vendor/unbound/1.23.0

6 files changed, 219 insertions, 63 deletions

diff --git a/testdata/stat_values.tdir/stat_values.conf b/testdata/stat_values.tdir/stat_values.conf
index dc4553920635..312a7e17494f 100644
--- a/testdata/stat_values.tdir/stat_values.conf
+++ b/testdata/stat_values.tdir/stat_values.conf
@@ -14,6 +14,10 @@ server:
 	outbound-msg-retry: 0
 	root-key-sentinel: no
 	trust-anchor-signaling: no
+	serve-expired-client-timeout: 0
+	dns-error-reporting: yes
+
+	trust-anchor: "bogusdnssec. DS 1444 8 2 5224fb17d630a2e3efdc863a05a4032c5db415b5de3f32472ee9abed42e10146"
 
 	local-zone: local.zone static
 	local-data: "www.local.zone A 192.0.2.1"
@@ -26,9 +30,15 @@ remote-control:
 	server-cert-file: "unbound_server.pem"
 	control-key-file: "unbound_control.key"
 	control-cert-file: "unbound_control.pem"
-forward-zone:
-	name: "."
-	forward-addr: "127.0.0.1@@TOPORT@"
-forward-zone:
+stub-zone:
+	name: "example.com."
+	stub-addr: "127.0.0.1@@TOPORT@"
+stub-zone:
+	name: "bogusdnssec."
+	stub-addr: "127.0.0.1@@TOPORT@"
+stub-zone:
+	name: "an.agent."
+	stub-addr: "127.0.0.1@@TOPORT@"
+stub-zone:
 	name: "expired."
-	forward-addr: "127.0.0.1@@EXPIREDPORT@"
+	stub-addr: "127.0.0.1@@EXPIREDPORT@"
diff --git a/testdata/stat_values.tdir/stat_values.pre b/testdata/stat_values.tdir/stat_values.pre
index 7b6eefdfaa49..81f94d8d10be 100644
--- a/testdata/stat_values.tdir/stat_values.pre
+++ b/testdata/stat_values.tdir/stat_values.pre
@@ -38,6 +38,7 @@ echo "FWD_EXPIRED_PID=$FWD_EXPIRED_PID" >> .tpkg.var.test
 sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's/@EXPIREDPORT\@/'$FWD_EXPIRED_PORT'/' -e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' < stat_values.conf > ub.conf
 sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's/@EXPIREDPORT\@/'$FWD_EXPIRED_PORT'/' -e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' < stat_values_cachedb.conf > ub_cachedb.conf
 sed -e 's/@PORT\@/'$UNBOUND_PORT'/'                                                                          -e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' < stat_values_downstream_cookies.conf > ub_downstream_cookies.conf
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/'                                            -e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' < stat_values_discard_wait_limit.conf > ub_discard_wait_limit.conf
 # start unbound in the background
 $PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
 UNBOUND_PID=$!
diff --git a/testdata/stat_values.tdir/stat_values.test b/testdata/stat_values.tdir/stat_values.test
index 814ecd1168d3..d538e4d60ec2 100644
--- a/testdata/stat_values.tdir/stat_values.test
+++ b/testdata/stat_values.tdir/stat_values.test
@@ -3,7 +3,6 @@
 [ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
 # use .tpkg.var.test for in test variable passing
 [ -f .tpkg.var.test ] && source .tpkg.var.test
-# We need kill_pid for the serve-expired-client-timeout test
 . ../common.sh
 
 PRE="../.."
@@ -154,6 +153,19 @@ set_ub_option () {
 	fi
 }
 
+# Convenient function to kill current Unbound and bring up one with an alternate configuration.
+bring_up_alternate_configuration () {
+	conf_file=$1
+	kill_pid $UNBOUND_PID  # kill current Unbound
+	echo ""
+	cat unbound.log
+	echo ""
+	$PRE/unbound -d -c $conf_file >unbound.log 2>&1 &
+	UNBOUND_PID=$!
+	echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+	wait_unbound_up unbound.log
+}
+
 # Convenient function to exit the test.
 end () {
 	echo "> cat logfiles"
@@ -180,8 +192,8 @@ else
 	end 1
 fi
 
-echo
-echo "[ Check initial stats based on first query. ]"
+
+teststep "Check initial stats based on first query."
 check_stats "\
 total.num.queries=1
 total.num.cachemiss=1
@@ -198,16 +210,15 @@ rrset.cache.count=1
 infra.cache.count=1
 num.answer.rcode.NOERROR=1"
 
-echo
-echo "[ Check stat reset. ]"
+
+teststep "Check stat reset."
 check_stats "\
 msg.cache.count=1
 rrset.cache.count=1
 infra.cache.count=1"
 
 
-echo
-echo "[ Enable serve-expired and check. ]"
+teststep "Enable serve-expired and check."
 set_ub_option serve-expired yes
 sleep 2  # make sure the TTL has expired.
 echo "> dig 1ttl.example.com."
@@ -236,8 +247,7 @@ rrset.cache.count=1
 infra.cache.count=1"
 
 
-echo
-echo "[ Enable serve-expired-client-timeout and check. ]"
+teststep "Enable serve-expired-client-timeout and check."
 set_ub_option serve-expired-client-timeout 1
 echo "> dig servfail.expired."
 dig @127.0.0.1 -p $UNBOUND_PORT servfail.expired. | tee outfile
@@ -295,8 +305,7 @@ infra.cache.count=2"
 set_ub_option serve-expired no
 
 
-echo
-echo "[ Check REFUSED; try without RD flag. ]"
+teststep "Check REFUSED; try without RD flag."
 echo "> dig somethingelse.example.com."
 dig @127.0.0.1 -p $UNBOUND_PORT +nordflag somethingelse.example.com. | tee outfile
 echo "> check answer"
@@ -319,8 +328,7 @@ rrset.cache.count=2
 infra.cache.count=2"
 
 
-echo
-echo "[ Check the AD flag. ]"
+teststep "Check the AD flag."
 echo "> dig www.example.com."
 dig @127.0.0.1 -p $UNBOUND_PORT +noadflag www.example.com. | tee outfile
 echo "> check answer"
@@ -345,8 +353,8 @@ msg.cache.count=3
 rrset.cache.count=3
 infra.cache.count=2"
 
-echo
-echo "[ Check local zone. ]"
+
+teststep "Check local zone."
 echo "> dig www.local.zone."
 dig @127.0.0.1 -p $UNBOUND_PORT www.local.zone. | tee outfile
 echo "> check answer"
@@ -370,8 +378,7 @@ rrset.cache.count=3
 infra.cache.count=2"
 
 
-echo
-echo "[ Check NXDOMAIN (with local data). ]"
+teststep "Check NXDOMAIN (with local data)."
 echo "> dig mail.local.zone."
 dig @127.0.0.1 -p $UNBOUND_PORT mail.local.zone. | tee outfile
 echo "> check answer"
@@ -395,8 +402,7 @@ rrset.cache.count=3
 infra.cache.count=2"
 
 
-echo
-echo "[ Check CHAOS. ]"
+teststep "Check CHAOS."
 echo "> dig id.server. ch txt"
 dig @127.0.0.1 -p $UNBOUND_PORT id.server. ch txt | tee outfile
 echo "> check answer"
@@ -420,18 +426,79 @@ rrset.cache.count=3
 infra.cache.count=2"
 
 
+teststep "Check dns-error-reporting."
+echo "> dig www.bogusdnssec."
+dig @127.0.0.1 -p $UNBOUND_PORT www.bogusdnssec. | tee outfile
+echo "> check answer"
+if grep "SERVFAIL" outfile; then
+	echo "OK"
+else
+	end 1
+fi
+check_stats "\
+infra.cache.count=4
+key.cache.count=1
+msg.cache.count=7
+num.answer.bogus=1
+num.answer.rcode.SERVFAIL=1
+num.query.class.IN=1
+num.query.edns.present=1
+num.query.flags.AD=1
+num.query.flags.RD=1
+num.query.opcode.QUERY=1
+num.query.type.A=1
+num.query.udpout=9
+rrset.cache.count=4
+total.num.cachemiss=1
+total.num.dns_error_reports=1
+total.num.queries=1
+total.num.recursivereplies=1"
+
+
+###
+#
+# Bring the discard-timeout, wait-limit configured Unbound up
+#
+bring_up_alternate_configuration ub_discard_wait_limit.conf
+#
+###
+
+
+teststep "Check discard-timeout and wait-limit"
+echo "> dig www.unresponsive"
+dig @127.0.0.1 -p $UNBOUND_PORT +retry=2 +timeout=1 www.unresponsive. | tee outfile
+echo "> check answer"
+if grep "no servers could be reached" outfile; then
+	echo "OK"
+else
+	end 1
+fi
+check_stats "\
+infra.cache.count=1
+msg.cache.count=1
+num.query.class.IN=3
+num.query.edns.present=3
+num.query.flags.AD=3
+num.query.flags.RD=3
+num.query.opcode.QUERY=3
+num.query.type.A=3
+num.query.udpout=1
+total.num.cachemiss=3
+total.num.queries=3
+total.num.queries_discard_timeout=2
+total.num.queries_wait_limit=1"
+
+
+###
+#
 # Bring the downstream DNS Cookies configured Unbound up
-kill_pid $UNBOUND_PID  # kill current Unbound
-echo ""
-cat unbound.log
-echo ""
-$PRE/unbound -d -c ub_downstream_cookies.conf >unbound.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-wait_unbound_up unbound.log
+#
+bring_up_alternate_configuration ub_downstream_cookies.conf
+#
+###
+
 
-echo
-echo "[ Get a DNS Cookie. ]"
+teststep "Get a DNS Cookie."
 echo "> dig www.local.zone +tcp $nocookie +ednsopt=10:0102030405060708"
 dig @127.0.0.1 -p $UNBOUND_PORT +tcp $nocookie +ednsopt=10:0102030405060708 +retry=0 +time=1 www.local.zone. | tee outfile
 echo "> check answer"
@@ -456,8 +523,8 @@ num.query.edns.present=1
 num.query.tcp=1
 num.answer.rcode.NOERROR=1"
 
-echo
-echo "[ Present the valid DNS Cookie. ]"
+
+teststep "Present the valid DNS Cookie."
 echo "> dig www.local.zone $nocookie +ednsopt=10:valid_cookie"
 dig @127.0.0.1 -p $UNBOUND_PORT $nocookie +ednsopt=10:$valid_cookie +retry=0 +time=1 www.local.zone. | tee outfile
 echo "> check answer"
@@ -478,8 +545,8 @@ num.query.flags.AD=1
 num.query.edns.present=1
 num.answer.rcode.NOERROR=1"
 
-echo
-echo "[ Present an invalid DNS Cookie. ]"
+
+teststep "Present an invalid DNS Cookie."
 echo "> dig www.local.zone $nocookie +ednsopt=10:invalid_cookie"
 dig @127.0.0.1 -p $UNBOUND_PORT $nocookie +ednsopt=10:$invalid_cookie +retry=0 +time=1 www.local.zone. | tee outfile
 echo "> check answer"
@@ -497,8 +564,8 @@ total.num.queries_cookie_invalid=1
 total.num.cachehits=1
 num.answer.rcode.YXRRSET=1"
 
-echo
-echo "[ Present no DNS Cookie. ]"
+
+teststep "Present no DNS Cookie."
 echo "> dig www.local.zone +ignore"
 dig @127.0.0.1 -p $UNBOUND_PORT +ignore $nocookie +retry=0 +time=1 www.local.zone. | tee outfile
 echo "> check answer"
@@ -516,18 +583,17 @@ num.answer.rcode.REFUSED=1"
 
 if test x$USE_CACHEDB = "x1"; then
 
+
+###
+#
 # Bring the cachedb configured Unbound up
-kill_pid $UNBOUND_PID  # kill current Unbound
-echo ""
-cat unbound.log
-echo ""
-$PRE/unbound -d -c ub_cachedb.conf >unbound.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-wait_unbound_up unbound.log
+#
+bring_up_alternate_configuration ub_cachedb.conf
+#
+###
+
 
-echo
-echo "[ Check cachedb cache miss. ]"
+teststep "Check cachedb cache miss."
 echo "> dig www.example.com."
 dig @127.0.0.1 +ednsopt=65534 -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> check answer"
@@ -554,8 +620,8 @@ rrset.cache.count=1
 infra.cache.count=1
 num.answer.rcode.NOERROR=1"
 
-echo
-echo "[ Check cachedb cache hit. ]"
+
+teststep "Check cachedb cache hit."
 echo "> dig www.example.com."
 dig @127.0.0.1 +ednsopt=65534 -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> check answer"
@@ -582,8 +648,8 @@ rrset.cache.count=1
 infra.cache.count=1
 num.answer.rcode.NOERROR=1"
 
-echo
-echo "[ Check cachedb cache hit with stat reset ]"
+
+teststep "Check cachedb cache hit with stat reset."
 echo "> dig www.example.com."
 dig @127.0.0.1 +ednsopt=65534 -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> check answer"
diff --git a/testdata/stat_values.tdir/stat_values.testns b/testdata/stat_values.tdir/stat_values.testns
index 12df8a93905a..a5c0ae92b599 100644
--- a/testdata/stat_values.tdir/stat_values.testns
+++ b/testdata/stat_values.tdir/stat_values.testns
@@ -31,3 +31,52 @@ SECTION QUESTION
 SECTION ANSWER
 0ttl	0 IN	A 0.0.0.1
 ENTRY_END
+
+
+
+$ORIGIN bogusdnssec.
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+@	IN	DNSKEY
+SECTION ANSWER
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+REPLY QR AA NOERROR
+ADJUST copy_id
+SECTION QUESTION
+www	IN	A
+SECTION ANSWER
+www	0 IN	A 10.20.30.40
+; bogus signature to not trigger LAME DNSSEC and continue with validation
+www	0 IN	RRSIG   A 8 2 240 20250429005000 20250401005000 42393 bogusdnssec. ob6ddTJkdeOUn92cxx1NPGneV7rhOp2zKBv8FXQjJ/Wso8LJJnzRHW9p 3sTatlzi+UdRi7BOrcxwjUG38lgO+TS5vRFGAiTRmOezm6xJVNTg8lIb RJGCD5bRtRRstwt31Qt6Gda+6sAyvDebpUB/opkQpevv6xohdrhr0g8+ Q4w=
+SECTION ADDITIONAL
+; dns error reporting agent
+HEX_EDNSDATA_BEGIN
+	00 12				; opt-code (Report-Channel)
+	00 0A				; opt-len
+	02 61 6E 05 61 67 65 6E 74 00	; an.agent.
+HEX_EDNSDATA_END
+ENTRY_END
+
+
+
+$ORIGIN an.agent.
+;just give an answer back to anything
+ENTRY_BEGIN
+MATCH opcode subdomain
+REPLY QR AA NXDOMAIN
+ADJUST copy_id copy_query
+SECTION QUESTION
+an.agent.	IN	ANY
+ENTRY_END
+
+
+
+$ORIGIN unresponsive.
+;; no entry for 'unresponsive.', we rely on timeouts.
diff --git a/testdata/stat_values.tdir/stat_values_cachedb.conf b/testdata/stat_values.tdir/stat_values_cachedb.conf
index b5e9b0e02932..b7b375b36ef1 100644
--- a/testdata/stat_values.tdir/stat_values_cachedb.conf
+++ b/testdata/stat_values.tdir/stat_values_cachedb.conf
@@ -1,7 +1,6 @@
 server:
 	verbosity: 5
 	module-config: "cachedb iterator"
-	serve-expired: yes
 	num-threads: 1
 	interface: 127.0.0.1
 	port: @PORT@
@@ -17,8 +16,6 @@ server:
 	root-key-sentinel: no
 	trust-anchor-signaling: no
 
-	local-zone: local.zone static
-	local-data: "www.local.zone A 192.0.2.1"
 remote-control:
 	control-enable: yes
 	control-interface: 127.0.0.1
@@ -28,9 +25,6 @@ remote-control:
 	server-cert-file: "unbound_server.pem"
 	control-key-file: "unbound_control.key"
 	control-cert-file: "unbound_control.pem"
-forward-zone:
-	name: "."
-	forward-addr: "127.0.0.1@@TOPORT@"
-forward-zone:
-	name: "expired."
-	forward-addr: "127.0.0.1@@EXPIREDPORT@"
+stub-zone:
+	name: "example.com."
+	stub-addr: "127.0.0.1@@TOPORT@"
diff --git a/testdata/stat_values.tdir/stat_values_discard_wait_limit.conf b/testdata/stat_values.tdir/stat_values_discard_wait_limit.conf
new file mode 100644
index 000000000000..b6f63cf17cfd
--- /dev/null
+++ b/testdata/stat_values.tdir/stat_values_discard_wait_limit.conf
@@ -0,0 +1,36 @@
+server:
+	verbosity: 5
+	num-threads: 1
+	interface: 127.0.0.1
+	module-config: "validator iterator"
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	extended-statistics: yes
+	identity: "stat_values"
+	outbound-msg-retry: 0
+	root-key-sentinel: no
+	trust-anchor-signaling: no
+
+	discard-timeout: 800
+        wait-limit: 1
+	wait-limit-netblock: 127.0.0.0/8 1
+	wait-limit-netblock: ::1/128 1
+	infra-cache-min-rtt: 3000  # This is for the discard-timeout test
+
+remote-control:
+	control-enable: yes
+	control-interface: 127.0.0.1
+	# control-interface: ::1
+	control-port: @CONTROL_PORT@
+	server-key-file: "unbound_server.key"
+	server-cert-file: "unbound_server.pem"
+	control-key-file: "unbound_control.key"
+	control-cert-file: "unbound_control.pem"
+stub-zone:
+	name: "unresponsive."
+	stub-addr: "127.0.0.1@@TOPORT@"