Skip to content

Commit

Permalink
Merge remote-tracking branch 'nlnet/master'
Browse files Browse the repository at this point in the history 
* nlnet/master:
  Regenerate configure for the fix acx_nlnetlabs.m4 for -Wstrict-prototypes.
  - Fix acx_nlnetlabs.m4 for -Wstrict-prototypes.
  Fix NLnetLabs#833: [FR] Ability to set the Redis password.
  - Fix NLnetLabs#835: [FR] Ability to use Redis unix sockets.
  - Add NLnetLabs#835: [FR] Ability to use Redis unix sockets.
  Changelog note for NLnetLabs#819, generate configparser.c and comment syntax change. - Merge NLnetLabs#819: Added new static zone type block_a to suppress all A   queries for specific zones.
  - Fix test for new default.
  - Set default for harden-unknown-additional to no. So that it does   not hamper future protocol developments.
  - Add harden-unknown-additional option. Default on and it removes   unknown records from the authority section and additional section.   Thanks to Xiang Li, from NISL Lab, Tsinghua University.
  - Set max-udp-size default to 1232. This is the same default value as   the default value for edns-buffer-size. It restricts client edns   buffer size choices, and makes unbound behave similar to other DNS   resolvers. The new choice, down from 4096 means it is harder to get   large responses from Unbound. Thanks to Xiang Li, from NISL Lab,   Tsinghua University.
  - Fix not following cleared RD flags potentially enables amplification   DDoS attacks, reported by Xiang Li and Wei Xu from NISL Lab,   Tsinghua University. The fix stops query loops, by refusing to send   RD=0 queries to a forwarder, they still get answered from cache.
  Added new static zone type block_a to suppress all A queries for specific zones
  • Loading branch information
@jedisct1
jedisct1 committed Jan 29, 2023
2 parents 7dba557 + 8b93829 commit ca5eb7a
Show file tree
Hide file tree
Showing 20 changed files with 5,170 additions and 4,860 deletions.
29 changes: 15 additions & 14 deletions acx_nlnetlabs.m4
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@
# Copyright 2009, Wouter Wijngaards, NLnet Labs.
# BSD licensed.
#
# Version 44
# Version 45
# 2023-01-26 fix -Wstrict-prototypes.
# 2022-09-01 fix checking if nonblocking sockets work on OpenBSD.
# 2021-08-17 fix sed script in ssldir split handling.
# 2021-08-17 fix for openssl to detect split version, with ssldir_include
Expand Down Expand Up @@ -187,7 +188,7 @@ dnl cache=`echo $1 | sed 'y%.=/+- %___p__%'`
AC_CACHE_VAL(cv_prog_cc_flag_needed_$cache,
[
echo '$2' > conftest.c
echo 'void f(){}' >>conftest.c
echo 'void f(void){}' >>conftest.c
if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
eval "cv_prog_cc_flag_needed_$cache=no"
else
Expand Down Expand Up @@ -233,7 +234,7 @@ dnl DEPFLAG: set to flag that generates dependencies.
AC_DEFUN([ACX_DEPFLAG],
[
AC_MSG_CHECKING([$CC dependency flag])
echo 'void f(){}' >conftest.c
echo 'void f(void){}' >conftest.c
if test "`$CC -MM conftest.c 2>&1`" = "conftest.o: conftest.c"; then
DEPFLAG="-MM"
else
Expand Down Expand Up @@ -272,7 +273,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAUL
#include <getopt.h>
#endif
int test() {
int test(void) {
int a;
char **opts = NULL;
struct timeval tv;
Expand Down Expand Up @@ -309,7 +310,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_DEFAUL
#include <getopt.h>
#endif
int test() {
int test(void) {
int a;
char **opts = NULL;
struct timeval tv;
Expand All @@ -335,7 +336,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG,
[
#include <stdbool.h>
#include <ctype.h>
int test() {
int test(void) {
int a = 0;
return a;
}
Expand All @@ -345,7 +346,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D_BSD_SOURCE -D_DEFAULT_SOURCE,
[
#include <ctype.h>
int test() {
int test(void) {
int a;
a = isascii(32);
return a;
Expand All @@ -356,7 +357,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D_GNU_SOURCE,
[
#include <netinet/in.h>
int test() {
int test(void) {
struct in6_pktinfo inf;
int a = (int)sizeof(inf);
return a;
Expand All @@ -370,7 +371,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D_GNU_SOURCE -D_FRSRESGID,
[
#include <unistd.h>
int test() {
int test(void) {
int a = setresgid(0,0,0);
a = setresuid(0,0,0);
return a;
Expand All @@ -385,7 +386,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D_POSIX_C_SOURCE=200112,
#endif
#include <netdb.h>
int test() {
int test(void) {
int a = 0;
char *t;
time_t time = 0;
Expand Down Expand Up @@ -413,7 +414,7 @@ ACX_CHECK_COMPILER_FLAG_NEEDED(-D__EXTENSIONS__,
#include <getopt.h>
#endif
int test() {
int test(void) {
int a;
char **opts = NULL;
struct timeval tv;
Expand Down Expand Up @@ -834,7 +835,7 @@ dnl try to see if an additional _LARGEFILE_SOURCE 1 is needed to get fseeko
ACX_CHECK_COMPILER_FLAG_NEEDED(-D_LARGEFILE_SOURCE=1,
[
#include <stdio.h>
int test() {
int test(void) {
int a = fseeko(stdin, 0, 0);
return a;
}
Expand All @@ -859,7 +860,7 @@ char* (*f) () = getaddrinfo;
#ifdef __cplusplus
}
#endif
int main() {
int main(void) {
;
return 0;
}
Expand Down Expand Up @@ -923,7 +924,7 @@ cache=`echo $1 | sed 'y%.=/+-%___p_%'`
AC_CACHE_VAL(cv_cc_deprecated_$cache,
[
echo '$3' >conftest.c
echo 'void f(){ $2 }' >>conftest.c
echo 'void f(void){ $2 }' >>conftest.c
if test -z "`$CC $CPPFLAGS $CFLAGS -c conftest.c 2>&1 | grep -e deprecated -e unavailable`"; then
eval "cv_cc_deprecated_$cache=no"
else
Expand Down
23 changes: 21 additions & 2 deletions cachedb/redis.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -56,6 +56,8 @@ struct redis_moddata {
int numctxs; /* number of ctx entries */
const char* server_host; /* server's IP address or host name */
int server_port; /* server's TCP port */
const char* server_path; /* server's unix path, or "", NULL if unused */
const char* server_password; /* server's AUTH password, or "", NULL if unused */
struct timeval timeout; /* timeout for connection setup and commands */
};

Expand All @@ -67,8 +69,13 @@ redis_connect(const struct redis_moddata* moddata)
{
redisContext* ctx;

ctx = redisConnectWithTimeout(moddata->server_host,
moddata->server_port, moddata->timeout);
if(moddata->server_path && moddata->server_path[0]!=0) {
ctx = redisConnectUnixWithTimeout(moddata->server_path,
moddata->timeout);
} else {
ctx = redisConnectWithTimeout(moddata->server_host,
moddata->server_port, moddata->timeout);
}
if(!ctx || ctx->err) {
const char *errstr = "out of memory";
if(ctx)
Expand All @@ -80,6 +87,16 @@ redis_connect(const struct redis_moddata* moddata)
log_err("failed to set redis timeout");
goto fail;
}
if(moddata->server_password && moddata->server_password[0]!=0) {
redisReply* rep;
rep = redisCommand(ctx, "AUTH %s", moddata->server_password);
if(!rep || rep->type == REDIS_REPLY_ERROR) {
log_err("failed to authenticate with password");
freeReplyObject(rep);
goto fail;
}
freeReplyObject(rep);
}
return ctx;

fail:
Expand Down Expand Up @@ -112,6 +129,8 @@ redis_init(struct module_env* env, struct cachedb_env* cachedb_env)
* we don't have to free it in this module. */
moddata->server_host = env->cfg->redis_server_host;
moddata->server_port = env->cfg->redis_server_port;
moddata->server_path = env->cfg->redis_server_path;
moddata->server_password = env->cfg->redis_server_password;
moddata->timeout.tv_sec = env->cfg->redis_timeout / 1000;
moddata->timeout.tv_usec = (env->cfg->redis_timeout % 1000) * 1000;
for(i = 0; i < moddata->numctxs; i++)
Expand Down
42 changes: 21 additions & 21 deletions configure
View file
Original file line number Diff line number Diff line change
Expand Up @@ -5146,7 +5146,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu

{ $as_echo "$as_me:${as_lineno-$LINENO}: checking $CC dependency flag" >&5
$as_echo_n "checking $CC dependency flag... " >&6; }
echo 'void f(){}' >conftest.c
echo 'void f(void){}' >conftest.c
if test "`$CC -MM conftest.c 2>&1`" = "conftest.o: conftest.c"; then
DEPFLAG="-MM"
else
Expand Down Expand Up @@ -5328,7 +5328,7 @@ echo '
#include <getopt.h>
#endif

int test() {
int test(void) {
int a;
char **opts = NULL;
struct timeval tv;
Expand All @@ -5349,7 +5349,7 @@ int test() {
return a;
}
' > conftest.c
echo 'void f(){}' >>conftest.c
echo 'void f(void){}' >>conftest.c
if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
eval "cv_prog_cc_flag_needed_$cache=no"
else
Expand Down Expand Up @@ -5419,7 +5419,7 @@ echo '
#include <getopt.h>
#endif

int test() {
int test(void) {
int a;
char **opts = NULL;
struct timeval tv;
Expand All @@ -5440,7 +5440,7 @@ int test() {
return a;
}
' > conftest.c
echo 'void f(){}' >>conftest.c
echo 'void f(void){}' >>conftest.c
if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
eval "cv_prog_cc_flag_needed_$cache=no"
else
Expand Down Expand Up @@ -5499,12 +5499,12 @@ else
echo '
#include <stdbool.h>
#include <ctype.h>
int test() {
int test(void) {
int a = 0;
return a;
}
' > conftest.c
echo 'void f(){}' >>conftest.c
echo 'void f(void){}' >>conftest.c
if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
eval "cv_prog_cc_flag_needed_$cache=no"
else
Expand Down Expand Up @@ -5563,13 +5563,13 @@ else
echo '
#include <ctype.h>

int test() {
int test(void) {
int a;
a = isascii(32);
return a;
}
' > conftest.c
echo 'void f(){}' >>conftest.c
echo 'void f(void){}' >>conftest.c
if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
eval "cv_prog_cc_flag_needed_$cache=no"
else
Expand Down Expand Up @@ -5628,13 +5628,13 @@ else
echo '
#include <netinet/in.h>

int test() {
int test(void) {
struct in6_pktinfo inf;
int a = (int)sizeof(inf);
return a;
}
' > conftest.c
echo 'void f(){}' >>conftest.c
echo 'void f(void){}' >>conftest.c
if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
eval "cv_prog_cc_flag_needed_$cache=no"
else
Expand Down Expand Up @@ -5696,13 +5696,13 @@ else
echo '
#include <unistd.h>

int test() {
int test(void) {
int a = setresgid(0,0,0);
a = setresuid(0,0,0);
return a;
}
' > conftest.c
echo 'void f(){}' >>conftest.c
echo 'void f(void){}' >>conftest.c
if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
eval "cv_prog_cc_flag_needed_$cache=no"
else
Expand Down Expand Up @@ -5765,7 +5765,7 @@ echo '
#endif
#include <netdb.h>

int test() {
int test(void) {
int a = 0;
char *t;
time_t time = 0;
Expand All @@ -5778,7 +5778,7 @@ int test() {
return a;
}
' > conftest.c
echo 'void f(){}' >>conftest.c
echo 'void f(void){}' >>conftest.c
if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
eval "cv_prog_cc_flag_needed_$cache=no"
else
Expand Down Expand Up @@ -5847,7 +5847,7 @@ echo '
#include <getopt.h>
#endif

int test() {
int test(void) {
int a;
char **opts = NULL;
struct timeval tv;
Expand All @@ -5860,7 +5860,7 @@ int test() {
return a;
}
' > conftest.c
echo 'void f(){}' >>conftest.c
echo 'void f(void){}' >>conftest.c
if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
eval "cv_prog_cc_flag_needed_$cache=no"
else
Expand Down Expand Up @@ -15955,12 +15955,12 @@ else

echo '
#include <stdio.h>
int test() {
int test(void) {
int a = fseeko(stdin, 0, 0);
return a;
}
' > conftest.c
echo 'void f(){}' >>conftest.c
echo 'void f(void){}' >>conftest.c
if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
eval "cv_prog_cc_flag_needed_$cache=no"
else
Expand Down Expand Up @@ -20211,7 +20211,7 @@ char* (*f) () = getaddrinfo;
#ifdef __cplusplus
}
#endif
int main() {
int main(void) {
;
return 0;
}
Expand Down Expand Up @@ -20485,7 +20485,7 @@ echo '
#include <stdlib.h>
#include <unistd.h>
' >conftest.c
echo 'void f(){ (void)daemon(0, 0); }' >>conftest.c
echo 'void f(void){ (void)daemon(0, 0); }' >>conftest.c
if test -z "`$CC $CPPFLAGS $CFLAGS -c conftest.c 2>&1 | grep -e deprecated -e unavailable`"; then
eval "cv_cc_deprecated_$cache=no"
else
Expand Down
33 changes: 33 additions & 0 deletions doc/Changelog
View file
Original file line number Diff line number Diff line change
@@ -1,3 +1,36 @@
26 January 2023: Wouter
- Fix acx_nlnetlabs.m4 for -Wstrict-prototypes.

23 January 2023: George
- Fix #833: [FR] Ability to set the Redis password.

23 January 2023: Wouter
- Fix #835: [FR] Ability to use Redis unix sockets.

20 January 2023: Wouter
- Merge #819: Added new static zone type block_a to suppress all A
queries for specific zones.

19 January 2023: Wouter
- Set max-udp-size default to 1232. This is the same default value as
the default value for edns-buffer-size. It restricts client edns
buffer size choices, and makes unbound behave similar to other DNS
resolvers. The new choice, down from 4096 means it is harder to get
large responses from Unbound. Thanks to Xiang Li, from NISL Lab,
Tsinghua University.
- Add harden-unknown-additional option. It removes
unknown records from the authority section and additional section.
Thanks to Xiang Li, from NISL Lab, Tsinghua University.
- Set default for harden-unknown-additional to no. So that it does
not hamper future protocol developments.
- Fix test for new default.

18 January 2023: Wouter
- Fix not following cleared RD flags potentially enables amplification
DDoS attacks, reported by Xiang Li and Wei Xu from NISL Lab,
Tsinghua University. The fix stops query loops, by refusing to send
RD=0 queries to a forwarder, they still get answered from cache.

13 January 2023: Wouter
- Merge #826: Аdd a metric about the maximum number of collisions in
lrushah.
Expand Down
Loading

0 comments on commit ca5eb7a

Please sign in to comment.