NLnetLabs
diff --git a/‎cachedb/cachedb.c
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions b/‎cachedb/cachedb.c
Copy file name to clipboard
+1Lines changed: 1 addition & 0 deletions
diff --git a/‎dns64/dns64.c
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion b/‎dns64/dns64.c
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion
diff --git a/‎doc/unbound.conf.5.in
Copy file name to clipboard
+13Lines changed: 13 additions & 0 deletions b/‎doc/unbound.conf.5.in
Copy file name to clipboard
+13Lines changed: 13 additions & 0 deletions
diff --git a/‎respip/respip.c
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion b/‎respip/respip.c
Copy file name to clipboard
+1-1Lines changed: 1 addition & 1 deletion
diff --git a/‎services/cache/rrset.c
Copy file name to clipboard
+2Lines changed: 2 additions & 0 deletions b/‎services/cache/rrset.c
Copy file name to clipboard
+2Lines changed: 2 additions & 0 deletions
diff --git a/‎util/config_file.c
Copy file name to clipboard
+4Lines changed: 4 additions & 0 deletions b/‎util/config_file.c
Copy file name to clipboard
+4Lines changed: 4 additions & 0 deletions
diff --git a/‎util/config_file.h
Copy file name to clipboard
+2Lines changed: 2 additions & 0 deletions b/‎util/config_file.h
Copy file name to clipboard
+2Lines changed: 2 additions & 0 deletions
@@ -465,6 +465,7 @@ packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)
 			data->rr_ttl[i] -= subtract;
 		else	data->rr_ttl[i] = 0;
 	}
+	data->ttl_add = (subtract < data->ttl_add) ? (data->ttl_add - subtract) : 0;
 }
 
 /* Adjust the TTL of a DNS message and its RRs by 'adjust'.  If 'adjust' is
 
@@ -727,7 +727,7 @@ dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk,
 		*dd_out = NULL;
 		return; /* integer overflow protection in alloc */
 	}
-	if (!(dd = *dd_out = regional_alloc(region,
+	if (!(dd = *dd_out = regional_alloc_zero(region,
 		  sizeof(struct packed_rrset_data)
 		  + fd->count * (sizeof(size_t) + sizeof(time_t) +
 			     sizeof(uint8_t*) + 2 + 16)))) {
 
@@ -1186,6 +1186,19 @@ responding with expired data.  A recommended value per
 RFC 8767 is 1800.  Setting this to 0 will disable this
 behavior.  Default is 0.
 .TP
+.B serve\-original\-ttl: \fI<yes or no>
+If enabled, unbound will always return the original TTL as received from
+the upstream name server rather than the decrementing TTL as
+stored in the cache.  This feature may be useful if unbound serves as a 
+front-end to a hidden authoritative name server. Enabling this feature does 
+not impact cache expiry, it only changes the TTL unbound embeds in responses to 
+queries. Note that enabling this feature implicitly disables enforcement of
+the configured minimum and maximum TTL, as it is assumed users who enable this 
+feature do not want unbound to change the TTL obtained from an upstream server. 
+Thus, the values set using \fBcache\-min\-ttl\fR and \fBcache\-max\-ttl\fR are
+ignored.
+Default is "no".
+.TP
 .B val\-nsec3\-keysize\-iterations: \fI<"list of values">
 List of keysize and iteration count values, separated by spaces, surrounded
 by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
 
@@ -523,7 +523,7 @@ copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)
 			return NULL; /* guard against integer overflow */
 		dsize += data->rr_len[i];
 	}
-	d = regional_alloc(region, dsize);
+	d = regional_alloc_zero(region, dsize);
 	if(!d)
 		return NULL;
 	*d = *data;
 
@@ -45,6 +45,7 @@
 #include "util/config_file.h"
 #include "util/data/packed_rrset.h"
 #include "util/data/msgreply.h"
+#include "util/data/msgparse.h"
 #include "util/regional.h"
 #include "util/alloc.h"
 #include "util/net_help.h"
@@ -396,6 +397,7 @@ rrset_update_sec_status(struct rrset_cache* r,
 			cachedata->ttl = updata->ttl + now;
 			for(i=0; i<cachedata->count+cachedata->rrsig_count; i++)
 				cachedata->rr_ttl[i] = updata->rr_ttl[i]+now;
+			cachedata->ttl_add = now;
 		}
 	}
 	lock_rw_unlock(&e->lock);
 
@@ -261,6 +261,7 @@ config_create(void)
 	cfg->serve_expired_ttl_reset = 0;
 	cfg->serve_expired_reply_ttl = 30;
 	cfg->serve_expired_client_timeout = 0;
+	cfg->serve_original_ttl = 0;
 	cfg->add_holddown = 30*24*3600;
 	cfg->del_holddown = 30*24*3600;
 	cfg->keep_missing = 366*24*3600; /* one year plus a little leeway */
@@ -646,6 +647,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else if(strcmp(opt, "serve-expired-reply-ttl:") == 0)
 	{ IS_NUMBER_OR_ZERO; cfg->serve_expired_reply_ttl = atoi(val); SERVE_EXPIRED_REPLY_TTL=(time_t)cfg->serve_expired_reply_ttl;}
 	else S_NUMBER_OR_ZERO("serve-expired-client-timeout:", serve_expired_client_timeout)
+	else S_YNO("serve-original-ttl:", serve_original_ttl)
 	else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations)
 	else S_UNSIGNED_OR_ZERO("add-holddown:", add_holddown)
 	else S_UNSIGNED_OR_ZERO("del-holddown:", del_holddown)
@@ -1066,6 +1068,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "serve-expired-ttl-reset", serve_expired_ttl_reset)
 	else O_DEC(opt, "serve-expired-reply-ttl", serve_expired_reply_ttl)
 	else O_DEC(opt, "serve-expired-client-timeout", serve_expired_client_timeout)
+	else O_YNO(opt, "serve-original-ttl", serve_original_ttl)
 	else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
 	else O_UNS(opt, "add-holddown", add_holddown)
 	else O_UNS(opt, "del-holddown", del_holddown)
@@ -2126,6 +2129,7 @@ config_apply(struct config_file* config)
 	SERVE_EXPIRED = config->serve_expired;
 	SERVE_EXPIRED_TTL = (time_t)config->serve_expired_ttl;
 	SERVE_EXPIRED_REPLY_TTL = (time_t)config->serve_expired_reply_ttl;
+	SERVE_ORIGINAL_TTL = config->serve_original_ttl;
 	MAX_NEG_TTL = (time_t)config->max_negative_ttl;
 	RTT_MIN_TIMEOUT = config->infra_cache_min_rtt;
 	EDNS_ADVERTISED_SIZE = (uint16_t)config->edns_buffer_size;
 
@@ -392,6 +392,8 @@ struct config_file {
 	/** serve expired entries only after trying to update the entries and this
 	 *  timeout (in milliseconds) is reached */
 	int serve_expired_client_timeout;
+	/** serve original TTLs rather than decrementing ones */
+	int serve_original_ttl;
 	/** nsec3 maximum iterations per key size, string */
 	char* val_nsec3_key_iterations;
 	/** autotrust add holddown time, in seconds */
Original file line number	Diff line number	Diff line change
`@@ -465,6 +465,7 @@ packed_rrset_ttl_subtract(struct packed_rrset_data* data, time_t subtract)`
`465`	`465`	`data->rr_ttl[i] -= subtract;`
`466`	`466`	`else data->rr_ttl[i] = 0;`
`467`	`467`	`}`
	`468`	`+ data->ttl_add = (subtract < data->ttl_add) ? (data->ttl_add - subtract) : 0;`
`468`	`469`	`}`
`469`	`470`
`470`	`471`	`/* Adjust the TTL of a DNS message and its RRs by 'adjust'. If 'adjust' is`
Original file line number	Diff line number	Diff line change
`@@ -727,7 +727,7 @@ dns64_synth_aaaa_data(const struct ub_packed_rrset_key* fk,`
`727`	`727`	`*dd_out = NULL;`
`728`	`728`	`return; /* integer overflow protection in alloc */`
`729`	`729`	`}`
`730`		`- if (!(dd = *dd_out = regional_alloc(region,`
	`730`	`+ if (!(dd = *dd_out = regional_alloc_zero(region,`
`731`	`731`	`sizeof(struct packed_rrset_data)`
`732`	`732`	`+ fd->count * (sizeof(size_t) + sizeof(time_t) +`
`733`	`733`	`sizeof(uint8_t*) + 2 + 16)))) {`
Original file line number	Diff line number	Diff line change
`@@ -523,7 +523,7 @@ copy_rrset(const struct ub_packed_rrset_key* key, struct regional* region)`
`523`	`523`	`return NULL; /* guard against integer overflow */`
`524`	`524`	`dsize += data->rr_len[i];`
`525`	`525`	`}`
`526`		`- d = regional_alloc(region, dsize);`
	`526`	`+ d = regional_alloc_zero(region, dsize);`
`527`	`527`	`if(!d)`
`528`	`528`	`return NULL;`
`529`	`529`	`d = data;`