BREAK case 255: YY_RULE_SETUP #line 470 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_INTERFACE_TAG) } +{ YDVAR(2, VAR_LOCAL_ZONE_TAG) } YY_BREAK case 256: YY_RULE_SETUP #line 471 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(3, VAR_INTERFACE_TAG_ACTION) } +{ YDVAR(2, VAR_ACCESS_CONTROL_TAG) } YY_BREAK case 257: YY_RULE_SETUP #line 472 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(3, VAR_INTERFACE_TAG_DATA) } +{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_ACTION) } YY_BREAK case 258: YY_RULE_SETUP #line 473 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_INTERFACE_VIEW) } +{ YDVAR(3, VAR_ACCESS_CONTROL_TAG_DATA) } YY_BREAK case 259: YY_RULE_SETUP #line 474 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) } +{ YDVAR(2, VAR_ACCESS_CONTROL_VIEW) } YY_BREAK case 260: YY_RULE_SETUP #line 475 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_DNSTAP) } +{ YDVAR(2, VAR_INTERFACE_TAG) } YY_BREAK case 261: YY_RULE_SETUP #line 476 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_ENABLE) } +{ YDVAR(3, VAR_INTERFACE_TAG_ACTION) } YY_BREAK case 262: YY_RULE_SETUP #line 477 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_BIDIRECTIONAL) } +{ YDVAR(3, VAR_INTERFACE_TAG_DATA) } YY_BREAK case 263: YY_RULE_SETUP #line 478 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) } +{ YDVAR(2, VAR_INTERFACE_VIEW) } YY_BREAK case 264: YY_RULE_SETUP #line 479 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_IP) } +{ YDVAR(3, VAR_LOCAL_ZONE_OVERRIDE) } YY_BREAK case 265: YY_RULE_SETUP #line 480 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_TLS) } +{ YDVAR(0, VAR_DNSTAP) } YY_BREAK case 266: YY_RULE_SETUP #line 481 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_TLS_SERVER_NAME) } +{ YDVAR(1, VAR_DNSTAP_ENABLE) } YY_BREAK case 267: YY_RULE_SETUP #line 482 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_TLS_CERT_BUNDLE) } +{ YDVAR(1, VAR_DNSTAP_BIDIRECTIONAL) } YY_BREAK case 268: YY_RULE_SETUP #line 483 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSTAP_TLS_CLIENT_KEY_FILE) } +{ YDVAR(1, VAR_DNSTAP_SOCKET_PATH) } YY_BREAK case 269: YY_RULE_SETUP -#line 485 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSTAP_TLS_CLIENT_CERT_FILE) } +#line 484 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSTAP_IP) } YY_BREAK case 270: YY_RULE_SETUP -#line 487 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) } +#line 485 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSTAP_TLS) } YY_BREAK case 271: YY_RULE_SETUP -#line 488 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) } +#line 486 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSTAP_TLS_SERVER_NAME) } YY_BREAK case 272: YY_RULE_SETUP -#line 489 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_IDENTITY) } +#line 487 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSTAP_TLS_CERT_BUNDLE) } YY_BREAK case 273: YY_RULE_SETUP -#line 490 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSTAP_VERSION) } +#line 488 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSTAP_TLS_CLIENT_KEY_FILE) } YY_BREAK case 274: YY_RULE_SETUP -#line 491 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 490 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { - YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) } + YDVAR(1, VAR_DNSTAP_TLS_CLIENT_CERT_FILE) } YY_BREAK case 275: YY_RULE_SETUP -#line 493 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) } +#line 492 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSTAP_SEND_IDENTITY) } YY_BREAK case 276: YY_RULE_SETUP -#line 495 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) } +#line 493 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSTAP_SEND_VERSION) } YY_BREAK case 277: YY_RULE_SETUP -#line 497 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) } +#line 494 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSTAP_IDENTITY) } YY_BREAK case 278: YY_RULE_SETUP -#line 499 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) } +#line 495 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSTAP_VERSION) } YY_BREAK case 279: YY_RULE_SETUP -#line 501 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 496 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { - YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) } + YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES) } YY_BREAK case 280: YY_RULE_SETUP -#line 503 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) } +#line 498 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES) } YY_BREAK case 281: YY_RULE_SETUP -#line 504 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IP_RATELIMIT) } +#line 500 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES) } YY_BREAK case 282: YY_RULE_SETUP -#line 505 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RATELIMIT) } +#line 502 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES) } YY_BREAK case 283: YY_RULE_SETUP -#line 506 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) } +#line 504 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES) } YY_BREAK case 284: YY_RULE_SETUP -#line 507 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RATELIMIT_SLABS) } +#line 506 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) } YY_BREAK case 285: YY_RULE_SETUP #line 508 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) } +{ YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) } YY_BREAK case 286: YY_RULE_SETUP #line 509 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RATELIMIT_SIZE) } +{ YDVAR(1, VAR_IP_RATELIMIT) } YY_BREAK case 287: YY_RULE_SETUP #line 510 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) } +{ YDVAR(1, VAR_IP_RATELIMIT_COOKIE) } YY_BREAK case 288: YY_RULE_SETUP #line 511 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) } +{ YDVAR(1, VAR_RATELIMIT) } YY_BREAK case 289: YY_RULE_SETUP #line 512 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) } +{ YDVAR(1, VAR_IP_RATELIMIT_SLABS) } YY_BREAK case 290: YY_RULE_SETUP #line 513 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RATELIMIT_FACTOR) } +{ YDVAR(1, VAR_RATELIMIT_SLABS) } YY_BREAK case 291: YY_RULE_SETUP #line 514 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IP_RATELIMIT_BACKOFF) } +{ YDVAR(1, VAR_IP_RATELIMIT_SIZE) } YY_BREAK case 292: YY_RULE_SETUP #line 515 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_RATELIMIT_BACKOFF) } +{ YDVAR(1, VAR_RATELIMIT_SIZE) } YY_BREAK case 293: YY_RULE_SETUP #line 516 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_OUTBOUND_MSG_RETRY) } +{ YDVAR(2, VAR_RATELIMIT_FOR_DOMAIN) } YY_BREAK case 294: YY_RULE_SETUP #line 517 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_LOW_RTT) } +{ YDVAR(2, VAR_RATELIMIT_BELOW_DOMAIN) } YY_BREAK case 295: YY_RULE_SETUP #line 518 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FAST_SERVER_NUM) } +{ YDVAR(1, VAR_IP_RATELIMIT_FACTOR) } YY_BREAK case 296: YY_RULE_SETUP #line 519 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FAST_SERVER_PERMIL) } +{ YDVAR(1, VAR_RATELIMIT_FACTOR) } YY_BREAK case 297: YY_RULE_SETUP #line 520 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FAST_SERVER_PERMIL) } +{ YDVAR(1, VAR_IP_RATELIMIT_BACKOFF) } YY_BREAK case 298: YY_RULE_SETUP #line 521 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_FAST_SERVER_PERMIL) } +{ YDVAR(1, VAR_RATELIMIT_BACKOFF) } YY_BREAK case 299: YY_RULE_SETUP #line 522 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_RESPONSE_IP_TAG) } +{ YDVAR(1, VAR_OUTBOUND_MSG_RETRY) } YY_BREAK case 300: YY_RULE_SETUP #line 523 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_RESPONSE_IP) } +{ YDVAR(1, VAR_MAX_SENT_COUNT) } YY_BREAK case 301: YY_RULE_SETUP #line 524 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_RESPONSE_IP_DATA) } +{ YDVAR(1, VAR_MAX_QUERY_RESTARTS) } YY_BREAK case 302: YY_RULE_SETUP #line 525 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_DNSCRYPT) } +{ YDVAR(1, VAR_LOW_RTT) } YY_BREAK case 303: YY_RULE_SETUP #line 526 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_ENABLE) } +{ YDVAR(1, VAR_FAST_SERVER_NUM) } YY_BREAK case 304: YY_RULE_SETUP #line 527 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_PORT) } +{ YDVAR(1, VAR_FAST_SERVER_PERMIL) } YY_BREAK case 305: YY_RULE_SETUP #line 528 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) } +{ YDVAR(1, VAR_FAST_SERVER_PERMIL) } YY_BREAK case 306: YY_RULE_SETUP #line 529 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) } +{ YDVAR(1, VAR_FAST_SERVER_PERMIL) } YY_BREAK case 307: YY_RULE_SETUP #line 530 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) } +{ YDVAR(2, VAR_RESPONSE_IP_TAG) } YY_BREAK case 308: YY_RULE_SETUP #line 531 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) } +{ YDVAR(2, VAR_RESPONSE_IP) } YY_BREAK case 309: YY_RULE_SETUP #line 532 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) } +{ YDVAR(2, VAR_RESPONSE_IP_DATA) } YY_BREAK case 310: YY_RULE_SETUP -#line 534 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ - YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) } +#line 533 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(0, VAR_DNSCRYPT) } YY_BREAK case 311: YY_RULE_SETUP -#line 536 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) } +#line 534 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSCRYPT_ENABLE) } YY_BREAK case 312: YY_RULE_SETUP -#line 537 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) } +#line 535 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSCRYPT_PORT) } YY_BREAK case 313: YY_RULE_SETUP -#line 538 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PAD_RESPONSES) } +#line 536 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSCRYPT_PROVIDER) } YY_BREAK case 314: YY_RULE_SETUP -#line 539 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PAD_RESPONSES_BLOCK_SIZE) } +#line 537 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSCRYPT_SECRET_KEY) } YY_BREAK case 315: YY_RULE_SETUP -#line 540 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PAD_QUERIES) } +#line 538 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT) } YY_BREAK case 316: YY_RULE_SETUP -#line 541 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PAD_QUERIES_BLOCK_SIZE) } +#line 539 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_DNSCRYPT_PROVIDER_CERT_ROTATED) } YY_BREAK case 317: YY_RULE_SETUP -#line 542 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_ENABLED) } +#line 540 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE) } YY_BREAK case 318: YY_RULE_SETUP -#line 543 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) } +#line 542 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ + YDVAR(1, VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS) } YY_BREAK case 319: YY_RULE_SETUP #line 544 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_HOOK) } +{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SIZE) } YY_BREAK case 320: YY_RULE_SETUP #line 545 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) } +{ YDVAR(1, VAR_DNSCRYPT_NONCE_CACHE_SLABS) } YY_BREAK case 321: YY_RULE_SETUP #line 546 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_WHITELIST) } +{ YDVAR(1, VAR_PAD_RESPONSES) } YY_BREAK case 322: YY_RULE_SETUP #line 547 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_WHITELIST) } +{ YDVAR(1, VAR_PAD_RESPONSES_BLOCK_SIZE) } YY_BREAK case 323: YY_RULE_SETUP #line 548 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSECMOD_STRICT) } +{ YDVAR(1, VAR_PAD_QUERIES) } YY_BREAK case 324: YY_RULE_SETUP #line 549 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_CACHEDB) } +{ YDVAR(1, VAR_PAD_QUERIES_BLOCK_SIZE) } YY_BREAK case 325: YY_RULE_SETUP #line 550 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHEDB_BACKEND) } +{ YDVAR(1, VAR_IPSECMOD_ENABLED) } YY_BREAK case 326: YY_RULE_SETUP #line 551 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHEDB_SECRETSEED) } +{ YDVAR(1, VAR_IPSECMOD_IGNORE_BOGUS) } YY_BREAK case 327: YY_RULE_SETUP #line 552 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHEDB_REDISHOST) } +{ YDVAR(1, VAR_IPSECMOD_HOOK) } YY_BREAK case 328: YY_RULE_SETUP #line 553 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHEDB_REDISPORT) } +{ YDVAR(1, VAR_IPSECMOD_MAX_TTL) } YY_BREAK case 329: YY_RULE_SETUP #line 554 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) } +{ YDVAR(1, VAR_IPSECMOD_WHITELIST) } YY_BREAK case 330: YY_RULE_SETUP #line 555 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) } +{ YDVAR(1, VAR_IPSECMOD_WHITELIST) } YY_BREAK case 331: YY_RULE_SETUP #line 556 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(0, VAR_IPSET) } +{ YDVAR(1, VAR_IPSECMOD_STRICT) } YY_BREAK case 332: YY_RULE_SETUP #line 557 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSET_NAME_V4) } +{ YDVAR(0, VAR_CACHEDB) } YY_BREAK case 333: YY_RULE_SETUP #line 558 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_IPSET_NAME_V6) } +{ YDVAR(1, VAR_CACHEDB_BACKEND) } YY_BREAK case 334: YY_RULE_SETUP #line 559 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) } +{ YDVAR(1, VAR_CACHEDB_SECRETSEED) } YY_BREAK case 335: YY_RULE_SETUP #line 560 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) } +{ YDVAR(1, VAR_CACHEDB_REDISHOST) } YY_BREAK case 336: YY_RULE_SETUP #line 561 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(2, VAR_EDNS_CLIENT_STRING) } +{ YDVAR(1, VAR_CACHEDB_REDISPORT) } YY_BREAK case 337: YY_RULE_SETUP #line 562 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) } +{ YDVAR(1, VAR_CACHEDB_REDISPATH) } YY_BREAK case 338: YY_RULE_SETUP #line 563 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_NSID ) } +{ YDVAR(1, VAR_CACHEDB_REDISPASSWORD) } YY_BREAK case 339: YY_RULE_SETUP #line 564 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_EDE ) } +{ YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) } YY_BREAK case 340: YY_RULE_SETUP #line 565 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ YDVAR(1, VAR_PROXY_PROTOCOL_PORT) } +{ YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) } YY_BREAK case 341: -/* rule 341 can match eol */ YY_RULE_SETUP #line 566 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(0, VAR_IPSET) } + YY_BREAK +case 342: +YY_RULE_SETUP +#line 567 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_IPSET_NAME_V4) } + YY_BREAK +case 343: +YY_RULE_SETUP +#line 568 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_IPSET_NAME_V6) } + YY_BREAK +case 344: +YY_RULE_SETUP +#line 569 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) } + YY_BREAK +case 345: +YY_RULE_SETUP +#line 570 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(2, VAR_TCP_CONNECTION_LIMIT) } + YY_BREAK +case 346: +YY_RULE_SETUP +#line 571 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_ANSWER_COOKIE ) } + YY_BREAK +case 347: +YY_RULE_SETUP +#line 572 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_COOKIE_SECRET) } + YY_BREAK +case 348: +YY_RULE_SETUP +#line 573 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(2, VAR_EDNS_CLIENT_STRING) } + YY_BREAK +case 349: +YY_RULE_SETUP +#line 574 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) } + YY_BREAK +case 350: +YY_RULE_SETUP +#line 575 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_NSID ) } + YY_BREAK +case 351: +YY_RULE_SETUP +#line 576 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_EDE ) } + YY_BREAK +case 352: +YY_RULE_SETUP +#line 577 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ YDVAR(1, VAR_PROXY_PROTOCOL_PORT) } + YY_BREAK +case 353: +/* rule 353 can match eol */ +YY_RULE_SETUP +#line 578 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("NL\n")); cfg_parser->line++; } YY_BREAK /* Quoted strings. Strip leading and ending quotes */ -case 342: +case 354: YY_RULE_SETUP -#line 569 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 581 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { BEGIN(quotedstring); LEXOUT(("QS ")); } YY_BREAK case YY_STATE_EOF(quotedstring): -#line 570 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 582 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("EOF inside quoted string"); if(--num_args == 0) { BEGIN(INITIAL); } else { BEGIN(val); } } YY_BREAK -case 343: +case 355: YY_RULE_SETUP -#line 575 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 587 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("STR(%s) ", yytext)); yymore(); } YY_BREAK -case 344: -/* rule 344 can match eol */ +case 356: +/* rule 356 can match eol */ YY_RULE_SETUP -#line 576 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ yyerror("newline inside quoted string, no end \""); +#line 588 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ yyerror("newline inside quoted string, no end \""); cfg_parser->line++; BEGIN(INITIAL); } YY_BREAK -case 345: +case 357: YY_RULE_SETUP -#line 578 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 590 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("QE ")); if(--num_args == 0) { BEGIN(INITIAL); } @@ -5470,34 +5626,34 @@ YY_RULE_SETUP } YY_BREAK /* Single Quoted strings. Strip leading and ending quotes */ -case 346: +case 358: YY_RULE_SETUP -#line 590 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 602 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { BEGIN(singlequotedstr); LEXOUT(("SQS ")); } YY_BREAK case YY_STATE_EOF(singlequotedstr): -#line 591 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 603 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("EOF inside quoted string"); if(--num_args == 0) { BEGIN(INITIAL); } else { BEGIN(val); } } YY_BREAK -case 347: +case 359: YY_RULE_SETUP -#line 596 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 608 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("STR(%s) ", yytext)); yymore(); } YY_BREAK -case 348: -/* rule 348 can match eol */ +case 360: +/* rule 360 can match eol */ YY_RULE_SETUP -#line 597 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ yyerror("newline inside quoted string, no end '"); +#line 609 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ yyerror("newline inside quoted string, no end '"); cfg_parser->line++; BEGIN(INITIAL); } YY_BREAK -case 349: +case 361: YY_RULE_SETUP -#line 599 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 611 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("SQE ")); if(--num_args == 0) { BEGIN(INITIAL); } @@ -5510,38 +5666,38 @@ YY_RULE_SETUP } YY_BREAK /* include: directive */ -case 350: +case 362: YY_RULE_SETUP -#line 611 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ +#line 623 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); } YY_BREAK case YY_STATE_EOF(include): -#line 613 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 625 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("EOF inside include directive"); BEGIN(inc_prev); } YY_BREAK -case 351: +case 363: YY_RULE_SETUP -#line 617 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 629 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ISP ")); /* ignore */ } YY_BREAK -case 352: -/* rule 352 can match eol */ +case 364: +/* rule 364 can match eol */ YY_RULE_SETUP -#line 618 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 630 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("NL\n")); cfg_parser->line++;} YY_BREAK -case 353: +case 365: YY_RULE_SETUP -#line 619 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 631 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("IQS ")); BEGIN(include_quoted); } YY_BREAK -case 354: +case 366: YY_RULE_SETUP -#line 620 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 632 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("Iunquotedstr(%s) ", yytext)); config_start_include_glob(yytext, 0); @@ -5549,27 +5705,27 @@ YY_RULE_SETUP } YY_BREAK case YY_STATE_EOF(include_quoted): -#line 625 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 637 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("EOF inside quoted string"); BEGIN(inc_prev); } YY_BREAK -case 355: +case 367: YY_RULE_SETUP -#line 629 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 641 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ISTR(%s) ", yytext)); yymore(); } YY_BREAK -case 356: -/* rule 356 can match eol */ +case 368: +/* rule 368 can match eol */ YY_RULE_SETUP -#line 630 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ yyerror("newline before \" in include name"); +#line 642 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ yyerror("newline before \" in include name"); cfg_parser->line++; BEGIN(inc_prev); } YY_BREAK -case 357: +case 369: YY_RULE_SETUP -#line 632 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 644 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("IQE ")); yytext[yyleng - 1] = '\0'; @@ -5579,7 +5735,7 @@ YY_RULE_SETUP YY_BREAK case YY_STATE_EOF(INITIAL): case YY_STATE_EOF(val): -#line 638 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 650 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("LEXEOF ")); yy_set_bol(1); /* Set beginning of line, so "^" rules match. */ @@ -5594,39 +5750,39 @@ case YY_STATE_EOF(val): } YY_BREAK /* include-toplevel: directive */ -case 358: +case 370: YY_RULE_SETUP -#line 652 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 664 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include_toplevel); } YY_BREAK case YY_STATE_EOF(include_toplevel): -#line 655 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 667 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("EOF inside include_toplevel directive"); BEGIN(inc_prev); } YY_BREAK -case 359: +case 371: YY_RULE_SETUP -#line 659 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 671 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ITSP ")); /* ignore */ } YY_BREAK -case 360: -/* rule 360 can match eol */ +case 372: +/* rule 372 can match eol */ YY_RULE_SETUP -#line 660 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 672 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("NL\n")); cfg_parser->line++; } YY_BREAK -case 361: +case 373: YY_RULE_SETUP -#line 661 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 673 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ITQS ")); BEGIN(include_toplevel_quoted); } YY_BREAK -case 362: +case 374: YY_RULE_SETUP -#line 662 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 674 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ITunquotedstr(%s) ", yytext)); config_start_include_glob(yytext, 1); @@ -5635,29 +5791,29 @@ YY_RULE_SETUP } YY_BREAK case YY_STATE_EOF(include_toplevel_quoted): -#line 668 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 680 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("EOF inside quoted string"); BEGIN(inc_prev); } YY_BREAK -case 363: +case 375: YY_RULE_SETUP -#line 672 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 684 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ITSTR(%s) ", yytext)); yymore(); } YY_BREAK -case 364: -/* rule 364 can match eol */ +case 376: +/* rule 376 can match eol */ YY_RULE_SETUP -#line 673 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 685 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { yyerror("newline before \" in include name"); cfg_parser->line++; BEGIN(inc_prev); } YY_BREAK -case 365: +case 377: YY_RULE_SETUP -#line 677 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 689 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { LEXOUT(("ITQE ")); yytext[yyleng - 1] = '\0'; @@ -5666,33 +5822,33 @@ YY_RULE_SETUP return (VAR_FORCE_TOPLEVEL); } YY_BREAK -case 366: +case 378: YY_RULE_SETUP -#line 685 "/usr/src/usr.sbin/unbound/util/configlexer.lex" -{ LEXOUT(("unquotedstr(%s) ", yytext)); +#line 697 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +{ LEXOUT(("unquotedstr(%s) ", yytext)); if(--num_args == 0) { BEGIN(INITIAL); } yylval.str = strdup(yytext); return STRING_ARG; } YY_BREAK -case 367: +case 379: YY_RULE_SETUP -#line 689 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 701 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { ub_c_error_msg("unknown keyword '%s'", yytext); } YY_BREAK -case 368: +case 380: YY_RULE_SETUP -#line 693 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 705 "/usr/src/usr.sbin/unbound/util/configlexer.lex" { ub_c_error_msg("stray '%s'", yytext); } YY_BREAK -case 369: +case 381: YY_RULE_SETUP -#line 697 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 709 "/usr/src/usr.sbin/unbound/util/configlexer.lex" ECHO; YY_BREAK -#line 5694 "" +#line 5850 "" case YY_END_OF_BUFFER: { @@ -5985,7 +6141,7 @@ static int yy_get_next_buffer (void) while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) { yy_current_state = (int) yy_def[yy_current_state]; - if ( yy_current_state >= 3646 ) + if ( yy_current_state >= 3778 ) yy_c = yy_meta[(unsigned int) yy_c]; } yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c]; @@ -6013,11 +6169,11 @@ static int yy_get_next_buffer (void) while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) { yy_current_state = (int) yy_def[yy_current_state]; - if ( yy_current_state >= 3646 ) + if ( yy_current_state >= 3778 ) yy_c = yy_meta[(unsigned int) yy_c]; } yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c]; - yy_is_jam = (yy_current_state == 3645); + yy_is_jam = (yy_current_state == 3777); return yy_is_jam ? 0 : yy_current_state; } @@ -6650,7 +6806,7 @@ void yyfree (void * ptr ) #define YYTABLES_NAME "yytables" -#line 697 "/usr/src/usr.sbin/unbound/util/configlexer.lex" +#line 709 "/usr/src/usr.sbin/unbound/util/configlexer.lex" diff --git a/sbin/unwind/libunbound/util/configlexer.lex b/sbin/unwind/libunbound/util/configlexer.lex index 09e314b21..3fcdfa62e 100644 --- a/sbin/unwind/libunbound/util/configlexer.lex +++ b/sbin/unwind/libunbound/util/configlexer.lex @@ -209,9 +209,9 @@ SQANY [^\'\n\r\\]|\\. %x quotedstring singlequotedstr include include_quoted val include_toplevel include_toplevel_quoted %% -{SPACE}* { +{SPACE}* { LEXOUT(("SP ")); /* ignore */ } -{SPACE}*{COMMENT}.* { +{SPACE}*{COMMENT}.* { /* note that flex makes the longest match and '.' is any but not nl */ LEXOUT(("comment(%s) ", yytext)); /* ignore */ } server{COLON} { YDVAR(0, VAR_SERVER) } @@ -227,6 +227,7 @@ outgoing-num-tcp{COLON} { YDVAR(1, VAR_OUTGOING_NUM_TCP) } incoming-num-tcp{COLON} { YDVAR(1, VAR_INCOMING_NUM_TCP) } do-ip4{COLON} { YDVAR(1, VAR_DO_IP4) } do-ip6{COLON} { YDVAR(1, VAR_DO_IP6) } +do-nat64{COLON} { YDVAR(1, VAR_DO_NAT64) } prefer-ip4{COLON} { YDVAR(1, VAR_PREFER_IP4) } prefer-ip6{COLON} { YDVAR(1, VAR_PREFER_IP6) } do-udp{COLON} { YDVAR(1, VAR_DO_UDP) } @@ -240,6 +241,7 @@ tcp-reuse-timeout{COLON} { YDVAR(1, VAR_TCP_REUSE_TIMEOUT) } tcp-auth-query-timeout{COLON} { YDVAR(1, VAR_TCP_AUTH_QUERY_TIMEOUT) } edns-tcp-keepalive{COLON} { YDVAR(1, VAR_EDNS_TCP_KEEPALIVE) } edns-tcp-keepalive-timeout{COLON} { YDVAR(1, VAR_EDNS_TCP_KEEPALIVE_TIMEOUT) } +sock-queue-timeout{COLON} { YDVAR(1, VAR_SOCK_QUEUE_TIMEOUT) } ssl-upstream{COLON} { YDVAR(1, VAR_SSL_UPSTREAM) } tls-upstream{COLON} { YDVAR(1, VAR_SSL_UPSTREAM) } ssl-service-key{COLON} { YDVAR(1, VAR_SSL_SERVICE_KEY) } @@ -316,6 +318,7 @@ harden-dnssec-stripped{COLON} { YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) } harden-below-nxdomain{COLON} { YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) } harden-referral-path{COLON} { YDVAR(1, VAR_HARDEN_REFERRAL_PATH) } harden-algo-downgrade{COLON} { YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) } +harden-unknown-additional{COLON} { YDVAR(1, VAR_HARDEN_UNKNOWN_ADDITIONAL) } use-caps-for-id{COLON} { YDVAR(1, VAR_USE_CAPS_FOR_ID) } caps-whitelist{COLON} { YDVAR(1, VAR_CAPS_WHITELIST) } caps-exempt{COLON} { YDVAR(1, VAR_CAPS_WHITELIST) } @@ -413,7 +416,7 @@ val-log-level{COLON} { YDVAR(1, VAR_VAL_LOG_LEVEL) } key-cache-size{COLON} { YDVAR(1, VAR_KEY_CACHE_SIZE) } key-cache-slabs{COLON} { YDVAR(1, VAR_KEY_CACHE_SLABS) } neg-cache-size{COLON} { YDVAR(1, VAR_NEG_CACHE_SIZE) } -val-nsec3-keysize-iterations{COLON} { +val-nsec3-keysize-iterations{COLON} { YDVAR(1, VAR_VAL_NSEC3_KEYSIZE_ITERATIONS) } zonemd-permissive-mode{COLON} { YDVAR(1, VAR_ZONEMD_PERMISSIVE_MODE) } zonemd-check{COLON} { YDVAR(1, VAR_ZONEMD_CHECK) } @@ -438,6 +441,7 @@ insecure-lan-zones{COLON} { YDVAR(1, VAR_INSECURE_LAN_ZONES) } statistics-interval{COLON} { YDVAR(1, VAR_STATISTICS_INTERVAL) } statistics-cumulative{COLON} { YDVAR(1, VAR_STATISTICS_CUMULATIVE) } extended-statistics{COLON} { YDVAR(1, VAR_EXTENDED_STATISTICS) } +statistics-inhibit-zero{COLON} { YDVAR(1, VAR_STATISTICS_INHIBIT_ZERO) } shm-enable{COLON} { YDVAR(1, VAR_SHM_ENABLE) } shm-key{COLON} { YDVAR(1, VAR_SHM_KEY) } remote-control{COLON} { YDVAR(0, VAR_REMOTE_CONTROL) } @@ -461,6 +465,7 @@ max-udp-size{COLON} { YDVAR(1, VAR_MAX_UDP_SIZE) } dns64-prefix{COLON} { YDVAR(1, VAR_DNS64_PREFIX) } dns64-synthall{COLON} { YDVAR(1, VAR_DNS64_SYNTHALL) } dns64-ignore-aaaa{COLON} { YDVAR(1, VAR_DNS64_IGNORE_AAAA) } +nat64-prefix{COLON} { YDVAR(1, VAR_NAT64_PREFIX) } define-tag{COLON} { YDVAR(1, VAR_DEFINE_TAG) } local-zone-tag{COLON} { YDVAR(2, VAR_LOCAL_ZONE_TAG) } access-control-tag{COLON} { YDVAR(2, VAR_ACCESS_CONTROL_TAG) } @@ -502,6 +507,7 @@ dnstap-log-forwarder-response-messages{COLON} { YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) } disable-dnssec-lame-check{COLON} { YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) } ip-ratelimit{COLON} { YDVAR(1, VAR_IP_RATELIMIT) } +ip-ratelimit-cookie{COLON} { YDVAR(1, VAR_IP_RATELIMIT_COOKIE) } ratelimit{COLON} { YDVAR(1, VAR_RATELIMIT) } ip-ratelimit-slabs{COLON} { YDVAR(1, VAR_IP_RATELIMIT_SLABS) } ratelimit-slabs{COLON} { YDVAR(1, VAR_RATELIMIT_SLABS) } @@ -514,6 +520,8 @@ ratelimit-factor{COLON} { YDVAR(1, VAR_RATELIMIT_FACTOR) } ip-ratelimit-backoff{COLON} { YDVAR(1, VAR_IP_RATELIMIT_BACKOFF) } ratelimit-backoff{COLON} { YDVAR(1, VAR_RATELIMIT_BACKOFF) } outbound-msg-retry{COLON} { YDVAR(1, VAR_OUTBOUND_MSG_RETRY) } +max-sent-count{COLON} { YDVAR(1, VAR_MAX_SENT_COUNT) } +max-query-restarts{COLON} { YDVAR(1, VAR_MAX_QUERY_RESTARTS) } low-rtt{COLON} { YDVAR(1, VAR_LOW_RTT) } fast-server-num{COLON} { YDVAR(1, VAR_FAST_SERVER_NUM) } low-rtt-pct{COLON} { YDVAR(1, VAR_FAST_SERVER_PERMIL) } @@ -551,6 +559,8 @@ backend{COLON} { YDVAR(1, VAR_CACHEDB_BACKEND) } secret-seed{COLON} { YDVAR(1, VAR_CACHEDB_SECRETSEED) } redis-server-host{COLON} { YDVAR(1, VAR_CACHEDB_REDISHOST) } redis-server-port{COLON} { YDVAR(1, VAR_CACHEDB_REDISPORT) } +redis-server-path{COLON} { YDVAR(1, VAR_CACHEDB_REDISPATH) } +redis-server-password{COLON} { YDVAR(1, VAR_CACHEDB_REDISPASSWORD) } redis-timeout{COLON} { YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) } redis-expire-records{COLON} { YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) } ipset{COLON} { YDVAR(0, VAR_IPSET) } @@ -558,6 +568,8 @@ name-v4{COLON} { YDVAR(1, VAR_IPSET_NAME_V4) } name-v6{COLON} { YDVAR(1, VAR_IPSET_NAME_V6) } udp-upstream-without-downstream{COLON} { YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) } tcp-connection-limit{COLON} { YDVAR(2, VAR_TCP_CONNECTION_LIMIT) } +answer-cookie{COLON} { YDVAR(1, VAR_ANSWER_COOKIE ) } +cookie-secret{COLON} { YDVAR(1, VAR_COOKIE_SECRET) } edns-client-string{COLON} { YDVAR(2, VAR_EDNS_CLIENT_STRING) } edns-client-string-opcode{COLON} { YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) } nsid{COLON} { YDVAR(1, VAR_NSID ) } @@ -573,7 +585,7 @@ proxy-protocol-port{COLON} { YDVAR(1, VAR_PROXY_PROTOCOL_PORT) } else { BEGIN(val); } } {DQANY}* { LEXOUT(("STR(%s) ", yytext)); yymore(); } -{NEWLINE} { yyerror("newline inside quoted string, no end \""); +{NEWLINE} { yyerror("newline inside quoted string, no end \""); cfg_parser->line++; BEGIN(INITIAL); } \" { LEXOUT(("QE ")); @@ -594,7 +606,7 @@ proxy-protocol-port{COLON} { YDVAR(1, VAR_PROXY_PROTOCOL_PORT) } else { BEGIN(val); } } {SQANY}* { LEXOUT(("STR(%s) ", yytext)); yymore(); } -{NEWLINE} { yyerror("newline inside quoted string, no end '"); +{NEWLINE} { yyerror("newline inside quoted string, no end '"); cfg_parser->line++; BEGIN(INITIAL); } \' { LEXOUT(("SQE ")); @@ -608,7 +620,7 @@ proxy-protocol-port{COLON} { YDVAR(1, VAR_PROXY_PROTOCOL_PORT) } } /* include: directive */ -include{COLON} { +include{COLON} { LEXOUT(("v(%s) ", yytext)); inc_prev = YYSTATE; BEGIN(include); } <> { yyerror("EOF inside include directive"); @@ -627,7 +639,7 @@ proxy-protocol-port{COLON} { YDVAR(1, VAR_PROXY_PROTOCOL_PORT) } BEGIN(inc_prev); } {DQANY}* { LEXOUT(("ISTR(%s) ", yytext)); yymore(); } -{NEWLINE} { yyerror("newline before \" in include name"); +{NEWLINE} { yyerror("newline before \" in include name"); cfg_parser->line++; BEGIN(inc_prev); } \" { LEXOUT(("IQE ")); @@ -682,7 +694,7 @@ proxy-protocol-port{COLON} { YDVAR(1, VAR_PROXY_PROTOCOL_PORT) } return (VAR_FORCE_TOPLEVEL); } -{UNQUOTEDLETTER}* { LEXOUT(("unquotedstr(%s) ", yytext)); +{UNQUOTEDLETTER}* { LEXOUT(("unquotedstr(%s) ", yytext)); if(--num_args == 0) { BEGIN(INITIAL); } yylval.str = strdup(yytext); return STRING_ARG; } diff --git a/sbin/unwind/libunbound/util/configparser.h b/sbin/unwind/libunbound/util/configparser.h index d2e7370f1..ad2902b29 100644 --- a/sbin/unwind/libunbound/util/configparser.h +++ b/sbin/unwind/libunbound/util/configparser.h @@ -16,319 +16,331 @@ #define VAR_PREFER_IP4 272 #define VAR_DO_IP4 273 #define VAR_DO_IP6 274 -#define VAR_PREFER_IP6 275 -#define VAR_DO_UDP 276 -#define VAR_DO_TCP 277 -#define VAR_TCP_MSS 278 -#define VAR_OUTGOING_TCP_MSS 279 -#define VAR_TCP_IDLE_TIMEOUT 280 -#define VAR_EDNS_TCP_KEEPALIVE 281 -#define VAR_EDNS_TCP_KEEPALIVE_TIMEOUT 282 -#define VAR_CHROOT 283 -#define VAR_USERNAME 284 -#define VAR_DIRECTORY 285 -#define VAR_LOGFILE 286 -#define VAR_PIDFILE 287 -#define VAR_MSG_CACHE_SIZE 288 -#define VAR_MSG_CACHE_SLABS 289 -#define VAR_NUM_QUERIES_PER_THREAD 290 -#define VAR_RRSET_CACHE_SIZE 291 -#define VAR_RRSET_CACHE_SLABS 292 -#define VAR_OUTGOING_NUM_TCP 293 -#define VAR_INFRA_HOST_TTL 294 -#define VAR_INFRA_LAME_TTL 295 -#define VAR_INFRA_CACHE_SLABS 296 -#define VAR_INFRA_CACHE_NUMHOSTS 297 -#define VAR_INFRA_CACHE_LAME_SIZE 298 -#define VAR_NAME 299 -#define VAR_STUB_ZONE 300 -#define VAR_STUB_HOST 301 -#define VAR_STUB_ADDR 302 -#define VAR_TARGET_FETCH_POLICY 303 -#define VAR_HARDEN_SHORT_BUFSIZE 304 -#define VAR_HARDEN_LARGE_QUERIES 305 -#define VAR_FORWARD_ZONE 306 -#define VAR_FORWARD_HOST 307 -#define VAR_FORWARD_ADDR 308 -#define VAR_DO_NOT_QUERY_ADDRESS 309 -#define VAR_HIDE_IDENTITY 310 -#define VAR_HIDE_VERSION 311 -#define VAR_IDENTITY 312 -#define VAR_VERSION 313 -#define VAR_HARDEN_GLUE 314 -#define VAR_MODULE_CONF 315 -#define VAR_TRUST_ANCHOR_FILE 316 -#define VAR_TRUST_ANCHOR 317 -#define VAR_VAL_OVERRIDE_DATE 318 -#define VAR_BOGUS_TTL 319 -#define VAR_VAL_CLEAN_ADDITIONAL 320 -#define VAR_VAL_PERMISSIVE_MODE 321 -#define VAR_INCOMING_NUM_TCP 322 -#define VAR_MSG_BUFFER_SIZE 323 -#define VAR_KEY_CACHE_SIZE 324 -#define VAR_KEY_CACHE_SLABS 325 -#define VAR_TRUSTED_KEYS_FILE 326 -#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 327 -#define VAR_USE_SYSLOG 328 -#define VAR_OUTGOING_INTERFACE 329 -#define VAR_ROOT_HINTS 330 -#define VAR_DO_NOT_QUERY_LOCALHOST 331 -#define VAR_CACHE_MAX_TTL 332 -#define VAR_HARDEN_DNSSEC_STRIPPED 333 -#define VAR_ACCESS_CONTROL 334 -#define VAR_LOCAL_ZONE 335 -#define VAR_LOCAL_DATA 336 -#define VAR_INTERFACE_AUTOMATIC 337 -#define VAR_STATISTICS_INTERVAL 338 -#define VAR_DO_DAEMONIZE 339 -#define VAR_USE_CAPS_FOR_ID 340 -#define VAR_STATISTICS_CUMULATIVE 341 -#define VAR_OUTGOING_PORT_PERMIT 342 -#define VAR_OUTGOING_PORT_AVOID 343 -#define VAR_DLV_ANCHOR_FILE 344 -#define VAR_DLV_ANCHOR 345 -#define VAR_NEG_CACHE_SIZE 346 -#define VAR_HARDEN_REFERRAL_PATH 347 -#define VAR_PRIVATE_ADDRESS 348 -#define VAR_PRIVATE_DOMAIN 349 -#define VAR_REMOTE_CONTROL 350 -#define VAR_CONTROL_ENABLE 351 -#define VAR_CONTROL_INTERFACE 352 -#define VAR_CONTROL_PORT 353 -#define VAR_SERVER_KEY_FILE 354 -#define VAR_SERVER_CERT_FILE 355 -#define VAR_CONTROL_KEY_FILE 356 -#define VAR_CONTROL_CERT_FILE 357 -#define VAR_CONTROL_USE_CERT 358 -#define VAR_TCP_REUSE_TIMEOUT 359 -#define VAR_MAX_REUSE_TCP_QUERIES 360 -#define VAR_EXTENDED_STATISTICS 361 -#define VAR_LOCAL_DATA_PTR 362 -#define VAR_JOSTLE_TIMEOUT 363 -#define VAR_STUB_PRIME 364 -#define VAR_UNWANTED_REPLY_THRESHOLD 365 -#define VAR_LOG_TIME_ASCII 366 -#define VAR_DOMAIN_INSECURE 367 -#define VAR_PYTHON 368 -#define VAR_PYTHON_SCRIPT 369 -#define VAR_VAL_SIG_SKEW_MIN 370 -#define VAR_VAL_SIG_SKEW_MAX 371 -#define VAR_VAL_MAX_RESTART 372 -#define VAR_CACHE_MIN_TTL 373 -#define VAR_VAL_LOG_LEVEL 374 -#define VAR_AUTO_TRUST_ANCHOR_FILE 375 -#define VAR_KEEP_MISSING 376 -#define VAR_ADD_HOLDDOWN 377 -#define VAR_DEL_HOLDDOWN 378 -#define VAR_SO_RCVBUF 379 -#define VAR_EDNS_BUFFER_SIZE 380 -#define VAR_PREFETCH 381 -#define VAR_PREFETCH_KEY 382 -#define VAR_SO_SNDBUF 383 -#define VAR_SO_REUSEPORT 384 -#define VAR_HARDEN_BELOW_NXDOMAIN 385 -#define VAR_IGNORE_CD_FLAG 386 -#define VAR_LOG_QUERIES 387 -#define VAR_LOG_REPLIES 388 -#define VAR_LOG_LOCAL_ACTIONS 389 -#define VAR_TCP_UPSTREAM 390 -#define VAR_SSL_UPSTREAM 391 -#define VAR_TCP_AUTH_QUERY_TIMEOUT 392 -#define VAR_SSL_SERVICE_KEY 393 -#define VAR_SSL_SERVICE_PEM 394 -#define VAR_SSL_PORT 395 -#define VAR_FORWARD_FIRST 396 -#define VAR_STUB_SSL_UPSTREAM 397 -#define VAR_FORWARD_SSL_UPSTREAM 398 -#define VAR_TLS_CERT_BUNDLE 399 -#define VAR_STUB_TCP_UPSTREAM 400 -#define VAR_FORWARD_TCP_UPSTREAM 401 -#define VAR_HTTPS_PORT 402 -#define VAR_HTTP_ENDPOINT 403 -#define VAR_HTTP_MAX_STREAMS 404 -#define VAR_HTTP_QUERY_BUFFER_SIZE 405 -#define VAR_HTTP_RESPONSE_BUFFER_SIZE 406 -#define VAR_HTTP_NODELAY 407 -#define VAR_HTTP_NOTLS_DOWNSTREAM 408 -#define VAR_STUB_FIRST 409 -#define VAR_MINIMAL_RESPONSES 410 -#define VAR_RRSET_ROUNDROBIN 411 -#define VAR_MAX_UDP_SIZE 412 -#define VAR_DELAY_CLOSE 413 -#define VAR_UDP_CONNECT 414 -#define VAR_UNBLOCK_LAN_ZONES 415 -#define VAR_INSECURE_LAN_ZONES 416 -#define VAR_INFRA_CACHE_MIN_RTT 417 -#define VAR_INFRA_CACHE_MAX_RTT 418 -#define VAR_INFRA_KEEP_PROBING 419 -#define VAR_DNS64_PREFIX 420 -#define VAR_DNS64_SYNTHALL 421 -#define VAR_DNS64_IGNORE_AAAA 422 -#define VAR_DNSTAP 423 -#define VAR_DNSTAP_ENABLE 424 -#define VAR_DNSTAP_SOCKET_PATH 425 -#define VAR_DNSTAP_IP 426 -#define VAR_DNSTAP_TLS 427 -#define VAR_DNSTAP_TLS_SERVER_NAME 428 -#define VAR_DNSTAP_TLS_CERT_BUNDLE 429 -#define VAR_DNSTAP_TLS_CLIENT_KEY_FILE 430 -#define VAR_DNSTAP_TLS_CLIENT_CERT_FILE 431 -#define VAR_DNSTAP_SEND_IDENTITY 432 -#define VAR_DNSTAP_SEND_VERSION 433 -#define VAR_DNSTAP_BIDIRECTIONAL 434 -#define VAR_DNSTAP_IDENTITY 435 -#define VAR_DNSTAP_VERSION 436 -#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 437 -#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 438 -#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 439 -#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 440 -#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 441 -#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 442 -#define VAR_RESPONSE_IP_TAG 443 -#define VAR_RESPONSE_IP 444 -#define VAR_RESPONSE_IP_DATA 445 -#define VAR_HARDEN_ALGO_DOWNGRADE 446 -#define VAR_IP_TRANSPARENT 447 -#define VAR_IP_DSCP 448 -#define VAR_DISABLE_DNSSEC_LAME_CHECK 449 -#define VAR_IP_RATELIMIT 450 -#define VAR_IP_RATELIMIT_SLABS 451 -#define VAR_IP_RATELIMIT_SIZE 452 -#define VAR_RATELIMIT 453 -#define VAR_RATELIMIT_SLABS 454 -#define VAR_RATELIMIT_SIZE 455 -#define VAR_OUTBOUND_MSG_RETRY 456 -#define VAR_RATELIMIT_FOR_DOMAIN 457 -#define VAR_RATELIMIT_BELOW_DOMAIN 458 -#define VAR_IP_RATELIMIT_FACTOR 459 -#define VAR_RATELIMIT_FACTOR 460 -#define VAR_IP_RATELIMIT_BACKOFF 461 -#define VAR_RATELIMIT_BACKOFF 462 -#define VAR_SEND_CLIENT_SUBNET 463 -#define VAR_CLIENT_SUBNET_ZONE 464 -#define VAR_CLIENT_SUBNET_ALWAYS_FORWARD 465 -#define VAR_CLIENT_SUBNET_OPCODE 466 -#define VAR_MAX_CLIENT_SUBNET_IPV4 467 -#define VAR_MAX_CLIENT_SUBNET_IPV6 468 -#define VAR_MIN_CLIENT_SUBNET_IPV4 469 -#define VAR_MIN_CLIENT_SUBNET_IPV6 470 -#define VAR_MAX_ECS_TREE_SIZE_IPV4 471 -#define VAR_MAX_ECS_TREE_SIZE_IPV6 472 -#define VAR_CAPS_WHITELIST 473 -#define VAR_CACHE_MAX_NEGATIVE_TTL 474 -#define VAR_PERMIT_SMALL_HOLDDOWN 475 -#define VAR_QNAME_MINIMISATION 476 -#define VAR_QNAME_MINIMISATION_STRICT 477 -#define VAR_IP_FREEBIND 478 -#define VAR_DEFINE_TAG 479 -#define VAR_LOCAL_ZONE_TAG 480 -#define VAR_ACCESS_CONTROL_TAG 481 -#define VAR_LOCAL_ZONE_OVERRIDE 482 -#define VAR_ACCESS_CONTROL_TAG_ACTION 483 -#define VAR_ACCESS_CONTROL_TAG_DATA 484 -#define VAR_VIEW 485 -#define VAR_ACCESS_CONTROL_VIEW 486 -#define VAR_VIEW_FIRST 487 -#define VAR_SERVE_EXPIRED 488 -#define VAR_SERVE_EXPIRED_TTL 489 -#define VAR_SERVE_EXPIRED_TTL_RESET 490 -#define VAR_SERVE_EXPIRED_REPLY_TTL 491 -#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 492 -#define VAR_EDE_SERVE_EXPIRED 493 -#define VAR_SERVE_ORIGINAL_TTL 494 -#define VAR_FAKE_DSA 495 -#define VAR_FAKE_SHA1 496 -#define VAR_LOG_IDENTITY 497 -#define VAR_HIDE_TRUSTANCHOR 498 -#define VAR_HIDE_HTTP_USER_AGENT 499 -#define VAR_HTTP_USER_AGENT 500 -#define VAR_TRUST_ANCHOR_SIGNALING 501 -#define VAR_AGGRESSIVE_NSEC 502 -#define VAR_USE_SYSTEMD 503 -#define VAR_SHM_ENABLE 504 -#define VAR_SHM_KEY 505 -#define VAR_ROOT_KEY_SENTINEL 506 -#define VAR_DNSCRYPT 507 -#define VAR_DNSCRYPT_ENABLE 508 -#define VAR_DNSCRYPT_PORT 509 -#define VAR_DNSCRYPT_PROVIDER 510 -#define VAR_DNSCRYPT_SECRET_KEY 511 -#define VAR_DNSCRYPT_PROVIDER_CERT 512 -#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 513 -#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 514 -#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 515 -#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 516 -#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 517 -#define VAR_PAD_RESPONSES 518 -#define VAR_PAD_RESPONSES_BLOCK_SIZE 519 -#define VAR_PAD_QUERIES 520 -#define VAR_PAD_QUERIES_BLOCK_SIZE 521 -#define VAR_IPSECMOD_ENABLED 522 -#define VAR_IPSECMOD_HOOK 523 -#define VAR_IPSECMOD_IGNORE_BOGUS 524 -#define VAR_IPSECMOD_MAX_TTL 525 -#define VAR_IPSECMOD_WHITELIST 526 -#define VAR_IPSECMOD_STRICT 527 -#define VAR_CACHEDB 528 -#define VAR_CACHEDB_BACKEND 529 -#define VAR_CACHEDB_SECRETSEED 530 -#define VAR_CACHEDB_REDISHOST 531 -#define VAR_CACHEDB_REDISPORT 532 -#define VAR_CACHEDB_REDISTIMEOUT 533 -#define VAR_CACHEDB_REDISEXPIRERECORDS 534 -#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 535 -#define VAR_FOR_UPSTREAM 536 -#define VAR_AUTH_ZONE 537 -#define VAR_ZONEFILE 538 -#define VAR_MASTER 539 -#define VAR_URL 540 -#define VAR_FOR_DOWNSTREAM 541 -#define VAR_FALLBACK_ENABLED 542 -#define VAR_TLS_ADDITIONAL_PORT 543 -#define VAR_LOW_RTT 544 -#define VAR_LOW_RTT_PERMIL 545 -#define VAR_FAST_SERVER_PERMIL 546 -#define VAR_FAST_SERVER_NUM 547 -#define VAR_ALLOW_NOTIFY 548 -#define VAR_TLS_WIN_CERT 549 -#define VAR_TCP_CONNECTION_LIMIT 550 -#define VAR_FORWARD_NO_CACHE 551 -#define VAR_STUB_NO_CACHE 552 -#define VAR_LOG_SERVFAIL 553 -#define VAR_DENY_ANY 554 -#define VAR_UNKNOWN_SERVER_TIME_LIMIT 555 -#define VAR_LOG_TAG_QUERYREPLY 556 -#define VAR_STREAM_WAIT_SIZE 557 -#define VAR_TLS_CIPHERS 558 -#define VAR_TLS_CIPHERSUITES 559 -#define VAR_TLS_USE_SNI 560 -#define VAR_IPSET 561 -#define VAR_IPSET_NAME_V4 562 -#define VAR_IPSET_NAME_V6 563 -#define VAR_TLS_SESSION_TICKET_KEYS 564 -#define VAR_RPZ 565 -#define VAR_TAGS 566 -#define VAR_RPZ_ACTION_OVERRIDE 567 -#define VAR_RPZ_CNAME_OVERRIDE 568 -#define VAR_RPZ_LOG 569 -#define VAR_RPZ_LOG_NAME 570 -#define VAR_DYNLIB 571 -#define VAR_DYNLIB_FILE 572 -#define VAR_EDNS_CLIENT_STRING 573 -#define VAR_EDNS_CLIENT_STRING_OPCODE 574 -#define VAR_NSID 575 -#define VAR_ZONEMD_PERMISSIVE_MODE 576 -#define VAR_ZONEMD_CHECK 577 -#define VAR_ZONEMD_REJECT_ABSENCE 578 -#define VAR_RPZ_SIGNAL_NXDOMAIN_RA 579 -#define VAR_INTERFACE_AUTOMATIC_PORTS 580 -#define VAR_EDE 581 -#define VAR_INTERFACE_ACTION 582 -#define VAR_INTERFACE_VIEW 583 -#define VAR_INTERFACE_TAG 584 -#define VAR_INTERFACE_TAG_ACTION 585 -#define VAR_INTERFACE_TAG_DATA 586 -#define VAR_PROXY_PROTOCOL_PORT 587 +#define VAR_DO_NAT64 275 +#define VAR_PREFER_IP6 276 +#define VAR_DO_UDP 277 +#define VAR_DO_TCP 278 +#define VAR_TCP_MSS 279 +#define VAR_OUTGOING_TCP_MSS 280 +#define VAR_TCP_IDLE_TIMEOUT 281 +#define VAR_EDNS_TCP_KEEPALIVE 282 +#define VAR_EDNS_TCP_KEEPALIVE_TIMEOUT 283 +#define VAR_SOCK_QUEUE_TIMEOUT 284 +#define VAR_CHROOT 285 +#define VAR_USERNAME 286 +#define VAR_DIRECTORY 287 +#define VAR_LOGFILE 288 +#define VAR_PIDFILE 289 +#define VAR_MSG_CACHE_SIZE 290 +#define VAR_MSG_CACHE_SLABS 291 +#define VAR_NUM_QUERIES_PER_THREAD 292 +#define VAR_RRSET_CACHE_SIZE 293 +#define VAR_RRSET_CACHE_SLABS 294 +#define VAR_OUTGOING_NUM_TCP 295 +#define VAR_INFRA_HOST_TTL 296 +#define VAR_INFRA_LAME_TTL 297 +#define VAR_INFRA_CACHE_SLABS 298 +#define VAR_INFRA_CACHE_NUMHOSTS 299 +#define VAR_INFRA_CACHE_LAME_SIZE 300 +#define VAR_NAME 301 +#define VAR_STUB_ZONE 302 +#define VAR_STUB_HOST 303 +#define VAR_STUB_ADDR 304 +#define VAR_TARGET_FETCH_POLICY 305 +#define VAR_HARDEN_SHORT_BUFSIZE 306 +#define VAR_HARDEN_LARGE_QUERIES 307 +#define VAR_FORWARD_ZONE 308 +#define VAR_FORWARD_HOST 309 +#define VAR_FORWARD_ADDR 310 +#define VAR_DO_NOT_QUERY_ADDRESS 311 +#define VAR_HIDE_IDENTITY 312 +#define VAR_HIDE_VERSION 313 +#define VAR_IDENTITY 314 +#define VAR_VERSION 315 +#define VAR_HARDEN_GLUE 316 +#define VAR_MODULE_CONF 317 +#define VAR_TRUST_ANCHOR_FILE 318 +#define VAR_TRUST_ANCHOR 319 +#define VAR_VAL_OVERRIDE_DATE 320 +#define VAR_BOGUS_TTL 321 +#define VAR_VAL_CLEAN_ADDITIONAL 322 +#define VAR_VAL_PERMISSIVE_MODE 323 +#define VAR_INCOMING_NUM_TCP 324 +#define VAR_MSG_BUFFER_SIZE 325 +#define VAR_KEY_CACHE_SIZE 326 +#define VAR_KEY_CACHE_SLABS 327 +#define VAR_TRUSTED_KEYS_FILE 328 +#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 329 +#define VAR_USE_SYSLOG 330 +#define VAR_OUTGOING_INTERFACE 331 +#define VAR_ROOT_HINTS 332 +#define VAR_DO_NOT_QUERY_LOCALHOST 333 +#define VAR_CACHE_MAX_TTL 334 +#define VAR_HARDEN_DNSSEC_STRIPPED 335 +#define VAR_ACCESS_CONTROL 336 +#define VAR_LOCAL_ZONE 337 +#define VAR_LOCAL_DATA 338 +#define VAR_INTERFACE_AUTOMATIC 339 +#define VAR_STATISTICS_INTERVAL 340 +#define VAR_DO_DAEMONIZE 341 +#define VAR_USE_CAPS_FOR_ID 342 +#define VAR_STATISTICS_CUMULATIVE 343 +#define VAR_OUTGOING_PORT_PERMIT 344 +#define VAR_OUTGOING_PORT_AVOID 345 +#define VAR_DLV_ANCHOR_FILE 346 +#define VAR_DLV_ANCHOR 347 +#define VAR_NEG_CACHE_SIZE 348 +#define VAR_HARDEN_REFERRAL_PATH 349 +#define VAR_PRIVATE_ADDRESS 350 +#define VAR_PRIVATE_DOMAIN 351 +#define VAR_REMOTE_CONTROL 352 +#define VAR_CONTROL_ENABLE 353 +#define VAR_CONTROL_INTERFACE 354 +#define VAR_CONTROL_PORT 355 +#define VAR_SERVER_KEY_FILE 356 +#define VAR_SERVER_CERT_FILE 357 +#define VAR_CONTROL_KEY_FILE 358 +#define VAR_CONTROL_CERT_FILE 359 +#define VAR_CONTROL_USE_CERT 360 +#define VAR_TCP_REUSE_TIMEOUT 361 +#define VAR_MAX_REUSE_TCP_QUERIES 362 +#define VAR_EXTENDED_STATISTICS 363 +#define VAR_LOCAL_DATA_PTR 364 +#define VAR_JOSTLE_TIMEOUT 365 +#define VAR_STUB_PRIME 366 +#define VAR_UNWANTED_REPLY_THRESHOLD 367 +#define VAR_LOG_TIME_ASCII 368 +#define VAR_DOMAIN_INSECURE 369 +#define VAR_PYTHON 370 +#define VAR_PYTHON_SCRIPT 371 +#define VAR_VAL_SIG_SKEW_MIN 372 +#define VAR_VAL_SIG_SKEW_MAX 373 +#define VAR_VAL_MAX_RESTART 374 +#define VAR_CACHE_MIN_TTL 375 +#define VAR_VAL_LOG_LEVEL 376 +#define VAR_AUTO_TRUST_ANCHOR_FILE 377 +#define VAR_KEEP_MISSING 378 +#define VAR_ADD_HOLDDOWN 379 +#define VAR_DEL_HOLDDOWN 380 +#define VAR_SO_RCVBUF 381 +#define VAR_EDNS_BUFFER_SIZE 382 +#define VAR_PREFETCH 383 +#define VAR_PREFETCH_KEY 384 +#define VAR_SO_SNDBUF 385 +#define VAR_SO_REUSEPORT 386 +#define VAR_HARDEN_BELOW_NXDOMAIN 387 +#define VAR_IGNORE_CD_FLAG 388 +#define VAR_LOG_QUERIES 389 +#define VAR_LOG_REPLIES 390 +#define VAR_LOG_LOCAL_ACTIONS 391 +#define VAR_TCP_UPSTREAM 392 +#define VAR_SSL_UPSTREAM 393 +#define VAR_TCP_AUTH_QUERY_TIMEOUT 394 +#define VAR_SSL_SERVICE_KEY 395 +#define VAR_SSL_SERVICE_PEM 396 +#define VAR_SSL_PORT 397 +#define VAR_FORWARD_FIRST 398 +#define VAR_STUB_SSL_UPSTREAM 399 +#define VAR_FORWARD_SSL_UPSTREAM 400 +#define VAR_TLS_CERT_BUNDLE 401 +#define VAR_STUB_TCP_UPSTREAM 402 +#define VAR_FORWARD_TCP_UPSTREAM 403 +#define VAR_HTTPS_PORT 404 +#define VAR_HTTP_ENDPOINT 405 +#define VAR_HTTP_MAX_STREAMS 406 +#define VAR_HTTP_QUERY_BUFFER_SIZE 407 +#define VAR_HTTP_RESPONSE_BUFFER_SIZE 408 +#define VAR_HTTP_NODELAY 409 +#define VAR_HTTP_NOTLS_DOWNSTREAM 410 +#define VAR_STUB_FIRST 411 +#define VAR_MINIMAL_RESPONSES 412 +#define VAR_RRSET_ROUNDROBIN 413 +#define VAR_MAX_UDP_SIZE 414 +#define VAR_DELAY_CLOSE 415 +#define VAR_UDP_CONNECT 416 +#define VAR_UNBLOCK_LAN_ZONES 417 +#define VAR_INSECURE_LAN_ZONES 418 +#define VAR_INFRA_CACHE_MIN_RTT 419 +#define VAR_INFRA_CACHE_MAX_RTT 420 +#define VAR_INFRA_KEEP_PROBING 421 +#define VAR_DNS64_PREFIX 422 +#define VAR_DNS64_SYNTHALL 423 +#define VAR_DNS64_IGNORE_AAAA 424 +#define VAR_NAT64_PREFIX 425 +#define VAR_DNSTAP 426 +#define VAR_DNSTAP_ENABLE 427 +#define VAR_DNSTAP_SOCKET_PATH 428 +#define VAR_DNSTAP_IP 429 +#define VAR_DNSTAP_TLS 430 +#define VAR_DNSTAP_TLS_SERVER_NAME 431 +#define VAR_DNSTAP_TLS_CERT_BUNDLE 432 +#define VAR_DNSTAP_TLS_CLIENT_KEY_FILE 433 +#define VAR_DNSTAP_TLS_CLIENT_CERT_FILE 434 +#define VAR_DNSTAP_SEND_IDENTITY 435 +#define VAR_DNSTAP_SEND_VERSION 436 +#define VAR_DNSTAP_BIDIRECTIONAL 437 +#define VAR_DNSTAP_IDENTITY 438 +#define VAR_DNSTAP_VERSION 439 +#define VAR_DNSTAP_LOG_RESOLVER_QUERY_MESSAGES 440 +#define VAR_DNSTAP_LOG_RESOLVER_RESPONSE_MESSAGES 441 +#define VAR_DNSTAP_LOG_CLIENT_QUERY_MESSAGES 442 +#define VAR_DNSTAP_LOG_CLIENT_RESPONSE_MESSAGES 443 +#define VAR_DNSTAP_LOG_FORWARDER_QUERY_MESSAGES 444 +#define VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES 445 +#define VAR_RESPONSE_IP_TAG 446 +#define VAR_RESPONSE_IP 447 +#define VAR_RESPONSE_IP_DATA 448 +#define VAR_HARDEN_ALGO_DOWNGRADE 449 +#define VAR_IP_TRANSPARENT 450 +#define VAR_IP_DSCP 451 +#define VAR_DISABLE_DNSSEC_LAME_CHECK 452 +#define VAR_IP_RATELIMIT 453 +#define VAR_IP_RATELIMIT_SLABS 454 +#define VAR_IP_RATELIMIT_SIZE 455 +#define VAR_RATELIMIT 456 +#define VAR_RATELIMIT_SLABS 457 +#define VAR_RATELIMIT_SIZE 458 +#define VAR_OUTBOUND_MSG_RETRY 459 +#define VAR_MAX_SENT_COUNT 460 +#define VAR_MAX_QUERY_RESTARTS 461 +#define VAR_RATELIMIT_FOR_DOMAIN 462 +#define VAR_RATELIMIT_BELOW_DOMAIN 463 +#define VAR_IP_RATELIMIT_FACTOR 464 +#define VAR_RATELIMIT_FACTOR 465 +#define VAR_IP_RATELIMIT_BACKOFF 466 +#define VAR_RATELIMIT_BACKOFF 467 +#define VAR_SEND_CLIENT_SUBNET 468 +#define VAR_CLIENT_SUBNET_ZONE 469 +#define VAR_CLIENT_SUBNET_ALWAYS_FORWARD 470 +#define VAR_CLIENT_SUBNET_OPCODE 471 +#define VAR_MAX_CLIENT_SUBNET_IPV4 472 +#define VAR_MAX_CLIENT_SUBNET_IPV6 473 +#define VAR_MIN_CLIENT_SUBNET_IPV4 474 +#define VAR_MIN_CLIENT_SUBNET_IPV6 475 +#define VAR_MAX_ECS_TREE_SIZE_IPV4 476 +#define VAR_MAX_ECS_TREE_SIZE_IPV6 477 +#define VAR_CAPS_WHITELIST 478 +#define VAR_CACHE_MAX_NEGATIVE_TTL 479 +#define VAR_PERMIT_SMALL_HOLDDOWN 480 +#define VAR_QNAME_MINIMISATION 481 +#define VAR_QNAME_MINIMISATION_STRICT 482 +#define VAR_IP_FREEBIND 483 +#define VAR_DEFINE_TAG 484 +#define VAR_LOCAL_ZONE_TAG 485 +#define VAR_ACCESS_CONTROL_TAG 486 +#define VAR_LOCAL_ZONE_OVERRIDE 487 +#define VAR_ACCESS_CONTROL_TAG_ACTION 488 +#define VAR_ACCESS_CONTROL_TAG_DATA 489 +#define VAR_VIEW 490 +#define VAR_ACCESS_CONTROL_VIEW 491 +#define VAR_VIEW_FIRST 492 +#define VAR_SERVE_EXPIRED 493 +#define VAR_SERVE_EXPIRED_TTL 494 +#define VAR_SERVE_EXPIRED_TTL_RESET 495 +#define VAR_SERVE_EXPIRED_REPLY_TTL 496 +#define VAR_SERVE_EXPIRED_CLIENT_TIMEOUT 497 +#define VAR_EDE_SERVE_EXPIRED 498 +#define VAR_SERVE_ORIGINAL_TTL 499 +#define VAR_FAKE_DSA 500 +#define VAR_FAKE_SHA1 501 +#define VAR_LOG_IDENTITY 502 +#define VAR_HIDE_TRUSTANCHOR 503 +#define VAR_HIDE_HTTP_USER_AGENT 504 +#define VAR_HTTP_USER_AGENT 505 +#define VAR_TRUST_ANCHOR_SIGNALING 506 +#define VAR_AGGRESSIVE_NSEC 507 +#define VAR_USE_SYSTEMD 508 +#define VAR_SHM_ENABLE 509 +#define VAR_SHM_KEY 510 +#define VAR_ROOT_KEY_SENTINEL 511 +#define VAR_DNSCRYPT 512 +#define VAR_DNSCRYPT_ENABLE 513 +#define VAR_DNSCRYPT_PORT 514 +#define VAR_DNSCRYPT_PROVIDER 515 +#define VAR_DNSCRYPT_SECRET_KEY 516 +#define VAR_DNSCRYPT_PROVIDER_CERT 517 +#define VAR_DNSCRYPT_PROVIDER_CERT_ROTATED 518 +#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SIZE 519 +#define VAR_DNSCRYPT_SHARED_SECRET_CACHE_SLABS 520 +#define VAR_DNSCRYPT_NONCE_CACHE_SIZE 521 +#define VAR_DNSCRYPT_NONCE_CACHE_SLABS 522 +#define VAR_PAD_RESPONSES 523 +#define VAR_PAD_RESPONSES_BLOCK_SIZE 524 +#define VAR_PAD_QUERIES 525 +#define VAR_PAD_QUERIES_BLOCK_SIZE 526 +#define VAR_IPSECMOD_ENABLED 527 +#define VAR_IPSECMOD_HOOK 528 +#define VAR_IPSECMOD_IGNORE_BOGUS 529 +#define VAR_IPSECMOD_MAX_TTL 530 +#define VAR_IPSECMOD_WHITELIST 531 +#define VAR_IPSECMOD_STRICT 532 +#define VAR_CACHEDB 533 +#define VAR_CACHEDB_BACKEND 534 +#define VAR_CACHEDB_SECRETSEED 535 +#define VAR_CACHEDB_REDISHOST 536 +#define VAR_CACHEDB_REDISPORT 537 +#define VAR_CACHEDB_REDISTIMEOUT 538 +#define VAR_CACHEDB_REDISEXPIRERECORDS 539 +#define VAR_CACHEDB_REDISPATH 540 +#define VAR_CACHEDB_REDISPASSWORD 541 +#define VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM 542 +#define VAR_FOR_UPSTREAM 543 +#define VAR_AUTH_ZONE 544 +#define VAR_ZONEFILE 545 +#define VAR_MASTER 546 +#define VAR_URL 547 +#define VAR_FOR_DOWNSTREAM 548 +#define VAR_FALLBACK_ENABLED 549 +#define VAR_TLS_ADDITIONAL_PORT 550 +#define VAR_LOW_RTT 551 +#define VAR_LOW_RTT_PERMIL 552 +#define VAR_FAST_SERVER_PERMIL 553 +#define VAR_FAST_SERVER_NUM 554 +#define VAR_ALLOW_NOTIFY 555 +#define VAR_TLS_WIN_CERT 556 +#define VAR_TCP_CONNECTION_LIMIT 557 +#define VAR_ANSWER_COOKIE 558 +#define VAR_COOKIE_SECRET 559 +#define VAR_IP_RATELIMIT_COOKIE 560 +#define VAR_FORWARD_NO_CACHE 561 +#define VAR_STUB_NO_CACHE 562 +#define VAR_LOG_SERVFAIL 563 +#define VAR_DENY_ANY 564 +#define VAR_UNKNOWN_SERVER_TIME_LIMIT 565 +#define VAR_LOG_TAG_QUERYREPLY 566 +#define VAR_STREAM_WAIT_SIZE 567 +#define VAR_TLS_CIPHERS 568 +#define VAR_TLS_CIPHERSUITES 569 +#define VAR_TLS_USE_SNI 570 +#define VAR_IPSET 571 +#define VAR_IPSET_NAME_V4 572 +#define VAR_IPSET_NAME_V6 573 +#define VAR_TLS_SESSION_TICKET_KEYS 574 +#define VAR_RPZ 575 +#define VAR_TAGS 576 +#define VAR_RPZ_ACTION_OVERRIDE 577 +#define VAR_RPZ_CNAME_OVERRIDE 578 +#define VAR_RPZ_LOG 579 +#define VAR_RPZ_LOG_NAME 580 +#define VAR_DYNLIB 581 +#define VAR_DYNLIB_FILE 582 +#define VAR_EDNS_CLIENT_STRING 583 +#define VAR_EDNS_CLIENT_STRING_OPCODE 584 +#define VAR_NSID 585 +#define VAR_ZONEMD_PERMISSIVE_MODE 586 +#define VAR_ZONEMD_CHECK 587 +#define VAR_ZONEMD_REJECT_ABSENCE 588 +#define VAR_RPZ_SIGNAL_NXDOMAIN_RA 589 +#define VAR_INTERFACE_AUTOMATIC_PORTS 590 +#define VAR_EDE 591 +#define VAR_INTERFACE_ACTION 592 +#define VAR_INTERFACE_VIEW 593 +#define VAR_INTERFACE_TAG 594 +#define VAR_INTERFACE_TAG_ACTION 595 +#define VAR_INTERFACE_TAG_DATA 596 +#define VAR_PROXY_PROTOCOL_PORT 597 +#define VAR_STATISTICS_INHIBIT_ZERO 598 +#define VAR_HARDEN_UNKNOWN_ADDITIONAL 599 #ifndef YYSTYPE_DEFINED #define YYSTYPE_DEFINED typedef union { diff --git a/sbin/unwind/libunbound/util/configparser.y b/sbin/unwind/libunbound/util/configparser.y index 3ecdad2ad..d8f25a67e 100644 --- a/sbin/unwind/libunbound/util/configparser.y +++ b/sbin/unwind/libunbound/util/configparser.y @@ -47,6 +47,7 @@ #include "util/configyyrename.h" #include "util/config_file.h" #include "util/net_help.h" +#include "sldns/str2wire.h" int ub_c_lex(void); void ub_c_error(const char *message); @@ -73,9 +74,10 @@ extern struct config_parser_state* cfg_parser; %token VAR_FORCE_TOPLEVEL %token VAR_SERVER VAR_VERBOSITY VAR_NUM_THREADS VAR_PORT %token VAR_OUTGOING_RANGE VAR_INTERFACE VAR_PREFER_IP4 -%token VAR_DO_IP4 VAR_DO_IP6 VAR_PREFER_IP6 VAR_DO_UDP VAR_DO_TCP +%token VAR_DO_IP4 VAR_DO_IP6 VAR_DO_NAT64 VAR_PREFER_IP6 VAR_DO_UDP VAR_DO_TCP %token VAR_TCP_MSS VAR_OUTGOING_TCP_MSS VAR_TCP_IDLE_TIMEOUT %token VAR_EDNS_TCP_KEEPALIVE VAR_EDNS_TCP_KEEPALIVE_TIMEOUT +%token VAR_SOCK_QUEUE_TIMEOUT %token VAR_CHROOT VAR_USERNAME VAR_DIRECTORY VAR_LOGFILE VAR_PIDFILE %token VAR_MSG_CACHE_SIZE VAR_MSG_CACHE_SLABS VAR_NUM_QUERIES_PER_THREAD %token VAR_RRSET_CACHE_SIZE VAR_RRSET_CACHE_SLABS VAR_OUTGOING_NUM_TCP @@ -123,6 +125,7 @@ extern struct config_parser_state* cfg_parser; %token VAR_UNBLOCK_LAN_ZONES VAR_INSECURE_LAN_ZONES %token VAR_INFRA_CACHE_MIN_RTT VAR_INFRA_CACHE_MAX_RTT VAR_INFRA_KEEP_PROBING %token VAR_DNS64_PREFIX VAR_DNS64_SYNTHALL VAR_DNS64_IGNORE_AAAA +%token VAR_NAT64_PREFIX %token VAR_DNSTAP VAR_DNSTAP_ENABLE VAR_DNSTAP_SOCKET_PATH VAR_DNSTAP_IP %token VAR_DNSTAP_TLS VAR_DNSTAP_TLS_SERVER_NAME VAR_DNSTAP_TLS_CERT_BUNDLE %token VAR_DNSTAP_TLS_CLIENT_KEY_FILE VAR_DNSTAP_TLS_CLIENT_CERT_FILE @@ -140,7 +143,7 @@ extern struct config_parser_state* cfg_parser; %token VAR_DISABLE_DNSSEC_LAME_CHECK %token VAR_IP_RATELIMIT VAR_IP_RATELIMIT_SLABS VAR_IP_RATELIMIT_SIZE %token VAR_RATELIMIT VAR_RATELIMIT_SLABS VAR_RATELIMIT_SIZE -%token VAR_OUTBOUND_MSG_RETRY +%token VAR_OUTBOUND_MSG_RETRY VAR_MAX_SENT_COUNT VAR_MAX_QUERY_RESTARTS %token VAR_RATELIMIT_FOR_DOMAIN VAR_RATELIMIT_BELOW_DOMAIN %token VAR_IP_RATELIMIT_FACTOR VAR_RATELIMIT_FACTOR %token VAR_IP_RATELIMIT_BACKOFF VAR_RATELIMIT_BACKOFF @@ -175,12 +178,13 @@ extern struct config_parser_state* cfg_parser; %token VAR_IPSECMOD_MAX_TTL VAR_IPSECMOD_WHITELIST VAR_IPSECMOD_STRICT %token VAR_CACHEDB VAR_CACHEDB_BACKEND VAR_CACHEDB_SECRETSEED %token VAR_CACHEDB_REDISHOST VAR_CACHEDB_REDISPORT VAR_CACHEDB_REDISTIMEOUT -%token VAR_CACHEDB_REDISEXPIRERECORDS +%token VAR_CACHEDB_REDISEXPIRERECORDS VAR_CACHEDB_REDISPATH VAR_CACHEDB_REDISPASSWORD %token VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM VAR_FOR_UPSTREAM %token VAR_AUTH_ZONE VAR_ZONEFILE VAR_MASTER VAR_URL VAR_FOR_DOWNSTREAM %token VAR_FALLBACK_ENABLED VAR_TLS_ADDITIONAL_PORT VAR_LOW_RTT VAR_LOW_RTT_PERMIL %token VAR_FAST_SERVER_PERMIL VAR_FAST_SERVER_NUM %token VAR_ALLOW_NOTIFY VAR_TLS_WIN_CERT VAR_TCP_CONNECTION_LIMIT +%token VAR_ANSWER_COOKIE VAR_COOKIE_SECRET VAR_IP_RATELIMIT_COOKIE %token VAR_FORWARD_NO_CACHE VAR_STUB_NO_CACHE VAR_LOG_SERVFAIL VAR_DENY_ANY %token VAR_UNKNOWN_SERVER_TIME_LIMIT VAR_LOG_TAG_QUERYREPLY %token VAR_STREAM_WAIT_SIZE VAR_TLS_CIPHERS VAR_TLS_CIPHERSUITES VAR_TLS_USE_SNI @@ -193,7 +197,8 @@ extern struct config_parser_state* cfg_parser; %token VAR_RPZ_SIGNAL_NXDOMAIN_RA VAR_INTERFACE_AUTOMATIC_PORTS VAR_EDE %token VAR_INTERFACE_ACTION VAR_INTERFACE_VIEW VAR_INTERFACE_TAG %token VAR_INTERFACE_TAG_ACTION VAR_INTERFACE_TAG_DATA -%token VAR_PROXY_PROTOCOL_PORT +%token VAR_PROXY_PROTOCOL_PORT VAR_STATISTICS_INHIBIT_ZERO +%token VAR_HARDEN_UNKNOWN_ADDITIONAL %% toplevelvars: /* empty */ | toplevelvars toplevelvar ; @@ -222,10 +227,11 @@ contents_server: contents_server content_server | ; content_server: server_num_threads | server_verbosity | server_port | server_outgoing_range | server_do_ip4 | - server_do_ip6 | server_prefer_ip4 | server_prefer_ip6 | - server_do_udp | server_do_tcp | + server_do_ip6 | server_do_nat64 | server_prefer_ip4 | + server_prefer_ip6 | server_do_udp | server_do_tcp | server_tcp_mss | server_outgoing_tcp_mss | server_tcp_idle_timeout | server_tcp_keepalive | server_tcp_keepalive_timeout | + server_sock_queue_timeout | server_interface | server_chroot | server_username | server_directory | server_logfile | server_pidfile | server_msg_cache_size | server_msg_cache_slabs | @@ -273,6 +279,7 @@ content_server: server_num_threads | server_verbosity | server_port | server_so_reuseport | server_delay_close | server_udp_connect | server_unblock_lan_zones | server_insecure_lan_zones | server_dns64_prefix | server_dns64_synthall | server_dns64_ignore_aaaa | + server_nat64_prefix | server_infra_cache_min_rtt | server_infra_cache_max_rtt | server_harden_algo_downgrade | server_ip_transparent | server_ip_ratelimit | server_ratelimit | server_ip_dscp | server_infra_keep_probing | @@ -282,6 +289,7 @@ content_server: server_num_threads | server_verbosity | server_port | server_ratelimit_below_domain | server_ratelimit_factor | server_ip_ratelimit_factor | server_ratelimit_backoff | server_ip_ratelimit_backoff | server_outbound_msg_retry | + server_max_sent_count | server_max_query_restarts | server_send_client_subnet | server_client_subnet_zone | server_client_subnet_always_forward | server_client_subnet_opcode | server_max_client_subnet_ipv4 | server_max_client_subnet_ipv6 | @@ -301,7 +309,7 @@ content_server: server_num_threads | server_verbosity | server_port | server_serve_expired | server_serve_expired_ttl | server_serve_expired_ttl_reset | server_serve_expired_reply_ttl | server_serve_expired_client_timeout | - server_ede_serve_expired | server_serve_original_ttl | server_fake_dsa | + server_ede_serve_expired | server_serve_original_ttl | server_fake_dsa | server_log_identity | server_use_systemd | server_response_ip_tag | server_response_ip | server_response_ip_data | server_shm_enable | server_shm_key | server_fake_sha1 | @@ -317,12 +325,14 @@ content_server: server_num_threads | server_verbosity | server_port | server_unknown_server_time_limit | server_log_tag_queryreply | server_stream_wait_size | server_tls_ciphers | server_tls_ciphersuites | server_tls_session_ticket_keys | + server_answer_cookie | server_cookie_secret | server_ip_ratelimit_cookie | server_tls_use_sni | server_edns_client_string | server_edns_client_string_opcode | server_nsid | server_zonemd_permissive_mode | server_max_reuse_tcp_queries | server_tcp_reuse_timeout | server_tcp_auth_query_timeout | server_interface_automatic_ports | server_ede | - server_proxy_protocol_port + server_proxy_protocol_port | server_statistics_inhibit_zero | + server_harden_unknown_additional ; stubstart: VAR_STUB_ZONE { @@ -485,7 +495,7 @@ rpz_signal_nxdomain_ra: VAR_RPZ_SIGNAL_NXDOMAIN_RA STRING_ARG rpzstart: VAR_RPZ { struct config_auth* s; - OUTYY(("\nP(rpz:)\n")); + OUTYY(("\nP(rpz:)\n")); cfg_parser->started_toplevel = 1; s = (struct config_auth*)calloc(1, sizeof(struct config_auth)); if(s) { @@ -501,7 +511,7 @@ rpzstart: VAR_RPZ } } ; -contents_rpz: contents_rpz content_rpz +contents_rpz: contents_rpz content_rpz | ; content_rpz: auth_name | auth_zonefile | rpz_tag | auth_master | auth_url | auth_allow_notify | rpz_action_override | rpz_cname_override | @@ -554,6 +564,15 @@ server_extended_statistics: VAR_EXTENDED_STATISTICS STRING_ARG free($2); } ; +server_statistics_inhibit_zero: VAR_STATISTICS_INHIBIT_ZERO STRING_ARG + { + OUTYY(("P(server_statistics_inhibit_zero:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->stat_inhibit_zero = (strcmp($2, "yes")==0); + free($2); + } + ; server_shm_enable: VAR_SHM_ENABLE STRING_ARG { OUTYY(("P(server_shm_enable:%s)\n", $2)); @@ -840,6 +859,15 @@ server_do_ip6: VAR_DO_IP6 STRING_ARG free($2); } ; +server_do_nat64: VAR_DO_NAT64 STRING_ARG + { + OUTYY(("P(server_do_nat64:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->do_nat64 = (strcmp($2, "yes")==0); + free($2); + } + ; server_do_udp: VAR_DO_UDP STRING_ARG { OUTYY(("P(server_do_udp:%s)\n", $2)); @@ -962,6 +990,19 @@ server_tcp_keepalive_timeout: VAR_EDNS_TCP_KEEPALIVE_TIMEOUT STRING_ARG free($2); } ; +server_sock_queue_timeout: VAR_SOCK_QUEUE_TIMEOUT STRING_ARG + { + OUTYY(("P(server_sock_queue_timeout:%s)\n", $2)); + if(atoi($2) == 0 && strcmp($2, "0") != 0) + yyerror("number expected"); + else if (atoi($2) > 6553500) + cfg_parser->cfg->sock_queue_timeout = 6553500; + else if (atoi($2) < 1) + cfg_parser->cfg->sock_queue_timeout = 0; + else cfg_parser->cfg->sock_queue_timeout = atoi($2); + free($2); + } + ; server_tcp_upstream: VAR_TCP_UPSTREAM STRING_ARG { OUTYY(("P(server_tcp_upstream:%s)\n", $2)); @@ -1122,7 +1163,7 @@ server_http_nodelay: VAR_HTTP_NODELAY STRING_ARG yyerror("expected yes or no."); else cfg_parser->cfg->http_nodelay = (strcmp($2, "yes")==0); free($2); - } + }; server_http_notls_downstream: VAR_HTTP_NOTLS_DOWNSTREAM STRING_ARG { OUTYY(("P(server_http_notls_downstream:%s)\n", $2)); @@ -1768,6 +1809,16 @@ server_harden_algo_downgrade: VAR_HARDEN_ALGO_DOWNGRADE STRING_ARG free($2); } ; +server_harden_unknown_additional: VAR_HARDEN_UNKNOWN_ADDITIONAL STRING_ARG + { + OUTYY(("P(server_harden_unknown_additional:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->harden_unknown_additional = + (strcmp($2, "yes")==0); + free($2); + } + ; server_use_caps_for_id: VAR_USE_CAPS_FOR_ID STRING_ARG { OUTYY(("P(server_use_caps_for_id:%s)\n", $2)); @@ -2159,6 +2210,7 @@ server_permit_small_holddown: VAR_PERMIT_SMALL_HOLDDOWN STRING_ARG (strcmp($2, "yes")==0); free($2); } + ; server_key_cache_size: VAR_KEY_CACHE_SIZE STRING_ARG { OUTYY(("P(server_key_cache_size:%s)\n", $2)); @@ -2196,6 +2248,7 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG strcmp($3, "transparent")!=0 && strcmp($3, "nodefault")!=0 && strcmp($3, "typetransparent")!=0 && strcmp($3, "always_transparent")!=0 + && strcmp($3, "block_a")!=0 && strcmp($3, "always_refuse")!=0 && strcmp($3, "always_nxdomain")!=0 && strcmp($3, "always_nodata")!=0 @@ -2208,7 +2261,7 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG yyerror("local-zone type: expected static, deny, " "refuse, redirect, transparent, " "typetransparent, inform, inform_deny, " - "inform_redirect, always_transparent, " + "inform_redirect, always_transparent, block_a," "always_refuse, always_nxdomain, " "always_nodata, always_deny, always_null, " "noview, nodefault or ipset"); @@ -2323,6 +2376,13 @@ server_dns64_ignore_aaaa: VAR_DNS64_IGNORE_AAAA STRING_ARG fatal_exit("out of memory adding dns64-ignore-aaaa"); } ; +server_nat64_prefix: VAR_NAT64_PREFIX STRING_ARG + { + OUTYY(("P(nat64_prefix:%s)\n", $2)); + free(cfg_parser->cfg->nat64_prefix); + cfg_parser->cfg->nat64_prefix = $2; + } + ; server_define_tag: VAR_DEFINE_TAG STRING_ARG { char* p, *s = $2; @@ -2508,6 +2568,15 @@ server_ip_ratelimit: VAR_IP_RATELIMIT STRING_ARG free($2); } ; +server_ip_ratelimit_cookie: VAR_IP_RATELIMIT_COOKIE STRING_ARG + { + OUTYY(("P(server_ip_ratelimit_cookie:%s)\n", $2)); + if(atoi($2) == 0 && strcmp($2, "0") != 0) + yyerror("number expected"); + else cfg_parser->cfg->ip_ratelimit_cookie = atoi($2); + free($2); + } + ; server_ratelimit: VAR_RATELIMIT STRING_ARG { OUTYY(("P(server_ratelimit:%s)\n", $2)); @@ -2636,6 +2705,24 @@ server_outbound_msg_retry: VAR_OUTBOUND_MSG_RETRY STRING_ARG free($2); } ; +server_max_sent_count: VAR_MAX_SENT_COUNT STRING_ARG + { + OUTYY(("P(server_max_sent_count:%s)\n", $2)); + if(atoi($2) == 0 && strcmp($2, "0") != 0) + yyerror("number expected"); + else cfg_parser->cfg->max_sent_count = atoi($2); + free($2); + } + ; +server_max_query_restarts: VAR_MAX_QUERY_RESTARTS STRING_ARG + { + OUTYY(("P(server_max_query_restarts:%s)\n", $2)); + if(atoi($2) == 0 && strcmp($2, "0") != 0) + yyerror("number expected"); + else cfg_parser->cfg->max_query_restarts = atoi($2); + free($2); + } + ; server_low_rtt: VAR_LOW_RTT STRING_ARG { OUTYY(("P(low-rtt option is deprecated, use fast-server-num instead)\n")); @@ -2685,7 +2772,7 @@ server_pad_responses: VAR_PAD_RESPONSES STRING_ARG OUTYY(("P(server_pad_responses:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->pad_responses = + else cfg_parser->cfg->pad_responses = (strcmp($2, "yes")==0); free($2); } @@ -2704,7 +2791,7 @@ server_pad_queries: VAR_PAD_QUERIES STRING_ARG OUTYY(("P(server_pad_queries:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); - else cfg_parser->cfg->pad_queries = + else cfg_parser->cfg->pad_queries = (strcmp($2, "yes")==0); free($2); } @@ -3443,9 +3530,10 @@ py_script: VAR_PYTHON_SCRIPT STRING_ARG if(!cfg_strlist_append_ex(&cfg_parser->cfg->python_script, $2)) yyerror("out of memory"); } + ; dynlibstart: VAR_DYNLIB - { - OUTYY(("\nP(dynlib:)\n")); + { + OUTYY(("\nP(dynlib:)\n")); cfg_parser->started_toplevel = 1; } ; @@ -3459,6 +3547,7 @@ dl_file: VAR_DYNLIB_FILE STRING_ARG if(!cfg_strlist_append_ex(&cfg_parser->cfg->dynlib_file, $2)) yyerror("out of memory"); } + ; server_disable_dnssec_lame_check: VAR_DISABLE_DNSSEC_LAME_CHECK STRING_ARG { OUTYY(("P(disable_dnssec_lame_check:%s)\n", $2)); @@ -3519,7 +3608,6 @@ dnsc_dnscrypt_enable: VAR_DNSCRYPT_ENABLE STRING_ARG free($2); } ; - dnsc_dnscrypt_port: VAR_DNSCRYPT_PORT STRING_ARG { OUTYY(("P(dnsc_dnscrypt_port:%s)\n", $2)); @@ -3613,7 +3701,7 @@ contents_cachedb: contents_cachedb content_cachedb | ; content_cachedb: cachedb_backend_name | cachedb_secret_seed | redis_server_host | redis_server_port | redis_timeout | - redis_expire_records + redis_expire_records | redis_server_path | redis_server_password ; cachedb_backend_name: VAR_CACHEDB_BACKEND STRING_ARG { @@ -3666,6 +3754,30 @@ redis_server_port: VAR_CACHEDB_REDISPORT STRING_ARG free($2); } ; +redis_server_path: VAR_CACHEDB_REDISPATH STRING_ARG + { + #if defined(USE_CACHEDB) && defined(USE_REDIS) + OUTYY(("P(redis_server_path:%s)\n", $2)); + free(cfg_parser->cfg->redis_server_path); + cfg_parser->cfg->redis_server_path = $2; + #else + OUTYY(("P(Compiled without cachedb or redis, ignoring)\n")); + free($2); + #endif + } + ; +redis_server_password: VAR_CACHEDB_REDISPASSWORD STRING_ARG + { + #if defined(USE_CACHEDB) && defined(USE_REDIS) + OUTYY(("P(redis_server_password:%s)\n", $2)); + free(cfg_parser->cfg->redis_server_password); + cfg_parser->cfg->redis_server_password = $2; + #else + OUTYY(("P(Compiled without cachedb or redis, ignoring)\n")); + free($2); + #endif + } + ; redis_timeout: VAR_CACHEDB_REDISTIMEOUT STRING_ARG { #if defined(USE_CACHEDB) && defined(USE_REDIS) @@ -3703,6 +3815,31 @@ server_tcp_connection_limit: VAR_TCP_CONNECTION_LIMIT STRING_ARG STRING_ARG } } ; +server_answer_cookie: VAR_ANSWER_COOKIE STRING_ARG + { + OUTYY(("P(server_answer_cookie:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->do_answer_cookie = (strcmp($2, "yes")==0); + free($2); + } + ; +server_cookie_secret: VAR_COOKIE_SECRET STRING_ARG + { + uint8_t secret[32]; + size_t secret_len = sizeof(secret); + + OUTYY(("P(server_cookie_secret:%s)\n", $2)); + if(sldns_str2wire_hex_buf($2, secret, &secret_len) + || (secret_len != 16)) + yyerror("expected 128 bit hex string"); + else { + cfg_parser->cfg->cookie_secret_len = secret_len; + memcpy(cfg_parser->cfg->cookie_secret, secret, sizeof(secret)); + } + free($2); + } + ; ipsetstart: VAR_IPSET { OUTYY(("\nP(ipset:)\n")); @@ -3772,10 +3909,11 @@ validate_acl_action(const char* action) strcmp(action, "refuse_non_local")!=0 && strcmp(action, "allow_setrd")!=0 && strcmp(action, "allow")!=0 && - strcmp(action, "allow_snoop")!=0) + strcmp(action, "allow_snoop")!=0 && + strcmp(action, "allow_cookie")!=0) { yyerror("expected deny, refuse, deny_non_local, " - "refuse_non_local, allow, allow_setrd or " - "allow_snoop as access control action"); + "refuse_non_local, allow, allow_setrd, " + "allow_snoop or allow_cookie as access control action"); } } diff --git a/sbin/unwind/libunbound/util/data/msgencode.c b/sbin/unwind/libunbound/util/data/msgencode.c index fe21cfb86..a170eb7b8 100644 --- a/sbin/unwind/libunbound/util/data/msgencode.c +++ b/sbin/unwind/libunbound/util/data/msgencode.c @@ -806,6 +806,95 @@ calc_edns_field_size(struct edns_data* edns) return 1 + 2 + 2 + 4 + 2 + rdatalen; } +uint16_t +calc_edns_option_size(struct edns_data* edns, uint16_t code) +{ + size_t rdatalen = 0; + struct edns_option* opt; + if(!edns || !edns->edns_present) + return 0; + for(opt = edns->opt_list_inplace_cb_out; opt; opt = opt->next) { + if(opt->opt_code == code) + rdatalen += 4 + opt->opt_len; + } + for(opt = edns->opt_list_out; opt; opt = opt->next) { + if(opt->opt_code == code) + rdatalen += 4 + opt->opt_len; + } + return rdatalen; +} + +uint16_t +calc_ede_option_size(struct edns_data* edns, uint16_t* txt_size) +{ + size_t rdatalen = 0; + struct edns_option* opt; + *txt_size = 0; + if(!edns || !edns->edns_present) + return 0; + for(opt = edns->opt_list_inplace_cb_out; opt; opt = opt->next) { + if(opt->opt_code == LDNS_EDNS_EDE) { + rdatalen += 4 + opt->opt_len; + if(opt->opt_len > 2) *txt_size += opt->opt_len - 2; + if(opt->opt_len >= 2 && sldns_read_uint16( + opt->opt_data) == LDNS_EDE_OTHER) { + *txt_size += 4 + 2; + } + } + } + for(opt = edns->opt_list_out; opt; opt = opt->next) { + if(opt->opt_code == LDNS_EDNS_EDE) { + rdatalen += 4 + opt->opt_len; + if(opt->opt_len > 2) *txt_size += opt->opt_len - 2; + if(opt->opt_len >= 2 && sldns_read_uint16( + opt->opt_data) == LDNS_EDE_OTHER) { + *txt_size += 4 + 2; + } + } + } + return rdatalen; +} + +/* Trims the EDE OPTION-DATA to not include any EXTRA-TEXT data. + * Also removes any LDNS_EDE_OTHER options from the list since they are useless + * without the extra text. */ +static void +ede_trim_text(struct edns_option** list) +{ + struct edns_option* curr, *prev = NULL; + if(!list || !(*list)) return; + /* Unlink and repoint if LDNS_EDE_OTHER are first in list */ + while(list && *list && (*list)->opt_code == LDNS_EDNS_EDE + && (*list)->opt_len >= 2 + && sldns_read_uint16((*list)->opt_data) == LDNS_EDE_OTHER ) { + *list = (*list)->next; + } + if(!list || !(*list)) return; + curr = *list; + while(curr) { + if(curr->opt_code == LDNS_EDNS_EDE) { + if(curr->opt_len >= 2 && sldns_read_uint16( + curr->opt_data) == LDNS_EDE_OTHER) { + /* LDNS_EDE_OTHER cannot be the first option in + * this while, so prev is always initialized at + * this point from the other branches; + * cut this option off */ + prev->next = curr->next; + curr = curr->next; + } else if(curr->opt_len > 2) { + /* trim this option's EXTRA-TEXT */ + curr->opt_len = 2; + prev = curr; + curr = curr->next; + } + } else { + /* continue */ + prev = curr; + curr = curr->next; + } + } +} + static void attach_edns_record_max_msg_sz(sldns_buffer* pkt, struct edns_data* edns, uint16_t max_msg_sz) @@ -894,6 +983,7 @@ reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep, { uint16_t flags; unsigned int attach_edns = 0; + uint16_t edns_field_size, ede_size, ede_txt_size; if(!cached || rep->authoritative) { /* original flags, copy RD and CD bits from query. */ @@ -916,25 +1006,39 @@ reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep, log_assert(flags & BIT_QR); /* QR bit must be on in our replies */ if(udpsize < LDNS_HEADER_SIZE) return 0; + /* currently edns does not change during calculations; + * calculate sizes once here */ + edns_field_size = calc_edns_field_size(edns); + ede_size = calc_ede_option_size(edns, &ede_txt_size); if(sldns_buffer_capacity(pkt) < udpsize) udpsize = sldns_buffer_capacity(pkt); - if(udpsize < LDNS_HEADER_SIZE + calc_edns_field_size(edns)) { + /* EDEs are optional, try to fit anything else before them */ + if(udpsize < LDNS_HEADER_SIZE + edns_field_size - ede_size) { /* packet too small to contain edns, omit it. */ attach_edns = 0; } else { /* reserve space for edns record */ - attach_edns = (unsigned int)calc_edns_field_size(edns); - udpsize -= attach_edns; + attach_edns = (unsigned int)edns_field_size - ede_size; } if(!reply_info_encode(qinf, rep, id, flags, pkt, timenow, region, - udpsize, dnssec, MINIMAL_RESPONSES)) { + udpsize - attach_edns, dnssec, MINIMAL_RESPONSES)) { log_err("reply encode: out of memory"); return 0; } - if(attach_edns && sldns_buffer_capacity(pkt) >= - sldns_buffer_limit(pkt)+attach_edns) - attach_edns_record_max_msg_sz(pkt, edns, udpsize+attach_edns); + if(attach_edns) { + if(udpsize >= sldns_buffer_limit(pkt) + edns_field_size) + attach_edns_record_max_msg_sz(pkt, edns, udpsize); + else if(udpsize >= sldns_buffer_limit(pkt) + edns_field_size - ede_txt_size) { + ede_trim_text(&edns->opt_list_inplace_cb_out); + ede_trim_text(&edns->opt_list_out); + attach_edns_record_max_msg_sz(pkt, edns, udpsize); + } else if(udpsize >= sldns_buffer_limit(pkt) + edns_field_size - ede_size) { + edns_opt_list_remove(&edns->opt_list_inplace_cb_out, LDNS_EDNS_EDE); + edns_opt_list_remove(&edns->opt_list_out, LDNS_EDNS_EDE); + attach_edns_record_max_msg_sz(pkt, edns, udpsize); + } + } return 1; } @@ -958,15 +1062,17 @@ qinfo_query_encode(sldns_buffer* pkt, struct query_info* qinfo) sldns_buffer_flip(pkt); } -void -error_encode(sldns_buffer* buf, int r, struct query_info* qinfo, - uint16_t qid, uint16_t qflags, struct edns_data* edns) +void +extended_error_encode(sldns_buffer* buf, uint16_t rcode, + struct query_info* qinfo, uint16_t qid, uint16_t qflags, + uint16_t xflags, struct edns_data* edns) { uint16_t flags; sldns_buffer_clear(buf); sldns_buffer_write(buf, &qid, sizeof(uint16_t)); - flags = (uint16_t)(BIT_QR | BIT_RA | r); /* QR and retcode*/ + flags = (uint16_t)(BIT_QR | BIT_RA | (rcode & 0xF)); /* QR and retcode*/ + flags |= xflags; flags |= (qflags & (BIT_RD|BIT_CD)); /* copy RD and CD bit */ sldns_buffer_write_u16(buf, flags); if(qinfo) flags = 1; @@ -993,11 +1099,25 @@ error_encode(sldns_buffer* buf, int r, struct query_info* qinfo, struct edns_data es = *edns; es.edns_version = EDNS_ADVERTISED_VERSION; es.udp_size = EDNS_ADVERTISED_SIZE; - es.ext_rcode = 0; + es.ext_rcode = (uint8_t)(rcode >> 4); es.bits &= EDNS_DO; if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) > - edns->udp_size) - return; + edns->udp_size) { + edns_opt_list_remove(&es.opt_list_inplace_cb_out, LDNS_EDNS_EDE); + edns_opt_list_remove(&es.opt_list_out, LDNS_EDNS_EDE); + if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) > + edns->udp_size) { + return; + } + } attach_edns_record(buf, &es); } } + +void +error_encode(sldns_buffer* buf, int r, struct query_info* qinfo, + uint16_t qid, uint16_t qflags, struct edns_data* edns) +{ + extended_error_encode(buf, (r & 0x000F), qinfo, qid, qflags, + (r & 0xFFF0), edns); +} diff --git a/sbin/unwind/libunbound/util/data/msgencode.h b/sbin/unwind/libunbound/util/data/msgencode.h index 30dc515cb..6aff06099 100644 --- a/sbin/unwind/libunbound/util/data/msgencode.h +++ b/sbin/unwind/libunbound/util/data/msgencode.h @@ -108,6 +108,27 @@ void qinfo_query_encode(struct sldns_buffer* pkt, struct query_info* qinfo); */ uint16_t calc_edns_field_size(struct edns_data* edns); +/** + * Calculate the size of a specific EDNS option in packet. + * @param edns: edns data or NULL. + * @param code: the opt code to get the size of. + * @return octets the option will take up. + */ +uint16_t calc_edns_option_size(struct edns_data* edns, uint16_t code); + +/** + * Calculate the size of the EDE option(s) in packet. Also calculate seperately + * the size of the EXTRA-TEXT field(s) in case we can trim them to fit. + * In this case include any LDNS_EDE_OTHER options in their entirety since they + * are useless without extra text. + * @param edns: edns data or NULL. + * @param txt_size: the size of the EXTRA-TEXT field(s); this includes + * LDNS_EDE_OTHER in their entirety since they are useless without + * extra text. + * @return octets the option will take up. + */ +uint16_t calc_ede_option_size(struct edns_data* edns, uint16_t* txt_size); + /** * Attach EDNS record to buffer. Buffer has complete packet. There must * be enough room left for the EDNS record. @@ -116,11 +137,11 @@ uint16_t calc_edns_field_size(struct edns_data* edns); */ void attach_edns_record(struct sldns_buffer* pkt, struct edns_data* edns); -/** +/** * Encode an error. With QR and RA set. * * @param pkt: where to store the packet. - * @param r: RCODE value to encode. + * @param r: RCODE value to encode (may contain extra flags). * @param qinfo: if not NULL, the query is included. * @param qid: query ID to set in packet. network order. * @param qflags: original query flags (to copy RD and CD bits). host order. @@ -130,4 +151,21 @@ void attach_edns_record(struct sldns_buffer* pkt, struct edns_data* edns); void error_encode(struct sldns_buffer* pkt, int r, struct query_info* qinfo, uint16_t qid, uint16_t qflags, struct edns_data* edns); +/** + * Encode an extended error. With QR and RA set. + * + * @param pkt: where to store the packet. + * @param rcode: Extended RCODE value to encode. + * @param qinfo: if not NULL, the query is included. + * @param qid: query ID to set in packet. network order. + * @param qflags: original query flags (to copy RD and CD bits). host order. + * @param xflags: extra flags to set (such as for example BIT_AA and/or BIT_TC) + * @param edns: if not NULL, this is the query edns info, + * and an edns reply is attached. Only attached if EDNS record fits reply. + * Without edns extended errors (i.e. > 15) will not be conveyed. + */ +void extended_error_encode(struct sldns_buffer* pkt, uint16_t rcode, + struct query_info* qinfo, uint16_t qid, uint16_t qflags, + uint16_t xflags, struct edns_data* edns); + #endif /* UTIL_DATA_MSGENCODE_H */ diff --git a/sbin/unwind/libunbound/util/data/msgparse.c b/sbin/unwind/libunbound/util/data/msgparse.c index 5bb69d6ed..b5414c6d0 100644 --- a/sbin/unwind/libunbound/util/data/msgparse.c +++ b/sbin/unwind/libunbound/util/data/msgparse.c @@ -45,6 +45,8 @@ #include "util/netevent.h" #include "util/storage/lookup3.h" #include "util/regional.h" +#include "util/rfc_1982.h" +#include "util/edns.h" #include "sldns/rrdef.h" #include "sldns/sbuffer.h" #include "sldns/parseutil.h" @@ -940,22 +942,11 @@ parse_packet(sldns_buffer* pkt, struct msg_parse* msg, struct regional* region) return 0; } -static int -edns_opt_list_append_keepalive(struct edns_option** list, int msec, - struct regional* region) -{ - uint8_t data[2]; /* For keepalive value */ - data[0] = (uint8_t)((msec >> 8) & 0xff); - data[1] = (uint8_t)(msec & 0xff); - return edns_opt_list_append(list, LDNS_EDNS_KEEPALIVE, sizeof(data), - data, region); -} - /** parse EDNS options from EDNS wireformat rdata */ static int parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len, struct edns_data* edns, struct config_file* cfg, struct comm_point* c, - struct regional* region) + struct comm_reply* repinfo, uint32_t now, struct regional* region) { /* To respond with a Keepalive option, the client connection must have * received one message with a TCP Keepalive EDNS option, and that @@ -979,6 +970,10 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len, while(rdata_len >= 4) { uint16_t opt_code = sldns_read_uint16(rdata_ptr); uint16_t opt_len = sldns_read_uint16(rdata_ptr+2); + uint8_t server_cookie[40]; + enum edns_cookie_val_status cookie_val_status; + int cookie_is_v4 = 1; + rdata_ptr += 4; rdata_len -= 4; if(opt_len > rdata_len) @@ -1041,6 +1036,76 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len, edns->padding_block_size = cfg->pad_responses_block_size; break; + case LDNS_EDNS_COOKIE: + if(!cfg || !cfg->do_answer_cookie || !repinfo) + break; + if(opt_len != 8 && (opt_len < 16 || opt_len > 40)) { + verbose(VERB_ALGO, "worker request: " + "badly formatted cookie"); + return LDNS_RCODE_FORMERR; + } + edns->cookie_present = 1; + + /* Copy client cookie, version and timestamp for + * validation and creation purposes. + */ + if(opt_len >= 16) { + memmove(server_cookie, rdata_ptr, 16); + } else { + memset(server_cookie, 0, 16); + memmove(server_cookie, rdata_ptr, opt_len); + } + + /* Copy client ip for validation and creation + * purposes. It will be overwritten if (re)creation + * is needed. + */ + if(repinfo->remote_addr.ss_family == AF_INET) { + memcpy(server_cookie + 16, + &((struct sockaddr_in*)&repinfo->remote_addr)->sin_addr, 4); + } else { + cookie_is_v4 = 0; + memcpy(server_cookie + 16, + &((struct sockaddr_in6*)&repinfo->remote_addr)->sin6_addr, 16); + } + + cookie_val_status = edns_cookie_server_validate( + rdata_ptr, opt_len, cfg->cookie_secret, + cfg->cookie_secret_len, cookie_is_v4, + server_cookie, now); + switch(cookie_val_status) { + case COOKIE_STATUS_VALID: + case COOKIE_STATUS_VALID_RENEW: + edns->cookie_valid = 1; + /* Reuse cookie */ + if(!edns_opt_list_append( + &edns->opt_list_out, LDNS_EDNS_COOKIE, + opt_len, rdata_ptr, region)) { + log_err("out of memory"); + return LDNS_RCODE_SERVFAIL; + } + /* Cookie to be reused added to outgoing + * options. Done! + */ + break; + case COOKIE_STATUS_CLIENT_ONLY: + edns->cookie_client = 1; + /* fallthrough */ + case COOKIE_STATUS_FUTURE: + case COOKIE_STATUS_EXPIRED: + case COOKIE_STATUS_INVALID: + default: + edns_cookie_server_write(server_cookie, + cfg->cookie_secret, cookie_is_v4, now); + if(!edns_opt_list_append(&edns->opt_list_out, + LDNS_EDNS_COOKIE, 24, server_cookie, + region)) { + log_err("out of memory"); + return LDNS_RCODE_SERVFAIL; + } + break; + } + break; default: break; } @@ -1115,6 +1180,8 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg, edns->opt_list_out = NULL; edns->opt_list_inplace_cb_out = NULL; edns->padding_block_size = 0; + edns->cookie_present = 0; + edns->cookie_valid = 0; /* take the options */ rdata_len = found->rr_first->size-2; @@ -1170,7 +1237,8 @@ skip_pkt_rrs(sldns_buffer* pkt, int num) int parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns, - struct config_file* cfg, struct comm_point* c, struct regional* region) + struct config_file* cfg, struct comm_point* c, + struct comm_reply* repinfo, time_t now, struct regional* region) { size_t rdata_len; uint8_t* rdata_ptr; @@ -1206,6 +1274,8 @@ parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns, edns->opt_list_out = NULL; edns->opt_list_inplace_cb_out = NULL; edns->padding_block_size = 0; + edns->cookie_present = 0; + edns->cookie_valid = 0; /* take the options */ rdata_len = sldns_buffer_read_u16(pkt); @@ -1214,7 +1284,7 @@ parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns, rdata_ptr = sldns_buffer_current(pkt); /* ignore rrsigs */ return parse_edns_options_from_query(rdata_ptr, rdata_len, edns, cfg, - c, region); + c, repinfo, now, region); } void diff --git a/sbin/unwind/libunbound/util/data/msgparse.h b/sbin/unwind/libunbound/util/data/msgparse.h index 0c458e6e8..b7dc235d6 100644 --- a/sbin/unwind/libunbound/util/data/msgparse.h +++ b/sbin/unwind/libunbound/util/data/msgparse.h @@ -72,6 +72,7 @@ struct regional; struct edns_option; struct config_file; struct comm_point; +struct comm_reply; /** number of buckets in parse rrset hash table. Must be power of 2. */ #define PARSE_TABLE_SIZE 32 @@ -217,8 +218,6 @@ struct rr_parse { * region. */ struct edns_data { - /** if EDNS OPT record was present */ - int edns_present; /** Extended RCODE */ uint8_t ext_rcode; /** The EDNS version number */ @@ -238,7 +237,15 @@ struct edns_data { struct edns_option* opt_list_inplace_cb_out; /** block size to pad */ uint16_t padding_block_size; -}; + /** if EDNS OPT record was present */ + unsigned int edns_present : 1; + /** if a cookie was present */ + unsigned int cookie_present : 1; + /** if the cookie validated */ + unsigned int cookie_valid : 1; + /** if the cookie holds only the client part */ + unsigned int cookie_client : 1; +}; /** * EDNS option @@ -310,12 +317,15 @@ int skip_pkt_rrs(struct sldns_buffer* pkt, int num); * initialised. * @param cfg: the configuration (with nsid value etc.) * @param c: commpoint to determine transport (if needed) + * @param repinfo: commreply to determine the client address + * @param now: current time * @param region: region to alloc results in (edns option contents) * @return: 0 on success, or an RCODE on error. * RCODE formerr if OPT is badly formatted and so on. */ int parse_edns_from_query_pkt(struct sldns_buffer* pkt, struct edns_data* edns, - struct config_file* cfg, struct comm_point* c, struct regional* region); + struct config_file* cfg, struct comm_point* c, + struct comm_reply* repinfo, time_t now, struct regional* region); /** * Calculate hash value for rrset in packet. diff --git a/sbin/unwind/libunbound/util/data/msgreply.c b/sbin/unwind/libunbound/util/data/msgreply.c index 1e6ee9704..920a0a939 100644 --- a/sbin/unwind/libunbound/util/data/msgreply.c +++ b/sbin/unwind/libunbound/util/data/msgreply.c @@ -94,7 +94,7 @@ parse_create_qinfo(sldns_buffer* pkt, struct msg_parse* msg, struct reply_info* construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd, time_t ttl, time_t prettl, time_t expttl, size_t an, size_t ns, - size_t ar, size_t total, enum sec_status sec) + size_t ar, size_t total, enum sec_status sec, sldns_ede_code reason_bogus) { struct reply_info* rep; /* rrset_count-1 because the first ref is part of the struct. */ @@ -117,7 +117,9 @@ construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd, rep->ar_numrrsets = ar; rep->rrset_count = total; rep->security = sec; - rep->reason_bogus = LDNS_EDE_NONE; + rep->reason_bogus = reason_bogus; + /* this is only allocated and used for caching on copy */ + rep->reason_bogus_str = NULL; rep->authoritative = 0; /* array starts after the refs */ if(region) @@ -137,7 +139,7 @@ parse_create_repinfo(struct msg_parse* msg, struct reply_info** rep, { *rep = construct_reply_info_base(region, msg->flags, msg->qdcount, 0, 0, 0, msg->an_rrsets, msg->ns_rrsets, msg->ar_rrsets, - msg->rrset_count, sec_status_unchecked); + msg->rrset_count, sec_status_unchecked, LDNS_EDE_NONE); if(!*rep) return 0; return 1; @@ -182,7 +184,7 @@ make_new_reply_info(const struct reply_info* rep, struct regional* region, new_rep = construct_reply_info_base(region, rep->flags, rep->qdcount, rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl, an_numrrsets, 0, 0, an_numrrsets, - sec_status_insecure); + sec_status_insecure, LDNS_EDE_NONE); if(!new_rep) return NULL; if(!reply_info_alloc_rrset_keys(new_rep, NULL, region)) @@ -580,6 +582,10 @@ reply_info_parsedelete(struct reply_info* rep, struct alloc_cache* alloc) for(i=0; irrset_count; i++) { ub_packed_rrset_parsedelete(rep->rrsets[i], alloc); } + if(rep->reason_bogus_str) { + free(rep->reason_bogus_str); + rep->reason_bogus_str = NULL; + } free(rep); } @@ -661,6 +667,10 @@ void reply_info_delete(void* d, void* ATTR_UNUSED(arg)) { struct reply_info* r = (struct reply_info*)d; + if(r->reason_bogus_str) { + free(r->reason_bogus_str); + r->reason_bogus_str = NULL; + } free(r); } @@ -737,17 +747,36 @@ repinfo_copy_rrsets(struct reply_info* dest, struct reply_info* from, return 1; } -struct reply_info* -reply_info_copy(struct reply_info* rep, struct alloc_cache* alloc, +struct reply_info* +reply_info_copy(struct reply_info* rep, struct alloc_cache* alloc, struct regional* region) { struct reply_info* cp; - cp = construct_reply_info_base(region, rep->flags, rep->qdcount, - rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl, + cp = construct_reply_info_base(region, rep->flags, rep->qdcount, + rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl, rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets, - rep->rrset_count, rep->security); + rep->rrset_count, rep->security, rep->reason_bogus); if(!cp) return NULL; + + if(rep->reason_bogus_str && *rep->reason_bogus_str != 0) { + if(region) { + cp->reason_bogus_str = (char*)regional_alloc(region, + sizeof(char) + * (strlen(rep->reason_bogus_str)+1)); + } else { + cp->reason_bogus_str = malloc(sizeof(char) + * (strlen(rep->reason_bogus_str)+1)); + } + if(!cp->reason_bogus_str) { + if(!region) + reply_info_parsedelete(cp, alloc); + return NULL; + } + memcpy(cp->reason_bogus_str, rep->reason_bogus_str, + strlen(rep->reason_bogus_str)+1); + } + /* allocate ub_key structures special or not */ if(!reply_info_alloc_rrset_keys(cp, alloc, region)) { if(!region) @@ -1020,6 +1049,16 @@ int edns_opt_list_append_ede(struct edns_option** list, struct regional* region, return 1; } +int edns_opt_list_append_keepalive(struct edns_option** list, int msec, + struct regional* region) +{ + uint8_t data[2]; /* For keepalive value */ + data[0] = (uint8_t)((msec >> 8) & 0xff); + data[1] = (uint8_t)(msec & 0xff); + return edns_opt_list_append(list, LDNS_EDNS_KEEPALIVE, sizeof(data), + data, region); +} + int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len, uint8_t* data, struct regional* region) { @@ -1195,7 +1234,7 @@ int inplace_cb_query_response_call(struct module_env* env, } struct edns_option* edns_opt_copy_region(struct edns_option* list, - struct regional* region) + struct regional* region) { struct edns_option* result = NULL, *cur = NULL, *s; while(list) { @@ -1224,6 +1263,42 @@ struct edns_option* edns_opt_copy_region(struct edns_option* list, return result; } +struct edns_option* edns_opt_copy_filter_region(struct edns_option* list, + uint16_t* filter_list, size_t filter_list_len, struct regional* region) +{ + struct edns_option* result = NULL, *cur = NULL, *s; + size_t i; + while(list) { + for(i=0; iopt_code) goto found; + if(i == filter_list_len) goto next; +found: + /* copy edns option structure */ + s = regional_alloc_init(region, list, sizeof(*list)); + if(!s) return NULL; + s->next = NULL; + + /* copy option data */ + if(s->opt_data) { + s->opt_data = regional_alloc_init(region, s->opt_data, + s->opt_len); + if(!s->opt_data) + return NULL; + } + + /* link into list */ + if(cur) + cur->next = s; + else result = s; + cur = s; + +next: + /* examine next element */ + list = list->next; + } + return result; +} + int edns_opt_compare(struct edns_option* p, struct edns_option* q) { if(!p && !q) return 0; diff --git a/sbin/unwind/libunbound/util/data/msgreply.h b/sbin/unwind/libunbound/util/data/msgreply.h index 9538adc5a..a9af3d7e6 100644 --- a/sbin/unwind/libunbound/util/data/msgreply.h +++ b/sbin/unwind/libunbound/util/data/msgreply.h @@ -170,9 +170,17 @@ struct reply_info { /** * EDE (rfc8914) code with reason for DNSSEC bogus status. + * Used for caching the EDE. */ sldns_ede_code reason_bogus; + /** + * EDE (rfc8914) NULL-terminated string with human-readable reason + * for DNSSEC bogus status. + * Used for caching the EDE. + */ + char* reason_bogus_str; + /** * Number of RRsets in each section. * The answer section. Add up the RRs in every RRset to calculate @@ -240,13 +248,15 @@ struct msgreply_entry { * @param ar: ar count * @param total: total rrset count (presumably an+ns+ar). * @param sec: security status of the reply info. + * @param reason_bogus: the Extended DNS Error for DNSSEC bogus status * @return the reply_info base struct with the array for putting the rrsets * in. The array has been zeroed. Returns NULL on malloc failure. */ struct reply_info* construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd, - time_t ttl, time_t prettl, time_t expttl, size_t an, size_t ns, - size_t ar, size_t total, enum sec_status sec); + time_t ttl, time_t prettl, time_t expttl, size_t an, size_t ns, + size_t ar, size_t total, enum sec_status sec, + sldns_ede_code reason_bogus); /** * Parse wire query into a queryinfo structure, return 0 on parse error. @@ -567,6 +577,16 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len, int edns_opt_list_append_ede(struct edns_option** list, struct regional* region, sldns_ede_code code, const char *txt); +/** + * Append edns keep alive option to edns options list + * @param list: the edns option list to append the edns option to. + * @param msec: the duration in msecs for the keep alive. + * @param region: region to allocate the new edns option. + * @return false on failure. + */ +int edns_opt_list_append_keepalive(struct edns_option** list, int msec, + struct regional* region); + /** * Remove any option found on the edns option list that matches the code. * @param list: the list of edns options. @@ -718,6 +738,12 @@ int inplace_cb_query_response_call(struct module_env* env, struct edns_option* edns_opt_copy_region(struct edns_option* list, struct regional* region); +/** + * Copy a filtered edns option list allocated to the new region + */ +struct edns_option* edns_opt_copy_filter_region(struct edns_option* list, + uint16_t* filter_list, size_t filter_list_len, struct regional* region); + /** * Copy edns option list allocated with malloc */ diff --git a/sbin/unwind/libunbound/util/edns.c b/sbin/unwind/libunbound/util/edns.c index f55dcb97e..2b4047f0b 100644 --- a/sbin/unwind/libunbound/util/edns.c +++ b/sbin/unwind/libunbound/util/edns.c @@ -45,8 +45,11 @@ #include "util/netevent.h" #include "util/net_help.h" #include "util/regional.h" +#include "util/rfc_1982.h" +#include "util/siphash.h" #include "util/data/msgparse.h" #include "util/data/msgreply.h" +#include "sldns/sbuffer.h" struct edns_strings* edns_strings_create(void) { @@ -128,3 +131,59 @@ edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr, return (struct edns_string_addr*)addr_tree_lookup(tree, addr, addrlen); } +uint8_t* +edns_cookie_server_hash(const uint8_t* in, const uint8_t* secret, int v4, + uint8_t* hash) +{ + v4?siphash(in, 20, secret, hash, 8):siphash(in, 32, secret, hash, 8); + return hash; +} + +void +edns_cookie_server_write(uint8_t* buf, const uint8_t* secret, int v4, + uint32_t timestamp) +{ + uint8_t hash[8]; + buf[ 8] = 1; /* Version */ + buf[ 9] = 0; /* Reserved */ + buf[10] = 0; /* Reserved */ + buf[11] = 0; /* Reserved */ + sldns_write_uint32(buf + 12, timestamp); + (void)edns_cookie_server_hash(buf, secret, v4, hash); + memcpy(buf + 16, hash, 8); +} + +enum edns_cookie_val_status +edns_cookie_server_validate(const uint8_t* cookie, size_t cookie_len, + const uint8_t* secret, size_t secret_len, int v4, + const uint8_t* hash_input, uint32_t now) +{ + uint8_t hash[8]; + uint32_t timestamp; + uint32_t subt_1982 = 0; /* Initialize for the compiler; unused value */ + int comp_1982; + if(cookie_len != 24) + /* RFC9018 cookies are 24 bytes long */ + return COOKIE_STATUS_CLIENT_ONLY; + if(secret_len != 16 || /* RFC9018 cookies have 16 byte secrets */ + cookie[8] != 1) /* RFC9018 cookies are cookie version 1 */ + return COOKIE_STATUS_INVALID; + timestamp = sldns_read_uint32(cookie + 12); + if((comp_1982 = compare_1982(now, timestamp)) > 0 + && (subt_1982 = subtract_1982(timestamp, now)) > 3600) + /* Cookie is older than 1 hour (see RFC9018 Section 4.3.) */ + return COOKIE_STATUS_EXPIRED; + if(comp_1982 <= 0 && subtract_1982(now, timestamp) > 300) + /* Cookie time is more than 5 minutes in the future. + * (see RFC9018 Section 4.3.) */ + return COOKIE_STATUS_FUTURE; + if(memcmp(edns_cookie_server_hash(hash_input, secret, v4, hash), + cookie + 16, 8) != 0) + /* Hashes do not match */ + return COOKIE_STATUS_INVALID; + if(comp_1982 > 0 && subt_1982 > 1800) + /* Valid cookie but older than 30 minutes, so create a new one + * anyway */ + return COOKIE_STATUS_VALID_RENEW; + return COOKIE_STATUS_VALID; +} diff --git a/sbin/unwind/libunbound/util/edns.h b/sbin/unwind/libunbound/util/edns.h index d9ded0b84..5da0ecb29 100644 --- a/sbin/unwind/libunbound/util/edns.h +++ b/sbin/unwind/libunbound/util/edns.h @@ -75,6 +75,15 @@ struct edns_string_addr { size_t string_len; }; +enum edns_cookie_val_status { + COOKIE_STATUS_CLIENT_ONLY = -3, + COOKIE_STATUS_FUTURE = -2, + COOKIE_STATUS_EXPIRED = -1, + COOKIE_STATUS_INVALID = 0, + COOKIE_STATUS_VALID = 1, + COOKIE_STATUS_VALID_RENEW = 2, +}; + /** * Create structure to hold EDNS strings * @return: newly created edns_strings, NULL on alloc failure. @@ -106,4 +115,54 @@ struct edns_string_addr* edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr, socklen_t addrlen); +/** + * Compute the interoperable DNS cookie (RFC9018) hash. + * @param in: buffer input for the hash generation. It needs to be: + * Client Cookie | Version | Reserved | Timestamp | Client-IP + * @param secret: the server secret; implicit length of 16 octets. + * @param v4: if the client IP is v4 or v6. + * @param hash: buffer to write the hash to. + * return a pointer to the hash. + */ +uint8_t* edns_cookie_server_hash(const uint8_t* in, const uint8_t* secret, + int v4, uint8_t* hash); + +/** + * Write an interoperable DNS server cookie (RFC9018). + * @param buf: buffer to write to. It should have a size of at least 32 octets + * as it doubles as the output buffer and the hash input buffer. + * The first 8 octets are expected to be the Client Cookie and will be + * left untouched. + * The next 8 octets will be written with Version | Reserved | Timestamp. + * The next 4 or 16 octets are expected to be the IPv4 or the IPv6 address + * based on the v4 flag. + * Thus the first 20 or 32 octets, based on the v4 flag, will be used as + * the hash input. + * The server hash (8 octets) will be written after the first 16 octets; + * overwriting the address information. + * The caller expects a complete, 24 octet long cookie in the buffer. + * @param secret: the server secret; implicit length of 16 octets. + * @param v4: if the client IP is v4 or v6. + * @param timestamp: the timestamp to use. + */ +void edns_cookie_server_write(uint8_t* buf, const uint8_t* secret, int v4, + uint32_t timestamp); + +/** + * Validate an interoperable DNS cookie (RFC9018). + * @param cookie: pointer to the cookie data. + * @param cookie_len: the length of the cookie data. + * @param secret: pointer to the server secret. + * @param secret_len: the length of the secret. + * @param v4: if the client IP is v4 or v6. + * @param hash_input: pointer to the hash input for validation. It needs to be: + * Client Cookie | Version | Reserved | Timestamp | Client-IP + * @param now: the current time. + * return edns_cookie_val_status with the cookie validation status i.e., + * <=0 for invalid, else valid. + */ +enum edns_cookie_val_status edns_cookie_server_validate(const uint8_t* cookie, + size_t cookie_len, const uint8_t* secret, size_t secret_len, int v4, + const uint8_t* hash_input, uint32_t now); + #endif diff --git a/sbin/unwind/libunbound/util/fptr_wlist.c b/sbin/unwind/libunbound/util/fptr_wlist.c index dc8ab6693..3b88da235 100644 --- a/sbin/unwind/libunbound/util/fptr_wlist.c +++ b/sbin/unwind/libunbound/util/fptr_wlist.c @@ -659,6 +659,10 @@ int fptr_whitelist_inplace_cb_edns_back_parsed( #else (void)fptr; #endif +#ifdef WITH_PYTHONMODULE + if(fptr == &python_inplace_cb_edns_back_parsed_call) + return 1; +#endif #ifdef WITH_DYNLIBMODULE if(fptr == &dynlib_inplace_cb_edns_back_parsed) return 1; @@ -675,6 +679,10 @@ int fptr_whitelist_inplace_cb_query_response( #else (void)fptr; #endif +#ifdef WITH_PYTHONMODULE + if(fptr == &python_inplace_cb_query_response) + return 1; +#endif #ifdef WITH_DYNLIBMODULE if(fptr == &dynlib_inplace_cb_query_response) return 1; diff --git a/sbin/unwind/libunbound/util/iana_ports.inc b/sbin/unwind/libunbound/util/iana_ports.inc index 80a8144d3..5cb127ed8 100644 --- a/sbin/unwind/libunbound/util/iana_ports.inc +++ b/sbin/unwind/libunbound/util/iana_ports.inc @@ -674,6 +674,8 @@ 911, 912, 913, +914, +915, 989, 990, 991, @@ -1901,6 +1903,7 @@ 2256, 2257, 2258, +2259, 2260, 2261, 2262, @@ -2010,6 +2013,7 @@ 2366, 2367, 2368, +2369, 2370, 2372, 2378, @@ -4840,6 +4844,7 @@ 8403, 8416, 8417, +8433, 8442, 8443, 8444, diff --git a/sbin/unwind/libunbound/util/module.c b/sbin/unwind/libunbound/util/module.c index 6698f9497..773dab853 100644 --- a/sbin/unwind/libunbound/util/module.c +++ b/sbin/unwind/libunbound/util/module.c @@ -84,8 +84,10 @@ void errinf_ede(struct module_qstate* qstate, const char* str, sldns_ede_code reason_bogus) { struct errinf_strlist* p; - if((qstate->env->cfg->val_log_level < 2 && !qstate->env->cfg->log_servfail) || !str) + if(!str || (qstate->env->cfg->val_log_level < 2 && + !qstate->env->cfg->log_servfail)) { return; + } p = (struct errinf_strlist*)regional_alloc(qstate->region, sizeof(*p)); if(!p) { log_err("malloc failure in validator-error-info string"); @@ -152,15 +154,19 @@ char* errinf_to_str_bogus(struct module_qstate* qstate) return p; } +/* Try to find the latest (most specific) dnssec failure */ sldns_ede_code errinf_to_reason_bogus(struct module_qstate* qstate) { struct errinf_strlist* s; + sldns_ede_code ede = LDNS_EDE_NONE; for(s=qstate->errinf; s; s=s->next) { - if (s->reason_bogus != LDNS_EDE_NONE) { - return s->reason_bogus; - } + if(s->reason_bogus == LDNS_EDE_NONE) continue; + if(ede != LDNS_EDE_NONE + && ede != LDNS_EDE_DNSSEC_BOGUS + && s->reason_bogus == LDNS_EDE_DNSSEC_BOGUS) continue; + ede = s->reason_bogus; } - return LDNS_EDE_NONE; + return ede; } char* errinf_to_str_servfail(struct module_qstate* qstate) diff --git a/sbin/unwind/libunbound/util/module.h b/sbin/unwind/libunbound/util/module.h index 013c65b02..5b6fcc93c 100644 --- a/sbin/unwind/libunbound/util/module.h +++ b/sbin/unwind/libunbound/util/module.h @@ -619,6 +619,12 @@ struct module_qstate { /** if this is a validation recursion query that does not get * validation itself */ int is_valrec; +#ifdef CLIENT_SUBNET + /** the client network address is needed for the client-subnet option + * when prefetching, but we can't use reply_list in mesh_info, because + * we don't want to send a reply for the internal query. */ + struct sockaddr_storage client_addr; +#endif /** comm_reply contains server replies */ struct comm_reply* reply; @@ -671,6 +677,8 @@ struct module_qstate { * those servers. By comparing expiry time with qstarttime for type NS. */ time_t qstarttime; + /** whether a message from cachedb will be used for the reply */ + int is_cachedb_answer; /** * Attributes of clients that share the qstate that may affect IP-based @@ -818,11 +826,11 @@ void errinf_dname(struct module_qstate* qstate, const char* str, * This string is malloced and has to be freed by caller. */ char* errinf_to_str_bogus(struct module_qstate* qstate); + /** - * Check the sldns_ede_code of the qstate. + * Check the sldns_ede_code of the qstate->errinf. * @param qstate: query state. - * @return LDNS_EDE_DNSSEC_BOGUS by default, or the first explicitly set - * sldns_ede_code. + * @return the latest explicitly set sldns_ede_code or LDNS_EDE_NONE. */ sldns_ede_code errinf_to_reason_bogus(struct module_qstate* qstate); diff --git a/sbin/unwind/libunbound/util/net_help.c b/sbin/unwind/libunbound/util/net_help.c index 54fad6986..e559c9b2f 100644 --- a/sbin/unwind/libunbound/util/net_help.c +++ b/sbin/unwind/libunbound/util/net_help.c @@ -779,8 +779,8 @@ addr_in_common(struct sockaddr_storage* addr1, int net1, return match; } -void -addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen, +void +addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen, char* buf, size_t len) { int af = (int)((struct sockaddr_in*)addr)->sin_family; @@ -792,7 +792,50 @@ addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen, } } -int +int +prefixnet_is_nat64(int prefixnet) +{ + return (prefixnet == 32 || prefixnet == 40 || + prefixnet == 48 || prefixnet == 56 || + prefixnet == 64 || prefixnet == 96); +} + +void +addr_to_nat64(const struct sockaddr_storage* addr, + const struct sockaddr_storage* nat64_prefix, + socklen_t nat64_prefixlen, int nat64_prefixnet, + struct sockaddr_storage* nat64_addr, socklen_t* nat64_addrlen) +{ + struct sockaddr_in *sin = (struct sockaddr_in *)addr; + struct sockaddr_in6 *sin6; + uint8_t *v4_byte; + + /* This needs to be checked by the caller */ + log_assert(addr->ss_family == AF_INET); + /* Current usage is only from config values; prefix lengths enforced + * during config validation */ + log_assert(prefixnet_is_nat64(nat64_prefixnet)); + + *nat64_addr = *nat64_prefix; + *nat64_addrlen = nat64_prefixlen; + + sin6 = (struct sockaddr_in6 *)nat64_addr; + sin6->sin6_flowinfo = 0; + sin6->sin6_port = sin->sin_port; + + nat64_prefixnet = nat64_prefixnet / 8; + + v4_byte = (uint8_t *)&sin->sin_addr.s_addr; + for(int i = 0; i < 4; i++) { + if(nat64_prefixnet == 8) { + /* bits 64...71 are MBZ */ + sin6->sin6_addr.s6_addr[nat64_prefixnet++] = 0; + } + sin6->sin6_addr.s6_addr[nat64_prefixnet++] = *v4_byte++; + } +} + +int addr_is_ip4mapped(struct sockaddr_storage* addr, socklen_t addrlen) { /* prefix for ipv4 into ipv6 mapping is ::ffff:x.x.x.x */ @@ -1005,6 +1048,16 @@ listen_sslctx_setup(void* ctxt) log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list"); } #endif +#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF) + /* ignore errors when peers do not send the mandatory close_notify + * alert on shutdown. + * Relevant for openssl >= 3 */ + if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) & + SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) { + log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF"); + return 0; + } +#endif if((SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE) & SSL_OP_CIPHER_SERVER_PREFERENCE) != @@ -1233,6 +1286,17 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem, int wincert) SSL_CTX_free(ctx); return 0; } +#endif +#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF) + /* ignore errors when peers do not send the mandatory close_notify + * alert on shutdown. + * Relevant for openssl >= 3 */ + if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) & + SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) { + log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF"); + SSL_CTX_free(ctx); + return 0; + } #endif if(key && key[0]) { if(!SSL_CTX_use_certificate_chain_file(ctx, pem)) { diff --git a/sbin/unwind/libunbound/util/net_help.h b/sbin/unwind/libunbound/util/net_help.h index f1881b3ed..a9de910d5 100644 --- a/sbin/unwind/libunbound/util/net_help.h +++ b/sbin/unwind/libunbound/util/net_help.h @@ -331,6 +331,29 @@ int addr_in_common(struct sockaddr_storage* addr1, int net1, void addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen, char* buf, size_t len); +/** + * Check if the prefix network length is one of the allowed 32, 40, 48, 56, 64, + * or 96. + * @param prefixnet: prefix network length to check. + * @return 1 on success, 0 on failure. + */ +int prefixnet_is_nat64(int prefixnet); + +/** + * Create a NAT64 address from a given address (needs to be IPv4) and a given + * NAT64 prefix. The NAT64 prefix net needs to be one of 32, 40, 48, 56, 64, 96. + * @param addr: IPv4 address. + * @param nat64_prefix: NAT64 prefix. + * @param nat64_prefixlen: NAT64 prefix len. + * @param nat64_prefixnet: NAT64 prefix mask. + * @param nat64_addr: the resulting NAT64 address. + * @param nat64_addrlen: the resulting NAT64 address length. + */ +void addr_to_nat64(const struct sockaddr_storage* addr, + const struct sockaddr_storage* nat64_prefix, + socklen_t nat64_prefixlen, int nat64_prefixnet, + struct sockaddr_storage* nat64_addr, socklen_t* nat64_addrlen); + /** * See if sockaddr is an ipv6 mapped ipv4 address, "::ffff:0.0.0.0" * @param addr: address diff --git a/sbin/unwind/libunbound/util/netevent.c b/sbin/unwind/libunbound/util/netevent.c index c67a49ff8..204e4883c 100644 --- a/sbin/unwind/libunbound/util/netevent.c +++ b/sbin/unwind/libunbound/util/netevent.c @@ -4,22 +4,22 @@ * Copyright (c) 2007, NLnet Labs. All rights reserved. * * This software is open source. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. - * + * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. - * + * * Neither the name of the NLNET LABS nor the names of its contributors may * be used to endorse or promote products derived from this software without * specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR @@ -46,6 +46,7 @@ #include "util/tcp_conn_limit.h" #include "util/fptr_wlist.h" #include "util/proxy_protocol.h" +#include "util/timeval_func.h" #include "sldns/pkthdr.h" #include "sldns/sbuffer.h" #include "sldns/str2wire.h" @@ -71,7 +72,9 @@ #ifdef HAVE_OPENSSL_ERR_H #include #endif - +#ifdef HAVE_LINUX_NET_TSTAMP_H +#include +#endif /* -------- Start of local definitions -------- */ /** if CMSG_ALIGN is not defined on this platform, a workaround */ #ifndef CMSG_ALIGN @@ -114,6 +117,16 @@ /** timeout in millisec to wait for write to unblock, packets dropped after.*/ #define SEND_BLOCKED_WAIT_TIMEOUT 200 +/** Let's make timestamping code cleaner and redefine SO_TIMESTAMP* */ +#ifndef SO_TIMESTAMP +#define SO_TIMESTAMP 29 +#endif +#ifndef SO_TIMESTAMPNS +#define SO_TIMESTAMPNS 35 +#endif +#ifndef SO_TIMESTAMPING +#define SO_TIMESTAMPING 37 +#endif /** * The internal event structure for keeping ub_event info for the event. * Possibly other structures (list, tree) this is part of. @@ -177,7 +190,7 @@ static struct comm_point* comm_point_create_tcp_handler( /* -------- End of local definitions -------- */ -struct comm_base* +struct comm_base* comm_base_create(int sigs) { struct comm_base* b = (struct comm_base*)calloc(1, @@ -220,7 +233,7 @@ comm_base_create_event(struct ub_event_base* base) return b; } -void +void comm_base_delete(struct comm_base* b) { if(!b) @@ -237,7 +250,7 @@ comm_base_delete(struct comm_base* b) free(b); } -void +void comm_base_delete_no_base(struct comm_base* b) { if(!b) @@ -253,14 +266,14 @@ comm_base_delete_no_base(struct comm_base* b) free(b); } -void +void comm_base_timept(struct comm_base* b, time_t** tt, struct timeval** tv) { *tt = &b->eb->secs; *tv = &b->eb->now; } -void +void comm_base_dispatch(struct comm_base* b) { int retval; @@ -470,7 +483,7 @@ comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet, (struct sockaddr_storage*)addr, addrlen); return 0; } else if((size_t)sent != sldns_buffer_remaining(packet)) { - log_err("sent %d in place of %d bytes", + log_err("sent %d in place of %d bytes", (int)sent, (int)sldns_buffer_remaining(packet)); return 0; } @@ -489,7 +502,7 @@ static void p_ancil(const char* str, struct comm_reply* r) if(r->srctype == 6) { #ifdef IPV6_PKTINFO char buf[1024]; - if(inet_ntop(AF_INET6, &r->pktinfo.v6info.ipi6_addr, + if(inet_ntop(AF_INET6, &r->pktinfo.v6info.ipi6_addr, buf, (socklen_t)sizeof(buf)) == 0) { (void)strlcpy(buf, "(inet_ntop error)", sizeof(buf)); } @@ -499,13 +512,13 @@ static void p_ancil(const char* str, struct comm_reply* r) } else if(r->srctype == 4) { #ifdef IP_PKTINFO char buf1[1024], buf2[1024]; - if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_addr, + if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_addr, buf1, (socklen_t)sizeof(buf1)) == 0) { (void)strlcpy(buf1, "(inet_ntop error)", sizeof(buf1)); } buf1[sizeof(buf1)-1]=0; #ifdef HAVE_STRUCT_IN_PKTINFO_IPI_SPEC_DST - if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_spec_dst, + if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_spec_dst, buf2, (socklen_t)sizeof(buf2)) == 0) { (void)strlcpy(buf2, "(inet_ntop error)", sizeof(buf2)); } @@ -517,7 +530,7 @@ static void p_ancil(const char* str, struct comm_reply* r) buf1, buf2); #elif defined(IP_RECVDSTADDR) char buf1[1024]; - if(inet_ntop(AF_INET, &r->pktinfo.v4addr, + if(inet_ntop(AF_INET, &r->pktinfo.v4addr, buf1, (socklen_t)sizeof(buf1)) == 0) { (void)strlcpy(buf1, "(inet_ntop error)", sizeof(buf1)); } @@ -531,7 +544,7 @@ static void p_ancil(const char* str, struct comm_reply* r) /** send a UDP reply over specified interface*/ static int comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, - struct sockaddr* addr, socklen_t addrlen, struct comm_reply* r) + struct sockaddr* addr, socklen_t addrlen, struct comm_reply* r) { #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_SENDMSG) ssize_t sent; @@ -579,6 +592,11 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, cmsg_data = CMSG_DATA(cmsg); ((struct in_pktinfo *) cmsg_data)->ipi_ifindex = 0; cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo)); + /* zero the padding bytes inserted by the CMSG_LEN */ + if(sizeof(struct in_pktinfo) < cmsg->cmsg_len) + memset(((uint8_t*)(CMSG_DATA(cmsg))) + + sizeof(struct in_pktinfo), 0, cmsg->cmsg_len + - sizeof(struct in_pktinfo)); #elif defined(IP_SENDSRCADDR) msg.msg_controllen = CMSG_SPACE(sizeof(struct in_addr)); log_assert(msg.msg_controllen <= sizeof(control.buf)); @@ -587,6 +605,11 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, memmove(CMSG_DATA(cmsg), &r->pktinfo.v4addr, sizeof(struct in_addr)); cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr)); + /* zero the padding bytes inserted by the CMSG_LEN */ + if(sizeof(struct in_addr) < cmsg->cmsg_len) + memset(((uint8_t*)(CMSG_DATA(cmsg))) + + sizeof(struct in_addr), 0, cmsg->cmsg_len + - sizeof(struct in_addr)); #else verbose(VERB_ALGO, "no IP_PKTINFO or IP_SENDSRCADDR"); msg.msg_control = NULL; @@ -603,6 +626,11 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, cmsg_data = CMSG_DATA(cmsg); ((struct in6_pktinfo *) cmsg_data)->ipi6_ifindex = 0; cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo)); + /* zero the padding bytes inserted by the CMSG_LEN */ + if(sizeof(struct in6_pktinfo) < cmsg->cmsg_len) + memset(((uint8_t*)(CMSG_DATA(cmsg))) + + sizeof(struct in6_pktinfo), 0, cmsg->cmsg_len + - sizeof(struct in6_pktinfo)); } else { /* try to pass all 0 to use default route */ msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo)); @@ -611,9 +639,14 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, cmsg->cmsg_type = IPV6_PKTINFO; memset(CMSG_DATA(cmsg), 0, sizeof(struct in6_pktinfo)); cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo)); + /* zero the padding bytes inserted by the CMSG_LEN */ + if(sizeof(struct in6_pktinfo) < cmsg->cmsg_len) + memset(((uint8_t*)(CMSG_DATA(cmsg))) + + sizeof(struct in6_pktinfo), 0, cmsg->cmsg_len + - sizeof(struct in6_pktinfo)); } #endif /* S_SPLINT_S */ - if(verbosity >= VERB_ALGO) + if(verbosity >= VERB_ALGO && r->srctype != 0) p_ancil("send_udp over interface", r); sent = sendmsg(c->fd, &msg, 0); if(sent == -1) { @@ -695,7 +728,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, if(!udp_send_errno_needs_log(addr, addrlen)) return 0; verbose(VERB_OPS, "sendmsg failed: %s", strerror(errno)); - log_addr(VERB_OPS, "remote address is", + log_addr(VERB_OPS, "remote address is", (struct sockaddr_storage*)addr, addrlen); #ifdef __NetBSD__ /* netbsd 7 has IP_PKTINFO for recv but not send */ @@ -705,7 +738,7 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, #endif return 0; } else if((size_t)sent != sldns_buffer_remaining(packet)) { - log_err("sent %d in place of %d bytes", + log_err("sent %d in place of %d bytes", (int)sent, (int)sldns_buffer_remaining(packet)); return 0; } @@ -817,7 +850,7 @@ done: return 1; } -void +void comm_point_udp_ancil_callback(int fd, short event, void* arg) { #if defined(AF_INET6) && defined(IPV6_PKTINFO) && defined(HAVE_RECVMSG) @@ -833,6 +866,9 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg) #ifndef S_SPLINT_S struct cmsghdr* cmsg; #endif /* S_SPLINT_S */ +#ifdef HAVE_LINUX_NET_TSTAMP_H + struct timespec *ts; +#endif /* HAVE_LINUX_NET_TSTAMP_H */ rep.c = (struct comm_point*)arg; log_assert(rep.c->type == comm_udp); @@ -843,6 +879,7 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg) ub_comm_base_now(rep.c->ev->base); for(i=0; ibuffer); + timeval_clear(&rep.c->recv_tv); rep.remote_addrlen = (socklen_t)sizeof(rep.remote_addr); log_assert(fd != -1); log_assert(sldns_buffer_remaining(rep.c->buffer) > 0); @@ -894,9 +931,23 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg) sizeof(struct in_addr)); break; #endif /* IP_PKTINFO or IP_RECVDSTADDR */ +#ifdef HAVE_LINUX_NET_TSTAMP_H + } else if( cmsg->cmsg_level == SOL_SOCKET && + cmsg->cmsg_type == SO_TIMESTAMPNS) { + ts = (struct timespec *)CMSG_DATA(cmsg); + TIMESPEC_TO_TIMEVAL(&rep.c->recv_tv, ts); + } else if( cmsg->cmsg_level == SOL_SOCKET && + cmsg->cmsg_type == SO_TIMESTAMPING) { + ts = (struct timespec *)CMSG_DATA(cmsg); + TIMESPEC_TO_TIMEVAL(&rep.c->recv_tv, ts); + } else if( cmsg->cmsg_level == SOL_SOCKET && + cmsg->cmsg_type == SO_TIMESTAMP) { + memmove(&rep.c->recv_tv, CMSG_DATA(cmsg), sizeof(struct timeval)); +#endif /* HAVE_LINUX_NET_TSTAMP_H */ } } - if(verbosity >= VERB_ALGO) + + if(verbosity >= VERB_ALGO && rep.srctype != 0) p_ancil("receive_udp on interface", &rep); #endif /* S_SPLINT_S */ @@ -930,7 +981,7 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg) #endif /* AF_INET6 && IPV6_PKTINFO && HAVE_RECVMSG */ } -void +void comm_point_udp_callback(int fd, short event, void* arg) { struct comm_reply rep; @@ -950,14 +1001,14 @@ comm_point_udp_callback(int fd, short event, void* arg) rep.remote_addrlen = (socklen_t)sizeof(rep.remote_addr); log_assert(fd != -1); log_assert(sldns_buffer_remaining(rep.c->buffer) > 0); - rcv = recvfrom(fd, (void*)sldns_buffer_begin(rep.c->buffer), + rcv = recvfrom(fd, (void*)sldns_buffer_begin(rep.c->buffer), sldns_buffer_remaining(rep.c->buffer), MSG_DONTWAIT, (struct sockaddr*)&rep.remote_addr, &rep.remote_addrlen); if(rcv == -1) { #ifndef USE_WINSOCK if(errno != EAGAIN && errno != EINTR && udp_recv_needs_log(errno)) - log_err("recvfrom %d failed: %s", + log_err("recvfrom %d failed: %s", fd, strerror(errno)); #else if(WSAGetLastError() != WSAEINPROGRESS && @@ -1012,7 +1063,7 @@ int adjusted_tcp_timeout(struct comm_point* c) /** Use a new tcp handler for new query fd, set to read query */ static void -setup_tcp_handler(struct comm_point* c, int fd, int cur, int max) +setup_tcp_handler(struct comm_point* c, int fd, int cur, int max) { int handler_usage; log_assert(c->type == comm_tcp || c->type == comm_http); @@ -1076,10 +1127,10 @@ int comm_point_perform_accept(struct comm_point* c, /* EINTR is signal interrupt. others are closed connection. */ if( errno == EINTR || errno == EAGAIN #ifdef EWOULDBLOCK - || errno == EWOULDBLOCK + || errno == EWOULDBLOCK #endif #ifdef ECONNABORTED - || errno == ECONNABORTED + || errno == ECONNABORTED #endif #ifdef EPROTO || errno == EPROTO @@ -1253,7 +1304,7 @@ static int http2_submit_settings(struct http2_session* h2_session) #endif /* HAVE_NGHTTP2 */ -void +void comm_point_tcp_accept_callback(int fd, short event, void* arg) { struct comm_point* c = (struct comm_point*)arg, *c_hdl; @@ -2161,7 +2212,7 @@ comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok) log_err("in comm_point_tcp_handle_read buffer_remaining is " "not > 0 as expected, continuing with (harmless) 0 " "length recv"); - r = recv(fd, (void*)sldns_buffer_current(c->buffer), + r = recv(fd, (void*)sldns_buffer_current(c->buffer), sldns_buffer_remaining(c->buffer), MSG_DONTWAIT); if(r == 0) { if(c->tcp_req_info) @@ -2252,8 +2303,8 @@ recv_error: return 0; } -/** - * Handle tcp writing callback. +/** + * Handle tcp writing callback. * @param fd: file descriptor of socket. * @param c: comm point to write buffer out of. * @return: 0 on error @@ -2277,7 +2328,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c) /* from Stevens, unix network programming, vol1, 3rd ed, p450*/ int error = 0; socklen_t len = (socklen_t)sizeof(error); - if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error, + if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error, &len) < 0){ #ifndef USE_WINSOCK error = errno; /* on solaris errno is error */ @@ -2318,7 +2369,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c) return ssl_handle_it(c, 1); #ifdef USE_MSG_FASTOPEN - /* Only try this on first use of a connection that uses tfo, + /* Only try this on first use of a connection that uses tfo, otherwise fall through to normal write */ /* Also, TFO support on WINDOWS not implemented at the moment */ if(c->tcp_do_fastopen == 1) { @@ -2473,7 +2524,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c) if(WSAGetLastError() == WSAEWOULDBLOCK) { ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); - return 1; + return 1; } if(WSAGetLastError() == WSAECONNRESET && verbosity < 2) return 0; /* silence reset by peer */ @@ -2522,7 +2573,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c) return 1; if(WSAGetLastError() == WSAEWOULDBLOCK) { ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); - return 1; + return 1; } if(WSAGetLastError() == WSAECONNRESET && verbosity < 2) return 0; /* silence reset by peer */ @@ -2541,12 +2592,13 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c) if((!c->tcp_write_and_read && sldns_buffer_remaining(buffer) == 0) || (c->tcp_write_and_read && c->tcp_write_byte_count == c->tcp_write_pkt_len + 2)) { tcp_callback_writer(c); } - + return 1; } -/** read again to drain buffers when there could be more to read */ -static void +/** read again to drain buffers when there could be more to read, returns 0 + * on failure which means the comm point is closed. */ +static int tcp_req_info_read_again(int fd, struct comm_point* c) { while(c->tcp_req_info->read_again) { @@ -2560,12 +2612,13 @@ tcp_req_info_read_again(int fd, struct comm_point* c) if(!c->tcp_do_close) { fptr_ok(fptr_whitelist_comm_point( c->callback)); - (void)(*c->callback)(c, c->cb_arg, + (void)(*c->callback)(c, c->cb_arg, NETEVENT_CLOSED, NULL); } - return; + return 0; } } + return 1; } /** read again to drain buffers when there could be more to read */ @@ -2616,13 +2669,16 @@ tcp_more_write_again(int fd, struct comm_point* c) } } -void +void comm_point_tcp_handle_callback(int fd, short event, void* arg) { struct comm_point* c = (struct comm_point*)arg; log_assert(c->type == comm_tcp); ub_comm_base_now(c->ev->base); + if(c->fd == -1 || c->fd != fd) + return; /* duplicate event, but commpoint closed. */ + #ifdef USE_DNSCRYPT /* Initialize if this is a dnscrypt socket */ if(c->tcp_parent) { @@ -2671,8 +2727,10 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg) } return; } - if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) - tcp_req_info_read_again(fd, c); + if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) { + if(!tcp_req_info_read_again(fd, c)) + return; + } if(moreread && *moreread) tcp_more_read_again(fd, c); return; @@ -2690,8 +2748,10 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg) } return; } - if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) - tcp_req_info_read_again(fd, c); + if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) { + if(!tcp_req_info_read_again(fd, c)) + return; + } if(morewrite && *morewrite) tcp_more_write_again(fd, c); return; @@ -2774,7 +2834,7 @@ http_read_more(int fd, struct comm_point* c) { ssize_t r; log_assert(sldns_buffer_remaining(c->buffer) > 0); - r = recv(fd, (void*)sldns_buffer_current(c->buffer), + r = recv(fd, (void*)sldns_buffer_current(c->buffer), sldns_buffer_remaining(c->buffer), MSG_DONTWAIT); if(r == 0) { return 0; @@ -3043,7 +3103,7 @@ http_chunked_segment(struct comm_point* c) /* return and wait to read more */ return 1; } - + /* callback of http reader for a new part of the data */ c->http_stored = 0; sldns_buffer_set_position(c->buffer, 0); @@ -3393,7 +3453,7 @@ http_check_connect(int fd, struct comm_point* c) /* from Stevens, unix network programming, vol1, 3rd ed, p450*/ int error = 0; socklen_t len = (socklen_t)sizeof(error); - if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error, + if(getsockopt(fd, SOL_SOCKET, SO_ERROR, (void*)&error, &len) < 0){ #ifndef USE_WINSOCK error = errno; /* on solaris errno is error */ @@ -3478,7 +3538,7 @@ http_write_more(int fd, struct comm_point* c) { ssize_t r; log_assert(sldns_buffer_remaining(c->buffer) > 0); - r = send(fd, (void*)sldns_buffer_current(c->buffer), + r = send(fd, (void*)sldns_buffer_current(c->buffer), sldns_buffer_remaining(c->buffer), 0); if(r == -1) { #ifndef USE_WINSOCK @@ -3489,7 +3549,7 @@ http_write_more(int fd, struct comm_point* c) return 1; if(WSAGetLastError() == WSAEWOULDBLOCK) { ub_winsock_tcp_wouldblock(c->ev->ev, UB_EV_WRITE); - return 1; + return 1; } #endif log_err_addr("http send r", sock_strerror(errno), @@ -3610,8 +3670,8 @@ comm_point_http2_handle_write(int ATTR_UNUSED(fd), struct comm_point* c) #endif } -/** - * Handle http writing callback. +/** + * Handle http writing callback. * @param fd: file descriptor of socket. * @param c: comm point to write buffer out of. * @return: 0 on error @@ -3677,7 +3737,7 @@ comm_point_http_handle_write(int fd, struct comm_point* c) return 1; } -void +void comm_point_http_handle_callback(int fd, short event, void* arg) { struct comm_point* c = (struct comm_point*)arg; @@ -3730,7 +3790,7 @@ void comm_point_local_handle_callback(int fd, short event, void* arg) if(event&UB_EV_READ) { if(!comm_point_tcp_handle_read(fd, c, 1)) { fptr_ok(fptr_whitelist_comm_point(c->callback)); - (void)(*c->callback)(c, c->cb_arg, NETEVENT_CLOSED, + (void)(*c->callback)(c, c->cb_arg, NETEVENT_CLOSED, NULL); } return; @@ -3738,21 +3798,21 @@ void comm_point_local_handle_callback(int fd, short event, void* arg) log_err("Ignored event %d for localhdl.", event); } -void comm_point_raw_handle_callback(int ATTR_UNUSED(fd), +void comm_point_raw_handle_callback(int ATTR_UNUSED(fd), short event, void* arg) { struct comm_point* c = (struct comm_point*)arg; int err = NETEVENT_NOERROR; log_assert(c->type == comm_raw); ub_comm_base_now(c->ev->base); - + if(event&UB_EV_TIMEOUT) err = NETEVENT_TIMEOUT; fptr_ok(fptr_whitelist_comm_point_raw(c->callback)); (void)(*c->callback)(c, c->cb_arg, err, NULL); } -struct comm_point* +struct comm_point* comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer, int pp2_enabled, comm_point_callback_type* callback, void* callback_arg, struct unbound_socket* socket) @@ -3800,7 +3860,11 @@ comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer, evbits = UB_EV_READ | UB_EV_PERSIST; /* ub_event stuff */ c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, +#ifdef USE_WINSOCK comm_point_udp_callback, c); +#else + comm_point_udp_ancil_callback, c); +#endif if(c->ev->ev == NULL) { log_err("could not baseset udp event"); comm_point_delete(c); @@ -3815,7 +3879,7 @@ comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer, return c; } -struct comm_point* +struct comm_point* comm_point_create_udp_ancil(struct comm_base *base, int fd, sldns_buffer* buffer, int pp2_enabled, comm_point_callback_type* callback, void* callback_arg, struct unbound_socket* socket) @@ -3878,8 +3942,8 @@ comm_point_create_udp_ancil(struct comm_base *base, int fd, return c; } -static struct comm_point* -comm_point_create_tcp_handler(struct comm_base *base, +static struct comm_point* +comm_point_create_tcp_handler(struct comm_base *base, struct comm_point* parent, size_t bufsize, struct sldns_buffer* spoolbuf, comm_point_callback_type* callback, void* callback_arg, struct unbound_socket* socket) @@ -3976,8 +4040,8 @@ comm_point_create_tcp_handler(struct comm_base *base, return c; } -static struct comm_point* -comm_point_create_http_handler(struct comm_base *base, +static struct comm_point* +comm_point_create_http_handler(struct comm_base *base, struct comm_point* parent, size_t bufsize, int harden_large_queries, uint32_t http_max_streams, char* http_endpoint, comm_point_callback_type* callback, void* callback_arg, @@ -4074,7 +4138,7 @@ comm_point_create_http_handler(struct comm_base *base, return NULL; } #endif - + /* add to parent free list */ c->tcp_free = parent->tcp_free; parent->tcp_free = c; @@ -4096,7 +4160,7 @@ comm_point_create_http_handler(struct comm_base *base, return c; } -struct comm_point* +struct comm_point* comm_point_create_tcp(struct comm_base *base, int fd, int num, int idle_timeout, int harden_large_queries, uint32_t http_max_streams, char* http_endpoint, @@ -4194,11 +4258,11 @@ comm_point_create_tcp(struct comm_base *base, int fd, int num, return NULL; } } - + return c; } -struct comm_point* +struct comm_point* comm_point_create_tcp_out(struct comm_base *base, size_t bufsize, comm_point_callback_type* callback, void* callback_arg) { @@ -4265,7 +4329,7 @@ comm_point_create_tcp_out(struct comm_base *base, size_t bufsize, return c; } -struct comm_point* +struct comm_point* comm_point_create_http_out(struct comm_base *base, size_t bufsize, comm_point_callback_type* callback, void* callback_arg, sldns_buffer* temp) @@ -4336,7 +4400,7 @@ comm_point_create_http_out(struct comm_base *base, size_t bufsize, return c; } -struct comm_point* +struct comm_point* comm_point_create_local(struct comm_base *base, int fd, size_t bufsize, comm_point_callback_type* callback, void* callback_arg) { @@ -4404,8 +4468,8 @@ comm_point_create_local(struct comm_base *base, int fd, size_t bufsize, return c; } -struct comm_point* -comm_point_create_raw(struct comm_base* base, int fd, int writing, +struct comm_point* +comm_point_create_raw(struct comm_base* base, int fd, int writing, comm_point_callback_type* callback, void* callback_arg) { struct comm_point* c = (struct comm_point*)calloc(1, @@ -4469,7 +4533,7 @@ comm_point_create_raw(struct comm_base* base, int fd, int writing, return c; } -void +void comm_point_close(struct comm_point* c) { if(!c) @@ -4488,6 +4552,11 @@ comm_point_close(struct comm_point* c) tcp_req_info_clear(c->tcp_req_info); if(c->h2_session) http2_session_server_delete(c->h2_session); + /* stop the comm point from reading or writing after it is closed. */ + if(c->tcp_more_read_again && *c->tcp_more_read_again) + *c->tcp_more_read_again = 0; + if(c->tcp_more_write_again && *c->tcp_more_write_again) + *c->tcp_more_write_again = 0; /* close fd after removing from event lists, or epoll.. is messed up */ if(c->fd != -1 && !c->do_not_close) { @@ -4504,10 +4573,10 @@ comm_point_close(struct comm_point* c) c->fd = -1; } -void +void comm_point_delete(struct comm_point* c) { - if(!c) + if(!c) return; if((c->type == comm_tcp || c->type == comm_http) && c->ssl) { #ifdef HAVE_SSL @@ -4546,7 +4615,7 @@ comm_point_delete(struct comm_point* c) free(c); } -void +void comm_point_send_reply(struct comm_reply *repinfo) { struct sldns_buffer* buffer; @@ -4610,7 +4679,7 @@ comm_point_send_reply(struct comm_reply *repinfo) } } -void +void comm_point_drop_reply(struct comm_reply* repinfo) { if(!repinfo) @@ -4634,7 +4703,7 @@ comm_point_drop_reply(struct comm_reply* repinfo) reclaim_tcp_handler(repinfo->c); } -void +void comm_point_stop_listening(struct comm_point* c) { verbose(VERB_ALGO, "comm point stop listening %d", c->fd); @@ -4646,10 +4715,10 @@ comm_point_stop_listening(struct comm_point* c) } } -void +void comm_point_start_listening(struct comm_point* c, int newfd, int msec) { - verbose(VERB_ALGO, "comm point start listening %d (%d msec)", + verbose(VERB_ALGO, "comm point start listening %d (%d msec)", c->fd==-1?newfd:c->fd, msec); if(c->type == comm_tcp_accept && !c->tcp_free) { /* no use to start listening no free slots. */ @@ -4733,10 +4802,10 @@ void comm_point_listen_for_rw(struct comm_point* c, int rd, int wr) size_t comm_point_get_mem(struct comm_point* c) { size_t s; - if(!c) + if(!c) return 0; s = sizeof(*c) + sizeof(*c->ev); - if(c->timeout) + if(c->timeout) s += sizeof(*c->timeout); if(c->type == comm_tcp || c->type == comm_local) { s += sizeof(*c->buffer) + sldns_buffer_capacity(c->buffer); @@ -4755,7 +4824,7 @@ size_t comm_point_get_mem(struct comm_point* c) return s; } -struct comm_timer* +struct comm_timer* comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg) { struct internal_timer *tm = (struct internal_timer*)calloc(1, @@ -4768,7 +4837,7 @@ comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg) tm->base = base; tm->super.callback = cb; tm->super.cb_arg = cb_arg; - tm->ev = ub_event_new(base->eb->base, -1, UB_EV_TIMEOUT, + tm->ev = ub_event_new(base->eb->base, -1, UB_EV_TIMEOUT, comm_timer_callback, &tm->super); if(tm->ev == NULL) { log_err("timer_create: event_base_set failed."); @@ -4778,7 +4847,7 @@ comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg) return &tm->super; } -void +void comm_timer_disable(struct comm_timer* timer) { if(!timer) @@ -4787,7 +4856,7 @@ comm_timer_disable(struct comm_timer* timer) timer->ev_timer->enabled = 0; } -void +void comm_timer_set(struct comm_timer* timer, struct timeval* tv) { log_assert(tv); @@ -4799,7 +4868,7 @@ comm_timer_set(struct comm_timer* timer, struct timeval* tv) timer->ev_timer->enabled = 1; } -void +void comm_timer_delete(struct comm_timer* timer) { if(!timer) @@ -4812,7 +4881,7 @@ comm_timer_delete(struct comm_timer* timer) free(timer->ev_timer); } -void +void comm_timer_callback(int ATTR_UNUSED(fd), short event, void* arg) { struct comm_timer* tm = (struct comm_timer*)arg; @@ -4824,19 +4893,19 @@ comm_timer_callback(int ATTR_UNUSED(fd), short event, void* arg) (*tm->callback)(tm->cb_arg); } -int +int comm_timer_is_set(struct comm_timer* timer) { return (int)timer->ev_timer->enabled; } -size_t +size_t comm_timer_get_mem(struct comm_timer* ATTR_UNUSED(timer)) { return sizeof(struct internal_timer); } -struct comm_signal* +struct comm_signal* comm_signal_create(struct comm_base* base, void (*callback)(int, void*), void* cb_arg) { @@ -4853,7 +4922,7 @@ comm_signal_create(struct comm_base* base, return com; } -void +void comm_signal_callback(int sig, short event, void* arg) { struct comm_signal* comsig = (struct comm_signal*)arg; @@ -4864,10 +4933,10 @@ comm_signal_callback(int sig, short event, void* arg) (*comsig->callback)(sig, comsig->cb_arg); } -int +int comm_signal_bind(struct comm_signal* comsig, int sig) { - struct internal_signal* entry = (struct internal_signal*)calloc(1, + struct internal_signal* entry = (struct internal_signal*)calloc(1, sizeof(struct internal_signal)); if(!entry) { log_err("malloc failed"); @@ -4894,7 +4963,7 @@ comm_signal_bind(struct comm_signal* comsig, int sig) return 1; } -void +void comm_signal_delete(struct comm_signal* comsig) { struct internal_signal* p, *np; diff --git a/sbin/unwind/libunbound/util/netevent.h b/sbin/unwind/libunbound/util/netevent.h index 3e7849c13..dc9619c16 100644 --- a/sbin/unwind/libunbound/util/netevent.h +++ b/sbin/unwind/libunbound/util/netevent.h @@ -4,22 +4,22 @@ * Copyright (c) 2007, NLnet Labs. All rights reserved. * * This software is open source. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. - * + * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. - * + * * Neither the name of the NLNET LABS nor the names of its contributors may * be used to endorse or promote products derived from this software without * specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR @@ -60,6 +60,7 @@ #ifndef NET_EVENT_H #define NET_EVENT_H +#include #include "dnscrypt/dnscrypt.h" #ifdef HAVE_NGHTTP2_NGHTTP2_H #include @@ -83,7 +84,7 @@ struct internal_timer; /* A sub struct of the comm_timer super struct */ enum listen_type; /** callback from communication point function type */ -typedef int comm_point_callback_type(struct comm_point*, void*, int, +typedef int comm_point_callback_type(struct comm_point*, void*, int, struct comm_reply*); /** to pass no_error to callback function */ @@ -91,7 +92,7 @@ typedef int comm_point_callback_type(struct comm_point*, void*, int, /** to pass closed connection to callback function */ #define NETEVENT_CLOSED -1 /** to pass timeout happened to callback function */ -#define NETEVENT_TIMEOUT -2 +#define NETEVENT_TIMEOUT -2 /** to pass fallback from capsforID to callback function; 0x20 failed */ #define NETEVENT_CAPSFAIL -3 /** to pass done transfer to callback function; http file is complete */ @@ -165,8 +166,8 @@ struct comm_reply { socklen_t client_addrlen; }; -/** - * Communication point to the network +/** + * Communication point to the network * These behaviours can be accomplished by setting the flags * and passing return values from the callback. * udp frontside: called after readdone. sendafter. @@ -206,7 +207,7 @@ struct comm_point { int max_tcp_count; /** current number of tcp handler in-use for this accept socket */ int cur_tcp_count; - /** malloced array of tcp handlers for a tcp-accept, + /** malloced array of tcp handlers for a tcp-accept, of size max_tcp_count. */ struct comm_point** tcp_handlers; /** linked list of free tcp_handlers to use for new queries. @@ -271,9 +272,9 @@ struct comm_point { /** is this a UDP, TCP-accept or TCP socket. */ enum comm_point_type { /** UDP socket - handle datagrams. */ - comm_udp, + comm_udp, /** TCP accept socket - only creates handlers if readable. */ - comm_tcp_accept, + comm_tcp_accept, /** TCP handler socket - handle byteperbyte readwrite. */ comm_tcp, /** HTTP handler socket */ @@ -282,7 +283,7 @@ struct comm_point { comm_local, /** raw - not DNS format - for pipe readers and writers */ comm_raw - } + } /** variable with type of socket, UDP,TCP-accept,TCP,pipe */ type; @@ -303,7 +304,7 @@ struct comm_point { /** if set the connection is NOT closed on delete. */ int do_not_close; - /** if set, the connection is closed on error, on timeout, + /** if set, the connection is closed on error, on timeout, and after read/write completes. No callback is done. */ int tcp_do_close; @@ -383,15 +384,16 @@ struct comm_point { /** number of queries outstanding on this socket, used by * outside network for udp ports */ int inuse; - + /** the timestamp when the packet was received by the kernel */ + struct timeval recv_tv; /** callback when done. tcp_accept does not get called back, is NULL then. If a timeout happens, callback with timeout=1 is called. - If an error happens, callback is called with error set + If an error happens, callback is called with error set nonzero. If not NETEVENT_NOERROR, it is an errno value. If the connection is closed (by remote end) then the callback is called with error set to NETEVENT_CLOSED=-1. - If a timeout happens on the connection, the error is set to + If a timeout happens on the connection, the error is set to NETEVENT_TIMEOUT=-2. The reply_info can be copied if the reply needs to happen at a later time. It consists of a struct with commpoint and address. @@ -399,7 +401,7 @@ struct comm_point { Note the reply information is temporary and must be copied. NULL is passed for_reply info, in cases where error happened. - declare as: + declare as: int my_callback(struct comm_point* c, void* my_arg, int error, struct comm_reply *reply_info); @@ -446,14 +448,14 @@ struct comm_signal { /** * Create a new comm base. - * @param sigs: if true it attempts to create a default loop for + * @param sigs: if true it attempts to create a default loop for * signal handling. * @return: the new comm base. NULL on error. */ struct comm_base* comm_base_create(int sigs); /** - * Create comm base that uses the given ub_event_base (underlying pluggable + * Create comm base that uses the given ub_event_base (underlying pluggable * event mechanism pointer). * @param base: underlying pluggable event base. * @return: the new comm base. NULL on error. @@ -619,7 +621,7 @@ struct comm_point* comm_point_create_http_out(struct comm_base* base, * @return: the commpoint or NULL on error. */ struct comm_point* comm_point_create_local(struct comm_base* base, - int fd, size_t bufsize, + int fd, size_t bufsize, comm_point_callback_type* callback, void* callback_arg); /** @@ -632,7 +634,7 @@ struct comm_point* comm_point_create_local(struct comm_base* base, * @return: the commpoint or NULL on error. */ struct comm_point* comm_point_create_raw(struct comm_base* base, - int fd, int writing, + int fd, int writing, comm_point_callback_type* callback, void* callback_arg); /** @@ -722,7 +724,7 @@ size_t comm_point_get_mem(struct comm_point* c); * @param cb_arg: user callback argument. * @return: the new timer or NULL on error. */ -struct comm_timer* comm_timer_create(struct comm_base* base, +struct comm_timer* comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg); /** @@ -792,7 +794,7 @@ void comm_signal_delete(struct comm_signal* comsig); * if -1, error message has been printed if necessary, simply drop * out of the reading handler. */ -int comm_point_perform_accept(struct comm_point* c, +int comm_point_perform_accept(struct comm_point* c, struct sockaddr_storage* addr, socklen_t* addrlen); /**** internal routines ****/ @@ -801,7 +803,7 @@ int comm_point_perform_accept(struct comm_point* c, * This routine is published for checks and tests, and is only used internally. * handle libevent callback for udp comm point. * @param fd: file descriptor. - * @param event: event bits from libevent: + * @param event: event bits from libevent: * EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT. * @param arg: the comm_point structure. */ @@ -811,7 +813,7 @@ void comm_point_udp_callback(int fd, short event, void* arg); * This routine is published for checks and tests, and is only used internally. * handle libevent callback for udp ancillary data comm point. * @param fd: file descriptor. - * @param event: event bits from libevent: + * @param event: event bits from libevent: * EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT. * @param arg: the comm_point structure. */ @@ -821,7 +823,7 @@ void comm_point_udp_ancil_callback(int fd, short event, void* arg); * This routine is published for checks and tests, and is only used internally. * handle libevent callback for tcp accept comm point * @param fd: file descriptor. - * @param event: event bits from libevent: + * @param event: event bits from libevent: * EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT. * @param arg: the comm_point structure. */ @@ -831,7 +833,7 @@ void comm_point_tcp_accept_callback(int fd, short event, void* arg); * This routine is published for checks and tests, and is only used internally. * handle libevent callback for tcp data comm point * @param fd: file descriptor. - * @param event: event bits from libevent: + * @param event: event bits from libevent: * EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT. * @param arg: the comm_point structure. */ @@ -841,7 +843,7 @@ void comm_point_tcp_handle_callback(int fd, short event, void* arg); * This routine is published for checks and tests, and is only used internally. * handle libevent callback for tcp data comm point * @param fd: file descriptor. - * @param event: event bits from libevent: + * @param event: event bits from libevent: * EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT. * @param arg: the comm_point structure. */ @@ -955,7 +957,7 @@ void http2_stream_add_meshstate(struct http2_stream* h2_stream, * This routine is published for checks and tests, and is only used internally. * handle libevent callback for timer comm. * @param fd: file descriptor (always -1). - * @param event: event bits from libevent: + * @param event: event bits from libevent: * EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT. * @param arg: the comm_timer structure. */ @@ -965,7 +967,7 @@ void comm_timer_callback(int fd, short event, void* arg); * This routine is published for checks and tests, and is only used internally. * handle libevent callback for signal comm. * @param fd: file descriptor (used for the signal number). - * @param event: event bits from libevent: + * @param event: event bits from libevent: * EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT. * @param arg: the internal commsignal structure. */ @@ -975,7 +977,7 @@ void comm_signal_callback(int fd, short event, void* arg); * This routine is published for checks and tests, and is only used internally. * libevent callback for AF_UNIX fds * @param fd: file descriptor. - * @param event: event bits from libevent: + * @param event: event bits from libevent: * EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT. * @param arg: the comm_point structure. */ @@ -985,7 +987,7 @@ void comm_point_local_handle_callback(int fd, short event, void* arg); * This routine is published for checks and tests, and is only used internally. * libevent callback for raw fd access. * @param fd: file descriptor. - * @param event: event bits from libevent: + * @param event: event bits from libevent: * EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT. * @param arg: the comm_point structure. */ @@ -995,7 +997,7 @@ void comm_point_raw_handle_callback(int fd, short event, void* arg); * This routine is published for checks and tests, and is only used internally. * libevent callback for timeout on slow accept. * @param fd: file descriptor. - * @param event: event bits from libevent: + * @param event: event bits from libevent: * EV_READ, EV_WRITE, EV_SIGNAL, EV_TIMEOUT. * @param arg: the comm_point structure. */ diff --git a/sbin/unwind/libunbound/util/regional.c b/sbin/unwind/libunbound/util/regional.c index 93e911c5e..44aee68b2 100644 --- a/sbin/unwind/libunbound/util/regional.c +++ b/sbin/unwind/libunbound/util/regional.c @@ -186,7 +186,7 @@ regional_alloc_init(struct regional* r, const void *init, size_t size) { void *s = regional_alloc(r, size); if(!s) return NULL; - memcpy(s, init, size); + memmove(s, init, size); return s; } diff --git a/sbin/unwind/libunbound/util/rfc_1982.c b/sbin/unwind/libunbound/util/rfc_1982.c new file mode 100644 index 000000000..cf64e21d0 --- /dev/null +++ b/sbin/unwind/libunbound/util/rfc_1982.c @@ -0,0 +1,75 @@ +/* + * util/rfc_1982.c - RFC 1982 Serial Number Arithmetic + * + * Copyright (c) 2023, NLnet Labs. All rights reserved. + * + * This software is open source. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of the NLNET LABS nor the names of its contributors may + * be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * \file + * + * This file contains functions for RFC 1982 serial number arithmetic. + */ +#include "config.h" +#include "util/rfc_1982.h" + +int +compare_1982(uint32_t a, uint32_t b) +{ + /* for 32 bit values */ + const uint32_t cutoff = ((uint32_t) 1 << (32 - 1)); + + if (a == b) { + return 0; + } else if ((a < b && b - a < cutoff) || (a > b && a - b > cutoff)) { + return -1; + } else { + return 1; + } +} + +uint32_t +subtract_1982(uint32_t a, uint32_t b) +{ + /* for 32 bit values */ + const uint32_t cutoff = ((uint32_t) 1 << (32 - 1)); + + if(a == b) + return 0; + if(a < b && b - a < cutoff) { + return b-a; + } + if(a > b && a - b > cutoff) { + return ((uint32_t)0xffffffff) - (a-b-1); + } + /* wrong case, b smaller than a */ + return 0; +} diff --git a/sbin/unwind/libunbound/util/rfc_1982.h b/sbin/unwind/libunbound/util/rfc_1982.h new file mode 100644 index 000000000..bae383d0e --- /dev/null +++ b/sbin/unwind/libunbound/util/rfc_1982.h @@ -0,0 +1,63 @@ +/* + * util/rfc_1982.h - RFC 1982 Serial Number Arithmetic + * + * Copyright (c) 2023, NLnet Labs. All rights reserved. + * + * This software is open source. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of the NLNET LABS nor the names of its contributors may + * be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * \file + * + * This file contains functions for RFC 1982 serial number arithmetic. + */ +#ifndef RFC_1982_H +#define RFC_1982_H + +/** + * RFC 1982 comparison, uses unsigned integers, and tries to avoid + * compiler optimization (eg. by avoiding a-b<0 comparisons). + * @param a: value to compare. + * @param b: value to compare. + * @return 0 if equal, 1 if a > b, else -1. + */ +int compare_1982(uint32_t a, uint32_t b); + +/** + * RFC 1982 subtraction, uses unsigned integers, and tries to avoid + * compiler optimization (eg. by avoiding a-b<0 comparisons). + * @param a: value to subtract from. + * @param b: value to subtract. + * @return the difference between them if we know that b is larger than a, + * that is the distance between them in serial number arithmetic. + */ +uint32_t subtract_1982(uint32_t a, uint32_t b); + +#endif /* RFC_1982_H */ diff --git a/sbin/unwind/libunbound/util/siphash.c b/sbin/unwind/libunbound/util/siphash.c new file mode 100644 index 000000000..32797dff6 --- /dev/null +++ b/sbin/unwind/libunbound/util/siphash.c @@ -0,0 +1,192 @@ +/* + SipHash reference C implementation + + Copyright (c) 2012-2016 Jean-Philippe Aumasson + + Copyright (c) 2012-2014 Daniel J. Bernstein + + To the extent possible under law, the author(s) have dedicated all copyright + and related and neighboring rights to this software to the public domain + worldwide. This software is distributed without any warranty. + + You should have received a copy of the CC0 Public Domain Dedication along + with + this software. If not, see + . + */ +/** + * Edited slightly for integration in Unbound. Edits are noted with 'EDIT'. + */ +/** EDIT + * \#include + * \#include + * \#include + * \#include + * Replaced the above includes with Unbound's config.h + */ +#include "config.h" + +/** EDIT + * prevent warning from -Wmissing-prototypes + */ +#include "util/siphash.h" + +/* default: SipHash-2-4 */ +#define cROUNDS 2 +#define dROUNDS 4 + +#define ROTL(x, b) (uint64_t)(((x) << (b)) | ((x) >> (64 - (b)))) + +#define U32TO8_LE(p, v) \ + (p)[0] = (uint8_t)((v)); \ + (p)[1] = (uint8_t)((v) >> 8); \ + (p)[2] = (uint8_t)((v) >> 16); \ + (p)[3] = (uint8_t)((v) >> 24); + +#define U64TO8_LE(p, v) \ + U32TO8_LE((p), (uint32_t)((v))); \ + U32TO8_LE((p) + 4, (uint32_t)((v) >> 32)); + +#define U8TO64_LE(p) \ + (((uint64_t)((p)[0])) | ((uint64_t)((p)[1]) << 8) | \ + ((uint64_t)((p)[2]) << 16) | ((uint64_t)((p)[3]) << 24) | \ + ((uint64_t)((p)[4]) << 32) | ((uint64_t)((p)[5]) << 40) | \ + ((uint64_t)((p)[6]) << 48) | ((uint64_t)((p)[7]) << 56)) + +#define SIPROUND \ + do { \ + v0 += v1; \ + v1 = ROTL(v1, 13); \ + v1 ^= v0; \ + v0 = ROTL(v0, 32); \ + v2 += v3; \ + v3 = ROTL(v3, 16); \ + v3 ^= v2; \ + v0 += v3; \ + v3 = ROTL(v3, 21); \ + v3 ^= v0; \ + v2 += v1; \ + v1 = ROTL(v1, 17); \ + v1 ^= v2; \ + v2 = ROTL(v2, 32); \ + } while (0) + +#ifdef DEBUG +#define TRACE \ + do { \ + printf("(%3d) v0 %08x %08x\n", (int)inlen, (uint32_t)(v0 >> 32), \ + (uint32_t)v0); \ + printf("(%3d) v1 %08x %08x\n", (int)inlen, (uint32_t)(v1 >> 32), \ + (uint32_t)v1); \ + printf("(%3d) v2 %08x %08x\n", (int)inlen, (uint32_t)(v2 >> 32), \ + (uint32_t)v2); \ + printf("(%3d) v3 %08x %08x\n", (int)inlen, (uint32_t)(v3 >> 32), \ + (uint32_t)v3); \ + } while (0) +#else +#define TRACE +#endif + +int siphash(const uint8_t *in, const size_t inlen, const uint8_t *k, + uint8_t *out, const size_t outlen) { + + uint64_t v0 = 0x736f6d6570736575ULL; + uint64_t v1 = 0x646f72616e646f6dULL; + uint64_t v2 = 0x6c7967656e657261ULL; + uint64_t v3 = 0x7465646279746573ULL; + uint64_t k0 = U8TO64_LE(k); + uint64_t k1 = U8TO64_LE(k + 8); + uint64_t m; + int i; + const uint8_t *end = in + inlen - (inlen % sizeof(uint64_t)); + const int left = inlen & 7; + uint64_t b = ((uint64_t)inlen) << 56; + /** EDIT + * The following assert moved here from the top for C90 compliance. + */ + assert((outlen == 8) || (outlen == 16)); + v3 ^= k1; + v2 ^= k0; + v1 ^= k1; + v0 ^= k0; + + if (outlen == 16) + v1 ^= 0xee; + + for (; in != end; in += 8) { + m = U8TO64_LE(in); + v3 ^= m; + + TRACE; + for (i = 0; i < cROUNDS; ++i) + SIPROUND; + + v0 ^= m; + } + + switch (left) { + case 7: + b |= ((uint64_t)in[6]) << 48; + /** EDIT annotate case statement fallthrough for gcc */ + /* fallthrough */ + case 6: + b |= ((uint64_t)in[5]) << 40; + /** EDIT annotate case statement fallthrough for gcc */ + /* fallthrough */ + case 5: + b |= ((uint64_t)in[4]) << 32; + /** EDIT annotate case statement fallthrough for gcc */ + /* fallthrough */ + case 4: + b |= ((uint64_t)in[3]) << 24; + /** EDIT annotate case statement fallthrough for gcc */ + /* fallthrough */ + case 3: + b |= ((uint64_t)in[2]) << 16; + /** EDIT annotate case statement fallthrough for gcc */ + /* fallthrough */ + case 2: + b |= ((uint64_t)in[1]) << 8; + /** EDIT annotate case statement fallthrough for gcc */ + /* fallthrough */ + case 1: + b |= ((uint64_t)in[0]); + break; + case 0: + break; + } + + v3 ^= b; + + TRACE; + for (i = 0; i < cROUNDS; ++i) + SIPROUND; + + v0 ^= b; + + if (outlen == 16) + v2 ^= 0xee; + else + v2 ^= 0xff; + + TRACE; + for (i = 0; i < dROUNDS; ++i) + SIPROUND; + + b = v0 ^ v1 ^ v2 ^ v3; + U64TO8_LE(out, b); + + if (outlen == 8) + return 0; + + v1 ^= 0xdd; + + TRACE; + for (i = 0; i < dROUNDS; ++i) + SIPROUND; + + b = v0 ^ v1 ^ v2 ^ v3; + U64TO8_LE(out + 8, b); + + return 0; +} diff --git a/sbin/unwind/libunbound/util/siphash.h b/sbin/unwind/libunbound/util/siphash.h new file mode 100644 index 000000000..63da2175c --- /dev/null +++ b/sbin/unwind/libunbound/util/siphash.h @@ -0,0 +1,43 @@ +/* + * util/siphash.h - header for SipHash reference C implementation. + * + * Copyright (c) 2023, NLnet Labs. All rights reserved. + * + * This software is open source. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of the NLNET LABS nor the names of its contributors may + * be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ +/** + * \file + * Contains the SipHash reference C implementation. + */ +#ifndef UTIL_SIPHASH_H +#define UTIL_SIPHASH_H +int siphash(const uint8_t *in, const size_t inlen, const uint8_t *k, + uint8_t *out, const size_t outlen); +#endif /* UTIL_SIPHASH_H */ diff --git a/sbin/unwind/libunbound/util/storage/lruhash.c b/sbin/unwind/libunbound/util/storage/lruhash.c index 3500a4ef0..e17b180db 100644 --- a/sbin/unwind/libunbound/util/storage/lruhash.c +++ b/sbin/unwind/libunbound/util/storage/lruhash.c @@ -81,6 +81,7 @@ lruhash_create(size_t start_size, size_t maxmem, table->num = 0; table->space_used = 0; table->space_max = maxmem; + table->max_collisions = 0; table->array = calloc(table->size, sizeof(struct lruhash_bin)); if(!table->array) { lock_quick_destroy(&table->lock); @@ -216,15 +217,19 @@ reclaim_space(struct lruhash* table, struct lruhash_entry** list) struct lruhash_entry* bin_find_entry(struct lruhash* table, - struct lruhash_bin* bin, hashvalue_type hash, void* key) + struct lruhash_bin* bin, hashvalue_type hash, void* key, size_t* collisions) { + size_t c = 0; struct lruhash_entry* p = bin->overflow_list; while(p) { if(p->hash == hash && table->compfunc(p->key, key) == 0) - return p; + break; + c++; p = p->overflow_next; } - return NULL; + if (collisions != NULL) + *collisions = c; + return p; } void @@ -303,6 +308,7 @@ lruhash_insert(struct lruhash* table, hashvalue_type hash, struct lruhash_bin* bin; struct lruhash_entry* found, *reclaimlist=NULL; size_t need_size; + size_t collisions; fptr_ok(fptr_whitelist_hash_sizefunc(table->sizefunc)); fptr_ok(fptr_whitelist_hash_delkeyfunc(table->delkeyfunc)); fptr_ok(fptr_whitelist_hash_deldatafunc(table->deldatafunc)); @@ -317,12 +323,14 @@ lruhash_insert(struct lruhash* table, hashvalue_type hash, lock_quick_lock(&bin->lock); /* see if entry exists already */ - if(!(found=bin_find_entry(table, bin, hash, entry->key))) { + if(!(found=bin_find_entry(table, bin, hash, entry->key, &collisions))) { /* if not: add to bin */ entry->overflow_next = bin->overflow_list; bin->overflow_list = entry; lru_front(table, entry); table->num++; + if (table->max_collisions < collisions) + table->max_collisions = collisions; table->space_used += need_size; } else { /* if so: update data - needs a writelock */ @@ -362,7 +370,7 @@ lruhash_lookup(struct lruhash* table, hashvalue_type hash, void* key, int wr) lock_quick_lock(&table->lock); bin = &table->array[hash & table->size_mask]; lock_quick_lock(&bin->lock); - if((entry=bin_find_entry(table, bin, hash, key))) + if((entry=bin_find_entry(table, bin, hash, key, NULL))) lru_touch(table, entry); lock_quick_unlock(&table->lock); @@ -389,7 +397,7 @@ lruhash_remove(struct lruhash* table, hashvalue_type hash, void* key) lock_quick_lock(&table->lock); bin = &table->array[hash & table->size_mask]; lock_quick_lock(&bin->lock); - if((entry=bin_find_entry(table, bin, hash, key))) { + if((entry=bin_find_entry(table, bin, hash, key, NULL))) { bin_overflow_remove(bin, entry); lru_remove(table, entry); } else { @@ -579,6 +587,7 @@ lruhash_insert_or_retrieve(struct lruhash* table, hashvalue_type hash, struct lruhash_bin* bin; struct lruhash_entry* found, *reclaimlist = NULL; size_t need_size; + size_t collisions; fptr_ok(fptr_whitelist_hash_sizefunc(table->sizefunc)); fptr_ok(fptr_whitelist_hash_delkeyfunc(table->delkeyfunc)); fptr_ok(fptr_whitelist_hash_deldatafunc(table->deldatafunc)); @@ -593,7 +602,7 @@ lruhash_insert_or_retrieve(struct lruhash* table, hashvalue_type hash, lock_quick_lock(&bin->lock); /* see if entry exists already */ - if ((found = bin_find_entry(table, bin, hash, entry->key)) != NULL) { + if ((found = bin_find_entry(table, bin, hash, entry->key, &collisions)) != NULL) { /* if so: keep the existing data - acquire a writelock */ lock_rw_wrlock(&found->lock); } @@ -604,6 +613,8 @@ lruhash_insert_or_retrieve(struct lruhash* table, hashvalue_type hash, bin->overflow_list = entry; lru_front(table, entry); table->num++; + if (table->max_collisions < collisions) + table->max_collisions = collisions; table->space_used += need_size; /* return the entry that was presented, and lock it */ found = entry; diff --git a/sbin/unwind/libunbound/util/storage/lruhash.h b/sbin/unwind/libunbound/util/storage/lruhash.h index 4759b5001..2086e4dec 100644 --- a/sbin/unwind/libunbound/util/storage/lruhash.h +++ b/sbin/unwind/libunbound/util/storage/lruhash.h @@ -178,6 +178,8 @@ struct lruhash { size_t space_used; /** the amount of space the hash table is maximally allowed to use. */ size_t space_max; + /** the maximum collisions were detected during the lruhash_insert operations. */ + size_t max_collisions; }; /** @@ -357,10 +359,11 @@ void bin_delete(struct lruhash* table, struct lruhash_bin* bin); * @param bin: hash bin to look into. * @param hash: hash value to look for. * @param key: key to look for. + * @param collisions: how many collisions were found during the search. * @return: the entry or NULL if not found. */ struct lruhash_entry* bin_find_entry(struct lruhash* table, - struct lruhash_bin* bin, hashvalue_type hash, void* key); + struct lruhash_bin* bin, hashvalue_type hash, void* key, size_t* collisions); /** * Remove entry from bin overflow chain. diff --git a/sbin/unwind/libunbound/util/storage/slabhash.c b/sbin/unwind/libunbound/util/storage/slabhash.c index a6c3d0fa6..7d376c4d6 100644 --- a/sbin/unwind/libunbound/util/storage/slabhash.c +++ b/sbin/unwind/libunbound/util/storage/slabhash.c @@ -242,3 +242,21 @@ size_t count_slabhash_entries(struct slabhash* sh) } return cnt; } + +void get_slabhash_stats(struct slabhash* sh, long long* num, long long* collisions) +{ + size_t slab, cnt = 0, max_collisions = 0; + + for(slab=0; slabsize; slab++) { + lock_quick_lock(&sh->array[slab]->lock); + cnt += sh->array[slab]->num; + if (max_collisions < sh->array[slab]->max_collisions) { + max_collisions = sh->array[slab]->max_collisions; + } + lock_quick_unlock(&sh->array[slab]->lock); + } + if (num != NULL) + *num = cnt; + if (collisions != NULL) + *collisions = max_collisions; +} diff --git a/sbin/unwind/libunbound/util/storage/slabhash.h b/sbin/unwind/libunbound/util/storage/slabhash.h index 4ecb60421..dc5fc3603 100644 --- a/sbin/unwind/libunbound/util/storage/slabhash.h +++ b/sbin/unwind/libunbound/util/storage/slabhash.h @@ -200,6 +200,15 @@ void slabhash_traverse(struct slabhash* table, int wr, */ size_t count_slabhash_entries(struct slabhash* table); +/** + * Retrieves number of items in slabhash and the current max collision level + * @param table: slabbed hash table. + * @param entries_count: where to save the current number of elements. + * @param max_collisions: where to save the current max collisions level. + */ +void get_slabhash_stats(struct slabhash* table, + long long* entries_count, long long* max_collisions); + /* --- test representation --- */ /** test structure contains test key */ struct slabhash_testkey { diff --git a/sbin/unwind/libunbound/util/timehist.c b/sbin/unwind/libunbound/util/timehist.c index 61cc995fd..2063fe80e 100644 --- a/sbin/unwind/libunbound/util/timehist.c +++ b/sbin/unwind/libunbound/util/timehist.c @@ -4,22 +4,22 @@ * Copyright (c) 2007, NLnet Labs. All rights reserved. * * This software is open source. - * + * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: - * + * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. - * + * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. - * + * * Neither the name of the NLNET LABS nor the names of its contributors may * be used to endorse or promote products derived from this software without * specific prior written permission. - * + * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR @@ -46,6 +46,7 @@ #include #include "util/timehist.h" #include "util/log.h" +#include "util/timeval_func.h" /** special timestwo operation for time values in histogram setup */ static void @@ -83,12 +84,12 @@ dosetup(struct timehist* hist) struct timehist* timehist_setup(void) { - struct timehist* hist = (struct timehist*)calloc(1, + struct timehist* hist = (struct timehist*)calloc(1, sizeof(struct timehist)); if(!hist) return NULL; hist->num = NUM_BUCKETS_HIST; - hist->buckets = (struct th_buck*)calloc(hist->num, + hist->buckets = (struct th_buck*)calloc(hist->num, sizeof(struct th_buck)); if(!hist->buckets) { free(hist); @@ -114,23 +115,6 @@ void timehist_clear(struct timehist* hist) hist->buckets[i].count = 0; } -/** histogram compare of time values */ -static int -timeval_smaller(const struct timeval* x, const struct timeval* y) -{ -#ifndef S_SPLINT_S - if(x->tv_sec < y->tv_sec) - return 1; - else if(x->tv_sec == y->tv_sec) { - if(x->tv_usec <= y->tv_usec) - return 1; - else return 0; - } - else return 0; -#endif -} - - void timehist_insert(struct timehist* hist, struct timeval* tv) { size_t i; @@ -194,7 +178,7 @@ timehist_count(struct timehist* hist) return res; } -double +double timehist_quartile(struct timehist* hist, double q) { double lookfor, passed, res; @@ -209,22 +193,22 @@ timehist_quartile(struct timehist* hist, double q) lookfor *= q; passed = 0; i = 0; - while(i+1 < hist->num && + while(i+1 < hist->num && passed+(double)hist->buckets[i].count < lookfor) { passed += (double)hist->buckets[i++].count; } /* got the right bucket */ #ifndef S_SPLINT_S - low = (double)hist->buckets[i].lower.tv_sec + + low = (double)hist->buckets[i].lower.tv_sec + (double)hist->buckets[i].lower.tv_usec/1000000.; - up = (double)hist->buckets[i].upper.tv_sec + + up = (double)hist->buckets[i].upper.tv_sec + (double)hist->buckets[i].upper.tv_usec/1000000.; #endif res = (lookfor - passed)*(up-low)/((double)hist->buckets[i].count); return low+res; } -void +void timehist_export(struct timehist* hist, long long* array, size_t sz) { size_t i; @@ -235,7 +219,7 @@ timehist_export(struct timehist* hist, long long* array, size_t sz) array[i] = (long long)hist->buckets[i].count; } -void +void timehist_import(struct timehist* hist, long long* array, size_t sz) { size_t i; diff --git a/sbin/unwind/libunbound/util/timeval_func.c b/sbin/unwind/libunbound/util/timeval_func.c new file mode 100644 index 000000000..90250e153 --- /dev/null +++ b/sbin/unwind/libunbound/util/timeval_func.c @@ -0,0 +1,113 @@ +/* + * util/timeval_func.c - helpers to work with struct timeval values. + * + * Copyright (c) 2023, NLnet Labs. All rights reserved. + * + * This software is open source. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of the NLNET LABS nor the names of its contributors may + * be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * \file + * + * This file contains helpers to manipulate struct timeval values. + */ + +#include "config.h" +#include "timeval_func.h" + +/** subtract timers and the values do not overflow or become negative */ +void +timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start) +{ +#ifndef S_SPLINT_S + time_t end_usec = end->tv_usec; + d->tv_sec = end->tv_sec - start->tv_sec; + if(end_usec < start->tv_usec) { + end_usec += 1000000; + d->tv_sec--; + } + d->tv_usec = end_usec - start->tv_usec; +#endif +} + +/** add timers and the values do not overflow or become negative */ +void +timeval_add(struct timeval* d, const struct timeval* add) +{ +#ifndef S_SPLINT_S + d->tv_sec += add->tv_sec; + d->tv_usec += add->tv_usec; + if(d->tv_usec >= 1000000 ) { + d->tv_usec -= 1000000; + d->tv_sec++; + } +#endif +} + +/** divide sum of timers to get average */ +void +timeval_divide(struct timeval* avg, const struct timeval* sum, long long d) +{ +#ifndef S_SPLINT_S + long long leftover; + if(d <= 0) { + avg->tv_sec = 0; + avg->tv_usec = 0; + return; + } + avg->tv_sec = sum->tv_sec / d; + avg->tv_usec = sum->tv_usec / d; + /* handle fraction from seconds divide */ + leftover = sum->tv_sec - avg->tv_sec*d; + if(leftover <= 0) + leftover = 0; + avg->tv_usec += (((long long)leftover)*((long long)1000000))/d; + if(avg->tv_sec < 0) + avg->tv_sec = 0; + if(avg->tv_usec < 0) + avg->tv_usec = 0; +#endif +} + +/** histogram compare of time values */ +int +timeval_smaller(const struct timeval* x, const struct timeval* y) +{ +#ifndef S_SPLINT_S + if(x->tv_sec < y->tv_sec) + return 1; + else if(x->tv_sec == y->tv_sec) { + if(x->tv_usec <= y->tv_usec) + return 1; + else return 0; + } + else return 0; +#endif +} diff --git a/sbin/unwind/libunbound/util/timeval_func.h b/sbin/unwind/libunbound/util/timeval_func.h new file mode 100644 index 000000000..819d1dd80 --- /dev/null +++ b/sbin/unwind/libunbound/util/timeval_func.h @@ -0,0 +1,53 @@ +/* + * util/timeval_func.h - definitions of helpers for struct timeval values. + * + * Copyright (c) 2023, NLnet Labs. All rights reserved. + * + * This software is open source. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of the NLNET LABS nor the names of its contributors may + * be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * \file + * + * This file contains definitions of helpers to manipulate struct timeval + * values, implemented in the corresponding C file. + */ +#include + +#ifndef timeval_isset +#define timeval_isset(tv) ((tv)->tv_sec || (tv)->tv_usec) +#endif +#ifndef timeval_clear +#define timeval_clear(tv) ((tv)->tv_sec = (tv)->tv_usec = 0) +#endif +void timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start); +void timeval_add(struct timeval* d, const struct timeval* add); +void timeval_divide(struct timeval* avg, const struct timeval* sum, long long d); +int timeval_smaller(const struct timeval* x, const struct timeval* y); diff --git a/sbin/unwind/libunbound/util/tube.c b/sbin/unwind/libunbound/util/tube.c index 43455feef..7d98b93c3 100644 --- a/sbin/unwind/libunbound/util/tube.c +++ b/sbin/unwind/libunbound/util/tube.c @@ -45,6 +45,9 @@ #include "util/netevent.h" #include "util/fptr_wlist.h" #include "util/ub_event.h" +#ifdef HAVE_POLL_H +#include +#endif #ifndef USE_WINSOCK /* on unix */ @@ -396,20 +399,28 @@ int tube_read_msg(struct tube* tube, uint8_t** buf, uint32_t* len, return 1; } -/** perform a select() on the fd */ +/** perform poll() on the fd */ static int pollit(int fd, struct timeval* t) { - fd_set r; + struct pollfd fds; + int pret; + int msec = -1; + memset(&fds, 0, sizeof(fds)); + fds.fd = fd; + fds.events = POLLIN | POLLERR | POLLHUP; #ifndef S_SPLINT_S - FD_ZERO(&r); - FD_SET(FD_SET_T fd, &r); + if(t) + msec = t->tv_sec*1000 + t->tv_usec/1000; #endif - if(select(fd+1, &r, NULL, NULL, t) == -1) { + + pret = poll(&fds, 1, msec); + + if(pret == -1) return 0; - } - errno = 0; - return (int)(FD_ISSET(fd, &r)); + if(pret != 0) + return 1; + return 0; } int tube_poll(struct tube* tube) @@ -426,24 +437,27 @@ int tube_wait(struct tube* tube) int tube_wait_timeout(struct tube* tube, int msec) { - struct timeval t; - int fd = tube->sr; - fd_set r; - t.tv_sec = msec/1000; - t.tv_usec = (msec%1000)*1000; -#ifndef S_SPLINT_S - FD_ZERO(&r); - FD_SET(FD_SET_T fd, &r); -#endif + int ret = 0; + while(1) { - if(select(fd+1, &r, NULL, NULL, &t) == -1) { + struct pollfd fds; + memset(&fds, 0, sizeof(fds)); + + fds.fd = tube->sr; + fds.events = POLLIN | POLLERR | POLLHUP; + ret = poll(&fds, 1, msec); + + if(ret == -1) { if(errno == EAGAIN || errno == EINTR) continue; return -1; } break; } - return (int)(FD_ISSET(fd, &r)); + + if(ret != 0) + return 1; + return 0; } int tube_read_fd(struct tube* tube) @@ -529,6 +543,7 @@ struct tube* tube_create(void) if(tube->event == WSA_INVALID_EVENT) { free(tube); log_err("WSACreateEvent: %s", wsa_strerror(WSAGetLastError())); + return NULL; } if(!WSAResetEvent(tube->event)) { log_err("WSAResetEvent: %s", wsa_strerror(WSAGetLastError())); diff --git a/sbin/unwind/libunbound/validator/autotrust.c b/sbin/unwind/libunbound/validator/autotrust.c index 3cdf9ceae..3011a0ace 100644 --- a/sbin/unwind/libunbound/validator/autotrust.c +++ b/sbin/unwind/libunbound/validator/autotrust.c @@ -2376,6 +2376,8 @@ probe_anchor(struct module_env* env, struct trust_anchor* tp) edns.opt_list_out = NULL; edns.opt_list_inplace_cb_out = NULL; edns.padding_block_size = 0; + edns.cookie_present = 0; + edns.cookie_valid = 0; if(sldns_buffer_capacity(buf) < 65535) edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); else edns.udp_size = 65535; diff --git a/sbin/unwind/libunbound/validator/val_kcache.c b/sbin/unwind/libunbound/validator/val_kcache.c index c190085b5..f5d49d24f 100644 --- a/sbin/unwind/libunbound/validator/val_kcache.c +++ b/sbin/unwind/libunbound/validator/val_kcache.c @@ -81,17 +81,11 @@ key_cache_delete(struct key_cache* kcache) void key_cache_insert(struct key_cache* kcache, struct key_entry_key* kkey, - struct module_qstate* qstate) + int copy_reason) { - struct key_entry_key* k = key_entry_copy(kkey); + struct key_entry_key* k = key_entry_copy(kkey, copy_reason); if(!k) return; - if(key_entry_isbad(k) && qstate->errinf && - qstate->env->cfg->val_log_level >= 2) { - /* on malloc failure there is simply no reason string */ - key_entry_set_reason(k, errinf_to_str_bogus(qstate)); - key_entry_set_reason_bogus(k, errinf_to_reason_bogus(qstate)); - } key_entry_hash(k); slabhash_insert(kcache->slab, k->entry.hash, &k->entry, k->entry.data, NULL); diff --git a/sbin/unwind/libunbound/validator/val_kcache.h b/sbin/unwind/libunbound/validator/val_kcache.h index 76c9dd094..df8de0999 100644 --- a/sbin/unwind/libunbound/validator/val_kcache.h +++ b/sbin/unwind/libunbound/validator/val_kcache.h @@ -76,10 +76,10 @@ void key_cache_delete(struct key_cache* kcache); * @param kcache: the key cache. * @param kkey: key entry key, assumed malloced in a region, is copied * to perform update or insertion. Its data pointer is also copied. - * @param qstate: store errinf reason in case its bad. + * @param copy_reason: if the reason string needs to be copied (allocated). */ void key_cache_insert(struct key_cache* kcache, struct key_entry_key* kkey, - struct module_qstate* qstate); + int copy_reason); /** * Remove an entry from the key cache. diff --git a/sbin/unwind/libunbound/validator/val_kentry.c b/sbin/unwind/libunbound/validator/val_kentry.c index a47feba61..85f026402 100644 --- a/sbin/unwind/libunbound/validator/val_kentry.c +++ b/sbin/unwind/libunbound/validator/val_kentry.c @@ -152,7 +152,7 @@ key_entry_copy_toregion(struct key_entry_key* kkey, struct regional* region) } struct key_entry_key* -key_entry_copy(struct key_entry_key* kkey) +key_entry_copy(struct key_entry_key* kkey, int copy_reason) { struct key_entry_key* newk; if(!kkey) @@ -190,7 +190,7 @@ key_entry_copy(struct key_entry_key* kkey) } packed_rrset_ptr_fixup(newd->rrset_data); } - if(d->reason) { + if(copy_reason && d->reason && *d->reason != 0) { newd->reason = strdup(d->reason); if(!newd->reason) { free(newd->rrset_data); @@ -199,6 +199,8 @@ key_entry_copy(struct key_entry_key* kkey) free(newk); return NULL; } + } else { + newd->reason = NULL; } if(d->algo) { newd->algo = (uint8_t*)strdup((char*)d->algo); @@ -237,22 +239,6 @@ key_entry_isbad(struct key_entry_key* kkey) return (int)(d->isbad); } -void -key_entry_set_reason(struct key_entry_key* kkey, char* reason) -{ - struct key_entry_data* d = (struct key_entry_data*)kkey->entry.data; - d->reason = reason; -} - -void -key_entry_set_reason_bogus(struct key_entry_key* kkey, sldns_ede_code ede) -{ - struct key_entry_data* d = (struct key_entry_data*)kkey->entry.data; - if (ede != LDNS_EDE_NONE) { /* reason_bogus init is LDNS_EDE_NONE already */ - d->reason_bogus = ede; - } -} - char* key_entry_get_reason(struct key_entry_key* kkey) { @@ -294,6 +280,7 @@ key_entry_setup(struct regional* region, struct key_entry_key* key_entry_create_null(struct regional* region, uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, + sldns_ede_code reason_bogus, const char* reason, time_t now) { struct key_entry_key* k; @@ -302,8 +289,10 @@ key_entry_create_null(struct regional* region, return NULL; d->ttl = now + ttl; d->isbad = 0; - d->reason = NULL; - d->reason_bogus = LDNS_EDE_NONE; + d->reason = (!reason || *reason == 0) + ?NULL :(char*)regional_strdup(region, reason); + /* On allocation error we don't store the reason string */ + d->reason_bogus = reason_bogus; d->rrset_type = LDNS_RR_TYPE_DNSKEY; d->rrset_data = NULL; d->algo = NULL; @@ -313,7 +302,9 @@ key_entry_create_null(struct regional* region, struct key_entry_key* key_entry_create_rrset(struct regional* region, uint8_t* name, size_t namelen, uint16_t dclass, - struct ub_packed_rrset_key* rrset, uint8_t* sigalg, time_t now) + struct ub_packed_rrset_key* rrset, uint8_t* sigalg, + sldns_ede_code reason_bogus, const char* reason, + time_t now) { struct key_entry_key* k; struct key_entry_data* d; @@ -323,8 +314,10 @@ key_entry_create_rrset(struct regional* region, return NULL; d->ttl = rd->ttl + now; d->isbad = 0; - d->reason = NULL; - d->reason_bogus = LDNS_EDE_NONE; + d->reason = (!reason || *reason == 0) + ?NULL :(char*)regional_strdup(region, reason); + /* On allocation error we don't store the reason string */ + d->reason_bogus = reason_bogus; d->rrset_type = ntohs(rrset->rk.type); d->rrset_data = (struct packed_rrset_data*)regional_alloc_init(region, rd, packed_rrset_sizeof(rd)); @@ -341,7 +334,8 @@ key_entry_create_rrset(struct regional* region, struct key_entry_key* key_entry_create_bad(struct regional* region, - uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, + uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, + sldns_ede_code reason_bogus, const char* reason, time_t now) { struct key_entry_key* k; @@ -350,8 +344,10 @@ key_entry_create_bad(struct regional* region, return NULL; d->ttl = now + ttl; d->isbad = 1; - d->reason = NULL; - d->reason_bogus = LDNS_EDE_NONE; + d->reason = (!reason || *reason == 0) + ?NULL :(char*)regional_strdup(region, reason); + /* On allocation error we don't store the reason string */ + d->reason_bogus = reason_bogus; d->rrset_type = LDNS_RR_TYPE_DNSKEY; d->rrset_data = NULL; d->algo = NULL; diff --git a/sbin/unwind/libunbound/validator/val_kentry.h b/sbin/unwind/libunbound/validator/val_kentry.h index ded45beaa..ca9f0dabc 100644 --- a/sbin/unwind/libunbound/validator/val_kentry.h +++ b/sbin/unwind/libunbound/validator/val_kentry.h @@ -120,9 +120,11 @@ struct key_entry_key* key_entry_copy_toregion(struct key_entry_key* kkey, /** * Copy a key entry, malloced. * @param kkey: the key entry key (and data pointer) to copy. + * @param copy_reason: if the reason string needs to be copied (allocated). * @return newly allocated entry or NULL on a failure to allocate memory. */ -struct key_entry_key* key_entry_copy(struct key_entry_key* kkey); +struct key_entry_key* key_entry_copy(struct key_entry_key* kkey, + int copy_reason); /** * See if this is a null entry. Does not do locking. @@ -145,23 +147,6 @@ int key_entry_isgood(struct key_entry_key* kkey); */ int key_entry_isbad(struct key_entry_key* kkey); -/** - * Set reason why a key is bad. - * @param kkey: bad key. - * @param reason: string to attach, you must allocate it. - * Not safe to call twice unless you deallocate it yourself. - */ -void key_entry_set_reason(struct key_entry_key* kkey, char* reason); - -/** - * Set the EDE (RFC8914) code why the key is bad, if it - * exists (so not LDNS_EDE_NONE). - * @param kkey: bad key. - * @param ede: EDE code to attach to this key. - */ -void key_entry_set_reason_bogus(struct key_entry_key* kkey, sldns_ede_code ede); - - /** * Get reason why a key is bad. * @param kkey: bad key @@ -184,11 +169,14 @@ sldns_ede_code key_entry_get_reason_bogus(struct key_entry_key* kkey); * @param namelen: length of name * @param dclass: class of key entry. (host order); * @param ttl: what ttl should the key have. relative. + * @param reason_bogus: accompanying EDE code. + * @param reason: accompanying NULL-terminated EDE string (or NULL). * @param now: current time (added to ttl). * @return new key entry or NULL on alloc failure */ struct key_entry_key* key_entry_create_null(struct regional* region, - uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, + uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, + sldns_ede_code reason_bogus, const char* reason, time_t now); /** @@ -199,12 +187,16 @@ struct key_entry_key* key_entry_create_null(struct regional* region, * @param dclass: class of key entry. (host order); * @param rrset: data for key entry. This is copied to the region. * @param sigalg: signalled algorithm list (or NULL). + * @param reason_bogus: accompanying EDE code (usually LDNS_EDE_NONE). + * @param reason: accompanying NULL-terminated EDE string (or NULL). * @param now: current time (added to ttl of rrset) * @return new key entry or NULL on alloc failure */ struct key_entry_key* key_entry_create_rrset(struct regional* region, - uint8_t* name, size_t namelen, uint16_t dclass, - struct ub_packed_rrset_key* rrset, uint8_t* sigalg, time_t now); + uint8_t* name, size_t namelen, uint16_t dclass, + struct ub_packed_rrset_key* rrset, uint8_t* sigalg, + sldns_ede_code reason_bogus, const char* reason, + time_t now); /** * Create a bad entry, in the given region. @@ -213,11 +205,14 @@ struct key_entry_key* key_entry_create_rrset(struct regional* region, * @param namelen: length of name * @param dclass: class of key entry. (host order); * @param ttl: what ttl should the key have. relative. + * @param reason_bogus: accompanying EDE code. + * @param reason: accompanying NULL-terminated EDE string (or NULL). * @param now: current time (added to ttl). * @return new key entry or NULL on alloc failure */ struct key_entry_key* key_entry_create_bad(struct regional* region, uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, + sldns_ede_code reason_bogus, const char* reason, time_t now); /** diff --git a/sbin/unwind/libunbound/validator/val_neg.c b/sbin/unwind/libunbound/validator/val_neg.c index 67699b1f7..52bc68387 100644 --- a/sbin/unwind/libunbound/validator/val_neg.c +++ b/sbin/unwind/libunbound/validator/val_neg.c @@ -43,7 +43,7 @@ */ #include "config.h" #ifdef HAVE_OPENSSL_SSL_H -#include "openssl/ssl.h" +#include #define NSEC3_SHA_LEN SHA_DIGEST_LENGTH #else #define NSEC3_SHA_LEN 20 @@ -1407,6 +1407,11 @@ val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo, /* Matching NSEC, use to generate No Data answer. Not creating answers * yet for No Data proven using wildcard. */ if(nsec && nsec_proves_nodata(nsec, qinfo, &nodata_wc) && !nodata_wc) { + /* do not create nodata answers for qtype ANY, it is a query + * type, not an rrtype to disprove. Nameerrors are useful for + * qtype ANY, in the else branch. */ + if(qinfo->qtype == LDNS_RR_TYPE_ANY) + return NULL; if(!(msg = dns_msg_create(qinfo->qname, qinfo->qname_len, qinfo->qtype, qinfo->qclass, region, 2))) return NULL; diff --git a/sbin/unwind/libunbound/validator/val_nsec.c b/sbin/unwind/libunbound/validator/val_nsec.c index 876bfab6d..17c90d83f 100644 --- a/sbin/unwind/libunbound/validator/val_nsec.c +++ b/sbin/unwind/libunbound/validator/val_nsec.c @@ -174,9 +174,10 @@ val_nsec_proves_no_ds(struct ub_packed_rrset_key* nsec, /** check security status from cache or verify rrset, returns true if secure */ static int -nsec_verify_rrset(struct module_env* env, struct val_env* ve, - struct ub_packed_rrset_key* nsec, struct key_entry_key* kkey, - char** reason, struct module_qstate* qstate) +nsec_verify_rrset(struct module_env* env, struct val_env* ve, + struct ub_packed_rrset_key* nsec, struct key_entry_key* kkey, + char** reason, sldns_ede_code* reason_bogus, + struct module_qstate* qstate) { struct packed_rrset_data* d = (struct packed_rrset_data*) nsec->entry.data; @@ -187,7 +188,7 @@ nsec_verify_rrset(struct module_env* env, struct val_env* ve, if(d->security == sec_status_secure) return 1; d->security = val_verify_rrset_entry(env, ve, nsec, kkey, reason, - NULL, LDNS_SECTION_AUTHORITY, qstate); + reason_bogus, LDNS_SECTION_AUTHORITY, qstate); if(d->security == sec_status_secure) { rrset_update_sec_status(env->rrset_cache, nsec, *env->now); return 1; @@ -199,7 +200,7 @@ enum sec_status val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve, struct query_info* qinfo, struct reply_info* rep, struct key_entry_key* kkey, time_t* proof_ttl, char** reason, - struct module_qstate* qstate) + sldns_ede_code* reason_bogus, struct module_qstate* qstate) { struct ub_packed_rrset_key* nsec = reply_find_rrset_section_ns( rep, qinfo->qname, qinfo->qname_len, LDNS_RR_TYPE_NSEC, @@ -216,7 +217,8 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve, * 1) this is a delegation point and there is no DS * 2) this is not a delegation point */ if(nsec) { - if(!nsec_verify_rrset(env, ve, nsec, kkey, reason, qstate)) { + if(!nsec_verify_rrset(env, ve, nsec, kkey, reason, + reason_bogus, qstate)) { verbose(VERB_ALGO, "NSEC RRset for the " "referral did not verify."); return sec_status_bogus; @@ -225,6 +227,7 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve, if(sec == sec_status_bogus) { /* something was wrong. */ *reason = "NSEC does not prove absence of DS"; + *reason_bogus = LDNS_EDE_DNSSEC_BOGUS; return sec; } else if(sec == sec_status_insecure) { /* this wasn't a delegation point. */ @@ -246,9 +249,11 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve, if(rep->rrsets[i]->rk.type != htons(LDNS_RR_TYPE_NSEC)) continue; if(!nsec_verify_rrset(env, ve, rep->rrsets[i], kkey, reason, - qstate)) { + reason_bogus, qstate)) { verbose(VERB_ALGO, "NSEC for empty non-terminal " "did not verify."); + *reason = "NSEC for empty non-terminal " + "did not verify."; return sec_status_bogus; } if(nsec_proves_nodata(rep->rrsets[i], qinfo, &wc)) { diff --git a/sbin/unwind/libunbound/validator/val_nsec.h b/sbin/unwind/libunbound/validator/val_nsec.h index 7117809d6..81844c908 100644 --- a/sbin/unwind/libunbound/validator/val_nsec.h +++ b/sbin/unwind/libunbound/validator/val_nsec.h @@ -44,6 +44,7 @@ #ifndef VALIDATOR_VAL_NSEC_H #define VALIDATOR_VAL_NSEC_H #include "util/data/packed_rrset.h" +#include "sldns/rrdef.h" struct val_env; struct module_env; struct module_qstate; @@ -65,6 +66,7 @@ struct key_entry_key; * @param kkey: key entry to use for verification of signatures. * @param proof_ttl: if secure, the TTL of how long this proof lasts. * @param reason: string explaining why bogus. + * @param reason_bogus: relevant EDE code for validation failure. * @param qstate: qstate with region. * @return security status. * SECURE: proved absence of DS. @@ -75,7 +77,8 @@ struct key_entry_key; enum sec_status val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve, struct query_info* qinfo, struct reply_info* rep, struct key_entry_key* kkey, - time_t* proof_ttl, char** reason, struct module_qstate* qstate); + time_t* proof_ttl, char** reason, sldns_ede_code* reason_bogus, + struct module_qstate* qstate); /** * nsec typemap check, takes an NSEC-type bitmap as argument, checks for type. diff --git a/sbin/unwind/libunbound/validator/val_sigcrypt.c b/sbin/unwind/libunbound/validator/val_sigcrypt.c index 5ab21e20e..37730f179 100644 --- a/sbin/unwind/libunbound/validator/val_sigcrypt.c +++ b/sbin/unwind/libunbound/validator/val_sigcrypt.c @@ -48,6 +48,7 @@ #include "util/data/msgparse.h" #include "util/data/dname.h" #include "util/rbtree.h" +#include "util/rfc_1982.h" #include "util/module.h" #include "util/net_help.h" #include "util/regional.h" @@ -718,9 +719,9 @@ dnskey_verify_rrset(struct module_env* env, struct val_env* ve, } verbose(VERB_ALGO, "rrset failed to verify: all signatures are bogus"); if(!numchecked) { - *reason = "signature missing"; + *reason = "signature for expected key and algorithm missing"; if(reason_bogus) - *reason_bogus = LDNS_EDE_RRSIGS_MISSING; + *reason_bogus = LDNS_EDE_DNSSEC_BOGUS; } else if(numchecked == numindeterminate) { verbose(VERB_ALGO, "rrset failed to verify due to algorithm " "refusal by cryptolib"); @@ -1378,44 +1379,6 @@ sigdate_error(const char* str, int32_t expi, int32_t incep, int32_t now) (unsigned)incep, (unsigned)now); } -/** RFC 1982 comparison, uses unsigned integers, and tries to avoid - * compiler optimization (eg. by avoiding a-b<0 comparisons), - * this routine matches compare_serial(), for SOA serial number checks */ -static int -compare_1982(uint32_t a, uint32_t b) -{ - /* for 32 bit values */ - const uint32_t cutoff = ((uint32_t) 1 << (32 - 1)); - - if (a == b) { - return 0; - } else if ((a < b && b - a < cutoff) || (a > b && a - b > cutoff)) { - return -1; - } else { - return 1; - } -} - -/** if we know that b is larger than a, return the difference between them, - * that is the distance between them. in RFC1982 arith */ -static uint32_t -subtract_1982(uint32_t a, uint32_t b) -{ - /* for 32 bit values */ - const uint32_t cutoff = ((uint32_t) 1 << (32 - 1)); - - if(a == b) - return 0; - if(a < b && b - a < cutoff) { - return b-a; - } - if(a > b && a - b > cutoff) { - return ((uint32_t)0xffffffff) - (a-b-1); - } - /* wrong case, b smaller than a */ - return 0; -} - /** check rrsig dates */ static int check_dates(struct val_env* ve, uint32_t unow, uint8_t* expi_p, diff --git a/sbin/unwind/libunbound/validator/val_utils.c b/sbin/unwind/libunbound/validator/val_utils.c index e2319ee23..8b388882b 100644 --- a/sbin/unwind/libunbound/validator/val_utils.c +++ b/sbin/unwind/libunbound/validator/val_utils.c @@ -587,16 +587,18 @@ val_verify_new_DNSKEYs(struct regional* region, struct module_env* env, return key_entry_create_rrset(region, ds_rrset->rk.dname, ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class), dnskey_rrset, - downprot?sigalg:NULL, *env->now); + downprot?sigalg:NULL, LDNS_EDE_NONE, NULL, + *env->now); } else if(sec == sec_status_insecure) { return key_entry_create_null(region, ds_rrset->rk.dname, - ds_rrset->rk.dname_len, + ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class), - rrset_get_ttl(ds_rrset), *env->now); + rrset_get_ttl(ds_rrset), *reason_bogus, *reason, + *env->now); } return key_entry_create_bad(region, ds_rrset->rk.dname, ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class), - BOGUS_KEY_TTL, *env->now); + BOGUS_KEY_TTL, *reason_bogus, *reason, *env->now); } enum sec_status @@ -694,7 +696,7 @@ val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve, has_useful_ta = 1; sec = dnskey_verify_rrset(env, ve, dnskey_rrset, - ta_dnskey, i, reason, NULL, LDNS_SECTION_ANSWER, qstate); + ta_dnskey, i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate); if(sec == sec_status_secure) { if(!sigalg || algo_needs_set_secure(&needs, (uint8_t)dnskey_get_algo(ta_dnskey, i))) { @@ -743,16 +745,17 @@ val_verify_new_DNSKEYs_with_ta(struct regional* region, struct module_env* env, return key_entry_create_rrset(region, dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class), dnskey_rrset, - downprot?sigalg:NULL, *env->now); + downprot?sigalg:NULL, LDNS_EDE_NONE, NULL, *env->now); } else if(sec == sec_status_insecure) { return key_entry_create_null(region, dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class), - rrset_get_ttl(dnskey_rrset), *env->now); + rrset_get_ttl(dnskey_rrset), *reason_bogus, *reason, + *env->now); } return key_entry_create_bad(region, dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class), - BOGUS_KEY_TTL, *env->now); + BOGUS_KEY_TTL, *reason_bogus, *reason, *env->now); } int diff --git a/sbin/unwind/libunbound/validator/validator.c b/sbin/unwind/libunbound/validator/validator.c index 1723afefe..9de9d54db 100644 --- a/sbin/unwind/libunbound/validator/validator.c +++ b/sbin/unwind/libunbound/validator/validator.c @@ -70,16 +70,16 @@ static void process_ds_response(struct module_qstate* qstate, struct query_info* qinfo, struct sock_list* origin); -/* Updates the suplied EDE (RFC8914) code selectively so we don't loose - * a more specific code - */ +/* Updates the suplied EDE (RFC8914) code selectively so we don't lose + * a more specific code */ static void update_reason_bogus(struct reply_info* rep, sldns_ede_code reason_bogus) { - if (rep->reason_bogus == LDNS_EDE_DNSSEC_BOGUS || - rep->reason_bogus == LDNS_EDE_NONE) { - rep->reason_bogus = reason_bogus; - } + if(reason_bogus == LDNS_EDE_NONE) return; + if(reason_bogus == LDNS_EDE_DNSSEC_BOGUS + && rep->reason_bogus != LDNS_EDE_NONE + && rep->reason_bogus != LDNS_EDE_DNSSEC_BOGUS) return; + rep->reason_bogus = reason_bogus; } @@ -1672,20 +1672,13 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq, vq->state = VAL_FINISHED_STATE; return 1; } else if(key_entry_isbad(vq->key_entry)) { - sldns_ede_code ede = LDNS_EDE_DNSSEC_BOGUS; - - /* the key could have a more spefic EDE than just bogus */ - if(key_entry_get_reason_bogus(vq->key_entry) != LDNS_EDE_NONE) { - ede = key_entry_get_reason_bogus(vq->key_entry); - } - + /* Bad keys should have the relevant EDE code and text */ + sldns_ede_code ede = key_entry_get_reason_bogus(vq->key_entry); /* key is bad, chain is bad, reply is bogus */ errinf_dname(qstate, "key for validation", vq->key_entry->name); errinf_ede(qstate, "is marked as invalid", ede); - if(key_entry_get_reason(vq->key_entry)) { - errinf(qstate, "because of a previous"); - errinf(qstate, key_entry_get_reason(vq->key_entry)); - } + errinf(qstate, "because of a previous"); + errinf(qstate, key_entry_get_reason(vq->key_entry)); /* no retries, stop bothering the authority until timeout */ vq->restart_count = ve->max_restart; @@ -1888,7 +1881,8 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq, vq->chase_reply->security = sec_status_insecure; val_mark_insecure(vq->chase_reply, vq->key_entry->name, qstate->env->rrset_cache, qstate->env); - key_cache_insert(ve->kcache, vq->key_entry, qstate); + key_cache_insert(ve->kcache, vq->key_entry, + qstate->env->cfg->val_log_level >= 2); return 1; } @@ -1897,12 +1891,13 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq, "of trust to keys for", vq->key_entry->name, LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class); vq->chase_reply->security = sec_status_bogus; - - update_reason_bogus(vq->chase_reply, LDNS_EDE_DNSKEY_MISSING); + update_reason_bogus(vq->chase_reply, + key_entry_get_reason_bogus(vq->key_entry)); errinf_ede(qstate, "while building chain of trust", - LDNS_EDE_DNSKEY_MISSING); + key_entry_get_reason_bogus(vq->key_entry)); if(vq->restart_count >= ve->max_restart) - key_cache_insert(ve->kcache, vq->key_entry, qstate); + key_cache_insert(ve->kcache, vq->key_entry, + qstate->env->cfg->val_log_level >= 2); return 1; } @@ -2151,9 +2146,19 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq, log_query_info(NO_VERBOSE, "validation failure", &qstate->qinfo); else { - char* err = errinf_to_str_bogus(qstate); - if(err) log_info("%s", err); - free(err); + char* err_str = errinf_to_str_bogus(qstate); + if(err_str) { + size_t err_str_len = strlen(err_str); + log_info("%s", err_str); + /* allocate space and store the error + * string */ + vq->orig_msg->rep->reason_bogus_str = regional_alloc( + qstate->region, + sizeof(char) * (err_str_len+1)); + memcpy(vq->orig_msg->rep->reason_bogus_str, + err_str, err_str_len+1); + } + free(err_str); } } /* @@ -2195,6 +2200,9 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq, } } } + + /* Update rep->reason_bogus as it is the one being cached */ + update_reason_bogus(vq->orig_msg->rep, errinf_to_reason_bogus(qstate)); /* store results in cache */ if(qstate->query_flags&BIT_RD) { /* if secure, this will override cache anyway, no need @@ -2370,13 +2378,17 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset, log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- " "could not fetch DNSKEY rrset", ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass); + reason_bogus = LDNS_EDE_DNSKEY_MISSING; + reason = "no DNSKEY rrset"; if(qstate->env->cfg->harden_dnssec_stripped) { - errinf_ede(qstate, "no DNSKEY rrset", LDNS_EDE_DNSKEY_MISSING); + errinf_ede(qstate, reason, reason_bogus); kkey = key_entry_create_bad(qstate->region, ta->name, ta->namelen, ta->dclass, BOGUS_KEY_TTL, + reason_bogus, reason, *qstate->env->now); } else kkey = key_entry_create_null(qstate->region, ta->name, ta->namelen, ta->dclass, NULL_KEY_TTL, + reason_bogus, reason, *qstate->env->now); if(!kkey) { log_err("out of memory: allocate fail prime key"); @@ -2409,9 +2421,11 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset, errinf_ede(qstate, reason, reason_bogus); kkey = key_entry_create_bad(qstate->region, ta->name, ta->namelen, ta->dclass, BOGUS_KEY_TTL, + reason_bogus, reason, *qstate->env->now); } else kkey = key_entry_create_null(qstate->region, ta->name, ta->namelen, ta->dclass, NULL_KEY_TTL, + reason_bogus, reason, *qstate->env->now); if(!kkey) { log_err("out of memory: allocate null prime key"); @@ -2458,8 +2472,9 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, /* errors here pretty much break validation */ verbose(VERB_DETAIL, "DS response was error, thus bogus"); errinf(qstate, rc); - errinf_ede(qstate, "no DS", LDNS_EDE_NETWORK_ERROR); - + reason = "no DS"; + reason_bogus = LDNS_EDE_NETWORK_ERROR; + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } @@ -2473,7 +2488,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, if(!ds) { log_warn("internal error: POSITIVE DS response was " "missing DS."); - errinf_ede(qstate, "no DS record", LDNS_EDE_DNSSEC_BOGUS); + reason = "no DS record"; + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } /* Verify only returns BOGUS or SECURE. If the rrset is @@ -2492,13 +2508,11 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, if(!val_dsset_isusable(ds)) { /* If they aren't usable, then we treat it like * there was no DS. */ - - /* TODO add EDE Unsupported DS Digest Type; this needs - * EDE to be added on non SERVFAIL answers. */ - - *ke = key_entry_create_null(qstate->region, - qinfo->qname, qinfo->qname_len, qinfo->qclass, - ub_packed_rrset_ttl(ds), *qstate->env->now); + *ke = key_entry_create_null(qstate->region, + qinfo->qname, qinfo->qname_len, qinfo->qclass, + ub_packed_rrset_ttl(ds), + LDNS_EDE_UNSUPPORTED_DS_DIGEST, NULL, + *qstate->env->now); return (*ke) != NULL; } @@ -2506,7 +2520,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, log_query_info(VERB_DETAIL, "validated DS", qinfo); *ke = key_entry_create_rrset(qstate->region, qinfo->qname, qinfo->qname_len, qinfo->qclass, ds, - NULL, *qstate->env->now); + NULL, LDNS_EDE_NONE, NULL, *qstate->env->now); return (*ke) != NULL; } else if(subtype == VAL_CLASS_NODATA || subtype == VAL_CLASS_NAMEERROR) { @@ -2518,7 +2532,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, /* make sure there are NSECs or NSEC3s with signatures */ if(!val_has_signed_nsecs(msg->rep, &reason)) { verbose(VERB_ALGO, "no NSECs: %s", reason); - errinf_ede(qstate, reason, LDNS_EDE_NSEC_MISSING); + reason_bogus = LDNS_EDE_NSEC_MISSING; + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } @@ -2530,7 +2545,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, /* Try to prove absence of the DS with NSEC */ sec = val_nsec_prove_nodata_dsreply( qstate->env, ve, qinfo, msg->rep, vq->key_entry, - &proof_ttl, &reason, qstate); + &proof_ttl, &reason, &reason_bogus, qstate); switch(sec) { case sec_status_secure: verbose(VERB_DETAIL, "NSEC RRset for the " @@ -2538,6 +2553,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, *ke = key_entry_create_null(qstate->region, qinfo->qname, qinfo->qname_len, qinfo->qclass, proof_ttl, + LDNS_EDE_NONE, NULL, *qstate->env->now); return (*ke) != NULL; case sec_status_insecure: @@ -2571,6 +2587,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, *ke = key_entry_create_null(qstate->region, qinfo->qname, qinfo->qname_len, qinfo->qclass, proof_ttl, + LDNS_EDE_NONE, NULL, *qstate->env->now); return (*ke) != NULL; case sec_status_indeterminate: @@ -2593,7 +2610,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, * this is BOGUS. */ verbose(VERB_DETAIL, "DS %s ran out of options, so return " "bogus", val_classification_to_string(subtype)); - errinf(qstate, "no DS but also no proof of that"); + reason = "no DS but also no proof of that"; + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } else if(subtype == VAL_CLASS_CNAME || subtype == VAL_CLASS_CNAMENOANSWER) { @@ -2605,22 +2623,25 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, cname = reply_find_rrset_section_an(msg->rep, qinfo->qname, qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass); if(!cname) { - errinf(qstate, "validator classified CNAME but no " - "CNAME of the queried name for DS"); + reason = "validator classified CNAME but no " + "CNAME of the queried name for DS"; + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count == 0) { if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep-> rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) { - errinf(qstate, "DS got DNAME answer"); + reason = "DS got DNAME answer"; } else { - errinf(qstate, "DS got unsigned CNAME answer"); + reason = "DS got unsigned CNAME answer"; } + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } - sec = val_verify_rrset_entry(qstate->env, ve, cname, - vq->key_entry, &reason, NULL, LDNS_SECTION_ANSWER, qstate); + sec = val_verify_rrset_entry(qstate->env, ve, cname, + vq->key_entry, &reason, &reason_bogus, + LDNS_SECTION_ANSWER, qstate); if(sec == sec_status_secure) { verbose(VERB_ALGO, "CNAME validated, " "proof that DS does not exist"); @@ -2629,12 +2650,13 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, return 1; } errinf(qstate, "CNAME in DS response was not secure."); - errinf(qstate, reason); + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } else { verbose(VERB_QUERY, "Encountered an unhandled type of " "DS response, thus bogus."); errinf(qstate, "no DS and"); + reason = "no DS"; if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) { char rc[16]; rc[0]=0; @@ -2647,8 +2669,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, } return_bogus: *ke = key_entry_create_bad(qstate->region, qinfo->qname, - qinfo->qname_len, qinfo->qclass, - BOGUS_KEY_TTL, *qstate->env->now); + qinfo->qname_len, qinfo->qclass, BOGUS_KEY_TTL, + reason_bogus, reason, *qstate->env->now); return (*ke) != NULL; } @@ -2768,14 +2790,17 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq, vq->restart_count++; return; } - vq->key_entry = key_entry_create_bad(qstate->region, + reason = "No DNSKEY record"; + reason_bogus = LDNS_EDE_DNSKEY_MISSING; + vq->key_entry = key_entry_create_bad(qstate->region, qinfo->qname, qinfo->qname_len, qinfo->qclass, - BOGUS_KEY_TTL, *qstate->env->now); + BOGUS_KEY_TTL, reason_bogus, reason, + *qstate->env->now); if(!vq->key_entry) { log_err("alloc failure in missing dnskey response"); /* key_entry is NULL for failure in Validate */ } - errinf_ede(qstate, "No DNSKEY record", LDNS_EDE_DNSKEY_MISSING); + errinf_ede(qstate, reason, reason_bogus); errinf_origin(qstate, origin); errinf_dname(qstate, "for key", qinfo->qname); vq->state = VAL_VALIDATE_STATE; @@ -2822,7 +2847,8 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq, qstate->errinf = NULL; /* The DNSKEY validated, so cache it as a trusted key rrset. */ - key_cache_insert(ve->kcache, vq->key_entry, qstate); + key_cache_insert(ve->kcache, vq->key_entry, + qstate->env->cfg->val_log_level >= 2); /* If good, we stay in the FINDKEY state. */ log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo); @@ -2890,7 +2916,8 @@ process_prime_response(struct module_qstate* qstate, struct val_qstate* vq, errinf_origin(qstate, origin); errinf_dname(qstate, "for trust anchor", ta->name); /* store the freshly primed entry in the cache */ - key_cache_insert(ve->kcache, vq->key_entry, qstate); + key_cache_insert(ve->kcache, vq->key_entry, + qstate->env->cfg->val_log_level >= 2); } /* If the result of the prime is a null key, skip the FINDKEY state.*/ diff --git a/share/man/man5/bsd.port.mk.5 b/share/man/man5/bsd.port.mk.5 index 4381e224f..4570b2fe6 100644 --- a/share/man/man5/bsd.port.mk.5 +++ b/share/man/man5/bsd.port.mk.5 @@ -1,4 +1,4 @@ -.\" $OpenBSD: bsd.port.mk.5,v 1.587 2023/09/04 22:36:55 thfr Exp $ +.\" $OpenBSD: bsd.port.mk.5,v 1.602 2023/09/05 13:58:49 espie Exp $ .\" .\" Copyright (c) 2000-2008 Marc Espie .\" @@ -24,7 +24,7 @@ .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. .\" -.Dd $Mdocdate: September 4 2023 $ +.Dd $Mdocdate: September 5 2023 $ .Dt BSD.PORT.MK 5 .Os .Sh NAME @@ -41,15 +41,31 @@ tree framework, in the form of documented public targets, variables and paths. .Pp +The actual +.Nm +file lives under +.Pa ${PORTSDIR}/infrastructure/mk , +with +.Xr make 1 Ns 's +system include file redirecting to it. +.Pp +Optional parts of this framework have been moved to +.Xr port-modules 5 +in an effort to shrink the main file +.Po +see also +.Ev MODULES +.Pc . +.Pp Identifiers beginning with an underscore are internal-use only and likely to change without notice. .Pp This documentation contains sections covering targets, variables, diagnostics, and filenames, ordered in alphabetic order, followed -by a section covering the fake framework, a section -explaining flavors and multi-packages, and a section covering -the generation of package information. +by a section covering the fake framework, a section covering debug +packages generation, a section explaining flavors and multi-packages, +and a section covering the generation of package information. .Pp It ends with sections covering some obsolete targets, variables and files, outlining conversion @@ -84,6 +100,13 @@ run it, or to run regression tests. The output is formatted as package specification pairs, in a form suitable for .Xr tsort 1 . +.Pp +Note that is is possible to obtain reverse dependency information by +using +.Nm show-reverse-deps +from the +.Pa sqlports +package. .It Cm full-{build,run,all,test}-depends Print all dependencies a package depends upon for building, running, or both, as a list of package names, sorted by dependency order with @@ -235,6 +258,14 @@ for details. .It Cm dump-vars Dump the values of all relevant variables in a port, prepended with the port's FULLPKGPATH. +.Pp +Can be limited to some specific information by setting +.Ev DPB +to nothing or +.Sq fetch . +Mostly used by +.Xr dpb 1 +for obtaining vital information from the ports tree. .It Cm extract Extract the distribution files under .Pa ${WRKDIR} @@ -252,15 +283,16 @@ and .Cm do-extract hooks. .It Cm fake -Do a fake port installation, that is, simulate the port installation under -${WRKINST}. +Do a fake port installation, that is, simulate the port installation into +the staging area ${WRKINST}. There is no .Cm do-fake and .Cm post-fake -hooks. +hooks: +instead .Cm fake -actually uses +runs .Cm pre-fake , .Cm pre-install , .Cm do-install @@ -272,9 +304,20 @@ Override or .Cm post-install to change behavior. -Do not touch +.Pp +There are only a handful of ports that use +.Cm pre-fake : +that hook can be used to finish setting up a +.Pa fake +directory before starting the installation proper. +Stuff run during .Cm pre-fake -unless you really know what you are doing. +will not register with +.Cm update-plist , +whereas stuff run during +.Cm pre-install +will be considered part of the installation process. +.Pp See .Sx THE FAKE FRAMEWORK section below. @@ -291,7 +334,7 @@ and .Ev PATCHFILES* using ${FETCH_CMD}. Files are normally retrieved from the list of sites in -.Ev MASTER_SITES* . +.Ev SITES* . .Pp Appending .Sq :0 @@ -299,9 +342,9 @@ to .Sq :9 to an entry will let ${FETCH_CMD} retrieve from -.Ev MASTER_SITES0 +.Ev SITES0 to -.Ev MASTER_SITES9 +.Ev SITES9 instead (deprecated). .Pp Preferably, adding a suffix to @@ -309,11 +352,11 @@ Preferably, adding a suffix to .Ev PATCHFILES , .Ev SUPDISTFILES will switch the site entry to the corresponding -.Ev MASTER_SITES +.Ev SITES variable, e.g., .Bd -literal -offset indent DISTFILES.go = ... -MASTER_SITES.go = ... +SITES.go = ... .Ed .Pp If the rest of the entry parses as @@ -346,9 +389,10 @@ all files relevant to a port, .Cm dpb Fl F is more efficient. .Pp -Use of +There are no .Cm {pre,do,post}-fetch -hooks is forbidden, as this would make mirroring of distfiles very complicated. +hooks, as this would break +.Xr dpb 1 . .Pp See .Ev ALL_DISTFILES , @@ -361,18 +405,16 @@ See .Ev FETCH_MANUALLY , .Ev FULLDISTDIR , .Ev MAKESUMFILES , -.Ev MASTER_SITES* , -.Ev MASTER_SITES0 , ... , -.Ev MASTER_SITES9 , .Ev PATCHFILES* , .Ev SUPDISTFILES* , .Ev REFETCH . +.Ev SITES* , .It Cm fetch-all Like .Cm fetch , but also fetches .Ev SUPDISTFILES* , -for use with e.g., +for use by e.g., .Cm makesum . .It Cm fix-permissions Ensure permissions are correct when using @@ -425,9 +467,6 @@ and before or .Cm update-plist . Always rerun, as it is cheap enough. -.It Cm index -Top-level target, see -.Xr ports 7 . .It Cm install-depends Before package installation, install and verify dependencies constructed from .Ev RUN_DEPENDS , LIB_DEPENDS , @@ -456,17 +495,18 @@ Verify that the .Ev LIB_DEPENDS and .Ev WANTLIB -are accurate for the port. +recorded in the port's packages are accurate. See .Cm port-lib-depends-check , -which is quicker. +which checks files under the fake staging directory instead, +and thus has faster turn-around. .It Cm license-check Check that .Ev PERMIT_PACKAGE settings match: if any dependency has a more restrictive setting, warn about it. -This warning is advisory, because the automated license checking cannot -figure out which ports were used only for building and did not taint +This warning is advisory, because automated license checking cannot +know that some ports were only used for building and did not taint the current port. .It Cm lock Manually obtain a lock on a given directory. @@ -477,14 +517,18 @@ Seldom used, see .Xr ports 7 for details. .It Cm makesum -Run +Uses +.Cm fetch-all +to fetch missing ${MAKESUMFILES} +without verifying their digest, then run .Xr sha256 1 -on ${MAKESUMFILES} -that is, files listed in ${DISTFILES*}, ${SUPDISTFILES*} and ${PATCHFILES*}, -and store the result in ${CHECKSUM_FILE}, normally +on them that is, +files listed in ${DISTFILES*}, ${SUPDISTFILES*} and ${PATCHFILES*}. +The result is stored in ${CHECKSUM_FILE}, normally .Pa distinfo . Also store the lengths of all files for a quick check during -.Cm fetch . +.Cm fetch , +.Cm fetch-all . .It Cm no-lib-depends-args Degenerate form of .Cm lib-depends-args @@ -511,9 +555,18 @@ for each package in the .Ev MULTI_PACKAGES list. If the repository already contains up-to-date packages, they are not rebuilt. -If PLIST_REPOSITORY is set, the resulting packaging information is compared -with existing stuff, and saved if new, with loud complaints if it changed -without a REVISION bump. +If PLIST_REPOSITORY is set (the default), the resulting packaging +information is compared with existing stuff, and saved if new, +with loud complaints if it changed without a +.Ev REVISION +bump. +.Pp +if +.Ev DEBUG_PACKAGES +is set, some debug information may also be set aside and saved +in +.Pa debug-* +packages transparently. .Pp Also note that .Pa ${PLIST_REPOSITORY}/${MACHINE_ARCH}/history @@ -569,7 +622,7 @@ will be applied under .Ev WRKDIST . .It Cm peek-ftp Connect to the first site in -.Ev MASTER_SITES , +.Ev SITES , in the right directory, and leaves user at .Xr ftp 1 Ns 's prompt. @@ -787,7 +840,12 @@ Print the list of .Xr pkgpath 7 for all ports that will be affected by the current port changing. -Works by walking the list of dependencies, in reverse. +Works by walking the full list of all dependencies of all ports, in reverse. +.Pp +Very slow, prefer installing the +.Pa sqlports +package and using +.Nm show-reverse-deps . .It Cm show-run-depends Print all running dependencies for a port, one per-line, without duplicates. .It Cm subpackage @@ -993,9 +1051,7 @@ Automatically set as soon as .Ev CONFIGURE_STYLE is gnu or higher. .It Ev AUTOCONF_VERSION -Starting with -.Ox 3.3 , -several versions of autoconf may coexist peacefully. +Several versions of autoconf may coexist peacefully. The main autoconf script is a shell wrapper in the .Pa devel/metaauto package, and similarly for automake. @@ -1271,7 +1327,10 @@ This is essentially the same as running after each package build. Defaults to .Sq \&No , -as this can be a big performance hit. +as this can be a big performance hit, and also because +.Ev lib-depends-check +doesn't know about library subdirectories or dynamic loading through +.Xr dlopen 3 . .It Ev CHECKSUMFILES List of all files that need to be retrieved by .Cm fetch , @@ -1284,8 +1343,9 @@ See also .It Ev CHECKSUM_FILE Location for this port's checksums, used by .Cm checksum , +.Cm makesum , and -.Cm makesum . +.Xr dpb 1 . Defaults to .Pa distinfo . .It Ev CHECKSUM_PACKAGES @@ -1594,9 +1654,9 @@ and entries can be added as needed .Pc . The components are used to build -.Ev MASTER_SITES.name +.Ev SITES.name .Ev DISTFILES.name -and +and (optionally) .Ev HOMEPAGE . .Pp At the end of @@ -1622,7 +1682,7 @@ into account. .It Ev DISTFILES* The main port's distribution files (the actual software source, except for binary-only ports). -Will be retrieved from the corresponding MASTER_SITES* (see +Will be retrieved from the corresponding SITES* (see .Cm fetch ) , checksummed and extracted (see .Cm checksum , @@ -1633,16 +1693,16 @@ normally holds a list of files, possibly with to .Sq :9 appended to select a different -.Ev MASTER_SITES . +.Ev SITES . .Pp Preferably, adding a suffix to .Ev DISTFILES , will switch the site entry to the corresponding -.Ev MASTER_SITES +.Ev SITES variable, e.g., .Bd -literal -offset indent DISTFILES.go = ... -MASTER_SITES.go = ... +SITES.go = ... .Ed .Pp Each entry may optionally be of the form @@ -1669,8 +1729,17 @@ If ${DISTFILES*} varies depending on or architecture, use .Ev SUPDISTFILES* to ensure distfiles mirroring and -.Cm makesum +.Cm makesum Ns 's proper operation. +.Pp +If no +.Ev DISTFILES* +is set and if +.Ev SITES +is not null, then +.Ev DISTFILES +will be set to +.Pa ${DISNAME}${EXTRACT_SUFX} . .It Ev DISTNAME Name used to identify the port. See @@ -1724,9 +1793,13 @@ If defined, .Nm will provide dummy values for variables mandatory for a minimally functional port. -Used by various pieces of the ports tree to perform introspection and get to +Used by +.Pa sqlports +and +.Xr dpb 1 +to perform introspection and obtain .Nm Ns 's -variables. +default values for variables without needing to access any specific port. .It Ev ECHO_MSG User settings. Used to display @@ -1782,6 +1855,9 @@ for instance to flag erroneous combinations of and .Ev BROKEN for other common issues). +.Pp +Note that setting fatal errors defeats all introspection mechanisms and breaks +.Pa sqlports . .It Ev EXTRACT_CASES In the normal extraction stage (when .Ev EXTRACT_ONLY @@ -1874,7 +1950,7 @@ Target built by ${MAKE_PROGRAM} on fake invocation. Defaults to ${INSTALL_TARGET}. .It Ev FAKEOBJDIR User settings. -If non empty, used as a base for the fake area. +If non empty, used as a base for the fake staging area. The real fake directory ${WRKINST} is created there. Can be set on a per-${PKGPATH} basis. For instance, setting FAKEOBJDIR_www/mozilla-firefox=/tmp/obj @@ -2024,7 +2100,7 @@ See Simple support for GitHub-hosted projects. Leave empty for non hosted projects. Yields a suitable default for -.Ev MASTER_SITES_GITHUB +.Ev SITES_GITHUB and .Ev DISTNAME . .It Ev GH_ACCOUNT @@ -2106,12 +2182,17 @@ to simplify bulk-package builds. Set to .Sq Yes if port needs human interaction to build. -Porters should strive to minimize +.Pp +Note that .Ev IS_INTERACTIVE -ports, by using -.Ev FLAVORS -for multiple choice ports, and by postponing human intervention -to package installation time. +ports won't be built as official packages, +so avoid at all cost. +.Pp +Human intervention should be moved to binary package +installation and/or post-installation configuration instead. +.Pp +Discrete Yes/No choices are better modelled as +.Ev FLAVORS . .It Ev LE_ARCHS Set to the list of little-endian architectures. Read-only. @@ -2273,45 +2354,6 @@ prepended and with master site selection extension removed. Read-only. See also .Ev CHECKSUMFILES . -.It Ev MASTER_SITE_BACKUP -User settings. -List of sites to try after normal master sites. -Normally includes ${MASTER_SITE_OPENBSD} and ${MASTER_SITE_FREEBSD}. -.It Ev MASTER_SITE_* -Lists of standard sites to retrieve files from, refer to -.Pa ${PORTSDIR}/infrastructure/db/network.conf -for a complete list. -.Pp -Generally used with the standard -.Xr make 1 Ns 's -.Li ${VARIABLE:=subdir/} -construct to append the relevant subdir at the end of each entry, e.g., -.Dl MASTER_SITES = ${MASTER_SITE_GNU:=cgicc/} -.It Ev MASTER_SITES -List of primary locations from which distribution files and patchfiles are -retrieved. -See the -.Cm fetch -target for details. -Defaults to ${MASTER_SITES_GITHUB} for GitHub-hosted projects, -see -.Ev GH_* . -See -.Xr ports 7 -for user configuration. -.It Ev MASTER_SITES* -List of alternate locations from which ${DISTFILES*}, ${PATCHFILES*}, -${SUPDISTFILES*} are retrieved. -See -.Cm fetch -for details. -Suffix should start with -.Sq \&. -for consistency. -.Pp -.It Ev MASTER_SITES0 , ... , MASTER_SITES9 -Supplementary locations from which distribution files and patchfiles are -retrieved. .It Ev MESSAGE File recorded in the package and displayed during installation. Defaults to ${PKGDIR}/MESSAGE if this file exists. @@ -3117,6 +3159,45 @@ Porters of software using libtool should make sure .Ev MAKE_FLAGS get propagated to the libtool invocations. This should be enough in most cases. +.It Ev SITE_BACKUP +User settings. +List of sites to try after normal master sites. +Normally includes ${SITE_OPENBSD} and ${SITE_FREEBSD}. +.It Ev SITE_* +Lists of standard sites to retrieve files from, refer to +.Pa ${PORTSDIR}/infrastructure/db/network.conf +for a complete list. +.Pp +Generally used with the standard +.Xr make 1 Ns 's +.Li ${VARIABLE:=subdir/} +construct to append the relevant subdir at the end of each entry, e.g., +.Dl SITES = ${SITE_GNU:=cgicc/} +.It Ev SITES +List of primary locations from which distribution files and patchfiles are +retrieved. +See the +.Cm fetch +target for details. +Defaults to ${SITES_GITHUB} for GitHub-hosted projects, +see +.Ev GH_* . +See +.Xr ports 7 +for user configuration. +.It Ev SITES* +List of alternate locations from which ${DISTFILES*}, ${PATCHFILES*}, +${SUPDISTFILES*} are retrieved. +See +.Cm fetch +for details. +Suffix should start with +.Sq \&. +for consistency. +.Pp +.It Ev SITES0 , ... , SITES9 +Supplementary locations from which distribution files and patchfiles are +retrieved (deprecated). .It Ev SKIPDIR See .Xr ports 7 . @@ -3329,13 +3410,6 @@ when using .Ev DIST_TUPLE . Very similar to .Ev TEMPLATE_DISTFILES. . -.It Ev TEMPLATES -Base location for the templates used in the -.Cm readmes -target. -User settings. -Defaults to -.Pa ${PORTSDIR}/infrastructure/templates . .It Ev TEST_DEPENDS See .Ev BUILD_DEPENDS @@ -3592,7 +3666,8 @@ Subdirectory of ${WRKDIR} where the actual source is. Base for configuration (default: ${WRKDIST}). Note that WRKSRC may be a symbolic link, if set to ${WRKDIR}. .It Ev WRKINST -Subdirectory of ${WRKDIR} where port normally installs (see the +Subdirectory of ${WRKDIR} used as a staging area for installing the port. +(See .Cm fake target). .It Ev WRKOBJDIR @@ -3640,14 +3715,16 @@ Set to bison if needed. .Sh THE FAKE FRAMEWORK The .Cm fake -target is used to install the port in a private directory first, ready for +target is used to install the port under a staging directory first, ready for packaging by the .Cm package -target, so that the actual installation will use the package. +target, so that the actual +.Cm install +target will use the binary package instead. .Pp Essentially, .Cm fake -invokes a real install process after tweaking a few variables. +invokes the install process after tweaking a few variables. .Pp .Cm fake first creates a skeleton tree under ${WRKINST}, using @@ -3660,6 +3737,10 @@ target may be used to complete that skeleton tree. For instance, a few ports may need supplementary stuff to be present (as it would be installed if the port's dependencies were present). .Pp +In most cases, +.Cm pre-install +is preferred. +.Pp If .Cm {pre,do,post}-install overrides are present, they are used with some @@ -4390,7 +4471,7 @@ resulting in a double inclusion. This would lead to weird results, such as .Ev PKG_ARGS being defined twice. -.It "Fatal: MASTER_SITES* is not defined but referenced by in " +.It "Fatal: SITES* is not defined but referenced by in " Pretty much self-explanatory. .It "Fatal: SUBPACKAGES should always begin with -: " That is the only way to differentiate between diff --git a/sys/arch/amd64/amd64/vmm_machdep.c b/sys/arch/amd64/amd64/vmm_machdep.c index 6a63b021e..4e68581d1 100644 --- a/sys/arch/amd64/amd64/vmm_machdep.c +++ b/sys/arch/amd64/amd64/vmm_machdep.c @@ -1,4 +1,4 @@ -/* $OpenBSD: vmm_machdep.c,v 1.6 2023/09/03 09:30:43 mlarkin Exp $ */ +/* $OpenBSD: vmm_machdep.c,v 1.7 2023/09/05 14:00:40 mlarkin Exp $ */ /* * Copyright (c) 2014 Mike Larkin * @@ -6319,7 +6319,7 @@ vmm_handle_cpuid(struct vcpu *vcpu) *rax = eax; *rbx = ebx; *rcx = ecx; - *rdx = edx & VMM_APMI_EDX_MASK; + *rdx = edx & VMM_APMI_EDX_INCLUDE_MASK; break; case 0x80000008: /* Phys bits info and topology (AMD) */ *rax = eax; diff --git a/sys/arch/amd64/include/vmmvar.h b/sys/arch/amd64/include/vmmvar.h index a187c4f1d..4b75fa8ac 100644 --- a/sys/arch/amd64/include/vmmvar.h +++ b/sys/arch/amd64/include/vmmvar.h @@ -1,4 +1,4 @@ -/* $OpenBSD: vmmvar.h,v 1.92 2023/09/03 09:30:43 mlarkin Exp $ */ +/* $OpenBSD: vmmvar.h,v 1.93 2023/09/05 14:00:41 mlarkin Exp $ */ /* * Copyright (c) 2014 Mike Larkin * @@ -559,7 +559,9 @@ struct vm_mprotect_ept_params { CPUIDEBX_STIBP | CPUIDEBX_IBRS_ALWAYSON | CPUIDEBX_STIBP_ALWAYSON | \ CPUIDEBX_IBRS_PREF | CPUIDEBX_SSBD | CPUIDEBX_VIRT_SSBD | \ CPUIDEBX_SSBD_NOTREQ) -#define VMM_APMI_EDX_MASK ~(CPUIDEDX_HWPSTATE) + +/* This mask is an include list for bits we want to expose */ +#define VMM_APMI_EDX_INCLUDE_MASK (CPUIDEDX_ITSC) /* * SEFF flags - copy from host minus: diff --git a/sys/arch/arm64/dev/apldc.c b/sys/arch/arm64/dev/apldc.c index f9f93c783..b36cb4405 100644 --- a/sys/arch/arm64/dev/apldc.c +++ b/sys/arch/arm64/dev/apldc.c @@ -1,4 +1,4 @@ -/* $OpenBSD: apldc.c,v 1.9 2023/07/03 15:54:07 tobhe Exp $ */ +/* $OpenBSD: apldc.c,v 1.10 2023/09/05 11:04:06 tobhe Exp $ */ /* * Copyright (c) 2022 Mark Kettenis * @@ -575,17 +575,22 @@ apldchidev_handle_gpio_req(struct apldchidev_softc *sc, uint8_t iface, if (sc->sc_ngpios >= APLDCHIDEV_NUM_GPIOS) return; - if (iface == sc->sc_iface_mt) - node = OF_getnodebyname(sc->sc_node, "multi-touch"); - else if (iface == sc->sc_iface_stm) - node = OF_getnodebyname(sc->sc_node, "stm"); - if (node == -1) - return; - + node = sc->sc_node; snprintf(name, sizeof(name), "apple,%s-gpios", req->name); len = OF_getproplen(node, name); - if (len <= 0 || len > sizeof(gpio)) - return; + if (len <= 0 || len > sizeof(gpio)) { + /* XXX: older device trees store gpios in sub-nodes */ + if (iface == sc->sc_iface_mt) + node = OF_getnodebyname(sc->sc_node, "multi-touch"); + else if (iface == sc->sc_iface_stm) + node = OF_getnodebyname(sc->sc_node, "stm"); + if (node == -1) + return; + len = OF_getproplen(node, name); + if (len <= 0 || len > sizeof(gpio)) + return; + } + OF_getpropintarray(node, name, gpio, len); gpio_controller_config_pin(gpio, GPIO_CONFIG_OUTPUT); gpio_controller_set_pin(gpio, 0); diff --git a/sys/dev/pci/if_em.c b/sys/dev/pci/if_em.c index 5ed3332b6..e29b12e0b 100644 --- a/sys/dev/pci/if_em.c +++ b/sys/dev/pci/if_em.c @@ -31,7 +31,7 @@ POSSIBILITY OF SUCH DAMAGE. ***************************************************************************/ -/* $OpenBSD: if_em.c,v 1.365 2023/02/09 21:21:27 naddy Exp $ */ +/* $OpenBSD: if_em.c,v 1.366 2023/09/05 13:06:42 naddy Exp $ */ /* $FreeBSD: if_em.c,v 1.46 2004/09/29 18:28:28 mlaier Exp $ */ #include @@ -1474,7 +1474,7 @@ em_iff(struct em_softc *sc) ETHER_NEXT_MULTI(step, enm); } - em_mc_addr_list_update(&sc->hw, mta, ac->ac_multicnt, 0, 1); + em_mc_addr_list_update(&sc->hw, mta, ac->ac_multicnt, 0); } E1000_WRITE_REG(&sc->hw, RCTL, reg_rctl); diff --git a/sys/dev/pci/if_em_hw.c b/sys/dev/pci/if_em_hw.c index 7db048d48..5cd58ebf1 100644 --- a/sys/dev/pci/if_em_hw.c +++ b/sys/dev/pci/if_em_hw.c @@ -31,7 +31,7 @@ *******************************************************************************/ -/* $OpenBSD: if_em_hw.c,v 1.117 2023/04/11 00:45:08 jsg Exp $ */ +/* $OpenBSD: if_em_hw.c,v 1.118 2023/09/05 13:06:42 naddy Exp $ */ /* * if_em_hw.c Shared functions for accessing and configuring the MAC */ @@ -7884,20 +7884,16 @@ em_init_rx_addrs(struct em_hw *hw) * mc_addr_list - the list of new multicast addresses * mc_addr_count - number of addresses * pad - number of bytes between addresses in the list - * rar_used_count - offset where to start adding mc addresses into the RAR's * - * The given list replaces any existing list. Clears the last 15 receive - * address registers and the multicast table. Uses receive address registers - * for the first 15 multicast addresses, and hashes the rest into the + * The given list replaces any existing list and hashes the addresses into the * multicast table. *****************************************************************************/ void em_mc_addr_list_update(struct em_hw *hw, uint8_t *mc_addr_list, - uint32_t mc_addr_count, uint32_t pad, uint32_t rar_used_count) + uint32_t mc_addr_count, uint32_t pad) { uint32_t hash_value; uint32_t i; - uint32_t num_rar_entry; uint32_t num_mta_entry; DEBUGFUNC("em_mc_addr_list_update"); /* @@ -7906,28 +7902,6 @@ em_mc_addr_list_update(struct em_hw *hw, uint8_t *mc_addr_list, */ hw->num_mc_addrs = mc_addr_count; - /* Clear RAR[1-15] */ - DEBUGOUT(" Clearing RAR[1-15]\n"); - num_rar_entry = E1000_RAR_ENTRIES; - if (IS_ICH8(hw->mac_type)) - num_rar_entry = E1000_RAR_ENTRIES_ICH8LAN; - if (hw->mac_type == em_ich8lan) - num_rar_entry -= 1; - /* - * Reserve a spot for the Locally Administered Address to work around - * an 82571 issue in which a reset on one port will reload the MAC on - * the other port. - */ - if ((hw->mac_type == em_82571) && (hw->laa_is_present == TRUE)) - num_rar_entry -= 1; - - for (i = rar_used_count; i < num_rar_entry; i++) { - E1000_WRITE_REG_ARRAY(hw, RA, (i << 1), 0); - E1000_WRITE_FLUSH(hw); - E1000_WRITE_REG_ARRAY(hw, RA, ((i << 1) + 1), 0); - E1000_WRITE_FLUSH(hw); - } - /* Clear the MTA */ DEBUGOUT(" Clearing MTA\n"); num_mta_entry = E1000_NUM_MTA_REGISTERS; @@ -7954,18 +7928,7 @@ em_mc_addr_list_update(struct em_hw *hw, uint8_t *mc_addr_list, (i * (ETH_LENGTH_OF_ADDRESS + pad))); DEBUGOUT1(" Hash value = 0x%03X\n", hash_value); - /* - * Place this multicast address in the RAR if there is room, * - * else put it in the MTA - */ - if (rar_used_count < num_rar_entry) { - em_rar_set(hw, mc_addr_list + - (i * (ETH_LENGTH_OF_ADDRESS + pad)), - rar_used_count); - rar_used_count++; - } else { - em_mta_set(hw, hash_value); - } + em_mta_set(hw, hash_value); } DEBUGOUT("MC Update Complete\n"); } diff --git a/sys/dev/pci/if_em_hw.h b/sys/dev/pci/if_em_hw.h index 78340f3fe..0b9f548d6 100644 --- a/sys/dev/pci/if_em_hw.h +++ b/sys/dev/pci/if_em_hw.h @@ -31,7 +31,7 @@ *******************************************************************************/ -/* $OpenBSD: if_em_hw.h,v 1.88 2022/11/06 18:17:56 mbuhl Exp $ */ +/* $OpenBSD: if_em_hw.h,v 1.89 2023/09/05 13:06:43 naddy Exp $ */ /* $FreeBSD: if_em_hw.h,v 1.15 2005/05/26 23:32:02 tackerman Exp $ */ /* if_em_hw.h @@ -428,7 +428,7 @@ boolean_t em_get_flash_presence_i210(struct em_hw *); /* Filters (multicast, vlan, receive) */ void em_mc_addr_list_update(struct em_hw *hw, uint8_t * mc_addr_list, uint32_t mc_addr_count, - uint32_t pad, uint32_t rar_used_count); + uint32_t pad); uint32_t em_hash_mc_addr(struct em_hw *hw, uint8_t *mc_addr); void em_mta_set(struct em_hw *hw, uint32_t hash_value); void em_rar_set(struct em_hw *hw, uint8_t *mc_addr, uint32_t rar_index); diff --git a/sys/dev/pci/ksmn.c b/sys/dev/pci/ksmn.c index 004d10514..e57204491 100644 --- a/sys/dev/pci/ksmn.c +++ b/sys/dev/pci/ksmn.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ksmn.c,v 1.8 2023/06/23 03:47:10 mlarkin Exp $ */ +/* $OpenBSD: ksmn.c,v 1.9 2023/09/05 13:06:01 stsp Exp $ */ /* * Copyright (c) 2019 Bryan Steele @@ -105,6 +105,7 @@ static const struct pci_matchid ksmn_devices[] = { { PCI_VENDOR_AMD, PCI_PRODUCT_AMD_17_1X_RC }, { PCI_VENDOR_AMD, PCI_PRODUCT_AMD_17_3X_RC }, { PCI_VENDOR_AMD, PCI_PRODUCT_AMD_17_6X_RC }, + { PCI_VENDOR_AMD, PCI_PRODUCT_AMD_19_4X_RC }, { PCI_VENDOR_AMD, PCI_PRODUCT_AMD_19_6X_RC }, }; diff --git a/sys/uvm/uvm_fault.c b/sys/uvm/uvm_fault.c index 28fa1da14..1ae20b5af 100644 --- a/sys/uvm/uvm_fault.c +++ b/sys/uvm/uvm_fault.c @@ -1,4 +1,4 @@ -/* $OpenBSD: uvm_fault.c,v 1.134 2023/09/02 08:24:40 mpi Exp $ */ +/* $OpenBSD: uvm_fault.c,v 1.135 2023/09/05 05:08:26 guenther Exp $ */ /* $NetBSD: uvm_fault.c,v 1.51 2000/08/06 00:22:53 thorpej Exp $ */ /* @@ -1455,7 +1455,20 @@ uvm_fault_lower(struct uvm_faultinfo *ufi, struct uvm_faultctx *flt, */ if ((amap_flags(amap) & AMAP_SHARED) != 0) { pmap_page_protect(uobjpage, PROT_NONE); - } + } +#if defined(MULTIPROCESSOR) && !defined(__HAVE_PMAP_MPSAFE_ENTER_COW) + /* + * Otherwise: + * If there are multiple threads, either uvm or the + * pmap has to make sure no threads see the old RO + * mapping once any have seen the new RW mapping. + * uvm does it here by forcing it to PROT_NONE before + * inserting the new mapping. + */ + else if (P_HASSIBLING(curproc)) { + pmap_page_protect(uobjpage, PROT_NONE); + } +#endif /* dispose of uobjpage. drop handle to uobj as well. */ if (uobjpage->pg_flags & PG_WANTED) diff --git a/usr.bin/make/defines.h b/usr.bin/make/defines.h index 05b29dcf0..4fd99c52e 100644 --- a/usr.bin/make/defines.h +++ b/usr.bin/make/defines.h @@ -1,7 +1,7 @@ #ifndef DEFINES_H #define DEFINES_H -/* $OpenBSD: defines.h,v 1.15 2015/10/14 13:50:22 espie Exp $ */ +/* $OpenBSD: defines.h,v 1.16 2023/09/05 14:05:41 jsg Exp $ */ /* * Copyright (c) 2001 Marc Espie. @@ -61,18 +61,10 @@ typedef struct Suff_ Suff; #ifdef __GNUC__ # define UNUSED __attribute__((__unused__)) -# define HAS_INLINES -# define INLINE __inline__ #else # define UNUSED #endif -#ifdef HAS_INLINES -# ifndef INLINE -# define INLINE inline -# endif -#endif - /* * debug control: * There is one bit per module. It is up to the module what debug diff --git a/usr.bin/make/lst.h b/usr.bin/make/lst.h index c3a745069..4d8ad5713 100644 --- a/usr.bin/make/lst.h +++ b/usr.bin/make/lst.h @@ -1,7 +1,7 @@ #ifndef _LST_H_ #define _LST_H_ -/* $OpenBSD: lst.h,v 1.33 2021/03/04 09:45:31 espie Exp $ */ +/* $OpenBSD: lst.h,v 1.34 2023/09/05 14:05:41 jsg Exp $ */ /* $NetBSD: lst.h,v 1.7 1996/11/06 17:59:12 christos Exp $ */ /* @@ -159,25 +159,16 @@ extern void * Lst_DeQueue(Lst); #define Lst_Adv(ln) ((ln)->nextPtr) #define Lst_Rev(ln) ((ln)->prevPtr) - -/* Inlines are preferable to macros here because of the type checking. */ -#ifdef HAS_INLINES -static INLINE LstNode +static inline LstNode Lst_FindConst(Lst l, FindProcConst cProc, const void *d) { return Lst_FindFrom(Lst_First(l), (FindProc)cProc, (void *)d); } -static INLINE LstNode +static inline LstNode Lst_FindFromConst(LstNode ln, FindProcConst cProc, const void *d) { return Lst_FindFrom(ln, (FindProc)cProc, (void *)d); } -#else -#define Lst_FindConst(l, cProc, d) \ - Lst_FindFrom(Lst_First(l), (FindProc)cProc, (void *)d) -#define Lst_FindFromConst(ln, cProc, d) \ - Lst_FindFrom(ln, (FindProc)cProc, (void *)d) -#endif #endif /* _LST_H_ */ diff --git a/usr.bin/make/lst.lib/lst.h b/usr.bin/make/lst.lib/lst.h index a05dc7878..cce991888 100644 --- a/usr.bin/make/lst.lib/lst.h +++ b/usr.bin/make/lst.lib/lst.h @@ -1,7 +1,7 @@ #ifndef _LST_H_ #define _LST_H_ -/* $OpenBSD: lst.h,v 1.2 2015/10/14 13:52:11 espie Exp $ */ +/* $OpenBSD: lst.h,v 1.3 2023/09/05 14:05:41 jsg Exp $ */ /* $NetBSD: lst.h,v 1.7 1996/11/06 17:59:12 christos Exp $ */ /* @@ -154,25 +154,16 @@ extern void * Lst_DeQueue(Lst); #define Lst_Adv(ln) ((ln)->nextPtr) #define Lst_Rev(ln) ((ln)->prevPtr) - -/* Inlines are preferable to macros here because of the type checking. */ -#ifdef HAS_INLINES -static INLINE LstNode +static inline LstNode Lst_FindConst(Lst l, FindProcConst cProc, const void *d) { return Lst_FindFrom(Lst_First(l), (FindProc)cProc, (void *)d); } -static INLINE LstNode +static inline LstNode Lst_FindFromConst(LstNode ln, FindProcConst cProc, const void *d) { return Lst_FindFrom(ln, (FindProc)cProc, (void *)d); } -#else -#define Lst_FindConst(l, cProc, d) \ - Lst_FindFrom(Lst_First(l), (FindProc)cProc, (void *)d) -#define Lst_FindFromConst(ln, cProc, d) \ - Lst_FindFrom(ln, (FindProc)cProc, (void *)d) -#endif #endif /* _LST_H_ */ diff --git a/usr.sbin/makefs/cd9660/iso.h b/usr.sbin/makefs/cd9660/iso.h index cbf011a1a..3ed58d1de 100644 --- a/usr.sbin/makefs/cd9660/iso.h +++ b/usr.sbin/makefs/cd9660/iso.h @@ -1,4 +1,4 @@ -/* $OpenBSD: iso.h,v 1.2 2016/12/17 16:22:04 krw Exp $ */ +/* $OpenBSD: iso.h,v 1.3 2023/09/05 15:33:40 robert Exp $ */ /* $NetBSD: iso.h,v 1.10 2011/09/27 01:01:44 christos Exp $ */ /*- @@ -190,8 +190,7 @@ isonum_712(const u_char *p) /* 7.2.1: unsigned little-endian 16-bit value. NOT USED IN KERNEL. */ static __inline int -isonum_721(p) - u_char *p; +isonum_721(u_char *p) { #if !defined(__STRICT_ALIGNMENT) && (BYTE_ORDER == LITTLE_ENDIAN) return *(u_int16_t *)p; @@ -202,8 +201,7 @@ isonum_721(p) /* 7.2.2: unsigned big-endian 16-bit value. NOT USED IN KERNEL. */ static __inline int -isonum_722(p) - unsigned char *p; +isonum_722(unsigned char *p) { #if !defined(__STRICT_ALIGNMENT) && (BYTE_ORDER == BIG_ENDIAN) return *(u_int16_t *)p; @@ -230,8 +228,7 @@ isonum_723(u_char *p) /* 7.3.1: unsigned little-endian 32-bit value. NOT USED IN KERNEL. */ static __inline int -isonum_731(p) - u_char *p; +isonum_731(u_char *p) { #if !defined(__STRICT_ALIGNMENT) && (BYTE_ORDER == LITTLE_ENDIAN) return *(u_int32_t *)p; @@ -242,8 +239,7 @@ isonum_731(p) /* 7.3.2: unsigned big-endian 32-bit value. NOT USED IN KERNEL. */ static __inline int -isonum_732(p) - unsigned char *p; +isonum_732(unsigned char *p) { #if !defined(__STRICT_ALIGNMENT) && (BYTE_ORDER == BIG_ENDIAN) return *(u_int32_t *)p; diff --git a/usr.sbin/radiusd/parse.y b/usr.sbin/radiusd/parse.y index ba3399fbf..ef17ae1e7 100644 --- a/usr.sbin/radiusd/parse.y +++ b/usr.sbin/radiusd/parse.y @@ -1,4 +1,4 @@ -/* $OpenBSD: parse.y,v 1.15 2023/09/04 12:28:18 yasuoka Exp $ */ +/* $OpenBSD: parse.y,v 1.16 2023/09/05 00:32:01 yasuoka Exp $ */ /* * Copyright (c) 2002, 2003, 2004 Henning Brauer @@ -312,6 +312,11 @@ authenticate : AUTHENTICATE { } str_l optnl '{' authopts '}' { struct radiusd_authentication *a; + if (authen.auth == NULL) { + free_str_l(&$3); + yyerror("no authentication module specified"); + YYERROR; + } if ((a = calloc(1, sizeof(struct radiusd_authentication))) == NULL) { free_str_l(&$3); diff --git a/usr.sbin/radiusd/radiusd.c b/usr.sbin/radiusd/radiusd.c index 143cd0d1a..8e63f9783 100644 --- a/usr.sbin/radiusd/radiusd.c +++ b/usr.sbin/radiusd/radiusd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: radiusd.c,v 1.29 2023/09/04 10:50:52 yasuoka Exp $ */ +/* $OpenBSD: radiusd.c,v 1.31 2023/09/05 00:32:01 yasuoka Exp $ */ /* * Copyright (c) 2013 Internet Initiative Japan Inc. @@ -27,6 +27,7 @@ #include #include #include +#include #include #include #include @@ -489,6 +490,8 @@ radiusd_listen_on_event(int fd, short evmask, void *ctx) goto on_error; } found: + RADIUSD_ASSERT(authen->auth != NULL); + if (!MODULE_DO_USERPASS(authen->auth->module) && !MODULE_DO_ACCSREQ(authen->auth->module)) { log_warnx("Received %s(code=%d) from %s id=%d " @@ -918,7 +921,7 @@ radiusd_module_load(struct radiusd *radiusd, const char *path, const char *name) { struct radiusd_module *module = NULL; pid_t pid; - int pairsock[] = { -1, -1 }; + int ival, pairsock[] = { -1, -1 }; const char *av[3]; ssize_t n; struct imsg imsg; @@ -928,8 +931,7 @@ radiusd_module_load(struct radiusd *radiusd, const char *path, const char *name) fatal("Out of memory"); module->radiusd = radiusd; - if (socketpair(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK, PF_UNSPEC, - pairsock) == -1) { + if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, pairsock) == -1) { log_warn("Could not load module `%s'(%s): pipe()", name, path); goto on_error; } @@ -956,6 +958,16 @@ radiusd_module_load(struct radiusd *radiusd, const char *path, const char *name) close(pairsock[1]); module->fd = pairsock[0]; + if ((ival = fcntl(module->fd, F_GETFL)) == -1) { + log_warn("Could not load module `%s': fcntl(F_GETFL)", + name); + goto on_error; + } + if (fcntl(module->fd, F_SETFL, ival | O_NONBLOCK) == -1) { + log_warn("Could not load module `%s': fcntl(F_SETFL,O_NONBLOCK)", + name); + goto on_error; + } strlcpy(module->name, name, sizeof(module->name)); module->pid = pid; imsg_init(&module->ibuf, module->fd); diff --git a/usr.sbin/unbound/Makefile.in b/usr.sbin/unbound/Makefile.in index df57b7f3b..fef4c5283 100644 --- a/usr.sbin/unbound/Makefile.in +++ b/usr.sbin/unbound/Makefile.in @@ -122,15 +122,15 @@ iterator/iter_delegpt.c iterator/iter_donotq.c iterator/iter_fwd.c \ iterator/iter_hints.c iterator/iter_priv.c iterator/iter_resptype.c \ iterator/iter_scrub.c iterator/iter_utils.c services/listen_dnsport.c \ services/localzone.c services/mesh.c services/modstack.c services/view.c \ -services/rpz.c \ +services/rpz.c util/rfc_1982.c \ services/outbound_list.c services/outside_network.c util/alloc.c \ util/config_file.c util/configlexer.c util/configparser.c \ util/shm_side/shm_main.c services/authzone.c \ util/fptr_wlist.c util/locks.c util/log.c util/mini_event.c util/module.c \ util/netevent.c util/net_help.c util/random.c util/rbtree.c util/regional.c \ -util/rtt.c util/edns.c util/storage/dnstree.c util/storage/lookup3.c \ +util/rtt.c util/siphash.c util/edns.c util/storage/dnstree.c util/storage/lookup3.c \ util/storage/lruhash.c util/storage/slabhash.c util/tcp_conn_limit.c \ -util/timehist.c util/tube.c util/proxy_protocol.c \ +util/timehist.c util/tube.c util/proxy_protocol.c util/timeval_func.c \ util/ub_event.c util/ub_event_pluggable.c util/winsock_event.c \ validator/autotrust.c validator/val_anchor.c validator/validator.c \ validator/val_kcache.c validator/val_kentry.c validator/val_neg.c \ @@ -145,14 +145,14 @@ as112.lo msgparse.lo msgreply.lo packed_rrset.lo iterator.lo iter_delegpt.lo \ iter_donotq.lo iter_fwd.lo iter_hints.lo iter_priv.lo iter_resptype.lo \ iter_scrub.lo iter_utils.lo localzone.lo mesh.lo modstack.lo view.lo \ outbound_list.lo alloc.lo config_file.lo configlexer.lo configparser.lo \ -fptr_wlist.lo edns.lo locks.lo log.lo mini_event.lo module.lo net_help.lo \ +fptr_wlist.lo siphash.lo edns.lo locks.lo log.lo mini_event.lo module.lo net_help.lo \ random.lo rbtree.lo regional.lo rtt.lo dnstree.lo lookup3.lo lruhash.lo \ slabhash.lo tcp_conn_limit.lo timehist.lo tube.lo winsock_event.lo \ -autotrust.lo val_anchor.lo rpz.lo proxy_protocol.lo \ +autotrust.lo val_anchor.lo rpz.lo rfc_1982.lo proxy_protocol.lo \ validator.lo val_kcache.lo val_kentry.lo val_neg.lo val_nsec3.lo val_nsec.lo \ val_secalgo.lo val_sigcrypt.lo val_utils.lo dns64.lo $(CACHEDB_OBJ) authzone.lo \ $(SUBNET_OBJ) $(PYTHONMOD_OBJ) $(CHECKLOCK_OBJ) $(DNSTAP_OBJ) $(DNSCRYPT_OBJ) \ -$(IPSECMOD_OBJ) $(IPSET_OBJ) $(DYNLIBMOD_OBJ) respip.lo +$(IPSECMOD_OBJ) $(IPSET_OBJ) $(DYNLIBMOD_OBJ) respip.lo timeval_func.lo COMMON_OBJ_WITHOUT_UB_EVENT=$(COMMON_OBJ_WITHOUT_NETCALL) netevent.lo listen_dnsport.lo \ outside_network.lo COMMON_OBJ=$(COMMON_OBJ_WITHOUT_UB_EVENT) ub_event.lo @@ -455,6 +455,7 @@ unbound-dnstap-socket.lo unbound-dnstap-socket.o: $(srcdir)/dnstap/unbound-dnsta dynlibmod.lo dynlibdmod.o: $(srcdir)/dynlibmod/dynlibmod.c config.h $(srcdir)/dynlibmod/dynlibmod.h cachedb.lo cachedb.o: $(srcdir)/cachedb/cachedb.c config.h $(srcdir)/cachedb/cachedb.h redis.lo redis.o: $(srcdir)/cachedb/redis.c config.h $(srcdir)/cachedb/redis.h +timeval_func.lo timeval_func.o: $(srcdir)/util/timeval_func.c $(srcdir)/util/timeval_func.h # dnscrypt dnscrypt.lo dnscrypt.o: $(srcdir)/dnscrypt/dnscrypt.c config.h \ @@ -498,6 +499,7 @@ util/configlexer.c: $(srcdir)/util/configlexer.lex util/configparser.h echo "#include \"util/configyyrename.h\"" >> $@ ;\ $(LEX) -t $(srcdir)/util/configlexer.lex >> $@ ;\ fi + @if test ! -f $@; then echo "No $@ : need flex and bison to compile from source repository"; exit 1; fi util/configparser.c util/configparser.h: $(srcdir)/util/configparser.y @-if test ! -d util; then mkdir -p util; fi @@ -617,7 +619,7 @@ install-all: all $(PYTHONMOD_INSTALL) $(PYUNBOUND_INSTALL) $(UNBOUND_EVENT_INSTA $(INSTALL) -c -m 644 doc/unbound.conf.5 $(DESTDIR)$(mandir)/man5 $(INSTALL) -c -m 644 doc/unbound-host.1 $(DESTDIR)$(mandir)/man1 $(INSTALL) -c -m 755 unbound-control-setup $(DESTDIR)$(sbindir)/unbound-control-setup - if test ! -e $(DESTDIR)$(configfile); then $(INSTALL) -d `dirname $(DESTDIR)$(configfile)`; $(INSTALL) -c -m 644 doc/example.conf $(DESTDIR)$(configfile); fi + if test ! -e "$(DESTDIR)$(configfile)"; then $(INSTALL) -d `dirname "$(DESTDIR)$(configfile)"`; $(INSTALL) -c -m 644 doc/example.conf "$(DESTDIR)$(configfile)"; fi pythonmod-uninstall: rm -f -- $(DESTDIR)$(PYTHON_SITE_PKG)/unboundmodule.py @@ -646,7 +648,7 @@ uninstall: $(PYTHONMOD_UNINSTALL) $(PYUNBOUND_UNINSTALL) $(UNBOUND_EVENT_UNINSTA rm -f -- $(DESTDIR)$(includedir)/unbound.h $(LIBTOOL) --mode=uninstall rm -f $(DESTDIR)$(libdir)/libunbound.la @echo - @echo "You still need to remove "`dirname $(DESTDIR)$(configfile)`" , $(DESTDIR)$(configfile) by hand" + @echo "You still need to remove "`dirname "$(DESTDIR)$(configfile)"`" , $(DESTDIR)$(configfile) by hand" iana_update: curl -o port-numbers.tmp https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml --compressed @@ -916,7 +918,8 @@ config_file.lo config_file.o: $(srcdir)/util/config_file.c config.h $(srcdir)/ut configlexer.lo configlexer.o: util/configlexer.c config.h $(srcdir)/util/configyyrename.h \ $(srcdir)/util/config_file.h util/configparser.h configparser.lo configparser.o: util/configparser.c config.h $(srcdir)/util/configyyrename.h \ - $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h + $(srcdir)/util/config_file.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/sldns/str2wire.h \ + $(srcdir)/sldns/rrdef.h shm_main.lo shm_main.o: $(srcdir)/util/shm_side/shm_main.c config.h $(srcdir)/util/shm_side/shm_main.h \ $(srcdir)/libunbound/unbound.h $(srcdir)/daemon/daemon.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \ $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \ @@ -929,7 +932,7 @@ shm_main.lo shm_main.o: $(srcdir)/util/shm_side/shm_main.c config.h $(srcdir)/ut $(srcdir)/services/view.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/respip/respip.h \ $(srcdir)/services/cache/rrset.h $(srcdir)/util/storage/slabhash.h $(srcdir)/services/cache/infra.h \ $(srcdir)/util/rtt.h $(srcdir)/validator/validator.h $(srcdir)/validator/val_utils.h $(srcdir)/util/fptr_wlist.h \ - $(srcdir)/util/tube.h + $(srcdir)/util/tube.h $(srcdir)/util/timeval_func.h authzone.lo authzone.o: $(srcdir)/services/authzone.c config.h $(srcdir)/services/authzone.h \ $(srcdir)/util/rbtree.h $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/services/mesh.h $(srcdir)/util/netevent.h \ $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/data/msgparse.h \ @@ -984,7 +987,7 @@ netevent.lo netevent.o: $(srcdir)/util/netevent.c config.h $(srcdir)/util/neteve $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h $(srcdir)/services/localzone.h $(srcdir)/services/view.h \ $(srcdir)/sldns/sbuffer.h $(srcdir)/util/config_file.h $(srcdir)/services/authzone.h $(srcdir)/daemon/stats.h \ $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h $(srcdir)/respip/respip.h $(srcdir)/sldns/str2wire.h \ - $(srcdir)/dnstap/dnstap.h $(srcdir)/services/listen_dnsport.h + $(srcdir)/dnstap/dnstap.h $(srcdir)/services/listen_dnsport.h $(srcdir)/util/timeval_func.h proxy_protocol.lo proxy_protocol.o: $(srcdir)/util/proxy_protocol.c config.h \ $(srcdir)/util/proxy_protocol.h $(srcdir)/sldns/sbuffer.h net_help.lo net_help.o: $(srcdir)/util/net_help.c config.h $(srcdir)/util/net_help.h $(srcdir)/util/log.h \ @@ -1007,6 +1010,8 @@ rtt.lo rtt.o: $(srcdir)/util/rtt.c config.h $(srcdir)/util/rtt.h $(srcdir)/itera $(srcdir)/services/outbound_list.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/storage/lruhash.h \ $(srcdir)/util/locks.h $(srcdir)/util/log.h $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/module.h \ $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h +siphash.lo siphash.o: $(srcdir)/util/siphash.c +rfc_1982.lo rfc_1982.o: $(srcdir)/util/rfc_1982.c edns.lo edns.o: $(srcdir)/util/edns.c config.h $(srcdir)/util/edns.h $(srcdir)/util/storage/dnstree.h \ $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \ $(srcdir)/util/net_help.h $(srcdir)/util/log.h $(srcdir)/util/regional.h \ @@ -1322,7 +1327,7 @@ unbound.lo unbound.o: $(srcdir)/daemon/unbound.c config.h $(srcdir)/util/log.h $ worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \ $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \ - $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \ + $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/timeval_func.h \ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/daemon.h \ @@ -1344,7 +1349,7 @@ testbound.lo testbound.o: $(srcdir)/testcode/testbound.c config.h $(srcdir)/test $(srcdir)/daemon/remote.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \ $(srcdir)/util/config_file.h $(srcdir)/sldns/keyraw.h $(srcdir)/daemon/unbound.c $(srcdir)/daemon/daemon.h \ - $(srcdir)/util/alloc.h $(srcdir)/services/modstack.h \ + $(srcdir)/util/alloc.h $(srcdir)/util/timeval_func.h $(srcdir)/services/modstack.h \ $(srcdir)/util/storage/slabhash.h $(srcdir)/services/listen_dnsport.h $(srcdir)/services/cache/rrset.h \ $(srcdir)/services/cache/infra.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rtt.h \ $(srcdir)/util/data/msgreply.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \ @@ -1358,7 +1363,7 @@ testpkts.lo testpkts.o: $(srcdir)/testcode/testpkts.c config.h $(srcdir)/testcod worker.lo worker.o: $(srcdir)/daemon/worker.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \ $(srcdir)/util/random.h $(srcdir)/daemon/worker.h $(srcdir)/libunbound/worker.h $(srcdir)/sldns/sbuffer.h \ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/storage/lruhash.h $(srcdir)/util/locks.h \ - $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \ + $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h $(srcdir)/util/timeval_func.h \ $(srcdir)/util/alloc.h $(srcdir)/util/data/msgreply.h $(srcdir)/util/data/msgparse.h $(srcdir)/sldns/pkthdr.h \ $(srcdir)/sldns/rrdef.h $(srcdir)/daemon/stats.h $(srcdir)/util/timehist.h $(srcdir)/libunbound/unbound.h \ $(srcdir)/util/module.h $(srcdir)/dnstap/dnstap.h $(srcdir)/daemon/daemon.h \ @@ -1410,7 +1415,7 @@ stats.lo stats.o: $(srcdir)/daemon/stats.c config.h $(srcdir)/daemon/stats.h $(s $(srcdir)/validator/val_kcache.h $(srcdir)/validator/val_neg.h replay.lo replay.o: $(srcdir)/testcode/replay.c config.h $(srcdir)/util/log.h $(srcdir)/util/net_help.h \ $(srcdir)/util/config_file.h $(srcdir)/testcode/replay.h $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \ - $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h \ + $(srcdir)/testcode/testpkts.h $(srcdir)/util/rbtree.h $(srcdir)/util/timeval_func.h \ $(srcdir)/testcode/fake_event.h $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/rrdef.h fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/testcode/fake_event.h \ $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h \ @@ -1418,7 +1423,7 @@ fake_event.lo fake_event.o: $(srcdir)/testcode/fake_event.c config.h $(srcdir)/t $(srcdir)/util/locks.h $(srcdir)/sldns/pkthdr.h $(srcdir)/sldns/rrdef.h $(srcdir)/util/data/msgreply.h \ $(srcdir)/util/data/packed_rrset.h $(srcdir)/util/data/msgencode.h $(srcdir)/util/data/dname.h \ $(srcdir)/util/edns.h $(srcdir)/util/storage/dnstree.h $(srcdir)/util/rbtree.h $(srcdir)/util/config_file.h \ - $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h \ + $(srcdir)/services/listen_dnsport.h $(srcdir)/services/outside_network.h $(srcdir)/util/timeval_func.h \ $(srcdir)/services/cache/infra.h $(srcdir)/util/rtt.h \ $(srcdir)/testcode/replay.h $(srcdir)/testcode/testpkts.h $(srcdir)/util/fptr_wlist.h $(srcdir)/util/module.h \ $(srcdir)/util/tube.h $(srcdir)/services/mesh.h $(srcdir)/services/modstack.h $(srcdir)/services/rpz.h \ diff --git a/usr.sbin/unbound/README.md b/usr.sbin/unbound/README.md index d1bbcf2b7..c220da030 100644 --- a/usr.sbin/unbound/README.md +++ b/usr.sbin/unbound/README.md @@ -1,9 +1,10 @@ # Unbound -[![Travis Build Status](https://travis-ci.org/NLnetLabs/unbound.svg?branch=master)](https://travis-ci.org/NLnetLabs/unbound) +[![Github Build Status](https://github.com/NLnetLabs/unbound/actions/workflows/ci.yml/badge.svg?branch=master)](https://github.com/NLnetLabs/unbound/actions) [![Packaging status](https://repology.org/badge/tiny-repos/unbound.svg)](https://repology.org/project/unbound/versions) [![Fuzzing Status](https://oss-fuzz-build-logs.storage.googleapis.com/badges/unbound.svg)](https://bugs.chromium.org/p/oss-fuzz/issues/list?sort=-opened&can=1&q=proj:unbound) [![Documentation Status](https://readthedocs.org/projects/unbound/badge/?version=latest)](https://unbound.readthedocs.io/en/latest/?badge=latest) +[![Mastodon Follow](https://img.shields.io/mastodon/follow/109262826617293067?domain=https%3A%2F%2Ffosstodon.org&style=social)](https://fosstodon.org/@nlnetlabs) Unbound is a validating, recursive, caching DNS resolver. It is designed to be fast and lean and incorporates modern features based on open standards. If you diff --git a/usr.sbin/unbound/acx_nlnetlabs.m4 b/usr.sbin/unbound/acx_nlnetlabs.m4 index a84fe3f8f..54d32907b 100644 --- a/usr.sbin/unbound/acx_nlnetlabs.m4 +++ b/usr.sbin/unbound/acx_nlnetlabs.m4 @@ -2,7 +2,9 @@ # Copyright 2009, Wouter Wijngaards, NLnet Labs. # BSD licensed. # -# Version 44 +# Version 46 +# 2023-05-04 fix to remove unused whitespace. +# 2023-01-26 fix -Wstrict-prototypes. # 2022-09-01 fix checking if nonblocking sockets work on OpenBSD. # 2021-08-17 fix sed script in ssldir split handling. # 2021-08-17 fix for openssl to detect split version, with ssldir_include @@ -187,7 +189,7 @@ dnl cache=`echo $1 | sed 'y%.=/+- %___p__%'` AC_CACHE_VAL(cv_prog_cc_flag_needed_$cache, [ echo '$2' > conftest.c -echo 'void f(){}' >>conftest.c +echo 'void f(void){}' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_needed_$cache=no" else @@ -233,7 +235,7 @@ dnl DEPFLAG: set to flag that generates dependencies. AC_DEFUN([ACX_DEPFLAG], [ AC_MSG_CHECKING([$CC dependency flag]) -echo 'void f(){}' >conftest.c +echo 'void f(void){}' >conftest.c if test "`$CC -MM conftest.c 2>&1`" = "conftest.o: conftest.c"; then DEPFLAG="-MM" else @@ -272,7 +274,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAUL #include #endif -int test() { +int test(void) { int a; char **opts = NULL; struct timeval tv; @@ -309,7 +311,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAUL #include #endif -int test() { +int test(void) { int a; char **opts = NULL; struct timeval tv; @@ -335,7 +337,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG, [ #include #include -int test() { +int test(void) { int a = 0; return a; } @@ -345,7 +347,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D_BSD_SOURCE -D_DEFAULT_SOURCE, [ #include -int test() { +int test(void) { int a; a = isascii(32); return a; @@ -356,7 +358,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D_GNU_SOURCE, [ #include -int test() { +int test(void) { struct in6_pktinfo inf; int a = (int)sizeof(inf); return a; @@ -370,7 +372,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D_GNU_SOURCE -D_FRSRESGID, [ #include -int test() { +int test(void) { int a = setresgid(0,0,0); a = setresuid(0,0,0); return a; @@ -385,7 +387,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D_POSIX_C_SOURCE=200112, #endif #include -int test() { +int test(void) { int a = 0; char *t; time_t time = 0; @@ -413,7 +415,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D__EXTENSIONS__, #include #endif -int test() { +int test(void) { int a; char **opts = NULL; struct timeval tv; @@ -834,7 +836,7 @@ dnl try to see if an additional _LARGEFILE_SOURCE 1 is needed to get fseeko ACX_CHECK_COMPILER_FLAG_NEEDED(-D_LARGEFILE_SOURCE=1, [ #include -int test() { +int test(void) { int a = fseeko(stdin, 0, 0); return a; } @@ -859,7 +861,7 @@ char* (*f) () = getaddrinfo; #ifdef __cplusplus } #endif -int main() { +int main(void) { ; return 0; } @@ -923,7 +925,7 @@ cache=`echo $1 | sed 'y%.=/+-%___p_%'` AC_CACHE_VAL(cv_cc_deprecated_$cache, [ echo '$3' >conftest.c -echo 'void f(){ $2 }' >>conftest.c +echo 'void f(void){ $2 }' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS -c conftest.c 2>&1 | grep -e deprecated -e unavailable`"; then eval "cv_cc_deprecated_$cache=no" else @@ -1355,7 +1357,7 @@ dnl $3: define value, 1 AC_DEFUN([AHX_CONFIG_FLAG_OMITTED], [#if defined($1) && !defined($2) #define $2 $3 -[#]endif ]) +[#]endif]) dnl Wrapper for AHX_CONFIG_FLAG_OMITTED for -D style flags dnl $1: the -DNAME or -DNAME=value string. diff --git a/usr.sbin/unbound/acx_python.m4 b/usr.sbin/unbound/acx_python.m4 index 16c0c6fd9..c945d6c89 100644 --- a/usr.sbin/unbound/acx_python.m4 +++ b/usr.sbin/unbound/acx_python.m4 @@ -17,33 +17,62 @@ AC_DEFUN([AC_PYTHON_DEVEL],[ PYTHON_VERSION=`$PYTHON -c "import sys; \ print(sys.version.split()[[0]])"` fi + # calculate the version number components. + [ + v="$PYTHON_VERSION" + PYTHON_VERSION_MAJOR=`echo $v | sed 's/[^0-9].*//'` + if test -z "$PYTHON_VERSION_MAJOR"; then PYTHON_VERSION_MAJOR="0"; fi + v=`echo $v | sed -e 's/^[0-9]*$//' -e 's/[0-9]*[^0-9]//'` + PYTHON_VERSION_MINOR=`echo $v | sed 's/[^0-9].*//'` + if test -z "$PYTHON_VERSION_MINOR"; then PYTHON_VERSION_MINOR="0"; fi + v=`echo $v | sed -e 's/^[0-9]*$//' -e 's/[0-9]*[^0-9]//'` + PYTHON_VERSION_PATCH=`echo $v | sed 's/[^0-9].*//'` + if test -z "$PYTHON_VERSION_PATCH"; then PYTHON_VERSION_PATCH="0"; fi + ] - # Check if you have sysconfig - AC_MSG_CHECKING([for the sysconfig Python module]) - if ac_sysconfig_result=`$PYTHON -c "import sysconfig" 2>&1`; then + # For some systems, sysconfig exists, but has the wrong paths, + # on Debian 10, for python 2.7 and 3.7. So, we check the version, + # and for older versions try distutils.sysconfig first. For newer + # versions>=3.10, where distutils.sysconfig is deprecated, use + # sysconfig first and then attempt the other one. + py_distutils_first="no" + if test $PYTHON_VERSION_MAJOR -lt 3; then + py_distutils_first="yes" + fi + if test $PYTHON_VERSION_MAJOR -eq 3 -a $PYTHON_VERSION_MINOR -lt 10; then + py_distutils_first="yes" + fi + + # Check if you have the first module + if test "$py_distutils_first" = "yes"; then m="distutils"; else m="sysconfig"; fi + sysconfig_module="" + AC_MSG_CHECKING([for the $m Python module]) + if ac_modulecheck_result1=`$PYTHON -c "import $m" 2>&1`; then AC_MSG_RESULT([yes]) - sysconfig_module="sysconfig" - # if yes, use sysconfig, because distutils is deprecated. + sysconfig_module="$m" else AC_MSG_RESULT([no]) - # if no, try to use distutils + fi - # - # Check if you have distutils, else fail - # - AC_MSG_CHECKING([for the distutils Python package]) - if ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`; then + # if not found, try the other one. + if test -z "$sysconfig_module"; then + if test "$py_distutils_first" = "yes"; then m2="sysconfig"; else m2="distutils"; fi + AC_MSG_CHECKING([for the $m2 Python module]) + if ac_modulecheck_result2=`$PYTHON -c "import $m2" 2>&1`; then AC_MSG_RESULT([yes]) + sysconfig_module="$m2" else AC_MSG_RESULT([no]) - AC_MSG_ERROR([cannot import Python module "distutils". - Please check your Python installation. The error was: - $ac_distutils_result]) + AC_MSG_ERROR([cannot import Python module "$m", or "$m2". + Please check your Python installation. The errors are: + $m + $ac_modulecheck_result1 + $m2 + $ac_modulecheck_result2]) PYTHON_VERSION="" fi - - sysconfig_module="distutils.sysconfig" fi + if test "$sysconfig_module" = "distutils"; then sysconfig_module="distutils.sysconfig"; fi # # Check for Python include path diff --git a/usr.sbin/unbound/cachedb/cachedb.c b/usr.sbin/unbound/cachedb/cachedb.c index 8b912ec4d..0a6c05d6f 100644 --- a/usr.sbin/unbound/cachedb/cachedb.c +++ b/usr.sbin/unbound/cachedb/cachedb.c @@ -102,7 +102,6 @@ static int testframe_init(struct module_env* env, struct cachedb_env* cachedb_env) { struct testframe_moddata* d; - (void)env; verbose(VERB_ALGO, "testframe_init"); d = (struct testframe_moddata*)calloc(1, sizeof(struct testframe_moddata)); @@ -111,6 +110,15 @@ testframe_init(struct module_env* env, struct cachedb_env* cachedb_env) log_err("out of memory"); return 0; } + /* Register an EDNS option (65534) to bypass the worker cache lookup + * for testing */ + if(!edns_register_option(LDNS_EDNS_UNBOUND_CACHEDB_TESTFRAME_TEST, + 1 /* bypass cache */, + 0 /* no aggregation */, env)) { + log_err("testframe_init, could not register test opcode"); + free(d); + return 0; + } lock_basic_init(&d->lock); lock_protect(&d->lock, d, sizeof(*d)); return 1; @@ -218,6 +226,8 @@ static int cachedb_apply_cfg(struct cachedb_env* cachedb_env, struct config_file* cfg) { const char* backend_str = cfg->cachedb_backend; + if(!backend_str || *backend_str==0) + return 1; cachedb_env->backend = cachedb_find_backend(backend_str); if(!cachedb_env->backend) { log_err("cachedb: cannot find backend name '%s'", backend_str); @@ -274,12 +284,9 @@ cachedb_deinit(struct module_env* env, int id) if(!env || !env->modinfo[id]) return; cachedb_env = (struct cachedb_env*)env->modinfo[id]; - /* free contents */ - /* TODO */ if(cachedb_env->enabled) { (*cachedb_env->backend->deinit)(env, cachedb_env); } - free(cachedb_env); env->modinfo[id] = NULL; } @@ -390,6 +397,15 @@ prep_data(struct module_qstate* qstate, struct sldns_buffer* buf) if(!qstate->return_msg || !qstate->return_msg->rep) return 0; + /* do not store failures like SERVFAIL in the cachedb, this avoids + * overwriting expired, valid, content with broken content. */ + if(FLAGS_GET_RCODE(qstate->return_msg->rep->flags) != + LDNS_RCODE_NOERROR && + FLAGS_GET_RCODE(qstate->return_msg->rep->flags) != + LDNS_RCODE_NXDOMAIN && + FLAGS_GET_RCODE(qstate->return_msg->rep->flags) != + LDNS_RCODE_YXDOMAIN) + return 0; /* We don't store the reply if its TTL is 0 unless serve-expired is * enabled. Such a reply won't be reusable and simply be a waste for * the backend. It's also compatible with the default behavior of @@ -397,6 +413,14 @@ prep_data(struct module_qstate* qstate, struct sldns_buffer* buf) if(qstate->return_msg->rep->ttl == 0 && !qstate->env->cfg->serve_expired) return 0; + + /* The EDE is added to the out-list so it is encoded in the cached message */ + if (qstate->env->cfg->ede && qstate->return_msg->rep->reason_bogus != LDNS_EDE_NONE) { + edns_opt_list_append_ede(&edns.opt_list_out, qstate->env->scratch, + qstate->return_msg->rep->reason_bogus, + qstate->return_msg->rep->reason_bogus_str); + } + if(verbosity >= VERB_ALGO) log_dns_msg("cachedb encoding", &qstate->return_msg->qinfo, qstate->return_msg->rep); @@ -493,6 +517,7 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf) { struct msg_parse* prs; struct edns_data edns; + struct edns_option* ede; uint64_t timestamp, expiry; time_t adjust; size_t lim = sldns_buffer_limit(buf); @@ -530,6 +555,24 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf) if(!qstate->return_msg) return 0; + /* We find the EDE in the in-list after parsing */ + if(qstate->env->cfg->ede && + (ede = edns_opt_list_find(edns.opt_list_in, LDNS_EDNS_EDE))) { + if(ede->opt_len >= 2) { + qstate->return_msg->rep->reason_bogus = + sldns_read_uint16(ede->opt_data); + } + /* allocate space and store the error string and it's size */ + if(ede->opt_len > 2) { + size_t ede_len = ede->opt_len - 2; + qstate->return_msg->rep->reason_bogus_str = regional_alloc( + qstate->region, sizeof(char) * (ede_len+1)); + memcpy(qstate->return_msg->rep->reason_bogus_str, + ede->opt_data+2, ede_len); + qstate->return_msg->rep->reason_bogus_str[ede_len] = 0; + } + } + qstate->return_rcode = LDNS_RCODE_NOERROR; /* see how much of the TTL expired, and remove it */ @@ -542,10 +585,16 @@ parse_data(struct module_qstate* qstate, struct sldns_buffer* buf) verbose(VERB_ALGO, "cachedb msg expired"); /* If serve-expired is enabled, we still use an expired message * setting the TTL to 0. */ - if(qstate->env->cfg->serve_expired) - adjust = -1; - else + if(!qstate->env->cfg->serve_expired || + (FLAGS_GET_RCODE(qstate->return_msg->rep->flags) + != LDNS_RCODE_NOERROR && + FLAGS_GET_RCODE(qstate->return_msg->rep->flags) + != LDNS_RCODE_NXDOMAIN && + FLAGS_GET_RCODE(qstate->return_msg->rep->flags) + != LDNS_RCODE_YXDOMAIN)) return 0; /* message expired */ + else + adjust = -1; } verbose(VERB_ALGO, "cachedb msg adjusted down by %d", (int)adjust); adjust_msg_ttl(qstate->return_msg, adjust); @@ -615,11 +664,15 @@ cachedb_extcache_store(struct module_qstate* qstate, struct cachedb_env* ie) * See if unbound's internal cache can answer the query */ static int -cachedb_intcache_lookup(struct module_qstate* qstate) +cachedb_intcache_lookup(struct module_qstate* qstate, struct cachedb_env* cde) { uint8_t* dpname=NULL; size_t dpnamelen=0; struct dns_msg* msg; + /* for testframe bypass this lookup */ + if(cde->backend == &testframe_backend) { + return 0; + } if(iter_stub_fwd_no_cache(qstate, &qstate->qinfo, &dpname, &dpnamelen)) return 0; /* no cache for these queries */ @@ -678,6 +731,7 @@ cachedb_handle_query(struct module_qstate* qstate, struct cachedb_qstate* ATTR_UNUSED(iq), struct cachedb_env* ie, int id) { + qstate->is_cachedb_answer = 0; /* check if we are enabled, and skip if so */ if(!ie->enabled) { /* pass request to next module */ @@ -694,7 +748,7 @@ cachedb_handle_query(struct module_qstate* qstate, /* lookup inside unbound's internal cache. * This does not look for expired entries. */ - if(cachedb_intcache_lookup(qstate)) { + if(cachedb_intcache_lookup(qstate, ie)) { if(verbosity >= VERB_ALGO) { if(qstate->return_msg->rep) log_dns_msg("cachedb internal cache lookup", @@ -731,6 +785,7 @@ cachedb_handle_query(struct module_qstate* qstate, qstate->ext_state[id] = module_wait_module; return; } + qstate->is_cachedb_answer = 1; /* we are done with the query */ qstate->ext_state[id] = module_finished; return; @@ -753,6 +808,7 @@ static void cachedb_handle_response(struct module_qstate* qstate, struct cachedb_qstate* ATTR_UNUSED(iq), struct cachedb_env* ie, int id) { + qstate->is_cachedb_answer = 0; /* check if we are not enabled or instructed to not cache, and skip */ if(!ie->enabled || qstate->no_cache_store) { /* we are done with the query */ diff --git a/usr.sbin/unbound/cachedb/redis.c b/usr.sbin/unbound/cachedb/redis.c index 91bc64b72..61a34c2a1 100644 --- a/usr.sbin/unbound/cachedb/redis.c +++ b/usr.sbin/unbound/cachedb/redis.c @@ -56,6 +56,8 @@ struct redis_moddata { int numctxs; /* number of ctx entries */ const char* server_host; /* server's IP address or host name */ int server_port; /* server's TCP port */ + const char* server_path; /* server's unix path, or "", NULL if unused */ + const char* server_password; /* server's AUTH password, or "", NULL if unused */ struct timeval timeout; /* timeout for connection setup and commands */ }; @@ -67,8 +69,13 @@ redis_connect(const struct redis_moddata* moddata) { redisContext* ctx; - ctx = redisConnectWithTimeout(moddata->server_host, - moddata->server_port, moddata->timeout); + if(moddata->server_path && moddata->server_path[0]!=0) { + ctx = redisConnectUnixWithTimeout(moddata->server_path, + moddata->timeout); + } else { + ctx = redisConnectWithTimeout(moddata->server_host, + moddata->server_port, moddata->timeout); + } if(!ctx || ctx->err) { const char *errstr = "out of memory"; if(ctx) @@ -80,6 +87,17 @@ redis_connect(const struct redis_moddata* moddata) log_err("failed to set redis timeout"); goto fail; } + if(moddata->server_password && moddata->server_password[0]!=0) { + redisReply* rep; + rep = redisCommand(ctx, "AUTH %s", moddata->server_password); + if(!rep || rep->type == REDIS_REPLY_ERROR) { + log_err("failed to authenticate with password"); + freeReplyObject(rep); + goto fail; + } + freeReplyObject(rep); + } + verbose(VERB_OPS, "Connection to Redis established"); return ctx; fail: @@ -94,7 +112,7 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env) int i; struct redis_moddata* moddata = NULL; - verbose(VERB_ALGO, "redis_init"); + verbose(VERB_OPS, "Redis initialization"); moddata = calloc(1, sizeof(struct redis_moddata)); if(!moddata) { @@ -112,6 +130,8 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env) * we don't have to free it in this module. */ moddata->server_host = env->cfg->redis_server_host; moddata->server_port = env->cfg->redis_server_port; + moddata->server_path = env->cfg->redis_server_path; + moddata->server_password = env->cfg->redis_server_password; moddata->timeout.tv_sec = env->cfg->redis_timeout / 1000; moddata->timeout.tv_usec = (env->cfg->redis_timeout % 1000) * 1000; for(i = 0; i < moddata->numctxs; i++) @@ -154,7 +174,7 @@ redis_deinit(struct module_env* env, struct cachedb_env* cachedb_env) cachedb_env->backend_data; (void)env; - verbose(VERB_ALGO, "redis_deinit"); + verbose(VERB_OPS, "Redis deinitialization"); if(!moddata) return; diff --git a/usr.sbin/unbound/config.guess b/usr.sbin/unbound/config.guess index 980b02083..b18721393 100644 --- a/usr.sbin/unbound/config.guess +++ b/usr.sbin/unbound/config.guess @@ -1,10 +1,10 @@ #! /bin/sh # Attempt to guess a canonical system name. -# Copyright 1992-2022 Free Software Foundation, Inc. +# Copyright 1992-2023 Free Software Foundation, Inc. # shellcheck disable=SC2006,SC2268 # see below for rationale -timestamp='2022-09-17' +timestamp='2023-07-20' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by @@ -47,7 +47,7 @@ me=`echo "$0" | sed -e 's,.*/,,'` usage="\ Usage: $0 [OPTION] -Output the configuration name of the system \`$me' is run on. +Output the configuration name of the system '$me' is run on. Options: -h, --help print this help, then exit @@ -60,13 +60,13 @@ version="\ GNU config.guess ($timestamp) Originally written by Per Bothner. -Copyright 1992-2022 Free Software Foundation, Inc. +Copyright 1992-2023 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." help=" -Try \`$me --help' for more information." +Try '$me --help' for more information." # Parse command line while test $# -gt 0 ; do @@ -102,8 +102,8 @@ GUESS= # temporary files to be created and, as you can see below, it is a # headache to deal with in a portable fashion. -# Historically, `CC_FOR_BUILD' used to be named `HOST_CC'. We still -# use `HOST_CC' if defined, but it is deprecated. +# Historically, 'CC_FOR_BUILD' used to be named 'HOST_CC'. We still +# use 'HOST_CC' if defined, but it is deprecated. # Portable tmp directory creation inspired by the Autoconf team. @@ -459,7 +459,7 @@ case $UNAME_MACHINE:$UNAME_SYSTEM:$UNAME_RELEASE:$UNAME_VERSION in UNAME_RELEASE=`uname -v` ;; esac - # Japanese Language versions have a version number like `4.1.3-JL'. + # Japanese Language versions have a version number like '4.1.3-JL'. SUN_REL=`echo "$UNAME_RELEASE" | sed -e 's/-/_/'` GUESS=sparc-sun-sunos$SUN_REL ;; @@ -976,7 +976,27 @@ EOF GUESS=$UNAME_MACHINE-unknown-minix ;; aarch64:Linux:*:*) - GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + set_cc_for_build + CPU=$UNAME_MACHINE + LIBCABI=$LIBC + if test "$CC_FOR_BUILD" != no_compiler_found; then + ABI=64 + sed 's/^ //' << EOF > "$dummy.c" + #ifdef __ARM_EABI__ + #ifdef __ARM_PCS_VFP + ABI=eabihf + #else + ABI=eabi + #endif + #endif +EOF + cc_set_abi=`$CC_FOR_BUILD -E "$dummy.c" 2>/dev/null | grep '^ABI' | sed 's, ,,g'` + eval "$cc_set_abi" + case $ABI in + eabi | eabihf) CPU=armv8l; LIBCABI=$LIBC$ABI ;; + esac + fi + GUESS=$CPU-unknown-linux-$LIBCABI ;; aarch64_be:Linux:*:*) UNAME_MACHINE=aarch64_be @@ -1042,6 +1062,15 @@ EOF k1om:Linux:*:*) GUESS=$UNAME_MACHINE-unknown-linux-$LIBC ;; + kvx:Linux:*:*) + GUESS=$UNAME_MACHINE-unknown-linux-$LIBC + ;; + kvx:cos:*:*) + GUESS=$UNAME_MACHINE-unknown-cos + ;; + kvx:mbr:*:*) + GUESS=$UNAME_MACHINE-unknown-mbr + ;; loongarch32:Linux:*:* | loongarch64:Linux:*:*) GUESS=$UNAME_MACHINE-unknown-linux-$LIBC ;; @@ -1197,7 +1226,7 @@ EOF GUESS=$UNAME_MACHINE-pc-sysv4.2uw$UNAME_VERSION ;; i*86:OS/2:*:*) - # If we were able to find `uname', then EMX Unix compatibility + # If we were able to find 'uname', then EMX Unix compatibility # is probably installed. GUESS=$UNAME_MACHINE-pc-os2-emx ;; @@ -1338,7 +1367,7 @@ EOF GUESS=ns32k-sni-sysv fi ;; - PENTIUM:*:4.0*:*) # Unisys `ClearPath HMP IX 4000' SVR4/MP effort + PENTIUM:*:4.0*:*) # Unisys 'ClearPath HMP IX 4000' SVR4/MP effort # says GUESS=i586-unisys-sysv4 ;; diff --git a/usr.sbin/unbound/config.h.in b/usr.sbin/unbound/config.h.in index 1f1d87b43..845abe134 100644 --- a/usr.sbin/unbound/config.h.in +++ b/usr.sbin/unbound/config.h.in @@ -367,6 +367,9 @@ /* Define if we have LibreSSL */ #undef HAVE_LIBRESSL +/* Define to 1 if you have the header file. */ +#undef HAVE_LINUX_NET_TSTAMP_H + /* Define to 1 if you have the `localtime_r' function. */ #undef HAVE_LOCALTIME_R @@ -1071,39 +1074,39 @@ #if defined(OMITTED__D_GNU_SOURCE) && !defined(_GNU_SOURCE) #define _GNU_SOURCE 1 -#endif +#endif #if defined(OMITTED__D_BSD_SOURCE) && !defined(_BSD_SOURCE) #define _BSD_SOURCE 1 -#endif +#endif #if defined(OMITTED__D_DEFAULT_SOURCE) && !defined(_DEFAULT_SOURCE) #define _DEFAULT_SOURCE 1 -#endif +#endif #if defined(OMITTED__D__EXTENSIONS__) && !defined(__EXTENSIONS__) #define __EXTENSIONS__ 1 -#endif +#endif #if defined(OMITTED__D_POSIX_C_SOURCE_200112) && !defined(_POSIX_C_SOURCE) #define _POSIX_C_SOURCE 200112 -#endif +#endif #if defined(OMITTED__D_XOPEN_SOURCE_600) && !defined(_XOPEN_SOURCE) #define _XOPEN_SOURCE 600 -#endif +#endif #if defined(OMITTED__D_XOPEN_SOURCE_EXTENDED_1) && !defined(_XOPEN_SOURCE_EXTENDED) #define _XOPEN_SOURCE_EXTENDED 1 -#endif +#endif #if defined(OMITTED__D_ALL_SOURCE) && !defined(_ALL_SOURCE) #define _ALL_SOURCE 1 -#endif +#endif #if defined(OMITTED__D_LARGEFILE_SOURCE_1) && !defined(_LARGEFILE_SOURCE) #define _LARGEFILE_SOURCE 1 -#endif +#endif @@ -1187,7 +1190,7 @@ #endif - + #ifdef HAVE_ATTR_FORMAT # define ATTR_FORMAT(archetype, string_index, first_to_check) \ __attribute__ ((format (archetype, string_index, first_to_check))) @@ -1297,7 +1300,7 @@ void* reallocarray(void *ptr, size_t nmemb, size_t size); #ifdef HAVE_WINSOCK2_H #define FD_SET_T (u_int) #else -#define FD_SET_T +#define FD_SET_T #endif diff --git a/usr.sbin/unbound/config.sub b/usr.sbin/unbound/config.sub index baf1512b3..6ae250275 100644 --- a/usr.sbin/unbound/config.sub +++ b/usr.sbin/unbound/config.sub @@ -1,10 +1,10 @@ #! /bin/sh # Configuration validation subroutine script. -# Copyright 1992-2022 Free Software Foundation, Inc. +# Copyright 1992-2023 Free Software Foundation, Inc. # shellcheck disable=SC2006,SC2268 # see below for rationale -timestamp='2022-09-17' +timestamp='2023-07-31' # This file is free software; you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by @@ -76,13 +76,13 @@ Report bugs and patches to ." version="\ GNU config.sub ($timestamp) -Copyright 1992-2022 Free Software Foundation, Inc. +Copyright 1992-2023 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE." help=" -Try \`$me --help' for more information." +Try '$me --help' for more information." # Parse command line while test $# -gt 0 ; do @@ -130,7 +130,7 @@ IFS=$saved_IFS # Separate into logical components for further validation case $1 in *-*-*-*-*) - echo Invalid configuration \`"$1"\': more than four components >&2 + echo "Invalid configuration '$1': more than four components" >&2 exit 1 ;; *-*-*-*) @@ -145,7 +145,8 @@ case $1 in nto-qnx* | linux-* | uclinux-uclibc* \ | uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* \ | netbsd*-eabi* | kopensolaris*-gnu* | cloudabi*-eabi* \ - | storm-chaos* | os2-emx* | rtmk-nova* | managarm-*) + | storm-chaos* | os2-emx* | rtmk-nova* | managarm-* \ + | windows-* ) basic_machine=$field1 basic_os=$maybe_os ;; @@ -943,7 +944,7 @@ $basic_machine EOF IFS=$saved_IFS ;; - # We use `pc' rather than `unknown' + # We use 'pc' rather than 'unknown' # because (1) that's what they normally are, and # (2) the word "unknown" tends to confuse beginning users. i*86 | x86_64) @@ -1075,7 +1076,7 @@ case $cpu-$vendor in pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*) cpu=i586 ;; - pentiumpro-* | p6-* | 6x86-* | athlon-* | athalon_*-*) + pentiumpro-* | p6-* | 6x86-* | athlon-* | athlon_*-*) cpu=i686 ;; pentiumii-* | pentium2-* | pentiumiii-* | pentium3-*) @@ -1205,6 +1206,7 @@ case $cpu-$vendor in | i370 | i*86 | i860 | i960 | ia16 | ia64 \ | ip2k | iq2000 \ | k1om \ + | kvx \ | le32 | le64 \ | lm32 \ | loongarch32 | loongarch64 \ @@ -1213,31 +1215,7 @@ case $cpu-$vendor in | m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x \ | m88110 | m88k | maxq | mb | mcore | mep | metag \ | microblaze | microblazeel \ - | mips | mipsbe | mipseb | mipsel | mipsle \ - | mips16 \ - | mips64 | mips64eb | mips64el \ - | mips64octeon | mips64octeonel \ - | mips64orion | mips64orionel \ - | mips64r5900 | mips64r5900el \ - | mips64vr | mips64vrel \ - | mips64vr4100 | mips64vr4100el \ - | mips64vr4300 | mips64vr4300el \ - | mips64vr5000 | mips64vr5000el \ - | mips64vr5900 | mips64vr5900el \ - | mipsisa32 | mipsisa32el \ - | mipsisa32r2 | mipsisa32r2el \ - | mipsisa32r3 | mipsisa32r3el \ - | mipsisa32r5 | mipsisa32r5el \ - | mipsisa32r6 | mipsisa32r6el \ - | mipsisa64 | mipsisa64el \ - | mipsisa64r2 | mipsisa64r2el \ - | mipsisa64r3 | mipsisa64r3el \ - | mipsisa64r5 | mipsisa64r5el \ - | mipsisa64r6 | mipsisa64r6el \ - | mipsisa64sb1 | mipsisa64sb1el \ - | mipsisa64sr71k | mipsisa64sr71kel \ - | mipsr5900 | mipsr5900el \ - | mipstx39 | mipstx39el \ + | mips* \ | mmix \ | mn10200 | mn10300 \ | moxie \ @@ -1285,7 +1263,7 @@ case $cpu-$vendor in ;; *) - echo Invalid configuration \`"$1"\': machine \`"$cpu-$vendor"\' not recognized 1>&2 + echo "Invalid configuration '$1': machine '$cpu-$vendor' not recognized" 1>&2 exit 1 ;; esac @@ -1732,7 +1710,7 @@ case $os in | hpux* | unos* | osf* | luna* | dgux* | auroraux* | solaris* \ | sym* | plan9* | psp* | sim* | xray* | os68k* | v88r* \ | hiux* | abug | nacl* | netware* | windows* \ - | os9* | macos* | osx* | ios* \ + | os9* | macos* | osx* | ios* | tvos* | watchos* \ | mpw* | magic* | mmixware* | mon960* | lnews* \ | amigaos* | amigados* | msdos* | newsos* | unicos* | aof* \ | aos* | aros* | cloudabi* | sortix* | twizzler* \ @@ -1758,7 +1736,7 @@ case $os in | onefs* | tirtos* | phoenix* | fuchsia* | redox* | bme* \ | midnightbsd* | amdhsa* | unleashed* | emscripten* | wasi* \ | nsk* | powerunix* | genode* | zvmoe* | qnx* | emx* | zephyr* \ - | fiwix* | mlibc* ) + | fiwix* | mlibc* | cos* | mbr* ) ;; # This one is extra strict with allowed versions sco3.2v2 | sco3.2v[4-9]* | sco5v6*) @@ -1766,11 +1744,11 @@ case $os in ;; none) ;; - kernel* ) + kernel* | msvc* ) # Restricted further below ;; *) - echo Invalid configuration \`"$1"\': OS \`"$os"\' not recognized 1>&2 + echo "Invalid configuration '$1': OS '$os' not recognized" 1>&2 exit 1 ;; esac @@ -1785,18 +1763,24 @@ case $kernel-$os in ;; managarm-mlibc* | managarm-kernel* ) ;; + windows*-gnu* | windows*-msvc*) + ;; -dietlibc* | -newlib* | -musl* | -relibc* | -uclibc* | -mlibc* ) # These are just libc implementations, not actual OSes, and thus # require a kernel. - echo "Invalid configuration \`$1': libc \`$os' needs explicit kernel." 1>&2 + echo "Invalid configuration '$1': libc '$os' needs explicit kernel." 1>&2 exit 1 ;; -kernel* ) - echo "Invalid configuration \`$1': \`$os' needs explicit kernel." 1>&2 + echo "Invalid configuration '$1': '$os' needs explicit kernel." 1>&2 exit 1 ;; *-kernel* ) - echo "Invalid configuration \`$1': \`$kernel' does not support \`$os'." 1>&2 + echo "Invalid configuration '$1': '$kernel' does not support '$os'." 1>&2 + exit 1 + ;; + *-msvc* ) + echo "Invalid configuration '$1': '$os' needs 'windows'." 1>&2 exit 1 ;; kfreebsd*-gnu* | kopensolaris*-gnu*) @@ -1809,11 +1793,15 @@ case $kernel-$os in ;; *-eabi* | *-gnueabi*) ;; + none-coff* | none-elf*) + # None (no kernel, i.e. freestanding / bare metal), + # can be paired with an output format "OS" + ;; -*) # Blank kernel with real OS is always fine. ;; *-*) - echo "Invalid configuration \`$1': Kernel \`$kernel' not known to work with OS \`$os'." 1>&2 + echo "Invalid configuration '$1': Kernel '$kernel' not known to work with OS '$os'." 1>&2 exit 1 ;; esac diff --git a/usr.sbin/unbound/configure b/usr.sbin/unbound/configure index dd8fe2523..d67d5d766 100644 --- a/usr.sbin/unbound/configure +++ b/usr.sbin/unbound/configure @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.69 for unbound 1.17.0. +# Generated by GNU Autoconf 2.69 for unbound 1.18.0. # # Report bugs to . # @@ -591,8 +591,8 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='unbound' PACKAGE_TARNAME='unbound' -PACKAGE_VERSION='1.17.0' -PACKAGE_STRING='unbound 1.17.0' +PACKAGE_VERSION='1.18.0' +PACKAGE_STRING='unbound 1.18.0' PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues' PACKAGE_URL='' @@ -1477,7 +1477,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures unbound 1.17.0 to adapt to many kinds of systems. +\`configure' configures unbound 1.18.0 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1543,7 +1543,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of unbound 1.17.0:";; + short | recursive ) echo "Configuration of unbound 1.18.0:";; esac cat <<\_ACEOF @@ -1785,7 +1785,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -unbound configure 1.17.0 +unbound configure 1.18.0 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. @@ -2494,7 +2494,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by unbound $as_me 1.17.0, which was +It was created by unbound $as_me 1.18.0, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ @@ -2844,13 +2844,13 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu UNBOUND_VERSION_MAJOR=1 -UNBOUND_VERSION_MINOR=17 +UNBOUND_VERSION_MINOR=18 UNBOUND_VERSION_MICRO=0 LIBUNBOUND_CURRENT=9 -LIBUNBOUND_REVISION=20 +LIBUNBOUND_REVISION=22 LIBUNBOUND_AGE=1 # 1.0.0 had 0:12:0 # 1.0.1 had 0:13:0 @@ -2938,6 +2938,8 @@ LIBUNBOUND_AGE=1 # 1.16.2 had 9:18:1 # 1.16.3 had 9:19:1 # 1.17.0 had 9:20:1 +# 1.17.1 had 9:21:1 +# 1.18.0 had 9:22:1 # Current -- the number of the binary API that we're implementing # Revision -- which iteration of the implementation of the binary @@ -5144,7 +5146,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking $CC dependency flag" >&5 $as_echo_n "checking $CC dependency flag... " >&6; } -echo 'void f(){}' >conftest.c +echo 'void f(void){}' >conftest.c if test "`$CC -MM conftest.c 2>&1`" = "conftest.o: conftest.c"; then DEPFLAG="-MM" else @@ -5326,7 +5328,7 @@ echo ' #include #endif -int test() { +int test(void) { int a; char **opts = NULL; struct timeval tv; @@ -5347,7 +5349,7 @@ int test() { return a; } ' > conftest.c -echo 'void f(){}' >>conftest.c +echo 'void f(void){}' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_needed_$cache=no" else @@ -5417,7 +5419,7 @@ echo ' #include #endif -int test() { +int test(void) { int a; char **opts = NULL; struct timeval tv; @@ -5438,7 +5440,7 @@ int test() { return a; } ' > conftest.c -echo 'void f(){}' >>conftest.c +echo 'void f(void){}' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_needed_$cache=no" else @@ -5497,12 +5499,12 @@ else echo ' #include #include -int test() { +int test(void) { int a = 0; return a; } ' > conftest.c -echo 'void f(){}' >>conftest.c +echo 'void f(void){}' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_needed_$cache=no" else @@ -5561,13 +5563,13 @@ else echo ' #include -int test() { +int test(void) { int a; a = isascii(32); return a; } ' > conftest.c -echo 'void f(){}' >>conftest.c +echo 'void f(void){}' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_needed_$cache=no" else @@ -5626,13 +5628,13 @@ else echo ' #include -int test() { +int test(void) { struct in6_pktinfo inf; int a = (int)sizeof(inf); return a; } ' > conftest.c -echo 'void f(){}' >>conftest.c +echo 'void f(void){}' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_needed_$cache=no" else @@ -5694,13 +5696,13 @@ else echo ' #include -int test() { +int test(void) { int a = setresgid(0,0,0); a = setresuid(0,0,0); return a; } ' > conftest.c -echo 'void f(){}' >>conftest.c +echo 'void f(void){}' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_needed_$cache=no" else @@ -5763,7 +5765,7 @@ echo ' #endif #include -int test() { +int test(void) { int a = 0; char *t; time_t time = 0; @@ -5776,7 +5778,7 @@ int test() { return a; } ' > conftest.c -echo 'void f(){}' >>conftest.c +echo 'void f(void){}' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_needed_$cache=no" else @@ -5845,7 +5847,7 @@ echo ' #include #endif -int test() { +int test(void) { int a; char **opts = NULL; struct timeval tv; @@ -5858,7 +5860,7 @@ int test() { return a; } ' > conftest.c -echo 'void f(){}' >>conftest.c +echo 'void f(void){}' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_needed_$cache=no" else @@ -6609,6 +6611,11 @@ $as_echo "no" >&6; }; fi fi +if test "$LEX" = "" -o "$LEX" = ":"; then + if test ! -f util/configlexer.c; then + as_fn_error $? "no lex and no util/configlexer.c: need flex and bison to compile from source repository." "$LINENO" 5 + fi +fi for ac_prog in 'bison -y' byacc do # Extract the first word of "$ac_prog", so it can be a program name with args. @@ -6652,6 +6659,11 @@ fi done test -n "$YACC" || YACC="yacc" +if test "$YACC" = "" -o "$YACC" = ":"; then + if test ! -f util/configparser.c; then + as_fn_error $? "no yacc and no util/configparser.c: need flex and bison to compile from source repository." "$LINENO" 5 + fi +fi # Extract the first word of "doxygen", so it can be a program name with args. set dummy doxygen; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 @@ -14876,6 +14888,21 @@ fi done +# Check for Linux timestamping headers +for ac_header in linux/net_tstamp.h +do : + ac_fn_c_check_header_compile "$LINENO" "linux/net_tstamp.h" "ac_cv_header_linux_net_tstamp_h" "$ac_includes_default +" +if test "x$ac_cv_header_linux_net_tstamp_h" = xyes; then : + cat >>confdefs.h <<_ACEOF +#define HAVE_LINUX_NET_TSTAMP_H 1 +_ACEOF + +fi + +done + + # check for types. # Using own tests for int64* because autoconf builtin only give 32bit. ac_fn_c_check_type "$LINENO" "int8_t" "ac_cv_type_int8_t" "$ac_includes_default" @@ -15953,12 +15980,12 @@ else echo ' #include -int test() { +int test(void) { int a = fseeko(stdin, 0, 0); return a; } ' > conftest.c -echo 'void f(){}' >>conftest.c +echo 'void f(void){}' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_needed_$cache=no" else @@ -17541,39 +17568,68 @@ fi PYTHON_VERSION=`$PYTHON -c "import sys; \ print(sys.version.split()[0])"` fi + # calculate the version number components. - # Check if you have sysconfig - { $as_echo "$as_me:${as_lineno-$LINENO}: checking for the sysconfig Python module" >&5 -$as_echo_n "checking for the sysconfig Python module... " >&6; } - if ac_sysconfig_result=`$PYTHON -c "import sysconfig" 2>&1`; then + v="$PYTHON_VERSION" + PYTHON_VERSION_MAJOR=`echo $v | sed 's/[^0-9].*//'` + if test -z "$PYTHON_VERSION_MAJOR"; then PYTHON_VERSION_MAJOR="0"; fi + v=`echo $v | sed -e 's/^[0-9]*$//' -e 's/[0-9]*[^0-9]//'` + PYTHON_VERSION_MINOR=`echo $v | sed 's/[^0-9].*//'` + if test -z "$PYTHON_VERSION_MINOR"; then PYTHON_VERSION_MINOR="0"; fi + v=`echo $v | sed -e 's/^[0-9]*$//' -e 's/[0-9]*[^0-9]//'` + PYTHON_VERSION_PATCH=`echo $v | sed 's/[^0-9].*//'` + if test -z "$PYTHON_VERSION_PATCH"; then PYTHON_VERSION_PATCH="0"; fi + + + # For some systems, sysconfig exists, but has the wrong paths, + # on Debian 10, for python 2.7 and 3.7. So, we check the version, + # and for older versions try distutils.sysconfig first. For newer + # versions>=3.10, where distutils.sysconfig is deprecated, use + # sysconfig first and then attempt the other one. + py_distutils_first="no" + if test $PYTHON_VERSION_MAJOR -lt 3; then + py_distutils_first="yes" + fi + if test $PYTHON_VERSION_MAJOR -eq 3 -a $PYTHON_VERSION_MINOR -lt 10; then + py_distutils_first="yes" + fi + + # Check if you have the first module + if test "$py_distutils_first" = "yes"; then m="distutils"; else m="sysconfig"; fi + sysconfig_module="" + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for the $m Python module" >&5 +$as_echo_n "checking for the $m Python module... " >&6; } + if ac_modulecheck_result1=`$PYTHON -c "import $m" 2>&1`; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } - sysconfig_module="sysconfig" - # if yes, use sysconfig, because distutils is deprecated. + sysconfig_module="$m" else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } - # if no, try to use distutils + fi - # - # Check if you have distutils, else fail - # - { $as_echo "$as_me:${as_lineno-$LINENO}: checking for the distutils Python package" >&5 -$as_echo_n "checking for the distutils Python package... " >&6; } - if ac_distutils_result=`$PYTHON -c "import distutils" 2>&1`; then + # if not found, try the other one. + if test -z "$sysconfig_module"; then + if test "$py_distutils_first" = "yes"; then m2="sysconfig"; else m2="distutils"; fi + { $as_echo "$as_me:${as_lineno-$LINENO}: checking for the $m2 Python module" >&5 +$as_echo_n "checking for the $m2 Python module... " >&6; } + if ac_modulecheck_result2=`$PYTHON -c "import $m2" 2>&1`; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } + sysconfig_module="$m2" else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } - as_fn_error $? "cannot import Python module \"distutils\". - Please check your Python installation. The error was: - $ac_distutils_result" "$LINENO" 5 + as_fn_error $? "cannot import Python module \"$m\", or \"$m2\". + Please check your Python installation. The errors are: + $m + $ac_modulecheck_result1 + $m2 + $ac_modulecheck_result2" "$LINENO" 5 PYTHON_VERSION="" fi - - sysconfig_module="distutils.sysconfig" fi + if test "$sysconfig_module" = "distutils"; then sysconfig_module="distutils.sysconfig"; fi # # Check for Python include path @@ -17705,7 +17761,14 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu # if test ! -z "$PYTHON_VERSION"; then - if test `$PYTHON -c "print('$PYTHON_VERSION' >= '2.4.0')"` = "False"; then + badversion="no" + if test "$PYTHON_VERSION_MAJOR" -lt 2; then + badversion="yes" + fi + if test "$PYTHON_VERSION_MAJOR" -eq 2 -a "$PYTHON_VERSION_MINOR" -lt 4; then + badversion="yes" + fi + if test "$badversion" = "yes"; then as_fn_error $? "Python version >= 2.4.0 is required" "$LINENO" 5 fi @@ -20174,7 +20237,7 @@ char* (*f) () = getaddrinfo; #ifdef __cplusplus } #endif -int main() { +int main(void) { ; return 0; } @@ -20448,7 +20511,7 @@ echo ' #include #include ' >conftest.c -echo 'void f(){ (void)daemon(0, 0); }' >>conftest.c +echo 'void f(void){ (void)daemon(0, 0); }' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS -c conftest.c 2>&1 | grep -e deprecated -e unavailable`"; then eval "cv_cc_deprecated_$cache=no" else @@ -22086,7 +22149,7 @@ _ACEOF -version=1.17.0 +version=1.18.0 date=`date +'%b %e, %Y'` @@ -22605,7 +22668,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by unbound $as_me 1.17.0, which was +This file was extended by unbound $as_me 1.18.0, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -22671,7 +22734,7 @@ _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ -unbound config.status 1.17.0 +unbound config.status 1.18.0 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" diff --git a/usr.sbin/unbound/configure.ac b/usr.sbin/unbound/configure.ac index 7c5b1e99e..678d28b2a 100644 --- a/usr.sbin/unbound/configure.ac +++ b/usr.sbin/unbound/configure.ac @@ -10,7 +10,7 @@ sinclude(dnscrypt/dnscrypt.m4) # must be numbers. ac_defun because of later processing m4_define([VERSION_MAJOR],[1]) -m4_define([VERSION_MINOR],[17]) +m4_define([VERSION_MINOR],[18]) m4_define([VERSION_MICRO],[0]) AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound]) AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR]) @@ -18,7 +18,7 @@ AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR]) AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO]) LIBUNBOUND_CURRENT=9 -LIBUNBOUND_REVISION=20 +LIBUNBOUND_REVISION=22 LIBUNBOUND_AGE=1 # 1.0.0 had 0:12:0 # 1.0.1 had 0:13:0 @@ -106,6 +106,8 @@ LIBUNBOUND_AGE=1 # 1.16.2 had 9:18:1 # 1.16.3 had 9:19:1 # 1.17.0 had 9:20:1 +# 1.17.1 had 9:21:1 +# 1.18.0 had 9:22:1 # Current -- the number of the binary API that we're implementing # Revision -- which iteration of the implementation of the binary @@ -387,7 +389,17 @@ fi if test "$LEX" != "" -a "$LEX" != ":"; then ACX_YYLEX_OPTION fi +if test "$LEX" = "" -o "$LEX" = ":"; then + if test ! -f util/configlexer.c; then + AC_MSG_ERROR([no lex and no util/configlexer.c: need flex and bison to compile from source repository.]) + fi +fi AC_PROG_YACC +if test "$YACC" = "" -o "$YACC" = ":"; then + if test ! -f util/configparser.c; then + AC_MSG_ERROR([no yacc and no util/configparser.c: need flex and bison to compile from source repository.]) + fi +fi AC_CHECK_PROG(doxygen, doxygen, doxygen) AC_CHECK_TOOL(STRIP, strip) ACX_LIBTOOL_C_ONLY @@ -452,6 +464,9 @@ AC_CHECK_HEADERS([netioapi.h],,, [AC_INCLUDES_DEFAULT #endif ]) +# Check for Linux timestamping headers +AC_CHECK_HEADERS([linux/net_tstamp.h],,, [AC_INCLUDES_DEFAULT]) + # check for types. # Using own tests for int64* because autoconf builtin only give 32bit. AC_CHECK_TYPE(int8_t, signed char) @@ -734,7 +749,14 @@ if test x_$ub_test_python != x_no; then ac_save_LIBS="$LIBS" dnl otherwise AC_PYTHON_DEVEL thrashes $LIBS AC_PYTHON_DEVEL if test ! -z "$PYTHON_VERSION"; then - if test `$PYTHON -c "print('$PYTHON_VERSION' >= '2.4.0')"` = "False"; then + badversion="no" + if test "$PYTHON_VERSION_MAJOR" -lt 2; then + badversion="yes" + fi + if test "$PYTHON_VERSION_MAJOR" -eq 2 -a "$PYTHON_VERSION_MINOR" -lt 4; then + badversion="yes" + fi + if test "$badversion" = "yes"; then AC_MSG_ERROR([Python version >= 2.4.0 is required]) fi diff --git a/usr.sbin/unbound/daemon/acl_list.c b/usr.sbin/unbound/daemon/acl_list.c index 49f9e02b0..83a672139 100644 --- a/usr.sbin/unbound/daemon/acl_list.c +++ b/usr.sbin/unbound/daemon/acl_list.c @@ -109,6 +109,8 @@ parse_acl_access(const char* str, enum acl_access* control) *control = acl_allow_snoop; else if(strcmp(str, "allow_setrd") == 0) *control = acl_allow_setrd; + else if (strcmp(str, "allow_cookie") == 0) + *control = acl_allow_cookie; else { log_err("access control type %s unknown", str); return 0; diff --git a/usr.sbin/unbound/daemon/acl_list.h b/usr.sbin/unbound/daemon/acl_list.h index 72f86d763..db1087610 100644 --- a/usr.sbin/unbound/daemon/acl_list.h +++ b/usr.sbin/unbound/daemon/acl_list.h @@ -64,8 +64,12 @@ enum acl_access { acl_allow, /** allow full access for all queries, recursion and cache snooping */ acl_allow_snoop, - /** allow full access for recursion queries and set RD flag regardless of request */ - acl_allow_setrd + /** allow full access for recursion queries and set RD flag regardless + * of request */ + acl_allow_setrd, + /** allow full access for recursion (+RD) queries if valid cookie + * present or stateful transport */ + acl_allow_cookie }; /** diff --git a/usr.sbin/unbound/daemon/cachedump.c b/usr.sbin/unbound/daemon/cachedump.c index a85dd62a9..8263e6186 100644 --- a/usr.sbin/unbound/daemon/cachedump.c +++ b/usr.sbin/unbound/daemon/cachedump.c @@ -166,8 +166,7 @@ dump_msg_ref(RES* ssl, struct ub_packed_rrset_key* k) /** dump message entry */ static int -dump_msg(RES* ssl, struct query_info* k, struct reply_info* d, - time_t now) +dump_msg(RES* ssl, struct query_info* k, struct reply_info* d, time_t now) { size_t i; char* nm, *tp, *cl; @@ -192,13 +191,15 @@ dump_msg(RES* ssl, struct query_info* k, struct reply_info* d, } /* meta line */ - if(!ssl_printf(ssl, "msg %s %s %s %d %d " ARG_LL "d %d %u %u %u\n", + if(!ssl_printf(ssl, "msg %s %s %s %d %d " ARG_LL "d %d %u %u %u %d %s\n", nm, cl, tp, (int)d->flags, (int)d->qdcount, (long long)(d->ttl-now), (int)d->security, (unsigned)d->an_numrrsets, (unsigned)d->ns_numrrsets, - (unsigned)d->ar_numrrsets)) { + (unsigned)d->ar_numrrsets, + (int)d->reason_bogus, + d->reason_bogus_str?d->reason_bogus_str:"")) { free(nm); free(tp); free(cl); @@ -387,7 +388,7 @@ move_into_cache(struct ub_packed_rrset_key* k, struct rrset_ref ref; uint8_t* p; - ak = alloc_special_obtain(&worker->alloc); + ak = alloc_special_obtain(worker->alloc); if(!ak) { log_warn("error out of memory"); return 0; @@ -398,7 +399,7 @@ move_into_cache(struct ub_packed_rrset_key* k, ak->rk.dname = (uint8_t*)memdup(k->rk.dname, k->rk.dname_len); if(!ak->rk.dname) { log_warn("error out of memory"); - ub_packed_rrset_parsedelete(ak, &worker->alloc); + ub_packed_rrset_parsedelete(ak, worker->alloc); return 0; } s = sizeof(*ad) + (sizeof(size_t) + sizeof(uint8_t*) + @@ -408,7 +409,7 @@ move_into_cache(struct ub_packed_rrset_key* k, ad = (struct packed_rrset_data*)malloc(s); if(!ad) { log_warn("error out of memory"); - ub_packed_rrset_parsedelete(ak, &worker->alloc); + ub_packed_rrset_parsedelete(ak, worker->alloc); return 0; } p = (uint8_t*)ad; @@ -431,7 +432,8 @@ move_into_cache(struct ub_packed_rrset_key* k, ref.key = ak; ref.id = ak->id; (void)rrset_cache_update(worker->env.rrset_cache, &ref, - &worker->alloc, *worker->env.now); + worker->alloc, *worker->env.now); + return 1; } @@ -632,6 +634,9 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker) long long ttl; size_t i; int go_on = 1; + int ede; + int consumed = 0; + char* ede_str = NULL; regional_free_all(region); @@ -646,11 +651,16 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker) } /* read remainder of line */ - if(sscanf(s, " %u %u " ARG_LL "d %u %u %u %u", &flags, &qdcount, &ttl, - &security, &an, &ns, &ar) != 7) { + /* note the last space before any possible EDE text */ + if(sscanf(s, " %u %u " ARG_LL "d %u %u %u %u %d %n", &flags, &qdcount, &ttl, + &security, &an, &ns, &ar, &ede, &consumed) != 8) { log_warn("error cannot parse numbers: %s", s); return 0; } + /* there may be EDE text after the numbers */ + if(consumed > 0 && (size_t)consumed < strlen(s)) + ede_str = s + consumed; + memset(&rep, 0, sizeof(rep)); rep.flags = (uint16_t)flags; rep.qdcount = (uint16_t)qdcount; rep.ttl = (time_t)ttl; @@ -665,6 +675,8 @@ load_msg(RES* ssl, sldns_buffer* buf, struct worker* worker) rep.ns_numrrsets = (size_t)ns; rep.ar_numrrsets = (size_t)ar; rep.rrset_count = (size_t)an+(size_t)ns+(size_t)ar; + rep.reason_bogus = (sldns_ede_code)ede; + rep.reason_bogus_str = ede_str?(char*)regional_strdup(region, ede_str):NULL; rep.rrsets = (struct ub_packed_rrset_key**)regional_alloc_zero( region, sizeof(struct ub_packed_rrset_key*)*rep.rrset_count); @@ -859,7 +871,8 @@ int print_deleg_lookup(RES* ssl, struct worker* worker, uint8_t* nm, /* go up? */ if(iter_dp_is_useless(&qinfo, BIT_RD, dp, (worker->env.cfg->do_ip4 && worker->back->num_ip4 != 0), - (worker->env.cfg->do_ip6 && worker->back->num_ip6 != 0))) { + (worker->env.cfg->do_ip6 && worker->back->num_ip6 != 0), + worker->env.cfg->do_nat64)) { print_dp_main(ssl, dp, msg); print_dp_details(ssl, worker, dp); if(!ssl_printf(ssl, "cache delegation was " diff --git a/usr.sbin/unbound/daemon/daemon.c b/usr.sbin/unbound/daemon/daemon.c index 0d7af8644..0dbe1ccc8 100644 --- a/usr.sbin/unbound/daemon/daemon.c +++ b/usr.sbin/unbound/daemon/daemon.c @@ -488,6 +488,27 @@ static int daemon_get_shufport(struct daemon* daemon, int* shufport) return avail; } +/** + * Clear and delete per-worker alloc caches, and free memory maintained in + * superalloc. + * The rrset and message caches must be empty at the time of call. + * @param daemon: the daemon that maintains the alloc caches to be cleared. + */ +static void +daemon_clear_allocs(struct daemon* daemon) +{ + int i; + + for(i=0; inum; i++) { + alloc_clear(daemon->worker_allocs[i]); + free(daemon->worker_allocs[i]); + } + free(daemon->worker_allocs); + daemon->worker_allocs = NULL; + + alloc_clear_special(&daemon->superalloc); +} + /** * Allocate empty worker structures. With backptr and thread-number, * from 0..numthread initialised. Used as user arguments to new threads. @@ -540,6 +561,21 @@ daemon_create_workers(struct daemon* daemon) /* the above is not ports/numthr, due to rounding */ fatal_exit("could not create worker"); } + /* create per-worker alloc caches if not reusing existing ones. */ + if(!daemon->worker_allocs) { + daemon->worker_allocs = (struct alloc_cache**)calloc( + (size_t)daemon->num, sizeof(struct alloc_cache*)); + if(!daemon->worker_allocs) + fatal_exit("could not allocate worker allocs"); + for(i=0; inum; i++) { + struct alloc_cache* alloc = calloc(1, + sizeof(struct alloc_cache)); + if (!alloc) + fatal_exit("could not allocate worker alloc"); + alloc_init(alloc, &daemon->superalloc, i); + daemon->worker_allocs[i] = alloc; + } + } free(shufport); } @@ -771,6 +807,7 @@ daemon_fork(struct daemon* daemon) /* Shutdown SHM */ shm_main_shutdown(daemon); + daemon->reuse_cache = daemon->workers[0]->reuse_cache; daemon->need_to_exit = daemon->workers[0]->need_to_exit; } @@ -785,9 +822,16 @@ daemon_cleanup(struct daemon* daemon) log_thread_set(NULL); /* clean up caches because * a) RRset IDs will be recycled after a reload, causing collisions - * b) validation config can change, thus rrset, msg, keycache clear */ + * b) validation config can change, thus rrset, msg, keycache clear + * + * If we are trying to keep the cache as long as possible, we should + * defer the cleanup until we know whether the new configuration allows + * the reuse. (If we're exiting, cleanup should be done here). */ + if(!daemon->reuse_cache || daemon->need_to_exit) { slabhash_clear(&daemon->env->rrset_cache->table); slabhash_clear(daemon->env->msg_cache); + } + daemon->old_num = daemon->num; /* save the current num */ local_zones_delete(daemon->local_zones); daemon->local_zones = NULL; respip_set_delete(daemon->respip_set); @@ -802,8 +846,13 @@ daemon_cleanup(struct daemon* daemon) worker_delete(daemon->workers[i]); free(daemon->workers); daemon->workers = NULL; + /* Unless we're trying to keep the cache, worker alloc_caches should be + * cleared and freed here. We do this after deleting workers to + * guarantee that the alloc caches are valid throughout the lifetime + * of workers. */ + if(!daemon->reuse_cache || daemon->need_to_exit) + daemon_clear_allocs(daemon); daemon->num = 0; - alloc_clear_special(&daemon->superalloc); #ifdef USE_DNSTAP dt_delete(daemon->dtenv); daemon->dtenv = NULL; @@ -900,8 +949,42 @@ daemon_delete(struct daemon* daemon) void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg) { + int new_num = cfg->num_threads?cfg->num_threads:1; + daemon->cfg = cfg; config_apply(cfg); + + /* If this is a reload and we deferred the decision on whether to + * reuse the alloc, RRset, and message caches, then check to see if + * it's safe to keep the caches: + * - changing the number of threads is obviously incompatible with + * keeping the per-thread alloc caches. It also means we have to + * clear RRset and message caches. (note that 'new_num' may be + * adjusted in daemon_create_workers, but for our purpose we can + * simply compare it with 'old_num'; if they are equal here, + * 'new_num' won't be adjusted to a different value than 'old_num'). + * - changing RRset cache size effectively clears any remaining cache + * entries. We could keep their keys in alloc caches, but it would + * be more consistent with the sense of the change to clear allocs + * and free memory. To do so we also have to clear message cache. + * - only changing message cache size does not necessarily affect + * RRset or alloc cache. But almost all new subsequent queries will + * require recursive resolution anyway, so it doesn't help much to + * just keep RRset and alloc caches. For simplicity we clear/free + * the other two, too. */ + if(daemon->worker_allocs && + (new_num != daemon->old_num || + !slabhash_is_size(daemon->env->msg_cache, cfg->msg_cache_size, + cfg->msg_cache_slabs) || + !slabhash_is_size(&daemon->env->rrset_cache->table, + cfg->rrset_cache_size, cfg->rrset_cache_slabs))) + { + log_warn("cannot reuse caches due to critical config change"); + slabhash_clear(&daemon->env->rrset_cache->table); + slabhash_clear(daemon->env->msg_cache); + daemon_clear_allocs(daemon); + } + if(!slabhash_is_size(daemon->env->msg_cache, cfg->msg_cache_size, cfg->msg_cache_slabs)) { slabhash_delete(daemon->env->msg_cache); diff --git a/usr.sbin/unbound/daemon/daemon.h b/usr.sbin/unbound/daemon/daemon.h index efd9f745e..8a182d97d 100644 --- a/usr.sbin/unbound/daemon/daemon.h +++ b/usr.sbin/unbound/daemon/daemon.h @@ -99,8 +99,12 @@ struct daemon { void* listen_sslctx, *connect_sslctx; /** num threads allocated */ int num; + /** num threads allocated in the previous config or 0 at first */ + int old_num; /** the worker entries */ struct worker** workers; + /** per-worker allocation cache */ + struct alloc_cache **worker_allocs; /** do we need to exit unbound (or is it only a reload?) */ int need_to_exit; /** master random table ; used for port div between threads on reload*/ @@ -140,6 +144,8 @@ struct daemon { /** the dnscrypt environment */ struct dnsc_env* dnscenv; #endif + /** reuse existing cache on reload if other conditions allow it. */ + int reuse_cache; }; /** diff --git a/usr.sbin/unbound/daemon/remote.c b/usr.sbin/unbound/daemon/remote.c index 96ef69d9e..4990fc8e9 100644 --- a/usr.sbin/unbound/daemon/remote.c +++ b/usr.sbin/unbound/daemon/remote.c @@ -87,6 +87,7 @@ #include "sldns/parseutil.h" #include "sldns/wire2str.h" #include "sldns/sbuffer.h" +#include "util/timeval_func.h" #ifdef HAVE_SYS_TYPES_H # include @@ -105,49 +106,6 @@ /** what to put on statistics lines between var and value, ": " or "=" */ #define SQ "=" -/** if true, inhibits a lot of =0 lines from the stats output */ -static const int inhibit_zero = 1; - -/** subtract timers and the values do not overflow or become negative */ -static void -timeval_subtract(struct timeval* d, const struct timeval* end, - const struct timeval* start) -{ -#ifndef S_SPLINT_S - time_t end_usec = end->tv_usec; - d->tv_sec = end->tv_sec - start->tv_sec; - if(end_usec < start->tv_usec) { - end_usec += 1000000; - d->tv_sec--; - } - d->tv_usec = end_usec - start->tv_usec; -#endif -} - -/** divide sum of timers to get average */ -static void -timeval_divide(struct timeval* avg, const struct timeval* sum, long long d) -{ -#ifndef S_SPLINT_S - size_t leftover; - if(d <= 0) { - avg->tv_sec = 0; - avg->tv_usec = 0; - return; - } - avg->tv_sec = sum->tv_sec / d; - avg->tv_usec = sum->tv_usec / d; - /* handle fraction from seconds divide */ - leftover = sum->tv_sec - avg->tv_sec*d; - if(leftover <= 0) - leftover = 0; - avg->tv_usec += (((long long)leftover)*((long long)1000000))/d; - if(avg->tv_sec < 0) - avg->tv_sec = 0; - if(avg->tv_usec < 0) - avg->tv_usec = 0; -#endif -} static int remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg) @@ -684,8 +642,9 @@ do_stop(RES* ssl, struct worker* worker) /** do the reload command */ static void -do_reload(RES* ssl, struct worker* worker) +do_reload(RES* ssl, struct worker* worker, int reuse_cache) { + worker->reuse_cache = reuse_cache; worker->need_to_exit = 0; comm_base_exit(worker->base); send_ok(ssl); @@ -713,6 +672,12 @@ print_stats(RES* ssl, const char* nm, struct ub_stats_info* s) (unsigned long)s->svr.num_queries)) return 0; if(!ssl_printf(ssl, "%s.num.queries_ip_ratelimited"SQ"%lu\n", nm, (unsigned long)s->svr.num_queries_ip_ratelimited)) return 0; + if(!ssl_printf(ssl, "%s.num.queries_cookie_valid"SQ"%lu\n", nm, + (unsigned long)s->svr.num_queries_cookie_valid)) return 0; + if(!ssl_printf(ssl, "%s.num.queries_cookie_client"SQ"%lu\n", nm, + (unsigned long)s->svr.num_queries_cookie_client)) return 0; + if(!ssl_printf(ssl, "%s.num.queries_cookie_invalid"SQ"%lu\n", nm, + (unsigned long)s->svr.num_queries_cookie_invalid)) return 0; if(!ssl_printf(ssl, "%s.num.cachehits"SQ"%lu\n", nm, (unsigned long)(s->svr.num_queries - s->svr.num_queries_missed_cache))) return 0; @@ -720,6 +685,10 @@ print_stats(RES* ssl, const char* nm, struct ub_stats_info* s) (unsigned long)s->svr.num_queries_missed_cache)) return 0; if(!ssl_printf(ssl, "%s.num.prefetch"SQ"%lu\n", nm, (unsigned long)s->svr.num_queries_prefetch)) return 0; + if(!ssl_printf(ssl, "%s.num.queries_timed_out"SQ"%lu\n", nm, + (unsigned long)s->svr.num_queries_timed_out)) return 0; + if(!ssl_printf(ssl, "%s.query.queue_time_us.max"SQ"%lu\n", nm, + (unsigned long)s->svr.max_query_time_us)) return 0; if(!ssl_printf(ssl, "%s.num.expired"SQ"%lu\n", nm, (unsigned long)s->svr.ans_expired)) return 0; if(!ssl_printf(ssl, "%s.num.recursivereplies"SQ"%lu\n", nm, @@ -920,7 +889,7 @@ print_hist(RES* ssl, struct ub_stats_info* s) /** print extended stats */ static int -print_ext(RES* ssl, struct ub_stats_info* s) +print_ext(RES* ssl, struct ub_stats_info* s, int inhibit_zero) { int i; char nm[32]; @@ -1066,6 +1035,11 @@ print_ext(RES* ssl, struct ub_stats_info* s) (unsigned)s->svr.infra_cache_count)) return 0; if(!ssl_printf(ssl, "key.cache.count"SQ"%u\n", (unsigned)s->svr.key_cache_count)) return 0; + /* max collisions */ + if(!ssl_printf(ssl, "msg.cache.max_collisions"SQ"%u\n", + (unsigned)s->svr.msg_cache_max_collisions)) return 0; + if(!ssl_printf(ssl, "rrset.cache.max_collisions"SQ"%u\n", + (unsigned)s->svr.rrset_cache_max_collisions)) return 0; /* applied RPZ actions */ for(i=0; isvr.num_query_subnet_cache)) return 0; #endif /* CLIENT_SUBNET */ +#ifdef USE_CACHEDB + if(!ssl_printf(ssl, "num.query.cachedb"SQ"%lu\n", + (unsigned long)s->svr.num_query_cachedb)) return 0; +#endif /* USE_CACHEDB */ return 1; } @@ -1129,7 +1107,7 @@ do_stats(RES* ssl, struct worker* worker, int reset) return; if(!print_hist(ssl, &total)) return; - if(!print_ext(ssl, &total)) + if(!print_ext(ssl, &total, daemon->cfg->stat_inhibit_zero)) return; } } @@ -1609,6 +1587,9 @@ do_flush_type(RES* ssl, struct worker* worker, char* arg) if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs)) return; t = sldns_get_rr_type_by_name(arg2); + if(t == 0 && strcmp(arg2, "TYPE0") != 0) { + return; + } do_cache_remove(worker, nm, nmlen, t, LDNS_RR_CLASS_IN); free(nm); @@ -1963,6 +1944,8 @@ do_flush_name(RES* ssl, struct worker* w, char* arg) do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_PTR, LDNS_RR_CLASS_IN); do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SRV, LDNS_RR_CLASS_IN); do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NAPTR, LDNS_RR_CLASS_IN); + do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SVCB, LDNS_RR_CLASS_IN); + do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_HTTPS, LDNS_RR_CLASS_IN); free(nm); send_ok(ssl); @@ -3029,8 +3012,11 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd, if(cmdcmp(p, "stop", 4)) { do_stop(ssl, worker); return; + } else if(cmdcmp(p, "reload_keep_cache", 17)) { + do_reload(ssl, worker, 1); + return; } else if(cmdcmp(p, "reload", 6)) { - do_reload(ssl, worker); + do_reload(ssl, worker, 0); return; } else if(cmdcmp(p, "stats_noreset", 13)) { do_stats(ssl, worker, 0); diff --git a/usr.sbin/unbound/daemon/remote.h b/usr.sbin/unbound/daemon/remote.h index ce9d36d3e..0035b5b8d 100644 --- a/usr.sbin/unbound/daemon/remote.h +++ b/usr.sbin/unbound/daemon/remote.h @@ -46,7 +46,7 @@ #ifndef DAEMON_REMOTE_H #define DAEMON_REMOTE_H #ifdef HAVE_OPENSSL_SSL_H -#include "openssl/ssl.h" +#include #endif struct config_file; struct listen_list; diff --git a/usr.sbin/unbound/daemon/stats.c b/usr.sbin/unbound/daemon/stats.c index ee40543a9..4855bf1c1 100644 --- a/usr.sbin/unbound/daemon/stats.c +++ b/usr.sbin/unbound/daemon/stats.c @@ -293,8 +293,10 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset) s->svr.queries_ratelimited = (long long)get_queries_ratelimit(worker, reset); /* get cache sizes */ - s->svr.msg_cache_count = (long long)count_slabhash_entries(worker->env.msg_cache); - s->svr.rrset_cache_count = (long long)count_slabhash_entries(&worker->env.rrset_cache->table); + get_slabhash_stats(worker->env.msg_cache, + &s->svr.msg_cache_count, &s->svr.msg_cache_max_collisions); + get_slabhash_stats(&worker->env.rrset_cache->table, + &s->svr.rrset_cache_count, &s->svr.rrset_cache_max_collisions); s->svr.infra_cache_count = (long long)count_slabhash_entries(worker->env.infra_cache->hosts); if(worker->env.key_cache) s->svr.key_cache_count = (long long)count_slabhash_entries(worker->env.key_cache->slab); @@ -354,6 +356,11 @@ server_stats_compile(struct worker* worker, struct ub_stats_info* s, int reset) s->svr.num_query_subnet = 0; s->svr.num_query_subnet_cache = 0; #endif +#ifdef USE_CACHEDB + s->svr.num_query_cachedb = (long long)worker->env.mesh->ans_cachedb; +#else + s->svr.num_query_cachedb = 0; +#endif /* get tcp accept usage */ s->svr.tcp_accept_usage = 0; @@ -428,8 +435,14 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a) { total->svr.num_queries += a->svr.num_queries; total->svr.num_queries_ip_ratelimited += a->svr.num_queries_ip_ratelimited; + total->svr.num_queries_cookie_valid += a->svr.num_queries_cookie_valid; + total->svr.num_queries_cookie_client += a->svr.num_queries_cookie_client; + total->svr.num_queries_cookie_invalid += a->svr.num_queries_cookie_invalid; total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache; total->svr.num_queries_prefetch += a->svr.num_queries_prefetch; + total->svr.num_queries_timed_out += a->svr.num_queries_timed_out; + if (total->svr.max_query_time_us < a->svr.max_query_time_us) + total->svr.max_query_time_us = a->svr.max_query_time_us; total->svr.sum_query_list_size += a->svr.sum_query_list_size; total->svr.ans_expired += a->svr.ans_expired; #ifdef USE_DNSCRYPT @@ -471,6 +484,9 @@ void server_stats_add(struct ub_stats_info* total, struct ub_stats_info* a) total->svr.unwanted_replies += a->svr.unwanted_replies; total->svr.unwanted_queries += a->svr.unwanted_queries; total->svr.tcp_accept_usage += a->svr.tcp_accept_usage; +#ifdef USE_CACHEDB + total->svr.num_query_cachedb += a->svr.num_query_cachedb; +#endif for(i=0; isvr.qtype[i] += a->svr.qtype[i]; for(i=0; ians_rcode_nodata ++; } } + +void server_stats_downstream_cookie(struct ub_server_stats* stats, + struct edns_data* edns) +{ + if(!(edns->edns_present && edns->cookie_present)) return; + if(edns->cookie_valid) { + stats->num_queries_cookie_valid++; + } else if(edns->cookie_client) { + stats->num_queries_cookie_client++; + } else { + stats->num_queries_cookie_invalid++; + } +} diff --git a/usr.sbin/unbound/daemon/stats.h b/usr.sbin/unbound/daemon/stats.h index 5756f38a1..48decffb4 100644 --- a/usr.sbin/unbound/daemon/stats.h +++ b/usr.sbin/unbound/daemon/stats.h @@ -126,4 +126,11 @@ void server_stats_insquery(struct ub_server_stats* stats, struct comm_point* c, */ void server_stats_insrcode(struct ub_server_stats* stats, struct sldns_buffer* buf); +/** + * Add DNS Cookie stats for this query + * @param stats: the stats + * @param edns: edns record + */ +void server_stats_downstream_cookie(struct ub_server_stats* stats, + struct edns_data* edns); #endif /* DAEMON_STATS_H */ diff --git a/usr.sbin/unbound/daemon/worker.c b/usr.sbin/unbound/daemon/worker.c index 2d629a810..8c6fa3b9a 100644 --- a/usr.sbin/unbound/daemon/worker.c +++ b/usr.sbin/unbound/daemon/worker.c @@ -68,6 +68,7 @@ #include "util/fptr_wlist.h" #include "util/tube.h" #include "util/edns.h" +#include "util/timeval_func.h" #include "iterator/iter_fwd.h" #include "iterator/iter_hints.h" #include "iterator/iter_utils.h" @@ -133,7 +134,7 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker), rrset = slabhash_get_mem(&worker->env.rrset_cache->table); infra = infra_get_mem(worker->env.infra_cache); mesh = mesh_get_mem(worker->env.mesh); - ac = alloc_get_mem(&worker->alloc); + ac = alloc_get_mem(worker->alloc); superac = alloc_get_mem(&worker->daemon->superalloc); anch = anchors_get_mem(worker->env.anchors); iter = 0; @@ -288,61 +289,83 @@ worker_err_ratelimit(struct worker* worker, int err) return err; } +/** + * Structure holding the result of the worker_check_request function. + * Based on configuration it could be called up to four times; ideally should + * be called once. + */ +struct check_request_result { + int checked; + int value; +}; /** check request sanity. * @param pkt: the wire packet to examine for sanity. * @param worker: parameters for checking. - * @return error code, 0 OK, or -1 discard. + * @param out: struct to update with the result. */ -static int -worker_check_request(sldns_buffer* pkt, struct worker* worker) +static void +worker_check_request(sldns_buffer* pkt, struct worker* worker, + struct check_request_result* out) { + if(out->checked) return; + out->checked = 1; if(sldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) { verbose(VERB_QUERY, "request too short, discarded"); - return -1; + out->value = -1; + return; } if(sldns_buffer_limit(pkt) > NORMAL_UDP_SIZE && worker->daemon->cfg->harden_large_queries) { verbose(VERB_QUERY, "request too large, discarded"); - return -1; + out->value = -1; + return; } if(LDNS_QR_WIRE(sldns_buffer_begin(pkt))) { verbose(VERB_QUERY, "request has QR bit on, discarded"); - return -1; + out->value = -1; + return; } if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) { LDNS_TC_CLR(sldns_buffer_begin(pkt)); verbose(VERB_QUERY, "request bad, has TC bit on"); - return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR); + out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR); + return; } if(LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY && LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_NOTIFY) { verbose(VERB_QUERY, "request unknown opcode %d", LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt))); - return worker_err_ratelimit(worker, LDNS_RCODE_NOTIMPL); + out->value = worker_err_ratelimit(worker, LDNS_RCODE_NOTIMPL); + return; } if(LDNS_QDCOUNT(sldns_buffer_begin(pkt)) != 1) { verbose(VERB_QUERY, "request wrong nr qd=%d", LDNS_QDCOUNT(sldns_buffer_begin(pkt))); - return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR); + out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR); + return; } if(LDNS_ANCOUNT(sldns_buffer_begin(pkt)) != 0 && (LDNS_ANCOUNT(sldns_buffer_begin(pkt)) != 1 || LDNS_OPCODE_WIRE(sldns_buffer_begin(pkt)) != LDNS_PACKET_NOTIFY)) { verbose(VERB_QUERY, "request wrong nr an=%d", LDNS_ANCOUNT(sldns_buffer_begin(pkt))); - return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR); + out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR); + return; } if(LDNS_NSCOUNT(sldns_buffer_begin(pkt)) != 0) { verbose(VERB_QUERY, "request wrong nr ns=%d", LDNS_NSCOUNT(sldns_buffer_begin(pkt))); - return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR); + out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR); + return; } if(LDNS_ARCOUNT(sldns_buffer_begin(pkt)) > 1) { verbose(VERB_QUERY, "request wrong nr ar=%d", LDNS_ARCOUNT(sldns_buffer_begin(pkt))); - return worker_err_ratelimit(worker, LDNS_RCODE_FORMERR); + out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR); + return; } - return 0; + out->value = 0; + return; } void @@ -452,7 +475,8 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo, uint16_t udpsize = edns->udp_size; int secure = 0; time_t timenow = *worker->env.now; - int must_validate = (!(flags&BIT_CD) || worker->env.cfg->ignore_cd) + int has_cd_bit = (flags&BIT_CD); + int must_validate = (!has_cd_bit || worker->env.cfg->ignore_cd) && worker->env.need_to_validate; struct dns_msg *msg = NULL; struct delegpt *dp; @@ -484,11 +508,12 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo, msg->rep, LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad, worker->env.now_tv)) return 0; - /* TODO store the reason for the bogus reply in cache - * and implement in here instead of the hardcoded EDE */ - if (worker->env.cfg->ede) { - EDNS_OPT_LIST_APPEND_EDE(&edns->opt_list_out, - worker->scratchpad, LDNS_EDE_DNSSEC_BOGUS, ""); + /* Attach the cached EDE (RFC8914) */ + if(worker->env.cfg->ede && + msg->rep->reason_bogus != LDNS_EDE_NONE) { + edns_opt_list_append_ede(&edns->opt_list_out, + worker->scratchpad, msg->rep->reason_bogus, + msg->rep->reason_bogus_str); } error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, &msg->qinfo, id, flags, edns); @@ -522,6 +547,16 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo, worker->env.now_tv)) return 0; msg->rep->flags |= BIT_QR|BIT_RA; + /* Attach the cached EDE (RFC8914) if CD bit is set and the answer is + * bogus. */ + if(worker->env.cfg->ede && has_cd_bit && + (check_delegation_secure(msg->rep) == sec_status_bogus || + check_delegation_secure(msg->rep) == sec_status_secure_sentinel_fail) && + msg->rep->reason_bogus != LDNS_EDE_NONE) { + edns_opt_list_append_ede(&edns->opt_list_out, + worker->scratchpad, msg->rep->reason_bogus, + msg->rep->reason_bogus_str); + } if(!reply_info_answer_encode(&msg->qinfo, msg->rep, id, flags, repinfo->c->buffer, 0, 1, worker->scratchpad, udpsize, edns, (int)(edns->bits & EDNS_DO), secure)) { @@ -565,9 +600,10 @@ apply_respip_action(struct worker* worker, const struct query_info* qinfo, /* xxx_deny actions mean dropping the reply, unless the original reply * was redirected to response-ip data. */ - if((actinfo.action == respip_deny || + if(actinfo.action == respip_always_deny || + ((actinfo.action == respip_deny || actinfo.action == respip_inform_deny) && - *encode_repp == rep) + *encode_repp == rep)) *encode_repp = NULL; /* If address info is returned, it means the action should be an @@ -611,7 +647,8 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo, uint16_t udpsize = edns->udp_size; struct reply_info* encode_rep = rep; struct reply_info* partial_rep = *partial_repp; - int must_validate = (!(flags&BIT_CD) || worker->env.cfg->ignore_cd) + int has_cd_bit = (flags&BIT_CD); + int must_validate = (!has_cd_bit || worker->env.cfg->ignore_cd) && worker->env.need_to_validate; *partial_repp = NULL; /* avoid accidental further pass */ @@ -623,6 +660,14 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo, if(worker->env.cfg->serve_expired_ttl && rep->serve_expired_ttl < timenow) return 0; + /* Ignore expired failure answers */ + if(FLAGS_GET_RCODE(rep->flags) != + LDNS_RCODE_NOERROR && + FLAGS_GET_RCODE(rep->flags) != + LDNS_RCODE_NXDOMAIN && + FLAGS_GET_RCODE(rep->flags) != + LDNS_RCODE_YXDOMAIN) + return 0; if(!rrset_array_lock(rep->ref, rep->rrset_count, 0)) return 0; *is_expired_answer = 1; @@ -661,11 +706,11 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo, LDNS_RCODE_SERVFAIL, edns, repinfo, worker->scratchpad, worker->env.now_tv)) goto bail_out; - /* TODO store the reason for the bogus reply in cache - * and implement in here instead of the hardcoded EDE */ - if (worker->env.cfg->ede) { - EDNS_OPT_LIST_APPEND_EDE(&edns->opt_list_out, - worker->scratchpad, LDNS_EDE_DNSSEC_BOGUS, ""); + /* Attach the cached EDE (RFC8914) */ + if(worker->env.cfg->ede && rep->reason_bogus != LDNS_EDE_NONE) { + edns_opt_list_append_ede(&edns->opt_list_out, + worker->scratchpad, rep->reason_bogus, + rep->reason_bogus_str); } error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, qinfo, id, flags, edns); @@ -697,10 +742,6 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo, edns->udp_size = EDNS_ADVERTISED_SIZE; edns->ext_rcode = 0; edns->bits &= EDNS_DO; - if(!inplace_cb_reply_cache_call(&worker->env, qinfo, NULL, rep, - (int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad, - worker->env.now_tv)) - goto bail_out; *alias_rrset = NULL; /* avoid confusion if caller set it to non-NULL */ if((worker->daemon->use_response_ip || worker->daemon->use_rpz) && !partial_rep && !apply_respip_action(worker, qinfo, cinfo, rep, @@ -730,13 +771,24 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo, goto bail_out; } } else { - /* We don't check the global ede as this is a warning, not - * an error */ - if (*is_expired_answer == 1 && + if(*is_expired_answer == 1 && worker->env.cfg->ede_serve_expired && worker->env.cfg->ede) { EDNS_OPT_LIST_APPEND_EDE(&edns->opt_list_out, worker->scratchpad, LDNS_EDE_STALE_ANSWER, ""); } + /* Attach the cached EDE (RFC8914) if CD bit is set and the + * answer is bogus. */ + if(*is_secure_answer == 0 && + worker->env.cfg->ede && has_cd_bit && + encode_rep->reason_bogus != LDNS_EDE_NONE) { + edns_opt_list_append_ede(&edns->opt_list_out, + worker->scratchpad, encode_rep->reason_bogus, + encode_rep->reason_bogus_str); + } + if(!inplace_cb_reply_cache_call(&worker->env, qinfo, NULL, encode_rep, + (int)(flags&LDNS_RCODE_MASK), edns, repinfo, worker->scratchpad, + worker->env.now_tv)) + goto bail_out; if(!reply_info_answer_encode(qinfo, encode_rep, id, flags, repinfo->c->buffer, timenow, 1, worker->scratchpad, udpsize, edns, (int)(edns->bits & EDNS_DO), @@ -787,7 +839,8 @@ reply_and_prefetch(struct worker* worker, struct query_info* qinfo, if(modstack_find(&worker->env.mesh->mods, "subnetcache") != -1 && worker->env.unique_mesh) { mesh_new_prefetch(worker->env.mesh, qinfo, flags, leeway + - PREFETCH_EXPIRY_ADD, rpz_passthru, repinfo, opt_list); + PREFETCH_EXPIRY_ADD, rpz_passthru, + &repinfo->client_addr, opt_list); return; } #endif @@ -1050,7 +1103,8 @@ static int deny_refuse(struct comm_point* c, enum acl_access acl, enum acl_access deny, enum acl_access refuse, struct worker* worker, struct comm_reply* repinfo, - struct acl_addr* acladdr, int ede) + struct acl_addr* acladdr, int ede, + struct check_request_result* check_result) { if(acl == deny) { if(verbosity >= VERB_ALGO) { @@ -1073,9 +1127,16 @@ deny_refuse(struct comm_point* c, enum acl_access acl, if(worker->stats.extended) worker->stats.unwanted_queries++; - if(worker_check_request(c->buffer, worker) == -1) { + worker_check_request(c->buffer, worker, check_result); + if(check_result->value != 0) { + if(check_result->value != -1) { + LDNS_QR_SET(sldns_buffer_begin(c->buffer)); + LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), + check_result->value); + return 1; + } comm_point_drop_reply(repinfo); - return 0; /* discard this */ + return 0; } /* worker_check_request() above guarantees that the buffer contains at * least a header and that qdcount == 1 @@ -1229,7 +1290,8 @@ deny_refuse(struct comm_point* c, enum acl_access acl, static int deny_refuse_all(struct comm_point* c, enum acl_access* acl, struct worker* worker, struct comm_reply* repinfo, - struct acl_addr** acladdr, int ede, int check_proxy) + struct acl_addr** acladdr, int ede, int check_proxy, + struct check_request_result* check_result) { if(check_proxy) { *acladdr = acl_addr_lookup(worker->daemon->acl, @@ -1244,16 +1306,51 @@ deny_refuse_all(struct comm_point* c, enum acl_access* acl, } *acl = acl_get_control(*acladdr); return deny_refuse(c, *acl, acl_deny, acl_refuse, worker, repinfo, - *acladdr, ede); + *acladdr, ede, check_result); } static int deny_refuse_non_local(struct comm_point* c, enum acl_access acl, struct worker* worker, struct comm_reply* repinfo, - struct acl_addr* acladdr, int ede) + struct acl_addr* acladdr, int ede, + struct check_request_result* check_result) { return deny_refuse(c, acl, acl_deny_non_local, acl_refuse_non_local, - worker, repinfo, acladdr, ede); + worker, repinfo, acladdr, ede, check_result); +} + +/* Returns 1 if the ip rate limit check can happen before EDNS parsing, + * else 0 */ +static int +pre_edns_ip_ratelimit_check(enum acl_access acl) +{ + if(acl == acl_allow_cookie) return 0; + return 1; +} + +/* Check if the query is blocked by source IP rate limiting. + * Returns 1 if it passes the check, 0 otherwise. */ +static int +check_ip_ratelimit(struct worker* worker, struct sockaddr_storage* addr, + socklen_t addrlen, int has_cookie, sldns_buffer* pkt) +{ + if(!infra_ip_ratelimit_inc(worker->env.infra_cache, addr, addrlen, + *worker->env.now, has_cookie, + worker->env.cfg->ip_ratelimit_backoff, pkt)) { + /* See if we can pass through with slip factor */ + if(!has_cookie && worker->env.cfg->ip_ratelimit_factor != 0 && + ub_random_max(worker->env.rnd, + worker->env.cfg->ip_ratelimit_factor) == 0) { + char addrbuf[128]; + addr_to_str(addr, addrlen, addrbuf, sizeof(addrbuf)); + verbose(VERB_QUERY, "ip_ratelimit allowed through for " + "ip address %s because of slip in " + "ip_ratelimit_factor", addrbuf); + return 1; + } + return 0; + } + return 1; } int @@ -1269,11 +1366,13 @@ worker_handle_request(struct comm_point* c, void* arg, int error, struct edns_option* original_edns_list = NULL; enum acl_access acl; struct acl_addr* acladdr; + int pre_edns_ip_ratelimit = 1; int rc = 0; int need_drop = 0; int is_expired_answer = 0; int is_secure_answer = 0; int rpz_passthru = 0; + long long wait_queue_time = 0; /* We might have to chase a CNAME chain internally, in which case * we'll have up to two replies and combine them to build a complete * answer. These variables control this case. */ @@ -1282,6 +1381,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error, struct query_info* lookup_qinfo = &qinfo; struct query_info qinfo_tmp; /* placeholder for lookup_qinfo */ struct respip_client_info* cinfo = NULL, cinfo_tmp; + struct timeval wait_time; + struct check_request_result check_result = {0,0}; memset(&qinfo, 0, sizeof(qinfo)); if((error != NETEVENT_NOERROR && error != NETEVENT_DONE)|| !repinfo) { @@ -1289,6 +1390,20 @@ worker_handle_request(struct comm_point* c, void* arg, int error, verbose(VERB_ALGO, "handle request called with err=%d", error); return 0; } + + if (worker->env.cfg->sock_queue_timeout && timeval_isset(&c->recv_tv)) { + timeval_subtract(&wait_time, worker->env.now_tv, &c->recv_tv); + wait_queue_time = wait_time.tv_sec * 1000000 + wait_time.tv_usec; + if (worker->stats.max_query_time_us < wait_queue_time) + worker->stats.max_query_time_us = wait_queue_time; + if(wait_queue_time > + (long long)(worker->env.cfg->sock_queue_timeout * 1000000)) { + /* count and drop queries that were sitting in the socket queue too long */ + worker->stats.num_queries_timed_out++; + return 0; + } + } + #ifdef USE_DNSCRYPT repinfo->max_udp_size = worker->daemon->cfg->max_udp_size; if(!dnsc_handle_curved_request(worker->daemon->dnscenv, repinfo)) { @@ -1298,7 +1413,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error, if(c->dnscrypt && !repinfo->is_dnscrypted) { char buf[LDNS_MAX_DOMAINLEN+1]; /* Check if this is unencrypted and asking for certs */ - if(worker_check_request(c->buffer, worker) != 0) { + worker_check_request(c->buffer, worker, &check_result); + if(check_result.value != 0) { verbose(VERB_ALGO, "dnscrypt: worker check request: bad query."); log_addr(VERB_CLIENT,"from",&repinfo->client_addr, @@ -1340,31 +1456,34 @@ worker_handle_request(struct comm_point* c, void* arg, int error, if(worker->dtenv.log_client_query_messages) { log_addr(VERB_ALGO, "request from client", &repinfo->client_addr, repinfo->client_addrlen); log_addr(VERB_ALGO, "to local addr", (void*)repinfo->c->socket->addr->ai_addr, repinfo->c->socket->addr->ai_addrlen); - dt_msg_send_client_query(&worker->dtenv, &repinfo->client_addr, (void*)repinfo->c->socket->addr->ai_addr, c->type, c->buffer); + dt_msg_send_client_query(&worker->dtenv, &repinfo->client_addr, (void*)repinfo->c->socket->addr->ai_addr, c->type, c->buffer, + ((worker->env.cfg->sock_queue_timeout && timeval_isset(&c->recv_tv))?&c->recv_tv:NULL)); } #endif /* Check deny/refuse ACLs */ if(repinfo->is_proxied) { if((ret=deny_refuse_all(c, &acl, worker, repinfo, &acladdr, - worker->env.cfg->ede, 1)) != -1) { + worker->env.cfg->ede, 1, &check_result)) != -1) { if(ret == 1) goto send_reply; return ret; } } if((ret=deny_refuse_all(c, &acl, worker, repinfo, &acladdr, - worker->env.cfg->ede, 0)) != -1) { + worker->env.cfg->ede, 0, &check_result)) != -1) { if(ret == 1) goto send_reply; return ret; } - if((ret=worker_check_request(c->buffer, worker)) != 0) { + worker_check_request(c->buffer, worker, &check_result); + if(check_result.value != 0) { verbose(VERB_ALGO, "worker check request: bad query."); log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen); - if(ret != -1) { + if(check_result.value != -1) { LDNS_QR_SET(sldns_buffer_begin(c->buffer)); - LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), ret); + LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), + check_result.value); return 1; } comm_point_drop_reply(repinfo); @@ -1372,33 +1491,21 @@ worker_handle_request(struct comm_point* c, void* arg, int error, } worker->stats.num_queries++; + pre_edns_ip_ratelimit = pre_edns_ip_ratelimit_check(acl); - /* check if this query should be dropped based on source ip rate limiting - * NOTE: we always check the repinfo->client_address. IP ratelimiting is - * implicitly disabled for proxies. */ - if(!infra_ip_ratelimit_inc(worker->env.infra_cache, - &repinfo->client_addr, repinfo->client_addrlen, - *worker->env.now, - worker->env.cfg->ip_ratelimit_backoff, c->buffer)) { - /* See if we are passed through with slip factor */ - if(worker->env.cfg->ip_ratelimit_factor != 0 && - ub_random_max(worker->env.rnd, - worker->env.cfg->ip_ratelimit_factor) == 0) { - char addrbuf[128]; - addr_to_str(&repinfo->client_addr, - repinfo->client_addrlen, addrbuf, - sizeof(addrbuf)); - verbose(VERB_QUERY, "ip_ratelimit allowed through for " - "ip address %s because of slip in " - "ip_ratelimit_factor", addrbuf); - } else { + /* If the IP rate limiting check needs extra EDNS information (e.g., + * DNS Cookies) postpone the check until after EDNS is parsed. */ + if(pre_edns_ip_ratelimit) { + /* NOTE: we always check the repinfo->client_address. + * IP ratelimiting is implicitly disabled for proxies. */ + if(!check_ip_ratelimit(worker, &repinfo->client_addr, + repinfo->client_addrlen, 0, c->buffer)) { worker->stats.num_queries_ip_ratelimited++; comm_point_drop_reply(repinfo); return 0; } } - /* see if query is in the cache */ if(!query_info_parse(&qinfo, c->buffer)) { verbose(VERB_ALGO, "worker parse request: formerror."); log_addr(VERB_CLIENT, "from", &repinfo->client_addr, @@ -1455,16 +1562,16 @@ worker_handle_request(struct comm_point* c, void* arg, int error, } goto send_reply; } - if((ret=parse_edns_from_query_pkt(c->buffer, &edns, worker->env.cfg, c, - worker->scratchpad)) != 0) { + if((ret=parse_edns_from_query_pkt( + c->buffer, &edns, worker->env.cfg, c, repinfo, + (worker->env.now ? *worker->env.now : time(NULL)), + worker->scratchpad)) != 0) { struct edns_data reply_edns; verbose(VERB_ALGO, "worker parse edns: formerror."); log_addr(VERB_CLIENT, "from", &repinfo->client_addr, repinfo->client_addrlen); memset(&reply_edns, 0, sizeof(reply_edns)); reply_edns.edns_present = 1; - reply_edns.udp_size = EDNS_ADVERTISED_SIZE; - LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), ret); error_encode(c->buffer, ret, &qinfo, *(uint16_t*)(void *)sldns_buffer_begin(c->buffer), sldns_buffer_read_u16_at(c->buffer, 2), &reply_edns); @@ -1473,23 +1580,15 @@ worker_handle_request(struct comm_point* c, void* arg, int error, } if(edns.edns_present) { if(edns.edns_version != 0) { - edns.ext_rcode = (uint8_t)(EDNS_RCODE_BADVERS>>4); - edns.edns_version = EDNS_ADVERTISED_VERSION; - edns.udp_size = EDNS_ADVERTISED_SIZE; - edns.bits &= EDNS_DO; edns.opt_list_in = NULL; edns.opt_list_out = NULL; edns.opt_list_inplace_cb_out = NULL; - edns.padding_block_size = 0; verbose(VERB_ALGO, "query with bad edns version."); log_addr(VERB_CLIENT, "from", &repinfo->client_addr, repinfo->client_addrlen); - error_encode(c->buffer, EDNS_RCODE_BADVERS&0xf, &qinfo, + extended_error_encode(c->buffer, EDNS_RCODE_BADVERS, &qinfo, *(uint16_t*)(void *)sldns_buffer_begin(c->buffer), - sldns_buffer_read_u16_at(c->buffer, 2), NULL); - if(sldns_buffer_capacity(c->buffer) >= - sldns_buffer_limit(c->buffer)+calc_edns_field_size(&edns)) - attach_edns_record(c->buffer, &edns); + sldns_buffer_read_u16_at(c->buffer, 2), 0, &edns); regional_free_all(worker->scratchpad); goto send_reply; } @@ -1502,6 +1601,62 @@ worker_handle_request(struct comm_point* c, void* arg, int error, edns.udp_size = NORMAL_UDP_SIZE; } } + + /* Get stats for cookies */ + server_stats_downstream_cookie(&worker->stats, &edns); + + /* If the IP rate limiting check was postponed, check now. */ + if(!pre_edns_ip_ratelimit) { + /* NOTE: we always check the repinfo->client_address. + * IP ratelimiting is implicitly disabled for proxies. */ + if(!check_ip_ratelimit(worker, &repinfo->client_addr, + repinfo->client_addrlen, edns.cookie_valid, + c->buffer)) { + worker->stats.num_queries_ip_ratelimited++; + comm_point_drop_reply(repinfo); + return 0; + } + } + + /* "if, else if" sequence below deals with downstream DNS Cookies */ + if(acl != acl_allow_cookie) + ; /* pass; No cookie downstream processing whatsoever */ + + else if(edns.cookie_valid) + ; /* pass; Valid cookie is good! */ + + else if(c->type != comm_udp) + ; /* pass; Stateful transport */ + + else if(edns.cookie_present) { + /* Cookie present, but not valid: Cookie was bad! */ + extended_error_encode(c->buffer, + LDNS_EXT_RCODE_BADCOOKIE, &qinfo, + *(uint16_t*)(void *) + sldns_buffer_begin(c->buffer), + sldns_buffer_read_u16_at(c->buffer, 2), + 0, &edns); + regional_free_all(worker->scratchpad); + goto send_reply; + } else { + /* Cookie required, but no cookie present on UDP */ + verbose(VERB_ALGO, "worker request: " + "need cookie or stateful transport"); + log_addr(VERB_ALGO, "from",&repinfo->remote_addr + , repinfo->remote_addrlen); + EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out, + worker->scratchpad, LDNS_EDE_OTHER, + "DNS Cookie needed for UDP replies"); + error_encode(c->buffer, + (LDNS_RCODE_REFUSED|BIT_TC), &qinfo, + *(uint16_t*)(void *) + sldns_buffer_begin(c->buffer), + sldns_buffer_read_u16_at(c->buffer, 2), + &edns); + regional_free_all(worker->scratchpad); + goto send_reply; + } + if(edns.udp_size > worker->daemon->cfg->max_udp_size && c->type == comm_udp) { verbose(VERB_QUERY, @@ -1587,7 +1742,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error, /* We've looked in our local zones. If the answer isn't there, we * might need to bail out based on ACLs now. */ if((ret=deny_refuse_non_local(c, acl, worker, repinfo, acladdr, - worker->env.cfg->ede)) != -1) + worker->env.cfg->ede, &check_result)) != -1) { regional_free_all(worker->scratchpad); if(ret == 1) @@ -1606,7 +1761,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error, * ACLs allow the snooping. */ if(!(LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) && acl != acl_allow_snoop ) { - if (worker->env.cfg->ede) { + if(worker->env.cfg->ede) { EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out, worker->scratchpad, LDNS_EDE_NOT_AUTHORITATIVE, ""); } @@ -2059,15 +2214,14 @@ worker_init(struct worker* worker, struct config_file *cfg, } server_stats_init(&worker->stats, cfg); - alloc_init(&worker->alloc, &worker->daemon->superalloc, - worker->thread_num); - alloc_set_id_cleanup(&worker->alloc, &worker_alloc_cleanup, worker); + worker->alloc = worker->daemon->worker_allocs[worker->thread_num]; + alloc_set_id_cleanup(worker->alloc, &worker_alloc_cleanup, worker); worker->env = *worker->daemon->env; comm_base_timept(worker->base, &worker->env.now, &worker->env.now_tv); worker->env.worker = worker; worker->env.worker_base = worker->base; worker->env.send_query = &worker_send_query; - worker->env.alloc = &worker->alloc; + worker->env.alloc = worker->alloc; worker->env.outnet = worker->back; worker->env.rnd = worker->rndstate; /* If case prefetch is triggered, the corresponding mesh will clear @@ -2211,7 +2365,7 @@ worker_delete(struct worker* worker) #endif /* USE_DNSTAP */ comm_base_delete(worker->base); ub_randfree(worker->rndstate); - alloc_clear(&worker->alloc); + /* don't touch worker->alloc, as it's maintained in daemon */ regional_destroy(worker->env.scratch); regional_destroy(worker->scratchpad); free(worker); diff --git a/usr.sbin/unbound/daemon/worker.h b/usr.sbin/unbound/daemon/worker.h index d4d337a7a..520da5018 100644 --- a/usr.sbin/unbound/daemon/worker.h +++ b/usr.sbin/unbound/daemon/worker.h @@ -118,7 +118,7 @@ struct worker { /** do we need to restart or quit (on signal) */ int need_to_exit; /** allocation cache for this thread */ - struct alloc_cache alloc; + struct alloc_cache *alloc; /** per thread statistics */ struct ub_server_stats stats; /** thread scratch regional */ @@ -131,6 +131,8 @@ struct worker { /** dnstap environment, changed for this thread */ struct dt_env dtenv; #endif + /** reuse existing cache on reload if other conditions allow it. */ + int reuse_cache; }; /** diff --git a/usr.sbin/unbound/dns64/dns64.c b/usr.sbin/unbound/dns64/dns64.c index 7010662a4..f74bfef2e 100644 --- a/usr.sbin/unbound/dns64/dns64.c +++ b/usr.sbin/unbound/dns64/dns64.c @@ -59,7 +59,7 @@ ******************************************************************************/ /** - * This is the default DNS64 prefix that is used whent he dns64 module is listed + * This is the default DNS64 prefix that is used when the dns64 module is listed * in module-config but when the dns64-prefix variable is not present. */ static const char DEFAULT_DNS64_PREFIX[] = "64:ff9b::/96"; @@ -841,7 +841,7 @@ dns64_adjust_a(int id, struct module_qstate* super, struct module_qstate* qstate cp = construct_reply_info_base(super->region, rep->flags, rep->qdcount, rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl, rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets, - rep->rrset_count, rep->security); + rep->rrset_count, rep->security, LDNS_EDE_NONE); if(!cp) return; diff --git a/usr.sbin/unbound/dnstap/dnstap.c b/usr.sbin/unbound/dnstap/dnstap.c index 5c0cde1d5..d15eb9b00 100644 --- a/usr.sbin/unbound/dnstap/dnstap.c +++ b/usr.sbin/unbound/dnstap/dnstap.c @@ -388,12 +388,15 @@ dt_msg_send_client_query(struct dt_env *env, struct sockaddr_storage *qsock, struct sockaddr_storage *rsock, enum comm_point_type cptype, - sldns_buffer *qmsg) + sldns_buffer *qmsg, + struct timeval* tstamp) { struct dt_msg dm; struct timeval qtime; - gettimeofday(&qtime, NULL); + if(tstamp) + memcpy(&qtime, tstamp, sizeof(qtime)); + else gettimeofday(&qtime, NULL); /* type */ dt_msg_init(env, &dm, DNSTAP__MESSAGE__TYPE__CLIENT_QUERY); diff --git a/usr.sbin/unbound/dnstap/dnstap.h b/usr.sbin/unbound/dnstap/dnstap.h index 449fae727..169bdc2c6 100644 --- a/usr.sbin/unbound/dnstap/dnstap.h +++ b/usr.sbin/unbound/dnstap/dnstap.h @@ -126,13 +126,15 @@ dt_delete(struct dt_env *env); * @param rsock: local (service) address/port. * @param cptype: comm_udp or comm_tcp. * @param qmsg: query message. + * @param tstamp: timestamp or NULL if none provided. */ void dt_msg_send_client_query(struct dt_env *env, struct sockaddr_storage *qsock, struct sockaddr_storage *rsock, enum comm_point_type cptype, - struct sldns_buffer *qmsg); + struct sldns_buffer *qmsg, + struct timeval* tstamp); /** * Create and send a new dnstap "Message" event of type CLIENT_RESPONSE. diff --git a/usr.sbin/unbound/dnstap/unbound-dnstap-socket.c b/usr.sbin/unbound/dnstap/unbound-dnstap-socket.c index 2a995bc13..525b8cb3f 100644 --- a/usr.sbin/unbound/dnstap/unbound-dnstap-socket.c +++ b/usr.sbin/unbound/dnstap/unbound-dnstap-socket.c @@ -61,6 +61,7 @@ #include "services/listen_dnsport.h" #include "sldns/sbuffer.h" #include "sldns/wire2str.h" +#include "sldns/pkthdr.h" #ifdef USE_DNSTAP #include #include "dnstap/dnstap.pb-c.h" @@ -448,6 +449,7 @@ static char* q_of_msg(ProtobufCBinaryData message) char buf[300]; /* header, name, type, class minimum to get the query tuple */ if(message.len < 12 + 1 + 4 + 4) return NULL; + if(LDNS_QDCOUNT(message.data) < 1) return NULL; if(sldns_wire2str_rrquestion_buf(message.data+12, message.len-12, buf, sizeof(buf)) != 0) { /* remove trailing newline, tabs to spaces */ @@ -502,7 +504,7 @@ static char* tv_to_str(protobuf_c_boolean has_time_sec, uint64_t time_sec, time_t time_t_sec; memset(&tv, 0, sizeof(tv)); if(has_time_sec) tv.tv_sec = time_sec; - if(has_time_nsec) tv.tv_usec = time_nsec; + if(has_time_nsec) tv.tv_usec = time_nsec/1000; buf[0]=0; time_t_sec = tv.tv_sec; @@ -789,7 +791,7 @@ static int reply_with_accept(struct tap_data* data) /** reply with FINISH control frame to bidirectional client, * returns 0 on error */ -static int reply_with_finish(int fd) +static int reply_with_finish(struct tap_data* data) { #ifdef USE_DNSTAP size_t len = 0; @@ -799,21 +801,34 @@ static int reply_with_finish(int fd) return 0; } - fd_set_block(fd); - if(send(fd, finishframe, len, 0) == -1) { - log_err("send failed: %s", sock_strerror(errno)); - fd_set_nonblock(fd); - free(finishframe); - return 0; + fd_set_block(data->fd); + if(data->ssl) { + int r; + if((r=SSL_write(data->ssl, finishframe, len)) <= 0) { + if(SSL_get_error(data->ssl, r) == SSL_ERROR_ZERO_RETURN) + log_err("SSL_write, peer closed connection"); + else + log_err("could not SSL_write"); + fd_set_nonblock(data->fd); + free(finishframe); + return 0; + } + } else { + if(send(data->fd, finishframe, len, 0) == -1) { + log_err("send failed: %s", sock_strerror(errno)); + fd_set_nonblock(data->fd); + free(finishframe); + return 0; + } } if(verbosity) log_info("sent control frame(finish)"); - fd_set_nonblock(fd); + fd_set_nonblock(data->fd); free(finishframe); return 1; #else log_err("no dnstap compiled, no reply"); - (void)fd; + (void)data; return 0; #endif } @@ -933,7 +948,7 @@ static int tap_handshake(struct tap_data* data) #endif /* HAVE_SSL */ /** callback for dnstap listener */ -void dtio_tap_callback(int fd, short ATTR_UNUSED(bits), void* arg) +void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg) { struct tap_data* data = (struct tap_data*)arg; if(verbosity>=3) log_info("tap callback"); @@ -1016,7 +1031,7 @@ void dtio_tap_callback(int fd, short ATTR_UNUSED(bits), void* arg) } } else if(data->len >= 4 && sldns_read_uint32(data->frame) == FSTRM_CONTROL_FRAME_STOP && data->is_bidirectional) { - if(!reply_with_finish(fd)) { + if(!reply_with_finish(data)) { tap_data_free(data); return; } diff --git a/usr.sbin/unbound/doc/Changelog b/usr.sbin/unbound/doc/Changelog index 727d1543e..a7c9c4002 100644 --- a/usr.sbin/unbound/doc/Changelog +++ b/usr.sbin/unbound/doc/Changelog @@ -1,7 +1,416 @@ +25 August 2023: Wouter + - Fix compile error on NetBSD in util/netevent.h. + +23 August 2023: Wouter + - Tag for 1.18.0rc1 release. + +22 August 2023: Wouter + - Set version number to 1.18.0. + +21 August 2023: Wouter + - Debug Windows ci workflow. + - Fix windows ci workflow to install bison and flex. + - Fix for #925: unbound.service: Main process exited, code=killed, + status=11/SEGV. Fixes cachedb configuration handling. + - Fix #923: processQueryResponse() THROWAWAY should be mindful of + fail_reply. + - Fix unit test for unbound-control to work when threads are disabled, + and fix cache dump check. + +18 August 2023: Wouter + - Fix for iter_dec_attempts that could cause a hang, part of + capsforid and qname minimisation, depending on the settings. + - Fix uninitialized memory passed in padding bytes of cmsg to sendmsg. + - Fix stat_values test to work with dig that enables DNS cookies. + +17 August 2023: Wouter + - Merge PR #762: Downstream DNS Server Cookies a la RFC7873 and + RFC9018. Create server cookies for clients that send client cookies. + This needs to be explicitly turned on in the config file with: + `answer-cookie: yes`. A `cookie-secret:` can be configured for + anycast setups. Without one, a random cookie secret is generated. + The acl option `allow_cookie` allows queries with either a valid + cookie or over a stateful transport. The statistics output has + `queries_cookie_valid` and `queries_cookie_client` and + `queries_cookie_invalid` information. The `ip\-ratelimit\-cookie:` + value determines a rate limit for queries with cookies, if desired. + - Fix regional_alloc_init for potential unaligned source of the copy. + - Fix ip_ratelimit test to work with dig that enables DNS cookies. + +2 August 2023: George + - Move a cache reply callback in worker.c closer to the cache reply + generation. + +1 August 2023: George + - Merge #911 from natalie-reece: Exclude EDE before other EDNS options + when there isn't enough space. + - For #911: Try to trim EXTRA-TEXT (and LDNS_EDE_OTHER options + altogether) before giving up on attaching EDE options. + - More braces and formatting for Fix for EDNS EDE size calculation to + avoid future bugs. + - Fix to use the now cached EDE, if any, for CD_bit queries. + +1 August 2023: Wouter + - Fix for EDNS EDE size calculation. + +31 July 2023: George + - Merge #790 from Tom Carpay: Add support for EDE caching in cachedb + and subnetcache. + +31 July 2023: Wouter + - iana portlist update. + +30 July 2023: George + - Merge #759 from Tom Carpay: Add EDE (RFC8914) caching. + +28 July 2023: George + - Fix unused variable compile warning for kernel timestamps in + netevent.c + +21 July 2023: George + - Merge #857 from eaglegai: fix potential memory leaks when errors + happen. + - For #857: fix mixed declarations and code. + - Merge #118 from mibere: Changed verbosity level for Redis init & + deinit. + - Merge #390 from Frank Riley: Add missing callbacks to the python + module. + - Cleaner failure code for callback functions in interface.i. + - Merge #889 from borisVanhoof: Free memory in error case + remove + unused function. + - For #889: use netcat-openbsd instead of netcat-traditional. + - For #889: Account for num_detached_states before possible + mesh_state_delete when erroring out. + +20 July 2023: George + - Merge #909 from headshog: Numeric truncation when parsing TYPEXX and + CLASSXX representation. + - For #909: Fix return values. + - Merge #901 from Sergei Trofimovich: config: improve handling of + unknown modules. + +20 July 2023: Wouter + - For #909: Fix RR class comparison. + +14 July 2023: George + - More clear description of the different auth-zone behaviors on the + man page. + +13 July 2023: George + - Merge #880 from chipitsine: services/authzone.c: remove redundant + check. + +11 July 2023: George + - Merge #664 from tilan7763: Add prefetch support for subnet cache + entries. + - For #664: Easier code flow for subnetcache prefetching. + - For #664: Add testcase. + - For #664: Rename subnet_prefetch tests to subnet_global_prefetch to + differentiate from the new subnet prefetch support. + +3 July 2023: George + - Merge #739: Add SVCB dohpath support. + - Code cleanup for sldns_str2wire_svcparam_key_lookup. + - Merge #802: add validation EDEs to queries where the CD bit is set. + - For #802: Cleanup comments and add RCODE check for CD bit test case. + - Skip the 00-lint test. splint is not maintained; it either does not + work or produces false positives. Static analysis is handled in the + clang test. + +3 July 2023: Wouter + - Fix #906: warning: ‘Py_SetProgramName’ is deprecated. + - Fix dereference of NULL variable warning in mesh_do_callback. + +29 June 2023: George + - More fixes for reference counting for python module and clean up + failure code. + - Merge #827 from rcmcdonald91: Eliminate unnecessary Python reloading + which causes memory leaks. + +29 June 2023: Wouter + - Fix python modules with multiple scripts, by incrementing reference + counts. + +27 June 2023: George + - Merge #892: Add cachedb hit stat. Introduces 'num.query.cachedb' as + a new statistical counter. + - Remove warning about unknown cast-function-type warning pragma. + +22 June 2023: Wouter + - Merge #903: contrib: add yocto compatible init script. + +15 June 2023: Philip + - Fix for issue #887 (Timeouts to forward servers on BSD based + system with ASLR) + - Probably fixes #516 (Stream reuse does not work on Windows) as well + +14 June 2023: George + - Properly handle all return values of worker_check_request during + early EDE code. + - Do not check the incoming request more than once. + +12 June 2023: Wouter + - Merge #896: Fix: #895: pythonmodule: add all site-packages + directories to sys.path. + - Fix #895: python + sysconfig gives ANOTHER path comparing to + distutils. + - Fix for uncertain unit test for doh buffer size events. + +25 May 2023: Wouter + - Fix unbound-dnstap-socket printout when no query is present. + - Fix unbound-dnstap-socket time fraction conversion for printout. + +19 May 2023: Wouter + - Fix RPZ removal of client-ip, nsip, nsdname triggers from IXFR. + - Fix to remove unused variables from RPZ clientip data structure. + +16 May 2023: Wouter + - Fix #888: [FR] Use kernel timestamps for dnstap. + - Fix to print debug log for ancillary data with correct IP address. + +11 May 2023: Wouter + - Fix warning in windows compile, in set_recvtimestamp. + +4 May 2023: Wouter + - Fix #885: Error: util/configlexer.c: No such file or directory, + adds error messages explaining to install flex and bison. + - Fix to remove unused whitespace from acx_nlnetlabs.m4 and config.h. + - Fix doxygen in addr_to_nat64 header definition. + +1 May 2023: George + - Merge #722 from David 'eqvinox' Lamparter: NAT64 support. + - For #722: minor fixes, formatting, refactoring. + +1 May 2023: Wouter + - Fix RPZ IP responses with trigger rpz-drop on cache entries, that + they are dropped. + +26 April 2023: Philip + - Fix issue #860: Bad interaction with 0 TTL records and serve-expired + +26 April 2023: Wouter + - Merge #882 from vvfedorenko: Features/dropqueuedpackets, with + sock-queue-timeout option that drops packets that have been in the + socket queue for too long. Added statistics num.queries_timed_out + and query.queue_time_us.max that track the socket queue timeouts. + - Fix for #882: small changes, date updated in Copyright for + util/timeval_func.c and util/timeval_func.h. Man page entries and + example entry. + - Fix for #882: document variable to stop doxygen warning. + +19 April 2023: Wouter + - Fix for #878: Invalid IP address in unbound.conf causes Segmentation + Fault on OpenBSD. + +14 April 2023: Wouter + - Merge #875: change obsolete txt URL in unbound-anchor.c to point + to RFC 7958, and Fix #874. + +13 April 2023: Wouter + - Fix build badge, from failing travis link to github ci action link. + +6 April 2023: Wouter + - Fix for #870: Add test case for the qname minimisation and CNAME. + +4 April 2023: Wouter + - Fix #870: NXDOMAIN instead of NOERROR rcode when asked for existing + CNAME record. + +24 March 2023: Philip + - Fix issue #676: Unencrypted query is sent when + forward-tls-upstream: yes is used without tls-cert-bundle + - Extra consistency check to make sure that when TLS is requested, + either we set up a TLS connection or we return an error. + +21 March 2023: Philip + - Fix issue #851: reserved identifier violation + +20 March 2023: Wouter + - iana portlist update. + +17 March 2023: George + - Fix #812, fix #846, by using the SSL_OP_IGNORE_UNEXPECTED_EOF option + to ignore the unexpected eof while reading in openssl >= 3. + +16 March 2023: Wouter + - Fix ssl.h include brackets, instead of quotes. + +14 March 2023: Wouter + - Fix unbound-dnstap-socket test program to reply the finish frame + over a TLS connection correctly. + +23 February 2023: Wouter + - Fix for #852: Completion of error handling. + +21 February 2023: Philip + - Fix #825: Unexpected behavior with client-subnet-always-forward + and serve-expired + +10 February 2023: George + - Clean up iterator/iterator.c::error_response_cache() and allow for + better interaction with serve-expired, prefetch and cached error + responses. + +9 February 2023: George + - Allow TTL refresh of expired error responses. + - Add testcase for refreshing expired error responses. + +9 February 2023: Wouter + - Fix to ignore entirely empty responses, and try at another authority. + This turns completely empty responses, a type of noerror/nodata into + a servfail, but they do not conform to RFC2308, and the retry can + fetch improved content. + - Fix unit tests for spurious empty messages. + - Fix consistency of unit test without roundrobin answers for the + cnametooptout unit test. + - Fix to git ignore the library symbol file that configure can create. + +8 February 2023: Wouter + - Fix #841: Unbound won't build with aaaa-filter-iterator.patch. + +30 January 2023: George + - Add duration variable for speed_local.test. + +26 January 2023: Wouter + - Fix acx_nlnetlabs.m4 for -Wstrict-prototypes. + +23 January 2023: George + - Fix #833: [FR] Ability to set the Redis password. + +23 January 2023: Wouter + - Fix #835: [FR] Ability to use Redis unix sockets. + +20 January 2023: Wouter + - Merge #819: Added new static zone type block_a to suppress all A + queries for specific zones. + +19 January 2023: Wouter + - Set max-udp-size default to 1232. This is the same default value as + the default value for edns-buffer-size. It restricts client edns + buffer size choices, and makes unbound behave similar to other DNS + resolvers. The new choice, down from 4096 means it is harder to get + large responses from Unbound. Thanks to Xiang Li, from NISL Lab, + Tsinghua University. + - Add harden-unknown-additional option. It removes + unknown records from the authority section and additional section. + Thanks to Xiang Li, from NISL Lab, Tsinghua University. + - Set default for harden-unknown-additional to no. So that it does + not hamper future protocol developments. + - Fix test for new default. + +18 January 2023: Wouter + - Fix not following cleared RD flags potentially enables amplification + DDoS attacks, reported by Xiang Li and Wei Xu from NISL Lab, + Tsinghua University. The fix stops query loops, by refusing to send + RD=0 queries to a forwarder, they still get answered from cache. + +13 January 2023: Wouter + - Merge #826: Аdd a metric about the maximum number of collisions in + lrushah. + - Improve documentation for #826, describe the large collisions amount. + +9 January 2023: Wouter + - Fix python module install path detection. + - Fix python version detection in configure. + +6 January 2023: Wouter + - Fix #823: Response change to NODATA for some ANY queries since + 1.12, tested on 1.16.1. + - Fix wildcard in hyperlocal zone service degradation, reported + by Sergey Kacheev. This fix is included in 1.17.1rc2. + That became 1.17.1 on 12 Jan 2023, the code repo continues + with 1.17.2. 1.17.1 excludes fix #823, it is included forwards. + +5 January 2023: Wouter + - Tag for 1.17.1 release. + +2 January 2023: Wouter + - Fix windows compile for libunbound subprocess reap comm point closes. + - Update github workflows to use checkout v3. + +14 December 2022: George + - Merge #569 from JINMEI Tatuya: add keep-cache option to + 'unbound-control reload' to keep caches. + +13 December 2022: George + - Expose 'statistics-inhibit-zero' as a configuration option; the + default value retains Unbound's behavior. + - Expose 'max-sent-count' as a configuration option; the + default value retains Unbound's behavior. + - Merge #461 from Christian Allred: Add max-query-restarts option. + Exposes an internal configuration but the default value retains + Unbound's behavior. + +13 December 2022: Wouter + - Merge #808: Wrap Makefile script's directory variables in quotes. + - Fix to wrap Makefile scripts directory in quotes for uninstall. + +1 December 2022: Wouter + - Fix #773: When used with systemd-networkd, unbound does not start + until systemd-networkd-wait-online.service times out. + +30 November 2022: George + - Add SVCB and HTTPS to the types removed by 'unbound-control flush'. + - Clear documentation for interactivity between the subnet module and + the serve-expired and prefetch configuration options. + +30 November 2022: Wouter + - Fix #782: Segmentation fault in stats.c:404. + +28 November 2022: Wouter + - Fix for the ignore of tcp events for closed comm points, preserve + the use after free protection features. + +23 November 2022: Philip + - Merge #720 from jonathangray: fix use after free when + WSACreateEvent() fails. + +22 November 2022: George + - Ignore expired error responses. + +11 November 2022: Wouter + - Fix #779: [doc] Missing documention in ub_resolve_event() for + callback parameter was_ratelimited. + +9 November 2022: George + - Complementary fix for distutils.sysconfig deprecation in Python 3.10 + to commit 62c5039ab9da42713e006e840b7578e01d66e7f2. + +8 November 2022: Wouter + - Fix to ignore tcp events for closed comm points. + - Fix to make sure to not read again after a tcp comm point is closed. + - Fix #775: libunbound: subprocess reap causes parent process reap + to hang. + - iana portlist update. + +21 October 2022: George + - Merge #767 from jonathangray: consistently use IPv4/IPv6 in + unbound.conf.5. + +21 October 2022: Wouter + - Fix that cachedb does not store failures in the external cache. + +18 October 2022: George + - Clarify the use of MAX_SENT_COUNT in the iterator code. + +17 October 2022: Wouter + - testcode/dohclient sets log identity to its name. + +14 October 2022: Wouter + - Merge #768 from fobser: Arithmetic on a pointer to void is a GNU + extension. + - In unit test, print python script name list correctly. + +13 October 2022: Wouter + - Tag for 1.17.0 release. The code repository continues with 1.17.1. + 11 October 2022: George - Fix PROXYv2 header read for TCP connections when no proxied addresses are provided. +7 October 2022: Wouter + - Tag for 1.17.0rc1 release. + 7 October 2022: George - Fix to stop possible loops in the tcp reuse code (write_wait list and tcp_wait list). Based on analysis and patch from Prad Seniappan diff --git a/usr.sbin/unbound/doc/README b/usr.sbin/unbound/doc/README index 7b49c206c..7c443c5af 100644 --- a/usr.sbin/unbound/doc/README +++ b/usr.sbin/unbound/doc/README @@ -1,4 +1,4 @@ -README for Unbound 1.17.0 +README for Unbound 1.18.0 Copyright 2007 NLnet Labs http://unbound.net diff --git a/usr.sbin/unbound/doc/README.DNS64 b/usr.sbin/unbound/doc/README.DNS64 index 49446ac57..71e2310ed 100644 --- a/usr.sbin/unbound/doc/README.DNS64 +++ b/usr.sbin/unbound/doc/README.DNS64 @@ -28,3 +28,23 @@ prefix. For example: ;; ANSWER SECTION: jazz-v4.viagenie.ca. 86400 IN AAAA 64:ff9b::ce7b:1f02 + +NAT64 support was added by David Lamparter in 2022; license(s) of the +surrounding code apply. Note that NAT64 is closely related but functionally +orthogonal to DNS64; it allows Unbound to send outgoing queries to IPv4-only +servers over IPv6 through the configured NAT64 prefix. This allows running +an Unbound instance on an IPv6-only host without breaking every single domain +that only has IPv4 servers. Whether that Unbound instance also does DNS64 is +an independent choice. + +To enable NAT64 in Unbound, add to unbound.conf's "server" section: + + do-nat64: yes + +The NAT64 prefix defaults to the DNS64 prefix, which in turn defaults to the +standard 64:FF9B::/96 prefix. You can reconfigure it with: + + nat64-prefix: 64:FF9B::/96 + +To test NAT64 operation, pick a domain that only has IPv4 reachability for its +nameservers and try resolving any names in that domain. diff --git a/usr.sbin/unbound/doc/example.conf.in b/usr.sbin/unbound/doc/example.conf.in index 611a31667..b7195360c 100644 --- a/usr.sbin/unbound/doc/example.conf.in +++ b/usr.sbin/unbound/doc/example.conf.in @@ -1,7 +1,7 @@ # # Example configuration file. # -# See unbound.conf(5) man page, version 1.17.0. +# See unbound.conf(5) man page, version 1.18.0. # # this is a comment. @@ -35,9 +35,14 @@ server: # statistics-cumulative: no # enable extended statistics (query types, answer codes, status) - # printed from unbound-control. default off, because of speed. + # printed from unbound-control. Default off, because of speed. # extended-statistics: no + # Inhibits selected extended statistics (qtype, qclass, qopcode, rcode, + # rpz-actions) from printing if their value is 0. + # Default on. + # statistics-inhibit-zero: yes + # number of threads to create. 1 disables threading. # num-threads: 1 @@ -138,8 +143,8 @@ server: # edns-buffer-size: 1232 # Maximum UDP response size (not applied to TCP response). - # Suggested values are 512 to 4096. Default is 4096. 65536 disables it. - # max-udp-size: 4096 + # Suggested values are 512 to 4096. Default is 1232. 65536 disables it. + # max-udp-size: 1232 # max memory to use for stream(tcp and tls) waiting result buffers. # stream-wait-size: 4m @@ -173,6 +178,15 @@ server: # a throwaway response (also timeouts) is received. # outbound-msg-retry: 5 + # Hard limit on the number of outgoing queries Unbound will make while + # resolving a name, making sure large NS sets do not loop. + # It resets on query restarts (e.g., CNAME) and referrals. + # max-sent-count: 32 + + # Hard limit on the number of times Unbound is allowed to restart a + # query upon encountering a CNAME record. + # max-query-restarts: 11 + # msec for waiting for an unknown server to reply. Increase if you # are behind a slow satellite link, to eg. 1128. # unknown-server-time-limit: 376 @@ -229,6 +243,18 @@ server: # Enable IPv6, "yes" or "no". # do-ip6: yes + # If running unbound on an IPv6-only host, domains that only have + # IPv4 servers would become unresolveable. If NAT64 is available in + # the network, unbound can use NAT64 to reach these servers with + # the following option. This is NOT needed for enabling DNS64 on a + # system that has IPv4 connectivity. + # Consider also enabling prefer-ip6 to prefer native IPv6 connections + # to nameservers. + # do-nat64: no + + # NAT64 prefix. Defaults to using dns64-prefix value. + # nat64-prefix: 64:ff9b::0/96 + # Enable UDP, "yes" or "no". # do-udp: yes @@ -260,6 +286,10 @@ server: # Timeout for EDNS TCP keepalive, in msec. # edns-tcp-keepalive-timeout: 120000 + # UDP queries that have waited in the socket buffer for a long time + # can be dropped. Default is 0, disabled. In seconds, such as 3. + # sock-queue-timeout: 0 + # Use systemd socket activation for UDP, TCP, and control sockets. # use-systemd: no @@ -489,6 +519,10 @@ server: # to validate the zone. # harden-algo-downgrade: no + # Harden against unknown records in the authority section and the + # additional section. + # harden-unknown-additional: no + # Sent minimum amount of information to upstream servers to enhance # privacy. Only sent minimum required labels of the QNAME and set QTYPE # to A when possible. @@ -796,6 +830,8 @@ server: # o always_transparent, always_refuse, always_nxdomain, always_nodata, # always_deny resolve in that way but ignore local data for # that name + # o block_a resolves all records normally but returns + # NODATA for A queries and ignores local data for that name # o always_null returns 0.0.0.0 or ::0 for any name in the zone. # o noview breaks out of that view towards global local-zones. # @@ -1192,6 +1228,10 @@ remote-control: # redis-server-host: 127.0.0.1 # # redis server's TCP port # redis-server-port: 6379 +# # if the server uses a unix socket, set its path, or "" when not used. +# # redis-server-path: "/var/lib/redis/redis-server.sock" +# # if the server uses an AUTH password, specify here, or "" when not used. +# # redis-server-password: "" # # timeout (in ms) for communication with the redis server # redis-timeout: 100 # # set timeout on redis records based on DNS response TTL diff --git a/usr.sbin/unbound/doc/libunbound.3.in b/usr.sbin/unbound/doc/libunbound.3.in index 0a673baa8..315d02dca 100644 --- a/usr.sbin/unbound/doc/libunbound.3.in +++ b/usr.sbin/unbound/doc/libunbound.3.in @@ -1,4 +1,4 @@ -.TH "libunbound" "3" "Oct 13, 2022" "NLnet Labs" "unbound 1.17.0" +.TH "libunbound" "3" "Aug 30, 2023" "NLnet Labs" "unbound 1.18.0" .\" .\" libunbound.3 -- unbound library functions manual .\" @@ -44,7 +44,7 @@ .B ub_ctx_zone_remove, .B ub_ctx_data_add, .B ub_ctx_data_remove -\- Unbound DNS validating resolver 1.17.0 functions. +\- Unbound DNS validating resolver 1.18.0 functions. .SH "SYNOPSIS" .B #include .LP diff --git a/usr.sbin/unbound/doc/unbound-anchor.8.in b/usr.sbin/unbound/doc/unbound-anchor.8.in index dc61b72da..4e862fc89 100644 --- a/usr.sbin/unbound/doc/unbound-anchor.8.in +++ b/usr.sbin/unbound/doc/unbound-anchor.8.in @@ -1,4 +1,4 @@ -.TH "unbound-anchor" "8" "Oct 13, 2022" "NLnet Labs" "unbound 1.17.0" +.TH "unbound-anchor" "8" "Aug 30, 2023" "NLnet Labs" "unbound 1.18.0" .\" .\" unbound-anchor.8 -- unbound anchor maintenance utility manual .\" diff --git a/usr.sbin/unbound/doc/unbound-checkconf.8.in b/usr.sbin/unbound/doc/unbound-checkconf.8.in index ba6c334c7..6a2c2cc94 100644 --- a/usr.sbin/unbound/doc/unbound-checkconf.8.in +++ b/usr.sbin/unbound/doc/unbound-checkconf.8.in @@ -1,4 +1,4 @@ -.TH "unbound-checkconf" "8" "Oct 13, 2022" "NLnet Labs" "unbound 1.17.0" +.TH "unbound-checkconf" "8" "Aug 30, 2023" "NLnet Labs" "unbound 1.18.0" .\" .\" unbound-checkconf.8 -- unbound configuration checker manual .\" diff --git a/usr.sbin/unbound/doc/unbound-control.8.in b/usr.sbin/unbound/doc/unbound-control.8.in index 3841b9737..db4eb7230 100644 --- a/usr.sbin/unbound/doc/unbound-control.8.in +++ b/usr.sbin/unbound/doc/unbound-control.8.in @@ -1,4 +1,4 @@ -.TH "unbound-control" "8" "Oct 13, 2022" "NLnet Labs" "unbound 1.17.0" +.TH "unbound-control" "8" "Aug 30, 2023" "NLnet Labs" "unbound 1.18.0" .\" .\" unbound-control.8 -- unbound remote control manual .\" @@ -54,6 +54,12 @@ Stop the server. The server daemon exits. .B reload Reload the server. This flushes the cache and reads the config file fresh. .TP +.B reload_keep_cache +Reload the server but try to keep the RRset and message cache if +(re)configuration allows for it. +That means the caches sizes and the number of threads must not change between +reloads. +.TP .B verbosity \fInumber Change verbosity value for logging. Same values as \fBverbosity\fR keyword in \fIunbound.conf\fR(5). This new setting lasts until the server is issued @@ -130,7 +136,7 @@ name specified. .TP .B flush \fIname Remove the name from the cache. Removes the types -A, AAAA, NS, SOA, CNAME, DNAME, MX, PTR, SRV and NAPTR. +A, AAAA, NS, SOA, CNAME, DNAME, MX, PTR, SRV, NAPTR, SVCB and HTTPS. Because that is fast to do. Other record types can be removed using .B flush_type or @@ -363,6 +369,15 @@ number of queries received by thread .I threadX.num.queries_ip_ratelimited number of queries rate limited by thread .TP +.I threadX.num.queries_cookie_valid +number of queries with a valid DNS Cookie by thread +.TP +.I threadX.num.queries_cookie_client +number of queries with a client part only DNS Cookie by thread +.TP +.I threadX.num.queries_cookie_invalid +number of queries with an invalid DNS Cookie by thread +.TP .I threadX.num.cachehits number of queries that were successfully answered using a cache lookup .TP @@ -392,6 +407,14 @@ as a cache response was sent. .I threadX.num.expired number of replies that served an expired cache entry. .TP +.I threadX.num.queries_timed_out +number of queries that are dropped because they waited in the UDP socket buffer +for too long. +.TP +.I threadX.query.queue_time_us.max +The maximum wait time for packets in the socket buffer, in microseconds. This +is only reported when sock-queue-timeout is enabled. +.TP .I threadX.num.recursivereplies The number of replies sent to queries that needed recursive processing. Could be smaller than threadX.num.cachemiss if due to timeouts no replies were sent for some queries. .TP @@ -432,6 +455,18 @@ buffers are full. .I total.num.queries summed over threads. .TP +.I total.num.queries_ip_ratelimited +summed over threads. +.TP +.I total.num.queries_cookie_valid +summed over threads. +.TP +.I total.num.queries_cookie_client +summed over threads. +.TP +.I total.num.queries_cookie_invalid +summed over threads. +.TP .I total.num.cachehits summed over threads. .TP @@ -456,6 +491,12 @@ summed over threads. .I total.num.expired summed over threads. .TP +.I total.num.queries_timed_out +summed over threads. +.TP +.I total.query.queue_time_us.max +the maximum of the thread values. +.TP .I total.num.recursivereplies summed over threads. .TP @@ -591,7 +632,7 @@ ratelimiting. .TP .I num.query.dnscrypt.shared_secret.cachemiss The number of dnscrypt queries that did not find a shared secret in the cache. -The can be use to compute the shared secret hitrate. +This can be used to compute the shared secret hitrate. .TP .I num.query.dnscrypt.replay The number of dnscrypt queries that found a nonce hit in the nonce cache and @@ -647,6 +688,18 @@ timing and protocol support information. The number of items in the key cache. These are DNSSEC keys, one item per delegation point, and their validation status. .TP +.I msg.cache.max_collisions +The maximum number of hash table collisions in the msg cache. This is the +number of hashes that are identical when a new element is inserted in the +hash table. If the value is very large, like hundreds, something is wrong +with the performance of the hash table, hash values are incorrect or malicious. +.TP +.I rrset.cache.max_collisions +The maximum number of hash table collisions in the rrset cache. This is the +number of hashes that are identical when a new element is inserted in the +hash table. If the value is very large, like hundreds, something is wrong +with the performance of the hash table, hash values are incorrect or malicious. +.TP .I dnscrypt_shared_secret.cache.count The number of items in the shared secret cache. These are precomputed shared secrets for a given client public key/server secret key pair. Shared secrets @@ -686,7 +739,12 @@ Number of queries that got an answer that contained EDNS client subnet data. .I num.query.subnet_cache Number of queries answered from the edns client subnet cache. These are counted as cachemiss by the main counters, but hit the client subnet -specific cache, after getting processed by the edns client subnet module. +specific cache after getting processed by the edns client subnet module. +.TP +.I num.query.cachedb +Number of queries answered from the external cache of cachedb. +These are counted as cachemiss by the main counters, but hit the cachedb +external cache after getting processed by the cachedb module. .TP .I num.rpz.action. Number of queries answered using configured RPZ policy, per RPZ action type. diff --git a/usr.sbin/unbound/doc/unbound-host.1.in b/usr.sbin/unbound/doc/unbound-host.1.in index 8371084c5..e4fe718ab 100644 --- a/usr.sbin/unbound/doc/unbound-host.1.in +++ b/usr.sbin/unbound/doc/unbound-host.1.in @@ -1,4 +1,4 @@ -.TH "unbound\-host" "1" "Oct 13, 2022" "NLnet Labs" "unbound 1.17.0" +.TH "unbound\-host" "1" "Aug 30, 2023" "NLnet Labs" "unbound 1.18.0" .\" .\" unbound-host.1 -- unbound DNS lookup utility .\" diff --git a/usr.sbin/unbound/doc/unbound.8.in b/usr.sbin/unbound/doc/unbound.8.in index ac61b0f7a..7b955a92e 100644 --- a/usr.sbin/unbound/doc/unbound.8.in +++ b/usr.sbin/unbound/doc/unbound.8.in @@ -1,4 +1,4 @@ -.TH "unbound" "8" "Oct 13, 2022" "NLnet Labs" "unbound 1.17.0" +.TH "unbound" "8" "Aug 30, 2023" "NLnet Labs" "unbound 1.18.0" .\" .\" unbound.8 -- unbound manual .\" @@ -9,7 +9,7 @@ .\" .SH "NAME" .B unbound -\- Unbound DNS validating resolver 1.17.0. +\- Unbound DNS validating resolver 1.18.0. .SH "SYNOPSIS" .B unbound .RB [ \-h ] diff --git a/usr.sbin/unbound/doc/unbound.conf.5.in b/usr.sbin/unbound/doc/unbound.conf.5.in index 02d3343fe..07ee83906 100644 --- a/usr.sbin/unbound/doc/unbound.conf.5.in +++ b/usr.sbin/unbound/doc/unbound.conf.5.in @@ -1,4 +1,4 @@ -.TH "unbound.conf" "5" "Oct 13, 2022" "NLnet Labs" "unbound 1.17.0" +.TH "unbound.conf" "5" "Aug 30, 2023" "NLnet Labs" "unbound 1.18.0" .\" .\" unbound.conf.5 -- unbound.conf manual .\" @@ -76,6 +76,14 @@ If enabled, extended statistics are printed from \fIunbound\-control\fR(8). Default is off, because keeping track of more statistics takes time. The counters are listed in \fIunbound\-control\fR(8). .TP +.B statistics\-inhibit\-zero: \fI +If enabled, selected extended statistics with a value of 0 are inhibited from +printing with \fIunbound\-control\fR(8). +These are query types, query classes, query opcodes, answer rcodes +(except NOERROR, FORMERR, SERVFAIL, NXDOMAIN, NOTIMPL, REFUSED) and +RPZ actions. +Default is on. +.TP .B num\-threads: \fI The number of threads to create to serve clients. Use 1 for no threading. .TP @@ -189,7 +197,8 @@ number). .B max\-udp\-size: \fI Maximum UDP response size (not applied to TCP response). 65536 disables the udp response size maximum, and uses the choice from the client, always. -Suggested values are 512 to 4096. Default is 4096. +Suggested values are 512 to 4096. Default is 1232. The default value is the +same as the default for edns\-buffer\-size. .TP .B stream\-wait\-size: \fI Number of bytes size maximum to use for waiting stream buffers. Default is @@ -313,7 +322,7 @@ ip\-transparent option is also available. The value of the Differentiated Services Codepoint (DSCP) in the differentiated services field (DS) of the outgoing IP packet headers. The field replaces the outdated IPv4 Type-Of-Service field and the -IPV6 traffic class field. +IPv6 traffic class field. .TP .B rrset\-cache\-size: \fI Number of bytes size of the RRset cache. Default is 4 megabytes. @@ -380,7 +389,7 @@ Enable or disable whether ip4 queries are answered or issued. Default is yes. Enable or disable whether ip6 queries are answered or issued. Default is yes. If disabled, queries are not answered on IPv6, and queries are not sent on IPv6 to the internet nameservers. With this option you can disable the -ipv6 transport for sending DNS traffic, it does not impact the contents of +IPv6 transport for sending DNS traffic, it does not impact the contents of the DNS traffic, which may have ip4 and ip6 addresses in it. .TP .B prefer\-ip4: \fI @@ -460,6 +469,14 @@ configured, and finally to 0 if the number of free buffers falls below A minimum actual timeout of 200 milliseconds is observed regardless of the advertised timeout. .TP +.B sock\-queue\-timeout: \fI\fR +UDP queries that have waited in the socket buffer for a long time can be +dropped. Default is 0, disabled. The time is set in seconds, 3 could be a +good value to ignore old queries that likely the client does not need a reply +for any more. This could happen if the host has not been able to service +the queries for a while, i.e. Unbound is not running, and then is enabled +again. It uses timestamp socket options. +.TP .B tcp\-upstream: \fI Enable or disable whether the upstream queries use TCP only for transport. Default is no. Useful in tunneling scenarios. If set to no you can specify @@ -648,17 +665,17 @@ This option is experimental at this time. .B access\-control: \fI The netblock is given as an IP4 or IP6 address with /size appended for a classless network block. The action can be \fIdeny\fR, \fIrefuse\fR, -\fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIdeny_non_local\fR or -\fIrefuse_non_local\fR. +\fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIallow_cookie\fR, +\fIdeny_non_local\fR or \fIrefuse_non_local\fR. The most specific netblock match is used, if none match \fIrefuse\fR is used. The order of the access\-control statements therefore does not matter. .IP -The action \fIdeny\fR stops queries from hosts from that netblock. +The \fIdeny\fR action stops queries from hosts from that netblock. .IP -The action \fIrefuse\fR stops queries too, but sends a DNS rcode REFUSED +The \fIrefuse\fR action stops queries too, but sends a DNS rcode REFUSED error message back. .IP -The action \fIallow\fR gives access to clients from that netblock. +The \fIallow\fR action gives access to clients from that netblock. It gives only access for recursion clients (which is what almost all clients need). Nonrecursive queries are refused. .IP @@ -678,13 +695,27 @@ may be useful if another DNS server must forward requests for specific zones to a resolver DNS server, but only supports stub domains and sends queries to the resolver DNS server with the RD bit cleared. .IP -The action \fIallow_snoop\fR gives nonrecursive access too. This give +The \fIallow_snoop\fR action gives nonrecursive access too. This give both recursive and non recursive access. The name \fIallow_snoop\fR refers to cache snooping, a technique to use nonrecursive queries to examine the cache contents (for malicious acts). However, nonrecursive queries can also be a valuable debugging tool (when you want to examine the cache contents). In that case use \fIallow_snoop\fR for your administration host. .IP +The \fIallow_cookie\fR action allows access to UDP queries that contain a +valid DNS Cookie as specified in RFC 7873 and RFC 9018, when the +\fBanswer\-cookie\fR option is enabled. +UDP queries containing only a DNS Client Cookie and no Server Cookie, or an +invalid DNS Cookie, will receive a BADCOOKIE response including a newly +generated DNS Cookie, allowing clients to retry with that DNS Cookie. +The \fIallow_cookie\fR action will also accept requests over stateful +transports, regardless of the presence of an DNS Cookie and regardless of the +\fBanswer\-cookie\fR setting. +If \fBip\-ratelimit\fR is used, clients with a valid DNS Cookie will bypass the +ratelimit. +If a ratelimit for such clients is still needed, \fBip\-ratelimit\-cookie\fR +can be used instead. +.IP By default only localhost is \fIallow\fRed, the rest is \fIrefuse\fRd. The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS protocol is not designed to handle dropped packets due to policy, and @@ -966,6 +997,12 @@ validate the zone. Default is no. Zone signers must produce zones that allow this feature to work, but sometimes they do not, and turning this option off avoids that validation failure. .TP +.B harden\-unknown\-additional: \fI +Harden against unknown records in the authority section and additional +section. Default is no. If no, such records are copied from the upstream +and presented to the client together with the answer. If yes, it could +hamper future protocol developments that want to add records. +.TP .B use\-caps\-for\-id: \fI Use 0x20\-encoded random bits in the query to foil spoof attempts. This perturbs the lowercase and uppercase of query names sent to @@ -1338,10 +1375,10 @@ address space are not validated. This is usually required whenever Configure a local zone. The type determines the answer to give if there is no match from local\-data. The types are deny, refuse, static, transparent, redirect, nodefault, typetransparent, inform, inform_deny, -inform_redirect, always_transparent, always_refuse, always_nxdomain, always_null, noview, -and are explained below. After that the default settings are listed. Use -local\-data: to enter data into the local zone. Answers for local zones -are authoritative DNS answers. By default the zones are class IN. +inform_redirect, always_transparent, block_a, always_refuse, always_nxdomain, +always_null, noview, and are explained below. After that the default settings +are listed. Use local\-data: to enter data into the local zone. Answers for +local zones are authoritative DNS answers. By default the zones are class IN. .IP If you need more complicated authoritative data, with referrals, wildcards, CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for @@ -1416,6 +1453,12 @@ Ie. answer queries with fixed data and also log the machines that ask. \h'5'\fIalways_transparent\fR Like transparent, but ignores local data and resolves normally. .TP 10 +\h'5'\fIblock_a\fR +Like transparent, but ignores local data and resolves normally all query +types excluding A. For A queries it unconditionally returns NODATA. +Useful in cases when there is a need to explicitly force all apps to use +IPv6 protocol and avoid any queries to IPv4. +.TP 10 \h'5'\fIalways_refuse\fR Like refuse, but ignores local data and refuses the query. .TP 10 @@ -1626,7 +1669,7 @@ This specifies the action data for \fIresponse-ip\fR with action being to redirect as specified by "\fIresource record string\fR". "Resource record string" is similar to that of \fIaccess-control-tag-action\fR, but it must be of either AAAA, A or CNAME types. -If the IP-netblock is an IPv6/IPV4 prefix, the record +If the IP-netblock is an IPv6/IPv4 prefix, the record must be AAAA/A respectively, unless it is a CNAME (which can be used for both versions of IP netblocks). If it is CNAME there must not be more than one \fIresponse-ip-data\fR for the same IP-netblock. @@ -1732,11 +1775,27 @@ A value of 0 will disable ratelimiting for domain names that end in this name. .TP 5 .B ip\-ratelimit: \fI Enable global ratelimiting of queries accepted per IP address. -If 0, the default, it is disabled. This option is experimental at this time. +This option is experimental at this time. The ratelimit is in queries per second that are allowed. More queries are completely dropped and will not receive a reply, SERVFAIL or otherwise. IP ratelimiting happens before looking in the cache. This may be useful for mitigating amplification attacks. +Default is 0 (disabled). +.TP 5 +.B ip\-ratelimit\-cookie: \fI +Enable global ratelimiting of queries accepted per IP address with a valid DNS +Cookie. +This option is experimental at this time. +The ratelimit is in queries per second that are allowed. +More queries are completely dropped and will not receive a reply, SERVFAIL or +otherwise. +IP ratelimiting happens before looking in the cache. +This option could be useful in combination with \fIallow_cookie\fR in an +attempt to mitigate other amplification attacks than UDP reflections (e.g., +attacks targeting Unbound itself) which are already handled with DNS Cookies. +If used, the value is suggested to be higher than \fBip\-ratelimit\fR e.g., +tenfold. +Default is 0 (disabled). .TP 5 .B ip\-ratelimit\-size: \fI Give the size of the data structure in which the current ongoing rates are @@ -1775,6 +1834,21 @@ If a forward/stub zone is used, this is the number of retries per nameserver in the zone. Default is 5. .TP 5 +.B max\-sent\-count: \fI +Hard limit on the number of outgoing queries Unbound will make while resolving +a name, making sure large NS sets do not loop. +Results in SERVFAIL when reached. +It resets on query restarts (e.g., CNAME) and referrals. +Default is 32. +.TP 5 +.B max\-query\-restarts: \fI +Hard limit on the number of times Unbound is allowed to restart a query upon +encountering a CNAME record. +Results in SERVFAIL when reached. +Changing this value needs caution as it can allow long CNAME chains to be +accepted, where Unbound needs to verify (resolve) each link individually. +Default is 11. +.TP 5 .B fast\-server\-permil: \fI Specify how many times out of 1000 to pick from the set of fastest servers. 0 turns the feature off. A value of 900 would pick from the fastest @@ -1790,6 +1864,18 @@ Set the number of servers that should be used for fast server selection. Only use the fastest specified number of servers with the fast\-server\-permil option, that turns this on or off. The default is to use the fastest 3 servers. .TP 5 +.B answer\-cookie: \fI +If enabled, Unbound will answer to requests containing DNS Cookies as +specified in RFC 7873 and RFC 9018. +Default is no. +.TP 5 +.B cookie\-secret: \fI<128 bit hex string> +Server's secret for DNS Cookie generation. +Useful to explicitly set for servers in an anycast deployment that need to +share the secret in order to verify each other's Server Cookies. +An example hex string would be "000102030405060708090a0b0c0d0e0f". +Default is a 128 bits random secret generated at startup time. +.TP 5 .B edns\-client\-string: \fI Include an EDNS0 option containing configured ascii string in queries with destination address matching the configured IP netblock. This configuration @@ -1808,7 +1894,7 @@ errors. Default is "no". When the \fBval-log-level\fR option is also set to \fB2\fR, responses with Extended DNS Errors concerning DNSSEC failures that are not served from cache, will also contain a descriptive text message about the reason for the failure. -.TP +.TP 5 .B ede\-serve\-expired: \fI If enabled, Unbound will attach an Extended DNS Error (RFC8914) Code 3 - Stale Answer as EDNS0 option to the expired response. Note that this will not attach @@ -2023,13 +2109,32 @@ useful when you want immediate changes to be visible. Authority zones are configured with \fBauth\-zone:\fR, and each one must have a \fBname:\fR. There can be multiple ones, by listing multiple auth\-zone clauses, each with a different name, pertaining to that part of the namespace. The authority zone with the name closest to the name looked up is used. -Authority zones are processed after \fBlocal\-zones\fR and before -cache (\fBfor\-downstream:\fR \fIyes\fR), and when used in this manner -make Unbound respond like an authority server. Authority zones are also -processed after cache, just before going to the network to fetch -information for recursion (\fBfor\-upstream:\fR \fIyes\fR), and when used -in this manner provide a local copy of an authority server that speeds up -lookups of that data. +Authority zones can be processed on two distinct, non-exclusive, configurable +stages. +.LP +With \fBfor\-downstream:\fR \fIyes\fR (default), authority zones are processed +after \fBlocal\-zones\fR and before cache. +When used in this manner, Unbound responds like an authority server with no +further processing other than returning an answer from the zone contents. +A notable example, in this case, is CNAME records which are returned verbatim +to downstream clients without further resolution. +.LP +With \fBfor\-upstream:\fR \fIyes\fR (default), authority zones are processed +after the cache lookup, just before going to the network to fetch +information for recursion. +When used in this manner they provide a local copy of an authority server +that speeds up lookups for that data during resolving. +.LP +If both options are enabled (default), client queries for an authority zone are +answered authoritatively from Unbound, while internal queries that require data +from the authority zone consult the local zone data instead of going to the +network. +.LP +An interesting configuration is \fBfor\-downstream:\fR \fIno\fR, +\fBfor\-upstream:\fR \fIyes\fR that allows for hyperlocal behavior where both +client and internal queries consult the local zone data while resolving. +In this case, the aforementioned CNAME example will result in a thoroughly +resolved answer. .LP Authority zones can be read from zonefile. And can be kept updated via AXFR and IXFR. After update the zonefile is rewritten. The update mechanism @@ -2223,6 +2328,21 @@ List domain for which the AAAA records are ignored and the A record is used by dns64 processing instead. Can be entered multiple times, list a new domain for which it applies, one per line. Applies also to names underneath the name given. +.SS "NAT64 Operation" +.LP +NAT64 operation allows using a NAT64 prefix for outbound requests to IPv4-only +servers. It is controlled by two options in the \fBserver:\fR section: +.TP +.B do\-nat64: \fI\fR +Use NAT64 to reach IPv4-only servers. +Consider also enabling \fBprefer\-ip6\fR to prefer native IPv6 connections to +nameservers. +Default no. +.TP +.B nat64\-prefix: \fI\fR +Use a specific NAT64 prefix to reach IPv4-only servers. Defaults to using +the prefix configured in \fBdns64\-prefix\fR, which in turn defaults to +64:ff9b::/96. The prefix length must be one of /32, /40, /48, /56, /64 or /96. .SS "DNSCrypt Options" .LP The @@ -2313,6 +2433,9 @@ The maximum size of the ECS cache is controlled by 'msg-cache-size' in the configuration file. On top of that, for each query only 100 different subnets are allowed to be stored for each address family. Exceeding that number, older entries will be purged from cache. +.LP +This module does not interact with the \fBserve\-expired*\fR and +\fBprefetch:\fR options. .TP .B send\-client\-subnet: \fI\fR Send client source address to this authority. Append /num to indicate a @@ -2515,6 +2638,16 @@ This option defaults to "127.0.0.1". The TCP port number of the Redis server. This option defaults to 6379. .TP +.B redis-server-path: \fI\fR +The unix socket path to connect to the redis server. Off by default, and it +can be set to "" to turn this off. Unix sockets may have better throughput +than the IP address option. +.TP +.B redis-server-password: \fI""\fR +The Redis AUTH password to use for the redis server. +Only relevant if Redis is configured for client password authorisation. +Off by default, and it can be set to "" to turn this off. +.TP .B redis-timeout: \fI\fR The period until when Unbound waits for a response from the Redis sever. If this timeout expires Unbound closes the connection, treats it as diff --git a/usr.sbin/unbound/edns-subnet/subnetmod.c b/usr.sbin/unbound/edns-subnet/subnetmod.c index f2c213768..ec0ff78b7 100644 --- a/usr.sbin/unbound/edns-subnet/subnetmod.c +++ b/usr.sbin/unbound/edns-subnet/subnetmod.c @@ -204,6 +204,17 @@ subnetmod_init(struct module_env *env, int id) } alloc_init(&sn_env->alloc, NULL, 0); env->modinfo[id] = (void*)sn_env; + + /* Warn that serve-expired and prefetch do not work with the subnet + * module cache. */ + if(env->cfg->serve_expired) + log_warn( + "subnetcache: serve-expired is set but not working " + "for data originating from the subnet module cache."); + if(env->cfg->prefetch) + log_warn( + "subnetcache: prefetch is set but not working " + "for data originating from the subnet module cache."); /* Copy msg_cache settings */ sn_env->subnet_msg_cache = slabhash_create(env->cfg->msg_cache_slabs, HASH_DEFAULT_STARTARRAY, env->cfg->msg_cache_size, @@ -341,7 +352,7 @@ update_cache(struct module_qstate *qstate, int id) ((struct subnet_qstate*)qstate->minfo[id])->qinfo_hash : query_info_hash(&qstate->qinfo, qstate->query_flags); /* Step 1, general qinfo lookup */ - struct lruhash_entry *lru_entry = slabhash_lookup(subnet_msg_cache, h, + struct lruhash_entry* lru_entry = slabhash_lookup(subnet_msg_cache, h, &qstate->qinfo, 1); int need_to_insert = (lru_entry == NULL); if (!lru_entry) { @@ -410,7 +421,7 @@ update_cache(struct module_qstate *qstate, int id) /** Lookup in cache and reply true iff reply is sent. */ static int -lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq) +lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq, int prefetch) { struct lruhash_entry *e; struct module_env *env = qstate->env; @@ -462,6 +473,10 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq) INET6_SIZE); sq->ecs_client_out.subnet_validdata = 1; } + + if (prefetch && *qstate->env->now >= ((struct reply_info *)node->elem)->prefetch_ttl) { + qstate->need_refetch = 1; + } return 1; } @@ -768,6 +783,11 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event, &qstate->mesh_info->reply_list->query_reply.client_addr, &sq->ecs_client_in, qstate->env->cfg); } + else if(qstate->client_addr.ss_family != AF_UNSPEC) { + subnet_option_from_ss( + &qstate->client_addr, + &sq->ecs_client_in, qstate->env->cfg); + } if(sq->ecs_client_in.subnet_validdata == 0) { /* No clients are interested in result or we could not @@ -791,7 +811,9 @@ subnetmod_operate(struct module_qstate *qstate, enum module_ev event, if(!sq->started_no_cache_lookup && !qstate->blacklist) { lock_rw_wrlock(&sne->biglock); - if(lookup_and_reply(qstate, id, sq)) { + if(qstate->mesh_info->reply_list && + lookup_and_reply(qstate, id, sq, + qstate->env->cfg->prefetch)) { sne->num_msg_cache++; lock_rw_unlock(&sne->biglock); verbose(VERB_QUERY, "subnetcache: answered from cache"); diff --git a/usr.sbin/unbound/iterator/iter_delegpt.c b/usr.sbin/unbound/iterator/iter_delegpt.c index 770c14d73..61a7bccdc 100644 --- a/usr.sbin/unbound/iterator/iter_delegpt.c +++ b/usr.sbin/unbound/iterator/iter_delegpt.c @@ -321,6 +321,45 @@ void delegpt_log(enum verbosity_value v, struct delegpt* dp) } } +int +delegpt_addr_on_result_list(struct delegpt* dp, struct delegpt_addr* find) +{ + struct delegpt_addr* a = dp->result_list; + while(a) { + if(a == find) + return 1; + a = a->next_result; + } + return 0; +} + +void +delegpt_usable_list_remove_addr(struct delegpt* dp, struct delegpt_addr* del) +{ + struct delegpt_addr* usa = dp->usable_list, *prev = NULL; + while(usa) { + if(usa == del) { + /* snip off the usable list */ + if(prev) + prev->next_usable = usa->next_usable; + else dp->usable_list = usa->next_usable; + return; + } + prev = usa; + usa = usa->next_usable; + } +} + +void +delegpt_add_to_result_list(struct delegpt* dp, struct delegpt_addr* a) +{ + if(delegpt_addr_on_result_list(dp, a)) + return; + delegpt_usable_list_remove_addr(dp, a); + a->next_result = dp->result_list; + dp->result_list = a; +} + void delegpt_add_unused_targets(struct delegpt* dp) { diff --git a/usr.sbin/unbound/iterator/iter_delegpt.h b/usr.sbin/unbound/iterator/iter_delegpt.h index ae13ee1ea..f49aac28a 100644 --- a/usr.sbin/unbound/iterator/iter_delegpt.h +++ b/usr.sbin/unbound/iterator/iter_delegpt.h @@ -457,4 +457,29 @@ int delegpt_add_target_mlc(struct delegpt* dp, uint8_t* name, size_t namelen, /** get memory in use by dp */ size_t delegpt_get_mem(struct delegpt* dp); +/** + * See if the addr is on the result list. + * @param dp: delegation point. + * @param find: the pointer is searched for on the result list. + * @return 1 if found, 0 if not found. + */ +int delegpt_addr_on_result_list(struct delegpt* dp, struct delegpt_addr* find); + +/** + * Remove the addr from the usable list. + * @param dp: the delegation point. + * @param del: the addr to remove from the list, the pointer is searched for. + */ +void delegpt_usable_list_remove_addr(struct delegpt* dp, + struct delegpt_addr* del); + +/** + * Add the delegpt_addr back to the result list, if it is not already on + * the result list. Also removes it from the usable list. + * @param dp: delegation point. + * @param a: addr to add, nothing happens if it is already on the result list. + * It is removed from the usable list. + */ +void delegpt_add_to_result_list(struct delegpt* dp, struct delegpt_addr* a); + #endif /* ITERATOR_ITER_DELEGPT_H */ diff --git a/usr.sbin/unbound/iterator/iter_resptype.c b/usr.sbin/unbound/iterator/iter_resptype.c index 641ebb5fe..e284987e0 100644 --- a/usr.sbin/unbound/iterator/iter_resptype.c +++ b/usr.sbin/unbound/iterator/iter_resptype.c @@ -284,6 +284,13 @@ response_type_from_server(int rdset, /* If we've gotten this far, this is NOERROR/NODATA (which could * be an entirely empty message) */ + /* but ignore entirely empty messages, noerror/nodata has a soa + * negative ttl value in the authority section, this makes it try + * again at another authority. And turns it from a 5 second empty + * message into a 5 second servfail response. */ + if(msg->rep->an_numrrsets == 0 && msg->rep->ns_numrrsets == 0 && + msg->rep->ar_numrrsets == 0) + return RESPONSE_TYPE_THROWAWAY; /* check if recursive answer; saying it has empty cache */ if( (msg->rep->flags&BIT_RA) && !(msg->rep->flags&BIT_AA) && !rdset) return RESPONSE_TYPE_REC_LAME; diff --git a/usr.sbin/unbound/iterator/iter_scrub.c b/usr.sbin/unbound/iterator/iter_scrub.c index 53bcd761a..8d8aa8a4f 100644 --- a/usr.sbin/unbound/iterator/iter_scrub.c +++ b/usr.sbin/unbound/iterator/iter_scrub.c @@ -346,6 +346,26 @@ soa_in_auth(struct msg_parse* msg) return 0; } +/** Check if type is allowed in the authority section */ +static int +type_allowed_in_authority_section(uint16_t tp) +{ + if(tp == LDNS_RR_TYPE_SOA || tp == LDNS_RR_TYPE_NS || + tp == LDNS_RR_TYPE_DS || tp == LDNS_RR_TYPE_NSEC || + tp == LDNS_RR_TYPE_NSEC3) + return 1; + return 0; +} + +/** Check if type is allowed in the additional section */ +static int +type_allowed_in_additional_section(uint16_t tp) +{ + if(tp == LDNS_RR_TYPE_A || tp == LDNS_RR_TYPE_AAAA) + return 1; + return 0; +} + /** * This routine normalizes a response. This includes removing "irrelevant" * records from the answer and additional sections and (re)synthesizing @@ -355,11 +375,13 @@ soa_in_auth(struct msg_parse* msg) * @param msg: msg to normalize. * @param qinfo: original query. * @param region: where to allocate synthesized CNAMEs. + * @param env: module env with config options. * @return 0 on error. */ static int scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, - struct query_info* qinfo, struct regional* region) + struct query_info* qinfo, struct regional* region, + struct module_env* env) { uint8_t* sname = qinfo->qname; size_t snamelen = qinfo->qname_len; @@ -511,6 +533,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, /* Mark additional names from AUTHORITY */ while(rrset && rrset->section == LDNS_SECTION_AUTHORITY) { + /* protect internals of recursor by making sure to del these */ if(rrset->type==LDNS_RR_TYPE_DNAME || rrset->type==LDNS_RR_TYPE_CNAME || rrset->type==LDNS_RR_TYPE_A || @@ -519,6 +542,13 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, "RRset:", pkt, msg, prev, &rrset); continue; } + /* Allowed list of types in the authority section */ + if(env->cfg->harden_unknown_additional && + !type_allowed_in_authority_section(rrset->type)) { + remove_rrset("normalize: removing irrelevant " + "RRset:", pkt, msg, prev, &rrset); + continue; + } /* only one NS set allowed in authority section */ if(rrset->type==LDNS_RR_TYPE_NS) { /* NS set must be pertinent to the query */ @@ -576,7 +606,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, * found in ANSWER and AUTHORITY. */ /* These records have not been marked OK previously */ while(rrset && rrset->section == LDNS_SECTION_ADDITIONAL) { - /* FIXME: what about other types? */ if(rrset->type==LDNS_RR_TYPE_A || rrset->type==LDNS_RR_TYPE_AAAA) { @@ -589,6 +618,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, continue; } } + /* protect internals of recursor by making sure to del these */ if(rrset->type==LDNS_RR_TYPE_DNAME || rrset->type==LDNS_RR_TYPE_CNAME || rrset->type==LDNS_RR_TYPE_NS) { @@ -596,6 +626,13 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg, "RRset:", pkt, msg, prev, &rrset); continue; } + /* Allowed list of types in the additional section */ + if(env->cfg->harden_unknown_additional && + !type_allowed_in_additional_section(rrset->type)) { + remove_rrset("normalize: removing irrelevant " + "RRset:", pkt, msg, prev, &rrset); + continue; + } prev = rrset; rrset = rrset->rrset_all_next; } @@ -846,7 +883,7 @@ scrub_message(sldns_buffer* pkt, struct msg_parse* msg, } /* normalize the response, this cleans up the additional. */ - if(!scrub_normalize(pkt, msg, qinfo, region)) + if(!scrub_normalize(pkt, msg, qinfo, region, env)) return 0; /* delete all out-of-zone information */ if(!scrub_sanitize(pkt, msg, qinfo, zonename, env, ie)) diff --git a/usr.sbin/unbound/iterator/iter_utils.c b/usr.sbin/unbound/iterator/iter_utils.c index 56b184a02..10a8ec3eb 100644 --- a/usr.sbin/unbound/iterator/iter_utils.c +++ b/usr.sbin/unbound/iterator/iter_utils.c @@ -71,6 +71,11 @@ /** time when nameserver glue is said to be 'recent' */ #define SUSPICION_RECENT_EXPIRY 86400 +/** if NAT64 is enabled and no NAT64 prefix is configured, first fall back to + * DNS64 prefix. If that is not configured, fall back to this default value. + */ +static const char DEFAULT_NAT64_PREFIX[] = "64:ff9b::/96"; + /** fillup fetch policy array */ static void fetch_fill(struct iter_env* ie, const char* str) @@ -142,6 +147,7 @@ caps_white_apply_cfg(rbtree_type* ntree, struct config_file* cfg) int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg) { + const char *nat64_prefix; int i; /* target fetch policy */ if(!read_fetch_policy(iter_env, cfg->target_fetch_policy)) @@ -172,9 +178,35 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg) } } + + nat64_prefix = cfg->nat64_prefix; + if(!nat64_prefix) + nat64_prefix = cfg->dns64_prefix; + if(!nat64_prefix) + nat64_prefix = DEFAULT_NAT64_PREFIX; + if(!netblockstrtoaddr(nat64_prefix, 0, &iter_env->nat64_prefix_addr, + &iter_env->nat64_prefix_addrlen, + &iter_env->nat64_prefix_net)) { + log_err("cannot parse nat64-prefix netblock: %s", nat64_prefix); + return 0; + } + if(!addr_is_ip6(&iter_env->nat64_prefix_addr, + iter_env->nat64_prefix_addrlen)) { + log_err("nat64-prefix is not IPv6: %s", cfg->nat64_prefix); + return 0; + } + if(!prefixnet_is_nat64(iter_env->nat64_prefix_net)) { + log_err("nat64-prefix length it not 32, 40, 48, 56, 64 or 96: %s", + nat64_prefix); + return 0; + } + iter_env->supports_ipv6 = cfg->do_ip6; iter_env->supports_ipv4 = cfg->do_ip4; + iter_env->use_nat64 = cfg->do_nat64; iter_env->outbound_msg_retry = cfg->outbound_msg_retry; + iter_env->max_sent_count = cfg->max_sent_count; + iter_env->max_query_restarts = cfg->max_query_restarts; return 1; } @@ -238,7 +270,8 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env, if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) { return -1; /* there is no ip6 available */ } - if(!iter_env->supports_ipv4 && !addr_is_ip6(&a->addr, a->addrlen)) { + if(!iter_env->supports_ipv4 && !iter_env->use_nat64 && + !addr_is_ip6(&a->addr, a->addrlen)) { return -1; /* there is no ip4 available */ } /* check lameness - need zone , class info */ @@ -745,10 +778,15 @@ iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp) int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, - struct delegpt* dp, int supports_ipv4, int supports_ipv6) + struct delegpt* dp, int supports_ipv4, int supports_ipv6, + int use_nat64) { struct delegpt_ns* ns; struct delegpt_addr* a; + + if(supports_ipv6 && use_nat64) + supports_ipv4 = 1; + /* check: * o RD qflag is on. * o no addresses are provided. @@ -1308,8 +1346,7 @@ void iter_dec_attempts(struct delegpt* dp, int d, int outbound_msg_retry) for(a=dp->target_list; a; a = a->next_target) { if(a->attempts >= outbound_msg_retry) { /* add back to result list */ - a->next_result = dp->result_list; - dp->result_list = a; + delegpt_add_to_result_list(dp, a); } if(a->attempts > d) a->attempts -= d; diff --git a/usr.sbin/unbound/iterator/iter_utils.h b/usr.sbin/unbound/iterator/iter_utils.h index 49698bcdf..fa9066ba5 100644 --- a/usr.sbin/unbound/iterator/iter_utils.h +++ b/usr.sbin/unbound/iterator/iter_utils.h @@ -189,10 +189,13 @@ void iter_mark_pside_cycle_targets(struct module_qstate* qstate, * if not, then the IPv4 addresses are useless. * @param supports_ipv6: if we support ipv6 for lookups to the target. * if not, then the IPv6 addresses are useless. + * @param use_nat64: if we support NAT64 for lookups to the target. + * if yes, IPv4 addresses are useful even if we don't support IPv4. * @return true if dp is useless. */ int iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, - struct delegpt* dp, int supports_ipv4, int supports_ipv6); + struct delegpt* dp, int supports_ipv4, int supports_ipv6, + int use_nat64); /** * See if qname has DNSSEC needs. This is true if there is a trust anchor above diff --git a/usr.sbin/unbound/iterator/iterator.c b/usr.sbin/unbound/iterator/iterator.c index 09cd67c94..290273176 100644 --- a/usr.sbin/unbound/iterator/iterator.c +++ b/usr.sbin/unbound/iterator/iterator.c @@ -255,7 +255,7 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super) log_err("out of memory adding missing"); } delegpt_mark_neg(dpns, qstate->qinfo.qtype); - if((dpns->got4 == 2 || !ie->supports_ipv4) && + if((dpns->got4 == 2 || (!ie->supports_ipv4 && !ie->use_nat64)) && (dpns->got6 == 2 || !ie->supports_ipv6)) { dpns->resolved = 1; /* mark as failed */ target_count_increase_nx(super_iq, 1); @@ -302,81 +302,65 @@ error_response(struct module_qstate* qstate, int id, int rcode) static int error_response_cache(struct module_qstate* qstate, int id, int rcode) { - if(!qstate->no_cache_store) { - /* store in cache */ - struct reply_info err; - if(qstate->prefetch_leeway > NORR_TTL) { - verbose(VERB_ALGO, "error response for prefetch in cache"); - /* attempt to adjust the cache entry prefetch */ - if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo, - NORR_TTL, qstate->query_flags)) - return error_response(qstate, id, rcode); - /* if that fails (not in cache), fall through to store err */ - } - if(qstate->env->cfg->serve_expired) { - /* if serving expired contents, and such content is - * already available, don't overwrite this servfail */ - struct msgreply_entry* msg; - if((msg=msg_cache_lookup(qstate->env, - qstate->qinfo.qname, qstate->qinfo.qname_len, - qstate->qinfo.qtype, qstate->qinfo.qclass, - qstate->query_flags, 0, - qstate->env->cfg->serve_expired_ttl_reset)) - != NULL) { - if(qstate->env->cfg->serve_expired_ttl_reset) { - struct reply_info* rep = - (struct reply_info*)msg->entry.data; - if(rep && *qstate->env->now + - qstate->env->cfg->serve_expired_ttl > - rep->serve_expired_ttl) { - rep->serve_expired_ttl = - *qstate->env->now + - qstate->env->cfg->serve_expired_ttl; - } - } - lock_rw_unlock(&msg->entry.lock); - return error_response(qstate, id, rcode); - } - /* serving expired contents, but nothing is cached - * at all, so the servfail cache entry is useful - * (stops waste of time on this servfail NORR_TTL) */ - } else { - /* don't overwrite existing (non-expired) data in - * cache with a servfail */ - struct msgreply_entry* msg; - if((msg=msg_cache_lookup(qstate->env, - qstate->qinfo.qname, qstate->qinfo.qname_len, - qstate->qinfo.qtype, qstate->qinfo.qclass, - qstate->query_flags, *qstate->env->now, 0)) - != NULL) { - struct reply_info* rep = (struct reply_info*) - msg->entry.data; - if(FLAGS_GET_RCODE(rep->flags) == - LDNS_RCODE_NOERROR || - FLAGS_GET_RCODE(rep->flags) == - LDNS_RCODE_NXDOMAIN) { - /* we have a good entry, - * don't overwrite */ - lock_rw_unlock(&msg->entry.lock); - return error_response(qstate, id, rcode); - } - lock_rw_unlock(&msg->entry.lock); - } - - } - memset(&err, 0, sizeof(err)); - err.flags = (uint16_t)(BIT_QR | BIT_RA); - FLAGS_SET_RCODE(err.flags, rcode); - err.qdcount = 1; - err.ttl = NORR_TTL; - err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl); - err.serve_expired_ttl = NORR_TTL; - /* do not waste time trying to validate this servfail */ - err.security = sec_status_indeterminate; - verbose(VERB_ALGO, "store error response in message cache"); - iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL, - qstate->query_flags, qstate->qstarttime); + struct reply_info err; + struct msgreply_entry* msg; + if(qstate->no_cache_store) { + return error_response(qstate, id, rcode); } + if(qstate->prefetch_leeway > NORR_TTL) { + verbose(VERB_ALGO, "error response for prefetch in cache"); + /* attempt to adjust the cache entry prefetch */ + if(dns_cache_prefetch_adjust(qstate->env, &qstate->qinfo, + NORR_TTL, qstate->query_flags)) + return error_response(qstate, id, rcode); + /* if that fails (not in cache), fall through to store err */ + } + if((msg=msg_cache_lookup(qstate->env, + qstate->qinfo.qname, qstate->qinfo.qname_len, + qstate->qinfo.qtype, qstate->qinfo.qclass, + qstate->query_flags, 0, + qstate->env->cfg->serve_expired_ttl_reset)) != NULL) { + struct reply_info* rep = (struct reply_info*)msg->entry.data; + if(qstate->env->cfg->serve_expired && + qstate->env->cfg->serve_expired_ttl_reset && rep && + *qstate->env->now + qstate->env->cfg->serve_expired_ttl + > rep->serve_expired_ttl) { + verbose(VERB_ALGO, "reset serve-expired-ttl for " + "response in cache"); + rep->serve_expired_ttl = *qstate->env->now + + qstate->env->cfg->serve_expired_ttl; + } + if(rep && (FLAGS_GET_RCODE(rep->flags) == + LDNS_RCODE_NOERROR || + FLAGS_GET_RCODE(rep->flags) == + LDNS_RCODE_NXDOMAIN || + FLAGS_GET_RCODE(rep->flags) == + LDNS_RCODE_YXDOMAIN) && + (qstate->env->cfg->serve_expired || + *qstate->env->now <= rep->ttl)) { + /* we have a good entry, don't overwrite */ + lock_rw_unlock(&msg->entry.lock); + return error_response(qstate, id, rcode); + } + lock_rw_unlock(&msg->entry.lock); + /* nothing interesting is cached (already error response or + * expired good record when we don't serve expired), so this + * servfail cache entry is useful (stops waste of time on this + * servfail NORR_TTL) */ + } + /* store in cache */ + memset(&err, 0, sizeof(err)); + err.flags = (uint16_t)(BIT_QR | BIT_RA); + FLAGS_SET_RCODE(err.flags, rcode); + err.qdcount = 1; + err.ttl = NORR_TTL; + err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl); + err.serve_expired_ttl = NORR_TTL; + /* do not waste time trying to validate this servfail */ + err.security = sec_status_indeterminate; + verbose(VERB_ALGO, "store error response in message cache"); + iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0, 0, NULL, + qstate->query_flags, qstate->qstarttime); return error_response(qstate, id, rcode); } @@ -590,6 +574,54 @@ handle_cname_response(struct module_qstate* qstate, struct iter_qstate* iq, return 1; } +/** fill fail address for later recovery */ +static void +fill_fail_addr(struct iter_qstate* iq, struct sockaddr_storage* addr, + socklen_t addrlen) +{ + if(addrlen == 0) { + iq->fail_addr_type = 0; + return; + } + if(((struct sockaddr_in*)addr)->sin_family == AF_INET) { + iq->fail_addr_type = 4; + memcpy(&iq->fail_addr.in, + &((struct sockaddr_in*)addr)->sin_addr, + sizeof(iq->fail_addr.in)); + } +#ifdef AF_INET6 + else if(((struct sockaddr_in*)addr)->sin_family == AF_INET6) { + iq->fail_addr_type = 6; + memcpy(&iq->fail_addr.in6, + &((struct sockaddr_in6*)addr)->sin6_addr, + sizeof(iq->fail_addr.in6)); + } +#endif + else { + iq->fail_addr_type = 0; + } +} + +/** print fail addr to string */ +static void +print_fail_addr(struct iter_qstate* iq, char* buf, size_t len) +{ + if(iq->fail_addr_type == 4) { + if(inet_ntop(AF_INET, &iq->fail_addr.in, buf, + (socklen_t)len) == 0) + (void)strlcpy(buf, "(inet_ntop error)", len); + } +#ifdef AF_INET6 + else if(iq->fail_addr_type == 6) { + if(inet_ntop(AF_INET6, &iq->fail_addr.in6, buf, + (socklen_t)len) == 0) + (void)strlcpy(buf, "(inet_ntop error)", len); + } +#endif + else + (void)strlcpy(buf, "", len); +} + /** add response specific error information for log servfail */ static void errinf_reply(struct module_qstate* qstate, struct iter_qstate* iq) @@ -597,16 +629,14 @@ errinf_reply(struct module_qstate* qstate, struct iter_qstate* iq) if(qstate->env->cfg->val_log_level < 2 && !qstate->env->cfg->log_servfail) return; if((qstate->reply && qstate->reply->remote_addrlen != 0) || - (iq->fail_reply && iq->fail_reply->remote_addrlen != 0)) { + (iq->fail_addr_type != 0)) { char from[256], frm[512]; if(qstate->reply && qstate->reply->remote_addrlen != 0) addr_to_str(&qstate->reply->remote_addr, qstate->reply->remote_addrlen, from, sizeof(from)); else - addr_to_str(&iq->fail_reply->remote_addr, - iq->fail_reply->remote_addrlen, from, - sizeof(from)); + print_fail_addr(iq, from, sizeof(from)); snprintf(frm, sizeof(frm), "from %s", from); errinf(qstate, frm); } @@ -1137,7 +1167,7 @@ generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq, * Generate a NS check request to obtain authoritative information * on an NS rrset. * - * @param qstate: the qtstate that triggered the need to prime. + * @param qstate: the qstate that triggered the need to prime. * @param iq: iterator query state. * @param id: module id. */ @@ -1314,7 +1344,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq, /* We enforce a maximum number of query restarts. This is primarily a * cheap way to prevent CNAME loops. */ - if(iq->query_restart_count > MAX_RESTART_COUNT) { + if(iq->query_restart_count > ie->max_query_restarts) { verbose(VERB_QUERY, "request has exceeded the maximum number" " of query restarts with %d", iq->query_restart_count); errinf(qstate, "request has exceeded the maximum number " @@ -1451,6 +1481,19 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq, errinf(qstate, "malloc failure for forward zone"); return error_response(qstate, id, LDNS_RCODE_SERVFAIL); } + if((qstate->query_flags&BIT_RD)==0) { + /* If the server accepts RD=0 queries and forwards + * with RD=1, then if the server is listed as an NS + * entry, it starts query loops. Stop that loop by + * disallowing the query. The RD=0 was previously used + * to check the cache with allow_snoop. For stubs, + * the iterator pass would have primed the stub and + * then cached information can be used for further + * queries. */ + verbose(VERB_ALGO, "cannot forward RD=0 query, to stop query loops"); + errinf(qstate, "cannot forward RD=0 query"); + return error_response(qstate, id, LDNS_RCODE_SERVFAIL); + } iq->refetch_glue = 0; iq->minimisation_state = DONOT_MINIMISE_STATE; /* the request has been forwarded. @@ -1571,7 +1614,8 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq, * same server reply) if useless-checked. */ if(iter_dp_is_useless(&qstate->qinfo, qstate->query_flags, - iq->dp, ie->supports_ipv4, ie->supports_ipv6)) { + iq->dp, ie->supports_ipv4, ie->supports_ipv6, + ie->use_nat64)) { struct delegpt* retdp = NULL; if(!can_have_last_resort(qstate->env, iq->dp->name, iq->dp->namelen, iq->qchase.qclass, &retdp)) { if(retdp) { @@ -1932,7 +1976,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq, break; } /* Send the A request. */ - if(ie->supports_ipv4 && + if((ie->supports_ipv4 || ie->use_nat64) && ((ns->lame && !ns->done_pside4) || (!ns->lame && !ns->got4))) { if(!generate_target_query(qstate, iq, id, @@ -2085,14 +2129,14 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq, /* if this nameserver is at a delegation point, but that * delegation point is a stub and we cannot go higher, skip*/ if( ((ie->supports_ipv6 && !ns->done_pside6) || - (ie->supports_ipv4 && !ns->done_pside4)) && + ((ie->supports_ipv4 || ie->use_nat64) && !ns->done_pside4)) && !can_have_last_resort(qstate->env, ns->name, ns->namelen, iq->qchase.qclass, NULL)) { log_nametypeclass(VERB_ALGO, "cannot pside lookup ns " "because it is also a stub/forward,", ns->name, LDNS_RR_TYPE_NS, iq->qchase.qclass); if(ie->supports_ipv6) ns->done_pside6 = 1; - if(ie->supports_ipv4) ns->done_pside4 = 1; + if(ie->supports_ipv4 || ie->use_nat64) ns->done_pside4 = 1; continue; } /* query for parent-side A and AAAA for nameservers */ @@ -2117,7 +2161,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq, return 0; } } - if(ie->supports_ipv4 && !ns->done_pside4) { + if((ie->supports_ipv4 || ie->use_nat64) && !ns->done_pside4) { /* Send the A request. */ if(!generate_parentside_target_query(qstate, iq, id, ns->name, ns->namelen, @@ -2259,6 +2303,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, int tf_policy; struct delegpt_addr* target; struct outbound_entry* outq; + struct sockaddr_storage real_addr; + socklen_t real_addrlen; int auth_fallback = 0; uint8_t* qout_orig = NULL; size_t qout_orig_len = 0; @@ -2276,14 +2322,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, iq->num_current_queries, iq->sent_count); /* Make sure that we haven't run away */ - /* FIXME: is this check even necessary? */ if(iq->referral_count > MAX_REFERRAL_COUNT) { verbose(VERB_QUERY, "request has exceeded the maximum " "number of referrrals with %d", iq->referral_count); errinf(qstate, "exceeded the maximum of referrals"); return error_response(qstate, id, LDNS_RCODE_SERVFAIL); } - if(iq->sent_count > MAX_SENT_COUNT) { + if(iq->sent_count > ie->max_sent_count) { verbose(VERB_QUERY, "request has exceeded the maximum " "number of sends with %d", iq->sent_count); errinf(qstate, "exceeded the maximum number of sends"); @@ -2385,7 +2430,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, } if(!ie->supports_ipv6) delegpt_no_ipv6(iq->dp); - if(!ie->supports_ipv4) + if(!ie->supports_ipv4 && !ie->use_nat64) delegpt_no_ipv4(iq->dp); delegpt_log(VERB_ALGO, iq->dp); @@ -2630,7 +2675,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, * the original query is one that matched too, so we have * caps_server+1 number of matching queries now */ if(iq->caps_server+1 >= naddr*3 || - iq->caps_server*2+2 >= MAX_SENT_COUNT) { + iq->caps_server*2+2 >= (size_t)ie->max_sent_count) { /* *2 on sentcount check because ipv6 may fail */ /* we're done, process the response */ verbose(VERB_ALGO, "0x20 fallback had %d responses " @@ -2812,6 +2857,18 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, iq->dnssec_expected?"expected": "not expected", iq->dnssec_lame_query?" but lame_query anyway": ""); } + + real_addr = target->addr; + real_addrlen = target->addrlen; + + if(ie->use_nat64 && target->addr.ss_family == AF_INET) { + addr_to_nat64(&target->addr, &ie->nat64_prefix_addr, + ie->nat64_prefix_addrlen, ie->nat64_prefix_net, + &real_addr, &real_addrlen); + log_name_addr(VERB_QUERY, "applied NAT64:", + iq->dp->name, &real_addr, real_addrlen); + } + fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query)); outq = (*qstate->env->send_query)(&iq->qinfo_out, iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), @@ -2822,7 +2879,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, !qstate->blacklist&&(!iter_qname_indicates_dnssec(qstate->env, &iq->qinfo_out)||target->attempts==1)?0:BIT_CD), iq->dnssec_expected, iq->caps_fallback || is_caps_whitelisted( - ie, iq), sq_check_ratelimit, &target->addr, target->addrlen, + ie, iq), sq_check_ratelimit, &real_addr, real_addrlen, iq->dp->name, iq->dp->namelen, (iq->dp->tcp_upstream || qstate->env->cfg->tcp_upstream), (iq->dp->ssl_upstream || qstate->env->cfg->ssl_upstream), @@ -2839,7 +2896,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq, return error_response(qstate, id, LDNS_RCODE_SERVFAIL); } log_addr(VERB_QUERY, "error sending query to auth server", - &target->addr, target->addrlen); + &real_addr, real_addrlen); if(qstate->env->cfg->qname_minimisation) iq->minimisation_state = SKIP_MINIMISE_STATE; return next_state(iq, QUERYTARGETS_STATE); @@ -2883,7 +2940,7 @@ static int processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, struct iter_env* ie, int id) { - int dnsseclame = 0; + int dnsseclame = 0, origtypecname = 0; enum response_type type; iq->num_current_queries--; @@ -2966,6 +3023,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, /* YXDOMAIN is a permanent error, no need to retry */ type = RESPONSE_TYPE_ANSWER; } + if(type == RESPONSE_TYPE_CNAME) + origtypecname = 1; if(type == RESPONSE_TYPE_CNAME && iq->response->rep->an_numrrsets >= 1 && ntohs(iq->response->rep->rrsets[0]->rk.type) == LDNS_RR_TYPE_DNAME) { uint8_t* sname = NULL; @@ -3051,11 +3110,14 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, iq->minimisation_state = DONOT_MINIMISE_STATE; } if(FLAGS_GET_RCODE(iq->response->rep->flags) == - LDNS_RCODE_NXDOMAIN) { + LDNS_RCODE_NXDOMAIN && !origtypecname) { /* Stop resolving when NXDOMAIN is DNSSEC * signed. Based on assumption that nameservers * serving signed zones do not return NXDOMAIN * for empty-non-terminals. */ + /* If this response is actually a CNAME type, + * the nxdomain rcode may not be for the qname, + * and so it is not the final response. */ if(iq->dnssec_expected) return final_state(iq); /* Make subrequest to validate intermediate @@ -3183,7 +3245,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq, (*qstate->env->detach_subs)(qstate); iq->num_target_queries = 0; iq->response = NULL; - iq->fail_reply = NULL; + iq->fail_addr_type = 0; verbose(VERB_ALGO, "cleared outbound list for next round"); return next_state(iq, QUERYTARGETS_STATE); } else if(type == RESPONSE_TYPE_CNAME) { @@ -3565,7 +3627,7 @@ processTargetResponse(struct module_qstate* qstate, int id, } else { verbose(VERB_ALGO, "iterator TargetResponse failed"); delegpt_mark_neg(dpns, qstate->qinfo.qtype); - if((dpns->got4 == 2 || !ie->supports_ipv4) && + if((dpns->got4 == 2 || (!ie->supports_ipv4 && !ie->use_nat64)) && (dpns->got6 == 2 || !ie->supports_ipv6)) { dpns->resolved = 1; /* fail the target */ /* do not count cached answers */ @@ -3810,6 +3872,9 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq, /* make sure QR flag is on */ iq->response->rep->flags |= BIT_QR; + /* explicitly set the EDE string to NULL */ + iq->response->rep->reason_bogus_str = NULL; + /* we have finished processing this query */ qstate->ext_state[id] = module_finished; @@ -3988,7 +4053,8 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq, } /* parse message */ - iq->fail_reply = qstate->reply; + fill_fail_addr(iq, &qstate->reply->remote_addr, + qstate->reply->remote_addrlen); prs = (struct msg_parse*)regional_alloc(qstate->env->scratch, sizeof(struct msg_parse)); if(!prs) { diff --git a/usr.sbin/unbound/iterator/iterator.h b/usr.sbin/unbound/iterator/iterator.h index 592c10bfc..0fe160beb 100644 --- a/usr.sbin/unbound/iterator/iterator.h +++ b/usr.sbin/unbound/iterator/iterator.h @@ -63,12 +63,8 @@ struct rbtree_type; /** max number of nxdomains allowed for target lookups for a query and * its subqueries when fallback has kicked in */ #define MAX_TARGET_NX_FALLBACK (MAX_TARGET_NX*2) -/** max number of query restarts. Determines max number of CNAME chain. */ -#define MAX_RESTART_COUNT 11 /** max number of referrals. Makes sure resolver does not run away */ #define MAX_REFERRAL_COUNT 130 -/** max number of queries-sent-out. Make sure large NS set does not loop */ -#define MAX_SENT_COUNT 32 /** max number of queries for which to perform dnsseclameness detection, * (rrsigs missing detection) after that, just pick up that response */ #define DNSSEC_LAME_DETECT_COUNT 4 @@ -116,6 +112,18 @@ struct iter_env { /** A flag to indicate whether or not we have an IPv4 route */ int supports_ipv4; + /** A flag to locally apply NAT64 to make IPv4 addrs into IPv6 */ + int use_nat64; + + /** NAT64 prefix address, cf. dns64_env->prefix_addr */ + struct sockaddr_storage nat64_prefix_addr; + + /** sizeof(sockaddr_in6) */ + socklen_t nat64_prefix_addrlen; + + /** CIDR mask length of NAT64 prefix */ + int nat64_prefix_net; + /** A set of inetaddrs that should never be queried. */ struct iter_donotq* donotq; @@ -145,6 +153,12 @@ struct iter_env { /** number of retries on outgoing queries */ int outbound_msg_retry; + + /** number of queries_sent */ + int max_sent_count; + + /** max number of query restarts to limit length of CNAME chain */ + int max_query_restarts; }; /** @@ -437,7 +451,14 @@ struct iter_qstate { /** true if there have been parse failures of reply packets */ int parse_failures; /** a failure printout address for last received answer */ - struct comm_reply* fail_reply; + union { + struct in_addr in; +#ifdef AF_INET6 + struct in6_addr in6; +#endif + } fail_addr; + /** which fail_addr, 0 is nothing, 4 or 6 */ + int fail_addr_type; }; /** diff --git a/usr.sbin/unbound/libunbound/context.c b/usr.sbin/unbound/libunbound/context.c index 9969ee2de..cd12b2a19 100644 --- a/usr.sbin/unbound/libunbound/context.c +++ b/usr.sbin/unbound/libunbound/context.c @@ -70,6 +70,7 @@ context_finalize(struct ub_ctx* ctx) } else { log_init(cfg->logfile, cfg->use_syslog, NULL); } + ctx->pipe_pid = getpid(); cfg_apply_local_port_policy(cfg, 65536); config_apply(cfg); if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env)) diff --git a/usr.sbin/unbound/libunbound/context.h b/usr.sbin/unbound/libunbound/context.h index e401de77d..098ac3556 100644 --- a/usr.sbin/unbound/libunbound/context.h +++ b/usr.sbin/unbound/libunbound/context.h @@ -89,6 +89,12 @@ struct ub_ctx { pid_t bg_pid; /** tid of bg worker thread */ ub_thread_type bg_tid; + /** pid when pipes are created. This was the process when the + * setup was called. Helps with clean up, so we can tell after a fork + * which side of the fork the delete is on. */ + pid_t pipe_pid; + /** when threaded, the worker that exists in the created thread. */ + struct libworker* thread_worker; /** do threading (instead of forking) for async resolution */ int dothread; diff --git a/usr.sbin/unbound/libunbound/libunbound.c b/usr.sbin/unbound/libunbound/libunbound.c index 9ca2c3979..389d02a85 100644 --- a/usr.sbin/unbound/libunbound/libunbound.c +++ b/usr.sbin/unbound/libunbound/libunbound.c @@ -305,11 +305,31 @@ ub_ctx_delete(struct ub_ctx* ctx) int do_stop = 1; if(!ctx) return; + /* if the delete is called but it has forked, and before the fork + * the context was finalized, then the bg worker is not stopped + * from here. There is one worker, but two contexts that refer to + * it and only one should clean up, the one with getpid == pipe_pid.*/ + if(ctx->created_bg && ctx->pipe_pid != getpid()) { + do_stop = 0; +#ifndef USE_WINSOCK + /* Stop events from getting deregistered, if the backend is + * epoll, the epoll fd is the same as the other process. + * That process should deregister them. */ + if(ctx->qq_pipe->listen_com) + ctx->qq_pipe->listen_com->event_added = 0; + if(ctx->qq_pipe->res_com) + ctx->qq_pipe->res_com->event_added = 0; + if(ctx->rr_pipe->listen_com) + ctx->rr_pipe->listen_com->event_added = 0; + if(ctx->rr_pipe->res_com) + ctx->rr_pipe->res_com->event_added = 0; +#endif + } /* see if bg thread is created and if threads have been killed */ /* no locks, because those may be held by terminated threads */ /* for processes the read pipe is closed and we see that on read */ #ifdef HAVE_PTHREAD - if(ctx->created_bg && ctx->dothread) { + if(ctx->created_bg && ctx->dothread && do_stop) { if(pthread_kill(ctx->bg_tid, 0) == ESRCH) { /* thread has been killed */ do_stop = 0; @@ -318,6 +338,23 @@ ub_ctx_delete(struct ub_ctx* ctx) #endif /* HAVE_PTHREAD */ if(do_stop) ub_stop_bg(ctx); + if(ctx->created_bg && ctx->pipe_pid != getpid() && ctx->thread_worker) { + /* This delete is happening from a different process. Delete + * the thread worker from this process memory space. The + * thread is not there to do so, so it is freed here. */ + struct ub_event_base* evbase = comm_base_internal( + ctx->thread_worker->base); + libworker_delete_event(ctx->thread_worker); + ctx->thread_worker = NULL; +#ifdef USE_MINI_EVENT + ub_event_base_free(evbase); +#else + /* cannot event_base_free, because the epoll_fd cleanup + * in libevent could stop the original event_base in the + * other process from working. */ + free(evbase); +#endif + } libworker_delete_event(ctx->event_worker); modstack_desetup(&ctx->mods, ctx->env); diff --git a/usr.sbin/unbound/libunbound/libworker.c b/usr.sbin/unbound/libunbound/libworker.c index 5d230942e..1b0f2f1f1 100644 --- a/usr.sbin/unbound/libunbound/libworker.c +++ b/usr.sbin/unbound/libunbound/libworker.c @@ -168,14 +168,12 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb) hints_delete(w->env->hints); w->env->hints = NULL; } - if(cfg->ssl_upstream || (cfg->tls_cert_bundle && cfg->tls_cert_bundle[0]) || cfg->tls_win_cert) { - w->sslctx = connect_sslctx_create(NULL, NULL, - cfg->tls_cert_bundle, cfg->tls_win_cert); - if(!w->sslctx) { - /* to make the setup fail after unlock */ - hints_delete(w->env->hints); - w->env->hints = NULL; - } + w->sslctx = connect_sslctx_create(NULL, NULL, + cfg->tls_cert_bundle, cfg->tls_win_cert); + if(!w->sslctx) { + /* to make the setup fail after unlock */ + hints_delete(w->env->hints); + w->env->hints = NULL; } if(!w->is_bg || w->is_bg_thread) { lock_basic_unlock(&ctx->cfglock); @@ -395,6 +393,7 @@ int libworker_bg(struct ub_ctx* ctx) w = libworker_setup(ctx, 1, NULL); if(!w) return UB_NOMEM; w->is_bg_thread = 1; + ctx->thread_worker = w; #ifdef ENABLE_LOCK_CHECKS w->thread_num = 1; /* for nicer DEBUG checklocks */ #endif @@ -604,6 +603,8 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q, edns->opt_list_out = NULL; edns->opt_list_inplace_cb_out = NULL; edns->padding_block_size = 0; + edns->cookie_present = 0; + edns->cookie_valid = 0; if(sldns_buffer_capacity(w->back->udp_buff) < 65535) edns->udp_size = (uint16_t)sldns_buffer_capacity( w->back->udp_buff); diff --git a/usr.sbin/unbound/libunbound/unbound-event.h b/usr.sbin/unbound/libunbound/unbound-event.h index 467eec0ba..97e573f63 100644 --- a/usr.sbin/unbound/libunbound/unbound-event.h +++ b/usr.sbin/unbound/libunbound/unbound-event.h @@ -52,8 +52,8 @@ * unbound was compiled with, otherwise it wouldn't work, the event and * event_base structures would be different. */ -#ifndef _UB_UNBOUND_EVENT_H -#define _UB_UNBOUND_EVENT_H +#ifndef UB_UNBOUND_EVENT_H +#define UB_UNBOUND_EVENT_H #ifdef __cplusplus extern "C" { @@ -230,7 +230,7 @@ int ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base); * @param callback: this is called on completion of the resolution. * It is called as: * void callback(void* mydata, int rcode, void* packet, int packet_len, - * int sec, char* why_bogus) + * int sec, char* why_bogus, int was_ratelimited) * with mydata: the same as passed here, you may pass NULL, * with rcode: 0 on no error, nonzero for mostly SERVFAIL situations, * this is a DNS rcode. @@ -241,6 +241,7 @@ int ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base); * with packet_len: length in bytes of the packet buffer. * with sec: 0 if insecure, 1 if bogus, 2 if DNSSEC secure. * with why_bogus: text string explaining why it is bogus (or NULL). + * with was_ratelimited: if the query was ratelimited. * These point to buffers inside unbound; do not deallocate the packet or * error string. * @@ -261,4 +262,4 @@ int ub_resolve_event(struct ub_ctx* ctx, const char* name, int rrtype, } #endif -#endif /* _UB_UNBOUND_H */ +#endif /* UB_UNBOUND_EVENT_H */ diff --git a/usr.sbin/unbound/libunbound/unbound.h b/usr.sbin/unbound/libunbound/unbound.h index 8775ab5b3..bb8e8acf0 100644 --- a/usr.sbin/unbound/libunbound/unbound.h +++ b/usr.sbin/unbound/libunbound/unbound.h @@ -94,8 +94,8 @@ * The second calls another worker thread (or process) to perform the work. * And no buffers need to be set up, but a context-switch happens. */ -#ifndef _UB_UNBOUND_H -#define _UB_UNBOUND_H +#ifndef UB_UNBOUND_H +#define UB_UNBOUND_H #ifdef __cplusplus extern "C" { @@ -695,11 +695,20 @@ struct ub_server_stats { long long num_queries; /** number of queries that have been dropped/ratelimited by ip. */ long long num_queries_ip_ratelimited; + /** number of queries with a valid DNS Cookie. */ + long long num_queries_cookie_valid; + /** number of queries with only the client part of the DNS Cookie. */ + long long num_queries_cookie_client; + /** number of queries with invalid DNS Cookie. */ + long long num_queries_cookie_invalid; /** number of queries that had a cache-miss. */ long long num_queries_missed_cache; /** number of prefetch queries - cachehits with prefetch */ long long num_queries_prefetch; - + /** number of queries which are too late to process */ + long long num_queries_timed_out; + /** the longest wait time in the queue */ + long long max_query_time_us; /** * Sum of the querylistsize of the worker for * every query that missed cache. To calculate average. @@ -788,6 +797,11 @@ struct ub_server_stats { /** number of key cache entries */ long long key_cache_count; + /** maximum number of collisions in the msg cache */ + long long msg_cache_max_collisions; + /** maximum number of collisions in the rrset cache */ + long long rrset_cache_max_collisions; + /** number of queries that used dnscrypt */ long long num_query_dnscrypt_crypted; /** number of queries that queried dnscrypt certificates */ @@ -819,6 +833,8 @@ struct ub_server_stats { /** number of queries answered from edns-subnet specific data, and * the answer was from the edns-subnet cache. */ long long num_query_subnet_cache; + /** number of queries served from cachedb */ + long long num_query_cachedb; /** number of bytes in the stream wait buffers */ long long mem_stream_wait; /** number of bytes in the HTTP2 query buffers */ @@ -860,4 +876,4 @@ struct ub_stats_info { } #endif -#endif /* _UB_UNBOUND_H */ +#endif /* UB_UNBOUND_H */ diff --git a/usr.sbin/unbound/services/authzone.c b/usr.sbin/unbound/services/authzone.c index 4c06a32d6..61493cc3b 100644 --- a/usr.sbin/unbound/services/authzone.c +++ b/usr.sbin/unbound/services/authzone.c @@ -1306,8 +1306,8 @@ az_remove_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len, auth_data_delete(node); } if(z->rpz) { - rpz_remove_rr(z->rpz, z->namelen, dname, dname_len, rr_type, - rr_class, rdata, rdatalen); + rpz_remove_rr(z->rpz, z->name, z->namelen, dname, dname_len, + rr_type, rr_class, rdata, rdatalen); } return 1; } @@ -2756,6 +2756,7 @@ az_change_dnames(struct dns_msg* msg, uint8_t* oldname, uint8_t* newname, == 0) { msg->rep->rrsets[i]->rk.dname = newname; msg->rep->rrsets[i]->rk.dname_len = newlen; + msg->rep->rrsets[i]->entry.hash = rrset_key_hash(&msg->rep->rrsets[i]->rk); } } } @@ -5419,6 +5420,8 @@ xfr_transfer_lookup_host(struct auth_xfer* xfr, struct module_env* env) edns.opt_list_out = NULL; edns.opt_list_inplace_cb_out = NULL; edns.padding_block_size = 0; + edns.cookie_present = 0; + edns.cookie_valid = 0; if(sldns_buffer_capacity(buf) < 65535) edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); else edns.udp_size = 65535; @@ -6612,6 +6615,8 @@ xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env) edns.opt_list_out = NULL; edns.opt_list_inplace_cb_out = NULL; edns.padding_block_size = 0; + edns.cookie_present = 0; + edns.cookie_valid = 0; if(sldns_buffer_capacity(buf) < 65535) edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); else edns.udp_size = 65535; @@ -7509,7 +7514,7 @@ static void add_rrlist_rrsigs_into_data(struct packed_rrset_data* data, size_t j; if(!rrlist[i]) continue; - if(rrlist[i] && rrlist[i]->type == LDNS_RR_TYPE_ZONEMD && + if(rrlist[i]->type == LDNS_RR_TYPE_ZONEMD && query_dname_compare(z->name, node->name)==0) { /* omit RRSIGs over type ZONEMD at apex */ continue; diff --git a/usr.sbin/unbound/services/cache/dns.c b/usr.sbin/unbound/services/cache/dns.c index 006341355..58003ebe2 100644 --- a/usr.sbin/unbound/services/cache/dns.c +++ b/usr.sbin/unbound/services/cache/dns.c @@ -132,31 +132,6 @@ msg_cache_remove(struct module_env* env, uint8_t* qname, size_t qnamelen, slabhash_remove(env->msg_cache, h, &k); } -/** remove servfail msg cache entry */ -static void -msg_del_servfail(struct module_env* env, struct query_info* qinfo, - uint32_t flags) -{ - struct msgreply_entry* e; - /* see if the entry is servfail, and then remove it, so that - * lookups move from the cacheresponse stage to the recursionresponse - * stage */ - e = msg_cache_lookup(env, qinfo->qname, qinfo->qname_len, - qinfo->qtype, qinfo->qclass, flags, 0, 0); - if(!e) return; - /* we don't check for the ttl here, also expired servfail entries - * are removed. If the user uses serve-expired, they would still be - * used to answer from cache */ - if(FLAGS_GET_RCODE(((struct reply_info*)e->entry.data)->flags) - != LDNS_RCODE_SERVFAIL) { - lock_rw_unlock(&e->entry.lock); - return; - } - lock_rw_unlock(&e->entry.lock); - msg_cache_remove(env, qinfo->qname, qinfo->qname_len, qinfo->qtype, - qinfo->qclass, flags); -} - void dns_cache_store_msg(struct module_env* env, struct query_info* qinfo, hashvalue_type hash, struct reply_info* rep, time_t leeway, int pside, @@ -182,13 +157,20 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo, /* we do not store the message, but we did store the RRs, * which could be useful for delegation information */ verbose(VERB_ALGO, "TTL 0: dropped msg from cache"); - free(rep); - /* if the message is SERVFAIL in cache, remove that SERVFAIL, + reply_info_delete(rep, NULL); + /* if the message is in the cache, remove that msg, * so that the TTL 0 response can be returned for future - * responses (i.e. don't get answered by the servfail from + * responses (i.e. don't get answered from * cache, but instead go to recursion to get this TTL0 - * response). */ - msg_del_servfail(env, qinfo, flags); + * response). + * Possible messages that could be in the cache: + * - SERVFAIL + * - NXDOMAIN + * - NODATA + * - an older record that is expired + * - an older record that did not yet expire */ + msg_cache_remove(env, qinfo->qname, qinfo->qname_len, + qinfo->qtype, qinfo->qclass, flags); return; } @@ -610,6 +592,7 @@ gen_dns_msg(struct regional* region, struct query_info* q, size_t num) if(!msg->rep) return NULL; msg->rep->reason_bogus = LDNS_EDE_NONE; + msg->rep->reason_bogus_str = NULL; if(num > RR_COUNT_MAX) return NULL; /* integer overflow protection */ msg->rep->rrsets = (struct ub_packed_rrset_key**) @@ -636,6 +619,14 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r, r->serve_expired_ttl < now) { return NULL; } + /* Ignore expired failure answers */ + if(FLAGS_GET_RCODE(r->flags) != + LDNS_RCODE_NOERROR && + FLAGS_GET_RCODE(r->flags) != + LDNS_RCODE_NXDOMAIN && + FLAGS_GET_RCODE(r->flags) != + LDNS_RCODE_YXDOMAIN) + return 0; } else { return NULL; } @@ -664,6 +655,10 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r, msg->rep->rrset_count = r->rrset_count; msg->rep->authoritative = r->authoritative; msg->rep->reason_bogus = r->reason_bogus; + if(r->reason_bogus_str) { + msg->rep->reason_bogus_str = regional_strdup(region, r->reason_bogus_str); + } + if(!rrset_array_lock(r->ref, r->rrset_count, now_control)) { return NULL; } @@ -1067,7 +1062,6 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf, /* ttl must be relative ;i.e. 0..86400 not time(0)+86400. * the env->now is added to message and RRsets in this routine. */ /* the leeway is used to invalidate other rrsets earlier */ - if(is_referral) { /* store rrsets */ struct rrset_ref ref; @@ -1084,7 +1078,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf, ((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS && !pside) ? qstarttime:*env->now + leeway)); } - free(rep); + reply_info_delete(rep, NULL); return 1; } else { /* store msg, and rrsets */ diff --git a/usr.sbin/unbound/services/cache/infra.c b/usr.sbin/unbound/services/cache/infra.c index 2442696a7..6d66f2307 100644 --- a/usr.sbin/unbound/services/cache/infra.c +++ b/usr.sbin/unbound/services/cache/infra.c @@ -67,6 +67,11 @@ int infra_dp_ratelimit = 0; * in queries per second. */ int infra_ip_ratelimit = 0; +/** ratelimit value for client ip addresses, + * in queries per second. + * For clients with a valid DNS Cookie. */ +int infra_ip_ratelimit_cookie = 0; + size_t infra_sizefunc(void* k, void* ATTR_UNUSED(d)) { @@ -1051,9 +1056,50 @@ infra_get_mem(struct infra_cache* infra) return s; } +/* Returns 1 if the limit has not been exceeded, 0 otherwise. */ +static int +check_ip_ratelimit(struct sockaddr_storage* addr, socklen_t addrlen, + struct sldns_buffer* buffer, int premax, int max, int has_cookie) +{ + int limit; + + if(has_cookie) limit = infra_ip_ratelimit_cookie; + else limit = infra_ip_ratelimit; + + /* Disabled */ + if(limit == 0) return 1; + + if(premax <= limit && max > limit) { + char client_ip[128], qnm[LDNS_MAX_DOMAINLEN+1+12+12]; + addr_to_str(addr, addrlen, client_ip, sizeof(client_ip)); + qnm[0]=0; + if(sldns_buffer_limit(buffer)>LDNS_HEADER_SIZE && + LDNS_QDCOUNT(sldns_buffer_begin(buffer))!=0) { + (void)sldns_wire2str_rrquestion_buf( + sldns_buffer_at(buffer, LDNS_HEADER_SIZE), + sldns_buffer_limit(buffer)-LDNS_HEADER_SIZE, + qnm, sizeof(qnm)); + if(strlen(qnm)>0 && qnm[strlen(qnm)-1]=='\n') + qnm[strlen(qnm)-1] = 0; /*remove newline*/ + if(strchr(qnm, '\t')) + *strchr(qnm, '\t') = ' '; + if(strchr(qnm, '\t')) + *strchr(qnm, '\t') = ' '; + verbose(VERB_OPS, "ip_ratelimit exceeded %s %d%s %s", + client_ip, limit, + has_cookie?"(cookie)":"", qnm); + } else { + verbose(VERB_OPS, "ip_ratelimit exceeded %s %d%s (no query name)", + client_ip, limit, + has_cookie?"(cookie)":""); + } + } + return (max <= limit); +} + int infra_ip_ratelimit_inc(struct infra_cache* infra, struct sockaddr_storage* addr, socklen_t addrlen, time_t timenow, - int backoff, struct sldns_buffer* buffer) + int has_cookie, int backoff, struct sldns_buffer* buffer) { int max; struct lruhash_entry* entry; @@ -1070,31 +1116,8 @@ int infra_ip_ratelimit_inc(struct infra_cache* infra, (*cur)++; max = infra_rate_max(entry->data, timenow, backoff); lock_rw_unlock(&entry->lock); - - if(premax <= infra_ip_ratelimit && max > infra_ip_ratelimit) { - char client_ip[128], qnm[LDNS_MAX_DOMAINLEN+1+12+12]; - addr_to_str(addr, addrlen, client_ip, sizeof(client_ip)); - qnm[0]=0; - if(sldns_buffer_limit(buffer)>LDNS_HEADER_SIZE && - LDNS_QDCOUNT(sldns_buffer_begin(buffer))!=0) { - (void)sldns_wire2str_rrquestion_buf( - sldns_buffer_at(buffer, LDNS_HEADER_SIZE), - sldns_buffer_limit(buffer)-LDNS_HEADER_SIZE, - qnm, sizeof(qnm)); - if(strlen(qnm)>0 && qnm[strlen(qnm)-1]=='\n') - qnm[strlen(qnm)-1] = 0; /*remove newline*/ - if(strchr(qnm, '\t')) - *strchr(qnm, '\t') = ' '; - if(strchr(qnm, '\t')) - *strchr(qnm, '\t') = ' '; - verbose(VERB_OPS, "ip_ratelimit exceeded %s %d %s", - client_ip, infra_ip_ratelimit, qnm); - } else { - verbose(VERB_OPS, "ip_ratelimit exceeded %s %d (no query name)", - client_ip, infra_ip_ratelimit); - } - } - return (max <= infra_ip_ratelimit); + return check_ip_ratelimit(addr, addrlen, buffer, premax, max, + has_cookie); } /* create */ diff --git a/usr.sbin/unbound/services/cache/infra.h b/usr.sbin/unbound/services/cache/infra.h index 32f23cc07..0ad871226 100644 --- a/usr.sbin/unbound/services/cache/infra.h +++ b/usr.sbin/unbound/services/cache/infra.h @@ -153,6 +153,8 @@ struct rate_key { /** ip ratelimit, 0 is off */ extern int infra_ip_ratelimit; +/** ip ratelimit for DNS Cookie clients, 0 is off */ +extern int infra_ip_ratelimit_cookie; /** * key for ip_ratelimit lookups, a source IP. @@ -419,13 +421,14 @@ int infra_find_ratelimit(struct infra_cache* infra, uint8_t* name, * @param addr: client address * @param addrlen: client address length * @param timenow: what time it is now. + * @param has_cookie: if the request came with a DNS Cookie. * @param backoff: if backoff is enabled. * @param buffer: with query for logging. * @return 1 if it could be incremented. 0 if the increment overshot the * ratelimit and the query should be dropped. */ int infra_ip_ratelimit_inc(struct infra_cache* infra, struct sockaddr_storage* addr, socklen_t addrlen, time_t timenow, - int backoff, struct sldns_buffer* buffer); + int has_cookie, int backoff, struct sldns_buffer* buffer); /** * Get memory used by the infra cache. diff --git a/usr.sbin/unbound/services/listen_dnsport.c b/usr.sbin/unbound/services/listen_dnsport.c index 84fdc3d8e..60f9b41e5 100644 --- a/usr.sbin/unbound/services/listen_dnsport.c +++ b/usr.sbin/unbound/services/listen_dnsport.c @@ -79,7 +79,9 @@ #ifdef HAVE_NET_IF_H #include #endif - +#ifdef HAVE_LINUX_NET_TSTAMP_H +#include +#endif /** number of queued TCP connections for listen() */ #define TCP_BACKLOG 256 @@ -1018,7 +1020,7 @@ make_sock(int stype, const char* ifname, const char* port, log_err("node %s:%s getaddrinfo: %s %s", ifname?ifname:"default", port, gai_strerror(r), #ifdef EAI_SYSTEM - r==EAI_SYSTEM?(char*)strerror(errno):"" + (r==EAI_SYSTEM?(char*)strerror(errno):"") #else "" #endif @@ -1114,6 +1116,25 @@ port_insert(struct listen_port** list, int s, enum listen_type ftype, return 1; } +/** set fd to receive software timestamps */ +static int +set_recvtimestamp(int s) +{ +#ifdef HAVE_LINUX_NET_TSTAMP_H + int opt = SOF_TIMESTAMPING_RX_SOFTWARE | SOF_TIMESTAMPING_SOFTWARE; + if (setsockopt(s, SOL_SOCKET, SO_TIMESTAMPNS, (void*)&opt, (socklen_t)sizeof(opt)) < 0) { + log_err("setsockopt(..., SO_TIMESTAMPNS, ...) failed: %s", + strerror(errno)); + return 0; + } + return 1; +#else + log_err("packets timestamping is not supported on this platform"); + (void)s; + return 0; +#endif +} + /** set fd to receive source address packet info */ static int set_recvpktinfo(int s, int family) @@ -1214,6 +1235,9 @@ if_is_ssl(const char* ifname, const char* port, int ssl_port, * @param use_systemd: if true, fetch sockets from systemd. * @param dnscrypt_port: dnscrypt service port number * @param dscp: DSCP to use. + * @param sock_queue_timeout: the sock_queue_timeout from config. Seconds to + * wait to discard if UDP packets have waited for long in the socket + * buffer. * @return: returns false on error. */ static int @@ -1223,7 +1247,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, struct config_strlist* tls_additional_port, int https_port, struct config_strlist* proxy_protocol_port, int* reuseport, int transparent, int tcp_mss, int freebind, - int http2_nodelay, int use_systemd, int dnscrypt_port, int dscp) + int http2_nodelay, int use_systemd, int dnscrypt_port, int dscp, + int sock_queue_timeout) { int s, noip6=0; int is_https = if_is_https(ifname, port, https_port); @@ -1252,7 +1277,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, &noip6, rcv, snd, reuseport, transparent, tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock)) == -1) { - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); if(noip6) { log_warn("IPv6 protocol not available"); @@ -1263,15 +1289,20 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, /* getting source addr packet info is highly non-portable */ if(!set_recvpktinfo(s, hints->ai_family)) { sock_close(s); - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); return 0; } + if (sock_queue_timeout && !set_recvtimestamp(s)) { + log_warn("socket timestamping is not available"); + } if(!port_insert(list, s, is_dnscrypt ?listen_type_udpancil_dnscrypt:listen_type_udpancil, is_pp2, ub_sock)) { sock_close(s); - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); return 0; } @@ -1283,7 +1314,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, &noip6, rcv, snd, reuseport, transparent, tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock)) == -1) { - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); if(noip6) { log_warn("IPv6 protocol not available"); @@ -1291,11 +1323,15 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, } return 0; } + if (sock_queue_timeout && !set_recvtimestamp(s)) { + log_warn("socket timestamping is not available"); + } if(!port_insert(list, s, is_dnscrypt ?listen_type_udp_dnscrypt:listen_type_udp, is_pp2, ub_sock)) { sock_close(s); - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); return 0; } @@ -1318,7 +1354,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1, &noip6, 0, 0, reuseport, transparent, tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock)) == -1) { - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); if(noip6) { /*log_warn("IPv6 protocol not available");*/ @@ -1330,7 +1367,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, verbose(VERB_ALGO, "setup TCP for SSL service"); if(!port_insert(list, s, port_type, is_pp2, ub_sock)) { sock_close(s); - freeaddrinfo(ub_sock->addr); + if(ub_sock->addr) + freeaddrinfo(ub_sock->addr); free(ub_sock); return 0; } @@ -1802,7 +1840,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, reuseport, cfg->ip_transparent, cfg->tcp_mss, cfg->ip_freebind, cfg->http_nodelay, cfg->use_systemd, - cfg->dnscrypt_port, cfg->ip_dscp)) { + cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) { listening_ports_free(list); return NULL; } @@ -1819,7 +1857,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, reuseport, cfg->ip_transparent, cfg->tcp_mss, cfg->ip_freebind, cfg->http_nodelay, cfg->use_systemd, - cfg->dnscrypt_port, cfg->ip_dscp)) { + cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) { listening_ports_free(list); return NULL; } @@ -1838,7 +1876,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, reuseport, cfg->ip_transparent, cfg->tcp_mss, cfg->ip_freebind, cfg->http_nodelay, cfg->use_systemd, - cfg->dnscrypt_port, cfg->ip_dscp)) { + cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) { listening_ports_free(list); return NULL; } @@ -1854,7 +1892,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, reuseport, cfg->ip_transparent, cfg->tcp_mss, cfg->ip_freebind, cfg->http_nodelay, cfg->use_systemd, - cfg->dnscrypt_port, cfg->ip_dscp)) { + cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) { listening_ports_free(list); return NULL; } @@ -1872,7 +1910,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, reuseport, cfg->ip_transparent, cfg->tcp_mss, cfg->ip_freebind, cfg->http_nodelay, cfg->use_systemd, - cfg->dnscrypt_port, cfg->ip_dscp)) { + cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) { listening_ports_free(list); return NULL; } @@ -1888,7 +1926,7 @@ listening_ports_open(struct config_file* cfg, char** ifs, int num_ifs, reuseport, cfg->ip_transparent, cfg->tcp_mss, cfg->ip_freebind, cfg->http_nodelay, cfg->use_systemd, - cfg->dnscrypt_port, cfg->ip_dscp)) { + cfg->dnscrypt_port, cfg->ip_dscp, cfg->sock_queue_timeout)) { listening_ports_free(list); return NULL; } @@ -1908,7 +1946,8 @@ void listening_ports_free(struct listen_port* list) } /* rc_ports don't have ub_socket */ if(list->socket) { - freeaddrinfo(list->socket->addr); + if(list->socket->addr) + freeaddrinfo(list->socket->addr); free(list->socket); } free(list); diff --git a/usr.sbin/unbound/services/localzone.c b/usr.sbin/unbound/services/localzone.c index 4e42eb46a..0ca003819 100644 --- a/usr.sbin/unbound/services/localzone.c +++ b/usr.sbin/unbound/services/localzone.c @@ -1308,6 +1308,7 @@ local_encode(struct query_info* qinfo, struct module_env* env, else rep.ns_numrrsets = 1; rep.rrset_count = 1; rep.rrsets = &rrset; + rep.reason_bogus = LDNS_EDE_NONE; udpsize = edns->udp_size; edns->edns_version = EDNS_ADVERTISED_VERSION; edns->udp_size = EDNS_ADVERTISED_SIZE; @@ -1603,7 +1604,7 @@ local_zone_does_not_cover(struct local_zone* z, struct query_info* qinfo, struct local_data key; struct local_data* ld = NULL; struct local_rrset* lr = NULL; - if(z->type == local_zone_always_transparent) + if(z->type == local_zone_always_transparent || z->type == local_zone_block_a) return 1; if(z->type != local_zone_transparent && z->type != local_zone_typetransparent @@ -1679,6 +1680,16 @@ local_zones_zone_answer(struct local_zone* z, struct module_env* env, } else if(lz_type == local_zone_typetransparent || lz_type == local_zone_always_transparent) { /* no NODATA or NXDOMAINS for this zone type */ + return 0; + } else if(lz_type == local_zone_block_a) { + /* Return NODATA for all A queries */ + if(qinfo->qtype == LDNS_RR_TYPE_A) { + local_error_encode(qinfo, env, edns, repinfo, buf, temp, + LDNS_RCODE_NOERROR, (LDNS_RCODE_NOERROR|BIT_AA), + LDNS_EDE_NONE, NULL); + return 1; + } + return 0; } else if(lz_type == local_zone_always_null) { /* 0.0.0.0 or ::0 or noerror/nodata for this zone type, @@ -1846,7 +1857,8 @@ local_zones_answer(struct local_zones* zones, struct module_env* env, if(z && (lzt == local_zone_transparent || lzt == local_zone_typetransparent || lzt == local_zone_inform || - lzt == local_zone_always_transparent) && + lzt == local_zone_always_transparent || + lzt == local_zone_block_a) && local_zone_does_not_cover(z, qinfo, labs)) { lock_rw_unlock(&z->lock); z = NULL; @@ -1894,6 +1906,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env, if(lzt != local_zone_always_refuse && lzt != local_zone_always_transparent + && lzt != local_zone_block_a && lzt != local_zone_always_nxdomain && lzt != local_zone_always_nodata && lzt != local_zone_always_deny @@ -1924,6 +1937,7 @@ const char* local_zone_type2str(enum localzone_type t) case local_zone_inform_deny: return "inform_deny"; case local_zone_inform_redirect: return "inform_redirect"; case local_zone_always_transparent: return "always_transparent"; + case local_zone_block_a: return "block_a"; case local_zone_always_refuse: return "always_refuse"; case local_zone_always_nxdomain: return "always_nxdomain"; case local_zone_always_nodata: return "always_nodata"; @@ -1958,6 +1972,8 @@ int local_zone_str2type(const char* type, enum localzone_type* t) *t = local_zone_inform_redirect; else if(strcmp(type, "always_transparent") == 0) *t = local_zone_always_transparent; + else if(strcmp(type, "block_a") == 0) + *t = local_zone_block_a; else if(strcmp(type, "always_refuse") == 0) *t = local_zone_always_refuse; else if(strcmp(type, "always_nxdomain") == 0) diff --git a/usr.sbin/unbound/services/localzone.h b/usr.sbin/unbound/services/localzone.h index 52dffae48..0c67b3fe5 100644 --- a/usr.sbin/unbound/services/localzone.h +++ b/usr.sbin/unbound/services/localzone.h @@ -88,6 +88,8 @@ enum localzone_type { local_zone_inform_redirect, /** resolve normally, even when there is local data */ local_zone_always_transparent, + /** resolve normally, even when there is local data but return NODATA for A queries */ + local_zone_block_a, /** answer with error, even when there is local data */ local_zone_always_refuse, /** answer with nxdomain, even when there is local data */ diff --git a/usr.sbin/unbound/services/mesh.c b/usr.sbin/unbound/services/mesh.c index ac333f7bd..52d14a2d1 100644 --- a/usr.sbin/unbound/services/mesh.c +++ b/usr.sbin/unbound/services/mesh.c @@ -63,82 +63,13 @@ #include "util/data/dname.h" #include "respip/respip.h" #include "services/listen_dnsport.h" +#include "util/timeval_func.h" #ifdef CLIENT_SUBNET #include "edns-subnet/subnetmod.h" #include "edns-subnet/edns-subnet.h" #endif -/** subtract timers and the values do not overflow or become negative */ -static void -timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start) -{ -#ifndef S_SPLINT_S - time_t end_usec = end->tv_usec; - d->tv_sec = end->tv_sec - start->tv_sec; - if(end_usec < start->tv_usec) { - end_usec += 1000000; - d->tv_sec--; - } - d->tv_usec = end_usec - start->tv_usec; -#endif -} - -/** add timers and the values do not overflow or become negative */ -static void -timeval_add(struct timeval* d, const struct timeval* add) -{ -#ifndef S_SPLINT_S - d->tv_sec += add->tv_sec; - d->tv_usec += add->tv_usec; - if(d->tv_usec >= 1000000 ) { - d->tv_usec -= 1000000; - d->tv_sec++; - } -#endif -} - -/** divide sum of timers to get average */ -static void -timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d) -{ -#ifndef S_SPLINT_S - size_t leftover; - if(d <= 0) { - avg->tv_sec = 0; - avg->tv_usec = 0; - return; - } - avg->tv_sec = sum->tv_sec / d; - avg->tv_usec = sum->tv_usec / d; - /* handle fraction from seconds divide */ - leftover = sum->tv_sec - avg->tv_sec*d; - if(leftover <= 0) - leftover = 0; - avg->tv_usec += (((long long)leftover)*((long long)1000000))/d; - if(avg->tv_sec < 0) - avg->tv_sec = 0; - if(avg->tv_usec < 0) - avg->tv_usec = 0; -#endif -} - -/** histogram compare of time values */ -static int -timeval_smaller(const struct timeval* x, const struct timeval* y) -{ -#ifndef S_SPLINT_S - if(x->tv_sec < y->tv_sec) - return 1; - else if(x->tv_sec == y->tv_sec) { - if(x->tv_usec <= y->tv_usec) - return 1; - else return 0; - } - else return 0; -#endif -} - /** * Compare two response-ip client info entries for the purpose of mesh state * compare. It returns 0 if ci_a and ci_b are considered equal; otherwise @@ -275,6 +206,7 @@ mesh_create(struct module_stack* stack, struct module_env* env) mesh->stats_jostled = 0; mesh->stats_dropped = 0; mesh->ans_expired = 0; + mesh->ans_cachedb = 0; mesh->max_reply_states = env->cfg->num_queries_per_thread; mesh->max_forever_states = (mesh->max_reply_states+1)/2; #ifndef S_SPLINT_S @@ -517,6 +449,8 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo, comm_point_send_reply(rep); return; } + /* set detached (it is now) */ + mesh->num_detached_states++; if(unique) mesh_state_make_unique(s); s->s.rpz_passthru = rpz_passthru; @@ -525,13 +459,14 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo, s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in, s->s.region); if(!s->s.edns_opts_front_in) { - log_err("mesh_state_create: out of memory; SERVFAIL"); + log_err("edns_opt_copy_region: out of memory; SERVFAIL"); if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL, LDNS_RCODE_SERVFAIL, edns, rep, mesh->env->scratch, mesh->env->now_tv)) edns->opt_list_inplace_cb_out = NULL; error_encode(r_buffer, LDNS_RCODE_SERVFAIL, qinfo, qid, qflags, edns); comm_point_send_reply(rep); + mesh_state_delete(&s->s); return; } } @@ -543,8 +478,6 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo, #endif rbtree_insert(&mesh->all, &s->node); log_assert(n != NULL); - /* set detached (it is now) */ - mesh->num_detached_states++; added = 1; } if(!s->reply_list && !s->cb_list) { @@ -637,6 +570,8 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, if(!s) { return 0; } + /* set detached (it is now) */ + mesh->num_detached_states++; if(unique) mesh_state_make_unique(s); s->s.rpz_passthru = rpz_passthru; @@ -644,6 +579,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, s->s.edns_opts_front_in = edns_opt_copy_region(edns->opt_list_in, s->s.region); if(!s->s.edns_opts_front_in) { + mesh_state_delete(&s->s); return 0; } } @@ -654,8 +590,6 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, #endif rbtree_insert(&mesh->all, &s->node); log_assert(n != NULL); - /* set detached (it is now) */ - mesh->num_detached_states++; added = 1; } if(!s->reply_list && !s->cb_list) { @@ -672,6 +606,8 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, } /* add serve expired timer if not already there */ if(timeout && !mesh_serve_expired_init(s, timeout)) { + if(added) + mesh_state_delete(&s->s); return 0; } /* update statistics */ @@ -773,7 +709,7 @@ static void mesh_schedule_prefetch(struct mesh_area* mesh, * attached its own ECS data. */ static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh, struct query_info* qinfo, uint16_t qflags, time_t leeway, int run, - int rpz_passthru, struct comm_reply* rep, struct edns_option* edns_list) + int rpz_passthru, struct sockaddr_storage* addr, struct edns_option* edns_list) { struct mesh_state* s = NULL; struct edns_option* opt = NULL; @@ -803,20 +739,10 @@ static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh, return; } } else { - /* Fake the ECS data from the client's IP */ - struct ecs_data ecs; - memset(&ecs, 0, sizeof(ecs)); - subnet_option_from_ss(&rep->client_addr, &ecs, mesh->env->cfg); - if(ecs.subnet_validdata == 0) { - log_err("prefetch_subnet subnet_option_from_ss: invalid data"); - return; - } - subnet_ecs_opt_list_append(&ecs, &s->s.edns_opts_front_in, - &s->s, s->s.region); - if(!s->s.edns_opts_front_in) { - log_err("prefetch_subnet subnet_ecs_opt_list_append: out of memory"); - return; - } + /* Store the client's address. Later in the subnet module, + * it is decided whether to include an ECS option or not. + */ + s->s.client_addr = *addr; } #ifdef UNBOUND_DEBUG n = @@ -863,14 +789,14 @@ static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh, void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo, uint16_t qflags, time_t leeway, int rpz_passthru, - struct comm_reply* rep, struct edns_option* opt_list) + struct sockaddr_storage* addr, struct edns_option* opt_list) { + (void)addr; (void)opt_list; - (void)rep; #ifdef CLIENT_SUBNET - if(rep) + if(addr) mesh_schedule_prefetch_subnet(mesh, qinfo, qflags, leeway, 1, - rpz_passthru, rep, opt_list); + rpz_passthru, addr, opt_list); else #endif mesh_schedule_prefetch(mesh, qinfo, qflags, leeway, 1, @@ -970,12 +896,6 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo, return mstate; } -int -mesh_state_is_unique(struct mesh_state* mstate) -{ - return mstate->unique != NULL; -} - void mesh_state_make_unique(struct mesh_state* mstate) { @@ -1251,7 +1171,7 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep, else secure = 0; if(!rep && rcode == LDNS_RCODE_NOERROR) rcode = LDNS_RCODE_SERVFAIL; - if(!rcode && (rep->security == sec_status_bogus || + if(!rcode && rep && (rep->security == sec_status_bogus || rep->security == sec_status_secure_sentinel_fail)) { if(!(reason = errinf_to_str_bogus(&m->s))) rcode = LDNS_RCODE_SERVFAIL; @@ -1291,7 +1211,8 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep, } else { fptr_ok(fptr_whitelist_mesh_cb(r->cb)); (*r->cb)(r->cb_arg, LDNS_RCODE_NOERROR, r->buf, - rep->security, reason, was_ratelimited); + (rep?rep->security:sec_status_unchecked), + reason, was_ratelimited); } } free(reason); @@ -1311,10 +1232,36 @@ mesh_is_rpz_respip_tcponly_action(struct mesh_state const* m) } static inline int -mesh_is_udp(struct mesh_reply const* r) { +mesh_is_udp(struct mesh_reply const* r) +{ return r->query_reply.c->type == comm_udp; } +static inline void +mesh_find_and_attach_ede_and_reason(struct mesh_state* m, + struct reply_info* rep, struct mesh_reply* r) +{ + /* OLD note: + * During validation the EDE code can be received via two + * code paths. One code path fills the reply_info EDE, and + * the other fills it in the errinf_strlist. These paths + * intersect at some points, but where is opaque due to + * the complexity of the validator. At the time of writing + * we make the choice to prefer the EDE from errinf_strlist + * but a compelling reason to do otherwise is just as valid + * NEW note: + * The compelling reason is that with caching support, the value + * in the reply_info is cached. + * The reason members of the reply_info struct should be + * updated as they are already cached. No reason to + * try and find the EDE information in errinf anymore. + */ + if(rep->reason_bogus != LDNS_EDE_NONE) { + edns_opt_list_append_ede(&r->edns.opt_list_out, + m->s.region, rep->reason_bogus, rep->reason_bogus_str); + } +} + /** * Send reply to mesh reply entry * @param m: mesh state to send it for. @@ -1406,35 +1353,12 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep, &r->edns, &r->query_reply, m->s.region, &r->start_time)) r->edns.opt_list_inplace_cb_out = NULL; } - /* Send along EDE BOGUS EDNS0 option when answer is bogus */ - if(m->s.env->cfg->ede && rcode == LDNS_RCODE_SERVFAIL && - m->s.env->need_to_validate && (!(r->qflags&BIT_CD) || - m->s.env->cfg->ignore_cd) && rep && - (rep->security <= sec_status_bogus || - rep->security == sec_status_secure_sentinel_fail)) { - char *reason = m->s.env->cfg->val_log_level >= 2 - ? errinf_to_str_bogus(&m->s) : NULL; - - /* During validation the EDE code can be received via two - * code paths. One code path fills the reply_info EDE, and - * the other fills it in the errinf_strlist. These paths - * intersect at some points, but where is opaque due to - * the complexity of the validator. At the time of writing - * we make the choice to prefer the EDE from errinf_strlist - * but a compelling reason to do otherwise is just as valid - */ - sldns_ede_code reason_bogus = errinf_to_reason_bogus(&m->s); - if ((reason_bogus == LDNS_EDE_DNSSEC_BOGUS && - rep->reason_bogus != LDNS_EDE_NONE) || - reason_bogus == LDNS_EDE_NONE) { - reason_bogus = rep->reason_bogus; - } - - if(reason_bogus != LDNS_EDE_NONE) { - edns_opt_list_append_ede(&r->edns.opt_list_out, - m->s.region, reason_bogus, reason); - } - free(reason); + /* Send along EDE EDNS0 option when SERVFAILing; usually + * DNSSEC validation failures */ + /* Since we are SERVFAILing here, CD bit and rep->security + * is already handled. */ + if(m->s.env->cfg->ede && rep) { + mesh_find_and_attach_ede_and_reason(m, rep, r); } error_encode(r_buffer, rcode, &m->s.qinfo, r->qid, r->qflags, &r->edns); @@ -1449,6 +1373,16 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep, r->edns.bits &= EDNS_DO; m->s.qinfo.qname = r->qname; m->s.qinfo.local_alias = r->local_alias; + + /* Attach EDE without SERVFAIL if the validation failed. + * Need to explicitly check for rep->security otherwise failed + * validation paths may attach to a secure answer. */ + if(m->s.env->cfg->ede && rep && + (rep->security <= sec_status_bogus || + rep->security == sec_status_secure_sentinel_fail)) { + mesh_find_and_attach_ede_and_reason(m, rep, r); + } + if(!inplace_cb_reply_call(m->s.env, &m->s.qinfo, &m->s, rep, LDNS_RCODE_NOERROR, &r->edns, &r->query_reply, m->s.region, &r->start_time) || !reply_info_answer_encode(&m->s.qinfo, rep, r->qid, @@ -1503,6 +1437,7 @@ void mesh_query_done(struct mesh_state* mstate) struct reply_info* rep = (mstate->s.return_msg? mstate->s.return_msg->rep:NULL); struct timeval tv = {0, 0}; + int i = 0; /* No need for the serve expired timer anymore; we are going to reply. */ if(mstate->s.serve_expired_data) { comm_timer_delete(mstate->s.serve_expired_data->timer); @@ -1522,6 +1457,7 @@ void mesh_query_done(struct mesh_state* mstate) } } for(r = mstate->reply_list; r; r = r->next) { + i++; tv = r->start_time; /* if a response-ip address block has been stored the @@ -1533,16 +1469,6 @@ void mesh_query_done(struct mesh_state* mstate) mstate->s.qinfo.qclass, r->local_alias, &r->query_reply.client_addr, r->query_reply.client_addrlen); - if(mstate->s.env->cfg->stat_extended && - mstate->s.respip_action_info->rpz_used) { - if(mstate->s.respip_action_info->rpz_disabled) - mstate->s.env->mesh->rpz_action[RPZ_DISABLED_ACTION]++; - if(mstate->s.respip_action_info->rpz_cname_override) - mstate->s.env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++; - else - mstate->s.env->mesh->rpz_action[respip_action_to_rpz_action( - mstate->s.respip_action_info->action)]++; - } } /* if this query is determined to be dropped during the @@ -1573,6 +1499,27 @@ void mesh_query_done(struct mesh_state* mstate) prev_buffer = r_buffer; } } + /* Account for each reply sent. */ + if(i > 0 && mstate->s.respip_action_info && + mstate->s.respip_action_info->addrinfo && + mstate->s.env->cfg->stat_extended && + mstate->s.respip_action_info->rpz_used) { + if(mstate->s.respip_action_info->rpz_disabled) + mstate->s.env->mesh->rpz_action[RPZ_DISABLED_ACTION] += i; + if(mstate->s.respip_action_info->rpz_cname_override) + mstate->s.env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION] += i; + else + mstate->s.env->mesh->rpz_action[respip_action_to_rpz_action( + mstate->s.respip_action_info->action)] += i; + } + if(!mstate->s.is_drop && i > 0) { + if(mstate->s.env->cfg->stat_extended + && mstate->s.is_cachedb_answer) { + mstate->s.env->mesh->ans_cachedb += i; + } + } + + /* Mesh area accounting */ if(mstate->reply_list) { mstate->reply_list = NULL; if(!mstate->reply_list && !mstate->cb_list) { @@ -1585,6 +1532,7 @@ void mesh_query_done(struct mesh_state* mstate) mstate->s.env->mesh->num_detached_states++; } mstate->replies_sent = 1; + while((c = mstate->cb_list) != NULL) { /* take this cb off the list; so that the list can be * changed, eg. by adds from the callback routine */ @@ -1842,9 +1790,21 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate, if(s == module_finished) { if(mstate->s.curmod == 0) { struct query_info* qinfo = NULL; + struct edns_option* opt_list = NULL; + struct sockaddr_storage addr; uint16_t qflags; int rpz_p = 0; +#ifdef CLIENT_SUBNET + struct edns_option* ecs; + if(mstate->s.need_refetch && mstate->reply_list && + modstack_find(&mesh->mods, "subnetcache") != -1 && + mstate->s.env->unique_mesh) { + addr = mstate->reply_list->query_reply.client_addr; + } else +#endif + memset(&addr, 0, sizeof(addr)); + mesh_query_done(mstate); mesh_walk_supers(mesh, mstate); @@ -1854,13 +1814,28 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate, * we need to make a copy of the query info here. */ if(mstate->s.need_refetch) { mesh_copy_qinfo(mstate, &qinfo, &qflags); +#ifdef CLIENT_SUBNET + /* Make also a copy of the ecs option if any */ + if((ecs = edns_opt_list_find( + mstate->s.edns_opts_front_in, + mstate->s.env->cfg->client_subnet_opcode)) != NULL) { + (void)edns_opt_list_append(&opt_list, + ecs->opt_code, ecs->opt_len, + ecs->opt_data, + mstate->s.env->scratch); + } +#endif rpz_p = mstate->s.rpz_passthru; } - mesh_state_delete(&mstate->s); if(qinfo) { - mesh_schedule_prefetch(mesh, qinfo, qflags, - 0, 1, rpz_p); + mesh_state_delete(&mstate->s); + mesh_new_prefetch(mesh, qinfo, qflags, 0, + rpz_p, + addr.ss_family!=AF_UNSPEC?&addr:NULL, + opt_list); + } else { + mesh_state_delete(&mstate->s); } return 0; } @@ -1968,6 +1943,7 @@ mesh_stats_clear(struct mesh_area* mesh) mesh->ans_secure = 0; mesh->ans_bogus = 0; mesh->ans_expired = 0; + mesh->ans_cachedb = 0; memset(&mesh->ans_rcode[0], 0, sizeof(size_t)*UB_STATS_RCODE_NUM); memset(&mesh->rpz_action[0], 0, sizeof(size_t)*UB_STATS_RPZ_ACTION_NUM); mesh->ans_nodata = 0; @@ -2104,6 +2080,7 @@ mesh_serve_expired_callback(void* arg) struct timeval tv = {0, 0}; int must_validate = (!(qstate->query_flags&BIT_CD) || qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate; + int i = 0; if(!qstate->serve_expired_data) return; verbose(VERB_ALGO, "Serve expired: Trying to reply with expired data"); comm_timer_delete(qstate->serve_expired_data->timer); @@ -2175,6 +2152,7 @@ mesh_serve_expired_callback(void* arg) log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep); for(r = mstate->reply_list; r; r = r->next) { + i++; tv = r->start_time; /* If address info is returned, it means the action should be an @@ -2184,16 +2162,6 @@ mesh_serve_expired_callback(void* arg) qstate->qinfo.qtype, qstate->qinfo.qclass, r->local_alias, &r->query_reply.client_addr, r->query_reply.client_addrlen); - - if(qstate->env->cfg->stat_extended && actinfo.rpz_used) { - if(actinfo.rpz_disabled) - qstate->env->mesh->rpz_action[RPZ_DISABLED_ACTION]++; - if(actinfo.rpz_cname_override) - qstate->env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION]++; - else - qstate->env->mesh->rpz_action[ - respip_action_to_rpz_action(actinfo.action)]++; - } } /* Add EDE Stale Answer (RCF8914). Ignore global ede as this is @@ -2213,11 +2181,23 @@ mesh_serve_expired_callback(void* arg) tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate); prev = r; prev_buffer = r_buffer; - - /* Account for each reply sent. */ - mesh->ans_expired++; - } + /* Account for each reply sent. */ + if(i > 0) { + mesh->ans_expired += i; + if(actinfo.addrinfo && qstate->env->cfg->stat_extended && + actinfo.rpz_used) { + if(actinfo.rpz_disabled) + qstate->env->mesh->rpz_action[RPZ_DISABLED_ACTION] += i; + if(actinfo.rpz_cname_override) + qstate->env->mesh->rpz_action[RPZ_CNAME_OVERRIDE_ACTION] += i; + else + qstate->env->mesh->rpz_action[ + respip_action_to_rpz_action(actinfo.action)] += i; + } + } + + /* Mesh area accounting */ if(mstate->reply_list) { mstate->reply_list = NULL; if(!mstate->reply_list && !mstate->cb_list) { @@ -2228,6 +2208,7 @@ mesh_serve_expired_callback(void* arg) } } } + while((c = mstate->cb_list) != NULL) { /* take this cb off the list; so that the list can be * changed, eg. by adds from the callback routine */ diff --git a/usr.sbin/unbound/services/mesh.h b/usr.sbin/unbound/services/mesh.h index 42c2636e3..aa36312f6 100644 --- a/usr.sbin/unbound/services/mesh.h +++ b/usr.sbin/unbound/services/mesh.h @@ -114,6 +114,8 @@ struct mesh_area { size_t stats_dropped; /** stats, number of expired replies sent */ size_t ans_expired; + /** stats, number of cached replies from cachedb */ + size_t ans_cachedb; /** number of replies sent */ size_t replies_sent; /** sum of waiting times for the replies */ @@ -335,13 +337,13 @@ int mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo, * @param leeway: TTL leeway what to expire earlier for this update. * @param rpz_passthru: if true, the rpz passthru was previously found and * further rpz processing is stopped. - * @param rep: comm_reply for the client; to be used when subnet is enabled. + * @param addr: sockaddr_storage for the client; to be used with subnet. * @param opt_list: edns opt_list from the client; to be used when subnet is * enabled. */ void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo, uint16_t qflags, time_t leeway, int rpz_passthru, - struct comm_reply* rep, struct edns_option* opt_list); + struct sockaddr_storage* addr, struct edns_option* opt_list); /** * Handle new event from the wire. A serviced query has returned. @@ -478,14 +480,6 @@ struct mesh_state* mesh_state_create(struct module_env* env, struct query_info* qinfo, struct respip_client_info* cinfo, uint16_t qflags, int prime, int valrec); -/** - * Check if the mesh state is unique. - * A unique mesh state uses it's unique member to point to itself, else NULL. - * @param mstate: mesh state to check. - * @return true if the mesh state is unique, false otherwise. - */ -int mesh_state_is_unique(struct mesh_state* mstate); - /** * Make a mesh state unique. * A unique mesh state uses it's unique member to point to itself. diff --git a/usr.sbin/unbound/services/modstack.c b/usr.sbin/unbound/services/modstack.c index 3ba6fa838..fc46286cd 100644 --- a/usr.sbin/unbound/services/modstack.c +++ b/usr.sbin/unbound/services/modstack.c @@ -120,12 +120,16 @@ modstack_config(struct module_stack* stack, const char* module_conf) stack->mod[i] = module_factory(&module_conf); if(!stack->mod[i]) { char md[256]; + char * s = md; snprintf(md, sizeof(md), "%s", module_conf); - if(strchr(md, ' ')) *(strchr(md, ' ')) = 0; - if(strchr(md, '\t')) *(strchr(md, '\t')) = 0; + /* Leading spaces are present on errors. */ + while (*s && isspace((unsigned char)*s)) + s++; + if(strchr(s, ' ')) *(strchr(s, ' ')) = 0; + if(strchr(s, '\t')) *(strchr(s, '\t')) = 0; log_err("Unknown value in module-config, module: '%s'." " This module is not present (not compiled in)," - " See the list of linked modules with unbound -V", md); + " See the list of linked modules with unbound -V", s); return 0; } } diff --git a/usr.sbin/unbound/services/outside_network.c b/usr.sbin/unbound/services/outside_network.c index 9e2a3f8c9..9e50a2cb1 100644 --- a/usr.sbin/unbound/services/outside_network.c +++ b/usr.sbin/unbound/services/outside_network.c @@ -551,8 +551,27 @@ reuse_tcp_find(struct outside_network* outnet, struct sockaddr_storage* addr, log_assert(&key_p != ((struct reuse_tcp*)result)->pending); } /* not found, return null */ + + /* It is possible that we search for something before the first element + * in the tree. Replace a null pointer with the first element. + */ + if (!result) { + verbose(VERB_CLIENT, "reuse_tcp_find: taking first"); + result = rbtree_first(&outnet->tcp_reuse); + } + if(!result || result == RBTREE_NULL) return NULL; + + /* It is possible that we got the previous address, but that the + * address we are looking for is in the tree. If the address we got + * is less than the address we are looking, then take the next entry. + */ + if (reuse_cmp_addrportssl(result->key, &key_p.reuse) < 0) { + verbose(VERB_CLIENT, "reuse_tcp_find: key too low"); + result = rbtree_next(result); + } + verbose(VERB_CLIENT, "reuse_tcp_find check inexact match"); /* inexact match, find one of possibly several connections to the * same destination address, with the correct port, ssl, and @@ -620,6 +639,15 @@ outnet_tcp_take_into_use(struct waiting_tcp* w) log_assert(w->addrlen > 0); pend->c->tcp_do_toggle_rw = 0; pend->c->tcp_do_close = 0; + + /* Consistency check, if we have ssl_upstream but no sslctx, then + * log an error and return failure. + */ + if (w->ssl_upstream && !w->outnet->sslctx) { + log_err("SSL upstream requested but no SSL context"); + return 0; + } + /* open socket */ s = outnet_get_tcp_fd(&w->addr, w->addrlen, w->outnet->tcp_mss, w->outnet->ip_dscp); diff --git a/usr.sbin/unbound/services/rpz.c b/usr.sbin/unbound/services/rpz.c index 586ff03ac..d903562e5 100644 --- a/usr.sbin/unbound/services/rpz.c +++ b/usr.sbin/unbound/services/rpz.c @@ -1188,6 +1188,22 @@ rpz_find_zone(struct local_zones* zones, uint8_t* qname, size_t qname_len, uint1 return z; } +/** Find entry for RR type in the list of rrsets for the clientip. */ +static struct local_rrset* +rpz_find_synthesized_rrset(uint16_t qtype, + struct clientip_synthesized_rr* data) +{ + struct local_rrset* cursor = data->data; + while( cursor != NULL) { + struct packed_rrset_key* packed_rrset = &cursor->rrset->rk; + if(htons(qtype) == packed_rrset->type) { + return cursor; + } + cursor = cursor->next; + } + return NULL; +} + /** * Remove RR from RPZ's local-data * @param z: local-zone for RPZ, holding write lock @@ -1270,15 +1286,15 @@ rpz_rrset_delete_rr(struct resp_addr* raddr, uint16_t rr_type, uint8_t* rdata, } -/** Remove RR from RPZ's local-zone */ +/** Remove RR from rpz localzones structure */ static void -rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, - enum rpz_action a, uint16_t rr_type, uint16_t rr_class, - uint8_t* rdatawl, size_t rdatalen) +rpz_remove_local_zones_trigger(struct local_zones* zones, uint8_t* dname, + size_t dnamelen, enum rpz_action a, uint16_t rr_type, + uint16_t rr_class, uint8_t* rdatawl, size_t rdatalen) { struct local_zone* z; int delete_zone = 1; - z = rpz_find_zone(r->local_zones, dname, dnamelen, rr_class, + z = rpz_find_zone(zones, dname, dnamelen, rr_class, 1 /* only exact */, 1 /* wr lock */, 1 /* keep lock*/); if(!z) { verbose(VERB_ALGO, "rpz: cannot remove RR from IXFR, " @@ -1290,15 +1306,24 @@ rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, dnamelen, rr_type, rdatawl, rdatalen); else if(a != localzone_type_to_rpz_action(z->type)) { lock_rw_unlock(&z->lock); - lock_rw_unlock(&r->local_zones->lock); + lock_rw_unlock(&zones->lock); return; } lock_rw_unlock(&z->lock); if(delete_zone) { - local_zones_del_zone(r->local_zones, z); + local_zones_del_zone(zones, z); } - lock_rw_unlock(&r->local_zones->lock); - return; + lock_rw_unlock(&zones->lock); +} + +/** Remove RR from RPZ's local-zone */ +static void +rpz_remove_qname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, + enum rpz_action a, uint16_t rr_type, uint16_t rr_class, + uint8_t* rdatawl, size_t rdatalen) +{ + rpz_remove_local_zones_trigger(r->local_zones, dname, dnamelen, + a, rr_type, rr_class, rdatawl, rdatalen); } static void @@ -1335,15 +1360,159 @@ rpz_remove_response_ip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, lock_rw_unlock(&r->respip_set->lock); } +/** find and remove type from list of local_rrset entries*/ +static void +del_local_rrset_from_list(struct local_rrset** list_head, uint16_t dtype) +{ + struct local_rrset* prev=NULL, *p=*list_head; + while(p && ntohs(p->rrset->rk.type) != dtype) { + prev = p; + p = p->next; + } + if(!p) + return; /* rrset type not found */ + /* unlink it */ + if(prev) prev->next = p->next; + else *list_head = p->next; + /* no memory recycling for zone deletions ... */ +} + +/** Delete client-ip trigger RR from its RRset and perhaps also the rrset + * from the linked list. Returns if the local data is empty and the node can + * be deleted too, or not. */ +static int rpz_remove_clientip_rr(struct clientip_synthesized_rr* node, + uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen) +{ + struct local_rrset* rrset; + struct packed_rrset_data* d; + size_t index; + rrset = rpz_find_synthesized_rrset(rr_type, node); + if(rrset == NULL) + return 0; /* type not found, ignore */ + d = (struct packed_rrset_data*)rrset->rrset->entry.data; + if(!packed_rrset_find_rr(d, rdatawl, rdatalen, &index)) + return 0; /* RR not found, ignore */ + if(d->count == 1) { + /* regional alloc'd */ + /* delete the type entry from the list */ + del_local_rrset_from_list(&node->data, rr_type); + /* if the list is empty, the node can be removed too */ + if(node->data == NULL) + return 1; + } else if (d->count > 1) { + if(!local_rrset_remove_rr(d, index)) + return 0; + } + return 0; +} + +/** remove trigger RR from clientip_syntheized set tree. */ +static void +rpz_clientip_remove_trigger_rr(struct clientip_synthesized_rrset* set, + struct sockaddr_storage* addr, socklen_t addrlen, int net, + enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen) +{ + struct clientip_synthesized_rr* node; + int delete_node = 1; + + lock_rw_wrlock(&set->lock); + node = (struct clientip_synthesized_rr*)addr_tree_find(&set->entries, + addr, addrlen, net); + if(node == NULL) { + /* netblock not found */ + verbose(VERB_ALGO, "rpz: cannot remove RR from IXFR, " + "RPZ address, netblock not found"); + lock_rw_unlock(&set->lock); + return; + } + lock_rw_wrlock(&node->lock); + if(a == RPZ_LOCAL_DATA_ACTION) { + /* remove RR, signal whether entry can be removed */ + delete_node = rpz_remove_clientip_rr(node, rr_type, rdatawl, + rdatalen); + } else if(a != node->action) { + /* ignore the RR with different action specification */ + delete_node = 0; + } + if(delete_node) { + rbtree_delete(&set->entries, node->node.node.key); + } + lock_rw_unlock(&set->lock); + lock_rw_unlock(&node->lock); + if(delete_node) { + lock_rw_destroy(&node->lock); + } +} + +/** Remove clientip trigger RR from RPZ. */ +static void +rpz_remove_clientip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, + enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen) +{ + struct sockaddr_storage addr; + socklen_t addrlen; + int net, af; + if(a == RPZ_INVALID_ACTION) + return; + if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af)) + return; + rpz_clientip_remove_trigger_rr(r->client_set, &addr, addrlen, net, + a, rr_type, rdatawl, rdatalen); +} + +/** Remove nsip trigger RR from RPZ. */ +static void +rpz_remove_nsip_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, + enum rpz_action a, uint16_t rr_type, uint8_t* rdatawl, size_t rdatalen) +{ + struct sockaddr_storage addr; + socklen_t addrlen; + int net, af; + if(a == RPZ_INVALID_ACTION) + return; + if(!netblockdnametoaddr(dname, dnamelen, &addr, &addrlen, &net, &af)) + return; + rpz_clientip_remove_trigger_rr(r->ns_set, &addr, addrlen, net, + a, rr_type, rdatawl, rdatalen); +} + +/** Remove nsdname trigger RR from RPZ. */ +static void +rpz_remove_nsdname_trigger(struct rpz* r, uint8_t* dname, size_t dnamelen, + enum rpz_action a, uint16_t rr_type, uint16_t rr_class, + uint8_t* rdatawl, size_t rdatalen) +{ + uint8_t* dname_stripped = NULL; + size_t dnamelen_stripped = 0; + if(a == RPZ_INVALID_ACTION) + return; + if(!rpz_strip_nsdname_suffix(dname, dnamelen, &dname_stripped, + &dnamelen_stripped)) + return; + rpz_remove_local_zones_trigger(r->nsdname_zones, dname_stripped, + dnamelen_stripped, a, rr_type, rr_class, rdatawl, rdatalen); + free(dname_stripped); +} + void -rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen, - uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, size_t rdatalen) +rpz_remove_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dname, + size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, + size_t rdatalen) { size_t policydnamelen; enum rpz_trigger t; enum rpz_action a; uint8_t* policydname; + if(rpz_type_ignored(rr_type)) { + /* this rpz action is not valid, eg. this is the SOA or NS RR */ + return; + } + if(!dname_subdomain_c(dname, azname)) { + /* not subdomain of the RPZ zone. */ + return; + } + if(!(policydname = calloc(1, LDNS_MAX_DOMAINLEN + 1))) return; @@ -1358,13 +1527,28 @@ rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, size_t dnamelen, return; } t = rpz_dname_to_trigger(policydname, policydnamelen); + if(t == RPZ_INVALID_TRIGGER) { + /* skipping invalid trigger */ + free(policydname); + return; + } if(t == RPZ_QNAME_TRIGGER) { rpz_remove_qname_trigger(r, policydname, policydnamelen, a, rr_type, rr_class, rdatawl, rdatalen); } else if(t == RPZ_RESPONSE_IP_TRIGGER) { rpz_remove_response_ip_trigger(r, policydname, policydnamelen, a, rr_type, rdatawl, rdatalen); + } else if(t == RPZ_CLIENT_IP_TRIGGER) { + rpz_remove_clientip_trigger(r, policydname, policydnamelen, a, + rr_type, rdatawl, rdatalen); + } else if(t == RPZ_NSIP_TRIGGER) { + rpz_remove_nsip_trigger(r, policydname, policydnamelen, a, + rr_type, rdatawl, rdatalen); + } else if(t == RPZ_NSDNAME_TRIGGER) { + rpz_remove_nsdname_trigger(r, policydname, policydnamelen, a, + rr_type, rr_class, rdatawl, rdatalen); } + /* else it was an unsupported trigger, also skipped. */ free(policydname); } @@ -1563,21 +1747,6 @@ rpz_local_encode(struct module_env* env, struct query_info* qinfo, return 1; } -static struct local_rrset* -rpz_find_synthesized_rrset(uint16_t qtype, - struct clientip_synthesized_rr* data) -{ - struct local_rrset* cursor = data->data; - while( cursor != NULL) { - struct packed_rrset_key* packed_rrset = &cursor->rrset->rk; - if(htons(qtype) == packed_rrset->type) { - return cursor; - } - cursor = cursor->next; - } - return NULL; -} - /** allocate SOA record ubrrsetkey in region */ static struct ub_packed_rrset_key* make_soa_ubrrset(struct auth_zone* auth_zone, struct auth_rrset* soa, @@ -1713,7 +1882,8 @@ rpz_synthesize_nodata(struct rpz* ATTR_UNUSED(r), struct module_qstate* ms, 0, /* ns */ 0, /* ar */ 0, /* total */ - sec_status_insecure); + sec_status_insecure, + LDNS_EDE_NONE); if(msg->rep) msg->rep->authoritative = 1; if(!rpz_add_soa(msg->rep, ms, az)) @@ -1742,7 +1912,8 @@ rpz_synthesize_nxdomain(struct rpz* r, struct module_qstate* ms, 0, /* ns */ 0, /* ar */ 0, /* total */ - sec_status_insecure); + sec_status_insecure, + LDNS_EDE_NONE); if(msg->rep) msg->rep->authoritative = 1; if(!rpz_add_soa(msg->rep, ms, az)) @@ -1772,7 +1943,8 @@ rpz_synthesize_localdata_from_rrset(struct rpz* ATTR_UNUSED(r), struct module_qs 0, /* ns */ 0, /* ar */ 1, /* total */ - sec_status_insecure); + sec_status_insecure, + LDNS_EDE_NONE); if(new_reply_info == NULL) { log_err("out of memory"); return NULL; diff --git a/usr.sbin/unbound/services/rpz.h b/usr.sbin/unbound/services/rpz.h index cfc46c3c3..7e4ee7143 100644 --- a/usr.sbin/unbound/services/rpz.h +++ b/usr.sbin/unbound/services/rpz.h @@ -84,10 +84,11 @@ enum rpz_action { RPZ_CNAME_OVERRIDE_ACTION, /* RPZ CNAME action override*/ }; -struct clientip_synthesized_rrset{ +struct clientip_synthesized_rrset { struct regional* region; struct rbtree_type entries; - lock_rw_type lock; /* lock on the respip tree */ + /** lock on the entries tree */ + lock_rw_type lock; }; struct clientip_synthesized_rr { @@ -95,10 +96,6 @@ struct clientip_synthesized_rr { struct addr_tree_node node; /** lock on the node item */ lock_rw_type lock; - /** tag bitlist */ - uint8_t* taglist; - /** length of the taglist (in bytes) */ - size_t taglen; /** action for this address span */ enum rpz_action action; /** "local data" for this node */ @@ -152,6 +149,7 @@ int rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dna /** * Delete policy matching RR, used for IXFR. * @param r: the rpz to add the policy to. + * @param azname: dname of the auth-zone * @param aznamelen: the length of the auth-zone name * @param dname: dname of the RR * @param dnamelen: length of the dname @@ -160,9 +158,9 @@ int rpz_insert_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, uint8_t* dna * @param rdatawl: rdata of the RR, prepended with the rdata size * @param rdatalen: length if the RR, including the prepended rdata size */ -void rpz_remove_rr(struct rpz* r, size_t aznamelen, uint8_t* dname, - size_t dnamelen, uint16_t rr_type, uint16_t rr_class, uint8_t* rdatawl, - size_t rdatalen); +void rpz_remove_rr(struct rpz* r, uint8_t* azname, size_t aznamelen, + uint8_t* dname, size_t dnamelen, uint16_t rr_type, uint16_t rr_class, + uint8_t* rdatawl, size_t rdatalen); /** * Walk over the RPZ zones to find and apply a QNAME trigger policy. diff --git a/usr.sbin/unbound/sldns/rrdef.c b/usr.sbin/unbound/sldns/rrdef.c index b51dc7279..6f91494cb 100644 --- a/usr.sbin/unbound/sldns/rrdef.c +++ b/usr.sbin/unbound/sldns/rrdef.c @@ -702,7 +702,11 @@ sldns_get_rr_type_by_name(const char *name) /* TYPEXX representation */ if (strlen(name) > 4 && strncasecmp(name, "TYPE", 4) == 0) { - return atoi(name + 4); + unsigned int a = atoi(name + 4); + if (a > LDNS_RR_TYPE_LAST) { + return (enum sldns_enum_rr_type)0; + } + return a; } /* Normal types */ @@ -740,7 +744,11 @@ sldns_get_rr_class_by_name(const char *name) /* CLASSXX representation */ if (strlen(name) > 5 && strncasecmp(name, "CLASS", 5) == 0) { - return atoi(name + 5); + unsigned int a = atoi(name + 5); + if (a > LDNS_RR_CLASS_LAST) { + return (enum sldns_enum_rr_class)0; + } + return a; } /* Normal types */ diff --git a/usr.sbin/unbound/sldns/rrdef.h b/usr.sbin/unbound/sldns/rrdef.h index 9dca9c335..5f3efe25b 100644 --- a/usr.sbin/unbound/sldns/rrdef.h +++ b/usr.sbin/unbound/sldns/rrdef.h @@ -433,10 +433,12 @@ enum sldns_enum_edns_option LDNS_EDNS_DHU = 6, /* RFC6975 */ LDNS_EDNS_N3U = 7, /* RFC6975 */ LDNS_EDNS_CLIENT_SUBNET = 8, /* RFC7871 */ + LDNS_EDNS_COOKIE = 10, /* RFC7873 */ LDNS_EDNS_KEEPALIVE = 11, /* draft-ietf-dnsop-edns-tcp-keepalive*/ LDNS_EDNS_PADDING = 12, /* RFC7830 */ LDNS_EDNS_EDE = 15, /* RFC8914 */ - LDNS_EDNS_CLIENT_TAG = 16 /* draft-bellis-dnsop-edns-tags-01 */ + LDNS_EDNS_CLIENT_TAG = 16, /* draft-bellis-dnsop-edns-tags-01 */ + LDNS_EDNS_UNBOUND_CACHEDB_TESTFRAME_TEST = 65534 }; typedef enum sldns_enum_edns_option sldns_edns_option; @@ -482,6 +484,9 @@ typedef enum sldns_enum_ede_code sldns_ede_code; #define LDNS_TSIG_ERROR_BADNAME 20 #define LDNS_TSIG_ERROR_BADALG 21 +/** DNS Cookie extended rcode */ +#define LDNS_EXT_RCODE_BADCOOKIE 23 + /** * Contains all information about resource record types. * diff --git a/usr.sbin/unbound/sldns/str2wire.c b/usr.sbin/unbound/sldns/str2wire.c index 83ba58fb6..521d08a9f 100644 --- a/usr.sbin/unbound/sldns/str2wire.c +++ b/usr.sbin/unbound/sldns/str2wire.c @@ -698,7 +698,7 @@ static int sldns_str2wire_check_svcbparams(uint8_t* rdata, uint16_t rdata_len) mandatory = svcparams[i]; } - /* 4. verify that all the SvcParamKeys in mandatory are present */ + /* Verify that all the SvcParamKeys in mandatory are present */ if(mandatory) { /* Divide by sizeof(uint16_t)*/ uint16_t mandatory_nkeys = sldns_read_uint16(mandatory + 2) / sizeof(uint16_t); @@ -1123,36 +1123,40 @@ sldns_str2wire_svcparam_key_lookup(const char *key, size_t key_len) return key_value; } else switch (key_len) { - case sizeof("mandatory")-1: - if (!strncmp(key, "mandatory", sizeof("mandatory")-1)) - return SVCB_KEY_MANDATORY; - if (!strncmp(key, "echconfig", sizeof("echconfig")-1)) - return SVCB_KEY_ECH; /* allow "echconfig" as well as "ech" */ + case 3: + if (!strncmp(key, "ech", key_len)) + return SVCB_KEY_ECH; break; - case sizeof("alpn")-1: - if (!strncmp(key, "alpn", sizeof("alpn")-1)) + case 4: + if (!strncmp(key, "alpn", key_len)) return SVCB_KEY_ALPN; - if (!strncmp(key, "port", sizeof("port")-1)) + if (!strncmp(key, "port", key_len)) return SVCB_KEY_PORT; break; - case sizeof("no-default-alpn")-1: - if (!strncmp( key , "no-default-alpn" - , sizeof("no-default-alpn")-1)) - return SVCB_KEY_NO_DEFAULT_ALPN; + case 7: + if (!strncmp(key, "dohpath", key_len)) + return SVCB_KEY_DOHPATH; break; - case sizeof("ipv4hint")-1: - if (!strncmp(key, "ipv4hint", sizeof("ipv4hint")-1)) + case 8: + if (!strncmp(key, "ipv4hint", key_len)) return SVCB_KEY_IPV4HINT; - if (!strncmp(key, "ipv6hint", sizeof("ipv6hint")-1)) + if (!strncmp(key, "ipv6hint", key_len)) return SVCB_KEY_IPV6HINT; break; - case sizeof("ech")-1: - if (!strncmp(key, "ech", sizeof("ech")-1)) - return SVCB_KEY_ECH; + case 9: + if (!strncmp(key, "mandatory", key_len)) + return SVCB_KEY_MANDATORY; + if (!strncmp(key, "echconfig", key_len)) + return SVCB_KEY_ECH; /* allow "echconfig" as well as "ech" */ + break; + + case 15: + if (!strncmp(key, "no-default-alpn", key_len)) + return SVCB_KEY_NO_DEFAULT_ALPN; break; default: @@ -1515,6 +1519,33 @@ sldns_str2wire_svcbparam_alpn_value(const char* val, return LDNS_WIREPARSE_ERR_OK; } +static int +sldns_str2wire_svcbparam_dohpath_value(const char* val, + uint8_t* rd, size_t* rd_len) +{ + size_t val_len; + + /* RFC6570#section-2.1 + * "The characters outside of expressions in a URI Template string are + * intended to be copied literally" + * Practically this means we do not have to look for "double escapes" + * like in the alpn value list. + */ + + val_len = strlen(val); + + if (*rd_len < 4 + val_len) { + return LDNS_WIREPARSE_ERR_BUFFER_TOO_SMALL; + } + + sldns_write_uint16(rd, SVCB_KEY_DOHPATH); + sldns_write_uint16(rd + 2, val_len); + memcpy(rd + 4, val, val_len); + *rd_len = 4 + val_len; + + return LDNS_WIREPARSE_ERR_OK; +} + static int sldns_str2wire_svcparam_value(const char *key, size_t key_len, const char *val, uint8_t* rd, size_t* rd_len) @@ -1535,6 +1566,7 @@ sldns_str2wire_svcparam_value(const char *key, size_t key_len, case SVCB_KEY_PORT: case SVCB_KEY_IPV4HINT: case SVCB_KEY_IPV6HINT: + case SVCB_KEY_DOHPATH: return LDNS_WIREPARSE_ERR_SVCB_MISSING_PARAM; #endif default: @@ -1566,6 +1598,8 @@ sldns_str2wire_svcparam_value(const char *key, size_t key_len, return sldns_str2wire_svcbparam_ech_value(val, rd, rd_len); case SVCB_KEY_ALPN: return sldns_str2wire_svcbparam_alpn_value(val, rd, rd_len); + case SVCB_KEY_DOHPATH: + return sldns_str2wire_svcbparam_dohpath_value(val, rd, rd_len); default: str_len = strlen(val); if (*rd_len < 4 + str_len) @@ -1611,7 +1645,7 @@ static int sldns_str2wire_svcparam_buf(const char* str, uint8_t* rd, size_t* rd_ *val_out = 0; return sldns_str2wire_svcparam_value(str, eq_pos - str, - unescaped_val[0] ? unescaped_val : NULL, rd, rd_len); + unescaped_val[0] ? unescaped_val : NULL, rd, rd_len); } /* case: key= */ else if (eq_pos != NULL && !(eq_pos[1])) { diff --git a/usr.sbin/unbound/sldns/str2wire.h b/usr.sbin/unbound/sldns/str2wire.h index baee4236f..5e4d146d3 100644 --- a/usr.sbin/unbound/sldns/str2wire.h +++ b/usr.sbin/unbound/sldns/str2wire.h @@ -38,7 +38,8 @@ struct sldns_struct_lookup_table; #define SVCB_KEY_IPV4HINT 4 #define SVCB_KEY_ECH 5 #define SVCB_KEY_IPV6HINT 6 -#define SVCPARAMKEY_COUNT 7 +#define SVCB_KEY_DOHPATH 7 +#define SVCPARAMKEY_COUNT 8 #define MAX_NUMBER_OF_SVCPARAMS 64 @@ -236,6 +237,7 @@ uint8_t* sldns_wirerr_get_rdatawl(uint8_t* rr, size_t len, size_t dname_len); #define LDNS_WIREPARSE_ERR_SVCB_NO_DEFAULT_ALPN_VALUE 385 #define LDNS_WIREPARSE_ERR_SVCPARAM_BROKEN_RDATA 386 + /** * Get reference to a constant string for the (parse) error. * @param e: error return value diff --git a/usr.sbin/unbound/sldns/wire2str.c b/usr.sbin/unbound/sldns/wire2str.c index 78618003c..e6278ff56 100644 --- a/usr.sbin/unbound/sldns/wire2str.c +++ b/usr.sbin/unbound/sldns/wire2str.c @@ -224,7 +224,7 @@ sldns_lookup_table* sldns_tsig_errors = sldns_tsig_errors_data; /* draft-ietf-dnsop-svcb-https-06: 6. Initial SvcParamKeys */ const char *svcparamkey_strs[] = { "mandatory", "alpn", "no-default-alpn", "port", - "ipv4hint", "ech", "ipv6hint" + "ipv4hint", "ech", "ipv6hint", "dohpath" }; char* sldns_wire2str_pkt(uint8_t* data, size_t len) @@ -1174,6 +1174,7 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl case SVCB_KEY_IPV4HINT: case SVCB_KEY_IPV6HINT: case SVCB_KEY_MANDATORY: + case SVCB_KEY_DOHPATH: return -1; default: return written_chars; @@ -1201,6 +1202,8 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl case SVCB_KEY_ECH: r = sldns_wire2str_svcparam_ech2str(s, slen, data_len, *d); break; + case SVCB_KEY_DOHPATH: + /* fallthrough */ default: r = sldns_str_print(s, slen, "=\""); diff --git a/usr.sbin/unbound/smallapp/unbound-anchor.c b/usr.sbin/unbound/smallapp/unbound-anchor.c index 0dcba46f5..4a063e1b8 100644 --- a/usr.sbin/unbound/smallapp/unbound-anchor.c +++ b/usr.sbin/unbound/smallapp/unbound-anchor.c @@ -1593,8 +1593,7 @@ xml_parse_setup(XML_Parser parser, struct xml_data* data, time_t now) /** * Perform XML parsing of the root-anchors file - * Its format description can be read here - * https://data.iana.org/root-anchors/draft-icann-dnssec-trust-anchor.txt + * Its format description can be found in RFC 7958. * It uses libexpat. * @param xml: BIO with xml data. * @param now: the current time for checking DS validity periods. diff --git a/usr.sbin/unbound/smallapp/unbound-checkconf.c b/usr.sbin/unbound/smallapp/unbound-checkconf.c index 0946ef9e8..99692a625 100644 --- a/usr.sbin/unbound/smallapp/unbound-checkconf.c +++ b/usr.sbin/unbound/smallapp/unbound-checkconf.c @@ -714,7 +714,7 @@ morechecks(struct config_file* cfg) cfg->chrootdir, cfg); } #endif - /* remove chroot setting so that modules are not stripping pathnames*/ + /* remove chroot setting so that modules are not stripping pathnames */ free(cfg->chrootdir); cfg->chrootdir = NULL; diff --git a/usr.sbin/unbound/smallapp/unbound-control.c b/usr.sbin/unbound/smallapp/unbound-control.c index de3dd9af0..c4f730061 100644 --- a/usr.sbin/unbound/smallapp/unbound-control.c +++ b/usr.sbin/unbound/smallapp/unbound-control.c @@ -59,6 +59,7 @@ #include "util/locks.h" #include "util/net_help.h" #include "util/shm_side/shm_main.h" +#include "util/timeval_func.h" #include "daemon/stats.h" #include "sldns/wire2str.h" #include "sldns/pkthdr.h" @@ -102,6 +103,12 @@ usage(void) printf(" stop stops the server\n"); printf(" reload reloads the server\n"); printf(" (this flushes data, stats, requestlist)\n"); + printf(" reload_keep_cache reloads the server but tries to\n"); + printf(" keep the RRset and message cache\n"); + printf(" if (re)configuration allows for it.\n"); + printf(" That means the caches sizes and\n"); + printf(" the number of threads must not\n"); + printf(" change between reloads.\n"); printf(" stats print statistics\n"); printf(" stats_noreset peek at statistics\n"); #ifdef HAVE_SHMGET @@ -180,33 +187,6 @@ usage(void) #ifdef HAVE_SHMGET /** what to put on statistics lines between var and value, ": " or "=" */ #define SQ "=" -/** if true, inhibits a lot of =0 lines from the stats output */ -static const int inhibit_zero = 1; -/** divide sum of timers to get average */ -static void -timeval_divide(struct timeval* avg, const struct timeval* sum, long long d) -{ -#ifndef S_SPLINT_S - size_t leftover; - if(d <= 0) { - avg->tv_sec = 0; - avg->tv_usec = 0; - return; - } - avg->tv_sec = sum->tv_sec / d; - avg->tv_usec = sum->tv_usec / d; - /* handle fraction from seconds divide */ - leftover = sum->tv_sec - avg->tv_sec*d; - if(leftover <= 0) - leftover = 0; - avg->tv_usec += (((long long)leftover)*((long long)1000000))/d; - if(avg->tv_sec < 0) - avg->tv_sec = 0; - if(avg->tv_usec < 0) - avg->tv_usec = 0; -#endif -} - /** print unsigned long stats value */ #define PR_UL_NM(str, var) printf("%s."str SQ"%lu\n", nm, (unsigned long)(var)); #define PR_UL(str, var) printf(str SQ"%lu\n", (unsigned long)(var)); @@ -224,10 +204,18 @@ static void pr_stats(const char* nm, struct ub_stats_info* s) PR_UL_NM("num.queries", s->svr.num_queries); PR_UL_NM("num.queries_ip_ratelimited", s->svr.num_queries_ip_ratelimited); + PR_UL_NM("num.queries_cookie_valid", + s->svr.num_queries_cookie_valid); + PR_UL_NM("num.queries_cookie_client", + s->svr.num_queries_cookie_client); + PR_UL_NM("num.queries_cookie_invalid", + s->svr.num_queries_cookie_invalid); PR_UL_NM("num.cachehits", s->svr.num_queries - s->svr.num_queries_missed_cache); PR_UL_NM("num.cachemiss", s->svr.num_queries_missed_cache); PR_UL_NM("num.prefetch", s->svr.num_queries_prefetch); + PR_UL_NM("num.queries_timed_out", s->svr.num_queries_timed_out); + PR_UL_NM("query.queue_time_us.max", s->svr.max_query_time_us); PR_UL_NM("num.expired", s->svr.ans_expired); PR_UL_NM("num.recursivereplies", s->mesh_replies_sent); #ifdef USE_DNSCRYPT @@ -316,7 +304,7 @@ static void print_hist(struct ub_stats_info* s) } /** print extended */ -static void print_extended(struct ub_stats_info* s) +static void print_extended(struct ub_stats_info* s, int inhibit_zero) { int i; char nm[16]; @@ -399,6 +387,9 @@ static void print_extended(struct ub_stats_info* s) PR_UL("rrset.cache.count", s->svr.rrset_cache_count); PR_UL("infra.cache.count", s->svr.infra_cache_count); PR_UL("key.cache.count", s->svr.key_cache_count); + /* max collisions */ + PR_UL("msg.cache.max_collisions", s->svr.msg_cache_max_collisions); + PR_UL("rrset.cache.max_collisions", s->svr.rrset_cache_max_collisions); /* applied RPZ actions */ for(i=0; isvr.num_query_subnet); PR_UL("num.query.subnet_cache", s->svr.num_query_subnet_cache); #endif +#ifdef USE_CACHEDB + PR_UL("num.query.cachedb", s->svr.num_query_cachedb); +#endif } /** print statistics out of memory structures */ @@ -439,7 +433,7 @@ static void do_stats_shm(struct config_file* cfg, struct ub_stats_info* stats, if(cfg->stat_extended) { print_mem(shm_stat, &stats[0]); print_hist(stats); - print_extended(stats); + print_extended(stats, cfg->stat_inhibit_zero); } } #endif /* HAVE_SHMGET */ diff --git a/usr.sbin/unbound/smallapp/unbound-host.c b/usr.sbin/unbound/smallapp/unbound-host.c index 418501487..b686ace54 100644 --- a/usr.sbin/unbound/smallapp/unbound-host.c +++ b/usr.sbin/unbound/smallapp/unbound-host.c @@ -482,6 +482,7 @@ int main(int argc, char* argv[]) case '?': case 'h': default: + ub_ctx_delete(ctx); usage(); } } @@ -495,8 +496,10 @@ int main(int argc, char* argv[]) } argc -= optind; argv += optind; - if(argc != 1) + if(argc != 1) { + ub_ctx_delete(ctx); usage(); + } #ifdef HAVE_SSL #ifdef HAVE_ERR_LOAD_CRYPTO_STRINGS diff --git a/usr.sbin/unbound/testcode/dohclient.c b/usr.sbin/unbound/testcode/dohclient.c index 1e319508c..6b6bfd66d 100644 --- a/usr.sbin/unbound/testcode/dohclient.c +++ b/usr.sbin/unbound/testcode/dohclient.c @@ -226,9 +226,16 @@ make_query(char* qname, char* qtype, char* qclass) printf("cannot parse query name: '%s'\n", qname); exit(1); } - qinfo.qtype = sldns_get_rr_type_by_name(qtype); + if(qinfo.qtype == 0 && strcmp(qtype, "TYPE0") != 0) { + printf("cannot parse query type: '%s'\n", qtype); + exit(1); + } qinfo.qclass = sldns_get_rr_class_by_name(qclass); + if(qinfo.qclass == 0 && strcmp(qclass, "CLASS0") != 0) { + printf("cannot parse query class: '%s'\n", qclass); + exit(1); + } qinfo.local_alias = NULL; qinfo_query_encode(buf, &qinfo); /* flips buffer */ @@ -573,6 +580,7 @@ int main(int argc, char** argv) #endif checklock_start(); log_init(0, 0, 0); + log_ident_set("dohclient"); h2_session = http2_session_create(); if(!h2_session) fatal_exit("out of memory"); diff --git a/usr.sbin/unbound/testcode/fake_event.c b/usr.sbin/unbound/testcode/fake_event.c index 618e739d7..2140b212a 100644 --- a/usr.sbin/unbound/testcode/fake_event.c +++ b/usr.sbin/unbound/testcode/fake_event.c @@ -65,6 +65,7 @@ #include "sldns/wire2str.h" #include "sldns/str2wire.h" #include "daemon/remote.h" +#include "util/timeval_func.h" #include struct worker; struct daemon_remote; @@ -95,20 +96,6 @@ struct fake_commpoint { /** Global variable: the scenario. Saved here for when event_init is done. */ static struct replay_scenario* saved_scenario = NULL; -/** add timers and the values do not overflow or become negative */ -static void -timeval_add(struct timeval* d, const struct timeval* add) -{ -#ifndef S_SPLINT_S - d->tv_sec += add->tv_sec; - d->tv_usec += add->tv_usec; - if(d->tv_usec >= 1000000) { - d->tv_usec -= 1000000; - d->tv_sec++; - } -#endif -} - void fake_temp_file(const char* adj, const char* id, char* buf, size_t len) { @@ -1265,6 +1252,8 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet, if(dnssec) edns.bits = EDNS_DO; edns.padding_block_size = 0; + edns.cookie_present = 0; + edns.cookie_valid = 0; edns.opt_list_in = NULL; edns.opt_list_out = per_upstream_opt_list; edns.opt_list_inplace_cb_out = NULL; diff --git a/usr.sbin/unbound/testcode/lock_verify.c b/usr.sbin/unbound/testcode/lock_verify.c index c9a0657e6..3881d02bb 100644 --- a/usr.sbin/unbound/testcode/lock_verify.c +++ b/usr.sbin/unbound/testcode/lock_verify.c @@ -177,6 +177,8 @@ static int readup_str(char** str, FILE* in) } buf[len] = 0; *str = strdup(buf); + if(!*str) + fatal_exit("strdup failed: out of memory"); return 1; } diff --git a/usr.sbin/unbound/testcode/perf.c b/usr.sbin/unbound/testcode/perf.c index 18d056823..599861810 100644 --- a/usr.sbin/unbound/testcode/perf.c +++ b/usr.sbin/unbound/testcode/perf.c @@ -458,9 +458,17 @@ qlist_parse_line(sldns_buffer* buf, char* p) if(strcmp(tp, "IN") == 0 || strcmp(tp, "CH") == 0) { qinfo.qtype = sldns_get_rr_type_by_name(cl); qinfo.qclass = sldns_get_rr_class_by_name(tp); + if((qinfo.qtype == 0 && strcmp(cl, "TYPE0") != 0) || + (qinfo.qclass == 0 && strcmp(tp, "CLASS0") != 0)) { + return 0; + } } else { qinfo.qtype = sldns_get_rr_type_by_name(tp); qinfo.qclass = sldns_get_rr_class_by_name(cl); + if((qinfo.qtype == 0 && strcmp(tp, "TYPE0") != 0) || + (qinfo.qclass == 0 && strcmp(cl, "CLASS0") != 0)) { + return 0; + } } if(fl[0] == '+') rec = 1; else if(fl[0] == '-') rec = 0; diff --git a/usr.sbin/unbound/testcode/replay.c b/usr.sbin/unbound/testcode/replay.c index 3caf98233..f896a5512 100644 --- a/usr.sbin/unbound/testcode/replay.c +++ b/usr.sbin/unbound/testcode/replay.c @@ -51,6 +51,7 @@ #include "testcode/testpkts.h" #include "testcode/fake_event.h" #include "sldns/str2wire.h" +#include "util/timeval_func.h" /** max length of lines in file */ #define MAX_LINE_LEN 10240 @@ -66,22 +67,6 @@ static char* macro_expand(rbtree_type* store, struct replay_runtime* runtime, char** text); -/** compare of time values */ -static int -timeval_smaller(const struct timeval* x, const struct timeval* y) -{ -#ifndef S_SPLINT_S - if(x->tv_sec < y->tv_sec) - return 1; - else if(x->tv_sec == y->tv_sec) { - if(x->tv_usec <= y->tv_usec) - return 1; - else return 0; - } - else return 0; -#endif -} - /** parse keyword in string. * @param line: if found, the line is advanced to after the keyword. * @param keyword: string. diff --git a/usr.sbin/unbound/testcode/streamtcp.c b/usr.sbin/unbound/testcode/streamtcp.c index cb426c91a..6a81118f9 100644 --- a/usr.sbin/unbound/testcode/streamtcp.c +++ b/usr.sbin/unbound/testcode/streamtcp.c @@ -132,7 +132,15 @@ write_q(int fd, int udp, SSL* ssl, sldns_buffer* buf, uint16_t id, /* qtype and qclass */ qinfo.qtype = sldns_get_rr_type_by_name(strtype); + if(qinfo.qtype == 0 && strcmp(strtype, "TYPE0") != 0) { + printf("cannot parse query type: '%s'\n", strtype); + exit(1); + } qinfo.qclass = sldns_get_rr_class_by_name(strclass); + if(qinfo.qclass == 0 && strcmp(strclass, "CLASS0") != 0) { + printf("cannot parse query class: '%s'\n", strclass); + exit(1); + } /* clear local alias */ qinfo.local_alias = NULL; @@ -371,15 +379,19 @@ static void send_em(const char* svr, const char* pp2_client, int udp, int usessl, int noanswer, int onarrival, int delay, int num, char** qs) { - sldns_buffer* buf = sldns_buffer_new(65553); - sldns_buffer* proxy_buf = sldns_buffer_new(65553); struct sockaddr_storage svr_addr; socklen_t svr_addrlen; int fd = open_svr(svr, udp, &svr_addr, &svr_addrlen); int i, wait_results = 0, pp2_parsed; SSL_CTX* ctx = NULL; SSL* ssl = NULL; - if(!buf) fatal_exit("out of memory"); + sldns_buffer* buf = sldns_buffer_new(65553); + sldns_buffer* proxy_buf = sldns_buffer_new(65553); + if(!buf || !proxy_buf) { + sldns_buffer_free(buf); + sldns_buffer_free(proxy_buf); + fatal_exit("out of memory"); + } pp2_parsed = parse_pp2_client(pp2_client, udp, proxy_buf); if(usessl) { ctx = connect_sslctx_create(NULL, NULL, NULL, 0); diff --git a/usr.sbin/unbound/testcode/testpkts.c b/usr.sbin/unbound/testcode/testpkts.c index b70d4c439..4d35bea93 100644 --- a/usr.sbin/unbound/testcode/testpkts.c +++ b/usr.sbin/unbound/testcode/testpkts.c @@ -21,7 +21,6 @@ */ #include "config.h" -struct sockaddr_storage; #include #include #include @@ -140,6 +139,10 @@ static void matchline(char* line, struct entry* e) e->match_noedns = 1; } else if(str_keyword(&parse, "ednsdata")) { e->match_ednsdata_raw = 1; + } else if(str_keyword(&parse, "client_cookie")) { + e->match_client_cookie = 1; + } else if(str_keyword(&parse, "server_cookie")) { + e->match_server_cookie = 1; } else if(str_keyword(&parse, "UDP")) { e->match_transport = transport_udp; } else if(str_keyword(&parse, "TCP")) { @@ -905,37 +908,64 @@ get_do_flag(uint8_t* pkt, size_t len) return (int)(edns_bits&LDNS_EDNS_MASK_DO_BIT); } -/** Snips the EDE option out of the OPT record and returns the EDNS EDE - * INFO-CODE if found, else -1 */ +/** Snips the specified EDNS option out of the OPT record and puts it in the + * provided buffer. The buffer should be able to hold any opt data ie 65535. + * Returns the length of the option written, + * or 0 if not found, else -1 on error. */ static int -extract_ede(uint8_t* pkt, size_t len) +pkt_snip_edns_option(uint8_t* pkt, size_t len, sldns_edns_option code, + uint8_t* buf) { uint8_t *rdata, *opt_position = pkt; uint16_t rdlen, optlen; size_t remaining = len; - int ede_code; - if(!pkt_find_edns_opt(&opt_position, &remaining)) return -1; + if(!pkt_find_edns_opt(&opt_position, &remaining)) return 0; if(remaining < 8) return -1; /* malformed */ rdlen = sldns_read_uint16(opt_position+6); rdata = opt_position + 8; while(rdlen > 0) { if(rdlen < 4) return -1; /* malformed */ optlen = sldns_read_uint16(rdata+2); - if(sldns_read_uint16(rdata) == LDNS_EDNS_EDE) { - if(rdlen < 6) return -1; /* malformed */ - ede_code = sldns_read_uint16(rdata+4); + if(sldns_read_uint16(rdata) == code) { + /* save data to buf for caller inspection */ + memmove(buf, rdata+4, optlen); /* snip option from packet; assumes len is correct */ memmove(rdata, rdata+4+optlen, (pkt+len)-(rdata+4+optlen)); /* update OPT size */ sldns_write_uint16(opt_position+6, sldns_read_uint16(opt_position+6)-(4+optlen)); - return ede_code; + return optlen; } rdlen -= 4 + optlen; rdata += 4 + optlen; } - return -1; + return 0; +} + +/** Snips the EDE option out of the OPT record and returns the EDNS EDE + * INFO-CODE if found, else -1 */ +static int +extract_ede(uint8_t* pkt, size_t len) +{ + uint8_t buf[65535]; + int buflen = pkt_snip_edns_option(pkt, len, LDNS_EDNS_EDE, buf); + if(buflen < 2 /*ede without text at minimum*/) return -1; + return sldns_read_uint16(buf); +} + +/** Snips the DNS Cookie option out of the OPT record and puts it in the + * provided cookie buffer (should be at least 24 octets). + * Returns the length of the cookie if found, else -1. */ +static int +extract_cookie(uint8_t* pkt, size_t len, uint8_t* cookie) +{ + uint8_t buf[65535]; + int buflen = pkt_snip_edns_option(pkt, len, LDNS_EDNS_COOKIE, buf); + if(buflen != 8 /*client cookie*/ && + buflen != 8 + 16 /*server cookie*/) return -1; + memcpy(cookie, buf, buflen); + return buflen; } /** zero TTLs in packet */ @@ -1530,6 +1560,27 @@ find_match(struct entry* entries, uint8_t* query_pkt, size_t len, continue; } } + /* Cookies could also modify the query_pkt; keep them early */ + if(p->match_client_cookie || p->match_server_cookie) { + uint8_t cookie[24]; + int cookie_len = extract_cookie(query_pkt, len, + cookie); + if(cookie_len == -1) { + verbose(3, "bad DNS Cookie. " + "Expected but not found\n"); + continue; + } else if(p->match_client_cookie && + cookie_len != 8) { + verbose(3, "bad DNS Cookie. Expected client " + "cookie of length 8."); + continue; + } else if((p->match_server_cookie) && + cookie_len != 24) { + verbose(3, "bad DNS Cookie. Expected server " + "cookie of length 24."); + continue; + } + } if(p->match_opcode && get_opcode(query_pkt, len) != get_opcode(reply, rlen)) { verbose(3, "bad opcode\n"); diff --git a/usr.sbin/unbound/testcode/testpkts.h b/usr.sbin/unbound/testcode/testpkts.h index e3bc1f23f..b86c1e74e 100644 --- a/usr.sbin/unbound/testcode/testpkts.h +++ b/usr.sbin/unbound/testcode/testpkts.h @@ -64,6 +64,14 @@ struct sldns_file_parse_state; ; 'ede=any' makes the query match any EDNS EDE info-code. ; It also snips the EDE record out of the packet to facilitate ; other matches. + ; 'client_cookie' makes the query match any DNS Cookie option with + ; with a length of 8 octets. + ; It also snips the DNS Cookie record out of the packet to + ; facilitate other matches. + ; 'server_cookie' makes the query match any DNS Cookie option with + ; with a length of 24 octets. + ; It also snips the DNS Cookie record out of the packet to + ; facilitate other matches. MATCH [opcode] [qtype] [qname] [serial=] [all] [ttl] MATCH [UDP|TCP] DO MATCH ... @@ -104,11 +112,11 @@ struct sldns_file_parse_state; ; be parsed, ADJUST rules for the answer packet ; are ignored. Only copy_id is done. HEX_ANSWER_END - HEX_EDNS_BEGIN ; follow with hex data. + HEX_EDNSDATA_BEGIN ; follow with hex data. ; Raw EDNS data to match against. It must be an ; exact match (all options are matched) and will be ; evaluated only when 'MATCH ednsdata' given. - HEX_EDNS_END + HEX_EDNSDATA_END ENTRY_END @@ -214,6 +222,10 @@ struct entry { uint8_t match_noedns; /** match edns data field given in hex */ uint8_t match_ednsdata_raw; + /** match an DNS cookie of length 8 */ + uint8_t match_client_cookie; + /** match an DNS cookie of length 24 */ + uint8_t match_server_cookie; /** match query serial with this value. */ uint32_t ixfr_soa_serial; /** match on UDP/TCP */ diff --git a/usr.sbin/unbound/testcode/unitlruhash.c b/usr.sbin/unbound/testcode/unitlruhash.c index 1c6e2cfe7..cfd644dab 100644 --- a/usr.sbin/unbound/testcode/unitlruhash.c +++ b/usr.sbin/unbound/testcode/unitlruhash.c @@ -94,7 +94,7 @@ test_bin_find_entry(struct lruhash* table) bin_overflow_remove(&bin, &k->entry); /* find in empty list */ - unit_assert( bin_find_entry(table, &bin, h, k) == NULL ); + unit_assert( bin_find_entry(table, &bin, h, k, NULL) == NULL ); /* insert */ lock_quick_lock(&bin.lock); @@ -102,20 +102,20 @@ test_bin_find_entry(struct lruhash* table) lock_quick_unlock(&bin.lock); /* find, hash not OK. */ - unit_assert( bin_find_entry(table, &bin, myhash(13), k) == NULL ); + unit_assert( bin_find_entry(table, &bin, myhash(13), k, NULL) == NULL ); /* find, hash OK, but cmp not */ unit_assert( k->entry.hash == k2->entry.hash ); - unit_assert( bin_find_entry(table, &bin, h, k2) == NULL ); + unit_assert( bin_find_entry(table, &bin, h, k2, NULL) == NULL ); /* find, hash OK, and cmp too */ - unit_assert( bin_find_entry(table, &bin, h, k) == &k->entry ); + unit_assert( bin_find_entry(table, &bin, h, k, NULL) == &k->entry ); /* remove the element */ lock_quick_lock(&bin.lock); bin_overflow_remove(&bin, &k->entry); lock_quick_unlock(&bin.lock); - unit_assert( bin_find_entry(table, &bin, h, k) == NULL ); + unit_assert( bin_find_entry(table, &bin, h, k, NULL) == NULL ); /* prepend two different elements; so the list is long */ /* one has the same hash, but different cmp */ @@ -127,28 +127,28 @@ test_bin_find_entry(struct lruhash* table) lock_quick_unlock(&bin.lock); /* find, hash not OK. */ - unit_assert( bin_find_entry(table, &bin, myhash(13), k) == NULL ); + unit_assert( bin_find_entry(table, &bin, myhash(13), k, NULL) == NULL ); /* find, hash OK, but cmp not */ unit_assert( k->entry.hash == k2->entry.hash ); - unit_assert( bin_find_entry(table, &bin, h, k2) == NULL ); + unit_assert( bin_find_entry(table, &bin, h, k2, NULL) == NULL ); /* find, hash OK, and cmp too */ - unit_assert( bin_find_entry(table, &bin, h, k) == &k->entry ); + unit_assert( bin_find_entry(table, &bin, h, k, NULL) == &k->entry ); /* remove middle element */ - unit_assert( bin_find_entry(table, &bin, k4->entry.hash, k4) + unit_assert( bin_find_entry(table, &bin, k4->entry.hash, k4, NULL) == &k4->entry ); lock_quick_lock(&bin.lock); bin_overflow_remove(&bin, &k4->entry); lock_quick_unlock(&bin.lock); - unit_assert( bin_find_entry(table, &bin, k4->entry.hash, k4) == NULL); + unit_assert( bin_find_entry(table, &bin, k4->entry.hash, k4, NULL) == NULL); /* remove last element */ lock_quick_lock(&bin.lock); bin_overflow_remove(&bin, &k->entry); lock_quick_unlock(&bin.lock); - unit_assert( bin_find_entry(table, &bin, h, k) == NULL ); + unit_assert( bin_find_entry(table, &bin, h, k, NULL) == NULL ); lock_quick_destroy(&bin.lock); delkey(k); diff --git a/usr.sbin/unbound/testcode/unitmain.c b/usr.sbin/unbound/testcode/unitmain.c index 195e19b69..18741538a 100644 --- a/usr.sbin/unbound/testcode/unitmain.c +++ b/usr.sbin/unbound/testcode/unitmain.c @@ -530,6 +530,207 @@ infra_test(void) config_delete(cfg); } +#include "util/edns.h" +/* Complete version-invalid client cookie; needs a new one. + * Based on edns_cookie_rfc9018_a2 */ +static void +edns_cookie_invalid_version(void) +{ + uint32_t timestamp = 1559734385; + uint8_t client_cookie[] = { + 0x24, 0x64, 0xc4, 0xab, 0xcf, 0x10, 0xc9, 0x57, + 0x99, 0x00, 0x00, 0x00, + 0x5c, 0xf7, 0x9f, 0x11, + 0x1f, 0x81, 0x30, 0xc3, 0xee, 0xe2, 0x94, 0x80 }; + uint8_t server_cookie[] = { + 0x24, 0x64, 0xc4, 0xab, 0xcf, 0x10, 0xc9, 0x57, + 0x01, 0x00, 0x00, 0x00, + 0x5c, 0xf7, 0xa8, 0x71, + 0xd4, 0xa5, 0x64, 0xa1, 0x44, 0x2a, 0xca, 0x77 }; + uint8_t server_secret[] = { + 0xe5, 0xe9, 0x73, 0xe5, 0xa6, 0xb2, 0xa4, 0x3f, + 0x48, 0xe7, 0xdc, 0x84, 0x9e, 0x37, 0xbf, 0xcf }; + uint8_t buf[32]; + /* copy client cookie|version|reserved|timestamp */ + memcpy(buf, client_cookie, 8 + 4 + 4); + /* copy ip 198.51.100.100 */ + memcpy(buf + 16, "\306\063\144\144", 4); + unit_assert(edns_cookie_server_validate(client_cookie, + sizeof(client_cookie), server_secret, sizeof(server_secret), 1, + buf, timestamp) == COOKIE_STATUS_INVALID); + edns_cookie_server_write(buf, server_secret, 1, timestamp); + unit_assert(memcmp(server_cookie, buf, 24) == 0); +} + +/* Complete hash-invalid client cookie; needs a new one. */ +static void +edns_cookie_invalid_hash(void) +{ + uint32_t timestamp = 0; + uint8_t client_cookie[] = { + 0xfc, 0x93, 0xfc, 0x62, 0x80, 0x7d, 0xdb, 0x86, + 0x01, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, + 0x32, 0xF2, 0x43, 0xB9, 0xBC, 0xFE, 0xC4, 0x06 }; + uint8_t server_cookie[] = { + 0xfc, 0x93, 0xfc, 0x62, 0x80, 0x7d, 0xdb, 0x86, + 0x01, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x00, 0x00, + 0xBA, 0x0D, 0x82, 0x90, 0x8F, 0xAA, 0xEB, 0xBD }; + uint8_t server_secret[] = { + 0xe5, 0xe9, 0x73, 0xe5, 0xa6, 0xb2, 0xa4, 0x3f, + 0x48, 0xe7, 0xdc, 0x84, 0x9e, 0x37, 0xbf, 0xcf }; + uint8_t buf[32]; + /* copy client cookie|version|reserved|timestamp */ + memcpy(buf, client_cookie, 8 + 4 + 4); + /* copy ip 203.0.113.203 */ + memcpy(buf + 16, "\313\000\161\313", 4); + unit_assert(edns_cookie_server_validate(client_cookie, + sizeof(client_cookie), server_secret, sizeof(server_secret), 1, + buf, timestamp) == COOKIE_STATUS_INVALID); + edns_cookie_server_write(buf, server_secret, 1, timestamp); + unit_assert(memcmp(server_cookie, buf, 24) == 0); +} + +/* Complete hash-valid client cookie; more than 30 minutes old; needs a + * refreshed server cookie. + * A slightly better variation of edns_cookie_rfc9018_a3 for Unbound to check + * that RESERVED bits do not influence cookie validation. */ +static void +edns_cookie_rfc9018_a3_better(void) +{ + uint32_t timestamp = 1800 + 1; + uint8_t client_cookie[] = { + 0xfc, 0x93, 0xfc, 0x62, 0x80, 0x7d, 0xdb, 0x86, + 0x01, 0xab, 0xcd, 0xef, + 0x00, 0x00, 0x00, 0x00, + 0x32, 0xF2, 0x43, 0xB9, 0xBC, 0xFE, 0xC4, 0x06 }; + uint8_t server_cookie[] = { + 0xfc, 0x93, 0xfc, 0x62, 0x80, 0x7d, 0xdb, 0x86, + 0x01, 0x00, 0x00, 0x00, + 0x00, 0x00, 0x07, 0x09, + 0x62, 0xD5, 0x93, 0x09, 0x14, 0x5C, 0x23, 0x9D }; + uint8_t server_secret[] = { + 0xe5, 0xe9, 0x73, 0xe5, 0xa6, 0xb2, 0xa4, 0x3f, + 0x48, 0xe7, 0xdc, 0x84, 0x9e, 0x37, 0xbf, 0xcf }; + uint8_t buf[32]; + /* copy client cookie|version|reserved|timestamp */ + memcpy(buf, client_cookie, 8 + 4 + 4); + /* copy ip 203.0.113.203 */ + memcpy(buf + 16, "\313\000\161\313", 4); + unit_assert(edns_cookie_server_validate(client_cookie, + sizeof(client_cookie), server_secret, sizeof(server_secret), 1, + buf, timestamp) == COOKIE_STATUS_VALID_RENEW); + edns_cookie_server_write(buf, server_secret, 1, timestamp); + unit_assert(memcmp(server_cookie, buf, 24) == 0); +} + +/* Complete hash-valid client cookie; more than 60 minutes old (expired); + * needs a refreshed server cookie. */ +static void +edns_cookie_rfc9018_a3(void) +{ + uint32_t timestamp = 1559734700; + uint8_t client_cookie[] = { + 0xfc, 0x93, 0xfc, 0x62, 0x80, 0x7d, 0xdb, 0x86, + 0x01, 0xab, 0xcd, 0xef, + 0x5c, 0xf7, 0x8f, 0x71, + 0xa3, 0x14, 0x22, 0x7b, 0x66, 0x79, 0xeb, 0xf5 }; + uint8_t server_cookie[] = { + 0xfc, 0x93, 0xfc, 0x62, 0x80, 0x7d, 0xdb, 0x86, + 0x01, 0x00, 0x00, 0x00, + 0x5c, 0xf7, 0xa9, 0xac, + 0xf7, 0x3a, 0x78, 0x10, 0xac, 0xa2, 0x38, 0x1e }; + uint8_t server_secret[] = { + 0xe5, 0xe9, 0x73, 0xe5, 0xa6, 0xb2, 0xa4, 0x3f, + 0x48, 0xe7, 0xdc, 0x84, 0x9e, 0x37, 0xbf, 0xcf }; + uint8_t buf[32]; + /* copy client cookie|version|reserved|timestamp */ + memcpy(buf, client_cookie, 8 + 4 + 4); + /* copy ip 203.0.113.203 */ + memcpy(buf + 16, "\313\000\161\313", 4); + unit_assert(edns_cookie_server_validate(client_cookie, + sizeof(client_cookie), server_secret, sizeof(server_secret), 1, + buf, timestamp) == COOKIE_STATUS_EXPIRED); + edns_cookie_server_write(buf, server_secret, 1, timestamp); + unit_assert(memcmp(server_cookie, buf, 24) == 0); +} + +/* Complete hash-valid client cookie; more than 30 minutes old; needs a + * refreshed server cookie. */ +static void +edns_cookie_rfc9018_a2(void) +{ + uint32_t timestamp = 1559734385; + uint8_t client_cookie[] = { + 0x24, 0x64, 0xc4, 0xab, 0xcf, 0x10, 0xc9, 0x57, + 0x01, 0x00, 0x00, 0x00, + 0x5c, 0xf7, 0x9f, 0x11, + 0x1f, 0x81, 0x30, 0xc3, 0xee, 0xe2, 0x94, 0x80 }; + uint8_t server_cookie[] = { + 0x24, 0x64, 0xc4, 0xab, 0xcf, 0x10, 0xc9, 0x57, + 0x01, 0x00, 0x00, 0x00, + 0x5c, 0xf7, 0xa8, 0x71, + 0xd4, 0xa5, 0x64, 0xa1, 0x44, 0x2a, 0xca, 0x77 }; + uint8_t server_secret[] = { + 0xe5, 0xe9, 0x73, 0xe5, 0xa6, 0xb2, 0xa4, 0x3f, + 0x48, 0xe7, 0xdc, 0x84, 0x9e, 0x37, 0xbf, 0xcf }; + uint8_t buf[32]; + /* copy client cookie|version|reserved|timestamp */ + memcpy(buf, client_cookie, 8 + 4 + 4); + /* copy ip 198.51.100.100 */ + memcpy(buf + 16, "\306\063\144\144", 4); + unit_assert(edns_cookie_server_validate(client_cookie, + sizeof(client_cookie), server_secret, sizeof(server_secret), 1, + buf, timestamp) == COOKIE_STATUS_VALID_RENEW); + edns_cookie_server_write(buf, server_secret, 1, timestamp); + unit_assert(memcmp(server_cookie, buf, 24) == 0); +} + +/* Only client cookie; needs a complete server cookie. */ +static void +edns_cookie_rfc9018_a1(void) +{ + uint32_t timestamp = 1559731985; + uint8_t client_cookie[] = { + 0x24, 0x64, 0xc4, 0xab, 0xcf, 0x10, 0xc9, 0x57 }; + uint8_t server_cookie[] = { + 0x24, 0x64, 0xc4, 0xab, 0xcf, 0x10, 0xc9, 0x57, + 0x01, 0x00, 0x00, 0x00, + 0x5c, 0xf7, 0x9f, 0x11, + 0x1f, 0x81, 0x30, 0xc3, 0xee, 0xe2, 0x94, 0x80 }; + uint8_t server_secret[] = { + 0xe5, 0xe9, 0x73, 0xe5, 0xa6, 0xb2, 0xa4, 0x3f, + 0x48, 0xe7, 0xdc, 0x84, 0x9e, 0x37, 0xbf, 0xcf }; + uint8_t buf[32]; + /* copy client cookie|version|reserved|timestamp */ + memcpy(buf, server_cookie, 8 + 4 + 4); + /* copy ip 198.51.100.100 */ + memcpy(buf + 16, "\306\063\144\144", 4); + unit_assert(edns_cookie_server_validate(client_cookie, + sizeof(client_cookie), + /* these will not be used; it will return invalid + * because of the size. */ + NULL, 0, 1, NULL, 0) == COOKIE_STATUS_CLIENT_ONLY); + edns_cookie_server_write(buf, server_secret, 1, timestamp); + unit_assert(memcmp(server_cookie, buf, 24) == 0); +} + +/** test interoperable DNS cookies (RFC9018) */ +static void +edns_cookie_test(void) +{ + unit_show_feature("interoperable dns cookies"); + /* Check RFC9018 appendix test vectors */ + edns_cookie_rfc9018_a1(); + edns_cookie_rfc9018_a2(); + edns_cookie_rfc9018_a3(); + /* More tests */ + edns_cookie_rfc9018_a3_better(); + edns_cookie_invalid_hash(); + edns_cookie_invalid_version(); +} + #include "util/random.h" /** test randomness */ static void @@ -839,6 +1040,218 @@ static void respip_test(void) respip_conf_actions_test(); } +#include "util/regional.h" +#include "sldns/sbuffer.h" +#include "util/data/dname.h" +#include "util/data/msgreply.h" +#include "util/data/msgencode.h" +#include "sldns/str2wire.h" + +static void edns_ede_encode_setup(struct edns_data* edns, + struct regional* region) +{ + memset(edns, 0, sizeof(*edns)); + edns->edns_present = 1; + edns->edns_version = EDNS_ADVERTISED_VERSION; + edns->udp_size = EDNS_ADVERTISED_SIZE; + edns->bits &= EDNS_DO; + /* Fill up opt_list_out with EDEs */ + unit_assert( + edns_opt_list_append_ede(&edns->opt_list_out, region, + LDNS_EDE_OTHER, "Too long other text")); + unit_assert( + edns_opt_list_append_ede(&edns->opt_list_out, region, + LDNS_EDE_OTHER, "Too long other text")); + unit_assert( + edns_opt_list_append_ede(&edns->opt_list_out, region, + LDNS_EDE_BLOCKED, "Too long blocked text")); + unit_assert( + edns_opt_list_append_ede(&edns->opt_list_out, region, + LDNS_EDE_OTHER, "Too long other text")); + unit_assert( + edns_opt_list_append_ede(&edns->opt_list_out, region, + LDNS_EDE_BLOCKED, "Too long blocked text")); + /* Fill up opt_list_inplace_cb_out with EDEs */ + unit_assert( + edns_opt_list_append_ede(&edns->opt_list_inplace_cb_out, region, + LDNS_EDE_OTHER, "Too long other text")); + unit_assert( + edns_opt_list_append_ede(&edns->opt_list_inplace_cb_out, region, + LDNS_EDE_OTHER, "Too long other text")); + unit_assert( + edns_opt_list_append_ede(&edns->opt_list_inplace_cb_out, region, + LDNS_EDE_BLOCKED, "Too long blocked text")); + unit_assert( + edns_opt_list_append_ede(&edns->opt_list_inplace_cb_out, region, + LDNS_EDE_OTHER, "Too long other text")); + unit_assert( + edns_opt_list_append_ede(&edns->opt_list_inplace_cb_out, region, + LDNS_EDE_BLOCKED, "Too long blocked text")); + /* append another EDNS option to both lists */ + unit_assert( + edns_opt_list_append(&edns->opt_list_out, + LDNS_EDNS_UNBOUND_CACHEDB_TESTFRAME_TEST, 0, NULL, region)); + unit_assert( + edns_opt_list_append(&edns->opt_list_inplace_cb_out, + LDNS_EDNS_UNBOUND_CACHEDB_TESTFRAME_TEST, 0, NULL, region)); + /* append LDNS_EDE_OTHER at the end of both lists */ + unit_assert( + edns_opt_list_append_ede(&edns->opt_list_out, region, + LDNS_EDE_OTHER, "Too long other text")); + unit_assert( + edns_opt_list_append_ede(&edns->opt_list_inplace_cb_out, region, + LDNS_EDE_OTHER, "Too long other text")); +} + +static void edns_ede_encode_encodedecode(struct query_info* qinfo, + struct reply_info* rep, struct regional* region, + struct edns_data* edns, sldns_buffer* pkt) +{ + /* encode */ + unit_assert( + reply_info_answer_encode(qinfo, rep, 1, rep->flags, pkt, + 0, 0, region, 65535, edns, 0, 0)); + /* buffer ready for reading; skip after the question section */ + sldns_buffer_skip(pkt, LDNS_HEADER_SIZE); + (void)query_dname_len(pkt); + sldns_buffer_skip(pkt, 2 + 2); + /* decode */ + unit_assert(parse_edns_from_query_pkt(pkt, edns, NULL, NULL, NULL, 0, + region) == 0); +} + +static void edns_ede_encode_check(struct edns_data* edns, int* found_ede, + int* found_ede_other, int* found_ede_txt, int* found_other_edns) +{ + struct edns_option* opt; + for(opt = edns->opt_list_in; opt; opt = opt->next) { + if(opt->opt_code == LDNS_EDNS_EDE) { + (*found_ede)++; + if(opt->opt_len > 2) + (*found_ede_txt)++; + if(opt->opt_len >= 2 && sldns_read_uint16( + opt->opt_data) == LDNS_EDE_OTHER) + (*found_ede_other)++; + } else { + (*found_other_edns)++; + } + } + +} + +static void edns_ede_encode_fit_test(struct query_info* qinfo, + struct reply_info* rep, struct regional* region) +{ + struct edns_data edns; + int found_ede = 0, found_ede_other = 0, found_ede_txt = 0; + int found_other_edns = 0; + sldns_buffer* pkt = sldns_buffer_new(65535); + unit_assert(pkt); + edns_ede_encode_setup(&edns, region); + /* leave the pkt buffer as is; everything should fit */ + edns_ede_encode_encodedecode(qinfo, rep, region, &edns, pkt); + edns_ede_encode_check(&edns, &found_ede, &found_ede_other, + &found_ede_txt, &found_other_edns); + unit_assert(found_ede == 12); + unit_assert(found_ede_other == 8); + unit_assert(found_ede_txt == 12); + unit_assert(found_other_edns == 2); + /* cleanup */ + sldns_buffer_free(pkt); +} + +static void edns_ede_encode_notxt_fit_test( struct query_info* qinfo, + struct reply_info* rep, struct regional* region) +{ + struct edns_data edns; + sldns_buffer* pkt; + uint16_t edns_field_size, ede_txt_size; + int found_ede = 0, found_ede_other = 0, found_ede_txt = 0; + int found_other_edns = 0; + edns_ede_encode_setup(&edns, region); + /* pkt buffer should fit everything if the ede txt is cropped. + * OTHER EDE should not be there since it is useless without text. */ + edns_field_size = calc_edns_field_size(&edns); + (void)calc_ede_option_size(&edns, &ede_txt_size); + pkt = sldns_buffer_new(LDNS_HEADER_SIZE + + qinfo->qname_len + + 2 + 2 /* qtype + qclass */ + + 11 /* opt record */ + + edns_field_size + - ede_txt_size); + unit_assert(pkt); + edns_ede_encode_encodedecode(qinfo, rep, region, &edns, pkt); + edns_ede_encode_check(&edns, &found_ede, &found_ede_other, + &found_ede_txt, &found_other_edns); + unit_assert(found_ede == 4); + unit_assert(found_ede_other == 0); + unit_assert(found_ede_txt == 0); + unit_assert(found_other_edns == 2); + /* cleanup */ + sldns_buffer_free(pkt); +} + +static void edns_ede_encode_no_fit_test( struct query_info* qinfo, + struct reply_info* rep, struct regional* region) +{ + struct edns_data edns; + sldns_buffer* pkt; + uint16_t edns_field_size, ede_size, ede_txt_size; + int found_ede = 0, found_ede_other = 0, found_ede_txt = 0; + int found_other_edns = 0; + edns_ede_encode_setup(&edns, region); + /* pkt buffer should fit only non-EDE options. */ + edns_field_size = calc_edns_field_size(&edns); + ede_size = calc_ede_option_size(&edns, &ede_txt_size); + pkt = sldns_buffer_new(LDNS_HEADER_SIZE + + qinfo->qname_len + + 2 + 2 /* qtype + qclass */ + + 11 /* opt record */ + + edns_field_size + - ede_size); + unit_assert(pkt); + edns_ede_encode_encodedecode(qinfo, rep, region, &edns, pkt); + edns_ede_encode_check(&edns, &found_ede, &found_ede_other, + &found_ede_txt, &found_other_edns); + unit_assert(found_ede == 0); + unit_assert(found_ede_other == 0); + unit_assert(found_ede_txt == 0); + unit_assert(found_other_edns == 2); + /* cleanup */ + sldns_buffer_free(pkt); +} + +/** test optional EDE encoding with various buffer + * available sizes */ +static void edns_ede_answer_encode_test(void) +{ + struct regional* region = regional_create(); + struct reply_info* rep; + struct query_info qinfo; + unit_show_feature("edns ede optional encoding"); + unit_assert(region); + rep = construct_reply_info_base(region, + LDNS_RCODE_NOERROR | BIT_QR, 1, + 3600, 3600, 3600, + 0, 0, 0, 0, + sec_status_unchecked, LDNS_EDE_NONE); + unit_assert(rep); + memset(&qinfo, 0, sizeof(qinfo)); + qinfo.qname = sldns_str2wire_dname("encode.ede.", &qinfo.qname_len); + unit_assert(qinfo.qname); + qinfo.qtype = LDNS_RR_TYPE_TXT; + qinfo.qclass = LDNS_RR_CLASS_IN; + + edns_ede_encode_fit_test(&qinfo, rep, region); + edns_ede_encode_notxt_fit_test(&qinfo, rep, region); + edns_ede_encode_no_fit_test(&qinfo, rep, region); + + /* cleanup */ + free(qinfo.qname); + regional_free_all(region); + regional_destroy(region); +} + void unit_show_func(const char* file, const char* func) { printf("test %s:%s\n", file, func); @@ -852,6 +1265,7 @@ void unit_show_feature(const char* feature) #ifdef USE_ECDSA_EVP_WORKAROUND void ecdsa_evp_workaround_init(void); #endif + /** * Main unit test program. Setup, teardown and report errors. * @param argc: arg count. @@ -906,9 +1320,11 @@ main(int argc, char* argv[]) slabhash_test(); infra_test(); ldns_test(); + edns_cookie_test(); zonemd_test(); tcpreuse_test(); msgparse_test(); + edns_ede_answer_encode_test(); #ifdef CLIENT_SUBNET ecs_test(); #endif /* CLIENT_SUBNET */ diff --git a/usr.sbin/unbound/util/config_file.c b/usr.sbin/unbound/util/config_file.c index 503385120..b7aed66dc 100644 --- a/usr.sbin/unbound/util/config_file.c +++ b/usr.sbin/unbound/util/config_file.c @@ -55,6 +55,7 @@ #include "util/regional.h" #include "util/fptr_wlist.h" #include "util/data/dname.h" +#include "util/random.h" #include "util/rtt.h" #include "services/cache/infra.h" #include "sldns/wire2str.h" @@ -87,6 +88,9 @@ struct config_parser_state* cfg_parser = 0; /** init ports possible for use */ static void init_outgoing_availports(int* array, int num); +/** init cookie with random data */ +static void init_cookie_secret(uint8_t* cookie_secret, size_t cookie_secret_len); + struct config_file* config_create(void) { @@ -99,6 +103,7 @@ config_create(void) cfg->stat_interval = 0; cfg->stat_cumulative = 0; cfg->stat_extended = 0; + cfg->stat_inhibit_zero = 1; cfg->num_threads = 1; cfg->port = UNBOUND_DNS_PORT; cfg->do_ip4 = 1; @@ -115,6 +120,7 @@ config_create(void) cfg->tcp_auth_query_timeout = 3 * 1000; /* 3s in millisecs */ cfg->do_tcp_keepalive = 0; cfg->tcp_keepalive_timeout = 120 * 1000; /* 120s in millisecs */ + cfg->sock_queue_timeout = 0; /* do not check timeout */ cfg->ssl_service_key = NULL; cfg->ssl_service_pem = NULL; cfg->ssl_port = UNBOUND_DNS_OVER_TLS_PORT; @@ -232,6 +238,7 @@ config_create(void) cfg->harden_below_nxdomain = 1; cfg->harden_referral_path = 0; cfg->harden_algo_downgrade = 0; + cfg->harden_unknown_additional = 0; cfg->use_caps_bits_for_id = 0; cfg->caps_whitelist = NULL; cfg->private_address = NULL; @@ -299,7 +306,7 @@ config_create(void) cfg->minimal_responses = 1; cfg->rrset_roundrobin = 1; cfg->unknown_server_time_limit = 376; - cfg->max_udp_size = 4096; + cfg->max_udp_size = 1232; /* value taken from edns_buffer_size */ if(!(cfg->server_key_file = strdup(RUN_DIR"/unbound_server.key"))) goto error_exit; if(!(cfg->server_cert_file = strdup(RUN_DIR"/unbound_server.pem"))) @@ -323,6 +330,7 @@ config_create(void) cfg->dnstap_bidirectional = 1; cfg->dnstap_tls = 1; cfg->disable_dnssec_lame_check = 0; + cfg->ip_ratelimit_cookie = 0; cfg->ip_ratelimit = 0; cfg->ratelimit = 0; cfg->ip_ratelimit_slabs = 4; @@ -336,6 +344,8 @@ config_create(void) cfg->ip_ratelimit_backoff = 0; cfg->ratelimit_backoff = 0; cfg->outbound_msg_retry = 5; + cfg->max_sent_count = 32; + cfg->max_query_restarts = 11; cfg->qname_minimisation = 1; cfg->qname_minimisation_strict = 0; cfg->shm_enable = 0; @@ -364,11 +374,17 @@ config_create(void) cfg->ipsecmod_whitelist = NULL; cfg->ipsecmod_strict = 0; #endif + cfg->do_answer_cookie = 0; + memset(cfg->cookie_secret, 0, sizeof(cfg->cookie_secret)); + cfg->cookie_secret_len = 16; + init_cookie_secret(cfg->cookie_secret, cfg->cookie_secret_len); #ifdef USE_CACHEDB if(!(cfg->cachedb_backend = strdup("testframe"))) goto error_exit; if(!(cfg->cachedb_secret = strdup("default"))) goto error_exit; #ifdef USE_REDIS if(!(cfg->redis_server_host = strdup("127.0.0.1"))) goto error_exit; + cfg->redis_server_path = NULL; + cfg->redis_server_password = NULL; cfg->redis_timeout = 100; cfg->redis_server_port = 6379; cfg->redis_expire_records = 0; @@ -516,6 +532,7 @@ int config_set_option(struct config_file* cfg, const char* opt, else S_YNO("use-syslog:", use_syslog) else S_STR("log-identity:", log_identity) else S_YNO("extended-statistics:", stat_extended) + else S_YNO("statistics-inhibit-zero:", stat_inhibit_zero) else S_YNO("statistics-cumulative:", stat_cumulative) else S_YNO("shm-enable:", shm_enable) else S_NUMBER_OR_ZERO("shm-key:", shm_key) @@ -536,6 +553,7 @@ int config_set_option(struct config_file* cfg, const char* opt, else S_NUMBER_NONZERO("tcp-reuse-timeout:", tcp_reuse_timeout) else S_YNO("edns-tcp-keepalive:", do_tcp_keepalive) else S_NUMBER_NONZERO("edns-tcp-keepalive-timeout:", tcp_keepalive_timeout) + else S_NUMBER_OR_ZERO("sock-queue-timeout:", sock_queue_timeout) else S_YNO("ssl-upstream:", ssl_upstream) else S_YNO("tls-upstream:", ssl_upstream) else S_STR("ssl-service-key:", ssl_service_key) @@ -645,6 +663,7 @@ int config_set_option(struct config_file* cfg, const char* opt, else S_YNO("harden-below-nxdomain:", harden_below_nxdomain) else S_YNO("harden-referral-path:", harden_referral_path) else S_YNO("harden-algo-downgrade:", harden_algo_downgrade) + else S_YNO("harden-unknown-additional:", harden_unknown_additional) else S_YNO("use-caps-for-id:", use_caps_bits_for_id) else S_STRLIST("caps-whitelist:", caps_whitelist) else S_SIZET_OR_ZERO("unwanted-reply-threshold:", unwanted_threshold) @@ -761,6 +780,10 @@ int config_set_option(struct config_file* cfg, const char* opt, else S_POW2("dnscrypt-nonce-cache-slabs:", dnscrypt_nonce_cache_slabs) #endif + else if(strcmp(opt, "ip-ratelimit-cookie:") == 0) { + IS_NUMBER_OR_ZERO; cfg->ip_ratelimit_cookie = atoi(val); + infra_ip_ratelimit_cookie=cfg->ip_ratelimit_cookie; + } else if(strcmp(opt, "ip-ratelimit:") == 0) { IS_NUMBER_OR_ZERO; cfg->ip_ratelimit = atoi(val); infra_ip_ratelimit=cfg->ip_ratelimit; @@ -778,6 +801,8 @@ int config_set_option(struct config_file* cfg, const char* opt, else S_YNO("ip-ratelimit-backoff:", ip_ratelimit_backoff) else S_YNO("ratelimit-backoff:", ratelimit_backoff) else S_NUMBER_NONZERO("outbound-msg-retry:", outbound_msg_retry) + else S_NUMBER_NONZERO("max-sent-count:", max_sent_count) + else S_NUMBER_NONZERO("max-query-restarts:", max_query_restarts) else S_SIZET_NONZERO("fast-server-num:", fast_server_num) else S_NUMBER_OR_ZERO("fast-server-permil:", fast_server_permil) else S_YNO("qname-minimisation:", qname_minimisation) @@ -996,6 +1021,7 @@ config_get_option(struct config_file* cfg, const char* opt, else O_DEC(opt, "statistics-interval", stat_interval) else O_YNO(opt, "statistics-cumulative", stat_cumulative) else O_YNO(opt, "extended-statistics", stat_extended) + else O_YNO(opt, "statistics-inhibit-zero", stat_inhibit_zero) else O_YNO(opt, "shm-enable", shm_enable) else O_DEC(opt, "shm-key", shm_key) else O_YNO(opt, "use-syslog", use_syslog) @@ -1055,6 +1081,7 @@ config_get_option(struct config_file* cfg, const char* opt, else O_DEC(opt, "tcp-reuse-timeout", tcp_reuse_timeout) else O_YNO(opt, "edns-tcp-keepalive", do_tcp_keepalive) else O_DEC(opt, "edns-tcp-keepalive-timeout", tcp_keepalive_timeout) + else O_DEC(opt, "sock-queue-timeout", sock_queue_timeout) else O_YNO(opt, "ssl-upstream", ssl_upstream) else O_YNO(opt, "tls-upstream", ssl_upstream) else O_STR(opt, "ssl-service-key", ssl_service_key) @@ -1110,6 +1137,7 @@ config_get_option(struct config_file* cfg, const char* opt, else O_YNO(opt, "harden-below-nxdomain", harden_below_nxdomain) else O_YNO(opt, "harden-referral-path", harden_referral_path) else O_YNO(opt, "harden-algo-downgrade", harden_algo_downgrade) + else O_YNO(opt, "harden-unknown-additional", harden_unknown_additional) else O_YNO(opt, "use-caps-for-id", use_caps_bits_for_id) else O_LST(opt, "caps-whitelist", caps_whitelist) else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold) @@ -1225,6 +1253,7 @@ config_get_option(struct config_file* cfg, const char* opt, else O_LST(opt, "python-script", python_script) else O_LST(opt, "dynlib-file", dynlib_file) else O_YNO(opt, "disable-dnssec-lame-check", disable_dnssec_lame_check) + else O_DEC(opt, "ip-ratelimit-cookie", ip_ratelimit_cookie) else O_DEC(opt, "ip-ratelimit", ip_ratelimit) else O_DEC(opt, "ratelimit", ratelimit) else O_MEM(opt, "ip-ratelimit-size", ip_ratelimit_size) @@ -1238,6 +1267,8 @@ config_get_option(struct config_file* cfg, const char* opt, else O_YNO(opt, "ip-ratelimit-backoff", ip_ratelimit_backoff) else O_YNO(opt, "ratelimit-backoff", ratelimit_backoff) else O_UNS(opt, "outbound-msg-retry", outbound_msg_retry) + else O_UNS(opt, "max-sent-count", max_sent_count) + else O_UNS(opt, "max-query-restarts", max_query_restarts) else O_DEC(opt, "fast-server-num", fast_server_num) else O_DEC(opt, "fast-server-permil", fast_server_permil) else O_DEC(opt, "val-sig-skew-min", val_sig_skew_min) @@ -1278,6 +1309,8 @@ config_get_option(struct config_file* cfg, const char* opt, #ifdef USE_REDIS else O_STR(opt, "redis-server-host", redis_server_host) else O_DEC(opt, "redis-server-port", redis_server_port) + else O_STR(opt, "redis-server-path", redis_server_path) + else O_STR(opt, "redis-server-password", redis_server_password) else O_DEC(opt, "redis-timeout", redis_timeout) else O_YNO(opt, "redis-expire-records", redis_expire_records) #endif /* USE_REDIS */ @@ -1629,6 +1662,7 @@ config_delete(struct config_file* cfg) free(cfg->server_cert_file); free(cfg->control_key_file); free(cfg->control_cert_file); + free(cfg->nat64_prefix); free(cfg->dns64_prefix); config_delstrlist(cfg->dns64_ignore_aaaa); free(cfg->dnstap_socket_path); @@ -1654,6 +1688,8 @@ config_delete(struct config_file* cfg) free(cfg->cachedb_secret); #ifdef USE_REDIS free(cfg->redis_server_host); + free(cfg->redis_server_path); + free(cfg->redis_server_password); #endif /* USE_REDIS */ #endif /* USE_CACHEDB */ #ifdef USE_IPSET @@ -1663,6 +1699,20 @@ config_delete(struct config_file* cfg) free(cfg); } +static void +init_cookie_secret(uint8_t* cookie_secret, size_t cookie_secret_len) +{ + struct ub_randstate *rand = ub_initstate(NULL); + + if (!rand) + fatal_exit("could not init random generator"); + while (cookie_secret_len) { + *cookie_secret++ = (uint8_t)ub_random(rand); + cookie_secret_len--; + } + ub_randfree(rand); +} + static void init_outgoing_availports(int* a, int num) { diff --git a/usr.sbin/unbound/util/config_file.h b/usr.sbin/unbound/util/config_file.h index dba986f41..452f3c6a7 100644 --- a/usr.sbin/unbound/util/config_file.h +++ b/usr.sbin/unbound/util/config_file.h @@ -76,6 +76,8 @@ struct config_file { int stat_cumulative; /** if true, the statistics are kept in greater detail */ int stat_extended; + /** if true, inhibits a lot of =0 lines from the extended stats output */ + int stat_inhibit_zero; /** number of threads to create */ int num_threads; @@ -86,6 +88,8 @@ struct config_file { int do_ip4; /** do ip6 query support. */ int do_ip6; + /** do nat64 on queries */ + int do_nat64; /** prefer ip4 upstream queries. */ int prefer_ip4; /** prefer ip6 upstream queries. */ @@ -114,6 +118,8 @@ struct config_file { int do_tcp_keepalive; /** tcp keepalive timeout, in msec */ int tcp_keepalive_timeout; + /** timeout of packets sitting in the socket queue */ + int sock_queue_timeout; /** proxy protocol ports */ struct config_strlist* proxy_protocol_port; @@ -290,6 +296,9 @@ struct config_file { int harden_referral_path; /** harden against algorithm downgrade */ int harden_algo_downgrade; + /** harden against unknown records in the authority section and in + * the additional section */ + int harden_unknown_additional; /** use 0x20 bits in query as random ID bits */ int use_caps_bits_for_id; /** 0x20 whitelist, domains that do not use capsforid */ @@ -533,6 +542,9 @@ struct config_file { /** ignore AAAAs for these domain names and use A record anyway */ struct config_strlist* dns64_ignore_aaaa; + /* NAT64 prefix; if unset defaults to dns64_prefix */ + char* nat64_prefix; + /** true to enable dnstap support */ int dnstap; /** using bidirectional frame streams if true */ @@ -578,6 +590,9 @@ struct config_file { /** ratelimit for ip addresses. 0 is off, otherwise qps (unless overridden) */ int ip_ratelimit; + /** ratelimit for ip addresses with a valid DNS Cookie. 0 is off, + * otherwise qps (unless overridden) */ + int ip_ratelimit_cookie; /** number of slabs for ip_ratelimit cache */ size_t ip_ratelimit_slabs; /** memory size in bytes for ip_ratelimit cache */ @@ -608,6 +623,11 @@ struct config_file { /** number of retries on outgoing queries */ int outbound_msg_retry; + /** max sent queries per qstate; resets on query restarts (e.g., + * CNAMES) and referrals */ + int max_sent_count; + /** max number of query restarts; determines max length of CNAME chain */ + int max_query_restarts; /** minimise outgoing QNAME and hide original QTYPE if possible */ int qname_minimisation; /** minimise QNAME in strict mode, minimise according to RFC. @@ -684,12 +704,23 @@ struct config_file { char* redis_server_host; /** redis server's TCP port */ int redis_server_port; + /** redis server's unix path. Or "", NULL if unused */ + char* redis_server_path; + /** redis server's AUTH password. Or "", NULL if unused */ + char* redis_server_password; /** timeout (in ms) for communication with the redis server */ int redis_timeout; /** set timeout on redis records based on DNS response ttl */ int redis_expire_records; #endif #endif + /** Downstream DNS Cookies */ + /** do answer with server cookie when request contained cookie option */ + int do_answer_cookie; + /** cookie secret */ + uint8_t cookie_secret[40]; + /** cookie secret length */ + size_t cookie_secret_len; /* ipset module */ #ifdef USE_IPSET @@ -1335,4 +1366,3 @@ int if_is_dnscrypt(const char* ifname, const char* port, int dnscrypt_port); #endif #endif /* UTIL_CONFIG_FILE_H */ - diff --git a/usr.sbin/unbound/util/configlexer.lex b/usr.sbin/unbound/util/configlexer.lex index a7f5639f7..3fcdfa62e 100644 --- a/usr.sbin/unbound/util/configlexer.lex +++ b/usr.sbin/unbound/util/configlexer.lex @@ -227,6 +227,7 @@ outgoing-num-tcp{COLON} { YDVAR(1, VAR_OUTGOING_NUM_TCP) } incoming-num-tcp{COLON} { YDVAR(1, VAR_INCOMING_NUM_TCP) } do-ip4{COLON} { YDVAR(1, VAR_DO_IP4) } do-ip6{COLON} { YDVAR(1, VAR_DO_IP6) } +do-nat64{COLON} { YDVAR(1, VAR_DO_NAT64) } prefer-ip4{COLON} { YDVAR(1, VAR_PREFER_IP4) } prefer-ip6{COLON} { YDVAR(1, VAR_PREFER_IP6) } do-udp{COLON} { YDVAR(1, VAR_DO_UDP) } @@ -240,6 +241,7 @@ tcp-reuse-timeout{COLON} { YDVAR(1, VAR_TCP_REUSE_TIMEOUT) } tcp-auth-query-timeout{COLON} { YDVAR(1, VAR_TCP_AUTH_QUERY_TIMEOUT) } edns-tcp-keepalive{COLON} { YDVAR(1, VAR_EDNS_TCP_KEEPALIVE) } edns-tcp-keepalive-timeout{COLON} { YDVAR(1, VAR_EDNS_TCP_KEEPALIVE_TIMEOUT) } +sock-queue-timeout{COLON} { YDVAR(1, VAR_SOCK_QUEUE_TIMEOUT) } ssl-upstream{COLON} { YDVAR(1, VAR_SSL_UPSTREAM) } tls-upstream{COLON} { YDVAR(1, VAR_SSL_UPSTREAM) } ssl-service-key{COLON} { YDVAR(1, VAR_SSL_SERVICE_KEY) } @@ -316,6 +318,7 @@ harden-dnssec-stripped{COLON} { YDVAR(1, VAR_HARDEN_DNSSEC_STRIPPED) } harden-below-nxdomain{COLON} { YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) } harden-referral-path{COLON} { YDVAR(1, VAR_HARDEN_REFERRAL_PATH) } harden-algo-downgrade{COLON} { YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) } +harden-unknown-additional{COLON} { YDVAR(1, VAR_HARDEN_UNKNOWN_ADDITIONAL) } use-caps-for-id{COLON} { YDVAR(1, VAR_USE_CAPS_FOR_ID) } caps-whitelist{COLON} { YDVAR(1, VAR_CAPS_WHITELIST) } caps-exempt{COLON} { YDVAR(1, VAR_CAPS_WHITELIST) } @@ -438,6 +441,7 @@ insecure-lan-zones{COLON} { YDVAR(1, VAR_INSECURE_LAN_ZONES) } statistics-interval{COLON} { YDVAR(1, VAR_STATISTICS_INTERVAL) } statistics-cumulative{COLON} { YDVAR(1, VAR_STATISTICS_CUMULATIVE) } extended-statistics{COLON} { YDVAR(1, VAR_EXTENDED_STATISTICS) } +statistics-inhibit-zero{COLON} { YDVAR(1, VAR_STATISTICS_INHIBIT_ZERO) } shm-enable{COLON} { YDVAR(1, VAR_SHM_ENABLE) } shm-key{COLON} { YDVAR(1, VAR_SHM_KEY) } remote-control{COLON} { YDVAR(0, VAR_REMOTE_CONTROL) } @@ -461,6 +465,7 @@ max-udp-size{COLON} { YDVAR(1, VAR_MAX_UDP_SIZE) } dns64-prefix{COLON} { YDVAR(1, VAR_DNS64_PREFIX) } dns64-synthall{COLON} { YDVAR(1, VAR_DNS64_SYNTHALL) } dns64-ignore-aaaa{COLON} { YDVAR(1, VAR_DNS64_IGNORE_AAAA) } +nat64-prefix{COLON} { YDVAR(1, VAR_NAT64_PREFIX) } define-tag{COLON} { YDVAR(1, VAR_DEFINE_TAG) } local-zone-tag{COLON} { YDVAR(2, VAR_LOCAL_ZONE_TAG) } access-control-tag{COLON} { YDVAR(2, VAR_ACCESS_CONTROL_TAG) } @@ -502,6 +507,7 @@ dnstap-log-forwarder-response-messages{COLON} { YDVAR(1, VAR_DNSTAP_LOG_FORWARDER_RESPONSE_MESSAGES) } disable-dnssec-lame-check{COLON} { YDVAR(1, VAR_DISABLE_DNSSEC_LAME_CHECK) } ip-ratelimit{COLON} { YDVAR(1, VAR_IP_RATELIMIT) } +ip-ratelimit-cookie{COLON} { YDVAR(1, VAR_IP_RATELIMIT_COOKIE) } ratelimit{COLON} { YDVAR(1, VAR_RATELIMIT) } ip-ratelimit-slabs{COLON} { YDVAR(1, VAR_IP_RATELIMIT_SLABS) } ratelimit-slabs{COLON} { YDVAR(1, VAR_RATELIMIT_SLABS) } @@ -514,6 +520,8 @@ ratelimit-factor{COLON} { YDVAR(1, VAR_RATELIMIT_FACTOR) } ip-ratelimit-backoff{COLON} { YDVAR(1, VAR_IP_RATELIMIT_BACKOFF) } ratelimit-backoff{COLON} { YDVAR(1, VAR_RATELIMIT_BACKOFF) } outbound-msg-retry{COLON} { YDVAR(1, VAR_OUTBOUND_MSG_RETRY) } +max-sent-count{COLON} { YDVAR(1, VAR_MAX_SENT_COUNT) } +max-query-restarts{COLON} { YDVAR(1, VAR_MAX_QUERY_RESTARTS) } low-rtt{COLON} { YDVAR(1, VAR_LOW_RTT) } fast-server-num{COLON} { YDVAR(1, VAR_FAST_SERVER_NUM) } low-rtt-pct{COLON} { YDVAR(1, VAR_FAST_SERVER_PERMIL) } @@ -551,6 +559,8 @@ backend{COLON} { YDVAR(1, VAR_CACHEDB_BACKEND) } secret-seed{COLON} { YDVAR(1, VAR_CACHEDB_SECRETSEED) } redis-server-host{COLON} { YDVAR(1, VAR_CACHEDB_REDISHOST) } redis-server-port{COLON} { YDVAR(1, VAR_CACHEDB_REDISPORT) } +redis-server-path{COLON} { YDVAR(1, VAR_CACHEDB_REDISPATH) } +redis-server-password{COLON} { YDVAR(1, VAR_CACHEDB_REDISPASSWORD) } redis-timeout{COLON} { YDVAR(1, VAR_CACHEDB_REDISTIMEOUT) } redis-expire-records{COLON} { YDVAR(1, VAR_CACHEDB_REDISEXPIRERECORDS) } ipset{COLON} { YDVAR(0, VAR_IPSET) } @@ -558,6 +568,8 @@ name-v4{COLON} { YDVAR(1, VAR_IPSET_NAME_V4) } name-v6{COLON} { YDVAR(1, VAR_IPSET_NAME_V6) } udp-upstream-without-downstream{COLON} { YDVAR(1, VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM) } tcp-connection-limit{COLON} { YDVAR(2, VAR_TCP_CONNECTION_LIMIT) } +answer-cookie{COLON} { YDVAR(1, VAR_ANSWER_COOKIE ) } +cookie-secret{COLON} { YDVAR(1, VAR_COOKIE_SECRET) } edns-client-string{COLON} { YDVAR(2, VAR_EDNS_CLIENT_STRING) } edns-client-string-opcode{COLON} { YDVAR(1, VAR_EDNS_CLIENT_STRING_OPCODE) } nsid{COLON} { YDVAR(1, VAR_NSID ) } diff --git a/usr.sbin/unbound/util/configparser.y b/usr.sbin/unbound/util/configparser.y index 36e9dc1b3..d8f25a67e 100644 --- a/usr.sbin/unbound/util/configparser.y +++ b/usr.sbin/unbound/util/configparser.y @@ -47,6 +47,7 @@ #include "util/configyyrename.h" #include "util/config_file.h" #include "util/net_help.h" +#include "sldns/str2wire.h" int ub_c_lex(void); void ub_c_error(const char *message); @@ -73,9 +74,10 @@ extern struct config_parser_state* cfg_parser; %token VAR_FORCE_TOPLEVEL %token VAR_SERVER VAR_VERBOSITY VAR_NUM_THREADS VAR_PORT %token VAR_OUTGOING_RANGE VAR_INTERFACE VAR_PREFER_IP4 -%token VAR_DO_IP4 VAR_DO_IP6 VAR_PREFER_IP6 VAR_DO_UDP VAR_DO_TCP +%token VAR_DO_IP4 VAR_DO_IP6 VAR_DO_NAT64 VAR_PREFER_IP6 VAR_DO_UDP VAR_DO_TCP %token VAR_TCP_MSS VAR_OUTGOING_TCP_MSS VAR_TCP_IDLE_TIMEOUT %token VAR_EDNS_TCP_KEEPALIVE VAR_EDNS_TCP_KEEPALIVE_TIMEOUT +%token VAR_SOCK_QUEUE_TIMEOUT %token VAR_CHROOT VAR_USERNAME VAR_DIRECTORY VAR_LOGFILE VAR_PIDFILE %token VAR_MSG_CACHE_SIZE VAR_MSG_CACHE_SLABS VAR_NUM_QUERIES_PER_THREAD %token VAR_RRSET_CACHE_SIZE VAR_RRSET_CACHE_SLABS VAR_OUTGOING_NUM_TCP @@ -123,6 +125,7 @@ extern struct config_parser_state* cfg_parser; %token VAR_UNBLOCK_LAN_ZONES VAR_INSECURE_LAN_ZONES %token VAR_INFRA_CACHE_MIN_RTT VAR_INFRA_CACHE_MAX_RTT VAR_INFRA_KEEP_PROBING %token VAR_DNS64_PREFIX VAR_DNS64_SYNTHALL VAR_DNS64_IGNORE_AAAA +%token VAR_NAT64_PREFIX %token VAR_DNSTAP VAR_DNSTAP_ENABLE VAR_DNSTAP_SOCKET_PATH VAR_DNSTAP_IP %token VAR_DNSTAP_TLS VAR_DNSTAP_TLS_SERVER_NAME VAR_DNSTAP_TLS_CERT_BUNDLE %token VAR_DNSTAP_TLS_CLIENT_KEY_FILE VAR_DNSTAP_TLS_CLIENT_CERT_FILE @@ -140,7 +143,7 @@ extern struct config_parser_state* cfg_parser; %token VAR_DISABLE_DNSSEC_LAME_CHECK %token VAR_IP_RATELIMIT VAR_IP_RATELIMIT_SLABS VAR_IP_RATELIMIT_SIZE %token VAR_RATELIMIT VAR_RATELIMIT_SLABS VAR_RATELIMIT_SIZE -%token VAR_OUTBOUND_MSG_RETRY +%token VAR_OUTBOUND_MSG_RETRY VAR_MAX_SENT_COUNT VAR_MAX_QUERY_RESTARTS %token VAR_RATELIMIT_FOR_DOMAIN VAR_RATELIMIT_BELOW_DOMAIN %token VAR_IP_RATELIMIT_FACTOR VAR_RATELIMIT_FACTOR %token VAR_IP_RATELIMIT_BACKOFF VAR_RATELIMIT_BACKOFF @@ -175,12 +178,13 @@ extern struct config_parser_state* cfg_parser; %token VAR_IPSECMOD_MAX_TTL VAR_IPSECMOD_WHITELIST VAR_IPSECMOD_STRICT %token VAR_CACHEDB VAR_CACHEDB_BACKEND VAR_CACHEDB_SECRETSEED %token VAR_CACHEDB_REDISHOST VAR_CACHEDB_REDISPORT VAR_CACHEDB_REDISTIMEOUT -%token VAR_CACHEDB_REDISEXPIRERECORDS +%token VAR_CACHEDB_REDISEXPIRERECORDS VAR_CACHEDB_REDISPATH VAR_CACHEDB_REDISPASSWORD %token VAR_UDP_UPSTREAM_WITHOUT_DOWNSTREAM VAR_FOR_UPSTREAM %token VAR_AUTH_ZONE VAR_ZONEFILE VAR_MASTER VAR_URL VAR_FOR_DOWNSTREAM %token VAR_FALLBACK_ENABLED VAR_TLS_ADDITIONAL_PORT VAR_LOW_RTT VAR_LOW_RTT_PERMIL %token VAR_FAST_SERVER_PERMIL VAR_FAST_SERVER_NUM %token VAR_ALLOW_NOTIFY VAR_TLS_WIN_CERT VAR_TCP_CONNECTION_LIMIT +%token VAR_ANSWER_COOKIE VAR_COOKIE_SECRET VAR_IP_RATELIMIT_COOKIE %token VAR_FORWARD_NO_CACHE VAR_STUB_NO_CACHE VAR_LOG_SERVFAIL VAR_DENY_ANY %token VAR_UNKNOWN_SERVER_TIME_LIMIT VAR_LOG_TAG_QUERYREPLY %token VAR_STREAM_WAIT_SIZE VAR_TLS_CIPHERS VAR_TLS_CIPHERSUITES VAR_TLS_USE_SNI @@ -193,7 +197,8 @@ extern struct config_parser_state* cfg_parser; %token VAR_RPZ_SIGNAL_NXDOMAIN_RA VAR_INTERFACE_AUTOMATIC_PORTS VAR_EDE %token VAR_INTERFACE_ACTION VAR_INTERFACE_VIEW VAR_INTERFACE_TAG %token VAR_INTERFACE_TAG_ACTION VAR_INTERFACE_TAG_DATA -%token VAR_PROXY_PROTOCOL_PORT +%token VAR_PROXY_PROTOCOL_PORT VAR_STATISTICS_INHIBIT_ZERO +%token VAR_HARDEN_UNKNOWN_ADDITIONAL %% toplevelvars: /* empty */ | toplevelvars toplevelvar ; @@ -222,10 +227,11 @@ contents_server: contents_server content_server | ; content_server: server_num_threads | server_verbosity | server_port | server_outgoing_range | server_do_ip4 | - server_do_ip6 | server_prefer_ip4 | server_prefer_ip6 | - server_do_udp | server_do_tcp | + server_do_ip6 | server_do_nat64 | server_prefer_ip4 | + server_prefer_ip6 | server_do_udp | server_do_tcp | server_tcp_mss | server_outgoing_tcp_mss | server_tcp_idle_timeout | server_tcp_keepalive | server_tcp_keepalive_timeout | + server_sock_queue_timeout | server_interface | server_chroot | server_username | server_directory | server_logfile | server_pidfile | server_msg_cache_size | server_msg_cache_slabs | @@ -273,6 +279,7 @@ content_server: server_num_threads | server_verbosity | server_port | server_so_reuseport | server_delay_close | server_udp_connect | server_unblock_lan_zones | server_insecure_lan_zones | server_dns64_prefix | server_dns64_synthall | server_dns64_ignore_aaaa | + server_nat64_prefix | server_infra_cache_min_rtt | server_infra_cache_max_rtt | server_harden_algo_downgrade | server_ip_transparent | server_ip_ratelimit | server_ratelimit | server_ip_dscp | server_infra_keep_probing | @@ -282,6 +289,7 @@ content_server: server_num_threads | server_verbosity | server_port | server_ratelimit_below_domain | server_ratelimit_factor | server_ip_ratelimit_factor | server_ratelimit_backoff | server_ip_ratelimit_backoff | server_outbound_msg_retry | + server_max_sent_count | server_max_query_restarts | server_send_client_subnet | server_client_subnet_zone | server_client_subnet_always_forward | server_client_subnet_opcode | server_max_client_subnet_ipv4 | server_max_client_subnet_ipv6 | @@ -317,12 +325,14 @@ content_server: server_num_threads | server_verbosity | server_port | server_unknown_server_time_limit | server_log_tag_queryreply | server_stream_wait_size | server_tls_ciphers | server_tls_ciphersuites | server_tls_session_ticket_keys | + server_answer_cookie | server_cookie_secret | server_ip_ratelimit_cookie | server_tls_use_sni | server_edns_client_string | server_edns_client_string_opcode | server_nsid | server_zonemd_permissive_mode | server_max_reuse_tcp_queries | server_tcp_reuse_timeout | server_tcp_auth_query_timeout | server_interface_automatic_ports | server_ede | - server_proxy_protocol_port + server_proxy_protocol_port | server_statistics_inhibit_zero | + server_harden_unknown_additional ; stubstart: VAR_STUB_ZONE { @@ -554,6 +564,15 @@ server_extended_statistics: VAR_EXTENDED_STATISTICS STRING_ARG free($2); } ; +server_statistics_inhibit_zero: VAR_STATISTICS_INHIBIT_ZERO STRING_ARG + { + OUTYY(("P(server_statistics_inhibit_zero:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->stat_inhibit_zero = (strcmp($2, "yes")==0); + free($2); + } + ; server_shm_enable: VAR_SHM_ENABLE STRING_ARG { OUTYY(("P(server_shm_enable:%s)\n", $2)); @@ -840,6 +859,15 @@ server_do_ip6: VAR_DO_IP6 STRING_ARG free($2); } ; +server_do_nat64: VAR_DO_NAT64 STRING_ARG + { + OUTYY(("P(server_do_nat64:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->do_nat64 = (strcmp($2, "yes")==0); + free($2); + } + ; server_do_udp: VAR_DO_UDP STRING_ARG { OUTYY(("P(server_do_udp:%s)\n", $2)); @@ -962,6 +990,19 @@ server_tcp_keepalive_timeout: VAR_EDNS_TCP_KEEPALIVE_TIMEOUT STRING_ARG free($2); } ; +server_sock_queue_timeout: VAR_SOCK_QUEUE_TIMEOUT STRING_ARG + { + OUTYY(("P(server_sock_queue_timeout:%s)\n", $2)); + if(atoi($2) == 0 && strcmp($2, "0") != 0) + yyerror("number expected"); + else if (atoi($2) > 6553500) + cfg_parser->cfg->sock_queue_timeout = 6553500; + else if (atoi($2) < 1) + cfg_parser->cfg->sock_queue_timeout = 0; + else cfg_parser->cfg->sock_queue_timeout = atoi($2); + free($2); + } + ; server_tcp_upstream: VAR_TCP_UPSTREAM STRING_ARG { OUTYY(("P(server_tcp_upstream:%s)\n", $2)); @@ -1122,7 +1163,7 @@ server_http_nodelay: VAR_HTTP_NODELAY STRING_ARG yyerror("expected yes or no."); else cfg_parser->cfg->http_nodelay = (strcmp($2, "yes")==0); free($2); - } + }; server_http_notls_downstream: VAR_HTTP_NOTLS_DOWNSTREAM STRING_ARG { OUTYY(("P(server_http_notls_downstream:%s)\n", $2)); @@ -1768,6 +1809,16 @@ server_harden_algo_downgrade: VAR_HARDEN_ALGO_DOWNGRADE STRING_ARG free($2); } ; +server_harden_unknown_additional: VAR_HARDEN_UNKNOWN_ADDITIONAL STRING_ARG + { + OUTYY(("P(server_harden_unknown_additional:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->harden_unknown_additional = + (strcmp($2, "yes")==0); + free($2); + } + ; server_use_caps_for_id: VAR_USE_CAPS_FOR_ID STRING_ARG { OUTYY(("P(server_use_caps_for_id:%s)\n", $2)); @@ -2159,6 +2210,7 @@ server_permit_small_holddown: VAR_PERMIT_SMALL_HOLDDOWN STRING_ARG (strcmp($2, "yes")==0); free($2); } + ; server_key_cache_size: VAR_KEY_CACHE_SIZE STRING_ARG { OUTYY(("P(server_key_cache_size:%s)\n", $2)); @@ -2196,6 +2248,7 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG strcmp($3, "transparent")!=0 && strcmp($3, "nodefault")!=0 && strcmp($3, "typetransparent")!=0 && strcmp($3, "always_transparent")!=0 + && strcmp($3, "block_a")!=0 && strcmp($3, "always_refuse")!=0 && strcmp($3, "always_nxdomain")!=0 && strcmp($3, "always_nodata")!=0 @@ -2208,7 +2261,7 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG yyerror("local-zone type: expected static, deny, " "refuse, redirect, transparent, " "typetransparent, inform, inform_deny, " - "inform_redirect, always_transparent, " + "inform_redirect, always_transparent, block_a," "always_refuse, always_nxdomain, " "always_nodata, always_deny, always_null, " "noview, nodefault or ipset"); @@ -2323,6 +2376,13 @@ server_dns64_ignore_aaaa: VAR_DNS64_IGNORE_AAAA STRING_ARG fatal_exit("out of memory adding dns64-ignore-aaaa"); } ; +server_nat64_prefix: VAR_NAT64_PREFIX STRING_ARG + { + OUTYY(("P(nat64_prefix:%s)\n", $2)); + free(cfg_parser->cfg->nat64_prefix); + cfg_parser->cfg->nat64_prefix = $2; + } + ; server_define_tag: VAR_DEFINE_TAG STRING_ARG { char* p, *s = $2; @@ -2508,6 +2568,15 @@ server_ip_ratelimit: VAR_IP_RATELIMIT STRING_ARG free($2); } ; +server_ip_ratelimit_cookie: VAR_IP_RATELIMIT_COOKIE STRING_ARG + { + OUTYY(("P(server_ip_ratelimit_cookie:%s)\n", $2)); + if(atoi($2) == 0 && strcmp($2, "0") != 0) + yyerror("number expected"); + else cfg_parser->cfg->ip_ratelimit_cookie = atoi($2); + free($2); + } + ; server_ratelimit: VAR_RATELIMIT STRING_ARG { OUTYY(("P(server_ratelimit:%s)\n", $2)); @@ -2636,6 +2705,24 @@ server_outbound_msg_retry: VAR_OUTBOUND_MSG_RETRY STRING_ARG free($2); } ; +server_max_sent_count: VAR_MAX_SENT_COUNT STRING_ARG + { + OUTYY(("P(server_max_sent_count:%s)\n", $2)); + if(atoi($2) == 0 && strcmp($2, "0") != 0) + yyerror("number expected"); + else cfg_parser->cfg->max_sent_count = atoi($2); + free($2); + } + ; +server_max_query_restarts: VAR_MAX_QUERY_RESTARTS STRING_ARG + { + OUTYY(("P(server_max_query_restarts:%s)\n", $2)); + if(atoi($2) == 0 && strcmp($2, "0") != 0) + yyerror("number expected"); + else cfg_parser->cfg->max_query_restarts = atoi($2); + free($2); + } + ; server_low_rtt: VAR_LOW_RTT STRING_ARG { OUTYY(("P(low-rtt option is deprecated, use fast-server-num instead)\n")); @@ -3443,6 +3530,7 @@ py_script: VAR_PYTHON_SCRIPT STRING_ARG if(!cfg_strlist_append_ex(&cfg_parser->cfg->python_script, $2)) yyerror("out of memory"); } + ; dynlibstart: VAR_DYNLIB { OUTYY(("\nP(dynlib:)\n")); @@ -3459,6 +3547,7 @@ dl_file: VAR_DYNLIB_FILE STRING_ARG if(!cfg_strlist_append_ex(&cfg_parser->cfg->dynlib_file, $2)) yyerror("out of memory"); } + ; server_disable_dnssec_lame_check: VAR_DISABLE_DNSSEC_LAME_CHECK STRING_ARG { OUTYY(("P(disable_dnssec_lame_check:%s)\n", $2)); @@ -3519,7 +3608,6 @@ dnsc_dnscrypt_enable: VAR_DNSCRYPT_ENABLE STRING_ARG free($2); } ; - dnsc_dnscrypt_port: VAR_DNSCRYPT_PORT STRING_ARG { OUTYY(("P(dnsc_dnscrypt_port:%s)\n", $2)); @@ -3613,7 +3701,7 @@ contents_cachedb: contents_cachedb content_cachedb | ; content_cachedb: cachedb_backend_name | cachedb_secret_seed | redis_server_host | redis_server_port | redis_timeout | - redis_expire_records + redis_expire_records | redis_server_path | redis_server_password ; cachedb_backend_name: VAR_CACHEDB_BACKEND STRING_ARG { @@ -3666,6 +3754,30 @@ redis_server_port: VAR_CACHEDB_REDISPORT STRING_ARG free($2); } ; +redis_server_path: VAR_CACHEDB_REDISPATH STRING_ARG + { + #if defined(USE_CACHEDB) && defined(USE_REDIS) + OUTYY(("P(redis_server_path:%s)\n", $2)); + free(cfg_parser->cfg->redis_server_path); + cfg_parser->cfg->redis_server_path = $2; + #else + OUTYY(("P(Compiled without cachedb or redis, ignoring)\n")); + free($2); + #endif + } + ; +redis_server_password: VAR_CACHEDB_REDISPASSWORD STRING_ARG + { + #if defined(USE_CACHEDB) && defined(USE_REDIS) + OUTYY(("P(redis_server_password:%s)\n", $2)); + free(cfg_parser->cfg->redis_server_password); + cfg_parser->cfg->redis_server_password = $2; + #else + OUTYY(("P(Compiled without cachedb or redis, ignoring)\n")); + free($2); + #endif + } + ; redis_timeout: VAR_CACHEDB_REDISTIMEOUT STRING_ARG { #if defined(USE_CACHEDB) && defined(USE_REDIS) @@ -3703,6 +3815,31 @@ server_tcp_connection_limit: VAR_TCP_CONNECTION_LIMIT STRING_ARG STRING_ARG } } ; +server_answer_cookie: VAR_ANSWER_COOKIE STRING_ARG + { + OUTYY(("P(server_answer_cookie:%s)\n", $2)); + if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) + yyerror("expected yes or no."); + else cfg_parser->cfg->do_answer_cookie = (strcmp($2, "yes")==0); + free($2); + } + ; +server_cookie_secret: VAR_COOKIE_SECRET STRING_ARG + { + uint8_t secret[32]; + size_t secret_len = sizeof(secret); + + OUTYY(("P(server_cookie_secret:%s)\n", $2)); + if(sldns_str2wire_hex_buf($2, secret, &secret_len) + || (secret_len != 16)) + yyerror("expected 128 bit hex string"); + else { + cfg_parser->cfg->cookie_secret_len = secret_len; + memcpy(cfg_parser->cfg->cookie_secret, secret, sizeof(secret)); + } + free($2); + } + ; ipsetstart: VAR_IPSET { OUTYY(("\nP(ipset:)\n")); @@ -3772,10 +3909,11 @@ validate_acl_action(const char* action) strcmp(action, "refuse_non_local")!=0 && strcmp(action, "allow_setrd")!=0 && strcmp(action, "allow")!=0 && - strcmp(action, "allow_snoop")!=0) + strcmp(action, "allow_snoop")!=0 && + strcmp(action, "allow_cookie")!=0) { yyerror("expected deny, refuse, deny_non_local, " - "refuse_non_local, allow, allow_setrd or " - "allow_snoop as access control action"); + "refuse_non_local, allow, allow_setrd, " + "allow_snoop or allow_cookie as access control action"); } } diff --git a/usr.sbin/unbound/util/data/msgencode.c b/usr.sbin/unbound/util/data/msgencode.c index a0adabd82..933f6dc65 100644 --- a/usr.sbin/unbound/util/data/msgencode.c +++ b/usr.sbin/unbound/util/data/msgencode.c @@ -806,6 +806,95 @@ calc_edns_field_size(struct edns_data* edns) return 1 + 2 + 2 + 4 + 2 + rdatalen; } +uint16_t +calc_edns_option_size(struct edns_data* edns, uint16_t code) +{ + size_t rdatalen = 0; + struct edns_option* opt; + if(!edns || !edns->edns_present) + return 0; + for(opt = edns->opt_list_inplace_cb_out; opt; opt = opt->next) { + if(opt->opt_code == code) + rdatalen += 4 + opt->opt_len; + } + for(opt = edns->opt_list_out; opt; opt = opt->next) { + if(opt->opt_code == code) + rdatalen += 4 + opt->opt_len; + } + return rdatalen; +} + +uint16_t +calc_ede_option_size(struct edns_data* edns, uint16_t* txt_size) +{ + size_t rdatalen = 0; + struct edns_option* opt; + *txt_size = 0; + if(!edns || !edns->edns_present) + return 0; + for(opt = edns->opt_list_inplace_cb_out; opt; opt = opt->next) { + if(opt->opt_code == LDNS_EDNS_EDE) { + rdatalen += 4 + opt->opt_len; + if(opt->opt_len > 2) *txt_size += opt->opt_len - 2; + if(opt->opt_len >= 2 && sldns_read_uint16( + opt->opt_data) == LDNS_EDE_OTHER) { + *txt_size += 4 + 2; + } + } + } + for(opt = edns->opt_list_out; opt; opt = opt->next) { + if(opt->opt_code == LDNS_EDNS_EDE) { + rdatalen += 4 + opt->opt_len; + if(opt->opt_len > 2) *txt_size += opt->opt_len - 2; + if(opt->opt_len >= 2 && sldns_read_uint16( + opt->opt_data) == LDNS_EDE_OTHER) { + *txt_size += 4 + 2; + } + } + } + return rdatalen; +} + +/* Trims the EDE OPTION-DATA to not include any EXTRA-TEXT data. + * Also removes any LDNS_EDE_OTHER options from the list since they are useless + * without the extra text. */ +static void +ede_trim_text(struct edns_option** list) +{ + struct edns_option* curr, *prev = NULL; + if(!list || !(*list)) return; + /* Unlink and repoint if LDNS_EDE_OTHER are first in list */ + while(list && *list && (*list)->opt_code == LDNS_EDNS_EDE + && (*list)->opt_len >= 2 + && sldns_read_uint16((*list)->opt_data) == LDNS_EDE_OTHER ) { + *list = (*list)->next; + } + if(!list || !(*list)) return; + curr = *list; + while(curr) { + if(curr->opt_code == LDNS_EDNS_EDE) { + if(curr->opt_len >= 2 && sldns_read_uint16( + curr->opt_data) == LDNS_EDE_OTHER) { + /* LDNS_EDE_OTHER cannot be the first option in + * this while, so prev is always initialized at + * this point from the other branches; + * cut this option off */ + prev->next = curr->next; + curr = curr->next; + } else if(curr->opt_len > 2) { + /* trim this option's EXTRA-TEXT */ + curr->opt_len = 2; + prev = curr; + curr = curr->next; + } + } else { + /* continue */ + prev = curr; + curr = curr->next; + } + } +} + static void attach_edns_record_max_msg_sz(sldns_buffer* pkt, struct edns_data* edns, uint16_t max_msg_sz) @@ -894,6 +983,7 @@ reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep, { uint16_t flags; unsigned int attach_edns = 0; + uint16_t edns_field_size, ede_size, ede_txt_size; if(!cached || rep->authoritative) { /* original flags, copy RD and CD bits from query. */ @@ -916,25 +1006,39 @@ reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep, log_assert(flags & BIT_QR); /* QR bit must be on in our replies */ if(udpsize < LDNS_HEADER_SIZE) return 0; + /* currently edns does not change during calculations; + * calculate sizes once here */ + edns_field_size = calc_edns_field_size(edns); + ede_size = calc_ede_option_size(edns, &ede_txt_size); if(sldns_buffer_capacity(pkt) < udpsize) udpsize = sldns_buffer_capacity(pkt); - if(udpsize < LDNS_HEADER_SIZE + calc_edns_field_size(edns)) { + /* EDEs are optional, try to fit anything else before them */ + if(udpsize < LDNS_HEADER_SIZE + edns_field_size - ede_size) { /* packet too small to contain edns, omit it. */ attach_edns = 0; } else { /* reserve space for edns record */ - attach_edns = (unsigned int)calc_edns_field_size(edns); - udpsize -= attach_edns; + attach_edns = (unsigned int)edns_field_size - ede_size; } if(!reply_info_encode(qinf, rep, id, flags, pkt, timenow, region, - udpsize, dnssec, MINIMAL_RESPONSES)) { + udpsize - attach_edns, dnssec, MINIMAL_RESPONSES)) { log_err("reply encode: out of memory"); return 0; } - if(attach_edns && sldns_buffer_capacity(pkt) >= - sldns_buffer_limit(pkt)+attach_edns) - attach_edns_record_max_msg_sz(pkt, edns, udpsize+attach_edns); + if(attach_edns) { + if(udpsize >= sldns_buffer_limit(pkt) + edns_field_size) + attach_edns_record_max_msg_sz(pkt, edns, udpsize); + else if(udpsize >= sldns_buffer_limit(pkt) + edns_field_size - ede_txt_size) { + ede_trim_text(&edns->opt_list_inplace_cb_out); + ede_trim_text(&edns->opt_list_out); + attach_edns_record_max_msg_sz(pkt, edns, udpsize); + } else if(udpsize >= sldns_buffer_limit(pkt) + edns_field_size - ede_size) { + edns_opt_list_remove(&edns->opt_list_inplace_cb_out, LDNS_EDNS_EDE); + edns_opt_list_remove(&edns->opt_list_out, LDNS_EDNS_EDE); + attach_edns_record_max_msg_sz(pkt, edns, udpsize); + } + } return 1; } @@ -959,14 +1063,16 @@ qinfo_query_encode(sldns_buffer* pkt, struct query_info* qinfo) } void -error_encode(sldns_buffer* buf, int r, struct query_info* qinfo, - uint16_t qid, uint16_t qflags, struct edns_data* edns) +extended_error_encode(sldns_buffer* buf, uint16_t rcode, + struct query_info* qinfo, uint16_t qid, uint16_t qflags, + uint16_t xflags, struct edns_data* edns) { uint16_t flags; sldns_buffer_clear(buf); sldns_buffer_write(buf, &qid, sizeof(uint16_t)); - flags = (uint16_t)(BIT_QR | BIT_RA | r); /* QR and retcode*/ + flags = (uint16_t)(BIT_QR | BIT_RA | (rcode & 0xF)); /* QR and retcode*/ + flags |= xflags; flags |= (qflags & (BIT_RD|BIT_CD)); /* copy RD and CD bit */ sldns_buffer_write_u16(buf, flags); if(qinfo) flags = 1; @@ -993,11 +1099,25 @@ error_encode(sldns_buffer* buf, int r, struct query_info* qinfo, struct edns_data es = *edns; es.edns_version = EDNS_ADVERTISED_VERSION; es.udp_size = EDNS_ADVERTISED_SIZE; - es.ext_rcode = 0; + es.ext_rcode = (uint8_t)(rcode >> 4); es.bits &= EDNS_DO; if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) > - edns->udp_size) - return; + edns->udp_size) { + edns_opt_list_remove(&es.opt_list_inplace_cb_out, LDNS_EDNS_EDE); + edns_opt_list_remove(&es.opt_list_out, LDNS_EDNS_EDE); + if(sldns_buffer_limit(buf) + calc_edns_field_size(&es) > + edns->udp_size) { + return; + } + } attach_edns_record(buf, &es); } } + +void +error_encode(sldns_buffer* buf, int r, struct query_info* qinfo, + uint16_t qid, uint16_t qflags, struct edns_data* edns) +{ + extended_error_encode(buf, (r & 0x000F), qinfo, qid, qflags, + (r & 0xFFF0), edns); +} diff --git a/usr.sbin/unbound/util/data/msgencode.h b/usr.sbin/unbound/util/data/msgencode.h index 439892ebf..dce4551ab 100644 --- a/usr.sbin/unbound/util/data/msgencode.h +++ b/usr.sbin/unbound/util/data/msgencode.h @@ -108,6 +108,27 @@ void qinfo_query_encode(struct sldns_buffer* pkt, struct query_info* qinfo); */ uint16_t calc_edns_field_size(struct edns_data* edns); +/** + * Calculate the size of a specific EDNS option in packet. + * @param edns: edns data or NULL. + * @param code: the opt code to get the size of. + * @return octets the option will take up. + */ +uint16_t calc_edns_option_size(struct edns_data* edns, uint16_t code); + +/** + * Calculate the size of the EDE option(s) in packet. Also calculate seperately + * the size of the EXTRA-TEXT field(s) in case we can trim them to fit. + * In this case include any LDNS_EDE_OTHER options in their entirety since they + * are useless without extra text. + * @param edns: edns data or NULL. + * @param txt_size: the size of the EXTRA-TEXT field(s); this includes + * LDNS_EDE_OTHER in their entirety since they are useless without + * extra text. + * @return octets the option will take up. + */ +uint16_t calc_ede_option_size(struct edns_data* edns, uint16_t* txt_size); + /** * Attach EDNS record to buffer. Buffer has complete packet. There must * be enough room left for the EDNS record. @@ -120,7 +141,7 @@ void attach_edns_record(struct sldns_buffer* pkt, struct edns_data* edns); * Encode an error. With QR and RA set. * * @param pkt: where to store the packet. - * @param r: RCODE value to encode. + * @param r: RCODE value to encode (may contain extra flags). * @param qinfo: if not NULL, the query is included. * @param qid: query ID to set in packet. network order. * @param qflags: original query flags (to copy RD and CD bits). host order. @@ -130,4 +151,21 @@ void attach_edns_record(struct sldns_buffer* pkt, struct edns_data* edns); void error_encode(struct sldns_buffer* pkt, int r, struct query_info* qinfo, uint16_t qid, uint16_t qflags, struct edns_data* edns); +/** + * Encode an extended error. With QR and RA set. + * + * @param pkt: where to store the packet. + * @param rcode: Extended RCODE value to encode. + * @param qinfo: if not NULL, the query is included. + * @param qid: query ID to set in packet. network order. + * @param qflags: original query flags (to copy RD and CD bits). host order. + * @param xflags: extra flags to set (such as for example BIT_AA and/or BIT_TC) + * @param edns: if not NULL, this is the query edns info, + * and an edns reply is attached. Only attached if EDNS record fits reply. + * Without edns extended errors (i.e. > 15) will not be conveyed. + */ +void extended_error_encode(struct sldns_buffer* pkt, uint16_t rcode, + struct query_info* qinfo, uint16_t qid, uint16_t qflags, + uint16_t xflags, struct edns_data* edns); + #endif /* UTIL_DATA_MSGENCODE_H */ diff --git a/usr.sbin/unbound/util/data/msgparse.c b/usr.sbin/unbound/util/data/msgparse.c index f1aef2e55..880cf89ae 100644 --- a/usr.sbin/unbound/util/data/msgparse.c +++ b/usr.sbin/unbound/util/data/msgparse.c @@ -45,6 +45,8 @@ #include "util/netevent.h" #include "util/storage/lookup3.h" #include "util/regional.h" +#include "util/rfc_1982.h" +#include "util/edns.h" #include "sldns/rrdef.h" #include "sldns/sbuffer.h" #include "sldns/parseutil.h" @@ -940,22 +942,11 @@ parse_packet(sldns_buffer* pkt, struct msg_parse* msg, struct regional* region) return 0; } -static int -edns_opt_list_append_keepalive(struct edns_option** list, int msec, - struct regional* region) -{ - uint8_t data[2]; /* For keepalive value */ - data[0] = (uint8_t)((msec >> 8) & 0xff); - data[1] = (uint8_t)(msec & 0xff); - return edns_opt_list_append(list, LDNS_EDNS_KEEPALIVE, sizeof(data), - data, region); -} - /** parse EDNS options from EDNS wireformat rdata */ static int parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len, struct edns_data* edns, struct config_file* cfg, struct comm_point* c, - struct regional* region) + struct comm_reply* repinfo, uint32_t now, struct regional* region) { /* To respond with a Keepalive option, the client connection must have * received one message with a TCP Keepalive EDNS option, and that @@ -979,6 +970,10 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len, while(rdata_len >= 4) { uint16_t opt_code = sldns_read_uint16(rdata_ptr); uint16_t opt_len = sldns_read_uint16(rdata_ptr+2); + uint8_t server_cookie[40]; + enum edns_cookie_val_status cookie_val_status; + int cookie_is_v4 = 1; + rdata_ptr += 4; rdata_len -= 4; if(opt_len > rdata_len) @@ -1041,6 +1036,76 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len, edns->padding_block_size = cfg->pad_responses_block_size; break; + case LDNS_EDNS_COOKIE: + if(!cfg || !cfg->do_answer_cookie || !repinfo) + break; + if(opt_len != 8 && (opt_len < 16 || opt_len > 40)) { + verbose(VERB_ALGO, "worker request: " + "badly formatted cookie"); + return LDNS_RCODE_FORMERR; + } + edns->cookie_present = 1; + + /* Copy client cookie, version and timestamp for + * validation and creation purposes. + */ + if(opt_len >= 16) { + memmove(server_cookie, rdata_ptr, 16); + } else { + memset(server_cookie, 0, 16); + memmove(server_cookie, rdata_ptr, opt_len); + } + + /* Copy client ip for validation and creation + * purposes. It will be overwritten if (re)creation + * is needed. + */ + if(repinfo->remote_addr.ss_family == AF_INET) { + memcpy(server_cookie + 16, + &((struct sockaddr_in*)&repinfo->remote_addr)->sin_addr, 4); + } else { + cookie_is_v4 = 0; + memcpy(server_cookie + 16, + &((struct sockaddr_in6*)&repinfo->remote_addr)->sin6_addr, 16); + } + + cookie_val_status = edns_cookie_server_validate( + rdata_ptr, opt_len, cfg->cookie_secret, + cfg->cookie_secret_len, cookie_is_v4, + server_cookie, now); + switch(cookie_val_status) { + case COOKIE_STATUS_VALID: + case COOKIE_STATUS_VALID_RENEW: + edns->cookie_valid = 1; + /* Reuse cookie */ + if(!edns_opt_list_append( + &edns->opt_list_out, LDNS_EDNS_COOKIE, + opt_len, rdata_ptr, region)) { + log_err("out of memory"); + return LDNS_RCODE_SERVFAIL; + } + /* Cookie to be reused added to outgoing + * options. Done! + */ + break; + case COOKIE_STATUS_CLIENT_ONLY: + edns->cookie_client = 1; + /* fallthrough */ + case COOKIE_STATUS_FUTURE: + case COOKIE_STATUS_EXPIRED: + case COOKIE_STATUS_INVALID: + default: + edns_cookie_server_write(server_cookie, + cfg->cookie_secret, cookie_is_v4, now); + if(!edns_opt_list_append(&edns->opt_list_out, + LDNS_EDNS_COOKIE, 24, server_cookie, + region)) { + log_err("out of memory"); + return LDNS_RCODE_SERVFAIL; + } + break; + } + break; default: break; } @@ -1115,6 +1180,8 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg, edns->opt_list_out = NULL; edns->opt_list_inplace_cb_out = NULL; edns->padding_block_size = 0; + edns->cookie_present = 0; + edns->cookie_valid = 0; /* take the options */ rdata_len = found->rr_first->size-2; @@ -1170,7 +1237,8 @@ skip_pkt_rrs(sldns_buffer* pkt, int num) int parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns, - struct config_file* cfg, struct comm_point* c, struct regional* region) + struct config_file* cfg, struct comm_point* c, + struct comm_reply* repinfo, time_t now, struct regional* region) { size_t rdata_len; uint8_t* rdata_ptr; @@ -1206,6 +1274,8 @@ parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns, edns->opt_list_out = NULL; edns->opt_list_inplace_cb_out = NULL; edns->padding_block_size = 0; + edns->cookie_present = 0; + edns->cookie_valid = 0; /* take the options */ rdata_len = sldns_buffer_read_u16(pkt); @@ -1214,7 +1284,7 @@ parse_edns_from_query_pkt(sldns_buffer* pkt, struct edns_data* edns, rdata_ptr = sldns_buffer_current(pkt); /* ignore rrsigs */ return parse_edns_options_from_query(rdata_ptr, rdata_len, edns, cfg, - c, region); + c, repinfo, now, region); } void diff --git a/usr.sbin/unbound/util/data/msgparse.h b/usr.sbin/unbound/util/data/msgparse.h index 1ad436742..5c98026cb 100644 --- a/usr.sbin/unbound/util/data/msgparse.h +++ b/usr.sbin/unbound/util/data/msgparse.h @@ -72,6 +72,7 @@ struct regional; struct edns_option; struct config_file; struct comm_point; +struct comm_reply; /** number of buckets in parse rrset hash table. Must be power of 2. */ #define PARSE_TABLE_SIZE 32 @@ -217,8 +218,6 @@ struct rr_parse { * region. */ struct edns_data { - /** if EDNS OPT record was present */ - int edns_present; /** Extended RCODE */ uint8_t ext_rcode; /** The EDNS version number */ @@ -238,7 +237,15 @@ struct edns_data { struct edns_option* opt_list_inplace_cb_out; /** block size to pad */ uint16_t padding_block_size; -}; + /** if EDNS OPT record was present */ + unsigned int edns_present : 1; + /** if a cookie was present */ + unsigned int cookie_present : 1; + /** if the cookie validated */ + unsigned int cookie_valid : 1; + /** if the cookie holds only the client part */ + unsigned int cookie_client : 1; +}; /** * EDNS option @@ -310,12 +317,15 @@ int skip_pkt_rrs(struct sldns_buffer* pkt, int num); * initialised. * @param cfg: the configuration (with nsid value etc.) * @param c: commpoint to determine transport (if needed) + * @param repinfo: commreply to determine the client address + * @param now: current time * @param region: region to alloc results in (edns option contents) * @return: 0 on success, or an RCODE on error. * RCODE formerr if OPT is badly formatted and so on. */ int parse_edns_from_query_pkt(struct sldns_buffer* pkt, struct edns_data* edns, - struct config_file* cfg, struct comm_point* c, struct regional* region); + struct config_file* cfg, struct comm_point* c, + struct comm_reply* repinfo, time_t now, struct regional* region); /** * Calculate hash value for rrset in packet. diff --git a/usr.sbin/unbound/util/data/msgreply.c b/usr.sbin/unbound/util/data/msgreply.c index 14925de7d..bf7e96286 100644 --- a/usr.sbin/unbound/util/data/msgreply.c +++ b/usr.sbin/unbound/util/data/msgreply.c @@ -94,7 +94,7 @@ parse_create_qinfo(sldns_buffer* pkt, struct msg_parse* msg, struct reply_info* construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd, time_t ttl, time_t prettl, time_t expttl, size_t an, size_t ns, - size_t ar, size_t total, enum sec_status sec) + size_t ar, size_t total, enum sec_status sec, sldns_ede_code reason_bogus) { struct reply_info* rep; /* rrset_count-1 because the first ref is part of the struct. */ @@ -117,7 +117,9 @@ construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd, rep->ar_numrrsets = ar; rep->rrset_count = total; rep->security = sec; - rep->reason_bogus = LDNS_EDE_NONE; + rep->reason_bogus = reason_bogus; + /* this is only allocated and used for caching on copy */ + rep->reason_bogus_str = NULL; rep->authoritative = 0; /* array starts after the refs */ if(region) @@ -137,7 +139,7 @@ parse_create_repinfo(struct msg_parse* msg, struct reply_info** rep, { *rep = construct_reply_info_base(region, msg->flags, msg->qdcount, 0, 0, 0, msg->an_rrsets, msg->ns_rrsets, msg->ar_rrsets, - msg->rrset_count, sec_status_unchecked); + msg->rrset_count, sec_status_unchecked, LDNS_EDE_NONE); if(!*rep) return 0; return 1; @@ -182,7 +184,7 @@ make_new_reply_info(const struct reply_info* rep, struct regional* region, new_rep = construct_reply_info_base(region, rep->flags, rep->qdcount, rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl, an_numrrsets, 0, 0, an_numrrsets, - sec_status_insecure); + sec_status_insecure, LDNS_EDE_NONE); if(!new_rep) return NULL; if(!reply_info_alloc_rrset_keys(new_rep, NULL, region)) @@ -580,6 +582,10 @@ reply_info_parsedelete(struct reply_info* rep, struct alloc_cache* alloc) for(i=0; irrset_count; i++) { ub_packed_rrset_parsedelete(rep->rrsets[i], alloc); } + if(rep->reason_bogus_str) { + free(rep->reason_bogus_str); + rep->reason_bogus_str = NULL; + } free(rep); } @@ -661,6 +667,10 @@ void reply_info_delete(void* d, void* ATTR_UNUSED(arg)) { struct reply_info* r = (struct reply_info*)d; + if(r->reason_bogus_str) { + free(r->reason_bogus_str); + r->reason_bogus_str = NULL; + } free(r); } @@ -745,9 +755,28 @@ reply_info_copy(struct reply_info* rep, struct alloc_cache* alloc, cp = construct_reply_info_base(region, rep->flags, rep->qdcount, rep->ttl, rep->prefetch_ttl, rep->serve_expired_ttl, rep->an_numrrsets, rep->ns_numrrsets, rep->ar_numrrsets, - rep->rrset_count, rep->security); + rep->rrset_count, rep->security, rep->reason_bogus); if(!cp) return NULL; + + if(rep->reason_bogus_str && *rep->reason_bogus_str != 0) { + if(region) { + cp->reason_bogus_str = (char*)regional_alloc(region, + sizeof(char) + * (strlen(rep->reason_bogus_str)+1)); + } else { + cp->reason_bogus_str = malloc(sizeof(char) + * (strlen(rep->reason_bogus_str)+1)); + } + if(!cp->reason_bogus_str) { + if(!region) + reply_info_parsedelete(cp, alloc); + return NULL; + } + memcpy(cp->reason_bogus_str, rep->reason_bogus_str, + strlen(rep->reason_bogus_str)+1); + } + /* allocate ub_key structures special or not */ if(!reply_info_alloc_rrset_keys(cp, alloc, region)) { if(!region) @@ -1020,6 +1049,16 @@ int edns_opt_list_append_ede(struct edns_option** list, struct regional* region, return 1; } +int edns_opt_list_append_keepalive(struct edns_option** list, int msec, + struct regional* region) +{ + uint8_t data[2]; /* For keepalive value */ + data[0] = (uint8_t)((msec >> 8) & 0xff); + data[1] = (uint8_t)(msec & 0xff); + return edns_opt_list_append(list, LDNS_EDNS_KEEPALIVE, sizeof(data), + data, region); +} + int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len, uint8_t* data, struct regional* region) { @@ -1195,7 +1234,7 @@ int inplace_cb_query_response_call(struct module_env* env, } struct edns_option* edns_opt_copy_region(struct edns_option* list, - struct regional* region) + struct regional* region) { struct edns_option* result = NULL, *cur = NULL, *s; while(list) { @@ -1224,6 +1263,42 @@ struct edns_option* edns_opt_copy_region(struct edns_option* list, return result; } +struct edns_option* edns_opt_copy_filter_region(struct edns_option* list, + uint16_t* filter_list, size_t filter_list_len, struct regional* region) +{ + struct edns_option* result = NULL, *cur = NULL, *s; + size_t i; + while(list) { + for(i=0; iopt_code) goto found; + if(i == filter_list_len) goto next; +found: + /* copy edns option structure */ + s = regional_alloc_init(region, list, sizeof(*list)); + if(!s) return NULL; + s->next = NULL; + + /* copy option data */ + if(s->opt_data) { + s->opt_data = regional_alloc_init(region, s->opt_data, + s->opt_len); + if(!s->opt_data) + return NULL; + } + + /* link into list */ + if(cur) + cur->next = s; + else result = s; + cur = s; + +next: + /* examine next element */ + list = list->next; + } + return result; +} + int edns_opt_compare(struct edns_option* p, struct edns_option* q) { if(!p && !q) return 0; diff --git a/usr.sbin/unbound/util/data/msgreply.h b/usr.sbin/unbound/util/data/msgreply.h index 258271eeb..ae5d43b41 100644 --- a/usr.sbin/unbound/util/data/msgreply.h +++ b/usr.sbin/unbound/util/data/msgreply.h @@ -170,9 +170,17 @@ struct reply_info { /** * EDE (rfc8914) code with reason for DNSSEC bogus status. + * Used for caching the EDE. */ sldns_ede_code reason_bogus; + /** + * EDE (rfc8914) NULL-terminated string with human-readable reason + * for DNSSEC bogus status. + * Used for caching the EDE. + */ + char* reason_bogus_str; + /** * Number of RRsets in each section. * The answer section. Add up the RRs in every RRset to calculate @@ -240,13 +248,15 @@ struct msgreply_entry { * @param ar: ar count * @param total: total rrset count (presumably an+ns+ar). * @param sec: security status of the reply info. + * @param reason_bogus: the Extended DNS Error for DNSSEC bogus status * @return the reply_info base struct with the array for putting the rrsets * in. The array has been zeroed. Returns NULL on malloc failure. */ struct reply_info* construct_reply_info_base(struct regional* region, uint16_t flags, size_t qd, - time_t ttl, time_t prettl, time_t expttl, size_t an, size_t ns, - size_t ar, size_t total, enum sec_status sec); + time_t ttl, time_t prettl, time_t expttl, size_t an, size_t ns, + size_t ar, size_t total, enum sec_status sec, + sldns_ede_code reason_bogus); /** * Parse wire query into a queryinfo structure, return 0 on parse error. @@ -567,6 +577,16 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len, int edns_opt_list_append_ede(struct edns_option** list, struct regional* region, sldns_ede_code code, const char *txt); +/** + * Append edns keep alive option to edns options list + * @param list: the edns option list to append the edns option to. + * @param msec: the duration in msecs for the keep alive. + * @param region: region to allocate the new edns option. + * @return false on failure. + */ +int edns_opt_list_append_keepalive(struct edns_option** list, int msec, + struct regional* region); + /** * Remove any option found on the edns option list that matches the code. * @param list: the list of edns options. @@ -718,6 +738,12 @@ int inplace_cb_query_response_call(struct module_env* env, struct edns_option* edns_opt_copy_region(struct edns_option* list, struct regional* region); +/** + * Copy a filtered edns option list allocated to the new region + */ +struct edns_option* edns_opt_copy_filter_region(struct edns_option* list, + uint16_t* filter_list, size_t filter_list_len, struct regional* region); + /** * Copy edns option list allocated with malloc */ diff --git a/usr.sbin/unbound/util/edns.c b/usr.sbin/unbound/util/edns.c index f55dcb97e..2b4047f0b 100644 --- a/usr.sbin/unbound/util/edns.c +++ b/usr.sbin/unbound/util/edns.c @@ -45,8 +45,11 @@ #include "util/netevent.h" #include "util/net_help.h" #include "util/regional.h" +#include "util/rfc_1982.h" +#include "util/siphash.h" #include "util/data/msgparse.h" #include "util/data/msgreply.h" +#include "sldns/sbuffer.h" struct edns_strings* edns_strings_create(void) { @@ -128,3 +131,59 @@ edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr, return (struct edns_string_addr*)addr_tree_lookup(tree, addr, addrlen); } +uint8_t* +edns_cookie_server_hash(const uint8_t* in, const uint8_t* secret, int v4, + uint8_t* hash) +{ + v4?siphash(in, 20, secret, hash, 8):siphash(in, 32, secret, hash, 8); + return hash; +} + +void +edns_cookie_server_write(uint8_t* buf, const uint8_t* secret, int v4, + uint32_t timestamp) +{ + uint8_t hash[8]; + buf[ 8] = 1; /* Version */ + buf[ 9] = 0; /* Reserved */ + buf[10] = 0; /* Reserved */ + buf[11] = 0; /* Reserved */ + sldns_write_uint32(buf + 12, timestamp); + (void)edns_cookie_server_hash(buf, secret, v4, hash); + memcpy(buf + 16, hash, 8); +} + +enum edns_cookie_val_status +edns_cookie_server_validate(const uint8_t* cookie, size_t cookie_len, + const uint8_t* secret, size_t secret_len, int v4, + const uint8_t* hash_input, uint32_t now) +{ + uint8_t hash[8]; + uint32_t timestamp; + uint32_t subt_1982 = 0; /* Initialize for the compiler; unused value */ + int comp_1982; + if(cookie_len != 24) + /* RFC9018 cookies are 24 bytes long */ + return COOKIE_STATUS_CLIENT_ONLY; + if(secret_len != 16 || /* RFC9018 cookies have 16 byte secrets */ + cookie[8] != 1) /* RFC9018 cookies are cookie version 1 */ + return COOKIE_STATUS_INVALID; + timestamp = sldns_read_uint32(cookie + 12); + if((comp_1982 = compare_1982(now, timestamp)) > 0 + && (subt_1982 = subtract_1982(timestamp, now)) > 3600) + /* Cookie is older than 1 hour (see RFC9018 Section 4.3.) */ + return COOKIE_STATUS_EXPIRED; + if(comp_1982 <= 0 && subtract_1982(now, timestamp) > 300) + /* Cookie time is more than 5 minutes in the future. + * (see RFC9018 Section 4.3.) */ + return COOKIE_STATUS_FUTURE; + if(memcmp(edns_cookie_server_hash(hash_input, secret, v4, hash), + cookie + 16, 8) != 0) + /* Hashes do not match */ + return COOKIE_STATUS_INVALID; + if(comp_1982 > 0 && subt_1982 > 1800) + /* Valid cookie but older than 30 minutes, so create a new one + * anyway */ + return COOKIE_STATUS_VALID_RENEW; + return COOKIE_STATUS_VALID; +} diff --git a/usr.sbin/unbound/util/edns.h b/usr.sbin/unbound/util/edns.h index d9ded0b84..5da0ecb29 100644 --- a/usr.sbin/unbound/util/edns.h +++ b/usr.sbin/unbound/util/edns.h @@ -75,6 +75,15 @@ struct edns_string_addr { size_t string_len; }; +enum edns_cookie_val_status { + COOKIE_STATUS_CLIENT_ONLY = -3, + COOKIE_STATUS_FUTURE = -2, + COOKIE_STATUS_EXPIRED = -1, + COOKIE_STATUS_INVALID = 0, + COOKIE_STATUS_VALID = 1, + COOKIE_STATUS_VALID_RENEW = 2, +}; + /** * Create structure to hold EDNS strings * @return: newly created edns_strings, NULL on alloc failure. @@ -106,4 +115,54 @@ struct edns_string_addr* edns_string_addr_lookup(rbtree_type* tree, struct sockaddr_storage* addr, socklen_t addrlen); +/** + * Compute the interoperable DNS cookie (RFC9018) hash. + * @param in: buffer input for the hash generation. It needs to be: + * Client Cookie | Version | Reserved | Timestamp | Client-IP + * @param secret: the server secret; implicit length of 16 octets. + * @param v4: if the client IP is v4 or v6. + * @param hash: buffer to write the hash to. + * return a pointer to the hash. + */ +uint8_t* edns_cookie_server_hash(const uint8_t* in, const uint8_t* secret, + int v4, uint8_t* hash); + +/** + * Write an interoperable DNS server cookie (RFC9018). + * @param buf: buffer to write to. It should have a size of at least 32 octets + * as it doubles as the output buffer and the hash input buffer. + * The first 8 octets are expected to be the Client Cookie and will be + * left untouched. + * The next 8 octets will be written with Version | Reserved | Timestamp. + * The next 4 or 16 octets are expected to be the IPv4 or the IPv6 address + * based on the v4 flag. + * Thus the first 20 or 32 octets, based on the v4 flag, will be used as + * the hash input. + * The server hash (8 octets) will be written after the first 16 octets; + * overwriting the address information. + * The caller expects a complete, 24 octet long cookie in the buffer. + * @param secret: the server secret; implicit length of 16 octets. + * @param v4: if the client IP is v4 or v6. + * @param timestamp: the timestamp to use. + */ +void edns_cookie_server_write(uint8_t* buf, const uint8_t* secret, int v4, + uint32_t timestamp); + +/** + * Validate an interoperable DNS cookie (RFC9018). + * @param cookie: pointer to the cookie data. + * @param cookie_len: the length of the cookie data. + * @param secret: pointer to the server secret. + * @param secret_len: the length of the secret. + * @param v4: if the client IP is v4 or v6. + * @param hash_input: pointer to the hash input for validation. It needs to be: + * Client Cookie | Version | Reserved | Timestamp | Client-IP + * @param now: the current time. + * return edns_cookie_val_status with the cookie validation status i.e., + * <=0 for invalid, else valid. + */ +enum edns_cookie_val_status edns_cookie_server_validate(const uint8_t* cookie, + size_t cookie_len, const uint8_t* secret, size_t secret_len, int v4, + const uint8_t* hash_input, uint32_t now); + #endif diff --git a/usr.sbin/unbound/util/fptr_wlist.c b/usr.sbin/unbound/util/fptr_wlist.c index 89de9dc13..0ad3f6242 100644 --- a/usr.sbin/unbound/util/fptr_wlist.c +++ b/usr.sbin/unbound/util/fptr_wlist.c @@ -659,6 +659,10 @@ int fptr_whitelist_inplace_cb_edns_back_parsed( #else (void)fptr; #endif +#ifdef WITH_PYTHONMODULE + if(fptr == &python_inplace_cb_edns_back_parsed_call) + return 1; +#endif #ifdef WITH_DYNLIBMODULE if(fptr == &dynlib_inplace_cb_edns_back_parsed) return 1; @@ -675,6 +679,10 @@ int fptr_whitelist_inplace_cb_query_response( #else (void)fptr; #endif +#ifdef WITH_PYTHONMODULE + if(fptr == &python_inplace_cb_query_response) + return 1; +#endif #ifdef WITH_DYNLIBMODULE if(fptr == &dynlib_inplace_cb_query_response) return 1; diff --git a/usr.sbin/unbound/util/iana_ports.inc b/usr.sbin/unbound/util/iana_ports.inc index 80a8144d3..5cb127ed8 100644 --- a/usr.sbin/unbound/util/iana_ports.inc +++ b/usr.sbin/unbound/util/iana_ports.inc @@ -674,6 +674,8 @@ 911, 912, 913, +914, +915, 989, 990, 991, @@ -1901,6 +1903,7 @@ 2256, 2257, 2258, +2259, 2260, 2261, 2262, @@ -2010,6 +2013,7 @@ 2366, 2367, 2368, +2369, 2370, 2372, 2378, @@ -4840,6 +4844,7 @@ 8403, 8416, 8417, +8433, 8442, 8443, 8444, diff --git a/usr.sbin/unbound/util/module.c b/usr.sbin/unbound/util/module.c index 6f69094c4..86ab24a07 100644 --- a/usr.sbin/unbound/util/module.c +++ b/usr.sbin/unbound/util/module.c @@ -84,8 +84,10 @@ void errinf_ede(struct module_qstate* qstate, const char* str, sldns_ede_code reason_bogus) { struct errinf_strlist* p; - if((qstate->env->cfg->val_log_level < 2 && !qstate->env->cfg->log_servfail) || !str) + if(!str || (qstate->env->cfg->val_log_level < 2 && + !qstate->env->cfg->log_servfail)) { return; + } p = (struct errinf_strlist*)regional_alloc(qstate->region, sizeof(*p)); if(!p) { log_err("malloc failure in validator-error-info string"); @@ -152,15 +154,19 @@ char* errinf_to_str_bogus(struct module_qstate* qstate) return p; } +/* Try to find the latest (most specific) dnssec failure */ sldns_ede_code errinf_to_reason_bogus(struct module_qstate* qstate) { struct errinf_strlist* s; + sldns_ede_code ede = LDNS_EDE_NONE; for(s=qstate->errinf; s; s=s->next) { - if (s->reason_bogus != LDNS_EDE_NONE) { - return s->reason_bogus; - } + if(s->reason_bogus == LDNS_EDE_NONE) continue; + if(ede != LDNS_EDE_NONE + && ede != LDNS_EDE_DNSSEC_BOGUS + && s->reason_bogus == LDNS_EDE_DNSSEC_BOGUS) continue; + ede = s->reason_bogus; } - return LDNS_EDE_NONE; + return ede; } char* errinf_to_str_servfail(struct module_qstate* qstate) diff --git a/usr.sbin/unbound/util/module.h b/usr.sbin/unbound/util/module.h index a3b9fd759..f8e7e762b 100644 --- a/usr.sbin/unbound/util/module.h +++ b/usr.sbin/unbound/util/module.h @@ -619,6 +619,12 @@ struct module_qstate { /** if this is a validation recursion query that does not get * validation itself */ int is_valrec; +#ifdef CLIENT_SUBNET + /** the client network address is needed for the client-subnet option + * when prefetching, but we can't use reply_list in mesh_info, because + * we don't want to send a reply for the internal query. */ + struct sockaddr_storage client_addr; +#endif /** comm_reply contains server replies */ struct comm_reply* reply; @@ -671,6 +677,8 @@ struct module_qstate { * those servers. By comparing expiry time with qstarttime for type NS. */ time_t qstarttime; + /** whether a message from cachedb will be used for the reply */ + int is_cachedb_answer; /** * Attributes of clients that share the qstate that may affect IP-based @@ -818,11 +826,11 @@ void errinf_dname(struct module_qstate* qstate, const char* str, * This string is malloced and has to be freed by caller. */ char* errinf_to_str_bogus(struct module_qstate* qstate); + /** - * Check the sldns_ede_code of the qstate. + * Check the sldns_ede_code of the qstate->errinf. * @param qstate: query state. - * @return LDNS_EDE_DNSSEC_BOGUS by default, or the first explicitly set - * sldns_ede_code. + * @return the latest explicitly set sldns_ede_code or LDNS_EDE_NONE. */ sldns_ede_code errinf_to_reason_bogus(struct module_qstate* qstate); diff --git a/usr.sbin/unbound/util/net_help.c b/usr.sbin/unbound/util/net_help.c index d7146be8f..4abe1081e 100644 --- a/usr.sbin/unbound/util/net_help.c +++ b/usr.sbin/unbound/util/net_help.c @@ -792,6 +792,49 @@ addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen, } } +int +prefixnet_is_nat64(int prefixnet) +{ + return (prefixnet == 32 || prefixnet == 40 || + prefixnet == 48 || prefixnet == 56 || + prefixnet == 64 || prefixnet == 96); +} + +void +addr_to_nat64(const struct sockaddr_storage* addr, + const struct sockaddr_storage* nat64_prefix, + socklen_t nat64_prefixlen, int nat64_prefixnet, + struct sockaddr_storage* nat64_addr, socklen_t* nat64_addrlen) +{ + struct sockaddr_in *sin = (struct sockaddr_in *)addr; + struct sockaddr_in6 *sin6; + uint8_t *v4_byte; + + /* This needs to be checked by the caller */ + log_assert(addr->ss_family == AF_INET); + /* Current usage is only from config values; prefix lengths enforced + * during config validation */ + log_assert(prefixnet_is_nat64(nat64_prefixnet)); + + *nat64_addr = *nat64_prefix; + *nat64_addrlen = nat64_prefixlen; + + sin6 = (struct sockaddr_in6 *)nat64_addr; + sin6->sin6_flowinfo = 0; + sin6->sin6_port = sin->sin_port; + + nat64_prefixnet = nat64_prefixnet / 8; + + v4_byte = (uint8_t *)&sin->sin_addr.s_addr; + for(int i = 0; i < 4; i++) { + if(nat64_prefixnet == 8) { + /* bits 64...71 are MBZ */ + sin6->sin6_addr.s6_addr[nat64_prefixnet++] = 0; + } + sin6->sin6_addr.s6_addr[nat64_prefixnet++] = *v4_byte++; + } +} + int addr_is_ip4mapped(struct sockaddr_storage* addr, socklen_t addrlen) { @@ -1005,6 +1048,16 @@ listen_sslctx_setup(void* ctxt) log_crypto_err("could not set cipher list with SSL_CTX_set_cipher_list"); } #endif +#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF) + /* ignore errors when peers do not send the mandatory close_notify + * alert on shutdown. + * Relevant for openssl >= 3 */ + if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) & + SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) { + log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF"); + return 0; + } +#endif if((SSL_CTX_set_options(ctx, SSL_OP_CIPHER_SERVER_PREFERENCE) & SSL_OP_CIPHER_SERVER_PREFERENCE) != @@ -1233,6 +1286,17 @@ void* connect_sslctx_create(char* key, char* pem, char* verifypem, int wincert) SSL_CTX_free(ctx); return 0; } +#endif +#if defined(SSL_OP_IGNORE_UNEXPECTED_EOF) + /* ignore errors when peers do not send the mandatory close_notify + * alert on shutdown. + * Relevant for openssl >= 3 */ + if((SSL_CTX_set_options(ctx, SSL_OP_IGNORE_UNEXPECTED_EOF) & + SSL_OP_IGNORE_UNEXPECTED_EOF) != SSL_OP_IGNORE_UNEXPECTED_EOF) { + log_crypto_err("could not set SSL_OP_IGNORE_UNEXPECTED_EOF"); + SSL_CTX_free(ctx); + return 0; + } #endif if(key && key[0]) { if(!SSL_CTX_use_certificate_chain_file(ctx, pem)) { diff --git a/usr.sbin/unbound/util/net_help.h b/usr.sbin/unbound/util/net_help.h index 86e77b664..78f639da2 100644 --- a/usr.sbin/unbound/util/net_help.h +++ b/usr.sbin/unbound/util/net_help.h @@ -331,6 +331,29 @@ int addr_in_common(struct sockaddr_storage* addr1, int net1, void addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen, char* buf, size_t len); +/** + * Check if the prefix network length is one of the allowed 32, 40, 48, 56, 64, + * or 96. + * @param prefixnet: prefix network length to check. + * @return 1 on success, 0 on failure. + */ +int prefixnet_is_nat64(int prefixnet); + +/** + * Create a NAT64 address from a given address (needs to be IPv4) and a given + * NAT64 prefix. The NAT64 prefix net needs to be one of 32, 40, 48, 56, 64, 96. + * @param addr: IPv4 address. + * @param nat64_prefix: NAT64 prefix. + * @param nat64_prefixlen: NAT64 prefix len. + * @param nat64_prefixnet: NAT64 prefix mask. + * @param nat64_addr: the resulting NAT64 address. + * @param nat64_addrlen: the resulting NAT64 address length. + */ +void addr_to_nat64(const struct sockaddr_storage* addr, + const struct sockaddr_storage* nat64_prefix, + socklen_t nat64_prefixlen, int nat64_prefixnet, + struct sockaddr_storage* nat64_addr, socklen_t* nat64_addrlen); + /** * See if sockaddr is an ipv6 mapped ipv4 address, "::ffff:0.0.0.0" * @param addr: address diff --git a/usr.sbin/unbound/util/netevent.c b/usr.sbin/unbound/util/netevent.c index 09a5c71fd..204e4883c 100644 --- a/usr.sbin/unbound/util/netevent.c +++ b/usr.sbin/unbound/util/netevent.c @@ -46,6 +46,7 @@ #include "util/tcp_conn_limit.h" #include "util/fptr_wlist.h" #include "util/proxy_protocol.h" +#include "util/timeval_func.h" #include "sldns/pkthdr.h" #include "sldns/sbuffer.h" #include "sldns/str2wire.h" @@ -71,7 +72,9 @@ #ifdef HAVE_OPENSSL_ERR_H #include #endif - +#ifdef HAVE_LINUX_NET_TSTAMP_H +#include +#endif /* -------- Start of local definitions -------- */ /** if CMSG_ALIGN is not defined on this platform, a workaround */ #ifndef CMSG_ALIGN @@ -114,6 +117,16 @@ /** timeout in millisec to wait for write to unblock, packets dropped after.*/ #define SEND_BLOCKED_WAIT_TIMEOUT 200 +/** Let's make timestamping code cleaner and redefine SO_TIMESTAMP* */ +#ifndef SO_TIMESTAMP +#define SO_TIMESTAMP 29 +#endif +#ifndef SO_TIMESTAMPNS +#define SO_TIMESTAMPNS 35 +#endif +#ifndef SO_TIMESTAMPING +#define SO_TIMESTAMPING 37 +#endif /** * The internal event structure for keeping ub_event info for the event. * Possibly other structures (list, tree) this is part of. @@ -579,6 +592,11 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, cmsg_data = CMSG_DATA(cmsg); ((struct in_pktinfo *) cmsg_data)->ipi_ifindex = 0; cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo)); + /* zero the padding bytes inserted by the CMSG_LEN */ + if(sizeof(struct in_pktinfo) < cmsg->cmsg_len) + memset(((uint8_t*)(CMSG_DATA(cmsg))) + + sizeof(struct in_pktinfo), 0, cmsg->cmsg_len + - sizeof(struct in_pktinfo)); #elif defined(IP_SENDSRCADDR) msg.msg_controllen = CMSG_SPACE(sizeof(struct in_addr)); log_assert(msg.msg_controllen <= sizeof(control.buf)); @@ -587,6 +605,11 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, memmove(CMSG_DATA(cmsg), &r->pktinfo.v4addr, sizeof(struct in_addr)); cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr)); + /* zero the padding bytes inserted by the CMSG_LEN */ + if(sizeof(struct in_addr) < cmsg->cmsg_len) + memset(((uint8_t*)(CMSG_DATA(cmsg))) + + sizeof(struct in_addr), 0, cmsg->cmsg_len + - sizeof(struct in_addr)); #else verbose(VERB_ALGO, "no IP_PKTINFO or IP_SENDSRCADDR"); msg.msg_control = NULL; @@ -603,6 +626,11 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, cmsg_data = CMSG_DATA(cmsg); ((struct in6_pktinfo *) cmsg_data)->ipi6_ifindex = 0; cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo)); + /* zero the padding bytes inserted by the CMSG_LEN */ + if(sizeof(struct in6_pktinfo) < cmsg->cmsg_len) + memset(((uint8_t*)(CMSG_DATA(cmsg))) + + sizeof(struct in6_pktinfo), 0, cmsg->cmsg_len + - sizeof(struct in6_pktinfo)); } else { /* try to pass all 0 to use default route */ msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo)); @@ -611,9 +639,14 @@ comm_point_send_udp_msg_if(struct comm_point *c, sldns_buffer* packet, cmsg->cmsg_type = IPV6_PKTINFO; memset(CMSG_DATA(cmsg), 0, sizeof(struct in6_pktinfo)); cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo)); + /* zero the padding bytes inserted by the CMSG_LEN */ + if(sizeof(struct in6_pktinfo) < cmsg->cmsg_len) + memset(((uint8_t*)(CMSG_DATA(cmsg))) + + sizeof(struct in6_pktinfo), 0, cmsg->cmsg_len + - sizeof(struct in6_pktinfo)); } #endif /* S_SPLINT_S */ - if(verbosity >= VERB_ALGO) + if(verbosity >= VERB_ALGO && r->srctype != 0) p_ancil("send_udp over interface", r); sent = sendmsg(c->fd, &msg, 0); if(sent == -1) { @@ -810,7 +843,7 @@ done: /* We are reading a whole packet; * Move the rest of the data to overwrite the PROXYv2 header */ /* XXX can we do better to avoid memmove? */ - memmove(header, ((void*)header)+size, + memmove(header, ((char*)header)+size, sldns_buffer_limit(buf)-size); sldns_buffer_set_limit(buf, sldns_buffer_limit(buf)-size); } @@ -833,6 +866,9 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg) #ifndef S_SPLINT_S struct cmsghdr* cmsg; #endif /* S_SPLINT_S */ +#ifdef HAVE_LINUX_NET_TSTAMP_H + struct timespec *ts; +#endif /* HAVE_LINUX_NET_TSTAMP_H */ rep.c = (struct comm_point*)arg; log_assert(rep.c->type == comm_udp); @@ -843,6 +879,7 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg) ub_comm_base_now(rep.c->ev->base); for(i=0; ibuffer); + timeval_clear(&rep.c->recv_tv); rep.remote_addrlen = (socklen_t)sizeof(rep.remote_addr); log_assert(fd != -1); log_assert(sldns_buffer_remaining(rep.c->buffer) > 0); @@ -894,9 +931,23 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg) sizeof(struct in_addr)); break; #endif /* IP_PKTINFO or IP_RECVDSTADDR */ +#ifdef HAVE_LINUX_NET_TSTAMP_H + } else if( cmsg->cmsg_level == SOL_SOCKET && + cmsg->cmsg_type == SO_TIMESTAMPNS) { + ts = (struct timespec *)CMSG_DATA(cmsg); + TIMESPEC_TO_TIMEVAL(&rep.c->recv_tv, ts); + } else if( cmsg->cmsg_level == SOL_SOCKET && + cmsg->cmsg_type == SO_TIMESTAMPING) { + ts = (struct timespec *)CMSG_DATA(cmsg); + TIMESPEC_TO_TIMEVAL(&rep.c->recv_tv, ts); + } else if( cmsg->cmsg_level == SOL_SOCKET && + cmsg->cmsg_type == SO_TIMESTAMP) { + memmove(&rep.c->recv_tv, CMSG_DATA(cmsg), sizeof(struct timeval)); +#endif /* HAVE_LINUX_NET_TSTAMP_H */ } } - if(verbosity >= VERB_ALGO) + + if(verbosity >= VERB_ALGO && rep.srctype != 0) p_ancil("receive_udp on interface", &rep); #endif /* S_SPLINT_S */ @@ -2545,8 +2596,9 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c) return 1; } -/** read again to drain buffers when there could be more to read */ -static void +/** read again to drain buffers when there could be more to read, returns 0 + * on failure which means the comm point is closed. */ +static int tcp_req_info_read_again(int fd, struct comm_point* c) { while(c->tcp_req_info->read_again) { @@ -2563,9 +2615,10 @@ tcp_req_info_read_again(int fd, struct comm_point* c) (void)(*c->callback)(c, c->cb_arg, NETEVENT_CLOSED, NULL); } - return; + return 0; } } + return 1; } /** read again to drain buffers when there could be more to read */ @@ -2623,6 +2676,9 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg) log_assert(c->type == comm_tcp); ub_comm_base_now(c->ev->base); + if(c->fd == -1 || c->fd != fd) + return; /* duplicate event, but commpoint closed. */ + #ifdef USE_DNSCRYPT /* Initialize if this is a dnscrypt socket */ if(c->tcp_parent) { @@ -2671,8 +2727,10 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg) } return; } - if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) - tcp_req_info_read_again(fd, c); + if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) { + if(!tcp_req_info_read_again(fd, c)) + return; + } if(moreread && *moreread) tcp_more_read_again(fd, c); return; @@ -2690,8 +2748,10 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg) } return; } - if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) - tcp_req_info_read_again(fd, c); + if(has_tcpq && c->tcp_req_info && c->tcp_req_info->read_again) { + if(!tcp_req_info_read_again(fd, c)) + return; + } if(morewrite && *morewrite) tcp_more_write_again(fd, c); return; @@ -3800,7 +3860,11 @@ comm_point_create_udp(struct comm_base *base, int fd, sldns_buffer* buffer, evbits = UB_EV_READ | UB_EV_PERSIST; /* ub_event stuff */ c->ev->ev = ub_event_new(base->eb->base, c->fd, evbits, +#ifdef USE_WINSOCK comm_point_udp_callback, c); +#else + comm_point_udp_ancil_callback, c); +#endif if(c->ev->ev == NULL) { log_err("could not baseset udp event"); comm_point_delete(c); @@ -4488,6 +4552,11 @@ comm_point_close(struct comm_point* c) tcp_req_info_clear(c->tcp_req_info); if(c->h2_session) http2_session_server_delete(c->h2_session); + /* stop the comm point from reading or writing after it is closed. */ + if(c->tcp_more_read_again && *c->tcp_more_read_again) + *c->tcp_more_read_again = 0; + if(c->tcp_more_write_again && *c->tcp_more_write_again) + *c->tcp_more_write_again = 0; /* close fd after removing from event lists, or epoll.. is messed up */ if(c->fd != -1 && !c->do_not_close) { diff --git a/usr.sbin/unbound/util/netevent.h b/usr.sbin/unbound/util/netevent.h index 433c14c3c..dc9619c16 100644 --- a/usr.sbin/unbound/util/netevent.h +++ b/usr.sbin/unbound/util/netevent.h @@ -60,6 +60,7 @@ #ifndef NET_EVENT_H #define NET_EVENT_H +#include #include "dnscrypt/dnscrypt.h" #ifdef HAVE_NGHTTP2_NGHTTP2_H #include @@ -383,7 +384,8 @@ struct comm_point { /** number of queries outstanding on this socket, used by * outside network for udp ports */ int inuse; - + /** the timestamp when the packet was received by the kernel */ + struct timeval recv_tv; /** callback when done. tcp_accept does not get called back, is NULL then. If a timeout happens, callback with timeout=1 is called. diff --git a/usr.sbin/unbound/util/regional.c b/usr.sbin/unbound/util/regional.c index 5577fbca9..fb0c6fc30 100644 --- a/usr.sbin/unbound/util/regional.c +++ b/usr.sbin/unbound/util/regional.c @@ -186,7 +186,7 @@ regional_alloc_init(struct regional* r, const void *init, size_t size) { void *s = regional_alloc(r, size); if(!s) return NULL; - memcpy(s, init, size); + memmove(s, init, size); return s; } diff --git a/usr.sbin/unbound/util/rfc_1982.c b/usr.sbin/unbound/util/rfc_1982.c new file mode 100644 index 000000000..c28deded6 --- /dev/null +++ b/usr.sbin/unbound/util/rfc_1982.c @@ -0,0 +1,74 @@ +/* + * util/rfc_1982.c - RFC 1982 Serial Number Arithmetic + * + * Copyright (c) 2023, NLnet Labs. All rights reserved. + * + * This software is open source. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of the NLNET LABS nor the names of its contributors may + * be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * \file + * + * This file contains functions for RFC 1982 serial number arithmetic. + */ +#include "config.h" + +int +compare_1982(uint32_t a, uint32_t b) +{ + /* for 32 bit values */ + const uint32_t cutoff = ((uint32_t) 1 << (32 - 1)); + + if (a == b) { + return 0; + } else if ((a < b && b - a < cutoff) || (a > b && a - b > cutoff)) { + return -1; + } else { + return 1; + } +} + +uint32_t +subtract_1982(uint32_t a, uint32_t b) +{ + /* for 32 bit values */ + const uint32_t cutoff = ((uint32_t) 1 << (32 - 1)); + + if(a == b) + return 0; + if(a < b && b - a < cutoff) { + return b-a; + } + if(a > b && a - b > cutoff) { + return ((uint32_t)0xffffffff) - (a-b-1); + } + /* wrong case, b smaller than a */ + return 0; +} diff --git a/usr.sbin/unbound/util/rfc_1982.h b/usr.sbin/unbound/util/rfc_1982.h new file mode 100644 index 000000000..bae383d0e --- /dev/null +++ b/usr.sbin/unbound/util/rfc_1982.h @@ -0,0 +1,63 @@ +/* + * util/rfc_1982.h - RFC 1982 Serial Number Arithmetic + * + * Copyright (c) 2023, NLnet Labs. All rights reserved. + * + * This software is open source. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of the NLNET LABS nor the names of its contributors may + * be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * \file + * + * This file contains functions for RFC 1982 serial number arithmetic. + */ +#ifndef RFC_1982_H +#define RFC_1982_H + +/** + * RFC 1982 comparison, uses unsigned integers, and tries to avoid + * compiler optimization (eg. by avoiding a-b<0 comparisons). + * @param a: value to compare. + * @param b: value to compare. + * @return 0 if equal, 1 if a > b, else -1. + */ +int compare_1982(uint32_t a, uint32_t b); + +/** + * RFC 1982 subtraction, uses unsigned integers, and tries to avoid + * compiler optimization (eg. by avoiding a-b<0 comparisons). + * @param a: value to subtract from. + * @param b: value to subtract. + * @return the difference between them if we know that b is larger than a, + * that is the distance between them in serial number arithmetic. + */ +uint32_t subtract_1982(uint32_t a, uint32_t b); + +#endif /* RFC_1982_H */ diff --git a/usr.sbin/unbound/util/siphash.c b/usr.sbin/unbound/util/siphash.c new file mode 100644 index 000000000..0e1b597d0 --- /dev/null +++ b/usr.sbin/unbound/util/siphash.c @@ -0,0 +1,187 @@ +/* + SipHash reference C implementation + + Copyright (c) 2012-2016 Jean-Philippe Aumasson + + Copyright (c) 2012-2014 Daniel J. Bernstein + + To the extent possible under law, the author(s) have dedicated all copyright + and related and neighboring rights to this software to the public domain + worldwide. This software is distributed without any warranty. + + You should have received a copy of the CC0 Public Domain Dedication along + with + this software. If not, see + . + */ +/** + * Edited slightly for integration in Unbound. Edits are noted with 'EDIT'. + */ +/** EDIT + * \#include + * \#include + * \#include + * \#include + * Replaced the above includes with Unbound's config.h + */ +#include "config.h" + +/* default: SipHash-2-4 */ +#define cROUNDS 2 +#define dROUNDS 4 + +#define ROTL(x, b) (uint64_t)(((x) << (b)) | ((x) >> (64 - (b)))) + +#define U32TO8_LE(p, v) \ + (p)[0] = (uint8_t)((v)); \ + (p)[1] = (uint8_t)((v) >> 8); \ + (p)[2] = (uint8_t)((v) >> 16); \ + (p)[3] = (uint8_t)((v) >> 24); + +#define U64TO8_LE(p, v) \ + U32TO8_LE((p), (uint32_t)((v))); \ + U32TO8_LE((p) + 4, (uint32_t)((v) >> 32)); + +#define U8TO64_LE(p) \ + (((uint64_t)((p)[0])) | ((uint64_t)((p)[1]) << 8) | \ + ((uint64_t)((p)[2]) << 16) | ((uint64_t)((p)[3]) << 24) | \ + ((uint64_t)((p)[4]) << 32) | ((uint64_t)((p)[5]) << 40) | \ + ((uint64_t)((p)[6]) << 48) | ((uint64_t)((p)[7]) << 56)) + +#define SIPROUND \ + do { \ + v0 += v1; \ + v1 = ROTL(v1, 13); \ + v1 ^= v0; \ + v0 = ROTL(v0, 32); \ + v2 += v3; \ + v3 = ROTL(v3, 16); \ + v3 ^= v2; \ + v0 += v3; \ + v3 = ROTL(v3, 21); \ + v3 ^= v0; \ + v2 += v1; \ + v1 = ROTL(v1, 17); \ + v1 ^= v2; \ + v2 = ROTL(v2, 32); \ + } while (0) + +#ifdef DEBUG +#define TRACE \ + do { \ + printf("(%3d) v0 %08x %08x\n", (int)inlen, (uint32_t)(v0 >> 32), \ + (uint32_t)v0); \ + printf("(%3d) v1 %08x %08x\n", (int)inlen, (uint32_t)(v1 >> 32), \ + (uint32_t)v1); \ + printf("(%3d) v2 %08x %08x\n", (int)inlen, (uint32_t)(v2 >> 32), \ + (uint32_t)v2); \ + printf("(%3d) v3 %08x %08x\n", (int)inlen, (uint32_t)(v3 >> 32), \ + (uint32_t)v3); \ + } while (0) +#else +#define TRACE +#endif + +int siphash(const uint8_t *in, const size_t inlen, const uint8_t *k, + uint8_t *out, const size_t outlen) { + + uint64_t v0 = 0x736f6d6570736575ULL; + uint64_t v1 = 0x646f72616e646f6dULL; + uint64_t v2 = 0x6c7967656e657261ULL; + uint64_t v3 = 0x7465646279746573ULL; + uint64_t k0 = U8TO64_LE(k); + uint64_t k1 = U8TO64_LE(k + 8); + uint64_t m; + int i; + const uint8_t *end = in + inlen - (inlen % sizeof(uint64_t)); + const int left = inlen & 7; + uint64_t b = ((uint64_t)inlen) << 56; + /** EDIT + * The following assert moved here from the top for C90 compliance. + */ + assert((outlen == 8) || (outlen == 16)); + v3 ^= k1; + v2 ^= k0; + v1 ^= k1; + v0 ^= k0; + + if (outlen == 16) + v1 ^= 0xee; + + for (; in != end; in += 8) { + m = U8TO64_LE(in); + v3 ^= m; + + TRACE; + for (i = 0; i < cROUNDS; ++i) + SIPROUND; + + v0 ^= m; + } + + switch (left) { + case 7: + b |= ((uint64_t)in[6]) << 48; + /** EDIT annotate case statement fallthrough for gcc */ + /* fallthrough */ + case 6: + b |= ((uint64_t)in[5]) << 40; + /** EDIT annotate case statement fallthrough for gcc */ + /* fallthrough */ + case 5: + b |= ((uint64_t)in[4]) << 32; + /** EDIT annotate case statement fallthrough for gcc */ + /* fallthrough */ + case 4: + b |= ((uint64_t)in[3]) << 24; + /** EDIT annotate case statement fallthrough for gcc */ + /* fallthrough */ + case 3: + b |= ((uint64_t)in[2]) << 16; + /** EDIT annotate case statement fallthrough for gcc */ + /* fallthrough */ + case 2: + b |= ((uint64_t)in[1]) << 8; + /** EDIT annotate case statement fallthrough for gcc */ + /* fallthrough */ + case 1: + b |= ((uint64_t)in[0]); + break; + case 0: + break; + } + + v3 ^= b; + + TRACE; + for (i = 0; i < cROUNDS; ++i) + SIPROUND; + + v0 ^= b; + + if (outlen == 16) + v2 ^= 0xee; + else + v2 ^= 0xff; + + TRACE; + for (i = 0; i < dROUNDS; ++i) + SIPROUND; + + b = v0 ^ v1 ^ v2 ^ v3; + U64TO8_LE(out, b); + + if (outlen == 8) + return 0; + + v1 ^= 0xdd; + + TRACE; + for (i = 0; i < dROUNDS; ++i) + SIPROUND; + + b = v0 ^ v1 ^ v2 ^ v3; + U64TO8_LE(out + 8, b); + + return 0; +} diff --git a/usr.sbin/unbound/util/siphash.h b/usr.sbin/unbound/util/siphash.h new file mode 100644 index 000000000..63da2175c --- /dev/null +++ b/usr.sbin/unbound/util/siphash.h @@ -0,0 +1,43 @@ +/* + * util/siphash.h - header for SipHash reference C implementation. + * + * Copyright (c) 2023, NLnet Labs. All rights reserved. + * + * This software is open source. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of the NLNET LABS nor the names of its contributors may + * be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ +/** + * \file + * Contains the SipHash reference C implementation. + */ +#ifndef UTIL_SIPHASH_H +#define UTIL_SIPHASH_H +int siphash(const uint8_t *in, const size_t inlen, const uint8_t *k, + uint8_t *out, const size_t outlen); +#endif /* UTIL_SIPHASH_H */ diff --git a/usr.sbin/unbound/util/storage/lruhash.c b/usr.sbin/unbound/util/storage/lruhash.c index 9cf3fce7c..63922455c 100644 --- a/usr.sbin/unbound/util/storage/lruhash.c +++ b/usr.sbin/unbound/util/storage/lruhash.c @@ -81,6 +81,7 @@ lruhash_create(size_t start_size, size_t maxmem, table->num = 0; table->space_used = 0; table->space_max = maxmem; + table->max_collisions = 0; table->array = calloc(table->size, sizeof(struct lruhash_bin)); if(!table->array) { lock_quick_destroy(&table->lock); @@ -216,15 +217,19 @@ reclaim_space(struct lruhash* table, struct lruhash_entry** list) struct lruhash_entry* bin_find_entry(struct lruhash* table, - struct lruhash_bin* bin, hashvalue_type hash, void* key) + struct lruhash_bin* bin, hashvalue_type hash, void* key, size_t* collisions) { + size_t c = 0; struct lruhash_entry* p = bin->overflow_list; while(p) { if(p->hash == hash && table->compfunc(p->key, key) == 0) - return p; + break; + c++; p = p->overflow_next; } - return NULL; + if (collisions != NULL) + *collisions = c; + return p; } void @@ -303,6 +308,7 @@ lruhash_insert(struct lruhash* table, hashvalue_type hash, struct lruhash_bin* bin; struct lruhash_entry* found, *reclaimlist=NULL; size_t need_size; + size_t collisions; fptr_ok(fptr_whitelist_hash_sizefunc(table->sizefunc)); fptr_ok(fptr_whitelist_hash_delkeyfunc(table->delkeyfunc)); fptr_ok(fptr_whitelist_hash_deldatafunc(table->deldatafunc)); @@ -317,12 +323,14 @@ lruhash_insert(struct lruhash* table, hashvalue_type hash, lock_quick_lock(&bin->lock); /* see if entry exists already */ - if(!(found=bin_find_entry(table, bin, hash, entry->key))) { + if(!(found=bin_find_entry(table, bin, hash, entry->key, &collisions))) { /* if not: add to bin */ entry->overflow_next = bin->overflow_list; bin->overflow_list = entry; lru_front(table, entry); table->num++; + if (table->max_collisions < collisions) + table->max_collisions = collisions; table->space_used += need_size; } else { /* if so: update data - needs a writelock */ @@ -362,7 +370,7 @@ lruhash_lookup(struct lruhash* table, hashvalue_type hash, void* key, int wr) lock_quick_lock(&table->lock); bin = &table->array[hash & table->size_mask]; lock_quick_lock(&bin->lock); - if((entry=bin_find_entry(table, bin, hash, key))) + if((entry=bin_find_entry(table, bin, hash, key, NULL))) lru_touch(table, entry); lock_quick_unlock(&table->lock); @@ -389,7 +397,7 @@ lruhash_remove(struct lruhash* table, hashvalue_type hash, void* key) lock_quick_lock(&table->lock); bin = &table->array[hash & table->size_mask]; lock_quick_lock(&bin->lock); - if((entry=bin_find_entry(table, bin, hash, key))) { + if((entry=bin_find_entry(table, bin, hash, key, NULL))) { bin_overflow_remove(bin, entry); lru_remove(table, entry); } else { @@ -579,6 +587,7 @@ lruhash_insert_or_retrieve(struct lruhash* table, hashvalue_type hash, struct lruhash_bin* bin; struct lruhash_entry* found, *reclaimlist = NULL; size_t need_size; + size_t collisions; fptr_ok(fptr_whitelist_hash_sizefunc(table->sizefunc)); fptr_ok(fptr_whitelist_hash_delkeyfunc(table->delkeyfunc)); fptr_ok(fptr_whitelist_hash_deldatafunc(table->deldatafunc)); @@ -593,7 +602,7 @@ lruhash_insert_or_retrieve(struct lruhash* table, hashvalue_type hash, lock_quick_lock(&bin->lock); /* see if entry exists already */ - if ((found = bin_find_entry(table, bin, hash, entry->key)) != NULL) { + if ((found = bin_find_entry(table, bin, hash, entry->key, &collisions)) != NULL) { /* if so: keep the existing data - acquire a writelock */ lock_rw_wrlock(&found->lock); } @@ -604,6 +613,8 @@ lruhash_insert_or_retrieve(struct lruhash* table, hashvalue_type hash, bin->overflow_list = entry; lru_front(table, entry); table->num++; + if (table->max_collisions < collisions) + table->max_collisions = collisions; table->space_used += need_size; /* return the entry that was presented, and lock it */ found = entry; diff --git a/usr.sbin/unbound/util/storage/lruhash.h b/usr.sbin/unbound/util/storage/lruhash.h index 42b58fccf..4457c4f81 100644 --- a/usr.sbin/unbound/util/storage/lruhash.h +++ b/usr.sbin/unbound/util/storage/lruhash.h @@ -178,6 +178,8 @@ struct lruhash { size_t space_used; /** the amount of space the hash table is maximally allowed to use. */ size_t space_max; + /** the maximum collisions were detected during the lruhash_insert operations. */ + size_t max_collisions; }; /** @@ -357,10 +359,11 @@ void bin_delete(struct lruhash* table, struct lruhash_bin* bin); * @param bin: hash bin to look into. * @param hash: hash value to look for. * @param key: key to look for. + * @param collisions: how many collisions were found during the search. * @return: the entry or NULL if not found. */ struct lruhash_entry* bin_find_entry(struct lruhash* table, - struct lruhash_bin* bin, hashvalue_type hash, void* key); + struct lruhash_bin* bin, hashvalue_type hash, void* key, size_t* collisions); /** * Remove entry from bin overflow chain. diff --git a/usr.sbin/unbound/util/storage/slabhash.c b/usr.sbin/unbound/util/storage/slabhash.c index 2da70ba7c..7c8e4e84e 100644 --- a/usr.sbin/unbound/util/storage/slabhash.c +++ b/usr.sbin/unbound/util/storage/slabhash.c @@ -242,3 +242,21 @@ size_t count_slabhash_entries(struct slabhash* sh) } return cnt; } + +void get_slabhash_stats(struct slabhash* sh, long long* num, long long* collisions) +{ + size_t slab, cnt = 0, max_collisions = 0; + + for(slab=0; slabsize; slab++) { + lock_quick_lock(&sh->array[slab]->lock); + cnt += sh->array[slab]->num; + if (max_collisions < sh->array[slab]->max_collisions) { + max_collisions = sh->array[slab]->max_collisions; + } + lock_quick_unlock(&sh->array[slab]->lock); + } + if (num != NULL) + *num = cnt; + if (collisions != NULL) + *collisions = max_collisions; +} diff --git a/usr.sbin/unbound/util/storage/slabhash.h b/usr.sbin/unbound/util/storage/slabhash.h index 563c65407..85872ab30 100644 --- a/usr.sbin/unbound/util/storage/slabhash.h +++ b/usr.sbin/unbound/util/storage/slabhash.h @@ -200,6 +200,15 @@ void slabhash_traverse(struct slabhash* table, int wr, */ size_t count_slabhash_entries(struct slabhash* table); +/** + * Retrieves number of items in slabhash and the current max collision level + * @param table: slabbed hash table. + * @param entries_count: where to save the current number of elements. + * @param max_collisions: where to save the current max collisions level. + */ +void get_slabhash_stats(struct slabhash* table, + long long* entries_count, long long* max_collisions); + /* --- test representation --- */ /** test structure contains test key */ struct slabhash_testkey { diff --git a/usr.sbin/unbound/util/timehist.c b/usr.sbin/unbound/util/timehist.c index 515cf61f3..2063fe80e 100644 --- a/usr.sbin/unbound/util/timehist.c +++ b/usr.sbin/unbound/util/timehist.c @@ -46,6 +46,7 @@ #include #include "util/timehist.h" #include "util/log.h" +#include "util/timeval_func.h" /** special timestwo operation for time values in histogram setup */ static void @@ -114,23 +115,6 @@ void timehist_clear(struct timehist* hist) hist->buckets[i].count = 0; } -/** histogram compare of time values */ -static int -timeval_smaller(const struct timeval* x, const struct timeval* y) -{ -#ifndef S_SPLINT_S - if(x->tv_sec < y->tv_sec) - return 1; - else if(x->tv_sec == y->tv_sec) { - if(x->tv_usec <= y->tv_usec) - return 1; - else return 0; - } - else return 0; -#endif -} - - void timehist_insert(struct timehist* hist, struct timeval* tv) { size_t i; diff --git a/usr.sbin/unbound/util/timeval_func.c b/usr.sbin/unbound/util/timeval_func.c new file mode 100644 index 000000000..90250e153 --- /dev/null +++ b/usr.sbin/unbound/util/timeval_func.c @@ -0,0 +1,113 @@ +/* + * util/timeval_func.c - helpers to work with struct timeval values. + * + * Copyright (c) 2023, NLnet Labs. All rights reserved. + * + * This software is open source. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of the NLNET LABS nor the names of its contributors may + * be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * \file + * + * This file contains helpers to manipulate struct timeval values. + */ + +#include "config.h" +#include "timeval_func.h" + +/** subtract timers and the values do not overflow or become negative */ +void +timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start) +{ +#ifndef S_SPLINT_S + time_t end_usec = end->tv_usec; + d->tv_sec = end->tv_sec - start->tv_sec; + if(end_usec < start->tv_usec) { + end_usec += 1000000; + d->tv_sec--; + } + d->tv_usec = end_usec - start->tv_usec; +#endif +} + +/** add timers and the values do not overflow or become negative */ +void +timeval_add(struct timeval* d, const struct timeval* add) +{ +#ifndef S_SPLINT_S + d->tv_sec += add->tv_sec; + d->tv_usec += add->tv_usec; + if(d->tv_usec >= 1000000 ) { + d->tv_usec -= 1000000; + d->tv_sec++; + } +#endif +} + +/** divide sum of timers to get average */ +void +timeval_divide(struct timeval* avg, const struct timeval* sum, long long d) +{ +#ifndef S_SPLINT_S + long long leftover; + if(d <= 0) { + avg->tv_sec = 0; + avg->tv_usec = 0; + return; + } + avg->tv_sec = sum->tv_sec / d; + avg->tv_usec = sum->tv_usec / d; + /* handle fraction from seconds divide */ + leftover = sum->tv_sec - avg->tv_sec*d; + if(leftover <= 0) + leftover = 0; + avg->tv_usec += (((long long)leftover)*((long long)1000000))/d; + if(avg->tv_sec < 0) + avg->tv_sec = 0; + if(avg->tv_usec < 0) + avg->tv_usec = 0; +#endif +} + +/** histogram compare of time values */ +int +timeval_smaller(const struct timeval* x, const struct timeval* y) +{ +#ifndef S_SPLINT_S + if(x->tv_sec < y->tv_sec) + return 1; + else if(x->tv_sec == y->tv_sec) { + if(x->tv_usec <= y->tv_usec) + return 1; + else return 0; + } + else return 0; +#endif +} diff --git a/usr.sbin/unbound/util/timeval_func.h b/usr.sbin/unbound/util/timeval_func.h new file mode 100644 index 000000000..819d1dd80 --- /dev/null +++ b/usr.sbin/unbound/util/timeval_func.h @@ -0,0 +1,53 @@ +/* + * util/timeval_func.h - definitions of helpers for struct timeval values. + * + * Copyright (c) 2023, NLnet Labs. All rights reserved. + * + * This software is open source. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * Redistributions in binary form must reproduce the above copyright notice, + * this list of conditions and the following disclaimer in the documentation + * and/or other materials provided with the distribution. + * + * Neither the name of the NLNET LABS nor the names of its contributors may + * be used to endorse or promote products derived from this software without + * specific prior written permission. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR + * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT + * HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, + * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR + * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF + * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +/** + * \file + * + * This file contains definitions of helpers to manipulate struct timeval + * values, implemented in the corresponding C file. + */ +#include + +#ifndef timeval_isset +#define timeval_isset(tv) ((tv)->tv_sec || (tv)->tv_usec) +#endif +#ifndef timeval_clear +#define timeval_clear(tv) ((tv)->tv_sec = (tv)->tv_usec = 0) +#endif +void timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start); +void timeval_add(struct timeval* d, const struct timeval* add); +void timeval_divide(struct timeval* avg, const struct timeval* sum, long long d); +int timeval_smaller(const struct timeval* x, const struct timeval* y); diff --git a/usr.sbin/unbound/util/tube.c b/usr.sbin/unbound/util/tube.c index 165b73331..b18e219c9 100644 --- a/usr.sbin/unbound/util/tube.c +++ b/usr.sbin/unbound/util/tube.c @@ -45,6 +45,9 @@ #include "util/netevent.h" #include "util/fptr_wlist.h" #include "util/ub_event.h" +#ifdef HAVE_POLL_H +#include +#endif #ifndef USE_WINSOCK /* on unix */ @@ -396,20 +399,28 @@ int tube_read_msg(struct tube* tube, uint8_t** buf, uint32_t* len, return 1; } -/** perform a select() on the fd */ +/** perform poll() on the fd */ static int pollit(int fd, struct timeval* t) { - fd_set r; + struct pollfd fds; + int pret; + int msec = -1; + memset(&fds, 0, sizeof(fds)); + fds.fd = fd; + fds.events = POLLIN | POLLERR | POLLHUP; #ifndef S_SPLINT_S - FD_ZERO(&r); - FD_SET(FD_SET_T fd, &r); + if(t) + msec = t->tv_sec*1000 + t->tv_usec/1000; #endif - if(select(fd+1, &r, NULL, NULL, t) == -1) { + + pret = poll(&fds, 1, msec); + + if(pret == -1) + return 0; + if(pret != 0) + return 1; return 0; - } - errno = 0; - return (int)(FD_ISSET(fd, &r)); } int tube_poll(struct tube* tube) @@ -426,24 +437,27 @@ int tube_wait(struct tube* tube) int tube_wait_timeout(struct tube* tube, int msec) { - struct timeval t; - int fd = tube->sr; - fd_set r; - t.tv_sec = msec/1000; - t.tv_usec = (msec%1000)*1000; -#ifndef S_SPLINT_S - FD_ZERO(&r); - FD_SET(FD_SET_T fd, &r); -#endif + int ret = 0; + while(1) { - if(select(fd+1, &r, NULL, NULL, &t) == -1) { + struct pollfd fds; + memset(&fds, 0, sizeof(fds)); + + fds.fd = tube->sr; + fds.events = POLLIN | POLLERR | POLLHUP; + ret = poll(&fds, 1, msec); + + if(ret == -1) { if(errno == EAGAIN || errno == EINTR) continue; return -1; } break; } - return (int)(FD_ISSET(fd, &r)); + + if(ret != 0) + return 1; + return 0; } int tube_read_fd(struct tube* tube) @@ -529,6 +543,7 @@ struct tube* tube_create(void) if(tube->event == WSA_INVALID_EVENT) { free(tube); log_err("WSACreateEvent: %s", wsa_strerror(WSAGetLastError())); + return NULL; } if(!WSAResetEvent(tube->event)) { log_err("WSAResetEvent: %s", wsa_strerror(WSAGetLastError())); diff --git a/usr.sbin/unbound/validator/autotrust.c b/usr.sbin/unbound/validator/autotrust.c index 7fd5e5463..62212c4a8 100644 --- a/usr.sbin/unbound/validator/autotrust.c +++ b/usr.sbin/unbound/validator/autotrust.c @@ -2376,6 +2376,8 @@ probe_anchor(struct module_env* env, struct trust_anchor* tp) edns.opt_list_out = NULL; edns.opt_list_inplace_cb_out = NULL; edns.padding_block_size = 0; + edns.cookie_present = 0; + edns.cookie_valid = 0; if(sldns_buffer_capacity(buf) < 65535) edns.udp_size = (uint16_t)sldns_buffer_capacity(buf); else edns.udp_size = 65535; diff --git a/usr.sbin/unbound/validator/val_kcache.c b/usr.sbin/unbound/validator/val_kcache.c index f58d6b21c..733639ade 100644 --- a/usr.sbin/unbound/validator/val_kcache.c +++ b/usr.sbin/unbound/validator/val_kcache.c @@ -81,17 +81,11 @@ key_cache_delete(struct key_cache* kcache) void key_cache_insert(struct key_cache* kcache, struct key_entry_key* kkey, - struct module_qstate* qstate) + int copy_reason) { - struct key_entry_key* k = key_entry_copy(kkey); + struct key_entry_key* k = key_entry_copy(kkey, copy_reason); if(!k) return; - if(key_entry_isbad(k) && qstate->errinf && - qstate->env->cfg->val_log_level >= 2) { - /* on malloc failure there is simply no reason string */ - key_entry_set_reason(k, errinf_to_str_bogus(qstate)); - key_entry_set_reason_bogus(k, errinf_to_reason_bogus(qstate)); - } key_entry_hash(k); slabhash_insert(kcache->slab, k->entry.hash, &k->entry, k->entry.data, NULL); diff --git a/usr.sbin/unbound/validator/val_kcache.h b/usr.sbin/unbound/validator/val_kcache.h index 9ad1eb8fd..2eac3dc9a 100644 --- a/usr.sbin/unbound/validator/val_kcache.h +++ b/usr.sbin/unbound/validator/val_kcache.h @@ -76,10 +76,10 @@ void key_cache_delete(struct key_cache* kcache); * @param kcache: the key cache. * @param kkey: key entry key, assumed malloced in a region, is copied * to perform update or insertion. Its data pointer is also copied. - * @param qstate: store errinf reason in case its bad. + * @param copy_reason: if the reason string needs to be copied (allocated). */ void key_cache_insert(struct key_cache* kcache, struct key_entry_key* kkey, - struct module_qstate* qstate); + int copy_reason); /** * Remove an entry from the key cache. diff --git a/usr.sbin/unbound/validator/val_kentry.c b/usr.sbin/unbound/validator/val_kentry.c index d5adf4ea8..b99833502 100644 --- a/usr.sbin/unbound/validator/val_kentry.c +++ b/usr.sbin/unbound/validator/val_kentry.c @@ -152,7 +152,7 @@ key_entry_copy_toregion(struct key_entry_key* kkey, struct regional* region) } struct key_entry_key* -key_entry_copy(struct key_entry_key* kkey) +key_entry_copy(struct key_entry_key* kkey, int copy_reason) { struct key_entry_key* newk; if(!kkey) @@ -190,7 +190,7 @@ key_entry_copy(struct key_entry_key* kkey) } packed_rrset_ptr_fixup(newd->rrset_data); } - if(d->reason) { + if(copy_reason && d->reason && *d->reason != 0) { newd->reason = strdup(d->reason); if(!newd->reason) { free(newd->rrset_data); @@ -199,6 +199,8 @@ key_entry_copy(struct key_entry_key* kkey) free(newk); return NULL; } + } else { + newd->reason = NULL; } if(d->algo) { newd->algo = (uint8_t*)strdup((char*)d->algo); @@ -237,22 +239,6 @@ key_entry_isbad(struct key_entry_key* kkey) return (int)(d->isbad); } -void -key_entry_set_reason(struct key_entry_key* kkey, char* reason) -{ - struct key_entry_data* d = (struct key_entry_data*)kkey->entry.data; - d->reason = reason; -} - -void -key_entry_set_reason_bogus(struct key_entry_key* kkey, sldns_ede_code ede) -{ - struct key_entry_data* d = (struct key_entry_data*)kkey->entry.data; - if (ede != LDNS_EDE_NONE) { /* reason_bogus init is LDNS_EDE_NONE already */ - d->reason_bogus = ede; - } -} - char* key_entry_get_reason(struct key_entry_key* kkey) { @@ -294,6 +280,7 @@ key_entry_setup(struct regional* region, struct key_entry_key* key_entry_create_null(struct regional* region, uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, + sldns_ede_code reason_bogus, const char* reason, time_t now) { struct key_entry_key* k; @@ -302,8 +289,10 @@ key_entry_create_null(struct regional* region, return NULL; d->ttl = now + ttl; d->isbad = 0; - d->reason = NULL; - d->reason_bogus = LDNS_EDE_NONE; + d->reason = (!reason || *reason == 0) + ?NULL :(char*)regional_strdup(region, reason); + /* On allocation error we don't store the reason string */ + d->reason_bogus = reason_bogus; d->rrset_type = LDNS_RR_TYPE_DNSKEY; d->rrset_data = NULL; d->algo = NULL; @@ -313,7 +302,9 @@ key_entry_create_null(struct regional* region, struct key_entry_key* key_entry_create_rrset(struct regional* region, uint8_t* name, size_t namelen, uint16_t dclass, - struct ub_packed_rrset_key* rrset, uint8_t* sigalg, time_t now) + struct ub_packed_rrset_key* rrset, uint8_t* sigalg, + sldns_ede_code reason_bogus, const char* reason, + time_t now) { struct key_entry_key* k; struct key_entry_data* d; @@ -323,8 +314,10 @@ key_entry_create_rrset(struct regional* region, return NULL; d->ttl = rd->ttl + now; d->isbad = 0; - d->reason = NULL; - d->reason_bogus = LDNS_EDE_NONE; + d->reason = (!reason || *reason == 0) + ?NULL :(char*)regional_strdup(region, reason); + /* On allocation error we don't store the reason string */ + d->reason_bogus = reason_bogus; d->rrset_type = ntohs(rrset->rk.type); d->rrset_data = (struct packed_rrset_data*)regional_alloc_init(region, rd, packed_rrset_sizeof(rd)); @@ -342,6 +335,7 @@ key_entry_create_rrset(struct regional* region, struct key_entry_key* key_entry_create_bad(struct regional* region, uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, + sldns_ede_code reason_bogus, const char* reason, time_t now) { struct key_entry_key* k; @@ -350,8 +344,10 @@ key_entry_create_bad(struct regional* region, return NULL; d->ttl = now + ttl; d->isbad = 1; - d->reason = NULL; - d->reason_bogus = LDNS_EDE_NONE; + d->reason = (!reason || *reason == 0) + ?NULL :(char*)regional_strdup(region, reason); + /* On allocation error we don't store the reason string */ + d->reason_bogus = reason_bogus; d->rrset_type = LDNS_RR_TYPE_DNSKEY; d->rrset_data = NULL; d->algo = NULL; diff --git a/usr.sbin/unbound/validator/val_kentry.h b/usr.sbin/unbound/validator/val_kentry.h index 07069e906..836e90445 100644 --- a/usr.sbin/unbound/validator/val_kentry.h +++ b/usr.sbin/unbound/validator/val_kentry.h @@ -120,9 +120,11 @@ struct key_entry_key* key_entry_copy_toregion(struct key_entry_key* kkey, /** * Copy a key entry, malloced. * @param kkey: the key entry key (and data pointer) to copy. + * @param copy_reason: if the reason string needs to be copied (allocated). * @return newly allocated entry or NULL on a failure to allocate memory. */ -struct key_entry_key* key_entry_copy(struct key_entry_key* kkey); +struct key_entry_key* key_entry_copy(struct key_entry_key* kkey, + int copy_reason); /** * See if this is a null entry. Does not do locking. @@ -145,23 +147,6 @@ int key_entry_isgood(struct key_entry_key* kkey); */ int key_entry_isbad(struct key_entry_key* kkey); -/** - * Set reason why a key is bad. - * @param kkey: bad key. - * @param reason: string to attach, you must allocate it. - * Not safe to call twice unless you deallocate it yourself. - */ -void key_entry_set_reason(struct key_entry_key* kkey, char* reason); - -/** - * Set the EDE (RFC8914) code why the key is bad, if it - * exists (so not LDNS_EDE_NONE). - * @param kkey: bad key. - * @param ede: EDE code to attach to this key. - */ -void key_entry_set_reason_bogus(struct key_entry_key* kkey, sldns_ede_code ede); - - /** * Get reason why a key is bad. * @param kkey: bad key @@ -184,11 +169,14 @@ sldns_ede_code key_entry_get_reason_bogus(struct key_entry_key* kkey); * @param namelen: length of name * @param dclass: class of key entry. (host order); * @param ttl: what ttl should the key have. relative. + * @param reason_bogus: accompanying EDE code. + * @param reason: accompanying NULL-terminated EDE string (or NULL). * @param now: current time (added to ttl). * @return new key entry or NULL on alloc failure */ struct key_entry_key* key_entry_create_null(struct regional* region, uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, + sldns_ede_code reason_bogus, const char* reason, time_t now); /** @@ -199,12 +187,16 @@ struct key_entry_key* key_entry_create_null(struct regional* region, * @param dclass: class of key entry. (host order); * @param rrset: data for key entry. This is copied to the region. * @param sigalg: signalled algorithm list (or NULL). + * @param reason_bogus: accompanying EDE code (usually LDNS_EDE_NONE). + * @param reason: accompanying NULL-terminated EDE string (or NULL). * @param now: current time (added to ttl of rrset) * @return new key entry or NULL on alloc failure */ struct key_entry_key* key_entry_create_rrset(struct regional* region, - uint8_t* name, size_t namelen, uint16_t dclass, - struct ub_packed_rrset_key* rrset, uint8_t* sigalg, time_t now); + uint8_t* name, size_t namelen, uint16_t dclass, + struct ub_packed_rrset_key* rrset, uint8_t* sigalg, + sldns_ede_code reason_bogus, const char* reason, + time_t now); /** * Create a bad entry, in the given region. @@ -213,11 +205,14 @@ struct key_entry_key* key_entry_create_rrset(struct regional* region, * @param namelen: length of name * @param dclass: class of key entry. (host order); * @param ttl: what ttl should the key have. relative. + * @param reason_bogus: accompanying EDE code. + * @param reason: accompanying NULL-terminated EDE string (or NULL). * @param now: current time (added to ttl). * @return new key entry or NULL on alloc failure */ struct key_entry_key* key_entry_create_bad(struct regional* region, uint8_t* name, size_t namelen, uint16_t dclass, time_t ttl, + sldns_ede_code reason_bogus, const char* reason, time_t now); /** diff --git a/usr.sbin/unbound/validator/val_neg.c b/usr.sbin/unbound/validator/val_neg.c index b19d6c9f8..6e3833bc3 100644 --- a/usr.sbin/unbound/validator/val_neg.c +++ b/usr.sbin/unbound/validator/val_neg.c @@ -43,7 +43,7 @@ */ #include "config.h" #ifdef HAVE_OPENSSL_SSL_H -#include "openssl/ssl.h" +#include #define NSEC3_SHA_LEN SHA_DIGEST_LENGTH #else #define NSEC3_SHA_LEN 20 @@ -1407,6 +1407,11 @@ val_neg_getmsg(struct val_neg_cache* neg, struct query_info* qinfo, /* Matching NSEC, use to generate No Data answer. Not creating answers * yet for No Data proven using wildcard. */ if(nsec && nsec_proves_nodata(nsec, qinfo, &nodata_wc) && !nodata_wc) { + /* do not create nodata answers for qtype ANY, it is a query + * type, not an rrtype to disprove. Nameerrors are useful for + * qtype ANY, in the else branch. */ + if(qinfo->qtype == LDNS_RR_TYPE_ANY) + return NULL; if(!(msg = dns_msg_create(qinfo->qname, qinfo->qname_len, qinfo->qtype, qinfo->qclass, region, 2))) return NULL; diff --git a/usr.sbin/unbound/validator/val_nsec.c b/usr.sbin/unbound/validator/val_nsec.c index e3c10c8e7..9fa760acc 100644 --- a/usr.sbin/unbound/validator/val_nsec.c +++ b/usr.sbin/unbound/validator/val_nsec.c @@ -176,7 +176,8 @@ val_nsec_proves_no_ds(struct ub_packed_rrset_key* nsec, static int nsec_verify_rrset(struct module_env* env, struct val_env* ve, struct ub_packed_rrset_key* nsec, struct key_entry_key* kkey, - char** reason, struct module_qstate* qstate) + char** reason, sldns_ede_code* reason_bogus, + struct module_qstate* qstate) { struct packed_rrset_data* d = (struct packed_rrset_data*) nsec->entry.data; @@ -187,7 +188,7 @@ nsec_verify_rrset(struct module_env* env, struct val_env* ve, if(d->security == sec_status_secure) return 1; d->security = val_verify_rrset_entry(env, ve, nsec, kkey, reason, - NULL, LDNS_SECTION_AUTHORITY, qstate); + reason_bogus, LDNS_SECTION_AUTHORITY, qstate); if(d->security == sec_status_secure) { rrset_update_sec_status(env->rrset_cache, nsec, *env->now); return 1; @@ -199,7 +200,7 @@ enum sec_status val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve, struct query_info* qinfo, struct reply_info* rep, struct key_entry_key* kkey, time_t* proof_ttl, char** reason, - struct module_qstate* qstate) + sldns_ede_code* reason_bogus, struct module_qstate* qstate) { struct ub_packed_rrset_key* nsec = reply_find_rrset_section_ns( rep, qinfo->qname, qinfo->qname_len, LDNS_RR_TYPE_NSEC, @@ -216,7 +217,8 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve, * 1) this is a delegation point and there is no DS * 2) this is not a delegation point */ if(nsec) { - if(!nsec_verify_rrset(env, ve, nsec, kkey, reason, qstate)) { + if(!nsec_verify_rrset(env, ve, nsec, kkey, reason, + reason_bogus, qstate)) { verbose(VERB_ALGO, "NSEC RRset for the " "referral did not verify."); return sec_status_bogus; @@ -225,6 +227,7 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve, if(sec == sec_status_bogus) { /* something was wrong. */ *reason = "NSEC does not prove absence of DS"; + *reason_bogus = LDNS_EDE_DNSSEC_BOGUS; return sec; } else if(sec == sec_status_insecure) { /* this wasn't a delegation point. */ @@ -246,9 +249,11 @@ val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve, if(rep->rrsets[i]->rk.type != htons(LDNS_RR_TYPE_NSEC)) continue; if(!nsec_verify_rrset(env, ve, rep->rrsets[i], kkey, reason, - qstate)) { + reason_bogus, qstate)) { verbose(VERB_ALGO, "NSEC for empty non-terminal " "did not verify."); + *reason = "NSEC for empty non-terminal " + "did not verify."; return sec_status_bogus; } if(nsec_proves_nodata(rep->rrsets[i], qinfo, &wc)) { diff --git a/usr.sbin/unbound/validator/val_nsec.h b/usr.sbin/unbound/validator/val_nsec.h index 289ae8812..41f57c36e 100644 --- a/usr.sbin/unbound/validator/val_nsec.h +++ b/usr.sbin/unbound/validator/val_nsec.h @@ -44,6 +44,7 @@ #ifndef VALIDATOR_VAL_NSEC_H #define VALIDATOR_VAL_NSEC_H #include "util/data/packed_rrset.h" +#include "sldns/rrdef.h" struct val_env; struct module_env; struct module_qstate; @@ -65,6 +66,7 @@ struct key_entry_key; * @param kkey: key entry to use for verification of signatures. * @param proof_ttl: if secure, the TTL of how long this proof lasts. * @param reason: string explaining why bogus. + * @param reason_bogus: relevant EDE code for validation failure. * @param qstate: qstate with region. * @return security status. * SECURE: proved absence of DS. @@ -75,7 +77,8 @@ struct key_entry_key; enum sec_status val_nsec_prove_nodata_dsreply(struct module_env* env, struct val_env* ve, struct query_info* qinfo, struct reply_info* rep, struct key_entry_key* kkey, - time_t* proof_ttl, char** reason, struct module_qstate* qstate); + time_t* proof_ttl, char** reason, sldns_ede_code* reason_bogus, + struct module_qstate* qstate); /** * nsec typemap check, takes an NSEC-type bitmap as argument, checks for type. diff --git a/usr.sbin/unbound/validator/val_sigcrypt.c b/usr.sbin/unbound/validator/val_sigcrypt.c index 36b3bbbba..596a315db 100644 --- a/usr.sbin/unbound/validator/val_sigcrypt.c +++ b/usr.sbin/unbound/validator/val_sigcrypt.c @@ -48,6 +48,7 @@ #include "util/data/msgparse.h" #include "util/data/dname.h" #include "util/rbtree.h" +#include "util/rfc_1982.h" #include "util/module.h" #include "util/net_help.h" #include "util/regional.h" @@ -718,9 +719,9 @@ dnskey_verify_rrset(struct module_env* env, struct val_env* ve, } verbose(VERB_ALGO, "rrset failed to verify: all signatures are bogus"); if(!numchecked) { - *reason = "signature missing"; + *reason = "signature for expected key and algorithm missing"; if(reason_bogus) - *reason_bogus = LDNS_EDE_RRSIGS_MISSING; + *reason_bogus = LDNS_EDE_DNSSEC_BOGUS; } else if(numchecked == numindeterminate) { verbose(VERB_ALGO, "rrset failed to verify due to algorithm " "refusal by cryptolib"); @@ -1378,44 +1379,6 @@ sigdate_error(const char* str, int32_t expi, int32_t incep, int32_t now) (unsigned)incep, (unsigned)now); } -/** RFC 1982 comparison, uses unsigned integers, and tries to avoid - * compiler optimization (eg. by avoiding a-b<0 comparisons), - * this routine matches compare_serial(), for SOA serial number checks */ -static int -compare_1982(uint32_t a, uint32_t b) -{ - /* for 32 bit values */ - const uint32_t cutoff = ((uint32_t) 1 << (32 - 1)); - - if (a == b) { - return 0; - } else if ((a < b && b - a < cutoff) || (a > b && a - b > cutoff)) { - return -1; - } else { - return 1; - } -} - -/** if we know that b is larger than a, return the difference between them, - * that is the distance between them. in RFC1982 arith */ -static uint32_t -subtract_1982(uint32_t a, uint32_t b) -{ - /* for 32 bit values */ - const uint32_t cutoff = ((uint32_t) 1 << (32 - 1)); - - if(a == b) - return 0; - if(a < b && b - a < cutoff) { - return b-a; - } - if(a > b && a - b > cutoff) { - return ((uint32_t)0xffffffff) - (a-b-1); - } - /* wrong case, b smaller than a */ - return 0; -} - /** check rrsig dates */ static int check_dates(struct val_env* ve, uint32_t unow, uint8_t* expi_p, diff --git a/usr.sbin/unbound/validator/val_utils.c b/usr.sbin/unbound/validator/val_utils.c index bd1c29b72..ba7a66a22 100644 --- a/usr.sbin/unbound/validator/val_utils.c +++ b/usr.sbin/unbound/validator/val_utils.c @@ -587,16 +587,18 @@ val_verify_new_DNSKEYs(struct regional* region, struct module_env* env, return key_entry_create_rrset(region, ds_rrset->rk.dname, ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class), dnskey_rrset, - downprot?sigalg:NULL, *env->now); + downprot?sigalg:NULL, LDNS_EDE_NONE, NULL, + *env->now); } else if(sec == sec_status_insecure) { return key_entry_create_null(region, ds_rrset->rk.dname, ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class), - rrset_get_ttl(ds_rrset), *env->now); + rrset_get_ttl(ds_rrset), *reason_bogus, *reason, + *env->now); } return key_entry_create_bad(region, ds_rrset->rk.dname, ds_rrset->rk.dname_len, ntohs(ds_rrset->rk.rrset_class), - BOGUS_KEY_TTL, *env->now); + BOGUS_KEY_TTL, *reason_bogus, *reason, *env->now); } enum sec_status @@ -694,7 +696,7 @@ val_verify_DNSKEY_with_TA(struct module_env* env, struct val_env* ve, has_useful_ta = 1; sec = dnskey_verify_rrset(env, ve, dnskey_rrset, - ta_dnskey, i, reason, NULL, LDNS_SECTION_ANSWER, qstate); + ta_dnskey, i, reason, reason_bogus, LDNS_SECTION_ANSWER, qstate); if(sec == sec_status_secure) { if(!sigalg || algo_needs_set_secure(&needs, (uint8_t)dnskey_get_algo(ta_dnskey, i))) { @@ -743,16 +745,17 @@ val_verify_new_DNSKEYs_with_ta(struct regional* region, struct module_env* env, return key_entry_create_rrset(region, dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class), dnskey_rrset, - downprot?sigalg:NULL, *env->now); + downprot?sigalg:NULL, LDNS_EDE_NONE, NULL, *env->now); } else if(sec == sec_status_insecure) { return key_entry_create_null(region, dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class), - rrset_get_ttl(dnskey_rrset), *env->now); + rrset_get_ttl(dnskey_rrset), *reason_bogus, *reason, + *env->now); } return key_entry_create_bad(region, dnskey_rrset->rk.dname, dnskey_rrset->rk.dname_len, ntohs(dnskey_rrset->rk.rrset_class), - BOGUS_KEY_TTL, *env->now); + BOGUS_KEY_TTL, *reason_bogus, *reason, *env->now); } int diff --git a/usr.sbin/unbound/validator/validator.c b/usr.sbin/unbound/validator/validator.c index 2af6e7232..8ff3f02ff 100644 --- a/usr.sbin/unbound/validator/validator.c +++ b/usr.sbin/unbound/validator/validator.c @@ -70,16 +70,16 @@ static void process_ds_response(struct module_qstate* qstate, struct query_info* qinfo, struct sock_list* origin); -/* Updates the suplied EDE (RFC8914) code selectively so we don't loose - * a more specific code - */ +/* Updates the suplied EDE (RFC8914) code selectively so we don't lose + * a more specific code */ static void update_reason_bogus(struct reply_info* rep, sldns_ede_code reason_bogus) { - if (rep->reason_bogus == LDNS_EDE_DNSSEC_BOGUS || - rep->reason_bogus == LDNS_EDE_NONE) { - rep->reason_bogus = reason_bogus; - } + if(reason_bogus == LDNS_EDE_NONE) return; + if(reason_bogus == LDNS_EDE_DNSSEC_BOGUS + && rep->reason_bogus != LDNS_EDE_NONE + && rep->reason_bogus != LDNS_EDE_DNSSEC_BOGUS) return; + rep->reason_bogus = reason_bogus; } @@ -112,7 +112,7 @@ fill_nsec3_iter(struct val_env* ve, char* s, int c) s = e; if(i>0 && ve->nsec3_keysize[i-1] >= ve->nsec3_keysize[i]) { log_err("nsec3 key iterations not ascending: %d %d", - (int)ve->nsec3_keysize[i-1], + (int)ve->nsec3_keysize[i-1], (int)ve->nsec3_keysize[i]); return 0; } @@ -1672,20 +1672,13 @@ processInit(struct module_qstate* qstate, struct val_qstate* vq, vq->state = VAL_FINISHED_STATE; return 1; } else if(key_entry_isbad(vq->key_entry)) { - sldns_ede_code ede = LDNS_EDE_DNSSEC_BOGUS; - - /* the key could have a more spefic EDE than just bogus */ - if(key_entry_get_reason_bogus(vq->key_entry) != LDNS_EDE_NONE) { - ede = key_entry_get_reason_bogus(vq->key_entry); - } - + /* Bad keys should have the relevant EDE code and text */ + sldns_ede_code ede = key_entry_get_reason_bogus(vq->key_entry); /* key is bad, chain is bad, reply is bogus */ errinf_dname(qstate, "key for validation", vq->key_entry->name); errinf_ede(qstate, "is marked as invalid", ede); - if(key_entry_get_reason(vq->key_entry)) { - errinf(qstate, "because of a previous"); - errinf(qstate, key_entry_get_reason(vq->key_entry)); - } + errinf(qstate, "because of a previous"); + errinf(qstate, key_entry_get_reason(vq->key_entry)); /* no retries, stop bothering the authority until timeout */ vq->restart_count = ve->max_restart; @@ -1888,7 +1881,8 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq, vq->chase_reply->security = sec_status_insecure; val_mark_insecure(vq->chase_reply, vq->key_entry->name, qstate->env->rrset_cache, qstate->env); - key_cache_insert(ve->kcache, vq->key_entry, qstate); + key_cache_insert(ve->kcache, vq->key_entry, + qstate->env->cfg->val_log_level >= 2); return 1; } @@ -1897,12 +1891,13 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq, "of trust to keys for", vq->key_entry->name, LDNS_RR_TYPE_DNSKEY, vq->key_entry->key_class); vq->chase_reply->security = sec_status_bogus; - - update_reason_bogus(vq->chase_reply, LDNS_EDE_DNSKEY_MISSING); + update_reason_bogus(vq->chase_reply, + key_entry_get_reason_bogus(vq->key_entry)); errinf_ede(qstate, "while building chain of trust", - LDNS_EDE_DNSKEY_MISSING); + key_entry_get_reason_bogus(vq->key_entry)); if(vq->restart_count >= ve->max_restart) - key_cache_insert(ve->kcache, vq->key_entry, qstate); + key_cache_insert(ve->kcache, vq->key_entry, + qstate->env->cfg->val_log_level >= 2); return 1; } @@ -2151,9 +2146,19 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq, log_query_info(NO_VERBOSE, "validation failure", &qstate->qinfo); else { - char* err = errinf_to_str_bogus(qstate); - if(err) log_info("%s", err); - free(err); + char* err_str = errinf_to_str_bogus(qstate); + if(err_str) { + size_t err_str_len = strlen(err_str); + log_info("%s", err_str); + /* allocate space and store the error + * string */ + vq->orig_msg->rep->reason_bogus_str = regional_alloc( + qstate->region, + sizeof(char) * (err_str_len+1)); + memcpy(vq->orig_msg->rep->reason_bogus_str, + err_str, err_str_len+1); + } + free(err_str); } } /* @@ -2195,6 +2200,9 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq, } } } + + /* Update rep->reason_bogus as it is the one being cached */ + update_reason_bogus(vq->orig_msg->rep, errinf_to_reason_bogus(qstate)); /* store results in cache */ if(qstate->query_flags&BIT_RD) { /* if secure, this will override cache anyway, no need @@ -2370,13 +2378,17 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset, log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- " "could not fetch DNSKEY rrset", ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass); + reason_bogus = LDNS_EDE_DNSKEY_MISSING; + reason = "no DNSKEY rrset"; if(qstate->env->cfg->harden_dnssec_stripped) { - errinf_ede(qstate, "no DNSKEY rrset", LDNS_EDE_DNSKEY_MISSING); + errinf_ede(qstate, reason, reason_bogus); kkey = key_entry_create_bad(qstate->region, ta->name, ta->namelen, ta->dclass, BOGUS_KEY_TTL, + reason_bogus, reason, *qstate->env->now); } else kkey = key_entry_create_null(qstate->region, ta->name, ta->namelen, ta->dclass, NULL_KEY_TTL, + reason_bogus, reason, *qstate->env->now); if(!kkey) { log_err("out of memory: allocate fail prime key"); @@ -2409,9 +2421,11 @@ primeResponseToKE(struct ub_packed_rrset_key* dnskey_rrset, errinf_ede(qstate, reason, reason_bogus); kkey = key_entry_create_bad(qstate->region, ta->name, ta->namelen, ta->dclass, BOGUS_KEY_TTL, + reason_bogus, reason, *qstate->env->now); } else kkey = key_entry_create_null(qstate->region, ta->name, ta->namelen, ta->dclass, NULL_KEY_TTL, + reason_bogus, reason, *qstate->env->now); if(!kkey) { log_err("out of memory: allocate null prime key"); @@ -2458,8 +2472,9 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, /* errors here pretty much break validation */ verbose(VERB_DETAIL, "DS response was error, thus bogus"); errinf(qstate, rc); - errinf_ede(qstate, "no DS", LDNS_EDE_NETWORK_ERROR); - + reason = "no DS"; + reason_bogus = LDNS_EDE_NETWORK_ERROR; + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } @@ -2473,7 +2488,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, if(!ds) { log_warn("internal error: POSITIVE DS response was " "missing DS."); - errinf_ede(qstate, "no DS record", LDNS_EDE_DNSSEC_BOGUS); + reason = "no DS record"; + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } /* Verify only returns BOGUS or SECURE. If the rrset is @@ -2492,13 +2508,11 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, if(!val_dsset_isusable(ds)) { /* If they aren't usable, then we treat it like * there was no DS. */ - - /* TODO add EDE Unsupported DS Digest Type; this needs - * EDE to be added on non SERVFAIL answers. */ - *ke = key_entry_create_null(qstate->region, qinfo->qname, qinfo->qname_len, qinfo->qclass, - ub_packed_rrset_ttl(ds), *qstate->env->now); + ub_packed_rrset_ttl(ds), + LDNS_EDE_UNSUPPORTED_DS_DIGEST, NULL, + *qstate->env->now); return (*ke) != NULL; } @@ -2506,7 +2520,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, log_query_info(VERB_DETAIL, "validated DS", qinfo); *ke = key_entry_create_rrset(qstate->region, qinfo->qname, qinfo->qname_len, qinfo->qclass, ds, - NULL, *qstate->env->now); + NULL, LDNS_EDE_NONE, NULL, *qstate->env->now); return (*ke) != NULL; } else if(subtype == VAL_CLASS_NODATA || subtype == VAL_CLASS_NAMEERROR) { @@ -2518,7 +2532,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, /* make sure there are NSECs or NSEC3s with signatures */ if(!val_has_signed_nsecs(msg->rep, &reason)) { verbose(VERB_ALGO, "no NSECs: %s", reason); - errinf_ede(qstate, reason, LDNS_EDE_NSEC_MISSING); + reason_bogus = LDNS_EDE_NSEC_MISSING; + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } @@ -2530,7 +2545,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, /* Try to prove absence of the DS with NSEC */ sec = val_nsec_prove_nodata_dsreply( qstate->env, ve, qinfo, msg->rep, vq->key_entry, - &proof_ttl, &reason, qstate); + &proof_ttl, &reason, &reason_bogus, qstate); switch(sec) { case sec_status_secure: verbose(VERB_DETAIL, "NSEC RRset for the " @@ -2538,6 +2553,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, *ke = key_entry_create_null(qstate->region, qinfo->qname, qinfo->qname_len, qinfo->qclass, proof_ttl, + LDNS_EDE_NONE, NULL, *qstate->env->now); return (*ke) != NULL; case sec_status_insecure: @@ -2571,6 +2587,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, *ke = key_entry_create_null(qstate->region, qinfo->qname, qinfo->qname_len, qinfo->qclass, proof_ttl, + LDNS_EDE_NONE, NULL, *qstate->env->now); return (*ke) != NULL; case sec_status_indeterminate: @@ -2593,7 +2610,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, * this is BOGUS. */ verbose(VERB_DETAIL, "DS %s ran out of options, so return " "bogus", val_classification_to_string(subtype)); - errinf(qstate, "no DS but also no proof of that"); + reason = "no DS but also no proof of that"; + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } else if(subtype == VAL_CLASS_CNAME || subtype == VAL_CLASS_CNAMENOANSWER) { @@ -2605,22 +2623,25 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, cname = reply_find_rrset_section_an(msg->rep, qinfo->qname, qinfo->qname_len, LDNS_RR_TYPE_CNAME, qinfo->qclass); if(!cname) { - errinf(qstate, "validator classified CNAME but no " - "CNAME of the queried name for DS"); + reason = "validator classified CNAME but no " + "CNAME of the queried name for DS"; + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } if(((struct packed_rrset_data*)cname->entry.data)->rrsig_count == 0) { if(msg->rep->an_numrrsets != 0 && ntohs(msg->rep-> rrsets[0]->rk.type)==LDNS_RR_TYPE_DNAME) { - errinf(qstate, "DS got DNAME answer"); + reason = "DS got DNAME answer"; } else { - errinf(qstate, "DS got unsigned CNAME answer"); + reason = "DS got unsigned CNAME answer"; } + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } sec = val_verify_rrset_entry(qstate->env, ve, cname, - vq->key_entry, &reason, NULL, LDNS_SECTION_ANSWER, qstate); + vq->key_entry, &reason, &reason_bogus, + LDNS_SECTION_ANSWER, qstate); if(sec == sec_status_secure) { verbose(VERB_ALGO, "CNAME validated, " "proof that DS does not exist"); @@ -2629,12 +2650,13 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, return 1; } errinf(qstate, "CNAME in DS response was not secure."); - errinf(qstate, reason); + errinf_ede(qstate, reason, reason_bogus); goto return_bogus; } else { verbose(VERB_QUERY, "Encountered an unhandled type of " "DS response, thus bogus."); errinf(qstate, "no DS and"); + reason = "no DS"; if(FLAGS_GET_RCODE(msg->rep->flags) != LDNS_RCODE_NOERROR) { char rc[16]; rc[0]=0; @@ -2647,8 +2669,8 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq, } return_bogus: *ke = key_entry_create_bad(qstate->region, qinfo->qname, - qinfo->qname_len, qinfo->qclass, - BOGUS_KEY_TTL, *qstate->env->now); + qinfo->qname_len, qinfo->qclass, BOGUS_KEY_TTL, + reason_bogus, reason, *qstate->env->now); return (*ke) != NULL; } @@ -2768,14 +2790,17 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq, vq->restart_count++; return; } + reason = "No DNSKEY record"; + reason_bogus = LDNS_EDE_DNSKEY_MISSING; vq->key_entry = key_entry_create_bad(qstate->region, qinfo->qname, qinfo->qname_len, qinfo->qclass, - BOGUS_KEY_TTL, *qstate->env->now); + BOGUS_KEY_TTL, reason_bogus, reason, + *qstate->env->now); if(!vq->key_entry) { log_err("alloc failure in missing dnskey response"); /* key_entry is NULL for failure in Validate */ } - errinf_ede(qstate, "No DNSKEY record", LDNS_EDE_DNSKEY_MISSING); + errinf_ede(qstate, reason, reason_bogus); errinf_origin(qstate, origin); errinf_dname(qstate, "for key", qinfo->qname); vq->state = VAL_VALIDATE_STATE; @@ -2822,7 +2847,8 @@ process_dnskey_response(struct module_qstate* qstate, struct val_qstate* vq, qstate->errinf = NULL; /* The DNSKEY validated, so cache it as a trusted key rrset. */ - key_cache_insert(ve->kcache, vq->key_entry, qstate); + key_cache_insert(ve->kcache, vq->key_entry, + qstate->env->cfg->val_log_level >= 2); /* If good, we stay in the FINDKEY state. */ log_query_info(VERB_DETAIL, "validated DNSKEY", qinfo); @@ -2890,7 +2916,8 @@ process_prime_response(struct module_qstate* qstate, struct val_qstate* vq, errinf_origin(qstate, origin); errinf_dname(qstate, "for trust anchor", ta->name); /* store the freshly primed entry in the cache */ - key_cache_insert(ve->kcache, vq->key_entry, qstate); + key_cache_insert(ve->kcache, vq->key_entry, + qstate->env->cfg->val_log_level >= 2); } /* If the result of the prime is a null key, skip the FINDKEY state.*/