upstream/unbound
1
0
Fork 0
mirror of https://github.com/NLnetLabs/unbound.git synced 2025-12-20 23:00:56 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

- Note that for harden-below-nxdomain the nxdomain must be secure,

Browse source 
this means nsec3 with optout is insufficient.


git-svn-id: file:///svn/unbound/trunk@3925 be551aaa-1e26-0410-a405-d3ace91eadb9
This commit is contained in:
Wouter Wijngaards 2016-11-04 14:49:43 +00:00
parent 11031a7d36
commit ba274dd312
3 changed files with 70 additions and 52 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
doc/Changelog
View file

@ -6,6 +6,8 @@
manner. Every function on its own, so that other libraries (eg.
LibreSSL) can develop their API without hindrance.
- Fix #1154: segfault when reading config with duplicate zones.
- Note that for harden-below-nxdomain the nxdomain must be secure,
this means nsec3 with optout is insufficient.
3 November 2016: Ralph
- Set OpenSSL security level to 0 when using aNULL ciphers.

1
doc/unbound.conf.5.in
View file

@ -631,6 +631,7 @@ might return nxdomain for empty nonterminals (that usually happen for reverse
IP address lookups), and thus may be incompatible with this. To try to avoid
this only DNSSEC-secure nxdomains are used, because the old software does not
have DNSSEC. Default is off.
The nxdomain must be secure, this means nsec3 with optout is insufficient.
Currently, draft\-ietf\-dnsop\-nxdomain\-cut promotes this technique.
.TP
.B harden\-referral\-path: \fI<yes or no>

109
util/configlexer.c
View file

@ -10,7 +10,7 @@
#define FLEX_SCANNER
#define YY_FLEX_MAJOR_VERSION 2
#define YY_FLEX_MINOR_VERSION 6
#define YY_FLEX_SUBMINOR_VERSION 1
#define YY_FLEX_SUBMINOR_VERSION 0
#if YY_FLEX_SUBMINOR_VERSION > 0
#define FLEX_BETA
#endif
@ -89,13 +89,25 @@ typedef unsigned int flex_uint32_t;
#endif /* ! FLEXINT_H */
/* TODO: this is always defined, so inline it */
#define yyconst const
#ifdef __cplusplus
#if defined(__GNUC__) && __GNUC__ >= 3
#define yynoreturn __attribute__((__noreturn__))
/* The "const" storage-class-modifier is valid. */
#define YY_USE_CONST
#else /* ! __cplusplus */
/* C99 requires __STDC__ to be defined as 1. */
#if defined (__STDC__)
#define YY_USE_CONST
#endif /* defined (__STDC__) */
#endif /* ! __cplusplus */
#ifdef YY_USE_CONST
#define yyconst const
#else
#define yynoreturn
#define yyconst
#endif
/* Returned upon end-of-file. */
@ -156,7 +168,7 @@ typedef struct yy_buffer_state *YY_BUFFER_STATE;
typedef size_t yy_size_t;
#endif
extern int yyleng;
extern yy_size_t yyleng;
extern FILE *yyin, *yyout;
@ -195,12 +207,12 @@ struct yy_buffer_state
/* Size of input buffer in bytes, not including room for EOB
* characters.
*/
int yy_buf_size;
yy_size_t yy_buf_size;
/* Number of characters read into yy_ch_buf, not including EOB
* characters.
*/
int yy_n_chars;
yy_size_t yy_n_chars;
/* Whether we "own" the buffer - i.e., we know we created it,
* and can realloc() it to grow it, and should free() it to
@ -251,7 +263,7 @@ struct yy_buffer_state
/* Stack of input buffers. */
static size_t yy_buffer_stack_top = 0; /**< index of top of stack. */
static size_t yy_buffer_stack_max = 0; /**< capacity of stack. */
static YY_BUFFER_STATE * yy_buffer_stack = NULL; /**< Stack as an array. */
static YY_BUFFER_STATE * yy_buffer_stack = 0; /**< Stack as an array. */
/* We provide macros for accessing buffer states in case in the
* future we want to put the buffer states in a more general
@ -270,11 +282,11 @@ static YY_BUFFER_STATE * yy_buffer_stack = NULL; /**< Stack as an array. */
/* yy_hold_char holds the character lost when yytext is formed. */
static char yy_hold_char;
static int yy_n_chars; /* number of characters read into yy_ch_buf */
int yyleng;
static yy_size_t yy_n_chars; /* number of characters read into yy_ch_buf */
yy_size_t yyleng;
/* Points to current character in buffer. */
static char *yy_c_buf_p = NULL;
static char *yy_c_buf_p = (char *) 0;
static int yy_init = 0; /* whether we need to initialize */
static int yy_start = 0; /* start state number */
@ -299,7 +311,7 @@ static void yy_init_buffer (YY_BUFFER_STATE b,FILE *file );
YY_BUFFER_STATE yy_scan_buffer (char *base,yy_size_t size );
YY_BUFFER_STATE yy_scan_string (yyconst char *yy_str );
YY_BUFFER_STATE yy_scan_bytes (yyconst char *bytes,int len );
YY_BUFFER_STATE yy_scan_bytes (yyconst char *bytes,yy_size_t len );
void *yyalloc (yy_size_t );
void *yyrealloc (void *,yy_size_t );
@ -333,7 +345,7 @@ void yyfree (void * );
typedef unsigned char YY_CHAR;
FILE *yyin = NULL, *yyout = NULL;
FILE *yyin = (FILE *) 0, *yyout = (FILE *) 0;
typedef int yy_state_type;
@ -350,7 +362,10 @@ extern char *yytext;
static yy_state_type yy_get_previous_state (void );
static yy_state_type yy_try_NUL_trans (yy_state_type current_state );
static int yy_get_next_buffer (void );
static void yynoreturn yy_fatal_error (yyconst char* msg );
#if defined(__GNUC__) && __GNUC__ >= 3
__attribute__((__noreturn__))
#endif
static void yy_fatal_error (yyconst char msg[] );
/* Done after the current pattern has been matched and before the
* corresponding action - sets up yytext.
@ -358,7 +373,7 @@ static void yynoreturn yy_fatal_error (yyconst char* msg );
#define YY_DO_BEFORE_ACTION \
(yytext_ptr) = yy_bp; \
(yytext_ptr) -= (yy_more_len); \
yyleng = (int) (yy_cp - (yytext_ptr)); \
yyleng = (size_t) (yy_cp - (yytext_ptr)); \
(yy_hold_char) = *yy_cp; \
*yy_cp = '\0'; \
(yy_c_buf_p) = yy_cp;
@ -2147,7 +2162,7 @@ static void config_end_include(void)
#define YY_NO_INPUT 1
#endif
#line 2149 "<stdout>"
#line 2164 "<stdout>"
#define INITIAL 0
#define quotedstring 1
@ -2191,7 +2206,7 @@ FILE *yyget_out (void );
void yyset_out (FILE * _out_str );
int yyget_leng (void );
yy_size_t yyget_leng (void );
char *yyget_text (void );
@ -2248,7 +2263,7 @@ static int input (void );
/* This used to be an fputs(), but since the string might contain NUL's,
* we now use fwrite().
*/
#define ECHO do { if (fwrite( yytext, (size_t) yyleng, 1, yyout )) {} } while (0)
#define ECHO do { if (fwrite( yytext, yyleng, 1, yyout )) {} } while (0)
#endif
/* Gets input and stuffs it into "buf". number of characters read, or YY_NULL,
@ -2272,7 +2287,7 @@ static int input (void );
else \
{ \
errno=0; \
while ( (result = (int) fread(buf, 1, max_size, yyin))==0 && ferror(yyin)) \
while ( (result = fread(buf, 1, max_size, yyin))==0 && ferror(yyin)) \
{ \
if( errno != EINTR) \
{ \
@ -2370,7 +2385,7 @@ YY_DECL
{
#line 207 "./util/configlexer.lex"
#line 2372 "<stdout>"
#line 2387 "<stdout>"
while ( /*CONSTCOND*/1 ) /* loops until end-of-file is reached */
{
@ -2406,7 +2421,7 @@ yy_match:
if ( yy_current_state >= 1956 )
yy_c = yy_meta[(unsigned int) yy_c];
}
yy_current_state = yy_nxt[yy_base[yy_current_state] + (flex_int16_t) yy_c];
yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
++yy_cp;
}
while ( yy_base[yy_current_state] != 3865 );
@ -3517,7 +3532,7 @@ YY_RULE_SETUP
#line 489 "./util/configlexer.lex"
ECHO;
YY_BREAK
#line 3519 "<stdout>"
#line 3534 "<stdout>"
case YY_END_OF_BUFFER:
{
@ -3716,7 +3731,7 @@ static int yy_get_next_buffer (void)
if ( b->yy_is_our_buffer )
{
int new_size = b->yy_buf_size * 2;
yy_size_t new_size = b->yy_buf_size * 2;
if ( new_size <= 0 )
b->yy_buf_size += b->yy_buf_size / 8;
@ -3729,7 +3744,7 @@ static int yy_get_next_buffer (void)
}
else
/* Can't grow it, we don't own it. */
b->yy_ch_buf = NULL;
b->yy_ch_buf = 0;
if ( ! b->yy_ch_buf )
YY_FATAL_ERROR(
@ -3771,9 +3786,9 @@ static int yy_get_next_buffer (void)
else
ret_val = EOB_ACT_CONTINUE_SCAN;
if ((int) ((yy_n_chars) + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) {
if ((yy_size_t) ((yy_n_chars) + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) {
/* Extend the array by 50%, plus the number we really need. */
int new_size = (yy_n_chars) + number_to_move + ((yy_n_chars) >> 1);
yy_size_t new_size = (yy_n_chars) + number_to_move + ((yy_n_chars) >> 1);
YY_CURRENT_BUFFER_LVALUE->yy_ch_buf = (char *) yyrealloc((void *) YY_CURRENT_BUFFER_LVALUE->yy_ch_buf,new_size );
if ( ! YY_CURRENT_BUFFER_LVALUE->yy_ch_buf )
YY_FATAL_ERROR( "out of dynamic memory in yy_get_next_buffer()" );
@ -3811,7 +3826,7 @@ static int yy_get_next_buffer (void)
if ( yy_current_state >= 1956 )
yy_c = yy_meta[(unsigned int) yy_c];
}
yy_current_state = yy_nxt[yy_base[yy_current_state] + (flex_int16_t) yy_c];
yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
}
return yy_current_state;
@ -3839,7 +3854,7 @@ static int yy_get_next_buffer (void)
if ( yy_current_state >= 1956 )
yy_c = yy_meta[(unsigned int) yy_c];
}
yy_current_state = yy_nxt[yy_base[yy_current_state] + (flex_int16_t) yy_c];
yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c];
yy_is_jam = (yy_current_state == 1955);
return yy_is_jam ? 0 : yy_current_state;
@ -3873,7 +3888,7 @@ static int yy_get_next_buffer (void)
else
{ /* need more input */
int offset = (yy_c_buf_p) - (yytext_ptr);
yy_size_t offset = (yy_c_buf_p) - (yytext_ptr);
++(yy_c_buf_p);
switch ( yy_get_next_buffer( ) )
@ -3897,7 +3912,7 @@ static int yy_get_next_buffer (void)
case EOB_ACT_END_OF_FILE:
{
if ( yywrap( ) )
return 0;
return EOF;
if ( ! (yy_did_buffer_switch_on_eof) )
YY_NEW_FILE;
@ -4145,7 +4160,7 @@ void yypop_buffer_state (void)
*/
static void yyensure_buffer_stack (void)
{
int num_to_alloc;
yy_size_t num_to_alloc;
if (!(yy_buffer_stack)) {
@ -4153,7 +4168,7 @@ static void yyensure_buffer_stack (void)
* scanner will even need a stack. We use 2 instead of 1 to avoid an
* immediate realloc on the next call.
*/
num_to_alloc = 1; /* After all that talk, this was set to 1 anyways... */
num_to_alloc = 1; // After all that talk, this was set to 1 anyways...
(yy_buffer_stack) = (struct yy_buffer_state**)yyalloc
(num_to_alloc * sizeof(struct yy_buffer_state*)
);
@ -4200,7 +4215,7 @@ YY_BUFFER_STATE yy_scan_buffer (char * base, yy_size_t size )
base[size-2] != YY_END_OF_BUFFER_CHAR ||
base[size-1] != YY_END_OF_BUFFER_CHAR )
/* They forgot to leave room for the EOB's. */
return NULL;
return 0;
b = (YY_BUFFER_STATE) yyalloc(sizeof( struct yy_buffer_state ) );
if ( ! b )
@ -4209,7 +4224,7 @@ YY_BUFFER_STATE yy_scan_buffer (char * base, yy_size_t size )
b->yy_buf_size = size - 2; /* "- 2" to take care of EOB's */
b->yy_buf_pos = b->yy_ch_buf = base;
b->yy_is_our_buffer = 0;
b->yy_input_file = NULL;
b->yy_input_file = 0;
b->yy_n_chars = b->yy_buf_size;
b->yy_is_interactive = 0;
b->yy_at_bol = 1;
@ -4232,7 +4247,7 @@ YY_BUFFER_STATE yy_scan_buffer (char * base, yy_size_t size )
YY_BUFFER_STATE yy_scan_string (yyconst char * yystr )
{
return yy_scan_bytes(yystr,(int) strlen(yystr) );
return yy_scan_bytes(yystr,strlen(yystr) );
}
/** Setup the input buffer state to scan the given bytes. The next call to yylex() will
@ -4242,7 +4257,7 @@ YY_BUFFER_STATE yy_scan_string (yyconst char * yystr )
*
* @return the newly allocated buffer state object.
*/
YY_BUFFER_STATE yy_scan_bytes (yyconst char * yybytes, int _yybytes_len )
YY_BUFFER_STATE yy_scan_bytes (yyconst char * yybytes, yy_size_t _yybytes_len )
{
YY_BUFFER_STATE b;
char *buf;
@ -4250,7 +4265,7 @@ YY_BUFFER_STATE yy_scan_bytes (yyconst char * yybytes, int _yybytes_len )
yy_size_t i;
/* Get memory for full buffer, including space for trailing EOB's. */
n = (yy_size_t) _yybytes_len + 2;
n = _yybytes_len + 2;
buf = (char *) yyalloc(n );
if ( ! buf )
YY_FATAL_ERROR( "out of dynamic memory in yy_scan_bytes()" );
@ -4276,7 +4291,7 @@ YY_BUFFER_STATE yy_scan_bytes (yyconst char * yybytes, int _yybytes_len )
#define YY_EXIT_FAILURE 2
#endif
static void yynoreturn yy_fatal_error (yyconst char* msg )
static void yy_fatal_error (yyconst char* msg )
{
(void) fprintf( stderr, "%s\n", msg );
exit( YY_EXIT_FAILURE );
@ -4329,7 +4344,7 @@ FILE *yyget_out (void)
/** Get the length of the current token.
*
*/
int yyget_leng (void)
yy_size_t yyget_leng (void)
{
return yyleng;
}
@ -4385,10 +4400,10 @@ static int yy_init_globals (void)
* This function is called from yylex_destroy(), so don't allocate here.
*/
(yy_buffer_stack) = NULL;
(yy_buffer_stack) = 0;
(yy_buffer_stack_top) = 0;
(yy_buffer_stack_max) = 0;
(yy_c_buf_p) = NULL;
(yy_c_buf_p) = (char *) 0;
(yy_init) = 0;
(yy_start) = 0;
@ -4397,8 +4412,8 @@ static int yy_init_globals (void)
yyin = stdin;
yyout = stdout;
#else
yyin = NULL;
yyout = NULL;
yyin = (FILE *) 0;
yyout = (FILE *) 0;
#endif
/* For future reference: Set errno on error, since we are called by
@ -4456,7 +4471,7 @@ static int yy_flex_strlen (yyconst char * s )
void *yyalloc (yy_size_t size )
{
return malloc(size);
return (void *) malloc( size );
}
void *yyrealloc (void * ptr, yy_size_t size )
@ -4469,7 +4484,7 @@ void *yyrealloc (void * ptr, yy_size_t size )
* any pointer type to void*, and deal with argument conversions
* as though doing an assignment.
*/
return realloc(ptr, size);
return (void *) realloc( (char *) ptr, size );
}
void yyfree (void * ptr )