unbound: Vendor import 1.18.0

Release notes at
https://www.nlnetlabs.nl/news/2023/Aug/30/unbound-1.18.0-released/

MFC after: 2 weeks

Merge commit '401770e05c71ecb5ae61a59d316069b4b78bf622' into main

unbound: Move config.h to lib directory.

It was originally in contrib, and moved to usr.sbin in 6692aa840c1f; I always thought lib would make more sense but never got around to moving it.

Reviewed by: cy
Differential Revision: https://reviews.freebsd.org/D41504

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

libunbound: Request the OpenSSL 1.1 API

OPENSSL_API_COMPAT can be used to specify the OpenSSL API version in
use for the purpose of hiding deprecated interfaces and enabling
the appropriate deprecation notices.

This change is a NFC while we're still using OpenSSL 1.1.1 but will
avoid deprecation warnings upon the switch to OpenSSL 3.0.

A future update may migrate to use the OpenSSL 3.0 APIs.

PR: 271615
Reviewed by: emaste
Sponsored by: The FreeBSD Foundation

unbound: Reapply Vendor import 1.17.0

Reapply 643f9a0581e8aac7eb790ced1164748939829826. 64d318ea98b7 was a
mismerge during fake rebase. Let's reapply it.

Changes include: Added ACL per interface, proxy protocol and bug fixes.

Announcement: https://nlnetlabs.nl/news/2022/Oct/13/unbound-1.17.0-released/

Merge commit '643f9a0581e8aac7eb790ced1164748939829826' into main

Revert "unbound: Vendor import 1.17.0"

This reverts commit 64d318ea98b7c59f5567d47a9a8474887d8b5cb8, reversing
changes made to 8063dc03202fad7d6bdf34976bc8556fa3f23fa1.

Revert a mismerge which reversed 8063dc03202fad7d6bdf34976bc8556fa3f23fa1.

unbound: Vendor import 1.17.0

Added ACL per interface, proxy protocol and bug fixes.

Announcement: https://nlnetlabs.nl/news/2022/Oct/13/unbound-1.17.0-released/

Merge commit '643f9a0581e8aac7eb790ced1164748939829826' into new_merge

MFV r361322:

Update unbound 1.9.6 --> 1.10.1.

Bug Fixes:
- CVE-2020-12662 Unbound can be tricked into amplifying an incoming
query into a large number of queries directed to a target.
- CVE-2020-12663 Malformed answers from upstream name servers can be
used to make Unbound unresponsive.

Reported by: emaste
MFC after: 3 days
Relnotes: yes
Security: CVE-2020-12662, CVE-2020-12663

Unbound's config.h is manually maintained, using a ./configure produced
config.h as a guide. In practice contributed software maintains a copy
of config.h within its build directory tree containing its Makefile.
usr.sbin/unbound is the home for its config.h.

MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D22983

Update Makefile for 1.8.0, apologies for the breakage.

Approved by: re (kib)

Upgrade Unbound to 1.7.2. More to follow.

Approved by: re (kib@)

Upgrade Unbound to 1.6.4. More to follow.

Upgrade Unbound to 1.6.2. More to follow.

Upgrade Unbound to 1.6.1. More to follow.

Upgrade Unbound to 1.6.0. More to follow.

Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones

This implifies pathing in make/displayed output

MFC after: 3 weeks
Sponsored by: Dell EMC Isilon

Upgrade to Unbound 1.5.9.

MFH

Sponsored by: The FreeBSD Foundation

Add to CFLAGS, rather than replacing.

This allows additional CFLAGS, as set in bsd.cpu.mk, to go through.

MFH

Sponsored by: The FreeBSD Foundation

Use the new insecure-lan-zones option instead of listing each AS112 zone
separately.

MFC after: 3 days

First pass through library packaging.

Sponsored by: The FreeBSD Foundation

Merge from head

Upgrade to Unbound 1.5.4.

Add libunbound to the unbound package

Add a ${CP} alias for copying files in the build.

Some users build FreeBSD as non-root in Perforce workspaces. By default,
Perforce sets files read-only unless they're explicitly being edited.
As a result, the -f argument must be used to cp in order to override the
read-only flag when copying source files to object directories. Bare use of
'cp' should be avoided in the future.

Update all current users of 'cp' in the src tree.

Reviewed by: emaste
MFC after: 1 week
Sponsored by: Spectra Logic

Upgrade to Unbound 1.5.1. Almost all our local changes to date have been
adopted upstream, greatly reducing the diff.

Convert libraries to use LIBADD
While here reduce a bit overlinking

Fix incremental builds involving non-root users with read-only source files.
This is a followup commit to r271771.

MFC after: 1 month

Clean up the libunbound build to avoid accidentally regenerating the
configuration lexer and parser during buildworld. Instead of being
included in the source as it is in the upstream distribution, the code is
now always generated (in ${.OBJDIR}) at build time.

PR: 190739
MFC after: 1 week

Upgrade to latest ldns (1.6.17) and unbound (1.4.22).

MFC after: 3 weeks

Build and install the Unbound caching DNS resolver daemon.

Approved by: re (blanket)

unbound: Move config.h to lib directory.

It was originally in contrib, and moved to usr.sbin in 6692aa840c1f; I always thought lib would make more sense but never got around to moving it.

Reviewed by: cy
Differential Revision: https://reviews.freebsd.org/D41504

Remove $FreeBSD$: one-line sh pattern

Remove /^\s*#[#!]?\s*\$FreeBSD\$.*$\n/

libunbound: Request the OpenSSL 1.1 API

OPENSSL_API_COMPAT can be used to specify the OpenSSL API version in
use for the purpose of hiding deprecated interfaces and enabling
the appropriate deprecation notices.

This change is a NFC while we're still using OpenSSL 1.1.1 but will
avoid deprecation warnings upon the switch to OpenSSL 3.0.

A future update may migrate to use the OpenSSL 3.0 APIs.

PR: 271615
Reviewed by: emaste
Sponsored by: The FreeBSD Foundation

unbound: Reapply Vendor import 1.17.0

Reapply 643f9a0581e8aac7eb790ced1164748939829826. 64d318ea98b7 was a
mismerge during fake rebase. Let's reapply it.

Changes include: Added ACL per interface, proxy protocol and bug fixes.

Announcement: https://nlnetlabs.nl/news/2022/Oct/13/unbound-1.17.0-released/

Merge commit '643f9a0581e8aac7eb790ced1164748939829826' into main

Revert "unbound: Vendor import 1.17.0"

This reverts commit 64d318ea98b7c59f5567d47a9a8474887d8b5cb8, reversing
changes made to 8063dc03202fad7d6bdf34976bc8556fa3f23fa1.

Revert a mismerge which reversed 8063dc03202fad7d6bdf34976bc8556fa3f23fa1.

Unbound's config.h is manually maintained, using a ./configure produced
config.h as a guide. In practice contributed software maintains a copy
of config.h within its build directory tree containing its Makefile.
usr.sbin/unbound is the home for its config.h.

MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D22983

Update Makefile for 1.8.0, apologies for the breakage.

Approved by: re (kib)

Upgrade Unbound to 1.6.1. More to follow.

Use SRCTOP-relative paths to other directories instead of .CURDIR-relative ones

This implifies pathing in make/displayed output

MFC after: 3 weeks
Sponsored by: Dell EMC Isilon

Add to CFLAGS, rather than replacing.

This allows additional CFLAGS, as set in bsd.cpu.mk, to go through.

First pass through library packaging.

Sponsored by: The FreeBSD Foundation

Add libunbound to the unbound package

Add a ${CP} alias for copying files in the build.

Some users build FreeBSD as non-root in Perforce workspaces. By default,
Perforce sets files read-only unless they're explicitly being edited.
As a result, the -f argument must be used to cp in order to override the
read-only flag when copying source files to object directories. Bare use of
'cp' should be avoided in the future.

Update all current users of 'cp' in the src tree.

Reviewed by: emaste
MFC after: 1 week
Sponsored by: Spectra Logic

Convert libraries to use LIBADD
While here reduce a bit overlinking

Fix incremental builds involving non-root users with read-only source files.
This is a followup commit to r271771.

MFC after: 1 month

Clean up the libunbound build to avoid accidentally regenerating the
configuration lexer and parser during buildworld. Instead of being
included in the source as it is in the upstream distribution, the code is
now always generated (in ${.OBJDIR}) at build time.

PR: 190739
MFC after: 1 week

Build and install the Unbound caching DNS resolver daemon.

Approved by: re (blanket)