Convert hash_init() to use realloc().

Fix PXE boot server (PXEBS) responses broken in 2.92
I think I've found a regression in dnsmasq 2.92 that breaks PXE boot server (PXEBS) responses when running in proxy DHCP mode. Fair warning: I'm not familiar with the dnsmasq codebase and used AI tooling to help trace through the source and identify the issue, so please take the analysis below with appropriate skepticism. PXE boot works fine on 2.91 but fails on 2.92 — the client gets the initial proxy DHCPOFFER, but the PXEBS ACK on port 4011 never reaches it. My setup is dnsmasq in proxy DHCP mode serving iPXE to Proxmox VMs via their virtio-net ROM. Here's a stripped-down version of my config: port=0 enable-tftp tftp-root=/tftpboot dhcp-range=172.19.74.0,proxy,255.255.255.0 interface=eno1 bind-interfaces dhcp-match=set:ipxe,175 pxe-service=tag:ipxe,x86PC,"Network Boot",http://server:8081/boot.ipxe pxe-service=tag:!ipxe,x86PC,"Network Boot",undionly.kpxe log-dhcp The issue seems to be in src/dhcp.c in the response routing logic after dhcp_reply() returns. In 2.91, the destination selection was an if/else-if chain: if (pxe_fd) { ... } else if (mess->giaddr.s_addr && !is_relay_reply) { ... } else if (mess->ciaddr.s_addr) { ... } else { ... broadcast to 255.255.255.255:68 ... } In 2.92, the else between the pxe_fd block and the giaddr/relay check was removed in commit 4fbe1ad ("Implement RFC-4388 DHCPv4 leasequery") to accommodate the new is_relay_use_source logic: if (pxe_fd) { ... } if ((is_relay_use_source || mess->giaddr.s_addr) && !is_relay_reply) { ... } else if (mess->ciaddr.s_addr) { ... } else { ... broadcast to 255.255.255.255:68 ... } For PXEBS responses, dhcp_reply() in rfc2131.c (around line 924-925) does: mess->yiaddr = mess->ciaddr; mess->ciaddr.s_addr = 0; So after dhcp_reply() returns for a PXEBS request, ciaddr is 0, giaddr is 0 (no relay), and is_relay_use_source is 0. In 2.91, the pxe_fd block runs and the rest of the chain is skipped — dest stays as received from recvmsg, and the response goes back to the client correctly. In 2.92, the pxe_fd block runs but then falls through to the standalone if, which is false, so the else block runs and sets dest to 255.255.255.255 port 68. The client is listening on port 4011 and ignores it. Here are the relevant dnsmasq logs. With 2.91 (working), I see normal proxy DHCP and PXE boot server exchanges: dnsmasq-dhcp: DHCPDISCOVER(eno1) bc:24:11:59:85:90 dnsmasq-dhcp: DHCPOFFER(eno1) 172.19.74.60 bc:24:11:59:85:90 dnsmasq-dhcp: DHCPREQUEST(eno1) 172.19.74.60 bc:24:11:59:85:90 dnsmasq-dhcp: DHCPACK(eno1) 172.19.74.60 bc:24:11:59:85:90 dnsmasq-dhcp: PXE(eno1) bc:24:11:59:85:90 proxy dnsmasq-dhcp: PXE(eno1) bc:24:11:59:85:90 proxy dnsmasq-dhcp: PXEBS(eno1) bc:24:11:59:85:90 undionly.kpxe dnsmasq-dhcp: PXE(eno1) bc:24:11:59:85:90 proxy dnsmasq-dhcp: PXEBS(eno1) bc:24:11:59:85:90 http://infra1.oneill.net:8081/boot.ipxe With 2.92 (broken), the DHCPDISCOVER/OFFER/REQUEST/ACK cycle and the proxy PXE response work, but the PXEBS response never reaches the client — it times out after repeated attempts. The dnsmasq side shows it sending the response, but the client keeps retrying: dnsmasq-dhcp: PXE(eno1) bc:24:11:59:85:90 proxy dnsmasq-dhcp: PXE(eno1) bc:24:11:59:85:90 proxy dnsmasq-dhcp: PXEBS(eno1) bc:24:11:59:85:90 undionly.kpxe dnsmasq-dhcp: PXEBS(eno1) bc:24:11:59:85:90 undionly.kpxe dnsmasq-dhcp: PXEBS(eno1) bc:24:11:59:85:90 undionly.kpxe dnsmasq-dhcp: PXEBS(eno1) bc:24:11:59:85:90 undionly.kpxe I tested by restoring the else keyword and the fix appears to work — 2.92 with the patch below PXE boots successfully. I believe this change preserves the leasequery behavior since that path only applies when pxe_fd is false (normal DHCP handling, not port 4011).
2026-11-04 13:48:30 +00:00 · 2026-02-06 15:05:59 +00:00 · 2026-02-05 15:38:27 +00:00 · 2026-02-05 14:53:10 +00:00 · 2026-02-05 13:26:08 +00:00 · 2026-02-03 22:33:32 +00:00
17 changed files with 802 additions and 613 deletions
@@ -1,3 +1,34 @@
+version 2.93
+	Fix a corner-case in DNSSEC validation with wildcards. If we have
+	a wildcard record *.example.com and recieve a query for
+	a.example.com then that's OK, but we have to check that there isn't
+	an actual a.example.com record. The corner case is when we get a
+	query for *.example.com in that case the non-existence check
+	is not required, was being done. Thanks to Jan Breig for
+	spotting this.
+
+	Enable support for inotify on FreeBSD 15.0-RELEASE, which added
+	Linux-compatible inotify support.
+
+	Fix DNSSEC failure with spurious RRSIGs. The presence of wrong
+	RRSIG RRs in replies caused DNSSEC validation to fail even
+	when the RRs do not require validation because the zone is
+	unsigned. Note that, at the time of this commit, Google
+	DNS appears to have the same bug, so if you're using 8.8.8.8
+	or friends as upstream, resolving the broken zones
+	(eg rivcoed.org) will still fail. Thanks to Petr Menšík
+	for the bug report.
+
+	Fix DNSSEC fail with CNAME replies to DS queries. As CNAME reply
+	to a DNSSEC query was confusing the validation logic. It now
+	accepts a signed CNAME reply to a DS query as proof that no DS
+	exists at the domain. This fixes the DS/zone break detection logic.
+
+	Fix regression in 2.92 release which broke DHCPv6 when a DHCP
+	relay is in use. Many thanks to Jørgen Søvik for help
+	finding this bug.
+	
+	
 version 2.92
        Redesign the interaction between DNSSEC validation and per-domain
 	servers, specified as --server=/<domain>/<ip-address>. This should
@@ -136,6 +136,8 @@ Log the results of DNS queries handled by dnsmasq. Enable a full cache dump on r
 then the log has extra information at the start of each line.
 This consists of a serial number which ties together the log lines associated with an individual query, and the IP address of the requestor. If the argument "proto" is supplied, this shows everything that "extra" does and also the network protocol used to communicate the queries. Logging of only queries to the authoritative server can be configured with
 .B --log-queries=auth
+and logging only failed replies (Error, NXDOMAIN or NODATA) can be configured with
+.B --log-queries=only_failed
 .TP
 .B \-8, --log-facility=<facility>
 Set the facility to which dnsmasq will send syslog entries, this
@@ -193,20 +193,22 @@ void *blockdata_retrieve(struct blockdata *block, size_t len, void *data)
 {
  size_t blen;
  struct  blockdata *b;
-  uint8_t *new, *d;
+  uint8_t *d;
  
-  static unsigned int buff_len = 0;
-  static unsigned char *buff = NULL;
-   
  if (!data)
    {
+      static unsigned int buff_len = 0;
+      static unsigned char *buff = NULL;
+      uint8_t *new;
+      
      if (len > buff_len)
 	{
-	  if (!(new = whine_malloc(len)))
+	  blen = len + 1024;
+	  if (!(new = whine_realloc(buff, blen)))
 	    return NULL;
-	  if (buff)
-	    free(buff);
+
 	  buff = new;
+	  buff_len = blen;
 	}
      data = buff;
    }
@@ -17,13 +17,16 @@
 #include "dnsmasq.h"

 static struct crec *cache_head = NULL, *cache_tail = NULL, **hash_table = NULL;
-#ifdef HAVE_DHCP
-static struct crec *dhcp_spare = NULL;
-#endif
+static struct crec *config_spare = NULL;
 static struct crec *new_chain = NULL;
 static int insert_error;
 static union bigname *big_free = NULL;
 static int bignames_left, hash_size;
+struct nameblock {
+  struct nameblock *next;
+  unsigned int last, index;
+  char data[NAMEBLOCK_CHARS];
+} *hostblocks = NULL;

 static void make_non_terminals(struct crec *source);
 static struct crec *really_insert(char *name, union all_addr *addr, unsigned short class,
@@ -192,6 +195,61 @@ void cache_init(void)
  rehash(daemon->cachesize);
 }

+static struct crec *get_config_crec(void)
+{
+  struct crec *ret;
+  
+  if (config_spare)
+    {
+      ret = config_spare;
+      config_spare = config_spare->next;
+    }
+  else
+    ret = whine_malloc(SIZEOF_POINTER_CREC);
+
+  return ret;
+}
+
+static void free_config_crec(struct crec *p)
+{
+  p->next = config_spare;
+  config_spare  = p;
+}
+
+static char *store_name(unsigned int namelen, unsigned int index)
+{
+  struct nameblock *block;
+  char *ret = NULL;
+
+  for (block = hostblocks; block; block = block->next)
+    if (block->index == index && NAMEBLOCK_CHARS - block->last >= namelen)
+      break;
+
+  if (!block && ((block = whine_malloc(sizeof(struct nameblock)))))
+    {
+      block->next = hostblocks;
+      block->index = index;
+      hostblocks = block;
+    }
+  
+  if (block && NAMEBLOCK_CHARS - block->last >= namelen)
+    {
+      ret = &block->data[block->last];
+      block->last += namelen;
+    }
+
+  return ret;
+}
+
+static void free_names(unsigned int index)
+{
+  struct nameblock *block;
+
+  for (block = hostblocks; block; block = block->next)
+    if (index == UID_NONE || block->index == index)
+      block->last = 0;
+}
+
 /* In most cases, we create the hash table once here by calling this with (hash_table == NULL)
   but if the hosts file(s) are big (some people have 50000 ad-block entries), the table
   will be much too small, so the hosts reading code calls rehash every 1000 addresses, to
@@ -441,12 +499,14 @@ unsigned int cache_remove_uid(const unsigned int uid)
 	if ((crecp->flags & (F_HOSTS | F_DHCP | F_CONFIG)) && crecp->uid == uid)
 	  {
 	    *up = tmp;
-	    free(crecp);
+	    free_config_crec(crecp);
 	    removed++;
 	  }
 	else
 	  up = &crecp->hash_next;
      }
+
+  free_names(uid);
  
  return removed;
 }
@@ -855,7 +915,7 @@ void cache_end_insert(void)
 #ifdef HAVE_DNSSEC
 void cache_update_hwm(void)
 {
-  /* Sneak out possibly updated crypto HWM values. */
+ /* Sneak out possibly updated crypto HWM values. */
  unsigned char op = PIPE_OP_STATS;

  read_write(daemon->pipe_to_parent, &op, sizeof(op), RW_WRITE);
@@ -1000,6 +1060,7 @@ int cache_recv_insert(time_t now, int fd)
      }
      
    case PIPE_OP_RESULT:
+    case PIPE_OP_KILLED:
      {
 	/* UDP validation moved to TCP to avoid truncation. 
 	   Restart UDP validation process with the returned result. */
@@ -1013,11 +1074,14 @@ int cache_recv_insert(time_t now, int fd)
 	    !read_write(fd, (unsigned char *)&ret_len, sizeof(ret_len), RW_READ) ||
 	    !read_write(fd, (unsigned char *)daemon->packet, ret_len, RW_READ) ||
 	    !read_write(fd, (unsigned char *)&forward, sizeof(forward), RW_READ) ||
-	    !read_write(fd, (unsigned char *)&uid, sizeof(uid), RW_READ) ||
-	    !read_write(fd, (unsigned char *)&keycount, sizeof(keycount), RW_READ) ||
-	    !read_write(fd, (unsigned char *)&keycountp, sizeof(keycountp), RW_READ) ||
-	    !read_write(fd, (unsigned char *)&validatecount, sizeof(validatecount), RW_READ) ||
-	    !read_write(fd, (unsigned char *)&validatecountp, sizeof(validatecountp), RW_READ))
+	    !read_write(fd, (unsigned char *)&uid, sizeof(uid), RW_READ))
+	  return 0;
+
+	if (op == PIPE_OP_RESULT && 
+	    (!read_write(fd, (unsigned char *)&keycount, sizeof(keycount), RW_READ) ||
+	     !read_write(fd, (unsigned char *)&keycountp, sizeof(keycountp), RW_READ) ||
+	     !read_write(fd, (unsigned char *)&validatecount, sizeof(validatecount), RW_READ) ||
+	     !read_write(fd, (unsigned char *)&validatecountp, sizeof(validatecountp), RW_READ)))
 	  return 0;
 	
 	/* There's a tiny chance that the frec may have been freed 
@@ -1025,9 +1089,12 @@ int cache_recv_insert(time_t now, int fd)
 	   the uid field which is unique modulo 2^32 for each use. */
 	if (uid == forward->uid)
 	  {
-	    /* repatriate the work counters from the child process. */
-	    *keycountp = keycount;
-	    *validatecountp = validatecount;
+	    if (op == PIPE_OP_RESULT)
+	      {
+		/* repatriate the work counters from the child process. */
+		*keycountp = keycount;
+		*validatecountp = validatecount;
+	      }
 	    
 	    if (!forward->dependent)
 	      return_reply(now, forward, (struct dns_header *)daemon->packet, ret_len, status);
@@ -1254,7 +1321,7 @@ static void add_hosts_entry(struct crec *cache, union all_addr *addr, int addrle
  while ((lookup = cache_find_by_name(lookup, cache_get_name(cache), 0, cache->flags & (F_IPV4 | F_IPV6))))
    if ((lookup->flags & F_HOSTS) && memcmp(&lookup->addr, addr, addrlen) == 0)
      {
-	free(cache);
+	free_config_crec(cache);
 	return;
      }
    
@@ -1377,13 +1444,13 @@ int read_hostsfile(char *filename, unsigned int index, int cache_size, struct cr
    {
      if (inet_pton(AF_INET, token, &addr) > 0)
 	{
-	  flags = F_HOSTS | F_IMMORTAL | F_FORWARD | F_REVERSE | F_IPV4;
+	  flags = F_NAMEP | F_HOSTS | F_IMMORTAL | F_FORWARD | F_REVERSE | F_IPV4;
 	  addrlen = INADDRSZ;
 	  domain_suffix = get_domain(addr.addr4);
 	}
      else if (inet_pton(AF_INET6, token, &addr) > 0)
 	{
-	  flags = F_HOSTS | F_IMMORTAL | F_FORWARD | F_REVERSE | F_IPV6;
+	  flags = F_NAMEP | F_HOSTS | F_IMMORTAL | F_FORWARD | F_REVERSE | F_IPV6;
 	  addrlen = IN6ADDRSZ;
 	  domain_suffix = get_domain6(&addr.addr6);
 	}
@@ -1417,27 +1484,37 @@ int read_hostsfile(char *filename, unsigned int index, int cache_size, struct cr
 	  if ((canon = canonicalise(token, &nomem)))
 	    {
 	      /* If set, add a version of the name with a default domain appended */
-	      if (option_bool(OPT_EXPAND) && domain_suffix && !fqdn && 
-		  (cache = whine_malloc(SIZEOF_BARE_CREC + strlen(canon) + 2 + strlen(domain_suffix))))
+	      if (option_bool(OPT_EXPAND) && domain_suffix && !fqdn && (cache = get_config_crec()))
 		{
-		  strcpy(cache->name.sname, canon);
-		  strcat(cache->name.sname, ".");
-		  strcat(cache->name.sname, domain_suffix);
-		  cache->flags = flags;
-		  cache->ttd = daemon->local_ttl;
-		  add_hosts_entry(cache, &addr, addrlen, index, rhash, hashsz);
-		  name_count++;
-		  names_done++;
+		  if (!(cache->name.namep = store_name(strlen(canon) + 2 + strlen(domain_suffix), index)))
+		    free_config_crec(cache);
+		  else
+		    {
+		      strcpy(cache->name.namep, canon);
+		      strcat(cache->name.namep, ".");
+		      strcat(cache->name.namep, domain_suffix);
+		      cache->flags = flags;
+		      cache->ttd = daemon->local_ttl;
+		      add_hosts_entry(cache, &addr, addrlen, index, rhash, hashsz);
+		      name_count++;
+		      names_done++;
+		    }
 		}
-	      if ((cache = whine_malloc(SIZEOF_BARE_CREC + strlen(canon) + 1)))
+	      if ((cache = get_config_crec()))
 		{
-		  strcpy(cache->name.sname, canon);
-		  cache->flags = flags;
-		  cache->ttd = daemon->local_ttl;
-		  add_hosts_entry(cache, &addr, addrlen, index, rhash, hashsz);
-		  name_count++;
-		  names_done++;
+		  if (!(cache->name.namep = store_name(strlen(canon) + 1, index)))
+		    free_config_crec(cache);
+		  else
+		    {
+		      strcpy(cache->name.namep, canon);
+		      cache->flags = flags;
+		      cache->ttd = daemon->local_ttl;
+		      add_hosts_entry(cache, &addr, addrlen, index, rhash, hashsz);
+		      name_count++;
+		      names_done++;
+		    }
 		}
+	      
 	      free(canon);
 	      
 	    }
@@ -1488,7 +1565,7 @@ void cache_reload(void)
 	if (cache->flags & (F_HOSTS | F_CONFIG))
 	  {
 	    *up = cache->hash_next;
-	    free(cache);
+	    free_config_crec(cache);
 	  }
 	else if (!(cache->flags & F_DHCP))
 	  {
@@ -1503,11 +1580,13 @@ void cache_reload(void)
 	else
 	  up = &cache->hash_next;
      }
+
+  free_names(UID_NONE); /* free everything */
  
  /* Add locally-configured CNAMEs to the cache */
  for (a = daemon->cnames; a; a = a->next)
    if (a->alias[1] != '*' &&
-	((cache = whine_malloc(SIZEOF_POINTER_CREC))))
+	((cache = get_config_crec())))
      {
 	cache->flags = F_FORWARD | F_NAMEP | F_CNAME | F_IMMORTAL | F_CONFIG;
 	cache->ttd = a->ttl;
@@ -1521,25 +1600,30 @@ void cache_reload(void)
  
 #ifdef HAVE_DNSSEC
  for (ds = daemon->ds; ds; ds = ds->next)
-    if ((cache = whine_malloc(SIZEOF_POINTER_CREC)) &&
-	(cache->addr.ds.keydata = blockdata_alloc(ds->digest, ds->digestlen)))
+    if ((cache = get_config_crec()))
      {
-	cache->flags = F_FORWARD | F_IMMORTAL | F_DS | F_CONFIG | F_NAMEP;
-	cache->ttd = daemon->local_ttl;
-	cache->name.namep = ds->name;
-	cache->uid = ds->class;
-	if (ds->digestlen != 0)
-	  {
-	    cache->addr.ds.keylen = ds->digestlen;
-	    cache->addr.ds.algo = ds->algo;
-	    cache->addr.ds.keytag = ds->keytag;
-	    cache->addr.ds.digest = ds->digest_type;
-	  }
-	else
-	  cache->flags |= F_NEG | F_DNSSECOK | F_NO_RR;
 	
-	cache_hash(cache);
-	make_non_terminals(cache);
+	if (!(cache->addr.ds.keydata = blockdata_alloc(ds->digest, ds->digestlen)))
+	  free_config_crec(cache);
+	else
+	  {
+	    cache->flags = F_FORWARD | F_IMMORTAL | F_DS | F_CONFIG | F_NAMEP;
+	    cache->ttd = daemon->local_ttl;
+	    cache->name.namep = ds->name;
+	    cache->uid = ds->class;
+	    if (ds->digestlen != 0)
+	      {
+		cache->addr.ds.keylen = ds->digestlen;
+		cache->addr.ds.algo = ds->algo;
+		cache->addr.ds.keytag = ds->keytag;
+		cache->addr.ds.digest = ds->digest_type;
+	      }
+	    else
+	      cache->flags |= F_NEG | F_DNSSECOK | F_NO_RR;
+	    
+	    cache_hash(cache);
+	    make_non_terminals(cache);
+	  }
      }
 #endif
  
@@ -1554,7 +1638,7 @@ void cache_reload(void)
    for (nl = hr->names; nl; nl = nl->next)
      {
 	if ((hr->flags & HR_4) &&
-	    (cache = whine_malloc(SIZEOF_POINTER_CREC)))
+	    (cache = get_config_crec()))
 	  {
 	    cache->name.namep = nl->name;
 	    cache->ttd = hr->ttl;
@@ -1563,7 +1647,7 @@ void cache_reload(void)
 	  }

 	if ((hr->flags & HR_6) &&
-	    (cache = whine_malloc(SIZEOF_POINTER_CREC)))
+	    (cache = get_config_crec()))
 	  {
 	    cache->name.namep = nl->name;
 	    cache->ttd = hr->ttl;
@@ -1655,8 +1739,7 @@ void cache_unhash_dhcp(void)
      if (cache->flags & F_DHCP)
 	{
 	  *up = cache->hash_next;
-	  cache->next = dhcp_spare;
-	  dhcp_spare = cache;
+	  free_config_crec(cache);
 	}
      else
 	up = &cache->hash_next;
@@ -1727,12 +1810,7 @@ void cache_add_dhcp_entry(char *host_name, int prot,
  else
    flags |= F_REVERSE;
  
-  if ((crec = dhcp_spare))
-    dhcp_spare = dhcp_spare->next;
-  else /* need new one */
-    crec = whine_malloc(SIZEOF_POINTER_CREC);
-  
-  if (crec) /* malloc may fail */
+  if ((crec = get_config_crec()))
    {
      crec->flags = flags | F_NAMEP | F_DHCP | F_FORWARD;
      if (ttd == 0)
@@ -1779,15 +1857,7 @@ static void make_non_terminals(struct crec *source)
 	  hostname_isequal(name, cache_get_name(crecp)))
 	{
 	  *up = crecp->hash_next;
-#ifdef HAVE_DHCP
-	  if (type & F_DHCP)
-	    {
-	      crecp->next = dhcp_spare;
-	      dhcp_spare = crecp;
-	    }
-	  else
-#endif
-	    free(crecp);
+	  free_config_crec(crecp);
 	  break;
 	}
      else
@@ -1820,17 +1890,7 @@ static void make_non_terminals(struct crec *source)
 	  continue;
 	}
      
-#ifdef HAVE_DHCP
-      if ((source->flags & F_DHCP) && dhcp_spare)
-	{
-	  crecp = dhcp_spare;
-	  dhcp_spare = dhcp_spare->next;
-	}
-      else
-#endif
-	crecp = whine_malloc(SIZEOF_POINTER_CREC);
-
-      if (crecp)
+      if ((crecp = get_config_crec()))
 	{
 	  crecp->flags = (source->flags | F_NAMEP) & ~(F_IPV4 | F_IPV6 | F_CNAME | F_RR | F_DNSKEY | F_DS | F_REVERSE);
 	  if (!(crecp->flags & F_IMMORTAL))
@@ -2159,9 +2219,9 @@ static char *querystr(char *desc, unsigned short type)
  unsigned int i;
  int len = 10; /* strlen("type=xxxxx") */
  const char *types = NULL;
-  static char *buff = NULL;
-  static int bufflen = 0;
-
+  static struct iovec buff = { NULL, 0 };
+  char *buffp;
+  
  for (i = 0; i < (sizeof(typestr)/sizeof(typestr[0])); i++)
    if (typestr[i].type == type)
      {
@@ -2176,37 +2236,28 @@ static char *querystr(char *desc, unsigned short type)
       len += strlen(desc);
    }
  len++; /* terminator */
-  
-  if (!buff || bufflen < len)
-    {
-      if (buff)
-	free(buff);
-      else if (len < 20)
-	len = 20;
-      
-      buff = whine_malloc(len);
-      bufflen = len;
-    }

-  if (buff)
+  if (!expand_buf(&buff, len))
+    return "";
+
+  buffp = buff.iov_base;
+  
+  if (desc)
    {
-      if (desc)
-	{
-	  if (types)
-	    sprintf(buff, "%s[%s]", desc, types);
-	  else
-	    sprintf(buff, "%s[type=%d]", desc, type);
-	}
+      if (types)
+	sprintf(buffp, "%s[%s]", desc, types);
      else
-	{
-	  if (types)
-	    sprintf(buff, "<%s>", types);
-	  else
-	    sprintf(buff, "<type=%d>", type);
-	}
+	sprintf(buffp, "%s[type=%d]", desc, type);
+    }
+  else
+    {
+      if (types)
+	sprintf(buffp, "<%s>", types);
+      else
+	sprintf(buffp, "<type=%d>", type);
    }
  
-  return buff ? buff : "";
+  return buffp;
 }

 static char *edestr(int ede)
@@ -2243,10 +2294,20 @@ static char *edestr(int ede)
    case EDE_UNS_NS3_ITER:                return "unsupported NSEC3 iterations value";
    case EDE_UNABLE_POLICY:               return "uanble to conform to policy";
    case EDE_SYNTHESIZED:                 return "synthesized";
+    case EDE_US_SERVFAIL:                 return "upstream returned SERVFAIL";
    default:                              return "unknown";
    }
 }

+static int error_occured(unsigned int flags) {
+  if (flags & F_RCODE)
+    return 1;
+  else if (flags & F_NEG)
+    return 1;
+  else
+    return 0;
+}
+
 void log_query(unsigned int flags, char *name, union all_addr *addr, char *arg, unsigned short type)
 {
  char *source, *dest;
@@ -2259,6 +2320,9 @@ void log_query(unsigned int flags, char *name, union all_addr *addr, char *arg,
  if (!option_bool(OPT_LOG))
    return;

+  if(option_bool(OPT_LOG_ONLY_FAILED) && !error_occured(flags))
+    return;
+
  /* F_NOERR is reused here to indicate logs arrising from auth queries */ 
  if (!(flags & F_NOERR) && option_bool(OPT_AUTH_LOG))
    return;
@@ -22,6 +22,7 @@
 #define TCP_BACKLOG 32  /* kernel backlog limit for TCP connections */
 #define EDNS_PKTSZ 1232 /* default max EDNS.0 UDP packet from from  /dnsflagday.net/2020 */
 #define KEYBLOCK_LEN 40 /* choose to minimise fragmentation when storing DNSSEC keys */
+#define NAMEBLOCK_CHARS 1500 /* quantum of memory allocation for names from /etc/hosts */
 #define DNSSEC_LIMIT_WORK 40 /* Max number of queries to validate one question */
 #define DNSSEC_LIMIT_SIG_FAIL 20 /* Number of signature that can fail to validate in one answer */
 #define DNSSEC_LIMIT_CRYPTO 200 /* max no. of crypto operations to validate one query. */
@@ -142,7 +143,8 @@ HAVE_LOOP
   include functionality to probe for and remove DNS forwarding loops.

 HAVE_INOTIFY
-   use the Linux inotify facility to efficiently re-read configuration files.
+   use the Linux and FreeBSD >= 15 inotify facility
+   to efficiently re-read configuration files.

 NO_ID
   Don't report *.bind CHAOS info to clients, forward such requests upstream instead.
@@ -375,8 +377,15 @@ HAVE_SOCKADDR_SA_LEN
 #undef HAVE_DUMPFILE
 #endif

-#if defined (HAVE_LINUX_NETWORK) && !defined(NO_INOTIFY)
-#define HAVE_INOTIFY
+#if !defined(NO_INOTIFY)
+#  if defined (HAVE_LINUX_NETWORK)
+#    define HAVE_INOTIFY
+#  elif defined (__FreeBSD__) && __FreeBSD__ + 0 >= 15
+#    include <osreldate.h>
+#    if __FreeBSD_version >= 1500068 /* 15.0.0 */
+#      define HAVE_INOTIFY
+#    endif
+#  endif
 #endif

 /* This never compiles code, it's only used by the makefile to fingerprint builds. */
@@ -126,20 +126,18 @@ int hash_init(const struct nettle_hash *hash, void **ctxp, unsigned char **diges

  if (ctx_sz < hash->context_size)
    {
-      if (!(new = whine_malloc(hash->context_size)))
+      if (!(new = whine_realloc(ctx, hash->context_size)))
 	return 0;
-      if (ctx)
-	free(ctx);
+      
      ctx = new;
      ctx_sz = hash->context_size;
    }
  
  if (digest_sz < hash->digest_size)
    {
-      if (!(new = whine_malloc(hash->digest_size)))
+      if (!(new = whine_realloc(digest, hash->digest_size)))
 	return 0;
-      if (digest)
-	free(digest);
+
      digest = new;
      digest_sz = hash->digest_size;
    }
@@ -399,7 +399,7 @@ void dhcp_packet(time_t now, int pxe_fd)
      if (mess->ciaddr.s_addr != 0)
 	dest.sin_addr = mess->ciaddr;
    }
-  if ((is_relay_use_source || mess->giaddr.s_addr) && !is_relay_reply)
+  else if ((is_relay_use_source || mess->giaddr.s_addr) && !is_relay_reply)
    {
      /* Send to BOOTP relay. */
      if (is_relay_use_source)
@@ -86,6 +86,7 @@
 #define EDNS0_OPTION_UMBRELLA       20292 /* Cisco Umbrella temporary assignment */

 /* RFC-8914 extended errors, negative values are our definitions */
+#define EDE_US_SERVFAIL    -2  /* SERVFAIL from usptream */
 #define EDE_UNSET          -1  /* No extended DNS error available */
 #define EDE_OTHER           0  /* Other */
 #define EDE_USUPDNSKEY      1  /* Unsupported DNSKEY algo */
@@ -864,6 +864,9 @@ int main (int argc, char **argv)
    }
 #endif

+   /* Don't start logging malloc before logging is set up. */
+  daemon->log_malloc = option_bool(OPT_LOG_MALLOC);
+  
  if (daemon->port == 0)
    my_syslog(LOG_INFO, _("started, version %s DNS disabled"), VERSION);
  else 
@@ -1335,11 +1338,42 @@ static void sig_handler(int sig)
      if (sig == SIGTERM || sig == SIGINT)
 	exit(EC_MISC);
    }
-  else if (pid != getpid())
+  else if (daemon->pipe_to_parent != -1)
    {
      /* alarm is used to kill TCP children after a fixed time. */
      if (sig == SIGALRM)
-	_exit(0);
+	{
+#ifdef HAVE_DNSSEC
+	  if (!daemon->forward_to_tcp)
+#endif
+	    _exit(0); /* Normal TCP child */
+#ifdef HAVE_DNSSEC
+	  else
+	    {
+	      /* udp_to_tcp transfer.
+		 If daemon->header_to_tcp is NULL the waiting is over and
+		 we can let things take their course, otherwise, send a failure
+		 return down the pipe to unblock the UDP transaction and kill
+		 the process. */
+	      if (daemon->header_to_tcp)
+		{
+		  unsigned char op = PIPE_OP_KILLED;
+		  int status = STAT_ABANDONED;
+		  
+		  read_write(daemon->pipe_to_parent, &op, sizeof(op), RW_WRITE);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)&status, sizeof(status), RW_WRITE);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)(&daemon->plen_to_tcp), sizeof(daemon->plen_to_tcp), RW_WRITE);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)(daemon->header_to_tcp), daemon->plen_to_tcp, RW_WRITE);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)(&daemon->forward_to_tcp), sizeof(daemon->forward_to_tcp), RW_WRITE);
+		  read_write(daemon->pipe_to_parent, (unsigned char *)(&daemon->forward_to_tcp->uid), sizeof(daemon->forward_to_tcp->uid), RW_WRITE);
+
+		  my_syslog(LOG_INFO, _("TCP process for DNSSEC validation timed out"));
+
+		  _exit(0);
+		}
+	    }
+#endif
+	}
    }
  else
    {
@@ -1416,8 +1450,6 @@ void send_event(int fd, int event, int data, char *msg)
    while (writev(fd, iov, msg ? 2 : 1) == -1 && errno == EINTR);
 }

-/* NOTE: the memory used to return msg is leaked: use msgs in events only
-   to describe fatal errors. */
 static int read_event(int fd, struct event_desc *evp, char **msg)
 {
  char *buf;
@@ -1427,12 +1459,22 @@ static int read_event(int fd, struct event_desc *evp, char **msg)
  
  *msg = NULL;
  
-  if (evp->msg_sz != 0 && 
-      (buf = malloc(evp->msg_sz + 1)) &&
-      read_write(fd, (unsigned char *)buf, evp->msg_sz, RW_READ))
+  if (evp->msg_sz != 0)
    {
-      buf[evp->msg_sz] = 0;
-      *msg = buf;
+      if (!(buf = whine_malloc(evp->msg_sz + 1)))
+	{
+	  int i;
+	  unsigned char a;
+	  
+	  /* Keep the stream synchronised if malloc fails. */
+	  for (i = 0; i < evp->msg_sz; i++)
+	    read_write(fd, &a, 1, RW_READ);
+	}
+      else if (read_write(fd, (unsigned char *)buf, evp->msg_sz, RW_READ))
+	{
+	  buf[evp->msg_sz] = 0;
+	  *msg = buf;
+	}
    }

  return 1;
@@ -1495,9 +1537,6 @@ static void async_event(int pipe, time_t now)
  int wstatus, i, check = 0;
  char *msg;
  
-  /* NOTE: the memory used to return msg is leaked: use msgs in events only
-     to describe fatal errors. */
-  
  if (read_event(pipe, &ev, &msg))
    switch (ev.event)
      {
@@ -1603,7 +1642,6 @@ static void async_event(int pipe, time_t now)
      case EVENT_SCRIPT_LOG:
 	my_syslog(MS_SCRIPT | LOG_DEBUG, "%s", msg ? msg : "");
        free(msg);
-	msg = NULL;
 	break;

 	/* necessary for fatal errors in helper */
@@ -1941,20 +1979,21 @@ static void check_dns_listeners(time_t now)

 static void do_tcp_connection(struct listener *listener, time_t now, int slot)
 {
-  int confd, client_ok = 1;
+  int confd;
  struct irec *iface = NULL;
  pid_t p;
  union mysockaddr tcp_addr;
  socklen_t tcp_len = sizeof(union mysockaddr);
-  unsigned char *buff;
  struct server *s; 
-  int flags, auth_dns;
+  int flags, auth_dns = 0;
  struct in_addr netmask;
  int pipefd[2];
+  struct iovec tcpbuff;
 #ifdef HAVE_LINUX_NETWORK
  unsigned char a = 0;
 #endif
-
+  netmask.s_addr = 0;
+  
  while ((confd = accept(listener->tcpfd, NULL, NULL)) == -1 && errno == EINTR);
  
  if (confd == -1)
@@ -1981,58 +2020,63 @@ static void do_tcp_connection(struct listener *listener, time_t now, int slot)
  
  enumerate_interfaces(0);
  
-  if (option_bool(OPT_NOWILD))
-    iface = listener->iface; /* May be NULL */
+  if (option_bool(OPT_NOWILD) || option_bool(OPT_CLEVERBIND))
+    {
+      if ((iface = listener->iface)) 
+	{
+	  netmask = iface->netmask;
+	  auth_dns = iface->dns_auth;
+	}
+    }
  else 
    {
-      int if_index;
+      int if_index, got_index = 0;
      char intr_name[IF_NAMESIZE];
      
-      /* if we can find the arrival interface, check it's one that's allowed */
+      /* if we can find the arrival interface, check it's one that's allowed
+	 tcp_interface() is not implemented on non-Linux platforms */
      if ((if_index = tcp_interface(confd, tcp_addr.sa.sa_family)) != 0 &&
 	  indextoname(listener->tcpfd, if_index, intr_name))
 	{
 	  union all_addr addr;
+
+	  got_index = 1;
 	  
 	  if (tcp_addr.sa.sa_family == AF_INET6)
 	    addr.addr6 = tcp_addr.in6.sin6_addr;
 	  else
 	    addr.addr4 = tcp_addr.in.sin_addr;
 	  
-	  for (iface = daemon->interfaces; iface; iface = iface->next)
-	    if (iface->index == if_index &&
-		iface->addr.sa.sa_family == tcp_addr.sa.sa_family)
-	      break;
-	  
-	  if (!iface && !loopback_exception(listener->tcpfd, tcp_addr.sa.sa_family, &addr, intr_name))
-	    client_ok = 0;
+	  if (!iface_check(tcp_addr.sa.sa_family, &addr, intr_name, &auth_dns) &&
+	      !loopback_exception(listener->tcpfd, tcp_addr.sa.sa_family, &addr, intr_name))
+	    goto closeconandreturn;
 	}
      
-      if (option_bool(OPT_CLEVERBIND))
-	iface = listener->iface; /* May be NULL */
-      else
+      /* When binding the wildcard address, try and get the
+	 netmask of the interface for localisation. */
+      for (iface = daemon->interfaces; iface; iface = iface->next)
+	if (sockaddr_isequal(&iface->addr, &tcp_addr))
+	  {
+	    netmask = iface->netmask;
+	    break;
+	  }
+
+      /* On platforms where tcp_interface() doesn't work, we rely
+	 of the presence of the local address of the connection in the
+	 interface list to check if we're accepting this connection and
+	 for its auth status. */
+      if (!got_index)
 	{
-	  /* Check for allowed interfaces when binding the wildcard address:
-	     we do this by looking for an interface with the same address as 
-	     the local address of the TCP connection, then looking to see if that's
-	     an allowed interface. As a side effect, we get the netmask of the
-	     interface too, for localisation. */
-	  
-	  for (iface = daemon->interfaces; iface; iface = iface->next)
-	    if (sockaddr_isequal(&iface->addr, &tcp_addr))
-	      break;
-	  
 	  if (!iface)
-	    client_ok = 0;
+	    goto closeconandreturn;
+
+	  auth_dns = iface->dns_auth;
 	}
    }
  
-  if (!client_ok)
-    goto closeconandreturn;
-  
  if (!option_bool(OPT_DEBUG))
    {
-      /* The code in edns0.c qthat decorates queries with the source MAC address depends
+      /* The code in edns0.c that decorates queries with the source MAC address depends
 	 on the code in arp.c, which populates a cache with the contents of the ARP table
 	 using netlink. Since the child process can't use netlink, we pre-populate
 	 the cache with the ARP table entry for our source here, including a negative entry
@@ -2100,23 +2144,9 @@ static void do_tcp_connection(struct listener *listener, time_t now, int slot)
 	  
 	  return;
 	}
-    }
-         
-  if (iface)
-    {
-      netmask = iface->netmask;
-      auth_dns = iface->dns_auth;
-    }
-  else
-    {
-      netmask.s_addr = 0;
-      auth_dns = 0;
-    }
-  
-  /* Arrange for SIGALRM after CHILD_LIFETIME seconds to
-     terminate the process. */
-  if (!option_bool(OPT_DEBUG))
-    {
+      
+      /* Arrange for SIGALRM after CHILD_LIFETIME seconds to
+	 terminate the process. */
 #ifdef HAVE_LINUX_NETWORK
      /* See comment above re: netlink socket. */
      close(daemon->netlinkfd);
@@ -2133,10 +2163,8 @@ static void do_tcp_connection(struct listener *listener, time_t now, int slot)
  if ((flags = fcntl(confd, F_GETFL, 0)) != -1)
    while(retry_send(fcntl(confd, F_SETFL, flags & ~O_NONBLOCK)));

-  buff = tcp_request(confd, now, &tcp_addr, netmask, auth_dns);
-	      
-  if (buff)
-    free(buff);
+  tcp_request(confd, now, &tcpbuff, &tcp_addr, netmask, auth_dns);
+  free(tcpbuff.iov_base);
  
  for (s = daemon->servers; s; s = s->next)
    if (s->tcpfd != -1)
@@ -2239,8 +2267,12 @@ int swap_to_tcp(struct frec *forward, time_t now, int status, struct dns_header
 	  close(daemon->netlinkfd);
 	  read_write(pipefd[1], &a, 1, RW_WRITE);
 #endif		  
+	  alarm(CHILD_LIFETIME);
 	  close(pipefd[0]); /* close read end in child. */
-	  daemon->pipe_to_parent = pipefd[1];	  
+	  daemon->pipe_to_parent = pipefd[1];
+	  daemon->forward_to_tcp = forward;
+	  daemon->header_to_tcp = header;
+	  daemon->plen_to_tcp = *plen;
 	}
    }
  
@@ -289,7 +289,9 @@ struct event_desc {
 #define OPT_DO_0x20        75
 #define OPT_AUTH_LOG       76
 #define OPT_LEASEQUERY     77
-#define OPT_LAST           78
+#define OPT_LOG_ONLY_FAILED  78
+#define OPT_LOG_MALLOC     79
+#define OPT_LAST           80

 #define OPTION_BITS (sizeof(unsigned int)*8)
 #define OPTION_SIZE ( (OPT_LAST/OPTION_BITS)+((OPT_LAST%OPTION_BITS)!=0) )
@@ -549,6 +551,7 @@ struct crec {
 #define PIPE_OP_STATS   3  /* Update parent's stats */
 #define PIPE_OP_IPSET   4  /* Update IPset */
 #define PIPE_OP_NFTSET  5  /* Update NFTset */
+#define PIPE_OP_KILLED  6  /* child killed by SIGALARM */

 /* struct sockaddr is not large enough to hold any address,
   and specifically not big enough to hold an IPv6 address.
@@ -760,10 +763,9 @@ struct dyndir {
 #define STAT_NEED_DS            0x40000
 #define STAT_NEED_KEY           0x50000
 #define STAT_TRUNCATED          0x60000
-#define STAT_SECURE_WILDCARD    0x70000
-#define STAT_OK                 0x80000
-#define STAT_ABANDONED          0x90000
-#define STAT_ASYNC              0xa0000
+#define STAT_OK                 0x70000
+#define STAT_ABANDONED          0x80000
+#define STAT_ASYNC              0x90000

 #define DNSSEC_FAIL_NYV         0x0001 /* key not yet valid */
 #define DNSSEC_FAIL_EXP         0x0002 /* key expired */
@@ -777,6 +779,7 @@ struct dyndir {
 #define DNSSEC_FAIL_NSEC3_ITERS 0x0200 /* too many iterations in NSEC3 */
 #define DNSSEC_FAIL_BADPACKET   0x0400 /* bad packet */
 #define DNSSEC_FAIL_WORK        0x0800 /* too much crypto */
+#define DNSSEC_FAIL_UPSTREAM    0x1000 /* SERVFAIL from UPSTREAM */

 #define STAT_ISEQUAL(a, b)  (((a) & 0xffff0000) == (b))

@@ -1205,6 +1208,7 @@ extern struct daemon {
  int log_fac; /* log facility */
  char *log_file; /* optional log file */
  int max_logs;  /* queue limit */
+  int log_malloc; /* log malloc/realloc/free */
  int randport_limit; /* Maximum number of source ports for query. */
  int cachesize, ftabsize;
  int port, query_port, min_port, max_port;
@@ -1271,6 +1275,9 @@ extern struct daemon {
  int dnssec_no_time_check;
  int back_to_the_future;
  int limit[LIMIT_MAX];
+  struct frec *forward_to_tcp;
+  struct dns_header *header_to_tcp;
+  ssize_t plen_to_tcp;
 #endif
  struct frec *frec_list;
  struct frec_src *free_frec_src;
@@ -1462,7 +1469,7 @@ int dnssec_validate_by_ds(time_t now, struct dns_header *header, size_t plen, ch
 int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char *name,
 		       char *keyname, int class, int *validate_count);
 int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, int *class,
-			  int check_unsigned, int *neganswer, int *nons, int *nsec_ttl, int *validate_count);
+			  int check_unsigned, int *neganswer, int *prim_ok, int *nons, int *nsec_ttl, int *validate_count);
 int dnskey_keytag(int alg, int flags, unsigned char *key, int keylen);
 size_t filter_rrsigs(struct dns_header *header, size_t plen);
 int setup_timestamp(void);
@@ -1490,8 +1497,16 @@ unsigned char *do_rfc1035_name(unsigned char *p, char *sval, char *limit);
 void *safe_malloc(size_t size);
 void safe_strncpy(char *dest, const char *src, size_t size);
 void safe_pipe(int *fd, int read_noblock);
-void *whine_malloc(size_t size);
-void *whine_realloc(void *ptr, size_t size);
+#define whine_malloc(x) whine_malloc_real(__func__, __LINE__, (x))
+#define whine_realloc(x, y) whine_realloc_real(NULL, __func__, __LINE__, (x), (y))
+#define expand_buf(x, y) expand_buf_real(__func__, __LINE__, (x), (y))
+#define expand_workspace(x, y, z) expand_workspace_real(__func__, __LINE__, (x), (y), (z))
+#define free(x) free_real(__func__, __LINE__, (x))
+void free_real(const char *func, unsigned int line, void *ptr);
+void *whine_malloc_real(const char *func, unsigned int line, size_t size);
+void *whine_realloc_real(const char *wrapper, const char *func, unsigned int line, void *ptr, size_t size);
+int expand_buf_real(const char *func, unsigned int line, struct iovec *iov, size_t size);
+int expand_workspace_real(const char *func, unsigned int line, unsigned char ***wkspc, int *szp, int new);
 int sa_len(union mysockaddr *addr);
 int sockaddr_isequal(const union mysockaddr *s1, const union mysockaddr *s2);
 int sockaddr_isnull(const union mysockaddr *s);
@@ -1513,9 +1528,9 @@ int parse_hex(char *in, unsigned char *out, int maxlen,
 	      unsigned int *wildcard_mask, int *mac_type);
 int memcmp_masked(unsigned char *a, unsigned char *b, int len, 
 		  unsigned int mask);
-int expand_buf(struct iovec *iov, size_t size);
 char *print_mac(char *buff, unsigned char *mac, int len);
 int read_write(int fd, unsigned char *packet, int size, int rw);
+int read_writev(int fd, struct iovec *iov, int iovcnt, int rw);
 void close_fds(long max_fd, int spare1, int spare2, int spare3);
 int wildcard_match(const char* wildcard, const char* match);
 int wildcard_matchn(const char* wildcard, const char* match, int num);
@@ -1558,8 +1573,8 @@ int tcp_from_udp(time_t now, int status, struct dns_header *header, ssize_t *n,
 		 int class, char *name, struct server *server, 
 		 int *keycount, int *validatecount);
 #endif
-unsigned char *tcp_request(int confd, time_t now,
-			   union mysockaddr *local_addr, struct in_addr netmask, int auth_dns);
+void tcp_request(int confd, time_t now, struct iovec *bigbuff,
+		 union mysockaddr *local_addr, struct in_addr netmask, int auth_dns);
 void server_gone(struct server *server);
 int send_from(int fd, int nowild, char *packet, size_t len, 
 	       union mysockaddr *to, union all_addr *source,
@@ -1904,7 +1919,6 @@ int do_poll(int timeout);
 /* rrfilter.c */
 size_t rrfilter(struct dns_header *header, size_t *plen, int mode);
 short *rrfilter_desc(int type);
-int expand_workspace(unsigned char ***wkspc, int *szp, int new);
 int to_wire(char *name);
 void from_wire(char *name);
 /* modes. */
@@ -370,45 +370,42 @@ static int explore_rrset(struct dns_header *header, size_t plen, int class, int
 	      
 	      GETSHORT(type_covered, p);
 	      p += 16; /* algo, labels, orig_ttl, sig_expiration, sig_inception, key_tag */
-	      
-	      if (gotkey)
+
+	      if (type_covered == type)
 		{
-		  /* If there's more than one SIG, ensure they all have same keyname */
-		  if (extract_name(header, plen, &p, keyname, EXTR_NAME_COMPARE, 0) != 1)
+		  if (!extract_name(header, plen, &p, daemon->workspacename, EXTR_NAME_EXTRACT, 0))
 		    return 0;
-		}
-	      else
-		{
-		  gotkey = 1;
-		  
-		  if (!extract_name(header, plen, &p, keyname, EXTR_NAME_EXTRACT, 0))
-		    return 0;
-		  
+
 		  /* RFC 4035 5.3.1 says that the Signer's Name field MUST equal
 		     the name of the zone containing the RRset. We can't tell that
 		     for certain, but we can check that  the RRset name is equal to
 		     or encloses the signers name, which should be enough to stop 
 		     an attacker using signatures made with the key of an unrelated 
-		     zone he controls. Note that the root key is always allowed. */
-		  if (*keyname != 0)
+		     zone he controls. Note that the root key is always allowed.
+		     Ignore sigs which aren't valid */
+		  if (*daemon->workspacename == 0 || hostname_issubdomain(name, daemon->workspacename) != 0)
 		    {
-		      char *name_start;
-		      for (name_start = name; !hostname_isequal(name_start, keyname); )
-			if ((name_start = strchr(name_start, '.')))
-			  name_start++; /* chop a label off and try again */
-			else
-			  return 0;
+		      if (gotkey)
+			{
+			  /* If there's more than one valid SIG, they must all have same keyname */
+			  if (!hostname_isequal(keyname, daemon->workspacename))
+			    return 0;
+			}
+		      else
+			{
+			  strcpy(keyname, daemon->workspacename);
+			  gotkey = 1;
+			}
+		      
+		      if (gotkey)
+			{
+			  if (!expand_workspace(&sigs, &sig_sz, sigidx))
+			    return 0; 
+		      
+			  sigs[sigidx++] = pdata;
+			}
 		    }
 		}
-		  
-	      
-	      if (type_covered == type)
-		{
-		  if (!expand_workspace(&sigs, &sig_sz, sigidx))
-		    return 0; 
-		  
-		  sigs[sigidx++] = pdata;
-		} 
 	      
 	      p = pdata + 6; /* restore for ADD_RDLEN */
 	    }
@@ -438,8 +435,6 @@ int dec_counter(int *counter, char *message)
 /* Validate a single RRset (class, type, name) in the supplied DNS reply 
   Return code:
   STAT_SECURE   if it validates.
-   STAT_SECURE_WILDCARD if it validates and is the result of wildcard expansion.
-   (In this case *wildcard_out points to the "body" of the wildcard within name.) 
   STAT_BOGUS    signature is wrong, bad packet.
   STAT_ABANDONED validation abandoned do to excess resource usage.
   STAT_NEED_KEY need DNSKEY to complete validation (name is returned in keyname)
@@ -455,7 +450,7 @@ int dec_counter(int *counter, char *message)
   ttl_out is the floor on TTL, based on TTL and orig_ttl and expiration of sig used to validate.
 */
 static int validate_rrset(time_t now, struct dns_header *header, size_t plen, int class, int type, int sigidx, int rrsetidx, 
-			  char *name, char *keyname, char **wildcard_out, struct blockdata *key, int keylen,
+			  char *name, char *keyname, int *wildcard_offset_out, struct blockdata *key, int keylen,
 			  int algo_in, int keytag_in, unsigned long *ttl_out, int *validate_counter)
 {
  unsigned char *p;
@@ -463,13 +458,15 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
  struct crec *crecp = NULL;
  short *rr_desc = rrfilter_desc(type);
  u32 sig_expiration, sig_inception;
-  int failflags = DNSSEC_FAIL_NOSIG | DNSSEC_FAIL_NYV | DNSSEC_FAIL_EXP | DNSSEC_FAIL_NOKEYSUP;
-  
-  unsigned long curtime = time(0);
+    unsigned long curtime = time(0);
  int time_check = is_check_date(curtime);
+  int failflags = DNSSEC_FAIL_NOSIG;
  
-  if (wildcard_out)
-    *wildcard_out = NULL;
+  if (sigidx != 0)
+    failflags |= DNSSEC_FAIL_NYV | DNSSEC_FAIL_EXP | DNSSEC_FAIL_NOKEYSUP;
+
+  if (wildcard_offset_out)
+    *wildcard_offset_out = 0;
  
  name_labels = count_labels(name); /* For 4035 5.3.2 check */

@@ -574,7 +571,9 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
 	  name_start = name;
 	  
 	  /* if more labels than in RRsig name, hash *.<no labels in rrsig labels field>  4035 5.3.2 */
-	  if (labels < name_labels)
+	  /* If the name is already the wildcard, we're not going to change it. */
+	  if (labels < name_labels &&
+	      !(name_labels - labels == 1 && name_start[0] == '*' && name_start[1] == '.'))
 	    {
 	      for (j = name_labels - labels; j != 0; j--)
 		{
@@ -584,11 +583,11 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
 		    name_start++;
 		}
 	      
-	      if (wildcard_out)
-		*wildcard_out = name_start+1;
-
+	      if (wildcard_offset_out)
+		*wildcard_offset_out = name_start - name + 1;
+	      
 	      name_start--;
-	      *name_start = '*';
+	      *name_start = '*';	      
 	    }
 	  
 	  wire_len = to_wire(name_start);
@@ -687,7 +686,7 @@ static int validate_rrset(time_t now, struct dns_header *header, size_t plen, in
 		  return STAT_ABANDONED;
 		
 		if (verify(crecp->addr.key.keydata, crecp->addr.key.keylen, sig, sig_len, digest, hash->digest_size, algo))
-		  return (labels < name_labels) ? STAT_SECURE_WILDCARD : STAT_SECURE;
+		  return STAT_SECURE;
 		
 		/* An attacker can waste a lot of our CPU by setting up a giant DNSKEY RRSET full of failing
 		   keys, all of which we have to try. Since many failing keys is not likely for
@@ -992,7 +991,7 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
 		       char *keyname, int class, int *validate_counter)
 {
  unsigned char *p = (unsigned char *)(header+1);
-  int qtype, qclass, rc, i, neganswer = 0, nons = 0, servfail = 0, neg_ttl = 0, found_supported = 0;
+  int qtype, qclass, rc, i, neganswer = 0, prim_ok = 0, nons = 0, servfail = 0, neg_ttl = 0, found_supported = 0;
  int aclass, atype, rdlen, flags;
  unsigned long ttl;
  union all_addr a;
@@ -1003,7 +1002,7 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
  if (RCODE(header) == SERVFAIL)
    servfail = neganswer = nons = 1;
  else
-    rc = dnssec_validate_reply(now, header, plen, name, keyname, NULL, 0, &neganswer, &nons, &neg_ttl, validate_counter);
+    rc = dnssec_validate_reply(now, header, plen, name, keyname, NULL, 0, &neganswer, &prim_ok, &nons, &neg_ttl, validate_counter);
  
  p = (unsigned char *)(header+1);
  if (ntohs(header->qdcount) != 1 ||
@@ -1020,27 +1019,32 @@ int dnssec_validate_ds(time_t now, struct dns_header *header, size_t plen, char
    {
      if (STAT_ISEQUAL(rc, STAT_INSECURE))
 	{
-	  if (option_bool(OPT_BOGUSPRIV) &&
-	      (flags = in_arpa_name_2_addr(name, &a)) &&
-	      ((flags == F_IPV6 && private_net6(&a.addr6, 0)) || (flags == F_IPV4 && private_net(a.addr4, 0))))
+	  /* A INSECURE DS answer is OK if it's negative and there's a CNAME answer to the DS answer which is
+	     signed, since that's enough to prove that the DS record doesn't exist. */
+	  if (!neganswer || !prim_ok)
 	    {
-	      my_syslog(LOG_INFO, _("Insecure reply received for DS %s, assuming that's OK for a RFC-1918 address."), name);
-	      neganswer = 1;
-	      nons = 0; /* If we're faking a DS, fake one with an NS. */
-	      neg_ttl = DNSSEC_ASSUMED_DS_TTL;
-	    }
-	  else if (lookup_domain(name, F_DOMAINSRV, NULL, NULL))
-	    {
-	      my_syslog(LOG_INFO, _("Insecure reply received for DS %s, assuming non-DNSSEC domain-specific server."), name);
-	      neganswer = 1;
-	      nons = 0; /* If we're faking a DS, fake one with an NS. */
-	      neg_ttl = DNSSEC_ASSUMED_DS_TTL;
-	    }
-	  else
-	    {
-	      my_syslog(LOG_WARNING, _("Insecure DS reply received for %s, check domain configuration and upstream DNS server DNSSEC support"), name);
-	      log_query(F_NOEXTRA | F_UPSTREAM, name, NULL, "BOGUS DS - not secure", 0);
-	      return STAT_BOGUS | DNSSEC_FAIL_INDET;
+	      if (option_bool(OPT_BOGUSPRIV) &&
+		  (flags = in_arpa_name_2_addr(name, &a)) &&
+		  ((flags == F_IPV6 && private_net6(&a.addr6, 0)) || (flags == F_IPV4 && private_net(a.addr4, 0))))
+		{
+		  my_syslog(LOG_INFO, _("Insecure reply received for DS %s, assuming that's OK for a RFC-1918 address."), name);
+		  neganswer = 1;
+		  nons = 0; /* If we're faking a DS, fake one with an NS. */
+		  neg_ttl = DNSSEC_ASSUMED_DS_TTL;
+		}
+	      else if (lookup_domain(name, F_DOMAINSRV, NULL, NULL))
+		{
+		  my_syslog(LOG_INFO, _("Insecure reply received for DS %s, assuming non-DNSSEC domain-specific server."), name);
+		  neganswer = 1;
+		  nons = 0; /* If we're faking a DS, fake one with an NS. */
+		  neg_ttl = DNSSEC_ASSUMED_DS_TTL;
+		}
+	      else
+		{
+		  my_syslog(LOG_WARNING, _("Insecure DS reply received for %s, check domain configuration and upstream DNS server DNSSEC support"), name);
+		  log_query(F_NOEXTRA | F_UPSTREAM, name, NULL, "BOGUS DS - not secure", 0);
+		  return STAT_BOGUS | DNSSEC_FAIL_INDET; 
+		}
 	    }
 	}
      else
@@ -1419,7 +1423,10 @@ static int base32_decode(char *in, unsigned char *out)
 	    oc |= 1;
 	  mask = mask >> 1;
 	  if (((++on) & 7) == 0)
-	    *p++ = oc;
+	    {
+	      *p++ = oc;
+	      oc = 0;
+	    }
 	  oc = oc << 1;
 	}
    }
@@ -1545,11 +1552,11 @@ static int check_nsec3_coverage(struct dns_header *header, size_t plen, int dige

 /* returns 0 on success, or DNSSEC_FAIL_* value on failure. */
 static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, unsigned char **nsecs, int nsec_count, char *workspace1,
-				     char *workspace2, char *name, int type, char *wildname, int *nons, int *validate_counter)
+				     char *workspace2, char *name, int type, int wild_offset, int *nons, int *validate_counter)
 {
  unsigned char *salt, *p, *digest;
  int digest_len, i, iterations, salt_len, base32_len, algo = 0;
-  struct nettle_hash const *hash;
+  struct nettle_hash const *hash = NULL;
  char *closest_encloser, *next_closest, *wildcard;
  
  if (nons)
@@ -1643,9 +1650,9 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns
      if (*closest_encloser == '.')
 	closest_encloser++;

-      if (wildname && hostname_isequal(closest_encloser, wildname))
+      if (wild_offset != 0 && name - closest_encloser == wild_offset)
 	break;
-
+      
      if (dec_counter(validate_counter, NULL))
 	return DNSSEC_FAIL_WORK;
      
@@ -1687,7 +1694,7 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns
    return DNSSEC_FAIL_NONSEC;
  
  /* Finally, check that there's no seat of wildcard synthesis */
-  if (!wildname)
+  if (wild_offset == 0)
    {
      if (!(wildcard = strchr(next_closest, '.')) || wildcard == next_closest)
 	return DNSSEC_FAIL_NONSEC;
@@ -1710,7 +1717,7 @@ static int prove_non_existence_nsec3(struct dns_header *header, size_t plen, uns

 /* returns 0 on success, or DNSSEC_FAIL_* value on failure. */
 static int prove_non_existence(struct dns_header *header, size_t plen, char *keyname, char *name, int qtype, int qclass,
-			       char *wildname, int *nons, int *nsec_ttl, int *validate_counter)
+			      int wild_offset, int *nons, int *nsec_ttl, int *validate_counter)
 {
  static unsigned char **nsecset = NULL, **rrsig_labels = NULL;
  static int nsecset_sz = 0, rrsig_labels_sz = 0;
@@ -1858,7 +1865,7 @@ static int prove_non_existence(struct dns_header *header, size_t plen, char *key
  if (type_found == T_NSEC)
    return prove_non_existence_nsec(header, plen, nsecset, rrsig_labels, nsecs_found, daemon->workspacename, keyname, name, qtype, nons);
  else if (type_found == T_NSEC3)
-    return prove_non_existence_nsec3(header, plen, nsecset, nsecs_found, daemon->workspacename, keyname, name, qtype, wildname, nons, validate_counter);
+    return prove_non_existence_nsec3(header, plen, nsecset, nsecs_found, daemon->workspacename, keyname, name, qtype, wild_offset, nons, validate_counter);
  else
    return DNSSEC_FAIL_NONSEC;
 }
@@ -1965,7 +1972,7 @@ static int zone_status(char *name, int class, char *keyname, time_t now)
   if the nons argument is non-NULL.
 */
 int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, char *name, char *keyname, 
-			  int *class, int check_unsigned, int *neganswer, int *nons, int *nsec_ttl, int *validate_counter)
+			  int *class, int check_unsigned, int *neganswer, int *prim_ok, int *nons, int *nsec_ttl, int *validate_counter)
 {
  static unsigned char **targets = NULL;
  static int target_sz = 0;
@@ -1994,8 +2001,11 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
  
  if (neganswer)
    *neganswer = 0;
+
+  if (RCODE(header) == SERVFAIL)
+    return STAT_BOGUS | DNSSEC_FAIL_UPSTREAM;
  
-  if (RCODE(header) == SERVFAIL || ntohs(header->qdcount) != 1)
+  if (ntohs(header->qdcount) != 1)
    return STAT_BOGUS;
  
  if (RCODE(header) != NXDOMAIN && RCODE(header) != NOERROR)
@@ -2103,8 +2113,8 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 		       CNAME must be <subdomain>.<dname>
 		       CNAME target must be <subdomain>.<dname_target>
 		       <subdomain>s must match for name and target. */ 
-		    if (hostname_issubdomain(name, daemon->cname) == 1 &&
-			hostname_issubdomain(keyname, daemon->workspacename) == 1 &&
+		    if (hostname_issubdomain(daemon->cname, name) == 1 &&
+			hostname_issubdomain(daemon->workspacename, keyname) == 1 &&
 			name_prefix_len == strlen(daemon->workspacename) - strlen(keyname))
 		      {
 			char save = daemon->cname[name_prefix_len];
@@ -2183,47 +2193,32 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
      else
 	{
 	  /* Not done, validate now */
-	  int sigcnt, rrcnt;
-	  char *wildname;
+	  int sigcnt, rrcnt, wild_offset;
 	  
 	  if (!explore_rrset(header, plen, class1, type1, name, keyname, &sigcnt, &rrcnt))
 	    return STAT_BOGUS;
 	  
-	  /* No signatures for RRset. We can be configured to assume this is OK and return an INSECURE result. */
-	  if (sigcnt == 0)
-	    {
-	      /* NSEC and NSEC3 records must be signed. We make this assumption elsewhere. */
-	      if (type1 == T_NSEC || type1 == T_NSEC3)
-		return STAT_BOGUS | DNSSEC_FAIL_NOSIG;
-	      else if (nons && i >= ntohs(header->ancount))
-		/* If we're validating a DS reply, rather than looking for the value of AD bit,
-		   we only care that NSEC and NSEC3 RRs in the auth section are signed. 
-		   Return SECURE even if others (SOA....) are not. */
-		rc = STAT_SECURE;
-	      else
-		{
-		  /* unsigned RRsets in auth section are not BOGUS, but do make reply insecure. */
-		  if (check_unsigned && i < ntohs(header->ancount))
-		    {
-		      rc = zone_status(name, class1, keyname, now);
-		      if (STAT_ISEQUAL(rc, STAT_SECURE))
-			rc = STAT_BOGUS | DNSSEC_FAIL_NOSIG;
-		      
-		      if (class)
-			*class = class1; /* Class for NEED_DS or NEED_KEY */
-		    }
-		  else 
-		    rc = STAT_INSECURE; 
-		  
-		  if (!STAT_ISEQUAL(rc, STAT_INSECURE))
-		    return rc;
-		}
-	    }
+	  /* NSEC and NSEC3 records must be signed. We make this assumption elsewhere. */
+	  if (sigcnt == 0 && (type1 == T_NSEC || type1 == T_NSEC3))
+	    return STAT_BOGUS | DNSSEC_FAIL_NOSIG;
+	  else if (sigcnt == 0 && nons && i >= ntohs(header->ancount))
+	    /* If we're validating a DS reply, rather than looking for the value of AD bit,
+	       we only care that NSEC and NSEC3 RRs in the auth section are signed. 
+	       Return SECURE even if others (SOA....) are not. */
+	    rc = STAT_SECURE;
+	  else if (sigcnt == 0 && (!check_unsigned || i >= ntohs(header->ancount)))
+	    /* unsigned RRsets in auth section are not BOGUS, but do make reply insecure. */
+	    rc = STAT_INSECURE;
 	  else
 	    {
-	      /* explore_rrset() gives us key name from sigs in keyname.
+	      /* explore_rrset() gives us zone name from sigs in keyname, if
+		 it didn't find a key, use the name we're validating.
 		 Can't overwrite name here. */
-	      strcpy(daemon->workspacename, keyname);
+	      if (sigcnt == 0)
+		strcpy(daemon->workspacename, name);
+	      else
+		strcpy(daemon->workspacename, keyname);
+	      
 	      rc = zone_status(daemon->workspacename, class1, keyname, now);
 	      
 	      if (STAT_ISEQUAL(rc, STAT_BOGUS) || STAT_ISEQUAL(rc, STAT_NEED_KEY) || STAT_ISEQUAL(rc, STAT_NEED_DS))
@@ -2233,12 +2228,12 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 		  return rc;
 		}
 	      
-	      /* Zone is insecure, don't need to validate RRset */
+	      /* If zone is insecure, don't need to validate RRset, and rc remains as STAT_INSECURE*/
 	      if (STAT_ISEQUAL(rc, STAT_SECURE))
 		{
 		  unsigned long sig_ttl;
 		  rc = validate_rrset(now, header, plen, class1, type1, sigcnt,
-				      rrcnt, name, keyname, &wildname, NULL, 0, 0, 0, &sig_ttl, validate_counter);
+				      rrcnt, name, keyname, &wild_offset, NULL, 0, 0, 0, &sig_ttl, validate_counter);
 		  
 		  if (STAT_ISEQUAL(rc, STAT_BOGUS) || STAT_ISEQUAL(rc, STAT_NEED_KEY) || STAT_ISEQUAL(rc, STAT_NEED_DS) || STAT_ISEQUAL(rc, STAT_ABANDONED))
 		    {
@@ -2247,7 +2242,7 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 		      return rc;
 		    } 
 		  
-		  /* rc is now STAT_SECURE or STAT_SECURE_WILDCARD */
+		  /* rc is now STAT_SECURE  */
 		  
 		  /* Note that RR is validated */
 		  daemon->rr_status[i] = sig_ttl;
@@ -2273,8 +2268,8 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 		     Note that we may not yet have validated the NSEC/NSEC3 RRsets. 
 		     That's not a problem since if the RRsets later fail
 		     we'll return BOGUS then. */
-		  if (STAT_ISEQUAL(rc, STAT_SECURE_WILDCARD) &&
-		      ((rc_nsec = prove_non_existence(header, plen, keyname, name, type1, class1, wildname, NULL, NULL, validate_counter))) != 0)
+		  if (wild_offset != 0 &&
+		      ((rc_nsec = prove_non_existence(header, plen, keyname, name, type1, class1, wild_offset, NULL, NULL, validate_counter))) != 0)
 		    return  (rc_nsec & DNSSEC_FAIL_WORK) ? STAT_ABANDONED : (STAT_BOGUS | rc_nsec);

 		  rc = STAT_SECURE;
@@ -2286,6 +2281,20 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 	secure = STAT_INSECURE;
    }

+
+  /* For a DS record, we are interested also in if the answer to the DS query was
+     a CNAME RRset which validated. That's proof that the DS doesn't exist,
+     even if it's  a CNAME which is not signed, and therefore we have no proof
+     of what it actually _is_. This return tells us that the answer to
+     primary query is secure, even is the whole answer is insecure, because
+     something down the CNAME list doesn't validate or doesn't exist.
+     Note that prim_ok is only valid when neganswer is true, ie either
+     the answer is the requested record or it's a CNAME that ends
+     in a missing answer or an unsigned zone.
+  */
+  if (prim_ok)
+    *prim_ok = !targets[0];
+    
  /* OK, all the RRsets validate, now see if we have a missing answer or CNAME target. */
  for (j = 0; j <targetidx; j++)
    if ((p2 = targets[j]))
@@ -2296,20 +2305,12 @@ int dnssec_validate_reply(time_t now, struct dns_header *header, size_t plen, ch
 	if (!extract_name(header, plen, &p2, name, EXTR_NAME_EXTRACT, 10))
 	  return STAT_BOGUS; /* bad packet */
 	
-	/* NXDOMAIN or NODATA reply, unanswered question is (name, qclass, qtype) */
-	
-	/* For anything other than a DS record, this situation is OK if either
-	   the answer is in an unsigned zone, or there's NSEC records.
-	   For a DS record, we return INSECURE, which almost always turns
-	   into BOGUS in the caller. */
-	if ((rc_nsec = prove_non_existence(header, plen, keyname, name, qtype, qclass, NULL, nons, nsec_ttl, validate_counter)) != 0)
+	/* NXDOMAIN or NODATA reply, unanswered question is (name, qclass, qtype)
+	   This situation is OK if either the answer is in an unsigned zone, or there's NSEC records. */
+	if ((rc_nsec = prove_non_existence(header, plen, keyname, name, qtype, qclass, 0, nons, nsec_ttl, validate_counter)) != 0)
 	  {
 	    if (rc_nsec & DNSSEC_FAIL_WORK)
 	      return STAT_ABANDONED;
-
-	    /* Empty DS without NSECS */
-	    if (qtype == T_DS)
-	      return STAT_INSECURE;
 	    
 	    if ((rc_nsec & (DNSSEC_FAIL_NONSEC | DNSSEC_FAIL_NSEC3_ITERS)) &&
 		!STAT_ISEQUAL((rc = zone_status(name, qclass, keyname, now)), STAT_SECURE))
@@ -2381,8 +2382,9 @@ int errflags_to_ede(int status)
  /* We can end up with more than one flag set for some errors,
     so this encodes a rough priority so the (eg) No sig is reported
     before no-unexpired-sig. */
-
-  if (status & DNSSEC_FAIL_NYV)
+  if (status & DNSSEC_FAIL_UPSTREAM)
+    return EDE_US_SERVFAIL;
+  else if (status & DNSSEC_FAIL_NYV)
    return EDE_SIG_NYV;
  else if (status & DNSSEC_FAIL_EXP)
    return EDE_SIG_EXP;
@@ -103,7 +103,7 @@ unsigned char *find_pseudoheader(struct dns_header *header, size_t plen, size_t
 size_t add_pseudoheader(struct dns_header *header, size_t plen, unsigned char *limit, 
 			int optno, unsigned char *opt, size_t optlen, int set_do, int replace)
 { 
-  unsigned char *lenp, *datap, *p, *udp_len, *buff = NULL;
+  unsigned char *lenp = NULL, *datap = NULL, *p, *udp_len, *buff = NULL;
  int rdlen = 0, is_sign, is_last;
  unsigned short flags = set_do ? 0x8000 : 0, rcode = 0;

@@ -135,9 +135,9 @@ static void log_query_mysockaddr(unsigned int flags, char *name, union mysockadd
 }

 static void server_send(struct server *server, int fd,
-			const void *header, size_t plen, int flags)
+			const void *header, size_t plen)
 {
-  while (retry_send(sendto(fd, header, plen, flags,
+  while (retry_send(sendto(fd, header, plen, 0,
 			   &server->addr.sa,
 			   sa_len(&server->addr))));
 }
@@ -960,7 +960,7 @@ static void dnssec_validate(struct frec *forward, struct dns_header *header,
 	    status = dnssec_validate_ds(now, header, plen, daemon->namebuff, daemon->keyname, forward->class, &orig->validate_counter);
 	  else
 	    status = dnssec_validate_reply(now, header, plen, daemon->namebuff, daemon->keyname, &forward->class, 
-					   !option_bool(OPT_DNSSEC_IGN_NS), NULL, NULL, NULL, &orig->validate_counter);
+					   !option_bool(OPT_DNSSEC_IGN_NS), NULL, NULL, NULL, NULL, &orig->validate_counter);
 	  
 	  if (STAT_ISEQUAL(status, STAT_ABANDONED))
 	    log_resource = 1;
@@ -1074,7 +1074,7 @@ static void dnssec_validate(struct frec *forward, struct dns_header *header,
 		    set_outgoing_mark(orig, fd);
 #endif

-		  server_send(server, fd, header, nn, 0);
+		  server_send(server, fd, header, nn);
 		  server->queries++;
 #ifdef HAVE_DUMPFILE
 		  dump_packet_udp(DUMP_SEC_QUERY, (void *)header, (size_t)nn, NULL, &server->addr, fd);
@@ -1399,6 +1399,9 @@ void return_reply(time_t now, struct frec *forward, struct dns_header *header, s
      
 	  a.log.ede = ede;
 	  log_query(F_SECSTAT, domain, &a, result, 0);
+
+	  if (ede == EDE_US_SERVFAIL)
+	    ede = EDE_DNSSEC_BOGUS;
 	}
    }
  
@@ -2015,20 +2018,21 @@ void receive_query(struct listener *listen, time_t now)
 }

 
-/* Send query in packet, qsize to a server determined by first,last,start and
-   get the reply. return reply size. */
-static ssize_t tcp_talk(int first, int last, int start, unsigned char *packet,  size_t qsize,
-			int have_mark, unsigned int mark, struct server **servp)
+/* Send query in header, qsize to a server determined by first,last,start and
+   get the reply into the buffer passed by outbuff. Return reply size. */
+static ssize_t tcp_talk(int first, int last, int start, struct dns_header *header, size_t qsize,
+			struct iovec *recvbuff, int have_mark, unsigned int mark, struct server **servp)
 {
  int firstsendto = -1;
-  u16 *length = (u16 *)packet;
-  unsigned char *payload = &packet[2];
-  struct dns_header *header = (struct dns_header *)payload;
-  unsigned int rsize;
+  u16 length;
+  unsigned int rsize = 0;
  int class, rclass, type, rtype;
  unsigned char *p;
-  struct blockdata *saved_question;
  struct timeval tv;
+  struct iovec sendio[2];
+#ifdef MSG_FASTOPEN
+  struct msghdr msg;
+#endif
  
  (void)mark;
  (void)have_mark;
@@ -2040,10 +2044,12 @@ static ssize_t tcp_talk(int first, int last, int start, unsigned char *packet,
  GETSHORT(type, p); 
  GETSHORT(class, p);

-  /* Save question for retry. */
-  if (!(saved_question = blockdata_alloc((char *)header, (size_t)qsize)))
-    return 0;
-  
+  length = htons(qsize);
+  sendio[0].iov_base = &length;
+  sendio[0].iov_len = sizeof(length);
+  sendio[1].iov_base = header;
+  sendio[1].iov_len = qsize;
+
  while (1) 
    {
      int data_sent = 0, fatal = 0;
@@ -2065,10 +2071,6 @@ static ssize_t tcp_talk(int first, int last, int start, unsigned char *packet,
      *servp = serv = daemon->serverarray[start];
      
    retry:
-      blockdata_retrieve(saved_question, qsize, header);
-      
-      *length = htons(qsize);
-      
      if (serv->tcpfd == -1)
 	{
 	  if ((serv->tcpfd = socket(serv->addr.sa.sa_family, SOCK_STREAM, 0)) == -1)
@@ -2099,10 +2101,17 @@ static ssize_t tcp_talk(int first, int last, int start, unsigned char *packet,
 	  tv.tv_sec += TCP_TIMEOUT;
 	  setsockopt(serv->tcpfd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof(tv));
 #endif
-	  
 #ifdef MSG_FASTOPEN
-	  server_send(serv, serv->tcpfd, packet, qsize + sizeof(u16), MSG_FASTOPEN);
-	  
+	  msg.msg_name = &serv->addr.sa;
+	  msg.msg_namelen = sa_len(&serv->addr);
+	  msg.msg_iov = sendio;
+	  msg.msg_iovlen = 2;
+	  msg.msg_control = NULL;
+	  msg.msg_controllen = 0;
+	  msg.msg_flags = 0;
+
+	  while (retry_send(sendmsg(serv->tcpfd, &msg, MSG_FASTOPEN)));
+
 	  if (errno == 0)
 	    data_sent = 1;
 	  else if (errno == ETIMEDOUT || errno == EHOSTUNREACH || errno == EINPROGRESS || errno == ECONNREFUSED)
@@ -2128,12 +2137,13 @@ static ssize_t tcp_talk(int first, int last, int start, unsigned char *packet,
 	  serv->flags &= ~SERV_GOT_TCP;
 	}
      
-      /* We us the _ONCE veriant of read_write() here because we've set a timeout on the tcp socket
+      /* We use the _ONCE variant of read_write() here because we've set a timeout on the tcp socket
 	 and wish to abort if the whole data is not read/written within the timeout. */      
-      if ((!data_sent && !read_write(serv->tcpfd, (unsigned char *)packet, qsize + sizeof(u16), RW_WRITE_ONCE)) ||
-	  !read_write(serv->tcpfd, (unsigned char *)length, sizeof (*length), RW_READ_ONCE) ||
-	  !read_write(serv->tcpfd, payload, (rsize = ntohs(*length)), RW_READ_ONCE))
-	{
+      if ((!data_sent && !read_writev(serv->tcpfd, sendio, 2, RW_WRITE_ONCE)) ||
+	  !read_write(serv->tcpfd, (unsigned char *)&length, sizeof(length), RW_READ_ONCE) ||
+	  !expand_buf(recvbuff, (rsize = ntohs(length))) ||
+	  !read_write(serv->tcpfd, recvbuff->iov_base, rsize, RW_READ_ONCE))
+      {
 	  /* We get data then EOF, reopen connection to same server,
 	     else try next. This avoids DoS from a server which accepts
 	     connections and then closes them. */
@@ -2146,28 +2156,28 @@ static ssize_t tcp_talk(int first, int last, int start, unsigned char *packet,
 	  else
 	    goto failed;
 	}
+      else
+	{
+	  /* If the question section of the reply doesn't match the question we sent, then
+	     someone might be attempting to insert bogus values into the cache by 
+	     sending replies containing questions and bogus answers.
+	     Try another server, or give up */
+	  p = (unsigned char *)(((struct dns_header *)recvbuff->iov_base)+1);
+	  if (extract_name(((struct dns_header *)recvbuff->iov_base), rsize, &p, daemon->namebuff, EXTR_NAME_COMPARE, 4) != 1)
+	    continue;
+	  GETSHORT(rtype, p); 
+	  GETSHORT(rclass, p);
      
-      /* If the question section of the reply doesn't match the question we sent, then
-	 someone might be attempting to insert bogus values into the cache by 
-	 sending replies containing questions and bogus answers.
-	 Try another server, or give up */
-      p = (unsigned char *)(header+1);
-      if (extract_name(header, rsize, &p, daemon->namebuff, EXTR_NAME_COMPARE, 4) != 1)
-	continue;
-      GETSHORT(rtype, p); 
-      GETSHORT(rclass, p);
-      
-      if (type != rtype || class != rclass)
-	continue;
+	  if (type != rtype || class != rclass)
+	    continue;
+	}
      
      serv->flags |= SERV_GOT_TCP;
      
      *servp = serv;
-      blockdata_free(saved_question);
      return rsize;
    }
  
-  blockdata_free(saved_question);
  return 0;
 }
 		  
@@ -2179,19 +2189,16 @@ int tcp_from_udp(time_t now, int status, struct dns_header *header, ssize_t *ple
 		 int class, char *name, struct server *server, 
 		 int *keycount, int *validatecount)
 {
-  unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
-  struct dns_header *new_header = (struct dns_header *)&packet[2];
  int start, first, last, new_status;
  ssize_t n = *plenp;
  int log_save = daemon->log_display_id;
+  struct iovec recvbuff;
+
+  recvbuff.iov_len = 0;
+  recvbuff.iov_base = NULL;
  
  *plenp = 0;
  
-  if (!packet)
-    return STAT_ABANDONED;
-
-  memcpy(new_header, header, n);
-
  /* Set TCP flag in logs. */
  daemon->log_display_id = -daemon->log_display_id;

@@ -2209,10 +2216,11 @@ int tcp_from_udp(time_t now, int status, struct dns_header *header, ssize_t *ple
 	log_query_mysockaddr(F_NOEXTRA | F_DNSSEC | F_SERVER, name, &server->addr,
 			     STAT_ISEQUAL(status, STAT_NEED_KEY) ? "dnssec-query[DNSKEY]" : "dnssec-query[DS]", 0);

-      if ((n = tcp_talk(first, last, start, packet, n, 0, 0, &server)) == 0)
+      if ((n = tcp_talk(first, last, start, header, n, &recvbuff, 0, 0, &server)) == 0)
 	new_status = STAT_ABANDONED;
      else
 	{
+	  struct dns_header *new_header = (struct dns_header *)recvbuff.iov_base;
 	  new_status = tcp_key_recurse(now, status, new_header, n, class, daemon->namebuff, daemon->keyname, server, 0, 0, keycount, validatecount);
 	  
 	  if (STAT_ISEQUAL(status, STAT_OK))
@@ -2223,7 +2231,7 @@ int tcp_from_udp(time_t now, int status, struct dns_header *header, ssize_t *ple
 	      
 	      if (n >= daemon->edns_pktsz)
 		{
-		  /* still too bIg, strip optional sections and try again. */
+		  /* still too big, strip optional sections and try again. */
 		  new_header->nscount = htons(0);
 		  new_header->arcount = htons(0);
 		  n = resize_packet(new_header, n, NULL, 0);
@@ -2237,6 +2245,10 @@ int tcp_from_udp(time_t now, int status, struct dns_header *header, ssize_t *ple
 		    }
 		}
 	      
+	      /* we have succeeded and are no longer blocked talking
+		 on a TCP connection, so if the watchdog alarm goes off,
+		 ignore it. */
+	      daemon->forward_to_tcp = NULL;
 	      /* return the stripped or truncated reply. */
 	      memcpy(header, new_header, n);
 	      *plenp = n;
@@ -2245,7 +2257,7 @@ int tcp_from_udp(time_t now, int status, struct dns_header *header, ssize_t *ple
    }
  
  daemon->log_display_id = log_save;
-  free(packet);
+  free(recvbuff.iov_base);
  return new_status;
 }			    
 
@@ -2255,9 +2267,12 @@ static int tcp_key_recurse(time_t now, int status, struct dns_header *header, si
 			   int have_mark, unsigned int mark, int *keycount, int *validatecount)
 {
  int first, last, start, new_status;
-  unsigned char *packet = NULL;
-  struct dns_header *new_header = NULL;
+  struct iovec new_packet;
+  struct dns_header *query_header = NULL, *new_header;

+  new_packet.iov_base = NULL;
+  new_packet.iov_len = 0;
+  
  while (1)
    {
      size_t m;
@@ -2270,7 +2285,7 @@ static int tcp_key_recurse(time_t now, int status, struct dns_header *header, si
 	new_status = dnssec_validate_ds(now, header, n, name, keyname, class, validatecount);
      else
 	new_status = dnssec_validate_reply(now, header, n, name, keyname, &class,
-					   !option_bool(OPT_DNSSEC_IGN_NS), NULL, NULL, NULL, validatecount);
+					   !option_bool(OPT_DNSSEC_IGN_NS), NULL, NULL, NULL, NULL, validatecount);
      
      if (!STAT_ISEQUAL(new_status, STAT_NEED_DS) && !STAT_ISEQUAL(new_status, STAT_NEED_KEY) && !STAT_ISEQUAL(new_status, STAT_ABANDONED))
 	break;
@@ -2291,34 +2306,21 @@ static int tcp_key_recurse(time_t now, int status, struct dns_header *header, si
 	}
      
      /* Can't validate because we need a key/DS whose name now in keyname.
-	 Make query for same, and recurse to validate */
-      if (!packet)
-	{
-	  packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
-	  new_header = (struct dns_header *)&packet[2];
-	}
-      
-      if (!packet)
-	{
-	  new_status = STAT_ABANDONED;
-	  break;
-	}
-      
-      m = dnssec_generate_query(new_header, ((unsigned char *) new_header) + 65536, keyname, class, 0,
+	 Make query for same in UDP packet buffer, recurse to validate*/
+      query_header = (struct dns_header *)daemon->packet;
+      daemon->srv_save = NULL;
+
+      m = dnssec_generate_query(query_header, ((unsigned char *)query_header) + daemon->edns_pktsz, keyname, class, 0,
 				STAT_ISEQUAL(new_status, STAT_NEED_KEY) ? T_DNSKEY : T_DS);
      
-      if ((start = dnssec_server(server, keyname, STAT_ISEQUAL(new_status, STAT_NEED_DS), &first, &last)) == -1)
+      if ((start = dnssec_server(server, keyname, STAT_ISEQUAL(new_status, STAT_NEED_DS), &first, &last)) == -1 ||
+	  (m = tcp_talk(first, last, start, query_header, m, &new_packet, have_mark, mark, &server)) == 0)
 	{
 	  new_status = STAT_ABANDONED;
 	  break;
 	}
      
-      if ((m = tcp_talk(first, last, start, packet, m, have_mark, mark, &server)) == 0)
-	{
-	  new_status = STAT_ABANDONED;
-	  break;
-	}
-
+      new_header = new_packet.iov_base;
      log_save = daemon->log_display_id;
      daemon->log_display_id = -(++daemon->log_id);
      
@@ -2335,8 +2337,7 @@ static int tcp_key_recurse(time_t now, int status, struct dns_header *header, si
 	break; 
    }
  
-  if (packet)
-    free(packet);
+  free(new_packet.iov_base);
  
  return new_status;
 }
@@ -2346,11 +2347,11 @@ static int tcp_key_recurse(time_t now, int status, struct dns_header *header, si
 /* The daemon forks before calling this: it should deal with one connection,
   blocking as necessary, and then return. Note, need to be a bit careful
   about resources for debug mode, when the fork is suppressed: that's
-   done by the caller. */
-unsigned char *tcp_request(int confd, time_t now,
-			   union mysockaddr *local_addr, struct in_addr netmask, int auth_dns)
+   done by the caller, which also frees bigbuff. */
+void tcp_request(int confd, time_t now, struct iovec *bigbuff, 
+		 union mysockaddr *local_addr, struct in_addr netmask, int auth_dns)
 {
-  size_t size = 0, saved_size = 0;
+  size_t size = 0;
  int norebind = 0;
 #ifdef HAVE_CONNTRACK
  int allowed = 1;
@@ -2359,16 +2360,10 @@ unsigned char *tcp_request(int confd, time_t now,
  int local_auth = 0;
 #endif
  int checking_disabled, do_bit = 0, ad_reqd = 0, have_pseudoheader = 0;
-  struct blockdata *saved_question = NULL;
  unsigned short qtype;
  unsigned int gotname = 0;
-  /* Max TCP packet + slop + size */
-  unsigned char *packet = whine_malloc(65536 + MAXDNAME + RRFIXEDSZ + sizeof(u16));
-  unsigned char *payload = &packet[2];
-  u16 tcp_len;
-  /* largest field in header is 16-bits, so this is still sufficiently aligned */
-  struct dns_header *header = (struct dns_header *)payload;
-  u16 *length = (u16 *)packet;
+  u16 tcp_len, out_len;
+  struct dns_header *header, *out_header;
  struct server *serv;
  struct in_addr dst_addr_4;
  union mysockaddr peer_addr;
@@ -2378,9 +2373,13 @@ unsigned char *tcp_request(int confd, time_t now,
  unsigned int mark = 0;
  int have_mark = 0;
  int first, last, filtered, do_stale = 0;
-      
-  if (!packet || getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1)
-    return packet;
+  struct iovec out_iov[2];
+  
+  bigbuff->iov_base = NULL;
+  bigbuff->iov_len = 0;
+  
+  if (getpeername(confd, (struct sockaddr *)&peer_addr, &peer_len) == -1)
+    return;

 #ifdef HAVE_CONNTRACK
  /* Get connection mark of incoming query to set on outgoing connections. */
@@ -2401,7 +2400,7 @@ unsigned char *tcp_request(int confd, time_t now,
  if (option_bool(OPT_LOCAL_SERVICE))
    {
      struct addrlist *addr;
-
+      
      if (peer_addr.sa.sa_family == AF_INET6) 
 	{
 	  for (addr = daemon->interface_addrs; addr; addr = addr->next)
@@ -2424,7 +2423,7 @@ unsigned char *tcp_request(int confd, time_t now,
 	{
 	  prettyprint_addr(&peer_addr, daemon->addrbuff);
 	  my_syslog(LOG_WARNING, _("ignoring query from non-local network %s"), daemon->addrbuff);
-	  return packet;
+	  return;
 	}
    }

@@ -2442,18 +2441,26 @@ unsigned char *tcp_request(int confd, time_t now,
 	  if (query_count >= TCP_MAX_QUERIES)
 	    break;
 	  
+	  /* Now get the query into the normal UDP packet buffer.
+	     Ignore queries long than this. If we're answering locally,
+	     copy the query into the output buffer, but for forwarding, tcp_talk()
+	     wants the query in a a different buffer from the reply.
+	     Note that we overwrote any saved UDP query - this onlt matters in debug mode. */
+	  daemon->srv_save = NULL;
 	  if (!read_write(confd, (unsigned char *)&tcp_len, sizeof(tcp_len), RW_READ) ||
-	      !(size = ntohs(tcp_len)) ||
-	      !read_write(confd, payload, size, RW_READ))
+	      !(size = ntohs(tcp_len)) || size > (size_t)daemon->packet_buff_sz ||
+	      !read_write(confd, (unsigned char *)daemon->packet, size, RW_READ))
 	    break;
-	      
+	  
 	  if (size < (int)sizeof(struct dns_header))
 	    continue;
 	  
-	  /* Clear buffer beyond request to avoid risk of
-	     information disclosure. */
-	  memset(payload + size, 0, 65536 - size);
+	  /* Make sure we have a buffer big enough for the largest answer. */
+	  expand_buf(bigbuff, 65536 + MAXDNAME + RRFIXEDSZ);
+	  out_header = bigbuff->iov_base;
 	  
+	  /* header == query */
+	  header = (struct dns_header *)daemon->packet;
 	  query_count++;
 	  
 	  /* log_query gets called indirectly all over the place, so 
@@ -2472,9 +2479,6 @@ unsigned char *tcp_request(int confd, time_t now,
 	    ede = EDE_INVALID_DATA;
 	  else
 	    {
-	      if (saved_question)
-		blockdata_free(saved_question);
-
 	      do_bit = 0;
 	      
 	      if (find_pseudoheader(header, (size_t)size, NULL, &pheader, NULL, NULL))
@@ -2489,9 +2493,12 @@ unsigned char *tcp_request(int confd, time_t now,
 		    do_bit = 1; /* do bit */ 
 		}

-	      size = add_edns0_config(header, size, ((unsigned char *) header) + 65536, &peer_addr, now, &cacheable);
-	      saved_question = blockdata_alloc((char *)header, (size_t)size);
-	      saved_size = size;
+	      size = add_edns0_config(header, size, ((unsigned char *) header) + daemon->edns_pktsz, &peer_addr, now, &cacheable);
+
+	      /* Clear buffer to avoid risk of information disclosure. */
+	      memset(bigbuff->iov_base, 0, bigbuff->iov_len);
+	      /* Copy query into output buffer for local answering */
+	      memcpy(out_header, header, size);	    
 	      
 	      log_query_mysockaddr((auth_dns ? F_NOERR | F_AUTH : 0) | F_QUERY | F_FORWARD, daemon->namebuff,
 				   &peer_addr, NULL, qtype);
@@ -2550,10 +2557,10 @@ unsigned char *tcp_request(int confd, time_t now,
 #endif
 #ifdef HAVE_AUTH
 	      else if (auth_dns)
-		m = answer_auth(header, ((char *) header) + 65536, (size_t)size, now, &peer_addr, local_auth);
+		m = answer_auth(out_header, ((char *) out_header) + 65536, (size_t)size, now, &peer_addr, local_auth);
 #endif
 	      else
-		m = answer_request(header, ((char *) header) + 65536, (size_t)size, 
+		m = answer_request(out_header, ((char *) out_header) + 65536, (size_t)size, 
 				   dst_addr_4, netmask, now, ad_reqd, do_bit, !cacheable, &stale, &filtered);
 	    }
 	}
@@ -2561,15 +2568,12 @@ unsigned char *tcp_request(int confd, time_t now,
      /* Do this by steam now we're not in the select() loop */
      check_log_writer(1); 
      
-      if (m == 0 && ede == EDE_UNSET && saved_question)
+      if (m == 0 && ede == EDE_UNSET)
 	{
 	  struct server *master;
 	  int start;
 	  int no_cache_dnssec = 0, cache_secure = 0, bogusanswer = 0;

-	  blockdata_retrieve(saved_question, (size_t)saved_size, header);
-	  size = saved_size;
-
 	  /* save state of "cd" flag in query */
 	  checking_disabled = header->hb4 & HB4_CD;
 	  
@@ -2598,7 +2602,7 @@ unsigned char *tcp_request(int confd, time_t now,
 #ifdef HAVE_DNSSEC
 		  if (option_bool(OPT_DNSSEC_VALID))
 		    {
-		      size = add_do_bit(header, size, ((unsigned char *) header) + 65536);
+		      size = add_do_bit(header, size, ((unsigned char *) header) + daemon->edns_pktsz);
 		      
 		      /* For debugging, set Checking Disabled, otherwise, have the upstream check too,
 			 this allows it to select auth servers when one is returning bad data. */
@@ -2608,12 +2612,14 @@ unsigned char *tcp_request(int confd, time_t now,
 #endif
 		  
 		  /* Loop round available servers until we succeed in connecting to one. */
-		  if ((m = tcp_talk(first, last, start, packet, size, have_mark, mark, &serv)) == 0)
+		  if ((m = tcp_talk(first, last, start, header, size, bigbuff, have_mark, mark, &serv)) == 0)
 		    ede = EDE_NETERR;
 		  else
 		    {
+		      /* just in case tcp_talk() expanded buffer - should never happen */
+		      out_header = bigbuff->iov_base;
 		      /* get query name again for logging - may have been overwritten */
-		      if (!extract_name(header, (unsigned int)size, NULL, daemon->namebuff, EXTR_NAME_EXTRACT, 0))
+		      if (!extract_name(out_header, (unsigned int)size, NULL, daemon->namebuff, EXTR_NAME_EXTRACT, 0))
 			strcpy(daemon->namebuff, "query");
 		      log_query_mysockaddr(F_SERVER | F_FORWARD, daemon->namebuff, &serv->addr, NULL, 0);
 		      
@@ -2629,7 +2635,8 @@ unsigned char *tcp_request(int confd, time_t now,
 			    {
 			      int keycount = daemon->limit[LIMIT_WORK]; /* Limit to number of DNSSEC questions, to catch loops and avoid filling cache. */
 			      int validatecount = daemon->limit[LIMIT_CRYPTO]; 
-			      int status = tcp_key_recurse(now, STAT_OK, header, m, 0, daemon->namebuff, daemon->keyname, 
+			      /* tcp_key_recurse() may overwrite packetbuf, and thuse *header is now invalid */
+			      int status = tcp_key_recurse(now, STAT_OK, out_header, m, 0, daemon->namebuff, daemon->keyname, 
 							   serv, have_mark, mark, &keycount, &validatecount);
 			      char *result, *domain = "result";
 			      
@@ -2655,12 +2662,14 @@ unsigned char *tcp_request(int confd, time_t now,
 				  no_cache_dnssec = 1;
 				  bogusanswer = 1;
 				  
-				  if (extract_name(header, m, NULL, daemon->namebuff, EXTR_NAME_EXTRACT, 0))
+				  if (extract_name(out_header, m, NULL, daemon->namebuff, EXTR_NAME_EXTRACT, 0))
 				    domain = daemon->namebuff;
 				}
 			      
 			      a.log.ede = ede;
 			      log_query(F_SECSTAT, domain, &a, result, 0);
+			      if (ede == EDE_US_SERVFAIL)
+				ede = EDE_DNSSEC_BOGUS;
 			      
 			      if ((daemon->limit[LIMIT_CRYPTO] - validatecount) > (int)daemon->metrics[METRIC_CRYPTO_HWM])
 				daemon->metrics[METRIC_CRYPTO_HWM] = daemon->limit[LIMIT_CRYPTO] - validatecount;
@@ -2677,18 +2686,18 @@ unsigned char *tcp_request(int confd, time_t now,
 		    
 		      /* restore CD bit to the value in the query */
 		      if (checking_disabled)
-			header->hb4 |= HB4_CD;
+			out_header->hb4 |= HB4_CD;
 		      else
-			header->hb4 &= ~HB4_CD;
+			out_header->hb4 &= ~HB4_CD;
 		      
 		      /* Never cache answers which are contingent on the source or MAC address EDSN0 option,
 			 since the cache is ignorant of such things. */
 		      if (!cacheable)
 			no_cache_dnssec = 1;
 		      
-		      m = process_reply(header, now, serv, (unsigned int)m, 
+		      m = process_reply(out_header, now, serv, (unsigned int)m, 
 					option_bool(OPT_NO_REBIND) && !norebind, no_cache_dnssec, cache_secure, bogusanswer,
-					ad_reqd, do_bit, !have_pseudoheader, &peer_addr, ((unsigned char *)header) + 65536, ede);
+					ad_reqd, do_bit, !have_pseudoheader, &peer_addr, ((unsigned char *)out_header) + 65536, ede);

 		      /* process_reply() adds pheader itself */
 		      have_pseudoheader = 0; 
@@ -2703,8 +2712,8 @@ unsigned char *tcp_request(int confd, time_t now,
      /* In case of local answer or no connections made. */
      if (m == 0)
 	{
-	  if (!(m = make_local_answer(flags, gotname, size, header, daemon->namebuff,
-				      ((char *) header) + 65536, first, last, ede)))
+	  if (!(m = make_local_answer(flags, gotname, size, out_header, daemon->namebuff,
+				      ((char *) out_header) + 65536, first, last, ede)))
 	    break;
 	}
      else if (ede == EDE_UNSET)
@@ -2720,14 +2729,12 @@ unsigned char *tcp_request(int confd, time_t now,
 	  u16 swap = htons((u16)ede);
 	  
 	  if (ede != EDE_UNSET)
-	    m = add_pseudoheader(header, m, ((unsigned char *) header) + 65536, EDNS0_OPTION_EDE, (unsigned char *)&swap, 2, do_bit, 0);
+	    m = add_pseudoheader(out_header, m, ((unsigned char *) out_header) + 65536, EDNS0_OPTION_EDE, (unsigned char *)&swap, 2, do_bit, 0);
 	  else
-	    m = add_pseudoheader(header, m, ((unsigned char *) header) + 65536, 0, NULL, 0, do_bit, 0);
+	    m = add_pseudoheader(out_header, m, ((unsigned char *) out_header) + 65536, 0, NULL, 0, do_bit, 0);
 	}
-		  
-      check_log_writer(1);
      
-      *length = htons(m);
+      check_log_writer(1);
      
 #if defined(HAVE_CONNTRACK) && defined(HAVE_UBUS)
 #ifdef HAVE_AUTH
@@ -2737,7 +2744,13 @@ unsigned char *tcp_request(int confd, time_t now,
 	  report_addresses(header, m, mark);
 #endif
      
-      if (!read_write(confd, packet, m + sizeof(u16), RW_WRITE))
+      /* use scatter-gather IO so that length doesn't end up in separate packet. */
+      out_len = htons(m);
+      out_iov[0].iov_len = sizeof(out_len);
+      out_iov[0].iov_base = &out_len;
+      out_iov[1].iov_len = m;
+      out_iov[1].iov_base = bigbuff->iov_base;
+      if (!read_writev(confd, out_iov, 2, RW_WRITE))
 	break;
      
      /* If we answered with stale data, this process will now try and get fresh data into
@@ -2753,18 +2766,15 @@ unsigned char *tcp_request(int confd, time_t now,
 	  daemon->log_source_addr = NULL;
 	}
    }
-
-  /* If we ran once to get fresh data, confd is already closed. */
+  
+/* If we ran once to get fresh data, confd is already closed. */
  if (!do_stale)
    {
      shutdown(confd, SHUT_RDWR);
      close(confd);
    }
-
-  blockdata_free(saved_question);
+  
  check_log_writer(1);
-
-  return packet;
 }

 /* return a UDP socket bound to a random port, have to cope with straying into
@@ -3265,7 +3275,7 @@ void resend_query(void)
 {
  if (daemon->srv_save)
    server_send(daemon->srv_save, daemon->fd_save,
-		daemon->packet, daemon->packet_len, 0);
+		daemon->packet, daemon->packet_len);
 }

 /* A server record is going away, remove references to it */
@@ -23,6 +23,9 @@ static volatile int mem_recover = 0;
 static jmp_buf mem_jmp;
 static int one_file(char *file, int hard_opt);

+static void *opt_malloc_real(const char *func, unsigned int line, size_t size);
+#define opt_malloc(x) opt_malloc_real(__func__, __LINE__, (x))
+
 /* Solaris headers don't have facility names. */
 #ifdef HAVE_SOLARIS_NETWORK
 static const struct {
@@ -197,6 +200,7 @@ struct myoption {
 #define LOPT_DO_ENCODE     388
 #define LOPT_LEASEQUERY    389
 #define LOPT_SPLIT_RELAY   390
+#define LOPT_LOG_MALLOC    391

 #ifdef HAVE_GETOPT_LONG
 static const struct option opts[] =  
@@ -398,6 +402,7 @@ static const struct myoption opts[] =
    { "no-ident", 0, 0, LOPT_NO_IDENT },
    { "max-tcp-connections", 1, 0, LOPT_MAX_PROCS },
    { "leasequery", 2, 0, LOPT_LEASEQUERY },
+    { "log-malloc", 0, 0, LOPT_LOG_MALLOC },
    { NULL, 0, 0, 0 }
  };

@@ -606,6 +611,7 @@ static struct {
  { LOPT_NO_IDENT, OPT_NO_IDENT, NULL, gettext_noop("Do not add CHAOS TXT records."), NULL },
  { LOPT_CACHE_RR, ARG_DUP, "<RR-type>", gettext_noop("Cache this DNS resource record type."), NULL },
  { LOPT_MAX_PROCS, ARG_ONE, "<integer>", gettext_noop("Maximum number of concurrent tcp connections."), NULL },
+  { LOPT_LOG_MALLOC, OPT_LOG_MALLOC, NULL, gettext_noop("Log memory allocation for debugging."), NULL },
  { 0, 0, NULL, NULL, NULL }
 }; 

@@ -652,13 +658,13 @@ static void unhide_metas(char *cp)
      *cp = unhide_meta(*cp);
 }

-static void *opt_malloc(size_t size)
+static void *opt_malloc_real(const char *func, unsigned int line, size_t size)
 {
  void *ret;

  if (mem_recover)
    {
-      ret = whine_malloc(size);
+      ret = whine_malloc_real(func, line, size);
      if (!ret)
 	longjmp(mem_jmp, 1);
    }
@@ -3463,6 +3469,8 @@ static int one_opt(int option, char *arg, char *errstr, char *gen_err, int comma
 	    }
 	  else if (strcmp(arg, "auth") == 0)
 	    set_option_bool(OPT_AUTH_LOG);
+	  else if (strcmp(arg, "only_failed") == 0)
+	    set_option_bool(OPT_LOG_ONLY_FAILED);
 	}
      break;

@@ -5729,7 +5737,7 @@ struct hostsfile *expand_filelist(struct hostsfile *list)
  struct dirent **namelist;

  /* find largest used index */
-  for (i = SRC_AH, ah = list; ah; ah = ah->next)
+  for (last = NULL, i = SRC_AH, ah = list; ah; ah = ah->next)
    {
      last = ah;
      
@@ -21,7 +21,7 @@

 struct state {
  unsigned char *clid;
-  int multicast_dest, clid_len, ia_type, interface, hostname_auth, lease_allocate;
+  int clid_len, ia_type, interface, hostname_auth, lease_allocate;
  char *client_hostname, *hostname, *domain, *send_domain;
  struct dhcp_context *context;
  struct in6_addr *link_address, *fallback, *ll_addr, *ula_addr;
@@ -34,8 +34,8 @@ struct state {
 };

 static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz, 
-			     struct in6_addr *client_addr, int is_unicast, time_t now);
-static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now);
+			     struct in6_addr *client_addr, time_t now);
+static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, time_t now);
 static void log6_opts(int nest, unsigned int xid, void *start_opts, void *end_opts);
 static void log6_packet(struct state *state, char *type, struct in6_addr *addr, char *string);
 static void log6_quiet(struct state *state, char *type, struct in6_addr *addr, char *string);
@@ -80,6 +80,10 @@ unsigned short dhcp6_reply(struct dhcp_context *context, int multicast_dest, int
    return 0;
  
  msg_type = *((unsigned char *)daemon->dhcp_packet.iov_base);
+
+  /* request from a client must be multicast RFC-9915 section 16 */
+  if (msg_type != DHCP6RELAYFORW && !multicast_dest)
+    return 0;
  
  /* Mark these so we only match each at most once, to avoid tangled linked lists */
  for (vendor = daemon->dhcp_vendors; vendor; vendor = vendor->next)
@@ -87,7 +91,6 @@ unsigned short dhcp6_reply(struct dhcp_context *context, int multicast_dest, int
  
  reset_counter();
  state.context = context;
-  state.multicast_dest = multicast_dest;
  state.interface = interface;
  state.iface_name = iface_name;
  state.fallback = fallback;
@@ -97,8 +100,7 @@ unsigned short dhcp6_reply(struct dhcp_context *context, int multicast_dest, int
  state.tags = NULL;
  state.link_address = NULL;

-  if (dhcp6_maybe_relay(&state, daemon->dhcp_packet.iov_base, sz, client_addr, 
-			IN6_IS_ADDR_MULTICAST(client_addr), now))
+  if (dhcp6_maybe_relay(&state, daemon->dhcp_packet.iov_base, sz, client_addr, now))
    return msg_type == DHCP6RELAYFORW ? DHCPV6_SERVER_PORT : DHCPV6_CLIENT_PORT;

  return 0;
@@ -106,7 +108,7 @@ unsigned short dhcp6_reply(struct dhcp_context *context, int multicast_dest, int

 /* This cost me blood to write, it will probably cost you blood to understand - srk. */
 static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t sz, 
-			     struct in6_addr *client_addr, int is_unicast, time_t now)
+			     struct in6_addr *client_addr, time_t now)
 {
  uint8_t *end = inbuff + sz;
  uint8_t *opts = inbuff + 34;
@@ -184,7 +186,7 @@ static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t
 	  return 0;
 	}

-      return dhcp6_no_relay(state, msg_type, inbuff, sz, is_unicast, now);
+      return dhcp6_no_relay(state, msg_type, inbuff, sz, now);
    }

  /* must have at least msg_type+hopcount+link_address+peer_address+minimal size option
@@ -250,9 +252,7 @@ static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t
 	      /* RFC6221 para 4 */
 	      if (!IN6_IS_ADDR_UNSPECIFIED(&align))
 		state->link_address = &align;
-	      /* zero is_unicast since that is now known to refer to the 
-		 relayed packet, not the original sent by the client */
-	      if (!dhcp6_maybe_relay(state, opt6_ptr(opt, 0), opt6_len(opt), client_addr, 0, now))
+	      if (!dhcp6_maybe_relay(state, opt6_ptr(opt, 0), opt6_len(opt), client_addr, now))
 		return 0;
 	    }
 	  else
@@ -264,7 +264,7 @@ static int dhcp6_maybe_relay(struct state *state, unsigned char *inbuff, size_t
  return 1;
 }

-static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, int is_unicast, time_t now)
+static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbuff, size_t sz, time_t now)
 {
  void *opt;
  int i, o, o1, start_opts, start_msg;
@@ -340,22 +340,17 @@ static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbu

  opt = opt6_find(state->packet_options, state->end, OPTION6_SERVER_ID, 1);
  
-  if (msg_type == DHCP6SOLICIT || msg_type == DHCP6CONFIRM || msg_type == DHCP6REBIND || msg_type == DHCP6IREQ)
+  if (msg_type == DHCP6SOLICIT || msg_type == DHCP6CONFIRM || msg_type == DHCP6REBIND)
    {
-      /* Above message types must be multicast 3315 Section 15. */
-      if (!state->multicast_dest)
+      /* SOLICIT, CONFIRM and REBIND messages MUST NOT have a server-id.  3315 para 15.x */
+      if (opt) 
 	return 0;
-
-      /* server-id must match except for SOLICIT, CONFIRM and REBIND messages, which MUST NOT
-	 have a server-id.  3315 para 15.x */
-      if (msg_type == DHCP6IREQ)
-	{
-	  /* If server-id provided in IREQ, it must match. */
-	  if (opt && (opt6_len(opt) != daemon->duid_len ||
-		      memcmp(opt6_ptr(opt, 0), daemon->duid, daemon->duid_len) != 0))
-	    return 0;
-	}
-      else if (opt) 
+    }
+  else if (msg_type == DHCP6IREQ)
+    {
+      /* If server-id provided in IREQ, it must match. */
+      if (opt && (opt6_len(opt) != daemon->duid_len ||
+		  memcmp(opt6_ptr(opt, 0), daemon->duid, daemon->duid_len) != 0))
 	return 0;
    }
  else
@@ -370,18 +365,6 @@ static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbu
  put_opt6(daemon->duid, daemon->duid_len);
  end_opt6(o);

-  if (is_unicast &&
-      (msg_type == DHCP6REQUEST || msg_type == DHCP6RENEW || msg_type == DHCP6RELEASE || msg_type == DHCP6DECLINE))
-    
-    {  
-      outmsgtype = DHCP6REPLY;
-      o1 = new_opt6(OPTION6_STATUS_CODE);
-      put_opt6_short(DHCP6USEMULTI);
-      put_opt6_string("Use multicast");
-      end_opt6(o1);
-      goto done;
-    }
-
  /* match vendor and user class options */
  for (vendor = daemon->dhcp_vendors; vendor; vendor = vendor->next)
    {
@@ -1304,7 +1287,6 @@ static int dhcp6_no_relay(struct state *state, int msg_type, unsigned char *inbu

  log_tags(tagif, state->xid);

- done:
  /* Fill in the message type. Note that we store the offset,
     not a direct pointer, since the packet memory may have been 
     reallocated. */
@@ -337,27 +337,6 @@ short *rrfilter_desc(int type)
  return p+1;
 }

-int expand_workspace(unsigned char ***wkspc, int *szp, int new)
-{
-  unsigned char **p;
-  int old = *szp;
-
-  if (old >= new+1)
-    return 1;
-
-  new += 5;
-
-  if (!(p = whine_realloc(*wkspc, new * sizeof(unsigned char *))))
-    return 0;
-
-  memset(p+old, 0, new-old);
-  
-  *wkspc = p;
-  *szp = new;
-
-  return 1;
-}
-
 /* Convert from presentation format to wire format, in place.
   Also map UC -> LC.
   Note that using extract_name to get presentation format
@@ -341,26 +341,6 @@ void safe_pipe(int *fd, int read_noblock)
    die(_("cannot create pipe: %s"), NULL, EC_MISC);
 }

-void *whine_malloc(size_t size)
-{
-  void *ret = calloc(1, size);
-
-  if (!ret)
-    my_syslog(LOG_ERR, _("failed to allocate %d bytes"), (int) size);
-  
-  return ret;
-}
-
-void *whine_realloc(void *ptr, size_t size)
-{
-  void *ret = realloc(ptr, size);
-
-  if (!ret)
-    my_syslog(LOG_ERR, _("failed to reallocate %d bytes"), (int) size);
-
-  return ret;
-}
-
 int sockaddr_isequal(const union mysockaddr *s1, const union mysockaddr *s2)
 {
  if (s1->sa.sa_family == s2->sa.sa_family)
@@ -443,8 +423,8 @@ int hostname_issubdomain(char *a, char *b)
  for (ap = a; *ap; ap++); 
  for (bp = b; *bp; bp++);

-  /* a shorter than b or a empty. */
-  if ((bp - b) < (ap - a) || ap == a)
+  /* a shorter than b */
+  if ((ap - a) < (bp - b))
    return 0;

  do
@@ -459,12 +439,12 @@ int hostname_issubdomain(char *a, char *b)

       if (c1 != c2)
 	 return 0;
-    } while (ap != a);
+    } while (bp != b);

-  if (bp == b)
+  if (ap == a)
    return 2;

-  if (*(--bp) == '.')
+  if (*(--ap) == '.')
    return 1;

  return 0;
@@ -692,32 +672,6 @@ int memcmp_masked(unsigned char *a, unsigned char *b, int len, unsigned int mask
  return count;
 }

-/* _note_ may copy buffer */
-int expand_buf(struct iovec *iov, size_t size)
-{
-  void *new;
-
-  if (size <= (size_t)iov->iov_len)
-    return 1;
-
-  if (!(new = whine_malloc(size)))
-    {
-      errno = ENOMEM;
-      return 0;
-    }
-
-  if (iov->iov_base)
-    {
-      memcpy(new, iov->iov_base, iov->iov_len);
-      free(iov->iov_base);
-    }
-
-  iov->iov_base = new;
-  iov->iov_len = size;
-
-  return 1;
-}
-
 char *print_mac(char *buff, unsigned char *mac, int len)
 {
  char *p = buff;
@@ -777,43 +731,60 @@ int retry_send(ssize_t rc)
   "once" fails on EAGAIN, as this a timeout.
   This indicates a timeout of a TCP socket.
 */
-int read_write(int fd, unsigned char *packet, int size, int rw)
+int read_writev(int fd, struct iovec *iov, int iovcnt, int rw)
 {
-  ssize_t n, done;
-  
-  for (done = 0; done < size; done += n)
-    {
-      if (rw & 1)
-	n = read(fd, &packet[done], (size_t)(size - done));
-      else
-	n = write(fd, &packet[done], (size_t)(size - done));
-      
-      if (n == 0)
-	return 0;
+  int cur = 0;
+  ssize_t n, done = 0;

+  while (cur < iovcnt)
+    {
+      iov[cur].iov_len -= done;
+      iov[cur].iov_base =  ((char *)iov[cur].iov_base) + done;
+
+      if (rw & 1)
+	n = readv(fd, &iov[cur], iovcnt - cur);
+      else
+	n = writev(fd, &iov[cur], iovcnt - cur);
+
+      iov[cur].iov_len += done;
+      iov[cur].iov_base = ((char *)iov[cur].iov_base) - done;
+      
      if (n == -1)
 	{
-	  n = 0; /* don't mess with counter when we loop. */
-
 	  if (errno == EINTR || errno == ENOMEM || errno == ENOBUFS)
 	    continue;
-
-	  if (errno == EAGAIN || errno == EWOULDBLOCK)
-	    {
-	      /* "once" variant */
-	      if (rw & 2)
-		return 0;
-
-	      continue;
-	    }
+	  
+	  if (!(rw & 2) && (errno == EAGAIN || errno == EWOULDBLOCK))
+	    continue;

 	  return 0;
 	}
+      
+      if (n == 0 && (rw & 1))
+	return 0;
+      
+      done += n;
+      while (cur < iovcnt && (size_t)done >= iov[cur].iov_len)
+	done -= iov[cur++].iov_len;
    }
          
  return 1;
 }

+int read_write(int fd, unsigned char *packet, int size, int rw)
+{
+  struct iovec iov;
+
+  /* size == 0 is not an error, just a NOOP. */
+  if (size == 0)
+    return 1;
+  
+  iov.iov_len = (size_t)size;
+  iov.iov_base = packet;
+
+  return read_writev(fd, &iov, 1, rw);
+}
+
 /* close all fds except STDIN, STDOUT and STDERR, spare1, spare2 and spare3 */
 void close_fds(long max_fd, int spare1, int spare2, int spare3) 
 {
@@ -949,3 +920,87 @@ int kernel_version(void)
  return version * 256 + (split ? atoi(split) : 0);
 }
 #endif
+
+#define hash_ptr(x) (((unsigned int)(((char *)(x)) - ((char *)NULL))) & 0xffffff)
+
+void *whine_malloc_real(const char *func, unsigned int line, size_t size)
+{
+  void *ret = calloc(1, size);
+  
+  if (!ret)
+    my_syslog(LOG_ERR, _("failed to allocate %d bytes"), (int) size);
+  else if (daemon->log_malloc)
+    my_syslog(LOG_INFO, _("malloc: %s:%u %zu bytes at %x"), func, line, size, hash_ptr(ret));
+
+  return ret;
+}
+
+void *whine_realloc_real(const char *wrapper, const char *func, unsigned int line, void *ptr, size_t size)
+{
+  unsigned int old = hash_ptr(ptr);
+  void *ret = realloc(ptr, size);
+  
+  if (!ret)
+    my_syslog(LOG_ERR, _("failed to reallocate %d bytes"), (int) size);
+  else if (daemon->log_malloc)
+    {
+      if (!wrapper)
+	wrapper = "realloc";
+      my_syslog(LOG_INFO, _("%s: %s:%u %zu bytes from %x to %x"), wrapper, func, line, size, old, hash_ptr(ret));
+    }
+  
+  return ret;
+}
+
+/* _note_ may copy buffer */
+int expand_buf_real(const char *func, unsigned int line, struct iovec *iov, size_t size)
+{
+  void *new;
+
+  if (size <= (size_t)iov->iov_len)
+    return 1;
+
+  if (!(new = whine_realloc_real("expand_buf", func, line, iov->iov_base, size)))
+    {
+      errno = ENOMEM;
+      return 0;
+    }
+
+  iov->iov_base = new;
+  iov->iov_len = size;
+
+  return 1;
+}
+
+int expand_workspace_real(const char *func, unsigned int line, unsigned char ***wkspc, int *szp, int new)
+{
+  unsigned char **p;
+  int old = *szp;
+
+  if (old >= new+1)
+    return 1;
+
+  new += 5;
+
+  if (!(p = whine_realloc_real("expand_workspace", func, line, *wkspc, new * sizeof(unsigned char *))))
+    return 0;
+
+  memset(p+old, 0, new-old);
+  
+  *wkspc = p;
+  *szp = new;
+
+  return 1;
+}
+
+#undef free
+void free_real(const char *func, unsigned int line, void *ptr)
+{
+  if (ptr)
+    {
+      if (daemon->log_malloc)
+	my_syslog(LOG_INFO, _("free: %s:%u block at %x"), func, line, hash_ptr(ptr));
+  
+      free(ptr);
+    }
+}
Author	SHA1	Message	Date
Simon Kelley	e4d0bb4579	Convert hash_init() to use realloc().	2026-02-06 15:05:59 +00:00
Clayton O'Neill	84415a87be	Fix PXE boot server (PXEBS) responses broken in 2.92 I think I've found a regression in dnsmasq 2.92 that breaks PXE boot server (PXEBS) responses when running in proxy DHCP mode. Fair warning: I'm not familiar with the dnsmasq codebase and used AI tooling to help trace through the source and identify the issue, so please take the analysis below with appropriate skepticism. PXE boot works fine on 2.91 but fails on 2.92 — the client gets the initial proxy DHCPOFFER, but the PXEBS ACK on port 4011 never reaches it. My setup is dnsmasq in proxy DHCP mode serving iPXE to Proxmox VMs via their virtio-net ROM. Here's a stripped-down version of my config: port=0 enable-tftp tftp-root=/tftpboot dhcp-range=172.19.74.0,proxy,255.255.255.0 interface=eno1 bind-interfaces dhcp-match=set:ipxe,175 pxe-service=tag:ipxe,x86PC,"Network Boot",http://server:8081/boot.ipxe pxe-service=tag:!ipxe,x86PC,"Network Boot",undionly.kpxe log-dhcp The issue seems to be in src/dhcp.c in the response routing logic after dhcp_reply() returns. In 2.91, the destination selection was an if/else-if chain: if (pxe_fd) { ... } else if (mess->giaddr.s_addr && !is_relay_reply) { ... } else if (mess->ciaddr.s_addr) { ... } else { ... broadcast to 255.255.255.255:68 ... } In 2.92, the else between the pxe_fd block and the giaddr/relay check was removed in commit `4fbe1ad` ("Implement RFC-4388 DHCPv4 leasequery") to accommodate the new is_relay_use_source logic: if (pxe_fd) { ... } if ((is_relay_use_source \|\| mess->giaddr.s_addr) && !is_relay_reply) { ... } else if (mess->ciaddr.s_addr) { ... } else { ... broadcast to 255.255.255.255:68 ... } For PXEBS responses, dhcp_reply() in rfc2131.c (around line 924-925) does: mess->yiaddr = mess->ciaddr; mess->ciaddr.s_addr = 0; So after dhcp_reply() returns for a PXEBS request, ciaddr is 0, giaddr is 0 (no relay), and is_relay_use_source is 0. In 2.91, the pxe_fd block runs and the rest of the chain is skipped — dest stays as received from recvmsg, and the response goes back to the client correctly. In 2.92, the pxe_fd block runs but then falls through to the standalone if, which is false, so the else block runs and sets dest to 255.255.255.255 port 68. The client is listening on port 4011 and ignores it. Here are the relevant dnsmasq logs. With 2.91 (working), I see normal proxy DHCP and PXE boot server exchanges: dnsmasq-dhcp: DHCPDISCOVER(eno1) bc:24:11:59:85:90 dnsmasq-dhcp: DHCPOFFER(eno1) 172.19.74.60 bc:24:11:59:85:90 dnsmasq-dhcp: DHCPREQUEST(eno1) 172.19.74.60 bc:24:11:59:85:90 dnsmasq-dhcp: DHCPACK(eno1) 172.19.74.60 bc:24:11:59:85:90 dnsmasq-dhcp: PXE(eno1) bc:24:11:59:85:90 proxy dnsmasq-dhcp: PXE(eno1) bc:24:11:59:85:90 proxy dnsmasq-dhcp: PXEBS(eno1) bc:24:11:59:85:90 undionly.kpxe dnsmasq-dhcp: PXE(eno1) bc:24:11:59:85:90 proxy dnsmasq-dhcp: PXEBS(eno1) bc:24:11:59:85:90 http://infra1.oneill.net:8081/boot.ipxe With 2.92 (broken), the DHCPDISCOVER/OFFER/REQUEST/ACK cycle and the proxy PXE response work, but the PXEBS response never reaches the client — it times out after repeated attempts. The dnsmasq side shows it sending the response, but the client keeps retrying: dnsmasq-dhcp: PXE(eno1) bc:24:11:59:85:90 proxy dnsmasq-dhcp: PXE(eno1) bc:24:11:59:85:90 proxy dnsmasq-dhcp: PXEBS(eno1) bc:24:11:59:85:90 undionly.kpxe dnsmasq-dhcp: PXEBS(eno1) bc:24:11:59:85:90 undionly.kpxe dnsmasq-dhcp: PXEBS(eno1) bc:24:11:59:85:90 undionly.kpxe dnsmasq-dhcp: PXEBS(eno1) bc:24:11:59:85:90 undionly.kpxe I tested by restoring the else keyword and the fix appears to work — 2.92 with the patch below PXE boots successfully. I believe this change preserves the leasequery behavior since that path only applies when pxe_fd is false (normal DHCP handling, not port 4011).	2026-02-05 15:38:27 +00:00
Simon Kelley	1537645e8f	treat opt_malloc as a wrapper for logging purposes.	2026-02-05 14:53:10 +00:00
Simon Kelley	ceab392c60	Improve memory allocation for /etc/hosts etc. Clearing and reloading the DNS cache involved freeing and re-allocating many small memory blocks. Doing this frequently with a significant number of static DNS configuraions or DHCP leases could result in excessive heap fragmentation and memory use. This patch extends the pool memory allocation technique used else where to this memory. On cache clear, the memory is not freed, but added to a pool of useable but unused data structures which get re-used to store the new data.	2026-02-05 13:26:08 +00:00
Simon Kelley	5f0f6aa9b1	Enhance --log-malloc Log callers of wrapper functions of realloc() These are expand_buf() and expand_workspace()	2026-02-03 22:33:32 +00:00
Simon Kelley	578ea08391	CHANGELOG entry for 2.92 DHCPv6 and relay regression. Bug introduced in `3ceea9e755` Bug fixed in `714d36229a`	2026-02-03 22:06:07 +00:00
Simon Kelley	fbfcf87f8b	Rewrite blockdata_retrieve() and expand_buf() to use realloc().	2026-02-01 21:56:30 +00:00
Simon Kelley	19f3e06e7a	Fix compiler warning.	2026-02-01 15:44:13 +00:00
Matthias Andree	40d1152059	read_writev: avoid reading past the last iovec elem If iovcnt is exhausted and the first vector element's operation is satisfied, the while loop will read past the end of the iovec array. This triggers the address sanitizer and leads to undefined program state. Avoid reading too far.	2026-02-01 15:36:16 +00:00
Matthias Andree	3c830c4f1c	Avoid uninitialized-value warnings from the compiler	2026-02-01 14:02:08 +00:00
Matthias Andree	e9f400dd37	base32_decode: avoid shifting into the sign bit While this won't do harm on systems that do 2's completement, it triggers the compilers' undefined-behavior sanitizer and fixes sanitizer error such as the one below (where the 1694... will vary) and is distracting while debugging. dnssec.c:1427:12: runtime error: left shift of 1694604366 by 1 places cannot be represented in type 'int'	2026-02-01 14:00:31 +00:00
Simon Kelley	870f14108f	Tidy up memory allocation in read_event()	2026-01-31 21:31:10 +00:00
Simon Kelley	714d36229a	Tidy up check for muticast DHCPv6 requests. Anything sent by a client must be multicast. A relay can unicast to a server.	2026-01-31 20:40:21 +00:00
Simon Kelley	60e90e2224	Remove DHCPv6 UseMulticast option code. This almost certainly never worked and was never use, and it's rendered obsolete in RFC 9915.	2026-01-31 16:50:21 +00:00
Simon Kelley	ed2ba5b07a	Optimise TCP send. In the DNS TCP code, there are a couple of places where we have a buffer containing a message which we need to send via TCP. The DNS protocol is that this is sent as <16-bit length in network order><message> Making two write calls, one for the length and one for the message causes the TCP stack to send two packets, one for each. A single packet containing both is preferable from a performance POV. Implement a scatter-gather version of our read_write() wrapper and use it where necessary to send TCP DNS messages.	2026-01-28 14:57:50 +00:00
Simon Kelley	729c16a8ac	Rationalise DNS TCP buffer use. This fixes the plethora of 64k buffers that got allocated when doing DNSSEC over TCP. By using the UDP buffer is pass the query into tcp_talk() and allowing tcp_talk to allocate its output buffer one the size of the reply is known, we only need to allocate as much memory as is required. The final reply to the TCP query still needs the 64k buffer because answer_request() and answer_auth() are not capable of extending their output buffers.	2026-01-26 15:25:22 +00:00
Simon Kelley	80acb76f46	Don't start malloc() logging until the log system is configured.	2026-01-25 12:20:04 +00:00
Simon Kelley	f1fa05d754	Don't log free(NULL) calls.	2026-01-25 12:16:48 +00:00
Simon Kelley	b148ba4752	Add --log-malloc debugging option. Log all blocks malloced and all blocks freed.	2026-01-24 22:16:23 +00:00
Simon Kelley	81f619612e	Fix memory allocation in blockdata_retrieve() This was functionally correct, but every call malloced a new buffer and freed the previous one, rather than only doing that when the buffer needed expansion.	2026-01-24 22:00:35 +00:00
Simon Kelley	cb321709e9	Fix DNSSEC fail with CNAME replies to DS queries. A CNAME reply to a DNSSEC query was confusing the validation logic. It now accepts a signed CNAME reply to a DS query as proof that no DS exists at the domain. This fixes the DS/zone break detection logic.	2026-01-18 18:57:08 +00:00
Simon Kelley	8eb36844a0	Log SERVFAIL from usptream servers. If we're doing DNSSEC validation and fail because the upstream reply to our query is SERVFAIL, log this as the reason in validation result line. This will make maintainers lives easier when they get reports of "wrong" validation failure, which is sometimes an upstream problem.	2026-01-18 12:50:57 +00:00
Pavel Bozhko	8fa68a6e1e	The only_failed argument has been added to the log-queries parameter. This may be useful for embedded systems for example: log-queries without only_failed places a heavy load on the NAND flash memory. At the same time, logging requests is necessary to troubleshoot network issues.	2026-01-16 15:33:59 +00:00
Simon Kelley	1269f074f8	Fix DNSSEC failure with spurious RRSIGs. The presence of wrong RRSIG RRs in replies causes DNSSEC validation to fail even when the RRs do not require validation because the zone is unsigned. This patch solves the problem and tidies up the logic. Included is some fixes for hostname_issubdomain() which suffered some confusions about argument order :) I've clarified that and checked every to the function to make sure they are using the correct argument order. Note that, at the time of this commit, Google DNS appears to have the same bug, so if you're using 8.8.8.8 or friends as upstream, resolving the broken zones (eg rivcoed.org) will still fail. Thanks to Petr Menšík for the bug report.	2026-01-15 14:41:31 +00:00
Matthias Andree	e1faf705c9	Support Inotify in FreeBSD. FreeBSD 15.0 has added Linux-compatible inotify support, so enable it by looking if the version matches. Since FreeBSD inotify has seen a few bug fixes in 2025H2, so only enable it if __FreeBSD_version >= 1500068. The latter can be checked through osreldate.h or sys/param.h; the latter defines more macros that clash with dnsmasq's, such as MIN and MAX, so use the former.	2026-01-14 20:08:41 +00:00
Simon Kelley	f603a4f920	Fix a corner-case in DNSSEC validation with wildcards. If we have a wildcard record .example.com and recieve a query for a.example.com then that's OK, but we have to check that there isn't an actual a.example.com record. The corner case is when we get a query for .example.com in that case the non-existence check is not required, but was being done. Thanks to Jan Breig for spotting this.	2026-01-12 21:55:41 +00:00
Simon Kelley	c090f1d17b	Terminate TCP child processes that arise from UDP truncated replies. These can't be held forever by a client that opens a connection and then sends nothing, but we can still be DoSsed by a server which accepts a connection and never replies. If the TCP process times out, it sends that information to the parent so that the UDP query can be unblocked. As the TCP timeout is 150s it's highly unlikely that any client will still be waiting, but the point is to free resources.	2025-12-07 15:00:29 +00:00
Simon Kelley	fa48bdb939	Tidy up code in in do_tcp_connection() which filters incoming connections. A general rewrite and consolidation of the code that determines if an incoming TCP connection is allowed, based on --address and --interface. This was prompted by a bug found by Sławomir Zborowski where a TCP connection for a valid IPv4 address on one interface which arrived via a second interface which didn't have an IPv4 address would be wrongly rejected.	2025-12-07 15:00:24 +00:00