upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-24 00:29:58 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Note that for harden-below-nxdomain the nxdomain must be secure,

Browse source 
this means nsec3 with optout is insufficient.


git-svn-id: file:///svn/unbound/trunk@3925 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2016-11-04 14:49:43 +00:00
parent 11031a7d36
commit ba274dd312
3 changed files with 70 additions and 52 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
doc/Changelog
View file

@ -6,6 +6,8 @@
manner. Every function on its own, so that other libraries (eg. manner. Every function on its own, so that other libraries (eg.
LibreSSL) can develop their API without hindrance. LibreSSL) can develop their API without hindrance.
- Fix #1154: segfault when reading config with duplicate zones. - Fix #1154: segfault when reading config with duplicate zones.
- Note that for harden-below-nxdomain the nxdomain must be secure,
this means nsec3 with optout is insufficient.
3 November 2016: Ralph 3 November 2016: Ralph
- Set OpenSSL security level to 0 when using aNULL ciphers. - Set OpenSSL security level to 0 when using aNULL ciphers.

1
doc/unbound.conf.5.in
View file

@ -631,6 +631,7 @@ might return nxdomain for empty nonterminals (that usually happen for reverse
IP address lookups), and thus may be incompatible with this. To try to avoid IP address lookups), and thus may be incompatible with this. To try to avoid
this only DNSSEC-secure nxdomains are used, because the old software does not this only DNSSEC-secure nxdomains are used, because the old software does not
have DNSSEC. Default is off. have DNSSEC. Default is off.
The nxdomain must be secure, this means nsec3 with optout is insufficient.
Currently, draft\-ietf\-dnsop\-nxdomain\-cut promotes this technique. Currently, draft\-ietf\-dnsop\-nxdomain\-cut promotes this technique.
.TP .TP
.B harden\-referral\-path: \fI<yes or no> .B harden\-referral\-path: \fI<yes or no>

109
util/configlexer.c
View file

@ -10,7 +10,7 @@
#define FLEX_SCANNER #define FLEX_SCANNER
#define YY_FLEX_MAJOR_VERSION 2 #define YY_FLEX_MAJOR_VERSION 2
#define YY_FLEX_MINOR_VERSION 6 #define YY_FLEX_MINOR_VERSION 6
#define YY_FLEX_SUBMINOR_VERSION 1 #define YY_FLEX_SUBMINOR_VERSION 0
#if YY_FLEX_SUBMINOR_VERSION > 0 #if YY_FLEX_SUBMINOR_VERSION > 0
#define FLEX_BETA #define FLEX_BETA
#endif #endif
@ -89,13 +89,25 @@ typedef unsigned int flex_uint32_t;
#endif /* ! FLEXINT_H */ #endif /* ! FLEXINT_H */
/* TODO: this is always defined, so inline it */ #ifdef __cplusplus
#define yyconst const
#if defined(__GNUC__) && __GNUC__ >= 3 /* The "const" storage-class-modifier is valid. */
#define yynoreturn __attribute__((__noreturn__)) #define YY_USE_CONST
#else /* ! __cplusplus */
/* C99 requires __STDC__ to be defined as 1. */
#if defined (__STDC__)
#define YY_USE_CONST
#endif /* defined (__STDC__) */
#endif /* ! __cplusplus */
#ifdef YY_USE_CONST
#define yyconst const
#else #else
#define yynoreturn #define yyconst
#endif #endif
/* Returned upon end-of-file. */ /* Returned upon end-of-file. */
@ -156,7 +168,7 @@ typedef struct yy_buffer_state *YY_BUFFER_STATE;
typedef size_t yy_size_t; typedef size_t yy_size_t;
#endif #endif
extern int yyleng; extern yy_size_t yyleng;
extern FILE *yyin, *yyout; extern FILE *yyin, *yyout;
@ -195,12 +207,12 @@ struct yy_buffer_state
/* Size of input buffer in bytes, not including room for EOB /* Size of input buffer in bytes, not including room for EOB
* characters. * characters.
*/ */
int yy_buf_size; yy_size_t yy_buf_size;
/* Number of characters read into yy_ch_buf, not including EOB /* Number of characters read into yy_ch_buf, not including EOB
* characters. * characters.
*/ */
int yy_n_chars; yy_size_t yy_n_chars;
/* Whether we "own" the buffer - i.e., we know we created it, /* Whether we "own" the buffer - i.e., we know we created it,
* and can realloc() it to grow it, and should free() it to * and can realloc() it to grow it, and should free() it to
@ -251,7 +263,7 @@ struct yy_buffer_state
/* Stack of input buffers. */ /* Stack of input buffers. */
static size_t yy_buffer_stack_top = 0; /**< index of top of stack. */ static size_t yy_buffer_stack_top = 0; /**< index of top of stack. */
static size_t yy_buffer_stack_max = 0; /**< capacity of stack. */ static size_t yy_buffer_stack_max = 0; /**< capacity of stack. */
static YY_BUFFER_STATE * yy_buffer_stack = NULL; /**< Stack as an array. */ static YY_BUFFER_STATE * yy_buffer_stack = 0; /**< Stack as an array. */
/* We provide macros for accessing buffer states in case in the /* We provide macros for accessing buffer states in case in the
* future we want to put the buffer states in a more general * future we want to put the buffer states in a more general
@ -270,11 +282,11 @@ static YY_BUFFER_STATE * yy_buffer_stack = NULL; /**< Stack as an array. */
/* yy_hold_char holds the character lost when yytext is formed. */ /* yy_hold_char holds the character lost when yytext is formed. */
static char yy_hold_char; static char yy_hold_char;
static int yy_n_chars; /* number of characters read into yy_ch_buf */ static yy_size_t yy_n_chars; /* number of characters read into yy_ch_buf */
int yyleng; yy_size_t yyleng;
/* Points to current character in buffer. */ /* Points to current character in buffer. */
static char *yy_c_buf_p = NULL; static char *yy_c_buf_p = (char *) 0;
static int yy_init = 0; /* whether we need to initialize */ static int yy_init = 0; /* whether we need to initialize */
static int yy_start = 0; /* start state number */ static int yy_start = 0; /* start state number */
@ -299,7 +311,7 @@ static void yy_init_buffer (YY_BUFFER_STATE b,FILE *file );
YY_BUFFER_STATE yy_scan_buffer (char *base,yy_size_t size ); YY_BUFFER_STATE yy_scan_buffer (char *base,yy_size_t size );
YY_BUFFER_STATE yy_scan_string (yyconst char *yy_str ); YY_BUFFER_STATE yy_scan_string (yyconst char *yy_str );
YY_BUFFER_STATE yy_scan_bytes (yyconst char *bytes,int len ); YY_BUFFER_STATE yy_scan_bytes (yyconst char *bytes,yy_size_t len );
void *yyalloc (yy_size_t ); void *yyalloc (yy_size_t );
void *yyrealloc (void *,yy_size_t ); void *yyrealloc (void *,yy_size_t );
@ -333,7 +345,7 @@ void yyfree (void * );
typedef unsigned char YY_CHAR; typedef unsigned char YY_CHAR;
FILE *yyin = NULL, *yyout = NULL; FILE *yyin = (FILE *) 0, *yyout = (FILE *) 0;
typedef int yy_state_type; typedef int yy_state_type;
@ -350,7 +362,10 @@ extern char *yytext;
static yy_state_type yy_get_previous_state (void ); static yy_state_type yy_get_previous_state (void );
static yy_state_type yy_try_NUL_trans (yy_state_type current_state ); static yy_state_type yy_try_NUL_trans (yy_state_type current_state );
static int yy_get_next_buffer (void ); static int yy_get_next_buffer (void );
static void yynoreturn yy_fatal_error (yyconst char* msg ); #if defined(__GNUC__) && __GNUC__ >= 3
__attribute__((__noreturn__))
#endif
static void yy_fatal_error (yyconst char msg[] );
/* Done after the current pattern has been matched and before the /* Done after the current pattern has been matched and before the
* corresponding action - sets up yytext. * corresponding action - sets up yytext.
@ -358,7 +373,7 @@ static void yynoreturn yy_fatal_error (yyconst char* msg );
#define YY_DO_BEFORE_ACTION \ #define YY_DO_BEFORE_ACTION \
(yytext_ptr) = yy_bp; \ (yytext_ptr) = yy_bp; \
(yytext_ptr) -= (yy_more_len); \ (yytext_ptr) -= (yy_more_len); \
yyleng = (int) (yy_cp - (yytext_ptr)); \ yyleng = (size_t) (yy_cp - (yytext_ptr)); \
(yy_hold_char) = *yy_cp; \ (yy_hold_char) = *yy_cp; \
*yy_cp = '\0'; \ *yy_cp = '\0'; \
(yy_c_buf_p) = yy_cp; (yy_c_buf_p) = yy_cp;
@ -2147,7 +2162,7 @@ static void config_end_include(void)
#define YY_NO_INPUT 1 #define YY_NO_INPUT 1
#endif #endif
#line 2149 "<stdout>" #line 2164 "<stdout>"
#define INITIAL 0 #define INITIAL 0
#define quotedstring 1 #define quotedstring 1
@ -2191,7 +2206,7 @@ FILE *yyget_out (void );
void yyset_out (FILE * _out_str ); void yyset_out (FILE * _out_str );
int yyget_leng (void ); yy_size_t yyget_leng (void );
char *yyget_text (void ); char *yyget_text (void );
@ -2248,7 +2263,7 @@ static int input (void );
/* This used to be an fputs(), but since the string might contain NUL's, /* This used to be an fputs(), but since the string might contain NUL's,
* we now use fwrite(). * we now use fwrite().
*/ */
#define ECHO do { if (fwrite( yytext, (size_t) yyleng, 1, yyout )) {} } while (0) #define ECHO do { if (fwrite( yytext, yyleng, 1, yyout )) {} } while (0)
#endif #endif
/* Gets input and stuffs it into "buf". number of characters read, or YY_NULL, /* Gets input and stuffs it into "buf". number of characters read, or YY_NULL,
@ -2272,7 +2287,7 @@ static int input (void );
else \ else \
{ \ { \
errno=0; \ errno=0; \
while ( (result = (int) fread(buf, 1, max_size, yyin))==0 && ferror(yyin)) \ while ( (result = fread(buf, 1, max_size, yyin))==0 && ferror(yyin)) \
{ \ { \
if( errno != EINTR) \ if( errno != EINTR) \
{ \ { \
@ -2370,7 +2385,7 @@ YY_DECL
{ {
#line 207 "./util/configlexer.lex" #line 207 "./util/configlexer.lex"
#line 2372 "<stdout>" #line 2387 "<stdout>"
while ( /*CONSTCOND*/1 ) /* loops until end-of-file is reached */ while ( /*CONSTCOND*/1 ) /* loops until end-of-file is reached */
{ {
@ -2406,7 +2421,7 @@ yy_match:
if ( yy_current_state >= 1956 ) if ( yy_current_state >= 1956 )
yy_c = yy_meta[(unsigned int) yy_c]; yy_c = yy_meta[(unsigned int) yy_c];
} }
yy_current_state = yy_nxt[yy_base[yy_current_state] + (flex_int16_t) yy_c]; yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
++yy_cp; ++yy_cp;
} }
while ( yy_base[yy_current_state] != 3865 ); while ( yy_base[yy_current_state] != 3865 );
@ -3517,7 +3532,7 @@ YY_RULE_SETUP
#line 489 "./util/configlexer.lex" #line 489 "./util/configlexer.lex"
ECHO; ECHO;
YY_BREAK YY_BREAK
#line 3519 "<stdout>" #line 3534 "<stdout>"
case YY_END_OF_BUFFER: case YY_END_OF_BUFFER:
{ {
@ -3716,7 +3731,7 @@ static int yy_get_next_buffer (void)
if ( b->yy_is_our_buffer ) if ( b->yy_is_our_buffer )
{ {
int new_size = b->yy_buf_size * 2; yy_size_t new_size = b->yy_buf_size * 2;
if ( new_size <= 0 ) if ( new_size <= 0 )
b->yy_buf_size += b->yy_buf_size / 8; b->yy_buf_size += b->yy_buf_size / 8;
@ -3729,7 +3744,7 @@ static int yy_get_next_buffer (void)
} }
else else
/* Can't grow it, we don't own it. */ /* Can't grow it, we don't own it. */
b->yy_ch_buf = NULL; b->yy_ch_buf = 0;
if ( ! b->yy_ch_buf ) if ( ! b->yy_ch_buf )
YY_FATAL_ERROR( YY_FATAL_ERROR(
@ -3771,9 +3786,9 @@ static int yy_get_next_buffer (void)
else else
ret_val = EOB_ACT_CONTINUE_SCAN; ret_val = EOB_ACT_CONTINUE_SCAN;
if ((int) ((yy_n_chars) + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) { if ((yy_size_t) ((yy_n_chars) + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) {
/* Extend the array by 50%, plus the number we really need. */ /* Extend the array by 50%, plus the number we really need. */
int new_size = (yy_n_chars) + number_to_move + ((yy_n_chars) >> 1); yy_size_t new_size = (yy_n_chars) + number_to_move + ((yy_n_chars) >> 1);
YY_CURRENT_BUFFER_LVALUE->yy_ch_buf = (char *) yyrealloc((void *) YY_CURRENT_BUFFER_LVALUE->yy_ch_buf,new_size ); YY_CURRENT_BUFFER_LVALUE->yy_ch_buf = (char *) yyrealloc((void *) YY_CURRENT_BUFFER_LVALUE->yy_ch_buf,new_size );
if ( ! YY_CURRENT_BUFFER_LVALUE->yy_ch_buf ) if ( ! YY_CURRENT_BUFFER_LVALUE->yy_ch_buf )
YY_FATAL_ERROR( "out of dynamic memory in yy_get_next_buffer()" ); YY_FATAL_ERROR( "out of dynamic memory in yy_get_next_buffer()" );
@ -3811,7 +3826,7 @@ static int yy_get_next_buffer (void)
if ( yy_current_state >= 1956 ) if ( yy_current_state >= 1956 )
yy_c = yy_meta[(unsigned int) yy_c]; yy_c = yy_meta[(unsigned int) yy_c];
} }
yy_current_state = yy_nxt[yy_base[yy_current_state] + (flex_int16_t) yy_c]; yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
} }
return yy_current_state; return yy_current_state;
@ -3839,7 +3854,7 @@ static int yy_get_next_buffer (void)
if ( yy_current_state >= 1956 ) if ( yy_current_state >= 1956 )
yy_c = yy_meta[(unsigned int) yy_c]; yy_c = yy_meta[(unsigned int) yy_c];
} }
yy_current_state = yy_nxt[yy_base[yy_current_state] + (flex_int16_t) yy_c]; yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
yy_is_jam = (yy_current_state == 1955); yy_is_jam = (yy_current_state == 1955);
return yy_is_jam ? 0 : yy_current_state; return yy_is_jam ? 0 : yy_current_state;
@ -3873,7 +3888,7 @@ static int yy_get_next_buffer (void)
else else
{ /* need more input */ { /* need more input */
int offset = (yy_c_buf_p) - (yytext_ptr); yy_size_t offset = (yy_c_buf_p) - (yytext_ptr);
++(yy_c_buf_p); ++(yy_c_buf_p);
switch ( yy_get_next_buffer( ) ) switch ( yy_get_next_buffer( ) )
@ -3897,7 +3912,7 @@ static int yy_get_next_buffer (void)
case EOB_ACT_END_OF_FILE: case EOB_ACT_END_OF_FILE:
{ {
if ( yywrap( ) ) if ( yywrap( ) )
return 0; return EOF;
if ( ! (yy_did_buffer_switch_on_eof) ) if ( ! (yy_did_buffer_switch_on_eof) )
YY_NEW_FILE; YY_NEW_FILE;
@ -4145,7 +4160,7 @@ void yypop_buffer_state (void)
*/ */
static void yyensure_buffer_stack (void) static void yyensure_buffer_stack (void)
{ {
int num_to_alloc; yy_size_t num_to_alloc;
if (!(yy_buffer_stack)) { if (!(yy_buffer_stack)) {
@ -4153,7 +4168,7 @@ static void yyensure_buffer_stack (void)
* scanner will even need a stack. We use 2 instead of 1 to avoid an * scanner will even need a stack. We use 2 instead of 1 to avoid an
* immediate realloc on the next call. * immediate realloc on the next call.
*/ */
num_to_alloc = 1; /* After all that talk, this was set to 1 anyways... */ num_to_alloc = 1; // After all that talk, this was set to 1 anyways...
(yy_buffer_stack) = (struct yy_buffer_state**)yyalloc (yy_buffer_stack) = (struct yy_buffer_state**)yyalloc
(num_to_alloc * sizeof(struct yy_buffer_state*) (num_to_alloc * sizeof(struct yy_buffer_state*)
); );
@ -4200,7 +4215,7 @@ YY_BUFFER_STATE yy_scan_buffer (char * base, yy_size_t size )
base[size-2] != YY_END_OF_BUFFER_CHAR || base[size-2] != YY_END_OF_BUFFER_CHAR ||
base[size-1] != YY_END_OF_BUFFER_CHAR ) base[size-1] != YY_END_OF_BUFFER_CHAR )
/* They forgot to leave room for the EOB's. */ /* They forgot to leave room for the EOB's. */
return NULL; return 0;
b = (YY_BUFFER_STATE) yyalloc(sizeof( struct yy_buffer_state ) ); b = (YY_BUFFER_STATE) yyalloc(sizeof( struct yy_buffer_state ) );
if ( ! b ) if ( ! b )
@ -4209,7 +4224,7 @@ YY_BUFFER_STATE yy_scan_buffer (char * base, yy_size_t size )
b->yy_buf_size = size - 2; /* "- 2" to take care of EOB's */ b->yy_buf_size = size - 2; /* "- 2" to take care of EOB's */
b->yy_buf_pos = b->yy_ch_buf = base; b->yy_buf_pos = b->yy_ch_buf = base;
b->yy_is_our_buffer = 0; b->yy_is_our_buffer = 0;
b->yy_input_file = NULL; b->yy_input_file = 0;
b->yy_n_chars = b->yy_buf_size; b->yy_n_chars = b->yy_buf_size;
b->yy_is_interactive = 0; b->yy_is_interactive = 0;
b->yy_at_bol = 1; b->yy_at_bol = 1;
@ -4232,7 +4247,7 @@ YY_BUFFER_STATE yy_scan_buffer (char * base, yy_size_t size )
YY_BUFFER_STATE yy_scan_string (yyconst char * yystr ) YY_BUFFER_STATE yy_scan_string (yyconst char * yystr )
{ {
return yy_scan_bytes(yystr,(int) strlen(yystr) ); return yy_scan_bytes(yystr,strlen(yystr) );
} }
/** Setup the input buffer state to scan the given bytes. The next call to yylex() will /** Setup the input buffer state to scan the given bytes. The next call to yylex() will
@ -4242,7 +4257,7 @@ YY_BUFFER_STATE yy_scan_string (yyconst char * yystr )
* *
* @return the newly allocated buffer state object. * @return the newly allocated buffer state object.
*/ */
YY_BUFFER_STATE yy_scan_bytes (yyconst char * yybytes, int _yybytes_len ) YY_BUFFER_STATE yy_scan_bytes (yyconst char * yybytes, yy_size_t _yybytes_len )
{ {
YY_BUFFER_STATE b; YY_BUFFER_STATE b;
char *buf; char *buf;
@ -4250,7 +4265,7 @@ YY_BUFFER_STATE yy_scan_bytes (yyconst char * yybytes, int _yybytes_len )
yy_size_t i; yy_size_t i;
/* Get memory for full buffer, including space for trailing EOB's. */ /* Get memory for full buffer, including space for trailing EOB's. */
n = (yy_size_t) _yybytes_len + 2; n = _yybytes_len + 2;
buf = (char *) yyalloc(n ); buf = (char *) yyalloc(n );
if ( ! buf ) if ( ! buf )
YY_FATAL_ERROR( "out of dynamic memory in yy_scan_bytes()" ); YY_FATAL_ERROR( "out of dynamic memory in yy_scan_bytes()" );
@ -4276,7 +4291,7 @@ YY_BUFFER_STATE yy_scan_bytes (yyconst char * yybytes, int _yybytes_len )
#define YY_EXIT_FAILURE 2 #define YY_EXIT_FAILURE 2
#endif #endif
static void yynoreturn yy_fatal_error (yyconst char* msg ) static void yy_fatal_error (yyconst char* msg )
{ {
(void) fprintf( stderr, "%s\n", msg ); (void) fprintf( stderr, "%s\n", msg );
exit( YY_EXIT_FAILURE ); exit( YY_EXIT_FAILURE );
@ -4329,7 +4344,7 @@ FILE *yyget_out (void)
/** Get the length of the current token. /** Get the length of the current token.
* *
*/ */
int yyget_leng (void) yy_size_t yyget_leng (void)
{ {
return yyleng; return yyleng;
} }
@ -4385,10 +4400,10 @@ static int yy_init_globals (void)
* This function is called from yylex_destroy(), so don't allocate here. * This function is called from yylex_destroy(), so don't allocate here.
*/ */
(yy_buffer_stack) = NULL; (yy_buffer_stack) = 0;
(yy_buffer_stack_top) = 0; (yy_buffer_stack_top) = 0;
(yy_buffer_stack_max) = 0; (yy_buffer_stack_max) = 0;
(yy_c_buf_p) = NULL; (yy_c_buf_p) = (char *) 0;
(yy_init) = 0; (yy_init) = 0;
(yy_start) = 0; (yy_start) = 0;
@ -4397,8 +4412,8 @@ static int yy_init_globals (void)
yyin = stdin; yyin = stdin;
yyout = stdout; yyout = stdout;
#else #else
yyin = NULL; yyin = (FILE *) 0;
yyout = NULL; yyout = (FILE *) 0;
#endif #endif
/* For future reference: Set errno on error, since we are called by /* For future reference: Set errno on error, since we are called by
@ -4456,7 +4471,7 @@ static int yy_flex_strlen (yyconst char * s )
void *yyalloc (yy_size_t size ) void *yyalloc (yy_size_t size )
{ {
return malloc(size); return (void *) malloc( size );
} }
void *yyrealloc (void * ptr, yy_size_t size ) void *yyrealloc (void * ptr, yy_size_t size )
@ -4469,7 +4484,7 @@ void *yyrealloc (void * ptr, yy_size_t size )
* any pointer type to void*, and deal with argument conversions * any pointer type to void*, and deal with argument conversions
* as though doing an assignment. * as though doing an assignment.
*/ */
return realloc(ptr, size); return (void *) realloc( (char *) ptr, size );
} }
void yyfree (void * ptr ) void yyfree (void * ptr )