nsd-3.2.16/0000775000175000017500000000000012173226547011364 5ustar matjematjensd-3.2.16/iterated_hash.c0000664000175000017500000000167711761673243014350 0ustar matjematje/* * iterated_hash.c -- nsec3 hash calculation. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * * With thanks to Ben Laurie. */ #include "config.h" #ifdef NSEC3 #include #include #include #include "iterated_hash.h" int iterated_hash(unsigned char out[SHA_DIGEST_LENGTH], const unsigned char *salt, int saltlength, const unsigned char *in, int inlength, int iterations) { #if defined(NSEC3) && defined(HAVE_SSL) SHA_CTX ctx; int n; assert(in && inlength > 0 && iterations >= 0); for(n=0 ; n <= iterations ; ++n) { SHA1_Init(&ctx); SHA1_Update(&ctx, in, inlength); if(saltlength > 0) SHA1_Update(&ctx, salt, saltlength); SHA1_Final(out, &ctx); in=out; inlength=SHA_DIGEST_LENGTH; } return SHA_DIGEST_LENGTH; #else (void)out; (void)salt; (void)saltlength; (void)in; (void)inlength; (void)iterations; return 0; #endif } #endif /* NSEC3 */ nsd-3.2.16/LICENSE0000664000175000017500000000272611535444205012372 0ustar matjematjeCopyright (c) 2001-2011, NLnet Labs. All rights reserved. This software is open source. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of the NLNET LABS nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. nsd-3.2.16/tsig-openssl.h0000664000175000017500000000077011535444205014162 0ustar matjematje/* * tsig-openssl.h -- Interface to OpenSSL for TSIG support. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _TSIG_OPENSSL_H_ #define _TSIG_OPENSSL_H_ #if defined(HAVE_SSL) #include "region-allocator.h" #include #include /* * Initialize OpenSSL support for TSIG. */ int tsig_openssl_init(region_type *region); void tsig_openssl_finalize(); #endif /* defined(HAVE_SSL) */ #endif /* _TSIG_H_ */ nsd-3.2.16/nsd-xfer.8.in0000664000175000017500000000340612173226547013613 0ustar matjematje.TH "nsd\-xfer" "8" "Jul 22, 2013" "NLnet Labs" "nsd 3.2.16" .\" Copyright (c) 2001\-2011, NLnet Labs. All rights reserved. .\" See LICENSE for the license. .SH "NAME" .LP .B nsd\-xfer \- AXFR client to transfer zones from a name server .SH "SYNOPSIS" .LP .B nsd\-xfer .RB [ \-4 ] .RB [ \-6 ] .RB [ \-a .IR address[@port] ] .RB [ \-p .IR port ] .RB [ \-s .IR serial ] .RB [ \-T .IR tsiginfo ] .RB [ \-v ] .B \-z .I zone .B \-f .I file .I servers .SH "DESCRIPTION" .LP .B Nsd\-xfer is program to transfer zones from a name server using AXFR. .B NSD is a complete implementation of an authoritative DNS nameserver. .SH "OPTIONS" .LP .TP .B \-4 Only send to IPv4 addresses. .TP .B \-6 Only send to IPv6 addresses. .TP .B \-a\fI address[@port] Specify the source address (and port) to send from. .TP .B \-f\fI file The file to store the zone in. .TP .B \-p\fI port Specify the port to send to. .TP .B \-s\fI serial Specify the serial of the current zone. The zone is only transferred if the master server has a zone with a greater serial number. .TP .B \-T\fI tsiginfo Use TSIG to verify the zone transfer. The .I tsiginfo file must contain the TSIG key information. The file is removed upon successful reading of the key. The format of the tsiginfo file is described in the doc/README file (section 3.3). .TP .B \-v Be more verbose. .TP .B \-z\fI zone Specify the zone to receive. .TP .I servers List of nameservers to try. .SH "EXAMPLES" .LP To run this program the standard way type: .LP # nsd\-xfer \-z foobar.cz \-f foobar.cz.zone 1.2.3.4 .SH "SEE ALSO" .LP nsd(8), nsdc(8), nsd.conf(5), nsd-checkconf(8), nsd-notify(8), nsd-patch(8), zonec(8) .SH "AUTHORS" .LP .B NSD was written by NLnet Labs and RIPE NCC joint team. Please see CREDITS file in the distribution for further details. nsd-3.2.16/xfrd-tcp.c0000664000175000017500000003517612010733410013251 0ustar matjematje/* * xfrd-tcp.c - XFR (transfer) Daemon TCP system source file. Manages tcp conn. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include "xfrd-tcp.h" #include "buffer.h" #include "packet.h" #include "dname.h" #include "options.h" #include "namedb.h" #include "xfrd.h" #include "util.h" xfrd_tcp_set_t* xfrd_tcp_set_create(struct region* region) { int i; xfrd_tcp_set_t* tcp_set = region_alloc(region, sizeof(xfrd_tcp_set_t)); memset(tcp_set, 0, sizeof(xfrd_tcp_set_t)); tcp_set->tcp_count = 0; tcp_set->tcp_waiting_first = 0; tcp_set->tcp_waiting_last = 0; for(i=0; itcp_state[i] = xfrd_tcp_create(region); return tcp_set; } void xfrd_setup_packet(buffer_type* packet, uint16_t type, uint16_t klass, const dname_type* dname) { /* Set up the header */ buffer_clear(packet); ID_SET(packet, qid_generate()); FLAGS_SET(packet, 0); OPCODE_SET(packet, OPCODE_QUERY); QDCOUNT_SET(packet, 1); ANCOUNT_SET(packet, 0); NSCOUNT_SET(packet, 0); ARCOUNT_SET(packet, 0); buffer_skip(packet, QHEADERSZ); /* The question record. */ buffer_write(packet, dname_name(dname), dname->name_size); buffer_write_u16(packet, type); buffer_write_u16(packet, klass); } static socklen_t #ifdef INET6 xfrd_acl_sockaddr(acl_options_t* acl, unsigned int port, struct sockaddr_storage *sck) #else xfrd_acl_sockaddr(acl_options_t* acl, unsigned int port, struct sockaddr_in *sck, const char* fromto) #endif /* INET6 */ { /* setup address structure */ #ifdef INET6 memset(sck, 0, sizeof(struct sockaddr_storage)); #else memset(sck, 0, sizeof(struct sockaddr_in)); #endif if(acl->is_ipv6) { #ifdef INET6 struct sockaddr_in6* sa = (struct sockaddr_in6*)sck; sa->sin6_family = AF_INET6; sa->sin6_port = htons(port); sa->sin6_addr = acl->addr.addr6; return sizeof(struct sockaddr_in6); #else log_msg(LOG_ERR, "xfrd: IPv6 connection %s %s attempted but no \ INET6.", fromto, acl->ip_address_spec); return 0; #endif } else { struct sockaddr_in* sa = (struct sockaddr_in*)sck; sa->sin_family = AF_INET; sa->sin_port = htons(port); sa->sin_addr = acl->addr.addr; return sizeof(struct sockaddr_in); } } socklen_t #ifdef INET6 xfrd_acl_sockaddr_to(acl_options_t* acl, struct sockaddr_storage *to) #else xfrd_acl_sockaddr_to(acl_options_t* acl, struct sockaddr_in *to) #endif /* INET6 */ { unsigned int port = acl->port?acl->port:(unsigned)atoi(TCP_PORT); #ifdef INET6 return xfrd_acl_sockaddr(acl, port, to); #else return xfrd_acl_sockaddr(acl, port, to, "to"); #endif /* INET6 */ } socklen_t #ifdef INET6 xfrd_acl_sockaddr_frm(acl_options_t* acl, struct sockaddr_storage *frm) #else xfrd_acl_sockaddr_frm(acl_options_t* acl, struct sockaddr_in *frm) #endif /* INET6 */ { unsigned int port = acl->port?acl->port:0; #ifdef INET6 return xfrd_acl_sockaddr(acl, port, frm); #else return xfrd_acl_sockaddr(acl, port, frm, "from"); #endif /* INET6 */ } void xfrd_write_soa_buffer(struct buffer* packet, const dname_type* apex, struct xfrd_soa* soa) { size_t rdlength_pos; uint16_t rdlength; buffer_write(packet, dname_name(apex), apex->name_size); /* already in network order */ buffer_write(packet, &soa->type, sizeof(soa->type)); buffer_write(packet, &soa->klass, sizeof(soa->klass)); buffer_write(packet, &soa->ttl, sizeof(soa->ttl)); rdlength_pos = buffer_position(packet); buffer_skip(packet, sizeof(rdlength)); /* uncompressed dnames */ buffer_write(packet, soa->prim_ns+1, soa->prim_ns[0]); buffer_write(packet, soa->email+1, soa->email[0]); buffer_write(packet, &soa->serial, sizeof(uint32_t)); buffer_write(packet, &soa->refresh, sizeof(uint32_t)); buffer_write(packet, &soa->retry, sizeof(uint32_t)); buffer_write(packet, &soa->expire, sizeof(uint32_t)); buffer_write(packet, &soa->minimum, sizeof(uint32_t)); /* write length of RR */ rdlength = buffer_position(packet) - rdlength_pos - sizeof(rdlength); buffer_write_u16_at(packet, rdlength_pos, rdlength); } xfrd_tcp_t* xfrd_tcp_create(region_type* region) { xfrd_tcp_t* tcp_state = (xfrd_tcp_t*)region_alloc( region, sizeof(xfrd_tcp_t)); memset(tcp_state, 0, sizeof(xfrd_tcp_t)); tcp_state->packet = buffer_create(region, QIOBUFSZ); tcp_state->fd = -1; return tcp_state; } void xfrd_tcp_obtain(xfrd_tcp_set_t* set, xfrd_zone_t* zone) { assert(zone->tcp_conn == -1); assert(zone->tcp_waiting == 0); if(set->tcp_count < XFRD_MAX_TCP) { int i; assert(!set->tcp_waiting_first); set->tcp_count ++; /* find a free tcp_buffer */ for(i=0; itcp_state[i]->fd == -1) { zone->tcp_conn = i; break; } } /** What if there is no free tcp_buffer? return; */ if (zone->tcp_conn < 0) { return; } zone->tcp_waiting = 0; /* stop udp use (if any) */ if(zone->zone_handler.fd != -1) xfrd_udp_release(zone); if(!xfrd_tcp_open(set, zone)) return; xfrd_tcp_xfr(set, zone); return; } /* wait, at end of line */ DEBUG(DEBUG_XFRD,2, (LOG_INFO, "xfrd: max number of tcp " "connections (%d) reached.", XFRD_MAX_TCP)); zone->tcp_waiting_next = 0; zone->tcp_waiting = 1; if(!set->tcp_waiting_last) { set->tcp_waiting_first = zone; set->tcp_waiting_last = zone; } else { set->tcp_waiting_last->tcp_waiting_next = zone; set->tcp_waiting_last = zone; } xfrd_unset_timer(zone); } int xfrd_tcp_open(xfrd_tcp_set_t* set, xfrd_zone_t* zone) { int fd, family, conn; #ifdef INET6 struct sockaddr_storage to; #else struct sockaddr_in to; #endif /* INET6 */ socklen_t to_len; assert(zone->tcp_conn != -1); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s open tcp conn to %s", zone->apex_str, zone->master->ip_address_spec)); set->tcp_state[zone->tcp_conn]->is_reading = 0; set->tcp_state[zone->tcp_conn]->total_bytes = 0; set->tcp_state[zone->tcp_conn]->msglen = 0; if(zone->master->is_ipv6) { #ifdef INET6 family = PF_INET6; #else xfrd_set_refresh_now(zone); xfrd_tcp_release(set, zone); return 0; #endif } else { family = PF_INET; } fd = socket(family, SOCK_STREAM, IPPROTO_TCP); set->tcp_state[zone->tcp_conn]->fd = fd; if(fd == -1) { log_msg(LOG_ERR, "xfrd: %s cannot create tcp socket: %s", zone->master->ip_address_spec, strerror(errno)); xfrd_set_refresh_now(zone); xfrd_tcp_release(set, zone); return 0; } if(fcntl(fd, F_SETFL, O_NONBLOCK) == -1) { log_msg(LOG_ERR, "xfrd: fcntl failed: %s", strerror(errno)); xfrd_set_refresh_now(zone); xfrd_tcp_release(set, zone); return 0; } to_len = xfrd_acl_sockaddr_to(zone->master, &to); /* bind it */ if (!xfrd_bind_local_interface(fd, zone->zone_options->outgoing_interface, zone->master, 1)) { xfrd_set_refresh_now(zone); xfrd_tcp_release(set, zone); return 0; } conn = connect(fd, (struct sockaddr*)&to, to_len); if (conn == -1 && errno != EINPROGRESS) { log_msg(LOG_ERR, "xfrd: connect %s failed: %s", zone->master->ip_address_spec, strerror(errno)); xfrd_set_refresh_now(zone); xfrd_tcp_release(set, zone); return 0; } zone->zone_handler.fd = fd; zone->zone_handler.event_types = NETIO_EVENT_TIMEOUT|NETIO_EVENT_WRITE; xfrd_set_timer(zone, xfrd_time() + set->tcp_timeout); return 1; } void xfrd_tcp_xfr(xfrd_tcp_set_t* set, xfrd_zone_t* zone) { xfrd_tcp_t* tcp = set->tcp_state[zone->tcp_conn]; assert(zone->tcp_conn != -1); assert(zone->tcp_waiting == 0); /* start AXFR or IXFR for the zone */ if(zone->soa_disk_acquired == 0 || zone->master->use_axfr_only || zone->master->ixfr_disabled) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "request full zone transfer " "(AXFR) for %s to %s", zone->apex_str, zone->master->ip_address_spec)); xfrd_setup_packet(tcp->packet, TYPE_AXFR, CLASS_IN, zone->apex); } else { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "request incremental zone " "transfer (IXFR) for %s to %s", zone->apex_str, zone->master->ip_address_spec)); xfrd_setup_packet(tcp->packet, TYPE_IXFR, CLASS_IN, zone->apex); NSCOUNT_SET(tcp->packet, 1); xfrd_write_soa_buffer(tcp->packet, zone->apex, &zone->soa_disk); } zone->query_id = ID(tcp->packet); zone->msg_seq_nr = 0; zone->msg_rr_count = 0; if(zone->master->key_options && zone->master->key_options->tsig_key) { xfrd_tsig_sign_request(tcp->packet, &zone->tsig, zone->master); } buffer_flip(tcp->packet); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "sent tcp query with ID %d", zone->query_id)); tcp->msglen = buffer_limit(tcp->packet); /* wait for select to complete connect before write */ } static void tcp_conn_ready_for_reading(xfrd_tcp_t* tcp) { tcp->total_bytes = 0; tcp->msglen = 0; buffer_clear(tcp->packet); } int conn_write(xfrd_tcp_t* tcp) { ssize_t sent; if(tcp->total_bytes < sizeof(tcp->msglen)) { uint16_t sendlen = htons(tcp->msglen); sent = write(tcp->fd, (const char*)&sendlen + tcp->total_bytes, sizeof(tcp->msglen) - tcp->total_bytes); if(sent == -1) { if(errno == EAGAIN || errno == EINTR) { /* write would block, try later */ return 0; } else { return -1; } } tcp->total_bytes += sent; if(tcp->total_bytes < sizeof(tcp->msglen)) { /* incomplete write, resume later */ return 0; } assert(tcp->total_bytes == sizeof(tcp->msglen)); } assert(tcp->total_bytes < tcp->msglen + sizeof(tcp->msglen)); sent = write(tcp->fd, buffer_current(tcp->packet), buffer_remaining(tcp->packet)); if(sent == -1) { if(errno == EAGAIN || errno == EINTR) { /* write would block, try later */ return 0; } else { return -1; } } buffer_skip(tcp->packet, sent); tcp->total_bytes += sent; if(tcp->total_bytes < tcp->msglen + sizeof(tcp->msglen)) { /* more to write when socket becomes writable again */ return 0; } assert(tcp->total_bytes == tcp->msglen + sizeof(tcp->msglen)); return 1; } void xfrd_tcp_write(xfrd_tcp_set_t* set, xfrd_zone_t* zone) { int ret; xfrd_tcp_t* tcp = set->tcp_state[zone->tcp_conn]; assert(zone->tcp_conn != -1); if(tcp->total_bytes == 0) { /* check for pending error from nonblocking connect */ /* from Stevens, unix network programming, vol1, 3rd ed, p450 */ int error = 0; socklen_t len = sizeof(error); if(getsockopt(tcp->fd, SOL_SOCKET, SO_ERROR, &error, &len) < 0){ error = errno; /* on solaris errno is error */ } if(error == EINPROGRESS || error == EWOULDBLOCK) return; /* try again later */ if(error != 0) { log_msg(LOG_ERR, "Could not tcp connect to %s: %s", zone->master->ip_address_spec, strerror(error)); xfrd_set_refresh_now(zone); xfrd_tcp_release(set, zone); return; } } ret = conn_write(tcp); if(ret == -1) { log_msg(LOG_ERR, "xfrd: failed writing tcp %s", strerror(errno)); xfrd_set_refresh_now(zone); xfrd_tcp_release(set, zone); return; } if(ret == 0) { return; /* write again later */ } /* done writing, get ready for reading */ tcp->is_reading = 1; tcp_conn_ready_for_reading(tcp); zone->zone_handler.event_types = NETIO_EVENT_READ|NETIO_EVENT_TIMEOUT; xfrd_tcp_read(set, zone); } int conn_read(xfrd_tcp_t* tcp) { ssize_t received; /* receive leading packet length bytes */ if(tcp->total_bytes < sizeof(tcp->msglen)) { received = read(tcp->fd, (char*) &tcp->msglen + tcp->total_bytes, sizeof(tcp->msglen) - tcp->total_bytes); if(received == -1) { if(errno == EAGAIN || errno == EINTR) { /* read would block, try later */ return 0; } else { #ifdef ECONNRESET if (verbosity >= 2 || errno != ECONNRESET) #endif /* ECONNRESET */ log_msg(LOG_ERR, "tcp read sz: %s", strerror(errno)); return -1; } } else if(received == 0) { /* EOF */ return -1; } tcp->total_bytes += received; if(tcp->total_bytes < sizeof(tcp->msglen)) { /* not complete yet, try later */ return 0; } assert(tcp->total_bytes == sizeof(tcp->msglen)); tcp->msglen = ntohs(tcp->msglen); if(tcp->msglen > buffer_capacity(tcp->packet)) { log_msg(LOG_ERR, "buffer too small, dropping connection"); return 0; } buffer_set_limit(tcp->packet, tcp->msglen); } assert(buffer_remaining(tcp->packet) > 0); received = read(tcp->fd, buffer_current(tcp->packet), buffer_remaining(tcp->packet)); if(received == -1) { if(errno == EAGAIN || errno == EINTR) { /* read would block, try later */ return 0; } else { #ifdef ECONNRESET if (verbosity >= 2 || errno != ECONNRESET) #endif /* ECONNRESET */ log_msg(LOG_ERR, "tcp read %s", strerror(errno)); return -1; } } else if(received == 0) { /* EOF */ return -1; } tcp->total_bytes += received; buffer_skip(tcp->packet, received); if(buffer_remaining(tcp->packet) > 0) { /* not complete yet, wait for more */ return 0; } /* completed */ assert(buffer_position(tcp->packet) == tcp->msglen); return 1; } void xfrd_tcp_read(xfrd_tcp_set_t* set, xfrd_zone_t* zone) { xfrd_tcp_t* tcp = set->tcp_state[zone->tcp_conn]; int ret; assert(zone->tcp_conn != -1); ret = conn_read(tcp); if(ret == -1) { xfrd_set_refresh_now(zone); xfrd_tcp_release(set, zone); return; } if(ret == 0) return; /* completed msg */ buffer_flip(tcp->packet); switch(xfrd_handle_received_xfr_packet(zone, tcp->packet)) { case xfrd_packet_more: tcp_conn_ready_for_reading(tcp); break; case xfrd_packet_transfer: case xfrd_packet_newlease: xfrd_tcp_release(set, zone); assert(zone->round_num == -1); break; case xfrd_packet_notimpl: zone->master->ixfr_disabled = time(NULL); xfrd_tcp_release(set, zone); /* query next server */ xfrd_make_request(zone); break; case xfrd_packet_bad: case xfrd_packet_tcp: default: xfrd_tcp_release(set, zone); /* query next server */ xfrd_make_request(zone); break; } } void xfrd_tcp_release(xfrd_tcp_set_t* set, xfrd_zone_t* zone) { int conn = zone->tcp_conn; DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s released tcp conn to %s", zone->apex_str, zone->master->ip_address_spec)); assert(zone->tcp_conn != -1); assert(zone->tcp_waiting == 0); zone->tcp_conn = -1; zone->tcp_waiting = 0; zone->zone_handler.fd = -1; zone->zone_handler.event_types = NETIO_EVENT_READ|NETIO_EVENT_TIMEOUT; if(set->tcp_state[conn]->fd != -1) close(set->tcp_state[conn]->fd); set->tcp_state[conn]->fd = -1; if(set->tcp_count == XFRD_MAX_TCP && set->tcp_waiting_first) { /* pop first waiting process */ zone = set->tcp_waiting_first; if(set->tcp_waiting_last == zone) set->tcp_waiting_last = 0; set->tcp_waiting_first = zone->tcp_waiting_next; zone->tcp_waiting_next = 0; /* start it */ assert(zone->tcp_conn == -1); zone->tcp_conn = conn; zone->tcp_waiting = 0; /* stop udp (if any) */ if(zone->zone_handler.fd != -1) xfrd_udp_release(zone); if(!xfrd_tcp_open(set, zone)) return; xfrd_tcp_xfr(set, zone); } else { assert(!set->tcp_waiting_first); set->tcp_count --; assert(set->tcp_count >= 0); } } nsd-3.2.16/configparser.c0000664000175000017500000023533412173226547014224 0ustar matjematje/* A Bison parser, made by GNU Bison 2.5. */ /* Bison implementation for Yacc-like parsers in C Copyright (C) 1984, 1989-1990, 2000-2011 Free Software Foundation, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ /* As a special exception, you may create a larger work that contains part or all of the Bison parser skeleton and distribute that work under terms of your choice, so long as that work isn't itself a parser generator using the skeleton or a modified version thereof as a parser skeleton. Alternatively, if you modify or redistribute the parser skeleton itself, you may (at your option) remove this special exception, which will cause the skeleton and the resulting Bison output files to be licensed under the GNU General Public License without this special exception. This special exception was added by the Free Software Foundation in version 2.2 of Bison. */ /* C LALR(1) parser skeleton written by Richard Stallman, by simplifying the original so-called "semantic" parser. */ /* All symbols defined below should begin with yy or YY, to avoid infringing on user name space. This should be done even for local variables, as they might otherwise be expanded by user macros. There are some unavoidable exceptions within include files to define necessary library symbols; they are noted "INFRINGES ON USER NAME SPACE" below. */ /* Identify Bison output. */ #define YYBISON 1 /* Bison version. */ #define YYBISON_VERSION "2.5" /* Skeleton name. */ #define YYSKELETON_NAME "yacc.c" /* Pure parsers. */ #define YYPURE 0 /* Push parsers. */ #define YYPUSH 0 /* Pull parsers. */ #define YYPULL 1 /* Using locations. */ #define YYLSP_NEEDED 0 /* Copy the first part of user declarations. */ /* Line 268 of yacc.c */ #line 10 "configparser.y" #include "config.h" #include #include #include #include #include #include "options.h" #include "util.h" #include "rrl.h" #include "configyyrename.h" int c_lex(void); void c_error(const char *message); #ifdef __cplusplus extern "C" #endif /* __cplusplus */ /* these need to be global, otherwise they cannot be used inside yacc */ extern config_parser_state_t* cfg_parser; static int server_settings_seen = 0; #if 0 #define OUTYY(s) printf s /* used ONLY when debugging */ #else #define OUTYY(s) #endif /* Line 268 of yacc.c */ #line 104 "configparser.c" /* Enabling traces. */ #ifndef YYDEBUG # define YYDEBUG 0 #endif /* Enabling verbose error messages. */ #ifdef YYERROR_VERBOSE # undef YYERROR_VERBOSE # define YYERROR_VERBOSE 1 #else # define YYERROR_VERBOSE 0 #endif /* Enabling the token table. */ #ifndef YYTOKEN_TABLE # define YYTOKEN_TABLE 0 #endif /* Tokens. */ #ifndef YYTOKENTYPE # define YYTOKENTYPE /* Put the tokens into the symbol table, so that GDB and other debuggers know about them. */ enum yytokentype { SPACE = 258, LETTER = 259, NEWLINE = 260, COMMENT = 261, COLON = 262, ANY = 263, ZONESTR = 264, STRING = 265, VAR_SERVER = 266, VAR_NAME = 267, VAR_IP_ADDRESS = 268, VAR_IP_TRANSPARENT = 269, VAR_DEBUG_MODE = 270, VAR_IP4_ONLY = 271, VAR_IP6_ONLY = 272, VAR_DATABASE = 273, VAR_IDENTITY = 274, VAR_NSID = 275, VAR_LOGFILE = 276, VAR_SERVER_COUNT = 277, VAR_TCP_COUNT = 278, VAR_PIDFILE = 279, VAR_PORT = 280, VAR_STATISTICS = 281, VAR_ZONESTATSFILE = 282, VAR_CHROOT = 283, VAR_USERNAME = 284, VAR_ZONESDIR = 285, VAR_XFRDFILE = 286, VAR_DIFFFILE = 287, VAR_XFRD_RELOAD_TIMEOUT = 288, VAR_TCP_QUERY_COUNT = 289, VAR_TCP_TIMEOUT = 290, VAR_IPV4_EDNS_SIZE = 291, VAR_IPV6_EDNS_SIZE = 292, VAR_ZONEFILE = 293, VAR_ZONE = 294, VAR_ALLOW_NOTIFY = 295, VAR_REQUEST_XFR = 296, VAR_NOTIFY = 297, VAR_PROVIDE_XFR = 298, VAR_NOTIFY_RETRY = 299, VAR_OUTGOING_INTERFACE = 300, VAR_ALLOW_AXFR_FALLBACK = 301, VAR_KEY = 302, VAR_ALGORITHM = 303, VAR_SECRET = 304, VAR_AXFR = 305, VAR_UDP = 306, VAR_VERBOSITY = 307, VAR_HIDE_VERSION = 308, VAR_RRL_SIZE = 309, VAR_RRL_RATELIMIT = 310, VAR_RRL_SLIP = 311, VAR_RRL_IPV4_PREFIX_LENGTH = 312, VAR_RRL_IPV6_PREFIX_LENGTH = 313, VAR_RRL_WHITELIST_RATELIMIT = 314, VAR_RRL_WHITELIST = 315 }; #endif /* Tokens. */ #define SPACE 258 #define LETTER 259 #define NEWLINE 260 #define COMMENT 261 #define COLON 262 #define ANY 263 #define ZONESTR 264 #define STRING 265 #define VAR_SERVER 266 #define VAR_NAME 267 #define VAR_IP_ADDRESS 268 #define VAR_IP_TRANSPARENT 269 #define VAR_DEBUG_MODE 270 #define VAR_IP4_ONLY 271 #define VAR_IP6_ONLY 272 #define VAR_DATABASE 273 #define VAR_IDENTITY 274 #define VAR_NSID 275 #define VAR_LOGFILE 276 #define VAR_SERVER_COUNT 277 #define VAR_TCP_COUNT 278 #define VAR_PIDFILE 279 #define VAR_PORT 280 #define VAR_STATISTICS 281 #define VAR_ZONESTATSFILE 282 #define VAR_CHROOT 283 #define VAR_USERNAME 284 #define VAR_ZONESDIR 285 #define VAR_XFRDFILE 286 #define VAR_DIFFFILE 287 #define VAR_XFRD_RELOAD_TIMEOUT 288 #define VAR_TCP_QUERY_COUNT 289 #define VAR_TCP_TIMEOUT 290 #define VAR_IPV4_EDNS_SIZE 291 #define VAR_IPV6_EDNS_SIZE 292 #define VAR_ZONEFILE 293 #define VAR_ZONE 294 #define VAR_ALLOW_NOTIFY 295 #define VAR_REQUEST_XFR 296 #define VAR_NOTIFY 297 #define VAR_PROVIDE_XFR 298 #define VAR_NOTIFY_RETRY 299 #define VAR_OUTGOING_INTERFACE 300 #define VAR_ALLOW_AXFR_FALLBACK 301 #define VAR_KEY 302 #define VAR_ALGORITHM 303 #define VAR_SECRET 304 #define VAR_AXFR 305 #define VAR_UDP 306 #define VAR_VERBOSITY 307 #define VAR_HIDE_VERSION 308 #define VAR_RRL_SIZE 309 #define VAR_RRL_RATELIMIT 310 #define VAR_RRL_SLIP 311 #define VAR_RRL_IPV4_PREFIX_LENGTH 312 #define VAR_RRL_IPV6_PREFIX_LENGTH 313 #define VAR_RRL_WHITELIST_RATELIMIT 314 #define VAR_RRL_WHITELIST 315 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED typedef union YYSTYPE { /* Line 293 of yacc.c */ #line 41 "configparser.y" char* str; /* Line 293 of yacc.c */ #line 266 "configparser.c" } YYSTYPE; # define YYSTYPE_IS_TRIVIAL 1 # define yystype YYSTYPE /* obsolescent; will be withdrawn */ # define YYSTYPE_IS_DECLARED 1 #endif /* Copy the second part of user declarations. */ /* Line 343 of yacc.c */ #line 278 "configparser.c" #ifdef short # undef short #endif #ifdef YYTYPE_UINT8 typedef YYTYPE_UINT8 yytype_uint8; #else typedef unsigned char yytype_uint8; #endif #ifdef YYTYPE_INT8 typedef YYTYPE_INT8 yytype_int8; #elif (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) typedef signed char yytype_int8; #else typedef short int yytype_int8; #endif #ifdef YYTYPE_UINT16 typedef YYTYPE_UINT16 yytype_uint16; #else typedef unsigned short int yytype_uint16; #endif #ifdef YYTYPE_INT16 typedef YYTYPE_INT16 yytype_int16; #else typedef short int yytype_int16; #endif #ifndef YYSIZE_T # ifdef __SIZE_TYPE__ # define YYSIZE_T __SIZE_TYPE__ # elif defined size_t # define YYSIZE_T size_t # elif ! defined YYSIZE_T && (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) # include /* INFRINGES ON USER NAME SPACE */ # define YYSIZE_T size_t # else # define YYSIZE_T unsigned int # endif #endif #define YYSIZE_MAXIMUM ((YYSIZE_T) -1) #ifndef YY_ # if defined YYENABLE_NLS && YYENABLE_NLS # if ENABLE_NLS # include /* INFRINGES ON USER NAME SPACE */ # define YY_(msgid) dgettext ("bison-runtime", msgid) # endif # endif # ifndef YY_ # define YY_(msgid) msgid # endif #endif /* Suppress unused-variable warnings by "using" E. */ #if ! defined lint || defined __GNUC__ # define YYUSE(e) ((void) (e)) #else # define YYUSE(e) /* empty */ #endif /* Identity function, used to suppress warnings about constant conditions. */ #ifndef lint # define YYID(n) (n) #else #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static int YYID (int yyi) #else static int YYID (yyi) int yyi; #endif { return yyi; } #endif #if ! defined yyoverflow || YYERROR_VERBOSE /* The parser invokes alloca or malloc; define the necessary symbols. */ # ifdef YYSTACK_USE_ALLOCA # if YYSTACK_USE_ALLOCA # ifdef __GNUC__ # define YYSTACK_ALLOC __builtin_alloca # elif defined __BUILTIN_VA_ARG_INCR # include /* INFRINGES ON USER NAME SPACE */ # elif defined _AIX # define YYSTACK_ALLOC __alloca # elif defined _MSC_VER # include /* INFRINGES ON USER NAME SPACE */ # define alloca _alloca # else # define YYSTACK_ALLOC alloca # if ! defined _ALLOCA_H && ! defined EXIT_SUCCESS && (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) # include /* INFRINGES ON USER NAME SPACE */ # ifndef EXIT_SUCCESS # define EXIT_SUCCESS 0 # endif # endif # endif # endif # endif # ifdef YYSTACK_ALLOC /* Pacify GCC's `empty if-body' warning. */ # define YYSTACK_FREE(Ptr) do { /* empty */; } while (YYID (0)) # ifndef YYSTACK_ALLOC_MAXIMUM /* The OS might guarantee only one guard page at the bottom of the stack, and a page size can be as small as 4096 bytes. So we cannot safely invoke alloca (N) if N exceeds 4096. Use a slightly smaller number to allow for a few compiler-allocated temporary stack slots. */ # define YYSTACK_ALLOC_MAXIMUM 4032 /* reasonable circa 2006 */ # endif # else # define YYSTACK_ALLOC YYMALLOC # define YYSTACK_FREE YYFREE # ifndef YYSTACK_ALLOC_MAXIMUM # define YYSTACK_ALLOC_MAXIMUM YYSIZE_MAXIMUM # endif # if (defined __cplusplus && ! defined EXIT_SUCCESS \ && ! ((defined YYMALLOC || defined malloc) \ && (defined YYFREE || defined free))) # include /* INFRINGES ON USER NAME SPACE */ # ifndef EXIT_SUCCESS # define EXIT_SUCCESS 0 # endif # endif # ifndef YYMALLOC # define YYMALLOC malloc # if ! defined malloc && ! defined EXIT_SUCCESS && (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) void *malloc (YYSIZE_T); /* INFRINGES ON USER NAME SPACE */ # endif # endif # ifndef YYFREE # define YYFREE free # if ! defined free && ! defined EXIT_SUCCESS && (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) void free (void *); /* INFRINGES ON USER NAME SPACE */ # endif # endif # endif #endif /* ! defined yyoverflow || YYERROR_VERBOSE */ #if (! defined yyoverflow \ && (! defined __cplusplus \ || (defined YYSTYPE_IS_TRIVIAL && YYSTYPE_IS_TRIVIAL))) /* A type that is properly aligned for any stack member. */ union yyalloc { yytype_int16 yyss_alloc; YYSTYPE yyvs_alloc; }; /* The size of the maximum gap between one aligned stack and the next. */ # define YYSTACK_GAP_MAXIMUM (sizeof (union yyalloc) - 1) /* The size of an array large to enough to hold all stacks, each with N elements. */ # define YYSTACK_BYTES(N) \ ((N) * (sizeof (yytype_int16) + sizeof (YYSTYPE)) \ + YYSTACK_GAP_MAXIMUM) # define YYCOPY_NEEDED 1 /* Relocate STACK from its old location to the new one. The local variables YYSIZE and YYSTACKSIZE give the old and new number of elements in the stack, and YYPTR gives the new location of the stack. Advance YYPTR to a properly aligned location for the next stack. */ # define YYSTACK_RELOCATE(Stack_alloc, Stack) \ do \ { \ YYSIZE_T yynewbytes; \ YYCOPY (&yyptr->Stack_alloc, Stack, yysize); \ Stack = &yyptr->Stack_alloc; \ yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \ yyptr += yynewbytes / sizeof (*yyptr); \ } \ while (YYID (0)) #endif #if defined YYCOPY_NEEDED && YYCOPY_NEEDED /* Copy COUNT objects from FROM to TO. The source and destination do not overlap. */ # ifndef YYCOPY # if defined __GNUC__ && 1 < __GNUC__ # define YYCOPY(To, From, Count) \ __builtin_memcpy (To, From, (Count) * sizeof (*(From))) # else # define YYCOPY(To, From, Count) \ do \ { \ YYSIZE_T yyi; \ for (yyi = 0; yyi < (Count); yyi++) \ (To)[yyi] = (From)[yyi]; \ } \ while (YYID (0)) # endif # endif #endif /* !YYCOPY_NEEDED */ /* YYFINAL -- State number of the termination state. */ #define YYFINAL 2 /* YYLAST -- Last index in YYTABLE. */ #define YYLAST 115 /* YYNTOKENS -- Number of terminals. */ #define YYNTOKENS 61 /* YYNNTS -- Number of nonterminals. */ #define YYNNTS 59 /* YYNRULES -- Number of rules. */ #define YYNRULES 110 /* YYNRULES -- Number of states. */ #define YYNSTATES 167 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX. */ #define YYUNDEFTOK 2 #define YYMAXUTOK 315 #define YYTRANSLATE(YYX) \ ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK) /* YYTRANSLATE[YYLEX] -- Bison symbol number corresponding to YYLEX. */ static const yytype_uint8 yytranslate[] = { 0, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60 }; #if YYDEBUG /* YYPRHS[YYN] -- Index of the first RHS symbol of rule number YYN in YYRHS. */ static const yytype_uint16 yyprhs[] = { 0, 0, 3, 4, 7, 10, 13, 16, 18, 21, 22, 24, 26, 28, 30, 32, 34, 36, 38, 40, 42, 44, 46, 48, 50, 52, 54, 56, 58, 60, 62, 64, 66, 68, 70, 72, 74, 76, 78, 80, 82, 84, 86, 88, 91, 94, 97, 100, 103, 106, 109, 112, 115, 118, 121, 124, 127, 130, 133, 136, 139, 142, 145, 148, 151, 154, 157, 160, 163, 166, 169, 172, 175, 178, 181, 184, 187, 189, 192, 194, 196, 198, 200, 202, 204, 206, 208, 210, 212, 214, 217, 220, 224, 227, 230, 234, 238, 242, 245, 249, 252, 255, 258, 260, 263, 265, 267, 269, 271, 274, 277 }; /* YYRHS -- A `-1'-separated list of the rules' RHS. */ static const yytype_int8 yyrhs[] = { 62, 0, -1, -1, 62, 63, -1, 64, 65, -1, 100, 101, -1, 114, 115, -1, 11, -1, 65, 66, -1, -1, 67, -1, 68, -1, 69, -1, 72, -1, 73, -1, 74, -1, 75, -1, 76, -1, 77, -1, 78, -1, 79, -1, 80, -1, 81, -1, 82, -1, 83, -1, 84, -1, 85, -1, 86, -1, 87, -1, 88, -1, 89, -1, 90, -1, 91, -1, 92, -1, 93, -1, 70, -1, 71, -1, 94, -1, 95, -1, 96, -1, 97, -1, 98, -1, 99, -1, 13, 10, -1, 14, 10, -1, 15, 10, -1, 52, 10, -1, 53, 10, -1, 16, 10, -1, 17, 10, -1, 18, 10, -1, 19, 10, -1, 20, 10, -1, 21, 10, -1, 22, 10, -1, 23, 10, -1, 24, 10, -1, 25, 10, -1, 26, 10, -1, 27, 10, -1, 28, 10, -1, 29, 10, -1, 30, 10, -1, 32, 10, -1, 31, 10, -1, 33, 10, -1, 34, 10, -1, 35, 10, -1, 36, 10, -1, 37, 10, -1, 54, 10, -1, 55, 10, -1, 56, 10, -1, 57, 10, -1, 58, 10, -1, 59, 10, -1, 39, -1, 101, 102, -1, 102, -1, 103, -1, 104, -1, 105, -1, 106, -1, 108, -1, 109, -1, 110, -1, 111, -1, 112, -1, 113, -1, 12, 10, -1, 38, 10, -1, 40, 10, 10, -1, 41, 107, -1, 10, 10, -1, 50, 10, 10, -1, 51, 10, 10, -1, 42, 10, 10, -1, 44, 10, -1, 43, 10, 10, -1, 45, 10, -1, 46, 10, -1, 60, 10, -1, 47, -1, 115, 116, -1, 116, -1, 117, -1, 118, -1, 119, -1, 12, 10, -1, 48, 10, -1, 49, 10, -1 }; /* YYRLINE[YYN] -- source line where rule number YYN was defined. */ static const yytype_uint16 yyrline[] = { 0, 67, 67, 67, 68, 68, 69, 72, 80, 80, 81, 81, 81, 81, 82, 82, 82, 82, 82, 83, 83, 83, 83, 84, 84, 84, 85, 85, 86, 86, 86, 87, 87, 87, 88, 88, 88, 89, 89, 89, 90, 90, 90, 91, 113, 121, 129, 137, 145, 153, 161, 167, 173, 193, 199, 207, 215, 221, 227, 235, 241, 247, 253, 259, 265, 271, 279, 287, 295, 303, 311, 321, 329, 339, 349, 359, 369, 391, 391, 392, 392, 392, 393, 393, 393, 393, 394, 394, 394, 395, 404, 413, 424, 428, 440, 453, 467, 480, 488, 499, 511, 519, 529, 545, 545, 546, 546, 546, 547, 556, 565 }; #endif #if YYDEBUG || YYERROR_VERBOSE || YYTOKEN_TABLE /* YYTNAME[SYMBOL-NUM] -- String name of the symbol SYMBOL-NUM. First, the terminals, then, starting at YYNTOKENS, nonterminals. */ static const char *const yytname[] = { "$end", "error", "$undefined", "SPACE", "LETTER", "NEWLINE", "COMMENT", "COLON", "ANY", "ZONESTR", "STRING", "VAR_SERVER", "VAR_NAME", "VAR_IP_ADDRESS", "VAR_IP_TRANSPARENT", "VAR_DEBUG_MODE", "VAR_IP4_ONLY", "VAR_IP6_ONLY", "VAR_DATABASE", "VAR_IDENTITY", "VAR_NSID", "VAR_LOGFILE", "VAR_SERVER_COUNT", "VAR_TCP_COUNT", "VAR_PIDFILE", "VAR_PORT", "VAR_STATISTICS", "VAR_ZONESTATSFILE", "VAR_CHROOT", "VAR_USERNAME", "VAR_ZONESDIR", "VAR_XFRDFILE", "VAR_DIFFFILE", "VAR_XFRD_RELOAD_TIMEOUT", "VAR_TCP_QUERY_COUNT", "VAR_TCP_TIMEOUT", "VAR_IPV4_EDNS_SIZE", "VAR_IPV6_EDNS_SIZE", "VAR_ZONEFILE", "VAR_ZONE", "VAR_ALLOW_NOTIFY", "VAR_REQUEST_XFR", "VAR_NOTIFY", "VAR_PROVIDE_XFR", "VAR_NOTIFY_RETRY", "VAR_OUTGOING_INTERFACE", "VAR_ALLOW_AXFR_FALLBACK", "VAR_KEY", "VAR_ALGORITHM", "VAR_SECRET", "VAR_AXFR", "VAR_UDP", "VAR_VERBOSITY", "VAR_HIDE_VERSION", "VAR_RRL_SIZE", "VAR_RRL_RATELIMIT", "VAR_RRL_SLIP", "VAR_RRL_IPV4_PREFIX_LENGTH", "VAR_RRL_IPV6_PREFIX_LENGTH", "VAR_RRL_WHITELIST_RATELIMIT", "VAR_RRL_WHITELIST", "$accept", "toplevelvars", "toplevelvar", "serverstart", "contents_server", "content_server", "server_ip_address", "server_ip_transparent", "server_debug_mode", "server_verbosity", "server_hide_version", "server_ip4_only", "server_ip6_only", "server_database", "server_identity", "server_nsid", "server_logfile", "server_server_count", "server_tcp_count", "server_pidfile", "server_port", "server_statistics", "server_zonestatsfile", "server_chroot", "server_username", "server_zonesdir", "server_difffile", "server_xfrdfile", "server_xfrd_reload_timeout", "server_tcp_query_count", "server_tcp_timeout", "server_ipv4_edns_size", "server_ipv6_edns_size", "server_rrl_size", "server_rrl_ratelimit", "server_rrl_slip", "server_rrl_ipv4_prefix_length", "server_rrl_ipv6_prefix_length", "server_rrl_whitelist_ratelimit", "zonestart", "contents_zone", "content_zone", "zone_name", "zone_zonefile", "zone_allow_notify", "zone_request_xfr", "zone_request_xfr_data", "zone_notify", "zone_notify_retry", "zone_provide_xfr", "zone_outgoing_interface", "zone_allow_axfr_fallback", "zone_rrl_whitelist", "keystart", "contents_key", "content_key", "key_name", "key_algorithm", "key_secret", 0 }; #endif # ifdef YYPRINT /* YYTOKNUM[YYLEX-NUM] -- Internal token number corresponding to token YYLEX-NUM. */ static const yytype_uint16 yytoknum[] = { 0, 256, 257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315 }; # endif /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives. */ static const yytype_uint8 yyr1[] = { 0, 61, 62, 62, 63, 63, 63, 64, 65, 65, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 101, 102, 102, 102, 102, 102, 102, 102, 102, 102, 102, 103, 104, 105, 106, 107, 107, 107, 108, 109, 110, 111, 112, 113, 114, 115, 115, 116, 116, 116, 117, 118, 119 }; /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN. */ static const yytype_uint8 yyr2[] = { 0, 2, 0, 2, 2, 2, 2, 1, 2, 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 1, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 2, 3, 2, 2, 3, 3, 3, 2, 3, 2, 2, 2, 1, 2, 1, 1, 1, 1, 2, 2, 2 }; /* YYDEFACT[STATE-NAME] -- Default reduction number in state STATE-NUM. Performed when YYTABLE doesn't specify something else to do. Zero means the default is an error. */ static const yytype_uint8 yydefact[] = { 2, 0, 1, 7, 76, 102, 3, 9, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 5, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 0, 0, 0, 6, 104, 105, 106, 107, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 8, 10, 11, 12, 35, 36, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 37, 38, 39, 40, 41, 42, 89, 90, 0, 0, 0, 0, 92, 0, 0, 97, 99, 100, 101, 77, 108, 109, 110, 103, 43, 44, 45, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 64, 63, 65, 66, 67, 68, 69, 46, 47, 70, 71, 72, 73, 74, 75, 91, 93, 0, 0, 96, 98, 94, 95 }; /* YYDEFGOTO[NTERM-NUM]. */ static const yytype_int8 yydefgoto[] = { -1, 1, 6, 7, 10, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 8, 21, 22, 23, 24, 25, 26, 114, 27, 28, 29, 30, 31, 32, 9, 36, 37, 38, 39, 40 }; /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing STATE-NUM. */ #define YYPACT_NINF -13 static const yytype_int8 yypact[] = { -13, 2, -13, -13, -13, -13, -13, -13, -12, -11, 37, -6, -5, -4, -7, -3, -2, -1, 0, 1, 4, -12, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, 5, 6, 7, -11, -13, -13, -13, -13, 8, 9, 10, 11, 12, 13, 14, 15, 17, 25, 26, 29, 30, 32, 35, 36, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 87, 88, 89, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, 90, 91, 92, 93, -13, 94, 95, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, 96, 97, -13, -13, -13, -13 }; /* YYPGOTO[NTERM-NUM]. */ static const yytype_int8 yypgoto[] = { -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -9, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, -13, 79, -13, -13, -13 }; /* YYTABLE[YYPACT[STATE-NUM]]. What to do in state STATE-NUM. If positive, shift that token. If negative, reduce the rule which number is the opposite. If YYTABLE_NINF, syntax error. */ #define YYTABLE_NINF -1 static const yytype_uint8 yytable[] = { 11, 33, 2, 111, 108, 109, 110, 115, 116, 117, 118, 119, 121, 3, 120, 122, 123, 124, 126, 127, 128, 129, 130, 131, 132, 133, 12, 134, 13, 14, 15, 16, 17, 18, 19, 135, 136, 34, 35, 137, 138, 4, 139, 112, 113, 140, 141, 0, 20, 5, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 153, 154, 155, 66, 67, 68, 69, 70, 71, 72, 73, 156, 157, 158, 159, 160, 161, 162, 163, 164, 165, 166, 0, 0, 0, 0, 0, 0, 0, 125 }; #define yypact_value_is_default(yystate) \ ((yystate) == (-13)) #define yytable_value_is_error(yytable_value) \ YYID (0) static const yytype_int8 yycheck[] = { 12, 12, 0, 10, 10, 10, 10, 10, 10, 10, 10, 10, 21, 11, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 38, 10, 40, 41, 42, 43, 44, 45, 46, 10, 10, 48, 49, 10, 10, 39, 10, 50, 51, 10, 10, -1, 60, 47, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 52, 53, 54, 55, 56, 57, 58, 59, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, -1, -1, -1, -1, -1, -1, -1, 36 }; /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing symbol of state STATE-NUM. */ static const yytype_uint8 yystos[] = { 0, 62, 0, 11, 39, 47, 63, 64, 100, 114, 65, 12, 38, 40, 41, 42, 43, 44, 45, 46, 60, 101, 102, 103, 104, 105, 106, 108, 109, 110, 111, 112, 113, 12, 48, 49, 115, 116, 117, 118, 119, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 52, 53, 54, 55, 56, 57, 58, 59, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 90, 91, 92, 93, 94, 95, 96, 97, 98, 99, 10, 10, 10, 10, 50, 51, 107, 10, 10, 10, 10, 10, 10, 102, 10, 10, 10, 116, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10, 10 }; #define yyerrok (yyerrstatus = 0) #define yyclearin (yychar = YYEMPTY) #define YYEMPTY (-2) #define YYEOF 0 #define YYACCEPT goto yyacceptlab #define YYABORT goto yyabortlab #define YYERROR goto yyerrorlab /* Like YYERROR except do call yyerror. This remains here temporarily to ease the transition to the new meaning of YYERROR, for GCC. Once GCC version 2 has supplanted version 1, this can go. However, YYFAIL appears to be in use. Nevertheless, it is formally deprecated in Bison 2.4.2's NEWS entry, where a plan to phase it out is discussed. */ #define YYFAIL goto yyerrlab #if defined YYFAIL /* This is here to suppress warnings from the GCC cpp's -Wunused-macros. Normally we don't worry about that warning, but some users do, and we want to make it easy for users to remove YYFAIL uses, which will produce warnings from Bison 2.5. */ #endif #define YYRECOVERING() (!!yyerrstatus) #define YYBACKUP(Token, Value) \ do \ if (yychar == YYEMPTY && yylen == 1) \ { \ yychar = (Token); \ yylval = (Value); \ YYPOPSTACK (1); \ goto yybackup; \ } \ else \ { \ yyerror (YY_("syntax error: cannot back up")); \ YYERROR; \ } \ while (YYID (0)) #define YYTERROR 1 #define YYERRCODE 256 /* YYLLOC_DEFAULT -- Set CURRENT to span from RHS[1] to RHS[N]. If N is 0, then set CURRENT to the empty location which ends the previous symbol: RHS[0] (always defined). */ #define YYRHSLOC(Rhs, K) ((Rhs)[K]) #ifndef YYLLOC_DEFAULT # define YYLLOC_DEFAULT(Current, Rhs, N) \ do \ if (YYID (N)) \ { \ (Current).first_line = YYRHSLOC (Rhs, 1).first_line; \ (Current).first_column = YYRHSLOC (Rhs, 1).first_column; \ (Current).last_line = YYRHSLOC (Rhs, N).last_line; \ (Current).last_column = YYRHSLOC (Rhs, N).last_column; \ } \ else \ { \ (Current).first_line = (Current).last_line = \ YYRHSLOC (Rhs, 0).last_line; \ (Current).first_column = (Current).last_column = \ YYRHSLOC (Rhs, 0).last_column; \ } \ while (YYID (0)) #endif /* This macro is provided for backward compatibility. */ #ifndef YY_LOCATION_PRINT # define YY_LOCATION_PRINT(File, Loc) ((void) 0) #endif /* YYLEX -- calling `yylex' with the right arguments. */ #ifdef YYLEX_PARAM # define YYLEX yylex (YYLEX_PARAM) #else # define YYLEX yylex () #endif /* Enable debugging if requested. */ #if YYDEBUG # ifndef YYFPRINTF # include /* INFRINGES ON USER NAME SPACE */ # define YYFPRINTF fprintf # endif # define YYDPRINTF(Args) \ do { \ if (yydebug) \ YYFPRINTF Args; \ } while (YYID (0)) # define YY_SYMBOL_PRINT(Title, Type, Value, Location) \ do { \ if (yydebug) \ { \ YYFPRINTF (stderr, "%s ", Title); \ yy_symbol_print (stderr, \ Type, Value); \ YYFPRINTF (stderr, "\n"); \ } \ } while (YYID (0)) /*--------------------------------. | Print this symbol on YYOUTPUT. | `--------------------------------*/ /*ARGSUSED*/ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static void yy_symbol_value_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep) #else static void yy_symbol_value_print (yyoutput, yytype, yyvaluep) FILE *yyoutput; int yytype; YYSTYPE const * const yyvaluep; #endif { if (!yyvaluep) return; # ifdef YYPRINT if (yytype < YYNTOKENS) YYPRINT (yyoutput, yytoknum[yytype], *yyvaluep); # else YYUSE (yyoutput); # endif switch (yytype) { default: break; } } /*--------------------------------. | Print this symbol on YYOUTPUT. | `--------------------------------*/ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static void yy_symbol_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep) #else static void yy_symbol_print (yyoutput, yytype, yyvaluep) FILE *yyoutput; int yytype; YYSTYPE const * const yyvaluep; #endif { if (yytype < YYNTOKENS) YYFPRINTF (yyoutput, "token %s (", yytname[yytype]); else YYFPRINTF (yyoutput, "nterm %s (", yytname[yytype]); yy_symbol_value_print (yyoutput, yytype, yyvaluep); YYFPRINTF (yyoutput, ")"); } /*------------------------------------------------------------------. | yy_stack_print -- Print the state stack from its BOTTOM up to its | | TOP (included). | `------------------------------------------------------------------*/ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static void yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop) #else static void yy_stack_print (yybottom, yytop) yytype_int16 *yybottom; yytype_int16 *yytop; #endif { YYFPRINTF (stderr, "Stack now"); for (; yybottom <= yytop; yybottom++) { int yybot = *yybottom; YYFPRINTF (stderr, " %d", yybot); } YYFPRINTF (stderr, "\n"); } # define YY_STACK_PRINT(Bottom, Top) \ do { \ if (yydebug) \ yy_stack_print ((Bottom), (Top)); \ } while (YYID (0)) /*------------------------------------------------. | Report that the YYRULE is going to be reduced. | `------------------------------------------------*/ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static void yy_reduce_print (YYSTYPE *yyvsp, int yyrule) #else static void yy_reduce_print (yyvsp, yyrule) YYSTYPE *yyvsp; int yyrule; #endif { int yynrhs = yyr2[yyrule]; int yyi; unsigned long int yylno = yyrline[yyrule]; YYFPRINTF (stderr, "Reducing stack by rule %d (line %lu):\n", yyrule - 1, yylno); /* The symbols being reduced. */ for (yyi = 0; yyi < yynrhs; yyi++) { YYFPRINTF (stderr, " $%d = ", yyi + 1); yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi], &(yyvsp[(yyi + 1) - (yynrhs)]) ); YYFPRINTF (stderr, "\n"); } } # define YY_REDUCE_PRINT(Rule) \ do { \ if (yydebug) \ yy_reduce_print (yyvsp, Rule); \ } while (YYID (0)) /* Nonzero means print parse trace. It is left uninitialized so that multiple parsers can coexist. */ int yydebug; #else /* !YYDEBUG */ # define YYDPRINTF(Args) # define YY_SYMBOL_PRINT(Title, Type, Value, Location) # define YY_STACK_PRINT(Bottom, Top) # define YY_REDUCE_PRINT(Rule) #endif /* !YYDEBUG */ /* YYINITDEPTH -- initial size of the parser's stacks. */ #ifndef YYINITDEPTH # define YYINITDEPTH 200 #endif /* YYMAXDEPTH -- maximum size the stacks can grow to (effective only if the built-in stack extension method is used). Do not make this value too large; the results are undefined if YYSTACK_ALLOC_MAXIMUM < YYSTACK_BYTES (YYMAXDEPTH) evaluated with infinite-precision integer arithmetic. */ #ifndef YYMAXDEPTH # define YYMAXDEPTH 10000 #endif #if YYERROR_VERBOSE # ifndef yystrlen # if defined __GLIBC__ && defined _STRING_H # define yystrlen strlen # else /* Return the length of YYSTR. */ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static YYSIZE_T yystrlen (const char *yystr) #else static YYSIZE_T yystrlen (yystr) const char *yystr; #endif { YYSIZE_T yylen; for (yylen = 0; yystr[yylen]; yylen++) continue; return yylen; } # endif # endif # ifndef yystpcpy # if defined __GLIBC__ && defined _STRING_H && defined _GNU_SOURCE # define yystpcpy stpcpy # else /* Copy YYSRC to YYDEST, returning the address of the terminating '\0' in YYDEST. */ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static char * yystpcpy (char *yydest, const char *yysrc) #else static char * yystpcpy (yydest, yysrc) char *yydest; const char *yysrc; #endif { char *yyd = yydest; const char *yys = yysrc; while ((*yyd++ = *yys++) != '\0') continue; return yyd - 1; } # endif # endif # ifndef yytnamerr /* Copy to YYRES the contents of YYSTR after stripping away unnecessary quotes and backslashes, so that it's suitable for yyerror. The heuristic is that double-quoting is unnecessary unless the string contains an apostrophe, a comma, or backslash (other than backslash-backslash). YYSTR is taken from yytname. If YYRES is null, do not copy; instead, return the length of what the result would have been. */ static YYSIZE_T yytnamerr (char *yyres, const char *yystr) { if (*yystr == '"') { YYSIZE_T yyn = 0; char const *yyp = yystr; for (;;) switch (*++yyp) { case '\'': case ',': goto do_not_strip_quotes; case '\\': if (*++yyp != '\\') goto do_not_strip_quotes; /* Fall through. */ default: if (yyres) yyres[yyn] = *yyp; yyn++; break; case '"': if (yyres) yyres[yyn] = '\0'; return yyn; } do_not_strip_quotes: ; } if (! yyres) return yystrlen (yystr); return yystpcpy (yyres, yystr) - yyres; } # endif /* Copy into *YYMSG, which is of size *YYMSG_ALLOC, an error message about the unexpected token YYTOKEN for the state stack whose top is YYSSP. Return 0 if *YYMSG was successfully written. Return 1 if *YYMSG is not large enough to hold the message. In that case, also set *YYMSG_ALLOC to the required number of bytes. Return 2 if the required number of bytes is too large to store. */ static int yysyntax_error (YYSIZE_T *yymsg_alloc, char **yymsg, yytype_int16 *yyssp, int yytoken) { YYSIZE_T yysize0 = yytnamerr (0, yytname[yytoken]); YYSIZE_T yysize = yysize0; YYSIZE_T yysize1; enum { YYERROR_VERBOSE_ARGS_MAXIMUM = 5 }; /* Internationalized format string. */ const char *yyformat = 0; /* Arguments of yyformat. */ char const *yyarg[YYERROR_VERBOSE_ARGS_MAXIMUM]; /* Number of reported tokens (one for the "unexpected", one per "expected"). */ int yycount = 0; /* There are many possibilities here to consider: - Assume YYFAIL is not used. It's too flawed to consider. See for details. YYERROR is fine as it does not invoke this function. - If this state is a consistent state with a default action, then the only way this function was invoked is if the default action is an error action. In that case, don't check for expected tokens because there are none. - The only way there can be no lookahead present (in yychar) is if this state is a consistent state with a default action. Thus, detecting the absence of a lookahead is sufficient to determine that there is no unexpected or expected token to report. In that case, just report a simple "syntax error". - Don't assume there isn't a lookahead just because this state is a consistent state with a default action. There might have been a previous inconsistent state, consistent state with a non-default action, or user semantic action that manipulated yychar. - Of course, the expected token list depends on states to have correct lookahead information, and it depends on the parser not to perform extra reductions after fetching a lookahead from the scanner and before detecting a syntax error. Thus, state merging (from LALR or IELR) and default reductions corrupt the expected token list. However, the list is correct for canonical LR with one exception: it will still contain any token that will not be accepted due to an error action in a later state. */ if (yytoken != YYEMPTY) { int yyn = yypact[*yyssp]; yyarg[yycount++] = yytname[yytoken]; if (!yypact_value_is_default (yyn)) { /* Start YYX at -YYN if negative to avoid negative indexes in YYCHECK. In other words, skip the first -YYN actions for this state because they are default actions. */ int yyxbegin = yyn < 0 ? -yyn : 0; /* Stay within bounds of both yycheck and yytname. */ int yychecklim = YYLAST - yyn + 1; int yyxend = yychecklim < YYNTOKENS ? yychecklim : YYNTOKENS; int yyx; for (yyx = yyxbegin; yyx < yyxend; ++yyx) if (yycheck[yyx + yyn] == yyx && yyx != YYTERROR && !yytable_value_is_error (yytable[yyx + yyn])) { if (yycount == YYERROR_VERBOSE_ARGS_MAXIMUM) { yycount = 1; yysize = yysize0; break; } yyarg[yycount++] = yytname[yyx]; yysize1 = yysize + yytnamerr (0, yytname[yyx]); if (! (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM)) return 2; yysize = yysize1; } } } switch (yycount) { # define YYCASE_(N, S) \ case N: \ yyformat = S; \ break YYCASE_(0, YY_("syntax error")); YYCASE_(1, YY_("syntax error, unexpected %s")); YYCASE_(2, YY_("syntax error, unexpected %s, expecting %s")); YYCASE_(3, YY_("syntax error, unexpected %s, expecting %s or %s")); YYCASE_(4, YY_("syntax error, unexpected %s, expecting %s or %s or %s")); YYCASE_(5, YY_("syntax error, unexpected %s, expecting %s or %s or %s or %s")); # undef YYCASE_ } yysize1 = yysize + yystrlen (yyformat); if (! (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM)) return 2; yysize = yysize1; if (*yymsg_alloc < yysize) { *yymsg_alloc = 2 * yysize; if (! (yysize <= *yymsg_alloc && *yymsg_alloc <= YYSTACK_ALLOC_MAXIMUM)) *yymsg_alloc = YYSTACK_ALLOC_MAXIMUM; return 1; } /* Avoid sprintf, as that infringes on the user's name space. Don't have undefined behavior even if the translation produced a string with the wrong number of "%s"s. */ { char *yyp = *yymsg; int yyi = 0; while ((*yyp = *yyformat) != '\0') if (*yyp == '%' && yyformat[1] == 's' && yyi < yycount) { yyp += yytnamerr (yyp, yyarg[yyi++]); yyformat += 2; } else { yyp++; yyformat++; } } return 0; } #endif /* YYERROR_VERBOSE */ /*-----------------------------------------------. | Release the memory associated to this symbol. | `-----------------------------------------------*/ /*ARGSUSED*/ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static void yydestruct (const char *yymsg, int yytype, YYSTYPE *yyvaluep) #else static void yydestruct (yymsg, yytype, yyvaluep) const char *yymsg; int yytype; YYSTYPE *yyvaluep; #endif { YYUSE (yyvaluep); if (!yymsg) yymsg = "Deleting"; YY_SYMBOL_PRINT (yymsg, yytype, yyvaluep, yylocationp); switch (yytype) { default: break; } } /* Prevent warnings from -Wmissing-prototypes. */ #ifdef YYPARSE_PARAM #if defined __STDC__ || defined __cplusplus int yyparse (void *YYPARSE_PARAM); #else int yyparse (); #endif #else /* ! YYPARSE_PARAM */ #if defined __STDC__ || defined __cplusplus int yyparse (void); #else int yyparse (); #endif #endif /* ! YYPARSE_PARAM */ /* The lookahead symbol. */ int yychar; /* The semantic value of the lookahead symbol. */ YYSTYPE yylval; /* Number of syntax errors so far. */ int yynerrs; /*----------. | yyparse. | `----------*/ #ifdef YYPARSE_PARAM #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) int yyparse (void *YYPARSE_PARAM) #else int yyparse (YYPARSE_PARAM) void *YYPARSE_PARAM; #endif #else /* ! YYPARSE_PARAM */ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) int yyparse (void) #else int yyparse () #endif #endif { int yystate; /* Number of tokens to shift before error messages enabled. */ int yyerrstatus; /* The stacks and their tools: `yyss': related to states. `yyvs': related to semantic values. Refer to the stacks thru separate pointers, to allow yyoverflow to reallocate them elsewhere. */ /* The state stack. */ yytype_int16 yyssa[YYINITDEPTH]; yytype_int16 *yyss; yytype_int16 *yyssp; /* The semantic value stack. */ YYSTYPE yyvsa[YYINITDEPTH]; YYSTYPE *yyvs; YYSTYPE *yyvsp; YYSIZE_T yystacksize; int yyn; int yyresult; /* Lookahead token as an internal (translated) token number. */ int yytoken; /* The variables used to return semantic value and location from the action routines. */ YYSTYPE yyval; #if YYERROR_VERBOSE /* Buffer for error messages, and its allocated size. */ char yymsgbuf[128]; char *yymsg = yymsgbuf; YYSIZE_T yymsg_alloc = sizeof yymsgbuf; #endif #define YYPOPSTACK(N) (yyvsp -= (N), yyssp -= (N)) /* The number of symbols on the RHS of the reduced rule. Keep to zero when no symbol should be popped. */ int yylen = 0; yytoken = 0; yyss = yyssa; yyvs = yyvsa; yystacksize = YYINITDEPTH; YYDPRINTF ((stderr, "Starting parse\n")); yystate = 0; yyerrstatus = 0; yynerrs = 0; yychar = YYEMPTY; /* Cause a token to be read. */ /* Initialize stack pointers. Waste one element of value and location stack so that they stay on the same level as the state stack. The wasted elements are never initialized. */ yyssp = yyss; yyvsp = yyvs; goto yysetstate; /*------------------------------------------------------------. | yynewstate -- Push a new state, which is found in yystate. | `------------------------------------------------------------*/ yynewstate: /* In all cases, when you get here, the value and location stacks have just been pushed. So pushing a state here evens the stacks. */ yyssp++; yysetstate: *yyssp = yystate; if (yyss + yystacksize - 1 <= yyssp) { /* Get the current used size of the three stacks, in elements. */ YYSIZE_T yysize = yyssp - yyss + 1; #ifdef yyoverflow { /* Give user a chance to reallocate the stack. Use copies of these so that the &'s don't force the real ones into memory. */ YYSTYPE *yyvs1 = yyvs; yytype_int16 *yyss1 = yyss; /* Each stack pointer address is followed by the size of the data in use in that stack, in bytes. This used to be a conditional around just the two extra args, but that might be undefined if yyoverflow is a macro. */ yyoverflow (YY_("memory exhausted"), &yyss1, yysize * sizeof (*yyssp), &yyvs1, yysize * sizeof (*yyvsp), &yystacksize); yyss = yyss1; yyvs = yyvs1; } #else /* no yyoverflow */ # ifndef YYSTACK_RELOCATE goto yyexhaustedlab; # else /* Extend the stack our own way. */ if (YYMAXDEPTH <= yystacksize) goto yyexhaustedlab; yystacksize *= 2; if (YYMAXDEPTH < yystacksize) yystacksize = YYMAXDEPTH; { yytype_int16 *yyss1 = yyss; union yyalloc *yyptr = (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize)); if (! yyptr) goto yyexhaustedlab; YYSTACK_RELOCATE (yyss_alloc, yyss); YYSTACK_RELOCATE (yyvs_alloc, yyvs); # undef YYSTACK_RELOCATE if (yyss1 != yyssa) YYSTACK_FREE (yyss1); } # endif #endif /* no yyoverflow */ yyssp = yyss + yysize - 1; yyvsp = yyvs + yysize - 1; YYDPRINTF ((stderr, "Stack size increased to %lu\n", (unsigned long int) yystacksize)); if (yyss + yystacksize - 1 <= yyssp) YYABORT; } YYDPRINTF ((stderr, "Entering state %d\n", yystate)); if (yystate == YYFINAL) YYACCEPT; goto yybackup; /*-----------. | yybackup. | `-----------*/ yybackup: /* Do appropriate processing given the current state. Read a lookahead token if we need one and don't already have one. */ /* First try to decide what to do without reference to lookahead token. */ yyn = yypact[yystate]; if (yypact_value_is_default (yyn)) goto yydefault; /* Not known => get a lookahead token if don't already have one. */ /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol. */ if (yychar == YYEMPTY) { YYDPRINTF ((stderr, "Reading a token: ")); yychar = YYLEX; } if (yychar <= YYEOF) { yychar = yytoken = YYEOF; YYDPRINTF ((stderr, "Now at end of input.\n")); } else { yytoken = YYTRANSLATE (yychar); YY_SYMBOL_PRINT ("Next token is", yytoken, &yylval, &yylloc); } /* If the proper action on seeing token YYTOKEN is to reduce or to detect an error, take that action. */ yyn += yytoken; if (yyn < 0 || YYLAST < yyn || yycheck[yyn] != yytoken) goto yydefault; yyn = yytable[yyn]; if (yyn <= 0) { if (yytable_value_is_error (yyn)) goto yyerrlab; yyn = -yyn; goto yyreduce; } /* Count tokens shifted since error; after three, turn off error status. */ if (yyerrstatus) yyerrstatus--; /* Shift the lookahead token. */ YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc); /* Discard the shifted token. */ yychar = YYEMPTY; yystate = yyn; *++yyvsp = yylval; goto yynewstate; /*-----------------------------------------------------------. | yydefault -- do the default action for the current state. | `-----------------------------------------------------------*/ yydefault: yyn = yydefact[yystate]; if (yyn == 0) goto yyerrlab; goto yyreduce; /*-----------------------------. | yyreduce -- Do a reduction. | `-----------------------------*/ yyreduce: /* yyn is the number of a rule to reduce with. */ yylen = yyr2[yyn]; /* If YYLEN is nonzero, implement the default value of the action: `$$ = $1'. Otherwise, the following line sets YYVAL to garbage. This behavior is undocumented and Bison users should not rely upon it. Assigning to YYVAL unconditionally makes the parser a bit smaller, and it avoids a GCC warning that YYVAL may be used uninitialized. */ yyval = yyvsp[1-yylen]; YY_REDUCE_PRINT (yyn); switch (yyn) { case 7: /* Line 1806 of yacc.c */ #line 73 "configparser.y" { OUTYY(("\nP(server:)\n")); if(server_settings_seen) { yyerror("duplicate server: element."); } server_settings_seen = 1; } break; case 43: /* Line 1806 of yacc.c */ #line 92 "configparser.y" { OUTYY(("P(server_ip_address:%s)\n", (yyvsp[(2) - (2)].str))); if(cfg_parser->current_ip_address_option) { cfg_parser->current_ip_address_option->next = (ip_address_option_t*)region_alloc( cfg_parser->opt->region, sizeof(ip_address_option_t)); cfg_parser->current_ip_address_option = cfg_parser->current_ip_address_option->next; cfg_parser->current_ip_address_option->next=0; } else { cfg_parser->current_ip_address_option = (ip_address_option_t*)region_alloc( cfg_parser->opt->region, sizeof(ip_address_option_t)); cfg_parser->current_ip_address_option->next=0; cfg_parser->opt->ip_addresses = cfg_parser->current_ip_address_option; } cfg_parser->current_ip_address_option->address = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 44: /* Line 1806 of yacc.c */ #line 114 "configparser.y" { OUTYY(("P(server_ip_transparent:%s)\n", (yyvsp[(2) - (2)].str))); if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0) yyerror("expected yes or no."); else cfg_parser->opt->ip_transparent = (strcmp((yyvsp[(2) - (2)].str), "yes")==0); } break; case 45: /* Line 1806 of yacc.c */ #line 122 "configparser.y" { OUTYY(("P(server_debug_mode:%s)\n", (yyvsp[(2) - (2)].str))); if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0) yyerror("expected yes or no."); else cfg_parser->opt->debug_mode = (strcmp((yyvsp[(2) - (2)].str), "yes")==0); } break; case 46: /* Line 1806 of yacc.c */ #line 130 "configparser.y" { OUTYY(("P(server_verbosity:%s)\n", (yyvsp[(2) - (2)].str))); if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0) yyerror("number expected"); else cfg_parser->opt->verbosity = atoi((yyvsp[(2) - (2)].str)); } break; case 47: /* Line 1806 of yacc.c */ #line 138 "configparser.y" { OUTYY(("P(server_hide_version:%s)\n", (yyvsp[(2) - (2)].str))); if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0) yyerror("expected yes or no."); else cfg_parser->opt->hide_version = (strcmp((yyvsp[(2) - (2)].str), "yes")==0); } break; case 48: /* Line 1806 of yacc.c */ #line 146 "configparser.y" { OUTYY(("P(server_ip4_only:%s)\n", (yyvsp[(2) - (2)].str))); if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0) yyerror("expected yes or no."); else cfg_parser->opt->ip4_only = (strcmp((yyvsp[(2) - (2)].str), "yes")==0); } break; case 49: /* Line 1806 of yacc.c */ #line 154 "configparser.y" { OUTYY(("P(server_ip6_only:%s)\n", (yyvsp[(2) - (2)].str))); if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0) yyerror("expected yes or no."); else cfg_parser->opt->ip6_only = (strcmp((yyvsp[(2) - (2)].str), "yes")==0); } break; case 50: /* Line 1806 of yacc.c */ #line 162 "configparser.y" { OUTYY(("P(server_database:%s)\n", (yyvsp[(2) - (2)].str))); cfg_parser->opt->database = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 51: /* Line 1806 of yacc.c */ #line 168 "configparser.y" { OUTYY(("P(server_identity:%s)\n", (yyvsp[(2) - (2)].str))); cfg_parser->opt->identity = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 52: /* Line 1806 of yacc.c */ #line 174 "configparser.y" { unsigned char* nsid = 0; uint16_t nsid_len = 0; OUTYY(("P(server_nsid:%s)\n", (yyvsp[(2) - (2)].str))); if (strlen((yyvsp[(2) - (2)].str)) % 2 != 0) { yyerror("the NSID must be a hex string of an even length."); } else { nsid_len = strlen((yyvsp[(2) - (2)].str)) / 2; nsid = xalloc(nsid_len); if (hex_pton((yyvsp[(2) - (2)].str), nsid, nsid_len) == -1) yyerror("hex string cannot be parsed in NSID."); else cfg_parser->opt->nsid = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); free(nsid); } } break; case 53: /* Line 1806 of yacc.c */ #line 194 "configparser.y" { OUTYY(("P(server_logfile:%s)\n", (yyvsp[(2) - (2)].str))); cfg_parser->opt->logfile = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 54: /* Line 1806 of yacc.c */ #line 200 "configparser.y" { OUTYY(("P(server_server_count:%s)\n", (yyvsp[(2) - (2)].str))); if(atoi((yyvsp[(2) - (2)].str)) <= 0) yyerror("number greater than zero expected"); else cfg_parser->opt->server_count = atoi((yyvsp[(2) - (2)].str)); } break; case 55: /* Line 1806 of yacc.c */ #line 208 "configparser.y" { OUTYY(("P(server_tcp_count:%s)\n", (yyvsp[(2) - (2)].str))); if(atoi((yyvsp[(2) - (2)].str)) <= 0) yyerror("number greater than zero expected"); else cfg_parser->opt->tcp_count = atoi((yyvsp[(2) - (2)].str)); } break; case 56: /* Line 1806 of yacc.c */ #line 216 "configparser.y" { OUTYY(("P(server_pidfile:%s)\n", (yyvsp[(2) - (2)].str))); cfg_parser->opt->pidfile = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 57: /* Line 1806 of yacc.c */ #line 222 "configparser.y" { OUTYY(("P(server_port:%s)\n", (yyvsp[(2) - (2)].str))); cfg_parser->opt->port = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 58: /* Line 1806 of yacc.c */ #line 228 "configparser.y" { OUTYY(("P(server_statistics:%s)\n", (yyvsp[(2) - (2)].str))); if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0) yyerror("number expected"); else cfg_parser->opt->statistics = atoi((yyvsp[(2) - (2)].str)); } break; case 59: /* Line 1806 of yacc.c */ #line 236 "configparser.y" { OUTYY(("P(server_zonestatsfile:%s)\n", (yyvsp[(2) - (2)].str))); cfg_parser->opt->zonestatsfile = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 60: /* Line 1806 of yacc.c */ #line 242 "configparser.y" { OUTYY(("P(server_chroot:%s)\n", (yyvsp[(2) - (2)].str))); cfg_parser->opt->chroot = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 61: /* Line 1806 of yacc.c */ #line 248 "configparser.y" { OUTYY(("P(server_username:%s)\n", (yyvsp[(2) - (2)].str))); cfg_parser->opt->username = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 62: /* Line 1806 of yacc.c */ #line 254 "configparser.y" { OUTYY(("P(server_zonesdir:%s)\n", (yyvsp[(2) - (2)].str))); cfg_parser->opt->zonesdir = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 63: /* Line 1806 of yacc.c */ #line 260 "configparser.y" { OUTYY(("P(server_difffile:%s)\n", (yyvsp[(2) - (2)].str))); cfg_parser->opt->difffile = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 64: /* Line 1806 of yacc.c */ #line 266 "configparser.y" { OUTYY(("P(server_xfrdfile:%s)\n", (yyvsp[(2) - (2)].str))); cfg_parser->opt->xfrdfile = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 65: /* Line 1806 of yacc.c */ #line 272 "configparser.y" { OUTYY(("P(server_xfrd_reload_timeout:%s)\n", (yyvsp[(2) - (2)].str))); if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0) yyerror("number expected"); cfg_parser->opt->xfrd_reload_timeout = atoi((yyvsp[(2) - (2)].str)); } break; case 66: /* Line 1806 of yacc.c */ #line 280 "configparser.y" { OUTYY(("P(server_tcp_query_count:%s)\n", (yyvsp[(2) - (2)].str))); if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0) yyerror("number expected"); cfg_parser->opt->tcp_query_count = atoi((yyvsp[(2) - (2)].str)); } break; case 67: /* Line 1806 of yacc.c */ #line 288 "configparser.y" { OUTYY(("P(server_tcp_timeout:%s)\n", (yyvsp[(2) - (2)].str))); if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0) yyerror("number expected"); cfg_parser->opt->tcp_timeout = atoi((yyvsp[(2) - (2)].str)); } break; case 68: /* Line 1806 of yacc.c */ #line 296 "configparser.y" { OUTYY(("P(server_ipv4_edns_size:%s)\n", (yyvsp[(2) - (2)].str))); if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0) yyerror("number expected"); cfg_parser->opt->ipv4_edns_size = atoi((yyvsp[(2) - (2)].str)); } break; case 69: /* Line 1806 of yacc.c */ #line 304 "configparser.y" { OUTYY(("P(server_ipv6_edns_size:%s)\n", (yyvsp[(2) - (2)].str))); if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0) yyerror("number expected"); cfg_parser->opt->ipv6_edns_size = atoi((yyvsp[(2) - (2)].str)); } break; case 70: /* Line 1806 of yacc.c */ #line 312 "configparser.y" { OUTYY(("P(server_rrl_size:%s)\n", (yyvsp[(2) - (2)].str))); #ifdef RATELIMIT if(atoi((yyvsp[(2) - (2)].str)) <= 0) yyerror("number greater than zero expected"); cfg_parser->opt->rrl_size = atoi((yyvsp[(2) - (2)].str)); #endif } break; case 71: /* Line 1806 of yacc.c */ #line 322 "configparser.y" { OUTYY(("P(server_rrl_ratelimit:%s)\n", (yyvsp[(2) - (2)].str))); #ifdef RATELIMIT cfg_parser->opt->rrl_ratelimit = atoi((yyvsp[(2) - (2)].str)); #endif } break; case 72: /* Line 1806 of yacc.c */ #line 330 "configparser.y" { OUTYY(("P(server_rrl_slip:%s)\n", (yyvsp[(2) - (2)].str))); #ifdef RATELIMIT if(atoi((yyvsp[(2) - (2)].str)) < 0) yyerror("number equal or greater than zero expected"); cfg_parser->opt->rrl_slip = atoi((yyvsp[(2) - (2)].str)); #endif } break; case 73: /* Line 1806 of yacc.c */ #line 340 "configparser.y" { OUTYY(("P(server_rrl_ipv4_prefix_length:%s)\n", (yyvsp[(2) - (2)].str))); #ifdef RATELIMIT if(atoi((yyvsp[(2) - (2)].str)) < 0 || atoi((yyvsp[(2) - (2)].str)) > 32) yyerror("invalid IPv4 prefix length"); cfg_parser->opt->rrl_ipv4_prefix_length = atoi((yyvsp[(2) - (2)].str)); #endif } break; case 74: /* Line 1806 of yacc.c */ #line 350 "configparser.y" { OUTYY(("P(server_rrl_ipv6_prefix_length:%s)\n", (yyvsp[(2) - (2)].str))); #ifdef RATELIMIT if(atoi((yyvsp[(2) - (2)].str)) < 0 || atoi((yyvsp[(2) - (2)].str)) > 64) yyerror("invalid IPv6 prefix length"); cfg_parser->opt->rrl_ipv6_prefix_length = atoi((yyvsp[(2) - (2)].str)); #endif } break; case 75: /* Line 1806 of yacc.c */ #line 360 "configparser.y" { OUTYY(("P(server_rrl_whitelist_ratelimit:%s)\n", (yyvsp[(2) - (2)].str))); #ifdef RATELIMIT cfg_parser->opt->rrl_whitelist_ratelimit = atoi((yyvsp[(2) - (2)].str)); #endif } break; case 76: /* Line 1806 of yacc.c */ #line 370 "configparser.y" { OUTYY(("\nP(zone:)\n")); if(cfg_parser->current_zone) { if(!cfg_parser->current_zone->name) c_error("previous zone has no name"); else { if(!nsd_options_insert_zone(cfg_parser->opt, cfg_parser->current_zone)) c_error("duplicate zone"); } if(!cfg_parser->current_zone->zonefile) c_error("previous zone has no zonefile"); } cfg_parser->current_zone = zone_options_create(cfg_parser->opt->region); cfg_parser->current_allow_notify = 0; cfg_parser->current_request_xfr = 0; cfg_parser->current_notify = 0; cfg_parser->current_provide_xfr = 0; cfg_parser->current_outgoing_interface = 0; } break; case 89: /* Line 1806 of yacc.c */ #line 396 "configparser.y" { OUTYY(("P(zone_name:%s)\n", (yyvsp[(2) - (2)].str))); #ifndef NDEBUG assert(cfg_parser->current_zone); #endif cfg_parser->current_zone->name = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 90: /* Line 1806 of yacc.c */ #line 405 "configparser.y" { OUTYY(("P(zone_zonefile:%s)\n", (yyvsp[(2) - (2)].str))); #ifndef NDEBUG assert(cfg_parser->current_zone); #endif cfg_parser->current_zone->zonefile = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 91: /* Line 1806 of yacc.c */ #line 414 "configparser.y" { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)); OUTYY(("P(zone_allow_notify:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str))); if(cfg_parser->current_allow_notify) cfg_parser->current_allow_notify->next = acl; else cfg_parser->current_zone->allow_notify = acl; cfg_parser->current_allow_notify = acl; } break; case 92: /* Line 1806 of yacc.c */ #line 425 "configparser.y" { } break; case 93: /* Line 1806 of yacc.c */ #line 429 "configparser.y" { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, (yyvsp[(1) - (2)].str), (yyvsp[(2) - (2)].str)); OUTYY(("P(zone_request_xfr:%s %s)\n", (yyvsp[(1) - (2)].str), (yyvsp[(2) - (2)].str))); if(acl->blocked) c_error("blocked address used for request-xfr"); if(acl->rangetype!=acl_range_single) c_error("address range used for request-xfr"); if(cfg_parser->current_request_xfr) cfg_parser->current_request_xfr->next = acl; else cfg_parser->current_zone->request_xfr = acl; cfg_parser->current_request_xfr = acl; } break; case 94: /* Line 1806 of yacc.c */ #line 441 "configparser.y" { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)); acl->use_axfr_only = 1; OUTYY(("P(zone_request_xfr:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str))); if(acl->blocked) c_error("blocked address used for request-xfr"); if(acl->rangetype!=acl_range_single) c_error("address range used for request-xfr"); if(cfg_parser->current_request_xfr) cfg_parser->current_request_xfr->next = acl; else cfg_parser->current_zone->request_xfr = acl; cfg_parser->current_request_xfr = acl; } break; case 95: /* Line 1806 of yacc.c */ #line 454 "configparser.y" { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)); acl->allow_udp = 1; OUTYY(("P(zone_request_xfr:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str))); if(acl->blocked) c_error("blocked address used for request-xfr"); if(acl->rangetype!=acl_range_single) c_error("address range used for request-xfr"); if(cfg_parser->current_request_xfr) cfg_parser->current_request_xfr->next = acl; else cfg_parser->current_zone->request_xfr = acl; cfg_parser->current_request_xfr = acl; } break; case 96: /* Line 1806 of yacc.c */ #line 468 "configparser.y" { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)); OUTYY(("P(zone_notify:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str))); if(acl->blocked) c_error("blocked address used for notify"); if(acl->rangetype!=acl_range_single) c_error("address range used for notify"); if(cfg_parser->current_notify) cfg_parser->current_notify->next = acl; else cfg_parser->current_zone->notify = acl; cfg_parser->current_notify = acl; } break; case 97: /* Line 1806 of yacc.c */ #line 481 "configparser.y" { OUTYY(("P(zone_notify_retry:%s)\n", (yyvsp[(2) - (2)].str))); if(atoi((yyvsp[(2) - (2)].str)) == 0 && strcmp((yyvsp[(2) - (2)].str), "0") != 0) yyerror("number expected"); else cfg_parser->current_zone->notify_retry = atoi((yyvsp[(2) - (2)].str)); } break; case 98: /* Line 1806 of yacc.c */ #line 489 "configparser.y" { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str)); OUTYY(("P(zone_provide_xfr:%s %s)\n", (yyvsp[(2) - (3)].str), (yyvsp[(3) - (3)].str))); if(cfg_parser->current_provide_xfr) cfg_parser->current_provide_xfr->next = acl; else cfg_parser->current_zone->provide_xfr = acl; cfg_parser->current_provide_xfr = acl; } break; case 99: /* Line 1806 of yacc.c */ #line 500 "configparser.y" { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, (yyvsp[(2) - (2)].str), "NOKEY"); OUTYY(("P(zone_outgoing_interface:%s)\n", (yyvsp[(2) - (2)].str))); if(acl->rangetype!=acl_range_single) c_error("address range used for outgoing interface"); if(cfg_parser->current_outgoing_interface) cfg_parser->current_outgoing_interface->next = acl; else cfg_parser->current_zone->outgoing_interface = acl; cfg_parser->current_outgoing_interface = acl; } break; case 100: /* Line 1806 of yacc.c */ #line 512 "configparser.y" { OUTYY(("P(zone_allow_axfr_fallback:%s)\n", (yyvsp[(2) - (2)].str))); if(strcmp((yyvsp[(2) - (2)].str), "yes") != 0 && strcmp((yyvsp[(2) - (2)].str), "no") != 0) yyerror("expected yes or no."); else cfg_parser->current_zone->allow_axfr_fallback = (strcmp((yyvsp[(2) - (2)].str), "yes")==0); } break; case 101: /* Line 1806 of yacc.c */ #line 520 "configparser.y" { OUTYY(("P(zone_rrl_whitelist:%s)\n", (yyvsp[(2) - (2)].str))); #ifdef RATELIMIT cfg_parser->current_zone->rrl_whitelist |= rrlstr2type((yyvsp[(2) - (2)].str)); #endif } break; case 102: /* Line 1806 of yacc.c */ #line 530 "configparser.y" { OUTYY(("\nP(key:)\n")); if(cfg_parser->current_key) { if(!cfg_parser->current_key->name) c_error("previous key has no name"); if(!cfg_parser->current_key->algorithm) c_error("previous key has no algorithm"); if(!cfg_parser->current_key->secret) c_error("previous key has no secret blob"); cfg_parser->current_key->next = key_options_create(cfg_parser->opt->region); cfg_parser->current_key = cfg_parser->current_key->next; } else { cfg_parser->current_key = key_options_create(cfg_parser->opt->region); cfg_parser->opt->keys = cfg_parser->current_key; } cfg_parser->opt->numkeys++; } break; case 108: /* Line 1806 of yacc.c */ #line 548 "configparser.y" { OUTYY(("P(key_name:%s)\n", (yyvsp[(2) - (2)].str))); #ifndef NDEBUG assert(cfg_parser->current_key); #endif cfg_parser->current_key->name = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 109: /* Line 1806 of yacc.c */ #line 557 "configparser.y" { OUTYY(("P(key_algorithm:%s)\n", (yyvsp[(2) - (2)].str))); #ifndef NDEBUG assert(cfg_parser->current_key); #endif cfg_parser->current_key->algorithm = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; case 110: /* Line 1806 of yacc.c */ #line 566 "configparser.y" { OUTYY(("key_secret:%s)\n", (yyvsp[(2) - (2)].str))); #ifndef NDEBUG assert(cfg_parser->current_key); #endif cfg_parser->current_key->secret = region_strdup(cfg_parser->opt->region, (yyvsp[(2) - (2)].str)); } break; /* Line 1806 of yacc.c */ #line 2373 "configparser.c" default: break; } /* User semantic actions sometimes alter yychar, and that requires that yytoken be updated with the new translation. We take the approach of translating immediately before every use of yytoken. One alternative is translating here after every semantic action, but that translation would be missed if the semantic action invokes YYABORT, YYACCEPT, or YYERROR immediately after altering yychar or if it invokes YYBACKUP. In the case of YYABORT or YYACCEPT, an incorrect destructor might then be invoked immediately. In the case of YYERROR or YYBACKUP, subsequent parser actions might lead to an incorrect destructor call or verbose syntax error message before the lookahead is translated. */ YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc); YYPOPSTACK (yylen); yylen = 0; YY_STACK_PRINT (yyss, yyssp); *++yyvsp = yyval; /* Now `shift' the result of the reduction. Determine what state that goes to, based on the state we popped back to and the rule number reduced by. */ yyn = yyr1[yyn]; yystate = yypgoto[yyn - YYNTOKENS] + *yyssp; if (0 <= yystate && yystate <= YYLAST && yycheck[yystate] == *yyssp) yystate = yytable[yystate]; else yystate = yydefgoto[yyn - YYNTOKENS]; goto yynewstate; /*------------------------------------. | yyerrlab -- here on detecting error | `------------------------------------*/ yyerrlab: /* Make sure we have latest lookahead translation. See comments at user semantic actions for why this is necessary. */ yytoken = yychar == YYEMPTY ? YYEMPTY : YYTRANSLATE (yychar); /* If not already recovering from an error, report this error. */ if (!yyerrstatus) { ++yynerrs; #if ! YYERROR_VERBOSE yyerror (YY_("syntax error")); #else # define YYSYNTAX_ERROR yysyntax_error (&yymsg_alloc, &yymsg, \ yyssp, yytoken) { char const *yymsgp = YY_("syntax error"); int yysyntax_error_status; yysyntax_error_status = YYSYNTAX_ERROR; if (yysyntax_error_status == 0) yymsgp = yymsg; else if (yysyntax_error_status == 1) { if (yymsg != yymsgbuf) YYSTACK_FREE (yymsg); yymsg = (char *) YYSTACK_ALLOC (yymsg_alloc); if (!yymsg) { yymsg = yymsgbuf; yymsg_alloc = sizeof yymsgbuf; yysyntax_error_status = 2; } else { yysyntax_error_status = YYSYNTAX_ERROR; yymsgp = yymsg; } } yyerror (yymsgp); if (yysyntax_error_status == 2) goto yyexhaustedlab; } # undef YYSYNTAX_ERROR #endif } if (yyerrstatus == 3) { /* If just tried and failed to reuse lookahead token after an error, discard it. */ if (yychar <= YYEOF) { /* Return failure if at end of input. */ if (yychar == YYEOF) YYABORT; } else { yydestruct ("Error: discarding", yytoken, &yylval); yychar = YYEMPTY; } } /* Else will try to reuse lookahead token after shifting the error token. */ goto yyerrlab1; /*---------------------------------------------------. | yyerrorlab -- error raised explicitly by YYERROR. | `---------------------------------------------------*/ yyerrorlab: /* Pacify compilers like GCC when the user code never invokes YYERROR and the label yyerrorlab therefore never appears in user code. */ if (/*CONSTCOND*/ 0) goto yyerrorlab; /* Do not reclaim the symbols of the rule which action triggered this YYERROR. */ YYPOPSTACK (yylen); yylen = 0; YY_STACK_PRINT (yyss, yyssp); yystate = *yyssp; goto yyerrlab1; /*-------------------------------------------------------------. | yyerrlab1 -- common code for both syntax error and YYERROR. | `-------------------------------------------------------------*/ yyerrlab1: yyerrstatus = 3; /* Each real token shifted decrements this. */ for (;;) { yyn = yypact[yystate]; if (!yypact_value_is_default (yyn)) { yyn += YYTERROR; if (0 <= yyn && yyn <= YYLAST && yycheck[yyn] == YYTERROR) { yyn = yytable[yyn]; if (0 < yyn) break; } } /* Pop the current state because it cannot handle the error token. */ if (yyssp == yyss) YYABORT; yydestruct ("Error: popping", yystos[yystate], yyvsp); YYPOPSTACK (1); yystate = *yyssp; YY_STACK_PRINT (yyss, yyssp); } *++yyvsp = yylval; /* Shift the error token. */ YY_SYMBOL_PRINT ("Shifting", yystos[yyn], yyvsp, yylsp); yystate = yyn; goto yynewstate; /*-------------------------------------. | yyacceptlab -- YYACCEPT comes here. | `-------------------------------------*/ yyacceptlab: yyresult = 0; goto yyreturn; /*-----------------------------------. | yyabortlab -- YYABORT comes here. | `-----------------------------------*/ yyabortlab: yyresult = 1; goto yyreturn; #if !defined(yyoverflow) || YYERROR_VERBOSE /*-------------------------------------------------. | yyexhaustedlab -- memory exhaustion comes here. | `-------------------------------------------------*/ yyexhaustedlab: yyerror (YY_("memory exhausted")); yyresult = 2; /* Fall through. */ #endif yyreturn: if (yychar != YYEMPTY) { /* Make sure we have latest lookahead translation. See comments at user semantic actions for why this is necessary. */ yytoken = YYTRANSLATE (yychar); yydestruct ("Cleanup: discarding lookahead", yytoken, &yylval); } /* Do not reclaim the symbols of the rule which action triggered this YYABORT or YYACCEPT. */ YYPOPSTACK (yylen); YY_STACK_PRINT (yyss, yyssp); while (yyssp != yyss) { yydestruct ("Cleanup: popping", yystos[*yyssp], yyvsp); YYPOPSTACK (1); } #ifndef yyoverflow if (yyss != yyssa) YYSTACK_FREE (yyss); #endif #if YYERROR_VERBOSE if (yymsg != yymsgbuf) YYSTACK_FREE (yymsg); #endif /* Make sure YYID is used. */ return YYID (yyresult); } /* Line 2067 of yacc.c */ #line 575 "configparser.y" /* parse helper routines could be here */ nsd-3.2.16/xfrd-tcp.h0000664000175000017500000000726311761673243013275 0ustar matjematje/* * xfrd-tcp.h - XFR (transfer) Daemon TCP system header file. Manages tcp conn. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef XFRD_TCP_H #define XFRD_TCP_H #include "config.h" #include "xfrd.h" struct buffer; struct xfrd_zone; struct xfrd_soa; struct xfrd_state; struct region; struct dname; struct acl_options; typedef struct xfrd_tcp xfrd_tcp_t; typedef struct xfrd_tcp_set xfrd_tcp_set_t; /* * A set of xfrd tcp connections. */ struct xfrd_tcp_set { /* tcp connections, each has packet and read/wr state */ struct xfrd_tcp *tcp_state[XFRD_MAX_TCP]; /* number of TCP connections in use. */ int tcp_count; /* TCP timeout. */ int tcp_timeout; /* linked list of zones waiting for a TCP connection */ struct xfrd_zone *tcp_waiting_first, *tcp_waiting_last; }; /* * Structure to keep track of an open tcp connection * The xfrd tcp connection is used to first make a request * Then to receive the answer packet(s). */ struct xfrd_tcp { /* tcp connection state */ /* state: reading or writing */ uint8_t is_reading; /* how many bytes have been read/written - total, incl. tcp length bytes */ uint32_t total_bytes; /* msg len bytes */ uint16_t msglen; /* fd of connection. -1 means unconnected */ int fd; /* packet buffer of connection */ struct buffer* packet; }; /* create set of tcp connections */ xfrd_tcp_set_t* xfrd_tcp_set_create(struct region* region); /* init tcp state */ xfrd_tcp_t* xfrd_tcp_create(struct region* region); /* obtain tcp connection for a zone (or wait) */ void xfrd_tcp_obtain(xfrd_tcp_set_t* set, struct xfrd_zone* zone); /* release tcp connection for a zone (starts waiting) */ void xfrd_tcp_release(xfrd_tcp_set_t* set, struct xfrd_zone* zone); /* use tcp connection to start xfr */ void xfrd_tcp_xfr(xfrd_tcp_set_t* set, struct xfrd_zone* zone); /* initialize tcp_state for a zone. Opens the connection. true on success.*/ int xfrd_tcp_open(xfrd_tcp_set_t* set, struct xfrd_zone* zone); /* read data from tcp, maybe partial read */ void xfrd_tcp_read(xfrd_tcp_set_t* set, struct xfrd_zone* zone); /* write data to tcp, maybe a partial write */ void xfrd_tcp_write(xfrd_tcp_set_t* set, struct xfrd_zone* zone); /* see if the tcp connection is in the reading stage (else writin) */ static inline int xfrd_tcp_is_reading(xfrd_tcp_set_t* set, int conn) {return set->tcp_state[conn]->is_reading;} /* * Read from a stream connection (size16)+packet into buffer. * returns value is * -1 on error. * 0 on short read, call back later. * 1 on completed read. * On first call, make sure total_bytes = 0, msglen=0, buffer_clear(). * and the packet and fd need to be set. */ int conn_read(xfrd_tcp_t* conn); /* * Write to a stream connection (size16)+packet. * return value is * -1 on error. 0 on short write, call back later. 1 completed write. * On first call, make sure total_bytes=0, msglen=buffer_limit(), * buffer_flipped(). packet and fd need to be set. */ int conn_write(xfrd_tcp_t* conn); /* setup DNS packet for a query of this type */ void xfrd_setup_packet(struct buffer* packet, uint16_t type, uint16_t klass, const struct dname* dname); /* write soa in network format to the packet buffer */ void xfrd_write_soa_buffer(struct buffer* packet, const struct dname* apex, struct xfrd_soa* soa); /* use acl address to setup sockaddr struct, returns length of addr. */ socklen_t xfrd_acl_sockaddr_to(struct acl_options* acl, #ifdef INET6 struct sockaddr_storage *to); #else struct sockaddr_in *to); #endif /* INET6 */ socklen_t xfrd_acl_sockaddr_frm(struct acl_options* acl, #ifdef INET6 struct sockaddr_storage *frm); #else struct sockaddr_in *frm); #endif /* INET6 */ #endif /* XFRD_TCP_H */ nsd-3.2.16/configyyrename.h0000664000175000017500000000451411761673243014561 0ustar matjematje/* * configyyrename.h -- renames for config file yy values to avoid conflicts. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef CONFIGYYRENAME_H #define CONFIGYYRENAME_H #include "config.h" /* defines to change symbols so that no yacc/lex symbols clash */ #define yymaxdepth c_maxdepth #define yyparse c_parse #define yylex c_lex #define yyerror c_error #define yylval c_lval #define yychar c_char #define yydebug c_debug #define yypact c_pact #define yyr1 c_r1 #define yyr2 c_r2 #define yydef c_def #define yychk c_chk #define yypgo c_pgo #define yyact c_act #define yyexca c_exca #define yyerrflag c_errflag #define yynerrs c_nerrs #define yyps c_ps #define yypv c_pv #define yys c_s #define yy_yys c_yys #define yystate c_state #define yytmp c_tmp #define yyv c_v #define yy_yyv c_yyv #define yyval c_val #define yylloc c_lloc #define yyreds c_reds #define yytoks c_toks #define yylhs c_yylhs #define yylen c_yylen #define yydefred c_yydefred #define yydgoto c_yydgoto #define yysindex c_yysindex #define yyrindex c_yyrindex #define yygindex c_yygindex #define yytable c_yytable #define yycheck c_yycheck #define yyname c_yyname #define yyrule c_yyrule #define yyin c_in #define yyout c_out #define yywrap c_wrap #define yy_load_buffer_state c_load_buffer_state #define yy_switch_to_buffer c_switch_to_buffer #define yy_flush_buffer c_flush_buffer #define yy_init_buffer c_init_buffer #define yy_scan_buffer c_scan_buffer #define yy_scan_bytes c_scan_bytes #define yy_scan_string c_scan_string #define yy_create_buffer c_create_buffer #define yyrestart c_restart #define yy_delete_buffer c_delete_buffer #define yypop_buffer_state c_pop_buffer_state #define yypush_buffer_state c_push_buffer_state #define yyunput c_unput #define yyset_in c_set_in #define yyget_in c_get_in #define yyset_out c_set_out #define yyget_out c_get_out #define yyget_lineno c_get_lineno #define yyset_lineno c_set_lineno #define yyset_debug c_set_debug #define yyget_debug c_get_debug #define yy_flex_debug c_flex_debug #define yylex_destroy c_lex_destroy #define yyfree c_free #define yyrealloc c_realloc #define yyalloc c_alloc #define yymalloc c_malloc #define yyget_leng c_get_leng #define yylineno c_lineno #define yyget_text c_get_text #endif /* CONFIGYYRENAME_H */ nsd-3.2.16/tsig.c0000664000175000017500000004004612071046230012464 0ustar matjematje/* * tsig.h -- TSIG definitions (RFC 2845). * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include "tsig.h" #include "tsig-openssl.h" #include "dns.h" #include "packet.h" static region_type *tsig_region; struct tsig_key_table { struct tsig_key_table *next; tsig_key_type *key; }; typedef struct tsig_key_table tsig_key_table_type; static tsig_key_table_type *tsig_key_table; struct tsig_algorithm_table { struct tsig_algorithm_table *next; tsig_algorithm_type *algorithm; }; typedef struct tsig_algorithm_table tsig_algorithm_table_type; static tsig_algorithm_table_type *tsig_algorithm_table; static size_t max_algo_digest_size = 0; static void tsig_digest_variables(tsig_record_type *tsig, int tsig_timers_only) { uint16_t klass = htons(CLASS_ANY); uint32_t ttl = htonl(0); uint16_t signed_time_high = htons(tsig->signed_time_high); uint32_t signed_time_low = htonl(tsig->signed_time_low); uint16_t signed_time_fudge = htons(tsig->signed_time_fudge); uint16_t error_code = htons(tsig->error_code); uint16_t other_size = htons(tsig->other_size); if (!tsig_timers_only) { tsig->algorithm->hmac_update(tsig->context, dname_name(tsig->key_name), tsig->key_name->name_size); tsig->algorithm->hmac_update(tsig->context, &klass, sizeof(klass)); tsig->algorithm->hmac_update(tsig->context, &ttl, sizeof(ttl)); tsig->algorithm->hmac_update(tsig->context, dname_name(tsig->algorithm_name), tsig->algorithm_name->name_size); } tsig->algorithm->hmac_update(tsig->context, &signed_time_high, sizeof(signed_time_high)); tsig->algorithm->hmac_update(tsig->context, &signed_time_low, sizeof(signed_time_low)); tsig->algorithm->hmac_update(tsig->context, &signed_time_fudge, sizeof(signed_time_fudge)); if (!tsig_timers_only) { tsig->algorithm->hmac_update(tsig->context, &error_code, sizeof(error_code)); tsig->algorithm->hmac_update(tsig->context, &other_size, sizeof(other_size)); tsig->algorithm->hmac_update(tsig->context, tsig->other_data, tsig->other_size); } } int tsig_init(region_type *region) { tsig_region = region; tsig_key_table = NULL; tsig_algorithm_table = NULL; #if defined(HAVE_SSL) return tsig_openssl_init(region); #endif /* defined(HAVE_SSL) */ return 1; } void tsig_add_key(tsig_key_type *key) { tsig_key_table_type *entry = (tsig_key_table_type *) region_alloc( tsig_region, sizeof(tsig_key_table_type)); entry->key = key; entry->next = tsig_key_table; tsig_key_table = entry; } void tsig_add_algorithm(tsig_algorithm_type *algorithm) { tsig_algorithm_table_type *entry = (tsig_algorithm_table_type *) region_alloc( tsig_region, sizeof(tsig_algorithm_table_type)); entry->algorithm = algorithm; entry->next = tsig_algorithm_table; tsig_algorithm_table = entry; if(algorithm->maximum_digest_size > max_algo_digest_size) max_algo_digest_size = algorithm->maximum_digest_size; } /** * compare a tsig algorithm string lowercased */ int tsig_strlowercmp(const char* str1, const char* str2) { while (str1 && str2 && *str1 != '\0' && *str2 != '\0') { if(tolower((int)*str1) != tolower((int)*str2)) { if(tolower((int)*str1) < tolower((int)*str2)) return -1; return 1; } str1++; str2++; } if (str1 && str2) { if (*str1 == *str2) return 0; else if (*str1 == '\0') return -1; } else if (!str1 && !str2) return 0; else if (!str1 && str2) return -1; return 1; } /* * Find an HMAC algorithm based on its short name. */ tsig_algorithm_type * tsig_get_algorithm_by_name(const char *name) { tsig_algorithm_table_type *algorithm_entry; for (algorithm_entry = tsig_algorithm_table; algorithm_entry; algorithm_entry = algorithm_entry->next) { if (tsig_strlowercmp(name, algorithm_entry->algorithm->short_name) == 0) { return algorithm_entry->algorithm; } } return NULL; } const char * tsig_error(int error_code) { static char message[1000]; switch (error_code) { case TSIG_ERROR_NOERROR: return "No Error"; break; case TSIG_ERROR_BADSIG: return "Bad Signature"; break; case TSIG_ERROR_BADKEY: return "Bad Key"; break; case TSIG_ERROR_BADTIME: return "Bad Time"; break; default: if(error_code < 16) /* DNS rcodes */ return rcode2str(error_code); snprintf(message, sizeof(message), "Unknown Error %d", error_code); break; } return message; } static void tsig_cleanup(void *data) { tsig_record_type *tsig = (tsig_record_type *) data; region_destroy(tsig->rr_region); region_destroy(tsig->context_region); } void tsig_create_record(tsig_record_type *tsig, region_type *region) { tsig_create_record_custom(tsig, region, DEFAULT_CHUNK_SIZE, DEFAULT_LARGE_OBJECT_SIZE, DEFAULT_INITIAL_CLEANUP_SIZE); } void tsig_create_record_custom(tsig_record_type *tsig, region_type *region, size_t chunk_size, size_t large_object_size, size_t initial_cleanup_size) { tsig->rr_region = region_create_custom(xalloc, free, chunk_size, large_object_size, initial_cleanup_size, 0); tsig->context_region = region_create_custom(xalloc, free, chunk_size, large_object_size, initial_cleanup_size, 0); region_add_cleanup(region, tsig_cleanup, tsig); tsig_init_record(tsig, NULL, NULL); } void tsig_init_record(tsig_record_type *tsig, tsig_algorithm_type *algorithm, tsig_key_type *key) { tsig->status = TSIG_NOT_PRESENT; tsig->error_code = TSIG_ERROR_NOERROR; tsig->position = 0; tsig->response_count = 0; tsig->context = NULL; tsig->algorithm = algorithm; tsig->key = key; tsig->prior_mac_size = 0; tsig->prior_mac_data = NULL; region_free_all(tsig->context_region); } int tsig_from_query(tsig_record_type *tsig) { tsig_key_table_type *key_entry; tsig_key_type *key = NULL; tsig_algorithm_table_type *algorithm_entry; tsig_algorithm_type *algorithm = NULL; uint64_t current_time; uint64_t signed_time; assert(tsig->status == TSIG_OK); assert(!tsig->algorithm); assert(!tsig->key); /* XXX: TODO: slow linear check for keyname */ for (key_entry = tsig_key_table; key_entry; key_entry = key_entry->next) { if (dname_compare(tsig->key_name, key_entry->key->name) == 0) { key = key_entry->key; break; } } for (algorithm_entry = tsig_algorithm_table; algorithm_entry; algorithm_entry = algorithm_entry->next) { if (dname_compare( tsig->algorithm_name, algorithm_entry->algorithm->wireformat_name) == 0) { algorithm = algorithm_entry->algorithm; break; } } if (!algorithm || !key) { /* Algorithm or key is unknown, cannot authenticate. */ tsig->error_code = TSIG_ERROR_BADKEY; return 0; } if ((tsig->algorithm && algorithm != tsig->algorithm) || (tsig->key && key != tsig->key)) { /* * Algorithm or key changed during a single connection, * return error. */ tsig->error_code = TSIG_ERROR_BADKEY; return 0; } signed_time = ((((uint64_t) tsig->signed_time_high) << 32) | ((uint64_t) tsig->signed_time_low)); current_time = (uint64_t) time(NULL); if ((current_time < signed_time - tsig->signed_time_fudge) || (current_time > signed_time + tsig->signed_time_fudge)) { uint16_t current_time_high; uint32_t current_time_low; #if 0 /* debug */ char current_time_text[26]; char signed_time_text[26]; time_t clock; clock = (time_t) current_time; ctime_r(&clock, current_time_text); current_time_text[24] = '\0'; clock = (time_t) signed_time; ctime_r(&clock, signed_time_text); signed_time_text[24] = '\0'; log_msg(LOG_ERR, "current server time %s is outside the range of TSIG" " signed time %s with fudge %u", current_time_text, signed_time_text, (unsigned) tsig->signed_time_fudge); #endif tsig->error_code = TSIG_ERROR_BADTIME; current_time_high = (uint16_t) (current_time >> 32); current_time_low = (uint32_t) current_time; tsig->other_size = 6; tsig->other_data = (uint8_t *) region_alloc( tsig->rr_region, sizeof(uint16_t) + sizeof(uint32_t)); write_uint16(tsig->other_data, current_time_high); write_uint32(tsig->other_data + 2, current_time_low); return 0; } tsig->algorithm = algorithm; tsig->key = key; tsig->response_count = 0; tsig->prior_mac_size = 0; return 1; } void tsig_init_query(tsig_record_type *tsig, uint16_t original_query_id) { assert(tsig); assert(tsig->algorithm); assert(tsig->key); tsig->response_count = 0; tsig->prior_mac_size = 0; tsig->algorithm_name = tsig->algorithm->wireformat_name; tsig->key_name = tsig->key->name; tsig->mac_size = 0; tsig->mac_data = NULL; tsig->original_query_id = original_query_id; tsig->error_code = TSIG_ERROR_NOERROR; tsig->other_size = 0; tsig->other_data = NULL; } void tsig_prepare(tsig_record_type *tsig) { if (!tsig->context) { assert(tsig->algorithm); tsig->context = tsig->algorithm->hmac_create_context( tsig->context_region); tsig->prior_mac_data = (uint8_t *) region_alloc( tsig->context_region, tsig->algorithm->maximum_digest_size); } tsig->algorithm->hmac_init_context(tsig->context, tsig->algorithm, tsig->key); if (tsig->prior_mac_size > 0) { uint16_t mac_size = htons(tsig->prior_mac_size); tsig->algorithm->hmac_update(tsig->context, &mac_size, sizeof(mac_size)); tsig->algorithm->hmac_update(tsig->context, tsig->prior_mac_data, tsig->prior_mac_size); } tsig->updates_since_last_prepare = 0; } void tsig_update(tsig_record_type *tsig, buffer_type *packet, size_t length) { uint16_t original_query_id = htons(tsig->original_query_id); assert(length <= buffer_limit(packet)); tsig->algorithm->hmac_update(tsig->context, &original_query_id, sizeof(original_query_id)); tsig->algorithm->hmac_update( tsig->context, buffer_at(packet, sizeof(original_query_id)), length - sizeof(original_query_id)); if (QR(packet)) { ++tsig->response_count; } ++tsig->updates_since_last_prepare; } void tsig_sign(tsig_record_type *tsig) { uint64_t current_time = (uint64_t) time(NULL); tsig->signed_time_high = (uint16_t) (current_time >> 32); tsig->signed_time_low = (uint32_t) current_time; tsig->signed_time_fudge = 300; /* XXX; hardcoded value */ tsig_digest_variables(tsig, tsig->response_count > 1); tsig->algorithm->hmac_final(tsig->context, tsig->prior_mac_data, &tsig->prior_mac_size); tsig->mac_size = tsig->prior_mac_size; tsig->mac_data = tsig->prior_mac_data; } int tsig_verify(tsig_record_type *tsig) { tsig_digest_variables(tsig, tsig->response_count > 1); tsig->algorithm->hmac_final(tsig->context, tsig->prior_mac_data, &tsig->prior_mac_size); if (tsig->mac_size != tsig->prior_mac_size || memcmp(tsig->mac_data, tsig->prior_mac_data, tsig->mac_size) != 0) { /* Digest is incorrect, cannot authenticate. */ tsig->error_code = TSIG_ERROR_BADSIG; return 0; } else { return 1; } } int tsig_find_rr(tsig_record_type *tsig, buffer_type *packet) { size_t saved_position = buffer_position(packet); size_t rrcount = (QDCOUNT(packet) + ANCOUNT(packet) + NSCOUNT(packet) + ARCOUNT(packet)); size_t i; int result; if (ARCOUNT(packet) == 0) { tsig->status = TSIG_NOT_PRESENT; return 1; } buffer_set_position(packet, QHEADERSZ); /* TSIG must be the last record, so skip all others. */ for (i = 0; i < rrcount - 1; ++i) { if (!packet_skip_rr(packet, i < QDCOUNT(packet))) { buffer_set_position(packet, saved_position); return 0; } } result = tsig_parse_rr(tsig, packet); buffer_set_position(packet, saved_position); return result; } int tsig_parse_rr(tsig_record_type *tsig, buffer_type *packet) { uint16_t type; uint16_t klass; uint32_t ttl; uint16_t rdlen; tsig->status = TSIG_NOT_PRESENT; tsig->position = buffer_position(packet); tsig->key_name = NULL; tsig->algorithm_name = NULL; tsig->mac_data = NULL; tsig->other_data = NULL; region_free_all(tsig->rr_region); tsig->key_name = dname_make_from_packet(tsig->rr_region, packet, 1, 1); if (!tsig->key_name) { buffer_set_position(packet, tsig->position); return 0; } if (!buffer_available(packet, 10)) { buffer_set_position(packet, tsig->position); return 0; } type = buffer_read_u16(packet); klass = buffer_read_u16(packet); /* TSIG not present */ if (type != TYPE_TSIG || klass != CLASS_ANY) { buffer_set_position(packet, tsig->position); return 1; } ttl = buffer_read_u32(packet); rdlen = buffer_read_u16(packet); tsig->status = TSIG_ERROR; tsig->error_code = RCODE_FORMAT; if (ttl != 0 || !buffer_available(packet, rdlen)) { buffer_set_position(packet, tsig->position); return 0; } tsig->algorithm_name = dname_make_from_packet( tsig->rr_region, packet, 1, 1); if (!tsig->algorithm_name || !buffer_available(packet, 10)) { buffer_set_position(packet, tsig->position); return 0; } tsig->signed_time_high = buffer_read_u16(packet); tsig->signed_time_low = buffer_read_u32(packet); tsig->signed_time_fudge = buffer_read_u16(packet); tsig->mac_size = buffer_read_u16(packet); if (!buffer_available(packet, tsig->mac_size)) { buffer_set_position(packet, tsig->position); tsig->mac_size = 0; return 0; } tsig->mac_data = (uint8_t *) region_alloc_init( tsig->rr_region, buffer_current(packet), tsig->mac_size); buffer_skip(packet, tsig->mac_size); if (!buffer_available(packet, 6)) { buffer_set_position(packet, tsig->position); return 0; } tsig->original_query_id = buffer_read_u16(packet); tsig->error_code = buffer_read_u16(packet); tsig->other_size = buffer_read_u16(packet); if (!buffer_available(packet, tsig->other_size) || tsig->other_size > 16) { tsig->other_size = 0; buffer_set_position(packet, tsig->position); return 0; } tsig->other_data = (uint8_t *) region_alloc_init( tsig->rr_region, buffer_current(packet), tsig->other_size); buffer_skip(packet, tsig->other_size); tsig->status = TSIG_OK; return 1; } void tsig_append_rr(tsig_record_type *tsig, buffer_type *packet) { size_t rdlength_pos; /* XXX: TODO key name compression? */ if(tsig->key_name) buffer_write(packet, dname_name(tsig->key_name), tsig->key_name->name_size); else buffer_write_u8(packet, 0); buffer_write_u16(packet, TYPE_TSIG); buffer_write_u16(packet, CLASS_ANY); buffer_write_u32(packet, 0); /* TTL */ rdlength_pos = buffer_position(packet); buffer_skip(packet, sizeof(uint16_t)); if(tsig->algorithm_name) buffer_write(packet, dname_name(tsig->algorithm_name), tsig->algorithm_name->name_size); else buffer_write_u8(packet, 0); buffer_write_u16(packet, tsig->signed_time_high); buffer_write_u32(packet, tsig->signed_time_low); buffer_write_u16(packet, tsig->signed_time_fudge); buffer_write_u16(packet, tsig->mac_size); buffer_write(packet, tsig->mac_data, tsig->mac_size); buffer_write_u16(packet, tsig->original_query_id); buffer_write_u16(packet, tsig->error_code); buffer_write_u16(packet, tsig->other_size); buffer_write(packet, tsig->other_data, tsig->other_size); buffer_write_u16_at(packet, rdlength_pos, buffer_position(packet) - rdlength_pos - sizeof(uint16_t)); } size_t tsig_reserved_space(tsig_record_type *tsig) { if (tsig->status == TSIG_NOT_PRESENT) return 0; return ( (tsig->key_name?tsig->key_name->name_size:1) /* Owner */ + sizeof(uint16_t) /* Type */ + sizeof(uint16_t) /* Class */ + sizeof(uint32_t) /* TTL */ + sizeof(uint16_t) /* RDATA length */ + (tsig->algorithm_name?tsig->algorithm_name->name_size:1) + sizeof(uint16_t) /* Signed time (high) */ + sizeof(uint32_t) /* Signed time (low) */ + sizeof(uint16_t) /* Signed time fudge */ + sizeof(uint16_t) /* MAC size */ + max_algo_digest_size /* MAC data */ + sizeof(uint16_t) /* Original query ID */ + sizeof(uint16_t) /* Error code */ + sizeof(uint16_t) /* Other size */ + tsig->other_size); /* Other data */ } void tsig_error_reply(tsig_record_type *tsig) { if(tsig->mac_data) memset(tsig->mac_data, 0, tsig->mac_size); tsig->mac_size = 0; } void tsig_finalize() { #if defined(HAVE_SSL) tsig_openssl_finalize(); #endif /* defined(HAVE_SSL) */ } nsd-3.2.16/dname.c0000664000175000017500000003026712166742755012632 0ustar matjematje/* * dname.c -- Domain name handling. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include #include #include "dns.h" #include "dname.h" #include "query.h" /** * The maximum number of labels is the maximum domain name, less 1 for * the root (len == 0) label, divided by two (minimum non-root label of * one character + length byte), then add back in one for the root label. */ #define MAXLABELS (((MAXDOMAINLEN - 1) / 2) + 1) const dname_type * dname_make(region_type *region, const uint8_t *name, int normalize) { size_t name_size = 0; uint8_t label_offsets[MAXDOMAINLEN]; uint8_t label_count = 0; const uint8_t *label = name; dname_type *result; ssize_t i; assert(name); while (1) { if (label_is_pointer(label)) return NULL; label_offsets[label_count] = (uint8_t) (label - name); ++label_count; name_size += label_length(label) + 1; if (label_is_root(label)) break; label = label_next(label); } if (name_size > MAXDOMAINLEN) return NULL; assert(label_count <= MAXDOMAINLEN / 2 + 1); /* Reverse label offsets. */ for (i = 0; i < label_count / 2; ++i) { uint8_t tmp = label_offsets[i]; label_offsets[i] = label_offsets[label_count - i - 1]; label_offsets[label_count - i - 1] = tmp; } result = (dname_type *) region_alloc( region, (sizeof(dname_type) + (label_count + name_size) * sizeof(uint8_t))); result->name_size = name_size; result->label_count = label_count; memcpy((uint8_t *) dname_label_offsets(result), label_offsets, label_count * sizeof(uint8_t)); if (normalize) { uint8_t *dst = (uint8_t *) dname_name(result); const uint8_t *src = name; while (!label_is_root(src)) { ssize_t len = label_length(src); *dst++ = *src++; for (i = 0; i < len; ++i) { *dst++ = DNAME_NORMALIZE(*src++); } } *dst = *src; } else { memcpy((uint8_t *) dname_name(result), name, name_size * sizeof(uint8_t)); } return result; } const dname_type * dname_make_from_packet(region_type *region, buffer_type *packet, int allow_pointers, int normalize) { uint8_t buf[MAXDOMAINLEN + 1]; if(!dname_make_wire_from_packet(buf, packet, allow_pointers)) return 0; return dname_make(region, buf, normalize); } int dname_make_wire_from_packet(uint8_t *buf, buffer_type *packet, int allow_pointers) { int done = 0; uint8_t visited[(MAX_PACKET_SIZE+7)/8]; size_t dname_length = 0; const uint8_t *label; ssize_t mark = -1; memset(visited, 0, (buffer_limit(packet)+7)/8); while (!done) { if (!buffer_available(packet, 1)) { /* error("dname out of bounds"); */ return 0; } if (get_bit(visited, buffer_position(packet))) { /* error("dname loops"); */ return 0; } set_bit(visited, buffer_position(packet)); label = buffer_current(packet); if (label_is_pointer(label)) { size_t pointer; if (!allow_pointers) { return 0; } if (!buffer_available(packet, 2)) { /* error("dname pointer out of bounds"); */ return 0; } pointer = label_pointer_location(label); if (pointer >= buffer_limit(packet)) { /* error("dname pointer points outside packet"); */ return 0; } buffer_skip(packet, 2); if (mark == -1) { mark = buffer_position(packet); } buffer_set_position(packet, pointer); } else if (label_is_normal(label)) { size_t length = label_length(label) + 1; done = label_is_root(label); if (!buffer_available(packet, length)) { /* error("dname label out of bounds"); */ return 0; } if (dname_length + length >= MAXDOMAINLEN+1) { /* error("dname too large"); */ return 0; } buffer_read(packet, buf + dname_length, length); dname_length += length; } else { /* error("bad label type"); */ return 0; } } if (mark != -1) { buffer_set_position(packet, mark); } return dname_length; } const dname_type * dname_parse(region_type *region, const char *name) { uint8_t dname[MAXDOMAINLEN]; if(!dname_parse_wire(dname, name)) return 0; return dname_make(region, dname, 1); } int dname_parse_wire(uint8_t* dname, const char* name) { const uint8_t *s = (const uint8_t *) name; uint8_t *h; uint8_t *p; uint8_t *d = dname; size_t label_length; if (strcmp(name, ".") == 0) { /* Root domain. */ dname[0] = 0; return 1; } for (h = d, p = h + 1; *s; ++s, ++p) { if (p - dname >= MAXDOMAINLEN) { return 0; } switch (*s) { case '.': if (p == h + 1) { /* Empty label. */ return 0; } else { label_length = p - h - 1; if (label_length > MAXLABELLEN) { return 0; } *h = label_length; h = p; } break; case '\\': /* Handle escaped characters (RFC1035 5.1) */ if (isdigit(s[1]) && isdigit(s[2]) && isdigit(s[3])) { int val = (hexdigit_to_int(s[1]) * 100 + hexdigit_to_int(s[2]) * 10 + hexdigit_to_int(s[3])); if (0 <= val && val <= 255) { s += 3; *p = val; } else { *p = *++s; } } else if (s[1] != '\0') { *p = *++s; } break; default: *p = *s; break; } } if (p != h + 1) { /* Terminate last label. */ label_length = p - h - 1; if (label_length > MAXLABELLEN) { return 0; } *h = label_length; h = p; } /* Add root label. */ *h = 0; return p-dname; } const dname_type * dname_copy(region_type *region, const dname_type *dname) { return (dname_type *) region_alloc_init( region, dname, dname_total_size(dname)); } const dname_type * dname_partial_copy(region_type *region, const dname_type *dname, uint8_t label_count) { if (!dname) return NULL; if (label_count == 0) { /* Always copy the root label. */ label_count = 1; } assert(label_count <= dname->label_count); return dname_make(region, dname_label(dname, label_count - 1), 0); } const dname_type * dname_origin(region_type *region, const dname_type *dname) { return dname_partial_copy(region, dname, dname->label_count - 1); } int dname_is_subdomain(const dname_type *left, const dname_type *right) { uint8_t i; if (left->label_count < right->label_count) return 0; for (i = 1; i < right->label_count; ++i) { if (label_compare(dname_label(left, i), dname_label(right, i)) != 0) return 0; } return 1; } int dname_compare(const void *vleft, const void *vright) { const dname_type* left = (const dname_type*) vleft; const dname_type* right = (const dname_type*) vright; int result; uint8_t label_count; uint8_t i; assert(left); assert(right); if (left == right) { return 0; } label_count = (left->label_count <= right->label_count ? left->label_count : right->label_count); /* Skip the root label by starting at label 1. */ for (i = 1; i < label_count; ++i) { result = label_compare(dname_label(left, i), dname_label(right, i)); if (result) { return result; } } /* Dname with the fewest labels is "first". */ return (int) left->label_count - (int) right->label_count; } int label_compare(const uint8_t *left, const uint8_t *right) { int left_length; int right_length; size_t size; int result; assert(left); assert(right); assert(label_is_normal(left)); assert(label_is_normal(right)); left_length = label_length(left); right_length = label_length(right); size = left_length < right_length ? left_length : right_length; result = memcmp(label_data(left), label_data(right), size); if (result) { return result; } else { return (int) left_length - (int) right_length; } } uint8_t dname_label_match_count(const dname_type *left, const dname_type *right) { uint8_t i; assert(left); assert(right); for (i = 1; i < left->label_count && i < right->label_count; ++i) { if (label_compare(dname_label(left, i), dname_label(right, i)) != 0) { return i; } } return i; } const char * dname_to_string(const dname_type *dname, const dname_type *origin) { static char buf[MAXDOMAINLEN * 5]; return dname_to_string_r(dname, origin, buf); } const char * dname_to_string_r(const dname_type *dname, const dname_type *origin, char* buf) { size_t i; size_t labels_to_convert = 0; int absolute = 1; char *dst; const uint8_t *src; if (!dname) { *buf = '\0'; return buf; } dst = buf; if (dname->label_count == 1) { *dst++ = '.'; *dst = '\0'; return buf; } labels_to_convert = dname->label_count - 1; if (origin && dname_is_subdomain(dname, origin)) { int common_labels = dname_label_match_count(dname, origin); labels_to_convert = dname->label_count - common_labels; absolute = 0; } src = dname_name(dname); for (i = 0; i < labels_to_convert; ++i) { size_t len = label_length(src); size_t j; ++src; for (j = 0; j < len; ++j) { uint8_t ch = *src++; if (isalnum(ch) || ch == '-' || ch == '_') { *dst++ = ch; } else if (ch == '.' || ch == '\\') { *dst++ = '\\'; *dst++ = ch; } else { snprintf(dst, 5, "\\%03u", (unsigned int)ch); dst += 4; } } *dst++ = '.'; } if (absolute) { *dst = '\0'; } else { *--dst = '\0'; } return buf; } const dname_type * dname_make_from_label(region_type *region, const uint8_t *label, const size_t length) { uint8_t temp[MAXLABELLEN + 2]; assert(length > 0 && length <= MAXLABELLEN); temp[0] = length; memcpy(temp + 1, label, length * sizeof(uint8_t)); temp[length + 1] = '\000'; return dname_make(region, temp, 1); } const dname_type * dname_concatenate(region_type *region, const dname_type *left, const dname_type *right) { uint8_t temp[MAXDOMAINLEN]; assert(left->name_size + right->name_size - 1 <= MAXDOMAINLEN); memcpy(temp, dname_name(left), left->name_size - 1); memcpy(temp + left->name_size - 1, dname_name(right), right->name_size); return dname_make(region, temp, 0); } const dname_type * dname_replace(region_type* region, const dname_type* name, const dname_type* src, const dname_type* dest) { /* nomenclature: name is said to be .. x can be null. */ dname_type* res; int x_labels = name->label_count - src->label_count; int x_len = name->name_size - src->name_size; int i; assert(dname_is_subdomain(name, src)); /* check if final size is acceptable */ if(x_len+dest->name_size > MAXDOMAINLEN) return NULL; res = (dname_type*)region_alloc(region, sizeof(dname_type) + (x_labels+dest->label_count + x_len+dest->name_size) *sizeof(uint8_t)); res->name_size = x_len+dest->name_size; res->label_count = x_labels+dest->label_count; for(i=0; ilabel_count; i++) ((uint8_t*)dname_label_offsets(res))[i] = dname_label_offsets(dest)[i] + x_len; for(i=dest->label_count; ilabel_count; i++) ((uint8_t*)dname_label_offsets(res))[i] = dname_label_offsets(name)[i - dest->label_count + src->label_count]; memcpy((uint8_t*)dname_name(res), dname_name(name), x_len); memcpy((uint8_t*)dname_name(res)+x_len, dname_name(dest), dest->name_size); assert(dname_is_subdomain(res, dest)); return res; } #ifndef FULL_PREHASH /** * Make wildcard synthesis. * */ int dname_make_wildcard(struct region *region, struct dname const *dname, struct dname const **wildcard) { uint8_t name_size; uint8_t label_count; uint8_t *names; uint8_t *labels; struct dname *new_dname; unsigned int i; /* * Checks: * dname label_count + 1 < MAXLABELS * dname size + 2 < MAXDOMAINLEN */ if (dname->label_count > (MAXLABELS - 1)) { return EINVAL; } if (dname->name_size > (MAXDOMAINLEN - 2)) { return EINVAL; } label_count = dname->label_count + 1; name_size = dname->name_size + 2; new_dname = (struct dname *) region_alloc(region, sizeof(dname_type) + (label_count * sizeof(uint8_t)) + (name_size * sizeof(uint8_t))); if (new_dname == NULL) { return ENOMEM; } new_dname->label_count = label_count; new_dname->name_size = name_size; labels = (uint8_t *) dname_label_offsets(new_dname); memcpy(labels, dname_label_offsets(dname), dname->label_count * sizeof(uint8_t)); for (i = 0; i < dname->label_count; i++) { labels[i] += 2; } labels[i] = 0; names = (uint8_t *) dname_name(new_dname); *names++ = '\001'; *names++ = '*'; memcpy(names, dname_name(dname), dname->name_size * sizeof(uint8_t)); *wildcard = new_dname; return 0; } #endif nsd-3.2.16/buffer.h0000664000175000017500000002122111535444205012776 0ustar matjematje/* * buffer.h -- generic memory buffer. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * * * The buffer module implements a generic buffer. The API is based on * the java.nio.Buffer interface. */ #ifndef _BUFFER_H_ #define _BUFFER_H_ #include #include #include #include "region-allocator.h" #include "util.h" typedef struct buffer buffer_type; struct buffer { /* * The current position used for reading/writing. */ size_t _position; /* * The read/write limit. */ size_t _limit; /* * The amount of data the buffer can contain. */ size_t _capacity; /* * The data contained in the buffer. */ uint8_t *_data; /* * If the buffer is fixed it cannot be resized. */ unsigned _fixed : 1; }; #ifdef NDEBUG static inline void buffer_invariant(buffer_type *ATTR_UNUSED(buffer)) { } #else static inline void buffer_invariant(buffer_type *buffer) { assert(buffer); assert(buffer->_position <= buffer->_limit); assert(buffer->_limit <= buffer->_capacity); assert(buffer->_data); } #endif /* * Create a new buffer with the specified capacity. */ buffer_type *buffer_create(region_type *region, size_t capacity); /* * Create a buffer with the specified data. The data is not copied * and no memory allocations are done. The buffer is fixed and cannot * be resized using buffer_reserve(). */ void buffer_create_from(buffer_type *buffer, void *data, size_t size); /* * Clear the buffer and make it ready for writing. The buffer's limit * is set to the capacity and the position is set to 0. */ void buffer_clear(buffer_type *buffer); /* * Make the buffer ready for reading the data that has been written to * the buffer. The buffer's limit is set to the current position and * the position is set to 0. */ void buffer_flip(buffer_type *buffer); /* * Make the buffer ready for re-reading the data. The buffer's * position is reset to 0. */ void buffer_rewind(buffer_type *buffer); static inline size_t buffer_position(buffer_type *buffer) { return buffer->_position; } /* * Set the buffer's position to MARK. The position must be less than * or equal to the buffer's limit. */ static inline void buffer_set_position(buffer_type *buffer, size_t mark) { assert(mark <= buffer->_limit); buffer->_position = mark; } /* * Change the buffer's position by COUNT bytes. The position must not * be moved behind the buffer's limit or before the beginning of the * buffer. */ static inline void buffer_skip(buffer_type *buffer, ssize_t count) { assert(buffer->_position + count <= buffer->_limit); buffer->_position += count; } static inline size_t buffer_limit(buffer_type *buffer) { return buffer->_limit; } /* * Change the buffer's limit. If the buffer's position is greater * than the new limit the position is set to the limit. */ static inline void buffer_set_limit(buffer_type *buffer, size_t limit) { assert(limit <= buffer->_capacity); buffer->_limit = limit; if (buffer->_position > buffer->_limit) buffer->_position = buffer->_limit; } static inline size_t buffer_capacity(buffer_type *buffer) { return buffer->_capacity; } /* * Change the buffer's capacity. The data is reallocated so any * pointers to the data may become invalid. The buffer's limit is set * to the buffer's new capacity. */ void buffer_set_capacity(buffer_type *buffer, size_t capacity); /* * Ensure BUFFER can contain at least AMOUNT more bytes. The buffer's * capacity is increased if necessary using buffer_set_capacity(). * * The buffer's limit is always set to the (possibly increased) * capacity. */ void buffer_reserve(buffer_type *buffer, size_t amount); /* * Return a pointer to the data at the indicated position. */ static inline uint8_t * buffer_at(buffer_type *buffer, size_t at) { assert(at <= buffer->_limit); return buffer->_data + at; } /* * Return a pointer to the beginning of the buffer (the data at * position 0). */ static inline uint8_t * buffer_begin(buffer_type *buffer) { return buffer_at(buffer, 0); } /* * Return a pointer to the end of the buffer (the data at the buffer's * limit). */ static inline uint8_t * buffer_end(buffer_type *buffer) { return buffer_at(buffer, buffer->_limit); } /* * Return a pointer to the data at the buffer's current position. */ static inline uint8_t * buffer_current(buffer_type *buffer) { return buffer_at(buffer, buffer->_position); } /* * The number of bytes remaining between the indicated position and * the limit. */ static inline size_t buffer_remaining_at(buffer_type *buffer, size_t at) { buffer_invariant(buffer); assert(at <= buffer->_limit); return buffer->_limit - at; } /* * The number of bytes remaining between the buffer's position and * limit. */ static inline size_t buffer_remaining(buffer_type *buffer) { return buffer_remaining_at(buffer, buffer->_position); } /* * Check if the buffer has at least COUNT more bytes available. * Before reading or writing the caller needs to ensure enough space * is available! */ static inline int buffer_available_at(buffer_type *buffer, size_t at, size_t count) { return count <= buffer_remaining_at(buffer, at); } static inline int buffer_available(buffer_type *buffer, size_t count) { return buffer_available_at(buffer, buffer->_position, count); } static inline void buffer_write_at(buffer_type *buffer, size_t at, const void *data, size_t count) { assert(buffer_available_at(buffer, at, count)); memcpy(buffer->_data + at, data, count); } static inline void buffer_write(buffer_type *buffer, const void *data, size_t count) { buffer_write_at(buffer, buffer->_position, data, count); buffer->_position += count; } static inline void buffer_write_string_at(buffer_type *buffer, size_t at, const char *str) { buffer_write_at(buffer, at, str, strlen(str)); } static inline void buffer_write_string(buffer_type *buffer, const char *str) { buffer_write(buffer, str, strlen(str)); } static inline void buffer_write_u8_at(buffer_type *buffer, size_t at, uint8_t data) { assert(buffer_available_at(buffer, at, sizeof(data))); buffer->_data[at] = data; } static inline void buffer_write_u8(buffer_type *buffer, uint8_t data) { buffer_write_u8_at(buffer, buffer->_position, data); buffer->_position += sizeof(data); } static inline void buffer_write_u16_at(buffer_type *buffer, size_t at, uint16_t data) { assert(buffer_available_at(buffer, at, sizeof(data))); write_uint16(buffer->_data + at, data); } static inline void buffer_write_u16(buffer_type *buffer, uint16_t data) { buffer_write_u16_at(buffer, buffer->_position, data); buffer->_position += sizeof(data); } static inline void buffer_write_u32_at(buffer_type *buffer, size_t at, uint32_t data) { assert(buffer_available_at(buffer, at, sizeof(data))); write_uint32(buffer->_data + at, data); } static inline void buffer_write_u32(buffer_type *buffer, uint32_t data) { buffer_write_u32_at(buffer, buffer->_position, data); buffer->_position += sizeof(data); } static inline void buffer_read_at(buffer_type *buffer, size_t at, void *data, size_t count) { assert(buffer_available_at(buffer, at, count)); memcpy(data, buffer->_data + at, count); } static inline void buffer_read(buffer_type *buffer, void *data, size_t count) { buffer_read_at(buffer, buffer->_position, data, count); buffer->_position += count; } static inline uint8_t buffer_read_u8_at(buffer_type *buffer, size_t at) { assert(buffer_available_at(buffer, at, sizeof(uint8_t))); return buffer->_data[at]; } static inline uint8_t buffer_read_u8(buffer_type *buffer) { uint8_t result = buffer_read_u8_at(buffer, buffer->_position); buffer->_position += sizeof(uint8_t); return result; } static inline uint16_t buffer_read_u16_at(buffer_type *buffer, size_t at) { assert(buffer_available_at(buffer, at, sizeof(uint16_t))); return read_uint16(buffer->_data + at); } static inline uint16_t buffer_read_u16(buffer_type *buffer) { uint16_t result = buffer_read_u16_at(buffer, buffer->_position); buffer->_position += sizeof(uint16_t); return result; } static inline uint32_t buffer_read_u32_at(buffer_type *buffer, size_t at) { assert(buffer_available_at(buffer, at, sizeof(uint32_t))); return read_uint32(buffer->_data + at); } static inline uint32_t buffer_read_u32(buffer_type *buffer) { uint32_t result = buffer_read_u32_at(buffer, buffer->_position); buffer->_position += sizeof(uint32_t); return result; } /* * Print to the buffer, increasing the capacity if required using * buffer_reserve(). The buffer's position is set to the terminating * '\0'. Returns the number of characters written (not including the * terminating '\0'). */ int buffer_printf(buffer_type *buffer, const char *format, ...) ATTR_FORMAT(printf, 2, 3); #endif /* _BUFFER_H_ */ nsd-3.2.16/nsd-checkconf.c0000664000175000017500000003754412160600467014243 0ustar matjematje/* * checkconf - Read and repeat configuration file to output. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include "tsig.h" #include "options.h" #include "util.h" #include "dname.h" #include "rrl.h" extern char *optarg; extern int optind; #define ZONE_GET_ACL(NAME, VAR) \ if (strcasecmp(#NAME, (VAR)) == 0) { \ quote_acl((zone->NAME)); \ return; \ } #define ZONE_GET_OUTGOING(NAME, VAR) \ if (strcasecmp(#NAME, (VAR)) == 0) { \ acl_options_t* acl; \ for(acl=zone->NAME; acl; acl=acl->next) \ quote(acl->ip_address_spec); \ return; \ } #define ZONE_GET_STR(NAME, VAR) \ if (strcasecmp(#NAME, (VAR)) == 0) { \ quote(zone->NAME); \ return; \ } #define ZONE_GET_BIN(NAME, VAR) \ if (strcasecmp(#NAME, (VAR)) == 0) { \ printf("%s\n", zone->NAME?"yes":"no"); \ } #define ZONE_GET_RRL(NAME, VAR, PATTERN) \ if (strcasecmp(#NAME, (VAR)) == 0) { \ zone_print_rrl_whitelist("", PATTERN->NAME); \ return; \ } #define SERV_GET_BIN(NAME, VAR) \ if (strcasecmp(#NAME, (VAR)) == 0) { \ printf("%s\n", opt->NAME?"yes":"no"); \ return; \ } #define SERV_GET_STR(NAME, VAR) \ if (strcasecmp(#NAME, (VAR)) == 0) { \ quote(opt->NAME); \ return; \ } #define SERV_GET_INT(NAME, VAR) \ if (strcasecmp(#NAME, (VAR)) == 0) { \ printf("%d\n", (int) opt->NAME); \ return; \ } #define SERV_GET_IP(NAME, VAR) \ if (strcasecmp(#NAME, (VAR)) == 0) { \ for(ip = opt->ip_addresses; ip; ip=ip->next) \ { \ quote(ip->address); \ } \ return; \ } #ifdef RATELIMIT static void zone_print_rrl_whitelist(const char* s, uint16_t w) { int i; if(w==rrl_type_all) { printf("%sall\n", s); return; } for(i=0x01; i <= 0x80; i<<=1) { if( (w&i) ) printf("%s%s\n", s, rrltype2str(i)); } } #endif /* RATELIMIT */ static char buf[BUFSIZ]; static char * underscore(const char *s) { const char *j = s; size_t i = 0; while(j && *j) { if (*j == '-') { buf[i++] = '_'; } else { buf[i++] = *j; } j++; if (i >= BUFSIZ) { return NULL; } } buf[i] = '\0'; return buf; } static void usage(void) { fprintf(stderr, "usage: nsd-checkconf [-v|-h] [-o option] [-z zonename]\n"); fprintf(stderr, " [-s keyname] \n"); fprintf(stderr, " Checks NSD configuration file for errors.\n"); fprintf(stderr, " Version %s. Report bugs to <%s>.\n\n", PACKAGE_VERSION, PACKAGE_BUGREPORT); fprintf(stderr, "Use with a configfile as argument to check syntax.\n"); fprintf(stderr, "Use with -o, -z or -s options to query the configuration.\n\n"); fprintf(stderr, "-v Verbose, echo settings that take effect to std output.\n"); fprintf(stderr, "-h Print this help information.\n"); fprintf(stderr, "-o option Print value of the option specified to stdout.\n"); fprintf(stderr, "-z zonename Print option value for the zone given.\n"); fprintf(stderr, "-a keyname Print algorithm name for the TSIG key.\n"); fprintf(stderr, "-s keyname Print base64 secret blob for the TSIG key.\n"); exit(1); } static void print_string_var(const char* varname, const char* value) { if (!value) { printf("\t#%s\n", varname); } else { printf("\t%s \"%s\"\n", varname, value); } } static void quote(const char *v) { if(v==NULL) printf("\n"); else printf("%s\n", v); } static void quote_acl(acl_options_t* acl) { while(acl) { printf("%s %s\n", acl->ip_address_spec, acl->nokey?"NOKEY":(acl->blocked?"BLOCKED": (acl->key_name?acl->key_name:"(null)"))); acl=acl->next; } } static void print_acl(const char* varname, acl_options_t* acl) { while(acl) { printf("\t%s ", varname); if(acl->use_axfr_only) printf("AXFR "); if(acl->allow_udp) printf("UDP "); printf("%s %s\n", acl->ip_address_spec, acl->nokey?"NOKEY":(acl->blocked?"BLOCKED": (acl->key_name?acl->key_name:"(null)"))); if(1) { printf("\t# %s", acl->is_ipv6?"ip6":"ip4"); if(acl->port == 0) printf(" noport"); else printf(" port=%d", acl->port); if(acl->rangetype == acl_range_single) printf(" single"); if(acl->rangetype == acl_range_mask) printf(" masked"); if(acl->rangetype == acl_range_subnet) printf(" subnet"); if(acl->rangetype == acl_range_minmax) printf(" minmax"); if(acl->is_ipv6) { #ifdef INET6 char dest[128]; inet_ntop(AF_INET6, &acl->addr.addr6, dest, sizeof(dest)); printf(" addr=%s", dest); if(acl->rangetype != acl_range_single) { inet_ntop(AF_INET6, &acl->range_mask.addr6, dest, sizeof(dest)); printf(" rangemask=%s", dest); } #else printf(" ip6addr-noip6defined"); #endif } else { char dest[128]; inet_ntop(AF_INET, &acl->addr.addr, dest, sizeof(dest)); printf(" addr=%s", dest); if(acl->rangetype != acl_range_single) { inet_ntop(AF_INET, &acl->range_mask.addr, dest, sizeof(dest)); printf(" rangemask=%s", dest); } } printf("\n"); } acl=acl->next; } } static void print_acl_ips(const char* varname, acl_options_t* acl) { while(acl) { printf("\t%s %s\n", varname, acl->ip_address_spec); acl=acl->next; } } void config_print_zone(nsd_options_t* opt, const char* k, int s, const char *o, const char *z) { zone_options_t* zone; ip_address_option_t* ip; if (k) { /* find key */ key_options_t* key = opt->keys; for( ; key ; key=key->next) { if(strcmp(key->name, k) == 0) { if (s) { quote(key->secret); } else { quote(key->algorithm); } return; } } printf("Could not find key %s\n", k); return; } if (!o) { return; } if (z) { const dname_type *dname = dname_parse(opt->region, z); if(!dname) { printf("Could not parse zone name %s\n", z); exit(1); } /* look per zone */ RBTREE_FOR(zone, zone_options_t*, opt->zone_options) { if (dname_compare(dname, zone->node.key) == 0) { /* -z matches, return are in the defines */ ZONE_GET_STR(name, o); ZONE_GET_STR(zonefile, o); ZONE_GET_ACL(request_xfr, o); ZONE_GET_ACL(provide_xfr, o); ZONE_GET_ACL(allow_notify, o); ZONE_GET_ACL(notify, o); ZONE_GET_BIN(notify_retry, o); ZONE_GET_OUTGOING(outgoing_interface, o); ZONE_GET_BIN(allow_axfr_fallback, o); #ifdef RATELIMIT ZONE_GET_RRL(rrl_whitelist, o, zone); #endif printf("Zone option not handled: %s %s\n", z, o); exit(1); } } printf("Zone does not exist: %s\n", z); exit(1); } else { /* look in the server section */ SERV_GET_IP(ip_address, o); /* bin */ SERV_GET_BIN(ip_transparent, o); SERV_GET_BIN(debug_mode, o); SERV_GET_BIN(ip4_only, o); SERV_GET_BIN(ip6_only, o); SERV_GET_BIN(hide_version, o); /* str */ SERV_GET_STR(database, o); SERV_GET_STR(identity, o); SERV_GET_STR(nsid, o); SERV_GET_STR(logfile, o); SERV_GET_STR(pidfile, o); SERV_GET_STR(chroot, o); SERV_GET_STR(username, o); SERV_GET_STR(zonesdir, o); SERV_GET_STR(difffile, o); SERV_GET_STR(xfrdfile, o); SERV_GET_STR(port, o); #if defined(BIND8_STATS) && defined(USE_ZONE_STATS) SERV_GET_STR(zonestatsfile, o); #endif /* int */ SERV_GET_INT(server_count, o); SERV_GET_INT(tcp_count, o); SERV_GET_INT(tcp_query_count, o); SERV_GET_INT(tcp_timeout, o); SERV_GET_INT(ipv4_edns_size, o); SERV_GET_INT(ipv6_edns_size, o); SERV_GET_INT(statistics, o); SERV_GET_INT(xfrd_reload_timeout, o); SERV_GET_INT(verbosity, o); #ifdef RATELIMIT SERV_GET_INT(rrl_size, o); SERV_GET_INT(rrl_ratelimit, o); SERV_GET_INT(rrl_slip, o); SERV_GET_INT(rrl_ipv4_prefix_length, o); SERV_GET_INT(rrl_ipv6_prefix_length, o); SERV_GET_INT(rrl_whitelist_ratelimit, o); #endif if(strcasecmp(o, "zones") == 0) { RBTREE_FOR(zone, zone_options_t*, opt->zone_options) quote(zone->name); return; } printf("Server option not handled: %s\n", o); exit(1); } } void config_test_print_server(nsd_options_t* opt) { ip_address_option_t* ip; key_options_t* key; zone_options_t* zone; printf("# Config settings.\n"); printf("server:\n"); printf("\tdebug-mode: %s\n", opt->debug_mode?"yes":"no"); printf("\tip-transparent: %s\n", opt->ip_transparent?"yes":"no"); printf("\tip4-only: %s\n", opt->ip4_only?"yes":"no"); printf("\tip6-only: %s\n", opt->ip6_only?"yes":"no"); printf("\thide-version: %s\n", opt->hide_version?"yes":"no"); print_string_var("database:", opt->database); print_string_var("identity:", opt->identity); print_string_var("nsid:", opt->nsid); print_string_var("logfile:", opt->logfile); printf("\tserver_count: %d\n", opt->server_count); printf("\ttcp_count: %d\n", opt->tcp_count); printf("\ttcp_query_count: %d\n", opt->tcp_query_count); printf("\ttcp_timeout: %d\n", opt->tcp_timeout); printf("\tipv4-edns-size: %d\n", (int) opt->ipv4_edns_size); printf("\tipv6-edns-size: %d\n", (int) opt->ipv6_edns_size); print_string_var("pidfile:", opt->pidfile); print_string_var("port:", opt->port); printf("\tstatistics: %d\n", opt->statistics); #if defined(BIND8_STATS) && defined(USE_ZONE_STATS) printf("\tzone-stats-file: %s\n", opt->zonestatsfile); #endif print_string_var("chroot:", opt->chroot); print_string_var("username:", opt->username); print_string_var("zonesdir:", opt->zonesdir); print_string_var("difffile:", opt->difffile); print_string_var("xfrdfile:", opt->xfrdfile); printf("\txfrd_reload_timeout: %d\n", opt->xfrd_reload_timeout); printf("\tverbosity: %d\n", opt->verbosity); #ifdef RATELIMIT printf("\trrl-size: %d\n", (int)opt->rrl_size); printf("\trrl-ratelimit: %d\n", (int)opt->rrl_ratelimit); printf("\trrl-slip: %d\n", (int)opt->rrl_slip); printf("\trrl-ipv4-prefix-length: %d\n", (int)opt->rrl_ipv4_prefix_length); printf("\trrl-ipv6-prefix-length: %d\n", (int)opt->rrl_ipv6_prefix_length); printf("\trrl-whitelist-ratelimit: %d\n", (int)opt->rrl_whitelist_ratelimit); #endif for(ip = opt->ip_addresses; ip; ip=ip->next) { print_string_var("ip-address:", ip->address); } for(key = opt->keys; key; key=key->next) { printf("\nkey:\n"); print_string_var("name:", key->name); print_string_var("algorithm:", key->algorithm); print_string_var("secret:", key->secret); } RBTREE_FOR(zone, zone_options_t*, opt->zone_options) { printf("\nzone:\n"); print_string_var("name:", zone->name); print_string_var("zonefile:", zone->zonefile); #ifdef RATELIMIT zone_print_rrl_whitelist("\trrl-whitelist: ", zone->rrl_whitelist); #endif print_acl("allow-notify:", zone->allow_notify); print_acl("request-xfr:", zone->request_xfr); printf("\tnotify-retry: %d\n", zone->notify_retry); print_acl("notify:", zone->notify); print_acl("provide-xfr:", zone->provide_xfr); print_acl_ips("outgoing-interface:", zone->outgoing_interface); printf("\tallow-axfr-fallback: %s\n", zone->allow_axfr_fallback?"yes":"no"); } } static int additional_checks(nsd_options_t* opt, const char* filename) { ip_address_option_t* ip = opt->ip_addresses; zone_options_t* zone; key_options_t* key; int num = 0; int errors = 0; while(ip) { num++; ip = ip->next; } if(num > MAX_INTERFACES) { fprintf(stderr, "%s: too many interfaces (ip-address:) specified.\n", filename); errors ++; } RBTREE_FOR(zone, zone_options_t*, opt->zone_options) { const dname_type* dname = dname_parse(opt->region, zone->name); /* memory leak. */ if(!dname) { fprintf(stderr, "%s: cannot parse zone name syntax for zone %s.\n", filename, zone->name); errors ++; } if(zone->allow_notify && !zone->request_xfr) { fprintf(stderr, "%s: zone %s has allow-notify but no request-xfr" " items. Where can it get a zone transfer when a notify " "is received?\n", filename, zone->name); errors ++; } } for(key = opt->keys; key; key=key->next) { const dname_type* dname = dname_parse(opt->region, key->name); /* memory leak. */ uint8_t data[4000]; int size; if(!dname) { fprintf(stderr, "%s: cannot parse tsig name syntax for key %s.\n", filename, key->name); errors ++; } size = b64_pton(key->secret, data, sizeof(data)); if(size == -1) { fprintf(stderr, "%s: cannot base64 decode tsig secret: for key %s.\n", filename, key->name); errors ++; } if(tsig_get_algorithm_by_name(key->algorithm) == NULL) { fprintf(stderr, "%s: bad tsig algorithm %s: for key \ %s.\n", filename, key->algorithm, key->name); errors ++; } } #ifndef BIND8_STATS if(opt->statistics > 0) { fprintf(stderr, "%s: 'statistics: %d' but BIND 8 statistics feature not enabled.\n", filename, opt->statistics); errors ++; } # ifndef USE_ZONE_STATS if(opt->zonestatsfile) { fprintf(stderr, "%s: 'zone-stats-file: %s' but per zone BIND 8 statistics feature not enabled.\n", filename, opt->zonestatsfile); errors ++; } # endif #endif #ifndef HAVE_CHROOT if(opt->chroot != 0) { fprintf(stderr, "%s: chroot %s given. chroot not supported on this platform.\n", filename, opt->chroot); errors ++; } #endif if (opt->identity && strlen(opt->identity) > UCHAR_MAX) { fprintf(stderr, "%s: server identity too long (%u characters)\n", filename, (unsigned) strlen(opt->identity)); errors ++; } /* not done here: parsing of ip-address. parsing of username. */ if (opt->chroot) { int l = strlen(opt->chroot); if (strncmp(opt->chroot, opt->pidfile, l) != 0) { fprintf(stderr, "%s: pidfile %s is not relative to chroot %s.\n", filename, opt->pidfile, opt->chroot); errors ++; } if (strncmp(opt->chroot, opt->database, l) != 0) { fprintf(stderr, "%s: databasefile %s is not relative to chroot %s.\n", filename, opt->database, opt->chroot); errors ++; } if (strncmp(opt->chroot, opt->difffile, l) != 0) { fprintf(stderr, "%s: difffile %s is not relative to chroot %s.\n", filename, opt->difffile, opt->chroot); errors ++; } if (strncmp(opt->chroot, opt->xfrdfile, l) != 0) { fprintf(stderr, "%s: xfrdfile %s is not relative to chroot %s.\n", filename, opt->xfrdfile, opt->chroot); errors ++; } } if (atoi(opt->port) <= 0) { fprintf(stderr, "%s: port number '%s' is not a positive number.\n", filename, opt->port); errors ++; } if(errors != 0) { fprintf(stderr, "%s: %d semantic errors in %d zones, %d keys.\n", filename, errors, (int)nsd_options_num_zones(opt), (int)opt->numkeys); } return (errors == 0); } int main(int argc, char* argv[]) { int c; int verbose = 0; int key_sec = 0; const char * conf_opt = NULL; /* what option do you want? Can be NULL -> print all */ const char * conf_zone = NULL; /* what zone are we talking about */ const char * conf_key = NULL; /* what key is needed */ const char* configfile; nsd_options_t *options; log_init("nsd-checkconf"); /* Parse the command line... */ while ((c = getopt(argc, argv, "vo:a:s:z:")) != -1) { switch (c) { case 'v': verbose = 1; break; case 'o': conf_opt = optarg; break; case 'a': if (conf_key) { fprintf(stderr, "Error: cannot combine -a with -s or other -a.\n"); exit(1); } conf_key = optarg; break; case 's': if (conf_key) { fprintf(stderr, "Error: cannot combine -s with -a or other -s.\n"); exit(1); } conf_key = optarg; key_sec = 1; break; case 'z': conf_zone = optarg; break; default: usage(); }; } argc -= optind; argv += optind; if (argc == 0 || argc>=2) { usage(); } configfile = argv[0]; /* read config file */ options = nsd_options_create(region_create(xalloc, free)); tsig_init(options->region); if (!parse_options_file(options, configfile) || !additional_checks(options, configfile)) { exit(2); } if (conf_opt || conf_key) { config_print_zone(options, conf_key, key_sec, underscore(conf_opt), conf_zone); } else { if (verbose) { printf("# Read file %s: %d zones, %d keys.\n", configfile, (int)nsd_options_num_zones(options), (int)options->numkeys); config_test_print_server(options); } } return 0; } nsd-3.2.16/nsd.conf.sample.in0000664000175000017500000001416112156303073014676 0ustar matjematje# # nsd.conf -- the NSD(8) configuration file, nsd.conf(5). # # Copyright (c) 2001-2011, NLnet Labs. All rights reserved. # # See LICENSE for the license. # # This is a comment. # Sample configuration file # options for the nsd server server: # uncomment to specify specific interfaces to bind (default wildcard interface). # ip-address: 1.2.3.4 # ip-address: 1.2.3.4@5678 # ip-address: 12fe::8ef0 # Allow binding to non local addresses. Default no. # ip-transparent: no # don't answer VERSION.BIND and VERSION.SERVER CHAOS class queries # hide-version: no # enable debug mode, does not fork daemon process into the background. # debug-mode: no # listen only on IPv4 connections # ip4-only: no # listen only on IPv6 connections # ip6-only: no # the database to use # database: "@dbfile@" # identify the server (CH TXT ID.SERVER entry). # identity: "unidentified server" # NSID identity (hex string). default disabled. # nsid: "aabbccdd" # log messages to file. Default to stderr and syslog (with facility LOG_DAEMON). # logfile: "@logfile@" # Number of NSD servers to fork. # server-count: 1 # Maximum number of concurrent TCP connections per server. # This option should have a value below 1000. # tcp-count: 10 # Maximum number of queries served on a single TCP connection. # By default 0, which means no maximum. # tcp-query-count: 0 # Override the default (120 seconds) TCP timeout. # tcp-timeout: 120 # Preferred EDNS buffer size for IPv4. # ipv4-edns-size: 4096 # Preferred EDNS buffer size for IPv6. # ipv6-edns-size: 4096 # File to store pid for nsd in. # pidfile: "@pidfile@" # port to answer queries on. default is 53. # port: 53 # statistics are produced every number of seconds. # statistics: 3600 # if per zone statistics is enabled, file to store statistics. # zone-stats-file: "@zonestatsfile@" # Run NSD in a chroot-jail. # make sure to have pidfile and database reachable from there. # by default, no chroot-jail is used. # chroot: "@configdir@" # After binding socket, drop user privileges. # can be a username, id or id.gid. # username: @user@ # The directory for zonefile: files. # zonesdir: "@zonesdir@" # The file where incoming zone transfers are stored. # run nsd-patch to update zone files, then you can safely delete it. # difffile: "@difffile@" # The file where secondary zone refresh and expire timeouts are kept. # If you delete this file, all secondary zones are forced to be # 'refreshing' (as if nsd got a notify). # xfrdfile: "@xfrdfile@" # Number of seconds between reloads triggered by xfrd. # xfrd-reload-timeout: 10 # Verbosity level. # verbosity: 0 # RRLconfig # Response Rate Limiting, size of the hashtable. Default 1000000. # rrl-size: 1000000 # Response Rate Limiting, maximum QPS allowed (from one query source). # Default 200. If set to 0, ratelimiting is disabled. Also set # rrl-whitelist-ratelimit to 0 to disable ratelimit processing. # rrl-ratelimit: 200 # Response Rate Limiting, number of packets to discard before # sending a SLIP response (a truncated one, allowing an honest # resolver to retry with TCP). Default is 2 (one half of the # queries will receive a SLIP response, 0 disables SLIP (all # packets are discarded), 1 means every request will get a # SLIP response. # rrl-slip: 2 # Response Rate Limiting, IPv4 prefix length. Addresses are # grouped by netblock. # rrl-ipv4-prefix-length: 24 # Response Rate Limiting, IPv6 prefix length. Addresses are # grouped by netblock. # rrl-ipv6-prefix-length: 64 # Response Rate Limiting, maximum QPS allowed (from one query source) # for whitelisted types. Default 2000. # rrl-whitelist-ratelimit: 2000 # RRLend # key for zone 1 key: name: mskey algorithm: hmac-md5 secret: "K2tf3TRjvQkVCmJF3/Z9vA==" # Sample zone 1 zone: name: "example.com" zonefile: "example.com.zone" # This is a slave zone. Masters are listed below. # If no access control elements are provided, this zone # will not be served to/from other servers. # master 1 allow-notify: 168.192.44.42 mskey request-xfr: 168.192.44.42 mskey # master 2 allow-notify: 10.0.0.11 NOKEY request-xfr: 10.0.0.11 NOKEY # By default, a slave will request a zone transfer with IXFR/TCP. # If you want to make use of IXFR/UDP use allow-notify: 10.0.0.12 NOKEY request-xfr: UDP 10.0.0.12 NOKEY # for a master that only speaks AXFR (like NSD) use allow-notify: 10.0.0.13 NOKEY request-xfr: AXFR 10.0.0.13 NOKEY # Attention: You cannot use UDP and AXFR together. AXFR is always over # TCP. If you use UDP, we higly recommend you to deploy TSIG. # Allow AXFR fallback if the master does not support IXFR. Default # is yes. allow-axfr-fallback: "yes" # uncomment to provide AXFR to all the world # provide-xfr: 0.0.0.0/0 NOKEY # provide-xfr: ::0/0 NOKEY # set local interface for sending zone transfer requests. outgoing-interface: 10.0.0.10 # Sample zone 2 zone: name: "example.net" zonefile: "example.net.signed.zone" # This is a master zone. Slaves are listed below. # If no access control elements are provided, this zone # will not be served to/from other servers. # secondary 1. Uses port 5300. notify: 10.0.0.14@5300 sec1_key provide-xfr: 10.0.0.14@5300 sec1_key # secondary 2. notify: 10.11.12.14 sec2_key provide-xfr: 10.11.12.14 sec2_key # also provide xfr to operator's network. provide-xfr: 169.192.85.0/24 NOKEY # uncomment to disable xfr for the address. # provide-xfr: 169.192.85.66 BLOCKED # set the number of retries for notify. notify-retry: 5 # set local interface for sending notifies outgoing-interface: 10.0.0.15 # RRLconfig # Response Rate Limiting, whitelist types # rrl-whitelist: nxdomain # rrl-whitelist: error # rrl-whitelist: referral # rrl-whitelist: any # rrl-whitelist: rrsig # rrl-whitelist: wildcard # rrl-whitelist: nodata # rrl-whitelist: dnskey # rrl-whitelist: positive # rrl-whitelist: all # RRLend # keys for zone 2 key: name: "sec1_key" algorithm: hmac-md5 secret: "6KM6qiKfwfEpamEq72HQdA==" key: name: sec2_key algorithm: hmac-sha1 secret: "m83H2x8R0zbDf3yRKhrqgw==" key: name: sec3_key algorithm: hmac-sha256 secret: "m83H2x8R0zbDf3yRKhrqgw==" nsd-3.2.16/rdata.c0000664000175000017500000005150512162277142012624 0ustar matjematje/* * rdata.c -- RDATA conversion functions. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include #include #include #ifdef HAVE_STRINGS_H #include #endif #include "rdata.h" #include "zonec.h" /* Taken from RFC 4398, section 2.1. */ lookup_table_type dns_certificate_types[] = { /* 0 Reserved */ { 1, "PKIX" }, /* X.509 as per PKIX */ { 2, "SPKI" }, /* SPKI cert */ { 3, "PGP" }, /* OpenPGP packet */ { 4, "IPKIX" }, /* The URL of an X.509 data object */ { 5, "ISPKI" }, /* The URL of an SPKI certificate */ { 6, "IPGP" }, /* The fingerprint and URL of an OpenPGP packet */ { 7, "ACPKIX" }, /* Attribute Certificate */ { 8, "IACPKIX" }, /* The URL of an Attribute Certificate */ { 253, "URI" }, /* URI private */ { 254, "OID" }, /* OID private */ /* 255 Reserved */ /* 256-65279 Available for IANA assignment */ /* 65280-65534 Experimental */ /* 65535 Reserved */ { 0, NULL } }; /* Taken from RFC 2535, section 7. */ lookup_table_type dns_algorithms[] = { { 1, "RSAMD5" }, /* RFC 2537 */ { 2, "DH" }, /* RFC 2539 */ { 3, "DSA" }, /* RFC 2536 */ { 4, "ECC" }, { 5, "RSASHA1" }, /* RFC 3110 */ { 6, "DSA-NSEC3-SHA1" }, /* RFC 5155 */ { 7, "RSASHA1-NSEC3-SHA1" }, /* RFC 5155 */ { 8, "RSASHA256" }, /* RFC 5702 */ { 10, "RSASHA512" }, /* RFC 5702 */ { 12, "ECC-GOST" }, /* RFC 5933 */ { 13, "ECDSAP256SHA256" }, /* RFC 6605 */ { 14, "ECDSAP384SHA384" }, /* RFC 6605 */ { 252, "INDIRECT" }, { 253, "PRIVATEDNS" }, { 254, "PRIVATEOID" }, { 0, NULL } }; typedef int (*rdata_to_string_type)(buffer_type *output, rdata_atom_type rdata, rr_type *rr); static int rdata_dname_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { buffer_printf(output, "%s", dname_to_string(domain_dname(rdata_atom_domain(rdata)), NULL)); return 1; } static int rdata_dns_name_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { const uint8_t *data = rdata_atom_data(rdata); size_t offset = 0; uint8_t length = data[offset]; size_t i; while (length > 0) { if (offset) /* concat label */ buffer_printf(output, "."); for (i = 1; i <= length; ++i) { uint8_t ch = data[i+offset]; if (ch=='.' || ch==';' || ch=='(' || ch==')' || ch=='\\') { buffer_printf(output, "\\%c", (char) ch); } else if (!isgraph((int) ch)) { buffer_printf(output, "\\%03u", (unsigned int) ch); } else if (isprint((int) ch)) { buffer_printf(output, "%c", (char) ch); } else { buffer_printf(output, "\\%03u", (unsigned int) ch); } } /* next label */ offset = offset+length+1; length = data[offset]; } /* root label */ buffer_printf(output, "."); return 1; } static int rdata_text_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { const uint8_t *data = rdata_atom_data(rdata); uint8_t length = data[0]; size_t i; buffer_printf(output, "\""); for (i = 1; i <= length; ++i) { char ch = (char) data[i]; if (isprint((int)ch)) { if (ch == '"' || ch == '\\') { buffer_printf(output, "\\"); } buffer_printf(output, "%c", ch); } else { buffer_printf(output, "\\%03u", (unsigned) data[i]); } } buffer_printf(output, "\""); return 1; } static int rdata_texts_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { uint16_t pos = 0; const uint8_t *data = rdata_atom_data(rdata); uint16_t length = rdata_atom_size(rdata); size_t i; while (pos < length && pos + data[pos] < length) { buffer_printf(output, "\""); for (i = 1; i <= data[pos]; ++i) { char ch = (char) data[pos + i]; if (isprint((int)ch)) { if (ch == '"' || ch == '\\') { buffer_printf(output, "\\"); } buffer_printf(output, "%c", ch); } else { buffer_printf(output, "\\%03u", (unsigned) data[pos+i]); } } pos += data[pos]+1; buffer_printf(output, pos < length?"\" ":"\""); } return 1; } static int rdata_byte_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { uint8_t data = *rdata_atom_data(rdata); buffer_printf(output, "%lu", (unsigned long) data); return 1; } static int rdata_short_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { uint16_t data = read_uint16(rdata_atom_data(rdata)); buffer_printf(output, "%lu", (unsigned long) data); return 1; } static int rdata_long_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { uint32_t data = read_uint32(rdata_atom_data(rdata)); buffer_printf(output, "%lu", (unsigned long) data); return 1; } static int rdata_a_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { int result = 0; char str[200]; if (inet_ntop(AF_INET, rdata_atom_data(rdata), str, sizeof(str))) { buffer_printf(output, "%s", str); result = 1; } return result; } static int rdata_aaaa_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { int result = 0; char str[200]; if (inet_ntop(AF_INET6, rdata_atom_data(rdata), str, sizeof(str))) { buffer_printf(output, "%s", str); result = 1; } return result; } static int rdata_ilnp64_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { uint8_t* data = rdata_atom_data(rdata); uint16_t a1 = read_uint16(data); uint16_t a2 = read_uint16(data+2); uint16_t a3 = read_uint16(data+4); uint16_t a4 = read_uint16(data+6); buffer_printf(output, "%.4x:%.4x:%.4x:%.4x", a1, a2, a3, a4); return 1; } #ifdef DRAFT_RRTYPES static int rdata_eui48_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { uint8_t* data = rdata_atom_data(rdata); uint8_t a1 = data[0]; uint8_t a2 = data[1]; uint8_t a3 = data[2]; uint8_t a4 = data[3]; uint8_t a5 = data[4]; uint8_t a6 = data[5]; buffer_printf(output, "%.2x-%.2x-%.2x-%.2x-%.2x-%.2x", a1, a2, a3, a4, a5, a6); return 1; } static int rdata_eui64_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { uint8_t* data = rdata_atom_data(rdata); uint8_t a1 = data[0]; uint8_t a2 = data[1]; uint8_t a3 = data[2]; uint8_t a4 = data[3]; uint8_t a5 = data[4]; uint8_t a6 = data[5]; uint8_t a7 = data[6]; uint8_t a8 = data[7]; buffer_printf(output, "%.2x-%.2x-%.2x-%.2x-%.2x-%.2x-%.2x-%.2x", a1, a2, a3, a4, a5, a6, a7, a8); return 1; } #endif static int rdata_rrtype_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { uint16_t type = read_uint16(rdata_atom_data(rdata)); buffer_printf(output, "%s", rrtype_to_string(type)); return 1; } static int rdata_algorithm_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { uint8_t id = *rdata_atom_data(rdata); buffer_printf(output, "%u", (unsigned) id); return 1; } static int rdata_certificate_type_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { uint16_t id = read_uint16(rdata_atom_data(rdata)); lookup_table_type *type = lookup_by_id(dns_certificate_types, id); if (type) { buffer_printf(output, "%s", type->name); } else { buffer_printf(output, "%u", (unsigned) id); } return 1; } static int rdata_period_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { uint32_t period = read_uint32(rdata_atom_data(rdata)); buffer_printf(output, "%lu", (unsigned long) period); return 1; } static int rdata_time_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { int result = 0; time_t time = (time_t) read_uint32(rdata_atom_data(rdata)); struct tm *tm = gmtime(&time); char buf[15]; if (strftime(buf, sizeof(buf), "%Y%m%d%H%M%S", tm)) { buffer_printf(output, "%s", buf); result = 1; } return result; } static int rdata_base32_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { int length; size_t size = rdata_atom_size(rdata); if(size == 0) { buffer_write(output, "-", 1); return 1; } size -= 1; /* remove length byte from count */ buffer_reserve(output, size * 2 + 1); length = b32_ntop(rdata_atom_data(rdata)+1, size, (char *) buffer_current(output), size * 2); if (length > 0) { buffer_skip(output, length); } return length != -1; } static int rdata_base64_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { int length; size_t size = rdata_atom_size(rdata); if(size == 0) return 1; buffer_reserve(output, size * 2 + 1); length = b64_ntop(rdata_atom_data(rdata), size, (char *) buffer_current(output), size * 2); if (length > 0) { buffer_skip(output, length); } return length != -1; } static void hex_to_string(buffer_type *output, const uint8_t *data, size_t size) { static const char hexdigits[] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' }; size_t i; buffer_reserve(output, size * 2); for (i = 0; i < size; ++i) { uint8_t octet = *data++; buffer_write_u8(output, hexdigits[octet >> 4]); buffer_write_u8(output, hexdigits[octet & 0x0f]); } } static int rdata_hex_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { hex_to_string(output, rdata_atom_data(rdata), rdata_atom_size(rdata)); return 1; } static int rdata_hexlen_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { if(rdata_atom_size(rdata) <= 1) { /* NSEC3 salt hex can be empty */ buffer_printf(output, "-"); return 1; } hex_to_string(output, rdata_atom_data(rdata)+1, rdata_atom_size(rdata)-1); return 1; } static int rdata_nsap_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { buffer_printf(output, "0x"); hex_to_string(output, rdata_atom_data(rdata), rdata_atom_size(rdata)); return 1; } static int rdata_apl_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { int result = 0; buffer_type packet; buffer_create_from( &packet, rdata_atom_data(rdata), rdata_atom_size(rdata)); if (buffer_available(&packet, 4)) { uint16_t address_family = buffer_read_u16(&packet); uint8_t prefix = buffer_read_u8(&packet); uint8_t length = buffer_read_u8(&packet); int negated = length & APL_NEGATION_MASK; int af = -1; length &= APL_LENGTH_MASK; switch (address_family) { case 1: af = AF_INET; break; case 2: af = AF_INET6; break; } if (af != -1 && buffer_available(&packet, length)) { char text_address[1000]; uint8_t address[128]; memset(address, 0, sizeof(address)); buffer_read(&packet, address, length); if (inet_ntop(af, address, text_address, sizeof(text_address))) { buffer_printf(output, "%s%d:%s/%d", negated ? "!" : "", (int) address_family, text_address, (int) prefix); result = 1; } } } return result; } static int rdata_services_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { int result = 0; buffer_type packet; buffer_create_from( &packet, rdata_atom_data(rdata), rdata_atom_size(rdata)); if (buffer_available(&packet, 1)) { uint8_t protocol_number = buffer_read_u8(&packet); ssize_t bitmap_size = buffer_remaining(&packet); uint8_t *bitmap = buffer_current(&packet); struct protoent *proto = getprotobynumber(protocol_number); if (proto) { int i; buffer_printf(output, "%s", proto->p_name); for (i = 0; i < bitmap_size * 8; ++i) { if (get_bit(bitmap, i)) { struct servent *service = getservbyport((int)htons(i), proto->p_name); if (service) { buffer_printf(output, " %s", service->s_name); } else { buffer_printf(output, " %d", i); } } } buffer_skip(&packet, bitmap_size); result = 1; } } return result; } static int rdata_ipsecgateway_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* rr) { int gateway_type = rdata_atom_data(rr->rdatas[1])[0]; switch(gateway_type) { case IPSECKEY_NOGATEWAY: buffer_printf(output, "."); break; case IPSECKEY_IP4: rdata_a_to_string(output, rdata, rr); break; case IPSECKEY_IP6: rdata_aaaa_to_string(output, rdata, rr); break; case IPSECKEY_DNAME: { region_type* temp = region_create(xalloc, free); const dname_type* d = dname_make(temp, rdata_atom_data(rdata), 0); if(!d) { region_destroy(temp); return 0; } buffer_printf(output, "%s", dname_to_string(d, NULL)); region_destroy(temp); } break; default: return 0; } return 1; } static int rdata_nxt_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { size_t i; uint8_t *bitmap = rdata_atom_data(rdata); size_t bitmap_size = rdata_atom_size(rdata); for (i = 0; i < bitmap_size * 8; ++i) { if (get_bit(bitmap, i)) { buffer_printf(output, "%s ", rrtype_to_string(i)); } } buffer_skip(output, -1); return 1; } static int rdata_nsec_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { size_t saved_position = buffer_position(output); buffer_type packet; int insert_space = 0; buffer_create_from( &packet, rdata_atom_data(rdata), rdata_atom_size(rdata)); while (buffer_available(&packet, 2)) { uint8_t window = buffer_read_u8(&packet); uint8_t bitmap_size = buffer_read_u8(&packet); uint8_t *bitmap = buffer_current(&packet); int i; if (!buffer_available(&packet, bitmap_size)) { buffer_set_position(output, saved_position); return 0; } for (i = 0; i < bitmap_size * 8; ++i) { if (get_bit(bitmap, i)) { buffer_printf(output, "%s%s", insert_space ? " " : "", rrtype_to_string( window * 256 + i)); insert_space = 1; } } buffer_skip(&packet, bitmap_size); } return 1; } static int rdata_loc_to_string(buffer_type *ATTR_UNUSED(output), rdata_atom_type ATTR_UNUSED(rdata), rr_type* ATTR_UNUSED(rr)) { /* * Returning 0 forces the record to be printed in unknown * format. */ return 0; } static int rdata_unknown_to_string(buffer_type *output, rdata_atom_type rdata, rr_type* ATTR_UNUSED(rr)) { uint16_t size = rdata_atom_size(rdata); buffer_printf(output, "\\# %lu ", (unsigned long) size); hex_to_string(output, rdata_atom_data(rdata), size); return 1; } static rdata_to_string_type rdata_to_string_table[RDATA_ZF_UNKNOWN + 1] = { rdata_dname_to_string, rdata_dns_name_to_string, rdata_text_to_string, rdata_texts_to_string, rdata_byte_to_string, rdata_short_to_string, rdata_long_to_string, rdata_a_to_string, rdata_aaaa_to_string, rdata_rrtype_to_string, rdata_algorithm_to_string, rdata_certificate_type_to_string, rdata_period_to_string, rdata_time_to_string, rdata_base64_to_string, rdata_base32_to_string, rdata_hex_to_string, rdata_hexlen_to_string, rdata_nsap_to_string, rdata_apl_to_string, rdata_ipsecgateway_to_string, rdata_services_to_string, rdata_nxt_to_string, rdata_nsec_to_string, rdata_loc_to_string, rdata_ilnp64_to_string, #ifdef DRAFT_RRTYPES rdata_eui48_to_string, rdata_eui64_to_string, #endif rdata_unknown_to_string }; int rdata_atom_to_string(buffer_type *output, rdata_zoneformat_type type, rdata_atom_type rdata, rr_type* record) { return rdata_to_string_table[type](output, rdata, record); } ssize_t rdata_wireformat_to_rdata_atoms(region_type *region, domain_table_type *owners, uint16_t rrtype, uint16_t data_size, buffer_type *packet, rdata_atom_type **rdatas) { size_t end = buffer_position(packet) + data_size; size_t i; rdata_atom_type temp_rdatas[MAXRDATALEN]; rrtype_descriptor_type *descriptor = rrtype_descriptor_by_type(rrtype); region_type *temp_region; assert(descriptor->maximum <= MAXRDATALEN); if (!buffer_available(packet, data_size)) { return -1; } temp_region = region_create(xalloc, free); for (i = 0; i < descriptor->maximum; ++i) { int is_domain = 0; int is_normalized = 0; int is_wirestore = 0; size_t length = 0; int required = i < descriptor->minimum; switch (rdata_atom_wireformat_type(rrtype, i)) { case RDATA_WF_COMPRESSED_DNAME: case RDATA_WF_UNCOMPRESSED_DNAME: is_domain = 1; is_normalized = 1; break; case RDATA_WF_LITERAL_DNAME: is_domain = 1; is_wirestore = 1; break; case RDATA_WF_BYTE: length = sizeof(uint8_t); break; case RDATA_WF_SHORT: length = sizeof(uint16_t); break; case RDATA_WF_LONG: length = sizeof(uint32_t); break; case RDATA_WF_TEXTS: length = data_size; break; case RDATA_WF_TEXT: case RDATA_WF_BINARYWITHLENGTH: /* Length is stored in the first byte. */ length = 1; if (buffer_position(packet) + length <= end) { length += buffer_current(packet)[length - 1]; } break; case RDATA_WF_A: length = sizeof(in_addr_t); break; case RDATA_WF_AAAA: length = IP6ADDRLEN; break; case RDATA_WF_ILNP64: length = IP6ADDRLEN/2; break; #ifdef DRAFT_RRTYPES case RDATA_WF_EUI48: length = EUI48ADDRLEN; case RDATA_WF_EUI64: length = EUI64ADDRLEN; break; #endif case RDATA_WF_BINARY: /* Remaining RDATA is binary. */ length = end - buffer_position(packet); break; case RDATA_WF_APL: length = (sizeof(uint16_t) /* address family */ + sizeof(uint8_t) /* prefix */ + sizeof(uint8_t)); /* length */ if (buffer_position(packet) + length <= end) { /* Mask out negation bit. */ length += (buffer_current(packet)[length - 1] & APL_LENGTH_MASK); } break; case RDATA_WF_IPSECGATEWAY: switch(rdata_atom_data(temp_rdatas[1])[0]) /* gateway type */ { default: case IPSECKEY_NOGATEWAY: length = 0; break; case IPSECKEY_IP4: length = IP4ADDRLEN; break; case IPSECKEY_IP6: length = IP6ADDRLEN; break; case IPSECKEY_DNAME: is_domain = 1; is_normalized = 1; is_wirestore = 1; break; } break; } if (is_domain) { const dname_type *dname; if (!required && buffer_position(packet) == end) { break; } dname = dname_make_from_packet( temp_region, packet, 1, is_normalized); if (!dname || buffer_position(packet) > end) { /* Error in domain name. */ region_destroy(temp_region); return -1; } if(is_wirestore) { temp_rdatas[i].data = (uint16_t *) region_alloc( region, sizeof(uint16_t) + dname->name_size); temp_rdatas[i].data[0] = dname->name_size; memcpy(temp_rdatas[i].data+1, dname_name(dname), dname->name_size); } else temp_rdatas[i].domain = domain_table_insert(owners, dname); } else { if (buffer_position(packet) + length > end) { if (required) { /* Truncated RDATA. */ region_destroy(temp_region); return -1; } else { break; } } if (!required && buffer_position(packet) == end) { break; } temp_rdatas[i].data = (uint16_t *) region_alloc( region, sizeof(uint16_t) + length); temp_rdatas[i].data[0] = length; buffer_read(packet, temp_rdatas[i].data + 1, length); } } if (buffer_position(packet) < end) { /* Trailing garbage. */ region_destroy(temp_region); return -1; } *rdatas = (rdata_atom_type *) region_alloc_init( region, temp_rdatas, i * sizeof(rdata_atom_type)); region_destroy(temp_region); return (ssize_t)i; } size_t rdata_maximum_wireformat_size(rrtype_descriptor_type *descriptor, size_t rdata_count, rdata_atom_type *rdatas) { size_t result = 0; size_t i; for (i = 0; i < rdata_count; ++i) { if (rdata_atom_is_domain(descriptor->type, i)) { result += domain_dname(rdata_atom_domain(rdatas[i]))->name_size; } else { result += rdata_atom_size(rdatas[i]); } } return result; } int rdata_atoms_to_unknown_string(buffer_type *output, rrtype_descriptor_type *descriptor, size_t rdata_count, rdata_atom_type *rdatas) { size_t i; size_t size = rdata_maximum_wireformat_size(descriptor, rdata_count, rdatas); buffer_printf(output, " \\# %lu ", (unsigned long) size); for (i = 0; i < rdata_count; ++i) { if (rdata_atom_is_domain(descriptor->type, i)) { const dname_type *dname = domain_dname(rdata_atom_domain(rdatas[i])); hex_to_string( output, dname_name(dname), dname->name_size); } else { hex_to_string(output, rdata_atom_data(rdatas[i]), rdata_atom_size(rdatas[i])); } } return 1; } int print_rdata(buffer_type *output, rrtype_descriptor_type *descriptor, rr_type *record) { size_t i; size_t saved_position = buffer_position(output); for (i = 0; i < record->rdata_count; ++i) { if (i == 0) { buffer_printf(output, "\t"); } else if (descriptor->type == TYPE_SOA && i == 2) { buffer_printf(output, " (\n\t\t"); } else { buffer_printf(output, " "); } if (!rdata_atom_to_string( output, (rdata_zoneformat_type) descriptor->zoneformat[i], record->rdatas[i], record)) { buffer_set_position(output, saved_position); return 0; } } if (descriptor->type == TYPE_SOA) { buffer_printf(output, " )"); } return 1; } nsd-3.2.16/nsec3.h0000664000175000017500000000470512073243522012545 0ustar matjematje/* * nsec3.h -- nsec3 handling. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef NSEC3_H #define NSEC3_H #include "config.h" #ifdef NSEC3 struct domain; struct dname; struct region; struct zone; struct namedb; struct query; struct answer; #ifndef FULL_PREHASH struct rr; struct nsec3_domain; #endif /* * Create the hashed name of the nsec3 record * for the given dname. */ const struct dname *nsec3_hash_dname(struct region *region, struct zone *zone, const struct dname *dname); /* * calculate prehash information for all zones, * selects only updated=1 zones if bool set. */ void prehash(struct namedb* db, int updated_only); #ifndef FULL_PREHASH void prehash_zone(struct namedb *db, struct zone *zone); void prehash_zone_incremental(struct namedb *db, struct zone *zone); #endif /* * finds nsec3 that covers the given domain dname. * returns true if the find is exact. * hashname is the already hashed dname for the NSEC3. */ #ifdef FULL_PREHASH int nsec3_find_cover(struct namedb* db, struct zone* zone, const struct dname* hashname, struct domain** result); #else int nsec3_find_cover(struct namedb* ATTR_UNUSED(db), struct zone* zone, const struct dname* hashname, struct nsec3_domain** result); #endif /* * _answer_ Routines used to add the correct nsec3 record to a query answer. * cnames etc may have been followed, hence original name. */ /* * add proof for wildcards that the name below the wildcard.parent * does not exist */ void nsec3_answer_wildcard(struct query *query, struct answer *answer, struct domain *wildcard, struct namedb* db, const struct dname *qname); /* * add NSEC3 to provide domain name but not rrset exists, * this could be a query for a DS or NSEC3 type */ void nsec3_answer_nodata(struct query *query, struct answer *answer, struct domain *original); /* * add NSEC3 for a delegation (optout stuff) */ void nsec3_answer_delegation(struct query *query, struct answer *answer); /* * add NSEC3 for authoritative answers. * match==0 is an nxdomain. */ void nsec3_answer_authoritative(struct domain** match, struct query *query, struct answer *answer, struct domain* closest_encloser, struct namedb* db, const struct dname* qname); /* * True if domain is a NSEC3 (+RRSIG) data only variety. * pass nonNULL zone to filter for particular zone. */ int domain_has_only_NSEC3(struct domain* domain, struct zone* zone); #endif /* NSEC3 */ #endif /* NSEC3_H*/ nsd-3.2.16/xfrd.c0000664000175000017500000015220412166530743012475 0ustar matjematje/* * xfrd.c - XFR (transfer) Daemon source file. Coordinates SOA updates. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include "xfrd.h" #include "xfrd-tcp.h" #include "xfrd-disk.h" #include "xfrd-notify.h" #include "options.h" #include "util.h" #include "netio.h" #include "region-allocator.h" #include "nsd.h" #include "packet.h" #include "difffile.h" #include "ipc.h" #define XFRD_TRANSFER_TIMEOUT_START 10 /* empty zone timeout is between x and 2*x seconds */ #define XFRD_TRANSFER_TIMEOUT_MAX 14400 /* empty zone timeout max expbackoff */ #define XFRD_UDP_TIMEOUT 10 /* seconds, before a udp request times out */ #define XFRD_NO_IXFR_CACHE 172800 /* 48h before retrying ixfr's after notimpl */ #define XFRD_LOWERBOUND_REFRESH 1 /* seconds, smallest refresh timeout */ #define XFRD_LOWERBOUND_RETRY 1 /* seconds, smallest retry timeout */ #define XFRD_MAX_ROUNDS 3 /* max number of rounds along the masters */ #define XFRD_TSIG_MAX_UNSIGNED 103 /* max number of packets without tsig in a tcp stream. */ /* rfc recommends 100, +3 for offbyone errors/interoperability. */ /* the daemon state */ xfrd_state_t* xfrd = 0; /* main xfrd loop */ static void xfrd_main(); /* shut down xfrd, close sockets. */ static void xfrd_shutdown(); /* create zone rbtree at start */ static void xfrd_init_zones(); /* free up memory used by main database */ static void xfrd_free_namedb(); /* handle zone timeout, event */ static void xfrd_handle_zone(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); /* handle incoming notification message. soa can be NULL. true if transfer needed. */ static int xfrd_handle_incoming_notify(xfrd_zone_t* zone, xfrd_soa_t* soa); /* call with buffer just after the soa dname. returns 0 on error. */ static int xfrd_parse_soa_info(buffer_type* packet, xfrd_soa_t* soa); /* set the zone state to a new state (takes care of expiry messages) */ static void xfrd_set_zone_state(xfrd_zone_t* zone, enum xfrd_zone_state new_zone_state); /* set timer for retry amount (depends on zone_state) */ static void xfrd_set_timer_retry(xfrd_zone_t* zone); /* set timer for refresh timeout (depends on zone_state) */ static void xfrd_set_timer_refresh(xfrd_zone_t* zone); /* set reload timeout */ static void xfrd_set_reload_timeout(); /* handle reload timeout */ static void xfrd_handle_reload(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); /* send expiry notifications to nsd */ static void xfrd_send_expire_notification(xfrd_zone_t* zone); /* send ixfr request, returns fd of connection to read on */ static int xfrd_send_ixfr_request_udp(xfrd_zone_t* zone); /* obtain udp socket slot */ static void xfrd_udp_obtain(xfrd_zone_t* zone); /* read data via udp */ static void xfrd_udp_read(xfrd_zone_t* zone); /* find master by notify number */ static int find_same_master_notify(xfrd_zone_t* zone, int acl_num_nfy); void xfrd_init(int socket, struct nsd* nsd) { region_type* region; assert(xfrd == 0); /* to setup signalhandling */ nsd->server_kind = NSD_SERVER_BOTH; region = region_create(xalloc, free); xfrd = (xfrd_state_t*)region_alloc(region, sizeof(xfrd_state_t)); memset(xfrd, 0, sizeof(xfrd_state_t)); xfrd->region = region; xfrd->xfrd_start_time = time(0); xfrd->netio = netio_create(xfrd->region); xfrd->nsd = nsd; xfrd->packet = buffer_create(xfrd->region, QIOBUFSZ); xfrd->udp_waiting_first = NULL; xfrd->udp_waiting_last = NULL; xfrd->udp_use_num = 0; xfrd->ipc_pass = buffer_create(xfrd->region, QIOBUFSZ); xfrd->parent_soa_info_pass = 0; /* add the handlers already, because this involves allocs */ xfrd->reload_handler.fd = -1; xfrd->reload_handler.timeout = NULL; xfrd->reload_handler.user_data = xfrd; xfrd->reload_handler.event_types = NETIO_EVENT_TIMEOUT; xfrd->reload_handler.event_handler = xfrd_handle_reload; xfrd->reload_timeout.tv_sec = 0; xfrd->reload_cmd_last_sent = xfrd->xfrd_start_time; xfrd->can_send_reload = 1; xfrd->ipc_send_blocked = 0; xfrd->ipc_handler.fd = socket; xfrd->ipc_handler.timeout = NULL; xfrd->ipc_handler.user_data = xfrd; xfrd->ipc_handler.event_types = NETIO_EVENT_READ; xfrd->ipc_handler.event_handler = xfrd_handle_ipc; xfrd->ipc_conn = xfrd_tcp_create(xfrd->region); /* not reading using ipc_conn yet */ xfrd->ipc_conn->is_reading = 0; xfrd->ipc_conn->fd = xfrd->ipc_handler.fd; xfrd->ipc_conn_write = xfrd_tcp_create(xfrd->region); xfrd->ipc_conn_write->fd = xfrd->ipc_handler.fd; xfrd->need_to_send_reload = 0; xfrd->sending_zone_state = 0; xfrd->dirty_zones = stack_create(xfrd->region, nsd_options_num_zones(nsd->options)); xfrd->notify_waiting_first = NULL; xfrd->notify_waiting_last = NULL; xfrd->notify_udp_num = 0; xfrd->tcp_set = xfrd_tcp_set_create(xfrd->region); xfrd->tcp_set->tcp_timeout = nsd->tcp_timeout; srandom((unsigned long) getpid() * (unsigned long) time(NULL)); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd pre-startup")); diff_snip_garbage(nsd->db, nsd->options); xfrd_init_zones(); xfrd_free_namedb(); xfrd_read_state(xfrd); xfrd_send_expy_all_zones(); /* add handlers after zone handlers so they are before them in list */ netio_add_handler(xfrd->netio, &xfrd->reload_handler); netio_add_handler(xfrd->netio, &xfrd->ipc_handler); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd startup")); xfrd_main(); } static void xfrd_main() { xfrd->shutdown = 0; while(!xfrd->shutdown) { /* dispatch may block for a longer period, so current is gone */ xfrd->got_time = 0; if(netio_dispatch(xfrd->netio, NULL, 0) == -1) { if (errno != EINTR) { log_msg(LOG_ERR, "xfrd netio_dispatch failed: %s", strerror(errno)); } } if(xfrd->nsd->signal_hint_quit || xfrd->nsd->signal_hint_shutdown) xfrd->shutdown = 1; } xfrd_shutdown(); } static void xfrd_shutdown() { xfrd_zone_t* zone; int i; DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd shutdown")); xfrd_write_state(xfrd); close(xfrd->ipc_handler.fd); /* close tcp sockets */ for(i=0; itcp_set->tcp_state[i]->fd != -1) { close(xfrd->tcp_set->tcp_state[i]->fd); xfrd->tcp_set->tcp_state[i]->fd = -1; } } /* close udp sockets */ RBTREE_FOR(zone, xfrd_zone_t*, xfrd->zones) { if(zone->tcp_conn==-1 && zone->zone_handler.fd != -1) { close(zone->zone_handler.fd); zone->zone_handler.fd = -1; } } close_notify_fds(xfrd->notify_zones); /* shouldn't we clean up memory used by xfrd process */ DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd shutdown complete")); exit(0); } static void xfrd_init_zones() { zone_type *dbzone; zone_options_t *zone_opt; xfrd_zone_t *xzone; const dname_type* dname; assert(xfrd->zones == 0); assert(xfrd->nsd->db != 0); xfrd->zones = rbtree_create(xfrd->region, (int (*)(const void *, const void *)) dname_compare); xfrd->notify_zones = rbtree_create(xfrd->region, (int (*)(const void *, const void *)) dname_compare); RBTREE_FOR(zone_opt, zone_options_t*, xfrd->nsd->options->zone_options) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "Zone %s\n", zone_opt->name)); dname = dname_parse(xfrd->region, zone_opt->name); if(!dname) { log_msg(LOG_ERR, "xfrd: Could not parse zone name %s.", zone_opt->name); continue; } dbzone = domain_find_zone(domain_table_find(xfrd->nsd->db->domains, dname)); if(dbzone && dname_compare(dname, domain_dname(dbzone->apex)) != 0) dbzone = 0; /* we found a parent zone */ DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: adding %s zone %s\n", dbzone?"filled":"empty", zone_opt->name)); init_notify_send(xfrd->notify_zones, xfrd->netio, xfrd->region, dname, zone_opt, dbzone); if(!zone_is_slave(zone_opt)) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s, master zone has no outgoing xfr requests", zone_opt->name)); continue; } xzone = (xfrd_zone_t*)region_alloc(xfrd->region, sizeof(xfrd_zone_t)); memset(xzone, 0, sizeof(xfrd_zone_t)); xzone->apex = dname; xzone->apex_str = zone_opt->name; xzone->state = xfrd_zone_refreshing; xzone->dirty = 0; xzone->zone_options = zone_opt; /* first retry will use first master */ xzone->master = 0; xzone->master_num = 0; xzone->next_master = 0; xzone->fresh_xfr_timeout = XFRD_TRANSFER_TIMEOUT_START; xzone->soa_nsd_acquired = 0; xzone->soa_disk_acquired = 0; xzone->soa_notified_acquired = 0; /* [0]=1, [1]=0; "." domain name */ xzone->soa_nsd.prim_ns[0] = 1; xzone->soa_nsd.email[0] = 1; xzone->soa_disk.prim_ns[0]=1; xzone->soa_disk.email[0]=1; xzone->soa_notified.prim_ns[0]=1; xzone->soa_notified.email[0]=1; xzone->zone_handler.fd = -1; xzone->zone_handler.timeout = 0; xzone->zone_handler.user_data = xzone; xzone->zone_handler.event_types = NETIO_EVENT_READ|NETIO_EVENT_TIMEOUT; xzone->zone_handler.event_handler = xfrd_handle_zone; netio_add_handler(xfrd->netio, &xzone->zone_handler); xzone->tcp_conn = -1; xzone->tcp_waiting = 0; xzone->udp_waiting = 0; tsig_create_record_custom(&xzone->tsig, xfrd->region, 0, 0, 4); if(dbzone && dbzone->soa_rrset && dbzone->soa_rrset->rrs) { xzone->soa_nsd_acquired = xfrd_time(); xzone->soa_disk_acquired = xfrd_time(); /* we only use the first SOA in the rrset */ xfrd_copy_soa(&xzone->soa_nsd, dbzone->soa_rrset->rrs); xfrd_copy_soa(&xzone->soa_disk, dbzone->soa_rrset->rrs); } /* set refreshing anyway, we have data but it may be old */ xfrd_set_refresh_now(xzone); xzone->node.key = dname; rbtree_insert(xfrd->zones, (rbnode_t*)xzone); } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: started server %d secondary zones", (int)xfrd->zones->count)); } void xfrd_send_expy_all_zones() { xfrd_zone_t* zone; RBTREE_FOR(zone, xfrd_zone_t*, xfrd->zones) { xfrd_send_expire_notification(zone); } } void xfrd_reopen_logfile() { if (xfrd->nsd->file_rotation_ok) log_reopen(xfrd->nsd->log_filename, 0); } static void xfrd_free_namedb() { namedb_close(xfrd->nsd->db); xfrd->nsd->db = 0; } static void xfrd_set_timer_refresh(xfrd_zone_t* zone) { time_t set_refresh; time_t set_expire; time_t set_min; time_t set; if(zone->soa_disk_acquired == 0 || zone->state != xfrd_zone_ok) { xfrd_set_timer_retry(zone); return; } /* refresh or expire timeout, whichever is earlier */ set_refresh = zone->soa_disk_acquired + ntohl(zone->soa_disk.refresh); set_expire = zone->soa_disk_acquired + ntohl(zone->soa_disk.expire); if(set_refresh < set_expire) set = set_refresh; else set = set_expire; set_min = zone->soa_disk_acquired + XFRD_LOWERBOUND_REFRESH; if(set < set_min) set = set_min; xfrd_set_timer(zone, set); } static void xfrd_set_timer_retry(xfrd_zone_t* zone) { /* set timer for next retry or expire timeout if earlier. */ if(zone->soa_disk_acquired == 0) { /* if no information, use reasonable timeout */ xfrd_set_timer(zone, xfrd_time() + zone->fresh_xfr_timeout + random()%zone->fresh_xfr_timeout); /* exponential backoff - some master data in zones is paid-for but non-working, and will not get fixed. */ zone->fresh_xfr_timeout *= 2; if(zone->fresh_xfr_timeout > XFRD_TRANSFER_TIMEOUT_MAX) zone->fresh_xfr_timeout = XFRD_TRANSFER_TIMEOUT_MAX; } else if(zone->state == xfrd_zone_expired || xfrd_time() + ntohl(zone->soa_disk.retry) < zone->soa_disk_acquired + ntohl(zone->soa_disk.expire)) { if(ntohl(zone->soa_disk.retry) < XFRD_LOWERBOUND_RETRY) xfrd_set_timer(zone, xfrd_time() + XFRD_LOWERBOUND_RETRY); else xfrd_set_timer(zone, xfrd_time() + ntohl(zone->soa_disk.retry)); } else { if(ntohl(zone->soa_disk.expire) < XFRD_LOWERBOUND_RETRY) xfrd_set_timer(zone, xfrd_time() + XFRD_LOWERBOUND_RETRY); else xfrd_set_timer(zone, zone->soa_disk_acquired + ntohl(zone->soa_disk.expire)); } } static void xfrd_handle_zone(netio_type* ATTR_UNUSED(netio), netio_handler_type *handler, netio_event_types_type event_types) { xfrd_zone_t* zone = (xfrd_zone_t*)handler->user_data; if(zone->tcp_conn != -1) { /* busy in tcp transaction */ if(xfrd_tcp_is_reading(xfrd->tcp_set, zone->tcp_conn) && event_types & NETIO_EVENT_READ) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s event tcp read", zone->apex_str)); xfrd_set_timer(zone, xfrd_time() + xfrd->tcp_set->tcp_timeout); xfrd_tcp_read(xfrd->tcp_set, zone); return; } else if(!xfrd_tcp_is_reading(xfrd->tcp_set, zone->tcp_conn) && event_types & NETIO_EVENT_WRITE) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s event tcp write", zone->apex_str)); xfrd_set_timer(zone, xfrd_time() + xfrd->tcp_set->tcp_timeout); xfrd_tcp_write(xfrd->tcp_set, zone); return; } else if(event_types & NETIO_EVENT_TIMEOUT) { /* tcp connection timed out. Stop it. */ DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s event tcp timeout", zone->apex_str)); xfrd_tcp_release(xfrd->tcp_set, zone); /* continue to retry; as if a timeout happened */ event_types = NETIO_EVENT_TIMEOUT; } } if(event_types & NETIO_EVENT_READ) { /* busy in udp transaction */ DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s event udp read", zone->apex_str)); xfrd_set_refresh_now(zone); xfrd_udp_read(zone); return; } /* timeout */ DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s timeout", zone->apex_str)); if(handler->fd != -1) { assert(zone->tcp_conn == -1); xfrd_udp_release(zone); } if(zone->tcp_waiting) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "xfrd: zone %s skips retry, TCP connections full", zone->apex_str)); xfrd_unset_timer(zone); return; } if(zone->udp_waiting) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "xfrd: zone %s skips retry, UDP connections full", zone->apex_str)); xfrd_unset_timer(zone); return; } if(zone->soa_disk_acquired) { if (zone->state != xfrd_zone_expired && (uint32_t)xfrd_time() >= zone->soa_disk_acquired + ntohl(zone->soa_disk.expire)) { /* zone expired */ log_msg(LOG_ERR, "xfrd: zone %s has expired", zone->apex_str); xfrd_set_zone_state(zone, xfrd_zone_expired); } else if(zone->state == xfrd_zone_ok && (uint32_t)xfrd_time() >= zone->soa_disk_acquired + ntohl(zone->soa_disk.refresh)) { /* zone goes to refreshing state. */ DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s is refreshing", zone->apex_str)); xfrd_set_zone_state(zone, xfrd_zone_refreshing); } } /* make a new request */ xfrd_make_request(zone); } void xfrd_make_request(xfrd_zone_t* zone) { if(zone->next_master != -1) { /* we are told to use this next master */ DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd zone %s use master %i", zone->apex_str, zone->next_master)); zone->master_num = zone->next_master; zone->master = acl_find_num( zone->zone_options->request_xfr, zone->master_num); /* if there is no next master, fallback to use the first one */ if(!zone->master) { zone->master = zone->zone_options->request_xfr; zone->master_num = 0; } /* fallback to cycle master */ zone->next_master = -1; zone->round_num = 0; /* fresh set of retries after notify */ } else { /* cycle master */ if(zone->round_num != -1 && zone->master && zone->master->next) { /* try the next master */ zone->master = zone->master->next; zone->master_num++; } else { /* start a new round */ zone->master = zone->zone_options->request_xfr; zone->master_num = 0; zone->round_num++; } if(zone->round_num >= XFRD_MAX_ROUNDS) { /* tried all servers that many times, wait */ zone->round_num = -1; xfrd_set_timer_retry(zone); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd zone %s makereq wait_retry, rd %d mr %d nx %d", zone->apex_str, zone->round_num, zone->master_num, zone->next_master)); return; } } /* cache ixfr_disabled only for XFRD_NO_IXFR_CACHE time */ if (zone->master->ixfr_disabled && (zone->master->ixfr_disabled + XFRD_NO_IXFR_CACHE) <= time(NULL)) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "clear negative caching ixfr " "disabled for master %s num " "%d ", zone->master->ip_address_spec, zone->master_num)); zone->master->ixfr_disabled = 0; } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd zone %s make request round %d mr %d nx %d", zone->apex_str, zone->round_num, zone->master_num, zone->next_master)); /* perform xfr request */ if (!zone->master->use_axfr_only && zone->soa_disk_acquired > 0 && !zone->master->ixfr_disabled) { if (zone->master->allow_udp) { xfrd_set_timer(zone, xfrd_time() + XFRD_UDP_TIMEOUT); xfrd_udp_obtain(zone); } else { /* doing 3 rounds of IXFR/TCP might not be useful */ xfrd_set_timer(zone, xfrd_time() + xfrd->tcp_set->tcp_timeout); xfrd_tcp_obtain(xfrd->tcp_set, zone); } } else if (zone->master->use_axfr_only || zone->soa_disk_acquired <= 0) { xfrd_set_timer(zone, xfrd_time() + xfrd->tcp_set->tcp_timeout); xfrd_tcp_obtain(xfrd->tcp_set, zone); } else if (zone->master->ixfr_disabled) { if (zone->zone_options->allow_axfr_fallback) { xfrd_set_timer(zone, xfrd_time() + xfrd->tcp_set->tcp_timeout); xfrd_tcp_obtain(xfrd->tcp_set, zone); } else DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd zone %s axfr " "fallback not allowed, skipping master %s.", zone->apex_str, zone->master->ip_address_spec)); } } static void xfrd_udp_obtain(xfrd_zone_t* zone) { assert(zone->udp_waiting == 0); if(zone->tcp_conn != -1) { /* no tcp and udp at the same time */ xfrd_tcp_release(xfrd->tcp_set, zone); } if(xfrd->udp_use_num < XFRD_MAX_UDP) { xfrd->udp_use_num++; zone->zone_handler.fd = xfrd_send_ixfr_request_udp(zone); if(zone->zone_handler.fd == -1) xfrd->udp_use_num--; return; } /* queue the zone as last */ zone->udp_waiting = 1; zone->udp_waiting_next = NULL; if(!xfrd->udp_waiting_first) xfrd->udp_waiting_first = zone; if(xfrd->udp_waiting_last) xfrd->udp_waiting_last->udp_waiting_next = zone; xfrd->udp_waiting_last = zone; xfrd_unset_timer(zone); } time_t xfrd_time() { if(!xfrd->got_time) { xfrd->current_time = time(0); xfrd->got_time = 1; } return xfrd->current_time; } void xfrd_copy_soa(xfrd_soa_t* soa, rr_type* rr) { const uint8_t* rr_ns_wire = dname_name(domain_dname(rdata_atom_domain(rr->rdatas[0]))); uint8_t rr_ns_len = domain_dname(rdata_atom_domain(rr->rdatas[0]))->name_size; const uint8_t* rr_em_wire = dname_name(domain_dname(rdata_atom_domain(rr->rdatas[1]))); uint8_t rr_em_len = domain_dname(rdata_atom_domain(rr->rdatas[1]))->name_size; if(rr->type != TYPE_SOA || rr->rdata_count != 7) { log_msg(LOG_ERR, "xfrd: copy_soa called with bad rr, type %d rrs %u.", rr->type, rr->rdata_count); return; } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: copy_soa rr, type %d rrs %u, ttl %u.", rr->type, rr->rdata_count, rr->ttl)); soa->type = htons(rr->type); soa->klass = htons(rr->klass); soa->ttl = htonl(rr->ttl); soa->rdata_count = htons(rr->rdata_count); /* copy dnames */ soa->prim_ns[0] = rr_ns_len; memcpy(soa->prim_ns+1, rr_ns_wire, rr_ns_len); soa->email[0] = rr_em_len; memcpy(soa->email+1, rr_em_wire, rr_em_len); /* already in network format */ memcpy(&soa->serial, rdata_atom_data(rr->rdatas[2]), sizeof(uint32_t)); memcpy(&soa->refresh, rdata_atom_data(rr->rdatas[3]), sizeof(uint32_t)); memcpy(&soa->retry, rdata_atom_data(rr->rdatas[4]), sizeof(uint32_t)); memcpy(&soa->expire, rdata_atom_data(rr->rdatas[5]), sizeof(uint32_t)); memcpy(&soa->minimum, rdata_atom_data(rr->rdatas[6]), sizeof(uint32_t)); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: copy_soa rr, serial %u refresh %u retry %u expire %u", ntohl(soa->serial), ntohl(soa->refresh), ntohl(soa->retry), ntohl(soa->expire))); } static void xfrd_set_zone_state(xfrd_zone_t* zone, enum xfrd_zone_state s) { if(s != zone->state) { enum xfrd_zone_state old = zone->state; zone->state = s; if(s == xfrd_zone_expired || old == xfrd_zone_expired) { xfrd_send_expire_notification(zone); } } } void xfrd_set_refresh_now(xfrd_zone_t* zone) { xfrd_set_timer(zone, xfrd_time()); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd zone %s sets timeout right now, state %d", zone->apex_str, zone->state)); } void xfrd_unset_timer(xfrd_zone_t* zone) { zone->zone_handler.timeout = NULL; } void xfrd_set_timer(xfrd_zone_t* zone, time_t t) { /* randomize the time, within 90%-100% of original */ /* not later so zones cannot expire too late */ /* only for times far in the future */ if(t > xfrd_time() + 10) { time_t extra = t - xfrd_time(); time_t base = extra*9/10; t = xfrd_time() + base + random()%(extra-base); } zone->zone_handler.timeout = &zone->timeout; zone->timeout.tv_sec = t; zone->timeout.tv_nsec = 0; } void xfrd_handle_incoming_soa(xfrd_zone_t* zone, xfrd_soa_t* soa, time_t acquired) { if(soa == NULL) { /* nsd no longer has a zone in memory */ zone->soa_nsd_acquired = 0; xfrd_set_zone_state(zone, xfrd_zone_refreshing); xfrd_set_refresh_now(zone); return; } if(zone->soa_nsd_acquired && soa->serial == zone->soa_nsd.serial) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s has already been updated " "to serial %u (at time %u)", zone->apex_str, ntohl(zone->soa_nsd.serial), (unsigned) zone->soa_nsd_acquired)); return; } if(zone->soa_disk_acquired && soa->serial == zone->soa_disk.serial) { /* soa in disk has been loaded in memory */ log_msg(LOG_INFO, "Zone %s serial %u is updated to %u.", zone->apex_str, (unsigned)ntohl(zone->soa_nsd.serial), (unsigned)ntohl(soa->serial)); zone->soa_nsd = zone->soa_disk; zone->soa_nsd_acquired = zone->soa_disk_acquired; if((uint32_t)xfrd_time() - zone->soa_disk_acquired < ntohl(zone->soa_disk.refresh)) { /* zone ok, wait for refresh time */ xfrd_set_zone_state(zone, xfrd_zone_ok); zone->round_num = -1; xfrd_set_timer_refresh(zone); } else if((uint32_t)xfrd_time() - zone->soa_disk_acquired < ntohl(zone->soa_disk.expire)) { /* zone refreshing */ xfrd_set_zone_state(zone, xfrd_zone_refreshing); xfrd_set_refresh_now(zone); } if((uint32_t)xfrd_time() - zone->soa_disk_acquired >= ntohl(zone->soa_disk.expire)) { /* zone expired */ xfrd_set_zone_state(zone, xfrd_zone_expired); xfrd_set_refresh_now(zone); } if(zone->soa_notified_acquired != 0 && (zone->soa_notified.serial == 0 || compare_serial(ntohl(zone->soa_disk.serial), ntohl(zone->soa_notified.serial)) >= 0)) { /* read was in response to this notification */ zone->soa_notified_acquired = 0; } if(zone->soa_notified_acquired && zone->state == xfrd_zone_ok) { /* refresh because of notification */ xfrd_set_zone_state(zone, xfrd_zone_refreshing); xfrd_set_refresh_now(zone); } xfrd_send_notify(xfrd->notify_zones, zone->apex, &zone->soa_nsd); return; } /* user must have manually provided zone data */ DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s serial %u from unknown source. refreshing", zone->apex_str, (unsigned)ntohl(soa->serial))); zone->soa_nsd = *soa; zone->soa_disk = *soa; zone->soa_nsd_acquired = acquired; zone->soa_disk_acquired = acquired; if(zone->soa_notified_acquired != 0 && (zone->soa_notified.serial == 0 || compare_serial(ntohl(zone->soa_disk.serial), ntohl(zone->soa_notified.serial)) >= 0)) { /* user provided in response to this notification */ zone->soa_notified_acquired = 0; } xfrd_set_zone_state(zone, xfrd_zone_refreshing); xfrd_set_refresh_now(zone); xfrd_send_notify(xfrd->notify_zones, zone->apex, &zone->soa_nsd); } static void xfrd_send_expire_notification(xfrd_zone_t* zone) { if(zone->dirty) return; /* already queued */ /* enqueue */ assert(xfrd->dirty_zones->num < xfrd->dirty_zones->capacity); zone->dirty = 1; stack_push(xfrd->dirty_zones, (void*)zone); xfrd->ipc_handler.event_types |= NETIO_EVENT_WRITE; } int xfrd_udp_read_packet(buffer_type* packet, int fd) { ssize_t received; /* read the data */ buffer_clear(packet); received = recvfrom(fd, buffer_begin(packet), buffer_remaining(packet), 0, NULL, NULL); if(received == -1) { log_msg(LOG_ERR, "xfrd: recvfrom failed: %s", strerror(errno)); return 0; } buffer_set_limit(packet, received); return 1; } void xfrd_udp_release(xfrd_zone_t* zone) { assert(zone->udp_waiting == 0); if(zone->zone_handler.fd != -1) close(zone->zone_handler.fd); zone->zone_handler.fd = -1; /* see if there are waiting zones */ if(xfrd->udp_use_num == XFRD_MAX_UDP) { while(xfrd->udp_waiting_first) { /* snip off waiting list */ xfrd_zone_t* wz = xfrd->udp_waiting_first; assert(wz->udp_waiting); wz->udp_waiting = 0; xfrd->udp_waiting_first = wz->udp_waiting_next; if(xfrd->udp_waiting_last == wz) xfrd->udp_waiting_last = NULL; /* see if this zone needs udp connection */ if(wz->tcp_conn == -1) { wz->zone_handler.fd = xfrd_send_ixfr_request_udp(wz); if(wz->zone_handler.fd != -1) return; } } } /* no waiting zones */ if(xfrd->udp_use_num > 0) xfrd->udp_use_num--; } static void xfrd_udp_read(xfrd_zone_t* zone) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s read udp data", zone->apex_str)); if(!xfrd_udp_read_packet(xfrd->packet, zone->zone_handler.fd)) { xfrd_udp_release(zone); return; } switch(xfrd_handle_received_xfr_packet(zone, xfrd->packet)) { case xfrd_packet_tcp: xfrd_set_timer(zone, xfrd_time() + xfrd->tcp_set->tcp_timeout); xfrd_udp_release(zone); xfrd_tcp_obtain(xfrd->tcp_set, zone); break; case xfrd_packet_transfer: case xfrd_packet_newlease: /* nothing more to do */ assert(zone->round_num == -1); xfrd_udp_release(zone); break; case xfrd_packet_notimpl: zone->master->ixfr_disabled = time(NULL); /* drop packet */ xfrd_udp_release(zone); /* query next server */ xfrd_make_request(zone); break; case xfrd_packet_more: case xfrd_packet_drop: /* drop packet */ xfrd_udp_release(zone); /* query next server */ xfrd_make_request(zone); break; case xfrd_packet_bad: default: zone->master->bad_xfr_count++; if (zone->master->bad_xfr_count > 2) { zone->master->ixfr_disabled = time(NULL); zone->master->bad_xfr_count = 0; } /* drop packet */ xfrd_udp_release(zone); /* query next server */ xfrd_make_request(zone); break; } } int xfrd_send_udp(acl_options_t* acl, buffer_type* packet, acl_options_t* ifc) { #ifdef INET6 struct sockaddr_storage to; #else struct sockaddr_in to; #endif /* INET6 */ int fd, family; /* this will set the remote port to acl->port or TCP_PORT */ socklen_t to_len = xfrd_acl_sockaddr_to(acl, &to); /* get the address family of the remote host */ if(acl->is_ipv6) { #ifdef INET6 family = PF_INET6; #else return -1; #endif /* INET6 */ } else { family = PF_INET; } fd = socket(family, SOCK_DGRAM, IPPROTO_UDP); if(fd == -1) { log_msg(LOG_ERR, "xfrd: cannot create udp socket to %s: %s", acl->ip_address_spec, strerror(errno)); return -1; } /* bind it */ if (!xfrd_bind_local_interface(fd, ifc, acl, 0)) { log_msg(LOG_ERR, "xfrd: cannot bind outgoing interface '%s' to " "udp socket: No matching ip addresses found", ifc->ip_address_spec); close(fd); return -1; } /* send it (udp) */ if(sendto(fd, buffer_current(packet), buffer_remaining(packet), 0, (struct sockaddr*)&to, to_len) == -1) { log_msg(LOG_ERR, "xfrd: sendto %s failed %s", acl->ip_address_spec, strerror(errno)); close(fd); return -1; } return fd; } int xfrd_bind_local_interface(int sockd, acl_options_t* ifc, acl_options_t* acl, int tcp) { #ifdef SO_LINGER struct linger linger = {1, 0}; #endif socklen_t frm_len; #ifdef INET6 struct sockaddr_storage frm; #else struct sockaddr_in frm; #endif /* INET6 */ int ret = 1; if (!ifc) /* no outgoing interface set */ return 1; while (ifc) { if (ifc->is_ipv6 != acl->is_ipv6) { /* check if we have a matching address family */ ifc = ifc->next; continue; } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: bind() %s to %s socket", ifc->ip_address_spec, tcp? "tcp":"udp")); ret = 0; frm_len = xfrd_acl_sockaddr_frm(ifc, &frm); if (tcp) { #ifdef SO_REUSEADDR if (setsockopt(sockd, SOL_SOCKET, SO_REUSEADDR, &frm, frm_len) < 0) { VERBOSITY(2, (LOG_WARNING, "xfrd: setsockopt " "SO_REUSEADDR failed: %s", strerror(errno))); } #else VERBOSITY(2, (LOG_WARNING, "xfrd: setsockopt SO_REUSEADDR " "failed: SO_REUSEADDR not defined")); #endif /* SO_REUSEADDR */ if (ifc->port != 0) { #ifdef SO_LINGER if (setsockopt(sockd, SOL_SOCKET, SO_LINGER, &linger, sizeof(linger)) < 0) { VERBOSITY(2, (LOG_WARNING, "xfrd: setsockopt " "SO_LINGER failed: %s", strerror(errno))); } #else VERBOSITY(2, (LOG_WARNING, "xfrd: setsockopt SO_LINGER " "failed: SO_LINGER not defined")); #endif /* SO_LINGER */ } } /* found one */ if(bind(sockd, (struct sockaddr*)&frm, frm_len) >= 0) { DEBUG(DEBUG_XFRD,2, (LOG_INFO, "xfrd: bind() %s to %s " "socket was successful", ifc->ip_address_spec, tcp? "tcp":"udp")); return 1; } DEBUG(DEBUG_XFRD,2, (LOG_INFO, "xfrd: bind() %s to %s socket" "failed: %s", ifc->ip_address_spec, tcp? "tcp":"udp", strerror(errno))); log_msg(LOG_WARNING, "xfrd: could not bind source address:port to " "socket: %s", strerror(errno)); /* try another */ ifc = ifc->next; } return ret; } void xfrd_tsig_sign_request(buffer_type* packet, tsig_record_type* tsig, acl_options_t* acl) { tsig_algorithm_type* algo; assert(acl->key_options && acl->key_options->tsig_key); algo = tsig_get_algorithm_by_name(acl->key_options->algorithm); if(!algo) { log_msg(LOG_ERR, "tsig unknown algorithm %s", acl->key_options->algorithm); return; } assert(algo); tsig_init_record(tsig, algo, acl->key_options->tsig_key); tsig_init_query(tsig, ID(packet)); tsig_prepare(tsig); tsig_update(tsig, packet, buffer_position(packet)); tsig_sign(tsig); tsig_append_rr(tsig, packet); ARCOUNT_SET(packet, ARCOUNT(packet) + 1); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "appending tsig to packet")); /* prepare for validating tsigs */ tsig_prepare(tsig); } static int xfrd_send_ixfr_request_udp(xfrd_zone_t* zone) { int fd; /* make sure we have a master to query the ixfr request to */ assert(zone->master); if(zone->tcp_conn != -1) { /* tcp is using the zone_handler.fd */ log_msg(LOG_ERR, "xfrd: %s tried to send udp whilst tcp engaged", zone->apex_str); return -1; } xfrd_setup_packet(xfrd->packet, TYPE_IXFR, CLASS_IN, zone->apex); zone->query_id = ID(xfrd->packet); zone->msg_seq_nr = 0; zone->msg_rr_count = 0; DEBUG(DEBUG_XFRD,1, (LOG_INFO, "sent query with ID %d", zone->query_id)); NSCOUNT_SET(xfrd->packet, 1); xfrd_write_soa_buffer(xfrd->packet, zone->apex, &zone->soa_disk); /* if we have tsig keys, sign the ixfr query */ if(zone->master->key_options && zone->master->key_options->tsig_key) { xfrd_tsig_sign_request(xfrd->packet, &zone->tsig, zone->master); } buffer_flip(xfrd->packet); xfrd_set_timer(zone, xfrd_time() + XFRD_UDP_TIMEOUT); if((fd = xfrd_send_udp(zone->master, xfrd->packet, zone->zone_options->outgoing_interface)) == -1) return -1; DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd sent udp request for ixfr=%u for zone %s to %s", (unsigned)ntohl(zone->soa_disk.serial), zone->apex_str, zone->master->ip_address_spec)); return fd; } static int xfrd_parse_soa_info(buffer_type* packet, xfrd_soa_t* soa) { if(!buffer_available(packet, 10)) return 0; soa->type = htons(buffer_read_u16(packet)); soa->klass = htons(buffer_read_u16(packet)); soa->ttl = htonl(buffer_read_u32(packet)); if(ntohs(soa->type) != TYPE_SOA || ntohs(soa->klass) != CLASS_IN) { return 0; } if(!buffer_available(packet, buffer_read_u16(packet)) /* rdata length */ || !(soa->prim_ns[0] = dname_make_wire_from_packet(soa->prim_ns+1, packet, 1)) || !(soa->email[0] = dname_make_wire_from_packet(soa->email+1, packet, 1))) { return 0; } soa->rdata_count = 7; /* rdata in SOA */ soa->serial = htonl(buffer_read_u32(packet)); soa->refresh = htonl(buffer_read_u32(packet)); soa->retry = htonl(buffer_read_u32(packet)); soa->expire = htonl(buffer_read_u32(packet)); soa->minimum = htonl(buffer_read_u32(packet)); return 1; } /* * Check the RRs in an IXFR/AXFR reply. * returns 0 on error, 1 on correct parseable packet. * done = 1 if the last SOA in an IXFR/AXFR has been seen. * soa then contains that soa info. * (soa contents is modified by the routine) */ static int xfrd_xfr_check_rrs(xfrd_zone_t* zone, buffer_type* packet, size_t count, int *done, xfrd_soa_t* soa) { /* first RR has already been checked */ uint32_t tmp_serial = 0; uint16_t type, rrlen; size_t i, soapos; for(i=0; imsg_rr_count) { if (*done) { /** * We are done, but there are more RRs coming. Ignore * trailing garbage. */ DEBUG(DEBUG_XFRD,1, (LOG_WARNING, "xfrd: zone %s xfr is " "done, ignore trailing garbage", zone->apex_str)); return 1; } if(!packet_skip_dname(packet)) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "xfrd: zone %s xfr unable " "to skip owner name", zone->apex_str)); return 0; } if(!buffer_available(packet, 10)) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "xfrd: zone %s xfr hdr " "too small", zone->apex_str)); return 0; } soapos = buffer_position(packet); type = buffer_read_u16(packet); (void)buffer_read_u16(packet); /* class */ (void)buffer_read_u32(packet); /* ttl */ rrlen = buffer_read_u16(packet); if(!buffer_available(packet, rrlen)) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "xfrd: zone %s xfr pkt " "too small", zone->apex_str)); return 0; } if(type == TYPE_SOA) { /* check the SOAs */ size_t mempos = buffer_position(packet); buffer_set_position(packet, soapos); if(!xfrd_parse_soa_info(packet, soa)) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "xfrd: zone %s xfr " "unable to parse soainfo", zone->apex_str)); return 0; } if(zone->msg_rr_count == 1 && ntohl(soa->serial) != zone->msg_new_serial) { /* 2nd RR is SOA with lower serial, this is an IXFR */ zone->msg_is_ixfr = 1; if(!zone->soa_disk_acquired) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "xfrd: zone %s xfr " "got ixfr but need axfr", zone->apex_str)); return 0; /* got IXFR but need AXFR */ } if(ntohl(soa->serial) != ntohl(zone->soa_disk.serial)) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "xfrd: zone %s xfr " "bad start serial", zone->apex_str)); return 0; /* bad start serial in IXFR */ } zone->msg_old_serial = ntohl(soa->serial); tmp_serial = ntohl(soa->serial); } else if(ntohl(soa->serial) == zone->msg_new_serial) { /* saw another SOA of new serial. */ if(zone->msg_is_ixfr == 1) { zone->msg_is_ixfr = 2; /* seen middle SOA in ixfr */ } else { /* 2nd SOA for AXFR or 3rd newSOA for IXFR */ *done = 1; } } else if (zone->msg_is_ixfr) { /* some additional checks */ if(ntohl(soa->serial) > zone->msg_new_serial) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "xfrd: zone %s xfr " "bad middle serial", zone->apex_str)); return 0; /* bad middle serial in IXFR */ } if(ntohl(soa->serial) < tmp_serial) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "xfrd: zone %s xfr " "serial decreasing not allowed", zone->apex_str)); return 0; /* middle serial decreases in IXFR */ } /** serial ok, update tmp serial */ tmp_serial = ntohl(soa->serial); } buffer_set_position(packet, mempos); } buffer_skip(packet, rrlen); } /* packet seems to have a valid DNS RR structure */ return 1; } static int xfrd_xfr_process_tsig(xfrd_zone_t* zone, buffer_type* packet) { int have_tsig = 0; assert(zone && zone->master && zone->master->key_options && zone->master->key_options->tsig_key && packet); if(!tsig_find_rr(&zone->tsig, packet)) { log_msg(LOG_ERR, "xfrd: zone %s, from %s: malformed tsig RR", zone->apex_str, zone->master->ip_address_spec); return 0; } if(zone->tsig.status == TSIG_OK) { have_tsig = 1; if (zone->tsig.error_code != TSIG_ERROR_NOERROR) { log_msg(LOG_ERR, "xfrd: zone %s, from %s: tsig error " "(%s)", zone->apex_str, zone->master->ip_address_spec, tsig_error(zone->tsig.error_code)); } } if(have_tsig) { /* strip the TSIG resource record off... */ buffer_set_limit(packet, zone->tsig.position); ARCOUNT_SET(packet, ARCOUNT(packet) - 1); } /* keep running the TSIG hash */ tsig_update(&zone->tsig, packet, buffer_limit(packet)); if(have_tsig) { if (!tsig_verify(&zone->tsig)) { log_msg(LOG_ERR, "xfrd: zone %s, from %s: bad tsig signature", zone->apex_str, zone->master->ip_address_spec); return 0; } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s, from %s: good tsig signature", zone->apex_str, zone->master->ip_address_spec)); /* prepare for next tsigs */ tsig_prepare(&zone->tsig); } else if(zone->tsig.updates_since_last_prepare > XFRD_TSIG_MAX_UNSIGNED) { /* we allow a number of non-tsig signed packets */ log_msg(LOG_INFO, "xfrd: zone %s, from %s: too many consecutive " "packets without TSIG", zone->apex_str, zone->master->ip_address_spec); return 0; } if(!have_tsig && zone->msg_seq_nr == 0) { log_msg(LOG_ERR, "xfrd: zone %s, from %s: no tsig in first packet of reply", zone->apex_str, zone->master->ip_address_spec); return 0; } return 1; } /* parse the received packet. returns xfrd packet result code. */ static enum xfrd_packet_result xfrd_parse_received_xfr_packet(xfrd_zone_t* zone, buffer_type* packet, xfrd_soa_t* soa) { size_t rr_count; size_t qdcount = QDCOUNT(packet); size_t ancount = ANCOUNT(packet), ancount_todo; size_t nscount = NSCOUNT(packet); int done = 0; /* has to be axfr / ixfr reply */ if(!buffer_available(packet, QHEADERSZ)) { log_msg(LOG_INFO, "packet too small"); return xfrd_packet_bad; } /* only check ID in first response message. Could also check that * AA bit and QR bit are set, but not needed. */ DEBUG(DEBUG_XFRD,2, (LOG_INFO, "got query with ID %d and %d needed", ID(packet), zone->query_id)); if(ID(packet) != zone->query_id) { log_msg(LOG_ERR, "xfrd: zone %s received bad query id from %s, " "dropped", zone->apex_str, zone->master->ip_address_spec); return xfrd_packet_bad; } /* check RCODE in all response messages */ if(RCODE(packet) != RCODE_OK) { log_msg(LOG_ERR, "xfrd: zone %s received error code %s from " "%s", zone->apex_str, rcode2str(RCODE(packet)), zone->master->ip_address_spec); if (RCODE(packet) == RCODE_IMPL || RCODE(packet) == RCODE_FORMAT) { return xfrd_packet_notimpl; } if (RCODE(packet) != RCODE_NOTAUTH) { /* RFC 2845: If NOTAUTH, client should do TSIG checking */ return xfrd_packet_bad; } } /* check TSIG */ if(zone->master->key_options) { if(!xfrd_xfr_process_tsig(zone, packet)) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "dropping xfr reply due " "to bad TSIG")); return xfrd_packet_bad; } } if (RCODE(packet) == RCODE_NOTAUTH) { return xfrd_packet_bad; } buffer_skip(packet, QHEADERSZ); /* skip question section */ for(rr_count = 0; rr_count < qdcount; ++rr_count) { if (!packet_skip_rr(packet, 1)) { log_msg(LOG_ERR, "xfrd: zone %s, from %s: bad RR in " "question section", zone->apex_str, zone->master->ip_address_spec); return xfrd_packet_bad; } } if(zone->msg_rr_count == 0 && ancount == 0) { if(zone->tcp_conn == -1 && TC(packet)) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: TC flagged")); return xfrd_packet_tcp; } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: too short xfr packet: no " "answer")); /* if IXFR is unknown, fallback to AXFR (if allowed) */ if (nscount == 1) { if(!packet_skip_dname(packet) || !xfrd_parse_soa_info(packet, soa)) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "xfrd: zone %s, from %s: " "no SOA begins authority section", zone->apex_str, zone->master->ip_address_spec)); return xfrd_packet_bad; } return xfrd_packet_notimpl; } return xfrd_packet_bad; } ancount_todo = ancount; if(zone->msg_rr_count == 0) { /* parse the first RR, see if it is a SOA */ if(!packet_skip_dname(packet) || !xfrd_parse_soa_info(packet, soa)) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "xfrd: zone %s, from %s: " "no SOA begins answer" " section", zone->apex_str, zone->master->ip_address_spec)); return xfrd_packet_bad; } if(zone->soa_disk_acquired != 0 && zone->state != xfrd_zone_expired /* if expired - accept anything */ && compare_serial(ntohl(soa->serial), ntohl(zone->soa_disk.serial)) < 0) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s ignoring old serial from %s", zone->apex_str, zone->master->ip_address_spec)); VERBOSITY(1, (LOG_INFO, "xfrd: zone %s ignoring old serial from %s", zone->apex_str, zone->master->ip_address_spec)); return xfrd_packet_bad; } if(zone->soa_disk_acquired != 0 && zone->soa_disk.serial == soa->serial) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s got " "update indicating " "current serial", zone->apex_str)); /* (even if notified) the lease on the current soa is renewed */ zone->soa_disk_acquired = xfrd_time(); if(zone->soa_nsd.serial == soa->serial) zone->soa_nsd_acquired = xfrd_time(); xfrd_set_zone_state(zone, xfrd_zone_ok); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s is ok", zone->apex_str)); if(zone->soa_notified_acquired == 0) { /* not notified or anything, so stop asking around */ zone->round_num = -1; /* next try start a new round */ xfrd_set_timer_refresh(zone); return xfrd_packet_newlease; } /* try next master */ return xfrd_packet_drop; } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "IXFR reply has ok serial (have \ %u, reply %u).", (unsigned)ntohl(zone->soa_disk.serial), (unsigned)ntohl(soa->serial))); /* serial is newer than soa_disk */ if(ancount == 1) { /* single record means it is like a notify */ (void)xfrd_handle_incoming_notify(zone, soa); } else if(zone->soa_notified_acquired && zone->soa_notified.serial && compare_serial(ntohl(zone->soa_notified.serial), ntohl(soa->serial)) < 0) { /* this AXFR/IXFR notifies me that an even newer serial exists */ zone->soa_notified.serial = soa->serial; } zone->msg_new_serial = ntohl(soa->serial); zone->msg_rr_count = 1; zone->msg_is_ixfr = 0; if(zone->soa_disk_acquired) zone->msg_old_serial = ntohl(zone->soa_disk.serial); else zone->msg_old_serial = 0; ancount_todo = ancount - 1; } if(zone->tcp_conn == -1 && TC(packet)) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s received TC from %s. retry tcp.", zone->apex_str, zone->master->ip_address_spec)); return xfrd_packet_tcp; } if(zone->tcp_conn == -1 && ancount < 2) { /* too short to be a real ixfr/axfr data transfer: need at */ /* least two RRs in the answer section. */ /* The serial is newer, so try tcp to this master. */ DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: udp reply is short. Try " "tcp anyway.")); return xfrd_packet_tcp; } if(!xfrd_xfr_check_rrs(zone, packet, ancount_todo, &done, soa)) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s sent bad xfr " "reply.", zone->apex_str)); return xfrd_packet_bad; } if(zone->tcp_conn == -1 && done == 0) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: udp reply incomplete")); return xfrd_packet_bad; } if(done == 0) return xfrd_packet_more; if(zone->master->key_options) { if(zone->tsig.updates_since_last_prepare != 0) { log_msg(LOG_INFO, "xfrd: last packet of reply has no " "TSIG"); return xfrd_packet_bad; } } return xfrd_packet_transfer; } enum xfrd_packet_result xfrd_handle_received_xfr_packet(xfrd_zone_t* zone, buffer_type* packet) { xfrd_soa_t soa; enum xfrd_packet_result res; /* parse and check the packet - see if it ends the xfr */ switch((res=xfrd_parse_received_xfr_packet(zone, packet, &soa))) { case xfrd_packet_more: case xfrd_packet_transfer: /* continue with commit */ break; case xfrd_packet_newlease: return xfrd_packet_newlease; case xfrd_packet_tcp: return xfrd_packet_tcp; case xfrd_packet_notimpl: case xfrd_packet_bad: case xfrd_packet_drop: default: { /* rollback */ if(zone->msg_seq_nr > 0) { /* do not process xfr - if only one part simply ignore it. */ /* rollback previous parts of commit */ buffer_clear(packet); buffer_printf(packet, "xfrd: zone %s xfr " "rollback serial %u at " "time %u from %s of %u " "parts", zone->apex_str, (int)zone->msg_new_serial, (int)xfrd_time(), zone->master->ip_address_spec, zone->msg_seq_nr); buffer_flip(packet); diff_write_commit(zone->apex_str, zone->msg_old_serial, zone->msg_new_serial, zone->query_id, zone->msg_seq_nr, 0, (char*)buffer_begin(packet), xfrd->nsd->options); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s " "xfr reverted " "\"%s\"", zone->apex_str, (char*)buffer_begin(packet))); } if (res == xfrd_packet_notimpl) return res; else return xfrd_packet_bad; } } /* dump reply on disk to diff file */ diff_write_packet(zone->apex_str, zone->msg_new_serial, zone->query_id, zone->msg_seq_nr, buffer_begin(packet), buffer_limit(packet), xfrd->nsd->options); VERBOSITY(1, (LOG_INFO, "xfrd: zone %s written received XFR from %s with serial %u to " "disk", zone->apex_str, zone->master->ip_address_spec, (int)zone->msg_new_serial)); zone->msg_seq_nr++; if(res == xfrd_packet_more) { /* wait for more */ return xfrd_packet_more; } /* done. we are completely sure of this */ buffer_clear(packet); buffer_printf(packet, "xfrd: zone %s received update to serial %u at " "time %u from %s in %u parts", zone->apex_str, (int)zone->msg_new_serial, (int)xfrd_time(), zone->master->ip_address_spec, zone->msg_seq_nr); if(zone->master->key_options) { buffer_printf(packet, " TSIG verified with key %s", zone->master->key_options->name); } buffer_flip(packet); diff_write_commit(zone->apex_str, zone->msg_old_serial, zone->msg_new_serial, zone->query_id, zone->msg_seq_nr, 1, (char*)buffer_begin(packet), xfrd->nsd->options); VERBOSITY(1, (LOG_INFO, "xfrd: zone %s committed \"%s\"", zone->apex_str, (char*)buffer_begin(packet))); /* update the disk serial no. */ zone->soa_disk_acquired = xfrd_time(); zone->soa_disk = soa; if(zone->soa_notified_acquired && ( zone->soa_notified.serial == 0 || compare_serial(htonl(zone->soa_disk.serial), htonl(zone->soa_notified.serial)) >= 0)) { zone->soa_notified_acquired = 0; } if(!zone->soa_notified_acquired) { /* do not set expired zone to ok: * it would cause nsd to start answering * bad data, since the zone is not loaded yet. * if nsd does not reload < retry time, more * queries (for even newer versions) are made. * For expired zone after reload it is set ok (SOAINFO ipc). */ if(zone->state != xfrd_zone_expired) xfrd_set_zone_state(zone, xfrd_zone_ok); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s is waiting for reload", zone->apex_str)); zone->round_num = -1; /* next try start anew */ xfrd_set_timer_refresh(zone); xfrd_set_reload_timeout(); return xfrd_packet_transfer; } else { /* try to get an even newer serial */ /* pretend it was bad to continue queries */ xfrd_set_reload_timeout(); return xfrd_packet_bad; } } static void xfrd_set_reload_timeout() { if(xfrd->nsd->options->xfrd_reload_timeout == -1) return; /* automatic reload disabled. */ if(xfrd->reload_timeout.tv_sec == 0 || xfrd_time() >= xfrd->reload_timeout.tv_sec ) { /* no reload wait period (or it passed), do it right away */ xfrd->need_to_send_reload = 1; xfrd->ipc_handler.event_types |= NETIO_EVENT_WRITE; /* start reload wait period */ xfrd->reload_timeout.tv_sec = xfrd_time() + xfrd->nsd->options->xfrd_reload_timeout; xfrd->reload_timeout.tv_nsec = 0; return; } /* cannot reload now, set that after the timeout a reload has to happen */ xfrd->reload_handler.timeout = &xfrd->reload_timeout; } static void xfrd_handle_reload(netio_type *ATTR_UNUSED(netio), netio_handler_type *handler, netio_event_types_type event_types) { /* reload timeout */ assert(event_types & NETIO_EVENT_TIMEOUT); /* timeout wait period after this request is sent */ handler->timeout = NULL; xfrd->reload_timeout.tv_sec = xfrd_time() + xfrd->nsd->options->xfrd_reload_timeout; xfrd->need_to_send_reload = 1; xfrd->ipc_handler.event_types |= NETIO_EVENT_WRITE; } void xfrd_handle_passed_packet(buffer_type* packet, int acl_num, int acl_num_xfr) { uint8_t qnamebuf[MAXDOMAINLEN]; uint16_t qtype, qclass; const dname_type* dname; region_type* tempregion = region_create(xalloc, free); xfrd_zone_t* zone; buffer_skip(packet, QHEADERSZ); if(!packet_read_query_section(packet, qnamebuf, &qtype, &qclass)) { region_destroy(tempregion); return; /* drop bad packet */ } dname = dname_make(tempregion, qnamebuf, 1); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: got passed packet for %s, acl " "%d", dname_to_string(dname,0), acl_num)); /* find the zone */ zone = (xfrd_zone_t*)rbtree_search(xfrd->zones, dname); if(!zone) { log_msg(LOG_INFO, "xfrd: incoming packet for unknown zone %s", dname_to_string(dname,0)); region_destroy(tempregion); return; /* drop packet for unknown zone */ } region_destroy(tempregion); /* handle */ if(OPCODE(packet) == OPCODE_NOTIFY) { xfrd_soa_t soa; int have_soa = 0; int next; /* get serial from a SOA */ if(ANCOUNT(packet) == 1 && packet_skip_dname(packet) && xfrd_parse_soa_info(packet, &soa)) { have_soa = 1; } if(xfrd_handle_incoming_notify(zone, have_soa?&soa:NULL)) { if(zone->zone_handler.fd == -1 && zone->tcp_conn == -1 && !zone->tcp_waiting && !zone->udp_waiting) { xfrd_set_refresh_now(zone); } } /* First, see if our notifier has a match in provide-xfr */ if (acl_find_num(zone->zone_options->request_xfr, acl_num_xfr)) next = acl_num_xfr; else /* If not, find master that matches notifiers ACL entry */ next = find_same_master_notify(zone, acl_num); if(next != -1) { zone->next_master = next; DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: notify set next master to query %d", next)); } } else { /* TODO handle incoming IXFR udp reply via port 53 */ } } static int xfrd_handle_incoming_notify(xfrd_zone_t* zone, xfrd_soa_t* soa) { if(soa && zone->soa_disk_acquired && zone->state != xfrd_zone_expired && compare_serial(ntohl(soa->serial),ntohl(zone->soa_disk.serial)) <= 0) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: ignored notify %s %u old serial, zone valid " "(soa disk serial %u)", zone->apex_str, (unsigned)ntohl(soa->serial), (unsigned)ntohl(zone->soa_disk.serial))); return 0; /* ignore notify with old serial, we have a valid zone */ } if(soa == 0) { zone->soa_notified.serial = 0; } else if (zone->soa_notified_acquired == 0 || zone->soa_notified.serial == 0 || compare_serial(ntohl(soa->serial), ntohl(zone->soa_notified.serial)) > 0) { zone->soa_notified = *soa; } zone->soa_notified_acquired = xfrd_time(); if(zone->state == xfrd_zone_ok) { xfrd_set_zone_state(zone, xfrd_zone_refreshing); } /* transfer right away */ VERBOSITY(1, (LOG_INFO, "Handle incoming notify for zone %s", zone->apex_str)); return 1; } static int find_same_master_notify(xfrd_zone_t* zone, int acl_num_nfy) { acl_options_t* nfy_acl = acl_find_num( zone->zone_options->allow_notify, acl_num_nfy); int num = 0; acl_options_t* master = zone->zone_options->request_xfr; if(!nfy_acl) return -1; while(master) { if(acl_addr_matches_host(nfy_acl, master)) return num; master = master->next; num++; } return -1; } void xfrd_check_failed_updates() { /* see if updates have not come through */ xfrd_zone_t* zone; RBTREE_FOR(zone, xfrd_zone_t*, xfrd->zones) { /* zone has a disk soa, and no nsd soa or a different nsd soa */ if(zone->soa_disk_acquired != 0 && (zone->soa_nsd_acquired == 0 || zone->soa_disk.serial != zone->soa_nsd.serial)) { if(zone->soa_disk_acquired < xfrd->reload_cmd_last_sent) { /* this zone should have been loaded, since its disk soa time is before the time of the reload cmd. */ xfrd_soa_t dumped_soa = zone->soa_disk; log_msg(LOG_ERR, "xfrd: zone %s: soa serial %u " "update failed (acquired: %u), restarting " "transfer (notified zone)", zone->apex_str, ntohl(zone->soa_disk.serial), (unsigned) zone->soa_disk_acquired); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s: nsd has " "soa serial %u (acquired: %u, reload cmd sent: " "%u)", zone->apex_str, ntohl(zone->soa_nsd.serial), (unsigned) zone->soa_nsd_acquired, (unsigned) xfrd->reload_cmd_last_sent)); /* revert the soa; it has not been acquired properly */ zone->soa_disk_acquired = zone->soa_nsd_acquired; zone->soa_disk = zone->soa_nsd; /* pretend we are notified with disk soa. This will cause a refetch of the data, and reload. */ xfrd_handle_incoming_notify(zone, &dumped_soa); xfrd_set_timer_refresh(zone); } else if(zone->soa_disk_acquired >= xfrd->reload_cmd_last_sent) { /* this zone still has to be loaded, make sure reload is set to be sent. */ if(xfrd->need_to_send_reload == 0 && xfrd->reload_handler.timeout == NULL) { log_msg(LOG_ERR, "xfrd: zone %s: needs " "to be loaded. reload lost? " "try again", zone->apex_str); xfrd_set_reload_timeout(); } } } } } void xfrd_prepare_zones_for_reload() { xfrd_zone_t* zone; RBTREE_FOR(zone, xfrd_zone_t*, xfrd->zones) { /* zone has a disk soa, and no nsd soa or a different nsd soa */ if(zone->soa_disk_acquired != 0 && (zone->soa_nsd_acquired == 0 || zone->soa_disk.serial != zone->soa_nsd.serial)) { if(zone->soa_disk_acquired == xfrd_time()) { /* antedate by one second. * this makes sure that the zone time is before * reload, so that check_failed_zones() is * certain of the result. */ zone->soa_disk_acquired--; } } } } struct buffer* xfrd_get_temp_buffer() { return xfrd->packet; } nsd-3.2.16/namedb.c0000664000175000017500000003535412160600467012761 0ustar matjematje/* * namedb.c -- common namedb operations. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include #include #include "namedb.h" static domain_type * allocate_domain_info(domain_table_type *table, const dname_type *dname, domain_type *parent) { domain_type *result; assert(table); assert(dname); assert(parent); result = (domain_type *) region_alloc(table->region, sizeof(domain_type)); result->node.key = dname_partial_copy( table->region, dname, domain_dname(parent)->label_count + 1); result->parent = parent; result->nextdiff = NULL; result->wildcard_child_closest_match = result; result->rrsets = NULL; result->number = 0; #ifdef NSEC3 result->nsec3_cover = NULL; #ifdef FULL_PREHASH result->nsec3_wcard_child_cover = NULL; result->nsec3_ds_parent_cover = NULL; result->nsec3_lookup = NULL; result->nsec3_is_exact = 0; result->nsec3_ds_parent_is_exact = 0; #endif /* FULL_PREHASH */ #endif /* NSEC3 */ result->is_existing = 0; result->is_apex = 0; result->has_SOA = 0; return result; } domain_table_type * domain_table_create(region_type *region) { const dname_type *origin; domain_table_type *result; domain_type *root; assert(region); origin = dname_make(region, (uint8_t *) "", 0); root = (domain_type *) region_alloc(region, sizeof(domain_type)); root->node.key = origin; root->parent = NULL; root->nextdiff = NULL; root->wildcard_child_closest_match = root; root->rrsets = NULL; root->number = 1; /* 0 is used for after header */ root->is_existing = 0; root->is_apex = 0; root->has_SOA = 0; #ifdef NSEC3 root->nsec3_cover = NULL; #ifdef FULL_PREHASH root->nsec3_is_exact = 0; root->nsec3_ds_parent_is_exact = 0; root->nsec3_wcard_child_cover = NULL; root->nsec3_ds_parent_cover = NULL; root->nsec3_lookup = NULL; #endif /* FULL_PREHASH */ #endif /* NSEC3 */ result = (domain_table_type *) region_alloc(region, sizeof(domain_table_type)); result->region = region; result->names_to_domains = rbtree_create( region, (int (*)(const void *, const void *)) dname_compare); rbtree_insert(result->names_to_domains, (rbnode_t *) root); result->root = root; return result; } int domain_table_search(domain_table_type *table, const dname_type *dname, domain_type **closest_match, domain_type **closest_encloser) { int exact; uint8_t label_match_count; assert(table); assert(dname); assert(closest_match); assert(closest_encloser); exact = rbtree_find_less_equal(table->names_to_domains, dname, (rbnode_t **) closest_match); assert(*closest_match); *closest_encloser = *closest_match; if (!exact) { label_match_count = dname_label_match_count( domain_dname(*closest_encloser), dname); assert(label_match_count < dname->label_count); while (label_match_count < domain_dname(*closest_encloser)->label_count) { (*closest_encloser) = (*closest_encloser)->parent; assert(*closest_encloser); } } return exact; } domain_type * domain_table_find(domain_table_type *table, const dname_type *dname) { domain_type *closest_match; domain_type *closest_encloser; int exact; exact = domain_table_search( table, dname, &closest_match, &closest_encloser); return exact ? closest_encloser : NULL; } domain_type * domain_table_insert(domain_table_type *table, const dname_type *dname) { domain_type *closest_match; domain_type *closest_encloser; domain_type *result; int exact; assert(table); assert(dname); exact = domain_table_search( table, dname, &closest_match, &closest_encloser); if (exact) { result = closest_encloser; } else { assert(domain_dname(closest_encloser)->label_count < dname->label_count); /* Insert new node(s). */ do { result = allocate_domain_info(table, dname, closest_encloser); rbtree_insert(table->names_to_domains, (rbnode_t *) result); result->number = table->names_to_domains->count; /* * If the newly added domain name is larger * than the parent's current * wildcard_child_closest_match but smaller or * equal to the wildcard domain name, update * the parent's wildcard_child_closest_match * field. */ if (label_compare(dname_name(domain_dname(result)), (const uint8_t *) "\001*") <= 0 && dname_compare(domain_dname(result), domain_dname(closest_encloser->wildcard_child_closest_match)) > 0) { closest_encloser->wildcard_child_closest_match = result; } closest_encloser = result; } while (domain_dname(closest_encloser)->label_count < dname->label_count); } return result; } int domain_table_iterate(domain_table_type *table, domain_table_iterator_type iterator, void *user_data) { const void *dname; void *node; int error = 0; assert(table); RBTREE_WALK(table->names_to_domains, dname, node) { error += iterator((domain_type *) node, user_data); } return error; } void domain_add_rrset(domain_type *domain, rrset_type *rrset) { #if 0 /* fast */ rrset->next = domain->rrsets; domain->rrsets = rrset; #else /* preserve ordering, add at end */ rrset_type** p = &domain->rrsets; while(*p) p = &((*p)->next); *p = rrset; rrset->next = 0; #endif while (domain && !domain->is_existing) { domain->is_existing = 1; domain = domain->parent; } } rrset_type * domain_find_rrset(domain_type *domain, zone_type *zone, uint16_t type) { rrset_type *result = domain->rrsets; while (result) { if (result->zone == zone && rrset_rrtype(result) == type) { return result; } result = result->next; } return NULL; } rrset_type * domain_find_any_rrset(domain_type *domain, zone_type *zone) { rrset_type *result = domain->rrsets; while (result) { if (result->zone == zone) { return result; } result = result->next; } return NULL; } zone_type * domain_find_zone(domain_type *domain) { rrset_type *rrset; while (domain) { for (rrset = domain->rrsets; rrset; rrset = rrset->next) { if (rrset_rrtype(rrset) == TYPE_SOA) { return rrset->zone; } } domain = domain->parent; } return NULL; } #ifndef FULL_PREHASH domain_type * domain_find_zone_apex(domain_type *domain) { while (domain != NULL) { if (domain->has_SOA != 0) return domain; domain = domain->parent; } return NULL; } #endif /* !FULL_PREHASH */ zone_type * domain_find_parent_zone(zone_type *zone) { rrset_type *rrset; assert(zone); for (rrset = zone->apex->rrsets; rrset; rrset = rrset->next) { if (rrset->zone != zone && rrset_rrtype(rrset) == TYPE_NS) { return rrset->zone; } } return NULL; } domain_type * domain_find_ns_rrsets(domain_type *domain, zone_type *zone, rrset_type **ns) { while (domain && domain != zone->apex) { *ns = domain_find_rrset(domain, zone, TYPE_NS); if (*ns) return domain; domain = domain->parent; } *ns = NULL; return NULL; } int domain_is_glue(domain_type *domain, zone_type *zone) { rrset_type *unused; domain_type *ns_domain = domain_find_ns_rrsets(domain, zone, &unused); return (ns_domain != NULL && domain_find_rrset(ns_domain, zone, TYPE_SOA) == NULL); } domain_type * domain_wildcard_child(domain_type *domain) { domain_type *wildcard_child; assert(domain); assert(domain->wildcard_child_closest_match); wildcard_child = domain->wildcard_child_closest_match; if (wildcard_child != domain && label_is_wildcard(dname_name(domain_dname(wildcard_child)))) { return wildcard_child; } else { return NULL; } } int zone_is_secure(zone_type *zone) { assert(zone); return zone->is_secure; } uint16_t rr_rrsig_type_covered(rr_type *rr) { assert(rr->type == TYPE_RRSIG); assert(rr->rdata_count > 0); assert(rdata_atom_size(rr->rdatas[0]) == sizeof(uint16_t)); return ntohs(* (uint16_t *) rdata_atom_data(rr->rdatas[0])); } zone_type * namedb_find_zone(namedb_type *db, domain_type *domain) { zone_type *zone; for (zone = db->zones; zone; zone = zone->next) { if (zone->apex == domain) break; } return zone; } rrset_type * domain_find_non_cname_rrset(domain_type *domain, zone_type *zone) { /* find any rrset type that is not allowed next to a CNAME */ /* nothing is allowed next to a CNAME, except RRSIG, NSEC, NSEC3 */ rrset_type *result = domain->rrsets; while (result) { if (result->zone == zone && /* here is the list of exceptions*/ rrset_rrtype(result) != TYPE_CNAME && rrset_rrtype(result) != TYPE_RRSIG && rrset_rrtype(result) != TYPE_NXT && rrset_rrtype(result) != TYPE_SIG && rrset_rrtype(result) != TYPE_NSEC && rrset_rrtype(result) != TYPE_NSEC3 ) { return result; } result = result->next; } return NULL; } /** * Create namedb. * */ struct namedb * namedb_create(void) { struct namedb *db = NULL; region_type *region = NULL; #ifdef NSEC3 #ifndef FULL_PREHASH region_type *nsec3_region = NULL; region_type *nsec3_mod_region = NULL; #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ #ifdef USE_MMAP_ALLOC region = region_create_custom(mmap_alloc, mmap_free, MMAP_ALLOC_CHUNK_SIZE, MMAP_ALLOC_LARGE_OBJECT_SIZE, MMAP_ALLOC_INITIAL_CLEANUP_SIZE, 1); #else /* !USE_MMAP_ALLOC */ region = region_create_custom(xalloc, free, DEFAULT_CHUNK_SIZE, DEFAULT_LARGE_OBJECT_SIZE, DEFAULT_INITIAL_CLEANUP_SIZE, 1); #endif /* !USE_MMAP_ALLOC */ if (region == NULL) return NULL; #ifdef NSEC3 #ifndef FULL_PREHASH #ifdef USE_MMAP_ALLOC nsec3_region = region_create_custom(mmap_alloc, mmap_free, MMAP_ALLOC_CHUNK_SIZE, MMAP_ALLOC_LARGE_OBJECT_SIZE, MMAP_ALLOC_INITIAL_CLEANUP_SIZE, 1); #else /* !USE_MMAP_ALLOC */ nsec3_region = region_create_custom(xalloc, free, DEFAULT_CHUNK_SIZE, DEFAULT_LARGE_OBJECT_SIZE, DEFAULT_INITIAL_CLEANUP_SIZE, 1); #endif /* !USE_MMAP_ALLOC */ if (nsec3_region == NULL) { region_destroy(region); return NULL; } #ifdef USE_MMAP_ALLOC nsec3_mod_region = region_create_custom(mmap_alloc, mmap_free, MMAP_ALLOC_CHUNK_SIZE, MMAP_ALLOC_LARGE_OBJECT_SIZE, MMAP_ALLOC_INITIAL_CLEANUP_SIZE, 1); #else /* !USE_MMAP_ALLOC */ nsec3_mod_region = region_create_custom(xalloc, free, DEFAULT_CHUNK_SIZE, DEFAULT_LARGE_OBJECT_SIZE, DEFAULT_INITIAL_CLEANUP_SIZE, 1); #endif /* !USE_MMAP_ALLOC */ if (nsec3_mod_region == NULL) { region_destroy(region); region_destroy(nsec3_region); return NULL; } #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ /* Make a new structure... */ db = (namedb_type *) region_alloc(region, sizeof(namedb_type)); db->region = region; #ifdef NSEC3 #ifndef FULL_PREHASH db->nsec3_region = nsec3_region; db->nsec3_mod_region = nsec3_mod_region; db->nsec3_mod_domains = NULL; #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ db->domains = domain_table_create(region); db->zones = NULL; db->zone_count = 0; db->filename = NULL; db->fd = NULL; db->crc = ~0; db->crc_pos = 0; db->diff_skip = 0; db->diff_pos = 0; return db; } /** * Destroy namedb. * */ void namedb_destroy(struct namedb *db) { #ifdef NSEC3 #ifndef FULL_PREHASH region_destroy(db->nsec3_mod_region); db->nsec3_mod_region = NULL; db->nsec3_mod_domains = NULL; region_destroy(db->nsec3_region); db->nsec3_region = NULL; #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ region_destroy(db->region); } #ifdef NSEC3 #ifndef FULL_PREHASH int zone_nsec3_domains_create(struct namedb *db, struct zone *zone) { if ((db == NULL) || (zone == NULL)) return EINVAL; if (zone->nsec3_domains != NULL) return 0; zone->nsec3_domains = rbtree_create(db->nsec3_region, dname_compare); if (zone->nsec3_domains == NULL) return ENOMEM; return 0; } int zone_nsec3_domains_destroy(struct namedb *db, struct zone *zone) { rbnode_t *node; if ((db == NULL) || (zone == NULL)) return EINVAL; if (zone->nsec3_domains == NULL) return 0; node = rbtree_postorder_first(zone->nsec3_domains->root); while (node != RBTREE_NULL) { struct nsec3_domain *nsec3_domain = (struct nsec3_domain *) node; node = rbtree_postorder_next(node); if (nsec3_domain->covers != NULL) { nsec3_domain->covers->nsec3_cover = NULL; } region_recycle(db->nsec3_region, nsec3_domain, sizeof(*nsec3_domain)); } region_recycle(db->nsec3_region, zone->nsec3_domains, sizeof(*(zone->nsec3_domains))); zone->nsec3_domains = NULL; return 0; } int namedb_add_nsec3_domain(struct namedb *db, struct domain *domain, struct zone *zone) { struct nsec3_domain *nsec3_domain; if (zone->nsec3_domains == NULL) return 0; nsec3_domain = (struct nsec3_domain *) region_alloc(db->nsec3_region, sizeof(*nsec3_domain)); if (nsec3_domain == NULL) return ENOMEM; nsec3_domain->node.key = domain_dname(domain); nsec3_domain->nsec3_domain = domain; nsec3_domain->covers = NULL; if (rbtree_insert(zone->nsec3_domains, (rbnode_t *) nsec3_domain) == NULL) { region_recycle(db->nsec3_region, nsec3_domain, sizeof(*nsec3_domain)); } return 0; } int namedb_del_nsec3_domain(struct namedb *db, struct domain *domain, struct zone *zone) { rbnode_t *node; struct nsec3_domain *nsec3_domain; int error = 0; if (zone->nsec3_domains == NULL) return 0; node = rbtree_delete(zone->nsec3_domains, domain_dname(domain)); if (node == NULL) return 0; nsec3_domain = (struct nsec3_domain *) node; if (nsec3_domain->covers != NULL) { /* * It is possible that this NSEC3 domain was modified * due to the addition/deletion of another NSEC3 domain. * Make sure it gets added to the NSEC3 list later by * making sure it's covered domain is added to the * NSEC3 mod list. S64#3441 */ error = namedb_add_nsec3_mod_domain(db, nsec3_domain->covers); nsec3_domain->covers->nsec3_cover = NULL; nsec3_domain->covers = NULL; } region_recycle(db->nsec3_region, nsec3_domain, sizeof(*nsec3_domain)); return error; } int namedb_nsec3_mod_domains_create(struct namedb *db) { if (db == NULL) return EINVAL; namedb_nsec3_mod_domains_destroy(db); db->nsec3_mod_domains = rbtree_create(db->nsec3_mod_region, dname_compare); if (db->nsec3_mod_domains == NULL) return ENOMEM; return 0; } int namedb_nsec3_mod_domains_destroy(struct namedb *db) { if (db == NULL) return EINVAL; if (db->nsec3_mod_domains == NULL) return 0; region_free_all(db->nsec3_mod_region); db->nsec3_mod_domains = NULL; return 0; } int namedb_add_nsec3_mod_domain(struct namedb *db, struct domain *domain) { struct nsec3_mod_domain *nsec3_mod_domain; nsec3_mod_domain = (struct nsec3_mod_domain *) region_alloc(db->nsec3_mod_region, sizeof(*nsec3_mod_domain)); if (nsec3_mod_domain == NULL) { log_msg(LOG_ERR, "memory allocation failure on modified domain"); return ENOMEM; } nsec3_mod_domain->node.key = domain_dname(domain); nsec3_mod_domain->domain = domain; if (rbtree_insert(db->nsec3_mod_domains, (rbnode_t *) nsec3_mod_domain) == NULL) { region_recycle(db->nsec3_mod_region, nsec3_mod_domain, sizeof(*nsec3_mod_domain)); } return 0; } #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ nsd-3.2.16/rbtree.c0000664000175000017500000003371411761673243013024 0ustar matjematje/* * rbtree.c -- generic red black tree * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include "rbtree.h" #define BLACK 0 #define RED 1 rbnode_t rbtree_null_node = { RBTREE_NULL, /* Parent. */ RBTREE_NULL, /* Left. */ RBTREE_NULL, /* Right. */ NULL, /* Key. */ BLACK /* Color. */ }; static void rbtree_rotate_left(rbtree_t *rbtree, rbnode_t *node); static void rbtree_rotate_right(rbtree_t *rbtree, rbnode_t *node); static void rbtree_insert_fixup(rbtree_t *rbtree, rbnode_t *node); static void rbtree_delete_fixup(rbtree_t* rbtree, rbnode_t* child, rbnode_t* child_parent); /* * Creates a new red black tree, intializes and returns a pointer to it. * * Return NULL on failure. * */ rbtree_t * rbtree_create (region_type *region, int (*cmpf)(const void *, const void *)) { rbtree_t *rbtree; /* Allocate memory for it */ rbtree = (rbtree_t *) region_alloc(region, sizeof(rbtree_t)); if (!rbtree) { return NULL; } /* Initialize it */ rbtree->root = RBTREE_NULL; rbtree->count = 0; rbtree->region = region; rbtree->cmp = cmpf; return rbtree; } /* * Rotates the node to the left. * */ static void rbtree_rotate_left(rbtree_t *rbtree, rbnode_t *node) { rbnode_t *right = node->right; node->right = right->left; if (right->left != RBTREE_NULL) right->left->parent = node; right->parent = node->parent; if (node->parent != RBTREE_NULL) { if (node == node->parent->left) { node->parent->left = right; } else { node->parent->right = right; } } else { rbtree->root = right; } right->left = node; node->parent = right; } /* * Rotates the node to the right. * */ static void rbtree_rotate_right(rbtree_t *rbtree, rbnode_t *node) { rbnode_t *left = node->left; node->left = left->right; if (left->right != RBTREE_NULL) left->right->parent = node; left->parent = node->parent; if (node->parent != RBTREE_NULL) { if (node == node->parent->right) { node->parent->right = left; } else { node->parent->left = left; } } else { rbtree->root = left; } left->right = node; node->parent = left; } static void rbtree_insert_fixup(rbtree_t *rbtree, rbnode_t *node) { rbnode_t *uncle; /* While not at the root and need fixing... */ while (node != rbtree->root && node->parent->color == RED) { /* If our parent is left child of our grandparent... */ if (node->parent == node->parent->parent->left) { uncle = node->parent->parent->right; /* If our uncle is red... */ if (uncle->color == RED) { /* Paint the parent and the uncle black... */ node->parent->color = BLACK; uncle->color = BLACK; /* And the grandparent red... */ node->parent->parent->color = RED; /* And continue fixing the grandparent */ node = node->parent->parent; } else { /* Our uncle is black... */ /* Are we the right child? */ if (node == node->parent->right) { node = node->parent; rbtree_rotate_left(rbtree, node); } /* Now we're the left child, repaint and rotate... */ node->parent->color = BLACK; node->parent->parent->color = RED; rbtree_rotate_right(rbtree, node->parent->parent); } } else { uncle = node->parent->parent->left; /* If our uncle is red... */ if (uncle->color == RED) { /* Paint the parent and the uncle black... */ node->parent->color = BLACK; uncle->color = BLACK; /* And the grandparent red... */ node->parent->parent->color = RED; /* And continue fixing the grandparent */ node = node->parent->parent; } else { /* Our uncle is black... */ /* Are we the right child? */ if (node == node->parent->left) { node = node->parent; rbtree_rotate_right(rbtree, node); } /* Now we're the right child, repaint and rotate... */ node->parent->color = BLACK; node->parent->parent->color = RED; rbtree_rotate_left(rbtree, node->parent->parent); } } } rbtree->root->color = BLACK; } /* * Inserts a node into a red black tree. * * Returns NULL on failure or the pointer to the newly added node * otherwise. */ rbnode_t * rbtree_insert (rbtree_t *rbtree, rbnode_t *data) { /* XXX Not necessary, but keeps compiler quiet... */ int r = 0; /* We start at the root of the tree */ rbnode_t *node = rbtree->root; rbnode_t *parent = RBTREE_NULL; /* Lets find the new parent... */ while (node != RBTREE_NULL) { /* Compare two keys, do we have a duplicate? */ if ((r = rbtree->cmp(data->key, node->key)) == 0) { return NULL; } parent = node; if (r < 0) { node = node->left; } else { node = node->right; } } /* Initialize the new node */ data->parent = parent; data->left = data->right = RBTREE_NULL; data->color = RED; rbtree->count++; /* Insert it into the tree... */ if (parent != RBTREE_NULL) { if (r < 0) { parent->left = data; } else { parent->right = data; } } else { rbtree->root = data; } /* Fix up the red-black properties... */ rbtree_insert_fixup(rbtree, data); return data; } /* * Searches the red black tree, returns the data if key is found or NULL otherwise. * */ rbnode_t * rbtree_search (rbtree_t *rbtree, const void *key) { rbnode_t *node; if (rbtree_find_less_equal(rbtree, key, &node)) { return node; } else { return NULL; } } /* helpers for delete */ static void swap_int8(uint8_t* x, uint8_t* y) { uint8_t t = *x; *x = *y; *y = t; } static void swap_np(rbnode_t** x, rbnode_t** y) { rbnode_t* t = *x; *x = *y; *y = t; } static void change_parent_ptr(rbtree_t* rbtree, rbnode_t* parent, rbnode_t* old, rbnode_t* new) { if(parent == RBTREE_NULL) { assert(rbtree->root == old); if(rbtree->root == old) rbtree->root = new; return; } assert(parent->left == old || parent->right == old || parent->left == new || parent->right == new); if(parent->left == old) parent->left = new; if(parent->right == old) parent->right = new; } static void change_child_ptr(rbnode_t* child, rbnode_t* old, rbnode_t* new) { if(child == RBTREE_NULL) return; assert(child->parent == old || child->parent == new); if(child->parent == old) child->parent = new; } rbnode_t* rbtree_delete(rbtree_t *rbtree, const void *key) { rbnode_t *to_delete; rbnode_t *child; if((to_delete = rbtree_search(rbtree, key)) == 0) return 0; rbtree->count--; /* make sure we have at most one non-leaf child */ if(to_delete->left != RBTREE_NULL && to_delete->right != RBTREE_NULL) { /* swap with smallest from right subtree (or largest from left) */ rbnode_t *smright = to_delete->right; while(smright->left != RBTREE_NULL) smright = smright->left; /* swap the smright and to_delete elements in the tree, * but the rbnode_t is first part of user data struct * so cannot just swap the keys and data pointers. Instead * readjust the pointers left,right,parent */ /* swap colors - colors are tied to the position in the tree */ swap_int8(&to_delete->color, &smright->color); /* swap child pointers in parents of smright/to_delete */ change_parent_ptr(rbtree, to_delete->parent, to_delete, smright); if(to_delete->right != smright) change_parent_ptr(rbtree, smright->parent, smright, to_delete); /* swap parent pointers in children of smright/to_delete */ change_child_ptr(smright->left, smright, to_delete); change_child_ptr(smright->left, smright, to_delete); change_child_ptr(smright->right, smright, to_delete); change_child_ptr(smright->right, smright, to_delete); change_child_ptr(to_delete->left, to_delete, smright); if(to_delete->right != smright) change_child_ptr(to_delete->right, to_delete, smright); if(to_delete->right == smright) { /* set up so after swap they work */ to_delete->right = to_delete; smright->parent = smright; } /* swap pointers in to_delete/smright nodes */ swap_np(&to_delete->parent, &smright->parent); swap_np(&to_delete->left, &smright->left); swap_np(&to_delete->right, &smright->right); /* now delete to_delete (which is at the location where the smright previously was) */ } assert(to_delete->left == RBTREE_NULL || to_delete->right == RBTREE_NULL); if(to_delete->left != RBTREE_NULL) child = to_delete->left; else child = to_delete->right; /* unlink to_delete from the tree, replace to_delete with child */ change_parent_ptr(rbtree, to_delete->parent, to_delete, child); change_child_ptr(child, to_delete, to_delete->parent); if(to_delete->color == RED) { /* if node is red then the child (black) can be swapped in */ } else if(child->color == RED) { /* change child to BLACK, removing a RED node is no problem */ if(child!=RBTREE_NULL) child->color = BLACK; } else rbtree_delete_fixup(rbtree, child, to_delete->parent); /* unlink completely */ to_delete->parent = RBTREE_NULL; to_delete->left = RBTREE_NULL; to_delete->right = RBTREE_NULL; to_delete->color = BLACK; return to_delete; } static void rbtree_delete_fixup(rbtree_t* rbtree, rbnode_t* child, rbnode_t* child_parent) { rbnode_t* sibling; int go_up = 1; /* determine sibling to the node that is one-black short */ if(child_parent->right == child) sibling = child_parent->left; else sibling = child_parent->right; while(go_up) { if(child_parent == RBTREE_NULL) { /* removed parent==black from root, every path, so ok */ return; } if(sibling->color == RED) { /* rotate to get a black sibling */ child_parent->color = RED; sibling->color = BLACK; if(child_parent->right == child) rbtree_rotate_right(rbtree, child_parent); else rbtree_rotate_left(rbtree, child_parent); /* new sibling after rotation */ if(child_parent->right == child) sibling = child_parent->left; else sibling = child_parent->right; } if(child_parent->color == BLACK && sibling->color == BLACK && sibling->left->color == BLACK && sibling->right->color == BLACK) { /* fixup local with recolor of sibling */ if(sibling != RBTREE_NULL) sibling->color = RED; child = child_parent; child_parent = child_parent->parent; /* prepare to go up, new sibling */ if(child_parent->right == child) sibling = child_parent->left; else sibling = child_parent->right; } else go_up = 0; } if(child_parent->color == RED && sibling->color == BLACK && sibling->left->color == BLACK && sibling->right->color == BLACK) { /* move red to sibling to rebalance */ if(sibling != RBTREE_NULL) sibling->color = RED; child_parent->color = BLACK; return; } assert(sibling != RBTREE_NULL); /* get a new sibling, by rotating at sibling. See which child of sibling is red */ if(child_parent->right == child && sibling->color == BLACK && sibling->right->color == RED && sibling->left->color == BLACK) { sibling->color = RED; sibling->right->color = BLACK; rbtree_rotate_left(rbtree, sibling); /* new sibling after rotation */ if(child_parent->right == child) sibling = child_parent->left; else sibling = child_parent->right; } else if(child_parent->left == child && sibling->color == BLACK && sibling->left->color == RED && sibling->right->color == BLACK) { sibling->color = RED; sibling->left->color = BLACK; rbtree_rotate_right(rbtree, sibling); /* new sibling after rotation */ if(child_parent->right == child) sibling = child_parent->left; else sibling = child_parent->right; } /* now we have a black sibling with a red child. rotate and exchange colors. */ sibling->color = child_parent->color; child_parent->color = BLACK; if(child_parent->right == child) { assert(sibling->left->color == RED); sibling->left->color = BLACK; rbtree_rotate_right(rbtree, child_parent); } else { assert(sibling->right->color == RED); sibling->right->color = BLACK; rbtree_rotate_left(rbtree, child_parent); } } int rbtree_find_less_equal(rbtree_t *rbtree, const void *key, rbnode_t **result) { int r; rbnode_t *node; assert(result); /* We start at root... */ node = rbtree->root; *result = NULL; /* While there are children... */ while (node != RBTREE_NULL) { r = rbtree->cmp(key, node->key); if (r == 0) { /* Exact match */ *result = node; return 1; } if (r < 0) { node = node->left; } else { /* Temporary match */ *result = node; node = node->right; } } return 0; } /* * Finds the first element in the red black tree * */ rbnode_t * rbtree_first (rbtree_t *rbtree) { rbnode_t *node; for (node = rbtree->root; node->left != RBTREE_NULL; node = node->left); return node; } rbnode_t * rbtree_last (rbtree_t *rbtree) { rbnode_t *node; for (node = rbtree->root; node->right != RBTREE_NULL; node = node->right); return node; } /* * Returns the next node... * */ rbnode_t * rbtree_next (rbnode_t *node) { rbnode_t *parent; if (node->right != RBTREE_NULL) { /* One right, then keep on going left... */ for (node = node->right; node->left != RBTREE_NULL; node = node->left); } else { parent = node->parent; while (parent != RBTREE_NULL && node == parent->right) { node = parent; parent = parent->parent; } node = parent; } return node; } rbnode_t * rbtree_previous(rbnode_t *node) { rbnode_t *parent; if (node->left != RBTREE_NULL) { /* One left, then keep on going right... */ for (node = node->left; node->right != RBTREE_NULL; node = node->right); } else { parent = node->parent; while (parent != RBTREE_NULL && node == parent->left) { node = parent; parent = parent->parent; } node = parent; } return node; } /** * Given an rbtree "root" node, find the first node under that tree in * postorder. */ rbnode_t * rbtree_postorder_first(rbnode_t *root) { rbnode_t *node = root; do { while (node->left != RBTREE_NULL) { node = node->left; } while ((node->left == RBTREE_NULL) && (node->right != RBTREE_NULL)) { node = node->right; } } while (node->left != node->right); return node; } /** * Given any node in an rbtree, find the next node in postorder. */ rbnode_t * rbtree_postorder_next(rbnode_t *node) { if ((node->parent->right == RBTREE_NULL) || (node->parent->right == node)) node = node->parent; else node = rbtree_postorder_first(node->parent->right); return node; } nsd-3.2.16/mkinstalldirs0000775000175000017500000000131711024154774014170 0ustar matjematje#! /bin/sh # mkinstalldirs --- make directory hierarchy # Author: Noah Friedman # Created: 1993-05-16 # Public domain # $Id: mkinstalldirs 2739 2008-06-12 08:10:36Z matje $ errstatus=0 for file do set fnord `echo ":$file" | sed -ne 's/^:\//#/;s/^://;s/\// /g;s/^#/\//;p'` shift pathcomp= for d do pathcomp="$pathcomp$d" case "$pathcomp" in -* ) pathcomp=./$pathcomp ;; esac if test ! -d "$pathcomp"; then echo "mkdir $pathcomp" mkdir "$pathcomp" || lasterr=$? if test ! -d "$pathcomp"; then errstatus=$lasterr fi fi pathcomp="$pathcomp/" done done exit $errstatus # mkinstalldirs ends here nsd-3.2.16/query.h0000664000175000017500000001224412043766134012702 0ustar matjematje/* * query.h -- manipulation with the queries * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _QUERY_H_ #define _QUERY_H_ #include #include #include "namedb.h" #include "nsd.h" #include "packet.h" #include "tsig.h" enum query_state { QUERY_PROCESSED, QUERY_DISCARDED, QUERY_IN_AXFR }; typedef enum query_state query_state_type; /* Query as we pass it around */ typedef struct query query_type; struct query { /* * Memory region freed whenever the query is reset. */ region_type *region; /* * The address the query was received from. */ #ifdef INET6 struct sockaddr_storage addr; #else struct sockaddr_in addr; #endif socklen_t addrlen; /* * Maximum supported query size. */ size_t maxlen; /* * Space reserved for optional records like EDNS. */ size_t reserved_space; /* EDNS information provided by the client. */ edns_record_type edns; /* TSIG record information and running hash for query-response */ tsig_record_type tsig; /* tsig actions can be overridden, for axfr transfer. */ int tsig_prepare_it, tsig_update_it, tsig_sign_it; int tcp; uint16_t tcplen; buffer_type *packet; /* Normalized query domain name. */ const dname_type *qname; /* Query type and class in host byte order. */ uint16_t qtype; uint16_t qclass; /* The zone used to answer the query. */ zone_type *zone; /* The domain used to answer the query. */ domain_type *domain; /* The delegation domain, if any. */ domain_type *delegation_domain; /* The delegation NS rrset, if any. */ rrset_type *delegation_rrset; /* Original opcode. */ uint8_t opcode; /* * The number of CNAMES followed. After a CNAME is followed * we no longer change the RCODE to NXDOMAIN and no longer add * SOA records to the authority section in case of NXDOMAIN * and NODATA. * Also includes number of DNAMES followed. */ int cname_count; /* Used for dname compression. */ uint16_t compressed_dname_count; domain_type *compressed_dnames[MAXRRSPP]; /* * Indexed by domain->number, index 0 is reserved for the * query name when generated from a wildcard record. */ uint16_t *compressed_dname_offsets; uint32_t compressed_dname_offsets_size; /* number of temporary domains used for the query */ uint32_t number_temporary_domains; /* * Used for AXFR processing. */ int axfr_is_done; zone_type *axfr_zone; domain_type *axfr_current_domain; rrset_type *axfr_current_rrset; uint16_t axfr_current_rr; #ifdef RATELIMIT /* if we encountered a wildcard, its domain */ domain_type *wildcard_domain; #endif }; /* Check if the last write resulted in an overflow. */ static inline int query_overflow(struct query *q); /* * Store the offset of the specified domain in the dname compression * table. */ void query_put_dname_offset(struct query *query, domain_type *domain, uint16_t offset); /* * Lookup the offset of the specified domain in the dname compression * table. Offset 0 is used to indicate the domain is not yet in the * compression table. */ static inline uint16_t query_get_dname_offset(struct query *query, domain_type *domain) { return query->compressed_dname_offsets[domain->number]; } /* * Remove all compressed dnames that have an offset that points beyond * the end of the current answer. This must be done after some RRs * are truncated and before adding new RRs. Otherwise dnames may be * compressed using truncated data! */ void query_clear_dname_offsets(struct query *query, size_t max_offset); /* * Clear the compression tables. */ void query_clear_compression_tables(struct query *query); /* * Enter the specified domain into the compression table starting at * the specified offset. */ void query_add_compression_domain(struct query *query, domain_type *domain, uint16_t offset); /* * Create a new query structure. */ query_type *query_create(region_type *region, uint16_t *compressed_dname_offsets, uint32_t compressed_dname_size); /* * Reset a query structure so it is ready for receiving and processing * a new query. */ void query_reset(query_type *query, size_t maxlen, int is_tcp); /* * Process a query and write the response in the query I/O buffer. */ query_state_type query_process(query_type *q, nsd_type *nsd); /* * Prepare the query structure for writing the response. The packet * data up-to the current packet limit is preserved. This usually * includes the packet header and question section. Space is reserved * for the optional EDNS record, if required. */ void query_prepare_response(query_type *q); /* * Add EDNS0 information to the response if required. */ void query_add_optional(query_type *q, nsd_type *nsd); /* * Write an error response into the query structure with the indicated * RCODE. */ query_state_type query_error(query_type *q, nsd_rc_type rcode); static inline int query_overflow(query_type *q) { return buffer_position(q->packet) > (q->maxlen - q->reserved_space); } static inline int query_overflow_nsid(query_type *q, uint16_t nsid_len) { return buffer_position(q->packet) > (q->maxlen - q->reserved_space - nsid_len); } #endif /* _QUERY_H_ */ nsd-3.2.16/rdata.h0000664000175000017500000000326711535444205012632 0ustar matjematje/* * rdata.h -- RDATA conversion functions. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _RDATA_H_ #define _RDATA_H_ #include "dns.h" #include "namedb.h" /* High bit of the APL length field is the negation bit. */ #define APL_NEGATION_MASK 0x80U #define APL_LENGTH_MASK (~APL_NEGATION_MASK) extern lookup_table_type dns_certificate_types[]; extern lookup_table_type dns_algorithms[]; int rdata_atom_to_string(buffer_type *output, rdata_zoneformat_type type, rdata_atom_type rdata, rr_type *rr); /* * Split the wireformat RDATA into an array of rdata atoms. Domain * names are inserted into the OWNERS table. The number of rdata atoms * is returned and the array itself is allocated in REGION and stored * in RDATAS. * * Returns -1 on failure. */ ssize_t rdata_wireformat_to_rdata_atoms(region_type *region, domain_table_type *owners, uint16_t rrtype, uint16_t rdata_size, buffer_type *packet, rdata_atom_type **rdatas); /* * Calculate the maximum size of the rdata assuming domain names are * not compressed. */ size_t rdata_maximum_wireformat_size(rrtype_descriptor_type *descriptor, size_t rdata_count, rdata_atom_type *rdatas); int rdata_atoms_to_unknown_string(buffer_type *out, rrtype_descriptor_type *descriptor, size_t rdata_count, rdata_atom_type *rdatas); /* print rdata to a text string (as for a zone file) returns 0 on a failure (bufpos is reset to original position). returns 1 on success, bufpos is moved. */ int print_rdata(buffer_type *output, rrtype_descriptor_type *descriptor, rr_type *record); #endif /* _DNS_H_ */ nsd-3.2.16/region-allocator.c0000664000175000017500000002723412134226771014775 0ustar matjematje/* * region-allocator.c -- region based memory allocator. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include "region-allocator.h" #ifdef ALIGNMENT #undef ALIGNMENT #endif #define ALIGN_UP(x, s) (((x) + s - 1) & (~(s - 1))) #define ALIGNMENT (sizeof(void *)) #define CHECK_DOUBLE_FREE 0 /* set to 1 to perform expensive check for double recycle() */ typedef struct cleanup cleanup_type; struct cleanup { void (*action)(void *); void *data; }; struct recycle_elem { struct recycle_elem* next; }; struct region { size_t total_allocated; size_t small_objects; size_t large_objects; size_t chunk_count; size_t unused_space; /* Unused space due to alignment, etc. */ size_t allocated; char *initial_data; char *data; void *(*allocator)(size_t); void (*deallocator)(void *); size_t maximum_cleanup_count; size_t cleanup_count; cleanup_type *cleanups; size_t chunk_size; size_t large_object_size; /* if not NULL recycling is enabled. * It is an array of linked lists of parts held for recycle. * The parts are all pointers to within the allocated chunks. * Array [i] points to elements of size i. */ struct recycle_elem** recycle_bin; /* amount of memory in recycle storage */ size_t recycle_size; }; static region_type * alloc_region_base(void *(*allocator)(size_t size), void (*deallocator)(void *), size_t initial_cleanup_count) { region_type *result = (region_type *) allocator(sizeof(region_type)); if (!result) return NULL; result->total_allocated = 0; result->small_objects = 0; result->large_objects = 0; result->chunk_count = 1; result->unused_space = 0; result->recycle_bin = NULL; result->recycle_size = 0; result->allocated = 0; result->data = NULL; result->initial_data = NULL; result->allocator = allocator; result->deallocator = deallocator; assert(initial_cleanup_count > 0); result->maximum_cleanup_count = initial_cleanup_count; result->cleanup_count = 0; result->cleanups = (cleanup_type *) allocator( result->maximum_cleanup_count * sizeof(cleanup_type)); if (!result->cleanups) { deallocator(result); return NULL; } result->chunk_size = DEFAULT_CHUNK_SIZE; result->large_object_size = DEFAULT_LARGE_OBJECT_SIZE; return result; } region_type * region_create(void *(*allocator)(size_t size), void (*deallocator)(void *)) { region_type* result = alloc_region_base(allocator, deallocator, DEFAULT_INITIAL_CLEANUP_SIZE); if(!result) return NULL; result->data = (char *) allocator(result->chunk_size); if (!result->data) { deallocator(result->cleanups); deallocator(result); return NULL; } result->initial_data = result->data; return result; } region_type *region_create_custom(void *(*allocator)(size_t), void (*deallocator)(void *), size_t chunk_size, size_t large_object_size, size_t initial_cleanup_size, int recycle) { region_type* result = alloc_region_base(allocator, deallocator, initial_cleanup_size); if(!result) return NULL; assert(large_object_size <= chunk_size); result->chunk_size = chunk_size; result->large_object_size = large_object_size; if(result->chunk_size > 0) { result->data = (char *) allocator(result->chunk_size); if (!result->data) { deallocator(result->cleanups); deallocator(result); return NULL; } result->initial_data = result->data; } if(recycle) { result->recycle_bin = allocator(sizeof(struct recycle_elem*) * result->large_object_size); if(!result->recycle_bin) { region_destroy(result); return NULL; } memset(result->recycle_bin, 0, sizeof(struct recycle_elem*) * result->large_object_size); } return result; } void region_destroy(region_type *region) { void (*deallocator)(void *); if (!region) return; deallocator = region->deallocator; region_free_all(region); deallocator(region->cleanups); deallocator(region->initial_data); if(region->recycle_bin) deallocator(region->recycle_bin); deallocator(region); } size_t region_add_cleanup(region_type *region, void (*action)(void *), void *data) { assert(action); if (region->cleanup_count >= region->maximum_cleanup_count) { cleanup_type *cleanups = (cleanup_type *) region->allocator( 2 * region->maximum_cleanup_count * sizeof(cleanup_type)); if (!cleanups) return 0; memcpy(cleanups, region->cleanups, region->cleanup_count * sizeof(cleanup_type)); region->deallocator(region->cleanups); region->cleanups = cleanups; region->maximum_cleanup_count *= 2; } region->cleanups[region->cleanup_count].action = action; region->cleanups[region->cleanup_count].data = data; ++region->cleanup_count; return region->cleanup_count; } void region_remove_cleanup(region_type *region, void (*action)(void *), void *data) { size_t i; for(i=0; icleanup_count; i++) { if(region->cleanups[i].action == action && region->cleanups[i].data == data) { region->cleanup_count--; region->cleanups[i] = region->cleanups[region->cleanup_count]; return; } } } void * region_alloc(region_type *region, size_t size) { size_t aligned_size; void *result; if (size == 0) { size = 1; } aligned_size = ALIGN_UP(size, ALIGNMENT); if (aligned_size >= region->large_object_size) { result = region->allocator(size); if (!result) return NULL; if (!region_add_cleanup(region, region->deallocator, result)) { region->deallocator(result); return NULL; } region->total_allocated += size; ++region->large_objects; return result; } if (region->recycle_bin && region->recycle_bin[aligned_size]) { result = (void*)region->recycle_bin[aligned_size]; region->recycle_bin[aligned_size] = region->recycle_bin[aligned_size]->next; region->recycle_size -= aligned_size; region->unused_space += aligned_size - size; return result; } if (region->allocated + aligned_size > region->chunk_size) { void *chunk = region->allocator(region->chunk_size); size_t wasted; if (!chunk) return NULL; wasted = (region->chunk_size - region->allocated) & (~(ALIGNMENT-1)); if(wasted >= ALIGNMENT) { /* put wasted part in recycle bin for later use */ region->total_allocated += wasted; ++region->small_objects; region_recycle(region, region->data+region->allocated, wasted); region->allocated += wasted; } ++region->chunk_count; region->unused_space += region->chunk_size - region->allocated; if(!region_add_cleanup(region, region->deallocator, chunk)) { region->deallocator(chunk); region->chunk_count--; region->unused_space -= region->chunk_size - region->allocated; return NULL; } region->allocated = 0; region->data = (char *) chunk; } result = region->data + region->allocated; region->allocated += aligned_size; region->total_allocated += aligned_size; region->unused_space += aligned_size - size; ++region->small_objects; return result; } void * region_alloc_init(region_type *region, const void *init, size_t size) { void *result = region_alloc(region, size); if (!result) return NULL; memcpy(result, init, size); return result; } void * region_alloc_zero(region_type *region, size_t size) { void *result = region_alloc(region, size); if (!result) return NULL; memset(result, 0, size); return result; } void region_free_all(region_type *region) { size_t i; assert(region); assert(region->cleanups); i = region->cleanup_count; while (i > 0) { --i; assert(region->cleanups[i].action); region->cleanups[i].action(region->cleanups[i].data); } if(region->recycle_bin) { memset(region->recycle_bin, 0, sizeof(struct recycle_elem*) * region->large_object_size); region->recycle_size = 0; } region->data = region->initial_data; region->cleanup_count = 0; region->allocated = 0; region->total_allocated = 0; region->small_objects = 0; region->large_objects = 0; region->chunk_count = 1; region->unused_space = 0; } char * region_strdup(region_type *region, const char *string) { return (char *) region_alloc_init(region, string, strlen(string) + 1); } void region_recycle(region_type *region, void *block, size_t size) { size_t aligned_size; size_t i; if(!block || !region->recycle_bin) return; if (size == 0) { size = 1; } aligned_size = ALIGN_UP(size, ALIGNMENT); if(aligned_size < region->large_object_size) { struct recycle_elem* elem = (struct recycle_elem*)block; /* we rely on the fact that ALIGNMENT is void* so the next will fit */ assert(aligned_size >= sizeof(struct recycle_elem)); if(CHECK_DOUBLE_FREE) { /* make sure the same ptr is not freed twice. */ struct recycle_elem *p = region->recycle_bin[aligned_size]; while(p) { assert(p != elem); p = p->next; } } elem->next = region->recycle_bin[aligned_size]; region->recycle_bin[aligned_size] = elem; region->recycle_size += aligned_size; region->unused_space -= aligned_size - size; return; } /* a large allocation */ region->total_allocated -= size; --region->large_objects; for(i=0; icleanup_count; i++) { while(region->cleanups[i].data == block) { /* perform action (deallocator) on block */ region->cleanups[i].action(block); region->cleanups[i].data = NULL; /* remove cleanup - move last entry here, check this one again */ --region->cleanup_count; region->cleanups[i].action = region->cleanups[region->cleanup_count].action; region->cleanups[i].data = region->cleanups[region->cleanup_count].data; } } } void region_dump_stats(region_type *region, FILE *out) { fprintf(out, "%lu objects (%lu small/%lu large), %lu bytes allocated (%lu wasted) in %lu chunks, %lu cleanups, %lu in recyclebin", (unsigned long) (region->small_objects + region->large_objects), (unsigned long) region->small_objects, (unsigned long) region->large_objects, (unsigned long) region->total_allocated, (unsigned long) region->unused_space, (unsigned long) region->chunk_count, (unsigned long) region->cleanup_count, (unsigned long) region->recycle_size); if(1 && region->recycle_bin) { /* print details of the recycle bin */ size_t i; for(i=0; ilarge_object_size; i++) { size_t count = 0; struct recycle_elem* el = region->recycle_bin[i]; while(el) { count++; el = el->next; } if(i%ALIGNMENT == 0 && i!=0) fprintf(out, " %lu", (unsigned long)count); } } } size_t region_get_recycle_size(region_type* region) { return region->recycle_size; } /* debug routine, includes here to keep base region-allocator independent */ #undef ALIGN_UP #include "util.h" void region_log_stats(region_type *region) { char buf[10240], *str=buf; int strl = sizeof(buf); int len; snprintf(str, strl, "%lu objects (%lu small/%lu large), %lu bytes allocated (%lu wasted) in %lu chunks, %lu cleanups, %lu in recyclebin", (unsigned long) (region->small_objects + region->large_objects), (unsigned long) region->small_objects, (unsigned long) region->large_objects, (unsigned long) region->total_allocated, (unsigned long) region->unused_space, (unsigned long) region->chunk_count, (unsigned long) region->cleanup_count, (unsigned long) region->recycle_size); len = strlen(str); str+=len; strl-=len; if(1 && region->recycle_bin) { /* print details of the recycle bin */ size_t i; for(i=0; ilarge_object_size; i++) { size_t count = 0; struct recycle_elem* el = region->recycle_bin[i]; while(el) { count++; el = el->next; } if(i%ALIGNMENT == 0 && i!=0) { snprintf(str, strl, " %lu", (unsigned long)count); len = strlen(str); str+=len; strl-=len; } } } log_msg(LOG_INFO, "memory: %s", buf); } nsd-3.2.16/zlexer.lex0000664000175000017500000002073411761673243013416 0ustar matjematje%{ /* * zlexer.lex - lexical analyzer for (DNS) zone files * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include "zonec.h" #include "dname.h" #include "zparser.h" #define YY_NO_UNPUT #if 0 #define LEXOUT(s) printf s /* used ONLY when debugging */ #else #define LEXOUT(s) #endif enum lexer_state { EXPECT_OWNER, PARSING_OWNER, PARSING_TTL_CLASS_TYPE, PARSING_RDATA }; static int parse_token(int token, char *yytext, enum lexer_state *lexer_state); static YY_BUFFER_STATE include_stack[MAXINCLUDES]; static zparser_type zparser_stack[MAXINCLUDES]; static int include_stack_ptr = 0; /* * Saves the file specific variables on the include stack. */ static void push_parser_state(FILE *input) { zparser_stack[include_stack_ptr].filename = parser->filename; zparser_stack[include_stack_ptr].line = parser->line; zparser_stack[include_stack_ptr].origin = parser->origin; include_stack[include_stack_ptr] = YY_CURRENT_BUFFER; yy_switch_to_buffer(yy_create_buffer(input, YY_BUF_SIZE)); ++include_stack_ptr; } /* * Restores the file specific variables from the include stack. */ static void pop_parser_state(void) { --include_stack_ptr; parser->filename = zparser_stack[include_stack_ptr].filename; parser->line = zparser_stack[include_stack_ptr].line; parser->origin = zparser_stack[include_stack_ptr].origin; yy_delete_buffer(YY_CURRENT_BUFFER); yy_switch_to_buffer(include_stack[include_stack_ptr]); } #ifndef yy_set_bol /* compat definition, for flex 2.4.6 */ #define yy_set_bol(at_bol) \ { \ if ( ! yy_current_buffer ) \ yy_current_buffer = yy_create_buffer( yyin, YY_BUF_SIZE ); \ yy_current_buffer->yy_ch_buf[0] = ((at_bol)?'\n':' '); \ } #endif %} SPACE [ \t] LETTER [a-zA-Z] NEWLINE [\n\r] ZONESTR [^ \t\n\r();.\"\$] DOLLAR \$ COMMENT ; DOT \. BIT [^\]\n]|\\. ANY [^\"\n\\]|\\. %x incl bitlabel quotedstring %% static int paren_open = 0; static enum lexer_state lexer_state = EXPECT_OWNER; {SPACE}*{COMMENT}.* /* ignore */ ^{DOLLAR}TTL { lexer_state = PARSING_RDATA; return DOLLAR_TTL; } ^{DOLLAR}ORIGIN { lexer_state = PARSING_RDATA; return DOLLAR_ORIGIN; } /* * Handle $INCLUDE directives. See * http://dinosaur.compilertools.net/flex/flex_12.html#SEC12. */ ^{DOLLAR}INCLUDE { BEGIN(incl); } \n | <> { int error_occurred = parser->error_occurred; BEGIN(INITIAL); zc_error("missing file name in $INCLUDE directive"); yy_set_bol(1); /* Set beginning of line, so "^" rules match. */ ++parser->line; parser->error_occurred = error_occurred; } .+ { char *tmp; domain_type *origin = parser->origin; int error_occurred = parser->error_occurred; BEGIN(INITIAL); if (include_stack_ptr >= MAXINCLUDES ) { zc_error("includes nested too deeply, skipped (>%d)", MAXINCLUDES); } else { FILE *input; /* Remove trailing comment. */ tmp = strrchr(yytext, ';'); if (tmp) { *tmp = '\0'; } strip_string(yytext); /* Parse origin for include file. */ tmp = strrchr(yytext, ' '); if (!tmp) { tmp = strrchr(yytext, '\t'); } if (tmp) { const dname_type *dname; /* split the original yytext */ *tmp = '\0'; strip_string(yytext); dname = dname_parse(parser->region, tmp + 1); if (!dname) { zc_error("incorrect include origin '%s'", tmp + 1); } else if (*(tmp + strlen(tmp + 1)) != '.') { zc_error("$INCLUDE directive requires absolute domain name"); } else { origin = domain_table_insert( parser->db->domains, dname); } } if (strlen(yytext) == 0) { zc_error("missing file name in $INCLUDE directive"); } else if (!(input = fopen(yytext, "r"))) { zc_error("cannot open include file '%s': %s", yytext, strerror(errno)); } else { /* Initialize parser for include file. */ char *filename = region_strdup(parser->region, yytext); push_parser_state(input); /* Destroys yytext. */ parser->filename = filename; parser->line = 1; parser->origin = origin; lexer_state = EXPECT_OWNER; } } parser->error_occurred = error_occurred; } <> { yy_set_bol(1); /* Set beginning of line, so "^" rules match. */ if (include_stack_ptr == 0) { yyterminate(); } else { fclose(yyin); pop_parser_state(); } } ^{DOLLAR}{LETTER}+ { zc_warning("Unknown directive: %s", yytext); } {DOT} { LEXOUT((". ")); return parse_token('.', yytext, &lexer_state); } @ { LEXOUT(("@ ")); return parse_token('@', yytext, &lexer_state); } \\# { LEXOUT(("\\# ")); return parse_token(URR, yytext, &lexer_state); } {NEWLINE} { ++parser->line; if (!paren_open) { lexer_state = EXPECT_OWNER; LEXOUT(("NL\n")); return NL; } else { LEXOUT(("SP ")); return SP; } } \( { if (paren_open) { zc_error("nested parentheses"); yyterminate(); } LEXOUT(("( ")); paren_open = 1; return SP; } \) { if (!paren_open) { zc_error("closing parentheses without opening parentheses"); yyterminate(); } LEXOUT((") ")); paren_open = 0; return SP; } {SPACE}+ { if (!paren_open && lexer_state == EXPECT_OWNER) { lexer_state = PARSING_TTL_CLASS_TYPE; LEXOUT(("PREV ")); return PREV; } if (lexer_state == PARSING_OWNER) { lexer_state = PARSING_TTL_CLASS_TYPE; } LEXOUT(("SP ")); return SP; } /* Bitlabels. Strip leading and ending brackets. */ \\\[ { BEGIN(bitlabel); } <> { zc_error("EOF inside bitlabel"); BEGIN(INITIAL); } {BIT}* { yymore(); } \n { ++parser->line; yymore(); } \] { BEGIN(INITIAL); yytext[yyleng - 1] = '\0'; return parse_token(BITLAB, yytext, &lexer_state); } /* Quoted strings. Strip leading and ending quotes. */ \" { BEGIN(quotedstring); LEXOUT(("\" ")); } <> { zc_error("EOF inside quoted string"); BEGIN(INITIAL); } {ANY}* { LEXOUT(("STR ")); yymore(); } \n { ++parser->line; yymore(); } \" { LEXOUT(("\" ")); BEGIN(INITIAL); yytext[yyleng - 1] = '\0'; return parse_token(STR, yytext, &lexer_state); } ({ZONESTR}|\\.|\\\n)+ { /* Any allowed word. */ return parse_token(STR, yytext, &lexer_state); } . { zc_error("unknown character '%c' (\\%03d) seen - is this a zonefile?", (int) yytext[0], (int) yytext[0]); } %% /* * Analyze "word" to see if it matches an RR type, possibly by using * the "TYPExxx" notation. If it matches, the corresponding token is * returned and the TYPE parameter is set to the RR type value. */ static int rrtype_to_token(const char *word, uint16_t *type) { uint16_t t = rrtype_from_string(word); if (t != 0) { rrtype_descriptor_type *entry = rrtype_descriptor_by_type(t); *type = t; return entry->token; } return 0; } /* * Remove \DDD constructs from the input. See RFC 1035, section 5.1. */ static size_t zoctet(char *text) { /* * s follows the string, p lags behind and rebuilds the new * string */ char *s; char *p; for (s = p = text; *s; ++s, ++p) { assert(p <= s); if (s[0] != '\\') { /* Ordinary character. */ *p = *s; } else if (isdigit((int)s[1]) && isdigit((int)s[2]) && isdigit((int)s[3])) { /* \DDD escape. */ int val = (hexdigit_to_int(s[1]) * 100 + hexdigit_to_int(s[2]) * 10 + hexdigit_to_int(s[3])); if (0 <= val && val <= 255) { s += 3; *p = val; } else { zc_warning("text escape \\DDD overflow"); *p = *++s; } } else if (s[1] != '\0') { /* \X where X is any character, keep X. */ *p = *++s; } else { /* Trailing backslash, ignore it. */ zc_warning("trailing backslash ignored"); --p; } } *p = '\0'; return p - text; } static int parse_token(int token, char *yytext, enum lexer_state *lexer_state) { size_t len; char *str; if (*lexer_state == EXPECT_OWNER) { *lexer_state = PARSING_OWNER; } else if (*lexer_state == PARSING_TTL_CLASS_TYPE) { const char *t; int token; uint16_t rrclass; /* type */ token = rrtype_to_token(yytext, &yylval.type); if (token != 0) { *lexer_state = PARSING_RDATA; LEXOUT(("%d[%s] ", token, yytext)); return token; } /* class */ rrclass = rrclass_from_string(yytext); if (rrclass != 0) { yylval.klass = rrclass; LEXOUT(("CLASS ")); return T_RRCLASS; } /* ttl */ yylval.ttl = strtottl(yytext, &t); if (*t == '\0') { LEXOUT(("TTL ")); return T_TTL; } } str = region_strdup(parser->rr_region, yytext); len = zoctet(str); yylval.data.str = str; yylval.data.len = len; LEXOUT(("%d[%s] ", token, yytext)); return token; } nsd-3.2.16/options.h0000664000175000017500000001432312162532574013231 0ustar matjematje/* * options.h -- nsd.conf options definitions and prototypes * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef OPTIONS_H #define OPTIONS_H #include "config.h" #include #include "region-allocator.h" #include "rbtree.h" struct query; struct dname; struct tsig_key; typedef struct nsd_options nsd_options_t; typedef struct zone_options zone_options_t; typedef struct ipaddress_option ip_address_option_t; typedef struct acl_options acl_options_t; typedef struct key_options key_options_t; typedef struct config_parser_state config_parser_state_t; /* * Options global for nsd. */ struct nsd_options { /* options for zones, by apex, contains zone_options_t */ rbtree_t* zone_options; /* list of keys defined */ key_options_t* keys; size_t numkeys; /* list of ip adresses to bind to (or NULL for all) */ ip_address_option_t* ip_addresses; int ip_transparent; int debug_mode; int verbosity; int hide_version; int ip4_only; int ip6_only; const char* database; const char* identity; const char* logfile; int server_count; int tcp_count; int tcp_query_count; int tcp_timeout; size_t ipv4_edns_size; size_t ipv6_edns_size; const char* pidfile; const char* port; int statistics; const char* zonestatsfile; const char* chroot; const char* username; const char* zonesdir; const char* difffile; const char* xfrdfile; const char* nsid; int xfrd_reload_timeout; #ifdef RATELIMIT /** number of buckets in rrl hashtable */ size_t rrl_size; /** max qps for queries, 0 is nolimit */ size_t rrl_ratelimit; /** ratio of slipped responses, 0 is noslip */ size_t rrl_slip; /** ip prefix length */ size_t rrl_ipv4_prefix_length; size_t rrl_ipv6_prefix_length; /** max qps for whitelisted queries, 0 is nolimit */ size_t rrl_whitelist_ratelimit; #endif region_type* region; }; struct ipaddress_option { ip_address_option_t* next; char* address; }; /* * Options for a zone */ struct zone_options { /* key is dname of apex */ rbnode_t node; /* is apex of the zone */ const char* name; const char* zonefile; acl_options_t* allow_notify; acl_options_t* request_xfr; acl_options_t* notify; acl_options_t* provide_xfr; acl_options_t* outgoing_interface; #ifdef RATELIMIT uint16_t rrl_whitelist; /* bitmap with rrl types */ #endif uint8_t allow_axfr_fallback; uint8_t notify_retry; }; union acl_addr_storage { #ifdef INET6 struct in_addr addr; struct in6_addr addr6; #else struct in_addr addr; #endif }; /* * Access control list element */ struct acl_options { acl_options_t* next; /* options */ uint8_t use_axfr_only; uint8_t allow_udp; time_t ixfr_disabled; int bad_xfr_count; /* ip address range */ const char* ip_address_spec; uint8_t is_ipv6; unsigned int port; /* is 0(no port) or suffix @port value */ union acl_addr_storage addr; union acl_addr_storage range_mask; enum { acl_range_single = 0, /* single adress */ acl_range_mask = 1, /* 10.20.30.40&255.255.255.0 */ acl_range_subnet = 2, /* 10.20.30.40/28 */ acl_range_minmax = 3 /* 10.20.30.40-10.20.30.60 (mask=max) */ } rangetype; /* key */ uint8_t nokey; uint8_t blocked; const char* key_name; key_options_t* key_options; }; /* * Key definition */ struct key_options { key_options_t* next; const char* name; const char* algorithm; const char* secret; struct tsig_key* tsig_key; }; /* * Used during options parsing */ struct config_parser_state { const char* filename; int line; int errors; nsd_options_t* opt; zone_options_t* current_zone; key_options_t* current_key; ip_address_option_t* current_ip_address_option; acl_options_t* current_allow_notify; acl_options_t* current_request_xfr; acl_options_t* current_notify; acl_options_t* current_provide_xfr; acl_options_t* current_outgoing_interface; }; extern config_parser_state_t* cfg_parser; /* region will be put in nsd_options struct. Returns empty options struct. */ nsd_options_t* nsd_options_create(region_type* region); /* the number of zones that are configured */ static inline size_t nsd_options_num_zones(nsd_options_t* opt) { return opt->zone_options->count; } /* insert a zone into the main options tree, returns 0 on error */ int nsd_options_insert_zone(nsd_options_t* opt, zone_options_t* zone); /* parses options file. Returns false on failure */ int parse_options_file(nsd_options_t* opt, const char* file); zone_options_t* zone_options_create(region_type* region); /* find a zone by apex domain name, or NULL if not found. */ zone_options_t* zone_options_find(nsd_options_t* opt, const struct dname* apex); key_options_t* key_options_create(region_type* region); key_options_t* key_options_find(nsd_options_t* opt, const char* name); #if defined(HAVE_SSL) /* tsig must be inited, adds all keys in options to tsig. */ void key_options_tsig_add(nsd_options_t* opt); #endif /* check acl list, acl number that matches if passed(0..), * or failure (-1) if dropped */ /* the reason why (the acl) is returned too (or NULL) */ int acl_check_incoming(acl_options_t* acl, struct query* q, acl_options_t** reason); int acl_addr_matches_host(acl_options_t* acl, acl_options_t* host); int acl_addr_matches(acl_options_t* acl, struct query* q); int acl_key_matches(acl_options_t* acl, struct query* q); int acl_addr_match_mask(uint32_t* a, uint32_t* b, uint32_t* mask, size_t sz); int acl_addr_match_range(uint32_t* minval, uint32_t* x, uint32_t* maxval, size_t sz); /* returns true if acls are both from the same host */ int acl_same_host(acl_options_t* a, acl_options_t* b); /* find acl by number in the list */ acl_options_t* acl_find_num(acl_options_t* acl, int num); /* see if a zone is a slave or a master zone */ int zone_is_slave(zone_options_t* opt); /* parsing helpers */ void c_error(const char* msg); void c_error_msg(const char* fmt, ...) ATTR_FORMAT(printf, 1, 2); acl_options_t* parse_acl_info(region_type* region, char* ip, const char* key); /* true if ipv6 address, false if ipv4 */ int parse_acl_is_ipv6(const char* p); /* returns range type. mask is the 2nd part of the range */ int parse_acl_range_type(char* ip, char** mask); /* parses subnet mask, fills 0 mask as well */ void parse_acl_range_subnet(char* p, void* addr, int maxbits); /* clean up options */ void nsd_options_destroy(nsd_options_t* opt); #endif /* OPTIONS_H */ nsd-3.2.16/rbtree.h0000664000175000017500000000457311654212464013025 0ustar matjematje/* * rbtree.h -- generic red-black tree * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _RBTREE_H_ #define _RBTREE_H_ #include "region-allocator.h" /* * This structure must be the first member of the data structure in * the rbtree. This allows easy casting between an rbnode_t and the * user data (poor man's inheritance). */ typedef struct rbnode_t rbnode_t; struct rbnode_t { rbnode_t *parent; rbnode_t *left; rbnode_t *right; const void *key; uint8_t color; }; #define RBTREE_NULL &rbtree_null_node extern rbnode_t rbtree_null_node; typedef struct rbtree_t rbtree_t; struct rbtree_t { region_type *region; /* The root of the red-black tree */ rbnode_t *root; /* The number of the nodes in the tree */ size_t count; /* Current node for walks... */ rbnode_t *_node; /* Key compare function. <0,0,>0 like strcmp. Return 0 on two NULL ptrs. */ int (*cmp) (const void *, const void *); }; /* rbtree.c */ rbtree_t *rbtree_create(region_type *region, int (*cmpf)(const void *, const void *)); rbnode_t *rbtree_insert(rbtree_t *rbtree, rbnode_t *data); /* returns node that is now unlinked from the tree. User to delete it. * returns 0 if node not present */ rbnode_t *rbtree_delete(rbtree_t *rbtree, const void *key); rbnode_t *rbtree_search(rbtree_t *rbtree, const void *key); /* returns true if exact match in result. Else result points to <= element, or NULL if key is smaller than the smallest key. */ int rbtree_find_less_equal(rbtree_t *rbtree, const void *key, rbnode_t **result); rbnode_t *rbtree_first(rbtree_t *rbtree); rbnode_t *rbtree_last(rbtree_t *rbtree); rbnode_t *rbtree_next(rbnode_t *rbtree); rbnode_t *rbtree_previous(rbnode_t *rbtree); rbnode_t *rbtree_postorder_first(rbnode_t *root); rbnode_t *rbtree_postorder_next(rbnode_t *node); #define RBTREE_WALK(rbtree, k, d) \ for((rbtree)->_node = rbtree_first(rbtree);\ (rbtree)->_node != RBTREE_NULL && ((k) = (rbtree)->_node->key) && \ ((d) = (void *) (rbtree)->_node); (rbtree)->_node = rbtree_next((rbtree)->_node)) /* call with node=variable of struct* with rbnode_t as first element. with type is the type of a pointer to that struct. */ #define RBTREE_FOR(node, type, rbtree) \ for(node=(type)rbtree_first(rbtree); \ (rbnode_t*)node != RBTREE_NULL; \ node = (type)rbtree_next((rbnode_t*)node)) #endif /* _RBTREE_H_ */ nsd-3.2.16/rrl.c0000664000175000017500000003402212166740567012335 0ustar matjematje /* rrl.c - Response Rate Limiting for NSD. * By W.C.A. Wijngaards * Copyright 2012, NLnet Labs. * BSD, see LICENSE. */ #include "config.h" #include #include #include "dns.h" #include "rrl.h" #include "util.h" #include "lookup3.h" #include "options.h" #ifdef RATELIMIT #ifdef HAVE_MMAP #include #if defined(MAP_ANON) && !defined(MAP_ANONYMOUS) #define MAP_ANONYMOUS MAP_ANON #endif #endif /* HAVE_MMAP */ /** * The rate limiting data structure bucket, this represents one rate of * packets from a single source. * Smoothed average rates. */ struct rrl_bucket { /* the source netmask */ uint64_t source; /* rate, in queries per second, which due to rate=r(t)+r(t-1)/2 is * equal to double the queries per second */ uint32_t rate; /* the full hash */ uint32_t hash; /* counter for queries arrived in this second */ uint32_t counter; /* timestamp, which time is the time of the counter, the rate is from * one timestep before that. */ int32_t stamp; /* flags for the source mask and type */ uint16_t flags; }; /* the (global) array of RRL buckets */ static struct rrl_bucket* rrl_array = NULL; static size_t rrl_array_size = RRL_BUCKETS; static uint32_t rrl_ratelimit = RRL_LIMIT; /* 2x qps */ static uint8_t rrl_slip_ratio = RRL_SLIP; static uint8_t rrl_ipv4_prefixlen = RRL_IPV4_PREFIX_LENGTH; static uint8_t rrl_ipv6_prefixlen = RRL_IPV6_PREFIX_LENGTH; static uint64_t rrl_ipv6_mask; /* max prefixlen 64 */ static uint32_t rrl_whitelist_ratelimit = RRL_WLIST_LIMIT; /* 2x qps */ /* the array of mmaps for the children (saved between reloads) */ static void** rrl_maps = NULL; static size_t rrl_maps_num = 0; /* from NSD4 for RRL logs */ static char* wiredname2str(const uint8_t* dname) { static char buf[MAXDOMAINLEN*5+3]; char* p = buf; uint8_t lablen; if(*dname == 0) { strlcpy(buf, ".", sizeof(buf)); return buf; } lablen = *dname++; while(lablen) { while(lablen--) { uint8_t ch = *dname++; if (isalnum(ch) || ch == '-' || ch == '_') { *p++ = ch; } else if (ch == '.' || ch == '\\') { *p++ = '\\'; *p++ = ch; } else { snprintf(p, 5, "\\%03u", (unsigned int)ch); p += 4; } } lablen = *dname++; *p++ = '.'; } *p++ = 0; return buf; } void rrl_mmap_init(int numch, size_t numbuck, size_t lm, size_t wlm, size_t sm, size_t plf, size_t pls) { #ifdef HAVE_MMAP size_t i; #endif if(numbuck != 0) rrl_array_size = numbuck; rrl_ratelimit = lm*2; rrl_slip_ratio = sm; rrl_ipv4_prefixlen = plf; rrl_ipv6_prefixlen = pls; if (pls <= 32) { rrl_ipv6_mask = ((uint64_t) htonl(0xffffffff << (32-pls))) << 32; } else { rrl_ipv6_mask = ((uint64_t) htonl(0xffffffff << (64-pls))) | (((uint64_t)0xffffffff)<<32); } rrl_whitelist_ratelimit = wlm*2; #ifdef HAVE_MMAP /* allocate the ratelimit hashtable in a memory map so it is * preserved across reforks (every child its own table) */ rrl_maps_num = (size_t)numch; rrl_maps = (void**)xalloc(sizeof(void*)*rrl_maps_num); for(i=0; i= rrl_maps_num) rrl_array = xalloc_zero(sizeof(struct rrl_bucket)*rrl_array_size); #ifdef HAVE_MMAP else rrl_array = (struct rrl_bucket*)rrl_maps[ch]; #endif } /** return the source netblock of the query, this is the genuine source * for genuine queries and the target for reflected packets */ static uint64_t rrl_get_source(query_type* query, uint16_t* c2) { /* note there is an IPv6 subnet, that maps * to the same buckets as IPv4 space, but there is a flag in c2 * that makes the hash different */ #ifdef INET6 if( ((struct sockaddr_in*)&query->addr)->sin_family == AF_INET) { *c2 = 0; return ((struct sockaddr_in*)&query->addr)-> sin_addr.s_addr & htonl(0xffffffff << (32-rrl_ipv4_prefixlen)); } else { uint64_t s; *c2 = rrl_ip6; memmove(&s, &((struct sockaddr_in6*)&query->addr)->sin6_addr, sizeof(s)); return s & rrl_ipv6_mask; } #else *c2 = 0; return query->addr.sin_addr.s_addr & htonl(0xffffffff << (32-rrl_ipv4_prefixlen)); #endif } /** debug source to string */ static const char* rrlsource2str(uint64_t s, uint16_t c2) { static char buf[64]; struct in_addr a4; #ifdef INET6 if(c2) { /* IPv6 */ struct in6_addr a6; memset(&a6, 0, sizeof(a6)); memmove(&a6, &s, sizeof(s)); if(!inet_ntop(AF_INET6, &a6, buf, sizeof(buf))) strlcpy(buf, "[ip6 ntop failed]", sizeof(buf)); else { static char prefix[4]; snprintf(prefix, sizeof(prefix), "/%d", rrl_ipv6_prefixlen); strlcat(buf, &prefix[0], sizeof(buf)); } return buf; } #endif /* ipv4 */ a4.s_addr = (uint32_t)s; if(!inet_ntop(AF_INET, &a4, buf, sizeof(buf))) strlcpy(buf, "[ip4 ntop failed]", sizeof(buf)); else { static char prefix[4]; snprintf(prefix, sizeof(prefix), "/%d", rrl_ipv4_prefixlen); strlcat(buf, &prefix[0], sizeof(buf)); } return buf; } enum rrl_type rrlstr2type(const char* s) { if(strcmp(s, "nxdomain")==0) return rrl_type_nxdomain; else if(strcmp(s, "error")==0) return rrl_type_error; else if(strcmp(s, "referral")==0) return rrl_type_referral; else if(strcmp(s, "any")==0) return rrl_type_any; else if(strcmp(s, "wildcard")==0) return rrl_type_wildcard; else if(strcmp(s, "nodata")==0) return rrl_type_nodata; else if(strcmp(s, "dnskey")==0) return rrl_type_dnskey; else if(strcmp(s, "positive")==0) return rrl_type_positive; else if(strcmp(s, "rrsig")==0) return rrl_type_rrsig; else if(strcmp(s, "all")==0) return rrl_type_all; return 0; /* unknown */ } const char* rrltype2str(enum rrl_type c) { switch(c & 0x0fff) { case rrl_type_nxdomain: return "nxdomain"; case rrl_type_error: return "error"; case rrl_type_referral: return "referral"; case rrl_type_any: return "any"; case rrl_type_wildcard: return "wildcard"; case rrl_type_nodata: return "nodata"; case rrl_type_dnskey: return "dnskey"; case rrl_type_positive: return "positive"; case rrl_type_rrsig: return "rrsig"; case rrl_type_all: return "all"; } return "unknown"; } /** classify the query in a number of different types, each has separate * ratelimiting, so that positive queries are not impeded by others */ static uint16_t rrl_classify(query_type* query, const uint8_t** d, size_t* d_len) { if(RCODE(query->packet) == RCODE_NXDOMAIN) { if(query->zone && query->zone->apex) { *d = dname_name(domain_dname(query->zone->apex)); *d_len = domain_dname(query->zone->apex)->name_size; } return rrl_type_nxdomain; } if(RCODE(query->packet) != RCODE_OK) { if(query->zone && query->zone->apex) { *d = dname_name(domain_dname(query->zone->apex)); *d_len = domain_dname(query->zone->apex)->name_size; } return rrl_type_error; } if(query->delegation_domain) { *d = dname_name(domain_dname(query->delegation_domain)); *d_len = domain_dname(query->delegation_domain)->name_size; return rrl_type_referral; } if(query->qtype == TYPE_ANY) { if(query->qname) { *d = dname_name(query->qname); *d_len = query->qname->name_size; } return rrl_type_any; } if(query->qtype == TYPE_RRSIG) { if(query->qname) { *d = dname_name(query->qname); *d_len = query->qname->name_size; } return rrl_type_rrsig; } if(query->wildcard_domain) { *d = dname_name(domain_dname(query->wildcard_domain)); *d_len = domain_dname(query->wildcard_domain)->name_size; return rrl_type_wildcard; } if(ANCOUNT(query->packet) == 0) { if(query->zone && query->zone->apex) { *d = dname_name(domain_dname(query->zone->apex)); *d_len = domain_dname(query->zone->apex)->name_size; } return rrl_type_nodata; } if(query->qtype == TYPE_DNSKEY) { if(query->qname) { *d = dname_name(query->qname); *d_len = query->qname->name_size; } return rrl_type_dnskey; } /* positive */ if(query->qname) { *d = dname_name(query->qname); *d_len = query->qname->name_size; } return rrl_type_positive; } /** Examine the query and return hash and source of netblock. */ static void examine_query(query_type* query, uint32_t* hash, uint64_t* source, uint16_t* flags, uint32_t* lm) { /* compile a binary string representing the query */ uint16_t c, c2; /* size with 16 bytes to spare */ uint8_t buf[MAXDOMAINLEN + sizeof(*source) + sizeof(c) + 16]; const uint8_t* dname = NULL; size_t dname_len; uint32_t r = 0x267fcd16; *source = rrl_get_source(query, &c2); c = rrl_classify(query, &dname, &dname_len); if(query->zone && query->zone->opts && (query->zone->opts->rrl_whitelist & c)) *lm = rrl_whitelist_ratelimit; if(*lm == 0) return; c |= c2; *flags = c; memmove(buf, source, sizeof(*source)); memmove(buf+sizeof(*source), &c, sizeof(c)); DEBUG(DEBUG_QUERY, 1, (LOG_INFO, "rrl_examine type %s name %s", rrltype2str(c), dname?wiredname2str(dname):"NULL")); /* and hash it */ if(dname && dname_len <= MAXDOMAINLEN) { memmove(buf+sizeof(*source)+sizeof(c), dname, dname_len); *hash = hashlittle(buf, sizeof(*source)+sizeof(c)+dname_len, r); } else *hash = hashlittle(buf, sizeof(*source)+sizeof(c), r); } /* age the bucket because elapsed time steps have gone by */ static void rrl_attenuate_bucket(struct rrl_bucket* b, int32_t elapsed) { if(elapsed > 16) { b->rate = 0; } else { /* divide rate /2 for every elapsed time step, because * the counters in the inbetween steps were 0 */ /* r(t) = 0 + 0/2 + 0/4 + .. + oldrate/2^dt */ b->rate >>= elapsed; /* we know that elapsed >= 2 */ b->rate += (b->counter>>(elapsed-1)); } } /** log a message about ratelimits */ static void rrl_msg(query_type* query, const char* str) { uint16_t c, c2, wl = 0; const uint8_t* d = NULL; size_t d_len; uint64_t s; char address[128]; if(verbosity < 2) return; if (addr2ip(query->addr, address, sizeof(address))) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "addr2ip failed")); strlcpy(address, "[unknown]", sizeof(address)); } s = rrl_get_source(query, &c2); c = rrl_classify(query, &d, &d_len) | c2; if(query->zone && query->zone->opts && (query->zone->opts->rrl_whitelist & c)) wl = 1; log_msg(LOG_INFO, "ratelimit %s %s type %s%s target %s query %s %s", str, d?wiredname2str(d):"", rrltype2str(c), wl?"(whitelisted)":"", rrlsource2str(s, c2), address, rrtype_to_string(query->qtype)); } /** true if the query used to be blocked by the ratelimit */ static int used_to_block(uint32_t rate, uint32_t counter, uint32_t lm) { return rate >= lm || counter+rate/2 >= lm; } /** update the rate in a ratelimit bucket, return actual rate */ uint32_t rrl_update(query_type* query, uint32_t hash, uint64_t source, uint16_t flags, int32_t now, uint32_t lm) { struct rrl_bucket* b = &rrl_array[hash % rrl_array_size]; DEBUG(DEBUG_QUERY, 1, (LOG_INFO, "source %llx hash %x oldrate %d oldcount %d stamp %d", (long long unsigned)source, hash, b->rate, b->counter, b->stamp)); /* check if different source */ if(b->source != source || b->flags != flags || b->hash != hash) { /* initialise */ /* potentially the wrong limit here, used lower nonwhitelim */ if(verbosity >=2 && used_to_block(b->rate, b->counter, rrl_ratelimit)) { char address[128]; if (addr2ip(query->addr, address, sizeof(address))) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "addr2ip failed")); strlcpy(address, "[unknown]", sizeof(address)); } log_msg(LOG_INFO, "ratelimit unblock ~ type %s target %s query %s %s (%s collision)", rrltype2str(b->flags), rrlsource2str(b->source, b->flags), address, rrtype_to_string(query->qtype), (b->hash!=hash?"bucket":"hash")); } b->hash = hash; b->source = source; b->flags = flags; b->counter = 1; b->rate = 0; b->stamp = now; return 1; } /* this is the same source */ /* check if old, zero or smooth it */ /* circular arith for time */ if(now - b->stamp == 1) { /* very busy bucket and time just stepped one step */ int oldblock = used_to_block(b->rate, b->counter, lm); b->rate = b->rate/2 + b->counter; if(oldblock && b->rate < lm) rrl_msg(query, "unblock"); b->counter = 1; b->stamp = now; } else if(now - b->stamp > 0) { /* older bucket */ int olderblock = used_to_block(b->rate, b->counter, lm); rrl_attenuate_bucket(b, now - b->stamp); if(olderblock && b->rate < lm) rrl_msg(query, "unblock"); b->counter = 1; b->stamp = now; } else if(now != b->stamp) { /* robust, timestamp from the future */ if(used_to_block(b->rate, b->counter, lm)) rrl_msg(query, "unblock"); b->rate = 0; b->counter = 1; b->stamp = now; } else { /* bucket is from the current timestep, update counter */ b->counter ++; /* log what is blocked for operational debugging */ if(b->counter + b->rate/2 == lm && b->rate < lm) rrl_msg(query, "block"); } /* return max from current rate and projected next-value for rate */ /* so that if the rate increases suddenly very high, it is * stopped halfway into the time step */ if(b->counter > b->rate/2) return b->counter + b->rate/2; return b->rate; } int rrl_process_query(query_type* query) { uint64_t source; uint32_t hash; int32_t now = (int32_t)time(NULL); uint32_t lm = rrl_ratelimit; uint16_t flags; if(rrl_ratelimit == 0 && rrl_whitelist_ratelimit == 0) return 0; /* examine query */ examine_query(query, &hash, &source, &flags, &lm); if(lm == 0) return 0; /* no limit for this */ /* update rate */ return (rrl_update(query, hash, source, flags, now, lm) >= lm); } query_state_type rrl_slip(query_type* query) { /* discard number of packets, randomly */ if((rrl_slip_ratio > 0) && ((rrl_slip_ratio == 1) || ((random() % rrl_slip_ratio) == 0))) { /* set TC on the rest */ TC_SET(query->packet); ANCOUNT_SET(query->packet, 0); NSCOUNT_SET(query->packet, 0); ARCOUNT_SET(query->packet, 0); if(query->qname) /* header, type, class, qname */ buffer_set_position(query->packet, QHEADERSZ+4+query->qname->name_size); else buffer_set_position(query->packet, QHEADERSZ); return QUERY_PROCESSED; } return QUERY_DISCARDED; } #endif /* RATELIMIT */ nsd-3.2.16/axfr.c0000664000175000017500000001247112046760532012471 0ustar matjematje/* * axfr.c -- generating AXFR responses. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include "axfr.h" #include "dns.h" #include "packet.h" #include "options.h" #define AXFR_TSIG_SIGN_EVERY_NTH 96 /* tsig sign every N packets. */ query_state_type query_axfr(struct nsd *nsd, struct query *query) { domain_type *closest_match; domain_type *closest_encloser; int exact; int added; uint16_t total_added = 0; if (query->axfr_is_done) return QUERY_PROCESSED; if (query->maxlen > AXFR_MAX_MESSAGE_LEN) query->maxlen = AXFR_MAX_MESSAGE_LEN; assert(!query_overflow(query)); /* only keep running values for most packets */ query->tsig_prepare_it = 0; query->tsig_update_it = 1; if(query->tsig_sign_it) { /* prepare for next updates */ query->tsig_prepare_it = 1; query->tsig_sign_it = 0; } if (query->axfr_zone == NULL) { /* Start AXFR. */ exact = namedb_lookup(nsd->db, query->qname, &closest_match, &closest_encloser); query->domain = closest_encloser; query->axfr_zone = domain_find_zone(closest_encloser); if (!exact || query->axfr_zone == NULL || query->axfr_zone->apex != query->domain) { /* No SOA no transfer */ RCODE_SET(query->packet, RCODE_NOTAUTH); return QUERY_PROCESSED; } query->axfr_current_domain = query->domain; query->axfr_current_rrset = NULL; query->axfr_current_rr = 0; if(query->tsig.status == TSIG_OK) { query->tsig_sign_it = 1; /* sign first packet in stream */ } query_add_compression_domain(query, query->domain, QHEADERSZ); assert(query->axfr_zone->soa_rrset->rr_count == 1); added = packet_encode_rr(query, query->axfr_zone->apex, &query->axfr_zone->soa_rrset->rrs[0]); if (!added) { /* XXX: This should never happen... generate error code? */ abort(); } ++total_added; } else { /* * Query name and EDNS need not be repeated after the * first response packet. */ query->edns.status = EDNS_NOT_PRESENT; buffer_set_limit(query->packet, QHEADERSZ); QDCOUNT_SET(query->packet, 0); query_prepare_response(query); } /* Add zone RRs until answer is full. */ assert(query->axfr_current_domain); do { if (!query->axfr_current_rrset) { query->axfr_current_rrset = domain_find_any_rrset( query->axfr_current_domain, query->axfr_zone); query->axfr_current_rr = 0; } while (query->axfr_current_rrset) { if (query->axfr_current_rrset != query->axfr_zone->soa_rrset && query->axfr_current_rrset->zone == query->axfr_zone) { while (query->axfr_current_rr < query->axfr_current_rrset->rr_count) { added = packet_encode_rr( query, query->axfr_current_domain, &query->axfr_current_rrset->rrs[query->axfr_current_rr]); if (!added) goto return_answer; ++total_added; ++query->axfr_current_rr; } } query->axfr_current_rrset = query->axfr_current_rrset->next; query->axfr_current_rr = 0; } assert(query->axfr_current_domain); query->axfr_current_domain = (domain_type *) rbtree_next((rbnode_t *) query->axfr_current_domain); } while ((rbnode_t *) query->axfr_current_domain != RBTREE_NULL && dname_is_subdomain( domain_dname(query->axfr_current_domain), domain_dname(query->axfr_zone->apex))); /* Add terminating SOA RR. */ assert(query->axfr_zone->soa_rrset->rr_count == 1); added = packet_encode_rr(query, query->axfr_zone->apex, &query->axfr_zone->soa_rrset->rrs[0]); if (added) { ++total_added; query->tsig_sign_it = 1; /* sign last packet */ query->axfr_is_done = 1; } return_answer: AA_SET(query->packet); ANCOUNT_SET(query->packet, total_added); NSCOUNT_SET(query->packet, 0); ARCOUNT_SET(query->packet, 0); /* check if it needs tsig signatures */ if(query->tsig.status == TSIG_OK) { if(query->tsig.updates_since_last_prepare >= AXFR_TSIG_SIGN_EVERY_NTH) { query->tsig_sign_it = 1; } } query_clear_compression_tables(query); return QUERY_IN_AXFR; } /* * Answer if this is an AXFR or IXFR query. */ query_state_type answer_axfr_ixfr(struct nsd *nsd, struct query *q) { acl_options_t *acl = NULL; /* Is it AXFR? */ switch (q->qtype) { case TYPE_AXFR: if (q->tcp) { zone_options_t* zone_opt = zone_options_find(nsd->options, q->qname); if(!zone_opt || acl_check_incoming(zone_opt->provide_xfr, q, &acl)==-1) { if (verbosity > 0) { char address[128]; if (addr2ip(q->addr, address, sizeof(address))) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "addr2ip failed")); strlcpy(address, "[unknown]", sizeof(address)); } VERBOSITY(1, (LOG_INFO, "axfr for zone %s from client %s refused, %s", dname_to_string(q->qname, NULL), address, acl?"blocked":"no acl matches")); } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "axfr refused, %s", acl?"blocked":"no acl matches")); if (!zone_opt) { RCODE_SET(q->packet, RCODE_NOTAUTH); } else { RCODE_SET(q->packet, RCODE_REFUSE); } return QUERY_PROCESSED; } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "axfr admitted acl %s %s", acl->ip_address_spec, acl->key_name?acl->key_name:"NOKEY")); return query_axfr(nsd, q); } /** Fallthrough: AXFR over UDP queries are discarded. */ case TYPE_IXFR: RCODE_SET(q->packet, RCODE_IMPL); return QUERY_PROCESSED; default: return QUERY_DISCARDED; } } nsd-3.2.16/server.c0000664000175000017500000016562112167000652013037 0ustar matjematje/* * server.c -- nsd(8) network input/output * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #ifndef SHUT_WR #define SHUT_WR 1 #endif #include #include "axfr.h" #include "namedb.h" #include "netio.h" #include "xfrd.h" #include "xfrd-tcp.h" #include "difffile.h" #include "nsec3.h" #include "ipc.h" #include "lookup3.h" #include "rrl.h" /* * Data for the UDP handlers. */ struct udp_handler_data { struct nsd *nsd; struct nsd_socket *socket; query_type *query; }; /* * Data for the TCP accept handlers. Most data is simply passed along * to the TCP connection handler. */ struct tcp_accept_handler_data { struct nsd *nsd; struct nsd_socket *socket; size_t tcp_accept_handler_count; netio_handler_type *tcp_accept_handlers; }; int slowaccept; struct timespec slowaccept_timeout; /* * Data for the TCP connection handlers. * * The TCP handlers use non-blocking I/O. This is necessary to avoid * blocking the entire server on a slow TCP connection, but does make * reading from and writing to the socket more complicated. * * Basically, whenever a read/write would block (indicated by the * EAGAIN errno variable) we remember the position we were reading * from/writing to and return from the TCP reading/writing event * handler. When the socket becomes readable/writable again we * continue from the same position. */ struct tcp_handler_data { /* * The region used to allocate all TCP connection related * data, including this structure. This region is destroyed * when the connection is closed. */ region_type* region; /* * The global nsd structure. */ struct nsd* nsd; /* * The current query data for this TCP connection. */ query_type* query; /* * These fields are used to enable the TCP accept handlers * when the number of TCP connection drops below the maximum * number of TCP connections. */ size_t tcp_accept_handler_count; netio_handler_type *tcp_accept_handlers; /* * The query_state is used to remember if we are performing an * AXFR, if we're done processing, or if we should discard the * query and connection. */ query_state_type query_state; /* * The bytes_transmitted field is used to remember the number * of bytes transmitted when receiving or sending a DNS * packet. The count includes the two additional bytes used * to specify the packet length on a TCP connection. */ size_t bytes_transmitted; /* * The number of queries handled by this specific TCP connection. */ int query_count; }; /* * Handle incoming queries on the UDP server sockets. */ static void handle_udp(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); /* * Handle incoming connections on the TCP sockets. These handlers * usually wait for the NETIO_EVENT_READ event (indicating an incoming * connection) but are disabled when the number of current TCP * connections is equal to the maximum number of TCP connections. * Disabling is done by changing the handler to wait for the * NETIO_EVENT_NONE type. This is done using the function * configure_tcp_accept_handlers. */ static void handle_tcp_accept(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); /* * Handle incoming queries on a TCP connection. The TCP connections * are configured to be non-blocking and the handler may be called * multiple times before a complete query is received. */ static void handle_tcp_reading(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); /* * Handle outgoing responses on a TCP connection. The TCP connections * are configured to be non-blocking and the handler may be called * multiple times before a complete response is sent. */ static void handle_tcp_writing(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); /* * Send all children the quit nonblocking, then close pipe. */ static void send_children_quit(struct nsd* nsd); /* same, for shutdown time, waits for child to exit to avoid restart issues */ static void send_children_quit_and_wait(struct nsd* nsd); /* set childrens flags to send NSD_STATS to them */ #ifdef BIND8_STATS static void set_children_stats(struct nsd* nsd); #endif /* BIND8_STATS */ /* * Change the event types the HANDLERS are interested in to * EVENT_TYPES. */ static void configure_handler_event_types(size_t count, netio_handler_type *handlers, netio_event_types_type event_types); /* * start xfrdaemon (again). */ static pid_t server_start_xfrd(struct nsd *nsd, netio_handler_type* handler); static uint16_t *compressed_dname_offsets = 0; static uint32_t compression_table_capacity = 0; static uint32_t compression_table_size = 0; /* * Remove the specified pid from the list of child pids. Returns -1 if * the pid is not in the list, child_num otherwise. The field is set to 0. */ static int delete_child_pid(struct nsd *nsd, pid_t pid) { size_t i; for (i = 0; i < nsd->child_count; ++i) { if (nsd->children[i].pid == pid) { nsd->children[i].pid = 0; if(!nsd->children[i].need_to_exit) { if(nsd->children[i].child_fd != -1) close(nsd->children[i].child_fd); nsd->children[i].child_fd = -1; if(nsd->children[i].handler) nsd->children[i].handler->fd = -1; } return i; } } return -1; } /* * Restart child servers if necessary. */ static int restart_child_servers(struct nsd *nsd, region_type* region, netio_type* netio, int* xfrd_sock_p) { struct main_ipc_handler_data *ipc_data; size_t i; int sv[2]; /* Fork the child processes... */ for (i = 0; i < nsd->child_count; ++i) { if (nsd->children[i].pid <= 0) { if (nsd->children[i].child_fd != -1) close(nsd->children[i].child_fd); if (socketpair(AF_UNIX, SOCK_STREAM, 0, sv) == -1) { log_msg(LOG_ERR, "socketpair: %s", strerror(errno)); return -1; } nsd->children[i].child_fd = sv[0]; nsd->children[i].parent_fd = sv[1]; nsd->children[i].pid = fork(); switch (nsd->children[i].pid) { default: /* SERVER MAIN */ close(nsd->children[i].parent_fd); nsd->children[i].parent_fd = -1; if(!nsd->children[i].handler) { ipc_data = (struct main_ipc_handler_data*) region_alloc( region, sizeof(struct main_ipc_handler_data)); ipc_data->nsd = nsd; ipc_data->child = &nsd->children[i]; ipc_data->child_num = i; ipc_data->xfrd_sock = xfrd_sock_p; ipc_data->packet = buffer_create(region, QIOBUFSZ); ipc_data->forward_mode = 0; ipc_data->got_bytes = 0; ipc_data->total_bytes = 0; ipc_data->acl_num = 0; ipc_data->busy_writing_zone_state = 0; ipc_data->write_conn = xfrd_tcp_create(region); nsd->children[i].handler = (struct netio_handler*) region_alloc( region, sizeof(struct netio_handler)); nsd->children[i].handler->fd = nsd->children[i].child_fd; nsd->children[i].handler->timeout = NULL; nsd->children[i].handler->user_data = ipc_data; nsd->children[i].handler->event_types = NETIO_EVENT_READ; nsd->children[i].handler->event_handler = parent_handle_child_command; netio_add_handler(netio, nsd->children[i].handler); } /* clear any ongoing ipc */ ipc_data = (struct main_ipc_handler_data*) nsd->children[i].handler->user_data; ipc_data->forward_mode = 0; ipc_data->busy_writing_zone_state = 0; /* restart - update fd */ nsd->children[i].handler->fd = nsd->children[i].child_fd; break; case 0: /* CHILD */ nsd->pid = 0; nsd->child_count = 0; nsd->server_kind = nsd->children[i].kind; nsd->this_child = &nsd->children[i]; /* remove signal flags inherited from parent the parent will handle them. */ nsd->signal_hint_reload = 0; nsd->signal_hint_child = 0; nsd->signal_hint_quit = 0; nsd->signal_hint_shutdown = 0; nsd->signal_hint_stats = 0; nsd->signal_hint_statsusr = 0; close(nsd->this_child->child_fd); nsd->this_child->child_fd = -1; server_child(nsd); /* NOTREACH */ exit(0); case -1: log_msg(LOG_ERR, "fork failed: %s", strerror(errno)); return -1; } } } return 0; } #ifdef BIND8_STATS static void set_bind8_alarm(struct nsd* nsd) { /* resync so that the next alarm is on the next whole minute */ if(nsd->st.period > 0) /* % by 0 gives divbyzero error */ alarm(nsd->st.period - (time(NULL) % nsd->st.period)); } #endif static void cleanup_dname_compression_tables(void *ptr) { free(ptr); compressed_dname_offsets = NULL; compression_table_capacity = 0; } static void initialize_dname_compression_tables(struct nsd *nsd) { size_t needed = domain_table_count(nsd->db->domains) + 1; needed += EXTRA_DOMAIN_NUMBERS; if(compression_table_capacity < needed) { if(compressed_dname_offsets) { region_remove_cleanup(nsd->db->region, cleanup_dname_compression_tables, compressed_dname_offsets); free(compressed_dname_offsets); } compressed_dname_offsets = (uint16_t *) xalloc( needed * sizeof(uint16_t)); region_add_cleanup(nsd->db->region, cleanup_dname_compression_tables, compressed_dname_offsets); compression_table_capacity = needed; compression_table_size=domain_table_count(nsd->db->domains)+1; } memset(compressed_dname_offsets, 0, needed * sizeof(uint16_t)); compressed_dname_offsets[0] = QHEADERSZ; /* The original query name */ } /* * Initialize the server, create and bind the sockets. * */ int server_init(struct nsd *nsd) { size_t i; #if defined(SO_REUSEADDR) || (defined(INET6) && (defined(IPV6_V6ONLY) || defined(IPV6_USE_MIN_MTU) || defined(IPV6_MTU) || defined(IP_TRANSPARENT))) int on = 1; #endif /* UDP */ /* Make a socket... */ for (i = 0; i < nsd->ifs; i++) { if (!nsd->udp[i].addr) { nsd->udp[i].s = -1; continue; } if ((nsd->udp[i].s = socket(nsd->udp[i].addr->ai_family, nsd->udp[i].addr->ai_socktype, 0)) == -1) { #if defined(INET6) if (nsd->udp[i].addr->ai_family == AF_INET6 && errno == EAFNOSUPPORT && nsd->grab_ip6_optional) { log_msg(LOG_WARNING, "fallback to UDP4, no IPv6: not supported"); continue; } #endif /* INET6 */ log_msg(LOG_ERR, "can't create a socket: %s", strerror(errno)); return -1; } #if defined(INET6) if (nsd->udp[i].addr->ai_family == AF_INET6) { # if defined(IPV6_V6ONLY) if (setsockopt(nsd->udp[i].s, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)) < 0) { log_msg(LOG_ERR, "setsockopt(..., IPV6_V6ONLY, ...) failed: %s", strerror(errno)); return -1; } # endif # if defined(IPV6_USE_MIN_MTU) /* * There is no fragmentation of IPv6 datagrams * during forwarding in the network. Therefore * we do not send UDP datagrams larger than * the minimum IPv6 MTU of 1280 octets. The * EDNS0 message length can be larger if the * network stack supports IPV6_USE_MIN_MTU. */ if (setsockopt(nsd->udp[i].s, IPPROTO_IPV6, IPV6_USE_MIN_MTU, &on, sizeof(on)) < 0) { log_msg(LOG_ERR, "setsockopt(..., IPV6_USE_MIN_MTU, ...) failed: %s", strerror(errno)); return -1; } # elif defined(IPV6_MTU) /* * On Linux, PMTUD is disabled by default for datagrams * so set the MTU equal to the MIN MTU to get the same. */ on = IPV6_MIN_MTU; if (setsockopt(nsd->udp[i].s, IPPROTO_IPV6, IPV6_MTU, &on, sizeof(on)) < 0) { log_msg(LOG_ERR, "setsockopt(..., IPV6_MTU, ...) failed: %s", strerror(errno)); return -1; } on = 1; # endif } #endif #if defined(AF_INET) if (nsd->udp[i].addr->ai_family == AF_INET) { # if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT) int action = IP_PMTUDISC_DONT; if (setsockopt(nsd->udp[i].s, IPPROTO_IP, IP_MTU_DISCOVER, &action, sizeof(action)) < 0) { log_msg(LOG_ERR, "setsockopt(..., IP_MTU_DISCOVER, IP_PMTUDISC_DONT...) failed: %s", strerror(errno)); return -1; } # elif defined(IP_DONTFRAG) int off = 0; if (setsockopt(nsd->udp[i].s, IPPROTO_IP, IP_DONTFRAG, &off, sizeof(off)) < 0) { log_msg(LOG_ERR, "setsockopt(..., IP_DONTFRAG, ...) failed: %s", strerror(errno)); return -1; } # endif } #endif /* set it nonblocking */ /* otherwise, on OSes with thundering herd problems, the UDP recv could block NSD after select returns readable. */ if (fcntl(nsd->udp[i].s, F_SETFL, O_NONBLOCK) == -1) { log_msg(LOG_ERR, "cannot fcntl udp: %s", strerror(errno)); } /* Bind it... */ if (nsd->options->ip_transparent) { #ifdef IP_TRANSPARENT if (setsockopt(nsd->udp[i].s, IPPROTO_IP, IP_TRANSPARENT, &on, sizeof(on)) < 0) { log_msg(LOG_ERR, "setsockopt(...,IP_TRANSPARENT, ...) failed for udp: %s", strerror(errno)); } #endif /* IP_TRANSPARENT */ } if (bind(nsd->udp[i].s, (struct sockaddr *) nsd->udp[i].addr->ai_addr, nsd->udp[i].addr->ai_addrlen) != 0) { log_msg(LOG_ERR, "can't bind udp socket: %s", strerror(errno)); return -1; } } /* TCP */ /* Make a socket... */ for (i = 0; i < nsd->ifs; i++) { if (!nsd->tcp[i].addr) { nsd->tcp[i].s = -1; continue; } if ((nsd->tcp[i].s = socket(nsd->tcp[i].addr->ai_family, nsd->tcp[i].addr->ai_socktype, 0)) == -1) { #if defined(INET6) if (nsd->tcp[i].addr->ai_family == AF_INET6 && errno == EAFNOSUPPORT && nsd->grab_ip6_optional) { log_msg(LOG_WARNING, "fallback to TCP4, no IPv6: not supported"); continue; } #endif /* INET6 */ log_msg(LOG_ERR, "can't create a socket: %s", strerror(errno)); return -1; } #ifdef SO_REUSEADDR if (setsockopt(nsd->tcp[i].s, SOL_SOCKET, SO_REUSEADDR, &on, sizeof(on)) < 0) { log_msg(LOG_ERR, "setsockopt(..., SO_REUSEADDR, ...) failed: %s", strerror(errno)); } #endif /* SO_REUSEADDR */ #if defined(INET6) if (nsd->tcp[i].addr->ai_family == AF_INET6) { # if defined(IPV6_V6ONLY) if (setsockopt(nsd->tcp[i].s, IPPROTO_IPV6, IPV6_V6ONLY, &on, sizeof(on)) < 0) { log_msg(LOG_ERR, "setsockopt(..., IPV6_V6ONLY, ...) failed: %s", strerror(errno)); return -1; } # endif # if defined(IPV6_USE_MIN_MTU) /* * Use minimum MTU to minimize delays learning working * PMTU when communicating through a tunnel. */ if (setsockopt(nsd->tcp[i].s, IPPROTO_IPV6, IPV6_USE_MIN_MTU, &on, sizeof(on)) < 0) { log_msg(LOG_ERR, "setsockopt(..., IPV6_USE_MIN_MTU, ...) failed: %s", strerror(errno)); return -1; } # elif defined(IPV6_MTU) /* * On Linux, PMTUD is disabled by default for datagrams * so set the MTU equal to the MIN MTU to get the same. */ on = IPV6_MIN_MTU; if (setsockopt(nsd->tcp[i].s, IPPROTO_IPV6, IPV6_MTU, &on, sizeof(on)) < 0) { log_msg(LOG_ERR, "setsockopt(..., IPV6_MTU, ...) failed: %s", strerror(errno)); return -1; } on = 1; # endif } #endif /* set it nonblocking */ /* (StevensUNP p463), if tcp listening socket is blocking, then it may block in accept, even if select() says readable. */ if (fcntl(nsd->tcp[i].s, F_SETFL, O_NONBLOCK) == -1) { log_msg(LOG_ERR, "cannot fcntl tcp: %s", strerror(errno)); } /* Bind it... */ if (nsd->options->ip_transparent) { #ifdef IP_TRANSPARENT if (setsockopt(nsd->tcp[i].s, IPPROTO_IP, IP_TRANSPARENT, &on, sizeof(on)) < 0) { log_msg(LOG_ERR, "setsockopt(...,IP_TRANSPARENT, ...) failed for tcp: %s", strerror(errno)); } #endif /* IP_TRANSPARENT */ } if (bind(nsd->tcp[i].s, (struct sockaddr *) nsd->tcp[i].addr->ai_addr, nsd->tcp[i].addr->ai_addrlen) != 0) { log_msg(LOG_ERR, "can't bind tcp socket: %s", strerror(errno)); return -1; } /* Listen to it... */ if (listen(nsd->tcp[i].s, TCP_BACKLOG) == -1) { log_msg(LOG_ERR, "can't listen: %s", strerror(errno)); return -1; } } return 0; } /* * Prepare the server for take off. * */ int server_prepare(struct nsd *nsd) { #ifdef RATELIMIT /* set secret modifier for hashing (udb ptr buckets and rate limits) */ #ifdef HAVE_ARC4RANDOM srandom(arc4random()); hash_set_raninit(arc4random()); #else uint32_t v = getpid() ^ time(NULL); srandom((unsigned long)v); if(RAND_status() && RAND_bytes((unsigned char*)&v, sizeof(v)) > 0) hash_set_raninit(v); else hash_set_raninit(random()); #endif rrl_mmap_init(nsd->child_count, nsd->options->rrl_size, nsd->options->rrl_ratelimit, nsd->options->rrl_whitelist_ratelimit, nsd->options->rrl_slip, nsd->options->rrl_ipv4_prefix_length, nsd->options->rrl_ipv6_prefix_length); #endif /* RATELIMIT */ /* Open the database... */ if ((nsd->db = namedb_open(nsd->dbfile, nsd->options, nsd->child_count)) == NULL) { log_msg(LOG_ERR, "unable to open the database %s: %s", nsd->dbfile, strerror(errno)); return -1; } /* Read diff file */ if(!diff_read_file(nsd->db, nsd->options, NULL, nsd->child_count)) { log_msg(LOG_ERR, "The diff file contains errors. Will continue " "without it"); } #ifdef NSEC3 prehash(nsd->db, 0); #endif compression_table_capacity = 0; initialize_dname_compression_tables(nsd); #ifdef BIND8_STATS /* Initialize times... */ time(&nsd->st.boot); set_bind8_alarm(nsd); #endif /* BIND8_STATS */ return 0; } /* * Fork the required number of servers. */ static int server_start_children(struct nsd *nsd, region_type* region, netio_type* netio, int* xfrd_sock_p) { size_t i; /* Start all child servers initially. */ for (i = 0; i < nsd->child_count; ++i) { nsd->children[i].pid = 0; } return restart_child_servers(nsd, region, netio, xfrd_sock_p); } void server_close_all_sockets(struct nsd_socket sockets[], size_t n) { size_t i; /* Close all the sockets... */ for (i = 0; i < n; ++i) { if (sockets[i].s != -1) { close(sockets[i].s); freeaddrinfo(sockets[i].addr); sockets[i].s = -1; } } } /* * Close the sockets, shutdown the server and exit. * Does not return. * */ void server_shutdown(struct nsd *nsd) { size_t i; server_close_all_sockets(nsd->udp, nsd->ifs); server_close_all_sockets(nsd->tcp, nsd->ifs); /* CHILD: close command channel to parent */ if(nsd->this_child && nsd->this_child->parent_fd != -1) { close(nsd->this_child->parent_fd); nsd->this_child->parent_fd = -1; } /* SERVER: close command channels to children */ if(!nsd->this_child) { for(i=0; i < nsd->child_count; ++i) if(nsd->children[i].child_fd != -1) { close(nsd->children[i].child_fd); nsd->children[i].child_fd = -1; } } log_finalize(); tsig_finalize(); nsd_options_destroy(nsd->options); region_destroy(nsd->region); exit(0); } static pid_t server_start_xfrd(struct nsd *nsd, netio_handler_type* handler) { pid_t pid; int sockets[2] = {0,0}; zone_type* zone; struct ipc_handler_conn_data *data; /* no need to send updates for zones, because xfrd will read from fork-memory */ for(zone = nsd->db->zones; zone; zone=zone->next) { zone->updated = 0; } if(handler->fd != -1) close(handler->fd); if (socketpair(AF_UNIX, SOCK_STREAM, 0, sockets) == -1) { log_msg(LOG_ERR, "startxfrd failed on socketpair: %s", strerror(errno)); return -1; } pid = fork(); switch (pid) { case -1: log_msg(LOG_ERR, "fork xfrd failed: %s", strerror(errno)); break; case 0: /* CHILD: close first socket, use second one */ close(sockets[0]); xfrd_init(sockets[1], nsd); /* ENOTREACH */ break; default: /* PARENT: close second socket, use first one */ close(sockets[1]); handler->fd = sockets[0]; break; } /* PARENT only */ handler->timeout = NULL; handler->event_types = NETIO_EVENT_READ; handler->event_handler = parent_handle_xfrd_command; /* clear ongoing ipc reads */ data = (struct ipc_handler_conn_data *) handler->user_data; data->conn->is_reading = 0; return pid; } /* pass timeout=-1 for blocking. Returns size, 0, -1(err), or -2(timeout) */ static ssize_t block_read(struct nsd* nsd, int s, void* p, ssize_t sz, int timeout) { uint8_t* buf = (uint8_t*) p; ssize_t total = 0; fd_set rfds; struct timeval tv; FD_ZERO(&rfds); while( total < sz) { ssize_t ret; FD_SET(s, &rfds); tv.tv_sec = timeout; tv.tv_usec = 0; ret = select(s+1, &rfds, NULL, NULL, timeout==-1?NULL:&tv); if(ret == -1) { if(errno == EAGAIN) /* blocking read */ continue; if(errno == EINTR) { if(nsd && (nsd->signal_hint_quit || nsd->signal_hint_shutdown)) return -1; /* other signals can be handled later */ continue; } /* some error */ return -1; } if(ret == 0) { /* operation timed out */ return -2; } ret = read(s, buf+total, sz-total); if(ret == -1) { if(errno == EAGAIN) /* blocking read */ continue; if(errno == EINTR) { if(nsd && (nsd->signal_hint_quit || nsd->signal_hint_shutdown)) return -1; /* other signals can be handled later */ continue; } /* some error */ return -1; } if(ret == 0) { /* closed connection! */ return 0; } total += ret; } return total; } /* * Reload the database, stop parent, re-fork children and continue. * as server_main. */ static void server_reload(struct nsd *nsd, region_type* server_region, netio_type* netio, int cmdsocket, int* xfrd_sock_p) { pid_t old_pid; sig_atomic_t cmd = NSD_QUIT_SYNC; zone_type* zone; int xfrd_sock = *xfrd_sock_p; int ret; if(db_crc_different(nsd->db) == 0) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "CRC the same. skipping %s.", nsd->db->filename)); } else { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "CRC different. reread of %s.", nsd->db->filename)); namedb_close(nsd->db); if ((nsd->db = namedb_open(nsd->dbfile, nsd->options, nsd->child_count)) == NULL) { log_msg(LOG_ERR, "unable to reload the database: %s", strerror(errno)); exit(1); } #if defined(NSEC3) && !defined(FULL_PREHASH) prehash(nsd->db, 0); #endif } if(!diff_read_file(nsd->db, nsd->options, NULL, nsd->child_count)) { log_msg(LOG_ERR, "unable to load the diff file: %s", nsd->options->difffile); exit(1); } log_msg(LOG_INFO, "memory recyclebin holds %lu bytes", (unsigned long) region_get_recycle_size(nsd->db->region)); #ifndef NDEBUG if(nsd_debug_level >= 1) region_log_stats(nsd->db->region); #endif /* NDEBUG */ #ifdef NSEC3 #ifdef FULL_PREHASH prehash(nsd->db, 1); #endif /* FULL_PREHASH */ #endif /* NSEC3 */ initialize_dname_compression_tables(nsd); /* Get our new process id */ old_pid = nsd->pid; nsd->pid = getpid(); #ifdef BIND8_STATS /* Restart dumping stats if required. */ time(&nsd->st.boot); set_bind8_alarm(nsd); #endif /* Start new child processes */ if (server_start_children(nsd, server_region, netio, xfrd_sock_p) != 0) { send_children_quit(nsd); /* no wait required */ exit(1); } /* if the parent has quit, we must quit too, poll the fd for cmds */ if(block_read(nsd, cmdsocket, &cmd, sizeof(cmd), 0) == sizeof(cmd)) { DEBUG(DEBUG_IPC,1, (LOG_INFO, "reload: ipc command from main %d", cmd)); if(cmd == NSD_QUIT) { DEBUG(DEBUG_IPC,1, (LOG_INFO, "reload: quit to follow nsd")); send_children_quit(nsd); /* no wait required */ exit(0); } } /* Overwrite pid before closing old parent, to avoid race condition: * - parent process already closed * - pidfile still contains old_pid * - control script contacts parent process, using contents of pidfile */ if (writepid(nsd) == -1) { log_msg(LOG_ERR, "cannot overwrite the pidfile %s: %s", nsd->pidfile, strerror(errno)); } #define RELOAD_SYNC_TIMEOUT 25 /* seconds */ /* Send quit command to parent: blocking, wait for receipt. */ do { DEBUG(DEBUG_IPC,1, (LOG_INFO, "reload: ipc send quit to main")); if (!write_socket(cmdsocket, &cmd, sizeof(cmd))) { log_msg(LOG_ERR, "problems sending command from reload %d to oldnsd %d: %s", (int)nsd->pid, (int)old_pid, strerror(errno)); } /* blocking: wait for parent to really quit. (it sends RELOAD as ack) */ DEBUG(DEBUG_IPC,1, (LOG_INFO, "reload: ipc wait for ack main")); ret = block_read(nsd, cmdsocket, &cmd, sizeof(cmd), RELOAD_SYNC_TIMEOUT); if(ret == -2) { DEBUG(DEBUG_IPC, 1, (LOG_ERR, "reload timeout QUITSYNC. retry")); } } while (ret == -2); if(ret == -1) { log_msg(LOG_ERR, "reload: could not wait for parent to quit: %s", strerror(errno)); } DEBUG(DEBUG_IPC,1, (LOG_INFO, "reload: ipc reply main %d %d", ret, (int)cmd)); if(cmd == NSD_QUIT) { /* small race condition possible here, parent got quit cmd. */ send_children_quit(nsd); unlinkpid(nsd->pidfile); exit(1); } assert(ret==-1 || ret == 0 || cmd == NSD_RELOAD); /* inform xfrd of new SOAs */ cmd = NSD_SOA_BEGIN; if(!write_socket(xfrd_sock, &cmd, sizeof(cmd))) { log_msg(LOG_ERR, "problems sending soa begin from reload %d to xfrd: %s", (int)nsd->pid, strerror(errno)); } for(zone= nsd->db->zones; zone; zone = zone->next) { uint16_t sz; const dname_type *dname_ns=0, *dname_em=0; if(zone->updated == 0) continue; DEBUG(DEBUG_IPC,1, (LOG_INFO, "nsd: sending soa info for zone %s", dname_to_string(domain_dname(zone->apex),0))); cmd = NSD_SOA_INFO; sz = dname_total_size(domain_dname(zone->apex)); if(zone->soa_rrset) { dname_ns = domain_dname( rdata_atom_domain(zone->soa_rrset->rrs[0].rdatas[0])); dname_em = domain_dname( rdata_atom_domain(zone->soa_rrset->rrs[0].rdatas[1])); sz += sizeof(uint32_t)*6 + sizeof(uint8_t)*2 + dname_ns->name_size + dname_em->name_size; } sz = htons(sz); /* use blocking writes */ if(!write_socket(xfrd_sock, &cmd, sizeof(cmd)) || !write_socket(xfrd_sock, &sz, sizeof(sz)) || !write_socket(xfrd_sock, domain_dname(zone->apex), dname_total_size(domain_dname(zone->apex)))) { log_msg(LOG_ERR, "problems sending soa info from reload %d to xfrd: %s", (int)nsd->pid, strerror(errno)); } if(zone->soa_rrset) { uint32_t ttl = htonl(zone->soa_rrset->rrs[0].ttl); assert(dname_ns && dname_em); assert(zone->soa_rrset->rr_count > 0); assert(rrset_rrtype(zone->soa_rrset) == TYPE_SOA); assert(zone->soa_rrset->rrs[0].rdata_count == 7); if(!write_socket(xfrd_sock, &ttl, sizeof(uint32_t)) || !write_socket(xfrd_sock, &dname_ns->name_size, sizeof(uint8_t)) || !write_socket(xfrd_sock, dname_name(dname_ns), dname_ns->name_size) || !write_socket(xfrd_sock, &dname_em->name_size, sizeof(uint8_t)) || !write_socket(xfrd_sock, dname_name(dname_em), dname_em->name_size) || !write_socket(xfrd_sock, rdata_atom_data( zone->soa_rrset->rrs[0].rdatas[2]), sizeof(uint32_t)) || !write_socket(xfrd_sock, rdata_atom_data( zone->soa_rrset->rrs[0].rdatas[3]), sizeof(uint32_t)) || !write_socket(xfrd_sock, rdata_atom_data( zone->soa_rrset->rrs[0].rdatas[4]), sizeof(uint32_t)) || !write_socket(xfrd_sock, rdata_atom_data( zone->soa_rrset->rrs[0].rdatas[5]), sizeof(uint32_t)) || !write_socket(xfrd_sock, rdata_atom_data( zone->soa_rrset->rrs[0].rdatas[6]), sizeof(uint32_t))) { log_msg(LOG_ERR, "problems sending soa info from reload %d to xfrd: %s", (int)nsd->pid, strerror(errno)); } } zone->updated = 0; } cmd = NSD_SOA_END; if(!write_socket(xfrd_sock, &cmd, sizeof(cmd))) { log_msg(LOG_ERR, "problems sending soa end from reload %d to xfrd: %s", (int)nsd->pid, strerror(errno)); } /* try to reopen file */ if (nsd->file_rotation_ok) log_reopen(nsd->log_filename, 1); /* exit reload, continue as new server_main */ } /* * Get the mode depending on the signal hints that have been received. * Multiple signal hints can be received and will be handled in turn. */ static sig_atomic_t server_signal_mode(struct nsd *nsd) { if(nsd->signal_hint_quit) { nsd->signal_hint_quit = 0; return NSD_QUIT; } else if(nsd->signal_hint_shutdown) { nsd->signal_hint_shutdown = 0; return NSD_SHUTDOWN; } else if(nsd->signal_hint_child) { nsd->signal_hint_child = 0; return NSD_REAP_CHILDREN; } else if(nsd->signal_hint_reload) { nsd->signal_hint_reload = 0; return NSD_RELOAD; } else if(nsd->signal_hint_stats) { nsd->signal_hint_stats = 0; #ifdef BIND8_STATS set_bind8_alarm(nsd); #endif return NSD_STATS; } else if(nsd->signal_hint_statsusr) { nsd->signal_hint_statsusr = 0; return NSD_STATS; } return NSD_RUN; } /* * The main server simply waits for signals and child processes to * terminate. Child processes are restarted as necessary. */ void server_main(struct nsd *nsd) { region_type *server_region = region_create(xalloc, free); netio_type *netio = netio_create(server_region); netio_handler_type reload_listener; netio_handler_type xfrd_listener; int reload_sockets[2] = {-1, -1}; struct timespec timeout_spec; int fd; int status; pid_t child_pid; pid_t reload_pid = -1; pid_t xfrd_pid = -1; sig_atomic_t mode; #ifdef RATELIMIT rrl_init((nsd->this_child - nsd->children)/sizeof(nsd->children[0])); #endif /* Ensure we are the main process */ assert(nsd->server_kind == NSD_SERVER_MAIN); xfrd_listener.user_data = (struct ipc_handler_conn_data*)region_alloc( server_region, sizeof(struct ipc_handler_conn_data)); xfrd_listener.fd = -1; ((struct ipc_handler_conn_data*)xfrd_listener.user_data)->nsd = nsd; ((struct ipc_handler_conn_data*)xfrd_listener.user_data)->conn = xfrd_tcp_create(server_region); /* Start the XFRD process */ xfrd_pid = server_start_xfrd(nsd, &xfrd_listener); netio_add_handler(netio, &xfrd_listener); /* Start the child processes that handle incoming queries */ if (server_start_children(nsd, server_region, netio, &xfrd_listener.fd) != 0) { send_children_quit(nsd); /* no wait required */ exit(1); } reload_listener.fd = -1; /* This_child MUST be 0, because this is the parent process */ assert(nsd->this_child == 0); /* Run the server until we get a shutdown signal */ while ((mode = nsd->mode) != NSD_SHUTDOWN) { /* Did we receive a signal that changes our mode? */ if(mode == NSD_RUN) { nsd->mode = mode = server_signal_mode(nsd); } switch (mode) { case NSD_RUN: /* see if any child processes terminated */ while((child_pid = waitpid(0, &status, WNOHANG)) != -1 && child_pid != 0) { int is_child = delete_child_pid(nsd, child_pid); if (is_child != -1 && nsd->children[is_child].need_to_exit) { if(nsd->children[is_child].child_fd == -1) nsd->children[is_child].has_exited = 1; parent_check_all_children_exited(nsd); } else if(is_child != -1) { log_msg(LOG_WARNING, "server %d died unexpectedly with status %d, restarting", (int) child_pid, status); restart_child_servers(nsd, server_region, netio, &xfrd_listener.fd); } else if (child_pid == reload_pid) { sig_atomic_t cmd = NSD_SOA_END; log_msg(LOG_WARNING, "Reload process %d failed with status %d, continuing with old database", (int) child_pid, status); reload_pid = -1; if(reload_listener.fd > 0) close(reload_listener.fd); reload_listener.fd = -1; reload_listener.event_types = NETIO_EVENT_NONE; /* inform xfrd reload attempt ended */ if(!write_socket(xfrd_listener.fd, &cmd, sizeof(cmd))) { log_msg(LOG_ERR, "problems " "sending SOAEND to xfrd: %s", strerror(errno)); } } else if (child_pid == xfrd_pid) { log_msg(LOG_WARNING, "xfrd process %d failed with status %d, restarting ", (int) child_pid, status); xfrd_pid = server_start_xfrd(nsd, &xfrd_listener); } else { log_msg(LOG_WARNING, "Unknown child %d terminated with status %d", (int) child_pid, status); } } if (child_pid == -1) { if (errno == EINTR) { continue; } log_msg(LOG_WARNING, "wait failed: %s", strerror(errno)); } if (nsd->mode != NSD_RUN) break; /* timeout to collect processes. In case no sigchild happens. */ timeout_spec.tv_sec = 60; timeout_spec.tv_nsec = 0; /* listen on ports, timeout for collecting terminated children */ if(netio_dispatch(netio, &timeout_spec, 0) == -1) { if (errno != EINTR) { log_msg(LOG_ERR, "netio_dispatch failed: %s", strerror(errno)); } } break; case NSD_RELOAD: /* Continue to run nsd after reload */ nsd->mode = NSD_RUN; if (reload_pid != -1) { log_msg(LOG_WARNING, "Reload already in progress (pid = %d)", (int) reload_pid); break; } log_msg(LOG_WARNING, "signal received, reloading..."); if (socketpair(AF_UNIX, SOCK_STREAM, 0, reload_sockets) == -1) { log_msg(LOG_ERR, "reload failed on socketpair: %s", strerror(errno)); reload_pid = -1; break; } /* Do actual reload */ reload_pid = fork(); switch (reload_pid) { case -1: log_msg(LOG_ERR, "fork failed: %s", strerror(errno)); break; case 0: /* CHILD */ close(reload_sockets[0]); server_reload(nsd, server_region, netio, reload_sockets[1], &xfrd_listener.fd); DEBUG(DEBUG_IPC,2, (LOG_INFO, "Reload exited to become new main")); close(reload_sockets[1]); DEBUG(DEBUG_IPC,2, (LOG_INFO, "Reload closed")); /* drop stale xfrd ipc data */ ((struct ipc_handler_conn_data*)xfrd_listener.user_data) ->conn->is_reading = 0; reload_pid = -1; reload_listener.fd = -1; reload_listener.event_types = NETIO_EVENT_NONE; DEBUG(DEBUG_IPC,2, (LOG_INFO, "Reload resetup; run")); break; default: /* PARENT, keep running until NSD_QUIT_SYNC * received from CHILD. */ close(reload_sockets[1]); reload_listener.fd = reload_sockets[0]; reload_listener.timeout = NULL; reload_listener.user_data = nsd; reload_listener.event_types = NETIO_EVENT_READ; reload_listener.event_handler = parent_handle_reload_command; /* listens to Quit */ netio_add_handler(netio, &reload_listener); break; } break; case NSD_QUIT_SYNC: /* synchronisation of xfrd, parent and reload */ if(!nsd->quit_sync_done && reload_listener.fd != -1) { sig_atomic_t cmd = NSD_RELOAD; /* stop xfrd ipc writes in progress */ DEBUG(DEBUG_IPC,1, (LOG_INFO, "main: ipc send indication reload")); if(!write_socket(xfrd_listener.fd, &cmd, sizeof(cmd))) { log_msg(LOG_ERR, "server_main: could not send reload " "indication to xfrd: %s", strerror(errno)); } /* wait for ACK from xfrd */ DEBUG(DEBUG_IPC,1, (LOG_INFO, "main: wait ipc reply xfrd")); nsd->quit_sync_done = 1; } nsd->mode = NSD_RUN; break; case NSD_QUIT: /* silent shutdown during reload */ if(reload_listener.fd != -1) { /* acknowledge the quit, to sync reload that we will really quit now */ sig_atomic_t cmd = NSD_RELOAD; DEBUG(DEBUG_IPC,1, (LOG_INFO, "main: ipc ack reload")); if(!write_socket(reload_listener.fd, &cmd, sizeof(cmd))) { log_msg(LOG_ERR, "server_main: " "could not ack quit: %s", strerror(errno)); } close(reload_listener.fd); } /* only quit children after xfrd has acked */ send_children_quit(nsd); /* no wait required */ namedb_fd_close(nsd->db); region_destroy(server_region); server_shutdown(nsd); /* ENOTREACH */ break; case NSD_SHUTDOWN: send_children_quit_and_wait(nsd); log_msg(LOG_WARNING, "signal received, shutting down..."); break; case NSD_REAP_CHILDREN: /* continue; wait for child in run loop */ nsd->mode = NSD_RUN; break; case NSD_STATS: #ifdef BIND8_STATS set_children_stats(nsd); #endif nsd->mode = NSD_RUN; break; default: log_msg(LOG_WARNING, "NSD main server mode invalid: %d", nsd->mode); nsd->mode = NSD_RUN; break; } } /* Truncate the pid file. */ if ((fd = open(nsd->pidfile, O_WRONLY | O_TRUNC, 0644)) == -1) { log_msg(LOG_ERR, "can not truncate the pid file %s: %s", nsd->pidfile, strerror(errno)); } else { close(fd); } /* Unlink it if possible... */ unlinkpid(nsd->pidfile); if(reload_listener.fd != -1) { sig_atomic_t cmd = NSD_QUIT; DEBUG(DEBUG_IPC,1, (LOG_INFO, "main: ipc send quit to reload-process")); if(!write_socket(reload_listener.fd, &cmd, sizeof(cmd))) { log_msg(LOG_ERR, "server_main: could not send quit to reload: %s", strerror(errno)); } fsync(reload_listener.fd); close(reload_listener.fd); } if(xfrd_listener.fd != -1) { /* complete quit, stop xfrd */ sig_atomic_t cmd = NSD_QUIT; DEBUG(DEBUG_IPC,1, (LOG_INFO, "main: ipc send quit to xfrd")); if(!write_socket(xfrd_listener.fd, &cmd, sizeof(cmd))) { log_msg(LOG_ERR, "server_main: could not send quit to xfrd: %s", strerror(errno)); } fsync(xfrd_listener.fd); close(xfrd_listener.fd); (void)kill(xfrd_pid, SIGTERM); } namedb_fd_close(nsd->db); region_destroy(server_region); server_shutdown(nsd); } static query_state_type server_process_query(struct nsd *nsd, struct query *query) { return query_process(query, nsd); } /* * Serve DNS requests. */ void server_child(struct nsd *nsd) { size_t i; region_type *server_region = region_create(xalloc, free); netio_type *netio = netio_create(server_region); netio_handler_type *tcp_accept_handlers; query_type *udp_query; sig_atomic_t mode; assert(nsd->server_kind != NSD_SERVER_MAIN); DEBUG(DEBUG_IPC, 2, (LOG_INFO, "child process started")); if (!(nsd->server_kind & NSD_SERVER_TCP)) { server_close_all_sockets(nsd->tcp, nsd->ifs); } if (!(nsd->server_kind & NSD_SERVER_UDP)) { server_close_all_sockets(nsd->udp, nsd->ifs); } if (nsd->this_child && nsd->this_child->parent_fd != -1) { netio_handler_type *handler; handler = (netio_handler_type *) region_alloc( server_region, sizeof(netio_handler_type)); handler->fd = nsd->this_child->parent_fd; handler->timeout = NULL; handler->user_data = (struct ipc_handler_conn_data*)region_alloc( server_region, sizeof(struct ipc_handler_conn_data)); ((struct ipc_handler_conn_data*)handler->user_data)->nsd = nsd; ((struct ipc_handler_conn_data*)handler->user_data)->conn = xfrd_tcp_create(server_region); handler->event_types = NETIO_EVENT_READ; handler->event_handler = child_handle_parent_command; netio_add_handler(netio, handler); } if (nsd->server_kind & NSD_SERVER_UDP) { udp_query = query_create(server_region, compressed_dname_offsets, compression_table_size); for (i = 0; i < nsd->ifs; ++i) { struct udp_handler_data *data; netio_handler_type *handler; data = (struct udp_handler_data *) region_alloc( server_region, sizeof(struct udp_handler_data)); data->query = udp_query; data->nsd = nsd; data->socket = &nsd->udp[i]; handler = (netio_handler_type *) region_alloc( server_region, sizeof(netio_handler_type)); handler->fd = nsd->udp[i].s; handler->timeout = NULL; handler->user_data = data; handler->event_types = NETIO_EVENT_READ; handler->event_handler = handle_udp; netio_add_handler(netio, handler); } } /* * Keep track of all the TCP accept handlers so we can enable * and disable them based on the current number of active TCP * connections. */ tcp_accept_handlers = (netio_handler_type *) region_alloc( server_region, nsd->ifs * sizeof(netio_handler_type)); if (nsd->server_kind & NSD_SERVER_TCP) { for (i = 0; i < nsd->ifs; ++i) { struct tcp_accept_handler_data *data; netio_handler_type *handler; data = (struct tcp_accept_handler_data *) region_alloc( server_region, sizeof(struct tcp_accept_handler_data)); data->nsd = nsd; data->socket = &nsd->tcp[i]; data->tcp_accept_handler_count = nsd->ifs; data->tcp_accept_handlers = tcp_accept_handlers; handler = &tcp_accept_handlers[i]; handler->fd = nsd->tcp[i].s; handler->timeout = NULL; handler->user_data = data; handler->event_types = NETIO_EVENT_READ | NETIO_EVENT_ACCEPT; handler->event_handler = handle_tcp_accept; netio_add_handler(netio, handler); } } /* The main loop... */ while ((mode = nsd->mode) != NSD_QUIT) { if(mode == NSD_RUN) nsd->mode = mode = server_signal_mode(nsd); /* Do we need to do the statistics... */ if (mode == NSD_STATS) { #ifdef BIND8_STATS int p = nsd->st.period; nsd->st.period = 1; /* force stats printout */ /* Dump the statistics */ bind8_stats(nsd); nsd->st.period = p; #else /* !BIND8_STATS */ log_msg(LOG_NOTICE, "Statistics support not enabled at compile time."); #endif /* BIND8_STATS */ nsd->mode = NSD_RUN; } else if (mode == NSD_REAP_CHILDREN) { /* got signal, notify parent. parent reaps terminated children. */ if (nsd->this_child->parent_fd != -1) { sig_atomic_t parent_notify = NSD_REAP_CHILDREN; if (write(nsd->this_child->parent_fd, &parent_notify, sizeof(parent_notify)) == -1) { log_msg(LOG_ERR, "problems sending command from %d to parent: %s", (int) nsd->this_child->pid, strerror(errno)); } } else /* no parent, so reap 'em */ while (waitpid(0, NULL, WNOHANG) > 0) ; nsd->mode = NSD_RUN; } else if(mode == NSD_RUN) { /* Wait for a query... */ if (netio_dispatch(netio, NULL, NULL) == -1) { if (errno != EINTR) { log_msg(LOG_ERR, "netio_dispatch failed: %s", strerror(errno)); break; } } } else if(mode == NSD_QUIT) { /* ignore here, quit */ } else { log_msg(LOG_ERR, "mode bad value %d, back to service.", mode); nsd->mode = NSD_RUN; } } #ifdef BIND8_STATS bind8_stats(nsd); #endif /* BIND8_STATS */ namedb_fd_close(nsd->db); region_destroy(server_region); server_shutdown(nsd); } static query_state_type server_process_query_udp(struct nsd *nsd, struct query *query) { #ifdef RATELIMIT if(query_process(query, nsd) != QUERY_DISCARDED) { if(rrl_process_query(query)) return rrl_slip(query); else return QUERY_PROCESSED; } return QUERY_DISCARDED; #else return query_process(query, nsd); #endif } static void handle_udp(netio_type *ATTR_UNUSED(netio), netio_handler_type *handler, netio_event_types_type event_types) { struct udp_handler_data *data = (struct udp_handler_data *) handler->user_data; int received, sent; struct query *q = data->query; if (!(event_types & NETIO_EVENT_READ)) { return; } /* Account... */ #ifdef BIND8_STATS if (data->socket->addr->ai_family == AF_INET) { STATUP(data->nsd, qudp); } else if (data->socket->addr->ai_family == AF_INET6) { STATUP(data->nsd, qudp6); } #endif /* Initialize the query... */ query_reset(q, UDP_MAX_MESSAGE_LEN, 0); received = recvfrom(handler->fd, buffer_begin(q->packet), buffer_remaining(q->packet), 0, (struct sockaddr *)&q->addr, &q->addrlen); if (received == -1) { if (errno != EAGAIN && errno != EINTR) { log_msg(LOG_ERR, "recvfrom failed: %s", strerror(errno)); STATUP(data->nsd, rxerr); /* No zone statup */ } } else { buffer_skip(q->packet, received); buffer_flip(q->packet); /* Process and answer the query... */ if (server_process_query_udp(data->nsd, q) != QUERY_DISCARDED) { #ifdef BIND8_STATS if (RCODE(q->packet) == RCODE_OK && !AA(q->packet)) { STATUP(data->nsd, nona); # ifdef USE_ZONE_STATS if (q->zone) ZTATUP(q->zone, nona); # endif } # ifdef USE_ZONE_STATS if (q->zone) { if (data->socket->addr->ai_family == AF_INET) { ZTATUP(q->zone, qudp); } else if (data->socket->addr->ai_family == AF_INET6) { ZTATUP(q->zone, qudp6); } } # endif #endif /* Add EDNS0 and TSIG info if necessary. */ query_add_optional(q, data->nsd); buffer_flip(q->packet); sent = sendto(handler->fd, buffer_begin(q->packet), buffer_remaining(q->packet), 0, (struct sockaddr *) &q->addr, q->addrlen); if (sent == -1) { log_msg(LOG_ERR, "sendto failed: %s", strerror(errno)); STATUP(data->nsd, txerr); #ifdef USE_ZONE_STATS if (q->zone) ZTATUP(q->zone, txerr); #endif } else if ((size_t) sent != buffer_remaining(q->packet)) { log_msg(LOG_ERR, "sent %d in place of %d bytes", sent, (int) buffer_remaining(q->packet)); #ifdef BIND8_STATS } else { /* Account the rcode & TC... */ STATUP2(data->nsd, rcode, RCODE(q->packet)); # ifdef USE_ZONE_STATS if (q->zone) ZTATUP2(q->zone, rcode, RCODE(q->packet)); # endif if (TC(q->packet)) { STATUP(data->nsd, truncated); # ifdef USE_ZONE_STATS if (q->zone) ZTATUP(q->zone, truncated); # endif } #endif /* BIND8_STATS */ } #ifdef BIND8_STATS } else { STATUP(data->nsd, dropped); # ifdef USE_ZONE_STATS if (q->zone) { ZTATUP(q->zone, dropped); } # endif #endif } } } static void cleanup_tcp_handler(netio_type *netio, netio_handler_type *handler) { struct tcp_handler_data *data = (struct tcp_handler_data *) handler->user_data; netio_remove_handler(netio, handler); close(handler->fd); slowaccept = 0; /* * Enable the TCP accept handlers when the current number of * TCP connections is about to drop below the maximum number * of TCP connections. */ if (data->nsd->current_tcp_count == data->nsd->maximum_tcp_count) { configure_handler_event_types(data->tcp_accept_handler_count, data->tcp_accept_handlers, NETIO_EVENT_READ); } --data->nsd->current_tcp_count; assert(data->nsd->current_tcp_count >= 0); region_destroy(data->region); } static void handle_tcp_reading(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types) { struct tcp_handler_data *data = (struct tcp_handler_data *) handler->user_data; ssize_t received; if (event_types & NETIO_EVENT_TIMEOUT) { /* Connection timed out. */ cleanup_tcp_handler(netio, handler); return; } if (data->nsd->tcp_query_count > 0 && data->query_count >= data->nsd->tcp_query_count) { /* No more queries allowed on this tcp connection. */ cleanup_tcp_handler(netio, handler); return; } assert(event_types & NETIO_EVENT_READ); if (data->bytes_transmitted == 0) { query_reset(data->query, TCP_MAX_MESSAGE_LEN, 1); } /* * Check if we received the leading packet length bytes yet. */ if (data->bytes_transmitted < sizeof(uint16_t)) { received = read(handler->fd, (char *) &data->query->tcplen + data->bytes_transmitted, sizeof(uint16_t) - data->bytes_transmitted); if (received == -1) { if (errno == EAGAIN || errno == EINTR) { /* * Read would block, wait until more * data is available. */ return; } else { #ifdef ECONNRESET if (verbosity >= 2 || errno != ECONNRESET) #endif /* ECONNRESET */ log_msg(LOG_ERR, "failed reading from tcp: %s", strerror(errno)); cleanup_tcp_handler(netio, handler); return; } } else if (received == 0) { /* EOF */ cleanup_tcp_handler(netio, handler); return; } data->bytes_transmitted += received; if (data->bytes_transmitted < sizeof(uint16_t)) { /* * Not done with the tcplen yet, wait for more * data to become available. */ return; } assert(data->bytes_transmitted == sizeof(uint16_t)); data->query->tcplen = ntohs(data->query->tcplen); /* * Minimum query size is: * * Size of the header (12) * + Root domain name (1) * + Query class (2) * + Query type (2) */ if (data->query->tcplen < QHEADERSZ + 1 + sizeof(uint16_t) + sizeof(uint16_t)) { VERBOSITY(2, (LOG_WARNING, "packet too small, dropping tcp connection")); cleanup_tcp_handler(netio, handler); return; } if (data->query->tcplen > data->query->maxlen) { VERBOSITY(2, (LOG_WARNING, "insufficient tcp buffer, dropping connection")); cleanup_tcp_handler(netio, handler); return; } buffer_set_limit(data->query->packet, data->query->tcplen); } assert(buffer_remaining(data->query->packet) > 0); /* Read the (remaining) query data. */ received = read(handler->fd, buffer_current(data->query->packet), buffer_remaining(data->query->packet)); if (received == -1) { if (errno == EAGAIN || errno == EINTR) { /* * Read would block, wait until more data is * available. */ return; } else { #ifdef ECONNRESET if (verbosity >= 2 || errno != ECONNRESET) #endif /* ECONNRESET */ log_msg(LOG_ERR, "failed reading from tcp: %s", strerror(errno)); cleanup_tcp_handler(netio, handler); return; } } else if (received == 0) { /* EOF */ cleanup_tcp_handler(netio, handler); return; } data->bytes_transmitted += received; buffer_skip(data->query->packet, received); if (buffer_remaining(data->query->packet) > 0) { /* * Message not yet complete, wait for more data to * become available. */ return; } assert(buffer_position(data->query->packet) == data->query->tcplen); /* Account... */ #ifdef BIND8_STATS # ifndef INET6 STATUP(data->nsd, ctcp); # else if (data->query->addr.ss_family == AF_INET) { STATUP(data->nsd, ctcp); } else if (data->query->addr.ss_family == AF_INET6) { STATUP(data->nsd, ctcp6); } # endif #endif /* BIND8_STATS */ /* We have a complete query, process it. */ /* tcp-query-count: handle query counter ++ */ data->query_count++; buffer_flip(data->query->packet); data->query_state = server_process_query(data->nsd, data->query); if (data->query_state == QUERY_DISCARDED) { /* Drop the packet and the entire connection... */ STATUP(data->nsd, dropped); #if defined(BIND8_STATS) && defined(USE_ZONE_STATS) if (data->query->zone) { ZTATUP(data->query->zone, dropped); } #endif cleanup_tcp_handler(netio, handler); return; } #ifdef BIND8_STATS if (RCODE(data->query->packet) == RCODE_OK && !AA(data->query->packet)) { STATUP(data->nsd, nona); # ifdef USE_ZONE_STATS if (data->query->zone) ZTATUP(data->query->zone, nona); # endif } # ifdef USE_ZONE_STATS if (data->query->zone) { # ifndef INET6 ZTATUP(data->query->zone, ctcp); # else if (data->query->addr.ss_family == AF_INET) { ZTATUP(data->query->zone, ctcp); } else if (data->query->addr.ss_family == AF_INET6) { ZTATUP(data->query->zone, ctcp6); } # endif } # endif /* USE_ZONE_STATS */ #endif /* BIND8_STATS */ query_add_optional(data->query, data->nsd); /* Switch to the tcp write handler. */ buffer_flip(data->query->packet); data->query->tcplen = buffer_remaining(data->query->packet); data->bytes_transmitted = 0; handler->timeout->tv_sec = data->nsd->tcp_timeout; handler->timeout->tv_nsec = 0L; timespec_add(handler->timeout, netio_current_time(netio)); handler->event_types = NETIO_EVENT_WRITE | NETIO_EVENT_TIMEOUT; handler->event_handler = handle_tcp_writing; } static void handle_tcp_writing(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types) { struct tcp_handler_data *data = (struct tcp_handler_data *) handler->user_data; ssize_t sent; struct query *q = data->query; if (event_types & NETIO_EVENT_TIMEOUT) { /* Connection timed out. */ cleanup_tcp_handler(netio, handler); return; } assert(event_types & NETIO_EVENT_WRITE); if (data->bytes_transmitted < sizeof(q->tcplen)) { /* Writing the response packet length. */ uint16_t n_tcplen = htons(q->tcplen); #ifdef HAVE_WRITEV struct iovec iov[2]; iov[0].iov_base = (uint8_t*)&n_tcplen + data->bytes_transmitted; iov[0].iov_len = sizeof(n_tcplen) - data->bytes_transmitted; iov[1].iov_base = buffer_begin(q->packet); iov[1].iov_len = buffer_limit(q->packet); sent = writev(handler->fd, iov, 2); #else /* HAVE_WRITEV */ sent = write(handler->fd, (const char *) &n_tcplen + data->bytes_transmitted, sizeof(n_tcplen) - data->bytes_transmitted); #endif /* HAVE_WRITEV */ if (sent == -1) { if (errno == EAGAIN || errno == EINTR) { /* * Write would block, wait until * socket becomes writable again. */ return; } else { #ifdef ECONNRESET if(verbosity >= 2 || errno != ECONNRESET) #endif /* ECONNRESET */ #ifdef EPIPE if(verbosity >= 2 || errno != EPIPE) #endif /* EPIPE 'broken pipe' */ log_msg(LOG_ERR, "failed writing to tcp: %s", strerror(errno)); cleanup_tcp_handler(netio, handler); return; } } data->bytes_transmitted += sent; if (data->bytes_transmitted < sizeof(q->tcplen)) { /* * Writing not complete, wait until socket * becomes writable again. */ return; } #ifdef HAVE_WRITEV sent -= sizeof(n_tcplen); /* handle potential 'packet done' code */ goto packet_could_be_done; #endif } sent = write(handler->fd, buffer_current(q->packet), buffer_remaining(q->packet)); if (sent == -1) { if (errno == EAGAIN || errno == EINTR) { /* * Write would block, wait until * socket becomes writable again. */ return; } else { #ifdef ECONNRESET if(verbosity >= 2 || errno != ECONNRESET) #endif /* ECONNRESET */ #ifdef EPIPE if(verbosity >= 2 || errno != EPIPE) #endif /* EPIPE 'broken pipe' */ log_msg(LOG_ERR, "failed writing to tcp: %s", strerror(errno)); cleanup_tcp_handler(netio, handler); return; } } data->bytes_transmitted += sent; #ifdef HAVE_WRITEV packet_could_be_done: #endif buffer_skip(q->packet, sent); if (data->bytes_transmitted < q->tcplen + sizeof(q->tcplen)) { /* * Still more data to write when socket becomes * writable again. */ return; } assert(data->bytes_transmitted == q->tcplen + sizeof(q->tcplen)); if (data->query_state == QUERY_IN_AXFR) { /* Continue processing AXFR and writing back results. */ buffer_clear(q->packet); data->query_state = query_axfr(data->nsd, q); if (data->query_state != QUERY_PROCESSED) { query_add_optional(data->query, data->nsd); /* Reset data. */ buffer_flip(q->packet); q->tcplen = buffer_remaining(q->packet); data->bytes_transmitted = 0; /* Reset timeout. */ handler->timeout->tv_sec = data->nsd->tcp_timeout; handler->timeout->tv_nsec = 0; timespec_add(handler->timeout, netio_current_time(netio)); /* * Write data if/when the socket is writable * again. */ return; } } /* * Done sending, wait for the next request to arrive on the * TCP socket by installing the TCP read handler. */ if (data->nsd->tcp_query_count > 0 && data->query_count >= data->nsd->tcp_query_count) { (void) shutdown(handler->fd, SHUT_WR); } data->bytes_transmitted = 0; handler->timeout->tv_sec = data->nsd->tcp_timeout; handler->timeout->tv_nsec = 0; timespec_add(handler->timeout, netio_current_time(netio)); handler->event_types = NETIO_EVENT_READ | NETIO_EVENT_TIMEOUT; handler->event_handler = handle_tcp_reading; } /* * Handle an incoming TCP connection. The connection is accepted and * a new TCP reader event handler is added to NETIO. The TCP handler * is responsible for cleanup when the connection is closed. */ static void handle_tcp_accept(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types) { struct tcp_accept_handler_data *data = (struct tcp_accept_handler_data *) handler->user_data; int s; struct tcp_handler_data *tcp_data; region_type *tcp_region; netio_handler_type *tcp_handler; #ifdef INET6 struct sockaddr_storage addr; #else struct sockaddr_in addr; #endif socklen_t addrlen; if (!(event_types & NETIO_EVENT_READ)) { return; } if (data->nsd->current_tcp_count >= data->nsd->maximum_tcp_count) { return; } /* Accept it... */ addrlen = sizeof(addr); s = accept(handler->fd, (struct sockaddr *) &addr, &addrlen); if (s == -1) { /** * EMFILE and ENFILE is a signal that the limit of open * file descriptors has been reached. Pause accept(). * EINTR is a signal interrupt. The others are various OS ways * of saying that the client has closed the connection. */ if (errno == EMFILE || errno == ENFILE) { if (!slowaccept) { slowaccept_timeout.tv_sec = NETIO_SLOW_ACCEPT_TIMEOUT; slowaccept_timeout.tv_nsec = 0L; timespec_add(&slowaccept_timeout, netio_current_time(netio)); slowaccept = 1; /* We don't want to spam the logs here */ } } else if (errno != EINTR && errno != EWOULDBLOCK #ifdef ECONNABORTED && errno != ECONNABORTED #endif /* ECONNABORTED */ #ifdef EPROTO && errno != EPROTO #endif /* EPROTO */ ) { log_msg(LOG_ERR, "accept failed: %s", strerror(errno)); } return; } if (fcntl(s, F_SETFL, O_NONBLOCK) == -1) { log_msg(LOG_ERR, "fcntl failed: %s", strerror(errno)); close(s); return; } /* * This region is deallocated when the TCP connection is * closed by the TCP handler. */ tcp_region = region_create(xalloc, free); tcp_data = (struct tcp_handler_data *) region_alloc( tcp_region, sizeof(struct tcp_handler_data)); tcp_data->region = tcp_region; tcp_data->query = query_create(tcp_region, compressed_dname_offsets, compression_table_size); tcp_data->nsd = data->nsd; tcp_data->query_count = 0; tcp_data->tcp_accept_handler_count = data->tcp_accept_handler_count; tcp_data->tcp_accept_handlers = data->tcp_accept_handlers; tcp_data->query_state = QUERY_PROCESSED; tcp_data->bytes_transmitted = 0; memcpy(&tcp_data->query->addr, &addr, addrlen); tcp_data->query->addrlen = addrlen; tcp_handler = (netio_handler_type *) region_alloc( tcp_region, sizeof(netio_handler_type)); tcp_handler->fd = s; tcp_handler->timeout = (struct timespec *) region_alloc( tcp_region, sizeof(struct timespec)); tcp_handler->timeout->tv_sec = data->nsd->tcp_timeout; tcp_handler->timeout->tv_nsec = 0L; timespec_add(tcp_handler->timeout, netio_current_time(netio)); tcp_handler->user_data = tcp_data; tcp_handler->event_types = NETIO_EVENT_READ | NETIO_EVENT_TIMEOUT; tcp_handler->event_handler = handle_tcp_reading; netio_add_handler(netio, tcp_handler); /* * Keep track of the total number of TCP handlers installed so * we can stop accepting connections when the maximum number * of simultaneous TCP connections is reached. */ ++data->nsd->current_tcp_count; if (data->nsd->current_tcp_count == data->nsd->maximum_tcp_count) { configure_handler_event_types(data->tcp_accept_handler_count, data->tcp_accept_handlers, NETIO_EVENT_NONE); } } static void send_children_command(struct nsd* nsd, sig_atomic_t command, int timeout) { size_t i; assert(nsd->server_kind == NSD_SERVER_MAIN && nsd->this_child == 0); for (i = 0; i < nsd->child_count; ++i) { if (nsd->children[i].pid > 0 && nsd->children[i].child_fd != -1) { if (write(nsd->children[i].child_fd, &command, sizeof(command)) == -1) { if(errno != EAGAIN && errno != EINTR) log_msg(LOG_ERR, "problems sending command %d to server %d: %s", (int) command, (int) nsd->children[i].pid, strerror(errno)); } else if (timeout > 0) { /* wait for reply */ (void)block_read(NULL, nsd->children[i].child_fd, &command, sizeof(command), timeout); } fsync(nsd->children[i].child_fd); close(nsd->children[i].child_fd); nsd->children[i].child_fd = -1; } } } static void send_children_quit(struct nsd* nsd) { send_children_command(nsd, NSD_QUIT, 0); } static void send_children_quit_and_wait(struct nsd* nsd) { DEBUG(DEBUG_IPC, 1, (LOG_INFO, "send children quit and wait")); send_children_command(nsd, NSD_QUIT_CHILD, 3); } #ifdef BIND8_STATS static void set_children_stats(struct nsd* nsd) { size_t i; assert(nsd->server_kind == NSD_SERVER_MAIN && nsd->this_child == 0); DEBUG(DEBUG_IPC, 1, (LOG_INFO, "parent set stats to send to children")); for (i = 0; i < nsd->child_count; ++i) { nsd->children[i].need_to_send_STATS = 1; nsd->children[i].handler->event_types |= NETIO_EVENT_WRITE; } } #endif /* BIND8_STATS */ static void configure_handler_event_types(size_t count, netio_handler_type *handlers, netio_event_types_type event_types) { size_t i; assert(handlers); for (i = 0; i < count; ++i) { handlers[i].event_types = event_types; } } nsd-3.2.16/tsig.h0000664000175000017500000001623312071046230012472 0ustar matjematje/* * tsig.h -- TSIG definitions (RFC 2845). * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _TSIG_H_ #define _TSIG_H_ #include #include #include #include "buffer.h" #include "dname.h" #define TSIG_ERROR_NOERROR 0 #define TSIG_ERROR_BADSIG 16 #define TSIG_ERROR_BADKEY 17 #define TSIG_ERROR_BADTIME 18 #define TSIG_HMAC_MD5 157 #define TSIG_HMAC_SHA1 158 #define TSIG_HMAC_SHA256 159 typedef struct tsig_algorithm tsig_algorithm_type; typedef struct tsig_key tsig_key_type; typedef struct tsig_record tsig_record_type; enum tsig_status { TSIG_NOT_PRESENT, TSIG_OK, TSIG_ERROR }; typedef enum tsig_status tsig_status_type; struct tsig_lookup_struct_table { uint8_t id; const char* short_name; }; typedef struct tsig_lookup_struct_table tsig_lookup_algorithm_table; /* * A TSIG HMAC algorithm, such as hmac-md5. */ struct tsig_algorithm { /* * Short name of the algorithm, such as "hmac-md5". */ const char *short_name; /* * Full wireformat name of the algorithm, such as * "hmac-md5.sig-alg.reg.int." */ const dname_type *wireformat_name; /* * The maximum size of a digest generated by this algorithm. */ size_t maximum_digest_size; /* * Algorithm implementation specific data. */ const void *data; /* * Create a new HMAC context. */ void *(*hmac_create_context)(region_type *region); /* * Initialize an HMAC context with the specified algorithm and * key. */ void (*hmac_init_context)(void *context, tsig_algorithm_type *algorithm, tsig_key_type *key); /* * Update the HMAC context with the specified data. */ void (*hmac_update)(void *context, const void *data, size_t size); /* * Generate the final digest. DIGEST points to a buffer of at * least maximum_digest_size bytes. */ void (*hmac_final)(void *context, uint8_t *digest, size_t *size); }; /* * A TSIG key used to sign and verify packets. */ struct tsig_key { const dname_type *name; size_t size; const uint8_t *data; }; struct tsig_record { tsig_status_type status; size_t position; size_t response_count; size_t updates_since_last_prepare; void *context; tsig_algorithm_type *algorithm; tsig_key_type *key; size_t prior_mac_size; uint8_t *prior_mac_data; /* TSIG RR data is allocated in the rr_region. */ region_type *rr_region; region_type *context_region; const dname_type *key_name; const dname_type *algorithm_name; uint16_t signed_time_high; uint32_t signed_time_low; uint16_t signed_time_fudge; uint16_t mac_size; uint8_t *mac_data; uint16_t original_query_id; uint16_t error_code; uint16_t other_size; uint8_t *other_data; }; /* * Initialize the TSIG module (including TSIG implementation modules * such as tsig-openssl). */ int tsig_init(region_type *region); /* * Add the specified key to the TSIG key table. */ void tsig_add_key(tsig_key_type *key); /* * Add the specified algorithm to the TSIG algorithm table. */ void tsig_add_algorithm(tsig_algorithm_type *algorithm); /* * Find an HMAC algorithm based on its short name. */ tsig_algorithm_type *tsig_get_algorithm_by_name(const char *name); /* * Return a descriptive error message based on the TSIG error code. */ const char *tsig_error(int error_code); /* * Create the tsig record internal structure. Allocs it. * Call init_record afterwards before doing more with it. * * The region is used to attach a cleanup function that destroys the tsig. */ void tsig_create_record(tsig_record_type* tsig, region_type* region); /* * Like tsig_create_record, with custom region settings. * The size params are used to customise the rr_region and context_region. */ void tsig_create_record_custom(tsig_record_type* tsig, region_type* region, size_t chunk_size, size_t large_object_size, size_t initial_cleanup_size); /* * Call this before starting to analyze or signing a sequence of * packets. * * ALGORITHM and KEY are optional and are only needed if you want to * sign the initial query. Otherwise the key and algorithm are looked * up in the algorithm and key table when a received TSIG RR is * processed. */ void tsig_init_record(tsig_record_type *data, tsig_algorithm_type *algorithm, tsig_key_type *key); /* * Validate the TSIG RR key and algorithm from the TSIG RR. Otherwise * update the TSIG error code. The MAC itself is not validated. * * Returns non-zero if the key and algorithm could be validated. */ int tsig_from_query(tsig_record_type *tsig); /* * Prepare TSIG for signing of a query. This initializes TSIG with * the algorithm and key stored in the TSIG record. */ void tsig_init_query(tsig_record_type *tsig, uint16_t original_query_id); /* * Prepare TSIG for performing an HMAC calculation. If the TSIG * contains a prior HMAC it is inserted first into the hash * calculation. */ void tsig_prepare(tsig_record_type *tsig); /* * Add the first LENGTH octets of PACKET to the TSIG hash, replacing * the PACKET's id with the original query id from TSIG. If the query * is a response the TSIG response count is incremented. */ void tsig_update(tsig_record_type *tsig, buffer_type *packet, size_t length); /* * Finalize the TSIG record by hashing the TSIG data. If the TSIG * response count is greater than 1 only the timers are hashed. * Signed time is set to the current time. The TSIG record can be * added to a packet using tsig_append_rr(). * * The calculated MAC is also stored as the prior MAC, so it can be * used as a running MAC. */ void tsig_sign(tsig_record_type *tsig); /* * Verify the calculated MAC against the MAC in the TSIG RR. * * The calculated MAC is also stored as the prior MAC, so it can be * used as a running MAC. */ int tsig_verify(tsig_record_type *tsig); /* * Find the TSIG RR in QUERY and parse it if present. Store the * parsed results in TSIG. * * Returns non-zero if no parsing error occurred, use the tsig->status * field to find out if the TSIG record was present. */ int tsig_find_rr(tsig_record_type *tsig, buffer_type *packet); /* * Call this to analyze the TSIG RR starting at the current location * of PACKET. On success true is returned and the results are stored * in TSIG. * * Returns non-zero if no parsing error occurred, use the tsig->status * field to find out if the TSIG record was present. */ int tsig_parse_rr(tsig_record_type *tsig, buffer_type *packet); /* * Append the TSIG record to the response PACKET. */ void tsig_append_rr(tsig_record_type *tsig, buffer_type *packet); /* * The amount of space to reserve in the response for the TSIG data * (if required). */ size_t tsig_reserved_space(tsig_record_type *tsig); /* * status or error_code must already be in error. * prepares content for error packet. */ void tsig_error_reply(tsig_record_type *tsig); /* * compare tsig algorithm names case insensitive. */ int tsig_strlowercmp(const char* str1, const char* str2); /* * cleanup tsig openssl stuff. */ void tsig_finalize(void); #endif /* _TSIG_H_ */ nsd-3.2.16/query.c0000664000175000017500000012107512163056422012673 0ustar matjematje/* * query.c -- nsd(8) the resolver. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "answer.h" #include "axfr.h" #include "dns.h" #include "dname.h" #include "nsd.h" #include "namedb.h" #include "query.h" #include "util.h" #include "options.h" #include "nsec3.h" #include "tsig.h" /* [Bug #253] Adding unnecessary NS RRset may lead to undesired truncation. * This function determines if the final response packet needs the NS RRset * included. Currently, it will only return negative if QTYPE == DNSKEY|DS. * This way, resolvers won't fallback to TCP unnecessarily when priming * trust anchors. */ static int answer_needs_ns(struct query *query); static int add_rrset(struct query *query, answer_type *answer, rr_section_type section, domain_type *owner, rrset_type *rrset); static void answer_authoritative(struct nsd *nsd, struct query *q, answer_type *answer, uint32_t domain_number, int exact, domain_type *closest_match, domain_type *closest_encloser, const dname_type *qname); static void answer_lookup_zone(struct nsd *nsd, struct query *q, answer_type *answer, uint32_t domain_number, int exact, domain_type *closest_match, domain_type *closest_encloser, const dname_type *qname); void query_put_dname_offset(struct query *q, domain_type *domain, uint16_t offset) { assert(q); assert(domain); assert(domain->number > 0); if (offset > MAX_COMPRESSION_OFFSET) return; if (q->compressed_dname_count >= MAX_COMPRESSED_DNAMES) return; q->compressed_dname_offsets[domain->number] = offset; q->compressed_dnames[q->compressed_dname_count] = domain; ++q->compressed_dname_count; } void query_clear_dname_offsets(struct query *q, size_t max_offset) { while (q->compressed_dname_count > 0 && (q->compressed_dname_offsets[q->compressed_dnames[q->compressed_dname_count - 1]->number] >= max_offset)) { q->compressed_dname_offsets[q->compressed_dnames[q->compressed_dname_count - 1]->number] = 0; --q->compressed_dname_count; } } void query_clear_compression_tables(struct query *q) { uint16_t i; for (i = 0; i < q->compressed_dname_count; ++i) { assert(q->compressed_dnames); q->compressed_dname_offsets[q->compressed_dnames[i]->number] = 0; } q->compressed_dname_count = 0; } void query_add_compression_domain(struct query *q, domain_type *domain, uint16_t offset) { while (domain->parent) { DEBUG(DEBUG_NAME_COMPRESSION, 2, (LOG_INFO, "query dname: %s, number: %lu, offset: %u\n", dname_to_string(domain_dname(domain), NULL), (unsigned long) domain->number, offset)); query_put_dname_offset(q, domain, offset); offset += label_length(dname_name(domain_dname(domain))) + 1; domain = domain->parent; } } /* * Generate an error response with the specified RCODE. */ query_state_type query_error (struct query *q, nsd_rc_type rcode) { if (rcode == NSD_RC_DISCARD) { return QUERY_DISCARDED; } buffer_clear(q->packet); QR_SET(q->packet); /* This is an answer. */ RCODE_SET(q->packet, (int) rcode); /* Error code. */ /* Truncate the question as well... */ QDCOUNT_SET(q->packet, 0); ANCOUNT_SET(q->packet, 0); NSCOUNT_SET(q->packet, 0); ARCOUNT_SET(q->packet, 0); buffer_set_position(q->packet, QHEADERSZ); return QUERY_PROCESSED; } static query_state_type query_formerr (struct query *query) { int opcode = OPCODE(query->packet); FLAGS_SET(query->packet, FLAGS(query->packet) & 0x0100U); /* Preserve the RD flag. Clear the rest. */ OPCODE_SET(query->packet, opcode); return query_error(query, NSD_RC_FORMAT); } static void query_cleanup(void *data) { query_type *query = (query_type *) data; region_destroy(query->region); } query_type * query_create(region_type *region, uint16_t *compressed_dname_offsets, uint32_t compressed_dname_size) { query_type *query = (query_type *) region_alloc_zero(region, sizeof(query_type)); /* create region with large block size, because the initial chunk saves many mallocs in the server */ query->region = region_create_custom(xalloc, free, 16384, 16384/8, 32, 0); query->compressed_dname_offsets = compressed_dname_offsets; query->packet = buffer_create(region, QIOBUFSZ); region_add_cleanup(region, query_cleanup, query); query->compressed_dname_offsets_size = compressed_dname_size; tsig_create_record(&query->tsig, region); query->tsig_prepare_it = 1; query->tsig_update_it = 1; query->tsig_sign_it = 1; return query; } void query_reset(query_type *q, size_t maxlen, int is_tcp) { /* * As long as less than 4Kb (region block size) has been used, * this call to free_all is free, the block is saved for re-use, * so no malloc() or free() calls are done. * at present use of the region is for: * o query qname dname_type (255 max). * o wildcard expansion domain_type (7*ptr+u32+2bytes)+(5*ptr nsec3) * o wildcard expansion for additional section domain_type. * o nsec3 hashed name(s) (3 dnames for a nonexist_proof, * one proof per wildcard and for nx domain). */ region_free_all(q->region); q->addrlen = sizeof(q->addr); q->maxlen = maxlen; q->reserved_space = 0; buffer_clear(q->packet); edns_init_record(&q->edns); tsig_init_record(&q->tsig, NULL, NULL); q->tsig_prepare_it = 1; q->tsig_update_it = 1; q->tsig_sign_it = 1; q->tcp = is_tcp; q->qname = NULL; q->qtype = 0; q->qclass = 0; q->zone = NULL; q->domain = NULL; q->opcode = 0; q->cname_count = 0; q->delegation_domain = NULL; q->delegation_rrset = NULL; q->compressed_dname_count = 0; q->number_temporary_domains = 0; q->axfr_is_done = 0; q->axfr_zone = NULL; q->axfr_current_domain = NULL; q->axfr_current_rrset = NULL; q->axfr_current_rr = 0; #ifdef RATELIMIT q->wildcard_domain = NULL; #endif } /* get a temporary domain number (or 0=failure) */ static domain_type* query_get_tempdomain(struct query *q) { static domain_type d[EXTRA_DOMAIN_NUMBERS]; if(q->number_temporary_domains >= EXTRA_DOMAIN_NUMBERS) return 0; q->number_temporary_domains ++; memset(&d[q->number_temporary_domains-1], 0, sizeof(domain_type)); d[q->number_temporary_domains-1].number = q->compressed_dname_offsets_size + q->number_temporary_domains - 1; return &d[q->number_temporary_domains-1]; } static void query_addtxt(struct query *q, const uint8_t *dname, uint16_t klass, uint32_t ttl, const char *txt) { size_t txt_length = strlen(txt); uint8_t len = (uint8_t) txt_length; assert(txt_length <= UCHAR_MAX); /* Add the dname */ if (dname >= buffer_begin(q->packet) && dname <= buffer_current(q->packet)) { buffer_write_u16(q->packet, 0xc000 | (dname - buffer_begin(q->packet))); } else { buffer_write(q->packet, dname + 1, *dname); } buffer_write_u16(q->packet, TYPE_TXT); buffer_write_u16(q->packet, klass); buffer_write_u32(q->packet, ttl); buffer_write_u16(q->packet, len + 1); buffer_write_u8(q->packet, len); buffer_write(q->packet, txt, len); } /* * Parse the question section of a query. The normalized query name * is stored in QUERY->name, the class in QUERY->klass, and the type * in QUERY->type. */ static int process_query_section(query_type *query) { uint8_t qnamebuf[MAXDOMAINLEN]; buffer_set_position(query->packet, QHEADERSZ); /* Lets parse the query name and convert it to lower case. */ if(!packet_read_query_section(query->packet, qnamebuf, &query->qtype, &query->qclass)) return 0; query->qname = dname_make(query->region, qnamebuf, 1); query->opcode = OPCODE(query->packet); return 1; } /* * Process an optional EDNS OPT record. Sets QUERY->EDNS to 0 if * there was no EDNS record, to -1 if there was an invalid or * unsupported EDNS record, and to 1 otherwise. Updates QUERY->MAXLEN * if the EDNS record specifies a maximum supported response length. * * Return NSD_RC_FORMAT on failure, NSD_RC_OK on success. */ static nsd_rc_type process_edns(nsd_type* nsd, struct query *q) { if (q->edns.status == EDNS_ERROR) { /* The only error is VERSION not implemented */ return NSD_RC_FORMAT; } if (q->edns.status == EDNS_OK) { /* Only care about UDP size larger than normal... */ if (!q->tcp && q->edns.maxlen > UDP_MAX_MESSAGE_LEN) { size_t edns_size; #if defined(INET6) if (q->addr.ss_family == AF_INET6) { edns_size = nsd->ipv6_edns_size; } else #endif edns_size = nsd->ipv4_edns_size; if (q->edns.maxlen < edns_size) { q->maxlen = q->edns.maxlen; } else { q->maxlen = edns_size; } #if defined(INET6) && !defined(IPV6_USE_MIN_MTU) && !defined(IPV6_MTU) /* * Use IPv6 minimum MTU to avoid sending * packets that are too large for some links. * IPv6 will not automatically fragment in * this case (unlike IPv4). */ if (q->addr.ss_family == AF_INET6 && q->maxlen > IPV6_MIN_MTU) { q->maxlen = IPV6_MIN_MTU; } #endif } /* Strip the OPT resource record off... */ buffer_set_position(q->packet, q->edns.position); buffer_set_limit(q->packet, q->edns.position); ARCOUNT_SET(q->packet, ARCOUNT(q->packet) - 1); } return NSD_RC_OK; } /* * Processes TSIG. * Sets error when tsig does not verify on the query. */ static nsd_rc_type process_tsig(struct query* q) { if(q->tsig.status == TSIG_ERROR) return NSD_RC_FORMAT; if(q->tsig.status == TSIG_OK) { if(!tsig_from_query(&q->tsig)) { log_msg(LOG_ERR, "query: bad tsig (%s)", tsig_error(q->tsig.error_code)); return NSD_RC_NOTAUTH; } buffer_set_limit(q->packet, q->tsig.position); ARCOUNT_SET(q->packet, ARCOUNT(q->packet) - 1); tsig_prepare(&q->tsig); tsig_update(&q->tsig, q->packet, buffer_limit(q->packet)); if(!tsig_verify(&q->tsig)) { log_msg(LOG_ERR, "query: bad tsig signature for key %s", dname_to_string(q->tsig.key->name, NULL)); return NSD_RC_NOTAUTH; } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "query good tsig signature for %s", dname_to_string(q->tsig.key->name, NULL))); } return NSD_RC_OK; } /* * Check notify acl and forward to xfrd (or return an error). */ static query_state_type answer_notify(struct nsd* nsd, struct query *query) { int acl_num, acl_num_xfr; acl_options_t *why; nsd_rc_type rc; zone_options_t* zone_opt; DEBUG(DEBUG_XFRD,1, (LOG_INFO, "got notify %s processing acl", dname_to_string(query->qname, NULL))); zone_opt = zone_options_find(nsd->options, query->qname); if(!zone_opt) return query_error(query, NSD_RC_NXDOMAIN); if(!nsd->this_child) /* we are in debug mode or something */ return query_error(query, NSD_RC_SERVFAIL); if(!tsig_find_rr(&query->tsig, query->packet)) { DEBUG(DEBUG_XFRD,2, (LOG_ERR, "bad tsig RR format")); return query_error(query, NSD_RC_FORMAT); } rc = process_tsig(query); if(rc != NSD_RC_OK) return query_error(query, rc); /* check if it passes acl */ if((acl_num = acl_check_incoming(zone_opt->allow_notify, query, &why)) != -1) { sig_atomic_t mode = NSD_PASS_TO_XFRD; int s = nsd->this_child->parent_fd; uint16_t sz; uint32_t acl_send = htonl(acl_num); uint32_t acl_xfr; size_t pos; assert(why); /* Find priority candidate for request XFR. -1 if no match */ acl_num_xfr = acl_check_incoming( zone_opt->request_xfr, query, NULL); acl_xfr = htonl(acl_num_xfr); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "got notify %s passed acl %s %s", dname_to_string(query->qname, NULL), why->ip_address_spec, why->nokey?"NOKEY": (why->blocked?"BLOCKED":why->key_name))); sz = buffer_limit(query->packet); if(buffer_limit(query->packet) > MAX_PACKET_SIZE) return query_error(query, NSD_RC_SERVFAIL); /* forward to xfrd for processing Note. Blocking IPC I/O, but acl is OK. */ sz = htons(sz); if(!write_socket(s, &mode, sizeof(mode)) || !write_socket(s, &sz, sizeof(sz)) || !write_socket(s, buffer_begin(query->packet), buffer_limit(query->packet)) || !write_socket(s, &acl_send, sizeof(acl_send)) || !write_socket(s, &acl_xfr, sizeof(acl_xfr))) { log_msg(LOG_ERR, "error in IPC notify server2main, %s", strerror(errno)); return query_error(query, NSD_RC_SERVFAIL); } /* create notify reply - keep same query contents */ QR_SET(query->packet); /* This is an answer. */ AA_SET(query->packet); /* we are authoritative. */ ANCOUNT_SET(query->packet, 0); NSCOUNT_SET(query->packet, 0); ARCOUNT_SET(query->packet, 0); RCODE_SET(query->packet, RCODE_OK); /* Error code. */ /* position is right after the query */ pos = buffer_position(query->packet); buffer_clear(query->packet); buffer_set_position(query->packet, pos); VERBOSITY(2, (LOG_INFO, "Notify received and accepted, forward to xfrd")); /* tsig is added in add_additional later (if needed) */ return QUERY_PROCESSED; } if (verbosity > 1) { char address[128]; if (addr2ip(query->addr, address, sizeof(address))) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "addr2ip failed")); strlcpy(address, "[unknown]", sizeof(address)); } VERBOSITY(1, (LOG_INFO, "notify for zone %s from client %s refused, %s%s", dname_to_string(query->qname, NULL), address, why?why->key_name:"no acl matches", why?why->ip_address_spec:".")); } return query_error(query, NSD_RC_REFUSE); } /* * Answer a query in the CHAOS class. */ static query_state_type answer_chaos(struct nsd *nsd, query_type *q) { AA_CLR(q->packet); switch (q->qtype) { case TYPE_ANY: case TYPE_TXT: if ((q->qname->name_size == 11 && memcmp(dname_name(q->qname), "\002id\006server", 11) == 0) || (q->qname->name_size == 15 && memcmp(dname_name(q->qname), "\010hostname\004bind", 15) == 0)) { /* Add ID */ query_addtxt(q, buffer_begin(q->packet) + QHEADERSZ, CLASS_CH, 0, nsd->identity); ANCOUNT_SET(q->packet, ANCOUNT(q->packet) + 1); } else if ((q->qname->name_size == 16 && memcmp(dname_name(q->qname), "\007version\006server", 16) == 0) || (q->qname->name_size == 14 && memcmp(dname_name(q->qname), "\007version\004bind", 14) == 0)) { if(!nsd->options->hide_version) { /* Add version */ query_addtxt(q, buffer_begin(q->packet) + QHEADERSZ, CLASS_CH, 0, nsd->version); ANCOUNT_SET(q->packet, ANCOUNT(q->packet) + 1); } else { RCODE_SET(q->packet, RCODE_REFUSE); } } break; default: RCODE_SET(q->packet, RCODE_REFUSE); break; } return QUERY_PROCESSED; } /* * Find the covering NSEC for a non-existent domain name. Normally * the NSEC will be located at CLOSEST_MATCH, except when it is an * empty non-terminal. In this case the NSEC may be located at the * previous domain name (in canonical ordering). */ static domain_type * find_covering_nsec(domain_type *closest_match, zone_type *zone, rrset_type **nsec_rrset) { assert(closest_match); assert(nsec_rrset); /* loop away temporary created domains. For real ones it is &RBTREE_NULL */ while (closest_match->node.parent == NULL) closest_match = closest_match->parent; while (closest_match) { *nsec_rrset = domain_find_rrset(closest_match, zone, TYPE_NSEC); if (*nsec_rrset) { return closest_match; } if (closest_match == zone->apex) { /* Don't look outside the current zone. */ return NULL; } closest_match = domain_previous(closest_match); } return NULL; } struct additional_rr_types { uint16_t rr_type; rr_section_type rr_section; }; struct additional_rr_types default_additional_rr_types[] = { { TYPE_A, ADDITIONAL_A_SECTION }, { TYPE_AAAA, ADDITIONAL_AAAA_SECTION }, { 0, (rr_section_type) 0 } }; struct additional_rr_types rt_additional_rr_types[] = { { TYPE_A, ADDITIONAL_A_SECTION }, { TYPE_AAAA, ADDITIONAL_AAAA_SECTION }, { TYPE_X25, ADDITIONAL_OTHER_SECTION }, { TYPE_ISDN, ADDITIONAL_OTHER_SECTION }, { 0, (rr_section_type) 0 } }; static void add_additional_rrsets(struct query *query, answer_type *answer, rrset_type *master_rrset, size_t rdata_index, int allow_glue, struct additional_rr_types types[]) { size_t i; assert(query); assert(answer); assert(master_rrset); assert(rdata_atom_is_domain(rrset_rrtype(master_rrset), rdata_index)); for (i = 0; i < master_rrset->rr_count; ++i) { int j; domain_type *additional = rdata_atom_domain(master_rrset->rrs[i].rdatas[rdata_index]); domain_type *match = additional; assert(additional); if (!allow_glue && domain_is_glue(match, query->zone)) continue; /* * Check to see if we need to generate the dependent * based on a wildcard domain. */ while (!match->is_existing) { match = match->parent; } if (additional != match && domain_wildcard_child(match)) { domain_type *wildcard_child = domain_wildcard_child(match); domain_type *temp = (domain_type *) region_alloc( query->region, sizeof(domain_type)); memcpy(&temp->node, &additional->node, sizeof(rbnode_t)); temp->number = additional->number; temp->parent = match; temp->wildcard_child_closest_match = temp; temp->rrsets = wildcard_child->rrsets; temp->is_existing = wildcard_child->is_existing; additional = temp; } for (j = 0; types[j].rr_type != 0; ++j) { rrset_type *rrset = domain_find_rrset( additional, query->zone, types[j].rr_type); if (rrset) { answer_add_rrset(answer, types[j].rr_section, additional, rrset); } } } } static int answer_needs_ns(struct query* query) { assert(query); /* Currently, only troublesome for DNSKEY and DS, * cuz their RRSETs are quite large. */ return (query->qtype != TYPE_DNSKEY && query->qtype != TYPE_DS); } static int add_rrset(struct query *query, answer_type *answer, rr_section_type section, domain_type *owner, rrset_type *rrset) { int result; assert(query); assert(answer); assert(owner); assert(rrset); assert(rrset_rrclass(rrset) == CLASS_IN); result = answer_add_rrset(answer, section, owner, rrset); switch (rrset_rrtype(rrset)) { case TYPE_NS: add_additional_rrsets(query, answer, rrset, 0, 1, default_additional_rr_types); break; case TYPE_MB: add_additional_rrsets(query, answer, rrset, 0, 0, default_additional_rr_types); break; case TYPE_MX: case TYPE_KX: add_additional_rrsets(query, answer, rrset, 1, 0, default_additional_rr_types); break; case TYPE_RT: add_additional_rrsets(query, answer, rrset, 1, 0, rt_additional_rr_types); break; default: break; } return result; } /* returns 0 on error, or the domain number for to_name. from_name is changes to to_name by the DNAME rr. DNAME rr is from src to dest. closest encloser encloses the to_name. */ static uint32_t query_synthesize_cname(struct query* q, struct answer* answer, const dname_type* from_name, const dname_type* to_name, domain_type* src, domain_type* to_closest_encloser, domain_type** to_closest_match) { /* add temporary domains for from_name and to_name and all their (not allocated yet) parents */ /* any domains below src are not_existing (because of DNAME at src) */ int i; domain_type* cname_domain; domain_type* cname_dest; rrset_type* rrset; /* allocate source part */ domain_type* lastparent = src; assert(q && answer && from_name && to_name && src && to_closest_encloser); assert(to_closest_match); for(i=0; i < from_name->label_count - domain_dname(src)->label_count; i++) { domain_type* newdom = query_get_tempdomain(q); if(!newdom) return 0; newdom->is_existing = 1; newdom->parent = lastparent; newdom->node.key = dname_partial_copy(q->region, from_name, domain_dname(src)->label_count + i + 1); if(dname_compare(domain_dname(newdom), q->qname) == 0) { /* 0 good for query name, otherwise new number */ newdom->number = 0; } DEBUG(DEBUG_QUERY,2, (LOG_INFO, "created temp domain src %d. %s nr %d", i, dname_to_string(domain_dname(newdom), NULL), newdom->number)); lastparent = newdom; } cname_domain = lastparent; /* allocate dest part */ lastparent = to_closest_encloser; for(i=0; i < to_name->label_count - domain_dname(to_closest_encloser)->label_count; i++) { domain_type* newdom = query_get_tempdomain(q); if(!newdom) return 0; newdom->is_existing = 0; newdom->parent = lastparent; newdom->node.key = dname_partial_copy(q->region, to_name, domain_dname(to_closest_encloser)->label_count + i + 1); DEBUG(DEBUG_QUERY,2, (LOG_INFO, "created temp domain dest %d. %s nr %d", i, dname_to_string(domain_dname(newdom), NULL), newdom->number)); lastparent = newdom; } cname_dest = lastparent; *to_closest_match = cname_dest; /* allocate the CNAME RR */ rrset = (rrset_type*) region_alloc(q->region, sizeof(rrset_type)); memset(rrset, 0, sizeof(rrset_type)); rrset->zone = q->zone; rrset->rr_count = 1; rrset->rrs = (rr_type*) region_alloc(q->region, sizeof(rr_type)); memset(rrset->rrs, 0, sizeof(rr_type)); rrset->rrs->owner = cname_domain; rrset->rrs->ttl = 0; rrset->rrs->type = TYPE_CNAME; rrset->rrs->klass = CLASS_IN; rrset->rrs->rdata_count = 1; rrset->rrs->rdatas = (rdata_atom_type*)region_alloc(q->region, sizeof(rdata_atom_type)); rrset->rrs->rdatas->domain = cname_dest; if(!add_rrset(q, answer, ANSWER_SECTION, cname_domain, rrset)) { log_msg(LOG_ERR, "could not add synthesized CNAME rrset to packet"); } return cname_dest->number; } /* * Answer delegation information. * * DNSSEC: Include the DS RRset if present. Otherwise include an NSEC * record proving the DS RRset does not exist. */ static void answer_delegation(query_type *query, answer_type *answer) { assert(answer); assert(query->delegation_domain); assert(query->delegation_rrset); if (query->cname_count == 0) { AA_CLR(query->packet); } else { AA_SET(query->packet); } add_rrset(query, answer, AUTHORITY_SECTION, query->delegation_domain, query->delegation_rrset); if (query->edns.dnssec_ok && zone_is_secure(query->zone)) { rrset_type *rrset; if ((rrset = domain_find_rrset(query->delegation_domain, query->zone, TYPE_DS))) { add_rrset(query, answer, AUTHORITY_SECTION, query->delegation_domain, rrset); #ifdef NSEC3 } else if (query->zone->nsec3_soa_rr) { nsec3_answer_delegation(query, answer); #endif } else if ((rrset = domain_find_rrset(query->delegation_domain, query->zone, TYPE_NSEC))) { add_rrset(query, answer, AUTHORITY_SECTION, query->delegation_domain, rrset); } } query->domain = query->delegation_domain; } /* * Answer SOA information. */ static void answer_soa(struct query *query, answer_type *answer) { query->domain = query->zone->apex; if (query->qclass != CLASS_ANY) { add_rrset(query, answer, AUTHORITY_SECTION, query->zone->apex, query->zone->soa_nx_rrset); } } /* * Answer that the domain name exists but there is no RRset with the * requested type. * * DNSSEC: Include the correct NSEC record proving that the type does * not exist. In the wildcard no data (3.1.3.4) case the wildcard IS * NOT expanded, so the ORIGINAL parameter must point to the original * wildcard entry, not to the generated entry. */ static void answer_nodata(struct query *query, answer_type *answer, domain_type *original) { if (query->cname_count == 0) { answer_soa(query, answer); } #ifdef NSEC3 if (query->edns.dnssec_ok && query->zone->nsec3_soa_rr) { nsec3_answer_nodata(query, answer, original); } else #endif if (query->edns.dnssec_ok && zone_is_secure(query->zone)) { domain_type *nsec_domain; rrset_type *nsec_rrset; nsec_domain = find_covering_nsec(original, query->zone, &nsec_rrset); if (nsec_domain) { add_rrset(query, answer, AUTHORITY_SECTION, nsec_domain, nsec_rrset); } } } static void answer_nxdomain(query_type *query, answer_type *answer) { RCODE_SET(query->packet, RCODE_NXDOMAIN); answer_soa(query, answer); } /* * Answer domain information (or SOA if we do not have an RRset for * the type specified by the query). */ static void answer_domain(struct nsd* nsd, struct query *q, answer_type *answer, domain_type *domain, domain_type *original) { rrset_type *rrset; if (q->qtype == TYPE_ANY) { int added = 0; for (rrset = domain_find_any_rrset(domain, q->zone); rrset; rrset = rrset->next) { if (rrset->zone == q->zone #ifdef NSEC3 && rrset_rrtype(rrset) != TYPE_NSEC3 #endif /* * Don't include the RRSIG RRset when * DNSSEC is used, because it is added * automatically on an per-RRset basis. */ && !(q->edns.dnssec_ok && zone_is_secure(q->zone) && rrset_rrtype(rrset) == TYPE_RRSIG)) { add_rrset(q, answer, ANSWER_SECTION, domain, rrset); ++added; } } if (added == 0) { answer_nodata(q, answer, original); return; } #ifdef NSEC3 } else if (q->qtype == TYPE_NSEC3) { answer_nodata(q, answer, original); return; #endif } else if ((rrset = domain_find_rrset(domain, q->zone, q->qtype))) { add_rrset(q, answer, ANSWER_SECTION, domain, rrset); } else if ((rrset = domain_find_rrset(domain, q->zone, TYPE_CNAME))) { int added; /* * If the CNAME is not added it is already in the * answer, so we have a CNAME loop. Don't follow the * CNAME target in this case. */ added = add_rrset(q, answer, ANSWER_SECTION, domain, rrset); assert(rrset->rr_count > 0); if (added) { /* only process first CNAME record */ domain_type *closest_match = rdata_atom_domain(rrset->rrs[0].rdatas[0]); domain_type *closest_encloser = closest_match; zone_type* origzone = q->zone; ++q->cname_count; while (!closest_encloser->is_existing) closest_encloser = closest_encloser->parent; answer_lookup_zone(nsd, q, answer, closest_match->number, closest_match == closest_encloser, closest_match, closest_encloser, domain_dname(closest_match)); q->zone = origzone; } /* example 6.2.7 shows no NS-set from zone in auth (RFC1034) */ q->domain = domain; return; } else { answer_nodata(q, answer, original); return; } q->domain = domain; if (q->qclass != CLASS_ANY && q->zone->ns_rrset && answer_needs_ns(q)) { add_rrset(q, answer, OPTIONAL_AUTHORITY_SECTION, q->zone->apex, q->zone->ns_rrset); } } /* * Answer with authoritative data. If a wildcard is matched the owner * name will be expanded to the domain name specified by * DOMAIN_NUMBER. DOMAIN_NUMBER 0 (zero) is reserved for the original * query name. * * DNSSEC: Include the necessary NSEC records in case the request * domain name does not exist and/or a wildcard match does not exist. */ static void answer_authoritative(struct nsd *nsd, struct query *q, answer_type *answer, uint32_t domain_number, int exact, domain_type *closest_match, domain_type *closest_encloser, const dname_type *qname) { domain_type *match; domain_type *original = closest_match; rrset_type *rrset; #ifdef NSEC3 if(exact && domain_has_only_NSEC3(closest_match, q->zone)) { exact = 0; /* pretend it does not exist */ if(closest_encloser->parent) closest_encloser = closest_encloser->parent; } #endif /* NSEC3 */ if (exact) { match = closest_match; } else if ((rrset=domain_find_rrset(closest_encloser, q->zone, TYPE_DNAME))) { /* process DNAME */ const dname_type* name = qname; domain_type *dest = rdata_atom_domain(rrset->rrs[0].rdatas[0]); int added; assert(rrset->rr_count > 0); if(domain_number != 0) /* we followed CNAMEs or DNAMEs */ name = domain_dname(closest_match); DEBUG(DEBUG_QUERY,2, (LOG_INFO, "expanding DNAME for q=%s", dname_to_string(name, NULL))); DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->src is %s", dname_to_string(domain_dname(closest_encloser), NULL))); DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->dest is %s", dname_to_string(domain_dname(dest), NULL))); /* if the DNAME set is not added we have a loop, do not follow */ added = add_rrset(q, answer, ANSWER_SECTION, closest_encloser, rrset); if(added) { domain_type* src = closest_encloser; const dname_type* newname = dname_replace(q->region, name, domain_dname(src), domain_dname(dest)); uint32_t newnum = 0; zone_type* origzone = q->zone; ++q->cname_count; if(!newname) { /* newname too long */ RCODE_SET(q->packet, RCODE_YXDOMAIN); return; } DEBUG(DEBUG_QUERY,2, (LOG_INFO, "->result is %s", dname_to_string(newname, NULL))); /* follow the DNAME */ exact = namedb_lookup(nsd->db, newname, &closest_match, &closest_encloser); /* synthesize CNAME record */ newnum = query_synthesize_cname(q, answer, name, newname, src, closest_encloser, &closest_match); if(!newnum) { /* could not synthesize the CNAME. */ /* return previous CNAMEs to make resolver recurse for us */ return; } while (closest_encloser && !closest_encloser->is_existing) closest_encloser = closest_encloser->parent; answer_lookup_zone(nsd, q, answer, newnum, closest_match == closest_encloser, closest_match, closest_encloser, newname); q->zone = origzone; } if(!added) /* log the error so operator can find looping recursors */ log_msg(LOG_INFO, "DNAME processing stopped due to loop, qname %s", dname_to_string(q->qname, NULL)); return; } else if (domain_wildcard_child(closest_encloser)) { /* Generate the domain from the wildcard. */ domain_type *wildcard_child = domain_wildcard_child(closest_encloser); #ifdef RATELIMIT q->wildcard_domain = wildcard_child; #endif match = (domain_type *) region_alloc(q->region, sizeof(domain_type)); memcpy(&match->node, &wildcard_child->node, sizeof(rbnode_t)); match->parent = closest_encloser; match->wildcard_child_closest_match = match; match->number = domain_number; match->rrsets = wildcard_child->rrsets; match->is_existing = wildcard_child->is_existing; #ifdef NSEC3 match->nsec3_cover = wildcard_child->nsec3_cover; #ifdef FULL_PREHASH match->nsec3_is_exact = wildcard_child->nsec3_is_exact; match->nsec3_wcard_child_cover = wildcard_child->nsec3_wcard_child_cover; match->nsec3_ds_parent_is_exact = wildcard_child->nsec3_ds_parent_is_exact; match->nsec3_ds_parent_cover = wildcard_child->nsec3_ds_parent_cover; #endif if (q->edns.dnssec_ok && q->zone->nsec3_soa_rr) { /* Only add nsec3 wildcard data when do bit is set */ nsec3_answer_wildcard(q, answer, wildcard_child, nsd->db, qname); } #endif /* * Remember the original domain in case a Wildcard No * Data (3.1.3.4) response needs to be generated. In * this particular case the wildcard IS NOT * expanded. */ original = wildcard_child; } else { match = NULL; } /* Authorative zone. */ #ifdef NSEC3 if (q->edns.dnssec_ok && q->zone->nsec3_soa_rr) { nsec3_answer_authoritative(&match, q, answer, closest_encloser, nsd->db, qname); } else #endif if (q->edns.dnssec_ok && zone_is_secure(q->zone)) { if (match != closest_encloser) { domain_type *nsec_domain; rrset_type *nsec_rrset; /* * No match found or generated from wildcard, * include NSEC record. */ nsec_domain = find_covering_nsec(closest_match, q->zone, &nsec_rrset); if (nsec_domain) { add_rrset(q, answer, AUTHORITY_SECTION, nsec_domain, nsec_rrset); } } if (!match) { domain_type *nsec_domain; rrset_type *nsec_rrset; /* * No match and no wildcard. Include NSEC * proving there is no wildcard. */ nsec_domain = find_covering_nsec(closest_encloser->wildcard_child_closest_match, q->zone, &nsec_rrset); if (nsec_domain) { add_rrset(q, answer, AUTHORITY_SECTION, nsec_domain, nsec_rrset); } } } #ifdef NSEC3 if (RCODE(q->packet)!=RCODE_OK) { return; /* nsec3 collision failure */ } #endif if (match) { answer_domain(nsd, q, answer, match, original); } else { answer_nxdomain(q, answer); } } /* * qname may be different after CNAMEs have been followed from query->qname. */ static void answer_lookup_zone(struct nsd *nsd, struct query *q, answer_type *answer, uint32_t domain_number, int exact, domain_type *closest_match, domain_type *closest_encloser, const dname_type *qname) { q->zone = domain_find_zone(closest_encloser); if (!q->zone) { if(q->cname_count == 0) RCODE_SET(q->packet, RCODE_SERVFAIL); return; } /* * See RFC 4035 (DNSSEC protocol) section 3.1.4.1 Responding * to Queries for DS RRs. */ if (exact && q->qtype == TYPE_DS && closest_encloser == q->zone->apex) { /* * Type DS query at a zone cut, use the responsible * parent zone to generate the answer if we are * authoritative for the parent zone. */ zone_type *zone = domain_find_parent_zone(q->zone); if (zone) q->zone = zone; } /* see if the zone has expired (for secondary zones) */ if(q->zone && q->zone->opts && zone_is_slave(q->zone->opts) && !q->zone->is_ok) { if(q->cname_count == 0) RCODE_SET(q->packet, RCODE_SERVFAIL); return; } if (exact && q->qtype == TYPE_DS && closest_encloser == q->zone->apex) { /* * Type DS query at the zone apex (and the server is * not authoratitive for the parent zone). */ if (q->qclass == CLASS_ANY) { AA_CLR(q->packet); } else { AA_SET(q->packet); } answer_nodata(q, answer, closest_encloser); } else { q->delegation_domain = domain_find_ns_rrsets( closest_encloser, q->zone, &q->delegation_rrset); if (!q->delegation_domain || (exact && q->qtype == TYPE_DS && closest_encloser == q->delegation_domain)) { if (q->qclass == CLASS_ANY) { AA_CLR(q->packet); } else { AA_SET(q->packet); } answer_authoritative(nsd, q, answer, domain_number, exact, closest_match, closest_encloser, qname); } else { answer_delegation(q, answer); } } } static void answer_query(struct nsd *nsd, struct query *q) { domain_type *closest_match; domain_type *closest_encloser; int exact; uint16_t offset; answer_type answer; answer_init(&answer); exact = namedb_lookup(nsd->db, q->qname, &closest_match, &closest_encloser); if (!closest_encloser->is_existing) { exact = 0; while (closest_encloser != NULL && !closest_encloser->is_existing) closest_encloser = closest_encloser->parent; } if(!closest_encloser) { RCODE_SET(q->packet, RCODE_SERVFAIL); return; } q->domain = closest_encloser; answer_lookup_zone(nsd, q, &answer, 0, exact, closest_match, closest_encloser, q->qname); #ifdef USE_ZONE_STATS if (q->zone) { ZTATUP2(q->zone, opcode, q->opcode); ZTATUP2(q->zone, qtype, q->qtype); ZTATUP2(q->zone, opcode, q->qclass); } #endif offset = dname_label_offsets(q->qname)[domain_dname(closest_encloser)->label_count - 1] + QHEADERSZ; query_add_compression_domain(q, closest_encloser, offset); encode_answer(q, &answer); query_clear_compression_tables(q); } void query_prepare_response(query_type *q) { uint16_t flags; /* * Preserve the data up-to the current packet's limit. */ buffer_set_position(q->packet, buffer_limit(q->packet)); buffer_set_limit(q->packet, buffer_capacity(q->packet)); /* * Reserve space for the EDNS records if required. */ q->reserved_space = edns_reserved_space(&q->edns); q->reserved_space += tsig_reserved_space(&q->tsig); /* Update the flags. */ flags = FLAGS(q->packet); flags &= 0x0100U; /* Preserve the RD flag. */ /* CD flag must be cleared for auth answers */ flags |= 0x8000U; /* Set the QR flag. */ FLAGS_SET(q->packet, flags); } /* * Processes the query. * */ query_state_type query_process(query_type *q, nsd_type *nsd) { /* The query... */ nsd_rc_type rc; query_state_type query_state; uint16_t arcount; /* Sanity checks */ if (buffer_limit(q->packet) < QHEADERSZ) { /* packet too small to contain DNS header. Now packet investigation macros will work without problems. */ return QUERY_DISCARDED; } if (QR(q->packet)) { /* Not a query? Drop it on the floor. */ return QUERY_DISCARDED; } if (RCODE(q->packet) != RCODE_OK || !process_query_section(q)) { return query_formerr(q); } /* Update statistics. */ STATUP2(nsd, opcode, q->opcode); STATUP2(nsd, qtype, q->qtype); STATUP2(nsd, qclass, q->qclass); if (q->opcode != OPCODE_QUERY) { if (q->opcode == OPCODE_NOTIFY) { return answer_notify(nsd, q); } else { return query_error(q, NSD_RC_IMPL); } } /* Dont bother to answer more than one question at once... */ if (QDCOUNT(q->packet) != 1) { FLAGS_SET(q->packet, 0); return query_formerr(q); } /* Ignore settings of flags */ /* Dont allow any records in the answer or authority section... except for IXFR queries. */ if (ANCOUNT(q->packet) != 0 || (q->qtype!=TYPE_IXFR && NSCOUNT(q->packet) != 0)) { return query_formerr(q); } if(q->qtype==TYPE_IXFR && NSCOUNT(q->packet) > 0) { int i; /* skip ixfr soa information data here */ for(i=0; i< NSCOUNT(q->packet); i++) if(!packet_skip_rr(q->packet, 0)) return query_formerr(q); } arcount = ARCOUNT(q->packet); if (arcount > 0) { /* According to RFC 6891: * "The placement flexibility for the OPT RR does not * override the need for the TSIG or SIG(0) RRs to be * the last in the additional section whenever they are * present." * So we should not have to check for TSIG RR before * OPT RR. Keep the code for backwards compatibility. */ /* see if tsig is before edns record */ if (!tsig_parse_rr(&q->tsig, q->packet)) return query_formerr(q); if(q->tsig.status != TSIG_NOT_PRESENT) --arcount; } /* See if there is an OPT RR. */ if (arcount > 0) { if (edns_parse_record(&q->edns, q->packet)) --arcount; } /* See if there is a TSIG RR. */ if (arcount > 0 && q->tsig.status == TSIG_NOT_PRESENT) { /* see if tsig is after the edns record */ if (!tsig_parse_rr(&q->tsig, q->packet)) return query_formerr(q); if(q->tsig.status != TSIG_NOT_PRESENT) --arcount; } /* If more RRs left in Add. Section, FORMERR. */ if (arcount > 0) { return query_formerr(q); } /* Do we have any trailing garbage? */ #ifdef STRICT_MESSAGE_PARSE if (buffer_remaining(q->packet) > 0) { /* If we're strict.... */ return query_formerr(q); } #endif /* Remove trailing garbage. */ buffer_set_limit(q->packet, buffer_position(q->packet)); rc = process_tsig(q); if (rc != NSD_RC_OK) { return query_error(q, rc); } rc = process_edns(nsd, q); if (rc != NSD_RC_OK) { /* We should not return FORMERR, but BADVERS (=16). * BADVERS is created with Ext. RCODE, followed by RCODE. * Ext. RCODE is set to 1, RCODE must be 0 (getting 0x10 = 16). * Thus RCODE = NOERROR = NSD_RC_OK. */ return query_error(q, NSD_RC_OK); } query_prepare_response(q); if (q->qclass != CLASS_IN && q->qclass != CLASS_ANY) { if (q->qclass == CLASS_CH) { return answer_chaos(nsd, q); } else { return query_error(q, NSD_RC_REFUSE); } } query_state = answer_axfr_ixfr(nsd, q); if (query_state == QUERY_PROCESSED || query_state == QUERY_IN_AXFR) { return query_state; } answer_query(nsd, q); return QUERY_PROCESSED; } void query_add_optional(query_type *q, nsd_type *nsd) { struct edns_data *edns = &nsd->edns_ipv4; #if defined(INET6) if (q->addr.ss_family == AF_INET6) { edns = &nsd->edns_ipv6; } #endif if (RCODE(q->packet) == RCODE_FORMAT) { return; } switch (q->edns.status) { case EDNS_NOT_PRESENT: break; case EDNS_OK: if (q->edns.dnssec_ok) edns->ok[7] = 0x80; else edns->ok[7] = 0x00; buffer_write(q->packet, edns->ok, OPT_LEN); if (nsd->nsid_len > 0 && q->edns.nsid == 1 && !query_overflow_nsid(q, nsd->nsid_len)) { /* rdata length */ buffer_write(q->packet, edns->rdata_nsid, OPT_RDATA); /* nsid opt header */ buffer_write(q->packet, edns->nsid, OPT_HDR); /* nsid payload */ buffer_write(q->packet, nsd->nsid, nsd->nsid_len); } else { /* fill with NULLs */ buffer_write(q->packet, edns->rdata_none, OPT_RDATA); } ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1); STATUP(nsd, edns); #ifdef USE_ZONE_STATS if (q->zone) { ZTATUP(q->zone, edns); } #endif break; case EDNS_ERROR: if (q->edns.dnssec_ok) edns->error[7] = 0x80; else edns->error[7] = 0x00; buffer_write(q->packet, edns->error, OPT_LEN); buffer_write(q->packet, edns->rdata_none, OPT_RDATA); ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1); STATUP(nsd, ednserr); #ifdef USE_ZONE_STATS if (q->zone) { ZTATUP(q->zone, ednserr); } #endif break; } if (q->tsig.status != TSIG_NOT_PRESENT) { if (q->tsig.status == TSIG_ERROR || q->tsig.error_code != TSIG_ERROR_NOERROR) { tsig_error_reply(&q->tsig); tsig_append_rr(&q->tsig, q->packet); ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1); } else if(q->tsig.status == TSIG_OK && q->tsig.error_code == TSIG_ERROR_NOERROR) { if(q->tsig_prepare_it) tsig_prepare(&q->tsig); if(q->tsig_update_it) tsig_update(&q->tsig, q->packet, buffer_position(q->packet)); if(q->tsig_sign_it) { tsig_sign(&q->tsig); tsig_append_rr(&q->tsig, q->packet); ARCOUNT_SET(q->packet, ARCOUNT(q->packet) + 1); } } } } nsd-3.2.16/dns.c0000664000175000017500000004755412162277142012326 0ustar matjematje/* * dns.c -- DNS definitions. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include #include #ifdef HAVE_STRINGS_H #include #endif #include "dns.h" #include "zonec.h" #include "zparser.h" /* Taken from RFC 1035, section 3.2.4. */ static lookup_table_type dns_rrclasses[] = { { CLASS_IN, "IN" }, /* the Internet */ { CLASS_CS, "CS" }, /* the CSNET class (Obsolete) */ { CLASS_CH, "CH" }, /* the CHAOS class */ { CLASS_HS, "HS" }, /* Hesiod */ { 0, NULL } }; static rrtype_descriptor_type rrtype_descriptors[(RRTYPE_DESCRIPTORS_LENGTH+1)] = { /* 0 */ { 0, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 1 */ { TYPE_A, "A", T_A, 1, 1, { RDATA_WF_A }, { RDATA_ZF_A } }, /* 2 */ { TYPE_NS, "NS", T_NS, 1, 1, { RDATA_WF_COMPRESSED_DNAME }, { RDATA_ZF_DNAME } }, /* 3 */ { TYPE_MD, "MD", T_MD, 1, 1, { RDATA_WF_UNCOMPRESSED_DNAME }, { RDATA_ZF_DNAME } }, /* 4 */ { TYPE_MF, "MF", T_MF, 1, 1, { RDATA_WF_UNCOMPRESSED_DNAME }, { RDATA_ZF_DNAME } }, /* 5 */ { TYPE_CNAME, "CNAME", T_CNAME, 1, 1, { RDATA_WF_COMPRESSED_DNAME }, { RDATA_ZF_DNAME } }, /* 6 */ { TYPE_SOA, "SOA", T_SOA, 7, 7, { RDATA_WF_COMPRESSED_DNAME, RDATA_WF_COMPRESSED_DNAME, RDATA_WF_LONG, RDATA_WF_LONG, RDATA_WF_LONG, RDATA_WF_LONG, RDATA_WF_LONG }, { RDATA_ZF_DNAME, RDATA_ZF_DNAME, RDATA_ZF_PERIOD, RDATA_ZF_PERIOD, RDATA_ZF_PERIOD, RDATA_ZF_PERIOD, RDATA_ZF_PERIOD } }, /* 7 */ { TYPE_MB, "MB", T_MB, 1, 1, { RDATA_WF_COMPRESSED_DNAME }, { RDATA_ZF_DNAME } }, /* 8 */ { TYPE_MG, "MG", T_MG, 1, 1, { RDATA_WF_COMPRESSED_DNAME }, { RDATA_ZF_DNAME } }, /* 9 */ { TYPE_MR, "MR", T_MR, 1, 1, { RDATA_WF_COMPRESSED_DNAME }, { RDATA_ZF_DNAME } }, /* 10 */ { TYPE_NULL, "NULL", T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 11 */ { TYPE_WKS, "WKS", T_WKS, 2, 2, { RDATA_WF_A, RDATA_WF_BINARY }, { RDATA_ZF_A, RDATA_ZF_SERVICES } }, /* 12 */ { TYPE_PTR, "PTR", T_PTR, 1, 1, { RDATA_WF_COMPRESSED_DNAME }, { RDATA_ZF_DNAME } }, /* 13 */ { TYPE_HINFO, "HINFO", T_HINFO, 2, 2, { RDATA_WF_TEXT, RDATA_WF_TEXT }, { RDATA_ZF_TEXT, RDATA_ZF_TEXT } }, /* 14 */ { TYPE_MINFO, "MINFO", T_MINFO, 2, 2, { RDATA_WF_COMPRESSED_DNAME, RDATA_WF_COMPRESSED_DNAME }, { RDATA_ZF_DNAME, RDATA_ZF_DNAME } }, /* 15 */ { TYPE_MX, "MX", T_MX, 2, 2, { RDATA_WF_SHORT, RDATA_WF_COMPRESSED_DNAME }, { RDATA_ZF_SHORT, RDATA_ZF_DNAME } }, /* 16 */ { TYPE_TXT, "TXT", T_TXT, 1, 1, { RDATA_WF_TEXTS }, { RDATA_ZF_TEXTS } }, /* 17 */ { TYPE_RP, "RP", T_RP, 2, 2, { RDATA_WF_UNCOMPRESSED_DNAME, RDATA_WF_UNCOMPRESSED_DNAME }, { RDATA_ZF_DNAME, RDATA_ZF_DNAME } }, /* 18 */ { TYPE_AFSDB, "AFSDB", T_AFSDB, 2, 2, { RDATA_WF_SHORT, RDATA_WF_UNCOMPRESSED_DNAME }, { RDATA_ZF_SHORT, RDATA_ZF_DNAME } }, /* 19 */ { TYPE_X25, "X25", T_X25, 1, 1, { RDATA_WF_TEXT }, { RDATA_ZF_TEXT } }, /* 20 */ { TYPE_ISDN, "ISDN", T_ISDN, 1, 2, { RDATA_WF_TEXT, RDATA_WF_TEXT }, { RDATA_ZF_TEXT, RDATA_ZF_TEXT } }, /* 21 */ { TYPE_RT, "RT", T_RT, 2, 2, { RDATA_WF_SHORT, RDATA_WF_UNCOMPRESSED_DNAME }, { RDATA_ZF_SHORT, RDATA_ZF_DNAME } }, /* 22 */ { TYPE_NSAP, "NSAP", T_NSAP, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_NSAP } }, /* 23 */ { 23, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 24 */ { TYPE_SIG, "SIG", T_SIG, 9, 9, { RDATA_WF_SHORT, RDATA_WF_BYTE, RDATA_WF_BYTE, RDATA_WF_LONG, RDATA_WF_LONG, RDATA_WF_LONG, RDATA_WF_SHORT, RDATA_WF_UNCOMPRESSED_DNAME, RDATA_WF_BINARY }, { RDATA_ZF_RRTYPE, RDATA_ZF_BYTE, RDATA_ZF_BYTE, RDATA_ZF_PERIOD, RDATA_ZF_TIME, RDATA_ZF_TIME, RDATA_ZF_SHORT, RDATA_ZF_DNAME, RDATA_ZF_BASE64 } }, /* 25 */ { TYPE_KEY, "KEY", T_KEY, 4, 4, { RDATA_WF_SHORT, RDATA_WF_BYTE, RDATA_WF_BYTE, RDATA_WF_BINARY }, { RDATA_ZF_SHORT, RDATA_ZF_BYTE, RDATA_ZF_ALGORITHM, RDATA_ZF_BASE64 } }, /* 26 */ { TYPE_PX, "PX", T_PX, 3, 3, { RDATA_WF_SHORT, RDATA_WF_UNCOMPRESSED_DNAME, RDATA_WF_UNCOMPRESSED_DNAME }, { RDATA_ZF_SHORT, RDATA_ZF_DNAME, RDATA_ZF_DNAME } }, /* 27 */ { 27, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 28 */ { TYPE_AAAA, "AAAA", T_AAAA, 1, 1, { RDATA_WF_AAAA }, { RDATA_ZF_AAAA } }, /* 29 */ { TYPE_LOC, "LOC", T_LOC, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_LOC } }, /* 30 */ { TYPE_NXT, "NXT", T_NXT, 2, 2, { RDATA_WF_UNCOMPRESSED_DNAME, RDATA_WF_BINARY }, { RDATA_ZF_DNAME, RDATA_ZF_NXT } }, /* 31 */ { 31, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 32 */ { 32, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 33 */ { TYPE_SRV, "SRV", T_SRV, 4, 4, { RDATA_WF_SHORT, RDATA_WF_SHORT, RDATA_WF_SHORT, RDATA_WF_UNCOMPRESSED_DNAME }, { RDATA_ZF_SHORT, RDATA_ZF_SHORT, RDATA_ZF_SHORT, RDATA_ZF_DNAME } }, /* 34 */ { 34, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 35 */ { TYPE_NAPTR, "NAPTR", T_NAPTR, 6, 6, { RDATA_WF_SHORT, RDATA_WF_SHORT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_UNCOMPRESSED_DNAME }, { RDATA_ZF_SHORT, RDATA_ZF_SHORT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_DNAME } }, /* 36 */ { TYPE_KX, "KX", T_KX, 2, 2, { RDATA_WF_SHORT, RDATA_WF_UNCOMPRESSED_DNAME }, { RDATA_ZF_SHORT, RDATA_ZF_DNAME } }, /* 37 */ { TYPE_CERT, "CERT", T_CERT, 4, 4, { RDATA_WF_SHORT, RDATA_WF_SHORT, RDATA_WF_BYTE, RDATA_WF_BINARY }, { RDATA_ZF_CERTIFICATE_TYPE, RDATA_ZF_SHORT, RDATA_ZF_ALGORITHM, RDATA_ZF_BASE64 } }, /* 38 */ { TYPE_A6, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 39 */ { TYPE_DNAME, "DNAME", T_DNAME, 1, 1, { RDATA_WF_UNCOMPRESSED_DNAME }, { RDATA_ZF_DNAME } }, /* 40 */ { 40, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 41 */ { TYPE_OPT, "OPT", T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 42 */ { TYPE_APL, "APL", T_APL, 0, MAXRDATALEN, { RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL, RDATA_WF_APL }, { RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL, RDATA_ZF_APL } }, /* 43 */ { TYPE_DS, "DS", T_DS, 4, 4, { RDATA_WF_SHORT, RDATA_WF_BYTE, RDATA_WF_BYTE, RDATA_WF_BINARY }, { RDATA_ZF_SHORT, RDATA_ZF_ALGORITHM, RDATA_ZF_BYTE, RDATA_ZF_HEX } }, /* 44 */ { TYPE_SSHFP, "SSHFP", T_SSHFP, 3, 3, { RDATA_WF_BYTE, RDATA_WF_BYTE, RDATA_WF_BINARY }, { RDATA_ZF_BYTE, RDATA_ZF_BYTE, RDATA_ZF_HEX } }, /* 45 */ { TYPE_IPSECKEY, "IPSECKEY", T_IPSECKEY, 4, 5, { RDATA_WF_BYTE, RDATA_WF_BYTE, RDATA_WF_BYTE, RDATA_WF_IPSECGATEWAY, RDATA_WF_BINARY }, { RDATA_ZF_BYTE, RDATA_ZF_BYTE, RDATA_ZF_BYTE, RDATA_ZF_IPSECGATEWAY, RDATA_ZF_BASE64 } }, /* 46 */ { TYPE_RRSIG, "RRSIG", T_RRSIG, 9, 9, { RDATA_WF_SHORT, RDATA_WF_BYTE, RDATA_WF_BYTE, RDATA_WF_LONG, RDATA_WF_LONG, RDATA_WF_LONG, RDATA_WF_SHORT, RDATA_WF_LITERAL_DNAME, RDATA_WF_BINARY }, { RDATA_ZF_RRTYPE, RDATA_ZF_ALGORITHM, RDATA_ZF_BYTE, RDATA_ZF_PERIOD, RDATA_ZF_TIME, RDATA_ZF_TIME, RDATA_ZF_SHORT, RDATA_ZF_LITERAL_DNAME, RDATA_ZF_BASE64 } }, /* 47 */ { TYPE_NSEC, "NSEC", T_NSEC, 2, 2, { RDATA_WF_LITERAL_DNAME, RDATA_WF_BINARY }, { RDATA_ZF_LITERAL_DNAME, RDATA_ZF_NSEC } }, /* 48 */ { TYPE_DNSKEY, "DNSKEY", T_DNSKEY, 4, 4, { RDATA_WF_SHORT, RDATA_WF_BYTE, RDATA_WF_BYTE, RDATA_WF_BINARY }, { RDATA_ZF_SHORT, RDATA_ZF_BYTE, RDATA_ZF_ALGORITHM, RDATA_ZF_BASE64 } }, /* 49 */ { TYPE_DHCID, "DHCID", T_DHCID, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_BASE64 } }, /* 50 */ { TYPE_NSEC3, "NSEC3", T_NSEC3, 6, 6, { RDATA_WF_BYTE, /* hash type */ RDATA_WF_BYTE, /* flags */ RDATA_WF_SHORT, /* iterations */ RDATA_WF_BINARYWITHLENGTH, /* salt */ RDATA_WF_BINARYWITHLENGTH, /* next hashed name */ RDATA_WF_BINARY /* type bitmap */ }, { RDATA_ZF_BYTE, RDATA_ZF_BYTE, RDATA_ZF_SHORT, RDATA_ZF_HEX_LEN, RDATA_ZF_BASE32, RDATA_ZF_NSEC } }, /* 51 */ { TYPE_NSEC3PARAM, "NSEC3PARAM", T_NSEC3PARAM, 4, 4, { RDATA_WF_BYTE, /* hash type */ RDATA_WF_BYTE, /* flags */ RDATA_WF_SHORT, /* iterations */ RDATA_WF_BINARYWITHLENGTH /* salt */ }, { RDATA_ZF_BYTE, RDATA_ZF_BYTE, RDATA_ZF_SHORT, RDATA_ZF_HEX_LEN } }, /* 52 */ { TYPE_TLSA, "TLSA", T_TLSA, 4, 4, { RDATA_WF_BYTE, /* usage */ RDATA_WF_BYTE, /* selector */ RDATA_WF_BYTE, /* matching type */ RDATA_WF_BINARY }, /* certificate association data */ { RDATA_ZF_BYTE, RDATA_ZF_BYTE, RDATA_ZF_BYTE, RDATA_ZF_HEX } }, /* 53 */ { 53, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 54 */ { 54, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 55 */ { 55, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 56 */ { 56, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 57 */ { 57, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 58 */ { 58, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 59 */ { 59, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 60 */ { 60, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 61 */ { 61, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 62 */ { 62, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 63 */ { 63, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 64 */ { 64, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 65 */ { 65, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 66 */ { 66, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 67 */ { 67, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 68 */ { 68, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 69 */ { 69, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 70 */ { 70, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 71 */ { 71, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 72 */ { 72, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 73 */ { 73, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 74 */ { 74, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 75 */ { 75, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 76 */ { 76, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 77 */ { 77, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 78 */ { 78, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 79 */ { 79, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 80 */ { 80, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 81 */ { 81, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 82 */ { 82, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 83 */ { 83, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 84 */ { 84, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 85 */ { 85, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 86 */ { 86, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 87 */ { 87, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 88 */ { 88, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 89 */ { 89, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 90 */ { 90, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 91 */ { 91, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 92 */ { 92, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 93 */ { 93, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 94 */ { 94, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 95 */ { 95, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 96 */ { 96, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 97 */ { 97, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 98 */ { 98, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 99 */ { TYPE_SPF, "SPF", T_SPF, 1, MAXRDATALEN, { RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT, RDATA_WF_TEXT }, { RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT, RDATA_ZF_TEXT } }, /* 100 */ { 100, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 101 */ { 101, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 102 */ { 102, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 103 */ { 103, NULL, T_UTYPE, 1, 1, { RDATA_WF_BINARY }, { RDATA_ZF_UNKNOWN } }, /* 104 */ { TYPE_NID, "NID", T_NID, 2, 2, { RDATA_WF_SHORT, RDATA_WF_ILNP64 }, { RDATA_ZF_SHORT, RDATA_ZF_ILNP64 } }, /* 105 */ { TYPE_L32, "L32", T_L32, 2, 2, { RDATA_WF_SHORT, RDATA_WF_A }, { RDATA_ZF_SHORT, RDATA_ZF_A } }, /* 106 */ { TYPE_L64, "L64", T_L64, 2, 2, { RDATA_WF_SHORT, RDATA_WF_ILNP64 }, { RDATA_ZF_SHORT, RDATA_ZF_ILNP64 } }, /* 107 */ { TYPE_LP, "LP", T_LP, 2, 2, { RDATA_WF_SHORT, RDATA_WF_UNCOMPRESSED_DNAME }, { RDATA_ZF_SHORT, RDATA_ZF_DNAME } }, #ifdef DRAFT_RRTYPES /* 108 */ { TYPE_EUI48, "EUI48", T_EUI48, 1, 1, { RDATA_WF_EUI48 }, { RDATA_ZF_EUI48 } }, /* 109 */ { TYPE_EUI64, "EUI64", T_EUI64, 1, 1, { RDATA_WF_EUI64 }, { RDATA_ZF_EUI64 } }, #endif /* 32769 */ { TYPE_DLV, "DLV", T_DLV, 4, 4, { RDATA_WF_SHORT, RDATA_WF_BYTE, RDATA_WF_BYTE, RDATA_WF_BINARY }, { RDATA_ZF_SHORT, RDATA_ZF_ALGORITHM, RDATA_ZF_BYTE, RDATA_ZF_HEX } }, }; rrtype_descriptor_type * rrtype_descriptor_by_type(uint16_t type) { if (type < RRTYPE_DESCRIPTORS_LENGTH) return &rrtype_descriptors[type]; else if (type == TYPE_DLV) return &rrtype_descriptors[PSEUDO_TYPE_DLV]; return &rrtype_descriptors[0]; } rrtype_descriptor_type * rrtype_descriptor_by_name(const char *name) { int i; for (i = 0; i < RRTYPE_DESCRIPTORS_LENGTH; ++i) { if (rrtype_descriptors[i].name && strcasecmp(rrtype_descriptors[i].name, name) == 0) { return &rrtype_descriptors[i]; } } if (rrtype_descriptors[PSEUDO_TYPE_DLV].name && strcasecmp(rrtype_descriptors[PSEUDO_TYPE_DLV].name, name) == 0) { return &rrtype_descriptors[PSEUDO_TYPE_DLV]; } return NULL; } const char * rrtype_to_string(uint16_t rrtype) { static char buf[20]; rrtype_descriptor_type *descriptor = rrtype_descriptor_by_type(rrtype); if (descriptor->name) { return descriptor->name; } else { snprintf(buf, sizeof(buf), "TYPE%d", (int) rrtype); return buf; } } /* * Lookup the type in the ztypes lookup table. If not found, check if * the type uses the "TYPExxx" notation for unknown types. * * Return 0 if no type matches. */ uint16_t rrtype_from_string(const char *name) { char *end; long rrtype; rrtype_descriptor_type *entry; entry = rrtype_descriptor_by_name(name); if (entry) { return entry->type; } if (strlen(name) < 5) return 0; if (strncasecmp(name, "TYPE", 4) != 0) return 0; if (!isdigit((int)name[4])) return 0; /* The rest from the string must be a number. */ rrtype = strtol(name + 4, &end, 10); if (*end != '\0') return 0; if (rrtype < 0 || rrtype > 65535L) return 0; return (uint16_t) rrtype; } const char * rrclass_to_string(uint16_t rrclass) { static char buf[20]; lookup_table_type *entry = lookup_by_id(dns_rrclasses, rrclass); if (entry) { assert(strlen(entry->name) < sizeof(buf)); strlcpy(buf, entry->name, sizeof(buf)); } else { snprintf(buf, sizeof(buf), "CLASS%d", (int) rrclass); } return buf; } uint16_t rrclass_from_string(const char *name) { char *end; long rrclass; lookup_table_type *entry; entry = lookup_by_name(dns_rrclasses, name); if (entry) { return (uint16_t) entry->id; } if (strlen(name) < 6) return 0; if (strncasecmp(name, "CLASS", 5) != 0) return 0; if (!isdigit((int)name[5])) return 0; /* The rest from the string must be a number. */ rrclass = strtol(name + 5, &end, 10); if (*end != '\0') return 0; if (rrclass < 0 || rrclass > 65535L) return 0; return (uint16_t) rrclass; } nsd-3.2.16/configure.ac0000664000175000017500000006037312162277142013656 0ustar matjematjednl dnl Some global settings dnl sinclude(acx_nlnetlabs.m4) AC_INIT(NSD,3.2.16,nsd-bugs@nlnetlabs.nl) AC_CONFIG_HEADER([config.h]) AC_AIX dnl dnl By default set $sysconfdir to /etc and $localstatedir to /var dnl case "$prefix" in NONE) case "$sysconfdir" in '${prefix}/etc') sysconfdir=/etc ;; esac case "$localstatedir" in '${prefix}/var') localstatedir=/var ;; esac ;; esac # # Determine configuration directory # configdir=$sysconfdir/nsd AC_ARG_WITH([configdir], AC_HELP_STRING([--with-configdir=dir], [NSD configuration directory]), [configdir=$withval]) AC_SUBST(configdir) # # Determine configuration file nsd_conf_file=${configdir}/nsd.conf AC_ARG_WITH([nsd_conf_file], AC_HELP_STRING([--with-nsd_conf_file=path], [Pathname to the NSD configuration file]), [nsd_conf_file=$withval]) AC_SUBST(nsd_conf_file) # the eval is to evaluate shell expansion twice, once # for $nsd_conf_file and once for the ${prefix} within it. AC_DEFINE_UNQUOTED(CONFIGFILE, ["`eval echo $nsd_conf_file`"], [Pathname to the NSD configuration file]) # # Determine start and kill priorities start_priority=45 AC_ARG_WITH([start_priority], AC_HELP_STRING([--with-start_priority=number], [NSD startup priority]), [start_priority=$withval]) AC_SUBST(start_priority) kill_priority=74 AC_ARG_WITH([kill_priority], AC_HELP_STRING([--with-kill_priority=number], [NSD shutdown priority]), [kill_priority=$withval]) AC_SUBST(kill_priority) # # Default logfile # logfile=${localstatedir}/log/nsd.log AC_SUBST(logfile) # # Database directory # dbdir=${localstatedir}/db/nsd # # Determine the pidfile location. Check if /var/run exists, if so set pidfile # to /var/run/nsd.pid by default # if test -d ${localstatedir}/run; then pidfile=${localstatedir}/run/nsd.pid else pidfile=${dbdir}/nsd.pid fi AC_ARG_WITH([pidfile], AC_HELP_STRING([--with-pidfile=path], [Pathname to the NSD pidfile]), [pidfile=$withval]) AC_SUBST(pidfile) AC_DEFINE_UNQUOTED(PIDFILE, ["`eval echo $pidfile`"], [Pathname to the NSD pidfile]) # # Determine location of nsd.db # dbfile=${dbdir}/nsd.db AC_ARG_WITH([dbfile], AC_HELP_STRING([--with-dbfile=path], [Pathname to the NSD database]), [dbfile=$withval]) AC_SUBST(dbfile) AC_DEFINE_UNQUOTED(DBFILE, ["`eval echo $dbfile`"], [Pathname to the NSD database]) dbdir=`dirname $dbfile` AC_SUBST(dbdir) piddir=`dirname $pidfile` AC_SUBST(piddir) # # Determine the default directory for the zone files # zonesdir=$configdir AC_ARG_WITH([zonesdir], AC_HELP_STRING([--with-zonesdir=dir], [NSD default location for zone files]), [zonesdir=$withval]) AC_SUBST(zonesdir) AC_DEFINE_UNQUOTED(ZONESDIR, ["`eval echo $zonesdir`"], [NSD default location for zone files. Empty string or NULL to disable.]) # default diff file location. difffile=${dbdir}/ixfr.db AC_ARG_WITH([difffile], AC_HELP_STRING([--with-difffile=path], [Pathname to the NSD diff transfer journal file]), [difffile=$withval]) AC_DEFINE_UNQUOTED(DIFFFILE, ["`eval echo $difffile`"], [Pathname to the NSD diff transfer journal file.]) AC_SUBST(difffile) # default xfrd file location. xfrdfile=${dbdir}/xfrd.state AC_ARG_WITH([xfrdfile], AC_HELP_STRING([--with-xfrdfile=path], [Pathname to the NSD xfrd zone timer state file]), [xfrdfile=$withval]) AC_DEFINE_UNQUOTED(XFRDFILE, ["`eval echo $xfrdfile`"], [Pathname to the NSD xfrd zone timer state file.]) AC_SUBST(xfrdfile) # # Determine default chroot directory # AC_ARG_WITH([chroot], AC_HELP_STRING([--with-chroot=dir], [NSD default chroot directory]), [ chrootdir=$withval AC_DEFINE_UNQUOTED(CHROOTDIR, ["`eval echo $chrootdir`"], [NSD default chroot directory]) ]) # # Determine the user name to drop privileges to # user=nsd AC_ARG_WITH([user], AC_HELP_STRING([--with-user=username], [User name or ID to answer the queries with]), [user=$withval]) AC_SUBST(user) AC_DEFINE_UNQUOTED(USER, ["$user"], [the user name to drop privileges to]) # Checks for programs. AC_PROG_AWK AC_PROG_CC AC_PROG_LN_S AC_PROG_INSTALL AC_PROG_LEX AC_PROG_YACC AC_DEFUN([AC_CHECK_FORMAT_ATTRIBUTE], [AC_REQUIRE([AC_PROG_CC]) AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "format" attribute) AC_CACHE_VAL(ac_cv_c_format_attribute, [ac_cv_c_format_attribute=no AC_TRY_COMPILE( [#include void f (char *format, ...) __attribute__ ((format (printf, 1, 2))); void (*pf) (char *format, ...) __attribute__ ((format (printf, 1, 2))); ], [ f ("%s", "str"); ], [ac_cv_c_format_attribute="yes"], [ac_cv_c_format_attribute="no"]) ]) AC_MSG_RESULT($ac_cv_c_format_attribute) if test $ac_cv_c_format_attribute = yes; then AC_DEFINE(HAVE_ATTR_FORMAT, 1, [Whether the C compiler accepts the "format" attribute]) fi ])dnl AC_DEFUN([AC_CHECK_UNUSED_ATTRIBUTE], [AC_REQUIRE([AC_PROG_CC]) AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "unused" attribute) AC_CACHE_VAL(ac_cv_c_unused_attribute, [ac_cv_c_unused_attribute=no AC_TRY_COMPILE( [#include void f (char *u __attribute__((unused))); ], [ f ("x"); ], [ac_cv_c_unused_attribute="yes"], [ac_cv_c_unused_attribute="no"]) ]) AC_MSG_RESULT($ac_cv_c_unused_attribute) if test $ac_cv_c_unused_attribute = yes; then AC_DEFINE(HAVE_ATTR_UNUSED, 1, [Whether the C compiler accepts the "unused" attribute]) fi ])dnl AC_DEFUN([CHECK_COMPILER_FLAG], [ AC_REQUIRE([AC_PROG_CC]) AC_MSG_CHECKING(whether $CC supports -$1) cache=`echo $1 | sed 'y%.=/+-%___p_%'` AC_CACHE_VAL(cv_prog_cc_flag_$cache, [ echo 'void f(){}' >conftest.c if test -z "`$CC -$1 -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_$cache=yes" else eval "cv_prog_cc_flag_$cache=no" fi rm -f conftest* ]) if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then AC_MSG_RESULT(yes) : $2 else AC_MSG_RESULT(no) : $3 fi ]) AC_DEFUN([AC_CHECK_CTIME_R], [AC_REQUIRE([AC_PROG_CC]) AC_MSG_CHECKING(whether ctime_r works with two arguments) AC_CACHE_VAL(ac_cv_c_ctime_c, [ac_cv_c_ctime_c=no AC_TRY_COMPILE( [#include void testing (void) { time_t clock; char current_time[40]; ctime_r(&clock, current_time); }], [ testing(); ], [ac_cv_c_ctime_c="yes"], [ac_cv_c_ctime_c="no"]) ]) AC_MSG_RESULT($ac_cv_c_ctime_c) if test $ac_cv_c_ctime_c = no; then CPPFLAGS="$CPPFLAGS -D_POSIX_PTHREAD_SEMANTICS" fi ])dnl # Checks for typedefs, structures, and compiler characteristics. CHECK_COMPILER_FLAG(O2, [], [ CFLAGS=`echo $CFLAGS | sed -e "s/-O2//g"` ]) AC_C_CONST AC_C_INLINE AC_TYPE_UID_T AC_TYPE_PID_T AC_TYPE_SIZE_T AC_TYPE_OFF_T AC_CHECK_FORMAT_ATTRIBUTE AC_CHECK_UNUSED_ATTRIBUTE ACX_CHECK_MEMCMP_SIGNED AC_CHECK_CTIME_R # Checks for libraries. # Check for SSL, original taken from # http://www.gnu.org/software/ac-archive/htmldoc/check_ssl.html and # modified for NSD. AC_DEFUN([CHECK_SSL], [ AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname], [enable SSL (will check /usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/sfw /usr/local /usr)]),[ ],[ withval="yes" ]) if test x_$withval != x_no; then AC_MSG_CHECKING(for SSL) if test x_$withval = x_ -o x_$withval = x_yes; then withval="/usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/sfw /usr/local /usr" fi for dir in $withval; do ssldir="$dir" if test -f "$dir/include/openssl/ssl.h"; then found_ssl="yes"; AC_DEFINE_UNQUOTED([HAVE_SSL], [], [Define if you have the SSL libraries installed.]) if test x_$ssldir != x_/usr; then CPPFLAGS="$CPPFLAGS -I$ssldir/include"; fi break; fi done if test x_$found_ssl != x_yes; then AC_MSG_ERROR(Cannot find the SSL libraries in $withval) else AC_MSG_RESULT(found in $ssldir) HAVE_SSL=yes if test x_$ssldir != x_/usr; then LDFLAGS="$LDFLAGS -L$ssldir/lib"; fi if test x_$ssldir = x_/usr/sfw; then LDFLAGS="$LDFLAGS -R$ssldir/lib"; fi AC_CHECK_LIB(crypto, HMAC_CTX_init,, [ AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required]) ]) AC_CHECK_FUNCS([EVP_sha1 EVP_sha256]) fi AC_SUBST(HAVE_SSL) fi ])dnl # Checks for header files. AC_HEADER_STDC AC_HEADER_SYS_WAIT AC_CHECK_HEADERS([time.h arpa/inet.h signal.h string.h strings.h fcntl.h limits.h netinet/in.h stddef.h sys/param.h sys/socket.h syslog.h unistd.h sys/select.h stdarg.h stdint.h netdb.h sys/bitypes.h tcpd.h grp.h]) AC_DEFUN([CHECK_VALIST_DEF], [ AC_REQUIRE([AC_PROG_CC]) AC_MSG_CHECKING(for double definition of struct va_list) AC_CACHE_VAL(ac_cv_c_va_list_def, [ cat >conftest.c < #include int foo(void); EOF if test -z "`$CC -Werror -D_XOPEN_SOURCE=600 -c conftest.c 2>&1`"; then eval "ac_cv_c_va_list_def=no" else eval "ac_cv_c_va_list_def=yes" fi rm -f conftest* ]) if test $ac_cv_c_va_list_def = yes; then AC_MSG_RESULT(yes) : AC_DEFINE_UNQUOTED([HAVE_VA_LIST_DOUBLE_DEF], [], [Define this if you have double va_list definitions.]) else AC_MSG_RESULT(no) : fi ]) CHECK_VALIST_DEF AC_DEFUN([AC_CHECK_STRPTIME], [AC_REQUIRE([AC_PROG_CC]) AC_MSG_CHECKING(whether strptime needs defines) AC_CACHE_VAL(ac_cv_c_strptime_needs_defs, [ cat >conftest.c < int testing (void) { struct tm t; const char *timestr="201201"; return strptime(timestr, "%Y%m", &t) != 0; } EOF if test -z "`$CC -Wall -Werror -c conftest.c 2>&1`"; then eval "ac_cv_c_strptime_needs_defs=no" else eval "ac_cv_c_strptime_needs_defs=yes" fi rm -f conftest* ]) AC_MSG_RESULT($ac_cv_c_strptime_needs_defs) if test $ac_cv_c_strptime_needs_defs = yes; then AC_DEFINE_UNQUOTED([STRPTIME_NEEDS_DEFINES], 1, [strptime is available from time.h with some defines.]) fi ])dnl AC_CHECK_STRPTIME # check wether strptime also works AC_DEFUN([AC_CHECK_STRPTIME_WORKS], [AC_REQUIRE([AC_PROG_CC]) AC_MSG_CHECKING(whether strptime works) if test c${cross_compiling} = cno; then AC_TRY_RUN([ #define _XOPEN_SOURCE #include int main(void) { struct tm tm; char *res; res = strptime("20070207111842", "%Y%m%d%H%M%S", &tm); if (!res) return 1; return 0; } ] , [eval "ac_cv_c_strptime_works=yes"], [eval "ac_cv_c_strptime_works=no"]) else eval "ac_cv_c_strptime_works=maybe" fi AC_MSG_RESULT($ac_cv_c_strptime_works) if test $ac_cv_c_strptime_works = no; then AC_LIBOBJ(strptime) else AC_DEFINE_UNQUOTED([STRPTIME_WORKS], 1, [use default strptime.]) fi ])dnl AC_SEARCH_LIBS(inet_pton, [nsl]) AC_SEARCH_LIBS(socket, [socket]) AC_CHECK_STRPTIME_WORKS dnl LIBGTOP_CHECK_TYPE dnl Stolen from Gnome's anjuta dnl Improved version of AC_CHECK_TYPE which takes into account dnl that we need to #include some other header files on some dnl systems to get some types. dnl AC_LIBGTOP_CHECK_TYPE(TYPE, DEFAULT) AC_DEFUN([AC_LIBGTOP_CHECK_TYPE], [AC_REQUIRE([AC_HEADER_STDC])dnl AC_MSG_CHECKING(for $1) AC_CACHE_VAL(ac_cv_type_$1, [AC_EGREP_CPP(dnl changequote(<<,>>)dnl <<(^|[^a-zA-Z_0-9])$1[^a-zA-Z_0-9]>>dnl changequote([,]), [ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif ], ac_cv_type_$1=yes, ac_cv_type_$1=no)])dnl AC_MSG_RESULT($ac_cv_type_$1) if test $ac_cv_type_$1 = no; then AC_DEFINE($1, $2, Define "$1" to "$2" if "$1" is missing) fi ]) AC_LIBGTOP_CHECK_TYPE(int8_t, char) AC_LIBGTOP_CHECK_TYPE(int16_t, short) AC_LIBGTOP_CHECK_TYPE(int32_t, int) AC_LIBGTOP_CHECK_TYPE(int64_t, long long) AC_LIBGTOP_CHECK_TYPE(uint8_t, unsigned char) AC_LIBGTOP_CHECK_TYPE(uint16_t, unsigned short) AC_LIBGTOP_CHECK_TYPE(uint32_t, unsigned int) AC_LIBGTOP_CHECK_TYPE(uint64_t, unsigned long long) AC_LIBGTOP_CHECK_TYPE(socklen_t, int) AC_LIBGTOP_CHECK_TYPE(sig_atomic_t, int) AC_LIBGTOP_CHECK_TYPE(ssize_t, int) AC_LIBGTOP_CHECK_TYPE(suseconds_t, time_t) AC_CHECK_TYPE(in_addr_t, [], [AC_DEFINE([in_addr_t], [uint32_t], [in_addr_t])], [ #if HAVE_SYS_TYPES_H # include #endif #if HAVE_NETINET_IN_H # include #endif]) ACX_CHECK_SS_FAMILY # Checks for library functions. AC_FUNC_CHOWN AC_FUNC_FORK AC_FUNC_MALLOC AC_TYPE_SIGNAL AC_FUNC_FSEEKO AC_SYS_LARGEFILE AC_CHECK_FUNCS([arc4random arc4random_uniform]) AC_CHECK_FUNCS([tzset alarm chroot dup2 endpwent gethostname memset memcpy socket strcasecmp strchr strdup strerror strncasecmp strtol writev getaddrinfo getnameinfo freeaddrinfo gai_strerror sigaction sigprocmask strptime setusercontext initgroups setresuid setreuid setresgid setregid getpwnam mmap]) # check if setreuid en setregid fail, on MacOSX10.4(darwin8). if echo $build_os | grep darwin8 > /dev/null; then AC_DEFINE(DARWIN_BROKEN_SETREUID, 1, [Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work]) fi # # Checking for missing functions we can replace # AC_REPLACE_FUNCS(basename) AC_REPLACE_FUNCS(inet_aton) AC_REPLACE_FUNCS(inet_pton) AC_REPLACE_FUNCS(inet_ntop) AC_REPLACE_FUNCS(snprintf) AC_REPLACE_FUNCS(strlcat) AC_REPLACE_FUNCS(strlcpy) AC_REPLACE_FUNCS(strptime) AC_REPLACE_FUNCS(b64_pton) AC_REPLACE_FUNCS(b64_ntop) AC_REPLACE_FUNCS(pselect) AC_REPLACE_FUNCS(memmove) AC_MSG_CHECKING(for pselect prototype in sys/select.h) AC_EGREP_HEADER([[^a-zA-Z_]*pselect[^a-zA-Z_]], sys/select.h, AC_DEFINE(HAVE_PSELECT_PROTO, 1, [if sys/select.h provides pselect prototype]) AC_MSG_RESULT(yes), AC_MSG_RESULT(no)) AC_MSG_CHECKING(for ctime_r prototype in time.h) AC_EGREP_HEADER([[^a-zA-Z_]*ctime_r[^a-zA-Z_]], time.h, AC_DEFINE(HAVE_CTIME_R_PROTO, 1, [if time.h provides ctime_r prototype]) AC_MSG_RESULT(yes), AC_MSG_RESULT(no)) AC_CHECK_TYPE([struct timespec], AC_DEFINE(HAVE_STRUCT_TIMESPEC, 1, [If time.h has a struct timespec (for pselect).]), [], [ AC_INCLUDES_DEFAULT #ifdef HAVE_SIGNAL_H #include #endif #ifdef HAVE_TIME_H #include #endif ]) dnl dnl Some random defines's dnl AC_DEFINE_UNQUOTED([IDENTITY], ["unidentified server"], [Define to the default nsd identity.]) AC_DEFINE_UNQUOTED([VERSION], [PACKAGE_STRING], [Define to the NSD version to answer version.server query.]) AC_DEFINE_UNQUOTED([TCP_BACKLOG], [5], [Define to the backlog to be used with listen.]) AC_DEFINE_UNQUOTED([TCP_PORT], ["53"], [Define to the default tcp port.]) AC_DEFINE_UNQUOTED([TCP_MAX_MESSAGE_LEN], [65535], [Define to the default maximum message length.]) AC_DEFINE_UNQUOTED([UDP_PORT], ["53"], [Define to the default udp port.]) AC_DEFINE_UNQUOTED([UDP_MAX_MESSAGE_LEN], [512], [Define to the default maximum udp message length.]) AC_DEFINE_UNQUOTED([EDNS_MAX_MESSAGE_LEN], [4096], [Define to the default maximum message length with EDNS.]) AC_DEFINE_UNQUOTED([MAXSYSLOGMSGLEN], [512], [Define to the maximum message length to pass to syslog.]) dnl dnl Determine the syslog facility to use dnl facility=LOG_DAEMON AC_ARG_WITH([facility], AC_HELP_STRING([--with-facility=name], [Syslog default facility (LOG_DAEMON)]), [facility=$withval]) AC_DEFINE_UNQUOTED([FACILITY], $facility, [Define to the default facility for syslog.]) dnl dnl Determine the maximum number of ip-addresses that are allowed dnl max_ips=8 AC_ARG_WITH([max_ips], AC_HELP_STRING([--with-max-ips=number], [Limit on the number of ip-addresses that may be specified]), [max_ips=$withval]) AC_DEFINE_UNQUOTED([MAX_INTERFACES], $max_ips, [Define to the maximum ip-addresses to serve.]) dnl dnl Determine the default tcp timeout dnl tcp_timeout=120 AC_ARG_WITH([tcp_timeout], AC_HELP_STRING([--with-tcp-timeout=number], [Limit the default tcp timeout]), [tcp_timeout=$withval]) AC_DEFINE_UNQUOTED([TCP_TIMEOUT], $tcp_timeout, [Define to the default tcp timeout.]) dnl dnl Features dnl AC_ARG_ENABLE(root-server, AC_HELP_STRING([--enable-root-server], [Configure NSD as a root server])) case "$enable_root_server" in yes) AC_DEFINE_UNQUOTED([ROOT_SERVER], [], [Define this to configure as a root server.]) ;; no|*) ;; esac AC_ARG_ENABLE(ipv6, AC_HELP_STRING([--disable-ipv6], [Disables IPv6 support])) case "$enable_ipv6" in no) ;; yes|*) AC_DEFINE_UNQUOTED([INET6], [], [Define this to enable IPv6 support.]) ;; esac AC_ARG_ENABLE(bind8-stats, AC_HELP_STRING([--enable-bind8-stats], [Enables BIND8 like NSTATS & XSTATS])) case "$enable_bind8_stats" in yes|'') AC_DEFINE_UNQUOTED([BIND8_STATS], [], [Define this to enable BIND8 like NSTATS & XSTATS.]) ;; no|*) ;; esac AC_ARG_ENABLE(checking, AC_HELP_STRING([--enable-checking], [Enable internal runtime checks])) case "$enable_checking" in yes) CHECK_COMPILER_FLAG(W, [ CFLAGS="$CFLAGS -W" ]) CHECK_COMPILER_FLAG(Wall, [ CFLAGS="$CFLAGS -Wall" ]) CHECK_COMPILER_FLAG(Wextra, [ CFLAGS="$CFLAGS -Wextra" ]) CHECK_COMPILER_FLAG(Wdeclaration-after-statement, [ CFLAGS="$CFLAGS -Wdeclaration-after-statement" ]) ;; no|*) AC_DEFINE([NDEBUG], [], [Undefine this to enable internal runtime checks.]) ;; esac AC_ARG_ENABLE(ratelimit, AC_HELP_STRING([--enable-ratelimit], [Enable rate limiting])) case "$enable_ratelimit" in yes) AC_DEFINE_UNQUOTED([RATELIMIT], [], [Define this to enable rate limiting.]) dnl causes awk to not match the exclusion start marker. ratelimit="xx" ;; no|*) ratelimit="" ;; esac AC_SUBST(ratelimit) # we need SSL for TSIG (and maybe also for NSEC3). CHECK_SSL AC_ARG_ENABLE(nsec3, AC_HELP_STRING([--disable-nsec3], [Disable NSEC3 support])) case "$enable_nsec3" in no) ;; yes|*) AC_DEFINE_UNQUOTED([NSEC3], [], [Define this to enable NSEC3 support.]) ;; esac AC_ARG_ENABLE(full-prehash, AC_HELP_STRING([--disable-full-prehash], [Disables NSEC3 full prehashing])) case "$enable_full_prehash" in no) ;; yes|*) AC_DEFINE_UNQUOTED([FULL_PREHASH], [], [Define this to enable NSEC3 full prehashing.]) ;; esac AC_ARG_ENABLE(minimal-responses, AC_HELP_STRING([--disable-minimal-responses], [Disable response minimization. More truncation.])) case "$enable_minimal_responses" in no) ;; yes|*) AC_DEFINE_UNQUOTED([MINIMAL_RESPONSES], [], [Define this to enable response minimalization to reduce truncation.]) ;; esac AC_ARG_ENABLE(draft-rrtypes, AC_HELP_STRING([--enable-draft-rrtypes], [Enable draft RRtypes.])) case "$enable_draft_rrtypes" in yes) AC_DEFINE_UNQUOTED([DRAFT_RRTYPES], [], [Define this to enable draft RRtypes.]) ;; no|*) ;; esac AC_ARG_ENABLE(mmap, AC_HELP_STRING([--enable-mmap], [Use mmap instead of malloc. Experimental.])) case "$enable_mmap" in yes) AC_CHECK_HEADERS([sys/mman.h]) AC_LIBGTOP_CHECK_TYPE(uintptr_t, void*) AC_CHECK_FUNCS([mmap munmap]) AC_DEFINE_UNQUOTED([USE_MMAP_ALLOC], [], [Define this to enable mmap instead of malloc. Experimental.]) ;; no|*) ;; esac # # Default zonestatsfile # zonestatsfile=${localstatedir}/log/nsd.stats AC_SUBST(zonestatsfile) AC_DEFINE_UNQUOTED(ZONESTATSFILE, ["`eval echo $zonestatsfile`"], [Pathname to the NSD statistics file]) AC_ARG_ENABLE(zone_stats, AC_HELP_STRING([--enable-zone-stats], [Maintain statistics per zone, instead of global statistics.])) case "$enable_zone_stats" in yes) AC_DEFINE_UNQUOTED([USE_ZONE_STATS], [], [Define this to enable zone statistics.]) ;; no|*) ;; esac AH_BOTTOM([ /* define before includes as it specifies what standard to use. */ #if (defined(HAVE_PSELECT) && !defined (HAVE_PSELECT_PROTO)) \ || !defined (HAVE_CTIME_R_PROTO) \ || defined (STRPTIME_NEEDS_DEFINES) # ifndef _XOPEN_SOURCE # define _XOPEN_SOURCE 600 # endif # ifndef _POSIX_C_SOURCE # define _POSIX_C_SOURCE 200112 # endif # ifndef _BSD_SOURCE # define _BSD_SOURCE 1 # endif # ifndef __EXTENSIONS__ # define __EXTENSIONS__ 1 # endif # ifndef _STDC_C99 # define _STDC_C99 1 # endif # ifndef _ALL_SOURCE # define _ALL_SOURCE 1 # endif #endif ]) AH_BOTTOM([ #ifdef HAVE_VA_LIST_DOUBLE_DEF /* workaround double va_list definition on some platforms */ # ifndef _VA_LIST_DEFINED # define _VA_LIST_DEFINED # endif #endif ]) AH_BOTTOM([ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_TIME_H #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_NETINET_IN_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif ]) AH_BOTTOM([ #ifdef HAVE_ATTR_FORMAT #define ATTR_FORMAT(archetype, string_index, first_to_check) \ __attribute__ ((format (archetype, string_index, first_to_check))) #else /* !HAVE_ATTR_FORMAT */ #define ATTR_FORMAT(archetype, string_index, first_to_check) /* empty */ #endif /* !HAVE_ATTR_FORMAT */ #if defined(__cplusplus) #define ATTR_UNUSED(x) #elif defined(HAVE_ATTR_UNUSED) #define ATTR_UNUSED(x) x __attribute__((unused)) #else /* !HAVE_ATTR_UNUSED */ #define ATTR_UNUSED(x) x #endif /* !HAVE_ATTR_UNUSED */ ]) AH_BOTTOM([ #ifndef IPV6_MIN_MTU #define IPV6_MIN_MTU 1280 #endif /* IPV6_MIN_MTU */ #ifndef AF_INET6 #define AF_INET6 28 #endif /* AF_INET6 */ ]) if test $ac_cv_func_getaddrinfo = no; then AC_LIBOBJ([fake-rfc2553]) fi AH_BOTTOM([ /* maximum nesting of included files */ #define MAXINCLUDES 10 ]) AH_BOTTOM([ #ifndef HAVE_B64_NTOP int b64_ntop(uint8_t const *src, size_t srclength, char *target, size_t targsize); #endif /* !HAVE_B64_NTOP */ #ifndef HAVE_B64_PTON int b64_pton(char const *src, uint8_t *target, size_t targsize); #endif /* !HAVE_B64_PTON */ #ifndef HAVE_FSEEKO #define fseeko fseek #define ftello ftell #endif /* HAVE_FSEEKO */ #ifndef HAVE_SNPRINTF #include int snprintf (char *str, size_t count, const char *fmt, ...); int vsnprintf (char *str, size_t count, const char *fmt, va_list arg); #endif /* HAVE_SNPRINTF */ #ifndef HAVE_INET_PTON int inet_pton(int af, const char* src, void* dst); #endif /* HAVE_INET_PTON */ #ifndef HAVE_INET_NTOP const char *inet_ntop(int af, const void *src, char *dst, size_t size); #endif #ifndef HAVE_INET_ATON int inet_aton(const char *cp, struct in_addr *addr); #endif #ifndef HAVE_MEMMOVE void *memmove(void *dest, const void *src, size_t n); #endif #ifndef HAVE_STRLCAT size_t strlcat(char *dst, const char *src, size_t siz); #endif #ifndef HAVE_STRLCPY size_t strlcpy(char *dst, const char *src, size_t siz); #endif #ifndef HAVE_GETADDRINFO #include "compat/fake-rfc2553.h" #endif #ifndef HAVE_STRPTIME #define HAVE_STRPTIME 1 char *strptime(const char *s, const char *format, struct tm *tm); #endif #ifndef STRPTIME_WORKS #define STRPTIME_WORKS 1 #define strptime(a,b,c) nsd_strptime((a),(b),(c)) #endif ]) AH_BOTTOM( AHX_MEMCMP_BROKEN(nsd) AHX_CONFIG_MAXHOSTNAMELEN ) AH_BOTTOM([ /* provide timespec def if not available */ #ifndef CONFIG_DEFINES #define CONFIG_DEFINES #ifndef HAVE_STRUCT_TIMESPEC #ifndef __timespec_defined #define __timespec_defined 1 struct timespec { long tv_sec; /* seconds */ long tv_nsec; /* nanoseconds */ }; #endif /* !__timespec_defined */ #endif /* !HAVE_STRUCT_TIMESPEC */ #endif /* !CONFIG_DEFINES */ ]) # big fat warning if test "$enable_checking" = "yes"; then echo "*************************************************" echo "* You have activated \"--enable-checking\" *" echo "* *" echo "* This will instruct NSD to be stricter *" echo "* when validating its input. This could lead *" echo "* to a reduced service level. *" echo "* *" echo "*************************************************" fi if test "$enable_zone_stats" = "yes"; then echo "*************************************************" echo "* You have activated \"--enable-zone-stats\" *" echo "* *" echo "* This will make NSD maintain statistics *" echo "* on a per zone basis. This could lead to *" echo "* a reduced service level and an *" echo "* a larger memory footprint. *" echo "* *" echo "*************************************************" fi AC_CONFIG_FILES([Makefile]) AC_OUTPUT nsd-3.2.16/configlexer.c0000664000175000017500000024464312173226547014052 0ustar matjematje#include "configyyrename.h" #line 3 "" #define YY_INT_ALIGNED short int /* A lexical scanner generated by flex */ #define FLEX_SCANNER #define YY_FLEX_MAJOR_VERSION 2 #define YY_FLEX_MINOR_VERSION 5 #define YY_FLEX_SUBMINOR_VERSION 35 #if YY_FLEX_SUBMINOR_VERSION > 0 #define FLEX_BETA #endif /* First, we deal with platform-specific or compiler-specific issues. */ /* begin standard C headers. */ #include #include #include #include /* end standard C headers. */ /* flex integer type definitions */ #ifndef FLEXINT_H #define FLEXINT_H /* C99 systems have . Non-C99 systems may or may not. */ #if defined (__STDC_VERSION__) && __STDC_VERSION__ >= 199901L /* C99 says to define __STDC_LIMIT_MACROS before including stdint.h, * if you want the limit (max/min) macros for int types. */ #ifndef __STDC_LIMIT_MACROS #define __STDC_LIMIT_MACROS 1 #endif #include typedef int8_t flex_int8_t; typedef uint8_t flex_uint8_t; typedef int16_t flex_int16_t; typedef uint16_t flex_uint16_t; typedef int32_t flex_int32_t; typedef uint32_t flex_uint32_t; #else typedef signed char flex_int8_t; typedef short int flex_int16_t; typedef int flex_int32_t; typedef unsigned char flex_uint8_t; typedef unsigned short int flex_uint16_t; typedef unsigned int flex_uint32_t; /* Limits of integral types. */ #ifndef INT8_MIN #define INT8_MIN (-128) #endif #ifndef INT16_MIN #define INT16_MIN (-32767-1) #endif #ifndef INT32_MIN #define INT32_MIN (-2147483647-1) #endif #ifndef INT8_MAX #define INT8_MAX (127) #endif #ifndef INT16_MAX #define INT16_MAX (32767) #endif #ifndef INT32_MAX #define INT32_MAX (2147483647) #endif #ifndef UINT8_MAX #define UINT8_MAX (255U) #endif #ifndef UINT16_MAX #define UINT16_MAX (65535U) #endif #ifndef UINT32_MAX #define UINT32_MAX (4294967295U) #endif #endif /* ! C99 */ #endif /* ! FLEXINT_H */ #ifdef __cplusplus /* The "const" storage-class-modifier is valid. */ #define YY_USE_CONST #else /* ! __cplusplus */ /* C99 requires __STDC__ to be defined as 1. */ #if defined (__STDC__) #define YY_USE_CONST #endif /* defined (__STDC__) */ #endif /* ! __cplusplus */ #ifdef YY_USE_CONST #define yyconst const #else #define yyconst #endif /* Returned upon end-of-file. */ #define YY_NULL 0 /* Promotes a possibly negative, possibly signed char to an unsigned * integer for use as an array index. If the signed char is negative, * we want to instead treat it as an 8-bit unsigned char, hence the * double cast. */ #define YY_SC_TO_UI(c) ((unsigned int) (unsigned char) c) /* Enter a start condition. This macro really ought to take a parameter, * but we do it the disgusting crufty way forced on us by the ()-less * definition of BEGIN. */ #define BEGIN (yy_start) = 1 + 2 * /* Translate the current start state into a value that can be later handed * to BEGIN to return to the state. The YYSTATE alias is for lex * compatibility. */ #define YY_START (((yy_start) - 1) / 2) #define YYSTATE YY_START /* Action number for EOF rule of a given start state. */ #define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1) /* Special action meaning "start processing a new file". */ #define YY_NEW_FILE yyrestart(yyin ) #define YY_END_OF_BUFFER_CHAR 0 /* Size of default input buffer. */ #ifndef YY_BUF_SIZE #ifdef __ia64__ /* On IA-64, the buffer size is 16k, not 8k. * Moreover, YY_BUF_SIZE is 2*YY_READ_BUF_SIZE in the general case. * Ditto for the __ia64__ case accordingly. */ #define YY_BUF_SIZE 32768 #else #define YY_BUF_SIZE 16384 #endif /* __ia64__ */ #endif /* The state buf must be large enough to hold one state per character in the main buffer. */ #define YY_STATE_BUF_SIZE ((YY_BUF_SIZE + 2) * sizeof(yy_state_type)) #ifndef YY_TYPEDEF_YY_BUFFER_STATE #define YY_TYPEDEF_YY_BUFFER_STATE typedef struct yy_buffer_state *YY_BUFFER_STATE; #endif extern int yyleng; extern FILE *yyin, *yyout; #define EOB_ACT_CONTINUE_SCAN 0 #define EOB_ACT_END_OF_FILE 1 #define EOB_ACT_LAST_MATCH 2 #define YY_LESS_LINENO(n) /* Return all but the first "n" matched characters back to the input stream. */ #define yyless(n) \ do \ { \ /* Undo effects of setting up yytext. */ \ int yyless_macro_arg = (n); \ YY_LESS_LINENO(yyless_macro_arg);\ *yy_cp = (yy_hold_char); \ YY_RESTORE_YY_MORE_OFFSET \ (yy_c_buf_p) = yy_cp = yy_bp + yyless_macro_arg - YY_MORE_ADJ; \ YY_DO_BEFORE_ACTION; /* set up yytext again */ \ } \ while ( 0 ) #define unput(c) yyunput( c, (yytext_ptr) ) #ifndef YY_TYPEDEF_YY_SIZE_T #define YY_TYPEDEF_YY_SIZE_T typedef size_t yy_size_t; #endif #ifndef YY_STRUCT_YY_BUFFER_STATE #define YY_STRUCT_YY_BUFFER_STATE struct yy_buffer_state { FILE *yy_input_file; char *yy_ch_buf; /* input buffer */ char *yy_buf_pos; /* current position in input buffer */ /* Size of input buffer in bytes, not including room for EOB * characters. */ yy_size_t yy_buf_size; /* Number of characters read into yy_ch_buf, not including EOB * characters. */ int yy_n_chars; /* Whether we "own" the buffer - i.e., we know we created it, * and can realloc() it to grow it, and should free() it to * delete it. */ int yy_is_our_buffer; /* Whether this is an "interactive" input source; if so, and * if we're using stdio for input, then we want to use getc() * instead of fread(), to make sure we stop fetching input after * each newline. */ int yy_is_interactive; /* Whether we're considered to be at the beginning of a line. * If so, '^' rules will be active on the next match, otherwise * not. */ int yy_at_bol; int yy_bs_lineno; /**< The line count. */ int yy_bs_column; /**< The column count. */ /* Whether to try to fill the input buffer when we reach the * end of it. */ int yy_fill_buffer; int yy_buffer_status; #define YY_BUFFER_NEW 0 #define YY_BUFFER_NORMAL 1 /* When an EOF's been seen but there's still some text to process * then we mark the buffer as YY_EOF_PENDING, to indicate that we * shouldn't try reading from the input source any more. We might * still have a bunch of tokens to match, though, because of * possible backing-up. * * When we actually see the EOF, we change the status to "new" * (via yyrestart()), so that the user can continue scanning by * just pointing yyin at a new input file. */ #define YY_BUFFER_EOF_PENDING 2 }; #endif /* !YY_STRUCT_YY_BUFFER_STATE */ /* Stack of input buffers. */ static size_t yy_buffer_stack_top = 0; /**< index of top of stack. */ static size_t yy_buffer_stack_max = 0; /**< capacity of stack. */ static YY_BUFFER_STATE * yy_buffer_stack = 0; /**< Stack as an array. */ /* We provide macros for accessing buffer states in case in the * future we want to put the buffer states in a more general * "scanner state". * * Returns the top of the stack, or NULL. */ #define YY_CURRENT_BUFFER ( (yy_buffer_stack) \ ? (yy_buffer_stack)[(yy_buffer_stack_top)] \ : NULL) /* Same as previous macro, but useful when we know that the buffer stack is not * NULL or when we need an lvalue. For internal use only. */ #define YY_CURRENT_BUFFER_LVALUE (yy_buffer_stack)[(yy_buffer_stack_top)] /* yy_hold_char holds the character lost when yytext is formed. */ static char yy_hold_char; static int yy_n_chars; /* number of characters read into yy_ch_buf */ int yyleng; /* Points to current character in buffer. */ static char *yy_c_buf_p = (char *) 0; static int yy_init = 0; /* whether we need to initialize */ static int yy_start = 0; /* start state number */ /* Flag which is used to allow yywrap()'s to do buffer switches * instead of setting up a fresh yyin. A bit of a hack ... */ static int yy_did_buffer_switch_on_eof; void yyrestart (FILE *input_file ); void yy_switch_to_buffer (YY_BUFFER_STATE new_buffer ); YY_BUFFER_STATE yy_create_buffer (FILE *file,int size ); void yy_delete_buffer (YY_BUFFER_STATE b ); void yy_flush_buffer (YY_BUFFER_STATE b ); void yypush_buffer_state (YY_BUFFER_STATE new_buffer ); void yypop_buffer_state (void ); static void yyensure_buffer_stack (void ); static void yy_load_buffer_state (void ); static void yy_init_buffer (YY_BUFFER_STATE b,FILE *file ); #define YY_FLUSH_BUFFER yy_flush_buffer(YY_CURRENT_BUFFER ) YY_BUFFER_STATE yy_scan_buffer (char *base,yy_size_t size ); YY_BUFFER_STATE yy_scan_string (yyconst char *yy_str ); YY_BUFFER_STATE yy_scan_bytes (yyconst char *bytes,int len ); void *yyalloc (yy_size_t ); void *yyrealloc (void *,yy_size_t ); void yyfree (void * ); #define yy_new_buffer yy_create_buffer #define yy_set_interactive(is_interactive) \ { \ if ( ! YY_CURRENT_BUFFER ){ \ yyensure_buffer_stack (); \ YY_CURRENT_BUFFER_LVALUE = \ yy_create_buffer(yyin,YY_BUF_SIZE ); \ } \ YY_CURRENT_BUFFER_LVALUE->yy_is_interactive = is_interactive; \ } #define yy_set_bol(at_bol) \ { \ if ( ! YY_CURRENT_BUFFER ){\ yyensure_buffer_stack (); \ YY_CURRENT_BUFFER_LVALUE = \ yy_create_buffer(yyin,YY_BUF_SIZE ); \ } \ YY_CURRENT_BUFFER_LVALUE->yy_at_bol = at_bol; \ } #define YY_AT_BOL() (YY_CURRENT_BUFFER_LVALUE->yy_at_bol) /* Begin user sect3 */ typedef unsigned char YY_CHAR; FILE *yyin = (FILE *) 0, *yyout = (FILE *) 0; typedef int yy_state_type; extern int yylineno; int yylineno = 1; extern char *yytext; #define yytext_ptr yytext static yy_state_type yy_get_previous_state (void ); static yy_state_type yy_try_NUL_trans (yy_state_type current_state ); static int yy_get_next_buffer (void ); static void yy_fatal_error (yyconst char msg[] ); /* Done after the current pattern has been matched and before the * corresponding action - sets up yytext. */ #define YY_DO_BEFORE_ACTION \ (yytext_ptr) = yy_bp; \ (yytext_ptr) -= (yy_more_len); \ yyleng = (size_t) (yy_cp - (yytext_ptr)); \ (yy_hold_char) = *yy_cp; \ *yy_cp = '\0'; \ (yy_c_buf_p) = yy_cp; #define YY_NUM_RULES 67 #define YY_END_OF_BUFFER 68 /* This struct is not used in this scanner, but its presence is necessary. */ struct yy_trans_info { flex_int32_t yy_verify; flex_int32_t yy_nxt; }; static yyconst flex_int16_t yy_accept[505] = { 0, 1, 1, 55, 55, 59, 59, 63, 63, 68, 66, 1, 53, 54, 2, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 67, 55, 56, 67, 57, 67, 62, 59, 60, 61, 67, 63, 64, 65, 67, 66, 0, 1, 2, 2, 2, 2, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 55, 0, 62, 0, 59, 63, 0, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 45, 66, 66, 66, 66, 66, 66, 44, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 41, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 4, 66, 13, 66, 66, 22, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 32, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 25, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 36, 66, 66, 66, 66, 66, 66, 66, 66, 66, 43, 66, 3, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 58, 66, 66, 66, 66, 66, 66, 14, 66, 66, 21, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 11, 66, 28, 66, 12, 66, 66, 9, 10, 66, 66, 66, 66, 66, 66, 66, 66, 66, 46, 48, 66, 66, 66, 66, 66, 66, 26, 66, 66, 29, 66, 33, 27, 42, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 16, 66, 66, 31, 66, 66, 66, 66, 7, 66, 5, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 23, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 38, 35, 66, 66, 66, 66, 66, 66, 18, 66, 66, 66, 34, 8, 66, 66, 66, 37, 66, 66, 66, 66, 66, 15, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 47, 66, 52, 66, 66, 66, 66, 6, 19, 20, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 17, 66, 24, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 39, 66, 66, 66, 66, 40, 66, 66, 66, 30, 66, 66, 66, 66, 66, 66, 49, 50, 66, 51, 0 } ; static yyconst flex_int32_t yy_ec[256] = { 0, 1, 1, 1, 1, 1, 1, 1, 1, 2, 3, 1, 1, 4, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 5, 6, 1, 1, 1, 1, 1, 1, 1, 1, 1, 7, 1, 1, 1, 1, 1, 1, 8, 1, 9, 1, 1, 1, 10, 1, 1, 1, 1, 1, 1, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 1, 36, 1, 1, 1, 1, 37, 38, 39, 40, 41, 42, 43, 44, 45, 1, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 } ; static yyconst flex_int32_t yy_meta[62] = { 0, 1, 2, 3, 4, 4, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 } ; static yyconst flex_int16_t yy_base[514] = { 0, 0, 0, 59, 62, 66, 70, 73, 76, 1417, 1380, 80, 1418, 1418, 83, 63, 71, 89, 75, 78, 101, 81, 112, 102, 120, 118, 128, 138, 127, 146, 136, 144, 184, 1379, 1418, 1418, 1418, 86, 1378, 1411, 1418, 1418, 188, 1376, 1418, 1418, 171, 1375, 193, 91, 0, 197, 0, 0, 179, 168, 176, 124, 173, 189, 110, 191, 178, 211, 194, 207, 201, 205, 216, 209, 222, 212, 220, 227, 219, 244, 240, 242, 248, 254, 245, 255, 251, 1374, 203, 1373, 284, 1406, 1371, 297, 268, 270, 269, 279, 274, 277, 296, 294, 291, 295, 308, 239, 310, 315, 311, 312, 319, 307, 322, 332, 323, 321, 325, 334, 359, 344, 336, 345, 362, 1370, 350, 366, 365, 358, 356, 352, 1369, 372, 375, 389, 391, 378, 383, 385, 403, 393, 392, 394, 416, 417, 1368, 412, 424, 419, 426, 413, 428, 430, 431, 436, 451, 439, 450, 449, 445, 433, 465, 483, 496, 491, 452, 466, 481, 486, 492, 477, 495, 493, 506, 512, 503, 507, 526, 529, 524, 1367, 517, 1366, 528, 533, 1365, 521, 527, 543, 547, 553, 557, 530, 551, 554, 552, 556, 577, 580, 567, 570, 588, 582, 1363, 590, 591, 596, 617, 601, 602, 593, 598, 624, 613, 628, 619, 621, 626, 627, 644, 645, 635, 668, 654, 646, 652, 650, 658, 662, 660, 664, 678, 682, 692, 672, 676, 695, 689, 694, 688, 698, 699, 690, 708, 721, 720, 714, 717, 1355, 707, 725, 736, 727, 724, 742, 747, 740, 735, 745, 751, 762, 755, 763, 1335, 753, 772, 779, 785, 793, 778, 782, 781, 784, 1334, 791, 1333, 788, 786, 798, 795, 811, 808, 807, 823, 829, 826, 819, 820, 833, 821, 835, 834, 843, 845, 848, 1326, 849, 853, 850, 851, 852, 854, 1325, 876, 885, 1323, 860, 861, 888, 891, 879, 873, 892, 895, 887, 894, 889, 880, 898, 903, 907, 911, 919, 909, 922, 932, 936, 923, 930, 1321, 937, 1320, 934, 1315, 926, 945, 1272, 1227, 950, 953, 948, 952, 949, 958, 962, 965, 973, 1226, 1225, 972, 966, 971, 959, 976, 974, 1220, 995, 1000, 991, 978, 988, 927, 915, 1008, 1004, 1007, 997, 1013, 999, 1006, 1017, 1002, 1005, 1012, 1023, 1030, 1031, 1034, 1032, 1038, 1052, 869, 1050, 1043, 865, 1055, 1057, 1064, 1039, 776, 1058, 767, 1075, 1073, 1077, 1067, 1049, 1087, 1092, 1090, 1093, 1096, 1084, 1081, 723, 1097, 1104, 1112, 1108, 1119, 1115, 1125, 1116, 1107, 1110, 1127, 1134, 616, 584, 1137, 1138, 1128, 1130, 1148, 1142, 578, 1131, 1157, 1141, 563, 480, 1153, 1154, 1176, 462, 1160, 1173, 1175, 1171, 1190, 409, 1178, 1180, 1183, 1185, 1193, 1195, 1200, 1199, 1201, 1206, 390, 1197, 355, 1209, 1218, 1207, 1211, 353, 317, 305, 1233, 1221, 1239, 1240, 1242, 1238, 1245, 1247, 1246, 1250, 1251, 1244, 289, 1264, 223, 1254, 1253, 1276, 1277, 1280, 1266, 1283, 1291, 1284, 1287, 1288, 1275, 1295, 185, 1289, 1298, 1307, 1318, 180, 1308, 1309, 1317, 177, 1322, 1324, 1331, 1336, 1337, 1319, 99, 92, 1339, 85, 1418, 1376, 1380, 1384, 112, 1388, 1392, 82, 1394, 1396 } ; static yyconst flex_int16_t yy_def[514] = { 0, 504, 1, 505, 505, 506, 506, 507, 507, 504, 508, 504, 504, 504, 509, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 510, 504, 504, 504, 510, 511, 504, 504, 504, 511, 512, 504, 504, 512, 508, 508, 504, 513, 509, 513, 509, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 510, 510, 511, 511, 504, 512, 512, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 508, 0, 504, 504, 504, 504, 504, 504, 504, 504, 504 } ; static yyconst flex_int16_t yy_nxt[1480] = { 0, 10, 11, 12, 12, 13, 14, 10, 10, 10, 10, 15, 10, 16, 17, 10, 10, 10, 18, 19, 20, 21, 10, 22, 23, 24, 10, 25, 26, 27, 28, 29, 10, 30, 10, 31, 32, 15, 10, 16, 17, 10, 10, 10, 18, 19, 20, 21, 10, 22, 23, 24, 10, 25, 26, 27, 28, 29, 10, 30, 10, 31, 34, 35, 36, 34, 35, 36, 39, 40, 40, 41, 39, 40, 40, 41, 44, 44, 45, 44, 44, 45, 49, 85, 54, 52, 50, 52, 52, 56, 83, 83, 61, 49, 60, 37, 55, 50, 37, 48, 57, 62, 42, 63, 58, 65, 42, 48, 59, 46, 54, 48, 46, 47, 48, 56, 64, 48, 61, 53, 60, 48, 55, 66, 97, 48, 57, 62, 48, 63, 58, 65, 69, 73, 59, 48, 67, 48, 48, 70, 68, 78, 64, 75, 71, 74, 48, 72, 48, 66, 97, 77, 81, 94, 48, 79, 48, 76, 69, 73, 48, 80, 67, 48, 48, 70, 68, 78, 82, 75, 71, 74, 48, 72, 48, 88, 88, 77, 81, 94, 48, 79, 48, 76, 92, 95, 47, 80, 47, 47, 85, 99, 85, 85, 82, 47, 90, 47, 47, 52, 91, 52, 52, 93, 48, 96, 98, 83, 83, 48, 92, 95, 48, 48, 48, 48, 48, 99, 100, 101, 102, 48, 90, 106, 105, 48, 91, 48, 104, 93, 48, 96, 98, 53, 107, 108, 110, 48, 109, 111, 114, 48, 103, 48, 112, 48, 136, 48, 48, 106, 105, 117, 48, 113, 104, 48, 48, 115, 48, 48, 107, 108, 110, 48, 109, 111, 114, 118, 103, 120, 112, 116, 121, 119, 123, 48, 48, 117, 48, 113, 48, 48, 122, 115, 48, 128, 85, 48, 85, 85, 48, 48, 124, 118, 125, 120, 126, 116, 121, 119, 123, 88, 88, 127, 48, 48, 48, 129, 122, 131, 48, 128, 130, 48, 132, 48, 133, 137, 124, 134, 125, 140, 126, 138, 139, 48, 143, 48, 141, 127, 48, 48, 48, 129, 142, 131, 144, 135, 130, 146, 132, 48, 133, 48, 48, 134, 48, 48, 48, 145, 147, 48, 143, 48, 141, 48, 148, 48, 48, 48, 142, 48, 144, 135, 149, 146, 150, 152, 48, 154, 48, 151, 48, 158, 153, 145, 147, 155, 156, 157, 48, 48, 148, 159, 160, 165, 48, 162, 48, 48, 149, 48, 48, 152, 48, 48, 161, 151, 48, 158, 153, 48, 48, 155, 156, 157, 163, 164, 48, 159, 160, 48, 166, 162, 48, 167, 170, 168, 171, 48, 169, 48, 161, 172, 173, 48, 48, 48, 48, 48, 48, 174, 163, 164, 175, 176, 177, 178, 166, 48, 180, 167, 170, 168, 171, 48, 169, 179, 48, 48, 181, 182, 48, 48, 187, 48, 193, 174, 190, 202, 48, 176, 48, 178, 48, 188, 48, 48, 189, 48, 183, 191, 48, 179, 192, 48, 181, 182, 184, 185, 187, 48, 193, 186, 190, 48, 48, 48, 48, 194, 195, 188, 204, 205, 189, 203, 183, 191, 48, 196, 192, 48, 48, 197, 184, 185, 198, 209, 207, 186, 201, 206, 199, 48, 208, 194, 48, 48, 204, 48, 210, 203, 48, 211, 200, 196, 212, 48, 48, 48, 213, 48, 48, 209, 207, 220, 201, 206, 199, 48, 208, 214, 48, 48, 215, 216, 210, 218, 48, 211, 200, 217, 212, 48, 219, 221, 213, 48, 223, 227, 48, 220, 48, 48, 48, 48, 48, 214, 222, 48, 215, 216, 224, 218, 225, 226, 230, 217, 228, 48, 219, 221, 229, 48, 223, 227, 231, 48, 48, 48, 48, 233, 48, 48, 222, 234, 232, 235, 224, 48, 225, 226, 230, 48, 228, 239, 48, 236, 229, 238, 237, 243, 231, 48, 48, 245, 48, 233, 48, 246, 48, 234, 232, 235, 48, 240, 48, 48, 241, 48, 244, 239, 48, 236, 48, 238, 237, 48, 48, 247, 242, 245, 248, 249, 251, 246, 250, 252, 253, 48, 256, 240, 48, 48, 241, 48, 244, 48, 254, 255, 48, 260, 48, 48, 48, 247, 242, 261, 248, 249, 251, 48, 250, 252, 253, 257, 256, 259, 258, 262, 48, 48, 48, 266, 254, 255, 48, 260, 48, 263, 48, 264, 268, 261, 48, 265, 48, 267, 48, 269, 48, 271, 270, 259, 48, 262, 272, 276, 48, 266, 273, 274, 48, 277, 48, 263, 275, 264, 48, 279, 278, 265, 285, 267, 48, 48, 48, 271, 48, 280, 48, 48, 272, 276, 48, 48, 273, 274, 282, 277, 281, 284, 275, 48, 48, 279, 278, 283, 285, 286, 48, 287, 290, 48, 288, 280, 48, 48, 289, 48, 48, 48, 291, 48, 282, 297, 281, 284, 292, 293, 299, 48, 48, 283, 295, 286, 48, 287, 48, 294, 288, 48, 300, 48, 289, 296, 301, 48, 291, 48, 298, 48, 302, 305, 292, 293, 299, 306, 48, 48, 295, 303, 304, 48, 309, 294, 307, 310, 48, 311, 313, 296, 48, 308, 48, 48, 298, 48, 48, 305, 48, 48, 48, 306, 48, 312, 314, 48, 316, 48, 309, 48, 307, 310, 48, 311, 313, 315, 317, 308, 318, 319, 321, 48, 48, 324, 320, 48, 325, 322, 323, 312, 314, 326, 316, 48, 48, 48, 328, 48, 331, 332, 48, 315, 317, 48, 318, 319, 321, 48, 48, 48, 320, 327, 325, 322, 323, 329, 330, 48, 333, 48, 334, 342, 48, 48, 48, 48, 48, 48, 48, 335, 336, 337, 338, 339, 48, 48, 340, 327, 341, 48, 343, 329, 330, 48, 333, 346, 334, 48, 344, 345, 48, 350, 348, 48, 48, 335, 347, 337, 338, 48, 349, 48, 48, 48, 341, 48, 48, 353, 48, 48, 355, 346, 48, 352, 344, 345, 354, 48, 348, 351, 356, 48, 347, 48, 357, 48, 349, 359, 358, 48, 360, 361, 362, 48, 363, 364, 48, 48, 365, 352, 48, 48, 354, 368, 48, 351, 48, 376, 48, 367, 48, 48, 369, 359, 358, 366, 360, 361, 362, 48, 363, 377, 48, 48, 48, 370, 48, 48, 371, 368, 372, 373, 48, 48, 374, 367, 48, 375, 369, 48, 48, 366, 378, 379, 381, 48, 48, 48, 48, 380, 48, 370, 48, 382, 371, 384, 372, 373, 383, 385, 374, 386, 48, 375, 387, 48, 391, 390, 378, 48, 381, 48, 388, 48, 48, 380, 48, 392, 48, 48, 48, 48, 48, 389, 383, 385, 48, 48, 393, 397, 387, 48, 391, 390, 396, 394, 395, 48, 388, 398, 399, 400, 403, 392, 48, 48, 48, 402, 48, 389, 401, 405, 48, 48, 393, 397, 411, 48, 404, 406, 396, 394, 395, 48, 48, 398, 48, 400, 407, 48, 408, 48, 48, 402, 409, 412, 401, 405, 48, 410, 413, 48, 411, 414, 404, 406, 415, 48, 418, 48, 417, 48, 420, 416, 407, 48, 408, 421, 48, 419, 409, 48, 422, 424, 48, 410, 48, 48, 423, 414, 48, 48, 415, 425, 418, 429, 417, 426, 48, 416, 427, 48, 48, 428, 48, 419, 48, 430, 422, 48, 48, 431, 432, 48, 423, 433, 435, 434, 437, 48, 439, 48, 48, 426, 48, 48, 427, 441, 48, 428, 436, 48, 48, 430, 438, 48, 48, 431, 432, 446, 440, 433, 48, 434, 437, 443, 439, 48, 48, 442, 444, 48, 445, 441, 48, 447, 436, 450, 448, 449, 438, 453, 451, 454, 452, 48, 440, 48, 455, 48, 48, 443, 48, 456, 48, 442, 444, 48, 445, 48, 462, 463, 459, 450, 48, 449, 465, 48, 451, 48, 452, 48, 457, 48, 48, 48, 460, 458, 461, 456, 48, 48, 464, 48, 466, 48, 462, 463, 459, 467, 468, 469, 48, 470, 48, 48, 471, 472, 457, 48, 48, 48, 460, 458, 461, 477, 478, 48, 464, 473, 474, 475, 48, 48, 48, 467, 48, 469, 48, 48, 48, 48, 471, 472, 48, 48, 476, 48, 48, 479, 480, 477, 478, 481, 482, 473, 474, 475, 48, 484, 48, 483, 488, 489, 490, 485, 48, 487, 486, 48, 48, 48, 476, 491, 48, 479, 480, 48, 48, 481, 482, 48, 48, 48, 492, 48, 493, 483, 488, 48, 490, 485, 48, 487, 486, 494, 495, 496, 497, 491, 498, 48, 48, 48, 500, 501, 502, 503, 499, 48, 492, 48, 48, 48, 48, 48, 48, 48, 48, 48, 48, 494, 495, 496, 497, 48, 498, 48, 48, 48, 48, 48, 502, 48, 499, 33, 33, 33, 33, 38, 38, 38, 38, 43, 43, 43, 43, 51, 51, 48, 51, 83, 83, 88, 88, 52, 52, 48, 52, 48, 48, 48, 48, 48, 48, 89, 87, 86, 84, 48, 89, 87, 86, 84, 48, 504, 9, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504 } ; static yyconst flex_int16_t yy_chk[1480] = { 0, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 3, 3, 3, 4, 4, 4, 5, 5, 5, 5, 6, 6, 6, 6, 7, 7, 7, 8, 8, 8, 11, 511, 15, 14, 11, 14, 14, 16, 37, 37, 19, 49, 18, 3, 15, 49, 4, 15, 17, 19, 5, 19, 17, 21, 6, 16, 17, 7, 15, 18, 8, 508, 19, 16, 20, 21, 19, 14, 18, 503, 15, 22, 60, 17, 17, 19, 501, 19, 17, 21, 23, 25, 17, 500, 22, 20, 23, 24, 22, 28, 20, 26, 24, 25, 60, 24, 22, 22, 60, 27, 30, 57, 25, 28, 24, 26, 23, 25, 57, 29, 22, 28, 26, 24, 22, 28, 31, 26, 24, 25, 30, 24, 27, 46, 46, 27, 30, 57, 31, 28, 29, 26, 55, 58, 32, 29, 32, 32, 42, 62, 42, 42, 31, 48, 54, 48, 48, 51, 54, 51, 51, 56, 55, 59, 61, 84, 84, 58, 55, 58, 56, 493, 62, 54, 489, 62, 63, 63, 63, 484, 54, 66, 65, 59, 54, 61, 64, 56, 64, 59, 61, 51, 67, 68, 70, 66, 69, 71, 74, 67, 63, 65, 72, 69, 101, 63, 71, 66, 65, 76, 68, 73, 64, 74, 72, 75, 70, 470, 67, 68, 70, 73, 69, 71, 74, 77, 63, 79, 72, 75, 80, 78, 82, 101, 76, 76, 77, 73, 75, 80, 81, 75, 78, 94, 86, 82, 86, 86, 79, 81, 90, 77, 91, 79, 92, 75, 80, 78, 82, 89, 89, 93, 90, 92, 91, 95, 81, 97, 94, 94, 96, 95, 98, 93, 99, 102, 90, 100, 91, 104, 92, 103, 103, 468, 107, 98, 105, 93, 97, 99, 96, 95, 106, 97, 108, 100, 96, 110, 98, 455, 99, 107, 100, 100, 102, 104, 105, 109, 111, 103, 107, 454, 105, 106, 112, 111, 108, 110, 106, 112, 108, 100, 113, 110, 114, 116, 109, 118, 113, 115, 116, 123, 117, 109, 111, 120, 121, 122, 115, 117, 112, 124, 125, 131, 120, 128, 125, 453, 113, 448, 124, 116, 123, 114, 127, 115, 118, 123, 117, 122, 121, 120, 121, 122, 129, 130, 127, 124, 125, 128, 132, 128, 131, 133, 136, 134, 137, 132, 135, 133, 127, 138, 139, 129, 446, 130, 136, 135, 137, 141, 129, 130, 142, 143, 144, 145, 132, 134, 147, 133, 136, 134, 137, 435, 135, 146, 141, 145, 148, 149, 138, 139, 151, 143, 155, 141, 154, 160, 142, 143, 144, 145, 146, 152, 147, 148, 153, 155, 150, 154, 149, 146, 154, 151, 148, 149, 150, 150, 151, 154, 155, 150, 154, 153, 152, 150, 160, 156, 157, 152, 162, 163, 153, 161, 150, 154, 429, 157, 154, 156, 161, 158, 150, 150, 158, 167, 165, 150, 159, 164, 158, 165, 166, 156, 425, 162, 162, 157, 168, 161, 163, 169, 158, 157, 170, 159, 164, 167, 171, 166, 158, 167, 165, 181, 159, 164, 158, 170, 166, 172, 168, 171, 173, 174, 168, 178, 169, 169, 158, 176, 170, 176, 179, 182, 171, 181, 184, 187, 174, 181, 172, 182, 178, 173, 187, 172, 183, 179, 173, 174, 185, 178, 185, 186, 190, 176, 188, 183, 179, 182, 189, 184, 184, 187, 191, 188, 190, 185, 189, 193, 191, 186, 183, 194, 192, 195, 185, 424, 185, 186, 190, 194, 188, 200, 195, 196, 189, 199, 197, 203, 191, 192, 420, 205, 193, 193, 197, 206, 413, 194, 192, 195, 196, 201, 199, 200, 202, 205, 204, 200, 201, 196, 206, 199, 197, 203, 204, 207, 202, 205, 208, 209, 211, 206, 210, 212, 213, 208, 216, 201, 412, 202, 202, 210, 204, 211, 214, 215, 207, 219, 212, 213, 209, 207, 202, 220, 208, 209, 211, 216, 210, 212, 213, 217, 216, 218, 217, 221, 214, 215, 219, 225, 214, 215, 221, 219, 220, 222, 218, 223, 227, 220, 222, 224, 224, 226, 223, 228, 225, 229, 228, 218, 217, 221, 230, 234, 229, 225, 231, 232, 230, 235, 226, 222, 233, 223, 227, 237, 236, 224, 244, 226, 234, 232, 237, 229, 228, 238, 233, 231, 230, 234, 235, 236, 231, 232, 240, 235, 239, 242, 233, 244, 238, 237, 236, 241, 244, 245, 241, 246, 249, 242, 247, 238, 240, 239, 248, 399, 248, 245, 250, 247, 240, 256, 239, 242, 251, 252, 259, 252, 246, 241, 254, 245, 251, 246, 249, 253, 247, 253, 260, 250, 248, 255, 261, 254, 250, 259, 257, 256, 262, 264, 251, 252, 259, 265, 255, 257, 254, 263, 263, 386, 269, 253, 266, 271, 260, 272, 274, 255, 384, 267, 264, 261, 257, 266, 265, 264, 267, 262, 272, 265, 271, 273, 275, 269, 277, 263, 269, 274, 266, 271, 273, 272, 274, 276, 278, 267, 279, 280, 282, 277, 276, 285, 281, 275, 286, 283, 284, 273, 275, 287, 277, 281, 282, 284, 289, 278, 293, 294, 280, 276, 278, 279, 279, 280, 282, 283, 286, 285, 281, 288, 286, 283, 284, 291, 292, 287, 295, 288, 296, 306, 289, 291, 293, 294, 295, 292, 296, 298, 299, 301, 302, 303, 301, 302, 304, 288, 305, 379, 307, 291, 292, 376, 295, 310, 296, 306, 308, 309, 298, 314, 312, 305, 312, 298, 311, 301, 302, 299, 313, 309, 303, 311, 305, 304, 307, 317, 310, 308, 319, 310, 313, 316, 308, 309, 318, 314, 312, 315, 320, 315, 311, 318, 321, 316, 313, 323, 322, 357, 325, 327, 329, 317, 330, 333, 319, 322, 334, 316, 329, 356, 318, 337, 323, 315, 320, 347, 327, 336, 321, 325, 338, 323, 322, 335, 325, 327, 329, 330, 330, 348, 335, 337, 333, 339, 336, 334, 340, 337, 341, 344, 338, 347, 345, 336, 339, 346, 338, 340, 345, 335, 349, 351, 354, 346, 344, 341, 349, 352, 348, 339, 354, 358, 340, 360, 341, 344, 359, 361, 345, 362, 355, 346, 363, 353, 367, 366, 349, 351, 354, 361, 364, 363, 352, 352, 366, 368, 359, 367, 364, 360, 358, 365, 359, 361, 368, 362, 369, 373, 363, 365, 367, 366, 372, 370, 371, 369, 364, 374, 375, 377, 381, 368, 370, 371, 373, 380, 372, 365, 378, 383, 374, 383, 369, 373, 391, 378, 382, 385, 372, 370, 371, 391, 377, 374, 375, 377, 387, 380, 388, 381, 385, 380, 389, 392, 378, 383, 382, 390, 393, 390, 391, 394, 382, 385, 395, 388, 398, 387, 397, 389, 401, 396, 387, 398, 388, 402, 397, 400, 389, 392, 403, 405, 394, 390, 393, 395, 404, 394, 396, 400, 395, 406, 398, 410, 397, 407, 401, 396, 408, 408, 403, 409, 409, 400, 402, 411, 403, 405, 407, 414, 415, 404, 404, 416, 418, 417, 421, 406, 423, 410, 416, 407, 417, 421, 408, 427, 411, 409, 419, 414, 415, 411, 422, 423, 419, 414, 415, 433, 426, 416, 418, 417, 421, 430, 423, 426, 427, 428, 431, 422, 432, 427, 430, 434, 419, 437, 434, 436, 422, 440, 438, 441, 439, 433, 426, 431, 442, 432, 428, 430, 436, 443, 437, 428, 431, 438, 432, 439, 451, 452, 447, 437, 434, 436, 457, 440, 438, 441, 439, 447, 444, 443, 442, 444, 449, 445, 450, 443, 445, 451, 456, 449, 458, 452, 451, 452, 447, 459, 460, 461, 450, 462, 350, 457, 463, 464, 444, 343, 342, 332, 449, 445, 450, 471, 472, 456, 456, 465, 466, 467, 461, 458, 459, 459, 460, 461, 467, 462, 464, 463, 463, 464, 465, 466, 469, 472, 471, 473, 474, 471, 472, 475, 476, 465, 466, 467, 469, 478, 476, 477, 482, 483, 485, 479, 331, 481, 480, 482, 473, 474, 469, 486, 475, 473, 474, 477, 479, 475, 476, 480, 481, 485, 487, 478, 488, 477, 482, 483, 485, 479, 486, 481, 480, 490, 491, 492, 494, 486, 495, 487, 490, 491, 497, 498, 499, 502, 496, 328, 487, 492, 488, 499, 326, 324, 494, 300, 495, 297, 290, 490, 491, 492, 494, 496, 495, 270, 268, 258, 497, 498, 499, 502, 496, 505, 505, 505, 505, 506, 506, 506, 506, 507, 507, 507, 507, 509, 509, 243, 509, 510, 510, 512, 512, 513, 513, 198, 513, 180, 177, 175, 140, 126, 119, 88, 87, 85, 83, 47, 43, 39, 38, 33, 10, 9, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504, 504 } ; static yy_state_type yy_last_accepting_state; static char *yy_last_accepting_cpos; extern int yy_flex_debug; int yy_flex_debug = 0; /* The intent behind this definition is that it'll catch * any uses of REJECT which flex missed. */ #define REJECT reject_used_but_not_detected static int yy_more_flag = 0; static int yy_more_len = 0; #define yymore() ((yy_more_flag) = 1) #define YY_MORE_ADJ (yy_more_len) #define YY_RESTORE_YY_MORE_OFFSET char *yytext; #line 1 "configlexer.lex" #line 2 "configlexer.lex" /* * configlexer.lex - lexical analyzer for NSD config file * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include "options.h" #include "configyyrename.h" #include "configparser.h" void c_error(const char *message); #define YY_NO_UNPUT #if 0 #define LEXOUT(s) printf s /* used ONLY when debugging */ #else #define LEXOUT(s) #endif struct inc_state { const char* filename; int line; }; static struct inc_state parse_stack[MAXINCLUDES]; static YY_BUFFER_STATE include_stack[MAXINCLUDES]; static int config_include_stack_ptr = 0; static void config_start_include(const char* filename) { FILE *input; if(strlen(filename) == 0) { c_error_msg("empty include file name"); return; } if(config_include_stack_ptr >= MAXINCLUDES) { c_error_msg("includes nested too deeply, skipped (>%d)", MAXINCLUDES); return; } input = fopen(filename, "r"); if(!input) { c_error_msg("cannot open include file '%s': %s", filename, strerror(errno)); return; } LEXOUT(("switch_to_include_file(%s) ", filename)); parse_stack[config_include_stack_ptr].filename = cfg_parser->filename; parse_stack[config_include_stack_ptr].line = cfg_parser->line; include_stack[config_include_stack_ptr] = YY_CURRENT_BUFFER; cfg_parser->filename = region_strdup(cfg_parser->opt->region, filename); cfg_parser->line = 1; yy_switch_to_buffer(yy_create_buffer(input,YY_BUF_SIZE)); ++config_include_stack_ptr; } static void config_end_include(void) { --config_include_stack_ptr; cfg_parser->filename = parse_stack[config_include_stack_ptr].filename; cfg_parser->line = parse_stack[config_include_stack_ptr].line; yy_delete_buffer(YY_CURRENT_BUFFER); yy_switch_to_buffer(include_stack[config_include_stack_ptr]); } #ifndef yy_set_bol /* compat definition, for flex 2.4.6 */ #define yy_set_bol(at_bol) \ { \ if ( ! yy_current_buffer ) \ yy_current_buffer = yy_create_buffer(yyin,YY_BUF_SIZE ); \ yy_current_buffer->yy_ch_buf[0] = ((at_bol)?'\n':' '); \ } #endif #line 1040 "" #define INITIAL 0 #define quotedstring 1 #define include 2 #define include_quoted 3 #ifndef YY_NO_UNISTD_H /* Special case for "unistd.h", since it is non-ANSI. We include it way * down here because we want the user's section 1 to have been scanned first. * The user has a chance to override it with an option. */ #include #endif #ifndef YY_EXTRA_TYPE #define YY_EXTRA_TYPE void * #endif static int yy_init_globals (void ); /* Accessor methods to globals. These are made visible to non-reentrant scanners for convenience. */ int yylex_destroy (void ); int yyget_debug (void ); void yyset_debug (int debug_flag ); YY_EXTRA_TYPE yyget_extra (void ); void yyset_extra (YY_EXTRA_TYPE user_defined ); FILE *yyget_in (void ); void yyset_in (FILE * in_str ); FILE *yyget_out (void ); void yyset_out (FILE * out_str ); int yyget_leng (void ); char *yyget_text (void ); int yyget_lineno (void ); void yyset_lineno (int line_number ); /* Macros after this point can all be overridden by user definitions in * section 1. */ #ifndef YY_SKIP_YYWRAP #ifdef __cplusplus extern "C" int yywrap (void ); #else extern int yywrap (void ); #endif #endif static void yyunput (int c,char *buf_ptr ); #ifndef yytext_ptr static void yy_flex_strncpy (char *,yyconst char *,int ); #endif #ifdef YY_NEED_STRLEN static int yy_flex_strlen (yyconst char * ); #endif #ifndef YY_NO_INPUT #ifdef __cplusplus static int yyinput (void ); #else static int input (void ); #endif #endif /* Amount of stuff to slurp up with each read. */ #ifndef YY_READ_BUF_SIZE #ifdef __ia64__ /* On IA-64, the buffer size is 16k, not 8k */ #define YY_READ_BUF_SIZE 16384 #else #define YY_READ_BUF_SIZE 8192 #endif /* __ia64__ */ #endif /* Copy whatever the last rule matched to the standard output. */ #ifndef ECHO /* This used to be an fputs(), but since the string might contain NUL's, * we now use fwrite(). */ #define ECHO do { if (fwrite( yytext, yyleng, 1, yyout )) {} } while (0) #endif /* Gets input and stuffs it into "buf". number of characters read, or YY_NULL, * is returned in "result". */ #ifndef YY_INPUT #define YY_INPUT(buf,result,max_size) \ if ( YY_CURRENT_BUFFER_LVALUE->yy_is_interactive ) \ { \ int c = '*'; \ size_t n; \ for ( n = 0; n < max_size && \ (c = getc( yyin )) != EOF && c != '\n'; ++n ) \ buf[n] = (char) c; \ if ( c == '\n' ) \ buf[n++] = (char) c; \ if ( c == EOF && ferror( yyin ) ) \ YY_FATAL_ERROR( "input in flex scanner failed" ); \ result = n; \ } \ else \ { \ errno=0; \ while ( (result = fread(buf, 1, max_size, yyin))==0 && ferror(yyin)) \ { \ if( errno != EINTR) \ { \ YY_FATAL_ERROR( "input in flex scanner failed" ); \ break; \ } \ errno=0; \ clearerr(yyin); \ } \ }\ \ #endif /* No semi-colon after return; correct usage is to write "yyterminate();" - * we don't want an extra ';' after the "return" because that will cause * some compilers to complain about unreachable statements. */ #ifndef yyterminate #define yyterminate() return YY_NULL #endif /* Number of entries by which start-condition stack grows. */ #ifndef YY_START_STACK_INCR #define YY_START_STACK_INCR 25 #endif /* Report a fatal error. */ #ifndef YY_FATAL_ERROR #define YY_FATAL_ERROR(msg) yy_fatal_error( msg ) #endif /* end tables serialization structures and prototypes */ /* Default declaration of generated scanner - a define so the user can * easily add parameters. */ #ifndef YY_DECL #define YY_DECL_IS_OURS 1 extern int yylex (void); #define YY_DECL int yylex (void) #endif /* !YY_DECL */ /* Code executed at the beginning of each rule, after yytext and yyleng * have been set up. */ #ifndef YY_USER_ACTION #define YY_USER_ACTION #endif /* Code executed at the end of each rule. */ #ifndef YY_BREAK #define YY_BREAK break; #endif #define YY_RULE_SETUP \ YY_USER_ACTION /** The main scanner function which does all the work. */ YY_DECL { register yy_state_type yy_current_state; register char *yy_cp, *yy_bp; register int yy_act; #line 96 "configlexer.lex" #line 1232 "" if ( !(yy_init) ) { (yy_init) = 1; #ifdef YY_USER_INIT YY_USER_INIT; #endif if ( ! (yy_start) ) (yy_start) = 1; /* first start state */ if ( ! yyin ) yyin = stdin; if ( ! yyout ) yyout = stdout; if ( ! YY_CURRENT_BUFFER ) { yyensure_buffer_stack (); YY_CURRENT_BUFFER_LVALUE = yy_create_buffer(yyin,YY_BUF_SIZE ); } yy_load_buffer_state( ); } while ( 1 ) /* loops until end-of-file is reached */ { (yy_more_len) = 0; if ( (yy_more_flag) ) { (yy_more_len) = (yy_c_buf_p) - (yytext_ptr); (yy_more_flag) = 0; } yy_cp = (yy_c_buf_p); /* Support of yytext. */ *yy_cp = (yy_hold_char); /* yy_bp points to the position in yy_ch_buf of the start of * the current run. */ yy_bp = yy_cp; yy_current_state = (yy_start); yy_match: do { register YY_CHAR yy_c = yy_ec[YY_SC_TO_UI(*yy_cp)]; if ( yy_accept[yy_current_state] ) { (yy_last_accepting_state) = yy_current_state; (yy_last_accepting_cpos) = yy_cp; } while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) { yy_current_state = (int) yy_def[yy_current_state]; if ( yy_current_state >= 505 ) yy_c = yy_meta[(unsigned int) yy_c]; } yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c]; ++yy_cp; } while ( yy_base[yy_current_state] != 1418 ); yy_find_action: yy_act = yy_accept[yy_current_state]; if ( yy_act == 0 ) { /* have to back up */ yy_cp = (yy_last_accepting_cpos); yy_current_state = (yy_last_accepting_state); yy_act = yy_accept[yy_current_state]; } YY_DO_BEFORE_ACTION; do_action: /* This label is used only to access EOF actions. */ switch ( yy_act ) { /* beginning of action switch */ case 0: /* must back up */ /* undo the effects of YY_DO_BEFORE_ACTION */ *yy_cp = (yy_hold_char); yy_cp = (yy_last_accepting_cpos); yy_current_state = (yy_last_accepting_state); goto yy_find_action; case 1: YY_RULE_SETUP #line 97 "configlexer.lex" { LEXOUT(("SP ")); /* ignore */ } YY_BREAK case 2: YY_RULE_SETUP #line 98 "configlexer.lex" { LEXOUT(("comment(%s) ", yytext)); /* ignore */ } YY_BREAK case 3: YY_RULE_SETUP #line 99 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_SERVER;} YY_BREAK case 4: YY_RULE_SETUP #line 100 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_NAME;} YY_BREAK case 5: YY_RULE_SETUP #line 101 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_IP_ADDRESS;} YY_BREAK case 6: YY_RULE_SETUP #line 102 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_IP_TRANSPARENT;} YY_BREAK case 7: YY_RULE_SETUP #line 103 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_DEBUG_MODE;} YY_BREAK case 8: YY_RULE_SETUP #line 104 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_HIDE_VERSION;} YY_BREAK case 9: YY_RULE_SETUP #line 105 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_IP4_ONLY;} YY_BREAK case 10: YY_RULE_SETUP #line 106 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_IP6_ONLY;} YY_BREAK case 11: YY_RULE_SETUP #line 107 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_DATABASE;} YY_BREAK case 12: YY_RULE_SETUP #line 108 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_IDENTITY;} YY_BREAK case 13: YY_RULE_SETUP #line 109 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_NSID;} YY_BREAK case 14: YY_RULE_SETUP #line 110 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_LOGFILE;} YY_BREAK case 15: YY_RULE_SETUP #line 111 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_SERVER_COUNT;} YY_BREAK case 16: YY_RULE_SETUP #line 112 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_TCP_COUNT;} YY_BREAK case 17: YY_RULE_SETUP #line 113 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_TCP_QUERY_COUNT;} YY_BREAK case 18: YY_RULE_SETUP #line 114 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_TCP_TIMEOUT;} YY_BREAK case 19: YY_RULE_SETUP #line 115 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_IPV4_EDNS_SIZE;} YY_BREAK case 20: YY_RULE_SETUP #line 116 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_IPV6_EDNS_SIZE;} YY_BREAK case 21: YY_RULE_SETUP #line 117 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_PIDFILE;} YY_BREAK case 22: YY_RULE_SETUP #line 118 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_PORT;} YY_BREAK case 23: YY_RULE_SETUP #line 119 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_STATISTICS;} YY_BREAK case 24: YY_RULE_SETUP #line 120 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_ZONESTATSFILE;} YY_BREAK case 25: YY_RULE_SETUP #line 121 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_CHROOT;} YY_BREAK case 26: YY_RULE_SETUP #line 122 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_USERNAME;} YY_BREAK case 27: YY_RULE_SETUP #line 123 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_ZONESDIR;} YY_BREAK case 28: YY_RULE_SETUP #line 124 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_DIFFFILE;} YY_BREAK case 29: YY_RULE_SETUP #line 125 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_XFRDFILE;} YY_BREAK case 30: YY_RULE_SETUP #line 126 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_XFRD_RELOAD_TIMEOUT;} YY_BREAK case 31: YY_RULE_SETUP #line 127 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_VERBOSITY;} YY_BREAK case 32: YY_RULE_SETUP #line 128 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_ZONE;} YY_BREAK case 33: YY_RULE_SETUP #line 129 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_ZONEFILE;} YY_BREAK case 34: YY_RULE_SETUP #line 130 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_ALLOW_NOTIFY;} YY_BREAK case 35: YY_RULE_SETUP #line 131 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_REQUEST_XFR;} YY_BREAK case 36: YY_RULE_SETUP #line 132 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_NOTIFY;} YY_BREAK case 37: YY_RULE_SETUP #line 133 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_NOTIFY_RETRY;} YY_BREAK case 38: YY_RULE_SETUP #line 134 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_PROVIDE_XFR;} YY_BREAK case 39: YY_RULE_SETUP #line 135 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_OUTGOING_INTERFACE;} YY_BREAK case 40: YY_RULE_SETUP #line 136 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_ALLOW_AXFR_FALLBACK;} YY_BREAK case 41: YY_RULE_SETUP #line 137 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_KEY;} YY_BREAK case 42: YY_RULE_SETUP #line 138 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_ALGORITHM;} YY_BREAK case 43: YY_RULE_SETUP #line 139 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_SECRET;} YY_BREAK case 44: YY_RULE_SETUP #line 140 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_AXFR;} YY_BREAK case 45: YY_RULE_SETUP #line 141 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_UDP;} YY_BREAK case 46: YY_RULE_SETUP #line 142 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_SIZE;} YY_BREAK case 47: YY_RULE_SETUP #line 143 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_RATELIMIT;} YY_BREAK case 48: YY_RULE_SETUP #line 144 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_SLIP;} YY_BREAK case 49: YY_RULE_SETUP #line 145 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_IPV4_PREFIX_LENGTH;} YY_BREAK case 50: YY_RULE_SETUP #line 146 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_IPV6_PREFIX_LENGTH;} YY_BREAK case 51: YY_RULE_SETUP #line 147 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_WHITELIST_RATELIMIT;} YY_BREAK case 52: YY_RULE_SETUP #line 148 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_WHITELIST;} YY_BREAK case 53: /* rule 53 can match eol */ YY_RULE_SETUP #line 149 "configlexer.lex" { LEXOUT(("NL\n")); cfg_parser->line++;} YY_BREAK /* Quoted strings. Strip leading and ending quotes */ case 54: YY_RULE_SETUP #line 152 "configlexer.lex" { BEGIN(quotedstring); LEXOUT(("QS ")); } YY_BREAK case YY_STATE_EOF(quotedstring): #line 153 "configlexer.lex" { yyerror("EOF inside quoted string"); BEGIN(INITIAL); } YY_BREAK case 55: YY_RULE_SETUP #line 157 "configlexer.lex" { LEXOUT(("STR(%s) ", yytext)); yymore(); } YY_BREAK case 56: /* rule 56 can match eol */ YY_RULE_SETUP #line 158 "configlexer.lex" { cfg_parser->line++; yymore(); } YY_BREAK case 57: YY_RULE_SETUP #line 159 "configlexer.lex" { LEXOUT(("QE ")); BEGIN(INITIAL); yytext[yyleng - 1] = '\0'; yylval.str = region_strdup(cfg_parser->opt->region, yytext); return STRING; } YY_BREAK /* include: directive */ case 58: YY_RULE_SETUP #line 168 "configlexer.lex" { LEXOUT(("v(%s) ", yytext)); BEGIN(include); } YY_BREAK case YY_STATE_EOF(include): #line 169 "configlexer.lex" { yyerror("EOF inside include directive"); BEGIN(INITIAL); } YY_BREAK case 59: YY_RULE_SETUP #line 173 "configlexer.lex" { LEXOUT(("ISP ")); /* ignore */ } YY_BREAK case 60: /* rule 60 can match eol */ YY_RULE_SETUP #line 174 "configlexer.lex" { LEXOUT(("NL\n")); cfg_parser->line++;} YY_BREAK case 61: YY_RULE_SETUP #line 175 "configlexer.lex" { LEXOUT(("IQS ")); BEGIN(include_quoted); } YY_BREAK case 62: YY_RULE_SETUP #line 176 "configlexer.lex" { LEXOUT(("Iunquotedstr(%s) ", yytext)); config_start_include(yytext); BEGIN(INITIAL); } YY_BREAK case YY_STATE_EOF(include_quoted): #line 181 "configlexer.lex" { yyerror("EOF inside quoted string"); BEGIN(INITIAL); } YY_BREAK case 63: YY_RULE_SETUP #line 185 "configlexer.lex" { LEXOUT(("ISTR(%s) ", yytext)); yymore(); } YY_BREAK case 64: /* rule 64 can match eol */ YY_RULE_SETUP #line 186 "configlexer.lex" { cfg_parser->line++; yymore(); } YY_BREAK case 65: YY_RULE_SETUP #line 187 "configlexer.lex" { LEXOUT(("IQE ")); yytext[yyleng - 1] = '\0'; config_start_include(yytext); BEGIN(INITIAL); } YY_BREAK case YY_STATE_EOF(INITIAL): #line 193 "configlexer.lex" { yy_set_bol(1); /* Set beginning of line, so "^" rules match. */ if (config_include_stack_ptr == 0) { yyterminate(); } else { fclose(yyin); config_end_include(); } } YY_BREAK case 66: YY_RULE_SETUP #line 203 "configlexer.lex" { LEXOUT(("unquotedstr(%s) ", yytext)); yylval.str = region_strdup(cfg_parser->opt->region, yytext); return STRING; } YY_BREAK case 67: YY_RULE_SETUP #line 206 "configlexer.lex" ECHO; YY_BREAK #line 1711 "" case YY_END_OF_BUFFER: { /* Amount of text matched not including the EOB char. */ int yy_amount_of_matched_text = (int) (yy_cp - (yytext_ptr)) - 1; /* Undo the effects of YY_DO_BEFORE_ACTION. */ *yy_cp = (yy_hold_char); YY_RESTORE_YY_MORE_OFFSET if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_NEW ) { /* We're scanning a new file or input source. It's * possible that this happened because the user * just pointed yyin at a new source and called * yylex(). If so, then we have to assure * consistency between YY_CURRENT_BUFFER and our * globals. Here is the right place to do so, because * this is the first action (other than possibly a * back-up) that will match for the new input source. */ (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_n_chars; YY_CURRENT_BUFFER_LVALUE->yy_input_file = yyin; YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = YY_BUFFER_NORMAL; } /* Note that here we test for yy_c_buf_p "<=" to the position * of the first EOB in the buffer, since yy_c_buf_p will * already have been incremented past the NUL character * (since all states make transitions on EOB to the * end-of-buffer state). Contrast this with the test * in input(). */ if ( (yy_c_buf_p) <= &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] ) { /* This was really a NUL. */ yy_state_type yy_next_state; (yy_c_buf_p) = (yytext_ptr) + yy_amount_of_matched_text; yy_current_state = yy_get_previous_state( ); /* Okay, we're now positioned to make the NUL * transition. We couldn't have * yy_get_previous_state() go ahead and do it * for us because it doesn't know how to deal * with the possibility of jamming (and we don't * want to build jamming into it because then it * will run more slowly). */ yy_next_state = yy_try_NUL_trans( yy_current_state ); yy_bp = (yytext_ptr) + YY_MORE_ADJ; if ( yy_next_state ) { /* Consume the NUL. */ yy_cp = ++(yy_c_buf_p); yy_current_state = yy_next_state; goto yy_match; } else { yy_cp = (yy_c_buf_p); goto yy_find_action; } } else switch ( yy_get_next_buffer( ) ) { case EOB_ACT_END_OF_FILE: { (yy_did_buffer_switch_on_eof) = 0; if ( yywrap( ) ) { /* Note: because we've taken care in * yy_get_next_buffer() to have set up * yytext, we can now set up * yy_c_buf_p so that if some total * hoser (like flex itself) wants to * call the scanner after we return the * YY_NULL, it'll still work - another * YY_NULL will get returned. */ (yy_c_buf_p) = (yytext_ptr) + YY_MORE_ADJ; yy_act = YY_STATE_EOF(YY_START); goto do_action; } else { if ( ! (yy_did_buffer_switch_on_eof) ) YY_NEW_FILE; } break; } case EOB_ACT_CONTINUE_SCAN: (yy_c_buf_p) = (yytext_ptr) + yy_amount_of_matched_text; yy_current_state = yy_get_previous_state( ); yy_cp = (yy_c_buf_p); yy_bp = (yytext_ptr) + YY_MORE_ADJ; goto yy_match; case EOB_ACT_LAST_MATCH: (yy_c_buf_p) = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)]; yy_current_state = yy_get_previous_state( ); yy_cp = (yy_c_buf_p); yy_bp = (yytext_ptr) + YY_MORE_ADJ; goto yy_find_action; } break; } default: YY_FATAL_ERROR( "fatal flex scanner internal error--no action found" ); } /* end of action switch */ } /* end of scanning one token */ } /* end of yylex */ /* yy_get_next_buffer - try to read in a new buffer * * Returns a code representing an action: * EOB_ACT_LAST_MATCH - * EOB_ACT_CONTINUE_SCAN - continue scanning from current position * EOB_ACT_END_OF_FILE - end of file */ static int yy_get_next_buffer (void) { register char *dest = YY_CURRENT_BUFFER_LVALUE->yy_ch_buf; register char *source = (yytext_ptr); register int number_to_move, i; int ret_val; if ( (yy_c_buf_p) > &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] ) YY_FATAL_ERROR( "fatal flex scanner internal error--end of buffer missed" ); if ( YY_CURRENT_BUFFER_LVALUE->yy_fill_buffer == 0 ) { /* Don't try to fill the buffer, so this is an EOF. */ if ( (yy_c_buf_p) - (yytext_ptr) - YY_MORE_ADJ == 1 ) { /* We matched a single character, the EOB, so * treat this as a final EOF. */ return EOB_ACT_END_OF_FILE; } else { /* We matched some text prior to the EOB, first * process it. */ return EOB_ACT_LAST_MATCH; } } /* Try to read more data. */ /* First move last chars to start of buffer. */ number_to_move = (int) ((yy_c_buf_p) - (yytext_ptr)) - 1; for ( i = 0; i < number_to_move; ++i ) *(dest++) = *(source++); if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_EOF_PENDING ) /* don't do the read, it's not guaranteed to return an EOF, * just force an EOF */ YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars) = 0; else { int num_to_read = YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1; while ( num_to_read <= 0 ) { /* Not enough room in the buffer - grow it. */ /* just a shorter name for the current buffer */ YY_BUFFER_STATE b = YY_CURRENT_BUFFER; int yy_c_buf_p_offset = (int) ((yy_c_buf_p) - b->yy_ch_buf); if ( b->yy_is_our_buffer ) { int new_size = b->yy_buf_size * 2; if ( new_size <= 0 ) b->yy_buf_size += b->yy_buf_size / 8; else b->yy_buf_size *= 2; b->yy_ch_buf = (char *) /* Include room in for 2 EOB chars. */ yyrealloc((void *) b->yy_ch_buf,b->yy_buf_size + 2 ); } else /* Can't grow it, we don't own it. */ b->yy_ch_buf = 0; if ( ! b->yy_ch_buf ) YY_FATAL_ERROR( "fatal error - scanner input buffer overflow" ); (yy_c_buf_p) = &b->yy_ch_buf[yy_c_buf_p_offset]; num_to_read = YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1; } if ( num_to_read > YY_READ_BUF_SIZE ) num_to_read = YY_READ_BUF_SIZE; /* Read in more data. */ YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]), (yy_n_chars), (size_t) num_to_read ); YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars); } if ( (yy_n_chars) == 0 ) { if ( number_to_move == YY_MORE_ADJ ) { ret_val = EOB_ACT_END_OF_FILE; yyrestart(yyin ); } else { ret_val = EOB_ACT_LAST_MATCH; YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = YY_BUFFER_EOF_PENDING; } } else ret_val = EOB_ACT_CONTINUE_SCAN; if ((yy_size_t) ((yy_n_chars) + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) { /* Extend the array by 50%, plus the number we really need. */ yy_size_t new_size = (yy_n_chars) + number_to_move + ((yy_n_chars) >> 1); YY_CURRENT_BUFFER_LVALUE->yy_ch_buf = (char *) yyrealloc((void *) YY_CURRENT_BUFFER_LVALUE->yy_ch_buf,new_size ); if ( ! YY_CURRENT_BUFFER_LVALUE->yy_ch_buf ) YY_FATAL_ERROR( "out of dynamic memory in yy_get_next_buffer()" ); } (yy_n_chars) += number_to_move; YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] = YY_END_OF_BUFFER_CHAR; YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] = YY_END_OF_BUFFER_CHAR; (yytext_ptr) = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[0]; return ret_val; } /* yy_get_previous_state - get the state just before the EOB char was reached */ static yy_state_type yy_get_previous_state (void) { register yy_state_type yy_current_state; register char *yy_cp; yy_current_state = (yy_start); for ( yy_cp = (yytext_ptr) + YY_MORE_ADJ; yy_cp < (yy_c_buf_p); ++yy_cp ) { register YY_CHAR yy_c = (*yy_cp ? yy_ec[YY_SC_TO_UI(*yy_cp)] : 1); if ( yy_accept[yy_current_state] ) { (yy_last_accepting_state) = yy_current_state; (yy_last_accepting_cpos) = yy_cp; } while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) { yy_current_state = (int) yy_def[yy_current_state]; if ( yy_current_state >= 505 ) yy_c = yy_meta[(unsigned int) yy_c]; } yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c]; } return yy_current_state; } /* yy_try_NUL_trans - try to make a transition on the NUL character * * synopsis * next_state = yy_try_NUL_trans( current_state ); */ static yy_state_type yy_try_NUL_trans (yy_state_type yy_current_state ) { register int yy_is_jam; register char *yy_cp = (yy_c_buf_p); register YY_CHAR yy_c = 1; if ( yy_accept[yy_current_state] ) { (yy_last_accepting_state) = yy_current_state; (yy_last_accepting_cpos) = yy_cp; } while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) { yy_current_state = (int) yy_def[yy_current_state]; if ( yy_current_state >= 505 ) yy_c = yy_meta[(unsigned int) yy_c]; } yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c]; yy_is_jam = (yy_current_state == 504); return yy_is_jam ? 0 : yy_current_state; } static void yyunput (int c, register char * yy_bp ) { register char *yy_cp; yy_cp = (yy_c_buf_p); /* undo effects of setting up yytext */ *yy_cp = (yy_hold_char); if ( yy_cp < YY_CURRENT_BUFFER_LVALUE->yy_ch_buf + 2 ) { /* need to shift things up to make room */ /* +2 for EOB chars. */ register int number_to_move = (yy_n_chars) + 2; register char *dest = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[ YY_CURRENT_BUFFER_LVALUE->yy_buf_size + 2]; register char *source = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]; while ( source > YY_CURRENT_BUFFER_LVALUE->yy_ch_buf ) *--dest = *--source; yy_cp += (int) (dest - source); yy_bp += (int) (dest - source); YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_buf_size; if ( yy_cp < YY_CURRENT_BUFFER_LVALUE->yy_ch_buf + 2 ) YY_FATAL_ERROR( "flex scanner push-back overflow" ); } *--yy_cp = (char) c; (yytext_ptr) = yy_bp; (yy_hold_char) = *yy_cp; (yy_c_buf_p) = yy_cp; } #ifndef YY_NO_INPUT #ifdef __cplusplus static int yyinput (void) #else static int input (void) #endif { int c; *(yy_c_buf_p) = (yy_hold_char); if ( *(yy_c_buf_p) == YY_END_OF_BUFFER_CHAR ) { /* yy_c_buf_p now points to the character we want to return. * If this occurs *before* the EOB characters, then it's a * valid NUL; if not, then we've hit the end of the buffer. */ if ( (yy_c_buf_p) < &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] ) /* This was really a NUL. */ *(yy_c_buf_p) = '\0'; else { /* need more input */ int offset = (yy_c_buf_p) - (yytext_ptr); ++(yy_c_buf_p); switch ( yy_get_next_buffer( ) ) { case EOB_ACT_LAST_MATCH: /* This happens because yy_g_n_b() * sees that we've accumulated a * token and flags that we need to * try matching the token before * proceeding. But for input(), * there's no matching to consider. * So convert the EOB_ACT_LAST_MATCH * to EOB_ACT_END_OF_FILE. */ /* Reset buffer status. */ yyrestart(yyin ); /*FALLTHROUGH*/ case EOB_ACT_END_OF_FILE: { if ( yywrap( ) ) return EOF; if ( ! (yy_did_buffer_switch_on_eof) ) YY_NEW_FILE; #ifdef __cplusplus return yyinput(); #else return input(); #endif } case EOB_ACT_CONTINUE_SCAN: (yy_c_buf_p) = (yytext_ptr) + offset; break; } } } c = *(unsigned char *) (yy_c_buf_p); /* cast for 8-bit char's */ *(yy_c_buf_p) = '\0'; /* preserve yytext */ (yy_hold_char) = *++(yy_c_buf_p); return c; } #endif /* ifndef YY_NO_INPUT */ /** Immediately switch to a different input stream. * @param input_file A readable stream. * * @note This function does not reset the start condition to @c INITIAL . */ void yyrestart (FILE * input_file ) { if ( ! YY_CURRENT_BUFFER ){ yyensure_buffer_stack (); YY_CURRENT_BUFFER_LVALUE = yy_create_buffer(yyin,YY_BUF_SIZE ); } yy_init_buffer(YY_CURRENT_BUFFER,input_file ); yy_load_buffer_state( ); } /** Switch to a different input buffer. * @param new_buffer The new input buffer. * */ void yy_switch_to_buffer (YY_BUFFER_STATE new_buffer ) { /* TODO. We should be able to replace this entire function body * with * yypop_buffer_state(); * yypush_buffer_state(new_buffer); */ yyensure_buffer_stack (); if ( YY_CURRENT_BUFFER == new_buffer ) return; if ( YY_CURRENT_BUFFER ) { /* Flush out information for old buffer. */ *(yy_c_buf_p) = (yy_hold_char); YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = (yy_c_buf_p); YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars); } YY_CURRENT_BUFFER_LVALUE = new_buffer; yy_load_buffer_state( ); /* We don't actually know whether we did this switch during * EOF (yywrap()) processing, but the only time this flag * is looked at is after yywrap() is called, so it's safe * to go ahead and always set it. */ (yy_did_buffer_switch_on_eof) = 1; } static void yy_load_buffer_state (void) { (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_n_chars; (yytext_ptr) = (yy_c_buf_p) = YY_CURRENT_BUFFER_LVALUE->yy_buf_pos; yyin = YY_CURRENT_BUFFER_LVALUE->yy_input_file; (yy_hold_char) = *(yy_c_buf_p); } /** Allocate and initialize an input buffer state. * @param file A readable stream. * @param size The character buffer size in bytes. When in doubt, use @c YY_BUF_SIZE. * * @return the allocated buffer state. */ YY_BUFFER_STATE yy_create_buffer (FILE * file, int size ) { YY_BUFFER_STATE b; b = (YY_BUFFER_STATE) yyalloc(sizeof( struct yy_buffer_state ) ); if ( ! b ) YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" ); b->yy_buf_size = size; /* yy_ch_buf has to be 2 characters longer than the size given because * we need to put in 2 end-of-buffer characters. */ b->yy_ch_buf = (char *) yyalloc(b->yy_buf_size + 2 ); if ( ! b->yy_ch_buf ) YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" ); b->yy_is_our_buffer = 1; yy_init_buffer(b,file ); return b; } /** Destroy the buffer. * @param b a buffer created with yy_create_buffer() * */ void yy_delete_buffer (YY_BUFFER_STATE b ) { if ( ! b ) return; if ( b == YY_CURRENT_BUFFER ) /* Not sure if we should pop here. */ YY_CURRENT_BUFFER_LVALUE = (YY_BUFFER_STATE) 0; if ( b->yy_is_our_buffer ) yyfree((void *) b->yy_ch_buf ); yyfree((void *) b ); } #ifndef __cplusplus extern int isatty (int ); #endif /* __cplusplus */ /* Initializes or reinitializes a buffer. * This function is sometimes called more than once on the same buffer, * such as during a yyrestart() or at EOF. */ static void yy_init_buffer (YY_BUFFER_STATE b, FILE * file ) { int oerrno = errno; yy_flush_buffer(b ); b->yy_input_file = file; b->yy_fill_buffer = 1; /* If b is the current buffer, then yy_init_buffer was _probably_ * called from yyrestart() or through yy_get_next_buffer. * In that case, we don't want to reset the lineno or column. */ if (b != YY_CURRENT_BUFFER){ b->yy_bs_lineno = 1; b->yy_bs_column = 0; } b->yy_is_interactive = file ? (isatty( fileno(file) ) > 0) : 0; errno = oerrno; } /** Discard all buffered characters. On the next scan, YY_INPUT will be called. * @param b the buffer state to be flushed, usually @c YY_CURRENT_BUFFER. * */ void yy_flush_buffer (YY_BUFFER_STATE b ) { if ( ! b ) return; b->yy_n_chars = 0; /* We always need two end-of-buffer characters. The first causes * a transition to the end-of-buffer state. The second causes * a jam in that state. */ b->yy_ch_buf[0] = YY_END_OF_BUFFER_CHAR; b->yy_ch_buf[1] = YY_END_OF_BUFFER_CHAR; b->yy_buf_pos = &b->yy_ch_buf[0]; b->yy_at_bol = 1; b->yy_buffer_status = YY_BUFFER_NEW; if ( b == YY_CURRENT_BUFFER ) yy_load_buffer_state( ); } /** Pushes the new state onto the stack. The new state becomes * the current state. This function will allocate the stack * if necessary. * @param new_buffer The new state. * */ void yypush_buffer_state (YY_BUFFER_STATE new_buffer ) { if (new_buffer == NULL) return; yyensure_buffer_stack(); /* This block is copied from yy_switch_to_buffer. */ if ( YY_CURRENT_BUFFER ) { /* Flush out information for old buffer. */ *(yy_c_buf_p) = (yy_hold_char); YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = (yy_c_buf_p); YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars); } /* Only push if top exists. Otherwise, replace top. */ if (YY_CURRENT_BUFFER) (yy_buffer_stack_top)++; YY_CURRENT_BUFFER_LVALUE = new_buffer; /* copied from yy_switch_to_buffer. */ yy_load_buffer_state( ); (yy_did_buffer_switch_on_eof) = 1; } /** Removes and deletes the top of the stack, if present. * The next element becomes the new top. * */ void yypop_buffer_state (void) { if (!YY_CURRENT_BUFFER) return; yy_delete_buffer(YY_CURRENT_BUFFER ); YY_CURRENT_BUFFER_LVALUE = NULL; if ((yy_buffer_stack_top) > 0) --(yy_buffer_stack_top); if (YY_CURRENT_BUFFER) { yy_load_buffer_state( ); (yy_did_buffer_switch_on_eof) = 1; } } /* Allocates the stack if it does not exist. * Guarantees space for at least one push. */ static void yyensure_buffer_stack (void) { int num_to_alloc; if (!(yy_buffer_stack)) { /* First allocation is just for 2 elements, since we don't know if this * scanner will even need a stack. We use 2 instead of 1 to avoid an * immediate realloc on the next call. */ num_to_alloc = 1; (yy_buffer_stack) = (struct yy_buffer_state**)yyalloc (num_to_alloc * sizeof(struct yy_buffer_state*) ); if ( ! (yy_buffer_stack) ) YY_FATAL_ERROR( "out of dynamic memory in yyensure_buffer_stack()" ); memset((yy_buffer_stack), 0, num_to_alloc * sizeof(struct yy_buffer_state*)); (yy_buffer_stack_max) = num_to_alloc; (yy_buffer_stack_top) = 0; return; } if ((yy_buffer_stack_top) >= ((yy_buffer_stack_max)) - 1){ /* Increase the buffer to prepare for a possible push. */ int grow_size = 8 /* arbitrary grow size */; num_to_alloc = (yy_buffer_stack_max) + grow_size; (yy_buffer_stack) = (struct yy_buffer_state**)yyrealloc ((yy_buffer_stack), num_to_alloc * sizeof(struct yy_buffer_state*) ); if ( ! (yy_buffer_stack) ) YY_FATAL_ERROR( "out of dynamic memory in yyensure_buffer_stack()" ); /* zero only the new slots.*/ memset((yy_buffer_stack) + (yy_buffer_stack_max), 0, grow_size * sizeof(struct yy_buffer_state*)); (yy_buffer_stack_max) = num_to_alloc; } } /** Setup the input buffer state to scan directly from a user-specified character buffer. * @param base the character buffer * @param size the size in bytes of the character buffer * * @return the newly allocated buffer state object. */ YY_BUFFER_STATE yy_scan_buffer (char * base, yy_size_t size ) { YY_BUFFER_STATE b; if ( size < 2 || base[size-2] != YY_END_OF_BUFFER_CHAR || base[size-1] != YY_END_OF_BUFFER_CHAR ) /* They forgot to leave room for the EOB's. */ return 0; b = (YY_BUFFER_STATE) yyalloc(sizeof( struct yy_buffer_state ) ); if ( ! b ) YY_FATAL_ERROR( "out of dynamic memory in yy_scan_buffer()" ); b->yy_buf_size = size - 2; /* "- 2" to take care of EOB's */ b->yy_buf_pos = b->yy_ch_buf = base; b->yy_is_our_buffer = 0; b->yy_input_file = 0; b->yy_n_chars = b->yy_buf_size; b->yy_is_interactive = 0; b->yy_at_bol = 1; b->yy_fill_buffer = 0; b->yy_buffer_status = YY_BUFFER_NEW; yy_switch_to_buffer(b ); return b; } /** Setup the input buffer state to scan a string. The next call to yylex() will * scan from a @e copy of @a str. * @param yystr a NUL-terminated string to scan * * @return the newly allocated buffer state object. * @note If you want to scan bytes that may contain NUL values, then use * yy_scan_bytes() instead. */ YY_BUFFER_STATE yy_scan_string (yyconst char * yystr ) { return yy_scan_bytes(yystr,strlen(yystr) ); } /** Setup the input buffer state to scan the given bytes. The next call to yylex() will * scan from a @e copy of @a bytes. * @param yybytes the byte buffer to scan * @param _yybytes_len the number of bytes in the buffer pointed to by @a bytes. * * @return the newly allocated buffer state object. */ YY_BUFFER_STATE yy_scan_bytes (yyconst char * yybytes, int _yybytes_len ) { YY_BUFFER_STATE b; char *buf; yy_size_t n; int i; /* Get memory for full buffer, including space for trailing EOB's. */ n = _yybytes_len + 2; buf = (char *) yyalloc(n ); if ( ! buf ) YY_FATAL_ERROR( "out of dynamic memory in yy_scan_bytes()" ); for ( i = 0; i < _yybytes_len; ++i ) buf[i] = yybytes[i]; buf[_yybytes_len] = buf[_yybytes_len+1] = YY_END_OF_BUFFER_CHAR; b = yy_scan_buffer(buf,n ); if ( ! b ) YY_FATAL_ERROR( "bad buffer in yy_scan_bytes()" ); /* It's okay to grow etc. this buffer, and we should throw it * away when we're done. */ b->yy_is_our_buffer = 1; return b; } #ifndef YY_EXIT_FAILURE #define YY_EXIT_FAILURE 2 #endif static void yy_fatal_error (yyconst char* msg ) { (void) fprintf( stderr, "%s\n", msg ); exit( YY_EXIT_FAILURE ); } /* Redefine yyless() so it works in section 3 code. */ #undef yyless #define yyless(n) \ do \ { \ /* Undo effects of setting up yytext. */ \ int yyless_macro_arg = (n); \ YY_LESS_LINENO(yyless_macro_arg);\ yytext[yyleng] = (yy_hold_char); \ (yy_c_buf_p) = yytext + yyless_macro_arg; \ (yy_hold_char) = *(yy_c_buf_p); \ *(yy_c_buf_p) = '\0'; \ yyleng = yyless_macro_arg; \ } \ while ( 0 ) /* Accessor methods (get/set functions) to struct members. */ /** Get the current line number. * */ int yyget_lineno (void) { return yylineno; } /** Get the input stream. * */ FILE *yyget_in (void) { return yyin; } /** Get the output stream. * */ FILE *yyget_out (void) { return yyout; } /** Get the length of the current token. * */ int yyget_leng (void) { return yyleng; } /** Get the current token. * */ char *yyget_text (void) { return yytext; } /** Set the current line number. * @param line_number * */ void yyset_lineno (int line_number ) { yylineno = line_number; } /** Set the input stream. This does not discard the current * input buffer. * @param in_str A readable stream. * * @see yy_switch_to_buffer */ void yyset_in (FILE * in_str ) { yyin = in_str ; } void yyset_out (FILE * out_str ) { yyout = out_str ; } int yyget_debug (void) { return yy_flex_debug; } void yyset_debug (int bdebug ) { yy_flex_debug = bdebug ; } static int yy_init_globals (void) { /* Initialization is the same as for the non-reentrant scanner. * This function is called from yylex_destroy(), so don't allocate here. */ (yy_buffer_stack) = 0; (yy_buffer_stack_top) = 0; (yy_buffer_stack_max) = 0; (yy_c_buf_p) = (char *) 0; (yy_init) = 0; (yy_start) = 0; /* Defined in main.c */ #ifdef YY_STDINIT yyin = stdin; yyout = stdout; #else yyin = (FILE *) 0; yyout = (FILE *) 0; #endif /* For future reference: Set errno on error, since we are called by * yylex_init() */ return 0; } /* yylex_destroy is for both reentrant and non-reentrant scanners. */ int yylex_destroy (void) { /* Pop the buffer stack, destroying each element. */ while(YY_CURRENT_BUFFER){ yy_delete_buffer(YY_CURRENT_BUFFER ); YY_CURRENT_BUFFER_LVALUE = NULL; yypop_buffer_state(); } /* Destroy the stack itself. */ yyfree((yy_buffer_stack) ); (yy_buffer_stack) = NULL; /* Reset the globals. This is important in a non-reentrant scanner so the next time * yylex() is called, initialization will occur. */ yy_init_globals( ); return 0; } /* * Internal utility routines. */ #ifndef yytext_ptr static void yy_flex_strncpy (char* s1, yyconst char * s2, int n ) { register int i; for ( i = 0; i < n; ++i ) s1[i] = s2[i]; } #endif #ifdef YY_NEED_STRLEN static int yy_flex_strlen (yyconst char * s ) { register int n; for ( n = 0; s[n]; ++n ) ; return n; } #endif void *yyalloc (yy_size_t size ) { return (void *) malloc( size ); } void *yyrealloc (void * ptr, yy_size_t size ) { /* The cast to (char *) in the following accommodates both * implementations that use char* generic pointers, and those * that use void* generic pointers. It works with the latter * because both ANSI C and C++ allow castless assignment from * any pointer type to void*, and deal with argument conversions * as though doing an assignment. */ return (void *) realloc( (char *) ptr, size ); } void yyfree (void * ptr ) { free( (char *) ptr ); /* see yyrealloc() for (char *) cast */ } #define YYTABLES_NAME "yytables" #line 206 "configlexer.lex" nsd-3.2.16/configure0000775000175000017500000072352012173226546013303 0ustar matjematje#! /bin/sh # Guess values for system-dependent variables and create Makefiles. # Generated by GNU Autoconf 2.68 for NSD 3.2.16. # # Report bugs to . # # # Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001, # 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010 Free Software # Foundation, Inc. # # # This configure script is free software; the Free Software Foundation # gives unlimited permission to copy, distribute and modify it. ## -------------------- ## ## M4sh Initialization. ## ## -------------------- ## # Be more Bourne compatible DUALCASE=1; export DUALCASE # for MKS sh if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in #( *posix*) : set -o posix ;; #( *) : ;; esac fi as_nl=' ' export as_nl # Printing a long string crashes Solaris 7 /usr/bin/printf. as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo # Prefer a ksh shell builtin over an external printf program on Solaris, # but without wasting forks for bash or zsh. if test -z "$BASH_VERSION$ZSH_VERSION" \ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='print -r --' as_echo_n='print -rn --' elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='printf %s\n' as_echo_n='printf %s' else if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' as_echo_n='/usr/ucb/echo -n' else as_echo_body='eval expr "X$1" : "X\\(.*\\)"' as_echo_n_body='eval arg=$1; case $arg in #( *"$as_nl"*) expr "X$arg" : "X\\(.*\\)$as_nl"; arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; esac; expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ' export as_echo_n_body as_echo_n='sh -c $as_echo_n_body as_echo' fi export as_echo_body as_echo='sh -c $as_echo_body as_echo' fi # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi # IFS # We need space, tab and new line, in precisely that order. Quoting is # there to prevent editors from complaining about space-tab. # (If _AS_PATH_WALK were called with IFS unset, it would disable word # splitting by setting IFS to empty value.) IFS=" "" $as_nl" # Find who we are. Look in the path if we contain no directory separator. as_myself= case $0 in #(( *[\\/]* ) as_myself=$0 ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break done IFS=$as_save_IFS ;; esac # We did not find ourselves, most probably we were run as `sh COMMAND' # in which case we are not to be found in the path. if test "x$as_myself" = x; then as_myself=$0 fi if test ! -f "$as_myself"; then $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 exit 1 fi # Unset variables that we do not need and which cause bugs (e.g. in # pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1" # suppresses any "Segmentation fault" message there. '((' could # trigger a bug in pdksh 5.2.14. for as_var in BASH_ENV ENV MAIL MAILPATH do eval test x\${$as_var+set} = xset \ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : done PS1='$ ' PS2='> ' PS4='+ ' # NLS nuisances. LC_ALL=C export LC_ALL LANGUAGE=C export LANGUAGE # CDPATH. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH if test "x$CONFIG_SHELL" = x; then as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which # is contrary to our usage. Disable this feature. alias -g '\${1+\"\$@\"}'='\"\$@\"' setopt NO_GLOB_SUBST else case \`(set -o) 2>/dev/null\` in #( *posix*) : set -o posix ;; #( *) : ;; esac fi " as_required="as_fn_return () { (exit \$1); } as_fn_success () { as_fn_return 0; } as_fn_failure () { as_fn_return 1; } as_fn_ret_success () { return 0; } as_fn_ret_failure () { return 1; } exitcode=0 as_fn_success || { exitcode=1; echo as_fn_success failed.; } as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; } as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; } as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; } if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then : else exitcode=1; echo positional parameters were not saved. fi test x\$exitcode = x0 || exit 1" as_suggested=" as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" && test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' || exit 1 test \$(( 1 + 1 )) = 2 || exit 1" if (eval "$as_required") 2>/dev/null; then : as_have_required=yes else as_have_required=no fi if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null; then : else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR as_found=false for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. as_found=: case $as_dir in #( /*) for as_base in sh bash ksh sh5; do # Try only shells that exist, to save several forks. as_shell=$as_dir/$as_base if { test -f "$as_shell" || test -f "$as_shell.exe"; } && { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$as_shell"; } 2>/dev/null; then : CONFIG_SHELL=$as_shell as_have_required=yes if { $as_echo "$as_bourne_compatible""$as_suggested" | as_run=a "$as_shell"; } 2>/dev/null; then : break 2 fi fi done;; esac as_found=false done $as_found || { if { test -f "$SHELL" || test -f "$SHELL.exe"; } && { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$SHELL"; } 2>/dev/null; then : CONFIG_SHELL=$SHELL as_have_required=yes fi; } IFS=$as_save_IFS if test "x$CONFIG_SHELL" != x; then : # We cannot yet assume a decent shell, so we have to provide a # neutralization value for shells without unset; and this also # works around shells that cannot unset nonexistent variables. # Preserve -v and -x to the replacement shell. BASH_ENV=/dev/null ENV=/dev/null (unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV export CONFIG_SHELL case $- in # (((( *v*x* | *x*v* ) as_opts=-vx ;; *v* ) as_opts=-v ;; *x* ) as_opts=-x ;; * ) as_opts= ;; esac exec "$CONFIG_SHELL" $as_opts "$as_myself" ${1+"$@"} fi if test x$as_have_required = xno; then : $as_echo "$0: This script requires a shell more modern than all" $as_echo "$0: the shells that I found on your system." if test x${ZSH_VERSION+set} = xset ; then $as_echo "$0: In particular, zsh $ZSH_VERSION has bugs and should" $as_echo "$0: be upgraded to zsh 4.3.4 or later." else $as_echo "$0: Please tell bug-autoconf@gnu.org and $0: nsd-bugs@nlnetlabs.nl about your system, including any $0: error possibly output before this message. Then install $0: a modern shell, or manually run the script under such a $0: shell if you do have one." fi exit 1 fi fi fi SHELL=${CONFIG_SHELL-/bin/sh} export SHELL # Unset more variables known to interfere with behavior of common tools. CLICOLOR_FORCE= GREP_OPTIONS= unset CLICOLOR_FORCE GREP_OPTIONS ## --------------------- ## ## M4sh Shell Functions. ## ## --------------------- ## # as_fn_unset VAR # --------------- # Portably unset VAR. as_fn_unset () { { eval $1=; unset $1;} } as_unset=as_fn_unset # as_fn_set_status STATUS # ----------------------- # Set $? to STATUS, without forking. as_fn_set_status () { return $1 } # as_fn_set_status # as_fn_exit STATUS # ----------------- # Exit the shell with STATUS, even in a "trap 0" or "set -e" context. as_fn_exit () { set +e as_fn_set_status $1 exit $1 } # as_fn_exit # as_fn_mkdir_p # ------------- # Create "$as_dir" as a directory, including parents if necessary. as_fn_mkdir_p () { case $as_dir in #( -*) as_dir=./$as_dir;; esac test -d "$as_dir" || eval $as_mkdir_p || { as_dirs= while :; do case $as_dir in #( *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( *) as_qdir=$as_dir;; esac as_dirs="'$as_qdir' $as_dirs" as_dir=`$as_dirname -- "$as_dir" || $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_dir" : 'X\(//\)[^/]' \| \ X"$as_dir" : 'X\(//\)$' \| \ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_dir" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` test -d "$as_dir" && break done test -z "$as_dirs" || eval "mkdir $as_dirs" } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" } # as_fn_mkdir_p # as_fn_append VAR VALUE # ---------------------- # Append the text in VALUE to the end of the definition contained in VAR. Take # advantage of any shell optimizations that allow amortized linear growth over # repeated appends, instead of the typical quadratic growth present in naive # implementations. if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then : eval 'as_fn_append () { eval $1+=\$2 }' else as_fn_append () { eval $1=\$$1\$2 } fi # as_fn_append # as_fn_arith ARG... # ------------------ # Perform arithmetic evaluation on the ARGs, and store the result in the # global $as_val. Take advantage of shells that can avoid forks. The arguments # must be portable across $(()) and expr. if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then : eval 'as_fn_arith () { as_val=$(( $* )) }' else as_fn_arith () { as_val=`expr "$@" || test $? -eq 1` } fi # as_fn_arith # as_fn_error STATUS ERROR [LINENO LOG_FD] # ---------------------------------------- # Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are # provided, also output the error to LOG_FD, referencing LINENO. Then exit the # script with STATUS, using 1 if that was 0. as_fn_error () { as_status=$1; test $as_status -eq 0 && as_status=1 if test "$4"; then as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 fi $as_echo "$as_me: error: $2" >&2 as_fn_exit $as_status } # as_fn_error if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then as_basename=basename else as_basename=false fi if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then as_dirname=dirname else as_dirname=false fi as_me=`$as_basename -- "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)' \| . 2>/dev/null || $as_echo X/"$0" | sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/ q } /^X\/\(\/\/\)$/{ s//\1/ q } /^X\/\(\/\).*/{ s//\1/ q } s/.*/./; q'` # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' as_cr_Letters=$as_cr_letters$as_cr_LETTERS as_cr_digits='0123456789' as_cr_alnum=$as_cr_Letters$as_cr_digits as_lineno_1=$LINENO as_lineno_1a=$LINENO as_lineno_2=$LINENO as_lineno_2a=$LINENO eval 'test "x$as_lineno_1'$as_run'" != "x$as_lineno_2'$as_run'" && test "x`expr $as_lineno_1'$as_run' + 1`" = "x$as_lineno_2'$as_run'"' || { # Blame Lee E. McMahon (1931-1989) for sed's syntax. :-) sed -n ' p /[$]LINENO/= ' <$as_myself | sed ' s/[$]LINENO.*/&-/ t lineno b :lineno N :loop s/[$]LINENO\([^'$as_cr_alnum'_].*\n\)\(.*\)/\2\1\2/ t loop s/-\n.*// ' >$as_me.lineno && chmod +x "$as_me.lineno" || { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; } # Don't try to exec as it changes $[0], causing all sort of problems # (the dirname of $[0] is not the place where we might find the # original and so on. Autoconf is especially sensitive to this). . "./$as_me.lineno" # Exit status is that of the last command. exit } ECHO_C= ECHO_N= ECHO_T= case `echo -n x` in #((((( -n*) case `echo 'xy\c'` in *c*) ECHO_T=' ';; # ECHO_T is single tab character. xy) ECHO_C='\c';; *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ECHO_T=' ';; esac;; *) ECHO_N='-n';; esac rm -f conf$$ conf$$.exe conf$$.file if test -d conf$$.dir; then rm -f conf$$.dir/conf$$.file else rm -f conf$$.dir mkdir conf$$.dir 2>/dev/null fi if (echo >conf$$.file) 2>/dev/null; then if ln -s conf$$.file conf$$ 2>/dev/null; then as_ln_s='ln -s' # ... but there are two gotchas: # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. # In both cases, we have to default to `cp -p'. ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || as_ln_s='cp -p' elif ln conf$$.file conf$$ 2>/dev/null; then as_ln_s=ln else as_ln_s='cp -p' fi else as_ln_s='cp -p' fi rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file rmdir conf$$.dir 2>/dev/null if mkdir -p . 2>/dev/null; then as_mkdir_p='mkdir -p "$as_dir"' else test -d ./-p && rmdir ./-p as_mkdir_p=false fi if test -x / >/dev/null 2>&1; then as_test_x='test -x' else if ls -dL / >/dev/null 2>&1; then as_ls_L_option=L else as_ls_L_option= fi as_test_x=' eval sh -c '\'' if test -d "$1"; then test -d "$1/."; else case $1 in #( -*)set "./$1";; esac; case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in #(( ???[sx]*):;;*)false;;esac;fi '\'' sh ' fi as_executable_p=$as_test_x # Sed expression to map a string onto a valid CPP name. as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" test -n "$DJDIR" || exec 7<&0 &1 # Name of the host. # hostname on some systems (SVR3.2, old GNU/Linux) returns a bogus exit status, # so uname gets run too. ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q` # # Initializations. # ac_default_prefix=/usr/local ac_clean_files= ac_config_libobj_dir=. LIBOBJS= cross_compiling=no subdirs= MFLAGS= MAKEFLAGS= # Identity of this package. PACKAGE_NAME='NSD' PACKAGE_TARNAME='nsd' PACKAGE_VERSION='3.2.16' PACKAGE_STRING='NSD 3.2.16' PACKAGE_BUGREPORT='nsd-bugs@nlnetlabs.nl' PACKAGE_URL='' # Factoring default headers for most tests. ac_includes_default="\ #include #ifdef HAVE_SYS_TYPES_H # include #endif #ifdef HAVE_SYS_STAT_H # include #endif #ifdef STDC_HEADERS # include # include #else # ifdef HAVE_STDLIB_H # include # endif #endif #ifdef HAVE_STRING_H # if !defined STDC_HEADERS && defined HAVE_MEMORY_H # include # endif # include #endif #ifdef HAVE_STRINGS_H # include #endif #ifdef HAVE_INTTYPES_H # include #endif #ifdef HAVE_STDINT_H # include #endif #ifdef HAVE_UNISTD_H # include #endif" ac_subst_vars='LTLIBOBJS zonestatsfile HAVE_SSL ratelimit LIBOBJS YFLAGS YACC LEXLIB LEX_OUTPUT_ROOT LEX INSTALL_DATA INSTALL_SCRIPT INSTALL_PROGRAM LN_S AWK user xfrdfile difffile zonesdir piddir dbdir dbfile pidfile logfile kill_priority start_priority nsd_conf_file configdir EGREP GREP CPP OBJEXT EXEEXT ac_ct_CC CPPFLAGS LDFLAGS CFLAGS CC target_alias host_alias build_alias LIBS ECHO_T ECHO_N ECHO_C DEFS mandir localedir libdir psdir pdfdir dvidir htmldir infodir docdir oldincludedir includedir localstatedir sharedstatedir sysconfdir datadir datarootdir libexecdir sbindir bindir program_transform_name prefix exec_prefix PACKAGE_URL PACKAGE_BUGREPORT PACKAGE_STRING PACKAGE_VERSION PACKAGE_TARNAME PACKAGE_NAME PATH_SEPARATOR SHELL' ac_subst_files='' ac_user_opts=' enable_option_checking with_configdir with_nsd_conf_file with_start_priority with_kill_priority with_pidfile with_dbfile with_zonesdir with_difffile with_xfrdfile with_chroot with_user enable_largefile with_facility with_max_ips with_tcp_timeout enable_root_server enable_ipv6 enable_bind8_stats enable_checking enable_ratelimit with_ssl enable_nsec3 enable_full_prehash enable_minimal_responses enable_draft_rrtypes enable_mmap enable_zone_stats ' ac_precious_vars='build_alias host_alias target_alias CC CFLAGS LDFLAGS LIBS CPPFLAGS CPP YACC YFLAGS' # Initialize some variables set by options. ac_init_help= ac_init_version=false ac_unrecognized_opts= ac_unrecognized_sep= # The variables have the same names as the options, with # dashes changed to underlines. cache_file=/dev/null exec_prefix=NONE no_create= no_recursion= prefix=NONE program_prefix=NONE program_suffix=NONE program_transform_name=s,x,x, silent= site= srcdir= verbose= x_includes=NONE x_libraries=NONE # Installation directory options. # These are left unexpanded so users can "make install exec_prefix=/foo" # and all the variables that are supposed to be based on exec_prefix # by default will actually change. # Use braces instead of parens because sh, perl, etc. also accept them. # (The list follows the same order as the GNU Coding Standards.) bindir='${exec_prefix}/bin' sbindir='${exec_prefix}/sbin' libexecdir='${exec_prefix}/libexec' datarootdir='${prefix}/share' datadir='${datarootdir}' sysconfdir='${prefix}/etc' sharedstatedir='${prefix}/com' localstatedir='${prefix}/var' includedir='${prefix}/include' oldincludedir='/usr/include' docdir='${datarootdir}/doc/${PACKAGE_TARNAME}' infodir='${datarootdir}/info' htmldir='${docdir}' dvidir='${docdir}' pdfdir='${docdir}' psdir='${docdir}' libdir='${exec_prefix}/lib' localedir='${datarootdir}/locale' mandir='${datarootdir}/man' ac_prev= ac_dashdash= for ac_option do # If the previous option needs an argument, assign it. if test -n "$ac_prev"; then eval $ac_prev=\$ac_option ac_prev= continue fi case $ac_option in *=?*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;; *=) ac_optarg= ;; *) ac_optarg=yes ;; esac # Accept the important Cygnus configure options, so we can diagnose typos. case $ac_dashdash$ac_option in --) ac_dashdash=yes ;; -bindir | --bindir | --bindi | --bind | --bin | --bi) ac_prev=bindir ;; -bindir=* | --bindir=* | --bindi=* | --bind=* | --bin=* | --bi=*) bindir=$ac_optarg ;; -build | --build | --buil | --bui | --bu) ac_prev=build_alias ;; -build=* | --build=* | --buil=* | --bui=* | --bu=*) build_alias=$ac_optarg ;; -cache-file | --cache-file | --cache-fil | --cache-fi \ | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c) ac_prev=cache_file ;; -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \ | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* | --c=*) cache_file=$ac_optarg ;; --config-cache | -C) cache_file=config.cache ;; -datadir | --datadir | --datadi | --datad) ac_prev=datadir ;; -datadir=* | --datadir=* | --datadi=* | --datad=*) datadir=$ac_optarg ;; -datarootdir | --datarootdir | --datarootdi | --datarootd | --dataroot \ | --dataroo | --dataro | --datar) ac_prev=datarootdir ;; -datarootdir=* | --datarootdir=* | --datarootdi=* | --datarootd=* \ | --dataroot=* | --dataroo=* | --dataro=* | --datar=*) datarootdir=$ac_optarg ;; -disable-* | --disable-*) ac_useropt=`expr "x$ac_option" : 'x-*disable-\(.*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid feature name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "enable_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--disable-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval enable_$ac_useropt=no ;; -docdir | --docdir | --docdi | --doc | --do) ac_prev=docdir ;; -docdir=* | --docdir=* | --docdi=* | --doc=* | --do=*) docdir=$ac_optarg ;; -dvidir | --dvidir | --dvidi | --dvid | --dvi | --dv) ac_prev=dvidir ;; -dvidir=* | --dvidir=* | --dvidi=* | --dvid=* | --dvi=* | --dv=*) dvidir=$ac_optarg ;; -enable-* | --enable-*) ac_useropt=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid feature name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "enable_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--enable-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval enable_$ac_useropt=\$ac_optarg ;; -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \ | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \ | --exec | --exe | --ex) ac_prev=exec_prefix ;; -exec-prefix=* | --exec_prefix=* | --exec-prefix=* | --exec-prefi=* \ | --exec-pref=* | --exec-pre=* | --exec-pr=* | --exec-p=* | --exec-=* \ | --exec=* | --exe=* | --ex=*) exec_prefix=$ac_optarg ;; -gas | --gas | --ga | --g) # Obsolete; use --with-gas. with_gas=yes ;; -help | --help | --hel | --he | -h) ac_init_help=long ;; -help=r* | --help=r* | --hel=r* | --he=r* | -hr*) ac_init_help=recursive ;; -help=s* | --help=s* | --hel=s* | --he=s* | -hs*) ac_init_help=short ;; -host | --host | --hos | --ho) ac_prev=host_alias ;; -host=* | --host=* | --hos=* | --ho=*) host_alias=$ac_optarg ;; -htmldir | --htmldir | --htmldi | --htmld | --html | --htm | --ht) ac_prev=htmldir ;; -htmldir=* | --htmldir=* | --htmldi=* | --htmld=* | --html=* | --htm=* \ | --ht=*) htmldir=$ac_optarg ;; -includedir | --includedir | --includedi | --included | --include \ | --includ | --inclu | --incl | --inc) ac_prev=includedir ;; -includedir=* | --includedir=* | --includedi=* | --included=* | --include=* \ | --includ=* | --inclu=* | --incl=* | --inc=*) includedir=$ac_optarg ;; -infodir | --infodir | --infodi | --infod | --info | --inf) ac_prev=infodir ;; -infodir=* | --infodir=* | --infodi=* | --infod=* | --info=* | --inf=*) infodir=$ac_optarg ;; -libdir | --libdir | --libdi | --libd) ac_prev=libdir ;; -libdir=* | --libdir=* | --libdi=* | --libd=*) libdir=$ac_optarg ;; -libexecdir | --libexecdir | --libexecdi | --libexecd | --libexec \ | --libexe | --libex | --libe) ac_prev=libexecdir ;; -libexecdir=* | --libexecdir=* | --libexecdi=* | --libexecd=* | --libexec=* \ | --libexe=* | --libex=* | --libe=*) libexecdir=$ac_optarg ;; -localedir | --localedir | --localedi | --localed | --locale) ac_prev=localedir ;; -localedir=* | --localedir=* | --localedi=* | --localed=* | --locale=*) localedir=$ac_optarg ;; -localstatedir | --localstatedir | --localstatedi | --localstated \ | --localstate | --localstat | --localsta | --localst | --locals) ac_prev=localstatedir ;; -localstatedir=* | --localstatedir=* | --localstatedi=* | --localstated=* \ | --localstate=* | --localstat=* | --localsta=* | --localst=* | --locals=*) localstatedir=$ac_optarg ;; -mandir | --mandir | --mandi | --mand | --man | --ma | --m) ac_prev=mandir ;; -mandir=* | --mandir=* | --mandi=* | --mand=* | --man=* | --ma=* | --m=*) mandir=$ac_optarg ;; -nfp | --nfp | --nf) # Obsolete; use --without-fp. with_fp=no ;; -no-create | --no-create | --no-creat | --no-crea | --no-cre \ | --no-cr | --no-c | -n) no_create=yes ;; -no-recursion | --no-recursion | --no-recursio | --no-recursi \ | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) no_recursion=yes ;; -oldincludedir | --oldincludedir | --oldincludedi | --oldincluded \ | --oldinclude | --oldinclud | --oldinclu | --oldincl | --oldinc \ | --oldin | --oldi | --old | --ol | --o) ac_prev=oldincludedir ;; -oldincludedir=* | --oldincludedir=* | --oldincludedi=* | --oldincluded=* \ | --oldinclude=* | --oldinclud=* | --oldinclu=* | --oldincl=* | --oldinc=* \ | --oldin=* | --oldi=* | --old=* | --ol=* | --o=*) oldincludedir=$ac_optarg ;; -prefix | --prefix | --prefi | --pref | --pre | --pr | --p) ac_prev=prefix ;; -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*) prefix=$ac_optarg ;; -program-prefix | --program-prefix | --program-prefi | --program-pref \ | --program-pre | --program-pr | --program-p) ac_prev=program_prefix ;; -program-prefix=* | --program-prefix=* | --program-prefi=* \ | --program-pref=* | --program-pre=* | --program-pr=* | --program-p=*) program_prefix=$ac_optarg ;; -program-suffix | --program-suffix | --program-suffi | --program-suff \ | --program-suf | --program-su | --program-s) ac_prev=program_suffix ;; -program-suffix=* | --program-suffix=* | --program-suffi=* \ | --program-suff=* | --program-suf=* | --program-su=* | --program-s=*) program_suffix=$ac_optarg ;; -program-transform-name | --program-transform-name \ | --program-transform-nam | --program-transform-na \ | --program-transform-n | --program-transform- \ | --program-transform | --program-transfor \ | --program-transfo | --program-transf \ | --program-trans | --program-tran \ | --progr-tra | --program-tr | --program-t) ac_prev=program_transform_name ;; -program-transform-name=* | --program-transform-name=* \ | --program-transform-nam=* | --program-transform-na=* \ | --program-transform-n=* | --program-transform-=* \ | --program-transform=* | --program-transfor=* \ | --program-transfo=* | --program-transf=* \ | --program-trans=* | --program-tran=* \ | --progr-tra=* | --program-tr=* | --program-t=*) program_transform_name=$ac_optarg ;; -pdfdir | --pdfdir | --pdfdi | --pdfd | --pdf | --pd) ac_prev=pdfdir ;; -pdfdir=* | --pdfdir=* | --pdfdi=* | --pdfd=* | --pdf=* | --pd=*) pdfdir=$ac_optarg ;; -psdir | --psdir | --psdi | --psd | --ps) ac_prev=psdir ;; -psdir=* | --psdir=* | --psdi=* | --psd=* | --ps=*) psdir=$ac_optarg ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) silent=yes ;; -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ | --sbi=* | --sb=*) sbindir=$ac_optarg ;; -sharedstatedir | --sharedstatedir | --sharedstatedi \ | --sharedstated | --sharedstate | --sharedstat | --sharedsta \ | --sharedst | --shareds | --shared | --share | --shar \ | --sha | --sh) ac_prev=sharedstatedir ;; -sharedstatedir=* | --sharedstatedir=* | --sharedstatedi=* \ | --sharedstated=* | --sharedstate=* | --sharedstat=* | --sharedsta=* \ | --sharedst=* | --shareds=* | --shared=* | --share=* | --shar=* \ | --sha=* | --sh=*) sharedstatedir=$ac_optarg ;; -site | --site | --sit) ac_prev=site ;; -site=* | --site=* | --sit=*) site=$ac_optarg ;; -srcdir | --srcdir | --srcdi | --srcd | --src | --sr) ac_prev=srcdir ;; -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*) srcdir=$ac_optarg ;; -sysconfdir | --sysconfdir | --sysconfdi | --sysconfd | --sysconf \ | --syscon | --sysco | --sysc | --sys | --sy) ac_prev=sysconfdir ;; -sysconfdir=* | --sysconfdir=* | --sysconfdi=* | --sysconfd=* | --sysconf=* \ | --syscon=* | --sysco=* | --sysc=* | --sys=* | --sy=*) sysconfdir=$ac_optarg ;; -target | --target | --targe | --targ | --tar | --ta | --t) ac_prev=target_alias ;; -target=* | --target=* | --targe=* | --targ=* | --tar=* | --ta=* | --t=*) target_alias=$ac_optarg ;; -v | -verbose | --verbose | --verbos | --verbo | --verb) verbose=yes ;; -version | --version | --versio | --versi | --vers | -V) ac_init_version=: ;; -with-* | --with-*) ac_useropt=`expr "x$ac_option" : 'x-*with-\([^=]*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid package name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "with_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--with-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval with_$ac_useropt=\$ac_optarg ;; -without-* | --without-*) ac_useropt=`expr "x$ac_option" : 'x-*without-\(.*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid package name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "with_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--without-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval with_$ac_useropt=no ;; --x) # Obsolete; use --with-x. with_x=yes ;; -x-includes | --x-includes | --x-include | --x-includ | --x-inclu \ | --x-incl | --x-inc | --x-in | --x-i) ac_prev=x_includes ;; -x-includes=* | --x-includes=* | --x-include=* | --x-includ=* | --x-inclu=* \ | --x-incl=* | --x-inc=* | --x-in=* | --x-i=*) x_includes=$ac_optarg ;; -x-libraries | --x-libraries | --x-librarie | --x-librari \ | --x-librar | --x-libra | --x-libr | --x-lib | --x-li | --x-l) ac_prev=x_libraries ;; -x-libraries=* | --x-libraries=* | --x-librarie=* | --x-librari=* \ | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*) x_libraries=$ac_optarg ;; -*) as_fn_error $? "unrecognized option: \`$ac_option' Try \`$0 --help' for more information" ;; *=*) ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='` # Reject names that are not valid shell variable names. case $ac_envvar in #( '' | [0-9]* | *[!_$as_cr_alnum]* ) as_fn_error $? "invalid variable name: \`$ac_envvar'" ;; esac eval $ac_envvar=\$ac_optarg export $ac_envvar ;; *) # FIXME: should be removed in autoconf 3.0. $as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2 expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null && $as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2 : "${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option}" ;; esac done if test -n "$ac_prev"; then ac_option=--`echo $ac_prev | sed 's/_/-/g'` as_fn_error $? "missing argument to $ac_option" fi if test -n "$ac_unrecognized_opts"; then case $enable_option_checking in no) ;; fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;; *) $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;; esac fi # Check all directory arguments for consistency. for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ datadir sysconfdir sharedstatedir localstatedir includedir \ oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ libdir localedir mandir do eval ac_val=\$$ac_var # Remove trailing slashes. case $ac_val in */ ) ac_val=`expr "X$ac_val" : 'X\(.*[^/]\)' \| "X$ac_val" : 'X\(.*\)'` eval $ac_var=\$ac_val;; esac # Be sure to have absolute directory names. case $ac_val in [\\/$]* | ?:[\\/]* ) continue;; NONE | '' ) case $ac_var in *prefix ) continue;; esac;; esac as_fn_error $? "expected an absolute directory name for --$ac_var: $ac_val" done # There might be people who depend on the old broken behavior: `$host' # used to hold the argument of --host etc. # FIXME: To remove some day. build=$build_alias host=$host_alias target=$target_alias # FIXME: To remove some day. if test "x$host_alias" != x; then if test "x$build_alias" = x; then cross_compiling=maybe $as_echo "$as_me: WARNING: if you wanted to set the --build type, don't use --host. If a cross compiler is detected then cross compile mode will be used" >&2 elif test "x$build_alias" != "x$host_alias"; then cross_compiling=yes fi fi ac_tool_prefix= test -n "$host_alias" && ac_tool_prefix=$host_alias- test "$silent" = yes && exec 6>/dev/null ac_pwd=`pwd` && test -n "$ac_pwd" && ac_ls_di=`ls -di .` && ac_pwd_ls_di=`cd "$ac_pwd" && ls -di .` || as_fn_error $? "working directory cannot be determined" test "X$ac_ls_di" = "X$ac_pwd_ls_di" || as_fn_error $? "pwd does not report name of working directory" # Find the source files, if location was not specified. if test -z "$srcdir"; then ac_srcdir_defaulted=yes # Try the directory containing this script, then the parent directory. ac_confdir=`$as_dirname -- "$as_myself" || $as_expr X"$as_myself" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_myself" : 'X\(//\)[^/]' \| \ X"$as_myself" : 'X\(//\)$' \| \ X"$as_myself" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_myself" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` srcdir=$ac_confdir if test ! -r "$srcdir/$ac_unique_file"; then srcdir=.. fi else ac_srcdir_defaulted=no fi if test ! -r "$srcdir/$ac_unique_file"; then test "$ac_srcdir_defaulted" = yes && srcdir="$ac_confdir or .." as_fn_error $? "cannot find sources ($ac_unique_file) in $srcdir" fi ac_msg="sources are in $srcdir, but \`cd $srcdir' does not work" ac_abs_confdir=`( cd "$srcdir" && test -r "./$ac_unique_file" || as_fn_error $? "$ac_msg" pwd)` # When building in place, set srcdir=. if test "$ac_abs_confdir" = "$ac_pwd"; then srcdir=. fi # Remove unnecessary trailing slashes from srcdir. # Double slashes in file names in object file debugging info # mess up M-x gdb in Emacs. case $srcdir in */) srcdir=`expr "X$srcdir" : 'X\(.*[^/]\)' \| "X$srcdir" : 'X\(.*\)'`;; esac for ac_var in $ac_precious_vars; do eval ac_env_${ac_var}_set=\${${ac_var}+set} eval ac_env_${ac_var}_value=\$${ac_var} eval ac_cv_env_${ac_var}_set=\${${ac_var}+set} eval ac_cv_env_${ac_var}_value=\$${ac_var} done # # Report the --help message. # if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF \`configure' configures NSD 3.2.16 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... To assign environment variables (e.g., CC, CFLAGS...), specify them as VAR=VALUE. See below for descriptions of some of the useful variables. Defaults for the options are specified in brackets. Configuration: -h, --help display this help and exit --help=short display options specific to this package --help=recursive display the short help of all the included packages -V, --version display version information and exit -q, --quiet, --silent do not print \`checking ...' messages --cache-file=FILE cache test results in FILE [disabled] -C, --config-cache alias for \`--cache-file=config.cache' -n, --no-create do not create output files --srcdir=DIR find the sources in DIR [configure dir or \`..'] Installation directories: --prefix=PREFIX install architecture-independent files in PREFIX [$ac_default_prefix] --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX [PREFIX] By default, \`make install' will install all the files in \`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify an installation prefix other than \`$ac_default_prefix' using \`--prefix', for instance \`--prefix=\$HOME'. For better control, use the options below. Fine tuning of the installation directories: --bindir=DIR user executables [EPREFIX/bin] --sbindir=DIR system admin executables [EPREFIX/sbin] --libexecdir=DIR program executables [EPREFIX/libexec] --sysconfdir=DIR read-only single-machine data [PREFIX/etc] --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] --localstatedir=DIR modifiable single-machine data [PREFIX/var] --libdir=DIR object code libraries [EPREFIX/lib] --includedir=DIR C header files [PREFIX/include] --oldincludedir=DIR C header files for non-gcc [/usr/include] --datarootdir=DIR read-only arch.-independent data root [PREFIX/share] --datadir=DIR read-only architecture-independent data [DATAROOTDIR] --infodir=DIR info documentation [DATAROOTDIR/info] --localedir=DIR locale-dependent data [DATAROOTDIR/locale] --mandir=DIR man documentation [DATAROOTDIR/man] --docdir=DIR documentation root [DATAROOTDIR/doc/nsd] --htmldir=DIR html documentation [DOCDIR] --dvidir=DIR dvi documentation [DOCDIR] --pdfdir=DIR pdf documentation [DOCDIR] --psdir=DIR ps documentation [DOCDIR] _ACEOF cat <<\_ACEOF _ACEOF fi if test -n "$ac_init_help"; then case $ac_init_help in short | recursive ) echo "Configuration of NSD 3.2.16:";; esac cat <<\_ACEOF Optional Features: --disable-option-checking ignore unrecognized --enable/--with options --disable-FEATURE do not include FEATURE (same as --enable-FEATURE=no) --enable-FEATURE[=ARG] include FEATURE [ARG=yes] --disable-largefile omit support for large files --enable-root-server Configure NSD as a root server --disable-ipv6 Disables IPv6 support --enable-bind8-stats Enables BIND8 like NSTATS & XSTATS --enable-checking Enable internal runtime checks --enable-ratelimit Enable rate limiting --disable-nsec3 Disable NSEC3 support --disable-full-prehash Disables NSEC3 full prehashing --disable-minimal-responses Disable response minimization. More truncation. --enable-draft-rrtypes Enable draft RRtypes. --enable-mmap Use mmap instead of malloc. Experimental. --enable-zone-stats Maintain statistics per zone, instead of global statistics. Optional Packages: --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) --with-configdir=dir NSD configuration directory --with-nsd_conf_file=path Pathname to the NSD configuration file --with-start_priority=number NSD startup priority --with-kill_priority=number NSD shutdown priority --with-pidfile=path Pathname to the NSD pidfile --with-dbfile=path Pathname to the NSD database --with-zonesdir=dir NSD default location for zone files --with-difffile=path Pathname to the NSD diff transfer journal file --with-xfrdfile=path Pathname to the NSD xfrd zone timer state file --with-chroot=dir NSD default chroot directory --with-user=username User name or ID to answer the queries with --with-facility=name Syslog default facility (LOG_DAEMON) --with-max-ips=number Limit on the number of ip-addresses that may be specified --with-tcp-timeout=number Limit the default tcp timeout --with-ssl=pathname enable SSL (will check /usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/sfw /usr/local /usr) Some influential environment variables: CC C compiler command CFLAGS C compiler flags LDFLAGS linker flags, e.g. -L if you have libraries in a nonstandard directory LIBS libraries to pass to the linker, e.g. -l CPPFLAGS (Objective) C/C++ preprocessor flags, e.g. -I if you have headers in a nonstandard directory CPP C preprocessor YACC The `Yet Another Compiler Compiler' implementation to use. Defaults to the first program found out of: `bison -y', `byacc', `yacc'. YFLAGS The list of arguments that will be passed by default to $YACC. This script will default YFLAGS to the empty string to avoid a default value of `-d' given by some make applications. Use these variables to override the choices made by `configure' or to help it to find libraries and programs with nonstandard names/locations. Report bugs to . _ACEOF ac_status=$? fi if test "$ac_init_help" = "recursive"; then # If there are subdirs, report their specific --help. for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue test -d "$ac_dir" || { cd "$srcdir" && ac_pwd=`pwd` && srcdir=. && test -d "$ac_dir"; } || continue ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix cd "$ac_dir" || { ac_status=$?; continue; } # Check for guested configure. if test -f "$ac_srcdir/configure.gnu"; then echo && $SHELL "$ac_srcdir/configure.gnu" --help=recursive elif test -f "$ac_srcdir/configure"; then echo && $SHELL "$ac_srcdir/configure" --help=recursive else $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2 fi || ac_status=$? cd "$ac_pwd" || { ac_status=$?; break; } done fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF NSD configure 3.2.16 generated by GNU Autoconf 2.68 Copyright (C) 2010 Free Software Foundation, Inc. This configure script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it. _ACEOF exit fi ## ------------------------ ## ## Autoconf initialization. ## ## ------------------------ ## # ac_fn_c_try_compile LINENO # -------------------------- # Try to compile conftest.$ac_ext, and return whether this succeeded. ac_fn_c_try_compile () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack rm -f conftest.$ac_objext if { { ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compile") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest.$ac_objext; then : ac_retval=0 else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_compile # ac_fn_c_try_cpp LINENO # ---------------------- # Try to preprocess conftest.$ac_ext, and return whether this succeeded. ac_fn_c_try_cpp () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack if { { ac_try="$ac_cpp conftest.$ac_ext" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_cpp conftest.$ac_ext") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } > conftest.i && { test -z "$ac_c_preproc_warn_flag$ac_c_werror_flag" || test ! -s conftest.err }; then : ac_retval=0 else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_cpp # ac_fn_c_check_header_mongrel LINENO HEADER VAR INCLUDES # ------------------------------------------------------- # Tests whether HEADER exists, giving a warning if it cannot be compiled using # the include files in INCLUDES and setting the cache variable VAR # accordingly. ac_fn_c_check_header_mongrel () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack if eval \${$3+:} false; then : { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } else # Is the header compilable? { $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 usability" >&5 $as_echo_n "checking $2 usability... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 #include <$2> _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_header_compiler=yes else ac_header_compiler=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_compiler" >&5 $as_echo "$ac_header_compiler" >&6; } # Is the header present? { $as_echo "$as_me:${as_lineno-$LINENO}: checking $2 presence" >&5 $as_echo_n "checking $2 presence... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include <$2> _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : ac_header_preproc=yes else ac_header_preproc=no fi rm -f conftest.err conftest.i conftest.$ac_ext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_header_preproc" >&5 $as_echo "$ac_header_preproc" >&6; } # So? What about this header? case $ac_header_compiler:$ac_header_preproc:$ac_c_preproc_warn_flag in #(( yes:no: ) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&5 $as_echo "$as_me: WARNING: $2: accepted by the compiler, rejected by the preprocessor!" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5 $as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;} ;; no:yes:* ) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: present but cannot be compiled" >&5 $as_echo "$as_me: WARNING: $2: present but cannot be compiled" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: check for missing prerequisite headers?" >&5 $as_echo "$as_me: WARNING: $2: check for missing prerequisite headers?" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: see the Autoconf documentation" >&5 $as_echo "$as_me: WARNING: $2: see the Autoconf documentation" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&5 $as_echo "$as_me: WARNING: $2: section \"Present But Cannot Be Compiled\"" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $2: proceeding with the compiler's result" >&5 $as_echo "$as_me: WARNING: $2: proceeding with the compiler's result" >&2;} ( $as_echo "## ------------------------------------ ## ## Report this to nsd-bugs@nlnetlabs.nl ## ## ------------------------------------ ##" ) | sed "s/^/$as_me: WARNING: /" >&2 ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 else eval "$3=\$ac_header_compiler" fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } fi eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_header_mongrel # ac_fn_c_try_run LINENO # ---------------------- # Try to link conftest.$ac_ext, and return whether this succeeded. Assumes # that executables *can* be run. ac_fn_c_try_run () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { ac_try='./conftest$ac_exeext' { { case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_try") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; }; then : ac_retval=0 else $as_echo "$as_me: program exited with status $ac_status" >&5 $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=$ac_status fi rm -rf conftest.dSYM conftest_ipa8_conftest.oo eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_run # ac_fn_c_check_header_compile LINENO HEADER VAR INCLUDES # ------------------------------------------------------- # Tests whether HEADER exists and can be compiled using the include files in # INCLUDES, setting the cache variable VAR accordingly. ac_fn_c_check_header_compile () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 #include <$2> _ACEOF if ac_fn_c_try_compile "$LINENO"; then : eval "$3=yes" else eval "$3=no" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_header_compile # ac_fn_c_try_link LINENO # ----------------------- # Try to link conftest.$ac_ext, and return whether this succeeded. ac_fn_c_try_link () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack rm -f conftest.$ac_objext conftest$ac_exeext if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>conftest.err ac_status=$? if test -s conftest.err; then grep -v '^ *+' conftest.err >conftest.er1 cat conftest.er1 >&5 mv -f conftest.er1 conftest.err fi $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } && { test -z "$ac_c_werror_flag" || test ! -s conftest.err } && test -s conftest$ac_exeext && { test "$cross_compiling" = yes || $as_test_x conftest$ac_exeext }; then : ac_retval=0 else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 ac_retval=1 fi # Delete the IPA/IPO (Inter Procedural Analysis/Optimization) information # created by the PGI compiler (conftest_ipa8_conftest.oo), as it would # interfere with the next link command; also delete a directory that is # left behind by Apple's compiler. We do this before executing the actions. rm -rf conftest.dSYM conftest_ipa8_conftest.oo eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno as_fn_set_status $ac_retval } # ac_fn_c_try_link # ac_fn_c_check_type LINENO TYPE VAR INCLUDES # ------------------------------------------- # Tests whether TYPE exists after having included INCLUDES, setting cache # variable VAR accordingly. ac_fn_c_check_type () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 else eval "$3=no" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 int main () { if (sizeof ($2)) return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $4 int main () { if (sizeof (($2))) return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : else eval "$3=yes" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_type # ac_fn_c_check_member LINENO AGGR MEMBER VAR INCLUDES # ---------------------------------------------------- # Tries to find if the field MEMBER exists in type AGGR, after including # INCLUDES, setting cache variable VAR accordingly. ac_fn_c_check_member () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2.$3" >&5 $as_echo_n "checking for $2.$3... " >&6; } if eval \${$4+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $5 int main () { static $2 ac_aggr; if (ac_aggr.$3) return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : eval "$4=yes" else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $5 int main () { static $2 ac_aggr; if (sizeof ac_aggr.$3) return 0; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : eval "$4=yes" else eval "$4=no" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi eval ac_res=\$$4 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_member # ac_fn_c_check_func LINENO FUNC VAR # ---------------------------------- # Tests whether FUNC exists, setting the cache variable VAR accordingly ac_fn_c_check_func () { as_lineno=${as_lineno-"$1"} as_lineno_stack=as_lineno_stack=$as_lineno_stack { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $2" >&5 $as_echo_n "checking for $2... " >&6; } if eval \${$3+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Define $2 to an innocuous variant, in case declares $2. For example, HP-UX 11i declares gettimeofday. */ #define $2 innocuous_$2 /* System header to define __stub macros and hopefully few prototypes, which can conflict with char $2 (); below. Prefer to if __STDC__ is defined, since exists even on freestanding compilers. */ #ifdef __STDC__ # include #else # include #endif #undef $2 /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char $2 (); /* The GNU C library defines this for functions which it implements to always fail with ENOSYS. Some functions are actually named something starting with __ and the normal name is an alias. */ #if defined __stub_$2 || defined __stub___$2 choke me #endif int main () { return $2 (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : eval "$3=yes" else eval "$3=no" fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext fi eval ac_res=\$$3 { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_res" >&5 $as_echo "$ac_res" >&6; } eval $as_lineno_stack; ${as_lineno_stack:+:} unset as_lineno } # ac_fn_c_check_func cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. It was created by NSD $as_me 3.2.16, which was generated by GNU Autoconf 2.68. Invocation command line was $ $0 $@ _ACEOF exec 5>>config.log { cat <<_ASUNAME ## --------- ## ## Platform. ## ## --------- ## hostname = `(hostname || uname -n) 2>/dev/null | sed 1q` uname -m = `(uname -m) 2>/dev/null || echo unknown` uname -r = `(uname -r) 2>/dev/null || echo unknown` uname -s = `(uname -s) 2>/dev/null || echo unknown` uname -v = `(uname -v) 2>/dev/null || echo unknown` /usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null || echo unknown` /bin/uname -X = `(/bin/uname -X) 2>/dev/null || echo unknown` /bin/arch = `(/bin/arch) 2>/dev/null || echo unknown` /usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null || echo unknown` /usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null || echo unknown` /usr/bin/hostinfo = `(/usr/bin/hostinfo) 2>/dev/null || echo unknown` /bin/machine = `(/bin/machine) 2>/dev/null || echo unknown` /usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null || echo unknown` /bin/universe = `(/bin/universe) 2>/dev/null || echo unknown` _ASUNAME as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. $as_echo "PATH: $as_dir" done IFS=$as_save_IFS } >&5 cat >&5 <<_ACEOF ## ----------- ## ## Core tests. ## ## ----------- ## _ACEOF # Keep a trace of the command line. # Strip out --no-create and --no-recursion so they do not pile up. # Strip out --silent because we don't want to record it for future runs. # Also quote any args containing shell meta-characters. # Make two passes to allow for proper duplicate-argument suppression. ac_configure_args= ac_configure_args0= ac_configure_args1= ac_must_keep_next=false for ac_pass in 1 2 do for ac_arg do case $ac_arg in -no-create | --no-c* | -n | -no-recursion | --no-r*) continue ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) continue ;; *\'*) ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; esac case $ac_pass in 1) as_fn_append ac_configure_args0 " '$ac_arg'" ;; 2) as_fn_append ac_configure_args1 " '$ac_arg'" if test $ac_must_keep_next = true; then ac_must_keep_next=false # Got value, back to normal. else case $ac_arg in *=* | --config-cache | -C | -disable-* | --disable-* \ | -enable-* | --enable-* | -gas | --g* | -nfp | --nf* \ | -q | -quiet | --q* | -silent | --sil* | -v | -verb* \ | -with-* | --with-* | -without-* | --without-* | --x) case "$ac_configure_args0 " in "$ac_configure_args1"*" '$ac_arg' "* ) continue ;; esac ;; -* ) ac_must_keep_next=true ;; esac fi as_fn_append ac_configure_args " '$ac_arg'" ;; esac done done { ac_configure_args0=; unset ac_configure_args0;} { ac_configure_args1=; unset ac_configure_args1;} # When interrupted or exit'd, cleanup temporary files, and complete # config.log. We remove comments because anyway the quotes in there # would cause problems or look ugly. # WARNING: Use '\'' to represent an apostrophe within the trap. # WARNING: Do not start the trap code with a newline, due to a FreeBSD 4.0 bug. trap 'exit_status=$? # Save into config.log some information that might help in debugging. { echo $as_echo "## ---------------- ## ## Cache variables. ## ## ---------------- ##" echo # The following way of writing the cache mishandles newlines in values, ( for ac_var in `(set) 2>&1 | sed -n '\''s/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'\''`; do eval ac_val=\$$ac_var case $ac_val in #( *${as_nl}*) case $ac_var in #( *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; esac case $ac_var in #( _ | IFS | as_nl) ;; #( BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( *) { eval $ac_var=; unset $ac_var;} ;; esac ;; esac done (set) 2>&1 | case $as_nl`(ac_space='\'' '\''; set) 2>&1` in #( *${as_nl}ac_space=\ *) sed -n \ "s/'\''/'\''\\\\'\'''\''/g; s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\''\\2'\''/p" ;; #( *) sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p" ;; esac | sort ) echo $as_echo "## ----------------- ## ## Output variables. ## ## ----------------- ##" echo for ac_var in $ac_subst_vars do eval ac_val=\$$ac_var case $ac_val in *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; esac $as_echo "$ac_var='\''$ac_val'\''" done | sort echo if test -n "$ac_subst_files"; then $as_echo "## ------------------- ## ## File substitutions. ## ## ------------------- ##" echo for ac_var in $ac_subst_files do eval ac_val=\$$ac_var case $ac_val in *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; esac $as_echo "$ac_var='\''$ac_val'\''" done | sort echo fi if test -s confdefs.h; then $as_echo "## ----------- ## ## confdefs.h. ## ## ----------- ##" echo cat confdefs.h echo fi test "$ac_signal" != 0 && $as_echo "$as_me: caught signal $ac_signal" $as_echo "$as_me: exit $exit_status" } >&5 rm -f core *.core core.conftest.* && rm -f -r conftest* confdefs* conf$$* $ac_clean_files && exit $exit_status ' 0 for ac_signal in 1 2 13 15; do trap 'ac_signal='$ac_signal'; as_fn_exit 1' $ac_signal done ac_signal=0 # confdefs.h avoids OS command line length limits that DEFS can exceed. rm -f -r conftest* confdefs.h $as_echo "/* confdefs.h */" > confdefs.h # Predefined preprocessor variables. cat >>confdefs.h <<_ACEOF #define PACKAGE_NAME "$PACKAGE_NAME" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_TARNAME "$PACKAGE_TARNAME" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_VERSION "$PACKAGE_VERSION" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_STRING "$PACKAGE_STRING" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_URL "$PACKAGE_URL" _ACEOF # Let the site file select an alternate cache file if it wants to. # Prefer an explicitly selected file to automatically selected ones. ac_site_file1=NONE ac_site_file2=NONE if test -n "$CONFIG_SITE"; then # We do not want a PATH search for config.site. case $CONFIG_SITE in #(( -*) ac_site_file1=./$CONFIG_SITE;; */*) ac_site_file1=$CONFIG_SITE;; *) ac_site_file1=./$CONFIG_SITE;; esac elif test "x$prefix" != xNONE; then ac_site_file1=$prefix/share/config.site ac_site_file2=$prefix/etc/config.site else ac_site_file1=$ac_default_prefix/share/config.site ac_site_file2=$ac_default_prefix/etc/config.site fi for ac_site_file in "$ac_site_file1" "$ac_site_file2" do test "x$ac_site_file" = xNONE && continue if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then { $as_echo "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5 $as_echo "$as_me: loading site script $ac_site_file" >&6;} sed 's/^/| /' "$ac_site_file" >&5 . "$ac_site_file" \ || { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "failed to load site script $ac_site_file See \`config.log' for more details" "$LINENO" 5; } fi done if test -r "$cache_file"; then # Some versions of bash will fail to source /dev/null (special files # actually), so we avoid doing that. DJGPP emulates it as a regular file. if test /dev/null != "$cache_file" && test -f "$cache_file"; then { $as_echo "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5 $as_echo "$as_me: loading cache $cache_file" >&6;} case $cache_file in [\\/]* | ?:[\\/]* ) . "$cache_file";; *) . "./$cache_file";; esac fi else { $as_echo "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5 $as_echo "$as_me: creating cache $cache_file" >&6;} >$cache_file fi # Check that the precious variables saved in the cache have kept the same # value. ac_cache_corrupted=false for ac_var in $ac_precious_vars; do eval ac_old_set=\$ac_cv_env_${ac_var}_set eval ac_new_set=\$ac_env_${ac_var}_set eval ac_old_val=\$ac_cv_env_${ac_var}_value eval ac_new_val=\$ac_env_${ac_var}_value case $ac_old_set,$ac_new_set in set,) { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5 $as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;} ac_cache_corrupted=: ;; ,set) { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5 $as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} ac_cache_corrupted=: ;; ,);; *) if test "x$ac_old_val" != "x$ac_new_val"; then # differences in whitespace do not lead to failure. ac_old_val_w=`echo x $ac_old_val` ac_new_val_w=`echo x $ac_new_val` if test "$ac_old_val_w" != "$ac_new_val_w"; then { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5 $as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} ac_cache_corrupted=: else { $as_echo "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5 $as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;} eval $ac_var=\$ac_old_val fi { $as_echo "$as_me:${as_lineno-$LINENO}: former value: \`$ac_old_val'" >&5 $as_echo "$as_me: former value: \`$ac_old_val'" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: current value: \`$ac_new_val'" >&5 $as_echo "$as_me: current value: \`$ac_new_val'" >&2;} fi;; esac # Pass precious variables to config.status. if test "$ac_new_set" = set; then case $ac_new_val in *\'*) ac_arg=$ac_var=`$as_echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;; *) ac_arg=$ac_var=$ac_new_val ;; esac case " $ac_configure_args " in *" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy. *) as_fn_append ac_configure_args " '$ac_arg'" ;; esac fi done if $ac_cache_corrupted; then { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5 $as_echo "$as_me: error: changes in the environment can compromise the build" >&2;} as_fn_error $? "run \`make distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5 fi ## -------------------- ## ## Main body of script. ## ## -------------------- ## ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu ac_config_headers="$ac_config_headers config.h" ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args. set dummy ${ac_tool_prefix}gcc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_CC="${ac_tool_prefix}gcc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_CC"; then ac_ct_CC=$CC # Extract the first word of "gcc", so it can be a program name with args. set dummy gcc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_ac_ct_CC="gcc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 $as_echo "$ac_ct_CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi else CC="$ac_cv_prog_CC" fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args. set dummy ${ac_tool_prefix}cc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_CC="${ac_tool_prefix}cc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi fi if test -z "$CC"; then # Extract the first word of "cc", so it can be a program name with args. set dummy cc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else ac_prog_rejected=no as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then ac_prog_rejected=yes continue fi ac_cv_prog_CC="cc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS if test $ac_prog_rejected = yes; then # We found a bogon in the path, so make sure we never use it. set dummy $ac_cv_prog_CC shift if test $# != 0; then # We chose a different compiler from the bogus one. # However, it has the same basename, so the bogon will be chosen # first if we set CC to just the basename; use the full file name. shift ac_cv_prog_CC="$as_dir/$ac_word${1+' '}$@" fi fi fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then for ac_prog in cl.exe do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_CC="$ac_tool_prefix$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$CC" && break done fi if test -z "$CC"; then ac_ct_CC=$CC for ac_prog in cl.exe do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_ac_ct_CC="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 $as_echo "$ac_ct_CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ac_ct_CC" && break done if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi fi fi test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "no acceptable C compiler found in \$PATH See \`config.log' for more details" "$LINENO" 5; } # Provide some information about the compiler. $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5 set X $ac_compile ac_compiler=$2 for ac_option in --version -v -V -qversion; do { { ac_try="$ac_compiler $ac_option >&5" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compiler $ac_option >&5") 2>conftest.err ac_status=$? if test -s conftest.err; then sed '10a\ ... rest of stderr output deleted ... 10q' conftest.err >conftest.er1 cat conftest.er1 >&5 fi rm -f conftest.er1 conftest.err $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } done cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF ac_clean_files_save=$ac_clean_files ac_clean_files="$ac_clean_files a.out a.out.dSYM a.exe b.out" # Try to create an executable without -o first, disregard a.out. # It will help us diagnose broken compilers, and finding out an intuition # of exeext. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler works" >&5 $as_echo_n "checking whether the C compiler works... " >&6; } ac_link_default=`$as_echo "$ac_link" | sed 's/ -o *conftest[^ ]*//'` # The possible output files: ac_files="a.out conftest.exe conftest a.exe a_out.exe b.out conftest.*" ac_rmfiles= for ac_file in $ac_files do case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; * ) ac_rmfiles="$ac_rmfiles $ac_file";; esac done rm -f $ac_rmfiles if { { ac_try="$ac_link_default" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link_default") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then : # Autoconf-2.13 could set the ac_cv_exeext variable to `no'. # So ignore a value of `no', otherwise this would lead to `EXEEXT = no' # in a Makefile. We should not override ac_cv_exeext if it was cached, # so that the user can short-circuit this test for compilers unknown to # Autoconf. for ac_file in $ac_files '' do test -f "$ac_file" || continue case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; [ab].out ) # We found the default executable, but exeext='' is most # certainly right. break;; *.* ) if test "${ac_cv_exeext+set}" = set && test "$ac_cv_exeext" != no; then :; else ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` fi # We set ac_cv_exeext here because the later test for it is not # safe: cross compilers may not add the suffix if given an `-o' # argument, so we may need to know it at that point already. # Even if this section looks crufty: it has the advantage of # actually working. break;; * ) break;; esac done test "$ac_cv_exeext" = no && ac_cv_exeext= else ac_file='' fi if test -z "$ac_file"; then : { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error 77 "C compiler cannot create executables See \`config.log' for more details" "$LINENO" 5; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler default output file name" >&5 $as_echo_n "checking for C compiler default output file name... " >&6; } { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_file" >&5 $as_echo "$ac_file" >&6; } ac_exeext=$ac_cv_exeext rm -f -r a.out a.out.dSYM a.exe conftest$ac_cv_exeext b.out ac_clean_files=$ac_clean_files_save { $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of executables" >&5 $as_echo_n "checking for suffix of executables... " >&6; } if { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then : # If both `conftest.exe' and `conftest' are `present' (well, observable) # catch `conftest.exe'. For instance with Cygwin, `ls conftest' will # work properly (i.e., refer to `conftest.exe'), while it won't with # `rm'. for ac_file in conftest.exe conftest conftest.*; do test -f "$ac_file" || continue case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM | *.o | *.obj ) ;; *.* ) ac_cv_exeext=`expr "$ac_file" : '[^.]*\(\..*\)'` break;; * ) break;; esac done else { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot compute suffix of executables: cannot compile and link See \`config.log' for more details" "$LINENO" 5; } fi rm -f conftest conftest$ac_cv_exeext { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_exeext" >&5 $as_echo "$ac_cv_exeext" >&6; } rm -f conftest.$ac_ext EXEEXT=$ac_cv_exeext ac_exeext=$EXEEXT cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include int main () { FILE *f = fopen ("conftest.out", "w"); return ferror (f) || fclose (f) != 0; ; return 0; } _ACEOF ac_clean_files="$ac_clean_files conftest.out" # Check that the compiler produces executables we can run. If not, either # the compiler is broken, or we cross compile. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are cross compiling" >&5 $as_echo_n "checking whether we are cross compiling... " >&6; } if test "$cross_compiling" != yes; then { { ac_try="$ac_link" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_link") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } if { ac_try='./conftest$ac_cv_exeext' { { case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_try") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; }; then cross_compiling=no else if test "$cross_compiling" = maybe; then cross_compiling=yes else { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot run C compiled programs. If you meant to cross compile, use \`--host'. See \`config.log' for more details" "$LINENO" 5; } fi fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $cross_compiling" >&5 $as_echo "$cross_compiling" >&6; } rm -f conftest.$ac_ext conftest$ac_cv_exeext conftest.out ac_clean_files=$ac_clean_files_save { $as_echo "$as_me:${as_lineno-$LINENO}: checking for suffix of object files" >&5 $as_echo_n "checking for suffix of object files... " >&6; } if ${ac_cv_objext+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF rm -f conftest.o conftest.obj if { { ac_try="$ac_compile" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compile") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; }; then : for ac_file in conftest.o conftest.obj conftest.*; do test -f "$ac_file" || continue; case $ac_file in *.$ac_ext | *.xcoff | *.tds | *.d | *.pdb | *.xSYM | *.bb | *.bbg | *.map | *.inf | *.dSYM ) ;; *) ac_cv_objext=`expr "$ac_file" : '.*\.\(.*\)'` break;; esac done else $as_echo "$as_me: failed program was:" >&5 sed 's/^/| /' conftest.$ac_ext >&5 { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot compute suffix of object files: cannot compile See \`config.log' for more details" "$LINENO" 5; } fi rm -f conftest.$ac_cv_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_objext" >&5 $as_echo "$ac_cv_objext" >&6; } OBJEXT=$ac_cv_objext ac_objext=$OBJEXT { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5 $as_echo_n "checking whether we are using the GNU C compiler... " >&6; } if ${ac_cv_c_compiler_gnu+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { #ifndef __GNUC__ choke me #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_compiler_gnu=yes else ac_compiler_gnu=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_cv_c_compiler_gnu=$ac_compiler_gnu fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5 $as_echo "$ac_cv_c_compiler_gnu" >&6; } if test $ac_compiler_gnu = yes; then GCC=yes else GCC= fi ac_test_CFLAGS=${CFLAGS+set} ac_save_CFLAGS=$CFLAGS { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5 $as_echo_n "checking whether $CC accepts -g... " >&6; } if ${ac_cv_prog_cc_g+:} false; then : $as_echo_n "(cached) " >&6 else ac_save_c_werror_flag=$ac_c_werror_flag ac_c_werror_flag=yes ac_cv_prog_cc_g=no CFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_g=yes else CFLAGS="" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : else ac_c_werror_flag=$ac_save_c_werror_flag CFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_g=yes fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_c_werror_flag=$ac_save_c_werror_flag fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5 $as_echo "$ac_cv_prog_cc_g" >&6; } if test "$ac_test_CFLAGS" = set; then CFLAGS=$ac_save_CFLAGS elif test $ac_cv_prog_cc_g = yes; then if test "$GCC" = yes; then CFLAGS="-g -O2" else CFLAGS="-g" fi else if test "$GCC" = yes; then CFLAGS="-O2" else CFLAGS= fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5 $as_echo_n "checking for $CC option to accept ISO C89... " >&6; } if ${ac_cv_prog_cc_c89+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_prog_cc_c89=no ac_save_CC=$CC cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include #include /* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */ struct buf { int x; }; FILE * (*rcsopen) (struct buf *, struct stat *, int); static char *e (p, i) char **p; int i; { return p[i]; } static char *f (char * (*g) (char **, int), char **p, ...) { char *s; va_list v; va_start (v,p); s = g (p, va_arg (v,int)); va_end (v); return s; } /* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has function prototypes and stuff, but not '\xHH' hex character constants. These don't provoke an error unfortunately, instead are silently treated as 'x'. The following induces an error, until -std is added to get proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an array size at least. It's necessary to write '\x00'==0 to get something that's true only with -std. */ int osf4_cc_array ['\x00' == 0 ? 1 : -1]; /* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters inside strings and character constants. */ #define FOO(x) 'x' int xlc6_cc_array[FOO(a) == 'x' ? 1 : -1]; int test (int i, double x); struct s1 {int (*f) (int a);}; struct s2 {int (*f) (double a);}; int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int); int argc; char **argv; int main () { return f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1]; ; return 0; } _ACEOF for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \ -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__" do CC="$ac_save_CC $ac_arg" if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_c89=$ac_arg fi rm -f core conftest.err conftest.$ac_objext test "x$ac_cv_prog_cc_c89" != "xno" && break done rm -f conftest.$ac_ext CC=$ac_save_CC fi # AC_CACHE_VAL case "x$ac_cv_prog_cc_c89" in x) { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 $as_echo "none needed" >&6; } ;; xno) { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 $as_echo "unsupported" >&6; } ;; *) CC="$CC $ac_cv_prog_cc_c89" { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5 $as_echo "$ac_cv_prog_cc_c89" >&6; } ;; esac if test "x$ac_cv_prog_cc_c89" != xno; then : fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking how to run the C preprocessor" >&5 $as_echo_n "checking how to run the C preprocessor... " >&6; } # On Suns, sometimes $CPP names a directory. if test -n "$CPP" && test -d "$CPP"; then CPP= fi if test -z "$CPP"; then if ${ac_cv_prog_CPP+:} false; then : $as_echo_n "(cached) " >&6 else # Double quotes because CPP needs to be expanded for CPP in "$CC -E" "$CC -E -traditional-cpp" "/lib/cpp" do ac_preproc_ok=false for ac_c_preproc_warn_flag in '' yes do # Use a header file that comes with gcc, so configuring glibc # with a fresh cross-compiler works. # Prefer to if __STDC__ is defined, since # exists even on freestanding compilers. # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. "Syntax error" is here to catch this case. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef __STDC__ # include #else # include #endif Syntax error _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : else # Broken: fails on valid input. continue fi rm -f conftest.err conftest.i conftest.$ac_ext # OK, works on sane cases. Now check whether nonexistent headers # can be detected and how. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : # Broken: success on invalid input. continue else # Passes both tests. ac_preproc_ok=: break fi rm -f conftest.err conftest.i conftest.$ac_ext done # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. rm -f conftest.i conftest.err conftest.$ac_ext if $ac_preproc_ok; then : break fi done ac_cv_prog_CPP=$CPP fi CPP=$ac_cv_prog_CPP else ac_cv_prog_CPP=$CPP fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CPP" >&5 $as_echo "$CPP" >&6; } ac_preproc_ok=false for ac_c_preproc_warn_flag in '' yes do # Use a header file that comes with gcc, so configuring glibc # with a fresh cross-compiler works. # Prefer to if __STDC__ is defined, since # exists even on freestanding compilers. # On the NeXT, cc -E runs the code through the compiler's parser, # not just through cpp. "Syntax error" is here to catch this case. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifdef __STDC__ # include #else # include #endif Syntax error _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : else # Broken: fails on valid input. continue fi rm -f conftest.err conftest.i conftest.$ac_ext # OK, works on sane cases. Now check whether nonexistent headers # can be detected and how. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if ac_fn_c_try_cpp "$LINENO"; then : # Broken: success on invalid input. continue else # Passes both tests. ac_preproc_ok=: break fi rm -f conftest.err conftest.i conftest.$ac_ext done # Because of `break', _AC_PREPROC_IFELSE's cleaning code was skipped. rm -f conftest.i conftest.err conftest.$ac_ext if $ac_preproc_ok; then : else { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "C preprocessor \"$CPP\" fails sanity check See \`config.log' for more details" "$LINENO" 5; } fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking for grep that handles long lines and -e" >&5 $as_echo_n "checking for grep that handles long lines and -e... " >&6; } if ${ac_cv_path_GREP+:} false; then : $as_echo_n "(cached) " >&6 else if test -z "$GREP"; then ac_path_GREP_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in grep ggrep; do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_GREP="$as_dir/$ac_prog$ac_exec_ext" { test -f "$ac_path_GREP" && $as_test_x "$ac_path_GREP"; } || continue # Check for GNU ac_path_GREP and select it if it is found. # Check for GNU $ac_path_GREP case `"$ac_path_GREP" --version 2>&1` in *GNU*) ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_found=:;; *) ac_count=0 $as_echo_n 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" $as_echo 'GREP' >> "conftest.nl" "$ac_path_GREP" -e 'GREP$' -e '-(cannot match)-' < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_GREP_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_GREP="$ac_path_GREP" ac_path_GREP_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_GREP_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_GREP"; then as_fn_error $? "no acceptable grep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 fi else ac_cv_path_GREP=$GREP fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_GREP" >&5 $as_echo "$ac_cv_path_GREP" >&6; } GREP="$ac_cv_path_GREP" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for egrep" >&5 $as_echo_n "checking for egrep... " >&6; } if ${ac_cv_path_EGREP+:} false; then : $as_echo_n "(cached) " >&6 else if echo a | $GREP -E '(a|b)' >/dev/null 2>&1 then ac_cv_path_EGREP="$GREP -E" else if test -z "$EGREP"; then ac_path_EGREP_found=false # Loop through the user's path and test for each of PROGNAME-LIST as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH$PATH_SEPARATOR/usr/xpg4/bin do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_prog in egrep; do for ac_exec_ext in '' $ac_executable_extensions; do ac_path_EGREP="$as_dir/$ac_prog$ac_exec_ext" { test -f "$ac_path_EGREP" && $as_test_x "$ac_path_EGREP"; } || continue # Check for GNU ac_path_EGREP and select it if it is found. # Check for GNU $ac_path_EGREP case `"$ac_path_EGREP" --version 2>&1` in *GNU*) ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_found=:;; *) ac_count=0 $as_echo_n 0123456789 >"conftest.in" while : do cat "conftest.in" "conftest.in" >"conftest.tmp" mv "conftest.tmp" "conftest.in" cp "conftest.in" "conftest.nl" $as_echo 'EGREP' >> "conftest.nl" "$ac_path_EGREP" 'EGREP$' < "conftest.nl" >"conftest.out" 2>/dev/null || break diff "conftest.out" "conftest.nl" >/dev/null 2>&1 || break as_fn_arith $ac_count + 1 && ac_count=$as_val if test $ac_count -gt ${ac_path_EGREP_max-0}; then # Best one so far, save it but keep looking for a better one ac_cv_path_EGREP="$ac_path_EGREP" ac_path_EGREP_max=$ac_count fi # 10*(2^10) chars as input seems more than enough test $ac_count -gt 10 && break done rm -f conftest.in conftest.tmp conftest.nl conftest.out;; esac $ac_path_EGREP_found && break 3 done done done IFS=$as_save_IFS if test -z "$ac_cv_path_EGREP"; then as_fn_error $? "no acceptable egrep could be found in $PATH$PATH_SEPARATOR/usr/xpg4/bin" "$LINENO" 5 fi else ac_cv_path_EGREP=$EGREP fi fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_path_EGREP" >&5 $as_echo "$ac_cv_path_EGREP" >&6; } EGREP="$ac_cv_path_EGREP" { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5 $as_echo_n "checking for ANSI C header files... " >&6; } if ${ac_cv_header_stdc+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include #include int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_header_stdc=yes else ac_cv_header_stdc=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext if test $ac_cv_header_stdc = yes; then # SunOS 4.x string.h does not declare mem*, contrary to ANSI. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "memchr" >/dev/null 2>&1; then : else ac_cv_header_stdc=no fi rm -f conftest* fi if test $ac_cv_header_stdc = yes; then # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "free" >/dev/null 2>&1; then : else ac_cv_header_stdc=no fi rm -f conftest* fi if test $ac_cv_header_stdc = yes; then # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi. if test "$cross_compiling" = yes; then : : else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #if ((' ' & 0x0FF) == 0x020) # define ISLOWER(c) ('a' <= (c) && (c) <= 'z') # define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) #else # define ISLOWER(c) \ (('a' <= (c) && (c) <= 'i') \ || ('j' <= (c) && (c) <= 'r') \ || ('s' <= (c) && (c) <= 'z')) # define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c)) #endif #define XOR(e, f) (((e) && !(f)) || (!(e) && (f))) int main () { int i; for (i = 0; i < 256; i++) if (XOR (islower (i), ISLOWER (i)) || toupper (i) != TOUPPER (i)) return 2; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : else ac_cv_header_stdc=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5 $as_echo "$ac_cv_header_stdc" >&6; } if test $ac_cv_header_stdc = yes; then $as_echo "#define STDC_HEADERS 1" >>confdefs.h fi # On IRIX 5.3, sys/types and inttypes.h are conflicting. for ac_header in sys/types.h sys/stat.h stdlib.h string.h memory.h strings.h \ inttypes.h stdint.h unistd.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_compile "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default " if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done ac_fn_c_check_header_mongrel "$LINENO" "minix/config.h" "ac_cv_header_minix_config_h" "$ac_includes_default" if test "x$ac_cv_header_minix_config_h" = xyes; then : MINIX=yes else MINIX= fi if test "$MINIX" = yes; then $as_echo "#define _POSIX_SOURCE 1" >>confdefs.h $as_echo "#define _POSIX_1_SOURCE 2" >>confdefs.h $as_echo "#define _MINIX 1" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether it is safe to define __EXTENSIONS__" >&5 $as_echo_n "checking whether it is safe to define __EXTENSIONS__... " >&6; } if ${ac_cv_safe_to_define___extensions__+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ # define __EXTENSIONS__ 1 $ac_includes_default int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_safe_to_define___extensions__=yes else ac_cv_safe_to_define___extensions__=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_safe_to_define___extensions__" >&5 $as_echo "$ac_cv_safe_to_define___extensions__" >&6; } test $ac_cv_safe_to_define___extensions__ = yes && $as_echo "#define __EXTENSIONS__ 1" >>confdefs.h $as_echo "#define _ALL_SOURCE 1" >>confdefs.h $as_echo "#define _GNU_SOURCE 1" >>confdefs.h $as_echo "#define _POSIX_PTHREAD_SEMANTICS 1" >>confdefs.h $as_echo "#define _TANDEM_SOURCE 1" >>confdefs.h case "$prefix" in NONE) case "$sysconfdir" in '${prefix}/etc') sysconfdir=/etc ;; esac case "$localstatedir" in '${prefix}/var') localstatedir=/var ;; esac ;; esac # # Determine configuration directory # configdir=$sysconfdir/nsd # Check whether --with-configdir was given. if test "${with_configdir+set}" = set; then : withval=$with_configdir; configdir=$withval fi # # Determine configuration file nsd_conf_file=${configdir}/nsd.conf # Check whether --with-nsd_conf_file was given. if test "${with_nsd_conf_file+set}" = set; then : withval=$with_nsd_conf_file; nsd_conf_file=$withval fi # the eval is to evaluate shell expansion twice, once # for $nsd_conf_file and once for the ${prefix} within it. cat >>confdefs.h <<_ACEOF #define CONFIGFILE "`eval echo $nsd_conf_file`" _ACEOF # # Determine start and kill priorities start_priority=45 # Check whether --with-start_priority was given. if test "${with_start_priority+set}" = set; then : withval=$with_start_priority; start_priority=$withval fi kill_priority=74 # Check whether --with-kill_priority was given. if test "${with_kill_priority+set}" = set; then : withval=$with_kill_priority; kill_priority=$withval fi # # Default logfile # logfile=${localstatedir}/log/nsd.log # # Database directory # dbdir=${localstatedir}/db/nsd # # Determine the pidfile location. Check if /var/run exists, if so set pidfile # to /var/run/nsd.pid by default # if test -d ${localstatedir}/run; then pidfile=${localstatedir}/run/nsd.pid else pidfile=${dbdir}/nsd.pid fi # Check whether --with-pidfile was given. if test "${with_pidfile+set}" = set; then : withval=$with_pidfile; pidfile=$withval fi cat >>confdefs.h <<_ACEOF #define PIDFILE "`eval echo $pidfile`" _ACEOF # # Determine location of nsd.db # dbfile=${dbdir}/nsd.db # Check whether --with-dbfile was given. if test "${with_dbfile+set}" = set; then : withval=$with_dbfile; dbfile=$withval fi cat >>confdefs.h <<_ACEOF #define DBFILE "`eval echo $dbfile`" _ACEOF dbdir=`dirname $dbfile` piddir=`dirname $pidfile` # # Determine the default directory for the zone files # zonesdir=$configdir # Check whether --with-zonesdir was given. if test "${with_zonesdir+set}" = set; then : withval=$with_zonesdir; zonesdir=$withval fi cat >>confdefs.h <<_ACEOF #define ZONESDIR "`eval echo $zonesdir`" _ACEOF # default diff file location. difffile=${dbdir}/ixfr.db # Check whether --with-difffile was given. if test "${with_difffile+set}" = set; then : withval=$with_difffile; difffile=$withval fi cat >>confdefs.h <<_ACEOF #define DIFFFILE "`eval echo $difffile`" _ACEOF # default xfrd file location. xfrdfile=${dbdir}/xfrd.state # Check whether --with-xfrdfile was given. if test "${with_xfrdfile+set}" = set; then : withval=$with_xfrdfile; xfrdfile=$withval fi cat >>confdefs.h <<_ACEOF #define XFRDFILE "`eval echo $xfrdfile`" _ACEOF # # Determine default chroot directory # # Check whether --with-chroot was given. if test "${with_chroot+set}" = set; then : withval=$with_chroot; chrootdir=$withval cat >>confdefs.h <<_ACEOF #define CHROOTDIR "`eval echo $chrootdir`" _ACEOF fi # # Determine the user name to drop privileges to # user=nsd # Check whether --with-user was given. if test "${with_user+set}" = set; then : withval=$with_user; user=$withval fi cat >>confdefs.h <<_ACEOF #define USER "$user" _ACEOF # Checks for programs. for ac_prog in gawk mawk nawk awk do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_AWK+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$AWK"; then ac_cv_prog_AWK="$AWK" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_AWK="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi AWK=$ac_cv_prog_AWK if test -n "$AWK"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $AWK" >&5 $as_echo "$AWK" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$AWK" && break done ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}gcc", so it can be a program name with args. set dummy ${ac_tool_prefix}gcc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_CC="${ac_tool_prefix}gcc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$ac_cv_prog_CC"; then ac_ct_CC=$CC # Extract the first word of "gcc", so it can be a program name with args. set dummy gcc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_ac_ct_CC="gcc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 $as_echo "$ac_ct_CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi else CC="$ac_cv_prog_CC" fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then # Extract the first word of "${ac_tool_prefix}cc", so it can be a program name with args. set dummy ${ac_tool_prefix}cc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_CC="${ac_tool_prefix}cc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi fi if test -z "$CC"; then # Extract the first word of "cc", so it can be a program name with args. set dummy cc; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else ac_prog_rejected=no as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then if test "$as_dir/$ac_word$ac_exec_ext" = "/usr/ucb/cc"; then ac_prog_rejected=yes continue fi ac_cv_prog_CC="cc" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS if test $ac_prog_rejected = yes; then # We found a bogon in the path, so make sure we never use it. set dummy $ac_cv_prog_CC shift if test $# != 0; then # We chose a different compiler from the bogus one. # However, it has the same basename, so the bogon will be chosen # first if we set CC to just the basename; use the full file name. shift ac_cv_prog_CC="$as_dir/$ac_word${1+' '}$@" fi fi fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi fi if test -z "$CC"; then if test -n "$ac_tool_prefix"; then for ac_prog in cl.exe do # Extract the first word of "$ac_tool_prefix$ac_prog", so it can be a program name with args. set dummy $ac_tool_prefix$ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$CC"; then ac_cv_prog_CC="$CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_CC="$ac_tool_prefix$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi CC=$ac_cv_prog_CC if test -n "$CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $CC" >&5 $as_echo "$CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$CC" && break done fi if test -z "$CC"; then ac_ct_CC=$CC for ac_prog in cl.exe do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_ac_ct_CC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$ac_ct_CC"; then ac_cv_prog_ac_ct_CC="$ac_ct_CC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_ac_ct_CC="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi ac_ct_CC=$ac_cv_prog_ac_ct_CC if test -n "$ac_ct_CC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_ct_CC" >&5 $as_echo "$ac_ct_CC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$ac_ct_CC" && break done if test "x$ac_ct_CC" = x; then CC="" else case $cross_compiling:$ac_tool_warned in yes:) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5 $as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;} ac_tool_warned=yes ;; esac CC=$ac_ct_CC fi fi fi test -z "$CC" && { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "no acceptable C compiler found in \$PATH See \`config.log' for more details" "$LINENO" 5; } # Provide some information about the compiler. $as_echo "$as_me:${as_lineno-$LINENO}: checking for C compiler version" >&5 set X $ac_compile ac_compiler=$2 for ac_option in --version -v -V -qversion; do { { ac_try="$ac_compiler $ac_option >&5" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$ac_compiler $ac_option >&5") 2>conftest.err ac_status=$? if test -s conftest.err; then sed '10a\ ... rest of stderr output deleted ... 10q' conftest.err >conftest.er1 cat conftest.er1 >&5 fi rm -f conftest.er1 conftest.err $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } done { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether we are using the GNU C compiler" >&5 $as_echo_n "checking whether we are using the GNU C compiler... " >&6; } if ${ac_cv_c_compiler_gnu+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { #ifndef __GNUC__ choke me #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_compiler_gnu=yes else ac_compiler_gnu=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_cv_c_compiler_gnu=$ac_compiler_gnu fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_compiler_gnu" >&5 $as_echo "$ac_cv_c_compiler_gnu" >&6; } if test $ac_compiler_gnu = yes; then GCC=yes else GCC= fi ac_test_CFLAGS=${CFLAGS+set} ac_save_CFLAGS=$CFLAGS { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC accepts -g" >&5 $as_echo_n "checking whether $CC accepts -g... " >&6; } if ${ac_cv_prog_cc_g+:} false; then : $as_echo_n "(cached) " >&6 else ac_save_c_werror_flag=$ac_c_werror_flag ac_c_werror_flag=yes ac_cv_prog_cc_g=no CFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_g=yes else CFLAGS="" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : else ac_c_werror_flag=$ac_save_c_werror_flag CFLAGS="-g" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_g=yes fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_c_werror_flag=$ac_save_c_werror_flag fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_g" >&5 $as_echo "$ac_cv_prog_cc_g" >&6; } if test "$ac_test_CFLAGS" = set; then CFLAGS=$ac_save_CFLAGS elif test $ac_cv_prog_cc_g = yes; then if test "$GCC" = yes; then CFLAGS="-g -O2" else CFLAGS="-g" fi else if test "$GCC" = yes; then CFLAGS="-O2" else CFLAGS= fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $CC option to accept ISO C89" >&5 $as_echo_n "checking for $CC option to accept ISO C89... " >&6; } if ${ac_cv_prog_cc_c89+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_prog_cc_c89=no ac_save_CC=$CC cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include #include /* Most of the following tests are stolen from RCS 5.7's src/conf.sh. */ struct buf { int x; }; FILE * (*rcsopen) (struct buf *, struct stat *, int); static char *e (p, i) char **p; int i; { return p[i]; } static char *f (char * (*g) (char **, int), char **p, ...) { char *s; va_list v; va_start (v,p); s = g (p, va_arg (v,int)); va_end (v); return s; } /* OSF 4.0 Compaq cc is some sort of almost-ANSI by default. It has function prototypes and stuff, but not '\xHH' hex character constants. These don't provoke an error unfortunately, instead are silently treated as 'x'. The following induces an error, until -std is added to get proper ANSI mode. Curiously '\x00'!='x' always comes out true, for an array size at least. It's necessary to write '\x00'==0 to get something that's true only with -std. */ int osf4_cc_array ['\x00' == 0 ? 1 : -1]; /* IBM C 6 for AIX is almost-ANSI by default, but it replaces macro parameters inside strings and character constants. */ #define FOO(x) 'x' int xlc6_cc_array[FOO(a) == 'x' ? 1 : -1]; int test (int i, double x); struct s1 {int (*f) (int a);}; struct s2 {int (*f) (double a);}; int pairnames (int, char **, FILE *(*)(struct buf *, struct stat *, int), int, int); int argc; char **argv; int main () { return f (e, argv, 0) != argv[0] || f (e, argv, 1) != argv[1]; ; return 0; } _ACEOF for ac_arg in '' -qlanglvl=extc89 -qlanglvl=ansi -std \ -Ae "-Aa -D_HPUX_SOURCE" "-Xc -D__EXTENSIONS__" do CC="$ac_save_CC $ac_arg" if ac_fn_c_try_compile "$LINENO"; then : ac_cv_prog_cc_c89=$ac_arg fi rm -f core conftest.err conftest.$ac_objext test "x$ac_cv_prog_cc_c89" != "xno" && break done rm -f conftest.$ac_ext CC=$ac_save_CC fi # AC_CACHE_VAL case "x$ac_cv_prog_cc_c89" in x) { $as_echo "$as_me:${as_lineno-$LINENO}: result: none needed" >&5 $as_echo "none needed" >&6; } ;; xno) { $as_echo "$as_me:${as_lineno-$LINENO}: result: unsupported" >&5 $as_echo "unsupported" >&6; } ;; *) CC="$CC $ac_cv_prog_cc_c89" { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_cc_c89" >&5 $as_echo "$ac_cv_prog_cc_c89" >&6; } ;; esac if test "x$ac_cv_prog_cc_c89" != xno; then : fi ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ln -s works" >&5 $as_echo_n "checking whether ln -s works... " >&6; } LN_S=$as_ln_s if test "$LN_S" = "ln -s"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no, using $LN_S" >&5 $as_echo "no, using $LN_S" >&6; } fi ac_aux_dir= for ac_dir in "$srcdir" "$srcdir/.." "$srcdir/../.."; do if test -f "$ac_dir/install-sh"; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/install-sh -c" break elif test -f "$ac_dir/install.sh"; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/install.sh -c" break elif test -f "$ac_dir/shtool"; then ac_aux_dir=$ac_dir ac_install_sh="$ac_aux_dir/shtool install -c" break fi done if test -z "$ac_aux_dir"; then as_fn_error $? "cannot find install-sh, install.sh, or shtool in \"$srcdir\" \"$srcdir/..\" \"$srcdir/../..\"" "$LINENO" 5 fi # These three variables are undocumented and unsupported, # and are intended to be withdrawn in a future Autoconf release. # They can cause serious problems if a builder's source tree is in a directory # whose full name contains unusual characters. ac_config_guess="$SHELL $ac_aux_dir/config.guess" # Please don't use this var. ac_config_sub="$SHELL $ac_aux_dir/config.sub" # Please don't use this var. ac_configure="$SHELL $ac_aux_dir/configure" # Please don't use this var. # Find a good install program. We prefer a C program (faster), # so one script is as good as another. But avoid the broken or # incompatible versions: # SysV /etc/install, /usr/sbin/install # SunOS /usr/etc/install # IRIX /sbin/install # AIX /bin/install # AmigaOS /C/install, which installs bootblocks on floppy discs # AIX 4 /usr/bin/installbsd, which doesn't work without a -g flag # AFS /usr/afsws/bin/install, which mishandles nonexistent args # SVR4 /usr/ucb/install, which tries to use the nonexistent group "staff" # OS/2's system install, which has a completely different semantic # ./install, which can be erroneously created by make from ./install.sh. # Reject install programs that cannot install multiple files. { $as_echo "$as_me:${as_lineno-$LINENO}: checking for a BSD-compatible install" >&5 $as_echo_n "checking for a BSD-compatible install... " >&6; } if test -z "$INSTALL"; then if ${ac_cv_path_install+:} false; then : $as_echo_n "(cached) " >&6 else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. # Account for people who put trailing slashes in PATH elements. case $as_dir/ in #(( ./ | .// | /[cC]/* | \ /etc/* | /usr/sbin/* | /usr/etc/* | /sbin/* | /usr/afsws/bin/* | \ ?:[\\/]os2[\\/]install[\\/]* | ?:[\\/]OS2[\\/]INSTALL[\\/]* | \ /usr/ucb/* ) ;; *) # OSF1 and SCO ODT 3.0 have their own names for install. # Don't use installbsd from OSF since it installs stuff as root # by default. for ac_prog in ginstall scoinst install; do for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_prog$ac_exec_ext" && $as_test_x "$as_dir/$ac_prog$ac_exec_ext"; }; then if test $ac_prog = install && grep dspmsg "$as_dir/$ac_prog$ac_exec_ext" >/dev/null 2>&1; then # AIX install. It has an incompatible calling convention. : elif test $ac_prog = install && grep pwplus "$as_dir/$ac_prog$ac_exec_ext" >/dev/null 2>&1; then # program-specific install script used by HP pwplus--don't use. : else rm -rf conftest.one conftest.two conftest.dir echo one > conftest.one echo two > conftest.two mkdir conftest.dir if "$as_dir/$ac_prog$ac_exec_ext" -c conftest.one conftest.two "`pwd`/conftest.dir" && test -s conftest.one && test -s conftest.two && test -s conftest.dir/conftest.one && test -s conftest.dir/conftest.two then ac_cv_path_install="$as_dir/$ac_prog$ac_exec_ext -c" break 3 fi fi fi done done ;; esac done IFS=$as_save_IFS rm -rf conftest.one conftest.two conftest.dir fi if test "${ac_cv_path_install+set}" = set; then INSTALL=$ac_cv_path_install else # As a last resort, use the slow shell script. Don't cache a # value for INSTALL within a source directory, because that will # break other packages using the cache if that directory is # removed, or if the value is a relative name. INSTALL=$ac_install_sh fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $INSTALL" >&5 $as_echo "$INSTALL" >&6; } # Use test -z because SunOS4 sh mishandles braces in ${var-val}. # It thinks the first close brace ends the variable substitution. test -z "$INSTALL_PROGRAM" && INSTALL_PROGRAM='${INSTALL}' test -z "$INSTALL_SCRIPT" && INSTALL_SCRIPT='${INSTALL}' test -z "$INSTALL_DATA" && INSTALL_DATA='${INSTALL} -m 644' for ac_prog in flex lex do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_LEX+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$LEX"; then ac_cv_prog_LEX="$LEX" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_LEX="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi LEX=$ac_cv_prog_LEX if test -n "$LEX"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $LEX" >&5 $as_echo "$LEX" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$LEX" && break done test -n "$LEX" || LEX=":" if test "x$LEX" != "x:"; then cat >conftest.l <<_ACEOF %% a { ECHO; } b { REJECT; } c { yymore (); } d { yyless (1); } e { yyless (input () != 0); } f { unput (yytext[0]); } . { BEGIN INITIAL; } %% #ifdef YYTEXT_POINTER extern char *yytext; #endif int main (void) { return ! yylex () + ! yywrap (); } _ACEOF { { ac_try="$LEX conftest.l" case "(($ac_try" in *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; *) ac_try_echo=$ac_try;; esac eval ac_try_echo="\"\$as_me:${as_lineno-$LINENO}: $ac_try_echo\"" $as_echo "$ac_try_echo"; } >&5 (eval "$LEX conftest.l") 2>&5 ac_status=$? $as_echo "$as_me:${as_lineno-$LINENO}: \$? = $ac_status" >&5 test $ac_status = 0; } { $as_echo "$as_me:${as_lineno-$LINENO}: checking lex output file root" >&5 $as_echo_n "checking lex output file root... " >&6; } if ${ac_cv_prog_lex_root+:} false; then : $as_echo_n "(cached) " >&6 else if test -f lex.yy.c; then ac_cv_prog_lex_root=lex.yy elif test -f lexyy.c; then ac_cv_prog_lex_root=lexyy else as_fn_error $? "cannot find output from $LEX; giving up" "$LINENO" 5 fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_lex_root" >&5 $as_echo "$ac_cv_prog_lex_root" >&6; } LEX_OUTPUT_ROOT=$ac_cv_prog_lex_root if test -z "${LEXLIB+set}"; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking lex library" >&5 $as_echo_n "checking lex library... " >&6; } if ${ac_cv_lib_lex+:} false; then : $as_echo_n "(cached) " >&6 else ac_save_LIBS=$LIBS ac_cv_lib_lex='none needed' for ac_lib in '' -lfl -ll; do LIBS="$ac_lib $ac_save_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ `cat $LEX_OUTPUT_ROOT.c` _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_lex=$ac_lib fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext test "$ac_cv_lib_lex" != 'none needed' && break done LIBS=$ac_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_lex" >&5 $as_echo "$ac_cv_lib_lex" >&6; } test "$ac_cv_lib_lex" != 'none needed' && LEXLIB=$ac_cv_lib_lex fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether yytext is a pointer" >&5 $as_echo_n "checking whether yytext is a pointer... " >&6; } if ${ac_cv_prog_lex_yytext_pointer+:} false; then : $as_echo_n "(cached) " >&6 else # POSIX says lex can declare yytext either as a pointer or an array; the # default is implementation-dependent. Figure out which it is, since # not all implementations provide the %pointer and %array declarations. ac_cv_prog_lex_yytext_pointer=no ac_save_LIBS=$LIBS LIBS="$LEXLIB $ac_save_LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define YYTEXT_POINTER 1 `cat $LEX_OUTPUT_ROOT.c` _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_prog_lex_yytext_pointer=yes fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_lex_yytext_pointer" >&5 $as_echo "$ac_cv_prog_lex_yytext_pointer" >&6; } if test $ac_cv_prog_lex_yytext_pointer = yes; then $as_echo "#define YYTEXT_POINTER 1" >>confdefs.h fi rm -f conftest.l $LEX_OUTPUT_ROOT.c fi for ac_prog in 'bison -y' byacc do # Extract the first word of "$ac_prog", so it can be a program name with args. set dummy $ac_prog; ac_word=$2 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5 $as_echo_n "checking for $ac_word... " >&6; } if ${ac_cv_prog_YACC+:} false; then : $as_echo_n "(cached) " >&6 else if test -n "$YACC"; then ac_cv_prog_YACC="$YACC" # Let the user override the test. else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. for ac_exec_ext in '' $ac_executable_extensions; do if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then ac_cv_prog_YACC="$ac_prog" $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5 break 2 fi done done IFS=$as_save_IFS fi fi YACC=$ac_cv_prog_YACC if test -n "$YACC"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: $YACC" >&5 $as_echo "$YACC" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi test -n "$YACC" && break done test -n "$YACC" || YACC="yacc" # Checks for typedefs, structures, and compiler characteristics. { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -O2" >&5 $as_echo_n "checking whether $CC supports -O2... " >&6; } cache=`echo O2 | sed 'y%.=/+-%___p_%'` if eval \${cv_prog_cc_flag_$cache+:} false; then : $as_echo_n "(cached) " >&6 else echo 'void f(){}' >conftest.c if test -z "`$CC -O2 -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_$cache=yes" else eval "cv_prog_cc_flag_$cache=no" fi rm -f conftest* fi if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } : else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } : CFLAGS=`echo $CFLAGS | sed -e "s/-O2//g"` fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for an ANSI C-conforming const" >&5 $as_echo_n "checking for an ANSI C-conforming const... " >&6; } if ${ac_cv_c_const+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ int main () { /* FIXME: Include the comments suggested by Paul. */ #ifndef __cplusplus /* Ultrix mips cc rejects this. */ typedef int charset[2]; const charset cs; /* SunOS 4.1.1 cc rejects this. */ char const *const *pcpcc; char **ppc; /* NEC SVR4.0.2 mips cc rejects this. */ struct point {int x, y;}; static struct point const zero = {0,0}; /* AIX XL C 1.02.0.0 rejects this. It does not let you subtract one const X* pointer from another in an arm of an if-expression whose if-part is not a constant expression */ const char *g = "string"; pcpcc = &g + (g ? g-g : 0); /* HPUX 7.0 cc rejects these. */ ++pcpcc; ppc = (char**) pcpcc; pcpcc = (char const *const *) ppc; { /* SCO 3.2v4 cc rejects this. */ char *t; char const *s = 0 ? (char *) 0 : (char const *) 0; *t++ = 0; if (s) return 0; } { /* Someone thinks the Sun supposedly-ANSI compiler will reject this. */ int x[] = {25, 17}; const int *foo = &x[0]; ++foo; } { /* Sun SC1.0 ANSI compiler rejects this -- but not the above. */ typedef const int *iptr; iptr p = 0; ++p; } { /* AIX XL C 1.02.0.0 rejects this saying "k.c", line 2.27: 1506-025 (S) Operand must be a modifiable lvalue. */ struct s { int j; const int *ap[3]; }; struct s *b; b->j = 5; } { /* ULTRIX-32 V3.1 (Rev 9) vcc rejects this */ const int foo = 10; if (!foo) return 0; } return !cs[0] && !zero.x; #endif ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_c_const=yes else ac_cv_c_const=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_const" >&5 $as_echo "$ac_cv_c_const" >&6; } if test $ac_cv_c_const = no; then $as_echo "#define const /**/" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for inline" >&5 $as_echo_n "checking for inline... " >&6; } if ${ac_cv_c_inline+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_c_inline=no for ac_kw in inline __inline__ __inline; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #ifndef __cplusplus typedef int foo_t; static $ac_kw foo_t static_foo () {return 0; } $ac_kw foo_t foo () {return 0; } #endif _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_c_inline=$ac_kw fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext test "$ac_cv_c_inline" != no && break done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_inline" >&5 $as_echo "$ac_cv_c_inline" >&6; } case $ac_cv_c_inline in inline | yes) ;; *) case $ac_cv_c_inline in no) ac_val=;; *) ac_val=$ac_cv_c_inline;; esac cat >>confdefs.h <<_ACEOF #ifndef __cplusplus #define inline $ac_val #endif _ACEOF ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uid_t in sys/types.h" >&5 $as_echo_n "checking for uid_t in sys/types.h... " >&6; } if ${ac_cv_type_uid_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "uid_t" >/dev/null 2>&1; then : ac_cv_type_uid_t=yes else ac_cv_type_uid_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uid_t" >&5 $as_echo "$ac_cv_type_uid_t" >&6; } if test $ac_cv_type_uid_t = no; then $as_echo "#define uid_t int" >>confdefs.h $as_echo "#define gid_t int" >>confdefs.h fi ac_fn_c_check_type "$LINENO" "pid_t" "ac_cv_type_pid_t" "$ac_includes_default" if test "x$ac_cv_type_pid_t" = xyes; then : else cat >>confdefs.h <<_ACEOF #define pid_t int _ACEOF fi ac_fn_c_check_type "$LINENO" "size_t" "ac_cv_type_size_t" "$ac_includes_default" if test "x$ac_cv_type_size_t" = xyes; then : else cat >>confdefs.h <<_ACEOF #define size_t unsigned int _ACEOF fi ac_fn_c_check_type "$LINENO" "off_t" "ac_cv_type_off_t" "$ac_includes_default" if test "x$ac_cv_type_off_t" = xyes; then : else cat >>confdefs.h <<_ACEOF #define off_t long int _ACEOF fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"format\" attribute" >&5 $as_echo_n "checking whether the C compiler (${CC-cc}) accepts the \"format\" attribute... " >&6; } if ${ac_cv_c_format_attribute+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_c_format_attribute=no cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include void f (char *format, ...) __attribute__ ((format (printf, 1, 2))); void (*pf) (char *format, ...) __attribute__ ((format (printf, 1, 2))); int main () { f ("%s", "str"); ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_c_format_attribute="yes" else ac_cv_c_format_attribute="no" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_format_attribute" >&5 $as_echo "$ac_cv_c_format_attribute" >&6; } if test $ac_cv_c_format_attribute = yes; then $as_echo "#define HAVE_ATTR_FORMAT 1" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"unused\" attribute" >&5 $as_echo_n "checking whether the C compiler (${CC-cc}) accepts the \"unused\" attribute... " >&6; } if ${ac_cv_c_unused_attribute+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_c_unused_attribute=no cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include void f (char *u __attribute__((unused))); int main () { f ("x"); ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_c_unused_attribute="yes" else ac_cv_c_unused_attribute="no" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_unused_attribute" >&5 $as_echo "$ac_cv_c_unused_attribute" >&6; } if test $ac_cv_c_unused_attribute = yes; then $as_echo "#define HAVE_ATTR_UNUSED 1" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking if memcmp compares unsigned" >&5 $as_echo_n "checking if memcmp compares unsigned... " >&6; } if test "$cross_compiling" = yes; then : { $as_echo "$as_me:${as_lineno-$LINENO}: result: cross-compile no" >&5 $as_echo "cross-compile no" >&6; } $as_echo "#define MEMCMP_IS_BROKEN 1" >>confdefs.h case " $LIBOBJS " in *" memcmp.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS memcmp.$ac_objext" ;; esac else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include int main(void) { char a = 255, b = 0; if(memcmp(&a, &b, 1) < 0) return 1; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } $as_echo "#define MEMCMP_IS_BROKEN 1" >>confdefs.h case " $LIBOBJS " in *" memcmp.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS memcmp.$ac_objext" ;; esac fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether ctime_r works with two arguments" >&5 $as_echo_n "checking whether ctime_r works with two arguments... " >&6; } if ${ac_cv_c_ctime_c+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_c_ctime_c=no cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include void testing (void) { time_t clock; char current_time[40]; ctime_r(&clock, current_time); } int main () { testing(); ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_c_ctime_c="yes" else ac_cv_c_ctime_c="no" fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_ctime_c" >&5 $as_echo "$ac_cv_c_ctime_c" >&6; } if test $ac_cv_c_ctime_c = no; then CPPFLAGS="$CPPFLAGS -D_POSIX_PTHREAD_SEMANTICS" fi # Checks for libraries. # Check for SSL, original taken from # http://www.gnu.org/software/ac-archive/htmldoc/check_ssl.html and # modified for NSD. # Checks for header files. { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ANSI C header files" >&5 $as_echo_n "checking for ANSI C header files... " >&6; } if ${ac_cv_header_stdc+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #include #include int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_header_stdc=yes else ac_cv_header_stdc=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext if test $ac_cv_header_stdc = yes; then # SunOS 4.x string.h does not declare mem*, contrary to ANSI. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "memchr" >/dev/null 2>&1; then : else ac_cv_header_stdc=no fi rm -f conftest* fi if test $ac_cv_header_stdc = yes; then # ISC 2.0.2 stdlib.h does not declare free, contrary to ANSI. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "free" >/dev/null 2>&1; then : else ac_cv_header_stdc=no fi rm -f conftest* fi if test $ac_cv_header_stdc = yes; then # /bin/cc in Irix-4.0.5 gets non-ANSI ctype macros unless using -ansi. if test "$cross_compiling" = yes; then : : else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #if ((' ' & 0x0FF) == 0x020) # define ISLOWER(c) ('a' <= (c) && (c) <= 'z') # define TOUPPER(c) (ISLOWER(c) ? 'A' + ((c) - 'a') : (c)) #else # define ISLOWER(c) \ (('a' <= (c) && (c) <= 'i') \ || ('j' <= (c) && (c) <= 'r') \ || ('s' <= (c) && (c) <= 'z')) # define TOUPPER(c) (ISLOWER(c) ? ((c) | 0x40) : (c)) #endif #define XOR(e, f) (((e) && !(f)) || (!(e) && (f))) int main () { int i; for (i = 0; i < 256; i++) if (XOR (islower (i), ISLOWER (i)) || toupper (i) != TOUPPER (i)) return 2; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : else ac_cv_header_stdc=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_stdc" >&5 $as_echo "$ac_cv_header_stdc" >&6; } if test $ac_cv_header_stdc = yes; then $as_echo "#define STDC_HEADERS 1" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for sys/wait.h that is POSIX.1 compatible" >&5 $as_echo_n "checking for sys/wait.h that is POSIX.1 compatible... " >&6; } if ${ac_cv_header_sys_wait_h+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include #ifndef WEXITSTATUS # define WEXITSTATUS(stat_val) ((unsigned int) (stat_val) >> 8) #endif #ifndef WIFEXITED # define WIFEXITED(stat_val) (((stat_val) & 255) == 0) #endif int main () { int s; wait (&s); s = WIFEXITED (s) ? WEXITSTATUS (s) : 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_header_sys_wait_h=yes else ac_cv_header_sys_wait_h=no fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_header_sys_wait_h" >&5 $as_echo "$ac_cv_header_sys_wait_h" >&6; } if test $ac_cv_header_sys_wait_h = yes; then $as_echo "#define HAVE_SYS_WAIT_H 1" >>confdefs.h fi for ac_header in time.h arpa/inet.h signal.h string.h strings.h fcntl.h limits.h netinet/in.h stddef.h sys/param.h sys/socket.h syslog.h unistd.h sys/select.h stdarg.h stdint.h netdb.h sys/bitypes.h tcpd.h grp.h do : as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh` ac_fn_c_check_header_mongrel "$LINENO" "$ac_header" "$as_ac_Header" "$ac_includes_default" if eval test \"x\$"$as_ac_Header"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1 _ACEOF fi done { $as_echo "$as_me:${as_lineno-$LINENO}: checking for double definition of struct va_list" >&5 $as_echo_n "checking for double definition of struct va_list... " >&6; } if ${ac_cv_c_va_list_def+:} false; then : $as_echo_n "(cached) " >&6 else cat >conftest.c < #include int foo(void); EOF if test -z "`$CC -Werror -D_XOPEN_SOURCE=600 -c conftest.c 2>&1`"; then eval "ac_cv_c_va_list_def=no" else eval "ac_cv_c_va_list_def=yes" fi rm -f conftest* fi if test $ac_cv_c_va_list_def = yes; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } : cat >>confdefs.h <<_ACEOF #define HAVE_VA_LIST_DOUBLE_DEF /**/ _ACEOF else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } : fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether strptime needs defines" >&5 $as_echo_n "checking whether strptime needs defines... " >&6; } if ${ac_cv_c_strptime_needs_defs+:} false; then : $as_echo_n "(cached) " >&6 else cat >conftest.c < int testing (void) { struct tm t; const char *timestr="201201"; return strptime(timestr, "%Y%m", &t) != 0; } EOF if test -z "`$CC -Wall -Werror -c conftest.c 2>&1`"; then eval "ac_cv_c_strptime_needs_defs=no" else eval "ac_cv_c_strptime_needs_defs=yes" fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_strptime_needs_defs" >&5 $as_echo "$ac_cv_c_strptime_needs_defs" >&6; } if test $ac_cv_c_strptime_needs_defs = yes; then cat >>confdefs.h <<_ACEOF #define STRPTIME_NEEDS_DEFINES 1 _ACEOF fi # check wether strptime also works { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing inet_pton" >&5 $as_echo_n "checking for library containing inet_pton... " >&6; } if ${ac_cv_search_inet_pton+:} false; then : $as_echo_n "(cached) " >&6 else ac_func_search_save_LIBS=$LIBS cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char inet_pton (); int main () { return inet_pton (); ; return 0; } _ACEOF for ac_lib in '' nsl; do if test -z "$ac_lib"; then ac_res="none required" else ac_res=-l$ac_lib LIBS="-l$ac_lib $ac_func_search_save_LIBS" fi if ac_fn_c_try_link "$LINENO"; then : ac_cv_search_inet_pton=$ac_res fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext if ${ac_cv_search_inet_pton+:} false; then : break fi done if ${ac_cv_search_inet_pton+:} false; then : else ac_cv_search_inet_pton=no fi rm conftest.$ac_ext LIBS=$ac_func_search_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_inet_pton" >&5 $as_echo "$ac_cv_search_inet_pton" >&6; } ac_res=$ac_cv_search_inet_pton if test "$ac_res" != no; then : test "$ac_res" = "none required" || LIBS="$ac_res $LIBS" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for library containing socket" >&5 $as_echo_n "checking for library containing socket... " >&6; } if ${ac_cv_search_socket+:} false; then : $as_echo_n "(cached) " >&6 else ac_func_search_save_LIBS=$LIBS cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char socket (); int main () { return socket (); ; return 0; } _ACEOF for ac_lib in '' socket; do if test -z "$ac_lib"; then ac_res="none required" else ac_res=-l$ac_lib LIBS="-l$ac_lib $ac_func_search_save_LIBS" fi if ac_fn_c_try_link "$LINENO"; then : ac_cv_search_socket=$ac_res fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext if ${ac_cv_search_socket+:} false; then : break fi done if ${ac_cv_search_socket+:} false; then : else ac_cv_search_socket=no fi rm conftest.$ac_ext LIBS=$ac_func_search_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_search_socket" >&5 $as_echo "$ac_cv_search_socket" >&6; } ac_res=$ac_cv_search_socket if test "$ac_res" != no; then : test "$ac_res" = "none required" || LIBS="$ac_res $LIBS" fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether strptime works" >&5 $as_echo_n "checking whether strptime works... " >&6; } if test c${cross_compiling} = cno; then if test "$cross_compiling" = yes; then : { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "cannot run test program while cross compiling See \`config.log' for more details" "$LINENO" 5; } else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define _XOPEN_SOURCE #include int main(void) { struct tm tm; char *res; res = strptime("20070207111842", "%Y%m%d%H%M%S", &tm); if (!res) return 1; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : eval "ac_cv_c_strptime_works=yes" else eval "ac_cv_c_strptime_works=no" fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi else eval "ac_cv_c_strptime_works=maybe" fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_strptime_works" >&5 $as_echo "$ac_cv_c_strptime_works" >&6; } if test $ac_cv_c_strptime_works = no; then case " $LIBOBJS " in *" strptime.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS strptime.$ac_objext" ;; esac else cat >>confdefs.h <<_ACEOF #define STRPTIME_WORKS 1 _ACEOF fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for int8_t" >&5 $as_echo_n "checking for int8_t... " >&6; } if ${ac_cv_type_int8_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])int8_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_int8_t=yes else ac_cv_type_int8_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_int8_t" >&5 $as_echo "$ac_cv_type_int8_t" >&6; } if test $ac_cv_type_int8_t = no; then $as_echo "#define int8_t char" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for int16_t" >&5 $as_echo_n "checking for int16_t... " >&6; } if ${ac_cv_type_int16_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])int16_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_int16_t=yes else ac_cv_type_int16_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_int16_t" >&5 $as_echo "$ac_cv_type_int16_t" >&6; } if test $ac_cv_type_int16_t = no; then $as_echo "#define int16_t short" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for int32_t" >&5 $as_echo_n "checking for int32_t... " >&6; } if ${ac_cv_type_int32_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])int32_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_int32_t=yes else ac_cv_type_int32_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_int32_t" >&5 $as_echo "$ac_cv_type_int32_t" >&6; } if test $ac_cv_type_int32_t = no; then $as_echo "#define int32_t int" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for int64_t" >&5 $as_echo_n "checking for int64_t... " >&6; } if ${ac_cv_type_int64_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])int64_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_int64_t=yes else ac_cv_type_int64_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_int64_t" >&5 $as_echo "$ac_cv_type_int64_t" >&6; } if test $ac_cv_type_int64_t = no; then $as_echo "#define int64_t long long" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uint8_t" >&5 $as_echo_n "checking for uint8_t... " >&6; } if ${ac_cv_type_uint8_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])uint8_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_uint8_t=yes else ac_cv_type_uint8_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uint8_t" >&5 $as_echo "$ac_cv_type_uint8_t" >&6; } if test $ac_cv_type_uint8_t = no; then $as_echo "#define uint8_t unsigned char" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uint16_t" >&5 $as_echo_n "checking for uint16_t... " >&6; } if ${ac_cv_type_uint16_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])uint16_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_uint16_t=yes else ac_cv_type_uint16_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uint16_t" >&5 $as_echo "$ac_cv_type_uint16_t" >&6; } if test $ac_cv_type_uint16_t = no; then $as_echo "#define uint16_t unsigned short" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uint32_t" >&5 $as_echo_n "checking for uint32_t... " >&6; } if ${ac_cv_type_uint32_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])uint32_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_uint32_t=yes else ac_cv_type_uint32_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uint32_t" >&5 $as_echo "$ac_cv_type_uint32_t" >&6; } if test $ac_cv_type_uint32_t = no; then $as_echo "#define uint32_t unsigned int" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uint64_t" >&5 $as_echo_n "checking for uint64_t... " >&6; } if ${ac_cv_type_uint64_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])uint64_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_uint64_t=yes else ac_cv_type_uint64_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uint64_t" >&5 $as_echo "$ac_cv_type_uint64_t" >&6; } if test $ac_cv_type_uint64_t = no; then $as_echo "#define uint64_t unsigned long long" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for socklen_t" >&5 $as_echo_n "checking for socklen_t... " >&6; } if ${ac_cv_type_socklen_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])socklen_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_socklen_t=yes else ac_cv_type_socklen_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_socklen_t" >&5 $as_echo "$ac_cv_type_socklen_t" >&6; } if test $ac_cv_type_socklen_t = no; then $as_echo "#define socklen_t int" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for sig_atomic_t" >&5 $as_echo_n "checking for sig_atomic_t... " >&6; } if ${ac_cv_type_sig_atomic_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])sig_atomic_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_sig_atomic_t=yes else ac_cv_type_sig_atomic_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_sig_atomic_t" >&5 $as_echo "$ac_cv_type_sig_atomic_t" >&6; } if test $ac_cv_type_sig_atomic_t = no; then $as_echo "#define sig_atomic_t int" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ssize_t" >&5 $as_echo_n "checking for ssize_t... " >&6; } if ${ac_cv_type_ssize_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])ssize_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_ssize_t=yes else ac_cv_type_ssize_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_ssize_t" >&5 $as_echo "$ac_cv_type_ssize_t" >&6; } if test $ac_cv_type_ssize_t = no; then $as_echo "#define ssize_t int" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for suseconds_t" >&5 $as_echo_n "checking for suseconds_t... " >&6; } if ${ac_cv_type_suseconds_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])suseconds_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_suseconds_t=yes else ac_cv_type_suseconds_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_suseconds_t" >&5 $as_echo "$ac_cv_type_suseconds_t" >&6; } if test $ac_cv_type_suseconds_t = no; then $as_echo "#define suseconds_t time_t" >>confdefs.h fi ac_fn_c_check_type "$LINENO" "in_addr_t" "ac_cv_type_in_addr_t" " #if HAVE_SYS_TYPES_H # include #endif #if HAVE_NETINET_IN_H # include #endif " if test "x$ac_cv_type_in_addr_t" = xyes; then : else $as_echo "#define in_addr_t uint32_t" >>confdefs.h fi ac_fn_c_check_member "$LINENO" "struct sockaddr_storage" "ss_family" "ac_cv_member_struct_sockaddr_storage_ss_family" "$ac_includes_default #ifdef HAVE_NETINET_IN_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_NETDB_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif " if test "x$ac_cv_member_struct_sockaddr_storage_ss_family" = xyes; then : else ac_fn_c_check_member "$LINENO" "struct sockaddr_storage" "__ss_family" "ac_cv_member_struct_sockaddr_storage___ss_family" "$ac_includes_default #ifdef HAVE_NETINET_IN_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_NETDB_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif " if test "x$ac_cv_member_struct_sockaddr_storage___ss_family" = xyes; then : $as_echo "#define ss_family __ss_family" >>confdefs.h fi fi # Checks for library functions. for ac_header in unistd.h do : ac_fn_c_check_header_mongrel "$LINENO" "unistd.h" "ac_cv_header_unistd_h" "$ac_includes_default" if test "x$ac_cv_header_unistd_h" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_UNISTD_H 1 _ACEOF fi done { $as_echo "$as_me:${as_lineno-$LINENO}: checking for working chown" >&5 $as_echo_n "checking for working chown... " >&6; } if ${ac_cv_func_chown_works+:} false; then : $as_echo_n "(cached) " >&6 else if test "$cross_compiling" = yes; then : ac_cv_func_chown_works=no else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_includes_default #include int main () { char *f = "conftest.chown"; struct stat before, after; if (creat (f, 0600) < 0) return 1; if (stat (f, &before) < 0) return 1; if (chown (f, (uid_t) -1, (gid_t) -1) == -1) return 1; if (stat (f, &after) < 0) return 1; return ! (before.st_uid == after.st_uid && before.st_gid == after.st_gid); ; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : ac_cv_func_chown_works=yes else ac_cv_func_chown_works=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi rm -f conftest.chown fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_chown_works" >&5 $as_echo "$ac_cv_func_chown_works" >&6; } if test $ac_cv_func_chown_works = yes; then $as_echo "#define HAVE_CHOWN 1" >>confdefs.h fi for ac_header in vfork.h do : ac_fn_c_check_header_mongrel "$LINENO" "vfork.h" "ac_cv_header_vfork_h" "$ac_includes_default" if test "x$ac_cv_header_vfork_h" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_VFORK_H 1 _ACEOF fi done for ac_func in fork vfork do : as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var" if eval test \"x\$"$as_ac_var"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1 _ACEOF fi done if test "x$ac_cv_func_fork" = xyes; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for working fork" >&5 $as_echo_n "checking for working fork... " >&6; } if ${ac_cv_func_fork_works+:} false; then : $as_echo_n "(cached) " >&6 else if test "$cross_compiling" = yes; then : ac_cv_func_fork_works=cross else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ $ac_includes_default int main () { /* By Ruediger Kuhlmann. */ return fork () < 0; ; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : ac_cv_func_fork_works=yes else ac_cv_func_fork_works=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_fork_works" >&5 $as_echo "$ac_cv_func_fork_works" >&6; } else ac_cv_func_fork_works=$ac_cv_func_fork fi if test "x$ac_cv_func_fork_works" = xcross; then case $host in *-*-amigaos* | *-*-msdosdjgpp*) # Override, as these systems have only a dummy fork() stub ac_cv_func_fork_works=no ;; *) ac_cv_func_fork_works=yes ;; esac { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: result $ac_cv_func_fork_works guessed because of cross compilation" >&5 $as_echo "$as_me: WARNING: result $ac_cv_func_fork_works guessed because of cross compilation" >&2;} fi ac_cv_func_vfork_works=$ac_cv_func_vfork if test "x$ac_cv_func_vfork" = xyes; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for working vfork" >&5 $as_echo_n "checking for working vfork... " >&6; } if ${ac_cv_func_vfork_works+:} false; then : $as_echo_n "(cached) " >&6 else if test "$cross_compiling" = yes; then : ac_cv_func_vfork_works=cross else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Thanks to Paul Eggert for this test. */ $ac_includes_default #include #ifdef HAVE_VFORK_H # include #endif /* On some sparc systems, changes by the child to local and incoming argument registers are propagated back to the parent. The compiler is told about this with #include , but some compilers (e.g. gcc -O) don't grok . Test for this by using a static variable whose address is put into a register that is clobbered by the vfork. */ static void #ifdef __cplusplus sparc_address_test (int arg) # else sparc_address_test (arg) int arg; #endif { static pid_t child; if (!child) { child = vfork (); if (child < 0) { perror ("vfork"); _exit(2); } if (!child) { arg = getpid(); write(-1, "", 0); _exit (arg); } } } int main () { pid_t parent = getpid (); pid_t child; sparc_address_test (0); child = vfork (); if (child == 0) { /* Here is another test for sparc vfork register problems. This test uses lots of local variables, at least as many local variables as main has allocated so far including compiler temporaries. 4 locals are enough for gcc 1.40.3 on a Solaris 4.1.3 sparc, but we use 8 to be safe. A buggy compiler should reuse the register of parent for one of the local variables, since it will think that parent can't possibly be used any more in this routine. Assigning to the local variable will thus munge parent in the parent process. */ pid_t p = getpid(), p1 = getpid(), p2 = getpid(), p3 = getpid(), p4 = getpid(), p5 = getpid(), p6 = getpid(), p7 = getpid(); /* Convince the compiler that p..p7 are live; otherwise, it might use the same hardware register for all 8 local variables. */ if (p != p1 || p != p2 || p != p3 || p != p4 || p != p5 || p != p6 || p != p7) _exit(1); /* On some systems (e.g. IRIX 3.3), vfork doesn't separate parent from child file descriptors. If the child closes a descriptor before it execs or exits, this munges the parent's descriptor as well. Test for this by closing stdout in the child. */ _exit(close(fileno(stdout)) != 0); } else { int status; struct stat st; while (wait(&status) != child) ; return ( /* Was there some problem with vforking? */ child < 0 /* Did the child fail? (This shouldn't happen.) */ || status /* Did the vfork/compiler bug occur? */ || parent != getpid() /* Did the file descriptor bug occur? */ || fstat(fileno(stdout), &st) != 0 ); } } _ACEOF if ac_fn_c_try_run "$LINENO"; then : ac_cv_func_vfork_works=yes else ac_cv_func_vfork_works=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_vfork_works" >&5 $as_echo "$ac_cv_func_vfork_works" >&6; } fi; if test "x$ac_cv_func_fork_works" = xcross; then ac_cv_func_vfork_works=$ac_cv_func_vfork { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: result $ac_cv_func_vfork_works guessed because of cross compilation" >&5 $as_echo "$as_me: WARNING: result $ac_cv_func_vfork_works guessed because of cross compilation" >&2;} fi if test "x$ac_cv_func_vfork_works" = xyes; then $as_echo "#define HAVE_WORKING_VFORK 1" >>confdefs.h else $as_echo "#define vfork fork" >>confdefs.h fi if test "x$ac_cv_func_fork_works" = xyes; then $as_echo "#define HAVE_WORKING_FORK 1" >>confdefs.h fi for ac_header in stdlib.h do : ac_fn_c_check_header_mongrel "$LINENO" "stdlib.h" "ac_cv_header_stdlib_h" "$ac_includes_default" if test "x$ac_cv_header_stdlib_h" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_STDLIB_H 1 _ACEOF fi done { $as_echo "$as_me:${as_lineno-$LINENO}: checking for GNU libc compatible malloc" >&5 $as_echo_n "checking for GNU libc compatible malloc... " >&6; } if ${ac_cv_func_malloc_0_nonnull+:} false; then : $as_echo_n "(cached) " >&6 else if test "$cross_compiling" = yes; then : ac_cv_func_malloc_0_nonnull=no else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #if defined STDC_HEADERS || defined HAVE_STDLIB_H # include #else char *malloc (); #endif int main () { return ! malloc (0); ; return 0; } _ACEOF if ac_fn_c_try_run "$LINENO"; then : ac_cv_func_malloc_0_nonnull=yes else ac_cv_func_malloc_0_nonnull=no fi rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \ conftest.$ac_objext conftest.beam conftest.$ac_ext fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_func_malloc_0_nonnull" >&5 $as_echo "$ac_cv_func_malloc_0_nonnull" >&6; } if test $ac_cv_func_malloc_0_nonnull = yes; then : $as_echo "#define HAVE_MALLOC 1" >>confdefs.h else $as_echo "#define HAVE_MALLOC 0" >>confdefs.h case " $LIBOBJS " in *" malloc.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS malloc.$ac_objext" ;; esac $as_echo "#define malloc rpl_malloc" >>confdefs.h fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking return type of signal handlers" >&5 $as_echo_n "checking return type of signal handlers... " >&6; } if ${ac_cv_type_signal+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #include int main () { return *(signal (0, 0)) (0) == 1; ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_type_signal=int else ac_cv_type_signal=void fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_signal" >&5 $as_echo "$ac_cv_type_signal" >&6; } cat >>confdefs.h <<_ACEOF #define RETSIGTYPE $ac_cv_type_signal _ACEOF { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _LARGEFILE_SOURCE value needed for large files" >&5 $as_echo_n "checking for _LARGEFILE_SOURCE value needed for large files... " >&6; } if ${ac_cv_sys_largefile_source+:} false; then : $as_echo_n "(cached) " >&6 else while :; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include /* for off_t */ #include int main () { int (*fp) (FILE *, off_t, int) = fseeko; return fseeko (stdin, 0, 0) && fp (stdin, 0, 0); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_sys_largefile_source=no; break fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define _LARGEFILE_SOURCE 1 #include /* for off_t */ #include int main () { int (*fp) (FILE *, off_t, int) = fseeko; return fseeko (stdin, 0, 0) && fp (stdin, 0, 0); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_sys_largefile_source=1; break fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext ac_cv_sys_largefile_source=unknown break done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_largefile_source" >&5 $as_echo "$ac_cv_sys_largefile_source" >&6; } case $ac_cv_sys_largefile_source in #( no | unknown) ;; *) cat >>confdefs.h <<_ACEOF #define _LARGEFILE_SOURCE $ac_cv_sys_largefile_source _ACEOF ;; esac rm -rf conftest* # We used to try defining _XOPEN_SOURCE=500 too, to work around a bug # in glibc 2.1.3, but that breaks too many other things. # If you want fseeko and ftello with glibc, upgrade to a fixed glibc. if test $ac_cv_sys_largefile_source != unknown; then $as_echo "#define HAVE_FSEEKO 1" >>confdefs.h fi # Check whether --enable-largefile was given. if test "${enable_largefile+set}" = set; then : enableval=$enable_largefile; fi if test "$enable_largefile" != no; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for special C compiler options needed for large files" >&5 $as_echo_n "checking for special C compiler options needed for large files... " >&6; } if ${ac_cv_sys_largefile_CC+:} false; then : $as_echo_n "(cached) " >&6 else ac_cv_sys_largefile_CC=no if test "$GCC" != yes; then ac_save_CC=$CC while :; do # IRIX 6.2 and later do not support large files by default, # so use the C compiler's -n32 option if that helps. cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : break fi rm -f core conftest.err conftest.$ac_objext CC="$CC -n32" if ac_fn_c_try_compile "$LINENO"; then : ac_cv_sys_largefile_CC=' -n32'; break fi rm -f core conftest.err conftest.$ac_objext break done CC=$ac_save_CC rm -f conftest.$ac_ext fi fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_largefile_CC" >&5 $as_echo "$ac_cv_sys_largefile_CC" >&6; } if test "$ac_cv_sys_largefile_CC" != no; then CC=$CC$ac_cv_sys_largefile_CC fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _FILE_OFFSET_BITS value needed for large files" >&5 $as_echo_n "checking for _FILE_OFFSET_BITS value needed for large files... " >&6; } if ${ac_cv_sys_file_offset_bits+:} false; then : $as_echo_n "(cached) " >&6 else while :; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_sys_file_offset_bits=no; break fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define _FILE_OFFSET_BITS 64 #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_sys_file_offset_bits=64; break fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_cv_sys_file_offset_bits=unknown break done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_file_offset_bits" >&5 $as_echo "$ac_cv_sys_file_offset_bits" >&6; } case $ac_cv_sys_file_offset_bits in #( no | unknown) ;; *) cat >>confdefs.h <<_ACEOF #define _FILE_OFFSET_BITS $ac_cv_sys_file_offset_bits _ACEOF ;; esac rm -rf conftest* if test $ac_cv_sys_file_offset_bits = unknown; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for _LARGE_FILES value needed for large files" >&5 $as_echo_n "checking for _LARGE_FILES value needed for large files... " >&6; } if ${ac_cv_sys_large_files+:} false; then : $as_echo_n "(cached) " >&6 else while :; do cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_sys_large_files=no; break fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #define _LARGE_FILES 1 #include /* Check that off_t can represent 2**63 - 1 correctly. We can't simply define LARGE_OFF_T to be 9223372036854775807, since some C++ compilers masquerading as C compilers incorrectly reject 9223372036854775807. */ #define LARGE_OFF_T (((off_t) 1 << 62) - 1 + ((off_t) 1 << 62)) int off_t_is_large[(LARGE_OFF_T % 2147483629 == 721 && LARGE_OFF_T % 2147483647 == 1) ? 1 : -1]; int main () { ; return 0; } _ACEOF if ac_fn_c_try_compile "$LINENO"; then : ac_cv_sys_large_files=1; break fi rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext ac_cv_sys_large_files=unknown break done fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_sys_large_files" >&5 $as_echo "$ac_cv_sys_large_files" >&6; } case $ac_cv_sys_large_files in #( no | unknown) ;; *) cat >>confdefs.h <<_ACEOF #define _LARGE_FILES $ac_cv_sys_large_files _ACEOF ;; esac rm -rf conftest* fi fi for ac_func in arc4random arc4random_uniform do : as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var" if eval test \"x\$"$as_ac_var"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1 _ACEOF fi done for ac_func in tzset alarm chroot dup2 endpwent gethostname memset memcpy socket strcasecmp strchr strdup strerror strncasecmp strtol writev getaddrinfo getnameinfo freeaddrinfo gai_strerror sigaction sigprocmask strptime setusercontext initgroups setresuid setreuid setresgid setregid getpwnam mmap do : as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var" if eval test \"x\$"$as_ac_var"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1 _ACEOF fi done # check if setreuid en setregid fail, on MacOSX10.4(darwin8). if echo $build_os | grep darwin8 > /dev/null; then $as_echo "#define DARWIN_BROKEN_SETREUID 1" >>confdefs.h fi # # Checking for missing functions we can replace # ac_fn_c_check_func "$LINENO" "basename" "ac_cv_func_basename" if test "x$ac_cv_func_basename" = xyes; then : $as_echo "#define HAVE_BASENAME 1" >>confdefs.h else case " $LIBOBJS " in *" basename.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS basename.$ac_objext" ;; esac fi ac_fn_c_check_func "$LINENO" "inet_aton" "ac_cv_func_inet_aton" if test "x$ac_cv_func_inet_aton" = xyes; then : $as_echo "#define HAVE_INET_ATON 1" >>confdefs.h else case " $LIBOBJS " in *" inet_aton.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS inet_aton.$ac_objext" ;; esac fi ac_fn_c_check_func "$LINENO" "inet_pton" "ac_cv_func_inet_pton" if test "x$ac_cv_func_inet_pton" = xyes; then : $as_echo "#define HAVE_INET_PTON 1" >>confdefs.h else case " $LIBOBJS " in *" inet_pton.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS inet_pton.$ac_objext" ;; esac fi ac_fn_c_check_func "$LINENO" "inet_ntop" "ac_cv_func_inet_ntop" if test "x$ac_cv_func_inet_ntop" = xyes; then : $as_echo "#define HAVE_INET_NTOP 1" >>confdefs.h else case " $LIBOBJS " in *" inet_ntop.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS inet_ntop.$ac_objext" ;; esac fi ac_fn_c_check_func "$LINENO" "snprintf" "ac_cv_func_snprintf" if test "x$ac_cv_func_snprintf" = xyes; then : $as_echo "#define HAVE_SNPRINTF 1" >>confdefs.h else case " $LIBOBJS " in *" snprintf.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS snprintf.$ac_objext" ;; esac fi ac_fn_c_check_func "$LINENO" "strlcat" "ac_cv_func_strlcat" if test "x$ac_cv_func_strlcat" = xyes; then : $as_echo "#define HAVE_STRLCAT 1" >>confdefs.h else case " $LIBOBJS " in *" strlcat.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS strlcat.$ac_objext" ;; esac fi ac_fn_c_check_func "$LINENO" "strlcpy" "ac_cv_func_strlcpy" if test "x$ac_cv_func_strlcpy" = xyes; then : $as_echo "#define HAVE_STRLCPY 1" >>confdefs.h else case " $LIBOBJS " in *" strlcpy.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS strlcpy.$ac_objext" ;; esac fi ac_fn_c_check_func "$LINENO" "strptime" "ac_cv_func_strptime" if test "x$ac_cv_func_strptime" = xyes; then : $as_echo "#define HAVE_STRPTIME 1" >>confdefs.h else case " $LIBOBJS " in *" strptime.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS strptime.$ac_objext" ;; esac fi ac_fn_c_check_func "$LINENO" "b64_pton" "ac_cv_func_b64_pton" if test "x$ac_cv_func_b64_pton" = xyes; then : $as_echo "#define HAVE_B64_PTON 1" >>confdefs.h else case " $LIBOBJS " in *" b64_pton.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS b64_pton.$ac_objext" ;; esac fi ac_fn_c_check_func "$LINENO" "b64_ntop" "ac_cv_func_b64_ntop" if test "x$ac_cv_func_b64_ntop" = xyes; then : $as_echo "#define HAVE_B64_NTOP 1" >>confdefs.h else case " $LIBOBJS " in *" b64_ntop.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS b64_ntop.$ac_objext" ;; esac fi ac_fn_c_check_func "$LINENO" "pselect" "ac_cv_func_pselect" if test "x$ac_cv_func_pselect" = xyes; then : $as_echo "#define HAVE_PSELECT 1" >>confdefs.h else case " $LIBOBJS " in *" pselect.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS pselect.$ac_objext" ;; esac fi ac_fn_c_check_func "$LINENO" "memmove" "ac_cv_func_memmove" if test "x$ac_cv_func_memmove" = xyes; then : $as_echo "#define HAVE_MEMMOVE 1" >>confdefs.h else case " $LIBOBJS " in *" memmove.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS memmove.$ac_objext" ;; esac fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for pselect prototype in sys/select.h" >&5 $as_echo_n "checking for pselect prototype in sys/select.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "[^a-zA-Z_]*pselect[^a-zA-Z_]" >/dev/null 2>&1; then : $as_echo "#define HAVE_PSELECT_PROTO 1" >>confdefs.h { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi rm -f conftest* { $as_echo "$as_me:${as_lineno-$LINENO}: checking for ctime_r prototype in time.h" >&5 $as_echo_n "checking for ctime_r prototype in time.h... " >&6; } cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "[^a-zA-Z_]*ctime_r[^a-zA-Z_]" >/dev/null 2>&1; then : $as_echo "#define HAVE_CTIME_R_PROTO 1" >>confdefs.h { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } fi rm -f conftest* ac_fn_c_check_type "$LINENO" "struct timespec" "ac_cv_type_struct_timespec" " $ac_includes_default #ifdef HAVE_SIGNAL_H #include #endif #ifdef HAVE_TIME_H #include #endif " if test "x$ac_cv_type_struct_timespec" = xyes; then : $as_echo "#define HAVE_STRUCT_TIMESPEC 1" >>confdefs.h fi cat >>confdefs.h <<_ACEOF #define IDENTITY "unidentified server" _ACEOF cat >>confdefs.h <<_ACEOF #define VERSION PACKAGE_STRING _ACEOF cat >>confdefs.h <<_ACEOF #define TCP_BACKLOG 5 _ACEOF cat >>confdefs.h <<_ACEOF #define TCP_PORT "53" _ACEOF cat >>confdefs.h <<_ACEOF #define TCP_MAX_MESSAGE_LEN 65535 _ACEOF cat >>confdefs.h <<_ACEOF #define UDP_PORT "53" _ACEOF cat >>confdefs.h <<_ACEOF #define UDP_MAX_MESSAGE_LEN 512 _ACEOF cat >>confdefs.h <<_ACEOF #define EDNS_MAX_MESSAGE_LEN 4096 _ACEOF cat >>confdefs.h <<_ACEOF #define MAXSYSLOGMSGLEN 512 _ACEOF facility=LOG_DAEMON # Check whether --with-facility was given. if test "${with_facility+set}" = set; then : withval=$with_facility; facility=$withval fi cat >>confdefs.h <<_ACEOF #define FACILITY $facility _ACEOF max_ips=8 # Check whether --with-max_ips was given. if test "${with_max_ips+set}" = set; then : withval=$with_max_ips; max_ips=$withval fi cat >>confdefs.h <<_ACEOF #define MAX_INTERFACES $max_ips _ACEOF tcp_timeout=120 # Check whether --with-tcp_timeout was given. if test "${with_tcp_timeout+set}" = set; then : withval=$with_tcp_timeout; tcp_timeout=$withval fi cat >>confdefs.h <<_ACEOF #define TCP_TIMEOUT $tcp_timeout _ACEOF # Check whether --enable-root-server was given. if test "${enable_root_server+set}" = set; then : enableval=$enable_root_server; fi case "$enable_root_server" in yes) cat >>confdefs.h <<_ACEOF #define ROOT_SERVER /**/ _ACEOF ;; no|*) ;; esac # Check whether --enable-ipv6 was given. if test "${enable_ipv6+set}" = set; then : enableval=$enable_ipv6; fi case "$enable_ipv6" in no) ;; yes|*) cat >>confdefs.h <<_ACEOF #define INET6 /**/ _ACEOF ;; esac # Check whether --enable-bind8-stats was given. if test "${enable_bind8_stats+set}" = set; then : enableval=$enable_bind8_stats; fi case "$enable_bind8_stats" in yes|'') cat >>confdefs.h <<_ACEOF #define BIND8_STATS /**/ _ACEOF ;; no|*) ;; esac # Check whether --enable-checking was given. if test "${enable_checking+set}" = set; then : enableval=$enable_checking; fi case "$enable_checking" in yes) { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -W" >&5 $as_echo_n "checking whether $CC supports -W... " >&6; } cache=`echo W | sed 'y%.=/+-%___p_%'` if eval \${cv_prog_cc_flag_$cache+:} false; then : $as_echo_n "(cached) " >&6 else echo 'void f(){}' >conftest.c if test -z "`$CC -W -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_$cache=yes" else eval "cv_prog_cc_flag_$cache=no" fi rm -f conftest* fi if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } : CFLAGS="$CFLAGS -W" else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } : fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wall" >&5 $as_echo_n "checking whether $CC supports -Wall... " >&6; } cache=`echo Wall | sed 'y%.=/+-%___p_%'` if eval \${cv_prog_cc_flag_$cache+:} false; then : $as_echo_n "(cached) " >&6 else echo 'void f(){}' >conftest.c if test -z "`$CC -Wall -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_$cache=yes" else eval "cv_prog_cc_flag_$cache=no" fi rm -f conftest* fi if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } : CFLAGS="$CFLAGS -Wall" else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } : fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wextra" >&5 $as_echo_n "checking whether $CC supports -Wextra... " >&6; } cache=`echo Wextra | sed 'y%.=/+-%___p_%'` if eval \${cv_prog_cc_flag_$cache+:} false; then : $as_echo_n "(cached) " >&6 else echo 'void f(){}' >conftest.c if test -z "`$CC -Wextra -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_$cache=yes" else eval "cv_prog_cc_flag_$cache=no" fi rm -f conftest* fi if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } : CFLAGS="$CFLAGS -Wextra" else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } : fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking whether $CC supports -Wdeclaration-after-statement" >&5 $as_echo_n "checking whether $CC supports -Wdeclaration-after-statement... " >&6; } cache=`echo Wdeclaration-after-statement | sed 'y%.=/+-%___p_%'` if eval \${cv_prog_cc_flag_$cache+:} false; then : $as_echo_n "(cached) " >&6 else echo 'void f(){}' >conftest.c if test -z "`$CC -Wdeclaration-after-statement -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_$cache=yes" else eval "cv_prog_cc_flag_$cache=no" fi rm -f conftest* fi if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5 $as_echo "yes" >&6; } : CFLAGS="$CFLAGS -Wdeclaration-after-statement" else { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5 $as_echo "no" >&6; } : fi ;; no|*) $as_echo "#define NDEBUG /**/" >>confdefs.h ;; esac # Check whether --enable-ratelimit was given. if test "${enable_ratelimit+set}" = set; then : enableval=$enable_ratelimit; fi case "$enable_ratelimit" in yes) cat >>confdefs.h <<_ACEOF #define RATELIMIT /**/ _ACEOF ratelimit="xx" ;; no|*) ratelimit="" ;; esac # we need SSL for TSIG (and maybe also for NSEC3). # Check whether --with-ssl was given. if test "${with_ssl+set}" = set; then : withval=$with_ssl; else withval="yes" fi if test x_$withval != x_no; then { $as_echo "$as_me:${as_lineno-$LINENO}: checking for SSL" >&5 $as_echo_n "checking for SSL... " >&6; } if test x_$withval = x_ -o x_$withval = x_yes; then withval="/usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/sfw /usr/local /usr" fi for dir in $withval; do ssldir="$dir" if test -f "$dir/include/openssl/ssl.h"; then found_ssl="yes"; cat >>confdefs.h <<_ACEOF #define HAVE_SSL /**/ _ACEOF if test x_$ssldir != x_/usr; then CPPFLAGS="$CPPFLAGS -I$ssldir/include"; fi break; fi done if test x_$found_ssl != x_yes; then as_fn_error $? "Cannot find the SSL libraries in $withval" "$LINENO" 5 else { $as_echo "$as_me:${as_lineno-$LINENO}: result: found in $ssldir" >&5 $as_echo "found in $ssldir" >&6; } HAVE_SSL=yes if test x_$ssldir != x_/usr; then LDFLAGS="$LDFLAGS -L$ssldir/lib"; fi if test x_$ssldir = x_/usr/sfw; then LDFLAGS="$LDFLAGS -R$ssldir/lib"; fi { $as_echo "$as_me:${as_lineno-$LINENO}: checking for HMAC_CTX_init in -lcrypto" >&5 $as_echo_n "checking for HMAC_CTX_init in -lcrypto... " >&6; } if ${ac_cv_lib_crypto_HMAC_CTX_init+:} false; then : $as_echo_n "(cached) " >&6 else ac_check_lib_save_LIBS=$LIBS LIBS="-lcrypto $LIBS" cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ /* Override any GCC internal prototype to avoid an error. Use char because int might match the return type of a GCC builtin and then its argument prototype would still apply. */ #ifdef __cplusplus extern "C" #endif char HMAC_CTX_init (); int main () { return HMAC_CTX_init (); ; return 0; } _ACEOF if ac_fn_c_try_link "$LINENO"; then : ac_cv_lib_crypto_HMAC_CTX_init=yes else ac_cv_lib_crypto_HMAC_CTX_init=no fi rm -f core conftest.err conftest.$ac_objext \ conftest$ac_exeext conftest.$ac_ext LIBS=$ac_check_lib_save_LIBS fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_crypto_HMAC_CTX_init" >&5 $as_echo "$ac_cv_lib_crypto_HMAC_CTX_init" >&6; } if test "x$ac_cv_lib_crypto_HMAC_CTX_init" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_LIBCRYPTO 1 _ACEOF LIBS="-lcrypto $LIBS" else as_fn_error $? "OpenSSL found in $ssldir, but version 0.9.7 or higher is required" "$LINENO" 5 fi for ac_func in EVP_sha1 EVP_sha256 do : as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var" if eval test \"x\$"$as_ac_var"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1 _ACEOF fi done fi fi # Check whether --enable-nsec3 was given. if test "${enable_nsec3+set}" = set; then : enableval=$enable_nsec3; fi case "$enable_nsec3" in no) ;; yes|*) cat >>confdefs.h <<_ACEOF #define NSEC3 /**/ _ACEOF ;; esac # Check whether --enable-full-prehash was given. if test "${enable_full_prehash+set}" = set; then : enableval=$enable_full_prehash; fi case "$enable_full_prehash" in no) ;; yes|*) cat >>confdefs.h <<_ACEOF #define FULL_PREHASH /**/ _ACEOF ;; esac # Check whether --enable-minimal-responses was given. if test "${enable_minimal_responses+set}" = set; then : enableval=$enable_minimal_responses; fi case "$enable_minimal_responses" in no) ;; yes|*) cat >>confdefs.h <<_ACEOF #define MINIMAL_RESPONSES /**/ _ACEOF ;; esac # Check whether --enable-draft-rrtypes was given. if test "${enable_draft_rrtypes+set}" = set; then : enableval=$enable_draft_rrtypes; fi case "$enable_draft_rrtypes" in yes) cat >>confdefs.h <<_ACEOF #define DRAFT_RRTYPES /**/ _ACEOF ;; no|*) ;; esac # Check whether --enable-mmap was given. if test "${enable_mmap+set}" = set; then : enableval=$enable_mmap; fi case "$enable_mmap" in yes) for ac_header in sys/mman.h do : ac_fn_c_check_header_mongrel "$LINENO" "sys/mman.h" "ac_cv_header_sys_mman_h" "$ac_includes_default" if test "x$ac_cv_header_sys_mman_h" = xyes; then : cat >>confdefs.h <<_ACEOF #define HAVE_SYS_MMAN_H 1 _ACEOF fi done { $as_echo "$as_me:${as_lineno-$LINENO}: checking for uintptr_t" >&5 $as_echo_n "checking for uintptr_t... " >&6; } if ${ac_cv_type_uintptr_t+:} false; then : $as_echo_n "(cached) " >&6 else cat confdefs.h - <<_ACEOF >conftest.$ac_ext /* end confdefs.h. */ #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_SIGNAL_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif _ACEOF if (eval "$ac_cpp conftest.$ac_ext") 2>&5 | $EGREP "(^|[^a-zA-Z_0-9])uintptr_t[^a-zA-Z_0-9]" >/dev/null 2>&1; then : ac_cv_type_uintptr_t=yes else ac_cv_type_uintptr_t=no fi rm -f conftest* fi { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_type_uintptr_t" >&5 $as_echo "$ac_cv_type_uintptr_t" >&6; } if test $ac_cv_type_uintptr_t = no; then $as_echo "#define uintptr_t void*" >>confdefs.h fi for ac_func in mmap munmap do : as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh` ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var" if eval test \"x\$"$as_ac_var"\" = x"yes"; then : cat >>confdefs.h <<_ACEOF #define `$as_echo "HAVE_$ac_func" | $as_tr_cpp` 1 _ACEOF fi done cat >>confdefs.h <<_ACEOF #define USE_MMAP_ALLOC /**/ _ACEOF ;; no|*) ;; esac # # Default zonestatsfile # zonestatsfile=${localstatedir}/log/nsd.stats cat >>confdefs.h <<_ACEOF #define ZONESTATSFILE "`eval echo $zonestatsfile`" _ACEOF # Check whether --enable-zone_stats was given. if test "${enable_zone_stats+set}" = set; then : enableval=$enable_zone_stats; fi case "$enable_zone_stats" in yes) cat >>confdefs.h <<_ACEOF #define USE_ZONE_STATS /**/ _ACEOF ;; no|*) ;; esac if test $ac_cv_func_getaddrinfo = no; then case " $LIBOBJS " in *" fake-rfc2553.$ac_objext "* ) ;; *) LIBOBJS="$LIBOBJS fake-rfc2553.$ac_objext" ;; esac fi # big fat warning if test "$enable_checking" = "yes"; then echo "*************************************************" echo "* You have activated \"--enable-checking\" *" echo "* *" echo "* This will instruct NSD to be stricter *" echo "* when validating its input. This could lead *" echo "* to a reduced service level. *" echo "* *" echo "*************************************************" fi if test "$enable_zone_stats" = "yes"; then echo "*************************************************" echo "* You have activated \"--enable-zone-stats\" *" echo "* *" echo "* This will make NSD maintain statistics *" echo "* on a per zone basis. This could lead to *" echo "* a reduced service level and an *" echo "* a larger memory footprint. *" echo "* *" echo "*************************************************" fi ac_config_files="$ac_config_files Makefile" cat >confcache <<\_ACEOF # This file is a shell script that caches the results of configure # tests run on this system so they can be shared between configure # scripts and configure runs, see configure's option --config-cache. # It is not useful on other systems. If it contains results you don't # want to keep, you may remove or edit it. # # config.status only pays attention to the cache file if you give it # the --recheck option to rerun configure. # # `ac_cv_env_foo' variables (set or unset) will be overridden when # loading this file, other *unset* `ac_cv_foo' will be assigned the # following values. _ACEOF # The following way of writing the cache mishandles newlines in values, # but we know of no workaround that is simple, portable, and efficient. # So, we kill variables containing newlines. # Ultrix sh set writes to stderr and can't be redirected directly, # and sets the high bit in the cache file unless we assign to the vars. ( for ac_var in `(set) 2>&1 | sed -n 's/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'`; do eval ac_val=\$$ac_var case $ac_val in #( *${as_nl}*) case $ac_var in #( *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; esac case $ac_var in #( _ | IFS | as_nl) ;; #( BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( *) { eval $ac_var=; unset $ac_var;} ;; esac ;; esac done (set) 2>&1 | case $as_nl`(ac_space=' '; set) 2>&1` in #( *${as_nl}ac_space=\ *) # `set' does not quote correctly, so add quotes: double-quote # substitution turns \\\\ into \\, and sed turns \\ into \. sed -n \ "s/'/'\\\\''/g; s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p" ;; #( *) # `set' quotes correctly as required by POSIX, so do not add quotes. sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p" ;; esac | sort ) | sed ' /^ac_cv_env_/b end t clear :clear s/^\([^=]*\)=\(.*[{}].*\)$/test "${\1+set}" = set || &/ t end s/^\([^=]*\)=\(.*\)$/\1=${\1=\2}/ :end' >>confcache if diff "$cache_file" confcache >/dev/null 2>&1; then :; else if test -w "$cache_file"; then if test "x$cache_file" != "x/dev/null"; then { $as_echo "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5 $as_echo "$as_me: updating cache $cache_file" >&6;} if test ! -f "$cache_file" || test -h "$cache_file"; then cat confcache >"$cache_file" else case $cache_file in #( */* | ?:*) mv -f confcache "$cache_file"$$ && mv -f "$cache_file"$$ "$cache_file" ;; #( *) mv -f confcache "$cache_file" ;; esac fi fi else { $as_echo "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5 $as_echo "$as_me: not updating unwritable cache $cache_file" >&6;} fi fi rm -f confcache test "x$prefix" = xNONE && prefix=$ac_default_prefix # Let make expand exec_prefix. test "x$exec_prefix" = xNONE && exec_prefix='${prefix}' DEFS=-DHAVE_CONFIG_H ac_libobjs= ac_ltlibobjs= U= for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue # 1. Remove the extension, and $U if already installed. ac_script='s/\$U\././;s/\.o$//;s/\.obj$//' ac_i=`$as_echo "$ac_i" | sed "$ac_script"` # 2. Prepend LIBOBJDIR. When used with automake>=1.10 LIBOBJDIR # will be set to the directory where LIBOBJS objects are built. as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext" as_fn_append ac_ltlibobjs " \${LIBOBJDIR}$ac_i"'$U.lo' done LIBOBJS=$ac_libobjs LTLIBOBJS=$ac_ltlibobjs : "${CONFIG_STATUS=./config.status}" ac_write_fail=0 ac_clean_files_save=$ac_clean_files ac_clean_files="$ac_clean_files $CONFIG_STATUS" { $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5 $as_echo "$as_me: creating $CONFIG_STATUS" >&6;} as_write_fail=0 cat >$CONFIG_STATUS <<_ASEOF || as_write_fail=1 #! $SHELL # Generated by $as_me. # Run this file to recreate the current configuration. # Compiler output produced by configure, useful for debugging # configure, is in config.log if it exists. debug=false ac_cs_recheck=false ac_cs_silent=false SHELL=\${CONFIG_SHELL-$SHELL} export SHELL _ASEOF cat >>$CONFIG_STATUS <<\_ASEOF || as_write_fail=1 ## -------------------- ## ## M4sh Initialization. ## ## -------------------- ## # Be more Bourne compatible DUALCASE=1; export DUALCASE # for MKS sh if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in #( *posix*) : set -o posix ;; #( *) : ;; esac fi as_nl=' ' export as_nl # Printing a long string crashes Solaris 7 /usr/bin/printf. as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo # Prefer a ksh shell builtin over an external printf program on Solaris, # but without wasting forks for bash or zsh. if test -z "$BASH_VERSION$ZSH_VERSION" \ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='print -r --' as_echo_n='print -rn --' elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='printf %s\n' as_echo_n='printf %s' else if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' as_echo_n='/usr/ucb/echo -n' else as_echo_body='eval expr "X$1" : "X\\(.*\\)"' as_echo_n_body='eval arg=$1; case $arg in #( *"$as_nl"*) expr "X$arg" : "X\\(.*\\)$as_nl"; arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; esac; expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ' export as_echo_n_body as_echo_n='sh -c $as_echo_n_body as_echo' fi export as_echo_body as_echo='sh -c $as_echo_body as_echo' fi # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi # IFS # We need space, tab and new line, in precisely that order. Quoting is # there to prevent editors from complaining about space-tab. # (If _AS_PATH_WALK were called with IFS unset, it would disable word # splitting by setting IFS to empty value.) IFS=" "" $as_nl" # Find who we are. Look in the path if we contain no directory separator. as_myself= case $0 in #(( *[\\/]* ) as_myself=$0 ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break done IFS=$as_save_IFS ;; esac # We did not find ourselves, most probably we were run as `sh COMMAND' # in which case we are not to be found in the path. if test "x$as_myself" = x; then as_myself=$0 fi if test ! -f "$as_myself"; then $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 exit 1 fi # Unset variables that we do not need and which cause bugs (e.g. in # pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1" # suppresses any "Segmentation fault" message there. '((' could # trigger a bug in pdksh 5.2.14. for as_var in BASH_ENV ENV MAIL MAILPATH do eval test x\${$as_var+set} = xset \ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : done PS1='$ ' PS2='> ' PS4='+ ' # NLS nuisances. LC_ALL=C export LC_ALL LANGUAGE=C export LANGUAGE # CDPATH. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH # as_fn_error STATUS ERROR [LINENO LOG_FD] # ---------------------------------------- # Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are # provided, also output the error to LOG_FD, referencing LINENO. Then exit the # script with STATUS, using 1 if that was 0. as_fn_error () { as_status=$1; test $as_status -eq 0 && as_status=1 if test "$4"; then as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 fi $as_echo "$as_me: error: $2" >&2 as_fn_exit $as_status } # as_fn_error # as_fn_set_status STATUS # ----------------------- # Set $? to STATUS, without forking. as_fn_set_status () { return $1 } # as_fn_set_status # as_fn_exit STATUS # ----------------- # Exit the shell with STATUS, even in a "trap 0" or "set -e" context. as_fn_exit () { set +e as_fn_set_status $1 exit $1 } # as_fn_exit # as_fn_unset VAR # --------------- # Portably unset VAR. as_fn_unset () { { eval $1=; unset $1;} } as_unset=as_fn_unset # as_fn_append VAR VALUE # ---------------------- # Append the text in VALUE to the end of the definition contained in VAR. Take # advantage of any shell optimizations that allow amortized linear growth over # repeated appends, instead of the typical quadratic growth present in naive # implementations. if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then : eval 'as_fn_append () { eval $1+=\$2 }' else as_fn_append () { eval $1=\$$1\$2 } fi # as_fn_append # as_fn_arith ARG... # ------------------ # Perform arithmetic evaluation on the ARGs, and store the result in the # global $as_val. Take advantage of shells that can avoid forks. The arguments # must be portable across $(()) and expr. if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then : eval 'as_fn_arith () { as_val=$(( $* )) }' else as_fn_arith () { as_val=`expr "$@" || test $? -eq 1` } fi # as_fn_arith if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then as_basename=basename else as_basename=false fi if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then as_dirname=dirname else as_dirname=false fi as_me=`$as_basename -- "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)' \| . 2>/dev/null || $as_echo X/"$0" | sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/ q } /^X\/\(\/\/\)$/{ s//\1/ q } /^X\/\(\/\).*/{ s//\1/ q } s/.*/./; q'` # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' as_cr_Letters=$as_cr_letters$as_cr_LETTERS as_cr_digits='0123456789' as_cr_alnum=$as_cr_Letters$as_cr_digits ECHO_C= ECHO_N= ECHO_T= case `echo -n x` in #((((( -n*) case `echo 'xy\c'` in *c*) ECHO_T=' ';; # ECHO_T is single tab character. xy) ECHO_C='\c';; *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ECHO_T=' ';; esac;; *) ECHO_N='-n';; esac rm -f conf$$ conf$$.exe conf$$.file if test -d conf$$.dir; then rm -f conf$$.dir/conf$$.file else rm -f conf$$.dir mkdir conf$$.dir 2>/dev/null fi if (echo >conf$$.file) 2>/dev/null; then if ln -s conf$$.file conf$$ 2>/dev/null; then as_ln_s='ln -s' # ... but there are two gotchas: # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. # In both cases, we have to default to `cp -p'. ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || as_ln_s='cp -p' elif ln conf$$.file conf$$ 2>/dev/null; then as_ln_s=ln else as_ln_s='cp -p' fi else as_ln_s='cp -p' fi rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file rmdir conf$$.dir 2>/dev/null # as_fn_mkdir_p # ------------- # Create "$as_dir" as a directory, including parents if necessary. as_fn_mkdir_p () { case $as_dir in #( -*) as_dir=./$as_dir;; esac test -d "$as_dir" || eval $as_mkdir_p || { as_dirs= while :; do case $as_dir in #( *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( *) as_qdir=$as_dir;; esac as_dirs="'$as_qdir' $as_dirs" as_dir=`$as_dirname -- "$as_dir" || $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_dir" : 'X\(//\)[^/]' \| \ X"$as_dir" : 'X\(//\)$' \| \ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_dir" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` test -d "$as_dir" && break done test -z "$as_dirs" || eval "mkdir $as_dirs" } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" } # as_fn_mkdir_p if mkdir -p . 2>/dev/null; then as_mkdir_p='mkdir -p "$as_dir"' else test -d ./-p && rmdir ./-p as_mkdir_p=false fi if test -x / >/dev/null 2>&1; then as_test_x='test -x' else if ls -dL / >/dev/null 2>&1; then as_ls_L_option=L else as_ls_L_option= fi as_test_x=' eval sh -c '\'' if test -d "$1"; then test -d "$1/."; else case $1 in #( -*)set "./$1";; esac; case `ls -ld'$as_ls_L_option' "$1" 2>/dev/null` in #(( ???[sx]*):;;*)false;;esac;fi '\'' sh ' fi as_executable_p=$as_test_x # Sed expression to map a string onto a valid CPP name. as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" exec 6>&1 ## ----------------------------------- ## ## Main body of $CONFIG_STATUS script. ## ## ----------------------------------- ## _ASEOF test $as_write_fail = 0 && chmod +x $CONFIG_STATUS || ac_write_fail=1 cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # Save the log message, to keep $0 and so on meaningful, and to # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" This file was extended by NSD $as_me 3.2.16, which was generated by GNU Autoconf 2.68. Invocation command line was CONFIG_FILES = $CONFIG_FILES CONFIG_HEADERS = $CONFIG_HEADERS CONFIG_LINKS = $CONFIG_LINKS CONFIG_COMMANDS = $CONFIG_COMMANDS $ $0 $@ on `(hostname || uname -n) 2>/dev/null | sed 1q` " _ACEOF case $ac_config_files in *" "*) set x $ac_config_files; shift; ac_config_files=$*;; esac case $ac_config_headers in *" "*) set x $ac_config_headers; shift; ac_config_headers=$*;; esac cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 # Files that config.status was made for. config_files="$ac_config_files" config_headers="$ac_config_headers" _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ac_cs_usage="\ \`$as_me' instantiates files and other configuration actions from templates according to the current configuration. Unless the files and actions are specified as TAGs, all are instantiated by default. Usage: $0 [OPTION]... [TAG]... -h, --help print this help, then exit -V, --version print version number and configuration settings, then exit --config print configuration, then exit -q, --quiet, --silent do not print progress messages -d, --debug don't remove temporary files --recheck update $as_me by reconfiguring in the same conditions --file=FILE[:TEMPLATE] instantiate the configuration file FILE --header=FILE[:TEMPLATE] instantiate the configuration header FILE Configuration files: $config_files Configuration headers: $config_headers Report bugs to ." _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ NSD config.status 3.2.16 configured by $0, generated by GNU Autoconf 2.68, with options \\"\$ac_cs_config\\" Copyright (C) 2010 Free Software Foundation, Inc. This config.status script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it." ac_pwd='$ac_pwd' srcdir='$srcdir' INSTALL='$INSTALL' AWK='$AWK' test -n "\$AWK" || AWK=awk _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # The default lists apply if the user does not specify any file. ac_need_defaults=: while test $# != 0 do case $1 in --*=?*) ac_option=`expr "X$1" : 'X\([^=]*\)='` ac_optarg=`expr "X$1" : 'X[^=]*=\(.*\)'` ac_shift=: ;; --*=) ac_option=`expr "X$1" : 'X\([^=]*\)='` ac_optarg= ac_shift=: ;; *) ac_option=$1 ac_optarg=$2 ac_shift=shift ;; esac case $ac_option in # Handling of the options. -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) ac_cs_recheck=: ;; --version | --versio | --versi | --vers | --ver | --ve | --v | -V ) $as_echo "$ac_cs_version"; exit ;; --config | --confi | --conf | --con | --co | --c ) $as_echo "$ac_cs_config"; exit ;; --debug | --debu | --deb | --de | --d | -d ) debug=: ;; --file | --fil | --fi | --f ) $ac_shift case $ac_optarg in *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;; '') as_fn_error $? "missing file argument" ;; esac as_fn_append CONFIG_FILES " '$ac_optarg'" ac_need_defaults=false;; --header | --heade | --head | --hea ) $ac_shift case $ac_optarg in *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;; esac as_fn_append CONFIG_HEADERS " '$ac_optarg'" ac_need_defaults=false;; --he | --h) # Conflict between --help and --header as_fn_error $? "ambiguous option: \`$1' Try \`$0 --help' for more information.";; --help | --hel | -h ) $as_echo "$ac_cs_usage"; exit ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil | --si | --s) ac_cs_silent=: ;; # This is an error. -*) as_fn_error $? "unrecognized option: \`$1' Try \`$0 --help' for more information." ;; *) as_fn_append ac_config_targets " $1" ac_need_defaults=false ;; esac shift done ac_configure_extra_args= if $ac_cs_silent; then exec 6>/dev/null ac_configure_extra_args="$ac_configure_extra_args --silent" fi _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 if \$ac_cs_recheck; then set X '$SHELL' '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion shift \$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6 CONFIG_SHELL='$SHELL' export CONFIG_SHELL exec "\$@" fi _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 exec 5>>config.log { echo sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX ## Running $as_me. ## _ASBOX $as_echo "$ac_log" } >&5 _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # Handling of arguments. for ac_config_target in $ac_config_targets do case $ac_config_target in "config.h") CONFIG_HEADERS="$CONFIG_HEADERS config.h" ;; "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;; *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; esac done # If the user did not use the arguments to specify the items to instantiate, # then the envvar interface is used. Set only those that are not. # We use the long form for the default assignment because of an extremely # bizarre bug on SunOS 4.1.3. if $ac_need_defaults; then test "${CONFIG_FILES+set}" = set || CONFIG_FILES=$config_files test "${CONFIG_HEADERS+set}" = set || CONFIG_HEADERS=$config_headers fi # Have a temporary directory for convenience. Make it in the build tree # simply because there is no reason against having it here, and in addition, # creating and moving files from /tmp can sometimes cause problems. # Hook for its removal unless debugging. # Note that there is a small window in which the directory will not be cleaned: # after its creation but before its name has been assigned to `$tmp'. $debug || { tmp= ac_tmp= trap 'exit_status=$? : "${ac_tmp:=$tmp}" { test ! -d "$ac_tmp" || rm -fr "$ac_tmp"; } && exit $exit_status ' 0 trap 'as_fn_exit 1' 1 2 13 15 } # Create a (secure) tmp directory for tmp files. { tmp=`(umask 077 && mktemp -d "./confXXXXXX") 2>/dev/null` && test -d "$tmp" } || { tmp=./conf$$-$RANDOM (umask 077 && mkdir "$tmp") } || as_fn_error $? "cannot create a temporary directory in ." "$LINENO" 5 ac_tmp=$tmp # Set up the scripts for CONFIG_FILES section. # No need to generate them if there are no CONFIG_FILES. # This happens for instance with `./config.status config.h'. if test -n "$CONFIG_FILES"; then ac_cr=`echo X | tr X '\015'` # On cygwin, bash can eat \r inside `` if the user requested igncr. # But we know of no other shell where ac_cr would be empty at this # point, so we can use a bashism as a fallback. if test "x$ac_cr" = x; then eval ac_cr=\$\'\\r\' fi ac_cs_awk_cr=`$AWK 'BEGIN { print "a\rb" }' /dev/null` if test "$ac_cs_awk_cr" = "a${ac_cr}b"; then ac_cs_awk_cr='\\r' else ac_cs_awk_cr=$ac_cr fi echo 'BEGIN {' >"$ac_tmp/subs1.awk" && _ACEOF { echo "cat >conf$$subs.awk <<_ACEOF" && echo "$ac_subst_vars" | sed 's/.*/&!$&$ac_delim/' && echo "_ACEOF" } >conf$$subs.sh || as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 ac_delim_num=`echo "$ac_subst_vars" | grep -c '^'` ac_delim='%!_!# ' for ac_last_try in false false false false false :; do . ./conf$$subs.sh || as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 ac_delim_n=`sed -n "s/.*$ac_delim\$/X/p" conf$$subs.awk | grep -c X` if test $ac_delim_n = $ac_delim_num; then break elif $ac_last_try; then as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 else ac_delim="$ac_delim!$ac_delim _$ac_delim!! " fi done rm -f conf$$subs.sh cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 cat >>"\$ac_tmp/subs1.awk" <<\\_ACAWK && _ACEOF sed -n ' h s/^/S["/; s/!.*/"]=/ p g s/^[^!]*!// :repl t repl s/'"$ac_delim"'$// t delim :nl h s/\(.\{148\}\)..*/\1/ t more1 s/["\\]/\\&/g; s/^/"/; s/$/\\n"\\/ p n b repl :more1 s/["\\]/\\&/g; s/^/"/; s/$/"\\/ p g s/.\{148\}// t nl :delim h s/\(.\{148\}\)..*/\1/ t more2 s/["\\]/\\&/g; s/^/"/; s/$/"/ p b :more2 s/["\\]/\\&/g; s/^/"/; s/$/"\\/ p g s/.\{148\}// t delim ' >$CONFIG_STATUS || ac_write_fail=1 rm -f conf$$subs.awk cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 _ACAWK cat >>"\$ac_tmp/subs1.awk" <<_ACAWK && for (key in S) S_is_set[key] = 1 FS = "" } { line = $ 0 nfields = split(line, field, "@") substed = 0 len = length(field[1]) for (i = 2; i < nfields; i++) { key = field[i] keylen = length(key) if (S_is_set[key]) { value = S[key] line = substr(line, 1, len) "" value "" substr(line, len + keylen + 3) len += length(value) + length(field[++i]) substed = 1 } else len += 1 + keylen } print line } _ACAWK _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 if sed "s/$ac_cr//" < /dev/null > /dev/null 2>&1; then sed "s/$ac_cr\$//; s/$ac_cr/$ac_cs_awk_cr/g" else cat fi < "$ac_tmp/subs1.awk" > "$ac_tmp/subs.awk" \ || as_fn_error $? "could not setup config files machinery" "$LINENO" 5 _ACEOF # VPATH may cause trouble with some makes, so we remove sole $(srcdir), # ${srcdir} and @srcdir@ entries from VPATH if srcdir is ".", strip leading and # trailing colons and then remove the whole line if VPATH becomes empty # (actually we leave an empty line to preserve line numbers). if test "x$srcdir" = x.; then ac_vpsub='/^[ ]*VPATH[ ]*=[ ]*/{ h s/// s/^/:/ s/[ ]*$/:/ s/:\$(srcdir):/:/g s/:\${srcdir}:/:/g s/:@srcdir@:/:/g s/^:*// s/:*$// x s/\(=[ ]*\).*/\1/ G s/\n// s/^[^=]*=[ ]*$// }' fi cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 fi # test -n "$CONFIG_FILES" # Set up the scripts for CONFIG_HEADERS section. # No need to generate them if there are no CONFIG_HEADERS. # This happens for instance with `./config.status Makefile'. if test -n "$CONFIG_HEADERS"; then cat >"$ac_tmp/defines.awk" <<\_ACAWK || BEGIN { _ACEOF # Transform confdefs.h into an awk script `defines.awk', embedded as # here-document in config.status, that substitutes the proper values into # config.h.in to produce config.h. # Create a delimiter string that does not exist in confdefs.h, to ease # handling of long lines. ac_delim='%!_!# ' for ac_last_try in false false :; do ac_tt=`sed -n "/$ac_delim/p" confdefs.h` if test -z "$ac_tt"; then break elif $ac_last_try; then as_fn_error $? "could not make $CONFIG_HEADERS" "$LINENO" 5 else ac_delim="$ac_delim!$ac_delim _$ac_delim!! " fi done # For the awk script, D is an array of macro values keyed by name, # likewise P contains macro parameters if any. Preserve backslash # newline sequences. ac_word_re=[_$as_cr_Letters][_$as_cr_alnum]* sed -n ' s/.\{148\}/&'"$ac_delim"'/g t rset :rset s/^[ ]*#[ ]*define[ ][ ]*/ / t def d :def s/\\$// t bsnl s/["\\]/\\&/g s/^ \('"$ac_word_re"'\)\(([^()]*)\)[ ]*\(.*\)/P["\1"]="\2"\ D["\1"]=" \3"/p s/^ \('"$ac_word_re"'\)[ ]*\(.*\)/D["\1"]=" \2"/p d :bsnl s/["\\]/\\&/g s/^ \('"$ac_word_re"'\)\(([^()]*)\)[ ]*\(.*\)/P["\1"]="\2"\ D["\1"]=" \3\\\\\\n"\\/p t cont s/^ \('"$ac_word_re"'\)[ ]*\(.*\)/D["\1"]=" \2\\\\\\n"\\/p t cont d :cont n s/.\{148\}/&'"$ac_delim"'/g t clear :clear s/\\$// t bsnlc s/["\\]/\\&/g; s/^/"/; s/$/"/p d :bsnlc s/["\\]/\\&/g; s/^/"/; s/$/\\\\\\n"\\/p b cont ' >$CONFIG_STATUS || ac_write_fail=1 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 for (key in D) D_is_set[key] = 1 FS = "" } /^[\t ]*#[\t ]*(define|undef)[\t ]+$ac_word_re([\t (]|\$)/ { line = \$ 0 split(line, arg, " ") if (arg[1] == "#") { defundef = arg[2] mac1 = arg[3] } else { defundef = substr(arg[1], 2) mac1 = arg[2] } split(mac1, mac2, "(") #) macro = mac2[1] prefix = substr(line, 1, index(line, defundef) - 1) if (D_is_set[macro]) { # Preserve the white space surrounding the "#". print prefix "define", macro P[macro] D[macro] next } else { # Replace #undef with comments. This is necessary, for example, # in the case of _POSIX_SOURCE, which is predefined and required # on some systems where configure will not decide to define it. if (defundef == "undef") { print "/*", prefix defundef, macro, "*/" next } } } { print } _ACAWK _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 as_fn_error $? "could not setup config headers machinery" "$LINENO" 5 fi # test -n "$CONFIG_HEADERS" eval set X " :F $CONFIG_FILES :H $CONFIG_HEADERS " shift for ac_tag do case $ac_tag in :[FHLC]) ac_mode=$ac_tag; continue;; esac case $ac_mode$ac_tag in :[FHL]*:*);; :L* | :C*:*) as_fn_error $? "invalid tag \`$ac_tag'" "$LINENO" 5;; :[FH]-) ac_tag=-:-;; :[FH]*) ac_tag=$ac_tag:$ac_tag.in;; esac ac_save_IFS=$IFS IFS=: set x $ac_tag IFS=$ac_save_IFS shift ac_file=$1 shift case $ac_mode in :L) ac_source=$1;; :[FH]) ac_file_inputs= for ac_f do case $ac_f in -) ac_f="$ac_tmp/stdin";; *) # Look for the file first in the build tree, then in the source tree # (if the path is not absolute). The absolute path cannot be DOS-style, # because $ac_f cannot contain `:'. test -f "$ac_f" || case $ac_f in [\\/$]*) false;; *) test -f "$srcdir/$ac_f" && ac_f="$srcdir/$ac_f";; esac || as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5;; esac case $ac_f in *\'*) ac_f=`$as_echo "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac as_fn_append ac_file_inputs " '$ac_f'" done # Let's still pretend it is `configure' which instantiates (i.e., don't # use $as_me), people would be surprised to read: # /* config.h. Generated by config.status. */ configure_input='Generated from '` $as_echo "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g' `' by configure.' if test x"$ac_file" != x-; then configure_input="$ac_file. $configure_input" { $as_echo "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5 $as_echo "$as_me: creating $ac_file" >&6;} fi # Neutralize special characters interpreted by sed in replacement strings. case $configure_input in #( *\&* | *\|* | *\\* ) ac_sed_conf_input=`$as_echo "$configure_input" | sed 's/[\\\\&|]/\\\\&/g'`;; #( *) ac_sed_conf_input=$configure_input;; esac case $ac_tag in *:-:* | *:-) cat >"$ac_tmp/stdin" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;; esac ;; esac ac_dir=`$as_dirname -- "$ac_file" || $as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$ac_file" : 'X\(//\)[^/]' \| \ X"$ac_file" : 'X\(//\)$' \| \ X"$ac_file" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$ac_file" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` as_dir="$ac_dir"; as_fn_mkdir_p ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix case $ac_mode in :F) # # CONFIG_FILE # case $INSTALL in [\\/$]* | ?:[\\/]* ) ac_INSTALL=$INSTALL ;; *) ac_INSTALL=$ac_top_build_prefix$INSTALL ;; esac _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # If the template does not know about datarootdir, expand it. # FIXME: This hack should be removed a few years after 2.60. ac_datarootdir_hack=; ac_datarootdir_seen= ac_sed_dataroot=' /datarootdir/ { p q } /@datadir@/p /@docdir@/p /@infodir@/p /@localedir@/p /@mandir@/p' case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in *datarootdir*) ac_datarootdir_seen=yes;; *@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5 $as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;} _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_datarootdir_hack=' s&@datadir@&$datadir&g s&@docdir@&$docdir&g s&@infodir@&$infodir&g s&@localedir@&$localedir&g s&@mandir@&$mandir&g s&\\\${datarootdir}&$datarootdir&g' ;; esac _ACEOF # Neutralize VPATH when `$srcdir' = `.'. # Shell code in configure.ac might set extrasub. # FIXME: do we really want to maintain this feature? cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_sed_extra="$ac_vpsub $extrasub _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 :t /@[a-zA-Z_][a-zA-Z_0-9]*@/!b s|@configure_input@|$ac_sed_conf_input|;t t s&@top_builddir@&$ac_top_builddir_sub&;t t s&@top_build_prefix@&$ac_top_build_prefix&;t t s&@srcdir@&$ac_srcdir&;t t s&@abs_srcdir@&$ac_abs_srcdir&;t t s&@top_srcdir@&$ac_top_srcdir&;t t s&@abs_top_srcdir@&$ac_abs_top_srcdir&;t t s&@builddir@&$ac_builddir&;t t s&@abs_builddir@&$ac_abs_builddir&;t t s&@abs_top_builddir@&$ac_abs_top_builddir&;t t s&@INSTALL@&$ac_INSTALL&;t t $ac_datarootdir_hack " eval sed \"\$ac_sed_extra\" "$ac_file_inputs" | $AWK -f "$ac_tmp/subs.awk" \ >$ac_tmp/out || as_fn_error $? "could not create $ac_file" "$LINENO" 5 test -z "$ac_datarootdir_hack$ac_datarootdir_seen" && { ac_out=`sed -n '/\${datarootdir}/p' "$ac_tmp/out"`; test -n "$ac_out"; } && { ac_out=`sed -n '/^[ ]*datarootdir[ ]*:*=/p' \ "$ac_tmp/out"`; test -z "$ac_out"; } && { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir' which seems to be undefined. Please make sure it is defined" >&5 $as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir' which seems to be undefined. Please make sure it is defined" >&2;} rm -f "$ac_tmp/stdin" case $ac_file in -) cat "$ac_tmp/out" && rm -f "$ac_tmp/out";; *) rm -f "$ac_file" && mv "$ac_tmp/out" "$ac_file";; esac \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;; :H) # # CONFIG_HEADER # if test x"$ac_file" != x-; then { $as_echo "/* $configure_input */" \ && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs" } >"$ac_tmp/config.h" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 if diff "$ac_file" "$ac_tmp/config.h" >/dev/null 2>&1; then { $as_echo "$as_me:${as_lineno-$LINENO}: $ac_file is unchanged" >&5 $as_echo "$as_me: $ac_file is unchanged" >&6;} else rm -f "$ac_file" mv "$ac_tmp/config.h" "$ac_file" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 fi else $as_echo "/* $configure_input */" \ && eval '$AWK -f "$ac_tmp/defines.awk"' "$ac_file_inputs" \ || as_fn_error $? "could not create -" "$LINENO" 5 fi ;; esac done # for ac_tag as_fn_exit 0 _ACEOF ac_clean_files=$ac_clean_files_save test $ac_write_fail = 0 || as_fn_error $? "write failure creating $CONFIG_STATUS" "$LINENO" 5 # configure is writing to config.log, and then calls config.status. # config.status does its own redirection, appending to config.log. # Unfortunately, on DOS this fails, as config.log is still kept open # by configure, so config.status won't be able to write to it; its # output is simply discarded. So we exec the FD to /dev/null, # effectively closing config.log, so it can be properly (re)opened and # appended to by config.status. When coming back to configure, we # need to make the FD available again. if test "$no_create" != yes; then ac_cs_success=: ac_config_status_args= test "$silent" = yes && ac_config_status_args="$ac_config_status_args --quiet" exec 5>/dev/null $SHELL $CONFIG_STATUS $ac_config_status_args || ac_cs_success=false exec 5>>config.log # Use ||, not &&, to avoid exiting from the if with $? = 1, which # would make configure fail if this is the last instruction. $ac_cs_success || as_fn_exit 1 fi if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5 $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;} fi nsd-3.2.16/xfrd-notify.c0000664000175000017500000002212412010737213013765 0ustar matjematje/* * xfrd-notify.c - notify sending routines * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include "xfrd-notify.h" #include "xfrd.h" #include "xfrd-tcp.h" #include "packet.h" #define XFRD_NOTIFY_RETRY_TIMOUT 15 /* seconds between retries sending NOTIFY */ /* start sending notifies */ static void notify_enable(struct notify_zone_t* zone, struct xfrd_soa* new_soa); /* stop sending notifies */ static void notify_disable(struct notify_zone_t* zone); /* setup the notify active state */ static void setup_notify_active(struct notify_zone_t* zone); /* returns if the notify send is done for the notify_current acl */ static int xfrd_handle_notify_reply(struct notify_zone_t* zone, buffer_type* packet); /* handle zone notify send */ static void xfrd_handle_notify_send(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); static void xfrd_notify_next(struct notify_zone_t* zone); static void xfrd_notify_send_udp(struct notify_zone_t* zone, buffer_type* packet); static void notify_disable(struct notify_zone_t* zone) { zone->notify_current = 0; zone->notify_send_handler.timeout = NULL; if(zone->notify_send_handler.fd != -1) { close(zone->notify_send_handler.fd); zone->notify_send_handler.fd = -1; } if(xfrd->notify_udp_num == XFRD_MAX_UDP_NOTIFY) { /* find next waiting and needy zone */ while(xfrd->notify_waiting_first) { /* snip off */ struct notify_zone_t* wz = xfrd->notify_waiting_first; assert(wz->is_waiting); wz->is_waiting = 0; xfrd->notify_waiting_first = wz->waiting_next; if(xfrd->notify_waiting_last == wz) xfrd->notify_waiting_last = NULL; /* see if this zone needs notify sending */ if(wz->notify_current) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s: notify off waiting list.", zone->apex_str) ); setup_notify_active(wz); return; } } } xfrd->notify_udp_num--; } void init_notify_send(rbtree_t* tree, netio_type* netio, region_type* region, const dname_type* apex, zone_options_t* options, zone_type* dbzone) { struct notify_zone_t* not = (struct notify_zone_t*) region_alloc(region, sizeof(struct notify_zone_t)); memset(not, 0, sizeof(struct notify_zone_t)); not->apex = apex; not->apex_str = options->name; not->node.key = not->apex; not->options = options; /* if master zone and have a SOA */ not->current_soa = (struct xfrd_soa*)region_alloc(region, sizeof(struct xfrd_soa)); memset(not->current_soa, 0, sizeof(struct xfrd_soa)); if(dbzone && dbzone->soa_rrset && dbzone->soa_rrset->rrs) { xfrd_copy_soa(not->current_soa, dbzone->soa_rrset->rrs); } not->is_waiting = 0; not->notify_send_handler.fd = -1; not->notify_send_handler.timeout = 0; not->notify_send_handler.user_data = not; not->notify_send_handler.event_types = NETIO_EVENT_READ|NETIO_EVENT_TIMEOUT; not->notify_send_handler.event_handler = xfrd_handle_notify_send; netio_add_handler(netio, ¬->notify_send_handler); tsig_create_record_custom(¬->notify_tsig, region, 0, 0, 4); not->notify_current = 0; rbtree_insert(tree, (rbnode_t*)not); } static int xfrd_handle_notify_reply(struct notify_zone_t* zone, buffer_type* packet) { if((OPCODE(packet) != OPCODE_NOTIFY) || (QR(packet) == 0)) { log_msg(LOG_ERR, "xfrd: zone %s: received bad notify reply opcode/flags", zone->apex_str); return 0; } /* we know it is OPCODE NOTIFY, QUERY_REPLY and for this zone */ if(ID(packet) != zone->notify_query_id) { log_msg(LOG_ERR, "xfrd: zone %s: received notify-ack with bad ID", zone->apex_str); return 0; } /* could check tsig, but why. The reply does not cause processing. */ if(RCODE(packet) != RCODE_OK) { log_msg(LOG_ERR, "xfrd: zone %s: received notify response error %s from %s", zone->apex_str, rcode2str(RCODE(packet)), zone->notify_current->ip_address_spec); if(RCODE(packet) == RCODE_IMPL) return 1; /* rfc1996: notimpl notify reply: consider retries done */ return 0; } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s: host %s acknowledges notify", zone->apex_str, zone->notify_current->ip_address_spec)); return 1; } static void xfrd_notify_next(struct notify_zone_t* zone) { /* advance to next in acl */ zone->notify_current = zone->notify_current->next; zone->notify_retry = 0; if(zone->notify_current == 0) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s: no more notify-send acls. stop notify.", zone->apex_str)); notify_disable(zone); return; } } static void xfrd_notify_send_udp(struct notify_zone_t* zone, buffer_type* packet) { if(zone->notify_send_handler.fd != -1) close(zone->notify_send_handler.fd); zone->notify_send_handler.fd = -1; /* Set timeout for next reply */ zone->notify_timeout.tv_sec = xfrd_time() + XFRD_NOTIFY_RETRY_TIMOUT; /* send NOTIFY to secondary. */ xfrd_setup_packet(packet, TYPE_SOA, CLASS_IN, zone->apex); zone->notify_query_id = ID(packet); OPCODE_SET(packet, OPCODE_NOTIFY); AA_SET(packet); if(zone->current_soa->serial != 0) { /* add current SOA to answer section */ ANCOUNT_SET(packet, 1); xfrd_write_soa_buffer(packet, zone->apex, zone->current_soa); } if(zone->notify_current->key_options) { xfrd_tsig_sign_request(packet, &zone->notify_tsig, zone->notify_current); } buffer_flip(packet); zone->notify_send_handler.fd = xfrd_send_udp(zone->notify_current, packet, zone->options->outgoing_interface); if(zone->notify_send_handler.fd == -1) { log_msg(LOG_ERR, "xfrd: zone %s: could not send notify #%d to %s", zone->apex_str, zone->notify_retry, zone->notify_current->ip_address_spec); return; } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s: sent notify #%d to %s", zone->apex_str, zone->notify_retry, zone->notify_current->ip_address_spec)); } static void xfrd_handle_notify_send(netio_type* ATTR_UNUSED(netio), netio_handler_type *handler, netio_event_types_type event_types) { struct notify_zone_t* zone = (struct notify_zone_t*)handler->user_data; buffer_type* packet = xfrd_get_temp_buffer(); assert(zone->notify_current); if(zone->is_waiting) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: notify waiting, skipped, %s", zone->apex_str)); assert(zone->notify_send_handler.fd == -1); return; } if(event_types & NETIO_EVENT_READ) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s: read notify ACK", zone->apex_str)); assert(handler->fd != -1); if(xfrd_udp_read_packet(packet, zone->notify_send_handler.fd)) { if(xfrd_handle_notify_reply(zone, packet)) xfrd_notify_next(zone); } } else if(event_types & NETIO_EVENT_TIMEOUT) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s: notify timeout", zone->apex_str)); /* timeout, try again */ } /* see if notify is still enabled */ if(zone->notify_current) { zone->notify_retry++; if(zone->notify_retry > zone->options->notify_retry) { log_msg(LOG_ERR, "xfrd: zone %s: max notify send count reached, %s unreachable", zone->apex_str, zone->notify_current->ip_address_spec); xfrd_notify_next(zone); } } if(zone->notify_current) { /* try again */ xfrd_notify_send_udp(zone, packet); } } static void setup_notify_active(struct notify_zone_t* zone) { zone->notify_retry = 0; zone->notify_current = zone->options->notify; zone->notify_send_handler.timeout = &zone->notify_timeout; zone->notify_timeout.tv_sec = xfrd_time(); zone->notify_timeout.tv_nsec = 0; } static void notify_enable(struct notify_zone_t* zone, struct xfrd_soa* new_soa) { if(!zone->options->notify) { return; /* no notify acl, nothing to do */ } if(new_soa == NULL) memset(zone->current_soa, 0, sizeof(xfrd_soa_t)); else memcpy(zone->current_soa, new_soa, sizeof(xfrd_soa_t)); if(zone->is_waiting) return; if(xfrd->notify_udp_num < XFRD_MAX_UDP_NOTIFY) { setup_notify_active(zone); xfrd->notify_udp_num++; return; } /* put it in waiting list */ zone->notify_current = zone->options->notify; zone->is_waiting = 1; zone->waiting_next = NULL; if(xfrd->notify_waiting_last) { xfrd->notify_waiting_last->waiting_next = zone; } else { xfrd->notify_waiting_first = zone; } xfrd->notify_waiting_last = zone; zone->notify_send_handler.timeout = NULL; DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: zone %s: notify on waiting list.", zone->apex_str)); } void xfrd_send_notify(rbtree_t* tree, const dname_type* apex, struct xfrd_soa* new_soa) { /* lookup the zone */ struct notify_zone_t* zone = (struct notify_zone_t*) rbtree_search(tree, apex); assert(zone); notify_enable(zone, new_soa); } void notify_handle_master_zone_soainfo(rbtree_t* tree, const dname_type* apex, struct xfrd_soa* new_soa) { /* lookup the zone */ struct notify_zone_t* zone = (struct notify_zone_t*) rbtree_search(tree, apex); assert(zone); /* check if SOA changed */ if( (new_soa == NULL && zone->current_soa->serial == 0) || (new_soa && new_soa->serial == zone->current_soa->serial)) return; notify_enable(zone, new_soa); } void close_notify_fds(rbtree_t* tree) { struct notify_zone_t* zone; RBTREE_FOR(zone, struct notify_zone_t*, tree) { if(zone->notify_send_handler.fd != -1) { close(zone->notify_send_handler.fd); zone->notify_send_handler.fd = -1; } } } nsd-3.2.16/edns.h0000664000175000017500000000277711743261554012502 0ustar matjematje/* * edns.h -- EDNS definitions (RFC 2671). * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _EDNS_H_ #define _EDNS_H_ #include "buffer.h" #define OPT_LEN 9U /* Length of the NSD EDNS response record minus 2 */ #define OPT_RDATA 2 /* holds the rdata length comes after OPT_LEN */ #define OPT_HDR 4U /* NSID opt header length */ #define NSID_CODE 3 /* nsid option code */ #define DNSSEC_OK_MASK 0x8000U /* do bit mask */ struct edns_data { char ok[OPT_LEN]; char error[OPT_LEN]; char rdata_none[OPT_RDATA]; char rdata_nsid[OPT_RDATA]; char nsid[OPT_HDR]; }; typedef struct edns_data edns_data_type; enum edns_status { EDNS_NOT_PRESENT, EDNS_OK, /* EDNS states may be extended in the future */ EDNS_ERROR }; typedef enum edns_status edns_status_type; struct edns_record { edns_status_type status; size_t position; size_t maxlen; int dnssec_ok; int nsid; }; typedef struct edns_record edns_record_type; void edns_init_data(edns_data_type *data, uint16_t max_length); void edns_init_record(edns_record_type *data); int edns_parse_record(edns_record_type *data, buffer_type *packet); /* * The amount of space to reserve in the response for the EDNS data * (if required). */ size_t edns_reserved_space(edns_record_type *data); void edns_init_nsid(edns_data_type *data, uint16_t nsid_len); #endif /* _EDNS_H_ */ nsd-3.2.16/Makefile.in0000664000175000017500000006676512167000652013443 0ustar matjematje# # Makefile -- one file to make them all, nsd(8) # # Copyright (c) 2001-2011, NLnet Labs. All rights reserved. # # See LICENSE for the license. # # Standard installation pathnames SHELL = @SHELL@ srcdir = @srcdir@ prefix = @prefix@ exec_prefix = @exec_prefix@ sbindir = @sbindir@ mandir = @mandir@ datarootdir = @datarootdir@ # NSD specific pathnames configdir = @configdir@ piddir = @piddir@ dbdir = @dbdir@ pidfile = @pidfile@ logfile = @logfile@ zonestatsfile = @zonestatsfile@ dbfile = @dbfile@ difffile = @difffile@ xfrdfile = @xfrdfile@ nsdconfigfile = @nsd_conf_file@ zonesdir = @zonesdir@ user = @user@ spriority = @start_priority@ kpriority = @kill_priority@ CC = @CC@ CPPFLAGS = @CPPFLAGS@ -I. -I$(srcdir)# @DEFS@ contains -DHAVE_CONFIG_H CFLAGS = @CFLAGS@ LDFLAGS = @LDFLAGS@ LIBS = @LIBS@ LIBOBJS = @LIBOBJS@ INSTALL = $(srcdir)/install-sh -c INSTALL_PROGRAM = $(INSTALL) INSTALL_DATA = $(INSTALL) -m 644 YACC = @YACC@ LEX = @LEX@ COMPILE = $(CC) $(CPPFLAGS) $(CFLAGS) LINK = $(CC) $(CFLAGS) $(LDFLAGS) EDIT = sed \ -e 's,@prefix\@,$(prefix),g' \ -e 's,@exec_prefix\@,$(exec_prefix),g' \ -e 's,@sbindir\@,$(sbindir),g' \ -e 's,@configdir\@,$(configdir),g' \ -e 's,@zonesdir\@,$(zonesdir),g' \ -e 's,@pidfile\@,$(pidfile),g' \ -e 's,@logfile\@,$(logfile),g' \ -e 's,@zonestatsfile\@,$(zonestatsfile),g' \ -e 's,@dbfile\@,$(dbfile),g' \ -e 's,@difffile\@,$(difffile),g' \ -e 's,@xfrdfile\@,$(xfrdfile),g' \ -e 's,@nsdconfigfile\@,$(nsdconfigfile),g' \ -e 's,@shell\@,$(SHELL),g' \ -e 's,@user\@,$(user),g' \ -e 's,@spriority\@,$(spriority),g' \ -e 's,@kpriority\@,$(kpriority),g' TARGETS = nsd zonec nsd-notify nsd-xfer nsdc.sh nsd-checkconf nsd-patch nsd.conf.sample \ nsd.8 zonec.8 nsd-notify.8 nsd-xfer.8 nsdc.8 nsd-checkconf.8 nsd-patch.8 nsd.conf.5 ALL_OBJECTS = \ answer.o \ axfr.o \ buffer.o \ configlexer.o \ configparser.o \ dbaccess.o \ dbcreate.o \ difffile.o \ dname.o \ dns.o \ edns.o \ ipc.o \ iterated_hash.o \ lookup3.o \ namedb.o \ netio.o \ nsd-checkconf.o \ nsd-notify.o \ nsd.o \ nsd-patch.o \ nsd-xfer.o \ nsec3.o \ options.o \ packet.o \ query.o \ rbtree.o \ rdata.o \ region-allocator.o \ rrl.o \ server.o \ tsig.o \ tsig-openssl.o \ util.o \ xfrd-disk.o \ xfrd-notify.o \ xfrd.o \ xfrd-tcp.o \ zlexer.o \ zonec.o \ zparser.o NSD_OBJECTS = \ answer.o \ axfr.o \ buffer.o \ configlexer.o \ configparser.o \ options.o \ dbaccess.o \ difffile.o \ dname.o \ dns.o \ edns.o \ ipc.o \ iterated_hash.o \ lookup3.o \ namedb.o \ netio.o \ nsd.o \ nsec3.o \ packet.o \ query.o \ rbtree.o \ rdata.o \ region-allocator.o \ rrl.o \ server.o \ tsig.o \ tsig-openssl.o \ util.o \ xfrd-disk.o \ xfrd-notify.o \ xfrd-tcp.o \ xfrd.o ZONEC_OBJECTS = \ answer.o \ axfr.o \ buffer.o \ configlexer.o \ configparser.o \ dbaccess.o \ difffile.o \ dbcreate.o \ dname.o \ dns.o \ edns.o \ iterated_hash.o \ lookup3.o \ namedb.o \ nsec3.o \ options.o \ packet.o \ query.o \ rbtree.o \ rdata.o \ region-allocator.o \ rrl.o \ tsig.o \ tsig-openssl.o \ util.o \ zlexer.o \ zonec.o \ zparser.o NSD_NOTIFY_OBJECTS = \ answer.o \ axfr.o \ buffer.o \ configlexer.o \ configparser.o \ dbaccess.o \ dname.o \ dns.o \ edns.o \ iterated_hash.o \ lookup3.o \ namedb.o \ nsd-notify.o \ nsec3.o \ options.o \ packet.o \ query.o \ rbtree.o \ rdata.o \ region-allocator.o \ rrl.o \ tsig.o \ tsig-openssl.o \ util.o NSD_XFER_OBJECTS = \ answer.o \ axfr.o \ buffer.o \ configlexer.o \ configparser.o \ dbaccess.o \ dname.o \ dns.o \ edns.o \ iterated_hash.o \ lookup3.o \ namedb.o \ nsd-xfer.o \ nsec3.o \ options.o \ packet.o \ query.o \ rbtree.o \ rdata.o \ region-allocator.o \ rrl.o \ tsig.o \ tsig-openssl.o \ util.o NSD_CHECKCONF_OBJECTS = \ answer.o \ axfr.o \ buffer.o \ configlexer.o \ configparser.o \ dbaccess.o \ dname.o \ dns.o \ edns.o \ iterated_hash.o \ lookup3.o \ namedb.o \ nsd-checkconf.o \ nsec3.o \ options.o \ packet.o \ query.o \ rbtree.o \ rdata.o \ region-allocator.o \ rrl.o \ tsig.o \ tsig-openssl.o \ util.o NSD_PATCH_OBJECTS = \ answer.o \ axfr.o \ buffer.o \ configlexer.o \ configparser.o \ dbcreate.o \ dbaccess.o \ difffile.o \ dname.o \ dns.o \ edns.o \ iterated_hash.o \ lookup3.o \ namedb.o \ nsd-patch.o \ nsec3.o \ options.o \ packet.o \ query.o \ rbtree.o \ rdata.o \ region-allocator.o \ rrl.o \ tsig.o \ tsig-openssl.o \ util.o CUTEST_OBJECTS = \ answer.o \ axfr.o \ buffer.o \ configlexer.o \ configparser.o \ options.o \ dbaccess.o \ dbcreate.o \ difffile.o \ dname.o \ dns.o \ edns.o \ ipc.o \ iterated_hash.o \ lookup3.o \ namedb.o \ netio.o \ nsec3.o \ packet.o \ query.o \ rbtree.o \ rdata.o \ region-allocator.o \ rrl.o \ server.o \ tsig.o \ tsig-openssl.o \ util.o \ xfrd-disk.o \ xfrd-notify.o \ xfrd-tcp.o \ xfrd.o \ cutest_dname.o \ cutest_dns.o \ cutest_iterated_hash.o \ cutest_run.o \ cutest_rbtree.o \ cutest_options.o \ cutest_region.o \ cutest_rrl.o \ cutest_util.o \ cutest.o all: $(TARGETS) $(ALL_OBJECTS): $(COMPILE) -c $< nsdc.sh: $(srcdir)/nsdc.sh.in config.h rm -f nsdc.sh $(EDIT) $(srcdir)/nsdc.sh.in > nsdc.sh chmod +x nsdc.sh nsd.conf.sample: $(srcdir)/nsd.conf.sample.in config.h rm -f nsd.conf.sample $(EDIT) $(srcdir)/nsd.conf.sample.in | awk '/RRLconfig'@ratelimit@'/ { while($$0 !~ /.*RRLend.*/) { getline; } getline; } {print} ' > nsd.conf.sample nsd.conf.5: $(srcdir)/nsd.conf.5.in config.h rm -f nsd.conf.5 $(EDIT) $(srcdir)/nsd.conf.5.in | awk '/rrlstart'@ratelimit@'/ { while($$0 !~ /.*rrlend.*/) { getline; } getline; } {print} ' > nsd.conf.5 nsd.8: $(srcdir)/nsd.8.in config.h rm -f nsd.8 $(EDIT) $(srcdir)/nsd.8.in > nsd.8 nsdc.8: $(srcdir)/nsdc.8.in config.h rm -f nsdc.8 $(EDIT) $(srcdir)/nsdc.8.in > nsdc.8 zonec.8: $(srcdir)/zonec.8.in config.h rm -f zonec.8 $(EDIT) $(srcdir)/zonec.8.in > zonec.8 nsd-notify.8: $(srcdir)/nsd-notify.8.in config.h rm -f nsd-notify.8 $(EDIT) $(srcdir)/nsd-notify.8.in > nsd-notify.8 nsd-xfer.8: $(srcdir)/nsd-xfer.8.in config.h rm -f nsd-xfer.8 $(EDIT) $(srcdir)/nsd-xfer.8.in > nsd-xfer.8 nsd-checkconf.8: $(srcdir)/nsd-checkconf.8.in config.h rm -f nsd-checkconf.8 $(EDIT) $(srcdir)/nsd-checkconf.8.in > nsd-checkconf.8 nsd-patch.8: $(srcdir)/nsd-patch.8.in config.h rm -f nsd-patch.8 $(EDIT) $(srcdir)/nsd-patch.8.in > nsd-patch.8 install: all $(INSTALL) -d $(DESTDIR)$(sbindir) $(INSTALL) -d $(DESTDIR)$(configdir) $(INSTALL) -d $(DESTDIR)$(piddir) $(INSTALL) -d $(DESTDIR)$(dbdir) $(INSTALL) -d $(DESTDIR)$(mandir) $(INSTALL) -d $(DESTDIR)$(mandir)/man8 $(INSTALL) -d $(DESTDIR)$(mandir)/man5 $(INSTALL) nsd $(DESTDIR)$(sbindir)/nsd $(INSTALL) zonec $(DESTDIR)$(sbindir)/zonec $(INSTALL) nsdc.sh $(DESTDIR)$(sbindir)/nsdc $(INSTALL) nsd-notify $(DESTDIR)$(sbindir)/nsd-notify $(INSTALL) nsd-checkconf $(DESTDIR)$(sbindir)/nsd-checkconf $(INSTALL) nsd-patch $(DESTDIR)$(sbindir)/nsd-patch $(INSTALL) nsd-xfer $(DESTDIR)$(sbindir)/nsd-xfer $(INSTALL_DATA) $(srcdir)/nsd.8 $(DESTDIR)$(mandir)/man8 $(INSTALL_DATA) $(srcdir)/nsdc.8 $(DESTDIR)$(mandir)/man8 $(INSTALL_DATA) $(srcdir)/zonec.8 $(DESTDIR)$(mandir)/man8 $(INSTALL_DATA) $(srcdir)/nsd-notify.8 $(DESTDIR)$(mandir)/man8/nsd-notify.8 $(INSTALL_DATA) $(srcdir)/nsd-checkconf.8 $(DESTDIR)$(mandir)/man8/nsd-checkconf.8 $(INSTALL_DATA) $(srcdir)/nsd-patch.8 $(DESTDIR)$(mandir)/man8/nsd-patch.8 $(INSTALL_DATA) $(srcdir)/nsd-xfer.8 $(DESTDIR)$(mandir)/man8/nsd-xfer.8 $(INSTALL_DATA) $(srcdir)/nsd.conf.5 $(DESTDIR)$(mandir)/man5/nsd.conf.5 $(INSTALL_DATA) nsd.conf.sample $(DESTDIR)$(nsdconfigfile).sample uninstall: @echo rm -f -- $(DESTDIR)$(sbindir)/nsd $(DESTDIR)$(sbindir)/zonec $(DESTDIR)$(sbindir)/nsdc $(DESTDIR)$(sbindir)/nsd-notify $(DESTDIR)$(sbindir)/nsd-xfer $(DESTDIR)$(sbindir)/nsd-checkconf $(DESTDIR)$(sbindir)/nsd-patch rm -f -- $(DESTDIR)$(mandir)/man8/nsd.8 $(DESTDIR)$(mandir)/man8/nsdc.8 $(DESTDIR)$(mandir)/man8/zonec.8 $(DESTDIR)$(mandir)/man8/nsd-notify.8 $(DESTDIR)$(mandir)/man8/nsd-xfer.8 $(DESTDIR)$(mandir)/man5/nsd.conf.5 rm -f -- $(DESTDIR)$(mandir)/man8/nsd-checkconf.8 $(DESTDIR)$(mandir)/man8/nsd-patch.8 rm -f -- $(DESTDIR)$(pidfile) $(DESTDIR)$(dbfile) @echo @echo "You still need to remove $(DESTDIR)$(configdir), $(DESTDIR)$(piddir), $(DESTDIR)$(dbdir) directory by hand." test: nsd: $(NSD_OBJECTS) $(LIBOBJS) $(LINK) -o $@ $(NSD_OBJECTS) $(LIBOBJS) $(LIBS) zonec: $(ZONEC_OBJECTS) $(LIBOBJS) $(LINK) -o $@ $(ZONEC_OBJECTS) $(LIBOBJS) $(LIBS) nsd-notify: $(NSD_NOTIFY_OBJECTS) $(LIBOBJS) $(LINK) -o $@ $(NSD_NOTIFY_OBJECTS) $(LIBOBJS) $(LIBS) nsd-checkconf: $(NSD_CHECKCONF_OBJECTS) $(LIBOBJS) $(LINK) -o $@ $(NSD_CHECKCONF_OBJECTS) $(LIBOBJS) $(LIBS) nsd-xfer: $(NSD_XFER_OBJECTS) $(LIBOBJS) $(LINK) -o $@ $(NSD_XFER_OBJECTS) $(LIBOBJS) $(LIBS) nsd-patch: $(NSD_PATCH_OBJECTS) $(LIBOBJS) $(LINK) -o $@ $(NSD_PATCH_OBJECTS) $(LIBOBJS) $(LIBS) cutest: $(CUTEST_OBJECTS) $(LINK) -o $@ $(CUTEST_OBJECTS) $(LIBOBJS) $(LIBS) clean: rm -f *.o *.so y.* *.core *.gmon tags TAGS rm -f $(TARGETS) realclean: clean rm -f Makefile config.h config.log config.status rm -rf autom4te* rm -f zlexer.c zparser.h zparser.c zparser.stamp rm -f configlexer.c configparser.h configparser.c configparser.stamp devclean: realclean rm -f config.h.in configure basename.o: $(srcdir)/compat/basename.c $(COMPILE) -c $(srcdir)/compat/basename.c -o $@ inet_pton.o: $(srcdir)/compat/inet_pton.c $(COMPILE) -c $(srcdir)/compat/inet_pton.c -o $@ inet_ntop.o: $(srcdir)/compat/inet_ntop.c $(COMPILE) -c $(srcdir)/compat/inet_ntop.c -o $@ inet_aton.o: $(srcdir)/compat/inet_aton.c $(COMPILE) -c $(srcdir)/compat/inet_aton.c -o $@ b64_pton.o: $(srcdir)/compat/b64_pton.c $(COMPILE) -c $(srcdir)/compat/b64_pton.c -o $@ b64_ntop.o: $(srcdir)/compat/b64_ntop.c $(COMPILE) -c $(srcdir)/compat/b64_ntop.c -o $@ memcmp.o: $(srcdir)/compat/memcmp.c $(COMPILE) -c $(srcdir)/compat/memcmp.c -o $@ memmove.o: $(srcdir)/compat/memmove.c $(COMPILE) -c $(srcdir)/compat/memmove.c -o $@ snprintf.o: $(srcdir)/compat/snprintf.c $(COMPILE) -c $(srcdir)/compat/snprintf.c -o $@ strlcat.o: $(srcdir)/compat/strlcat.c $(COMPILE) -c $(srcdir)/compat/strlcat.c -o $@ strlcpy.o: $(srcdir)/compat/strlcpy.c $(COMPILE) -c $(srcdir)/compat/strlcpy.c -o $@ strptime.o: $(srcdir)/compat/strptime.c $(COMPILE) -c $(srcdir)/compat/strptime.c -o $@ vsnprintf.o: $(srcdir)/compat/vsnprintf.c $(COMPILE) -c $(srcdir)/compat/vsnprintf.c -o $@ timegm.o: $(srcdir)/compat/timegm.c $(COMPILE) -c $(srcdir)/compat/timegm.c -o $@ malloc.o: $(srcdir)/compat/malloc.c $(COMPILE) -c $(srcdir)/compat/malloc.c -o $@ pselect.o: $(srcdir)/compat/pselect.c $(COMPILE) -c $(srcdir)/compat/pselect.c -o $@ fake-rfc2553.o: $(srcdir)/compat/fake-rfc2553.c $(COMPILE) -c $(srcdir)/compat/fake-rfc2553.c -o $@ cutest_dname.o: $(srcdir)/tpkg/cutest/cutest_dname.c $(COMPILE) -c $(srcdir)/tpkg/cutest/cutest_dname.c -o $@ cutest_dns.o: $(srcdir)/tpkg/cutest/cutest_dns.c $(COMPILE) -c $(srcdir)/tpkg/cutest/cutest_dns.c -o $@ cutest_iterated_hash.o: $(srcdir)/tpkg/cutest/cutest_iterated_hash.c $(COMPILE) -c $(srcdir)/tpkg/cutest/cutest_iterated_hash.c -o $@ cutest_run.o: $(srcdir)/tpkg/cutest/cutest_run.c $(COMPILE) -c $(srcdir)/tpkg/cutest/cutest_run.c -o $@ cutest_rbtree.o: $(srcdir)/tpkg/cutest/cutest_rbtree.c $(COMPILE) -c $(srcdir)/tpkg/cutest/cutest_rbtree.c -o $@ cutest_rrl.o: $(srcdir)/tpkg/cutest/cutest_rrl.c $(COMPILE) -c $(srcdir)/tpkg/cutest/cutest_rrl.c -o $@ cutest_options.o: $(srcdir)/tpkg/cutest/cutest_options.c $(COMPILE) -c $(srcdir)/tpkg/cutest/cutest_options.c -o $@ cutest_region.o: $(srcdir)/tpkg/cutest/cutest_region.c $(COMPILE) -c $(srcdir)/tpkg/cutest/cutest_region.c -o $@ cutest_util.o: $(srcdir)/tpkg/cutest/cutest_util.c $(COMPILE) -c $(srcdir)/tpkg/cutest/cutest_util.c -o $@ cutest.o: $(srcdir)/tpkg/cutest/cutest.c $(COMPILE) -c $(srcdir)/tpkg/cutest/cutest.c -o $@ zlexer.c: $(srcdir)/zlexer.lex rm -f $@ echo '#include "config.h"' > $@ $(LEX) -i -t $(srcdir)/zlexer.lex >> $@ zparser.c zparser.h: $(srcdir)/zparser.y $(YACC) -d -o zparser.c $(srcdir)/zparser.y configlexer.c: $(srcdir)/configlexer.lex rm -f $@ echo '#include "configyyrename.h"' > $@ $(LEX) -i -t $(srcdir)/configlexer.lex >> $@ configparser.c configparser.h: $(srcdir)/configparser.y $(YACC) -d -o configparser.c $(srcdir)/configparser.y # autoconf rules config.h.in: configure.ac autoheader configure: configure.ac autoconf tags: ctags *.[ch] # dependency generation DEPEND_TMP=depend1073.tmp DEPEND_TMP2=depend1074.tmp DEPEND_TARGET=Makefile DEPEND_TARGET2=Makefile.in depend: (cd $(srcdir) ; $(CC) -MM $(CPPFLAGS) *.c compat/*.c tpkg/cutest/*.c) | \ sed -e 's? *\([^ ]*\.[ch]\)? $$(srcdir)/\1?g' | \ sed -e 's?$$(srcdir)/config.h?config.h?' \ -e 's?$$(srcdir)/configlexer.c?configlexer.c?' \ -e 's?$$(srcdir)/configparser.c?configparser.c?' \ -e 's?$$(srcdir)/configparser.h?configparser.h?' \ -e 's?$$(srcdir)/zlexer.c?zlexer.c?' \ -e 's?$$(srcdir)/zparser.c?zparser.c?' \ -e 's?$$(srcdir)/zparser.h?zparser.h?' \ > $(DEPEND_TMP) cp $(DEPEND_TARGET) $(DEPEND_TMP2) head -`egrep -n "# Dependencies" $(DEPEND_TARGET) | tail -1 | sed -e 's/:.*$$//'` $(DEPEND_TMP2) > $(DEPEND_TARGET) cat $(DEPEND_TMP) >> $(DEPEND_TARGET) @if diff $(DEPEND_TARGET) $(DEPEND_TMP2); then echo " $(DEPEND_TARGET) unchanged"; else echo " Updated $(DEPEND_TARGET))"; fi @if test -f $(DEPEND_TARGET2); then \ cp $(DEPEND_TARGET2) $(DEPEND_TMP2); \ head -`egrep -n "# Dependencies" $(DEPEND_TARGET2) | tail -1 | sed -e 's/:.*$$//'` $(DEPEND_TMP2) > $(DEPEND_TARGET2); \ cat $(DEPEND_TMP) >> $(DEPEND_TARGET2); \ if diff $(DEPEND_TARGET2) $(DEPEND_TMP2); then echo " $(DEPEND_TARGET2) unchanged"; else echo " Updated $(DEPEND_TARGET2))"; fi; \ fi rm -f $(DEPEND_TMP) $(DEPEND_TMP2) # Dependencies answer.o: $(srcdir)/answer.c config.h $(srcdir)/answer.h $(srcdir)/dns.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/rbtree.h $(srcdir)/packet.h $(srcdir)/query.h $(srcdir)/nsd.h $(srcdir)/edns.h $(srcdir)/tsig.h axfr.o: $(srcdir)/axfr.c config.h $(srcdir)/axfr.h $(srcdir)/nsd.h $(srcdir)/dns.h $(srcdir)/edns.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/query.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/rbtree.h $(srcdir)/packet.h \ $(srcdir)/tsig.h $(srcdir)/options.h buffer.o: $(srcdir)/buffer.c config.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h $(srcdir)/util.h configlexer.o: configlexer.c $(srcdir)/configyyrename.h config.h $(srcdir)/options.h \ $(srcdir)/region-allocator.h $(srcdir)/rbtree.h configparser.h configparser.o: configparser.c config.h $(srcdir)/options.h $(srcdir)/region-allocator.h \ $(srcdir)/rbtree.h $(srcdir)/util.h $(srcdir)/rrl.h $(srcdir)/query.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/dns.h $(srcdir)/nsd.h \ $(srcdir)/edns.h $(srcdir)/packet.h $(srcdir)/tsig.h $(srcdir)/configyyrename.h dbaccess.o: $(srcdir)/dbaccess.c config.h $(srcdir)/dns.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/rbtree.h $(srcdir)/options.h dbcreate.o: $(srcdir)/dbcreate.c config.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h config.h $(srcdir)/dns.h $(srcdir)/rbtree.h difffile.o: $(srcdir)/difffile.c config.h $(srcdir)/difffile.h $(srcdir)/rbtree.h \ $(srcdir)/region-allocator.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/util.h $(srcdir)/dns.h $(srcdir)/options.h \ $(srcdir)/packet.h $(srcdir)/rdata.h $(srcdir)/nsec3.h dname.o: $(srcdir)/dname.c config.h $(srcdir)/dns.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h \ $(srcdir)/util.h $(srcdir)/query.h $(srcdir)/namedb.h $(srcdir)/rbtree.h $(srcdir)/nsd.h $(srcdir)/edns.h $(srcdir)/packet.h $(srcdir)/tsig.h dns.o: $(srcdir)/dns.c config.h $(srcdir)/dns.h $(srcdir)/zonec.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/rbtree.h zparser.h edns.o: $(srcdir)/edns.c config.h $(srcdir)/dns.h $(srcdir)/edns.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h $(srcdir)/util.h ipc.o: $(srcdir)/ipc.c config.h $(srcdir)/ipc.h $(srcdir)/netio.h $(srcdir)/region-allocator.h $(srcdir)/buffer.h $(srcdir)/util.h \ $(srcdir)/xfrd-tcp.h $(srcdir)/xfrd.h $(srcdir)/rbtree.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/dns.h $(srcdir)/options.h $(srcdir)/tsig.h $(srcdir)/nsd.h \ $(srcdir)/edns.h $(srcdir)/xfrd-notify.h iterated_hash.o: $(srcdir)/iterated_hash.c config.h $(srcdir)/iterated_hash.h lookup3.o: $(srcdir)/lookup3.c config.h $(srcdir)/lookup3.h namedb.o: $(srcdir)/namedb.c config.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h \ $(srcdir)/util.h $(srcdir)/dns.h $(srcdir)/rbtree.h netio.o: $(srcdir)/netio.c config.h $(srcdir)/netio.h $(srcdir)/region-allocator.h $(srcdir)/util.h nsd.o: $(srcdir)/nsd.c config.h $(srcdir)/nsd.h $(srcdir)/dns.h $(srcdir)/edns.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h \ $(srcdir)/util.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/rbtree.h $(srcdir)/options.h $(srcdir)/tsig.h nsd-checkconf.o: $(srcdir)/nsd-checkconf.c config.h $(srcdir)/tsig.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h config.h $(srcdir)/dname.h $(srcdir)/options.h $(srcdir)/rbtree.h $(srcdir)/rrl.h \ $(srcdir)/query.h $(srcdir)/namedb.h $(srcdir)/dns.h $(srcdir)/nsd.h $(srcdir)/edns.h $(srcdir)/packet.h nsd-notify.o: $(srcdir)/nsd-notify.c config.h $(srcdir)/tsig.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h \ $(srcdir)/util.h config.h $(srcdir)/dname.h $(srcdir)/query.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/dns.h $(srcdir)/rbtree.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/nsd.h $(srcdir)/edns.h $(srcdir)/buffer.h $(srcdir)/packet.h $(srcdir)/tsig.h nsd-patch.o: $(srcdir)/nsd-patch.c config.h $(srcdir)/options.h $(srcdir)/region-allocator.h \ $(srcdir)/rbtree.h $(srcdir)/difffile.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/util.h $(srcdir)/dns.h nsd-xfer.o: $(srcdir)/nsd-xfer.c config.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h \ $(srcdir)/util.h config.h $(srcdir)/dns.h $(srcdir)/packet.h $(srcdir)/namedb.h $(srcdir)/rbtree.h $(srcdir)/query.h $(srcdir)/nsd.h $(srcdir)/edns.h \ $(srcdir)/tsig.h $(srcdir)/tsig-openssl.h nsec3.o: $(srcdir)/nsec3.c config.h $(srcdir)/nsec3.h $(srcdir)/iterated_hash.h $(srcdir)/namedb.h \ $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/dns.h $(srcdir)/rbtree.h $(srcdir)/nsd.h $(srcdir)/edns.h \ $(srcdir)/answer.h $(srcdir)/packet.h $(srcdir)/query.h $(srcdir)/tsig.h options.o: $(srcdir)/options.c config.h $(srcdir)/options.h $(srcdir)/region-allocator.h \ $(srcdir)/rbtree.h $(srcdir)/query.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/util.h $(srcdir)/dns.h $(srcdir)/nsd.h $(srcdir)/edns.h \ $(srcdir)/packet.h $(srcdir)/tsig.h $(srcdir)/rrl.h $(srcdir)/configyyrename.h packet.o: $(srcdir)/packet.c config.h $(srcdir)/packet.h $(srcdir)/dns.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h config.h $(srcdir)/rbtree.h $(srcdir)/query.h $(srcdir)/nsd.h $(srcdir)/edns.h $(srcdir)/tsig.h \ $(srcdir)/rdata.h query.o: $(srcdir)/query.c config.h $(srcdir)/answer.h $(srcdir)/dns.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/rbtree.h $(srcdir)/packet.h $(srcdir)/query.h $(srcdir)/nsd.h $(srcdir)/edns.h $(srcdir)/tsig.h \ $(srcdir)/axfr.h $(srcdir)/options.h $(srcdir)/nsec3.h config.h rbtree.o: $(srcdir)/rbtree.c config.h $(srcdir)/rbtree.h $(srcdir)/region-allocator.h rdata.o: $(srcdir)/rdata.c config.h $(srcdir)/rdata.h $(srcdir)/dns.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/rbtree.h $(srcdir)/zonec.h region-allocator.o: $(srcdir)/region-allocator.c config.h $(srcdir)/region-allocator.h $(srcdir)/util.h rrl.o: $(srcdir)/rrl.c config.h $(srcdir)/rrl.h $(srcdir)/query.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/dns.h $(srcdir)/rbtree.h $(srcdir)/nsd.h $(srcdir)/edns.h $(srcdir)/packet.h $(srcdir)/tsig.h \ $(srcdir)/lookup3.h $(srcdir)/options.h rrl-orig.o: $(srcdir)/rrl-orig.c config.h $(srcdir)/rrl.h $(srcdir)/query.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/dns.h $(srcdir)/rbtree.h $(srcdir)/nsd.h $(srcdir)/edns.h $(srcdir)/packet.h $(srcdir)/tsig.h \ $(srcdir)/lookup3.h $(srcdir)/options.h server.o: $(srcdir)/server.c config.h $(srcdir)/axfr.h $(srcdir)/nsd.h $(srcdir)/dns.h $(srcdir)/edns.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/query.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/rbtree.h $(srcdir)/packet.h \ $(srcdir)/tsig.h $(srcdir)/netio.h $(srcdir)/xfrd.h $(srcdir)/options.h $(srcdir)/xfrd-tcp.h $(srcdir)/difffile.h $(srcdir)/nsec3.h config.h \ $(srcdir)/ipc.h $(srcdir)/lookup3.h $(srcdir)/rrl.h tsig.o: $(srcdir)/tsig.c config.h $(srcdir)/tsig.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/dname.h \ $(srcdir)/tsig-openssl.h $(srcdir)/dns.h $(srcdir)/packet.h $(srcdir)/namedb.h $(srcdir)/rbtree.h tsig-openssl.o: $(srcdir)/tsig-openssl.c config.h $(srcdir)/tsig-openssl.h $(srcdir)/region-allocator.h \ $(srcdir)/tsig.h $(srcdir)/buffer.h $(srcdir)/util.h $(srcdir)/dname.h util.o: $(srcdir)/util.c config.h $(srcdir)/util.h $(srcdir)/region-allocator.h $(srcdir)/dname.h $(srcdir)/buffer.h \ $(srcdir)/namedb.h $(srcdir)/dns.h $(srcdir)/rbtree.h $(srcdir)/rdata.h xfrd.o: $(srcdir)/xfrd.c config.h $(srcdir)/xfrd.h $(srcdir)/netio.h $(srcdir)/region-allocator.h $(srcdir)/rbtree.h \ $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/util.h $(srcdir)/dns.h $(srcdir)/options.h $(srcdir)/tsig.h $(srcdir)/xfrd-tcp.h \ $(srcdir)/xfrd-disk.h $(srcdir)/xfrd-notify.h $(srcdir)/nsd.h $(srcdir)/edns.h $(srcdir)/packet.h $(srcdir)/difffile.h $(srcdir)/ipc.h xfrd-disk.o: $(srcdir)/xfrd-disk.c config.h $(srcdir)/xfrd-disk.h $(srcdir)/xfrd.h $(srcdir)/netio.h \ $(srcdir)/region-allocator.h $(srcdir)/rbtree.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/util.h $(srcdir)/dns.h \ $(srcdir)/options.h $(srcdir)/tsig.h $(srcdir)/nsd.h $(srcdir)/edns.h xfrd-notify.o: $(srcdir)/xfrd-notify.c config.h $(srcdir)/xfrd-notify.h $(srcdir)/tsig.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/dname.h $(srcdir)/netio.h $(srcdir)/rbtree.h $(srcdir)/xfrd.h $(srcdir)/namedb.h $(srcdir)/dns.h \ $(srcdir)/options.h $(srcdir)/xfrd-tcp.h $(srcdir)/packet.h xfrd-tcp.o: $(srcdir)/xfrd-tcp.c config.h $(srcdir)/xfrd-tcp.h $(srcdir)/xfrd.h $(srcdir)/netio.h \ $(srcdir)/region-allocator.h $(srcdir)/rbtree.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/util.h $(srcdir)/dns.h \ $(srcdir)/options.h $(srcdir)/tsig.h $(srcdir)/packet.h zlexer.o: zlexer.c config.h $(srcdir)/zonec.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h $(srcdir)/dns.h $(srcdir)/rbtree.h zparser.h zonec.o: $(srcdir)/zonec.c config.h $(srcdir)/zonec.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h config.h $(srcdir)/dns.h $(srcdir)/rbtree.h $(srcdir)/rdata.h $(srcdir)/options.h \ $(srcdir)/nsec3.h zparser.o: zparser.c config.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h $(srcdir)/util.h \ $(srcdir)/namedb.h $(srcdir)/dns.h $(srcdir)/rbtree.h $(srcdir)/zonec.h b64_ntop.o: $(srcdir)/compat/b64_ntop.c config.h b64_pton.o: $(srcdir)/compat/b64_pton.c config.h basename.o: $(srcdir)/compat/basename.c fake-rfc2553.o: $(srcdir)/compat/fake-rfc2553.c $(srcdir)/compat/fake-rfc2553.h config.h inet_aton.o: $(srcdir)/compat/inet_aton.c config.h inet_ntop.o: $(srcdir)/compat/inet_ntop.c config.h inet_pton.o: $(srcdir)/compat/inet_pton.c config.h malloc.o: $(srcdir)/compat/malloc.c memcmp.o: $(srcdir)/compat/memcmp.c config.h memmove.o: $(srcdir)/compat/memmove.c config.h pselect.o: $(srcdir)/compat/pselect.c config.h snprintf.o: $(srcdir)/compat/snprintf.c config.h strlcat.o: $(srcdir)/compat/strlcat.c config.h strlcpy.o: $(srcdir)/compat/strlcpy.c config.h strptime.o: $(srcdir)/compat/strptime.c cutest.o: $(srcdir)/tpkg/cutest/cutest.c $(srcdir)/tpkg/cutest/cutest.h cutest_dname.o: $(srcdir)/tpkg/cutest/cutest_dname.c config.h $(srcdir)/tpkg/cutest/cutest.h \ $(srcdir)/region-allocator.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h $(srcdir)/util.h config.h cutest_dns.o: $(srcdir)/tpkg/cutest/cutest_dns.c config.h $(srcdir)/tpkg/cutest/cutest.h \ $(srcdir)/region-allocator.h $(srcdir)/dns.h cutest_iterated_hash.o: $(srcdir)/tpkg/cutest/cutest_iterated_hash.c config.h \ $(srcdir)/tpkg/cutest/cutest.h $(srcdir)/region-allocator.h $(srcdir)/util.h config.h $(srcdir)/iterated_hash.h \ $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h $(srcdir)/util.h cutest_options.o: $(srcdir)/tpkg/cutest/cutest_options.c config.h \ $(srcdir)/tpkg/cutest/cutest.h $(srcdir)/region-allocator.h $(srcdir)/options.h config.h \ $(srcdir)/region-allocator.h $(srcdir)/rbtree.h $(srcdir)/util.h cutest_rbtree.o: $(srcdir)/tpkg/cutest/cutest_rbtree.c config.h \ $(srcdir)/tpkg/cutest/cutest.h $(srcdir)/region-allocator.h $(srcdir)/rbtree.h $(srcdir)/region-allocator.h cutest_region.o: $(srcdir)/tpkg/cutest/cutest_region.c config.h \ $(srcdir)/tpkg/cutest/cutest.h $(srcdir)/region-allocator.h $(srcdir)/util.h config.h $(srcdir)/rbtree.h \ $(srcdir)/region-allocator.h cutest_rrl.o: $(srcdir)/tpkg/cutest/cutest_rrl.c config.h $(srcdir)/tpkg/cutest/cutest.h \ $(srcdir)/rrl.h $(srcdir)/query.h $(srcdir)/namedb.h $(srcdir)/dname.h $(srcdir)/buffer.h $(srcdir)/region-allocator.h $(srcdir)/util.h \ config.h $(srcdir)/dns.h $(srcdir)/rbtree.h $(srcdir)/nsd.h $(srcdir)/edns.h $(srcdir)/packet.h $(srcdir)/tsig.h cutest_run.o: $(srcdir)/tpkg/cutest/cutest_run.c config.h $(srcdir)/tpkg/cutest/cutest.h cutest_util.o: $(srcdir)/tpkg/cutest/cutest_util.c config.h $(srcdir)/tpkg/cutest/cutest.h \ $(srcdir)/region-allocator.h $(srcdir)/util.h config.h nsd-3.2.16/nsec3.c0000664000175000017500000007225512067262046012552 0ustar matjematje/* * nsec3.c -- nsec3 handling. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include #ifdef NSEC3 #include #include #include #include "nsec3.h" #include "iterated_hash.h" #include "namedb.h" #include "nsd.h" #include "answer.h" #define NSEC3_SHA1_HASH 1 /* same type code as DS hash */ static void detect_nsec3_params(rr_type* nsec3_apex, const unsigned char** salt, int* salt_len, int* iter) { /* always uses first NSEC3 record with SOA bit set */ assert(salt && salt_len && iter); assert(nsec3_apex); *salt_len = rdata_atom_data(nsec3_apex->rdatas[3])[0]; *salt = (unsigned char*)(rdata_atom_data(nsec3_apex->rdatas[3])+1); *iter = read_uint16(rdata_atom_data(nsec3_apex->rdatas[2])); } static const dname_type * nsec3_hash_dname_param(region_type *region, zone_type *zone, const dname_type *dname, rr_type* param_rr) { unsigned char hash[SHA_DIGEST_LENGTH]; char b32[SHA_DIGEST_LENGTH*2+1]; const unsigned char* nsec3_salt = NULL; int nsec3_saltlength = 0; int nsec3_iterations = 0; detect_nsec3_params(param_rr, &nsec3_salt, &nsec3_saltlength, &nsec3_iterations); iterated_hash(hash, nsec3_salt, nsec3_saltlength, dname_name(dname), dname->name_size, nsec3_iterations); b32_ntop(hash, sizeof(hash), b32, sizeof(b32)); dname=dname_parse(region, b32); dname=dname_concatenate(region, dname, domain_dname(zone->apex)); return dname; } const dname_type * nsec3_hash_dname(region_type *region, zone_type *zone, const dname_type *dname) { return nsec3_hash_dname_param(region, zone, dname, zone->nsec3_soa_rr); } static int nsec3_has_soa(rr_type* rr) { if(rdata_atom_size(rr->rdatas[5]) >= 3 && /* has types in bitmap */ rdata_atom_data(rr->rdatas[5])[0] == 0 && /* first window = 0, */ /* [1]: windowlen must be >= 1 */ rdata_atom_data(rr->rdatas[5])[2]&0x02) /* SOA bit set */ return 1; return 0; } static rr_type* find_zone_nsec3(namedb_type* namedb, zone_type *zone) { size_t i; domain_type* domain; region_type* tmpregion; /* Check settings in NSEC3PARAM. Hash algorithm must be OK. And a NSEC3 with soa bit must map to the zone apex. */ rrset_type* paramset = domain_find_rrset(zone->apex, zone, TYPE_NSEC3PARAM); if(!paramset || !paramset->rrs || !paramset->rr_count) return NULL; tmpregion = region_create(xalloc, free); for(i=0; i < paramset->rr_count; i++) { rr_type* rr = ¶mset->rrs[i]; const dname_type* hashed_apex; rrset_type* nsec3_rrset; size_t j; const unsigned char *salt1; int saltlen1, iter1; if(rdata_atom_data(rr->rdatas[0])[0] != NSEC3_SHA1_HASH) { log_msg(LOG_ERR, "%s NSEC3PARAM entry %d has unknown hash algo %d", dname_to_string(domain_dname(zone->apex), NULL), (int)i, rdata_atom_data(rr->rdatas[0])[0]); continue; } if(rdata_atom_data(rr->rdatas[1])[0] != 0) { /* draft-nsec3-09: NSEC3PARAM records with flags field value other than zero MUST be ignored. */ continue; } /* check hash of apex -> NSEC3 with soa bit on */ hashed_apex = nsec3_hash_dname_param(tmpregion, zone, domain_dname(zone->apex), ¶mset->rrs[i]); domain = domain_table_find(namedb->domains, hashed_apex); if(!domain) { log_msg(LOG_ERR, "%s NSEC3PARAM entry %d has no hash(apex).", dname_to_string(domain_dname(zone->apex), NULL), (int)i); log_msg(LOG_ERR, "hash(apex)= %s", dname_to_string(hashed_apex, NULL)); continue; } nsec3_rrset = domain_find_rrset(domain, zone, TYPE_NSEC3); if(!nsec3_rrset) { log_msg(LOG_ERR, "%s NSEC3PARAM entry %d: hash(apex) has no NSEC3 RRset", dname_to_string(domain_dname(zone->apex), NULL), (int)i); continue; } detect_nsec3_params(rr, &salt1, &saltlen1, &iter1); /* find SOA bit enabled nsec3, with the same settings */ for(j=0; j < nsec3_rrset->rr_count; j++) { const unsigned char *salt2; int saltlen2, iter2; if(!nsec3_has_soa(&nsec3_rrset->rrs[j])) continue; /* check params OK. Ignores the optout bit. */ detect_nsec3_params(&nsec3_rrset->rrs[j], &salt2, &saltlen2, &iter2); if(saltlen1 == saltlen2 && iter1 == iter2 && rdata_atom_data(rr->rdatas[0])[0] == /* algo */ rdata_atom_data(nsec3_rrset->rrs[j].rdatas[0])[0] && memcmp(salt1, salt2, saltlen1) == 0) { /* found it */ DEBUG(DEBUG_QUERY, 1, (LOG_INFO, "detected NSEC3 for zone %s saltlen=%d iter=%d", dname_to_string(domain_dname( zone->apex),0), saltlen2, iter2)); region_destroy(tmpregion); return &nsec3_rrset->rrs[j]; } } log_msg(LOG_ERR, "%s NSEC3PARAM entry %d: hash(apex) no NSEC3 with SOAbit", dname_to_string(domain_dname(zone->apex), NULL), (int)i); } region_destroy(tmpregion); return NULL; } /* check that the rrset has an NSEC3 that uses the same parameters as the zone is using. Pass NSEC3 rrset, and zone must have nsec3_rrset set. if you pass NULL then 0 is returned. */ static int nsec3_rrset_params_ok(rr_type* base, rrset_type* rrset) { rdata_atom_type* prd; size_t i; if(!rrset) return 0; /* without rrset, no matching params either */ assert(rrset && rrset->zone && (base || rrset->zone->nsec3_soa_rr)); if(!base) base = rrset->zone->nsec3_soa_rr; prd = base->rdatas; for(i=0; i < rrset->rr_count; ++i) { rdata_atom_type* rd = rrset->rrs[i].rdatas; assert(rrset->rrs[i].type == TYPE_NSEC3); if(rdata_atom_data(rd[0])[0] == rdata_atom_data(prd[0])[0] && /* hash algo */ rdata_atom_data(rd[2])[0] == rdata_atom_data(prd[2])[0] && /* iterations 0 */ rdata_atom_data(rd[2])[1] == rdata_atom_data(prd[2])[1] && /* iterations 1 */ rdata_atom_data(rd[3])[0] == rdata_atom_data(prd[3])[0] && /* salt length */ memcmp(rdata_atom_data(rd[3])+1, rdata_atom_data(prd[3])+1, rdata_atom_data(rd[3])[0]) == 0 ) { /* this NSEC3 matches nsec3 parameters from zone */ return 1; } } return 0; } #ifdef FULL_PREHASH int nsec3_find_cover(namedb_type* db, zone_type* zone, const dname_type* hashname, domain_type** result) { rrset_type *rrset; domain_type *walk; domain_type *closest_match; domain_type *closest_encloser; int exact; assert(result); assert(zone->nsec3_soa_rr); exact = domain_table_search( db->domains, hashname, &closest_match, &closest_encloser); /* exact match of hashed domain name + it has an NSEC3? */ if(exact && nsec3_rrset_params_ok(NULL, domain_find_rrset(closest_encloser, zone, TYPE_NSEC3))) { *result = closest_encloser; assert(*result != 0); return 1; } /* find covering NSEC3 record, lexicographically before the closest match */ /* use nsec3_lookup to jumpstart the search */ walk = closest_match->nsec3_lookup; rrset = 0; while(walk && dname_is_subdomain(domain_dname(walk), domain_dname(zone->apex))) { if(nsec3_rrset_params_ok(NULL, domain_find_rrset(walk, zone, TYPE_NSEC3))) { /* this rrset is OK NSEC3, exit while */ rrset = domain_find_rrset(walk, zone, TYPE_NSEC3); break; } walk = domain_previous(walk); } if(rrset) *result = walk; else { /* * There are no NSEC3s before the closest match. * so the hash name is before the first NSEC3 record in the zone. * use last NSEC3, which covers the wraparound in hash space * * Since the zone has an NSEC3 with the SOA bit set for NSEC3 to turn on, * there is also a last nsec3, so find_cover always assigns *result!=0. */ *result = zone->nsec3_last; } assert(*result != 0); return 0; } #else int nsec3_find_cover(namedb_type* ATTR_UNUSED(db), zone_type* zone, const dname_type* hashname, struct nsec3_domain **result) { rbnode_t *node; int exact; assert(result); if (!zone->nsec3_domains) return 0; exact = rbtree_find_less_equal(zone->nsec3_domains, hashname, &node); if (!node) { exact = 0; node = rbtree_last(zone->nsec3_domains); } while (node != RBTREE_NULL) { struct rrset *nsec3_rrset; struct nsec3_domain *nsec3_domain = (struct nsec3_domain *) node; nsec3_rrset = domain_find_rrset(nsec3_domain->nsec3_domain, zone, TYPE_NSEC3); if (!nsec3_rrset) { /* * RRset in zone->nsec3_domains whose type != NSEC3 * If we get here, something is seriously wrong! */ return 0; } if (nsec3_rrset_params_ok(NULL, nsec3_rrset) != 0) { *result = nsec3_domain; return exact; } exact = 0; /* No match, so we're looking for closest match */ node = rbtree_previous(node); } /* * If we reach this point, *result == NULL. This should * never happen since the zone should have one NSEC3 record with * the SOA bit set, which matches a NSEC3PARAM RR in the zone. */ return exact; } #endif #ifdef FULL_PREHASH static void prehash_domain_r(namedb_type* db, zone_type* zone, domain_type* domain, region_type* region) { int exact; const dname_type *wcard, *wcard_child, *hashname; domain_type* result = 0; if(!zone->nsec3_soa_rr) { /* set to 0 (in case NSEC3 removed after an update) */ domain->nsec3_is_exact = 0; domain->nsec3_cover = NULL; domain->nsec3_wcard_child_cover = NULL; return; } hashname = nsec3_hash_dname(region, zone, domain_dname(domain)); exact = nsec3_find_cover(db, zone, hashname, &result); domain->nsec3_cover = result; if(exact) domain->nsec3_is_exact = 1; else domain->nsec3_is_exact = 0; /* find cover for *.domain for wildcard denial */ wcard = dname_parse(region, "*"); wcard_child = dname_concatenate(region, wcard, domain_dname(domain)); hashname = nsec3_hash_dname(region, zone, wcard_child); exact = nsec3_find_cover(db, zone, hashname, &result); domain->nsec3_wcard_child_cover = result; if(exact && !domain_wildcard_child(domain)) { /* We found an exact match for the *.domain NSEC3 hash, * but the domain wildcard child (*.domain) does not exist. * Thus there is a hash collision. It will cause servfail * for NXdomain queries below this domain. */ log_msg(LOG_WARNING, "prehash: collision of wildcard " "denial for %s. Sign zone with different salt " "to remove collision.", dname_to_string(domain_dname(domain),0)); } } #else static void prehash_domain_r(namedb_type* db, zone_type* zone, domain_type* domain, region_type* region) { int exact; const dname_type *hashname; struct nsec3_domain* result = NULL; domain->nsec3_cover = NULL; hashname = nsec3_hash_dname(region, zone, domain_dname(domain)); exact = nsec3_find_cover(db, zone, hashname, &result); if (result && exact) { result->covers = domain; domain->nsec3_cover = result->nsec3_domain; } return; } #endif static void prehash_domain(namedb_type* db, zone_type* zone, domain_type* domain, region_type* region) { prehash_domain_r(db, zone, domain, region); } #ifdef FULL_PREHASH static void prehash_ds(namedb_type* db, zone_type* zone, domain_type* domain, region_type* region) { domain_type* result = 0; const dname_type* hashname; int exact; if(!zone->nsec3_soa_rr) { domain->nsec3_ds_parent_is_exact = 0; domain->nsec3_ds_parent_cover = NULL; return; } /* hash again, other zone could have different hash parameters */ hashname = nsec3_hash_dname(region, zone, domain_dname(domain)); exact = nsec3_find_cover(db, zone, hashname, &result); if(exact) domain->nsec3_ds_parent_is_exact = 1; else domain->nsec3_ds_parent_is_exact = 0; domain->nsec3_ds_parent_cover = result; } #endif #ifndef FULL_PREHASH struct domain * find_last_nsec3_domain(struct zone *zone) { rbnode_t *node; if (zone->nsec3_domains == NULL) { return NULL; } node = rbtree_last(zone->nsec3_domains); if (node == RBTREE_NULL) { return NULL; } return ((struct nsec3_domain *) node)->nsec3_domain; } void prehash_zone_incremental(struct namedb *db, struct zone *zone) { region_type *temp_region; rbnode_t *node; /* find zone NSEC3PARAM settings */ zone->nsec3_soa_rr = find_zone_nsec3(db, zone); if (zone->nsec3_soa_rr == NULL) { zone->nsec3_last = NULL; return; } if (db->nsec3_mod_domains == NULL) { return; } zone->nsec3_last = find_last_nsec3_domain(zone); temp_region = region_create(xalloc, free); node = rbtree_first(db->nsec3_mod_domains); while (node != RBTREE_NULL) { struct nsec3_mod_domain *nsec3_mod_domain = (struct nsec3_mod_domain *) node; struct domain *walk = nsec3_mod_domain->domain; struct domain *domain_zone_apex; if (!walk || (dname_is_subdomain(domain_dname(walk), domain_dname(zone->apex)) == 0)) { node = rbtree_next(node); continue; } if (walk->nsec3_cover != NULL) { node = rbtree_next(node); continue; } /* Empty Terminal */ if (!walk->is_existing) { walk->nsec3_cover = NULL; node = rbtree_next(node); continue; } /* * Don't hash NSEC3 only nodes, unless possibly * part of a weird case where node is empty nonterminal * requiring NSEC3 but node name also is the hashed * node name of another node requiring NSEC3. * NSEC3 Empty Nonterminal with NSEC3 RRset present. */ if (domain_has_only_NSEC3(walk, zone) != 0) { struct domain *next_domain = domain_next(walk); if ((next_domain == NULL) || (next_domain->parent != walk)) { walk->nsec3_cover = NULL; node = rbtree_next(node); continue; } } /* * Identify domain nodes that belong to the zone * which are not glue records. What if you hit a * record that's in two zones but which has no * cut point between the zones. Not valid but * someone is gonna try it sometime. * This implementation doesn't link an NSEC3 * record to the domain. */ domain_zone_apex = domain_find_zone_apex(walk); if ((domain_zone_apex != NULL) && (domain_zone_apex == zone->apex) && (domain_is_glue(walk, zone) == 0)) { prehash_domain(db, zone, walk, temp_region); region_free_all(temp_region); } node = rbtree_next(node); } namedb_nsec3_mod_domains_destroy(db); region_destroy(temp_region); } void prehash_zone(struct namedb* db, struct zone* zone) { domain_type *walk; domain_type *last_nsec3_node; region_type *temp_region; assert(db && zone); /* find zone settings */ zone->nsec3_soa_rr = find_zone_nsec3(db, zone); if(!zone->nsec3_soa_rr) { zone->nsec3_last = NULL; return; } temp_region = region_create(xalloc, free); /* go through entire zone and setup nsec3_lookup speedup */ walk = zone->apex; last_nsec3_node = NULL; /* since we walk in sorted order, we pass all NSEC3s in sorted order and we can set the lookup ptrs */ while(walk && dname_is_subdomain( domain_dname(walk), domain_dname(zone->apex))) { struct domain *domain_zone_apex; if (walk->nsec3_cover != NULL) { walk = domain_next(walk); continue; } /* Empty Terminal */ if (walk->is_existing == 0) { walk->nsec3_cover = NULL; walk = domain_next(walk); continue; } /* * Don't hash NSEC3 only nodes, unless possibly * part of a weird case where node is empty nonterminal * requiring NSEC3 but node name also is the hashed * node name of another node requiring NSEC3. * NSEC3 Empty Nonterminal with NSEC3 RRset present. */ if (domain_has_only_NSEC3(walk, zone)) { struct domain *next_domain = domain_next(walk); if ((next_domain == NULL) || (next_domain->parent != walk)) { walk->nsec3_cover = NULL; walk = domain_next(walk); continue; } } /* * Identify domain nodes that belong to the zone * which are not glue records. What if you hit a * record that's in two zones but which has no * cut point between the zones. Not valid but * someone is gonna try it sometime. * This implementation doesn't link an NSEC3 * record to the domain. */ domain_zone_apex = domain_find_zone_apex(walk); if ((domain_zone_apex != NULL) && (domain_zone_apex == zone->apex) && (domain_is_glue(walk, zone) == 0)) { prehash_domain(db, zone, walk, temp_region); region_free_all(temp_region); } walk = domain_next(walk); } region_destroy(temp_region); } #else static void prehash_zone(struct namedb* db, struct zone* zone) { domain_type *walk; domain_type *last_nsec3_node; region_type *temp_region; assert(db && zone); /* find zone settings */ zone->nsec3_soa_rr = find_zone_nsec3(db, zone); if(!zone->nsec3_soa_rr) { zone->nsec3_last = NULL; return; } temp_region = region_create(xalloc, free); /* go through entire zone and setup nsec3_lookup speedup */ walk = zone->apex; last_nsec3_node = NULL; /* since we walk in sorted order, we pass all NSEC3s in sorted order and we can set the lookup ptrs */ while(walk && dname_is_subdomain( domain_dname(walk), domain_dname(zone->apex))) { zone_type* z = domain_find_zone(walk); if(z && z==zone) { if(domain_find_rrset(walk, zone, TYPE_NSEC3)) last_nsec3_node = walk; walk->nsec3_lookup = last_nsec3_node; } walk = domain_next(walk); } zone->nsec3_last = last_nsec3_node; /* go through entire zone */ walk = zone->apex; while(walk && dname_is_subdomain( domain_dname(walk), domain_dname(zone->apex))) { zone_type* z; if(!walk->is_existing && domain_has_only_NSEC3(walk, zone)) { walk->nsec3_cover = NULL; walk->nsec3_wcard_child_cover = NULL; walk = domain_next(walk); continue; } z = domain_find_zone(walk); if(z && z==zone && !domain_is_glue(walk, zone)) { prehash_domain(db, zone, walk, temp_region); region_free_all(temp_region); } /* prehash the DS (parent zone) */ if(domain_find_rrset(walk, zone, TYPE_DS) || (domain_find_rrset(walk, zone, TYPE_NS) && walk != zone->apex)) { assert(walk != zone->apex /* DS must be above zone cut */); prehash_ds(db, zone, walk, temp_region); region_free_all(temp_region); } walk = domain_next(walk); } region_destroy(temp_region); } #endif void prehash(struct namedb* db, int updated_only) { zone_type *z; time_t end, start = time(NULL); int count = 0; for(z = db->zones; z; z = z->next) { if(!updated_only || z->updated) { prehash_zone(db, z); if(z->nsec3_soa_rr) count++; } } end = time(NULL); if(count > 0) VERBOSITY(1, (LOG_INFO, "nsec3-prepare took %d " "seconds for %d zones.", (int)(end-start), count)); } #ifndef FULL_PREHASH static void nsec3_hash_and_find_cover(struct region *region, struct namedb *db, const struct dname *domain_dname, struct zone *zone, int *exact, struct domain **result) { dname_type const *hash_dname; struct nsec3_domain *nsec3_domain; *result = NULL; *exact = 0; hash_dname = nsec3_hash_dname(region, zone, domain_dname); *exact = nsec3_find_cover(db, zone, hash_dname, &nsec3_domain); if (nsec3_domain != NULL) { *result = nsec3_domain->nsec3_domain; } return; } static void nsec3_hash_and_find_wild_cover(struct region *region, struct namedb *db, struct domain *domain, struct zone *zone, int *exact, struct domain **result) { struct dname const *wcard_child; /* find cover for *.domain for wildcard denial */ (void) dname_make_wildcard(region, domain_dname(domain), &wcard_child); nsec3_hash_and_find_cover(region, db, wcard_child, zone, exact, result); if ((*exact != 0) && (domain_wildcard_child(domain) == NULL)) { /* We found an exact match for the *.domain NSEC3 hash, * but the domain wildcard child (*.domain) does not exist. * Thus there is a hash collision. It will cause servfail * for NXdomain queries below this domain. */ log_msg(LOG_WARNING, "collision of wildcard denial for %s. " "Sign zone with different salt to remove collision.", dname_to_string(domain_dname(domain), NULL)); } } #endif /* add the NSEC3 rrset to the query answer at the given domain */ static void nsec3_add_rrset(struct query *query, struct answer *answer, rr_section_type section, struct domain* domain) { if(domain) { rrset_type* rrset = domain_find_rrset(domain, query->zone, TYPE_NSEC3); if(rrset) answer_add_rrset(answer, section, domain, rrset); } } /* this routine does hashing at query-time. slow. */ static void nsec3_add_nonexist_proof(struct query *query, struct answer *answer, struct domain *encloser, struct namedb* db, const dname_type* qname) { const dname_type *to_prove; #ifdef FULL_PREHASH const dname_type *hashed; #else int exact = 0; #endif domain_type *cover = NULL; assert(encloser); /* if query=a.b.c.d encloser=c.d. then proof needed for b.c.d. */ /* if query=a.b.c.d encloser=*.c.d. then proof needed for b.c.d. */ to_prove = dname_partial_copy(query->region, qname, dname_label_match_count(qname, domain_dname(encloser))+1); /* generate proof that one label below closest encloser does not exist */ #ifdef FULL_PREHASH hashed = nsec3_hash_dname(query->region, query->zone, to_prove); if(nsec3_find_cover(db, query->zone, hashed, &cover)) #else nsec3_hash_and_find_cover(query->region, db, to_prove, query->zone, &exact, &cover); if (exact) #endif { /* exact match, hash collision */ /* the hashed name of the query corresponds to an existing name. */ log_msg(LOG_ERR, "nsec3 hash collision for name=%s", dname_to_string(to_prove, NULL)); RCODE_SET(query->packet, RCODE_SERVFAIL); return; } else if (cover) { /* cover proves the qname does not exist */ nsec3_add_rrset(query, answer, AUTHORITY_SECTION, cover); } } static void nsec3_add_closest_encloser_proof( struct query *query, struct answer *answer, struct domain *closest_encloser, struct namedb* db, const dname_type* qname) { if(!closest_encloser) return; /* prove that below closest encloser nothing exists */ nsec3_add_nonexist_proof(query, answer, closest_encloser, db, qname); /* proof that closest encloser exists */ #ifdef FULL_PREHASH if(closest_encloser->nsec3_is_exact) #else if(closest_encloser->nsec3_cover) #endif nsec3_add_rrset(query, answer, AUTHORITY_SECTION, closest_encloser->nsec3_cover); } void nsec3_answer_wildcard(struct query *query, struct answer *answer, struct domain *wildcard, struct namedb* db, const dname_type* qname) { if(!wildcard) return; if(!query->zone->nsec3_soa_rr) return; nsec3_add_nonexist_proof(query, answer, wildcard, db, qname); } static void nsec3_add_ds_proof(struct query *query, struct answer *answer, struct domain *domain, int delegpt) { #ifndef FULL_PREHASH struct domain * ds_parent_cover = NULL; int exact = 0; #endif /* assert we are above the zone cut */ assert(domain != query->zone->apex); #ifdef FULL_PREHASH if(domain->nsec3_ds_parent_is_exact) { /* use NSEC3 record from above the zone cut. */ nsec3_add_rrset(query, answer, AUTHORITY_SECTION, domain->nsec3_ds_parent_cover); } else if (!delegpt && domain->nsec3_is_exact) { #else nsec3_hash_and_find_cover(query->region, NULL, domain_dname(domain), query->zone, &exact, &ds_parent_cover); if (exact) { /* use NSEC3 record from above the zone cut. */ if (ds_parent_cover) { nsec3_add_rrset(query, answer, AUTHORITY_SECTION, ds_parent_cover); } } else if (!delegpt && domain->nsec3_cover) { #endif nsec3_add_rrset(query, answer, AUTHORITY_SECTION, domain->nsec3_cover); } else { /* prove closest provable encloser */ domain_type* par = domain->parent; domain_type* prev_par = NULL; assert(par); /* must be provable, thus there must be a parent */ #ifdef FULL_PREHASH while(!par->nsec3_is_exact) #else while(!par->nsec3_cover) #endif { prev_par = par; par = par->parent; assert(par); /* parent zone apex must be provable, thus this ends */ } nsec3_add_rrset(query, answer, AUTHORITY_SECTION, par->nsec3_cover); /* we took several steps to go to the provable parent, so the one below it has no exact nsec3, disprove it. disprove is easy, it has a prehashed cover ptr. */ if(prev_par) { #ifdef FULL_PREHASH assert(prev_par != domain && !prev_par->nsec3_is_exact); nsec3_add_rrset(query, answer, AUTHORITY_SECTION, prev_par->nsec3_cover); #else struct domain *prev_parent_cover = NULL; nsec3_hash_and_find_cover(query->region, NULL, domain_dname(prev_par), query->zone, &exact, &prev_parent_cover); if (prev_parent_cover) { nsec3_add_rrset(query, answer, AUTHORITY_SECTION, prev_parent_cover); } #endif } /* use NSEC3 record from above the zone cut. */ /* add optout range from parent zone */ /* note: no check of optout bit, resolver checks it */ #ifdef FULL_PREHASH nsec3_add_rrset(query, answer, AUTHORITY_SECTION, domain->nsec3_ds_parent_cover); #else nsec3_add_rrset(query, answer, AUTHORITY_SECTION, ds_parent_cover); #endif } } void nsec3_answer_nodata(struct query *query, struct answer *answer, struct domain *original) { if(!query->zone->nsec3_soa_rr) return; /* nodata when asking for secure delegation */ if(query->qtype == TYPE_DS) { if(original == query->zone->apex) { /* DS at zone apex, but server not authoritative for parent zone */ /* so answer at the child zone level */ #ifdef FULL_PREHASH if(original->nsec3_is_exact) #else if(original->nsec3_cover) #endif nsec3_add_rrset(query, answer, AUTHORITY_SECTION, original->nsec3_cover); return; } /* query->zone must be the parent zone */ nsec3_add_ds_proof(query, answer, original, 0); } /* the nodata is result from a wildcard match */ else if (original==original->wildcard_child_closest_match && label_is_wildcard(dname_name(domain_dname(original)))) { #ifndef FULL_PREHASH struct domain* original_cover; int exact; #endif /* denial for wildcard is already there */ /* add parent proof to have a closest encloser proof for wildcard parent */ /* in other words: nsec3 matching closest encloser */ #ifdef FULL_PREHASH if(original->parent && original->parent->nsec3_is_exact) #else if(original->parent && original->parent->nsec3_cover) #endif nsec3_add_rrset(query, answer, AUTHORITY_SECTION, original->parent->nsec3_cover); /* proof for wildcard itself */ /* in other words: nsec3 matching source of synthesis */ #ifdef FULL_PREHASH nsec3_add_rrset(query, answer, AUTHORITY_SECTION, original->nsec3_cover); #else original_cover = original->nsec3_cover; if (!original_cover) { /* not exact */ nsec3_hash_and_find_cover(query->region, NULL, domain_dname(original), query->zone, &exact, &original_cover); } if (original_cover) { nsec3_add_rrset(query, answer, AUTHORITY_SECTION, original_cover); } #endif } else { /* add nsec3 to prove rrset does not exist */ #ifdef FULL_PREHASH if(original->nsec3_is_exact) #else if (original->nsec3_cover != NULL) #endif nsec3_add_rrset(query, answer, AUTHORITY_SECTION, original->nsec3_cover); } } void nsec3_answer_delegation(struct query *query, struct answer *answer) { if(!query->zone->nsec3_soa_rr) return; nsec3_add_ds_proof(query, answer, query->delegation_domain, 1); } int domain_has_only_NSEC3(struct domain* domain, struct zone* zone) { /* check for only NSEC3/RRSIG */ rrset_type* rrset = domain->rrsets; int nsec3_seen = 0; while(rrset) { if(!zone || rrset->zone == zone) { if(rrset->rrs[0].type == TYPE_NSEC3) nsec3_seen = 1; else if(rrset->rrs[0].type != TYPE_RRSIG) return 0; } rrset = rrset->next; } return nsec3_seen; } void nsec3_answer_authoritative(struct domain** match, struct query *query, struct answer *answer, struct domain* closest_encloser, struct namedb* db, const dname_type* qname) { #ifndef FULL_PREHASH struct domain *cover_domain = NULL; int exact = 0; #endif if(!query->zone->nsec3_soa_rr) return; assert(match); /* there is a match, this has 1 RRset, which is NSEC3, but qtype is not. */ /* !is_existing: no RR types exist at the QNAME, nor at any descendant of QNAME */ if(*match && !(*match)->is_existing && #if 0 query->qtype != TYPE_NSEC3 && #endif domain_has_only_NSEC3(*match, query->zone)) { /* act as if the NSEC3 domain did not exist, name error */ *match = 0; /* all nsec3s are directly below the apex, that is closest encloser */ #ifdef FULL_PREHASH if(query->zone->apex->nsec3_is_exact) #else if(query->zone->apex->nsec3_cover) #endif nsec3_add_rrset(query, answer, AUTHORITY_SECTION, query->zone->apex->nsec3_cover); /* disprove the nsec3 record. */ nsec3_add_rrset(query, answer, AUTHORITY_SECTION, closest_encloser->nsec3_cover); /* disprove a wildcard */ #ifdef FULL_PREHASH nsec3_add_rrset(query, answer, AUTHORITY_SECTION, query->zone->apex->nsec3_wcard_child_cover); #else cover_domain = NULL; nsec3_hash_and_find_cover(query->region, db, domain_dname(closest_encloser), query->zone, &exact, &cover_domain); if (cover_domain) nsec3_add_rrset(query, answer, AUTHORITY_SECTION, cover_domain); #endif if (domain_wildcard_child(query->zone->apex)) { /* wildcard exists below the domain */ /* wildcard and nsec3 domain clash. server failure. */ RCODE_SET(query->packet, RCODE_SERVFAIL); } return; } else if(*match && (*match)->is_existing && #if 0 query->qtype != TYPE_NSEC3 && #endif domain_has_only_NSEC3(*match, query->zone)) { /* this looks like a NSEC3 domain, but is actually an empty non-terminal. */ nsec3_answer_nodata(query, answer, *match); return; } if(!*match) { /* name error, domain does not exist */ nsec3_add_closest_encloser_proof(query, answer, closest_encloser, db, qname); #ifdef FULL_PREHASH nsec3_add_rrset(query, answer, AUTHORITY_SECTION, closest_encloser->nsec3_wcard_child_cover); #else cover_domain = NULL; nsec3_hash_and_find_wild_cover(query->region, db, closest_encloser, query->zone, &exact, &cover_domain); if (cover_domain) nsec3_add_rrset(query, answer, AUTHORITY_SECTION, cover_domain); #endif } } #endif /* NSEC3 */ nsd-3.2.16/xfrd-notify.h0000664000175000017500000000356711761673243014022 0ustar matjematje/* * xfrd-notify.h - notify sending routines. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef XFRD_NOTIFY_H #define XFRD_NOTIFY_H #include "config.h" #include "tsig.h" #include "netio.h" #include "rbtree.h" struct nsd; struct region; struct xfrd_zone; struct zone_options; struct zone; struct xfrd_soa; struct acl_options; /** * This struct keeps track of outbound notifies for a zone. */ struct notify_zone_t { rbnode_t node; /* name of the zone */ const dname_type* apex; const char* apex_str; tsig_record_type notify_tsig; /* tsig state for notify */ struct zone_options* options; struct xfrd_soa *current_soa; /* current SOA in NSD */ /* notify sending handler */ /* Not saved on disk (i.e. kill of daemon stops notifies) */ netio_handler_type notify_send_handler; struct timespec notify_timeout; struct acl_options* notify_current; /* current slave to notify */ uint8_t notify_retry; /* how manieth retry in sending to current */ uint16_t notify_query_id; /* is this notify waiting for a socket? */ uint8_t is_waiting; /* next in the waiting list for the udp sockets */ struct notify_zone_t* waiting_next; }; /* initialise outgoing notifies */ void init_notify_send(rbtree_t* tree, netio_type* netio, region_type* region, const dname_type* apex, struct zone_options* options, struct zone* dbzone); /* send notifications to all in the notify list */ void xfrd_send_notify(rbtree_t* tree, const struct dname* apex, struct xfrd_soa* new_soa); /* handle soa update notify for a master zone. newsoa can be NULL. Makes sure that the soa (serial) has changed. Or drops notify. */ void notify_handle_master_zone_soainfo(rbtree_t* tree, const dname_type* apex, struct xfrd_soa* new_soa); /* close fds in use for notification sending */ void close_notify_fds(rbtree_t* tree); #endif /* XFRD_NOTIFY_H */ nsd-3.2.16/iterated_hash.h0000664000175000017500000000076011761673243014345 0ustar matjematje/* * iterated_hash.h -- nsec3 hash calculation. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * * With thanks to Ben Laurie. */ #ifndef ITERATED_HASH_H #define ITERATED_HASH_H #include "config.h" #ifdef NSEC3 #include int iterated_hash(unsigned char out[SHA_DIGEST_LENGTH], const unsigned char *salt,int saltlength, const unsigned char *in,int inlength,int iterations); #endif /* NSEC3 */ #endif /* ITERATED_HASH_H */ nsd-3.2.16/nsd-notify.c0000664000175000017500000002632512010733410013610 0ustar matjematje/* * nsd-notify.c -- sends notify(rfc1996) message to a list of servers * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include #include #ifdef HAVE_SYS_SELECT_H #include #endif #include #include #include #include #include #include #include #include #include #include #include #include #include "query.h" extern char *optarg; extern int optind; /* * Check if two getaddrinfo result lists have records with matching * ai_family fields. */ int check_matching_address_family(struct addrinfo *a, struct addrinfo *b); /* * Returns the first record with ai_family == FAMILY, or NULL if no * such record is found. */ struct addrinfo *find_by_address_family(struct addrinfo *addrs, int family); /* * Assigns pointers to hostname and port and wipes out the optional delimiter. */ void get_hostname_port_frm_str(char* arg, const char** hostname, const char** port); /* * Log a warning message. */ static void warning(const char *format, ...) ATTR_FORMAT(printf, 1, 2); static void warning(const char *format, ...) { va_list args; va_start(args, format); log_vmsg(LOG_WARNING, format, args); va_end(args); } static void usage(void) { fprintf(stderr, "usage: nsd-notify [-4] [-6] [-a src[@port] [-h] [-p \ port] [-y key:secret[:algo]] -z zone servers\n\n"); fprintf(stderr, "Send NOTIFY to secondary servers to force a zone \ update.\n"); fprintf(stderr, "Version %s. Report bugs to <%s>.\n\n", PACKAGE_VERSION, PACKAGE_BUGREPORT); fprintf(stderr, " -4 Send using IPv4.\n"); fprintf(stderr, " -6 Send using IPv6.\n"); fprintf(stderr, " -a src[@port] Local hostname/ip-address for " "the connection, including optional source port.\n"); fprintf(stderr, " -h Print this help " "information.\n"); fprintf(stderr, " -p port Port number of secondary " "server.\n"); fprintf(stderr, " -y key:secret[:algo] TSIG keyname, base64 secret " "blob and HMAC algorithm.\n" " If algo is not provided, " "HMAC-MD5 is assumed.\n"); fprintf(stderr, " -z zone Name of zone to be updated.\n"); fprintf(stderr, " servers IP addresses of the secondary " "server(s).\n"); exit(1); } /* * Send NOTIFY messages to the host, as in struct q, * waiting for ack packet (received in buffer answer). * Will retry transmission after a timeout. * addrstr is the string describing the address of the host. */ static void notify_host(int udp_s, struct query* q, struct query *answer, struct addrinfo* res, const dname_type *zone, const char* addrstr) { int timeout_retry = 1; /* seconds */ int num_retry = 6; /* times to try */ fd_set rfds; struct timeval tv; int retval = 0; ssize_t received = 0; int got_ack = 0; socklen_t addrlen = 0; while(!got_ack) { /* WE ARE READY SEND IT OUT */ if (sendto(udp_s, buffer_current(q->packet), buffer_remaining(q->packet), 0, res->ai_addr, res->ai_addrlen) == -1) { warning("send to %s failed: %s\n", addrstr, strerror(errno)); close(udp_s); return; } /* wait for ACK packet */ FD_ZERO(&rfds); FD_SET(udp_s, &rfds); tv.tv_sec = timeout_retry; /* seconds */ tv.tv_usec = 0; /* microseconds */ retval = select(udp_s + 1, &rfds, NULL, NULL, &tv); if (retval == -1) { warning("error waiting for reply from %s: %s\n", addrstr, strerror(errno)); close(udp_s); return; } if (retval == 0) { num_retry--; if(num_retry == 0) { warning("error: failed to send notify to %s.\n", addrstr); exit(1); } warning("timeout (%d s) expired, retry notify to %s.\n", timeout_retry, addrstr); } if (retval == 1) { got_ack = 1; } /* Exponential backoff */ timeout_retry *= 2; } /* receive reply */ addrlen = res->ai_addrlen; received = recvfrom(udp_s, buffer_begin(answer->packet), buffer_remaining(answer->packet), 0, res->ai_addr, &addrlen); res->ai_addrlen = addrlen; if (received == -1) { warning("recv %s failed: %s\n", addrstr, strerror(errno)); } else { /* check the answer */ if ((ID(q->packet) == ID(answer->packet)) && (OPCODE(answer->packet) == OPCODE_NOTIFY) && AA(answer->packet) && QR(answer->packet) && (RCODE(answer->packet) == RCODE_OK)) { /* no news is good news */ /* info("reply from: %s, acknowledges notify.\n", addrstr); */ } else { warning("bad reply from %s for zone %s, error response %s (%d).\n", addrstr, dname_to_string(zone, NULL), rcode2str(RCODE(answer->packet)), RCODE(answer->packet)); } } close(udp_s); } static tsig_key_type* add_key(region_type* region, const char* opt, tsig_algorithm_type** algo) { /* parse -y key:secret_base64 format option */ char* delim = strchr(opt, ':'); char* delim2 = NULL; tsig_key_type *key = (tsig_key_type*)region_alloc( region, sizeof(tsig_key_type)); size_t len; int sz; if (delim) { delim2 = strchr(delim+1, ':'); } if(!key) { log_msg(LOG_ERR, "region_alloc failed (add_key)"); return 0; } if(!delim) { log_msg(LOG_ERR, "bad key syntax %s", opt); return 0; } *delim = '\0'; key->name = dname_parse(region, opt); if(!key->name) { log_msg(LOG_ERR, "bad key name %s", opt); return 0; } *delim = ':'; if (!delim2) *algo = tsig_get_algorithm_by_name("hmac-md5"); else { char* by_name = (char*) malloc(sizeof(char)*(5+strlen(delim2))); snprintf(by_name, 5+strlen(delim2), "%s", delim2+1); *algo = tsig_get_algorithm_by_name(by_name); free(by_name); *delim2 = '\0'; } if (!(*algo)) { log_msg(LOG_ERR, "bad tsig algorithm %s", opt); return 0; } len = strlen(delim+1); key->data = region_alloc(region, len+1); if(!key->data) { log_msg(LOG_ERR, "region_alloc failed (add_key, key->data)"); return 0; } sz= b64_pton(delim+1, (uint8_t*)key->data, len); if(sz == -1) { log_msg(LOG_ERR, "bad key syntax %s", opt); return 0; } key->size = sz; tsig_add_key(key); return key; } int main (int argc, char *argv[]) { int c, udp_s; struct query q; struct query answer; const dname_type *zone = NULL; struct addrinfo hints, *res0, *res; int error; int default_family = DEFAULT_AI_FAMILY; const char *local_hostname = NULL; struct addrinfo *local_address, *local_addresses = NULL; const char *port = UDP_PORT; const char *local_port = NULL; region_type *region = region_create(xalloc, free); tsig_key_type *tsig_key = 0; tsig_record_type tsig; tsig_algorithm_type* algo = NULL; log_init("nsd-notify"); if(!tsig_init(region)) { log_msg(LOG_ERR, "could not init tsig\n"); exit(1); } srandom((unsigned long) getpid() * (unsigned long) time(NULL)); /* Parse the command line... */ while ((c = getopt(argc, argv, "46a:hp:y:z:")) != -1) { switch (c) { case '4': default_family = AF_INET; break; case '6': #ifdef INET6 default_family = AF_INET6; break; #else /* !INET6 */ log_msg(LOG_ERR, "IPv6 support not enabled\n"); exit(1); #endif /* !INET6 */ case 'a': get_hostname_port_frm_str((char *) optarg, &local_hostname, &local_port); break; case 'p': port = optarg; break; case 'y': if (!(tsig_key = add_key(region, optarg, &algo))) exit(1); break; case 'z': zone = dname_parse(region, optarg); if (!zone) { log_msg(LOG_ERR, "incorrect domain name '%s'", optarg); exit(1); } break; case 'h': default: usage(); } } argc -= optind; argv += optind; if (argc == 0 || zone == NULL) { usage(); } /* Initialize the query */ memset(&q, 0, sizeof(struct query)); q.addrlen = sizeof(q.addr); q.maxlen = 512; q.packet = buffer_create(region, QIOBUFSZ); memset(buffer_begin(q.packet), 0, buffer_remaining(q.packet)); /* Set up the header */ OPCODE_SET(q.packet, OPCODE_NOTIFY); ID_SET(q.packet, qid_generate()); AA_SET(q.packet); QDCOUNT_SET(q.packet, 1); buffer_skip(q.packet, QHEADERSZ); buffer_write(q.packet, dname_name(zone), zone->name_size); buffer_write_u16(q.packet, TYPE_SOA); buffer_write_u16(q.packet, CLASS_IN); if(tsig_key) { assert(algo); tsig_create_record(&tsig, region); tsig_init_record(&tsig, algo, tsig_key); tsig_init_query(&tsig, ID(q.packet)); tsig_prepare(&tsig); tsig_update(&tsig, q.packet, buffer_position(q.packet)); tsig_sign(&tsig); tsig_append_rr(&tsig, q.packet); ARCOUNT_SET(q.packet, ARCOUNT(q.packet) + 1); } buffer_flip(q.packet); /* initialize buffer for ack */ memset(&answer, 0, sizeof(struct query)); answer.addrlen = sizeof(answer.addr); answer.maxlen = 512; answer.packet = buffer_create(region, QIOBUFSZ); memset(buffer_begin(answer.packet), 0, buffer_remaining(answer.packet)); memset(&hints, 0, sizeof(hints)); hints.ai_family = default_family; hints.ai_socktype = SOCK_DGRAM; hints.ai_protocol = IPPROTO_UDP; if (local_hostname) { int rc = getaddrinfo(local_hostname, local_port, &hints, &local_addresses); if (rc) { warning("local hostname '%s' not found: %s", local_hostname, gai_strerror(rc)); } } for (/*empty*/; *argv; argv++) { error = getaddrinfo(*argv, port, &hints, &res0); if (error) { warning("skipping bad address %s: %s\n", *argv, gai_strerror(error)); continue; } if (local_addresses && !check_matching_address_family(res0, local_addresses)) { warning("no local address family matches remote " "address family, skipping server '%s'", *argv); continue; } for (res = res0; res; res = res->ai_next) { if (res->ai_addrlen > (socklen_t)sizeof(q.addr)) { continue; } /* * If a local address is specified, use an * address with the same family as the remote * address. */ local_address = find_by_address_family(local_addresses, res->ai_family); if (local_addresses && !local_address) { /* Continue with next remote address. */ continue; } udp_s = socket(res->ai_family, res->ai_socktype, res->ai_protocol); if (udp_s == -1) { warning("cannot create socket: %s\n", strerror(errno)); continue; } /* Bind socket to local address, if required. */ if (local_address && bind(udp_s, local_address->ai_addr, local_address->ai_addrlen) < 0) { warning("cannot bind to %s: %s\n", local_hostname, strerror(errno)); } memcpy(&q.addr, res->ai_addr, res->ai_addrlen); notify_host(udp_s, &q, &answer, res, zone, *argv); } freeaddrinfo(res0); } exit(0); } void get_hostname_port_frm_str(char* arg, const char** hostname, const char** port) { /* parse -a src[@port] option */ char* delim = strchr(arg, '@'); if (delim) { *delim = '\0'; *port = delim+1; } *hostname = arg; } int check_matching_address_family(struct addrinfo *a0, struct addrinfo *b0) { struct addrinfo *a; struct addrinfo *b; for (a = a0; a; a = a->ai_next) { for (b = b0; b; b = b->ai_next) { if (a->ai_family == b->ai_family) { return 1; } } } return 0; } struct addrinfo * find_by_address_family(struct addrinfo *addrs, int family) { for (; addrs; addrs = addrs->ai_next) { if (addrs->ai_family == family) { return addrs; } } return NULL; } nsd-3.2.16/region-allocator.h0000664000175000017500000000720111535444205014770 0ustar matjematje/* * region-allocator.h -- region based memory allocator. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _REGION_ALLOCATOR_H_ #define _REGION_ALLOCATOR_H_ #include typedef struct region region_type; #define DEFAULT_CHUNK_SIZE 4096 #define DEFAULT_LARGE_OBJECT_SIZE (DEFAULT_CHUNK_SIZE / 8) #define DEFAULT_INITIAL_CLEANUP_SIZE 16 /* * mmap allocator constants * */ #ifdef USE_MMAP_ALLOC /* header starts with size_t containing allocated size info and has at least 16 bytes to align the returned memory */ #define MMAP_ALLOC_HEADER_SIZE (sizeof(size_t) >= 16 ? (sizeof(size_t)) : 16) /* mmap allocator uses chunks of 32 4kB pages */ #define MMAP_ALLOC_CHUNK_SIZE ((32 * 4096) - MMAP_ALLOC_HEADER_SIZE) #define MMAP_ALLOC_LARGE_OBJECT_SIZE (MMAP_ALLOC_CHUNK_SIZE / 8) #define MMAP_ALLOC_INITIAL_CLEANUP_SIZE 16 #endif /* USE_MMAP_ALLOC */ /* * Create a new region. */ region_type *region_create(void *(*allocator)(size_t), void (*deallocator)(void *)); /* * Create a new region, with chunk size and large object size. * Note that large_object_size must be <= chunk_size. * Anything larger than the large object size is individually alloced. * large_object_size = chunk_size/8 is reasonable; * initial_cleanup_size is the number of prealloced ptrs for cleanups. * The cleanups are in a growing array, and it must start larger than zero. * If recycle is true, environmentally friendly memory recycling is be enabled. */ region_type *region_create_custom(void *(*allocator)(size_t), void (*deallocator)(void *), size_t chunk_size, size_t large_object_size, size_t initial_cleanup_size, int recycle); /* * Destroy REGION. All memory associated with REGION is freed as if * region_free_all was called. */ void region_destroy(region_type *region); /* * Add a cleanup to REGION. ACTION will be called with DATA as * parameter when the region is freed or destroyed. * * Returns 0 on failure. */ size_t region_add_cleanup(region_type *region, void (*action)(void *), void *data); /* * Remove cleanup, both action and data must match exactly. */ void region_remove_cleanup(region_type *region, void (*action)(void *), void *data); /* * Allocate SIZE bytes of memory inside REGION. The memory is * deallocated when region_free_all is called for this region. */ void *region_alloc(region_type *region, size_t size); /* * Allocate SIZE bytes of memory inside REGION and copy INIT into it. * The memory is deallocated when region_free_all is called for this * region. */ void *region_alloc_init(region_type *region, const void *init, size_t size); /* * Allocate SIZE bytes of memory inside REGION that are initialized to * 0. The memory is deallocated when region_free_all is called for * this region. */ void *region_alloc_zero(region_type *region, size_t size); /* * Run the cleanup actions and free all memory associated with REGION. */ void region_free_all(region_type *region); /* * Duplicate STRING and allocate the result in REGION. */ char *region_strdup(region_type *region, const char *string); /* * Recycle an allocated memory block. Pass size used to alloc it. * Does nothing if recycling is not enabled for the region. */ void region_recycle(region_type *region, void *block, size_t size); /* * Print some REGION statistics to OUT. */ void region_dump_stats(region_type *region, FILE *out); /* get size of recyclebin */ size_t region_get_recycle_size(region_type* region); /* Debug print REGION statistics to LOG. */ void region_log_stats(region_type *region); #endif /* _REGION_ALLOCATOR_H_ */ nsd-3.2.16/namedb.h0000664000175000017500000002440211762140165012757 0ustar matjematje/* * namedb.h -- nsd(8) internal namespace database definitions * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _NAMEDB_H_ #define _NAMEDB_H_ #include #include "dname.h" #include "dns.h" #include "rbtree.h" #include "util.h" struct zone_options; struct nsd_options; #define NAMEDB_MAGIC "NSDdbV08" #define NAMEDB_MAGIC_SIZE 8 typedef union rdata_atom rdata_atom_type; typedef struct rrset rrset_type; typedef struct rr rr_type; /* * A domain name table supporting fast insert and search operations. */ typedef struct domain_table domain_table_type; typedef struct domain domain_type; typedef struct zone zone_type; struct domain_table { region_type *region; rbtree_t *names_to_domains; domain_type *root; }; struct domain { rbnode_t node; domain_type *parent; domain_type *nextdiff; domain_type *wildcard_child_closest_match; rrset_type *rrsets; #ifdef NSEC3 domain_type *nsec3_cover; /* != NULL is exact cover */ #ifdef FULL_PREHASH /* (if nsec3 chain complete) nsec_cover is always the covering nsec3 record */ /* the nsec3 that covers the wildcard child of this domain. */ domain_type *nsec3_wcard_child_cover; /* for the DS case we must answer on the parent side of zone cut */ domain_type *nsec3_ds_parent_cover; /* the NSEC3 domain that has a hash-base32 <= than this dname. */ /* or NULL (no smaller one within this zone) * this variable is used to look up the NSEC3 record that matches * or covers a given b64-encoded-hash-string domain name. * The result of the lookup is stored in the *_cover variables. * The variable makes it possible to perform a rbtree lookup for * a name, then take this 'jump' to the previous element that contains * an NSEC3 record, with hopefully the correct parameters. */ domain_type *nsec3_lookup; #endif /* FULL_PREHASH */ #endif /* NSEC3 */ uint32_t number; /* Unique domain name number. */ /* * This domain name exists (see wildcard clarification draft). */ unsigned is_existing : 1; unsigned is_apex : 1; unsigned has_SOA : 1; #ifdef NSEC3 #ifdef FULL_PREHASH /* if the domain has an NSEC3 for it, use cover ptr to get it. */ unsigned nsec3_is_exact : 1; /* same but on parent side */ unsigned nsec3_ds_parent_is_exact : 1; #endif /* FULL_PREHASH */ #endif /* NSEC3 */ }; struct zone { zone_type *next; domain_type *apex; rrset_type *soa_rrset; rrset_type *soa_nx_rrset; /* see bug #103 */ rrset_type *ns_rrset; #ifdef NSEC3 rr_type *nsec3_soa_rr; /* rrset with SOA bit set */ domain_type *nsec3_last; /* last domain with nsec3, wraps */ #ifndef FULL_PREHASH rbtree_t *nsec3_domains; #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ #if defined(BIND8_STATS) && defined(USE_ZONE_STATS) struct nsdst st; #endif /* defined(BIND8_STATS) && defined(USE_ZONE_STATS) */ struct zone_options *opts; uint32_t number; uint8_t* dirty; /* array of dirty-flags, per child */ unsigned is_secure : 1; /* zone uses DNSSEC */ unsigned updated : 1; /* zone SOA was updated */ unsigned is_ok : 1; /* zone has not expired. */ }; #ifdef NSEC3 #ifndef FULL_PREHASH struct nsec3_domain { rbnode_t node; struct domain *nsec3_domain; struct domain *covers; }; struct nsec3_mod_domain { rbnode_t node; struct domain *domain; }; #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ /* a RR in DNS */ struct rr { domain_type *owner; rdata_atom_type *rdatas; uint32_t ttl; uint16_t type; uint16_t klass; uint16_t rdata_count; }; /* * An RRset consists of at least one RR. All RRs are from the same * zone. */ struct rrset { rrset_type *next; zone_type *zone; rr_type *rrs; uint16_t rr_count; }; /* * The field used is based on the wireformat the atom is stored in. * The allowed wireformats are defined by the rdata_wireformat_type * enumeration. */ union rdata_atom { /* RDATA_WF_COMPRESSED_DNAME, RDATA_WF_UNCOMPRESSED_DNAME */ domain_type *domain; /* Default. */ uint16_t *data; }; /* * Create a new domain_table containing only the root domain. */ domain_table_type *domain_table_create(region_type *region); /* * Search the domain table for a match and the closest encloser. */ int domain_table_search(domain_table_type *table, const dname_type *dname, domain_type **closest_match, domain_type **closest_encloser); /* * The number of domains stored in the table (minimum is one for the * root domain). */ static inline uint32_t domain_table_count(domain_table_type *table) { return table->names_to_domains->count; } /* * Find the specified dname in the domain_table. NULL is returned if * there is no exact match. */ domain_type *domain_table_find(domain_table_type *table, const dname_type *dname); /* * Insert a domain name in the domain table. If the domain name is * not yet present in the table it is copied and a new dname_info node * is created (as well as for the missing parent domain names, if * any). Otherwise the domain_type that is already in the * domain_table is returned. */ domain_type *domain_table_insert(domain_table_type *table, const dname_type *dname); /* * Iterate over all the domain names in the domain tree. */ typedef int (*domain_table_iterator_type)(domain_type *node, void *user_data); int domain_table_iterate(domain_table_type *table, domain_table_iterator_type iterator, void *user_data); /* * Add an RRset to the specified domain. Updates the is_existing flag * as required. */ void domain_add_rrset(domain_type *domain, rrset_type *rrset); rrset_type *domain_find_rrset(domain_type *domain, zone_type *zone, uint16_t type); rrset_type *domain_find_any_rrset(domain_type *domain, zone_type *zone); zone_type *domain_find_zone(domain_type *domain); zone_type *domain_find_parent_zone(zone_type *zone); #ifndef FULL_PREHASH domain_type *domain_find_zone_apex(domain_type *domain); #endif /* !FULL_PREHASH */ domain_type *domain_find_ns_rrsets(domain_type *domain, zone_type *zone, rrset_type **ns); int domain_is_glue(domain_type *domain, zone_type *zone); rrset_type *domain_find_non_cname_rrset(domain_type *domain, zone_type *zone); domain_type *domain_wildcard_child(domain_type *domain); int zone_is_secure(zone_type *zone); static inline const dname_type * domain_dname(domain_type *domain) { return (const dname_type *) domain->node.key; } static inline domain_type * domain_previous(domain_type *domain) { rbnode_t *prev = rbtree_previous((rbnode_t *) domain); return prev == RBTREE_NULL ? NULL : (domain_type *) prev; } static inline domain_type * domain_next(domain_type *domain) { rbnode_t *next = rbtree_next((rbnode_t *) domain); return next == RBTREE_NULL ? NULL : (domain_type *) next; } /* * The type covered by the signature in the specified RRSIG RR. */ uint16_t rr_rrsig_type_covered(rr_type *rr); typedef struct namedb namedb_type; struct namedb { region_type *region; #ifdef NSEC3 #ifndef FULL_PREHASH region_type *nsec3_region; region_type *nsec3_mod_region; rbtree_t *nsec3_mod_domains; #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ domain_table_type *domains; zone_type *zones; size_t zone_count; char *filename; FILE *fd; /* the timestamp on the ixfr.db file */ struct timeval diff_timestamp; /* the CRC on the nsd.db file and position of CRC in the db file */ uint32_t crc; off_t crc_pos; /* if diff_skip=1, diff_pos contains the nsd.diff place to continue */ uint8_t diff_skip; off_t diff_pos; }; static inline int rdata_atom_is_domain(uint16_t type, size_t index); static inline domain_type * rdata_atom_domain(rdata_atom_type atom) { return atom.domain; } static inline uint16_t rdata_atom_size(rdata_atom_type atom) { return *atom.data; } static inline uint8_t * rdata_atom_data(rdata_atom_type atom) { return (uint8_t *) (atom.data + 1); } /* * Find the zone for the specified DOMAIN in DB. */ zone_type *namedb_find_zone(namedb_type *db, domain_type *domain); /* dbcreate.c */ struct namedb *namedb_new(const char *filename); int namedb_save(struct namedb *db); void namedb_discard(struct namedb *db); /* dbaccess.c */ int namedb_lookup (struct namedb *db, const dname_type *dname, domain_type **closest_match, domain_type **closest_encloser); /* pass number of children (to alloc in dirty array */ struct namedb *namedb_open(const char *filename, struct nsd_options* opt, size_t num_children); void namedb_fd_close(struct namedb *db); void namedb_close(struct namedb *db); static inline int rdata_atom_is_domain(uint16_t type, size_t index) { const rrtype_descriptor_type *descriptor = rrtype_descriptor_by_type(type); return (index < descriptor->maximum && (descriptor->wireformat[index] == RDATA_WF_COMPRESSED_DNAME || descriptor->wireformat[index] == RDATA_WF_UNCOMPRESSED_DNAME)); } static inline rdata_wireformat_type rdata_atom_wireformat_type(uint16_t type, size_t index) { const rrtype_descriptor_type *descriptor = rrtype_descriptor_by_type(type); assert(index < descriptor->maximum); return (rdata_wireformat_type) descriptor->wireformat[index]; } static inline uint16_t rrset_rrtype(rrset_type *rrset) { assert(rrset); assert(rrset->rr_count > 0); return rrset->rrs[0].type; } static inline uint16_t rrset_rrclass(rrset_type *rrset) { assert(rrset); assert(rrset->rr_count > 0); return rrset->rrs[0].klass; } /** * Allocate and initialize a struct namedb. * Returns a pointer to a valid struct namedb or NULL on failure. */ struct namedb * namedb_create(void); /** * Destroy a struct namedb created using the namedb_create function. * Frees all regions associated with the namedb structure. */ void namedb_destroy(struct namedb *db); #ifdef NSEC3 #ifndef FULL_PREHASH int zone_nsec3_domains_create(struct namedb *db, struct zone *zone); int zone_nsec3_domains_destroy(struct namedb *db, struct zone *zone); int namedb_add_nsec3_domain(struct namedb *db, struct domain *domain, struct zone *zone); int namedb_del_nsec3_domain(struct namedb *db, struct domain *domain, struct zone *zone); int namedb_nsec3_mod_domains_create(struct namedb *db); int namedb_nsec3_mod_domains_destroy(struct namedb *db); int namedb_add_nsec3_mod_domain(struct namedb *db, struct domain *domain); #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ #endif nsd-3.2.16/netio.c0000664000175000017500000001610112160600467012636 0ustar matjematje/* * netio.c -- network I/O support. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include "netio.h" #include "util.h" #ifndef HAVE_PSELECT int pselect(int n, fd_set *readfds, fd_set *writefds, fd_set *exceptfds, const struct timespec *timeout, const sigset_t *sigmask); #else #include #endif netio_type * netio_create(region_type *region) { netio_type *result; assert(region); result = (netio_type *) region_alloc(region, sizeof(netio_type)); result->region = region; result->handlers = NULL; result->deallocated = NULL; result->dispatch_next = NULL; return result; } void netio_add_handler(netio_type *netio, netio_handler_type *handler) { netio_handler_list_type *elt; assert(netio); assert(handler); if (netio->deallocated) { /* * If we have deallocated handler list elements, reuse * the first one. */ elt = netio->deallocated; netio->deallocated = elt->next; } else { /* * Allocate a new one. */ elt = (netio_handler_list_type *) region_alloc( netio->region, sizeof(netio_handler_list_type)); } elt->next = netio->handlers; elt->handler = handler; netio->handlers = elt; } void netio_remove_handler(netio_type *netio, netio_handler_type *handler) { netio_handler_list_type **elt_ptr; assert(netio); assert(handler); for (elt_ptr = &netio->handlers; *elt_ptr; elt_ptr = &(*elt_ptr)->next) { if ((*elt_ptr)->handler == handler) { netio_handler_list_type *next = (*elt_ptr)->next; if ((*elt_ptr) == netio->dispatch_next) netio->dispatch_next = next; (*elt_ptr)->handler = NULL; (*elt_ptr)->next = netio->deallocated; netio->deallocated = *elt_ptr; *elt_ptr = next; break; } } } const struct timespec * netio_current_time(netio_type *netio) { assert(netio); if (!netio->have_current_time) { struct timeval current_timeval; if (gettimeofday(¤t_timeval, NULL) == -1) { log_msg(LOG_CRIT, "gettimeofday: %s, aborting.", strerror(errno)); abort(); } timeval_to_timespec(&netio->cached_current_time, ¤t_timeval); netio->have_current_time = 1; } return &netio->cached_current_time; } int netio_dispatch(netio_type *netio, const struct timespec *timeout, const sigset_t *sigmask) { fd_set readfds, writefds, exceptfds; int max_fd; int have_timeout = 0; struct timespec minimum_timeout; netio_handler_type *timeout_handler = NULL; netio_handler_list_type *elt; int rc; int result = 0; assert(netio); /* * Clear the cached current time. */ netio->have_current_time = 0; /* * Initialize the minimum timeout with the timeout parameter. */ if (timeout) { have_timeout = 1; memcpy(&minimum_timeout, timeout, sizeof(struct timespec)); } /* * Initialize the fd_sets and timeout based on the handler * information. */ max_fd = -1; FD_ZERO(&readfds); FD_ZERO(&writefds); FD_ZERO(&exceptfds); for (elt = netio->handlers; elt; elt = elt->next) { netio_handler_type *handler = elt->handler; if (handler->fd != -1 && handler->fd < (int)FD_SETSIZE) { if (handler->fd > max_fd) { max_fd = handler->fd; } if (handler->event_types & NETIO_EVENT_READ) { extern int slowaccept; extern struct timespec slowaccept_timeout; if ((handler->event_types & NETIO_EVENT_ACCEPT) && slowaccept) { if (timespec_compare(&slowaccept_timeout, netio_current_time(netio)) < 0) { slowaccept = 0; } if (slowaccept) { /** Timeout after slowaccept timeout. */ struct timespec relative; relative.tv_sec = slowaccept_timeout.tv_sec; relative.tv_nsec = slowaccept_timeout.tv_nsec; timespec_subtract(&relative, netio_current_time(netio)); if (!have_timeout || timespec_compare(&relative, &minimum_timeout) < 0) { have_timeout = 1; minimum_timeout.tv_sec = relative.tv_sec; minimum_timeout.tv_nsec = relative.tv_nsec; } } else { FD_SET(handler->fd, &readfds); } } else { /* Not accept event or not slow accept */ FD_SET(handler->fd, &readfds); } } if (handler->event_types & NETIO_EVENT_WRITE) { FD_SET(handler->fd, &writefds); } if (handler->event_types & NETIO_EVENT_EXCEPT) { FD_SET(handler->fd, &exceptfds); } } if (handler->timeout && (handler->event_types & NETIO_EVENT_TIMEOUT)) { struct timespec relative; relative.tv_sec = handler->timeout->tv_sec; relative.tv_nsec = handler->timeout->tv_nsec; timespec_subtract(&relative, netio_current_time(netio)); if (!have_timeout || timespec_compare(&relative, &minimum_timeout) < 0) { have_timeout = 1; minimum_timeout.tv_sec = relative.tv_sec; minimum_timeout.tv_nsec = relative.tv_nsec; timeout_handler = handler; } } } if (have_timeout && minimum_timeout.tv_sec < 0) { /* * On negative timeout for a handler, immediatly * dispatch the timeout event without checking for * other events. */ if (timeout_handler && (timeout_handler->event_types & NETIO_EVENT_TIMEOUT)) { timeout_handler->event_handler(netio, timeout_handler, NETIO_EVENT_TIMEOUT); } return result; } /* Check for events. */ rc = pselect(max_fd + 1, &readfds, &writefds, &exceptfds, have_timeout ? &minimum_timeout : NULL, sigmask); if (rc == -1) { if(errno == EINVAL || errno == EACCES || errno == EBADF) { log_msg(LOG_ERR, "fatal error pselect: %s.", strerror(errno)); exit(1); } return -1; } /* * Clear the cached current_time (pselect(2) may block for * some time so the cached value is likely to be old). */ netio->have_current_time = 0; if (rc == 0) { /* * No events before the minimum timeout expired. * Dispatch to handler if interested. */ if (timeout_handler && (timeout_handler->event_types & NETIO_EVENT_TIMEOUT)) { timeout_handler->event_handler(netio, timeout_handler, NETIO_EVENT_TIMEOUT); } } else { /* * Dispatch all the events to interested handlers * based on the fd_sets. Note that a handler might * deinstall itself, so store the next handler before * calling the current handler! */ assert(netio->dispatch_next == NULL); for (elt = netio->handlers; elt && rc; ) { netio_handler_type *handler = elt->handler; netio->dispatch_next = elt->next; if (handler->fd != -1 && handler->fd < (int)FD_SETSIZE) { netio_event_types_type event_types = NETIO_EVENT_NONE; if (FD_ISSET(handler->fd, &readfds)) { event_types |= NETIO_EVENT_READ; FD_CLR(handler->fd, &readfds); rc--; } if (FD_ISSET(handler->fd, &writefds)) { event_types |= NETIO_EVENT_WRITE; FD_CLR(handler->fd, &writefds); rc--; } if (FD_ISSET(handler->fd, &exceptfds)) { event_types |= NETIO_EVENT_EXCEPT; FD_CLR(handler->fd, &exceptfds); rc--; } if (event_types & handler->event_types) { handler->event_handler(netio, handler, event_types & handler->event_types); ++result; } } elt = netio->dispatch_next; } netio->dispatch_next = NULL; } return result; } nsd-3.2.16/zonec.c0000664000175000017500000011663012162277142012650 0ustar matjematje/* * zonec.c -- zone compiler. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include #include #ifdef HAVE_STRINGS_H #include #endif #include #include #include #include #ifdef HAVE_NETDB_H #include #endif #include "zonec.h" #include "dname.h" #include "dns.h" #include "namedb.h" #include "rdata.h" #include "region-allocator.h" #include "util.h" #include "options.h" #include "nsec3.h" #define ILNP_MAXDIGITS 4 #define ILNP_NUMGROUPS 4 const dname_type *error_dname; domain_type *error_domain; /* The database file... */ static const char *dbfile = 0; /* Some global flags... */ static int vflag = 0; /* if -v then print progress each 'progress' RRs */ static int progress = 10000; /* Total errors counter */ static long int totalerrors = 0; static long int totalrrs = 0; extern uint8_t nsecbits[NSEC_WINDOW_COUNT][NSEC_WINDOW_BITS_SIZE]; extern uint16_t nsec_highest_rcode; /* * Allocate SIZE+sizeof(uint16_t) bytes and store SIZE in the first * element. Return a pointer to the allocation. */ static uint16_t * alloc_rdata(region_type *region, size_t size) { uint16_t *result = region_alloc(region, sizeof(uint16_t) + size); *result = size; return result; } uint16_t * alloc_rdata_init(region_type *region, const void *data, size_t size) { uint16_t *result = region_alloc(region, sizeof(uint16_t) + size); *result = size; memcpy(result + 1, data, size); return result; } /* * These are parser function for generic zone file stuff. */ uint16_t * zparser_conv_hex(region_type *region, const char *hex, size_t len) { /* convert a hex value to wireformat */ uint16_t *r = NULL; uint8_t *t; int i; if (len % 2 != 0) { zc_error_prev_line("number of hex digits must be a multiple of 2"); } else if (len > MAX_RDLENGTH * 2) { zc_error_prev_line("hex data exceeds maximum rdata length (%d)", MAX_RDLENGTH); } else { /* the length part */ r = alloc_rdata(region, len/2); t = (uint8_t *)(r + 1); /* Now process octet by octet... */ while (*hex) { *t = 0; for (i = 16; i >= 1; i -= 15) { if (isxdigit((int)*hex)) { *t += hexdigit_to_int(*hex) * i; } else { zc_error_prev_line( "illegal hex character '%c'", (int) *hex); return NULL; } ++hex; } ++t; } } return r; } /* convert hex, precede by a 1-byte length */ uint16_t * zparser_conv_hex_length(region_type *region, const char *hex, size_t len) { uint16_t *r = NULL; uint8_t *t; int i; if (len % 2 != 0) { zc_error_prev_line("number of hex digits must be a multiple of 2"); } else if (len > 255 * 2) { zc_error_prev_line("hex data exceeds 255 bytes"); } else { uint8_t *l; /* the length part */ r = alloc_rdata(region, len/2+1); t = (uint8_t *)(r + 1); l = t++; *l = '\0'; /* Now process octet by octet... */ while (*hex) { *t = 0; for (i = 16; i >= 1; i -= 15) { if (isxdigit((int)*hex)) { *t += hexdigit_to_int(*hex) * i; } else { zc_error_prev_line( "illegal hex character '%c'", (int) *hex); return NULL; } ++hex; } ++t; ++*l; } } return r; } uint16_t * zparser_conv_time(region_type *region, const char *time) { /* convert a time YYHM to wireformat */ uint16_t *r = NULL; struct tm tm; /* Try to scan the time... */ if (!strptime(time, "%Y%m%d%H%M%S", &tm)) { zc_error_prev_line("date and time is expected"); } else { uint32_t l = htonl(mktime_from_utc(&tm)); r = alloc_rdata_init(region, &l, sizeof(l)); } return r; } uint16_t * zparser_conv_services(region_type *region, const char *protostr, char *servicestr) { /* * Convert a protocol and a list of service port numbers * (separated by spaces) in the rdata to wireformat */ uint16_t *r = NULL; uint8_t *p; uint8_t bitmap[65536/8]; char sep[] = " "; char *word; int max_port = -8; /* convert a protocol in the rdata to wireformat */ struct protoent *proto; memset(bitmap, 0, sizeof(bitmap)); proto = getprotobyname(protostr); if (!proto) { proto = getprotobynumber(atoi(protostr)); } if (!proto) { zc_error_prev_line("unknown protocol '%s'", protostr); return NULL; } for (word = strtok(servicestr, sep); word; word = strtok(NULL, sep)) { struct servent *service; int port; service = getservbyname(word, proto->p_name); if (service) { /* Note: ntohs not ntohl! Strange but true. */ port = ntohs((uint16_t) service->s_port); } else { char *end; port = strtol(word, &end, 10); if (*end != '\0') { zc_error_prev_line("unknown service '%s' for protocol '%s'", word, protostr); continue; } } if (port < 0 || port > 65535) { zc_error_prev_line("bad port number %d", port); } else { set_bit(bitmap, port); if (port > max_port) max_port = port; } } r = alloc_rdata(region, sizeof(uint8_t) + max_port / 8 + 1); p = (uint8_t *) (r + 1); *p = proto->p_proto; memcpy(p + 1, bitmap, *r); return r; } uint16_t * zparser_conv_serial(region_type *region, const char *serialstr) { uint16_t *r = NULL; uint32_t serial; const char *t; serial = strtoserial(serialstr, &t); if (*t != '\0') { zc_error_prev_line("serial is expected"); } else { serial = htonl(serial); r = alloc_rdata_init(region, &serial, sizeof(serial)); } return r; } uint16_t * zparser_conv_period(region_type *region, const char *periodstr) { /* convert a time period (think TTL's) to wireformat) */ uint16_t *r = NULL; uint32_t period; const char *end; /* Allocate required space... */ period = strtottl(periodstr, &end); if (*end != '\0') { zc_error_prev_line("time period is expected"); } else { period = htonl(period); r = alloc_rdata_init(region, &period, sizeof(period)); } return r; } uint16_t * zparser_conv_short(region_type *region, const char *text) { uint16_t *r = NULL; uint16_t value; char *end; value = htons((uint16_t) strtol(text, &end, 10)); if (*end != '\0') { zc_error_prev_line("integer value is expected"); } else { r = alloc_rdata_init(region, &value, sizeof(value)); } return r; } uint16_t * zparser_conv_byte(region_type *region, const char *text) { uint16_t *r = NULL; uint8_t value; char *end; value = (uint8_t) strtol(text, &end, 10); if (*end != '\0') { zc_error_prev_line("integer value is expected"); } else { r = alloc_rdata_init(region, &value, sizeof(value)); } return r; } uint16_t * zparser_conv_algorithm(region_type *region, const char *text) { const lookup_table_type *alg; uint8_t id; alg = lookup_by_name(dns_algorithms, text); if (alg) { id = (uint8_t) alg->id; } else { char *end; id = (uint8_t) strtol(text, &end, 10); if (*end != '\0') { zc_error_prev_line("algorithm is expected"); return NULL; } } return alloc_rdata_init(region, &id, sizeof(id)); } uint16_t * zparser_conv_certificate_type(region_type *region, const char *text) { /* convert a algoritm string to integer */ const lookup_table_type *type; uint16_t id; type = lookup_by_name(dns_certificate_types, text); if (type) { id = htons((uint16_t) type->id); } else { char *end; id = htons((uint16_t) strtol(text, &end, 10)); if (*end != '\0') { zc_error_prev_line("certificate type is expected"); return NULL; } } return alloc_rdata_init(region, &id, sizeof(id)); } uint16_t * zparser_conv_a(region_type *region, const char *text) { in_addr_t address; uint16_t *r = NULL; if (inet_pton(AF_INET, text, &address) != 1) { zc_error_prev_line("invalid IPv4 address '%s'", text); } else { r = alloc_rdata_init(region, &address, sizeof(address)); } return r; } uint16_t * zparser_conv_aaaa(region_type *region, const char *text) { uint8_t address[IP6ADDRLEN]; uint16_t *r = NULL; if (inet_pton(AF_INET6, text, address) != 1) { zc_error_prev_line("invalid IPv6 address '%s'", text); } else { r = alloc_rdata_init(region, address, sizeof(address)); } return r; } uint16_t * zparser_conv_ilnp64(region_type *region, const char *text) { uint16_t *r = NULL; int ngroups, num; unsigned long hex; const char *ch; int c; char digits[ILNP_MAXDIGITS+1]; unsigned int ui[ILNP_NUMGROUPS]; uint16_t a[ILNP_NUMGROUPS]; ngroups = 1; /* Always at least one group */ num = 0; for (ch = text; *ch != '\0'; ch++) { if (*ch == ':') { if (num <= 0) { zc_error_prev_line("ilnp64: empty group of " "digits is not allowed"); return NULL; } digits[num] = '\0'; hex = (unsigned long) strtol(digits, NULL, 16); num = 0; ui[ngroups - 1] = hex; if (ngroups >= ILNP_NUMGROUPS) { zc_error_prev_line("ilnp64: more than %d groups " "of digits", ILNP_NUMGROUPS); return NULL; } ngroups++; } else { /* Our grammar is stricter than the one accepted by * strtol. */ c = (int) *ch; if (!isxdigit(c)) { zc_error_prev_line("ilnp64: invalid " "(non-hexadecimal) character %c", c); return NULL; } if (num >= ILNP_MAXDIGITS) { zc_error_prev_line("ilnp64: more than %d digits " "in a group", ILNP_MAXDIGITS); return NULL; } digits[num++] = *ch; } } if (num <= 0) { zc_error_prev_line("ilnp64: empty group of digits is not " "allowed"); return NULL; } digits[num] = '\0'; hex = (unsigned long) strtol(digits, NULL, 16); ui[ngroups - 1] = hex; if (ngroups < 4) { zc_error_prev_line("ilnp64: less than %d groups of digits", ILNP_NUMGROUPS); return NULL; } a[0] = htons(ui[0]); a[1] = htons(ui[1]); a[2] = htons(ui[2]); a[3] = htons(ui[3]); r = alloc_rdata_init(region, a, sizeof(a)); return r; } #ifdef DRAFT_RRTYPES static uint16_t * zparser_conv_eui48(region_type *region, const char *text) { uint8_t nums[6]; uint16_t *r = NULL; unsigned int a, b, c, d, e, f; int l; if (sscanf(text, "%2x-%2x-%2x-%2x-%2x-%2x%n", &a, &b, &c, &d, &e, &f, &l) != 6 || l != (int)strlen(text)){ zc_error_prev_line("eui48: invalid rr"); return NULL; } nums[0] = (uint8_t)a; nums[1] = (uint8_t)b; nums[2] = (uint8_t)c; nums[3] = (uint8_t)d; nums[4] = (uint8_t)e; nums[5] = (uint8_t)f; r = alloc_rdata_init(region, nums, sizeof(nums)); return r; } static uint16_t * zparser_conv_eui64(region_type *region, const char *text) { uint8_t nums[8]; uint16_t *r = NULL; unsigned int a, b, c, d, e, f, g, h; int l; if (sscanf(text, "%2x-%2x-%2x-%2x-%2x-%2x-%2x-%2x%n", &a, &b, &c, &d, &e, &f, &g, &h, &l) != 8 || l != (int)strlen(text)) { zc_error_prev_line("eui64: invalid rr"); return NULL; } nums[0] = (uint8_t)a; nums[1] = (uint8_t)b; nums[2] = (uint8_t)c; nums[3] = (uint8_t)d; nums[4] = (uint8_t)e; nums[5] = (uint8_t)f; nums[6] = (uint8_t)g; nums[7] = (uint8_t)h; r = alloc_rdata_init(region, nums, sizeof(nums)); return r; } uint16_t * zparser_conv_eui(region_type *region, const char *text, size_t len) { uint16_t *r = NULL; int nnum, num; const char* ch; nnum = len/8; num = 1; for (ch = text; *ch != '\0'; ch++) { int c = (int) *ch; if (*ch == '-') { num++; } else if (!isxdigit(c)) { zc_error_prev_line("eui%u: invalid (non-hexadecimal) " "character %c", (unsigned) len, c); return NULL; } } if (num != nnum) { zc_error_prev_line("eui%u: wrong number of hex numbers", (unsigned) len); return NULL; } switch (len) { case 48: r = zparser_conv_eui48(region, text); break; case 64: r = zparser_conv_eui64(region, text); break; default: zc_error_prev_line("eui%u: invalid length", (unsigned) len); return NULL; break; } return r; } #endif uint16_t * zparser_conv_text(region_type *region, const char *text, size_t len) { uint16_t *r = NULL; uint8_t *p; if (len > 255) { zc_error_prev_line("text string is longer than 255 characters," " try splitting it into multiple parts"); len = 255; } r = alloc_rdata(region, len + 1); p = (uint8_t *) (r + 1); *p = len; memcpy(p + 1, text, len); return r; } uint16_t * zparser_conv_dns_name(region_type *region, const uint8_t* name, size_t len) { uint16_t* r = NULL; uint8_t* p = NULL; r = alloc_rdata(region, len); p = (uint8_t *) (r + 1); memcpy(p, name, len); return r; } uint16_t * zparser_conv_b32(region_type *region, const char *b32) { uint8_t buffer[B64BUFSIZE]; uint16_t *r = NULL; int i; if(strcmp(b32, "-") == 0) { return alloc_rdata_init(region, "", 1); } i = b32_pton(b32, buffer+1, B64BUFSIZE-1); if (i == -1 || i > 255) { zc_error_prev_line("invalid base32 data"); } else { buffer[0] = i; /* store length byte */ r = alloc_rdata_init(region, buffer, i+1); } return r; } uint16_t * zparser_conv_b64(region_type *region, const char *b64) { uint8_t buffer[B64BUFSIZE]; uint16_t *r = NULL; int i; i = b64_pton(b64, buffer, B64BUFSIZE); if (i == -1) { zc_error_prev_line("invalid base64 data"); } else { r = alloc_rdata_init(region, buffer, i); } return r; } uint16_t * zparser_conv_rrtype(region_type *region, const char *text) { uint16_t *r = NULL; uint16_t type = rrtype_from_string(text); if (type == 0) { zc_error_prev_line("unrecognized RR type '%s'", text); } else { type = htons(type); r = alloc_rdata_init(region, &type, sizeof(type)); } return r; } uint16_t * zparser_conv_nxt(region_type *region, uint8_t nxtbits[]) { /* nxtbits[] consists of 16 bytes with some zero's in it * copy every byte with zero to r and write the length in * the first byte */ uint16_t i; uint16_t last = 0; for (i = 0; i < 16; i++) { if (nxtbits[i] != 0) last = i + 1; } return alloc_rdata_init(region, nxtbits, last); } /* we potentially have 256 windows, each one is numbered. empty ones * should be discarded */ uint16_t * zparser_conv_nsec(region_type *region, uint8_t nsecbits[NSEC_WINDOW_COUNT][NSEC_WINDOW_BITS_SIZE]) { /* nsecbits contains up to 64K of bits which represent the * types available for a name. Walk the bits according to * nsec++ draft from jakob */ uint16_t *r; uint8_t *ptr; size_t i,j; uint16_t window_count = 0; uint16_t total_size = 0; uint16_t window_max = 0; /* The used windows. */ int used[NSEC_WINDOW_COUNT]; /* The last byte used in each the window. */ int size[NSEC_WINDOW_COUNT]; window_max = 1 + (nsec_highest_rcode / 256); /* used[i] is the i-th window included in the nsec * size[used[0]] is the size of window 0 */ /* walk through the 256 windows */ for (i = 0; i < window_max; ++i) { int empty_window = 1; /* check each of the 32 bytes */ for (j = 0; j < NSEC_WINDOW_BITS_SIZE; ++j) { if (nsecbits[i][j] != 0) { size[i] = j + 1; empty_window = 0; } } if (!empty_window) { used[window_count] = i; window_count++; } } for (i = 0; i < window_count; ++i) { total_size += sizeof(uint16_t) + size[used[i]]; } r = alloc_rdata(region, total_size); ptr = (uint8_t *) (r + 1); /* now walk used and copy it */ for (i = 0; i < window_count; ++i) { ptr[0] = used[i]; ptr[1] = size[used[i]]; memcpy(ptr + 2, &nsecbits[used[i]], size[used[i]]); ptr += size[used[i]] + 2; } return r; } /* Parse an int terminated in the specified range. */ static int parse_int(const char *str, char **end, int *result, const char *name, int min, int max) { *result = (int) strtol(str, end, 10); if (*result < min || *result > max) { zc_error_prev_line("%s must be within the range [%d .. %d]", name, min, max); return 0; } else { return 1; } } /* RFC1876 conversion routines */ static unsigned int poweroften[10] = {1, 10, 100, 1000, 10000, 100000, 1000000,10000000,100000000,1000000000}; /* * Converts ascii size/precision X * 10**Y(cm) to 0xXY. * Sets the given pointer to the last used character. * */ static uint8_t precsize_aton (char *cp, char **endptr) { unsigned int mval = 0, cmval = 0; uint8_t retval = 0; int exponent; int mantissa; while (isdigit((int)*cp)) mval = mval * 10 + hexdigit_to_int(*cp++); if (*cp == '.') { /* centimeters */ cp++; if (isdigit((int)*cp)) { cmval = hexdigit_to_int(*cp++) * 10; if (isdigit((int)*cp)) { cmval += hexdigit_to_int(*cp++); } } } if(mval >= poweroften[7]) { /* integer overflow possible for *100 */ mantissa = mval / poweroften[7]; exponent = 9; /* max */ } else { cmval = (mval * 100) + cmval; for (exponent = 0; exponent < 9; exponent++) if (cmval < poweroften[exponent+1]) break; mantissa = cmval / poweroften[exponent]; } if (mantissa > 9) mantissa = 9; retval = (mantissa << 4) | exponent; if (*cp == 'm') cp++; *endptr = cp; return (retval); } /* * Parses a specific part of rdata. * * Returns: * * number of elements parsed * zero on error * */ uint16_t * zparser_conv_loc(region_type *region, char *str) { uint16_t *r; uint32_t *p; int i; int deg, min, secs; /* Secs is stored times 1000. */ uint32_t lat = 0, lon = 0, alt = 0; /* encoded defaults: version=0 sz=1m hp=10000m vp=10m */ uint8_t vszhpvp[4] = {0, 0x12, 0x16, 0x13}; char *start; double d; for(;;) { deg = min = secs = 0; /* Degrees */ if (*str == '\0') { zc_error_prev_line("unexpected end of LOC data"); return NULL; } if (!parse_int(str, &str, °, "degrees", 0, 180)) return NULL; if (!isspace((int)*str)) { zc_error_prev_line("space expected after degrees"); return NULL; } ++str; /* Minutes? */ if (isdigit((int)*str)) { if (!parse_int(str, &str, &min, "minutes", 0, 60)) return NULL; if (!isspace((int)*str)) { zc_error_prev_line("space expected after minutes"); return NULL; } ++str; } /* Seconds? */ if (isdigit((int)*str)) { start = str; if (!parse_int(str, &str, &i, "seconds", 0, 60)) { return NULL; } if (*str == '.' && !parse_int(str + 1, &str, &i, "seconds fraction", 0, 999)) { return NULL; } if (!isspace((int)*str)) { zc_error_prev_line("space expected after seconds"); return NULL; } /* No need for precision specifiers, it's a double */ if (sscanf(start, "%lf", &d) != 1) { zc_error_prev_line("error parsing seconds"); } if (d < 0.0 || d > 60.0) { zc_error_prev_line("seconds not in range 0.0 .. 60.0"); } secs = (int) (d * 1000.0 + 0.5); ++str; } switch(*str) { case 'N': case 'n': lat = ((uint32_t)1<<31) + (deg * 3600000 + min * 60000 + secs); break; case 'E': case 'e': lon = ((uint32_t)1<<31) + (deg * 3600000 + min * 60000 + secs); break; case 'S': case 's': lat = ((uint32_t)1<<31) - (deg * 3600000 + min * 60000 + secs); break; case 'W': case 'w': lon = ((uint32_t)1<<31) - (deg * 3600000 + min * 60000 + secs); break; default: zc_error_prev_line("invalid latitude/longtitude: '%c'", *str); return NULL; } ++str; if (lat != 0 && lon != 0) break; if (!isspace((int)*str)) { zc_error_prev_line("space expected after latitude/longitude"); return NULL; } ++str; } /* Altitude */ if (*str == '\0') { zc_error_prev_line("unexpected end of LOC data"); return NULL; } if (!isspace((int)*str)) { zc_error_prev_line("space expected before altitude"); return NULL; } ++str; start = str; /* Sign */ if (*str == '+' || *str == '-') { ++str; } /* Meters of altitude... */ (void) strtol(str, &str, 10); switch(*str) { case ' ': case '\0': case 'm': break; case '.': if (!parse_int(str + 1, &str, &i, "altitude fraction", 0, 99)) { return NULL; } if (!isspace((int)*str) && *str != '\0' && *str != 'm') { zc_error_prev_line("altitude fraction must be a number"); return NULL; } break; default: zc_error_prev_line("altitude must be expressed in meters"); return NULL; } if (!isspace((int)*str) && *str != '\0') ++str; if (sscanf(start, "%lf", &d) != 1) { zc_error_prev_line("error parsing altitude"); } alt = (uint32_t) (10000000.0 + d * 100 + 0.5); if (!isspace((int)*str) && *str != '\0') { zc_error_prev_line("unexpected character after altitude"); return NULL; } /* Now parse size, horizontal precision and vertical precision if any */ for(i = 1; isspace((int)*str) && i <= 3; i++) { vszhpvp[i] = precsize_aton(str + 1, &str); if (!isspace((int)*str) && *str != '\0') { zc_error_prev_line("invalid size or precision"); return NULL; } } /* Allocate required space... */ r = alloc_rdata(region, 16); p = (uint32_t *) (r + 1); memmove(p, vszhpvp, 4); write_uint32(p + 1, lat); write_uint32(p + 2, lon); write_uint32(p + 3, alt); return r; } /* * Convert an APL RR RDATA element. */ uint16_t * zparser_conv_apl_rdata(region_type *region, char *str) { int negated = 0; uint16_t address_family; uint8_t prefix; uint8_t maximum_prefix; uint8_t length; uint8_t address[IP6ADDRLEN]; char *colon = strchr(str, ':'); char *slash = strchr(str, '/'); int af; int rc; uint16_t rdlength; uint16_t *r; uint8_t *t; char *end; long p; if (!colon) { zc_error("address family separator is missing"); return NULL; } if (!slash) { zc_error("prefix separator is missing"); return NULL; } *colon = '\0'; *slash = '\0'; if (*str == '!') { negated = 1; ++str; } if (strcmp(str, "1") == 0) { address_family = htons(1); af = AF_INET; length = sizeof(in_addr_t); maximum_prefix = length * 8; } else if (strcmp(str, "2") == 0) { address_family = htons(2); af = AF_INET6; length = IP6ADDRLEN; maximum_prefix = length * 8; } else { zc_error("invalid address family '%s'", str); return NULL; } rc = inet_pton(af, colon + 1, address); if (rc == 0) { zc_error("invalid address '%s'", colon + 1); return NULL; } else if (rc == -1) { zc_error("inet_pton failed: %s", strerror(errno)); return NULL; } /* Strip trailing zero octets. */ while (length > 0 && address[length - 1] == 0) --length; p = strtol(slash + 1, &end, 10); if (p < 0 || p > maximum_prefix) { zc_error("prefix not in the range 0 .. %d", maximum_prefix); return NULL; } else if (*end != '\0') { zc_error("invalid prefix '%s'", slash + 1); return NULL; } prefix = (uint8_t) p; rdlength = (sizeof(address_family) + sizeof(prefix) + sizeof(length) + length); r = alloc_rdata(region, rdlength); t = (uint8_t *) (r + 1); memcpy(t, &address_family, sizeof(address_family)); t += sizeof(address_family); memcpy(t, &prefix, sizeof(prefix)); t += sizeof(prefix); memcpy(t, &length, sizeof(length)); if (negated) { *t |= APL_NEGATION_MASK; } t += sizeof(length); memcpy(t, address, length); return r; } /* * Below some function that also convert but not to wireformat * but to "normal" (int,long,char) types */ uint32_t zparser_ttl2int(const char *ttlstr, int* error) { /* convert a ttl value to a integer * return the ttl in a int * -1 on error */ uint32_t ttl; const char *t; ttl = strtottl(ttlstr, &t); if (*t != 0) { zc_error_prev_line("invalid TTL value: %s",ttlstr); *error = 1; } return ttl; } void zadd_rdata_wireformat(uint16_t *data) { if (parser->current_rr.rdata_count >= MAXRDATALEN) { zc_error_prev_line("too many rdata elements"); } else { parser->current_rr.rdatas[parser->current_rr.rdata_count].data = data; ++parser->current_rr.rdata_count; } } /** * Used for TXT RR's to grow with undefined number of strings. */ void zadd_rdata_txt_wireformat(uint16_t *data, int first) { rdata_atom_type *rd; /* First STR in str_seq, allocate 65K in first unused rdata * else find last used rdata */ if (first) { rd = &parser->current_rr.rdatas[parser->current_rr.rdata_count]; if ((rd->data = (uint16_t *) region_alloc(parser->rr_region, sizeof(uint16_t) + 65535 * sizeof(uint8_t))) == NULL) { zc_error_prev_line("Could not allocate memory for TXT RR"); return; } parser->current_rr.rdata_count++; rd->data[0] = 0; } else rd = &parser->current_rr.rdatas[parser->current_rr.rdata_count-1]; if ((size_t)rd->data[0] + (size_t)data[0] > 65535) { zc_error_prev_line("too large rdata element"); return; } memcpy((uint8_t *)rd->data + 2 + rd->data[0], data + 1, data[0]); rd->data[0] += data[0]; } /** * Clean up after last call of zadd_rdata_txt_wireformat */ void zadd_rdata_txt_clean_wireformat() { uint16_t *tmp_data; rdata_atom_type *rd = &parser->current_rr.rdatas[parser->current_rr.rdata_count-1]; if ((tmp_data = (uint16_t *) region_alloc(parser->region, rd->data[0] + 2)) != NULL) { memcpy(tmp_data, rd->data, rd->data[0] + 2); rd->data = tmp_data; } else { /* We could not get memory in non-volatile region */ zc_error_prev_line("could not allocate memory for rdata"); return; } } void zadd_rdata_domain(domain_type *domain) { if (parser->current_rr.rdata_count >= MAXRDATALEN) { zc_error_prev_line("too many rdata elements"); } else { parser->current_rr.rdatas[parser->current_rr.rdata_count].domain = domain; ++parser->current_rr.rdata_count; } } void parse_unknown_rdata(uint16_t type, uint16_t *wireformat) { buffer_type packet; uint16_t size; ssize_t rdata_count; ssize_t i; rdata_atom_type *rdatas; if (wireformat) { size = *wireformat; } else { return; } buffer_create_from(&packet, wireformat + 1, *wireformat); rdata_count = rdata_wireformat_to_rdata_atoms(parser->region, parser->db->domains, type, size, &packet, &rdatas); if (rdata_count == -1) { zc_error_prev_line("bad unknown RDATA"); return; } for (i = 0; i < rdata_count; ++i) { if (rdata_atom_is_domain(type, i)) { zadd_rdata_domain(rdatas[i].domain); } else { zadd_rdata_wireformat(rdatas[i].data); } } } /* * Compares two rdata arrays. * * Returns: * * zero if they are equal * non-zero if not * */ static int zrdatacmp(uint16_t type, rr_type *a, rr_type *b) { int i = 0; assert(a); assert(b); /* One is shorter than another */ if (a->rdata_count != b->rdata_count) return 1; /* Compare element by element */ for (i = 0; i < a->rdata_count; ++i) { if (rdata_atom_is_domain(type, i)) { if (rdata_atom_domain(a->rdatas[i]) != rdata_atom_domain(b->rdatas[i])) { return 1; } } else { if (rdata_atom_size(a->rdatas[i]) != rdata_atom_size(b->rdatas[i])) { return 1; } if (memcmp(rdata_atom_data(a->rdatas[i]), rdata_atom_data(b->rdatas[i]), rdata_atom_size(a->rdatas[i])) != 0) { return 1; } } } /* Otherwise they are equal */ return 0; } /* * * Opens a zone file. * * Returns: * * - pointer to the parser structure * - NULL on error and errno set * */ static int zone_open(const char *filename, uint32_t ttl, uint16_t klass, const dname_type *origin) { /* Open the zone file... */ if (strcmp(filename, "-") == 0) { yyin = stdin; filename = ""; } else if (!(yyin = fopen(filename, "r"))) { return 0; } /* Open the network database */ setprotoent(1); setservent(1); zparser_init(filename, ttl, klass, origin); return 1; } void set_bitnsec(uint8_t bits[NSEC_WINDOW_COUNT][NSEC_WINDOW_BITS_SIZE], uint16_t index) { /* * The bits are counted from left to right, so bit #0 is the * left most bit. */ uint8_t window = index / 256; uint8_t bit = index % 256; bits[window][bit / 8] |= (1 << (7 - bit % 8)); } static void cleanup_rrset(void *r) { rrset_type *rrset = (rrset_type *) r; if (rrset) { free(rrset->rrs); } } int process_rr(void) { zone_type *zone = parser->current_zone; rr_type *rr = &parser->current_rr; rrset_type *rrset; size_t max_rdlength; int i; rrtype_descriptor_type *descriptor = rrtype_descriptor_by_type(rr->type); /* We only support IN class */ if (rr->klass != CLASS_IN) { if(zone->opts && zone->opts->request_xfr) zc_warning_prev_line("only class IN is supported"); else zc_error_prev_line("only class IN is supported"); return 0; } /* Make sure the maximum RDLENGTH does not exceed 65535 bytes. */ max_rdlength = rdata_maximum_wireformat_size( descriptor, rr->rdata_count, rr->rdatas); if (max_rdlength > MAX_RDLENGTH) { zc_error_prev_line("maximum rdata length exceeds %d octets", MAX_RDLENGTH); return 0; } /* Do we have the zone already? */ if (!zone) { zone = (zone_type *) region_alloc(parser->region, sizeof(zone_type)); zone->apex = parser->default_apex; zone->soa_rrset = NULL; zone->soa_nx_rrset = NULL; zone->ns_rrset = NULL; zone->opts = NULL; zone->is_secure = 0; zone->updated = 1; zone->next = parser->db->zones; parser->db->zones = zone; parser->current_zone = zone; } if (rr->type == TYPE_SOA) { /* * This is a SOA record, start a new zone or continue * an existing one. */ if (rr->owner->is_apex) { if(zone->opts && zone->opts->request_xfr) zc_warning_prev_line("this SOA record was already encountered"); else zc_error_prev_line("this SOA record was already encountered"); } else if (rr->owner == parser->default_apex) { zone->apex = rr->owner; rr->owner->is_apex = 1; } /* parser part */ parser->current_zone = zone; } if (!dname_is_subdomain(domain_dname(rr->owner), domain_dname(zone->apex))) { if(zone->opts && zone->opts->request_xfr) zc_warning_prev_line("out of zone data"); else zc_error_prev_line("out of zone data"); return 0; } /* Do we have this type of rrset already? */ rrset = domain_find_rrset(rr->owner, zone, rr->type); if (!rrset) { rrset = (rrset_type *) region_alloc(parser->region, sizeof(rrset_type)); rrset->zone = zone; rrset->rr_count = 1; rrset->rrs = (rr_type *) xalloc(sizeof(rr_type)); rrset->rrs[0] = *rr; region_add_cleanup(parser->region, cleanup_rrset, rrset); /* Add it */ domain_add_rrset(rr->owner, rrset); } else { if (rr->type != TYPE_RRSIG && rrset->rrs[0].ttl != rr->ttl) { zc_warning_prev_line( "TTL does not match the TTL of the RRset"); } /* Search for possible duplicates... */ for (i = 0; i < rrset->rr_count; i++) { if (!zrdatacmp(rr->type, rr, &rrset->rrs[i])) { break; } } /* Discard the duplicates... */ if (i < rrset->rr_count) { return 0; } /* Add it... */ rrset->rrs = (rr_type *) xrealloc( rrset->rrs, (rrset->rr_count + 1) * sizeof(rr_type)); rrset->rrs[rrset->rr_count] = *rr; ++rrset->rr_count; } if(rr->type == TYPE_DNAME && rrset->rr_count > 1) { if(zone->opts && zone->opts->request_xfr) zc_warning_prev_line("multiple DNAMEs at the same name"); else zc_error_prev_line("multiple DNAMEs at the same name"); } if(rr->type == TYPE_CNAME && rrset->rr_count > 1) { if(zone->opts && zone->opts->request_xfr) zc_warning_prev_line("multiple CNAMEs at the same name"); else zc_error_prev_line("multiple CNAMEs at the same name"); } if((rr->type == TYPE_DNAME && domain_find_rrset(rr->owner, zone, TYPE_CNAME)) ||(rr->type == TYPE_CNAME && domain_find_rrset(rr->owner, zone, TYPE_DNAME))) { if(zone->opts && zone->opts->request_xfr) zc_warning_prev_line("DNAME and CNAME at the same name"); else zc_error_prev_line("DNAME and CNAME at the same name"); } if(domain_find_rrset(rr->owner, zone, TYPE_CNAME) && domain_find_non_cname_rrset(rr->owner, zone)) { if(zone->opts && zone->opts->request_xfr) zc_warning_prev_line("CNAME and other data at the same name"); else zc_error_prev_line("CNAME and other data at the same name"); } if (rr->type == TYPE_RRSIG && rr_rrsig_type_covered(rr) == TYPE_DNSKEY) { rrset->zone->is_secure = 1; } /* Check we have SOA */ if (zone->soa_rrset == NULL) { if (rr->type == TYPE_SOA) { if (rr->owner != zone->apex) { zc_error_prev_line( "SOA record with invalid domain name"); } else { zone->soa_rrset = rrset; } } } else if (rr->type == TYPE_SOA) { if(zone->opts && zone->opts->request_xfr) zc_warning_prev_line("duplicate SOA record discarded"); else zc_error_prev_line("duplicate SOA record discarded"); --rrset->rr_count; } /* Is this a zone NS? */ if (rr->type == TYPE_NS && rr->owner == zone->apex) { zone->ns_rrset = rrset; } if (vflag > 1 && totalrrs > 0 && (totalrrs % progress == 0)) { fprintf(stdout, "%ld\n", totalrrs); } ++totalrrs; return 1; } /* * Find rrset type for any zone */ static rrset_type* domain_find_rrset_any(domain_type *domain, uint16_t type) { rrset_type *result = domain->rrsets; while (result) { if (rrset_rrtype(result) == type) { return result; } result = result->next; } return NULL; } /* * Check for DNAME type. Nothing is allowed below it */ static void check_dname(namedb_type* db) { domain_type* domain; RBTREE_FOR(domain, domain_type*, db->domains->names_to_domains) { if(domain->is_existing) { /* there may not be DNAMEs above it */ domain_type* parent = domain->parent; #ifdef NSEC3 if(domain_has_only_NSEC3(domain, NULL)) continue; #endif while(parent) { if(domain_find_rrset_any(parent, TYPE_DNAME)) { zc_error("While checking node %s,", dname_to_string(domain_dname(domain), NULL)); zc_error("DNAME at %s has data below it. " "This is not allowed (rfc 2672).", dname_to_string(domain_dname(parent), NULL)); exit(1); } parent = parent->parent; } } } } /* * Reads the specified zone into the memory * nsd_options can be NULL if no config file is passed. * */ static void zone_read(const char *name, const char *zonefile, nsd_options_t* nsd_options) { const dname_type *dname; dname = dname_parse(parser->region, name); if (!dname) { zc_error("incorrect zone name '%s'", name); return; } #ifndef ROOT_SERVER /* Is it a root zone? Are we a root server then? Idiot proof. */ if (dname->label_count == 1) { zc_error("not configured as a root server"); return; } #endif /* Open the zone file */ if (!zone_open(zonefile, 3600, CLASS_IN, dname)) { if(nsd_options) { /* check for secondary zone, they can start with no zone info */ zone_options_t* zopt = zone_options_find(nsd_options, dname); if(zopt && zone_is_slave(zopt)) { zc_warning("slave zone %s with no zonefile '%s'(%s) will " "force zone transfer.", name, zonefile, strerror(errno)); return; } } /* cannot happen with stdin - so no fix needed for zonefile */ zc_error("cannot open '%s': %s", zonefile, strerror(errno)); return; } /* Parse and process all RRs. */ yyparse(); /* check if zone file contained a correct SOA record */ if (parser->current_zone && parser->current_zone->soa_rrset && parser->current_zone->soa_rrset->rr_count!=0) { if(dname_compare(domain_dname( parser->current_zone->soa_rrset->rrs[0].owner), dname) != 0) { zc_error("zone configured as '%s', but SOA has owner '%s'.", name, dname_to_string( domain_dname(parser->current_zone-> soa_rrset->rrs[0].owner), NULL)); } } fclose(yyin); fflush(stdout); totalerrors += parser->errors; parser->filename = NULL; } static void usage (void) { #ifndef NDEBUG fprintf(stderr, "usage: zonec [-v|-h|-C|-F|-L] [-c configfile] [-o origin] [-d directory] [-f database] [-z zonefile]\n\n"); #else fprintf(stderr, "usage: zonec [-v|-h|-C] [-c configfile] [-o origin] [-d directory] [-f database] [-z zonefile]\n\n"); #endif fprintf(stderr, "\tNSD zone compiler, creates database from zone files.\n"); fprintf(stderr, "\tVersion %s. Report bugs to <%s>.\n\n", PACKAGE_VERSION, PACKAGE_BUGREPORT); fprintf(stderr, "\t-v\tBe more verbose.\n"); fprintf(stderr, "\t-h\tPrint this help information.\n"); fprintf(stderr, "\t-c\tSpecify config file to read instead of default nsd.conf.\n"); fprintf(stderr, "\t-C\tNo config file is read.\n"); fprintf(stderr, "\t-d\tSet working directory to open files from.\n"); fprintf(stderr, "\t-o\tSpecify a zone's origin (only used with -z).\n"); fprintf(stderr, "\t-f\tSpecify database file to use.\n"); fprintf(stderr, "\t-z\tSpecify a zonefile to read (read from stdin with \'-\').\n"); #ifndef NDEBUG fprintf(stderr, "\t-F\tSet debug facilities.\n"); fprintf(stderr, "\t-L\tSet debug level.\n"); #endif } extern char *optarg; extern int optind; int main (int argc, char **argv) { struct namedb *db; char *origin = NULL; int c; region_type *global_region; region_type *rr_region; const char* configfile= CONFIGFILE; const char* zonesdir = NULL; const char* singlefile = NULL; nsd_options_t* nsd_options = NULL; log_init("zonec"); global_region = region_create(xalloc, free); rr_region = region_create(xalloc, free); totalerrors = 0; /* Parse the command line... */ while ((c = getopt(argc, argv, "d:f:vhCF:L:o:c:z:")) != -1) { switch (c) { case 'c': configfile = optarg; break; case 'v': ++vflag; break; case 'f': dbfile = optarg; break; case 'd': zonesdir = optarg; break; case 'C': configfile = 0; break; #ifndef NDEBUG case 'F': sscanf(optarg, "%x", &nsd_debug_facilities); break; case 'L': sscanf(optarg, "%d", &nsd_debug_level); break; #endif /* NDEBUG */ case 'o': origin = optarg; break; case 'z': singlefile = optarg; break; case 'h': usage(); exit(0); case '?': default: usage(); exit(1); } } argc -= optind; argv += optind; if (argc != 0) { usage(); exit(1); } /* Read options */ if(configfile != 0) { nsd_options = nsd_options_create(global_region); if(!parse_options_file(nsd_options, configfile)) { fprintf(stderr, "zonec: could not read config: %s\n", configfile); exit(1); } } if(nsd_options && zonesdir == 0) zonesdir = nsd_options->zonesdir; if(zonesdir && zonesdir[0]) { if (chdir(zonesdir)) { fprintf(stderr, "zonec: cannot chdir to %s: %s\n", zonesdir, strerror(errno)); exit(1); } } if(dbfile == 0) { if(nsd_options && nsd_options->database) dbfile = nsd_options->database; else dbfile = DBFILE; } /* Create the database */ if ((db = namedb_new(dbfile)) == NULL) { fprintf(stderr, "zonec: error creating the database (%s): %s\n", dbfile, strerror(errno)); exit(1); } parser = zparser_create(global_region, rr_region, db); if (!parser) { fprintf(stderr, "zonec: error creating the parser\n"); exit(1); } /* Unique pointers used to mark errors. */ error_dname = (dname_type *) region_alloc(global_region, 0); error_domain = (domain_type *) region_alloc(global_region, 0); if (singlefile || origin) { /* * Read a single zone file with the specified origin */ if(!singlefile) { fprintf(stderr, "zonec: must have -z zonefile when reading single zone.\n"); exit(1); } if(!origin) { fprintf(stderr, "zonec: must have -o origin when reading single zone.\n"); exit(1); } if (vflag > 0) fprintf(stdout, "zonec: reading zone \"%s\".\n", origin); zone_read(origin, singlefile, nsd_options); if (vflag > 0) fprintf(stdout, "zonec: processed %ld RRs in \"%s\".\n", totalrrs, origin); } else { zone_options_t* zone; if(!nsd_options) { fprintf(stderr, "zonec: no zones specified.\n"); exit(1); } /* read all zones */ RBTREE_FOR(zone, zone_options_t*, nsd_options->zone_options) { if (vflag > 0) fprintf(stdout, "zonec: reading zone \"%s\".\n", zone->name); zone_read(zone->name, zone->zonefile, nsd_options); if (vflag > 0) fprintf(stdout, "zonec: processed %ld RRs in \"%s\".\n", totalrrs, zone->name); totalrrs = 0; } } check_dname(db); #ifndef NDEBUG if (vflag > 0) { fprintf(stdout, "global_region: "); region_dump_stats(global_region, stdout); fprintf(stdout, "\n"); fprintf(stdout, "db->region: "); region_dump_stats(db->region, stdout); fprintf(stdout, "\n"); } #endif /* NDEBUG */ /* Close the database */ if (namedb_save(db) != 0) { fprintf(stderr, "zonec: error writing the database (%s): %s\n", db->filename, strerror(errno)); namedb_discard(db); exit(1); } /* Print the total number of errors */ if (vflag > 0 || totalerrors > 0) { if (totalerrors > 0) { fprintf(stderr, "\nzonec: done with %ld errors.\n", totalerrors); } else { fprintf(stdout, "\nzonec: done with no errors.\n"); } } /* Disable this to save some time. */ #if 0 region_destroy(global_region); #endif return totalerrors ? 1 : 0; } nsd-3.2.16/nsd.8.in0000664000175000017500000001313012173226547012644 0ustar matjematje.TH "NSD" "8" "Jul 22, 2013" "NLnet Labs" "NSD 3.2.16" .\" Copyright (c) 2001\-2011, NLnet Labs. All rights reserved. .\" See LICENSE for the license. .SH "NAME" .LP .B nsd \- Name Server Daemon (NSD) version 3.2.16. .SH "SYNOPSIS" .LP .B nsd .RB [ \-4 ] .RB [ \-6 ] .RB [ \-a .IR ip\-address[@port] ] .RB [ \-c .IR configfile ] .RB [ \-d ] .RB [ \-f .IR database ] .RB [ \-h ] .RB [ \-i .IR identity ] .RB [ \-I .IR nsid ] .RB [ \-l .IR logfile ] .RB [ \-N .IR server\-count ] .RB [ \-n .IR noncurrent\-tcp\-count ] .RB [ \-P .IR pidfile ] .RB [ \-p .IR port ] .RB [ \-s .IR seconds ] .RB [ \-t .IR chrootdir ] .RB [ \-u .IR username ] .RB [ \-V .IR level ] .RB [ \-v ] .SH "DESCRIPTION" .LP .B NSD is a complete implementation of an authoritative DNS nameserver. Upon startup, .B NSD will read the database specified with .B \-f .I database argument and put itself into background and answers queries on port 53 or a different port specified with .B \-p .I port option. The .I database must be generated beforehand with zonec(8). By default, .B NSD will bind to all local interfaces available. Use the .B \-a .I ip\-address[@port] option to specify a single particular interface address to be bound. If this option is given more than once, .B NSD will bind its UDP and TCP sockets to all the specified ip\-addresses separately. If IPv6 is enabled when .B NSD is compiled an IPv6 address can also be specified. .P .SH "OPTIONS" .LP All the options can be specified in the configfile ( .B \-c argument), except for the .B \-v and .B \-h options. If options are specified on the commandline, the options on the commandline take precedence over the options in the configfile. .P Normally .B NSD should be started with the `nsdc(8) start` command invoked from a .I /etc/rc.d/nsd.sh script or similar at the operating system startup. .TP .B \-4 Only listen to IPv4 connections. .TP .B \-6 Only listen to IPv6 connections. .TP .B \-a\fI ip\-address[@port] Listen to the specified .IR ip\-address . The .I ip\-address must be specified in numeric format (using the standard IPv4 or IPv6 notation). Optionally, a port number can be given. This flag can be specified multiple times to listen to multiple IP addresses. If this flag is not specified, .B NSD listens to the wildcard interface. .TP .B \-c\fI configfile Read specified .I configfile instead of the default .IR @nsdconfigfile@ . For format description see nsd.conf(5). .TP .B \-d Turn on debugging mode, do not fork, stay in the foreground. .TP .B \-f\fI database Use the specified .I database instead of the default of .IR @dbfile@ . If a .B zonesdir: is specified in the config file this path can be relative to that directory. .TP .B \-h Print help information and exit. .TP .B \-i\fI identity Return the specified .I identity when asked for .I CH TXT ID.SERVER (This option is used to determine which server is answering the queries when they are anycast). The default is the name returned by gethostname(3). .TP .B \-I\fI nsid Add the specified .I nsid to the EDNS section of the answer when queried with an NSID EDNS enabled packet. .TP .B \-l\fI logfile Log messages to the specified .IR logfile . The default is to log to stderr and syslog. If a .B zonesdir: is specified in the config file this path can be relative to that directory. .TP .B \-N\fI count Start .I count .B NSD servers. The default is 1. Starting more than a single server is only useful on machines with multiple CPUs and/or network adapters. .TP .B \-n\fI number The maximum .I number of concurrent TCP connection that can be handled by each server. The default is 10. .TP .B \-P\fI pidfile Use the specified .I pidfile instead of the platform specific default, which is mostly .IR @pidfile@ . If a .B zonesdir: is specified in the config file, this path can be relative to that directory. .TP .B \-p\fI port Answer the queries on the specified .IR port . Normally this is port 53. .TP .B \-s\fI seconds Produce statistics dump every .I seconds seconds. This is equal to sending .I SIGUSR1 to the daemon periodically. .TP .B \-t\fI chroot Specifies a directory to .I chroot to upon startup. This option requires you to ensure that appropriate syslogd(8) socket (e.g. .I chrootdir /dev/log) is available, otherwise .B NSD won't produce any log output. .TP .B \-u\fI username Drop user and group privileges to those of .I username after binding the socket. The .I username must be one of: username, id, or id.gid. For example: nsd, 80, or 80.80. .TP .B \-V\fI level This value specifies the verbosity level for (non\-debug) logging. Default is 0. .TP .B \-v Print the version number of .B NSD to standard error and exit. .LP .B NSD reacts to the following signals: .TP SIGTERM Stop answering queries, shutdown, and exit normally. .TP SIGHUP Reload the database. .TP SIGUSR1 Dump BIND8\-style statistics into the log. Ignored otherwise. .SH "FILES" .TP @dbfile@ default .B NSD database .TP @pidfile@ the process id of the name server. .TP @nsdconfigfile@ default .B NSD configuration file .SH "DIAGNOSTICS" .LP will log all the problems via the standard syslog(8) .I daemon facility, unless the .B \-d option is specified. .SH "SEE ALSO" .LP nsdc(8), nsd.conf(5), nsd\-checkconf(8), nsd\-notify(8), nsd\-patch(8), nsd\-xfer(8), zonec(8) .SH "AUTHORS" .LP .B NSD was written by NLnet Labs and RIPE NCC joint team. Please see CREDITS file in the distribution for further details. .SH "BUGS" .LP .B NSD will answer the queries erroneously if the .I database was not properly compiled with zonec(8). Therefore problems with misconfigured master zone files or zonec(8) bugs may not be visible until the queries are actually answered with .BR NSD . nsd-3.2.16/contrib/0000775000175000017500000000000012173226526013021 5ustar matjematjensd-3.2.16/contrib/nsd.spec0000664000175000017500000001677011131617552014470 0ustar matjematjeSummary: NSD is a complete implementation of an authoritative DNS name server Name: nsd Version: 3.2.1 Release: 1%{?dist} License: BSD Url: http://www.nlnetlabs.nl/%{name}/ Source: http://www.nlnetlabs.nl/downloads/%{name}/%{name}-%{version}.tar.gz Source1: nsd.init Source2: nsd.cron Group: System Environment/Daemons BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) BuildRequires: flex, openssl-devel Requires(pre): shadow-utils %description NSD is a complete implementation of an authoritative DNS name server. It can function as a primary or secondary DNS server, with DNSSEC support. For further information about what NSD is and what NSD is not please consult the REQUIREMENTS document which is a part of this distribution. (thanks to Olaf). %prep %setup -q -n nsd-3.2.0 %build %configure --enable-bind8-stats --enable-plugins --enable-checking \ --enable-mmap --with-ssl --enable-nsec3 --enable-nsid \ --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid --with-ssl \ --with-user=nsd --with-difffile=%{_localstatedir}/lib/%{name}/ixfr.db \ --with-xfrdfile=%{_localstatedir}/lib/%{name}/ixfr.state %{__make} %{?_smp_mflags} #convert to utf8 iconv -f iso8859-1 -t utf-8 doc/RELNOTES > doc/RELNOTES.utf8 iconv -f iso8859-1 -t utf-8 doc/CREDITS > doc/CREDITS.utf8 mv -f doc/RELNOTES.utf8 doc/RELNOTES mv -f doc/CREDITS.utf8 doc/CREDITS %install rm -rf %{buildroot} %{__make} DESTDIR=%{buildroot} install install -d -m 0755 %{buildroot}%{_initrddir} install -d -m 0755 $RPM_BUILD_ROOT%{_sysconfdir}/cron.hourly install -c -m 0755 %{SOURCE2} $RPM_BUILD_ROOT%{_sysconfdir}/cron.hourly/nsd install -m 0755 %{SOURCE1} %{buildroot}/%{_initrddir}/nsd install -d -m 0700 %{buildroot}%{_localstatedir}/run/%{name} install -d -m 0700 %{buildroot}%{_localstatedir}/lib/%{name} # change .sample to normal config files head -76 %{buildroot}%{_sysconfdir}/nsd/nsd.conf.sample > %{buildroot}%{_sysconfdir}/nsd/nsd.conf rm %{buildroot}%{_sysconfdir}/nsd/nsd.conf.sample echo "database: /var/lib/nsd/nsd.db" >> %{buildroot}%{_sysconfdir}/nsd/nsd.conf echo "# include: \"/some/path/file\"" >> %{buildroot}%{_sysconfdir}/nsd/nsd.conf %clean rm -rf ${RPM_BUILD_ROOT} %files %defattr(-,root,root,-) %doc doc/* %doc contrib/nsd.zones2nsd.conf %dir %{_sysconfdir}/nsd/ %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/nsd/nsd.conf #%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/nsd/nsd.zones %attr(0755,root,root) %{_initrddir}/%{name} %{_sysconfdir}/cron.hourly/nsd %attr(0755,%{name},%{name}) %dir %{_localstatedir}/run/%{name} %attr(0755,%{name},%{name}) %dir %{_localstatedir}/lib/%{name} %{_sbindir}/* %{_mandir}/*/* %pre getent group nsd >/dev/null || groupadd -r nsd getent passwd nsd >/dev/null || \ useradd -r -g nsd -d /etc/nsd -s /sbin/nologin \ -c "nsd daemon account" nsd exit 0 %post /sbin/chkconfig --add %{name} %preun if [ $1 -eq 0 ]; then /sbin/service %{name} stop /sbin/chkconfig --del %{name} fi %postun if [ "$1" -ge "1" ]; then /sbin/service %{name} condrestart fi %changelog * Thu Oct 9 2008 Paul Wouters - 3.1.1-1 - updated to 3.1.1 * Mon Aug 11 2008 Tom "spot" Callaway - 3.1.0-2 - fix license tag - fix static user creation * Mon Jun 30 2008 Paul Wouters - 3.1.0-1 - Updated to 3.1.0 * Tue May 6 2008 Paul Wouters - 3.0.8-2 - Fix /dev/null redirection [Venkatesh Krishnamurthi] * Tue May 6 2008 Paul Wouters - 3.0.8-1 - Updated to 3.0.8 * Tue Feb 19 2008 Fedora Release Engineering - 3.0.7-3 - Autorebuild for GCC 4.3 * Wed Dec 5 2007 Paul Wouters - 3.0.7-2 - Rebuild for new libcrypto * Tue Nov 13 2007 Paul Wouters - 3.0.7-1 - Updated to new version - fix RELNOTES/README to be utf8 - Fix path to nsd.db in cron job. * Thu Nov 8 2007 Paul Wouters - 3.0.6-7 - Modified cron to only rebuild/reload when zone updates have been received * Wed Nov 7 2007 Paul Wouters - 3.0.6-6 - Added hourly cron job to do various maintenance tasks - Added nsd rebuild to create the proper nsd.db file on startup - Added nsd patch on shutdown to ensure zonefiles are up to date * Tue Oct 2 2007 Paul Wouters - 3.0.6-5 - nsdc update and nsdc notify are no longer needed in initscript. * Mon Sep 24 2007 Jesse Keating - 3.0.6-4 - Bump release for upgrade path. * Fri Sep 14 2007 Paul Wouters 3.0.6-3 - Do not include examples from nsd.conf.sample that causes bogus network traffic. * Fri Sep 14 2007 Paul Wouters 3.0.6-2 - Change locations of ixfr.db and xfrd.state to /var/lib/nsd - Enable NSEC3 - Delay running nsdc update until after nsd has started - Delete xfrd.state on nsd stop - Run nsdc notify in the background, since it can take a very long time when remote servers are unavailable. * Tue Sep 11 2007 Paul Wouters 3.0.6-1 - Upgraded to 3.0.6 - Do not include bind2nsd, since it didn't compile for me * Fri Jul 13 2007 Paul Wouters 3.0.5-2 - Fix init script, bug #245546 * Fri Mar 23 2007 Paul Wouters 3.0.5-1 - Upgraded to 3.0.5 * Mon Dec 11 2006 Wouter Wijngaards - 3.0.4-1 - Updated file permissions to make /etc/nsd owned by nsd user. * Thu Dec 7 2006 Paul Wouters 3.0.3-1 - Upgraded to 3.0.3 * Mon Nov 27 2006 Paul Wouters 3.0.2-1 - Upgraded to 3.0.2. - Use new configuration file nsd.conf. Still needs migration script. patch from Farkas Levente * Mon Oct 16 2006 Paul Wouters 2.3.6-2 - Bump version for upgrade path * Thu Oct 12 2006 Paul Wouters 2.3.6-1 - Upgraded to 2.3.6 - Removed obsolete workaround in nsd.init - Fixed spec file so daemon gets properly restarted on upgrade * Mon Sep 11 2006 Paul Wouters 2.3.5-4 - Rebuild requested for PT_GNU_HASH support from gcc - Removed dbaccess.c from doc section * Mon Aug 21 2006 Wouter Wijngaards - 3.0.0-1 - Proposal for 3.0.0 spec file * Mon Jun 26 2006 Paul Wouters - 2.3.5-3 - Bump version for FC-x upgrade path * Mon Jun 26 2006 Paul Wouters - 2.3.5-1 - Upgraded to nsd-2.3.5 * Sun May 7 2006 Paul Wouters - 2.3.4-3 - Upgraded to nsd-2.3.4. - Removed manual install targets because DESTDIR is now supported - Re-enabled --checking, checking patch no longer needed and removed. - Work around in nsd.init for nsd failing to start when there is no ipv6 - Various release bumps due to 'make tag' failures :( * Thu Dec 15 2005 Paul Wouters - 2.3.3-7 - chkconfig and attribute changes as proposed by Dmitry Butskoy * Thu Dec 15 2005 Paul Wouters - 2.3.3-6 - Moved pid file to /var/run/nsd/nsd.pid. - Use _localstatedir instead of "/var" * Tue Dec 13 2005 Paul Wouters - 2.3.3-5 - Added BuildRequires for openssl-devel, removed Requires for openssl. * Mon Dec 12 2005 Paul Wouters - 2.3.3-4 - upgraded to nsd-2.3.3 * Wed Dec 7 2005 Tom "spot" Callaway - 2.3.2-2 - minor cleanups * Mon Dec 5 2005 Paul Wouters - 2.3.2-1 - Upgraded to 2.3.2. Changed post scripts to comply to Fedora Extras policies (eg do not start daemon on fresh install) * Tue Oct 4 2005 Paul Wouters - 2.3.1-1 - Initial version nsd-3.2.16/contrib/bind2nsd/0000775000175000017500000000000012173226525014523 5ustar matjematjensd-3.2.16/contrib/bind2nsd/install.sh0000664000175000017500000000235410647646703016541 0ustar matjematje#!/bin/sh # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # install script # python setup.py install (cd pexpect-2.1; python setup.py install) (cd pyDes-1.2; python setup.py install) nsd-3.2.16/contrib/bind2nsd/TODO0000664000175000017500000000410710647646703015225 0ustar matjematjeto be done: =========== -- key {}'s have to be handled -- zone allow-transfer xlates to what in NSD? -- install process needs cleanup -- document install/update process -- performance: can this be improved? translation ought to be able to go quicker, perhaps by only handling changes vs complete re-translation every time -- license under MIT license and post to newly created bind2nsd.sf.net -- must handle 'control { ... }' settings? -- look for all 'BOZO's -- look for all 'FIXME's -- return code checking is abysmal, if done at all -- trap ctrl-C properly -- verify BIND named.conf grammar details -- verify NSD nsd.conf grammar details -- report specifically what line of what file has an error for ALL errors recently done: ============== -- can now report specifically what line of what file has an error and using it in some interesting places -- refactored the parser (much more maintainable now) -- acl_list: now set these up (as empty files) and copy them to the right places -- if scp does not require a password, and it is set to '' in the config file, then do not wait for the password prompt -- can now specify multiple ip-addresses for use in nsd.conf (and to say which one to scp to when sync'ing using 'dest-ip' option) -- zonec output again displayed when using 's64-sync --verbose' -- search for bind2nsd.conf in '.', $HOME, _and_ /etc/bind2nsd -- install config files, etc., in /etc/bind2nsd (passwd file, too) -- clean up example bind2nsd.conf -- set better config defaults -- GENERATE commands in the zone data are now intercepted and converted to the desired text (since we don't handle $GENERATE and it _is_ a BIND specific tool). -- Added in key xlation (i.e., 'key { ... }') -- 'options { pid-file } => server: pidfile' is ignorable -- handle options { recursive-clients nnn; } -- do not scp when using 's64-sync --analyze-only' -- handle allow-notify {} -- handle also-notify {} in options {} and in server {} or per zone -- create an 'nsd-sync' that works with any old NSD server on a remote machine (permutation of 's64-sync') nsd-3.2.16/contrib/bind2nsd/bind2nsd/0000775000175000017500000000000012173226525016226 5ustar matjematjensd-3.2.16/contrib/bind2nsd/bind2nsd/__init__.py0000664000175000017500000000217110647326614020344 0ustar matjematje# Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # initialize the module # nsd-3.2.16/contrib/bind2nsd/bind2nsd/Parser.py0000664000175000017500000003650510651575270020050 0ustar matjematje#!/usr/bin/env python # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # class containing the parser for BIND configuration files # # import os import os.path import sys if os.path.exists('../bind2nsd/Config.py'): sys.path.append('../bind2nsd') from NamedConf import * from Zone import * from Key import * from Tokenizer import * from Utils import * else: from bind2nsd.NamedConf import * from bind2nsd.Zone import * from bind2nsd.Key import * from bind2nsd.Tokenizer import * from bind2nsd.Utils import * #-- the following options {} clauses are currently currently ignored, # typically because they are not implemented or not applicable to NSD IGNORED_OPTIONS = [ 'cleaning-interval', 'datasize', 'interface-interval', 'max-cache-size', 'stacksize', ] class Parser: def __init__(self, named): self.named = named return def handle_include(self, tokens): (ttype, val, curline) = tokens.get() if ttype == T_STRING: fname = val.replace('"', '') self.named.includes.append(fname) report_info(' include file "%s"...' % (fname)) if os.path.exists(fname): self.parse(Tokenizer(fname)) else: report_error('? missing include file "%s"' % (fname)) else: bail('? dude. where is the filename string after "include"?') (ttype, val, curline) = tokens.get() if ttype != T_SEMI: bail('? need a semicolon to end the "include" (%d: %s)' % (ttype, val)) return def handle_key(self, tokens): (ttype, val, curline) = tokens.get() if ttype == T_STRING: name = val.replace('"', '') key = Key(name) (ttype, val, curline) = tokens.get() if ttype != T_LBRACE: bail('? need opening brace for "key" defn (%d: %s)' % (ttype, val)) (ttype, val, curline) = tokens.get() while ttype != T_RBRACE: if ttype == T_KEYWORD and val == 'algorithm': (ttype, val, curline) = tokens.get() if ttype == T_KEYWORD or ttype == T_NAME: key.setAlgorithm(val) else: bail('? bogosity after "algorithm" (%d: %s)' % (ttype, val)) elif ttype == T_KEYWORD and val == 'secret': (ttype, val, curline) = tokens.get() if ttype == T_STRING: s = val.replace('"','') key.setSecret(s) else: bail('? bogosity after "secret" (%d: %s)' % (ttype, val)) elif ttype == T_SEMI: pass (ttype, val, curline) = tokens.get() else: bail('? need to have a string after "key" (%d: %s)' % (ttype, val)) self.named.addKey(key) (ttype, val, curline) = tokens.get() if ttype != T_SEMI: bail('? need a semicolon to end the "key" (%d: %s)' % (ttype, val)) return def handle_server(self, tokens): (ttype, val, curline) = tokens.get() if ttype == T_QUAD: ipaddr = val (ttype, val, curline) = tokens.get() if ttype != T_LBRACE: bail('? need opening brace for "server" (%d: %s)' % (ttype, val)) (ttype, val, curline) = tokens.get() while ttype != T_RBRACE: if ttype == T_KEYWORD and val == 'keys': (ttype, val, curline) = tokens.get() if ttype == T_LBRACE: nlist = self.name_list(val, tokens) for ii in nlist: self.named.keys[ii].addIpAddr(ipaddr) else: bail('? bogosity after "keys" (%d: %s)' % (ttype, val)) (ttype, val, curline) = tokens.get() else: bail('? need to have an IP address after "server" (%d: %s)' % \ (ttype, val)) (ttype, val, curline) = tokens.get() if ttype != T_SEMI: bail('? need a semicolon to end the "server" (%d: %s)' % (ttype, val)) return def name_list(self, name, tokens): nlist = [] (ttype, val, curline) = tokens.get() if ttype == T_LBRACE or ttype == T_LPAREN: (ttype, val, curline) = tokens.get() while ttype != T_RBRACE and ttype != T_RPAREN: if ttype == T_NAME: nlist.append(val) elif ttype == T_SEMI or ttype == T_COMMENT: pass else: bail('? was expecting a name in "%s" (%d, %d: %s)' % \ (name, ttype, curline, val.strip())) (ttype, val, curline) = tokens.get() (ttype, val, curline) = tokens.get() if ttype != T_SEMI: bail('? junk after closing brace of "%s" section' % (name)) return nlist def quad_list(self, name, tokens): qlist = [] (ttype, val, curline) = tokens.get() if ttype == T_LBRACE or ttype == T_LPAREN: (ttype, val, curline) = tokens.get() while ttype != T_RBRACE and ttype != T_RPAREN: if ttype == T_QUAD: qlist.append(val) elif ttype == T_SEMI or ttype == T_COMMENT: pass else: bail('? was expecting a quad in "%s" (%d, %d: %s)' % \ (name, ttype, curline, val.strip())) (ttype, val, curline) = tokens.get() (ttype, val, curline) = tokens.get() if ttype != T_SEMI: bail('? junk after closing brace of "%s" section' % (name)) return qlist def quad_list_with_keys(self, name, tokens, named): qlist = [] (ttype, val, curline) = tokens.get() if ttype == T_LBRACE or ttype == T_LPAREN: (ttype, val, curline) = tokens.get() while ttype != T_RBRACE and ttype != T_RPAREN: if ttype == T_QUAD: qlist.append(val) elif ttype == T_SEMI or ttype == T_COMMENT: pass elif ttype == T_KEYWORD and val == 'key': (ttype, val, curline) = tokens.get() if ttype == T_NAME: if val in named.getKeys(): qlist.append(val) else: bail('? was expecting a key name in "%s" (%d, %d: %s)' % \ (name, ttype, curline, val.strip())) else: bail('? was expecting a quad in "%s" (%d, %d: %s)' % \ (name, ttype, curline, val.strip())) (ttype, val, curline) = tokens.get() (ttype, val, curline) = tokens.get() if ttype != T_SEMI: bail('? junk after closing brace of "%s" section' % (name)) return qlist def skip_value(self, name, tokens): (ttype, val, curline) = tokens.get() if ttype == T_NAME or ttype == T_STRING: pass else: bail('? need something after "%s" keyword (%d: %s)' % (name, ttype, val)) return def handle_options(self, tokens): report_info('=> processing server options') optsDone = False depth = 0 (ttype, val, curline) = tokens.get() if ttype == T_LBRACE: depth += 1 else: bail('? urk. bad info after "options" keyword.') (ttype, val, curline) = tokens.get() while not optsDone: if ttype == T_KEYWORD and val == 'directory': (ttype, val, curline) = tokens.get() if ttype == T_STRING: self.named.options.setDirectory(val) else: bail('? need string after "directory" keyword') elif ttype == T_KEYWORD and val == 'dump-file': (ttype, val, curline) = tokens.get() if ttype == T_STRING: self.named.options.setDumpFile(val) else: bail('? need string after "dump-file" keyword') elif ttype == T_KEYWORD and val == 'pid-file': (ttype, val, curline) = tokens.get() if ttype == T_STRING: self.named.options.setPidFile(val) else: bail('? need string after "pid-file" keyword') elif ttype == T_KEYWORD and val == 'coresize': (ttype, val, curline) = tokens.get() if ttype == T_NAME or ttype == T_KEYWORD: self.named.options.setCoresize(val) else: bail('? need name after "coresize" keyword (%d: %s)' % \ (ttype, val)) elif ttype == T_KEYWORD and val == 'version': (ttype, val, curline) = tokens.get() if ttype == T_STRING: self.named.options.setVersion(val) else: bail('? need string after "version" keyword') elif ttype == T_KEYWORD and val == 'transfer-format': (ttype, val, curline) = tokens.get() if ttype == T_NAME or ttype == T_KEYWORD: self.named.options.setTransferFormat(val) else: bail('? need name after "transfer-format" keyword (%d: %s)' % \ (ttype, val)) elif ttype == T_KEYWORD and val == 'statistics-file': (ttype, val, curline) = tokens.get() if ttype == T_STRING: self.named.options.setStatisticsFile(val) else: bail('? need string after "statistics-file" keyword') elif ttype == T_KEYWORD and val == 'allow-transfer': qlist = self.quad_list_with_keys(val, tokens, self.named) self.named.options.setAllowTransfer(qlist) elif ttype == T_KEYWORD and val == 'allow-notify': qlist = self.quad_list(val, tokens) self.named.options.setAllowNotify(qlist) elif ttype == T_KEYWORD and val == 'also-notify': qlist = self.quad_list(val, tokens) self.named.options.setAlsoNotify(qlist) elif ttype == T_KEYWORD and val == 'allow-recursion': qlist = self.quad_list(val, tokens) self.named.options.setAllowRecursion(qlist) elif ttype == T_KEYWORD and val == 'check-names': (ttype, val, curline) = tokens.get() info = [] while ttype != T_SEMI: info.append(val) (ttype, val, curline) = tokens.get() self.named.options.addCheckNames(' '.join(info)) elif ttype == T_KEYWORD and val in IGNORED_OPTIONS: self.skip_value(val, tokens) elif ttype == T_KEYWORD and val == 'recursive-clients': (ttype, val, curline) = tokens.get() if ttype == T_QUAD: # well, it's a number, actually... self.named.options.setRecursiveClients(val) else: bail('? need value after "recursive-clients" keyword (%d: %s)' % (ttype, val)) elif ttype == T_RBRACE: optDone = True break (ttype, val, curline) = tokens.get() (ttype, val, curline) = tokens.get() if ttype != T_SEMI: bail('? um, junk after closing brace of "options" section') return def handle_zone(self, tokens): (ttype, val, curline) = tokens.get() if ttype != T_STRING: bail('? expected string for zone name (%d: %s)' % (ttype, val)) zname = val.replace('"','') zone = Zone(zname) (ttype, val, curline) = tokens.get() if ttype == T_KEYWORD and (val == 'in' or val == 'IN'): (ttype, val, curline) = tokens.get() if ttype == T_LBRACE or ttype == T_LPAREN: (ttype, val, curline) = tokens.get() while ttype != T_RBRACE and ttype != T_RPAREN: if ttype == T_KEYWORD and val == 'type': (ttype, val, curline) = tokens.get() info = [] while ttype == T_KEYWORD or ttype == T_NAME: info.append(val) (ttype, val, curline) = tokens.get() zone.setType(' '.join(info)) elif ttype == T_KEYWORD and val == 'file': (ttype, val, curline) = tokens.get() if ttype != T_STRING: bail('? eh? no string for zone file name? (%d: %s)' % \ (ttype, val)) fname = val.replace('"','') zone.setFile(fname) elif ttype == T_KEYWORD and val == 'masters': qlist = self.quad_list(val, tokens) zone.setMasters(qlist) elif ttype == T_KEYWORD and val == 'allow-transfer': qlist = self.quad_list_with_keys(val, tokens, self.named) zone.setAllowTransfers(qlist) elif ttype == T_KEYWORD and val == 'also-notify': qlist = self.quad_list(val, tokens) zone.setAlsoNotify(qlist) elif ttype == T_SEMI: pass else: bail('? bugger. do NOT grok "%s" yet (%d: %s @ line %s)' % \ (val, ttype, val, curline)) (ttype, val, curline) = tokens.get() self.named.addZone(zone) else: bail('? expected left brace to start zone definition (%d: %s)' % \ (ttype, val)) (ttype, val, curline) = tokens.get() if ttype != T_SEMI: bail('? need a semicolon to end the "zone" (%d: %s)' % (ttype, val)) return def ignore_section(self, name, tokens): report_info('=> ignoring %s' % (name)) done = False depth = 0 (ttype, val, curline) = tokens.get() if ttype == T_LBRACE: depth += 1 else: bail('? urk. bad info after "%s" keyword.' % (name)) (ttype, val, curline) = tokens.get() while not done: if ttype == T_LBRACE: depth += 1 elif ttype == T_RBRACE: depth -= 1 if depth == 0: break else: pass (ttype, val, curline) = tokens.get() (ttype, val, curline) = tokens.get() if ttype != T_SEMI: bail('? um, junk after closing brace of "%s" section' % (name)) return def parse(self, tokens): (ttype, val, curline) = tokens.get() while ttype != T_EOF: if ttype == T_COMMENT: pass elif ttype == T_KEYWORD and val == 'controls': self.ignore_section(val, tokens) elif ttype == T_KEYWORD and val == 'key': self.handle_key(tokens) elif ttype == T_KEYWORD and val == 'include': self.handle_include(tokens) elif ttype == T_KEYWORD and val == 'logging': self.ignore_section(val, tokens) elif ttype == T_KEYWORD and val == 'lwres': self.ignore_section(val, tokens) elif ttype == T_KEYWORD and val == 'options': self.handle_options(tokens) elif ttype == T_KEYWORD and val == 'server': self.handle_server(tokens) elif ttype == T_KEYWORD and val == 'trusted-keys': self.ignore_section(val, tokens) elif ttype == T_KEYWORD and val == 'view': self.ignore_section(val, tokens) elif ttype == T_KEYWORD and val == 'zone': self.handle_zone(tokens) else: bail('? ew. what _is_ this? -> %2d: %s @ line %d' \ % (ttype, val, curline)) (ttype, val, curline) = tokens.get() return nsd-3.2.16/contrib/bind2nsd/bind2nsd/Zone.py0000664000175000017500000000637010651575270017524 0ustar matjematje#!/usr/bin/env python # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # class to represent a zone file # # import os import os.path import sys if os.path.exists('../bind2nsd/Config.py'): sys.path.append('../bind2nsd') from Utils import * else: from bind2nsd.Utils import * class Zone: def __init__(self, name): self.name = name self.file = '' self.type = '' self.masters = [] # empty unless we're a slave zone self.allow_transfer = [] self.also_notify = [] self.allow_notify = [] return def dump(self): report_info('=> Zone:') report_info(' name = %s' % (self.name)) report_info(' file = %s' % (self.file)) report_info(' type = %s' % (self.type)) report_info(' masters = %s' % (str(self.masters))) report_info(' allow_notify = %s' % (str(self.allow_notify))) report_info(' allow_transfer = %s' % (str(self.allow_transfer))) report_info(' also_notify = %s' % (str(self.also_notify))) return def setName(self, name): self.name = name return def getName(self): return self.name def setFile(self, file): self.file = file return def getFile(self): return self.file def setType(self, type): self.type = type return def getType(self): return self.type def addMaster(self, quad): self.masters.append(quad) return def setMasters(self, list): self.masters = list return def getMasters(self): return self.masters def addAllowTransfer(self, quad): self.allow_transfer.append(quad) return def setAllowTransfers(self, list): self.allow_transfer = list return def getAllowTransfer(self): return self.allow_transfer def addAlsoNotify(self, quad): self.also_notify.append(quad) return def setAlsoNotify(self, list): self.also_notify = list return def getAlsoNotify(self): return self.also_notify def addAllowNotify(self, quad): self.allow_notify.append(quad) return def setAllowNotify(self, list): self.allow_notify = list return def getAllowNotify(self): return self.allow_notify nsd-3.2.16/contrib/bind2nsd/bind2nsd/NamedConf.py0000664000175000017500000001446410651575270020446 0ustar matjematje#!/usr/bin/env python # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # class to represent a named.conf file # import os import os.path import sys if os.path.exists('../bind2nsd/Config.py'): sys.path.append('../bind2nsd') from Config import * from Parser import * from Zone import * from Utils import * else: from bind2nsd.Config import * from bind2nsd.Parser import * from bind2nsd.Zone import * from bind2nsd.Utils import * class Options: def __init__(self): self.allow_notify = [] self.allow_recursion = [] self.allow_transfer = [] self.also_notify = [] self.check_names = [] self.coresize = "" self.directory = "" self.dump_file = "" self.pid_file = "" self.recursive_clients = "" self.statistics_file = "" self.transfer_format = "" self.version = "" return def dump(self): report_info('=> Options:') report_info(' allow-notify: %s' % (self.allow_notify)) report_info(' allow-recursion: %s' % (self.allow_recursion)) report_info(' allow-transfer: %s' % (self.allow_transfer)) report_info(' also-notify: %s' % (self.also_notify)) report_info(' check-names: %s' % (str(self.check_names))) report_info(' coresize: %s' % (self.coresize)) report_info(' directory: %s' % (self.directory)) report_info(' dump-file: %s' % (self.dump_file)) report_info(' pid-file: %s' % (self.pid_file)) report_info(' recursive-clients: %s' % (self.recursive_clients)) report_info(' statistics-file: %s' % (self.statistics_file)) report_info(' transfer-format: %s' % (self.transfer_format)) report_info(' version: %s' % (self.version)) return def setDirectory(self, name): self.directory = name return def getDirectory(self): return self.directory def setDumpFile(self, name): self.dump_file = name return def getDumpFile(self): return self.dump_file def setPidFile(self, name): self.pid_file = name return def getPidFile(self): return self.pid_file def setStatisticsFile(self, name): self.statistics_file = name return def getStatisticsFile(self): return self.statistics_file def addAllowNotify(self, quad): self.allow_notify.append(quad) return def setAllowNotify(self, list): self.allow_notify = list return def getAllowNotify(self): return self.allow_notify def addAllowTransfer(self, quad): self.allow_transfer.append(quad) return def setAllowTransfer(self, list): self.allow_transfer = list return def getAllowTransfer(self): return self.allow_transfer def addAlsoNotify(self, quad): self.also_notify.append(quad) return def setAlsoNotify(self, list): self.also_notify = list return def getAlsoNotify(self): return self.also_notify def addAllowRecursion(self, quad): self.allow_recursion.append(quad) return def setAllowRecursion(self, list): self.allow_recursion = list return def getAllowRecursion(self): return self.allow_recursion def addCheckNames(self, val): self.check_names.append(val) return def getCheckNames(self): return self.check_names def setCoresize(self, val): self.coresize = val return def getCoresize(self): return self.coresize def setTransferFormat(self, val): self.transfer_format = val return def getTransferFormat(self): return self.transfer_format def setVersion(self, val): self.version = val return def getVersion(self): return self.version def setRecursiveClients(self, val): self.recursive_clients = val return def getRecursiveClients(self): return self.recursive_clients class NamedConf: def __init__(self, fname): self.fname = fname self.options = Options() self.includes = [] self.zones = {} self.keys = {} parser = Parser(self) parser.parse(Tokenizer(self.fname)) return def dump(self): report_info('=> NamedConf: dumping data from \"%s\"...' % (self.fname)) self.options.dump() report_info('=> NamedConf: list of includes...') report_info(str(self.includes)) report_info('=> NamedConf: zone info...') zlist = self.zones.keys() zlist.sort() for ii in zlist: self.zones[ii].dump() report_info('=> NamedConf: key info...') klist = self.keys.keys() klist.sort() for ii in klist: self.keys[ii].dump() return def getOptions(self): return self.options def addZone(self, zone): name = zone.getName() self.zones[name] = zone return def getZones(self): return self.zones def getZone(self, name): if name in self.zones: return self.zones[name] else: return None def addKey(self, key): name = key.getName() self.keys[name] = key return def getKey(self, name): if name in self.keys: return self.keys[name] else: return None def getKeys(self): return self.keys nsd-3.2.16/contrib/bind2nsd/bind2nsd/Utils.py0000664000175000017500000000465110647326614017712 0ustar matjematje#!/usr/bin/env python # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # utility functions used throughout the package # # import popen2 import sys VERBOSE = False def set_verbosity(flag): global VERBOSE VERBOSE = flag return def isVerbose(): global VERBOSE return VERBOSE def report_error(somestuff): if len(somestuff) > 0: print >> sys.stderr, somestuff sys.stderr.flush() return def report_info(somestuff): global VERBOSE if VERBOSE and len(somestuff) > 0: print >> sys.stdout, somestuff sys.stdout.flush() return def bail(somestuff): report_error(somestuff) sys.exit(1) return def run_cmd_capture(cmd): (cout, cin, cerr) = popen2.popen3(cmd) cin.close() output = cout.readlines() cout.close() errors = cerr.readlines() cerr.close() return (''.join(output), ''.join(errors)) def run_cmd(cmd, desc): #-- run a command using our own particular idiom global VERBOSE result = True # T => ran without error reports, F otherwise if VERBOSE and len(desc) > 0: report_info('=> ' + desc) (cout, cin, cerr) = popen2.popen3(cmd) cin.close() output = cout.readlines() cout.close() if VERBOSE: report_info(''.join(output)) errors = cerr.readlines() cerr.close() if len(errors) > 0: result = False report_error(''.join(errors)) return result nsd-3.2.16/contrib/bind2nsd/bind2nsd/Key.py0000664000175000017500000000443110651575270017335 0ustar matjematje#!/usr/bin/env python # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # class to represent a named.conf key # # import os import os.path import sys if os.path.exists('../bind2nsd/Config.py'): sys.path.append('../bind2nsd') from Utils import * else: from bind2nsd.Utils import * class Key: def __init__(self, name): self.name = name self.algorithm = '' self.secret = '' self.ipaddrs = [] return def dump(self): report_info('=> Key:') report_info(' algorithm = %s' % (self.algorithm)) report_info(' name = %s' % (self.name)) report_info(' secret = %s' % (self.secret)) report_info(' ipaddrs = %s' % (str(self.ipaddrs))) return def setName(self, val): self.name = val return def getName(self): return self.name def setAlgorithm(self, val): self.algorithm = val return def getAlgorithm(self): return self.algorithm def setSecret(self, val): self.secret = val return def getSecret(self): return self.secret def addIpAddr(self, addr): if addr not in self.ipaddrs: self.ipaddrs.append(addr) return def getIpAddrs(self): return self.ipaddrs nsd-3.2.16/contrib/bind2nsd/bind2nsd/Config.py0000664000175000017500000001247410651575270020020 0ustar matjematje#!/usr/bin/env python # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # class to represent all of the bind2nsd/syncem config items # import os import os.path import sys if os.path.exists('../pyDes-1.2'): sys.path.append('../pyDes-1.2') import pyDes def mkcipher(val): data = val.split() ctxt = '' for ii in range(0, len(data)): ctxt += chr(int(data[ii])) return ctxt def mkprintable(val): cstr = '' for ii in range(0, len(val)): c = val[ii] cstr += '%d ' % (ord(c)) return cstr class Config: def __init__(self): #-- set all of the defaults self.fname = '' self.config = \ { 'acl_list' : 'acl_list', 'bind2nsd' : '/usr/bin/bind2nsd', 'database' : '"nsd.db"', 'DEBUG' : False, 'DEMO-MODE' : False, 'destdir' : '/tmp/foobar', 'dest-ip' : '127.0.0.1', 'destuser' : 'dns', 'difffile' : '"ixfr.db"', 'dnspw' : 'iforgot', 'identity' : '"unknown"', 'ip-address' : '127.0.0.1', 'logfile' : '"log"', 'named-checkconf' : '/usr/sbin/named-checkconf', 'named-checkzone' : '/usr/sbin/named-checkzone', 'named_root' : '/etc/bind9', 'named_conf' : 'named.conf', 'named_watchlist' : '/etc/named.conf', 'nsd-checkconf' : '/usr/sbin/nsd-checkconf', 'nsd_conf' : 'nsd.conf', 'nsd_conf_dir' : '/etc/nsd/', 'nsd_preamble' : 'nsd.conf-preamble', 'password_file' : '/etc/bind2nsd/passwd', 'pidfile' : '"nsd.pid"', 'port' : '53', 'rebuild_cmd' : '/etc/init.d/nsdc rebuild', 'restart_cmd' : '/etc/init.d/nsdc restart', 'sleep_time' : '5', 'start_cmd' : '/etc/init.d/nsdc start', 'statistics' : '3600', 'stop_cmd' : '/etc/init.d/nsdc stop', 'syspw' : 'iforgot', 'tmpdir' : '/tmp/secure64/', # must have trailing '/' 'username' : 'nsd', 'version' : '0.5.0', 'xfrd-reload-timeout' : '10', 'zonec_cmd' : '/etc/init.d/zonec', } self.init() self.read_passwords() if self.config['DEBUG']: self.dump() return def init(self): fname = '' if os.path.exists('bind2nsd.conf'): self.fname = 'bind2nsd.conf' else: fname = os.getenv('HOME', '.') + '/bind2nsd.conf' if os.path.exists(fname): self.fname = fname else: if os.path.exists('/etc/bind2nsd/bind2nsd.conf'): self.fname = '/etc/bind2nsd/bind2nsd.conf' else: print '? hrm. no config file found -- did you _mean_ that?' #-- override the defaults if self.fname != '': fd = open(self.fname, 'r') line = fd.readline() while line: if len(line) > 0: info = line.split() if line[0] == '#': pass # ignore comments elif len(info) > 0: item = info[0].strip() if info[1].strip() == '=': if item in self.config: self.config[item] = ' '.join(info[2:]) else: pass # ignore lines with only one field else: pass # ignore empty lines line = fd.readline() return def read_passwords(self): fname = self.config['password_file'] if os.path.exists(fname): fd = open(fname, 'r+') syspw = fd.readline() dnspw = fd.readline() fd.close() obj = pyDes.triple_des('aBcDeFgHiJkLmNoP', pyDes.ECB) self.config['syspw'] = obj.decrypt(mkcipher(syspw), '#') self.config['dnspw'] = obj.decrypt(mkcipher(dnspw), '#') return def getValue(self, item): if item in self.config: return self.config[item] else: return None def setValue(self, item, val): if item in self.config: self.config[item] = val else: print '? no such config item "%s" (%s)' % (item, val) return def dump(self): print '=> Config:' print ' %-20s = %s' % ('fname', self.fname) for ii in self.config: print ' %-20s = %s' % (ii, self.config[ii]) return nsd-3.2.16/contrib/bind2nsd/bind2nsd/NsdConf.py0000664000175000017500000003733510651575270020150 0ustar matjematje#!/usr/bin/env python # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # class to represent a nsd.conf file # # import os.path import sys if os.path.exists('../bind2nsd/Config.py'): sys.path.append('../bind2nsd') from Utils import * else: from bind2nsd.Utils import * class NsdKey: def __init__(self, name): self.name = name self.algorithm = '' self.secret = '' return def dump(self, ofile): if ofile == sys.stdout: print >> ofile, '=> NsdKey:' print >> ofile,' name = %s' % (self.name) print >> ofile,' algorithm = %s' % (self.algorithm) print >> ofile,' secret = %s' % (self.secret) else: print >> ofile, 'key:' print >> ofile,' name: "%s"' % (self.name) print >> ofile,' algorithm: %s' % (self.algorithm) print >> ofile,' secret: "%s"' % (self.secret) return def setName(self, val): self.name = val return def getName(self): return self.name def setAlgorithm(self, val): self.algorithm = val return def getAlgorithm(self): return self.algorithm def setSecret(self, val): self.secret = val return def getSecret(self): return self.secret class NsdZone: def __init__(self, name, config, ipkeymap): self.name = name self.config = config self.include = '' self.zonefile = '' self.type = '' self.allow_notify = [] # empty unless we're a slave zone self.also_notify = [] # empty unless we're a master zone self.provide_xfr = [] self.oldrootdir = '' self.ipkeymap = ipkeymap return def dump(self, ofile): if ofile == sys.stdout: print >> ofile, '=> NsdZone:' print >> ofile, ' name = %s' % (self.name) print >> ofile, ' include = %s' % (self.include) print >> ofile, ' zonefile = %s' % (self.zonefile) print >> ofile, ' type = %s' % (self.type) print >> ofile, ' allow_notify = %s' % (str(self.allow_notify)) print >> ofile, ' also_notify = %s' % (str(self.also_notify)) print >> ofile, ' provide_xfr = %s' % (str(self.provide_xfr)) else: print >> ofile, '' print >> ofile, 'zone:' print >> ofile, ' name: "%s"' % (self.name) print >> ofile, ' zonefile: "%s"' % (self.zonefile) # BOZO: this is a hack to avoid errors in the zone compiler # and needs to be handled more intelligently; this allows the # zone file to be non-existent (done by some ISPs) but still # listed in the named.conf if not os.path.exists(self.oldrootdir + self.zonefile): report_error('? missing zone file "%s"' % \ (self.oldrootdir + self.zonefile)) nlist = self.allow_notify if self.type == 'slave': print >> ofile, ' # this is a slave zone. masters are listed next.' for ii in nlist: print >> ofile, ' allow-notify: %s NOKEY' % (ii) print >> ofile, ' request-xfr: %s NOKEY' % (ii) else: print >> ofile, ' include: "%s"' % (self.include) for ii in self.also_notify: print >> ofile, ' notify: %s NOKEY' % (ii) for ii in self.provide_xfr: if ii in self.ipkeymap: print >> ofile, ' provide-xfr: %s %s' % (ii, self.ipkeymap[ii]) print >> ofile, ' notify: %s %s' % (ii, self.ipkeymap[ii]) else: print >> ofile, ' provide-xfr: %s NOKEY' % (ii) print >> ofile, ' notify: %s NOKEY' % (ii) return def setName(self, name): self.name = name return def getName(self): return self.name def setOldRootDir(self, name): self.oldrootdir = name return def getOldRootDir(self): return self.oldrootdir def setZonefile(self, file): self.zonefile = file return def getZonefile(self): return self.zonefile def setType(self, type): self.type = type return def getType(self): return self.type def addMaster(self, quad): self.masters.append(quad) return def getMasters(self): return self.masters def setInclude(self, name): self.include = name return def getInclude(self): return self.include def setAllowNotify(self, quad_list): self.allow_notify = quad_list return def getAllowNotify(self): return self.allow_notify def addAllowNotify(self, nlist): self.allow_notify.append(nlist) return def setAlsoNotify(self, quad_list): self.also_notify = quad_list return def getAlsoNotify(self): return self.also_notify def addAlsoNotify(self, nlist): self.also_notify.append(nlist) return def setProvideXfr(self, quad_list): self.provide_xfr = quad_list return def getProvideXfr(self): return self.provide_xfr class NsdOptions: def __init__(self, config): self.database = config.getValue('database') self.difffile = config.getValue('difffile') self.identity = config.getValue('identity') self.ip_address = config.getValue('ip-address') self.logfile = config.getValue('logfile') self.pidfile = config.getValue('pidfile') self.port = config.getValue('port') self.statistics = config.getValue('statistics') self.username = config.getValue('username') self.xfrd_reload_timeout = config.getValue('xfrd-reload-timeout') return def dump(self, ofile): if ofile == sys.stdout: print >> ofile, '=> Options:' print >> ofile, ' database: %s' % (self.database) print >> ofile, ' difffile: %s' % (self.difffile) print >> ofile, ' identity: %s' % (self.identity) print >> ofile, ' ip-address: %s' % (self.ip_address) print >> ofile, ' logfile: %s' % (self.logfile) print >> ofile, ' pidfile: %s' % (self.pidfile) print >> ofile, ' port: %s' % (self.port) print >> ofile, ' statistics: %s' % (self.statistics) print >> ofile, ' username: %s' % (self.username) print >> ofile, ' xfrd-reload-timeout: %s' % (self.xfrd_reload_timeout) else: print >> ofile, '#' print >> ofile, '# All of the values below have been pulled from' print >> ofile, '# either defaults or the config file' print >> ofile, '#' print >> ofile, '' print >> ofile, 'server:' print >> ofile, ' database: %s' % (self.database) print >> ofile, ' difffile: %s' % (self.difffile) print >> ofile, ' identity: %s' % (self.identity) iplist = self.ip_address.split() for ii in iplist: print >> ofile, ' ip-address: %s' % (ii.strip()) print >> ofile, ' logfile: %s' % (self.logfile) print >> ofile, ' pidfile: %s' % (self.pidfile) print >> ofile, ' port: %s' % (self.port) print >> ofile, ' statistics: %s' % (self.statistics) print >> ofile, ' username: %s' % (self.username) print >> ofile, ' xfrd-reload-timeout: %s' % \ (self.xfrd_reload_timeout) print >> ofile, '' return def setDatabase(self, name): self.database = name return def getDatabase(self): return self.database def setDifffile(self, name): self.difffile = name return def getDifffile(self): return self.difffile def setIdentity(self, name): self.identity = name return def getIdentity(self): return self.identity def setIpAddress(self, quad): self.ip_address = quad return def getIpAddress(self): return self.ip_address def setLogfile(self, val): self.logfile = val return def getLogfile(self): return self.logfile def setPort(self, val): self.port = val return def getPort(self): return self.port def setPidfile(self, val): self.pidfile = val return def getPidfile(self): return self.pidfile def setStatistics(self, val): self.statistics = val return def getStatistics(self): return self.statistics def setXfrdReloadTimeout(self, val): self.xfrd_reload_timeout = val return def getXfrdReloadTimeout(self): return self.xfrd_reload_timeout class NsdConf: def __init__(self, config): self.config = config self.fname = config.getValue('nsd_conf') self.files = config.getValue('nsd_files') self.preamble = config.getValue('nsd_preamble') self.acl_list = config.getValue('acl_list') self.oldrootdir = '' self.options = NsdOptions(config) self.includes = [] self.zones = {} self.keys = {} self.ipkeymap = {} return def populate(self, named): self.oldrootdir = named.getOptions().getDirectory().replace('"','') if self.oldrootdir[len(self.oldrootdir)-1] != '/': self.oldrootdir += '/' klist = named.getKeys() for ii in klist: oldk = named.getKey(ii) k = NsdKey(oldk.getName()) k.setAlgorithm(oldk.getAlgorithm()) k.setSecret(oldk.getSecret()) self.keys[k.getName()] = k #-- map each of the key ip addresses for faster lookup on dump() iplist = oldk.getIpAddrs() for jj in iplist: if jj not in self.ipkeymap: self.ipkeymap[jj] = k.getName() zlist = named.getZones() for ii in zlist: oldz = named.getZone(ii) z = NsdZone(oldz.getName(), self.config, self.ipkeymap) z.setZonefile(oldz.getFile()) z.setInclude(self.acl_list) z.setOldRootDir(self.oldrootdir) if 'slave' in oldz.getType().split(): z.setType('slave') # not used, but nice to know nlist = oldz.getMasters() for ii in nlist: z.addAllowNotify(ii) if len(oldz.getAllowNotify()) > 0: nlist = oldz.getAllowNotify() else: nlist = named.getOptions().getAllowNotify() for ii in nlist: z.addAllowNotify(ii) else: z.setType('master') if len(oldz.getAlsoNotify()): nlist = oldz.getAlsoNotify() else: nlist = named.getOptions().getAlsoNotify() for ii in nlist: z.addAlsoNotify(ii) if len(named.getOptions().getAllowTransfer()) > 0: z.setProvideXfr(named.getOptions().getAllowTransfer()) self.zones[z.getName()] = z return def dump(self): report_info('=> NsdConf: dumping data from \"%s\"...' % (self.fname)) self.options.dump(sys.stdout) report_info('=> NsdConf: list of includes...') report_info( str(self.includes)) report_info('=> NsdConf: zone info...') zlist = self.zones.keys() zlist.sort() for ii in zlist: self.zones[ii].dump(sys.stdout) report_info('=> NsdConf: key info...') klist = self.keys.keys() klist.sort() for ii in klist(): self.keys[ii].dump(sys.stdout) return def write_conf(self): nfile = open(self.fname, 'w+') self.options.dump(nfile) klist = self.keys.keys() klist.sort() for ii in klist: self.keys[ii].dump(nfile) zlist = self.zones.keys() zlist.sort() for ii in zlist: report_info(' writing info for zone "%s"...' % (self.zones[ii].getName())) self.zones[ii].dump(nfile) nfile.close() return def do_generate(self, newfd, start, stop, step, lhs, rrtype, rhs): #-- write the equivalent of the $GENERATE for ii in range(start, stop, step): left = lhs.replace('$', str(ii)) right = rhs.replace('$', str(ii)) print >> newfd, '%s %s %s' % (left, rrtype, right) return def make_zone_copy(self, oldpath, newpath): #-- copy the zone file line-by-line so we can catch $GENERATE usage report_info('=> copying "%s" to "%s"' % (oldpath, newpath)) if not os.path.exists(oldpath): os.system('touch ' + newpath) return oldfd = open(oldpath, 'r+') newfd = open(newpath, 'w+') line = oldfd.readline() while line: fields = line.split() if len(fields) > 0 and fields[0].strip() == '$GENERATE': report_info('=> processing "%s"...' % (line.strip())) index = 1 #-- determine start/stop range indices = fields[index].split('-') start = 0 stop = 0 if len(indices) == 2: start = int(indices[0]) stop = int(indices[1]) if stop < start: bail('? stop < start in range "%s"' % (fields[1].strip())) else: bail('? invalid range "%s"' % (fields[1].strip())) index += 1 #-- determine increment step = 1 if len(fields) == 6: step = int(fields[index]) index += 1 #-- get lhs lhs = fields[index].strip() index += 1 #-- get RR type rrtype = fields[index].strip() if rrtype not in [ 'NS', 'PTR', 'A', 'AAAA', 'DNAME', 'CNAME' ]: bail('? illegal RR type "%s"' % (rrtype)) index += 1 #-- get rhs rhs = fields[index].strip() index += 1 #-- do the $GENERATE self.do_generate(newfd, start, stop, step, lhs, rrtype, rhs) else: #-- just copy the line as is print >> newfd, line, line = oldfd.readline() oldfd.close() newfd.close() return def write_zone_files(self): acls = {} zlist = self.zones.keys() zlist.sort() for ii in zlist: oldpath = self.oldrootdir + self.zones[ii].getZonefile() newpath = self.config.getValue('tmpdir') + self.zones[ii].getZonefile() if not os.path.exists(os.path.dirname(newpath)): os.makedirs(os.path.dirname(newpath)) self.make_zone_copy(oldpath, newpath) incl = self.zones[ii].getInclude() if acls.has_key(incl): acls[incl] += 1 else: acls[incl] = 1 alist = acls.keys() alist.sort() for ii in alist: newpath = self.config.getValue('tmpdir') + ii run_cmd('touch ' + newpath, 'touch "%s"' % (newpath)) return def addZone(self, zone): name = zone.getName() self.zones[name] = zone return def getZones(self): return self.zones def addKey(self, key): self.keys[key.getName()] = key return def getKeys(self): return self.keys def getKey(self, name): if name in self.keys: return self.keys[name] else: return None nsd-3.2.16/contrib/bind2nsd/bind2nsd/Tokenizer.py0000664000175000017500000001127210647326614020561 0ustar matjematje#!/usr/bin/env python # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # class to tokenize a named.conf file # # T_KEYWORD = 0 T_STRING = 1 T_LBRACE = 2 T_RBRACE = 3 T_SEMI = 4 T_COMMA = 5 T_QUAD = 6 T_COMMENT = 7 T_NAME = 8 T_EOF = 9 T_LPAREN = 10 T_RPAREN = 11 NAMED_KEYWORDS = [ 'algorithm', 'allow-notify', 'allow-recursion', 'allow-transfer', 'also-notify', 'category', 'channel', 'check-names', 'controls', 'coresize', 'directory', 'dump-file', 'file', 'IN', 'in', 'include', 'key', 'keys', 'logging', 'masters', 'options', 'pid-file', 'print-time', 'recursive-clients', 'secret', 'severity', 'statistics-file', 'syslog', 'transfer-format', 'type', 'version', 'versions', 'zone', ] class Tokenizer: def __init__(self, fname): infile = file(fname) self.data = ''.join(infile.readlines()) self.curpos = 0 self.lastpos = len(self.data) self.line = 1 return def get(self): tok = '' done = False while not done: if self.curpos >= self.lastpos: return (T_EOF, None, self.line) c = self.data[self.curpos] if c == '\n': self.line += 1 if c.isspace(): self.curpos += 1 continue elif c == '{': self.curpos += 1 return (T_LBRACE, c, self.line) elif c == '}': self.curpos += 1 return (T_RBRACE, c, self.line) elif c == '(': self.curpos += 1 return (T_LPAREN, c, self.line) elif c == ')': self.curpos += 1 return (T_RPAREN, c, self.line) elif c == ';': self.curpos += 1 return (T_SEMI, c, self.line) elif c == '#': while c != '\n': tok += c self.curpos += 1 c = self.data[self.curpos] self.curpos += 1 if c == '\n': self.line += 1 return (T_COMMENT, tok, self.line) elif c == '"': tok += c self.curpos += 1 c = self.data[self.curpos] while c != '"': tok += c self.curpos += 1 c = self.data[self.curpos] tok += c self.curpos += 1 return (T_STRING, tok, self.line) elif c == '/' and self.data[self.curpos+1] == '/': while c != '\n': tok += c self.curpos += 1 c = self.data[self.curpos] if c == '\n': self.line += 1 self.curpos += 1 return (T_COMMENT, tok, self.line) elif c == '/' and self.data[self.curpos+1] == '*': cmtDone = False tok += c tok += self.data[self.curpos+1] self.curpos += 2 c = self.data[self.curpos] while not cmtDone: if c == '*' and self.data[self.curpos+1] == '/': tok += c tok += self.data[self.curpos+1] self.curpos += 2 return (T_COMMENT, tok, self.line) else: tok += c if c == '\n': self.line += 1 self.curpos +=1 c = self.data[self.curpos] return (T_COMMENT, tok, self.line) elif c.isdigit(): tok += c self.curpos += 1 c = self.data[self.curpos] while c.isdigit() or c == '.' or c == '/': tok += c self.curpos += 1 c = self.data[self.curpos] return (T_QUAD, tok, self.line) else: while c.isalnum() or c == '_' or c == '-' or c == '.': tok += c self.curpos += 1 c = self.data[self.curpos] if tok in NAMED_KEYWORDS: return (T_KEYWORD, tok, self.line) else: return (T_NAME, tok, self.line) return def dump(self): print 'Tokenizer raw data:' print 'cur, last: %d, %d' % (self.curpos, self.lastpos) print self.data return nsd-3.2.16/contrib/bind2nsd/set_version0000664000175000017500000000432510647326614017016 0ustar matjematje#!/bin/sh # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # set the version number in the right files # if [ $# -ne "1" ] then echo "usage: set_version " exit 1 fi NEWV=$1 #-- report on the current version numbers SETUPV=$(grep -i version setup.py | sed 's/version = //' | sed "s/'//g" | \ sed 's/,//' | sed 's/[ ]*//g') echo "setup.py is currently => ${SETUPV}" CONFIGV=$(grep -i version bind2nsd/Config.py | sed "s/'version'//" | \ sed "s/: '//" | sed "s/',//" | sed 's/[ \t]*//g') echo "bind2nsd/Config.py is currently => ${CONFIGV}" #-- replace them sed --in-place=.bak \ "s/ version = '${SETUPV}',/ version = '${NEWV}',/" setup.py sed --in-place=.bak \ "s/[ \t]*'version'[ \t]*: '${CONFIGV}',/ 'version' : '${NEWV}',/" bind2nsd/Config.py #-- report on the new version numbers SETUPV=$(grep -i version setup.py | sed 's/version = //' | sed "s/'//g" | \ sed 's/,//' | sed 's/[ ]*//g') echo "setup.py is now => ${SETUPV}" CONFIGV=$(grep -i version bind2nsd/Config.py | sed "s/'version'//" | \ sed "s/: '//" | sed "s/',//" | sed 's/[ \t]*//g') echo "bind2nsd/Config.py is now => ${CONFIGV}" nsd-3.2.16/contrib/bind2nsd/chk_version0000664000175000017500000000271710647326614016773 0ustar matjematje#!/bin/sh # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # see what version number we're at # SETUPV=$(grep -i version setup.py | sed 's/version = //' | sed "s/'//g" | \ sed 's/,//' | sed 's/[ ]*//g') echo "setup.py => ${SETUPV}" CONFIGV=$(grep -i version bind2nsd/Config.py | sed "s/'version'//" | \ sed "s/: '//" | sed "s/',//" | sed 's/[ \t]*//g') echo "bind2nsd/Config.py => ${CONFIGV}" nsd-3.2.16/contrib/bind2nsd/README0000664000175000017500000000312010651575270015402 0ustar matjematjebind2nsd -- translate from BIND named.conf to NSD nsd.conf -- then, sync up configuration files with a Secure64 server To install these tools on Linux systems: # ./install.sh Then, copy bind2nsd.conf to the directory you will run these commands from (e.g., /etc/named or /etc/bind9) and then edit the values properly. Passwords for logging into a Secure64 system can be stored in the bind2nsd.conf file (as clear text only) or can be stored encrypted by using the 'password_file' config item and the s64-mkpw utility. -- Copyright (c) 2007, Secure64 Software Corporation. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. nsd-3.2.16/contrib/bind2nsd/etc/0000775000175000017500000000000012173226525015276 5ustar matjematjensd-3.2.16/contrib/bind2nsd/etc/bind2nsd.conf0000664000175000017500000000653410647326614017664 0ustar matjematje# Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # config file for bind2nsd # #--- parameters for the bind2nsd command --------------------------------- # default: named_root = /etc/bind9 # default: named_conf = named.conf # default: nsd_conf = nsd.conf # default: nsd_conf_dir = /etc/nsd/ # default: nsd_preamble = nsd.conf-preamble #--- options to fill in the blanks in nsd.conf --------------------------- # default: acl_list = "acl_list" # default: database = "nsd.db" => server data base name # default: difffile = "ixfr.db" => change data base on server # default: identity = "unknown" => nodename for server # default: ip-address = 127.0.0.1 1.2.3.4 => listen for requests on these # default: logfile = "log" => nsd log file on server # default: pidfile = "pid" => nsd pid file on server # default: port = 53 # default: statistics = 3600 # default: username = nsd # default: xfrd-reload-timeout = 10 #-- parameters for s64-sync or s64-mkpw ----------------------------------- # default: bind2nsd = /usr/bin/bind2nsd => where the translation script lives # default: dest-ip = 127.0.0.1 => where to copy to # default: destuser = dns => login name for scp (on server) # default: dnspw = iforgot => dnsconfig password (see s64-mkpw) # default: named-checkconf = /usr/sbin/named-checkconf => BIND command location # default: named-checkzone = /usr/sbin/named-checkzone => BIND command location # default: named_root = /etc/bind9 => default BIND config directory # default: named_conf = named.conf => BIND config file name # default: named_watchlist = /etc/named.conf => config files to poll # default: password_file = /etc/bind2nsd/passwd => encrypted passwords # default: sleep_time = 5 => poll time, in seconds # default: syspw = iforgot => sysconfig password (see s64-mkpw) # default: tmpdir = /tmp/secure64/ => must have trailing slash, is where the # xlated files are stashed #-- only useful in DEMO-MODE in s64-sync # default: destdir = /tmp/foobar => where to copy xlated files to # default: rebuild_cmd = /etc/init.d/nsdc rebuild => rebuild zonedb # default: restart_cmd = /etc/init.d/nsdc restart => restart nsd # default: start_cmd = /etc/init.d/nsdc start => start nsd # default: stop_cmd = /etc/init.d/nsdc stop => stop nsd # default: zonec_cmd = /etc/init.d/zonec => invoke nsd zone compiler nsd-3.2.16/contrib/bind2nsd/setup.py0000664000175000017500000000343410651575270016244 0ustar matjematje# # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # installation/setup script for bind2nsd # from distutils.core import setup setup(name = 'bind2nsd', version = '0.5.0', author = 'Secure64 Software Corporation', author_email = 'support@secure64.com', maintainer = 'Al Stone', maintainer_email = 'ahs3@secure64.com', url = 'http://www.secure64.com', description = 'automatic named/nsd translation and synchronization', packages = [ 'bind2nsd' ], scripts = [ 'scripts/bind2nsd', 'scripts/s64-sync', 'scripts/s64-mkpw', ], data_files = [ ('/usr/share/doc/bind2nsd', ['./README', './TODO']), ('/etc/bind2nsd', ['etc/bind2nsd.conf']), ] ) nsd-3.2.16/contrib/bind2nsd/scripts/0000775000175000017500000000000012173226525016212 5ustar matjematjensd-3.2.16/contrib/bind2nsd/scripts/nsd-sync0000664000175000017500000002603710651575270017706 0ustar matjematje#!/usr/bin/env python # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # When named.conf changes, update the NSD machine # # #-- imports import getopt import os import os.path import popen2 import re import sys import time if os.path.exists('../bind2nsd/Config.py'): sys.path.append('../bind2nsd') from Config import * from NamedConf import * from NsdConf import * from Utils import * else: from bind2nsd.Config import * from bind2nsd.NamedConf import * from bind2nsd.NsdConf import * from bind2nsd.Utils import * if os.path.exists('../pexpect-2.1'): sys.path.append('../pexpect-2.1') import pexpect import pxssh #-- globals conf = Config() #-- useful functions def usage(): print 'nsd-sync %s, copyright(c) 2007, Secure64 Software Corporation' \ % (conf.getValue('version')) print print 'usage: nsd-sync [-a|--analyze-only] [-h|--help] [-s|--sync-only]' print ' [-n|--now]' print ' -a | --analyze-only => look for and report errors, but do' print ' not sync with the NSD server' print ' -h | --help => print this message and quit' print ' -n | --now => do not poll, sync immediately' print ' -s | --sync-only => sync without translating BIND files' print ' -v | --verbose => output lots of info' return def rebuild_nsd_files(): result = False xlate = conf.getValue('bind2nsd') if os.path.exists(xlate): result = run_cmd(xlate, 'running bind2nsd...') else: report_error('? could not find "%s" and have got to have it' % (xlate)) report_error(' skipping rebuild of NSD files') return result def scp_target(): #-- do the scp to an actual NSD server report_info('=> using scp to transfer to NSD system...') tmpdir = conf.getValue('tmpdir') # must have trailing '/' if not os.path.exists(tmpdir) and not os.path.isdir(tmpdir): bail('? cannot find "%s"...' % (tmpdir)) #-- this feels a bit dodgy due to issues in pexpect when it goes # up against passwd and other such nastiness from scp/ssh -- all # we should have to do is child.wait() really, but that does not # work as it should. # # NB: it turn out that you can _not_ put a '*' at the end of the # source path; pexpect.spawn() screws up and the parsing of the string # and ends up ignoring everything up to the '*', meaning the command # does not have the 'scp' part in it and does not get executed properly. # pwd = os.getcwd() os.chdir(tmpdir) flist = os.listdir('.') fnames = ' '.join(flist) cmd = 'scp -r ' + fnames cmd += ' ' + conf.getValue('destuser') + '@' cmd += conf.getValue('dest-ip') + ':' report_info('=> ' + cmd) child = pexpect.spawn(cmd) if len(conf.getValue('dnspw')) > 0: child.expect('.*ssword:') child.sendline(conf.getValue('dnspw')) child.expect('.*' + conf.getValue('nsd_conf') + '.*') child.expect(pexpect.EOF) child.close() os.chdir(pwd) return def cp_files(analyze): #-- we assume everything has already been copied to the tmpdir by bind2nsd if analyze: return tmpdir = conf.getValue('tmpdir') # must have trailing '/' if not os.path.exists(tmpdir) and not os.path.isdir(tmpdir): bail('? cannot find "%s"...' % (tmpdir)) #-- scp the entire tmp directory if conf.getValue('DEMO-MODE'): report_info('** scp would go here, but cp -r for demonstration puposes') cmd = 'cp -r ' + tmpdir + '* ' + conf.getValue('destdir') run_cmd(cmd, 'using cp to transfer to demo system...') else: scp_target() return def restart_nsd(): if conf.getValue('DEMO-MODE'): cmd = conf.getValue('stop_cmd') run_cmd(cmd, 'stopping nsd...') # BOZO: rebuild is not behaving when there are errors, so the hack is # to remove the existing db, run the zone compiler and restart nsd #cmd = conf.getValue('rebuild_cmd') #os.system(cmd) cmd = 'rm -f ' + conf.getValue('database') run_cmd(cmd, 'removing old zonedb...') cmd = conf.getValue('zonec_cmd') run_cmd(cmd, 'rebuilding zonedb...') cmd = conf.getValue('start_cmd') run_cmd(cmd, 'starting nsd...') else: cmd = 'ssh -a -x ' cmd += conf.getValue('destuser') + '@' + conf.getValue('dest-ip') child = pexpect.spawn(cmd) if not child.isalive(): bail('? cannot login to NSD system at %s' % \ (conf.getValue('dest-ip'))) else: report_info('=> restarting NSD on %s' % \ (conf.getValue('dest-ip'))) child.expect('.*ssword:') child.sendline(conf.getValue('syspw')) child.expect('# ') report_info('=> now logged in') report_info('=> issuing zonec') child.sendline(conf.getValue('zonec_cmd')) if isVerbose(): child.logfile = sys.stdout child.expect('# ') report_info('=> issuing stop') child.sendline(conf.getValue('stop_cmd')) child.expect('# ') report_info('=> issuing start') child.sendline(conf.getValue('start_cmd')) child.expect('# ') child.sendline('exit') child.close() report_info('=> restart done') return def quick_parse(): #-- build an in-core representation of the named.conf file named_root = conf.getValue('named_root') named_fname = conf.getValue('named_conf') report_info('=> parsing named.conf file \"%s\"...' % (named_fname)) pwd = os.getcwd() if os.path.exists(named_root) and os.path.isdir(named_root): os.chdir(named_root) else: bail('? cannot find the named root directory "%s"' % (named_root)) named = NamedConf(named_fname) os.chdir(pwd) return named def run_named_check(named): #-- run named-checkconf on the config file and then run named-checkzone # on each zone file chkconf = conf.getValue('named-checkconf') if os.path.exists(chkconf): fname = conf.getValue('named_root') fname += '/' + conf.getValue('named_conf') report_info('=> running "%s" on "%s"...' % (chkconf, fname)) (output, errors) = run_cmd_capture(chkconf + ' ' + fname) if len(errors) > 0: report_info('? errors found --->') report_info(errors) else: report_info(' all is well.') else: report_error("? wanted to run named-checkconf, dude, but it's not there.") chkzone = conf.getValue('named-checkzone') if os.path.exists(chkzone): zdict = named.getZones() zlist = zdict.keys() zlist.sort() rname = named.getOptions().getDirectory().replace('"','') report_info('=> running "%s" on all zones...' % (chkzone)) prog = re.compile(':[0-9][0-9]*:') for ii in zlist: zone = zdict[ii].getName() zfile = rname + '/' + zdict[ii].getFile() (output, errors) = run_cmd_capture(chkzone + ' ' + zone + ' ' + zfile) if len(output) > 0 and prog.search(output) != None: report_info(output.strip()) else: report_error("? wanted to run named-checkzone, dude, but it's not there.") return def run_zonec(): zonec = conf.getValue('zonec_cmd') if os.path.exists(zonec): report_info('=> running the zone compiler "%s"...' % (zonec)) fname = conf.getValue('nsd_conf') tmpdir = conf.getValue('tmpdir') cmd = zonec + ' -c ' + tmpdir + '/' + fname + ' -d ' + tmpdir cmd += ' -f ' + tmpdir + '/zone.db' os.system('rm -f ' + tmpdir + '/zone.db') (output, errors) = run_cmd_capture(cmd) if len(errors) > 0: report_info('? errors found --->') report_info(errors) else: report_info(' all is well.') else: report_error("? hmph. wanted to run zonec, but it's not there.") return #-- main --------------------------------------------------------------- def main(): try: opts, args = getopt.getopt(sys.argv[1:], 'ahnsv', ['analyze-only', 'help', 'now', 'sync-only', 'verbose'] ) except getopt.GetoptError: usage() sys.exit(1) now = False analyze_only = False sync_only = False for ii, val in opts: if ii in ('-a', '--analyze-only'): analyze_only = True if ii in ('-h', '--help'): usage() sys.exit(0) if ii in ('-n', '--now'): now = True if ii in ('-s', '--sync-only'): sync_only = True if ii in ('-v', '--verbose'): set_verbosity(True) last_stat = {} this_stat = {} #-- don't poll unless we need to... if now: rebuild_nsd_files() cp_files(analyze_only) restart_nsd() sys.exit(0) #-- ...and don't poll if we just need to sync up to the machine... if sync_only: cp_files(analyze_only) restart_nsd() sys.exit(0) #-- ...and don't poll if we're just checking things out... if analyze_only: #-- well, and do a couple of extra things, too set_verbosity(True) report_info( \ 'nsd-sync %s, copyright(c) 2007, Secure64 Software Corporation' \ % (conf.getValue('version'))) named = quick_parse() rebuild_nsd_files() run_named_check(named) cp_files(analyze_only) run_zonec() sys.exit(0) #-- apparently we need to poll... tmplist = conf.getValue('named_watchlist').split() watchlist = [] for ii in tmplist: watchlist.append(ii.strip()) while True: for ii in watchlist: if ii in last_stat.keys(): statinfo = os.stat(ii) this_stat[ii] = (statinfo.st_size, statinfo.st_mtime) (old_size, old_mtime) = last_stat[ii] (new_size, new_mtime) = this_stat[ii] if old_size != new_size or old_mtime != new_mtime: report_info('aha! "%s" has changed!' % (ii)) last_stat[ii] = (new_size, new_mtime) rebuild_nsd_files() cp_files(analyze_only) restart_nsd() else: statinfo = os.stat(ii) last_stat[ii] = (statinfo.st_size, statinfo.st_mtime) this_stat[ii] = last_stat[ii] time.sleep(int(conf.getValue('sleep_time'))) sys.exit(0) #-- just in case if __name__ == '__main__': main() nsd-3.2.16/contrib/bind2nsd/scripts/bind2nsd0000664000175000017500000000641010651575270017644 0ustar matjematje#!/usr/bin/env python # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # Convert a BIND named.conf file to an NSD nsd.conf file # #-- imports import os import os.path import sys if os.path.exists('../bind2nsd/Config.py'): sys.path.append('../bind2nsd') from Config import * from NamedConf import * from NsdConf import * from Utils import * else: from bind2nsd.Config import * from bind2nsd.NamedConf import * from bind2nsd.NsdConf import * from bind2nsd.Utils import * #-- globals conf = Config() DEBUG = conf.getValue('DEBUG') #-- utility functions def usage(): print 'bind2nsd %s -- Copyright (c) 2007 Secure64 Software Corporation.' % \ (conf.getValue('version')) print 'usage: bind2nsd' print ' all options are controlled by the config file' return #-- main starts here ---------------------------------------------- if len(sys.argv) > 2: usage() sys.exit(1) elif len(sys.argv) == 2 and sys.argv[1] == '-v': set_verbosity(True) #-- build an in-core representation of the named.conf file named_root = conf.getValue('named_root') named_fname = conf.getValue('named_conf') report_info('=> parsing named.conf file \"%s\"...' % (named_fname)) pwd = os.getcwd() if os.path.exists(named_root) and os.path.isdir(named_root): os.chdir(named_root) else: bail('? er, cannot find the named root directory "%s"' % (named_root)) named = NamedConf(named_fname) if DEBUG: named.dump() os.chdir(pwd) #-- open the nsd.conf file and write out the translated version, including # all of the zone files needed. note that we're stashing everything in # the tmpdir as if it were a chroot dir (it simplifies the copy to our # server later on. # # FIXME: this is not multi-user safe -- if someone runs two copies # with the same tmpdir, we're hosed # pwd = os.getcwd() tmpdir = conf.getValue('tmpdir') if not os.path.exists(tmpdir): os.makedirs(tmpdir) os.chdir(tmpdir) nsd_fname = conf.getValue('nsd_conf') report_info('=> writing translated configuration to \"%s\"...' % (nsd_fname)) nsd = NsdConf(conf) nsd.populate(named) if DEBUG: nsd.dump() nsd.write_conf() report_info('=> writing zone files to \"%s\"...' % (tmpdir)) nsd.write_zone_files() os.chdir(pwd) #-- all done sys.exit(0) nsd-3.2.16/contrib/bind2nsd/scripts/s64-sync0000664000175000017500000002652310651575270017536 0ustar matjematje#!/usr/bin/env python # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # When named.conf changes, update the DNS machine # # #-- imports import getopt import os import os.path import popen2 import re import sys import time if os.path.exists('../bind2nsd/Config.py'): sys.path.append('../bind2nsd') from Config import * from Utils import * from NamedConf import * from NsdConf import * else: from bind2nsd.Config import * from bind2nsd.Utils import * from bind2nsd.NamedConf import * from bind2nsd.NsdConf import * if os.path.exists('../pexpect-2.1'): sys.path.append('../pexpect-2.1') import pexpect import pxssh #-- globals conf = Config() #-- useful functions def usage(): print 's64-sync %s, copyright(c) 2007, Secure64 Software Corporation' \ % (conf.getValue('version')) print print 'usage: s64-sync [-a|--analyze-only] [-h|--help] [-s|--sync-only]' print ' [-n|--now]' print ' -a | --analyze-only => look for and report errors, but do' print ' not sync with the Secure64 server' print ' -h | --help => print this message and quit' print ' -n | --now => do not poll, sync immediately' print ' -s | --sync-only => sync without translating BIND files' print ' -v | --verbose => output lots of info' return def rebuild_nsd_files(): result = False xlate = conf.getValue('bind2nsd') if os.path.exists(xlate): result = run_cmd(xlate, 'running bind2nsd...') else: report_error('? could not find "%s" and have got to have it' % (xlate)) report_error(' skipping rebuild of NSD files') return result def scp_s64(): #-- do the scp to an actual Secure64 server report_info('=> using scp to transfer to Secure64 system...') tmpdir = conf.getValue('tmpdir') # must have trailing '/' if not os.path.exists(tmpdir) and not os.path.isdir(tmpdir): bail('? cannot find "%s"...' % (tmpdir)) #-- this feels a bit dodgy due to issues in pexpect when it goes # up against passwd and other such nastiness from scp/ssh -- all # we should have to do is child.wait() really, but that does not # work as it should. # # NB: it turn out that you can _not_ put a '*' at the end of the # source path; pexpect.spawn() screws up and the parsing of the string # and ends up ignoring everything up to the '*', meaning the command # does not have the 'scp' part in it and does not get executed properly. # pwd = os.getcwd() os.chdir(tmpdir) #-- this is what i wanted to do... #cmd = 'scp -r ' + tmpdir + ' dns@' + conf.getValue('dest-ip') + ':' #-- this is what works... flist = os.listdir('.') fnames = ' '.join(flist) cmd = 'scp -r ' + fnames cmd += ' ' + conf.getValue('destuser') + '@' cmd += conf.getValue('dest-ip') + ':' report_info('=> ' + cmd) child = pexpect.spawn(cmd) if len(conf.getValue('dnspw')) > 0: child.expect('.*ssword:') child.sendline(conf.getValue('dnspw')) child.expect('.*' + conf.getValue('nsd_conf') + '.*') child.expect(pexpect.EOF) child.close() os.chdir(pwd) return def cp_files(analyze): #-- we assume everything has already been copied to the tmpdir by bind2nsd if analyze: return tmpdir = conf.getValue('tmpdir') # must have trailing '/' if not os.path.exists(tmpdir) and not os.path.isdir(tmpdir): bail('? cannot find "%s"...' % (tmpdir)) #-- scp the entire tmp directory if conf.getValue('DEMO-MODE'): report_info('** scp would go here, but cp -r for demonstration puposes') cmd = 'cp -r ' + tmpdir + '* ' + conf.getValue('destdir') run_cmd(cmd, 'using cp to transfer to demo system...') else: scp_s64() return def restart_nsd(): if conf.getValue('DEMO-MODE'): cmd = conf.getValue('stop_cmd') run_cmd(cmd, 'stopping nsd...') # BOZO: rebuild is not behaving when there are errors, so the hack is # to remove the existing db, run the zone compiler and restart nsd #cmd = conf.getValue('rebuild_cmd') #os.system(cmd) cmd = 'rm -f ' + conf.getValue('database') run_cmd(cmd, 'removing old zonedb...') cmd = conf.getValue('zonec_cmd') run_cmd(cmd, 'rebuilding zonedb...') cmd = conf.getValue('start_cmd') run_cmd(cmd, 'starting nsd...') else: cmd = 'ssh -a -x dns@' + conf.getValue('dest-ip') child = pexpect.spawn(cmd) if not child.isalive(): bail('? cannot login to Secure64 system at %s' % \ (conf.getValue('dest-ip'))) else: report_info('=> restarting Secure64 NSD on %s' % \ (conf.getValue('dest-ip'))) child.expect('.*ssword:') child.sendline(conf.getValue('syspw')) child.expect('\[view@.*> ') report_info('=> now logged in') child.sendline('enable dnsconfig') child.expect('.*ssword:') child.sendline(conf.getValue('dnspw')) child.expect('\*.*') report_info('=> issuing zonec') child.sendline('zonec') if isVerbose(): child.logfile = sys.stdout child.expect('\[dnsconfig@.*# ') report_info('=> issuing stop') child.sendline('stop') child.expect('\[dnsconfig@.*# ') report_info('=> issuing start') child.sendline('start') child.expect('\[dnsconfig@.*# ') child.sendline('exit') child.expect('\[view@.*> ') child.sendline('exit') child.close() report_info('=> restart done') return def quick_parse(): #-- build an in-core representation of the named.conf file named_root = conf.getValue('named_root') named_fname = conf.getValue('named_conf') report_info('=> parsing named.conf file \"%s\"...' % (named_fname)) pwd = os.getcwd() if os.path.exists(named_root) and os.path.isdir(named_root): os.chdir(named_root) else: bail('? cannot find the named root directory "%s"' % (named_root)) named = NamedConf(named_fname) os.chdir(pwd) return named def run_named_check(named): #-- run named-checkconf on the config file and then run named-checkzone # on each zone file chkconf = conf.getValue('named-checkconf') if os.path.exists(chkconf): fname = conf.getValue('named_root') fname += '/' + conf.getValue('named_conf') report_info('=> running "%s" on "%s"...' % (chkconf, fname)) (output, errors) = run_cmd_capture(chkconf + ' ' + fname) if len(errors) > 0: report_info('? errors found --->') report_info(errors) else: report_info(' all is well.') else: report_error("? wanted to run named-checkconf, dude, but it's not there.") chkzone = conf.getValue('named-checkzone') if os.path.exists(chkzone): zdict = named.getZones() zlist = zdict.keys() zlist.sort() rname = named.getOptions().getDirectory().replace('"','') report_info('=> running "%s" on all zones...' % (chkzone)) prog = re.compile(':[0-9][0-9]*:') for ii in zlist: zone = zdict[ii].getName() zfile = rname + '/' + zdict[ii].getFile() (output, errors) = run_cmd_capture(chkzone + ' ' + zone + ' ' + zfile) if len(output) > 0 and prog.search(output) != None: report_info(output.strip()) else: report_error("? wanted to run named-checkzone, dude, but it's not there.") return def run_zonec(): zonec = conf.getValue('zonec_cmd') if os.path.exists(zonec): report_info('=> running the zone compiler "%s"...' % (zonec)) fname = conf.getValue('nsd_conf') tmpdir = conf.getValue('tmpdir') cmd = zonec + ' -c ' + tmpdir + '/' + fname + ' -d ' + tmpdir cmd += ' -f ' + tmpdir + '/zone.db' os.system('rm -f ' + tmpdir + '/zone.db') (output, errors) = run_cmd_capture(cmd) if len(errors) > 0: report_info('? errors found --->') report_info(errors) else: report_info(' all is well.') else: report_error("? hmph. wanted to run zonec, but it's not there.") return #-- main --------------------------------------------------------------- def main(): try: opts, args = getopt.getopt(sys.argv[1:], 'ahnsv', ['analyze-only', 'help', 'now', 'sync-only', 'verbose'] ) except getopt.GetoptError: usage() sys.exit(1) now = False analyze_only = False sync_only = False for ii, val in opts: if ii in ('-a', '--analyze-only'): analyze_only = True if ii in ('-h', '--help'): usage() sys.exit(0) if ii in ('-n', '--now'): now = True if ii in ('-s', '--sync-only'): sync_only = True if ii in ('-v', '--verbose'): set_verbosity(True) last_stat = {} this_stat = {} #-- don't poll unless we need to... if now: rebuild_nsd_files() cp_files(analyze_only) restart_nsd() sys.exit(0) #-- ...and don't poll if we just need to sync up to the Secure64 machine... if sync_only: cp_files(analyze_only) restart_nsd() sys.exit(0) #-- ...and don't poll if we're just checking things out... if analyze_only: #-- well, and do a couple of extra things, too set_verbosity(True) report_info( \ 's64-sync %s, copyright(c) 2007, Secure64 Software Corporation' \ % (conf.getValue('version'))) named = quick_parse() rebuild_nsd_files() run_named_check(named) cp_files(analyze_only) run_zonec() sys.exit(0) #-- apparently we need to poll... tmplist = conf.getValue('named_watchlist').split() watchlist = [] for ii in tmplist: watchlist.append(ii.strip()) while True: for ii in watchlist: if ii in last_stat.keys(): statinfo = os.stat(ii) this_stat[ii] = (statinfo.st_size, statinfo.st_mtime) (old_size, old_mtime) = last_stat[ii] (new_size, new_mtime) = this_stat[ii] if old_size != new_size or old_mtime != new_mtime: report_info('aha! "%s" has changed!' % (ii)) last_stat[ii] = (new_size, new_mtime) rebuild_nsd_files() cp_files(analyze_only) restart_nsd() else: statinfo = os.stat(ii) last_stat[ii] = (statinfo.st_size, statinfo.st_mtime) this_stat[ii] = last_stat[ii] time.sleep(int(conf.getValue('sleep_time'))) sys.exit(0) #-- just in case if __name__ == '__main__': main() nsd-3.2.16/contrib/bind2nsd/scripts/s64-mkpw0000664000175000017500000000510010651575270017524 0ustar matjematje#!/usr/bin/env python # Copyright (c) 2007, Secure64 Software Corporation # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in # all copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN # THE SOFTWARE. # # # # encrypt a passwd (very simplistic for now, using GPG or such-like # key someday) # # #-- imports import os import os.path import sys import getpass import sys if os.path.exists('../bind2nsd/Config.py'): sys.path.append('../bind2nsd') from Config import * else: from bind2nsd.Config import * if os.path.exists('../pyDes-1.2'): sys.path.append('../pyDes-1.2') import pyDes #-- globals conf = Config() #-- useful functions def usage(): print 's64-mkpw %s, copyright(c) 2007, Secure64 Software Corporation' \ % (conf.getValue('version')) print print 'usage: s64-mkpw' return def mkprintable(val): cstr = '' for ii in range(0, len(val)): c = val[ii] cstr += '%d ' % (ord(c)) return cstr #-- main --------------------------------------------------------------- def main(): if len(sys.argv) > 1: usage() sys.exit(1) print 's64-mkpw %s, copyright(c) 2007, Secure64 Software Corporation' \ % (conf.getValue('version')) syspw = getpass.getpass('sysconfig password: ') dnspw = getpass.getpass('dnsconfig password: ') fd = open(conf.getValue('password_file'), 'w+') obj = pyDes.triple_des('aBcDeFgHiJkLmNoP', pyDes.ECB) fd.write(mkprintable(obj.encrypt(syspw, '#')) + '\n') fd.write(mkprintable(obj.encrypt(dnspw, '#')) + '\n') fd.close() print '=> stored password in "%s"' % (conf.getValue('password_file')) return if __name__ == '__main__': main() nsd-3.2.16/contrib/bind2nsd/MANIFEST0000664000175000017500000000036110647326614015660 0ustar matjematjeREADME setup.py bind2nsd/Config.py bind2nsd/Key.py bind2nsd/NamedConf.py bind2nsd/NsdConf.py bind2nsd/Parser.py bind2nsd/Tokenizer.py bind2nsd/Utils.py bind2nsd/Zone.py bind2nsd/__init__.py scripts/bind2nsd scripts/s64-mkpw scripts/s64-sync nsd-3.2.16/contrib/bind2nsd/ChangeLog0000664000175000017500000000500210651575270016275 0ustar matjematje2007-07-24 Al Stone * bind2nsd/*, scripts/*: cleaned up the way modules were being imported so that it's much simpler, hopefully more reliable. * bind2nsd/Parser.py: added code to recognize but skip the view{}, trusted-keys{}, and lwres{} clauses; added quad_list_with_keys(). * bind2nsd/Zone.py: store allow-notify statements. 2007-07-18 Al Stone * bind2nsd/Config.py: do not open config file with r+ * bind2nsd/NamedConf.py: remove recursive module import when running in ways I hadn't tried. 2007-07-13 Al Stone * etc/: added in some files forgotten when convertion to FOSS.... * scripts/nsd-sync: ...including this one. 2007-07-06 Al Stone * TODO: update. * bind2nsd/Key.py: correct missing ')'. * bind2nsd/Tokenizer.py: reformatting. * bind2nsd/Parser.py: handle 'recursive-clients' option; handle 'allow-notify' option; handle 'also-notify' option in zones. * bind2nsd/NamedConf.py: handle 'allow-notify' option; handle 'also-notify' for simple cases. * bind2nsd/NsdConf.py: handle 'allow-notify' option; handle 'also-notify' for simple cases. 2007-06-29 Al Stone * TODO: update. * bind2nsd/NsdConf.py: when writing zone data files, look for any use of the $GENERATE directive and replace it with the proper RRs; populate info from 'key {}' in BIND. * bind2nsd/Parser.py: add in several 'options {}' clauses that we'll recognize but do nothing about for now; handle multiple 'key {}' clauses; recognize 'server {}' clauses. * bind2nsd/Key.py: add getName(); added self.ipaddrs and methods. * bind2nsd/NamedConf.py: allow for more than one 'key {}' clause. * bind2nsd/Tokenizer.py: added 'keys' as a keyword. 2007-06-28 Al Stone * TODO: update. * bind2nsd/Config.py: 'dest-ip' added as the place to scp files to; search for bind2nsd.conf in '.', $HOME, _and_ /etc/bind2nsd; the default for 'password' file is '/etc/bind2nsd/passwd' _not_ '/etc/secure64/passwd'. * bind2nsd/NsdConf.py: handle multiple 'ip-address' clauses in the 'server' section. * etc/bind2nsd.conf: add 'dest-ip'; add info on all options. * scripts/s64-sync: replace 'ip-address' with 'dest-ip'; make sure zonec output shows up when in verbose mode. * bind2nsd/Utils.py: added isVerbose(). 2007-06-27 Al Stone * TODO: update. * s64-sync: allow for scp to destination when no password needed; clean up demo-mode 'cp -r'. * Config.py: add 'destuser' option. nsd-3.2.16/contrib/bind2nsd/COPYING0000664000175000017500000000206310647326614015563 0ustar matjematjeCopyright (c) 2007, Secure64 Software Corporation Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. nsd-3.2.16/contrib/nsd.zones2nsd.conf0000664000175000017500000000704710546466356016421 0ustar matjematje#!/usr/bin/env python # Contributed 2006 by Stephane Bortzmeyer. # Changed 20070102 by Wouter to handle primary zones and file names. # Converts a nsd 2 "nsd.zones" file to a nsd 3 "nsd.conf" file. # Change at will nsd_zones_name = "./nsd.zones" key_dir = "/local/nsd/etc/keys" # Directory holding the TSIG keys import re import os.path primary_line_re = re.compile("^zone\s+([a-z0-9\.-]+)\s+([a-z0-9/\.-]+)\s*$", re.IGNORECASE) secondary_line_re = re.compile("^zone\s+([a-z0-9\.-]+)\s+([a-z0-9/\.-]+)\s+masters\s+([0-9a-f:\. ]*)\s*$", re.IGNORECASE) notify_line_re = re.compile("^zone\s+([a-z0-9\.-]+)\s+([a-z0-9/\.-]+)\s+notify\s+([0-9a-f:\. ]*)\s*$", re.IGNORECASE) comment_re = re.compile("^\s*;") empty_re = re.compile("^\s*$") nsd_zones = open(nsd_zones_name) keys = {} for line in nsd_zones.xreadlines(): if comment_re.search(line) or empty_re.search(line): pass elif secondary_line_re.search(line): match = secondary_line_re.search(line) zone = match.group(1) zonefile = match.group(2) master_group = match.group(3) masters = re.split("\s+", master_group) print """zone: name: "%s" zonefile: "%s" # This is to allow "nsdc update" to work. allow-notify: 127.0.0.1 NOKEY # This is a slave zone. Masters are listed below.""" % (zone, zonefile) for master in masters: if re.search("^\s*$", master): continue key_filename = "%s/%s.tsiginfo" % (key_dir, master) if os.path.exists(key_filename): key_content = open(key_filename) peer_ip = key_content.readline() peer_ip = peer_ip[:-1] key_name = key_content.readline() key_name = key_name[:-1] algorithm = key_content.readline() algorithm = int(algorithm[:-1]) if algorithm == 157: algorithm_name = "hmac-md5" else: raise Exception("Unsupported TSIG algorithm %i" % algorithm) secret = key_content.readline() secret = secret[:-1] key_content.close() key = key_name keys[key_name] = { 'algorithm': algorithm_name, 'secret': secret} else: key = "NOKEY" print """ allow-notify: %s %s request-xfr: %s %s""" % (master, key, master, key) print "" elif primary_line_re.search(line): match = primary_line_re.search(line) zone = match.group(1) zonefile = match.group(2) print """zone: name: "%s" zonefile: "%s" """ % (zone, zonefile) elif notify_line_re.search(line): match = notify_line_re.search(line) zone = match.group(1) zonefile = match.group(2) notify_group = match.group(3) notifies = re.split("\s+", notify_group) print """zone: name: "%s" zonefile: "%s" # This is a master zone. Slaves are listed below.""" % (zone, zonefile) for notify in notifies: if re.search("^\s*$", notify): continue key = "NOKEY" print """ notify: %s %s""" % (notify, key) print "" else: raise Exception("Invalid line \"%s\"" % line) nsd_zones.close() for key in keys.keys(): print """key: name: "%s" algorithm: %s secret: "%s" """ % (key, keys[key]['algorithm'], keys[key]['secret']) print "" ## Local Variables: ## ## mode:python ## ## End: ## nsd-3.2.16/contrib/bug390.patch0000664000175000017500000000060211651742125015047 0ustar matjematje--- nsec3.c 2011-10-26 09:10:25.000000000 +0200 +++ nsec3-bug390.c 2011-10-26 09:10:17.000000000 +0200 @@ -469,6 +469,9 @@ if(!query->zone->nsec3_soa_rr) return; nsec3_add_nonexist_proof(query, answer, wildcard, db, qname); + if(wildcard->parent && wildcard->parent->nsec3_is_exact) + nsec3_add_rrset(query, answer, AUTHORITY_SECTION, + wildcard->parent->nsec3_cover); } nsd-3.2.16/contrib/README0000664000175000017500000000160111070141763013671 0ustar matjematjeThis is NSD contributions directory and it contains various additions to NSD that are not a part of the official distribution but may be helpful. USE AT YOUR OWN RISK. * nsd.spec: a rpm specfile to generate binary and source rpms. Put the source tarball in /usr/src/redhat/SOURCES. Then rpmbuild -ba nsd.spec * nsd.zones2nsd.conf: a python script to convert NSD 2 nsd.zones config files to NSD 3 nsd.conf config files. Do not forget to set nsd_zones_name and key_dir variables at the top of the script. * bind2nsd: a slightly abridged form is included; find the full source at http://bind2nsd.sourceforge.net. The bind2nsd scripts translate DNS information in BIND format to NSD format, and then copy that translation to an NSD server. The goal is to make it simple to run redundant BIND and NSD servers and keep them in sync, using only the BIND configuration files nsd-3.2.16/util.c0000664000175000017500000005610612160600467012506 0ustar matjematje/* * util.c -- set of various support routines. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include #include #ifdef HAVE_SYSLOG_H #include #endif /* HAVE_SYSLOG_H */ #include #include "util.h" #include "region-allocator.h" #include "dname.h" #include "namedb.h" #include "rdata.h" #include "zonec.h" #ifdef USE_MMAP_ALLOC #include #if defined(MAP_ANON) && !defined(MAP_ANONYMOUS) #define MAP_ANONYMOUS MAP_ANON #elif defined(MAP_ANONYMOUS) && !defined(MAP_ANON) #define MAP_ANON MAP_ANONYMOUS #endif #endif /* USE_MMAP_ALLOC */ #ifndef NDEBUG unsigned nsd_debug_facilities = 0xffff; int nsd_debug_level = 0; #endif #define MSB_32 0x80000000 int verbosity = 0; static const char *global_ident = NULL; static log_function_type *current_log_function = log_file; static FILE *current_log_file = NULL; void log_init(const char *ident) { global_ident = ident; current_log_file = stderr; } void log_open(int option, int facility, const char *filename) { #ifdef HAVE_SYSLOG_H openlog(global_ident, option, facility); #endif /* HAVE_SYSLOG_H */ if (filename) { FILE *file = fopen(filename, "a"); if (!file) { log_msg(LOG_ERR, "Cannot open %s for appending (%s), " "logging to stderr", filename, strerror(errno)); } else { current_log_file = file; } } } void log_reopen(const char *filename, uint8_t verbose) { if (filename) { FILE *file; if(strcmp(filename, "/dev/stdout")==0 || strcmp(filename, "/dev/stderr")==0) return; file = fopen(filename, "a"); if (!file) { if (verbose) VERBOSITY(2, (LOG_WARNING, "Cannot reopen %s for appending (%s), " "keeping old logfile", filename, strerror(errno))); } else { if (current_log_file && current_log_file != stderr) fclose(current_log_file); current_log_file = file; } } } void log_finalize(void) { #ifdef HAVE_SYSLOG_H closelog(); #endif /* HAVE_SYSLOG_H */ if (current_log_file && current_log_file != stderr) { fclose(current_log_file); } current_log_file = NULL; } static lookup_table_type log_priority_table[] = { { LOG_ERR, "error" }, { LOG_WARNING, "warning" }, { LOG_NOTICE, "notice" }, { LOG_INFO, "info" }, { 0, NULL } }; void log_file(int priority, const char *message) { size_t length; lookup_table_type *priority_info; const char *priority_text = "unknown"; assert(global_ident); assert(current_log_file); priority_info = lookup_by_id(log_priority_table, priority); if (priority_info) { priority_text = priority_info->name; } /* Bug #104, add time_t timestamp */ fprintf(current_log_file, "[%d] %s[%d]: %s: %s", (int)time(NULL), global_ident, (int) getpid(), priority_text, message); length = strlen(message); if (length == 0 || message[length - 1] != '\n') { fprintf(current_log_file, "\n"); } fflush(current_log_file); } void log_syslog(int priority, const char *message) { #ifdef HAVE_SYSLOG_H syslog(priority, "%s", message); #endif /* !HAVE_SYSLOG_H */ log_file(priority, message); } void log_set_log_function(log_function_type *log_function) { current_log_function = log_function; } void log_msg(int priority, const char *format, ...) { va_list args; va_start(args, format); log_vmsg(priority, format, args); va_end(args); } void log_vmsg(int priority, const char *format, va_list args) { char message[MAXSYSLOGMSGLEN]; vsnprintf(message, sizeof(message), format, args); current_log_function(priority, message); } void set_bit(uint8_t bits[], size_t index) { /* * The bits are counted from left to right, so bit #0 is the * left most bit. */ bits[index / 8] |= (1 << (7 - index % 8)); } void clear_bit(uint8_t bits[], size_t index) { /* * The bits are counted from left to right, so bit #0 is the * left most bit. */ bits[index / 8] &= ~(1 << (7 - index % 8)); } int get_bit(uint8_t bits[], size_t index) { /* * The bits are counted from left to right, so bit #0 is the * left most bit. */ return bits[index / 8] & (1 << (7 - index % 8)); } lookup_table_type * lookup_by_name(lookup_table_type *table, const char *name) { while (table->name != NULL) { if (strcasecmp(name, table->name) == 0) return table; table++; } return NULL; } lookup_table_type * lookup_by_id(lookup_table_type *table, int id) { while (table->name != NULL) { if (table->id == id) return table; table++; } return NULL; } void * xalloc(size_t size) { void *result = malloc(size); if (!result) { log_msg(LOG_ERR, "malloc failed: %s", strerror(errno)); exit(1); } return result; } void * xalloc_zero(size_t size) { void *result = xalloc(size); memset(result, 0, size); return result; } void * xrealloc(void *ptr, size_t size) { ptr = realloc(ptr, size); if (!ptr) { log_msg(LOG_ERR, "realloc failed: %s", strerror(errno)); exit(1); } return ptr; } #ifdef USE_MMAP_ALLOC void * mmap_alloc(size_t size) { void *base; size += MMAP_ALLOC_HEADER_SIZE; #ifdef HAVE_MMAP base = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); if (base == MAP_FAILED) { log_msg(LOG_ERR, "mmap failed: %s", strerror(errno)); exit(1); } #else /* !HAVE_MMAP */ log_msg(LOG_ERR, "mmap failed: don't have mmap"); exit(1); #endif /* HAVE_MMAP */ *((size_t*) base) = size; return (void*)((uintptr_t)base + MMAP_ALLOC_HEADER_SIZE); } void mmap_free(void *ptr) { void *base; size_t size; if (!ptr) return; base = (void*)((uintptr_t)ptr - MMAP_ALLOC_HEADER_SIZE); size = *((size_t*) base); #ifdef HAVE_MUNMAP if (munmap(base, size) == -1) { log_msg(LOG_ERR, "munmap failed: %s", strerror(errno)); exit(1); } #else /* !HAVE_MUNMAP */ log_msg(LOG_ERR, "munmap failed: don't have munmap"); exit(1); #endif /* HAVE_MUNMAP */ } #endif /* USE_MMAP_ALLOC */ int write_data(FILE *file, const void *data, size_t size) { size_t result; if (size == 0) return 1; result = fwrite(data, 1, size, file); if (result == 0) { log_msg(LOG_ERR, "write failed: %s", strerror(errno)); return 0; } else if (result < size) { log_msg(LOG_ERR, "short write (disk full?)"); return 0; } else { return 1; } } int write_socket(int s, const void *buf, size_t size) { const char* data = (const char*)buf; size_t total_count = 0; while (total_count < size) { ssize_t count = write(s, data + total_count, size - total_count); if (count == -1) { if (errno != EAGAIN && errno != EINTR) { return 0; } else { continue; } } total_count += count; } return 1; } int timespec_compare(const struct timespec *left, const struct timespec *right) { /* Compare seconds. */ if (left->tv_sec < right->tv_sec) { return -1; } else if (left->tv_sec > right->tv_sec) { return 1; } else { /* Seconds are equal, compare nanoseconds. */ if (left->tv_nsec < right->tv_nsec) { return -1; } else if (left->tv_nsec > right->tv_nsec) { return 1; } else { return 0; } } } /* One second is 1e9 nanoseconds. */ #define NANOSECONDS_PER_SECOND 1000000000L void timespec_add(struct timespec *left, const struct timespec *right) { left->tv_sec += right->tv_sec; left->tv_nsec += right->tv_nsec; if (left->tv_nsec >= NANOSECONDS_PER_SECOND) { /* Carry. */ ++left->tv_sec; left->tv_nsec -= NANOSECONDS_PER_SECOND; } } void timespec_subtract(struct timespec *left, const struct timespec *right) { left->tv_sec -= right->tv_sec; left->tv_nsec -= right->tv_nsec; if (left->tv_nsec < 0L) { /* Borrow. */ --left->tv_sec; left->tv_nsec += NANOSECONDS_PER_SECOND; } } uint32_t strtoserial(const char* nptr, const char** endptr) { uint32_t i = 0; uint32_t serial = 0; for(*endptr = nptr; **endptr; (*endptr)++) { switch (**endptr) { case ' ': case '\t': break; case '0': case '1': case '2': case '3': case '4': case '5': case '6': case '7': case '8': case '9': i *= 10; i += (**endptr - '0'); break; default: break; } } serial += i; return serial; } uint32_t strtottl(const char *nptr, const char **endptr) { uint32_t i = 0; uint32_t seconds = 0; for(*endptr = nptr; **endptr; (*endptr)++) { switch (**endptr) { case ' ': case '\t': break; case 's': case 'S': seconds += i; i = 0; break; case 'm': case 'M': seconds += i * 60; i = 0; break; case 'h': case 'H': seconds += i * 60 * 60; i = 0; break; case 'd': case 'D': seconds += i * 60 * 60 * 24; i = 0; break; case 'w': case 'W': seconds += i * 60 * 60 * 24 * 7; i = 0; break; case '0': case '1': case '2': case '3': case '4': case '5': case '6': case '7': case '8': case '9': i *= 10; i += (**endptr - '0'); break; default: seconds += i; /** * According to RFC2308, Section 8, the MSB * (sign bit) should be set to zero. * If we encounter a value larger than 2^31 -1, * we fall back to the default TTL. */ if ((seconds & MSB_32)) { seconds = DEFAULT_TTL; } return seconds; } } seconds += i; if ((seconds & MSB_32)) { seconds = DEFAULT_TTL; } return seconds; } ssize_t hex_ntop(uint8_t const *src, size_t srclength, char *target, size_t targsize) { static char hexdigits[] = { '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' }; size_t i; if (targsize < srclength * 2 + 1) { return -1; } for (i = 0; i < srclength; ++i) { *target++ = hexdigits[src[i] >> 4U]; *target++ = hexdigits[src[i] & 0xfU]; } *target = '\0'; return 2 * srclength; } ssize_t hex_pton(const char* src, uint8_t* target, size_t targsize) { uint8_t *t = target; if(strlen(src) % 2 != 0 || strlen(src)/2 > targsize) { return -1; } while(*src) { if(!isxdigit((int)src[0]) || !isxdigit((int)src[1])) return -1; *t++ = hexdigit_to_int(src[0]) * 16 + hexdigit_to_int(src[1]) ; src += 2; } return t-target; } int b32_ntop(uint8_t const *src, size_t srclength, char *target, size_t targsize) { static char b32[]="0123456789abcdefghijklmnopqrstuv"; char buf[9]; ssize_t len=0; while(srclength > 0) { int t; memset(buf,'\0',sizeof buf); /* xxxxx000 00000000 00000000 00000000 00000000 */ buf[0]=b32[src[0] >> 3]; /* 00000xxx xx000000 00000000 00000000 00000000 */ t=(src[0]&7) << 2; if(srclength > 1) t+=src[1] >> 6; buf[1]=b32[t]; if(srclength == 1) break; /* 00000000 00xxxxx0 00000000 00000000 00000000 */ buf[2]=b32[(src[1] >> 1)&0x1f]; /* 00000000 0000000x xxxx0000 00000000 00000000 */ t=(src[1]&1) << 4; if(srclength > 2) t+=src[2] >> 4; buf[3]=b32[t]; if(srclength == 2) break; /* 00000000 00000000 0000xxxx x0000000 00000000 */ t=(src[2]&0xf) << 1; if(srclength > 3) t+=src[3] >> 7; buf[4]=b32[t]; if(srclength == 3) break; /* 00000000 00000000 00000000 0xxxxx00 00000000 */ buf[5]=b32[(src[3] >> 2)&0x1f]; /* 00000000 00000000 00000000 000000xx xxx00000 */ t=(src[3]&3) << 3; if(srclength > 4) t+=src[4] >> 5; buf[6]=b32[t]; if(srclength == 4) break; /* 00000000 00000000 00000000 00000000 000xxxxx */ buf[7]=b32[src[4]&0x1f]; if(targsize < 8) return -1; src += 5; srclength -= 5; memcpy(target,buf,8); target += 8; targsize -= 8; len += 8; } if(srclength) { if(targsize < strlen(buf)+1) return -1; strlcpy(target, buf, targsize); len += strlen(buf); } else if(targsize < 1) return -1; else *target='\0'; return len; } int b32_pton(const char *src, uint8_t *target, size_t tsize) { char ch; size_t p=0; memset(target,'\0',tsize); while((ch = *src++)) { uint8_t d; size_t b; size_t n; if(p+5 >= tsize*8) return -1; if(isspace(ch)) continue; if(ch >= '0' && ch <= '9') d=ch-'0'; else if(ch >= 'A' && ch <= 'V') d=ch-'A'+10; else if(ch >= 'a' && ch <= 'v') d=ch-'a'+10; else return -1; b=7-p%8; n=p/8; if(b >= 4) target[n]|=d << (b-4); else { target[n]|=d >> (4-b); target[n+1]|=d << (b+4); } p+=5; } return (p+7)/8; } void strip_string(char *str) { char *start = str; char *end = str + strlen(str) - 1; while (isspace(*start)) ++start; if (start > end) { /* Completely blank. */ str[0] = '\0'; } else { while (isspace(*end)) --end; *++end = '\0'; if (str != start) memmove(str, start, end - start + 1); } } int hexdigit_to_int(char ch) { switch (ch) { case '0': return 0; case '1': return 1; case '2': return 2; case '3': return 3; case '4': return 4; case '5': return 5; case '6': return 6; case '7': return 7; case '8': return 8; case '9': return 9; case 'a': case 'A': return 10; case 'b': case 'B': return 11; case 'c': case 'C': return 12; case 'd': case 'D': return 13; case 'e': case 'E': return 14; case 'f': case 'F': return 15; default: abort(); } } /* Number of days per month (except for February in leap years). */ static const int mdays[] = { 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 }; static int is_leap_year(int year) { return year % 4 == 0 && (year % 100 != 0 || year % 400 == 0); } static int leap_days(int y1, int y2) { --y1; --y2; return (y2/4 - y1/4) - (y2/100 - y1/100) + (y2/400 - y1/400); } /* * Code adapted from Python 2.4.1 sources (Lib/calendar.py). */ time_t mktime_from_utc(const struct tm *tm) { int year = 1900 + tm->tm_year; time_t days = 365 * (year - 1970) + leap_days(1970, year); time_t hours; time_t minutes; time_t seconds; int i; for (i = 0; i < tm->tm_mon; ++i) { days += mdays[i]; } if (tm->tm_mon > 1 && is_leap_year(year)) { ++days; } days += tm->tm_mday - 1; hours = days * 24 + tm->tm_hour; minutes = hours * 60 + tm->tm_min; seconds = minutes * 60 + tm->tm_sec; return seconds; } /* code to calculate CRC. Lifted from BSD 4.4 crc.c in cksum(1). BSD license. http://www.tsfr.org/~orc/Code/bsd/bsd-current/cksum/crc.c. or http://gobsd.com/code/freebsd/usr.bin/cksum/crc.c The polynomial is 0x04c11db7L. */ static u_long crctab[] = { 0x0, 0x04c11db7, 0x09823b6e, 0x0d4326d9, 0x130476dc, 0x17c56b6b, 0x1a864db2, 0x1e475005, 0x2608edb8, 0x22c9f00f, 0x2f8ad6d6, 0x2b4bcb61, 0x350c9b64, 0x31cd86d3, 0x3c8ea00a, 0x384fbdbd, 0x4c11db70, 0x48d0c6c7, 0x4593e01e, 0x4152fda9, 0x5f15adac, 0x5bd4b01b, 0x569796c2, 0x52568b75, 0x6a1936c8, 0x6ed82b7f, 0x639b0da6, 0x675a1011, 0x791d4014, 0x7ddc5da3, 0x709f7b7a, 0x745e66cd, 0x9823b6e0, 0x9ce2ab57, 0x91a18d8e, 0x95609039, 0x8b27c03c, 0x8fe6dd8b, 0x82a5fb52, 0x8664e6e5, 0xbe2b5b58, 0xbaea46ef, 0xb7a96036, 0xb3687d81, 0xad2f2d84, 0xa9ee3033, 0xa4ad16ea, 0xa06c0b5d, 0xd4326d90, 0xd0f37027, 0xddb056fe, 0xd9714b49, 0xc7361b4c, 0xc3f706fb, 0xceb42022, 0xca753d95, 0xf23a8028, 0xf6fb9d9f, 0xfbb8bb46, 0xff79a6f1, 0xe13ef6f4, 0xe5ffeb43, 0xe8bccd9a, 0xec7dd02d, 0x34867077, 0x30476dc0, 0x3d044b19, 0x39c556ae, 0x278206ab, 0x23431b1c, 0x2e003dc5, 0x2ac12072, 0x128e9dcf, 0x164f8078, 0x1b0ca6a1, 0x1fcdbb16, 0x018aeb13, 0x054bf6a4, 0x0808d07d, 0x0cc9cdca, 0x7897ab07, 0x7c56b6b0, 0x71159069, 0x75d48dde, 0x6b93dddb, 0x6f52c06c, 0x6211e6b5, 0x66d0fb02, 0x5e9f46bf, 0x5a5e5b08, 0x571d7dd1, 0x53dc6066, 0x4d9b3063, 0x495a2dd4, 0x44190b0d, 0x40d816ba, 0xaca5c697, 0xa864db20, 0xa527fdf9, 0xa1e6e04e, 0xbfa1b04b, 0xbb60adfc, 0xb6238b25, 0xb2e29692, 0x8aad2b2f, 0x8e6c3698, 0x832f1041, 0x87ee0df6, 0x99a95df3, 0x9d684044, 0x902b669d, 0x94ea7b2a, 0xe0b41de7, 0xe4750050, 0xe9362689, 0xedf73b3e, 0xf3b06b3b, 0xf771768c, 0xfa325055, 0xfef34de2, 0xc6bcf05f, 0xc27dede8, 0xcf3ecb31, 0xcbffd686, 0xd5b88683, 0xd1799b34, 0xdc3abded, 0xd8fba05a, 0x690ce0ee, 0x6dcdfd59, 0x608edb80, 0x644fc637, 0x7a089632, 0x7ec98b85, 0x738aad5c, 0x774bb0eb, 0x4f040d56, 0x4bc510e1, 0x46863638, 0x42472b8f, 0x5c007b8a, 0x58c1663d, 0x558240e4, 0x51435d53, 0x251d3b9e, 0x21dc2629, 0x2c9f00f0, 0x285e1d47, 0x36194d42, 0x32d850f5, 0x3f9b762c, 0x3b5a6b9b, 0x0315d626, 0x07d4cb91, 0x0a97ed48, 0x0e56f0ff, 0x1011a0fa, 0x14d0bd4d, 0x19939b94, 0x1d528623, 0xf12f560e, 0xf5ee4bb9, 0xf8ad6d60, 0xfc6c70d7, 0xe22b20d2, 0xe6ea3d65, 0xeba91bbc, 0xef68060b, 0xd727bbb6, 0xd3e6a601, 0xdea580d8, 0xda649d6f, 0xc423cd6a, 0xc0e2d0dd, 0xcda1f604, 0xc960ebb3, 0xbd3e8d7e, 0xb9ff90c9, 0xb4bcb610, 0xb07daba7, 0xae3afba2, 0xaafbe615, 0xa7b8c0cc, 0xa379dd7b, 0x9b3660c6, 0x9ff77d71, 0x92b45ba8, 0x9675461f, 0x8832161a, 0x8cf30bad, 0x81b02d74, 0x857130c3, 0x5d8a9099, 0x594b8d2e, 0x5408abf7, 0x50c9b640, 0x4e8ee645, 0x4a4ffbf2, 0x470cdd2b, 0x43cdc09c, 0x7b827d21, 0x7f436096, 0x7200464f, 0x76c15bf8, 0x68860bfd, 0x6c47164a, 0x61043093, 0x65c52d24, 0x119b4be9, 0x155a565e, 0x18197087, 0x1cd86d30, 0x029f3d35, 0x065e2082, 0x0b1d065b, 0x0fdc1bec, 0x3793a651, 0x3352bbe6, 0x3e119d3f, 0x3ad08088, 0x2497d08d, 0x2056cd3a, 0x2d15ebe3, 0x29d4f654, 0xc5a92679, 0xc1683bce, 0xcc2b1d17, 0xc8ea00a0, 0xd6ad50a5, 0xd26c4d12, 0xdf2f6bcb, 0xdbee767c, 0xe3a1cbc1, 0xe760d676, 0xea23f0af, 0xeee2ed18, 0xf0a5bd1d, 0xf464a0aa, 0xf9278673, 0xfde69bc4, 0x89b8fd09, 0x8d79e0be, 0x803ac667, 0x84fbdbd0, 0x9abc8bd5, 0x9e7d9662, 0x933eb0bb, 0x97ffad0c, 0xafb010b1, 0xab710d06, 0xa6322bdf, 0xa2f33668, 0xbcb4666d, 0xb8757bda, 0xb5365d03, 0xb1f740b4 }; #define COMPUTE(var, ch) (var) = (var) << 8 ^ crctab[(var) >> 24 ^ (ch)] uint32_t compute_crc(uint32_t crc, uint8_t* data, size_t len) { size_t i; for(i=0; i b && a - b > cutoff)) { return -1; } else { return 1; } } uint16_t qid_generate(void) { #ifdef HAVE_ARC4RANDOM_UNIFORM return (uint16_t) arc4random_uniform(65536); #elif HAVE_ARC4RANDOM return (uint16_t) arc4random(); #else return (uint16_t) random(); #endif } void cleanup_region(void *data) { region_type *region = (region_type *) data; region_destroy(region); } struct state_pretty_rr* create_pretty_rr(struct region* region) { struct state_pretty_rr* state = (struct state_pretty_rr*) region_alloc(region, sizeof(struct state_pretty_rr)); state->previous_owner_region = region_create(xalloc, free); state->previous_owner = NULL; state->previous_owner_origin = NULL; region_add_cleanup(region, cleanup_region, state->previous_owner_region); return state; } static void set_previous_owner(struct state_pretty_rr *state, const dname_type *dname) { region_free_all(state->previous_owner_region); state->previous_owner = dname_copy(state->previous_owner_region, dname); state->previous_owner_origin = dname_origin( state->previous_owner_region, state->previous_owner); } int print_rr(FILE *out, struct state_pretty_rr *state, rr_type *record) { region_type *region = region_create(xalloc, free); buffer_type *output = buffer_create(region, MAX_RDLENGTH); rrtype_descriptor_type *descriptor = rrtype_descriptor_by_type(record->type); int result; const dname_type *owner = domain_dname(record->owner); const dname_type *owner_origin = dname_origin(region, owner); int owner_changed = (!state->previous_owner || dname_compare(state->previous_owner, owner) != 0); if (owner_changed) { int origin_changed = (!state->previous_owner_origin || dname_compare( state->previous_owner_origin, owner_origin) != 0); if (origin_changed) { buffer_printf( output, "$ORIGIN %s\n", dname_to_string(owner_origin, NULL)); } set_previous_owner(state, owner); buffer_printf(output, "%s", dname_to_string(owner, state->previous_owner_origin)); } buffer_printf(output, "\t%lu\t%s\t%s", (unsigned long) record->ttl, rrclass_to_string(record->klass), rrtype_to_string(record->type)); result = print_rdata(output, descriptor, record); if (!result) { /* * Some RDATA failed to print, so print the record's * RDATA in unknown format. */ result = rdata_atoms_to_unknown_string(output, descriptor, record->rdata_count, record->rdatas); } if (result) { buffer_printf(output, "\n"); buffer_flip(output); (void)write_data(out, buffer_current(output), buffer_remaining(output)); /* fflush(out); */ } region_destroy(region); return result; } const char* rcode2str(int rc) { switch(rc) { case RCODE_OK: return "NO ERROR"; case RCODE_FORMAT: return "FORMAT ERROR"; case RCODE_SERVFAIL: return "SERV FAIL"; case RCODE_NXDOMAIN: return "NAME ERROR"; case RCODE_IMPL: return "NOT IMPL"; case RCODE_REFUSE: return "REFUSED"; case RCODE_YXDOMAIN: return "YXDOMAIN"; case RCODE_YXRRSET: return "YXRRSET"; case RCODE_NXRRSET: return "NXRRSET"; case RCODE_NOTAUTH: return "SERVER NOT AUTHORITATIVE FOR ZONE"; case RCODE_NOTZONE: return "NOTZONE"; default: return "UNKNOWN ERROR"; } return NULL; /* ENOREACH */ } stack_type* stack_create(struct region* region, size_t size) { stack_type* stack = (stack_type*)region_alloc(region, sizeof(stack_type)); stack->capacity = size; stack->num = 0; stack->data = (void**) region_alloc(region, sizeof(void*)*size); memset(stack->data, 0, sizeof(void*)*size); return stack; } void stack_push(stack_type* stack, void* elem) { assert(stack); if(stack->num >= stack->capacity) { /* stack out of capacity, elem falls off stack */ return; } stack->data[stack->num] = elem; stack->num ++; } void* stack_pop(stack_type* stack) { void* elem; assert(stack); if(stack->num <= 0) return NULL; stack->num --; elem = stack->data[stack->num]; stack->data[stack->num] = NULL; return elem; } int addr2ip( #ifdef INET6 struct sockaddr_storage addr #else struct sockaddr_in addr #endif , char *address, socklen_t size) { #ifdef INET6 if (addr.ss_family == AF_INET6) { if (!inet_ntop(AF_INET6, &((struct sockaddr_in6 *)&addr)->sin6_addr, address, size)) return (1); #else if (0) { #endif } else { if (!inet_ntop(AF_INET, &((struct sockaddr_in *)&addr)->sin_addr, address, size)) return (1); } return (0); } nsd-3.2.16/util.h0000664000175000017500000002307011762140165012506 0ustar matjematje/* * util.h -- set of various support routines. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _UTIL_H_ #define _UTIL_H_ #include "config.h" #include #include #include #include struct rr; #ifdef HAVE_SYSLOG_H # include #else # define LOG_ERR 3 # define LOG_WARNING 4 # define LOG_NOTICE 5 # define LOG_INFO 6 #endif #define ALIGN_UP(n, alignment) \ (((n) + (alignment) - 1) & (~((alignment) - 1))) #define PADDING(n, alignment) \ (ALIGN_UP((n), (alignment)) - (n)) /* Counter for statistics */ typedef unsigned long stc_t; /** * Statistics. * */ struct nsdst { time_t boot; int period; /* Produce statistics dump every st_period seconds */ stc_t qtype[257]; /* Counters per qtype */ stc_t qclass[4]; /* Class IN or Class CH or other */ stc_t qudp, qudp6; /* Number of queries udp and udp6 */ stc_t ctcp, ctcp6; /* Number of tcp and tcp6 connections */ stc_t rcode[17], opcode[6]; /* Rcodes & opcodes */ /* Dropped, truncated, queries for nonconfigured zone, tx errors */ stc_t dropped, truncated, wrongzone, txerr, rxerr; stc_t edns, ednserr, raxfr, nona; }; /* * Initialize the logging system. All messages are logged to stderr * until log_open and log_set_log_function are called. */ void log_init(const char *ident); /* * Open the system log. If FILENAME is not NULL, a log file is opened * as well. */ void log_open(int option, int facility, const char *filename); /* * Reopen the logfile. */ void log_reopen(const char *filename, uint8_t verbose); /* * Finalize the logging system. */ void log_finalize(void); /* * Type of function to use for the actual logging. */ typedef void log_function_type(int priority, const char *message); /* * The function used to log to the log file. */ log_function_type log_file; /* * The function used to log to syslog. The messages are also logged * using log_file. */ log_function_type log_syslog; /* * Set the logging function to use (log_file or log_syslog). */ void log_set_log_function(log_function_type *log_function); /* * Log a message using the current log function. */ void log_msg(int priority, const char *format, ...) ATTR_FORMAT(printf, 2, 3); /* * Log a message using the current log function. */ void log_vmsg(int priority, const char *format, va_list args); /* * Verbose output switch */ extern int verbosity; #define VERBOSITY(level, args) \ do { \ if ((level) <= verbosity) { \ log_msg args ; \ } \ } while (0) /* * Set the INDEXth bit of BITS to 1. */ void set_bit(uint8_t bits[], size_t index); /* * Set the INDEXth bit of BITS to 0. */ void clear_bit(uint8_t bits[], size_t index); /* * Return the value of the INDEXth bit of BITS. */ int get_bit(uint8_t bits[], size_t index); /* A general purpose lookup table */ typedef struct lookup_table lookup_table_type; struct lookup_table { int id; const char *name; }; /* * Looks up the table entry by name, returns NULL if not found. */ lookup_table_type *lookup_by_name(lookup_table_type table[], const char *name); /* * Looks up the table entry by id, returns NULL if not found. */ lookup_table_type *lookup_by_id(lookup_table_type table[], int id); /* * (Re-)allocate SIZE bytes of memory. Report an error if the memory * could not be allocated and exit the program. These functions never * return NULL. */ void *xalloc(size_t size); void *xalloc_zero(size_t size); void *xrealloc(void *ptr, size_t size); /* * Mmap allocator routines. * */ #ifdef USE_MMAP_ALLOC void *mmap_alloc(size_t size); void mmap_free(void *ptr); #endif /* USE_MMAP_ALLOC */ /* * Write SIZE bytes of DATA to FILE. Report an error on failure. * * Returns 0 on failure, 1 on success. */ int write_data(FILE *file, const void *data, size_t size); /* * like write_data, but keeps track of crc */ int write_data_crc(FILE *file, const void *data, size_t size, uint32_t* crc); /* * Write the complete buffer to the socket, irrespective of short * writes or interrupts. This function blocks to write the data. * Returns 0 on error, 1 on success. */ int write_socket(int s, const void *data, size_t size); /* * Copy data allowing for unaligned accesses in network byte order * (big endian). */ static inline void write_uint16(void *dst, uint16_t data) { #ifdef ALLOW_UNALIGNED_ACCESSES * (uint16_t *) dst = htons(data); #else uint8_t *p = (uint8_t *) dst; p[0] = (uint8_t) ((data >> 8) & 0xff); p[1] = (uint8_t) (data & 0xff); #endif } static inline void write_uint32(void *dst, uint32_t data) { #ifdef ALLOW_UNALIGNED_ACCESSES * (uint32_t *) dst = htonl(data); #else uint8_t *p = (uint8_t *) dst; p[0] = (uint8_t) ((data >> 24) & 0xff); p[1] = (uint8_t) ((data >> 16) & 0xff); p[2] = (uint8_t) ((data >> 8) & 0xff); p[3] = (uint8_t) (data & 0xff); #endif } /* * Copy data allowing for unaligned accesses in network byte order * (big endian). */ static inline uint16_t read_uint16(const void *src) { #ifdef ALLOW_UNALIGNED_ACCESSES return ntohs(* (uint16_t *) src); #else uint8_t *p = (uint8_t *) src; return (p[0] << 8) | p[1]; #endif } static inline uint32_t read_uint32(const void *src) { #ifdef ALLOW_UNALIGNED_ACCESSES return ntohl(* (uint32_t *) src); #else uint8_t *p = (uint8_t *) src; return (p[0] << 24) | (p[1] << 16) | (p[2] << 8) | p[3]; #endif } /* * Print debugging information using log_msg, * set the logfile as /dev/stdout or /dev/stderr if you like. * nsd -F 0xFFFF enables all debug facilities. */ #define DEBUG_PARSER 0x0001U #define DEBUG_ZONEC 0x0002U #define DEBUG_QUERY 0x0004U #define DEBUG_DBACCESS 0x0008U #define DEBUG_NAME_COMPRESSION 0x0010U #define DEBUG_XFRD 0x0020U #define DEBUG_IPC 0x0040U extern unsigned nsd_debug_facilities; extern int nsd_debug_level; #ifdef NDEBUG #define DEBUG(facility, level, args) /* empty */ #else #define DEBUG(facility, level, args) \ do { \ if ((facility) & nsd_debug_facilities && \ (level) <= nsd_debug_level) { \ log_msg args ; \ } \ } while (0) #endif /* * Timespec functions. */ int timespec_compare(const struct timespec *left, const struct timespec *right); void timespec_add(struct timespec *left, const struct timespec *right); void timespec_subtract(struct timespec *left, const struct timespec *right); static inline void timeval_to_timespec(struct timespec *left, const struct timeval *right) { left->tv_sec = right->tv_sec; left->tv_nsec = 1000 * right->tv_usec; } /* * Converts a string representation of a period of time into * a long integer of seconds or serial value. * * Set the endptr to the first illegal character. * * Interface is similar as strtol(3) * * Returns: * LONG_MIN if underflow occurs * LONG_MAX if overflow occurs. * otherwise number of seconds * * XXX These functions do not check the range. * */ uint32_t strtoserial(const char *nptr, const char **endptr); uint32_t strtottl(const char *nptr, const char **endptr); /* * Convert binary data to a string of hexadecimal characters. */ ssize_t hex_ntop(uint8_t const *src, size_t srclength, char *target, size_t targsize); ssize_t hex_pton(const char* src, uint8_t* target, size_t targsize); /* * convert base32 data from and to string. Returns length. * -1 on error. Use (byte count*8)%5==0. */ int b32_pton(char const *src, uint8_t *target, size_t targsize); int b32_ntop(uint8_t const *src, size_t srclength, char *target, size_t targsize); /* * Strip trailing and leading whitespace from str. */ void strip_string(char *str); /* * Convert a single (hexidecimal) digit to its integer value. */ int hexdigit_to_int(char ch); /* * Convert TM to seconds since epoch (midnight, January 1st, 1970). * Like timegm(3), which is not always available. */ time_t mktime_from_utc(const struct tm *tm); /* * Add bytes to given crc. Returns new CRC sum. * Start crc val with 0xffffffff on first call. XOR crc with * 0xffffffff at the end again to get final POSIX 1003.2 checksum. */ uint32_t compute_crc(uint32_t crc, uint8_t* data, size_t len); /* * Compares two 32-bit serial numbers as defined in RFC1982. Returns * <0 if a < b, 0 if a == b, and >0 if a > b. The result is undefined * if a != b but neither is greater or smaller (see RFC1982 section * 3.2.). */ int compare_serial(uint32_t a, uint32_t b); /* * Generate a random query ID. */ uint16_t qid_generate(void); /* * call region_destroy on (region*)data, useful for region_add_cleanup(). */ void cleanup_region(void *data); /* * Region used to store owner and origin of previous RR (used * for pretty printing of zone data). * Keep the same between calls to print_rr. */ struct state_pretty_rr { struct region *previous_owner_region; const struct dname *previous_owner; const struct dname *previous_owner_origin; }; struct state_pretty_rr* create_pretty_rr(struct region* region); /* print rr to file, returns 0 on failure(nothing is written) */ int print_rr(FILE *out, struct state_pretty_rr* state, struct rr *record); /* * Convert a numeric rcode value to a human readable string */ const char* rcode2str(int rc); /* * Stack of pointers. * Stack is fixed size on start. More elems fall off stack. */ struct stack { void** data; size_t num, capacity; }; typedef struct stack stack_type; stack_type* stack_create(struct region* region, size_t size); void stack_push(stack_type* stack, void* elem); void* stack_pop(stack_type* stack); int addr2ip( #ifdef INET6 struct sockaddr_storage addr #else struct sockaddr_in addr #endif , char address[], socklen_t size); #endif /* _UTIL_H_ */ nsd-3.2.16/compat/0000775000175000017500000000000012173226525012643 5ustar matjematjensd-3.2.16/compat/inet_ntop.c0000664000175000017500000001253310537524016015010 0ustar matjematje/* From openssh 4.3p2 compat/inet_ntop.c */ /* Copyright (c) 1996 by Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. */ /* OPENBSD ORIGINAL: lib/libc/net/inet_ntop.c */ #include #ifndef HAVE_INET_NTOP #include #include #include #include #include #include #include #ifndef IN6ADDRSZ #define IN6ADDRSZ 16 /* IPv6 T_AAAA */ #endif #ifndef INT16SZ #define INT16SZ 2 /* for systems without 16-bit ints */ #endif /* * WARNING: Don't even consider trying to compile this on a system where * sizeof(int) < 4. sizeof(int) > 4 is fine; all the world's not a VAX. */ static const char *inet_ntop4(const u_char *src, char *dst, size_t size); static const char *inet_ntop6(const u_char *src, char *dst, size_t size); /* char * * inet_ntop(af, src, dst, size) * convert a network format address to presentation format. * return: * pointer to presentation format address (`dst'), or NULL (see errno). * author: * Paul Vixie, 1996. */ const char * inet_ntop(int af, const void *src, char *dst, size_t size) { switch (af) { case AF_INET: return (inet_ntop4(src, dst, size)); case AF_INET6: return (inet_ntop6(src, dst, size)); default: errno = EAFNOSUPPORT; return (NULL); } /* NOTREACHED */ } /* const char * * inet_ntop4(src, dst, size) * format an IPv4 address, more or less like inet_ntoa() * return: * `dst' (as a const) * notes: * (1) uses no statics * (2) takes a u_char* not an in_addr as input * author: * Paul Vixie, 1996. */ static const char * inet_ntop4(const u_char *src, char *dst, size_t size) { static const char fmt[] = "%u.%u.%u.%u"; char tmp[sizeof "255.255.255.255"]; int l; l = snprintf(tmp, size, fmt, src[0], src[1], src[2], src[3]); if (l <= 0 || l >= (int)size) { errno = ENOSPC; return (NULL); } strlcpy(dst, tmp, size); return (dst); } /* const char * * inet_ntop6(src, dst, size) * convert IPv6 binary address into presentation (printable) format * author: * Paul Vixie, 1996. */ static const char * inet_ntop6(const u_char *src, char *dst, size_t size) { /* * Note that int32_t and int16_t need only be "at least" large enough * to contain a value of the specified size. On some systems, like * Crays, there is no such thing as an integer variable with 16 bits. * Keep this in mind if you think this function should have been coded * to use pointer overlays. All the world's not a VAX. */ char tmp[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"]; char *tp, *ep; struct { int base, len; } best, cur; u_int words[IN6ADDRSZ / INT16SZ]; int i; int advance; /* * Preprocess: * Copy the input (bytewise) array into a wordwise array. * Find the longest run of 0x00's in src[] for :: shorthanding. */ memset(words, '\0', sizeof words); for (i = 0; i < IN6ADDRSZ; i++) words[i / 2] |= (src[i] << ((1 - (i % 2)) << 3)); best.base = -1; cur.base = -1; for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) { if (words[i] == 0) { if (cur.base == -1) cur.base = i, cur.len = 1; else cur.len++; } else { if (cur.base != -1) { if (best.base == -1 || cur.len > best.len) best = cur; cur.base = -1; } } } if (cur.base != -1) { if (best.base == -1 || cur.len > best.len) best = cur; } if (best.base != -1 && best.len < 2) best.base = -1; /* * Format the result. */ tp = tmp; ep = tmp + sizeof(tmp); for (i = 0; i < (IN6ADDRSZ / INT16SZ) && tp < ep; i++) { /* Are we inside the best run of 0x00's? */ if (best.base != -1 && i >= best.base && i < (best.base + best.len)) { if (i == best.base) { if (tp + 1 >= ep) return (NULL); *tp++ = ':'; } continue; } /* Are we following an initial run of 0x00s or any real hex? */ if (i != 0) { if (tp + 1 >= ep) return (NULL); *tp++ = ':'; } /* Is this address an encapsulated IPv4? */ if (i == 6 && best.base == 0 && (best.len == 6 || (best.len == 5 && words[5] == 0xffff))) { if (!inet_ntop4(src+12, tp, (size_t)(ep - tp))) return (NULL); tp += strlen(tp); break; } advance = snprintf(tp, ep - tp, "%x", words[i]); if (advance <= 0 || advance >= ep - tp) return (NULL); tp += advance; } /* Was it a trailing run of 0x00's? */ if (best.base != -1 && (best.base + best.len) == (IN6ADDRSZ / INT16SZ)) { if (tp + 1 >= ep) return (NULL); *tp++ = ':'; } if (tp + 1 >= ep) return (NULL); *tp++ = '\0'; /* * Check for overflow, copy, and we're done. */ if ((size_t)(tp - tmp) > size) { errno = ENOSPC; return (NULL); } strlcpy(dst, tmp, size); return (dst); } #endif /* !HAVE_INET_NTOP */ nsd-3.2.16/compat/snprintf.c0000664000175000017500000007123012135241604014646 0ustar matjematje/* snprintf - compatibility implementation of snprintf, vsnprintf * * Copyright (c) 2013, NLnet Labs. All rights reserved. * * This software is open source. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * Neither the name of the NLNET LABS nor the names of its contributors may * be used to endorse or promote products derived from this software without * specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ #include "config.h" #include #include #include #include #include #include #ifdef HAVE_STDINT_H #include #endif /* for test */ /* #define SNPRINTF_TEST 1 */ #ifdef SNPRINTF_TEST #define snprintf my_snprintf #define vsnprintf my_vsnprintf #endif /* SNPRINTF_TEST */ int snprintf(char* str, size_t size, const char* format, ...); int vsnprintf(char* str, size_t size, const char* format, va_list arg); /** * Very portable snprintf implementation, limited in functionality, * esp. for %[capital] %[nonportable] and so on. Reduced float functionality, * mostly in formatting and range (e+-16), for %f and %g. * * %s, %d, %u, %i, %x, %c, %n and %% are fully supported. * This includes width, precision, flags 0- +, and *(arg for wid,prec). * %f, %g, %m, %p have reduced support, support for wid,prec,flags,*, but * less floating point range, no %e formatting for %g. */ int snprintf(char* str, size_t size, const char* format, ...) { int r; va_list args; va_start(args, format); r = vsnprintf(str, size, format, args); va_end(args); return r; } /** add padding to string */ static void print_pad(char** at, size_t* left, int* ret, char p, int num) { while(num--) { if(*left > 1) { *(*at)++ = p; (*left)--; } (*ret)++; } } /** get negative symbol, 0 if none */ static char get_negsign(int negative, int plus, int space) { if(negative) return '-'; if(plus) return '+'; if(space) return ' '; return 0; } #define PRINT_DEC_BUFSZ 32 /* 20 is enough for 64 bit decimals */ /** print decimal into buffer, returns length */ static int print_dec(char* buf, int max, unsigned int value) { int i = 0; if(value == 0) { if(max > 0) { buf[0] = '0'; i = 1; } } else while(value && i < max) { buf[i++] = '0' + value % 10; value /= 10; } return i; } /** print long decimal into buffer, returns length */ static int print_dec_l(char* buf, int max, unsigned long value) { int i = 0; if(value == 0) { if(max > 0) { buf[0] = '0'; i = 1; } } else while(value && i < max) { buf[i++] = '0' + value % 10; value /= 10; } return i; } /** print long decimal into buffer, returns length */ static int print_dec_ll(char* buf, int max, unsigned long long value) { int i = 0; if(value == 0) { if(max > 0) { buf[0] = '0'; i = 1; } } else while(value && i < max) { buf[i++] = '0' + value % 10; value /= 10; } return i; } /** print hex into buffer, returns length */ static int print_hex(char* buf, int max, unsigned int value) { const char* h = "0123456789abcdef"; int i = 0; if(value == 0) { if(max > 0) { buf[0] = '0'; i = 1; } } else while(value && i < max) { buf[i++] = h[value & 0x0f]; value >>= 4; } return i; } /** print long hex into buffer, returns length */ static int print_hex_l(char* buf, int max, unsigned long value) { const char* h = "0123456789abcdef"; int i = 0; if(value == 0) { if(max > 0) { buf[0] = '0'; i = 1; } } else while(value && i < max) { buf[i++] = h[value & 0x0f]; value >>= 4; } return i; } /** print long long hex into buffer, returns length */ static int print_hex_ll(char* buf, int max, unsigned long long value) { const char* h = "0123456789abcdef"; int i = 0; if(value == 0) { if(max > 0) { buf[0] = '0'; i = 1; } } else while(value && i < max) { buf[i++] = h[value & 0x0f]; value >>= 4; } return i; } /** copy string into result, reversed */ static void spool_str_rev(char** at, size_t* left, int* ret, const char* buf, int len) { int i = len; while(i) { if(*left > 1) { *(*at)++ = buf[--i]; (*left)--; } else --i; (*ret)++; } } /** copy string into result */ static void spool_str(char** at, size_t* left, int* ret, const char* buf, int len) { int i; for(i=0; i 1) { *(*at)++ = buf[i]; (*left)--; } (*ret)++; } } /** print number formatted */ static void print_num(char** at, size_t* left, int* ret, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space, int zero, int negative, char* buf, int len) { int w = len; /* excludes minus sign */ char s = get_negsign(negative, plus, space); if(minus) { /* left adjust the number into the field, space padding */ /* calc numw = [sign][zeroes][number] */ int numw = w; if(precision == 0 && zero) numw = 0; if(numw < precision) numw = precision; if(s) numw++; /* sign */ if(s) print_pad(at, left, ret, s, 1); /* number */ if(precision == 0 && zero) { /* "" for the number */ } else { if(w < precision) print_pad(at, left, ret, '0', precision - w); spool_str_rev(at, left, ret, buf, len); } /* spaces */ if(numw < minw) print_pad(at, left, ret, ' ', minw - numw); } else { /* pad on the left of the number */ /* calculate numw has width of [sign][zeroes][number] */ int numw = w; if(precision == 0 && zero) numw = 0; if(numw < precision) numw = precision; if(!prgiven && zeropad && numw < minw) numw = minw; else if(s) numw++; /* pad with spaces */ if(numw < minw) print_pad(at, left, ret, ' ', minw - numw); /* print sign (and one less zeropad if so) */ if(s) { print_pad(at, left, ret, s, 1); numw--; } /* pad with zeroes */ if(w < numw) print_pad(at, left, ret, '0', numw - w); if(precision == 0 && zero) return; /* print the characters for the value */ spool_str_rev(at, left, ret, buf, len); } } /** print %d and %i */ static void print_num_d(char** at, size_t* left, int* ret, int value, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space) { char buf[PRINT_DEC_BUFSZ]; int negative = (value < 0); int zero = (value == 0); int len = print_dec(buf, (int)sizeof(buf), (unsigned int)(negative?-value:value)); print_num(at, left, ret, minw, precision, prgiven, zeropad, minus, plus, space, zero, negative, buf, len); } /** print %ld and %li */ static void print_num_ld(char** at, size_t* left, int* ret, long value, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space) { char buf[PRINT_DEC_BUFSZ]; int negative = (value < 0); int zero = (value == 0); int len = print_dec_l(buf, (int)sizeof(buf), (unsigned long)(negative?-value:value)); print_num(at, left, ret, minw, precision, prgiven, zeropad, minus, plus, space, zero, negative, buf, len); } /** print %lld and %lli */ static void print_num_lld(char** at, size_t* left, int* ret, long long value, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space) { char buf[PRINT_DEC_BUFSZ]; int negative = (value < 0); int zero = (value == 0); int len = print_dec_ll(buf, (int)sizeof(buf), (unsigned long long)(negative?-value:value)); print_num(at, left, ret, minw, precision, prgiven, zeropad, minus, plus, space, zero, negative, buf, len); } /** print %u */ static void print_num_u(char** at, size_t* left, int* ret, unsigned int value, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space) { char buf[PRINT_DEC_BUFSZ]; int negative = 0; int zero = (value == 0); int len = print_dec(buf, (int)sizeof(buf), value); print_num(at, left, ret, minw, precision, prgiven, zeropad, minus, plus, space, zero, negative, buf, len); } /** print %lu */ static void print_num_lu(char** at, size_t* left, int* ret, unsigned long value, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space) { char buf[PRINT_DEC_BUFSZ]; int negative = 0; int zero = (value == 0); int len = print_dec_l(buf, (int)sizeof(buf), value); print_num(at, left, ret, minw, precision, prgiven, zeropad, minus, plus, space, zero, negative, buf, len); } /** print %llu */ static void print_num_llu(char** at, size_t* left, int* ret, unsigned long long value, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space) { char buf[PRINT_DEC_BUFSZ]; int negative = 0; int zero = (value == 0); int len = print_dec_ll(buf, (int)sizeof(buf), value); print_num(at, left, ret, minw, precision, prgiven, zeropad, minus, plus, space, zero, negative, buf, len); } /** print %x */ static void print_num_x(char** at, size_t* left, int* ret, unsigned int value, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space) { char buf[PRINT_DEC_BUFSZ]; int negative = 0; int zero = (value == 0); int len = print_hex(buf, (int)sizeof(buf), value); print_num(at, left, ret, minw, precision, prgiven, zeropad, minus, plus, space, zero, negative, buf, len); } /** print %lx */ static void print_num_lx(char** at, size_t* left, int* ret, unsigned long value, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space) { char buf[PRINT_DEC_BUFSZ]; int negative = 0; int zero = (value == 0); int len = print_hex_l(buf, (int)sizeof(buf), value); print_num(at, left, ret, minw, precision, prgiven, zeropad, minus, plus, space, zero, negative, buf, len); } /** print %llx */ static void print_num_llx(char** at, size_t* left, int* ret, unsigned long long value, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space) { char buf[PRINT_DEC_BUFSZ]; int negative = 0; int zero = (value == 0); int len = print_hex_ll(buf, (int)sizeof(buf), value); print_num(at, left, ret, minw, precision, prgiven, zeropad, minus, plus, space, zero, negative, buf, len); } /** print %llp */ static void print_num_llp(char** at, size_t* left, int* ret, void* value, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space) { char buf[PRINT_DEC_BUFSZ]; int negative = 0; int zero = (value == 0); #if defined(UINTPTR_MAX) && defined(UINT32_MAX) && (UINTPTR_MAX == UINT32_MAX) /* avoid warning about upcast on 32bit systems */ unsigned long long llvalue = (unsigned long)value; #else unsigned long long llvalue = (unsigned long long)value; #endif int len = print_hex_ll(buf, (int)sizeof(buf), llvalue); if(zero) { buf[0]=')'; buf[1]='l'; buf[2]='i'; buf[3]='n'; buf[4]='('; len = 5; } else { /* put '0x' in front of the (reversed) buffer result */ if(len < PRINT_DEC_BUFSZ) buf[len++] = 'x'; if(len < PRINT_DEC_BUFSZ) buf[len++] = '0'; } print_num(at, left, ret, minw, precision, prgiven, zeropad, minus, plus, space, zero, negative, buf, len); } #define PRINT_FLOAT_BUFSZ 64 /* xx.yy with 20.20 about the max */ /** spool remainder after the decimal point to buffer, in reverse */ static int print_remainder(char* buf, int max, double r, int prec) { unsigned long long cap = 1; unsigned long long value; int len, i; if(prec > 19) prec = 19; /* max we can do */ if(max < prec) return 0; for(i=0; i= 5) { value++; /* that might carry to numbers before the comma, if so, * just ignore that rounding. failure because 64bitprintout */ if(value >= cap) value = cap-1; } len = print_dec_ll(buf, max, value); while(len < prec) { /* pad with zeroes, e.g. if 0.0012 */ buf[len++] = '0'; } if(len < max) buf[len++] = '.'; return len; } /** spool floating point to buffer */ static int print_float(char* buf, int max, double value, int prec) { /* as xxx.xxx if prec==0, no '.', with prec decimals after . */ /* no conversion for NAN and INF, because we do not want to require linking with -lm. */ /* Thus, the conversions use 64bit integers to convert the numbers, * which makes 19 digits before and after the decimal point the max */ unsigned long long whole = (unsigned long long)value; double remain = value - (double)whole; int len = 0; if(prec != 0) len = print_remainder(buf, max, remain, prec); len += print_dec_ll(buf+len, max-len, whole); return len; } /** print %f */ static void print_num_f(char** at, size_t* left, int* ret, double value, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space) { char buf[PRINT_FLOAT_BUFSZ]; int negative = (value < 0); int zero = 0; int len; if(!prgiven) precision = 6; len = print_float(buf, (int)sizeof(buf), negative?-value:value, precision); print_num(at, left, ret, minw, 1, 0, zeropad, minus, plus, space, zero, negative, buf, len); } /* rudimentary %g support */ static int print_float_g(char* buf, int max, double value, int prec) { unsigned long long whole = (unsigned long long)value; double remain = value - (double)whole; int before = 0; int len = 0; /* number of digits before the decimal point */ while(whole > 0) { before++; whole /= 10; } whole = (unsigned long long)value; if(prec > before && remain != 0.0) { /* see if the last decimals are zero, if so, skip them */ len = print_remainder(buf, max, remain, prec-before); while(len > 0 && buf[0]=='0') { memmove(buf, buf+1, --len); } } len += print_dec_ll(buf+len, max-len, whole); return len; } /** print %g */ static void print_num_g(char** at, size_t* left, int* ret, double value, int minw, int precision, int prgiven, int zeropad, int minus, int plus, int space) { char buf[PRINT_FLOAT_BUFSZ]; int negative = (value < 0); int zero = 0; int len; if(!prgiven) precision = 6; if(precision == 0) precision = 1; len = print_float_g(buf, (int)sizeof(buf), negative?-value:value, precision); print_num(at, left, ret, minw, 1, 0, zeropad, minus, plus, space, zero, negative, buf, len); } /** strnlen (compat implementation) */ static int my_strnlen(const char* s, int max) { int i; for(i=0; i 1) { *at++ = *fmt++; left--; } else fmt++; ret++; } /* see if we are at end */ if(!*fmt) break; /* fetch next argument % designation from format string */ fmt++; /* skip the '%' */ /********************************/ /* get the argument designation */ /********************************/ /* we must do this vararg stuff inside this function for * portability. Hence, get_designation, and print_designation * are not their own functions. */ /* printout designation: * conversion specifier: x, d, u, s, c, n, m, p * flags: # not supported * 0 zeropad (on the left) * - left adjust (right by default) * ' ' printspace for positive number (in - position). * + alwayssign * fieldwidth: [1-9][0-9]* minimum field width. * if this is * then type int next argument specifies the minwidth. * if this is negative, the - flag is set (with positive width). * precision: period[digits]*, %.2x. * if this is * then type int next argument specifies the precision. * just '.' or negative value means precision=0. * this is mindigits to print for d, i, u, x * this is aftercomma digits for f * this is max number significant digits for g * maxnumber characters to be printed for s * length: 0-none (int), 1-l (long), 2-ll (long long) * notsupported: hh (char), h (short), L (long double), q, j, z, t * Does not support %m$ and *m$ argument designation as array indices. * Does not support %#x * */ minw = 0; precision = 1; prgiven = 0; zeropad = 0; minus = 0; plus = 0; space = 0; length = 0; /* get flags in any order */ for(;;) { if(*fmt == '0') zeropad = 1; else if(*fmt == '-') minus = 1; else if(*fmt == '+') plus = 1; else if(*fmt == ' ') space = 1; else break; fmt++; } /* field width */ if(*fmt == '*') { fmt++; /* skip char */ minw = va_arg(arg, int); if(minw < 0) { minus = 1; minw = -minw; } } else while(*fmt >= '0' && *fmt <= '9') { minw = minw*10 + (*fmt++)-'0'; } /* precision */ if(*fmt == '.') { fmt++; /* skip period */ prgiven = 1; precision = 0; if(*fmt == '*') { fmt++; /* skip char */ precision = va_arg(arg, int); if(precision < 0) precision = 0; } else while(*fmt >= '0' && *fmt <= '9') { precision = precision*10 + (*fmt++)-'0'; } } /* length */ if(*fmt == 'l') { fmt++; /* skip char */ length = 1; if(*fmt == 'l') { fmt++; /* skip char */ length = 2; } } /* get the conversion */ if(!*fmt) conv = 0; else conv = *fmt++; /***********************************/ /* print that argument designation */ /***********************************/ switch(conv) { case 'i': case 'd': if(length == 0) print_num_d(&at, &left, &ret, va_arg(arg, int), minw, precision, prgiven, zeropad, minus, plus, space); else if(length == 1) print_num_ld(&at, &left, &ret, va_arg(arg, long), minw, precision, prgiven, zeropad, minus, plus, space); else if(length == 2) print_num_lld(&at, &left, &ret, va_arg(arg, long long), minw, precision, prgiven, zeropad, minus, plus, space); break; case 'u': if(length == 0) print_num_u(&at, &left, &ret, va_arg(arg, unsigned int), minw, precision, prgiven, zeropad, minus, plus, space); else if(length == 1) print_num_lu(&at, &left, &ret, va_arg(arg, unsigned long), minw, precision, prgiven, zeropad, minus, plus, space); else if(length == 2) print_num_llu(&at, &left, &ret, va_arg(arg, unsigned long long), minw, precision, prgiven, zeropad, minus, plus, space); break; case 'x': if(length == 0) print_num_x(&at, &left, &ret, va_arg(arg, unsigned int), minw, precision, prgiven, zeropad, minus, plus, space); else if(length == 1) print_num_lx(&at, &left, &ret, va_arg(arg, unsigned long), minw, precision, prgiven, zeropad, minus, plus, space); else if(length == 2) print_num_llx(&at, &left, &ret, va_arg(arg, unsigned long long), minw, precision, prgiven, zeropad, minus, plus, space); break; case 's': print_str(&at, &left, &ret, va_arg(arg, char*), minw, precision, prgiven, minus); break; case 'c': print_char(&at, &left, &ret, va_arg(arg, int), minw, minus); break; case 'n': *va_arg(arg, int*) = ret; break; case 'm': print_str(&at, &left, &ret, strerror(errno), minw, precision, prgiven, minus); break; case 'p': print_num_llp(&at, &left, &ret, va_arg(arg, void*), minw, precision, prgiven, zeropad, minus, plus, space); break; case '%': print_pad(&at, &left, &ret, '%', 1); break; case 'f': print_num_f(&at, &left, &ret, va_arg(arg, double), minw, precision, prgiven, zeropad, minus, plus, space); break; case 'g': print_num_g(&at, &left, &ret, va_arg(arg, double), minw, precision, prgiven, zeropad, minus, plus, space); break; /* unknown */ default: case 0: break; } } /* zero terminate */ if(left > 0) *at = 0; return ret; } #ifdef SNPRINTF_TEST /** do tests */ #undef snprintf #define DOTEST(bufsz, result, retval, ...) do { \ char buf[bufsz]; \ printf("now test %s\n", #__VA_ARGS__); \ int r=my_snprintf(buf, sizeof(buf), __VA_ARGS__); \ if(r != retval || strcmp(buf, result) != 0) { \ printf("error test(%s) was \"%s\":%d\n", \ ""#bufsz", "#result", "#retval", "#__VA_ARGS__, \ buf, r); \ exit(1); \ } \ r=snprintf(buf, sizeof(buf), __VA_ARGS__); \ if(r != retval || strcmp(buf, result) != 0) { \ printf("error test(%s) differs with system, \"%s\":%d\n", \ ""#bufsz", "#result", "#retval", "#__VA_ARGS__, \ buf, r); \ exit(1); \ } \ printf("test(\"%s\":%d) passed\n", buf, r); \ } while(0); /** test program */ int main(void) { int x = 0; /* bufsize, expectedstring, expectedretval, snprintf arguments */ DOTEST(1024, "hello", 5, "hello"); DOTEST(1024, "h", 1, "h"); /* warning from gcc for format string, but it does work * DOTEST(1024, "", 0, ""); */ DOTEST(3, "he", 5, "hello"); DOTEST(1, "", 7, "%d", 7823089); /* test positive numbers */ DOTEST(1024, "0", 1, "%d", 0); DOTEST(1024, "1", 1, "%d", 1); DOTEST(1024, "9", 1, "%d", 9); DOTEST(1024, "15", 2, "%d", 15); DOTEST(1024, "ab15cd", 6, "ab%dcd", 15); DOTEST(1024, "167", 3, "%d", 167); DOTEST(1024, "7823089", 7, "%d", 7823089); DOTEST(1024, " 12", 3, "%3d", 12); DOTEST(1024, "012", 3, "%.3d", 12); DOTEST(1024, "012", 3, "%3.3d", 12); DOTEST(1024, "012", 3, "%03d", 12); DOTEST(1024, " 012", 4, "%4.3d", 12); DOTEST(1024, "", 0, "%.0d", 0); /* test negative numbers */ DOTEST(1024, "-1", 2, "%d", -1); DOTEST(1024, "-12", 3, "%3d", -12); DOTEST(1024, " -2", 3, "%3d", -2); DOTEST(1024, "-012", 4, "%.3d", -12); DOTEST(1024, "-012", 4, "%3.3d", -12); DOTEST(1024, "-012", 4, "%4.3d", -12); DOTEST(1024, " -012", 5, "%5.3d", -12); DOTEST(1024, "-12", 3, "%03d", -12); DOTEST(1024, "-02", 3, "%03d", -2); DOTEST(1024, "-15", 3, "%d", -15); DOTEST(1024, "-7307", 5, "%d", -7307); DOTEST(1024, "-12 ", 5, "%-5d", -12); DOTEST(1024, "-00012", 6, "%-.5d", -12); /* test + and space flags */ DOTEST(1024, "+12", 3, "%+d", 12); DOTEST(1024, " 12", 3, "% d", 12); /* test %u */ DOTEST(1024, "12", 2, "%u", 12); DOTEST(1024, "0", 1, "%u", 0); DOTEST(1024, "4294967295", 10, "%u", 0xffffffff); /* test %x */ DOTEST(1024, "0", 1, "%x", 0); DOTEST(1024, "c", 1, "%x", 12); DOTEST(1024, "12ab34cd", 8, "%x", 0x12ab34cd); /* test %llu, %lld */ DOTEST(1024, "18446744073709551615", 20, "%llu", (long long)0xffffffffffffffff); DOTEST(1024, "-9223372036854775808", 20, "%lld", (long long)0x8000000000000000); DOTEST(1024, "9223372036854775808", 19, "%llu", (long long)0x8000000000000000); /* test %s */ DOTEST(1024, "hello", 5, "%s", "hello"); DOTEST(1024, " hello", 10, "%10s", "hello"); DOTEST(1024, "hello ", 10, "%-10s", "hello"); DOTEST(1024, "he", 2, "%.2s", "hello"); DOTEST(1024, " he", 4, "%4.2s", "hello"); DOTEST(1024, " h", 4, "%4.2s", "h"); /* test %c */ DOTEST(1024, "a", 1, "%c", 'a'); /* warning from gcc for format string, but it does work DOTEST(1024, " a", 5, "%5c", 'a'); DOTEST(1024, "a", 1, "%.0c", 'a'); */ /* test %n */ DOTEST(1024, "hello", 5, "hello%n", &x); if(x != 5) { printf("the %%n failed\n"); exit(1); } /* test %m */ errno = 0; DOTEST(1024, "Success", 7, "%m"); /* test %p */ DOTEST(1024, "0x10", 4, "%p", (void*)0x10); DOTEST(1024, "(nil)", 5, "%p", (void*)0x0); /* test %% */ DOTEST(1024, "%", 1, "%%"); /* test %f */ DOTEST(1024, "0.000000", 8, "%f", 0.0); DOTEST(1024, "0.00", 4, "%.2f", 0.0); /* differs, "-0.00" DOTEST(1024, "0.00", 4, "%.2f", -0.0); */ DOTEST(1024, "234.00", 6, "%.2f", 234.005); DOTEST(1024, "8973497.1246", 12, "%.4f", 8973497.12456); DOTEST(1024, "-12.000000", 10, "%f", -12.0); DOTEST(1024, "6", 1, "%.0f", 6.0); DOTEST(1024, "6", 1, "%g", 6.0); DOTEST(1024, "6.1", 3, "%g", 6.1); DOTEST(1024, "6.15", 4, "%g", 6.15); /* These format strings are from the code of NSD, Unbound, ldns */ DOTEST(1024, "abcdef", 6, "%s", "abcdef"); DOTEST(1024, "005", 3, "%03u", 5); DOTEST(1024, "12345", 5, "%03u", 12345); DOTEST(1024, "5", 1, "%d", 5); DOTEST(1024, "(nil)", 5, "%p", NULL); DOTEST(1024, "12345", 5, "%ld", (long)12345); DOTEST(1024, "12345", 5, "%lu", (long)12345); DOTEST(1024, " 12345", 12, "%12u", (unsigned)12345); DOTEST(1024, "12345", 5, "%u", (unsigned)12345); DOTEST(1024, "12345", 5, "%llu", (unsigned long long)12345); DOTEST(1024, "12345", 5, "%x", 0x12345); DOTEST(1024, "12345", 5, "%llx", (long long)0x12345); DOTEST(1024, "012345", 6, "%6.6d", 12345); DOTEST(1024, "012345", 6, "%6.6u", 12345); DOTEST(1024, "1234.54", 7, "%g", 1234.54); DOTEST(1024, "123456789.54", 12, "%.12g", 123456789.54); DOTEST(1024, "3456789123456.54", 16, "%.16g", 3456789123456.54); /* %24g does not work with 24 digits, not enough accuracy, * the first 16 digits are correct */ DOTEST(1024, "12345", 5, "%3.3d", 12345); DOTEST(1024, "000", 3, "%3.3d", 0); DOTEST(1024, "001", 3, "%3.3d", 1); DOTEST(1024, "012", 3, "%3.3d", 12); DOTEST(1024, "-012", 4, "%3.3d", -12); DOTEST(1024, "he", 2, "%.2s", "hello"); DOTEST(1024, "helloworld", 10, "%s%s", "hello", "world"); DOTEST(1024, "he", 2, "%.*s", 2, "hello"); DOTEST(1024, " hello", 7, "%*s", 7, "hello"); DOTEST(1024, "hello ", 7, "%*s", -7, "hello"); DOTEST(1024, "0", 1, "%c", '0'); DOTEST(1024, "A", 1, "%c", 'A'); DOTEST(1024, "", 1, "%c", 0); DOTEST(1024, "\010", 1, "%c", 8); DOTEST(1024, "%", 1, "%%"); DOTEST(1024, "0a", 2, "%02x", 0x0a); DOTEST(1024, "bd", 2, "%02x", 0xbd); DOTEST(1024, "12", 2, "%02ld", (long)12); DOTEST(1024, "02", 2, "%02ld", (long)2); DOTEST(1024, "02", 2, "%02u", (unsigned)2); DOTEST(1024, "765432", 6, "%05u", (unsigned)765432); DOTEST(1024, "10.234", 6, "%0.3f", 10.23421); DOTEST(1024, "123456.234", 10, "%0.3f", 123456.23421); DOTEST(1024, "123456789.234", 13, "%0.3f", 123456789.23421); DOTEST(1024, "123456.23", 9, "%.2f", 123456.23421); DOTEST(1024, "123456", 6, "%.0f", 123456.23421); DOTEST(1024, "0123", 4, "%.4x", 0x0123); DOTEST(1024, "00000123", 8, "%.8x", 0x0123); DOTEST(1024, "ffeb0cde", 8, "%.8x", 0xffeb0cde); DOTEST(1024, " 987654321", 10, "%10lu", (unsigned long)987654321); DOTEST(1024, " 987654321", 12, "%12lu", (unsigned long)987654321); DOTEST(1024, "987654321", 9, "%i", 987654321); DOTEST(1024, "-87654321", 9, "%i", -87654321); DOTEST(1024, "hello ", 16, "%-16s", "hello"); DOTEST(1024, " ", 16, "%-16s", ""); DOTEST(1024, "a ", 16, "%-16s", "a"); DOTEST(1024, "foobarfoobar ", 16, "%-16s", "foobarfoobar"); DOTEST(1024, "foobarfoobarfoobar", 18, "%-16s", "foobarfoobarfoobar"); /* combined expressions */ DOTEST(1024, "foo 1.0 size 512 edns", 21, "foo %s size %d %s%s", "1.0", 512, "", "edns"); DOTEST(15, "foo 1.0 size 5", 21, "foo %s size %d %s%s", "1.0", 512, "", "edns"); DOTEST(1024, "packet 1203ceff id", 18, "packet %2.2x%2.2x%2.2x%2.2x id", 0x12, 0x03, 0xce, 0xff); DOTEST(1024, "/tmp/testbound_123abcd.tmp", 26, "/tmp/testbound_%u%s%s.tmp", 123, "ab", "cd"); return 0; } #endif /* SNPRINTF_TEST */ nsd-3.2.16/compat/memmove.c0000664000175000017500000000166511761673243014471 0ustar matjematje/* * memmove.c: memmove compat implementation. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. */ #include #include void *memmove(void *dest, const void *src, size_t n); void *memmove(void *dest, const void *src, size_t n) { uint8_t* from = (uint8_t*) src; uint8_t* to = (uint8_t*) dest; if (from == to || n == 0) return dest; if (to > from && to-from < (int)n) { /* to overlaps with from */ /* */ /* */ /* copy in reverse, to avoid overwriting from */ int i; for(i=n-1; i>=0; i--) to[i] = from[i]; return dest; } if (from > to && from-to < (int)n) { /* to overlaps with from */ /* */ /* */ /* copy forwards, to avoid overwriting from */ size_t i; for(i=0; i #endif #ifndef STRPTIME_WORKS #define TM_YEAR_BASE 1900 #include #include static const char *abb_weekdays[] = { "Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat", NULL }; static const char *full_weekdays[] = { "Sunday", "Monday", "Tuesday", "Wednesday", "Thursday", "Friday", "Saturday", NULL }; static const char *abb_months[] = { "Jan", "Feb", "Mar", "Apr", "May", "Jun", "Jul", "Aug", "Sep", "Oct", "Nov", "Dec", NULL }; static const char *full_months[] = { "January", "February", "March", "April", "May", "June", "July", "August", "September", "October", "November", "December", NULL }; static const char *ampm[] = { "am", "pm", NULL }; static int match_string(const char **buf, const char **strs) { int i = 0; for (i = 0; strs[i] != NULL; i++) { int len = strlen(strs[i]); if (strncasecmp (*buf, strs[i], len) == 0) { *buf += len; return i; } } return -1; } static int str2int(const char **buf, int max) { int ret=0, count=0; while (*buf[0] != '\0' && isdigit(*buf[0]) && counttm_wday = ret; break; case 'b': /* month name, abbreviated or full */ case 'B': case 'h': ret = match_string(&s, full_months); if (ret < 0) ret = match_string(&s, abb_months); if (ret < 0) { return NULL; } tm->tm_mon = ret; break; case 'c': /* date and time representation */ if (!(s = nsd_strptime(s, "%x %X", tm))) { return NULL; } break; case 'C': /* century number */ ret = str2int(&s, 2); if (ret < 0 || ret > 99) { /* must be in [00,99] */ return NULL; } if (split_year) { tm->tm_year = ret*100 + (tm->tm_year%100); } else { tm->tm_year = ret*100 - TM_YEAR_BASE; split_year = 1; } break; case 'd': /* day of month */ case 'e': ret = str2int(&s, 2); if (ret < 1 || ret > 31) { /* must be in [01,31] */ return NULL; } tm->tm_mday = ret; break; case 'D': /* equivalent to %m/%d/%y */ if (!(s = nsd_strptime(s, "%m/%d/%y", tm))) { return NULL; } break; case 'H': /* hour */ ret = str2int(&s, 2); if (ret < 0 || ret > 23) { /* must be in [00,23] */ return NULL; } tm->tm_hour = ret; break; case 'I': /* 12hr clock hour */ ret = str2int(&s, 2); if (ret < 1 || ret > 12) { /* must be in [01,12] */ return NULL; } if (ret == 12) /* actually [0,11] */ ret = 0; tm->tm_hour = ret; break; case 'j': /* day of year */ ret = str2int(&s, 2); if (ret < 1 || ret > 366) { /* must be in [001,366] */ return NULL; } tm->tm_yday = ret; break; case 'm': /* month */ ret = str2int(&s, 2); if (ret < 1 || ret > 12) { /* must be in [01,12] */ return NULL; } /* months go from 0-11 */ tm->tm_mon = (ret-1); break; case 'M': /* minute */ ret = str2int(&s, 2); if (ret < 0 || ret > 59) { /* must be in [00,59] */ return NULL; } tm->tm_min = ret; break; case 'n': /* arbitrary whitespace */ case 't': while (isspace(*s)) s++; break; case 'p': /* am pm */ ret = match_string(&s, ampm); if (ret < 0) { return NULL; } if (tm->tm_hour < 0 || tm->tm_hour > 11) { /* %I */ return NULL; } if (ret == 1) /* pm */ tm->tm_hour += 12; break; case 'r': /* equivalent of %I:%M:%S %p */ if (!(s = nsd_strptime(s, "%I:%M:%S %p", tm))) { return NULL; } break; case 'R': /* equivalent of %H:%M */ if (!(s = nsd_strptime(s, "%H:%M", tm))) { return NULL; } break; case 'S': /* seconds */ ret = str2int(&s, 2); /* 60 may occur for leap seconds */ /* earlier 61 was also allowed */ if (ret < 0 || ret > 60) { /* must be in [00,60] */ return NULL; } tm->tm_sec = ret; break; case 'T': /* equivalent of %H:%M:%S */ if (!(s = nsd_strptime(s, "%H:%M:%S", tm))) { return NULL; } break; case 'U': /* week number, with the first Sun of Jan being w1 */ ret = str2int(&s, 2); if (ret < 0 || ret > 53) { /* must be in [00,53] */ return NULL; } /** it is hard (and not necessary for nsd) to determine time * data from week number. **/ break; case 'w': /* day of week */ ret = str2int(&s, 1); if (ret < 0 || ret > 6) { /* must be in [0,6] */ return NULL; } tm->tm_wday = ret; break; case 'W': /* week number, with the first Mon of Jan being w1 */ ret = str2int(&s, 2); if (ret < 0 || ret > 53) { /* must be in [00,53] */ return NULL; } /** it is hard (and not necessary for nsd) to determine time * data from week number. **/ break; case 'x': /* date format */ if (!(s = nsd_strptime(s, "%m/%d/%y", tm))) { return NULL; } break; case 'X': /* time format */ if (!(s = nsd_strptime(s, "%H:%M:%S", tm))) { return NULL; } break; case 'y': /* last two digits of a year */ ret = str2int(&s, 2); if (ret < 0 || ret > 99) { /* must be in [00,99] */ return NULL; } if (split_year) { tm->tm_year = ((tm->tm_year/100) * 100) + ret; } else { split_year = 1; /** currently: * if in [0,68] we are in 21th century, * if in [69,99] we are in 20th century. **/ if (ret < 69) /* 2000 */ ret += 100; tm->tm_year = ret; } break; case 'Y': /* year */ ret = str2int(&s, 4); if (ret < 0 || ret > 9999) { return NULL; } tm->tm_year = ret - TM_YEAR_BASE; break; case '\0': default: /* unsupported, cannot match format */ return NULL; break; } } else { /* literal */ /* if input cannot match format, return NULL */ if (*s != c) return NULL; s++; } format++; } /* return pointer to remainder of s */ return (char*) s; } #endif /* STRPTIME_WORKS */ nsd-3.2.16/compat/malloc.c0000664000175000017500000000060007676574217014272 0ustar matjematje/* Just a replacement, if the original malloc is not GNU-compliant. See autoconf documentation. */ #if HAVE_CONFIG_H #include #endif #undef malloc #include void *malloc (); /* Allocate an N-byte block of memory from the heap. If N is zero, allocate a 1-byte block. */ void * rpl_malloc (size_t n) { if (n == 0) n = 1; return malloc (n); } nsd-3.2.16/compat/memcmp.h0000664000175000017500000000047511761673243014305 0ustar matjematje/* * memcmp.h: undef memcmp for compat. * * Copyright (c) 2012, NLnet Labs. All rights reserved. * * See LICENSE for the license. */ #ifndef COMPAT_MEMCMP_H #define COMPAT_MEMCMP_H #ifdef memcmp /* undef here otherwise autoheader messes it up in config.h */ # undef memcmp #endif #endif /* COMPAT_MEMCMP_H */ nsd-3.2.16/compat/strlcpy.c0000664000175000017500000000320510446231040014474 0ustar matjematje/* from openssh 4.3p2 compat/strlcpy.c */ /* * Copyright (c) 1998 Todd C. Miller * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */ /* OPENBSD ORIGINAL: lib/libc/string/strlcpy.c */ #include #ifndef HAVE_STRLCPY #include #include /* * Copy src to string dst of size siz. At most siz-1 characters * will be copied. Always NUL terminates (unless siz == 0). * Returns strlen(src); if retval >= siz, truncation occurred. */ size_t strlcpy(char *dst, const char *src, size_t siz) { char *d = dst; const char *s = src; size_t n = siz; /* Copy as many bytes as will fit */ if (n != 0 && --n != 0) { do { if ((*d++ = *s++) == 0) break; } while (--n != 0); } /* Not enough room in dst, add NUL and traverse rest of src */ if (n == 0) { if (siz != 0) *d = '\0'; /* NUL-terminate dst */ while (*s++) ; } return(s - src - 1); /* count does not include NUL */ } #endif /* !HAVE_STRLCPY */ nsd-3.2.16/compat/basename.c0000664000175000017500000000044207434720207014562 0ustar matjematje/* Return the basename of a pathname. This file is in the public domain. */ char * basename (name) const char *name; { const char *base; for (base = name; *name; name++) { if (*name == '/') { base = name + 1; } } return (char *) base; } nsd-3.2.16/compat/inet_pton.c0000664000175000017500000001214210446177505015012 0ustar matjematje/* $KAME: inet_pton.c,v 1.5 2001/08/20 02:32:40 itojun Exp $ */ /* Copyright (c) 1996 by Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. */ #include #include #include #include /* * WARNING: Don't even consider trying to compile this on a system where * sizeof(int) < 4. sizeof(int) > 4 is fine; all the world's not a VAX. */ static int inet_pton4 (const char *src, uint8_t *dst); static int inet_pton6 (const char *src, uint8_t *dst); /* * * The definitions we might miss. * */ #ifndef NS_INT16SZ #define NS_INT16SZ 2 #endif #ifndef NS_IN6ADDRSZ #define NS_IN6ADDRSZ 16 #endif #ifndef NS_INADDRSZ #define NS_INADDRSZ 4 #endif /* int * inet_pton(af, src, dst) * convert from presentation format (which usually means ASCII printable) * to network format (which is usually some kind of binary format). * return: * 1 if the address was valid for the specified address family * 0 if the address wasn't valid (`dst' is untouched in this case) * -1 if some other error occurred (`dst' is untouched in this case, too) * author: * Paul Vixie, 1996. */ int inet_pton(af, src, dst) int af; const char *src; void *dst; { switch (af) { case AF_INET: return (inet_pton4(src, dst)); case AF_INET6: return (inet_pton6(src, dst)); default: errno = EAFNOSUPPORT; return (-1); } /* NOTREACHED */ } /* int * inet_pton4(src, dst) * like inet_aton() but without all the hexadecimal and shorthand. * return: * 1 if `src' is a valid dotted quad, else 0. * notice: * does not touch `dst' unless it's returning 1. * author: * Paul Vixie, 1996. */ static int inet_pton4(src, dst) const char *src; uint8_t *dst; { static const char digits[] = "0123456789"; int saw_digit, octets, ch; uint8_t tmp[NS_INADDRSZ], *tp; saw_digit = 0; octets = 0; *(tp = tmp) = 0; while ((ch = *src++) != '\0') { const char *pch; if ((pch = strchr(digits, ch)) != NULL) { uint32_t new = *tp * 10 + (pch - digits); if (new > 255) return (0); *tp = new; if (! saw_digit) { if (++octets > 4) return (0); saw_digit = 1; } } else if (ch == '.' && saw_digit) { if (octets == 4) return (0); *++tp = 0; saw_digit = 0; } else return (0); } if (octets < 4) return (0); memcpy(dst, tmp, NS_INADDRSZ); return (1); } /* int * inet_pton6(src, dst) * convert presentation level address to network order binary form. * return: * 1 if `src' is a valid [RFC1884 2.2] address, else 0. * notice: * (1) does not touch `dst' unless it's returning 1. * (2) :: in a full address is silently ignored. * credit: * inspired by Mark Andrews. * author: * Paul Vixie, 1996. */ static int inet_pton6(src, dst) const char *src; uint8_t *dst; { static const char xdigits_l[] = "0123456789abcdef", xdigits_u[] = "0123456789ABCDEF"; uint8_t tmp[NS_IN6ADDRSZ], *tp, *endp, *colonp; const char *xdigits, *curtok; int ch, saw_xdigit; uint32_t val; memset((tp = tmp), '\0', NS_IN6ADDRSZ); endp = tp + NS_IN6ADDRSZ; colonp = NULL; /* Leading :: requires some special handling. */ if (*src == ':') if (*++src != ':') return (0); curtok = src; saw_xdigit = 0; val = 0; while ((ch = *src++) != '\0') { const char *pch; if ((pch = strchr((xdigits = xdigits_l), ch)) == NULL) pch = strchr((xdigits = xdigits_u), ch); if (pch != NULL) { val <<= 4; val |= (pch - xdigits); if (val > 0xffff) return (0); saw_xdigit = 1; continue; } if (ch == ':') { curtok = src; if (!saw_xdigit) { if (colonp) return (0); colonp = tp; continue; } if (tp + NS_INT16SZ > endp) return (0); *tp++ = (uint8_t) (val >> 8) & 0xff; *tp++ = (uint8_t) val & 0xff; saw_xdigit = 0; val = 0; continue; } if (ch == '.' && ((tp + NS_INADDRSZ) <= endp) && inet_pton4(curtok, tp) > 0) { tp += NS_INADDRSZ; saw_xdigit = 0; break; /* '\0' was seen by inet_pton4(). */ } return (0); } if (saw_xdigit) { if (tp + NS_INT16SZ > endp) return (0); *tp++ = (uint8_t) (val >> 8) & 0xff; *tp++ = (uint8_t) val & 0xff; } if (colonp != NULL) { /* * Since some memmove()'s erroneously fail to handle * overlapping regions, we'll do the shift by hand. */ const int n = tp - colonp; int i; for (i = 1; i <= n; i++) { endp[- i] = colonp[n - i]; colonp[n - i] = 0; } tp = endp; } if (tp != endp) return (0); memcpy(dst, tmp, NS_IN6ADDRSZ); return (1); } nsd-3.2.16/compat/pselect.c0000664000175000017500000000174511716721240014451 0ustar matjematje/* * Like select(2) but set the signals to block while waiting in * select. This version is not entirely race condition safe. Only * operating system support can make it so. */ #include #include #include #ifdef HAVE_SYS_SELECT_H #include #endif #include #include int pselect (int n, fd_set *readfds, fd_set *writefds, fd_set *exceptfds, const struct timespec *timeout, const sigset_t *sigmask) { int result; sigset_t saved_sigmask; struct timeval saved_timeout; if (sigmask && sigprocmask(SIG_SETMASK, sigmask, &saved_sigmask) == -1) return -1; if (timeout) { saved_timeout.tv_sec = timeout->tv_sec; saved_timeout.tv_usec = timeout->tv_nsec / 1000; result = select(n, readfds, writefds, exceptfds, &saved_timeout); } else { result = select(n, readfds, writefds, exceptfds, NULL); } if (sigmask && sigprocmask(SIG_SETMASK, &saved_sigmask, NULL) == -1) return -1; return result; } nsd-3.2.16/compat/memcmp.c0000664000175000017500000000073611761673243014300 0ustar matjematje/* * memcmp.c: memcmp compat implementation. * * Copyright (c) 2010-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. */ #include int memcmp(const void *x, const void *y, size_t n); int memcmp(const void *x, const void *y, size_t n) { const uint8_t* x8 = (const uint8_t*)x; const uint8_t* y8 = (const uint8_t*)y; size_t i; for(i=0; i y8[i]) return 1; } return 0; } nsd-3.2.16/compat/b64_ntop.c0000664000175000017500000001641612010737213014441 0ustar matjematje/* * Copyright (c) 1996, 1998 by Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. */ /* * Portions Copyright (c) 1995 by International Business Machines, Inc. * * International Business Machines, Inc. (hereinafter called IBM) grants * permission under its copyrights to use, copy, modify, and distribute this * Software with or without fee, provided that the above copyright notice and * all paragraphs of this notice appear in all copies, and that the name of IBM * not be used in connection with the marketing of any product incorporating * the Software or modifications thereof, without specific, written prior * permission. * * To the extent it has a right to do so, IBM grants an immunity from suit * under its patents, if any, for the use, sale or manufacture of products to * the extent that such products are used for performing Domain Name System * dynamic updates in TCP/IP networks by means of the Software. No immunity is * granted for any product per se or for any other function of any product. * * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES, * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A * PARTICULAR PURPOSE. IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL, * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. */ #include #include #include #include #include #include #include #include #include #include #define Assert(Cond) if (!(Cond)) abort() static const char Base64[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; static const char Pad64 = '='; /* (From RFC1521 and draft-ietf-dnssec-secext-03.txt) The following encoding technique is taken from RFC 1521 by Borenstein and Freed. It is reproduced here in a slightly edited form for convenience. A 65-character subset of US-ASCII is used, enabling 6 bits to be represented per printable character. (The extra 65th character, "=", is used to signify a special processing function.) The encoding process represents 24-bit groups of input bits as output strings of 4 encoded characters. Proceeding from left to right, a 24-bit input group is formed by concatenating 3 8-bit input groups. These 24 bits are then treated as 4 concatenated 6-bit groups, each of which is translated into a single digit in the base64 alphabet. Each 6-bit group is used as an index into an array of 64 printable characters. The character referenced by the index is placed in the output string. Table 1: The Base64 Alphabet Value Encoding Value Encoding Value Encoding Value Encoding 0 A 17 R 34 i 51 z 1 B 18 S 35 j 52 0 2 C 19 T 36 k 53 1 3 D 20 U 37 l 54 2 4 E 21 V 38 m 55 3 5 F 22 W 39 n 56 4 6 G 23 X 40 o 57 5 7 H 24 Y 41 p 58 6 8 I 25 Z 42 q 59 7 9 J 26 a 43 r 60 8 10 K 27 b 44 s 61 9 11 L 28 c 45 t 62 + 12 M 29 d 46 u 63 / 13 N 30 e 47 v 14 O 31 f 48 w (pad) = 15 P 32 g 49 x 16 Q 33 h 50 y Special processing is performed if fewer than 24 bits are available at the end of the data being encoded. A full encoding quantum is always completed at the end of a quantity. When fewer than 24 input bits are available in an input group, zero bits are added (on the right) to form an integral number of 6-bit groups. Padding at the end of the data is performed using the '=' character. Since all base64 input is an integral number of octets, only the ------------------------------------------------- following cases can arise: (1) the final quantum of encoding input is an integral multiple of 24 bits; here, the final unit of encoded output will be an integral multiple of 4 characters with no "=" padding, (2) the final quantum of encoding input is exactly 8 bits; here, the final unit of encoded output will be two characters followed by two "=" padding characters, or (3) the final quantum of encoding input is exactly 16 bits; here, the final unit of encoded output will be three characters followed by one "=" padding character. */ int b64_ntop(uint8_t const *src, size_t srclength, char *target, size_t targsize) { size_t datalength = 0; uint8_t input[3]; uint8_t output[4]; size_t i; while (2 < srclength) { input[0] = *src++; input[1] = *src++; input[2] = *src++; srclength -= 3; output[0] = input[0] >> 2; output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4); output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6); output[3] = input[2] & 0x3f; Assert(output[0] < 64); Assert(output[1] < 64); Assert(output[2] < 64); Assert(output[3] < 64); if (datalength + 4 > targsize) return (-1); target[datalength++] = Base64[output[0]]; target[datalength++] = Base64[output[1]]; target[datalength++] = Base64[output[2]]; target[datalength++] = Base64[output[3]]; } /* Now we worry about padding. */ if (0 != srclength) { /* Get what's left. */ input[0] = input[1] = input[2] = '\0'; for (i = 0; i < srclength; i++) input[i] = *src++; output[0] = input[0] >> 2; output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4); output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6); Assert(output[0] < 64); Assert(output[1] < 64); Assert(output[2] < 64); if (datalength + 4 > targsize) return (-1); target[datalength++] = Base64[output[0]]; target[datalength++] = Base64[output[1]]; if (srclength == 1) target[datalength++] = Pad64; else target[datalength++] = Base64[output[2]]; target[datalength++] = Pad64; } if (datalength >= targsize) return (-1); target[datalength] = '\0'; /* Returned value doesn't count \0. */ return (datalength); } nsd-3.2.16/compat/strlcat.c0000664000175000017500000000461711535153054014470 0ustar matjematje/* compat/strlcat.c */ /*- * Copyright (c) 1998 Todd C. Miller * All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. The name of the author may not be used to endorse or promote products * derived from this software without specific prior written permission. * * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL * THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; * OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, * WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR * OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF * ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ /* OPENBSD ORIGINAL: lib/libc/string/strlcat.c */ #include #ifndef HAVE_STRLCAT #include #include /* * Appends src to string dst of size siz (unlike strncat, siz is the * full size of dst, not space left). At most siz-1 characters * will be copied. Always NUL terminates (unless siz <= strlen(dst)). * Returns strlen(src) + MIN(siz, strlen(initial dst)). * If retval >= siz, truncation occurred. */ size_t strlcat(char *dst, const char *src, size_t siz) { char *d = dst; const char *s = src; size_t n = siz; size_t dlen; /* Find the end of dst and adjust bytes left but don't go past end */ while (n-- != 0 && *d != '\0') d++; dlen = d - dst; n = siz - dlen; if (n == 0) return(dlen + strlen(s)); while (*s != '\0') { if (n != 1) { *d++ = *s; n--; } s++; } *d = '\0'; return(dlen + (s - src)); /* count does not include NUL */ } #endif /* !HAVE_STRLCAT */ nsd-3.2.16/compat/fake-rfc2553.h0000664000175000017500000001241510611704136015006 0ustar matjematje/* From openssh 4.3p2 filename openbsd-compat/fake-rfc2553.h */ /* * Copyright (C) 2000-2003 Damien Miller. All rights reserved. * Copyright (C) 1999 WIDE Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. Neither the name of the project nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ /* * Pseudo-implementation of RFC2553 name / address resolution functions * * But these functions are not implemented correctly. The minimum subset * is implemented for ssh use only. For example, this routine assumes * that ai_family is AF_INET. Don't use it for another purpose. */ #ifndef _FAKE_RFC2553_H #define _FAKE_RFC2553_H #include #include #include #include #include /* * First, socket and INET6 related definitions */ #ifndef HAVE_STRUCT_SOCKADDR_STORAGE # define _SS_MAXSIZE 128 /* Implementation specific max size */ # define _SS_PADSIZE (_SS_MAXSIZE - sizeof (struct sockaddr)) struct sockaddr_storage { struct sockaddr ss_sa; char __ss_pad2[_SS_PADSIZE]; }; # define ss_family ss_sa.sa_family #endif /* !HAVE_STRUCT_SOCKADDR_STORAGE */ #ifndef IN6_IS_ADDR_LOOPBACK # define IN6_IS_ADDR_LOOPBACK(a) \ (((uint32_t *)(a))[0] == 0 && ((uint32_t *)(a))[1] == 0 && \ ((uint32_t *)(a))[2] == 0 && ((uint32_t *)(a))[3] == htonl(1)) #endif /* !IN6_IS_ADDR_LOOPBACK */ #ifndef HAVE_STRUCT_IN6_ADDR struct in6_addr { uint8_t s6_addr[16]; }; #endif /* !HAVE_STRUCT_IN6_ADDR */ #ifndef HAVE_STRUCT_SOCKADDR_IN6 struct sockaddr_in6 { unsigned short sin6_family; uint16_t sin6_port; uint32_t sin6_flowinfo; struct in6_addr sin6_addr; }; #endif /* !HAVE_STRUCT_SOCKADDR_IN6 */ #ifndef AF_INET6 /* Define it to something that should never appear */ #define AF_INET6 AF_MAX #endif #ifndef PF_INET #define PF_INET AF_INET #endif #ifndef PF_INET6 #define PF_INET6 AF_INET6 #endif /* * Next, RFC2553 name / address resolution API */ #ifndef NI_NUMERICHOST # define NI_NUMERICHOST (1) #endif #ifndef NI_NAMEREQD # define NI_NAMEREQD (1<<1) #endif #ifndef NI_NUMERICSERV # define NI_NUMERICSERV (1<<2) #endif #ifndef AI_PASSIVE # define AI_PASSIVE (1) #endif #ifndef AI_CANONNAME # define AI_CANONNAME (1<<1) #endif #ifndef AI_NUMERICHOST # define AI_NUMERICHOST (1<<2) #endif #ifndef NI_MAXSERV # define NI_MAXSERV 32 #endif /* !NI_MAXSERV */ #ifndef NI_MAXHOST # define NI_MAXHOST 1025 #endif /* !NI_MAXHOST */ #ifndef INT_MAX #define INT_MAX 0xffffffff #endif #ifndef EAI_NODATA # define EAI_NODATA (INT_MAX - 1) #endif #ifndef EAI_MEMORY # define EAI_MEMORY (INT_MAX - 2) #endif #ifndef EAI_NONAME # define EAI_NONAME (INT_MAX - 3) #endif #ifndef EAI_SYSTEM # define EAI_SYSTEM (INT_MAX - 4) #endif #ifndef HAVE_STRUCT_ADDRINFO struct addrinfo { int ai_flags; /* AI_PASSIVE, AI_CANONNAME */ int ai_family; /* PF_xxx */ int ai_socktype; /* SOCK_xxx */ int ai_protocol; /* 0 or IPPROTO_xxx for IPv4 and IPv6 */ size_t ai_addrlen; /* length of ai_addr */ char *ai_canonname; /* canonical name for hostname */ struct sockaddr *ai_addr; /* binary address */ struct addrinfo *ai_next; /* next structure in linked list */ }; #endif /* !HAVE_STRUCT_ADDRINFO */ #ifndef HAVE_GETADDRINFO #ifdef getaddrinfo # undef getaddrinfo #endif #define getaddrinfo(a,b,c,d) (ssh_getaddrinfo(a,b,c,d)) int getaddrinfo(const char *, const char *, const struct addrinfo *, struct addrinfo **); #endif /* !HAVE_GETADDRINFO */ #if !defined(HAVE_GAI_STRERROR) && !defined(HAVE_CONST_GAI_STRERROR_PROTO) #define gai_strerror(a) (ssh_gai_strerror(a)) char *gai_strerror(int); #endif /* !HAVE_GAI_STRERROR */ #ifndef HAVE_FREEADDRINFO #define freeaddrinfo(a) (ssh_freeaddrinfo(a)) void freeaddrinfo(struct addrinfo *); #endif /* !HAVE_FREEADDRINFO */ #ifndef HAVE_GETNAMEINFO #define getnameinfo(a,b,c,d,e,f,g) (ssh_getnameinfo(a,b,c,d,e,f,g)) int getnameinfo(const struct sockaddr *, size_t, char *, size_t, char *, size_t, int); #endif /* !HAVE_GETNAMEINFO */ #endif /* !_FAKE_RFC2553_H */ nsd-3.2.16/compat/fake-rfc2553.c0000664000175000017500000001402710446231040014775 0ustar matjematje/* From openssh 4.3p2 filename openbsd-compat/fake-rfc2553.h */ /* * Copyright (C) 2000-2003 Damien Miller. All rights reserved. * Copyright (C) 1999 WIDE Project. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. Neither the name of the project nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. */ /* * Pseudo-implementation of RFC2553 name / address resolution functions * * But these functions are not implemented correctly. The minimum subset * is implemented for ssh use only. For example, this routine assumes * that ai_family is AF_INET. Don't use it for another purpose. */ #include #include #include #include #include "compat/fake-rfc2553.h" #ifndef HAVE_GETNAMEINFO int getnameinfo(const struct sockaddr *sa, size_t ATTR_UNUSED(salen), char *host, size_t hostlen, char *serv, size_t servlen, int flags) { struct sockaddr_in *sin = (struct sockaddr_in *)sa; struct hostent *hp; char tmpserv[16]; if (serv != NULL) { snprintf(tmpserv, sizeof(tmpserv), "%d", ntohs(sin->sin_port)); if (strlcpy(serv, tmpserv, servlen) >= servlen) return (EAI_MEMORY); } if (host != NULL) { if (flags & NI_NUMERICHOST) { if (strlcpy(host, inet_ntoa(sin->sin_addr), hostlen) >= hostlen) return (EAI_MEMORY); else return (0); } else { hp = gethostbyaddr((char *)&sin->sin_addr, sizeof(struct in_addr), AF_INET); if (hp == NULL) return (EAI_NODATA); if (strlcpy(host, hp->h_name, hostlen) >= hostlen) return (EAI_MEMORY); else return (0); } } return (0); } #endif /* !HAVE_GETNAMEINFO */ #ifndef HAVE_GAI_STRERROR #ifdef HAVE_CONST_GAI_STRERROR_PROTO const char * #else char * #endif gai_strerror(int err) { switch (err) { case EAI_NODATA: return ("no address associated with name"); case EAI_MEMORY: return ("memory allocation failure."); case EAI_NONAME: return ("nodename nor servname provided, or not known"); default: return ("unknown/invalid error."); } } #endif /* !HAVE_GAI_STRERROR */ #ifndef HAVE_FREEADDRINFO void freeaddrinfo(struct addrinfo *ai) { struct addrinfo *next; for(; ai != NULL;) { next = ai->ai_next; free(ai); ai = next; } } #endif /* !HAVE_FREEADDRINFO */ #ifndef HAVE_GETADDRINFO static struct addrinfo *malloc_ai(int port, u_long addr, const struct addrinfo *hints) { struct addrinfo *ai; ai = malloc(sizeof(*ai) + sizeof(struct sockaddr_in)); if (ai == NULL) return (NULL); memset(ai, '\0', sizeof(*ai) + sizeof(struct sockaddr_in)); ai->ai_addr = (struct sockaddr *)(ai + 1); /* XXX -- ssh doesn't use sa_len */ ai->ai_addrlen = sizeof(struct sockaddr_in); ai->ai_addr->sa_family = ai->ai_family = AF_INET; ((struct sockaddr_in *)(ai)->ai_addr)->sin_port = port; ((struct sockaddr_in *)(ai)->ai_addr)->sin_addr.s_addr = addr; /* XXX: the following is not generally correct, but does what we want */ if (hints->ai_socktype) ai->ai_socktype = hints->ai_socktype; else ai->ai_socktype = SOCK_STREAM; if (hints->ai_protocol) ai->ai_protocol = hints->ai_protocol; return (ai); } int getaddrinfo(const char *hostname, const char *servname, const struct addrinfo *hints, struct addrinfo **res) { struct hostent *hp; struct servent *sp; struct in_addr in; int i; long int port; u_long addr; port = 0; if (servname != NULL) { char *cp; port = strtol(servname, &cp, 10); if (port > 0 && port <= 65535 && *cp == '\0') port = htons(port); else if ((sp = getservbyname(servname, NULL)) != NULL) port = sp->s_port; else port = 0; } if (hints && hints->ai_flags & AI_PASSIVE) { addr = htonl(0x00000000); if (hostname && inet_aton(hostname, &in) != 0) addr = in.s_addr; *res = malloc_ai(port, addr, hints); if (*res == NULL) return (EAI_MEMORY); return (0); } if (!hostname) { *res = malloc_ai(port, htonl(0x7f000001), hints); if (*res == NULL) return (EAI_MEMORY); return (0); } if (inet_aton(hostname, &in)) { *res = malloc_ai(port, in.s_addr, hints); if (*res == NULL) return (EAI_MEMORY); return (0); } /* Don't try DNS if AI_NUMERICHOST is set */ if (hints && hints->ai_flags & AI_NUMERICHOST) return (EAI_NONAME); hp = gethostbyname(hostname); if (hp && hp->h_name && hp->h_name[0] && hp->h_addr_list[0]) { struct addrinfo *cur, *prev; cur = prev = *res = NULL; for (i = 0; hp->h_addr_list[i]; i++) { struct in_addr *in = (struct in_addr *)hp->h_addr_list[i]; cur = malloc_ai(port, in->s_addr, hints); if (cur == NULL) { if (*res != NULL) freeaddrinfo(*res); return (EAI_MEMORY); } if (prev) prev->ai_next = cur; else *res = cur; prev = cur; } return (0); } return (EAI_NODATA); } #endif /* !HAVE_GETADDRINFO */ nsd-3.2.16/compat/inet_aton.c0000664000175000017500000001241011204253137014756 0ustar matjematje/* From openssh4.3p2 compat/inet_aton.c */ /* * Copyright (c) 1983, 1990, 1993 * The Regents of the University of California. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * - * Portions Copyright (c) 1993 by Digital Equipment Corporation. * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies, and that * the name of Digital Equipment Corporation not be used in advertising or * publicity pertaining to distribution of the document or software without * specific, written prior permission. * * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL DIGITAL EQUIPMENT * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. * - * --Copyright-- */ /* OPENBSD ORIGINAL: lib/libc/net/inet_addr.c */ #include #if !defined(HAVE_INET_ATON) #include #include #include #include #include #if 0 /* * Ascii internet address interpretation routine. * The value returned is in network order. */ in_addr_t inet_addr(const char *cp) { struct in_addr val; if (inet_aton(cp, &val)) return (val.s_addr); return (INADDR_NONE); } #endif /* * Check whether "cp" is a valid ascii representation * of an Internet address and convert to a binary address. * Returns 1 if the address is valid, 0 if not. * This replaces inet_addr, the return value from which * cannot distinguish between failure and a local broadcast address. */ int inet_aton(const char *cp, struct in_addr *addr) { uint32_t val; int base, n; char c; unsigned int parts[4]; unsigned int *pp = parts; c = *cp; for (;;) { /* * Collect number up to ``.''. * Values are specified as for C: * 0x=hex, 0=octal, isdigit=decimal. */ if (!isdigit((int)c)) return (0); val = 0; base = 10; if (c == '0') { c = *++cp; if (c == 'x' || c == 'X') base = 16, c = *++cp; else base = 8; } for (;;) { if (isascii((int)c) && isdigit((int)c)) { val = (val * base) + (c - '0'); c = *++cp; } else if (base == 16 && isascii((int)c) && isxdigit((int)c)) { val = (val << 4) | (c + 10 - (islower((int)c) ? 'a' : 'A')); c = *++cp; } else break; } if (c == '.') { /* * Internet format: * a.b.c.d * a.b.c (with c treated as 16 bits) * a.b (with b treated as 24 bits) */ if (pp >= parts + 3) return (0); *pp++ = val; c = *++cp; } else break; } /* * Check for trailing characters. */ if (c != '\0' && (!isascii((int)c) || !isspace((int)c))) return (0); /* * Concoct the address according to * the number of parts specified. */ n = pp - parts + 1; switch (n) { case 0: return (0); /* initial nondigit */ case 1: /* a -- 32 bits */ break; case 2: /* a.b -- 8.24 bits */ if ((val > 0xffffff) || (parts[0] > 0xff)) return (0); val |= parts[0] << 24; break; case 3: /* a.b.c -- 8.8.16 bits */ if ((val > 0xffff) || (parts[0] > 0xff) || (parts[1] > 0xff)) return (0); val |= (parts[0] << 24) | (parts[1] << 16); break; case 4: /* a.b.c.d -- 8.8.8.8 bits */ if ((val > 0xff) || (parts[0] > 0xff) || (parts[1] > 0xff) || (parts[2] > 0xff)) return (0); val |= (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8); break; } if (addr) addr->s_addr = htonl(val); return (1); } #endif /* !defined(HAVE_INET_ATON) */ nsd-3.2.16/compat/b64_pton.c0000664000175000017500000002631411652001467014445 0ustar matjematje/* * Copyright (c) 1996, 1998 by Internet Software Consortium. * * Permission to use, copy, modify, and distribute this software for any * purpose with or without fee is hereby granted, provided that the above * copyright notice and this permission notice appear in all copies. * * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS * SOFTWARE. */ /* * Portions Copyright (c) 1995 by International Business Machines, Inc. * * International Business Machines, Inc. (hereinafter called IBM) grants * permission under its copyrights to use, copy, modify, and distribute this * Software with or without fee, provided that the above copyright notice and * all paragraphs of this notice appear in all copies, and that the name of IBM * not be used in connection with the marketing of any product incorporating * the Software or modifications thereof, without specific, written prior * permission. * * To the extent it has a right to do so, IBM grants an immunity from suit * under its patents, if any, for the use, sale or manufacture of products to * the extent that such products are used for performing Domain Name System * dynamic updates in TCP/IP networks by means of the Software. No immunity is * granted for any product per se or for any other function of any product. * * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES, * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A * PARTICULAR PURPOSE. IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL, * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. */ #include #include #include #include #include #include #include #include #include #include #define Assert(Cond) if (!(Cond)) abort() static const char Base64[] = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; static const char Pad64 = '='; /* (From RFC1521 and draft-ietf-dnssec-secext-03.txt) The following encoding technique is taken from RFC 1521 by Borenstein and Freed. It is reproduced here in a slightly edited form for convenience. A 65-character subset of US-ASCII is used, enabling 6 bits to be represented per printable character. (The extra 65th character, "=", is used to signify a special processing function.) The encoding process represents 24-bit groups of input bits as output strings of 4 encoded characters. Proceeding from left to right, a 24-bit input group is formed by concatenating 3 8-bit input groups. These 24 bits are then treated as 4 concatenated 6-bit groups, each of which is translated into a single digit in the base64 alphabet. Each 6-bit group is used as an index into an array of 64 printable characters. The character referenced by the index is placed in the output string. Table 1: The Base64 Alphabet Value Encoding Value Encoding Value Encoding Value Encoding 0 A 17 R 34 i 51 z 1 B 18 S 35 j 52 0 2 C 19 T 36 k 53 1 3 D 20 U 37 l 54 2 4 E 21 V 38 m 55 3 5 F 22 W 39 n 56 4 6 G 23 X 40 o 57 5 7 H 24 Y 41 p 58 6 8 I 25 Z 42 q 59 7 9 J 26 a 43 r 60 8 10 K 27 b 44 s 61 9 11 L 28 c 45 t 62 + 12 M 29 d 46 u 63 / 13 N 30 e 47 v 14 O 31 f 48 w (pad) = 15 P 32 g 49 x 16 Q 33 h 50 y Special processing is performed if fewer than 24 bits are available at the end of the data being encoded. A full encoding quantum is always completed at the end of a quantity. When fewer than 24 input bits are available in an input group, zero bits are added (on the right) to form an integral number of 6-bit groups. Padding at the end of the data is performed using the '=' character. Since all base64 input is an integral number of octets, only the ------------------------------------------------- following cases can arise: (1) the final quantum of encoding input is an integral multiple of 24 bits; here, the final unit of encoded output will be an integral multiple of 4 characters with no "=" padding, (2) the final quantum of encoding input is exactly 8 bits; here, the final unit of encoded output will be two characters followed by two "=" padding characters, or (3) the final quantum of encoding input is exactly 16 bits; here, the final unit of encoded output will be three characters followed by one "=" padding character. */ /* skips all whitespace anywhere. converts characters, four at a time, starting at (or after) src from base - 64 numbers into three 8 bit bytes in the target area. it returns the number of data bytes stored at the target, or -1 on error. */ static int b64rmap_initialized = 0; static uint8_t b64rmap[256]; static const uint8_t b64rmap_special = 0xf0; static const uint8_t b64rmap_end = 0xfd; static const uint8_t b64rmap_space = 0xfe; static const uint8_t b64rmap_invalid = 0xff; /** * Initializing the reverse map is not thread safe. * Which is fine for NSD. For now... **/ static void b64_initialize_rmap () { int i; char ch; /* Null: end of string, stop parsing */ b64rmap[0] = b64rmap_end; for (i = 1; i < 256; ++i) { ch = (char)i; /* Whitespaces */ if (isspace(ch)) b64rmap[i] = b64rmap_space; /* Padding: stop parsing */ else if (ch == Pad64) b64rmap[i] = b64rmap_end; /* Non-base64 char */ else b64rmap[i] = b64rmap_invalid; } /* Fill reverse mapping for base64 chars */ for (i = 0; Base64[i] != '\0'; ++i) b64rmap[(uint8_t)Base64[i]] = i; b64rmap_initialized = 1; } static int b64_pton_do(char const *src, uint8_t *target, size_t targsize) { int tarindex, state, ch; uint8_t ofs; state = 0; tarindex = 0; while (1) { ch = *src++; ofs = b64rmap[ch]; if (ofs >= b64rmap_special) { /* Ignore whitespaces */ if (ofs == b64rmap_space) continue; /* End of base64 characters */ if (ofs == b64rmap_end) break; /* A non-base64 character. */ return (-1); } switch (state) { case 0: if ((size_t)tarindex >= targsize) return (-1); target[tarindex] = ofs << 2; state = 1; break; case 1: if ((size_t)tarindex + 1 >= targsize) return (-1); target[tarindex] |= ofs >> 4; target[tarindex+1] = (ofs & 0x0f) << 4 ; tarindex++; state = 2; break; case 2: if ((size_t)tarindex + 1 >= targsize) return (-1); target[tarindex] |= ofs >> 2; target[tarindex+1] = (ofs & 0x03) << 6; tarindex++; state = 3; break; case 3: if ((size_t)tarindex >= targsize) return (-1); target[tarindex] |= ofs; tarindex++; state = 0; break; default: abort(); } } /* * We are done decoding Base-64 chars. Let's see if we ended * on a byte boundary, and/or with erroneous trailing characters. */ if (ch == Pad64) { /* We got a pad char. */ ch = *src++; /* Skip it, get next. */ switch (state) { case 0: /* Invalid = in first position */ case 1: /* Invalid = in second position */ return (-1); case 2: /* Valid, means one byte of info */ /* Skip any number of spaces. */ for ((void)NULL; ch != '\0'; ch = *src++) if (b64rmap[ch] != b64rmap_space) break; /* Make sure there is another trailing = sign. */ if (ch != Pad64) return (-1); ch = *src++; /* Skip the = */ /* Fall through to "single trailing =" case. */ /* FALLTHROUGH */ case 3: /* Valid, means two bytes of info */ /* * We know this char is an =. Is there anything but * whitespace after it? */ for ((void)NULL; ch != '\0'; ch = *src++) if (b64rmap[ch] != b64rmap_space) return (-1); /* * Now make sure for cases 2 and 3 that the "extra" * bits that slopped past the last full byte were * zeros. If we don't check them, they become a * subliminal channel. */ if (target[tarindex] != 0) return (-1); } } else { /* * We ended by seeing the end of the string. Make sure we * have no partial bytes lying around. */ if (state != 0) return (-1); } return (tarindex); } static int b64_pton_len(char const *src) { int tarindex, state, ch; uint8_t ofs; state = 0; tarindex = 0; while (1) { ch = *src++; ofs = b64rmap[ch]; if (ofs >= b64rmap_special) { /* Ignore whitespaces */ if (ofs == b64rmap_space) continue; /* End of base64 characters */ if (ofs == b64rmap_end) break; /* A non-base64 character. */ return (-1); } switch (state) { case 0: state = 1; break; case 1: tarindex++; state = 2; break; case 2: tarindex++; state = 3; break; case 3: tarindex++; state = 0; break; default: abort(); } } /* * We are done decoding Base-64 chars. Let's see if we ended * on a byte boundary, and/or with erroneous trailing characters. */ if (ch == Pad64) { /* We got a pad char. */ ch = *src++; /* Skip it, get next. */ switch (state) { case 0: /* Invalid = in first position */ case 1: /* Invalid = in second position */ return (-1); case 2: /* Valid, means one byte of info */ /* Skip any number of spaces. */ for ((void)NULL; ch != '\0'; ch = *src++) if (b64rmap[ch] != b64rmap_space) break; /* Make sure there is another trailing = sign. */ if (ch != Pad64) return (-1); ch = *src++; /* Skip the = */ /* Fall through to "single trailing =" case. */ /* FALLTHROUGH */ case 3: /* Valid, means two bytes of info */ /* * We know this char is an =. Is there anything but * whitespace after it? */ for ((void)NULL; ch != '\0'; ch = *src++) if (b64rmap[ch] != b64rmap_space) return (-1); } } else { /* * We ended by seeing the end of the string. Make sure we * have no partial bytes lying around. */ if (state != 0) return (-1); } return (tarindex); } int b64_pton(char const *src, uint8_t *target, size_t targsize) { if (!b64rmap_initialized) b64_initialize_rmap (); if (target) return b64_pton_do (src, target, targsize); else return b64_pton_len (src); } nsd-3.2.16/configparser.y0000664000175000017500000004213712160051362014232 0ustar matjematje/* * configparser.y -- yacc grammar for NSD configuration files * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ %{ #include "config.h" #include #include #include #include #include #include "options.h" #include "util.h" #include "rrl.h" #include "configyyrename.h" int c_lex(void); void c_error(const char *message); #ifdef __cplusplus extern "C" #endif /* __cplusplus */ /* these need to be global, otherwise they cannot be used inside yacc */ extern config_parser_state_t* cfg_parser; static int server_settings_seen = 0; #if 0 #define OUTYY(s) printf s /* used ONLY when debugging */ #else #define OUTYY(s) #endif %} %union { char* str; } %token SPACE LETTER NEWLINE COMMENT COLON ANY ZONESTR %token STRING %token VAR_SERVER VAR_NAME VAR_IP_ADDRESS VAR_IP_TRANSPARENT VAR_DEBUG_MODE %token VAR_IP4_ONLY VAR_IP6_ONLY VAR_DATABASE VAR_IDENTITY VAR_NSID VAR_LOGFILE %token VAR_SERVER_COUNT VAR_TCP_COUNT VAR_PIDFILE VAR_PORT VAR_STATISTICS %token VAR_ZONESTATSFILE VAR_CHROOT VAR_USERNAME VAR_ZONESDIR %token VAR_XFRDFILE VAR_DIFFFILE %token VAR_XFRD_RELOAD_TIMEOUT VAR_TCP_QUERY_COUNT VAR_TCP_TIMEOUT %token VAR_IPV4_EDNS_SIZE VAR_IPV6_EDNS_SIZE %token VAR_ZONEFILE %token VAR_ZONE %token VAR_ALLOW_NOTIFY VAR_REQUEST_XFR VAR_NOTIFY VAR_PROVIDE_XFR %token VAR_NOTIFY_RETRY VAR_OUTGOING_INTERFACE VAR_ALLOW_AXFR_FALLBACK %token VAR_KEY %token VAR_ALGORITHM VAR_SECRET %token VAR_AXFR VAR_UDP %token VAR_VERBOSITY VAR_HIDE_VERSION %token VAR_RRL_SIZE VAR_RRL_RATELIMIT VAR_RRL_SLIP %token VAR_RRL_IPV4_PREFIX_LENGTH VAR_RRL_IPV6_PREFIX_LENGTH %token VAR_RRL_WHITELIST_RATELIMIT VAR_RRL_WHITELIST %% toplevelvars: /* empty */ | toplevelvars toplevelvar ; toplevelvar: serverstart contents_server | zonestart contents_zone | keystart contents_key; /* server: declaration */ serverstart: VAR_SERVER { OUTYY(("\nP(server:)\n")); if(server_settings_seen) { yyerror("duplicate server: element."); } server_settings_seen = 1; } ; contents_server: contents_server content_server | ; content_server: server_ip_address | server_ip_transparent | server_debug_mode | server_ip4_only | server_ip6_only | server_database | server_identity | server_nsid | server_logfile | server_server_count | server_tcp_count | server_pidfile | server_port | server_statistics | server_zonestatsfile | server_chroot | server_username | server_zonesdir | server_difffile | server_xfrdfile | server_xfrd_reload_timeout | server_tcp_query_count | server_tcp_timeout | server_ipv4_edns_size | server_ipv6_edns_size | server_verbosity | server_hide_version | server_rrl_size | server_rrl_ratelimit | server_rrl_slip | server_rrl_ipv4_prefix_length | server_rrl_ipv6_prefix_length | server_rrl_whitelist_ratelimit; server_ip_address: VAR_IP_ADDRESS STRING { OUTYY(("P(server_ip_address:%s)\n", $2)); if(cfg_parser->current_ip_address_option) { cfg_parser->current_ip_address_option->next = (ip_address_option_t*)region_alloc( cfg_parser->opt->region, sizeof(ip_address_option_t)); cfg_parser->current_ip_address_option = cfg_parser->current_ip_address_option->next; cfg_parser->current_ip_address_option->next=0; } else { cfg_parser->current_ip_address_option = (ip_address_option_t*)region_alloc( cfg_parser->opt->region, sizeof(ip_address_option_t)); cfg_parser->current_ip_address_option->next=0; cfg_parser->opt->ip_addresses = cfg_parser->current_ip_address_option; } cfg_parser->current_ip_address_option->address = region_strdup(cfg_parser->opt->region, $2); } ; server_ip_transparent: VAR_IP_TRANSPARENT STRING { OUTYY(("P(server_ip_transparent:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); else cfg_parser->opt->ip_transparent = (strcmp($2, "yes")==0); } ; server_debug_mode: VAR_DEBUG_MODE STRING { OUTYY(("P(server_debug_mode:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); else cfg_parser->opt->debug_mode = (strcmp($2, "yes")==0); } ; server_verbosity: VAR_VERBOSITY STRING { OUTYY(("P(server_verbosity:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); else cfg_parser->opt->verbosity = atoi($2); } ; server_hide_version: VAR_HIDE_VERSION STRING { OUTYY(("P(server_hide_version:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); else cfg_parser->opt->hide_version = (strcmp($2, "yes")==0); } ; server_ip4_only: VAR_IP4_ONLY STRING { OUTYY(("P(server_ip4_only:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); else cfg_parser->opt->ip4_only = (strcmp($2, "yes")==0); } ; server_ip6_only: VAR_IP6_ONLY STRING { OUTYY(("P(server_ip6_only:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); else cfg_parser->opt->ip6_only = (strcmp($2, "yes")==0); } ; server_database: VAR_DATABASE STRING { OUTYY(("P(server_database:%s)\n", $2)); cfg_parser->opt->database = region_strdup(cfg_parser->opt->region, $2); } ; server_identity: VAR_IDENTITY STRING { OUTYY(("P(server_identity:%s)\n", $2)); cfg_parser->opt->identity = region_strdup(cfg_parser->opt->region, $2); } ; server_nsid: VAR_NSID STRING { unsigned char* nsid = 0; uint16_t nsid_len = 0; OUTYY(("P(server_nsid:%s)\n", $2)); if (strlen($2) % 2 != 0) { yyerror("the NSID must be a hex string of an even length."); } else { nsid_len = strlen($2) / 2; nsid = xalloc(nsid_len); if (hex_pton($2, nsid, nsid_len) == -1) yyerror("hex string cannot be parsed in NSID."); else cfg_parser->opt->nsid = region_strdup(cfg_parser->opt->region, $2); free(nsid); } } ; server_logfile: VAR_LOGFILE STRING { OUTYY(("P(server_logfile:%s)\n", $2)); cfg_parser->opt->logfile = region_strdup(cfg_parser->opt->region, $2); } ; server_server_count: VAR_SERVER_COUNT STRING { OUTYY(("P(server_server_count:%s)\n", $2)); if(atoi($2) <= 0) yyerror("number greater than zero expected"); else cfg_parser->opt->server_count = atoi($2); } ; server_tcp_count: VAR_TCP_COUNT STRING { OUTYY(("P(server_tcp_count:%s)\n", $2)); if(atoi($2) <= 0) yyerror("number greater than zero expected"); else cfg_parser->opt->tcp_count = atoi($2); } ; server_pidfile: VAR_PIDFILE STRING { OUTYY(("P(server_pidfile:%s)\n", $2)); cfg_parser->opt->pidfile = region_strdup(cfg_parser->opt->region, $2); } ; server_port: VAR_PORT STRING { OUTYY(("P(server_port:%s)\n", $2)); cfg_parser->opt->port = region_strdup(cfg_parser->opt->region, $2); } ; server_statistics: VAR_STATISTICS STRING { OUTYY(("P(server_statistics:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); else cfg_parser->opt->statistics = atoi($2); } ; server_zonestatsfile: VAR_ZONESTATSFILE STRING { OUTYY(("P(server_zonestatsfile:%s)\n", $2)); cfg_parser->opt->zonestatsfile = region_strdup(cfg_parser->opt->region, $2); } ; server_chroot: VAR_CHROOT STRING { OUTYY(("P(server_chroot:%s)\n", $2)); cfg_parser->opt->chroot = region_strdup(cfg_parser->opt->region, $2); } ; server_username: VAR_USERNAME STRING { OUTYY(("P(server_username:%s)\n", $2)); cfg_parser->opt->username = region_strdup(cfg_parser->opt->region, $2); } ; server_zonesdir: VAR_ZONESDIR STRING { OUTYY(("P(server_zonesdir:%s)\n", $2)); cfg_parser->opt->zonesdir = region_strdup(cfg_parser->opt->region, $2); } ; server_difffile: VAR_DIFFFILE STRING { OUTYY(("P(server_difffile:%s)\n", $2)); cfg_parser->opt->difffile = region_strdup(cfg_parser->opt->region, $2); } ; server_xfrdfile: VAR_XFRDFILE STRING { OUTYY(("P(server_xfrdfile:%s)\n", $2)); cfg_parser->opt->xfrdfile = region_strdup(cfg_parser->opt->region, $2); } ; server_xfrd_reload_timeout: VAR_XFRD_RELOAD_TIMEOUT STRING { OUTYY(("P(server_xfrd_reload_timeout:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); cfg_parser->opt->xfrd_reload_timeout = atoi($2); } ; server_tcp_query_count: VAR_TCP_QUERY_COUNT STRING { OUTYY(("P(server_tcp_query_count:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); cfg_parser->opt->tcp_query_count = atoi($2); } ; server_tcp_timeout: VAR_TCP_TIMEOUT STRING { OUTYY(("P(server_tcp_timeout:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); cfg_parser->opt->tcp_timeout = atoi($2); } ; server_ipv4_edns_size: VAR_IPV4_EDNS_SIZE STRING { OUTYY(("P(server_ipv4_edns_size:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); cfg_parser->opt->ipv4_edns_size = atoi($2); } ; server_ipv6_edns_size: VAR_IPV6_EDNS_SIZE STRING { OUTYY(("P(server_ipv6_edns_size:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); cfg_parser->opt->ipv6_edns_size = atoi($2); } ; server_rrl_size: VAR_RRL_SIZE STRING { OUTYY(("P(server_rrl_size:%s)\n", $2)); #ifdef RATELIMIT if(atoi($2) <= 0) yyerror("number greater than zero expected"); cfg_parser->opt->rrl_size = atoi($2); #endif } ; server_rrl_ratelimit: VAR_RRL_RATELIMIT STRING { OUTYY(("P(server_rrl_ratelimit:%s)\n", $2)); #ifdef RATELIMIT cfg_parser->opt->rrl_ratelimit = atoi($2); #endif } ; server_rrl_slip: VAR_RRL_SLIP STRING { OUTYY(("P(server_rrl_slip:%s)\n", $2)); #ifdef RATELIMIT if(atoi($2) < 0) yyerror("number equal or greater than zero expected"); cfg_parser->opt->rrl_slip = atoi($2); #endif } ; server_rrl_ipv4_prefix_length: VAR_RRL_IPV4_PREFIX_LENGTH STRING { OUTYY(("P(server_rrl_ipv4_prefix_length:%s)\n", $2)); #ifdef RATELIMIT if(atoi($2) < 0 || atoi($2) > 32) yyerror("invalid IPv4 prefix length"); cfg_parser->opt->rrl_ipv4_prefix_length = atoi($2); #endif } ; server_rrl_ipv6_prefix_length: VAR_RRL_IPV6_PREFIX_LENGTH STRING { OUTYY(("P(server_rrl_ipv6_prefix_length:%s)\n", $2)); #ifdef RATELIMIT if(atoi($2) < 0 || atoi($2) > 64) yyerror("invalid IPv6 prefix length"); cfg_parser->opt->rrl_ipv6_prefix_length = atoi($2); #endif } ; server_rrl_whitelist_ratelimit: VAR_RRL_WHITELIST_RATELIMIT STRING { OUTYY(("P(server_rrl_whitelist_ratelimit:%s)\n", $2)); #ifdef RATELIMIT cfg_parser->opt->rrl_whitelist_ratelimit = atoi($2); #endif } ; /* zone: declaration */ zonestart: VAR_ZONE { OUTYY(("\nP(zone:)\n")); if(cfg_parser->current_zone) { if(!cfg_parser->current_zone->name) c_error("previous zone has no name"); else { if(!nsd_options_insert_zone(cfg_parser->opt, cfg_parser->current_zone)) c_error("duplicate zone"); } if(!cfg_parser->current_zone->zonefile) c_error("previous zone has no zonefile"); } cfg_parser->current_zone = zone_options_create(cfg_parser->opt->region); cfg_parser->current_allow_notify = 0; cfg_parser->current_request_xfr = 0; cfg_parser->current_notify = 0; cfg_parser->current_provide_xfr = 0; cfg_parser->current_outgoing_interface = 0; } ; contents_zone: contents_zone content_zone | content_zone; content_zone: zone_name | zone_zonefile | zone_allow_notify | zone_request_xfr | zone_notify | zone_notify_retry | zone_provide_xfr | zone_outgoing_interface | zone_allow_axfr_fallback | zone_rrl_whitelist; zone_name: VAR_NAME STRING { OUTYY(("P(zone_name:%s)\n", $2)); #ifndef NDEBUG assert(cfg_parser->current_zone); #endif cfg_parser->current_zone->name = region_strdup(cfg_parser->opt->region, $2); } ; zone_zonefile: VAR_ZONEFILE STRING { OUTYY(("P(zone_zonefile:%s)\n", $2)); #ifndef NDEBUG assert(cfg_parser->current_zone); #endif cfg_parser->current_zone->zonefile = region_strdup(cfg_parser->opt->region, $2); } ; zone_allow_notify: VAR_ALLOW_NOTIFY STRING STRING { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, $2, $3); OUTYY(("P(zone_allow_notify:%s %s)\n", $2, $3)); if(cfg_parser->current_allow_notify) cfg_parser->current_allow_notify->next = acl; else cfg_parser->current_zone->allow_notify = acl; cfg_parser->current_allow_notify = acl; } ; zone_request_xfr: VAR_REQUEST_XFR zone_request_xfr_data { } ; zone_request_xfr_data: STRING STRING { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, $1, $2); OUTYY(("P(zone_request_xfr:%s %s)\n", $1, $2)); if(acl->blocked) c_error("blocked address used for request-xfr"); if(acl->rangetype!=acl_range_single) c_error("address range used for request-xfr"); if(cfg_parser->current_request_xfr) cfg_parser->current_request_xfr->next = acl; else cfg_parser->current_zone->request_xfr = acl; cfg_parser->current_request_xfr = acl; } | VAR_AXFR STRING STRING { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, $2, $3); acl->use_axfr_only = 1; OUTYY(("P(zone_request_xfr:%s %s)\n", $2, $3)); if(acl->blocked) c_error("blocked address used for request-xfr"); if(acl->rangetype!=acl_range_single) c_error("address range used for request-xfr"); if(cfg_parser->current_request_xfr) cfg_parser->current_request_xfr->next = acl; else cfg_parser->current_zone->request_xfr = acl; cfg_parser->current_request_xfr = acl; } | VAR_UDP STRING STRING { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, $2, $3); acl->allow_udp = 1; OUTYY(("P(zone_request_xfr:%s %s)\n", $2, $3)); if(acl->blocked) c_error("blocked address used for request-xfr"); if(acl->rangetype!=acl_range_single) c_error("address range used for request-xfr"); if(cfg_parser->current_request_xfr) cfg_parser->current_request_xfr->next = acl; else cfg_parser->current_zone->request_xfr = acl; cfg_parser->current_request_xfr = acl; } ; zone_notify: VAR_NOTIFY STRING STRING { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, $2, $3); OUTYY(("P(zone_notify:%s %s)\n", $2, $3)); if(acl->blocked) c_error("blocked address used for notify"); if(acl->rangetype!=acl_range_single) c_error("address range used for notify"); if(cfg_parser->current_notify) cfg_parser->current_notify->next = acl; else cfg_parser->current_zone->notify = acl; cfg_parser->current_notify = acl; } ; zone_notify_retry: VAR_NOTIFY_RETRY STRING { OUTYY(("P(zone_notify_retry:%s)\n", $2)); if(atoi($2) == 0 && strcmp($2, "0") != 0) yyerror("number expected"); else cfg_parser->current_zone->notify_retry = atoi($2); } ; zone_provide_xfr: VAR_PROVIDE_XFR STRING STRING { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, $2, $3); OUTYY(("P(zone_provide_xfr:%s %s)\n", $2, $3)); if(cfg_parser->current_provide_xfr) cfg_parser->current_provide_xfr->next = acl; else cfg_parser->current_zone->provide_xfr = acl; cfg_parser->current_provide_xfr = acl; } ; zone_outgoing_interface: VAR_OUTGOING_INTERFACE STRING { acl_options_t* acl = parse_acl_info(cfg_parser->opt->region, $2, "NOKEY"); OUTYY(("P(zone_outgoing_interface:%s)\n", $2)); if(acl->rangetype!=acl_range_single) c_error("address range used for outgoing interface"); if(cfg_parser->current_outgoing_interface) cfg_parser->current_outgoing_interface->next = acl; else cfg_parser->current_zone->outgoing_interface = acl; cfg_parser->current_outgoing_interface = acl; } ; zone_allow_axfr_fallback: VAR_ALLOW_AXFR_FALLBACK STRING { OUTYY(("P(zone_allow_axfr_fallback:%s)\n", $2)); if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0) yyerror("expected yes or no."); else cfg_parser->current_zone->allow_axfr_fallback = (strcmp($2, "yes")==0); } ; zone_rrl_whitelist: VAR_RRL_WHITELIST STRING { OUTYY(("P(zone_rrl_whitelist:%s)\n", $2)); #ifdef RATELIMIT cfg_parser->current_zone->rrl_whitelist |= rrlstr2type($2); #endif } ; /* key: declaration */ keystart: VAR_KEY { OUTYY(("\nP(key:)\n")); if(cfg_parser->current_key) { if(!cfg_parser->current_key->name) c_error("previous key has no name"); if(!cfg_parser->current_key->algorithm) c_error("previous key has no algorithm"); if(!cfg_parser->current_key->secret) c_error("previous key has no secret blob"); cfg_parser->current_key->next = key_options_create(cfg_parser->opt->region); cfg_parser->current_key = cfg_parser->current_key->next; } else { cfg_parser->current_key = key_options_create(cfg_parser->opt->region); cfg_parser->opt->keys = cfg_parser->current_key; } cfg_parser->opt->numkeys++; } ; contents_key: contents_key content_key | content_key; content_key: key_name | key_algorithm | key_secret; key_name: VAR_NAME STRING { OUTYY(("P(key_name:%s)\n", $2)); #ifndef NDEBUG assert(cfg_parser->current_key); #endif cfg_parser->current_key->name = region_strdup(cfg_parser->opt->region, $2); } ; key_algorithm: VAR_ALGORITHM STRING { OUTYY(("P(key_algorithm:%s)\n", $2)); #ifndef NDEBUG assert(cfg_parser->current_key); #endif cfg_parser->current_key->algorithm = region_strdup(cfg_parser->opt->region, $2); } ; key_secret: VAR_SECRET STRING { OUTYY(("key_secret:%s)\n", $2)); #ifndef NDEBUG assert(cfg_parser->current_key); #endif cfg_parser->current_key->secret = region_strdup(cfg_parser->opt->region, $2); } ; %% /* parse helper routines could be here */ nsd-3.2.16/lookup3.c0000664000175000017500000010623112124276505013122 0ustar matjematje/* February 2013(Matthijs) patch defines for BSD endianness, from Brad Smith. January 2012(Wouter) added randomised initial value, fallout from 28c3. March 2007(Wouter) adapted from lookup3.c original, add config.h include. added #ifdef VALGRIND to remove 298,384,660 'unused variable k8' warnings. added include of lookup3.h to check definitions match declarations. removed include of stdint - config.h takes care of platform independence. url http://burtleburtle.net/bob/hash/index.html. */ /* ------------------------------------------------------------------------------- lookup3.c, by Bob Jenkins, May 2006, Public Domain. These are functions for producing 32-bit hashes for hash table lookup. hashword(), hashlittle(), hashlittle2(), hashbig(), mix(), and final() are externally useful functions. Routines to test the hash are included if SELF_TEST is defined. You can use this free for any purpose. It's in the public domain. It has no warranty. You probably want to use hashlittle(). hashlittle() and hashbig() hash byte arrays. hashlittle() is is faster than hashbig() on little-endian machines. Intel and AMD are little-endian machines. On second thought, you probably want hashlittle2(), which is identical to hashlittle() except it returns two 32-bit hashes for the price of one. You could implement hashbig2() if you wanted but I haven't bothered here. If you want to find a hash of, say, exactly 7 integers, do a = i1; b = i2; c = i3; mix(a,b,c); a += i4; b += i5; c += i6; mix(a,b,c); a += i7; final(a,b,c); then use c as the hash value. If you have a variable length array of 4-byte integers to hash, use hashword(). If you have a byte array (like a character string), use hashlittle(). If you have several byte arrays, or a mix of things, see the comments above hashlittle(). Why is this so big? I read 12 bytes at a time into 3 4-byte integers, then mix those integers. This is fast (you can do a lot more thorough mixing with 12*3 instructions on 3 integers than you can with 3 instructions on 1 byte), but shoehorning those bytes into integers efficiently is messy. ------------------------------------------------------------------------------- */ /*#define SELF_TEST 1*/ #include "config.h" #include "lookup3.h" #include /* defines printf for tests */ #include /* defines time_t for timings in the test */ /*#include defines uint32_t etc (from config.h) */ #include /* attempt to define endianness */ #ifdef HAVE_SYS_TYPES_H # include /* attempt to define endianness (solaris) */ #endif #ifdef linux # include /* attempt to define endianness */ #endif #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__DragonFly__) #include /* attempt to define endianness */ #endif #ifdef __OpenBSD__ #include /* attempt to define endianness */ #endif /* random initial value */ static uint32_t raninit = 0xdeadbeef; void hash_set_raninit(uint32_t v) { raninit = v; } /* * My best guess at if you are big-endian or little-endian. This may * need adjustment. */ #if (defined(__BYTE_ORDER) && defined(__LITTLE_ENDIAN) && \ __BYTE_ORDER == __LITTLE_ENDIAN) || \ (defined(i386) || defined(__i386__) || defined(__i486__) || \ defined(__i586__) || defined(__i686__) || defined(vax) || defined(MIPSEL) || defined(__x86)) # define HASH_LITTLE_ENDIAN 1 # define HASH_BIG_ENDIAN 0 #elif (defined(__BYTE_ORDER) && defined(__BIG_ENDIAN) && \ __BYTE_ORDER == __BIG_ENDIAN) || \ (defined(sparc) || defined(__sparc) || defined(__sparc__) || defined(POWERPC) || defined(mc68000) || defined(sel)) # define HASH_LITTLE_ENDIAN 0 # define HASH_BIG_ENDIAN 1 #elif defined(_MACHINE_ENDIAN_H_) /* test for machine_endian_h protects failure if some are empty strings */ # if defined(_BYTE_ORDER) && defined(_BIG_ENDIAN) && _BYTE_ORDER == _BIG_ENDIAN # define HASH_LITTLE_ENDIAN 0 # define HASH_BIG_ENDIAN 1 # endif # if defined(_BYTE_ORDER) && defined(_LITTLE_ENDIAN) && _BYTE_ORDER == _LITTLE_ENDIAN # define HASH_LITTLE_ENDIAN 1 # define HASH_BIG_ENDIAN 0 # endif /* _MACHINE_ENDIAN_H_ */ #else # define HASH_LITTLE_ENDIAN 0 # define HASH_BIG_ENDIAN 0 #endif #define hashsize(n) ((uint32_t)1<<(n)) #define hashmask(n) (hashsize(n)-1) #define rot(x,k) (((x)<<(k)) | ((x)>>(32-(k)))) /* ------------------------------------------------------------------------------- mix -- mix 3 32-bit values reversibly. This is reversible, so any information in (a,b,c) before mix() is still in (a,b,c) after mix(). If four pairs of (a,b,c) inputs are run through mix(), or through mix() in reverse, there are at least 32 bits of the output that are sometimes the same for one pair and different for another pair. This was tested for: * pairs that differed by one bit, by two bits, in any combination of top bits of (a,b,c), or in any combination of bottom bits of (a,b,c). * "differ" is defined as +, -, ^, or ~^. For + and -, I transformed the output delta to a Gray code (a^(a>>1)) so a string of 1's (as is commonly produced by subtraction) look like a single 1-bit difference. * the base values were pseudorandom, all zero but one bit set, or all zero plus a counter that starts at zero. Some k values for my "a-=c; a^=rot(c,k); c+=b;" arrangement that satisfy this are 4 6 8 16 19 4 9 15 3 18 27 15 14 9 3 7 17 3 Well, "9 15 3 18 27 15" didn't quite get 32 bits diffing for "differ" defined as + with a one-bit base and a two-bit delta. I used http://burtleburtle.net/bob/hash/avalanche.html to choose the operations, constants, and arrangements of the variables. This does not achieve avalanche. There are input bits of (a,b,c) that fail to affect some output bits of (a,b,c), especially of a. The most thoroughly mixed value is c, but it doesn't really even achieve avalanche in c. This allows some parallelism. Read-after-writes are good at doubling the number of bits affected, so the goal of mixing pulls in the opposite direction as the goal of parallelism. I did what I could. Rotates seem to cost as much as shifts on every machine I could lay my hands on, and rotates are much kinder to the top and bottom bits, so I used rotates. ------------------------------------------------------------------------------- */ #define mix(a,b,c) \ { \ a -= c; a ^= rot(c, 4); c += b; \ b -= a; b ^= rot(a, 6); a += c; \ c -= b; c ^= rot(b, 8); b += a; \ a -= c; a ^= rot(c,16); c += b; \ b -= a; b ^= rot(a,19); a += c; \ c -= b; c ^= rot(b, 4); b += a; \ } /* ------------------------------------------------------------------------------- final -- final mixing of 3 32-bit values (a,b,c) into c Pairs of (a,b,c) values differing in only a few bits will usually produce values of c that look totally different. This was tested for * pairs that differed by one bit, by two bits, in any combination of top bits of (a,b,c), or in any combination of bottom bits of (a,b,c). * "differ" is defined as +, -, ^, or ~^. For + and -, I transformed the output delta to a Gray code (a^(a>>1)) so a string of 1's (as is commonly produced by subtraction) look like a single 1-bit difference. * the base values were pseudorandom, all zero but one bit set, or all zero plus a counter that starts at zero. These constants passed: 14 11 25 16 4 14 24 12 14 25 16 4 14 24 and these came close: 4 8 15 26 3 22 24 10 8 15 26 3 22 24 11 8 15 26 3 22 24 ------------------------------------------------------------------------------- */ #define final(a,b,c) \ { \ c ^= b; c -= rot(b,14); \ a ^= c; a -= rot(c,11); \ b ^= a; b -= rot(a,25); \ c ^= b; c -= rot(b,16); \ a ^= c; a -= rot(c,4); \ b ^= a; b -= rot(a,14); \ c ^= b; c -= rot(b,24); \ } /* -------------------------------------------------------------------- This works on all machines. To be useful, it requires -- that the key be an array of uint32_t's, and -- that the length be the number of uint32_t's in the key The function hashword() is identical to hashlittle() on little-endian machines, and identical to hashbig() on big-endian machines, except that the length has to be measured in uint32_ts rather than in bytes. hashlittle() is more complicated than hashword() only because hashlittle() has to dance around fitting the key bytes into registers. -------------------------------------------------------------------- */ uint32_t hashword( const uint32_t *k, /* the key, an array of uint32_t values */ size_t length, /* the length of the key, in uint32_ts */ uint32_t initval) /* the previous hash, or an arbitrary value */ { uint32_t a,b,c; /* Set up the internal state */ a = b = c = raninit + (((uint32_t)length)<<2) + initval; /*------------------------------------------------- handle most of the key */ while (length > 3) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 3; k += 3; } /*------------------------------------------- handle the last 3 uint32_t's */ switch(length) /* all the case statements fall through */ { case 3 : c+=k[2]; case 2 : b+=k[1]; case 1 : a+=k[0]; final(a,b,c); case 0: /* case 0: nothing left to add */ break; } /*------------------------------------------------------ report the result */ return c; } #ifdef SELF_TEST /* -------------------------------------------------------------------- hashword2() -- same as hashword(), but take two seeds and return two 32-bit values. pc and pb must both be nonnull, and *pc and *pb must both be initialized with seeds. If you pass in (*pb)==0, the output (*pc) will be the same as the return value from hashword(). -------------------------------------------------------------------- */ void hashword2 ( const uint32_t *k, /* the key, an array of uint32_t values */ size_t length, /* the length of the key, in uint32_ts */ uint32_t *pc, /* IN: seed OUT: primary hash value */ uint32_t *pb) /* IN: more seed OUT: secondary hash value */ { uint32_t a,b,c; /* Set up the internal state */ a = b = c = raninit + ((uint32_t)(length<<2)) + *pc; c += *pb; /*------------------------------------------------- handle most of the key */ while (length > 3) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 3; k += 3; } /*------------------------------------------- handle the last 3 uint32_t's */ switch(length) /* all the case statements fall through */ { case 3 : c+=k[2]; case 2 : b+=k[1]; case 1 : a+=k[0]; final(a,b,c); case 0: /* case 0: nothing left to add */ break; } /*------------------------------------------------------ report the result */ *pc=c; *pb=b; } #endif /* SELF_TEST */ /* ------------------------------------------------------------------------------- hashlittle() -- hash a variable-length key into a 32-bit value k : the key (the unaligned variable-length array of bytes) length : the length of the key, counting by bytes initval : can be any 4-byte value Returns a 32-bit value. Every bit of the key affects every bit of the return value. Two keys differing by one or two bits will have totally different hash values. The best hash table sizes are powers of 2. There is no need to do mod a prime (mod is sooo slow!). If you need less than 32 bits, use a bitmask. For example, if you need only 10 bits, do h = (h & hashmask(10)); In which case, the hash table should have hashsize(10) elements. If you are hashing n strings (uint8_t **)k, do it like this: for (i=0, h=0; i 12) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 12; k += 3; } /*----------------------------- handle the last (probably partial) block */ /* * "k[2]&0xffffff" actually reads beyond the end of the string, but * then masks off the part it's not allowed to read. Because the * string is aligned, the masked-off tail is in the same word as the * rest of the string. Every machine with memory protection I've seen * does it on word boundaries, so is OK with this. But VALGRIND will * still catch it and complain. The masking trick does make the hash * noticably faster for short strings (like English words). */ #ifndef VALGRIND switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break; case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break; case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break; case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=k[1]&0xffffff; a+=k[0]; break; case 6 : b+=k[1]&0xffff; a+=k[0]; break; case 5 : b+=k[1]&0xff; a+=k[0]; break; case 4 : a+=k[0]; break; case 3 : a+=k[0]&0xffffff; break; case 2 : a+=k[0]&0xffff; break; case 1 : a+=k[0]&0xff; break; case 0 : return c; /* zero length strings require no mixing */ } #else /* make valgrind happy */ k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=((uint32_t)k8[9])<<8; /* fall through */ case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=((uint32_t)k8[5])<<8; /* fall through */ case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]; break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=((uint32_t)k8[1])<<8; /* fall through */ case 1 : a+=k8[0]; break; case 0 : return c; } #endif /* !valgrind */ } else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) { const uint16_t *k = (const uint16_t *)key; /* read 16-bit chunks */ const uint8_t *k8; /*--------------- all but last block: aligned reads and different mixing */ while (length > 12) { a += k[0] + (((uint32_t)k[1])<<16); b += k[2] + (((uint32_t)k[3])<<16); c += k[4] + (((uint32_t)k[5])<<16); mix(a,b,c); length -= 12; k += 6; } /*----------------------------- handle the last (probably partial) block */ k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[4]+(((uint32_t)k[5])<<16); b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=k[4]; b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=k[2]; a+=k[0]+(((uint32_t)k[1])<<16); break; case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]+(((uint32_t)k[1])<<16); break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=k[0]; break; case 1 : a+=k8[0]; break; case 0 : return c; /* zero length requires no mixing */ } } else { /* need to read the key one byte at a time */ const uint8_t *k = (const uint8_t *)key; /*--------------- all but the last block: affect some 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; a += ((uint32_t)k[1])<<8; a += ((uint32_t)k[2])<<16; a += ((uint32_t)k[3])<<24; b += k[4]; b += ((uint32_t)k[5])<<8; b += ((uint32_t)k[6])<<16; b += ((uint32_t)k[7])<<24; c += k[8]; c += ((uint32_t)k[9])<<8; c += ((uint32_t)k[10])<<16; c += ((uint32_t)k[11])<<24; mix(a,b,c); length -= 12; k += 12; } /*-------------------------------- last block: affect all 32 bits of (c) */ switch(length) /* all the case statements fall through */ { case 12: c+=((uint32_t)k[11])<<24; case 11: c+=((uint32_t)k[10])<<16; case 10: c+=((uint32_t)k[9])<<8; case 9 : c+=k[8]; case 8 : b+=((uint32_t)k[7])<<24; case 7 : b+=((uint32_t)k[6])<<16; case 6 : b+=((uint32_t)k[5])<<8; case 5 : b+=k[4]; case 4 : a+=((uint32_t)k[3])<<24; case 3 : a+=((uint32_t)k[2])<<16; case 2 : a+=((uint32_t)k[1])<<8; case 1 : a+=k[0]; break; case 0 : return c; } } final(a,b,c); return c; } #ifdef SELF_TEST /* * hashlittle2: return 2 32-bit hash values * * This is identical to hashlittle(), except it returns two 32-bit hash * values instead of just one. This is good enough for hash table * lookup with 2^^64 buckets, or if you want a second hash if you're not * happy with the first, or if you want a probably-unique 64-bit ID for * the key. *pc is better mixed than *pb, so use *pc first. If you want * a 64-bit value do something like "*pc + (((uint64_t)*pb)<<32)". */ void hashlittle2( const void *key, /* the key to hash */ size_t length, /* length of the key */ uint32_t *pc, /* IN: primary initval, OUT: primary hash */ uint32_t *pb) /* IN: secondary initval, OUT: secondary hash */ { uint32_t a,b,c; /* internal state */ union { const void *ptr; size_t i; } u; /* needed for Mac Powerbook G4 */ /* Set up the internal state */ a = b = c = raninit + ((uint32_t)length) + *pc; c += *pb; u.ptr = key; if (HASH_LITTLE_ENDIAN && ((u.i & 0x3) == 0)) { const uint32_t *k = (const uint32_t *)key; /* read 32-bit chunks */ #ifdef VALGRIND const uint8_t *k8; #endif /*------ all but last block: aligned reads and affect 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 12; k += 3; } /*----------------------------- handle the last (probably partial) block */ /* * "k[2]&0xffffff" actually reads beyond the end of the string, but * then masks off the part it's not allowed to read. Because the * string is aligned, the masked-off tail is in the same word as the * rest of the string. Every machine with memory protection I've seen * does it on word boundaries, so is OK with this. But VALGRIND will * still catch it and complain. The masking trick does make the hash * noticably faster for short strings (like English words). */ #ifndef VALGRIND switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=k[2]&0xffffff; b+=k[1]; a+=k[0]; break; case 10: c+=k[2]&0xffff; b+=k[1]; a+=k[0]; break; case 9 : c+=k[2]&0xff; b+=k[1]; a+=k[0]; break; case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=k[1]&0xffffff; a+=k[0]; break; case 6 : b+=k[1]&0xffff; a+=k[0]; break; case 5 : b+=k[1]&0xff; a+=k[0]; break; case 4 : a+=k[0]; break; case 3 : a+=k[0]&0xffffff; break; case 2 : a+=k[0]&0xffff; break; case 1 : a+=k[0]&0xff; break; case 0 : *pc=c; *pb=b; return; /* zero length strings require no mixing */ } #else /* make valgrind happy */ k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=((uint32_t)k8[9])<<8; /* fall through */ case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=((uint32_t)k8[5])<<8; /* fall through */ case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]; break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=((uint32_t)k8[1])<<8; /* fall through */ case 1 : a+=k8[0]; break; case 0 : *pc=c; *pb=b; return; /* zero length strings require no mixing */ } #endif /* !valgrind */ } else if (HASH_LITTLE_ENDIAN && ((u.i & 0x1) == 0)) { const uint16_t *k = (const uint16_t *)key; /* read 16-bit chunks */ const uint8_t *k8; /*--------------- all but last block: aligned reads and different mixing */ while (length > 12) { a += k[0] + (((uint32_t)k[1])<<16); b += k[2] + (((uint32_t)k[3])<<16); c += k[4] + (((uint32_t)k[5])<<16); mix(a,b,c); length -= 12; k += 6; } /*----------------------------- handle the last (probably partial) block */ k8 = (const uint8_t *)k; switch(length) { case 12: c+=k[4]+(((uint32_t)k[5])<<16); b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 11: c+=((uint32_t)k8[10])<<16; /* fall through */ case 10: c+=k[4]; b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 9 : c+=k8[8]; /* fall through */ case 8 : b+=k[2]+(((uint32_t)k[3])<<16); a+=k[0]+(((uint32_t)k[1])<<16); break; case 7 : b+=((uint32_t)k8[6])<<16; /* fall through */ case 6 : b+=k[2]; a+=k[0]+(((uint32_t)k[1])<<16); break; case 5 : b+=k8[4]; /* fall through */ case 4 : a+=k[0]+(((uint32_t)k[1])<<16); break; case 3 : a+=((uint32_t)k8[2])<<16; /* fall through */ case 2 : a+=k[0]; break; case 1 : a+=k8[0]; break; case 0 : *pc=c; *pb=b; return; /* zero length strings require no mixing */ } } else { /* need to read the key one byte at a time */ const uint8_t *k = (const uint8_t *)key; /*--------------- all but the last block: affect some 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; a += ((uint32_t)k[1])<<8; a += ((uint32_t)k[2])<<16; a += ((uint32_t)k[3])<<24; b += k[4]; b += ((uint32_t)k[5])<<8; b += ((uint32_t)k[6])<<16; b += ((uint32_t)k[7])<<24; c += k[8]; c += ((uint32_t)k[9])<<8; c += ((uint32_t)k[10])<<16; c += ((uint32_t)k[11])<<24; mix(a,b,c); length -= 12; k += 12; } /*-------------------------------- last block: affect all 32 bits of (c) */ switch(length) /* all the case statements fall through */ { case 12: c+=((uint32_t)k[11])<<24; case 11: c+=((uint32_t)k[10])<<16; case 10: c+=((uint32_t)k[9])<<8; case 9 : c+=k[8]; case 8 : b+=((uint32_t)k[7])<<24; case 7 : b+=((uint32_t)k[6])<<16; case 6 : b+=((uint32_t)k[5])<<8; case 5 : b+=k[4]; case 4 : a+=((uint32_t)k[3])<<24; case 3 : a+=((uint32_t)k[2])<<16; case 2 : a+=((uint32_t)k[1])<<8; case 1 : a+=k[0]; break; case 0 : *pc=c; *pb=b; return; /* zero length strings require no mixing */ } } final(a,b,c); *pc=c; *pb=b; } #endif /* SELF_TEST */ #if 0 /* currently not used */ /* * hashbig(): * This is the same as hashword() on big-endian machines. It is different * from hashlittle() on all machines. hashbig() takes advantage of * big-endian byte ordering. */ uint32_t hashbig( const void *key, size_t length, uint32_t initval) { uint32_t a,b,c; union { const void *ptr; size_t i; } u; /* to cast key to (size_t) happily */ /* Set up the internal state */ a = b = c = raninit + ((uint32_t)length) + initval; u.ptr = key; if (HASH_BIG_ENDIAN && ((u.i & 0x3) == 0)) { const uint32_t *k = (const uint32_t *)key; /* read 32-bit chunks */ #ifdef VALGRIND const uint8_t *k8; #endif /*------ all but last block: aligned reads and affect 32 bits of (a,b,c) */ while (length > 12) { a += k[0]; b += k[1]; c += k[2]; mix(a,b,c); length -= 12; k += 3; } /*----------------------------- handle the last (probably partial) block */ /* * "k[2]<<8" actually reads beyond the end of the string, but * then shifts out the part it's not allowed to read. Because the * string is aligned, the illegal read is in the same word as the * rest of the string. Every machine with memory protection I've seen * does it on word boundaries, so is OK with this. But VALGRIND will * still catch it and complain. The masking trick does make the hash * noticably faster for short strings (like English words). */ #ifndef VALGRIND switch(length) { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=k[2]&0xffffff00; b+=k[1]; a+=k[0]; break; case 10: c+=k[2]&0xffff0000; b+=k[1]; a+=k[0]; break; case 9 : c+=k[2]&0xff000000; b+=k[1]; a+=k[0]; break; case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=k[1]&0xffffff00; a+=k[0]; break; case 6 : b+=k[1]&0xffff0000; a+=k[0]; break; case 5 : b+=k[1]&0xff000000; a+=k[0]; break; case 4 : a+=k[0]; break; case 3 : a+=k[0]&0xffffff00; break; case 2 : a+=k[0]&0xffff0000; break; case 1 : a+=k[0]&0xff000000; break; case 0 : return c; /* zero length strings require no mixing */ } #else /* make valgrind happy */ k8 = (const uint8_t *)k; switch(length) /* all the case statements fall through */ { case 12: c+=k[2]; b+=k[1]; a+=k[0]; break; case 11: c+=((uint32_t)k8[10])<<8; /* fall through */ case 10: c+=((uint32_t)k8[9])<<16; /* fall through */ case 9 : c+=((uint32_t)k8[8])<<24; /* fall through */ case 8 : b+=k[1]; a+=k[0]; break; case 7 : b+=((uint32_t)k8[6])<<8; /* fall through */ case 6 : b+=((uint32_t)k8[5])<<16; /* fall through */ case 5 : b+=((uint32_t)k8[4])<<24; /* fall through */ case 4 : a+=k[0]; break; case 3 : a+=((uint32_t)k8[2])<<8; /* fall through */ case 2 : a+=((uint32_t)k8[1])<<16; /* fall through */ case 1 : a+=((uint32_t)k8[0])<<24; break; case 0 : return c; } #endif /* !VALGRIND */ } else { /* need to read the key one byte at a time */ const uint8_t *k = (const uint8_t *)key; /*--------------- all but the last block: affect some 32 bits of (a,b,c) */ while (length > 12) { a += ((uint32_t)k[0])<<24; a += ((uint32_t)k[1])<<16; a += ((uint32_t)k[2])<<8; a += ((uint32_t)k[3]); b += ((uint32_t)k[4])<<24; b += ((uint32_t)k[5])<<16; b += ((uint32_t)k[6])<<8; b += ((uint32_t)k[7]); c += ((uint32_t)k[8])<<24; c += ((uint32_t)k[9])<<16; c += ((uint32_t)k[10])<<8; c += ((uint32_t)k[11]); mix(a,b,c); length -= 12; k += 12; } /*-------------------------------- last block: affect all 32 bits of (c) */ switch(length) /* all the case statements fall through */ { case 12: c+=k[11]; case 11: c+=((uint32_t)k[10])<<8; case 10: c+=((uint32_t)k[9])<<16; case 9 : c+=((uint32_t)k[8])<<24; case 8 : b+=k[7]; case 7 : b+=((uint32_t)k[6])<<8; case 6 : b+=((uint32_t)k[5])<<16; case 5 : b+=((uint32_t)k[4])<<24; case 4 : a+=k[3]; case 3 : a+=((uint32_t)k[2])<<8; case 2 : a+=((uint32_t)k[1])<<16; case 1 : a+=((uint32_t)k[0])<<24; break; case 0 : return c; } } final(a,b,c); return c; } #endif /* 0 == currently not used */ #ifdef SELF_TEST /* used for timings */ void driver1() { uint8_t buf[256]; uint32_t i; uint32_t h=0; time_t a,z; time(&a); for (i=0; i<256; ++i) buf[i] = 'x'; for (i=0; i<1; ++i) { h = hashlittle(&buf[0],1,h); } time(&z); if (z-a > 0) printf("time %d %.8x\n", z-a, h); } /* check that every input bit changes every output bit half the time */ #define HASHSTATE 1 #define HASHLEN 1 #define MAXPAIR 60 #define MAXLEN 70 void driver2() { uint8_t qa[MAXLEN+1], qb[MAXLEN+2], *a = &qa[0], *b = &qb[1]; uint32_t c[HASHSTATE], d[HASHSTATE], i=0, j=0, k, l, m=0, z; uint32_t e[HASHSTATE],f[HASHSTATE],g[HASHSTATE],h[HASHSTATE]; uint32_t x[HASHSTATE],y[HASHSTATE]; uint32_t hlen; printf("No more than %d trials should ever be needed \n",MAXPAIR/2); for (hlen=0; hlen < MAXLEN; ++hlen) { z=0; for (i=0; i>(8-j)); c[0] = hashlittle(a, hlen, m); b[i] ^= ((k+1)<>(8-j)); d[0] = hashlittle(b, hlen, m); /* check every bit is 1, 0, set, and not set at least once */ for (l=0; lz) z=k; if (k==MAXPAIR) { printf("Some bit didn't change: "); printf("%.8x %.8x %.8x %.8x %.8x %.8x ", e[0],f[0],g[0],h[0],x[0],y[0]); printf("i %d j %d m %d len %d\n", i, j, m, hlen); } if (z==MAXPAIR) goto done; } } } done: if (z < MAXPAIR) { printf("Mix success %2d bytes %2d initvals ",i,m); printf("required %d trials\n", z/2); } } printf("\n"); } /* Check for reading beyond the end of the buffer and alignment problems */ void driver3() { uint8_t buf[MAXLEN+20], *b; uint32_t len; uint8_t q[] = "This is the time for all good men to come to the aid of their country..."; uint32_t h; uint8_t qq[] = "xThis is the time for all good men to come to the aid of their country..."; uint32_t i; uint8_t qqq[] = "xxThis is the time for all good men to come to the aid of their country..."; uint32_t j; uint8_t qqqq[] = "xxxThis is the time for all good men to come to the aid of their country..."; uint32_t ref,x,y; uint8_t *p; printf("Endianness. These lines should all be the same (for values filled in):\n"); printf("%.8x %.8x %.8x\n", hashword((const uint32_t *)q, (sizeof(q)-1)/4, 13), hashword((const uint32_t *)q, (sizeof(q)-5)/4, 13), hashword((const uint32_t *)q, (sizeof(q)-9)/4, 13)); p = q; printf("%.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x\n", hashlittle(p, sizeof(q)-1, 13), hashlittle(p, sizeof(q)-2, 13), hashlittle(p, sizeof(q)-3, 13), hashlittle(p, sizeof(q)-4, 13), hashlittle(p, sizeof(q)-5, 13), hashlittle(p, sizeof(q)-6, 13), hashlittle(p, sizeof(q)-7, 13), hashlittle(p, sizeof(q)-8, 13), hashlittle(p, sizeof(q)-9, 13), hashlittle(p, sizeof(q)-10, 13), hashlittle(p, sizeof(q)-11, 13), hashlittle(p, sizeof(q)-12, 13)); p = &qq[1]; printf("%.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x\n", hashlittle(p, sizeof(q)-1, 13), hashlittle(p, sizeof(q)-2, 13), hashlittle(p, sizeof(q)-3, 13), hashlittle(p, sizeof(q)-4, 13), hashlittle(p, sizeof(q)-5, 13), hashlittle(p, sizeof(q)-6, 13), hashlittle(p, sizeof(q)-7, 13), hashlittle(p, sizeof(q)-8, 13), hashlittle(p, sizeof(q)-9, 13), hashlittle(p, sizeof(q)-10, 13), hashlittle(p, sizeof(q)-11, 13), hashlittle(p, sizeof(q)-12, 13)); p = &qqq[2]; printf("%.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x\n", hashlittle(p, sizeof(q)-1, 13), hashlittle(p, sizeof(q)-2, 13), hashlittle(p, sizeof(q)-3, 13), hashlittle(p, sizeof(q)-4, 13), hashlittle(p, sizeof(q)-5, 13), hashlittle(p, sizeof(q)-6, 13), hashlittle(p, sizeof(q)-7, 13), hashlittle(p, sizeof(q)-8, 13), hashlittle(p, sizeof(q)-9, 13), hashlittle(p, sizeof(q)-10, 13), hashlittle(p, sizeof(q)-11, 13), hashlittle(p, sizeof(q)-12, 13)); p = &qqqq[3]; printf("%.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x %.8x\n", hashlittle(p, sizeof(q)-1, 13), hashlittle(p, sizeof(q)-2, 13), hashlittle(p, sizeof(q)-3, 13), hashlittle(p, sizeof(q)-4, 13), hashlittle(p, sizeof(q)-5, 13), hashlittle(p, sizeof(q)-6, 13), hashlittle(p, sizeof(q)-7, 13), hashlittle(p, sizeof(q)-8, 13), hashlittle(p, sizeof(q)-9, 13), hashlittle(p, sizeof(q)-10, 13), hashlittle(p, sizeof(q)-11, 13), hashlittle(p, sizeof(q)-12, 13)); printf("\n"); /* check that hashlittle2 and hashlittle produce the same results */ i=47; j=0; hashlittle2(q, sizeof(q), &i, &j); if (hashlittle(q, sizeof(q), 47) != i) printf("hashlittle2 and hashlittle mismatch\n"); /* check that hashword2 and hashword produce the same results */ len = raninit; i=47, j=0; hashword2(&len, 1, &i, &j); if (hashword(&len, 1, 47) != i) printf("hashword2 and hashword mismatch %x %x\n", i, hashword(&len, 1, 47)); /* check hashlittle doesn't read before or after the ends of the string */ for (h=0, b=buf+1; h<8; ++h, ++b) { for (i=0; ishort_name = name; algorithm->wireformat_name = dname_parse(region, wireformat); if (!algorithm->wireformat_name) { log_msg(LOG_ERR, "cannot parse %s algorithm", wireformat); return 0; } algorithm->maximum_digest_size = EVP_MAX_MD_SIZE; algorithm->data = hmac_algorithm; algorithm->hmac_create_context = create_context; algorithm->hmac_init_context = init_context; algorithm->hmac_update = update; algorithm->hmac_final = final; tsig_add_algorithm(algorithm); return 1; } int tsig_openssl_init(region_type *region) { int count = 0; OpenSSL_add_all_digests(); count += tsig_openssl_init_algorithm(region, "md5", "hmac-md5","hmac-md5.sig-alg.reg.int."); #ifdef HAVE_EVP_SHA1 count += tsig_openssl_init_algorithm(region, "sha1", "hmac-sha1", "hmac-sha1."); #endif /* HAVE_EVP_SHA1 */ #ifdef HAVE_EVP_SHA256 count += tsig_openssl_init_algorithm(region, "sha256", "hmac-sha256", "hmac-sha256."); #endif /* HAVE_EVP_SHA256 */ return count; } static void cleanup_context(void *data) { HMAC_CTX *context = (HMAC_CTX *) data; HMAC_CTX_cleanup(context); } static void * create_context(region_type *region) { HMAC_CTX *context = (HMAC_CTX *) region_alloc(region, sizeof(HMAC_CTX)); region_add_cleanup(region, cleanup_context, context); HMAC_CTX_init(context); return context; } static void init_context(void *context, tsig_algorithm_type *algorithm, tsig_key_type *key) { HMAC_CTX *ctx = (HMAC_CTX *) context; const EVP_MD *md = (const EVP_MD *) algorithm->data; HMAC_Init_ex(ctx, key->data, key->size, md, NULL); } static void update(void *context, const void *data, size_t size) { HMAC_CTX *ctx = (HMAC_CTX *) context; HMAC_Update(ctx, (unsigned char *) data, (int) size); } static void final(void *context, uint8_t *digest, size_t *size) { HMAC_CTX *ctx = (HMAC_CTX *) context; unsigned len = (unsigned) *size; HMAC_Final(ctx, digest, &len); *size = (size_t) len; } void tsig_openssl_finalize() { EVP_cleanup(); } #endif /* defined(HAVE_SSL) */ nsd-3.2.16/dbcreate.c0000664000175000017500000001316512073243522013276 0ustar matjematje/* * dbcreate.c -- routines to create an nsd(8) name database * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include #include "namedb.h" static int write_db (namedb_type *db); static int write_number(struct namedb *db, uint32_t number); struct namedb * namedb_new (const char *filename) { namedb_type *db; /* Make a new structure... */ if ((db = namedb_create()) == NULL) { log_msg(LOG_ERR, "insufficient memory to create database"); return NULL; } db->filename = region_strdup(db->region, filename); db->crc = 0xffffffff; db->diff_skip = 0; db->fd = NULL; if (gettimeofday(&(db->diff_timestamp), NULL) != 0) { log_msg(LOG_ERR, "unable to load %s: cannot initialize " "timestamp", db->filename); namedb_destroy(db); return NULL; } /* * Unlink the old database, if it exists. This is useful to * ensure that NSD doesn't see the changes until a reload is done. */ if (unlink(db->filename) == -1 && errno != ENOENT) { namedb_destroy(db); return NULL; } /* Create the database */ if ((db->fd = fopen(db->filename, "w")) == NULL) { namedb_destroy(db); return NULL; } if (!write_data_crc(db->fd, NAMEDB_MAGIC, NAMEDB_MAGIC_SIZE, &db->crc)) { fclose(db->fd); namedb_discard(db); return NULL; } return db; } int namedb_save (struct namedb *db) { if (write_db(db) != 0) { return -1; } /* Finish up and write the crc */ if (!write_number(db, ~db->crc)) { fclose(db->fd); return -1; } /* Write the magic... */ if (!write_data_crc(db->fd, NAMEDB_MAGIC, NAMEDB_MAGIC_SIZE, &db->crc)) { fclose(db->fd); return -1; } /* Close the database */ fclose(db->fd); namedb_destroy(db); return 0; } void namedb_discard (struct namedb *db) { unlink(db->filename); namedb_destroy(db); } static int write_dname(struct namedb *db, domain_type *domain) { const dname_type *dname = domain_dname(domain); if (!write_data_crc(db->fd, &dname->name_size, sizeof(dname->name_size), &db->crc)) return -1; if (!write_data_crc(db->fd, dname_name(dname), dname->name_size, &db->crc)) return -1; return 0; } static int write_number(struct namedb *db, uint32_t number) { number = htonl(number); return write_data_crc(db->fd, &number, sizeof(number), &db->crc); } static int write_rrset(struct namedb *db, domain_type *domain, rrset_type *rrset) { uint16_t rr_count; int i, j; uint16_t type; uint16_t klass; assert(db); assert(domain); assert(rrset); rr_count = htons(rrset->rr_count); if (!write_number(db, domain->number)) return 1; if (!write_number(db, rrset->zone->number)) return 1; type = htons(rrset_rrtype(rrset)); if (!write_data_crc(db->fd, &type, sizeof(type), &db->crc)) return 1; klass = htons(rrset_rrclass(rrset)); if (!write_data_crc(db->fd, &klass, sizeof(klass), &db->crc)) return 1; if (!write_data_crc(db->fd, &rr_count, sizeof(rr_count), &db->crc)) return 1; for (i = 0; i < rrset->rr_count; ++i) { rr_type *rr = &rrset->rrs[i]; uint32_t ttl; uint16_t rdata_count; rdata_count = htons(rr->rdata_count); if (!write_data_crc(db->fd, &rdata_count, sizeof(rdata_count), &db->crc)) return 1; ttl = htonl(rr->ttl); if (!write_data_crc(db->fd, &ttl, sizeof(ttl), &db->crc)) return 1; for (j = 0; j < rr->rdata_count; ++j) { rdata_atom_type atom = rr->rdatas[j]; if (rdata_atom_is_domain(rr->type, j)) { if (!write_number(db, rdata_atom_domain(atom)->number)) return 1; } else { uint16_t size = htons(rdata_atom_size(atom)); if (!write_data_crc(db->fd, &size, sizeof(size), &db->crc)) return 1; if (!write_data_crc(db->fd, rdata_atom_data(atom), rdata_atom_size(atom), &db->crc)) return 1; } } } return 0; } static int number_dnames_iterator(domain_type *node, void *user_data) { uint32_t *current_number = (uint32_t *) user_data; node->number = *current_number; ++*current_number; return 0; } static int write_dname_iterator(domain_type *node, void *user_data) { namedb_type *db = (namedb_type *) user_data; return write_dname(db, node); } static int write_domain_iterator(domain_type *node, void *user_data) { namedb_type *db = (namedb_type *) user_data; rrset_type *rrset; int error = 0; for (rrset = node->rrsets; rrset; rrset = rrset->next) { error += write_rrset(db, node, rrset); } return error; } /* * Writes databse data into open database *db * * Returns zero if success. */ static int write_db(namedb_type *db) { zone_type *zone; uint32_t terminator = 0; uint32_t dname_count = 1; uint32_t zone_count = 1; int errors = 0; for (zone = db->zones; zone; zone = zone->next) { zone->number = zone_count; ++zone_count; if (!zone->soa_rrset) { fprintf(stderr, "SOA record not present in %s\n", dname_to_string(domain_dname(zone->apex), NULL)); ++errors; } } if (errors > 0) return -1; --zone_count; if (!write_number(db, zone_count)) return -1; for (zone = db->zones; zone; zone = zone->next) { if (write_dname(db, zone->apex)) return -1; } if (domain_table_iterate(db->domains, number_dnames_iterator, &dname_count)) return -1; --dname_count; if (!write_number(db, dname_count)) return -1; DEBUG(DEBUG_ZONEC, 1, (LOG_INFO, "Storing %lu domain names\n", (unsigned long) dname_count)); if (domain_table_iterate(db->domains, write_dname_iterator, db)) return -1; if (domain_table_iterate(db->domains, write_domain_iterator, db)) return -1; if (!write_data_crc(db->fd, &terminator, sizeof(terminator), &db->crc)) return -1; return 0; } nsd-3.2.16/zparser.h0000664000175000017500000001224212173226547013224 0ustar matjematje/* A Bison parser, made by GNU Bison 2.5. */ /* Bison interface for Yacc-like parsers in C Copyright (C) 1984, 1989-1990, 2000-2011 Free Software Foundation, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ /* As a special exception, you may create a larger work that contains part or all of the Bison parser skeleton and distribute that work under terms of your choice, so long as that work isn't itself a parser generator using the skeleton or a modified version thereof as a parser skeleton. Alternatively, if you modify or redistribute the parser skeleton itself, you may (at your option) remove this special exception, which will cause the skeleton and the resulting Bison output files to be licensed under the GNU General Public License without this special exception. This special exception was added by the Free Software Foundation in version 2.2 of Bison. */ /* Tokens. */ #ifndef YYTOKENTYPE # define YYTOKENTYPE /* Put the tokens into the symbol table, so that GDB and other debuggers know about them. */ enum yytokentype { T_A = 258, T_NS = 259, T_MX = 260, T_TXT = 261, T_CNAME = 262, T_AAAA = 263, T_PTR = 264, T_NXT = 265, T_KEY = 266, T_SOA = 267, T_SIG = 268, T_SRV = 269, T_CERT = 270, T_LOC = 271, T_MD = 272, T_MF = 273, T_MB = 274, T_MG = 275, T_MR = 276, T_NULL = 277, T_WKS = 278, T_HINFO = 279, T_MINFO = 280, T_RP = 281, T_AFSDB = 282, T_X25 = 283, T_ISDN = 284, T_RT = 285, T_NSAP = 286, T_NSAP_PTR = 287, T_PX = 288, T_GPOS = 289, T_EID = 290, T_NIMLOC = 291, T_ATMA = 292, T_NAPTR = 293, T_KX = 294, T_A6 = 295, T_DNAME = 296, T_SINK = 297, T_OPT = 298, T_APL = 299, T_UINFO = 300, T_UID = 301, T_GID = 302, T_UNSPEC = 303, T_TKEY = 304, T_TSIG = 305, T_IXFR = 306, T_AXFR = 307, T_MAILB = 308, T_MAILA = 309, T_DS = 310, T_DLV = 311, T_SSHFP = 312, T_RRSIG = 313, T_NSEC = 314, T_DNSKEY = 315, T_SPF = 316, T_NSEC3 = 317, T_IPSECKEY = 318, T_DHCID = 319, T_NSEC3PARAM = 320, T_TLSA = 321, T_NID = 322, T_L32 = 323, T_L64 = 324, T_LP = 325, T_EUI48 = 326, T_EUI64 = 327, DOLLAR_TTL = 328, DOLLAR_ORIGIN = 329, NL = 330, SP = 331, STR = 332, PREV = 333, BITLAB = 334, T_TTL = 335, T_RRCLASS = 336, URR = 337, T_UTYPE = 338 }; #endif /* Tokens. */ #define T_A 258 #define T_NS 259 #define T_MX 260 #define T_TXT 261 #define T_CNAME 262 #define T_AAAA 263 #define T_PTR 264 #define T_NXT 265 #define T_KEY 266 #define T_SOA 267 #define T_SIG 268 #define T_SRV 269 #define T_CERT 270 #define T_LOC 271 #define T_MD 272 #define T_MF 273 #define T_MB 274 #define T_MG 275 #define T_MR 276 #define T_NULL 277 #define T_WKS 278 #define T_HINFO 279 #define T_MINFO 280 #define T_RP 281 #define T_AFSDB 282 #define T_X25 283 #define T_ISDN 284 #define T_RT 285 #define T_NSAP 286 #define T_NSAP_PTR 287 #define T_PX 288 #define T_GPOS 289 #define T_EID 290 #define T_NIMLOC 291 #define T_ATMA 292 #define T_NAPTR 293 #define T_KX 294 #define T_A6 295 #define T_DNAME 296 #define T_SINK 297 #define T_OPT 298 #define T_APL 299 #define T_UINFO 300 #define T_UID 301 #define T_GID 302 #define T_UNSPEC 303 #define T_TKEY 304 #define T_TSIG 305 #define T_IXFR 306 #define T_AXFR 307 #define T_MAILB 308 #define T_MAILA 309 #define T_DS 310 #define T_DLV 311 #define T_SSHFP 312 #define T_RRSIG 313 #define T_NSEC 314 #define T_DNSKEY 315 #define T_SPF 316 #define T_NSEC3 317 #define T_IPSECKEY 318 #define T_DHCID 319 #define T_NSEC3PARAM 320 #define T_TLSA 321 #define T_NID 322 #define T_L32 323 #define T_L64 324 #define T_LP 325 #define T_EUI48 326 #define T_EUI64 327 #define DOLLAR_TTL 328 #define DOLLAR_ORIGIN 329 #define NL 330 #define SP 331 #define STR 332 #define PREV 333 #define BITLAB 334 #define T_TTL 335 #define T_RRCLASS 336 #define URR 337 #define T_UTYPE 338 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED typedef union YYSTYPE { /* Line 2068 of yacc.c */ #line 50 "zparser.y" domain_type *domain; const dname_type *dname; struct lex_data data; uint32_t ttl; uint16_t klass; uint16_t type; uint16_t *unknown; /* Line 2068 of yacc.c */ #line 228 "zparser.h" } YYSTYPE; # define YYSTYPE_IS_TRIVIAL 1 # define yystype YYSTYPE /* obsolescent; will be withdrawn */ # define YYSTYPE_IS_DECLARED 1 #endif extern YYSTYPE yylval; nsd-3.2.16/acx_nlnetlabs.m40000664000175000017500000011576612162243202014444 0ustar matjematje# acx_nlnetlabs.m4 - common macros for configure checks # Copyright 2009, Wouter Wijngaards, NLnet Labs. # BSD licensed. # # Version 24 # 2013-06-25 FLTO has --disable-flto option. # 2013-05-03 Update W32_SLEEP for newer mingw that links but not defines it. # 2013-03-22 Fix ACX_RSRC_VERSION for long version numbers. # 2012-02-09 Fix AHX_MEMCMP_BROKEN with undef in compat/memcmp.h. # 2012-01-20 Fix COMPILER_FLAGS_UNBOUND for gcc 4.6.2 assigned-not-used-warns. # 2011-12-05 Fix getaddrinfowithincludes on windows with fedora16 mingw32-gcc. # Fix ACX_MALLOC for redefined malloc error. # Fix GETADDRINFO_WITH_INCLUDES to add -lws2_32 # 2011-11-10 Fix FLTO test to not drop a.out in current directory. # 2011-11-01 Fix FLTO test for llvm on Lion. # 2011-08-01 Fix nonblock test (broken at v13). # 2011-08-01 Fix autoconf 2.68 warnings # 2011-06-23 Add ACX_CHECK_FLTO to check -flto. # 2010-08-16 Fix FLAG_OMITTED for AS_TR_CPP changes in autoconf-2.66. # 2010-07-02 Add check for ss_family (for minix). # 2010-04-26 Fix to use CPPFLAGS for CHECK_COMPILER_FLAGS. # 2010-03-01 Fix RPATH using CONFIG_COMMANDS to run at the very end. # 2010-02-18 WITH_SSL outputs the LIBSSL_LDFLAGS, LIBS, CPPFLAGS seperate, -ldl # 2010-02-01 added ACX_CHECK_MEMCMP_SIGNED, AHX_MEMCMP_BROKEN # 2010-01-20 added AHX_COONFIG_STRLCAT # 2009-07-14 U_CHAR detection improved for windows crosscompile. # added ACX_FUNC_MALLOC # fixup some #if to #ifdef # NONBLOCKING test for mingw crosscompile. # 2009-07-13 added ACX_WITH_SSL_OPTIONAL # 2009-07-03 fixup LDFLAGS for empty ssl dir. # # Automates some of the checking constructs. Aims at portability for POSIX. # Documentation for functions is below. # # the following macro's are provided in this file: # (see below for details on each macro). # # ACX_ESCAPE_BACKSLASH - escape backslashes in var for C-preproc. # ACX_RSRC_VERSION - create windows resource version number. # ACX_CHECK_COMPILER_FLAG - see if cc supports a flag. # ACX_CHECK_ERROR_FLAGS - see which flag is -werror (used below). # ACX_CHECK_COMPILER_FLAG_NEEDED - see if flags make the code compile cleanly. # ACX_DEPFLAG - find cc dependency flags. # ACX_DETERMINE_EXT_FLAGS_UNBOUND - find out which flags enable BSD and POSIX. # ACX_CHECK_FORMAT_ATTRIBUTE - find cc printf format syntax. # ACX_CHECK_UNUSED_ATTRIBUTE - find cc variable unused syntax. # ACX_CHECK_FLTO - see if cc supports -flto and use it if so. # ACX_LIBTOOL_C_ONLY - create libtool for C only, improved. # ACX_TYPE_U_CHAR - u_char type. # ACX_TYPE_RLIM_T - rlim_t type. # ACX_TYPE_SOCKLEN_T - socklen_t type. # ACX_TYPE_IN_ADDR_T - in_addr_t type. # ACX_TYPE_IN_PORT_T - in_port_t type. # ACX_ARG_RPATH - add --disable-rpath option. # ACX_WITH_SSL - add --with-ssl option, link -lcrypto. # ACX_WITH_SSL_OPTIONAL - add --with-ssl option, link -lcrypto, # where --without-ssl is also accepted # ACX_LIB_SSL - setup to link -lssl. # ACX_SYS_LARGEFILE - improved sys_largefile, fseeko, >2G files. # ACX_CHECK_GETADDRINFO_WITH_INCLUDES - find getaddrinfo, portably. # ACX_FUNC_DEPRECATED - see if func is deprecated. # ACX_CHECK_NONBLOCKING_BROKEN - see if nonblocking sockets really work. # ACX_MKDIR_ONE_ARG - determine mkdir(2) number of arguments. # ACX_FUNC_IOCTLSOCKET - find ioctlsocket, portably. # ACX_FUNC_MALLOC - check malloc, define replacement . # AHX_CONFIG_FORMAT_ATTRIBUTE - config.h text for format. # AHX_CONFIG_UNUSED_ATTRIBUTE - config.h text for unused. # AHX_CONFIG_FSEEKO - define fseeko, ftello fallback. # AHX_CONFIG_RAND_MAX - define RAND_MAX if needed. # AHX_CONFIG_MAXHOSTNAMELEN - define MAXHOSTNAMELEN if needed. # AHX_CONFIG_IPV6_MIN_MTU - define IPV6_MIN_MTU if needed. # AHX_CONFIG_SNPRINTF - snprintf compat prototype # AHX_CONFIG_INET_PTON - inet_pton compat prototype # AHX_CONFIG_INET_NTOP - inet_ntop compat prototype # AHX_CONFIG_INET_ATON - inet_aton compat prototype # AHX_CONFIG_MEMMOVE - memmove compat prototype # AHX_CONFIG_STRLCAT - strlcat compat prototype # AHX_CONFIG_STRLCPY - strlcpy compat prototype # AHX_CONFIG_GMTIME_R - gmtime_r compat prototype # AHX_CONFIG_W32_SLEEP - w32 compat for sleep # AHX_CONFIG_W32_USLEEP - w32 compat for usleep # AHX_CONFIG_W32_RANDOM - w32 compat for random # AHX_CONFIG_W32_SRANDOM - w32 compat for srandom # AHX_CONFIG_W32_FD_SET_T - w32 detection of FD_SET_T. # ACX_CFLAGS_STRIP - strip one flag from CFLAGS # ACX_STRIP_EXT_FLAGS - strip extension flags from CFLAGS # AHX_CONFIG_FLAG_OMITTED - define omitted flag # AHX_CONFIG_FLAG_EXT - define omitted extension flag # AHX_CONFIG_EXT_FLAGS - define the stripped extension flags # ACX_CHECK_MEMCMP_SIGNED - check if memcmp uses signed characters. # AHX_MEMCMP_BROKEN - replace memcmp func for CHECK_MEMCMP_SIGNED. # ACX_CHECK_SS_FAMILY - check for sockaddr_storage.ss_family # dnl Escape backslashes as \\, for C:\ paths, for the C preprocessor defines. dnl for example, ACX_ESCAPE_BACKSLASH($from_var, to_var) dnl $1: the text to change. dnl $2: the result. AC_DEFUN([ACX_ESCAPE_BACKSLASH], [$2="`echo $1 | sed -e 's/\\\\/\\\\\\\\/g'`" ]) dnl Calculate comma separated windows-resource numbers from package version. dnl Picks the first three(,0) or four numbers out of the name. dnl $1: variable for the result AC_DEFUN([ACX_RSRC_VERSION], [$1=[`echo $PACKAGE_VERSION | sed -e 's/^[^0-9]*\([0-9][0-9]*\)[^0-9][^0-9]*\([0-9][0-9]*\)[^0-9][^0-9]*\([0-9][0-9]*\)[^0-9][^0-9]*\([0-9][0-9]*\).*$/\1,\2,\3,\4/' -e 's/^[^0-9]*\([0-9][0-9]*\)[^0-9][^0-9]*\([0-9][0-9]*\)[^0-9][^0-9]*\([0-9][0-9]*\)[^0-9]*$/\1,\2,\3,0/' `] ]) dnl Routine to help check for compiler flags. dnl Checks if the compiler will accept the flag. dnl $1: the flag without a - in front, so g to check -g. dnl $2: executed if yes dnl $3: executed if no AC_DEFUN([ACX_CHECK_COMPILER_FLAG], [ AC_REQUIRE([AC_PROG_CC]) AC_MSG_CHECKING(whether $CC supports -$1) cache=`echo $1 | sed 'y%.=/+-%___p_%'` AC_CACHE_VAL(cv_prog_cc_flag_$cache, [ echo 'void f(){}' >conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS -$1 -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_$cache=yes" else eval "cv_prog_cc_flag_$cache=no" fi rm -f conftest conftest.o conftest.c ]) if eval "test \"`echo '$cv_prog_cc_flag_'$cache`\" = yes"; then AC_MSG_RESULT(yes) : $2 else AC_MSG_RESULT(no) : $3 fi ]) dnl setup flags for ACX_CHECK_COMPILER_FLAG_NEEDED dnl ERRFLAG: result, compiler flag to turn warnings into errors AC_DEFUN([ACX_CHECK_ERROR_FLAGS], [ ACX_CHECK_COMPILER_FLAG(Werror, [ERRFLAG="-Werror"], [ERRFLAG="-errwarn"]) ACX_CHECK_COMPILER_FLAG(Wall, [ERRFLAG="$ERRFLAG -Wall"], [ERRFLAG="$ERRFLAG -errfmt"]) ]) dnl Routine to help check for needed compiler flags. dnl $1: flags for CC dnl $2: the includes and code dnl $3: if the given code only compiles with the flag, execute argument 3 dnl $4: if the given code compiles without the flag, execute argument 4 dnl $5: with and without flag the compile fails, execute argument 5. AC_DEFUN([ACX_CHECK_COMPILER_FLAG_NEEDED], [ AC_REQUIRE([AC_PROG_CC]) AC_REQUIRE([ACX_CHECK_ERROR_FLAGS]) AC_MSG_CHECKING(whether we need $1 as a flag for $CC) cache=AS_TR_SH($1) dnl cache=`echo $1 | sed 'y%.=/+- %___p__%'` AC_CACHE_VAL(cv_prog_cc_flag_needed_$cache, [ echo '$2' > conftest.c echo 'void f(){}' >>conftest.c if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_needed_$cache=no" else [ if test -z "`$CC $CPPFLAGS $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1`"; then eval "cv_prog_cc_flag_needed_$cache=yes" else eval "cv_prog_cc_flag_needed_$cache=fail" #echo 'Test with flag fails too!' #cat conftest.c #echo "$CC $CPPFLAGS $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1" #echo `$CC $CPPFLAGS $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1` #exit 1 fi ] fi rm -f conftest conftest.c conftest.o ]) if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = yes"; then AC_MSG_RESULT(yes) : $3 else if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then AC_MSG_RESULT(no) #echo 'Test with flag is no!' #cat conftest.c #echo "$CC $CPPFLAGS $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1" #echo `$CC $CPPFLAGS $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1` #exit 1 : $4 else AC_MSG_RESULT(failed) : $5 fi fi ]) dnl Check for CC dependency flag dnl DEPFLAG: set to flag that generates dependencies. AC_DEFUN([ACX_DEPFLAG], [ AC_MSG_CHECKING([$CC dependency flag]) echo 'void f(){}' >conftest.c if test "`$CC -MM conftest.c 2>&1`" = "conftest.o: conftest.c"; then DEPFLAG="-MM" else if test "`$CC -xM1 conftest.c 2>&1`" = "conftest.o: conftest.c"; then DEPFLAG="-xM1" else DEPFLAG="-MM" # dunno do something fi fi AC_MSG_RESULT($DEPFLAG) rm -f conftest.c AC_SUBST(DEPFLAG) ]) dnl Determine flags that gives POSIX and BSD functionality. dnl CFLAGS is modified for the result. AC_DEFUN([ACX_DETERMINE_EXT_FLAGS_UNBOUND], [ ACX_CHECK_COMPILER_FLAG(std=c99, [C99FLAG="-std=c99"]) ACX_CHECK_COMPILER_FLAG(xc99, [C99FLAG="-xc99"]) AC_CHECK_HEADERS([getopt.h time.h],,, [AC_INCLUDES_DEFAULT]) ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE, [ #include "confdefs.h" #include #include #include #ifdef HAVE_TIME_H #include #endif #include #include #ifdef HAVE_GETOPT_H #include #endif int test() { int a; char **opts = NULL; struct timeval tv; char *t; time_t time = 0; char *buf = NULL; const char* str = NULL; struct msghdr msg; msg.msg_control = 0; t = ctime_r(&time, buf); tv.tv_usec = 10; srandom(32); a = getopt(2, opts, "a"); a = isascii(32); str = gai_strerror(0); if(str && t && tv.tv_usec && msg.msg_control) a = 0; return a; } ], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE"]) ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE, [ #include "confdefs.h" #include #include #include #ifdef HAVE_TIME_H #include #endif #include #include #ifdef HAVE_GETOPT_H #include #endif int test() { int a; char **opts = NULL; struct timeval tv; char *t; time_t time = 0; char *buf = NULL; const char* str = NULL; struct msghdr msg; msg.msg_control = 0; t = ctime_r(&time, buf); tv.tv_usec = 10; srandom(32); a = getopt(2, opts, "a"); a = isascii(32); str = gai_strerror(0); if(str && t && tv.tv_usec && msg.msg_control) a = 0; return a; } ], [CFLAGS="$CFLAGS $C99FLAG -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE"]) ACX_CHECK_COMPILER_FLAG_NEEDED($C99FLAG, [ #include #include int test() { int a = 0; return a; } ], [CFLAGS="$CFLAGS $C99FLAG"]) ACX_CHECK_COMPILER_FLAG_NEEDED(-D_BSD_SOURCE, [ #include int test() { int a; a = isascii(32); return a; } ], [CFLAGS="$CFLAGS -D_BSD_SOURCE"]) ACX_CHECK_COMPILER_FLAG_NEEDED(-D_GNU_SOURCE, [ #include int test() { struct in6_pktinfo inf; int a = (int)sizeof(inf); return a; } ], [CFLAGS="$CFLAGS -D_GNU_SOURCE"]) # check again for GNU_SOURCE for setresgid. May fail if setresgid # is not available at all. -D_FRSRESGID is to make this check unique. # otherwise we would get the previous cached result. ACX_CHECK_COMPILER_FLAG_NEEDED(-D_GNU_SOURCE -D_FRSRESGID, [ #include int test() { int a = setresgid(0,0,0); a = setresuid(0,0,0); return a; } ], [CFLAGS="$CFLAGS -D_GNU_SOURCE"]) ACX_CHECK_COMPILER_FLAG_NEEDED(-D_POSIX_C_SOURCE=200112, [ #include "confdefs.h" #ifdef HAVE_TIME_H #include #endif #include int test() { int a = 0; char *t; time_t time = 0; char *buf = NULL; const char* str = NULL; t = ctime_r(&time, buf); str = gai_strerror(0); if(t && str) a = 0; return a; } ], [CFLAGS="$CFLAGS -D_POSIX_C_SOURCE=200112"]) ACX_CHECK_COMPILER_FLAG_NEEDED(-D__EXTENSIONS__, [ #include "confdefs.h" #include #include #include #ifdef HAVE_TIME_H #include #endif #include #ifdef HAVE_GETOPT_H #include #endif int test() { int a; char **opts = NULL; struct timeval tv; tv.tv_usec = 10; srandom(32); a = getopt(2, opts, "a"); a = isascii(32); if(tv.tv_usec) a = 0; return a; } ], [CFLAGS="$CFLAGS -D__EXTENSIONS__"]) ])dnl End of ACX_DETERMINE_EXT_FLAGS_UNBOUND dnl Check if CC supports -flto. dnl in a way that supports clang and suncc (that flag does something else, dnl but fails to link). It sets it in CFLAGS if it works. AC_DEFUN([ACX_CHECK_FLTO], [ AC_ARG_ENABLE([flto], AS_HELP_STRING([--disable-flto], [Disable link-time optimization])) AS_IF([test "x$enable_flto" != "xno"], [ AC_MSG_CHECKING([if $CC supports -flto]) BAKCFLAGS="$CFLAGS" CFLAGS="$CFLAGS -flto" AC_LINK_IFELSE([AC_LANG_PROGRAM([], [])], [ if $CC $CFLAGS -o conftest conftest.c 2>&1 | grep "warning: no debug symbols in executable" >/dev/null; then CFLAGS="$BAKCFLAGS" AC_MSG_RESULT(no) else AC_MSG_RESULT(yes) fi rm -f conftest conftest.c conftest.o ], [CFLAGS="$BAKCFLAGS" ; AC_MSG_RESULT(no)]) ]) ]) dnl Check the printf-format attribute (if any) dnl result in HAVE_ATTR_FORMAT. dnl Make sure you also include the AHX_CONFIG_FORMAT_ATTRIBUTE. AC_DEFUN([ACX_CHECK_FORMAT_ATTRIBUTE], [AC_REQUIRE([AC_PROG_CC]) AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "format" attribute) AC_CACHE_VAL(ac_cv_c_format_attribute, [ac_cv_c_format_attribute=no AC_TRY_COMPILE( [#include void f (char *format, ...) __attribute__ ((format (printf, 1, 2))); void (*pf) (char *format, ...) __attribute__ ((format (printf, 1, 2))); ], [ f ("%s", "str"); ], [ac_cv_c_format_attribute="yes"], [ac_cv_c_format_attribute="no"]) ]) AC_MSG_RESULT($ac_cv_c_format_attribute) if test $ac_cv_c_format_attribute = yes; then AC_DEFINE(HAVE_ATTR_FORMAT, 1, [Whether the C compiler accepts the "format" attribute]) fi ])dnl End of ACX_CHECK_FORMAT_ATTRIBUTE dnl Setup ATTR_FORMAT config.h parts. dnl make sure you call ACX_CHECK_FORMAT_ATTRIBUTE also. AC_DEFUN([AHX_CONFIG_FORMAT_ATTRIBUTE], [ #ifdef HAVE_ATTR_FORMAT # define ATTR_FORMAT(archetype, string_index, first_to_check) \ __attribute__ ((format (archetype, string_index, first_to_check))) #else /* !HAVE_ATTR_FORMAT */ # define ATTR_FORMAT(archetype, string_index, first_to_check) /* empty */ #endif /* !HAVE_ATTR_FORMAT */ ]) dnl Check how to mark function arguments as unused. dnl result in HAVE_ATTR_UNUSED. dnl Make sure you include AHX_CONFIG_UNUSED_ATTRIBUTE also. AC_DEFUN([ACX_CHECK_UNUSED_ATTRIBUTE], [AC_REQUIRE([AC_PROG_CC]) AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "unused" attribute) AC_CACHE_VAL(ac_cv_c_unused_attribute, [ac_cv_c_unused_attribute=no AC_TRY_COMPILE( [#include void f (char *u __attribute__((unused))); ], [ f ("x"); ], [ac_cv_c_unused_attribute="yes"], [ac_cv_c_unused_attribute="no"]) ]) dnl Setup ATTR_UNUSED config.h parts. dnl make sure you call ACX_CHECK_UNUSED_ATTRIBUTE also. AC_DEFUN([AHX_CONFIG_UNUSED_ATTRIBUTE], [ #if defined(DOXYGEN) # define ATTR_UNUSED(x) x #elif defined(__cplusplus) # define ATTR_UNUSED(x) #elif defined(HAVE_ATTR_UNUSED) # define ATTR_UNUSED(x) x __attribute__((unused)) #else /* !HAVE_ATTR_UNUSED */ # define ATTR_UNUSED(x) x #endif /* !HAVE_ATTR_UNUSED */ ]) AC_MSG_RESULT($ac_cv_c_unused_attribute) if test $ac_cv_c_unused_attribute = yes; then AC_DEFINE(HAVE_ATTR_UNUSED, 1, [Whether the C compiler accepts the "unused" attribute]) fi ])dnl dnl Pre-fun for ACX_LIBTOOL_C_ONLY AC_DEFUN([ACX_LIBTOOL_C_PRE], [ # skip these tests, we do not need them. AC_DEFUN([AC_PROG_F77], [:]) AC_DEFUN([AC_PROG_FC], [:]) AC_DEFUN([AC_PROG_CXX], [:]) AC_DEFUN([AC_PROG_CXXCPP], [:]) AC_DEFUN([AC_PROG_OBJC], [:]) AC_DEFUN([AC_PROG_OBJCCPP], [:]) AC_DEFUN([AC_LIBTOOL_CXX], [:]) AC_DEFUN([AC_LIBTOOL_F77], [:]) # always use ./libtool unless override from commandline (libtool=mylibtool) if test -z "$libtool"; then libtool="./libtool" fi AC_SUBST(libtool) # avoid libtool max commandline length test on systems that fork slowly. AC_CANONICAL_HOST if echo "$host_os" | grep "sunos4" >/dev/null; then lt_cv_sys_max_cmd_len=32750; fi AC_PATH_TOOL(AR, ar, [false]) if test $AR = false; then AC_MSG_ERROR([Cannot find 'ar', please extend PATH to include it]) fi ]) dnl Perform libtool check, portably, only for C AC_DEFUN([ACX_LIBTOOL_C_ONLY], [ dnl as a requirement so that is gets called before LIBTOOL dnl because libtools 'AC_REQUIRE' names are right after this one, before dnl this function contents. AC_REQUIRE([ACX_LIBTOOL_C_PRE]) AC_PROG_LIBTOOL ]) dnl Detect if u_char type is defined, otherwise define it. AC_DEFUN([ACX_TYPE_U_CHAR], [AC_CHECK_TYPE([u_char], , [AC_DEFINE([u_char], [unsigned char], [Define to 'unsigned char if not defined])], [ AC_INCLUDES_DEFAULT #ifdef HAVE_WINSOCK2_H # include #endif ]) ]) dnl Detect if rlim_t type is defined, otherwise define it. AC_DEFUN([ACX_TYPE_RLIM_T], [AC_CHECK_TYPE(rlim_t, , [AC_DEFINE([rlim_t], [unsigned long], [Define to 'int' if not defined])], [ AC_INCLUDES_DEFAULT #ifdef HAVE_SYS_RESOURCE_H # include #endif ]) ]) dnl Detect if socklen_t type is defined, otherwise define it. AC_DEFUN([ACX_TYPE_SOCKLEN_T], [ AC_CHECK_TYPE(socklen_t, , [AC_DEFINE([socklen_t], [int], [Define to 'int' if not defined])], [ AC_INCLUDES_DEFAULT #ifdef HAVE_SYS_SOCKET_H # include #endif #ifdef HAVE_WS2TCPIP_H # include #endif ]) ]) dnl Detect if in_addr_t type is defined, otherwise define it. AC_DEFUN([ACX_TYPE_IN_ADDR_T], [ AC_CHECK_TYPE(in_addr_t, [], [AC_DEFINE([in_addr_t], [uint32_t], [in_addr_t])], [ AC_INCLUDES_DEFAULT #ifdef HAVE_SYS_TYPES_H # include #endif #ifdef HAVE_NETINET_IN_H # include #endif ]) ]) dnl Detect if in_port_t type is defined, otherwise define it. AC_DEFUN([ACX_TYPE_IN_PORT_T], [ AC_CHECK_TYPE(in_port_t, [], [AC_DEFINE([in_port_t], [uint16_t], [in_port_t])], [ AC_INCLUDES_DEFAULT #ifdef HAVE_SYS_TYPES_H # include #endif #ifdef HAVE_NETINET_IN_H # include #endif ]) ]) dnl Add option to disable the evil rpath. Check whether to use rpath or not. dnl Adds the --disable-rpath option. Uses trick to edit the ./libtool. AC_DEFUN([ACX_ARG_RPATH], [ AC_ARG_ENABLE(rpath, [ --disable-rpath disable hardcoded rpath (default=enabled)], enable_rpath=$enableval, enable_rpath=yes) if test "x$enable_rpath" = xno; then dnl AC_MSG_RESULT([Fixing libtool for -rpath problems.]) AC_CONFIG_COMMANDS([disable-rpath], [ sed < libtool > libtool-2 \ 's/^hardcode_libdir_flag_spec.*$'/'hardcode_libdir_flag_spec=" -D__LIBTOOL_RPATH_SED__ "/' mv libtool-2 libtool chmod 755 libtool libtool="./libtool" ]) fi ]) dnl Add a -R to the RUNTIME_PATH. Only if rpath is enabled and it is dnl an absolute path. dnl $1: the pathname to add. AC_DEFUN([ACX_RUNTIME_PATH_ADD], [ if test "x$enable_rpath" = xyes; then if echo "$1" | grep "^/" >/dev/null; then RUNTIME_PATH="$RUNTIME_PATH -R$1" fi fi ]) dnl Common code for both ACX_WITH_SSL and ACX_WITH_SSL_OPTIONAL dnl Takes one argument; the withval checked in those 2 functions dnl sets up the environment for the given openssl path AC_DEFUN([ACX_SSL_CHECKS], [ withval=$1 if test x_$withval != x_no; then AC_MSG_CHECKING(for SSL) if test x_$withval = x_ -o x_$withval = x_yes; then withval="/usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr" fi for dir in $withval; do ssldir="$dir" if test -f "$dir/include/openssl/ssl.h"; then found_ssl="yes" AC_DEFINE_UNQUOTED([HAVE_SSL], [], [Define if you have the SSL libraries installed.]) dnl assume /usr/include is already in the include-path. if test "$ssldir" != "/usr"; then CPPFLAGS="$CPPFLAGS -I$ssldir/include" LIBSSL_CPPFLAGS="$LIBSSL_CPPFLAGS -I$ssldir/include" fi break; fi done if test x_$found_ssl != x_yes; then AC_MSG_ERROR(Cannot find the SSL libraries in $withval) else AC_MSG_RESULT(found in $ssldir) HAVE_SSL=yes dnl assume /usr is already in the lib and dynlib paths. if test "$ssldir" != "/usr" -a "$ssldir" != ""; then LDFLAGS="$LDFLAGS -L$ssldir/lib" LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib" ACX_RUNTIME_PATH_ADD([$ssldir/lib]) fi AC_MSG_CHECKING([for HMAC_CTX_init in -lcrypto]) LIBS="$LIBS -lcrypto" LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto" AC_TRY_LINK(, [ int HMAC_CTX_init(void); (void)HMAC_CTX_init(); ], [ AC_MSG_RESULT(yes) AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, [If you have HMAC_CTX_init]) ], [ AC_MSG_RESULT(no) # check if -lwsock32 or -lgdi32 are needed. BAKLIBS="$LIBS" BAKSSLLIBS="$LIBSSL_LIBS" LIBS="$LIBS -lgdi32" LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32" AC_MSG_CHECKING([if -lcrypto needs -lgdi32]) AC_TRY_LINK([], [ int HMAC_CTX_init(void); (void)HMAC_CTX_init(); ],[ AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, [If you have HMAC_CTX_init]) AC_MSG_RESULT(yes) ],[ AC_MSG_RESULT(no) LIBS="$BAKLIBS" LIBSSL_LIBS="$BAKSSLLIBS" LIBS="$LIBS -ldl" LIBSSL_LIBS="$LIBSSL_LIBS -ldl" AC_MSG_CHECKING([if -lcrypto needs -ldl]) AC_TRY_LINK([], [ int HMAC_CTX_init(void); (void)HMAC_CTX_init(); ],[ AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, [If you have HMAC_CTX_init]) AC_MSG_RESULT(yes) ],[ AC_MSG_RESULT(no) AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required]) ]) ]) ]) fi AC_SUBST(HAVE_SSL) AC_SUBST(RUNTIME_PATH) # openssl engine functionality needs dlopen(). BAKLIBS="$LIBS" AC_SEARCH_LIBS([dlopen], [dl]) if test "$LIBS" != "$BAKLIBS"; then LIBSSL_LIBS="$LIBSSL_LIBS -ldl" fi fi AC_CHECK_HEADERS([openssl/ssl.h],,, [AC_INCLUDES_DEFAULT]) AC_CHECK_HEADERS([openssl/err.h],,, [AC_INCLUDES_DEFAULT]) AC_CHECK_HEADERS([openssl/rand.h],,, [AC_INCLUDES_DEFAULT]) ])dnl End of ACX_SSL_CHECKS dnl Check for SSL, where SSL is mandatory dnl Adds --with-ssl option, searches for openssl and defines HAVE_SSL if found dnl Setup of CPPFLAGS, CFLAGS. Adds -lcrypto to LIBS. dnl Checks main header files of SSL. dnl AC_DEFUN([ACX_WITH_SSL], [ AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname], [enable SSL (will check /usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr)]),[ ],[ withval="yes" ]) if test x_$withval = x_no; then AC_MSG_ERROR([Need SSL library to do digital signature cryptography]) fi ACX_SSL_CHECKS($withval) ])dnl End of ACX_WITH_SSL dnl Check for SSL, where ssl is optional (--without-ssl is allowed) dnl Adds --with-ssl option, searches for openssl and defines HAVE_SSL if found dnl Setup of CPPFLAGS, CFLAGS. Adds -lcrypto to LIBS. dnl Checks main header files of SSL. dnl AC_DEFUN([ACX_WITH_SSL_OPTIONAL], [ AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname], [enable SSL (will check /usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr)]),[ ],[ withval="yes" ]) ACX_SSL_CHECKS($withval) ])dnl End of ACX_WITH_SSL_OPTIONAL dnl Setup to use -lssl dnl To use -lcrypto, use the ACX_WITH_SSL setup (before this one). AC_DEFUN([ACX_LIB_SSL], [ # check if libssl needs libdl BAKLIBS="$LIBS" LIBS="-lssl $LIBS" AC_MSG_CHECKING([if libssl needs libdl]) AC_TRY_LINK_FUNC([SSL_CTX_new], [ AC_MSG_RESULT([no]) LIBS="$BAKLIBS" ] , [ AC_MSG_RESULT([yes]) LIBS="$BAKLIBS" AC_SEARCH_LIBS([dlopen], [dl]) ]) ])dnl End of ACX_LIB_SSL dnl Setup to use very large files (>2Gb). dnl setups fseeko and its own AC_DEFUN([ACX_SYS_LARGEFILE], [ AC_SYS_LARGEFILE dnl try to see if an additional _LARGEFILE_SOURCE 1 is needed to get fseeko ACX_CHECK_COMPILER_FLAG_NEEDED(-D_LARGEFILE_SOURCE=1, [ #include int test() { int a = fseeko(stdin, 0, 0); return a; } ], [CFLAGS="$CFLAGS -D_LARGEFILE_SOURCE=1"]) ]) dnl Check getaddrinfo. dnl Works on linux, solaris, bsd and windows(links winsock). dnl defines HAVE_GETADDRINFO, USE_WINSOCK. AC_DEFUN([ACX_CHECK_GETADDRINFO_WITH_INCLUDES], [AC_REQUIRE([AC_PROG_CC]) AC_MSG_CHECKING(for getaddrinfo) ac_cv_func_getaddrinfo=no AC_LINK_IFELSE( [AC_LANG_SOURCE([[ #ifdef __cplusplus extern "C" { #endif char* getaddrinfo(); char* (*f) () = getaddrinfo; #ifdef __cplusplus } #endif int main() { ; return 0; } ]])], dnl this case on linux, solaris, bsd [ac_cv_func_getaddrinfo="yes" dnl see if on windows if test "$ac_cv_header_windows_h" = "yes"; then AC_DEFINE(USE_WINSOCK, 1, [Whether the windows socket API is used]) USE_WINSOCK="1" LIBS="$LIBS -lws2_32" fi ], dnl no quick getaddrinfo, try mingw32 and winsock2 library. ORIGLIBS="$LIBS" LIBS="$LIBS -lws2_32" AC_LINK_IFELSE( [AC_LANG_PROGRAM( [ #ifdef HAVE_WS2TCPIP_H #include #endif ], [ (void)getaddrinfo(NULL, NULL, NULL, NULL); ] )], [ ac_cv_func_getaddrinfo="yes" dnl already: LIBS="$LIBS -lws2_32" AC_DEFINE(USE_WINSOCK, 1, [Whether the windows socket API is used]) USE_WINSOCK="1" ], [ ac_cv_func_getaddrinfo="no" LIBS="$ORIGLIBS" ]) ) AC_MSG_RESULT($ac_cv_func_getaddrinfo) if test $ac_cv_func_getaddrinfo = yes; then AC_DEFINE(HAVE_GETADDRINFO, 1, [Whether getaddrinfo is available]) fi ])dnl Endof AC_CHECK_GETADDRINFO_WITH_INCLUDES dnl check if a function is deprecated. defines DEPRECATED_func in config.h. dnl $1: function name dnl $2: C-statement that calls the function. dnl $3: includes for the program. dnl $4: executes if yes dnl $5: executes if no AC_DEFUN([ACX_FUNC_DEPRECATED], [ AC_REQUIRE([AC_PROG_CC]) AC_MSG_CHECKING(if $1 is deprecated) cache=`echo $1 | sed 'y%.=/+-%___p_%'` AC_CACHE_VAL(cv_cc_deprecated_$cache, [ echo '$3' >conftest.c echo 'void f(){ $2 }' >>conftest.c if test -z "`$CC -c conftest.c 2>&1 | grep deprecated`"; then eval "cv_cc_deprecated_$cache=no" else eval "cv_cc_deprecated_$cache=yes" fi rm -f conftest conftest.o conftest.c ]) if eval "test \"`echo '$cv_cc_deprecated_'$cache`\" = yes"; then AC_MSG_RESULT(yes) AC_DEFINE_UNQUOTED(AS_TR_CPP([DEPRECATED_$1]), 1, [Whether $1 is deprecated]) : $4 else AC_MSG_RESULT(no) : $5 fi ])dnl end of ACX_FUNC_DEPRECATED dnl check if select and nonblocking sockets actually work. dnl Needs fork(2) and select(2). dnl defines NONBLOCKING_IS_BROKEN, and if that is true multiple reads from dnl a nonblocking socket do not work, a new call to select is necessary. AC_DEFUN([ACX_CHECK_NONBLOCKING_BROKEN], [ AC_MSG_CHECKING([if nonblocking sockets work]) if echo $target | grep mingw32 >/dev/null; then AC_MSG_RESULT([no (windows)]) AC_DEFINE([NONBLOCKING_IS_BROKEN], 1, [Define if the network stack does not fully support nonblocking io (causes lower performance).]) else AC_RUN_IFELSE([ AC_LANG_SOURCE([[ #include #include #include #include #include #ifdef HAVE_SYS_TYPES_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_NETINET_IN_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif #ifdef HAVE_UNISTD_H #include #endif #ifdef HAVE_TIME_H #include #endif int main(void) { int port; int sfd, cfd; int num = 10; int i, p; struct sockaddr_in a; /* test if select and nonblocking reads work well together */ /* open port. fork child to send 10 messages. select to read. then try to nonblocking read the 10 messages then, nonblocking read must give EAGAIN */ port = 12345 + (time(0)%32); sfd = socket(PF_INET, SOCK_DGRAM, 0); if(sfd == -1) { perror("socket"); return 1; } memset(&a, 0, sizeof(a)); a.sin_family = AF_INET; a.sin_port = htons(port); a.sin_addr.s_addr = inet_addr("127.0.0.1"); if(bind(sfd, (struct sockaddr*)&a, sizeof(a)) < 0) { perror("bind"); return 1; } if(fcntl(sfd, F_SETFL, O_NONBLOCK) == -1) { perror("fcntl"); return 1; } cfd = socket(PF_INET, SOCK_DGRAM, 0); if(cfd == -1) { perror("client socket"); return 1; } a.sin_port = 0; if(bind(cfd, (struct sockaddr*)&a, sizeof(a)) < 0) { perror("client bind"); return 1; } a.sin_port = htons(port); /* no handler, causes exit in 10 seconds */ alarm(10); /* send and receive on the socket */ if((p=fork()) == 0) { for(i=0; i #include #ifdef HAVE_WINSOCK2_H #include #endif #ifdef HAVE_SYS_STAT_H #include #endif ], [ (void)mkdir("directory"); ], AC_MSG_RESULT(yes) AC_DEFINE(MKDIR_HAS_ONE_ARG, 1, [Define if mkdir has one argument.]) , AC_MSG_RESULT(no) ) ])dnl end of ACX_MKDIR_ONE_ARG dnl Check for ioctlsocket function. works on mingw32 too. AC_DEFUN([ACX_FUNC_IOCTLSOCKET], [ # check ioctlsocket AC_MSG_CHECKING(for ioctlsocket) AC_LINK_IFELSE([AC_LANG_PROGRAM([ #ifdef HAVE_WINSOCK2_H #include #endif ], [ (void)ioctlsocket(0, 0, NULL); ])], [ AC_MSG_RESULT(yes) AC_DEFINE(HAVE_IOCTLSOCKET, 1, [if the function 'ioctlsocket' is available]) ],[AC_MSG_RESULT(no)]) ])dnl end of ACX_FUNC_IOCTLSOCKET dnl detect malloc and provide malloc compat prototype. dnl $1: unique name for compat code AC_DEFUN([ACX_FUNC_MALLOC], [ AC_MSG_CHECKING([for GNU libc compatible malloc]) AC_RUN_IFELSE([AC_LANG_PROGRAM( [[#if defined STDC_HEADERS || defined HAVE_STDLIB_H #include #else char *malloc (); #endif ]], [ if(malloc(0) != 0) return 1;]) ], [AC_MSG_RESULT([no]) AC_LIBOBJ(malloc) AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if replacement function should be used.])] , [AC_MSG_RESULT([yes]) AC_DEFINE([HAVE_MALLOC], 1, [If have GNU libc compatible malloc])], [AC_MSG_RESULT([no (crosscompile)]) AC_LIBOBJ(malloc) AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if replacement function should be used.])] ) ]) dnl Define fallback for fseeko and ftello if needed. AC_DEFUN([AHX_CONFIG_FSEEKO], [ #ifndef HAVE_FSEEKO #define fseeko fseek #define ftello ftell #endif /* HAVE_FSEEKO */ ]) dnl Define RAND_MAX if not defined AC_DEFUN([AHX_CONFIG_RAND_MAX], [ #ifndef RAND_MAX #define RAND_MAX 2147483647 #endif ]) dnl Define MAXHOSTNAMELEN if not defined AC_DEFUN([AHX_CONFIG_MAXHOSTNAMELEN], [ #ifndef MAXHOSTNAMELEN #define MAXHOSTNAMELEN 256 #endif ]) dnl Define IPV6_MIN_MTU if not defined AC_DEFUN([AHX_CONFIG_IPV6_MIN_MTU], [ #ifndef IPV6_MIN_MTU #define IPV6_MIN_MTU 1280 #endif /* IPV6_MIN_MTU */ ]) dnl provide snprintf, vsnprintf compat prototype dnl $1: unique name for compat code AC_DEFUN([AHX_CONFIG_SNPRINTF], [ #ifndef HAVE_SNPRINTF #define snprintf snprintf_$1 #define vsnprintf vsnprintf_$1 #include int snprintf (char *str, size_t count, const char *fmt, ...); int vsnprintf (char *str, size_t count, const char *fmt, va_list arg); #endif /* HAVE_SNPRINTF */ ]) dnl provide inet_pton compat prototype. dnl $1: unique name for compat code AC_DEFUN([AHX_CONFIG_INET_PTON], [ #ifndef HAVE_INET_PTON #define inet_pton inet_pton_$1 int inet_pton(int af, const char* src, void* dst); #endif /* HAVE_INET_PTON */ ]) dnl provide inet_ntop compat prototype. dnl $1: unique name for compat code AC_DEFUN([AHX_CONFIG_INET_NTOP], [ #ifndef HAVE_INET_NTOP #define inet_ntop inet_ntop_$1 const char *inet_ntop(int af, const void *src, char *dst, size_t size); #endif ]) dnl provide inet_aton compat prototype. dnl $1: unique name for compat code AC_DEFUN([AHX_CONFIG_INET_ATON], [ #ifndef HAVE_INET_ATON #define inet_aton inet_aton_$1 int inet_aton(const char *cp, struct in_addr *addr); #endif ]) dnl provide memmove compat prototype. dnl $1: unique name for compat code AC_DEFUN([AHX_CONFIG_MEMMOVE], [ #ifndef HAVE_MEMMOVE #define memmove memmove_$1 void *memmove(void *dest, const void *src, size_t n); #endif ]) dnl provide strlcat compat prototype. dnl $1: unique name for compat code AC_DEFUN([AHX_CONFIG_STRLCAT], [ #ifndef HAVE_STRLCAT #define strlcat strlcat_$1 size_t strlcat(char *dst, const char *src, size_t siz); #endif ]) dnl provide strlcpy compat prototype. dnl $1: unique name for compat code AC_DEFUN([AHX_CONFIG_STRLCPY], [ #ifndef HAVE_STRLCPY #define strlcpy strlcpy_$1 size_t strlcpy(char *dst, const char *src, size_t siz); #endif ]) dnl provide gmtime_r compat prototype. dnl $1: unique name for compat code AC_DEFUN([AHX_CONFIG_GMTIME_R], [ #ifndef HAVE_GMTIME_R #define gmtime_r gmtime_r_$1 struct tm *gmtime_r(const time_t *timep, struct tm *result); #endif ]) dnl provide w32 compat definition for sleep AC_DEFUN([AHX_CONFIG_W32_SLEEP], [ #if !defined(HAVE_SLEEP) || defined(HAVE_WINDOWS_H) #define sleep(x) Sleep((x)*1000) /* on win32 */ #endif /* HAVE_SLEEP */ ]) dnl provide w32 compat definition for usleep AC_DEFUN([AHX_CONFIG_W32_USLEEP], [ #ifndef HAVE_USLEEP #define usleep(x) Sleep((x)/1000 + 1) /* on win32 */ #endif /* HAVE_USLEEP */ ]) dnl provide w32 compat definition for random AC_DEFUN([AHX_CONFIG_W32_RANDOM], [ #ifndef HAVE_RANDOM #define random rand /* on win32, for tests only (bad random) */ #endif /* HAVE_RANDOM */ ]) dnl provide w32 compat definition for srandom AC_DEFUN([AHX_CONFIG_W32_SRANDOM], [ #ifndef HAVE_SRANDOM #define srandom(x) srand(x) /* on win32, for tests only (bad random) */ #endif /* HAVE_SRANDOM */ ]) dnl provide w32 compat definition for FD_SET_T AC_DEFUN([AHX_CONFIG_W32_FD_SET_T], [ /* detect if we need to cast to unsigned int for FD_SET to avoid warnings */ #ifdef HAVE_WINSOCK2_H #define FD_SET_T (u_int) #else #define FD_SET_T #endif ]) dnl Remove an extension flag from CFLAGS, define replacement to be made. dnl Used by ACX_STRIP_EXT_FLAGS. dnl $1: the name of the flag, for example -D_GNU_SOURCE. AC_DEFUN([ACX_CFLAGS_STRIP], [ if echo $CFLAGS | grep " $1" >/dev/null 2>&1; then CFLAGS="`echo $CFLAGS | sed -e 's/ $1//g'`" AC_DEFINE(m4_bpatsubst(OMITTED_$1,[[-=]],_), 1, Put $1 define in config.h) fi ]) dnl Remove EXT flags from the CFLAGS and set them to be defined in config.h dnl use with ACX_DETERMINE_EXT_FLAGS. AC_DEFUN([ACX_STRIP_EXT_FLAGS], [ AC_MSG_NOTICE([Stripping extension flags...]) ACX_CFLAGS_STRIP(-D_GNU_SOURCE) ACX_CFLAGS_STRIP(-D_BSD_SOURCE) ACX_CFLAGS_STRIP(-D__EXTENSIONS__) ACX_CFLAGS_STRIP(-D_POSIX_C_SOURCE=200112) ACX_CFLAGS_STRIP(-D_XOPEN_SOURCE=600) ACX_CFLAGS_STRIP(-D_XOPEN_SOURCE_EXTENDED=1) ACX_CFLAGS_STRIP(-D_ALL_SOURCE) ACX_CFLAGS_STRIP(-D_LARGEFILE_SOURCE=1) ]) dnl End of ACX_STRIP_EXT_FLAGS dnl define one omitted flag for config.h dnl $1: flag name. -D_GNU_SOURCE dnl $2: replacement define. _GNU_SOURCE dnl $3: define value, 1 AC_DEFUN([AHX_CONFIG_FLAG_OMITTED], [#if defined($1) && !defined($2) #define $2 $3 [#]endif ]) dnl Wrapper for AHX_CONFIG_FLAG_OMITTED for -D style flags dnl $1: the -DNAME or -DNAME=value string. AC_DEFUN([AHX_CONFIG_FLAG_EXT], [AHX_CONFIG_FLAG_OMITTED(m4_bpatsubst(OMITTED_$1,[[-=]],_),m4_bpatsubst(m4_bpatsubst($1,-D,),=.*$,),m4_if(m4_bregexp($1,=),-1,1,m4_bpatsubst($1,^.*=,))) ]) dnl config.h part to define omitted cflags, use with ACX_STRIP_EXT_FLAGS. AC_DEFUN([AHX_CONFIG_EXT_FLAGS], [AHX_CONFIG_FLAG_EXT(-D_GNU_SOURCE) AHX_CONFIG_FLAG_EXT(-D_BSD_SOURCE) AHX_CONFIG_FLAG_EXT(-D__EXTENSIONS__) AHX_CONFIG_FLAG_EXT(-D_POSIX_C_SOURCE=200112) AHX_CONFIG_FLAG_EXT(-D_XOPEN_SOURCE=600) AHX_CONFIG_FLAG_EXT(-D_XOPEN_SOURCE_EXTENDED=1) AHX_CONFIG_FLAG_EXT(-D_ALL_SOURCE) AHX_CONFIG_FLAG_EXT(-D_LARGEFILE_SOURCE=1) ]) dnl check if memcmp is using signed characters and replace if so. AC_DEFUN([ACX_CHECK_MEMCMP_SIGNED], [AC_MSG_CHECKING([if memcmp compares unsigned]) AC_RUN_IFELSE([AC_LANG_SOURCE([[ #include #include #include int main(void) { char a = 255, b = 0; if(memcmp(&a, &b, 1) < 0) return 1; return 0; } ]])], [AC_MSG_RESULT([yes]) ], [ AC_MSG_RESULT([no]) AC_DEFINE([MEMCMP_IS_BROKEN], [1], [Define if memcmp() does not compare unsigned bytes]) AC_LIBOBJ([memcmp]) ], [ AC_MSG_RESULT([cross-compile no]) AC_DEFINE([MEMCMP_IS_BROKEN], [1], [Define if memcmp() does not compare unsigned bytes]) AC_LIBOBJ([memcmp]) ]) ]) dnl define memcmp to its replacement, pass unique id for program as arg AC_DEFUN([AHX_MEMCMP_BROKEN], [ #ifdef MEMCMP_IS_BROKEN #include "compat/memcmp.h" #define memcmp memcmp_$1 int memcmp(const void *x, const void *y, size_t n); #endif ]) dnl ACX_CHECK_SS_FAMILY - check for sockaddr_storage.ss_family AC_DEFUN([ACX_CHECK_SS_FAMILY], [AC_CHECK_MEMBER([struct sockaddr_storage.ss_family], [], [ AC_CHECK_MEMBER([struct sockaddr_storage.__ss_family], [ AC_DEFINE([ss_family], [__ss_family], [Fallback member name for socket family in struct sockaddr_storage]) ],, [AC_INCLUDES_DEFAULT #ifdef HAVE_NETINET_IN_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_NETDB_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif ]) ], [AC_INCLUDES_DEFAULT #ifdef HAVE_NETINET_IN_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_NETDB_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif ]) ]) dnl End of file nsd-3.2.16/dname.h0000664000175000017500000002210612166742755012630 0ustar matjematje/* * dname.h -- Domain name handling. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _DNAME_H_ #define _DNAME_H_ #include #include #include "buffer.h" #include "region-allocator.h" #if defined(NAMEDB_UPPERCASE) || defined(USE_NAMEDB_UPPERCASE) #define DNAME_NORMALIZE toupper #else #define DNAME_NORMALIZE tolower #endif /* * Domain names stored in memory add some additional information to be * able to quickly index and compare by label. */ typedef struct dname dname_type; struct dname { /* * The size (in bytes) of the domain name in wire format. */ uint8_t name_size; /* * The number of labels in this domain name (including the * root label). */ uint8_t label_count; /* uint8_t label_offsets[label_count]; uint8_t name[name_size]; */ }; /* * Construct a new domain name based on NAME in wire format. NAME * cannot contain compression pointers. * * Pre: NAME != NULL. */ const dname_type *dname_make(region_type *region, const uint8_t *name, int normalize); /* * Construct a new domain name based on wire format dname stored at * PACKET's current position. Compression pointers are followed. The * PACKET's current position is changed to the end of the wire format * dname or set to just after the first compression pointer. */ const dname_type *dname_make_from_packet(region_type *region, buffer_type *packet, int allow_pointers, int normalize); /* * parse wireformat from packet (following pointers) into the * given buffer. Returns length in buffer or 0 on error. * buffer must be MAXDOMAINLEN+1 long. */ int dname_make_wire_from_packet(uint8_t *buf, buffer_type *packet, int allow_pointers); /* * Construct a new domain name based on the ASCII representation NAME. * If ORIGIN is not NULL and NAME is not terminated by a "." the * ORIGIN is appended to the result. NAME can contain escape * sequences. * * Returns NULL on failure. Otherwise a newly allocated domain name * is returned. * * Pre: name != NULL. */ const dname_type *dname_parse(region_type *region, const char *name); /* * parse ascii string to wireformat domain name (without compression ptrs) * returns 0 on failure, the length of the wireformat on success. * the result is stored in the wirefmt which must be at least MAXDOMAINLEN * in size. On failure, the wirefmt can be altered. */ int dname_parse_wire(uint8_t* wirefmt, const char* name); /* * Return NULL if DNAME is NULL or a copy of DNAME otherwise. */ const dname_type *dname_copy(region_type *region, const dname_type *dname); /* * Copy the most significant LABEL_COUNT labels from dname. */ const dname_type *dname_partial_copy(region_type *region, const dname_type *dname, uint8_t label_count); /* * The origin of DNAME. */ const dname_type *dname_origin(region_type *region, const dname_type *dname); /* * Return true if LEFT is a subdomain of RIGHT. */ int dname_is_subdomain(const dname_type *left, const dname_type *right); /* * Offsets into NAME for each label starting with the most * significant label (the root label, followed by the TLD, * etc). */ static inline const uint8_t * dname_label_offsets(const dname_type *dname) { return (const uint8_t *) ((const char *) dname + sizeof(dname_type)); } /* * The actual name in wire format (a sequence of label, each * prefixed by a length byte, terminated by a zero length * label). */ static inline const uint8_t * dname_name(const dname_type *dname) { return (const uint8_t *) ((const char *) dname + sizeof(dname_type) + dname->label_count * sizeof(uint8_t)); } /* * Return the label for DNAME specified by LABEL_INDEX. The first * label (LABEL_INDEX == 0) is the root label, the next label is the * TLD, etc. * * Pre: dname != NULL && label_index < dname->label_count. */ static inline const uint8_t * dname_label(const dname_type *dname, uint8_t label) { uint8_t label_index; assert(dname != NULL); assert(label < dname->label_count); label_index = dname_label_offsets(dname)[label]; assert(label_index < dname->name_size); return dname_name(dname) + label_index; } /* * Compare two domain names. The comparison defines a lexographical * ordering based on the domain name's labels, starting with the most * significant label. * * Return < 0 if LEFT < RIGHT, 0 if LEFT == RIGHT, and > 0 if LEFT > * RIGHT. The comparison is case sensitive. * * Pre: vleft != NULL && vright != NULL */ int dname_compare(const void *vleft, const void *right); /* * Compare two labels. The comparison defines a lexographical * ordering based on the characters in the labels. * * Return < 0 if LEFT < RIGHT, 0 if LEFT == RIGHT, and > 0 if LEFT > * RIGHT. The comparison is case sensitive. * * Pre: left != NULL && right != NULL * label_is_normal(left) && label_is_normal(right) */ int label_compare(const uint8_t *left, const uint8_t *right); /* * Returns the number of labels that match in LEFT and RIGHT, starting * with the most significant label. Because the root label always * matches, the result will always be >= 1. * * Pre: left != NULL && right != NULL */ uint8_t dname_label_match_count(const dname_type *left, const dname_type *right); /* * The total size (in bytes) allocated to store DNAME. * * Pre: dname != NULL */ static inline size_t dname_total_size(const dname_type *dname) { return (sizeof(dname_type) + ((dname->label_count + dname->name_size) * sizeof(uint8_t))); } /* * Is LABEL a normal LABEL (not a pointer or reserved)? * * Pre: label != NULL; */ static inline int label_is_normal(const uint8_t *label) { assert(label); return (label[0] & 0xc0) == 0; } /* * Is LABEL a pointer? * * Pre: label != NULL; */ static inline int label_is_pointer(const uint8_t *label) { assert(label); return (label[0] & 0xc0) == 0xc0; } /* * LABEL's pointer location. * * Pre: label != NULL && label_is_pointer(label) */ static inline uint16_t label_pointer_location(const uint8_t *label) { assert(label); assert(label_is_pointer(label)); return ((uint16_t) (label[0] & ~0xc0) << 8) | (uint16_t) label[1]; } /* * Length of LABEL. * * Pre: label != NULL && label_is_normal(label) */ static inline uint8_t label_length(const uint8_t *label) { assert(label); assert(label_is_normal(label)); return label[0]; } /* * The data of LABEL. * * Pre: label != NULL && label_is_normal(label) */ static inline const uint8_t * label_data(const uint8_t *label) { assert(label); assert(label_is_normal(label)); return label + 1; } /* * Is LABEL the root label? * * Pre: label != NULL */ static inline int label_is_root(const uint8_t *label) { assert(label); return label[0] == 0; } /* * Is LABEL the wildcard label? * * Pre: label != NULL */ static inline int label_is_wildcard(const uint8_t *label) { assert(label); return label[0] == 1 && label[1] == '*'; } /* * The next label of LABEL. * * Pre: label != NULL * label_is_normal(label) * !label_is_root(label) */ static inline const uint8_t * label_next(const uint8_t *label) { assert(label); assert(label_is_normal(label)); assert(!label_is_root(label)); return label + label_length(label) + 1; } /* * Convert DNAME to its string representation. The result points to a * static buffer that is overwritten the next time this function is * invoked. * * If ORIGIN is provided and DNAME is a subdomain of ORIGIN the dname * will be represented relative to ORIGIN. * * Pre: dname != NULL */ const char *dname_to_string(const dname_type *dname, const dname_type *origin); /* * Convert DNAME to its string representation. This is a reentrant * version of dname_to_string. The buf argument is a pointer to a * user defined result buffer capable of holding the string representation * of a DNAME. Due to escape sequences and such, this buffer is recommeneded * to be at least 5 * MAXDOMAINLEN in size. * * If ORIGIN is provided and DNAME is a subdomain of ORIGIN the dname * will be represented relative to ORIGIN. * * Pre: dname != NULL */ const char *dname_to_string_r(const dname_type *dname, const dname_type *origin, char *buf); /* * Create a dname containing the single label specified by STR * followed by the root label. */ const dname_type *dname_make_from_label(region_type *region, const uint8_t *label, const size_t length); /* * Concatenate two dnames. */ const dname_type *dname_concatenate(region_type *region, const dname_type *left, const dname_type *right); /* * Perform DNAME substitution on a name, replace src with dest. * Name must be a subdomain of src. The returned name is a subdomain of dest. * Returns NULL if the result domain name is too long. */ const dname_type *dname_replace(region_type* region, const dname_type* name, const dname_type* src, const dname_type* dest); #ifndef FULL_PREHASH /** * Create a dname representing the wildcard form of the passed dname. */ int dname_make_wildcard(struct region *region, struct dname const *dname, struct dname const **wildcard); #endif #endif /* _DNAME_H_ */ nsd-3.2.16/dns.h0000664000175000017500000002360512162277142012322 0ustar matjematje/* * dns.h -- DNS definitions. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _DNS_H_ #define _DNS_H_ enum rr_section { QUESTION_SECTION, ANSWER_SECTION, AUTHORITY_SECTION, /* * Use a split authority section to ensure that optional * NS RRsets in the response can be omitted. */ OPTIONAL_AUTHORITY_SECTION, ADDITIONAL_SECTION, /* * Use a split additional section to ensure A records appear * before any AAAA records (this is recommended practice to * avoid truncating the additional section for IPv4 clients * that do not specify EDNS0), and AAAA records before other * types of additional records (such as X25 and ISDN). * Encode_answer sets the ARCOUNT field of the response packet * correctly. */ ADDITIONAL_A_SECTION = ADDITIONAL_SECTION, ADDITIONAL_AAAA_SECTION, ADDITIONAL_OTHER_SECTION, RR_SECTION_COUNT }; typedef enum rr_section rr_section_type; /* Possible OPCODE values */ #define OPCODE_QUERY 0 /* a standard query (QUERY) */ #define OPCODE_IQUERY 1 /* an inverse query (IQUERY) */ #define OPCODE_STATUS 2 /* a server status request (STATUS) */ #define OPCODE_NOTIFY 4 /* NOTIFY */ #define OPCODE_UPDATE 5 /* Dynamic update */ /* Possible RCODE values */ #define RCODE_OK 0 /* No error condition */ #define RCODE_FORMAT 1 /* Format error */ #define RCODE_SERVFAIL 2 /* Server failure */ #define RCODE_NXDOMAIN 3 /* Name Error */ #define RCODE_IMPL 4 /* Not implemented */ #define RCODE_REFUSE 5 /* Refused */ #define RCODE_YXDOMAIN 6 /* name should not exist */ #define RCODE_YXRRSET 7 /* rrset should not exist */ #define RCODE_NXRRSET 8 /* rrset does not exist */ #define RCODE_NOTAUTH 9 /* server not authoritative */ #define RCODE_NOTZONE 10 /* name not inside zone */ /* Standardized NSD return code. Partially maps to DNS RCODE values. */ enum nsd_rc { /* Discard the client request. */ NSD_RC_DISCARD = -1, /* OK, continue normal processing. */ NSD_RC_OK = RCODE_OK, /* Return the appropriate error code to the client. */ NSD_RC_FORMAT = RCODE_FORMAT, NSD_RC_SERVFAIL = RCODE_SERVFAIL, NSD_RC_NXDOMAIN = RCODE_NXDOMAIN, NSD_RC_IMPL = RCODE_IMPL, NSD_RC_REFUSE = RCODE_REFUSE, NSD_RC_NOTAUTH = RCODE_NOTAUTH }; typedef enum nsd_rc nsd_rc_type; /* RFC1035 */ #define CLASS_IN 1 /* Class IN */ #define CLASS_CS 2 /* Class CS */ #define CLASS_CH 3 /* Class CHAOS */ #define CLASS_HS 4 /* Class HS */ #define CLASS_NONE 254 /* Class NONE rfc2136 */ #define CLASS_ANY 255 /* Class ANY */ #define TYPE_A 1 /* a host address */ #define TYPE_NS 2 /* an authoritative name server */ #define TYPE_MD 3 /* a mail destination (Obsolete - use MX) */ #define TYPE_MF 4 /* a mail forwarder (Obsolete - use MX) */ #define TYPE_CNAME 5 /* the canonical name for an alias */ #define TYPE_SOA 6 /* marks the start of a zone of authority */ #define TYPE_MB 7 /* a mailbox domain name (EXPERIMENTAL) */ #define TYPE_MG 8 /* a mail group member (EXPERIMENTAL) */ #define TYPE_MR 9 /* a mail rename domain name (EXPERIMENTAL) */ #define TYPE_NULL 10 /* a null RR (EXPERIMENTAL) */ #define TYPE_WKS 11 /* a well known service description */ #define TYPE_PTR 12 /* a domain name pointer */ #define TYPE_HINFO 13 /* host information */ #define TYPE_MINFO 14 /* mailbox or mail list information */ #define TYPE_MX 15 /* mail exchange */ #define TYPE_TXT 16 /* text strings */ #define TYPE_RP 17 /* RFC1183 */ #define TYPE_AFSDB 18 /* RFC1183 */ #define TYPE_X25 19 /* RFC1183 */ #define TYPE_ISDN 20 /* RFC1183 */ #define TYPE_RT 21 /* RFC1183 */ #define TYPE_NSAP 22 /* RFC1706 */ #define TYPE_SIG 24 /* 2535typecode */ #define TYPE_KEY 25 /* 2535typecode */ #define TYPE_PX 26 /* RFC2163 */ #define TYPE_AAAA 28 /* ipv6 address */ #define TYPE_LOC 29 /* LOC record RFC1876 */ #define TYPE_NXT 30 /* 2535typecode */ #define TYPE_SRV 33 /* SRV record RFC2782 */ #define TYPE_NAPTR 35 /* RFC2915 */ #define TYPE_KX 36 /* RFC2230 Key Exchange Delegation Record */ #define TYPE_CERT 37 /* RFC2538 */ #define TYPE_A6 38 /* RFC2874 */ #define TYPE_DNAME 39 /* RFC2672 */ #define TYPE_OPT 41 /* Pseudo OPT record... */ #define TYPE_APL 42 /* RFC3123 */ #define TYPE_DS 43 /* RFC 4033, 4034, and 4035 */ #define TYPE_SSHFP 44 /* SSH Key Fingerprint */ #define TYPE_IPSECKEY 45 /* public key for ipsec use. RFC 4025 */ #define TYPE_RRSIG 46 /* RFC 4033, 4034, and 4035 */ #define TYPE_NSEC 47 /* RFC 4033, 4034, and 4035 */ #define TYPE_DNSKEY 48 /* RFC 4033, 4034, and 4035 */ #define TYPE_DHCID 49 /* RFC4701 DHCP information */ #define TYPE_NSEC3 50 /* NSEC3, secure denial, prevents zonewalking */ #define TYPE_NSEC3PARAM 51 /* NSEC3PARAM at zone apex nsec3 parameters */ #define TYPE_TLSA 52 /* RFC 6698 */ #define TYPE_SPF 99 /* RFC 4408 */ #define TYPE_NID 104 /* RFC 6742 */ #define TYPE_L32 105 /* RFC 6742 */ #define TYPE_L64 106 /* RFC 6742 */ #define TYPE_LP 107 /* RFC 6742 */ #ifdef DRAFT_RRTYPES #define TYPE_EUI48 108 /* draft-jabley-dnsext-eui48-eui64-rrtypes */ #define TYPE_EUI64 109 /* draft-jabley-dnsext-eui48-eui64-rrtypes */ #endif #define TYPE_TSIG 250 #define TYPE_IXFR 251 #define TYPE_AXFR 252 #define TYPE_MAILB 253 /* A request for mailbox-related records (MB, MG or MR) */ #define TYPE_MAILA 254 /* A request for mail agent RRs (Obsolete - see MX) */ #define TYPE_ANY 255 /* any type (wildcard) */ #define TYPE_DLV 32769 /* RFC 4431 */ #define PSEUDO_TYPE_DLV RRTYPE_DESCRIPTORS_LENGTH #define MAXLABELLEN 63 #define MAXDOMAINLEN 255 #define MAXRDATALEN 64 /* This is more than enough, think multiple TXT. */ #define MAX_RDLENGTH 65535 /* Maximum size of a single RR. */ #define MAX_RR_SIZE \ (MAXDOMAINLEN + sizeof(uint32_t) + 4*sizeof(uint16_t) + MAX_RDLENGTH) #define IP4ADDRLEN (32/8) #define IP6ADDRLEN (128/8) #ifdef DRAFT_RRTYPES #define EUI48ADDRLEN (48/8) #define EUI64ADDRLEN (64/8) #endif /* * The different types of RDATA wireformat data. */ enum rdata_wireformat { RDATA_WF_COMPRESSED_DNAME, /* Possibly compressed domain name. */ RDATA_WF_UNCOMPRESSED_DNAME, /* Uncompressed domain name. */ RDATA_WF_LITERAL_DNAME, /* Literal (not downcased) dname. */ RDATA_WF_BYTE, /* 8-bit integer. */ RDATA_WF_SHORT, /* 16-bit integer. */ RDATA_WF_LONG, /* 32-bit integer. */ RDATA_WF_TEXT, /* Text string. */ RDATA_WF_TEXTS, /* Text string sequence. */ RDATA_WF_A, /* 32-bit IPv4 address. */ RDATA_WF_AAAA, /* 128-bit IPv6 address. */ RDATA_WF_BINARY, /* Binary data (unknown length). */ RDATA_WF_BINARYWITHLENGTH, /* Binary data preceded by 1 byte length */ RDATA_WF_APL, /* APL data. */ RDATA_WF_IPSECGATEWAY, /* IPSECKEY gateway ip4, ip6 or dname. */ #ifdef DRAFT_RRTYPES RDATA_WF_ILNP64, /* 64-bit uncompressed IPv6 address. */ RDATA_WF_EUI48, /* 48-bit address. */ RDATA_WF_EUI64 /* 64-bit address. */ #else RDATA_WF_ILNP64 /* 64-bit uncompressed IPv6 address. */ #endif }; typedef enum rdata_wireformat rdata_wireformat_type; /* * The different types of RDATA that can appear in the zone file. */ enum rdata_zoneformat { RDATA_ZF_DNAME, /* Domain name. */ RDATA_ZF_LITERAL_DNAME, /* DNS name (not lowercased domain name). */ RDATA_ZF_TEXT, /* Text string. */ RDATA_ZF_TEXTS, /* Text string sequence. */ RDATA_ZF_BYTE, /* 8-bit integer. */ RDATA_ZF_SHORT, /* 16-bit integer. */ RDATA_ZF_LONG, /* 32-bit integer. */ RDATA_ZF_A, /* 32-bit IPv4 address. */ RDATA_ZF_AAAA, /* 128-bit IPv6 address. */ RDATA_ZF_RRTYPE, /* RR type. */ RDATA_ZF_ALGORITHM, /* Cryptographic algorithm. */ RDATA_ZF_CERTIFICATE_TYPE, RDATA_ZF_PERIOD, /* Time period. */ RDATA_ZF_TIME, RDATA_ZF_BASE64, /* Base-64 binary data. */ RDATA_ZF_BASE32, /* Base-32 binary data. */ RDATA_ZF_HEX, /* Hexadecimal binary data. */ RDATA_ZF_HEX_LEN, /* Hexadecimal binary data. Skip initial length byte. */ RDATA_ZF_NSAP, /* NSAP. */ RDATA_ZF_APL, /* APL. */ RDATA_ZF_IPSECGATEWAY, /* IPSECKEY gateway ip4, ip6 or dname. */ RDATA_ZF_SERVICES, /* Protocol and port number bitmap. */ RDATA_ZF_NXT, /* NXT type bitmap. */ RDATA_ZF_NSEC, /* NSEC type bitmap. */ RDATA_ZF_LOC, /* Location data. */ RDATA_ZF_ILNP64, /* 64-bit uncompressed IPv6 address. */ #ifdef DRAFT_RRTYPES RDATA_ZF_EUI48, /* EUI48 address. */ RDATA_ZF_EUI64, /* EUI64 address. */ #endif RDATA_ZF_UNKNOWN /* Unknown data. */ }; typedef enum rdata_zoneformat rdata_zoneformat_type; struct rrtype_descriptor { uint16_t type; /* RR type */ const char *name; /* Textual name. */ int token; /* Parser token. */ uint32_t minimum; /* Minimum number of RDATAs. */ uint32_t maximum; /* Maximum number of RDATAs. */ uint8_t wireformat[MAXRDATALEN]; /* rdata_wireformat_type */ uint8_t zoneformat[MAXRDATALEN]; /* rdata_zoneformat_type */ }; typedef struct rrtype_descriptor rrtype_descriptor_type; /* * Indexed by type. The special type "0" can be used to get a * descriptor for unknown types (with one binary rdata). * * EUI64 + 1 */ #ifdef DRAFT_RRTYPES #define RRTYPE_DESCRIPTORS_LENGTH (TYPE_EUI64 + 1) #else #define RRTYPE_DESCRIPTORS_LENGTH (TYPE_LP + 1) #endif rrtype_descriptor_type *rrtype_descriptor_by_name(const char *name); rrtype_descriptor_type *rrtype_descriptor_by_type(uint16_t type); const char *rrtype_to_string(uint16_t rrtype); /* * Lookup the type in the ztypes lookup table. If not found, check if * the type uses the "TYPExxx" notation for unknown types. * * Return 0 if no type matches. */ uint16_t rrtype_from_string(const char *name); const char *rrclass_to_string(uint16_t rrclass); uint16_t rrclass_from_string(const char *name); #ifdef __cplusplus inline rr_section_type operator++(rr_section_type &lhs) { lhs = (rr_section_type) ((int) lhs + 1); return lhs; } #endif /* __cplusplus */ #endif /* _DNS_H_ */ nsd-3.2.16/nsdc.sh.in0000664000175000017500000002446611563171373013266 0ustar matjematje#!@shell@ # # nsdc.sh -- a shell script to manage the beast # # Copyright (c) 2001-2011, NLnet Labs. All rights reserved. # # See LICENSE for the license. # # # chkconfig: 2345 @spriority@ @kpriority@ # description: NSD, authoritative only high performance name server. # configuration file default configfile="@nsdconfigfile@" # The directory where NSD binaries reside sbindir="@sbindir@" # how verbose is zonec run. Specify Nothing " ", -v or -vv. NSDC_ZONEC_VERBOSE=${NSDC_ZONEC_VERBOSE:--v} # how patch is done. Specify 1 (with use of textfiles, default) or 0 (without) NSDC_PATCH_STYLE=${NSDC_PATCH_STYLE:-1} # # You sure heard this many times before: NO USER SERVICEABLE PARTS BELOW # # see if user selects a different config file, with -c if test "x$1" = "x-c"; then shift if [ -e $1 ]; then configfile=$1 shift else echo "`basename $0`: Config file "$1" does not exist." exit 1 fi fi # locate nsd-checkconf : in sbindir, PATH, nsdc_dir or . nsd_checkconf="" if [ -e ${sbindir}/nsd-checkconf ]; then nsd_checkconf=${sbindir}/nsd-checkconf else if which nsd-checkconf >/dev/null 2>&1 ; then if which nsd-checkconf 2>&1 | grep "^[Nn]o " >/dev/null; then nsd_checkconf="" else nsd_checkconf=`which nsd-checkconf` fi fi if [ -z "${nsd_checkconf}" -a -e `dirname $0`/nsd-checkconf ]; then nsd_checkconf=`dirname $0`/nsd-checkconf fi if [ -z "${nsd_checkconf}" -a -e ./nsd-checkconf ]; then nsd_checkconf=./nsd-checkconf fi if [ -z "${nsd_checkconf}" ]; then echo "`basename $0`: Could not find nsd programs" \ "in $sbindir, in PATH=$PATH, in cwd=`pwd`," \ "or in dir of nsdc=`dirname $0`" exit 1 fi fi usage() { echo "Usage: `basename $0` [-c configfile] {start|stop|reload|rebuild|restart|" echo " running|update|notify|patch}" echo "options:" echo " -c configfile Use specified configfile (default: @nsdconfigfile@)." echo "commands:" echo " start Start nsd server." echo " stop Stop nsd server." echo " reload Nsd server reloads database file." echo " rebuild Compile database file from zone files." echo " restart Stop the nsd server and start it again." echo " running Prints message and exit nonzero if server not running." echo " update Try to update all slave zones hosted on this server." echo " notify Send notify messages to all secondary servers." echo " patch Merge zone transfer changes back to zone files." } # check the config syntax before using it ${nsd_checkconf} ${configfile} if test $? -ne 0 ; then usage exit 1 fi # Read some settings from the config file. dbfile=`${nsd_checkconf} -o database ${configfile}` pidfile=`${nsd_checkconf} -o pidfile ${configfile}` difffile=`${nsd_checkconf} -o difffile ${configfile}` zonesdir=`${nsd_checkconf} -o zonesdir ${configfile}` lockfile="${dbfile}.lock" # still needed sbindir=`dirname ${nsd_checkconf}` # move to zonesdir (if specified), and make absolute pathnames. if test -n "${zonesdir}"; then zonesdir=`dirname ${zonesdir}/.` if echo "${zonesdir}" | grep "^[^/]" >/dev/null; then zonesdir=`pwd`/${zonesdir} fi if echo "${dbfile}" | grep "^[^/]" >/dev/null; then dbfile=${zonesdir}/${dbfile} fi if echo "${pidfile}" | grep "^[^/]" >/dev/null; then pidfile=${zonesdir}/${pidfile} fi if echo "${lockfile}" | grep "^[^/]" >/dev/null; then lockfile=${zonesdir}/${lockfile} fi if echo "${difffile}" | grep "^[^/]" >/dev/null; then difffile=${zonesdir}/${difffile} fi fi # for bash: -C or noclobber. For tcsh: noclobber. For bourne: -C. noclobber_set="set -C" # ugly check for tcsh if echo @shell@ | grep tcsh >/dev/null; then noclobber_set="set noclobber" fi # # useful routines # signal() { if [ -s ${pidfile} ] then kill -"$1" `cat ${pidfile}` && return 0 else echo "nsd is not running" fi return 1 } lock_file() { (umask 222; ${noclobber_set}; echo "$$" >${lockfile}) } lock() { lock_file if [ $? = 1 ] then # check if the lockfile has not gone stale LPID=`cat ${lockfile}` echo database locked by PID: $LPID if kill -0 $LPID 2>/dev/null; then exit 1 fi # locking process does not exist, consider lockfile stale echo stale lockfile, removing... && rm -f ${lockfile} && lock_file fi if [ $? = 1 ] then echo lock failed exit 1 fi return 0 } unlock() { rm -f ${lockfile} } do_start() { if test -x ${sbindir}/nsd; then ${sbindir}/nsd -c ${configfile} test $? = 0 || (echo "nsd startup failed."; exit 1) else echo "${sbindir}/nsd not an executable file, nsd startup failed."; exit 1 fi } controlled_sleep() { if [ $1 -ge 25 ]; then sleep 1 fi } controlled_stop() { pid=$1 try=1 while [ $try -ne 0 ]; do if [ ${try} -gt 50 ]; then echo "nsdc stop failed" return 1 else if [ $try -eq 1 ]; then kill -TERM ${pid} else kill -TERM ${pid} >/dev/null 2>&1 fi # really stopped? kill -0 ${pid} >/dev/null 2>&1 if [ $? -eq 0 ]; then controlled_sleep ${try} try=`expr ${try} + 1` else try=0 fi fi done return 0 } do_controlled_stop() { if [ -s ${pidfile} ]; then pid=`cat ${pidfile}` controlled_stop ${pid} && return 0 else echo "nsd is not running, starting anyway" && return 0 fi return 1 } do_stop() { signal "TERM" } do_reload() { signal "HUP" } # send_updates zone_name {ip_spec key_spec} send_updates() { local zonename=$1 shift 1 # extract port number (if any) port=`${nsd_checkconf} -o port ${configfile}` if test -n "${port}"; then port="-p ${port}" fi update_sent="no" while test $# -gt 0; do ip_spec=$1 key_spec=$2 shift 2 # only localhost is allowed. # see if zone has 127.0.0.1 or ::1 as allowed. if test Z${ip_spec} = "Z127.0.0.1" -o Z${ip_spec} = "Z::1"; then secret="" if test K${key_spec} != KNOKEY -a K${key_spec} != KBLOCKED; then secret=`${nsd_checkconf} -s ${key_spec} ${configfile}` algo=`${nsd_checkconf} -a ${key_spec} ${configfile}` secret="-y ${key_spec}:${secret}:${algo}" fi if test K${key_spec} != KBLOCKED; then #echo "${sbindir}/nsd-notify -a ${ip_spec} ${port} ${secret} -z ${zonename} ${ip_spec}" ${sbindir}/nsd-notify -a ${ip_spec} ${port} ${secret} -z ${zonename} ${ip_spec} && update_sent="yes" fi fi done if test ${update_sent} = no; then req_xfr=`${nsd_checkconf} -z "${zonename}" -o request-xfr ${configfile}` if test -n "${req_xfr}"; then # must be a slave zone (has request-xfr). echo "`basename $0`: Could not send notify for slave zone ${zonename}: not configured (with allow-notify: 127.0.0.1 or ::1)" fi fi } # send_notify zone_name ifc_spec {ip_spec key_spec} send_notify() { local zonename=$1 # set local interface ifc_spec="" if test I$2 != INOIFC; then ifc_spec="-a $2" # with a : is IPv6 case "$2" in *:*) ifc_is_ip6="yes" ;; *) ifc_is_ip6="no" ;; esac fi shift 2 while test $# -gt 0; do ip_spec=$1 key_spec=$2 shift 2 secret="" # skip if ifc is set and mismatch v4-v6 if test -n "$ifc_spec"; then case "$ip_spec" in *:*) if test "$ifc_is_ip6" = "no"; then continue; fi;; *) if test "$ifc_is_ip6" = "yes"; then continue; fi;; esac fi if test K${key_spec} != KNOKEY -a K${key_spec} != KBLOCKED; then secret=`${nsd_checkconf} -s ${key_spec} ${configfile}` algo=`${nsd_checkconf} -a ${key_spec} ${configfile}` secret="-y ${key_spec}:${secret}:${algo}" fi if test K${key_spec} != KBLOCKED; then port="" ipaddr=${ip_spec} if echo ${ip_spec} | grep @ >/dev/null; then port="-p "`echo ${ip_spec} | sed -e 's/[^@]*@\([0-9]*\)/\1/'` ipaddr=`echo ${ip_spec} | sed -e 's/\([^@]*\)@[0-9]*/\1/'` fi #echo "${sbindir}/nsd-notify ${ifc_spec} ${port} ${secret} -z ${zonename} ${ipaddr}" ${sbindir}/nsd-notify ${ifc_spec} ${port} ${secret} -z ${zonename} ${ipaddr} fi done } # do_patch {with-textfile} do_patch() { if test I$1 = I1; then lock && mv ${difffile} ${difffile}.$$ && \ ${sbindir}/nsd-patch -c ${configfile} -x ${difffile}.$$ && \ rm -f ${difffile}.$$ && unlock && do_rebuild result=$? else # without textfile lock && mv ${difffile} ${difffile}.$$ && \ ${sbindir}/nsd-patch -c ${configfile} -x ${difffile}.$$ -s -o ${dbfile}.$$ \ && rm -f ${difffile}.$$ && unlock && \ mv ${dbfile}.$$ ${dbfile} result=$? fi return ${result} } do_rebuild() { lock && \ ${sbindir}/zonec ${NSDC_ZONEC_VERBOSE} -c ${configfile} -f ${dbfile}.$$ && \ mv ${dbfile}.$$ ${dbfile} result=$? unlock [ $result != 0 ] && echo "${dbfile} is unmodified" rm -f ${dbfile}.$$ return ${result} } case "$1" in start) if test -s ${pidfile} && kill -"0" `cat ${pidfile}` then (echo "process `cat ${pidfile}` exists, please use restart"; exit 1) else do_start fi ;; stop) do_stop ;; stats) signal "USR1" ;; reload) do_reload ;; running) signal "0" ;; patch) # patch queue clearen if test -s ${difffile}; then #${sbindir}/nsd-patch -c ${configfile} -x ${difffile} -l #debug #echo ${sbindir}/nsd-patch -c ${configfile} -x ${difffile} if do_patch ${NSDC_PATCH_STYLE}; then do_reload else unlock # try to move back the transfer data if [ -e ${difffile}.$$ -a ! -e ${difffile} ]; then mv ${difffile}.$$ ${difffile} fi echo "`basename $0`: patch failed." exit 1 fi else echo "`basename $0`: no patch necessary." fi ;; rebuild) do_rebuild ;; update) # send notifies to localhost for all zones that allow it echo "Sending notify to localhost to update secondary zones..." if [ -s ${pidfile} ]; then zoneslist=`${nsd_checkconf} -o zones ${configfile}` for zonename in ${zoneslist}; do notify_allow=`${nsd_checkconf} -z "${zonename}" -o allow-notify ${configfile}` if test "" != "${notify_allow}"; then send_updates ${zonename} ${notify_allow} fi done else echo "nsd is not running" fi ;; notify) # send notifies to all slaves echo "Sending notify to slave servers..." zoneslist=`${nsd_checkconf} -o zones ${configfile}` for zonename in ${zoneslist}; do notify=`${nsd_checkconf} -z "${zonename}" -o notify ${configfile}` local_ifc=`${nsd_checkconf} -z "${zonename}" -o outgoing-interface ${configfile}` if test "" = "${local_ifc}"; then local_ifc="NOIFC" fi if test "" != "${notify}"; then for ifc in ${local_ifc}; do send_notify ${zonename} ${ifc} ${notify} done fi done ;; restart) do_controlled_stop && do_start ;; *) usage ;; esac exit $? nsd-3.2.16/nsd.c0000664000175000017500000007421712160600467012320 0ustar matjematje/* * nsd.c -- nsd(8) * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include #include #include #ifdef HAVE_GRP_H #include #endif /* HAVE_GRP_H */ #ifdef HAVE_SETUSERCONTEXT #include #endif /* HAVE_SETUSERCONTEXT */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "nsd.h" #include "namedb.h" #include "options.h" #include "tsig.h" /* The server handler... */ static struct nsd nsd; static char hostname[MAXHOSTNAMELEN]; static void error(const char *format, ...) ATTR_FORMAT(printf, 1, 2); /* * Print the help text. * */ static void usage (void) { fprintf(stderr, "Usage: nsd [OPTION]...\n"); fprintf(stderr, "Name Server Daemon.\n\n"); fprintf(stderr, "Supported options:\n" " -4 Only listen to IPv4 connections.\n" " -6 Only listen to IPv6 connections.\n" " -a ip-address[@port] Listen to the specified incoming IP address (and port)\n" " May be specified multiple times).\n" " -c configfile Read specified configfile instead of %s.\n" " -d Enable debug mode (do not fork as a daemon process).\n" #ifndef NDEBUG " -F facilities Specify the debug facilities.\n" #endif /* NDEBUG */ " -f database Specify the database to load.\n" " -h Print this help information.\n" , CONFIGFILE); fprintf(stderr, " -i identity Specify the identity when queried for id.server CHAOS TXT.\n" " -I nsid Specify the NSID. This must be a hex string.\n" #ifndef NDEBUG " -L level Specify the debug level.\n" #endif /* NDEBUG */ " -l filename Specify the log file.\n" " -N server-count The number of servers to start.\n" " -n tcp-count The maximum number of TCP connections per server.\n" " -P pidfile Specify the PID file to write.\n" " -p port Specify the port to listen to.\n" " -s seconds Dump statistics every SECONDS seconds.\n" " -t chrootdir Change root to specified directory on startup.\n" ); fprintf(stderr, " -u user Change effective uid to the specified user.\n" " -V level Specify verbosity level.\n" " -v Print version information.\n" ); fprintf(stderr, "Version %s. Report bugs to <%s>.\n", PACKAGE_VERSION, PACKAGE_BUGREPORT); } /* * Print the version exit. * */ static void version(void) { fprintf(stderr, "%s version %s\n", PACKAGE_NAME, PACKAGE_VERSION); fprintf(stderr, "Written by NLnet Labs.\n\n"); fprintf(stderr, "Copyright (C) 2001-2011 NLnet Labs. This is free software.\n" "There is NO warranty; not even for MERCHANTABILITY or FITNESS\n" "FOR A PARTICULAR PURPOSE.\n"); exit(0); } /* * Something went wrong, give error messages and exit. * */ static void error(const char *format, ...) { va_list args; va_start(args, format); log_vmsg(LOG_ERR, format, args); va_end(args); exit(1); } static int file_inside_chroot(const char* fname, const char* chr) { #ifdef NDEBUG assert(chr); #endif /* NDEBUG */ /* filename and chroot the same? */ if (fname && fname[0] && chr[0] && !strncmp(fname, chr, strlen(chr))) return 2; /* strip chroot, file rotation ok */ else if (fname && fname[0] != '/') return 1; /* don't strip, file rotation ok */ return 0; /* don't strip, don't try file rotation */ } void get_ip_port_frm_str(const char* arg, const char** hostname, const char** port) { /* parse src[@port] option */ char* delim = NULL; if (arg) { delim = strchr(arg, '@'); } if (delim) { *delim = '\0'; *port = delim+1; } *hostname = arg; } /* * Fetch the nsd parent process id from the nsd pidfile * */ pid_t readpid(const char *file) { int fd; pid_t pid; char pidbuf[16]; char *t; int l; if ((fd = open(file, O_RDONLY)) == -1) { return -1; } if (((l = read(fd, pidbuf, sizeof(pidbuf)))) == -1) { close(fd); return -1; } close(fd); /* Empty pidfile means no pidfile... */ if (l == 0) { errno = ENOENT; return -1; } pid = (pid_t) strtol(pidbuf, &t, 10); if (*t && *t != '\n') { return -1; } return pid; } /* * Store the nsd parent process id in the nsd pidfile * */ int writepid(struct nsd *nsd) { FILE * fd; char pidbuf[32]; snprintf(pidbuf, sizeof(pidbuf), "%lu\n", (unsigned long) nsd->pid); if ((fd = fopen(nsd->pidfile, "w")) == NULL ) { log_msg(LOG_ERR, "cannot open pidfile %s: %s", nsd->pidfile, strerror(errno)); return -1; } if (!write_data(fd, pidbuf, strlen(pidbuf))) { log_msg(LOG_ERR, "cannot write pidfile %s: %s", nsd->pidfile, strerror(errno)); fclose(fd); return -1; } fclose(fd); if (chown(nsd->pidfile, nsd->uid, nsd->gid) == -1) { log_msg(LOG_ERR, "cannot chown %u.%u %s: %s", (unsigned) nsd->uid, (unsigned) nsd->gid, nsd->pidfile, strerror(errno)); return -1; } return 0; } void unlinkpid(const char* file) { int fd = -1; if (file) { /* truncate pidfile */ fd = open(file, O_WRONLY | O_TRUNC, 0644); if (fd == -1) { /* Truncate the pid file. */ log_msg(LOG_ERR, "can not truncate the pid file %s: %s", file, strerror(errno)); } else close(fd); /* unlink pidfile */ if (unlink(file) == -1) log_msg(LOG_WARNING, "failed to unlink pidfile %s: %s", file, strerror(errno)); } } /* * Incoming signals, set appropriate actions. * */ void sig_handler(int sig) { /* To avoid race cond. We really don't want to use log_msg() in this handler */ /* Are we a child server? */ if (nsd.server_kind != NSD_SERVER_MAIN) { switch (sig) { case SIGCHLD: nsd.signal_hint_child = 1; break; case SIGALRM: break; case SIGINT: case SIGTERM: nsd.signal_hint_quit = 1; break; case SIGILL: case SIGUSR1: /* Dump stats on SIGUSR1. */ nsd.signal_hint_statsusr = 1; break; default: break; } return; } /* We are the main process */ switch (sig) { case SIGCHLD: nsd.signal_hint_child = 1; return; case SIGHUP: nsd.signal_hint_reload = 1; return; case SIGALRM: nsd.signal_hint_stats = 1; break; case SIGILL: /* * For backwards compatibility with BIND 8 and older * versions of NSD. */ nsd.signal_hint_statsusr = 1; break; case SIGUSR1: /* Dump statistics. */ nsd.signal_hint_statsusr = 1; break; case SIGINT: /* Silent shutdown... */ nsd.signal_hint_quit = 1; break; case SIGTERM: default: nsd.signal_hint_shutdown = 1; break; } } /* * Statistic output... * */ #ifdef BIND8_STATS #ifdef USE_ZONE_STATS static void fprintf_zone_stats(FILE* fd, zone_type* zone, time_t now) { int i; /* NSTATS */ fprintf(fd, "NSTATS %s %lu", dname_to_string(domain_dname(zone->apex),0), (unsigned long) now); for (i = 0; i <= 255; i++) { if (zone->st.qtype[i] != 0) { fprintf(fd, " %s=%lu", rrtype_to_string(i), zone->st.qtype[i]); } } fprintf(fd, "\n"); /* XSTATS */ fprintf(fd, "XSTATS %s %lu" " RR=%lu RNXD=%lu RFwdR=%lu RDupR=%lu RFail=%lu RFErr=%lu RErr=%lu RAXFR=%lu" " RLame=%lu ROpts=%lu SSysQ=%lu SAns=%lu SFwdQ=%lu SDupQ=%lu SErr=%lu RQ=%lu" " RIQ=%lu RFwdQ=%lu RDupQ=%lu RTCP=%lu SFwdR=%lu SFail=%lu SFErr=%lu SNaAns=%lu" " SNXD=%lu RUQ=%lu RURQ=%lu RUXFR=%lu RUUpd=%lu\n", dname_to_string(domain_dname(zone->apex),0), (unsigned long) now, zone->st.dropped, (unsigned long)0, (unsigned long)0, (unsigned long)0, (unsigned long)0, (unsigned long)0, (unsigned long)0, zone->st.raxfr, (unsigned long)0, (unsigned long)0, (unsigned long)0, zone->st.qudp + zone->st.qudp6 - zone->st.dropped, (unsigned long)0, (unsigned long)0, zone->st.txerr, zone->st.opcode[OPCODE_QUERY], zone->st.opcode[OPCODE_IQUERY], zone->st.wrongzone, (unsigned long)0, zone->st.ctcp + zone->st.ctcp6, (unsigned long)0, zone->st.rcode[RCODE_SERVFAIL], zone->st.rcode[RCODE_FORMAT], zone->st.nona, zone->st.rcode[RCODE_NXDOMAIN], (unsigned long)0, (unsigned long)0, (unsigned long)0, zone->st.opcode[OPCODE_UPDATE]); } #endif void bind8_stats (struct nsd *nsd) { #ifdef USE_ZONE_STATS FILE* fd; zone_type* zone; #endif char buf[MAXSYSLOGMSGLEN]; char *msg, *t; int i, len; /* Current time... */ time_t now; if(!nsd->st.period) return; time(&now); /* NSTATS */ t = msg = buf + snprintf(buf, MAXSYSLOGMSGLEN, "NSTATS %lu %lu", (unsigned long) now, (unsigned long) nsd->st.boot); for (i = 0; i <= 255; i++) { /* How much space left? */ if ((len = buf + MAXSYSLOGMSGLEN - t) < 32) { log_msg(LOG_INFO, "%s", buf); t = msg; len = buf + MAXSYSLOGMSGLEN - t; } if (nsd->st.qtype[i] != 0) { t += snprintf(t, len, " %s=%lu", rrtype_to_string(i), nsd->st.qtype[i]); } } if (t > msg) log_msg(LOG_INFO, "%s", buf); /* XSTATS */ /* Only print it if we're in the main daemon or have anything to report... */ if (nsd->server_kind == NSD_SERVER_MAIN || nsd->st.dropped || nsd->st.raxfr || (nsd->st.qudp + nsd->st.qudp6 - nsd->st.dropped) || nsd->st.txerr || nsd->st.opcode[OPCODE_QUERY] || nsd->st.opcode[OPCODE_IQUERY] || nsd->st.wrongzone || nsd->st.ctcp + nsd->st.ctcp6 || nsd->st.rcode[RCODE_SERVFAIL] || nsd->st.rcode[RCODE_FORMAT] || nsd->st.nona || nsd->st.rcode[RCODE_NXDOMAIN] || nsd->st.opcode[OPCODE_UPDATE]) { log_msg(LOG_INFO, "XSTATS %lu %lu" " RR=%lu RNXD=%lu RFwdR=%lu RDupR=%lu RFail=%lu RFErr=%lu RErr=%lu RAXFR=%lu" " RLame=%lu ROpts=%lu SSysQ=%lu SAns=%lu SFwdQ=%lu SDupQ=%lu SErr=%lu RQ=%lu" " RIQ=%lu RFwdQ=%lu RDupQ=%lu RTCP=%lu SFwdR=%lu SFail=%lu SFErr=%lu SNaAns=%lu" " SNXD=%lu RUQ=%lu RURQ=%lu RUXFR=%lu RUUpd=%lu", (unsigned long) now, (unsigned long) nsd->st.boot, nsd->st.dropped, (unsigned long)0, (unsigned long)0, (unsigned long)0, (unsigned long)0, (unsigned long)0, (unsigned long)0, nsd->st.raxfr, (unsigned long)0, (unsigned long)0, (unsigned long)0, nsd->st.qudp + nsd->st.qudp6 - nsd->st.dropped, (unsigned long)0, (unsigned long)0, nsd->st.txerr, nsd->st.opcode[OPCODE_QUERY], nsd->st.opcode[OPCODE_IQUERY], nsd->st.wrongzone, (unsigned long)0, nsd->st.ctcp + nsd->st.ctcp6, (unsigned long)0, nsd->st.rcode[RCODE_SERVFAIL], nsd->st.rcode[RCODE_FORMAT], nsd->st.nona, nsd->st.rcode[RCODE_NXDOMAIN], (unsigned long)0, (unsigned long)0, (unsigned long)0, nsd->st.opcode[OPCODE_UPDATE]); } #ifdef USE_ZONE_STATS /* ZSTATS */ log_msg(LOG_INFO, "ZSTATS %s", nsd->zonestatsfile); if ((fd = fopen(nsd->zonestatsfile, "a")) == NULL ) { log_msg(LOG_ERR, "cannot open zone statsfile %s: %s", nsd->zonestatsfile, strerror(errno)); return; } /* Write stats per zone */ zone = nsd->db->zones; while (zone) { fprintf_zone_stats(fd, zone, now); zone = zone->next; } fclose(fd); #endif } #endif /* BIND8_STATS */ extern char *optarg; extern int optind; int main(int argc, char *argv[]) { /* Scratch variables... */ int c; pid_t oldpid; size_t i; struct sigaction action; FILE* dbfd; #ifdef HAVE_GETPWNAM struct passwd *pwd = NULL; #endif /* HAVE_GETPWNAM */ /* For initialising the address info structures */ /* static so it can get very big without overflowing the stack */ static struct addrinfo hints[MAX_INTERFACES]; static const char *nodes[MAX_INTERFACES]; const char *udp_port = 0; const char *tcp_port = 0; const char *configfile = CONFIGFILE; char* argv0 = (argv0 = strrchr(argv[0], '/')) ? argv0 + 1 : argv[0]; log_init(argv0); /* Initialize the server handler... */ memset(&nsd, 0, sizeof(struct nsd)); nsd.region = region_create(xalloc, free); nsd.dbfile = 0; nsd.pidfile = 0; nsd.server_kind = NSD_SERVER_MAIN; #ifdef USE_ZONE_STATS nsd.zonestatsfile = 0; #endif for (i = 0; i < MAX_INTERFACES; i++) { memset(&hints[i], 0, sizeof(hints[i])); hints[i].ai_family = DEFAULT_AI_FAMILY; hints[i].ai_flags = AI_PASSIVE; nodes[i] = NULL; } nsd.identity = 0; nsd.version = VERSION; nsd.username = 0; nsd.chrootdir = 0; nsd.nsid = NULL; nsd.nsid_len = 0; nsd.child_count = 0; nsd.maximum_tcp_count = 0; nsd.current_tcp_count = 0; nsd.grab_ip6_optional = 0; nsd.file_rotation_ok = 0; /* Set up our default identity to gethostname(2) */ if (gethostname(hostname, MAXHOSTNAMELEN) == 0) { nsd.identity = hostname; } else { log_msg(LOG_ERR, "failed to get the host name: %s - using default identity", strerror(errno)); nsd.identity = IDENTITY; } /* Parse the command line... */ while ((c = getopt(argc, argv, "46a:c:df:hi:I:l:N:n:P:p:s:u:t:X:V:v" #ifndef NDEBUG /* only when configured with --enable-checking */ "F:L:" #endif /* NDEBUG */ )) != -1) { switch (c) { case '4': for (i = 0; i < MAX_INTERFACES; ++i) { hints[i].ai_family = AF_INET; } break; case '6': #ifdef INET6 for (i = 0; i < MAX_INTERFACES; ++i) { hints[i].ai_family = AF_INET6; } #else /* !INET6 */ error("IPv6 support not enabled."); #endif /* INET6 */ break; case 'a': if (nsd.ifs < MAX_INTERFACES) { nodes[nsd.ifs] = optarg; ++nsd.ifs; } else { error("too many interfaces ('-a') specified."); } break; case 'c': configfile = optarg; break; case 'd': nsd.debug = 1; break; case 'f': nsd.dbfile = optarg; break; case 'h': usage(); exit(0); case 'i': nsd.identity = optarg; break; case 'I': if (nsd.nsid_len != 0) { /* can only be given once */ break; } if (strlen(optarg) % 2 != 0) { error("the NSID must be a hex string of an even length."); } nsd.nsid = xalloc(strlen(optarg) / 2); nsd.nsid_len = strlen(optarg) / 2; if (hex_pton(optarg, nsd.nsid, nsd.nsid_len) == -1) { error("hex string cannot be parsed '%s' in NSID.", optarg); } break; case 'l': nsd.log_filename = optarg; break; case 'N': i = atoi(optarg); if (i <= 0) { error("number of child servers must be greater than zero."); } else { nsd.child_count = i; } break; case 'n': i = atoi(optarg); if (i <= 0) { error("number of concurrent TCP connections must greater than zero."); } else { nsd.maximum_tcp_count = i; } break; case 'P': nsd.pidfile = optarg; break; case 'p': if (atoi(optarg) == 0) { error("port argument must be numeric."); } tcp_port = optarg; udp_port = optarg; break; case 's': #ifdef BIND8_STATS nsd.st.period = atoi(optarg); #else /* !BIND8_STATS */ error("BIND 8 statistics not enabled."); #endif /* BIND8_STATS */ break; case 't': #ifdef HAVE_CHROOT nsd.chrootdir = optarg; #else /* !HAVE_CHROOT */ error("chroot not supported on this platform."); #endif /* HAVE_CHROOT */ break; case 'u': nsd.username = optarg; break; case 'V': verbosity = atoi(optarg); break; case 'v': version(); /* version exits */ #ifndef NDEBUG case 'F': sscanf(optarg, "%x", &nsd_debug_facilities); break; case 'L': sscanf(optarg, "%d", &nsd_debug_level); break; #endif /* NDEBUG */ case '?': default: usage(); exit(1); } } argc -= optind; argv += optind; /* Commandline parse error */ if (argc != 0) { usage(); exit(1); } if (strlen(nsd.identity) > UCHAR_MAX) { error("server identity too long (%u characters)", (unsigned) strlen(nsd.identity)); } /* Read options */ nsd.options = nsd_options_create(region_create(xalloc, free)); if(!parse_options_file(nsd.options, configfile)) { error("could not read config: %s\n", configfile); } if(nsd.options->ip4_only) { for (i = 0; i < MAX_INTERFACES; ++i) { hints[i].ai_family = AF_INET; } } #ifdef INET6 if(nsd.options->ip6_only) { for (i = 0; i < MAX_INTERFACES; ++i) { hints[i].ai_family = AF_INET6; } } #endif /* INET6 */ if(nsd.options->ip_addresses) { ip_address_option_t* ip = nsd.options->ip_addresses; while(ip) { if (nsd.ifs < MAX_INTERFACES) { nodes[nsd.ifs] = ip->address; ++nsd.ifs; } else { error("too many interfaces ('-a' + " "'ip-address:') specified."); break; } ip = ip->next; } } if (verbosity == 0) verbosity = nsd.options->verbosity; #ifndef NDEBUG if (nsd_debug_level > 0 && verbosity == 0) verbosity = nsd_debug_level; #endif /* NDEBUG */ if(nsd.options->debug_mode) nsd.debug=1; if(!nsd.dbfile) { if(nsd.options->database) nsd.dbfile = nsd.options->database; else nsd.dbfile = DBFILE; } if(!nsd.pidfile) { if(nsd.options->pidfile) nsd.pidfile = nsd.options->pidfile; else nsd.pidfile = PIDFILE; } if(strcmp(nsd.identity, hostname)==0 || strcmp(nsd.identity,IDENTITY)==0) { if(nsd.options->identity) nsd.identity = nsd.options->identity; } if (nsd.options->logfile && !nsd.log_filename) { nsd.log_filename = nsd.options->logfile; } if(nsd.child_count == 0) { nsd.child_count = nsd.options->server_count; } if(nsd.maximum_tcp_count == 0) { nsd.maximum_tcp_count = nsd.options->tcp_count; } nsd.tcp_timeout = nsd.options->tcp_timeout; nsd.tcp_query_count = nsd.options->tcp_query_count; nsd.ipv4_edns_size = nsd.options->ipv4_edns_size; nsd.ipv6_edns_size = nsd.options->ipv6_edns_size; if(udp_port == 0) { if(nsd.options->port != 0) { udp_port = nsd.options->port; tcp_port = nsd.options->port; } else { udp_port = UDP_PORT; tcp_port = TCP_PORT; } } #ifdef BIND8_STATS if(nsd.st.period == 0) { nsd.st.period = nsd.options->statistics; } #ifdef USE_ZONE_STATS if (nsd.zonestatsfile == 0) { nsd.zonestatsfile = nsd.options->zonestatsfile; } #endif /* USE_ZONE_STATS */ #endif /* BIND8_STATS */ #ifdef HAVE_CHROOT if(nsd.chrootdir == 0) nsd.chrootdir = nsd.options->chroot; #ifdef CHROOTDIR /* if still no chrootdir, fallback to default */ if(nsd.chrootdir == 0) nsd.chrootdir = CHROOTDIR; #endif /* CHROOTDIR */ #endif /* HAVE_CHROOT */ if(nsd.username == 0) { if(nsd.options->username) nsd.username = nsd.options->username; else nsd.username = USER; } if(nsd.options->zonesdir && nsd.options->zonesdir[0]) { if(chdir(nsd.options->zonesdir)) { error("cannot chdir to '%s': %s", nsd.options->zonesdir, strerror(errno)); } DEBUG(DEBUG_IPC,1, (LOG_INFO, "changed directory to %s", nsd.options->zonesdir)); } /* EDNS0 */ edns_init_data(&nsd.edns_ipv4, nsd.options->ipv4_edns_size); #if defined(INET6) #if defined(IPV6_USE_MIN_MTU) || defined(IPV6_MTU) edns_init_data(&nsd.edns_ipv6, nsd.options->ipv6_edns_size); #else /* no way to set IPV6 MTU, send no bigger than that. */ if (nsd.options->ipv6_edns_size < IPV6_MIN_MTU) edns_init_data(&nsd.edns_ipv6, nsd.options->ipv6_edns_size); else edns_init_data(&nsd.edns_ipv6, IPV6_MIN_MTU); #endif /* IPV6 MTU) */ #endif /* defined(INET6) */ if (nsd.nsid_len == 0 && nsd.options->nsid) { if (strlen(nsd.options->nsid) % 2 != 0) { error("the NSID must be a hex string of an even length."); } nsd.nsid = xalloc(strlen(nsd.options->nsid) / 2); nsd.nsid_len = strlen(nsd.options->nsid) / 2; if (hex_pton(nsd.options->nsid, nsd.nsid, nsd.nsid_len) == -1) { error("hex string cannot be parsed '%s' in NSID.", nsd.options->nsid); } } edns_init_nsid(&nsd.edns_ipv4, nsd.nsid_len); #if defined(INET6) edns_init_nsid(&nsd.edns_ipv6, nsd.nsid_len); #endif /* defined(INET6) */ /* Number of child servers to fork. */ nsd.children = (struct nsd_child *) region_alloc( nsd.region, nsd.child_count * sizeof(struct nsd_child)); for (i = 0; i < nsd.child_count; ++i) { nsd.children[i].kind = NSD_SERVER_BOTH; nsd.children[i].pid = -1; nsd.children[i].child_fd = -1; nsd.children[i].parent_fd = -1; nsd.children[i].handler = NULL; nsd.children[i].need_to_send_STATS = 0; nsd.children[i].need_to_send_QUIT = 0; nsd.children[i].need_to_exit = 0; nsd.children[i].has_exited = 0; nsd.children[i].dirty_zones = stack_create(nsd.region, nsd_options_num_zones(nsd.options)); } nsd.this_child = NULL; /* We need at least one active interface */ if (nsd.ifs == 0) { nsd.ifs = 1; /* * With IPv6 we'd like to open two separate sockets, * one for IPv4 and one for IPv6, both listening to * the wildcard address (unless the -4 or -6 flags are * specified). * * However, this is only supported on platforms where * we can turn the socket option IPV6_V6ONLY _on_. * Otherwise we just listen to a single IPv6 socket * and any incoming IPv4 connections will be * automatically mapped to our IPv6 socket. */ #ifdef INET6 if (hints[0].ai_family == AF_UNSPEC) { #ifdef IPV6_V6ONLY hints[0].ai_family = AF_INET6; hints[1].ai_family = AF_INET; nsd.ifs = 2; nsd.grab_ip6_optional = 1; #else /* !IPV6_V6ONLY */ hints[0].ai_family = AF_INET6; #endif /* IPV6_V6ONLY */ } #endif /* INET6 */ } /* Set up the address info structures with real interface/port data */ for (i = 0; i < nsd.ifs; ++i) { int r; const char* node = NULL; const char* service = NULL; /* We don't perform name-lookups */ if (nodes[i] != NULL) hints[i].ai_flags |= AI_NUMERICHOST; get_ip_port_frm_str(nodes[i], &node, &service); hints[i].ai_socktype = SOCK_DGRAM; if ((r=getaddrinfo(node, (service?service:udp_port), &hints[i], &nsd.udp[i].addr)) != 0) { #ifdef INET6 if(nsd.grab_ip6_optional && hints[0].ai_family == AF_INET6) { log_msg(LOG_WARNING, "No IPv6, fallback to IPv4. getaddrinfo: %s", r==EAI_SYSTEM?strerror(errno):gai_strerror(r)); continue; } #endif error("cannot parse address '%s': getaddrinfo: %s %s", nodes[i]?nodes[i]:"(null)", gai_strerror(r), r==EAI_SYSTEM?strerror(errno):""); } hints[i].ai_socktype = SOCK_STREAM; if ((r=getaddrinfo(node, (service?service:tcp_port), &hints[i], &nsd.tcp[i].addr)) != 0) { error("cannot parse address '%s': getaddrinfo: %s %s", nodes[i]?nodes[i]:"(null)", gai_strerror(r), r==EAI_SYSTEM?strerror(errno):""); } } /* Parse the username into uid and gid */ nsd.gid = getgid(); nsd.uid = getuid(); #ifdef HAVE_GETPWNAM /* Parse the username into uid and gid */ if (*nsd.username) { if (isdigit((int)*nsd.username)) { char *t; nsd.uid = strtol(nsd.username, &t, 10); if (*t != 0) { if (*t != '.' || !isdigit((int)*++t)) { error("-u user or -u uid or -u uid.gid"); } nsd.gid = strtol(t, &t, 10); } else { /* Lookup the group id in /etc/passwd */ if ((pwd = getpwuid(nsd.uid)) == NULL) { error("user id %u does not exist.", (unsigned) nsd.uid); } else { nsd.gid = pwd->pw_gid; } } } else { /* Lookup the user id in /etc/passwd */ if ((pwd = getpwnam(nsd.username)) == NULL) { error("user '%s' does not exist.", nsd.username); } else { nsd.uid = pwd->pw_uid; nsd.gid = pwd->pw_gid; } } } /* endpwent(); */ #endif /* HAVE_GETPWNAM */ if(!tsig_init(nsd.region)) error("init tsig failed"); #if defined(HAVE_SSL) key_options_tsig_add(nsd.options); #endif /* Relativize the pathnames for chroot... */ if (nsd.chrootdir) { int l = strlen(nsd.chrootdir); /* existing chrootdir: append trailing slash for strncmp checking */ if (l>0 && strncmp(nsd.chrootdir + (l-1), "/", 1) != 0) { char *chroot_slash = region_alloc(nsd.region, sizeof(char)*(l+2)); memcpy(chroot_slash, nsd.chrootdir, sizeof(char)*(l+1)); strlcat(chroot_slash, "/", sizeof(char)*(l+2)); nsd.chrootdir = chroot_slash; ++l; } if (strncmp(nsd.chrootdir, nsd.pidfile, l) != 0) { error("%s is not relative to %s: chroot not possible", nsd.pidfile, nsd.chrootdir); } else if (strncmp(nsd.chrootdir, nsd.dbfile, l) != 0) { error("%s is not relative to %s: chroot not possible", nsd.dbfile, nsd.chrootdir); } else if (strncmp(nsd.chrootdir, nsd.options->xfrdfile, l) != 0) { error("%s is not relative to %s: chroot not possible", nsd.options->xfrdfile, nsd.chrootdir); } else if (strncmp(nsd.chrootdir, nsd.options->difffile, l) != 0) { error("%s is not relative to %s: chroot not possible", nsd.options->difffile, nsd.chrootdir); } else if (strncmp(nsd.chrootdir, nsd.options->zonesdir, l) != 0) { error("%s is not relative to %s: chroot not possible", nsd.options->zonesdir, nsd.chrootdir); } } /* Set up the logging */ log_open(LOG_PID, FACILITY, nsd.log_filename); if (!nsd.log_filename) log_set_log_function(log_syslog); else if (nsd.uid && nsd.gid) { if(chown(nsd.log_filename, nsd.uid, nsd.gid) != 0) VERBOSITY(2, (LOG_WARNING, "chown %s failed: %s", nsd.log_filename, strerror(errno))); } /* Do we have a running nsd? */ if ((oldpid = readpid(nsd.pidfile)) == -1) { if (errno != ENOENT) { log_msg(LOG_ERR, "can't read pidfile %s: %s", nsd.pidfile, strerror(errno)); } } else { if (kill(oldpid, 0) == 0 || errno == EPERM) { log_msg(LOG_WARNING, "%s is already running as %u, continuing", argv0, (unsigned) oldpid); } else { log_msg(LOG_ERR, "...stale pid file from process %u", (unsigned) oldpid); } } /* Setup the signal handling... */ action.sa_handler = sig_handler; sigfillset(&action.sa_mask); action.sa_flags = 0; sigaction(SIGTERM, &action, NULL); sigaction(SIGHUP, &action, NULL); sigaction(SIGINT, &action, NULL); sigaction(SIGILL, &action, NULL); sigaction(SIGUSR1, &action, NULL); sigaction(SIGALRM, &action, NULL); sigaction(SIGCHLD, &action, NULL); action.sa_handler = SIG_IGN; sigaction(SIGPIPE, &action, NULL); /* Initialize... */ nsd.mode = NSD_RUN; nsd.signal_hint_child = 0; nsd.signal_hint_reload = 0; nsd.signal_hint_quit = 0; nsd.signal_hint_shutdown = 0; nsd.signal_hint_stats = 0; nsd.signal_hint_statsusr = 0; nsd.quit_sync_done = 0; /* Initialize the server... */ if (server_init(&nsd) != 0) { log_msg(LOG_ERR, "server initialization failed, %s could " "not be started", argv0); exit(1); } /* Unless we're debugging, fork... */ if (!nsd.debug) { int fd; /* Take off... */ switch ((nsd.pid = fork())) { case 0: /* Child */ break; case -1: log_msg(LOG_ERR, "fork() failed: %s", strerror(errno)); server_close_all_sockets(nsd.udp, nsd.ifs); server_close_all_sockets(nsd.tcp, nsd.ifs); exit(1); default: /* Parent is done */ server_close_all_sockets(nsd.udp, nsd.ifs); server_close_all_sockets(nsd.tcp, nsd.ifs); exit(0); } /* Detach ourselves... */ if (setsid() == -1) { log_msg(LOG_ERR, "setsid() failed: %s", strerror(errno)); exit(1); } if ((fd = open("/dev/null", O_RDWR, 0)) != -1) { (void)dup2(fd, STDIN_FILENO); (void)dup2(fd, STDOUT_FILENO); (void)dup2(fd, STDERR_FILENO); if (fd > 2) (void)close(fd); } } /* Get our process id */ nsd.pid = getpid(); /* Set user context */ #ifdef HAVE_GETPWNAM if (*nsd.username) { #ifdef HAVE_SETUSERCONTEXT /* setusercontext does initgroups, setuid, setgid, and * also resource limits from login config, but we * still call setresuid, setresgid to be sure to set all uid */ if (setusercontext(NULL, pwd, nsd.uid, LOGIN_SETALL & ~LOGIN_SETUSER & ~LOGIN_SETGROUP) != 0) log_msg(LOG_WARNING, "unable to setusercontext %s: %s", nsd.username, strerror(errno)); #endif /* HAVE_SETUSERCONTEXT */ } #endif /* HAVE_GETPWNAM */ /* Chroot */ #ifdef HAVE_CHROOT if (nsd.chrootdir && strlen(nsd.chrootdir)) { int l = strlen(nsd.chrootdir); int ret = 0; while (l>0 && nsd.chrootdir[l-1] == '/') --l; /* filename after chroot */ ret = file_inside_chroot(nsd.log_filename, nsd.chrootdir); if (ret) { nsd.file_rotation_ok = 1; if (ret == 2) /* also strip chroot */ nsd.log_filename += l; } nsd.dbfile += l; nsd.pidfile += l; nsd.options->xfrdfile += l; nsd.options->difffile += l; nsd.options->zonesdir += l; #ifdef HAVE_TZSET /* set timezone whilst not yet in chroot */ tzset(); #endif if (chroot(nsd.chrootdir)) { log_msg(LOG_ERR, "unable to chroot: %s", strerror(errno)); exit(1); } if (chdir("/")) { log_msg(LOG_ERR, "unable to chdir to chroot: %s", strerror(errno)); exit(1); } DEBUG(DEBUG_IPC,1, (LOG_INFO, "changed root directory to %s", nsd.chrootdir)); /* chdir to zonesdir again after chroot */ if(nsd.options->zonesdir && nsd.options->zonesdir[0]) { if(chdir(nsd.options->zonesdir)) { error("unable to chdir to '%s': %s", nsd.options->zonesdir, strerror(errno)); } DEBUG(DEBUG_IPC,1, (LOG_INFO, "changed directory to %s", nsd.options->zonesdir)); } } else #endif /* HAVE_CHROOT */ nsd.file_rotation_ok = 1; DEBUG(DEBUG_IPC,1, (LOG_INFO, "file rotation on %s %sabled", nsd.log_filename, nsd.file_rotation_ok?"en":"dis")); /* Check if nsd.db exists */ if ((dbfd = fopen(nsd.dbfile, "r")) == NULL) { log_msg(LOG_ERR, "unable to open %s for reading: %s", nsd.dbfile, strerror(errno)); exit(1); } fclose(dbfd); /* Write pidfile */ if (writepid(&nsd) == -1) { log_msg(LOG_ERR, "cannot overwrite the pidfile %s: %s", nsd.pidfile, strerror(errno)); } /* Drop the permissions */ #ifdef HAVE_GETPWNAM if (*nsd.username) { #ifdef HAVE_INITGROUPS if(initgroups(nsd.username, nsd.gid) != 0) log_msg(LOG_WARNING, "unable to initgroups %s: %s", nsd.username, strerror(errno)); #endif /* HAVE_INITGROUPS */ endpwent(); #ifdef HAVE_SETRESGID if(setresgid(nsd.gid,nsd.gid,nsd.gid) != 0) #elif defined(HAVE_SETREGID) && !defined(DARWIN_BROKEN_SETREUID) if(setregid(nsd.gid,nsd.gid) != 0) #else /* use setgid */ if(setgid(nsd.gid) != 0) #endif /* HAVE_SETRESGID */ error("unable to set group id of %s: %s", nsd.username, strerror(errno)); #ifdef HAVE_SETRESUID if(setresuid(nsd.uid,nsd.uid,nsd.uid) != 0) #elif defined(HAVE_SETREUID) && !defined(DARWIN_BROKEN_SETREUID) if(setreuid(nsd.uid,nsd.uid) != 0) #else /* use setuid */ if(setuid(nsd.uid) != 0) #endif /* HAVE_SETRESUID */ error("unable to set user id of %s: %s", nsd.username, strerror(errno)); DEBUG(DEBUG_IPC,1, (LOG_INFO, "dropped user privileges, run as %s", nsd.username)); } #endif /* HAVE_GETPWNAM */ if (server_prepare(&nsd) != 0) { log_msg(LOG_ERR, "server preparation failed, %s could " "not be started", argv0); unlinkpid(nsd.pidfile); exit(1); } /* Really take off */ log_msg(LOG_NOTICE, "%s started (%s), pid %d", argv0, PACKAGE_STRING, (int) nsd.pid); if (nsd.server_kind == NSD_SERVER_MAIN) { server_main(&nsd); } else { server_child(&nsd); } /* NOTREACH */ exit(0); } nsd-3.2.16/zlexer.c0000664000175000017500000016234712173226547013056 0ustar matjematje#include #line 3 "" #define YY_INT_ALIGNED short int /* A lexical scanner generated by flex */ #define FLEX_SCANNER #define YY_FLEX_MAJOR_VERSION 2 #define YY_FLEX_MINOR_VERSION 5 #define YY_FLEX_SUBMINOR_VERSION 35 #if YY_FLEX_SUBMINOR_VERSION > 0 #define FLEX_BETA #endif /* First, we deal with platform-specific or compiler-specific issues. */ /* begin standard C headers. */ #include #include #include #include /* end standard C headers. */ /* flex integer type definitions */ #ifndef FLEXINT_H #define FLEXINT_H /* C99 systems have . Non-C99 systems may or may not. */ #if defined (__STDC_VERSION__) && __STDC_VERSION__ >= 199901L /* C99 says to define __STDC_LIMIT_MACROS before including stdint.h, * if you want the limit (max/min) macros for int types. */ #ifndef __STDC_LIMIT_MACROS #define __STDC_LIMIT_MACROS 1 #endif #include typedef int8_t flex_int8_t; typedef uint8_t flex_uint8_t; typedef int16_t flex_int16_t; typedef uint16_t flex_uint16_t; typedef int32_t flex_int32_t; typedef uint32_t flex_uint32_t; #else typedef signed char flex_int8_t; typedef short int flex_int16_t; typedef int flex_int32_t; typedef unsigned char flex_uint8_t; typedef unsigned short int flex_uint16_t; typedef unsigned int flex_uint32_t; /* Limits of integral types. */ #ifndef INT8_MIN #define INT8_MIN (-128) #endif #ifndef INT16_MIN #define INT16_MIN (-32767-1) #endif #ifndef INT32_MIN #define INT32_MIN (-2147483647-1) #endif #ifndef INT8_MAX #define INT8_MAX (127) #endif #ifndef INT16_MAX #define INT16_MAX (32767) #endif #ifndef INT32_MAX #define INT32_MAX (2147483647) #endif #ifndef UINT8_MAX #define UINT8_MAX (255U) #endif #ifndef UINT16_MAX #define UINT16_MAX (65535U) #endif #ifndef UINT32_MAX #define UINT32_MAX (4294967295U) #endif #endif /* ! C99 */ #endif /* ! FLEXINT_H */ #ifdef __cplusplus /* The "const" storage-class-modifier is valid. */ #define YY_USE_CONST #else /* ! __cplusplus */ /* C99 requires __STDC__ to be defined as 1. */ #if defined (__STDC__) #define YY_USE_CONST #endif /* defined (__STDC__) */ #endif /* ! __cplusplus */ #ifdef YY_USE_CONST #define yyconst const #else #define yyconst #endif /* Returned upon end-of-file. */ #define YY_NULL 0 /* Promotes a possibly negative, possibly signed char to an unsigned * integer for use as an array index. If the signed char is negative, * we want to instead treat it as an 8-bit unsigned char, hence the * double cast. */ #define YY_SC_TO_UI(c) ((unsigned int) (unsigned char) c) /* Enter a start condition. This macro really ought to take a parameter, * but we do it the disgusting crufty way forced on us by the ()-less * definition of BEGIN. */ #define BEGIN (yy_start) = 1 + 2 * /* Translate the current start state into a value that can be later handed * to BEGIN to return to the state. The YYSTATE alias is for lex * compatibility. */ #define YY_START (((yy_start) - 1) / 2) #define YYSTATE YY_START /* Action number for EOF rule of a given start state. */ #define YY_STATE_EOF(state) (YY_END_OF_BUFFER + state + 1) /* Special action meaning "start processing a new file". */ #define YY_NEW_FILE yyrestart(yyin ) #define YY_END_OF_BUFFER_CHAR 0 /* Size of default input buffer. */ #ifndef YY_BUF_SIZE #ifdef __ia64__ /* On IA-64, the buffer size is 16k, not 8k. * Moreover, YY_BUF_SIZE is 2*YY_READ_BUF_SIZE in the general case. * Ditto for the __ia64__ case accordingly. */ #define YY_BUF_SIZE 32768 #else #define YY_BUF_SIZE 16384 #endif /* __ia64__ */ #endif /* The state buf must be large enough to hold one state per character in the main buffer. */ #define YY_STATE_BUF_SIZE ((YY_BUF_SIZE + 2) * sizeof(yy_state_type)) #ifndef YY_TYPEDEF_YY_BUFFER_STATE #define YY_TYPEDEF_YY_BUFFER_STATE typedef struct yy_buffer_state *YY_BUFFER_STATE; #endif extern int yyleng; extern FILE *yyin, *yyout; #define EOB_ACT_CONTINUE_SCAN 0 #define EOB_ACT_END_OF_FILE 1 #define EOB_ACT_LAST_MATCH 2 #define YY_LESS_LINENO(n) /* Return all but the first "n" matched characters back to the input stream. */ #define yyless(n) \ do \ { \ /* Undo effects of setting up yytext. */ \ int yyless_macro_arg = (n); \ YY_LESS_LINENO(yyless_macro_arg);\ *yy_cp = (yy_hold_char); \ YY_RESTORE_YY_MORE_OFFSET \ (yy_c_buf_p) = yy_cp = yy_bp + yyless_macro_arg - YY_MORE_ADJ; \ YY_DO_BEFORE_ACTION; /* set up yytext again */ \ } \ while ( 0 ) #define unput(c) yyunput( c, (yytext_ptr) ) #ifndef YY_TYPEDEF_YY_SIZE_T #define YY_TYPEDEF_YY_SIZE_T typedef size_t yy_size_t; #endif #ifndef YY_STRUCT_YY_BUFFER_STATE #define YY_STRUCT_YY_BUFFER_STATE struct yy_buffer_state { FILE *yy_input_file; char *yy_ch_buf; /* input buffer */ char *yy_buf_pos; /* current position in input buffer */ /* Size of input buffer in bytes, not including room for EOB * characters. */ yy_size_t yy_buf_size; /* Number of characters read into yy_ch_buf, not including EOB * characters. */ int yy_n_chars; /* Whether we "own" the buffer - i.e., we know we created it, * and can realloc() it to grow it, and should free() it to * delete it. */ int yy_is_our_buffer; /* Whether this is an "interactive" input source; if so, and * if we're using stdio for input, then we want to use getc() * instead of fread(), to make sure we stop fetching input after * each newline. */ int yy_is_interactive; /* Whether we're considered to be at the beginning of a line. * If so, '^' rules will be active on the next match, otherwise * not. */ int yy_at_bol; int yy_bs_lineno; /**< The line count. */ int yy_bs_column; /**< The column count. */ /* Whether to try to fill the input buffer when we reach the * end of it. */ int yy_fill_buffer; int yy_buffer_status; #define YY_BUFFER_NEW 0 #define YY_BUFFER_NORMAL 1 /* When an EOF's been seen but there's still some text to process * then we mark the buffer as YY_EOF_PENDING, to indicate that we * shouldn't try reading from the input source any more. We might * still have a bunch of tokens to match, though, because of * possible backing-up. * * When we actually see the EOF, we change the status to "new" * (via yyrestart()), so that the user can continue scanning by * just pointing yyin at a new input file. */ #define YY_BUFFER_EOF_PENDING 2 }; #endif /* !YY_STRUCT_YY_BUFFER_STATE */ /* Stack of input buffers. */ static size_t yy_buffer_stack_top = 0; /**< index of top of stack. */ static size_t yy_buffer_stack_max = 0; /**< capacity of stack. */ static YY_BUFFER_STATE * yy_buffer_stack = 0; /**< Stack as an array. */ /* We provide macros for accessing buffer states in case in the * future we want to put the buffer states in a more general * "scanner state". * * Returns the top of the stack, or NULL. */ #define YY_CURRENT_BUFFER ( (yy_buffer_stack) \ ? (yy_buffer_stack)[(yy_buffer_stack_top)] \ : NULL) /* Same as previous macro, but useful when we know that the buffer stack is not * NULL or when we need an lvalue. For internal use only. */ #define YY_CURRENT_BUFFER_LVALUE (yy_buffer_stack)[(yy_buffer_stack_top)] /* yy_hold_char holds the character lost when yytext is formed. */ static char yy_hold_char; static int yy_n_chars; /* number of characters read into yy_ch_buf */ int yyleng; /* Points to current character in buffer. */ static char *yy_c_buf_p = (char *) 0; static int yy_init = 0; /* whether we need to initialize */ static int yy_start = 0; /* start state number */ /* Flag which is used to allow yywrap()'s to do buffer switches * instead of setting up a fresh yyin. A bit of a hack ... */ static int yy_did_buffer_switch_on_eof; void yyrestart (FILE *input_file ); void yy_switch_to_buffer (YY_BUFFER_STATE new_buffer ); YY_BUFFER_STATE yy_create_buffer (FILE *file,int size ); void yy_delete_buffer (YY_BUFFER_STATE b ); void yy_flush_buffer (YY_BUFFER_STATE b ); void yypush_buffer_state (YY_BUFFER_STATE new_buffer ); void yypop_buffer_state (void ); static void yyensure_buffer_stack (void ); static void yy_load_buffer_state (void ); static void yy_init_buffer (YY_BUFFER_STATE b,FILE *file ); #define YY_FLUSH_BUFFER yy_flush_buffer(YY_CURRENT_BUFFER ) YY_BUFFER_STATE yy_scan_buffer (char *base,yy_size_t size ); YY_BUFFER_STATE yy_scan_string (yyconst char *yy_str ); YY_BUFFER_STATE yy_scan_bytes (yyconst char *bytes,int len ); void *yyalloc (yy_size_t ); void *yyrealloc (void *,yy_size_t ); void yyfree (void * ); #define yy_new_buffer yy_create_buffer #define yy_set_interactive(is_interactive) \ { \ if ( ! YY_CURRENT_BUFFER ){ \ yyensure_buffer_stack (); \ YY_CURRENT_BUFFER_LVALUE = \ yy_create_buffer(yyin,YY_BUF_SIZE ); \ } \ YY_CURRENT_BUFFER_LVALUE->yy_is_interactive = is_interactive; \ } #define yy_set_bol(at_bol) \ { \ if ( ! YY_CURRENT_BUFFER ){\ yyensure_buffer_stack (); \ YY_CURRENT_BUFFER_LVALUE = \ yy_create_buffer(yyin,YY_BUF_SIZE ); \ } \ YY_CURRENT_BUFFER_LVALUE->yy_at_bol = at_bol; \ } #define YY_AT_BOL() (YY_CURRENT_BUFFER_LVALUE->yy_at_bol) /* Begin user sect3 */ typedef unsigned char YY_CHAR; FILE *yyin = (FILE *) 0, *yyout = (FILE *) 0; typedef int yy_state_type; extern int yylineno; int yylineno = 1; extern char *yytext; #define yytext_ptr yytext static yy_state_type yy_get_previous_state (void ); static yy_state_type yy_try_NUL_trans (yy_state_type current_state ); static int yy_get_next_buffer (void ); static void yy_fatal_error (yyconst char msg[] ); /* Done after the current pattern has been matched and before the * corresponding action - sets up yytext. */ #define YY_DO_BEFORE_ACTION \ (yytext_ptr) = yy_bp; \ (yytext_ptr) -= (yy_more_len); \ yyleng = (size_t) (yy_cp - (yytext_ptr)); \ (yy_hold_char) = *yy_cp; \ *yy_cp = '\0'; \ (yy_c_buf_p) = yy_cp; #define YY_NUM_RULES 25 #define YY_END_OF_BUFFER 26 /* This struct is not used in this scanner, but its presence is necessary. */ struct yy_trans_info { flex_int32_t yy_verify; flex_int32_t yy_nxt; }; static yyconst flex_int16_t yy_accept[67] = { 0, 0, 0, 0, 0, 16, 16, 20, 20, 26, 23, 14, 11, 11, 19, 24, 12, 13, 8, 1, 9, 23, 24, 6, 5, 16, 17, 16, 18, 20, 21, 22, 25, 23, 23, 14, 1, 1, 23, 10, 15, 23, 7, 7, 7, 7, 6, 16, 16, 16, 16, 20, 0, 7, 7, 7, 7, 7, 2, 7, 7, 7, 7, 7, 3, 4, 0 } ; static yyconst flex_int32_t yy_ec[256] = { 0, 1, 1, 1, 1, 1, 1, 1, 1, 2, 3, 1, 1, 4, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 2, 1, 5, 6, 7, 1, 1, 1, 8, 9, 1, 1, 1, 1, 10, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 11, 1, 1, 1, 1, 12, 13, 13, 14, 15, 16, 13, 17, 13, 18, 13, 13, 19, 13, 20, 21, 13, 13, 22, 13, 23, 24, 13, 13, 13, 13, 13, 25, 26, 27, 1, 1, 1, 13, 13, 28, 29, 30, 13, 31, 13, 32, 13, 13, 33, 13, 34, 35, 13, 13, 36, 13, 37, 38, 13, 13, 13, 13, 13, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 } ; static yyconst flex_int32_t yy_meta[39] = { 0, 1, 2, 3, 2, 4, 1, 2, 2, 2, 2, 2, 1, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 1, 1, 6, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5, 5 } ; static yyconst flex_int16_t yy_base[79] = { 0, 0, 25, 114, 113, 12, 14, 16, 17, 115, 88, 12, 187, 187, 187, 187, 187, 187, 187, 0, 87, 50, 59, 0, 187, 86, 187, 18, 187, 85, 187, 187, 105, 82, 95, 14, 0, 0, 81, 75, 64, 0, 0, 28, 27, 27, 0, 63, 20, 42, 39, 5, 8, 53, 51, 51, 52, 55, 0, 49, 56, 63, 59, 79, 0, 0, 187, 121, 127, 133, 139, 145, 151, 157, 1, 163, 169, 174, 180 } ; static yyconst flex_int16_t yy_def[79] = { 0, 67, 67, 68, 68, 69, 69, 70, 70, 66, 71, 66, 66, 66, 66, 66, 66, 66, 66, 72, 71, 73, 74, 75, 66, 76, 66, 77, 66, 78, 66, 66, 78, 71, 73, 66, 72, 72, 71, 71, 71, 34, 74, 74, 74, 74, 75, 76, 77, 76, 77, 78, 78, 74, 74, 74, 74, 74, 74, 74, 74, 74, 74, 74, 74, 74, 0, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66 } ; static yyconst flex_int16_t yy_nxt[226] = { 0, 66, 11, 12, 13, 14, 42, 15, 16, 17, 18, 19, 20, 51, 35, 26, 35, 26, 66, 30, 30, 31, 31, 36, 66, 36, 21, 11, 12, 13, 14, 52, 22, 16, 17, 18, 19, 20, 27, 28, 27, 28, 32, 32, 50, 47, 50, 47, 53, 54, 55, 21, 33, 33, 33, 33, 39, 33, 33, 33, 33, 33, 53, 54, 55, 50, 47, 56, 48, 57, 58, 59, 60, 61, 62, 40, 41, 43, 63, 64, 44, 56, 45, 57, 58, 59, 60, 61, 62, 48, 34, 43, 63, 64, 44, 65, 45, 33, 33, 33, 33, 34, 33, 33, 33, 33, 33, 34, 34, 65, 51, 52, 48, 34, 34, 66, 24, 24, 66, 66, 66, 41, 10, 10, 10, 10, 10, 10, 23, 23, 23, 23, 23, 23, 25, 25, 25, 25, 25, 25, 29, 29, 29, 29, 29, 29, 33, 66, 66, 66, 33, 33, 37, 37, 66, 37, 37, 37, 38, 38, 38, 38, 38, 38, 46, 46, 66, 46, 46, 46, 47, 47, 66, 47, 47, 49, 49, 66, 49, 49, 49, 51, 51, 66, 66, 51, 51, 9, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66 } ; static yyconst flex_int16_t yy_chk[226] = { 0, 0, 1, 1, 1, 1, 74, 1, 1, 1, 1, 1, 1, 52, 11, 5, 35, 6, 0, 7, 8, 7, 8, 11, 0, 35, 1, 2, 2, 2, 2, 51, 2, 2, 2, 2, 2, 2, 5, 5, 6, 6, 7, 8, 27, 27, 48, 48, 43, 44, 45, 2, 21, 21, 21, 21, 21, 21, 21, 21, 21, 21, 43, 44, 45, 50, 50, 53, 49, 54, 55, 56, 57, 59, 60, 21, 21, 22, 61, 62, 22, 53, 22, 54, 55, 56, 57, 59, 60, 47, 40, 22, 61, 62, 22, 63, 22, 34, 34, 34, 34, 39, 34, 34, 34, 34, 34, 38, 33, 63, 32, 29, 25, 20, 10, 9, 4, 3, 0, 0, 0, 34, 67, 67, 67, 67, 67, 67, 68, 68, 68, 68, 68, 68, 69, 69, 69, 69, 69, 69, 70, 70, 70, 70, 70, 70, 71, 0, 0, 0, 71, 71, 72, 72, 0, 72, 72, 72, 73, 73, 73, 73, 73, 73, 75, 75, 0, 75, 75, 75, 76, 76, 0, 76, 76, 77, 77, 0, 77, 77, 77, 78, 78, 0, 0, 78, 78, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66, 66 } ; static yy_state_type yy_last_accepting_state; static char *yy_last_accepting_cpos; extern int yy_flex_debug; int yy_flex_debug = 0; /* The intent behind this definition is that it'll catch * any uses of REJECT which flex missed. */ #define REJECT reject_used_but_not_detected static int yy_more_flag = 0; static int yy_more_len = 0; #define yymore() ((yy_more_flag) = 1) #define YY_MORE_ADJ (yy_more_len) #define YY_RESTORE_YY_MORE_OFFSET char *yytext; #line 1 "zlexer.lex" #line 2 "zlexer.lex" /* * zlexer.lex - lexical analyzer for (DNS) zone files * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include "zonec.h" #include "dname.h" #include "zparser.h" #define YY_NO_UNPUT #if 0 #define LEXOUT(s) printf s /* used ONLY when debugging */ #else #define LEXOUT(s) #endif enum lexer_state { EXPECT_OWNER, PARSING_OWNER, PARSING_TTL_CLASS_TYPE, PARSING_RDATA }; static int parse_token(int token, char *yytext, enum lexer_state *lexer_state); static YY_BUFFER_STATE include_stack[MAXINCLUDES]; static zparser_type zparser_stack[MAXINCLUDES]; static int include_stack_ptr = 0; /* * Saves the file specific variables on the include stack. */ static void push_parser_state(FILE *input) { zparser_stack[include_stack_ptr].filename = parser->filename; zparser_stack[include_stack_ptr].line = parser->line; zparser_stack[include_stack_ptr].origin = parser->origin; include_stack[include_stack_ptr] = YY_CURRENT_BUFFER; yy_switch_to_buffer(yy_create_buffer(input,YY_BUF_SIZE)); ++include_stack_ptr; } /* * Restores the file specific variables from the include stack. */ static void pop_parser_state(void) { --include_stack_ptr; parser->filename = zparser_stack[include_stack_ptr].filename; parser->line = zparser_stack[include_stack_ptr].line; parser->origin = zparser_stack[include_stack_ptr].origin; yy_delete_buffer(YY_CURRENT_BUFFER); yy_switch_to_buffer(include_stack[include_stack_ptr]); } #ifndef yy_set_bol /* compat definition, for flex 2.4.6 */ #define yy_set_bol(at_bol) \ { \ if ( ! yy_current_buffer ) \ yy_current_buffer = yy_create_buffer(yyin,YY_BUF_SIZE ); \ yy_current_buffer->yy_ch_buf[0] = ((at_bol)?'\n':' '); \ } #endif #line 612 "" #define INITIAL 0 #define incl 1 #define bitlabel 2 #define quotedstring 3 #ifndef YY_NO_UNISTD_H /* Special case for "unistd.h", since it is non-ANSI. We include it way * down here because we want the user's section 1 to have been scanned first. * The user has a chance to override it with an option. */ #include #endif #ifndef YY_EXTRA_TYPE #define YY_EXTRA_TYPE void * #endif static int yy_init_globals (void ); /* Accessor methods to globals. These are made visible to non-reentrant scanners for convenience. */ int yylex_destroy (void ); int yyget_debug (void ); void yyset_debug (int debug_flag ); YY_EXTRA_TYPE yyget_extra (void ); void yyset_extra (YY_EXTRA_TYPE user_defined ); FILE *yyget_in (void ); void yyset_in (FILE * in_str ); FILE *yyget_out (void ); void yyset_out (FILE * out_str ); int yyget_leng (void ); char *yyget_text (void ); int yyget_lineno (void ); void yyset_lineno (int line_number ); /* Macros after this point can all be overridden by user definitions in * section 1. */ #ifndef YY_SKIP_YYWRAP #ifdef __cplusplus extern "C" int yywrap (void ); #else extern int yywrap (void ); #endif #endif static void yyunput (int c,char *buf_ptr ); #ifndef yytext_ptr static void yy_flex_strncpy (char *,yyconst char *,int ); #endif #ifdef YY_NEED_STRLEN static int yy_flex_strlen (yyconst char * ); #endif #ifndef YY_NO_INPUT #ifdef __cplusplus static int yyinput (void ); #else static int input (void ); #endif #endif /* Amount of stuff to slurp up with each read. */ #ifndef YY_READ_BUF_SIZE #ifdef __ia64__ /* On IA-64, the buffer size is 16k, not 8k */ #define YY_READ_BUF_SIZE 16384 #else #define YY_READ_BUF_SIZE 8192 #endif /* __ia64__ */ #endif /* Copy whatever the last rule matched to the standard output. */ #ifndef ECHO /* This used to be an fputs(), but since the string might contain NUL's, * we now use fwrite(). */ #define ECHO do { if (fwrite( yytext, yyleng, 1, yyout )) {} } while (0) #endif /* Gets input and stuffs it into "buf". number of characters read, or YY_NULL, * is returned in "result". */ #ifndef YY_INPUT #define YY_INPUT(buf,result,max_size) \ if ( YY_CURRENT_BUFFER_LVALUE->yy_is_interactive ) \ { \ int c = '*'; \ size_t n; \ for ( n = 0; n < max_size && \ (c = getc( yyin )) != EOF && c != '\n'; ++n ) \ buf[n] = (char) c; \ if ( c == '\n' ) \ buf[n++] = (char) c; \ if ( c == EOF && ferror( yyin ) ) \ YY_FATAL_ERROR( "input in flex scanner failed" ); \ result = n; \ } \ else \ { \ errno=0; \ while ( (result = fread(buf, 1, max_size, yyin))==0 && ferror(yyin)) \ { \ if( errno != EINTR) \ { \ YY_FATAL_ERROR( "input in flex scanner failed" ); \ break; \ } \ errno=0; \ clearerr(yyin); \ } \ }\ \ #endif /* No semi-colon after return; correct usage is to write "yyterminate();" - * we don't want an extra ';' after the "return" because that will cause * some compilers to complain about unreachable statements. */ #ifndef yyterminate #define yyterminate() return YY_NULL #endif /* Number of entries by which start-condition stack grows. */ #ifndef YY_START_STACK_INCR #define YY_START_STACK_INCR 25 #endif /* Report a fatal error. */ #ifndef YY_FATAL_ERROR #define YY_FATAL_ERROR(msg) yy_fatal_error( msg ) #endif /* end tables serialization structures and prototypes */ /* Default declaration of generated scanner - a define so the user can * easily add parameters. */ #ifndef YY_DECL #define YY_DECL_IS_OURS 1 extern int yylex (void); #define YY_DECL int yylex (void) #endif /* !YY_DECL */ /* Code executed at the beginning of each rule, after yytext and yyleng * have been set up. */ #ifndef YY_USER_ACTION #define YY_USER_ACTION #endif /* Code executed at the end of each rule. */ #ifndef YY_BREAK #define YY_BREAK break; #endif #define YY_RULE_SETUP \ if ( yyleng > 0 ) \ YY_CURRENT_BUFFER_LVALUE->yy_at_bol = \ (yytext[yyleng - 1] == '\n'); \ YY_USER_ACTION /** The main scanner function which does all the work. */ YY_DECL { register yy_state_type yy_current_state; register char *yy_cp, *yy_bp; register int yy_act; #line 94 "zlexer.lex" static int paren_open = 0; static enum lexer_state lexer_state = EXPECT_OWNER; #line 809 "" if ( !(yy_init) ) { (yy_init) = 1; #ifdef YY_USER_INIT YY_USER_INIT; #endif if ( ! (yy_start) ) (yy_start) = 1; /* first start state */ if ( ! yyin ) yyin = stdin; if ( ! yyout ) yyout = stdout; if ( ! YY_CURRENT_BUFFER ) { yyensure_buffer_stack (); YY_CURRENT_BUFFER_LVALUE = yy_create_buffer(yyin,YY_BUF_SIZE ); } yy_load_buffer_state( ); } while ( 1 ) /* loops until end-of-file is reached */ { (yy_more_len) = 0; if ( (yy_more_flag) ) { (yy_more_len) = (yy_c_buf_p) - (yytext_ptr); (yy_more_flag) = 0; } yy_cp = (yy_c_buf_p); /* Support of yytext. */ *yy_cp = (yy_hold_char); /* yy_bp points to the position in yy_ch_buf of the start of * the current run. */ yy_bp = yy_cp; yy_current_state = (yy_start); yy_current_state += YY_AT_BOL(); yy_match: do { register YY_CHAR yy_c = yy_ec[YY_SC_TO_UI(*yy_cp)]; if ( yy_accept[yy_current_state] ) { (yy_last_accepting_state) = yy_current_state; (yy_last_accepting_cpos) = yy_cp; } while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) { yy_current_state = (int) yy_def[yy_current_state]; if ( yy_current_state >= 67 ) yy_c = yy_meta[(unsigned int) yy_c]; } yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c]; ++yy_cp; } while ( yy_base[yy_current_state] != 187 ); yy_find_action: yy_act = yy_accept[yy_current_state]; if ( yy_act == 0 ) { /* have to back up */ yy_cp = (yy_last_accepting_cpos); yy_current_state = (yy_last_accepting_state); yy_act = yy_accept[yy_current_state]; } YY_DO_BEFORE_ACTION; do_action: /* This label is used only to access EOF actions. */ switch ( yy_act ) { /* beginning of action switch */ case 0: /* must back up */ /* undo the effects of YY_DO_BEFORE_ACTION */ *yy_cp = (yy_hold_char); yy_cp = (yy_last_accepting_cpos); yy_current_state = (yy_last_accepting_state); goto yy_find_action; case 1: YY_RULE_SETUP #line 97 "zlexer.lex" /* ignore */ YY_BREAK case 2: YY_RULE_SETUP #line 98 "zlexer.lex" { lexer_state = PARSING_RDATA; return DOLLAR_TTL; } YY_BREAK case 3: YY_RULE_SETUP #line 99 "zlexer.lex" { lexer_state = PARSING_RDATA; return DOLLAR_ORIGIN; } YY_BREAK /* * Handle $INCLUDE directives. See * http://dinosaur.compilertools.net/flex/flex_12.html#SEC12. */ case 4: YY_RULE_SETUP #line 105 "zlexer.lex" { BEGIN(incl); } YY_BREAK case 5: /* rule 5 can match eol */ #line 109 "zlexer.lex" case YY_STATE_EOF(incl): #line 109 "zlexer.lex" { int error_occurred = parser->error_occurred; BEGIN(INITIAL); zc_error("missing file name in $INCLUDE directive"); yy_set_bol(1); /* Set beginning of line, so "^" rules match. */ ++parser->line; parser->error_occurred = error_occurred; } YY_BREAK case 6: YY_RULE_SETUP #line 117 "zlexer.lex" { char *tmp; domain_type *origin = parser->origin; int error_occurred = parser->error_occurred; BEGIN(INITIAL); if (include_stack_ptr >= MAXINCLUDES ) { zc_error("includes nested too deeply, skipped (>%d)", MAXINCLUDES); } else { FILE *input; /* Remove trailing comment. */ tmp = strrchr(yytext, ';'); if (tmp) { *tmp = '\0'; } strip_string(yytext); /* Parse origin for include file. */ tmp = strrchr(yytext, ' '); if (!tmp) { tmp = strrchr(yytext, '\t'); } if (tmp) { const dname_type *dname; /* split the original yytext */ *tmp = '\0'; strip_string(yytext); dname = dname_parse(parser->region, tmp + 1); if (!dname) { zc_error("incorrect include origin '%s'", tmp + 1); } else if (*(tmp + strlen(tmp + 1)) != '.') { zc_error("$INCLUDE directive requires absolute domain name"); } else { origin = domain_table_insert( parser->db->domains, dname); } } if (strlen(yytext) == 0) { zc_error("missing file name in $INCLUDE directive"); } else if (!(input = fopen(yytext, "r"))) { zc_error("cannot open include file '%s': %s", yytext, strerror(errno)); } else { /* Initialize parser for include file. */ char *filename = region_strdup(parser->region, yytext); push_parser_state(input); /* Destroys yytext. */ parser->filename = filename; parser->line = 1; parser->origin = origin; lexer_state = EXPECT_OWNER; } } parser->error_occurred = error_occurred; } YY_BREAK case YY_STATE_EOF(INITIAL): #line 178 "zlexer.lex" { yy_set_bol(1); /* Set beginning of line, so "^" rules match. */ if (include_stack_ptr == 0) { yyterminate(); } else { fclose(yyin); pop_parser_state(); } } YY_BREAK case 7: YY_RULE_SETUP #line 187 "zlexer.lex" { zc_warning("Unknown directive: %s", yytext); } YY_BREAK case 8: YY_RULE_SETUP #line 188 "zlexer.lex" { LEXOUT((". ")); return parse_token('.', yytext, &lexer_state); } YY_BREAK case 9: YY_RULE_SETUP #line 192 "zlexer.lex" { LEXOUT(("@ ")); return parse_token('@', yytext, &lexer_state); } YY_BREAK case 10: YY_RULE_SETUP #line 196 "zlexer.lex" { LEXOUT(("\\# ")); return parse_token(URR, yytext, &lexer_state); } YY_BREAK case 11: /* rule 11 can match eol */ YY_RULE_SETUP #line 200 "zlexer.lex" { ++parser->line; if (!paren_open) { lexer_state = EXPECT_OWNER; LEXOUT(("NL\n")); return NL; } else { LEXOUT(("SP ")); return SP; } } YY_BREAK case 12: YY_RULE_SETUP #line 211 "zlexer.lex" { if (paren_open) { zc_error("nested parentheses"); yyterminate(); } LEXOUT(("( ")); paren_open = 1; return SP; } YY_BREAK case 13: YY_RULE_SETUP #line 220 "zlexer.lex" { if (!paren_open) { zc_error("closing parentheses without opening parentheses"); yyterminate(); } LEXOUT((") ")); paren_open = 0; return SP; } YY_BREAK case 14: YY_RULE_SETUP #line 229 "zlexer.lex" { if (!paren_open && lexer_state == EXPECT_OWNER) { lexer_state = PARSING_TTL_CLASS_TYPE; LEXOUT(("PREV ")); return PREV; } if (lexer_state == PARSING_OWNER) { lexer_state = PARSING_TTL_CLASS_TYPE; } LEXOUT(("SP ")); return SP; } YY_BREAK /* Bitlabels. Strip leading and ending brackets. */ case 15: YY_RULE_SETUP #line 243 "zlexer.lex" { BEGIN(bitlabel); } YY_BREAK case YY_STATE_EOF(bitlabel): #line 244 "zlexer.lex" { zc_error("EOF inside bitlabel"); BEGIN(INITIAL); } YY_BREAK case 16: YY_RULE_SETUP #line 248 "zlexer.lex" { yymore(); } YY_BREAK case 17: /* rule 17 can match eol */ YY_RULE_SETUP #line 249 "zlexer.lex" { ++parser->line; yymore(); } YY_BREAK case 18: YY_RULE_SETUP #line 250 "zlexer.lex" { BEGIN(INITIAL); yytext[yyleng - 1] = '\0'; return parse_token(BITLAB, yytext, &lexer_state); } YY_BREAK /* Quoted strings. Strip leading and ending quotes. */ case 19: YY_RULE_SETUP #line 257 "zlexer.lex" { BEGIN(quotedstring); LEXOUT(("\" ")); } YY_BREAK case YY_STATE_EOF(quotedstring): #line 258 "zlexer.lex" { zc_error("EOF inside quoted string"); BEGIN(INITIAL); } YY_BREAK case 20: YY_RULE_SETUP #line 262 "zlexer.lex" { LEXOUT(("STR ")); yymore(); } YY_BREAK case 21: /* rule 21 can match eol */ YY_RULE_SETUP #line 263 "zlexer.lex" { ++parser->line; yymore(); } YY_BREAK case 22: YY_RULE_SETUP #line 264 "zlexer.lex" { LEXOUT(("\" ")); BEGIN(INITIAL); yytext[yyleng - 1] = '\0'; return parse_token(STR, yytext, &lexer_state); } YY_BREAK case 23: /* rule 23 can match eol */ YY_RULE_SETUP #line 271 "zlexer.lex" { /* Any allowed word. */ return parse_token(STR, yytext, &lexer_state); } YY_BREAK case 24: YY_RULE_SETUP #line 275 "zlexer.lex" { zc_error("unknown character '%c' (\\%03d) seen - is this a zonefile?", (int) yytext[0], (int) yytext[0]); } YY_BREAK case 25: YY_RULE_SETUP #line 279 "zlexer.lex" ECHO; YY_BREAK #line 1192 "" case YY_END_OF_BUFFER: { /* Amount of text matched not including the EOB char. */ int yy_amount_of_matched_text = (int) (yy_cp - (yytext_ptr)) - 1; /* Undo the effects of YY_DO_BEFORE_ACTION. */ *yy_cp = (yy_hold_char); YY_RESTORE_YY_MORE_OFFSET if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_NEW ) { /* We're scanning a new file or input source. It's * possible that this happened because the user * just pointed yyin at a new source and called * yylex(). If so, then we have to assure * consistency between YY_CURRENT_BUFFER and our * globals. Here is the right place to do so, because * this is the first action (other than possibly a * back-up) that will match for the new input source. */ (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_n_chars; YY_CURRENT_BUFFER_LVALUE->yy_input_file = yyin; YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = YY_BUFFER_NORMAL; } /* Note that here we test for yy_c_buf_p "<=" to the position * of the first EOB in the buffer, since yy_c_buf_p will * already have been incremented past the NUL character * (since all states make transitions on EOB to the * end-of-buffer state). Contrast this with the test * in input(). */ if ( (yy_c_buf_p) <= &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] ) { /* This was really a NUL. */ yy_state_type yy_next_state; (yy_c_buf_p) = (yytext_ptr) + yy_amount_of_matched_text; yy_current_state = yy_get_previous_state( ); /* Okay, we're now positioned to make the NUL * transition. We couldn't have * yy_get_previous_state() go ahead and do it * for us because it doesn't know how to deal * with the possibility of jamming (and we don't * want to build jamming into it because then it * will run more slowly). */ yy_next_state = yy_try_NUL_trans( yy_current_state ); yy_bp = (yytext_ptr) + YY_MORE_ADJ; if ( yy_next_state ) { /* Consume the NUL. */ yy_cp = ++(yy_c_buf_p); yy_current_state = yy_next_state; goto yy_match; } else { yy_cp = (yy_c_buf_p); goto yy_find_action; } } else switch ( yy_get_next_buffer( ) ) { case EOB_ACT_END_OF_FILE: { (yy_did_buffer_switch_on_eof) = 0; if ( yywrap( ) ) { /* Note: because we've taken care in * yy_get_next_buffer() to have set up * yytext, we can now set up * yy_c_buf_p so that if some total * hoser (like flex itself) wants to * call the scanner after we return the * YY_NULL, it'll still work - another * YY_NULL will get returned. */ (yy_c_buf_p) = (yytext_ptr) + YY_MORE_ADJ; yy_act = YY_STATE_EOF(YY_START); goto do_action; } else { if ( ! (yy_did_buffer_switch_on_eof) ) YY_NEW_FILE; } break; } case EOB_ACT_CONTINUE_SCAN: (yy_c_buf_p) = (yytext_ptr) + yy_amount_of_matched_text; yy_current_state = yy_get_previous_state( ); yy_cp = (yy_c_buf_p); yy_bp = (yytext_ptr) + YY_MORE_ADJ; goto yy_match; case EOB_ACT_LAST_MATCH: (yy_c_buf_p) = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)]; yy_current_state = yy_get_previous_state( ); yy_cp = (yy_c_buf_p); yy_bp = (yytext_ptr) + YY_MORE_ADJ; goto yy_find_action; } break; } default: YY_FATAL_ERROR( "fatal flex scanner internal error--no action found" ); } /* end of action switch */ } /* end of scanning one token */ } /* end of yylex */ /* yy_get_next_buffer - try to read in a new buffer * * Returns a code representing an action: * EOB_ACT_LAST_MATCH - * EOB_ACT_CONTINUE_SCAN - continue scanning from current position * EOB_ACT_END_OF_FILE - end of file */ static int yy_get_next_buffer (void) { register char *dest = YY_CURRENT_BUFFER_LVALUE->yy_ch_buf; register char *source = (yytext_ptr); register int number_to_move, i; int ret_val; if ( (yy_c_buf_p) > &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] ) YY_FATAL_ERROR( "fatal flex scanner internal error--end of buffer missed" ); if ( YY_CURRENT_BUFFER_LVALUE->yy_fill_buffer == 0 ) { /* Don't try to fill the buffer, so this is an EOF. */ if ( (yy_c_buf_p) - (yytext_ptr) - YY_MORE_ADJ == 1 ) { /* We matched a single character, the EOB, so * treat this as a final EOF. */ return EOB_ACT_END_OF_FILE; } else { /* We matched some text prior to the EOB, first * process it. */ return EOB_ACT_LAST_MATCH; } } /* Try to read more data. */ /* First move last chars to start of buffer. */ number_to_move = (int) ((yy_c_buf_p) - (yytext_ptr)) - 1; for ( i = 0; i < number_to_move; ++i ) *(dest++) = *(source++); if ( YY_CURRENT_BUFFER_LVALUE->yy_buffer_status == YY_BUFFER_EOF_PENDING ) /* don't do the read, it's not guaranteed to return an EOF, * just force an EOF */ YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars) = 0; else { int num_to_read = YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1; while ( num_to_read <= 0 ) { /* Not enough room in the buffer - grow it. */ /* just a shorter name for the current buffer */ YY_BUFFER_STATE b = YY_CURRENT_BUFFER; int yy_c_buf_p_offset = (int) ((yy_c_buf_p) - b->yy_ch_buf); if ( b->yy_is_our_buffer ) { int new_size = b->yy_buf_size * 2; if ( new_size <= 0 ) b->yy_buf_size += b->yy_buf_size / 8; else b->yy_buf_size *= 2; b->yy_ch_buf = (char *) /* Include room in for 2 EOB chars. */ yyrealloc((void *) b->yy_ch_buf,b->yy_buf_size + 2 ); } else /* Can't grow it, we don't own it. */ b->yy_ch_buf = 0; if ( ! b->yy_ch_buf ) YY_FATAL_ERROR( "fatal error - scanner input buffer overflow" ); (yy_c_buf_p) = &b->yy_ch_buf[yy_c_buf_p_offset]; num_to_read = YY_CURRENT_BUFFER_LVALUE->yy_buf_size - number_to_move - 1; } if ( num_to_read > YY_READ_BUF_SIZE ) num_to_read = YY_READ_BUF_SIZE; /* Read in more data. */ YY_INPUT( (&YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]), (yy_n_chars), (size_t) num_to_read ); YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars); } if ( (yy_n_chars) == 0 ) { if ( number_to_move == YY_MORE_ADJ ) { ret_val = EOB_ACT_END_OF_FILE; yyrestart(yyin ); } else { ret_val = EOB_ACT_LAST_MATCH; YY_CURRENT_BUFFER_LVALUE->yy_buffer_status = YY_BUFFER_EOF_PENDING; } } else ret_val = EOB_ACT_CONTINUE_SCAN; if ((yy_size_t) ((yy_n_chars) + number_to_move) > YY_CURRENT_BUFFER_LVALUE->yy_buf_size) { /* Extend the array by 50%, plus the number we really need. */ yy_size_t new_size = (yy_n_chars) + number_to_move + ((yy_n_chars) >> 1); YY_CURRENT_BUFFER_LVALUE->yy_ch_buf = (char *) yyrealloc((void *) YY_CURRENT_BUFFER_LVALUE->yy_ch_buf,new_size ); if ( ! YY_CURRENT_BUFFER_LVALUE->yy_ch_buf ) YY_FATAL_ERROR( "out of dynamic memory in yy_get_next_buffer()" ); } (yy_n_chars) += number_to_move; YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] = YY_END_OF_BUFFER_CHAR; YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars) + 1] = YY_END_OF_BUFFER_CHAR; (yytext_ptr) = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[0]; return ret_val; } /* yy_get_previous_state - get the state just before the EOB char was reached */ static yy_state_type yy_get_previous_state (void) { register yy_state_type yy_current_state; register char *yy_cp; yy_current_state = (yy_start); yy_current_state += YY_AT_BOL(); for ( yy_cp = (yytext_ptr) + YY_MORE_ADJ; yy_cp < (yy_c_buf_p); ++yy_cp ) { register YY_CHAR yy_c = (*yy_cp ? yy_ec[YY_SC_TO_UI(*yy_cp)] : 1); if ( yy_accept[yy_current_state] ) { (yy_last_accepting_state) = yy_current_state; (yy_last_accepting_cpos) = yy_cp; } while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) { yy_current_state = (int) yy_def[yy_current_state]; if ( yy_current_state >= 67 ) yy_c = yy_meta[(unsigned int) yy_c]; } yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c]; } return yy_current_state; } /* yy_try_NUL_trans - try to make a transition on the NUL character * * synopsis * next_state = yy_try_NUL_trans( current_state ); */ static yy_state_type yy_try_NUL_trans (yy_state_type yy_current_state ) { register int yy_is_jam; register char *yy_cp = (yy_c_buf_p); register YY_CHAR yy_c = 1; if ( yy_accept[yy_current_state] ) { (yy_last_accepting_state) = yy_current_state; (yy_last_accepting_cpos) = yy_cp; } while ( yy_chk[yy_base[yy_current_state] + yy_c] != yy_current_state ) { yy_current_state = (int) yy_def[yy_current_state]; if ( yy_current_state >= 67 ) yy_c = yy_meta[(unsigned int) yy_c]; } yy_current_state = yy_nxt[yy_base[yy_current_state] + (unsigned int) yy_c]; yy_is_jam = (yy_current_state == 66); return yy_is_jam ? 0 : yy_current_state; } static void yyunput (int c, register char * yy_bp ) { register char *yy_cp; yy_cp = (yy_c_buf_p); /* undo effects of setting up yytext */ *yy_cp = (yy_hold_char); if ( yy_cp < YY_CURRENT_BUFFER_LVALUE->yy_ch_buf + 2 ) { /* need to shift things up to make room */ /* +2 for EOB chars. */ register int number_to_move = (yy_n_chars) + 2; register char *dest = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[ YY_CURRENT_BUFFER_LVALUE->yy_buf_size + 2]; register char *source = &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[number_to_move]; while ( source > YY_CURRENT_BUFFER_LVALUE->yy_ch_buf ) *--dest = *--source; yy_cp += (int) (dest - source); yy_bp += (int) (dest - source); YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_buf_size; if ( yy_cp < YY_CURRENT_BUFFER_LVALUE->yy_ch_buf + 2 ) YY_FATAL_ERROR( "flex scanner push-back overflow" ); } *--yy_cp = (char) c; (yytext_ptr) = yy_bp; (yy_hold_char) = *yy_cp; (yy_c_buf_p) = yy_cp; } #ifndef YY_NO_INPUT #ifdef __cplusplus static int yyinput (void) #else static int input (void) #endif { int c; *(yy_c_buf_p) = (yy_hold_char); if ( *(yy_c_buf_p) == YY_END_OF_BUFFER_CHAR ) { /* yy_c_buf_p now points to the character we want to return. * If this occurs *before* the EOB characters, then it's a * valid NUL; if not, then we've hit the end of the buffer. */ if ( (yy_c_buf_p) < &YY_CURRENT_BUFFER_LVALUE->yy_ch_buf[(yy_n_chars)] ) /* This was really a NUL. */ *(yy_c_buf_p) = '\0'; else { /* need more input */ int offset = (yy_c_buf_p) - (yytext_ptr); ++(yy_c_buf_p); switch ( yy_get_next_buffer( ) ) { case EOB_ACT_LAST_MATCH: /* This happens because yy_g_n_b() * sees that we've accumulated a * token and flags that we need to * try matching the token before * proceeding. But for input(), * there's no matching to consider. * So convert the EOB_ACT_LAST_MATCH * to EOB_ACT_END_OF_FILE. */ /* Reset buffer status. */ yyrestart(yyin ); /*FALLTHROUGH*/ case EOB_ACT_END_OF_FILE: { if ( yywrap( ) ) return EOF; if ( ! (yy_did_buffer_switch_on_eof) ) YY_NEW_FILE; #ifdef __cplusplus return yyinput(); #else return input(); #endif } case EOB_ACT_CONTINUE_SCAN: (yy_c_buf_p) = (yytext_ptr) + offset; break; } } } c = *(unsigned char *) (yy_c_buf_p); /* cast for 8-bit char's */ *(yy_c_buf_p) = '\0'; /* preserve yytext */ (yy_hold_char) = *++(yy_c_buf_p); YY_CURRENT_BUFFER_LVALUE->yy_at_bol = (c == '\n'); return c; } #endif /* ifndef YY_NO_INPUT */ /** Immediately switch to a different input stream. * @param input_file A readable stream. * * @note This function does not reset the start condition to @c INITIAL . */ void yyrestart (FILE * input_file ) { if ( ! YY_CURRENT_BUFFER ){ yyensure_buffer_stack (); YY_CURRENT_BUFFER_LVALUE = yy_create_buffer(yyin,YY_BUF_SIZE ); } yy_init_buffer(YY_CURRENT_BUFFER,input_file ); yy_load_buffer_state( ); } /** Switch to a different input buffer. * @param new_buffer The new input buffer. * */ void yy_switch_to_buffer (YY_BUFFER_STATE new_buffer ) { /* TODO. We should be able to replace this entire function body * with * yypop_buffer_state(); * yypush_buffer_state(new_buffer); */ yyensure_buffer_stack (); if ( YY_CURRENT_BUFFER == new_buffer ) return; if ( YY_CURRENT_BUFFER ) { /* Flush out information for old buffer. */ *(yy_c_buf_p) = (yy_hold_char); YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = (yy_c_buf_p); YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars); } YY_CURRENT_BUFFER_LVALUE = new_buffer; yy_load_buffer_state( ); /* We don't actually know whether we did this switch during * EOF (yywrap()) processing, but the only time this flag * is looked at is after yywrap() is called, so it's safe * to go ahead and always set it. */ (yy_did_buffer_switch_on_eof) = 1; } static void yy_load_buffer_state (void) { (yy_n_chars) = YY_CURRENT_BUFFER_LVALUE->yy_n_chars; (yytext_ptr) = (yy_c_buf_p) = YY_CURRENT_BUFFER_LVALUE->yy_buf_pos; yyin = YY_CURRENT_BUFFER_LVALUE->yy_input_file; (yy_hold_char) = *(yy_c_buf_p); } /** Allocate and initialize an input buffer state. * @param file A readable stream. * @param size The character buffer size in bytes. When in doubt, use @c YY_BUF_SIZE. * * @return the allocated buffer state. */ YY_BUFFER_STATE yy_create_buffer (FILE * file, int size ) { YY_BUFFER_STATE b; b = (YY_BUFFER_STATE) yyalloc(sizeof( struct yy_buffer_state ) ); if ( ! b ) YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" ); b->yy_buf_size = size; /* yy_ch_buf has to be 2 characters longer than the size given because * we need to put in 2 end-of-buffer characters. */ b->yy_ch_buf = (char *) yyalloc(b->yy_buf_size + 2 ); if ( ! b->yy_ch_buf ) YY_FATAL_ERROR( "out of dynamic memory in yy_create_buffer()" ); b->yy_is_our_buffer = 1; yy_init_buffer(b,file ); return b; } /** Destroy the buffer. * @param b a buffer created with yy_create_buffer() * */ void yy_delete_buffer (YY_BUFFER_STATE b ) { if ( ! b ) return; if ( b == YY_CURRENT_BUFFER ) /* Not sure if we should pop here. */ YY_CURRENT_BUFFER_LVALUE = (YY_BUFFER_STATE) 0; if ( b->yy_is_our_buffer ) yyfree((void *) b->yy_ch_buf ); yyfree((void *) b ); } #ifndef __cplusplus extern int isatty (int ); #endif /* __cplusplus */ /* Initializes or reinitializes a buffer. * This function is sometimes called more than once on the same buffer, * such as during a yyrestart() or at EOF. */ static void yy_init_buffer (YY_BUFFER_STATE b, FILE * file ) { int oerrno = errno; yy_flush_buffer(b ); b->yy_input_file = file; b->yy_fill_buffer = 1; /* If b is the current buffer, then yy_init_buffer was _probably_ * called from yyrestart() or through yy_get_next_buffer. * In that case, we don't want to reset the lineno or column. */ if (b != YY_CURRENT_BUFFER){ b->yy_bs_lineno = 1; b->yy_bs_column = 0; } b->yy_is_interactive = file ? (isatty( fileno(file) ) > 0) : 0; errno = oerrno; } /** Discard all buffered characters. On the next scan, YY_INPUT will be called. * @param b the buffer state to be flushed, usually @c YY_CURRENT_BUFFER. * */ void yy_flush_buffer (YY_BUFFER_STATE b ) { if ( ! b ) return; b->yy_n_chars = 0; /* We always need two end-of-buffer characters. The first causes * a transition to the end-of-buffer state. The second causes * a jam in that state. */ b->yy_ch_buf[0] = YY_END_OF_BUFFER_CHAR; b->yy_ch_buf[1] = YY_END_OF_BUFFER_CHAR; b->yy_buf_pos = &b->yy_ch_buf[0]; b->yy_at_bol = 1; b->yy_buffer_status = YY_BUFFER_NEW; if ( b == YY_CURRENT_BUFFER ) yy_load_buffer_state( ); } /** Pushes the new state onto the stack. The new state becomes * the current state. This function will allocate the stack * if necessary. * @param new_buffer The new state. * */ void yypush_buffer_state (YY_BUFFER_STATE new_buffer ) { if (new_buffer == NULL) return; yyensure_buffer_stack(); /* This block is copied from yy_switch_to_buffer. */ if ( YY_CURRENT_BUFFER ) { /* Flush out information for old buffer. */ *(yy_c_buf_p) = (yy_hold_char); YY_CURRENT_BUFFER_LVALUE->yy_buf_pos = (yy_c_buf_p); YY_CURRENT_BUFFER_LVALUE->yy_n_chars = (yy_n_chars); } /* Only push if top exists. Otherwise, replace top. */ if (YY_CURRENT_BUFFER) (yy_buffer_stack_top)++; YY_CURRENT_BUFFER_LVALUE = new_buffer; /* copied from yy_switch_to_buffer. */ yy_load_buffer_state( ); (yy_did_buffer_switch_on_eof) = 1; } /** Removes and deletes the top of the stack, if present. * The next element becomes the new top. * */ void yypop_buffer_state (void) { if (!YY_CURRENT_BUFFER) return; yy_delete_buffer(YY_CURRENT_BUFFER ); YY_CURRENT_BUFFER_LVALUE = NULL; if ((yy_buffer_stack_top) > 0) --(yy_buffer_stack_top); if (YY_CURRENT_BUFFER) { yy_load_buffer_state( ); (yy_did_buffer_switch_on_eof) = 1; } } /* Allocates the stack if it does not exist. * Guarantees space for at least one push. */ static void yyensure_buffer_stack (void) { int num_to_alloc; if (!(yy_buffer_stack)) { /* First allocation is just for 2 elements, since we don't know if this * scanner will even need a stack. We use 2 instead of 1 to avoid an * immediate realloc on the next call. */ num_to_alloc = 1; (yy_buffer_stack) = (struct yy_buffer_state**)yyalloc (num_to_alloc * sizeof(struct yy_buffer_state*) ); if ( ! (yy_buffer_stack) ) YY_FATAL_ERROR( "out of dynamic memory in yyensure_buffer_stack()" ); memset((yy_buffer_stack), 0, num_to_alloc * sizeof(struct yy_buffer_state*)); (yy_buffer_stack_max) = num_to_alloc; (yy_buffer_stack_top) = 0; return; } if ((yy_buffer_stack_top) >= ((yy_buffer_stack_max)) - 1){ /* Increase the buffer to prepare for a possible push. */ int grow_size = 8 /* arbitrary grow size */; num_to_alloc = (yy_buffer_stack_max) + grow_size; (yy_buffer_stack) = (struct yy_buffer_state**)yyrealloc ((yy_buffer_stack), num_to_alloc * sizeof(struct yy_buffer_state*) ); if ( ! (yy_buffer_stack) ) YY_FATAL_ERROR( "out of dynamic memory in yyensure_buffer_stack()" ); /* zero only the new slots.*/ memset((yy_buffer_stack) + (yy_buffer_stack_max), 0, grow_size * sizeof(struct yy_buffer_state*)); (yy_buffer_stack_max) = num_to_alloc; } } /** Setup the input buffer state to scan directly from a user-specified character buffer. * @param base the character buffer * @param size the size in bytes of the character buffer * * @return the newly allocated buffer state object. */ YY_BUFFER_STATE yy_scan_buffer (char * base, yy_size_t size ) { YY_BUFFER_STATE b; if ( size < 2 || base[size-2] != YY_END_OF_BUFFER_CHAR || base[size-1] != YY_END_OF_BUFFER_CHAR ) /* They forgot to leave room for the EOB's. */ return 0; b = (YY_BUFFER_STATE) yyalloc(sizeof( struct yy_buffer_state ) ); if ( ! b ) YY_FATAL_ERROR( "out of dynamic memory in yy_scan_buffer()" ); b->yy_buf_size = size - 2; /* "- 2" to take care of EOB's */ b->yy_buf_pos = b->yy_ch_buf = base; b->yy_is_our_buffer = 0; b->yy_input_file = 0; b->yy_n_chars = b->yy_buf_size; b->yy_is_interactive = 0; b->yy_at_bol = 1; b->yy_fill_buffer = 0; b->yy_buffer_status = YY_BUFFER_NEW; yy_switch_to_buffer(b ); return b; } /** Setup the input buffer state to scan a string. The next call to yylex() will * scan from a @e copy of @a str. * @param yystr a NUL-terminated string to scan * * @return the newly allocated buffer state object. * @note If you want to scan bytes that may contain NUL values, then use * yy_scan_bytes() instead. */ YY_BUFFER_STATE yy_scan_string (yyconst char * yystr ) { return yy_scan_bytes(yystr,strlen(yystr) ); } /** Setup the input buffer state to scan the given bytes. The next call to yylex() will * scan from a @e copy of @a bytes. * @param yybytes the byte buffer to scan * @param _yybytes_len the number of bytes in the buffer pointed to by @a bytes. * * @return the newly allocated buffer state object. */ YY_BUFFER_STATE yy_scan_bytes (yyconst char * yybytes, int _yybytes_len ) { YY_BUFFER_STATE b; char *buf; yy_size_t n; int i; /* Get memory for full buffer, including space for trailing EOB's. */ n = _yybytes_len + 2; buf = (char *) yyalloc(n ); if ( ! buf ) YY_FATAL_ERROR( "out of dynamic memory in yy_scan_bytes()" ); for ( i = 0; i < _yybytes_len; ++i ) buf[i] = yybytes[i]; buf[_yybytes_len] = buf[_yybytes_len+1] = YY_END_OF_BUFFER_CHAR; b = yy_scan_buffer(buf,n ); if ( ! b ) YY_FATAL_ERROR( "bad buffer in yy_scan_bytes()" ); /* It's okay to grow etc. this buffer, and we should throw it * away when we're done. */ b->yy_is_our_buffer = 1; return b; } #ifndef YY_EXIT_FAILURE #define YY_EXIT_FAILURE 2 #endif static void yy_fatal_error (yyconst char* msg ) { (void) fprintf( stderr, "%s\n", msg ); exit( YY_EXIT_FAILURE ); } /* Redefine yyless() so it works in section 3 code. */ #undef yyless #define yyless(n) \ do \ { \ /* Undo effects of setting up yytext. */ \ int yyless_macro_arg = (n); \ YY_LESS_LINENO(yyless_macro_arg);\ yytext[yyleng] = (yy_hold_char); \ (yy_c_buf_p) = yytext + yyless_macro_arg; \ (yy_hold_char) = *(yy_c_buf_p); \ *(yy_c_buf_p) = '\0'; \ yyleng = yyless_macro_arg; \ } \ while ( 0 ) /* Accessor methods (get/set functions) to struct members. */ /** Get the current line number. * */ int yyget_lineno (void) { return yylineno; } /** Get the input stream. * */ FILE *yyget_in (void) { return yyin; } /** Get the output stream. * */ FILE *yyget_out (void) { return yyout; } /** Get the length of the current token. * */ int yyget_leng (void) { return yyleng; } /** Get the current token. * */ char *yyget_text (void) { return yytext; } /** Set the current line number. * @param line_number * */ void yyset_lineno (int line_number ) { yylineno = line_number; } /** Set the input stream. This does not discard the current * input buffer. * @param in_str A readable stream. * * @see yy_switch_to_buffer */ void yyset_in (FILE * in_str ) { yyin = in_str ; } void yyset_out (FILE * out_str ) { yyout = out_str ; } int yyget_debug (void) { return yy_flex_debug; } void yyset_debug (int bdebug ) { yy_flex_debug = bdebug ; } static int yy_init_globals (void) { /* Initialization is the same as for the non-reentrant scanner. * This function is called from yylex_destroy(), so don't allocate here. */ (yy_buffer_stack) = 0; (yy_buffer_stack_top) = 0; (yy_buffer_stack_max) = 0; (yy_c_buf_p) = (char *) 0; (yy_init) = 0; (yy_start) = 0; /* Defined in main.c */ #ifdef YY_STDINIT yyin = stdin; yyout = stdout; #else yyin = (FILE *) 0; yyout = (FILE *) 0; #endif /* For future reference: Set errno on error, since we are called by * yylex_init() */ return 0; } /* yylex_destroy is for both reentrant and non-reentrant scanners. */ int yylex_destroy (void) { /* Pop the buffer stack, destroying each element. */ while(YY_CURRENT_BUFFER){ yy_delete_buffer(YY_CURRENT_BUFFER ); YY_CURRENT_BUFFER_LVALUE = NULL; yypop_buffer_state(); } /* Destroy the stack itself. */ yyfree((yy_buffer_stack) ); (yy_buffer_stack) = NULL; /* Reset the globals. This is important in a non-reentrant scanner so the next time * yylex() is called, initialization will occur. */ yy_init_globals( ); return 0; } /* * Internal utility routines. */ #ifndef yytext_ptr static void yy_flex_strncpy (char* s1, yyconst char * s2, int n ) { register int i; for ( i = 0; i < n; ++i ) s1[i] = s2[i]; } #endif #ifdef YY_NEED_STRLEN static int yy_flex_strlen (yyconst char * s ) { register int n; for ( n = 0; s[n]; ++n ) ; return n; } #endif void *yyalloc (yy_size_t size ) { return (void *) malloc( size ); } void *yyrealloc (void * ptr, yy_size_t size ) { /* The cast to (char *) in the following accommodates both * implementations that use char* generic pointers, and those * that use void* generic pointers. It works with the latter * because both ANSI C and C++ allow castless assignment from * any pointer type to void*, and deal with argument conversions * as though doing an assignment. */ return (void *) realloc( (char *) ptr, size ); } void yyfree (void * ptr ) { free( (char *) ptr ); /* see yyrealloc() for (char *) cast */ } #define YYTABLES_NAME "yytables" #line 279 "zlexer.lex" /* * Analyze "word" to see if it matches an RR type, possibly by using * the "TYPExxx" notation. If it matches, the corresponding token is * returned and the TYPE parameter is set to the RR type value. */ static int rrtype_to_token(const char *word, uint16_t *type) { uint16_t t = rrtype_from_string(word); if (t != 0) { rrtype_descriptor_type *entry = rrtype_descriptor_by_type(t); *type = t; return entry->token; } return 0; } /* * Remove \DDD constructs from the input. See RFC 1035, section 5.1. */ static size_t zoctet(char *text) { /* * s follows the string, p lags behind and rebuilds the new * string */ char *s; char *p; for (s = p = text; *s; ++s, ++p) { assert(p <= s); if (s[0] != '\\') { /* Ordinary character. */ *p = *s; } else if (isdigit((int)s[1]) && isdigit((int)s[2]) && isdigit((int)s[3])) { /* \DDD escape. */ int val = (hexdigit_to_int(s[1]) * 100 + hexdigit_to_int(s[2]) * 10 + hexdigit_to_int(s[3])); if (0 <= val && val <= 255) { s += 3; *p = val; } else { zc_warning("text escape \\DDD overflow"); *p = *++s; } } else if (s[1] != '\0') { /* \X where X is any character, keep X. */ *p = *++s; } else { /* Trailing backslash, ignore it. */ zc_warning("trailing backslash ignored"); --p; } } *p = '\0'; return p - text; } static int parse_token(int token, char *yytext, enum lexer_state *lexer_state) { size_t len; char *str; if (*lexer_state == EXPECT_OWNER) { *lexer_state = PARSING_OWNER; } else if (*lexer_state == PARSING_TTL_CLASS_TYPE) { const char *t; int token; uint16_t rrclass; /* type */ token = rrtype_to_token(yytext, &yylval.type); if (token != 0) { *lexer_state = PARSING_RDATA; LEXOUT(("%d[%s] ", token, yytext)); return token; } /* class */ rrclass = rrclass_from_string(yytext); if (rrclass != 0) { yylval.klass = rrclass; LEXOUT(("CLASS ")); return T_RRCLASS; } /* ttl */ yylval.ttl = strtottl(yytext, &t); if (*t == '\0') { LEXOUT(("TTL ")); return T_TTL; } } str = region_strdup(parser->rr_region, yytext); len = zoctet(str); yylval.data.str = str; yylval.data.len = len; LEXOUT(("%d[%s] ", token, yytext)); return token; } nsd-3.2.16/config.h.in0000664000175000017500000004171512173226546013416 0ustar matjematje/* config.h.in. Generated from configure.ac by autoheader. */ /* Define this to enable BIND8 like NSTATS & XSTATS. */ #undef BIND8_STATS /* NSD default chroot directory */ #undef CHROOTDIR /* Pathname to the NSD configuration file */ #undef CONFIGFILE /* Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work */ #undef DARWIN_BROKEN_SETREUID /* Pathname to the NSD database */ #undef DBFILE /* Pathname to the NSD diff transfer journal file. */ #undef DIFFFILE /* Define this to enable draft RRtypes. */ #undef DRAFT_RRTYPES /* Define to the default maximum message length with EDNS. */ #undef EDNS_MAX_MESSAGE_LEN /* Define to the default facility for syslog. */ #undef FACILITY /* Define this to enable NSEC3 full prehashing. */ #undef FULL_PREHASH /* Define to 1 if you have the `alarm' function. */ #undef HAVE_ALARM /* Define to 1 if you have the `arc4random' function. */ #undef HAVE_ARC4RANDOM /* Define to 1 if you have the `arc4random_uniform' function. */ #undef HAVE_ARC4RANDOM_UNIFORM /* Define to 1 if you have the header file. */ #undef HAVE_ARPA_INET_H /* Whether the C compiler accepts the "format" attribute */ #undef HAVE_ATTR_FORMAT /* Whether the C compiler accepts the "unused" attribute */ #undef HAVE_ATTR_UNUSED /* Define to 1 if you have the `b64_ntop' function. */ #undef HAVE_B64_NTOP /* Define to 1 if you have the `b64_pton' function. */ #undef HAVE_B64_PTON /* Define to 1 if you have the `basename' function. */ #undef HAVE_BASENAME /* Define to 1 if your system has a working `chown' function. */ #undef HAVE_CHOWN /* Define to 1 if you have the `chroot' function. */ #undef HAVE_CHROOT /* if time.h provides ctime_r prototype */ #undef HAVE_CTIME_R_PROTO /* Define to 1 if you have the `dup2' function. */ #undef HAVE_DUP2 /* Define to 1 if you have the `endpwent' function. */ #undef HAVE_ENDPWENT /* Define to 1 if you have the `EVP_sha1' function. */ #undef HAVE_EVP_SHA1 /* Define to 1 if you have the `EVP_sha256' function. */ #undef HAVE_EVP_SHA256 /* Define to 1 if you have the header file. */ #undef HAVE_FCNTL_H /* Define to 1 if you have the `fork' function. */ #undef HAVE_FORK /* Define to 1 if you have the `freeaddrinfo' function. */ #undef HAVE_FREEADDRINFO /* Define to 1 if fseeko (and presumably ftello) exists and is declared. */ #undef HAVE_FSEEKO /* Define to 1 if you have the `gai_strerror' function. */ #undef HAVE_GAI_STRERROR /* Define to 1 if you have the `getaddrinfo' function. */ #undef HAVE_GETADDRINFO /* Define to 1 if you have the `gethostname' function. */ #undef HAVE_GETHOSTNAME /* Define to 1 if you have the `getnameinfo' function. */ #undef HAVE_GETNAMEINFO /* Define to 1 if you have the `getpwnam' function. */ #undef HAVE_GETPWNAM /* Define to 1 if you have the header file. */ #undef HAVE_GRP_H /* Define to 1 if you have the `inet_aton' function. */ #undef HAVE_INET_ATON /* Define to 1 if you have the `inet_ntop' function. */ #undef HAVE_INET_NTOP /* Define to 1 if you have the `inet_pton' function. */ #undef HAVE_INET_PTON /* Define to 1 if you have the `initgroups' function. */ #undef HAVE_INITGROUPS /* Define to 1 if you have the header file. */ #undef HAVE_INTTYPES_H /* Define to 1 if you have the `crypto' library (-lcrypto). */ #undef HAVE_LIBCRYPTO /* Define to 1 if you have the header file. */ #undef HAVE_LIMITS_H /* Define to 1 if your system has a GNU libc compatible `malloc' function, and to 0 otherwise. */ #undef HAVE_MALLOC /* Define to 1 if you have the `memcpy' function. */ #undef HAVE_MEMCPY /* Define to 1 if you have the `memmove' function. */ #undef HAVE_MEMMOVE /* Define to 1 if you have the header file. */ #undef HAVE_MEMORY_H /* Define to 1 if you have the `memset' function. */ #undef HAVE_MEMSET /* Define to 1 if you have the `mmap' function. */ #undef HAVE_MMAP /* Define to 1 if you have the `munmap' function. */ #undef HAVE_MUNMAP /* Define to 1 if you have the header file. */ #undef HAVE_NETDB_H /* Define to 1 if you have the header file. */ #undef HAVE_NETINET_IN_H /* Define to 1 if you have the `pselect' function. */ #undef HAVE_PSELECT /* if sys/select.h provides pselect prototype */ #undef HAVE_PSELECT_PROTO /* Define to 1 if you have the `setregid' function. */ #undef HAVE_SETREGID /* Define to 1 if you have the `setresgid' function. */ #undef HAVE_SETRESGID /* Define to 1 if you have the `setresuid' function. */ #undef HAVE_SETRESUID /* Define to 1 if you have the `setreuid' function. */ #undef HAVE_SETREUID /* Define to 1 if you have the `setusercontext' function. */ #undef HAVE_SETUSERCONTEXT /* Define to 1 if you have the `sigaction' function. */ #undef HAVE_SIGACTION /* Define to 1 if you have the header file. */ #undef HAVE_SIGNAL_H /* Define to 1 if you have the `sigprocmask' function. */ #undef HAVE_SIGPROCMASK /* Define to 1 if you have the `snprintf' function. */ #undef HAVE_SNPRINTF /* Define to 1 if you have the `socket' function. */ #undef HAVE_SOCKET /* Define if you have the SSL libraries installed. */ #undef HAVE_SSL /* Define to 1 if you have the header file. */ #undef HAVE_STDARG_H /* Define to 1 if you have the header file. */ #undef HAVE_STDDEF_H /* Define to 1 if you have the header file. */ #undef HAVE_STDINT_H /* Define to 1 if you have the header file. */ #undef HAVE_STDLIB_H /* Define to 1 if you have the `strcasecmp' function. */ #undef HAVE_STRCASECMP /* Define to 1 if you have the `strchr' function. */ #undef HAVE_STRCHR /* Define to 1 if you have the `strdup' function. */ #undef HAVE_STRDUP /* Define to 1 if you have the `strerror' function. */ #undef HAVE_STRERROR /* Define to 1 if you have the header file. */ #undef HAVE_STRINGS_H /* Define to 1 if you have the header file. */ #undef HAVE_STRING_H /* Define to 1 if you have the `strlcat' function. */ #undef HAVE_STRLCAT /* Define to 1 if you have the `strlcpy' function. */ #undef HAVE_STRLCPY /* Define to 1 if you have the `strncasecmp' function. */ #undef HAVE_STRNCASECMP /* Define to 1 if you have the `strptime' function. */ #undef HAVE_STRPTIME /* Define to 1 if you have the `strtol' function. */ #undef HAVE_STRTOL /* If time.h has a struct timespec (for pselect). */ #undef HAVE_STRUCT_TIMESPEC /* Define to 1 if you have the header file. */ #undef HAVE_SYSLOG_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_BITYPES_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_MMAN_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_PARAM_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_SELECT_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_SOCKET_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_STAT_H /* Define to 1 if you have the header file. */ #undef HAVE_SYS_TYPES_H /* Define to 1 if you have that is POSIX.1 compatible. */ #undef HAVE_SYS_WAIT_H /* Define to 1 if you have the header file. */ #undef HAVE_TCPD_H /* Define to 1 if you have the header file. */ #undef HAVE_TIME_H /* Define to 1 if you have the `tzset' function. */ #undef HAVE_TZSET /* Define to 1 if you have the header file. */ #undef HAVE_UNISTD_H /* Define this if you have double va_list definitions. */ #undef HAVE_VA_LIST_DOUBLE_DEF /* Define to 1 if you have the `vfork' function. */ #undef HAVE_VFORK /* Define to 1 if you have the header file. */ #undef HAVE_VFORK_H /* Define to 1 if `fork' works. */ #undef HAVE_WORKING_FORK /* Define to 1 if `vfork' works. */ #undef HAVE_WORKING_VFORK /* Define to 1 if you have the `writev' function. */ #undef HAVE_WRITEV /* Define to the default nsd identity. */ #undef IDENTITY /* Define this to enable IPv6 support. */ #undef INET6 /* Define to the maximum message length to pass to syslog. */ #undef MAXSYSLOGMSGLEN /* Define to the maximum ip-addresses to serve. */ #undef MAX_INTERFACES /* Define if memcmp() does not compare unsigned bytes */ #undef MEMCMP_IS_BROKEN /* Define this to enable response minimalization to reduce truncation. */ #undef MINIMAL_RESPONSES /* Undefine this to enable internal runtime checks. */ #undef NDEBUG /* Define this to enable NSEC3 support. */ #undef NSEC3 /* Define to the address where bug reports for this package should be sent. */ #undef PACKAGE_BUGREPORT /* Define to the full name of this package. */ #undef PACKAGE_NAME /* Define to the full name and version of this package. */ #undef PACKAGE_STRING /* Define to the one symbol short name of this package. */ #undef PACKAGE_TARNAME /* Define to the home page for this package. */ #undef PACKAGE_URL /* Define to the version of this package. */ #undef PACKAGE_VERSION /* Pathname to the NSD pidfile */ #undef PIDFILE /* Define this to enable rate limiting. */ #undef RATELIMIT /* Define as the return type of signal handlers (`int' or `void'). */ #undef RETSIGTYPE /* Define this to configure as a root server. */ #undef ROOT_SERVER /* Define to 1 if you have the ANSI C header files. */ #undef STDC_HEADERS /* strptime is available from time.h with some defines. */ #undef STRPTIME_NEEDS_DEFINES /* use default strptime. */ #undef STRPTIME_WORKS /* Define to the backlog to be used with listen. */ #undef TCP_BACKLOG /* Define to the default maximum message length. */ #undef TCP_MAX_MESSAGE_LEN /* Define to the default tcp port. */ #undef TCP_PORT /* Define to the default tcp timeout. */ #undef TCP_TIMEOUT /* Define to the default maximum udp message length. */ #undef UDP_MAX_MESSAGE_LEN /* Define to the default udp port. */ #undef UDP_PORT /* the user name to drop privileges to */ #undef USER /* Define this to enable mmap instead of malloc. Experimental. */ #undef USE_MMAP_ALLOC /* Enable extensions on AIX 3, Interix. */ #ifndef _ALL_SOURCE # undef _ALL_SOURCE #endif /* Enable GNU extensions on systems that have them. */ #ifndef _GNU_SOURCE # undef _GNU_SOURCE #endif /* Enable threading extensions on Solaris. */ #ifndef _POSIX_PTHREAD_SEMANTICS # undef _POSIX_PTHREAD_SEMANTICS #endif /* Enable extensions on HP NonStop. */ #ifndef _TANDEM_SOURCE # undef _TANDEM_SOURCE #endif /* Enable general extensions on Solaris. */ #ifndef __EXTENSIONS__ # undef __EXTENSIONS__ #endif /* Define this to enable zone statistics. */ #undef USE_ZONE_STATS /* Define to the NSD version to answer version.server query. */ #undef VERSION /* Pathname to the NSD xfrd zone timer state file. */ #undef XFRDFILE /* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a `char[]'. */ #undef YYTEXT_POINTER /* NSD default location for zone files. Empty string or NULL to disable. */ #undef ZONESDIR /* Pathname to the NSD statistics file */ #undef ZONESTATSFILE /* Number of bits in a file offset, on hosts where this is settable. */ #undef _FILE_OFFSET_BITS /* Define to 1 to make fseeko visible on some hosts (e.g. glibc 2.2). */ #undef _LARGEFILE_SOURCE /* Define for large files, on AIX-style hosts. */ #undef _LARGE_FILES /* Define to 1 if on MINIX. */ #undef _MINIX /* Define to 2 if the system does not provide POSIX.1 features except with this defined. */ #undef _POSIX_1_SOURCE /* Define to 1 if you need to in order for `stat' and other things to work. */ #undef _POSIX_SOURCE /* Define to empty if `const' does not conform to ANSI C. */ #undef const /* Define to `int' if doesn't define. */ #undef gid_t /* in_addr_t */ #undef in_addr_t /* Define to `__inline__' or `__inline' if that's what the C compiler calls it, or to nothing if 'inline' is not supported under any name. */ #ifndef __cplusplus #undef inline #endif /* Define "int16_t" to "short" if "int16_t" is missing */ #undef int16_t /* Define "int32_t" to "int" if "int32_t" is missing */ #undef int32_t /* Define "int64_t" to "long long" if "int64_t" is missing */ #undef int64_t /* Define "int8_t" to "char" if "int8_t" is missing */ #undef int8_t /* Define to rpl_malloc if the replacement function should be used. */ #undef malloc /* Define to `long int' if does not define. */ #undef off_t /* Define to `int' if does not define. */ #undef pid_t /* Define "sig_atomic_t" to "int" if "sig_atomic_t" is missing */ #undef sig_atomic_t /* Define to `unsigned int' if does not define. */ #undef size_t /* Define "socklen_t" to "int" if "socklen_t" is missing */ #undef socklen_t /* Fallback member name for socket family in struct sockaddr_storage */ #undef ss_family /* Define "ssize_t" to "int" if "ssize_t" is missing */ #undef ssize_t /* Define "suseconds_t" to "time_t" if "suseconds_t" is missing */ #undef suseconds_t /* Define to `int' if doesn't define. */ #undef uid_t /* Define "uint16_t" to "unsigned short" if "uint16_t" is missing */ #undef uint16_t /* Define "uint32_t" to "unsigned int" if "uint32_t" is missing */ #undef uint32_t /* Define "uint64_t" to "unsigned long long" if "uint64_t" is missing */ #undef uint64_t /* Define "uint8_t" to "unsigned char" if "uint8_t" is missing */ #undef uint8_t /* Define "uintptr_t" to "void*" if "uintptr_t" is missing */ #undef uintptr_t /* Define as `fork' if `vfork' does not work. */ #undef vfork /* define before includes as it specifies what standard to use. */ #if (defined(HAVE_PSELECT) && !defined (HAVE_PSELECT_PROTO)) \ || !defined (HAVE_CTIME_R_PROTO) \ || defined (STRPTIME_NEEDS_DEFINES) # ifndef _XOPEN_SOURCE # define _XOPEN_SOURCE 600 # endif # ifndef _POSIX_C_SOURCE # define _POSIX_C_SOURCE 200112 # endif # ifndef _BSD_SOURCE # define _BSD_SOURCE 1 # endif # ifndef __EXTENSIONS__ # define __EXTENSIONS__ 1 # endif # ifndef _STDC_C99 # define _STDC_C99 1 # endif # ifndef _ALL_SOURCE # define _ALL_SOURCE 1 # endif #endif #ifdef HAVE_VA_LIST_DOUBLE_DEF /* workaround double va_list definition on some platforms */ # ifndef _VA_LIST_DEFINED # define _VA_LIST_DEFINED # endif #endif #include #if STDC_HEADERS #include #include #endif #ifdef HAVE_TIME_H #include #endif #ifdef HAVE_STDINT_H #include #endif #ifdef HAVE_SYS_SOCKET_H #include #endif #ifdef HAVE_NETINET_IN_H #include #endif #ifdef HAVE_ARPA_INET_H #include #endif /* For Tru64 */ #ifdef HAVE_SYS_BITYPES_H #include #endif #ifdef HAVE_ATTR_FORMAT #define ATTR_FORMAT(archetype, string_index, first_to_check) \ __attribute__ ((format (archetype, string_index, first_to_check))) #else /* !HAVE_ATTR_FORMAT */ #define ATTR_FORMAT(archetype, string_index, first_to_check) /* empty */ #endif /* !HAVE_ATTR_FORMAT */ #if defined(__cplusplus) #define ATTR_UNUSED(x) #elif defined(HAVE_ATTR_UNUSED) #define ATTR_UNUSED(x) x __attribute__((unused)) #else /* !HAVE_ATTR_UNUSED */ #define ATTR_UNUSED(x) x #endif /* !HAVE_ATTR_UNUSED */ #ifndef IPV6_MIN_MTU #define IPV6_MIN_MTU 1280 #endif /* IPV6_MIN_MTU */ #ifndef AF_INET6 #define AF_INET6 28 #endif /* AF_INET6 */ /* maximum nesting of included files */ #define MAXINCLUDES 10 #ifndef HAVE_B64_NTOP int b64_ntop(uint8_t const *src, size_t srclength, char *target, size_t targsize); #endif /* !HAVE_B64_NTOP */ #ifndef HAVE_B64_PTON int b64_pton(char const *src, uint8_t *target, size_t targsize); #endif /* !HAVE_B64_PTON */ #ifndef HAVE_FSEEKO #define fseeko fseek #define ftello ftell #endif /* HAVE_FSEEKO */ #ifndef HAVE_SNPRINTF #include int snprintf (char *str, size_t count, const char *fmt, ...); int vsnprintf (char *str, size_t count, const char *fmt, va_list arg); #endif /* HAVE_SNPRINTF */ #ifndef HAVE_INET_PTON int inet_pton(int af, const char* src, void* dst); #endif /* HAVE_INET_PTON */ #ifndef HAVE_INET_NTOP const char *inet_ntop(int af, const void *src, char *dst, size_t size); #endif #ifndef HAVE_INET_ATON int inet_aton(const char *cp, struct in_addr *addr); #endif #ifndef HAVE_MEMMOVE void *memmove(void *dest, const void *src, size_t n); #endif #ifndef HAVE_STRLCAT size_t strlcat(char *dst, const char *src, size_t siz); #endif #ifndef HAVE_STRLCPY size_t strlcpy(char *dst, const char *src, size_t siz); #endif #ifndef HAVE_GETADDRINFO #include "compat/fake-rfc2553.h" #endif #ifndef HAVE_STRPTIME #define HAVE_STRPTIME 1 char *strptime(const char *s, const char *format, struct tm *tm); #endif #ifndef STRPTIME_WORKS #define STRPTIME_WORKS 1 #define strptime(a,b,c) nsd_strptime((a),(b),(c)) #endif #ifdef MEMCMP_IS_BROKEN #include "compat/memcmp.h" #define memcmp memcmp_nsd int memcmp(const void *x, const void *y, size_t n); #endif #ifndef MAXHOSTNAMELEN #define MAXHOSTNAMELEN 256 #endif /* provide timespec def if not available */ #ifndef CONFIG_DEFINES #define CONFIG_DEFINES #ifndef HAVE_STRUCT_TIMESPEC #ifndef __timespec_defined #define __timespec_defined 1 struct timespec { long tv_sec; /* seconds */ long tv_nsec; /* nanoseconds */ }; #endif /* !__timespec_defined */ #endif /* !HAVE_STRUCT_TIMESPEC */ #endif /* !CONFIG_DEFINES */ nsd-3.2.16/ipc.c0000664000175000017500000006075312163044664012313 0ustar matjematje/* * ipc.c - Interprocess communication routines. Handlers read and write. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include "ipc.h" #include "buffer.h" #include "xfrd-tcp.h" #include "nsd.h" #include "namedb.h" #include "xfrd.h" #include "xfrd-notify.h" /* set is_ok for the zone according to the zone message */ static zone_type* handle_xfrd_zone_state(struct nsd* nsd, buffer_type* packet); /* write ipc ZONE_STATE message into the buffer */ static void write_zone_state_packet(buffer_type* packet, zone_type* zone); /* attempt to send NSD_STATS command to child fd */ static void send_stat_to_child(struct main_ipc_handler_data* data, int fd); /* write IPC expire notification msg to a buffer */ static void xfrd_write_expire_notification(buffer_type* buffer, xfrd_zone_t* zone); /* send reload request over the IPC channel */ static void xfrd_send_reload_req(xfrd_state_t* xfrd); /* send quit request over the IPC channel */ static void xfrd_send_quit_req(xfrd_state_t* xfrd); /* get SOA INFO out of IPC packet buffer */ static void xfrd_handle_ipc_SOAINFO(xfrd_state_t* xfrd, buffer_type* packet); /* perform read part of handle ipc for xfrd */ static void xfrd_handle_ipc_read(netio_handler_type *handler, xfrd_state_t* xfrd); static zone_type* handle_xfrd_zone_state(struct nsd* nsd, buffer_type* packet) { uint8_t ok; const dname_type *dname; domain_type *domain; zone_type *zone; ok = buffer_read_u8(packet); dname = (dname_type*)buffer_current(packet); DEBUG(DEBUG_IPC,1, (LOG_INFO, "handler zone state %s is %s", dname_to_string(dname, NULL), ok?"ok":"expired")); /* find in zone_types, if does not exist, we cannot serve anyway */ /* find zone in config, since that one always exists */ domain = domain_table_find(nsd->db->domains, dname); if(!domain) { DEBUG(DEBUG_IPC,1, (LOG_INFO, "zone state msg, empty zone (domain %s)", dname_to_string(dname, NULL))); return NULL; } zone = domain_find_zone(domain); if(!zone || dname_compare(domain_dname(zone->apex), dname) != 0) { DEBUG(DEBUG_IPC,1, (LOG_INFO, "zone state msg, empty zone (zone %s)", dname_to_string(dname, NULL))); return NULL; } assert(zone); /* only update zone->is_ok if needed to minimize copy-on-write of memory pages shared after fork() */ if(ok && !zone->is_ok) zone->is_ok = 1; if(!ok && zone->is_ok) zone->is_ok = 0; return zone; } static void ipc_child_quit(struct nsd* nsd) { /* call shutdown and quit routines */ nsd->mode = NSD_QUIT; #ifdef BIND8_STATS bind8_stats(nsd); #endif /* BIND8_STATS */ server_shutdown(nsd); exit(0); } void child_handle_parent_command(netio_type *ATTR_UNUSED(netio), netio_handler_type *handler, netio_event_types_type event_types) { sig_atomic_t mode; int len; struct ipc_handler_conn_data *data = (struct ipc_handler_conn_data *) handler->user_data; if (!(event_types & NETIO_EVENT_READ)) { return; } if(data->conn->is_reading) { int ret = conn_read(data->conn); if(ret == -1) { log_msg(LOG_ERR, "handle_parent_command: error in conn_read: %s", strerror(errno)); data->conn->is_reading = 0; return; } if(ret == 0) { return; /* continue later */ } /* completed */ data->conn->is_reading = 0; buffer_flip(data->conn->packet); (void)handle_xfrd_zone_state(data->nsd, data->conn->packet); return; } if ((len = read(handler->fd, &mode, sizeof(mode))) == -1) { log_msg(LOG_ERR, "handle_parent_command: read: %s", strerror(errno)); return; } if (len == 0) { /* parent closed the connection. Quit */ data->nsd->mode = NSD_QUIT; return; } switch (mode) { case NSD_STATS: data->nsd->mode = mode; break; case NSD_QUIT: ipc_child_quit(data->nsd); break; case NSD_QUIT_CHILD: /* close our listening sockets and ack */ server_close_all_sockets(data->nsd->udp, data->nsd->ifs); server_close_all_sockets(data->nsd->tcp, data->nsd->ifs); /* mode == NSD_QUIT_CHILD */ (void)write(handler->fd, &mode, sizeof(mode)); ipc_child_quit(data->nsd); break; case NSD_ZONE_STATE: data->conn->is_reading = 1; data->conn->total_bytes = 0; data->conn->msglen = 0; data->conn->fd = handler->fd; buffer_clear(data->conn->packet); break; default: log_msg(LOG_ERR, "handle_parent_command: bad mode %d", (int) mode); break; } } void parent_handle_xfrd_command(netio_type *ATTR_UNUSED(netio), netio_handler_type *handler, netio_event_types_type event_types) { sig_atomic_t mode; int len; struct ipc_handler_conn_data *data = (struct ipc_handler_conn_data *) handler->user_data; if (!(event_types & NETIO_EVENT_READ)) { return; } if(data->conn->is_reading) { /* handle ZONE_STATE forward to children */ int ret = conn_read(data->conn); size_t i; zone_type* zone; if(ret == -1) { log_msg(LOG_ERR, "main xfrd listener: error in conn_read: %s", strerror(errno)); data->conn->is_reading = 0; return; } if(ret == 0) { return; /* continue later */ } /* completed */ data->conn->is_reading = 0; buffer_flip(data->conn->packet); zone = handle_xfrd_zone_state(data->nsd, data->conn->packet); if(!zone) return; /* forward to all children */ for (i = 0; i < data->nsd->child_count; ++i) { if(!zone->dirty[i]) { zone->dirty[i] = 1; stack_push(data->nsd->children[i].dirty_zones, zone); data->nsd->children[i].handler->event_types |= NETIO_EVENT_WRITE; } } return; } if ((len = read(handler->fd, &mode, sizeof(mode))) == -1) { log_msg(LOG_ERR, "handle_xfrd_command: read: %s", strerror(errno)); return; } if (len == 0) { /* xfrd closed, we must quit */ DEBUG(DEBUG_IPC,1, (LOG_INFO, "handle_xfrd_command: xfrd closed channel.")); close(handler->fd); handler->fd = -1; return; } switch (mode) { case NSD_RELOAD: DEBUG(DEBUG_IPC,1, (LOG_INFO, "parent handle xfrd command RELOAD")); data->nsd->signal_hint_reload = 1; break; case NSD_QUIT: data->nsd->mode = mode; break; case NSD_REAP_CHILDREN: data->nsd->signal_hint_child = 1; break; case NSD_ZONE_STATE: data->conn->is_reading = 1; data->conn->total_bytes = 0; data->conn->msglen = 0; data->conn->fd = handler->fd; buffer_clear(data->conn->packet); break; default: log_msg(LOG_ERR, "handle_xfrd_command: bad mode %d", (int) mode); break; } } static void write_zone_state_packet(buffer_type* packet, zone_type* zone) { sig_atomic_t cmd = NSD_ZONE_STATE; uint8_t ok = zone->is_ok; uint16_t sz; if(!zone->apex) { return; } sz = dname_total_size(domain_dname(zone->apex)) + 1; sz = htons(sz); buffer_clear(packet); buffer_write(packet, &cmd, sizeof(cmd)); buffer_write(packet, &sz, sizeof(sz)); buffer_write(packet, &ok, sizeof(ok)); buffer_write(packet, domain_dname(zone->apex), dname_total_size(domain_dname(zone->apex))); buffer_flip(packet); } static void send_stat_to_child(struct main_ipc_handler_data* data, int fd) { sig_atomic_t cmd = NSD_STATS; if(write(fd, &cmd, sizeof(cmd)) == -1) { if(errno == EAGAIN || errno == EINTR) return; /* try again later */ log_msg(LOG_ERR, "svrmain: problems sending stats to child %d command: %s", (int)data->child->pid, strerror(errno)); return; } data->child->need_to_send_STATS = 0; } int packet_read_query_section(buffer_type *packet, uint8_t* dest, uint16_t* qtype, uint16_t* qclass); static void debug_print_fwd_name(int ATTR_UNUSED(len), buffer_type* packet, int acl_num) { uint8_t qnamebuf[MAXDOMAINLEN]; uint16_t qtype, qclass; const dname_type* dname; region_type* tempregion = region_create(xalloc, free); size_t bufpos = buffer_position(packet); buffer_rewind(packet); buffer_skip(packet, 12); if(packet_read_query_section(packet, qnamebuf, &qtype, &qclass)) { dname = dname_make(tempregion, qnamebuf, 1); log_msg(LOG_INFO, "main: fwd packet for %s, acl %d", dname_to_string(dname,0), acl_num); } else { log_msg(LOG_INFO, "main: fwd packet badqname, acl %d", acl_num); } buffer_set_position(packet, bufpos); region_destroy(tempregion); } static void send_quit_to_child(struct main_ipc_handler_data* data, int fd) { sig_atomic_t cmd = NSD_QUIT; if(write(fd, &cmd, sizeof(cmd)) == -1) { if(errno == EAGAIN || errno == EINTR) return; /* try again later */ log_msg(LOG_ERR, "svrmain: problems sending quit to child %d command: %s", (int)data->child->pid, strerror(errno)); return; } data->child->need_to_send_QUIT = 0; DEBUG(DEBUG_IPC,2, (LOG_INFO, "main: sent quit to child %d", (int)data->child->pid)); } void parent_handle_child_command(netio_type *ATTR_UNUSED(netio), netio_handler_type *handler, netio_event_types_type event_types) { sig_atomic_t mode; int len; struct main_ipc_handler_data *data = (struct main_ipc_handler_data*)handler->user_data; /* do a nonblocking write to the child if it is ready. */ if (event_types & NETIO_EVENT_WRITE) { if(!data->busy_writing_zone_state && !data->child->need_to_send_STATS && !data->child->need_to_send_QUIT && !data->child->need_to_exit && data->child->dirty_zones->num > 0) { /* create packet from next dirty zone */ zone_type* zone = (zone_type*)stack_pop(data->child->dirty_zones); assert(zone); zone->dirty[data->child_num] = 0; data->busy_writing_zone_state = 1; write_zone_state_packet(data->write_conn->packet, zone); data->write_conn->msglen = buffer_limit(data->write_conn->packet); data->write_conn->total_bytes = sizeof(uint16_t); /* len bytes already in packet */ data->write_conn->fd = handler->fd; } if(data->busy_writing_zone_state) { /* write more of packet */ int ret = conn_write(data->write_conn); if(ret == -1) { log_msg(LOG_ERR, "handle_child_cmd %d: could not write: %s", (int)data->child->pid, strerror(errno)); data->busy_writing_zone_state = 0; } else if(ret == 1) { data->busy_writing_zone_state = 0; /* completed */ } } else if(data->child->need_to_send_STATS && !data->child->need_to_exit) { send_stat_to_child(data, handler->fd); } else if(data->child->need_to_send_QUIT) { send_quit_to_child(data, handler->fd); if(!data->child->need_to_send_QUIT) handler->event_types = NETIO_EVENT_READ; } if(!data->busy_writing_zone_state && !data->child->need_to_send_STATS && !data->child->need_to_send_QUIT && data->child->dirty_zones->num == 0) { handler->event_types = NETIO_EVENT_READ; } } if (!(event_types & NETIO_EVENT_READ)) { return; } if (data->forward_mode) { int got_acl; /* forward the data to xfrd */ DEBUG(DEBUG_IPC,2, (LOG_INFO, "main passed packet readup %d", (int)data->got_bytes)); if(data->got_bytes < sizeof(data->total_bytes)) { if ((len = read(handler->fd, (char*)&data->total_bytes+data->got_bytes, sizeof(data->total_bytes)-data->got_bytes)) == -1) { log_msg(LOG_ERR, "handle_child_command: read: %s", strerror(errno)); return; } if(len == 0) { /* EOF */ data->forward_mode = 0; return; } data->got_bytes += len; if(data->got_bytes < sizeof(data->total_bytes)) return; data->total_bytes = ntohs(data->total_bytes); buffer_clear(data->packet); if(data->total_bytes > buffer_capacity(data->packet)) { log_msg(LOG_ERR, "internal error: ipc too large"); exit(1); } return; } /* read the packet */ if(data->got_bytes-sizeof(data->total_bytes) < data->total_bytes) { if((len = read(handler->fd, buffer_current(data->packet), data->total_bytes - (data->got_bytes-sizeof(data->total_bytes)) )) == -1 ) { log_msg(LOG_ERR, "handle_child_command: read: %s", strerror(errno)); return; } if(len == 0) { /* EOF */ data->forward_mode = 0; return; } data->got_bytes += len; buffer_skip(data->packet, len); /* read rest later */ return; } /* read the acl numbers */ got_acl = data->got_bytes - sizeof(data->total_bytes) - data->total_bytes; if((len = read(handler->fd, (char*)&data->acl_num+got_acl, sizeof(data->acl_num)+sizeof(data->acl_xfr)-got_acl)) == -1 ) { log_msg(LOG_ERR, "handle_child_command: read: %s", strerror(errno)); return; } if(len == 0) { /* EOF */ data->forward_mode = 0; return; } got_acl += len; data->got_bytes += len; if(got_acl >= (int)(sizeof(data->acl_num)+sizeof(data->acl_xfr))) { uint16_t len = htons(data->total_bytes); DEBUG(DEBUG_IPC,2, (LOG_INFO, "main fwd passed packet write %d", (int)data->got_bytes)); #ifndef NDEBUG if(nsd_debug_level >= 2) debug_print_fwd_name(len, data->packet, data->acl_num); #endif data->forward_mode = 0; mode = NSD_PASS_TO_XFRD; if(!write_socket(*data->xfrd_sock, &mode, sizeof(mode)) || !write_socket(*data->xfrd_sock, &len, sizeof(len)) || !write_socket(*data->xfrd_sock, buffer_begin(data->packet), data->total_bytes) || !write_socket(*data->xfrd_sock, &data->acl_num, sizeof(data->acl_num)) || !write_socket(*data->xfrd_sock, &data->acl_xfr, sizeof(data->acl_xfr))) { log_msg(LOG_ERR, "error in ipc fwd main2xfrd: %s", strerror(errno)); } } return; } /* read command from ipc */ if ((len = read(handler->fd, &mode, sizeof(mode))) == -1) { log_msg(LOG_ERR, "handle_child_command: read: %s", strerror(errno)); return; } if (len == 0) { size_t i; if(handler->fd != -1) close(handler->fd); for(i=0; insd->child_count; ++i) if(data->nsd->children[i].child_fd == handler->fd) { data->nsd->children[i].child_fd = -1; data->nsd->children[i].has_exited = 1; DEBUG(DEBUG_IPC,1, (LOG_INFO, "server %d closed cmd channel", (int) data->nsd->children[i].pid)); } handler->fd = -1; parent_check_all_children_exited(data->nsd); return; } switch (mode) { case NSD_QUIT: data->nsd->mode = mode; break; case NSD_STATS: data->nsd->signal_hint_stats = 1; break; case NSD_REAP_CHILDREN: data->nsd->signal_hint_child = 1; break; case NSD_PASS_TO_XFRD: /* set mode for handle_child_command; echo to xfrd. */ data->forward_mode = 1; data->got_bytes = 0; data->total_bytes = 0; break; default: log_msg(LOG_ERR, "handle_child_command: bad mode %d", (int) mode); break; } } void parent_check_all_children_exited(struct nsd* nsd) { size_t i; for(i=0; i < nsd->child_count; i++) { if(!nsd->children[i].need_to_exit) return; if(!nsd->children[i].has_exited) return; } nsd->mode = NSD_QUIT_SYNC; DEBUG(DEBUG_IPC,2, (LOG_INFO, "main: all children exited. quit sync.")); } void parent_handle_reload_command(netio_type *ATTR_UNUSED(netio), netio_handler_type *handler, netio_event_types_type event_types) { sig_atomic_t mode; int len; size_t i; struct nsd *nsd = (struct nsd*) handler->user_data; if (!(event_types & NETIO_EVENT_READ)) { return; } /* read command from ipc */ if ((len = read(handler->fd, &mode, sizeof(mode))) == -1) { log_msg(LOG_ERR, "handle_reload_command: read: %s", strerror(errno)); return; } if (len == 0) { if(handler->fd != -1) { close(handler->fd); handler->fd = -1; } log_msg(LOG_ERR, "handle_reload_cmd: reload closed cmd channel"); return; } switch (mode) { case NSD_QUIT_SYNC: /* set all children to exit, only then notify xfrd. */ /* so that buffered packets to pass to xfrd can arrive. */ for(i=0; i < nsd->child_count; i++) { nsd->children[i].need_to_exit = 1; if(nsd->children[i].pid > 0 && nsd->children[i].child_fd != -1) { nsd->children[i].need_to_send_QUIT = 1; nsd->children[i].handler->event_types |= NETIO_EVENT_WRITE; } else { if(nsd->children[i].child_fd == -1) nsd->children[i].has_exited = 1; } } parent_check_all_children_exited(nsd); break; default: log_msg(LOG_ERR, "handle_reload_command: bad mode %d", (int) mode); break; } } static void xfrd_write_expire_notification(buffer_type* buffer, xfrd_zone_t* zone) { sig_atomic_t cmd = NSD_ZONE_STATE; uint8_t ok = 1; uint16_t sz = dname_total_size(zone->apex) + 1; sz = htons(sz); if(zone->state == xfrd_zone_expired) ok = 0; DEBUG(DEBUG_IPC,1, (LOG_INFO, "xfrd encoding ipc zone state msg for zone %s state %d.", zone->apex_str, (int)zone->state)); buffer_clear(buffer); buffer_write(buffer, &cmd, sizeof(cmd)); buffer_write(buffer, &sz, sizeof(sz)); buffer_write(buffer, &ok, sizeof(ok)); buffer_write(buffer, zone->apex, dname_total_size(zone->apex)); buffer_flip(buffer); } static void xfrd_send_reload_req(xfrd_state_t* xfrd) { sig_atomic_t req = NSD_RELOAD; /* ask server_main for a reload */ if(write(xfrd->ipc_handler.fd, &req, sizeof(req)) == -1) { if(errno == EAGAIN || errno == EINTR) return; /* try again later */ log_msg(LOG_ERR, "xfrd: problems sending reload command: %s", strerror(errno)); return; } DEBUG(DEBUG_IPC,1, (LOG_INFO, "xfrd: asked nsd to reload new updates")); xfrd_prepare_zones_for_reload(); xfrd->reload_cmd_last_sent = xfrd_time(); xfrd->need_to_send_reload = 0; xfrd->can_send_reload = 0; } static void xfrd_send_quit_req(xfrd_state_t* xfrd) { sig_atomic_t cmd = NSD_QUIT; xfrd->ipc_send_blocked = 1; xfrd->ipc_handler.event_types &= (~NETIO_EVENT_WRITE); xfrd->sending_zone_state = 0; DEBUG(DEBUG_IPC,1, (LOG_INFO, "xfrd: ipc send ackreload(quit)")); if(!write_socket(xfrd->ipc_handler.fd, &cmd, sizeof(cmd))) { log_msg(LOG_ERR, "xfrd: error writing ack to main: %s", strerror(errno)); } xfrd->need_to_send_quit = 0; } static void xfrd_handle_ipc_SOAINFO(xfrd_state_t* xfrd, buffer_type* packet) { xfrd_soa_t soa; xfrd_soa_t* soa_ptr = &soa; xfrd_zone_t* zone; /* dname is sent in memory format */ const dname_type* dname = (const dname_type*)buffer_begin(packet); /* find zone and decode SOA */ zone = (xfrd_zone_t*)rbtree_search(xfrd->zones, dname); buffer_skip(packet, dname_total_size(dname)); if(!buffer_available(packet, sizeof(uint32_t)*6 + sizeof(uint8_t)*2)) { /* NSD has zone without any info */ DEBUG(DEBUG_IPC,1, (LOG_INFO, "SOAINFO for %s lost zone", dname_to_string(dname,0))); soa_ptr = NULL; } else { /* read soa info */ memset(&soa, 0, sizeof(soa)); /* left out type, klass, count for speed */ soa.type = htons(TYPE_SOA); soa.klass = htons(CLASS_IN); soa.ttl = htonl(buffer_read_u32(packet)); soa.rdata_count = htons(7); soa.prim_ns[0] = buffer_read_u8(packet); if(!buffer_available(packet, soa.prim_ns[0])) return; buffer_read(packet, soa.prim_ns+1, soa.prim_ns[0]); soa.email[0] = buffer_read_u8(packet); if(!buffer_available(packet, soa.email[0])) return; buffer_read(packet, soa.email+1, soa.email[0]); soa.serial = htonl(buffer_read_u32(packet)); soa.refresh = htonl(buffer_read_u32(packet)); soa.retry = htonl(buffer_read_u32(packet)); soa.expire = htonl(buffer_read_u32(packet)); soa.minimum = htonl(buffer_read_u32(packet)); DEBUG(DEBUG_IPC,1, (LOG_INFO, "SOAINFO for %s %u", dname_to_string(dname,0), ntohl(soa.serial))); } if(!zone) { DEBUG(DEBUG_IPC,1, (LOG_INFO, "xfrd: zone %s master zone updated", dname_to_string(dname,0))); notify_handle_master_zone_soainfo(xfrd->notify_zones, dname, soa_ptr); return; } xfrd_handle_incoming_soa(zone, soa_ptr, xfrd_time()); } void xfrd_handle_ipc(netio_type* ATTR_UNUSED(netio), netio_handler_type *handler, netio_event_types_type event_types) { xfrd_state_t* xfrd = (xfrd_state_t*)handler->user_data; if ((event_types & NETIO_EVENT_READ)) { /* first attempt to read as a signal from main * could block further send operations */ xfrd_handle_ipc_read(handler, xfrd); } if ((event_types & NETIO_EVENT_WRITE)) { if(xfrd->ipc_send_blocked) { /* wait for SOA_END */ handler->event_types = NETIO_EVENT_READ; return; } /* if necessary prepare a packet */ if(!(xfrd->can_send_reload && xfrd->need_to_send_reload) && !xfrd->need_to_send_quit && !xfrd->sending_zone_state && xfrd->dirty_zones->num > 0) { xfrd_zone_t* zone = (xfrd_zone_t*)stack_pop(xfrd->dirty_zones); assert(zone); zone->dirty = 0; xfrd->sending_zone_state = 1; xfrd_write_expire_notification(xfrd->ipc_conn_write->packet, zone); xfrd->ipc_conn_write->msglen = buffer_limit(xfrd->ipc_conn_write->packet); /* skip length bytes; they are encoded in the packet, after cmd */ xfrd->ipc_conn_write->total_bytes = sizeof(uint16_t); } /* write a bit */ if(xfrd->sending_zone_state) { /* call conn_write */ int ret = conn_write(xfrd->ipc_conn_write); if(ret == -1) { log_msg(LOG_ERR, "xfrd: error in write ipc: %s", strerror(errno)); xfrd->sending_zone_state = 0; } else if(ret == 1) { /* done */ xfrd->sending_zone_state = 0; } } else if(xfrd->need_to_send_quit) { xfrd_send_quit_req(xfrd); } else if(xfrd->can_send_reload && xfrd->need_to_send_reload) { xfrd_send_reload_req(xfrd); } if(!(xfrd->can_send_reload && xfrd->need_to_send_reload) && !xfrd->need_to_send_quit && !xfrd->sending_zone_state && xfrd->dirty_zones->num == 0) { handler->event_types = NETIO_EVENT_READ; /* disable writing for now */ } } } static void xfrd_handle_ipc_read(netio_handler_type *handler, xfrd_state_t* xfrd) { sig_atomic_t cmd; int len; if(xfrd->ipc_conn->is_reading==2) { buffer_type* tmp = xfrd->ipc_pass; uint32_t acl_num; int32_t acl_xfr; /* read acl_num */ int ret = conn_read(xfrd->ipc_conn); if(ret == -1) { log_msg(LOG_ERR, "xfrd: error in read ipc: %s", strerror(errno)); xfrd->ipc_conn->is_reading = 0; return; } if(ret == 0) return; buffer_flip(xfrd->ipc_conn->packet); xfrd->ipc_pass = xfrd->ipc_conn->packet; xfrd->ipc_conn->packet = tmp; xfrd->ipc_conn->is_reading = 0; acl_num = buffer_read_u32(xfrd->ipc_pass); acl_xfr = (int32_t)buffer_read_u32(xfrd->ipc_pass); xfrd_handle_passed_packet(xfrd->ipc_conn->packet, acl_num, acl_xfr); return; } if(xfrd->ipc_conn->is_reading) { /* reading an IPC message */ int ret = conn_read(xfrd->ipc_conn); if(ret == -1) { log_msg(LOG_ERR, "xfrd: error in read ipc: %s", strerror(errno)); xfrd->ipc_conn->is_reading = 0; return; } if(ret == 0) return; buffer_flip(xfrd->ipc_conn->packet); if(xfrd->ipc_is_soa) { xfrd->ipc_conn->is_reading = 0; xfrd_handle_ipc_SOAINFO(xfrd, xfrd->ipc_conn->packet); } else { /* use ipc_conn to read remaining data as well */ buffer_type* tmp = xfrd->ipc_pass; xfrd->ipc_conn->is_reading=2; xfrd->ipc_pass = xfrd->ipc_conn->packet; xfrd->ipc_conn->packet = tmp; xfrd->ipc_conn->total_bytes = sizeof(xfrd->ipc_conn->msglen); xfrd->ipc_conn->msglen = 2*sizeof(uint32_t); buffer_clear(xfrd->ipc_conn->packet); buffer_set_limit(xfrd->ipc_conn->packet, xfrd->ipc_conn->msglen); } return; } if((len = read(handler->fd, &cmd, sizeof(cmd))) == -1) { log_msg(LOG_ERR, "xfrd_handle_ipc: read: %s", strerror(errno)); return; } if(len == 0) { /* parent closed the connection. Quit */ DEBUG(DEBUG_IPC,1, (LOG_INFO, "xfrd: main closed connection.")); xfrd->shutdown = 1; return; } switch(cmd) { case NSD_QUIT: case NSD_SHUTDOWN: DEBUG(DEBUG_IPC,1, (LOG_INFO, "xfrd: main send shutdown cmd.")); xfrd->shutdown = 1; break; case NSD_SOA_BEGIN: DEBUG(DEBUG_IPC,1, (LOG_INFO, "xfrd: ipc recv SOA_BEGIN")); /* reload starts sending SOA INFOs; don't block */ xfrd->parent_soa_info_pass = 1; /* reset the nonblocking ipc write; the new parent does not want half a packet */ xfrd->sending_zone_state = 0; break; case NSD_SOA_INFO: DEBUG(DEBUG_IPC,1, (LOG_INFO, "xfrd: ipc recv SOA_INFO")); assert(xfrd->parent_soa_info_pass); xfrd->ipc_is_soa = 1; xfrd->ipc_conn->is_reading = 1; break; case NSD_SOA_END: /* reload has finished */ DEBUG(DEBUG_IPC,1, (LOG_INFO, "xfrd: ipc recv SOA_END")); xfrd->can_send_reload = 1; xfrd->parent_soa_info_pass = 0; xfrd->ipc_send_blocked = 0; handler->event_types |= NETIO_EVENT_WRITE; xfrd_reopen_logfile(); xfrd_check_failed_updates(); xfrd_send_expy_all_zones(); break; case NSD_PASS_TO_XFRD: DEBUG(DEBUG_IPC,1, (LOG_INFO, "xfrd: ipc recv PASS_TO_XFRD")); xfrd->ipc_is_soa = 0; xfrd->ipc_conn->is_reading = 1; break; case NSD_RELOAD: /* main tells us that reload is done, stop ipc send to main */ DEBUG(DEBUG_IPC,1, (LOG_INFO, "xfrd: ipc recv RELOAD")); handler->event_types |= NETIO_EVENT_WRITE; xfrd->need_to_send_quit = 1; break; default: log_msg(LOG_ERR, "xfrd_handle_ipc: bad mode %d (%d)", (int)cmd, ntohl(cmd)); break; } if(xfrd->ipc_conn->is_reading) { /* setup read of info */ xfrd->ipc_conn->total_bytes = 0; xfrd->ipc_conn->msglen = 0; buffer_clear(xfrd->ipc_conn->packet); } } nsd-3.2.16/xfrd-disk.h0000664000175000017500000000112211761673243013425 0ustar matjematje/* * xfrd-disk.h - XFR (transfer) Daemon TCP system header file. Save/Load state to disk. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef XFRD_DISK_H #define XFRD_DISK_H #include "config.h" struct xfrd_state; /* magic string to identify xfrd state file */ #define XFRD_FILE_MAGIC "NSDXFRD1" /* read from state file as many zones as possible (until error/eof).*/ void xfrd_read_state(struct xfrd_state* xfrd); /* write xfrd zone state if possible */ void xfrd_write_state(struct xfrd_state* xfrd); #endif /* XFRD_DISK_H */ nsd-3.2.16/nsd.conf.5.in0000664000175000017500000004145212173226547013575 0ustar matjematje.TH "nsd.conf" "5" "Jul 22, 2013" "NLnet Labs" "nsd 3.2.16" .\" Copyright (c) 2001\-2011, NLnet Labs. All rights reserved. .\" See LICENSE for the license. .SH "NAME" .LP .B nsd.conf \- NSD configuration file .SH "SYNOPSIS" .LP .B nsd.conf .SH "DESCRIPTION" .B Nsd.conf is used to configure nsd(8). The file format has attributes and values. Some attributes have attributes inside them. The notation is: attribute: value. .PP Comments start with # and last to the end of line. Empty lines are ignored as is whitespace at the beginning of a line. .PP .B Nsd.conf specifies options for the nsd server, zone files, primaries and secondaries. .SH "EXAMPLE" .LP An example of a short nsd.conf file is below. .LP # Example.com nsd.conf file .RS 0 # This is a comment. .RE .TP server: .RS 5 database: "@dbfile@" .RE .RS 5 username: @user@ .RE .RS 5 logfile: "@logfile@" .RE .RS 5 pidfile: "@pidfile@" .RE .RS 5 difffile: "@difffile@" .RE .RS 5 xfrdfile: "@xfrdfile@" .RE .TP zone: .RS 5 name: example.com .RE .RS 5 # note that quotes are optional on the value .RE .RS 5 zonefile: @configdir@/example.com.zone .RE .SH "FILE FORMAT" There must be whitespace between keywords. Attribute keywords end with a colon ':'. An attribute is followed by its containing attributes, or a value. .P At the top level only .B server: or .B zone: or .B key: are allowed. These are followed by their attributes or the start of a new .B server: or .B zone: or .B key: clause. The .B zone: attribute is followed by zone options. The .B server: attribute is followed by global options for the .B NSD server. A .B key: attribute is used to define keys for authentication. .P Files can be included using the .B include: directive. It can appear anywhere, and takes a single filename as an argument. Processing continues as if the text from the included file was copied into the config file at that point. .SS "Server Options" .LP The global options (if not overridden from the NSD commandline) are taken from the .B server: clause. There may only be one .B server: clause. .TP .B ip\-address:\fR [@port] NSD will bind to the listed ip\-address. Can be give multiple times to bind multiple ip\-addresses. Optionally, a port number can be given. If none are given NSD listens to the wildcard interface. Same as commandline option .BR \-a. .TP .B ip\-transparent:\fR Allows NSD to bind to non local addresses. Default is no. .TP .B debug\-mode:\fR Turns on debugging mode for nsd, does not fork a daemon process. Default is no. Same as commandline option .BR \-d. .TP .B ip4\-only:\fR If yes, NSD only listens to IPv4 connections. Same as commandline option .BR \-4. .TP .B ip6\-only:\fR If yes, NSD only listens to IPv6 connections. Same as commandline option .BR \-6. .TP .B database:\fR By default .I @dbfile@ is used. The specified file is used to store the compiled zone information. Same as commandline option .BR \-f. .TP .B identity:\fR Returns the specified identity when asked for CH TXT ID.SERVER. Default is the name as returned by gethostname(3). Same as commandline option .BR \-i . .TP .B nsid:\fR Add the specified nsid to the EDNS section of the answer when queried with an NSID EDNS enabled packet. Same as commandline option .BR \-I . .TP .B logfile:\fR Log messages to the logfile. The default is to log to stderr and syslog (with facility LOG_DAEMON). Same as commandline option .BR \-l . .TP .B server\-count:\fR Start this many NSD servers. Default is 1. Same as commandline option .BR \-N . .TP .B tcp\-count:\fR The maximum number of concurrent, active TCP connections by each server. Default is 10. This option should have a value below 1000. Same as commandline option .BR \-n . .TP .B tcp\-query\-count:\fR The maximum number of queries served on a single TCP connection. Default is 0, meaning there is no maximum. .TP .B tcp\-timeout:\fR Overrides the default TCP timeout. This also affects zone transfers over TCP. .TP .B ipv4\-edns\-size:\fR Preferred EDNS buffer size for IPv4. .TP .B ipv6\-edns\-size:\fR Preferred EDNS buffer size for IPv6. .TP .B pidfile:\fR Use the pid file instead of the platform specific default, usually .IR @pidfile@. Same as commandline option .BR \-P . .TP .B port:\fR Answer queries on the specified port. Default is 53. Same as commandline option .BR \-p . .TP .B statistics:\fR If not present no statistics are dumped. Statistics are produced every number seconds. Same as commandline option .BR \-s . .TP .B zone\-stats\-file:\fR If per zone statistics is enabled, file to dump the statistics. .TP .B chroot:\fR NSD will chroot on startup to the specified directory. Same as commandline option .BR \-t . .TP .B username:\fR After binding the socket, drop user privileges and assume the username. Can be username, id or id.gid. Same as commandline option .BR \-u . .TP .B zonesdir:\fR Change the working directory to the specified directory before accessing zone files. Same as commandline option .B \-d for zonec(8). Also nsd(8) will access files (pid file, database file, log file) relative to this directory. Set the value to "" (the empty string) to disable the change of working directory. .TP .B difffile:\fR When NSD receives IXFR updates it will store them in this file. This file contains the differences between the database file and the latest zone version. Default is .IR @difffile@ . .TP .B xfrdfile:\fR The soa timeout and zone transfer daemon in NSD will save its state to this file. State is read back after a restart. The state file can be deleted without too much harm, but timestamps of zones will be gone. For more details see the section on zone expiry behavior of NSD. Default is .IR @xfrdfile@ . .TP .B xfrd\-reload\-timeout:\fR If this value is \-1, xfrd will not trigger a reload after a zone transfer. If positive xfrd will trigger a reload after a zone transfer, then it will wait for the number of seconds before it will trigger a new reload. Setting this value throttles the reloads to once per the number of seconds. The default is 10 seconds. .TP .B verbosity:\fR This value specifies the verbosity level for (non\-debug) logging. Default is 0. 1 gives more information about incoming notifies and zone transfers. 2 lists soft warnings that are encountered. .TP .B hide\-version:\fR Prevent NSD from replying with the version string on CHAOS class queries. .\" rrlstart .TP .B rrl\-size:\fR This option gives the size of the hashtable. Default 1000000. More buckets use more memory, and reduce the chance of hash collisions. .TP .B rrl\-ratelimit:\fR The max qps allowed (from one query source). Default 200 qps. If set to 0 then it is disabled (unlimited rate), also set the whilelist\-ratelimit to 0 to disable ratelimit processing. If you set verbosity to 2 the blocked and unblocked subnets are logged. Blocked queries are blocked and some receive TCP fallback replies. .TP .B rrl\-slip:\fR This option controls the number of packets discarded before we send back a SLIP response (a response with "truncated" bit set to one). 0 disables the sending of SLIP packets, 1 means every query will get a SLIP response. .TP .B rrl\-ipv4\-prefix:\fR IPv4 prefix length. Addresses are grouped by netblock. .TP .B rrl\-ipv6\-prefix:\fR IPv6 prefix length. Addresses are grouped by netblock. .TP .B rrl\-whitelist\-ratelimit:\fR The max qps for query sorts for a source, which have been whitelisted. Default 2000 qps. With the rrl\-whitelist option you can set specific queries to receive this qps limit instead of the normal limit. With the value 0 the rate is unlimited. .\" rrlend .SS "Zone Options" .LP For every zone the options need to be specified in one .B zone: clause. The access control list elements can be given multiple times to add multiple servers. These elements need to be added explicitly. .TP .B name:\fR The name of the zone. This is the domain name of the apex of the zone. May end with a '.' (in FQDN notation). For example "example.com", "sub.example.net.". This attribute must be present in each zone. .TP .B zonefile:\fR The file containing the zone information. This file is used by zonec(8). This attribute must be present in each zone. .TP .B allow\-notify:\fR Access control list. The listed (primary) address is allowed to send notifies to this (secondary) server. Notifies from unlisted or specifically BLOCKED addresses are discarded. If NOKEY is given no TSIG signature is required. .P .RS The ip\-spec is either a plain IP address (IPv4 or IPv6), or can be a subnet of the form 1.2.3.4/24, or masked like 1.2.3.4&255.255.255.0 or a range of the form 1.2.3.4\-1.2.3.25. A port number can be added using a suffix of @number, for example 1.2.3.4@5300 or 1.2.3.4/24@5300 for port 5300. Note the ip\-spec ranges do not use spaces around the /, &, @ and \- symbols. .RE .TP .B request\-xfr:\fR [AXFR|UDP] Access control list. The listed address (the master) is queried for AXFR/IXFR on update. A port number can be added using a suffix of @number, for example 1.2.3.4@5300. The specified key is used during AXFR/IXFR. .P .RS If the AXFR option is given, the server will not be contacted with IXFR queries but only AXFR requests will be made to the server. This allows an NSD secondary to have a master server that runs NSD. If the AXFR option is left out then both IXFR and AXFR requests are made to the master server. .P If the UDP option is given, the secondary will use UDP to transmit the IXFR requests. You should deploy TSIG when allowing UDP transport, to authenticate notifies and zone transfers. Otherwise, NSD is more vulnerable for Kaminsky\-style attacks. If the UDP option is left out then IXFR will be transmitted using TCP. .RE .TP .B allow\-axfr\-fallback:\fR This option should be accompanied by request\-xfr. It (dis)allows NSD (as secondary) to fallback to AXFR if the primary name server does not support IXFR. Default is yes. .TP .B notify:\fR Access control list. The listed address (a secondary) is notified of updates to this zone. A port number can be added using a suffix of @number, for example 1.2.3.4@5300. The specified key is used to sign the notify. Only on secondary configurations will NSD be able to detect zone updates (as it gets notified itself, or refreshes after a time). .TP .B notify\-retry:\fR This option should be accompanied by notify. It sets the number of retries when sending notifies. .TP .B provide\-xfr:\fR Access control list. The listed address (a secondary) is allowed to request AXFR from this server. Zone data will be provided to the address. The specified key is used during AXFR. For unlisted or BLOCKED addresses no data is provided, requests are discarded. .P .RS The ip\-spec is either a plain IP address (IPv4 or IPv6), or can be a subnet of the form 1.2.3.4/24, or masked like 1.2.3.4&255.255.255.0 or a range of the form 1.2.3.4\-1.2.3.25. A port number can be added using a suffix of @number, for example 1.2.3.4@5300 or 1.2.3.4/24@5300 for port 5300. Note the ip\-spec ranges do not use spaces around the /, &, @ and \- symbols. .RE .TP .B outgoing\-interface:\fR Access control list. The listed address is used to request AXFR|IXFR (in case of a secondary) or used to send notifies (in case of a primary). .P .RS The ip\-address is a plain IP address (IPv4 or IPv6). A port number can be added using a suffix of @number, for example 1.2.3.4@5300. .RE \" rrlstart .TP .B rrl\-whitelist:\fR This option causes queries of this rrltype to be whitelisted, for this zone. They receive the whitelist\-ratelimit. You can give multiple lines, each enables a new rrltype to be whitelisted for the zone. Default has none whitelisted. The rrltype is the query classification that the NSD RRL employs to make different types not interfere with one another. The types are logged in the loglines when a subnet is blocked (in verbosity 2). The RRL classification types are: nxdomain, error, referral, any, rrsig, wildcard, nodata, dnskey, positive, all. .\" rrlend .SS "Key Declarations" The .B key: clause establishes a key for use in access control lists. It has the following attributes. .TP .B name:\fR The key name. Used to refer to this key in the access control list. .TP .B algorithm:\fR Authentication algorithm for this key. .TP .B secret:\fR The base64 encoded shared secret. It is possible to put the .B secret: declaration (and base64 blob) into a different file, and then to .B include: that file. In this way the key secret and the rest of the configuration file, which may have different security policies, can be split apart. .SH "NSD CONFIGURATION FOR BIND9 HACKERS" BIND9 is a name server implementation with its own configuration file format, named.conf(5). BIND9 types zones as 'Master' or 'Slave'. .SS "Slave zones" For a slave zone, the master servers are listed. The master servers are queried for zone data, and are listened to for update notifications. In NSD these two properties need to be configured separately, by listing the master address in allow\-notify and request\-xfr statements. .P In BIND9 you only need to provide allow\-notify elements for any extra sources of notifications (i.e. the operators), NSD needs to have allow\-notify for both masters and operators. BIND9 allows additional transfer sources, in NSD you list those as request\-xfr. .P Here is an example of a slave zone in BIND9 syntax. .P # Config file for example.org options { .RS 5 dnssec\-enable yes; .RE .RS 0 }; .RE .LP key tsig.example.org. { .RS 5 algorithm hmac\-md5; .RE .RS 5 secret "aaaaaabbbbbbccccccdddddd"; .RE }; .LP server 162.0.4.49 { .RS 5 keys { tsig.example.org. ; }; .RE }; .LP zone "example.org" { .RS 5 type slave; .RE .RS 5 file "secondary/example.org.signed"; .RE .RS 5 masters { 162.0.4.49; }; .RE }; .P For NSD, DNSSEC is enabled automatically for zones that are signed. The dnssec\-enable statement in the options clause is not needed. In NSD keys are associated with an IP address in the access control list statement, therefore the server{} statement is not needed. Below is the same example in an NSD config file. .LP # Config file for example.org .RS 0 key: .RE .RS 5 name: tsig.example.org. .RE .RS 5 algorithm: hmac\-md5 .RE .RS 5 secret: "aaaaaabbbbbbccccccdddddd" .RE .LP zone: .RS 5 name: "example.org" .RE .RS 5 zonefile: "secondary/example.org.signed" .RE .RS 5 # the master is allowed to notify and will provide zone data. .RE .RS 5 allow\-notify: 162.0.4.49 NOKEY .RE .RS 5 request\-xfr: 162.0.4.49 tsig.example.org. .RE .P Notice that the master is listed twice, once to allow it to send notifies to this slave server and once to tell the slave server where to look for updates zone data. More allow\-notify and request\-xfr lines can be added to specify more masters. .P It is possible to specify extra allow\-notify lines for addresses that are also allowed to send notifications to this slave server. .SS "Master zones" For a master zone in BIND9, the slave servers are listed. These slave servers are sent notifications of updated and are allowed to request transfer of the zone data. In NSD these two properties need to be configured separately. .P Here is an example of a master zone in BIND9 syntax. .LP zone "example.nl" { .RS 5 type master; .RE .RS 5 file "example.nl"; .RE }; .LP In NSD syntax this becomes: .LP zone: .RS 5 name: "example.nl" .RE .RS 5 zonefile: "example.nl" .RE .RS 5 # allow anybody to request xfr. .RE .RS 5 provide\-xfr: 0.0.0.0/0 NOKEY .RE .RS 5 provide\-xfr: ::0/0 NOKEY .RE .P .RS 5 # to list a slave server you would in general give .RE .RS 5 # provide\-xfr: 1.2.3.4 tsig\-key.name. .RE .RS 5 # notify: 1.2.3.4 NOKEY .RE .SS "Other" NSD is an authoritative only DNS server. This means that it is meant as a primary or secondary server for zones, providing DNS data to DNS resolvers and caches. BIND9 can function as an authoritative DNS server, the configuration options for that are compared with those for NSD in this section. However, BIND9 can also function as a resolver or cache. The configuration options that BIND9 has for the resolver or caching thus have no equivalents for NSD. .SH "FILES" .TP @dbfile@ default .B NSD database .TP @nsdconfigfile@ default .B NSD configuration file .SH "SEE ALSO" .LP nsd(8), nsdc(8), nsd\-checkconf(8), nsd\-notify(8), nsd\-patch(8), nsd\-xfer(8), zonec(8) .SH "AUTHORS" .LP .B NSD was written by NLnet Labs and RIPE NCC joint team. Please see CREDITS file in the distribution for further details. .SH "BUGS" .LP .B nsd.conf is parsed by a primitive parser, error messages may not be to the point. nsd-3.2.16/packet.c0000664000175000017500000001720312073243522012771 0ustar matjematje/* * packet.c -- low-level DNS packet encoding and decoding functions. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include "packet.h" #include "query.h" #include "rdata.h" static void encode_dname(query_type *q, domain_type *domain) { while (domain->parent && query_get_dname_offset(q, domain) == 0) { query_put_dname_offset(q, domain, buffer_position(q->packet)); DEBUG(DEBUG_NAME_COMPRESSION, 2, (LOG_INFO, "dname: %s, number: %lu, offset: %u\n", dname_to_string(domain_dname(domain), NULL), (unsigned long) domain->number, query_get_dname_offset(q, domain))); buffer_write(q->packet, dname_name(domain_dname(domain)), label_length(dname_name(domain_dname(domain))) + 1U); domain = domain->parent; } if (domain->parent) { DEBUG(DEBUG_NAME_COMPRESSION, 2, (LOG_INFO, "dname: %s, number: %lu, pointer: %u\n", dname_to_string(domain_dname(domain), NULL), (unsigned long) domain->number, query_get_dname_offset(q, domain))); assert(query_get_dname_offset(q, domain) <= MAX_COMPRESSION_OFFSET); buffer_write_u16(q->packet, 0xc000 | query_get_dname_offset(q, domain)); } else { buffer_write_u8(q->packet, 0); } } int packet_encode_rr(query_type *q, domain_type *owner, rr_type *rr) { size_t truncation_mark; uint16_t rdlength = 0; size_t rdlength_pos; uint16_t j; assert(q); assert(owner); assert(rr); /* * If the record does not in fit in the packet the packet size * will be restored to the mark. */ truncation_mark = buffer_position(q->packet); encode_dname(q, owner); buffer_write_u16(q->packet, rr->type); buffer_write_u16(q->packet, rr->klass); buffer_write_u32(q->packet, rr->ttl); /* Reserve space for rdlength. */ rdlength_pos = buffer_position(q->packet); buffer_skip(q->packet, sizeof(rdlength)); for (j = 0; j < rr->rdata_count; ++j) { switch (rdata_atom_wireformat_type(rr->type, j)) { case RDATA_WF_COMPRESSED_DNAME: encode_dname(q, rdata_atom_domain(rr->rdatas[j])); break; case RDATA_WF_UNCOMPRESSED_DNAME: { const dname_type *dname = domain_dname( rdata_atom_domain(rr->rdatas[j])); buffer_write(q->packet, dname_name(dname), dname->name_size); break; } default: buffer_write(q->packet, rdata_atom_data(rr->rdatas[j]), rdata_atom_size(rr->rdatas[j])); break; } } if (!query_overflow(q)) { rdlength = (buffer_position(q->packet) - rdlength_pos - sizeof(rdlength)); buffer_write_u16_at(q->packet, rdlength_pos, rdlength); return 1; } else { buffer_set_position(q->packet, truncation_mark); query_clear_dname_offsets(q, truncation_mark); assert(!query_overflow(q)); return 0; } } int packet_encode_rrset(query_type *query, domain_type *owner, rrset_type *rrset, int section, #ifdef MINIMAL_RESPONSES size_t minimal_respsize, int* done) #else size_t ATTR_UNUSED(minimal_respsize), int* ATTR_UNUSED(done)) #endif { uint16_t i; size_t truncation_mark; uint16_t added = 0; int all_added = 1; #ifdef MINIMAL_RESPONSES int minimize_response = (section >= OPTIONAL_AUTHORITY_SECTION); int truncate_rrset = (section == ANSWER_SECTION || section == AUTHORITY_SECTION); #else int truncate_rrset = (section == ANSWER_SECTION || section == AUTHORITY_SECTION || section == OPTIONAL_AUTHORITY_SECTION); #endif rrset_type *rrsig; assert(rrset->rr_count > 0); truncation_mark = buffer_position(query->packet); for (i = 0; i < rrset->rr_count; ++i) { if (packet_encode_rr(query, owner, &rrset->rrs[i])) { ++added; } else { all_added = 0; break; } } if (all_added && query->edns.dnssec_ok && zone_is_secure(rrset->zone) && rrset_rrtype(rrset) != TYPE_RRSIG && (rrsig = domain_find_rrset(owner, rrset->zone, TYPE_RRSIG))) { for (i = 0; i < rrsig->rr_count; ++i) { if (rr_rrsig_type_covered(&rrsig->rrs[i]) == rrset_rrtype(rrset)) { if (packet_encode_rr(query, owner, &rrsig->rrs[i])) { ++added; } else { all_added = 0; break; } } } } #ifdef MINIMAL_RESPONSES if ((!all_added || buffer_position(query->packet) > minimal_respsize) && !query->tcp && minimize_response) { /* Truncate entire RRset. */ buffer_set_position(query->packet, truncation_mark); query_clear_dname_offsets(query, truncation_mark); added = 0; *done = 1; } #endif if (!all_added && truncate_rrset) { /* Truncate entire RRset and set truncate flag. */ buffer_set_position(query->packet, truncation_mark); query_clear_dname_offsets(query, truncation_mark); TC_SET(query->packet); added = 0; } return added; } int packet_skip_dname(buffer_type *packet) { while (1) { uint8_t label_size; if (!buffer_available(packet, 1)) return 0; label_size = buffer_read_u8(packet); if (label_size == 0) { return 1; } else if ((label_size & 0xc0) != 0) { if (!buffer_available(packet, 1)) return 0; buffer_skip(packet, 1); return 1; } else if (!buffer_available(packet, label_size)) { return 0; } else { buffer_skip(packet, label_size); } } } int packet_skip_rr(buffer_type *packet, int question_section) { if (!packet_skip_dname(packet)) return 0; if (question_section) { if (!buffer_available(packet, 4)) return 0; buffer_skip(packet, 4); } else { uint16_t rdata_size; if (!buffer_available(packet, 10)) return 0; buffer_skip(packet, 8); rdata_size = buffer_read_u16(packet); if (!buffer_available(packet, rdata_size)) return 0; buffer_skip(packet, rdata_size); } return 1; } rr_type * packet_read_rr(region_type *region, domain_table_type *owners, buffer_type *packet, int question_section) { const dname_type *owner; uint16_t rdlength; ssize_t rdata_count; rdata_atom_type *rdatas; rr_type *result = (rr_type *) region_alloc(region, sizeof(rr_type)); owner = dname_make_from_packet(region, packet, 1, 1); if (!owner || !buffer_available(packet, 2*sizeof(uint16_t))) { return NULL; } result->owner = domain_table_insert(owners, owner); result->type = buffer_read_u16(packet); result->klass = buffer_read_u16(packet); if (question_section) { result->ttl = 0; result->rdata_count = 0; result->rdatas = NULL; return result; } else if (!buffer_available(packet, sizeof(uint32_t) + sizeof(uint16_t))) { return NULL; } result->ttl = buffer_read_u32(packet); rdlength = buffer_read_u16(packet); if (!buffer_available(packet, rdlength)) { return NULL; } rdata_count = rdata_wireformat_to_rdata_atoms( region, owners, result->type, rdlength, packet, &rdatas); if (rdata_count == -1) { return NULL; } result->rdata_count = rdata_count; result->rdatas = rdatas; return result; } int packet_read_query_section(buffer_type *packet, uint8_t* dst, uint16_t* qtype, uint16_t* qclass) { uint8_t *query_name = buffer_current(packet); uint8_t *src = query_name; size_t len; while (*src) { /* * If we are out of buffer limits or we have a pointer * in question dname or the domain name is longer than * MAXDOMAINLEN ... */ if ((*src & 0xc0) || (src + *src + 2 > buffer_end(packet)) || (src + *src + 2 > query_name + MAXDOMAINLEN)) { return 0; } memcpy(dst, src, *src + 1); dst += *src + 1; src += *src + 1; } *dst++ = *src++; /* Make sure name is not too long or we have stripped packet... */ len = src - query_name; if (len > MAXDOMAINLEN || (src + 2*sizeof(uint16_t) > buffer_end(packet))) { return 0; } buffer_set_position(packet, src - buffer_begin(packet)); *qtype = buffer_read_u16(packet); *qclass = buffer_read_u16(packet); return 1; } nsd-3.2.16/nsd-notify.8.in0000664000175000017500000000271212173226547014156 0ustar matjematje.TH "nsd\-notify" "8" "Jul 22, 2013" "NLnet Labs" "nsd 3.2.16" .\" Copyright (c) 2001\-2011, NLnet Labs. All rights reserved. .\" See LICENSE for the license. .SH "NAME" .LP .B nsd\-notify \- program to send NOTIFY's to remote nameservers. .SH "SYNOPSIS" .LP .B nsd\-notify .RB [ \-4 ] .RB [ \-6 ] .RB [ \-h ] .RB [ \-a .IR address[@port] ] .RB [ \-p .IR port ] .RB [ \-y .IR key:secret[:algorithm] ] .B \-z .I zone servers .SH "DESCRIPTION" .LP .B Nsd\-notify is simple program to send NOTIFY's to remote nameservers. .B NSD is a complete implementation of an authoritative DNS nameserver. .SH "OPTIONS" .TP .B \-4 Only send to IPv4 addresses. .TP .B \-6 Only send to IPv6 addresses. .TP .B \-h Print help information and exit. .TP .B \-a\fI address[@port] Specify the source address (and port) to send from. .TP .B \-p\fI port Specify the port to send to. .TP .B \-y\fI key:secret[:algorithm] Specify a TSIG key and base64 encoded secret to sign the notification with. If the TSIG algorithm is not defined, MD5 is used. .TP .B z\fI zone Specify the zone to notify about. .TP .I servers List of nameservers to send to. .SH "EXAMPLES" .LP To run this program the standard way type: .LP .B # nsd\-notify \-z foobar.cz 1.2.3.4 .SH "SEE ALSO" .LP nsd(8), nsdc(8), nsd.conf(5), nsd\-checkconf(8), nsd\-patch(8), nsd\-xfer(8), zonec(8) .SH "AUTHORS" .B NSD was written by NLnet Labs and RIPE NCC joint team. Please see CREDITS file in the distribution for further details. nsd-3.2.16/nsd-patch.c0000664000175000017500000002406312010733410013374 0ustar matjematje/* * nsd-patch - read database and ixfrs and patch up zone files. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include #include #include #include #include #include #include "options.h" #include "difffile.h" #include "namedb.h" #include "util.h" extern char *optarg; extern int optind; static void usage(void) { fprintf(stderr, "usage: nsd-patch [options]\n"); fprintf(stderr, " Reads database and ixfrs and patches up zone files.\n"); fprintf(stderr, " Version %s. Report bugs to <%s>.\n\n", PACKAGE_VERSION, PACKAGE_BUGREPORT); fprintf(stderr, "-c configfile Specify config file to use, instead of %s\n", CONFIGFILE); fprintf(stderr, "-f Force writing of zone files.\n"); fprintf(stderr, "-h Print this help information.\n"); fprintf(stderr, "-l List contents of transfer journal difffile, %s\n", DIFFFILE); fprintf(stderr, "-o dbfile Specify dbfile to output the result " "directly to dbfile, nsd.db.\n"); fprintf(stderr, "-s Skip writing of zone files.\n"); fprintf(stderr, "-x difffile Specify diff file to use, instead of diff file from config.\n"); exit(1); } static void list_xfr(FILE *in) { uint32_t timestamp[2]; uint32_t skiplen, len, new_serial; char zone_name[3072]; uint16_t id; uint32_t seq_nr, len2; if(!diff_read_32(in, ×tamp[0]) || !diff_read_32(in, ×tamp[1]) || !diff_read_32(in, &len) || !diff_read_str(in, zone_name, sizeof(zone_name)) || !diff_read_32(in, &new_serial) || !diff_read_16(in, &id) || !diff_read_32(in, &seq_nr)) { fprintf(stderr, "incomplete zone transfer content packet\n"); return; } skiplen = len - (sizeof(uint32_t)*3 + sizeof(uint16_t) + strlen(zone_name)); fprintf(stdout, "zone %s transfer id %x serial %u timestamp %u.%u: " "seq_nr %d of %d bytes\n", zone_name, id, new_serial, timestamp[0], timestamp[1], seq_nr, skiplen); if(fseeko(in, skiplen, SEEK_CUR) == -1) fprintf(stderr, "fseek failed: %s\n", strerror(errno)); if(!diff_read_32(in, &len2)) { fprintf(stderr, "incomplete zone transfer content packet\n"); return; } if(len != len2) { fprintf(stderr, "packet seq %d had bad length check bytes!\n", seq_nr); } } static const char* get_date(const char* log) { const char *entry = strstr(log, " time "); time_t t = 0; static char timep[30]; if(!entry) return ""; t = strtol(entry + 6, NULL, 10); if(t == 0) return "0"; timep[0]=0; strlcpy(timep, ctime(&t), sizeof(timep)); /* remove newline at end */ if(strlen(timep) > 0 && timep[strlen(timep)-1]=='\n') timep[strlen(timep)-1] = 0; return timep; } static void list_commit(FILE *in) { uint32_t timestamp[2]; uint32_t len; char zone_name[3072]; uint32_t old_serial, new_serial; uint16_t id; uint32_t num; uint8_t commit; char log_msg[10240]; uint32_t len2; if(!diff_read_32(in, ×tamp[0]) || !diff_read_32(in, ×tamp[1]) || !diff_read_32(in, &len) || !diff_read_str(in, zone_name, sizeof(zone_name)) || !diff_read_32(in, &old_serial) || !diff_read_32(in, &new_serial) || !diff_read_16(in, &id) || !diff_read_32(in, &num) || !diff_read_8(in, &commit) || !diff_read_str(in, log_msg, sizeof(log_msg)) || !diff_read_32(in, &len2)) { fprintf(stderr, "incomplete commit/rollback packet\n"); return; } fprintf(stdout, "zone %s transfer id %x serial %d: %s of %d packets\n", zone_name, id, new_serial, commit?"commit":"rollback", num); fprintf(stdout, " time %s, from serial %d, log message: %s\n", get_date(log_msg), old_serial, log_msg); if(len != len2) { fprintf(stderr, " commit packet with bad length check \ bytes!\n"); } } static void debug_list(struct nsd_options* opt) { const char* file = opt->difffile; FILE *f; uint32_t type; fprintf(stdout, "debug listing of the contents of %s\n", file); f = fopen(file, "r"); if(!f) { fprintf(stderr, "error opening %s: %s\n", file, strerror(errno)); return; } while(diff_read_32(f, &type)) { switch(type) { case DIFF_PART_IXFR: list_xfr(f); break; case DIFF_PART_SURE: list_commit(f); break; default: fprintf(stderr, "bad part of type %x\n", type); break; } } fclose(f); } static int exist_difffile(struct nsd_options* opt) { /* see if diff file exists */ const char* file = opt->difffile; FILE *f; f = fopen(file, "r"); if(!f) { if(errno == ENOENT) return 0; fprintf(stderr, "could not open file %s: %s\n", file, strerror(errno)); return 0; } fclose(f); return 1; } static void print_rrs(FILE* out, struct zone* zone) { rrset_type *rrset; domain_type *domain = zone->apex; region_type* region = region_create(xalloc, free); struct state_pretty_rr* state = create_pretty_rr(region); /* first print the SOA record for the zone */ if(zone->soa_rrset) { size_t i; for(i=0; i < zone->soa_rrset->rr_count; i++) { if(!print_rr(out, state, &zone->soa_rrset->rrs[i])){ fprintf(stderr, "There was an error " "printing SOARR to zone %s\n", zone->opts->name); } } } /* go through entire tree below the zone apex (incl subzones) */ while(domain && dname_is_subdomain( domain_dname(domain), domain_dname(zone->apex))) { for(rrset = domain->rrsets; rrset; rrset=rrset->next) { size_t i; if(rrset->zone != zone || rrset == zone->soa_rrset) continue; for(i=0; i < rrset->rr_count; i++) { if(!print_rr(out, state, &rrset->rrs[i])){ fprintf(stderr, "There was an error " "printing RR to zone %s\n", zone->opts->name); } } } domain = domain_next(domain); } region_destroy(region); } static void print_commit_log(FILE* out, const dname_type* zone, struct diff_log* commit_log) { struct diff_log* p = commit_log; region_type* region = region_create(xalloc, free); while(p) { const dname_type* dname = dname_parse(region, p->zone_name); if(dname_compare(dname, zone) == 0) { fprintf(out, "; commit"); if(p->error) fprintf(out, "(%s)", p->error); fprintf(out, ": %s\n", p->comment); } p = p->next; } region_destroy(region); } static void write_to_zonefile(struct zone* zone, struct diff_log* commit_log) { const char* filename = zone->opts->zonefile; time_t now = time(0); FILE *out; fprintf(stdout, "writing zone %s to file %s\n", zone->opts->name, filename); if(!zone->apex) { fprintf(stderr, "zone %s has no apex, no data.\n", filename); return; } out = fopen(filename, "w"); if(!out) { fprintf(stderr, "cannot open or create file %s for writing: %s\n", filename, strerror(errno)); return; } /* print zone header */ fprintf(out, "; NSD version %s\n", PACKAGE_VERSION); fprintf(out, "; nsd-patch zone %s run at time %s", zone->opts->name, ctime(&now)); print_commit_log(out, domain_dname(zone->apex), commit_log); print_rrs(out, zone); fclose(out); } int main(int argc, char* argv[]) { int c; const char* configfile = CONFIGFILE; const char* difffile = NULL; const char* dbfile = NULL; nsd_options_t *options; struct namedb* db = NULL; struct namedb* dbout = NULL; struct zone* zone; struct diff_log* commit_log = 0; size_t fake_child_count = 1; int debug_list_diff = 0; int force_write = 0; int skip_write = 0; int difffile_exists = 0; /* Parse the command line... */ while ((c = getopt(argc, argv, "c:fhlo:sx:")) != -1) { switch (c) { case 'c': configfile = optarg; break; case 'l': debug_list_diff = 1; break; case 'f': if (skip_write) { fprintf(stderr, "Cannot force and skip writing " "zonefiles at the same time\n"); exit(1); } else force_write = 1; break; case 's': if (force_write) { fprintf(stderr, "Cannot skip and force writing " "zonefiles at the same time\n"); exit(1); } else skip_write = 1; break; case 'o': dbfile = optarg; break; case 'x': difffile = optarg; break; case 'h': default: usage(); }; } argc -= optind; argv += optind; if (argc != 0) usage(); /* read config file */ log_init("nsd-patch"); options = nsd_options_create(region_create(xalloc, free)); if(!parse_options_file(options, configfile)) { fprintf(stderr, "Could not read config: %s\n", configfile); exit(1); } if(options->zonesdir && options->zonesdir[0]) { if (chdir(options->zonesdir)) { fprintf(stderr, "nsd-patch: cannot chdir to %s: %s\n", options->zonesdir, strerror(errno)); exit(1); } } /* override difffile if commandline option given */ if(difffile) options->difffile = difffile; /* see if necessary */ if(!exist_difffile(options)) { fprintf(stderr, "No diff file.\n"); if (!force_write) exit(0); } else difffile_exists = 1; if(debug_list_diff) { debug_list(options); exit(0); } /* read database and diff file */ fprintf(stdout, "reading database\n"); db = namedb_open(options->database, options, fake_child_count); if(!db) { fprintf(stderr, "could not read database: %s\n", options->database); exit(1); } /* set all updated to 0 so we know what has changed */ for(zone = db->zones; zone; zone = zone->next) { zone->updated = 0; } if (dbfile) dbout = namedb_new(dbfile); if (dbout) { db->fd = dbout->fd; db->filename = (char*) dbfile; } /* read ixfr diff file */ if (difffile_exists) { fprintf(stdout, "reading updates to database\n"); if(!diff_read_file(db, options, &commit_log, fake_child_count)) { fprintf(stderr, "unable to load the diff file: %s\n", options->difffile); exit(1); } } if (skip_write) fprintf(stderr, "skip patching up zonefiles.\n"); else { fprintf(stdout, "writing changed zones\n"); for(zone = db->zones; zone; zone = zone->next) { if(!force_write && !zone->updated) { fprintf(stdout, "zone %s had not changed.\n", zone->opts->name); continue; } /* write zone to its zone file */ write_to_zonefile(zone, commit_log); } } /* output result directly to dbfile */ if (dbout) { fprintf(stdout, "storing database to %s.\n", dbout->filename); if (namedb_save(db) != 0) { fprintf(stderr, "error writing the database (%s): %s\n", dbfile, strerror(errno)); exit(1); } } fprintf(stdout, "done\n"); return 0; } nsd-3.2.16/lookup3.h0000664000175000017500000000516612043766134013136 0ustar matjematje/* * util/storage/lookup3.h - header file for hashing functions. * * Copyright (c) 2007, NLnet Labs. All rights reserved. * * This software is open source. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * Neither the name of the NLNET LABS nor the names of its contributors may * be used to endorse or promote products derived from this software without * specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE * POSSIBILITY OF SUCH DAMAGE. */ /** * \file * * This file contains header definitions for the hash functions we use. * The hash functions are public domain (see lookup3.c). */ #ifndef UTIL_STORAGE_LOOKUP3_H #define UTIL_STORAGE_LOOKUP3_H /** * Hash key made of 4byte chunks. * @param k: the key, an array of uint32_t values * @param length: the length of the key, in uint32_ts * @param initval: the previous hash, or an arbitrary value * @return: hash value. */ uint32_t hashword(const uint32_t *k, size_t length, uint32_t initval); /** * Hash key data. * @param k: the key, array of uint8_t * @param length: the length of the key, in uint8_ts * @param initval: the previous hash, or an arbitrary value * @return: hash value. */ uint32_t hashlittle(const void *k, size_t length, uint32_t initval); /** * Set the randomisation initial value, set this before threads start, * and before hashing stuff (because it changes subsequent results). * @param v: value */ void hash_set_raninit(uint32_t v); #endif /* UTIL_STORAGE_LOOKUP3_H */ nsd-3.2.16/zparser.y0000664000175000017500000010203512163246066013242 0ustar matjematje%{ /* * zyparser.y -- yacc grammar for (DNS) zone files * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include "dname.h" #include "namedb.h" #include "zonec.h" /* these need to be global, otherwise they cannot be used inside yacc */ zparser_type *parser; #ifdef __cplusplus extern "C" #endif /* __cplusplus */ int yywrap(void); /* this hold the nxt bits */ static uint8_t nxtbits[16]; static int dlv_warn = 1; /* 256 windows of 256 bits (32 bytes) */ /* still need to reset the bastard somewhere */ static uint8_t nsecbits[NSEC_WINDOW_COUNT][NSEC_WINDOW_BITS_SIZE]; /* hold the highest rcode seen in a NSEC rdata , BUG #106 */ uint16_t nsec_highest_rcode; void yyerror(const char *message); #ifdef NSEC3 /* parse nsec3 parameters and add the (first) rdata elements */ static void nsec3_add_params(const char* hash_algo_str, const char* flag_str, const char* iter_str, const char* salt_str, int salt_len); #endif /* NSEC3 */ %} %union { domain_type *domain; const dname_type *dname; struct lex_data data; uint32_t ttl; uint16_t klass; uint16_t type; uint16_t *unknown; } /* * Tokens to represent the known RR types of DNS. */ %token T_A T_NS T_MX T_TXT T_CNAME T_AAAA T_PTR T_NXT T_KEY T_SOA T_SIG %token T_SRV T_CERT T_LOC T_MD T_MF T_MB T_MG T_MR T_NULL T_WKS T_HINFO %token T_MINFO T_RP T_AFSDB T_X25 T_ISDN T_RT T_NSAP T_NSAP_PTR T_PX %token T_GPOS T_EID T_NIMLOC T_ATMA T_NAPTR T_KX T_A6 T_DNAME T_SINK %token T_OPT T_APL T_UINFO T_UID T_GID T_UNSPEC T_TKEY T_TSIG T_IXFR %token T_AXFR T_MAILB T_MAILA T_DS T_DLV T_SSHFP T_RRSIG T_NSEC T_DNSKEY %token T_SPF T_NSEC3 T_IPSECKEY T_DHCID T_NSEC3PARAM T_TLSA %token T_NID T_L32 T_L64 T_LP T_EUI48 T_EUI64 /* other tokens */ %token DOLLAR_TTL DOLLAR_ORIGIN NL SP %token STR PREV BITLAB %token T_TTL %token T_RRCLASS /* unknown RRs */ %token URR %token T_UTYPE %type type_and_rdata %type owner dname abs_dname %type rel_dname label %type wire_dname wire_abs_dname wire_rel_dname wire_label %type concatenated_str_seq str_sp_seq str_dot_seq dotted_str %type nxt_seq nsec_more %type rdata_unknown %% lines: /* empty file */ | lines line ; line: NL | sp NL | PREV NL {} /* Lines containing only whitespace. */ | ttl_directive { parser->error_occurred = 0; } | origin_directive { parser->error_occurred = 0; } | rr { /* rr should be fully parsed */ if (!parser->error_occurred) { parser->current_rr.rdatas = (rdata_atom_type *) region_alloc_init( parser->region, parser->current_rr.rdatas, (parser->current_rr.rdata_count * sizeof(rdata_atom_type))); process_rr(); } region_free_all(parser->rr_region); parser->current_rr.type = 0; parser->current_rr.rdata_count = 0; parser->current_rr.rdatas = parser->temporary_rdatas; parser->error_occurred = 0; } | error NL ; /* needed to cope with ( and ) in arbitary places */ sp: SP | sp SP ; trail: NL | sp NL ; ttl_directive: DOLLAR_TTL sp STR trail { parser->default_ttl = zparser_ttl2int($3.str, &(parser->error_occurred)); if (parser->error_occurred == 1) { parser->default_ttl = DEFAULT_TTL; parser->error_occurred = 0; } } ; origin_directive: DOLLAR_ORIGIN sp abs_dname trail { parser->origin = $3; } | DOLLAR_ORIGIN sp rel_dname trail { zc_error_prev_line("$ORIGIN directive requires absolute domain name"); } ; rr: owner classttl type_and_rdata { parser->current_rr.owner = $1; parser->current_rr.type = $3; } ; owner: dname sp { parser->prev_dname = $1; $$ = $1; } | PREV { $$ = parser->prev_dname; } ; classttl: /* empty - fill in the default, def. ttl and IN class */ { parser->current_rr.ttl = parser->default_ttl; parser->current_rr.klass = parser->default_class; } | T_RRCLASS sp /* no ttl */ { parser->current_rr.ttl = parser->default_ttl; parser->current_rr.klass = $1; } | T_TTL sp /* no class */ { parser->current_rr.ttl = $1; parser->current_rr.klass = parser->default_class; } | T_TTL sp T_RRCLASS sp /* the lot */ { parser->current_rr.ttl = $1; parser->current_rr.klass = $3; } | T_RRCLASS sp T_TTL sp /* the lot - reversed */ { parser->current_rr.ttl = $3; parser->current_rr.klass = $1; } ; dname: abs_dname | rel_dname { if ($1 == error_dname) { $$ = error_domain; } else if ($1->name_size + domain_dname(parser->origin)->name_size - 1 > MAXDOMAINLEN) { zc_error("domain name exceeds %d character limit", MAXDOMAINLEN); $$ = error_domain; } else { $$ = domain_table_insert( parser->db->domains, dname_concatenate( parser->rr_region, $1, domain_dname(parser->origin))); } } ; abs_dname: '.' { $$ = parser->db->domains->root; } | '@' { $$ = parser->origin; } | rel_dname '.' { if ($1 != error_dname) { $$ = domain_table_insert(parser->db->domains, $1); } else { $$ = error_domain; } } ; label: STR { if ($1.len > MAXLABELLEN) { zc_error("label exceeds %d character limit", MAXLABELLEN); $$ = error_dname; } else if ($1.len <= 0) { zc_error("zero label length"); $$ = error_dname; } else { $$ = dname_make_from_label(parser->rr_region, (uint8_t *) $1.str, $1.len); } } | BITLAB { zc_error("bitlabels are now deprecated. RFC2673 is obsoleted."); $$ = error_dname; } ; rel_dname: label | rel_dname '.' label { if ($1 == error_dname || $3 == error_dname) { $$ = error_dname; } else if ($1->name_size + $3->name_size - 1 > MAXDOMAINLEN) { zc_error("domain name exceeds %d character limit", MAXDOMAINLEN); $$ = error_dname; } else { $$ = dname_concatenate(parser->rr_region, $1, $3); } } ; /* * Some dnames in rdata are handled as opaque blobs */ wire_dname: wire_abs_dname | wire_rel_dname ; wire_abs_dname: '.' { char *result = (char *) region_alloc(parser->rr_region, 2); result[0] = 0; result[1] = '\0'; $$.str = result; $$.len = 1; } | wire_rel_dname '.' { char *result = (char *) region_alloc(parser->rr_region, $1.len + 2); memcpy(result, $1.str, $1.len); result[$1.len] = 0; result[$1.len+1] = '\0'; $$.str = result; $$.len = $1.len + 1; } ; wire_label: STR { char *result = (char *) region_alloc(parser->rr_region, $1.len + 1); if ($1.len > MAXLABELLEN) zc_error("label exceeds %d character limit", MAXLABELLEN); /* make label anyway */ result[0] = $1.len; memcpy(result+1, $1.str, $1.len); $$.str = result; $$.len = $1.len + 1; } ; wire_rel_dname: wire_label | wire_rel_dname '.' wire_label { if ($1.len + $3.len - 3 > MAXDOMAINLEN) zc_error("domain name exceeds %d character limit", MAXDOMAINLEN); /* make dname anyway */ $$.len = $1.len + $3.len; $$.str = (char *) region_alloc(parser->rr_region, $$.len + 1); memcpy($$.str, $1.str, $1.len); memcpy($$.str + $1.len, $3.str, $3.len); $$.str[$$.len] = '\0'; } ; str_seq: STR { zadd_rdata_txt_wireformat(zparser_conv_text(parser->rr_region, $1.str, $1.len), 1); } | str_seq sp STR { zadd_rdata_txt_wireformat(zparser_conv_text(parser->rr_region, $3.str, $3.len), 0); } ; /* * Generate a single string from multiple STR tokens, separated by * spaces or dots. */ concatenated_str_seq: STR | '.' { $$.len = 1; $$.str = region_strdup(parser->rr_region, "."); } | concatenated_str_seq sp STR { $$.len = $1.len + $3.len + 1; $$.str = (char *) region_alloc(parser->rr_region, $$.len + 1); memcpy($$.str, $1.str, $1.len); memcpy($$.str + $1.len, " ", 1); memcpy($$.str + $1.len + 1, $3.str, $3.len); $$.str[$$.len] = '\0'; } | concatenated_str_seq '.' STR { $$.len = $1.len + $3.len + 1; $$.str = (char *) region_alloc(parser->rr_region, $$.len + 1); memcpy($$.str, $1.str, $1.len); memcpy($$.str + $1.len, ".", 1); memcpy($$.str + $1.len + 1, $3.str, $3.len); $$.str[$$.len] = '\0'; } ; /* used to convert a nxt list of types */ nxt_seq: STR { uint16_t type = rrtype_from_string($1.str); if (type != 0 && type < 128) { set_bit(nxtbits, type); } else { zc_error("bad type %d in NXT record", (int) type); } } | nxt_seq sp STR { uint16_t type = rrtype_from_string($3.str); if (type != 0 && type < 128) { set_bit(nxtbits, type); } else { zc_error("bad type %d in NXT record", (int) type); } } ; nsec_more: SP nsec_more { } | NL { } | STR nsec_seq { uint16_t type = rrtype_from_string($1.str); if (type != 0) { if (type > nsec_highest_rcode) { nsec_highest_rcode = type; } set_bitnsec(nsecbits, type); } else { zc_error("bad type %d in NSEC record", (int) type); } } ; nsec_seq: NL | SP nsec_more ; /* * Sequence of STR tokens separated by spaces. The spaces are not * preserved during concatenation. */ str_sp_seq: STR | str_sp_seq sp STR { char *result = (char *) region_alloc(parser->rr_region, $1.len + $3.len + 1); memcpy(result, $1.str, $1.len); memcpy(result + $1.len, $3.str, $3.len); $$.str = result; $$.len = $1.len + $3.len; $$.str[$$.len] = '\0'; } ; /* * Sequence of STR tokens separated by dots. The dots are not * preserved during concatenation. */ str_dot_seq: STR | str_dot_seq '.' STR { char *result = (char *) region_alloc(parser->rr_region, $1.len + $3.len + 1); memcpy(result, $1.str, $1.len); memcpy(result + $1.len, $3.str, $3.len); $$.str = result; $$.len = $1.len + $3.len; $$.str[$$.len] = '\0'; } ; /* * A string that can contain dots. */ dotted_str: STR | '.' { $$.str = "."; $$.len = 1; } | dotted_str '.' { char *result = (char *) region_alloc(parser->rr_region, $1.len + 2); memcpy(result, $1.str, $1.len); result[$1.len] = '.'; $$.str = result; $$.len = $1.len + 1; $$.str[$$.len] = '\0'; } | dotted_str '.' STR { char *result = (char *) region_alloc(parser->rr_region, $1.len + $3.len + 2); memcpy(result, $1.str, $1.len); result[$1.len] = '.'; memcpy(result + $1.len + 1, $3.str, $3.len); $$.str = result; $$.len = $1.len + $3.len + 1; $$.str[$$.len] = '\0'; } ; /* define what we can parse */ type_and_rdata: /* * All supported RR types. We don't support NULL and types marked obsolete. */ T_A sp rdata_a | T_A sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_NS sp rdata_domain_name | T_NS sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_MD sp rdata_domain_name { zc_warning_prev_line("MD is obsolete"); } | T_MD sp rdata_unknown { zc_warning_prev_line("MD is obsolete"); $$ = $1; parse_unknown_rdata($1, $3); } | T_MF sp rdata_domain_name { zc_warning_prev_line("MF is obsolete"); } | T_MF sp rdata_unknown { zc_warning_prev_line("MF is obsolete"); $$ = $1; parse_unknown_rdata($1, $3); } | T_CNAME sp rdata_domain_name | T_CNAME sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_SOA sp rdata_soa | T_SOA sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_MB sp rdata_domain_name { zc_warning_prev_line("MB is obsolete"); } | T_MB sp rdata_unknown { zc_warning_prev_line("MB is obsolete"); $$ = $1; parse_unknown_rdata($1, $3); } | T_MG sp rdata_domain_name | T_MG sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_MR sp rdata_domain_name | T_MR sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } /* NULL */ | T_WKS sp rdata_wks | T_WKS sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_PTR sp rdata_domain_name | T_PTR sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_HINFO sp rdata_hinfo | T_HINFO sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_MINFO sp rdata_minfo /* Experimental */ | T_MINFO sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_MX sp rdata_mx | T_MX sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_TXT sp rdata_txt | T_TXT sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_SPF sp rdata_txt | T_SPF sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_RP sp rdata_rp /* RFC 1183 */ | T_RP sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_AFSDB sp rdata_afsdb /* RFC 1183 */ | T_AFSDB sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_X25 sp rdata_x25 /* RFC 1183 */ | T_X25 sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_ISDN sp rdata_isdn /* RFC 1183 */ | T_ISDN sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_IPSECKEY sp rdata_ipseckey /* RFC 4025 */ | T_IPSECKEY sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_DHCID sp rdata_dhcid | T_DHCID sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_RT sp rdata_rt /* RFC 1183 */ | T_RT sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_NSAP sp rdata_nsap /* RFC 1706 */ | T_NSAP sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_SIG sp rdata_rrsig | T_SIG sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_KEY sp rdata_dnskey | T_KEY sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_PX sp rdata_px /* RFC 2163 */ | T_PX sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_AAAA sp rdata_aaaa | T_AAAA sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_LOC sp rdata_loc | T_LOC sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_NXT sp rdata_nxt | T_NXT sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_SRV sp rdata_srv | T_SRV sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_NAPTR sp rdata_naptr /* RFC 2915 */ | T_NAPTR sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_KX sp rdata_kx /* RFC 2230 */ | T_KX sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_CERT sp rdata_cert /* RFC 2538 */ | T_CERT sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_DNAME sp rdata_domain_name /* RFC 2672 */ | T_DNAME sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_APL trail /* RFC 3123 */ | T_APL sp rdata_apl /* RFC 3123 */ | T_APL sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_DS sp rdata_ds | T_DS sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_DLV sp rdata_dlv { if (dlv_warn) { dlv_warn = 0; zc_warning_prev_line("DLV is experimental"); } } | T_DLV sp rdata_unknown { if (dlv_warn) { dlv_warn = 0; zc_warning_prev_line("DLV is experimental"); } $$ = $1; parse_unknown_rdata($1, $3); } | T_SSHFP sp rdata_sshfp | T_SSHFP sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_RRSIG sp rdata_rrsig | T_RRSIG sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_NSEC sp rdata_nsec | T_NSEC sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_NSEC3 sp rdata_nsec3 | T_NSEC3 sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_NSEC3PARAM sp rdata_nsec3_param | T_NSEC3PARAM sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_DNSKEY sp rdata_dnskey | T_DNSKEY sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_TLSA sp rdata_tlsa | T_TLSA sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_NID sp rdata_nid | T_NID sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_L32 sp rdata_l32 | T_L32 sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_L64 sp rdata_l64 | T_L64 sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_LP sp rdata_lp | T_LP sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_EUI48 sp rdata_eui48 | T_EUI48 sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_EUI64 sp rdata_eui64 | T_EUI64 sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | T_UTYPE sp rdata_unknown { $$ = $1; parse_unknown_rdata($1, $3); } | STR error NL { zc_error_prev_line("unrecognized RR type '%s'", $1.str); } ; /* * * below are all the definition for all the different rdata * */ rdata_a: dotted_str trail { zadd_rdata_wireformat(zparser_conv_a(parser->region, $1.str)); } ; rdata_domain_name: dname trail { /* convert a single dname record */ zadd_rdata_domain($1); } ; rdata_soa: dname sp dname sp STR sp STR sp STR sp STR sp STR trail { /* convert the soa data */ zadd_rdata_domain($1); /* prim. ns */ zadd_rdata_domain($3); /* email */ zadd_rdata_wireformat(zparser_conv_serial(parser->region, $5.str)); /* serial */ zadd_rdata_wireformat(zparser_conv_period(parser->region, $7.str)); /* refresh */ zadd_rdata_wireformat(zparser_conv_period(parser->region, $9.str)); /* retry */ zadd_rdata_wireformat(zparser_conv_period(parser->region, $11.str)); /* expire */ zadd_rdata_wireformat(zparser_conv_period(parser->region, $13.str)); /* minimum */ } ; rdata_wks: dotted_str sp STR sp concatenated_str_seq trail { zadd_rdata_wireformat(zparser_conv_a(parser->region, $1.str)); /* address */ zadd_rdata_wireformat(zparser_conv_services(parser->region, $3.str, $5.str)); /* protocol and services */ } ; rdata_hinfo: STR sp STR trail { zadd_rdata_wireformat(zparser_conv_text(parser->region, $1.str, $1.len)); /* CPU */ zadd_rdata_wireformat(zparser_conv_text(parser->region, $3.str, $3.len)); /* OS*/ } ; rdata_minfo: dname sp dname trail { /* convert a single dname record */ zadd_rdata_domain($1); zadd_rdata_domain($3); } ; rdata_mx: STR sp dname trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* priority */ zadd_rdata_domain($3); /* MX host */ } ; rdata_txt: str_seq trail { zadd_rdata_txt_clean_wireformat(); } ; /* RFC 1183 */ rdata_rp: dname sp dname trail { zadd_rdata_domain($1); /* mbox d-name */ zadd_rdata_domain($3); /* txt d-name */ } ; /* RFC 1183 */ rdata_afsdb: STR sp dname trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* subtype */ zadd_rdata_domain($3); /* domain name */ } ; /* RFC 1183 */ rdata_x25: STR trail { zadd_rdata_wireformat(zparser_conv_text(parser->region, $1.str, $1.len)); /* X.25 address. */ } ; /* RFC 1183 */ rdata_isdn: STR trail { zadd_rdata_wireformat(zparser_conv_text(parser->region, $1.str, $1.len)); /* address */ } | STR sp STR trail { zadd_rdata_wireformat(zparser_conv_text(parser->region, $1.str, $1.len)); /* address */ zadd_rdata_wireformat(zparser_conv_text(parser->region, $3.str, $3.len)); /* sub-address */ } ; /* RFC 1183 */ rdata_rt: STR sp dname trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* preference */ zadd_rdata_domain($3); /* intermediate host */ } ; /* RFC 1706 */ rdata_nsap: str_dot_seq trail { /* String must start with "0x" or "0X". */ if (strncasecmp($1.str, "0x", 2) != 0) { zc_error_prev_line("NSAP rdata must start with '0x'"); } else { zadd_rdata_wireformat(zparser_conv_hex(parser->region, $1.str + 2, $1.len - 2)); /* NSAP */ } } ; /* RFC 2163 */ rdata_px: STR sp dname sp dname trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* preference */ zadd_rdata_domain($3); /* MAP822 */ zadd_rdata_domain($5); /* MAPX400 */ } ; rdata_aaaa: dotted_str trail { zadd_rdata_wireformat(zparser_conv_aaaa(parser->region, $1.str)); /* IPv6 address */ } ; rdata_loc: concatenated_str_seq trail { zadd_rdata_wireformat(zparser_conv_loc(parser->region, $1.str)); /* Location */ } ; rdata_nxt: dname sp nxt_seq trail { zadd_rdata_domain($1); /* nxt name */ zadd_rdata_wireformat(zparser_conv_nxt(parser->region, nxtbits)); /* nxt bitlist */ memset(nxtbits, 0, sizeof(nxtbits)); } ; rdata_srv: STR sp STR sp STR sp dname trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* prio */ zadd_rdata_wireformat(zparser_conv_short(parser->region, $3.str)); /* weight */ zadd_rdata_wireformat(zparser_conv_short(parser->region, $5.str)); /* port */ zadd_rdata_domain($7); /* target name */ } ; /* RFC 2915 */ rdata_naptr: STR sp STR sp STR sp STR sp STR sp dname trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* order */ zadd_rdata_wireformat(zparser_conv_short(parser->region, $3.str)); /* preference */ zadd_rdata_wireformat(zparser_conv_text(parser->region, $5.str, $5.len)); /* flags */ zadd_rdata_wireformat(zparser_conv_text(parser->region, $7.str, $7.len)); /* service */ zadd_rdata_wireformat(zparser_conv_text(parser->region, $9.str, $9.len)); /* regexp */ zadd_rdata_domain($11); /* target name */ } ; /* RFC 2230 */ rdata_kx: STR sp dname trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* preference */ zadd_rdata_domain($3); /* exchanger */ } ; /* RFC 2538 */ rdata_cert: STR sp STR sp STR sp str_sp_seq trail { zadd_rdata_wireformat(zparser_conv_certificate_type(parser->region, $1.str)); /* type */ zadd_rdata_wireformat(zparser_conv_short(parser->region, $3.str)); /* key tag */ zadd_rdata_wireformat(zparser_conv_algorithm(parser->region, $5.str)); /* algorithm */ zadd_rdata_wireformat(zparser_conv_b64(parser->region, $7.str)); /* certificate or CRL */ } ; /* RFC 3123 */ rdata_apl: rdata_apl_seq trail ; rdata_apl_seq: dotted_str { zadd_rdata_wireformat(zparser_conv_apl_rdata(parser->region, $1.str)); } | rdata_apl_seq sp dotted_str { zadd_rdata_wireformat(zparser_conv_apl_rdata(parser->region, $3.str)); } ; rdata_ds: STR sp STR sp STR sp str_sp_seq trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* keytag */ zadd_rdata_wireformat(zparser_conv_algorithm(parser->region, $3.str)); /* alg */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, $5.str)); /* type */ zadd_rdata_wireformat(zparser_conv_hex(parser->region, $7.str, $7.len)); /* hash */ } ; rdata_dlv: STR sp STR sp STR sp str_sp_seq trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* keytag */ zadd_rdata_wireformat(zparser_conv_algorithm(parser->region, $3.str)); /* alg */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, $5.str)); /* type */ zadd_rdata_wireformat(zparser_conv_hex(parser->region, $7.str, $7.len)); /* hash */ } ; rdata_sshfp: STR sp STR sp str_sp_seq trail { zadd_rdata_wireformat(zparser_conv_byte(parser->region, $1.str)); /* alg */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, $3.str)); /* fp type */ zadd_rdata_wireformat(zparser_conv_hex(parser->region, $5.str, $5.len)); /* hash */ } ; rdata_dhcid: str_sp_seq trail { zadd_rdata_wireformat(zparser_conv_b64(parser->region, $1.str)); /* data blob */ } ; rdata_rrsig: STR sp STR sp STR sp STR sp STR sp STR sp STR sp wire_dname sp str_sp_seq trail { zadd_rdata_wireformat(zparser_conv_rrtype(parser->region, $1.str)); /* rr covered */ zadd_rdata_wireformat(zparser_conv_algorithm(parser->region, $3.str)); /* alg */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, $5.str)); /* # labels */ zadd_rdata_wireformat(zparser_conv_period(parser->region, $7.str)); /* # orig TTL */ zadd_rdata_wireformat(zparser_conv_time(parser->region, $9.str)); /* sig exp */ zadd_rdata_wireformat(zparser_conv_time(parser->region, $11.str)); /* sig inc */ zadd_rdata_wireformat(zparser_conv_short(parser->region, $13.str)); /* key id */ zadd_rdata_wireformat(zparser_conv_dns_name(parser->region, (const uint8_t*) $15.str,$15.len)); /* sig name */ zadd_rdata_wireformat(zparser_conv_b64(parser->region, $17.str)); /* sig data */ } ; rdata_nsec: wire_dname nsec_seq { zadd_rdata_wireformat(zparser_conv_dns_name(parser->region, (const uint8_t*) $1.str, $1.len)); /* nsec name */ zadd_rdata_wireformat(zparser_conv_nsec(parser->region, nsecbits)); /* nsec bitlist */ memset(nsecbits, 0, sizeof(nsecbits)); nsec_highest_rcode = 0; } ; rdata_nsec3: STR sp STR sp STR sp STR sp STR nsec_seq { #ifdef NSEC3 nsec3_add_params($1.str, $3.str, $5.str, $7.str, $7.len); zadd_rdata_wireformat(zparser_conv_b32(parser->region, $9.str)); /* next hashed name */ zadd_rdata_wireformat(zparser_conv_nsec(parser->region, nsecbits)); /* nsec bitlist */ memset(nsecbits, 0, sizeof(nsecbits)); nsec_highest_rcode = 0; #else zc_error_prev_line("nsec3 not supported"); #endif /* NSEC3 */ } ; rdata_nsec3_param: STR sp STR sp STR sp STR trail { #ifdef NSEC3 nsec3_add_params($1.str, $3.str, $5.str, $7.str, $7.len); #else zc_error_prev_line("nsec3 not supported"); #endif /* NSEC3 */ } ; rdata_tlsa: STR sp STR sp STR sp str_sp_seq trail { zadd_rdata_wireformat(zparser_conv_byte(parser->region, $1.str)); /* usage */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, $3.str)); /* selector */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, $5.str)); /* matching type */ zadd_rdata_wireformat(zparser_conv_hex(parser->region, $7.str, $7.len)); /* ca data */ } ; rdata_dnskey: STR sp STR sp STR sp str_sp_seq trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* flags */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, $3.str)); /* proto */ zadd_rdata_wireformat(zparser_conv_algorithm(parser->region, $5.str)); /* alg */ zadd_rdata_wireformat(zparser_conv_b64(parser->region, $7.str)); /* hash */ } ; rdata_ipsec_base: STR sp STR sp STR sp dotted_str { const dname_type* name = 0; zadd_rdata_wireformat(zparser_conv_byte(parser->region, $1.str)); /* precedence */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, $3.str)); /* gateway type */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, $5.str)); /* algorithm */ switch(atoi($3.str)) { case IPSECKEY_NOGATEWAY: zadd_rdata_wireformat(alloc_rdata_init(parser->region, "", 0)); break; case IPSECKEY_IP4: zadd_rdata_wireformat(zparser_conv_a(parser->region, $7.str)); break; case IPSECKEY_IP6: zadd_rdata_wireformat(zparser_conv_aaaa(parser->region, $7.str)); break; case IPSECKEY_DNAME: /* convert and insert the dname */ if(strlen($7.str) == 0) zc_error_prev_line("IPSECKEY must specify gateway name"); if(!(name = dname_parse(parser->region, $7.str))) zc_error_prev_line("IPSECKEY bad gateway dname %s", $7.str); if($7.str[strlen($7.str)-1] != '.') name = dname_concatenate(parser->rr_region, name, domain_dname(parser->origin)); zadd_rdata_wireformat(alloc_rdata_init(parser->region, dname_name(name), name->name_size)); break; default: zc_error_prev_line("unknown IPSECKEY gateway type"); } } ; rdata_ipseckey: rdata_ipsec_base sp str_sp_seq trail { zadd_rdata_wireformat(zparser_conv_b64(parser->region, $3.str)); /* public key */ } | rdata_ipsec_base trail ; /* RFC 6742 */ rdata_nid: STR sp dotted_str trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* preference */ zadd_rdata_wireformat(zparser_conv_ilnp64(parser->region, $3.str)); /* NodeID */ } ; rdata_l32: STR sp dotted_str trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* preference */ zadd_rdata_wireformat(zparser_conv_a(parser->region, $3.str)); /* Locator32 */ } ; rdata_l64: STR sp dotted_str trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* preference */ zadd_rdata_wireformat(zparser_conv_ilnp64(parser->region, $3.str)); /* Locator64 */ } ; rdata_lp: STR sp dname trail { zadd_rdata_wireformat(zparser_conv_short(parser->region, $1.str)); /* preference */ zadd_rdata_domain($3); /* FQDN */ } ; rdata_eui48: STR trail { #ifdef DRAFT_RRTYPES zadd_rdata_wireformat(zparser_conv_eui(parser->region, $1.str, 48)); #else zc_error_prev_line("EUI48 not supported, enable with --enable-draft-rrtypes."); #endif } ; rdata_eui64: STR trail { #ifdef DRAFT_RRTYPES zadd_rdata_wireformat(zparser_conv_eui(parser->region, $1.str, 64)); #else zc_error_prev_line("EUI64 not supported, enable with --enable-draft-rrtypes."); #endif } ; rdata_unknown: URR sp STR sp str_sp_seq trail { /* $2 is the number of octects, currently ignored */ $$ = zparser_conv_hex(parser->region, $5.str, $5.len); } | URR sp STR trail { $$ = zparser_conv_hex(parser->region, "", 0); } | URR error NL { $$ = zparser_conv_hex(parser->region, "", 0); } ; %% int yywrap(void) { return 1; } /* * Create the parser. */ zparser_type * zparser_create(region_type *region, region_type *rr_region, namedb_type *db) { zparser_type *result; result = (zparser_type *) region_alloc(region, sizeof(zparser_type)); result->region = region; result->rr_region = rr_region; result->db = db; result->filename = NULL; result->current_zone = NULL; result->origin = NULL; result->prev_dname = NULL; result->default_apex = NULL; result->temporary_rdatas = (rdata_atom_type *) region_alloc( result->region, MAXRDATALEN * sizeof(rdata_atom_type)); return result; } /* * Initialize the parser for a new zone file. */ void zparser_init(const char *filename, uint32_t ttl, uint16_t klass, const dname_type *origin) { memset(nxtbits, 0, sizeof(nxtbits)); memset(nsecbits, 0, sizeof(nsecbits)); nsec_highest_rcode = 0; parser->default_ttl = ttl; parser->default_class = klass; parser->current_zone = NULL; parser->origin = domain_table_insert(parser->db->domains, origin); parser->prev_dname = parser->origin; parser->default_apex = parser->origin; parser->error_occurred = 0; parser->errors = 0; parser->line = 1; parser->filename = filename; parser->current_rr.rdata_count = 0; parser->current_rr.rdatas = parser->temporary_rdatas; } void yyerror(const char *message) { zc_error("%s", message); } static void error_va_list(unsigned line, const char *fmt, va_list args) { if (parser->filename) { fprintf(stderr, "%s:%u: ", parser->filename, line); } fprintf(stderr, "error: "); vfprintf(stderr, fmt, args); fprintf(stderr, "\n"); ++parser->errors; parser->error_occurred = 1; } /* the line counting sux, to say the least * with this grose hack we try do give sane * numbers back */ void zc_error_prev_line(const char *fmt, ...) { va_list args; va_start(args, fmt); error_va_list(parser->line - 1, fmt, args); va_end(args); } void zc_error(const char *fmt, ...) { /* send an error message to stderr */ va_list args; va_start(args, fmt); error_va_list(parser->line, fmt, args); va_end(args); } static void warning_va_list(unsigned line, const char *fmt, va_list args) { if (parser->filename) { fprintf(stderr, "%s:%u: ", parser->filename, line); } fprintf(stderr, "warning: "); vfprintf(stderr, fmt, args); fprintf(stderr, "\n"); } void zc_warning_prev_line(const char *fmt, ...) { va_list args; va_start(args, fmt); warning_va_list(parser->line - 1, fmt, args); va_end(args); } void zc_warning(const char *fmt, ... ) { va_list args; va_start(args, fmt); warning_va_list(parser->line, fmt, args); va_end(args); } #ifdef NSEC3 static void nsec3_add_params(const char* hashalgo_str, const char* flag_str, const char* iter_str, const char* salt_str, int salt_len) { zadd_rdata_wireformat(zparser_conv_byte(parser->region, hashalgo_str)); zadd_rdata_wireformat(zparser_conv_byte(parser->region, flag_str)); zadd_rdata_wireformat(zparser_conv_short(parser->region, iter_str)); /* salt */ if(strcmp(salt_str, "-") != 0) zadd_rdata_wireformat(zparser_conv_hex_length(parser->region, salt_str, salt_len)); else zadd_rdata_wireformat(alloc_rdata_init(parser->region, "", 1)); } #endif /* NSEC3 */ nsd-3.2.16/nsd-patch.8.in0000664000175000017500000000304112173226547013741 0ustar matjematje.TH "nsd\-patch" "8" "Jul 22, 2013" "NLnet Labs" "nsd 3.2.16" .\" Copyright (c) 2001\-2011, NLnet Labs. All rights reserved. .\" See LICENSE for the license. .SH "NAME" .LP .B nsd\-patch \- NSD zone patcher version 3.2.16. .SH "SYNOPSIS" .B nsd\-patch .RB [ \-c .IR configfile ] .RB [ \-f ] .RB [ \-h ] .RB [ \-l ] .RB [ \-o .IR dbfile ] .RB [ \-s ] .RB [ \-x .IR difffile ] .SH "DESCRIPTION" .LP .B Nsd\-patch is the zone patcher for nsd(8). It reads in the nsd database (nsd.db) and difffile (ixfr.db), and overwrites the zone text files if they have been updated. Running this regularly ensures that the difffile does not grow infinitely. .SH "OPTIONS" .TP .B \-c\fI configfile Read specified configfile instead of the default .IR @nsdconfigfile@ . .TP .B \-f Forces writing zone files. Also zones that have not changed are written back to their zone files. .TP .B \-h Print usage help information and exit. .TP .B \-l List the journal entries from the difffile. Does not write to zone files. .TP .B \-o\fI dbfile Store the output directly to dbfile. .TP .B \-s Skip writing zone files. No zones are written back to their zone files. .TP .B \-x\fI difffile Read specified difffile. Overrides the config file setting. .SH "FILES" .TP @dbfile@ default .B NSD database .TP @nsdconfigfile@ default .B NSD configuration file .SH "SEE ALSO" nsd(8), nsdc(8), nsd.conf(5), nsd-checkconf(8), nsd-notify(8), nsd-xfer(8), zonec(8) .SH "AUTHORS" .LP .B NSD was written by NLnet Labs and RIPE NCC joint team. Please see CREDITS file in the distribution for further details. nsd-3.2.16/doc/0000775000175000017500000000000012173226547012131 5ustar matjematjensd-3.2.16/doc/README.svn0000664000175000017500000000174510542235616013620 0ustar matjematjeIf you build NSD directly from the Subversion repository, you will need the (gnu) autotools to generate the configure script. On most systems, this can simply be done by using autoreconf: autoreconf This will call autoconf, autoheader, aclocal etc. After this you can build normally with configure and make, see the general README for further information on this. Some systems do not have a symlink to separate versions, so you will have to use the specific version name. It should work with at least 2.53 and 2.59. The actual executable name may differ on various systems, most of the times it is either called autoreconf-2.59 or autoreconf259 Some systems also do not have a standard aclocal link, in which case you will have to tell autoreconf what aclocal executable to use. This can be done by setting the ACLOCAL environment variable. It should work with aclocal 1.4, 1.5 and 1.9. Examples of complete commands: ACLOCAL=aclocal19 autoreconf259 ACLOCAL=aclocal-1.9 autoreconf-2.59 nsd-3.2.16/doc/LICENSE0000664000175000017500000000272611535444205013137 0ustar matjematjeCopyright (c) 2001-2011, NLnet Labs. All rights reserved. This software is open source. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Neither the name of the NLNET LABS nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. nsd-3.2.16/doc/differences.tex0000664000175000017500000007024110477245127015134 0ustar matjematje% DIFFERENCES NSD 3 and other name servers. \documentclass[twoside,titlepage,english]{nlnetlabs} \newcites{rfc}{RFC references} \def\nlnetlabsno{2006-004} \rcsdetails{$Id: differences.tex 2438 2006-09-05 09:58:47Z wouter $} % Prints RCS details at the bottom of the page. \title{Response Differences between\\ NSD and other DNS Servers} \author{ %This escape is needed. Because of wrapping by hyperref \texorpdfstring{ Jelte Jansen\thanks{\href{mailto:jelte@nlnetlabs.nl}{jelte@nlnetlabs.nl}}, \textsl{NLnet Labs}\\ Wouter Wijngaards\thanks{\href{mailto:wouter@nlnetlabs.nl}{wouter@nlnetlabs.nl}}, \textsl{NLnet Labs} } {Jelte Jansen, Wouter C.A. Wijngaards} } \date{ \today } \begin{document} \flushbottom \maketitle{} \begin{abstract} This note describes observed differences in responses between NSD and other DNS server implementations. NSD 3.0.0 is compared to NSD 2.3.6, BIND 8.4.7 and BIND 9.3.2. Differences in answers to captured queries from resolvers are tallied and analyzed. No interoperability problems are found. \end{abstract} \tableofcontents \newpage \section{Introduction} The NSD name server is compared to other DNS server implementations in order to assess server interoperability. The goal is to observe differences in the answers that the name servers provide. These differences are categorized and counted. We used BIND 8 and BIND 9 versions to compare against. Also regression tests have been run on our testlab, comparing NSD 2 versus NSD 3. Our method uses a set of queries captured from production name servers. These queries are sent over UDP to a name server set up to serve a particular zone. Then the responses from the name server are recorded. For every query, the different answers provided by the server implementations are compared. Unparseable answers and no answers from the servers are handled identically by the comparison software. This is not a problem because both BIND and NSD are mature and stable DNS implementations, all answers they send are parseable. Only in a very few cases, where the query is very badly formed, no answers are sent back. The differences are found by replaying captured DNS query traces from the NL TLD and from the root zone against different name servers. The differences in the answers are then analyzed, by first performing a byte-comparison on the packets. If the packets are binary different, the contents are parsed, thus removing differences in domain name compression, and normalized (sorted, lowercase) in presentation. If the results do not match after normalization, then a list of difference categories is consulted. The difference is classified as the first category that matches. If a difference in answers does not match any category, then the process stops and the user is notified. All the differences are categorized for the traces we present. In addition, we gratefully made use of the PROTOS DNS tool developed at the University of Oulu which they made publicly available at \href{http://www.ee.oulu.fi/research/ouspg/protos/testing/c09/dns} {the protos webpage}\footnote{http://www.ee.oulu.fi/research/ouspg/protos/testing/c09/dns} and played the queries against the authoritative name servers. We fixed a packet parsing error in NSD3-prerelease and both NSD3 and BIND 9.3.2 remained running and responsive. Additionally we used the faulty DNS query traces in the wiki-ethereal repository. These can be found in \href{http://wiki.ethereal.com/SampleCaptures} {the ethereal wiki}\footnote{http://wiki.ethereal.com/SampleCaptures}. These traces posed no problem for BIND and NSD, mostly FORMERR answers. A previous document DIFFERENCES between BIND 8.4.4 and NSD 2.0.0 can be found in the NSD 2.x package. In the places where differences have been found between BIND and NSD, in the authors' opinion, no interoperability problems result for resolvers. \section{Response differences between BIND 9.3.2 and NSD 3.0.0} In this section the response differences between BIND 9.3.2 and NSD 3.0.0 are presented and analyzed. We start in Section~\ref{root_b932nsd3} and Section~\ref{nl_b932nsd3} with presenting the difference statistics for two test traces. Then in Section~\ref{sec:features} and Section~\ref{sec:funcdiff} the difference categories are explained in more detail. \subsection{Comparison of responses to root queries} \label{root_b932nsd3} Comparison between NSD 3.0.0 and BIND 9.3.2 for a root trace. \begin{tabular}{lrr} {\em difference} & {\em packets} & {\em \%diff} \\ d-additional (\ref{d-additional}) & 455607 & 59.19\% \\ n-clrdobit (\ref{n-clrdobit}) & 208389 & 27.07\% \\ b-soattl (\ref{b-soattl}) & 101707 & 13.21\% \\ n-update (\ref{n-update}) & 1858 & 0.24\% \\ d-hostname (\ref{d-hostname}) & 1032 & 0.13\% \\ d-formerrquery (\ref{d-formerrquery}) & 773 & 0.10\% \\ b-class0 (\ref{b-class0}) & 264 & 0.03\% \\ d-refusedquery (\ref{d-refusedquery}) & 79 & 0.01\% \\ d-notify (\ref{d-notify}) & 18 & 0.00\% \\ b-mailb (\ref{b-mailb}) & 7 & 0.00\% \\ n-tcinquery (\ref{n-tcinquery}) & 6 & 0.00\% \\ b-classany-nxdomain (\ref{b-classany-nxdomain}) & 5 & 0.00\% \\ d-badqueryflags (\ref{d-badqueryflags}) & 4 & 0.00\% \\ n-ixfr-notimpl (\ref{n-ixfr-notimpl}) & 3 & 0.00\% \\ d-version (\ref{d-version}) & 1 & 0.00\% \\ Total number of differences: & 769753 & 100\% \\ Number of packets the same after normalization:&1474863 \\ Number of packets exactly the same on the wire:& 59161 \\ Total number of packets inspected: &2244616 \\ \end{tabular} For each type of difference the number of packets in the trace that match that difference are shown. The section where that difference is analyzed is shown in parenthesis after the difference name. The percentage of differences explained by the difference category is listed. Adding up the packets that are different gives the total number of differences, or 100\% of the differences. The number of packets after normalization includes the number of packets that are the same on the wire. The total number of query packets is displayed at the bottom of the table. \subsection{Comparison of responses to NL TLD queries} \label{nl_b932nsd3} Comparison between NSD 3.0.0 and BIND 9.3.2, for a trace for .nl. \begin{tabular}{lrr} {\em difference} & {\em packets} & {\em \%diff} \\ d-unknown-opcode (\ref{d-unknown-opcode}) & 2541 & 26.44\% \\ b-badquery-badanswer (\ref{b-badquery-badanswer}) & 1817 & 18.91\% \\ n-clrdobit (\ref{n-clrdobit}) & 1495 & 15.56\% \\ b-soattl (\ref{b-soattl}) & 1120 & 11.65\% \\ n-update (\ref{n-update}) & 990 & 10.30\% \\ d-badqueryflags (\ref{d-badqueryflags}) & 847 & 8.81\% \\ d-hostname (\ref{d-hostname}) & 531 & 5.52\% \\ d-notify (\ref{d-notify}) & 98 & 1.02\% \\ b-upwards-ref (\ref{b-upwards-ref}) & 78 & 0.81\% \\ n-clrcdbit (\ref{n-clrcdbit}) & 63 & 0.66\% \\ d-version (\ref{d-version}) & 22 & 0.23\% \\ b-noglue-nsquery (\ref{b-noglue-nsquery}) & 8 & 0.08\% \\ b8-badedns0 (\ref{b8-badedns0}) & 1 & 0.01\% \\ Total number of differences: & 9611 & 100\% \\ Number of packets the same after normalization: & 90389 \\ Number of packets exactly the same on the wire: & 52336 \\ Total number of packets inspected: & 100000 \\ \end{tabular} \subsection{Features} \label{sec:features} In this section we enumerate a number of differences between BIND 9.3.2 and NSD 3.0.0 that cannot be immediately explained as design choices. These features could be seen as bugs in software or protocol specs, except that they do not lead to interoperability problems. \subsubsection{n-clrdobit - NSD clears DO bit in response} \label{n-clrdobit} NSD clears the DO bit in answers to queries with the DO bit. BIND copies the DO bit to the answer. \vspace{-8pt}\subparagraph{Analysis:} In RFC4035\cite{rfc4035} the DO bit is not specified for answers. In the examples section of that RFC the DO bit is shown for signed dig responses, although this could refer to the query or the answer. NSD clears the DO bit for all answers, a decision based on speed: the EDNS record sent back by NSD is precompiled and not modified during answer processing. \subsubsection{n-clrcdbit - NSD clears CD bit in response} \label{n-clrcdbit} NSD clears the CD bit in answers to queries with the CD bit. BIND copies the CD bit to the answer. \vspace{-8pt}\subparagraph{Analysis:} RFC 4035\cite{rfc4035} asserts that the CD bit must be cleared for authoritative answers. The CD bit should be copied into the answer by recursive servers. BIND copies the CD bit for some formerr queries. \subsubsection{b-class0 - CLASS0 formerr in BIND} \label{b-class0} For CLASS0, you can get either FORMERR, from BIND or REFUSED, from NSD. \vspace{-8pt}\subparagraph{Analysis:} Difference in interpretation of the RFCs, a CLASS value of 0 is interpreted as a syntax error by BIND but as another valid class (that is not served) by NSD. Resolvers are unaffected for CLASS IN. \subsubsection{n-tcinquery - TC bit in query is formerr for NSD} \label{n-tcinquery} NSD returns FORMERR if tc bit is set in query. \vspace{-8pt}\subparagraph{Analysis:} Queries cannot be longer than 512 octets, since the DNS header is short and the query DNS name has a maximum length of 255 octets. Thus TC (TrunCation) cannot happen. Only one question per query packet is answered by NSD, this is a design decision. Some update, ixfr request, notify, gss-tsig TKEY sequence queries could theoretically carry longer data in the query from the client. In practice this does not happen, as 255 octet uncompressed names are not used. If this were to happen, the client could attempt a TCP connection immediately instead of setting a TC bit, or use EDNS0 to send longer packets. In this NSD is more strict in validation than BIND. \subsubsection{b-soattl - BIND sets SOA TTL in authority section to 0 for SOA queries} \label{b-soattl} This happens when asking for the SOA for a domain that is not served. \footnotesize \begin{verbatim} Query: ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0 ;; flags: rd ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;; foo.bar. IN SOA \end{verbatim} \normalsize Answer from BIND 9.3.2: \footnotesize \begin{verbatim} ;; ->>HEADER<<- opcode: QUERY, rcode: NXDOMAIN, id: 6097 ;; flags: qr aa rd ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;; foo.bar. IN SOA ;; ANSWER SECTION: ;; AUTHORITY SECTION: . 0 IN SOA A.ROOT-SERVERS.NET. NSTLD.VERISIGN-GRS.COM. ( 2006072801 1800 900 604800 86400) ;; ADDITIONAL SECTION: ;; Query time: 10 msec ;; SERVER: 127.0.0.1 ;; WHEN: Wed Aug 23 13:52:36 2006 ;; MSG SIZE rcvd: 100 \end{verbatim} \normalsize Answer from NSD 3: \footnotesize \begin{verbatim} ;; ->>HEADER<<- opcode: QUERY, rcode: NXDOMAIN, id: 26095 ;; flags: qr aa rd ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;; foo.bar. IN SOA ;; ANSWER SECTION: ;; AUTHORITY SECTION: . 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. ( 2006072801 1800 900 604800 86400) ;; ADDITIONAL SECTION: ;; Query time: 60 msec ;; SERVER: 127.0.0.1 ;; WHEN: Wed Aug 23 13:53:30 2006 ;; MSG SIZE rcvd: 100 \end{verbatim} \normalsize \vspace{-8pt}\subparagraph{Analysis:} BIND conforms to internet-draft draft-andrews-dnsext-soa-discovery which has at the moment of code development not (yet) been published as RFC. NSD conforms to the RFCs. \subsubsection{b-classany-nxdomain - BIND gives an auth answer for class ANY nxdomain} \label{b-classany-nxdomain} A difference in behaviour for CLASS=ANY queries. For existing domains both BIND and NSD reply with AA bit cleared. For not existing domains (nxdomain) NSD replies with AA bit cleared. BIND replies with AA bit on and includes a SOA (CLASS=IN) for the zone, as for an authoritative nxdomain. Query: \footnotesize \begin{verbatim} ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 13328 ;; flags: ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;; nslabs.ruO. ANY MX \end{verbatim} \normalsize Answer from BIND 9.3.2: \footnotesize \begin{verbatim} ;; ->>HEADER<<- opcode: QUERY, rcode: NXDOMAIN, id: 13328 ;; flags: qr aa ; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0 ;; QUESTION SECTION: ;; nslabs.ruo. ANY MX ;; ANSWER SECTION: ;; AUTHORITY SECTION: . 86400 IN SOA a.root-servers.net. nstld.verisign-grs.com. ( 2006072801 1800 900 604800 86400) ;; ADDITIONAL SECTION: ;; Query time: 0 msec ;; WHEN: Wed Aug 23 13:58:51 2006 ;; MSG SIZE rcvd: 103 \end{verbatim} \normalsize Answer from NSD 3: \footnotesize \begin{verbatim} ;; ->>HEADER<<- opcode: QUERY, rcode: NXDOMAIN, id: 13328 ;; flags: qr ; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: ;; nslabs.ruo. ANY MX ;; ANSWER SECTION: ;; AUTHORITY SECTION: ;; ADDITIONAL SECTION: ;; Query time: 0 msec ;; WHEN: Wed Aug 23 13:58:51 2006 ;; MSG SIZE rcvd: 28 \end{verbatim} \normalsize \vspace{-8pt}\subparagraph{Analysis:} Feature of BIND where it answers authoritatively for CLASS ANY nxdomain queries. \subsubsection{b-badquery-badanswer - BIND replies with bad answer for some bad queries} \label{b-badquery-badanswer} BIND replies with an answer packet that cannot be parsed, or does not answer at all. NSD always generates an answer, with the appropriate RCODE (mostly NOTIMPL and FORMERR, but also NXDOMAIN to NOTIFY queries). All these queries are malformed in some way. A (very simple) example of a query without an answer is a query packet of 18 zero bytes. For some queries no answer only happens when BIND is presented with a trace of queries, not for a single query. \vspace{-8pt}\subparagraph{Analysis:} BIND includes (part of) the unparseable question into the answer, or some internal state of BIND is affected by earlier queries. NSD manages to answer the malformed query. Note that NSD does not answer queries that are too short, or that have the QR bit set. NSD tries to be as liberal in what it accepts as possible. \subsection{Functionality Differences} \label{sec:funcdiff} The next group of differences are due to the fact that NSD does not implement some functionality that is requested by resolvers. This is a design choice and should not cause resolver problems at all, since responses to those requests are within protocol specs. \subsubsection{d-notify - different NOTIFY errors} \label{d-notify} BIND and NSD give different errors for notify queries. The servers are started without any configuration for access control on notify. For notify messages aimed at a zone that is served, BIND 9.3.2 returns a NOERROR answer, and NSD 3 returns NOTAUTH. For notify messages on a zone that is not served (in-addr.arpa.) BIND 9.3.2 returns NOTAUTH and NSD 3 returns NXDOMAIN. \vspace{-8pt}\subparagraph{Analysis:} Default configuration differs between the two packages. NSD is more strict. Error codes are different, the tools that send notifies are not affected. \subsubsection{n-update - NSD does not implement dynamic update} \label{n-update} For UPDATE, you can get either REFUSED/NXRRSET/other RCODE from BIND 9.3.2 or NOTIMPL from nsd3. \vspace{-8pt}\subparagraph{Analysis:} NSD does not implement dynamic update. \subsubsection{b-mailb - BIND does not implement MAILB} \label{b-mailb} For MAILB, you can get either NOTIMPL(BIND 9) or NOERROR/NXDOMAIN(NSD 3). \vspace{-8pt}\subparagraph{Analysis:} BIND does not implement queries for the MAILB type. NSD treats it as one of the RRTYPEs. MAILB is obsoleted by RFCs, the MX type is used to transfer mail information now. \subsubsection{d-version - BIND returns servfail on version.server queries} \label{d-version} NSD returns version.server query, BIND returns servfail. \vspace{-8pt}\subparagraph{Analysis:} Both NSD and BIND return version.bind queries of the chaos class. These queries differ in the version number they return, of course. BIND does not return version.server queries. This is a design decision on the part of NSD to return version.server queries with the same answer. \subsubsection{d-additional - Different additional section on truncated answers} \label{d-additional} NSD and BIND return different additional sections on truncated answers to queries from the root. These answers are 480+ bytes long. \vspace{-8pt}\subparagraph{Analysis:} Not all the A and AAAA data fits into the additional section of the answer. BIND includes different names than NSD does, and BIND is observed to sometimes include one more AAAA record, less A records in the additional section. Resolvers should be unaffected. \subsubsection{d-refusedquery - BIND includes query section in REFUSED answers} \label{d-refusedquery} BIND includes the query sent for REFUSED answers. NSD replies with only the DNS header section. \vspace{-8pt}\subparagraph{Analysis:} The resolver must inspect the query ID. The error code provides sufficient information. Sending the header makes NSD replies smaller and thus more resilient to DoS attacks. \subsubsection{d-hostname - BIND adds a NS record for hostname.bind} \label{d-hostname} BIND includes an additional RR in the authority section of the reply: \footnotesize \begin{verbatim} hostname.bind. 0 CH NS hostname.bind. \end{verbatim} \normalsize \vspace{-8pt}\subparagraph{Analysis:} The RR seems useless. NSD does not include it. \subsubsection{n-ixfr-notimpl - NSD does not implement IXFR} \label{n-ixfr-notimpl} To queries for IXFR BIND responds with a valid answer (the latest SOA) and NSD responds with NOTIMPL error. \vspace{-8pt}\subparagraph{Analysis:} NSD 3.0.0 does not implement IXFR. It returns NOTIMPL by design. \subsubsection{d-formerrquery - BIND includes query section in FORMERR answers} \label{d-formerrquery} BIND includes the query sent for FORMERR answers. NSD replies with only the DNS header section. For some queries, NSD includes an EDNS record in the reply if there was a recognizable EDNS record in the query. \vspace{-8pt}\subparagraph{Analysis:} The resolver must inspect the query ID. The error code provides sufficient information. Sending the header makes NSD replies smaller and thus more resilient to DoS attacks. \subsubsection{d-badqueryflags - BIND includes query section in FORMERR answers} \label{d-badqueryflags} BIND includes the query section in reply to unparseable queries. NSD does not. \vspace{-8pt}\subparagraph{Analysis:} Same as d-formerrquery (\ref{d-formerrquery}), but the implementation of the comparison software could not parse the query either, thus a separate label. \subsubsection{d-unknown-class - BIND includes query section in answers to unknown class} \label{d-unknown-class} For queries with an unknown class in the query, BIND includes the query section in the answer. NSD does not. \vspace{-8pt}\subparagraph{Analysis:} Same as d-formerrquery (\ref{d-formerrquery}), but for a different error. \subsubsection{d-unknown-opcode - NSD returns NOTIMPL for unknown opcode} \label{d-unknown-opcode} For queries that are bad packets, with malformed RRs, with an unknown opcode, BIND returns a FORMERR, but NSD gives up after checking the opcode and returns NOTIMPL. NSD copies the flags from the query, and turns on the QR (query response) bit, BIND zeroes some of the flags. \vspace{-8pt}\subparagraph{Analysis:} NOTIMPL is appropriate since NSD does not implement whatever functionality is being looked for. \subsubsection{b-upwards-ref - BIND returns root delegation} \label{b-upwards-ref} For queries to a domain that is not served, which can only have arrived at this server due to a lame delegation, BIND returns a root delegation. NSD returns SERVFAIL. \vspace{-8pt}\subparagraph{Analysis:} By design, NSD does not know the root-servers. NSD is unable to reply as the zone is not configured, hence the SERVFAIL. This is also discussed in the REQUIREMENTS document for NSD. \subsubsection{b-noglue-nsquery - BIND returns no glue for NS queries} \label{b-noglue-nsquery} For queries for the NS records of the zone, BIND does not include glue for the NS records. NSD includes glue for the NS servers that lie within the zone. \vspace{-8pt}\subparagraph{Analysis:} The glue saves a followup query. \subsubsection{d-noquestion - different error on no question} \label{d-noquestion} For queries without a question section the error code differs. NSD considers it a FORMERR. BIND returns REFUSED. \vspace{-8pt}\subparagraph{Analysis:} Error code not specified for this corner case. No problems for resolvers. \subsubsection{b-uchar - BIND returns FORMERR on strange characters} \label{b-uchar} BIND returns FORMERR on strange characters in the query, such as 0x00, 0xff, 0xe4, 0x20, 0x40 and so on. \vspace{-8pt}\subparagraph{Analysis:} NSD does not give a formerr on these queries, it processes them. NSD normalizes names to lower case. Otherwise leaves them untouched. BIND preserves case in answers. Choice made in REQUIREMENTS for NSD, also see RFC1035\cite{rfc1035} 2.3.3. \section{Response differences between NSD 2.3.6 and NSD 3.0.0} The differences between NSD 2.3.6 and NSD 3.0.0 are listed below. All are due to version number changes and new features in NSD 3. \subsection{Comparison of responses in root trace} Differences between NSD 2.3.6 and NSD 3.0.0 for a root trace. Note that apart from the 26 packets that are different, all responses are binary the same on the wire between the two versions of NSD. \begin{tabular}{lrr} {\em difference} & {\em packets} & {\em \%diff} \\ n-notify (\ref{n-notify}) & 19 & 73.08\% \\ n-ixfr (\ref{n-ixfr}) & 3 & 11.54\% \\ version.bind (\ref{nsd-version}) & 3 & 11.54\% \\ version.server (\ref{nsd-version}) & 1 & 3.85\% \\ Total number of differences: & 26 & 100\% \\ Number of packets the same after normalization:&2244590 \\ Number of packets exactly the same on the wire:&2244590 \\ Total number of packets inspected: &2244616 \\ \end{tabular} \subsection{Comparison of responses in NL TLD trace} Differences between NSD 2.3.6 and NSD 3.0.0 for a nl. trace. Note that apart from the 311 packets that are different, all responses are binary the same on the wire between the two versions of NSD. \begin{tabular}{lrr} {\em difference} & {\em packets} & {\em \%diff} \\ n-notify (\ref{n-notify}) & 289 & 92.93\% \\ version.bind (\ref{nsd-version}) & 22 & 7.07\% \\ Total number of differences: & 311 & 100\% \\ Number of packets the same after normalization:& 99689 \\ Number of packets exactly the same on the wire:& 99689 \\ Total number of packets inspected: &100000 \\ \end{tabular} \subsection{Version number - version.bind and version.server} \label{nsd-version} To queries for version.bind and version.server the different implementations return a different version number, as they should. \vspace{-8pt}\subparagraph{Analysis:} Expected. Correct version numbers are returned. \subsection{n-notify - notify not implemented in NSD 2} \label{n-notify} Notifications are handled differently. NSD 2 returns NOTIMPL error code, while NSD 3 returns NOTAUTH or NXDOMAIN error codes. \vspace{-8pt}\subparagraph{Analysis:} Default config denies all notify queries for NSD 3. These answers are correct for non-existing and not authorized domains. \subsection{n-ixfr - IXFR error FORMERR in NSD 2} \label{n-ixfr} To IXFR query questions different error codes are given. The NSD 2 gives FORMERR (due to the RR in the authority section). NSD 3 returns NOTIMPL. \vspace{-8pt}\subparagraph{Analysis:} Neither version of NSD implements IXFR. It is more appropriate to return the NOTIMPL error code in that case. Bugfix in NSD. \section{Response differences between BIND 8 and NSD 3.0.0} In this section the response differences between BIND 8.4.7 and NSD 3.0.0 are categorized and analyzed. \subsection{Comparison of responses in root trace} The differences between BIND 8.4.7 and NSD 3.0.0 when presented with queries for the root zone are below. \begin{tabular}{lrr} {\em difference} & {\em packets} & {\em \%diff} \\ n-clrcdbit (\ref{n-clrcdbit}) & 516372 &84.39\% \\ d-hostname (\ref{d-hostname}) & 53431 &8.73\% \\ d-additional (\ref{d-additional}) & 32526 &5.32\% \\ b8-nodata-ttlminup (\ref{b8-nodata-ttlminup}) & 4611 &0.75\% \\ n-update (\ref{n-update}) & 1856 &0.30\% \\ d-version (\ref{d-version}) & 1033 &0.17\% \\ b8-auth-any (\ref{b8-auth-any}) & 519 &0.08\% \\ b8-badedns0 (\ref{b8-badedns0}) & 492 &0.08\% \\ d-unknown-class (\ref{d-unknown-class}) & 482 &0.08\% \\ b-badquery-badanswer (\ref{b-badquery-badanswer}) & 451 &0.07\% \\ b-class0 (\ref{b-class0}) & 97 &0.02\% \\ d-notify (\ref{d-notify}) & 18 &0.00\% \\ b8-ignore-tc-query (\ref{b8-ignore-tc-query}) & 6 &0.00\% \\ b8-badquery-ignored (\ref{b8-badquery-ignored}) & 4 &0.00\% \\ n-ixfr-notimpl (\ref{n-ixfr-notimpl}) & 3 &0.00\% \\ b-soattl (\ref{b-soattl}) & 1 &0.00\% \\ Total number of differences: & 611902 &100\% \\ Number of packets the same after normalization:&1632714 \\ Number of packets exactly the same on the wire:& 2299 \\ Total number of packets inspected: &2244616 \\ \end{tabular} \subsection{Comparison of responses in NL TLD trace} The differences between BIND 8.4.7 and NSD 3.0.0 when presented with queries for the .nl zone are below. \begin{tabular}{lrr} {\em difference} & {\em packets} & {\em \%diff} \\ n-clrcdbit (\ref{n-clrcdbit}) & 2857 &33.53\% \\ d-unknown-opcode (\ref{d-unknown-opcode}) & 2692 &31.59\% \\ n-update (\ref{n-update}) & 1283 &15.06\% \\ d-badqueryflags (\ref{d-badqueryflags}) & 841 &9.87\% \\ d-hostname (\ref{d-hostname}) & 531 &6.23\% \\ d-notify (\ref{d-notify}) & 293 &3.44\% \\ d-version (\ref{d-version}) & 22 &0.26\% \\ b-badquery-badanswer (\ref{b-badquery-badanswer}) & 1 &0.01\% \\ b8-badedns0 (\ref{b8-badedns0}) & 1 &0.01\% \\ Total number of differences: &8521 &100\% \\ Number of packets the same after normalization:&91479 \\ Number of packets exactly the same on the wire:&90837 \\ Total number of packets inspected:&100000 \\ \end{tabular} \subsection{b8-nodata-ttlminup - BIND 8 uses minimum TTL from SOA also if bigger} \label{b8-nodata-ttlminup} For NXDOMAIN queries in root-servers.net BIND 8 uses the minimum TTL from the SOA as the TTL of the included SOA RR. However, this minimum TTL is larger than the original TTL of the SOA, both NSD 2.3.6, NSD 3 and BIND 9 use the smaller of those two values as the TTL of the included SOA. \vspace{-8pt}\subparagraph{Analysis:} Bug in BIND 8 solved in BIND 9. \subsection{b8-badquery-ignored - BIND 8 replies normally for some bad queries} \label{b8-badquery-ignored} BIND8 manages to reply for malformed queries. NSD replies with FORMERR. \vspace{-8pt}\subparagraph{Analysis:} The query is bad, formerr is needed. Fixed in BIND9. \subsection{b8-badedns0 - BIND 8 ignores bad EDNS0 queries} \label{b8-badedns0} BIND 8 ignores queries with bad EDNS0 section. It answers the query. NSD replies with FORMERR. \vspace{-8pt}\subparagraph{Analysis:} BIND8 is more liberal in accepting broken EDNS0 records. NSD is not. Changed in BIND 9. \subsection{b8-auth-any - BIND 8 includes an authority section on queries for ANY .} \label{b8-auth-any} BIND8 includes an authority section on queries for class ANY . BIND9 and NSD return an empty authority section. \vspace{-8pt}\subparagraph{Analysis:} Fixed in BIND9. \subsection{b8-ignore-tc-query - BIND 8 ignores the TC bit in queries} \label{b8-ignore-tc-query} BIND responds to queries that have the TC bit set. NSD gives FORMERR. \vspace{-8pt}\subparagraph{Analysis:} This is like the n-tcinquery (\ref{n-tcinquery}), except where BIND9 returns NXDOMAIN, BIND8 returns the query with qr bit set. This is fixed in BIND9. NSD is less liberal in accepting queries, it returns form error on queries with the TC bit set. \bibliographystyle{nlnetlabs} \bibliography{allbib} \end{document} nsd-3.2.16/doc/TODO0000664000175000017500000001326311743261554012625 0ustar matjematje$Id: TODO 3559 2012-04-17 12:34:52Z matje $ AUTOCONF - check/translate arguments to --with-facility ZONE COMPILER - unify dns type table (name, dns type, yacc token, rdata types) prettier? - unify dns class table (name, dns type, yacc token) prettier? - one db file per zone (as an option?) (featurecreep)? req by Alex (Bit). So that after rsync, zonec is fast with many zones. - if a zone is dropped from the config file, but not removed from the nsd.db. NSD refuses to start. Should skip/drop the zone. Redesign file format, so that you can skip a zone more easily, this also makes multiply db files easier. - profile the zonec compiling speed. Speed it up. Many people complain about this. - wireformat interop. testing for IPSECKEY type. - chown nsd nsd.db (Paul Wouters nsd-users mail) SERVER - make sure that we dont copy anything from the query we dont want to copy, like funny headers etc - From Aaron Hopkins: set O_NONBLOCK on all sockets. Now a udp raging herd of server can get woken up when a message arrives. One server handles the packet, the rest blocks on that socket and does not serve other sockets. - From Aaron Hopkins: write tcp length and tcp data in one write operation, instead of multiple calls to write. Avoids Nagle algo delay in this case. preallocate 2 bytes in front of buffer to put them into. - Test TCP performance (do a lot of AXFRs, different zone sizes, and compare time averages). - From Aaron Hopkins: after you do select calls, do multiple read calls per select. This polling improves performance in high-load situations. Speed test to prove that it does so. - Turn off TC bit on all error replies. - Bug #133: print empty statistic blocks. Not sure if the feature is wanted. - XFRD should throttle the number of notifys going out for a zone to x/minute. (even if updates are very often). - Option to only notify a batch of slaves (from loads) at a time, with timeout between. - Round robin selection to send notify to secondaries. So the last one on the notify list does not diverge. - xfrd NOTIFY timeouts exponential backoff. - query SOA before getting AXFR and then cutting it off, it causes an errlog on the master. - when verbose, print the ip adresses that cause network errors to the log. - the server reaps children every minute, this is bad for powersaving laptops. - Implement AXFR clarify, RFC 5936. SECURITY PURITY - some data is in network order some in host order, make it clear with prefixes prettier? - brush up the fuction and identifiers names - The XFRD zone state can be split up in expired/service-possible and in idle/zone-transfer-busy state flags. Is this more beautiful? - no more #ifdefs, remove them all, but keep configure options. - getflags on socket before setflags nonblocking. - exponential backoff for retries xfrd and notify. - conformance to RFC: NSD accepts TSIG before OPT in additional, but this is not legal, only TSIG after OPT is allowed. - Allow for username: uid:gid, next to uid.gid. - Log error when serial in xfrd.state is incosistent with that from nsd.db. NSD PATCH - -q(?) option: no output when no patch necessary - cleaner output on normal operation (don't mention memory) - patch on demand after a xfrd reload has occured (including checks for disk memory and a reload timeout (no more often than 15 minutes or so)?). CLEANUP - make so that startup sends SOA_INFO to xfrd just like reload does, prettier? - dlopen and dynlib checks can be removed from autoconf scripts. - If presentation format NSEC3 stays, put optout-iterations into one 4byte datatype, easier reading and printing, avoids ugly special cases. DOCUMENTATION - document what to do when adding (or removing) a config option (what changes have to be made in the code). OPTIMISATIONS - delete entire zone for AFXR during reload read in, now walks the tree, but could use a double linked list to speed up. - less memory churn in deleting RRs/adding RRs: keep rrset->capacity num. initial read in capacity==limit, if you want to add RRs, alloc capacity*2. - less memory churn in deleting rrsets : keep a linked list of deleted rrsets for reuse. Keep a list (based on buckets of size of the malloc) of rr arrays. Keep a list (based on buckets of size of malloc) of rdata arrays. Keep a list (buckets on size) of rdata_data allocs. For reuse, buckets on char size, because we know most are small anyway large ones can be discarded/churned. - Look for special purpose memory allocators for NSD. - compress dnames in ixfr queries (write_soa_buffer) (zone 2x, mname, rname). small gain, nasty code. - compress dnames in tsig records, keyname, algorithname. - compress names in packets by pointing to uncompressed_dname entries. After each DNAME(with uncompressed target) follows a CNAME that can be compressed in this way. - Do not give servfail during reload quit sync process. Only stop old server processes once the new ones are forked and answering for secondary zones (so when xfrd is done with sending zone state to all children). The brief double answers are preferable to brief SERVFAIL. - nsd manual programs contain identical functions that are written down multiple times. Do we need to introduce a util_programs.c or something? - reduce the memory leak on zone transfers (deleted domains are not removed from tree). - Options server: ip-address: and zone: outgoing-interface are pretty much the same. - Options to make NSD restrict AXFR response messages to a single RR (RFC5936) TESTS - tpkg test for bug 157: a valid NSID EDNS0 option generates FORMERR on nsd-3.0.5 - tpkg test for bug 163: unable to read nsd.db when chroot'ed - tpkg test for bug 164: chkconfig - Update tpkg long tests - tpkg test for bug 347: NSEC3 no data tests when requesting DS nsd-3.2.16/doc/TESTPLAN0000664000175000017500000003556110467037422013314 0ustar matjematjeTEST PLAN for NSD. By W.C.A. Wijngaards, July 2006, NLnetLabs. 1. Introduction --------------- NSD 3 contains far more features than a typical point release. These features need to be tested and checked to make sure they work well. This document describes a plan to test all the features that have been added to NSD. Regression testing is also very important. The old features must remain working. We have a set of tpkg packages to help with it. And also root-trace speed tests to regression test NSD. The feature tests are to be automated, using tpkg packages where possible. 2. Minor Features ----------------- Some minor features for the test: 2.1. DNAME ---------- DNAME support - there are already extensive DNAME tests. (closed). 2.2. NSEC3 ---------- NSEC3 support - use the perl automated nsec3 test - port to tpkg perhaps. Note NSEC3 hash length byte to be implemented, test against others. Test interoperability of that. A simple zone transfer with Bind. (experimental, no need to test any more). 2.3. NSID --------- Would make a nice nsid.tpkg package. NSID support - run NSD with different NSIDs and queries. a- test NSID with zero length, query with NSID. b- very long length, query with NSID c- 012345678 and query for different things. 1- query OK things. - query error 2- nxdomain, 3- loop, 4- nodata. 5- query error (bad queries, wrong zone) - is NSID present. d- NSID and TSIG. 1- query has OK TSIG 2- query has BAD TSIG 3- query for nxdomain 4- bad query, wrong zone e- configure NSID from config file? - is this possible f- test if NSID in NOTIFY responses. (should there?) ldns-notify and parse result packet for nsid. g- test if NSID in AXFR responses. (should there?) drill axfr and see if nsid in result packets. (experimental, so low priority). (need a way to send NSID enabled queries - no test). 3. Transfers ------------ For the transfers the test are to be done using - NSD as a master(AXFR) in 3.1, or a ldns-ixfr miniserver(IXFR) as a master in 3.2 that serves pre-made ixfr answers. The zone transfer tests can be put in one tpkg by using servers at different ports. The allow- lines are then for localhost, all ports (since the sending process uses ephemeral ports, all must be allowed). The request- lines contain the correct port numbers to send to. 3.1. AXFR --------- 3.1.1. AXFR features -------------------- Setup is a secondary zone which requests to a master. the master zone is updated. Then, the secondary should be informed with the notify: statements. And test if secondary got the same zone as master. By doing axfr from both servers and check if the same, and serial nr. Tests 3.1.1 can be one tpkg. (with serial numbers for SOA, to perform serial rollover). - secondary starts with a zone without content (soa=1) so the zone is only mentioned in the config, the zonefile is empty/nonexist on the slave. Master has a soa and three text records. - axfr an empty zone - only the SOA (soa=2) - axfr a zone with only little data. (soa=3) some NS, MX, A, AAAA records. [NOTE: apparantly, due to the linked list mgt in domains (of rrset*) the ordering of rrtypes for a domain is reversed after a zone transfer for NSD, i.e. for query type=any. Ordering within an rrset is preserved. Created fix to ordering, but is slow for many rr types... ] - old zone unsigned, new zone signed. (soa=4) sign with two KSKs and one ZSK. And a prepublished ZSK in the zone. ZSK1: Kexample.com.+005+44537 ZSK2: Kexample.com.+005+03824 (prepublish) KSK1: Kexample.com.+005+53988 KSK2: Kexample.com.+005+25320 (presign) - old zone signed, new zone unsigned. (soa=5) different zone contents, some names are still there, unchanged, some names are there RRs changed, some names there different RRtypes, and some names removed, some names added. www: unchanged (including nsec,rrsig). webmail: mail prio changed. printer: name removed. terms: different RR types, now A type. mail: type TXT added. apex: type DNSKEY, nsec, rrsig removed. newservice, ooo: new names - new zone with nsec3. (soa=6) iter=33 salt=AA44FF11 slave detects NSEC3 settings. - new parameters for nsec3. (soa=7) iter=1078 salt=00998877665544332211AADDCCFF slave detects NSEC3 settings. - new zone no longer uses nsec3. (soa=8) uses nsec. - axfr an empty zone (only the SOA) (soa=9 + a lot for serial wraparound) 2**31 = 2147483648 9 + 2**31 : 2147483657 also tested 9 + 2**31-3 -- works. notify and transfer, zone updated. 9 + 2**31-2 -- works. notify and transfer, zone updated. 9 + 2**31-1 -- notify works, but at transfer time 'serial old'. fixed: works, zone updated. 9 + 2**31 -- notify is ignored, 'serial old'. 9 + 2**31+1 -- notify is ignored, 'serial old'. - axfr wraparound zone, couple txts. (soa=2) serial=2 works after serial=9 + 2**31-2 before. These can be done in order. Test done for AXFR. RRset-type ordering preserve fixed. Serial rollover fixed. Serial printed as unsigned. 3.1.2. Huge xfr - see test tpkg for this. It works already. 3.1.3. AXFR and TSIG Like 3.1.1. but enable tsig. Tested, it works. 3.2. IXFR --------- 3.2.1. IXFR Features -------------------- Setup is a secondary with ldns-mini-ixfr server as a master. (ldns/examples/nsd-test/ldns-testns.c). The mini ixfr server responds with canned replies to a IXFR query. - secondary loaded with only the soa = 1. notified with 10. ixfr server responds with soa=1. (i.e. no update available). - same, ixfr server responds with soa=2, and TC (udp). on tcp connection, it responds with a simple difference package. SOA2 SOA1 SOA2 newTXTA newTXTB SOA2 adds a couple records. - to soa is 3, and this one removes the TXT records, makes a new TXTB record and a TXTC record. test that TXTA domain does not exist NXDOMAIN. test that TXTB is updated. test that TXTC exists. - from 3 to 5, with 4 in between. make a ixfr packet that is 3 .. 4 and 4 .. 5 concatenated without compression, so it means more work for processing. So, in the ixfr packet TXTB is removed from 3, added in 4, removed from 4, added in 5. Also in vs4 a txt5 record is added, which stays around. - from 5 to 7, but this time the redundant work is removed from ixfr packet. - 7 to 8, have one domain name where two RR types exist, A and DNAME. remove one RR type in IXFR then make sure the other type still exists. - 8 to 9, have a name with many different A records. Remove one A record from it. Add another A record to it. Test if the rest is there. [Note: when you delete on RR from an RRset, the ordering of the RRset changes, the contents of the rrset get shuffled (last put in empty slot).] 3.2.2. a huge ixfr. ------------------- create test for it. Should be several MBs worth or data removed, MBs of data that stays the same, and MBs that are added. To make sure that the code can handle multiple packet IXFRs, and the state memory between IXFR packets. - created testns version for multiple packet reply. Small, multiple packets. Test from 3.1. but using multiple packets: one RR per packet. This test also falls over from udp to tcp for ixfr. - This works. The Mbs in size is tested in huge axfr test already. 3.2.3. Test remove domain ------------------------- - is_existing = 0 used to remove a domain. Check and test carefully. - test delete middle name i.e. you have a zone with: c.example.com TXT "x" b.c.example.com TXT "x" a.b.c.example.com TXT "x" and you delete the b.c. record. The b.c becomes empty nonterminal. If you then delete a.b.c. TXT, the b.c becomes NXdomain. [- fixed delete with IXFR for empty nonterminals.] - test delete/add a domain and NXdomain/exist replies. - tested in 3.2.1 already, works. - test delet domain and wildcard replies. - Tested, it works, fix for IXFR that makes empty nonterminals. 3.3. Timouts ------------ Get zone to expire. Check it does not answer. Start only a secondary server, no master. Set expire timeout short. Timers set as refresh=1 retry=1 expire=10 minimum=10 Provide an update. Check it does answer again. Startup the master server after a while. Transfer should happen within the retry interval. Wait for zone to expire again. Check that. Provide old zone on the master, after expire the slave must transfer it. The above works, old zone is transferred and served. Test that the master says that serial number is OK, in 3.2.1 tests. This test also includes IXFR reply from the master that contains AXFR contents. 3.4. TSIG zone transfers ------------------------ Already TSIG tpkg tests, with transfers TSIG protected, so that is ok. TSIG notifies - test it, create test for it. - notify accepted, nsd->nsd notify by starting master and slave server with tsig keys for a zone, update zone at master. Done in 3.1.3. - notify refused. nsd->nsd notify same but use different secret at one server. Test done. 4. IPC -------- 4.1. deadlocks -------------- Have 100.000 zones, all with short SOA timeouts, expire=1 sec. refresh=10. Expire very quickly. This gives many messages from xfrd to server. Send notifies to the server in a loop from a shell script. Lots of messages the other way around. Provide a master server that will serve all the zones (and say they are ok). then proceed to send queries for the zones to the server and see if you get answers. Wait for an hour and try again. Result, the IPC works okay, but xfrd uses much memory, 16Kb for TSIG regions, per zone. With the 2.5 kb in xfrd almost 20 Kb per zone. For 2G for 100.000. A bit much memory, for the largely unused tsig regions. Fixed, tsig for xfrd uses no preallocated worst case memory use, but only a small footprint. During use this may grow; about 1 K per zone perhaps. About 2.5Kb per secondary zone in xfrd, below 1 Kb for a master zone, that works out for 100.000 secondary zones as 250 Mb for xfrd. Perhaps do also with 100 child servers for the NSD. see if it can keep up and the result if it cannot keep up sending to child servers. Since it has to send for each zone to each child a message, this will take more resources. Tested, it cannot keep up. Child servers operate using old zone status of expired/ok, also the machine load is 100%. Also fixed tsig.other_size to be checked when reading TSIG from network. Due to the length and size, more an incidental test, but can be tpkg-ed. 4.2. IPC FORKS -------------- Infinite loop of reloads on a server. Has 10 child servers. wait. See if it runs out of sockets, file descriptors, etc. incidental test. Tested, with adjusted source that repeats reloads. This puts strain on the reload ipc handshake code. And ipc socket code. It works fine. 5. Random mess test ------------------- Setup 7 servers. In master->intermed->slave, with multiple master(2), intermed(3) and slave(2) servers. TSIGs (different) for everyone. Perhaps also include never respond entries (fake address) in acls. - Load random SOA + random data in servers. Backup the setup so it is repeatable. Let them work out what version to run. - Provide updated zone for a master. See what happens. - Send notifies to the slave servers. - Send notifies to the intermed servers. - Send notifies to the master servers. - Kill some server. Start it again. - Kill some server & delete some file (ixfr.db or xfrd.status). - delete ixfr.db - delete xfrd.status - delete ixfr and xfrd files. - run nsdc patch on a server. - pretend an intemediary was offline for a long time with old zone files and old ixfr.db and xfrd.state(!!) files. and see what happens :-) It should refresh/expire and so based on timers in xfrd.state. Tested: - nsd returns formerr on IXFR queries because of data in NS section. But this is correct, fixed NSD, so it is no longer formerr, but refused / not authorised instead. (or whatever we put in axfr.c). - depending on which server they are asking, servers will use one of the master zones (after expiry time exceeded). If master updated, intermediaries, then slaves update themselves too. - NSD would not start with a corrupt diff file. Now logs error and ignores, fixes, the diff file. 6. Portability test ------------------- Port NSD to as many platforms as possible - local: sparc5(ok), alpha(ok), amd64/OpenBsd(jelte thuis), open=FreeBSD(ok), linuxes(ok), MacOsX(ok), Sunos4(ok). - sf compilefarm for more. - x86-linux2 has ip6 disabled. tests dont work with that. - minix3 if we can get it working (the minix3 setup fails somehow). - would be good to have a test set of tpkg (and tools required) to run after a port-test. A very portable set of tpkgs. OSTYPE: (g)make. autoreconf. (g)indent. -> defaults for * systems. dig 8.3 too old (format of output). Need 9+. however dig/bind is not portable enough. ldns: pcat, pcat-diff, pcat-print. xfr1,2:nsd-ldnsd. pcat-grep.pl manual: md5sum/md5. hping(sudo). long: ldns-testns. Made tests more portable, ran tests on linux, freebsd, Solaris. Full testset run on SPARC/SunOS2.5, and fixed two unaligned memory accesses, all tests succeed now. Full testset runs on Powerpc/MacOSX. 7. CODE REVIEW -------------- Code has already had 1x review by Wouter, some review by Miek. More review (again), Jelte, Wouter. - Do some spots of interest. - perhaps a full review as well. 8. todo-tests ideas ------------------- These would be nice as tpkgs, but perhaps manual tests are needed. 8.1. test combinations of configure options and shells ------------------------------------------------------ " run tests with different shells, aka ==-bug bash 1.1. is too old for [[ in tpkg and tests. Some hosts have awk that puts a space before .pre files in tpkg. Some hosts have bash in /usr/local/bin so tpkg fails on that. run tests with different configure options and combinations of them. Many tests fail with disable-ipv6. implement this in a xen-like environment so that different OSs can be checked. run this daily or only when subversion changes for each test, run our "test-suite" " 8.2. patch file remove ---------------------- rm patch file, check xfrd's behavoir. Refetches zones Checked in section transfer_axfr. 8.3. 64 bit ----------- GB 64 bit file size transfers. On alpha so nastiest alignment on 64bit machine. Do transfer of > 4 Gb zone. Needs lots of memory(swap space) and disk space. Not done; no host for test. 8.4. Valgrind ------------- run with valgrind - on two nsds. then do the nsd-nsd, and notify the master to get axfr to happen test, with tsig as well enabled. Done, found one uninit variable. 8.5. Chroot ----------- test chroot and the new files/directories. (And the file/dir not in chroot problem, and if all is OK that it works). Done, default locations for ixfr.db and xfrd.state have full pathnames. 8.6. nsdc --------- In temporary test setup above, test nsdc tool. works. Make sure that if nsdc patch breaks a zone transfer in progress it is reattempted later on. hard to test. 8.7. nsd-patch -------------- nsd-patch - run nsd patch and compare zone files, like AXFR/IXFR tests. Done test axfr run, or test-mess. 8.8. gcov --------- gcov to look at code coverage of the tests. Tests added to improve coverage. nsd-3.2.16/doc/differences.pdf0000664000175000017500000150764110522345635015113 0ustar matjematje%PDF-1.4 5 0 obj << /S /GoTo /D (section.1) >> endobj 8 0 obj (Introduction) endobj 9 0 obj << /S /GoTo /D (section.2) >> endobj 12 0 obj (Response differences between BIND 9.3.2 and NSD 3.0.0) endobj 13 0 obj << /S /GoTo /D (subsection.2.1) >> endobj 16 0 obj (Comparison of responses to root queries) endobj 17 0 obj << /S /GoTo /D (subsection.2.2) >> endobj 20 0 obj (Comparison of responses to NL TLD queries) endobj 21 0 obj << /S /GoTo /D (subsection.2.3) >> endobj 24 0 obj (Features) endobj 25 0 obj << /S /GoTo /D (subsubsection.2.3.1) >> endobj 28 0 obj (n-clrdobit - NSD clears DO bit in response) endobj 29 0 obj << /S /GoTo /D (subsubsection.2.3.2) >> endobj 32 0 obj (n-clrcdbit - NSD clears CD bit in response) endobj 33 0 obj << /S /GoTo /D (subsubsection.2.3.3) >> endobj 36 0 obj (b-class0 - CLASS0 formerr in BIND) endobj 37 0 obj << /S /GoTo /D (subsubsection.2.3.4) >> endobj 40 0 obj (n-tcinquery - TC bit in query is formerr for NSD) endobj 41 0 obj << /S /GoTo /D (subsubsection.2.3.5) >> endobj 44 0 obj (b-soattl - BIND sets SOA TTL in authority section to 0 for SOA queries) endobj 45 0 obj << /S /GoTo /D (subsubsection.2.3.6) >> endobj 48 0 obj (b-classany-nxdomain - BIND gives an auth answer for class ANY nxdomain) endobj 49 0 obj << /S /GoTo /D (subsubsection.2.3.7) >> endobj 52 0 obj (b-badquery-badanswer - BIND replies with bad answer for some bad queries) endobj 53 0 obj << /S /GoTo /D (subsection.2.4) >> endobj 56 0 obj (Functionality Differences) endobj 57 0 obj << /S /GoTo /D (subsubsection.2.4.1) >> endobj 60 0 obj (d-notify - different NOTIFY errors) endobj 61 0 obj << /S /GoTo /D (subsubsection.2.4.2) >> endobj 64 0 obj (n-update - NSD does not implement dynamic update) endobj 65 0 obj << /S /GoTo /D (subsubsection.2.4.3) >> endobj 68 0 obj (b-mailb - BIND does not implement MAILB) endobj 69 0 obj << /S /GoTo /D (subsubsection.2.4.4) >> endobj 72 0 obj (d-version - BIND returns servfail on version.server queries) endobj 73 0 obj << /S /GoTo /D (subsubsection.2.4.5) >> endobj 76 0 obj (d-additional - Different additional section on truncated answers) endobj 77 0 obj << /S /GoTo /D (subsubsection.2.4.6) >> endobj 80 0 obj (d-refusedquery - BIND includes query section in REFUSED answers) endobj 81 0 obj << /S /GoTo /D (subsubsection.2.4.7) >> endobj 84 0 obj (d-hostname - BIND adds a NS record for hostname.bind) endobj 85 0 obj << /S /GoTo /D (subsubsection.2.4.8) >> endobj 88 0 obj (n-ixfr-notimpl - NSD does not implement IXFR) endobj 89 0 obj << /S /GoTo /D (subsubsection.2.4.9) >> endobj 92 0 obj (d-formerrquery - BIND includes query section in FORMERR answers) endobj 93 0 obj << /S /GoTo /D (subsubsection.2.4.10) >> endobj 96 0 obj (d-badqueryflags - BIND includes query section in FORMERR answers) endobj 97 0 obj << /S /GoTo /D (subsubsection.2.4.11) >> endobj 100 0 obj (d-unknown-class - BIND includes query section in answers to unknown class) endobj 101 0 obj << /S /GoTo /D (subsubsection.2.4.12) >> endobj 104 0 obj (d-unknown-opcode - NSD returns NOTIMPL for unknown opcode) endobj 105 0 obj << /S /GoTo /D (subsubsection.2.4.13) >> endobj 108 0 obj (b-upwards-ref - BIND returns root delegation) endobj 109 0 obj << /S /GoTo /D (subsubsection.2.4.14) >> endobj 112 0 obj (b-noglue-nsquery - BIND returns no glue for NS queries) endobj 113 0 obj << /S /GoTo /D (subsubsection.2.4.15) >> endobj 116 0 obj (d-noquestion - different error on no question) endobj 117 0 obj << /S /GoTo /D (subsubsection.2.4.16) >> endobj 120 0 obj (b-uchar - BIND returns FORMERR on strange characters) endobj 121 0 obj << /S /GoTo /D (section.3) >> endobj 124 0 obj (Response differences between NSD 2.3.6 and NSD 3.0.0) endobj 125 0 obj << /S /GoTo /D (subsection.3.1) >> endobj 128 0 obj (Comparison of responses in root trace) endobj 129 0 obj << /S /GoTo /D (subsection.3.2) >> endobj 132 0 obj (Comparison of responses in NL TLD trace) endobj 133 0 obj << /S /GoTo /D (subsection.3.3) >> endobj 136 0 obj (Version number - version.bind and version.server) endobj 137 0 obj << /S /GoTo /D (subsection.3.4) >> endobj 140 0 obj (n-notify - notify not implemented in NSD 2) endobj 141 0 obj << /S /GoTo /D (subsection.3.5) >> endobj 144 0 obj (n-ixfr - IXFR error FORMERR in NSD 2) endobj 145 0 obj << /S /GoTo /D (section.4) >> endobj 148 0 obj (Response differences between BIND 8 and NSD 3.0.0) endobj 149 0 obj << /S /GoTo /D (subsection.4.1) >> endobj 152 0 obj (Comparison of responses in root trace) endobj 153 0 obj << /S /GoTo /D (subsection.4.2) >> endobj 156 0 obj (Comparison of responses in NL TLD trace) endobj 157 0 obj << /S /GoTo /D (subsection.4.3) >> endobj 160 0 obj (b8-nodata-ttlminup - BIND 8 uses minimum TTL from SOA also if bigger) endobj 161 0 obj << /S /GoTo /D (subsection.4.4) >> endobj 164 0 obj (b8-badquery-ignored - BIND 8 replies normally for some bad queries) endobj 165 0 obj << /S /GoTo /D (subsection.4.5) >> endobj 168 0 obj (b8-badedns0 - BIND 8 ignores bad EDNS0 queries) endobj 169 0 obj << /S /GoTo /D (subsection.4.6) >> endobj 172 0 obj (b8-auth-any - BIND 8 includes an authority section on queries for ANY .) endobj 173 0 obj << /S /GoTo /D (subsection.4.7) >> endobj 176 0 obj (b8-ignore-tc-query - BIND 8 ignores the TC bit in queries) endobj 177 0 obj << /S /GoTo /D [178 0 R /Fit ] >> endobj 181 0 obj << /Length 1182 /Filter /FlateDecode >> stream xÚ¥VYoÜ6~ׯУD ïÃO©±MaÃ0àîšäa9Q •Ö’Ö®ûë;CRZ5QÁ+’3œ{¾!K)üXÊ(%Bj™- çT¥ûcBÓ/@ü#a‘©°œh¦X* ÕÒ"Kú”Rb´g˜pþ4]ŠooŽ,]µÉC’>L4PH˜²&-.P*-#Ö¥ÅܲëMòö=²!œ)™ng0E$a›ÃÇìϲ?å… YÛô%,´ÉVÕ'ÊDÎ2س¬+›}Ù#Eg;øÀñÿ þ•e“ÞÜ‚Ó„;„Þ¯ñæ*ˆÛ6‡°h‡¯eUÜ#Ã:lÖe÷\v= ›!ÔŒ8¥8ÚÌ9qL‚ÌI¹ðÒo½]õ€ærÝân æ6¸èƒE È¥†8CÊQŽ(a”D+½”O”Š%•c=q½ ,BÍY äD`&½¯w^/Å[s‡–ì¼%KÒ ­‰àHÁ £ êe|È9„.žñ‡Ç@Áá‡êÛèÙXl·ÈÙÁê0W1wÕ b•“sW_ÅOó“~2 FuÞŠ‚qA7:js£/@ÈìÝÙåxßïm^p›íÏGŸÞ&Ç@x §T”ÊÅqPûÂñÑÈö¹<î¼ Añ7ñKA"Õ($ù}3uÏÔšƒ$°:4çÇÏ4=@«Ý&@vV¥/ ö/s ê˜è8%!Xñ¤NÖÉì¡ Ž.ÿº$¦!ˆVCoKý/ļÿÀ®1¡ÀT@]¡ì€à’®f°éȆ‘ûm×綠übNá¢äUŠ(*Cél¾Â… ³¨dÖ´¾-•‚Òï=Œ SÌLämw}@˜çòNðN¬4<¡Â<µj·›$Ÿ¼¼¶ UÄ&ÉQÏ€Íò’ãÒSãýûõ*,†#HÀý€BëºÂy#‡ zʶ~ý§< O‚ØH©ÐðaÒÔž"dxP«êj@¯÷”s—uí®.c1 1&)lÛ³7‚ü/º0˜dZ›¥ùMSN”£?ŒSfI-±4>.†›%NkÿnPaˆã0Wh@ñoe=Í)\¼kê¦OÍF¨Ùô#¡¤ÿ†bg0ñ ¸2q‚º‚ª°§îJÙ+iþ Œð”ã>´Ö¾ c|^Îü£ô/Y<‡endstream endobj 178 0 obj << /Type /Page /Contents 181 0 R /Resources 180 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 215 0 R /Annots [ 190 0 R 197 0 R 204 0 R 208 0 R ] >> endobj 179 0 obj << /Type /XObject /Subtype /Form /FormType 1 /PTEX.FileName (/home/wouter/texmf/tex/latex/LogoInGradientBar2.pdf) /PTEX.PageNumber 1 /PTEX.InfoDict 216 0 R /Matrix [1.00000000 0.00000000 0.00000000 1.00000000 0.00000000 0.00000000] /BBox [0.00000000 0.00000000 703.00000000 64.00000000] /Resources << /ProcSet [ /PDF /ImageC ] /ExtGState << /R7 217 0 R >>/XObject << /R8 218 0 R >>>> /Length 219 0 R /Filter /FlateDecode >> stream xœm˜[ne» DÿÏ(ö¢èMé?H~2¹ `'èdþ@VQÚ÷ñmàÚ¢õ$‹ÅâþuÄŽ¨ûçÇ×ëϳãÿ½~½âQj iÎã륿}¾,¦júöû9çóõ÷ã߯_ö´æh} 9¦ãO1´sÓ/uÎ:Ó:hùÏë¯üûåè˜^¦ožçóWøO?€‹–RØS[¶Ñø[(3Çyü÷W:þõê©öí(c„Î=¾^=Ú å¶|¾Úl1Ä|´l,~Zs†µÐÛ–^Fˆ©ûªšCy8*ép†o|Zsöß-÷Qÿxñx ==Ÿ‘ãueá5ìL21ëVràUUÄR*ãšüïÅB®mk)tvÅyN·žÃ(Gå|¹¬9Lα¬8îCXÔ–,„gúÀ¸GGî矼0»8ªå[ʼnTÓ¸”`œÄÈEæ´Nu—¡­Xa#/Žb…@fdR»†ZÀDåžœMã¹¢ÆÿÂä.Â4¹_âJîUc[†LÚû!ŠèB@ówæ\|E=óR.¯Ä ò\Ÿpà œ|ŠîìÓÂc¢&¬ ZjĽ]G(e)¾`]¢Q4ZRtIf´øÓz…òŸ#‰œ¿[ï„B,®k»Ê=9JgÞè4ÎE÷Œ×i1ˆ[S4!DñLÐ(€oƒÌQ´¸ï¨çBañè J ÜæD€e§%ô eñ@qÌlh›9L?ÞÀ®rÆÅÒò^wòûº,âŸ)"1åK_T•òB‰nçm‡G¨’•|ïkE9ßL09ÇZAxg}Ìàu ‰vp`ÔÏHݓלkýQ—È×%ùýŸÏøx{˜²2{R`ʼnüü’…Èa€Ÿ¦dÒ0‡É-Ê—Íñ=§gÀÄ­zÊD¶Oy÷Α>»þÌ™)ì<’jpV… òlva—–¥m2PjwCrüdÁoJ,øŠkóù^î’´Ï»åænÞ_œ5ß-÷Yçª7K%Îqäojou?À‰$vkWÆÙblžR³+ûÈs/Û ½æÖº¼À¯iL!kQ°¡H½XŸª¦ñ¦Ì)»†Z§ÞwIHTÈš8¡P뢮7p0®J%êz&=aJ|,J"‰xàiù¼,M…îVa”:µ,A"Ø~ž¿î})RÍÀÊ‘Dþ~öã¹ô>Ïq™•ÎAÉpTcP¢qsaµÇ*¶"£ÇøZU_©úÖã 0'ûûµ½Öº$“Ë«Âã%2‚’’F‘!eÈ8ŠË¨^žD”Ð"¿ʵT%ñ~ë:5ŽC´î,1À5ϱë2®™3Câñ¼7¡EeQ9b«,xyÞ3\Û½C3ýy„¨Z¾'+@2ô*d}¯hk8Žmá8¯O*U 8»ª’¬B¾‹f€·}¡ñŽT÷ËbÞ¢è v «Ý©Í€€µÍâT§$± §‹ê*©ÁRR)Õx¸\M¢-¹±!€l,ž–¶hêa»È9µB Ÿ‰Õ«~¹†º"…ZwOJÆ·  µ¢g$enêr¶-׸…>(¬¶CÉM²4¤$Y…eðQV jË]8cÖUµåžQŒ¨_tZ’É<ä|ÒˆÄ>,šUœ0T’ “ì^F[wñŸ%“–t'ò¦Ôñ”ÔOñ,ª…¨Œq÷ñ¸*Oƒâeq¦×–+»ügÇ÷äüPIÝ®&ŠCùôu;?/_¹B*‰‰}ñw.ð“ëwEYÀ¡ê%á»áÈœ^”=>>qxSÏQž³¡»ÆªG»®lKSéu š÷0`RVw)q0@íKZ jHE„-ïÓ%D<=ýÌ/Òâ{ÁêšÑÈÎ&Q Æ[>~÷͇wy4ÄêA®¤Žz™¹nK†‚¨1®Êé1Š QV¤] ô:Æ®ý‰-³ìh¼&àðáà\rÈ 8ÕÎÒÝ{&ÉÅ7dj–²ÅeLj;Ï1“bã+–…C;¨&ÙºT½Z:Õ B¶HјŠë“ªž.aôªù¦#½i–'a™ÚÁkR(ƒHµ:Ûà&¢ê¤wcÅÊ (ѺZSRJ9HŸi :_¸?ÞÂá*q»?‘xâŽèr÷|X/è¿=_‘®Ù\ì’î{—ñ{¹ÛÔw“ë&á ‚ùËv´{ 0iÁô›ª`»»÷8Á×ÛBvV—l \V7¡of^t”ÛJf­èÞW‰ÊPK³>\4hÅûƒ(ÕÔ“ª}(c1Êj/ž¾sÄH¹«N“¤“?·Ån©0 Z]™9žÏÆJJÞ]hª$£ i‹ûê ¦žíîŒY½Ö¤Î$¯L¾eŸ$¡>¹ä«¬C.‰®ìN á¬Uĥђ>ÐœmMÕשàÕ«ßäÂjc°J†žc‰¹Uü¶ÁΘNZ(øÀôÙ§zy#¯ üˆÅk}§Ää0`87+ù3D“)¬®~¦ *Ñ•Ÿš»¸™šÚ!©ÎU’õ¥d(èÊcé5e©)…àf÷Ø[̽bY¦H[‰,-§ Ž,Ru9_o¦>6Q§‹Kª™³òòâ}³«ß*Ÿ|ócüß’W>éSZO§ÌFqt׫Ëâui‘äi•ì²(V2¾êÅÐÔ”žcªoù1C¥ZžûÜ»It'õGûžYÚ1Íì‡â}oÜÒØÍá5NçW—Ó¢ÂäÀeI*ó†˜!‡ï)Û‹§K+,®Ó× ¹Aó´ã ®UÙÇÖÓqÜ$IþFÏœÉíáH!¢-åïßÞä•WcÂ]$ŽäÊeѦú^矕 _ÑÇ ïµúª7VË;A,5¹éúÖû—ú`îY½{0÷,Þ!Ý3Ø /Í-æž­\–W–¥TfôO^ºŠ«§1†+6HÒ?;ýF""}Æþ? yˆendstream endobj 216 0 obj << /Producer (AFPL Ghostscript 8.51) /CreationDate (D:20060104161305) /ModDate (D:20060104161305) /Title (LogoInGradientBar2.eps) /Creator (Adobe Illustrator\(R\) X) /Author (Bert) >> endobj 217 0 obj << /Type /ExtGState /OPM 1 >> endobj 218 0 obj << /Subtype /Image /ColorSpace /DeviceRGB /Width 2921 /Height 143 /BitsPerComponent 8 /Filter /FlateDecode /DecodeParms << /Predictor 15 /Columns 2921 /Colors 3 >> /Length 203322 >> stream xœì½‡Ç•çÛ÷"çœ"ƒ9G1ˆT¢¤‘eËr’wïóy;o÷íìììzfvdkd[–,Ù%R"ÅœI0€$ˆD rîûUîsOW7/ ‘6Ë3ÔEߺuª«O:UõíS¡h4j}‘uÿ7„ÿùfņBó扊¢B ¾Ùæ¢s,2A•åSJâlHá„ð|EÍEY\ÈWâ\TfE©^ȃä+qfn–ÿL G|%ÎÌÍ°Äp(Á·b³s¨Õ5î.!!ä›mfvFgŠRå‘Ç[]«˜DÜbbBØÛþ¨ùìܬ-Q·ƒ·þønzvZ·ILˆ$„Þ¦@ͧUÅætå-´UbB¢W"ò@âœ]”jÓ¤p¢÷!9£Ns¥$&û6²ÍÚU哽ZqãÓ“ügFrš·(¤©™é©ÙiúŒ»KMLñæAs!Ïìì¬å¨ *æ½GHšà?³RÒ½E¡¡& ¯Ÿ#bJ$ÙÛªHƒã#ü9=95â«89f9]('5Ó›Í5139£7êŒVÅ=úJ¼?6ÄŸ3“Ó"^•ˆFѤü¸uå“’">ÏqhbzHŸS“}[©t͚˷AÜЄÝÈ•’á[ÔàÄrêZZiI)ø?oT~rz’º-"jîÕ ÜãÈä˜RW}ˆÊ'{îú0:5>=£$¢U¡Ì(Ê·Uï÷óç¢ÌH¤ÏÙ©Ù~ý-?:9N6'ƒ“”’£ZÕ¥9ˆÎ($&¢wø>îî¡{h|ý1ŠrrÒ²ü$Ž OŽÑs„IKJÍOÏöÞcßèà„’¨T:919;%Ã÷;{'»š›–•ë'©ùÞÙ˲‹Rý,9•mNj$¹,§È›+1>­ì*Z)5)¹83ß;ð!4‡I}ároQ¸Çîá¾ñ© Œ·Jbb Ú!Õc(Ðýï ³DX’’,‰cSwbšÓPTå•%D÷GN2˜(ÊWÁ M1¦ÇÕƒT¶ü°ŸÄÛ÷»øÏ•ÅÕ^‰Hè÷œÞ¢*óÊ|³]ín¡h´Ê¼Rßgî«¿“ÿ\]Rë[T[_'rÒçÂŒ\_+‡t¥ë&®Ê/ŸObk_‡]-ËZ[Vç[Të½;#ŽDˆƒJøf»ÔÙÄŸkò—Á®08vÝ°û#2 þÞ!JØ9xÝÖÒNBzRZYN¡¯‰¾Ðq?×TÌ×g»‡úè32ÔVøVþfïí=¸[ÚŒûZò®¡{ƒãÃäç ‹Áà”z²ÁöÞêï™ÄˆÙú»n;Cmvjúº²o(ó­û]äúb¨Â »êu}¡Ï}£ÔÓ“aÆs¼V÷íB4†¢kÀÊùzÈ:n 9ä(§ÊÏ`Þìmï¹?¡› =«òÍl‘m@ITc(dÕ.÷µçï\C6ú¼qÙJßZ5õÞ†ºÒP‹B „¹%FôÖ–¾Ž±!ºG”ÓPTé•+þ8¢;f.¹©™õ~­Š±ølûUþó¹;¼µBj¹w§µƒ»j/Ußg '¡ý~×°6&˜àeä"›wB‰§o_á?_Xù”¯Däa?åÀ®úfûíÕÏùóÖÊ5yi>úŒqöÔ-[b^ZֶʵÞ<ã×zZÉ‹F+¡_¬,®ñu`>h<ÊŸ·W®õö 8ƒÐ;H%P¥Êü2ïh… xÜŽÄzк²z_÷ø×W>ãÏ´f¯7$^ì¸Ñ768£gC¨R}a¥×ß³”]º—>#4Ç›½ìxëE6&_Yû´7¥Ž6Ð5žªÞà̓QºŠ¡7p½ 2²×”ÖyïNB×à=ò¾`— ó¾ †®}ýnKÜ]³Ñ›:ßÜÛNæ FÙ¼­Šæ³FÝhP€©¬)¬XîéhHȆÿ£Ï\æó¾~qácú€FÛ[»©Àoà@¿þ¬ù,ÿùõ ÏyóÀ"]èl"GuF9«‹«½ 8 0†ƒÚ˜àái¯/÷±«ð ?½y†>cdyºn‹7,ÒÅŽëw‰…é¹–­ðŽ/Mwo·õw²Äòì"d3ò UOÞºÜ;ÒOSrH¬/ªDNO­ú¯t5÷;3ò¶W­õU Œ³d0aâ0ÔBs¼õ¿Üu¥9÷˜÷lÃ6oxãÈÖ«§ä×qGÕ:ï¬f9Y"Fv_GôrgÓeíÓFµú\ƒÁ„“]¥E4&²m^¾Êë:ö ÷¼~‚ÿüW[ÿÈ[Æ»3íÈI­Š¢à}ùο~xê=þüüʾî1ÊùðÚqþó{Û^ñæÕ…1龉‰ ŒAÐ.¯Äæ{íW»[ÉDc8®È-ÝPÞàsC}¿½f›h´ØŸnÕ+±lèԭ˴Љ6<=h—×’7v·4+ƒ©$f$§BâÆe+¼ѯc Ñ⬂—VíöJ´´GNúŒr0"{ó4v5+@™è(FX8BÐ#|Tôk˜qò¢Ñ\kJj—ç™.†ãsí׺‡z-=µ/É.ØYµÞ×Oøþ±ŸóçýÔ×}+]=wǵ!ñ•5>&ºk°Ùºô=BbivÁ¾º­Þ˜z̆úõ €ŽÐf?÷J¨ü=*ÀSõà©^îj‚ܨö^à^îªÞè•øyë8¢Ô\¤àìÁDy0Aø¼å<< ZÁ€DX{s¯Ð¿?ò3þüêºýežù \úÓ·/Câ°-1gEqÕz?GN{&[—¯ÙV¹Æ›Ãj1¢©9NzuAùÖåk½K…ƒwyñþóßïýŽ·(K4A‹Á-Ùîç™ ýŸþ„?¿¶þÙrÏš \z(!„ÂÁŸÊ>—¯ðC~á Ï_ n»GŸ)ý§Ã?âϯox®Ü3ÍÄ®Ç34®%æ¡ÕúIü—ó²DtŸUë½y0]j¾w‡>Œz(g§o¶Ö‹'œ‰ªôÍM/xóÀö"þµôtoYNÉUOy—_0]‚£ÅB%±ÂëÀ`ÚuèÆé;Ý“Z 1" æ_^¡?=û’ˆô­M¼N;Ò¡¦S¸1ã‹j‰ζT¬òfƒÚ£nô²¾³ù%o¤ÿûà?óçïl~Ñ+èhËy-qêU˜™·—ûtmdƒPú¼«f£¯[…ô}ôüù-/{ý%H<Òr®©ç6MW1Tm]¾z­§kcX<Ò|³BäÇsA9{j7{—`p0²C%BV(+5½®`ùÎêõÞçÕúÅEå}…´~mý³¾•÷ò§dí‘mSŪÍ~-ô?O¼C;—úª§¼c(F¨síWὨ™o(T”‘ÚÛ¡WW»[ÈJÀödÀ mð.†À…îêS}6d¥%¦`´Z]RcäK©ëæ}Ì&¢s!½ú ]õǘ¶öuN(ï³ L÷V”T{§{˜eÃDëê6wù=k<¸—¨ÕlÌPVJ:ì‰w•ž%̸Ú`JH€Á÷®«Xjº:N3GK·ª¯OO~š”æãh(´¼ï.fLº•`¼4½Š><65ŽÙ1²%E’P1ß]94ï1e§føî1a‚ v|fgB´ó•ˆÒÒ½»!Ð 8B¼9ßZ($NÏÍP&̆|Ç0ÞMÌØ+5%’ä»™;f¯…ª¯|oÐÒ+ä´gi=ôݶƒ‚Íð.m‚Ú+ôÝ1¡l´ùŸ 7¿¼yhÜÞáWÙ ¾{÷ö¶Nóm£ÓÆ}ȾÉ%PÊæ DuÝø‹8JáÒ|³ý!§Pœìˆ5O³>¦ìȬÍpÈz©ðêýb±#ª¯ÎÍq—Á|@ÖôìlÔ2³¡49$  Þ°·¨ÿÅLÞéÔìÌœ¨9K„må;œS§ç<ºÑ&LV~Ú/bEi3Í1LNO˧CÉ—ùXÁ·S†Ä¨ÒÀ”¤$ãi.;‚áÓÎ ʃœ† [AsOMD-³U1ìymô¢°#¨9Áèã!Uùd¯ÅfGð1öÏz4ƒwédG†»Ó’‹VE£qGC{Ìzt· õgbzrˆv¼D»¢¸ÞV fGÐJýcC^#Œ¹¨÷…A+õ z$F³Ü¬š‹öfdJHç¥eñc‚}€O,Ç~* ÝV.÷ Ýœ5$F•ïë½ÇEaGàä ŽÏ9à [ó¼ôl¯®³#P LZ¦\÷¨ŠJW†¹~± ;‚æqµªÍî`:Ǹw¸_9^îßâqx$.ÈŽô8{¥2¡Ï–f°Á„Î ›3œE-G¯³S2¼÷¸”ìæ$÷F¸V”PmÌЌǴ ;‚çrgஆ\SwÙh½#ý˜o¿…ÄŠÜbCâ‚ì2tØ] ]ºÁÂ> wÏ] Ó¡Ä'ì¥EaG02âîÔàîný‚Œ\¹ì•&‚ªW¡*¯Ìk—ŒÁ@Ü⬺ʄkòËÙÏD¿hº{‹&ò.a3½iQØ‘á‰Ñæ{í³nŸ6ªžx™×|³#¸ÇëwÛb>•s9i™Þ¾ ;ÒÒwÇ1&±„‚¢¸kÃJ4õÞ›œp ´1ß. ;‰h¯‰V‹˜B1`—nö¶yð”WWy=¢`v]ìZw+Sœð¸«óË‹ ²#W{ZúGcþ ¹èÚëÊë —uAvO®„BÖ—5pÏÅ ÕØÝlûÆöMFu™«KkY"ÔøbdzŠ.é]Ý fGPÈ…;×½ £­Ü4ÅP…¶’c(%è¡× fGPȹökŽÄXQPB¹³206û6í¹ÇU%5 ƒï²7ÆbEÁCÛ¼l•1½Z,väJws×`oìo-ŠõËV¤z$>jìHÇà]]·Å˜J/ÈŽÀ¢žk±¨’¸«f£¤i×+qýV–Ëv¨é”gV¨|r¹+·ä<9KbI…<Ó°í! 9Ò|cŸQTaFÞžÚMÆ=.ÈŽ@KaW‹(äÙ†í<€7øñõ“lœ9eæî©ÝlÌîdG`N¡¨ÆÅô¤”½u[ŒyÓ‚ì2à ­Š1멪 ^ ¼(ì¼8¨DL¢~Lh.˜Vi¡îQ[åÃÝí¯ßfx¿ ²#ã,r{v +-}¡oœ4rKóWï6Ðb±#_?A®‹\Æpðòê=¼/èà^?“&I™@EO´]²D9tÏ­Üéž…í=ÖzѸ‰¯¬}š™Â©™é¯Ó~‚Ëd–fbP6ö™dG`—x åâ  /®ÚÅë ø«Ë‡ú„ëH ƒãU»øOX›ß\=*î(A»VWƒÙLL>¸z”6qe¼㙆íÆÅÙ‘oœðvmÜT˜Å,%;‚‘å½Æψ‰¥¨µ¡|ÅÞºÍFQ‹ÂŽ`dyïʧ$Q®ð¡yG™`vS’_]>,)á_]»ÏX~Y©?|ó´q19’øÍMxDƒÄw.bÔƒ¦r_]·Ÿ%búÙÙßNz”p_ýV¯ŸÌŽ@"2ðê%7X]AÅ×Ö?cµ(ì$þä̱1Ô1au…Ë¿¾Á¤+…Áììçªuo·ûµ¶¬Nº¬˜¼`È3æ¡hsÌ;ä4çýÆ#ÖŒƒþ‡'ˆn¸ÇKÉŽ`>nljÜÞÀr¶àEËánÕ™Ûü=ÕcèŽÊõ¶%Ä{êö•~e—D&MNk°ÕvrÐÅNÞºL‹CΆâJ9+ÇÈxSA¼§¡þ ‡aŒáxAvdtjüjwë¬-ÑΆ—ç•ÈÖhè&üWÔËJ'V,3¦{ ²#xç~ý":߀× å’)¥`v…t õNÍÌp!Ô²êż sákAvd`|H/Ñ8-¡ÿ“NÌMÍ4¶t‹á·vmiº5ô{k©ÆFçb±#“ŠSì…®œBC"ÉÆŽû‚ìˆÞ‰žýÊù„Y­—¶yÙ‘Øî˜øò >b¤E`G,¿f}Ù‘¹X!.v$êÄù0$ÆÏŽ@œ*Äï ¨8a;³Žôµüò%:\êcBÎÐb°!»>³3*~†OQaÁ…Àl©P(~w÷‹%ê÷ð|rá)¥D’¹òÞu®¼ç5  vǦÍEv’‰†ý]v…Ä$ºo4¬Þà73³##“£^‡«ghcüìškhrÔ·ƒ£¹²’ÓŽÌŽƒYLŠÞ*0pûG™˜ž™tM¨XnJ$‰'{ãÃóéjNjñ=ûÇÄâF,A¼{íÁìHŸóJ¢7ab±V^YväîHÿ¬V£;SE …xçØ” –„·ýø{/'%ƒ£ô ÷ÍzHjº’¬|Ã$ÆÏŽ ‹uõÆ:š`G`ÆK³ ŽÌŽ@Ey—ÚUu½R`ì³#p=­jE¯2;…Ü£÷›½ý¶$3ß0‰ÁìÈÈä˜l(™ ‘§Ð]ª6•®ŸÒ¬BÃ)_2v=ñV?£pÄØá[iíïtöTLx¯*¿œ,ÆAÌu»z‰)î·LdGZúîLÏøwíš‚e,Q«Ÿ†3vjŸ°#œ…i¾×nWÛÓúx@d]ao¯u·ßRvL™V•˜`ÉØ‘.UÈ=ß"'/C£ÍyÔ6îrmi1\vmîõHôº²zÃOfGZõ{êr7‹Su~™±-ÌŽ éXÞÛÑ™ÓVÛ[¹š/¹ï;ÉJ±@…iìj2–zá«Kk)3ܼ³íW½Ø®¥½ÐÍ« ç0˜¹ÜyÓ»Aëd®3Öh‚Ù˜#«r/Ï-1Þ¸ fG0ä¾uyžG¯¤ßR…86Ðí„AÛº“m—&

Rì&ŒÎ»Ù®p`ž®Ûj\ fGN¶]ÆLÁø •»£re†ßr¨ÉÜá`‰ûëÍýï`vä“'åœW¦g¶³°%cGPÈçΈJ¢i‘yW»%LÙ7-[i숳#÷ ±åœÇÑS “—ݵ›è3´ÝW¢¥7Œ‘%cGà÷~põ¨ï<NãK«v“ëÈÛÞK¸u¹k³3˜›¿ñWÛŸà@²š5ݽ-Ý™ê +68[&‡šNÍ7éØ_¿µP/ÜÃïŠi²{´…DV³+1,‰}$˜úMãç–_‚ù}qµM`¼»,ÜT‘¢ð—Œ7§ƒÙLü%"‹R™Wì”—‚Ùx¡ï_92jÎC•‚'&D^Yó´áÙÆÏŽ@âÏ/t)¡ó˜ ~_ßømÀ…þ¼å‚åJv>Xic;*˜Ä·Ït¿¦eÿ²^ßô¼-±·ýº¶_‚Ä=Nצ´(ì<´“·.‹ źˆäBЃæsÈ_^½‡Fmx×?=û[ç²Ë8a"ðíÍ/?ŒŸ…ÿÅ…ƒ¾n ×˃Bœ¡ßÌ Kh8ùÁìH×`ï»—?å¢dqÈüêÚ}ôVBÎ#d‚• Ù4æoÿPMün}Ę/³#ŸÜ8uý®ÿà™úí‰ÌŽ\ëiûä†o׶Pγn;°”ìˆÂAMö‚Zïë ûðdŽ›yûÂG\ˆ±ŠñúÆçŒ9Q0;‚‰’ƒU™ ™è#Áì ieÊJIç®t¼õ±6«¢qìÆüÏßžgŽfý宯º`v#{£Ñäh»¿a›}dQØØ%¹ð"Mì’±À²(ìFv{ õ¬ù— 1trfêï>û©÷KO÷þfï·iåÀ83-Áì.`v|À=_XJvƒõÝ‘þo}2Ì ±“£Ýª£|ÝŠa!jÇ„';peoôÞ²K™ðo]Ñr^Éü¼õüðĘåP¼Žÿ¡wd&+K81= OÛU!§ÌÔH²ÑÁdG0s´ƒŽ³TGæú²ZÉžÕ•ga1à##9ÝXÚZiê½Íà», ÿð’©Ìì|ëÃŽô÷L ÒÃâg…)€£ `GЪΖŠ‹Áÿ§D’ŒðEaGÐ/Œ·‰¸5à™…QG+¸Wíxo0œIr·|0;¢w¢g,É]ˆèÞ=¾Gqm˜º¿|‚Èô„‰%Á‚DI U~qþ²(ìˆæ$b‡ãXníG™¨C€8›^úÖä"2´gœS6,§wÉýÚˆŽP‚?'FKŸ/ƒœ²´d u ;Õ}‡$FchؘÒÇÐð¦lB(,wÁQ+-1:15)«! OIJ–4˜ç{¤ HªeœÒQy¦m¬EbGÆ”ÁµÛ'Ár$: F<ìŠûÄŽ`<`W ·ŒÚâO^Ý¢³QdþøÙ4/g«3G‰r=ð¾ÈŸ vÚ5,Þ¨Às™¶Ÿ>õÊ„÷–Ã#ÅŽ «ö‹Hš£ ɦÈK˦'Ë úšE†lI ‡sR•—oibÆVéH(Œf”k:¸ CiؔϷ¦à§Äè[¬žáDÃ/‰Ÿ10“ˆ§ŒÇÊ‘–ð˜H…úFØ“@›CÉ ˆÚÍ•…{ÄÓï·ÅOô#° BQfþEsÑî Yoø¸ÃDP9K“Æ=ÆÏŽ Iy¦— Z5U«®Ýª¸e°`G U4;% Èæ]²Ì‡9˜Á­ñGÝä[Jp#º{†í}å¨V'8Ü<(@%Œ‘v¿jw nGb‚”ˆI&ItÞKVÑ€lfS"ɆÄ%cGÐ\lÀ“up#©ØE™ùÒÀ³#ÐnU4{~Zvßè · L ‚æwHA¨4_6ÚAö¸`v÷…¹%ìÐä{#,ºAº§' ªâA¢4ûËsK¥{ÂŽpŠŸÑÇ=ØóXxé¹÷Fïóä 9i‡ˆU4EäEb5CÊsëÿÒ°#°½Wº›¹¶hsää΂±lMI-Œ6†W~|¸X’UØ5ÔË¿‚u2biÄÏŽÀZ²9…DtüÎÁ»H-–ŸžSí>é#€™œ™¾ÔyÃrŒz߀ @jwϤHdmiô¾‚Ù<~o ßžˆ$Ñ•Å50&(Ü^LÑ"ËsŠúdžX"~bl*ÄÏŽÀÒ6vÅBà£ó:g4)’D [7{Ûù½1Ø%o½Àƒ5¤¤&&ñX_nªX%‡ïEaGŽ´œ“î*Ü5 T V9EÔØ‘K7…ÇóÕ|/ìÑLØ :ÈRHBD«D'æDŽ M›Ž;o° AË@Éõ[ƒvZ_VolÕ°#P‹7è3ænÕye‚—UþÒVw”ò%cG „ÌLÃÂd§¤ÃÑâowÕlÀO`f^ídã)Ã>Óä(ª'&2²…µ;r¨é…gê•âÔ¤Ù;v×l‚?‰^;ÆWWuÞc[ÇÉÐÆ%cGðo:Z§ü·ÜÒ«‚z\U\M]ûƒÆ#<6¡û'…#LZGÕ¶Ðî4á_³#è_ì' ­`á:OcÖêÒZÌì {¼ú#1œ(œÃèËköÂnw ÞåÍ'ÀŽ OŒþðô¯yEE˜Nf&§ýñ¶¯È¢‚Ù‘œ|—§-‚[Æ ùÚúgäºÐ’±#p$~~ñ ÿ‰Îw\§³>-=C1šøÙ‘ŽXúŒ´±|%ï7“DôGYT;293õÇÁs4Œqr“¯¿Øùš\š fGÐgyŠDÇÐÈYØUO­.©…Äï{{‘¸iÙJü¤WHü˧^‡DŒ)ìXââÎê Ç[/ÄêYZû’“c²#ðIþûçoóŸ˜ÜaBdKŒª™Ý_í~]Þcüìü™8úÿ¹«z#ìO¯³¤ gì¯÷|S?;‚;úɧkGák)‰Î8¨‚[ÿ»½ßƧ#ÍçŽ: .bD;*ˆÀ=µ›à¤áÃ;úÖÐÄ(q 0›hìn9øTB®.;‚¡óãë'i×Æ †èFï-ò´ñ vr´[ÕE›[pJ³ ••p(¢“1ˆÃﶃ4„J²òǧ'F$7~OíFx¿¸5½4¡r%&„+óË0âèÐê˜ÈÐáb0ËpW¨¨Ì¦º* ó­(ª’Ãq0;µÄÀJMmO¢{çb @­ä¨@†7zÚ†§Æ(Ꙝ˜H ˜T‡ê‚r¹øÌŽôŽô÷Ž Ps%„ 3óÐýçôé<ÈÎK¦œØ< èaÈ!=àï©uû™ʨnÇ5« fGº‡úæ¢4—W/á£5Æáx;0 ¦rrp\vQl<©]`¹í—;×ñ³#Æ.-²1å}áqVN0;¢w¢£T›ÚÉ@þh=cÛýQfGð­û;wÔ¤JþÓð#NóEåUãìˆtw Ózµ§Õ‰í-ÈÈ…zÜîïêÖ[Ú…X[V?«ðˆØ»Ý«ù«aüìHso;ëJ^]Z ý¿ÔAJ«lÂzä˜xkÚó…Æáa(ÙAL8°#hÞ€J • ñ±I³l…ì˜ìœ„¦Þ˜&ì®Ù •gS`„ `GðÃãú£N+Á뀢ò;”L¡äø“µŽÖSÕTD–ÛlÛkô‘4Ä‚ÐXXZŒªòýuËA)€QAG`uµ`œwT¯‡Ä­ÙuDáè˜Pî8P<#X`ùþúžÚÍRb;¢¡Ûä¦$&Ñ=~æìûZ:xÔõ˜…DU žrüIš»g¶»ƒŽX»ª7ÀsÓË‹zÌZ¥Ù«„IŸA ò¬ ¨,$š‹E¨DƒxÁ÷QcG~+!Šî+ŠþÂ# ¬Ê®j×k;¢ƒŽ ’FÃKDE¿;yëwÌýõ[1OÿHÈuŸÌÛê™ÉéÆ›ôìì wm(áúòØOMU*á =²4ìÙÃB{÷ÕmAÃ#àÍZtŸm•kÔË— ‚J>¿r§ ¿¡ƒat#ôH;b±ì%ªýõÛ`=Ž6Ÿ»çìÒ‘4è,lL`!÷7l#<‚ËÙ^µNž"±dìÈ»—óš ŒŒ T‚ñ‘´Ää—Vïr\ ¯®Û©ñÁë')9Ç å1ÌŽüËùùó–åk`áÆ4ݵ7¹)ôtòô­XW¥½º¯w,mÎ!Ư£êPÛhÃíÇséé—‘uPÜ*Úã¡„>£ “xÖ¨&2Ví‚FwÌ—Šu±á9< ôPg¡\YN©´ì†$´*O9ŸiØçä\ûUVÚÂLäß~]j‰ßØø<ª_]:ÌoDì¨Z/Ï~ `G`¯¤qxiõnø*ŸÝ<«GmUzè^ñ‚Ù‘_^ü„GUØüÊÁåÏþØM~ÄÏŽ¼yö^(غ| ´Î$Ûj4Îw¶¼¤Y}õõ Ï›E;³­6B³#?9ó»¯Û–¯¯·„Ýi¸îßØøÜžOnœdsôÝ­/C—~uéP¿#¿’›îñ³#pÂ4Ç65ÿ|ç×,ý8x™ašªCmì©|$ 0Å¿¼#¾µéªúñ\Ó®mYi1|¼æÞOòæ™,Ç„¾²f/\zØsöL`ß^Yû4þ<îàªIáÈŸîøêÔÌôÛ>q–aÏ׊?ìÆ‹·Ï3¾}}ãó0ΗyD£#iÎØPˆJÐh;$þÓ‰_r9zäG§m¿ö…]Z =lëëc´õ×{¾%›"€]ÒÞ‘ª4ª„Ç193ýÇcÍûâªÝ²k°#Š9Ä‹ßÛö8?=û&QŒÐ#KÆŽ`ðâ×!àºÀ`b ùÉÙØî½±å%9ÅÏŽ¼wåSCá˜A÷0ÐH*=Tk `Gà©~*ü„ÿ°ÿáÕÿ ༆1k“è˜ì\Žïûÿùêº}0D‡›N³3¼Lç‡ý?|ó4µMr$ñßï}pê]~ñl_:’æ'ßå9Ú¦Š•p'0k{çÒ!º‚ŸÿoOG®°#pÚy*‡éÞ¿Ùõ Hü‡ÏßVó]—Vï’Á´âgG>¾qò¬ÓÑ0&þÙŽ¯BÖ:ô#6¡¯mxV®•ÅÏŽÄ‚Žè8Ö0˜ø·ŸüP_PbßØŠü¥ÿñ“𬠖°01O4õÞþ¥òˆýïO¿vÆ¢·>B¡lï>1†.;EUj¬w"¡K˜Üa6G³ÚëÄD“èw”ý·÷>aBa*1;nîk×¢CäsbDSNŽ½E‚-ÕçôŸž$.#l&f÷Çië]{mYM8 ¡6Ÿ·žçè ëÊêÐÙoö¶w@u®ìÔLé³#;nŒMOÐf+† Lä!‘NÃ!‰èŒ³ssʨ:Rê‹*3“Ó`‚P2Õ!'5£JÕ`vDCÆöA'˜»gå«%Ӳ½ÄÀŽÀ«:h½IŠ$¢Åæ¢s·û»pGõ¹CÀŽ@K¡o¥8S…fWïÖ*_E]†\¹Î?;‚0òr p†¡Ó£L~o}ÇÏŽè #SŒC¤ê÷ù'g&ýÊPDIa-ÄŽL:E…ôaI !Å@¾óñPàÏ_:;bàô­@ž°#±ô„ñù åÑisHÎÑ-YTv$Ö£tëQ ê¢ÓÃéâTŒ&QD ÕÁMŠ„ 0h>D\L‰$9ÖXCIH²Ã‡Ø¤ˆnu‘·£ºpª˜ä0tù–³Ñ®ê–¢0…Úðô/ª×ßñ§#QNÁ¢'¦§øa…¤ãÀŽ Y&fbu nd–¡–äæPüìÈŒ*!ÆvPX0´…’¬üDѪì~¥ƒÑí¤ÑV%Êç¾€ €tب + žii¶z.xR<7Ƴ(Î*4 ~N=ºMìßë–†%€ÁCä *r -­Ïò%fÌ pû|;D“X}°K‰ª6”{ºKÃŽÀtKM¨)(Çð«rWôŽ:1é fGšÄ‹b¸et(ysoì}5¨ÆbÉèЪ4& ¼¿‚ Èmþ`vÄÞØpÞøD¨½Ü¶¯Ðï8K–ÊîÐnĽ‘û¼É»$÷Éž°#œâgG®õ´rG+Îȧ2仕x@hùÈÖ¨@*rO³¿—†¹ÕßÅF%¶7‰ü°x¦çÄNpMÁ22Gr{˜fûügü숌¢_[X{2¥Â‡4qÇ\‰Â˜°#üUT´>u àVÅxën>v­-;-Ë"¿ƒ&D‘UqÍÕž»ð¨jpâÎß¹6)^¤“cMüìˆZ q<ü|™>ËYÇ'ž¬ ù¥ZMïEÂÆkÇìÈAZ@Ãi‘— -mTeÿ `GZûî°ÁÌVKT,b=a“CÎ{Úúâ$¯ÛDÂr]1~vDïÒÎÐÏB!ÚuÅEçÜŸ5aKœŸ™‹Rx[YIJ,J‚þ±Í÷Ȳ#üÕvÄ7=<;bÉ6ýýbGBN ’±Üš½dìÈdŒˆ±#ðظñÃ* ‹¡íOƒAW•±ï&ÆŽ8†€ÚäØ\ '$Hv„àHdGìˆÄD˜Aå¥Dyúx;¢0m…vžP"*¶¸ìȤú*Æè;‚jH‰r·#€™ñ%ügœìˆ‰;‚g!nÌHJ“§ü°#2ˆ³#”<úì~.O`¡-´Q7P‚¦“8‚/;‚”ŽHv¤HŸkýæß>;˜ˆ¼ˆ:H½]\v$ß ¶¦Ã˜ÇØta©9´ƒ‡zðoáBIvÚBA²#(<;%“Wú˜±ôtúwÄŽ_; Üá âDØüjÎÑ{‰(ÝÊ"ÅŽhL$ß¹èà ()”[õìàv  $Çíõ°#2 a"–(¡‹2؆/;b"KÃŽ ’âP ‹ö× †Y–SDæH™@ËãÁñVŠå°#è^ „R;¢ŠÐsÔÂdžÌ‘ l‹‹(ÁYºògG,7 ò„á?;¹­yØ”‰ü’¡0Ý;¢ON‰¹‘KÃŽHLÄ—ÁÈ^_´üœ¡ÊÈíaè†ÜMŒ“!L„ÿlp0‘3·ãdG0Üú&ÙŒÕù±uÉvD`": ˆ~µK²#–^ú¼Ðá`"QµöD‹¤è&ì2-:;"ñ™iìjÖ•MÀEŒ#¡#K v„€þ3€‘˜ˆ/;Â)°#—;›ø+fGÜ€HíÈR `G0T‘5¦jï­ÝlémÔ‹Bp}–ÇP_v$K¿Y勉ø%”Øtg5\Ú`1uUÉŽ ðÅUÇÅ1í—­ ‰‡šN‰‹ÃŽTå—Ñ»°’@ßdL„ÙKosr9¸ˆŸðà®0½!Ù¤g ²¸ìˆÂD´qìˆJÄvï£ÌŽ&b°#»ª7JÀŽ8_Ù›UdL$;ïSÙàt®æD1 äaÙ‘&"ÙùjõÒ°#øêº/¼ìˆ¥ß –ìHƒƒ‰Hvj/·ÓØ‘ë=­Lî¦:GÏHvÄÒ«ö¾˜ˆJ¾v„¾âiÕn X;²·nK×`/œQà° *<‰vêâaG¾¡7c väù•;aôxbÅìˆJlvDb"ËWÔk¥’áCæ¤eʇ6ízÞqÚi9ÅŽHL„Ù< Êù"¥vDuÓ`GP"¼7¶¼ä`"*a@§aH²#(‰YÅvÄÁDìDì4P÷÷¨s1ˆ°#ÆWÄŽX(ù±#ú«&Bì,ð{—?•»‡ûܘˆêh’I '¾±%¶ßÀŽt‹¯,}² Œ³ÁŽXµ %0;˜ÈyždÑÙù³#çPr/ÂnË­Px’„LÉ‹ËW–dHvä_?õš¥×^Þv{qÙõ•_$;Óñžˆ‹±ï3A2˜’)Ír"ì\}1¢Ùì†ÉŠýÛÝßôb"–›òW6NcG¬@@äÙÆDÞ¹ô ÏîŽaLD²#Iú¸οdì¾âMfGþùä;Ã㣱‹‰Ÿ‘_ù²#‰ÀŽHL„™€ß^;ÆË(ÀŽx1Ë(yKc"ì]”ìþ¤9_|hv>¹I’Y–[$‘ÅeGà»ðæ™x"¶èìÈßú!/2;òãÓ”ØìÈò¼#8—ùî–—QIfG–å–àÖ,=·=¡g[_";‚‘—¡ _vdMImafždG^ׇ7Á»;¢Câ1;‚ï‡ÃéfGàSµõu8çѨÓ-%;²Í™ÚHv¤:Yb8¢ã€ºØÌUTÑøØŽ·ª§BöUÌ_Ʀ&”Åv³#˜J·¨ÊÛ±¡<«°#Ó“zæèbG,íuÇÉŽðš¶Z*ךùÐìHR$© =Çr³#–{“eqÙ‘HB˜æ›¸ §[…h/’RüìJ¶O#²Ój_˜¶ðâgG¢¼ø{ÀŽDíòÿÐÓvÄç«GŸ™žŽû ìHþ¢ìLµÒ"²#¨*×öÁÙ‘)ýÿùe±#³ÊR‹`$ÆŽû®Ò—ÅŽXÚ™ˆ]|`vD~õر#ðfXsÁŸT™‡`GòÒ³åÃz¼Ø¨„¥÷Gù'´ƒˆby×z`v]†W„¿DvÄ DüjiØKo\ù²#ìõZ_„éR_ÙðÙL¨ã|éì,C¿°9¿kv„v}¼ìˆDzŒ‹”Ø|ÕN_=0;g„ ÂŽ<^ìHmÁ2i‡—ž©ÑÅC°# ';@~õ»fG¼€Èƒ°#:ÄHµåÇŽœ[¶,;B«K¿gìˆþJY¶¥aG`î*]€È±#ê«|õ•ÁŽTæ—‡þü®ÙdÆÅ/ÊŽàW´´÷å²#–ÞË”/vùe±ÈŽÀ¶ÐW;bi#Ï?ù]³#pŠ¤ó%²#ES?;âDˆQ_éÝ /;"÷óYv„b9xÙŒJìã-;²¯~+F¥/ÊŽì¯ßZ¨'È;bÙï˜Úé ±#WÜ€ÈïŽY[ZGÎç"²#(GS %;‚?8ù®¼¸ ;‚ô'ypv„¾ò²#PoLÉqv’¯n°#ôC¾òh²#›+VÒ+ì‹ÈŽtöÊ 2ÂŽ X\LÙ¤¿€È—ËŽ"‹ËŽðW‹ÈŽ`êtÂÁ²œÁWrÎõ ìÈΪõä´<;‚aNòàìˆüêÙ<‹äHÒC°#–>ÛˆËùRØø´ÞõìÈþ†mp¼ìHÓÝ[M½·¿(;b©ÕKÆŽhëò²##“cºòÖbGœ•Æ%bGR"Éòí‘Ç‹±<;}ñ²#Ó“z—v‰Ø:(ƒòx±#–÷ÓjzÂŽø|õè³#wdÖ9žæAÙ‘¤p„êü$îÈ“¸#ôù±cGPOVËdGÐ\t_nÜ>Ȇҗwd|jBé€sñAØèIvJßΗȎ@K»DôˆgGð+Öðß5;BgÖ,bÜïñ4ÖãwDOë8WÜu< 5à³#Ñ'qG‰;òXÇ©)X&ÉãwDd“CâgG.w5Ù.Á—ÊŽ8Ùü±#0ƒ¼ëiýîÙ´I¾^¢gÜ‘5euGšÏñOžÄ¡Ï¿—qGè þóÙ‘M«h„úrãŽlp²¡ôxÅQÚ$ötÉÒÇÓXmÜ4&§^vÙØ[vJ£Çžð²#»j6Ò¨½ˆqG|/R `GÔñ40˜_„Aw ½/=îOÃ~Yìˆqf̓°#ú ›çcÅ>0;òú†ç0`= qG>VÇÓØN˲#{j7“Cþ¥Ç¹âOóàìf ûêT×^Dv}·À­Ž;‚‹oÿˆÊy¼Ø‘?̸#ϯØI'T.";•`×ñww.åWõX_nÜ‘ºÂe’xxÙ‘ÿzäg¼\ÿ€ìÈ_ì| £çcw?§¥¿EŒ;‚*ñ…ØÔ!’¾ÚÓ²dìÈŠ¢ªáÉ1/;‚ùË­û]_”™žAS§¸#¸I©KÀŽ,ú™5“3S³OâŽÐ·OâŽ3;B@IÔ¾£ä”Hìa=RìȘ¡}”ÉTÆE‹ÊÌ:jé{f òà‰Kv¤0= *!Öƒ³#wGúÙN2&â ”PZ\v…§èó\´Ä;bé%cþI)Ÿð79fwÌ„pqf^ÿØ3èÂäTIvw¿‡÷ó˜ÁcÂóè6‘Ï=NvÄÒ³DþLìò˧€;’½)€Á¯”1ÔŸ™¹3ÐÍ&m(ÃÇ= ;é4çÇ“r¶Bmv¤G„a·Mìߣ ås`G¼˜ˆåw nŸ»¶/;Rœ•/·ù—†évc"–}Í}qñaب.:òÕé$R¡vOˆtÞ_–Êïìï^X;¢€Áà"®8K–þìTÑø„¡?;‚I)û¾ìHU~GùÈV–TÃcàh틵ɆòظµTìÈ­þ.6ò¾ìžTúœûxš¼ôl¸(Ä=ÖUfŠÆÉŽXzí˜?;B@IœìŒu„+]ÍŽùŠÂªÈ•Óv­-;-ËJvD%5W{Zlk,Ø‘ów®±Ÿ°èìˆbD%fG DÙ(!òKµ$LÄ`Gäf­ÈŽ\¸s»ª/;‚v“[àìš”‡NfGð¬y˜ËOϦÕd;ÿüìÈàø0uUÉŽ`¨’š†‹èŒÌù²#AÐé|§ñJì6™ŸÉRÖXW ?¡Óâ%;BÁHdHöµ¥uð[0DÊçþpìºüª’jËÍŽÀr¢/È]ObG0’Êך¡ä¸">:ì\²#ðäÊéâ²# ©Ùd¹Ù”,YŒG™!LÄ`G^tï>°#];®Ý*¥:pTÈW‘ìȽµÃDôî |ŒŽž2õ°ìÈz‘ìÈN(¡´4ìˆ 1"±—ÁÜðù•;$;£DÛ·’Yá%”Ø%{3Uw鯭Ær³#:‰ÄD TD¹}xí»Ç_ ;鿹z”FC¹ÁŽ¼¾ñyÆD,=M ®zæö8ÖdG`X^1Ï­ØIïQHvä››^˜HŒAg"¦†ã]5ß»òX…»H‡wÁH,ÅÕÅ mý³P{ø'íŽf³#°fŒwû²#0¼´?J)€Q˜HÓIƒÁÐÆi$ùÆÆçO´]bØNc"Ê`JvD#‰Ñì|ƒÏnÆ1±#P¢Š‚÷ûU­™”ØKoVñgbG(?³#0r"';ǘvÂ(ù²#¯mx¶ý~[o¶‘i²#í÷c?Ätf[åZŒ¶_€B]qeÄñü«5M•`Rw÷tÝd8)~¸½r-¬ÍY…¡h»UNÈ*aÒãgGЗ9Ƹ¥·`!·^b‡¾Dƒ )vÄÒ›‚Γ¢k@ÎݹÊýVeWµk5€AKŠpùÐUí“·.qÇÜ_¿SæÄÆ᪒è~Èn½t(%°#gn7ò1 ¢#c$•£ü•OÉÖÒ°#°½oÄ6Å÷ÕmÄ#`»«‚.¥b÷³Å}õ[áѾ@ÒѼr `G`¯SÈÝ¥ÑõàGIR¤"·CÒ$°êȆªÊXA»k6Áíä?—†±ÔÞÆa~çg}YÜEŠ8¢Ó“_Z½GÑ$†CWMKJ=xý8­Dµ.­«ö숥߿çÜõå+à<Þz¾sÀžtÀsxaåNŒ­Ÿ·Ä‚¼¼fÚD7à‡E•G[Îó( ãç‚  $E ´Ñ$M²‘~Ø|žQN"EÚú:Ø|áî^ÔÌ¿¹ú9³)P‰*V°#Ó³Ó Mpôx{Õ:Ì#ÍgyøÆÔcoífhÆ/º‚J¾¸Zoi_:¬GýxGÕz s°#˜§¼séÿùÒêÝðU>»yVÚª(x {ÅSfGÞo<3€ùËvV¯‡*ÂP;‚NýmýN6§8ÙKï+³K%„r­»•m5i(mÿØÐ{—?埼²öéŒäTa®êÊ’šmb?>€AúÉ™Ø}ů ÀD@HüÆƈ&asôêº}Ñ~uéЈ3+„n\{Ñ9~vN‹ŒæõÍM/@íyéî·W®ƒƒá¥IP Œó­MPÕï‹Ñ$;ªÖ®)­ƒý¿ÝoÿöÍ0éq²#˜Èÿ¯“¿²Š^#>{Ë‘ˆyÆ\I“d8¡b~ræ}zQe´·ÊÑ!€žûI,¢@ô+k÷!ƒ—‘‘HÐ,ßÜøÂäì” Ep`å.8ºoÿPPJÉáÚÁ&à‡¼·IÁ_ì|M6E;Õ=­¸vUéLHÜô"|•·„úªÊsVØŒ#?;û[^ÜøÖæ3“Óyñcö9ÑYˆM¡´dì”ðªãÃFÅ@ó“³°Ý{cËKr<ŠŸyïʧŒÃ1ƒîÁ¾½}>ýùίÉeðv3G¦Ž’'ûÃÓ¿f6Ú+'ì¦÷Y M8°ê)Ì`Æ%·Óq®ýêᛧ©mPÉïmû >ücoóNuMI-ž5OµTx’õû¡ü Vâçÿç³"›+€ÁÙÁ€Ä?Ùþ*ªúŸ¿m¤`‚ýò…¨øÙ”ðyëyGbÆŸíøêàøÈÿ<ñ›P¨„Ì?;g_ )ÊÈûîÖ—!ñŸŽÿÒrnòÏu”‘ÿøÉxÖk‰.v¤ùÜÑ;|#\Ž·ç[˜Ñ¼ í¥ýÚPèO··ðƒSïOŒé !¨ÐN¡BKÆŽ@÷Ô"•Þ‰Ä8¾§v3\}z²´\ON´7›áVÁ‘ƒÆvÙ¢CD0ã2¥ '>§áx&6=ŠM ô¾ƒ*¬83#Tç`/ffGöé ¦ UB«Jª1`þ®ì’ÎEsa¾‹`vD½Ö29J›­˜(ÁCëêkWcœ-Ì4ë°#ô&RKß[èbsR3¤‡ÌŽ´ÜkŸ˜™9 ëݯ–Lû¨¨„„ß}Ùx àÐzC/jÎÌÎvê)ô“â̹WÀŽ¨7]‡û™óNßÔƒ£º ×Tš¸øÙHvZÞr^ðÆÀjìåqþøّٹYÝm‰hÚPvviCz{7¶`ÀŽXv\› ë*Ôyâô c+ó‘eGøÛ'ìˆozvÄõ_*ÅÓ’;béÈŽ–Dé¦8ü†¥,{XŠŽŸA‚ùP"œ¦ÂÍÉv#šD“"1à#Aa\±”ó%&D|c¤/G}%&«ð!ú°›™i¾q´RT܃[HÒ7;m[Øã“…»aÔ›åÙ@)IɲUØ]ù)ÙæÈ ¶ÿš!³„{âgG&f&Ù´…¢ÊfÉF†Å7É°#¸5YŸ°Š;+*9’dl“ÇÏŽà¾$mušvÇ¡1š7€Á“•õ ëãodpO•Gˆ!As‚£‚æL3 å§e‡ô©O‚Q²f4:F¢¹hgKv3n_š­ ÏÃxŽìùü'ºŒdÂÐnÆÍÆÏŽàÛ>ñ­ÕSH…мhG?!_…IÄã‡cÇ}yf•‹`Û›DyÛcê°›!þ-~hÏÍôß™ŠípiNüìlÕÔHò˜êwv=³œð!œØ:ì†U4I«+r«rì}ËpR‚Šb‘GbÁý¥È@ÎÌ3ªµÆ_zÞ@2ó±#tkòt0 a"fRBEn1þ˜žì4 Gäa¬*=1U i-;¢šk¸8vÀV%HûYî=C)˜Á·wbzM¤È€RP ºGÌŽØÔhÔ:If#š„ÿ fG`ŽÔÕ©~(M1zmKàñùˆl2.Ñ$Râv„Rüìˆ"EzB·ãÉþ¬ÊWí†>+,”0:9ÎjV‘[’çÖÿ¥aG`i%)B‹{Ñ$°ÀêèYÁy¤'§IíÊOÏ6t#~v¤ot Me1,ü“²ìÂ2w™ìîñbgÓ¬sd4y¾¡cÍ’" Õ dG)¢Æ& C¢?ª}/ Oe?¾¨-qbfZbˆòk1ØHäÍ*ûc£™)´Ö#I]“ ˜B 3\=.€1H‘¼ôløu|D“È¢ØK¯ÈK¤ÆŠwq0–m­\#½ÖvÄÒºw‚«ÑS:œëËê1˜Îè7ŸX"QGc!k[Õ:ü ïEFjÁ…_[!Xì$žh»È¡Ñ[1öÅ"ðE’vT«µKôèkâDŒœÔ éIV©Ø$±4+AáÇZ.°¸y.‰‰É´1‰ò”” %MbéÕj¾IP󩘈ªåÂ÷Š[œìˆ¥7–xLWl½b²c6gwí&cï‘bGnö¶; Q![úÒkËê˳].J;¢I‘ˤ¦¢èoz›ÐÒG§I׸£r,Ó dGúFOSƒö‹3øà^!²–†A:u;FŠ`šŸ–#ñë]5ðÌ¡^?Î3)˜8¸^ ÃÓ{aåNYf;b©-s}:\PTKLKL‘18¡fäj:Åa$lj–›D–¹dìˆ$E,}$ ¶·¥bÚ¯Ÿ`³¦î1)•ÿÄÌýåÕ{äl:˜iìn–Þ E:aß]‰Lâ¯UL‘XüN)11þ£5Oëãu\¤ˆ]”“Põ8ÀXH¤¨—÷×o#òÝËŸ2)Â3S®ÀWô>\x;bé?mF/ÌÌëóg¶C"*‡±%â³ãÙF1ÜP ‹˜ÄùÙ‹w˜œÚbÜqqu£°®EÂk fG`r¥Y´ª@ìȺ²úõî®?;3(Ï©È)‘Ódˆ#‰¿½zŒÝcÜ#ÆÇûÂ|}]=“ÈŽÀõŠ…Ä‹*׺]Lvv×l¢—­uéP¿3ÀÑÅø(ÿ$š„?;‚ôÖ¹yÐL´%²Äom:I4Høê°½ìŸ×.§Pj'Ú.IúÙ¤%|nÅÎÊ<—';bépk˜°‡W/'û¯¬Ù 'ó}îD1pà ß2f ßÝò²,3€±t,"g,ˆªw²3räyÁè³eZâNÿšÛ38 ü'Å&±tðNmL¢,Kµeùj)Ä dGàüÿìü‡C漂?)ì§vÄÒx®§Ÿ™œ.#õ~oÛWäDfÉØÜã?Ÿ|‡ÿ„¯Ò;z_Ý£n=ä4šøÙ‘Ž.¨ Gîs«bºdŒÚìÒ÷ÿ‚çhh@ÌÈxà#šD.Í°#–v9J–¥—nä ™qóˆï{{©-Æ \á0˜îQD™;÷{$éhµ©b¥Á…°#(ÿ¿þ6Ï_ qSWKéµû²¨øÙþߎ¾%$æ éÉ `ù³_•EÅÏŽ`Öö÷GnU"Ä«•QÔNj“¤ˆ¥×ëdˆDØ%Šï¥ã¦ô;‚Ùœ4¨4m¥$&ý«­¯ÈÕã%cG0ä}|ý$ízâøpKtäõ vr´[Õjox‡BpäúF|!„îF¡ ?ºv||f’.ÃSMŒ„m8Æ Á‘Û_¿+F“S·/ó–|nz6½ IØ -Í]ínî²a T]Ï GBN>#Üf0;241‚r$f¦¦£V„Á¶õuö P¶pB|B8(g]¡k,˜Avöò^`zr*y›TT~FN1e²#sѹÛýÝQkŽ¾‡‰žÕ{:wr8ÑXÚ `G,í®;cSH¯Û‡•‹²ÛhÎ?;béí³Y±?el­ÇÄώз¼¢}aÞ#¶B´/“ÈŽÌ8Gg°æË0h=cÛý‘bG,1¿|ÂŽÄÒvÄUGøõ²åe. ;b‡ñ{tÄ.Ä=â“‚ŽÐgz„knQçw,z5¿Ea$ôjƇWíDAG¨ðIŠÀ'm¼Ù•¡G<•w±bGÐæã^‰ú¯p‚™yQØWè·X#舵;b¹CÈÒ‘µŒn?;b¹CÈ„”é‘ÀŽXîÐ#2EufCÿ5vÄ=b‰‡ÉÇÓXzö5áw–^Õ%2 JoiÎeº,®žw+=€±t›K^D¦‚ôÜ°{ŒŒŸ±ô³ŸÄ(”¡(#?A«„z$–IOcé曑"T1‹…1ÍDTÕ⬂·ÆÏŽXîÐ#Îʃ ÞÁk4Ì~;béÐ#Cæ=FÌù)îÌÁìˆzD%cèqè¯a-D·• fGŒÐ#2ññ4–^Y›Ê1\iyN‰a–ŒÎ`Þ8'Gd'¡4#xL0;b¹B¸(CuA9©$ÊÐ#n‰)¹.‰ÁìˆE¡G¦}Œ dÕ.c‰úÅ'Ì:b=aGDŠŸ±dèOëSÐKûK×zZDDºXvX`ï.æÒ°#–;ôˆ‘(è}n8ˆ¼KŒ,kKë w4~vD¢psPˆj‰ëËê ‰숥LÍÝNîÉXYlffGà\r2a”n8…ô¨·Ÿý&9|è/§øÙ¤æÞv9–‰]­§±´›w¶ýªD9yƒŽXìˆå=b$#舵;‚rbUÚ¼<·d¹{#$˜Á=ž¾uyÚïùxË8È&êúOƒs<åà Þ¢àEo®X-_9²ÙK›ñ[‡’‰‚ŽÐçóâ ©8¸³zƒá½°#–:V¦CX.ÛDAGè3ž2‡‚3î‘«¸²qå-Ír±‰A! Þk±=vdfvæðÍ3òNÞ #V ;‚t²írÿØ€ñ*wýVšÁ8ÔtšçJ2yƒŽXìˆå»ön¯¢vRÜ™—ˆ1BȦ¥ #ôYdÓæ-<ê :b-ÄŽØ¡GüÖ&(è}–¡GŒd±–QÍ5æwŽ÷¿Ð#2­t±bG ñýÆϘԱøœ #t–ðtìP'W‚¸ÕÎ+­2ôˆ‘è}\’øÞ•OyÂ.ªê=ã`2ôˆ‘Œ #ÖBìËw/ö-ªÐ9žÆÒÛÕ’æ)j±bGŒÐ#²¨j;D^ fG,½]Í>v¬ +š˜ymóÆò}üìˆå=BÂ(Qл…ƒsÿÎÎ+mlG³# ܹ|ØŽ+éÙ)è}8ˆ™Œ #Ö"±#ð—Ž4ŸŠu>žÆrdc$ :béÅ™Ÿžý­|]‡“7舵ìüù7Ï|à»ËÇÓX®ƒl̼O»ƒŽX ±#"ôˆk%Á²bÇÓXîƒlŒ„Á‘gÓ?:ýk5AðÜ@R$ñ·¾bl€°#–zÄß|AG¬…Ø‘N7"|ÂgÝv`Éؤ®÷™æèÖ3‚ŽX‹ÁŽXîÐ#Æ*†tÄZˆ‘¡GŒd±bG†&FdŒ™–‰ÌÝÍó :BŸeè™’#‰¹ëucÆÀŽXÚi—Lžm_Z½[†…°ƒ±Ü¡GX$É5‚ŽX‹ÁŽX2ôˆgÍ÷ }< ýñwŸýÔX“§„9ïßìý6}Ö¡G~CÛô!• @  ;Ýú³dìˆE`hGˆ·>­üW:9ï7a¦Äâú°{F“Uè‘Žëv)"þ­+ZÎ+™§n]î·y!NÿoOÍ&ZÆ|ЉQÊ{;v™9©Y;ÌŽXºw8‹#Ug‡Ãœ•z¤«‰÷dcRÕÒVº±´ÌŽXzjÉë粨„P˜—L9°#–}bûoñ3õbù­¢³#¨’ƒ:-á|LKLÎö¼°?;Íq¯¡qkx_ù^vD‡qí ñ¶L$!bl̳#–ŽP`IºÂù¤ÞCN0÷ø#vÄ—=øƒM‹ÀŽÌsÄ2<&ìˆÎ@å¸æ!8b-;‚4ãSW8Ñ;âòÊ´xûœSĉ&Âw'û!ÝuW¹A;3;ë]« kp$$~8-Þ>§Ò·é>vgnÊXEåU(Ù¶ú<-óqƒ^£ÌŽXŽ3ÎK¢3º 5[vDWiFƒº.™aýFWb0;Û= n¶j(5)Å‹†, ;‰˜ÿšƒæ‚söØß`v$ª0šqCÁPùÏÿ£ÆŽXjs\®Ç‘\Ô\R;¸ÇX9N·Iir¿Z:01"#Y|%5Ãû˜‚Ù< Å,Ï™³SÌø%Ö"±#ÐÒûãÞ{TÊ“‰u·ñ©‰AºG‘ ùé9lL`Ùðh<«œÑÌät¹±§º M¹%&X¡¼ôlï=. ;‰÷FìÍ6‡AµÑþ‰›ÌŽ ïôJKBº“›–…Û4Š fG,Ý/d/£¢ «ºUXbïpÿ„Ç®¤çxŸx0;bÙ>´¹‹†ròÓ³¥ÄHgé¡6y¼÷¸d숥—_Q±977IGù¶bAv*Ñ5tÏ>uÕɇ{,ÎÊ—­ }¾;|ß0˜H1ZäÅÙÈê¼gðv(ÓZi`çï÷ƒ2`:öH|ÂŽPZv¶·­¿CÕÜ5²'@]¥Vc‡FøHTj¹%^­^2vÄÒì‚;@ûK{ˆár ŸÃw‰{„Vx½…EaG ¥mýãîA“½º‚ŠLGÌŽÀ€ß¾ßÍg ð ”e–{lE0;b黆]“_Î>-$¶ôÝÁ8ë¨:ˆoûÇÏŽÀ…kîmw Zb~©DÇ ¥Wºš |viEq•·³#x­»ÕX¶C Tç—{{n0;‚‹$PòPNMÁ2à fG,½Q Õšqß#înui­ô0¡Ïöéb‡ í_#Œ‰Wºoòg”P4W¾ûí%k!vÄÒÛÆ=C&‚ û,{.:εž6§ûDYâÚ²zoG fGÐMwo;»Y1ÛTåDa‰°á§‰ëÊê¥ùêr"”È¢rR³Ö—7hQØK«„4$v ªhÌ)5v„2œk¿f8ä°'ëJë½æ+˜ËqòÖ%;M¥pBduIµÜ€éî»ØÑ䕸¥b•wÞÌŽÀΟ¹Ý8ä–ˆ6ßPÞà"—Œ±´}¥»Ù`s[åšDñ¾ <iL(Á³2Y ±#$ñrg“1é€ ½½j”…—¯þS‚×áÕ±%cG,åk»hL¬àË=Uµ^Î)T„ñv5% UëËWîq0;BŽµžw!þQŽàIëÔØÕÜè#±lã²²U¶œ3<| C'M+lø©[—•Jˆ%EÈÚ^µVJ¢\èýõÛäørUœeÃùàïªÙhÞc ;b)Û;ôIÓI5j‹‘ŸiØ.ùyq– 'HÜS»É¸(숖xí¼ŽÖ&×…ë —ï¨\Ç{0ð´Þ8aÔGÎF1¼vB/9ƺŽ§k·ǵì&/‡›Îï AFÛL1=×ÊìZuX[Z·Óc̃ÙKÏ#Žµ\  ª\r¾¸r—l®Ï[Ï{;&[–Çæ€>i:¥Þ× …¼¸jw™gzÌŽLBb˹ë7:ã÷Ž§ª6ìª1;Ú¢°#øñ“±µÇ„ù¢!‹ÂŽª­}÷ æ³+¶ËŽvw¸ÿ_ÎdÌCñh¾±ñy9…µ9tã”ÁŽÀ=;°ê)c©v)Ù˜S¸p½Ãý’“ƒ¥“9Þz€dG0ß\±ZF¿ÆÓÑ«^.vdYN± '6>= EÅlB²#‰ ‘5eµ2ì($^ën™™›“ìHFJÚš’:㕉Ù {I*JuZ5%Päo‹i†fFWlN‹#‰f¶YÈhNŸ}v²ùJœqL Ák•H"Ì®ª–¾GmÝ|,dÉ}»ùð}òŽ#Q„K1ŠÒXTB­ð¬½–We››Ó=ã]yØh]Ö}Ÿ£\ø6ŽãáD0ŠåôJß*H¤³~ ®D/¥Ì#Q®rÇñp"ÔfV©DHÅz‰$ùfðÇ{p²}[ÕÒ[éRâ|| Ç­…,ßGKo®Ì8¬@²b3}$¢å'¦'©EÂáäHr²ßs„—6=‹ÛœQ‘xÐ\¨¾:F$ „FT ü$/KDI.÷Ì·ÑN1] ðQ±´D²ÇÒhfÖŽ”š”컯NË­ê] „ÊÃQ#‰è>é~EQàhüòÀU26_)¡IÇT‹Íhh,‚Zy7‘N€B¸#™Éé¾æWÆg†g6N$yˆB¿õYH™ÅÔqzf:W)¬È_ó+ážÜ´L/\bÙMð=f¦¤ûš&Ef&yÕ·¹Ð}ð€¦f ˜As¥øvÛ!g¥¡Î°6YóH”¡qQŽoQx@Ó*$,lEXõºªZâ4™‘'I? _+œ'ä™ÉiÞ JêtIgàËOÏõíh:n­«Iá$ãEOJhsôrBQHzrš×õ·´«}/õÚ'¢µ™›œžRg„%&æ¤fyLG.™˜žÆ‡dÅ–¥úv[|+5ǘ±S¢£¾ }  ¥á½Jˆ¢P1(ò#OZRjžŸÄ %1¶…éÝÇ¥48>̽}Ö8rˆC!QEâøL(C·èÝU¥$&+'ÍgnF©MìÜ—dxÁP’hUÖÏÓTߢº{Ç`â7¢, øJ¼7zdb|tj,E3Ž(ÊkW1Þõ ÷Á¢z)ú(1Ce$>SÙ @¦F9ζŽ cb”:b‘rÔ;è¾–\?ëBCô‰c>¼š¥MrŽMOÐ4µ(#Ï·kßèáùj~zN¾ŸDrç~2eig¯otp`l™1×MMJAãûú ΙM*¡ùÚ¥ûãÃèÚ( 3Od(HÏñµ9ÈÔ „A/ìÊOMtßÿ¨!zYnjæ|{{°ä°à ![iVoÅ$¤…r|‡!K¿¾ÃŸ+óÊ|­@Å TÈP’]àÍO-?:…Ácßæ¥gfäùºLWºšÙVçûKDœ“ ƒƒqª(3Ï7[k_;¢È㻢跑>dC QHQf¾¯æô ÷³ùB6/s`i×9pwdj ¥¡VPBã”Jƒ `jd$¥ægäx‰K/&B%F'ÇÒÕȘZž]ìkåÐgõ“j³âÌ|/$d)•èº‰8KÉ©é¹ÞÑ ·Kˆœpª3ó*§¨ÑÛ÷»G&F§çf3“Ò 3óü³MŒÊ½ï%I˜Á¨úeé7óøóÊâj_+1,âùf–^»y¯9áÀÔCç¡„?Gôd›XRí»l×ÖßyW…7Šo!±<§Ø› ¼­¯sHITÙ0dÏ7ÔJm§gë…ú,F+* õ‡ðüÂ.ñ‚鲜_—IE®ÆÄ …P’‡jAèšRâE!ÛàÄèØäDvjL„¯@RÙÆGà˜!Õ·k#Ñ2ÖúID!èÚCz•í€ëK¡¨4ª‡©æÈcjédëºÝo“»\æó¾Ž8PHT´Õà[Æâ‹‚j¥ó,Œ¿÷jwËÀÄ2cL/LÏ¡ð:«èû·û;á`ÆŠl_|{‡<Æ ÙŒ7PY"Tb@{páʲŠªòË|%BWÔëÓȆ™àÍ^ëné×!T1sAŸõíhÈpÚ1Ñh±†Ä 7à ÝÊMÏÄÄdUiW"¬ÄMEܪÉonZ6:£/jsÜTl{¥ÿîøɶK죜:Ï‹ŽÄÛ}êí)xãõ…Ë}=L¸^0¨?ÜuÊæõÛ1#|ÊV™WZ_Xéë“‚”šzoßï €‘ýJçMòšÔQ•ùe¾SÂwo!*ƒ¢0ù¾x€<‚ÌöˆÆ¿p‡`‘J³ ×éC(ŒK‚ÊÃIKÖѽækjfN:JS‡½¦çÀOðm.ægwÍFß¾DkGßÈý$LÆÓsÐ}Í×µž¶ëŽŸ°B‘‚UÞ<¨öÅŽë¸AÔƒ Lœ¯;lG)øÚ<[ÚÈsO#2Qãp^6ñç›hÍÏ&^è¸~G¹¾÷“Éð7VWûfûìæYä¡ÏçE=(½}á#!q‹ï4çük°öí÷{ õ<Eùfûôæ™Þ{ÍduI­¯D ÙÍ÷î`”™œ™B!«Kj| †ªÆ.›bD¶}õ[½y0¦Ÿk¿†¢ s%”³©ÂgP€DôGäÁTÙ`¼QäÑA"UQ…™¹°ö¾ï1j:ÅëBÏ4l3Ž¥Ûu¥ë&Š‚bDXSRëë#Ïe‡ùÀœý'8–‘Þ<û~¦~»ï ¶ E¡b¸Gµ¶¬ÎWâåΘD˜ˆù^Ýùñ™÷ùós ;|%^îljº{“>̹}Ö› ­zêÖLT ßÂŒo«\ã]=Æ·gï\íîGGÃTÈ÷-&ä*œ+¤b‰åî®ÙäÍcé7+88_Cq•÷53J¿¹z”6ÐCVhkåß1v©WÍjûsÒ²árTû99äÈ jGßÂâ6½N½P4<gu6;%cYn±/ñy«mÕ{®fÉ郼KLÓ“í=˜öêYa:L“¯÷2#9Ô:ü|Ï»O+9I©é‰)ÅYÞµ\Ì_úôòÅÄÌ$-Cùªýøô$:†Võ]Ü››CC ë¥{Z2Eïö]·§m!üÿì½÷—Ç‘&Z·½÷Ýh 4¼÷½J"契Vcµ3ófÞÙ=ïÌÙÿáýðÎyûÞì›YÍí¬f4#ïH‰EO‚„áÑpÝ@{ï}ß®÷eFUܨ¬ê¨{ÙF”È{«óf¤‰ŒˆÌø*²¢ ,ð„M¢»ÉÒU0QåžÂ-äSìîOBèúB…®¶m ÉÌ ÜU-,.ÈKZ—:™T§%vœ¯Î¢ƒdñÅøÌÂ\\Å9U¸ L=\ sBU_`ØÑÒk#é™i™Fn®JGÇt”6âÂÅœ[itØ>-3$ö­Ö*‚®ÖÅäËBK…Ñz,§—K¥™°Åûܱ%ÒLPmáØ®-‘1%Žøè#cG"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"úwCv$¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Šè÷—"ìHDEQDEQDEQDEQDEQDEQDEQDEÑï/EØ‘ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ß_Š°#EQDEQDEQDEQDEQDEQDEQDEQD¿¿aG"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ~é#cGlñßþYª˜¨6 .f;ålªgÉbº ×ȶùkZZZ`U‹T•MM¥q´5CjLqŒ6lÑ)äK[¢X|1¾èŽYz,--Ð0T³ˆÖkŽTO`1U¥ˆc,-]óô[XŒëÆëQÅ2ÒÒ‡bnaž?g¤g¿àŽ* d¦g4Þ²âq[‡¥[ŽÅÐx4L5_ÍN,=–ž4G(³_p8¦¥e¥g7>>¿è6 ì2Òú¨_Ýø´LÕÇŽóñ……E—c,-;#+ãìÂ\Ü嘓‘(`hÒôÂÍÏÊ ¬j>>?çö“˜“™Xlrvš?£Làp¡ñè&þg«qHÏÄ?AÅÐx’Š˜–Œj äŒÏLò缬œô ɯ©¹þZ˜“Øx”Gúœ‘¹Ô¨Žy9Ê*æ²Jóˆ¹ÎÉÌ œÇɹi‡£ ŽY(æ/ƒs sózðÓõp¡mþb3óhý,}F“ ²óüe0˜Só3|4 U¡XÞÓ=<5ÆŸKóŠËLÏÏÎÌ»ÓÓ ³ƒG¤×š¢Ü¬ìÜ ÉAïä<–å/ÁqfjÎሥQ4XÒ“³SKWvzfnPÁqtf‚¿Vä—rœ˜š_Tâ %‘™–Q Ô9Ãü¹8·0Pç€ãÈô8­,(]Š#$:Òž™™Ÿ•ë—ˆÚ¬^¶YéÙ™Y¹™}ÄpA*hÙæd¨qTM˜kÖ«è`~v®¿ Æ«cv^qÌÌÈÈÉÈ”š¥ÏY™eyóÙ›˜†äàƒZ×™E9U-ÌcuÌ8}Ì„ØrÄpÏN‘YF±ò y£Ñé T·3ǬâÜŽ³ ó㳓sÄ1# #(«TH>Ô/æKò —öÀÄȬ» s e„y¤>bùdçÎ#Äs=¿°Žµõèçˆ>biu@üò²²G“8975£çã‰éÔr¨jVë2.eùÕ š‡>q8fæŽ*z×7>È_Jküe@´-nÇadÑ0,¢@£p{¨‹>`¾WV*LLKÌô’ßZÁ,bTQ 棊¹. â)…¶ŸšSF • X í@™±™ ¥¢m Ë"¸ÐºGû§]…‰I Ô«à½Dfâ‡Úç4áj¹‚¬¼Òü¢@Ž]ŠãŒË±¸l M~s ?×WŠ=&ËÖá˜[YP8A#½ÜG,ÿ@MŽ&uŒôñ×u• ­êBI¬J¨ñ¼ÌìªÂ²@ãÞ1ÒËÆË¿<ˆ#Ö5¦{ZƒD±¼ …689281BŸQ¬¾t…¿ Ú389<>£Tä!Ðv Iw†{øë†êU}윚Ÿ¦>eçW”öñJo+n,­ Ô„ ’|K{8|1²þ‰aˆ+>(Ž9ù0C~Ž¨µiû˜—¥$0Pr†Pfz‚VÊT–*“¶ÁÎIw‚ª K!9Cq©û&ï¾V—×b­ùË@$Ð*R_Ð6 ?GGˆ=ºÇa¡ ÒþªPÓöS!ê«w|ˆÕš´¦¢Î_;Gú Wñ–kveGhËAµˆ”ä`iŽ…þb¨ e ¾´—»²¤:ÐÃÄšPZBYuaùŠ¢ È<ÌФ星·¢¨<Ð-Ä RçgÉo¬+]ÈñFÿj܃ª (°‰+Í-¬)®ôsD{ºÇÈÍÍ̪(( t™`ý¯÷Ý毻ê7úËXZ÷võ[z¼jŠ*k‹+ƒªšìGûÇB(U´¿0@V!„j­Íª>¢L ÂÄ~Bˆ?þ?–OCY°á;yû"ÞP½:оtö ÂÂhM5¾²$˜cÛPZg¦ K»±¬Ö_Ö>äyhR÷1'¿º°,PECwº*Å6®XØø+=·x7TWRY ,v¬í<>°j[`!þGŸ¡L6-ÁñrÏÍ1×o¯+YQÄëz•Ü{TU_ZhC!„‚cþæšµþ2Pãí#=X¶øTX³FMºØuƒ¿Z³#°ñ·:Ð*Ô ©BW¸S8zó,ÞR».P/ai`­‘ú*/(H»3Ü}g¨›>C—ò¾Þ»y†>`ul«]Ìq´¶ƒF‡tš¡ó×FÜ ‚©j\Bìß¹qš?o_¹>PB}¡6úŒ(æ/§ëzÿm”Ĩñ’œÂuUÁîÄÛ×O%8Ö5—qÄ ‚µ¢Ï(°£nC Çk}·G¦Àqª [_ÕØøÖÁNSUåÂ"T)”it|ÚÒ¼ÂAAgÛ¯ »›ÇÕå+ñ?è%È3í1Ñx” ô0[úÚF¦Æ`þ2±yÉ-l®^è:žG÷J5°*8Ý~™¿>Ù| °ñW{[1sS`„A€ õs„Ç ‹kkiãˆu¸Ð°f{µúµ”Õ+C™À†¡*¬5õɶÖTÖ5UÔ6ìÕ+¸í=[pìÖ»Úê¢rTå·hðŠoö·÷Œ âöã°Å shjôÎj°´oŒb A}D±®Q@“ö5n lü‰¶ Cî­­¬_äEÃi‡èƒcƒc 8­ÇëýwzÆȸ£U›W4e1o»ÕJŸ×U5úíàˆõ8¨‡ ®xCYmMgŽ×úÚè3”j QÀ†ýb÷ pć‚œ|Ô¶%HEƒ×±Ösüõù-ûË€°f¯¹~ª:¸z{ Ç ]×á'@ fçÁIX_µ*ˆãÈû‚㧷<ȱ¥·­Åí#f Q€ÇŽ2p,Å1~猪¥=Ž·Fá3[ äm‰ª°s‡WŒÆ7W¯<*üùù7øóá¦]ûpd£zqÛãþ2`„¥Ý5Ò‡ý nÉö•ÍUM ßì$w¢² ¤¶¤jMy€}k°k–ŽQÕ†ê5g&ïÞ830霶Á_ZÊ3ùɹ×øóCM»]Gx/hY4(œuÍû˜ªþ‰!ú¼iEÓRôáoùóv<XælûUT— ŒÐ¤õü1ªºØ0>è ZŠù«‚ª‡CÞ¯QÕ暦ÀvU—»oÒglÐ]·×_Œ íÛõvµ(· ¾djóCèUX¬(^蜪 Ž°ýãCÕÕÇ²Ý ›ü}Ä_/uÝ€gei š$P}×›×O¨OzgøåÝÏúË€àzAQÐg¨ˆ-µZUA/Ñ–6ŽP úB±×[ŽóׯîyÎ_Ã-· {4ôuOÃæÀªn ´w ÷ĬF#h†°:ÞÕþ^LOÐá5;ýe — » —ð¡PkÂ@gô›+GUœMG÷ö4n4ŽÚå ''âr@™ÐÒˆ…ºŽ´ž‹Q!+¶”oß9Ú7<96½0›™–Q˜“·0Ãç÷bï Ã^Um¢3³Õ>4È·‡ŸÐ:ØA·”{<0gê¼:ŽMtF^fv¾þSŽøbs„ýc,ƒC…¸Â.{|f‚µÐ*,ÉÀàv÷p½(DÇ–<°a´ã ¶´ú³<85ÊÅ·ö–Þ®ÎÎÏ-ÚvZ,–£ŽÇsƒcÚdÓ°ÖwØ¥Ò‰ÑR þ‚§ªÐÇ@m‰Q‹/P<³¬|ÁÑ0ÕáãXFZ|Qã)J«…6ÅŽ«Z´UŒ–éi* ½TÐ †ªsZæ!fû&@,<ö}÷0:•‰ÙÎèVey :r¿TÀºpÕÆ„@~o)õØ‘À ý3´˜(–(oÈÁ8 Ö˜‚_ðW¿ÄÛ:´o[ž¶©ªÒ<†zâª[¶ 7*L¬ A(ão˜»ªu ¥¨@ñ¸¯*³¤Zù¶YÌÀC ñó‹ ƈ)mž–áŽU[úà~i\…ÃT‡¾L팮ÍÅçŒWÀŒL9ªPŒ–÷ë¯ùø<˜Ru!¸ 4>îN7Œ¨{›A±IPÐ~Ž²$†=0âššŸ‰»Ó‚«˜¸Š@ÝÒÓ¬ 1A='û–² ‰x|~vnà‰0×ÃЪÜÌlyšéRGÿV¥™¦åeæúãUåóïwJ,=•ã³w7ð鑃&-5ªØ³è`¸ŒÙ\¡ñ³ŽC}„Ûá?1¥ˆ£ú™š ÿaÜÌüÜÄlTa»móŸ_€)‡ÐÐ$ÿÑü%B𩤡õñçÀ3/K‡í)Reé°ýR£ ¯²J< ²sc ç¡©Qþº´·4ÅÑ 0]=ªÇXÚÙ™Ù裡åtp„¿úc Ѓ“ÆH¥ƒ©=vŠPhEAI S‘è¿gŒ B“XH›ƒ—昜éùH ¡ÉUðÛ bœåÙѤ\ÌÒ¼bÿÊídq-Î-ðãÂ{ž5l…'’XÝ=n¤ Û*ÿÀÇøÌäö¸W™@$JWÎJ^¥ƒcݽæéT.ÆÊXhpV—×ùÝ€Þ³_´î uCòé³ãˆ¦¥cÈ3SpÄXù9®¯j”KŠ·m¨Ëè#æq•ECÞì2T486UÖùÂ¥nî Ž YúŠçzsMS±7Ü ŽmƒÒ-!Ž é„r¾ÒÓêõ¾lTµaÅi_ºFûÜã3]B3Æ$ú#+XÆçæo­5ã—X_—znþš´iE“ä…ÃÑ,ËýÏšŠzèUÙGŒÕ¨˜ZZnªiò/´s×P’¬Öþ*P m°‹‘vLM•õÒñÇ‹]7\õe3Ç-µëü?ì¸ÊŠnGÝ¿‡‰EÝ1Ü+«Â¬«j”Jº÷B×ué[ÚTmZ±Fr„hAÕk«PsXÝëªV{ èÌ3íWøëÍû­ ÂàÓ™#ª[S^çÇaí_ëkKø ®HH%€}DKßméI´ íÙ\³V*¬}Ìã¸ðÛ-Ú^×ì÷^½ò>ÞÓ¸ÙX>àxµ· â*pÜZ»Îàx¶ã*ûD¨ ªUnˆ°®¯ö´Z^ Œ;B5ÝpU4êÙ·*8~y\Å/GÝz–BþêÒ»üù6?Xæzßm6 p––:†>ÖvnÐE'¯«lô‡í¡âK$G úÄnÇt‹hb‰?šgéäKìA˜wÔ5[M¼õ!ýôÖGª u¡ÃÇf<6íÎú Å>\ËÏÏ¿ÉŸ¯Ù‰ …Q+ÈQ&.¡=X³þPôÕÞÖ«.îªÒï}ýìœM´U¤ =‘6ŒÀù®kŒAaŽ»ë7ù­í;7Ï0’~cHlïCÛ[Ûƒ`ˆ <¼v·QêèƒÖ1¶òðû—G×íñïÑ~t6Û{dÝž@Ž*ÒÖãFÚ "màxôÖ‡ .)ŽQòHÓNÉrmiüBèù\ì¾q‰c{e¯ˆíÞ¸v¢ßµ}›ƒÂc2~ÆéjÁolÃß»y†m(õ.ôCM»ü›÷×[ŽsI(ÕÀC€ÞñAiûÃ=`€q|çæiyDci$ÍÁUÛ%ÇöáXÿyï^*zwÃ&yfrúÎe ¢µ”¦ïiØìÉ）¥Nn[¹~[êôÏ'^v?ÚOo8Tíu1\§n_’¸j[;^³Cú0CScGoU}–½{lý>iÑnô·Ÿ¼}Ñ8ßÃêØ׸Åh¹ß8FÁ®.ªxvãáÀÆÿúòQvù ‘ü8§ËÝ7Éo”çÂ(&ýmìŽß½yFnÐ,ÝG̸ßuÿÕ¥÷z\G•ìôÁ4/u߀EOl]Òè„É>ÛáXm0z~³ ø€þÛ«ÇŒá‚CûÈÚ=ÆÁ)JþòÒ;üõÏ}Þ ¢Óí—•Ÿ ‡ZëS>ˆ êyõÊsñ9KظUPG8/_|›¿þÇÃ_äxêÎ%H,}ÇÏøŒÚ7¯Ÿ”ïC‚ÖW­:´fG¶É±ïÞâ¯yäKFUp ÞÝ=ŒÚãÍûüп÷ûüù…mB«á¯J3ô¿=ôe£”ü-Ç™#xÁ¾Kü+¬Ìèãö•ë4íâ¯pžQæªwiCŸl>à÷Ó~zîu>mÃÚYÊ3ùßþWþü¹íO¨Vp|­åÙP>ÖÂ,C*üçr?þð·Ìqÿª­û—ðLþë[ßåÏÿéѯGH×-¯2Á,ÃU;Fz_ºðÖ¬w¸ ßžÞxPîÑ -%—KÿÐTÉV§$}q×ÓFèÞ_(Žžý 8>»é°Áñ/Å«Kc·àˆJ¾ú7Œ³!‚QCUÒ|À±|åòQƒ#Œããë÷§hÛ÷ÏüšYþí“l,2{_X;‡} -8–¯\z×8bÚR³ZÎàˆ½Þ÷N½Â_ÿËSbT›mcìCÑ»ÏmRîCa‹ßºvr6>sÞøVÿ@Âñ0*„hýLc¹b2õ‚¤ßòíë§àôÒ)=½°^ž_ŒÕáߣ}çø/(l vOm<ˆ`¸ØuÝq9b±ª‚²Ç–p9àz :°ƒØ†KºŽ/_|‡š…ü¾=ö/ºo`¸ä{ö™iØ I`bvêlû•…ÅE÷^ý~\c»7:=q±û:—ñò°ƒƒÿ?63™,ý* ö&ò\»3,:jãÅ 6”ÖÊSïØ`ïÄGh"±õ¿£g*‘ª£¥ 6´Ç¡ ¡”_Ó¢·&Üb±UåæÖ}¯¹øB¢aú%yìÔü~/©$šˆ ……ÃÑÏ¥">üùE‡inf@¸ z~j~†ã/Œ¤‘ÝÄ_ÑÁ¹En¼#>(#_§_´g2&qªcèi9™Y2\…¡˜_˜gD¡7Ò¶-8qaÕË4 죊ä ìH`ìÛ8¡é”F0:Nð˃6H J`ôÑ_€ñòðn9×æ/ó{NË„±¼3ä ×™ÈQÌ#X¼¡ üÓpìˆñ’Ä*Õ¶lW”=Ø[·Šõ`\PÍZ¨ªôtcL±#ø“ ± ˜„hàÈ¢TNæ˜S+ßS†¾.ïä±#¨|v~Öj•Là¡“=˜0ækس”`Gæãq~OÝ ?|äÅŽHàˆå• ¸A\vÝÐÎD˜ óî7ìˆzå}>xý ±#ôf¿|Â|1\†ÛŽªœqµWöQØ? "v„^ªökr[ ¿1 wÅŽ LÏ §„ë‚ðc@ MžìHïø`âøÌNhs¬ >¢…^âè¦AE9¼{Á2õžSó¬cl ½Ž×+òFȪP²Ä,|ìHÇp¯×¨¹ñ*æ¨àJºÝC1ƒ0ãÆ+¤áؘ¼;C=†yÒ!Æé$0asÅG!¥î QY,êÆòci‡cGèõß~ú%rÖr‰,“^«+VGÈÌí¡îÀ>b¬.063Ñ£ß?ó5_ÅÑYó`»nD—‰ %°‡aŽúØ%Àg‚üÔx§à®Ø‘ÖΙ ÃŽþ˜V8vëË8¹°ÜÒk*êØ._ë»=ïC…GŽEA$ÚDtYReA«DˆDŸä(Fd}u£±Ð±#“³Ó·=!&Y¸}¤Ç1y¾ÑÇßà˜ìHûPÏ ŽCÇcÓŠ&Í™ìÈu‘½¯-5k 7&;%ßæ‹ S½˜kã-ÿpìȬz+ñZ@UzOnÄ&ÚÛ*Sm1Á-ô¿½ŽQIFû¬ ýµqEâí½;®Îù´ð9ð-qÙ]bÁ`±Í‚çWö½dï¬ßh˜¿”`G WÆ¿ÙËrêÎ帹iRµ¢¶-µëè»8~rK¸Œ×U5V{½pìˆâxûâ|Ð6 šp›[”£Ô2ÂdéP‡¬⯠À¾U[ _:;Ò36ÐÒÛæ¯Êò¾sÿaG‹È…æÁCX½ÝàŽiìlä…æÑMXà%®sx¶ýʈj¶IP·Üà=ñ^¯§ì겕«½á„”`GŒè%[”äÂ7:ܘ½Ùƒ#M»Ø!÷æ™À-a¯ï ÅpìÈÅ®]£}ü,ëáµ»‰#v7oß8màlˆPÛ^76‰m‹T#’¶Ö®“&ëÅŽ@/±-3ÆâàêmÆo8v~Ëë×qqY]}iµ©½+väè­ Ø.ö˜Om0³5„cG`8–ZÚ…“ÇŽÀé2{LÏl5¨<µÁ ’¥;MÂioÌ4}nûì$ÿøÜkŽíµì¥yE¬Ä$8{;ê<þ^J°#ø ˆ%F"ÁŠ¦ê†pÅ™ /l{ÌØ„cG ½ßÉ„keª ÓŽ™[˜ÿþé_ÏúÞ£³´‡öˆW¤;2>;åÆŒmËk;`b =ìœÿ=õ+ÿ¯Àº¹j•н+vä»'^FüNv1_ß÷)ãaJ°#ÿ|â%¹aÖù%œ‚ãâ~‚[¨)h‰û¢küÆþÏ›”`G^»zìJ¯{’àµ?>ð‚Á1%Ø‘W¯¾¥Û³±"¶Ø|ýéÁÏÒþevaîÛü4p¶iÅš§7¢Ï°PK)”ټ“2$;‚}t ãp8Ö4±æ…Ò -<-§O_Úõ4oè¾æ×.vÜCE9ß<ì¬ÊÑ™‰<úãÀÆcÓ÷ܦ#òIJ°#Øî}ëè­ ú°*ìÉóqWìÈß¿ûƒ1ódUúøW}I4û7Œ–`ìX½Íðl û"±#1¥6+ÿ`ó£ðý†ÉN`ܘJf¤§iÚIÉþ±sÁôém{LbGP®"¿ÔHsWìV¥ÐØü;==}{í::;‚}¹Ü{“î°äÀªÍNIC™#Ïتd<"ÌH¬._é?{\6ìŒ;½Ô*±#–Ìù³|-vŽñ„÷¹•S?›{§T\L Üÿä‹´î“sÓF(‡~‘ž–°Æ}/i;2ÓÍ(mJ°#‹¶í;_r$--–ÈÂÀÀKÌQ EöÑ…Øœ`Tˆ2‘å"숟RŒ ¯fÈ6‹™bíùg<åôŒsöp숛M$ÁBÖœFÉGôúqŸ;½£vÒ#lË` šjÜÎc.³P숓&ÄNü\ÖFºÉV¹=­ò–Aã_Ðw—ˆNÅE¹,ß-ÉcGÜ¿Ú\@NAVzÍÑôü¬='ZEy2¼u¦;297c»E«ŒDF†¡z±#èÐøì$$šwoY²Ä5+t;ÿJ8’<ß½÷v„nŽà¯è”Œ”ëk)<»ñpìȨÎÄKŸ•HXö¢Éò¼bi<±#ú¯Ó¬‹P@*ÿ% "v„o%°,ꥑn!ÖÕÞ+±#uú+kQybX˜“ï‹Þ%‹¡kø+ôƒÖŸÎŒ•å;ùB0/¼ Ótf)!!±ê¢ ˆ„Pç„°ÝòTåϧŽÁ_gÇ Õ0þš†ÝŽTÂáØ‘‘©qykONf–ÔçU…å$ÿð›w!©î$¬$xÕ—VKŽáØüUŽ*4³äXS\IšüÎP÷¢s­ sD)í6,EqˆðC…êpÍ8µÇŽ´ uñ5géé‹Ù ¶Z½W{ع9òÅbTH±ž±AÞÍZT.mlr ½¨üöP÷¼+|ÆC÷ü"‹B”¡;…çÒ5;ê#¶.ZÏ+ óslª¨—*1;‚zäkÜùvV¥!!ؘ lÌÝY8;iowáq™ŒX†ô¾ fr³ŽØK^”S à CC°#˜µß^ý€¨8ìñùkE~Éá&O,$yìtû׎'8zU¬­1Sˆ¹ÜsSzƒ( ¶W®.ö£C’ÇŽÈ¿‚qä£E¦òËß™rÍÜN:â¯FÐ:%Ø‘—.¼ÍÊŸ]Ž6l%I#vŽo,šÚ+öøBÃJ;Ò1Ò+o&bMHpƒA:`÷Ù3ÁBƒQ[¶·=žŸ ¿"ʇl¨J]&ëngàH?µá d)_R‚ùÅù·X3Ã…ž[˜ãCðúâΧáý¢?<û*ÿ¾zh<ôùC"9„u7ìÈÎü†Ítâ8/Ž}ò¾¼ëY8;r¬õÓÆW(ÿ˜ ï.:;kÍ,=–Àô…¶ösñ…9qLA@§y1u‚A¡}ñ½'J+aÙ™Ù2ÒŸìÈ‚ë‚Rƒm÷ýŸÂ"›ƒ¢4oà>æî™Â±#2c… bM"ìÈÝècÄŽ0Äò>2¦À˜Ã2ä@ß]äÀl牔›p숊'% :jKd…:ÕòŠ©À‘ŽKl·U´ðËXG§ŒÄ;¨Ê›hIì]1Ã=ÂjÇçx(èT}/—RWUÅHó©å¦‘¡© õC “í]áÉcGfTÒ§õh8& nêh@ þÍÍÊF¯gçç oê‘ä±# ñ¸t9°[Çé¹D~Ô)9>ˆØü\†ß°5°ËãWlŸÐ™t„²]MÍÍpgý©Gî+ìˆL:‚¾ç¢×^Öž›2–ÆŽ`Šå ci^1„alz‚EÈH=Ž˜fœNAVa¦dŸâúÃŽ@_ÉS4&+#kH_C¬Ô#áØìgæ]-Š–æa¦k]´±¿L;"“Ž`ˆÐԡɱɹD¡gøÊR£¤.qìduù/É+ ™g$ºÝÒ7.èI=‚ÁÄu&Fµ¦XaSºGû™#ÄR®ÇpìˆLR¦2ˆä£U,´Ð‡ðì! ò‚‚I’£‘z$;‚Ms„ߌޡ³,´PbÕEå”tÄr•ïêòÚùx¼k´H©G°g“?D×F§Ç&)[׸‰@ˆB°#2鈥ßlV÷¶Œ$8Rê‘®±~üC—¢kØz±WSe=~r£?‘s qÅÆ•'”R '~hã‡k+PàöP뱕ÅU:Œ< 9Æ }ÄYà‡ëªܤ#aG°ÿÇ;CÝR„dê‘pìˆN:2ÇA/L¶:4õ§ ÁŽ@-kÙ³é‡ë*!N&Ûg˜Ñë}·ù"*Èúˆ™×W©ÊTÕ “ysàëÊZ‰ ëÔ¼¶¢Ã%U‘z$;ŽNÑ\½*=–~½?‘Ë¿"¿$‘tD­¯l4Õy7‚‡×›z$yìHÛ`',¯­¬‡ É>nU/s$Ä>y줋º³ ä,àe¤åÁŽà‡t§2ÑîúMðˆÒ] ’F!;b$X¢@K_«/#õH8väR÷ þ!Ä ¡¬¦u°ƒ•‰?õHvzÉY_¶:pÜ^·5_èJäÕÀa…ʤ#˜¬›nφÁÚ¡~8-_íÅñOxi7êÛë¡T9Æ€š·­\‘¸éh!¥vyS$‘IG°ä·×5«Ë¤…Qê‘cmøðsex¥·uÈ]¡ÐÀ«× NŽ^uß8´ÔYð6u}uçu¶/Fê‘pìȱÖs :\¯~X~¹ç&Ƕ¡^6­hò$ѧ¨ØJœïlaŽ”z£Äʲ„À*c-³k“…`GTÒÈž£bHðÍæšµðR.vÝà£|hÈÝ¡ÎxCG!ØXùÇÖîÇ“Bh÷6nöÀ¾ˆ b°®²Á IxínoÒ¥`|OܾàøÕ¶þ¡@ $¿$ßÚß¿j+üêc­Ø“ÇÌb…^ëm»íJÖþÕÛ ˜ÈUÛÐT™t\ N?ìh¡óq[ïq®öÄB°#œtT“hõvh<ä”zäõ–ã®,Ù˜DÃÙŽ+¼^`hvÖm„J¼Fiz~öDÛB)B"vD&=¿åa¨wnœá'{6K ‚1’ŽìmØŒïß:ÇzÌH=Žyëú)þ!DbKÍÚ³WÙjÃå0^· ÁŽ@!°@÷>µá ¬ó[×OrG×í•[¹ä±#ç;¯±Bͯß•(“ô<¾~ŸÜ2,väÞdïhÛÊfÈÞû­v8æÊßP˜ÉcG~vþ 渷a˪òÚ£7?tw+6\èÃM;¤#ŸÝþv o^;Á?4R$1’Ž|nÇpù|`é<0»ÐK®ãÃÁšBø…OIŽÉcG^¹ü;«phá}k=‡œ°#àø¥]ÏIG0Å0…¿ºø.oµ(õd˜ì—­€Ïn5ÿRiÇÈ=¿ùayþç¦ò§I;‚…3îZ´múÌ5£á)õ¬À÷˜àû> YÂÆ¿iÚ‰mÎ{7Ï|èZmüð+»Ÿ»Ò{KiwÁ©G’ǎȤ#°t_Çž[¿½zŒ üÅ‘/ÈýKòØ‘—.¾­n«qN!ê?½õ8coß8Å(eÅß¿û~òôƃpa³øÀ§Iÿæ #+Ì \‹ž}•7w3ÕÁŽ`ãóßÞùýÌÖÇàÕüàÌo˜#¥ÁªaÃò×¥obÈÑœº/l{¾ßwŽ¿Ä(è–g7&dû‚þÍ#_ES¿%’Ž¼¸ W|O\sƒ#Ü .U”Sð/'_v’aÄbPhòÄ#;òOÇ~®a ª²ƒk¶Ãu|íê؆PL¬_Yþ¾ÂŽ`öõ̪¿cO ïƒÓ°<¢•ê;j!8h˜+VcIÂÅUG@ºí…¹Îpì”Þ𴃀uÆ>±gl°]¨gúíõ²MG §C ûåîÚÔ¨B,± œ³ õ¤ʰ‹ê¬Õ…¢4”®ð¾eÃŽôŒÌ-ÎÓ‹ô?,ãÔ|â #õÈò`G0ª£3\4vZ, æŒÏ´ÑS('éˆnPF,-?;Ž1½Ò@¿¤Ô#Ú5J¼ì _QO),¨i¨MGiç(¡F2¦t_ð¢ÿ"þ˜*¥;b&ÆñcGôÃEï„iÌ‘í×4ÿK m–4ku1’d‚‰»‡’–F$Z%î-ï­Á¦Pô³í6•’pÃø"ù®pº÷º¦ìZÅhŒdf†NKˆAáÜ¢…Ö°)’.Éû,3u–Ô3'–ãÂ&‰Aå®eëʳÑZôˆ›aë>joóD^¾…îHœØµt°Š²&ÈWV•¯t± G;"2‘`.äŽ(;—TÞï_Ê"!g;ÎMbk›R¯çÀ/éb¬0ª­ƒ¬©0€ãq#¦–FQTÉ@v{ î#~Bçâzõî`eA©Œ¯W””äaíË‹TH„څ䬭¬‡®Àñ±¤tuùJ‘›Ä†Z£QU×ÓÌ'"ßù%-"Ú¹ƒ0@0ÄM˜ Z´Á•veàiK‰qB(ƒèáØ‘+=­îø©î¨w…ç¦o%ʯ­l -;Ò6Ô¥ MH'bW{[Õ¬%zTØÒÛÊÚÝ¡²h!f‡IaÐ7èƒÝΑ^Ö¢øúØ*r“`iÏ&c{ ©C°#½ãƒ¼ØÑ_¥ÛC]¬¢ahËj¯õßæ…P]PN‡Ý2]z$BòØ 8_Ý…ŸÓŠ–é rÞkÝ“ÅŽœWY4œ…†¥‚‹rNôq]Uc¡à‚Á²X*,ˆ~ÍåZ_Û¸ ªQo¢$ʇ`G0õ¬°Gß=-Ñå–‡^Ú$Ò‡cGdX!QåEÞæm+×K#‚¹Ò{Ë9µÕI(ÅåÕ-X&P&§t€.²h¹«É¦A12ž æ’î×À²b_¡—ÄKÌ/m¸”J'@$* ¦6yìȹŽ^hø9Õ ƒµ“ìÌ,)–;êš±H ¤Èá5;¡‹8´ƒq¹ÐuÍäM¤C°#£Óã„Ñ¡fïmÜ“×9ÚÇoQÃ~\½_ ÉÙœ×ÓÔ–TaÑ¡;ìã+TåòevÆ X!Ø’ºfN7 ?Ù®óaœ×Ó¨òåµo]O^o¨^…©Ä::uç?„HÈ¥‚Á80ò þ½ÂÎHK[v(Ì7Ý€–­£#KXÞ³ LáÕÛ‡§Ç¯ˆ[“è(Y¿šÖI¿,É+’׺'H0†SFQ¢k½mwDpwæÓw.óËâð%šµrøíÕ¸žÍ5kQò½›°½°N£Jrò´÷ùìVZÖTÔ¯u^aO”‡æ„ÿ ï÷9´zG¡†äÊQ}fãaq| ãõmÙ놼ÉÄ"vÎ^4œÞ ‚1”!@Y>;wR,„OoyÄÒÓ\Fö‘u (C8vD†ýö5nÁBð–²ù€Üú…`GŽÞ<Ë j†—w…[j×ÊÐQòØ‘w5Sþ§ç^ç»ë7É—_—;EôzK"Ú÷Dó¨#˜ã÷o%`g_ØéC$‰éŸ’ b ó¡=뵸¿´ë¬;Κ†&ÑEo^;Éá1x/ÒáI;‚5ÈQ[/R˜(¯ýIÕª-ªüºïN„Äö¯Úm “*%ó‰õ€HòØÇÜÁôSy>ÅB7~ ‚_Ûû¼å^Oãö¨ü© ~{õ¡í5F¿Žn7ûé¹7øå XU I;µÌWµÂÿ'_è;Ó@„'X€? 5ÀC†ê*ýû?½›@>¯1:ïÝ<Ë,ð•‘ä±#°Ôì A{fÛ£–†òpù†ÒÌéϾÊ?'±üŸÇ~Æõ<·éˆtàC°#gı8ÐÞ/ê(ôCáÑI•‚Nö‚FŒ0(ÏV>+=óû?-Ë'‰éVX®Áþ£ý/€#½ñOàIÙN;S"qä‹\žz]ë-Žùs€ß>»é0–v—B~$Ê}ïó2Ì™$v>‰^8¶[ÃãpŒëiþúá¯`ÏÂÛpÇŽ=Øz•ÅäYÙÂ$±#§ï\zCl:þË“ òúµã¼0¡Ã¿ºû9.‚ÁñÞKLÙW÷<-Š½Ã¿¹åc±êGc>hý E¹ßÔêúœ65(ƒÅ"aš!Øx•?Ön…,¡² F°C­åxÌahýÉåPÜWؑ׮‹Ûq e¯­¨§\Ø11vdW½ºN;YÊÉÌnìB7©”ñÖD8v„ WSEüX,4}>æplvŽ€n3vdûÊõéié°S1,4(´Á9µˆÅ ²riÃØ:Ð99?M,àJ§hÙ°#w†º9ÓEeAInfŽY¨)ª‘¾åÁŽLÏÏLÏÏR i±4¯˷¾ébÉÙiç”#fe§gR¨”N“¨Z°#^ ‚;byá#vä®t_`G,_–‹wEšüØË{mMv„þdbG¼ÉpÒk,Ü<ØeDfÚaìH  „è^±#&â<\ô`GDÞŽ`ì¢K¿Bgåv$[§'ᯩŎ8@?tFØ ISXç2B™ž„º“ÅŽè Ï‹!Ø ò cG²ÝûÏ&Äà Iz†„‰ÀØd(³áIOR•—‘ž¨ö¾ÂŽH8ס©Q^h†Å ÁŽŒsb@M¤ˆ~@äÞ±#U:®ù‘@„;B0þJÄé¹™‘éqž,& ÁŽ`E𱑭_† Õ¤"@n]@$Iìˆñ'x¥”K_B0 ÐK„ÃÓ(IìHšÚ™TS–jiqN¹qèQ ’ãˆÜ#vDÃDÊ݇ãâá=aG4L$‘l£¡l´¨©-®rò»P ™Ù—€~HtïØòþýá[“Y±õª'I€ü³ÎÑ«d" ô‹ ÄŽT(xGbèB°#&ˆÁCˆ‡Œ¯×)`ŠRò:”†çЈ¥£#–F°É¡ÆÃöá^·16Ö)Ev%v«jAféÀ¦šÔ¿ÀD¡dÜ…Œ±¼‘ìþäÂD(Z£S|/È ==ä¯!Ø‘[œÂ+ˆú¨%ÓÔ#<ÌËν=˜È¶ˆÁCìpø¬?_]v£ 0 ~}œ°#ÅKç=Ò“.öjðD*Ïìd’0ßÝ©J@ =;‚‡x¹” &bi½Äç’*ËHíú“·/ñN*¨®Tq„rËöD’ÇŽÈ8k vOÐG¹éQœ4)Ú¿jÛõþÛü+XP’a¨žGX@DÁŽ@ ÊXèÔ–ñ¼Hú‚‡X³lC±#E¹…ÛW®—éý&"bLè’2¢ìÖ¬²‰ºYÕ:¡ˆåÅŽÀ¥i^±ZÜÀ¢‚OÄQ†4 €Hväl{âOП„ÄBæ‡u¥+°69–`ëUKGEöñ…R&Ë‹=."ÉcGð'ÇðLDhª‡.ª`ÿêmo];9ïŠýšŠ•¡?ÖzžýÔ C/Á7”‰ÄÀŽ@K” W9;"ÿˆAÊò‹°Ýö3:Ð_Z¢ÓžX¿ÿ|÷õ¾1Ç”h,ÈK7Õ­÷!уˆ9&`"{ÒÆ;‚ý‚ «„`Gð§áhù±#êáÖGøsvíÛsphͬ>x¯\~ÏxÈ_ï;Ò\½Š–vàC¢ä±#/_|›ý™ .äkÇY§mðD–;¢ÿ”UŠÇã¡êç6‘þaj±#´ëzÓyè`G$L¤Ò Ì>$J;âÂDbGôÃý;ò¸ ù7ñ0µØ(=)á¨ÜÝ=õ+>}rÃì=eŽ4?v„JìÈ6÷²<ìw6)ÇŽ|ïô¯ùÂüœòÀýFJ`²« +^½šÐÆØ‘§7B;Â0‘5 Äò>$J;òFËqvZà?»IÕpVJ®òÃç6‘0‘@ìÈŽ•vÖ'ª ÁŽ@ÃscP9)y‰Ñ‘„æÁŽÀ7¦h7ØŸRwph€HˆÐC¢ä±#§ï\.„ýMJT“ˆ$‘²‚°#–ˆ|Qp\;¢þäÂDl¢¶¸ æà‡g°zÈ_“ÄŽtŽÐŸÂ°#/n{5°B0KodŒ‡ÿíïqtDaA•§ñ­÷47?Ÿx(Üä±#òOØ IT›&ï+ì,TÌE9À^ !±#ë«Va‹§“9Øj ö€çDjéøÝ;v„N9,çEvd|vJò¸•üzhrÔ=¥TÃsŸ8:‹ÅªÝÃ:‰ÁήAe,vdf^gwG £HY숥ܯ]=ÆòÉØ‘Sw.±ŸàÇŽPjýÔbG ì'Ü#vdoã–ýí ™b˜ˆLFòï ;²ÎM1’BìˆJF’ê{ÅŽ)F&"c÷Ž‘ZìˆL1Â0™Œä¾ÅŽ‘$±#òOÖGÄŽ\òD>>ìÈ÷OvdgÝÆß\I¼ð½ ØãO÷‚¡#Vväg~Ã÷E.väŸEŠ‘{ÄŽPf?v^¶Zˉ‘ºGì§I!vÀÁñ±#êOÚ ²Ø‘€Hj±#ü§bG,ï(+väÏ}.;#+µØ‘€Hj±#Yìˆå&#!ºwìÖ vs¿v$;#S®ß$±#Fj¨û;²×ÝÚHìÈêrµôÚ†:— ;¢€b~ìÈÄ씻߹Wìˆ>Llº?AìˆåM[~bG02Å9ؑɹ™8Ýü„¡@;’“‘­£É‹÷vdÑF3> v$¦’‘|dìHléÄü9ÂŽÜ•"ìˆóðÁÂŽ¨ò‹Ñ)’âÆC—c„qèãÈ;™Ññ;2:=Î}¼o±#p8¤ú}ÆŽ`ØùøïAÄŽtŽôò…{7v³ ƒµÉcG°"XŒ—;ÒPº¢obøÅŽ`: «©ÂŽ@œÚè-ä;rµ·M[í€ùóŽ@Á6W­J!vD^Osßæ¹O°#eµRóÿžcGN·»×Ó|üØLÖƒ‹ÙQ·k0UØ,OÒÆ˃¡‹løk’Ø‘æêUÇÚ.ðO>nìHEAi}IõŠQÙ¬ß{Ÿ`G~‡¼#‡Vï¸ÒÛaG’ÄŽ@8Ìo}BØ‘ß^ý€Ýã;Â_±#On8 uT’Øx’rM}$ìȉÛØÃüD°#GšvÉà°#P |¯è}‹ùÊîg±öcG°Ï‚£õ{ˆy÷Æék®Jà°#X°rr?>ìL]Y’Bì¶ÿrò—\æÃŽ|ïô+|b„‘%v´gôh)ÄŽÀ!üÅ…7åÃ;âþ)5Ø8W_†2ÂŽ,'v›øÏvÄ eÀŽ¤§¥fç§;²¸°x_äY&ìˆåIݯwÖx˜ vÄ¢d8ü'º³Æ¶ãžòiº.eg¤©0¶çÎ-â0‘À‹lˆ’ÇŽÌ-,¸}¾³Ob^ìH–¾žÆÀŽäx£°Ëƒ™[˜—5V’€Œ•ÔΩÀŽÌiŽ¶µÄ5ér(þ½bG0&ó°\ì HX,”Õû ;‚Æ°°q•Œ›ìÈ” B}ì gÄE6Ñ5ü'ºž†¿R‘%Ä TV‚±ô†œ>0vËD¡">ìH`Ò9”7fAbGèzË‹!@ ~…ßØôˆÚýpg ‹ÝÀŽ¬*_œå>¦üΈõQbG0\Éa`G 4J;‚VAãq™ìH÷X?Gôï¬VÁ^EÆ×Q9-ãν¦x zdJ$võÐi‘ÄŽ`ñB-´ˆh7aG Í®÷%š‡B,ƒï¬ò¡¸QvÖÍ Þ$°#Ð{. Ä²> vDÃDf ìÈ­v¥0]ì¶4·:±#. oÔÿ57P¹;eŒ¹Ø%%÷ŒñÃD¬ ‹l.õÜ`— ;‚ ’z8µØ¾žFbG0¤aˆR‹A—i¡%gºžFϣĎ`$”!;‚ ’H>?vN‘ìHvĸž†°#ÆE6÷Ž¹Ò{˹½[`G.t]gg¡d0&;²µvÝÐÔcGèzË‹!@‰{="ÆŽ¸Ù|,Ø‘ãmxïˆBKHìÈþU[á:Ø‘Ãkv¶Šëi\ìÆæ½cG`iT%vº÷²€éàáåž›²r?v¤,¿ý ¼ž&PBtؘªÍ:š(±#’µ•õò ÂŽÀCxïæñðwÁŽ@C ±#°ì˜µwÝî0v+Wʶ±T˜S]Á ±#ÐN2`Z숺žFŸãK숔4l:Þz~ÌU&ŒyóÚ‰…ÄE6&vZ¿5°#¯Û+7)!Ø‘wEŠ‘@ìˆVy;òÄúý¨ÜÀŽ<³ñð•ÞÖÛ®c˜Æο3ì¶tCbG %°²¸|vªþCaýwÖÀÉ¡ˆ,Qv$ðzšÀ‹løëG½³æ­k'—rìHàõ4Ù}"Ø‘Ïl} 3b`G("Ë´BW`¯…'̼˔ Þ9ÚÇ»}¬ 9ï!ØôZr¬.*Çø ÒÃ1eyÅM‚!‚,A«0Ê  ri‡`G0A,í …b×ʳ€ Âú•OJr * ʦ½ EV•¯D%ÒbuùJ}†>4ìÂÂ0ј5&±Á‘î>hì`3‡=$ºyk°C©#7¬N±=)Û몠—Ü º’×uU0yX/<ª )Û!ØKÅcns²¬A ,T¨ì£{ÁŽ`Ä’P˜Q…¯ßÒ×ê”Ö+[šËÝ7Y{7è'àÈáaôûdýD¶y 4dÛ “PÄÖ6}DF:Òp” 0N‚Áèq¯Á‹N—°Ïd‡òÓ¦Ò“L¸OJ1bà(1˜¹M;‚&føÄ:ëBFÇ›«WIŽÉcG®ö´ò©,,èâë•žV.°¥f­ôB°#Ý£ý]îa7Â&-Kº¯«¥íŠ„´n!؈±LY6þ`!p€°Vœ³‡`G,}tΛIIEA)à†“½[dùìÖ¬£Bm¥© ¨ù”ˆÇ¬¯jÄs½ñ$Š³;ÐK¯qÖœB¨®'yìÈÅ®¬´Á‘€/]x[[4evÖol®ZõÒ…·ØÆéô$ëàp¾+‚Ÿßñ¤ÿƒ3¯òÉî#k÷H¿"yì–3¿-[|hÍpüÞé_sBŠ|G¤'ylÝ^´áfûÑ[gé úò•=ÏÑömþhÿg,5Ao ¹NÖÈ>áï%ê~ïf¢ ¸WÍ ¦ƒu5!E^¹ü×€ÇþU[árÈ+^Øú˜Ü·†`G ÙûÂO^ÔПƒu5ÊïåC°#hÃ÷õ8Óˆ}vûpäà«°C¿=¿Åƒ5I;íý“9»’ýGû_ÀþâýÖs]Ïå >H”üËÉ—ÙY…&” -;¿W(@…Ç®í­ë'ÙFù/ízF¢IÀñ?蛹þîïͺïä<»éLÒ?ý1ïò]¿~´¡¿yä«0(ßéIþ÷G¾Š-´[@x¡/ ðDòØÔÀ I[Ï 8BäX™ÀJ?!;ú?ûmþ ¡Â^çOÜÄl9™Ù¨ÿºêõ"û›‡¿ŽPª$B±XL €ðdB°# oý‘å†,ŸÞx=hÚcmUP˜“'sÌX÷väDÛÅáéQ e7êýËôüì{7Ï0vÎ-þô¾ µÁ¿±sÄþñF»Z/ºöÔ” ’(;£?57CÃ3K»E9ÀGìßã‹quFçbGè4 ž‰ëµªQ…Åï$¸ª¥#€´µiém›×"ü“%·À˃u ÷,*YV„eÔ‘‚ù® /²°ØÔÃÍ5`d0òÍpø!(Ùq^1u§*±m›bsôK SŽ«ª²ÊPåç@^OŠ¡æ9u|áàhrucf8J«°ò@>yìÈ¢½˜H‘ ß緼ؑ4ßOS™H\ëEO,;’–&!É`GdáÄŸ"ìÈÒ”Jìˆåƒ˜ÌÜ ³=½SèN¹”K&,Ñÿ2GáØüiÑ‹D1Òœ¤Çœ«g¸¾˜†>Q1ú%BÀÈCI˜ /¦숥Õ÷H÷'&–¡ êɼƒZ°©q{QpŒ‘ Ãz6Ð0 1“á‚N˜’ÄŽX:fÌÁª˜ó † hŽ ‚v‚‘l†å½-_ÎcòØpœtß™¶X+ň–\¾Kp|±#ÀIà€î^°=éjŠ²óñïi1!àž°ä’ï+ì&e\äMÁ(¡/R Ö!Ø$:ž‘ 1˜X+TåIë²4vÄR1Qez3s$í”1NëÄŽXú€ãý™Ú/¡Í ±Æ€Èá ÇŽ`Ç5pÇÖJ;?+ornjÑv\,pƒuòØ4•ãÐàXœ[825Îz•@!–>(aq’}$ªraȘ>Q, °B±#sakˆÊ!äRV±wE3ð¤}ÄÍ~a+­545Ʊ<±É—“ÇŽ@Û‡zX™ ˜xQ¡$½ Ï”BEJWÜîáí%,ese ÁŽŒ©pn1#ãÚ/ ¥ÿ¾9ÐÁ!½tÃbq9Ú‚¯g;®²}A¡(ä\lR¯òÀâ\î·J•×ö¹í¬Œ,yvi¥;s&5X}x¾TÁ#äÅè#V&4îztàÛPZ£`.w.ñP“oÓ;–Pì{7Ë !ØK½?ªî£±Ýf`EK]vg¨ ™¢º@­A~aÚR²¡@! ™Ú ?„]žIØeu¯d‚B8~ûoz)$Öë&ý‚=Ý¿zþÝ6ØÕæš!Ü,©êéåÙ‡&Üá]˜!Ø,@‘ýBi ´ £òƒkvàßЖmZaŠ‚Î^™#/Ešßo=7“Ð0êN·ëýn¶-[…B¥«™ÿ±¶ Ì õÃ%à.7}C²ìæªU.ö œ)ñÌ¥îœØ}l®^ÝÒÛʈØY™”Ë ÅŽ@Ep+[/üÎÑ>Þ_hPˆ:ƒ>›€˜ØüZ ï‚GµI%,i€½~ûú)~Hv\z­¬Ûc@8ìÈôÜŒ¼ÿˆÓ¹ÑW¸pO¬ß'7k!ØÐk-ÇÙ­‚Ò«/©–Öì¨k–z,;ÒÒÛædtso»ÃW~uõ0;g‰#ÓôÛ±é N:‚ÊŸÚpPö1y쬆D †î±~ÞæÃF<ãm/vÄÒ¡Yö¢1¹=ÈÏü‚3ª0U›DŽ+i숥ïób×:3-êK‘m…À*ýòb"’MçþÂþü–‡¥×šìˆe^>äù ‡âldâ–ÓÈ$Ch±#–¯`‰©å‘ÔH…þËyu,ï]M¾ªÒ F8v$®àWq+¨2Ô“‘îÆ2Ó•”Ë@)=hï7˜øXüÆT%A“´±h†KsŒQ%RMxŸnèßä±#–W]¤C¶žÂ"vÄÒ÷°ÈQ•s#JwˆÄØìäR²Šæ“~_aGt%KI̧*ÁŽXÞkkˆ˜oNFV¡w¦Â±#XÃS£¬‹$©+óK #ô bGæ¼p&[Klµ·áØh‰¾ñE¿:ñ¹rc)%¯ž±þ„‰±=Ú¼¦¸’–|H@Œ%Ñ…5ôÓ'aF‰¦k÷ÑX¼!ØKÍò´oTªŒ k¬»aG „üv²QuNjb%à á1Î|ñ#XøwD|Wxa“À‡þ·gÎ ³óyTouK ¡,[[RelB°#–>‘—XI(Ì‚Ý:ÔåÛ(ùÉuÓSÉD’ øªglPo¡œˆ…½áHÜèX\\4+Ò´¦¢Žt›Œ$@GûwMáØ‘øââþöE;ØÏY[Ù`h×ìˆå\[3mùÉVD*úöf{Üè#l7oG¦Çä¢öö1—GµÕMFÂŒ˜°ã5TbvÄò^[cP©›3t­ÿ¶ãùFdh×ä±# +Ý·f}NÑÚJ³pòØKÇ_y¯hôÒ¸°Æ ÅŽXZ$êEIßUeaØ,Xyþ. bO§xLáØ8]ç:¯Å—pï·­\oXìˆÅ×Öé/ˆ)L i äHâ %£’èÂú|YÁA&ƒJÙM•õt]SòØK¿]-Q’’0 ¤]aÅdÂn’îc:¥Q±ôÅÕí^£ÀŠ «Ò@&…cGèÚš@WãÉ/ßV•¸:Ðë„AK¬qÁ'Ú.ø¬¶CÆ…5V(vÄÒ1ã^qCœ$UXŸFÁk=/ß=ŬÚfldB°#–ÒÌ­fä©jUùJR˜àõÁ­åë’­ÞN»ÇDö&OÙ’Ü"™”`ìûB°#–÷ÚƒvÖolðj×ä±#–¾íBf@”´»~“ÌÒd-#vž_”˜ý N#ÄÌp“ÇŽx®­ñZ[¡9D/ 8ˆAP¼t)SòØK/C bdSŠK‡^ºðÖRÇ/ÏnˆØK‡÷¦}’ƒ>–æûó…`G,ó™3gÑVoBø×HòØKOPB˜v¤$¯°0;Áê´PƒDÐK˜¦LׂFêòƒéÝhã·áØ*ài©ª°f«}~j8vÄÒKÌ‹}qZXQPÊ‚ý×94v ¼CÃŽ±\\ˆñJµ²°”•˜vÇûgŽ‰AƒŠ®)¬`•‚aïð¨h]"á_#áØJèBÃ.' T§¯"¢¯³Ó½ãƒN¢,QµÉ«‚\\ˆÙGH5«èÝGäØšcCé æÔ76ä7C _R 9èȥɱ¡¬&Ç+üáØK›Œ.ÿÉ‘NiSæ[àáØuŸÎH·ÿ´:/3WnÀ 0¸# e› ÑÕºª|%o< ð­ƒ $Š;"PFLźvÛ’ÛC]×TÔ1Gá­Áv•‡Ã;úP¿þ¨|J°#P¹ª>D¤º¡Ìä˜ìD CAe/«ô6FápìÔÈv^‰L0îÍ 'dn³C°#–† ù‘(¨¤¹j•a»Ã±#–Vãñž†Òšjß4…cG F®öÞš7Ñ6(&^a}8¼$Æ—]î À…@K¬¯jäå)½Ü}ËD6û-%Øp¼ØuÃÏ"!ïÚ¸3ÜÓn‚Õb\èœìˆ.©1ffd¢d…É1 ;bi$ tŽß­‚ÂÙàsÈ“ÇŽXÚ²¼!Ö>³†tÉ¥-/©a‚ËñÙm³[{ñ“ó¯›>¶2XOºÐ1Qa °#°,?9÷šsÑ5X«§|S‚î}ùÂ[³ ¦2Ù´bÍÓB™@áÈ a‰²32Q†·Øîýðì«ý>4' Öw>mœ=†cG,.Äå¨p ü¶oæÈV™_úåÝÏ0ÇKKàB4¾$ã——ÔHŽ_ÞõŒaeR‚±´ÌÜ9˜ãWw?gp ÇŽX:™–ôf™àÖJŠf«×ä¼Øx¡_Øù´±yÇŽGšA;¯ÉïoßoØ ³í*•©©)©Ü,^¶§m™;’‘ž®ožõh»bG`µáKÄ]Ž–‹À¨-©\)]ÛP›*Øô´´Õå‰÷¯`Û»fæ ìHNfö겕FüeÙ°#–ö÷hd`GàaúÃ+ˆ±ôv՛ЭJ‹¥ÁÏáæøâ"Úo[¶ÉLKÏÂM5€hNö̬Œ¥£´1‚”žeà*R‚±‚²0Ä4Ç47›ƒ¥#w|&,s¯°‘Ž±DÒ ãþ’vä®”zìˆñÏ•˜H›Ë$2h!›ÒÔUuWìUµ¸h{2ÞÄÅËÅCÙN«– HATP)>úìU%à 2ãˆ$}„WZP xd,–™–8b)ÁŽPãüÅåˆb™êª³6¨ÔxÜ9¶S¦%]] åŸî”`G,=×pgGGP1¤qè;bi™Ç8PãmGËgúG ¢55?ÍF}ô×fÝØêãÄìOBÿdfJE8v„hrv î‹kÔpÁ?ðk€»bG,=‰h*Šaÿ8ª(vÄÒÇÇ㪎ØcØ1G~É¿+vÄÒšdXßõC_1\EÙùó˜ìqÄ8(Ž6J¦cTýµÏNNÌ$®„t•åê Jþ%£L2ÒÒ°fý¸ë°#–·Ã/dÛW óºûæ]±#Tþ½{R`C Vä—ú•!¹&ÛFú’³Ö=`G,”Ãg˜ÁŠ z`rd|fŠr`€–F™¯Ð$(ÆbŸ‘–2~L˜u7숥'š:'îö‚êï#¦fpjTÝöEѬôŒJ³aÂö#ƲJ Z Õ¤Eb*šGµ(· ªÀ\Ýtç+ˆDÚÏCêȪË;U¿2¼+vÄÒ˜îÑ>Æ'é|6åyA&&;biÃÑ;>ÀÇè¤ +}}Ä b³êF:!JVýµaF„@U+Š* — ;G{p»¾Ãeìx‰Â±#D½ãƒ˜#RÑ`T”SPããuŠ á˜kj¡ Á±"(’숥õsçhß¨àˆªü"m¥;b)ˆÌL÷hŸ„Õ …hÔ±#–öpºÆúå¨bvêK wÅŽXz‚ð?V&hR}ißɼ+vÄÒK£u°ƒ8*“pìõñöP7í4 "Qê71ÒÛ*7O‚ccY­¿¶Ž‘^˜*6 Ð$(fø °>7ûÛÙû‚–XQ\Q4Ý)ÁŽXZ/µvò‰8Âjû§j°}¸‡UtqNþêŠ:ÿÒÆÈ÷Ž‘ŸKÇzl(«ñûBwÅŽhŽ#7:x¸ ÃKkK1\¨ ’³ r˜c¨¸ߨB’1ì™@6UÖ*“pìqlìê ?°žÆ SÄñF;ÛP¬}T¨L±#Äñzß!yÑêœÒ«}p¼Üs‹×,8®«lð{˜Äö‘Þ׆¢I›V4ù'(UØ*EÁY ZÍUæu®ñ…‹Ý7ûÝÛëàK4–Öøa‚hUKoßhS˜‘\ÚáØKƒ[z[{]‡Î¦»ÑÇQÝë4p‡¡!¨ŠÂÏñJOk§{3seI5DÂoµP숥]hTÉ!«é«/©Þì½¾„è®ØK aKßmåÈiÝs†ªüÛ´»bG,½×;Û~•5!,û–ÚµAK;;B}¼ÐuArh”j g•ìq<Ý~™#86U4ø•‰µ¼ØKGU¡LX/çÂÔú )ÁŽX:ªúaGË”ëVa¬vÖ(óWÛ;I p¼¥f­¡¥;biŸðb×VÁŠ×HÑd9ïø^¡Ý½­½—­µë·¢)ÁŽÇcmçÙO(U™ê7ú]_%¨=­lµÑ¤ƒk¶çûèã©;—e‚>BÀq!)ÁŽG¬ëÄBËÎÝôÿ³÷æÿq]Çèín ± nIwŠ4Ií²/Š,;ŽçÅIÞ8Ég&3¿¼ù¼?"ïó~J>ïM’ÏŒcÏ‹eK–"kßIQ”¸ïûÄJìûÒý¾çÔ½ÕuÏ] P°nY–ºoœ:kUSß[U³Æ»¤Ûî}Þr¶wØI…>î_»Ý+ɱlp~á{!XÚ÷¯ÚìõaÌ v„è³›g ÜuÔÀ4ADÃØ6N¾PÄã|Fƒ:FU¾’<;BtäæiØÔGűºaÇŠfïY{F숥 {c;*oïê­%ž³É|aGˆã±–sœË†¡|o‡h¾°#åuºs™/'WUÔ=Üt¿÷41#vÄÒ×ï]úŒMGh´k·ùâBæ;bé+ŽCöšcZƒ!(¼º‡0ùÄt`ívãR Æó;—Ž…fipɶºõ[—i^°#–> }|í„IÚyÿgïªû|µÕ¼`G4Ç¡¯€c+÷qïê-F¸JK"?½qšáû(fh+ ŽK(I`,Ôã«­fÄŽXZë¾qRr|dÝnKQè#Bx8Be@.±y ¶oÍÖF0Áf<Örm!Oo<à½çœ/ìˆâØrîó–óÌò †¨—ãŒØ]¦M*GhFˆ/¯~D“Ž«8Ø´l-¬/DZ#–q|ʘ†bK‹ËZ»Ó÷úe¡aG,}~rWÖ‹nNLX`Þûvè2X/Î!:VUT¾²¢Î{5#vÄÒ÷*·zö’`w4,©[RhZh8G´ tA.9À‹âåe5†ªÒ׉÷úFèî'¦òÂRß[ŽlbG,m™ôˆû^4¶œ¯ß!›ØKO7†”n˜c¢>zÃc ˜ãk‹’ÃÛ°éÔô¸S•¥oi’¹>>_é¥Ç¬xÜßK;_ØË}$¡²Ð˜­Jëûötš!2>GˆfÄŽXNô†â[ŒjáÚ¼e¾âô[cGæ4l*«£V¡ßrq•Ñÿ›¹Ø,ªš}«¬€uü8bùÂA¾$"ˆÏŒgÙÇy$òÑú¢g~oò7³f|ˆ{_pâ 4> 0~[Âp¥u:ó¹W…õ Hwþ~v,ïUÝ#X´¹‰ÜlîGpô5%¥tî°Ü™æ¦•öÍÇÊ™RÐÃÔ|­˜ÈA0;ÇTÊ×Þým -‡%êk¬»8:.‡ðb¨*7‘˜mÅ·½áÅF'Æ’¹yáÑGÔ6ãÊ™%GœÁògâ8­9æÏÄq–421ê ù„ՕЧˆðbãA8H¦INR©×*8êÐeó°$°gS³àˆXÞ‚zfäØ;28f¨¢ý¾€ã/‰èVËë12{¶ÄŒvÂlú8Kš GX/ãÃ^·¥A)žÑZÔD¹yÑ°pF'ÇJ=h¶/FÝÃ}¾‘/@ý£C°pæK ÍŽã ,´ù:XÍa‚ ¾|á _"Ç‘ª€Kv&C̨Cç‘fɱs°§¼°$›—ƒ÷|]Y’`÷BkÏ(0!TsÕ+4ÙÕž‘°›q¸Úî᳙赢Eô<Á/fÔ¡=Ãý(3/æñ,9Ά`´ãàûšÐ—Dšã°/`wQp¼Ûßé ùòèN_'G] "X/0¶}AÉ’º‡zKü!yÔ5ÔëzùË£Û}PUáéM3_TŸ$CÌ‹eŽ¨ÍûšÍãØÚÛô’€ä&ÈQýeØé|qlém ‚0a¸ÀqÆQ%µõwy_–X,4«óKjºÃûûh`l¸(à•i¦éÔ4ÔqÐ{ÂLŒ†œ—†Í#ÍÆS}"ØÄŒ·vÓ©”o(O±é«¢tYv[³Àgd*Qýî±#EQDEQDEQDEQDEQDEQDEQDEQDý®(ÂŽDQDEQDEQDEQDEQDEQDEQDEQD}u)ÂŽDQDEQDEQDEQDEQDEQDEQDEQD}u)ÂŽDQDEQDEQDEQDEQDEQDEQDEQD}u)ÂŽDQDEQDEQDEQDEQDEQDEQDEQD}ué bGÒV:fÅæÎ>íü+¤¶´•iaX1Õ»U±˜±´.çÔPÈ© ÿ‹i á˜iXG]HWX[JTæ˜J§lvÁUÙŸ©ª)vq0ŒûBM)õO*¦JàŸxPUT’ÊqœN¥øs"î_•®'5 Ž–ª*¨˜æhŽÌ!å☨Jñ¤Ï±™úèpôï# L§3s9¦¦ñ?{¸A}œJMcÄP' $Ô$ù#ŽSÓSh:ÄõL§ñ¯ªI„pœžBm`‰zÂ8¦¦3}LäpœžR}L¡]›Ã&§§2U¡i£:åpD >Nǔ昊ÙpTµˆ%‘‹…ŒêÄô$ÎKäú–¡ ¢ÏqÅÑT1Aèe:…aÏE/ý8bút±Ib‡’¾ò4‰¦§r☠œÜ€yD^öAU#ŠMLM(Ž9y¹Áy1GAÇu=D¹‰Ü`Ž“(Iõ$sò‚q˜žžN$y±€ÁwsÌñ]öó ±rò8‚–}Y„c“ªd:…zò0“~1VS“(†_Ñøüܤ?Ç©I^„˜ `Žã£“ãøP› á8åôQ1Íñ.pĈ¡0 $õó–A“Ƨ&G'Ç4ÇüdÇé©q= Å.¯  ãªöÊ Z«šãÄÈ„êca^K—#–ŠáZ6A+gdb eP'• âˆy䯅yù¾U#ËlØŽü9™›—ðk<„óø,8¢UãSãX®yªÉüÜ Ž£ô!­ÖsÒW˜@.Mó×¢¼‚Žã¬ø s‚¶ö°ÃÑ æˆö£BüŠ2EÉ@ŽXÏ( vX6A»cx|thbŠó Q&˜ãøè„昛,NúVv¬ø°ò}%9† k~h\sLbåûsT[íƒZ,ã8Æ&ØùîG4‰ö5QPUšãÖvvæ[lp|dtL§ òò sóƒ8ŽLŽ Ž©>–äª>úÈpÆÎÅÞ» µ:86<¢º9]˜W@‚Ÿ£Ø%ùE¾U¡ –4qDmAÀq‚8ªVùîGü:,8–pÔ’ÄVî`´µƆø3æ+¢Q8ŽŒBUåå—æûV…Ä‹0D|cÿ¨bZZP\Âq|âW´ª¬ #ŠMM@U¡Œ/Gè”éÄç²üìY_ŽcÄq|$GõKü9ŽN¥l™ÄÖècÿè ªJIG|¡IA»–-°ó&(€b}#Šiya ªòïãäxßè þM’d6ƒªRÕ.³Í‰òÂÒ€>Ž³€à âØ;2ÀŸ±ƒ‚8¢¶$Õ³$€#¤ÄÐØð¨î#$@IÒw¨ªÆ‡§¦§KtU¾v €A--‰9Ž g&(7d'ôŒô÷«n.)*-Mq¦Ï0¡ƒ„ 8¢„!$áÒÂ2_ŽPë(¦øŒ2¨ÊWñAðŽN8‹0‘$L —Øú*Ñ÷†ûùsEQ™o-ê3K"˜ã[&„¾Qň)ØA.ùö•Œ=‡£¿0‘ƒª"Žüµ¢¨Ü·*%íDzŽÝC}üâ+ˆ#IK¢Êâ`ŽŽ¢_º‡zQê»Êâ%Á3â Å|«B™¾Ñ!0»ò‚â )×¥8¢NÔS^P0A£¨ ¢ 6!ê© àا8G” ²÷À‘?qV!0Á³ªxi Ç‘AF=(ıs°‡?W—øWEªŠ>Ãt)®¾‘>ÊAUùr„MˆVS°CÃ|í=p„”C……q%Aâ õô*¦“(°¤ ÔצůRD×”Tø÷Ñ1h-mqì¼ÇŸQÆ·ñ³äUeÛíi5\Aú¥c@p, æ8ls„V[Vêϱgd w¸|•**…hõ-Ö>Ð’°3QÏÒ¢2_Ž¨ez†ûórrPϲÒJŽÃý|K¢µÁ‘?£6_ó‡Æ3´4@Dƒã½‘~¨Ñ¥Eå«AÛÇڀƃݽá>ˆh˜ ËJ«‚” ´ ta¸PLKü8âWT•áXVå[Õ qêƒÊCmA"eP!™/•Eå¾Ã…ÝÃ}mý]Ä®.ˆãØðÝþ.˜06 Ÿƒ8¢ ˜Â²­T£Zî«ÜÇU{QíA±º²ê ŽƒŽ¦AvÂÝþNþ\Q´Ä÷ü2®ú˜˜Ë8Bq`(À¼Ð° ¥p§¯µ¡NÔƒ¡ð5È1¬øФ ªÀ’œ8BÚsìàÏ(ãËÖËàØPÚ昤_ÀŽoÛ`øZ&(€b·5Óå5U‡ÀÔéã,9ùZ&ıµ·Ÿë—, ã8êpÌÍ Òh]C=|/Ý4AR£©oUàˆVÁœ€-vAŠe:‡zÆ''P ªd©¯-DQíA± Ž(ƒúdžP ŠqlÇÁ{¨³º¤¢ºx©ïῶô¨bÉ\p¬hæÈg4ƒÎ¡h9Meȹ–}n^e°\º§õ d ‰_ßbö¤F—•Ti4eä@[ÁÈÑöFÐpÁ<Ã$’‘ë+Èt²7lÛ“h¢ÃK0Ë#­slaºƒŽíúZU™¾Iuwh÷ÚwGéT¡: Ý¥ÆÄmUÐåž¾2´´'7®®ýopâP7Ã)uI vA—´tÛ–ˆÇ1ƒ·èÓ“`Š³jŽò^`‚Ý”ö¿ä*oBŽïÅW:Fm¨JyŽtm¾UaðÙ±äk³„KN± p;’'×ö™*oNˆÛ1EžèŽ|å踫ý]rÂ) rX§…ƒ\WXŒ¼¹Až\ËqÜÏèß·Z Q`ÃBêáÚæçð{I¿5v$íþoÈ‚Èð˜ame\ò¾ÅØ7–¦ååáè,>Ä$îïXM¥2 ~SŽc+%Úe)ß½§ Ò¥méû /;í„ž–ã›Pxÿ«vþì£MMf|{± Wè¤òJ²Tòñ_’çÕ˜w¯CqZ»–e!r(Ê–¥5; &°ôPø:¿¥ÀW±Ï›™¢ýIÅÑ 鬂£[…Ï©AwvÊÃ1=Í÷ÄÙ¸Ès)Ÿ`¸òs’r`j0Vruá×üÜêÉ3ä­­Û¹öJ‡^{ñZE K¨ÞÑÉ)ç*¯ Ț͵Wæ‚&àJ}„õI}ä+É/4n¾0V}£H«¼ Ôè&xñ¹‹H{†J¼b‡Îÿô¹Âïüsªw¤_Bßr /G‹Ž—ã|Øù=ðlÌŸ}ÏÆ´ÊÍQ] ûFíKÛšHã¨à뀡C#QÐaoÌuØK7,©õm|ÇÀ=^‡e~·½Ø³]ƒ½N”ÆnÅÀk-ï@´|}äó*,œpœ“jZ_¿šÄôu ÷Jý‚JjJ–zÍhu ªn´Õh%s“u¥æ=¤Ä½¡>¹ý--Œå ^C=š££‰ç,+­4.Vp êUt5éÛG, öL`¢½÷qó¶î)¡­ CëG×T¢wúÖ;c÷% —•VHŽècûÀ½!ÑGüZ]²Ä+v "n÷eVκêU–á4ËgBÌrСýbÇ þŒÕå+»À±¥·¿n¨Yí-ƒv‹›}KXß-í…öëôƒ±ri­ï:Å­ž»üuã²µ¾¿yï.‹/샤ܹ¶«üyUÅr/Gˆˆ;}ö²×s„2 Kk%­m  'vi™€£q÷ ¡µ¯CžTQÉÊ%u†”Æš¿;Ð9=Ùh(°jér/æãZw+{&ªK*¼ßг­½mÒä€$G7 U‹ ’"ÎÒ‚3îåxµ«…×!¶ïÅ7 \éjá¯ÛWlð–à¢ë?1È¥UjT36 TÿÍž6éвԪ¨3®0`]î¼)õ ì¥UKëŒåz·¿‹®ƒ™–•7,©18^íje`ic»Ã{ã386|±ó¦åt`÷ÊMÞ>bHå5®¥uÇêŠò 8^è¸!­Pp\S±Ü«m±/êÝA#¶gÕ}^Ž Û}<•ËË«W”×øûôæiþ¼qÙ¯$é¸ÖÕ*­/ŒçÆÚµ^Óý\Û5¶…ÀÎ+L° Qþ-Lè8…qŸˆ%qãÞÉ­Ú°lµäU…2ÒzÁx€£¡ûÀëJç-ÞþP˨侺&c£u ö ˜¬ K«©z•·§ï^fW.xA4Y~ôñµã΂N?иӷ d×­[`bÍo]¾Î·Ø©;à8HZkëÙ(€]vêö%iã4±¾f•q¦€¼iKK»eسU Þ>ž¼}±ÏÙkÛVlðµ0ûFOܾÈU=²î~ßÆcŽð}F=;ê›}‹½wù3®jûŠf\:ßvÍè#FÌ°.wÞÒöRæÐÑ°d™¡û Oß¹”±ô’ØT»¶Ê£ ~¶œã¯_ßð5ßÆ£ »9×T®X[Yo€ˆ8ÛvmP`Àq[ý¯ß±g¤ÿó[6Ç¥…¥»Wn6 ÀŠ¸Ðqón‡|Ž˜Gù"âÌÝ+ƒÂŠG ¾×8¿êˆh´çþaräæ‚¡€À«ÉÍŽé7ç>æÏßØô€ol4V hÏÞU[|‹}zó#QšªV®«^i€¨9|ã´4«pFÛ¶b½W‚A)\vv7¬Ù¯­ÞêËñ“§”-¤«Û·f«¯ >¹~’¿~û¾‡}«ºÔqó)Íqÿšm¾Å~}ú}þ¼Ív_\,´C×Oð×?ØòˆoU°ÐØHƒDõZ_Ð,GnžfÙ•Ö“õÍ^,,4%¾úÎÖǼìNß¹|µ»U>i®Yݼl|©u´å¼ÔÚà¸wõVÑ1'ßš@Ì‘<1á×Sw.¡dƬJ+m5ämÛ‹'ÞæÏ5íòúí !â$Ǻ²êûWn68~vë¬ÒÚâJ«Ë»Aÿëø›üùû;žôm» ýètpé£ëvûƒ$ìr”Ú¦ÚÆÍuFˆšƒ×NH 3ä*lCfbùh½À-­®X oipÐûøêq©C1(!f0í¼÷î¥#üõOv}÷ñ9ø‡>Ãè}|ý^ßbÿúùküùñ {}q!àøöÅOùëŸîþ¦oUX‡ÐÈêSÚÚ²|Ý–ú??ûwçcú‰ û|O8¿uñ»eýÙýßö–ù¼åœ:˜¤¹”…5oHi¨ã÷/Ö#€/óGÖí6,d˜—Ÿß:뜵UU5¥•®»ßëÎyãü!Æ…`nó³¢Aÿòé¯ù¾úé| r¨ì“Jk+B3 à\ Q¯åsf«aua)zkû‡_âÏùµïx àHõéÍ3²ª•KjlÜ%/jÀñëGÙ"Ú»zËfGí¯ûˆ¿þ‡}ßõrÄ.;|ã”úäðĆ…0ñ^ ýûÙQ!•úÖ懼¸Þºð‰|· 6áÃM» ½í¬å¼|{ßèãÉC~Ý·zŒ47ÇN“—!àõTó~/4F[&»6ù:@ÿïÇ/ðg(_$ÊþN©†þãä-sðÚql4úL#ÓëÀÚ² Œ hyg‚>~cã8z˜û:_:ý.}^^VíÕ/ãSKòÎùìkœüý‡?ãÏÏm}l¹ß1Kú³[gèNíùî¶Ç½e@¿<ù6Ÿ˜°æ÷x,X¡¯žýPšU˜šoo~È«b>½qúˆs°B“¾·ý뾡ªn;ØBXöŽ=¯œù@^‡ÂÈy澇½Ð,{0¥Ï8|ýáŽ'|9BU1Ç?Üþ„ï…Lè_œxËræúÿxôϼe`ÙÍ!˜Ð8ÈK-Ìã˧ßkíÍ«ø’ÐØÚ`‡böͤf SüÙ-@ hFc£ílØø¨ûÜóæåÓïvŽ0D {ò kU¾ém…uè…†üìèoøÚµÛýcC¿>õ~×poŒ¼1u ³Ð{ÜÆÒB7- :À"üƒ-°ñ1¤°TÉÛB^è+6lwš`‡ºvB8t9°ÌÍÉ\2Ôèõ{wN´žŸ"¯.‰5ƒöFÎieVµ9Õÿp:öa,%0?âB¾¶=êÁž•Îóê⥛êÖzÝm'Z/Ò»(Šóìª óH;<>z¾ýúÄ4Mª ó¸aÙjãRjQ5žK£Çpâ3nr®uߦ«*jWN<¾¼¬Æ{½qï6}F½¦ÝaRU…yùÞËöT:u·¯kTû˜hâ±DU± ›ÇB%÷±.SxÁârÃÐ/9Œ°ç|qò5Žäè#VŤžk*‹ÇÊ J \ ¶–«Âg8.Kœ Ë J¼—{ _žš¢B¾ïV.9ŠbP˜›o¸9°Àô•# U¦¦0×íO´Ò„zá'jI'üݦ|?† ‚ÞÀDUú¢@õ2‹ác2/Çüßôê» *€ö'†Ã—âX–%ç(è_ÙǨMZVeà¸å²Bo±¯2Í;b×â‡çÈüúebGµd4Éò 51#vĹ;“íRÿMxà#3bGd™9¾¾»(kØ4i\xõ$IøIo!bpÛ.r»fºOx›ŽqÀ†º‘â9šä}ëk‘bGÆô«ÒÞ?Dm¬³1AÐd¾»² /ÉbÃ5"n7¾/V’,äyôGˆä[˜ — ž·Ê {Fìˆz.5ey(™Èó¢+æ;Ò/ÞfÓý±ÿ‹eãå¸H±#÷†ûY÷‹yJË·d°’ùöÙ œ¹§˜ y/ÆU¡€ÏŽw¿§ÂUA:ÁŒ6öȼ`G°žý8*yX]RÁ².±2ØÍ7Ï;YÃŽ@¢¶õw¥\ÍþŒáb‘ˆµ‡­å‘ÑØÔ+Ê« ŽGŒ§¯ˆ®-­4ÜB3bGp$–zŠ =åë¬ÒÛ}Žpvõ ®¬š%¹zEXÜýqY,0ïa;;‚ŸxÍ#†CÏ&v³;d 3µ$„{'%_é}¿jbG°ü|%j[éqˆ.4ìäƒìÏ”2Æ–O_7ºo/c®+‹ÊÙI%{µ«EB˜ÖT¬`AÝ1xÏ~AÓ]$pSõJ㼎GTÁ´¶²žE4vk»xA“ û¸å´æ ;Ã×â²—°sš—eÖÏ…ö¼Å$AJð¨Bz_v¹ÿm‚A‹…ÁªA½åجK´»¾ÂR:}÷Š9&ªSoº.CgÄŽ´ô´Ém™Jò‹x€×É;—}96U5 7›Ø‘ž‘Ë7½…å·½¾Ù°Þñ#\§œ>J#ÿß´¬‘¯í0ARå Ž‰ ™ãÙ»Wû…3ž«Â1(Oܾ(G••Û}uMÌÔbrTå ¶{° ;xêö%ï_åèábzµ«õvæÍÌðC){}Q ;Ò5ÔË® £û×nç%q¼õ‚£µ3ØKŸvÖo¤Ï0þ^;!Æ\ãoÀGæ;›ððSŠ£ç³kå&>2#väó[gµWÒ¬ ƒ… 82úèÐý+7öÉ"ÅŽÀhaO‰‹œD΃kwöI„Á ô­ ŸÈs(ÚÞU÷ð‘±#];n €‰+ëÙyãÿ»—Ž¸N¾A²³ kï”ßÖÆqïéøTøÑÕ£MDbG,­·®Xoüm8vJê|û5/GH'¹Áß¾xØ–î+Ŧꯓ5ìL-*MÊM$žÚx€MVHÂËÎò=P}d¸lÂ7Îò=ko®k‚~”"ìèÍ Ÿ¸ rû?>‹÷Õ3ú^£AEòÛíçÛ¯C’‹íªr¹ßÛþuÃÛ‘MìÈ˧ßïvΡ‚6Õ®õºÒñ#X„'l^.s2_Š”—N½+£U1ÁT0¬…±#гgù'xâtüœ.Ž¹Ûß…ÞVaj¾»ýqf•qËÏs7 ‰úŒ£&¦&ÿõèkÞ« üÑ#M»ùÐ3éÍ ‡|8æäþá¶' ¿c6±#/ŸzOß¹¯>‚CпÃ÷úåéMÖ¸Qò3bG°$Œˆ¶,_ÿ`ããaÖ°#8výìèkã~}D…Æñj^°#ø‰0^úß¿ö㤖MìÈû—?;î%­XRóG;ž¢Ï8|ýÓ¡_úÞV=²n7ä0Qa“#Â’9y?Üó ŸÑ¼À¢ú%5Ïï|š9þãÁ_àß^WÖ›¬0>±À˜S2'÷oø¾q¿ŽÁ ô§G^U1­‡å0øö}±#¯žý°½_Éy‰‰i3€Ïø¬_øWŽ˜ë…5)´0$aŒ]ŸŽ³(YøĆ¯±YõÎ¥#ÚÈ‘ØK_ €5vóx­û¶l6•-É/ô*ŽpìN»ÚŠ`ǬS[,ýÎFÎÍž»NLbGðïÂdþ&qUËïheÖïÎj^°#©têz÷•+@ðrp-å|廫SÙNmžêšˆ´õØ]¡ŒRétç`·¾·õGœ|ÙŠ}Á‡z餎Çc…å†<;‚>BúúÐåÝÚ 8&˜Ùÿ[±¢dÿ‰ `,›—›“ã…}d ;’¶ÒSÓæ :fÎ$.{àÃ/ â¸mùú&½Ì`g\ûæi!ýÍͳ†Á¯^ä+µ êøíÊ…­ûê™\¿‰Ï{VmYS±Ü"÷Ò]_ËD½§ñÌ–Gä{„i¿z/ŸhÞG:ôеF<¦âdÁw·)òÄôä/O¼ã¾ ÉÔˆEh C²†Xþø*omS[aa·”!ØXþ/zOFU‘µ>ظ“6tÁGWùž ±üžßù”¼Ò ÇŽÀøÿ·c¯Œ˜  ŽyUÿê×.Èäá¦ÝšãðÏŽ¾î=°A5PÞÀ$Ü@ôIO±)‚.'×W¯2쫬aG`HüZºöÝãúì–G)¬„ƒ&„ c+…cGÔ¯§Þõ­ ¬¸çãú%kØ‘ů¡Îïms¡Cæ;ò≷ZN¾ ²Ý…ÉvG¼>ôKßÊ--%¨N˜IŸ¸“0átöWû¿Kg´:ô¢L(/Cq´‡r§öüÛ±7¦Ÿßù4q„™D¶™w;âTû7þ>ÿ·ƒ¿°9šåÒ°Áö»áØX/Ð錃<€¥Å¹÷YY8;B`5™óB€0bßßñÉރ׎ |Ô”T~}ƒR¸º¯œþ€|ÿvÿ…MµIGkÃñóhËy~n‰ªðvŒ[¾ì ª®¥»#;‚ÿmZ¶Ö@'‡cG ÐµCÁ;‚y¤ÆÓk!± n„‹©g«+–S€Xbv ‹}²;’ˆ'0Òÿ2/ØJ9ÄÍ‘Ø‘x<¾ri-]Ò¶ô´M§§½ØK¿ÅDG±É‰Î¡{.DˆN406#GT8vD¤³JƒON<I‘ΰ6³Re;â±û¤kHËs>%ñrDƒžëX D#NœèIúÐÒþÔ´“*ˆMˆT8‰XÂð4‡`GÐý)çnZçgI:O,zRèvi/FìÈèä5þ¼ 7IùáèI\EÊ*2‚Ž`0ªÃNbz‚ƒ<*áð€^Œ Xcá™#fc841ÂÞ# =¢Ž£C¼aÐ5<—m(Ê+ÃŽ‘AG Qð·ãÃöÊI«'Åù®Y˜;v¤gd€åê‡Y­Ì+ce¼O°±#ÝýœU„5€^óÖÃB*+(1‚ŽÀ6ÂDÈ4Þz¤tpÄÙøº¤ Då)t‚žaYV»C5†`G°eØXXZ:cÎ Ëóš’ ¹M採ôÒüuYi%ÚÐ'"6ã V/ÚÌŸ§{¨cyCd;B!@ø«Ì”çÕ‹'Ø¥^g1zè‘Œ¡â =‚GÙ5LxIl¦LJÅpìlqÞVÊø..DZמT•,Å×Û";F]YÄEçPfýSè‘îá>Ž³Ï©_Rƒ â8¥1Ò¬C°#2舥}ŸPp2…Á‘7'ÿ®Á^–*P¸«õmïÕ®V1* uko‡|"½ ;r»·CKf5ö%É¢šÒŠÛ½í¬¼¡GvCĹ½sõt`»±Ë–CpÐKk½åˮ߻Í^OhôÊñ’䀮AåIlf6t"7®Üíïdñ¢3}¬‘çÞì¤| ume=Ú ·…Q tîÑÖ€__³ K·'³ÙãÆ›(sÇŽ`îص橺ãÀAsŠm{êÎ%¶ jK+Ë K.wÞ’Oj˪Œ #ÍËÖÀ±ñXiû ÖV¯vÈÌòÕîV”L;·Ô5AG°#°\/©¨-ö#ôH8vÝïsf ÒûãÆê›BAG°¿°T.tÜpž(y.‡7kجù[÷ìý1µ±v v±#¢ÓqCð!Øèù¦VהΠė…U ؘ2è8n]±þ¦HLáGŽ¶œgEyÛTÕpöîÕá {5¢ž¦ª•Ø‰ì&±ÔEdþD. ="ƒŽ€ãöú ×»ow:[¼öº=Í ;¢‚ŽÜ¹Ä'] vœ/x‚­ éÍñ„ …7Ô¬:Ûv•7o~NžÑÇ…iëï:ïèLV;„j[7Ø¿flNtB¾|cíÚc-çù,@¡GT@á†_W½ÏÝ:Ï–þJúæŽÇŒ>Æ`Âî•.ÛÍuR˜„cG>ºzÌ1ÓXä÷Õ6}Ör–-Ôƒ% á Á XÏSÓÓ0g„YŒØtÄRq,vô«àЃ;¤ûŠcG nÞºð Å"©,^‚eɧïõÍ2¸]8v?±•Í»«~ãG׎±H„:ÆðŽLŒ¾q>ó=Ä 8ì@M+çFˆ2ìk6ó _¿W'¦±Ebn"ñôÆ`n½~þc֘฻aóWö;Öê1tnvD)Ì+xbÃ× ë· ^ÏjÎkç>æ°©Xê°>¸ü¹ƒ¶I¯ª¨»¥k›d;by²y¤ô˜ÖOöC ¹yšE.¤ÄžU[ 7XžÃ¬¥ˆ%^Ë(éĉQU¡G"ìH&èlÂòeû×n{óü!û0u ¡Ruò¾2Â9åæÅo¬ª—AGŠ“!ŸÝ~gËc°3¯tÝ"é ›ävªø/{ÙUŒcÎkg?bŽx"½éáØ‘¯B¾ìëö½}áÖ àøÇ»ž–åC°#Ð\9Ê_¿»íqˆ}ùUáPðþ•Ï5GešA.=Ò´ûMÅ1s¾ø“Ýß4‚Žì[³ Œ^9óž¤'8t@_ 66~°ë›0*.‰SžÈ«Â¬aGdÐ{]¿O81 ž@ËÃùég¯òŸ<¶~¥Õ÷O¤> ÇŽüäÈ+lÒ¬®\ñøú=/zJÐÒ£Ó\³úñ .©’ìTÞÏŽþ†¿BâÉÛó#ôÈܱ#xþ≷X˜@võJ=Ž'2sMÖ°#ohÀ„ÍhI dÈ˧Þç·`wýhÿw #¬Û ™ùÂñ7åäЉ¨kþÑþï»{ö÷ú¯ög´—N½Ç6*ŒÏol:ðoÇÞpN…*Qéó;Ÿ†òO‡~Aeðçª Oµ??ö:süÆÆPjgï^ùÃ1™Èûó½ùìäŠí_ø¾|5;ŽÿüÉ‹F öTó~œ¤Þ¼xhBߺÇb ~±Qdñ ÇŽ€ÑJM¢*ƒñPã.Ⱥž‘ò¢7U7<°v ¼xòmL(ý2=yøú)†ÀôÂÄF…êrÅy…OnÜwüöE:ÈÇ”cÎ6r´Y5Nž¼•uÍ5kTNC}~ÇŸbTÃZvµ”ÐpŠÜ$šÙu·¿‹°#¹I ,‚ÁQ÷ôÝ+ x²¥Ù'G-…¹ÖÕªó©'EyùP8Åë›õ,©nr”%e7NQ1º;‚VJÙwG±e¥RKÎ;BAGRŠ£j.,Oô]¿l™¦¡«,R¡GèEGÆ–`¨amö 8ó¨$Žº(£/–íQ-/,_á ¼Ž`A€}ÕOì^ç¨ì3ê’TF"¡ì6ƒ÷X8à+Žß^}RµV-‘c‚ÁzcgªÊ#¨9v öL;à!þåÊ™;v†>ïŽ)“š{„™B§¤Ÿ#Y¤Œ*‰üPç )ù³ƒÁ|Él;äÃWv(æv*ûû‹’…4ª"f†Êp)…gv»†ovÐ_âئÊÛRc%¯}C°#ØõòeâÚ²*H˜¿Ü#Ôó j ýHŠƒ8b‚Xc@У־v^TôõóvZOÌS‚éÉd¢QK‚ê·E$”Ç–¹Ñs—S>--,ÅJÆ4µˆ·6–Ö–®XŽ@ w®_:2väB;Õ ¦¯®¬ ;¢™ò2ó‹µÀ°#7îÝá°Œé’Hºt /ˆXèx]€E.ûx_]¤¿Ð†þR›¯ Ð dêWXç dÝlÊÄ k*WH›!;¢@! CIä6ëë ”g ´¼¬úrçMulsF ‹‡%étl¬ª—çŽÁ€óF[¦! ØGÎ:QÔ¼lõT*uEøû7×6B˜·©·IìËtÊnƒ¥ÎIŽñ„®lη_WSw©V>ªÔU‚sRÅRÇJ€Ùs¹ókyLÐÄÔ„¼´E›aMÉH$P2ƒO8vDF&WoÃ/QåÅnÚQß Õ#Gig}38bû·Û³–†žj®É\Be ;r^aAlˆ%±¶J9Å J¥Õ02éFv¤m ë¦CAïî×Nñ³ª¼sѨ! \C­Ê>£0sÒY»©¶1?7ï¨xKº ³Ã÷>¨ïª-E†B¡°žÙ͉õ€Mt¢õ"o4z+ôSñÂœ†˜då‚ÂŽ\ín½¥àøc(v˱–ó¼1Wê‹9™¥»SM*5.™!nAaG ôØWEHÞAéÈÄ¢ÅRñ>®?ÖšY'¯ß{WÁP®É'–^´,Q¿L1wìæ—…IN,þ¨v«@&pùº²jyG‚ÍðÑÕcη4~ÂÖ»ÓßyÖÑ0i[¿WcAìßa¥<Ô´ >»y–í, ™l1bG —xQá\Fû ƒÃ …eù¯8v’ðxK·÷ìVå98Öz-ÌÚ²J9 !ØÇþý쇬.ñW™ØV%’N?·íq¬(¶U`¦Ò(a‚º¼3›ÈxÂ[›žXÊ÷ŽS}úÁÆ]Eyù¯ ÷ž`“âÄqÔÙ&¨ß“ìH&ö…C¸¡G2fþÃM»r¹Ò)ˆ]Á)á8ÌÒ…yßÚü ä˜ìˆÎDc/c4é©û- ,àcÑfU¾é—'3 íõÍë«WáløîåŒx|澇a+J‰'EÉ'‰ª êø1üøŠcG&¦'å‹ï4í†mëâ}åù³=Ï\Р†_Xá ‡:à&þêÑu÷Ë'PäüÉ‘_[Ž |ªy¿4§³ƒÁYõe!ŽžÝò„3Ltœ¤zô§÷KÖ‚yáø›l„À„†ÞÇ׎¿Á7EÏn} –6é z9ƒ³09ƒŒaÒ<¿ó)®3;ò“#¯ðm$<ödõ¯Nf"X<·í1)ÒC°#Ø E0$¾½ù!Ëqîrý0 ÿñЋú›2Íö­Ù†'„2ä¶ Úð¦ð÷ÿÅÞgq~Á6á7X°û°$´y¬žá쉠†÷Ó—$脼¡DÙÁŽŒOMþ÷O~ņÙÓ›¬®XqýÞí×ÏeòzðùSw.Á¤¯èÝô¼`fYGÄ$Ã1; þÓ#¯ð×ï(,H5¶ jÇ~èeû³ƒ‚ã€ã…”xÑ]^êйcGpS>ÿénµõþ¿Ïÿ5&ÊKK&kØ‘øðç|‹ø°†€ ¼Ô€?Úÿ]‘^O0e8‚½'2ÝÔëì6мl|¢%”ïæï?øß1BZâPó½ó/\ÕÓ Ò("‘¨6þ—‡«’í<ú?ÿ K/BNb…úÿxçÓ/z—ϦʆïlSkïïÞþ1Wõô¦$h2;‚sÖûW>#m27ù·>‡¯œùà:ʼnÅp ÑA‚þ¹Ž™DÞCX;*&ӵ㌢€è€ÝûYËY*“Lä>¯õËÛw QêÅKâKŸv öR]Ðþ°`P,ò6>Ü´VÓ»—>egócë÷àz­«õLÛª  >;òá•£cSãäzm¬¬_[UÓÊAÕx;”É'î#Qvä–z—£z]œ, eG×ÔxºXø¼åÜtjš†bEy5¶˜áÕæ¸qÙZPb܉¦bß©W¤H™Æ ó’ò^tîØ}éÚa9aPÖV®ˆÇâúx€†Ž‚[ÃÀ!ÐÎݵZS·ô´§,;pË’Â2œk”}î  ÉS ß®DUС*̉Ñ:=‹Á $ÐỈéÞ;2¨3+©B؉t¢'—5£$Y”Ÿ›ñ,„`GІá‰Qvs³KNºüÐTX˜öC mÈ!Ç%иÚD"Ž1g_2½‹Žzl­§0.~³ƒ™N¥R™-vN;í¬.òΣûLÙ_/üûÚ»ïöïóg;â:x±#!EIJQè¬iÂçŽMNð¨ê¨bEÃã#I·ÒCâ!† ËCVNj ìHq^!Ö$3mw?AmƸñà‡D!Ø#a ”%¿µ¦íÉ¡›#vÄHXSQX†ñQ3ñ6Ò8Íʶè°#v=g˜èR¦¿~)ß~ ƒFÂD8C|ˆu‚jÛ„Ö& mí&L;]‘ìˆLX£3Ô”8'ÄC e˜+vVo¬Z ÆCì_v‚âÎaIðÝåˆd;‚Iäe‰íI󨊇•h ë»2'CM‹xh¤­ ÁŽÀäåôïC¢ì‚ 0‹”ïCJXcé*´_E-äµM–½ î]]¼”F×LZÏ‚”9!Ø™°•Ó½Æm÷Cœ…¤çx…¦(!/]æ(£FâØ@®#‹ô—,(ìV¸ãÐ"¨ÊP£³ØÜæ2FÚš…AcX¡cIP ê¡DÀ”—Ýi¬jÀÆ êºx¸¾f¦Œ·*þ„Ö*d‚ñо×TSlg¨‘Ø#mMv{–Ý~œ¡Ff±¡‡À€äìòòjò¸œ¼y™ÛH[3wìÈ ˆ¢©z%™@ÇÝ!Ãå“ïÙÈbƒ‡2a ä õÑ~¨»DikdìhlÚÚxÈJg}õJh™°†ZF™!;‚=+§Œ2ÔYlÖ׬F œ°F…ÖÐ}YlÒÐG2mMÖ°#'Z/²¾ÀŸ¯X¢jøüÖ9J“öDB°#X„5986L³˜ˆçÔhcO†TÖXÌyw·{¸–¶ƒÆ «64l*5MÍ;yá‚ÃÀÒò›Ûèã½(cÀÀØ0#3òsòHbŽ@YRµXá(929Îޯ¼‚xL%Ó°]ú#mM¶°#™„5ìX§H öÔê˜"Sî0äÿbØ#?Îl°#™,6vľ8vÄ’cúÀŽXa‘0ìHN"m6°#9q@$;بœË`G8Cå‡ÉÓYl,7vubciØ;ĈĎ`x¥„ZtØ#ÄaG,@>”ØL±£62ØKßÈψI*ìHŽ &¢±#–vWgº±#¬¨$vÄrDf)ËW0;RâˆÌ/v„‚4Ø‘27@dÑaGìŸÜØ¡f ;B0Ë!@Ɍؑòü.h–Ø‘’d!­‰ÉsD²€Á*ÊË7Ò²P !‘‚ÁîÃXúq;Ò.‚‘Ì;"CŒ0LĈ¸Í;‚ã4fŸ8JìHÏH?;~¼ØÊbc¹±#K KÝ‘/;‚u…®ˉ0Î]>$ZPØüäxI3ØKD¬…‘¾jÆŽÜèÎ#ñbGèÐk`GÖT¬è¼Ç•ìˆ 1Â،ċá#;bDøÌv[FK›ÀÕÑù*^î;R[ZE[[bG j˪dÊ’,`GŒ#„±ÜÁH ìˆ1¢6ŽÄŽX*ÓDƧ›5ìˆL ÁØ'Éo‡‘?e;²¹¶©µ·­/ÆŽÈ 5^ìe±±Ü؈;™ÐaÁbGV:wp;¢pTUõ2LˢÎ|xå(¾lìˆåø´ˆæŽüä¤xYÀŽ üÕ®VNÆ0Œä÷ ;Òä„9ì”H€H„ ÇŽX ’ñdÌ;òíÍáj`G î°¢ØöÁŽ˜H;òúùƒ|ß2K숙%vdßšm˵“Ôä%rNŠüG ;‚5O²TbG(CŒ|„í'ÃævÃÇWGØk&ìÈó;ŸÊKäØ‘'š÷‘`Ÿ;"]¡ŒÁ¬AÀþ±#Ézömú²±#Ûõê¥#€ÄŽh€H†ãÂÄŽ <U»{%v_þñà/¸;BYl,7vô7þpQ`Gþ·û¿ã‰yvË£¨áKÂŽü­1b`G4@$Ó‘ì`G|a"2É—Ša˜ˆÄŽ0 „(;Ø#ÄaGðáÿ~÷'ò¡ÄŽà¼öWûÕV•ØÔý_ûóÙ`G–,“1Ÿ;‚N0ìÈ bÄrcG,ŒäïÞù1eìÈϾ®›1ÏØŽOC4{ìÈôpØÈj¨’öÁn;ÂÐ;#®þ$vdÓ²µU%KgÄŽà¼#/úf‰,¢X¤;²ºb܈f‰©(.£x«;B·3bG°H¦S)%±ÝØ‘¡ñç¼óåbGâñÄZÝe‰±ô^ž;Rœ,,Ê+T™sÝØKiÌÎÀŽäåä‘IbGôR©„à `ì­“ÓSóŽ‰Ç☎Œ“K`G†'Æt´j­‰¡VØ#¥Cv°#S±1vD%ÿÂŽ$œ";¢ýûväwCvÄç§ùÅŽÈc‘bG’9¹4Jv$ËØJOc-ZìÈ’‚RŠaGøsv°#XH´ö"ìH„±9~°#XtIaG"ì}%vKR›EØ‘;bEØ‘;’ù)ÂŽDØ‘;aG~7Ø‘çôO‹;ò°úi©µ8±#›Ÿ"ìHö±#ôÓübGt"›î;ò{Œ©Õéi¬E‹ù:+G„É>v„ÓÓ,F쥧±"ìÈï;ÂÀbÄŽ,/¯ÂZ‹;’ÌM6è…aG"ìÑ,±#1gŸFØ‘¹P”³Æç'_ìH”³Fv6ÊYãË1ÊYÃ_£œ5D_…œ5è{™ž—(gÍÏYóåaGfάLt$ÊYc-lìȥΛlÛÌ2gͺšUt 6g÷¡ÄŽpzš…™³¢Ãx(±#*=ö¯/Ìœ5ÆC;¢ÓӨ댛³Æyø{˜³F§§Q[{1次ô4V”³&ÊYóUÊYS㤧‘ØòÈEØ‘/)gÍcëî‡àZ¤9k¶-_ߤÕbÌY…NS嬉rÖ-Øœ5¯ß³R-‹1g ìÆ}Z_D9k¢œ5v›£œ5E9kB°#ó›³æ»¾ ѽðsÖl_±LŽyÎY3>D­šcΚΡž»öžý}ËY“›È¥AžeΚ/ ;ò…sÖ% Pm”³ÆŠâŽÌ-rìH:-àKv Óîg¬­`ìHZ¬¼tN<ÇrVsÚ)Ÿ˜vÄÒÛ† úbGŒý–ì<å`G0,$nÀš;žÐH~„I*r̹õ¶Lt0Óñ´U0kì*×ìª;t «K–/ÈMÊÉZtØKëÞ2èúh#A 1q2È„;BÁHF'ƸÍ.òö ñ^@ý˜Wˆ?ìHY~1ž ð^%-‹‘gŽ¨_]vÄÒ7­üÙ;"}cÖœ±#èï=ÁÝ¡Õ«_Ûµ‹T»0 ‹;‚=¥¬%g˜Ð¬R”RŽLõ”lýd„kðbG0‰ø§k¨gÊqÇbÀÑl o·òmÛ *‹–È1 ÁŽ`½±3U‡Qײ0û&§9IQ‰ØsÇŽÀ@(ºz¾ÛßÉâ3…>Jà0Ê ä¸ ù¡ÎR˜d;‚ùb ¤7)1¼Ò U0"ÄFæ7…·ºx©ž!Øì¾ëÇÞ'Ž2 ÆJž7B°#Øõ-b”prÆŒC 1®ã‰ó j OZ/‰z}Ë€ b9ŒÁ:iíkçE…¥Ž>BÝÜè¶`i=AŒ„(;¢ v}±#(_QTv£ç˜ªŠËË J±ìo:.7PÃÒÚT*Õ*VNcU=:ÅgKë8éÈ\PØKû*ôÕôa‚°xFò#S-”ó…¹q/b{– MòÅÍÝ í×øÉꊹXä²÷Õ5Ašñ$DÒõîÛ\?–ÆGaAœ'¾Ø‘5•+¤â ÁŽÈ#X„´d0íåeÕ—;oŽNØ0M 12J±'ÀÁHˆæŽÁ€óFß×ê»W h^¶ê@‚¨¶._ÛÈÁH`¡–:ªK’…ÔÇóí×ÕÆÔ]BåueU'o_d¸¦Rârç-Öò˜ ‰© vûY~Ø(Žõ5«¸@vÄr‡i¬jÀäÁHvÔ7CõÈQº_;Œ[zÚÚíYKë`$k¸@Ö°#NˆE˜ ºâq.(•VÃ8 ÁŽ´ taÒgH*ºÇ9«Êk#0­TƇ^0¢b¾Ø‘Mµù¹y2ÆæÚFè2¨¿+]ö:Á Ù»j d«NìMò¸`=3òë›èDëEÞh K–a#ÃæüTÜ{ê`$E¹ °#W»[ï@)hFP¯[µêXËyÞ˜Œäàµ|ÜP³ S MÊ>$K_[ç ¶ °#z¬ÇkË*IÈKG&-v·|â‹y|ý^láóBD“k‹–2´ÃV9˜;vóˤ 'Vd—¯+«–w”!ØØ ]=æ|Kã'l½;ýg #ê±õ{eˆÈ B-|vó,Û!X˜\íbÄŽ@.ñ¢‚ù´Wûö08,¬ÖU»Êű#„Ç[2@gµïXë…Gø`[ÉYÁŽÀ.ý÷³²º|`íll«ŒI§ŸÛö8VÛ*°ŸÒ.êÃ7NÑF#‹ŠSÆ[Û;ò`㮢¼ü×Ïg\ÚxŽ8qu¶ Œ(cLB°#o_<Ì’ ’dSíZôHºBnÚ•›ÈE1~‚]Á…E{ÂÆѦ ó ¾µùAÉ1;Ø‘ã­xC]>ªEîçñ±H#iúåÉ·ùškϪ-«+–CÚ¼qá×óÌ}ÃV”Ó‹Aý äÇW;21=)ß}'쬋÷•Ú²éÏö<ƒ3 d» HäÒ¨bBÙj8°v»1bä¾Ø‘§š÷Ks:;ØœU_âèÙ-@8ÃDçÈ 0þµ‚yáø›l„Àì‡FÆ׎¿Á7EÏn} –6é z†Ç©‹œQMhÀsBø„cG~rä¾M‚„Ç^€¬þÕÉ á¹mI‘‚ùàÊç¼Ñ`Z|{óC–ö"sP?ÌÂúkÍQ™fO6ï[¥‚2ê¶Éàøˆ|âÅŽÔé`$XÚ ŒQ,ÃY€DQvÛü_´ü'ï!¡Üp<|çÒÆŽüÅÞga÷~Ör–Ê' Gûö…ÃC÷èoÁKâKŸv ö†`GnÚ «ìóÙÙüØú=8^ëj=£_ÀÀŸÂ¬2 øìÈ¡ë'‡Ôå¹ú½±²~mUýÔôÔûW>©s6Ê3]vä–Š Ú‚¡‹(2,BzcºldbLßàÙaÝM§¦•wcGÚº;le+ÌKÊ{ѹcG8tv„ÞN„½À  ²ZzÚSVŠþvIaYi~‘²ÏìHUqyAn>º,ßDUС8%9þØi±±!}§¡“·¥wdP½4«‹¡ tÉC.jFI²(?7ãYÁŽ  ¨ðW9ñëX€t„`GpBР–´®?–ÌU¡xx1…nHÇbÄŽŒNŽñPC’äåNŒq/0¡ÅÉ"‰d„×I^]˃Úà'ù ’‹fD| mVXB‘׬±Æ¤¾A×”¾™eסQ3!ÏF2?'O¶%‡7;ÕÅ) QI²…í•“VZ¶8ß5 sÄŽXÁÀ}$æàè°Ê’[âž…E‡QmîÅö£ÏPÿX90•xëá ¬RÅFÀh4êHÄ_Q¬èKÿèàˆ³)Ô`&‹F4ÊÕÙʼnêbW C°#$ì·ô`ZvF${Ja±Ém2w솈]Ø/°ÿ°´$@ .ÖZ5*úˆfwõMŠø+Æ,d;‚5)»†_ós’]C=¬ÝÐNB÷:ó´¬´OøJ›z…ø‚GÙ5ºá…ÌñDJÅ숥]­¼­°Ú±D;‡zdÒ¢ª’¥øJ–=­€jÍ‘CÊ[N†™Å}ÁC,ËAÇ-‘Hä¬rû C°#x.GµZdà™†%Ë0¡xÂn¬½ª¢%øÊR wuÅrK¹yZyp g––´övˆ *“Wc ;r»·CKf5öá+–,»ÝÛ>&‚­>QkaG0D VHèWº‡ûth%ý$'àË ÁE³qf,4úåx©ã&×Lý¶.V|x‚Õ‹%Áë×TÖC5𲯠5k$Ô&;isY€!hŠåÖ[[©@! b2pÉƪ†®Á^Úx"¯T¬ùÀŽ`î8½DwÃÒº…“͵êô~êÎ%,rLßåÎ[ü¤VƒN ºe>ò¯Û˜6Ý¥æek°Æ°xµCO5VÖß¼wgЧ‚ã–º&íÓw¯°=‰=Mq©ó&?©S0”Ì%l8vÝïsf À¨bÜX}Cûc› æ“w.sýP+ËJ*/tÜpž(y.‡7kجù[àºrcíšöþnçò"'vÔ7K>;½#_t^UQ‡ oÜ»;MöXZ]bfU$ge¢ÀæºÆ¶þ.Vmx²³a#8m9ŸQdùÅ«+—_élž°W#êiªZ‰Òñ'–Ž;ÂO(CÌbƒšñðNg§³õðd¯ÛÓ¼ °#Pˆ.ˆˆ MR¼`¸°µ!½Ûg¾n¨Y…EØ'"Š}\PØ‘6ø°u¦cËòuXR|í_³ ç 1)Nl]¾#ÃgŠ2I(ÝðP¾UÅKOݾĖÃÆÚµÒ‡4wì8Ê ëkVç&Ûo0G¬p)LB°#–†G8¦c–Æ溦·/°e‚z°zQ@†d ¡-!€÷¯Ül„ZtØÈp™Nk‹~wð”È3ò`ã)Ǿâب ë³ai-–%ŸLwÖ7Ë´\!ØKK6ÞhŸ_[µõðÍS,¡Ž1¼#£oœÏ€°g ó Žµœ#ŽiåïÜQ†…wʘà(ô NvÃ";åéàùëç?fYY¼dWÃ&ÌT¿c}¡Cç†`G ¡=†šnÚÕÈØwæ×Vi‘{òö¥^[$¦¡¼d 9+[ØèÁ÷Xô¾ãÑT«öÉæýtGnž–"wϪ-`ÍþB˜µô¶:F‰ ZèŽw/ÑO4 ¥®IÚ{_qìèÍ Ÿ°A¾¤ ô‘u»ß¿ü‹}˜:Ѐ0wuò¾2‚ô†¶=tíßàa7VÕŸ×z’—È}rã¾óm×(UZ?ùÞö¯K‡Gv°#–ZÆo±IßTUßX½k©'#„ K&;«’W{žrC>ˆã•B÷ê&bXþh§Jcñ±7†ó»©z% þ×Î~ÄÃkA áØ‘¯B¾ì¡Æ]ÇZ.ðñ ÊÂÁ1A†™y¸i—¥%­ŠªJ’EïÛešAÈ?Ù¼‹„Ïx‚yœ˜šü×£¯ñEΉ[–7½ræ¢'æšÕ2« •-ìTÞÏŽþ†¿’)(!†¨Sž°æŽÁóO¼ÅÂä‰æ}ø·Ôã‰Uâ:4kØ‘7ΔŠìÙ­¼|êý.ç v×ö‡¯:ôK>£mª] óû…ãoòÈOºC?‰é&Źù8ÀDw†=XÔt3IÍÀy‚AïúFÙÍ£7f|xrŒ]r(ŒU7>5iß|Ƭ¸jXÔ:œ1=¼*ÊH,629æL‡ºlGmcö‹úªÁðwd;bxÏid¦S)É£ 5Ò_OÅÒiéßÉ!µÂ±#nL‚;˜ÅFâ"술/ˆ±,÷[æf;bég6Mð5ê ÁŽ¸•í²!9n7s8vDüê3¾FÂ+[ØËÎP“òŽ•å$¬±ôoãZ*ù® ŽD2šžpNÂ^ÊÏI} ÁŽ`Ž©WrË`wUaF/#vÓ'c~DYl,í¥¶QRþ’…4ªÐŽRPʃ(§áÅDË$2Q$K¦(IXÒγfÂŽik\”VŽc›Ì;b¤­!F²y†vYŒØÛ.qHBö°pº q!£ŒÄ‘H°D»`÷øÈ$õ=5ÖvÄr§­1ª2ÖXó±ô…—ĺIÂZªÇ ‚Wf¨q@Žv—½èì`G,7epÌØv«°ùL~§¯cJ`% k¬P숥­ð ™c$¬±fÂŽ`}ò»\^jX²Œô#!¾}‚„[ZÞêi“âK–­r'¬±B±#–;m1bàH× “:nŠÃ1m”«)­ ©9ÓÐǸ‚,—ÃBÃŽ8iküÕ±‘°ÆZ`Ø˶Æn–C¨ê‡Oo?×ë,6–¾âKgƒ°ìÉ-åx±Óɉã©ËHXc…bG,w†ƒ8‹ x]h¿6•Jù3ÖXóp¾Ø‘ÉûcôråÒº ÍÑÈP# Ússm#Y;2m‹ÒvÂâ(ݨ¢ˆ¢Æªz_F†7ÇÄ–º&i_…cGŒ 5QË•¡Æ¤dNŽLXce;b¹ÓÖ¸)½Ü±B±#–†¾ñ £4ðÿ¢ÜŠ÷Ír¬å¼ Í(‰#‘è 5W=¿ÛµîjØDZR¦­±K8Œ)a qjôÁÆ]Mf¨1ÈHXc-NìˆåN[cŒ…‘°ÆúÊcGÔ¯"C l¹'µ_Jp ÃŽà×įQKE?:'#®I*ÈË'§5 ª×Ï :15/[MŽ œ¶&3×Χ§70Lµìx½vî£ ŽœÅæfÏÝLÀ0ó´þææ ŽÙÁŽXî´5nJSÂK[Å2ÔåÞ {VmY£‘èN”Ÿªr9ÏlyDÞ¹GØWÚÏEà·î{ˆ°ºvâªÈy*‰ßŸ˜žÄ 9æºQ£‘°ÆÊ"vbù㫼µMƒ…mÜR†`G`i¿püMçÂÇ0÷ ªvÒFƒ.øèê1ß3!–ßó;Ÿ’W:áØÿ2[“Ñ|ÈCƒ„`G,w†ƒPÏÃM»5ÇáŸ}Ý{`'¢,6–eÄ[ ­ßiùÞö'tœlµ)‚.'×W¯2쫬aGtÚš÷äÙ×gu$KÇ3ô Œc+…cGŒ´5ëîyƸ~ÉvÄr§­1ÈÈNbÍvDÿú–Œ5+‰#‘0e ;‚#žLee±±ÜQF ÂéŒýÓ¡ä ¹¸ ÅÁÊÝÒwÔ2m›ÒÏï|š8ÂL"ÛÌ»qªýòôßþÂæh–KÃÛï>„`G,¿P0;ƒò‚<€¥Å¹÷YY8;Bik8œƒe‰OVìû;ž Ù{ðÚqJ‚i0µÔ¥På×5¬ R÷•Óï?ÆxËþ/…[Ó;ß8ÍÏ-QþƒÃŽqË‚A îŽD³í 7-[[ë–®!ØK±µCt™Æqº[u¯r÷JJp´?èr«+–S q¬œÖ¾vöÉf–^†Y¶Vú_掱œ´5î&Ù_âñøÊ¥µtI‹=¨ßuæ´ÜÒJŽS©iÛ“õd…òÝ[ú:hÈV¢¤þ˜£ƒ¾Ó´™’ÒIú ó ƒ6;b¹ÿ­BïX>k'`Z0Ë4 jo¸A]Í‹™ k¬laG,wÚÑ0»V^6òâÈpŠIE¬PìˆåN[ãõ¯g¢ŒÈV¹Ëyq_eZôØzÄìˆ×ÁŽ±2+ÕÄŽ *ÏŽ±2{Ã_ï.²²ˆqBøL:Ä ˆÎn3å-w2Ý«ì6>×Ð_b6/;¢›=ű$_4Iæ/ ZŒØj¶¯wµ±jÁ x¥*ñåeF¹fø'.MøžGŒ€¯g‚‚Ž0G™ïFʘuB±#–öfùö1?'éô¹cG,wèÝû¿X6^<ÇbÄŽXÚ½ÇI7ä=e¢¡/XÉh’w±$`çñŠÙm©û,/ž#;b„áªâÑbì‘yÁŽ1å˜À±º¤‚e]ßè`¦;â :be;NiñÌþ\%2Ñ`í‘ Ð˜HoÐk&ì;1QšjK+óÝr5;béÓ—¯‡ =e7Véí¾ÎiFi¢ #ôY†±I—U™n<‡ípìœûh( Ïæ½Lv×U ÈWBoõ´ù L#舵ð°#–^~¾oÐkáaG dïxŽ8è}åÐ#Æãó3ÐÕ®–i?”Æé†>c¶Ò ºë¾X[Yo€ñ#àxYEÎðáHAGè3v«/8 ûBfi!š;vÄÒ×Á|-.{I™høë…ö¼Å$QÐúl„a‚A‹…ÁªâÔë}¡k\î#,¥K7¥Aȴʹ•` ÇŽX:$’ 5ÄDAG˜£ ="©Igº‘O²‰é¸,âX0aùmw±fÂŽ@prúh86-kd0Œ.ßkhìÇMuÌñìÝ«&*WWUWVµºbs<¡²eF••¡Ï2ôˆ¬ ·{° ;¢Bܾäý«£…uèÕ®V‘,/3üPÊ^_ÔBÃŽÀ¦ò`¡û×nç%íïK.ìˆÊD㤵žJMÉ >–(‡ñ¯r«†yÁŽàŒsøÆ);à­›v­Ü$S>Y3aG,ï¦Gñ2«ÂÂ`a¢Â«}tÈ:b-Zìˆ ="Ç"'‘óàÚ†}aGp}ëÂ'òʃ¶wÕ}ÆÍ~8vôѵãÝ~ÇœÆÊzvÞLŒ:q,L‚ƒbü`d·q7ÈÅÔŠÈ¡¹bG‚F3kØ+‘¨"Ÿ…eÍ;bé×CÓ–ëmT,zofÄŽXvV§i9¾¾À+‹Øj9T£1A¨Í`:šžtÃGñ8ŠÉBiÍθ‘ÇP@ yŽ±´§sREÌ´ ‡eïñEŠ!vcS.ÿkž“«Œ Sƒ–Ë[!˜&éÍ‹4⤳I;í‡j1V5ÆjÌí …J(ðp„Íä‚øÅbÅy9žU=#vÄҺʀ:ªL+~;/ØKû83u˜#ß5¶H±#*™ÑØð¨ˆSÛ Q¥(,Sbå`Ëò‹n‚×€;¥èóŠpìqì˜vIÂDyA©w`ç;bi ­’ JL“cBU†ì>:Ø‘’da¹ßrÍvÄÒ{¶k°WÜ|¥)¤ž!°üÐÇia åkÔ‹Wa…cGˆcÇà=—~‰'pòNåŒØ( {C}ÆM… èÚ’àÕa§³I;spŠ0ng°ž»Õ<:}L[ØA¾} ÇŽXzI`v䙓Xã™J¬}5™ÁŽ`ÍW•,‘Ñžö{\…_«K–xÅÎÄŽXιK>ÁˆùÞä.4숥'èN_‡½ìõ¡LÃÒZÆÑÖߥƒFfûql1™ÎÆÒR§hc£AJ´öµsF0K/ ÌQÂc=†cG,}Xmím“Š’Ý4T-TÞþNy–ÃöÁŒ{9Î v„8b¡j³Ö¦Š¢²å5îü£Ó7{ÚúEþ/´gEù² ÷^ƒ„q £j,Wõ2Š+€ ‰ÝàxãÞ>ÇÄêŠå^m;#vÄÒ"â®;¬ÖCƒv ²óvµÈÈOฦb¹WÛf;biøȵ®V©Ca ­«Yå5Ýñ#––„—:nª,‡™>Æ!(Ê ÀÊpÿ®Êp„Pm¬j08b‚ÜáaÒ˜ ã~¼®tÞâíµ ©‹næPÇ`ÏîÛÂÂLci5Uûôq¡aG,½ËÎݽ*­èb „2ÎX:ò“ÅŠ{Ö;ªÖÂÃŽXZûŸ¾sYÐ;Œ˜!0¯wßÖì2‡Ž5+ÖTº\S©) išV&ÇÖë}™Î;biÙ{òö¥AqŽÛê7ÀkØKëb#v¾„ˆ8s÷Š&óÛ뛽‡¾EŠ±´r#æ5 숥}öF|…æšÕÍ"B»¥á#‡oœ–Z[q\½Õs@†uÒÙAïjØdœÑNݹ„…*±#[U˜ŸuŽ±tXˆ87ÇêûWn–ñ+ʨt6âJ«Ë»­,bG,-”^;ÁͲÓÜgˆ/,¿Ž{zåñ+oÒa…¹qF` i‚¶xM…;BôyË9u0Ø,B½uüþåÏzÄ»óGÖí6,ä–Þv‘ÎFU{éÀÚ^WG6±#0ž!êµ|Îl5¬./^Êš ;bi7í§7NOLg,Hr|yºÇÃ7O_°oŒ¡w£Íˆ±ô.³±hNóQ¾÷>!;biQÿæ…OäY6áÍû8B„/5‚¥qÉûÜ}|ãÂ!Èíy¸i7GˆpF@1y~îxªy‰Gkg;béh Þ¥ƒer¿Û8±!ÓÙP¿±ñ Lââ8vôñÕã2 èµ;¼0A+‹ØK__¼uñ°¼ÁÀÔ|{óC^3/Øͱç•3ÈëPðz²y_U±y‰‘M숥qZ\þ\>r1N8î½~þ sèP¤Óìot[`÷òé÷ì›IͲJ'¦1.î]?il´ õp|éÔ»òMpÄkpwPLPÇ8<·í1ïåj8vÄÒ¯†þúÔû]ý ãÈÏɃYèÕ¡3bG,=‰gï^•Ø‘Ðéuâp°#8ÌB˜f+Ðöë’Øk0ï #çôK8„JìÄ—÷cÍ„±´$¹Ø®3í:þÈê⥛êÖzÝmáØKÃG`±L’‘£jC±lŒK9¨EÕx+ƒ5Û îÇü]9ñøò²ï=í¼`G,ç’–,4‡x,QS²Ô¸s›ï´“ÂvV“qï“؜|ËÍ×>Ó=#}v²$*•d€#D06p®O«:v}ä?òºÃ±#–¦`”¯hbšŠœìLX`úÊÑv YúR«0×Ìù€mëò'Z*³’¯Û4kØK{µ¦•ë^:î­D"a8|SÊ¿Ï“h†oÃfÄŽX|ÄCñ+Æ-—z‹}•é·ÆŽ¥­ô¼ %Ûâ!µÉׄÊ©ž¤%2ÑŸ÷7Ò¢9êÊìÂ1Ó° |ŒEšÒ1».ÿbÒê qŠeb"…"rÒ3cM†F7µ¥¦S)ىѦ±;ª¶D<ÒGé/ñzJŽi ·™Žkv!p"°xÀéª$G´‡®J5Ÿ>‰$‡cä$n¤»×{eÌUP2¡Nñ ŽÓªŒòøä(iêÏÑÒ¾a(üšˆ%‚F5¥'Å0‰0ŽÓši*WóÁKÙ}÷Ë^p s¤†z)ˆ£Ôg9Á§„ ÕiÕÇiXr9ºñAC1Žò•YA§T`!»XÈàËWd‚´,Í5}Ž+Žþ£ =©Gõ!Ì,}†]bê,½ìQÛøô$ì<Ô´;2ê?Ófé$XA™dG5;)îcܵ£«Êœ7¼€6YŒ¦öMPUSý695™›“«mþ}tsÌ 2J&ÄÊÉ÷×Xz®ÙE‹mÄÅ`†N¥¦PO¾'¨R†£Â™M~.håL¨ÈO)‡c`9â‘©ÆD±¦è3ç/ó)¦— ø¢@An2hkâЛçAªÉ>båŒNŽé…š´rdt+l éF=ôIR5̨9NÀ>F%(²i¡L~®¿ªÆÄÙØíaÙñ´ìQ…ˆðE&Yn`e³í‹jEãgÇ‘ð‚´º‚úÈùæÓ:(”¯ø‚\’HG_|‰å†rbq”×ñáq²Õ” Z«XÌ”jÊí”ÒL r|bP1G¬pÄzÎWGŽàÅŠ/d?|õÁU‰#J¢’‚¼ü`Ž™×Pr.Y*686Œ]V’, ÚÚà82¡¶mq~ΟAJap|xtB÷1/iÜóJŽƒã#XÕ Ä™›ÄF&ÇÀõ„@råîðÞóѾ¶9æå‡l4¬| ÔS4°eK [¹'¡^’o†zÿD„ÆÞ§”º¾Uañ"L*éÏQcC‡ˆ]™ÖÖ²שb¨[#ˆ#ú84>Š Q ¬ 8H¿ô O(@Q^¡q#ipìLbkcmQf*e L” RµÒcêÅhA>³ø’‘ö ’°éÌÁ̼WKL¨§oņ) \PU’#çŽôV546Â._Ø«åÎ8 ™ÔGå +?hQ ÿ(Ù•_TP8B Ž”ä£EAâ‹Ê ð’ÂR_ˆ¹5;$º¥½&™ Ñ(FE4Ì‹aŽ‚VG0ÑÒR±÷QUÐ1§g¸Ÿj+My¯JªÆHZZÚB &àÅÖäj#ß ¯æ82‘YÁ3ñ • âØGžÔã‹ö°´Peto¾ßàXêA´ÉW,íÛ â8"8I9FrX£ı_¤õÅ—XŽâ Ï«AÖ—º‰DaÔSðr‚æ˜_^p s„ÌAÉ2ª2˜ã … A1¯9öébPyežÄ—‚ã(Šá@± ¥ C?½€¡9töBÎ{Sm2A³t öâßÕÅK â‚LÇÙ¼€JÝ {#ˆcßÈåB8öŽ*a²¤ 4ˆ#¬PC…åZÄU¥…ê ôcMIEya‰¯éˆª¤ˆöE{XZ9MØÓ÷%"† eæÂ1óZ‹÷é™ÏtIQ0Ça›cZA+9¢a­¨h|Çž‘~Šá·´°ÔÆAQŠ' P[RÙ~e$Wƒd&\TåkÓ‰¨®œ)Ø·XÛ@÷ÐØ𲲪Š€ª@m‚cmP§&ïôµõwk­W¤ 8 ÉÁõø¾dW%  µ´»;Ðuo¨õT—Ù ôÞ™/•-l#¦¨Í‹/!‚fG™îá>ÔƒbAZ[•ùÿÙ{î:’#]°.pá½!CA$è½mïÕRKÓ’FšÑÍ›™÷Î[wöÌyÿbÏžÝÝ·o¼éiÔ’º¥i£6lv³é= CH@ ¼j¿Ì¨Š•U( —·Áé£aãÖÍ›‘&2"2ã«HõrËheAY(Guc&vh|é<öeX¼é„’óq”€õ’œ¢À ìzGc ³*_b9ïÒŽwzÈÄ žùù±wÃ>Çœù<p$UÆqÜ嘖æ—¸ûù\h¾WÑ&=¯¢Yó½PŽ(†ÿÑ¥½ó5^•éA=óq´(!èHFj:_ì'x/(ãpÌ-žo+§[Õ78Žþw´¸=Ãýý]¨¤,¯d>Ž¨Š÷h™yór釟€:C&È#öiéó.íɱ~}ï åÑödç{ùÊ"¬ÀØ0ºËSâVa`áVAJçó -­¾Ü?#ó©qÚ¿è=Z&ï|Zb‘[ZwÛ¡Ý}`: v‚&»ù¤Ë9;šF«²æ9;R‡{â´j¾÷ uòŸ’’2ß ¿`@°]šå`‰£ïÌhƼgÚ*R ÎäӣѴԴùvÇt–‹»ù¢!¶mOÏ¡Y3©))!òàhÇÞð_DHnþª(숒:fš2ЦÈ#¸…ÄùÈ1âƒû(‚ò‘¸p¬PHPÞ­-$Zm-.¾o ´@h™Åbâ…søwI_;’¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤”ÄŽ$)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$}u)‰IR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIúêR;’¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’ôÕ¥$v$IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%é«K_>vĶìˆI(GÛŽDÊ1Ž4gÏa¸l?Š¥DR*£¦>eU-ÈÑVbdëBßÀ¢åsss‘HJøPÌ©NÎ¥¦¤†×6;7‡SSÂÍ¢ªHJø¨bäÁ4ºÇÅÐçà87M.câ }œ™›Åp…÷eðï‚£:=;ƒ>˜ëY{6-%ºÜô Óâ1³s³èfz4méU-ž#æ(#šž0Ž3ªñáˆ453“†«ß©Ùi¬íÌ´xqœÆ-Àqfÿ&r'5ÇŒxp„<ÏÌÍd¥e.½* ×äôT\øêGü/;=>'¦§0×á´HŽcS)))™ñUÍq:;=+¼ØèÔxzjZ\”É" ÁLÆqdr K#œ#Ö,„0Ü(ŒOOâ߬´Œ87q9ÑØôþÍ]ШU(Õp-153•—™Îqxb®W\Öãä̘æ/Ä1ñ441‚ኋ ‚Q+ÈÌ /68>½/Žø7g!e²šÀMOæddÇÅõM0aØ¡L Ÿ3C5ÀÄô$ºY˜•^ÛÀØLUnFv8G¬¬ ðáG¨¦¢ìüpŽ5ǼPŽ‹¤áÉÑ™ÙÙÅpÄXÅEab¦çfŠ³ ‹õ B‡sœ™šÍÏȉËn¨t0+=#.ÌÐÄ(þ]P}õf/Äq|z*º$§pé­‚/õvqQÑ‹ä881—HÏd1„!›/Í-ZzUèãÀø0´DxLJ§fgV,ÄñÁÈÃœôÌpo‘IFúÁ.Ü(ÀpŒMŽfçÇ…ãýáþœŒ8.’ —ðï‚ê+Ž”xŽ‹!ø½hZ‡¼g¨nÑÀ±t¨8gŽPãpÈËóK—Þ*ÔƒÚ`8ÂU¨qü[œ³€}éêEÃû¸HZ$Ç®¡y9qáØ7:€Ã† År3sââ'Ä‘à OŽU¬/voð~z4½4†Os­,( /Ö9x¾Ä‚Ûœ8RçÀ}° ÷°ê(Í-ŒËàî@O~fn8Gx/ð`ªv¾v`ºªpex1˜*ü»"·8¤ †ëÁðÃü,ŒjØÆ ±±ª.*_£mYe¡Ip„†Á1Ž„‚éêr\$Aì!‰\hqt9 9–òíض/†¹Á\̶}vnvT䤅¯YîmЄ> ß/’y, Ž)‘”D}/†®Âà£d\6¡èLII‰K”vÑqá…CÌBˆW-ñˆ‚¯&}nìˆ-þ;ß ùë ‹9§˜Íe+„Œ2Ë”yʨ¨¾[ÌR‘û€C4 ŸË'ó…Ò¡¸]©ó¬mZùüq¾}/ªr»©Ø͇< ÀÔ„±iv±ª¨aþ³B ÂÌì¬Í³dEÒ‚jƒÎWU¥FBà…b<ªÝ0?GÔ3=;ã‰`¿$›šà¿ç;`BU`Jµa¸æ300<•i)Ñ@«€†Q‡(ФQTOô1‚ªüSIA#–j Wf4=Å@·ð,§tÌžãà ÏÎÍOó;]ókLâˆ;àXt61:9Ž]1‹–F~ÐAí¤>GàóíÛ‡ô›þ†ZšpЉ2˜#^(†¡ðëLµ…yÈçÛÒ¦ÑÒÚÒU 9ØLŽ ŽéÅ9þy„.æÑ^]Tá¯j|jâáØTRœSè×ýcC¢6„pE^±iCÀº‡ûèo” < ÃºÆ r9*Yin‘_göò ²´&Ätû9¢ñãäK2Ò2*óƒçñÞàƒ WÀ0;~YÅ2D1°lÙó2rJs ýûÇé´”ͨ, 8Á öŽ ÌÙΨb%–;ŒOO`ÓÈÊdýŠÕþª 6=Ãý“3“Ô.´gE^‘_Ÿ I1V˜Ð]ey1øwºùㆲš@Žh+¬’œB¿‚#ä™9Â8Vä¯0ì]×àƒ¯î]™WâgŠªzÝÕªÖW–éwûhëbUe&ǹ¹Žî1W/a¸`_尽﫯¹Eói¹k]7ùïš’*ÿ~Ê ÃåTe+¥Šá ¬­­÷îˆËÇtåÞ þ{mÉ*ìðý;vCÑÑGpDUþ¨&¨g¨…écZjZMI¥a0\Ýý½B/gT”ù&ÝC½ÝCÎÒÆb\·¢:°ñ7ÜáéÆ°Ž< Üxp‡?î\µ1°*H˜º†#{CÙšÀb×ïßfŽù¥>MŸªc Gj{ >…¡¢±4Z{;ا…á@UþƒÚžá>(vD¡% Ô ßÞêëÔzÉQ'˜ ÕÅ'Vœ{ƒ÷ª2s6®¬ ,¥㘙³Vq4—6tNs÷-—¡µ¿f«¿*K•¢Bú»ª°l>3t²ý2ÿÝP¾Ö¯p %ZtPHØÒî%UQ@m׺ZY“ƒ]àYa{_g—;×–6| âãûw¸*p\]TîŸnÐÕ{7ÝbÕE+ý†Ö§ãaæ‘>¬A$Ö–®òÛÐ;ý]w: ³ +gkå?;ˆÄ­Þ»lC15›ËëüËôIëy×¼ØO¬Ûí/ºÝïv—Ë1o{UGÐ¥Îëƒãôi‚¶¬ R˜ÀKw[øãSë÷øË`í`¸à*à`Ö­Xí_¶Ì÷JdXm|ÛÔ} †m誢r¿QjìicsŒJPÆBnëë„–c‡¼0+rèçx¹ó:›cKMwy ¢ÀµõݵtË T1×þ2×ï·C$œ>ÚÊTaðmÜTÈóñAúˆáZ]\QW  ÏÞ¹Æ »À2Í=íwúïñGp„2ôs¼zïF¿[MКbS¤;ï·>¸Ã^4ôüÎU›£ßi<Îï[³Åá#MÒëct]Ùê@;Õ~…‹¡Uþ¹†UÉá'Ж(fXmp¼ÜÙÂÊ#€¹ö«&ˆÄõ·g\ÏaCy_5AÕŸl»ÌÊäë[žô·jäÌíkãÓÌk6P5}ÖvIÙ]Ý¡µÛÓ(ðÙ­‹üñ[Ÿö—é¸ÐÑÌá¡m­\hqù#þûðÚðBj8~ëüæ¶güe,%`møýh_š»Û`øÈßC/Áî@Í6ÿŽ N‚R_.ýÆöçüUaù\¾wÏLà¡í®nð/m¬Ù›Â€ër°v»Á.ÜÙ;¼c·0H…ãýK-£Ì1-óÐÚG ÿzá×ü74¡¿UЖï6KŽ‰õ>eÒÞŦg܃‚ô¬#uÁÿûùwùïßÜõ’¿8žïh¦øqÄò¯-©ò—üðúéîVnsź-•ëŒpó ]mb¡A ¢˜ÇerUû´¶v„žÛ°ßÏôAË)Þ<>W¿ßïЂãù;M·´R%ª_YƒéöW‡–}ZÔó|ý@ŽÿtæWü÷óºÇ0µ¿n>Égï«e°Ù!‡!Þ³zsàÒþ‡Ó¿tÿ´_Üxhe¾ÉÆUõ¸[Z¸Ð›Êk·WÕÅ`§Nß¹::A¹ ŽX¶þ¥}úöÕ&í¡ݳöù'Nï»MŸQU+óK_ÞtØßr¸%¨ý^¸Ç¨Ê¯ÉO·_iì¾eÓ@h½ÍVãà[ªS·¯€)}D{v¬Ú¸¹¢ÎÏôß®}Ú=ä¸LÔÕ›Œpž/Üm‚}ä'àebpÄFî%WŽ(ã_h _]=Öå6lWõ¦]AO´_¾q¿Ÿl©X·«ºÁÇqà½æj¸l‡ãÁµÛý„_^ýû²_ßòT๴ŠñÇÿáðwüe,휻ÓHÃM}-È(  –o:Pì™õ{ «=93ýnӧ쬂¶V®‡€ùkƒEC…ô7d~ïšÍAe®BE3Gtðå†'Œý 8¾Ýø sÄ`n¯Ü°wÍm?¿ô!í_0b(°/¨ èÿ9ö#þû[Ûž­ò™ÀôÐr²ÓÝ ãŽÊú}¾- ¼8Ø a×OÀ@½ºù‰@¼ãÿýñ?ó߯o®ÊçKÊnfù©õ{ýKû|GÓ‰¶K“j àp|fÃ^‚o?ºq¦Q/mZXŒUû¡0Q›SUÑÊïíz9°Ì¹Ž&æˆ=ÚË Güï @¯þøü;–ËòOŸÿ¡¿*Ðñ[Ùû‚õ?¼vGP™ p'ÇrH…½ÞξÍÿË ÈñŸÏþ[‡»+ÄJº5bÆ9r™–}d+ÈÊãQ¥WÙü Ã%w¡Ø9;½ávø}è„aG ðÑGŸä@ŸÀa2TÊ‚Ø‘ñáqŸä@$ cƪŒv¤otзm4»4·ØŒxaGî+$Á”ñ1MiÞs¨±#èfÇ߆âœÂ\úêìå4U¥9¦¬Ì/1N¾ÄŽ Œ ;!UQ•¥Y0`òº†z¥q!‚‡­‚±Oˆ vQÀݮǖG4%ZŽÞy\;Ò3ÜïžnĪRÕWbÄŽÀYïrŽØl¹l¡OäAg÷PŸÄÙ0Çòüc¹-ˆ&éìµ|„]‡Ü}a§§#—&ÇÕÅœ\z©­¯ÓïÀ@Û Xª×Y;r»ÿž4 ¶Ë±¦¸’æÄôT{Çì´¬š³Â¸`G Tèc Ý뎊Ֆš1€¸`G`‹oõu(üŸwô!Òò|ò,!Ü4”)v…•´öÞñw,jìÛ¥ý˜bG FZ´û• Œ{}Ùö` F[Ûi0×Òj¡’ú²v¡F»[cVÛ&ظ²ÆðLÄŽ4õ´ñQ©ä¸ie­áŽ&;‚…ÓØukÖç}Á`5øŽ&ñ#¨Æ®VZ‰B¢mh‰-ëØ3A«÷nú9b­ó©Ípì8^½wƒ×¾¥±#–ÖK[«Ö¹‘ÄŽ@ü8¶Ä#qõ‡™—v뫹§Ýý~L“Õæž6Ž-1A±rÙ¾@^¸Û lT…;«7±ÕF=MN4ËCµ%U2hz¾£Éõ¤9NÝUÝÀá ž¿Óèß €_øÄŽœëh”b Ž»W7°•xÖáèéAàyh8vï™;Ê·ôúíàxpíFøã™ÛWÁѱʂ²­"~|óAGko‡¯½¥r}•ïÝâpì„ùJç cƒlk]±Í'üáØ8§Ú/ùÔ´Ä~NG³ !Ü&„ÿRg t—QÚöªúroÐwAìHÇÃnÔfù¸¹ÂŒÊÇ;ŽXþÂpÔ¯¬1&;òiëy örÈ9{I>Q·ËØz,ˆÁºnryIÚ]ÝÀP'ˆÄ±›ç=[‡ãsõû9¹Ö>ŠùÏP\h°³MÂäqö¬ÙìׇáØ‘ÎÁûXh~Ž¨GÆrP¦À^òHQMÓ@4;+|êö•Ž%•ûטê+;[öaËiiш ³rŸ­ßo8rqÁŽŒNŽ¿ßrÒÏšð9ÇDbG 9r©È&ˆÍÆrSøñ#ýcCï5}6-v¾TöÒ¦CüšêKðrþƒ•[ç:ÉØ>¿Ûx¼ÌÜkc ¾±õ)c¶ väâÝæ‹wÔבºlµáñ¾£8º rZ^¯4aŽpo°¨½»{E¨ÀxŽÇkü„2Ž0Ùšã«›Ÿ`Žðm°´5GéîYëËÖ<éóˆÂ±#pP@;ÿËöõÍOñù*쯛OÄäÑÁÚíÇDbGÞ¼r´K BˆÒ¢i(ɘu8?¹øžÿ3ôÝ/ÄŽüâò‡÷|1PßÜö,sìøùåý1ßÚö¬ñ0.ØX–7.`r´•Ë!­Ìéö+§o_õW…³É‡) ÇŽÀüuË â(ý/ÔóÂƘv‚ ^ ²Ú¯nyÒŽ v §QÀˈ2¢i/n:ı™úÉ…÷ün,D‚wL­: `þ6ì¬Þø´À|¼Ót¼Q€½\Žé/m:Ì{|p„-cŽ<`+rŠ¾·û%ãôxAì¤ þªŸã÷v½dX™xaG~tîmTe8Çàø[»_18&;ò`äáÏ.)±§PKÄ6·÷»sqÁŽÀ k=OÛ Gº1ø½~ÀJ8v~ ãaµËŽ0vÄÒàÝýµ[ÐÉ‚ØxqºwtŠè·¾SÁ”ý퉙©&uP0!Ë€gnzvCEo0adoÜ¿MåQÿÀ‹–L6U<þ©))«‹*Ùï…‘ºõàîÔÜL,f¯ÿ/3-£¶¸Êˆj-ˆâUa¯X“ÔS#)•…e ÝÃÔÀåØkÄå ?{#æ›HìÈøô¤ŽÙ¹Óì¶?7#K.¨yDã l$‚9òñ#”F>!Îiéþ7|±#Ï©XÄÄ•}G“gû:=ëûØÉ gtJoÃÔÿ§¦ø,€™£‹/,“ü )ƒ‰µÊûeA")ÎØ‘ðÚxžæ<ÅÀ Å;â?“…—vDã¼lÿy–¥O|H•h|‰é¤ò ¨Æ™ÙYÿÓ¼”TîÔç2ýA%ÿŸ™¬J?3Œ™ZVØ(š±É Û×xúœ–A3¥ò®3.Á[s”#N{ùe#ƒ8Ó†{3?Gn*&q|*_biÍkD¿Â±#à8$òFãpœ™öŸ\0G¹¿Ü°#ƒ‡Æ9«ýH¤8;Ÿ/Œ«¡a¾‚öÌ!Ì,}xDxˆèÇz½C ^Ø7ê"aØ‘Áñá@d’.l&P ÇŽLyá L¶Ö+ó }°#c:iGC¥»J}ï ,;‚7Ng˜Àј©pì–¡Úö­3£4Ð_ß@WzcÃáØp¼ûÐ8ýaŠ±Ï¤¥íÂAò`œùÆ;‚Jð?ïi°Cy9ƨ†cG Ìš5ª‚‰4N´Ã±#0U·v»1SC~²´=Òp3¦BÍc¼ÅŽÇÖÞ»ssÁÊdmé*ÒuØ´è^€Ž†2G´Jf‘Tª(žy ÇŽ@Kg^Ì…yTÛ¾$È(ئÉ04qÁŽ´õuzÌ‘ªÂ2CÌâ‚iîis\&ßè×”T’¡ÒþY’㟤¤lZ¹–¼/L¢?ìMTœ]`ÄøSìD"Ð(`8*\\ü%Œù¬Oì‰õÖÊõ´·ïUø’N³M†r3°*1M`g›†cG°"nÍÃ1/3ó(Ÿ$;Ò¨à æÙ¥&»nEµñÊZ8v¤ãa7«/O0A'FæXÈ9ñÒ˜A4#þŽ¹ó°‹þf.c¬JC̱#ÐKœyvéþ“ôe…9>ÙvYì=ýسz3y_«BZ¢4LÇ7.}àýÚùOzjÚë;Ÿ' ¬ðÅ °š¥ÁÜÏnð¨¯pì8JI–^ßÙù+J|‰ÄŽX^\ÈO.¼7ß핆#†÷Ž¹ÐÑä‡ÇWØÆ…üøü».GÃݳ°f ï=;òñÍsî6Ç42h¥À™š™þ—soÇ™½a Ž ÃŽ´ô´½qÆÿ+[o¸ð›WŽòÁ xhF6;ÒÜÓþÑõSUã7]\Èσð%DTÂÄ;ò³Ktúû¨ç€q!Øn¨¸x¥EÓ~¸ÿ5ÁŽùÛS¿`D¾á½¾ã9ÚaWòÆÅ÷9b‰ýÁo—ŽÇù–v~fÎ8øô7ôÒµníAt fÙPì•þê³7&} ¢ïì|±ZgˆÄ>`>ŽtèÛô·/‘ÖìàɆcG`z¤ÿ)©ÚW8.ØØ;òüŽ(tïoí~E>I$väKïßÐq}/vÿÅB3 ÅqÁŽ¼yùèèôx$?wùE"ìä0…cG ¾®?¸íÔbÅ@ø·ªÈD™‡cGt*”fOƒÜ:³¢œ|èúýÛ÷•96ËP¾Úîak‰ªèÓÀŽàÿ6–ÕPÐk_7ž+Šá9ÒSÓ*œsL±ÚÁ‰ÐC'Êr‹ (;241Ò=Ôçm’ó!=-­ºÐÙ«ê7'ù{n¹¥ÃdÆf°#³ssn¢M;’‰€5ÛOÌLA@9º@~Ž™³m¿7îX$’•>o”6;"“—H숥w TØÍt ê md‰T $RRMÌJvDGÿíùFÄŽx¦IìÈüô±#˜U¤çÉ%à™çW¾Ô#KÇŽäÉúea|4$uYaG°ÆøVKƒEfí\‹®Y±|‰{÷ŠNpÄ ý+uÁ >NŠ·ÙÁ¼Ä$Ñ×Ð8HˆˆN/){Q׬(Wî”樞S®!¹ÕD;}©S—vDbñh U:×ûMMIÉÖp‡Ñ©Ø шJÍ$Ý3õå/(0êném‹]z¢…4ü‹áÂPOLOqÃEc2<9ªR=iJǤ¥¤Êd ÐõéÞL3!ØÊye¹=G Hì ’Ô4â84>ƒ‰q€œÈ™ÊËÈö —váQEËÑ£á‰1îcvzFvz>ö òC´S6!潈ªqžbpƒÎ¹’£ËkZ XŸuŒ±ˆB$ òÈ '=ˈP&;i—p |eÈÿŠÜ"©|±#pÝX€ÑA )`1“ë7.ظƒ¬ˆÀä¥'yKw\°#]œS]ÏZZ4:0;cÅLy“…aGÐ}5}º±+xÕpIoØz¦àhBUvÄpДŒDJ6'RÝ…cGzGbÓMÃŒôŠKO”sœ{ø!þ–« ʤæ\:vÊá®ê££¿Š²óffgyÒAkŠ*¤2 ÇŽ`¸DÞøôœŒl™þ¡4·Hª»pìHßè f {± dž Ú‰nˆ¸ÝßÅÊ+ŠBŠYy~‰T>áØ‘ÞÑ“ÐU5y+ íÐnõÞÕ ÍÖr’ !¿/ÎX+òW@hÁèÎÃ.~X–W28>,LIJÝŠjéÀ„cGn>¸ÃK» +¢Õ-8®)®ÀZ€0똫3œ•eý£ŽÂÔ7‚­Wy&b—ŽÁ:å>¢/å¥}#±,D@cÿ¿tì¯Ã>õÊBAÆ9bÓ»•­½|£ –gqvþ=÷<ÔÒkR|ý~;&ð#Ìòféw°¤Õ~±#ðŽ®tÅ[ô±é GíëÛ…¶V®‡}Áàðûx!ïxØ=ë:4ð%heªg¬b(L A€l”æOŒ¶èÚôÛÕEåPzì™ òíU¤E ÇŽ\êláã¿ÒÜÂì´,±¦ì+×Ê-w°#°P]±ø2FÏí£M7¶B°#°eç;šØ†ÒéÕ}•“Ö‰wl®Xe-Äw`ôjKªÀ‘/LG÷‰B°#àxöÎ5æ»'=C1ogÏšÍ2õH8väʽë°ø4àÐ +óKnõÆ"jàkÜ-²¬°#P€íî…)ú&”j ²¼•† 'Û.±Û ‡¦¹ ~lZY‹5'DÆPV.¯JÊ¥Ûú: }ek½„y¼qÿ6sÄâ¥8Ágàèê´ •:+çÆ g«“S˜ohBö†r¸'.G¯Ãu;åûI!ØøüŸ¶^ˆ5C+®XøÒEϺ¡ TÉ„l°Ÿ€î±öì\Žc­çÝËqìJ ‘!"aqvž@’é ĺ‚Á1z ȹ}Õ}£Ý†ƒÔ,Ò?€¯‘˜';Í ­³gßZµs ŽŽ&ÌÌ9âM•‚osôúYÍà+øEäú̆½ða l 誚Æî[ ì@ÛÔl³´:bwnÿʼRë£kß^U/oË ÇŽÀ^\wï8 «j®u·Š{p —Ñ—Žiéioq9¢ËWÖ\íºÉþ ô¡aƒAtZ§«µ¦bÍz¢n§ø†cGÎu4 ­•»iåZ<áÊוVo«Ú€ï4~Ê×x9Ú¸O œ((À:J‚Ýñ+ OX Vu‘cœùYyP€*—Œ;ë$#VvjðŒûF;8î]³¥±«•ñëЄ/l<ˆ?ŽÞ8îuaf^MIåÅ»-|´¸¹¢ÎHZ‚W ³h»!ПîÈØ°ƒž ;;øÖ•X${gõFhcJb+àNÃéµ.;oÿý–Xæëš ƒ#¤QºŽ ÃŽ|Öv‘í/46¤ýìík,oP‡¼aÅìHÏPß{ÍŸñGü°I]ãåèsøäßÞþ¼¥Ã–:á“昕¿cUýñÖ |~sYÂÇ7.¼?é>$CÀ¿½´éô“ñ#^?u§ßqH`#`j!„Ì €Õ†› i—ÍÀßò–¨ïî|5ï§îŠÆ|Á~AYŸ£rC«„`G`y¥´ã[ròY o×Kà±?Ù~Åå=P» ¢¨^†Ñå0¯zuuvdxrìÇçÞq?Ùj·C 3bõ}÷+pÝ¡…ØOPWÕÔn?që l½a†ùç3¿â3IláäÉ‚ëgÖïŦŒtêg!„0%lÓ£i?ØóuyÝLvûˆŸœ—ÝT^šSdXø!ƒ÷¥õºÜy½×嘗‘ó»û¾.{±tìÌÓû-'¹GB¸¬½®Á…Ëñûû_Ãï7ŸdC†±Ú·f+~å$ÑnŒ±ß ÁŽ`!KŽÏׄÇàø¾‰?~zñ×¼Q‚„AqºŠÀn¿öL˜–ŽÁše %(Šožåo_Üt°¡¼;©¿>ñ3^VO­Û“$qÏxð7°Y;Ñv ¼è ]Uóñ3¼—ëßÜ¥’Öüåg?åwÀ®ˆÄ3½´é0Œ8þågoðç×ïÅ͹—ÊV›¯?>üºFåàcÊßBK¬Ò„aGH9•ÄþòÝ–>7BŸŸ™ýƒ½ž…¶tì,#äœÂŸÐ„à«]­äVáÙéY¯n~BV‚ÁfÿØͳÓs³…Çæ‹N2-·³O¯ß#£'áØÊ1IUeça­¡<ãB –PØÂCc| ¬<"Ì€bùàô»?x˜·vÏ©}–z–Ÿ‘C'9êš°Ùi*V Nr²ÑxÆs¬..‡íCæî6—¡RàØ“ªÃv].I5Žñ#ðǦggûç!;-S+HR–[ µƒýLcK°Í š™!Ž©‘Œƒ„$ ;‚  {r‰¦¦bã ŸSG¦Tc1ìè>L ³ûÍá]®Ö_îÇñ#˜nÞ‘¡Ë¨Í «âð0Ìv!ØŽ ©¸°ŽD3¤Ãmê4÷„ 5¸×')JUQÔÛ²gfc5ÛA‡èÿ7:„cGæè€Ñtx`¤ ÇŽø Þ7MÒ¶‰*ù*R<±#ó!EŒGs¤ˆ3=²˜/OÎR±#³âõ,Tž¢eK&0R÷,+ìÈôì¬Û5'FÁ@€/ù„’‘¨¥î¶ƒ¿GßDã¾{­é,/”LALR£S(ÄI3€‰íµÄÄ=”T¿¥Kj 5fGù±¬°#h Lš¾¤†®°a9Ñg¶|%'- : šW2XÈÓ§’JiF Áக, 1™eI Kj Óåe+ØN S„¶ô±˜Ùq™á¦Ê¡ ÇŽÈëW²T<>c+{„òhƒÎ†â!ñ„ÆV—,7ìH¯@-¨Kj4>†£}) ðQ01=5"ØtŠϲŠâ·ðºb€ ŒëE„í¢ìÈdï¨ÚQ³ 2Õ%5ê Ó2ŽDƒX´ßîâˆ&º#ç1;‚A0‚ôvLF•X§+äG¬KÇŽ`ÉlÏåù%XY˜ ÌB”x8.;2éÁ‚X”½–—ÜËÓÞp숆ԣƒvÂÿÃXј͂ƒ ‘m®Ö©Aàà²2ÁlÊ>†cGä­Øÿã·è,§Q¡O0¿’#½¯Ü9xŸ•–’œ÷¥cGà‚‹^§ÔêËM:º™# Ëû&C°#Byø^U¸"KoøëN†Nñ#ØDz},ÌÊÅêÀàÈ$·5%U*7‰àˆÍX`=tEh@µ«„cGnõiPˆ+˜#piT¬õe«¡—Üm³RÓh&ºg¸ÇÓ Ù–O( Ì„L†Aþ‚s@!­[±K»ãa/LØ ôSÌ’€pMq%ÔHË}½ýÓ=ÂÈË|TKÇŽ`ñÉ –*Ö8Ê×jÑk‰üX:vDBÜò3rkJTe ±¡…bô¶Y%#Áàð²J×·¶ã#G+¡{·T¨WE¯ßoge¢!&žíÇ;‚îñ­êÑ´­ºWºôýâ®H`"ŒÇa H­:xaî\U…Ãñ?K…¦ê ¥Xüf*ÜH&?±µo.¯›Uð«Û ©¢C°# "bÀÛ«6`a…ºF–=ýŠ5žò ÁŽ´ô´óÒFêWÖ(@Æm:³V:asE,‚¦’é‹)j{©óú蔞P#võÞM®®F O»A58«ê½á±y±#m~Eöš"Ó:šyY­.*_-!ؘ׳:âH¾­r}AVÞ­Þ»ü%šdœñ-+ìÈɶ˼?ÂÏ¡(Œ#GêvÁhr4Âr“‘`CŠØ{ÇúÅræŒb(°wÍfLÐ'â¨}SùZ¨à§Kj ÄÎu¸”TŒ 4Û¹úJ8~঱µAÝa!0(¤R'#Áè‰ôû6äjçÍ+±QB™Ê‚2h!Vw0¾_óÆBB°#B—ÔÀüÛµO¸À ¢©òÉ¡ZuI VèõûäÉØhÒ‹â*+;ò^Ógœœ Bˆe‹Œ°tÜZZ´ìŒ+üä[ŸÂo]ùX[4UÕÎêMõÂÏ_:vä|G#ßt÷JÃKg°`!Ç • 6aØ‘Ÿ‡Û .©YY L…ßñF¾C°# Ž¢%˜Yìy+X(-ÿߟ~‹Ÿ®ÝQ·¢~#/LxÚßßó =áÕñ[{^Áó·®e$ Œ£ º‡`GІ>ûo|Ôs‰EÚØÕÊÊÆ÷;;_¸©@!1åðC ‡Va]½cÕFˆô§ £d$p¤e‚on}FZ‡ìv§b 4çŸ_þ°ÏÝÝ£üí‚Ì\h¡knR“u+ªå½HKÇŽ èîõŸþnAV.|>€N~B°#¿ºv [ B˜¿¦Åþ¯OÐÒV±»×¶>#•ÏÒ±#ï·œ|0üŸXhûk¶ÂC€‚µÜ 'œ‹ ÁŽ åêˆ)B7ˤ½¬Ýò䩳Æ^ ;‚ ægmÝðv²Š6 |ç@ \NFüÉÛjÞEe2ÓÒ©•‹tvŠÆ ³"Åå{×Ǧ&èIE~)Œ#¶`4é`L°£™›Ut²©¼6+-ûY÷ø1’—™ÅÞ=Ô缉¤§F©ûø!…ðTzo&ãìg†&ì<9Ê¡~ë›(;2<9ƱäŒh:† ~sF§'Îņ`G`¿l7fš’’‚fØ:’Âõã ½$ï&Q—%)ìÈÜ,‡kSh&Šéɉi“¨4túÊÂ"Y‡cGœª"œ ¢Q ó!«ú¼Øý;öÀ­$‰I,vD?œ31AŠŒD ²æøbGR•XšØ‘Ô”Yí²ÂŽLÍ̸²k§êô!–;Õ-”ˆ0ZÃ)ñ0SÃ#\´—M4KGéøÝAzÈ¡A[WN]“8 ­#¦ÝR*¸‹Ô·ØL¹ãcD–vD¾.4ªE‘íd§ˆÕ—¡”²)¢ úň¹£ ¶GÅCº¶†“î~8iðJPqtAÁ‰iO´ ÁŽ r™ °Š(/9¢GpFÌ`ö‰#ÆeÀ¸¶fYaGðÕ U42£ŽóC;ya j(У4<1ÊÇýx¨27Œˆ„%™tÞ$¢ï6† ŠbÀ=ž³ô-•X0öFÊ ÙþÄ`G௰ :§Àð24³P Ä#;2>5!/:¡"†K®é‹/;‚šÅ”Y´VåÝÉ…Þ“¡Ó¥cG¤³ˆ5Eûaùи¶&;‚îvƒ1–N kö¾ø¤É>bÀ+ Tw0Îü qmMvD}5Ë'¥-ݫ༰*®B×€qãyç‡DKÇŽËN½†¼‘$Ü”éC2èÍ`¢ìˆ÷‹âë˜M™–c÷ÝÜ숌¯£Ë´p$ü"ƒ"ÌR|½O¥4…cGœè¸V‡>^’oÒk¼? •Ò;´§Â®‰ñpÐKØza§Çê £M›Xùи¶&;"¿²ôI+=äÕIÃö[_X3A­_‘[D@´n3F=«céØ‘›½,TœÄ’ß·´æ”Õ.;r­ûf,SHn v_OLÆ_NÙæŠuÐÿX>­âáöª ƒ÷yT!Zü6$/4~Hô8bG®ßog»Ÿ§j¨‰=tô^1FL´ÀEã/gÅ+ÅV}Ùš±é ™e„/ %îÅ–¤¢#-=íd/lr WššñÐñjTŽyr‚ÁW2“3ËŠ‡6– !~ˆ†¼ñ*ÆÏé÷-7¥ €HvD^X›õ›âm}]¢°ÕÃ-•ëNµ_a¿?§d°¶¶¤JÎ{v¤­ï.OYª\ÉîÝ`3ƒ+Sî‡`GèÂËpJ;Ý+/,7rQ,+ìÈQTÛ±ª^a²çf?ááúíaù¾2]”ÞÞ× eKý€§­ÞWîhf« y CvA¿OF¡91kŒ&±õª‡]@ý2ˆN1Tyÿ½YsÚJì«Ù*/¬ÁìS¨rª€…`GðG/ %èuRõP¼Â¾{ué¶ËCnåkK«H7~tý4o¨ €Hv$vaz[=îoîi»ãÎ;8âá‡-§DåÕ¤rÝ°¢"¨‹¼Ìì3·÷`?·a?vspQΈQ}ÉûæzvÄýJÍ-òUÞiü”5á®êMÒl…`G %´žQ A¦áØ!êÁ¨Êx<>RåüÐÖqèé¹­¢V¼ºYaA êu[·eò…õpìÈ/Õq¹óåÁZ…‡ð®¸o…òÇ%bGP9_­¢kØÏÚI†´é!L vD}Õí|¥÷Œ^hMÝmòõn©¾B°#ô8~¥’äÉò¶1&ad-|?Êš9áLU¬òŠ:RG?¦‡ºk·É|N!Ø‘s2ËÈŸ>÷ûTþ3M‘«iéØøHüUz4æ]«m^[“0ìÝšDñ;lgháü×O~¬¿T±;ci/;!Qq4ÍrKÅzr!È¡X!Ö¯ÜE†`G.Üm¾‹îëŸq¢>òí©³à+[‚ѯ 41vä™ jƒ‰ž*› ï€Oˆ…Ч*We ³œm»z¥dr„ʬP÷ÛVÓ©=þ§c^½rêª/«W/1Š„%–¾&µÇ14ª•0÷±Ü½‘HAf™ª¶ÞÎQ;Ço3ÃìúHg•„!“Ú¯²JZ!š…}¤3jÂŽð’ ŠøDôi€ –%;‚èCj§ 0"$‡fíD| ³ó&g¦ÆÑx]CjJ*aAÐ ‘__†~B°#³øJUå“”z$â<”±ï숼² X:2‰=ŒâW:í`GhˆæT¬ÄD0Ù ÂŽðC¢ìˆ!ìdF‚-rÓ³!ŸŒa˜ˆÄŽX^€ÈrƎС¡—€‘Ÿ‰[B1ê”`è$!;‚ Â"’Ø‘2U]Ø  ÄŽðC¢ìÁDø#@à÷<"숆‰ÄpN~ìˆ~Û-Ä;Â0ùÐÒ{!þ;;¢¿ÒGcócG°˜˜™d±Ô0µ‘Ø (‰ Ýâ±#5:½‡Ay, –p†‰Jˆ–Žá¯$vÄY4v-‘©h(ØÃé݇_;²ª°ŒÔ‘ÄŽ`: "ü0ƹˇD!Øȧs…ÀŽX:Í—¡T4î ƎXúa LD>„`WˆÉZ$v„¿’ØK‡·›{Úù6:ÆŽh@Éø#ÂŽÈwô;¢¶— _ìÈå{1˜H vu¢¼ÄŽlÓ±g;²©\½‘釉`1ò‰ù¿3ì„–¶ÄŽäed¯**—©b;bé—Z$vV@‚´üØz(±#`W¥õ†ÄŽ”æÖ–ÄâÖ‹ÄŽà«Mú+‰±ôÑ'—Ov„“![;Ò¨"£Ÿ;‚áâØ3cG ™ÎÅL.vDž³bGø!Qväê½ücG¼‘ÅbG°RHKì,ãe±~—-v&ï¤HÜBØK¿o-nâ{m¬ 숥ó«Kì,;½ +±#ÐÿÕ…+ùJÆŽX:ÌÉõØчª;z¶~ÿñ[Ù 3L$PB´H숂‰èP¨ÄŽ`‹ñô†½ï7Ÿä.3v$ ò ë ÆŽ´>èˆ] ±#2ˆAÅ9ù;B0;r¨v‡DÒ/;²Ó…‰Hìˆ ÁŽ¨¯”g2/v„JìÈ~•PD5FbG |àäh{áÁŽ(€tÔçÄŽÀýÐòæÁŽX:dÈeâ‹éõ~Å0‘HãËÇŽ€Å­©$vL9t‹ÇŽ¼¼é0ü4;uƒÎ@4ÆŽÀø6¹f‹°#&ÃŽ`¸8û,»“Ø‘oïPA8;òüÆòla‘ØŽ €¸UrMQÐîÁpÿGÇ/Žþ$/QbG  ¥s¾H숆‰lµ¼Ø (‰Dâ‹a˜ˆÄŽÀÊ?)¬[b°#ú«Xœ•°# PrÉ (‘ìÈ?ˆ„"ŒyWJüØ‘¯oyª8;ßÀŽ¼¸éPÏPŸ;rñn‹ºbÉûhñØJ(b`G^n8ŒÊy[ÍØ‘ PÒÌ ì‹|L±#«ôe4_;‚_y8.;òp|˜Wñc‡¡ý|ÔØZñÂŽà+ÙZ‹ÃŽDuŠë aGŒýÕÒ±#îëþ_ìDFõ `GêJWõ ÷%±#yÙ(]¬©GñD¾ÊØùÕc‡Ñ_uY'v_]_}.ìVesOÛçÂŽ r<ü¼ØüŠŽöüØ‘ZNñ¯5vÄÒ±Ì8bGΈ¯>/väØÍs¼C\$vUÉK÷‰n¡¯âˆ©bÏd‘ت3^Ø|uB©¯$vda숥"±ò‹ÇŽ¼®¿òcGšºo±#÷y±#ï»WÛ,;bD‰yZ}Ulù°#–~ œŸZìHVz&‰ÁÀŽd§gI¯õKÁŽå8iò?/v$¢Ò·x‚€‰ÇŽ¤¥¦Ñ¯¾všUxø`GTE ÄŽXþ¿¾ªôïÿΚyòŽØò¾¥Ç;"Á‹ÄŽd¤¦¡Án¯“yG¾ v3%1ØŒ!Ž¸skqØH›®*nØó"›E`Gø"§ÚÇ ;R˜?>51)®§Iæ±>?v„.²IvÄZyGø"¢äùÂwÖbG* Ê°4ü×Ó$;‚qãy_ìH»ºžÆÑÿ‰ÁŽ4õÜâÌŒÁz‰]d³hìÔ`“ðÇ ;¢¯§‰ÅžuÞ‘UEåX› h`ìšq̽ÈÆZ\Þ8üO®ßyDØu‘Mí¶£×ÏLÇnq°#'Û.³Ÿ°Ä;k]޺Ȇ?>^yGv¯n€¯¡ìüÌsw®}^ìˆtgõ(±#ó]O³ü±#ЄtŠËq©yGPÌgÍ"±#òΚEbG^Ù|DzkKÌ;R–W俳æÑaGö­ÙJZ”èñÊ;{ 6vKΗˆ1î¬Y8fØ‘š’* †¤àkÏpŸÌW!wDKÇŽ ê£ÄŽÜ¼Ïz*TŽjv?‘0‘µ¥U0Xú"›ÊAF­Â±#­½wÙÆAt±Øñ±õA êð¥Ὂ¥U‡<ƒÁŽ€Zî·[–3ý˜k,=u‘M_,vXSR Måö1;!GH/U¾ž¦­¯“Ââ±#ƒãÃ2B¿IÇ$våkŠ+5Ld‚Z½+É^sO›CÝ#<‘q²¥cGÐXŠ;‚ -ÀJI[:väúƒÛ,ÆØLPZjšaÛU Ñ&æq{Õ†À#Ø0ó¬a e<þqÄŽÜî¿Çb™§j¨±¼ØÆzçc\PÝŠêB•ôk¢©û/̆òµ0I7E›ýØaCyÊ°©E=´¢¯uµºêË®,(“'§!Ø,‡[nÝÒG¨–;¢“‘¬å ÃŽ¸)F1vÄMF¢tdƒ[D!Ø‘Ž‡Ý|.‰•E8§fu‘ž5[˜1&—î¶ðB ÄŽ Œ\Ú!Ø‘;»øÔ±#Xqì}aaJI ÁŽ@/ÑR¥?X»&³#ï:¡c5¦åƒ±L$ ÝR±®4·ëH¾‡ !‡¶‘9?v sïêÍÎ1Žz(šxæöU^˜Ðœ0 ¹)F;¢¯»næúÕn8>,ï¢èµÄŽfçïªÞ$a"š2y‘ žHI ÁŽ@$8óºžF÷ñzO;Ï»”¬n€–èaAìˆ Ln®X'ÝÈEbG —HH ´¬ „;Vm<Ñv‰­@ìÆ‹á}(Œ8Ad$–Wa~kÛ³4Høi¤õù°#?»ôéëiÖàãN|T=~fý>鑆`G°l§a"û,/vD'#‰¡!—Žùä湪$ ÐÛŸ²ºc@ Qb°# <ãM1âÃŽüæî—à óÇìÈ{&ÂØ‘¿ÉH`õ`_Þ!mÔ€]­ù½ý¯]Ò0>!œÓ§­x¡-;e«”‰»Ò^Ûú4T+\™»ë‡¾yQÁD»ÏØLïµáaN!ál anÈLFB‚¹ÐÑtASüج)hr 8Ÿí ŠÛIì~(øìÈÇ7Ïñ6n?©/‰AáÝÕ ;òÔº= |L†‡¿ìHKO»ŒÐÿÉ‘ïZ^ìH¥./±#õe5Ïè¥ýOg~ɇ™‹ÇŽ`“¨ãåÎ@ÿ§'¾gy±#(‰ÁDv$–ŒÄ¶×í”éÒ±#?»ôaç £L;ògÇþ…E‚ ]ý£sïðO~C§1°#D` ÁŽüí©_°[v´Q’Ø‘×w(Ó&a"?<ð­üÌ/©Lâ‹ñÃD,o2’Œhfíãg°Ð¨ËwÖP2‰yqÓ!¬>lÁþê3¹EØËkã;Ÿ“‘èòú6¼ÖTàH†LbGÖn;$à!ØìŽ.|ÿ5ÕÞòKÇŽÀ»øPl:(ňĎT»€¢„aGÞ¸ô>ØÀŽüWg¡©Ø€ú•5\~éØèuz<ÿ5ØøH§(;õuý~»!ßž:‹å¹Mì”C°#zØÄØ‘'Öí ¢¥Î9#N¾Ì)¶oØY‡`Gè`AbGêJW•æÍÎÍb«(±#–Þ;ØX™ÇÐD°Ðàvb~&ÉMÏ¢ £ÄŽg†!ØÙ€#;’M«.,—Øl«i.ð,æ—…±m»•pìætbf’±#üæ6žL~~ìÈœmNs,™^’7°#òÖ ÅŽp\Øš;‚î Ùzìˆz¢"þsY#ìÈìÜÈ3vD•aìH$’Y¦Øª$‰‰'vÄ zOýú‘;b9·Øˆé‰?v‚:çÖOB)sæXz%ÈòË ;"“… %Ø°á#æ-úÅs# z­4+ÖgFjšB“Ì87ݪFÓ#ZÙÅ4‚Î2¢~¨»FŽbs "`(iݴݪtz’èJ¹Ù\0‰”ƒiYaGPOº Fà«”# —29YI‰´ÈŒf $zÁ’†^ã‡2 Æ9;=ËÖ*;ÖÙ´Ìhj*žÌÆ8F1øUì‡}‰š9c©¬\èþ¡ÃÆXŽI8vdxr”!G4ž7œ˜ ˜4 Þ?¯„¼ŒlÏÐÄ(÷“('kYaG@}cƒ,½g4¬y5ESR õ™âþ <ÁhŽ³A6ÐHŒƒ„vb0'g¦‡cÙbìÒœ"ÌoïèC¶K¹éÙàσçÃ%1 V¢°#ãÓ³A#)±v¿´JÎBvúªG 0iý£¼0Ñe)iKÇŽ@evtB÷‘_Wš’c²tìj–1/­ž¡>Ö X…‚cvÄÒOí÷¨¿s2²àVb@jm»HL\×`lT+ Jñ¼kðs,Ê.n_vÄRq¸n^¡øUqNÁ} >¬,(Ã*à·íAUep¹$GLº\MKÇŽ@†{†bˆš 7µ,·XÑB°#–ŠQuòKs ÑÍžá>À®Ç¹B´0;roèü!º… “mÔ­¨¯›M‚ý¦ãa/mŒU¹8 ÇŽ`äG\MŽu @OY„Àq}Ùj•žÄ‰{©UŠîäffßéïbŽ„éW?t$RZ£cBí"Ž'™ÂÔ†`G°ghë‹åÌÀaeÝê»ËIË4R¤jYËžcÙ×–Tc½ÈL*ØþI3´tì6œ¬CÀq]éjTxÇûªá]¹FU/;Ò1ÐͲË^WZ uÁ§–‹A›Ù†B³a ÎÊ«:jJ*ñQNIž°©ÅV\Þtð8bG0;œ5ê…·NøJ×KH‘Öòr <„ÌsšñÔ”´öâÊ=‰Ñ©*ÊÊk¹ßÎê ú³¶¤ ‹¦ÃÖ·”×á‡×º8×½½¹bôLB°#XP—*ÊÊäj×MF?—ç•Ê& ÃŽ@–8ÏakÕz°¾îd'²éÔ^zÑ!ج‰|ÚVµ?D¯'g´®¶Õ‹Ô˜Pk!,ÀÍ•ë°Ø%”g÷êÉ1;Ò7:Ø܃&ÐK‡]·X}­/[#1¦!Ø5Jm—f\ˆ?Ô ¬Ucw+ãö`ªè²¦e…Á(1²ª4§pKå:È* ý‘º]0šR ŸP&ï63$ |ÓÊZXþafZúÞ5[ðCãÚ,aF“Ø:ñÀ¶ÊõЬ¾ œÕnÇåè[+×ÃXŸ¾}Å1߶ÒK˜#üŠø!¤û¦ÓíWø‡ûj¶æ W3;ï”ø!ª‚_}²íŠ„¡`¡AÂoÇšš~°fl¿;néS{é'„`Gà´ŸàQµU,O´]â­_ýÊÚ5ÅM’›™³oõæž‘~‰M|rÝnüðƒ–S®wdoT?¬¼p·IÞ±s•ç 9;Ó£•ƒƒ¿ÜY½ .A³@Ñ=_@îwB°#=—4A)ìÐÂH,vhƒsw9F ƒˆ…ÜÖ×ɃÔÔèKÂп§b6N+°¦Ô;®©…¦Ÿ­Ì/‘çÑáØÌ‹|E?„`°ŠFS_öBm–Ž9zã,+@pĘC3 ãùŠxm×Jv;¯DÈù™ û`˜>¼~š-–ž´ò!ØKAšŽº?„èî®n€„wq2§ÌÜçê÷C_É«¦ð„ ÄÑÖVHÑYMbiøÔºÝXgcøNÃ…¾yå£é˜,ÕCö>k»xoÀá·G´¬Pìôû pž^¿b/Õ!E~~ùCæ¸ËÖo½ÈPN(ÿÃÞRväxëüD?\·ã¸…`   !yåcVGßØúLá[WŽŽ¸?„q$€QvÄÒaK>)Ú±ª̇-§Œ,#šäµ­OÃűŸ¼oÍÖÍuXÎlµ¡í1k·v}*Öøö¼*O)C°#X°Œå„±#“înB%Y±úý–“¼´×—?Y·çƃÛòê±ßÝ÷ É1;‚õÂËÒ]èÊÓþÅÖà!8E0·Ý¥ Ëøâƃ0 ÛFSÿÀkrxƒ€yäP8ptß¼r”oX†î=¼vÇå{7>spf¾³ó%ø*ÿ*âýßÙù¢LX‚§÷“óï± …½(É)úÉùwùt æ¶JïŒÈD­Õ;ú0fl¥Ç¤=Z:vòvÑu¢Ð¬PìÙ•™pEâ÷tB‘??þ¯,ö bR³õW×>iëu<:4I"¬PìÈûÍ'›Ü-¼P| !µÊŸùvÿߧÿ9Bz±Ð0é¬L ^ ’ã±#Ø€üõ‰Ÿñ›O­ÛÓP±ö½¦¬Là@Buèô$ŸÑØdDÓ;Â?„˜¡ä›—ʾ¶íéóMœ” Kì??ù}p”óòÒ¦Ã0÷°Y|ÄÔPQå#3‘`" 3SŽæÔíø涧e2Ýì¼ ?) © ~tCƒ.S-;öw§~A£Žïï~›»¿9ù öÇàpJ ˜0ìtö„+ò­íÏÂŽ»þ˜ŠÝA÷ÊÝÄÒ±#=…1Õ,‹²òŸ­ßwwÀqr(VHNŽlá|Ø´DýPÿ,ššv¨–|û+ðí©³ØÙÉ‚ÑŒÎÎÌÍ.d}Ùj˜°æî6ÅZצ v ŸÊDSS·ºØ‘Y{–ÆÞWi¹ßÎXgxhÝC}*¡ˆz†--ÌÖìÜìE‘ÔF¡0+ûPw»Žê¥)¬Ç}UáË(í¯ojD Éê¢r9A!Øxb„î%€&%7# û,¬YB+ÐÛ‰pÈÑkÂŽÐñûÌìì="…~ #"ƒ±tÀË=ÓŽd¤¥ÃÁ‘Ð&Â=fçaT'F¸( <žãÃplTåMvÄR'„ãlªè<¥#͈â˜å±†`G¦f!\.ĉ ÏMÏÍp¬ZD¢ìHª¾¡-äÆS|ζgEôœ±#nò˜øÊ xvÄÒ—Ý8_¸—–HDA$v»‰¢ÅcGøÛ$v$!v$€™3F1ïlygÚŠvÄÈ2b!¦Ö2ÃŽ€‘‹ÛpÆ\âlP'á¿°e{¨—K×™H,'ˈmŒ9S†…€#ÿ:@ŠˆGHÐ…tÍqÚ¹ìÆù*Å›Q&¥¼+|YaGŒo)M wJr«LÌLÆ.²Í>ædd§èÁîžs3µ|ò¥º™HŒ,#FUPÓdƧ'\|O@±¼Ìl©Íñ#0cr̹D˜2Ÿ¨Aƒd1ºYÍsÓ2ÃŽ`G=£š2'î¢"h§¥_låy¤îð¨âcIvΚ3ǧ·–?©42£éäßèËnÜü4:ï·\w°ýÒ)±…±”ËÕÏaN·‡•(__¶B±#–Ž”Œ É!°ªåŠö R-;biàÂXG§ýp‚½—Š±ô®q—¸º+çR.´pìæŽÏĪlíeæê uÏPƒ“ÀõóÁßpp=C±#èW¿ÈÔ¢9Æ–pY^ )Ø®¡^yù”%Œ)>V­”—Ž±t€C€)ÎB›s]Sì·pìÁÉÝO6ÌÜŒPSUîÕ3DáØ|{7–ÅÄÎHM—PË✠c`=ÙhÎkKª¤‚ ÇŽà[u[„Û £ª•)DqÄÖQC¾œ…j«+­Vm"E%jÛØ\Y¡ØKOßว¬ü†¦tÕàœ»sMÁlïí¤V<°#Pkèã¬èã´0‚PªÆ_:v9„NAÊÌmj ÌcÍr@βœb,f.RÂ×ï·³2!·G¢67‰ãlëñÄŽ€®tÝ`7ÕÓG[]=KGöã×E¦8fôb]©s“X:H#M#ÚZ¹úÿò½œ2PéÛâ '!yc…bG@·úîr:K IÑ—-ëän¹n7qüÄ ÙzK"}¿Ê‚²­:„|3vÙW£ØÞ5[$Ð ÅŽà‡:ÀàÈ(Wå¹½oZ¡ØÐÑëgàÃÐoi¿Ï¾j¦·¨ûFO Uc4u’Úw²ŒÄŠeŽSrM]ûëvIŽÁ·2U{¬*M`g8EKÇŽYF ŽPã†4&;b鸴/ð»FEªË—6’®c8všðlGLEÓ+üqwõ&òèŽÝ<Çn^š{ C£Cƒ‡Ø¨¾-DÔ¨ Þ8Å»[cds1wÖ tˆŠ9w'ÁW”‡Єôþ=L˜Z.K¨5q#ªý´{õ Svû²£7ΰˆÂ« `JWÔ1…`G@o]ù˜îU5Ò¸tìœIˆ(Oœ1~tH°#Pƒri«QŒÍãÁµÛ %‚A߸ø¿'Uñ|Á‡yF§§G~…ª‹Åš°xëœdQÇÙy†k2p¿½óyyüŽ‘9E,íËWÅ^n8L.7”<[í4U¹-“¹~së3p_ñC™xÀ¨ º×¸q/;bii—‡34†ì½OË?̺XhvŒ£.牆`G,}¯ËÑfŽôUNF6 °‰øåµcü“’ì™,Vå&YÝ ªLvôÑõ3×)ͧ¦¼Œìaq(úƒ=_ÃvÞþ?ýՔ땡Ìäì4o:tnÚÁŽXZ$ä;y9|´aø½ß ýÅ?œy‹YÈ2ŠcþŠomVÖ¹tì6_wúÍX«2sœ¤ z `°  ðüXi}bÅtAñœÃ„`G°Qb<¥„3GÞ= /ôÍn‰„—æõŠã»×wBRè¯n¹aG,ý>߬m®´47›7iznFŽ?6ϲ:ŒÃô¬éTñýUüÃ'­HŒ"Ú4¦x®¡²§g§¼H ¥’4G³ Ë ;a˜œž2û¨’8¥{û87>=1ç¹UÉÉþ$^£Æ¬HfZº •¡DV<u73%úOƒ c¥k¨JÄ* ÇŽÐí9FÁ ÖZöcî70Æm5Çå‡Aï<›Kzà™ÓS£ScÜGú:(|‹ª ø%_‘m/4‰¯)!Âp‰†±´—àßÂu6œ3k!숥‡>!«Yé™C;Å;¢ë™Ò~•V˜žU•çã숥>Žæm5D bG ½Ã3¶4¯Hb±®1V†íÃÑekØh›ÞÑa8TUP1¹´1Ë}±DyAQøe,.ØK¬ô:c Ÿ¾À§Â±#–­®¡Þ™YØ1'# 9ÃUX;‚öt;WÞÄ49LÄU†K!Zèà´7²™/Ë+28.ˆG4Ɉ€WEA©äˆ=F^4ÈjY^‰¼ñ»©^oÈíÁ8ø¥:;¢9Žw<ì‘n•åÞV#‹aƒ-ó0Ǫ‚²<ßæ$.ØË{së}¥`­˜+NØ8B÷†î+  1bÞëÀ&±ï•oÆÛZýÖWI«±º7xß@£V”‘ë±ÅŽXÚ–u™·ôpU–Ë( LFëƒ>ÃQS\)Ý h‰›½†}A=«‹Ê¥“Œ!íôœVã[”ñGñ#–6@+ƒcy^ÉêbS™';byo®!BëV¬ò…p숥3'µõÝó¾mL, SÕÞ×iÀGÀ#æW&áØK‹Ä­¾»<ªdÙ0AþQ ÇŽXúu®kÝ­Æñ+<¨V?¾¹aG0ª+>â´ k £*• \½wÃpÈWæ—Â`É>¶õu¶;ÑP§*|»¾lT¨äJçõ‡^H4xAÆ$Gè·+ǘP¨ÛjVx”Ö¾¼±‹86TÔùÕW8vÄÒBA5rˆÄq鸥¯úÖòk8n®Xç7áØKû$Í=mBG,½siîi¿7x_z{*÷rõF¹Ð —®tÝžð€°Õ¥3«6F}Û“pìÈ´âx«3–ðL<´]Õ þ¾p숥/Akt“C0m*_ËH;âx¹ózfŠý×îÕ›%Gè³weÆK_s³½ªÞØ‚-ˆÇK-†ú‚ŠÛ±ªÞ¯èâ‚ÇÓ·¯ððÂ<ø8& ;bi#{¾£‰]G4ᶪõ>Ž `Gàžh¿d¼ Pš[´§ºAÚPˆý¹;× g"!óœÑÝ×ÿYzw|°v»\ÚÐKXeƒ‹f+_îÐÚþ]y8v/Þm6à#ØÇ^»CP€ã™ÛW•ÂGŠp/÷Õlñs ÇŽ€#–¼ ÓÒ©2ŽÔ£¹= ÇŽ€Zî·_èh–OЫ÷yøqÁŽX^DsÜ]ÝàW­‰ÄŽÀüøæÙ|DO¶{˜qÿÉC8vÄòÞ\C•aw ‘ž 8~tãŒpÈÕPV®ä«q¼õ‚±×öG¬E`G°ýÿ´õ‚±Í‘}vÃ>y¨WütûU÷ìÅiÜŽU¥¿ø©ÛW øšýDÝ.¿ëŽÁS5a¶ºÊmëf‘DµžÓK;¶jsÓ³ŸßxОŽA’¡ê¸ðÚí[¼Þ<ëÜ\ã/ˆ„_™' ;Bõ¼ÛtÜ@'Ào„úÊóè‡`–ŸY¿OÚP¢p숥=´¯Ÿ28Òm5òɧ·.¨)p„¢ðsŒ vÄÒŽ±¼þÏÒ íÕÍOÊ’0@ï·œ”‰²,½…ùÚæ'üï|†cGà®ró<ÁGøX }„« 7DFþºù„L7bi_î…ý—Ž!Žo]9:ä=…9~q“‡£º€ææYã·O­Û#úønãgÆË!°z/5’éœá÷Âß08Â…~fý^ÉñDÛ%F„Ѐá[”Ù\aâãñ#–F„üüòGÆŽ õ@}£숥õÒÛ×>1NÈÛjˆ‰AÕÍ5;!|¥áˆ ³â„-€ä´+C ;«ö¾­…°#–žì|gfg%v¤¡¼ÎHÈa-„±´ …‡01=%q!ð{ëWÖF½ç*·z; 숺ÖVœúb‡½žFBÄ€éÑtìM¤:6=b¤ yü±cª”çc*ƒïH¿ÄŽàÛò‚Ò"Ÿ‡Ž±´{ Ë2çÄ ú°ÁA7ƒi[n1í-ÎÎ÷{/‰ÄŽÌÎÍ «à‘ëM‰W !9 ,ê,_HtAìÈœ=y!üŒ´ô(m v„âÂîiO ;‰žÙw‰0p„fœ—FTÆÜ”ÀüáØ[—1:ãŽX‹ÀŽXà Ñ=Iàˆ—>7vÄàëÑ”ÕNS…¾—(bE¬È¼µÉp¯TÁ$×F Å¢ä6:Òìæ«Í©J³Õ…‚Ä˲mg¹‰˜«ëß¼‡Ižh§DRGŒÖ­1k ÿq*WE·=©[´Žh¼¾njN…º=!h¹êªæœE«oÆR0U–®Jg ¢‹æÃÇÈ3Žù 6š#_y2_chÙΕZþ2h’dµ±½žn»·»§ç3³ŸÝÏgvþŠýe?½3{ôt÷ôékìVÛ²,ÉÖa]¤HŠ”xßI€qßw¨ýfÆ{Qñòe=R,¨¶^تê!+#ȈȌï‹4 s„å£ÏÙ6Ã%©ˆÇ …œJD†}fnfÎë#öTÖ†¡ƒ˜##ÜU±$ħPdba>¡g'ÛàË\¯Á (Ѭȟ‰ÆgÕ)uS«(t¾V‹HCP Æäh™GUÖõˆ|n¼ À îða‚Ð6ŒjB—µóêÄ_ƒ¡e"´Š%ÃeE-hìŽB)Ž‰`¢"ãú§l®žæ8Kúò`•¾šJ©>¦“ ÒVÌû– ˆÆ¦'h­A?`¸¬CAP'¥và½qIJ}Æpý]G/ñ™)LåÜÂI µª¢†¡ÅÚû´rœNÍ0Øí¯HÚçqLÁÂ2ùí­² Å;:39­ƒ(SVTš´Éê”âèeöVÞ³…#úˆÝ8æubjŠ4B+X ㉆±2 žéªffR) þKT–”[ýTì%ôZ[(N`[GUbÚ4GKXÂÑÛ’C‚Veá8812­u¦Fì•TØ8b•Aì±UC Ūª «úBΗ^¤r/YdǶj&5;ŸžOÆ“Ø·‘Žw?jÓÇ¢ê’J+GTÅê *ÎZ•ãGÑÕ”Vïƒ2GÌD‘£U«qÇö,“8º¨4›^•Q4ì´‹l1‰XDCØbs}yM#$ahr"¦4¬ÖïÃ_1£)Ó 7ëê÷ãöj³È*ª’ɱ­BˆaßÍ6| qdL!VP¶Õ1ŽÞ©Pyq™]SÓÓc”x³e¨“qV´5¬²ŠZ545†:¡”PÌŠ¢Éäü«ë–[ý=¬ ¾±ÁaÅ1ÑX^³Æá#s¼6pe ð«K¡x+³éU ;ÞÚl¢=ˆ®êª†&ÇÊ’ÅÐ9km©oå+j­@g襛ý”¯±¼vm½èìPª<ía¦õÕ­x0Q{ÿ͉Y×ß "˜‰ %Pþ¥WG‹Ñg4).!’áêuõ+­UÁNµ‹hèŽ,ÀÊ+ýd‘ÁuS“}uˆ¤nip´:«°³ÃÝC#ðÑÇlÅÎu·ÃŸ,‡#TY¿Î­†õÄê€&‡‡ÜTQßTY— ZbÔ*Ò6yŽv¡¡ÆQ^=¯µ˜®ªc@ûäàÕœÌåKcî1Mju/õuŒ{ÎjSUƒÕoW¸ðÞëø@UµË­~û%Õªaüæ ÚV[9ÞîhÿÿúàMÊÚ\Ußָƺ@Ušãþ gF! ÇkœAyòÕÖóØë‹=×ù«që ÔWž,³ÌãÉ®‹hØÌ\ ú ' Z¥—jÃÆÅ66šù ¹ØÍaÜÓRÝŒ@;zÇû¢9΢@Ku£µ4!<ü›Ôa_¬QíÑB…É´"›³TÝ¥ïèBaƒîkÙÜt Í绯Â(` `\êË«³™!™‡i³Â¾[8¶÷߀;ÚÀhEu#ŠY9bi£ \…†òZØ©l%Úþ¡5;¬eÀîÆë™T–”dz·Àqž‰JªZQc-†Ð´Mƒ´µyucuæÖ”ì– µ¡˜µ(ç`YàYß A°Ã¿¨¡¡¢v[Ž(ЙAÛ—[ ]B S…U(œàŽNRr¦+cC÷@!Ì‘ñý«jšìUéd“´1ÔešWe+&‘d…œêºÄÙUµMA ‘—™CQ¶ ‚Ø_¸Ñ7>\¬·ÿ;”ØßNfѽŽ¾Ú‰³U´zw¤d~l.“¶Ú×X]¸UtBŽªê³û„¨mf ¾}u6ß^½n71J +I[UœÎ¨Ý—û—òdYy²Äjª`Ó&‡õ¶=¦ßU«µM`Áb0‘šÆ`–%JÐ~ëIÌÁØÌäBz[€Š@¦p"XX´ | uÄ.ŸõDŽŽiºá=ZÏÀžÞÌülzaA#*Š­NiCP ÕÝ EåÅ¥ÖS˜ñÎU²…­ðù3¶Ù2L© Œ\iÍv2‰Vé8ÔE9­m’S1¦ìA@ZµÈœ´Ž_.¤u 3³G0”6ž%oÅ…õ51*V=½@‘hÏÖ¡akü÷ò)"Ÿ Ì‘¹µÇ†áÚèwˆ(p²ƒÜb2_MD~ºìHDEQDEQDEQDEQDEQDEQDEQDEQDÿ:(ÂŽDQDEQDEQDEQDEQDEQDEQDEQD}~)ÂŽDQDEQDEQDEQDEQDEQDEQDEQD}~)ÂŽDQDEQDEQDEQDEQDEQDEQDEQD}~)ÂŽDQDEQDEQDEQDEQDEQDEQDEQD}~)ÂŽDQDEQDEQDEQDEQDEQDEQDEQD}~écGÒâ¿1ü/[1Qm,f/–v ¹U…KsUV¦øsza¿X«ZH§¹a¨©ÀÆtATÓT³Ô¶~º¶˜[Uµýó ó ^ã cYªB] ÔMT¢ŠÙÚ¯ªÒL;'VXPäˆ:æUU›ê]¬ Žb–ªæQPšTX€ÿZ9Îy£ŠÚ…ñ`ÔZ˜Kë†èÆ ƒs¤«BûÑÅ4z‡V9âoó󪺠«R­#6;ŸZð/ˆƒc° afn–¿–$Š-wÒ©¹9 ¤@{QaÂ*¨jÞãX/²NPj~ÿG1T€ÚP•µa©ùÔìü}Æ\'’Á2¨dõ¨ª!'ã k±éÔ´ã­Êòd©¥éô´j¼ØB5òq´?(9sós3ó©9Œ½£8ÅÉx‘ufÑËôBLI`ªŠ¤§R3sŠãœš‚Â’DÒº:F§'øsiQqÜ&„¨grvŠ>CfÊŠJ‚e@³S(©Ù;hyqÂÒxÐÈÔ˜ÛH=\VŽh<º©†K/Ÿ’, Ÿ™LyóˆZçõL§PÕæò€VYG§S3ô2S‘,³6~lzBOæX”,±qÄ\OÍNƒ££—_àˆÆ`¸0XGXbè]E²ÔªF§Ç¹•ÅåV €–O¦f ®PK(Pše(&g§'Sî<& UÅåÖ>öñ窒 +G4µaÅÔ*‹c­£JÅm<Ê’ÅVÉA%cÓ“˜&¨ ´ £j| ÔÐä˜÷-½¬¢ÎÚø¡ÉQŒ*}F«Ê’vYíàªjʪ VŽƒ#ô‹±¶´*Xmž›ÖK¢…zªK+‚ ƒ0632Jã ̵UQ`®'f§1À"5AE6301<ãõUUÛeµk¤…º²«ú‚<£an ‹êË«ƒeÀkxj ­ÂAà¡Æ­}œ˜™ŸÖ ¯Êdy¹mð¡pÐMjW2‘h(¯µqœÅ\ϸ‹QOMi¥µXïØ ]YÓ,ƒ êÇpÍb H)Õ•U[Eºcèn¬¨ ®YGé®ñ‘é1è(^Ô‘€Î´ö´\q<¹¬Ò.«×»è£©¢Þª0±´»ÇXV5µËƒe`ƒúÆÑ*,7,1ÔƒQ-´ÙÇk7ùsSe½UK€ã­Ñ~·YŽ³¶¾ÅÚø[#}SžÂÄìX'õˆb˜ŒC¶b(38é.4L÷òª+Ç.ÅqÚãXUk« t¥¿“?/¯j´ªh¬ëÁÉQc²¥º1X¼úƆð/Ú_®lCyMPE£Àá^þÚÖ°ÊÚ*pIJ¥Õ™YQ½ÌZìÆpR˜š ¨ue3 ŽCÝüuCãš`8j¸”Ú™„*M7W55xõŒ   Xã¥z][õ*ŠuŽ›–Y8:ÚpôO ÓgÔ¶ª¶ÙZU÷X¿2£ ‡š’Ê&Ûêèí‡T 0ĸ´¨²ZiÓr}àèY«úòLP° „ò<©,ò|8–V5WÖ‹aí\èâ¯[š×Yûˆ4áMPcEU}Îܺ»¯µuË­†¯ö»ëvjm}¡]Ç™)c-þ,301Ò;>€bè#Ì:Ô—UrºFzQJ íÇ–ªÆ }D%7QÙÌ$šWUR„Õô¾ ÌœñiÕ0èg¨8ˆk#ì,«/[W¿ÒÚG¬ÙqÕG5fÀ&ÛA÷ŒöC¯¢1XŒË*ë­Ö ’Ó­Œ{Zs,]Ÿe=^îë@é3ÊXÍ1ªº5Ò?>3×N³âh yFÃPú ó.ðêêš…“_ž,ƒ Z­Vë¥Þëüõþ•›ƒeÀ±½ÿZ…R]Z  µ~üÌ`ÉcgÝOih‰ÕV?-¿Ð{¿î^µ5Xt¡çû PªÙTô‡×OóçMËÖfãx¾ç*}F³V…2cÞÞdyu#dÕZìÈ5Á±i­UK\ìꀉ;X]Û,x©¯Î ˜Â¬×–UÁÔýÈü¡åÀho|EÍ2«Â„Çÿé3Šmij –A%ü ¦X­µ¥Õ˜£`1óáîþ‰‘DA¼ª¤lEuSPabƒpuàÆ€61`‡ÞÁ(X=“3·.`TµnÚ¶|]¥m AÅÿÑ°¸âXAµ®G”a£€bÛš×Ë€\ù˜?o[Þ†’Á2ÐH§».ñ×GÖí –A!ð¬`bê˪±1äX¹÷¯|DÐËË7dá8vRp|tÝýVŽçºÛû&†Ð<,üêâòÍM­VŽï^>ÆŸïkÇŠ`(Xdh ˜³ê’rèœê@1ì²Ïv·M¡y ŠcÌ•ã;—Žf8®Ø¬ MM‰¿âÿm«­ÅŽß8?ìm¬ÖÔµ¬©³x˜ ß_ü??¹áAkÈóUφ֔VìZ±)XfxrôBïuü‹¡h€9+¯Ý¶Ü"9Pnß8Ï_ŸÚ°'X´‹=×zDZ À˜C÷n_Þ4µ¨ ê º¦ eàzm´90PªíXÜ“£Øy¡”jÐIÇS]—P•7[RyÿªÍÁÍ# @VaûPþÆÊšeV-wûo@/¡x³P_VeãˆbêSÚimXaµ¡àu®ç*ªÂUaÍn¶é8½G=Õñ¥Íû‚eÐæ7/v(lYe-”!̺A~íÜþ¼gõ6ëòŒÕÐÄ(mâ ÏÁb0ŽÂÁ µ €ªAûw®ØdÝù¾vöŸWï]½½ÖæäÀõGØnRã[›ÖY‹¾vjÀsV±4²ùí¯œy?yë£Ö20= /è¡5;‚e œOߺ ŽØÀ‘€7…ì#¶„{¯co…?¡*X„Õ¦øÔ­KðLP †Åî_µ¥ÂæÀ|põo:ö­½Ïê¡¡ÀÁ«'øë׶=,ŽG;Î@ñjŽØ•TïÇ€ EU'o^¿pPŽÖc°6,Æ ½WQ[²0QW^³cyÛr›q?bžŸ°qÙÚl›Ž_|‹??²îþz[Á‹è…OËÌÌÍÂ{“ '¹¹ª±¡¼úÁÕÛ¬‡Zÿr"ÃñÑu»‚>!èÄÍ X³°•É2ØÙ²ÑZì½ËõO¸û¨ëšE=çzÚ¡ÆÑB…ÍËZ­Å`ªPŒB+(öØú‚eài¾v’6Mðê¡ß°Ð¬}üÅñ×ùó·v~1XÀQKûÊÙ[íôoÛm-SÕçíѶ4·ni²l¬ â°lûÆuUµ[›×µºÿQç9x_ð¬À¶ãáµ;‚ *9Öy®olLÑAØY«bdÑhu|çþ/Y Ë–>ÃT=i3C°ð´{džà2aKŽ¬Ü,†zP ' ‹°‰{`ÕëàtW†#T„Õ8‚~rìUþüô†½Ö]!Öì¥ÞÅ1^´ Wo]eãøæ…Ã=Þ Öºfáìað1hPyLuOܸÐ>p"]/‚€í€ØÛÖ#ôŸ¬nX¶Æª{á[^éëœMÍÍÕ•Ve3|ؼÜî…;Q¦6_ð{­NÎÉ›G´ÓsœUµÍ«j,GÔ°rbV5‚OÕ5ÜK!ÕŠd™Õ—ÐÛ½ž‰ÙI|¨.©D“°Sî áÀo×ËlsížrèðMY–sÇ;;¢(ÏŠêFk¸m*5sK ˘õpo~aì¦çfP˜ŽLëËj‚^(Ö#\¸™¹¶´ÉxãoyŒvµ›ÂX¬(^„½‰õÔqbvŠO9Ê’%ÙbLt¾Dq¬lѹ…¹±éIþj=rL§ÓêD(=Æ£’‚ÂÒD±5@Æ›PüCj=VUAÀ9: ÕsdÛy¥´ Û©0ó‚ŠöÆ ñøÝEiuUM*­âcq[$ÚqÖijW¶Ø7ÕÆŸ­6'¸OÇ4èÀ Pœ$T ;¢`AGíÝbYʸ•y :|n)'ìˆ[…X³UhLÒB¦˜e"kK;iY[Úm±¢é vÄ*ñŽø Ï6PˆW€÷n³ ™†¸»‰5¬ÂÆn˜¢6/P/^Û ØA ‹:m‹£” à@/QZÏŽF`dF55Ž¾bŽFÛ$ Æú@m¼°Ñ¤àé?ZžšŸ5Bc>r(f5(!ÐøB¹{AãutsÁ‘ï@ã'‚ e:53O£‘vÐ;ëNËá%dž«¯éÔl`Tc0WAŽ“©éy¯ ¥EÅÆ:3a¬ƒŽËÁ®[1F•NK…9ˆ[A#ŒrH« ²ž]:šÖÃepD³á‘}¤á Îãö,é3…CŒ®à¨¢ž`(XBŸéðÈÚø¡‰QȆ‡* ŠôÈÔ˜”y¢Ò¢yZQˆ¯j4Šã¦_…­8ƒ!°!74¦&ÐÇ4<¹ 4dT IàZûxS„BëË«½%8MŽûX©ÎåƒÕÉ8aGP xŒ‹ö g!Ž×6b04ù´(Îæý÷ŒðÒV¡/›;ë¨3 (J¶ :ǽ°  £vŒbi+¹Àšm¬¨“Ó401¡ «`î#*¹5ÚïMtÚñô Ê‘4]#}Ó· Û;úh’yÖ úäÈÑãÉå :¦¯|X÷1£O0AجJÁÀæ“œl©t0ãÁÃж¦rðű§ p÷ªËqyUƒ¡+ ö7†Ã‚è³±Ð0æÍUõÁ•Ë-¤ËP_0vØtq¸‘ {ãà© i£žàñѹn÷䃱º¶9[€™!& àŽ’pm kÞ?\ðsÖÔ-JõïTÂÑq‚¬!m‚˜¸&û†öjÿñÙLH;8Ñ.F0A$VT70c¹ÊBÌ"ˆ^gÅ8úØŽ?£ªlQáîQi—®o09Bw Ý2ÜB¬ ìÛ=9DâR_µÆK=`ÊSk˜t±÷:Ë1Ë@g^æàAÖŵÁ®)¿Q€{¹¶®Eú'˜‰%"‚¸nl\cø *ÜK‡ãº®¶˜±ÖºF\Ûa cÌ%B‹KnhXÅὨ΄«”XŸÐY§ñÛÃ=l­²à .&Ãð0¡vø$ôÐZûÉÑ™[WX™ƒõøÏчPÜò­Íë¬0Í‘©q^0ÙÚé®Ë#Ç•5Ë‚†ïêÀ.ï<ÈQ”úKRC Ü>Âzž»ÕÎÄ_×Ö¯+ÎDËð¾ % Ò¹B÷´Ñí¤‹ùØ8GƒîbS [|_ËkOܼˆG‡ЖBí¹Ü×!àž.µ¨£asåB^S SUiß™e=ªˆ©ïCÃoG(g>îÑŠš&yЉ¥zªë’á aT·/o“F¹s¨ÛS™ªªK*w´l0„¶ø£Îsüõé{fÍL~ÔqVOPÆI@%¨è‘é'¼qáû)í @6ÜÞÑŽ3üõ‹›–qô14û «l*úwçòçÝ«·Z£‰p9>¼îr¬-­|põ6kU^?Í€B°Ë†zí¬?~ébj>ê<;&ðñŽÚñÅ·4­mºÂ|òæ¥9ÿ–ziÇò Òo?yóbP™@ ìHõ¥ÞëlФà14ê9Ó}eÎï™T&Ëv¯ÚZâ9ð[ÎÞºB¥[5¾U Û ŽŽß¸`x˜ñÂøΖA—õ Ž&RuûZÍh"8b]trTr¬_„†èà5úŒziÝéØèW'ÏŸiÝeÅ{a¡hÏ@L¾¾ãI£Tåû펼Áý­÷÷¿ôb{éì±=¸gï‰hâÜ÷´Q.Ü¡k' Ž0Ž¯ÙÜS¼xü þüèú #*9èˆ|¢Ý«¶HϦ«Ìw‚¡÷ÑûZwO~ñq&¶÷xÛnƒ#ôüÁöã¬ßˆ0\PtAðñÛ—>ìãØÞº­Y@“ÿã£ßòç“%Ò¦ÃcWèsCyíSˆ Ë;Ï£ŠÞí_¿á‹b¯÷ÖÅ#üõ»âXÇYÇOðWo{@rü ýD§£êNP™@íœìºHEð×`XO”1ªB“žØð ù€ ýÝùƒ\èö|ͨjpr:Í“–¦ÿÉ {‚Êüï¿ÄŸ¿´yŸ¡mP fP¾¤AÿʼcðÖûW>VÁC~ ˜¿;ô+>~nË~“ã\êÕ³ï³Õ ÂìY³=ž|åÌûÝ£®×§}—-À úïü þŸþk˜ìo¸VMúÊÖÇŒ0\=iô½ƒµ•˜w.ÓÈQßÁïCkïã¯ÐÞï\>:@‘W¯ ú%D}½|úì;¨ÔW·=nE|ÂuD1þúïù–Q{Æ9ú]š/m~DVsMbüûãS뙹Ôï/ n:`õ‚ U8 ì™à¯Ù6ÿï{?ãÏ0VÊÍ‘^i†þãß1 Àüòä[|ÎF#àË[öÍÇÿýîOùó ;ž2^<˜™›}åÌ{7Gz}¿I+_.ˆùø—oòþÞ Õ(…#÷³DpÀ¾°ñ!ã\îðµSG®Ÿ"çMúæÎ/¿Âöùõóp‰Ð;asÿoÿˆ?ÿoO|ß±t&40}†7õ­]vˆ L«V(çàÆê·çží¾b<Ä’|¢-c>úÆ{ö aC“Z׉-¬„P¾°êè34,c¸à“ÿüãß9Þ\ÿïOý‘µñ0£xȪ5˾s¿i†`ò¤ J„mƒ9¢=ÐK—ù”ÀSa°ìA¯é@ûq0¥ÏÖDÿÇËŸ¿ûÀs(_<ñ&úè×%н;ƒÀÜ}¥ÓC9ïpAÇ!bÞÿà“?³ùaÙG%öý­ˆyÑÆ'7ì ¢¾^>ý.9™(Å÷¹~û/]Q†éÊꦇ[ï“6ôÍ ‡±mt㕺$Ttr°Ž\ØAlSÓÚl€u4ŒZÿeC ^îëlïï$vØR×­ÑþËj½àÅmÔË‹K±‰6£fúÖ%.³/Ë\cùZÅÑhÙOgG4ìmY^‡Ï UTƒgÓ©ÙÃÝä/qà©P™6È ±ÝP–Ý›kªëšGžicÁrl"æòtÊlðÅPð.}¶tÇ`4„H¿e:ÊQì ¬ ÛguÚöÎc±‚ªâ²`€Œ·½*•åUgñrµ;GFù…y lZ¬FÂU'ŠB¢´4ü…*.\ÄíL+?gÖ‹îy²ˆD©Ý„ÀŽd ÊK÷8ÄïLÅM0‘!#YƒÎøŽ9&#òi]ø¶Øn¹[,ÂŽh°#ŽÙÚä$-øŠ™afïiÚ¨7Á”!‹‚¡¤V¢«(,Ï—²t3ˆÀ ÇŽàOêÌÈV™Ì‚%=ïŸ1É̆×Â=ˆiÅê5žð%–ªÐx#‡D8vṲfÒ¶ªta×®£Ãe”ge¡aó²ÙLAPÞ¢`G¦RÓAÔ©ô²d±¡,±#”#ØrG‡| …ŽÑpßSQa¼ÄS¼-vdtz"9rôb¬L–ѨÎÍÏ¢’.Çx‚›G™*‚eÒ:ýõQa/¦Ç¬J À)¨.5›·Ô°#`4“EVkK« 뎈ŽúO=J—™°EÁŽ †1;GåqÐ;ãZah,¯3ôj8vDçJN*)Xìˆ ±6iöÂY°#FÞI˜Mãäh©aG°¨o õú—¶»’ ÆWx{9ÈUðÔ˜¨Z¿*ç6{l@€2a!Ъê&Ã(ä ;‚å,JþIgkph‡§Æ䢖„±5<épìˆ~ƒÖ¿-vä@ûqÏôûœ80û[Í3ß;räÚiålø‰퉶Ýäcúþ•ãsw9tóªöz᜛Ã='o^´:@$ …ŽG—-«Ca/RˆUÆIh ¾÷µld_èÝËÇ‚ÐdGÃGžÞ°×Ø^…cG.ô\ãèýíRvÍÐuùÄŽüîüÁà;Žv®žlÛcô1wìª×ΰºUàøìæGŒ‡áجáEû œ4x½zö=â(±#Ä1ÆÇŽ(8H–Mª2¼¾¼aGàX¾|êÛŠZ#³Èm±#o]<,7Œã)‘„FV.Ô}†$ÀÍ7(ˆ¿pßSÄÆñó‡ÌZ4¡ž‡½¥ MŽþEí~ƒ6Üãp숆ƒ|`6JÔ¦Ž ÇŽÌΧ^<þ¦{4á·ìpË¿H?ŽyÿÊÇ2 ¬D¦¼~ñÑë¶Ãå$£ÑáØ‘WϾĽ}{×3ÆF oØøó?;öšÕpÀøʶǸÏô›e[¿›÷ /Ÿ~÷–×lYâ÷½ÝϧC‹‚ùñÑWÔ©Q àõýÝ_!Ž¨ä׶…†ml\ÃiŠ  ¥³! "aÀ>ò†ÁVè¼$wLÜWìb‚øªpìœ.Ë6G×+cÇŽœënϸp~Ú³zû^ápìÈÌÜìßú¥õôX6ZÞ°#‡®žøÀ«Ä g6ïÛê¹Ç?ÿèwÖó„d<ñ'û¾A§Žð‚þúà‹Öª í ›µ(ØTò3a%ÁŒBAq%¯ÏüM„¶`× ·jQ°#¯œyÏM^b.Ûôww?gl!ñ#ÔGÆA¡L%{¶°z$övÿýúsi‡cG.÷uÐ#`0uüØÊ÷.tc¤'–‰Ÿ{üb± ““7ìvg)yI&ÜêŽHuI¥±ÿ]‚Øl[Ñžé€:2-ä#S(8´±LÏ2Ý„Âd¬ÆÊ-7Êg숣²,›GîyÃŽ¤Õ»¯£úÜžÅÊm`aÌ Ë;qrfÚˆÒçXA¬Ô‹ £´Šd¢´ò‰q´`Di;2ïGljùÿ$+T‘Ü,ø3ÊaG‰ò‡q¼yJû‹Å'‰rtxÌ`± ìžÇ]ìˆSB9¹ƒCè*à,T"q$1K†’0ìˆ~ÏÃå鎨 ñÄ»â$M•È×|)ɇf4?¿`6,³§õpapUÓ^b• Çd")—H8vdVÝÏ2ï•zµTB1Ð*Š©ÔL:3æhCš¿*.Ç~¨c®^±‚Ây"##*œ;v]“P›xa|N NãÖ€ìz713•öŽSñ§¡ï ´Ò—U…cGÔÝ+ó<æ ±$ukyÒ—/$;EŸÁ]BN ârŸ\¬‚) :>=‘³Œ’rðaJñ Gžþc|8õNZOY,ʱÏaN2ƒ¬!†Í^RØü\¾,…ñ™™O±èª‹0ü¬Ã±#py9€KZ¡Äæ]αXCY4Z¹cG°¦úƹµ¨dAi*ïj¤‚‚º²Lí´ºc”U’HN‰`€ºÄ/B!Øpìൌ?ÍÍÏqÒ&È­q•;v(9¢ñú®O»×„cGzÇY8 ó'ZsUƒÔäK ;2<™¹—D]O ]W_^C²­+pš;žMüjeÍ2ü›¹%Dä JƒMLY¢ÄÈå ;Ò36ÈX(ˆnIQR‚êZt^Dè¥k]lú1’ :}…V_]Ó$­|8v¤{t€U ~"S}¬¨^&µJ8vêHmP=íaú³Nå ñ…1B°#„há>bfÁš¿B·±´¼aGúÆ{=FpK°s“ú³¡¼ÆØ8å ;‚ÁäµL‹‹%špcãZiC—v¤cð‡-ÑN’cÜp±Ô°#*›HF` çthB¬—W5Ð ²¼„z ;X)9×Ȕԋ‚9'.¡€õ±h¹ûZ6ÂÐ@o¸Ó§A³LO°/ b¼ºŽ9×}eÄãHËY wùÓ5ߣؑ£gXÙÒr÷Ö¬çîÕ[ñ/ÉØX]Y•~oÕm –I#„ Æ=íý s`"ó ïußDlÙ‡×O³EC¿Ø¦_=¸f»´Ú¹cGPÿák'Ù!‡w$sïÁ.ïõÏTîØTþAû f31<9šá˜HRË™8V«4âkëZOðQç¹Ìýe:ŸbÆ¢¥Õq¡ô=±#íý7X/(h¨¨•ùfZëVp˜“èsŽÁÖ戺 !#ç½Ú£ï*¥¶†CìºÈ:$^Çêè—ÄÑÍ°eo_::çyþx2§öD®n“ódÛƒr#Ž9¡ò—tóoëJ«dh(mp|ëâÞ> ’u]&_ÐYüôFkïê9q3sµ4’ ±è %>­‚Ç7/b« w%ÍŽ_Üô¬*oØØ}V_äæÊ™¼jÓ23;vDçÿ¿Ê¡¸ä=ž¬Ülxt!جý7/æ¯pó°fyÊ«[¯RýŸí¾ÂÞ D5¨¥í™,%N‚Á&ômq£ <¹atVñ#Pƒ‡EÄrÞ.çð^(¥ÂKÞr€q„ô¾ª‘…v…NÀv"ÊツÅÈ_ñ+’FèÞC‚#”m»ŽÁÐááöåmÓzýü¡^O{è‰Ò^¡L^Øñü[8±¿ÔmÐô®¬^Ö­8º»B4Ò„cG~wîÖW¤á‡Dâ ¶tVñ#p½NxùKŠ ðm®ôg<[,Þu~?9;Õýk‚ïºEg_i­[€+|ü†ë®&àÒË»÷¯Ûe¨ýìÌñ«gßç¯ø!Üx>mÃWã^ª¼aGÞÕÙDÒ^›«ê%’ì+[…“?;—úé±×¼Ö¦¡âfægùZHÑ÷xÎÑÚ;—3K{CÃj¹€ù°ÈPâ,v^+÷0[l .„SA¡Ó—N½ÍW!T$KëÊ«iB¬¿¿ûËØÀùÿÑÑWØcû‰Í‚<Úúö®g$ë¼aGàið]{Ø ­­[! „Ø›Èò!ؘ‰Ÿ~ô…a‚–P}ô †¡ ÇŽüÝá_ñŽ‰¬›!´ó‡{¿.÷/áØ‘×ÏÀö¿…–s¯ÁÒ¯ÏØXå;‚ËÿàÅiOÐ*çeË€0Æ-oج2l) Ÿ(,ľ²b„ë„í–;Í¥†³ sÀA‘êÒ :ø¢î@«Ó Dù©Ô4Mv\Åéz¾\ ɊꦤŽDÜîM; ôëҢ♔Žèº…-þ³š¼aG&f§¼Œ¼*üœÌÈTûƒ²Ü±#3s)öîЪ‚leÐô›¥æ8p¦ç(mŒâÂt5×\XPHa‚˜û«‚D õ@ŽØ‘ÍÁm˜9 zCP4Ý/óìC˜—™,v$²|én°#1÷CZ> ‚OèÑ‚8¢àþ#ìYð û„¡Fê‘ܱ#hƒ€>¤QÄEâ ”ôЕQÜ,<Vd¤ ÁŽ¸IG<„IÍÍñÀRê/éˆ*GH&ɬa|ùúž*¬ÉyÑTè)|õ¢ÝŠERë)‘ƒHHõŽ‘Qg´gçgy cNAq¢È€³A9¢w*R&ÈS4^ÿÐ:C£µì£º®E¬Öܱ#2鈶@E„&a)4^æÁŽ ƒbðcÅ¥tSL¦ñ‰byQv?Ÿä…EHºHž‡K¦ ǎȤ#„_‰í¨*.Ç(a‡ ˜hùCÌú;9;-ÛŒbênqOeÜšå™U†0žÌ IÒJ„ då’ŽȤ#xŽ¿úÑ$éÚÒjt ÁŽIGà@`X'GHÈÓúªBÙÂܱ#FÒ‘¦ÊzMB©G0à3Þ²*I$ÑGüP7Õ-Ö\éÛá‡`G –#™@{ 1\zëåVU[Z%=¡Ü±#2é!EÀQµ£…%>ŽY±#p§ºEú¦Ê:TØ3:À Ë¿ZÌÂRÃŽt vó ­-«BïzEîL60ø*gµ~ ÃË}¬S?,—IGÐŒ*Xw‰·‹°3”©GòƒAïÚû3²hÖ×­Ñ>y-%dó+G±7Ư 4‰‘z$;b$Y®Ó$v‰›bðUž…cG® v)Ið‚ÐÐtO9ýš°­Ñw.‚‘IG)i”©wÔ#yÃŽ\ê½>›‰C(¤H¯¾è—›j`òƒÁª—Ç£ÔæK}×y‹b”_RØXUh_[ׂý6ÃGÊ’¥Æ½K ;r¶»o«Á8¯¬i‚Htu³•ß½j‹‘t„"Mb¤É;‚¥zZÈÞ¶æõ0@xâ™ût}yMkÝ 7éˆãºÛ–·á‡r:ŒÔ#!Ø!Ö÷óû‚ªØ:©GîE숑td¯QÜyžûØZßÍq`,ÆÓ$ÏŽw¯Þ†MÇ!}HJ͆|b…ží¾Â?¤Ô#¾¤#*4{?lÙGg™£‘z$wì¦Xëf¡‘¬Û…râƶ¡Fê‘ܱ#2é6P¯½9ºàèKÁ!®”t„Fl¥¾ËFÜM£šúØúðÃ#â‡{Voƒ}?yó¢~Ký²¹Ê—z$;"’Ž(½ÔZ¿¢cèOG0õÈç;‚‘Ôæ^IìÅý+7Cz?î<Ç ó‰¶Ýñ‚¸|µwÇò6˜rüÝ6J=¢“Ž\r¼œ>_Þú(lÙûW>â­ÜŽ– Rù„`GðC'ÀmÅ«¶6UÔaxGý Ëg÷ª­BÀ÷ûÒæ} Û!Ð$”zD&A É0UgDdå«Û—ÂB`uÇì ›BÍïhBÚ^¹Ðò†‘IG)b IŒ`mîØ‘—O¿Ãn”܉&)M$Ÿõ^)& ÁŽÈ¤#xàG“¤ŸÞø”ÏK§2ðˆàÁ«Ç»†Ý-4§Ü ÁŽ@K°¦ Š&1ÞÊÍvÛ½O¼Éç*û×íÂBà b󭇌î‡cG^;û>kohB>ˆ¢Ôœß{à9#éˆFŠÔzhÕJ=r¡çê1oïzŠN¢0e(‰'¬é.ì>RÊ$M'`xåÌ{üCŒ3T®D“Pê‘cgi¯‘Ö§pßSøáoμË?4R„`GñÃÓ™~eÛcåÉH/ûÉ›šZÁ­p숀/8øüØYv§ƒ©GB°#2éÚ³›Ñh’·O™Pê‘}…7 ^ ~o]8Ìðx~Ç’cväMõCw¡ÁGÂth#õH~°#³*§Å¯¹×XÅpo^?ÿëìû0ÝX8‡®ºaø¢Âøí}^£I^e´Íã:õˆL:‚¯xçcÛ ?{䛲a¹cG~qüug¬RûZwBñrl»(žøã‡^€A‘êè[»¾s@hbM©GtÒ‘³4Ø,ÿÁ¯ö«þŽh¤Év䯾8빯h¤È& ¦ ÁŽ@Ïõ¸›ˆ–*…qÑ$žÞƒ“ö(;s,uÍËOŽ½ÊgŒÐ–Ò¹ ÇŽü_ BHL:o‚©Gòƒ3öÎå£46Øþ‡G¿‹}Äß|ð"Sê™t*ª+îÏ¢áçÿé©?4’ŽRD¢IàCJ¿"wì,Ô?è¥MDH‰&¡Ô#2évy˜GõÃÃ/±j¤É;òæÅÃ|iZcyíú:8Bsz£åüð¡d@=;¢“Ž¼æÁb¦S¼üÓ‡/Ó V±X ¾1æôó‡ ö‚$À¢Aìî.m‹ûÖ®gê…«‚é¼õÖ¥#. ]Û­0s°qt8çØÈÀ„ß«Ž.ßþ© {ÐGº3‹b†““ìö¤`äx`‹íË×c±CE+ÖºN(Fé_-5ìú5=—¢ Œ/ ÷ :2 î ZJ:âxYaVè±?šJÍÒÐU$Ëè¬U8ô#ì…!á°h ùáåÉXVQ͵Šü`GÔA®wá E©°¹˜JMÓd¹cGôË<îrÇò¯¨‚§úŒ)Ž%‰äü¼>BqÛ\R¤ÎêgÄÝ4 Æ®dA„ƒÑ}…&™Ÿã¸¬‘z$wìÈ|:“5£ ?Fñ8îNÌCŠh·˜ }®DŠÈÜ$|‘M»çâcìàÄK•ì„YJBk} ̇¼žÆÑHt‡3ø"›j/1Ã=’GÛ!بAy8Å×!ÿ¿Dd˜?;rAD»[ª±Tgà#ƒÃ€ÈI‚éºÅS¡"t×Õ›,iõ*‹‰|õ3Ø,:~¡ÍQò¶5 ¼ì#ö™Òjç;‘ॠ'¤zÁ°3ð•¯È/)ì ÁeÙ®/yéäµöD–v„@ëVbõAt%Šbcãê™ù”D>ÑñG×H/§1€ÐJIË;‚Ñ–/‹ïÑc”÷îO£üæe­çzÚ]e’V§ðtåÊÑŽ³ìÈ‘ìˆþSw.YDórm°‹U4ì‘ì㽈Áò©Ö%Ëëi)rèêI¶/|‘Íû"t !§:žÁxxí}p;ƒH|å°:_dsR#?è!æFq¿uîØ Q¿í†0ß·B½zâÆ6¬ª|]¦|îØ‘;3jR×Ê(1þðúi^˜ktN‘ß{¡Í´@Ø8ÿõ4JÈñD*º—áêÀ V°Õ¥•òä4;‚|G€ñ+Ø}”?Ö™Yï´î’VþsŽyãü¡9/+'~N5¼vö}^˜{W«PÍáë§ø'_Øø6 )Âxµ´óÜÖýПڪªcA];ɯ†CȘnvÎŒN`à¶â™MûÀQ]OÓwÝHi¤ˆB“xŠ/²ù@!?\Ž° M䪠Æ!®Ðöo]Ì$ºÀB–‘ìÈÁöã@jDêŽC€riç;'G†Ðö«jà\½/Êc ¥·–#vŠè­‹GXH ô°´ûdùtúþÈ\vä ‡Y7Boѯwÿs¦|³†Ô»"À³[öC™Ã’lÏD…È\vä—'ßâí Å*~.b´O¨ò™U~°#p韫|cçÓ‰ÂL[@ˆ½Œw†cG~zìUþ¼wÍhcx­>¤È†½Ø£½w93ÅßÓQ(Ø80¥%ƒA~~Ç“o^8Ôã9«­u+ÈîCs² ÝŽÿÿX¥Lp‰Ð$°ƒo^8ÌÇ¡_Þú(4¤ äÿÁ¯8Þõ4ôÆñ‹›b4IZëÒ}ziÿˉ7ùüAfæwB±#纯²ö†çü -Æp€OzéCà–?£_Ê' ÁŽÀº)pGXSp°á,I•þÝÝÏÉÃÉìȯO½=èÙ‹ûZ6îÔVûïÿÊñ´2Üà×Î`‘€„ã 8J•þǾî ÁŽ@ÂÙ@Cw‘¿÷·‡~É |…Ÿ“/ìÜ~‚Q/1àEñ„¸žFýÑÞ¯½£s“оÈæ7R$­ÁÖÐäuðŸ¹fB“ŒÍLþôhf-|uÛcrË;vä/üBÿW 9¦X' ñ]OƒYƒö¦¨-ÑŸïÿ¶£ìDˆµÎ)òE,O½¿PÏ4šDùB?úðe¾sšPbóƒÁvã¼Ì6ôë ‚=e"úSïV¢ìÈÏŽ½Ö7áêR…ÑÆ}÷',äðèd†ìaAè3L%ž)dÀT‡”´ì¶BÒBýP犀Kóº¸ëêõDòƒn9Û}…Æ•Ï`!sy,Ì'Úü?ßúGþ‰B“4¯ƒOò7Ý…™VH‘/ÎÌ¥^:•™âÿ¤± ÐƬÑå?Ý—AVåŽåzUhªÿüô÷z·<Œòö>¯Ñ$îmkózºÈš“í‹É;ò“c¯2ÇVn¡MÄ_üþGœWþ©{åB ÁŽPÝ?NaõÊ’ò?ÓˆÅNÉ¢b±$í[;¿Žýãn2È0íî½…©¢ O¶í‘®cvDe¢ºyªÂîàkÛŸp´Ú©úðr‡ËYÈérÛšÛhïL. E70nRä;Â@H<ºþ~l¢ÕË}T']fÊå—vDßÔì‡0ÎÅeôŽœ‹÷ˆ9+«›ææè茰#t¸7¨uGiè`àPŒÎ¨ ;‚–ƒŠ‡ ‰éÓ#K°#ó ØT2Œ(@¦Y»7d9bGÒ ³Ó\]‰ŽiÎ/ÌO§f½âÊÕQÚ9ú^‹Q}díÎG4ä'G P’ÖÕú"wˆYQÓôm÷1 6G`GþË;?v¼à.cGþéÈËú´YÅ¥‚Qy§†»©* /é«ÍØâ9á/ÑæÁ1²`G¶6­Û"<™ü`G l);-žÔþö€Ø®zUÀS.¿¤°#êU4•ÄÔ ¯®m.Õçùž«;2•š¦=H6숣÷k;ÂgÚ˜ôi-™Ÿv„Ò؇cGŒYŽØ‘yü ãà}¥I1°#ÅñäÜÂœVvÄÒêà¯{ñ§DUV쇧¹¿‹ˆ)T@‘˜ãÇŽÄäM&ùÂŽ¤ù—Ï/å;’vÌbv„Æå“bGRó©LµwŠ‰kìýê³ÄŽ ZníbG@D¼spoaG4@äcG8ÅÈ"bGíLdÞvÄÑ> Û0玱#5% AybGtŠ‘„³¨Ø‘‰™)-ÒŸ:v„RŒ8w…HTøîø¸{ìH‘ ’ì ËsÌ\°#Ž—Œ„èžÃŽ üÐÔ¯â;ÄŽ`ôH¨>sìíøë`G t¨ºˆØ 1“‘…`G&U ý§¼`GPX äç;ÒÞƒué=‡Ñʬâ{ ;@þiibGtŠ‘µŽ ;rD„l?m숣2ùó¿ìHÇà->— bG𕬰q´Bs–6v„SŒ|¶ØÆà vŸe¼ÓÀŽàWtHaGòn¡?ØGg´÷'ÂŽ@ìY™|ªØ‘6bÄ `Gððƒ«™&Ÿ6vĈ|†ØGg×>$Z\ìårX\ìÈ»—y»Ú;ÅŽ‘;ÄŽpŠ‘Ï;¢ÿtyQ°#úO™Ì:Ÿ;‚ßê ƒ>v•ã¡¸f莰#ârlØ‘}øîò§ý¡ˆÜ9v„þ´¸Ø‘×Îèñ|à;ÄŽ<»åYíbGøOŸ9vDýI[í;ÇŽÜ¿rÓýÚ¥ÿ̱#*ňû§;ÅŽ€ûó:UÀ=Šùbdq±#!‘?½xâ ¹µùW¡#Î]aG`æfæfƒØˆÈ‡D‹‹±ûÁÞ¯9K;"ÿôicG-VìȯN¾¥—ö'ÃŽ@ùwõ"춥tPð™cGÚûoè½ç=‰ñN?v$™H’àÝv•K¯õ3ÁŽÔ”UÆ –vDG“>v¤ègŽqÎ#ÂŽä“òwĉ°#å‚™Kñ@DyGþUbG0§zYDìˆy‘ÍcGî"ïS M㽈©H–‘¬."vÄ»ÈæSÇŽ@©†Ï6ïHþ±#¹>çجãzçvØ‘º²*ÕÏ;¢¯§毟UÞ‘»ÃŽ¨ëir‘ìH”w$Ê;Bå¡Ïw‡9qó¼ëÓ~úؾȆèsŽI&Š(kz„¹ë¼#N„¹×°#÷DÞ‘lØ‘<çØï“õ9É;òµmcÿø™çù¦‡¤ŽºCìȾÖtQæ¿&숓CÞ­^ïŸ;+µðI±#P¶|úlóŽ$ rèî;‚_&;òÏÇ_çó½O5ï_Os/bG¶5¯£ÊîEì aîQìÈîù¶'‹‹ùû#/MMdFyG2Ê`G`•¾¤o׺óŽ`ûöïù¦³4°#K$ïíO~êyGèÒ:g `G0Œäöß‹Ø‘éÔŒ>sþØ‘‚‚Âuú/Ê;’+vdaná“æ)ŒÇ—v$Ê;òYÑÝcG$¶ãα#wzgÿ‡AìˆÖŸvõÅ ”KìZ……a…‰X%D¹cGfyf¹³Ob~ìö]zœ}Ø‘âx?ç 2Ø(;Pr÷Ø‘âD« çX5aGôMZ>˜ˆ£Á¢Æ( æªârØ ™m5à¹DŠ`l)(È}$4 úHÇÙôÛŠd)Ú645ʲ„_#&Ñ=½Ò*Â8A^RØpá(Qq¼}Ä ˆËzÒ5¥UÒx‡`G Hü²2VqmiúŽÎÒirZã*d sÇŽàçDÇ ¢só‰!¢¡;hdÿÄ0ËR™¾Ú¶_÷чeõR¯†`GÆÄ 4b±WÁ¢î`‘«.©”}Ì;y—UÔ#Ç ©…2z‚™ñaAÔv+Oxabpd$`IaG£âÏpO1ÎÃ))]QÓ„±bäz·²fþ½9ÒËJH‘ž±>_†DaQàƈ—l#­öÕrÞóƒµ÷gÌÍ•õX_X¼ÜGBŠèô$n!*t’r}¨{ÎrtGjÅìÖ…LÁ‚*ìšãÁ‘ç_áØ‘kƒ]œA C„9ÂtHÙ–';‚ âQB“ÖÖµÀö]ñ{ŒC…PùÁŽ¨6w_e— #qÆð2€ ÞΦ&ß>3?جz±¾T›¡/õu°Ð±&K;§E¾'Š¹†¹9Üà ¹,YÚ&™K ;r¶»}ÊS&ç•5MX¡Wú:ÙÊï^µ G¸„ ‚”^îë¹d°6w쬀\_¬Ü ¿ë\ÏUÏb¦ëËkZëVt Þêë'FhÒ¶åm˜Ž£"³¹©UîÌC°#B¬/Ñë­ÐÉ'».²¦…>—§K÷"vQ_Q¬ãI}ü¸ó<{2„Á8pÈú³µ~XŸêʤµß½z~xHzR³·4µÂ”·÷ßàl1„ÁW†ßAÒ©ßGgÙæ¶Ö¯”‡é¹cG0Åê¨N7 çU[àÂh¨qišsÇŽ@û±qGH;x½wùؾ¼ âŠ)&…–ÖZÿ‡Šªã© {°–\?ÍO[ÿ ¡kÒNsUýf¡ÒC°# w.å^oh\µ²¦¹cè«ÔLI¿™>çØŒ¤ö]¡‚ê€:Øþ1/Ì'ÚvÇ â™QÒh&¬—kžÍÅ6aÿº]m¬ÕÆnÏ~¬:|í$o1P9½ûH‚™JM¿¥Bn+ð',4hcesõ3BŠ(4‰†‡Æ{týðŽÞ½ü~NïkÙmðîåc¬Ž4šd=¬ŒœÐ/m~Dî°B°#z®]ô° PG·íÇ×ξïxm…i“ê.?ØG‡ÕyÇ„¥a€Øó2Aïd°ÖÉ;âè˜+¿óƒ ‚μÜ×yÒS˜¥‰ä³cÄ‚–`D&êyxí}“³S¯f„6ýôF•PäŸg±(wnÌ¥^W„` HFvä@ûq¶ÂpTvêìG¯Ÿÿ€  *éøå;“¤BÔÞÚ{rÃ8'wžcõÕPQKq5¢pìÄ’µ7Ü~,[˜ 9¡ßÜùøŠÆí'P€‡®žÔέjÌ7& [b;žÛ²|mJ4ž°U%4 8bõñqè÷ü 4ä+"ŸÄ·ï¦¨0¥Í¡PÔƒÉ=Öq–|¡´æø•­‚£ÞÇ×ï– -;¢± ™™ýÎ_G(aÆwb±ÈˆTvÄQˆœ×~ñdÛƒh”Þ‡žý‚gNq˜B°#˜;ŽG¢2…$ä$*¡HiÕßþ‹ÊÀWQ±Ã®ãk¤C°#o^8Ìèd8´{×lœù•'{×3r/ìzý³c¯q¯1×pé!„§=Ç"MR[Vùû¾0;—zñÄãÞÑ"Äf[óz;!dlêÁtÃ1VˆOȡǤ= ÁŽ`é±g‚6üpï×áoSÞ+¿}okbÅŽ  2U ä jºë¸tF“þ§Ý_–}ÌvúÿËGil`Âþíƒ_ESÿé×٭‚&„nÿ§#/óî{×Juµ ö³/z›žàçÿñ±ïà‡˜G®ù÷|¦ýtYú¹cG`¡þáȯùëŸ=òMìò~yò-¸ ôd}ÃJˆ4áG¼[_mó<šú_Þþ1{¡/Ü÷”7?Ÿ¹”GAá|¡Çܱ#èš¿¡¹H»‹ µŠAw&¼ˆKZµÄ!¡w †"F5;âècÎÔBà$©[±…–ö#;‚Qšö÷‘7çŽHÓ¨ŽNÏgÒÀ˜÷UÀbÆ1˜ìRÓø ×LkÙ¨Öù©Ô´sˆSfÓêܳÄéXRØJ)&Ÿ)Àº°ºÄo׳cGð+™Å„¦Ì[J DÓPV#E"w즣o|0ÃQ÷‹#èào 3‹ žòe£_V%‰bC„B°#˜ý¿€,á %VqôJoôÃPrÇŽ`ej LN±¬Bt›ý‹숣㩬ÜÈ7’¢ ŸO²^jØlŸ8Ê‹Õi÷_U]Z 3Á” 0t“ƒ—Ž>VÃ0ºåÕâŒvÕ ŸŒCŸü`G‡£õ$Ì \žux‚>^èbƒX¤§Œ§#³¶n¹´ò!ØGmé{8:âj&KÆA®¸pìÔ‘’UO»a”(K}…l‚!ô=Åoe&*È­KËv¤ol°WÜó©“„½Ÿ±qÊvÄуÉj‹«¨0.×Æekäû‹K ;âè[?8lI¸Cy™dCF(—vöBÂÚPCïØ€Þ*‚Y«oý¸Ðsmô6| )9×ÈDG¹cGXbÕëÛ!Q¡›–)PÖ”;}šQ}y ¤QþÊ€„`G`ï‹Ò˜ÉyÄLIûr/bGæ°æ ¿‚š°wÏ;Wn‚å‚Ê='Ò‡`µj­»<õ½6ê< BQá­L†L‰ÅǯŸžñ/ûÞøÕƒk¶K÷8wì,ݱγìCÅÉÔ}àµwíÉ1wì8~ ^ †ž;™*ìA µÑ¥'iÄ°Z!]<2Í*a‰Ê1päúiñÛ"¬}6 øå.>„y…cGÚûoleK[¦éj­[!“99Ÿ{ì„\wÜ…“AbŸvYWQèåd×EÖ!ñ‚øšºå2ïÔŽåm-ÕË`ËÞ¾ttÎóüéppT ÅŸl{PndB°#ŽNXÂ/[ã·MunpE×~_ËF8EàøÖÅ#¼}¨p|zÃp„¿tâf&Õ iûÀMþ”!ÿ!بÙ7ŒšÏs5b¦ø‰¶Ý²yÃŽÀ—0|3©—`e C“;vÚòœàßLba7/[KK›);ð®€ÁƒÅ“TW]ýØúÝŽ^_ìæarÛV©„Ož H´5úä?;‚MèÛ"a Ô8žŽ5Â,?ØGã ú¼ ËJ&?Û³f»Œ‡cG eN‘mÍëáŸpQ­¸7/î—ñBÓ# í —R" °dàrÈ yÏmÝgUBL­l;‡»ùð@!ŽºzæçeôsTô…M-Ó)«M/~ vCž®GCC°# O¼É^14<ìK§XÏlÚ·LøÉáظ^'¼„%ø3´î•þŒ&„Ê” N(v¾®D@™ôŒöÓÙWZ,žÕ/”¿å#µbá‡ËçÇ{å;âèô!ìù£PѧÅ.ì±õàÉì\JwÒœ³–Ê$ ß{๢xÚ;"AÑý+6Ã9ä>¢¨É:wìÈÑŽ³:±™{Œ-öµÁ›|µAƒBuõÌÛ·DÎB0¢=ã„𛈩ä=®Rã_¥uí 6 ßð«’uÞ°#ð4>ßËÖJsó JâsQB°#p$þåä›üumÝŠ›#=j¸.;‚ÅòÒé·É¢)pFY4ásÊ+K–ôŒ ¼uራV,{±ùÒõI»éää;â¨ÝÄ%‚EÕ’(,„9¸1ÜËuBéIs¼Ô°#°8Ýc0€¢#Sê™Ò!-M¶>¤Mêù" ˆ{ÔŒ¹èêvé#¯Ô|jvnŽæ1QPØâ?«ÉvÞ÷n•*Rœ ©Æd¹cG¦çf3a 'VXXˆ¯1O úE}¥MÍpTžbë¢Q¬ãÂê"‹¹L±  Êļ_% }’;vdÁÖ/ðç§@/èî•TϽAW؉(ÐuþaG‹ò‡‘“´à+æû GzÒ&ÈÄ+—6/¬q ;"BþŠãFÇc\§L=b…Þå“p숛zÄVÚ/t cu-xñ]ƒ(Å}–`n¹ã%ñ¿ÀñÝ`㥎ÁpéÃqKU*ÅH<É•Hí`4ž9êÔ#ó²ÙLFÒg1°#ŽÖãAq¥ïØBó‚qDê‘àXIGœÛaG4dʱ,‡(8·ÃŽ w£3Ö%‰ñ¬L–ѨΩke&ƒe/é}–©G|\ôØé>ªd$ÓcvŽúæ9c—vÄÑ™-²ÉjµÊ0æ³숣BSòÒ%AéÒ¢’òÀ J9bG¨’ñ,óˆ’\¸w|p~a!PDÕÚX^kvvÄñ§1ªª*./ó7/w숣sÛNÚGUyÒÆR ÇŽ©G$aÍg¾K ;Ãqc¨×¯Ì•–ë4*Ž °”D)Fèó­Ñþ錪ÌÀ%}Õ±ûÈv+Q”üS¼0Î>±pÄRHGhêÊ|¤p숆ƒô86Bá•–ÂY±#Ž¾÷‡õƒA­õ+ Í‚qÔõÈ—$L!ØyÃŽ@\ê½>Ÿ*åê´5®.ô;iyÃŽ@¨²Í#ÄÕˆñ/5ìô­LË! ¦a‹?¸²Ô°#ŽNÌôˆõöåmäCÂppäÏ Šd™‘’gQ°#FêI5¥m î€`ͪµcÛä`Í6øB8vËPžJB=†˜Ý‹ØGß4$s59ç4Í\Oãø/²á‚ôˆYIXØ£×O[·Uðø!»Mûþv†®Ë;âè R×J’*\ç/œ3vÄQšùªÀÈú†dsS+y£‘‰™àìkÝIÇLþ‹l|e«K*ï÷‡¬Â±#àxàÊÇ´¨¼ö¯ÛE©:™>çØБk§•³á'´½«·Sá©Ô´ŒµK‚ËÄgЗz;.÷]·®Ž¶†Um~}ŽÑ©GŽ8AJg®§q´-àÜf_˜¶ o^8Ìp[ƒžÚ°×pcB°#ŽvdtJ´ËL:âä;/ôwçZw…pážÙ´ÏpärÇŽ¨„+çdãø¬?•‹ŠqtÜ"Ûà1¯0¶TX­Ä13×úS0鈊q’…ãªp­Y8/Ø•zäÔ;¶ß™IGœÛaG}ßÜÝËòüö'ȳE%X6†i¸¬Oo|ˆ¾ë<«²ÊÛˆ’ŽÐg™zDðM' â/Ü÷¡áʾqþY‹&J¶OŸá`¡ùµûíáµ÷Ú5;Ò9ÔP_nUFÒçvØ‘ÙùÔ‹Çßt±~Ë^ä½.ˇ`G@XA=â^WY#V†¯ûÒÉ·åûTLÁ¤#N(vÄÑ÷CÉ7[$ ç ;B©G¬†¦ážæA%žé7Ë¢mìäÿäØ«™#&Áïî~®Â¿ÙÉ;⸩G&‚çªEñÄ·v~‘@¨ä×^Ii–Ãz¤¯¿¿øá…^ûàɶ=Ʀ#oØ‘™¹Ô?yI¯è#Öˆq‚q"ñÊae,…³`GêƒîkÙ(/¿pn‡ÁæëïÄýM’0ƒüÐ ÆÃü`Gt%'>(@I(ü°ç ýÍÁåË'’þdßЉ4ÃA‚„ša³;‚J~&Ì¢¤•¢0ô’O£ŽÑçƒ[¯˜~ÿ[rœ™› †«U…‰*FžoÏ‘#‹cP¡, v§TNŸT/ r ÇŽ Ùà%½av‚ †pìõn&}h•$Š  ÇŽ¸HW‰z;3h°ÇAàÚVž,É`¹Ò鱙ɠäH| õcäˆ2ÆæßYzØ —ÌÂÂDï ñ#ŽöH‚£ ŽAaQ°#Ð3Ó£ÁõˆÍgUIc¡0J®û")VAÀŒß†cG´'ˆ¦‹ÉàÁý¢`G(½Jð\µ´¨¤60há؆+ˆ}ÁÕ—×^ÚRÃŽ8Zf'F…ÕSŠÕ oUVØ7>Da›+ëyic{Æ‚a¡š 4$oØGË ¿²ÀÑì–êF ŒÀ­‘¾)/?ÖcSEaâñ#Žvփ߉åU †(Þ;Ièì^(LePñ#ó*ãâ­ 2A=Í•æ‘\Þ°#ŽŽëcÁ ³POP…ãä;âè¯H,áÖEkÝ Ã†.5숣͢|¹™Í^ß°ÊPÑK;‚uq±÷šáï¥ÕŒ/—™c»FzeÞ"è¥õõ« á_숣º°Fe¯¶†U¼´áÞœëiÇf››MT¯Ð+Œß†cG-3AeŽXG†}¹G±# ¿¢êxØè¥ÍM­ÜG,œ³Ýí~õ¥ÊµÖ¯çzX‰R´ˆPÉŽåع‚‘‚t¹¹ÓE„ ¦vK³9ª‹‚Ç3]—e^"óÖÀ - v?î<ï­ÄŒMkò²‰Á{9Õu)åwÈ1m«e6èïp6S”FÕp<±#Ž¶,go]™ó’M¦=Ž°}ÁÈP„÷òqçY¹ uô a¥ŒÝî9)’ Å â{×lçs@x¼§n^ ª/p„6v1áØG'NÂKâÅ»Woáí8ë8C MºU0|òÀêèàÕs‡\_jcj§pì8l?ÎúiEMSЮå ;âhä.Ö…±éÀ˜o_ÞÔ‡¹cG½A8Ùu1ÈSÙ¨0;=s´ãìH@}A¤¥>„ª„ë¢SYx¤Vöµî r ÇŽ€ãöãAˆÿN•¿Ät<ò†q”{s zÕx/tÿº]Õ~ít[ìÔÑ[óñ í]³£Uä/~† p,Æ4±>ĆýÝËÇ‚¯1À¾Ë-Œ#Š"/,ܽr«LøÄWÒH¯Ç×ïf Žoœ?4ès]s¼o­¹ŽÂ±# ;Îœï–ÓÄñ‰¶ ï7;âh ÊY`Ë^T˜xdÝ® 2 ÇŽ@{¸ò±è£[#tïžÕ™ù徎#×Ng&àøÔÆ=Áw8v^Л÷Ú°ïAõ•7숣·]2“¦֖߬˜K½~þÔw.w’ÃÇ>ÐÞ/Ÿ~×ïQ%ÜS, v_:õ¶qÄ„ö@P%Úã {%j˪ŸÜð o:fæR/ú=çaÒ—Úì1æ ;âè½ÿûW>â>¦½>ÂÃvÕ(ŽËñÊ™wû>¦•9~týýFUáØÝb<GȘqŽqôiƒ¼ÞÈñúøÍ_ Ú—¼aG°%tß3Ë•Â}ìüùG¿ žÉ?³yŸ4XX‰0gF¸p L°(ØG'Ó’;x=·åZ£?=öºàþÙSaÛš×?·u¿ñÛEÁŽPÒeÑügÌØc!áØGc_Ôý‰~ìd3ÎäŠýø°µBF…áØGå£ú–ÈÀŽÀ¢Aar\889vdkóú “7숣ß<¯Nö|Øø ÐAÀÄRÃŽL§fሺÙ,v¤Éÿ‚„yxrÌÀŽ$ã‰ÆŠ:ŽQªcáѾY/@ÃØ4¬¾ÌÜä ;B}œ˜ôÐ#^ëcåIK€,w숣7Vêº È^%HɳP”‘WjÐðÄbEñ$·S_‚‘ò‚G숉f¾¹cG(Úî5;C lム,8é˜cR0ÄaG‹rÅŽXÇ49¶Wå–KS=Öbì#±k±EÂŽpU” ’°,Dˆãᡨm1]•µa·ÅŽ¨V-,̧DU1k1…2ñŠQËÂÐWêx©„Ô &ôU;–ª@žŽ.T9Nìaûp숣‡Të•–œŸ(L¥bNUår¤Æ[ÕDj.5¯ç(æ¸Uá8Î"aGˆãLj–_O4,P‘U*±#D3*=Ô<5Lu° ÐÚ°ÛbGOÝÓàc —너n‹q"£p-jðéœâx28ªàˆQõ8*K 0‰~Ž‘AB¨ªYUoäS Êr¨ô9@cÕ¥†¡>ÂJé h¸0AÖ†Ý;âx jM¢µØ¢`G¸*NS†ªà â>25† ‚T(˜ZA<Ûà‡cGˆÆ¦'¦½>¢@‰ê£¥a‹‚!žãQE+²Ç¹숣ß›ž¤õH7UU–”eu bGíía(tƦ…xA¿¶¬:èÃA$Æ Z¢ –¿‘ÃÑZb`bDk€9ÂÖ”TZùÄŽ8úÄk£ªúX‡ä, B­I°‚è’ðÂÒ°*ÃÛbG½fQŒ8B$P¬±¢&Èñ¶ØÇŵô“¬¨›×ŠŒ»˜Â±#D=c òCªâ «Hç;âhAíšœ™š×Ãan®¬·*“|bG½ïÂÿI¯¢UåE%V0ÄÄŽ8Z/Aâ_¨h¨ñ’¢$¤"èu,A숣€k]p™  ài”ª…Öiè.Œ¼ò¬æñ׊dÙòª†` ;âh‘€R¥TÌàX™,k©n rì¼ÛµF†ƒ.ß Öv[숣cßøà(s,._c[÷.vÄÑ0 ¨_*Vš(qáŒ#LpÛûošVçÏ+FUAûˆ%ve@-4”‡ž„“½´h7GzÕ•Æ“Š£¶³åV-·(Ø"È38Òê€e©+¯¶N÷¢`Gˆ°®‡'Çè*:Àb úнû:ƵqÇ(U—V¶Öµu„°s¨{X_Ú¿Âd¯­[ÕÛbG\Ž½×¡ð!™HV$K[ëW`åKFØGo^ÎkpÕ”š åf£ª`1è˜cü ï Þ ÖãöåmA ËkEP-TRWZ Æ;w€q´c©ïú8΃c1Ö,Œ{#æºg´D«/”Ê«=¸°zXÚ°VðРm s¬Û´pì”Rÿø0i9€Š³j¹|bGíìêº8¢‚——UoZÖjõ¾;â(ý'ØK{û[õ bVõ•4;7ø9^é½vâz ]^ƒoQm{ãÿ‘5D=˜R(uÖÔ®02ŽÍ'vÄÒ&jbz‹áq•ßß´Íÿö…u'숥—±ž¯ t‚dqYíæÅkVú€ïÖ,°#–¶T[{;¨tÙʪ%÷U»#vÄr.P;Œ1F Zö^àaȼaGˆà.1Ê‚bÐ'À¬¾vf?¹rXTÐ/­6ÓKXZ¢µn}`cnïÃÍwûÇ8WØK£ß èòô>l!?G¨30U[ÝáµaѪ@oN°#–ž®½­GÛûnЩ)8b7ßÝ;bi›ðTç¥k*ÛD¬¦¤biy½q=qüèÊ)¸¢Xö1½7-^ã7V­Y`G,5«í—zÚºUfè ô߯ø K¶Ÿ…õ¢Ô±>/…õâÇ Xó‹±èPèfÛðÄœèü¤òÑÖÔ¯ð»{ ;bé¸*døØ” 3ѽáþõ ^°WáUÅt.LeQ©ÿViOCàÄè Pä_7¦bÞ°#–ƒö›œ™²ÜY‘xI[Òœ`G,}I ˜µø& Äã‰SÓNøXE—cq¿mlë`®ŽD+†q# ìüœ`GˆÜ-5#òwL¦WÈŽ(ˆ°#sC¿3v$¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢7aG"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ>¿aG"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ>¿aG"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ>¿aG"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ>¿aG"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ"Š(¢ˆ>¿ôI°#¶ûO ÿ—­Žh6 ®fëzn¥¬­qSøŸx–¦¨šíö*+G]ÿ‹…U›±g¨rŒ(¨cºÝž_<ÏÖ÷?‹gëÿÌ̌۱X<Ü1|Öf¨WV,ÏÊqFwL7••ãÔôNÄÑÎôÌ4:vª)4ÔêèAÎ`ªR@Çðý´êØ &]ÊÎmMOÛ¶ªCk‰ÀÎë:j˜q+–L$9RçQ-¦–j*p*ÀqjýŸ¡&ƒ8b¦gTÇð˜P'…ZA“Ž˜UÍQ=d–1¢•)ðœ™AŒ1™HŽqlr‚?§“É,cœ™˜šä?óSyMMÍLSÇhJSAñ€&§§¦ôãNê:Ù8Ž ŽY8ŽOMÐ&%ãÉl'¦'§ôjÅ„¦“©@ŽÔyü‹ÉDÇÒ‰T଎ãŒÃì9‚F&Fd^à&Â< cô9Kä§ÒÙƈ•ƒŽ¡Wy©tàÊ ò碼‚À:`ÇÏ(Û¬ŽNŽcÒgÌfÌ_ÆTÇÔîFT ÜD#UKê¹ÊOŒfbj‚VF‡Õ8«à821Æ–ävÓÅ+­¦ó«ÝæÏEéüÀÎO)Ž™Y-Í/ÎÎqbrJ;¨ ÌñÖèP†c^AàsGñí²‚’À¦P[›>ç%ó²­œÑAþ\œWÈKÿBjá!bºwÇÐø!õ (P`'âaòñ!/‰¦‚Lj8<1 Žô¬±9ª:Sj¹bu¥ !ÖÖêøô$¶dž®(åPgtÒY9ªÙVfU=Ê鉼D(/h­b•¢c¨f©™OƒcàZ;^«¨¸rÜéRËÇÊÆ“j!¨€jÓ… ƒcªê`= Z GÔ›G›Ø‰ÅùEûß*Žã`ÙUœ_˜∭1ìŽ1H®UhŸ¡ña,0(ðÂÌN—â86þ\QX’J¬,¿‘Ìî¨-© lªä6‹èâta \Åo AfbŒ©¼Òü¢tGôüöèþÅJ.PÕŠLj¦F'°\ÇU‚âl"úÆíþ\YTÈËÿÑgT@µÀ¦nÒà*SĶáÀØ :†Ïé¼òü’Àývƒ®\M'ÓUY8ößš˜r¬,Â’ µª8ŽŽLŽa– SùXÁnÐ#6QUQ¹¿G?ƨ÷VNyAi RÀ6ìîWŸ´½¸¼6°óàȺ«‹+‚9ŽÜÆB²§ SXY8Nô õ» ­%åuÑdøbÁCàT–VëèâÏ5Å»ûùÏ%Á»‡úØ,ĒȦøÚûoðgì ly?¢B¶†:cî’(Ë/ÓÀjmýÎ'Ûª-­ _г·\Å{©®¤*°©®Á^cyAq6U{µÏåhÙË*ë`Ù÷ ç@ð.BÅñv/Dœíp,)â1Ò£š5‹ÖP'PÕ¢BϪ ƒþ \„––h>×—V6… B˜¬¨ZØ!ö#öZ‰æXÄÖK÷P?z½\œW„…¨†ÀÕLJ1F´VSRh'€#þ£Ïh*Û²oíéàÏ‹Êj&öšr8æÕWÚ X„¨Y’_XYXÈC»9Ô sH5URÈõÚÀMú ¹¸,X˜\»usÔÕ¡Ï`Xíbw^\^ȱoøVßÈ-‡c*oqa‚eΓ0ÁÖ( Ò¡ÐÑhÐÒfv}iU RÐuÜ1æg_Kl A#îLÂÁ^ì\2–P-P`b—õ2ÇTþÒŠú@ŽKP$UQ'°)t »Ú–8bwZ&·Æ†nÜêÁ¿$”P-ã¹®Ëü¹±bQ6Ž·»iŒ6‹²p„FèqÇX]T¸µa/uÞRMMÎL¡ó e5Ù8^Gµ±A½$ØUÑÁ±¡òüb° ÜÚàxýÖMÅqz×l!ˆô»ßB¨6”Õr¼Úw}Øu¬jŠ+9‚Ît^âÏ˪Š‚8BUÝt5̳åYDôpgŽÙÔÐé΋üyâUu % Žé‚lórï5æv1 —{®ñŸ²sìµ´P”W¸2ˆ#ÌT]­LË K°Å¾m¸Ó7•LV”Â4!%XkcŒ+«—vìĵ ü¹©zi y µØ1p£oä6ÁÇ~ÌÆú‘>C.Õ•hmŒ[MMNMbth*P¿@9¢~*™ªÔÕ9ª¦”̼:`¸µÁ±­a¯NB>7fçx±»]´QaUM£¿¨­¯M©njQ6ƒüXÇ9>Ôn®i äˆF®öwRSU…eè| yÜÒÝ6ä«õe5‹²ˆ¯£ígùóÖ¥ëëÀH€Ì¡ÏÐÍ5Ë«akC/@JCÎÃ^ t`E´Ü¼Ân[º>˜ã­îë·»IŒC ­® àˆçñ¹ ŽË«õ Ôú•^tl^IuQÙòÊÅÓ… ضÔùjÕZÐF›š¤:ðª‹Ë! ƒ9Ž _î»Ö;Ž©ê¢ 4•ÄBõÚ@·Ã±¸<›09tõ^[·"ÐóG©†î^¶1°©Ë½0!¥«Š+`–dss>×eáx[ql¥Ï¨°®ne`S°Ð”R¨)*‡$Éf¬¼r2ñ~e eÍ‚Öð/d8ÚYR^ètœ½Ñ ÍNŸaZ&è<,4­A|rDŽ~DZ*-(Z_ßØùK=íp¬¨cM5K5º):X 0z—–×:V`ípÌ/Þ°(€#úÜÞߥu_4Ë*Å1@¿Gh+åy«jÓ…F`a¢54¢[ _àa‚šøP«:_¨Ñ`)¾žÑ¡»Vnñ×±´ìmë¿AÇÍÙ8Þ¼Ú5Ô7>9¡ë, ô a“´t_ESZªÕ. £jj°þ#oce=þ ìØþËÇùÐ3ø€n»-¦—=öc`S8öá’Pi4è—Q¥Ñ`üCJ{Òì–fYœ.”K–kÈÝR†œ2ö§ 6!äóà˜c:f³í!L´7¤\¡’¼¢löRr÷Ô)Ü=ˆ¯`wojn‚¶÷bdE> t¬äÖÈäxa*Öl6wÏ9;Ò¡(¾@1ŽYÅ3‚›™ÐljَÚàþC/`™å'ÓyêÔ1øÈtH OÍLa¢ð_ §H48¦“YOÑ1XÌ0¡S:ªèÇÍØ6zŽ§cÛ6ìöüT:061=37CÆY#>S“*°53Ï7™HB–vWéCLGs;O¡Éi{šÂ¯ÙÂŽS:|IÎl1S t:QÚx,ËV‡Å÷-Ûb@ATÀr€!u,ÄŽ!Õ>·ô;cGlñ¿¹bGœJNÍø³Œ!94¨ÂÎtZS@OÍiãàŽÑÚ<ã4eôMCfdI, ÒaÆe† ÀQ˜Ô o;Ó6æÎC„!þfÄmÍ4™HúŸ]ZY¤z5éåˆÉ‡l• þŸ˜ñÎj"nŠBô²RV"Qh̆Bè©àš:H–Žy9Ž \UM©Ø°‡#¦ ÊÀK‹Áàç({¦Z,^˜Î“+¼ ÁIž2¡h'§§ÀqÆ˱ '9êΫ¡ü!&ZÙ¿rfÒq§ÁòŸzƒãÈä˜ÁÓepÄ‚&Î̪&(Z¿11¥ã—üg6KBáºAô‡6Í pDÛ»!‹ÒùÆ1: Ž.aŠ‚Âí°ÌœaÚªçÙ  ÒµÔtž Áœ’æÀYí½É—KBÇV ýÏQFL³™z0òøÌNåÏjÿ°Š˜O ‡°ža¤²·¬ Äˆå 訤,I%¥r?b2Ñ”±rÀÑï¬Â2ãƒcœöÀΫ“ñqÛ+ öTùd«7k¤mHDÚ|.($ì]gŒŽ°±+‹Êü‚n6‘¶1iCSÙ<œ®Û½ãS™ØÞlâ^u%UþÐzŽ¢ }ó›˜: Em÷ò­Èyøfrkcà/‹‡BPÔý?D\mQ¥”«h^«°æ«ŠËå¬b%ßì×3š½º¨Ü¿ràÂqª ™×à;.ÁòÃ5ä(3¦qÌ1<>Ú5Ø«LU1FLl±ÏpWa•‘j BÉ£Åã»!"QEa‰qçÿ¦wV¡8—ÕJ±ƒoQGŠqK ÕÅåµrºÀ«óV÷˜—£?8vhŒ\‚F°òý‚[ƒ¥¾õV±`:nðÖ¦I«/©2ÎLû†oÝì‘%†KËëår…tíÖÍA÷²´ßŽ©ð»27;0ä Ní{¯q·²Ú_îéšÈüqh,‰«ý× ·dQi!ZÕÉø`¯!Æ—VÔxÇx¥ïš„¢zeaiCÐ_;ÏŸ›ª—:íXÒ7Üãx}¢½Ô¨ A; ]S\aÄ!"®öwc\V±È/v°ÀÀÔU…§½  7¯2¨eQiõ"Ÿ$‡œo¸aplªZêßÚêà˜O´Á±n¹Q³*A‡–Ö ¾h®:{¥m=€»—mì<Çõ[Žî<9¯–î«ã^ñI^ï ‡¨C¨­.Cëžåw`½\êé`ÙE„¥ÕT½Äoá¸r‚?¯Wg¯Ç^Cg:[ùÏ{Wl "vÐ%>{ÅÞÏ£ýðòq^Ñ5•q„<áýˆ.eÛh§®_¼år\ZQ—Mñík=J`zÜÕÐx:ÖÖ×ÙæªÚ²‚¢»V6uâú–™`·¬2˜ã—>v·­}ÿªíþ —zÚ¥-ai+zCý*? óøµ ZÛªæ -ýaNìKÝíS‚:ÞаJZ†øöbw›»¯ž¡ÂƆf¿±z¬ããG·,YˆV<ÚqŽ›zxõN£8¶Ü¼*ñ%ÄqÓâÕ’#vô‰ë-ÚÝˈ¹æšeÆâ„í/K Ñ”ÿ䮵§Ò‰¹²jI¶øå›ç8Ÿlk{ãz¿M‹õp^qÌô ·,^#… Üc×Î RbMír‰2é¹)•®f`mý ¿0Éqèêiú ž-sèê)|@Œg :¾zfÞ¹lc`Ы‚!&•…e;}ÂΑö³†Å"\Wï ù@Oa¡zƘHn^¼Ú¯û°*Z˜cQٽ˃…É+Ç{‡1b=ø•BG×é—À‘Ÿ8âùæ…›WxñT•ß·bs Çý—+OA7·kåfl‹BI:09v,ÛX-jâÛS¥ÑNL1ÿ~oî×'ÞáÏ»Wn…CaT€”8%b*–6™v.»Ë/ÁÎu]æ ”‹_¿@j¼r‚5M„¡¡ß/v·Ÿ¼~A–€#ž‘ÔÚã‡WNôÇÒ¬K×Ë1ÂÒ;pù¸1]س†ÉwæFëÙ­²¼v4®÷‹÷/¾é2]_·r}Px ôâÑ7øóƒÍ;rPUgn8Tx¨ùîÀ¦Þm9Ä I° È~úñküùëÛž ¬ƒUqº“9V>²:˜ãÛ>êv]¹ ‹V*>Øí¨Æ~sû‚9^o9¥u¨­­ÐGWßcT€à‚ö—`hKÛ´X²õHûã9>°j»kŸ¼Þ‚ÿè38>¶æÞÀŽýó¡åÏ­½×ßVòá¶3¢ÀÇ'ÖîòKé×.œ åj[XZøϨً‡(߬ÀÿïhÜ`ˆ/¬ÀÃm§-Q êøáæ•‚ãÄôä¾ÖcjkgÞT ³ÝM[¥ç uüÎ…CŒ'ÂîöÒ¨ùÚÙýÔT]iõÖí6*ÀÒƃ¾áÕ¡hÀýú»¿æsá§ÖïñƒZ ¯)•!üû›¶ùõÂoOï½qÛ1·.Y› ò·þ’?ÿÑ}_ ¬óqûÙ£Ä]zfÃF¯Ÿû°ÏõD­ò™°ØÿõôûüçÜõB G¬U0¥g¡ôìF“#„ü{-‡éPˆuÇö¥ëaÈjÐû[Ë爧üĺ]ò hßåcº®È‚)¥|@à…%!¡ÇÆõX‡²+yë1Y‚F¾t×ÃR¿ÀAxçÂGŽêÒŠªÅ0ÀüáÉÿþÁOøós›öÛ–Æ¡J5ô?ßÿ £ÂøÔÄÛç2GÛåøèš{ü‡QÿïûÿŸ¿¼é‘@ˆ ìÞ_žx‹>ÃÿÊæGý{úÃ<†F»Õ6?ÇÿúÞøóó›õƒ_^9ùÑU…/ásÇêâŠÇ×Þë× ??ö3…WuÏ2:~ã܇ÒGÃœ?¾ö>Ø`FÍ—Ot+té«[7*ÀQzùä{Ý^Š½…ep|íì>ƒã“ëvû9«Sú çëkÛž0*tõÁ 48Â2Ì!()L:b²ŽéçîzHäø‹ð´ÀhZúæó[•ààø¯§Þoñrl®i|fãþEø_Þþ‡˜û‚ù׶>ˆ:ÂÒúÕ‰·-]¾xnÓ#FHBH9:¥×ÿ[]Óˆu(… é—IÈ%],SÉ$è_0œg‹ÕW>ì39 Óß¿xÞ¥ËQý¼ZÒG¸9SÓÓ\)ж‡Ön££c7ÌPš_´iñyZGÂÐø¨ˆPÿ»¸¢n•·ó•-7Û¦íi®“H$0ùJþ’†—Åœ*jÆ ÓX~IHgGÔ¯@`%l¡ë·»ùý^z¿º±r‘<œž™éRPõA1DÂ7ŽLÕI»Vn¸%CÂгCãÃÝC.;õO<¯-®˜3ö œ ÑÉqÛ€ožz½ª\:ñáÒÁ—;¯jIûÏ0¡Î0R ú#>¶mŽOLMÉðy:‘.Î+ðØóÅWo™ŽMª—*y,¥-LåËð±m)Ô‹<µÓ ,5/¨015Á[–í)ß»Çô"·ÛŒEý‘è X³"1„®üf¾a÷ú+P6+ó¬cÿÛûFøÒ B™Ø.2A–fËÔ`‰z|ÄOŸyìˆ ±ä!‘\ôÓ:±‡¿q™ÀÃև™¦ÄPe: ™DØF÷±#è’Ú9AO@ÂG4pdÆ?@K›üYã3O1f¬XäðGˆ * J ©2ŸØ‘¾á)ZöÞÞÓÛíFåyÃŽ`ñy·A•ìŽh²±/jÝ9DÖÍÁ^¿j°u Ј.@ì½µÀæÝø‚õBÃŽpÄòm ¨5u8vKâÚ-Ï{^?8b1v„86VÔ3Gø-„ÞQ¦ÏXZðͤ‘ÀÔPVk“pì¤D[—+¢=MÑ»¹.Ç1^3ÆŒaº ÉŽÇÖžkÊ]¾˜{{lHÇTíÒòÌÛ´˜ù¡±ËG)o¯KÝ3v€ª•ðÈçN÷¨Ñ 8´† ÇŽ@H̺F¼ÛêŽpíæÚeÌñJoæEUIEê% 3;oØÉóÞÓF&ùÞ§±Ìu›dmÝJ¶LÎݸlœSSuzuÒhN°#g:/-‡cY£J‡Ê0Ž]˜ü®ûœ`G ä¯ô]ø™m¡AC)„cG`¸Þh ùá#s‚X>Õy)ãâ²ã<ôŽØýþÜ°å£ÒüÂu¾à"ìÑ|bG°ý­í¥üdڼǎô œöF—™6/YÃÆṮ˼©=xˆdú^_(}N°#GÛÏx¦DØà;]H¼’®žš’^­K+*¯pÕ¶êot™i÷Ê-†}2'Ø‘K=nbO¯à˜`ºØN8pù’`çÜížVÃäP‹Á± —°ª a²±#ï¶ 2ÈÕñ÷&w@¼r"ð¤æžå›ŒW'ç;‚Å|Äõ|ï[±É€}Ì vv¸yeî­¹—ͪ}­ÇŒ!̹Çך¡ôpìÄ‘|³_Òãkï3\ÈpìÆ×(u¦ÛD>Å!ßA—ôäºÝÌñýKÀ"„4ms9ŽÊå' Û­>?p„&ÜSë÷¦c„!šìL¸—N¼;é;bBõ Í ”‚$< ClÎ v¥…@]¢ÿùò¦G Ó1;sñ—Çß6FGÿ#á#°Še*KìŽç7?Ê_;»ßk;ÿSWZõ¤ ûÇŸ{3pÔ~øȱ#XÉCã>ÜÞGÖ˜H pìˆ8B”N¤¾¶õ ‰2oØ‘‰©ÉŸyu<È›€÷ ×pšì8þøð+ÚÉœ$IøTÆ»-‡ÛaËc¬^:õ^'¬zŸæƒOñí»ŸaŽÿ|ø_wZˆõMøNËGV}gÇ3쿼tâ뙌 Á1ynÓÃFáœ`G~uüíë┆Y7(؇ÿžìÈß|i0Èi(¯}ÞW9;ÂÀËkaÁïÞçŒÃ´pìHÇ@W¶­%aœò…cGàîaïŒû–„¥]°'ÖíbŽ?;úz G?@!;Ž³ÿ‘ †zílFkÛâÓ×·=ÁݯO¼í&Lò<µïï~9þÕ¾ŸrôÃGîˆù—#¯x\"8}ßÜþ}†_öWû~fù BK» ¿ôÎà>BhùÎÿxÏ×Ù7üÑáßfáXÿíO…s‚GÂ8JìHL‰Íš§7ì¡:0û_>ùžü–oDصb‹áìÜ;òÊ™½”¿PbG,íØnse>¬Y7«Š§þÅaŸzr‰!1÷á1íiÚšŒ+CŽܽqåMÄ$vmÕ—T¯qaàíj+¬ƒÿ“9].õ´÷hì…ÄŽàŸt*µÙ缇cGúGn«g-b6<+ÄI`{×ëîe:§ òÈ´µçš ;fºäô¯¢¨”±/o:[m¦ŽWcñp4 öI ‰±t¤€ÍÚé™i÷0ApÔ)Ù§é±#î¹ÆE1gÑ …cGpDåzMq+V$(ãfÒ]3³kY•XÎW$S× à7ãpõF¢§ôm™ŠNÇ‚à#áØ™ñÁ€ñý@8‚„0pÄß”¢aGîHŸy숀S™¡K[ˆÑt´‡¥!ÔC±LMìˆ%–µ\ë1/WºE6ŽQy„¼ -DË íHŸ]È™s ž@ƒ´é&£®—ö]A‚Á$HT¬1Ƥ{é‰Ê&¢¦"³eµüdÍ*D?Á˜·W˜.^à8êy1Î3F•VD#Q —=“‹‰WÍUœŒ8ŽLŒÏ8€JÿtÅ)šˆ‡"¯½àj¶Óù4ó‰âèÛvf2Ò'V˜W@àÄáñ*·ƒP‘>2.ÚMY`aäðÏ;2¥²‰dcs´¹”‘ªNRz, 9«Æ~Ä# Ó1¸7àèBOb^ŽI#Ž¡ÄÅ(9w³Õ)·-5·ÀÙ¹§—Ǩ«ñîX]»Ì€CåŽÑßfP;ÝG²¾¾‰6šÊzíŠh£óhÓH6;'Ø‘“-âb5ÁÑ@‡„cG®ßºyýV Åú…>ojh–úeN°#­:#tŽñ-‹×HŽáØ|+£qÐeÂ|²×ùÐ!v„hÞ°#Pˆ|œmùt(4Db8väà•|ªb4I¸yÉKÃ=ud6~~2%óHa)q¦Ü±##·õ·®Ã’Ê“!¥ÁÇB‰IlÙÿd,±K9ª’}—Žr¹ÑÔ¢²j#xîØèñ2mƒ# Hº–"Bª ÙyÚ@ï¬j;íXêîKµ‹¹„³±6v¤E|K–8’‡šwëtðÊɾázÖ”p…m!?:dN°#oŸÿˆû ¯éUUTf Cæ;òæ¹™ …Éaë6wëX|ùâ8&G¾]°uÉZC$†`GÐþ»-‡Øу¥$“`¡mÞ€n8väãö³m«^õÂí?>?¹nèµ³ûx\ÇÆÊEÛõ%hçpûÙ”4ïoÚF‡Úò¬aÉ.åjéü§Öï¡’WÎìÍÆq]ý ckGØ¢9ÁŽœÄ·ts×5Jm ܹŸò™c‰²±j¤?‹ó ^Øâ !‡cG x÷^:Ê–öÖï6´vvf³ BMAÅC4ɦæ ;¢¾m?˳ ã_ì|cûd^±9ÁŽiÓß*R5ŠGLË [+ѯÉýèðoe¹œ.´ùÅZÚxùÔ{üöº*Ï!R(úÎ…CÄU;ðÈO±õçïìx†Lô¾ÎPFSkj—“}â¥ïZî~0ªaI—×äŽNyûüAÙyyëG‡äŽMø–—#»u¶ƒñ´‚+ôã#¿åŸcËKF‡x¬pìÈ‹â[JlÀSQ]\ñ/ž ;‚o¥ÛUš_$±þtß—É ûçC¿a}çõã4:d«ŽÁ·ø/c^2ýû;Ÿ%Ž³ÿç²|L¼á¶¤¢îZµµ÷ßú?¼-ò|`’y õ±@¾¢5>Ãçì~Ažd†cGðí¿y5 G²n£F:¾rúÖw~Ž²çkTò{æ”ÛfShçé ÷[ÚFýÅñ·;úÖŽ§½†\îØ«Å\LdgAÁÓyþêÙ}tG[L_ïk‘¥­+§ ¿ìÅr…cG®ö]?Üv†A)eEO3fâ‹Üäý­Ç{G¨Ê‹YÓúrzkš '8°Í8 €Ž/¨ûì…]ÿJL…±Æ¦&²sÙ]”tËF‡¢T}2Ãuø2&<8˜.ŠE¹àÈ <ãÌ-;â¼¥¿¦³#†N`Vé53Ø!Wû:3©8’)²…ˆi}Y5ctõõ 2œ%ᇪ?âñ8¼{:膭³ªP*Ž¸~ÅÝáX”Χ4Òðëoõ2"„LŽvÁc¥#Jx—®—A­ÅÜÛLTäMÉ %áØH˜Ag;¨*ñLüE5á¿:<;¢ó—ŒPObι½ó•FÛ$)¬ îC;‹¢“ úÈOæÑ阺ZÁ‹«È râ”·žã¢±LEo$zZ4àAjÝ•‘;bg²9Í8sC 6σŸ8´-ã­(#CI(vÄjáóFŸmìˆH:¢þÂòÕ%"¯»¾¹FÝóÄ}OͤRx—©ˆÑ6ÈDL)õˆ¼­&¦…¸q‘z$;‚LÎLñÐÍ2r#¡2˜ºIGT=ÒyL„L™t„¶ñ„¸¿=O{·ev}àÇu§ ·„FM©GÜ¡ú‡n횘šñC#éHA*Ô·ÉdX«®êÛ¿8©§o2Ëà? 021ÆcÄ<€ãØD˜B©G žµAæTƒ§Š£˜t~J Rù”†Ä…Ë@Rx’Ž`Ô (A˜# hN:Bs-Ë@h °Àù©aº0¢Qq›Œ?õHîØ™t]E7ÐvÒ0Ï0p1–Û£CÒ·DO¤É¸¹&wì’ô%V5Ý_ãN—º¹F&Ñ€’ô|ÈËZ.ÚyÃŽô ÷óU;E©0‚‚çyÆ\“ùÁŽ`õˆÌÞµ%UãSãrž)õºÊî U•¹iH´<ÅêKª¤#°& Òù}ÓîîÀåœ,4ìˆL:‚µWUTÞ7|{xÂY9ØGFLtAaG8鈥Å8&K±GL¯M[¡Ø#éÈb}®Ñy»‡Å¥é¾ÅÞVªáir¼0nÅ+Uê™t룓÷×@¶Ô•VQÒËGô\®ßÊSà_ÉüáØ™+ kƒ§—R@>Ë„Ë*°e‰‘z$;b$Áä`Œíý]Ì‘n!u“Ž8£\UÓˆÍËyÐòÊ,!•tÂJ—b¿,­¨GÞ”z¼ZnRŒGm¶E¥5¨ÙÖßÉJRȤ#(‘c\^µX^J‚1’Žà¥©+}×yÔtsN:ÒË긹fv®˜×#¢Ô#­=í£nTk¾·¼¿ÆŸzd~°#ÐÅ2!üj(ßÖÞ6Ò(õV¯~/A<¨¦ê¥ý#·ÐÀ©GdÒpÁ㸤Fí(wx³ÆsÇŽœ¼~»Š)Å:Ä#cŽ…ep!"ZERå õMð“ωT+†÷ž;vÄH:²eñH*§D·»®~¥Ô¹!ØGÅ šX %§o\bab¤É;‚-|\¼öÚ¬r®¦Ïv]æ,ƒúæšL$ ;ròz ›ÕêBî%˜7WŽÙSFê‘;B4oØ™t*xóâÕ²ÚÓx'/;‚]skÏÍÝM[!ZeN£í뱡0K¬£! ·,Y£Ó8  ê‘ܱ#X„$äm½754K˜,Š]+6CîÇÙx.0‡>n?ãèqA KHÞVƒÉÁ»ûd#õHîØ÷¶êjú¾å›nõKí°§iºŠGÌŽV6Úá¶3dCÚÚ¹»q„Ǽ¿l{Dz ©xòP&ÕŠ™zd¡aGÞ8w€%pÁÚ;xõ$ëPc›¯ÖIGN2ÀôáÕwONOCª0žÓ+5`îØ‘Žþ.©ÈžX· K–©GrÇŽIG¾°~Êã-ÐQ6ï€ûèê)ÞVؘsì6àý©GB°#ò¶3¯½ÛG¦!1R„`GŒ¤#Ð…é¬^6ä(õˆ¼­-?²ú¨È#&B©G^;»oØÕ/«ª—B±¾é‹DØ„¬Úy%ã€éDòý‹G&Ý;wèÔ#2é$ძ¶CEŠËJì/Ýõ°t#ìQîØ#éÈ=Ë7-©¨Å#ÓùVÕŠ^S·|ÛÒõFÒ‘¯n}[O–©GrÇŽ` Ñ ÀÖËþ+›óáå ë™ HŽ!Ø#éÈCÍ;Šò ±&B©Gäm5EyÏn|vŸ@€Qê‘Ÿ“/¾YW·ró’Õ¯ÙÇî!¥LþÍÉ÷ضyrÝ.x¬¯ÙÏ&:äùzqWN8väÅcopbHü ŠòœÅ¾?õHv›] ùç6=,Kü©Gæ ;ò_æ##X•«k–ýæôû|‘z$wìˆH:²!–W.~ùÔ»¬h e Œ¤#xÏsWú®ÉJ=‚g§] ešÁÏÂ0J=]ù£Ã¿åbIÀøéä»|I:¥9q½EƒU™”<{¥÷šLCòÕ­O@´RÒK×Ã}dõNȶ÷Ð¥¯{¹cGþñ£ß¸ÑDµ¿°€uüm6&ý©GrǎȤ#›¯Ù¹|ã/¿EÀz[£ÇžÑÑ}¦ìÈ›çœírô ¬Ðom ö kê‘숑t„2O >ã9 ŽåÖÇŽà¹ð\µcý¢•ÐY|fH©G ž ¬X˜à¹\ìi—zÜÀ(„`GŒ¤#XáPdÐYŽ‹š |Œ¤#úÀ7a¼J%º¿¿óYHu™tfÃs›yõÌ^Vm”z¼þë{?榾¼éa”ÿäã׸Fê‘pìˆL:+Kî•Ó{O99\Úâ?Þó5N:Bm`QÁûñ‘W˜#Ý\ãÜVC]Í+þÞ}ÏÁ…¸sgQê‘ÿþÁOٓůö4mÅ.æ#ÖÆÊEßr“åŽ!°Åæ`m[º²®O…ùÕ/àf>ºæÆ—N½Ë€‰gïzÞ€F›!C –­ôw±#/|g’®¡ÑÇ#˜Ø½—>†7MíCVc `§Øzœ£ð¬RYå\9 Ûž ÏË['¹ÉtîÒu÷òT<ñ ¶¯`N¹æÚF°8Öq^Eˆt[0 Ó`Ã,d| ö žìyX¶.šƒRÀíe „>ÓXÙÚÛÑ«¤„*ƒŸh !C°#˜äZ]úëõõMxôJ¸Pxvp0±ÕRT’W´¤¢®óv7úæ j’I8›3ö m ÂŽ,*­I%°Ûùº˜.пø†sàñ¥uêw±P[PÊúâ› j¬0• †0ˆùxbQiõôÌ4|ÎŸå½ Çoóã'™áØ|å:ÅòRéâtüYJCBÑd#õHvÄI:¢Ç“PW%dÂŽÄ»HÇòdÒõ~2¥®npK~2­“ŽŒ3‚Fâþšœ Ôœ”QàX,­Â»ÓîzS$"ÑÎ<'â*äícg ‚[¡Ø˜~F”Xî!Îy©žtJ4â¹M^—Ø^LNBP väŽôÙÆŽ8€#‡‹Ó‚D*ÅuN‘iqý e12‘`OÎx@'6倚Ñ×Ó¸À°ÓD.'ˈð— ÁŽL+ÐÉ4O¹‚òÍãdBíX¾”‡±] ‘R “˜n§t–´3!:–`GÆÕM4¶å¾øNûY‚!4(8æöÁÖ%i´€ÁÊ” ÒùøSÂ#èRf"Q×n%Rh\s´©ó©D ¢Y¾"“ŸÔ?œÊô¡0¥²Œ@Nqûø³0’ ñR8þŒNŽq<ì0^(DgA—46Å¡¢t>º4"Þj*N‚…ÊD2•_ÀÆLfÆèfAû¼Àòôí6;LYFŒL$·!À9cGÄ=*’§p¯ÞL$0þÐó‘‰Ì[ tj€yà¾Æä9bG0]üdÕí3NVƒ^ÀPT% µ=ijŠeCêYbPGÞÄ4?ØL`¿>\ ƒ™‚ùAežÕ˜¢zŽÒæ;‚ 組²SÀ/å¨ìj]ƒ½3Pˆ2zÜL$NauQ–½œçºÒj'Ò™HlwNäv^(&ìð¸ù¡ü ¹Ñv¤ëvƒ{ŠÜ,#2j E®í숼‰†³ŒÈL$XxŽ×nÝdŸòŸ·öº/“ÙÊΆ撳JYFd&Ìçòªp$c—…ýàódbí%2oJv?‘+MaÕéL$Î!ùòÊlg#]eŽØ¡2£{vdTe ÉŒ‘²ŒÈL$hÝ€#áJr»ÀÍ2rµï:?µª¢rŒñ¼ˆvS–•‰D¬4Lä•;Fµ'›k—až1">9ƒÆJÃpX¼p–™‰¤¶¤JÞ‚¹5:(ó=PNiŒˆgõ1«XoZªÞ«,#úD̉dFT‡“GcE=²‘‰ÄˆÌv"Ž·*g‘™H ÷0'º¯òF€,"©%k¯¬^s«Å ‰YúA—aŶ‰ç¸Ùû"fŽØä (Aý½t&L J ØIÀÒ¤<±ö>èA~ñ=‹S´ÓË*Úa‹8å\PØÈ Þ8–7@7AùòSKÆ“¯½·å&µ ŒTØÓDçË'8e*Ã*¹cGÎt^ºì L˜O„|úðòq”õsÇŽò‚Bè¹P&zÖkj—C)¼tò]þ e12‘ÈÛm¬PìĸäHBþ·§?`³ "QÞp‚iëïü¸Í ßÂäxFSˆL$à{Ó¶ÄM4œeä—âí[”@þæT&:NYF ë?à½`ÛÏoy ëmpü¢rp&[{ax ï_<ÂvÖ0Ù*"Dg£ŽŒwFآܱ#hA‚{^Øúüz7‰¶« KŸZ¿çÀåìj1ä•3{Y ß%n·±æ;ÁN®œ­nجÃãÃçŸ|ü*/{HZ¹¶C°#½û[3ØÄßßù¬åd"qŸàûĺ]¯óM4Z–RDó>z™¸{åldùâûkwÕ—Va{ÊPîwïù#íÌç·v¨ø"ž;Vhç¡(C°#Ðà/{ƒ³)Ë6¬|îxïsrVC°#3¬/`´“0ùá_q£þü`G Ð,W]R–Ôçt°IäÚÎ;‚~sŠ[°ÿàžçà¿@Ý3BÚä…-c׳¾à,#??öëºÝæ/÷½Híàÿ(ˈÊD"TÀ·w< …òšX$ß»÷Ëàx¸í4˜Ò¨! ¿t×C¯žÝ§=SUuI+áoü’>°,áXýÅ?uºîf¹®Žx y”#vd|jòìÿÛxOmس¢j ‡À‰þôoÊÖrÄŽÀäø‡ƒ/ñŸ_ÑYF`ÑÉuòŸü–l-;òã#¯°FÛ¼xÍÚÿÞõ·<*OçB°#°gرâ,#2 ¬8‰s ÁŽ@¾I EYFd&QxŽïµ‚ÁLC††ú½»•øúÙÑ×ù¤ †“´dB°#?2íY^2-3‘ ýßßùE,Â3®†B ¤È •ŽÖý¸oÅ&¬ÃÿòÖßsS”eÄÈDòýÝ/@¿üJ,*<2p„ìe°øR•Å$³µÃ±#ÿכǟ¿¼ù‘æšF‘‰Dýàyè;°*¡˜,·èÿxì{øðÖ…ƒG\(*dï·¶?…%ÁÒxã¢U”eäÏßø!7õÔ†ûa:þßïüsÄ¢j®]#êLJ_¡’X,Fí3åˆT r^±Ü%DÄÎÕ¾ëož?È( ˆ8Ç®§:œÅê³v Q&’œ¹$B°# Ý{€3…<ºæž²‚è—;ÎRû0Û09维嬋°Ji‘mOƒ…7 ÿZ[¿TkСM5K§¦§Þi9Ä—ïlÓÆ$9€4"¬¥üT„†IG¶b³C"QŒ‘œ#˜%·ÇP ,j;­¨øàÐ,#cúÄÀÁ˜@ÍIK;;‚õàØ3±Xqº€Æ‹ÝíÎCcØ0f´¹èL„6¦ ±*8Ù œÍñ© :&"ìHSõ’x,N ªi" RyÂ]·{‡'FinÐI²:ú»¦l'FEa„€²ÏùSŠ‰"2²€¦Æ&ÇÄÅŽÐ×í±¡aJÜ"rº…`GlÛ†·Âh„Ò‚"üfJé8 2;2<>êxè12£å4¢¦PÇÕ<¸?¡×æñ«ñItbéÈ ú$[g"Q³Š§Æ(òüb¬"'x£Á#q$_XG!„Œ»q”P£[‰±t!ܧLž‰ÄÒá !QvD~ÉF!1v‹B8~p/9wv%xÔ€’Q ó ®ö^g@7ÔØãÚšùÁŽtª„"ιžª”Pá‰ë˜H]±sCÄŽ M¨ÝV‘‘›ÎÍ!«ešî¹ÅŽÜ”û‘{ (±õY³„‰ð 5žÂtasm&Þ™;väÂÍ+¬÷!%(¨æº‘õ&1ìˆqa ÝGXH”;v_q&XzÛõI½(´uáz®‚1.¬Ñ7ÔØãÚš;B4oØ‘÷/áÏ  ,$ ÁŽ`;+u©AÌnгt¼ã<ëP*”Ø‘-KÖPãﶅ€HŽØlÒCWO9ƒ×:ÚÈ2‚Â!L`ÛÓ¹äåÞ°ª°y‡ÄŽ¬¨ZL3°(wìÈ»MºÎÑÊêÅ$Ld–´YYXÆo«[ú›]¢Bš°¤¥qEA a.u·sü²Â YPØ•PD@šèžO¡­âIúš[d$0DbG €HîØ‘&ˆ©/­’":wìÈþÖcìD¬Ö0.¤g%Å–YT:Ú‡ÝGײ…ügvdߥ£l'€é‹ÀB¢ìˆúê†óX¸çìL}ÈÃGVï|íì>¶ÙðsBî¾}á ‹;²ÂFÇŽ<ºæèJVC°ýhkŸu³ŒØÚBC¡|“ì`$±#º0׈°#D¹cGŒ kå ±#ºðé·Îèr;Ã0,r6V±¥e’;väsh¼—ú¼©¡™lÚ7Î}È^ó¦@$;½É³†‰Ü§ Ïs!dï³ü…H(‚Ÿo^¬ð—/Ÿzõ L躒ê×ÏeØ‘gïz°½ïÚ§éƒÅN€cçÙêæB¢ì¾Roü»;`"ªPˆôoïxZ& ÁŽH˜ßP# w.»K®íùÁŽ@ÙC£ü»ž·4 k€ëP!QîØqabûýÝ_¥B™]黿Š§ÏÞÁD,½$¸Ê…?rbÉÊ4ûâ]5”ÕLLMÊYE!lþ#™DJÖïùþ•ØПìùÚK'ßÕþ…*ƒæ"åõÒÉwØé@ ÚÉ…‰Ø Žµv„ ùϱ#ðAôW¶Û‚‚Ø ’#vD}%ЊÿIÃD¸úñ÷|I¾þ‚‘_a…“£$±#Ƶ5!Ø Á ¾ªÃö…D!ØP$Dþ_þ=KÝ^>ùž,|QÃDhÈ|CÄŽ×Ö„`G°æ¥µÿ¿=ò]Ëw‹ ¡Å¸qØHd&ý„ u?6,Z æ¯÷ýœeG^ž” °½ÿ†´öÿìÑ?°´½$ í?{ô¹Bvĸ°Ê¡€þÞÁÙºð©¶þNéÖ”Tþá=J`Âïã Rð"±Ñþîà¯Yyí^±ewÓV|øña”¨¦v­ÜÚXYÏ0K+G8zvä[ÛŸ’îmŽØ‘ë Óöžå†,±Â!Ø´îÌ^ÆŽ Ù30ZºZݼ *Ó•%4 ÊkKªdf»ìl6yËÌó[³ôáÞÞÖ£Á„Äøèê)uEŽ.b˲ ê˜[¥]h%BBÄ´~¡8´6cG`Å%I² hDÔø€pW9§lBò¯©NyA1ÝF$±#tm ZP rXÚ-bìÈšÚåò¥â춞cÄb5Eåt¬t¹çÚðä(± ¤Åço^æé‚×_¨aB3vdiyýèäù 4tð%±#–ö×èætš>ӾᾖÓGë…éü·z;R§Oþ'§'»D¼†«¾ef˜º•J¤ÈÖUoÒªDæÎ숈D;ÓJæÓŒms40ìˆsCͬ°#–+¢3)xpv$wúœbG,ﺜ vÄò]Gúoˆ™÷ÑÌ;’ÖÉHøÏYbG([‘5§Øo2’YaGŒ }­ vdFÄÀŽ@ºQ¶•9ÄŽL«d!™d$³ÁŽ qH^™bäß ;by“‘Ì;by"ó€‰ëd$ŽÀ0™ŒdÁbG`J 0ÿج@já`GJóŠ±aåÊ!SoBD>vÄøŠ°#V(@dAaG®Š#Œ¹!’‘Ì;"SŒÌ;RUTF¡ÍO€ÁSè Ž;âˆÌ;Bþÿ9ì„ä¢RÅñ“aGdŠËÅŽ@È„+v;â;[…íλÝÖì°#±Xœ8~ì'#!š%v„¿’ØK‡·Ïˆ@øg;"SŒÌv¤©z‰”Ã9bGdŠk¡bG°ËhkKìˆ ²@±#:ÅÈ o¡jwç2@$ÂŽý»ÄŽ Íe€È¬°#”bÄòbGÐø²ª†c™]?Ø‘‘b„±#–‹r;Ût€JbG@¬¹G¾??Ø‘7ÏàõÉØ‘Ãm§™£;òøZ˜4°#—zÚùWŸ9ìH‹øÊú±#PUl™|ªØ‘f7Åȇ^@‰ˆÌv•Q(SŒ0LD&#™=vD¦ù´±#–zÃû´cìˆLFâÇŽ<¯Ã~vâˆÕëïŠyóüA÷ZÌ;2¯ØlØ.~ü;aG €HîØÌ$_lôicG,•Œä‹ÿ(RŒ0vä5‘ŒÄÁ„§);òĺ]$Øç ;BÉHøÏYbG° µÑâ”,^»ui&ýÕü`GÔWÉ!±# ò×™ìn‰fƒA³(ÙùU;‚?þrïϸ);A‚9ÄŽX òSæø©bG°YJôͼÿ¶Ø É4;K왂sˆ‘ÉHf‘)F,;b$#1°#P‚O®Ûe}Rìˆ&bù’‘Ì;²¤¢v׊-†²»#vîÛv«­:‡Ø+“Œ$;²D§±¼ØK'#ùó7ÈÎ;ò'ú›ùÄŽ|_O—H‡*¹1Ø3oØ85ðã”mïÅŽŸ ;²cÙø–;²¢Jm=JP={ìHUqå[ýØ<iWÌ;RçÖIìHQº ¦¤B}ÿØ‘x<ѤÎ'ÀŽ {EéB¢õbG,oÚr;’N¦É¹Ø½T2–Àì±#å…%I}Ì'ÃŽdâƒ;BaÇlØz(v$?™§£É3¿v$‘¤Î|ì~(!³ÄŽpà^bGb2kìHÌÅ$|2ìˆmÉo>¿aGœÂÏvD…ç ;’¢áÌ!vD§Hš–…Ÿv„~Xvä3…IÆãe%Ÿ]ì )ñæ;‚ 'ÔÂ'ÀŽ”ç—+'ÂŽXŸì¦‹Õ'ÀŽ4VÔßê°#óÁJ£EØ‘ùÄŽ¬ÖÙðŸ9bGº‡úä Ÿ vO¥>8ˆ°#v„(ÂŽðç@ì]dÃæˆiªYzX¼ùú™ÃŽÈëi>sØ,ª›CŽ`ÿÌaGäõ4ÖBÍ;òï;òƹÙ‚úÌaGÚú®_Í\ˆó»aG^9³—Ï["ìÈ|bGZ{®éxç¿%väWÇßæÜ ;òÝ_´´l`Gàga…/pìaG;—P>ÜO;²H_OcÍ)vd|jR>…O;òv=Ÿ—LF±#üÕbGÞ»x„o~üT±#؃¤¡>‹Ø(»?¸G Ì;òÙÂŽ<½áþàhüÛaGêJ+aù[Ÿ;²¼j±´´ç;’L¦VhWý`GJò‹ SùvÄú¤Ø‘”›Sà“`G Ä°#ŸQú`Gb1Yí“ßYS€©@˜ÈgãΚdZ>†\î¬I)Jl6Ø‘‰©IÞÿ³¾³&M³$±#:}HŒ.H#úÄwÖ`Dù©¼Ù`Gðà$GÂŽ`€™'bbG’êâ±<Ë‹I'R£&‚53t‘ QŽØÌ0]~FDŠÇ”x±#|=ÄŽ`fdÃy»³Z“ ÃD%Ît-ìȼ³†’‘Ìæά[ 0¢¢²–ÄîX°Ø¬pùâ>aGÆ=ȹ6ÐÅ“±#W döØ?LÄ ºÈæŽwÖÀ¥¡\-Û5݃}ƒ®8bìÈõ[7%’c–ØüÄ Qá%}‘M·(¼ó5œ W‚Á´pDßÊáÎL ÄÂyí&ì¤YËÍÌKÆ(Ë2øΚ¸”Ìç5гxŽ&2f`GZ{Ú•ëåbG øZ{:±#MÕKäÚžìˆ&b]dsúÆE6 ±#X½èü<ßY#a"–‹‘ÙP¨ۓ̓À¼#eùÅ2¦;wÖà)ȳžì¹~ìLJúM4·Ø¨Š^Hìˆ.Ìp ÁŽ`_pðÆÊ‚¹«¡¹P¬í;B´p°#sxg äVÚ<ßY áw8vwÖ@¾íZ¹eþï¬9xùÄmW˜ärgÍýMÛ°åÿÝßYóqÛYgÍŠú£ðÑÜbGêÜëi$vÂëœëÏ-vOâU–;²¦v9Êý×Ó@ û/²á?çÿΈ>Úª;¾X«Æõ4„1.²1°#®Þ /ÀÀŽ|aýnx³¹³æ¥“ïò¹Ptg Ñü`GÎw]AôYÝYÃ×ÓHìJˆì5úzš,/vDJvýF\OÃØ‘Ÿ‹‹lfygÍó[ƒ`ÿ”ëi ìJ˜r¹³fOÓ¶f¡Dæ;rµïú›úz‰¹à^dc‰B¢Ü±#XÞ"ˆ>«;k664ïÒú”`Ùÿð௩+‡;kà}|çîgfƒOúâÇN°ß^0wÖ|cÛ“Ò»Ÿ[ìÈ÷w¿@h‰ù.ä:¹ÜYóøÚ{IÍ…`GðôÙ×ÎñÎ?LÄúDwÖÀð#(QvzzœÿœÍ5Û–®#(±#Û–®…ñ`ÀDè¤è¿½÷cYxÇ;kàÒþç¿ÍB°#°Iþjß‹ü'aG $;R¢¯§±¼Ø‘Z}‘ͼÂÞ=cG 9µF ÆŽÞYƒ¦äiùÜbG¾¹ã)ˆ;òÏÀb9ví¼0!CîÓ¸³.^G—!Û>v ɉٴx \ž#º*¯¿)Hç¡D#f<Ø‘‘‰1æ˜N¤0Þá‰Q^9è<˜¢ªñ:)JØ(}(NÆb&ƒÁã€äŸœà}<ž(Ò¨èQ~î˜yp„¬gH†ƒ1N©&|LI^‘Ü)9bG,oŠ c4°#¨Ù˜Ò²˜#~%í€Ü±#˜@>5°ôᦥuž@9¤ÀQ¦Á²¡@£Ä(”æKM3?Øì){Žå„Ê<«XròHÔš/ìZà>0v¤gx`ÊCTÆÝC}SnÄ€ƤéÓRg ÀÆå<וVcçJìHZ!?2c\PØK‡!yëáY`ùØ#䶠°#x@¼ö`šÀ\bGê½õC°#ØA|ÖéA£–ÉH°ƒ`µË²³! 3mu<”Š'ÚÄ,¡³ ÅÏí7V.â[/’¥ú¹H짅`G°¨äs/¨gDxL‘,aìºÊOìªDD';‚Ÿˆç¢Ð*P(2 ê/­¨Ãêw€b¶.Q³z¹·ƒašØAfKw›Ò8šü",FÔ)J;r®ë2o´ú’êEe™£íܱ#78È¡° µËñádg‹²Ü%!µ[v‹ÄAViòcG°×xëçˆÁ†jˆœ:`ÜÖ×yÉ—ØØ°ôþ QvÄY”­,Ø‘{¼ÁÚ;B4oØ‘#ígؤëi°ªe$oç²»è|„(;rE½ßAnÖñò#mgx›4Õ,Ń8pù'[¥K QùIKC¤ÖÎ;¢†ñ9¶Ž/ÖWô‹d$–>%ÄÆ‘%èZº¯:JÇVQçM‹WC°wÞr„I.Áy‘ ­¹cGŽwœçuCY5Þ8—¹¢~óâ5&²R-À#Kž)F¡qÊ]ÆÉXü‘5*|{èê)Ö¡P^rm/(줽Dí^¹ÂD^d£è¡Õw·Ü¤e$ ¥µØÈÿf!ÒsÇŽ@´d° e÷êí÷/á· UVT-õsÅŽ@qèå»Vn±t~Lm€‹Vv„½Â­KÖBBÝËd$O­ß#}ºìÛc°ÐHÈËú[—®k6; íàåŒRøòf´8Ò~¶Íµ'¡‹ñðÈX'ÂZ& €Œä¡6JXzßß´ [‹œ•Lñ/Þõ„GL1Þ/ê~¶–{Ø2(aG k˜p®;òÀ*ò#ÂŽåŽA R„¾°õ1ØŠ;¢ê¯¹÷ãö3ç\{± X„lšn[ºN®´Ü±#° h£¡pÐðøðùŸý†+`ó˜(;‚í#Å×ïï|ÖÒñKÆía{â¹ãóFCË´µÿA$#y¸ùnÔ”%„Á¯ÞOá»÷|éRw;, ç"‘"DΫg÷u¹æ4Úߣ£•D!Ø‘‰éÉþ-gSŠˆÙ½—Kíûî§å¬†`G —Ø 'ì ã>œy FýùÁŽ@¼ÿJ`¾±ý 0ÅQŸm!h‡ç° wìH§ŠÑr öÜó|(‰Aý/n|Šà”»Œ©ð8جÂ"TØ‘¿Ö§‚Ê4ÃB‚SIø²È2õ½{¿ ù/K;‚EˆmB£nÐÉHÞ¹pH;ª ¾'­„¿=ðK>ç|¸y'Úÿ ÷z[/ †ô`Gþ§û¿.§"Gìèÿ{ÿ'v¤µ·ã•ÓˆäŸ>ðMY?GìÈøÔÄ_ïû9ÿùbÎ +:·ùcøa ÁŽüâø›|^GØ´ÿ—{3@„ç·<*OçB°#òzØ¥ßÙ¡¶Þ‹ÞúÒ’ ÁŽ@åIøG÷}ŽLF}ô»Ÿ9pù8J ì$!kL°“–LvÄH1‚G–—LKìêCmAòÖ£|øëý?Wf•îÇC«wÀ*øoïý˜Ï¯°¡¤Ð¾Ô€ÿéÁoA¿üD”v:‹Û‡³ömµ‚±2)FÁz=i`Gþ÷Ǿ“òW®­bë#–¾øÍoü Ë Ö Ÿ°ÙžÞp?>üù?ä¦PÆêÿùÆß2GÂŽÀàü…Û~,£ö™rÄŽ`›ÿ¢Qô" bß¿ô1Aò’),‰3—>j;EuŠó ^ÐX¥7Î~Ø5ÔK¿….–(íì4ø« èìDtàŽaUCìl¡ö Óù¯½ï|—¶œuV)€%v³ Ëm_ë±!u"§ZƒŽƒ×9:9¾w±#;õÖÐØ;rß år^éÕ¬n«(¯«ëªrÃ; ì<²áÉQê,ÀsW°*©Å™Ó'vþ{žY…`G®Ýêî¥=‹»osaàDcP[ð2`]ÏØîB»¬ ¹«4c“t€)±#0z sÞN¤—inøµÉ¶¾3Ö ý¶ª¨Ï·£ÿÆŒ ¨)./Håû# c“ãP£n\.FÑ 8ïúBUL/åfVZv숥E“AýÁ±a^'† ‚Áä8®PÌÊSo§«ãrШ),°x<>4>Ê1EzI¿r´ž~’„™Tz–&5FÁVL…{£(ðøÔ¤íž9vÄÖÕd248ÁMi`B«Ø3”«¼#³ÅŽL‹4hÇßÅãN¶w8.vDw#ìȧKŸmì¹hì¸N"Y;éCì™™ƒNb‰˜“>„›r.»™™áþ%°NUê›~]• ½}ð#§²bG,-hxW%‘VÎÆ›q!&º6íŒâ˜é;uޡ̈(’DÌ ÁŽ€Ý”{%jL(%GÆ †2î@LlÝùªMLM0Çd\B09Æe71oŠ”ü”¸gQ¥“é '’ñ “c2¿ ¼»ñÉ ~Ž`‡hÈ8/*ÔAÉ‘Àwb⸠1¥`Ò4~ÖÄqx"‰[q´/9æiPˆ¼ÅÆÖ(9Bèƒ#” ‚cŒ3\)¡@'žXZîØô*3F­ èyõbº4>ƾ=6ÄcÄpRñ¤Ìø‚:ia"äŽG¨^;Ã1J$†š¤$¿P=Ù© sA70X6©c ÁêѲ󃱔Ýp›wV2–(Î/Ä“âá ŸxX²þü`G°¥Ñƒ¯ðL%2 þÖñãSsXPz{|˜·^JAh+¨Ï¬¡ ©S\Þy«‡9bf`gcéÊ[~ð¬QAbæ–W6È=‚±äÚd†cºJÝñ”#þ¬Òﹺð Õ Ü”@„²â[Yµñ\TÌÕÕìpe±~xm@:QÜ·µ§ƒvŸ­t” !J<µš‘ÉQÖ´—c ÁŽ@ø_$P‹&¬Ï¢tþ5‘<›«È/iéÂZl(gVmÅÎ?Täõ›ý™Ä6˜®rŒ‘'í[óƒÁ~‘ð ÈR0’ˆ< ˆh,<ç^!maŒXr†^«A!™w&4nóƒõÆð»êâŠÅ^q—#vt¦ó’¼} NûåÞŽLŠ”Òjl[X/§ÝÀŒ¥¡!ÿ7Ô7I­;v¢›£ƒ–ÞVƒ,©t»w54KŽ!ØKãøÐëÚõYãÙPsÇŽ åc×.pû$¥yE­™|K6–„|·/;r©§Cî/Lþµ.N‡vdèÅŠ°#.Ív䪸ÐfóúEMž]œLïô>ÐìˆJù‹íÎ暺å(éé©°6 .v·³„GLæE‘+|‹È£cÍväìV VŠb]ýJˆMÉqÛÒu0ö·crQiUq^QK·»‹m…|‡Üù–°DûGo3šïnÚ*½Ü±#ØìåÅ×kj—C¼0t ¼îoÚçWÞbS’W¤’Eu^dÄ DñÆE«`¨`µ»ï`Øã•E¥ò¶ÎðL´ °# ½­G]@¤Öúº•GÚϲ봪º±¹¶QAL.&#ÁÒâ1OH0Üëï–VîØv“X:¨-)uè#«wJ+wìH¯‚M’vaL>¶æ^pÄŽ`›6ŸzcÒPhp·ŽL3…`G:o÷|$P€[—®ƒT—?¾ö>iV…`G`ó¼~v?[>0˜¡¿Ž°Úö¥ëP(ß¿ß¾t}÷p?ãKÀëÉu»ñ/$«rÒujIœáÆ—UÔooÜ{ì­ó3…àX\Áh[Ç*àñAlm´Ì­0÷ÔúûåtEآܱ# —N¼;,lÔUK>vž£ZÑÏkêVÜì}S@L°UÁ:“ôѲž»ëayž;v¤ E. lU”´ºh,’¯l~Ö/×ÁŽÀLýű·x6U/©+­2n•‚ð„ò5 ¡@/ºÁëù-Šã;bRQPºeÉš}—Ž²%Œv †Ç£oŽ‹BX_l{€ž\·KB4B°#–ÜpÕœ–Ìß>ÿs„YN(=¦ìÞGn²(Œú ’Š5Lnyù…5_ØÐOŽ¼Êïü@Ü·|Óçð±· Ö¹cG,}?…k‡ØøjeëqæH N@ôPó”Hÿâ[*1@–„.T¦œ ˆG™žŠo¨ùá_±7±ºv9„<­7õÃ.èD_mæZSÍ;á,0„gdzyÉÔ;>"çÑÖnËŽe±þ™#í/¬÷,¡Ü±#¯œÞ{ÙÝïÐw/ßÀÖytGªäˆ±4Z‘ÙtB¬íxèÄ£^W·â±µ©‚Ë ±0‡4m?Úqž#Ø3ßófî ÁŽÀç’e”/aúßÞñ´T4!ØKoƹâWPR/Ÿ|—3¸CÌÂÃêꃜdGéÁU;`HH°õ¸ï+ÒY ÁŽ€þ† .ÇmK×CµñÔ6š1Ázn¸áè,Ýïï~_=³—Y^2uõÎ…CÝîÍŒK\PÈ_íû9[>VpQÇBݸ(£Ú±#X„ ǧ6ìÁ✸«4(D£‚~F#²5.¤±¢þ·"ÜÓë÷llh†NÌÚÖÓöÀés rÿÉý_Ç¿¿8ö&Û¨Pd;7ì½t”‡A ¦±#–›Öˆ¢‡UÅå„Ѓ3SM€™ ¡ Áõâ±7bn仩¦±¾´êÃÖã–‹_0”ivÄÒÖT÷ÐäË Š75¬ÆzžTUÜ sdbLÁ¶œ fliy]iA1½ˆBƒ%@9<ÈÔ‰.â‰-K×]躧‰B«©þ£plÖùGUXD•¥óe¾:+;‚r®¿Æ³ƒ]¤2µ»³ ÃÙ€èSMt –‰ Mˆñ‘)ÒÒ¬Â4*Lå÷ ßr@'1õæÄ¥Ävq5j?bZTŒ‰Ò‡Äâл¶Ðbº0ý7‡ýeL~ˆ–»ÔÑÉ Õ¼DJ9ïÔm¢Kç+;_Ï• êê<8÷µv†bB°#`4:1îÌ ¾zfÚž!cŒv šÂ¯F&ÇfÜÃCJ’¹¨!¦ž,˜ê(íÃ!’êæŒ8GLY¥“L{q©i{šá>:n«ìF‰¶œnèô S"…A"–÷rX¡Ø#pŸðîÑ<55-°#4Wø{µqmAJ!ÂŽÜ‘>ÛØËsm9˜‹T²¼Ùo Â⎹Œ8ÇlÏvÑÜT¶I3.¬±î„q®­ jŒo±±jrJo˜€zÉx’8θ‚CÿòÎx !ØKGgí,ƒL»7]éj&{¥ä`*ž”¼¶Æ×ù‰Œnlbœ…‚Ñb¾{‹Ê¶$ҫȪ ‘çpD)ßT8I¾€×Èø˜íë<ý]èÞbƒ)Í\[ã­WªËQ|m.èÂKO×ðø¨Ÿ#‘qa5ØãÚƒ`‘ÐCÇJøIÆ…5Ö\`G,ïµ5Æt¤Ü[l,­8%FJRQº@FÜ­yĎе5+[ Ñæ;bé« ²=G<Â1@Ýê ÚÙª¤ª°œö# Àgjè%‹J¦VZhØãÚËöHs8)q4f-0ìˆ%®­ñ?¤ÊÂ2c?†`G,ïµ51ÛÒ3 q“’uMQá„Œj$AŒ4VÖ“0!Äw FÆž•ÇmÖ°#ÞkkƒÈ!”%󃱼×ÖÄ·ØX:$Á»’ð€Hgü^A 0]W·Ò°÷rÇŽ×ÖH/xìd™@†ðÙ´AFÄ=w숥a4ÁÂD_k…ý(˱#=ÃWÄUY’ €6yQ¹cG,5ç½€%)/™”ÖXwÂŽ@Âë8o“½eÉZCƒDØ¢yÃŽ@—}tåd6§Ã¸°Æ ÅŽXZjõ XADÖÇ—O:”ÉÉ;2¦1&'—èKkv2ðÔÍOæíríò†ƒŒ k¬¹ÀŽXêñu=Psh6¾Ü;’l’p¨Kε5>-ZáC‡,4ìˆqm$¸ö5ï zâÚ…kn~uƒ 6yïMË;béLÝŒ‘2øÖXs±¼×ÖH²u~lÊDeÜPcqaŠ±¼7Ôd\Xc…bGÔ·â†î6]XCŸåµ5ñ-6Eo à‚A_X·‹.DãjüÄ·ØX:#B6ÓqGãzÃ8Œ°#Ds‚ií¹v0X|Ù°B¿´éaúCÞPcßbÔ;vÄr¯­ñnjç/ãÂ+;by¯­1šÒ·ØºzÒÏ£{¨ùnÃt ÇŽ ‘½—>–Z›& Ü»ü.F÷Â0ƒ:ðs„À|D °91ƒ¤UÕK9xFÞ:À¯ÑÇ›ykCsæ|/ǒǼo´[vÄ¥9ÁŽX¸30â‡Û*…ÅN+$!D¥IÀ<~jÃã¨}N°#6ﵞðp´‰ã308†cG&¦'_?û¡×æV¯®].#µH~Ü¡­óÐðÝj=Ã/|‡Sz0Á=ùêÖ'9<Sö䵿Yµiq3½Ü/)w숥¡`IX•‘ùÆš 숥/ƒ3ŽD`g B­;aG ŽyÍHû *ïÛúJ)Iáظ]?:ü¯ã¾„Góíψ–pì«ëR}bÝ}œ2&Ç?úM Çß»ûYÃS ÇŽ€þñ£—»½¯å}鮇ÙÇïêûéǯû"¥yEß½ç‹|öˆ-öî…8ôãÖïá?ÿþàËœDÒ—7=l˜¬áØK«EÎ[&i{ã:i™üýÁ_C9»ÝÆã þàåýòø[jŒÞzµ%ßÚñ4ñ­ó·ösÜѸáQŸe’;vÄÒöçiÅÀŽ`²áÁúÅÀŽÀ¬‚ø2¼˜p숥Ø*±œ;«ƒ_ Q–ömi{°#С{š¶°ms°÷hÇy?vÆ/‰N\oÑʸµµ+XMMSÙ gŒ:Éx2‡3½7e`GÊ Kš}Q8v³ ¯dÚÍQa‰Y]UÝÈlj}÷ؒثRÛ^íëT±Bv¤¾¬š!ç;owgnKpyÂ+l(«‘‡´t¦m`GÐé•c—i ̓‰Åâ•¥ÆÁW8v4ìdõ6±#©<ð(;‚.)û߇IÄâ2 v¢a^Ò/Ô%®£ÞÞŸœðFíÓÉ<Ž™R\ØÛŒ“_ĉV9üØ‘D<‘ðEùñ#èµeà?æ ÜÏè|$ˆ9ÍÞõà©æç+ëEØ?}æ±#Tn‹‹‘,ßÂrÛ±X]cT›VX” V€šòƒ’t5‹ùq!Ö,°#–Þi²c„AñsÔ7ed8&‚!Ó3ÓòZþíjÝ ;bééRj1Fºõʨ†^É”D1­óŒa¢Ûã““rŒ*{R*eËjbG@-¢ŽcrûÒuFk0Ž´ŸéHMTؾt½ß…™숥á#‡ÛNC²0©**ÛѸÁÏqN°#–>FÇ̳ˆ³þöÞû®ãÈì<ä@@‚ Áæ%’)Y²4¶œÇë™ñ|“öœÙÝsvÏ~û7ìÙoÏÙðí÷í„ñDÙ[’,YÁ ¦(‘"Åœ‚H䌷¿îº·^ݾ÷6 òmËÒÃ}ýº:TWUwýn•ñ†b-ŠÐeØòÎqmݲH>tcG”ƒG®Ÿé±} ÁÂctcG”Y ·.pšŒ9`,aQƒu”§û†ª:ìG‹"” $!ߢŽ% ñ-H¾¾ǃ‹×-+ˆhy?o¨¿ v„ÊTaG”qíËŠ0zZ¶Ù†8e¿é°D`@kÀß}M vDŸ6£ ˜YP1÷Á%ÂÝØeΪ‡®žº” ΗÁèv.ÙT#8û/aŠ#WaËY/µ]‡|ö ò ¾…ˆ^´Aqߥ#òØZ»–n²²« `G”ÉyðêIþ3_{ì65DYnìˆ2gÕ·Ï:tõÜ¥‘ÖãtbG¨Î'"…ÆøäÊÂæýTaG”1AOFåCÇS«vZªÿ3ûå»0½ (¬ëЦö›ï\øXžÑv.ÙmQÜù(o e{Wï²ÂPµõÞ{çüAyƒsè£Û­K-lØ}—0EôºceÔfJ°#Ê(—}—>áÄ1 øÐÒÍa£¦;¢LüN7£ E“HêÆŽ(sÛÀœã ÅóW<e“»±#ÊÜì½|ò=yˆ>·vOøRn\ìÕ‘‡/¬òsë± rPüå‰we,Tx~Ý#aŠãbG”Qgr£•–€+¬È0oÀtI¶¬zÁÓ«wYa¼”>,ßf…¡RF)–~eý£á{æq±#ÊœõÐSDv-ÙÓ]ÖÁ·¿9wà„¸É­gV?dQ„ýÕé߶ve¯¾¡g_±Ã#6ìÛçHŠ¨ÞÚjŠ°#4F¬#cGòÓù`Tˬ"ýrúÅÇŽT–”ïY¶5|™3.vD™u<~ëcGòÒéÍ V×ur„ŒÝ ͺçÄ‘äèõ³ú¸ç{• CÃ{öJûͦö[ ½ÈËÉ]3o™uÆD#gZ.û–¶®[^T c÷`üð3iÆ â"eŽ;¢Ì¬6u4únGŒ±¼¨¤~Öë:bäVç±Ì˜Œÿ><Þéé 7`½ ¹y˜RKŒŒÜîî ¡J ‡â‚Bhë’¶w¨f {CÐl"«ÿcúmçî>“#†(bgFøÆÅŽ(}Ÿ0¢ŒuH™7Ì#ýnìˆ2÷œ}Ãý~ç "Äx0-·£õž|ŽÒî×°—sÅ>S4£!ùVScÚM~ao”‘± ÐNöut¿Z¤‹ßQ>"ñ=‘këE”TZ€Üñ %’¨õìH¸|jìÈÔ¶Å]0 q.!%ª’m-B}Å4å®–ñ»æ ˆ“ãlyz¼Ötµ8œ¬ÆyžbÈI´JN\½ RäÖÕ2„ðÑ®—ˆ--)ÒTXJÅ*$ã4¨Ç1]š¢©’®™÷`@‘ÈAÑbŠÂÉΓ˜Ë á¬ÎÓ9Æ(o„ãZ“ wk£˜ÅU Zü¡£—ì„H¿>•;šœw€r³LøÝ°¹~3uJp! g–| Šý>ż< " ÁÚ`K¸)’Rˆ{] ê &*Äé I±¼¨4Î ¼ü¦âÞ:˜8Ez ä"ß ‚S!¡rçŒ7Æ‘ÁÂtƒ" hqk`û<׶mïí¤­í–Fwt¥ KâÕñÄL忳 CÈ1]±´•91áŸÔx'&² qbr¨c¾ˆ;³S¡[å¼ ¡»#º¬wÜDñ\ažû:qˆ®µÝW¦tLH縮LùNÛqÓ®LÒ–±L&'•Ê‹¿'TF˜§œÞý’¿x—ÞqëH+·ƒi„©”Ã¥ÈY5M)ßÑ ¼ÈöŸ½´n×êDýÂrjóg§3× l5¾?zLKùœ±#IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IùK‚IJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IùÝ- v$)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$åw·$Ø‘¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”ßÝ’`G’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR’’”¤$%)IIJR~wËçŒÉøÿJá±u²=tUI¥\Õ2ºqêL¨)ÓXJW‡œß”«ÿcºâ8­eƼ¦Æ«†Æð}N*'¾ójlL·–“ŠmÊt>Ûýœq(fÐŽ‹b&CýÏÑ-¹š3³š““Š›. GÿÇEwç E•›“Ûy…JºZ.šÊ‰#8ê/J:¾µQÝÔ(fËQgdl”?çÆÏ:Öð­£µ†š9NŠºÿºZ&7'Ç1hgdtÄP'Ž"µãuóàˆŽanÑ+wú rqý×íøÑTnü Ž˜^åÆÕ¡Ö0FTHÇ‘¦”>ç¦b[ÃꌌiŠéœ´£ÎhfÔï<ƘŽëØÐÈ0x ½ÊË­ƒÉ63–§Ç=]¨3:æ “T*®5ÌÏj:7¹‰Æü)¥R΋ëªáLBA:?®Žim}C—âzEuÅØÖG†°L˜.'Å1ô Õò5ÅØΣZÃ|æëyˆ^Ç!LüOWn¯‚âfÆòÓyŽýˆÖ°Ü¨€j±G†™ ±@q­ òç¸Ö Ï{ëˆ ù1ëHHŸÁ`é˜5BSƒf róu†Ç˜ísâ8gPÑ«†­áàUÔT†»‹ˆòrÒEù…Ž:¼;|h(ŠùnŠÃC¨PO±oh€?äåçF-¦}pxˆÿŒkÍì2owä¤r ó¢9¿o¨_y˜*Lĉ&´Ö;ÔÎ;ê  j¢ZI~‘£v´^íÌÏÉ+ÌsÕÉ.P:³mQ§w¨O“Ë+ˆ«C»Œ>cwåDVë×=&ÄÖp´ÖoöZQç@æÄ©ÈUì5Ô,/,q×á?Ë K#«añt¡)Gk]=ø€ÍèP|h­w°J ŠâêÀ¢Ï$q­uö÷ðgWkƒý=Cý…NŠ¦µî‘¡ÒübTsÔáϳŠÊ"ë@êŒx»äâv¦«g°";zõ•ÆH 4…P¡"¦WŸ’¢_ÅåŽéºÛ×…é¬V—;(‚Ÿ1Ø°nŠh LJâð ª9(¢†Ì‰´`t›Rq·AW䤈Ö: Qt>NŒ£N×`/}† à} X^PâªÓÛÉŸQ-ÎèèíèDu×aë«(^ü¶ Š³KfÅu ­uŠŽ:Ðר£ÇXX'p¨Ž XO±BÕQ‡ZƒÌŸUTGQ¥@Dєìjë½ +®:žb[Ï=þ ¢‘­¡WR|U—F·†^±ˆvèÓZ7*W—VºëŠ•‘ÕPgÈg‰’xŠwzîògÈœ¸1Þó)¢‚C4¡5È|Tp×—" (â(Њ¢rGa_‡ÅYèÒ½>ÝÿŠâ2‡…‰Ö (P¡¶¬*®lã»}Ýh°cŒ&°âˆGk gÆè¢H­AwT—ʼn¯!Ý«¬ÀœS6;²šQ žÀ„M×ÚíîvþŒ:‘†è)Byv{Fkö8Ý¡[ëíBßÐŽC¿@>ßíë„f¯,‰î•–®öÞÁ>›[^_§?W•ÌŠk b¼£· *ÛU§·sÈ?194r€bñ¬Hƒœ´?}¹ªñ Šƒ>ŲxŠÍ‚b]ÌT€\·¯Ñòsó¿¹ó´-„ª£*tôj™YURá8)´÷Þƒ&B…ºY5Ž:8Ð":î>oïÑJmv鬸Óµa:/ž"ÈA)ÀÎ SC°ÃÛ{³âkÞ¬Úè^Aeû³ZoÜêlåϳK*ãn0ÐÚÍÎV4R_§­ç.Ÿ& ‘ã(Þ¼—¥ˆaFä8˜°â¹8ýB­AÕB×WDϵFDÑNy¼-¥€! Û5¥•qÇ„;zŒÞ©DãZƒõr§§jJ«ÜQ íL˜b¬ƒI ¥V£Ç[§«ßc‰‚¼<ô-²ȵvw`µe•qu¨µÖnMÕ¶š¢1.¨œWçúÝþ 5{Fû;ð­£µsÆ’ƒ"Æxcìï®-›§ø¨ÿÙßÚµ»ÍD±¡²ÎAS ^ãœ.p $6luiìFS¾$t‹/h„Û]ZBÆÉg:AÓgÈ·8“ †ß;LÇö^6VS.­ES8q§*e”;Mp0Œ<®¢w^ó8Ž"¬YºúvlÆþᑱ1ré‹»èÃ#f•î¢7rÊœÜõ%­óÊ´_\CŸãnÈ1L°MN*å¸EÑÞoºÐó¸“/Égcœ7D;˜Æ²Þ¸1Jw•ÛAF®´tn¬ƒL ¢Û HM‘çÎÑ}Hy>æè1NÄ/Åhßž©“••)}7‘g ûyp8@ý‡¸·(Bl e²BB_sD _í:¢Ö2¦N¨c˜sÔ ²DÔ•Å<Ú<<$ÁIè|x˜Pcúl)dWQ~„v$·ÿ©h‡µî P,LD«Æ½ŽÇtõ÷“¬ÏxOçZ³JÞ,¹%¡Ú-Ûßö ° M™åÆyÛ㨾òî—³Šž‡)*º õ¹äÂ7¡ Ã}ãna€‘Ôח`œáËØÛí… Û ØÅuÌŒ¥µ1Tjí}¯7ÐcMW¤íx·¿kx${µös ‘{Âj¤1Î** ; ³4ñWBºÎ`ÖÝ‹9¯,*³8 t·¿{d4`»T—‡¥\wðŽ#ÎT¥ó?}®*©ˆ”æ4ž½¢<ÛkŸDט˜ÕY…¥Ö¬â[ºuå'˜¨ÈëcìGy}9¿bN˜"æ­#‡´LEq™u7N¾g®ù rK´‚KÍíÏjË]©gÕ^G6ø¤ [<ìÓÅöÞN1ÆŒžüÒŠüEó†…$Ç\UEQléjðð™ŠøËÐ+í7ùs]yuäY‚®A‰¿ ò æ•G«nuÞa$ &!Ì«cKW»qi{Ë .­+«Ÿs:ú:ùú²(]0/æþâæ½V>'TÏ ßÇa‹aµîð ö,øК.È®ÛÝí†â×CS‘wL×ïÞfŠ³£ê€â­ÎV^kC±°¾¢6D±¯¹³M L4éœ8{û Æ:òȶÁ1›ÿ\9gq¸Žò/qè3ÚYX5/²Ú™–ËÊ_¡…Uuáy¬2Æ8 ƈí3oV­%¾À3ò> FÎÜYÕ‘§èSÍùó¢Ùõ‘¯Þmf1®Œ« ®¼&,0¯´Ýèñ·mmYUøâjñƽ¨!~ž_P1'Ìù` º#PFÏ.­^î9Ê¥¶ë|Ò®-›=·<‚bSÇÍá b˜ÖÖFlF>¡)s]yswñÎ5nmnyuä5:*\¸sÿÜ4e¸ÄàÕŽ[£ j3 |irãÞíVq׃9_R½ |}Ü=Ø{¾õ*ÿ¹eÁê0Ee¤DsçúŒF–ÏYYíÜí&¾¢]Q»(|a ž¿ÒqÓ˜>K,™]oY&`økw[F…ÀÄ&š\#| î’ÞD¨³Æš…Ö^­Ëm׉"ÍDÜÒêùa{3Æœ «!˜—`é¡-0X˜óa™œn¾Ì>°x½Š*§š/±-ráÛ=MñÎuÈU^ë’üÂe5 E¨¼“·.ÊéÂ&Bµ0ETëô).¨œw»÷Áå#ôúvݼÆð=¬Yq6É@’,©žoU»ÚÑ,EÔñòÚ…‘"ú·—>ñÅxæ¡e["{¶GƒôºxCýòp,-"™  ¸¦n™%¾ —0órk£ÂšyËÒ6Þƒ7côz¶¨j$€Eu¤ lœ¿Ò²…@ëLËCÑkªº´rÕÜ%E´ƒÍ(O|5 WàÛ ­WÊk 2pý¼åE„§ƒc„\Z]·Ô¢ˆMm(Ž(¿¹Õs—Fš|oûÈû”Q[VGڴ؇®â?Ÿ\ù`¸ÎµŽæs­Mü'ú³bÎb‹",Þ“Í—Z…Ç’dmݲ°<ÁÖøøªGÕ¶…kÃ/Þ¹~©-+TA,]å[}ýôüyûµaËvã'×ÏÈ2Ô1Ö1ÜÔ¦è}ÆNlŒÚŒ(¿:õ[þüÌš‡Â ÎŽÝ»&BDC†Ÿ‡/ÌÀ“+°Ž0Þ<ûa‡¸ÉÁÉ Ùºbjê¸õÞ…Cò:tó‚UÐïa¢¯œ|ÖÕúòÚ=a#–ÿgöK4$ºôÔÊEhÿý—ÊËÉK6Z ßBàœv{Wï à q¤ýå‰wùÏ¿ØýÍpÏQ`$°e²µa 5²Úýíø3GXZ¶õÞ{íÔ>>ã ¬˜³h÷’Íá›´Ÿû !Q0càùíQ– ÊÿóþùóWÖ?yr„Aû³ãoÓçúYµ‘úåØsRaÎZºÙR1ƒ#C¯žz?ˆV©ƒY7Û7ïÝ~åÔû'ä³6Q¤ŠùéÑ7¹µ‹ÖíXds@ñå“ïYŸ[»Ç¢Ùûʉwj“1›š(Lª •éó‹Ö‡V06ÀÖuâóë £+>¼r ûˆë|cóÞ09¨3ìGþ )Ë E˜%D1ã·ö•õZa/½sþcyÅôÈòm‘Çíÿôö?ðçom~*|*„:{íô>O‡’KkžY³Û¢ˆ³´ž¤øØòíÖÖÆ·¿9wà„&å…¥/lx<¬Cqÿá¡×øÏÿøä÷Ã=Ç“Zýy|Åkkƒâë§÷]l»‘ò½Æµ¥U{Wí´¬XJ¯žú-_èÍpl´]¡†1bÉa‘ÒlŸ–°Œm7˜7î¶Û$+KÊ÷,Ûöœ¼uCeÈÕ”V=º|[xŒÊríf¹ÑÔʹ¦#•WN¾OÝÂÿ"m{h´£×ÏêãžïqYXU¶´•¶sÎvø5e¡w€8’Ÿl&[B·¡®ƒ4û˜¡hº¦Áv‘2f&Ÿú…ù Ïfµ©£yп:ÆK Š*ë¬Ë½îÞ[wÆ2cìT‚õyx¤‹/ªT_1'ü¶$ÒÞ»CYÀGª¸@ÍÃ·è˜ >t8pí·ÌQœƒ†$H.ûãU 8<6âCm¢ÝUô>ý©_ÏÉ)Î+²¦ktl¬o¸ßwWéöÌk~¶k•ßr¤’£ô«¡éÜg4û&Ð@"gÄó ëQæßqä³/§â}ßC£Œ_XiB.~~½ß4–Š{{?àÔŽ ¯@N(ùE8Aë%`«L=v$®ÁHÆ´aGˆùÂ?̉ •áÆŽÈ@²DE;"ßì—%Œk;‚-=ÇP»i¤Ë‘š V£’¯%…-qÜØ‘!! b*òrÒì)ÌGx„)s‰ÉskàC²ÛT0ia;‚ ïÈ(›¦Á|ò-yʤÓÁ—!ÁÇ|Z²@â[Âw\ìfžßƒ”C£+ÜØzQ•9‡»†e©‰gµx0Ø‘îÞ‹m׳Óì½µuKY£]ëh–/ÚrW4Te±'›/J`"—Æšb`BpΨiƒg ŠoݼFK‡º±#PÇÇo][_hdEíBËŒ™ì&êøÍóDQ  ¸²v1»0;z;¥´á‚ý¸aþ ëá”`G "HÚˆ’!ŠÒkr¦åR[”0Ö‡.å§;røúiáÍÊÎÙšºeìu€²;|ítøÄ›pKÃj&`†‹w®ËÑQA;kÅeè¡k§$>ƒk¯Eÿ2ŽÐa°)ÐÚ¶p-«Øø7Và yzðêIŸb îºyËùúª œ#(îX´Ž)bãûï8fdsгáÌ)ÁŽ@>”BvŒu+}‘“ãæã«4}5(gÁJ òá¸Ø‘·.Ž=¯Ð¶aMêÆŽ@(Ž*ƒkÙ½d“õ|J°#`B¬cøW„ÒðQÓ±­­—i¥×ÆÅŽ\i¿A·çV¶ÚÚõ·½wñpö`%¦vÛÂ5¬×Pap@¥0¯ð‘Æ­lÈ%$–ˆ ¤D+0mØqøDžÙùuŽ­«ù9fvÛÒRÉÅ1Ÿ6Ô¯h¬µYѹÙÙŠu ÷†Dxƒ»±#°Bß8³?̘ս«v²ÙÔ~óÀÕ“aŠõ³jv/ÝÌþæüÁ;QùöEë~ãbGÀrkó¤A)?$(¾vzŸŒ_ÂÕ±L–µpŸbG`÷¾qæC‰Ž¥ÉÈËÍ{´qƒwa`¿qv¿²*™óãS«v²yüñµSž¼Ö燵;rínË;b¹©ÊâYϯ{Äjê‹yëì‡M:B`¹)ììûÙÑ·Mð•€âÃÒ|u㌠‡ ýá•cÞw¢"4ãÞUöÖvcG Y^>ñÞK¥´ øëŸä]pûþ+GCÚXÁÞžZH$yÅcX[{:±#„õB6áï­̺L›NìÈ[g?Š<€.ì=úŒsÄ‹‡_ëo_PÁÒ¼°á –ù—Ûn¼zê}ú,í/¨¼ßßú%ë·nì_ÿzèÕÁÐta¢~ë³|~ºåÒ›g>”ñõMOZ¿ucG`rüóǯDR„<´ÎhãbGþéàËòZ’ËóëåŒ;=?þäð]nAnþŸîzoq0y÷üÇᦠŸ‰7vûÏÿ&{õEF÷G<Ï¡ïpÌ SÜÒ°ê±å;è3ùáá× ÇŽooù’Yd\ìô4þ¹`»=¾"Kñ¼Ü ÓчqÐÿ°@Ï­{„u(˜ c…ЇÙ%•ßËcãBë5Y>mš¿jÓOæC"½|âÝžÁ~þ–Hj“cåNë3ØÆ=/‹ïnÑo—‡/a¦;ÒÜÕvÍ(Ž”WÅC`T—…'nìNg—Û®úî”Ú»IÎ׉½|“Ã¥”9¼‡µ­;Š­úEÁ 7B4q* ¿U8Ó°#æ=ç^ëõ~ú7Œ^>Ã0Ö7ZY¸÷_̪ôFaY&4ý"2`ó´aG2*ÃmEÇL圴åãŸ*ìHÝ‹_EÕKà#²L1vÄÝZx…¦ ;‰öàÊV‹n숕’%œ,ÃÑ™#Ðí¨Æ‰$ÜØù-ašxaE†G):S$ŒÆÎSàÆŽ€¢±º¢zŸQ…ù^˜Îq“OéLõÌÀÐ`Æ:2ú¥".8onìÈÀÈÐH”KXDN¡±–@«o0_BûA·0Y´G°.– $¨ ÝØLWï`˜"•â|âÆŽôŠ dV×8F(v…LÙ=Úq:GÀp¢EæçQ ©H|IÆC‡4·;Ò?4À­é0èÀ¼M vÓe‘éʾ°]F£`UÊ8À,§£;‚ˆžÕ Ú±FáÆŽ@÷Ë(é"›•àPýÝqëˆ%˜e»§ ;žÁyi,,1Íßu&Kð*[ LhŽnìö…|¯WbG”¾^™M’SÚ‹VÁ^ã—rÐÔP¢E™Ð)Ö¬º±#÷ú»å¦–MaÏÎñÇxóÞmÚÚaIQU<ËÚ3 ;r§»¬%.Ø#Ö:N v‡ ¾à°f sEצ„WÚo1¢%Xücå¯qcGüo­Ð` #hÀ~´0ÁñÞP3 ;ÒÔqK&ÑÈ–Œö=Ԙ䭄XeyíBË€qcGε6 1»u³ª­%pcGÀ‘¨e˜ÐzAyJ°#×ﶰçÏ*` Š=0:6v¦åÒH K4Tε{òØÈ^Ì9#Z¬ÝÑX».…Û{;Éo.°¬VÍY,­¯éĎз–7‹ ´ ]›BÞFºK©¬©[F[ 2䦈/-KA:½¡Þ›·3·/ka%¿Âè7vßò­¥U —VÏ 8ɦ;&¼ÒË J×Î󫇯ŽÄ+ã´¶.;&.;tõTèàuLH›Öˉ["c¨c‰™ 2yìv½tBK­Z;­'ŠÇnž‹òÿé2§|6 aŒî£+ÇeTYmãü•daBYG^ÙgŒðàâ ôç‘ëgïeSZš‚$!_T0yq"g r€ô2XBȇ@ÝÂt_~rýL”õ¥ È‘ÀŲ.ávDǼu˜¿tì-_‰ƒRÞP¯«}]XÇà×Ùy}aã–;ÊùéÑ7{³-î^²É ±öÆŽ\h½Ši$€áÁØtwúÞÅÃ<«Þ® ŠO™‹Ü¿–E{+B5XLÜØ‘—Í·‘#Z;¯q§±…`üÿäÈ[C£C‘VÎsë¡6qL€ WȘ£Çw·=+N'väÇŸüº-J£¡lÓmliÃŽèo½Ùx^:ï;[¾DWL`›h;Áv^Øð}þÁ_d¯_‚ËôäÊ,åÆŽ@q„ æ^A;{qˆ“Ëßô³ÁáÚƒÉ>·nu~wcGÞ8³ÿTKòU™pz*ò‰;‚£Ù¯Ï| ¢ æóOv~>ƒ%ä©PjÛÍ VøG¼<ðrÜí›!tˆ;ò£O^—Imäe(ì¥]æÐÙßó×ü$’êþÙ®oÐf¡BÃÛ±¼°ô/vC>qcG@ñÿÝ÷ãŠzWEÛå˜ã ¿ÒüÊ9_ßèA…À„=}JÙØü-™Ž·:ï@"¥²ˆñI¥¾¹y/é˜gZ®Èo9EÆœ²j°´ìç´aG`lÀBã¤0;‚¯™»Ô’½“ÇŽà0 ]F˜vÿ[º«qcG¼Û3áIåY­,*'!†1âǯµKìþ¾2ucG°ÜƒÚsh„þNÈ8Ó°#86 ¶?φۭ̽ñ%™0v$e^§îYY­ý Þ|„“Lv„è„:F +iû”`G9tB¿åÊWU‚‰/Ÿ!v‹a5þyaGdБ”ÉÏ4„tYœêÀŽ )ùv)v²ÑÄ:f»±#ž!îÒ±zä«zÄfBaÑ[—'$•ƒŽa–|Œm†ÚO™ÎX)ÁÜØ‘A/ñ ùwsÒ9é!?k@Æ@:ˆ¢”\hÚHŽ±0O‹'2Ý0L¥…QþÐh6Ç žÁì~Õ7”M—P˜Wròz«8¿³‡ƒŸ‚Ð>„5~K?3á¡4ÅÞ¡>žU“ý'Wæ¸aMÅ>à©6ÁT †˜ѲåKs`GL¦º>ñm±5œò‚üj€bDPQ½"pæ )“ #!™Åu0F´/âH68:L¨‚ Eï(,•ÛÄ¡L.ÜB ÓÉ‘çüò`RðÉcG°aï Ç^±Ž=“+ÃHRÎæ~?»¼2 ÛHf „¨ ÞK:°# (¯A1"'fÀ›ãÆ~á nìH[ïÝÑQO°@èÿ]oõR‚^Œ]R¬(. B‚jJ+ƒ.ÀiÂŽÜëïâøÿèÀìâYzÞ°RŽ—µ¥«‘I¥&öŒqfdï¡Šó@Zv¤£¯‹ï. t·¯{Øß”ïÓ„¹Ãl¯£Ý¤ódöúª’YXS, ²Åa÷ú §!FæÍ ¤)q`G@Çf¦ˆoÁ2ó.ÎXY, O&L¨ÚÒÊ®Á^¶ç@k~01ʌŽ@Ì^3ÇT$:Q·x£Všø“ÇŽ˜ ÙËå¹å5X ˜ÃÁ <ÐÞÛÉŽ™tn.†&W ,!ã('vkáþ34",Y—«³dö|PĺhŸ«ÿŽÓQsgSÄB['ü…˜c’7&´ÐiR×Ó Á~µ !´oÝk½ëû8ñóš²Êë-¬ÑÀÖÅ–;™À—J½‹g׃mØeKÑ;$*×Ê“AÂñ-䛼¯ÁIY=yì(Ê;/ZYy_ƒ6!ÓÀ DsŠ.5TÍ5Œím%yìd‹Œ–¬)æå›HÞkMÝ2(Ö>àK˜®¦ö›l{à‰£xòØ‘k: M ·¿¼vá嶬Cñ„îÐ?¾z’“Ž ëgÕž9n@waPDO;r°é'ä‚Á »yŽ)BèAw@èé t_¸caŒ±¸PæÊó̦0¿vÞ2ÈsÞ¼„äŽúèÊ1¦ˆ‚L ±Oͯš³{Bïˆï|RzG¯hîj“XØoEz˜1öÒúyÇo]7/X…±ì¿|”G„åCͬ¤Êèylm0¹ôÿá‡Í]w8õŽ»–n¿O·\⇕Åe‹gÏ—Ó…vÖáP“ÇŽà+6LÞ¨Gý=•1væÚºeýCãu#“A¢ü0-7²uázÄvx3ƒà#:ãŒ7Fèz+ž¶;‚]Æ»6ϺyË —Fk'4.š'¹Ðz•uÚßÒ°æøÍsl g[¾]™LY€ ¡j?l:>âä:ÝÌBnÓ8ºÒ~çX¸mᚣ7ဂÕDp¨·Î`ŠKf×ã‡jÜÈÆù+ Ç@H«Ø¹d#èuaL>±âml V¬hs~ðêIIqWð|z°#0!Âcà+tõ°Æ[¬’æLÃŽ¼ñŸ§°‘kî¿r”϶Ø–ëÔKœö½q8²m7,ÁH8á%ƒ`gl¥;ròÖÎb(nþ¨é8rãqó¢ö/¿ËŠä`4úPÝÙ‹ÖKóýˆÝûÒÑ·yñUiA‘µ‹!aöðCŠG‚'}[vï Ç¿}f?¿sŒo¨_ñîùƒ|…v †dÇØ^ÞÑhùÑåÛŒ`ï4ƒÐO¬éýcG~tøõÿ]-Ûk°è<«Ðõø§c&È@ 7uÜò¡$z´ßÞò%Øð‡¯Ÿf †ÄÞ•¾wáǯ‚Ü°´ƒ;B~\þßžom’ÇŠïlÅ’w.|lê WÈv¬ã;ç?æëP¤2ÿÑÏùüš%!Òà7ÓqÚ°#P,Cpø'à ŸLÁ„ßÛþœ¼O›6ìÖš-‹«ço¬_ñªÉ8C¤¡h 1`6üÃ_ðOZº†ºDm¾°áñúŠ9`uVd8jA½1«³ðäûüž$íÀŽ€"Ö‘ÿ¢–ÇjìY(HZ-E3^û{Wí²ò*/,±¶‰;r§§r’mðäÆi%ù~UÞ6»±#»ÿ§lkA‘-¨˜ &ä {Øh0]þíÈü“ç×=z±íš¶ÍôãOw½Š¯ŸÞDZÜjJ«ž^½ Š³¶Í¯œó­Í}äÀŽ€â>y]|û4lchL5ÖôÏwÿ~íÔ>ÖhP+0! |³*s,„±üÕ¾㨖0éç”Výêô>nü™Õ»e„E7vF «è0´6T Ov1Œ[üù×üdpd˜° ;oÀä¼qv?ã?¾¶ñ ,˜œIqæ}fõC°{›¼[ÁTA^Þ? Y‚ÀjT ²Ëñ$¡ç¿O5Ö6€É!*rôM¯}¥6Ì_A÷áåc =°”é´aGpš0·ÚÅÛ~ͼÆóææ„|.x²+ÈpòØzõ…¦¢0×X»èrû~}¯¢Ÿ•”XrØ<¿Là~ó5òØ)úrÏŸUzÍ Òï^ùðçüʹÍÿ1DµÂW¦ìN…z­}¸K]yuöwôSíÜTŽ•^|FaG´ƒ kç &í Kåô‰—0·8ƒPÿÐ Í`ŽÉ¨Àoé੤ H;‡ø ÆÜœè,*ÅDa±WMvÄ :BW»£2ÿÏMåXn÷ÉcG¤›>'œ~|Ó4*½Íïj™JìÈø‹\ÌiÃŽŒŽr'@…øFÂGB Ab±#-•£sPyÑ)$i øp`GÐaÿÎKÿ‹$‘Laƒ®Ê¬(n숄©æiÐI¶â°H´\˜Î7(Šl$dò dQèžå¶ÃŽèL4EãkL{/vÆdø ]è‰ÒÈ!¦H“áÁ1ßžÎÕ‘”о—ø¡dvÄ (²0rPA 2E4ŽúEAO Ç|bpc²%yEY˜g>¨`º‚vÄÜú€‰t(RÞ®Pfü§;Ò/@!xNáOÄ«ŠÚ‰‚AÉ'˜ÀÃVÖv¬No6N€~‚>`rxŒ˜^è*üŠ×‘ž(só«üÝ[ZP$Uˆ;‚ ”ï Ð}+êsû`3iyL;‚ee¨ FGž`LSDAQ>ÁfÁÉ"<ß1ÉŽÑ1ƒ~¦H—k˜.HeL}˺ŠÃŽ`õùÜ_! :ÉM{–¿_ªK*zš†¬2ÉV5EnvÚ°#-]D#c^ÁGÀzVýÕͪfÿŸ2¡A°³Àÿ=¾[¬+Ã>»±#ÒOŒ%#Š2lÐþáI‘LÉŽÞN^°yY&à ­£ôßã‰ämvë%g‰bÉ0LlÆüˆb8?à tÄà°*5ڌŽ`øÆ£Ÿ1-Ѭz·*æØA§ý+{evد[çÉŽÑz‹ÔÁ¸øæz“\ÔÒ¸õ…€u`G [ä mäí3îj¯>¤¥CL;‚ ¿åÇ´€ì][×HõYÀÎÑõ«Ï·6õyÂr3ÑzZÜŽá4.À“ÇŽœ š²*ÈIp5½UCemݲÑ̨|²jîb4L`³™¹$½‰Ó†È"™1lLžéO®Ÿõ! °Dô'×ÏŒ „ÁœòÙ`B¹›¶-\ !#giË‚UÐ/—³ “ ¶gcÍ w®zâ(£ï%ÉWw@¼¬ŒyâÎK\n»Î»ckÃØiçZ›XÜ$§M;ÒÜuGúÕÈk{R×÷ _Ø&Ëj°§¸z›P¾MþsòØ‘·.°) Û`Iõ|(¸C"ÅÀ¦ù«rssé ÍØzÝBÙU :ñÄ$­u™>Iì6Ž„Úl^° |Þ¤ë{sˆ?ÁÛÞ“ŒÿÄk\9Î:ziÍ,ÄGâ ]ÕA“­Gë‰\Ñ8 ?±±[ÄÖ#§Åo/惖 ëÎO2æªOÀZtòð²-ØÖ0á™–KÞÖÎè¸âëë—A!å›K:2WˆIø Tá1:±™“ÇŽ¼y6™|Cý °+¤ )‘Œ9ø<¶|;žð­7˜o¯yUôã«'y£Í›U+½ÂìȈŽ¢Áã Ör«ÏÂŽÑ9ØDÞJ½¶PÁ&½ï]8Ä2a×’Mò„8yìȾKŸ°…zÅáÏ}¾k'c<@Š6Ž¿sðç©ótr•ž¡Kr7¹±#oŸ;Ø?ìéÄåt²õ³I ”zlùŒz¿xòøòæXÄËmžE ãjç’ æ‰CA—ö4ê7Ý_?½_€ª‚èxÍ[>PX/lx\>)-(úöjä¥coÑ»4cÁzñðk|¡'Í’Ew}[>²WLì4ÂIŸÑ¥¯™ø˜^¾Õ„‚ù÷Þ}oºsÉF<ºY ?¾ÿÀWÚtî›ìl˜îÐÄnž1¡2mب*¾uÁQ…8á¿pýŒúÒšÝ2ŸÎô`GG†þ惟òŸ0! C!êIeŒâÏw}]‚BÌR,ÁçØcP"òɪ9K j  Áâ…Ëc‘;b@!ž-HçѺüË¡_±D}èÐ9ôª~b–ûÚÇ™¿û0 :ùî¶g¥>r`G>ºr D‰I`öü‡_À‡þøÖ_¨Ï±•;bB¾·ýË5¥U¨Ï¶êsóS„¼ÑÐÉïmþ†@'¦,ߊmõŸß{1 :Y¾ OÐþ?ù5·ÿ—{¾#=¾ìÈk†âé8<'ÐÉzëlÑ}I>–ýooý€£æ:(þð0NtÝÿù‰ïÃ$ø¹0ãÿá‘ï¢Ðìl~7ˆ ·ãÆŽü¯oþbk_h½ú’ß~*•úO| úõ3ûü©ÿé±?À1ÏÄB¨CÑhˆ É-f&«ØߘڣòüºG«K*~`°PTmïªa“ë˜L—>!hXœsºùÒÁk'=JnÞ·MÒ¥7Ï|x»§~ «O¾\1mØ‘.5—áz*ªêÐBÿð l{ ²}Ñz){'"3¸ ⥢¶¾b¸ôœ6€½ˆ!ëæ-—îväfç¾2@:ÚÀ"ï$ƒÚ‚€uÍøX,ÐMtáÉ!CðCyeêÀŽPôkšœ²ëŒ¦Ö×#^[:™Q©¸NœQØí êçèà,_c†•…ú°0½')ýZ;µ@@ú¥~GÚ¼•Í>ELΰ0ø½[A³’ÖUóô`G¬ tdÓmš0*ÊÄw¤'ÉÑ 9qH‘H C>’`G²ez±#AôÈô`G°ðcccÜ 4YØ åäÀŽÈ„5œ¡fDDø°ÒÖ8°#^ÂCˆ3Ôè‡þ¦²ÒÖ8°#VÂ2,ðp(ø÷S¹g8C ~8*"R :°#~Âå¿YUè?4¸T3âb…£ ótÇ$v„rHê'Í’ ta¥­q`Gð• ¯›¢`ÊÄüàY…ô„ •Š"?CM@QçŒi|L6rCY¾é“Øe°ÏüÙ‘ 2(C &AvÃJ[ãÀŽÈ„5~†©] M@ùþ=a-ìHi~1øsÀ÷Žc-èÒv »‡)mM·Æ‚øûjÐCŽÔR”—/èìˆLX“ö3Ôô‰‡y¹¹RyO;Ò7ÔÏ-G#âë~ŠN!áø9¹6Åà æPÄ‘ kÐ8©‰±"ìÙ",v)…0æÊ°‡÷¶Îù|ðF t‹-‚Od³Ó†a¯jÆxmÑ l«æ®;<¢êÒ ´ óªÒysØí¯;Ä]8–;°#VÂœÐ@ÑÂŽÀžƒb¦â 5҂ĪaVñ+~Úd¨Ñ¼g²Øxsb¥­q`Gd“¡f¶ÿ°[<¬æ„5¦/¶žÄŽX÷fv„LvešÀ®'NØó0»Ž“ÇŽ`ºdãþ†xˆ]‰HÏ1B´‹/¸•¶Æ_i@ÃÁI›Q†˜ÚÒ*/‚´€<¨¤d«T¬Œ3 ;bÖxIyt†šR Á}] Ló<„â»ÜvƒÕ%N§§G:°—VÏ—œæÀŽÈ„5˜=:qIìžÈc˜;"Öp†šæÎ;Œ´ÒÖL;"Ö€%¨…¦ö›ìt§‡À€f "Žn¸äØ‹g×K§ûä±#G„w¼±v!ç? >„x—‘{ÈsŒ ”¼Íâj{Ú°#üU†2Ô˜v=M‘ÁÖƒî!°#ÐXWrÚŠ9‹ñ™°†®eE› ôÚ†ú•^ÂC²Þ\—(ã­aãÁˆ8°#æ«Û|/Ijd+mÍä±#2a l$rÂAì7“‹"£®·ì@Ó‰Ñl Š¹Ô‚t¾‚ %²jòØ‘}—²~نʹôþý>á:B÷‘KŒfŒœÜ0*$²ÊÊû0I숕°†œ©˜@fϲ­:aM¿÷Ôë†ù:ºþ1ñ&=¥­‘.´óW &”¸ãÆù+±U/Š­J.4H [ìŒQ&¬P%ï6²xXOØoð~†´0€ÈÑ>T©÷)ìÄ•öÞÃŒ¶äw.Ù(Öp†ð <¬)«’#Pį_ϦHß±h‘¨L;b}µµa Q¤‡Ì'°..ù˜ƒÊ¢2‚@™20ÔJ[ãÀŽÈ¯@á©U»ü‡ÙY¥‡\Øÿ+ÝÓe5 ”%áõÓûXcZik&‘_q†~˜1¾á±“ÕÞë9Áê÷ìÙµÒûèÂŽÇ¡÷%g¨‘/”ã!äÕI€òœ ÙÎJ–öÓ«wÉ„5àÀ5uîC‰´aG¸)ÊPéôžØ}VÚšéÁŽè¯|ü%Dߣf£Yl¬´53 ;"Ö(ó24Vå¬~}Ó“²5vDºÐ àH ɇVÚväƒKGXk³cæóóØôœjÄ$»—l¢Ãã 3øèÍsT ˆ¬}È2äð¼¶l¶L[3mØh(A£æ2’3ožý±#ëëWH3lòØÊJS-Lnsò°#Öu;’½:K¥pæ¢{’+m7{ îá¨Íe^Nó\­ «êŠó‹Fõ•éUÆŽ,¨\™:°#tGMsƒÃ8=[ü×2Sâj§bæ`Gú‡µ/ŒZHçäÒ$c8쮢´5^ÂÓ¡Ât>ù|%vÝCÍ>Ý”WLÄýœÑ±QÏeòJ—úô`Gdð 97%vMK7úç‚Éf±I°#QeZ±#͸þt`GÌWvD§†Rq`G$D#‹‰”pS3;’Ÿ›Ñ`/êL;2ˆL-v$ QF¼rÀ¢(ìHM ÄŽä™`$üç±#QAìJ&‚A;:צ_èb=—I¬'ˆ±BŒ0L$ (á?'‰¡èüÂŽ€K;E ;ŠJbG”¹ÙÐ;B€’)ÇŽ¤sr¤Ó}òØ‘NP„±#½A@‰…10=F‰ÁYyâ°#>LÄkœl?ɧÎx_±#C#Ã"¥ËD°#üÊô`G ø+ÆŽ(DnýTØópŽl6;b}EØL!aaG(‹ ZʸÖdÐlÆŽÜî‘©ÃŽ`÷aŒÒËn‹F2“±#ü•ÄŽ"ÓŽÁC°Ç¸Ø,‡,ÄŽà9}%±#Åy…xxýžá7QÆeÂíÌdìˆï² `G  ¤Ÿ±#ÅEWÛo¹±#ôÿt`GNŠ¯;¢— 2Aìˆ 1Â0‘H@ •ÉcGdˆÆŽè 5~î0vdYÍ:]KìÚ FÞþ̱#Ø0ZšØŽ`"ÐrwÌLìdÝܲÙrãvDyw^±°#: ˆÙ8;¢ÌÕçáë§Gý@€ŒÁ6a îbG`pnkÈÞGO;‚ébß3cGtÞ_vDÂD"±#üÊÔbGø+‰«@›éÜ\º8–ØhÆ㾟LM5vD~¥|숗¡Æ/vd¡'±#йKkÞ ÂŽ(ãWÞëë’Ð0vD™7°ÇÅŽT—V.¨˜ÃE;¢L:nßÂŽPÄŽ <¶bÇ{ñÁ±# í[aZÂ؈i L-v3“6y %vdkÚ[­·|9ÃØ‘Kw®3hj±#¨/§M;²iÁ*ÒP;bD¦;Bm}ÀŽh€ˆ^M;kÄðÛ8Ø´pNè ÂŽ`³Ÿ’€’u{$vdyí" ˆ-±#h­Œ‘¾ÀÏ;»¤’Ø¥" Š3;B1,숙 v„a"‘€*ìH&‚¯ž` 3Œ” +QbG‡¤Ï v!‡µ˜8vÄ$jÉNxv¶Ÿ„>värÛM“¶æ ˆ10‘U;¢ô+øÏý“(ÂØ™¡&ŒyaÃã”äQbGö"ìˆüŠ±#/Ÿxöw ;¢¿2Z[bG`–¿*4……i¬m€Ù£‚Ø‘ºræ3ÂŽÀl WùåC´ƒç/{ª$‹Áµï߸ ;‚ƒÆĎ( ùÿdÚ°#ÿE|ÅØ‘Ÿÿg®Ì ìÈ_îùŽ|H3†Ýwàêqy´!ìL P"±#°ÏiãH숈¬ã?Ø‘0LÞ»x˜wS;òµMOÒ™KbGB‘ aG&"±# (¡âÀŽ„a"ÊdÎ’½,ìL# j"±#ó+kw.Þ(CŒ0L$ (á?'‰i¨œëÃDt!ìÈàÈ¿ŽØ‘ù•s¿c¢IìÊ|BD&…ùŽ¦ØâÆŽà(ôÝ­ÏZØ‘_x-;ò§»¾¦Œ$”ØÈê£7εt·YØÖ€3;ÂY8%vdñìùòRk°#‹f×KK{‚Ø‘9þeÄŽPÂksõÀŽ(cZØ‘²ÂR™2øþÂŽä¤r°Yÿ ÀŽô ŒŽÆaGhQ,ìH¡ïo¥2=Øé1gìˆvNgÆ>#ìÈXœ`G&_ìHà!•;ƒý,°#2‘ÍgŠ¡d4jJ±#£2Ó±#x˜…QÁÔ63;Þ–ÍŸ vĤ§Ñ[ï~ÄŽpzšû;‚é"{ëw ;IŠ v$\&ˆì¢cÉ¿;>‘S—`G”ßû bG(ÄH‚¹¿°#Ìó>ÅŽ 2N!v„/F§;¢ÌU&ž±±ÄŽ´êD6ÞâÎظ#ÿ¾œ5;]ŽKìX æQ¼?±#—Ûn˜ƒÊ§ÀŽL2î:ÃöcGtJTNd3aìHdzšÏ;NO£¢ÙH짧‘.4NdCezrÖ@‡ÓÓ´÷v†ÙP™9ØHl@ÉT„–Þ ;‚±Ö8“$v晳æ3ÂŽ|¦9kÊ K×ÎHìømŽÙÅ;‚͈-ÎYó™bG°p2= 9S!7$;YØJO£‚ؘ4kæ- ç¬QŸYÜ‘ù•s¡ÁÐÀØX2½…ÑéiÌUµÄŽÀÈy¸qkdΚ™†Ù½t3T¹…ypÑúÖžŽpΚÏ;òøòiq$Ÿ vdŸžFbGVÍ]"“wLv«€Ãþ1-Ø‘–îöØÕO‰QËY‰‘9kÔÄ°#`Ë%³çg™Ê‡‰ÀB'²á?gvò2Fùï3ìæDÞDM;²±~~ÜC*Ÿ;âÎY‰Ù½dÓÐèˆöz±#PЬ›&ŽQËY‰ù笉Ď˜D6{^éi;ò²HdÆŽàWÎväËëöHÜާŎü欹১™8v'AÒŸ/vdyíB<üWÏ—/ì4 /E'Š)÷ÙP™†¸#ÄõÁ¿ [Ø‘ÿï×ÌÅõ§ÀŽ`­O7_:}ûò ÇŽ`—‘É!±#ày){glΚš’ ê§ÄŽà¼ Íu®õÊ´aG¾9kºz™ÁØ,c,ÂØ‘’‚"4kç¬É+”îÏ1gÍ(¹Ñ“¸#÷IùâcG1%…Ië»°#Q0‰ÛÀ9v$3Æ!²1¨¼´>œŒŽJ°E:7[ßA—ØI¬Œ7¿µ°#/輟,&ƒA‘¸ŠeŠèž¼#pbG2¾—4c/@ƒuƒ$@Q~a8ĈÒr0 (Á!z +ͬf¨ó¶« ïaãØ ÇŒ:;BÁH ÌX"P”Œ¨o¨Ÿù¤$¿]ê“éi v£fo:F$숲`"y…iF#>œãÀŽàW<«y=»tþ3oŒÐ£T ĈÁŽ€¢ÍÌ*,E;rÔ¤e1óƒBQA{L„§‹Tþ3þt;ùƒÅŽ`íxe1ÞŠb­Â{û™b~nZ%“ÇŽô ˜†Cþõ{" ¶(b8<ÆHìˆ F’å4vÄ1âõ™fÕF¢íËÜðìÙ",va‹`£õhäG?39ÌVLxŸh!Œá`$T¦;¢ÌYÝ›>Ø[ų ó °ÐÚ¹ë6:¦¥½·“ÆŽ€µªÅ¥;¢Œ‹Ž?võÙsLíCàtŠtܺ××ÕíÏ #Á¯ð[êiYA1­‹ôß”.pvÃáË2Ho¢ˆyãUK`o‹#làJŸSmi•äí…A ,;`$F$oö'ië¹ËR.;‚úàíKm7X6Ö”VT•ƒåšÄœ4TÕIñåÀŽ´tµûâ(±Fëxµã¯*cŒçZ›”ò„#ø ["H¿ÁqNRœQØ /1tIŠê94?À,å¹ÛWÜØé PNìø3bÄÇŽÈËwÌ¡ä4vDÂDÀçä„Ã1zYÎÉä±#á#*Œs>Á„C–ÒŒqˆ‰á`$T&9~ó›=ؘ(t@†x!/N8ÄHsç¾M†±D` *Ó†Áðikg `ŽÖñØÍó¾>ÒØp…ôìv¶ŠÜMëë—ãÉe±ÙévIbGL0’%;uCNôC×N3jÛD®‚;–¸êc8= X‚ÕÖgŠÉOço1ëxV'²¹G#‚ØÄü`Oue± Ø‘5uË$òcòØ‘¯žbØP9’V±#¨¯ŒWLùâhÛµ0É°:œfÝ´r™$v¬%FäLmÒõ=ñ…ìX´Œ¤·¶!&Ü`¼P;BÁH$vdåœE`lL }ØÚ°¶%{•TvícÿbÚzY3ÈÑy~áÎUz“æ±Y”ƒ;òú™ý#þùbCý 0 d‹0a[¡bV#°#8ÐíiÜ‚%cë]dƒ Ñ Q_a%á#8JHñõÄŠ¤í4=ØXeŸ\Ë"«¾bBŒ¿yL +¡o3 ;‚c£ß<¼LcA`´ï¿œ]µ¯ozR¶æÀŽ€ßX6rˆ‘È`$Tؘ‹œØ(;ë¢ï•“ïó ~[,÷’çÕmÔüüÎ…ƒ|ä|aãã8ÈCµ±EZœ_ôܺ=LÚùéÑ7ùê: réuŒäéU»PA Ì0v²W îGìØ[2É÷¶ë>¾v꬯t  dç"ÄÈʹKÈúGŒd×’ ‚þ˽+wÂB¶°#°ãyÙ1vÄ„á &بBiÉ|Q±#Ú9jôú¶?cõŠãxžuhÁy‰º‡ çÛ¤=˶Â*èì“îal+yRv`G°ëYþ×ͪ!¥€mÅ·@(ù«~bþÒ7µXbX>8V¼,T¶ 4Ô¯“ü¹ñ^KìÈZÖZÛøk ò þòáo+°Š5¨ƒús›&±°#þÆÔ¾;í0 ÜIÕ决Þ[ç0väû|¢ûèÍsT§ƒçŒÜxó̇·{Úé· (YbÚ°#°„Fi*–V/XZ³¦þ;>fìÈæ pòØèqÁB·O÷þ;9vÖ´´Øð’wÀL¥Jý·.Þ¹nF¤Ãî€1sºåûæ±;pø¢ OÆŽ,™=_z'Øz‰‘æôÂQß½=’¥ŸTÏ’î¹…Á´`à)C‘"ž°òÅ$è»ÖÁ~ï„.°#tÉÉÍæääèyð[¦—äñ«A‘×°jú°#c|!ÏØݦA³’ôä±#™ !ÁŽL¾L%vD#ŒIg~Ú°#`Ô1Ÿ ¢ºèØı#cð€±OrseØt`XJBAJ®…½ŠÃŽ(ƒ™`ÏÕ “4d͘€¹äxÄ„:$¢hà‰ì¡;¢ €—@'hŠ(â_è9DfFFéÀÌ%$O=ãÐ+C(ãÊË÷Ÿè’2 À"‡Âëbþ,Ê/À<÷‹ ,$@Mx’ìÐPmýøaiAæSBL4è$7²•9 ¤¥ÖÁN*Î/‚’ ZZ¨ïÀŽ`JÙ} ž)É/Í3é”`þe$tµ8¯óÀˆ²¦a,]ý=1S„âLÈ»£Ø€B@Q(•TYA1V–c (}ñ]*÷¯;‚Y²††åÈ‚( EÎêä±#˜„{"çæ›ô^7SÄtæå÷ˆð$bRTÖ7< Uéìâ ) ØLò½¾,p§¢¸ ““‚Rsa*mv¥µ§ƒ'áW¥…%}]#>@ Of• Œ ñÑɪâY Å—ÑÊø/å6™6ìúÀyL°|Õ%•0jõ¬úÒunùl v4*ƒH¡;=÷F}‚)×ÝÁW,s090±½CÞ`) XBR¬*™ñØÚÝÁK®èìÅoév( As‘ƒ­•ÓE>+ÏôL£> 2ge$39Õ˜½6Aƒ•gvÛ‡f•omÀö·:[ÇDH éžZTX3o8ä¢`¡í‹ÖIý2yì¸E†üYWßx­£™¥ õ€¹ŒûèÊ1b‡í ñˆá°Q„'ËÅÛêjÒØe3lcù°"ؼã@,¡¡ þmÃüжRŽm0QF0K¬£K ŠÁ'˜RvG¦ó1FТ1ÒC4^]Z &á`‡XÐF#Îø1 @qÓ‚•¨ ! Û® 1Ñ¢ƒUëë—_h½Êx/Š2I(Ýö«æ.†IsüÖyO}gt@‘ÅÕóÁ¼£AqsÃêžÞÓ‚â®%Ñ`brªå’ÜãÒ &Qf‰ÙÒ€-ùpôæ9§ê€" kºz?l:îʬ· cüøêIžg<±BÅaGPÞ¿xØ?hhÚª9‹^;É!ñ°}6Í8ùØ,zm!—¶/\–`ŸY³ÊÑÇ“e@ñÏwöØ_à…üÁÏŸY½»¶lö‹‡_ãQCóÊæÀŽ üýG?çSáÚyO¬ØñêÉ÷ÙNh¨ªûΖ/¡Â?ü¥ç¯M¥0µe•X !£ÇS©ÌOÂ9‘Ó­¼¨ô«ë»ÙÙêZ_Øwë³ØhÜ`ª-Ÿ³’"®C»ùuµ…Uu0V!yò]Ïmcé&h´7¡ÑÌ!ϱ²òânÚ°#PúF8è©ÀXpðÁ±ôVçòGäåäîi ž*„^ƒ»õé‚#sÃìy­Ýíè$ÕÊK§ñCIÑ|Ó÷P9uåÕP‚ZÄy5`Q3 ;2–ƒ]Ê-K®g¨ŸÝUôføÀð·õ42#Uœ_4:6F§Wúe‰~=Õ+~˜ÎMCÐõ f!9¹…B>«éÂŽà9ŸÐ9Ù‹ÄÛxfÕr‚n÷ÉbG‚P„0v$"Ô…Ù‰8¢ìˆ,Ÿ!v$‚Ø焱¢ŒXÅJX£œØŒ2b4”‚¡ÄaGÌ·£ü.¯U8 7v‚ƒ½õ\² ‰DyQF2*Š$G"áâÆŽ˜(##ÜTJ4 p4o2ʈU HâûðŽì7rÇjtH® [‰ÃŽ(-þÇ2Y܉lŠ#‘P”Ñ+¯šoJæç› e„ºdìÖH:Ë q`G¬(#VS˜kAØe´£îɈLK$Š2ʈ…ªƒº¢YE¯Ø@·ªQf5zÒ9Ð#Ÿó猱¼-ô¢;¢ŒÇ—-ÎL°5‰¤¨Tî¸ÉcG”‰.·­œ1ìJºóEÚû:#ǨD$.ìˆÊFÉRô[Ë@óU—.øÜØýí`–s”hJ™«@’*2ʈÕy+ašFìš¾eƘúi±5G¦­ñ«‘÷:5§¼Fn47vÄú6G¥F…ÄÃ<Ð:bºdV¬Áø\gpØbÍwFÅs)<ÑŽD('vDyQF,Š~ø%ƒh!Š°ªé¹Ñw9RxÂ"¯RœQØþ–ÙÿtNzaUÀõ8yìˆ ¦­I§‹Ö(#CDì–LŽ TòæÍQf2‡}ÅǤ!û‘Ht”‘{-,à­u4q;rlFaG`Kà`Æ:4ÐùŒ¾.§•²¢Œ$—ÿ´Ö('vÏ·6ñÏuS[Q\fíqvD™œ;rkCéskÐ Ö¼M;¢‚QF,Š®äõp>Ó|9UG‰H$\&è–sž¤9@áCe”‘pÇÖÖ- ‚§ ;‚rüÖyŽÔ7:š=m–Ó:ZQFt5q(]<»žV]n¿Á€«Æ»±~=9ªa4£lùËó-ÚYÄ{9°#*e$DQß¼H‹nòØe&“ÜÏÙóÙ¹ù#:,"©XÅJX£¦;202t(› D¥½Yõö¤H$·L”‘Œ]Í+‰DRœÒ¸S›É ¹ZÆ|þîÖgåµÕ´aGG†ÿéã—¹ÃVçqØâ“MMv6¡5²cä¢6e”«Ži´ã÷”¹µ{ñð¯ø9¶¶£•°F9±#*eD™[åAAñM6"˜ÿÑÏY7Qfo ¢œØ¥åä+­¾†•äT(arbGT0ʈi-_¾4û';_ ‹ë¿ÝÿSñS>G«ÅˆæWΡ´,V”«©§WïZ#â€*'vå¯?øI—ˆßL!Ø ýª‰‘&¢Œ„)f ÄÖš×Z^;õ[”dBÕðù/vCúÜØ‘ ­W_¹“¬1~gë3 f¯Þ‡3¯Á@ G‡&òÝ­ÏÐpàÃ> Œ:<2ì{R+ç,"Ô)áÕ8œC¾QC¾K2õÌOžsÌ*ª‡jÚ¦5•Jó‹)¤—iÃŽà4a z£‚¥MGxêþ’Ùó­WÑ&Á¬B—1Œ&×Pä X˨p`GPζ\òg›î—R¾÷³J݃Y…ó8ßòçæäÒ­#;«zVÐõãÀŽ ÀÍŒÒ÷9©œŒn*åGÚ(”¡ïÔ ÃŽÐT ]rücÊ&ÿŽ÷Ž·!fü‰~}ñZ;¬\¹³Èí˜òA4V>5]ØÌà!ºçýßrwN;¢‚ik‚l”®ª‰=ø-SŒQñð‘T²3mØeœA‘ß«`^%*nìˆzD+èˆ;‚.ÉSz )'Ð17vDCøí{•y{û¡G"HZAGÔxØeî…3Q œÜT. V+ôˆ,M<ù&ÐHö¶ˆ űfÕ1ø»U(èw~$"ã{„@è‘àœ¨µqcGT0ôˆ,á #j<ìTT¿ %»º¼•dèY(e}Ö¡GDØY 5ìÃSÉ2ôˆ,™PÐ5vD#+ý·š,ª¥EaÓä±#VèI—‚ŽÐç^‘ÝFH€Ùų,9àÆŽX¡G$åŠârKݺ±#ÊÜ6²Ì3–¡ #Å‘ahD+舚FìˆÒñá»0«6{e¼ #ôäÒí®¶1› õŸVÐ5vDC(±{) =KDQÔäØû…u‘ùt¸W*tD‡±BȦ`‰ò~äÐ#VÏ°ÅæWÔZm¦aG(ôˆ4¸`º,û~J°#øŠgÕš1 :BŸEè‘€’Ä1l±¹ê•ÅÁÆ1§ˆU+Srbi¤ ç:¢fvD&äØ’ñ‚ŽÐ_Mí·$JƒK8èˆrbGT0ôˆRÙÙ……°´f%0ÝØÈÞs·›": :¢¦;–àõVÁHùÐ F•‚‹ ƸzîRËzD¨ã- «-6yìˆ2÷8×lŠžo~ëµLñã«'¢N á #j*°#PÇ›N8BvÚÀË|9IxL$–’…‚ŽÐg0¡JÉ  #LQ†Q¢ö¢ªy¬†dèk1\¼u÷‘ëgtð¼P¯`H°ã´Dx•@ÝÅU:è}ÆV•Fd¡ #ôY„ `G QÃr`òØe"[Ü ÚíT*LÐú “Ãóćl9+èˆ;¢²¡Gì¦ÐŽJ9±#ÊpчJ&*舚 ìˆ †‘v] +sžúÍ…ƒá“¯ö^ƒŽ¨ñ°#ʤŠ¡XȾ1+ôˆœZìë¾j¡G‚ýò‚ŽÐŸ\>*’¢tDM#vÄ =¢Ä(­ #jæaG”=biÛpÐåÄŽ(£¤Løq»„ƒŽ¨ñ°#2ôˆUiÜÆíàÕWÚ#0y%ù…µ£MÇáÑá—O¼ùÞ—tD‡QP(T‚™Ç1/<ÿnìˆ2 „E´âb+Âc;‚t¯¿ÛÚ£Åc#C"QœUTV¢8Øì ®îÞà¬èP(2šÈ Ö‚±†#jØPÄtya~|ìø°ªd–Ô2–í½Ö~¤l5òI÷`ïÝ H¿¿[]Z¶™ÜØeXâN÷]a3éÈXî© Š_on^uiE˜âLÃŽ(ãËiñrñd5;lh + ¦;¢L£ÛÝíR˜€âœ²Ù¥Á- žñè׃\šWQ6<ÜØe6l‹ S5•S?«ÖŠ=(óÔPA…úHÍ<ìˆò2×´É'¿ *æÓ´Ýìlµî¡°g1aH®;¢Œ´É¾%ozV¨#ÇÔ†ÙÕQ†%®Þ½%4ô§®¼&Ì®S‚Q†%š:nZTÖYoK€m„YÈ%œŸÃ6Ì”`G”¹ »cÂÃòYT5OR„¿ÔvÃBÜr`Y¦;¢ |äÚÝ–ÿ¿½sÿmë¶â8eÉ’_ò3Š§¶³ØIšÅÉ’õ1t麮?ìaö—î—ý²ÃÐbY°G—dX³<í,qűå‡l˲-k’º}y¨t€tC‰Àr ~I^òœÃs¾—§ÅùH òs¥)¿&Oý<5¶ ÏŽö-¶ÏÂêRJ¹›l5G^¥¦$ŸÒ:§äù“gÂ-Ù™;¢Œ-Á\¥ü‰©l5¶ wÄ"2¥>ƒEÈê:yô;›>Âfœ;9nÉcáŽ(>Òëâ©Yß2A-Þ-?N L$Iè6RÇÁQÆùòEù‘Ý×N+ð‚Ε™,­û/}OÀ¥É¹á£úýÑ«g‰ŸºÕæ'Ïù¦#Q¿u4–3ãGlAJ<\~ê_ÐB#L¬¯ßyê穱³äÛgSˆwË ±mPœ+ͤ»•µê©{åôù¢g™èôâ±1½Ú‡ŽÒÀÈ¥S³)ߥ:&îï?5bÅÿO›¿&ç¡Q@·Ÿß÷ÉôÌÀÛßJÅrÔWàŽ€xké^Š„mó×ä²é1væŽ(‰>2ÐÓÿÎÔÅð@t,Ü ïú‰gì)seþ}Dä<Ó¾yTk³$B†Ök¹#ʨõÅ£ˆØKïN_òYH­[K÷[²+iÎ'ŽØ‚P¢5ß §‘wgæýËööõ’x”_(Gt_wð‚ÞwD™ûŸŸüÃé;Ê8¢¾–ÜfõæâmªùÎ#äÒÕ·.„³Ú™;¢$ú’ðûg¯†ú¥3wDo'µ$ÞŸ¹œ š²gÜmc?œ½æ#¢ÿøèï.O-,Â0rÿZîˆ21{—>ÃN†èf¿ëŸÑÐ,Ÿ=þ<õ Éüä\ÈBûåŽ(s#=/Ñ»UO†O±%EicûGçÞõô§ã ·õÖö¸#äï™O¾¹#ÊHBPtMqx¼>{-uw”ú¿æŽ(cüîÞÍÊÑ`æOÍ¥ŒLŒ¥O~îßõÂœ£‘SG€›‹wZÉ,IA…¿ýAx~éÌQ†>ò§…;¾s2oRù59˜ÜX¼ýàè— þôâu=õ‡Mq ?8{õJ°ÑÞ$wDIô‘b¡ÿg—><¸Þ$w„# †DêC&›¿ÆwN>_ù›/>óƒÌùG³ï¤¶¶£8¿#V(¦BèïÌQæHŲñïÿàðÅ"LÊ?}ø7ŸfÚ4Jí—º ;sG”9×ÿö_7Rˆ?¹x=ôtæŽ(cä`o¤>ñ‰#¶ ˜öT˜0ó¿¼ü±oóÔÏSÓç‡ÞãÎÜeè#´Ö:‡ÈbÏÀ¯¾ó‰Øæ©—§¦UlþÍøë;¿wGB[RÙjly-wD?O-ؽ?Ÿÿ(…ȬnÖ·ƒ3#V‡½ Ñ•;K÷±©|îVè'¾ço4V2’ðE’êÅR"Η¦Y‡¾0A LÜ­$6À{Óóá9ôMrG”9`.Ø/”’à [ìÊé ½ìX¸#J+…̆Ïaåœ+M…ŸÎÜevdzõ—‡‰Ì~´?\xüRç©©zCÔ àÓÃã¡Ë´3wDiÅ·½º½é_^’ËfYó¡-ñu㎨ $—1…1¦:àÚ=¨ûÜ‘lFG0ýðqS5ëû{þÑ>c¦‚þ‡Áô7ÆQ}$F?îˆòè#þñV •ªô q$(ÿ5wDyÌÅγÙzIñ AÆÿÔæø¼–‰ÒLÒ‰Å_71JÓðUšªuÉO¬o‡ /A÷«+ÂV±M5m :ëØ¡GXÉÍáV£bW¦UD/óŽx]ŠkJÓGô]Fé¬Q^çÕ¡N—£;Öeª‰ˆ>E&LÇ“ªÖT‡®Kœ|:D;±Tóµ;OÏš‡–ÖClåú1íRGœ F×HªuiMúJ¿óÔÔ½êê„Ø0—,é¦$fEÜoø6hÚȳÅf× fCR‚-îÚj¥Möœ8«4¢;Öh˜Lrº)qVA´¤"&=—͉ˆVŽÛ‰5ìŸ(¢eÙyˆ!Ö=FQ®+ºŸ,"ês¿¡gµ;Û ÑMó›Õ]½Ä1DtmÃZ²¦WâÊatzŒÞ2Ïgsâ5É!æÒi•<Ä–Ú¶œ*ƒÃÐX¡d‹¥:šÓYœä1šLRûûæzf5ŸM3´Zˆô¾…˜K9…¥¦oÊiiw왓§“1µ½öaüÏz^Ó”¯F6“-HÔ+ÕºioO±Ñ­“óåÅ1¦Ò?ÅL=ƒ¸K[†`› ê[‘ö b.Ç<ˆ»Dš¢OÙŒ1£j»^s”©B®¢%9DÖ³½±‰õÀ¬Æ™U^¥FÌvÓ”ˆ¨/j¥rhötDRˆ2A÷[$B)³ž]ò¤e1¸ É–ª¦…µ–„/QjŒ:/•Y`…l7u¸‹2,“ö-å]¹ØÊÑD´ÄwÜ›ˆh*Y]öxÌÛ1)ÀD*€¸³W·+0<á$ˆ[Î[-Zö â®CÐùË„D…êî«I"rÚlYñ<C½E±ó nxŽïR@™dŽ§…” L¶ø>Žá8"¯›Ã‰¾1Wè;JLteDÞdã@§K+ô†[\‚[¥YGE‘üÊ‚‘WiÖ|¡?‚Èzv>Ç|_ÈÛSFëñ-ÏI7UèE´ŸŒÓ”ãl!&"š¦Ä•"'v»‰XÔ©hm¯ž7' ´Ûâç £)‘.­zaΔ î²«õ>6l¾g8²$ÖkÕš‘9ôªØÓ'n4W:2má%ºÙk!ûÊ–ÍMl)÷±þ‘7±Z×ÍPlVŽ¨†–fUìå³ùÁž~Q˜ ä&Ô¬7öúº{iJT ìYš¢ZÞ$ã£5‘¦œÇºJ•ã¶ÐlŸÑ¾Á¢ ¡)ã% ë(½g+Ίù8@¬ìlØ%ÍBêÙ³›µ-þòT±w@T ìYÇDò®ãJ•6§­©NŽ…\Ue”#»c«^ã)‹- ›Ù ¡ÎpOQÜÚÊxµ’ŸÍ=ÎÝà¥ôý…ñ€ïå!î°+Ùbl q£!Fhͦœ(ô"{Å颕­u&cî7š½šLìkí&*ú: "É©Œˆ£)Q|¸¦·wõûK#¢ÀSšb¯1WlšiŠfŒ‘Üo„ª¨CÑe ÞUy!)Ä!:j5cu(c¤NEq‡ÑMLˆ Uõl­ÌTПѾ!šÍãò&ˆ+t=;5:R=l¹í]6WšŠ!>]+#Éi ‰Š0¿ KÛ Þs¾r1_Ù^,ô#ÆiJ<æ¸Û›†ð_ñ/F7uÏ–R ÂÅqY¿`!¾¨Œ½„$5v8†œõ Ÿ1rÄchêÕÖ:OÃäž® ªÜ‰‰¦B¶½E|ì!¾G\Z±‚ž-Gb¦ãÝòãÍZk£qªmTÛ~_r™;1%ž˜€ÓiˆM4¤9ÚòèÕ3z…}‚r™OeÇh#šÎ󮩆øõˆ&*¦uÅÏâwirnH2«64¢þ` iÓT Ñ„YˆÝ8Aä!T—uŒ u†ÀO…ššàe’º>{-¬£ÌÉñi¥L÷è6楨CAdº–ÖËõƒ}^â”^"+yѤ¦µ‹0¶ÑlŠ^d§* !Q¢ÑžUÊ•šöšrf7ß¡ Ò^ß•k–M&c¯ÚM_`l‹3ä2*ƒhŠ9îù5·í«ú4±‰ØĶG¢Æ¨ æ“B{šÈ`}‰†ÇÏe{Ë—!†ÄVÆ*+ÐøŽzb~¥Eô†öä˜@ÉXp͹-Ì*vŽóÈñEçÞîþ<8<èÖ.ÓÞ˜ËÔ^n3ô*)°níl¦Ë¸Çe/:SQOü*±H2“ï~Ç£!:é 5ÆÜŒÑÈ:„«l(ªi¾Ví ;h4MÁÌè`h$ØÐX±]Gb!rŸ¥‹îÙ(­»(‰ör}¼.ömëØ|ìš weH4pßôoíÀ(P-âArB»ÁoX#‘ò»ºÊ^endstream endobj 219 0 obj 2479 endobj 190 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [181.8429 674.5331 183.8354 690.4733] /Subtype /Link /A << /S /GoTo /D (Hfootnote.1) >> >> endobj 197 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [216.1237 660.4755 218.1162 676.5256] /Subtype /Link /A << /S /GoTo /D (Hfootnote.2) >> >> endobj 204 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 1] /Rect [106.7225 110.7118 179.6838 123.6633] /Subtype/Link/A<> >> endobj 208 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 1] /Rect [106.7225 99.464 189.9404 112.7043] /Subtype/Link/A<> >> endobj 182 0 obj << /D [178 0 R /XYZ 100.3464 764.2205 null] >> endobj 183 0 obj << /D [178 0 R /XYZ 100.3464 727.37 null] >> endobj 180 0 obj << /Font << /F20 186 0 R /F21 189 0 R /F29 193 0 R /F35 196 0 R /F18 200 0 R /F30 203 0 R /F36 207 0 R /F41 211 0 R /F24 214 0 R >> /XObject << /Im1 179 0 R >> /ProcSet [ /PDF /Text ] >> endobj 224 0 obj << /Length 2741 /Filter /FlateDecode >> stream xÚí[ÛrÛÈ}÷Wð‘|ÀìÜ<ú¦”R¶œ’˜TRI Ò²–½ åËßïôÜA u,{K[)U À ƒés¦§§A°5lÁ˜ ¢Ò‹RKÂ9U‹ÍÝ3º¸5çþòŒy›"¹Õ‹õ³ŸÎXµ`”Ô´f‹õÍBŠ’PEáná•‹uûïåËwë×ë«Õ×}özo+kIj^+;Z} Î$Bjà±'LÉsØûþØõÇ`ÿt&Uþ´tQpsïRÕÖ”­Šš«åy¿|yö«ÂlÛûÍq»ïW×JÓ¥„ûœ^ÈÝ…—ݪ`ËÊ-ßÛK÷ýÁ´ˆJ,Ûí(ÝÐõ›îàš®­Iw¬ð¯ëzwæÅùÅ+·W¸¡ å²é[×~qå ¡Ö„® Ik¹T®—lÔKã ¡EiH¤Ru噘Þ2ʹqÐÜâ½yìfØ «BˆåþÆmÓîúe:Å+Ó©ôÑ4Øž¹<î½åÞÝá¯÷áJ¸Å¬uU/Íó*J'7²®¿áÜ©¾ªšÈR-´âDÕõ„¼¼Q‘[9iÜøÅÍÀjRÒ8f”ô (ã5)e].´¨H)"yü±É»xã¶k8ùæÕÃ:ydƾ;e¡¿8e™FYî<„23Q†ƒ&ÊLˆ¨aÂv¶2Ù:²9‚w BÉYg=Š¯¿þÜw¥Øù'8Ú`ô&Gëir´D-Ç”9)©!–1B9åZJ™”˾Øì†Ö°º¿Þú(X¸avqeZý¨Úû»®îøÕ;·×lûÙÑk&V?&¡K8™ÆGî„3q‚ƒFVT]¦©Š¬ðœ•M{ !씕@I¤C._¾ú]t”~zçJ<þЈ}AéÈ­:FŽ™¦ÇŒtÌ€&:*“ŒQ³èžŽkCGcU| #6^¾y~ĺÃGÃ]œ~†1.Kª~X´ŠýÁ)ɬ0Jrç”Ó” ˜‰4Q¢ ºd‘Èq³í5>¾ï†Ï#NÖ/Ý6µû»D•¥qUú {·Û`jI5‡·³br{1ùh ]°§Â(‡ ú0-©çÿrê?٬ɮeš­Ù…£ÙSV“Ds1¢2+LOÁ œVM ÅLŠÂA“¤(%¥IRe”LM{2°çÎLÈCPn'³IQ Ž†îý._aBÛGØ-€æ áºiÝrw/¾IŜƺ4«Ù›N¯uÍð{Šò“UI8››!s+D~Ñ Ì‘·*r³I:½­IÓišPØD›h’Šh!ëHSZ?ß»’¶f0M7G>¨m´®ª‹}(oï D¹³TÞu6ñgÚÏvß…h¿qWÞ»5vkÁ¸ª~?¡3ddf(¹W02PØD›ÈŒ”¥b‘Œ´z6iÛîz4^²¹4PP.ãT 4Øa™ØunÌixûüüÍ ¨*±ÇáùgXÈÌPrw`, °‰6±ÀJR›£È‚Œ‘ËåÇÃaJî~0¼ˆ<¸9è«êÁ',`ppqíƒi¹1Lúz½¿IvWk}ƒo¯¶&=žyÆó™êùܘçQØäy6yž|¥Òœ¡¢çˆAíöÁbß7;P»²K˜R§ù?hÎ5mkóÈm2w,„7{¦!l¯á>f&ü´þ&ÐV ™¥ÉEKàÞÊ? ø‘¹‰‡¨)QTÏi-7ôíf´†ÃF­ÍÀF­‰R-uµ¦£Ö†îæ>ŽÃ6UÈ8· ÎC¶Q5;¸¨µ«gþ@ Œ}&„§Cw»½|mZÏþ~õÚέ“ªkúC¶27-öþ”jӂкTsjËÌPµ»9µ¡°Im8lR›¬ eR[Õf uVÇ”u'Ó ´…)Æ…B?±4¡°¦ŸÍ~ðkÛXºË ÈÒ¸ú,±Õ]€{-0ÂÓÏp™¡äÎ`lš6q€Ã&„"¢¬"UÌt·Ÿ`^ H\OâËõÝÄÛöáþ¥‘á–•OSnJ¦Ø¬Ü23TnÁnNn(l’›ä&LNS³Ln|Vn{W<Û¸¼¤… ZeËu°±oÞ!íºc¬LØïÖçoÿöÆ´)#윈cRLÓâÇZ!d¯TÿÉ—Áœ+RJÎç„–™¡B vsBCa“ÐpØ$4ÆHUñTìb íÚ×A ³f°«ŽbTŸ¿A*’Vh UŸ 1e™rÛíºÛƧgâ‘X ý™a%3CYÉÝcÆà$+(lb‡¬°º2ø<{y"+vàßîî»"¼ì²ûÁßñÌ–%{?Üî|–cÄ“~­[ž~ê¡i…¸>>4îúÜ sýȈëqØèúØäzƒÏ4O/D˜ ‘· 69O‹Àù~‡ëíî…Õ¨øëoꋼ‡QJÉ•z̈»6CPf†”{ #…Má°‰ ’AEzIÂt±6¬~n†¯ˆL)[ûÚå㉞X6šþ¶ ?åõfuáÖPžôzxÞ¯gf¨×óîc^Ga“×OaÇßÊ„k˜4«z^ºÙI<ê‡/ñ³î¿{Ñîðô»9úî…Þ\ïg>|qU&ñx¾ä? ÏgÇ¡Ù˜k+!ÿÐÄ„ F¤ž­˜æf¨à‚ÝœàPØ$86þ„±’hZúøcÓ?} Ÿ½xöDYýh¾BOgøÊÌP¾rÇ™ln’/6ñ…Ã&¾¨0;•§+|øòU%F/Lílqú‚èuzi=ØN‹ îeI¬ZûwÊ×—Øy”bknS”%ûlz?Ì™¬P.3§bT"˜¢bf¹&à-,'ŠÕ%þ¥§f„›àćžÁ,X¹Ï §?õˆ÷ €¿J{Qúendstream endobj 223 0 obj << /Type /Page /Contents 224 0 R /Resources 222 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 215 0 R /Annots [ 227 0 R 231 0 R 232 0 R 236 0 R 237 0 R 238 0 R 239 0 R 240 0 R 241 0 R 242 0 R 243 0 R 244 0 R 245 0 R 246 0 R 247 0 R 248 0 R 249 0 R 250 0 R 251 0 R 252 0 R 253 0 R 254 0 R 255 0 R 256 0 R 257 0 R 258 0 R 259 0 R 260 0 R 261 0 R 262 0 R 263 0 R 264 0 R 265 0 R 266 0 R 267 0 R 268 0 R 269 0 R 270 0 R 271 0 R 272 0 R 273 0 R 274 0 R ] >> endobj 227 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [112.3897 690.4389 199.9121 700.0072] /Subtype /Link /A << /S /GoTo /D (section.1) >> >> endobj 231 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [112.3897 663.3418 444.9908 675.0313] /Subtype /Link /A << /S /GoTo /D (section.2) >> >> endobj 232 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [128.7534 649.482 347.1704 661.1715] /Subtype /Link /A << /S /GoTo /D (subsection.2.1) >> >> endobj 236 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [128.7534 635.6223 369.1098 647.3118] /Subtype /Link /A << /S /GoTo /D (subsection.2.2) >> >> endobj 237 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [128.7534 623.8837 196.0794 633.3308] /Subtype /Link /A << /S /GoTo /D (subsection.2.3) >> >> endobj 238 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 607.9028 395.5644 619.5923] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.1) >> >> endobj 239 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 594.043 394.3523 605.7325] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.2) >> >> endobj 240 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 582.3045 362.928 591.8727] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.3) >> >> endobj 241 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 566.3235 425.0796 578.013] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.4) >> >> endobj 242 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 552.4638 495.9258 564.1532] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.5) >> >> endobj 243 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [112.3897 538.9146 266.6249 550.604] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.5) >> >> endobj 244 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 525.0548 495.9258 536.7443] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.6) >> >> endobj 245 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [112.3897 513.6268 265.8977 523.1951] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.6) >> >> endobj 246 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 497.6459 495.9258 509.3353] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.7) >> >> endobj 247 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [112.3897 484.0967 272.4128 495.7861] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.7) >> >> endobj 248 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [128.7534 470.2369 274.4128 481.9264] /Subtype /Link /A << /S /GoTo /D (subsection.2.4) >> >> endobj 249 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 456.3771 357.1402 468.0666] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.1) >> >> endobj 250 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 442.5174 445.2009 454.2069] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.2) >> >> endobj 251 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 428.6576 404.1402 440.3471] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.3) >> >> endobj 252 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 414.7979 468.3221 426.4874] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.4) >> >> endobj 253 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 403.0593 495.9258 412.6276] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.5) >> >> endobj 254 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [112.3897 389.5101 216.0491 398.533] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.5) >> >> endobj 255 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 373.5292 495.9258 385.2187] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.6) >> >> endobj 256 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [112.3897 362.1012 227.5643 371.124] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.6) >> >> endobj 257 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 348.2414 461.0191 357.8097] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.7) >> >> endobj 258 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 332.2605 419.4736 343.95] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.8) >> >> endobj 259 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 318.4007 495.9258 330.0902] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.9) >> >> endobj 260 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [112.3897 306.9727 264.6855 316.4198] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.9) >> >> endobj 261 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 290.9918 495.9258 302.6813] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.10) >> >> endobj 262 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [112.3897 279.5638 264.6855 289.0108] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.10) >> >> endobj 263 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 263.5828 495.9258 275.2723] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.11) >> >> endobj 264 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [112.3897 252.1548 272.6855 261.7231] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.11) >> >> endobj 265 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 236.1739 495.9258 247.8634] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.12) >> >> endobj 266 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [112.3897 222.6247 224.0794 234.3142] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.12) >> >> endobj 267 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 208.7649 408.2917 220.4544] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.13) >> >> endobj 268 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 194.9052 458.3523 206.5947] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.14) >> >> endobj 269 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 181.0454 402.8068 192.7349] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.15) >> >> endobj 270 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [153.8444 167.1857 469.4433 178.8751] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.16) >> >> endobj 271 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [112.3897 142.2097 438.2787 153.8992] /Subtype /Link /A << /S /GoTo /D (section.3) >> >> endobj 272 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [128.7534 128.35 337.1098 140.0395] /Subtype /Link /A << /S /GoTo /D (subsection.3.1) >> >> endobj 273 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [128.7534 114.4902 359.0492 126.1797] /Subtype /Link /A << /S /GoTo /D (subsection.3.2) >> >> endobj 274 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [128.7534 102.7517 388.6856 112.32] /Subtype /Link /A << /S /GoTo /D (subsection.3.3) >> >> endobj 225 0 obj << /D [223 0 R /XYZ 113.386 764.2205 null] >> endobj 226 0 obj << /D [223 0 R /XYZ 113.386 705.3641 null] >> endobj 222 0 obj << /Font << /F18 200 0 R /F20 186 0 R /F45 230 0 R /F15 235 0 R >> /ProcSet [ /PDF /Text ] >> endobj 278 0 obj << /Length 1158 /Filter /FlateDecode >> stream xÚÍXËnã6Ýû+´”âð)QËIœ)RãhÑ¢íB‰[Jdmþ¾÷ò!ÉIDwÚ™i ¤ÈC^ñžÃCÑ,¢ðÇ"F)2•Q–JÂ9UÑý~F£ tþ0c”hF$åy$ M¥FHôQ’¥ÐW ý©ä>\íy´hfŸfѧaB¦I.…Š’,Õ„k%zVÌ>\2 ïDrš³¨xˆrN´  Þ.'L¨,*Ö¿Æç7ËâbYÜÎ/~œ]ý¬^Sçá•8L2Ù¸j—±”d CE2ÆL`AäORÆdž(JG…Ìó·»ïuÂ2X±¦ù°ÊwSæQÉöNÒÞN‡IcbŠ§`PÏS8äÀ¥¤,w<©ž§íŸê‡vÄ’Œ¯~¾\Ù†ªm×w‰¼Ü¬~øÅj5¦EÑoô/øGìøµ`g ²3NÕ4;Á ž×!å1;Þ\ÒLƒˆÔ„„=”s¯PþÕÒý¹åqS`G-âõö7ÊDÕVõ=ô›¦;©º9üÿÿUUm{ή– [ÓXȸ¬×öÙ’A(Á`ò-¨Ž™Ä5¿‘RJD*2ð&̹}WÂœ’Λ=Îñï[¶ÛCã”Ñ<زõú«!5è·D#:¯%D6ãÌ¡kË{«tB'ßTf)X¢VRžÙ’Y32“2 u2;²7T1"¨òÔñ¯MÝòÚ–Åõâˆ9‘éïÍ•_é ®F° WãÄMs ê¹ ‡¸É”s"UwÚ¬†ˆuÙ•I×íöžÇÏÆ'˜1qÞo|¤mñ|D pƒ£wÎ3Ó¹·¸1ŵ}Àúm\Ïí žíC¹óó5˜ˆ+‚k8²‡­“ÐÆÙl*8JRÉ¿Ë.þò¾o+Hû¦ú” G°  =ÎRM 2Ô 2r$4¦*󊔃"‘Ýrýôì} ã%ÁÚj›ºi«5 ÖH“kŸaŸ‘'>iÛ×V»-JÛ`Œ$³:Û½Øv”#~`ý`m«²Oö%lý êÏU‹³MòáWs‚,ÈÇ89Ó|ƒz>Â!{>TžFµt|¨×|Tëú@>ëœ#@M»Ï·1“Öûø]é>·/ y±¼uÙÝÚ³>ô ë+î~=aFÆ°#Gé™d$Ô1r"äÀˆëSý—Q:0Rb»ÏIi.7xù¡Ö§éx3`£¶Æ™ï±g‡C׆!h/k +Ÿ»Ï†ºm7šÑº»ÖáÖ3'9å®dSD"Äm¬)#ÿ¸üÅjÙÔùÿÅmÿ#WP¡§.‚((Q‹ 4ÎË3l§‚‹bJµg6ˆ³wcÙÝ}òÞùò®sØK~ñycwÎaÔXÙzqîÜ5Ö_'¨rùÅ<øõœ`b r1NK§Ø€QæG™+ÂÿwéSèô„s=õÓŽÌ –Pp9t0ssŸ> endobj 275 0 obj << /Type /XObject /Subtype /Form /FormType 1 /PTEX.FileName (/home/wouter/texmf/tex/latex/SmallLogoInGradientBarTex.pdf) /PTEX.PageNumber 1 /PTEX.InfoDict 292 0 R /Matrix [1.00000000 0.00000000 0.00000000 1.00000000 0.00000000 0.00000000] /BBox [0.00000000 0.00000000 703.00000000 64.00000000] /Resources << /ProcSet [ /PDF /ImageC ] /ExtGState << /R7 293 0 R >>/XObject << /R8 294 0 R >>>> /Length 295 0 R /Filter /FlateDecode >> stream xœm˜[Že= …ßÏ(ιÇygðÂJâ©Ô0‰oÙûV]¥–ºÊ.ÇIìe{eÿzçTÞYÿŽŸ?_þÛzÿñ¿×¯W~·ÞRÙûýó¥¿ýx­\rêåÓï§Í×ßßÿ~ýz£/a£õ=Õ\ÞÊiä\‡~é{÷]b#{ÿå?¯¿òï—o mfÛî¼îç¯ÚðŸ¾m­áS.‡ þ–Ú®y¿ÿûÇ«¼ÿõš}c³ßµ–TªÎ>ûiÖKóã5›íÄqꮩ­Oš‡Íà×ö¦u™öX5Ò'EǤ÷w]–Z™ÍÓ&øUsoõלe§aÏkŒZÉÒã<¡xø3'ßh*‡X¡9ý~ÕcpÁîˆÒ˜Êï|½Ù­ÙRȦ]¿ƒ) 9[2ÛºwR€Ü³Y5àžç™üæ]Äké„0!XŠéi³Å‚O ×ôâtŠéå¡ÎûóÖÐ]1CȦF¶À‡E¿ËVÏ›š:^èa’'C¦(6ÝûÝ!;‚¶O¤Ób±t¯ðPâR·e-×ÔàSU:‚H®pÍ)µ§|ÜããËͼ̷fÿvd ©?¥ávœ„ÒózÙ$! Ëj©]rv`›y7ú]½Xü¯Å”Ä«6ÙÔô¸kÅÔäµbêCÈÂ홦2h@Ž&j³x}}£!À ˜ˆùÝοóvÀ}ÕÜ {÷ý÷wÍc¯cÕ7šÐ}h†ÅÌÛ €°@qŒ2sÑ;çÙæwѨò÷9¬¸Õè¦K¿A”ËÆ+fh@s÷ÈoïsÈ>u•Ã){ªÌûØeцv—ÏƼ¾°@çXÇŸÑ!Ä8 ‹ƒ×,O å¸éA¢>Q‡âÇ©è+íÙ=)Oß(èÅxkÁ–ÂëWÍåVħh†¼)ý±.?/M×Àˆœš¢ù£‚`¦’Ò)ºî"€üìQF6°Ë‚ Wª€S9x¡nÕw]^N]uÞc×.ÂØ’×y &Äч7zfä—ì„À`ç·iô ¸ŒÏ†Æ‘pšcŠRøÞ). q¡òð0‹÷¯Ç_m 2&ÎG‡×ŒD""1 ÙbMf4ó6,\}€RËÞ3YÓyÏ`‰‡†æ|¬ÀÃ{²Å&’¾YM˳£C X*1yëo³RÅN`^¸ý¤NDôm¡!0>Pš¢špnÚu³¢t¬<Ö}ÊJ²=,T’Å=¬2ülÐÒÁž%i°&yg¨) fÅ/á̶¤‚¸¶[öäéׇ…&Û÷¸‚vâS͘d¸øÒ Ó-¦Ò]ÈVñÁÀ8…í±œÃÐiX±5ìÅFÙƒrð–/™çI¡)Ú vQj„MHReD­•LAŽñþ½>?4XP“E8«3ÊCcõn´z Èÿ[¼ë.;ÞrÜš»xý*õý2J}½d'eËÂć»ôÖ(vI™ ÂßêODÈÏiåŒk–ò^NOú%›“ýÈahÄØ=Zò@:‡-1å¢:öò®-¸cÞÑ@…¯ Ý„íê‚‹)UôI½žªìpЫpø9rŽxSm3D*–t°Ÿ—fÜ„Á(}`5œÃõ ‹T/. U/E|S;ª|) áu ï~"Ŷý~ci“a\_;{“ÆÃp¾/ò¶¦ºãèbgo±¨­n°‹Ç:GÝ%SkćF}¦Z;Ðé}&Ht™¥Ë´c¼jKâ *Mt‚p( í 0ô$Yí~F‚VÆãô/¶üÃä{ùóÜ–fc4U´vŸ49Ï¥)ƪ©æ‚8èQ E0Ÿƒ8hÀ(Ó¶@‘fœ^Ñ7‹!KD«§À4þî–³³¾>{’îËýn =8ºw5Õœ§ùÄjQTZqh4‘œˆmˆWÕ)³¿ë‘ûÜî¹ýAuˆ:äöÏçß @ï4¡“\ôx*z´ör>d4yËŽ©iz"êÃŽÝb÷|nŠâ}UŸN_;ÝgÕtѬ^QÕª(s*qX¬à.Ù‡°£”Š“v” $øàYâC×c°•+A6 ’ùW'^ÿ>†™N2ÚøÐtÁkùëÏaÔ4T|×êãÂ{”—¬§.‰ðy£‡Lɳxâ±|—— °=š¹?õ)$åó©Í:€~(}=1‡nõ·¡óý[ÛP+Ñ×êÿÙ‚Rendstream endobj 292 0 obj << /Producer (AFPL Ghostscript 8.51) /CreationDate (D:20060104161306) /ModDate (D:20060104161306) /Title (SmallLogoInGradientBarTex.eps) /Creator (Adobe Illustrator\(R\) X) /Author (Bert) >> endobj 293 0 obj << /Type /ExtGState /OPM 1 >> endobj 294 0 obj << /Subtype /Image /ColorSpace /DeviceRGB /Width 2921 /Height 143 /BitsPerComponent 8 /Filter /DCTDecode /Length 20674 >> stream ÿØÿîAdobedÿÛC  $, !$4.763.22:ASF:=N>22HbINVX]^]8EfmeZlS[]YÿÛC**Y;2;YYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYYÿÀ i"ÿÄ ÿĵ}!1AQa"q2‘¡#B±ÁRÑð$3br‚ %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzƒ„…†‡ˆ‰Š’“”•–—˜™š¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚáâãäåæçèéêñòóôõö÷øùúÿÄ ÿĵw!1AQaq"2B‘¡±Á #3RðbrÑ $4á%ñ&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz‚ƒ„…†‡ˆ‰Š’“”•–—˜™š¢£¤¥¦§¨©ª²³´µ¶·¸¹ºÂÃÄÅÆÇÈÉÊÒÓÔÕÖ×ØÙÚâãäåæçèéêòóôõö÷øùúÿÚ ?ôš(¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ JZJ(ïEè\P84Þ€2rh:äҩȤÁà0(©Þ’N‚•3D€œb%3Àõ©eqQáŽ:P±ÜÀv¤V*XzR²Á”f…BI-Æh˜%KçœÔ¹Ý>Õ×®8ÍI·‘í@!°}Ãõ¦Ï÷–Ÿ!NF9¦Ì¤°À&€è,ÌU8êj.c*Àõ©¥MéÇQQw*`(̳mΧ[±ÉSÎ)Y%Þ£9§A\³pMÔbÿÇÑ¢rZELàRª·ÚIÁÇ­,ÈÛèɃ ÈØÅ+&r9¨ð]^BÜŠ–8Ù¤.ãíLÙ*@¹ ÞÌÆäðM  ”ØÍ=à>JË´ˆ’I*³®Ð{üK;”ƒ#©â™vŒÛ6©8ÏJ’hÌízŠcîS!¢Xä ËU›£›|úâ òå"2à/z±r„ÁµA=) lÛ-¡jžÖ1·Û±WQ ¶Ü1U<¹‚¶pNs@2És%‘cÔ©¦Ø©o÷¿ © emJNÚmš2DCîôÇÔ†÷þ>#úçWªÜnÓ¡U$ãëW(»(ißzO ¦Éºæí£-…ð©,ctgÞ¥sŽ¢›,rÃre‰wüiÐvŸ#0hØ“·‘šdò©©l h•™Æ»S!Åû¹R“Î(º_Ç£þÌS-eŽïî‚jKÅ/lê ’qÀúÓmc?còÜÎAõ3ö¼±IpÎw)~) ¶ Í×i©˜n#G€G•b9z8LVf>­´ç´"bA¥ÿ«“ëUˆkÉ¥%ˆØ QVôèÞ8Ü:•Éî*†{y¤òº¸# gƒ@tDúl­$,¬I(zŸJ‡Nÿ¹¾‡ùÕ›ŽþŽHô¨lb‘.egFPAÁ#Þë¡Ék«ñâqúf›mpð$ñ“»`%sØçÖ¥¹†h¯Ä)¿ÛðÅ%µ›²LÒ­ Àþtgr¦Çû?Ú¼Æß¿5ÕÃζñƒ·x±ÜçÒ›ä]y_fòŽÝÛ³ÿשî¬R„nhÆýsHVvjZ×Q6û‹!㟦iuøÿ·ü?:Ö ¥¼73&ÏAÓ´O ¬G F(1–Ç‹×ñç?ýsoåTt?øö“ýÿéW¬Ê£$£~*ž‘[¸‘ làj:”þ$gaõ n$g#ËRÊ?§‹ùF”Wqß¿`lóŒf•í®­&™aŒºJ ‚p J4É?³J&-¿ü1HÍ&S"Km:9&EÜGô«7¯õO³—+éùf£[[»·‚)b1ÇÚXŒqV.­ç·¿ûM¼~`=€Î8Å“·ígß-»¶à¼nqIü‡›ñþU.•k$FI¦]ø‘!k-!FÙÏÍŽ:S)'dYÔãÆ_ þtÍ'þ<‡ûÆ¥¾V{9f#€>´Í67ŽÐ+©S“Á£©_h«¨ÈJ¢ÿ3Sj“4q")#~rG¥2öþTb  =êmBݧ‰JrÉÛÖk©MCYÝDGÖœÁ¯.åRÄéK3Ü\FÓ&Å@#Å:Hg·¹w‰ +ç¶qšo¸lWN¶r À€¦ýTͯ qN®rÄÔñY7Ù7Ä>•†âUŽŒª§r( 2IÝ®.R,¸Ë4[Ê䱓 ãê)ÓÁ$s¬±.ìcŠ[{wc#Ê6—cë@õ¹VhZrçplUÝæK"Ç©SU<©Õ ;8'9«žYKCäí heú–ÿ{ú €œÈå±´d ³f¬‘Àƒ»½@c–&uE%Xc4A|öû63ógö¤Á„ÆàçpÉ©>ÌßgÇñç8¦ˆä•2í 1šR[¿¸¿Zqm–ÀŽ»E%Ò³ Ú çµ;fëp§ƒ´S+©_F$ rMO!ÝoŸP*’íà槑q´sŒRN Ϧj «9<Šš%>VÖ¨ö:‚€dôÀ•´Y=i°}Óõ§¢íé°‚ÈÅÌŒÜô©"bAµ0«#£ ÓãR£ž¦€?õN“îþ4Ô9$S¤¯ˆóíLÁÆìóRò`Ó0ØÛŠ~r™¤N”¸Âb„ Gû•Ž#‘JÃ"€¡­I‚HÍ+Pö¤íš^Ôœô =((=((ïKIÞ–€Š( Š( ¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¤¥¤ ¤Í©;P“ŠÍ'qGñP–ŠhèiWîЃšBÁzÒ'zI: ~xÍ u'÷)ŒÅ DŒÁzЬ¥GÖAšTâBqåÀm½èf 2j3þ¼Q7ÞÇ««tëC8RÏ5âqŠ'ûË@\˜OJbʬp:Ón>àúÔr×e‡pƒ&”€GzŠçî­Iúµú ¨‚E2lç4;ª ±¨Wþ>$ÜÜ(=8 .N’,Ÿtþ*«„9ɨS‹²Nh›þ>“ðþt å’p3LŽU“;sÇ­9¾éúU{>øP>¤²N‘¶ 9ö§£]Êr*¤`4²îçƒÖŸdNvâ“&I•Ü ÎEÌ‘cqäö^Ûþ>¤ü# ×Øa‘žŸ…} QȲŒ©¦ùËçy\îªöÜ]89þtùþ?Ò€¹mØ"–=Í6)VU,¹À8æ‰ÿÔ?û¦¡±ÿPßïä)Žú’ê(ßi$‘פ2 ÌÜ6úÖ|*)ËrBñša'ì€vßý)Ì_Žê)h$ÙïK-Ìpœ19ôJpÀPvƒÅ:0ýÀFOZïbôr,©¹E1n¦1 îÕWN'|ƒ¶(ƒþBOõ4ûeEvÎ¥H²ÆsƒëQ_Ç£þÌTvÄ9ˆêb˜_Qí{ ¾ÒÄûÅN\Ëç+ŒñY1ª›˜¸ƒéVíI:sg°lR“,A:N LñÇ4—)o·~~n˜[KÿW'Ö™«Ë/ÇúP÷nh3*)f8©¨#¾†IA=2:Ôz¡"Ôc» þµJåU-í™ T䀔š4纊ßÉÉì)ÐÏèY×=«83UQŸcô¨c% ÐBví?ÌQqs3GûBß~ÝÇýìqV$‘cˆÈܨⱊ/öfü Þf3ߥ]É:>O]”\jLµéqôÎ3Žju"¡bHëÒ£Ó .G\œ~UBÕín™À,On´ ÉÙ-;nþ”ù@Uˆ¯hRð6â«Ëréx± m8íV¤b±³ @•ºÚÛýXnÝ“ž˜¤»µûNÏŸnÜöÍ%”ï:1|p{TÞJÒºÀ ªrM!]X½,K4e¡ªq骲y ªô«—h‹q`pECiu$ÓÈ· 8À÷ nÌuÕë”\u§[Ù¤²“¼¿ M³4oLg8æÿè‚i?»“ŠK•²×úÖÙœíÅ\–öæ;At¬ïí Œy¾Zù[±WåŸfhÿ»‘š¹z¥¿Ù¢Ù»w9Î1UeÒÕä,’Vê¸ÍX±î .øÎâ8¨®î¤†ê(Ón×Ær=èk½”Mj ä(äùõ¨-ôÕŠQ#ÈdÛ÷F1WØáIöªZuÔ—>g™·åÆ0>´ ¥t%Öœ³ÊdI lzñœÔ°ØųBrÁþñõª×7Ó}¡¡¶PJu8ÎqÖŸ¢ÒI\ ñõ¿¥ ñ¸ÄÒH ÊYÎÜUË«´[˜ƒlÎ9Æk4jW+²Y#_%ÏbòýÒDŠØwäûô£A'íaû=ºE»vÜóŒwÍC%–ûå¹ó1·.ßëQYê í$w+Æ ${uªÇSºmÒ¤kä©Ç"€rËD»Œ+¤rv¨,ôÕ·—Íy Ž:qŒR\êB;X¤ˆòíëLµ¿›íBÞí³t=1F€ÜnOaöÆCælÛŸáÎZ±s\ÂÑIÐ÷«2}JáæZ¢˜â’Frz½at.í÷ã Zœ[*Á£¬s+É)‘Wî®1RÞé«s(•Ç'sŒæ™¦ÞËu4©&Ü(ã’òþauökT ã©4h/vÅ›+4³B–fêÆš¶[oÍÏ™×øvûc­7N½7JË"…‘:ã½"]Èu6·;vnzP?vÈ–òÍ.‚劺ô`)¶–+låÙËÈ{‘Ò›xÐ2G #zö¦Ú^ÈÓ47+Žô»r[‹?:å&ó6íÇÎpsVXnR¾£–Ú„î]âEò“®EX’ü E•GÎÜ`ö4’%´µû0a¿vïlRÝÛ}¤(ß·o¶j´7“ Ö;…>0~½)f¼”ÎÑÀ ìê~”Õ‹ê6¨ƒVÞUÃË¿;³Æ:dæ‹K´FIeàL‚á互6ÆÕÎ1õ¦;­ÜZ‰˜0m¬;ѲÂ'qn 4Ë›—IDQ\úÒÚÜ4¬É Öiq¿a¸íôÅYhÁˆÆ8Å@Ó¸» m8§ÜÏä€e0Ñ‚/% îÝ“ž•–œ²¶Üõ¤†wó|¹@š×237–Õ¤XŸÈO+ËíëLŽÔ+Í»(ûHò7ãæÎ1ïLK‡ ¾`Z˜hK,Ûp;M:(„kÉ=M$òÔÇ'½=äRz‘š¥Æ±)}߆)î»Ð®qšdc9N1D²•!Te ø×bÎi=ÒÏNÔØå%Š¸Áß9ÎJ´P:4Ô‹iÉ9¤iqaÔÒ,¸h ºoÇ8Å:£iq :R‰>L÷ª›Xœõ¥eÜ1L7Ž =Û ‘@ Ï/ž¼Sùri»Û®8 }(UÁÍ!n;ÐçŠWž´¸Å7qíÒœE \R‘šE9¥'QŽh£<ÐFh‚h€ QFh Š( –’ŠZ(¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ (¢€ JZ(¤ïKI@zÑÕ©h gÐGÊ)øP,1D<( ´‚£_õ†¥¤ÀÎqÍ6O¹@‹Ôâë@ã¥A¸ye{æ¤þ´g8¥ë@¬GÜ?ZNÍàõ#`…TõÐ+í>V}èc¿bŽ b¬öÅ US ,Gs÷Ö•6Ø‚¤`ù€?Z€±L¸0ª÷§pE¶PI±wghÍ)Œ‘@XŠ›|zæ««…‰Ðõ5t£`RÐœ•Ð)º7lšVa,é·¶*጑H¨«÷T bš°ŠYwSUÛ»cŒŠºÈ÷”­8âr™îáâ‰%‡fèbÛ˜©V4VʨéJÊa€#Þ˜Xe¿ú„úUsÿ!ÇúUÀŒ€)»~í£w¯za'ÿPÿǘ´«$# Ò"ªŒ {PÔÍÄI2? F6a±ÆìÖ‹Eœ²}Å;ÀÇ¥+ÊfHâf…S$€«ú¥ÿz¬¤H‡*€aJèŽ0ê÷ vЯ:–°Àê¤ò+ZGÎàƵ€: `† û‚(o\P7 ¸RšvÓÔ*ƒùŠu‡üz¯Ôÿ:•]J°Æ…UEÚ è)ŽÚÜÏŸþBqýE^›ýLŸîŸåJcŒ¸bª[±Ç4âA (éêäúÕhÜ[M:Éœ• qÖµcD@v(P})ä º+ÜŠDòèTÒˆF]Šº§üz÷… BúHU벭Ȉë‡Pï4ª¡T*€è0¶¦™~Áäó¿~ Ðd1é%[‚¬ùù›ü´ß×8§²†R¬¨4¬%ž“ÿ‡ýãPj?ñÿoø:Ò5ÄjzñHñFî¬è¥‡BEåÒßî7Ò³4_ùoÿþµ©LŽ(âÏ–Š¹ëLÕ3%$zœÍ.pwcß<Š‚]ìnŽ:Öì°Å.<ÄVÇLŠrªª…PŽ€R±<‡?,Ë%•¼+“"“‘zše6—öï(ùB¯?AƒZËoɽb@þ Sä‰%]²"°÷X9‰5ÕÝÓÆ>R­Ç¥B“¢ió@ÙóÁçÒºãH—lhzLkhMíõ"‹#0®ax¬ídaÇ?©È©‹‹Íb'‡%ARONkmÑ]Jº†SÔL†¡ÊE\õÀëEƒÁ‚Af÷qËÅ sZl¶Îä`3qïW¥¶†f $HÄw"¤Ð ,…™‹¢ÇÔÿOëHî-5¶’\„99ö"µã‚(˜˜ãT'©­,°Å0XÕñÓ#¥GkZ2—¸šP>R1ùœÓ£ÿó~?ʵQ5 ŠG`1MÄ%ó/™ýìsE‡Ë¢35 b¿†b>N?CLŒ}«R‘ãÎÜ VâH»]CB)#Š8†#@£ØQ`åÔĆU†Þâ';`N’9n'óÇøV»ÛÂï½£RÞ¤T…ARÆ‹ Èw7pyyá@‚šàÜÞ4eˆUÈ…KcÆϽHÎ:Ó%ŠX® ±.àߥ"zÃpéo*ç•éíQ”d…'w3± £}ž@ü3ôö¨¼›‡E„¦Ns@¬Ë7-¿O-êýE²Çw÷A4ûˆÏØÌh ?:KXˆ´òÜœ‚(/©Ÿ±¤†IÙÎå"¤žåÞÒ!ž[!®) L«ÍM5“}–0œºg#×4fDŠÖ—¨‰ €~­ÿ,¿éK3Ot²Ì»BãñÅ?RŠI|¿-Kc9Çá@í£/Vfÿs}ó­:ϱ†HîegBýh)3u¨ ƒÓ4ÛiÞ¸9Ø _cœZšæ £».ïoÒ’ÚÉÙ&i¾VëAw)ùmöo´ïmûñÿש®§yÖÞ<à8±ÜçÒ›ö{¯/ìþ_Ë»vúõ=Õ“ªBÐÍ×4…gb8Ùß´;‹'Ë5\#]­Äîçr@«–ÖòÍvצÑéëÆ*mu›i½$ãpô ,ÂKÉœ‹¸î,T¶y úé¸k˜\ê æ*ÃéïöA̪KëíQÇoqs6ŠÊ4u*Ã9êj´ÐJÚ¼r„&1ŒµkÝCu©Dp¡ ?'ýªCiú¢B®Y\Õ½VÑî$ˆeÓ·¨¨-íî.o–âå6Á錑GQ4ù†ëß~¡þ•µYZͼ³´F(Ëàâµh)|LÄÑ?ãê§õ«:çüy§ýtÈÔzM¼ÐÜLÒFTÁ=ù©õxdšÕV$,ÁÁÀú:—¸SŽ²/ÞŒ~ßãÎi«’2\*ŒPŽ|ÍpPœNµcó!=:RHŽ“AœÓíã( 7Ð5¸Õÿ³øÒÎKJ©Ú…F%°qëK4m¼:Œ‘@ Œ˜äeÎG4Ð «9<Š’8Ùœ»Œf›²EÈ=èXØ´Y=i°}Óõ§¢íé°©Pr1LbOü5(éQÌ¥±št ãÿXÔ7Í&ÞÔ¨¤9$qC)¸s@¬Wpô¤ÇË»<木y'½&q@ÎS>Ô‰÷iq…Å09 czäÓ”äSpF@§¨À B'z:šb‚9 âŽÙ (Áé@æ”PE€ô;Ñ@Q@Q@ EPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPIKI@ Iš(ï@8 Ò´)84Šk}áCö   °Ó÷†(±Í#"0'é±÷¤_õ†€Ì­ ÁºS2óB­8 —¶÷¥'ŸJˆÿ¯#ýÆúP¬dR3… óMƒî­6¼´BbBŒž”Å•Xàg>ôÛ¸>µ€q@6Nò*pzûR««.Aâ 7'<Ó²c¦?­¹?ž›±“õ§³RÇ ª¤³©ïš™¿ãןA@îHŒw”Ö•UÂäÒ[ÿ©ßñôŸ‡ó /¡aÜ"åŽ29ÒC}ê+ÌüžœÓdn#ÛÇN” ²y'HÛ$ûS„ŠSx?-UŒ–]ÜðzÔjOÙÜvȤ-­ÌlÛFGÖŸ$‚5ÜÙǵR”Du9©î¿ãØgÚ€¹:0u :gœ¾w•Îê-ÿÔ'Ò«Ÿùþ?Ò˜î[v¥@3MŠU•K.p9¢õþé¨lÔ7ûÇù ú’ê$}¤’G\•*°u § Öt4S–!{Õ›|–ôÝÅ!'rXgI‰ ž=i&¹Ž†$ŸAU´ï½'ÐScõäõ Wv/E*J›äSácÎáíUtÒwÈ;`Qü„Ÿêhö-Í:@s× Cqàì'#¨=jÏͨ nFGZH>]I‚ð9é@¹µ.=Ê$Â#ÇÚ,© nsTgÿœQKª“˜‡nhmË0]Å;mRCzN¸¹K}»óótÀª3*¦£Œ2½)Ú·ü²ü¥ÌìiTÝG4Œ‰»+×"§¬Í;þ>æúçLmê‹ÓÌ°G½óŒãŠtr,‘  Fyªº§üz÷…4’4Ž:ì¤Ôö¾ý¹l{TÓÜGsÁéŽõ’U³7`nó:÷éI!,ÖþîÑ×êh¹<ìÕ·»Šç! ;´Éu"¡,Hà8I‡—«°ˆcØ»QZªµ­Ù` 0OãEÙìm+«ÆNTŒ‚*+k¨îwy{¾\g"«éd›Ï@Ç•E¢ÿËøõ |Û®nc¶U2nà H¾Pœ.7dúV~µþª/÷:ô‘¤®;…ÍÍ«$MNÙä ð T·7qZæ“е: Óm˜¸–Éîy§œÉ¨Û‰yʧ_§øÑryÙ­muÒ“9Aê)ò4º[s»{tãŠÎ²5‰U8_˜`}i×ò‹ð¢ãæv5dqlíÑA'­ÔwHZ=ØŠ[¿øóŸþ¹·òª:ü{Iþÿô ¦õ±=Æ¥oo/–Å™‡]£8«QJ“F$·)èkÉVO¶@-å±ç±õ«º?g”¸ü¨L˜É¶\¶½ŠéÝ# •ë‘Iu} © !%;TdÖv‰ÿSý?­ ¢My„€0Éàý(¸s;#V ˜®"2Fß(ëž1UÆ©ldÙ¹±ýìqY0–Xïwoo÷‡ôÍ<¢d£àoóqžý(¸¹Ù»,« M#ghô¤‚t¸zgÇ5NBNŠ ë°:]8‘¦±^£v(.ú’ɨA… bGÀ©šxÒ4°ØzZǶDk;–` `úR;7Ø¡;w7ôÿëÑryÙ«ä3¾Õ$7`GZ|÷ n¾yéY× #»·òÀ*ž>µ>«÷búšÌìËàä;óQGp’JÑ®w.sš’?õkôFÓþBÿÀ¿2›Ø¹,«nlãÚ–7 uè}j ÿøö?QI#Nã®Ó@¯¨óym¹?\qS3…Bý@â³QWìNÄ ÛúÕ¤$éüÿtÒÉ¢•eRËœgÒI2ÆÀ6r}*+õ-þ÷ôÛÏõ©ô¦ÒåÊŽ9VBBçZ’ªYýç }KH±€[<úR†Cv#5 ßÜ_­+çìƒÝÇ „-ŒŸ­9ÝP|ÕTöu=óN<ÉïA@®XIúRsPŽ'lqÖ„Êrzñ@\³‘Œö¤G8¦Eþ§ó¤ƒîŸ­$g Œ÷¥¨§þ”t b;PÌ­2?õAæ^h"°n”›†ìw¦'ß4¿òÖ€x‘C}ÓMO»@Å,¥Ï¦/CGðÐ!àƒA8¦žÔ£ïP1zÑži÷¨h ô t 4QÚŠ(¢ŠZ(¤ ¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¤¥¤ ŒsE&hHÍb‚iç€2sJFE7qíN#4psHS'9Å*’sšBÇ8r¢š NiU· Eb\ŽÔ 7sÐÒªúÓ]ˆ;W­*9$ƒÖL¾ìÓˆÈ#Ö˜\ù»{SØáIö cQv g4òqŠX˜²’}i²¹R CÙC. F°€Ù'8§Èû=ê1+Ç€$!ÎAÁ¥H•TŽ¹ëI3”PG­=NQIî(/³ŒýãJ•×réQ¬Œg)Ú‰¥*B¨ù øÓbÎi¯éU÷cãØ¥%ŠIÁžC–P6Šè±$bEÁü G¸FÜ[q({ŒD¬'µ69œH@9 Z’Ø;n ´ž¼S–êZ‰çr챎­9n3 r>aÆ( [E 1`;b¥š?56çõ\\È¥YÀØÔù§a Ž ôƒBh×dasœw¨Ì¸ów~ö¤·œÈJ¸Ã C3ý¯ËãoÿZ˜ô'‘wÆËœdc4È"òP®íÙ9éN•ŠÄÌ:šŽÖF–2ÍŒƒŠ©–JÎY\¨=F*Äq¬hz ¨×R³1ˆ ‹V`—Έ60z@•¯ Ëk ±ß»>ؤžÑe}኱ëÇZK9ÞbûñÇ §^JÐÆ¥1’qÍ ÒÃà`M«É=M1-¶\´»óœñŠ{K²ßÌn~P¦/'\HÊ dâ€m"ÍͲσ¬;Ñmj°rYz[‰JZ™öQm){a$‡×4ÃK’×}ÊͿǧÜ@·ínäÚ©ÙÛtˆ£ËSŽ•ufó-L«ÁÚOÐÒÓ"·²XdÞÎ]‡N1ŠuݯÚv|ûvç¶i,gyÑËã ö·“4®°(Úƒ$ý(–4j­µ§‘3É¿vîØÅ:Òãín# 8"¢³¹’k‰ȃŒzcºÐšê´E³vÞsœf!-ÄDî`ñÖªÝ]Ê.àîM-µöøäó†1“Žô‚êã?²ÓúÖÙŸ»ëV.lãž5_¸S…#µRû}Î<Ý‹ånÆ*ô³ÿ¡™£þîFhåkb¶î\±w=ȨeÒÑä,’ªã5=Œï=¹yÈb8ªo¨\;HÐ(òãë‘Ú>[QB±B"N TVdßûÍû±ÛÅFúˆK*¨ÞÇnßCQC:O\¨Û cé@ï¢Õí§ÚÑW~ͧ=3R˜U­ü—ù—nÓTn/gk–†ÙAÙœŸ\u§Á¨†´’IßP;ç¥xÜbi$¥f@~î1V/,Rè«n(ëÀ vª#Q¹M’ÈŠasÆ_½¢³2ÄFxÁ#Ö¹lIJ±KMÄ1wn¬E$–[ï–çÌÆÜ|»­:ÒàÉb³ÊFpI#ØšÎ:•Ó™D*pF(qI'› ÇœoR¹ôÍAciö8™7ïÜsœb«Ýja-"’ 7ÉÐØëMµ¾œ]‹{µ›¡éŠš7s¤¤Ó4‰!wÞÍ\¶·KhDqô’{šÌ›R¸’iEª¯—$’3;ÔãTÙær£ÌnÞÙ£A'’XØ}’YÍß¼tÛŒ~´^iÉs(•\Ç'rsT¢Ôîc’3r«åIÈ8ǵ{S¸’ÚÝ^"7‘žÆ8´:ÖÆ+x^?¿¿†'½V:É•ŠgîãúÕûWim¢vûÌ š¨—RQ­ÉXöç¥j:§„KnЃ´ÇJKK³CåîÝÎsŒT÷$Qdo^ÔÛKÙv‚äã<ÐW 4´i $…õ\U‡´í„<…^‡¾j‹j]âU!ç"¯Ã?kæ¨ÁÁÈô4å{Ûéë ÙË‘ÓŒT·vßi 7íÛíšO¸’á\ÈGÆG5Ü­;Gn „ê}qÖ€ÒÅõTAŠ‚+o*áåßÙã2sQÅzÙ¤`7/ý*¼v¼Š<¶é@î‹·yÑìÝ·œç¥Š?.;€éÖ«Ü\¸‘b„ǽ-½Ñmë(à Íuq ŠîáÈ_LU–ŒŒcŒU/µÌA(Ø*in¶Ä…Ìþ½¨Ñ,y(Wvìœô¤š5”îÆ=ª8g7Ë”i­s#3y`mZêÅʆ|¢ÇvsíN†O6=ÝCQÛÊÒ3ÇÇ¡$ÑùªqƒéN <°‡‘ŒT2LþfÈÇ"–9ó¯ë@]-†ycJ’HƒØŠ‡ÏaˆI©$”¡9-@´A9ÎM4À3ÁÀô¢9Ib¯Áß5ÎJ´P= ‚€»GJHÓ`#9¦´¸ŒÔÒ,Œhî›ñÎ1N¨šF,BŽ”ômÃÞ€M¬NzÐÈ硤F%È=(f;¶¯Zr¨Z6üû³HœƒÖÇ~;P1Ädb…ŒØéÖ1Î )^ip1Šnâzt¥ÝÆh ŠR3H Ï4Î(£Ð™4¦ŠJJ1E¢€ (¢€ŠJ(h¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š(¢Š))h ¤íN¤ $ÿ,ÊǧcjîÎiH`€G½bª2v+Ó˜®'CÔÕÅ”=¨(„ä¨'é@¬St"osJ[Í6öÅ\ ƒÈ¤UUû ¥bš°ŠYwSUÛ»cŒŠ¼Ê÷€?ZPŠAÊg»‡Ž$\îSß÷7JÍÓÿ­VÕ6UTaJʬ>`÷ ,Tµ§wwšü„éWPö¦ìMû°7z÷¦õþé¨ly‡ûGù ²@ ‚2 "*¨Âµ¶¦j0‰fGq«V*VOñŠ’69eR}Å:%bŽ÷¤ú ~£þ©Þ«(‘¦v*\PêŽ0àïH-¥ˆ'RöBƒTžPÖ±Ä3¸1­`”ÁaòC}9 nAp¥4í§¨ æ)-T¾žTu!…ZuVR½Á¡Up€íL-©²„µ–&;WmЦžsÔ©5a¢‰Ÿ,ˆ[ÔŽiä=Z@£bŽ—þ®O­VÅ´Ó¬€ä©µcD@|µP\RINA‘žÙ —B¦–„Dìz1â£Ó¿ãîo¡þu¤` bG1(ªõÅåØΔ‹}SÌ“;O9úŒTPFÓý©ÐpTãóÏô­y7‘U‡¸¥EUP¾‚‹ —S Ì¿aòyß¿?…h2ô’­Ô'5gɇÌݱ7õÎiîªÊCTõ‹‰KL¬Xz±¥gÃ(‚+˜¤;ÇqšÜ€ÚšðÂîãBÞ¤ Ñ`qѯ:7#äþð§JâîæÝb!@?Ö·`€AíLŽ(“"žåE!’’ =NV”ãß<Š†ìn21¹,QIƒ*#c¦áOU ¡T@(°rô“,–P@ —Rr1êkJý zHCÕBƒúUµ†“rÇPiÒ":^àô¢ÃQÐ¥h†Mbõe`?3Yi:¦Ÿ4 ö`GçÒº(ÑQ  £ *6‚“sG~¹ f‹ Äù‚H¬í]‡çÛ'"¥Þ/uˆÞv‚ 'Ú¶ÙUÔ«¨e=AØ¢Š0|¤E®ÑEƒÀ‚Ae%Ôrƒ¸¡Qõ¤ò%¤Çf c5½,0HÀËl{¥À ·1E…ìÎnyEÒZC%Õvž;Ö–¶1eôqü]Ž#rÑG·r f,qȸ•U”üÔXj2;øòƒýÁT#ÿó~?ʵUUT*€¦¢¾g¯z kc7R+øf#äý 2!ö½JG;pyü1[ˆêC¨eô"’4Ž5Äjª§û¢‹ —SD6÷¸!Û Ð±BšyÜ1»$U—†pÏõ f¤ ƒÒ‹Œý#îËõ8¶½›Ìqøò+J8ãLùj«ž¸¢Hã|yŠ§2(] ¨¢f³•Àã þ_þºWIo J e'5®‚˜±Ä­•D ì(°r”$g¼F»ÏáŠ"C4“²ƒ‚?ÑuFp÷¡UUp íE‡Êf,€Z´g;‹fŸ,l‘BÄqëš¼cŒ¾â«»×öŒ0{Ð.Rˆ"kÐÉœpi±·”%FêF*ú*(ùJFDc–U'ÜP;Y©{ž)–yêÕ"ª®v€>”Çb®|«¦-ÐÓcBÑÈE\eVûÀ­( @¬S. *Á§8(ñ“Ó¬„@Ù 3J@#÷ ,VQæLÄtæ‘X,l§©«J({RRr@ͱ]”ˆ”Ó‰ß"â§<Ži €±;³O„pO­<€zK@XŽ?õC|²äô©ðh ´|±=©å­BœúÓf°ÅÐYتqÞ¢ ÆQê3Sʛר¨B³•¢ñ@˜02Í´œH’G)Ò+$›×œÐ»«R-¤F$ÉÉ5<‡u¹>¢¢Ù!< ššEÄGa@! 8ƒ>™ªáK£ÈO"¬Â¿¹Á÷ªå$MÑ€jƒÊÆäõ èÈ8ÍHð%@å…64yeV~‹@†g•òH*[7,Œ§½)ŽŒPŠšÚ#ÝM[ÛÇÔŸó©o?Ô­Gn¤\9#ŽIt B@ëš ëõ ôªçþB?ô«0!@zâ«”o·îÇýj`úë’ë8“LŒ.ü°ISRÝÂÏµÓªÓ äŸÎŠB{‰{ÿýó«ÕJí§ŒÀÿ»LkvPÓ¾ôŸAOÔÕ/ûÔ–ÊϸcN¿Rñ(Qži 쎕ÌvA—®ÐP(Rç w3Ñh¼ÛAC´~uGÊÂÀ@NzÐ)žCq,1ç @Î=M;[Ï,`å@'J’æÝ‘£’.v9ö¢ÚÝä‘å—ÀŒzÎå]†H$˜îR?½ †[fä… š¨až0Ðr9ÏZ¼ùVf>§iÏÖ„D_ú¹>µ[i¼šff#j’ô«zj2Fû†9ªòÃ5¼Òy`?¢·2 \œ†  ?þª‘­– ‘Žç«Kbßbd8ó ÝÿÖ¨î q8cã9è(™kS;¬Ôú°4©!‹K:„â—QBÖ¡TtaNŠúzÄܸúPWS/Ë?fûNöß¿ýzÑ’C.–\õ)ÍQò.vý—jãvìæ´f‡fžÑ/$.>´"b·"ÒÎÛ&>ŒMgª5ÒÜNìw ´´ØÊÚ•qŒ±ª/ű’’^3ž¢€kD]ÈÚr.ã’ÅIî@ÿõÓv›˜XÊ æ*Ìš{}P`ʧqÿ Š('º¸ŒÊH€ŸJB³”ßê#1 ¹ÛjŸF™6$„ÁÕÌ3ÚݼЀCç¯lÕ2Õ­ãf“‡|qè)'ÌU²ÿÄÿVþt_–¸Ôc¶,BqÒŸg®«3‘…%°sïK¨[Ê·+uŒdjÞé^Òg³žæ w* QUÄM-¬·lì]\ŸÖ¯YY¼¯4×` ïÞª›{¸Õ­©W`s‘Í"ZvîîI¬­Ó$qõÁÅ:%6¢DŽYç¾jk­5Åœ"3—ˆóŒçšm¬Ý^‹™À=;‘@ìî&½÷àúéVõ‰Ú> >> endobj 281 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [115.7139 701.8656 342.3127 711.4339] /Subtype /Link /A << /S /GoTo /D (subsection.3.5) >> >> endobj 282 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [99.3502 675.2861 412.4363 686.9756] /Subtype /Link /A << /S /GoTo /D (section.4) >> >> endobj 283 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [115.7139 661.7369 324.0703 673.4264] /Subtype /Link /A << /S /GoTo /D (subsection.4.1) >> >> endobj 284 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [115.7139 648.1877 346.0097 659.8772] /Subtype /Link /A << /S /GoTo /D (subsection.4.2) >> >> endobj 285 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [115.7139 634.6385 482.8863 646.328] /Subtype /Link /A << /S /GoTo /D (subsection.4.3) >> >> endobj 286 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [99.3502 621.0893 181.9186 632.7788] /Subtype /Link /A << /S /GoTo /D (subsection.4.3) >> >> endobj 287 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [115.7139 607.5401 465.9771 619.2296] /Subtype /Link /A << /S /GoTo /D (subsection.4.4) >> >> endobj 288 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [115.7139 593.9909 384.5551 605.6804] /Subtype /Link /A << /S /GoTo /D (subsection.4.5) >> >> endobj 289 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [115.7139 580.4417 482.8863 592.1312] /Subtype /Link /A << /S /GoTo /D (subsection.4.6) >> >> endobj 290 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [99.3502 569.0137 174.0095 578.4608] /Subtype /Link /A << /S /GoTo /D (subsection.4.6) >> >> endobj 291 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [115.7139 553.3433 420.0097 565.0328] /Subtype /Link /A << /S /GoTo /D (subsection.4.7) >> >> endobj 279 0 obj << /D [277 0 R /XYZ 100.3464 764.2205 null] >> endobj 276 0 obj << /Font << /F18 200 0 R /F15 235 0 R /F45 230 0 R >> /XObject << /Im2 275 0 R >> /ProcSet [ /PDF /Text ] >> endobj 298 0 obj << /Length 2884 /Filter /FlateDecode >> stream xÚ•YKsÛH¾ûWè¶tUD³|í-‰“-OÍÚ³±S{˜-R2+©T<ö¯¼š¤dJ“-WYý@7hàT‹þÔB)ã›$ZÄ‘õµÂÅj{,60÷¯ %4KG´œR}x¸¸ú¬’… ü4HÕâa½0iäÇ6¶°[âë$4‹‡üwO].UÞÍí׻믗Êûøpsw{ùÇÃ/Ÿ.6µ~ªÓðüQª·gÑ@`}c#gS‘o•RÃQ¥îÛæri”—ïW} Gjj<N KúihZþðT\.u¬½ÛûknÔ°4ÛÒ¨ñ:øU^ C?.uâIèEÇT«f‹;\Ù9Ï÷ ÿ6ýŒ+•w}{ÏS]Ñm«¼r»«Š-Ô8×g=,/›º¶µl‹‡Ê‹eD¡@7¡MY(b/ëøü]Çý;ŽgËc(3Dmv0…Ù#²®Êç_.ëù—K *f­ÁêM“UØ‚s æ ç{Ý9 q2Çýþ(3ðA•·¢³É&$$lÒ;>YÍÚVÞóDa84'>*Ô¶4ÆzNûØæ«%F^Q3Q»'k¥vã~÷-7`þÊß9eN|²D¡6ÞN‡p籞;Íš¿ïG€[pKVÙ®'VÎf¬I½u‹²á*±Sbºw†'xÁ&?rw@=ÿÌ-M>‰á˜EK‡3Iâ æín‚XLÚŒ÷ÙòÈ×ë߸Av¿ÿÔ·ã.oà‰xJöFYw‡{È5Ù> @úÁÅU6 œ¯MÞÆäíh`q4"H{bÚ;2MÀd†W¦ãkáB>Äì£/R28ÐÆ«¦ÍÑñ»ñ>£—7BDLdÙ á= ¿; €¦£Úb¸Bp4f ÀCs€ç,Q`éñR§Þ‹ )Ì= à9Y°‚*™†¶…‹c#¶À"Ë<䉷}­ù™#E¥ŠC"’8î>bF=lԘȋËÖ$ï–;N]Ø~ãĤ ž±«BX@|`ùÊUVU/g\é‘£(¬R–ú©º¦f’®YSÜ%ñ2 ¿Ø&ºx7 ¼à{MÏŒ!™`:SrlĦé$¦*´–ãmƪ gL¦ÃÈÛfýÞ©)Œ‡¸†S]Ÿ=Vã§?aø6Õ¡°©Î;Î…@¡¼ÃéðO;ŽÖ ïÌ¢ÑÑ¡7œ‘O‘ N¢;äU¡½‡œm™tŠÝÀ)4ë♬ڎ!ð|ÆöÓÛÑìC3z,dof†â!¡™z|ˆ7{ç|.å­›v[ä­IÎh ÷+žù¼ÉçÛ ]æÛéT„²@#ƼM€"5† h£ßa–ÃàKS`{È¡<(x)ë OŽ‘PV’™0´c}Ëçžp<柊3zû+ y¿^scLÎB‡î0:b`„˜‰Á·é™è•¥Ú¡oä²$îeŒD] ª#B—‡»}pßl²*f“`¶ÜTbÈ~Î:Žniô'Ù$«3tà—WN6Ñî éî(àDvp®ž9r”,Ú5½Uäèµ!7š á…_Ë,Dšfæ” ïÐZïÛ ZOš3±w³ÆW¡E(=Gʃ ;eÙÌžÌ÷ñQ#*y¬šÉ›ªF G&Ã1F0"*J5€t/¤mAÊà°¼¼e8œVÍn,*ä¼ìöL‘B®Ãj¯ÒeWƒqÍOxø½ÛcŒÜsgÈûÊl´>LTqÄ•Ýôöô²)W•ÌJISØ’R¢Çª™žWMÏÇfÚ7wùî—óÑrSpqT›EŒÕPªjå'*Ñ ã§a’Hyu¦†šÀ|œ.–:¶ÿrlIÜHS¹¼ÑŸä}ÿ…œV0=šf ɘÌÓüžË*m‰!`òÒÄÉ¿+ȶ3‚ëfÆÐõþ„Ãѽ›ÀãH=k€0åg±¤Á´q?+ L&5#ÖÜK ˜ø f©¼k³tIM ˆÇÏbŠ…¸k.5Ó7/½†ÆI&šE> I}ãknr˜½l øE>- Õ”Ül\-€æ´lÑ µrTæé7ÀûœPJâdÆ~¬ôèæK æy˜!8Ê0V NÃ*vc¥Êa2KÈäà_¹Ò5O¹MŸËoxžåX““<ëÔœTqu»é–gü¾ìf Fƒ‡T #•zh†¬­Ë”8³7V¬À9LÐ’£XÃB|+çœQ¾1jêŒzέmœqrbW»æÇ#k=§ 2ËòÆM¡9?ŽeÖ–Ö¡DƪkÝHáGls4+çR•å„¶ëÉL ֹƿüH>}ùò¦8u&ȼçôo7GPÙsßñxN__Æ‚ßvº˜âúæógbûéöã'hÜóð¤êÜæ¯EÍ,#¶ßú°Òr$¶—JhDûÎg m•ÕîŽt¥o35##fdÌAYµÊmLþ y±°p²)Nû.Åé£-À÷ècÐ~*Z÷ò<ýÀ€Ùãú}ä$*„‹<ýå9}^ÍHïLiú ¦Ö¡bþ>tS±ÑÅ‘îòÑ`Gq§ä´œåñÿñEŒ#ö”ÊaÍV’'È—ÝäBÅAÆWJSOü£ï¦îC§ÒÚ7q¢æ>› í‡i`pîûÅï‹h~¹ÐH“pñ ÀW)(c{¡BíG*Tn¤º¸¿øÏÌ·`¥­ŸF‰¿¿Ú~+#úü ®ŸhÃñ?Ta:ML„YAY†$dˆ”LDÏÚ¾ßýóêê™PïÙç»öHšÐE}ŒÉWm!%Þv…+ž®š¡P¹Û\íÚMµé®Ü·#¼ J‰7W+t´ô*¯;ÁÒéÑ—r¢ØW6M§Xúóç&Fßè¿?â8tVÍöêž¿±ìªâ#¿Oôû–K3³W¾=µÒ}mTzþÓ}¤|­sâ˽#sT(=ù…~²—cø*€ñ–endstream endobj 297 0 obj << /Type /Page /Contents 298 0 R /Resources 296 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 215 0 R /Annots [ 300 0 R 301 0 R 302 0 R 306 0 R 307 0 R ] >> endobj 300 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 1] /Rect [417.6558 308.6947 495.9258 320.3842] /Subtype/Link/A<> >> endobj 301 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 1] /Rect [112.3897 295.1455 136.2005 308.3544] /Subtype/Link/A<> >> endobj 302 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [134.2079 295.1455 140.9328 308.3544] /Subtype /Link /A << /S /GoTo /D (Hfootnote.3) >> >> endobj 306 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 1] /Rect [252.7696 234.969 334.7133 248.1779] /Subtype/Link/A<> >> endobj 307 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [332.7208 234.969 339.4456 248.1779] /Subtype /Link /A << /S /GoTo /D (Hfootnote.4) >> >> endobj 299 0 obj << /D [297 0 R /XYZ 113.386 764.2205 null] >> endobj 6 0 obj << /D [297 0 R /XYZ 113.386 727.37 null] >> endobj 308 0 obj << /D [297 0 R /XYZ 129.9737 125.6658 null] >> endobj 309 0 obj << /D [297 0 R /XYZ 129.9737 114.7069 null] >> endobj 296 0 obj << /Font << /F18 200 0 R /F20 186 0 R /F15 235 0 R /F23 305 0 R /F24 214 0 R /F36 207 0 R >> /ProcSet [ /PDF /Text ] >> endobj 312 0 obj << /Length 1955 /Filter /FlateDecode >> stream xÚÍËnã6ðž¯ð¥€ T,ߢzë6Ù"E‘>b ‡¶ÙVb¡¶•HJ³Ù¯ï<(YÎÊñØC r†óæpFj&áOÍ””ÂXog™·Bkéf«Ý…œÝò‡ ‰Ò „•:ŸY!½ H2{œI‘y"ØÅo®wzvY_üz1ûõÀP‘[ãfiæƒÐÁ$}·¸øæ½  “Èe®f‹»Y®E0Rv¹PÆe³ÅúDÏSP[&¿]ÝþòóÍíÕ<5Æ$—×ïa?yõÛÕ ßÏUr…À-ãßázñ;m!…1–ö®o.y‘ #4Ó~Ç{&¹a*‰4FH+9ÿkñãÅÕb0È‚‡Bþ¶#M:&"“5 -FA£É‡ˆ(/¬Rj°Y¡ÍeûªÈ¤Þ·åaçžO\ƒ&ȤÛÀ¹ªÅ…JZRpÕUõ[2²A»Töë ì­#vlÐÄ¢ách,ð#²(bIÇ ×ÍuÇÀ¿’=Ç2Ù1”°Â´šOÈo͘›ÛH2Ï$,]%ÁIF8›k2ùaЪºé<éD–ÊØ«Œábûò1¨DÌSkòä÷y°d5‘:ÙñNµgV·½¬Þ›°§…ñŽ2oKòϘJ3ð\û šÐ<À ØÜßOY:„ÍyÈO€)EÑÇ æ'#ڮ誶«V-¯ïê‹qÉ8.5n¸è£¶‹«¦Xq*€Cœ’Ébsˆ6Qb öÖavÔqO ÃÀà†!ž=Ú7­ƒŠÀ·o0 vˆMÑ•÷uS ^cTL ‚iÿ¬¶é[®¹æPáwW7½ŒžMG”[Á· 놹sT7@G õÙIÃCM% a½{(°F-™çáÝño3.*¨ª÷˜MŠÜpÓÃ@Ññ‘ǧ²©€v⺃"Ú o¢³¾¯w|kñfT,¬;s ±öÞÆ"<º^èÃ>fXÓ¯ñ@_¬G7èîÐì†1o¡÷Á Ì«Ž”JœId‰ScK´9:'Tد}¼çŽJ-ýƒÁ|ÀU±ú»ì0;s’¯bqžvÓ8§Öia^W1‹-kø'DÒP80¢Ö 뜗>ƒ¹O<ùWSyºOWÛ¹Ö˪³#?©Èѹ -ƒ yä¨3!³IŽË´­‹®Û3ëuóN›DI• ºÁY­Nèö4çZ(¿‹.&{o0F²ç›[`\@m«Ú¾bª¢ñfÖ\©|îúbäʬ7mrï{Þ >wMº¯éYêë«’úë£mH̹­Ó¨7mUïÙ!Ö2OÔ9ýó` iúFÞEGìðU•ýX›é2º/¬§›7•|‹U%Ë]ã@æ •] 7xZ›§Š>%Ñð“´B­þ&Ë»šn  -v±0Xº1£=W…b[},°}Bý”– ܼù¢J íBÁmÊ3*ê à&*ÙU¼>ƒEψĦ)£Cµº\yõcù0eA5tìÜÁÇ~«\ƒ¨‘hm­WžôHÈ3+ñíÕÀ’´y/¾éš’‹rB²áê#^z­tìp4\ª¡K;Ϊxn·ÌC.Ìͳy!šGF´ŒÀÊÁšpDP„›âX^Ñ1÷ŠGFlè1d'À˜ï^U—É~$MÚMM-Õûck Š@Ù÷¬ˆ?š @èó¦ìÏöòiqv¦b²ŠK:@ãòËü 1ûª}¥×áØ~rN*F¢pDÚðýG>:øW7Q7tä:|–ÒÈdÔà\b“²YÆâ>")@ê i rR•¨&Ãs‚~@ú%%è›Ef?Ëé™X2Ín̆ªñÌè¼I¾ãæ™Ü3ÕÓŸ‹ž,>™‰‹Ð0Á<]±1^Œ¿¯øEiÏÍPÝ­0泦}•|ÅÃôRľPu›ÑˆužM ³Ã­ôúqÏ•9YåØOcõD°Lüý¤8â©ã”F²Ñã‘î'XDVûÕ½´.ãùîñüÈ„³âOšC)È\,.Y”„Àè©•’ÌÐÏUSRò.–É<Æš>k0Ñ›áÎbœ€nÔòÁj:M]¼žƒÙÂ\Í÷ IÖS9Xt¯žÇe;œYÇé6PtÅr[¾=Û8ë/6Ó×·Ÿ^üty˜Àû×ü:ˆÇëww4†C7 é= é÷üacü]uøê•Ð:˜É«Q:¢šø˜ S™°Æ˜¡W܉O¹ÿ‰Wtendstream endobj 311 0 obj << /Type /Page /Contents 312 0 R /Resources 310 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 215 0 R /Annots [ 314 0 R 315 0 R 316 0 R 317 0 R 321 0 R 322 0 R 323 0 R 324 0 R 325 0 R 326 0 R 327 0 R 328 0 R 329 0 R 330 0 R 331 0 R 332 0 R 333 0 R 334 0 R 335 0 R ] >> endobj 314 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [313.5309 652.4149 329.4629 664.1044] /Subtype /Link /A << /S /GoTo /D (subsection.2.1) >> >> endobj 315 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [389.9546 652.4149 405.8866 664.1044] /Subtype /Link /A << /S /GoTo /D (subsection.2.2) >> >> endobj 316 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [389.2699 640.9869 405.2018 650.5552] /Subtype /Link /A << /S /GoTo /D (subsection.2.3) >> >> endobj 317 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [466.9543 640.9869 482.8863 650.5552] /Subtype /Link /A << /S /GoTo /D (subsection.2.4) >> >> endobj 321 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [187.7189 524.9358 212.1357 540.4775] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.5) >> >> endobj 322 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [176.8401 511.3866 201.2569 526.9283] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.1) >> >> endobj 323 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [166.5674 497.8375 190.9842 513.3792] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.5) >> >> endobj 324 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [172.8704 484.2883 197.2872 499.83] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.2) >> >> endobj 325 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [185.3553 470.7391 209.7721 486.2808] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.7) >> >> endobj 326 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [202.0826 457.1899 226.4994 472.7316] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.9) >> >> endobj 327 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [167.234 443.6407 191.6508 459.1824] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.3) >> >> endobj 328 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [200.2644 430.0915 224.6812 445.6333] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.6) >> >> endobj 329 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [167.7189 416.5424 192.1357 432.0841] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.1) >> >> endobj 330 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [166.5067 402.9932 190.9235 418.5349] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.3) >> >> endobj 331 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [184.7189 389.444 209.1357 404.9857] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.4) >> >> endobj 332 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [229.3553 375.8948 253.7721 391.4365] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.6) >> >> endobj 333 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [205.3856 362.3456 235.2569 377.8874] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.10) >> >> endobj 334 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [196.8401 348.7965 221.2569 364.3382] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.8) >> >> endobj 335 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [173.2643 335.2473 197.6811 350.789] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.4) >> >> endobj 313 0 obj << /D [311 0 R /XYZ 100.3464 764.2205 null] >> endobj 10 0 obj << /D [311 0 R /XYZ 100.3464 727.37 null] >> endobj 14 0 obj << /D [311 0 R /XYZ 100.3464 598.8065 null] >> endobj 18 0 obj << /D [311 0 R /XYZ 100.3464 145.9313 null] >> endobj 310 0 obj << /Font << /F18 200 0 R /F20 186 0 R /F15 235 0 R /F51 320 0 R >> /XObject << /Im2 275 0 R >> /ProcSet [ /PDF /Text ] >> endobj 338 0 obj << /Length 2011 /Filter /FlateDecode >> stream xÚµÉnÛFôž¯Ð¥À¨ØY8$'·ÄK‘Ü"6ÐC’MÒ2ITHªŽûõ}Ë EZ”- ˜ofÞ¼}©…„?µPÊD&KiGZK»(¶oäb g¿¾QgVc¬÷wo~¹VÙBÉÈI§w e]ät–µ,Ò™5‹»ò“ÐË•’RŠW·ü~s{µ\cÄå‡kØ×W¯n¸X*q…À-Ÿ¿ÇõÝŸ´…ÆÄ´÷áæ’.2‘fÜw¼gÄ PÂã˜HF°’Ë/w¿½¹º4Š] ‚:ûºÚÖ©ÞVMô6Id¤T‹T¥Q–Ù„ô.ëÏR™ª]Z%ª]A/3i"ö¸Ê‹¯UwðÏÙLü²ò-¬kÇ\$8ÂD6všÉ¯€¾ûºƒÿÍR§â ¡ÒköËl |2QVlŒÏÒJÀÐQ) ¨*5Zh#,]"tÅñOÈý%»ûÕ=\ÎËoÈõ-ÏÄOr䪈§%°õ8ä—µ‰RÏYÚL •©ÔsVYäÔ,çݪش%jy_÷GzH 6•§—¨4*v6г‘M^ÐS^“®Éû~3%e=T)+”Ò2ÐQQbÏÈ…¦Ø³ÑýÈÐheÔ8P•&Î D%ÄË,ÑrÞÌ6_w§Ž”ž±6YŒÖ´À ‹2u†þ#Z’ÜÔ£Ãò-‚ÕØñà$›9#¬Qž*˜TŸ¡JQØ×ÏcB°"zZ™TR¸Ì“R‘Ôg¼ÃV£>aTç¨Ù­‚)È&§\Œg»T‰4°‘çì@AU”hì—A5øLk'3PJ’3ºÿEáÞvu³›š1”¬wé’6gRŒ¬¸Þ*RwȧoªöyJ]ò1”qÔXfóÔ3ZU¹ëä‘T| })y¤£ft·Ì ¸:÷ù³CåÑe[ôÖ=žqê7ä+ªáĨ`AáGj¾Å‚d²T¸DQÄ`FËù<¹9l‘ñ9~" ,Êô•ÜÓûäé}¬Ë|ës6ü~Lˆ|ÑnóMýwÞƒkßRqÐÂA*»ÿT$Âý·˜–Ìx/-€^Än’ª!Ö}žð°ü¶ ÆLÀ–V“̉ûƒ~ÜÏiP¡Ê§bEª¤H D'RrWÓÐ\Uä¬ÕØÕVZCá¡ÝBU2ãÞ yˆÁSÃõÒ€Îy Y Pæ;£6PRG—?€ib‰¦ÁìîpÖ#eŠž’OC“ÂÃj¤=š¸¥ZŽX9#ÌZ§e´ ~K4>5o"-¿òÍOï©O@¿…­ò)§&›•m×qkÓÌ›új9q·8çd‰ tÈX\¥4yÏGä "±küÖà\D®·¬2IŸs„„ãê;Fí&'ÓaÉDòŽ¿%çn½Þ~ àcS¼-W ht÷ÈKÏô!ËWszõ‡!Œ;¶iÑàö¦äA 4X71fî/Ý#þÚÛ¿¦C¥ eû´ÇxRMË—Qí¶éy„*š ïžÄx÷3(çs¸¨ö=#Rìåâzf¨lf›Qã[ЦÊKŸÖ kŠ¼¾jýL¡yžÚÔ$¾o û–Æ£ME¾ì¢c¢M’2L»xÈ0Ÿ|ša?\R²ƒ‡b2%)N”øáX !1'ێח¿ó—‡3ðîŽÁàC²Üiv†¯%p6Šk˜˜Š,-WK¶/U>ÇÀ÷ØÌÝ €ós)S‚c¶´Ó‰«чGO5°#¶ Â%€Îëq¢Ä{ÿDq6û: ܘÀL°P(‚í}ùoBß cEèFªÌz[%‘3 <]t[bñn—ož;¤ß½sƒWÅ ÙPFãT|¼F^È Ä~¨ù‚GGs Œò#z÷¨ø—§C†»ý±·8ÄUÉ7(÷xÅcTQR(!Aº‘AW©Š´…&0±kõû&Õ1¬Bq*™’ïR(/5اZž¸QúÂæ`\ *L*Ã7Þ¬ÇGo3:eè `’Þ—õš¶ÕÊ®03Ñ’oHæ°¦ÈD¹j 10jsØ”¼ÙVUË»æjGúEÈ?3BÓž"žsF|C¾†'·:—²FOr°K_4Œ¢Žœg5Å Þ!¯F–a™a»FÔ’][‡SžÌ´„¼š˜óC”›–uî†0¸Ød”u.W¨äÍ-ßl™CC¯Þâ˜âzÍ;÷£Ïoøš 09XÊÍ÷à\4Û}½©|oðm¡ulýcŸ2jÜ«qö>PIÛ­G÷çêÜõ¸çqôuÁ»õ¿h+z¦­,µ'Ý%ñ?Üœé0>º’lrµÞñÝÖ¿ ~¨ÉÄ–Ø«8Õ÷D\øsŽQBO+0¶ãpÑWjýk­®ü‘ïpëuN¤LŽÆ@ ÚG5l&J..Cß解Ãð28 ûµŠ¡B­'M×yÇ9×ö¾h¬4ŸêQ™]RE+¯ŠöÓö!D«ß<Ž¯pœ7Ô™!äõPOÎ\+ÛzõJŸèá•÷—Ïȱ‹Ñ;Zâ‹GŠäD’îq˜Mi?HˆÈ…ÿEg †Wýã Ç@†«¾ÞÐ`ÜäTþaÓ†!¢¹y?üjz2’L'‹“`ì^ÌMx1?Píóï%1} ê?»†ß‘°¿ÎÌë¿5æ~j~A µLÎþÌ;ÃðÈhHendstream endobj 337 0 obj << /Type /Page /Contents 338 0 R /Resources 336 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 215 0 R /Annots [ 340 0 R 341 0 R 342 0 R 343 0 R 344 0 R 345 0 R 346 0 R 347 0 R 348 0 R 349 0 R 350 0 R 351 0 R 352 0 R 354 0 R 356 0 R ] >> endobj 340 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [232.8797 699.2754 262.751 714.8171] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.12) >> >> endobj 341 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [250.8797 685.7262 275.2965 701.2679] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.7) >> >> endobj 342 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [189.8796 672.177 214.2964 687.7187] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.1) >> >> endobj 343 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [179.6069 658.6278 204.0237 674.1695] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.5) >> >> endobj 344 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [185.9099 645.0786 210.3267 660.6203] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.2) >> >> endobj 345 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [218.4251 631.5295 248.2965 647.0712] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.10) >> >> endobj 346 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [198.3948 617.9803 222.8116 633.522] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.7) >> >> endobj 347 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [180.7584 604.4311 205.1752 619.9728] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.1) >> >> endobj 348 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [208.4554 590.8819 238.3267 606.4236] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.13) >> >> endobj 349 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [189.2736 577.3327 213.6904 592.8744] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.2) >> >> endobj 350 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [186.3039 563.7835 210.7207 579.3253] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.4) >> >> endobj 351 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [224.4857 550.2344 254.3571 565.7761] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.14) >> >> endobj 352 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [202.6372 536.6852 218.5692 552.2269] /Subtype /Link /A << /S /GoTo /D (subsection.4.5) >> >> endobj 354 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 0] /Rect [246.1056 285.353 253.5527 294.3758] /Subtype /Link /A << /S /GoTo /D (cite.rfc4035) >> >> endobj 356 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 0] /Rect [234.7286 129.8501 242.1757 138.8729] /Subtype /Link /A << /S /GoTo /D (cite.rfc4035) >> >> endobj 339 0 obj << /D [337 0 R /XYZ 113.386 764.2205 null] >> endobj 22 0 obj << /D [337 0 R /XYZ 113.386 462.0483 null] >> endobj 26 0 obj << /D [337 0 R /XYZ 113.386 364.0978 null] >> endobj 353 0 obj << /D [337 0 R /XYZ 113.386 301.2075 null] >> endobj 30 0 obj << /D [337 0 R /XYZ 113.386 208.5949 null] >> endobj 355 0 obj << /D [337 0 R /XYZ 113.386 145.7045 null] >> endobj 336 0 obj << /Font << /F18 200 0 R /F51 320 0 R /F15 235 0 R /F20 186 0 R >> /ProcSet [ /PDF /Text ] >> endobj 360 0 obj << /Length 2152 /Filter /FlateDecode >> stream xÚÍksÚHò»E•¥‡žÎÖV#'ì%°är¹Ûû ƒÕ‚„%‘ÿýõc$d‡p®«ýpE3ÝÓ3ýîé‘øÉÂÑ®ïßu”Þ`¹¿ƒ ,¾»’†È¥ã  \Gønˆ$ƒÇpŸº à»MñÓd¯ãòêþjp:P†Näjo`~è¨ÐÓHúvqõÓ A&'‘,ÖƒH9¡¤‹©½`°XýËRCÄVÏ›MçñÐÖZ[ãÉà­»8‰§8¹J+ÆÉœ×ß"¼øL(¤ÐÚ%Üd:f r´£˜vÄ8mMùií 1ü÷â׫xÑ)ä‚…Âè² Ý'"••è«|òˆôWJÉ:ƒpÀXƒ<@`=ØË€i] Ì÷-‡€”þ0šÏQl³².‡ZXÕ>«*¦É ^x‹DØ@JŽQ%0¿×—E l%/r}ânºV Ǹ"²n‰°¹X…ÖÓþÊ#.†ÖL 6B 4Ï›-ì¤iÅè;Ü=K>Æ€O’kf±®*÷ °¸è„J³/‰ï>¡ñøšë 6€*(»ÔŽçFŠdŸÎÇ@æ°–/,î;‘ö=ÒUF‚ƒlT¤»§:‡=õÍ9Óx®£•t Róß…ÔYE*°‰ Ž4œGYQ[Z‡*kÒ&/iYYåšÉZÛèȵ²Ëm[Œ‚)S±ùiãסçY)ÆÃÑl㣅€¤Å¤£¼ zn,µ.9À d#`…Þõ!ÒØË)E= QWÜ™~c4Ä9¦¨ëÏ{®£´áyw,Ú¬l¶™Ù *Ï]n¸“5wíLý»ðÐ7ÛÔ“×<esÎ÷5«õeÍV°[rv? )n9Ó)ËÚP—;ÞRÕœý)ú×(nŠ.'7“xM¶âÅ5ªRñüWÀSî M¦gc3-t¤/¢~º»&Ý »YæÅã1«ž8‡mNá:š?ä O8¿«GŽöéׂÎÓ¦$ žR®y¯©˜S¤TÕØ1tŠšÑÏ’—Æçk›¥ñ‰Ž f#…WÖ°Õs 3³JP„^“ÇáÿÇ÷ÇS]‚2ÅaÀfiKš¤(#ÔÃÐVTÑØ•Å&3&„È4EÖ“x¥øP‰vÙdM›Ì:ðXQRp™1äŸ1žÎy²ÍÒ|!}k<ÛµêmY58Õ çŠ'm1;Öz¤ 1ÔX‘Î)œ÷¦d!bK— ÏSöé·|?„$Cí·ËŠ p NXspTžÇ‹ÆµÃ¹»ØbP©"™‰á3i‹i¾†^Çâj%¦Va8Ÿ¤IêÃÎ ¬®__xÖ ç»'&, SbCJò‚9œ‘挪%éGÅSKÌ–h?†ÊÜk$‡Ïa $iQÿ9¤s 6œQðûúsmcÛfBÞ–W,k¾¡„PSXæu^íõvʃ>¯y¹G…Ûþ@¾Y¡ M†L%°úàU”ÿ“ÒuC ?_“À)·©I"»éByÃlôÿÂ@ Çeã=þ ˄ɲ×w+Æ@BØügõ*á¢Ê—é]« £–ieœ„Ў̲i; D±Ò)X+UàrÖ!¢'Ú/QCAk].p#íòŒï>ŠkÏš˜“Uº Þ©äKâÌ‘ð—Õ6=õ‚˜â‚¯K)Ç´ö_äãŽTNJJg¾ÉÉ5u{k ¼Ó}guØb.¶Àê²ImŽ‚Ê+ÔÑSÐ,´æÚõ­6ÄjJÞ}6¯Ï)Üõ;¨IgV„!Ê#ö5+†Ò¦Éö³”ò°¸ý '¦G wæBî;„ýÞè1O•@Q3l´ìÚŸtÅR…½×óbÓcî_¨]ȼ1éÜvÇ:ãlŽÇ”îÂd{Éغ³“é$^D/¢^VN» y?)Ú’‚ò›jÒ]Üm™¡`)Í5N²´&©òå÷÷pמ¥d•²ã‘šºÔv|gïéS"sËö[¯{áÔ%ø{7´=¥°ßÁáå“…5ÁSښϰ½1š|³øÀ€‘‰Òc³å6ºM•Ñu¶ìat Ž‚0ô¼šáæ^ûŽïûásÃc¯Ò–Ĭ>×zØݾ~Sµèjÿ©€£ ãº?»—“1zZÿAA¼áõ~÷ɽ„&ÃÀ#ÓŸ¶ËíRîÓ¼%ióüî9…6F1P¾v·Þª½yú/âÈ…Ç®ŒÀ6ðf†{¾ÿ$þîiÜÛ}jz{j:‘ÏáþÓ¸#ãž zš›. Á¾^È]ô›7è/ϲùå}<ÇÉÏ?ÛŒ)Ër•Ý0pÿ)N¾\ó¼ê᧳8If‰YÉW-.±ZïÒMm«ozlÌ’4‡Ž¦óÏqÒÜ"?-ÞÏ’ÉâËKüx> endobj 361 0 obj << /D [359 0 R /XYZ 100.3464 764.2205 null] >> endobj 34 0 obj << /D [359 0 R /XYZ 100.3464 727.37 null] >> endobj 362 0 obj << /D [359 0 R /XYZ 100.3464 675.6257 null] >> endobj 38 0 obj << /D [359 0 R /XYZ 100.3464 617.6392 null] >> endobj 363 0 obj << /D [359 0 R /XYZ 100.3464 577.4598 null] >> endobj 42 0 obj << /D [359 0 R /XYZ 100.3464 429.4774 null] >> endobj 358 0 obj << /Font << /F18 200 0 R /F20 186 0 R /F15 235 0 R /F52 366 0 R >> /XObject << /Im2 275 0 R >> /ProcSet [ /PDF /Text ] >> endobj 370 0 obj << /Length 1457 /Filter /FlateDecode >> stream xÚíXYoÛF~÷¯Ð#„›=x:iƦ ÕHJ´é-Ò™tHÊG}gv–¬$˪‹6 zàÌììì7;ÇîJ 8üÄ@ÅTà |ÏaRrw0¿:⃌½9FÇî”ìM­×³£çg"ÎBŠÁìr Ü…2ðÁZÀdàªÁ,ûÅ’C[pέI<ýqœLã¡­”²NGg ·ÎâIœ q2VŒÄ”Æ_#?;×"ÔPÊѲQrJLÈ“¤‘LY –ÑQŒ3àøð×Ù»£xÖ{ä„ ÝÃn÷Z{üv·üVœ))Áœð˜#„Ð~Ges;”•#¨š^šºº"tÉ&Òã]Œ‚û,TÂx!8ê†[†¨Ó¶7Õ5VWzž£¡šPöZˆôÅ‹¡íJײ_½zG§ñäåK›$Õõ¼Êòcb>~Š'_ž]oȓϧãÑ(1CEfäÒã¡‹nD·Ë ­õ.Wé¢1Êßjú¦©Y £ï‹µª0 EÉô<ž!ï„ŸfoÇ“Ñìòééh6'ÑûnÂ!d°Üµ‰›Æ'Èô¥ªØEZ³¡-=`G˜²ÂåÖtuÓ¤`¡ðƒ­iäÃþeöêwîý92€¢<ßµÏárÐõw`Ò”ÕUÕÚM^ßäuÃʼed»lÚUÆ@X4Å¢´08‡Ô–ÿÊݽ{(9÷¸/.L\©°#<îôB l‰ƒn÷Ñ{úV}\çõ=‘mqÕ%«g–½jòù¡xNãÉO}r éC'áLšqþ6NŒþyn²7Z/L-(cI»êX¸U‡L~˜¾1hF?c'„‡Ê»é Ú*Î~~&ùV;ò xж”b"pL3JW÷MÑkŽiÎv sè`Ð>¸Ö~­»¬”ÒšcóªJ˜wYÕW •ÕV4X”CZ­ip‚ܱ‘ΰ˥ØëZRÌ g§e†ŠzÆmÓ+—–Üi¤š*µ³¢¡Õ±‰ÞèN ñÄݲ}ÍËaÓsPjзËbŽZKHq.­eÚ‘¶øÔKZé+ìÁÀ•8¡%½ê’¾sô.°²œØ,¿é»øªº§–•!°&îµz«SZ /´½\[(Q$¬ëõZÍ3E£lÙä §Ÿ°>-6”)H-Š›¼!25:éº]v8 ‡Y!g˜ù œ‡˜éCü 1å­7ByÌó¼`{;QZh|{Úî§HÎ<8˜© À¬ëYYñ• Õç­‰Œ lÇt}‹,kuÀeª3±¨ÖC:Ðaª‚ˆ“÷ÑÏó¢ä I¾Aÿ)pK¨c e euò»¢i \uA b!PZ¦ZÜ÷­ vrOF˜B³PYHHJ$êüzuOä-ZE‡0¨E4pQ´$˜¯ò´Î3êÀj=PÔÑÉÕhAÐÀVçëXÔÈc!”w›.ávn¶ù‡‰í梋ˆNeÝ”ER£F ÖG€kû}3sByªONõG”¯uÙQ¢:hø%éu³'HT% ¤èWF´vc¾Zg; Ó}nMǘ0•&îHŸ$£Ä´¼VuW¼¦AAýþV•ù3"ugØÔÓå…ßµŽhUëíHÛ¢kT8 1ßí¦u•þ|@¬\×ëÇuçš»ü:ªpzà:O¼Žnª?~íµþ‰ëè8žLÆ“ÝÛ¨PJO½þÝ['ÿ—ne³J/V¯ÇÌ\tûÑ»Ÿ÷õÅ>øÒe>—êiOSI ÖϮdzC*Žf'xbvlª?ž½Öw|¬ü¥ôØ}¬üW)}ºT¥Ëÿï”ïöNÙª—îY8.ÿ벡´ïO—S'xô= þ•8endstream endobj 369 0 obj << /Type /Page /Contents 370 0 R /Resources 368 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 367 0 R >> endobj 371 0 obj << /D [369 0 R /XYZ 113.386 764.2205 null] >> endobj 372 0 obj << /D [369 0 R /XYZ 113.386 497.0765 null] >> endobj 46 0 obj << /D [369 0 R /XYZ 113.386 442.1829 null] >> endobj 368 0 obj << /Font << /F18 200 0 R /F15 235 0 R /F52 366 0 R /F20 186 0 R >> /ProcSet [ /PDF /Text ] >> endobj 375 0 obj << /Length 1968 /Filter /FlateDecode >> stream xÚÕXÝoÛF÷_¡G .—ŸNQ@‰äFE#×’Š4w½š¢mâ(R&©¸¾¿þæk)Úa„öÞÂÙ™ÙÙÙùøÍZjâÂ?5Q®ëh?ô'Qè;žç“láNîAøÓ…%;VŽïzÉÄwÜÐQeò8q($…žþc¿Io—{o2¯/n.&7'ƒ*v_; cÇ‹ªï·o¯T >9‰›¨Éön’xN¬]Þ%ŽÒA4ÙîþiySÜv­õbóëõj³˜ÚZkk¾¼¾uµX/VH|˜*kĆåïq½ýL,ÔÐÚ'Þr5çEâhÇcÝó´µbÊí¸¬Ü鿶?_,¶ý…|ˆPœœ¢èØC%ºràM !$n|Jˆ _)EW~÷nj^`Ýóæ™É®Øç—LºüÙ·y†ŽÁq6Æ0€Ó†›?\¬dÇç|ÇÄìxÏ„§ù«ôe_J¸®ž3ùió›å?0²nàZMöu'Ç(WãnÈj0Ì*Ü,Ñ!d_»Nà†!™œUíÓÔ‹­CÞpøï ÖM½çد†y¸|ćàªdêÀq£a¾I„QµOºgò JÃ[Û?þøq1›/Ö?ü`3§>dõΤãæ·Åú˦›õûüúÓl¹QÑGIk/>å»2½oEù±áï»ÁYÆŽž­6ŸkS†ùÛöãõz¹ýòš?Ÿ/·ËëÕì—¾˜ÎxÇmP[’¾ø€‹Ës;ª¶Lo[§9ÖŽÔÇlõej{!VÏïf§§œDEñ‹|ñ“FõÍ ÿÆ–þò}ÏÿY re½½òÜÑô='P±'˜–Ïm]Ö^Žµmà;ÚS>8‚ÚWÓØçfM»#ö)ОZõ~ë=+rž@Ìm³¬èX’VxJ¸õ›VøÇuƒÎtiW|%qùÌÛïꆉ¿Ì6&±ª0Jv¤/ˆ »•v?á«U‚¡]½O‹Š‘åñØûDAT댅 ®}'Ðpq>0%`G"¬[û6Ý=BI g$°¦ Tí¯¥] …:‰,?/AHÃ- )2Ê:”äL˼§¢{`Šl"‘"Hö&Cˆ®dÑRÒ¥ð0Ü‚ñС†aü2Æa /œ6’k»ßçA…èXÓ>ΩbðW|¥À1Oü "Ì«|_a:ði†¬÷üŽùÝC*TÆñóU-¬[H2©ã9¤ •M¾Ó¡¶j±¾«YS\ê °'ÎôÒ |2„·,¥åÁ°™Ý Åÿž[6vŸWy“vy;¼íH5“o^Œ‡\T¬»ú@¦ØÒ÷}¸ž/Xëèå}ÝvP÷#N¯®·ËO¿Âv/ßC7vH„Й`åzýi±^¿aÑ-hAK±Zi¼¬™Ac x0™˜Ñpõ…éÑ~ÿÄ+Âö+Ë1»¾õÛœ'÷ÀPÑËX”6R¾@ïÓ»\Y{N3w­é^¨tÑ£¤rr¨ƒOè¦|tEÞX>Å”ÑQÜ‹5Ç¢0Gaq•9ÞŒõÉADt f!Hy9¸™XÆÄ×ÈíX …6¼*é­¨~cˆgfRýgxqn¢î¥;Šßö) ƒ„ü‡A†uìA]PàÀA€v(„vé(ÐAT±9/°Bä`€¼FÍäw®„[j!tãâ!EïܤUËÌ'Ôî+s+IÂP)äÈMîý OêòÝXáIÏiÊ~º&ͤf0Pc3€¬¾a‡> endobj 376 0 obj << /D [374 0 R /XYZ 100.3464 764.2205 null] >> endobj 377 0 obj << /D [374 0 R /XYZ 100.3464 463.3904 null] >> endobj 50 0 obj << /D [374 0 R /XYZ 100.3464 414.4339 null] >> endobj 378 0 obj << /D [374 0 R /XYZ 100.3464 269.4894 null] >> endobj 54 0 obj << /D [374 0 R /XYZ 100.3464 179.7608 null] >> endobj 373 0 obj << /Font << /F18 200 0 R /F52 366 0 R /F15 235 0 R /F20 186 0 R >> /XObject << /Im2 275 0 R >> /ProcSet [ /PDF /Text ] >> endobj 381 0 obj << /Length 2309 /Filter /FlateDecode >> stream xÚµYKsÛH¾çWèHÕZ ß"çfGò®·9%+µ™šÙ-Rk%Ê!©qi~ýâÐ-ʦ]É!I•ÙF£4ž-äÑäû¡¦ÉhšDnxñh½{çhíŸï|Å™¤IëjõîýµŸŽ|ÏͼÌ­6#?ÎÜ,H§D-uƒ4G«â'O|Ïóœåüîóíân>ž„aèÌn® î\Ï—óƾ3ÇàNÖ¯0_ý‡AÀÈa7‹™L27tÁ½Xè,„€ï(Nèz.ͼñWÿ~7_Y‰¢,"F³øm±-ÖK¹ïLn£D?q#ß÷El7ÂÙ>±Dâ;ŤÞwÕæHŒ%Sg‚OâÕŸžVÙ€ó²îdyq»Âü†V®(%Œf?=§i! i>îsà&ïú¾ªüJ´4Mœ¼.d°0j¡ñCõ×8 ’˜M‚˜g6eµN0qjCë­ nhHs^bqh~”é÷Ä` •µîxOCgõ­¤–¥läôF‰æàcÜvyÓ•D„L¤×8Ê–é©ê¾áø±$I*G™¬Ax_Ó: =€—&ï*‚ÐrêlÀ4oZ3fɌП`ê9ë½H 6ö[Á“YOÈ4tHš(œkŒ A©÷ŠéNänó‡²wB^í†eÊI–($¶äó·•‚vG‘ç°Ä©jå{¦Äâ‚€IL®1QßJËc÷À¬)»„«[¡ª§-nábË%èÜ.•‘º}S"¯tÙ~¢0%û™ IÒjŸAs0ié´¿¬þå Ôj.J£¾ý`ÍhI{L'á{r.Hç ¢õŽ†ßXA´ZéáDY­Ø#á{÷BþéÅ^UO/¥€G4.ÛåcîªÅEÆ­8ø#ì4L¼šZ½…ž)ApÅ!«úqÊÐ9i‘ |ÑìöÓåͯw7 ŠOAà†Ó8fö/ë|{láƒíoC¡"ŽÜ0ð#’سr“Ã[¶P™ÀàAy`VÔ‰(ªQ°÷ ÅþZÙpwT$è“Õt©û:x?POë{<â€5ìíã8qŒÓµ$ÓÌ*˜,_Ödê»A<ÍÎïl·Çq,ÞÁ¾\±«w°=?¥ÜBwÚ°ÛÆ‘Æ §þ¬³ÜPz&¯ÆÅ qi XPÙou{ÇæÈœ0UØC!ªßÁ3ÙtbòºS»õA# ë =7Œâ¤ŸvM;õäðHÆDûsÐéåÉ•3$%ÃÖ™¬A »Çm¹³é©8ÖùN5Œ9ááVÕ› Jî‹"A$‘ ˆœ/ŸgPí%œe5¿à‘íä€I(וײòPv2`n+¥’Zr¹€´ùÖ3Ÿ½_|].ïY½ßw=<2º·³¹Ðß4ûÝP(vxáœ}!TRõ'}þ(à §’àÖmþ*ï]ÜiáëC´WHP¹BTrbšÝu®’ï‘XE xd†µ 2}r¿£ Õèî'»"lïÅ”&b&ªMcn’†ÏMø„kœLbßG‚\ý@Ñcm* $}W2¶¦„‰5¥  §q‹WÊJìc Ý7Ÿ>ÓÁ‘(NÉk™$ ÷½ŸJÉæf´±W£ØPê_e¢ëh÷M£ˆäÇidÕ ñ¬udN'hß‘Ïʦ2Û¸ˆÂ6®JJ²ž Ÿ:ª ÑixSÔ²Z8 î®)ófàepeþæ:ß×¥6ò5‡>uK\7ûÞ︨9ÒF&†#&Ø îþ^’2×w*/ªLFº‡ÈG/¯qƒõ{#©0”O_•®<Mæçõì–m© ™^ÖqqZ·›R£9ËVý´– {§i—˜ïNzú‰ðÙ®ã/ÊÔ`ŽÉ™è_$§uɦäàMŒ:eK%æF8K»ÉíkœÀß½Ò¿ý`#Wc/„‹öZCש`kÌÝU\ø¹ZÔi!ؽæÃëÚFÚþü Sf jèžþe.Iù‡L4óDx ¤º¦ºkæ¿d“ׇÔÁ—ê´+Cæ\•É  Šu^‚qéÅ-Æþ­âj½ÍÛS;GN÷Í–/Ú¶½rî@w)}`kšÆREËt„bõè.Õxì™J¡³†Í³±5‡ìÚ×½-×]?„šoטìZ›t’¨P Æ JêF¬éCbì…¢‚cÓrzÞd2ÈúÖY‡¢D¸‹e9Æ"9ȵÚR´0fy°…»¦¤Hâ) ™WVÈ­ ˜ÒkQ Ô[o¾<Åcí¸G‹XÄÊ_1…F͈»%ЊRï2ºçŒÜCÛ²x¿¬ìæ. œl·20UBÆÔÇÈšéüh|IÿdT°­ä2A'ˆâãJ.o¯ôÔ?@/ÇkǹžØ¿I„ðz[_çr›Æµ8$&½÷#„ãª^oq™uÂiª•önÏjE¬³íÌÓ Ô×Bìôò˜¾èS.$4é+%—%¶l(­SýfŸ½†ì#X–j¥·+»jgmÀ'¡0Ïì;Æò~,¹*À¬ ë}¾Ñ˜ú±c+ȶ¼KÙØ”ò¨€m…=R¾6Üú‹ë¤w¹êËRë×ÞÛ)]:åYt[W0e©vtõÙ[Bñ4±´)7(dÉÃùÎ_±O}«¸0m) ½0jbg¥††Kí×ç3<5rþøSw&çFP `(¾¨yG«ÏT51Ü/ç×4ûÂzD/òcðé‘ «Mù¸­ú/;{29™/MjŒ•ž¯>³€ÙB±uN^œ$»?‹åîóß8Ì Å€ ßþa§‡4ô»Î3R`ÐýG•ÿ&Ägäendstream endobj 380 0 obj << /Type /Page /Contents 381 0 R /Resources 379 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 367 0 R >> endobj 382 0 obj << /D [380 0 R /XYZ 113.386 764.2205 null] >> endobj 58 0 obj << /D [380 0 R /XYZ 113.386 727.37 null] >> endobj 383 0 obj << /D [380 0 R /XYZ 113.386 629.8135 null] >> endobj 62 0 obj << /D [380 0 R /XYZ 113.386 586.5247 null] >> endobj 384 0 obj << /D [380 0 R /XYZ 113.386 531.606 null] >> endobj 66 0 obj << /D [380 0 R /XYZ 113.386 499.1392 null] >> endobj 385 0 obj << /D [380 0 R /XYZ 113.386 441.4932 null] >> endobj 70 0 obj << /D [380 0 R /XYZ 113.386 386.7765 null] >> endobj 386 0 obj << /D [380 0 R /XYZ 113.386 341.1645 null] >> endobj 74 0 obj << /D [380 0 R /XYZ 113.386 270.1714 null] >> endobj 387 0 obj << /D [380 0 R /XYZ 113.386 213.1314 null] >> endobj 78 0 obj << /D [380 0 R /XYZ 113.386 144.2595 null] >> endobj 379 0 obj << /Font << /F18 200 0 R /F20 186 0 R /F15 235 0 R >> /ProcSet [ /PDF /Text ] >> endobj 390 0 obj << /Length 2183 /Filter /FlateDecode >> stream xÚíY]oã¶}ϯð£ ĪD}÷mÓ8mŠnÒu Ü ÜöA±åDXYòJòîMý3CRr¬l÷è[±ÀŠÉáðÌ™¡ãÏ<úçÏ|Ïsƒ0gIºJyÑl³¿ðfO4øã…¯•©ï†žÊf¡ëÅa •Ù§™ç&1+ØÉ?ÙIZðÝí^Í®›‹³Â~êfaÍIœº*¨^­/¾»ñS²Éͼ̟­w³L¹iàùd]æúA”ÌÖÛÿ8j¾ ³=gµ|øõþîa9_Aà\ßÞܹY®–whü0÷%2~…þú_,‚F„,»½»–Næ®Ýw" œ;YÀw´Nàz.õ¼ùïëŸ/–k{ <”f_w¢ÖYŒ•øÈÊÙ÷ò9;ñc7ô}ŸÏü®Î«—®¤½»ï±99*ÏŠB7P~H;A{ý\½aâ´E‡4Õç¹J¢éc×K¯¬»Ã|¡§€êFK{³Ä§cѾHóöÚE#vÖÐ|&cX ·ÔiôòÞ’—ÜêEmƒ=?ã[²‰N@Žð]%ä?p£0SlzwüÍóc^¢,jL‚A‰Gfîx}Þ—MM†DQì<õ–¤eý%ŸtÉ®BÚÏE¾åS{Ÿd`ÙNDwæZ©Ý‡ ˌǻ=:yUÉ1IIìÈiGnôÏìF\ ŸÇ;=Ⱦi MkVèÊjt&‚Wßhì6¤yßç›99î#/Ks\¹íSŒÐVŠ"Èó 7*Ò§Àp¶‹ç¦ëë|ýãØYà“8W‚tjåÛm§[¢qgâ$d6Í<àãÒ]ÉøŽ$;€ÌâØò±$oLÀÑã÷ qxeƒ ¨7Õqk}"ò¼ÆWÁ4¨àŠóJ|²ZÉ·¬µÓ ð0íȽ¦-{¸õE4:dZDÍNO5ðßÊÕË÷¯C: )Zýl+åIŽcú,¶òb¬ÍÁ©ÝTL ‹Ø6lkÕàëPxÀV1 ~øI¾Vþ¾R€‘FÄĬ*#Šõ“¿Ìä"ãybQìG÷u4ø,*¡˜Ž Ã,ÕÔ¹mRÑ“j\Uons@£Ÿ<Î@€O5àëŽößGécê!ݪ“(û¨ûæE'ÃzŠtÊ=óA±/ê^´oÿ}³zèÊsc¤âºy€ú‚TqÌnÁF4º3LI*¼*·t„Pk` °rê4ðÇ+ ~) ïÔò9rIðyN,˜WåVKëî è£ÐüæE‰o”úUÞËuõ¢ÿp°yGj¾(ä¼ÛŸÙ‹}Û@ºF21¦³çýúöý¯¿H‡rDƒ©‚Z’žú ¨eûBŠ›£©;€XÃv$BjýroY@ n)£¸"W7µãÐn‹×ÛÖzÁ»{êqZ¼}O-jÂJo§;J†åSýu’WcÌg–äwMïq%ÜjMº&Ì.ÌWli0Ëkô—&J68÷q[è„0šÞŽ &QL©e½ä‚ûÕûåŠW:w$.Úî«Q’ÓAaM_êÄ›6ƒäXj|‚XL¢^7dOêÙH¢ö ä÷bïà –Ì^4Äfб5@;¤W¢ìt(²è¼ ™Ž»,´W/Sb“GŒM•ëP…xê$/ñÖ!EÌ SF+ÚR­qâö_F)ñz ÉÈNùî¨Ë*–s*¥ïòzÎUwÕÛ­ž(w¦6yâ0Ú /CÚ69ô¹0… û37\³C!å߬+ÿÈ+­¼„åwVKÌy#¯Ÿrç \ô-¼ñO­üO­ümµ²ïY}Ì·¸7,ðBþŒò'ZLÅøSÅá9b å‹0–v4 µH€tƪPUHÜaè5‡Bö­šŽ9ÔO¦yÀ7¨ô“³`ba'qªkd?–0¤ï«ºX¯ÕÈà{ò¶+t`Ÿ-¯qÁä– À!½óL ©dâ¿«(xàGPfLSaä± ì¯#ÄÞž¹ ÓP@2—HÌÃa’:ÐíE…ýŒ†©9#óÿ„_ÏÅÉ!?"2Çòîtho[•ämÙ™‡Œ0ÔŽ7'Gr­—·o À¸J³ëPs‡zµNëžò­ê´Ò #.-5ÓAŽ§L߃…TVÊX•? ?VÿO0ú6õÇšëš/ì?ó›*ïpyY†‹Ãç,"#šk_–À?úLhŽ#‘uõ—BnŽ­8êLyHî?’¸£P¹q§§Wtb¨”F0ÕpÜk`.ì"ã0¦ìr2Pi<Ž¤rô>Æ h!½«4’P„ ÀA-cÚU*•j jŒÎW‹¿`SºZE•ø\¥©ç9äS«H@(AáP¹y‚ä'ßïoÔfü˜Œú0ïÉTÞkxK6ýßø˜Þ` ;½=ÕÛÄm;ªHI|Â:Z¡¡³ÖŽ=²•^þ¡,H¦8Ép5í7=†O¾úZ5~ínäÑ»-¦ßÄô²ág ÜC²¶oš³ƒ^m%g›ýù“`ˆÊ„¶îEÖd¸ä½Î‘¨ …ó­¦ <úÀN214¾Ï«1ÙëY«Õ¹f®Ó3@Nã„Å4»Ð™;䳑h#hÜ—SP7ÔÝ&*È©sýž4Ш¼ZVú¹r)B“[Ж›¡ÆS)U©ž•ƒŒäœ lÕ•¡ o<âŽè'Qµ‘G+4RÇÚú3u¶ÃàÛ¿àÝ ˆ @2ýÄ'Á/(wãÔ`)Õ+NJEš`«ÎÉUW[èìø{­e,¥öqI¢kKÚH?Äçv y°žnõa5uDïyuÄïûGBëIªÓ¿’ Âù7ÊKó‡……ý+Bàü!KÿøÕ5†R쯑#"Ô®p_ÿ 9übH¡¯Ò`ò/ Vi1ÒšøkJ˜P;õ2»|@Éwú;þðSàendstream endobj 389 0 obj << /Type /Page /Contents 390 0 R /Resources 388 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 367 0 R /Annots [ 397 0 R 399 0 R ] >> endobj 397 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [296.6954 296.0552 321.1122 308.9568] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.9) >> >> endobj 399 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [292.9112 184.9533 317.328 197.8549] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.9) >> >> endobj 391 0 obj << /D [389 0 R /XYZ 100.3464 764.2205 null] >> endobj 392 0 obj << /D [389 0 R /XYZ 100.3464 727.37 null] >> endobj 82 0 obj << /D [389 0 R /XYZ 100.3464 673.9767 null] >> endobj 393 0 obj << /D [389 0 R /XYZ 100.3464 606.0009 null] >> endobj 86 0 obj << /D [389 0 R /XYZ 100.3464 574.9795 null] >> endobj 394 0 obj << /D [389 0 R /XYZ 100.3464 519.8763 null] >> endobj 90 0 obj << /D [389 0 R /XYZ 100.3464 477.4268 null] >> endobj 395 0 obj << /D [389 0 R /XYZ 100.3464 408.7744 null] >> endobj 94 0 obj << /D [389 0 R /XYZ 100.3464 354.8969 null] >> endobj 396 0 obj << /D [389 0 R /XYZ 100.3464 311.2217 null] >> endobj 98 0 obj << /D [389 0 R /XYZ 100.3464 268.7723 null] >> endobj 398 0 obj << /D [389 0 R /XYZ 100.3464 202.2411 null] >> endobj 102 0 obj << /D [389 0 R /XYZ 100.3464 170.6135 null] >> endobj 388 0 obj << /Font << /F18 200 0 R /F20 186 0 R /F15 235 0 R /F52 366 0 R >> /XObject << /Im2 275 0 R >> /ProcSet [ /PDF /Text ] >> endobj 402 0 obj << /Length 2155 /Filter /FlateDecode >> stream xÚµXKÛ6¾çWø(±*Q”lõ–Íz‹-Z§õºí!íAkѶPYr$9Îö×w^¤äD»}‹áp8ó̓ 'üÂIF~´H&óDûJñd{|Lö0÷Ý«Phf–h6¤ºÙ¼úæ.\LÂÀOƒ4œlv“¦Ãy·…¯q4Ùäï½h: ƒ ðÖˇŸÞ­–ÓYEÞíýŒ{wËõr…·ÓÐ[bãço°¿ù†"Š´·z¸åIåG~ÂÍ7«[; +¤ùLÿØ|ÿj¹qÇЩöS•Æ/ŸÕQ}yX\6 üH)`&¾áÔxØ7UV>µˆÒ~‹€ŠâáªXâPÃ^H½z·¹ÿñ' þa:SJ{E‹ßØËN0vjà¯>5È,ë Ï´Eµ•¦=0.Ìkø.<#ë+\Ù Ïã©4Gƒz¬¦@#׃ezqÜ4(/;ôU£“Ø dR¡ŠHwÓ…öà°>ö> NHx¢‚Z-Ou53ü uŽYQÉвŽ;„–Æš ‡[æÊfÉ_Ãà\ÁŠ-˜f› C²HùÄ;2$á…Ì7Cášâ£³PÙí» €v® ~%x¾ðò3òœ§|<ȸ[fG™ÈMIëPŸxž eOk h¬Î:Ô›†3fØb:ag‰KÛpŒýé,^Fø>w.?¡·ž‚»z¿ÞÑçÍý£h¯NAI`bëÿáÞ7Oè€4ôK€ÈÅzGœ³ä4Y³Û|p¨"ß…ÆŸ„Š)L_x ;ð9Õœá 3u7£¥‰ÖúÜ£A[š"†ì)¸C.äØÙcÙóë>sBÒ'öøŒ<_@mxì/Ü@ixÒ†:†€­£ø=õž Fòæ¬$>ŠsØì,çglGs›ƒõ¥ÁŽYÙÖÜÊ «Ší¹¥/øÂ<ÈKAD«g\»^þ _î×”Š ù#þ­6.Y)~·ggS¯ãÕ;´`Ã\Aÿ/¾ø*ðiøªz_žÍ MÅ0 !ú°‰ŸØÍgâÑO¼ÁE¿ªfJäÄ#»#iÕ=|ÀöÙ4…i_Œ‰ágAq®Q,JX.ÂØÎN:­Î){Á79·u“‹ý`®Þ ½…ŒýUW±{ÝÜãŽ(š@Óg?$u¡f!]–ç¼ßvè=KÇÙ¦—m+©HƒR¶èKzP‹¸AºD$“¯£á÷å¹ÇÐÎB`,Ëø×eügâ8eÑ/¾½`­ûž¾V<ÛØMz-B§½Ê9NìLò=긄R¦/Àið:u>MÑxEÐÇ ±Â ÿÈggv_+ùáª& L_p¼‰LcªŽ§MC5ÂÐ ìJö–ùËÿP¨ç˘BÛ!Ë3Ê¡XUW+Z*GhŽƒá«?šŠ{ AÛíÒØÍ·ìø*¡fAçÿ"3èPÐ Ûõ±™SV><„ˆ_tüÍƼå ýnM1r½öm184‘#AXBè¶6ÀBçî ï·_ »K§N?†»”š°A‡>qB&U Ê´ÕàHÇ);3R“ 0Ùè„BXÕ+‹wÉØz …¦ßš)O$É#–mD}Ž^J¾Ä¯.ŸËòÿ¾¨Nú¢z Ecï#‰¤£t ‰$ Cé^S:¾rÌLDÞdÕ^ÒŒåŸm;Ó°ü£'ñö*e°ØJû_x=\¯y wW©·mawÆñ-VNª€3ö Ó›B–¸‚*(w=¡ cž @γ-¸q6“•Á'XB|BŸz=æ Á'£_3âƒO*pMp+«äJd‹r»¯…öp­>¯7#õ ÚûÂÝ —ñ¾´ Ì3qŒL®QƒŒJYñaêJ‡Ws, aÎÈçZ‰h‡rXcÀVþ nÀG‰!€ôbe”©ö¤+¨jŽ9téÒß²/©{"vwÁ5Þõâà6—¹˜‘¬«áxàÌÅ`-X2¹p'„ æän2ceDLsÖJæ¢Òˆ Û—ñ+€N¼·‡º°õŠ,gýå}iaùQ\þ ߥT¼Ÿ3`A5TÚœI¹"0£…Ôš|÷mDñ{õGÿ’ 0˜Õ‰²+ñi÷Š„kmZ,"Àž_阋{›Ú·ô£DÁ‹Ÿ  i*žák4psXšpüQaiG¥°Ð…¼&Å,í§a” Ê#ö±ÃðUFPžÚgŠGT9c™Š)ÜS´íS—^HÀ€†ørJï\(÷²Fö/‹¶³ é;J!†hHáþT–ÂÚ.ÍÏÏ•Áä?`±‘ÄÊ܃èé|ÄÿG.É{åÃHŒqÒ‚-müsió"%£É¸@è!¹›™«»‡¨ ý4ŽUŸî‰€Æ6ø¼XOülD1Ó¦¬zgóÜX’êŠjôåH2ÜÖü‹ÛÑm!Èä‹¡u=ÂÂÜZÆâšB³±µsÒƒ a'ϹÝã$‘'Oj²j~~‚þðUº]Ÿ1Ôi(¾Wugd’/¸ë¬éÆ°°£§IŠp‰\= ¡þž˜?œ†_þºÖï8¸ÁP~­Œ”Q è%“ô@8ñ1\”3Â×q{¤ QFwâ8îkù*–:%Ž_¸í] âÙ/\ƒ'Þ%ʳY Ž!ð%” ž†Óöy=d§ÑËOð¢±øÏXá‰BõìKøÈŽìˆÆÅendstream endobj 401 0 obj << /Type /Page /Contents 402 0 R /Resources 400 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 367 0 R /Annots [ 409 0 R ] >> endobj 409 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 0] /Rect [159.9655 256.3563 167.4126 265.3792] /Subtype /Link /A << /S /GoTo /D (cite.rfc1035) >> >> endobj 403 0 obj << /D [401 0 R /XYZ 113.386 764.2205 null] >> endobj 404 0 obj << /D [401 0 R /XYZ 113.386 727.37 null] >> endobj 106 0 obj << /D [401 0 R /XYZ 113.386 684.1133 null] >> endobj 405 0 obj << /D [401 0 R /XYZ 113.386 615.4846 null] >> endobj 110 0 obj << /D [401 0 R /XYZ 113.386 555.7995 null] >> endobj 406 0 obj << /D [401 0 R /XYZ 113.386 498.5988 null] >> endobj 114 0 obj << /D [401 0 R /XYZ 113.386 468.1332 null] >> endobj 407 0 obj << /D [401 0 R /XYZ 113.386 413.0538 null] >> endobj 118 0 obj << /D [401 0 R /XYZ 113.386 369.039 null] >> endobj 408 0 obj << /D [401 0 R /XYZ 113.386 309.7171 null] >> endobj 122 0 obj << /D [401 0 R /XYZ 113.386 236.8237 null] >> endobj 126 0 obj << /D [401 0 R /XYZ 113.386 164.1178 null] >> endobj 400 0 obj << /Font << /F18 200 0 R /F20 186 0 R /F15 235 0 R >> /ProcSet [ /PDF /Text ] >> endobj 413 0 obj << /Length 1878 /Filter /FlateDecode >> stream xÚÕX[oÛ6~ϯð˨U^$Šê[Û8[†Æio+°îA±åX¨-%’Ü$ýõ;RQ%k‹vØ <$Ïõ;”åHÀŸI!B™h”˜(TJÄ£ÅvOŒÎaóç=é˜&V†‘Pé( …‰,²Œ.G"L 1t¬_v‡ÜÂóííW{ïöFïnJ¦‘ŽG“ÄØPÙX#ë«ùÞóiA§0©ÍW£T…V Ú¥¡Ôq2š/ÿ ôxj‹àdzúöxv:O´ÖÁþá¬Ó“é ‰×cL‘8åýW8ŸÿAKÈ¡uÌNaqŸiêÐ0ëËÙþÃ}ŠPŒÿšÿº7w†Dà›>í<Ç3é3‘©±ì›*••íD&¡µ±![—Å!u^cäå‚°À&6 .p–->æmKilƒŸ˜µOÆ}ñœ®Ã8JÉ-'%˜VµÅê†mþ b¡CX‹€’(O¦&)úˆÌ·?¡à‡’Šk8¶ªûrb¢DYŽ “pjPƧ±²A^£Az•á E¹D¡Ê ÕN³ÄÆÑ“BåcBô]PÄ7yv×þî#Ã-:´ñ æó±ÕàÆlÃRJ»)Û±J‚3ð@rç–jŹ°zmˆÀ€,ÈIåðŸJÒ8P†ôƒ:Ìv[¼ö±Û4$ æ jô‘ÌÆ|Á”n×93Ð…Ù6çålüm_åJ½Í6Åç¬-ªu“JJEQœŠïªñ^ó&Píȧ/k§d“mÉWNhÉcgÑ•z{g ôåã c$/†l(ÐaäÔ >ȦäKÐ#Q"%=Œ4\¨ `B†i+,Ô‰Ra*#‡‘5œÌ€ ès@=ĵj{‘µj´°!ãMÂ*ÁXç \ ÛUÙ`.icP#Ú›½áùzãÐ Ö[2-[ä`*¥ {jßaÒìÕVxWµè+tMîø&:±€¨xa’ÜÂQÇ2³ätfÐ%rE9ÈtÆC¹ Ç“Ø‚gQs¢U0«0uq»]g­ã§d«Û¡¸¯jr(0*´æjDZK‰„à[b dÃî ²:gby×7 ´x†;:È6fé £"«.YÈ… 5½Õâ C\fõ»Ò—l5\±Jrú“BtpÀÊ«¢v•qF—Æ ¨WbžT䨀ÍÝb†°†œ9w›Z—ËàÆŠäÉž¦Óëiä!ß×0;¾_k³ÊÚ@YßÛà‘‘êïЗL¨l×2’P$ƒ}éǶ im©ûì‰TAšðüÿ¢cpå£êþkýÞ¿Fø÷5íB»vñûXƒÍ5Wè›E¹ÛžQ“À=\˜ðð ëÛ¥:Až\rÓÈ('K«ÉëOÎÜn ì:FþË]^Ü;àI«=¤qçúõŠeŸÉÄ—¼ó¬¸Ex+))ÄlÞ/¶¿¾ííR>ó•ÈÆ 3J’3¢v©–ñ0Ð"Àë9U?sÒº‚ô*:¸kÖÕÕ^†·ùÒûÌ0v¾¼T&B¦¤æË2ÛÜPØ›Cñ‹£ÚLÖ!÷k{—KT¯ÁhÃðÆ ^WuçÓEËš ¬gkÜ"€ƒ]‚ß ®óv‡Ó2ï[׫†D†*NàkKÀ_a\5D®Ê ®ZŸ+Ô"|ò›¡ZB!òm^BaÞ®ù‡}jº×”ú‚"€w &Bä!’Š’·Á0K~Q ±Æ|—ÁïÄ9N¸"˜Õ9%I»¹Ã!ú^i~d!¯â¡ „KGwÅìx~xôvŒï@šw‘©± qeQQ(–þü3œT®‹Íc ~àA@5]Ä\4gÇ0!x‰IýÛü‡'gï÷€åå!^8ãż®ýþ}•š/Èrõ I¾Ÿ¯2ôÖ¦åçňªƒv΋˼dìR‘ß¹Æç^0½Ü{®íØê(Xð7,Á¯ó®®›ÜÝÐu‰«{…„q¸Mý~82ÿìcýÖäªê÷ërÂÍ´ð7QR–çrøÝãMtå‰öµëŠ¬ûœûv@çÖÌ$¥,Yák5vµ÷kµ¸^ÕwJôðýÁ /`RÐGO°Ñãm'pîhzrÒÿò1__ ¾KÅ  ßC'¾áвnxºWÓòs§O5<ìòYä1sx°Cú¼`À„;IRûYûTj(Kñàù›¡º<À­ã“£)œG×(ÑóÅ¡ÆÀ[¨rãÚ-œ°;‰F?‚küæ½ÀÓ·Â sò·Ìý‚/c%á@É0àÐw‹F?¨¢gyºc¶Hs¯×ʘßg°Ñ•#Ð㽋¢¥>‡å+JˆOr $ºhøä–«Í5.à§/ЋºÂ¡.²¶ƒÏá²m«{èyç±Ú¡(\rˆ`ùöÃÉ;Þ‡Kw®èËÊ,2ŽO¼Â Æö‘îšyŠÒè¡{Âû¿ƒv?#°ZÄà¡Ó¤Ç5ð£o”mEÚ Cð§ßÀo¯7þ ¬Tjiendstream endobj 412 0 obj << /Type /Page /Contents 413 0 R /Resources 411 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 424 0 R /Annots [ 415 0 R 416 0 R 417 0 R 418 0 R 419 0 R 420 0 R ] >> endobj 415 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [167.7189 699.2754 183.6508 714.8171] /Subtype /Link /A << /S /GoTo /D (subsection.3.4) >> >> endobj 416 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [156.234 685.7262 172.166 701.2679] /Subtype /Link /A << /S /GoTo /D (subsection.3.5) >> >> endobj 417 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [187.8098 672.177 203.7418 687.7187] /Subtype /Link /A << /S /GoTo /D (subsection.3.3) >> >> endobj 418 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [194.5977 658.6278 210.5296 674.1695] /Subtype /Link /A << /S /GoTo /D (subsection.3.3) >> >> endobj 419 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [167.7189 493.6905 183.6508 509.2322] /Subtype /Link /A << /S /GoTo /D (subsection.3.4) >> >> endobj 420 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [187.8098 480.1413 203.7418 495.683] /Subtype /Link /A << /S /GoTo /D (subsection.3.3) >> >> endobj 414 0 obj << /D [412 0 R /XYZ 100.3464 764.2205 null] >> endobj 130 0 obj << /D [412 0 R /XYZ 100.3464 584.5045 null] >> endobj 134 0 obj << /D [412 0 R /XYZ 100.3464 406.018 null] >> endobj 421 0 obj << /D [412 0 R /XYZ 100.3464 343.9702 null] >> endobj 138 0 obj << /D [412 0 R /XYZ 100.3464 308.2981 null] >> endobj 422 0 obj << /D [412 0 R /XYZ 100.3464 245.8435 null] >> endobj 142 0 obj << /D [412 0 R /XYZ 100.3464 194.501 null] >> endobj 423 0 obj << /D [412 0 R /XYZ 100.3464 129.3191 null] >> endobj 411 0 obj << /Font << /F18 200 0 R /F51 320 0 R /F15 235 0 R /F20 186 0 R >> /XObject << /Im2 275 0 R >> /ProcSet [ /PDF /Text ] >> endobj 427 0 obj << /Length 1312 /Filter /FlateDecode >> stream xÚíWMoã6½çWø€>ˆå§DõÖ4N‘bá=t{P,9bK^Ii6ùõ;3¤d9•×E±Ç"€Ãáã¼y3$%gþäLJ͵‹gIl¸RÂÎÖ» 1{€¹_.d°‰z£hluµºøáFº™<©œ­63™ÄܥΚãÊY=[å23¤‚}\ÜýþÛòn1´ÖìúöÆÙÍâãb‰Ÿç’-°qç篰¿úƒ†ÐBkCc·ËkßqÞ¿¼»ö#š .æ­~½X¬&5CÔº¥ÐõÆÿoÆI´/ƒMSSÔî(‚Ùº8¡Ÿv{:!V)F¬š2 [­Ÿ=u°¸ò—G‡žŒHC¸¡áë‹&_i9 î_»",zÁ!ô 2ˆV|~î3ƒ4€HLµH•lˆ Ô7ÚCœâ³$`]…Ô“¬ @w[{®`ä´rK¥x •›§<!hóÜgq3·œ5ý—8I½lýTtX©uìÒ›ŸPjLªŠÖÛfß#í@à“°BqÍ40“l¬f%ü*<3Ó˜98rÒËãùÃ&°&kªÅcíHÎ1²áI¬…dVM找œŠ}eXÊyÙ¡l5TÃ1¢íÄC+«â€h¹V“ˆ÷.ªíò¬Ë¢®Ûî ÷UÊž÷t °5b›XöÎ žØIè*ÂtÚ{dŒA ÷ÆúàÆ©‰™t6@µ8¿©:šÖŸ#òfÀ‚Ü–BëK&“*÷ì™Ò?ʨ2^Ç|ãÎÅ tO4áNEÓ'Ë‹¼jÅ©W%ϘŸCÊ)pÕ“jå[ûÛ¬m£(e/LŒÂ¸³ð÷ÁÏãj%|?C9%ïá(jŒP7(Œ>}¥AZö"9±/zOçž8.±>µ\à,M@êDuQdºró:Æ1ˆÆ%$ÔJœ­| ´¦ tëèósÑeÂP§Âÿ ÈÓñŲ}¨`³|¼AŸ¹70ç6¨¢ò Àlš¨ªñ .wþÊ—ìÝiàú¼SÆ1}Ö鶴3(þciúÜM…ÒLžÆðʬæNƒ0ý±DE…QØa®¹LtýµžŸ{›Hö#ž¹Ij<à ùª|šËòy‡[ŸÚQS´²5zõDÞ…¢êÃM›f»þîÚà11ò9³Ë¶å[†O1ôO*Áà~P‰4ßÕ)²ýâ'1E·˜NÁßÑÜ]2ýé80n{ÿȇ•…x*•¦SÞþG)÷SÊá<ñÓÂó(rp"QpZ+eàF‰§^uÑðpp{Ûð˜ç껼í–|…þ|˜øÿyS<^ΘSÏ;MDÝð¼ãï¿õú³XÂ'œÓßþ¤M}ѾƒBÇ}éM~\NìøÊendstream endobj 426 0 obj << /Type /Page /Contents 427 0 R /Resources 425 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 424 0 R /Annots [ 429 0 R 430 0 R 431 0 R 432 0 R 433 0 R 434 0 R 435 0 R 436 0 R 437 0 R 438 0 R 439 0 R 440 0 R 441 0 R 442 0 R 443 0 R 444 0 R ] >> endobj 429 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [189.2736 489.0053 213.6904 504.547] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.2) >> >> endobj 430 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [198.3948 475.4561 222.8116 490.9978] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.7) >> >> endobj 431 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [200.7584 461.9069 225.1752 477.4486] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.5) >> >> endobj 432 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [236.5161 448.3578 252.448 463.8995] /Subtype /Link /A << /S /GoTo /D (subsection.4.3) >> >> endobj 433 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [185.9099 434.8086 210.3267 450.3503] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.2) >> >> endobj 434 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [186.3039 421.2594 210.7207 436.8011] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.4) >> >> endobj 435 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [200.7584 407.7102 216.6904 423.2519] /Subtype /Link /A << /S /GoTo /D (subsection.4.6) >> >> endobj 436 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [202.6372 394.161 218.5692 409.7027] /Subtype /Link /A << /S /GoTo /D (subsection.4.5) >> >> endobj 437 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [221.4857 380.6118 251.3571 396.1536] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.11) >> >> endobj 438 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [250.8797 367.0627 275.2965 382.6044] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.7) >> >> endobj 439 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [180.2735 353.5135 204.6903 369.0552] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.3) >> >> endobj 440 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [180.7584 339.9643 205.1752 355.506] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.1) >> >> endobj 441 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [230.516 326.4151 246.448 341.9568] /Subtype /Link /A << /S /GoTo /D (subsection.4.7) >> >> endobj 442 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [241.4251 312.8659 257.3571 328.4076] /Subtype /Link /A << /S /GoTo /D (subsection.4.4) >> >> endobj 443 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [209.8797 299.3168 234.2965 314.8585] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.8) >> >> endobj 444 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [179.6069 285.7676 204.0237 301.3093] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.5) >> >> endobj 428 0 obj << /D [426 0 R /XYZ 113.386 764.2205 null] >> endobj 146 0 obj << /D [426 0 R /XYZ 113.386 727.37 null] >> endobj 150 0 obj << /D [426 0 R /XYZ 113.386 600.1676 null] >> endobj 154 0 obj << /D [426 0 R /XYZ 113.386 174.1354 null] >> endobj 425 0 obj << /Font << /F18 200 0 R /F20 186 0 R /F15 235 0 R /F51 320 0 R >> /ProcSet [ /PDF /Text ] >> endobj 447 0 obj << /Length 1918 /Filter /FlateDecode >> stream xÚµXÝoã6Ï_á—2°æòC”¨¾%µs—ÃÕÛ&ÚâzŠ-;ÂÚR"É›¦}烔嬲èÝ] ‡Ã™áÌoh©‰„ÿj¢¤&NâIšÄBki'ëÃ…œì`ñ_Ê Íœ±ÔÙ$2‰ŠLž&R¤ ôðŸúMžñþæ 'óúâç‹ÉÏ'…ʉ,6v2K'´³E¯Vﯕ›D&35Ym'™ÎHÖeB›NV›ÿEñtfËèvq÷Ó‡åÝb:3ÆDó›kàG׋Ûʼn¦*Z qÇëW8_ýB,”0&&ÞÍrÎÇr—a¾¼›3Ç)äôÿ«ÿ\,V½ 1ÄÄe_›—™ …ÈI«†N*m„N`9U©pÎ&äå¦ü]*S4S«¢¢ZÓ¶;“&Ñ#ÎòõÇ¢CoZø“Y}Þð.4Bi‡§Hˆº6Î4©¯fë}³ÞÜÞ²c?—Vj¶¡@g¢uÁå¤ï,‰ l7ß¡î×Ê6³#è©>Vð·žê4zFj†ÆÕÓ0Ö5 .Ú[< $´ˆ… Ç©ÔèH'™Ç)a³Ñã*:î‘5•wµ¨U'¬q‘ÒÎx­ÊB¿Òª¼Œ|ó„Ê1ÔQÄ ÄÓæ»ös»¥?ÁX›F.FÒ™péAzÀðàmEÆ'? Y ƒ‹Ôkµ.3‘5Ak"ô[¡§ wåöe¨x`¢×•Z%#¯Ëˆ8~Cק)„´hÚ²®ÎÍŠ{UÜ×^“„¼Õt?KÊ^ÉÑlŠÅ3É2ý™dÓGCK§#ÕŸ*Õè Þ;l±©ZyR Ì×_ÖÃÖ¯¦Î@Hó=«¨Ð@t䀩}Où<´·Þâ¨CÅo‰@/×tÍäë÷˜çÆA¾Xf¸4ŽËF­Xxð[ç(´é#…°óIÚ=øœ¢#óƒ/Ž| òÝPeNsÈ÷åŸyWŽÖ¥JG™ŠÓì5‰dÿàELÿ=fƒ·Èob{V!{žq±ù¦ÁL –™Püïñq̃²ÏW´‚)6`E - ¯þ1òj€%2k5"ïLk!…†`4t±Äw1õ»0m=! xÞå³®ÛÐÏêøˆL‰Pjdý μêps^s¼väVÀ™†üB{Uâ×F¬Õê¿Ll›úÀÛî>LŒ.™ï[BpŒ¥ÎÀØRD³8e£K Q’D÷ån­i¤ÍÌú}Z‰ò›ö]O] ©6Å6‹–¿Î?À1?^Þ,™ñ„&M‰–ãb £‹nu7kùž<‰*ÔWÇ’ìÜ8s¬æn,è¥DBâq yÀ Aì CˆFRi‹1‹c8ôGâ6]ââ×òÈÁ*9˜[¼rÚZöà°G#µXæLåí­`âß5rŸÑäâÓ2Uô’”U—-ë>óð0Z” .£-&“Ñ>Ge»¾"œ•y¨‚¥ë¦Ü‘áTUÀXQÔ¼.*¡¡¸÷åϸæj°”¤ø…|„zP™ 'Òœø†ê›1'®ú×[Æ5|l‹‚S$+„*ù~jFg¨Õ³Gš®uÍŒOS›€†cáá o??†# Ä™Þb€|Ù˜ítÙ(s3Ž‘8aÇàm˜ˆÌ$XM€V[òú²Ê÷/-ÞoûýX ZÕ*†`QŒŽ;>ªôxzõúÉÛÖûSFmOÂÈ\ú§p&F.UBÛ4#€KµÒàâ3€»Ï7¨ê *ýe†Æïò{ …M‚lRŽ‡†.æãF<Ü ÷xàK}aæ–õñ„ {Nðì7A - ôÿmPCCòWù.äFçs¦a›}ŸÛR³å0{[7 B’ OsÚu'YþÉ÷°ñ_¯3ü„§–ã¡Üñ[Œ:•2çÖû—^428ÌL/€ž/ÑŠX…ŽÇ¯ÜQWÒÄÉè¦c¼j¹‹4^9w+ ^½Öñõ„{ÓŒÒo~›P•}2šsS‘Ñç$ðnoqõ›!](HwÊ2ê¦`Šl½§7EÑð«o¹b’§ë‚_y?¼•oƈ75? ½übŽ‰C׳†ƒ^7›ðîÀ\¶¶Þ)M‡1 …Ã?ã|úÿw7V_‚aù:ÿ“³üÏôµàè É´Ï`Ä6I ;fPdÖ{èU-3òÊÇîË‚î©^i‹µO:žóh‡¥1ŽÁ=tc]]RËù«J|5 ÃýÏßV-óÑü ˆ.PÅ•Ôê_xµ uS{±0žWFŸï¸'à:Òë}Þzö%Ú¯¹‚p ôêm 6‹Šß,¬îØ„Äd«q,}jz«é-r¤j£†RžÌàBÁ·©<€ëˆ÷0òÖ?Î9k‡Ñú¯ T„fô+Z/4H|+ŒS Ìzeh˜²o|¸9ñ/ îHendstream endobj 446 0 obj << /Type /Page /Contents 447 0 R /Resources 445 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 424 0 R /Annots [ 449 0 R 450 0 R 451 0 R 452 0 R 453 0 R 454 0 R 455 0 R 456 0 R 457 0 R ] >> endobj 449 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [176.234 699.2754 200.6508 714.8171] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.2) >> >> endobj 450 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [219.8401 685.7262 249.7115 701.2679] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.12) >> >> endobj 451 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [172.8704 672.177 197.2872 687.7187] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.2) >> >> endobj 452 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [205.3856 658.6278 235.2569 674.1695] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.10) >> >> endobj 453 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [185.3553 645.0786 209.7721 660.6203] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.7) >> >> endobj 454 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [167.7189 631.5295 192.1357 647.0712] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.1) >> >> endobj 455 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [173.2643 617.9803 197.6811 633.522] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.4.4) >> >> endobj 456 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [237.8401 604.4311 262.2569 619.9728] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.7) >> >> endobj 457 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [189.5977 590.8819 205.5296 606.4236] /Subtype /Link /A << /S /GoTo /D (subsection.4.5) >> >> endobj 448 0 obj << /D [446 0 R /XYZ 100.3464 764.2205 null] >> endobj 158 0 obj << /D [446 0 R /XYZ 100.3464 519.5219 null] >> endobj 458 0 obj << /D [446 0 R /XYZ 100.3464 423.0374 null] >> endobj 162 0 obj << /D [446 0 R /XYZ 100.3464 388.5936 null] >> endobj 459 0 obj << /D [446 0 R /XYZ 100.3464 328.1074 null] >> endobj 166 0 obj << /D [446 0 R /XYZ 100.3464 295.7847 null] >> endobj 460 0 obj << /D [446 0 R /XYZ 100.3464 235.6971 null] >> endobj 170 0 obj << /D [446 0 R /XYZ 100.3464 189.8252 null] >> endobj 461 0 obj << /D [446 0 R /XYZ 100.3464 115.7899 null] >> endobj 445 0 obj << /Font << /F18 200 0 R /F51 320 0 R /F15 235 0 R /F20 186 0 R >> /XObject << /Im2 275 0 R >> /ProcSet [ /PDF /Text ] >> endobj 464 0 obj << /Length 1331 /Filter /FlateDecode >> stream xÚWÝoÛ6Ï_áG ˆ~‹ê[Ò¤C‡Å-loÐõAuäXh,'²¼$ÿýîx¤,·®3ŽÇã}þîHË‘€?9’RsíÝ(w†+%ìh±>£{ØûíLF™q¥®æg¤IÁ QÈÑ|92*ç^x Ú5ˆÞ7(Išª-ñ»UEÄü=)ø†25™â?í‚ñ·‚Å-f2j‡£±ÜÆ…@¢Ú€ëéØc6Vžm`Ü¡Z³nCBOÀۉ଻UÙ‘Ä vÊLåìß WñXðä‚ïÀøVGñm0ÕñllŒa“œŽ~Ü£ÿI ¸ñ v¦È¼Í°úSNb½öB™ ílÓ£B˜—MùðºEÍÛwDzb ×JÈJÏWuH¾`ô•ìkü=EŒnEéB5á,ê† NÅìa…âš×-Ï©dÕË"Ôê±#±çUJ~»W{õPÉ âô%êv@µh+Ô0,¹²y¥¹5=ùûúfêòãí*Ë®ð0TÜÓ²­ºêl¶´¦r)—ÊüJìç¢ ò["©’@ÄJÂN(¦JÙƒ-ú:È‚4°ÿRÝE~ÝWŠPD„åë3Dƒç¨EB tq%ØC }pë³V>Ä }ËEÊ1êhî‰û´fº&ˆav$¸Õ‘ÌÑ4–Ü[Ó¢jq±iéЦ9a€¶žûÆ]#‚èHüÔ/z]²¾eB8ÝôZãTìj «\ÑxšV˪­Â0YLƒáœLƒÍæ–;!ÌéA=”¢A}Ð@?)C7¾È¯?U0v…ToXMRošÕ‚kkóC»0 _ v 9¸£êI†EÎý~o—6º”¡Ð¼Qì6ŠýQ¶In3ؾŽÛ·å–ðÿšy“6Ëqî<›E©é†„b鬆 à"RBË8{>·™[0p-iv!Øm`ÝÕcjùþÜp°Õ©²«7¡¯Á¯e©7±Á¸ž ?3Z̪`+Œ‚º{%æÍKGÚ"U›J.”RÑw׈ #: ìpc)f„¶Dá<}ŸÛÍcèÞ˜˜;šo³® —NÙbÕh^R¬ÉÎA¬·¡6 ¼tVÔ" gS’õÐQ§¹³på‘Ÿ«®{|wqñüüÌëª[òM{Ñ.ø®òî¥ûU´Æ*ÓGû«†R–Þ½ÕP©S •ÄBC© uÒ꾡Þ0Û7ÔÐîgD7ÿ‹¬ˆX»øï™u¬¤CÕµuj–£P/$ÏMH¿Þ¬Ë0¬ÛM¹O ñ}ä V¯ñÒ­ÖUžRÏ$Aý¼T,ö.¢·ˆ{fÛ†+£‘^nnZ“³ilÀ›Ö Þ…¼ÉceÆødéÊ0_¯ñrWp™O6¨‰^0kÌÑÁEç%“…ÏâT:É”oUþ ž“Œv#Ï ‡%]Ž°ß 2mVü aA hÄ~6bÆ5¼v1ªW¢S›Øæñ¡&<ŠÃ+ºQJ¯©O¤Ï]" ¯z²°{2 (áWIÝs¥—{nžH-üù±»TY”ñøK+mTO:ëãt‡ ½'MO‚„¶XécI—ÎAÃzÿÖt€¼+åõéá0:ò«èGUœî—¿ƒŽXü›d endstream endobj 463 0 obj << /Type /Page /Contents 464 0 R /Resources 462 0 R /MediaBox [0 0 595.2756 841.8898] /Parent 424 0 R /Annots [ 467 0 R 469 0 R 470 0 R 474 0 R 475 0 R 476 0 R 477 0 R ] >> endobj 467 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[1 0 0] /Rect [322.2336 671.2487 346.6504 684.1503] /Subtype /Link /A << /S /GoTo /D (subsubsection.2.3.4) >> >> endobj 469 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 1] /Rect [193.014 545.0815 495.9258 557.074] /Subtype/Link/A<> >> endobj 470 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 1] /Rect [193.014 545.0815 395.4589 557.074] /Subtype/Link/A<> >> endobj 474 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 1] /Rect [393.4664 545.0815 395.4589 557.074] /Subtype/Link/A<> >> endobj 475 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 1] /Rect [290.4506 508.7137 495.9258 521.6153] /Subtype/Link/A<> >> endobj 476 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 1] /Rect [290.4506 508.7137 492.8955 521.6153] /Subtype/Link/A<> >> endobj 477 0 obj << /Type /Annot /Border[0 0 1]/H/I/C[0 1 1] /Rect [490.903 508.7137 492.8955 521.6153] /Subtype/Link/A<> >> endobj 465 0 obj << /D [463 0 R /XYZ 113.386 764.2205 null] >> endobj 174 0 obj << /D [463 0 R /XYZ 113.386 727.37 null] >> endobj 466 0 obj << /D [463 0 R /XYZ 113.386 686.4003 null] >> endobj 468 0 obj << /D [463 0 R /XYZ 113.386 589.1496 null] >> endobj 357 0 obj << /D [463 0 R /XYZ 113.386 593.6328 null] >> endobj 410 0 obj << /D [463 0 R /XYZ 113.386 541.5946 null] >> endobj 462 0 obj << /Font << /F18 200 0 R /F20 186 0 R /F15 235 0 R /F51 320 0 R /F53 473 0 R /F36 207 0 R >> /ProcSet [ /PDF /Text ] >> endobj 221 0 obj [178 0 R /Fit] endobj 220 0 obj [178 0 R /Fit] endobj 472 0 obj << /Length1 1045 /Length2 4255 /Length3 532 /Length 4958 /Filter /FlateDecode >> stream xÚí“y<”mÛÇe/{vE–cŒ=²}'$1Æ0c™af0öì[d_Ë"Kv¢…BQ–;Iö%{ˆ0废û¹{ïçÏ÷ýëý¼×\Ì÷wçïüÍq#,hj!©îŒuB°‚$X ¬hYZ‚¥°”´´°°& ' ±-8©€eu/ #€¥•deÈ/0 ‰õòÇ¡]Q@TSìg‘< î‰Ä¡p `' ždÜ°À"ÐH‚¿ îá˜ÿÜÌ‘x$Îé,EÎhpBº¢1t Ÿ™ô0.X@þOÙÙÇë¯%_$OˆþŠ)C:c1þ€3Ò…dŒ%Ÿ†$gù߈õOs˜‡‡1Üó§ý¯NýÇ:Üíáÿ¯ ¬§—‰Œ°ÎH查ÖÈ?Ã!Ñ>žÿ\Õ#À=ÐuŒ«þSBãah"ÒÙM@ ÎùKFbœÿ™Ü¹_ @ú–0}-}‰]ê¯ES8C°ô÷ú·ëÏê_ þ›ÉíÁ¡‰€4¹¿`r!ùó×7û¦A`ÑW@*Àq8¸?y|ÈÁãŒ$H"90H ƒ%·äž.XÝÏ••@^äKÁ:ÿÔÿ”äÞŽGý­( $û· €°ä¿ @ù›"€\°>¸¿Y@ûþVA6E`=Ècô—¢HvEü›Àäß Bþ†?C²Ÿëo( €P¿!¡ÿFòhƒ°¿!ÙÊë7$ïÅý†ä–~Cr*¿¿QFá^º†–() HÊ@ €< (HKÿ·2„‡Ä~ý¡Èƒó» ÉS†D‘ºñ1,B9Ò-«1úAˆö½¡ŠSâ'4\›’뻆;è#Þ§œð¸ßgà-þ©Îæ°2—õÌâ©E?>¾=Èì5l3Ì;9{ôÇ¢¯ãbn@ Ív®‘ÿ‚—Ð~ÄêٶƑÝ5è “wŸú¤Û–¼¸»Õ³Zd*ªe¹DýQ¢Ûη¡;/RNÞ–ëaU'4gÊö~+3éÇ”žJ59âCÓ,1ñÛîÃrx¦0í‡ÅâtB¸ŒFþû¦A·Ë1¹’\ “×µ\&oÙsõ÷Ÿ€„òª»sªFZ1ãmûž ÍX´ÖvûSŒfiÄ_s-õŠR)â­×©+aŒæT«JÚMUFLîxʇºQÒ2eÚ»çÒÕòLÖ‘×J².–70ó¼‰àÌÔu.s¨Þäô«L?½T5©¶­Õm¼væZþóó©ßxO´kXÿ`©ì>YI¡9fÌb3[ó*~Þ=¿#Z´*<>âçè €ÞÝÐpV_qcˆœD\´È(¥¬øL3óRR¡à­¸à2:Ç??ôƒt©¢3Õ~´®´ŒÌïô¥Ç1ì¥|8º#e¦wÓU‰ÝE€Á2îÅs°9Äv.y/ÙñË4 š) þÏLHçýû™ øí:pÏž•Uq:ù%†îT¤ú Ƨ£ž.[žu´E…úW¶T?¯”+Þ¾ˆém!vOM€ôƒJ±c5Ñ^«r&'>Ýî;ªA£ž‚YR¬åÞTV$”vU ‹F íõ:â*7—ѹtsëQ ñýBBùìNœW——Æ¡xýØœº™GôGUïÙY/ =&Ñëró2BI¤Ñá3ì­Ò&åþŠRÓíÝeA©é·gùƒ‹R³ç5g²iré8F3¬’<[›¦¥…¶Ëœt-¯/6ƒ]/OP±Øß(þ†éJ7`ä8AñtÒré Ý­~o”Ž·ŸvÞkë—žYZ¹Âcª‘߀²Ê”¼IQMƒ£Â5‹•UåÝ(/ë6µÕ ZIÏ®¦7Æ|·&Å@7?ãgýzI¯bAYCsŸG\6žÍ8‹=þ²Q¢ŠØ»©×K½@bÃ/M%³Ø·?Ó½Cµ}ñ­× ÒI–ô£oé_³O[÷x7VT¬Z\¥tƒ%µÄ±æDw‹~E/^ý’3yS‘Zø‘™Lc¡ÍÛQ'rD½»9~ŠUþægvµÞ”¬ÏkÉ#«V Ýa”@XÊ󾕖˜^$ûŠYÔÆþ©Õ{! ÅãÓ•úeüº7SÎñh¿»_sJE6¸ˆ]ßg¨=’Œ„C¦ù4#ÍDžbx)}ùîV÷Zê°³»å(^¥ ã,˜®tê½Fd}4%Wn燭Øä×ålmĦJÈŽž½@«áLÃV<ëUûœãøÃôã(úäëï@IüèýOODwÅøuOܶcì?ºŸ‘}í”÷b€yÏ¥fá´KýŸ=¢©Õìë„miÏ  z(=¡hdÍøҷЃfnP•(8¶®<)ÊýzfE³«U7Lˆ‡*­Ru¯‡÷ÔY±:y¾U%´Üï”-\Í’„b¦Â† ¤oéŽíÍص¤¢’µÓðèÆÀ¥4õf¨XÇ<§¦þÒž"é+ÄL¾EdåzI  !¾&'¼AgOœo©4’Y+väiþ1¤æŒ"bóÓÝ°³8Øö¤¼ßáøàÁxw¹˜pïRÔ\FèòÇé3Q¬h&Håâ5öãêå´O¯á‘öÛ®¬Ê=±qËUâ…ŸÃC1BëŽ?.¤DÑ@Ñxˆ!wÑF­@Âõšì/ßEofÕkSØ{®G=ÎzDzµ"E\룺ÿCƒ“¢ñ»´ÐÛF¬wñµ`¥ŒSï¿åqê¾yñ¥—$·ÖÀsl¼b¥ñsâٜӰhE*YO¹|gž ·šîÆoi蕺„æ¸4lG#$lë{9v eÌAÌîD©YÝétÙÞ›#ª,éxu±¶¹í¤Cú Þk› éÍëÍ]C¨¥±C23•_·l êøü§Æ”G,ô6Á§ì‹ÃI¼¡rÜ‹)•÷;ç"|ê')·fI|eãu¤ IÊGZ*•©ÞUL3qœ :á¸ÆEó^Š^ëÉD‰gúËãˆnv=m~¡cÛ¨ü–ÚפËr{Ñ@>5eì}2GOK›«màl]ݦ‰ÿ;‰,kKg§Z1ªV½[¹øÊß­I‰MºS³œ‚N™Nµê¬¾Z«"NíöpçR­ÞÑÅòìÐRV¢\ñ’©Å5ï9|ü õRzz:v!+@ã€OÕÍ~=3Ñ0ÿ$ë¯Ø’r¸ü#K=IþJ> àñïº7]ZSTŇ<‰"»Lö1i I„Î9*ýN³Vê#ùn“`áã»*”Ôi0£P)YÊØ™0Ð=ˆŠ­ú $ALj6ï.a³æÜÞ5P]AIôc2 žô§D¤3Æ°Ö°Â^–oÕΦ°i ð}º1&?BuycôIšè‹çuó粌Á6¬‘¾6É=¹jÝ?nÊ@~ðp°©ûHèõ+ýišteNÒ7¹ß\áä?k¡p›á·úíöVñ˜[Ÿ“‡3Uð~DŒeê©€X_¥ËK wøºè½­4¤ŸA»ïOî~%1Š½‰lm¯i+3……I³ôÍ¿q‘PA© D1ð•ã~VƒÝ¥ï*Êî™­~üá’háΖF {(iMñòÌûQ¹ºœÖf/««vB¾tÇëC&nùÂ]± —;Nª‘@’Ã>uü2"/(>&pŒ­õ9qäq­ˆ«ðÛ aßx¬îgŸêÁW¬#Ê…)KIogÜBÏu )€âPpf’5£ïÌÉB!Ë £õýùÐÊO%â'(ŠoØteÇÚM4Óe¼w¤Š‹k³¡­¾-¡$þ#t'?)0‘ÞN5ÑÇP°·”j¸õÁî”0XœÁªØr…-ý!Î.¸dûµEü¦ùý-L­ámï\‡¯Ô!ò¡»$ÅéÍc9“Ìž ûøÙ´ëo;p<ðϬ÷çƒ=¤Î^ß«o¯3–áR#vÆ?æž¿Up¥Ï/KiP}Ó öjK€‘BwwŸ+U=iº´T(P¼Ý|5Ddaé1© uæÂ"™Aû óy_lYLây˜ñ;‘øŠ;¼7šê»ž´¶mŸC…¼2©‘Iã+›¯i˜¬\Žy»§ÑðoõJ׫Ï?Œu¢ûêBÒéö>{ñÛ¥|š¥åh[ëˤtæá!õÍ%vo}Däšv+…’²ÏÛö‘hs23퉷uxgn©KT î;¨ã¼Ðò¶ú뀃|ãÐ=Æ«RzÍ0Ë2®p;¶H?¿šQ¤Jɳó—/Í4rüQÔ¥{ó¥e1ÔíyœÜ2ël¸ÂÒb$xÌ4"Ó—@³é£lƒ¯ÇR?u*óÑVþkQü‹ùGîû}åÖ¼uÁÇTˆ1^Ú­L™F­ög[5Ó “*O¨]îèP¼<®x2ì¨tÝUñsnmŠb»^DIÙÈ<ÎBúc:ñùS±·z62ŠÓø•ŠCFù°¸/[Å™#vÛ\M¬ôD’ð®Šk‡a\ÏŽNX•‘w§¬±,M5q/ý&^t\ëiñŽ1;<šÅý›×-–™KÔ<´Œ~ŒÌÃ¥Âax•æÀ!¡¨d>skÒ¦q›Gtè>ôÁcå/ù}†½\¨pÅþAÍ›¬{¯'ã»Uzv† w»‡@›ÑI„Ãñ[Í¥ç¹>—È_ðœá ¨ Ôäuù¨ÄÐ×ðütüÎrŘ„®ÍÎìªjI”| ‡EïðR™}ª¬ù¨ùœfISB×… öþ] ÅÝ`«#þžå ¿þŒã.çN û5I¹ÞÓļ £Å'lÛÍ­CééÁ‹np+ðÇG¢\O4lö˜Mï‚Ë5ö¢æ®GÎÜ›2ÏÝØôUƒ‰ D;=å]žðyX¬>Ãn¼˜>à¡,¨KŠÇÌ-ÈÂP:¯7žÝ\„@"QYØ/¥®`⃂‡O‡Ý»óÓöyËbZ8_oܳq>„©»º±£ã æè`üwÁ AÑðå»:¶ ±cùûÛkN¥ËCiq‰£(‡­ÌÉz(šïüˆÏYY,Ž[sÇØ1$D÷Ò™¤ä3b€qˆóÖí˜]ç½÷e´Ç'.¢\UÕHæ…¨)ŽÑÃï+‡ó¼›ÎZUyËæ‡AòBRÝÀ‚r:ö¡Ë¢€ƒYò•lßëm£ŒevcšhÍý©¶Ô:Dê:ÝŇÏA+¼ƒ4Ðsi'kzpùH7GI.oýÄ2ëþ¨WÇŒñ=, ú?–—h¹>DòP•1è’ZÓ²4E3e°\ÚUe5½Át+ò¤Ýa;ë9lÚôÞFZõd×^èÎxqð÷³»Œ6W»¾[V«+Ù“Ü’¨*Ì[6Niì½6¹²žN´É¯Q_Z°èŸYüª–É¢X0`ô±êw5–}t̾Õ\Hwˆ;WIå¶Fá×'ºã¸ó­_»ÞgqM j`ÖX+eQÏþ¸[ÐMцÿ&þ­ÍSpýfUMëU”cº*mý-xðËø„Ê'ë³7_Ð źË¸Ú ÖÚèÉ6¥=¢\½rePÆJá,oRŠA˜>LnPôa{5>O _@a¯¨Â¬¥ROŠâ(݇PûL¦R'MÊ%lØŒ¡Ñ}y’áÈKRÎ%Š;ãÒ‰x×{ÒÐâ!ñ¸³Ô5â?ò ŽÁüñ÷<€9ÝP6óºêTÍV‡Lèj£àÁKdxíÑM^½é•h©ìFý'1Om¶…¬ÏŸö9} äñô\NÑä«å DQ¿C„ãÃTLJ–£ô6¯6éw;¾EVWŠM(Ù»´pºŠ®ÎŠo+ÖÒÔT‰_U>~™ Ì jÿ¨Š`;ŸÊ) ‰ør£¢†iv›V7$›«p属T©iTËõLVèêç×ÚÈb*»béPÑUÉv"k£É¨¬<ÏÝtêQàír¨¸4âõ×.;g—Íc«¬«BŽa%ÎT§ö Y® Oá9%„ËèJ… l^¯KOyJö|8׸ø j¿: 8LË>n\L*Š„S{Ç„ TÔìì|l1ê®Ì‡*~Û$€Èp-j:Ͷgb·X:ÍäÀ¼rZúøÐý¿Áÿ „Ž#`=á8wºÿƒöáÝendstream endobj 473 0 obj << /Type /Font /Subtype /Type1 /Encoding 478 0 R /FirstChar 46 /LastChar 120 /Widths 479 0 R /BaseFont /JTFJDJ+CMTT10 /FontDescriptor 471 0 R >> endobj 471 0 obj << /Ascent 611 /CapHeight 611 /Descent -222 /FontName /JTFJDJ+CMTT10 /ItalicAngle 0 /StemV 69 /XHeight 431 /FontBBox [-4 -235 731 800] /Flags 4 /CharSet (/period/slash/zero/one/three/four/five/colon/c/e/f/g/h/i/o/p/r/t/w/x) /FontFile 472 0 R >> endobj 479 0 obj [525 525 525 525 0 525 525 525 0 0 0 0 525 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 525 0 525 525 525 525 525 0 0 0 0 0 525 525 0 525 0 525 0 0 525 525 ] endobj 478 0 obj << /Type /Encoding /Differences [ 0 /.notdef 46/period/slash/zero/one 50/.notdef 51/three/four/five 54/.notdef 58/colon 59/.notdef 99/c 100/.notdef 101/e/f/g/h/i 106/.notdef 111/o/p 113/.notdef 114/r 115/.notdef 116/t 117/.notdef 119/w/x 121/.notdef] >> endobj 365 0 obj << /Length1 1673 /Length2 9586 /Length3 532 /Length 10539 /Filter /FlateDecode >> stream xÚí—eTÜͶæqi‚»7ÜÝ-8  ‚6 »Kpww'@p'¸CÐàÜ!„ ™Î9÷¾äžù8óiÖÐ_øíª]ϳwÕ¿Ö*:*U VIS°1HlçÄÊÉÆ)”VÑÔr²qèè¤! #'K°Œ‘HÈ)(È ”t6rq9ù„xø„¸xt@i°½;ÄÒÜÂ È Íøg?PÒ±41²ª9Y€l¡k˜Ù5À&– 'w6 ¤ PýO†#P䂸€LÙœœ@SK' 1ÈÜÒÀþÇ‚Èÿï°©³ý¹€ ŽPS@¨IF Ô¢)ØÎÆh 2°¿Cµ@P'ÿ7Lýçâ²Î66¯lÿ,ÿ§IÿÛ°‘­¥ûMÛÚ;; @°)b÷ŸSµAÿö¦2µt¶ýÏQ'#KI;sãß!KGYK7©ª¥“‰Ð â úWdgúŸ mû—v)ui%Mæoç¿ÆT,íœ4ÝíÿYôÏä1ç3C›±t¾ç`ãàà„N„þþû?ýÿÐzeg6µ´ƒž^> bä€ (ñ=9–v¦ 7 È ê—ÍìMB[â 4Cv“‡ÈnoÙـ̜þ ý;Êù_ÑïÞ?a » ØÖÖè9 d·p··Ù=‡ø ¹ÐM›>‡€ì ø9 dÛþa^¨ '×çq^¨¾“ô× . »Øòà†,]þš5çmÚ? µærùË´Aì ÿQ/?ÝÎòo#*´ÿ•$øg[Ëÿ僶9:> þÌÿ|¨ g‹|P’ÏÕ’~&¨Ì3AE^ýCüÐêåž º²ü3AËVx&hEÊÏUPy&¨Âëg‚*¼ù‡  jÏUP&¨‚Æ3A»ªùLЊÞ>T]ë™ êÚÏU×y&¨ú»HÚ<Ýg‚æ=(Ahžñ3AóLþ!Nh¢é_­ôþ9"!´ó¿ZˆÅ_­Äò/„ÊÚü…P]Ûgä„êÚý…P]ð_Õµÿ ¡º!Tòþ9•!´…N!´Î!Ô•Ë3rAuÝÿ…ÿûu#%vódå²rqsC?.è‘ðþÓLœ!ÐÚé_÷8ôÊúo6³„Þo È°46²Ji )óyU0UŽÈ+eÞûº¾ûkZàb¬Mñˆ’ÓZÎ]E:.Æ.â.¥ë©cx»—ڸ왿ClêÜÓ®‹ánºG ©ÎeºŠûŽ=õMàf[ãìc^Ø73k£e‰ï û³ÎŽòTd4÷W¨`zÞ»|îÉâãבM·y\GÏM¥Ž•êPƺꊕ°:ècŠÒ̼|nwƹ+@ÉMx2€¹5AŠà’Ê^lš´ Mg¥`äœ0Ð'Ð1¾;÷ܵ³{ˆ\¨`o.%pn>¾t½`ÜÆ«Äd2“—ï R";ncÕ»‡LÅY›ë¥§Sð^Ð'ÿd1TLâ7µØ°cÔ¿±9JÈJÄæåBDËÒùA’}ŸH»bDƒÛœý”îÀÉ-Q'ÿ3X˜bùœÙ7û‡5æ&çÂœò}xyë¡ã.¨u”’à•úØ‹“FáÙZÅôýJp.µÔòþ7ÙF%ëlvä K‚‡ˆ8à|Ø´½®tÞõÎZ SªD„°©1ú¶#“Jµ-ÊÜ’Ï ~5ñaG+r2¶Z{Wízc±P Ìòr67ÍhÀ·sj³øæ2¯kb[²cŠåf;òÝK=‰Ã\œÉX÷Ò‡¤!\ì»’ò®˜³Î%ô>x4aZ¢$ÄýÁuL©!Ȳ¡ëNKˆÑß%Z™º3|q2RWßšø'ÉRÅ µüJﯪK …¬3Våwt|ž2]Æ(«'ãÎél +¢0¿Ä*fÂóJ37¢í`Ï z™=ÎSÚh¿ås÷ËQÙõ3$W)$•ý5ƒ¤ ƒ€ÛëQ¡cíÔâZg€ùµ[)ïèî±³Ÿó‹O5Îœl{ÈÊV©?î‹÷œ6Œ”¶n-«l©!¿F‚ŠOÑHOçkÝ™Vïý«TašÒ<5ÊOQü–;È6ß9`ù›ý>´w—7g´q2¹j'mw[r±J %·:fÒÌ3ðcœ\ÞÐPm'«I6œå@'?lIL­9†aàjûŒª÷² P•+G@6‡¢-TcêˆW ù9þöFóh8§AÊE014ë¨Ñ·’Û‰éû#6˜t­¦žŒb–dsZFoéîìó1iãøSK©ÕúÃË,mvƒ”å×°Béµ 49Gc[^`4ZÌ3{¸üŠïŸy_ʸ)®¯‡ ¦]²¢øèA0‘ç”ðÖù‡]ŸP¶çVÖ—¹äFÅÄVtÅ]š¯£Ä(kyÁƒv€¾íꔡkÁ®Ú >Û¡î²%°\n­L÷ð‘6»=ÿñÇw0ÆØÝ0Y/ìÛÇ^²¬¼"ëÏ“ú#Gnا% d†½™“°Wû¡Wñuß›ä*sju —¸} _Pº.xD<….œWyz­µcÆ„WAÇ WxébÙI¥5h.ö¸[×:²ÕNüćU‡go·ðä¬Úºüs¾|[Âc4N ó o>ÏÌIgª„ð^Jx²ŒüzJfiÈø|QùÃåh>ƒf¹´[.A6nXsVÈò|¶9ztB³i{2¢àû<ÞSåêjcü鼋7vÁzÖóZDƒ™Ö¾´Á|`Mb^|1ë€v¤‰ÑTdù½·"Ö%ko‹ÿ ¨S²³,S@d–§5R¤Ìy{‰¯£^·]Ž_ÀD;Ĭ|r`%5úª] ýÞ“G@¤WÆ–ªÈfLªJ^NBxût!7ŸÖ §JB/N_zù‹Q¡3\赟’¿…zµúŒƒ‰l(“5!nÚ‘¦b, ¬€—Íå”/¬qœb|¸ªŸø‰e¾Õ/*=0ûí†DûpFÍœ_ȲÎê_ž^8;»¾ÓÏîæ+‰}U‚Ô‘@¡—¿·Šòâ±T ‚%)n‡#ì—]|;ºR;S°E|`OVÉ]§Î›ØëÏÒËû r®ö¹§‘fÖÔG‰žÊ<Ú/w¶äëe¹æ„®î¾ùüx97²xßÚ‚ÎÓ÷¼'¢Ñìrë:vD+r¦aÕ6Ñ~#6~ ^BÎ2€ãŒžð#>~¢S¯3ÜAq= ܳ2+cXOÖþ˜}¨ S1>cΓt›r*¥ïp­ý¦ßVÞ±ÙªTcôÒ'Q¨ÚÛù(ªh³–õ`¤‘Ã8ËŒê×ËhÂ9ö¹ÍðõÅBËñ䈆1Ô¶/uî¨tduÅoøi»oO¨ZßDO©)ñ”§¿‹üá$N»ÎÝ ø^´·¤§²˜®$ºÀIo¢Ââõ,Lœc‘´‹ßËÅ£çá˜ó9äŒ_ìͦ0 $g8&‚XÉ. ‘ó¯øÅ~‡Wq—¶5Ê54nIàá+ ¹´Êöð&3óÅ àM³-£ú¨ßh+Œóôƒm0~gnâœüüÈùÍ2);ƒKNØ0.ª$2ˆAß`ˆ1Ý5LÎçøFùK 9B3.üî+(–Ð&xû@]5ã–í[«rÉ@ÜÍBq+ï<yv<.UH–¦Éš‘•™R< øÔ©ÛIhEÁcÖùöÕèPšîÍíz­~ÒL—ãè%Gé‘ИëJ°‚˜é¬5D]E>ž»¨ì©«BÃ5ª7Xß4QzO˜¥!À7ÄøÖ0†“lè缯çâ@ÅO²cÎöÛÀ4öä T–‘Õ+vÀÜ‘#‘Ìä·ÿpô-Q•»‚÷:¹lH1‚ƒ8 ‘Ì”$ëóñà:O¡tP·ëftö¡[P üLÇ}‹/a¦vQ ‚1{¯¥SÏÐ<üz ù ^® g¯–ÁýBšq{Öüé¾8 ¶óê°¯¾2^ÇÛ‡X—Èš‚MqG+±ÎÜ]K… i0Nûû,‚çÒ@‡ª“YâcÒ>©hûE˜»lï€øÑË4ûµ‚l¼T)ÍžqÄ'ï«/÷2ÙЗzg6¹±ó¯80@Ç<žX³MÒCLZ·1Ébk`4ãwSðÇ®¹ê¼'‘öT¥8NLþ/übݘ㞠_ºhÃ¥|ÞnŽ«]µ?tßîÀŠ¡ÈïâÎ嬱ýÄ»œ\¢»€É´'j)ŠS4DoMÈõŽW«&/I€Y™ÒÜoŠ–°”„àkÌ´‡òu;BŠôÓ<Û±^ÊÄÍ›ùˆX$çàu[É„ûŒ8¼2R «æ9DÃÈÛË,­RêÖØ3¬ˆDm-P~Þ®öìÏoœÇ¨ñ CæxXüJpl€LäÐ7-¡4¥û¦åÆβps௽JÅë©ýÖâ”OMƒ¢.²Žš˜]g7…M÷þÂxm,¨_iÕ‹Þw„P¶1'5oÁû>‘â¼’ V®û©IH(Šå©»@Ò:án’7ëÜÏJDG¶ 48Ê|ÙT¸„¿£óŠ-诎ªRpB?jôzlÑ°¡tÑ2ó?OS 56?ž Šr†°„¼øĪ¦Ø¾ÀÜf.•ø8·¬wQ&¡º)=úSF"”Ê …Új1ˆnWªò0ƒBv£ï¿wÀw:%lÉbê‡í™æœœœhî%ƒÉôÅ ½ôþÌà‹:õï$*(jæ·NeZ"¯à3ñiÈkU–YMŠh§™r_øè\=uÑÖÒ Æ¥ôTòë©NˆÐyÿ Lºªµ5ê(~_J× ùm ly’J‘ÓÆX£Lt§`Â:”S¾§óHø9ŒÐÚw’ò«A©á 8Æ%W«90ô|¿×Pûpú*¾Až½¥4™öm—YfËÇV+Ôf¸§ÉÃ=¾ñÿ;3ÛY‹Ðµ@tÃ74ýŒTã@ìF‡ÆÑ[Ä:DPJã‹9bD³Rú|>Š”¼ü^ò¸o…yΧñ(­1L¥áŽ|O1Á]~¯˜Õ¿ðé!ÏÿJø,"sùNŽu…?qûð öḷ>“ÂOcÏoȨc¦Gd*fg¹Ÿ÷×÷ÙT3ûÙ5v´“½)åtòœ+à N yu\šb}Ö ä\œ"Ë´«9miq’”ÿbßjpñ“¬%ô“IMKïßH¡¯ò|Bø@ŒÙÔÖÕ^‡BTõ-Iù‰y8Z×púûÄiäkÊ`8¬‚ ¥EUÔûÇz•óÌôþøúï°²ÛQd>x­¬}kŸx ?±mÚ8nŬ…iDësY2IH¶ˆ^}•íýôs˜@YnD²iÊŒÇÙ1'+ü€„¼ƒTÓ9&¨Å€uT+⯶‚mÏxÑ^­&î£Ã Žæ±5ó^[e[4:u^Þ·|RÖ±åFuÈói­:jìµ'ÔwV# É‘D‹ •É™uXµÇ ­T.…Rj–!úÝ&:™®s—ÄÄFƒG×W JU]|2äØ ª¢Væ-æ<4²—<§V¶C wžsˆœÊ.úʉagŽ(²Ed^¹ w5Ùå?¢EñÃH}³ˆöá—yÚÌc²e9Æš@ι•ÄL§ Œ§ö]ìm(×Aÿèí ³¸†ñ»l_Oÿ{U™˜§ã}b(*|_ß>É5 ÊÒ¨så'yÊ“Á¦u’)6xE\†.¡>/ËúÛ‘gïŒ@kÊûÑmü•S¼›3FÍLhÊiõƳwn z¢"³Ã*íq 6)¹Ñ(Ç°(Û%œ6É6â¹aM(Èì6%Á¬ÞÒvõÄÖŸo‰£8µ³÷:-öjqóJnÛ†Ctˆ3^¿d0¥!ÝÃÕ²]8à¥ìû1³1©2±„EV¡ž.1mŽª1¯–§Ÿ22åÕ£WöÛ‚·ÈÅìÌp2EŒ¶ÿz'“­ˆVÛ?Ðo®Å7Åw“ õ!/ÊEýŒDY™üÒ¬Þy÷ÚbàÚ–?kX-¡HXYã·è¨Ù}…ˆÙ¾ê§I£aÊÉ„™y×v¾±Ý»lçLz€‚zÄí_™w\lFHeçQkL/þhÅ­K}q0—Š¬(ˆ…”=ÙÌj„K \@ؼÿgð»¯e|á‡Í²8·›ßT^t¬€LÝ.…&ïZé­Ë¢¨éãý)Ý•[Ú<¬¢»»¦Ð ͽCj_Óª³„–f(ÊuSà=cÊÛQ0#‡À\s_½ßó/ï%Ú.Fêe‹läÉÜ´¬éÈðñ[ƒ­ÕîòŒø¨ÀYÆêöä”ó=’g‘ÚWj>z(Ê!‰îêÉr€¼ ûzUõ^̹®['þÍ?ìÅ$>"¹ª"øµ& dOäEš0g'a//žû@“PôÀÈÒÆG6py&ºs͆8›s-ÜšQ†c/wÚ[Ï^ðÐÈo‘"UC籋ÆÎù"‰—ž±©;ƒg¤ø* ¹FîïMùM[£]D¿»¥ †ÐXŠ¿ÜjÂMç<íÖ19Õ2D¡?rtþÖD¦‘~.ÀA¸μ“:å®Ü—ɧKÀjÂbM­ó0ÄÃH“­äÐÏbØáÌAÕÿUÍ´\GÊĵøþ¦Ü§öý±‡¿{$wf£)«oO€T¤È1†ÃzÂÏK«jC¿ì0)ßÕ«’ÍûÙ°$…éÁErO_‹øêV¼ñ¡1Í'lÀœhß›%ªO€ÊaS‘¸”µ+ÔYn ÂÌÒ‡*þ˦d,ÚÒ"¬Ç2ªTpÊX28ÒôÉ–ŸÜöá+^ŸR=©%yùž|‡Va¦˜]i®¬•ñ…4,\ú¥œÑµ¾âA—Õæì%Ç›ðFZ=7\£¿•”§´°Ücô¢ük‰a£mÄaf Átk¤Ï[¿•Sp<#X½¿_ $Y˜½ÂÏHú6^+f[ü©âNà0ÏÞÁrŠ6ëÛ=[êΫãó)wWØ3>ìSø‘-JÑy¤NÅ¡ÖPíŒ÷@¡ô¤ßS~¾>£½¦*ê°dM¾J—'ç´ê¡{AgGÙ«syŒôM˜])’±&^Í¥C=ÜØW 0ˆ;…É™¶x©¡“Ó^ã|Óz¬iýŸO ;áFîq,¡§ ¾D‚ÔI/©s÷ig:UHìõQo­A*¬ƒv˜-‡Õ ™ä‡öµþ8¼©4¢'_v^×6s»nN}·Åq3Ã5šÝ·\ËHG 0.ÛïàTÆÜü#UÜÚ“-¶6zNMr·º—´URÔŠoÏv3¦±ä΢‹´2EʵÀmx¬#YmÓc›G;­z{¯g¦¸2t¨XŸ+­| ¿Ì¯¤«;1–³ÜÇÿÐîTz'ND»#Îû† î϶OšY– & ç^u¯qëúº óƸkqx’D]®…È»YçÖ|ù¾7-ëˆÙ âúå4ùJqm·*›vÊýˆe5b[­ªaUDД°hõëiÿ˜|·Z…°å*¡czÔÝñIsõ3ã=ð#®D‡PnUgᔤ¨`ÿäÊía®SUÀ@®sƒ™è\è¸V’÷tvé aú›RUúj¹Ð±YG¹:jQVšA»¡sƒ°|8þ]¦`v†öžaáz®J5™µËþÒØ•úVÐ<«Éš&=i´c;õ±è›)°ØÝ‹,fI´È/âÉŠ,jC°Öïù'½8ƒ|®u™—NÚyW(ß¼_aþù3U`Sšš•>Ùí’EÀOp… Qø±¦ûRkˆMØ€>ÓªÜ}€¶¿w8bc¾Œ÷ÐX•3W÷ü› usÍo‚xêU@·‘Ø+I‡ºÄ‹â„Š£#ü]–çü1‹ÈŠrH}ÌGáZîn$ë3¶þRQ>%qëõB¨¯òõ,0HÌ2ÃÈÈY0™Çê`xŒ6UŽÉQ@M¤š4¦yžŸòØ81Î5ÀsŒ:À쟛 óˆ>Þþ»â{ <©ûá^tsõ&DFi!‡È:ˆg{‰Æ”*ž08‹*eùIPÞ†‡ÊÿñG]Dñ]n…—r®ß¬²ð‚³$³#QCGµBü)UÖ~͸UìPlð\^øPl8©èqÍzzÖš,t¯•BþË!®}îGA`ùz@xŽÖ=cÓ÷㟓ð7‡9œ‹g¿"©³—ðY6ûTzeÔ„^¶£š©\æHÙk‹òU¹0ÝÐ(ø´£Eæ›AѳN®Þ#™5[J}¬Ž)3LH¢ŽA‡åóÕa'H;bØ.÷–6±Å²$ï‰^£Ü¨ \õ×¥ÛéQ‘çFM°(aï¸|] õøýÝWÔËI®ókBÖ‰HŒ¤”Ú&p%zúÆ0ô¬uPG•Dë¬ën?± ¡,ÅJQÌõÓÃ}¤—'<ÿ™Eâ*CÃÚFw Ž¨ìP¼ÜµÌTÅG2QÛ ªŸ¼‰Åú…s’–S†Ÿrªñw’¬Ëø0%<£y[å4¿,nT _Ë=B‰TRÓ¤TŽÕeøòœÑÔk­› %púÔ;¦gxWUÁÅWéè¾âïHzÅ~xú`pÎõ“øä1 -ÉÉt öEl'Ç“±x1¤Õ ÕÔ”_¾âÏ û1ñÅ]b%ªÈ£¥÷ !.®Pclêfs~5èiºk–ÖÉöeËÛžŒî$GÊ!"Ö 1Äcž×ëDŠp[Šï[±h´…Ct‘Ä7lÌÊÞs]â œ[Z–òh3ÏÕ¸­ÅsdÃð{bù?¼>Ò°ˆhÆP±övÌ!òCÔ[õ'±ï2ßeN¾%BgX(¬ž™4*:lÉ44¢F[pN¸ÅÞ1¾gš Ps¬ýÅ4ñr¡n£Sñ§žðº¯µÈøÞ#ë­/äòÖÕ ÍC>ÈA”ÊTùà­AKV7U^¬Ò=WêQ¨G%ÌJ.ŽBYâgcQ[ï:Þ'Zùaȵ.SQÛ ŒÀù‰Ÿ?y‚ªz-kÏwõ"=§Œˆ1§Îd©\à\=íæ ÉnÂì†þ ‹z$LnC‚jÌEe—¼¨ÌP{!`¾ÙS–°-+ñSt…%ydX‰ÍÍH•¿ÖþCYYÆ•ò9ú{/P¬M+Mç+õ'‘#„¶"1ÛK'z|¢ûø—¨þî?ù~çûGµûá'Ë *‘W×Bߢ;“J$ïx6«‹Þž<áî®þŠŽ°n¹…%7×MOœòaÚ!j8©©À‚ÅâB!–¢½çÐ¥LÓÌg²éšÇ¢‰§»ŽÄZ[%ˆÂI+ ?@Ìf0 Ï|)ò¾g¹ÓÄø”Zy ÉÏßf·V%Ò=º” ¹§3g¦¯±‚‰â’ž ùýY­t +á €Y@¯¼fê7ûŠ%vm®þdKTÄoƒ®Òg 1œ¯Ó?Ã艞zÖtmŠ¥|¥û&rl(.+þËËXøàsÂœêŠéq‚uÆž¿@ývÁ;í®Æ‘ Ê´XxìÓª%:­sË“ößÄÔ¡C/q‹.ŒÌ+7•—&‡äëw2¸(“Zû˜‡C1¥}š©ÎýcZf0JX4Ù*sÙèé°8ÌØ=.h»vô›|ÞÆ+Wg&~`ÛEÌJ[Zç~ÌŸÏÎ;G¿z쎄±æ¡Df+êÏR/™µ:yz¢"s‘ÏÒ)ÐDBb¢* _jÇZ³­›m׳ê¾+Â6> Š[h¯z¥X®þ4e󋉖’õÁÞxá~×^õJÑÑ” üå–öÝÄ ^ÐÃ¥ïŠ÷Y{ªy:bôæм?CJÖˆÆí8lÚ'yQ»ôΓÁû7"µ¤0)ú©’eMù{£9Û}ŸŒ%DIúLÓFÅøòß™4’Cc¤Œü^Q„¿oÏ6!{t®„ÛÀˆÒ[úµÿiV¦~'òW¹v˜ÝUL~©V#K©N–hŽL”C›oký#ækHñç©\#¢ê,67„;½KÈdú¢û”Æ!)¸ÅÍÞíûëx®ÒO4…¶Ul¾WAçj”#d¡óåZ³k÷u% @³dx¼ ^Ô©dë×õž¿ ‰ndñû ôý™(äa͹îöWÞš+G@¶ÑÂú.Œ›\>ÿB*icìVâpÝ”VÈí7‰k„´õ’Vn}³úÚŽÁÞß»À1ÿ4c^¿4Í%¸®pÐÚ2N…ÿÌš#LDß¼Û«CÙv=·:)QyÀ0;Û˜ï)bn#±dIº¾Èv‚Íæ­cV‡wËn¿ÁV<„W"f4ì)¾´mS4ÚK§ôÐ9a“×WéÓzÛ€2+øž|Þâµü ¹°á0[öŽh%`¶{÷ ‘Áw§|Í…þéô#%Û«–f%>fZ5-“—ñÊ°y€Ðºæ¥»w{û¸…ø˜ºÓr’4±,#nl?ØæMNOžj'%èB¢b×LݬR!²<Á÷yq²€+q™€Ê1$À\ø "GyÁ¤»ËB–ß‹álæ+R>bAWÁ<¹a]°Ìï–•™1§Vë(¦°pˆêÏYo¯U($1WÖ(Kýâ´E?ÞûÔª+=xVüN®#)ÎO3u@cÃéÁ+‚!§EÇ2»uxê{§ëGWC8.ð@ŸUÖ&ÿÃEn­†€¯0?§‡Ε?G§Ÿ,œòˆúžÓÚêÆhtOihrN¾÷Ö2fÊ2¡®`à@MP¯Ü#ë!eG„B”Gæ'#¼ú“A¬'ÎȦ¸ôøûûÖ©'ÏèÞ‘t{|7X u³K=ÍdÔ›»ÇpgtYΞè b¾d7I‡}Í¢*3ÊHúœvÆü£Y*9¬o³Ÿ è²›a%T¬#Ë«ç„ðÐGj„ªH`K«Ÿ ,ûµf5?ÈùÌÔ>aöÝ×Ü(&=¡¤òý ½öÉk”ý…YÈåïÀªÖå{õ˜ ÀS¯9Þ¬¼FF1j }‡ƒov• f¦Õí´¦ÜO˜ˆës.‘GÁJs_ÍrßÔšñcŃWJò«?G¹Ú Ýv;ûfË’$qyXw¶ÍDCû&¬Oðk~QÎÙ[™m\ȧ¥ò(§¥_{MñÝœçH§Â^ï_kâÎ#pè®” —.E´‹†"#ÙDžœŒ}ÝßÖi±üü5`>íÛ £ýÂØG–3‡ËÏI*Áד!·×ã-Ô}!/ †¬ß+è%²álWÒEpø´îÔ<´ÅOL ¾eѵ ^e>béÞ-x…šø^Î*bØç"EdžÕôÌv­juiõþˆ¹ÝÑ0å®1}«8nLó@—ñ>+ &µªF¬ùOàú|¼ð¹6lf„ù±h8À]ÊÅÇ<»S^ñ’¿–ES!~¯.J©i™À¿ÊiHëÆ+;èB›¶PúY¹€Ü*ÁNÈ!]ËÞGm„GkËv7Ìï@éÖš)ñÂ'7XMR”±ßN㻃¸¬ó‡8ÂÊ–ü»Å¶¹Æ»±äË–ÜcÅZjÚ ¤…ÞJtŠovõÝðšGÃ`$ó‰ ²®Š‡MK ‘?Š¯TÜÇàb‚±Ò™ßÀ7ÑZSy(BÀظ²œMùA´Çn}â~oëæ9VøN¾«ØP 5rø Ç*—^´Q8þÿÿÿ'0±AœÀ¶FkÀÿähåñendstream endobj 366 0 obj << /Type /Font /Subtype /Type1 /Encoding 480 0 R /FirstChar 40 /LastChar 121 /Widths 481 0 R /BaseFont /BRXCKT+CMTT9 /FontDescriptor 364 0 R >> endobj 364 0 obj << /Ascent 611 /CapHeight 611 /Descent -222 /FontName /BRXCKT+CMTT9 /ItalicAngle 0 /StemV 74 /XHeight 431 /FontBBox [-6 -233 542 698] /Flags 4 /CharSet (/parenleft/parenright/comma/hyphen/period/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less/greater/A/C/D/E/G/H/I/L/M/N/O/Q/R/S/T/U/V/W/X/Y/Z/a/b/c/d/e/f/g/h/i/l/m/n/o/p/q/r/s/t/u/v/y) /FontFile 365 0 R >> endobj 481 0 obj [525 525 0 0 525 525 525 0 525 525 525 525 525 525 525 525 525 525 525 525 525 0 525 0 0 525 0 525 525 525 0 525 525 525 0 0 525 525 525 525 0 525 525 525 525 525 525 525 525 525 525 0 0 0 0 0 0 525 525 525 525 525 525 525 525 525 0 0 525 525 525 525 525 525 525 525 525 525 525 0 0 525 ] endobj 480 0 obj << /Type /Encoding /Differences [ 0 /.notdef 40/parenleft/parenright 42/.notdef 44/comma/hyphen/period 47/.notdef 48/zero/one/two/three/four/five/six/seven/eight/nine/colon/semicolon/less 61/.notdef 62/greater 63/.notdef 65/A 66/.notdef 67/C/D/E 70/.notdef 71/G/H/I 74/.notdef 76/L/M/N/O 80/.notdef 81/Q/R/S/T/U/V/W/X/Y/Z 91/.notdef 97/a/b/c/d/e/f/g/h/i 106/.notdef 108/l/m/n/o/p/q/r/s/t/u/v 119/.notdef 121/y 122/.notdef] >> endobj 319 0 obj << /Length1 1171 /Length2 7454 /Length3 532 /Length 8205 /Filter /FlateDecode >> stream xÚí“U\›ë¶îq .Å%‡B°¢¥ÅÝ !@ÁÝ¥xq-Å­Hq‡Šw((Å)‡9×Þkö¬}yÎÕù$ß¼ãÏó1ÂÌ ¡Í%iá`•s€»pñróŠ¥Uuyy€¼Ü< Ôüñáñ'ú\P”WÀ ”vpôDÀ¬¬]€lÒì% %í¡ ª‚]¬¡ö5 `; ¶uñäJÚÙµþºá Ô‚:CnP n//ÐqšC­`pè/OŠpK Ð¿Â®Žÿ}äE8?š²ým“øhÒÂnç ´€Z@jjÐG/ÿ7lýgq9W;;5°ý_åÿîÔÿ8ÛÃì<ÿ+ÃÁÞÑÕŠª:X@ðÿLÕ‡þËœ*ÔæjÿŸ§Š.`;Dnerñ póü+s–ƒy@-4`.k %ØÎúw ·øO'ýûÛHKGCRCó¿Fû÷¡wÑñt„yþÉþ›yÿáÇ&!`À7<]æ}L|üþ÷“ñˆÉÂ!0¸ï¹ Œ@€=KôHÏÞ¼@Üê„z<:qÃ\¯;ã ´t@þšëãèA–Çþ…|û7ò AŽP wùwLà9díéh …ÿ;$( ÉüC"@ì¿I豄ê?ô˜©öoæ‚4þ!~ Hûßô¸3 ð?ôXòKžÇ‹àãK@ÿÀ¿^âx4ü>ú‡ý:¶à£A»?ðQ×þ|"þ>ê:üºŽà£.â|Ôuþ —?ðцëcxòø…<ÿÆÿ¹iRRÞ\¼‚ü@.¾ç<É EE|ÿ·Lˆ+ñ8Ä¿ÿÎ ûßl {Üq(Ô ÌÏ8@ÄBlRÂJýdóÇÊÐÙiÒ‹C¾u„Ö¥‹qï-‹O!Gu t'D¡D6°r”_Ê Ëç+” ’>}ÞÚ Ð9¢>žá@ÉI;RÄ$À^”D©1†××–çBRP›c×Åzf<1ºú¿±U ‰uó¤Õmø×¼"¯ºçãP|³aÚ‡:‡¾uõ¸yc»/¢Ñ?àÞ•þ–¨XmªP6¦£¶ÝY¼IÀì“*öp.3µØ"Â~:9§C¹ë1_I;r‡¼å¬#AQŽú f()ÁTDGcoDd³ùÍD3S¦†À73èæÀߥ¯ÁE¿ûÑ~uØTkHÅ0<4&ôqH¶Ë£¸ð"ÆçùYòYülµˆ†‡ÆHº>QŸð=ù4šµ {8Ë!iboßûnMì‹h:»zTÀ—û)ü¸·õ7£ˆß¥,ºâ°ßZ&¥"ņC9–IÉ’o³,Õ»—(ˆÝ%C)œùU×éÞG•Fž©£ÚäÇšl"Z˜È»&6ž×*nÍOhŽ@ð# ín?Éš6ÞÇ[-‹pg§Ø‡>8_æD?ì úRáÞG~„s~>ø6ëT¦ûãa.‚25ßÖÖ@wQf’N?´“b›¦ ™tT‡!ûæ|¥J7 %[ê9oš€/wu0žKÌ®èÛNiR7¾î× $Ps„ eOžp:eÔ]!k;OÈmd¨¿ó´ -{ 6Kv0R üŽßF³Ý½ ÞÒ¤ÿ‰¶<»KÍÏô… ~ª3nHAe±(iK£ýíXäyx<{•ÒŒa•ÿ <[¬@ËÔȿΗ!º6TâvaY*qä÷FË4Pß’ º¡ÌõH0ârgÊÒ4¡\Ù×ëE¹Í/œ±—Ÿvdv6lïü®7HR0U˜þî³}Pê\Óàüç²ü·:á©Ïd‘Ñ”F—àL4ϸŽ,Àj?û¬º5L¼T½à?g½Ë¥»½ÜLzwùFÝ»‹Q΢]ë)¡'7ooKeV:U_·›“ñÇp«²SN½%F?ã©uÚ±øb‡p ã¦>Ãj^‰BÄÁ¦cQÍ ½…L=ç]©ÑÏ¢P×Èö ßß&Y¬¸žø-™~es>")|ÜÞL0ã3‘2‰š÷&zó/ô jTä>wdçõ>±LØ*<‰k†¦2öì{HÕH5k¼å±*bä?¢ä€rR¦ØW͵ô›5fÓ™IÌ–ðGÔ1Rï{~w×±¬µoˆÓÒŇONÜZ~>mÉ°p2NÓº¬Ê Œ–Æ¥òŠG÷Ü—Xî_ìÇ’ð˜öÒ„küðÙß ›Å«ÅfyiPH”Å”ƒ~K½ËK«b›gîkú¦¿vÕçtׄGÄÙ¯˜[f ZµŠÿlFªŸKˆ¢íµ®@”çÅ`™¢šaÃtI?‘¿Ç]ZSÖéoÁ˜’Ma4pħ-R¥­¾m'|{|bnEˆ4°ÏaRªG‹äàÔ5.×}ÕúÆ’ÝÏì‡ûˆ%5–båD°Å"ý? pøGÚÀýÝseA¦.zvHŸ€;^ÖS ßt ¢ûÛ6 ÊS´ Iì#¦vÐèÕ·²µ „q»MOîi”fík¹°çÒʦÞä!Q¢ØÉ\K4>ïøZ?Åšb‹ÊµwDGMéXQ‡,œ™š7ÔàLr ¨6´“nÛIDxŠ-éΠázìFg ¬t•ôµÒfúÏi+‹ãgÅm#½Æh3\X|_0©ù ÑvÔ¯ŽqxM‹:NxVÚ¬Ûüó‡·Zé¢\‘`’ìHW¨g¡Áwô…7£ ¹º7vÊ›•7#>Ô}+ªR–UùDð»x?+c0HÍø¾xÀ\綧6îÇ=‰ÿÌe¶-x_Ú7t¶Æ¿Ml„Dò\}õ²a•=ñˆžÖ‡¿•ma îD"Çá·äì­Äò7¹dÕЧX€º>Qb“ ¯™!«?™4$r>™Ô³i™×oY&àjÞõ XûÌv9#‚˜JîOž㾠$ÆÊ.´[ÀŽ븢~Õ†9¾¿bŽÝwþíì²^‘4$oo¶™«FÔÌUºs®'ÝžÿbòsL£= ãAŸ!¸-:’ K¾E$Ô‚®Xs×%"NBÿY¢»h•Ôbér³ñM°ÎðËصѬ° 7“(«CP§Üa.VÄS¾¹¾g”‹¶ˆÞ&ž¯9mÿÖÄ™-þvh‚.TQµàìòÚñòE=)¬[ƒÙëùº¸y­úÍ@›põ/Â3íâè´Á{gÀG²¨$ZÔ•wSŽæw#q 3†¡¡ÈbSƒY Ž™Œû4E•¬]ÈÍÜG\æÖp…#'e ƒl©Mªâ>Òœk X|.Úâ­Áwqw–‚ {WFÌÛ-§iñWdÜÕÏE}p1=—ÔW%±3ø.7‚ä{é°(Ä%%¢u¼¿ù‹L5ó ™»ëäD“¨Ÿ=;OPðŽl—áŽ"JîÝ@>}‰ã;’3&ãšœ®:j)³ü;v9¿&Wwšíw,:¤Y¾s='’‡‰ÆYÝÒgÒáoÔ š<MMÄUrW¾{“¸Ý#I0?w J¢Lš7µ“˜ñwUzéGõ2ez){çöáµÞäú÷EŒàYÙÚ{™g^q ¦+½kÐOˆè=ûÜ}¾5kr)*wà+ÝgQmÙz"¼ÛñSy«Rj­]"BLO›FÌ\–‚x§Ô@ºSu4ŽÆ^Ÿ>äWŸ¬4X ¶V' ½_$NŒb ŒkõÛŸ‘¯©×wžh ¯î6*œ”ïîL+òy“Úb¸¹Bï5’ë&Tý¼u¢r?~EÓg`ßf¦òdŽ+|ùž#µ/ÓþÅÌÕ"ïÓ½§¯f(Þx±Á4P>4äÔèOéíµá‡n4e’£urõœaßEвhÜ`|JÒ³Ü~E¬Ü2(+ÅTŸÈt¥ýȧíÚåT©»¸¿U²ØÕn¡NÌ‘y%µ~¸!3‹Š]ÙzSšoŠÜ>{9_ûÌrRaI„ÁÇþœ|Ïz§·A­¶¼éjÀIöÓõk6 ç‚îÕQK.kÇÉ ;’ÀW+x?~^&Z\~lœ'ìXsaþÐGÑMâ¢uÏs¡ªŠ×„®:šH­d ò°‹¯Ì(3ýPq_ÿÜúªØ+©ùó ´~Çùö&qi²*N$¾æ5´Ý/Û¤õVŸÀ¼FuÃ0ð#Úg‚±ú°f¹MNÞn\š2FÅBï¼ %}[ÈãÞOtŒZŸ‹Éýj™ò¶&“šÌ€«7¯TIuËÿîõ/6Ÿo­y ÏQ4ý}¤(q,D'·‰”íl×¢s.¨ªÀ|âßnó[Þ7-¸ž>jŸîŽtFÙxP6Ž¢±IkP—y~‡ìQÙiBµ•ç¥­Àì$Bœ§» ÝWy¸QÙ(ïꎪхL^’S7EîœÕ„gï}Ìf¡êY…ÏNIh«£Jàÿ‚ƇjÆíÑ݇ÓoÅIÔ“@éE÷­j#RÃ7‰Òé–Øû0yÍnMË\ÝzÌ“œïÎûÓ5«‡˜© ®Âò¦ìO#wUò¹ÅhÅ—³SóÌú¾ë$n2m«§Ï2‰hâ{ "ê§.‹­ÂbýI›ÜO؇ÊýϦ Â¥Œæ6¦"^ïf|µåŠº¡ïÆóméBíE³d˜W‘…Üm”@¨ÕšzíB¼Í;µ~áQÒ«d긾iž‘øhB&x>ä; c¼y“7Y±—Éfd3NìÛF¨2e†ê!ºnÚĦÿ»cZ[FÔé”——ŽëdŸç ä[½r~óùµ»á°é¤ÌÉn•F>¤WèÕê×@MDyðÜtMuÕÄZtöPÈeþa¨ùµOÃ’ä Å‹.xSqë·Óì—\DíÌWi—™ “K2Þ®A›±&žLÎfö¿N´ÆBÚE _“êtcé5ÜAÉrŸgÑXp”*Nn†¿ézPz†ZÃ=g1fF©r¥{Vº xí½êÈéÚyеªþ©›‰ ï3“IòL!×·ü¹K½FËÁè® FømR9Ë‚Q}¿f9‰$מ¡U`ÎûŸ¥à l… Ð¹×CUC6nN¢öו(¶JÖYëûa”˜‰“^ù›jnؤÏL¨Ä&<¶¿5~’»ü6™üÚ¯¯aÅë)ia ~EÔá)u<`ã¾nUÞò~fæŠ y(ª{6[·h)uq"†%©ã\}¢‰Ì¬b~7äw^Êš[Ò¿B5¤"à•Û„_ÓÄÕ¡™ÔÀ~dmì"þ‹½YïÍCZ¦®MàX[±H1³RÍëì.NMv5Æà*™‡ÜVÙͪު·µÈ»5K –ó+ý_Vè1ƒ5Òò'ÝÜK÷~öf×¢ÊLŒxa´O^Œ37?[Ýžâ•U`ûéj»¶PwY쿾¦ŒÎÏ'ˆ(Ï {ÇácÊSè=s¤ “çKŸ¸_Rx@úïXïäÛƒLmOK‘Ì1f¼YH£z£Y=•ƒ:Ç»Ûc?cÛȈ$›†Ô]_jp„­Ùú#Wáv }F£Ébj¸o˜õ¢ã´–áãgrv´õM¾më›ÓåWD¡ÆÓE»g0”ßÌ /F«¬wèìÀ!÷$¶OPÌô—Ù•FÁÒ{Æ,<_¿ïRÑ%Í©9ÄÅÔä«5óGNú¥Ø^3âxšƒ l°úíE—.½ñ"åÔîċ׮=;N8°ÄFºF¡&p-ä<7Söó,+¢±šÑ#õúõ]šóÐÓ£wž³¹ jŠþ¯l¨m­Rlha·aù½5GŠUyjÓàÌq’¾ë Œ¬?¹Í˜N߆'j†/Ï0æŸB"bqS\ø3¼¢Ù›V­ã)_ÂËøöÚ=¯ŠP1ñùóSÎdq7z”>›©RÊïjëÙ>b^èJ»cnhæ[6~x!¨MXæà£Y”m nÑ0FÈ»ŽËºë?m*D}ºQqmýžîLøC’åôPAP逎DñÀ­Dʨ9C“z*­?$“A¢¤QÏâoël¥‡WÓv!{d “01œ)-M™”ów> qs#‚%X%´×ŒåXr&L/-ý]«#ûþ2 u|’doHmc°œÂ`rBà”>Ŧ Sß”@¨'D›4…–ãe»?¡Ï\IÈÃÏZÎz¬c8_aO<4ò²HÄùÁÃH' ¡lNÚ=$›Z–I'Ç_äûÜÔ­¨ oŽ26^ s®Í‰Ì 6“û¹µUÜÑŽnI%÷|ŠaÂ=‹s¤š:®šVäs¤ä Ñ¡í(Óh/º8ÇÁRrÕ)Ïhê„y}%tœÂLuíÆdÌÍÌõ}Òг¼Êóc¸¤÷U´%9rýœê#È?3®(ô‡°<”ˆ6ͺ4å¡šÅ0YyŽ’>’ÿg*ÕHbP÷kÊ(iPVEP0A”k¢cÞkÆÌw¾þÀ&@¼«,/1:¤çðýZ#n×ó£Â%¬;°yÁcàJ¦}ʦ->OßI¦Ð§Oÿˆ8§H6:ãO',†È8õòåPidw?¸nï8…t´èÁ¨ ËnïË\u÷“ËËoÄ<òóèÙ1¤T2Ô<¹Æcò²~ô´+­wM›¾¦Ñc¡Å¥ï_ùŠ}žž>ãzi“GÐ4Üî}‹ª5ëƒ+ÞC#;wÂ|+P–Šz²‰k~zduÇ@%ÿ<ƒŒ}#Jë)ŠM²5 BŠA [ÜpÿäÆÄÚýEéÚ[üc"+Càèsª>ÆP :]œ:G€¡/Áý¦æ[ˆôzk9=Nà†øg =šÔÅ£UýÓZgçŸ-Ôk q»Üc®B3]ž´½›j֜Ñ™S&Áê‡6¥Jã/ÃmýÊF'K½\¿æ:ÿˆë±ÔK‹”M^¼^›—1êé7ý¼áˆh÷›I{Ê’Y—ÒSœèƒÍÖ‘ØçˆGN¿©*>)šÉ_±6y)X9qŠq£.. ø¬³¹ì펹¼O¹¤ è6¡=¸!š8ÌÚ}A°•) £~‰L›)e6QÊvêÌ–W„uØ$þ.“._#ÞM–>¤B¹íô.s7ðªªIìÝ~ŸyNDFAÃS*Òí3¢ŽIÇ^buŠ¼UvdgeÙäÁ»ùº $Ž^5öŠ¦þù0̦‚þM)—¡ÑQÅ4›üw:ƒ-ò¨*ÍÊŠ°€¡ä›†C]êÈ«µ„Øåéú#Åâ¿CÍwßñsí¶‡#‡”2¼ÌÇxÈÜòýÏÆJî$EEr«S¸~QW•_v¯ë½­kÊLpÝ0$àr4§j|¥¨JÜk3«ÿ9Qs­‡É¬èˆLÒ)PÞx챜p9VhG4Ùq··T ü—÷Iº2ƒ?½z]öþõ8(¤ûW‚MïGd’Ú¢"­6T’‘SʧAº Ý<¡™¨XÔÈm‹ª )aû9Ó£¦i]ûp8™‘¾„kYî™DÖLî PᮉrƒÁ\œ{iÇ&ß6áÐüZ#_éH•`P9üéàþá0ϲEEÌÎYpÇKZ,:àÚ²&ò“ë°É˜Ä ²uðB›ÈN:y5 }i’ƒíÉ~:€áfÓ¹Ï>iõ-ÒZOxÎlÑ»ØIÞ(ÿ™dÍgJnd²žhÐq€RW—Ž2¾öq­Ã͵|¦¯¼&ì³î¿[Ä« Ö¾oW.‰m•^V›ÐŸŸØQçš-:Šõ„ûr¹º?- ÓÝk£†C1AKtÀFŒïE2Ù<²…ÌýŠ ¿R;•¤õ뚧øÒ3Ü3»d “?ù;öŸ¤ö¥ßÈŽÐý”ƒeZ>!¬Po¡ /£gÇjÓ“WBŠ/úb&£t€´èŠT¿Ajø¡¥JwÂAŠcÛÄÐöû†þ‚ô0e ÈJ—u.<—9Ë{=®P»›rÏg ò½0Zí᩶ÅùÆÃ9|ZÞéTº ‰Fnã~aÆzþ™º–XíÈlx Yã’tÙ ÿŸdÇ"âü El&æWÙ‹YyÑsNÃÊ8Ç;øzvS§ª–a61Ö|†‚_ðå¬\€³…Â/î›Ô«ƒSm´Ø8”2'!ñR*—»5:V*N‡þÍ'•ç;¯Rksã¥ö²ñ2 ºû˜YˆWŽ.ÛdMÆO Ÿ©í–ƒŸ.+WVwð§Ñ ÁÐêæj܈e™+Ó½ÀA;ú[ûý‚SégUoCƒCYl ™[âÖ×çfzG§§™Ü­™i, ¸>|Ò` æ—¯),’? ãÒmáúôæx1*ÞÔÓŸmêÝwÕùkð^„öZM¡c¥ %Œ®n²¶'$"ÍŒñj­kÂà‘^ùd^áyÄÞÏÆ‹ÜZ¢"JŽë둺Ýßmî>E8¤¾±ûýR$¾á6;JL£€»·ü›v º·(ñ9H¨ËïäòþVgÓ?2å8NÎàU¸m›²¹Ÿ›r§JKèUñà}Ø..z¬ ¡üp=‚¨eöbpñ9£ë¢üÛÛñï’ý߬(ƒ}fÜÖ ]ZöÝ=™Jv—eŽƒ¾ÏωÝ$zœ^1üÎ;V©Ð*k+Ñìét#{nkç3òÚد„»¦«Üt6s}/ŒÔ³logÍysãN¯¤—Ásÿ¼?fz‹ïË“Ò™,s þj+øæ÷œîd}†½OƒpJöû½jdÿlÙT‹Búhu3yÂT‘@×}Ù [Y†J¨Ñü$뮂¦ò6¯ã¡ô)˜M}.cd¾Ãü‡„úÀ³‚[u¤¼ç›ŠVze÷¾O¨KKa>J!fý£VWs>¿ @d݇å¾Âa“$Ö*ã¢O]ͨ ØJ#¨vqòšã>]«b53@¾Ä€¸®Uш_å›ì¸î“ƒEðõ•ð¨[šÁ¬æ»+Q 7º) ÉÎd`´ Švž~d§Â1¼-’ˆ:†€†ú—ôdÏêŽwÒ.øÜU²W9ß© +è7Õ1ôz·Q7ñ)rBl1tçªÌÉ~þôZü8l._Ô'þâwñôXO^cÜüec«L *ÿ°­]‹µRk_ì-´gçàú&)Ÿde›—~æq€_ÓáqñC8‚é‚[‹taÚ+‹²¶š¤Äéj•ƒ÷y—¯2?{â€Y“4)AQ’€WVL›%~fgêZÔG4k³ßáX"1e0eþü1£a€œˆZn9È@¾ãÊ¿ÒÏÁ6-» åˆça‚Ó×>d6.µuràù?üþÿ' @ì `„‹ƒ=a ø_"Ÿ`endstream endobj 320 0 obj << /Type /Font /Subtype /Type1 /Encoding 482 0 R /FirstChar 11 /LastChar 121 /Widths 483 0 R /BaseFont /RTPAPN+CMTI10 /FontDescriptor 318 0 R >> endobj 318 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 /FontName /RTPAPN+CMTI10 /ItalicAngle -14.04 /StemV 68 /XHeight 431 /FontBBox [-163 -250 1146 969] /Flags 4 /CharSet (/ff/fi/percent/hyphen/D/E/M/N/P/S/a/c/d/e/f/h/i/k/l/m/n/o/p/r/s/t/u/x/y) /FontFile 319 0 R >> endobj 483 0 obj [613 562 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 818 0 0 0 0 0 0 0 358 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 755 678 0 0 0 0 0 0 0 897 743 0 678 0 0 562 0 0 0 0 0 0 0 0 0 0 0 0 0 511 0 460 511 460 307 0 511 307 0 460 256 818 562 511 511 0 422 409 332 537 0 0 464 486 ] endobj 482 0 obj << /Type /Encoding /Differences [ 0 /.notdef 11/ff/fi 13/.notdef 37/percent 38/.notdef 45/hyphen 46/.notdef 68/D/E 70/.notdef 77/M/N 79/.notdef 80/P 81/.notdef 83/S 84/.notdef 97/a 98/.notdef 99/c/d/e/f 103/.notdef 104/h/i 106/.notdef 107/k/l/m/n/o/p 113/.notdef 114/r/s/t/u 118/.notdef 120/x/y 122/.notdef] >> endobj 304 0 obj << /Length1 751 /Length2 1206 /Length3 532 /Length 1758 /Filter /FlateDecode >> stream xÚíR}ÙݢÁÅ‚ ' Ó(4àèêih*I_߇Ø"C™ldhÖÖ4ÀS* Ñm̬mÌ pÄQ8"Û·/“,ƒá0‡W¶(â6¼0 ‰¢(€ Àsù„xBB—@\ ‰F\˜#AP0Œ’L–ý¸ < X~,sÅ‚O- „ S`ar; ,r1‰\ˆG2qÈ» ÂÉïajµ¸“AÜØüey"£_uÙ|‰úWã Ä"®ÂÑÕT_è£5Wˆ ‹ù«»."6sh0êÇ,t‚#!®;,â„B+uå®6AĶbÁ„y`ï~·½†+¯¹ÒrgèÈ;JðoÑeî ¦ýÙàp$ð£R¨TA$¾O;ÿUWíF9F‰q° 6Ž³£HÄ\ÈÄÐŒr¡HE~M((&"Ž"’8ÀÃpÒòcš[ …–‹+Ø‚ LDØ þõ?98`‘1Æft`lJiTK*°´ Æý‘#Æq­Œ ‘Ì'̃‰!(â?Ä8¶‰¡¹µ'Êãw—ôT(ìuþ!ÃíjëƒæõÒoe‘²;ûÂwŒT³*ó7nW×XüB˜ÚëÑåôòXxF^ÿ‡qIàx~tý¬Ù|ר1Þ[é •ÆÚ¾ù) Ù½#åÙ‡JÛ _ÝzQì¾éýwÅ'd™ë~’šë‰tK–S>r0éxµÙS5/¼<Ùi¡È=òɉÞT»qH¥-à»åNç‘çU®‹e-Í´­•­³>êáOZ|4”zUÃŒ¦êµå³´sßá._míÀœõê£îÙ©G'?6S™™ÐPº¶îmå.«@Sû^ä3[yíäÛ©dˆBbòTwÙmmÌUßáRçpý«Ñ^Ö}'É=¾‘ÆA´MÒõ%§×\mŸ–u´Uœnk~Ò³4í7õØ9W¿bU §ñ;Jæ<ÕN7äìü9 õ¾NÝ•d’ÆèöÃEµ <ËÿO $onf榺GN¨Èê¥ýŒƒßMÁLú/u|o8·o¡Šþ²ˆ¾Vè‰eìåäzè÷â ö’qÕ¥wtêç-ž|–’°½ÔP°ðí–Ž:XáµÍ‡ƒ/Öß$HÕ“²êînûæé“n5÷_|;7ȉ´•ÉœÎV¶<çEiw[WŸ¸XZG)Nhzm`óóJ|ëdÆfÅh…³‚³TÇÄ΀ γ ªò£û&¢4›$mcXàÍ=±<Ó–V¹ß§iý1”ªepãò¬8Œ.ÔŠ0*›]j[\4ˆ‘×Á4¤µ—KÛÞ\u˜VpI•jÏK'š»gä/­’«Ï?˪¸÷¸¬¹#=¸Ùa?$wWóøÛ :lj0…Ya ªµPÙà˜S_ªþY+¨Òè§ó;ªEÃ^ÒÊKL½wvY¦q>2jíÐèYÊ”|ÙLCa`@³ží¡®ožËœ¿c™1QÓˆ¼¹œU›4÷`’±ù’Š\[ô_ ¥Ékö¥—L®Iî)ž*š¿õ“£ëF¿\gê¹Þ¬p¾âýˆýd±²¬—]ìm½JMöE½S^±ó‘%Çî„;•5 é˜=u=4raDYKr)†™¦qB{(EƒÇ)ÀÖþ¥ÛÖg11± DüÓ>Y¦“âØ&/{ßû.z¤z0“uDL8éŒùßÍœÎòa) ü­&†”|Ø?„'5ŒÒmÖðŠN¿Ôî)rç KáøØ‹÷:­é5ûþ±‡Ê’¡hÿ¡Ò9}r©7 ®OÖ>[¼µ¸ëmÁM½ ”p™+-ãšåÛÖ6¾U×KPßÓ—kj¿4R_’H;¦¼vWÏÜ«¸ô¦“Ú§ ßUðvl¿<ó3Ò–¿5 3ï>KØÚ±!¿ø£Î?ô•Ö¹™k¶’5*Veº[.‚©–JÚ€Ëöþ[çp•ÆÔ߸HÿøŸà a|6Fú'¶‰©6endstream endobj 305 0 obj << /Type /Font /Subtype /Type1 /Encoding 484 0 R /FirstChar 49 /LastChar 50 /Widths 485 0 R /BaseFont /DOJLNJ+CMR8 /FontDescriptor 303 0 R >> endobj 303 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 /FontName /DOJLNJ+CMR8 /ItalicAngle 0 /StemV 76 /XHeight 431 /FontBBox [-36 -250 1070 750] /Flags 4 /CharSet (/one/two) /FontFile 304 0 R >> endobj 485 0 obj [531 531 ] endobj 484 0 obj << /Type /Encoding /Differences [ 0 /.notdef 49/one/two 51/.notdef] >> endobj 234 0 obj << /Length1 1916 /Length2 14234 /Length3 532 /Length 15300 /Filter /FlateDecode >> stream xÚí¶eTÜ϶ »;@ãî܃»»4;ÁÝÝ  Ü-¸k°àÁ]‚ûôÿܹ'¹g>¾ï§Y¬^ýìªÞû©]õ+šŠLYIÔd ”9¸2±1³}ˆ+¨²±ؘYYŨ¨Ä&®Ö  Wà;@ h ~þûÀÅù‹‰ rôr¶¶´rЊÓý3‰ jt¶63q(˜¸ZíÁ9ÌLìj 3k «3@ÔΠúÏ'\ª@ ³;Ðœ‰ `nmæ 0ZZ; ±ü£$ã`ðüWØÜÍñ¿‡ÜÎ.`)í¿4é`IsƒÀhÄ¢W‚]þÿÐúÏäRnvvŠ&öÿ¤ÿ§QÿÇ°‰½µ×ÿž²wts:@æ@g‡ÿœªü/7 ¹µ›ýŽÊ¸šØY›‰:XÚ¬ÿ²v‘²öš+[»šY,Lì\€ÿŠÌÿSܹ)°ˆ«‹)¨Š1üמþkLÙÄÚÁUÝËñßYÿ™ü/fûÃàî8[{ôXÁíeOÿþ÷;ƒÿ¨%é`2·v°°sqLœM¼À§L\6€µƒ9Ðô ³0;€\Á€{â°9#ý³¡à=g±øW쿌֌vóŸÉ†9x,Ž@g3 ƒëŸ€ÅÉ nû¿ºûßaNVðTg ƒÐâ¯(ÛÿŽþÇdpYG;7—?pa3½½ÉŸ€ÅÊËÑ èð'Äý/kùŸXÐÅÎÄÅêO„Àâ tý €}AÀ3XÔÕãÏ8XÑÕÊø׌zrsþø§KÖîÍ뺀÷ïß –uºÿå Þ+àÿX3XÕÁúoÞÖlúó!n° ÐÉÍäφpƒ‹þ!pR±?N(þ‡ÀÙ$þxÑ’ÿ&ð’¥þxyÿxm2\OîëÉÿ!p=…?®§ø‡Àõ”þM¼àzʼ*•?®®ú‡ÀÕÕþ¸­êì¢ñ‡À.šì¢õ‡À.Úì¢óoâW7u61³ºþ“ÉÇñïøÿ<›àKŒåÏ1ä§6ýCàÔfžVð:Íÿ¶ï/üçý…à‚–!x­V!x±=–¬` Û¿lñ×SÊ Ö°ÿƒà›‡Åá/k€þB°†ã_Öpú ÁÎá?ù/7Ýõ/[¹ý…`+÷¿låñ×E¶òü ÁV^!ØÊû_øÞ¬bb O&vðƒ ~aý§Í|>n>¿ÿ1ÓÌÍ|­¸þëø‚þo¶°_ç@ 'Ð éçÈŒ?Ä&½)ìë'ÉÂérXzH1ËæÅúï?:‘ƒ—!íJFåœè×ë´+²°Ñö`÷H=ž‰\¢:|U&¤Î2æ_÷Ü÷²¼[‰´g)xí:’ߣ·7Í]ŸpA*Í®}MÑ)Ƚ<.P¦•P߇_%ƒèÑsoèÉáæіʲÓ­£æ SÅÈpúÁ¾æ‘’³6üÉ&¡…aåÔá†õXˆŸüª‡iÖAÊ¡ºE£º/|RVŽ^ûÖ?\-’ °TsìÁ.#¨ŽÊça‡Uçz¿“4š¹ÀŸ”ŒPp?glíÐ&{¡â6X/Ù1â`0²*’]*f½H*UÆÒ< x¿Òîù¾tÈ%ûSnœû¢'»ÄjêÓéÂ’¡¶ÚPàëdeOãx³¡]çh¼ý„Dî(œòæã&’e êWâ‚d½ñh#F÷üIɽP@ù0?¯‘D^®_ß™…$Näò—Xœsõ¦¾®òUL…çYu(ßn*¬5LŒÙºˆji•Z“è—O;)ž!“\D2¸ÂyHôa(>&aN¬‚{ßàÊÐ%ÑðáÜÝ÷Úè³(+;„jF}¼ù_Ë”NùÆŸìÕõê:úó ñÒÍá+rS4ìæ.(ϵ²­ šV?T‡ Ñ:sÇñ‹¹®ÁrWÇ›Iõ‰9S²ð“1Ê-BÆ:”Êg¥œB$?µ®7Ý0¤«'…-߬0Ñ3xÒv/ápdT6ôÜ`Ø¿°¾6ºéò6î§ÓWôPÀå¿Ë|¾'ÈujY¹NUn;ʹlõíO“‰OŽ~‡Ñäô;¤(ÑY ×ÂñÁAúçB»¿ýÐçGQ’ )‰²Ù{v±3aqõ̾ô³RˆÎ¢f­I]û†d½È>Tlo¦ÏúÝöTœÆÅ‘n·M›µõ J„²ÝföJIºQš¯!‚ªÊ"ónÿH^öDB¤Û¾"sý…Ý”+MßÌÜ‹,(ú·õÉ°7qL•gÓ®I |zÃÐ({ƒšˆÛ­ Ñ¡ÎÌ-—”“ežª¿’$ÈCŽþþõjiŸ%:óÝ¥M¢~ ·[š¤p¨`ÂSP¨Tvrà–m#/a±µ„v7f[·»Ã9;ÿ4r<·”À¼ƒäŽß÷­rÌw‚-Σܾy“ Y%!>ÍÚ£3&þ¥ózZ[BÑÏ/Ñ3ö(Ó· V2Ù’PΧpùZý¹9 dÛH=;ßÈNò+v6¿ÖP­£e{òmv±µÆž¼”G\ vŽép° 'ÉöEbcFêøô GŽ8{–ÉÅKÕôõè•m¸”¬wÎ&Êèk:*âå‘R¦mÚY˜¬äÙå³[âÏ3Áî?òÐ׶Ÿ”:Öl|,à¢2ßÈ/n›.'ŽÑFŽ–0¼‘iŒÇ¥ 1r-M ©QÄ1±b$\½kDg­ô˜í—l»c爱“0'úàÜk;Q$¦¬mG^ØöÎz÷þS„ò;~v¶PZå;4Y%Ùf]×¹Ú&Þ•‚#4é %·*"õ ;YWÖÞ‡òIÔJþÄzŒ~-fØ>¼kJ»ÞÖ˜aht' ¹þGXØÆó¢›<¥/¾B^¨Öa ¦ê‹Û*{Iß(ºž*;¯„¨¸²gköó­, 4£‡]ɯ(ÃÆ”=ì>•ï_v{ÖÑŽ²««À© šYeèÝEãýªpZœd´ù=%Gë5÷CÎ×ó1ûtàË?²«· "j<ÇyÑ效Ãλ%' òƒC(iEC»–eµÈºÞB™ÿ> KÐ\­Ô{c ÓòÙ¶3O™®i(—j[‘߆Fc”64}fœ` óPø :eyÌò «(´ñOv–ö@º¿Õô’·KÜn¹L‡4ëòÛ´hñcvŠqSñݹ„ŒX®hÞú|ÈûÎÈ‘CÅhÓ“´˜›ÝÇkNå;"AZs*‡1å×ÔË;â^&2ª‰í_À§Ãp1Ün™Øù./ÌÈtÊ›‰¨èü¨?è¢äß°ëæi›?¯†WEN…Éc¤³ÓhKs¹*+Ìètò‘9"ŸÖ5kç3œí+–w~y¼u g÷„¥ ž Á.2¬Ë(Zú×”ëÅá{Ö• óò4VÏm=€¾êbsü-*!zP% mô1›^¦ã'÷öötS‰…‚+-òÁ‡º_»±#Ð÷»°{ˆ¢Kµ v7ã+•×Æb<(+¶AñRAËs‹žF‹<[*ζ±¹|!yŠãN,$‘(–v£°î=ïì#ˆj즷!M€ÊGVƒüïuh*‚Ø´N>wr?ˆÍäbRÉT³ ’ƒ5v6ìÆ´ðûõ°ìßœOÃPÒÌ€Ìln»¶Ú¯f‘©7îx IÁ¬l¢óÔR¨}fnä‡Qyd›£ Ç©KµK§í«{NùÃZè/^Äõ¦Kûë ˘ýûZùÂ8w]¹_£A6í¿± ›DjœË¶dc5³à·Ú#¬ÇtÇŠå74í¿l Ô“÷b)‡” é½ã-äWô/ñVt^LVÔŸ!@õ‡2é6Ø@³ŸJ¾WÚDK6 Õfç°»0>ëúL2÷äqͨ<@HÚ¥]Ñš`/Fo¤Y[!µ 7FO =4ôAo¤`Ú~¤òì‹s5þÝÓ!&*ÝJh*:,Y+IP€a™âþî§JëàGŒô’ǯ4•ïžU“ýéºÑ'åŽU4ô…ûxY/œ$ŸõyÈ;ò$¡ŸGøè'ïÎœÑNgãÒÏëÊ•è8('ߤ!ûí.ÊÎ üP Zšž1H£%X¼KP;œlYûý]‘ùÚ³m Óu)¼ÃA¤õª‡B6 ïnu‚=è£ lV>¯ö<…lOJÅTG(þëfÓä‰ÂÒö¹¶ïŠ˜›ª`ÿÀ"bbö¹FìÈ?“mº]o>ØêÎ1ýÜ_™þ<‹r‰kfBß”¯š&ܾu¢JKþû1áÏ$]y{ ‹Áêx±ƒÞµdüäKÁ'öÃe… ?_éK.ÓaA¿C*Ý¡Ìg”K0¸ÝñI9ýÈÑm–BMüwïŽjñ1s¯¬»3LŒsmÅwz¦“A²Ì£{±‰Ù¤8Ô…¡P#BŸ¯]ú!×qæ~>!ú™v´ÕÀ n.nf’nÄ jz? &ꪑoE]0püH=“¢(¢<†8²øc[3Ÿúy&ýG´¾=ï~ãZSÎér¹$jfOÁSߪyæøi‰,l§gÜžÄ圃”Ø@ñdÈÒ¢nåôW›·×ŽyœVæAjtZ,"—| iŽ^¯fX3%’Â;H zÒ25‘¨ßÏa2° õ•k·L^]ÏÈ,"ûÅ3'QqË –ΦóÉ]ó›„c®'¤Ñu½æŸã—š>ê–uîÀºÞ3åZ«» Ý0ÉF‘Ñp»Ò]Q‹6¸ðKNâPHY7 Ël5ýˆÃ'… ™ ã…c‚¬µXu^2ŠP7‘áÕT…UûœÛ¢bò„²¾%ý)§þäŸ÷'ÂIP÷51Vä =?qõ“¼®qEÜU![ùS•¨RlãÖ@êÀGÿ]a¹¨¢ ÈZÚ'C._/ÿòâ=Ùæ¹hN ¿ùëHֹʊ®<Ùµ{»ô»Þä Mzø¸Šy² <µ€´îàb ÁÁ¡ªLÛÊï ,aѸñKB³ßƒ‡ßH½ÔÐ '¥Š÷mzº65!Ч“û\…õÇ“”´/ŒýÊOXx™”10ñs]Þ­·ï¹§¶5ïT Øðeåì~öÍ ¸q³Éá”´OÒVvsàj|ìö¡‚{ÏÿÐñ½¡´ÊºýSÛÙûY‹ÖÀCîÃÈ ÇrCxèû2}¦€Xm×åZúv|÷€<(vŽêC¾b/ªñ¦£:šÍÊ ¥-e#Ý_\òµ8rî-Xü öj4¸¡í†ƒÑ_áÖdçí<þÖ^†î°ú*£I#˜Åæ¦qƒÝè=ûß)]` Ñ=êy¹C‰.¡YÉõð…dïM?óxÄÛ¹ ðsˆ-³ë\«)…Îú| –ûY5Î,øâÖ’Wg.çœu°Êc³‰*´nÁE¹ï¸ƒºïýºÇ¶JìG+KŽIü»Fȶ¼ì¹7ÖÊø»føoÕ8®C-íéäJäSV±ŸD®p»ç_f3JÙ;tqâS éj"Iw|ö7ci߇ÛD^sµ»ÚÎüSiO*+4ÆâgÏ&tƒ6€yêo »Mæî$Ý´mN °fÔ[力¤é_8‰CÒyIFÌEòpõu½@ŠuÊ€g¯-˜Ú³wò7D=nïÞñW„ß&cgGWøß·2äZ,s¬jðÞ0‚ºg„ïNßš“í‚ñ[4ƘߋÙrñÒ.ýôS€6‰c–q±øeÑtòðÒyè¾Âì×vÅìõÑtûŠ'›yÛ¨Éâ'œÕ¬ÂÔŒ>^B¼™Aö£öi‚†àš’¾"$;.™äðÁ}›`‡3Û=;{ÕŒ¤Æ_lomådìÝç2ÌKD_«Å°#ä¶wÔÜO _”X‡ñIféÉAåЩõ˜DÏr´^ Œôr„Ù©”áK>LX®ˆëåõ³õv>b~æT$lô”ç3iˆ†¢wY¶rƒ ˜m.»ø íªIÊ«øBôùs‹¨Ø §~‡IþŠ¡Éð¦mxŠØ„Š‰Uè.ÌyšÄ’¡Ew; ºÝ`15·Äý&¨ÍQˆ næÁ*1°â0\g3°bÞuØ檪8i”Ãò{¶–7MVhʬ7Œøi9» %òþ#Ôï•ŸgNݼ¤ “?SÛˆ¶tk‡ËŽVSôXð:xñï~…Ƙuúøà’ ø E¹bdšuM~—¾¼]‚È%"ni8F3ÂäÀœ¥Ž’W¹-ui߀ú£½å£í«&O|´žv”Œsô‚¬ƒÎÔdJ´úåÚÔ×h"öÀŠÞFËçcE–FžÓö= ´bê‚6’àôçÈî6Y²w¯Û*uUY¾Šiöù+7„ÖÙ¦âX¯ÄÐpª$RÜe‘Ó°6‘ „K'ä×"–^¶t 4tï22ã´T²’K?Çft߀T†ë0M4ó«sá¥Ëñ╽!û| yÔlcØ1lIF»K`£¨“èL¹V+"Ö»òÒ0Ÿ‰6s¤ÔN~§©7¦ûÚº¿Z*À‘A·¾{ßàCï>ÐìM1ц†‰A§*7üi«OuÇZò>q×QД¾,|Ý—â’>IäBÏ|¯‡Taîe@¨¶®Z`ÙiM–A‹ÍQ¤{cóx¤t€ÚBw£³Àx£ò#gä:P£xÏÍEÑWtùˆ‰;Ô™œü]¦Û<á+,®”à ƒÝµÿ.ND%‰ÒŽX~ß{áV#ŠÑBjÏB ¦ R› ¿ˆ„wž,à”SÒfòÝ‘ 41-P]•çx}RÌâù[üÔ”Æ?Ïàp¨N>¹}LsPD?ÙTv¾×’Šð´Mñr{E[&,§ÍÀË÷¡%Ÿr)ÿóOú“;i4^Gsßù>î¸'ŒGÉ„¼Üfm…(Íf6DVW`8T¾ßylsæa\0ÒÌ8 Ʊ:U7¢Ö>±|¸Ü‡€x ™ äaeÚOïŸløŽ¤Ýµ±=ÚïZ:.g©ºýÜä ¨î„²ä7ô¿H3ù´z*áknȳ«BŠº¡qpž÷gÓï^£FYëÖ¦21ÁPƒØ¿Ä¥Þ-z´ b×X^:ˆÓbA| núNL[¸ÌÕú…Ó ^ÈÐ01 /{8†ÕÍÏÇlÛAZ¹T\.ûƒ³Çcñ \ôÄ(‡{Ω ý) r¾¥ØkôtslÊì‘àˆ”—ÅÍmG¸7fhÌDp³"€dì{´òÌÎqèž ƒíFÀÞ“ýí_}´éÆ}&ó!GΊ-Ú$~€»ÛøèyÃ¥‹£*X íÛR-»é¹í|m2‰Ö¼<§„£ªKÓ+ìÖiþúq¶"ŒÒ{i_Hû¼>Š5ÑÊ +ŽÎaå÷õóâá@U °¥!-(p8øHùÛogXÓlÿD5Ε€ªý¥2v¹™7¼3•c<è«È#”j„ï „'I”¸^¡È¹å­F°ðŽÛÌU\L^ÑOaÁxõëº ©„4dŽ Pô!Õ€D!1èRÚ©Ï`Ï“”Ä”ÝU@íF®õŒxã]Qï绨¯ŸùC9®Ê;Æ^·ÉsŸÀ1™EÞ?uãÑ~»]°›l|Go1@cýAŒŽ´iYHš­#ˆµÊc|áxÚ“O‡Sì:´ú²ÂØñu°ÈÝÝ¿¨ƒäFÈD”Ž¢UÙV‰ $„ÛBO7’]Ç€±^1VU×ǘ m—Û-&Ñ®=Ê•kÛ\ìXM¥ª\8~.C[úƃ›/¡s;F.„ZÎõá\h=L­éª‹—Ïr¹ˆ‹–Š»ªæ"Ó’!Îoº”íçÍw# Á^*‹÷{Á‚ »fÎT!½ƒ…‚¾—ÃR½ÅO#ä^®ùçEpQD㬟&á8ác”û²!ãylÀéM"Më"»2}q<íÁ {yɵ¹¢¨1ÏæË`Ÿ»²¯œ|Šcá×Wи©!0‰ aÝó”ä+HTÖ#½¦À l®”(á&‡HÈ>l°k‚R(*e òµr¡8l1†ïðÌhGãfÓ´O’zXp°}FG.ç?KDþxñÞ†:!,…ãDÄkcQæuûÃ]ßQ!WË¥lXeçjP‘Šnó‘%#ÔñÃfUvÙˆy“b3ÙxxëÇN(*ˆÉÈ‹Ñ1OÉL&®ï¿îëÊI¼| 'pŽvºd70Œ-FÄDö=dLj`4þõ€%â"vÕwŠRl•äⵎ¢ò¯Æ¥9RcŠÑwãD…à=á—`íïn÷­‘n+o«¨Vžc­l5õæ ¨j^¯ _Êla¨“_ÑpfÞÝ–¨÷Óð7&ø‰`¦ÛN¥2ÌB“#~[þB˜®_€ž¢ÁO®?Ô•T[Ze€þIOÍͪSj.—¿„5¯Wùo¶&xøÌìwŠK)·ìÄD ‹CÛ¾C”éP8B×u›ï‘s0|nèÈŽ®²ý_ß'‘ésB2H6Öw8Sf^h’¡Ø‹2æhçÃï¦Ð•Àº¾¾¡4ª,¨}íí75ÜÓŽqWbÛHßnñÄ>M—£c‰‘þþ6ï ¹ºlÐï‰Îxù3£tÌuujܬdzs–sêÄiª,"pR”êü>{VúÙtÛV€XYy¿X‘Hºj„‚Æ[ÿÍt ˆ¥=‡é%†ÌÚɵ½,œ†P…~’༗Ñt©4W¯ªÈóŠÖàh W¹t§ò²Ø†ß&ÒyÖœRª›TµÏÚ1*¤¡]fj³)5ƒSv·. ­ ©Á|9LNñcîAåk_Þ!.§ÿ9g —Ý[ÓÏ™V±7sý N‰ŒùjXRqê€Í]ôùxÙÞóWŒ|€ë©ÏàŠºÂøÛû†ÒÇñÂaÈÜ„F€ V©€õÝXýËýiU_S}Š ±î=òËu çYDïPü´ýdØ•Vó Åœ•ë2 ª`b—9ï|'-÷4”YuŽ-ÂýÐgj‰)‰0Jœ hÉ?¤“-§Álå¼2ã‹°æ€Añ£bÉ%(û ŠShB븎–‘JŸ\aË¡BÁEê«í~›œž„£ŠÚÊÄÙCGúDÞ£z!påÑo^¦ íF;òS«ìÜzC5lC#UÛ¢ò²ýÛܱs¨¨u 1”ÄAEMwb­Ê¬ºŒÙÔêñóÛ¬=Ãp‹ô9;z*Õ÷6쥳†áKAèÈ¢ê+‰ÓÛ4?:@Á|µQ‹†ªZü9OÛ}aƒ¾/|rèkÃ6õÓD§ÉZk"˜:š*ÁÑ;a"ñu?ŒëØD«¨Õº% ÈsúûêÍå}é(Tþ&zî ìÏá\ªw‹ë,Ò dªlK9½±žj&ÒÞý_Ë„Cw3FúßSÈÍÏÀž,OmG£ÅŽ‚ìõöŒÄ„$·½Ö¢çëjo‘ôëPìIÈ’Ÿ.r–ÓQp.Ö´o¬…¹W¾[UHÖú–»!.=l×ó.u e¿3¸Ì‘ ×ëÒžm§ƒ®\-«y¹Ý$cUbB½µP°Qøˆê}ñÕ蚤ÙOôÝb«“%ô7ºVx[“:3•¹òêÑ3ÌyD±™˜ ‘õq]U–DžmsÖ& ôhrÜ0Z€ezTXÏÅxq“¹è~k•åRd"(z;Ó0K³’å=n ÝlIƒts‘pÕ‹Paë?Õ×NWSèÄ;ʇúK¼&ô؆g_}û¢Å(ò¥2ªDiròZÛ‘‰#¼Fpf\'’^\Ù<"û˜Žh"í'Uä¡]ë3]ÓòϵÛW‚íž”Gß Ì̦Øhw÷­Æ¹„­AjmA+E¸ø_ªñÜ_LÆvƒU>Iù76þzålÇÒ¾–r‡é’£ý(ú~A cQ !d'¹õ„œ»“Õ¿ŸÜp1™ÇÒð@îóÜgÁz Ã…®ëYšâ²Ó¯˜ÌkÄ›„èH£ovßS/µÅ£ÕæHMqÊæo°5-?1ÛÆ=t&.â Pý²,üÎ?" ‡{AâÙx3ƒýmô„c˜Ô*¬’©c·H-u`‘[tI¸Kê4ë[ìj 3æ—Ë·Õ.â.4öj bËGÅÃñW¤q·²§lsxdA¾û*¤`ôÚ—0žÞvÊ…E©0í(MÛì¶ïŒ’á—«¤ùíq'h÷ôt¤¤³‰¢7š¥bÕÞÚ¾nºõgî,‚į<.ø›‚LœwÖ°Sœ›m[Èø%eaÔûÌ8wîÇ}ƒEkA»…òXÖ¾1i‡¼šY½Hˆd<ºühÅêâE¥Ô‚A~½PeDðþd°óïU -*ìlð³6v9¿Ý.n”‚ìËFž/½,âЬS– ¢}ñrÖ)°fòÒ$Дøè²1üús‘0KÜ¿¨ØDÞgâQ!>½(5§N­¯ð1eÂE¤ÑkwvC݃U”ÏM-5R-*—Wˆa˜ÛZ:ƒ&>O0—¾„A±¡gJ]{ yFD|×H˜:•Ï™áPþuŸÞJ-x¶eÊZtòÓjŸ¹'÷ !p€/äK†ÓƒÞê"Ãñá~7 G„x-$¦MMP<3t¬ºb‰¥ËcÐdGoÐ#©Áp§t¹*Œ‡ˆ•]¥/(b{ûrfêch–¨§ì¿Œø(‘Uýá 'uÙ<äÙ›‘ƒfÇËQƒ^¸§s+½—»½+¹h–Ù ô›8ã* 1;úá‘ë‡o^ÁgƒˆRÎ n#*åÑ¡lK™Ký€DÕ/›Ù„7nºŽ0mPÜÈHÂá^Ò=s²¯JÚç2îÂÆ㘀_ÁDÕuKúí¼mMzùÍ*]Âo»*™éX±u=²Ì<4._K AJÂuQ=3ßÅ šÒì©ø)oƒi<ó-&“Ï©ýpXçRrŠ•³fv&–Ê4¿ ØñIb©q*ŽÑ«`èð‹¦ýaÞ¬Á>íÃœêØå µÖìn–äEv1%ë^ñ¬_Œœ›½Í%ÜZ”‚l¯ÅGÅ$Z÷â°´L冩7V9è±­ß, ¨|T ‹;Š+UZG§–„3Ñ]b´‰‘•cìôe‡K>@U0í·m©²HT–Øf‚†îè@¤yWíÛê-ùX]s.]–ÄÛÒ]žx´4×›LË›ü,'Œ€LóÝ…$kN|í:Oô¾¾•+×à[X8!ñ³B Ò÷n¨Bä?¢ÏnP 2kLë!¬Ší‘p·Ï5ÖÓ “B%ìæ$ܾ¸èºŒã>˜)ðý €5YYvÓøo $ò&hÓ»Ðsúà6í%‘r=õ»p ,k7w<‹^˜ŸXvó?yÍ0~+¼`§íYÕ¦éöÇ·I â—å½/ÔÓh‹ßg߯ñF G@M¥‹^ô—jaÚ†W+vÑl¤Z “¼1w¢0rªáRûd)¾ÔÖµ{“‹ÐæyaÔ†Ð$n£î)ØÆj¡\(ªïª zß.;»ò¢¥Iô•Ô/dßz§e;Aò¦T8­yÄ&bì{âCÔ×als»’oØÎ,Ù&&Š°MÐpú4¥©&d,”ÌæÂÑÑï¯ |ü ôþœHm[GþÃÉLû…ïaòc3~Ͷ~Þ!~Ý <0-S¥­…(ÈNk¡à‘õi¸•×°‹ù „p‡³‚©å¨Øµ ¥wì®è(éƒt*9;û£â’H†×_|óÅ4ª2·ŸRðËy‰Kž¶”êô£CÅô{Ueù(füðô†yaÆž[™"¡y‡ÉhÁa7•ïÝÏ$U…ï±$£äºÛÒ7¸ýG*êPZ)ݹ ~s^9ÂôA÷ |×Õ!wf2Ðx °’ÍägH…#ÍK¬r]¯#ñªq‚ ÖÝï]³ÊvV_Û…}pÊb´¢~ ¦ýL!ÛT³ûüÆ£Ò]¶¼"Mõ„™I@žÞ,E£Ú1èćÃya]¥òG§®¥ w¢jz«{S‰XMµÖºÐ@<=ÇKViØ[ÖÆZ=~Ù·DôI-7Oµ¸34Äqüvn†#A°0`ykù¡4ôº¢I§-A_ˆLÁ5‡V˜/û59d»,¡ÒW½_ôYü6½‘é÷û\¨Áiÿ›#ä½vÿ7ź¹ý[¤Þq5]„¯d?if¼aô±‚ éú˜\Î$l¤Ñƒ U<)ŸmÄ5Š Þ«ëK;ßí^a•æÄ“[Ó7[G̼ûè^ãLè¾xë*s?§ƒ(QdÕ¥v‚ ¸)Ú}~O{Ö]:%¼®;%”°\:¬–µ‹Iüj4;›†¡ïò¹+Á$(j¾xœ9 Øh8Io\WìiaÓÆÝØmÒ4Âx¿ÅÁ½ßø4þ+…´%OšQtôŽq°jÉ)Œ7¶Èü›?%{¹ÒžvK?&25úÁo¯æ.Èï?ÊÝPžð¾¢²ºÈÈåRëó~•¨'T±H;!ÿ„Ÿ›§/æ6UÞ<3ØöSçá7ÞzäÈkki³¤ ߪh”#ÓýJîYÑS8ËÀÛð¸Ü!{<ªJÊ‹ÓVÒ£Aû:—åÚµvuç&æaûÐA÷oŽÛ®èúxºíl­ ¿åîŸ ÂŸ#Õ{«\ö‰y=cÅ`çîÁ‘r¬a ½—¹÷VP‹sz¼ZöšsFw’¶;&Žo¼íñòY¸ÎþH Ò§MC… [ö­ûà{¡»æ. ¢žŸxàoûæ–HÛü´3ÓÛ×OˆJ€k6™ècàiM²„C{Y€÷šªí’J³´ ©(J¢\Â6èœdÅ6½úüÝ~Ú…3äÝÿQõñ_øêÄ‚³vÍŠ¿ëÅ¥/ÝA×+<ÖkÚŠk{§aJê¢P„ñUÌÁÎF™ö/Cì–¸½agQÆðð™†>÷œþÐÂô°.I(„W‚©µ²ì N®=g5®ƒ‰~N ;eUξK IÒO“üýû¨º!Â¥?¤€©ã•ŠigNÖ\Z7ï/ÇÙ÷˜»°Jýñ´¸4_§}HÐ5óŒe¦ÃÕ²åwr0”òlH[Êâ•ÄÍ„¢c=g"øG°ãL 6/¬YÅ&¾]ÝÌX˜V‡q»¡µ­®lÀJri£3‹¸R[XICŸÙU5}9×bú&ÐÌݺž(.e¥Jü_EgÈC =Ø·AñÕî¨$´ui/mÈ“-§.3OÐyrœ£X5fÅ.•[`~j =#ÄÖˆBV>S!že7úNìÀ;¤%îBì°S`&."åЊQMŒ%¶cÇâÕ—)ó{èáõp§׬Æäÿ”[é(s»•J줠×Kþ1d(6[•J1E-õ(aQÑóÑíëU¾³.•Þh<@(îõŠÍ…›#ò”ŒoÊH”ûÓÔ£‘±hárÓà3 éœÃÝ,4ÎJÐÛÄÊÛ±¸AŠW2¿¢Z‘Dê$¼œ•Ù>V]ÝÊy‘äp1Òw+Ô-‹äÕ2xG7¢\ƒËóqt!Iã->~®¨ ’ðûn(*˜/7†ý ^µ Þ#4_¿±úZÇÏñ?„ˆŽzǽ%³išd^à gˆ±&‚^µ ^cR³æh}WÎÏZTe":t= G>}#xÝF¸7qéjÂSè*•ESºßΦ;†Þv.ÏTUhU’‰&ÚéÆÔ¡Hñ²h­ØÔVZÁ²…Ú··•# ?©ÅXv2ßÑÑ:â¶ø @·¼m£}]^. ä\Õ·È”ª…‹I;áš"•fˆUÁÅg5F±+õóÓl®¢$æí«SpÖ·ÞO2D“‡×Ó5þ1=n#ë9µMßn²¼å¡^=‰Í6vÐkIÏãQ½ey†sù±ê6*>šãÝWšÜåxÇw(h+Tæǽx¡ÌÌ­^Ø ‹ñ ä1•ÑtãŠ%‘y©”˜µhBæIV/*ú]V.3ŽÝ–l @Q—¬¥ÆšýÁ?'W½Ô‘@ñàEÏ)rI×Z_¬fè¯ò†÷ŽP/dâÂâZZä½"wóv}Žÿ³e©Éµpéh“/,<±*£ºz§'°Ÿé+I=ýüP|Å߀Ê3³OZBÊr4Ûr‚ñF«Öm…ŽqNà÷#Z•l¹ýô£ô“i ‡W˜mÕÈCJ¦¹5+²èEÝwø‡bS*–Þ«+\rïUž)hB[âÃ×O0ßt4ßóCõs¡… Ž,@™¼Ö­{G@ÀK*£Jrí BAz =K¿ï¸R¶7ßԫµš_/ÈF&áQ3ý^ÇØFYPy:›IŠÆ!S©–›hjMh]8õñ·²Ñ5”1%c¸ŽäägÛ:]¿‹UÞÑ1—¢(êÎ[ yd3›I¯W’5À¢¬c{¿n\ð#//APÚÿ¸ ‚¹ÿÂ-ôÜD!D‰ï¼ÇZS‹‹Û”YðG 'Ísõ⾃Õþ)–öl}î¼Sš¯”[Ø/ņ(F´s.Ro~¯¶Âä\ÕxÝQ[ÓXôqÀµìK0^g1!òöTú//_&¹ÄÈHŸ 2ç÷Ó ¥|ä; ýRo4™š ;Íì1F NPEnVq„ºæ.髈¸{º5÷6nGÒî‘>gý¾• ØY°°|íÓaFÿ¥kcZæoãæç‘Žk*!ɼ¹ÕqÌüë*ÒØ–`— K¹éÑÛ´€Çú“·Ûœ9¯‚ÙG‹ ¾oÄÅýJÅ{1ÝñעР.¦—DvËÂ^ •C.¼9mþgŸGCÿ$‡Ûê]h+œ x‰HDK:’w&Áe*žc‚Ö¤œ‚5t~O'Õsî±_Ö÷kgl¹•Ã›ŸkGI·ßõSoø–7í#ÙÏÉg_ZÀy6t½L’j}[×ÿ0 ÇÛŠ½q‘Ï‘ÚöTst™Ìy/NGÔƒ&)$î›&lÇz~ë=¶ODðX¥"œddÄû¬5#ÜPõŒó ´¥úµÛÇÉ™¨¡ù%š@ŒÏÀÞÎWß)*IäãYzä5;‡K)WpœÙî üv2ân;lþ8,ÅÂ~±éÅç‡6±ƒ–’ö¾tq£Ýé¤è¡ÙæúFà{Íâ‹Ê±Uµ‚c~Ë4+ à›À‘¢~{Ü[JQ[âäÿ„v3~ÑV!Æ%¶Î¹~Oõ|B0 s÷¤<_ynÙû%†Ê…ày=øðà‡Ë ˜äÝj_\l å&ê66†påê+äãc‹ªâ—}¾¾†o×ÀxÄÉڦ겮õït'(PŸ£Ók*ŽŸ¢†\Q÷k/“+Ëà¾Óc!®ÝŽE¦¾Ûç‰IŒ“ ¾½ºBæ$°i5Aê”Î΋Ë{®? ¢jJˆô'uã&ƒžX ýmx|uÓèÉןú^RÁ³>ò0 ­øZ»Cý‚{ö4ç[‘ÜŒ\LØ­¦NÖÁ*I×N“íú£6ÓŽâ7¼jÜ/šC<^ø}p#ŸZDZêb¤eÒR%È3NÌX·>#Q¥P†^p'i?ò)Š 7ÅܵæØPOœyë.ˆ2ÆNTÊ|dd sLaóÆ$%í"J¾î^ªGJÔÛ&°+ñ•ô¶âCk&5·þz®þàÓ•Õ}àݯÕáâNÒì\è¹rŠ÷{ήûR,æo`ãÊ°XeIQ¾ŸH4=ÄÄSRÈC÷¶Ý(s¢ÁÙv\cÒ‚_¥ÿP."¢5‹°Ók½›Z`…°-’ îÀ÷NÕ£¼´£J%‘Ž÷;æ9¨Óÿüåþâìð&Üš¾¡e—eW -§îö+=zÀN%vïoÅÁ+O=]­¯è®RA¥›XÔKd¼{ï>îé?¡ dß=ÍéÍ/õÒ`”[xqLâÎÏecžUíI’ÝøèqfÅ¥½p ±Ê˜NĪXIä™[ÊŽÖeS PŒLgãâ{Äø¸#ª»w‡öÑ\‚‰ï~ f[!9Êj7Y>¬d¤dP¸‰ÕÉŠk&³wÌ%û"¦ãs6£‡ˆøWTƒïGåuêB¤wþq%­Ï™.“v¬J?i:ðÑ“ò(Ñê}v»Ã¶Ç”G4J‰a•³ssäk4Ÿ=î^èá-¹¥tY%?Ï-H`Ã) ‡Y4û~-â¸Ñ·M"QM×onxsq¤—;ct³w—7Oòñ6¦æâ±F‹Wš^Wj„þÂUšk*ªÑ|y¢åÇÕîN¢/h@þ>½/ik“&cœ]ßM:|öÇ;Šµ<;˜×™­Ï\zÛ ‚ÒqPO!éñ½v9ñ\5ÝF}ky¼•W©ÛHë2vQ[B“hÀ¹Üœ'^—l]­ÊÏ‚'"òÔ°‚ŠÔ¦4òÈ\`‚H$ 0 ú"ij ^ß5Y »Ä?ykÁSÓ*ð7;k#Šö>F27o“D=¶[SnÔsÍœT–»z\ߎô43®W’5ÜÏΗSxþ£3–pG]Iøs{—¶õ†‚}Æôã/søµg¬íïK¨`ɨSP‘رOµ©”îúªÖ¼?³~çÁ3¤Ý|ªQ» rèy7Ýn/ýÓ¹ÙLÅÁþòÃ&ïRéÎÄc5¥( —3—åÓ:Ög¡‚¡aÝ•P˜<ôÙAr`xaG 55 f`,úˆ’Õ¤áN[/ª±dTçõbž0Eg㘬iŽ¬Á3—DX&…€R@uQÙ½±W?«ÔÁOñ©‹„ͼ:Ž‹înÑæ5ñ<Ì%ËÉ­€I¥Ž˜ð¹KÕ´y*õDsNÁŽ×ýŸ(ÊžÉ:ùÇ„hjÍÙ¸ƒ¹×N±ë*›ó™nƒ=®Ù/úY·³()[‹îGñªÃø'Ã+_†£)5Â9b qW² š¡”a˜“[€„kO«öN´RèoQ™uÝ£Ú¥m±…|r5&o¾XRxïRΈ„´{U1›Òw!.—k VƒKêÊù:UYÿ?þ ý¿ÿW$0³š8»‚ìMœm‘þ… 2wendstream endobj 235 0 obj << /Type /Font /Subtype /Type1 /Encoding 486 0 R /FirstChar 11 /LastChar 122 /Widths 487 0 R /BaseFont /CTBMRB+CMR10 /FontDescriptor 233 0 R >> endobj 233 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 /FontName /CTBMRB+CMR10 /ItalicAngle 0 /StemV 69 /XHeight 431 /FontBBox [-251 -250 1009 969] /Flags 4 /CharSet (/ff/fi/fl/ffi/percent/quoteright/parenleft/parenright/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/equal/A/B/C/D/E/F/H/I/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y/bracketleft/bracketright/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z) /FontFile 234 0 R >> endobj 487 0 obj [583 556 556 833 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 833 0 278 389 389 0 778 278 333 278 500 500 500 500 500 500 500 500 500 500 500 278 0 0 778 0 0 0 750 708 722 764 681 653 0 750 361 0 778 625 917 750 778 681 778 736 556 722 750 750 1028 750 750 0 278 0 278 0 0 0 500 556 444 556 444 306 500 556 278 0 528 278 833 556 500 556 528 392 394 389 556 528 722 528 528 444 ] endobj 486 0 obj << /Type /Encoding /Differences [ 0 /.notdef 11/ff/fi/fl/ffi 15/.notdef 37/percent 38/.notdef 39/quoteright/parenleft/parenright 42/.notdef 43/plus/comma/hyphen/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon 59/.notdef 61/equal 62/.notdef 65/A/B/C/D/E/F 71/.notdef 72/H/I 74/.notdef 75/K/L/M/N/O/P/Q/R/S/T/U/V/W/X/Y 90/.notdef 91/bracketleft 92/.notdef 93/bracketright 94/.notdef 97/a/b/c/d/e/f/g/h/i 106/.notdef 107/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z 123/.notdef] >> endobj 229 0 obj << /Length1 1205 /Length2 6872 /Length3 532 /Length 7639 /Filter /FlateDecode >> stream xÚí“e\”]÷ï ©–fèPºKº»»`ˆº;¤¤¤¥¤»;”FBRºáÌ}?ÿçÖóg®yq}×þíµ~{­}ÑS«k±JXC-A²Pˆ+'§PJERŸ“ÈÉÆÁ!  §—‚,ÜÀPˆ´…HÈ)(È”YÂ_à!^!>=P êì ÛÚ¹™¤˜ÿñ%œ@0°•¨báfr‚ç°²pjA­À 7o6 „£#Pó¯®@M+æ²fpr­ÁVn@K-`ÿË“Ä äÿWØÚÝùßK ˜+Üéo›Ì@¸Ik(ÄÑh ²°«BáÕ@p/ÿ7lýgrYwGGU §¿ÒÿÝ©ÿZ·p;zÿêäìî‚U Ö ä?¥z ™“„:þW7 G°•ÄÖäøWì* öY«ƒÝ¬ì€6Ž® ¿ã ˆõZ€7îoìúªjJ*Ò/þg¦/ª[€!nÚÞÎÿ¤ýKý7sþfxw``/ ¼½œp!üù÷›É“XA­Á[ /гðÀoœx¾œ@0ÄäyÁ³³A nð-@xKü6Pà¯ÂgÎnówìoäá²;ÃGµþ²û€`ÐßA ;ú‡y9€ìnž¿×yá)Ýì` ?\ð"PwØï7<öøCÁdw…Ÿø†ûø×tþ‰ðÙ!à?ÊòÁ%’¿ îRúâ‡çWøMð5ÕHnFó7Á•Zÿü†²[ü&ø>Ëß?¶Õ?ÄÉ?µõ?4è䲃#|øì?.†þpGÎ ¼°?žÊõ„Ûí„;vÿá&=ÿÆÿ¾’’’P/_Vn¸SV.øÌà™x€‚<|þÿ›ÒÊAÜþþàá7ûßl† È 0?µ³_Q “?Q‚‚(i[ÿVµ¦ã[ëÓйDÇÂ!%–åjýÛÒt|ì-”-*Ï{2×è?QÙ£`—·©Ó[æ[é>dú§é*Þ›Î4W¡{Ïšë¦Î÷yÕ¾.¿3øØ›uÜ·—«Î$­½ö¡ÓÈ£¶3#Œ__6ÝQ'2¼š›Z'Õ¥8Š'rÉç]â“¥ñÐûHô†‹'Ðw¼Û|ôIf7V¨11®¤Q³nO±ÈÄBüWjùYy»"Ö³·ËrꊿŒ©°Wul®¾¸—•òòl¼4¦]oª¥¼]—^,%î°y;'Ú¯{3Ýö0LÌZ¹žöþÔz ½ *Àx78–^½DÏ'*MxÔT,‡YV!kôb7M¼©Õùº¾üÉ7ðÒ€õÇf¿Ø²XþÐWXŸŸc»Tt£ÁÖÿóanb”dÚCÕ9Y‰O¹Óâ—‹ªwæ­Â\n.Ó[  ]KÄɖ꘸VO`œîÞÀˆÀ–“âTs)Åý&<!ž;úõ[` µÇ¸M!›Ðѧ„ØÈåJ‘­‘µ:´gØ“n'Ôž¢vž+á+ÕàüŸB›'$­Ï°ÏzEó8cr#5ªLM}?YÉ¥6Bƒ+‰žoØ$;®Z‘ûæŸZfíxrÐÅÇ¿Fn¤QOEËÔÉP5¨`Éæ«ãÉÉëȨº8—z¥zÔo*–ʱ‡nmc°)3Œe=eBeÏÒÕ†ú)¦íó‹Ï¹Ž±ÑÅHáË&} 1P™¿Pi§"êÝ/LìÁ–þÕvõ—¸EKÏ蔑sûÊÅ›§ÜÅ°[Ø„Ï»>lP\vkT0‡=y©ËP¥Ê=¾©1鑾µÄ°0êv}$Fi½R½Àr˜ ý!xós‚ÎHVôáä%Ã@Ñ!3Ž»GJ÷ §ôÜ®®B°}¹E±B÷'ÚÒ/ái(I§ÞQ‡€gÊÃ5Æ6¨,Uºíeqr«”¹oïžD°qô9’õê‚œÐæ…c± 8ÙkU%µÞW·ùšÞåµv…tm ÓŒí«¶ñd1^”_’ÁëÓ*ñ·«gk–ÞžöM„<”’[|¤`ç6èj¥¤ÂÇ0LܳèåGØóWéf,Õ—/%Œ¾#b[S–½µ7=¾i¡FG¥æùt‚¡K©/×1ÇŽa…7oµŠ·‚5—–@Ù;‡ ªÍÌ—V>aVk/Õ[)œ —=kb%'Øç¾~¥Ç|Òá6ub£2Xr»³Ay(UB”y‰9.¢Œq*SúK¹§Dg÷;À ’£Ÿ|{öí6ô oMûÉs-ÀöRÑ÷r4'´ææÕôüª›QÙFXhj[½Üf(Ns~¦õº±qÈ°çΔTv§ÑÑ ·Íõ1Ÿ†Ÿ”%ý9žéŒÏO-–ê ÇOø¿D ”ö´±dŸLG‡ò¶QèÄ{ÞòG<¼â6å&ãËC¹Âe¸ Bó)߯ÀöCñcÕ9 ƒ‰ê U„î¬ÖdÙk2ØŽqé-Ü–‘‹¤’½#L TÙŸJ,`åm}ŒÝx"PS£ã‘ûb½¼©Ja*™+çmòL? ¶ÝÁãÔ{_WµqKxsÔÃÿÉÚ‰ ö~™ÂXÕOåí—C‡}ë]ëny7­%&5cüúf!oAyä>jºÝ #( ˜oÏ.‚O ")ív½År\mφ3ßöô‡.¥òzçÊ»GûÖ1·–_LˆOödI1ìf¥GC˜©—ZRèýFóBmðÅ‘EÞm7r¶#Ås”¨7/nˆ…_MÒŠ:E11²dÊH¾;k¥5›¼0§øÌ¥AQB”(Žvå¢p÷²íHÙŽ0e>UØ‘ T }ª`©”ÒÎßä¾E˜#AÏ°-.¾µäY´ülÚñ˜]ûyy/·Ã˜°Ç™œžpp»‘ B÷aʯ™òy™ƒÓ‚ù‹@Þ º uyfÕžã2?¿;»Ä“°Ôc5ÚûKåeR²9Ä£Rõ.»ääW "ÓëY$ë(,Végå.îo¡c…ѦQ—ëS•&!ODo9ìø°HÏ"™Ë‹ðŽ©Qoÿ…‘9ÿ…ƒ7zWÊ-¿(Ò¹¬iFÃ,’MP,4°,¯ƒ+½sLÞÈÍÖyP³Ðªå‡Çu÷N‡Ú+ßË;¤w8Õ—|R»a—t­ŠØ§ð¥RÈØv<ø*†^|öÓBáü‡~0ér›´¦úóЦY­¬å/Ñ$6å•fî ò•ÂæÒ Œ4_ÝG_ˆ¿Z*TÖ.M£ùP–¤$o7Ãý„ú±r©ìn*"ÙÜ»T/&Ê¢ì‚êÇ%Û+=­” !ù8¾öÂG]Ÿ^zZ–é°0F«Ê“x˜‡8n߸"î@= oúø¬^`]¨²Ì¯Õö›ÖM~#Uß*«pa헼ЎR_ýCNŠ÷¦$G²“#€l/Ì\&’4uìI‘GG^õÍ©GÐ`Å¡Fm{€Æí8;¢N"EIú€a‘-Ê8²S…\ÕRKη¹éÔOO|êë71¢,@–°E§d\éžÏ óÊÂEQ2wyÚÒ!eņ:¾)Í«ãUk¯T®×)J%s\«fZвϋ&y . V¶•9t¹ƒÚPo;_ÕhY*y‘½z8,q¸ª£h,Åi¾F®å+.+Š4µVš+™œŽÞtj@:I_¤S¥¨]Çùkš “vƒÈ0eIð#+W>—ÂFÂÑpŠºª(„¤Œ´,š¢Z(Þ {2*šå›Ù=\0P îð4ªC}óI?ãñ%cEYÒ'c⪞*Öh®g›©·Ë¿È,1b²E5ÔçmTÞr©š#åÈö»@øÐ/wÏÆš?¤Õô¹ ®(ÇÉÝ ¡ÈÂxX\È8ùÝ;/œu!#ç¤Åe8MRHkB~àyR0n†wêIÁ`gzú׊ÌcëÆX°ïãQÕ†™Ë “7$Ê$¶QüwX1(3©¨Ä¼É0ýtŽ©O¾‰:ïpQìôd—ô pþÁ•š·žÛ£ðþW­B¢bä]lí!)ª…½ƒ^YœºG‰Á„µŠj"WƒQÎXþ2³‰}¦~±í_9ï‡b¹Ò^H*~|ê$ñ5ÅXXX³:ë³êåëç½Éxªö  ÷ÏÑ»š”P«êÞ3Yà·ÚqYö-®‘í â¸×Ÿ˜HÖhJ~–Xà:÷m’Úïôå¯W(~G¾ó…Îä÷+« ÜVùÜa=+.a†ó/Y ·ë~Çöµ—TJÛW¶äÞà”ù¨ïóvüÏ9XIÎ'c( à‰JŒó–ì+A_÷—3 Éu-ªœiÏ¡ 5L#Ú#¤Jzò(£8ÁÙNô°”¥êÕP¿6‰²yÛÂNqÇ·"u¯y'9bqƒc…´ã¼ž4&p‘Øøj!hÏURl>GŽjOrá’JËk|ÎÒ—óÚÖ(œqÉÈÔ8˜ÇôÍg”ÎK=w£Èí(ÏžØ\»œðq‚?Òav8Ó·¢m³?úJèÝSd@Ë FÂûB”×-ǵ\Á_ÊÀi'ŽÄ†Í<¥š¬S}ìD^#>M1ä+è2m÷E2wü÷æÓeÍßs’ÆÙ®”Ç‘¤84giswG~S¿ÈÚîti™¶ù\jͧSæm¤¸ÅŽ_7ÃÈñLŸ®Ë+AªBg9?ò’žþ r˜säÕ˜û¯-Šð"çKivÛõ7_­äÌ8gïã g7°»Õ±ÄÅyD#Î\ ÇÌ%æªIÍ5¶}vqõq‘¶Xi$ÔUÕ+ôGÚ(õeÔr'ŒÓ¤jBÉËŸ(¿PͲ†>I̾\,ï§ëÆM¼¬¹˜lmŒk<42\|Ào#Ø}î˜Ñiß=§ÄnÌÒVâh˜<5 jÖ+L$ðÅÙ8ÍEòf3[yÏge[f×€o8,È#ÏÌü1Š­p[ÞŒ)9H8NoZl&¶PA0Íš X&*Ó3SÍîÛBlªXŠ­ú†¦‰-,µ÷T0,9_¥ÆNJg²Àýb¿ò¼ÚS=åÃ` füÅ ¡qK/; /ø#dºùv)|§¡ ?†î­jË”•Š&~Û„Ö½|V`£ä@Š´4 ‰vc?u†'±ÀãÊå®4¥¥Ù ‘¯_•¢.§ÜùØéèѽu¹/ô 6/{‡ÎBºx7(ëÄ|J«> ¸+Ê8ˆ#[£òLÓîÞŽ~JD÷ÚÌÃ.„wE®*¯ŠõÊ^3=>Ô%a9æzÿ4Ä>!+ˆ2DzDÂp~{ã~¬mqÂY€,™%§•O˽ù¶FšJîÐ%õ¹¶Ž~˜caª'NÜxÞÿdBX—\fÆå~ò7SÕ¼n©Ë’(ƒhñ~|Óâ ,ÈMVTñ«v‹ ó X³\þ•¬õ ø µJ+]T´ãêûBí¹? #=Ý@áR%tã“É„;Yq ]­U¦S‘_‹ûÆð7 GÖ³‰ô(.FqÆm6˜Ao§ÃëÄïz Z“Î~¬ì¥Ân>©øãßðn÷]·ñ7(KÖ&âŇï$ ©3ÌXÔm›&>ëÆã kHÕ©•~¦ì`{•€[®¸ê±A‚”ý½­ÛkG[ˆóCB†gžATkQÌc¨â6Þt0ƒb†Xô'Å’¡/ŠÕÑúrTKª•ÈòO•¢¬×íDî®™¶ˆ×Ïõí ¨ÍB¾ì§psHM2Ü‘æFðßè“-{ U¤œu¶æ>õÕeÜ*½ 2Häü.-„HyÐäóÖ iò ©'©K éu2êSIaÉÆWriÜtÇÇ<eß=¯W+1“Â9Ã\½ŒÌÕÃ@¡Õ’6Ù«ót¹nuéÜø`}q‹ ™(ÏCC­§œý#)9ûöÕ*M6û@2Oýî¤tòWª–¾W ùñÕ‡&©ïˆr4„çk¯äЛ%¿¾ÓX«ùök5~F†è"©ù3›y¹Ý\cê'’îsÇ€¥‘}L_®‹Æüqkõët¢m%‘“Ôªa£5ã’ô5J}9ì%yìô²vã÷£VWU^6Ùlžáp,‘æ y ¿UÓÁ;$ÅÁý•ÞÖC¯ˆ§†ž+ÙΘ6¨[E þ•Ž‚º³líN¯§xµîB­E‹äßhÜ©œÙFÑ¿̈ÛßC÷f›P¼õï²Pðº¥VŸ’pµÃÐÓ0+õ7b¿öië¤ýHY)SG»|®¡‚éªþ¹}Á¥ÛDüÐ,9kc%gd²#Rç’UáM(¾’ºK¼Öà‘÷ ¾Ûæ[¬DMÎ?=#þ…lÖµÊËÖøÅúD'á¼O¤¤-V±#(~¬©=[XG.šk¸G8dÏs?ñô‘Û›Ö6VXìàòƒ°Ë‡Ò[Q5Xö”ãDe¼«eng\÷|…VZÖ¾E-!H–±”Ü´ÊcC˜þŠKKâgGú£Ó ¥l_òkœ¨_ºL4 y)a…aDMV~n‰44Dÿb½‰Ë«î9ÿåö~ó`ŒçKÇœ½#oÍåá)xÂÑ£çæ/?.ÜæÁéè¿5«îÔ­޻Πq˜iâ*')Kïà°|B˜ûTlcì°@/…ô¢;KÞ/e q€ÒC›×¸[7Z½]ªº}6Žunfè“Ÿ’¶wþÅ^¯;金ÿŽÝ¼ýͶz¿f€ƒì6Ñ9j·§]wã±sl‘D†rakø:ñ8‰ÞÈR™z¦œ–“‰G½s7}töjùç”9 $‡Z´kìDôöÅbš€©¤¤•nwîaÉ {ÌÌÖM…QbçµÑÚ`¶wíßUrßdß?‰Ž…z‡×öaøÜì¢ÿTBÛòxéu‰nˆàp°kxœiN€â^f[ÀoÙ¹ÏI{ãâ>ëá'”lá77eñéWµýÇ›tç˜O›&Û‡óYøDŸØrb®EùtÞ/yõôôsy{`úM͆q FëløÄ”,g§•©[UËÕ›3öiÇMls …/å:gè"l´On‡*sئÊ}£ûoŸKÎÏd,}–ãD^Ê/rí£®Àœ®(‘D¾›qïMY¬¨ në“ðZ;Ü^WyÒ‘©G¥ÍbÖ;‹=å[Ì?ȹ†“ÝôPÚÒß$§CŒ¡*µØbV}éÉ`)B>Ê|d«›l ¥”:ˆùe0µh{Œ}ŸÑC Íœ È÷ðËoWÖs^¸ŒWÿ;E%ðJ®œÖ”¿";øþ¥ÈÐ÷Ç‹þqB*j̨W^¨LFãAË®¹LÁ;MdµÆØßåæŸ6 düòh·ý¸);øþ®Ín@[¶æ)¾þ-¡éŠ^ÀqM׈Èy@Õ§Á§xcJÕ¢&æ’lcÜW9hÉ»š,¼ÉYpBßîÚª1»ÿºôÌ15r,}Ķ~§LFºOùBag[áÐrPr‰Þ~r=#_D…‰W½ g®Ý် 麅Ö™})-øKmTïÇ]ö5L*2‘ oŽÕ¶ ™]ž×6Î3ÊØJ0™×_”>¿3 V E%ŠæÆïtFG1µ—m‰pü¥l+K]ã?ØG ÅÛÃeù•4òEGi¬“4³åÝÐH蛋sêQ±'ÙúËÖtXý ½º3!°%ÃÏw®¶jë§u‹xDõHïøHR>’¶›>ÿ+D—Ñ»jËÇZø´;êÄóœõ¡á¹Iúãf•˜Ñ–_èm‚´ŠU6“,X–KÑ…y 2;óEFJbë'¡2%+§x\AÓ„ìuM‰Å~û’kƒÑÓžäR÷¦à_K¸Û&×(Ü,áÿ2³ž¨I‹ê(¦¯aO‹X‡gGæƒk´Ù$½©8^ÅÎ6 oq5³"U‰±ˆ˜îÞÈ–u ÞqoîˆlYá3‰êÑ£~ËÐ/›?£Ç-8_*¼™ÕsÑŸ¹9xúóg¹ŒŽß9‹ÆV\<ŒtgL‡¦šàÙ.4K>BÚKiHO"™"ÝUø^»;:Ö75—P]Ð,¾YH•\ù5¬âW„ÓhkÎ0j€JŒO Æ­W÷ý1ŽÇ–´ƒä4•ùD“÷ÎjûI™¯™¡&]Ì…`Æsú¢yO^¦ÇM©V.ãÛ™ÐzJäc¨Y,g# ¦JúÁ¬ê}G7)²ÕKŒWƒ\%”MìáNZhFCóˆñ¸öð+Ûœ«þG“‚ŠV.¶½ù±£'Ù|¥$MÏüãè˜62Ç}œ¤ÅW¸¡™0QýGçæÓO–èÛ¾ºà!ƒ'y<ãÎvåÑ®ØÁ[õψ?á ‚ß îbö–Yjz¸FeÓœÏ÷QEQ+ÕxÜLùü¿—O3<“ñ–‹Ÿ<¸=ˆÕG·pVFšÁ0)¯ _iûñü@œ~¹†5É=kWFÎLO¼ÙêÖÌÏc¼Ä'ê={©÷‘ãÿðøÿ þŸH`å²€¹A,`€ÿ±dúendstream endobj 230 0 obj << /Type /Font /Subtype /Type1 /Encoding 488 0 R /FirstChar 11 /LastChar 119 /Widths 489 0 R /BaseFont /XNOKMD+CMBX10 /FontDescriptor 228 0 R >> endobj 228 0 obj << /Ascent 694 /CapHeight 686 /Descent -194 /FontName /XNOKMD+CMBX10 /ItalicAngle 0 /StemV 114 /XHeight 444 /FontBBox [-301 -250 1164 946] /Flags 4 /CharSet (/ff/period/zero/one/two/three/four/five/six/eight/nine/B/D/I/N/R/S/a/b/c/d/e/i/n/o/p/r/s/t/u/w) /FontFile 229 0 R >> endobj 489 0 obj [671 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 319 0 575 575 575 575 575 575 575 0 575 575 0 0 0 0 0 0 0 0 818 0 882 0 0 0 0 436 0 0 0 0 900 0 0 0 862 639 0 0 0 0 0 0 0 0 0 0 0 0 0 559 639 511 639 527 0 0 0 319 0 0 0 0 639 575 639 0 474 454 447 639 0 831 ] endobj 488 0 obj << /Type /Encoding /Differences [ 0 /.notdef 11/ff 12/.notdef 46/period 47/.notdef 48/zero/one/two/three/four/five/six 55/.notdef 56/eight/nine 58/.notdef 66/B 67/.notdef 68/D 69/.notdef 73/I 74/.notdef 78/N 79/.notdef 82/R/S 84/.notdef 97/a/b/c/d/e 102/.notdef 105/i 106/.notdef 110/n/o/p 113/.notdef 114/r/s/t/u 118/.notdef 119/w 120/.notdef] >> endobj 213 0 obj << /Length1 1167 /Length2 5165 /Length3 532 /Length 5923 /Filter /FlateDecode >> stream xÚísg<œí·µè5"z%JÔщ½Eï¢d˜‘ÁÆè=z'ˆ.D Ñ#z” %¢Ka-ê™'Ïû’÷9ß÷Óùûþr¯µ×µ÷Ú{_÷-C!e0Ò¢D …€Â@9€ªž±(,Jzë–* B;#j 4D”•”=ÄD@)9qY9Q1Ò[U¤›/Êù! àSåÿK$ P†CPÎŽ @„†BàØŽ Àéè Aû ”a0€ñ_'<ÆÊ &`gG4ÀòÐA*ò—m„ ý7 ötûOÈ ‚òÀšðaMò°ÁH̆8‘Šè#±µ X'ÿ?Lý;¹†' ¦‚ÿ•;£ÿÁa¾ÿ'Ž„»y¢!(€ A!þ-µ€ümMvö„ÿ;ªÁœ•a€èß”³‡†³lèŒv„œ@0È/‚ÿÛvl¿,ˆ¨š˜[ªX üÚæ¯!È6õuû'é_Ú_øcgƒröÜb…Ø÷?_¶ÿ*¥ŽpD‚Øë )¡P _Rì½À"I€?àŒC|¬_a=ÀŽ$à„D‘þµLì¾Eœ~q¿ „$@êë… ~SR7ìÎàß” @Ä‚Bþ&d"Hä,) A{ÿŽKb« ¡(È 1l]¤'ê7!Ž%œ½þPHD<°Cøc­y@¼þp†mXäïþÃHDÎÁ:uD¿Icëhÿƒd±F­#lŽÿ  (6þb›€ü±~œC VŒøbÅÈ? ¶Ôð¯^þ€ØFÐ@lž@¬+ïßûÛ‹ü=•ÿ~çTT>þBX…vØ“âiIÑÀÿKèè‰BAè_¿3öæþ;9cï9âq$™B:Þ wÉhŒ,R/­ ¸}MåaS²þË®‰×daŸR®ÁJßéºß^¨·<}‘M}ý+ÁWvïsfØö£ L¨{ræäåW¯_³ýZ˜-÷³õ|¿¸q‡mQ¶5~<ø.yÍ`|a¨<ͪ¸/o÷íV¡!Ÿšé:Ñgœîû^ Ý9áRÒ–Ù0³¨ˆzqã™îåÑQóÞ7ÒãÏ r‰"n˜ÛC¶{Þ<-".H½´9Ø¿{Ÿ.wRÊñ~r:‡AAqñZìñE‰9-­ç§U¹"J£â<É™ˆ ¹© )õf®Ç“ï–™ò‚„}þ1TÈtõÓ^…ûCÐû5›Î¦þÎ CŸñÅ¡ü‘7—†·N)†û0]½'ACÛÔó‹Ikøîoç…UÅY=¾å´»¯wF?uHõUÂXÎK?Þ[õ“ºç–¢¥z\T£å¬“ñ S! Ê#?]10¤1ú9ò}™ôxÙ`ÏÆàæóâÀ™y¿ÍZ£k\Ô,$Û7îLq¡Å§òŽ2­°½{ «­û›’üˆÕOSÚÞˬW¼.ÁÏ{”Ÿ–¡59•N•‡ªä*d¸¦.6eÐßõÀû)C<_~dtÄ<|œnF­6T^FÏ$–ÇXrQ˜ViÁнÏ,ÎÝä>¤æørùçš ÛE7nÄÕ"*=m]Š¿FcV *ê‚—8#dW̹¯ Nåø‹¨<¢¡N…†ïÁ¶*”Á¯jg [§d"r÷¬*=naè[Žõ‰0žË¤Àþk,”§YMïMslÔ¹FOç]³ÆÅ+ù„vgØžÍÆ/Ëâ—Î@'«ïŒY2/ÑQ1w•Ð¿uUÍ„ÌÌÜÉ^?£ª•|ïns“¡~Ú׋5!(okÅÛ„y2 ¨øšwõ&¯Ï°ÿS\û§‹1yAdiÚw2j6ûð¶ì¦Ë^8 „pà>wv…4“ÁG` Å>¸‰B‹ä;Mw~²á÷}ƒÈP ±Ô žàgûÓƒµ2oE\|goóõýˆ‡Û3õÄE‘ûqÁ”Þ+êJÈ<ªõ™Cz:4’ܬ¤ïSAutsä M’í„ËÑ/ãŸQ©Ç0îv\„*­8]U‘·w#ˆ\dcÖCEãøK?Q¹úÈÓ,Âø¿¼,KžÔ¼r®˜ÚàÊUéF\šu|ëØN%R{ZkC€¨&µ#A Aƒ¹§ éÚ ƒ'ÍƃâæÌv"rx.ЛäÎAï¨uXŸ¥úÞ,lRq&ø4Pº|‰‹Œï 䥚ž=Â;ƒŽkÇ9ÝnÖ†¾8Þæ Nxj©Ùõé®öãQä ä¡ãcY|'“®ËÎÚ—U{Ö².Of9'˜©Žpôì8ˆ…òH™‡dGItAÊ5Ήm_…~Êçzm-•ð黹!’ωÿ|‹÷ËAÇ ÛËîùN E­’ŠNW ŸùS6bsãÑ·!VÓŽ¢ç/jcó?ïE7Ëcš\Ž%[\kuV¶™*bÓiÍü<¬ŸÇeé÷6ªT°7͇(-³+;<ô×…ûáí¢¨C__“gÔäBéÑ|I jJ[{Û¸‡ZCbÏ:v¾ÒYŒ ‘1Z-é¿×ûƒ¡}š‰ƒç~õ1FP3aî ¶1.ÙïdíÝßNUöUô§boÀq¢ì]ùÛ#öM ©wz‡á<Ü„áÕL¸„®7JêËYQ0™ûâ˜?áH4 ¾X ã- ¥bƒ”»&Þu—ë;ðÉ”þFþš°2u¿i'ËÎ%VF¢ßßf…³UåPÚÏÚ¿¹¤Ê-õYz>Ê•Ò9I,Ëœâý|vJ”¬Îð3yS›¨S^º†,¶…>’…¶§î”Šé7ÎHti£Ø\áoÉNÝÔ`I„äí’^š¯¤´Ðú¶Õæ8? }[aòÓ `|É™TpÏø Q¤ö-O;Ì@N¥b†¨<ÅÑq îuO¾êˆºÚ¦¦WúGÆ/à™”kœs׈"ß,òZuÚPIž)v‘u9 ¸ ìÔ_Ïd±¢šxå‡×É"nWpÕ¢­Y‘ öÏÜÕ92À»zú°=§ÅÆw©˜ù®»˜jÙšù‰ìáwKËMùà¼V ·z [IÁö¨y£ôʼnkÕÆz?Y©äÕ¿µ<òí¢…OŠœ4™’•>Ù0 ªU‡›8¨Â¡lS÷Ç«Ø($ƒáÊàmh'LàñAç©û ®4ÈˈôºøOùl[WoC7­¥ÊÆTZ 9­siš}^tŸ-Å“ìH¿ÀÑ|eW‘»Š¾hä­¸¾&în9 X›Â𧠔o¹žò…<Þ÷£úÙ¤‰Êñr¶G–Ô«9/Î'¼@ ñ¥—'ªÓ8ˆ1ôÁuô› ¤ËÙXq¦óUlõ¾¾™\kü-2JMÑÇÉ$Dx?ø¹fÍšŽkËHÅþc­P#ùÐS÷°~+‹ãŒÂ¢ì#÷½÷iàÕÃ/dWö˜×ûÓ:1—„Œ£¥f¾÷"uéÇËâ,Ý«bØ~<‹&3èÃå3 0`i’{ìÍ%G¨]jySp3k…ï>ùúaÇ}äÙM¨9cC1­‹x;¡OC_Ž§MÛî´NÕ-iÃUêÊ[1¤K?¼B×›!» ]À©9æWﮩ¡2ÊLtâóçiùK5 qng-Š•2}¦ÄœÑÞË«{½ùÛ2!9êŠE—äÏßkùà®mGD‡lG`ò5NÛù›d:p3•ãp@´Õu®YfJôEy|iËûÃŒOšŸ©|BI[7‡Ÿ“ˤì$Î=©ëZ=×/üB˜b|¨×yÓΛ÷¶mxùìZÔJ!I}¢”B¦mƒjžÈïÃÌj‹Èõ…=oïýž˜;6[Ï ÷xD;î"9È BDhýë5rx9¬;T´|@æ™y úƒ&†o_” ÏœäË…'…(´¿‘WueÁY«Kö¨îö=I.t×»&´ÑB½G†Ö>Á}þYãC“•ó4 '³&›’Ž‹žåµ/Œ’ü2À@¶}›D˜à{’ë³[±‹bUDô*8?Ûwî‹É½Îi“–ã»7†+ü£å5Ù^fú¤z®DM(õ°çaðò®«(ͳè• \)þžMñwº‚ªÐʺ¬9¤8a©Ö$Rm|U¼B²Ü¬L3BÑ8È>í Äç˜GÀ›úóì[v“ôÄeòfïö8{“í£?˜íÝ¢µ§Ì]Jã¦ÍõQ3ÇcŒ·2izÍs9˜(-§í<¼ ä~ô ½h ÏÏÜlîˈKL|±S&GáÂýòŽÁÌ°×üÎG¢à¨ÜNÒúÞÕ´/Å“×oì-X­¾/]„i‘!“:bL½Âm÷­WÞÞBü›z—â'ž¶YeƒŸöwoêp{i(ß‚6é-¨‘2…ØU°Îà2³[¦Ÿ|rI«< ³,0Ä—u2wE™ê Œy1[q3˜€ìõµJ"‘QwD„'¦¬M®W,&ûòaÎcl›_â„nçCŽ6)™rß±nß#V½p4e{™—\/‹ÈvQÑâð®'çÐZ¯'x—2íø±»â>±KQ¸•ŸXK£z¯§C7ûŠwçÌ=‡ý,¬Ú>ó‘¢”ÖljÅøç§‰Ñ ÝQ®ðA÷àÐ ´œÓo[º‹î+±0>1ñ}~QCN#…–!r˪Ä'*TåŒ1/cÐ+(~˜šýŠÓ¦ŽÃñ鉄§°)3¾ÚöžÝ2¡}4íÖÛ˜¹ÚE‰ÙCf—9Þ,ºÖÀg¡2)A±¥õŽŽ?┣-Hì²nBkx/\;dÛ7ÓºoÎØ*7ìYÜÉdŠ¯)[♺h-úBTÄ‹!IÀI L¢XÕÄœ°³ôUÝ('Údž²X.YZ{C«Ëtêþ(y™xôöàêqæX w8Îð~ÍãKd nŒr·!׬kJ}ï…3ŒUêjPˆ[‘¸ ô ïm°æÖC‹g„«ÌÖ?ú¤_`ªŽ3äñx\e퉗úö‚H æ_z¾Œ­-VdUüÁÃZ¿Ô<~—ýNÝÎ.ž¤²B(‹“öy²‹’B,-4X{ÞP/üú`ãØgZ»ïà¨@ïÔÉdVŽv¸ß°!Ë%‡¨]ÈfrMÈF©yNÐúÌY´p]½FOŸ§í7zúÎÀÔ›!êqýøšK¯x0G äN1 QLäýÖ'íeošbZs^:¤Dùñ*ÕH ’ZHÝ \çð´Ø&õnžÉ Ù!}ó™½æ"`«PÁÀðdÒ¼š nfîíÝREKÂem<ö¾K–GütSOú¾ôqO}Àë[¯"mÃã—{¤mPÔDRRR‚qH¦dW²f› ¯<žÞ,ÄÉ>M2.鶴Ý&ìz¹ZÑQg°ëŠ—›v}³ N“1ŠzãFáϸQ•2j_üC:)×ÚͧYé|“ì½ÒýpoØúª*&ê&|'áÌ…åq9µªØkRåq°ZWkîæEª¦½FjÒsßVYŒÈ8Q÷˜”Loß»xIÇ?Ô؆ÓXp–d¯eæ Af÷"«¥Q+‘-±…m+$&M»Qû Ó*;îZ5«Rý‹2N—îÛ8D÷CÀ¤x’K¶ê@ñÏ>ˆÏVPËÔÚÜç»Ï“»º,¾Ô¼ŠÝ7sš¢ãò- „ÍÛÔ”ä²rÃöýÍvhÃæ2¹êÎ/¢¹^OêÖ(¾s+Œ±V\˜TÖŽcò¿æe¶˜õ<‰$`é”âç¢MV›ˆO“ ´gZ¡_e|=ºôØ/?` K9áû”˜¡©×¾hbÚ@3T"Äåî†ÃD>]%ÿmŠµ•$ Äc—²î3–TMî`õ›„viWøö-±‚¼Á«~Å[Ús•©“×W;!çžH~›ËM3*LUÊsq´†Û®k…ÿ™±J+ ÈVbÙvvønÇ­Ÿ ÏBN6T:Þ¾³\`DÃZIfzl4¢“Â-]ÞɈpˆÝá¤éí>æ× ¢Pp×£¹ÊHu`¦Ê Ý[åF4øÛÍ>Ã0”+{‚ô¢Ž”5˜e<é ]Q\_ÓXg):®Ä#¥&ìZT¯K Kèôp¶‡˜¿3^{djV$Ú?@ëÈËßêëU›^såT¬·DKÿÍÃË´[¯°‡ó¾Í"&‚wœ£¯i¹Ñ«XY [$J÷-ŽõØxp?f±eýœq÷Cî`T4¬ì¶þBmø´¹[Þ Šþž§¼‰)ây’º«FKz×g÷-æ_ô1¯ñÚÜ^‡Â[XÚ DÜ•ñ5×x›øZ®µ@Üôè}À'—¾ûUƒ©G_’s‰WhH4¥eá‹ÐÍB5÷¤åÁd/¸é¸°r%|½4E·à¢'’»»p«`‘˜‡ŸÎ.ùýufª¸7òú_ŸÛ®³•^£7ÛQGw|CmVß÷IȈao™¡0[¥q¦H!~“òJÝd:òiÃM×Ó '¿W¥2\Žé{îûr‰]ÁîYv||gÁ馟b4vÙÃfFß1c²«Ë¥Áa§o¨Ÿ˜c.8xÆ'žÔéõ4VÕO©¨ã†GƹU»€º¾áR2¶±Žw·yT ŒØ7 :÷ñ-åþ8Wó8ŒMÒºÞª$I=ImÔ¨3j[›[!$’ØÜq!ž³Ö,ó\¼Qn«¦ÜH"‚«Ò‡u0wŸÜ°éSÕJl°›;Ÿ·÷ÑàŸ{× ×è„•ãé â«li°tó]ètßÒ‚õ:%qV|þà'ØÜÞŠ’A=® Òbé_׺M2¼¾K€G­IÅãô²àJŽªMiÒ ³mwåë*]L¾%ÉO?±k±ó ¾vüþ àH»oBÔ›ßÒ#¦ÏOŠ³]³æ\@JN¿‰ÒÉHH¾gÉbKãâSîÉ/GÞå{øsê¸d­ENaž0иëÈ  Z î1—Šø¡ ·—Õp­½ïq¤ŸúƊ•s-0Û]ž×/¤Z³†ÉG‚ß’f:V¨wç×Ó¨Þ?¬½ÎÊ8lO«r&ÔpyÊá½øÁ"­R³+Û<άÇØä²°iv÷ÙäÛñœç»ø­,.Öf–%R\Pº¦'õf>Ž·9dç VGÆô)f"m¹ Ý·%ˆX¯I«ö€'ø'â4øæíφA•"¥©¸» Õj#,/Ksj+l×à·’¥æo¹°|)!sEv¸ ³Ø±xì(»£$õ®øæŒØ—”bçÄ +ï-'b0ç.¡P+µé ¦ÅÓBü†ÙǛÖ2øM^4¸êtÕ$õO|öÅ{Þøªo;V'}Ò¿Õ¥DU‚×êá"N¿Â—'AâHAfPÞi¬Ñ–#¼)‚¼ùqÎV{ˆg~??—9„îv¤zƒ®, ˨¿h°¯Œf{è^ .‘§³Þ‚¯õ’aQ»7ÛÚÇI%¼+­Ø|àœ!ƒvÏä×ÓK2¥‰]®=ÑÿLJôüHàƒ€Ph$„r%ý/AsÏendstream endobj 214 0 obj << /Type /Font /Subtype /Type1 /Encoding 490 0 R /FirstChar 11 /LastChar 120 /Widths 491 0 R /BaseFont /CSVXBY+CMR6 /FontDescriptor 212 0 R >> endobj 212 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 /FontName /CSVXBY+CMR6 /ItalicAngle 0 /StemV 83 /XHeight 431 /FontBBox [-20 -250 1193 750] /Flags 4 /CharSet (/ff/hyphen/period/zero/one/two/three/four/five/six/seven/eight/nine/colon/I/Z/c/d/e/i/n/o/r/s/t/u/w/x) /FontFile 213 0 R >> endobj 491 0 obj [736 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 417 352 0 611 611 611 611 611 611 611 611 611 611 352 0 0 0 0 0 0 0 0 0 0 0 0 0 0 443 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 741 0 0 0 0 0 0 0 0 546 676 546 0 0 0 352 0 0 0 0 676 611 0 0 481 488 481 676 0 870 644 ] endobj 490 0 obj << /Type /Encoding /Differences [ 0 /.notdef 11/ff 12/.notdef 45/hyphen/period 47/.notdef 48/zero/one/two/three/four/five/six/seven/eight/nine/colon 59/.notdef 73/I 74/.notdef 90/Z 91/.notdef 99/c/d/e 102/.notdef 105/i 106/.notdef 110/n/o 112/.notdef 114/r/s/t/u 118/.notdef 119/w/x 121/.notdef] >> endobj 210 0 obj << /Length1 903 /Length2 2050 /Length3 532 /Length 2668 /Filter /FlateDecode >> stream xÚí’y<”ûÇ¥©‘%»òDöeflcIŒ­ÐØ’%T™g˜1f˜ëàˆÄ)-#J–œcOD–$DŠ(*k"E]¤²o¹C÷œãvþ¼÷¯ûºÏóÏóþ~¿¿Ï÷ó|¿?¹}vGÕ0xª'dA¥0ÔPê(}À{ô¨.€RGÂääLiÈ R)f ÒPzz(àh Z_SK¥“L©~!4¢—7P4UZ/B_ˆFÄ 2¼!_¶$G©8"ÄQ0d2à°~‚8@tˆáÕa(€'â€'äE¤Àë†,)*€þÆøý‘ „ht¶)@‘mR `[ÄS)ä`*»Ävòß0õ³¸E™lú®Ë¯éoiЗHùWÕ×/€Ñ,Ñ(?—:C?¼a!<1À÷ç¬%$qŠ?BDº1ÂÛ8o€’éÐF¢à6ÁžÛ†Äq'çcv*?ö¹‘³‰†cˆßŸªëÅŒú‹ÙÓ¡ƒ7¤:‰b²ß?¾<~êeNÁQñD ûBhë †ÀØ7ƒMÚ)x(€‚Ù†ê*ƒ}`Ï$ Pi°õujë•ÌÞ$;¼A#„ÅŸÄÞü“PlhjÂ&ÔÄMÈÖ&oB=áû¢Ø}(›­LÝ„Z‚¶ ucÿ>ij0SMGPÓÐfÿ:RG@ë Âÿ­@£AÆÆ-fïë&ÙÛ… `ë}MÅœ!±*ÎæE˜g?ÏçQæ4ñºwѦìaWíŽèž$NòoO­ý•K]– R…øFyF¥ƒV$éçî‡Ù?³˜:í1åÕ÷ÑÀS£©¡U’.ßR±!üdæ£ÇwÕT¼œ™Ðæ´ílÍ»ìz«éÆ—æñL;E3DZmû8êÝïÖ§ÑA»X¤’ÅÆ”ÊkîsàOñÏ‹ÓŠ}Ä9™ûMGt)–·R¥ÿ+õ~€àR6oÆ¥ïî3Ÿ:ÝD-£/y2.PXáa}FÎ~ûâ"^Ɇèh¾ t†ˆ$é`Ëêëýñ VEzÍ©ò‡…–BNÄ^y,QÍÕ[YIt¸+äÌ)Þ¡ê rĸ˜Æ1įËpÞSùþ_±5[ÁÓ §Tô£Vs¶°Å¾[–O1åo…– l5o{DÂ-|°N.߶kº‡—³ŠïJö~`h´¢C0<°%Ù®ƒ.7h“¡· qHbHЊW“f´yB½Üê¤šj É㳃 ÕÇOv»®*¦¥ú<¹ÆïáFžÖ¯%Ý=± ¶JP9ÕlB?g`«¥Ìsª&Œ·Èd1P[:Gæ8Ÿ¯Óãå!RäõGÞËê[lsÈž­Ìº–½¶î>?¿0Ó¼•íÔù£…©Ur-“Ãq,[îåŒGÜd‰¯¦kgšÂh Ž µ1‡šÇ‘±²ò>”÷á¸åxúžœó V£õÜ¡W{#¿X}5•åõžìXrY™ ?mßã°j¸ãKýîV\:U*ã#E-.µgN%ÈìÔé`¢Žô |6v›¤b®"÷u ü$“æîOÁÚaá•”í©Þv>-žÉZüÑg3øtQóúÈóèØ öæ«ÆèÊ…‰C7ô—&xü—tïÄj¸ê\Û[‹TºÅ‚Ð3•¸¾Ë+¹Kˆ»»¿F %n&˜{傲†wÐYb¸–ã2Üuñ£¬BƒÔ²NîCúifyµÝáù Üø¦KÝÿ4—ÊØØõ.¡3¬gE¹ü®õïî|1ÙÛö;iÊâÐPž€ÙaèhlJ¢,P ¥ô;Eü/KýVy3“ç–T|øR—Ó¼5É)W/þ†IÄûú5®a=ÑüJ©¾ËŒsœq³-‘û^J‘ ÞDó4DŒKOô^¨EqLH&ÛÛiœìˆ\}w.ý êü4dtÖ.'&ŠPב%¨ÏêJ›i«Ö±\.åi0æÐàS~y+kô}Ùó᜻û ‹‘w~°Ïö5(4ÖH1•lÆ"m¬‚¼o‹òF;%¦éŽ øûYýCIîÅဒ¹à¤GgN•‹âzNçÎ h•ZGSYÕo»^C?ª„©~€Í{|¤tZHõÙ¿»Œñ ®ô¿Ii7úþÕ^&Ì~B4÷ ¥áøꞈêÌÆÒÐ9.•2¦’î–7l Á©bÄÞ‹¿Ö<îÎ9ˆär¯Ó_ÆÞuÓ3ÉP-àÎ~/ñ5™©­ºðDès’­e\æW Ä!ÚŠ¶Â™)Þþ„tÄ'x±Xðž°9ôÝ(½xùVÝ„¾¹íµbÛTJü?Í ×(U ëð¶65ìªlWM¤,eq¦ûèW™<“_3•Sxªn,XO °Zo㯭5ùK¦>·7¯¶æâf ô8ktj½Ø÷­ ^œšÄ›£´Àªj㊖ýr¾Š£]|lW:ucxnzÍ{Ú¾ÀÛ|x:Ô¡xZäqnR‘ÙËj$K˜° «L»>kAGWÌ5ïqêåÐd?3'eÍÃ1Ðëø%=K¹ÄÁLÛ¾ñü®‘n²+þ¼äGæ9ûÁ½Ê^ý­â¿¬i9¿Q!èÜ¿Eiî¶yDéÞ¯6ãJÒÛ{gÊ®7›’TóÌC›2GXà›À4@’k§¿[1oÎìû‡­§-!8wË$Bñú›D~jüy—udLů'—Cž³îvÔüI—Œ“nŸWé+eÉ ,z½’_äU;ojO„jâütØ}»Ê'÷¥äš9¦ß”¯¨:Y?ÉzÂÝ5—­{¡?EŸdÖk¦Šf¶Ã9}áÂù dy~sá @7Âvêì¹;å¸lú1£ÕÛ¾3Hƒ÷ߞƛ…°ü\]zž·ý.ý”(XkiØqØ\-(»îJýGéÅPäøÀþ/ð?!€#C Aõi>°+Âlcendstream endobj 211 0 obj << /Type /Font /Subtype /Type1 /Encoding 492 0 R /FirstChar 58 /LastChar 116 /Widths 493 0 R /BaseFont /ZVXWUP+CMSS8 /FontDescriptor 209 0 R >> endobj 209 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 /FontName /ZVXWUP+CMSS8 /ItalicAngle 0 /StemV 87 /XHeight 444 /FontBBox [-65 -250 1062 761] /Flags 4 /CharSet (/colon/F/a/e/f/i/l/m/n/o/r/t) /FontFile 210 0 R >> endobj 493 0 obj [295 0 0 0 0 0 0 0 0 0 0 0 608 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 510 0 0 0 472 325 0 0 253 0 0 253 844 549 531 0 0 363 0 384 ] endobj 492 0 obj << /Type /Encoding /Differences [ 0 /.notdef 58/colon 59/.notdef 70/F 71/.notdef 97/a 98/.notdef 101/e/f 103/.notdef 105/i 106/.notdef 108/l/m/n/o 112/.notdef 114/r 115/.notdef 116/t 117/.notdef] >> endobj 206 0 obj << /Length1 1419 /Length2 8046 /Length3 532 /Length 8907 /Filter /FlateDecode >> stream xÚí–U\ÛÛ¶¨q(VÜ%¸»+.Å¢B@`Š/.Žxq-îPŠK)Jq—"=YkŸ½Ú³Ïã½O÷w“—|cŽ9Ç7ÇüÏ$LtZº\26P+"ÔÆÅÇÍ÷ §®#àãæÅdb’saöPgy ô À'&Æñøy|ÂÏÄž ‰a2ä .>nö`;€UŽí¯$€ŒÈÍÞè PÂì@Nð5¬€.ÔÚóáÈ@ ¿f¸t@î 7O 7&ÀÆÞ°í1yþòQq¶…Dþ¶ñpù÷'ÈÍ.`…K²àŠ6PgˆÀd‹É£…×ÁMþoHýç⊈Ðé¯åá=ú_£@'{ˆÏC\<` 7€:ÔäæüŸ©† ©©ƒlì=œþsT„Ø[Ë8ƒ! ï¿BöîŠöÞ -{˜µÀqý9Ûü§¼m+ðh+ji)pü}šiíaz>.ÿ,úWîßÌ÷›á½q³÷˜ðróòòÁáï2ûR ÎÖP{gøã $ º¹}0áÏœ„¾|{g7ä ÷åáv†ÂàSð–øl¡n˜&?€ÇÖþ¯Øß(È àqºœ! [Øï(ßGÿu–ÿ„<ÖP''àïˆ0<~¾P›ß!;èn÷;" àyrƒþˆx Î X.óú=./³sý‘ñ—5ÔÃíw@à¯mxþ‘ws‡·ð‚3Èäü;wýýÁUíÿýkƒèïIÂðe¿gÃgÈýC"poÅHî¨ó›à‚º¿ n£ÿÁoÏïŠÁ‹Zý&xo¬ÿ!>^x ›?ÞÐ/þá²v ¼¨ý߿×püá?®áôùàÎ \úÂwîòÂ5ÜþÀ¿Nâ„kÀþ@¸†Ç¯ëõùá…|þÆÿ}ßde¡Þ¾\b.~øï…0@Dˆ×ÿ$Z{¸ÁŸbØß_eð[ûo¶µ‡ßqÈdùuj-þÆá]SXÙk…ÂÉrTvDYps¼F}÷LVÈB"¤øÓ WöÕ:£Ÿ„¸;¨;´^÷”îQí~ÚcŠÇA®ñis;ž–;¯Z)Î2Ô}¶]è¯CöŸ¶5Í^!jN¯Ž–% dŸ îçk±Êë}G_¦Cè1ñlèÉ|#,b¤˜Ñ­c ÓÁKs-‹ _ñÂKNDY™yíŽÑ±t m÷ øYˆ‘—ôhzM‡oÝN+ ³ÉN¤ó]ú ´(ïií¯þáêç™°®`uCç“JHaXuö+ ‹©Òq…uÏcÎÖv#º&a³Õâ-  »"Õ…÷¼'‰…ÐM>Ff¶©fˆZ),õ‰¿°ú™P40„$²…Mˆº‘ÛftNè£Þ’Ð’r1iQÇ°(éVçø‘Q Õ·µ àDêNc›Û•µõi;;t‹a2¾2™3ܱxÌ'Üú¹NÔ⸙ͤÆ/×÷,“nÃD^¥¢a²ç72å–È<¢RÏ©òwŽé—Ú­XãgȹÜðsŽDdö–0Œ>'¾W-ÃÜuß#Z%å,›À‰¹T>dØ´I«»ÓpSeFÒÇ]È0`ºô‰¥z"±×SšfeüxòâI@ûƒ¢H+NÒî ¾¯†¯Ò›¤Všb^è’tñÑòZ•»: „Jöô,:y³o¤t Måõ¢öÃÁ@©âÆ%GA2šÑñÇ%ß½qqM¨è‹µl—ªcÎØ :‘h½ÒÆ¥ëÑÄà ‡÷¤ÊrñIbßL£ÏÛT¤Å#T©z-râZ F7ùÒ?dsJŠ°¸P"ê@lû€¾)Dó§´øIXÔïz¼I†M(2ß=#§ø,.FF\©È–0$S7«\úü” &“'ëÄýÉ£#C©°Œïuc-øZ^w˜Ç‚éºqþjöbÙJ›e¾øî`ˆ]bê ÿ½^(•„c³Ù^”Mt€à¥+uÍ®ÜѦõ™IŸï’GRO¯1ÝÂÊ4NÇ3·u±vt0äÇ\½p_Fa¢Ò×6Þê,©G2>w·@†©ÎoÇ‘óÁ ,5 òù¢ O£·WâE‰™‰%»W%Ý4vŸø"ÛŠÈ^¼TçL×EÀT*‘Ì¿kX0Éú×ú¶ÉÞíÉK†Y#ïšõ& « íšìN™×Œ@V\IÓöø â_í„Ã9ßS,Úì P;ç¹]å¹P’!ŽõÚ…i”à]tѕȶIÚ⧺Š‹¤°®‹~Èá}´=ùu[äå{}w•t9+ƒŠnl%¼°{S®#–FòɆZñÞQsWkTÂ÷7䫲â‹L‡‹’£/Ø"$ÚˆÄzÎT#ýÐ4î×\Ÿ^xÙ#nNzù¶KÙ´Ê3`Ëî:M‡ÔÔ«o5Ù06_ö4fGK&æ®HYE¨&‡Kv@Šž'·dc®¼øú(‡ bT9Og¶­º•T6æ×à‰ R>‚ÞÇBçqFÙ_±x;Ç ³P^ò6ÛNâT»™ÝQˆú}¬]û“C”ð/”ü¯ÂBæÉügÆV)˜\V@PÝÌD×ÀKïÚ׊`ÛAÆÐﱓ_xÌË“¦ÍÎ4_Çç^ÙzÈz}ºs‘zw†>Þb ˜ÏA¯5Kêœö ðl­îÌ4$²#M9MaUìkA‡ÆÁÉgï¹oJÜk?F'FÞI"ÀW×b¹Ð°¦’ãît¯5º"²)—ׄbfÊ#m‰éõTf$Z¨§ÝÅc&\K_ŒpÍX¸…54<¥Y<ß[yH9ñÜË¡aLXúÞ£±¡c89 #uø‡pxf§µk¯ÐÓ}èÇHcv6+c™Ù8(Ìë %•Â…ÆØYdRLÈämHïÖÞÔf0½ãèµ?düù¶d:Â0úÇc/dYê¨!ÒŒ8ÿ¶^Ô\cz|ï 8͹•‰ÐßêÔt¼~,åá]ø¥ú5bË•x2tžê‚§Å*2m®6ü0ŸûVCRÚÏ[’˜=ÒïH4”½Êé ºà¶OAÊ©Š¤`9߇³Àm“ õ3¦ófÊ3O:àÛçFg”ýõ§@M¦C¿R¿ÕU÷lw *ÑŸ9ç3 i´DÏé+dŠÃúõ;Ë^¬§&Üc¨SV¾kÅjVÎ-S‹¼H}¯ÁdcKZtm5¬UÁÈp•½Þõ™O4…D8j!KOƒ3©žCÓÈÎ1ÇÖƳ&¯:^=v²>=–aÙ|£ÚÔò©Ô‘D†_]¼Ÿ÷hUÜb%›b ;ÃбºRè‚HWÈXq̵K½¥½iW¢ø´ê‡L]Lÿ³þÕÎòû£,â‘þ9!Û\•çß“n;舩 _%‡xó†t+EžGÀŽŽåÇI@kÃ × 4;Óä!·µs…Ëfd:@s }ÎÌnv2æá͈K&]jim T×Êëe¡'1i´ìŒE{ìsK–ˆ¢Q5ôæßD§Z ¯a—êuÁ&èbŸŽH^ §„’hãâÊãúï/˜m#´ß³„KˆõŽ¿˜ô­QŠA ¹xoI%Þ¤½“«e‹«ù#_Êΰ.Þ$y÷¥‡W•?ãî› }žK¬¶M´ÖBÅìÇj)ÏÇÒGn´x,¬9$‚Ø7>y·ÃÓ–>PMFg!k,7M)"¨€.×·½<<Á˜#j:#'ɧ4É¦É `_Ê÷lGÇ‘æRçæÖ¼:6tdüÖìxVËññ^r !!›4zžÌ -Ù!ÌÂjV_' Íò]žÞšáÜòKèÄDsâOÖ1˜ázÔ (ötfIºDëðÔ¬)Ús\°ùj0ÔÂ8tz_½œ2XNÿìU<ÓCÌ&ECµÿÿB²TMòÑ‹u³ Ÿ!¹›Œ&ÚÕB2[²ò”Ä(¬ò²øJ$79²»ˆ‘‹Ý]ûbuצ†WñºñmCä‰&ï‰ z¼ecœ35›ÿ~7‚Ó—r©/8¡€n¦ã4µ’ö80m~õ§=D ªõEØ|7Iä­ºàÂCȘCe™…T28gyͧsÖ¹(Ë1Rµ!oš¡}^Ÿ1o IÈ^¸uÐaÝúš×$ÎóÛZ¿+TaÝt}Å/ÃS‚)¹û«¥{íÎÄ úõÊØ a†×ˉT»“åu¼u-óµ£1þ°Æg´xŸÃå¸b‚õ†¯ç†ŸÕ-SnÆû;'æ1u0`•è” xSúýê²mpM:ºƒ(Î¥þŒáÞi)ò}K…ŒŠsâCð¯_&œ†ä_ŒH¢?¢×í·µ%29ì_ãPl²®TvÙK'm¡pšLiÑEo æGmwU'‘P<…@HmÏÚ[Õ¢fSÖs}žÞƉ|$º^øˆ?ì™ê힂Ͳä½"†¨ÃázXµÆëåo íÛÜ^1:æüæX0{OŽôHIXÙ÷pñT­<^0Uå¦'L›ç×û®†³|ÙŽ“”dj? ’Zì ïçz¿2,ÌR‹4Ðögî¬mõ\é‚Ö±Uf OßÑܱY‘ÜØ f›p„g)í1¨}ƒÎÐѽý2‰„WTžTžyÓd96[põ±óeC—ÝE³ÖZrRlÌ; ëXÃOœ¹q/§P¹c„É[åú’#Â%2žYÍgPIQ³=^ä–©à¿.áê[¯ÊÒz¯·Í~eóµÖ]H6æ¹*:«u–=ÔßtãÁÃ|øÓ½zxIû"ê+†ö¤DdºO®ø¤ï¤E\êNìXÙIÒ×ëz‚¡-õIOÈž†<÷~Q›Ix|NÃ+¾ùz.c=w|²¿yLe#ôY§‹,`39ž<&aÐZl~œ`Hyu{hf²ÀQuHms¾H/FÂþ«Ã­I a-ÛÖêSÉĤ–RYfwHïÆæò‚u)šÉ%?iNµµÈ*|çŒåƪ×ÂÝŒpwÃ?Ae~×JB³|qŸ²p~4æc˜aˆ¼X'¯½¾[#?Óðô±yêà3ɾ³ÞÅÖš‹=ºrjÕð˜ÓùÁ»xX/W›’]æk=5Èe;nÆ•¹÷17ÆQªà2gµÎ¼ôÆ4EåásOŽéUÍ}r6É›+˜µLÕü{™Ý5°{2ZqÊ$?U±xVͯì©'‹¼þ¥êfcÁG@‚ަϦ-|íÇãä‹€Š¸ën\Äo‰'‹QèŸ:˜ií‚7b„fÏ jeL^¾JÑiBì²M„‘54;,I¹+%ššŸìLsê8?’Ñ„!É³ß ‚ÏîÖÐr˜^l§4.É ò#Šô,wöìœÏ[¼oKéKOé">¾·z~@› aÍüÔÎ8ÃÜíŒOæ°£ôB ö>ùgpÊ"¢{láñq©˜öH¥ø9Ë·‘!W·° ÒÚD ¼Û¸XäÞ ‚,)ä"Ì=‘ë½@Á1{ª/zcèBÌD•ÊîJîDü] Ö¤#ì •6ÍÇ’3e7væW8Þ²qx”š¸d«DݯasÛ3 oü\å'–½i@GZŸS²öèQ¬ÑMêÙZ{õZ¥±‡HS®¹€÷i|©ç…,Ú7jÍ^Eq’T¯O”¼tÜ / YŒí5m,2•:oFQ®•aT§"çš´@ÆItªïl_Mצûž’+,ÖÙò+k?ŽyipQ £U¡i6ÞŽ ¥ÏåÓ–ÖŒ2ùF²A€€ñ]hè™›·}ò§ŒWIà  ˜¯%=w þ`pÓ´5 eÙ£É,à\b"ˆ“ôÖòeTNY{)°Îð<½߇¾;¿'7\x5åë*Ö}å5PPt¶Çðªb\¬¼4^ì]XÒNWã 2cùЮŽQé‡fK@Ô¹Óª*·bK··Ë[Ì<§˜«€²T®C 3ìÇN’¢×ºœTB§ÔLÄO½—ÖóLø*~È.ÙØ?NÙ#¸äÁx‘q爦ü㓘žN-°33m ‘ýãÂz¸ s:#œ¼D$À¡…í…ú$xË1¸g©VÑcìè$¯¡ƒŠ®Ðѯ¤#Æ—A““±ÉòQ¨…Þ |±Åƒš¥8`¬¨Ye`±Ö)çK@Ñdzt¼×h‰Že"„6ƒâ-ÊYu¿mù6Š¸*‰˜( øŽ azèžm"kB¡@BûØpÔ0`äu%Q+OR«ÏedOÈ^JçUBy¥`˜•àNlþ¸ǃìàˬ)âÊK ȆŸ?ÙŠ‘°UŠ×òp¾ˆ"¾µº=Í“úµöG—žzóZb ãU4õÆÇ-Š5ΩreaõY1„'¤†ãºh ³í—ÓÙúj',=ïižÓÐ.xN¤EÉh7xèOsN÷þp¸~nÓÙN2·š^—ʼn%pV.ÇúZúu$‘ˆå¢ÏŽÔOËÕ<ó…9ñ0—bëé–“âd]6o&›.ñBNqnÎ_a“g†@R W’ú"‘7A¤‚Ô^ýç àñ>Å›k×T5ÄúŸ ÛtsQÞ1 +\:máÊ)>r÷ƤÖÌ[AN†“dØÄ+;ƧŽMC&Ü£ªÕ4F´î”AbJ cï—”EZ§Ä£õqÐ Y,N‰"ÔÈ7‘†Bº!'風]§ãljôèR"à) zååYyñ8[GßSpR,G3РÆø9¢T3ˆä¶Í¦Š­ÿ•ïc½<ñ¸Dv~x&ÔSÈ_€-Oaæ­ª– _¢~}t?g­í€˜£†,$™`¹Œ e‰E1TѽÁLå;‡±ÉS†ÒXzË‹Ö N¥¥û˜öùÃÌå˜4ÅÇ¡¡É©êâ Á”!­àV–¹UTF@#…}MáÈOl‹°™¬e{Šyºµ|rq)ÈIÏþ©@¸?÷Üaô:¸hbfçóøI+$ú¾C™U»Kî„ç‹ÃÁDûMÞ‘4Ö羪 ßf65§Õ”‚UófúŸ%Y™ÃS?G~ðËêÆîÔ² Po[¡ÏÕítÙ/‰²ÏY• ÈV´ê7êÆ!ä”dG)8”ô ØeÓ3«çZ¡ ¢C“£[>ïЮ9Ú@¹Õÿ!;/í¥/ &ƒïÀR“­š&–_~Õ:TŒ¿â2OÒˆ 2£l~b1ã?§ë)G‘³z„VU{s¾ÙLôã"ax9s§EHã}TJå; þ(ÕYm‡Ò×…y•…à&#s›ýÁ"ô) CÂTMQLoËÊá¢åÛÚyd±"°¡F§=îsž% å~ŠBÄHIŒ¶êHì2 ZaD¾%ç`× à2tÃÇ8½Žâu][ 'ÝÚsÍ»×—æ)&NF"e~6ˆÙ#=S¸5 6r¼’=FMŒÞ@¾€Z¯¤…xfCØþÌÚ¨ýöäDUÙòã3©G´3¡ãäÌ+\ßX`ÏûÚ§¥1ê¤øò‹L-©r#¹YÓ.” 㟋Œþ¬Žtc™%ŽÚ:l{-Xϲs8*d>û}áÁ ^í&ËG=ç&rÛÅL'æÙ™(ì\½YÂìÑEˆ—J,™Š!õ(ÄùúNcÚ+nnÄ)ô‡JpFc—0J¦?V£0_ÏR£’óüúôÆ5j暪WŽ RÏ7£e) ,| ¶ ª:ç¹h,bæó¦SEN–:=i­-uVÍcOpجè]7ê¸ RoÝŽ&zîL‹Õõ•¼ñº¼6q V|V·ÖÙoM!9F a»àÍþú–övq«Ñýþ{Ó(íÀÕ/+§‡¥Ä;2×¥ietÍ^+™ICyPdµLwØ šAYìpeV†äÛwçòº˜Ás2C™lâò!«yIam ¤^:ÎŽÈOöªÅÂ}+ Éäþ-ÄåInÂHq˜û¥uä– ÎñM›÷P–×W"öU¤./ªÃ¢S· ×·Fh~6ÉyšqRùò¶ÆÖÎ`|ñFÞ¯ƒï2Œ IÒsÈHÊÚÔîrS‚^Jþåé>¢ .‹ߪoî¡W“KDb ¾·Kü²¥½ÒóG“ dPbDmÝPûR¥3¦2Û\ÆS.Ð!nMÜR‰j“¬¶þ¢yÎÝFD0eGÖ{.j±r¦ýy™\¶ñ¾äûÌWÊU°´Ñ§˜Gßîm’ ü¦œÓ™(r IÝÂû)ùê.¹3Ù˜· Nz¿«¢÷éÑ~ÀÏ:ÁrK¯žN±/4Ɉ»$uŽ¿¦˜ršùP;@Ī½oæŽÉ$¢4¬ÐO©‚÷oH[ß…gǧ‚XÞó)ìQ^‡±,»c{ærkˆÔ$qLz=gìmö¶cSçnóŽkgôÝlSFvÙÑÊÒñzBµŸJŧ¾ðù"팟š¹W#q¬4 âVHo‹ÉKÀÃœýKY_w‡†ªÙ¯œ°Ú·œhV嵎YbØÕ’D?b(ÂjÈF±Tm2Ââ@T.wz»É7­i^Àï‚Š84׸OwÊ ƒ‰Üó<*˜k;šd:®Y«®‡Ï™R7Ûù£-ñkž^צ¤ÕË/Ù8bf°Å´†F(“Jld|ÉáUÐkç.JîÞ)IE ¯î>&i*äK½öðÄÕªH_16rþ¥”|¢oÓ7þyoåÞY/yGÙókàbè¥wªªÝzüøQziÁN¸L™Òbè’“îÎí Y‚!ýdv5ËÖhgqæ~2Ì$UJiåÌsõŒÆß;. ±ï‚Ê yÄD¤‘õ€\r ù2 «ÜÅßµ«§µ:µKMáÇ<0Ý<½…-ÊÆÊåR¯è­7K£‘ð5Ñð"LÊ  1¬‰9{ÙZ»hX`jVD±¾bAû’â'¹+Y’ñàGË,¬GèOŠ»Å¸P8ð©ré¶1ã},(ÕÍ—…§RKT¬5ûpi»7,¦øt' $‹õásys•]Ò÷±L\AëÌ4¾}Z¥÷¹ÃÍ­,¬MÇÎHK'z¿]—óµ­ÿîK„U:E\œ]Îû÷„;¿¬ÊVø½«åài7Ó&2‡§å?-׫„J"7ÝX&MDøH“…£¯¢±&›R¸¢¤WkKvS®P¸–¼(X~ôÛ¤)~bÓÉ° U9ÿuœ¢ïºuä$ãë”Çÿà èXUÃuk7 !#¤ ›ŽÜ¯×±w; ¢Ùü´Òú ¡Õ(Áù•‡ÐCv§±dØ”«»³`ú›õ7G_€o½V×(*ñE#ÆBŸ.Ý(Sr iŽ˜LdmRÈਣbæáy\Øö>™†å•}sPZ9å» þœc‰ îã6“Ûo0$6ã¾Úqh||–¶n4¼Q·õµDSpéöv†³êám¼Æ kÞ‡ÓS TB,;äl±å-šªzR»š­Õ½Ž5oc]‹Ñ\S%Îý×E§ÊÁqˆýF·6‘ßÖC»hAÈífÌv LM¸ß½õ?qú0§”­]cáX=“‘íÎò*)¼»ŸXOaõmIßö–!ÕW¢Xê]ËÉϘ\Ëùà"½Á$Ãf‡h­"—¯Ø&~®QÞÕW”NßËڭͥȂ±[zÞ¾9”qR»¡½ ¶cÌÄx™Ò$m:´ðBëíûÌ’'÷èž²7fTÆ¡«ñá\‘{õÃtɇsi-Ï™#¯„v©Í¼"”Œf‘ú”C»ôÃØŠï͉đÛé}Ä ÚØ„^çäŠö£­¹;û KQ»§¡Eؘõöµþ³¥]üæÏ?Û2jÊqÂѼÐm‰ò`zÐä¡Âœ›r,´W¬è¥ï.ˆH†èÎR /> endobj 205 0 obj << /Ascent 694 /CapHeight 683 /Descent -194 /FontName /QFNXPE+CMR9 /ItalicAngle 0 /StemV 74 /XHeight 431 /FontBBox [-39 -250 1036 750] /Flags 4 /CharSet (/fi/parenleft/parenright/comma/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon/at/C/F/R/S/U/a/b/c/d/e/g/h/i/j/k/l/m/n/o/p/r/s/t/u/w/y) /FontFile 206 0 R >> endobj 495 0 obj [571 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 400 400 0 0 285 0 285 514 514 514 514 514 514 514 514 514 514 514 285 0 0 0 0 0 799 0 0 742 0 0 671 0 0 0 0 0 0 0 0 0 0 0 756 571 0 771 0 0 0 0 0 0 0 0 0 0 0 514 571 457 571 457 0 514 571 285 314 542 285 856 571 514 571 0 402 405 400 571 0 742 0 542 ] endobj 494 0 obj << /Type /Encoding /Differences [ 0 /.notdef 12/fi 13/.notdef 40/parenleft/parenright 42/.notdef 44/comma 45/.notdef 46/period/slash/zero/one/two/three/four/five/six/seven/eight/nine/colon 59/.notdef 64/at 65/.notdef 67/C 68/.notdef 70/F 71/.notdef 82/R/S 84/.notdef 85/U 86/.notdef 97/a/b/c/d/e 102/.notdef 103/g/h/i/j/k/l/m/n/o/p 113/.notdef 114/r/s/t/u 118/.notdef 119/w 120/.notdef 121/y 122/.notdef] >> endobj 202 0 obj << /Length1 771 /Length2 963 /Length3 532 /Length 1528 /Filter /FlateDecode >> stream xÚíR{8TiŽ’mªMWª§úÆe‘53grYíQFÌT”¢cÎgfÎáÌ™\KT”’.žHˆºz¶ÄSK‰.»’JR)º¨µZtÙCÛÓ³ús÷¯}ö|ÿœßï}¿÷{¿÷÷±=%æBŒ €.$A›#Ä8‰$«¬Â᱌Œœ(ˆÒ8I,Bih U2€ÏÚ–ØZX²Œ€ª¦pY LœL‡HÖ@¨€.E Bé ¨`4¤¨HH)i5år Ú¡b¨„T8Ä8,.¥A”á‹;dÈ$õ§6¦ ý …CJɘ&ŒISÀXÄHB® dq=Hæ,È8ù7LwQÉå¨bH~(¤¯`TËÕHE¨Š†‘¤ˆ‘ToøÉ›b¸J1u£Q9.29æˆ%‡g!øàJ<bž8- ¨\ ‡ûÀFZaÒ6ÂuŠ-s4û4ÕaÌÅ z¹:Þòp|©™Œ(<øò8<™õùo툳œ )‰á„ ðV¥(TÍâ1R|D"'0`c˜Ë!HšÙ˜d¢A I±††j¸¨’I W†03 ‡û\ •É˜‡z__ÐÑ‘Œˆ4·æ6– bÁ·Ö ¬¢ÿÆ“ª( ôð bRú\âL²F@)«é6)µÛ¼ÿlbaŒóảZÜqý×N±¢íͲ[s–Ôö•h+Ÿh4­ÓŒJ¸ê½ŸÒpvÞŽè†Ã„o ‡ý{)L´3\lµÜ7Eº²+r†ßn{µ–ÎË7¯6u‹ƒ7?->ýûÉi,߶[3o«ËÂój‹’ ‹+¹ZÄ€©ËÁæT½£—s*ª6®YUQ8X«×v&j…‡^ËV³vçܨ\Òq[VVÏ|Üw•_º-ì…®úëMîmöw©²wµH±-«œÿ)~\v–·"†šæu2fN•2Ôí*Üñ³è¦?¬ìw +ýjkŠÊ¿í¢âÍB½yH¸0£ùYcgÉ䘜ö1¬ÈåÇO´œÛaÊ[R+$jžíJe'h*]ž(õݯû«ŽvË Ju¨cì$Ó©¾q=׎ìMbR9ºûmctziðü­ w[ž‚£¸/Ž·ÇWÞ\>9zíáh<¯YW˜™Ö¹wí9É5×:Ÿoq~нþ…ë_¾›X`­¼á›[’U9‘Æ+ êJ¶$!Zæp$íîìDüDXØ£çæn<¶´ñú },Öf”Í­r}HÊ“;D-gh öˆ: Ò².®2{qçò+õ®šé=eSrºÏŸôUT®é7l¨ê Ðqß”Ø5©¼ÿØ|ÕÝœ¨|—¥ÂØž–éÆ+èã3§ùÓÙ6ÅqšvƒE‘aû¢ÇŒrwoõ*µå†nW{óþáÇú_à?! •C”¢IJ…°þƒ¤;endstream endobj 203 0 obj << /Type /Font /Subtype /Type1 /Encoding 496 0 R /FirstChar 3 /LastChar 121 /Widths 497 0 R /BaseFont /BAMDOB+CMSY6 /FontDescriptor 201 0 R >> endobj 201 0 obj << /Ascent 750 /CapHeight 683 /Descent -194 /FontName /BAMDOB+CMSY6 /ItalicAngle -14.035 /StemV 93 /XHeight 431 /FontBBox [-4 -948 1329 786] /Flags 4 /CharSet (/asteriskmath/dagger) /FontFile 202 0 R >> endobj 497 0 obj [639 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 574 ] endobj 496 0 obj << /Type /Encoding /Differences [ 0 /.notdef 3/asteriskmath 4/.notdef 121/dagger 122/.notdef] >> endobj 199 0 obj << /Length1 1516 /Length2 6486 /Length3 532 /Length 7369 /Filter /FlateDecode >> stream xÚí”e\”}·ïAºKº†n:éîn††˜!†PéA¤AR”%¤KJéNiÉ3÷ýìç†óì—ç¼ÚŸ=×›ù®µþkýÖZÿëbaÐÒ呱…Ù€`P8?/¿@V]W—àçb³°Èºƒ­áTΖð‹‹ód<í¿¨„  „ 6 @æêë±w€Øe9þ ȸ€Ý! k(@ÝîvAäY;ta îË qvèüu ö»{my±ùù¶`¶‡@±ùþR¤ µƒDÿe¶õtý·Ë ìî`Gˆä $Ú ξ[°6Ÿ Q ŒPòÿCÔ&WðtvÖ°vù+ýßSúo~kˆ³ïEÀ\\=á`w€:ÌìýÏPCð¿Ä©ƒm!ž.ÿéU†[;C@2P{g0ø/ÄCâ¶Õ‚ÀA;kgðßv0Ôö?E ÷·>¹çªª&Z\ÿµÑ¿ZÖ(\Ï×õŸ´EÿÍü÷Œ˜;Ä` äùˆçßÿÌÿ£˜<³…@WBX`íîn틸øñ P[°ìƒPÌÇ …ÁGˆ¡ì`îØ-±s>»¿m£€sq±¾·ø|]ÀÐ{“€Ï±I˜í½I À÷ì»7ˆø`Pð?, ðÁ½ïýˆºpwðƒ„˜§û½Aa€x=ˆ@ˆó@ŒåFHó{=P†ß¿ÖúEÀ…<"‚8$sOˆÏï ,{Oˆžäî Ñü?$ŠhGážJ•ï ‘SížY4î ‘EóCdѺ'Ätî ‘S÷ž­ëÝ¢ý{B¨6ü‡¯ßýöÄÕmî Qôñåm b%àø×> BÃDH€<@Dçˆ(ärˆ»Ï}€ˆB°ˆ(äú»=@D]÷ø×Î bÖðˆhÞó"Ty=@„*ï{@Èð}€/þÆÿþ6?óñãáð .²8bŽ¢ÂâÿWÈÓÝ …ÿý¥D|þÍvÄ öƒ°g~À@OBS¾„}|)Ÿ?ò ù¹}]‚FMÛx3Nðôdç¢~U7ÎÅj£Ë’tüM´Mzïkj¨&íï ‡n ©“·›^V›é/¨ŽÓÕ}7\σw ¾~™8ÝFÖ[øøÖ¸ ;ë¨g7W‹]No cž©ÝÔ«¶=#DDÔH!ÝY?<´šUA‡0Õíc„Pø‚7áÛDÔ…áà—Žá˜õ\s¿`MžÄ—ù˜ï“nÍÎIã‰@ÍC;±µâsÛµ}£©mbðÏ›W§‰ðG®ÎM´EÝšªçò„Û‰rìF?2WΡêœÃ¿ ªoEèôªbÞè×CMHÉ™ÃÊóGž×OgÆৠn,=Q€ùÕwôì«ÍÞé_»Hmbµ¶—J@í/¾^ð„5nk‘•Ù\WêÙcróšŒ+ÉÊfrŸé'lø¿_T¢z!´•Æ_¥ýT Hjí*®Z¯0A<:{5ŽÁø‹§)w°§¶©#½rìòžn|#‰SÐêŠ/R5;ß/ÆC<Å:ljmõ%Tá}¦˜ÇÍ¿]òd‰^µœ‹Ç§ì&{cìƒz|_6R+ìP–TÍ6çºÕ}×"0·¸Zÿ3йé(ô<à©:®,!{RàŸÖjÍS:‰Hg©>~´Šðg\'/Q«Ku$t šò¬¯}vÇì‘Ñ>…ù¢¼"×,‘+EôA›U¡áƒq•"Ò®Xv÷÷á'X ½¶'“íäÄBös249<0£A×ö5.o7`ŠµšæD÷÷54Ë´8wù„¸ýÍeƒ";ÞÍ1 L ß»‘:UIö#e"Kv™á¨¶Ì?°é´(Ké+É[‰÷ß .ë+£±m?¶Ußò{^‹Ýuqfâ~%ùˆ™“Úº¢¡D аX}Ã6€Y)_òènÐÚo7—ikþÐcÿU÷ŒnSqƆÕè:*`i8HÞºš‡¤ëò›¸KžÂèĈ$V;›†­Á]¦;·ó%52º¨À¤Q»“@¾ESKü®‹_L¢Þ’"‚Ü"’øÌ™àÇå|U×qõ AŸIYHª•ÚU¿äÝG=7¿ ™`Áwè ü‰™Æù“[´¶îÈš{—fN>«oŠIÜa™–%×t sãÇJ£/¼FÀ”ô˜\[®Æ´éUSõÈv~M@žaVÙt¯RÞÌ7 ò…õDÎ)çJx?™Î9…ìÚ ç¥ï‘Ù¾ΆOõ”j…íOŒ b õ`³ ÕOÈ{ã›2ïl3†¥§"=B%ašV¬‘d×èÈ—çÆb.ø¡€TeÖºkÿþƒ¿ s,NÅ\"}`VË,Ýõd?O@ãDkî¦ü[ù¾IO›¥;ÚÝ©ú-k)ÏaþIÔ¥6R8QãBªOÐÍ©Fzž…Å꤉a@\¯I%Hý2í­Þ´ÿ¯ä^ç( RW*?c뛼¬Ê­¼|bößB7FÖ†i ==—üsLÞ]¥Ó‘SS±¹åå‘5wšf`z«€nlo»‡Ôµ»°zu…‡èÄÖ-ÄÕÑ TgdñÞ„V ø‰ÛOÖ&»>ð!t®:xhüeïÄ‚¥€·j‹¥s„×Ö!hMÚ“ÛŒy\kFãÓÌJ¸á½Å˜‰™qäe|·ÁºNûâØ,·ì¿£N¥ë68î0e:p2ÖW¹[o0P‡Ä? ú.ë4ç n¢V󸽃ý†šKѨø&4õÇSdѱ¢Ãël¹ÒW0A/QmÊŽ~ù5©uÇÒ¿ü¶b_ QÁSe^‹Ãçà2ŸL–Jçå0¬œmA^óÊé§JøÖ¾,ÍTÇAdf1ÐáN~&Å‹ÀôÐ]}ë¹ìåbfÂ=ãc_¶NäÛÙ{^<,ç´xkŽi¢Ùrwgïró'ñ±GIÒ,¡|¬Y¦ÊØÒ‰•N='jÖXN¹tb¥6–{/~è‚@’ìX—Y•¦K÷«¶XZÈïÞœô`ÐÏÖlaËRËþ /":_!4ËçSôó¦$Mr›žÃ‹Õ•þ§¢gòO–ÞfÒA~5i˜Ái˜ekŽáÏ¢£U7e€{\ 2¡[Ò'ýêÔÁò ç»((ÄÆV¿_;MIAòÈÖ~%ôŒùýZUžè›ïµ®>kÄA’ÈôÃÌ$ôÈ[0=+V}®“³Íœ&»ùýóª¢è*•6–H™–…ƒú«TåƇ¯—pNl§‹ë_‘xÈÌÌ«co®°'ú ¬—ÌÓ ^8g}Öž2£ó68%›[±m¸ÒFþ9ÿü”÷¢àªÝ5ç`pØw9:ü>n?úåð$/ÔÇ­x"r­[Yž•~¼8ª)¬Šœíêh?¾(cFr|ùs0ºó²Lùðë£ÓÞ¹w Š9.TÒ3ÔUQ«W²$·Ë;ʺ,[Ô¹Jv~mIŸ®zÇi>øÑ—ì®Rë¹ÀV‚P%iÖùC£Â_.lZ„¨â\ÄNOhÐf"+tÓrr&ªôŸFÏ÷5ïŸgC>ì¡<ÝRR#k¸ 3¢>ž"—ýß·-&•ð´¤72‰¡Vý%©ùÝûŒºhë9©hôQ dåçJ°@Á× :ŽvÁýÑ#ŽGçºÃó‘ž'.…‚í9x]|Ñç'êŽRò  ×]øtòSÆ‹¡é¯Ð.í{D•8NÖuý´ynÜÆúþËCÆH£#ZÙ¸ccfåm£ÿœI::çúlÅ„Í‹rXC•ÖÝãîC}¤Fâ]NÁ§° '¹WÐÈ¥-s´_DrËþ±É|Äy¿üÅÊcú/!ß ¬PÐŒWGß,×Dv„è[œOcüÀ²uNé/üß{[,¿ºï$*ÚÑ5‡›ÍU×)Ÿ5xFÆÖW1—f )YÀ_{5÷däá€;íÄo¢˜¾ Œ˜ÞÙgX5ÕšÈ|âÍ­¯E¢´¾Pý±]äˆ3fçešÒ v±B.w€±ó'-wIË/˜Ô)WvUØÌLú‡‹­–BÜ|˜t«ä<ƒéBßBˆˆïò”²á!Ïp;Y‰°.Q’]Ÿh4òÍ×ô÷ý.übÿƈ ÝXÕ⟈uÕ%þlLšüF;!ù»ðú…EÖè}‰Ò³ößßï^{Wê?V¬g>§x³¥H›n^ů6L`‹}«*ë‰ÑÚª5ù~¾ŠImæCi ˆ §ó•fáÏ\óá³BÑ€…0Šï‘Ì{Jâ©1›öjA‡äÒAn¼éœ…zQï„ðñ½"ç´ò"ؼPB7’Ò2¬©†¦e-äoO‰l$ûìºdhšëúÛS†±Í™2ðÊXÕ1Ö“7S\€:_–:D>Ó³°ñ [m{ÈP‹€ žÖTæ×¥êkj¦I7ØJ7’TÁÒq­Aî%‡¤¦&5h'Ö³¾ï³oyRÜÉ$߬U« ÇÝŠÎFØ<˜D¨B‡¬ÀU¨q’Xt•g¹ÂÂN BÕžŒö±Ô‘s%÷I<ß‹c3e—°RpǘÊÏîwâ'xþß&-ìwð(­>È3Ôª2ßÇü$\ÁËõ/˜ÖÀ«'q>L6ìO&ç£×‹h솯û?=>‘Ð$‡Zbû§Šç%sž1êUé’±E)Û*Z t GˆÒÛVVŽ)*ÙaÇJø³vb_såͯk†¾Ÿ;Õõ.ÿæ AÖ 4œ°º¡l#¢Ïgö[wš%šEê³#tPõÍ«Ò4S1ŠîNÛJy]î‰0zÐ`Oî6Ä0ÿkä2¾…­!NäÊž·пü3ãs'Ÿªí)JhVCŠhV-³PÇc²÷Ë&¡ÚÖÂÑE÷‰z¸mà´c?ÁkÁ ‰V3&«gBÉôbÌ@$î^΃ÏÀýË‚ÞO$ÅP™,¢€=2_¡o‰rÉ—„Z²dó0Ÿ€Ž?ß1êÚEþØkH<©î,EÚ]÷žÖñûÂÍZTlÙlNTx(sCzÙ«è&·—¢t ÏN†]p«ÄNË0YØÚ<²°–V'6nvbyöj?4=ù#ˆÍà€¾]Î,ïæ|½MãlÀ]-èçGû€½™w‚_©næBL\Ÿˆµ ¥`6êxq»~¹>Î(Äíh0}žÔϧÌÞÁ8”*ľÕ2²¾:%ýöVé¸"ÉLÍÃÜtºe—X#–¸r,Ìq¦áÊñî˜Ää¼Qш׈ëž~‚§ØîÎ21yãX~;7ï‘:TûúlѨÑ×+ü„9ìFg5G¥Uâóó#µë“e“GðW‡?ê·ŠòÚ€©:\¨;9 8ëDÇ/þãÅ]Øõ¾©7Üö6öýÓY|h_@Å ™„vyæ"[Ö¾Ö­¡c9eõM•÷™ ´—Î'†ß Í“`#Ne¦6¯œqw³"áÍÐú¥%ÛãÀŠâ”ÓyM‘ÚMÕΘ~—øâç£*Ê e—è2EOrΤ)b'ì?éUy{T…@4ONËÿð6mxöe¡û¿«¼ê¿DÕ“02ó[w9â «È·¸ãRa)_{ýL4šÑ]b@oÎ÷×¹Ug^Ñ Â7 Þ•‰hDiš ¥;ì¾í6QAÊAiøæXZnãi²8†‚4M§n?8{·-"¯¥NúíË-¦J¼eK߃´ü–iÕeÆ‚¿çøçcuJ2T´™ï"§ò½ŠîöÛ{4CW|¡x¸Xª î‘`ÊãÝ>Œö2Ó¹&ÛßBÁ´öפ‹*MPrXÏ äœl“ø³bȬGßFHV÷Èäýè­ÌÎlòñ–ç$§x~ÊÞölÃâ@¿Û@:2˜4Ç°åJ¡=BF\OÒØæ܇ñˆ¶ýÀæ™–þàtRÕ’!À@`ò®›ŒBLIÔ%#ûyÝ0ÛךÉ主ÖìÑ.ž…‰/™Foi^m¶@#œØ`‚é˜ø)/OòªX2%2Ëê“R+æ¼éRW¸ÇM¾P­ i‹ j©ì÷•ŠÇ2ëÆ\röžÝoƳa=ECwZV§íå@þéqé£jc…³zƒÁ2äœm˜Á•“yŸ_ît”ÉS!&´Ô÷°$†—‹\Ýml´G¦7±hÜ‘HŸ#ÛÕš²=räŒA’Ãê’¾ËPˆ8Ÿÿ›Ç×{lþúXõ|X¾j'¥ÐOB·>š{[$ªAÂôŽ&‚îA£ÓùkUžÐš¯Ò®D²KFUía¤Nï¾z­¡ éËbËlÉü~•÷Ûã¸=ð0×|…Y©êÂëÏçŸ,ÒÃëOj² ºC ݨ‹ùE#†/ÞR±…çᛊÇ0W±8ÇÎ˳wí“‹—Ç:ÌèÞq_ (8ÜV`J±w~¯\9"hhã“]„[,šà”xyŠ:U€Ð7¸© c°«>}jŽÐ›U¶ð®;ÿ>§KHih@î&Õ_?=×òÃ'­5N £÷âĦp"ds˜Ÿ{\òÞu¥óV™½(v=ÿEr»ç»×ŠD¬ÐÜ/˜™:¾´ÉÌ›9¢rï.-™”BGïeÍnÞê[>â­¥±xb1nÇü¯Ž•¶MÎ>˜ÙjlgÕY®BÊ]U:çU—c«Ëõ(§˜_f±©¾eSE«ÓÙZ¶T­½0h" vdxªW§"pýŸ­¢*áfø B&š“½ g•A²DÊ¢Ãϔ۷ï“ÜãŒ^Ë?{OóD6!³ QW®rÌMCÙr888 Yr,Ñ" õ1“MˆÃÃí§*Þ~œeD܇¼†2«`â(S½%NÛѪ0ÁF­º¿U†ÚýH´•Õ)«Ã£ãMžcˆ¦ÓEqÿŽ‰ŽÂàX[(0M͹ßÝ«€¦àsœÈWÍ”K/Ù`2Tp¡ž†’»üZ é"r­mkX(é åÚb˜“ugÉòj*_žZ÷ï1~ÒÅÀB^N¿´\µ á8KعŠ`@qFugßFÊ‚&¼n¡Ó:\:o˜)¥ÞæïÝ›¼4®^ù»6­6oAétOœÍÎ1öðÙ'ò[ä§,T©z­ùñ, 8:Š \V`sÆJ:CòŠÿÛ”Ô±â?Ö—Eµ˜{•íÃTîôZŽü^ÚÉó‚—âr«»…d8l™ë’¥$¼C/S¥˜*>””ùÞÚÕ ¨ñ·zä³”Üu†ªa¨³0ÂvÝë/ý슺XþìѦ|«¨gà«j©Q†z L¢škÛ@4ò°cM!ŠMBL×}5€,ÿз( ~ÐÜdï~||ò»OoÏßö¨>nå}o%wÌãs}ÂǨx¶•Ÿˆ³zÞW¸aiM9Q)B¯ºû1@/Y Nhèíß8(¾GòŒ|Ê)!‹g½þæî£ñçŸúfÛ˜Z„6ìK#DŠì,¨‚ñµh‘¼%ç"1󛳉o”ù+µóï }4yhm!VmÐAžJ‹¤½ ø$öÕ-ë]JÇÀ< %ý¸‘›¾ãp ÌÖŸz|ó3^íêÖ!¥ÅIÅ£ ÃGþ[2¹¿q/Wž³R¯#æ{ÝìEHÇôK²_mÞâ?Ò ±xÉ0$ëZ …[âÔ‚ü¨uÜÊÌÿôÌe'|ßçy)›NC|¤w&™V”˜*’Ç£r[’|—îeëÕ}G³A£XÁØÛòR‚t„ú…~Šõñiçõ¥!Èq;0=x¬ìvqîcî£#d?’s÷]&e¬¥,›?ìíiŽC ŽYq±9FÊ–Ån}Ð,v›Þ†p*Ûï3œ‘ú£ÄŸ}æðYpCÕ5rÝx|º‚?ìí»¹¿®}u÷3TÍÞUÒh‰õr4Eo,²€ÄZGë,!³ñi4Œ™R¨/cÝïþãO1­š˜ÖFF³„γ |r®øáž*Ïæµ%p@\™=més•°Å Nͧ„ÛäoÈ_t‰t#[Þ zzmáý,~Lc¡½U9ÞˆùYò£´ñmŽ²ë+\ÔÞõ³½t°®øR¾ÍùÏ« ¾­PQZ®Ò‡ÚÊ·J†G¿\˜÷~ü¸AÕIѪ¾6¼…œÆAE{3“|»ú¨H¾]&UVÑýÎf1kÍmY¿byu7Θãf OA9°“ x÷HýàÝ$¹Õp!A^G¡{…SßîGç›JÎ\‰« Èm\ùceQÅÆ Ý\ù¼H>ošºpÎ÷‚¦µÁøÿøÃþßÿ#€œÁÖîp˜‹µ»öÿøãœendstream endobj 200 0 obj << /Type /Font /Subtype /Type1 /Encoding 498 0 R /FirstChar 11 /LastChar 122 /Widths 499 0 R /BaseFont /DBKKZP+CMSS10 /FontDescriptor 198 0 R >> endobj 198 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 /FontName /DBKKZP+CMSS10 /ItalicAngle 0 /StemV 78 /XHeight 444 /FontBBox [-61 -250 999 759] /Flags 4 /CharSet (/ff/comma/hyphen/period/zero/one/two/three/four/five/six/seven/eight/nine/A/B/C/D/E/F/I/L/N/O/P/R/S/T/U/W/a/b/c/d/e/f/h/i/l/m/n/o/p/q/r/s/t/u/v/w/y/z) /FontFile 199 0 R >> endobj 499 0 obj [583 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278 333 278 0 500 500 500 500 500 500 500 500 500 500 0 0 0 0 0 0 0 667 667 639 722 597 569 0 0 278 0 0 542 0 708 736 639 0 646 556 681 688 0 944 0 0 0 0 0 0 0 0 0 481 517 444 517 444 306 0 517 239 0 0 239 794 517 500 517 517 342 383 361 517 461 683 0 461 435 ] endobj 498 0 obj << /Type /Encoding /Differences [ 0 /.notdef 11/ff 12/.notdef 44/comma/hyphen/period 47/.notdef 48/zero/one/two/three/four/five/six/seven/eight/nine 58/.notdef 65/A/B/C/D/E/F 71/.notdef 73/I 74/.notdef 76/L 77/.notdef 78/N/O/P 81/.notdef 82/R/S/T/U 86/.notdef 87/W 88/.notdef 97/a/b/c/d/e/f 103/.notdef 104/h/i 106/.notdef 108/l/m/n/o/p/q/r/s/t/u/v/w 120/.notdef 121/y/z 123/.notdef] >> endobj 195 0 obj << /Length1 846 /Length2 1891 /Length3 532 /Length 2487 /Filter /FlateDecode >> stream xÚíR{<”ù6n1¨HI‡¼’]—˜̨ёÁ`DalÊe5fÞa3Ì¥fr™²Í •(Õ©u¯ãZ™¢E®ÝÖ­\FäE¹¤bvq&¶=íŸçüu>çýýó>ßïó{¾Ïçùþ õ=ðf=t¢ÓXfsppÇãq a‡:0@‹B§9X @ìØ0ì`À ¬Ñ–Vh$j8Ð#¸ Jp 0r0þD²0á ƒB$Ðw+ —j TO'R@×ÀP©€×§LÀ d‚ŒC ÉŠ@$ ‘ÁöÉŽF¦ÖŸË$vÄ—Ö!Á”šŒ¤&©EFå$ …í¡KgR'ÿ Sߊ;±©Ô=„ðOòŸcú N¡rÿE¡‡G°Y p§“@í[ªøÙ;H¢°Ã¿íâX*…ˆ¡SAÀLºŽ•"…éDá€$ ‹ T&¸Ri¤omH³[1ór±wñ8`úe«+]…ÆòæF€ü+}#¾biF ðƒ›Ãá)Qz¾ü|3 K#ÒIšôY QÁ p¡Ò÷!EH Ph$€©e˜9Î’^¤¹Äd:úi©Ö(æö©ôm`{þ@Ò­Á_‘´ôBHÝÀÀ¯`´?A$cþ J§°Và_£²·§s¢Ì¤êfH„TiX#·Çü‘Èf0@kå)Jÿ‚Éé‚@¡âN:Ñæxè…rAA,6«õº‚1SG˜wüIÿ–ÐÆ|â…Æ3†¨ÅÜ<«ÎW¥ÜX{þÍîB‰ŒÐ.ÇD7Eáaünõ&5Mãk—𫦈þ?Ê>Èl¬]ž‘8&Ö‰™Nõ¼ï?T¥Pìö aý³ö›ò]‹ïbÃx¿ˆU.’ FÏC2+ÝÒÀ}ãýgK&éYtqÎ-ÿKï×-‰µkûÚÃzÕ„;’2Ýå:ó§ýœ‹†ÑO.Í®ße‰y¹×É÷ÍnI1•íZãn]Y] ‰Þzz:Ž÷NAW>¹¥Ë>Ûó$Z\“Ô»Ö¨éO»¥ØÝû®ßÍÛ‡;¸µÁ÷n~¸ä9¾ ËÙ'ùëE±bŒ9¥ƒMç¶'χì·4Ù¼úã}f~»–cúr¼ÑWaZ¥•£¾*ªç »ÊE_0'rª;µ»¢Ö0F-Äñ¦.F.û~6sóKÚ…˜™ÛiNUOýa"™}¡t—QjZuæH ÜU½8Ô³r¹¡xHN±öhW÷†Ã£’¤G×Ó_í6H‚9YM¸’0™‡..ò*‰“GloHr{½2ÝÇ"[¦JºA9!=bŸ÷ÃÞþî²}v©Gó:Qé)ÃV7J~=’ñ,?.ýulVþÕ×ؽk22&~.ñX[ïöáºP2ÇÏMüä6(!š—*Ö.46…¤X–£®¤]:Y•mûÎÇ óv&Uòè2…ÓœR‚„¥µ¸cÌfÑ"'e:·hD1×ÙÓM¢S——¡XX(U{ uÈM<—±?‘ø1sñu¶ìî+$qoÒIý1T©ãÏ‹ì[W†Ú˜Œ ÅkÂÍÞ‚èØžŠù§ñ[0ƒ’—CY2¡>ËÔã6a:²ý®âÑé¾jV OU?ð;ú‡NÒo>ÂvpµíðŪ·éó÷½õi“èëMxëš–—Z:Þ³ ƒ>G»ú^ü6 Ã‰¿.¹£gg×ïã©÷#Lƒ·Ã½|Ëìøzù¾ø”ùáS{ê’ýÈú¥ü [ï=§Bdгŧ¼±U1ªª:%3¤à9®y3tÄSüqÓ;­åfFvhˆv«f™UIÙM³ôù3Ù-Ìmo5&ÆÃ*_ÙèÛ:ùT¨¡Æü³8wêåúíÚ#`5+À ~ëÑøûxª?¦ülñÓèÓE2ÇÍ8I|^òu>澉“ü¹WCwÂí,W¿S^U­'ج©è2…x ¯¯S×>¾Õ…}óîÕœá²Ç £‘_#¼Z‡wŠ÷ 9 ÑÛŽ×i/Æ Åu¨Åõ,¡Fº1=œœùóøÃUOµ6Ÿ´ ò”bäØÙ»ûâ]l îÒíwbÇuuqvLùAÂ>ÞB‡Ñ‘·êWçÉ)¡¡jÞ/r~Ë­ä¡a¾ÿXs¿) ;?Œ ߃»Ó-RɶljÍC6Pë6ìJŒ´»[ƒ2÷Ék¿wŒÌXB´2YÈÖž®emÎìŒ|¦‡ª¬ÑLØ>§rËè{Œþ¦™TȪ 9€ î­¢ìz¿B{^è1Õ;9µm¸èùäHÜœöøPúý@Mü˜â¶K/÷Ëf¥*-¢¨a‘À¤BX2¸¤èé¥õ XŽÚ6r,±ÖÞ`¿•¨®%kr?·³óáYÍÆÓNd‡ŸçôªMù“÷d]°è¡ÆãÅÌä¾ %ž2ì¦@Çv׺¢õÍò:ÈG <—©i4 Ë­\F‰ìù/-¡ºðÿðƒþ_àB€H =œÀƒþ Ù3endstream endobj 196 0 obj << /Type /Font /Subtype /Type1 /Encoding 500 0 R /FirstChar 76 /LastChar 116 /Widths 501 0 R /BaseFont /RHBHPY+CMSSI12 /FontDescriptor 194 0 R >> endobj 194 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 /FontName /RHBHPY+CMSSI12 /ItalicAngle -12 /StemV 78 /XHeight 444 /FontBBox [-98 -251 1052 758] /Flags 4 /CharSet (/L/N/a/b/e/n/s/t) /FontFile 195 0 R >> endobj 501 0 obj [529 0 686 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 469 502 0 0 435 0 0 0 0 0 0 0 0 502 0 0 0 0 375 354 ] endobj 500 0 obj << /Type /Encoding /Differences [ 0 /.notdef 76/L 77/.notdef 78/N 79/.notdef 97/a/b 99/.notdef 101/e 102/.notdef 110/n 111/.notdef 115/s/t 117/.notdef] >> endobj 192 0 obj << /Length1 772 /Length2 944 /Length3 532 /Length 1505 /Filter /FlateDecode >> stream xÚíR{8Ti®<‹Fé¢è©‘Kfæ`L¨„’É3)B»Ç9Ÿ™£™3œ9.ó´¬Ý [ŠHn]h»ª©´]´1mYʺ š¨‡R¶T{h{zVîþµÏžïŸóû½ï÷þÞóþŽ¹‰ŸÈÖ —‡AO9IÛ"lÄxøˆ‚æ„Íe™›{P¥ 9¹¥¡3@œœà-pùÎvvÎCòH%Eˆ%4°ô°"ñ› R†’À¥%PÆh`¨ˆäi%¸I¥@8tC„P©ˆ³Yp£A$‹3dH@†ËÿcŽüÅ@JÁ˜–ŒI+ÀXÄå¤T pÎâøÊ™Yqòo˜)î-•ú¢²!ù¡¾€Q!UþEË"£iH9)r$u5üèÍâD´l$* Q)¹‘b)¶ˆ›kÏû O"â~I@8*UÀá>$ñ‘V˜ô†p– ƒüüWÛ|Üê0æ‡$½R ÷3y¸F>×LF‚¹l.aˆÌùô:bÖR“ã)vÞ徦èüëÖÛzÖÂLkS#¾ú€NËèi†Ê–ÎÆAc“±òƒ…÷ÏZgš‘Z¬¯ñ¸} =lÖ°4½Î+‹Ò6qhZ^­?:¹T5;±¿E]oZ~ì{‹ý0 Y>g¦Ê®öÝ€£ö™CŽu¦Äö ÐIjúcŽôQíd§;G+ñf–¥Wäs³·w §Õ­`Ï»ÞØ«#c™¬a_SX›€?!ÍA»ýÖM¯ËÖÞ§›[nÅÚ|RRµ>d’q±ºA5/WwåŒ:åTÕ‰ïÒÍ) \’.èZ–aébÑñá­¨öÕ×ñ»CÏêÇt;¥D%íOÕæuÝ=T¥7®šñ¼$YŠa7»•ÞïŠWp,‚¦ÃuÆ­Ó¶Ö׸t>•ªš6N{Þ!)»Ø¶÷2r%¥[o··÷-Îù¹SŸŒÊÚ{4?¦*à䨲óV™…gׇòž:‹“{¾ýµ¿(¬†[n-‘ÖŒÍÉ3ݘ9:C÷òx-óÒC¡¸õæÎi©Ï\Èè'†µ|ffŸ{¡ºø‡Ëw¼ïöˆØæ±]R´O“”¢ño®çþÇõ¿ÀB“B”¢å2”ZÇúUP9{endstream endobj 193 0 obj << /Type /Font /Subtype /Type1 /Encoding 502 0 R /FirstChar 3 /LastChar 121 /Widths 503 0 R /BaseFont /GRYPQW+CMSY8 /FontDescriptor 191 0 R >> endobj 191 0 obj << /Ascent 750 /CapHeight 683 /Descent -194 /FontName /GRYPQW+CMSY8 /ItalicAngle -14.035 /StemV 89 /XHeight 431 /FontBBox [-30 -955 1185 779] /Flags 4 /CharSet (/asteriskmath/dagger) /FontFile 192 0 R >> endobj 503 0 obj [531 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 472 ] endobj 502 0 obj << /Type /Encoding /Differences [ 0 /.notdef 3/asteriskmath 4/.notdef 121/dagger 122/.notdef] >> endobj 188 0 obj << /Length1 1071 /Length2 3546 /Length3 532 /Length 4246 /Filter /FlateDecode >> stream xÚí“y<”mÛÇ­a,Iöõ"û63–l‘%D ²EÆLfa[ö-R–ÈÊ’$’5Œ%*…ì{YŠ²FïÔýÜ÷í½Ÿ?ß÷¯çó\×?×÷8óøýÎã<.)qK+%7œ+Ò‡%*A•¡Ú€Ñ9++¨ U†€¤¤ŒðH8…Þ‚‘ÚTK <ÕÐVUÕVÓIF8ï<ÊÓÈÉýJÒ 0H< ÇçàDO$†ZGV8 I P Ðhök€! H¼/ÒM…n(pEz ° ð/GfXw ñGØäýç’/O šd©&åªE7¸!ÝAàó8ª’êäÿÃÔ?‹›Ðèóp̯ò¿»ôoëp ð¯ Æ›DDâs87$ûÏT[äæÎ!ÝP$Ì?W͈p4 a€õ@#È!Áåt³Dž€;M@þŽ#±nÿ4AmÜo `#+˜±éi…ÝèïEK8 K´ðþ«ì¯ìß ý›©ýÁ£üGˆ2¥&Rß?¿œþ!fŒEàÜPXêH¨àx<<D *©W¡ ë†ôþTÇ`e,ŽHÝP› ¸ãð _ª¦€8 þ+üGD"ñ¸¿êLô;ÀÔ-ª»?YƒÊæuûù¿HSÛþEÔÿ-¤EÍtý‹ ªŒÛ„`äTÀP£àq|åR+£ ÆüPªöR…pzü¤  Uˆx©"@ª®ïoü÷04Äù_U:®(©¨C©Ð4Ô5ƒÿW‚„Ç#±Äß?uªþdwu‘H$4ü‡Ð‰º’^C1.è-f”§5ô¨I:_ÙÜ×È9”L‹.ê<ã#?ñÄn§$ë(Ç㜘߮ázCÐ…n“¯á>I{s¾.sYuBvkYç>zKlE~>ü¬ºcIÖâÝD9Õ¾°=g¥ãsž¥ì)ëy¦1qšGߧ-w¢ŽkØ™d¡m®E?‘V‡qføcÕ®ûq¦Þbï‰ ¹r¹Vat×@âÚ)`¾—²wicñ¾#ŸY„ï÷Wb"6]%8hä¤-aJìWjŽ9KJ?(bÇ°¸BÀî®H°ËÃÒÀ4Ê æÇsý2E?'ò÷VjKÚ‚0ÕŠñúÄn´¦µÀk÷…OÛ¿Ó%Ñ$}nÜ*2vç ÕuÁÈxú•…o‘,$VtDL‰šX¶$[³âÖú´U›Y"/O†k7±¹ZMD×–ß¼Ž[ŸúT¥·³MBüb.âŽyëW¦Oã+.È /—¢…ž8iקê„'T ·º( êhÞ™c|1f_ÊQiþbLáûGÛíåÉS>³IjSDå0óInCy‚ßÊN!¯N:·Àz»”T#k¾‚%{|´—ÈgƒúŒ¶ÉMj)Ln{*¸­fœdcj8ox/ &»%R\W¯Ð¶rx íi„Ø—±x$A’…üÜýdÿó† ˜s>ߊú¬mñ’”ò c²öe4Çuô6㞎ÔÝTçÙ ÷eT•¿h:’XçGÊ¡¥g2†’©ã‚ëäüÃB3ô37%'Füi O¦%aç’y®)FŒóé "·”ƒxÈl¥iá õRŒç2çÇ Ìæ,3¶S3ÏoÝ+[x»ªœW¿Ý cwˆ[8â í':’ÝÎO€R ÔIÌS³}©­ZMGnc ¾Q¦ÒVÁ»NN%9jému¾b½(uU$Û ÷æ€+­oÈÙ·×OsM“9V›ê½Áaî0ù7ý¬¦Œ…x‡¶ëñÁÞØ(ŒÄБÇÛ/7Ñ~ “~Õ4ßœUeÍ–æpå_8ã!œ'—çËqhãMÄ#9‡%®O5šq±¯«9¢ÄéW¥ªOÌ›8„®ýìX¨m…e-IÎNDÆ2+?×e.û»oÕgÇfì¨hâX!hÏi7Æ&VŽG[¦šäôy²ötQðyao;éΖ5ÎÐw¥¢¾,ݯt¬»œ~úU´<àÂ1Ϫ¶2O B‡‚±ˆ¹& ¿uÃí$‚HŽa­øÏÇ‚›©l§Ïæȱۊ÷m9{öc‚s‰ÝüÞDé3é™ð» V&åY/ÑסQÒa‘ÆEÑJ}~ Ýk3»9´RÀ½^x…ðì×vúv)Æ40Cª Ü®AŠ!0ÿA‹ŸÖñ”k·œ½ÓUÀ·¼³ëL•Št]nh ëP&²iòš3+fY»6€P:ñ8Ç‚¯¼â¼×(éM™¯2zʬ`Î6Yξv6ùŸ"d6“¹:_~¾ùUD©qW°Žìç+Eªç𹞮ô!äÕKo¯î¶×ð~2‘pûØýô«DÙà‚ y¢6OÔç1Í8Ù“7ˆÍ^'V X·ÝC¸Û ÖX=ŒYD醢[^¾`S²ÂÚÅ?·j±®Ò02ÛGP‹Ù”uðyèˆm»/éY$lÚ>íFþT<©Í…f‰˜ÙÛÃ)7~~—çqFJØlØ ¤hì÷¤°ùKÞ–dÚãLÛböú‹eC}œÈ ¯ÞXËCrè)Þ6Õbht&~så,% ¹~MÏÈ/Eœ‘3•C~Εíü˜y©Ï;íék¥Vzü~ Ž1º:Äg.ð‡]”å$̨@ø.—Ÿ:3Mž_Ü‘ÝêDt‰{¤ÀaTc[ Û¯.ÒÏ™ºi-eÙþÕ!’éîÆ7tpç¸å|—àÉOÖ&ébM‘è`Öu3¶3å\Î`Ú!o,OtïŽ,ýRïdtnGͳªšà55ò³q) -‚á%®Ý†ÂܛϽ«–½·äÖévGxˆ±¶·_¿oÀ‡ýü¢'­ê÷åmì cô˜Y5éŽ|H»ƒžÝ™y!(çEBú ½8í÷¼¼›Ž(3æ+¥°$F˜U¹Îmzùå1»}-ÁmµHâêš“ÚåÓ‰"”,¯Àue‰{$wgr§€.7taxÐõhÖMÕíšR=˜Hb â!¬¸8FKµÌ=C¤Ð:rŽåe<û˜.]ZÑnvÝ~,, 0jóÄÌ›WEªê[¾\]³²ïbÄ1È‘;{ã«29­$O™8[¦óåçù 0†]_~éwY§?ûñVcôˆúüa©M¯þÔ·DQ¯ÚK¼—8uMz=kÖËÞZÕ3éN ÊÍ~`ôÂ(>hK[u#-ó§Ge¨“úÅÚ¤õl]:߃w âx‚“K}psÖw¸x¸tž9Tó»Ì[™/“û*ýmïÎKÍq+u+ ]=]°TÙX.è(·cVUtG˜¨ÉQïXfÂ(ü{¯&™¿Ôl\šÜyw7ÇŽ±î.”+;cÄ()/ã¨Ýÿ x$joʆ•œéžóšƒX$_åÄä6Т7%Ç£KK@%“|ÝïïxöšŸ’ #ÖNe9ôeWõnÓ(½]cªE†ß®l£yœ“o¬!)gŸð€ÇûÈÕ-;õ«‹´42ƒûž2ñnâv/Ž°Â÷Š”“i»nR8y¯ç¼Zh.{ ãü…·‚U÷¬üœŠô€±Æ5ú罉hÁ™#Â9–ƒX„ ¶Þà ‰Múj=KÑ«µIòkvM' žæÏ[’0¡`ÍFÞ…¢÷ ÃÙtÚ~ÛÓ±a uÖŠ1‚ï½Ô;O<¥7¾§ƒ#¼Ör=?íjÛb›„Ô«_ŒÒrifS´?ãi h—dغq%ÞdVÄ772îØ÷ëÙ3Û®Z•·“ؾ]Z‘°ïCðob9ûWÊ›6ˆf½u°pœAó›þ*­bú¯\RÚ/º·Ô3ч¤}è/•f~Ï·©¼°píR÷ UµÏûdëµ›gD¿Õ÷±0ƒ^ÞY°L@ÑXÿ¼]eÐj”RßL›’œÔA{RêÛ3×ÕíDvUˆ·;_Ä0÷•Çí»!‹^¢Ž'ß1q£dÈ«<”u´ü ½I.Iu¥¸±XÌ…êcݳ~j©èP Y3•uýÆ ?±-F±ˆ[þ1“nᲘÿ'À{s¿«ì5¡€Óæ ïp”’VÜ„„½ÌV£°Àñ'\­G+çºüä xJ®ô”0Ò½›K¢‰¥ø„R]s¾^òk¹…ÝçX{ôÉ},:£Ý.²^DnëAau Î|>ˆß3vfæã-qûËKÓóKc—n •1Y:ï Ýó7¿yAÿœ(ÚI<^X>97æŠñ¾m¬8Ä1 jîÖ²ÉæÀTá%Ÿ–U9øVðPª+ð.-éšÌ…ÈâöÏ1>ê „~îéÄ'JJË£F_)·vqÀ)ö·eŽËn‡ŽÔ‘øoYÏ?5*ø¿@«tG½ôwVöNgf>ºÅÆçÉŠ‰òê^pƒ½ü1 (~îƒSM¨5Ô‰ñ£/Pù]7ò*›Í»ð¦~íšÊaø E!¦äæOë-%¸@å›s ìq^.HñŽÂ¯Ì–fV˜©BŸžx«áÃ#A¬Ûy­™åþg÷T²3$kdøé^á¤8¸ßæ•él –È~XS2vC°‰¾>Åñ¬²2^òݱÜÞ¨Ær.ž.m˜hÛ‹ÏEUX:QÄëžËn?>–\rtwÛ%ÖH[F {Õ{²ŒùPÂCÂëËö§ô8Šíý00XéàÐkµ˜>IÁÞ.ÑAûdŒ¾É¹«ío¬óF?DJ§¿ŽæŽ‹8tLëF KZ¾âô~}1B>¦±k :õé˜&N澶 »DN£± ÿò¸ü-)Õæ”–i+¹}ÙÕ%Ž³ù 8›³¡^2lá1zM½cSJ&Õ÷ûtŽŽQ`áÅÙoh·ßo6=É12þzƒ}@ÜEò ¼ÿò僞1ŠAE^ˆ[‰5]ŸÔ”äÿø€þ[à?¢„ã‰8 ïúŠˆ‰Xendstream endobj 189 0 obj << /Type /Font /Subtype /Type1 /Encoding 504 0 R /FirstChar 44 /LastChar 118 /Widths 505 0 R /BaseFont /CSREGH+CMSS12 /FontDescriptor 187 0 R >> endobj 187 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 /FontName /CSREGH+CMSS12 /ItalicAngle 0 /StemV 76 /XHeight 444 /FontBBox [-62 -251 978 758] /Flags 4 /CharSet (/comma/zero/two/six/J/N/W/a/b/d/e/g/i/j/l/m/n/o/r/s/t/u/v) /FontFile 188 0 R >> endobj 505 0 obj [272 0 0 0 490 0 490 0 0 0 490 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 459 0 0 0 686 0 0 0 0 0 0 0 0 919 0 0 0 0 0 0 0 0 0 469 502 0 502 435 0 490 0 230 258 0 230 774 502 490 0 0 333 375 354 502 448 ] endobj 504 0 obj << /Type /Encoding /Differences [ 0 /.notdef 44/comma 45/.notdef 48/zero 49/.notdef 50/two 51/.notdef 54/six 55/.notdef 74/J 75/.notdef 78/N 79/.notdef 87/W 88/.notdef 97/a/b 99/.notdef 100/d/e 102/.notdef 103/g 104/.notdef 105/i/j 107/.notdef 108/l/m/n/o 112/.notdef 114/r/s/t/u/v 119/.notdef] >> endobj 185 0 obj << /Length1 1608 /Length2 9081 /Length3 532 /Length 9996 /Filter /FlateDecode >> stream xÚí˜U\›ëö ¡)V¬x!(VÜÝ))NI¡ 8 ¬¸w‡âÅ‹»w/¸Ûdïó?›Î9—3Wó›ä&ÏúÖ»ÖóÊ÷^„–JYYÜj–B`Ìì,ìIE55‰ìlv6tZZI[0f…H``;??;@ÜÞÀÎ#ÀÅ)ÀƃN „Z;Ûš™˜Âô’ %ñÄ­À¶f† @3[Ák‚,jPC30Ì™ ni Pýk„@l¶u± ³³ŒÌ a°‰õ/'9ˆ1Àû¯°‘½õ¿9€míàRz¸$®h…X:ŒÀÆè¬JPx/0Üäÿ†Ô—±·´TYýUþÖé¿2@Vf–Îÿ“µ²¶‡mŠP#°-ä?SµÀÿÒ“€ZþW#9ÈÒÌPbb °ý+df'cæ6R6ƒšŒA–và¿ã`ˆÑ*ÀîoVùwïÞªÊ2ý³§?V™A`êÎÖÿþ+ÿofdø Ùš9>²±°±±ÃáßÿÒývÒC¨‘~(¸y [[3:ütÀ‰àÂ0ƒ`'¸3+  ƒÀÅ ` µEÿkKá»Îjüwì_È GË‹Àjêlm †<†x¬Öð„=†ø¬ŸÁ¶ÐÇ?€ ÿÃÜlV˜ããsnxS˜©-ø x_¨½ícà/3‡?2¸¬vð5ù‡ájv`‡?Ìàógýמþá°BÌþ›B-¡ƒxàeÄ ^Bâ‘àÃ% >Vê‘àS”þ‡xá”y$¸»Ü#Ák*<¼¦â#Ák*=¼æûˆ^Sù‘à ¤úHðj_õG‚ÏHã‘àÝ5 ÞïÃ#ÁûiÿCð7”ôHðLƒG‚g>6¸šÑßNðø×^þpW“?.kúÂmÍþ@¸„Å·°üáV¥X! \úÂ5¬ÿ@¸†Í×°ýÿ:M |Õ` ÜÊþ„[9üp+ÇG„_άN ÜÊùoüïkBBêäÂÌË`怿"ðéñÃO›Ûÿ–hhok †Àþ¾ƒá—Í¿ÙØ ~5ÁN`Cô™I¨¡ ¯y|õ—|w鬑d;òÄ\ßf¿ÊDA–½EA¼qÛšau0Å1®®¹Y!Nܾ|«‘1÷2Iµ¸k·‹«ß4n7CF’êážÎ§'=i]mÏ­R·f(×­k˜f©Ï–š‘KvØy3IöƒžæOMÞ¸[x .Ï`$QoÄ¡ë¦5(Ä‚5·—"ú¯½…fAg²{ˆt’ÎðïgHÚÆ,æ±ùƒÓ‘&…oŸ±Ï›æã¹è*a`·Ð¸¬íHkV¦*•@òÓb*1§Ó“RÇá+‡Ûgݱ~­Å2#´9®Ù©ý‹Œ%þ´ù¾Üœá~]D«B¬^g>‘9Þøù¿Áø—USZåÜÅþ~‡Ì qLj,§®ß^ÐBrR=+2~²é×Ò¢ÅаŸª¡Òõ7ôêbvÉÄ›ho°”¦‚kp1s3 ÕŸž§4½FbnŠÈ‰S$¶nCByVg;ûâ ÷Ú$#Ó"¹×†1 xI-9j1 Îˆ=‚‘ƒA‚3šw} F¹Œî“a͇0Úöäg>Û*.]' ,£i!î"RרFI¸Ð3¥šçuyã|¾€Õd*ö3—Óàô ©c>OÁñ1èíí¡Óþ‘¥=EŸÖÇïTi9ä/u7q„’k±T€¨¢äÛ¤˜FptŠñýfÏÚIÔ+õF­¿}>t. ¦÷‰¡/¢2=V¯Öùe>7WE3nÀûNÖau|GÊÖ]M»ÏñãÆEEIJ¾ í¤™è\r¬á¶<Æ#ß?€¡š¹49æËÚõé{¾+R1u4YÊ"Á`}>ÒNÖMØuÛêy@›ÔžQ¾S<¶Ûnõ?°>#åççCÕXñ–x¦c«Y™ó ìõÁ7{ÿy7}? ž¯mž%W|Ûˆ¨lÄN±ŸÔ‘÷`íÁ²¹yR¼‘èàn”¯#1Xê ·Ç» %û„^Gë²Âû‹ R\_¶† F„V–¾üWITt££±ÜùÄ”ú9 ÒqëOk“/±ãŠù0çR˜@„|aÈvz!e¯Ù'=:“ŒöÐò;õ÷8‚{´^çl{~'1ï=>«ÅB¤ö~±$o{ãêU12ý^EÈ›ÆCÍbµqm?ÂoþÜïJº¿ìÆ.-Çîž*JYºé|¡xIV*tyBŒ5KJt ›ú}M1šÂ^£ý%GÍ›¥j‰Í³ ˆÚiú‘8¤`¹Þ7ŸZÞ–jk{hp ”ÊqüÇV˜Dôͺ×þÛY\.ÉÍŽ4;ýÅ ”1ƒÀènÙ¢c¯^‰L+ ú6DÑÝ Þ”§ºç«ŒTjSb´r[+ó~^¹£YSnŸˆ‘x·Í©lF%¨¤Nâ,.±¸\bÙ…«æ¢O®€0šì¡­³>=}œ$ h9!môd2d°È©9ýfrâ„ÌþIñžä¤|nµ¾—§ ݼY\ȶtmBs:ßò^û“®ù †eeì¢cVaHŠðöÆ$¢õ{²oÚ×;‹ˆ’ûO¬:ôïÎÚ>´¥å€7NaÉÆs™7«Ûk·X‘²‹M¡ÝsŸ½âÑN 5¬.EŠ._X-” ‘ÚÃØpYø#ë…~wáÄíV‡&sì†&ã 'œô«­²ª'ïÐõR†ê^A/f’¶x7uÉÓÉRÙ ò:8Z¥“w®M©¾=Œ·èG»÷ål$qwRsÒ³ºMÈp˜î•ÕÛOc­Sn͉•±6ó¿¤dv~Ì+žðÛ&j5âFùÞ(hõ¨e£¸íõ¸3‡P1Þ-Š2è,¡¼+ßømdrN›^ï˜?a*+­ëRð²¹s”„a  ÙîGHú˽Žl×$>Š¡ÚÚ±1ÌSì¨ÍzW€ÐT=«,›\Sé “ë^Â"ÙYAÞÔ‘ ã7B (Öˆr^EjW”®ýé.4‹'‚iKa}"™nyýÐåÕSòìX¼c^€çõÙ¼ f°ì· P$vÆÈ(ÁFÕ+­Çžëâýê•lÄG)Ê}\U“\í­’ì¯_º øª‘ådžñ7h 4³™_ˆa{A†Óáû;»SëRúÖ•nˆ…E´…$ÎÃM‚ZÕ\™í=úÁ¿‡P|£¤…$fÅ,+’AëDȦ%UÅᾨSVŬ켪—‘*hÚ[]éwjEŠ‚ Ž®¨mÏsÉ{ÝV8Sñ¬œ“C{\dó…2b¶=R”ñt€Ðª¬íõ@,²Ÿ&•èÄ=T|½lk ¿“e/¯±fn1w–<‘pjƒûÆñïñEù(K>/·gUÆx`|µkº.¯Æßдšù*"õ“vÇÑôgCã[Å~¸0R‰B¯«x•_¡äÄ;ïêE+iw‘\,ºÚ#eŒÚÝï ?Ë0#$ä×ù~1½&Ú/%E` oÛ?ä zˆ"ò1»ä…¾q¦¼ÐÖiTž:K;\©ü,ödKÿÞÍÇãÓ0õ¯SéN\±YnB‘³²—AM︒9Iuœ” Þ…·rZŠ*)n˜9yZ­l=;ôfÈsuÌã-Qý[ý—¨ ›ä¯Ò7!/<Åm)AÓo5ET¦:†<˜¬ Á‡bÂÒaiÕý˜HVß~ÀÖ[’ëøòœ½M$%Ø[Éôo¤åËÛOM©Ë¹eò{{‚f öF ¶ùY­ó¯Ä’9XÃÔ]vA=S~'c’·C“ã÷xaéíX[í&/·™À®§r;õZÛÕ^Ëô;›jáE—°üöì'êq!I6Ðòæ¶l¡×É,íHèÐêW­GÖwoåPKY›osu&4ìŽE ¯¿§^V˜Ð|ÃËzø¶mšÅ(õ4¼ÞT&ä‹@»,ZXíæ0w,MôËÅVLºæÆìÍó"’Šéœ@È>!Ux'¯e9êD [-Ž>G2Kè|¯é¢3ƯŠ¬øÕf0|gÞ÷bOB븭žÙmâpv\Ûv}3Òæ^«81ø)Œˆ·óä=¥\‹ŽcƒO%Ì-(C)ßÉ»ƒl]De6wèÖ*¢åØøÐc» ¢¯ã˜e×ö¶vÉ)ç4Š|ó@Є‚ÏÌÚ—B]›á¤(í[·Ý.§_Ð08‹[ Óh…4†û « e-Ï¥gF¹æè;©7_^ÛY¿ŒqD¶Q¸b¢se•…ÏÏÍy¿‘°%¿ü´—o$æñ`©BߊËSxvýô‡ÁSâÝõòÆ/¡1Ò·G6Âo|õõQÌG¥ J½j ^Mƒ¯LzxÎ{•‡Ô㶞«Î &Ñ1xƒøs„ êÊç¨eõvi«(ì—ûB‚P®Þ²@yuj+)Ô ÑgOñÇ%H8e7|rÙõä“Ì©=6êMè(HHÜ¥ð_©äÜm~AP—Þ<»¬!œáÊ@B|‡,Êú%3žíÓ¼¹VÈ”IkzbAÈÔ›q«¸ÎA”ý—<^*K»€'iÁÅZW†êÈ*ƒ˜Œ}Е]yûã©=ü,ñ%_{ æ'´+$Ùºj»í†‘pym7¬b^…YKRTRü}çS ³ÁíÑ^rñ+–™Âi&¦Í¼œê|HCâü¢Õ8fËùùJUÁ*Ew*>¦ò8?ŠŒÉ²Ì ‚ð'¾²Žµ¤R·„#fâÛÁÞC{Aãþ HO»ªîëòz.uRµžøVávs¬×Äc˜7ã< s>GÆ)»1W Xó1ÄÏ:÷çO8ÁbŽ½—ô¤r˜rð¶i]ýaÝžJ¨I{±Ixlì¾øš€&âéÓüÅ4îNN’š!®WÀ#ñ3ÿƒh,{üêùÑúýoÖÐ NÏÝc‚F™qØtaS'®±¡~â¹sKIMä {Ÿ5×áçžÙ‚âåp›ozêk{—´òV®tåa=Býö ½½õ&¤.¯M~1o©ºž;…56+$Ng¾xZšjF¥£o™ºsžõ‰">àØn©‚ºìsl¬uŒ30î¹îK4ªZœfú”•dM–×R"~¶\oŠt&•„aUfÈÈ›ˆ§Y kªfмº©èý@©º\Ùçóõ´Í@†ƒö—Ê~²ìñ§ïÀÞPÉQ3K|É¥…°}ì:h/qžløኩ }ŽxéhÔðñem¯uµw¶œBˆt þŒéטì×®Á5žãÜZ7îñänLì ~Öÿ‘ `Û$´N­ËÜ9Ñ@]*ÀÐ)\EÖÑòR»±ÕfµDŸnT2q_»5vˆEa*Sx†11y@9‰ TH?ѼíÄ•ÿyøIóûIP%ñîbH¾æ`1KÖûžâEK„øM‰úwýûç3Ê‚:CÏŠ´Ü'ܯG:¦.†3óÍ™Ïü‘¸w¿ ×ÿÐÕU–å¶KÁ/ëF'Æc#(£ÇA*‚Ö߀hýF4OD.Þ¾‘UEq˜2úmüRWy)³‡õÚ†§µár5éã½¹ÒÑ«·7Öb8myz¢4Ë9êßL«“4$ø(²v鞃|û8€!jé?ªŸ Ÿb!s^[?œsU øR3ËÂñÒx e‚/9d§$U§ì~Ù,ëšÊ0Çèõ¶ÖXáÌuÃDž§áÖy@º0†¾r8ðÊ1ªØ§VQÖPe£–Ri©1Õ‰åáÿÃ`Y)#ó&j7ö Ž{ÈòÄ9ª ¡‘Nw^^w2i^¯§”HÒÓ1]¬’°3)[‡æ³$KmQ@¾ú­‡Ø»S4*6jñY ìk†“. "/ÅgúÆ|à6ÙmÞ›)ålÆ8öÕ…ëë"™“•­šÛ“ 1óŠ[[É·D}°Ï_†GÌ2÷žy¥î„àTÝϤÄ:¬VGÝÐU.k1šû|5H•ùÝäl…¦Îõah…¯6Qcˆ qjŸ–»‚û6Œë]÷žóÑ®ïCjšÞë–?è8¥Pq)_“pF„ÌaÜ«?) e¢LSšú®5›[`ŽŸÌA,ÄCú±†ùìÒüÅ1)·9¡ÒĺÏ=Šý¹åg”™Ç6÷C¬`é3(ÆÔýyñ÷°Æ‘[ Ë [+¿Ù!Áù7Ý3ÕnúóŸQÐïk^ºqXKQmy€§NʈxcwŸ¯C†~Íw½À/ÇB“I´£ìåå u;úDt¨meÙ)û° RóÀˆW;,0ŒÃ°~™9E²·__ú¥HŸ°[×HI  Señ,dôoëjŸ|jš4&£)jï"WCj Ê÷¤óÛ>¬ñZ-ù¨ï-y(¥{w<ùiîºúèå¼ð ·@¿8PÉ6Óp>hP¹6œqíg ©xŸ'ïd¥–SC¯°CpáJ€Gó˜†IÒO’A‘^žú>f»Å¯eÁýÙO0Ù+E^‡nkgX‡ò«ǯuXÔÛ„ ]€ÈÇqjœÕ…m ¸"úÕ÷Å,˜*~~’[Öv 9 ÖržŽ7˜æØoÒ+xÇ$Î6‘zlAá¤H³j@F}k‘3®Y%AÔ·K'ô '¸Oêï?Â2ØÆ_«°z›ÚQrÖü„–¦Ü=´x%)Rã¡8’¯?ÒÕ& gÏ··–d”‹˜K4¶¡Íç†â‹""¡{°¢¶Åù½:b¿ídî#Û§nõÏ/­ñR‰¼žúláj 8_hL'.|·Š;ŠÜNœmµªg8ß'ÃîAéz1]'ÆÖŠoTҠ㪲:Ù@a^qˆtàýÑéggôºÛB\‹â¯ù.IùÛ‰g™ÕƒªZÊjW¬€‰Ä2<ÛÓêŠÍÐô×@·‘oƒßÇçå/§6޳ؕ¤VDx·»¥..ïéErÅ)`vŸüv+6ÆÐø¶=Ϙ ˜Òß$#9Mua§ü/'ÁË=™Ø(§Â“ÉWl]´¶KdJüªæí¯u½¯m6BSïOœ›σô™~·ï&7¾ÕÒK¼,fw> ”BÖìLµÆJM§ºXž{(Û™ :ýbà'(?_;{cLè÷ëÆOíκKF¥@þùƒËO(¼æÙêH"3óöÂ…ç»ËâèˆdRHÃÝ „³èãçÞ±7Ÿ¤ûäÊjÊ‚r%Ê]žIMicß‹hêbÛ ÌbI3Ê“d– T*9tÒ]æ\+þÁQ¾¡öD·°ý˜gƒ¼Qõ¢äÇöp}øÆx‰>GëI´¬ó½Y²ØÆTpeÖO(†?ò$®ù홶 Ú¯ö\ «¢V,ã&胪š:æPßµäÄ{îZ®FdVd¿ûõNþ§å¾_×Öa¡çÚ·m°Ó`he÷Î$fýÌxíÍ­â| œ0ô¹-RHAÀäŒÆ9o*DK³ÅÄ—@C™I*;âÞ/®ˆïEì°Ã+ãys`ä‚cÄ)¼ð‹¶yë²ÕzvšõÉj¶B\úµíC{3†¾æÃïäOËØw:ù"v!”Þô…eг­ñ%öƒCØ +I?J¦²v‚– ¹ää"q~—¹Cïàý¯}Ú+  Z1Z—Öo³-B’T4p.8ªkW½Ï©Ó‰/:|Å¡ÄæM»w¶î'ÃrYCÀÈ·ehÈY‚.ÄS¹b㔲t;?îníÁò´°Ú„&D‹`»BËCË3†éffω¤y~õØ9²¡ôÙe>ýKd¤°…iç´±#ˆs•_wÆ[…uÉ9Øú ôóæ±Î¥/˜(„UÏh,RSmxQ/êGû‹JCV’‡«pªò؇åÍV8ët&ñg0)_è¹r:1«h„ø³Ö®0ÍOäSy?ù4ß4j“Å–î ö×áç Õî5ù Ûh²·ŠÊ·»þ°`E_ñ§8çâ@ÁVdL}¦,ò>|òÌFºWQ?:C´QšO)f?y±ö1n%h—aO1ØЬ%[!tx·×æf%< £&Wúô4¡T0Üþ ±Â>ÿxÙm›Ó@ bè$ë'ú]Xmç^ag£3±á@ÍÔ‚è-¹£ì8ýª0 ÊR‰ËË~J9&yãO&/n¶2U9ìâÇ€þ鬭_ 6bF^|êÜ'‹¤TüUy5ÐöiṊ*&Z‹±+û|P)NT-*d×7¯|÷Ö?¥,¹[ÝgØkŒcƒþ®,ö”…ç–Rtéab¥ˆ}‰zŸ ÖQ£cv€² 4>ë^nCÞ”xÑ’ [jÍ£’¼U/È°¥žÚŽPMá ò=ÑÑâY–CícPå 9 6á´ŠéÜ«ì’·¹4yK®á´¡9Á˜ AZoCnŽB úPß—EDØP¶‡Hê+ÆûºRÙ–ÕS9Ö¸¤42iµÏüìŽRýpº2Ti¸ÏmëÔg#xÖ2T×ñݱ¤„V†'l°Þüîš»~$ó<­’¯¼úÏ/'Ÿl8ÆóÒ0˜ê¾0¼ç,”0Ê(Uï6«ø´$µKê^ÿöNÅy¯ëB^È¾Ê †)­CnÓKéwlƒ„*ª°$,¤gýƒ¸]ÖmÖ’`Ÿ½Iع þ 9´»£úÃD/%NBéö±‘˜‚ûþ‚Ê)Â÷6"lï jH¾aíÜí沘ì{mÌx—fyØTÖ°«­§,}üU{–IÕDœ”íêÛ=_v%]8³(§¿¶ôŲqf•RmìU‹ü»F©»{Êë׈óX¢RFÇ•f… Ñ%í“…w®ˆ”­%[$JNo[îej룽p7µ0‘…ªåõ~â¢Iãƒìý¡…bÀÛúéðdRòƒ—›zy”YÓÄë-á?Ñ­Q+’d'I˜ˆó¥©+šÂzBŸb¼ì\£SJ²Ê§hÛbçvòÑÒf.WͨŸ¤Ö>_祛Œì)ð^O¡a$€ïp,ëyuT*¢ISNëTÙ¡.Î…éR /‘ýM_”µ­K®7x•¨YTotO‰”ïW¡}»2ŒŒAð™ —?™ªvcèmbqHáWÓß4׊©¸:UkDŽ V9Ku6óξZk¥*¨7‘÷í·…ÓôRdØA²ï§-ÊuìHE¿GÊæuíá›U¶Ed±}óaàØã®°ÏÚTFá&±}rg,'h!Hnce}ÿõõ5½¹ª§sýqùGÙ‘‚颣b¨ªGâU[îãNò’†éïi§í½Yüú_’´A…˜e• Ë|äm×VÏ­²gÚ±RôL¦Éo·=\Û¼nÔ¹¼aê“"-]q;0m‘‚®+v¦‡ôÁÅ]ê•2“ºêÖ">™‚c2™§À¤e@ÐËXÏðÈÅgº¶W\OS®Ï¿M£ô7|fÛŒ’3û¾I"$æ×êïKk|L‡Q50aû=Ýw‚HµŸ1ssoæïÓ}iwÕH6ߪ§û +%e +îYôþæêȳw!¥6èæ™èÛ¬Y¶` ¡‰><Ý¢!>Yåûên2~ ì/‡ÎB•ZV&¯R™Ò5ËcpuôêÕÛžw%qfÔ©åšÒ‹cu û†îè®sgÌ%vÞ7Òäû%\Œ[g)GAå%*m‹~–M&8Ôò5÷9¿B{¡Üô¥^sèÎ!u€¼µl0ëc¶!—ê÷d"ÈAÕy;É06“ñ­¡•J­þå]^={s3LÙxƒg—dÌ“×2ÏgÑq£ÅvYλÝH—Ã9¹Wmó;lû­ËÅ®5®|¬?Mÿ4p€ååë–‘‡ëƒup—ËëŒÀßj!ZÛg6Ú ÕØÅÂwKÝá o×ØhäÙ½ÅQ ·à€¸åºó^(]å±A¾ 4Wš¶?»QÿA4ýúSËáu‚ ðhAþ„ö 8b’F~Ìd?ƒh4y‚õ$æÆ÷‰»+3oÿ-óiKzjïzÈ÷41æË0¢£ögR³ñQdâÉAÀ¦øSfÝ&#Z—†5_@ËmåUC}rM[ÀþלQ#gêg–<ÜM¢zôQ§N±&Ïi,ü?‘ ¯Ûã(YôìÝ{…•åtßdŒ*Þ \¬ÕêæÂ-1Ò;LßïW ©`RÙN4ˆ²¡ŸöA½¢¶³×ÅŒN“K´¬¡1(ŽèE4ÏñÄ*‘Tú%Ãà£Í@³â}ùý¿y >]¼â-\3cªF7.ô<úE>!áÍ´æÉh‘ß$?úpi]Œö;ˆê²k‚.ÊcCR°£rËøTyZ„Ü_à‹çå2"H7‹w åK𕆹Ym}NFñO¥®Ë\jfQ‡D¢ µÆÜôÀ—ø´ Ö'SÝy RQ ³Šq.WCÁ‹Èf—µ³?RJ^ÐÛó¾ `4"¯3 k0çg{sÂÌ“|[½—A1i'ûd‡¸Š{éø "½ÈÌ.´ˆ¸7YO«õ¬>ÚNÐëŒ7–äPïFÅ™=ZX$(ª‹z­±í°pø m•sŒœé¨Lú½ "ï(+4‡<ñš!Aé»LféËñmËð…LÒ>ùéC Àh¬íwZNñÌrg{"v¿ 4”Á+%kŒâ­ùkï®gÔ'‹[ ¶K>TíD~[3h¾oÏrÁšÃÜWüˆ«U÷_IMBæ•%é”^訅/ îÕíõ¿ >µ1’B”6äSEcdždú-àªèü‚Êé¾%N¦ø6_cÁTóg ¯8çVÙm;Æ^‹§ëtµæ¿/X Ïп(±ý~Ðÿÿ' Z‚A¶0¨ÈÖý¬¡:Ïendstream endobj 186 0 obj << /Type /Font /Subtype /Type1 /Encoding 506 0 R /FirstChar 11 /LastChar 121 /Widths 507 0 R /BaseFont /KJJGRH+CMSSBX10 /FontDescriptor 184 0 R >> endobj 184 0 obj << /Ascent 694 /CapHeight 694 /Descent -194 /FontName /KJJGRH+CMSSBX10 /ItalicAngle 0 /StemV 136 /XHeight 458 /FontBBox [-71 -250 1099 780] /Flags 4 /CharSet (/ff/fl/hyphen/period/zero/one/two/three/four/five/six/seven/eight/nine/colon/A/B/C/D/E/F/I/L/M/N/O/P/R/S/T/U/V/X/Y/a/b/c/d/e/f/g/h/i/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y) /FontFile 185 0 R >> endobj 507 0 obj [642 0 586 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 367 306 0 550 550 550 550 550 550 550 550 550 550 306 0 0 0 0 0 0 733 733 703 794 642 611 0 0 331 0 0 581 978 794 794 703 0 703 611 733 764 733 0 733 733 0 0 0 0 0 0 0 525 561 489 561 511 336 550 561 256 0 531 256 867 561 550 561 561 372 422 404 561 500 744 500 500 ] endobj 506 0 obj << /Type /Encoding /Differences [ 0 /.notdef 11/ff 12/.notdef 13/fl 14/.notdef 45/hyphen/period 47/.notdef 48/zero/one/two/three/four/five/six/seven/eight/nine/colon 59/.notdef 65/A/B/C/D/E/F 71/.notdef 73/I 74/.notdef 76/L/M/N/O/P 81/.notdef 82/R/S/T/U/V 87/.notdef 88/X/Y 90/.notdef 97/a/b/c/d/e/f/g/h/i 106/.notdef 107/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y 122/.notdef] >> endobj 215 0 obj << /Type /Pages /Count 6 /Parent 508 0 R /Kids [178 0 R 223 0 R 277 0 R 297 0 R 311 0 R 337 0 R] >> endobj 367 0 obj << /Type /Pages /Count 6 /Parent 508 0 R /Kids [359 0 R 369 0 R 374 0 R 380 0 R 389 0 R 401 0 R] >> endobj 424 0 obj << /Type /Pages /Count 4 /Parent 508 0 R /Kids [412 0 R 426 0 R 446 0 R 463 0 R] >> endobj 508 0 obj << /Type /Pages /Count 16 /Kids [215 0 R 367 0 R 424 0 R] >> endobj 509 0 obj << /Type /Outlines /First 7 0 R /Last 147 0 R /Count 4 >> endobj 175 0 obj << /Title 176 0 R /A 173 0 R /Parent 147 0 R /Prev 171 0 R >> endobj 171 0 obj << /Title 172 0 R /A 169 0 R /Parent 147 0 R /Prev 167 0 R /Next 175 0 R >> endobj 167 0 obj << /Title 168 0 R /A 165 0 R /Parent 147 0 R /Prev 163 0 R /Next 171 0 R >> endobj 163 0 obj << /Title 164 0 R /A 161 0 R /Parent 147 0 R /Prev 159 0 R /Next 167 0 R >> endobj 159 0 obj << /Title 160 0 R /A 157 0 R /Parent 147 0 R /Prev 155 0 R /Next 163 0 R >> endobj 155 0 obj << /Title 156 0 R /A 153 0 R /Parent 147 0 R /Prev 151 0 R /Next 159 0 R >> endobj 151 0 obj << /Title 152 0 R /A 149 0 R /Parent 147 0 R /Next 155 0 R >> endobj 147 0 obj << /Title 148 0 R /A 145 0 R /Parent 509 0 R /Prev 123 0 R /First 151 0 R /Last 175 0 R /Count -7 >> endobj 143 0 obj << /Title 144 0 R /A 141 0 R /Parent 123 0 R /Prev 139 0 R >> endobj 139 0 obj << /Title 140 0 R /A 137 0 R /Parent 123 0 R /Prev 135 0 R /Next 143 0 R >> endobj 135 0 obj << /Title 136 0 R /A 133 0 R /Parent 123 0 R /Prev 131 0 R /Next 139 0 R >> endobj 131 0 obj << /Title 132 0 R /A 129 0 R /Parent 123 0 R /Prev 127 0 R /Next 135 0 R >> endobj 127 0 obj << /Title 128 0 R /A 125 0 R /Parent 123 0 R /Next 131 0 R >> endobj 123 0 obj << /Title 124 0 R /A 121 0 R /Parent 509 0 R /Prev 11 0 R /Next 147 0 R /First 127 0 R /Last 143 0 R /Count -5 >> endobj 119 0 obj << /Title 120 0 R /A 117 0 R /Parent 55 0 R /Prev 115 0 R >> endobj 115 0 obj << /Title 116 0 R /A 113 0 R /Parent 55 0 R /Prev 111 0 R /Next 119 0 R >> endobj 111 0 obj << /Title 112 0 R /A 109 0 R /Parent 55 0 R /Prev 107 0 R /Next 115 0 R >> endobj 107 0 obj << /Title 108 0 R /A 105 0 R /Parent 55 0 R /Prev 103 0 R /Next 111 0 R >> endobj 103 0 obj << /Title 104 0 R /A 101 0 R /Parent 55 0 R /Prev 99 0 R /Next 107 0 R >> endobj 99 0 obj << /Title 100 0 R /A 97 0 R /Parent 55 0 R /Prev 95 0 R /Next 103 0 R >> endobj 95 0 obj << /Title 96 0 R /A 93 0 R /Parent 55 0 R /Prev 91 0 R /Next 99 0 R >> endobj 91 0 obj << /Title 92 0 R /A 89 0 R /Parent 55 0 R /Prev 87 0 R /Next 95 0 R >> endobj 87 0 obj << /Title 88 0 R /A 85 0 R /Parent 55 0 R /Prev 83 0 R /Next 91 0 R >> endobj 83 0 obj << /Title 84 0 R /A 81 0 R /Parent 55 0 R /Prev 79 0 R /Next 87 0 R >> endobj 79 0 obj << /Title 80 0 R /A 77 0 R /Parent 55 0 R /Prev 75 0 R /Next 83 0 R >> endobj 75 0 obj << /Title 76 0 R /A 73 0 R /Parent 55 0 R /Prev 71 0 R /Next 79 0 R >> endobj 71 0 obj << /Title 72 0 R /A 69 0 R /Parent 55 0 R /Prev 67 0 R /Next 75 0 R >> endobj 67 0 obj << /Title 68 0 R /A 65 0 R /Parent 55 0 R /Prev 63 0 R /Next 71 0 R >> endobj 63 0 obj << /Title 64 0 R /A 61 0 R /Parent 55 0 R /Prev 59 0 R /Next 67 0 R >> endobj 59 0 obj << /Title 60 0 R /A 57 0 R /Parent 55 0 R /Next 63 0 R >> endobj 55 0 obj << /Title 56 0 R /A 53 0 R /Parent 11 0 R /Prev 23 0 R /First 59 0 R /Last 119 0 R /Count -16 >> endobj 51 0 obj << /Title 52 0 R /A 49 0 R /Parent 23 0 R /Prev 47 0 R >> endobj 47 0 obj << /Title 48 0 R /A 45 0 R /Parent 23 0 R /Prev 43 0 R /Next 51 0 R >> endobj 43 0 obj << /Title 44 0 R /A 41 0 R /Parent 23 0 R /Prev 39 0 R /Next 47 0 R >> endobj 39 0 obj << /Title 40 0 R /A 37 0 R /Parent 23 0 R /Prev 35 0 R /Next 43 0 R >> endobj 35 0 obj << /Title 36 0 R /A 33 0 R /Parent 23 0 R /Prev 31 0 R /Next 39 0 R >> endobj 31 0 obj << /Title 32 0 R /A 29 0 R /Parent 23 0 R /Prev 27 0 R /Next 35 0 R >> endobj 27 0 obj << /Title 28 0 R /A 25 0 R /Parent 23 0 R /Next 31 0 R >> endobj 23 0 obj << /Title 24 0 R /A 21 0 R /Parent 11 0 R /Prev 19 0 R /Next 55 0 R /First 27 0 R /Last 51 0 R /Count -7 >> endobj 19 0 obj << /Title 20 0 R /A 17 0 R /Parent 11 0 R /Prev 15 0 R /Next 23 0 R >> endobj 15 0 obj << /Title 16 0 R /A 13 0 R /Parent 11 0 R /Next 19 0 R >> endobj 11 0 obj << /Title 12 0 R /A 9 0 R /Parent 509 0 R /Prev 7 0 R /Next 123 0 R /First 15 0 R /Last 55 0 R /Count -4 >> endobj 7 0 obj << /Title 8 0 R /A 5 0 R /Parent 509 0 R /Next 11 0 R >> endobj 510 0 obj << /Names [(Doc-Start) 183 0 R (Hfootnote.1) 220 0 R (Hfootnote.2) 221 0 R (Hfootnote.3) 308 0 R (Hfootnote.4) 309 0 R (cite.rfc1035) 410 0 R (cite.rfc4035) 357 0 R (page.1) 182 0 R (page.10) 382 0 R (page.11) 391 0 R (page.12) 403 0 R (page.13) 414 0 R (page.14) 428 0 R (page.15) 448 0 R (page.16) 465 0 R (page.2) 225 0 R (page.3) 279 0 R (page.4) 299 0 R (page.5) 313 0 R (page.6) 339 0 R (page.7) 361 0 R (page.8) 371 0 R (page.9) 376 0 R (section*.1) 226 0 R (section*.10) 384 0 R (section*.11) 385 0 R (section*.12) 386 0 R (section*.13) 387 0 R (section*.14) 392 0 R (section*.15) 393 0 R (section*.16) 394 0 R (section*.17) 395 0 R (section*.18) 396 0 R (section*.19) 398 0 R (section*.2) 353 0 R (section*.20) 404 0 R (section*.21) 405 0 R (section*.22) 406 0 R (section*.23) 407 0 R (section*.24) 408 0 R (section*.25) 421 0 R (section*.26) 422 0 R (section*.27) 423 0 R (section*.28) 458 0 R (section*.29) 459 0 R (section*.3) 355 0 R (section*.30) 460 0 R (section*.31) 461 0 R (section*.32) 466 0 R (section*.33) 468 0 R (section*.4) 362 0 R (section*.5) 363 0 R (section*.6) 372 0 R (section*.7) 377 0 R (section*.8) 378 0 R (section*.9) 383 0 R (section.1) 6 0 R (section.2) 10 0 R (section.3) 122 0 R (section.4) 146 0 R (subsection.2.1) 14 0 R (subsection.2.2) 18 0 R (subsection.2.3) 22 0 R (subsection.2.4) 54 0 R (subsection.3.1) 126 0 R (subsection.3.2) 130 0 R (subsection.3.3) 134 0 R (subsection.3.4) 138 0 R (subsection.3.5) 142 0 R (subsection.4.1) 150 0 R (subsection.4.2) 154 0 R (subsection.4.3) 158 0 R (subsection.4.4) 162 0 R (subsection.4.5) 166 0 R (subsection.4.6) 170 0 R (subsection.4.7) 174 0 R (subsubsection.2.3.1) 26 0 R (subsubsection.2.3.2) 30 0 R (subsubsection.2.3.3) 34 0 R (subsubsection.2.3.4) 38 0 R (subsubsection.2.3.5) 42 0 R (subsubsection.2.3.6) 46 0 R (subsubsection.2.3.7) 50 0 R (subsubsection.2.4.1) 58 0 R (subsubsection.2.4.10) 94 0 R (subsubsection.2.4.11) 98 0 R (subsubsection.2.4.12) 102 0 R (subsubsection.2.4.13) 106 0 R (subsubsection.2.4.14) 110 0 R (subsubsection.2.4.15) 114 0 R (subsubsection.2.4.16) 118 0 R (subsubsection.2.4.2) 62 0 R (subsubsection.2.4.3) 66 0 R (subsubsection.2.4.4) 70 0 R (subsubsection.2.4.5) 74 0 R (subsubsection.2.4.6) 78 0 R (subsubsection.2.4.7) 82 0 R (subsubsection.2.4.8) 86 0 R (subsubsection.2.4.9) 90 0 R] /Limits [(Doc-Start) (subsubsection.2.4.9)] >> endobj 511 0 obj << /Kids [510 0 R] >> endobj 512 0 obj << /Dests 511 0 R >> endobj 513 0 obj << /Type /Catalog /Pages 508 0 R /Outlines 509 0 R /Names 512 0 R /PageMode /UseOutlines /OpenAction 177 0 R >> endobj 514 0 obj << /Author( Jelte Jansen, Wouter C.A. Wijngaards )/Title(Response Differences between NSD and other DNS Servers)/Subject()/Creator(LaTeX with hyperref package)/Producer(pdfeTeX-1.21a)/Keywords() /CreationDate (D:20061102103525+01'00') /PTEX.Fullbanner (This is pdfeTeX, Version 3.141592-1.21a-2.2 (Web2C 7.5.4) kpathsea version 3.5.4) >> endobj xref 0 515 0000000001 65535 f 0000000002 00000 f 0000000003 00000 f 0000000004 00000 f 0000000000 00000 f 0000000009 00000 n 0000256611 00000 n 0000416511 00000 n 0000000054 00000 n 0000000084 00000 n 0000262450 00000 n 0000416387 00000 n 0000000129 00000 n 0000000201 00000 n 0000262511 00000 n 0000416313 00000 n 0000000252 00000 n 0000000310 00000 n 0000262574 00000 n 0000416226 00000 n 0000000361 00000 n 0000000421 00000 n 0000267655 00000 n 0000416102 00000 n 0000000472 00000 n 0000000499 00000 n 0000267717 00000 n 0000416028 00000 n 0000000555 00000 n 0000000616 00000 n 0000267842 00000 n 0000415941 00000 n 0000000672 00000 n 0000000733 00000 n 0000270496 00000 n 0000415854 00000 n 0000000789 00000 n 0000000841 00000 n 0000270621 00000 n 0000415767 00000 n 0000000897 00000 n 0000000964 00000 n 0000270748 00000 n 0000415680 00000 n 0000001020 00000 n 0000001109 00000 n 0000272735 00000 n 0000415593 00000 n 0000001165 00000 n 0000001254 00000 n 0000275206 00000 n 0000415519 00000 n 0000001310 00000 n 0000001401 00000 n 0000275333 00000 n 0000415406 00000 n 0000001452 00000 n 0000001496 00000 n 0000278109 00000 n 0000415332 00000 n 0000001552 00000 n 0000001605 00000 n 0000278232 00000 n 0000415245 00000 n 0000001661 00000 n 0000001728 00000 n 0000278356 00000 n 0000415158 00000 n 0000001784 00000 n 0000001842 00000 n 0000278481 00000 n 0000415071 00000 n 0000001898 00000 n 0000001976 00000 n 0000278606 00000 n 0000414984 00000 n 0000002032 00000 n 0000002115 00000 n 0000278731 00000 n 0000414897 00000 n 0000002171 00000 n 0000002253 00000 n 0000281761 00000 n 0000414810 00000 n 0000002309 00000 n 0000002380 00000 n 0000281888 00000 n 0000414723 00000 n 0000002436 00000 n 0000002499 00000 n 0000282015 00000 n 0000414636 00000 n 0000002555 00000 n 0000002637 00000 n 0000282142 00000 n 0000414549 00000 n 0000002694 00000 n 0000002777 00000 n 0000282269 00000 n 0000414460 00000 n 0000002834 00000 n 0000002927 00000 n 0000282396 00000 n 0000414369 00000 n 0000002985 00000 n 0000003062 00000 n 0000285259 00000 n 0000414277 00000 n 0000003120 00000 n 0000003184 00000 n 0000285385 00000 n 0000414185 00000 n 0000003242 00000 n 0000003316 00000 n 0000285511 00000 n 0000414093 00000 n 0000003374 00000 n 0000003439 00000 n 0000285637 00000 n 0000414015 00000 n 0000003497 00000 n 0000003569 00000 n 0000285762 00000 n 0000413884 00000 n 0000003616 00000 n 0000003688 00000 n 0000285825 00000 n 0000413805 00000 n 0000003740 00000 n 0000003797 00000 n 0000289152 00000 n 0000413712 00000 n 0000003849 00000 n 0000003908 00000 n 0000289216 00000 n 0000413619 00000 n 0000003960 00000 n 0000004028 00000 n 0000289343 00000 n 0000413526 00000 n 0000004080 00000 n 0000004142 00000 n 0000289471 00000 n 0000413447 00000 n 0000004194 00000 n 0000004250 00000 n 0000294080 00000 n 0000413329 00000 n 0000004297 00000 n 0000004366 00000 n 0000294141 00000 n 0000413250 00000 n 0000004418 00000 n 0000004475 00000 n 0000294204 00000 n 0000413157 00000 n 0000004527 00000 n 0000004586 00000 n 0000298134 00000 n 0000413064 00000 n 0000004638 00000 n 0000004726 00000 n 0000298262 00000 n 0000412971 00000 n 0000004778 00000 n 0000004864 00000 n 0000298390 00000 n 0000412878 00000 n 0000004916 00000 n 0000004982 00000 n 0000298518 00000 n 0000412785 00000 n 0000005034 00000 n 0000005125 00000 n 0000301731 00000 n 0000412706 00000 n 0000005177 00000 n 0000005254 00000 n 0000006568 00000 n 0000006734 00000 n 0000214275 00000 n 0000005306 00000 n 0000214149 00000 n 0000214213 00000 n 0000411114 00000 n 0000400833 00000 n 0000410950 00000 n 0000400050 00000 n 0000395521 00000 n 0000399888 00000 n 0000213480 00000 n 0000394924 00000 n 0000393140 00000 n 0000394764 00000 n 0000392635 00000 n 0000389865 00000 n 0000392472 00000 n 0000213638 00000 n 0000388769 00000 n 0000381117 00000 n 0000388607 00000 n 0000380521 00000 n 0000378714 00000 n 0000380361 00000 n 0000213796 00000 n 0000377613 00000 n 0000368425 00000 n 0000377453 00000 n 0000213973 00000 n 0000367824 00000 n 0000364875 00000 n 0000367663 00000 n 0000363968 00000 n 0000357764 00000 n 0000363808 00000 n 0000412218 00000 n 0000009672 00000 n 0000009873 00000 n 0000009920 00000 n 0000213458 00000 n 0000302213 00000 n 0000302181 00000 n 0000224800 00000 n 0000217300 00000 n 0000214479 00000 n 0000224674 00000 n 0000224737 00000 n 0000217770 00000 n 0000356807 00000 n 0000348885 00000 n 0000356645 00000 n 0000217926 00000 n 0000218082 00000 n 0000347523 00000 n 0000331940 00000 n 0000347362 00000 n 0000218242 00000 n 0000218403 00000 n 0000218564 00000 n 0000218730 00000 n 0000218895 00000 n 0000219060 00000 n 0000219225 00000 n 0000219391 00000 n 0000219556 00000 n 0000219722 00000 n 0000219888 00000 n 0000220054 00000 n 0000220220 00000 n 0000220381 00000 n 0000220547 00000 n 0000220713 00000 n 0000220879 00000 n 0000221045 00000 n 0000221211 00000 n 0000221376 00000 n 0000221542 00000 n 0000221707 00000 n 0000221873 00000 n 0000222037 00000 n 0000222203 00000 n 0000222369 00000 n 0000222536 00000 n 0000222703 00000 n 0000222870 00000 n 0000223037 00000 n 0000223204 00000 n 0000223371 00000 n 0000223538 00000 n 0000223705 00000 n 0000223872 00000 n 0000224039 00000 n 0000224195 00000 n 0000224354 00000 n 0000224515 00000 n 0000226379 00000 n 0000252357 00000 n 0000226149 00000 n 0000224911 00000 n 0000252293 00000 n 0000250371 00000 n 0000250531 00000 n 0000250692 00000 n 0000250847 00000 n 0000251008 00000 n 0000251169 00000 n 0000251329 00000 n 0000251489 00000 n 0000251650 00000 n 0000251811 00000 n 0000251972 00000 n 0000252132 00000 n 0000229264 00000 n 0000229472 00000 n 0000229519 00000 n 0000250349 00000 n 0000256798 00000 n 0000255447 00000 n 0000252483 00000 n 0000256548 00000 n 0000255621 00000 n 0000255832 00000 n 0000256043 00000 n 0000331622 00000 n 0000329585 00000 n 0000331463 00000 n 0000256201 00000 n 0000256391 00000 n 0000256670 00000 n 0000256734 00000 n 0000262637 00000 n 0000258970 00000 n 0000256935 00000 n 0000262386 00000 n 0000259256 00000 n 0000259417 00000 n 0000259578 00000 n 0000259739 00000 n 0000328684 00000 n 0000320196 00000 n 0000328522 00000 n 0000259900 00000 n 0000260066 00000 n 0000260232 00000 n 0000260398 00000 n 0000260562 00000 n 0000260728 00000 n 0000260894 00000 n 0000261059 00000 n 0000261225 00000 n 0000261391 00000 n 0000261557 00000 n 0000261722 00000 n 0000261888 00000 n 0000262055 00000 n 0000262221 00000 n 0000267967 00000 n 0000264867 00000 n 0000262776 00000 n 0000267592 00000 n 0000265121 00000 n 0000265287 00000 n 0000265453 00000 n 0000265618 00000 n 0000265784 00000 n 0000265950 00000 n 0000266117 00000 n 0000266282 00000 n 0000266448 00000 n 0000266615 00000 n 0000266781 00000 n 0000266947 00000 n 0000267114 00000 n 0000267779 00000 n 0000267275 00000 n 0000267904 00000 n 0000267433 00000 n 0000301918 00000 n 0000270811 00000 n 0000270310 00000 n 0000268078 00000 n 0000270432 00000 n 0000270557 00000 n 0000270684 00000 n 0000319050 00000 n 0000308229 00000 n 0000318889 00000 n 0000412335 00000 n 0000272797 00000 n 0000272487 00000 n 0000270950 00000 n 0000272609 00000 n 0000272672 00000 n 0000275396 00000 n 0000274956 00000 n 0000272908 00000 n 0000275078 00000 n 0000275142 00000 n 0000275269 00000 n 0000278793 00000 n 0000277924 00000 n 0000275535 00000 n 0000278046 00000 n 0000278169 00000 n 0000278294 00000 n 0000278418 00000 n 0000278543 00000 n 0000278668 00000 n 0000282460 00000 n 0000281154 00000 n 0000278891 00000 n 0000281635 00000 n 0000281699 00000 n 0000281824 00000 n 0000281951 00000 n 0000282078 00000 n 0000282205 00000 n 0000281304 00000 n 0000282332 00000 n 0000281470 00000 n 0000285888 00000 n 0000284834 00000 n 0000282599 00000 n 0000285135 00000 n 0000285198 00000 n 0000285322 00000 n 0000285448 00000 n 0000285574 00000 n 0000285699 00000 n 0000284976 00000 n 0000301981 00000 n 0000289598 00000 n 0000287944 00000 n 0000285986 00000 n 0000289088 00000 n 0000288126 00000 n 0000288287 00000 n 0000288446 00000 n 0000288606 00000 n 0000288767 00000 n 0000288928 00000 n 0000289279 00000 n 0000289407 00000 n 0000289534 00000 n 0000412452 00000 n 0000294267 00000 n 0000291129 00000 n 0000289737 00000 n 0000294017 00000 n 0000291391 00000 n 0000291556 00000 n 0000291722 00000 n 0000291888 00000 n 0000292048 00000 n 0000292214 00000 n 0000292380 00000 n 0000292541 00000 n 0000292701 00000 n 0000292868 00000 n 0000293034 00000 n 0000293200 00000 n 0000293365 00000 n 0000293524 00000 n 0000293685 00000 n 0000293851 00000 n 0000298646 00000 n 0000296376 00000 n 0000294378 00000 n 0000298070 00000 n 0000296582 00000 n 0000296747 00000 n 0000296914 00000 n 0000297079 00000 n 0000297246 00000 n 0000297412 00000 n 0000297578 00000 n 0000297743 00000 n 0000297909 00000 n 0000298198 00000 n 0000298326 00000 n 0000298454 00000 n 0000298582 00000 n 0000302044 00000 n 0000300196 00000 n 0000298785 00000 n 0000301668 00000 n 0000301792 00000 n 0000300386 00000 n 0000301855 00000 n 0000300552 00000 n 0000300737 00000 n 0000307486 00000 n 0000302245 00000 n 0000307324 00000 n 0000300922 00000 n 0000301108 00000 n 0000301295 00000 n 0000301482 00000 n 0000307958 00000 n 0000307748 00000 n 0000319753 00000 n 0000319447 00000 n 0000329257 00000 n 0000328957 00000 n 0000331852 00000 n 0000331824 00000 n 0000348381 00000 n 0000347986 00000 n 0000357399 00000 n 0000357099 00000 n 0000364559 00000 n 0000364263 00000 n 0000368209 00000 n 0000368047 00000 n 0000378289 00000 n 0000377961 00000 n 0000381003 00000 n 0000380741 00000 n 0000389461 00000 n 0000389113 00000 n 0000392968 00000 n 0000392850 00000 n 0000395407 00000 n 0000395145 00000 n 0000400518 00000 n 0000400302 00000 n 0000411833 00000 n 0000411475 00000 n 0000412553 00000 n 0000412631 00000 n 0000416583 00000 n 0000418961 00000 n 0000419000 00000 n 0000419038 00000 n 0000419168 00000 n trailer << /Size 515 /Root 513 0 R /Info 514 0 R /ID [<1784B550E045DD0920A5548BA7339155> <1784B550E045DD0920A5548BA7339155>] >> startxref 419523 %%EOF nsd-3.2.16/doc/REQUIREMENTS0000664000175000017500000010406712167000652013775 0ustar matjematje$Id: REQUIREMENTS 4015 2013-07-09 12:27:22Z matje $ NSD Requirements and Specifications ______________________________________________________________________ A. Scope. NSD is a complete implementation of an authoritative DNS nameserver. This document describes the basic requirements and specifications for this implementation. B. Requirements B.1. General Requirements These requirements are in order of importance: 1. Conformity to the relevant DNS RFCs If complying with the letter of the RFCs will cause a conflict with high load resilience reasoned trade-offs will be made and documented. 2 Code diversity from other implementations NSD is developed from scratch and does not share code or design with other implementations. 3. Authoritative server only NSD is designed to provide authoritative answers only. There are no facilities for caching or recursion. 4. Open source The code will be open source after the first public release. 5. Regression tested against bind8/9 Extensive regression tests with real trace data and synthetic exceptional data will be carried out. For the real traces any differences with bind8/9 will be documented. Should there be substantial differences a bind8/9 compatibility option will be considered. The testing tools will be published separately as much as possible. 6. Resilience to high load As many as UDP queries answered as possible per time interval. Aware of useless queries and limiting answers to conserve output bandwidth. This may supersede strict RFC compliance. Mitigation of DDoS attacks as far as feasible. 7. Documentation The implementation will be well documented with the aim of allowing others to understand its operation in order to be able to maintain the code. This includes these requirements, a general design document and well documented code. 8. Reviewed code All code will be reviewed by at least two persons other than the primary author before being included in a release version. 9. Simplicity NSD will not do things that are not strictly necessary for its task: authoritative name serving. If in doubt a feature is more likely not to be included. The code strives to be as simple and straightforward as possible, even if it looks stupid ;-). 10. Reasonable Portability Should be reasonably portable across hardware architectures and OS platforms. Rough targets: (Intel/SPARC/Alpha)(FreeBSD,Linux,Solaris) 11. Maintenance for initial period NLnet Labs and the RIPE NCC will support NSD for at least 12 months after publication. B.2. Explicit NON-Requirements 1. No caching NSD will not provide cached or recursive answers. 2. No slavish responsiveness NSD may decide to limit answers to queries it considers malicious or useless if this enables it to provide better service to queries it considers valid. Conserving output bandwidth is a consideration. 3. No end-user friendliness NSD operators are considered to have basic Unix and networking knowledge and are also considered to be able to read and understand reasonably written user documentation. 4. No creeping featurism NSD will not implement any functionality that is not strictly necessary for the task of authoritative name serving. Examples: round robin sequence of RRset members in consecutive answers, Also no dynamic plugins. C. Technical Specification. C.0 Environment The server runs with the least possible permissions. NSD will not implement special VM work-arounds to accommodate zones larger than order 10 million RRs in 32-bit address space machines. Operators requiring huge-zone support can use 64-bit machines. C.1. Zone file format and RR records. Zone file format as specified in rfc1035 (5.1), including the $TTL entry for default TTL as in RFC2308 (4) and the binary label format as in RFC2673. We implement most RRs currently assigned by IANA (http://www.iana.org/assignments/dns-parameters) except for RRs that are obsoleted by IANA or assigned experimental, those MAY not be implemented. See below and/or release notes. Zone file MUST not contain errors. i.e. the zonecompiler may fail or produce unpredictable results when: - RRs that are obsolete and not implemented are encountered. - Syntax errors are found (RFC1035 5.2) + not all RRs are of the same zone + not exactly one SOA RR is present at the top of the zone. + delegations are present but required glue is not present. + Out of Zone, non-glue data is encountered. + not all RRs in a RRset have the same TTL (RFC2181 5.2) + if a DNAME exists at node N there may not be any other data at 'N' (except CNAME or DNAME) and there MUST not be any other data at subnodes of 'N' (RFC 2672 section 3). - The default minimum TTL is not specified by the $TTL directive Zones that are parsed by the zonecompiler will be served by the nsd daemon. Only zone files of CLASS "IN" are supported. The zone file parser sets the TTL of those RRs that do not have their TTL defined to the minimum TTL as defined by the $TTL directive unless the RR is part of a RRset and the TTL is set for one of the RRs in the RRset. Parsing of the names in zone files is case insensitive (Note: RFC1035 2.3.3 also see 1034 3.1 "The basic rule is that case can be discarded only when data is used to define structure in a database, and two names are identical when compared in a case insensitive manner." ) The database relies on case; all names will be parsed to lower case. Case of dnames in RDATA will be preserved except for dnames for which dname compression in RDATA is allowed, those dname fields are converted to lower case. (for that subset of RRs compression has preference over case preservation). Also see Appendix B for dname compression in RDATA. DNSSEC consideration (as of 2.0.0): DNSSEC processing of data in a zone will only take place if that zone is marked to be secure. A zone is marked secure if the SOA record is signed. The zone data is not cryptographically checked at the time the zone db is generated; NSD always clears the AD flag on answering data from a secure zone in the database. NSD always copies the CD bit from the query to the response. NSD does not include the DNSKEY RRset in the additional section on queries for the SOA or NS records at the zone apex. It is not clear whether including the DNSKEY RRset is advantageous and not doing so simplifies NSD. C.2. Server and connection management. The server listens on port 53. The server answers with the same IP address and port (53) as the queries has been sent to. Replies are sent to the address/port the queries originated from. (rfc 2181 4) UDP. The server is optimized to handle UDP queries. Large packet sizes are supported. The size is set by the OS (e.g. net.inet.udp.maxdgram on FreeBSD). TCP. The server accepts TCP connections. Note that there may be one or more DNS messages in the stream. Each message is prepended with a 2 byte size (rfc 1035 4.2.2) Connection management (rfc1035 4.2.2.) + the server should not block other activities waiting for TCP data + The server should assume that the client will initiate connection closing and should delay closing its end of the connection until all outstanding client requests have been satisfied. + For closing dormant connections the timeout should be in the order of 2 minutes. NSD specific: + The maximum number of open TCP connections is configurable. It is assumed the OS copes with attacks on the TCP stack (e.g like SYN attacks) C.3 Incoming DNS Message processing. NSD specific choices. These issues are not addressed in the RFCs. Behavior is defined below. + Non parsable messages are replied to with a FORMERR. + Each UDP packet only carries one DNS Message. Any data behind the DNS message is considered garbage and is ignored. + Incoming DNS messages with the QR bit set to 1 (response) are discarded. (In spirit of rfc 1035 sect 7.3) + RD is copied into the response (rfc 1035 4.1.1) the RA bit is set to 0 and the QUERYID is copied into the response message. + OPCODE 0 (QUERY) results in normal handling of packet (rfc1035) OPCODE 1 (IQUERY) results in RCODE=4 NOTIMPL (rfc1035) OPCODE 2 (STATUS) results in RCODE=4 NOTIMPL (rfc1035) OPCODE 3 (RESERVED) results in RCODE=4 NOTIMPL OPCODE 4 (NOTIFY) results in RCODE=4 access control list processing and then handling of the notify. (rfc1995) OPCODE 5 (UPDATE) results in RCODE=4 NOTIMPL (rfc2136 sect 3) + AA bit in query packet is ignored. + TC bit set in a query packet is answered with FORMERR. [This must always be a broken implementation since the max length of the name is 255 octets.] + RCODES are ignored. + QDCOUNT=1 results in further processing. QDCOUNT!=1 results in RCODE=1 FORMERR + QCLASS=IN results in further processing. + QCLASS=ANY results in further processing with the AA bit in the response off (rfc 1035 6.2) + QLASS=CHAOS only leads to further processing if the queries are for the names ID.SERVER or VERSION.SERVER. Any other query in that namespace will lead to RCODE=REFUSED. For QTYPE other than TXT a NOERROR with a trivial SOA RR in the AUTHORITY section will be returned. Behavior for QTYPE=TXT is defined in draft-ietf-dnsop-serverid-00.txt + QCLASS!=IN && QCLASS!=ANY && QCLASS!=CHAOS results in RCODE=REFUSED [Background: BIND8 generates a SERVFAIL but I would say that a A NOERROR message with empty Answer, Authority and Additional section is also a good answer and more in the spirit of RFC 1034 section 4.3.1. We choose to mimic the behavior of bind. BIND9 generates a status RCODE=5 REFUSED. ] + Other sections should be empty otherwise FORMERR. + except, EDNS and TSIG opt records are allowed. + TSIG signature is checked, otherwise a TSIG error. + Presence of OPT RR indicates support of EDNS (rfc2671). If the VERSION > 0 then the server will respond with an OPT with RCODE=BADVERSION and VERSION=0 (The server supports EDNS0) In further processing ENDS0 support is taken into account. + If the DNSSEC OK bit (DO bit) is set then the query will be processed as a DNSSEC request. Although RFC3225 does not explicitly specify this NSD clears the DO bit in the answer. C 4 Further Query processing. Preconditions: + the QCLASS is either IN or ANY. For both classes the IN class zones are searched in the same manner. The difference in the response will be in the Authority information. + It is known if the requester supports EDNS0 + There is only one query in the DNS message to be answered. + The RD & message ID of the incoming query has been copied into the response message. + It is known if the requester wants DNSSEC processing as indicated by the DO bit being set. C 4.1 Actions based on QTYPE of incoming Query. If QTYPE>=249 we are dealing with special queries. case QTYPE=TKEY case QTYPE=TSIG case QTYPE=IXFR respond with RCODE=5 (REFUSED) case QTYPE=AXFR respond with AXFR (TSIG is supported) case QTYPE=MAILB proceed with processing. case QTYPE=MAILA proceed with processing. case QTYPE=ANY proceed with processing. QTYPE < 249 process the query Further processing of the packet is based on the algorithm from 1034 as modified by (rfc2672 4). Below is the algorithm as applies to an authoritative cache-less server and with the preconditions from above. We have also included DNSSEC considerations (rfc2535 and rfc3225) The first versions of NSD will not have DNSSEC processing implemented. (Read this as the DO bit is not set). 1. Search the available zones for the zone which is the nearest ancestor to QNAME. If such a zone is found, go to step 2, otherwise step 3. 2. Start matching down, label by label, in the zone. The matching process can terminate several ways: a. If the whole of QNAME is matched, we have found the node. If the data at the node is a CNAME, and QTYPE doesn't match CNAME, copy the CNAME RR into the answer section of the response, change QNAME to the canonical name in the CNAME RR, and go back to step 1. If the DO bit is set in the query the RRSIG(CNAME) needs to be copied in the answer section as well. Otherwise, copy all RRs which match QTYPE into the answer section. Also copy corresponding RRSIGs into the answer section if the DO bit was set, goto step 4. If QTYPE is 'ANY' copy all RRs including the security related RR types regardless if the DO bit was set into the answer section. If none of the RRtypes matched QTYPE, the DO bit was set and the zone is marked secure then the answer section is left empty and b. If a match would take us out of the authoritative data, we have a referral. This happens when we encounter a node with NS RRs marking cuts along the bottom of a zone. Copy the NS RRs for the subzone into the authority section of the reply. If the DO bit has been set then if the zone is marked secure then if there is a NSEC record or DS record then include the DS bit and associated RRSIG(DS) into the authority section if the DS record is present for this delegation. If there is no DS record present for this delegation then include the NSEC record with the corresponding RRSIG(NSEC) in the authority section. else we are in an opt-in part of the zone and we should include the the NSEC RR of the last secured RR in the zone and the corresponding RRSIG(NSEC) into the authority section of the answer. fi fi Put whatever addresses are available into the additional section, using glue RRs if the addresses are not available from authoritative data. If the DO bit was set then also copy the RRSIGs for the addresses for which the server is authoritative. Go to step 4. c. If at some label, a match is impossible (i.e., the corresponding label does not exist), look to see whether the last label matched has a DNAME record. BEGIN DNAME (supported as of NSD 3.0) If a DNAME record exists at that point, copy that record into the answer section, if the DO bit is set also copy the RRSIG. If substitution of its for its in QNAME would overflow the legal size for a , set RCODE to YXDOMAIN [DNSUPD] and exit; otherwise perform the substitution and continue. If the query was not extended [EDNS0] with a Version indicating understanding of the DNAME record, the server SHOULD synthesize a CNAME record as described above and include it in the answer section. Go back to step 1. Note that there should be no descendants of a DNAME in the same zone (rfc2672 3). So if a DNAME has been found only go to step 1 if another zone can be found. NSD will refuse to zonecompile a zone that has descendants of a DNAME. It always synthesizes CNAME records. END DNAME If there was no DNAME record, look to see if the "*" label exists. If the "*" label does not exist, check whether the name we are looking for is the original QNAME in the query or a name we have followed due to a CNAME. If the name is original, set an authoritative name error (RCODE=3 NXDOMAIN) in the response, if the DO bit was set then include the appropriate NSEC records (see section 4.5.) in the authority section, then exit. If the "*" label does exist, match RRs at that node against QTYPE. If any match, copy them into the answer section, but set the owner of the RR to be QNAME, and not the node with the "*" label. If the DO bit is set copy the RRSIG for the * label and matching QTYPE also set the owner of the RRSIG RR to be QNAME). In addition a NSEC record indicating that no specific matches are possible should be returned in the additional section. Otherwise just exit. Go to step 4. 3. If a there was no delegation of authoritative data return the root delegation in the authority section and continue with 4. Also see Appendix B.1 4. Using local data only, attempt to add other RRs which may be useful to the additional section of the query if the DO bit was set in the query then for retrieval of SOA or NS a DNSKEY of the same name should be added. For retrieval of type A, AAAA or A6 RRs the DNSKEY should also be included. See section 4.2 as well. Note that on a QNAME match the NS records are not copied into the AUTH section (This is a requirement from step 4 'matching down the cache' from rfc1034 4.3.2). This is a requirement only for caching servers. BIND8 will copy the the NS in the Auth section for authoritative server too. C 4.2 Additional Data processing. Additional data is added as long as there is space in the packet. When processing the additional section priority is (rfc 2535 3.5 and rfc 2874 4) + A + A6 + AAAA + DNSKEY For truncation see section C.4.4 If the DO bit is set RRSIGs will be included with the additional data. Although not specified in the RFCs we will assume the following priority: Note that A glue is always added before any AAAA glue. + A + RRSIG A + A6 + RRSIG A6 + AAAA + RRSIG AAAA + DNSKEY + RRSIG DNSKEY NSD will act as being authoritative for one zone without having the other zones in cache. In other words: If a NSD is authoritative for say both ripe.net and nlnetlabs.nl and both these zones are secondary for each others NS. Then, at least with my zone parser a query for ripe.net NS would return ANSWER: ripe.net NS ns.ripe.net NS ns.nlnetlabs.nl Additional ns.ripe.net A 10.0.0.1 and not ANSWER: ripe.net NS ns.ripe.net NS ns.nlnetlabs.nl Additional ns.ripe.net A 10.1.0.1 ns.nlnetlabs.nl A 10.2.0.2 This behavior is a consequence of NSD using precompiled packets. These are 'constructed' zone by zone. It is an optimisation of speed versus network optimisation. In NSD2 and later this behaviour still exists, even though the packets are constructed at run time, only information from the current zone is added to a response. C 4.3 Label compression in RDATA In the spirit of RFC 1035 section 3.3. and 4.4.1 ("Pointers can only be used for occurrences of a domain name where the format is not class specific.") we only do label compression for labels in rdata for which this is specifically mentioned in the RFC defining the RR. -NS, SOA, CNAME, and PTR (rfc 1035 3.3) Others defined in (rfc 1035 3.3) are not compressed. BIND8 does compression for all RR from rfc 1035 for which dnames appear in the rdata. (Note that other RFCs do refer to e.g. MX dname in rdata being compressed (e.g. rfc2974 4.). -MB, MG, MR, MINFO, MX also have compressed dnames. These RRs and their compression are described in RFC 883. -NSEC, RRSIG and DNSKEY MUST NOT have dname compression (rfc 4034). For RRs not mentioned here no label compression in the rdata is performed. C 4.4 Truncation handling. (as rfc2181 9) If inclusion of a RR set that is REQUIRED in either the answer or authority section leads to message truncation. The section is left empty and the truncation (TC) bit is set. If the DO bit is set RRSIG RRs are required in the answer and authority section. Inclusion of NS RRs in the authority section when QTYPE=DNSKEY is removed since NSD version 3.2.3. QTYPE=DS followed in version 3.2.7. This is to prevent resolvers from unnecessarily falling back to TCP. Only DNSKEY and DS records are considered, because it showed that especially these DNS packets are 'troublesome'. The feature 'minimize responses' is included since NSD 3.2.9. NS RRsets that would go into the Authority section in positive responses are not considered REQUIRED and therefore will NOT lead to setting of the TC bit. The minimal response size is: - 512 in case of no EDNS; - 1480 in case of EDNS/IPv4; - 1220 in case of EDNS/IPv6; - the advertized buffer size if that value is smaller than the the EDNS defaults. The feature can be disabled during build time with --disable-minimal-responses. If inclusion of an RRset in the Additional section is not possible RRs are omitted one by one. This may lead to incomplete RRsets. Omission of RRs from the Additional section because of message size constraints will NOT lead to setting of the TC bit. (rfc2181 9) We allow for incomplete RRsets in the additional section. C 4.5 NSEC processing. The NSEC record is required to be in the authority section if a QNAME or a QTYPE cannot be matched (see section 5 or RFC2535). If the DO bit on the query is not set then NSEC records should only be required if QNAME and QTYPE match. If the do bit on the query is set then we have to do NSEC processing if a zone is marked as secure otherwise we should do nothing. If the QNAME matches a name in the zone but the QTYPE does not match then the answer section should remain empty and the Authority section should have either the NSEC RR that matches QNAME or the NSEC RR (opt-in) that indicates QNAME is in an insecure part of the zone. C 4.6 Timeout management. NSD manages timeouts on the SOAs for secondary zones according to RFC. Timeouts are randomized, to avoid network bursts. The randomization used is 90-100% of the original value - meaning that it can never be delayed. This means zones cannot expire later than they should. It does mean the average timeout becomes 95% of the original. The random number calculation is primitive but fast. It is about spreading load not about randomness per se (in the crypto sense). ------------------------------------------------------------------------------- Appendix A IANA list of RR records RR records details. "A" 1, # RFC 1035, Section 3.4.1 No additional processing "NS" 2, # RFC 1035, Section 3.3.11 Additional A type processing. dname compression in RDATA "MD" 3, # RFC 1035, Section 3.3.4 (obsolete) "MF" 4, # RFC 1035, Section 3.3.5 (obsolete) "CNAME" 5, # RFC 1035, Section 3.3.1 No additional section processing. dname compression in RDATA "SOA" 6, # RFC 1035, Section 3.3.13 No additional section processing. SOA TTL semantics updated by rfc2308 dname compression in RDATA "MB" 7, # RFC 1035, Section 3.3.3 Additional processing type A of MADNAME "MG" 8, # RFC 1035, Section 3.3.6 No additional section processing. "MR" 9, # RFC 1035, Section 3.3.8 No additional section processing. "NULL" 10, # RFC 1035, Section 3.3.10 NOT IMPLEMENTED Not allowed in master files. (Not implemented in BIND) "WKS" 11, # RFC 1035, Section 3.4.2 (deprecated in favor of MX [RFC-1123] but not Obsolete) "PTR" 12, # RFC 1035, Section 3.3.12 No additional section processing. dname compression in RDATA "HINFO" 13, # RFC 1035, Section 3.3.2 No additional section processing. "MINFO" 14, # RFC 1035, Section 3.3.7 No additional section processing. "MX" 15, # RFC 1035, Section 3.3.9 Additional section processing type A of host in Exchange "TXT" 16, # RFC 1035, Section 3.3.14 No additional section processing. "RP" 17, # RFC 1183, Section 2.2 No additional section processing. "AFSDB" 18, # RFC 1183, Section 1 type A additional section processing for dname compression for hostname "X25" 19, # RFC 1183, Section 3.1 No additional section processing. "ISDN" 20, # RFC 1183, Section 3.2 No additional section processing. "RT" 21, # RFC 1183, Section 3.3 type X25, ISDN, and A additional section processing for . dname compression for intermediate-host. "NSAP" 22, # RFC 1706, Section 5 No additional section processing. NSAP requires special parsing rules. "NSAP_PTR" 23, # RFC 1348 (obsolete) "SIG" 24, # RFC 2535, Section 4.1.7: signers name field MAY be compressed. 4.1.8.1: SIG(0) specification. See section 4.2 for additional section processing. SIG signers name field MAY be compressed. (2535 4.1.7) "KEY" 25, # RFC 2535, Section See section RFC 2535 3.5 on inclusion of keys. "PX" 26, # RFC 2163, section 4 says: PX records cause no additional section processing All normal DNS conventions, like default values, wildcards, abbreviations and message compression, apply also for all the components of the PX RR. Compression is not explicitly mentioned: This label is CLASS specific: NO compression. "GPOS" 27, # RFC 1712 (obsolete) "AAAA" 28, # RFC 1886, Section 2.1 "LOC" 29, # RFC 1876 No requirements on additional section processing. "NXT" 30, # RFC 2535 No requirements on additional section processing. NXT dname field MAY be compressed. (2535 4.2) "EID" 31, # draft-ietf-nimrod-dns-xx.txt e.g. http://ana-3.lcs.mit.edu/~jnc/nimrod/dns.txt "NIMLOC" 32, # draft-ietf-nimrod-dns-xx.txt e.g. http://ana-3.lcs.mit.edu/~jnc/nimrod/dns.txt "SRV" 33, # RFC 2782 No dname compression of target field. (rfc2782 page 4) "ATMA" 34, # [Dobrowski] "NAPTR" 35, # RFC 2168, 2915 Contains regular expressions. Take care of escaping backslashes while parsing (rfc2915 p6): 'Replacement' field: no compression "KX" 36, # RFC 2230 KX records MUST cause type A additional section processing for the host specified by EXCHANGER. In the event that the host processing the DNS transaction supports IPv6, KX records MUST also cause type AAAA additional section processing. The KX RDATA field MUST NOT be compressed. (rfc2230 section 3) "CERT" 37, # RFC 2538 No dnames in rdata "A6" 38, # RFC 2874 No dnames in rdata "DNAME" 39, # RFC 2672 NO dname compression of target field. (rfc2672 sect 3) "SINK" 40, # [Eastlake] "OPT" 41, # RFC 2671 Pseudo RR. Not in zone files. "APL" 42 # RFC 3123 An APL RR with empty RDATA is valid and implements an empty list. "DS" 43, # RFC 4033, 4034, 4035. Included with referrals. "SSHFP" 44, # SSH Key Fingerprint, RFC 4255 "IPSECKEY" 45, # RFC 4025 Public key RSA/DSA for use in IPSEC. "RRSIG" 46, # RFC 4033, 4034, 4035. RFC 3755. Signature, uncompressed dnames. "NSEC" 47, # RFC 4033, 4034, 4035. RFC 3755. Signed next ownername, to disprove rrset types and domain name existance. Uncompressed dnames. "DNSKEY" 48, # RFC 4033, 4034, 4035. RFC 3755. Key for zone signing or key signing. Public key part. "DHCID" 49, # draft-ietf-dnsext-dhcid-rr-13.txt "NSEC3" 50, # RFC 5155. "NSEC3PARAM" 51, # RFC 5155. "TLSA" 52, # RFC 6698. Unknown 53 - 98, "SPF" 99, # RFC 4408 (Experimental). "UINFO" 100, # [IANA-Reserved] "UID" 101, # [IANA-Reserved] "GID" 102, # [IANA-Reserved] "UNSPEC" 103, # [IANA-Reserved] "NID" 104, # RFC 6742 "L32" 105, # RFC 6742 "L64" 106, # RFC 6742 "LP" 107, # RFC 6742 "EUI48" 108, # [draft-jabley-dnsext-eui48-eui64-rrtypes] "EUI64" 109, # [draft-jabley-dnsext-eui48-eui64-rrtypes] "TKEY" 249, # RFC 2930 "TSIG" 250, # RFC 2845 "IXFR" 251, # RFC 1995 "AXFR" 252, # RFC 1035 "MAILB" 253, # RFC 1035 (MB, MG, MR) "MAILA" 254, # RFC 1035 (obsolete - see MX) "ANY" 255, # RFC 1035 ______________________________________________________________________ Appendix B Details on specific design and implementation choices. B.1. Returning the root delegation when no answer can be found From RFC1034/1035 it is not obvious if returning a root delegation is a (non-)requirement for authoritative servers. We have decided not to implement a root-hints since an authoritative server should in normal circumstances only receive queries for which the server is authoritative. Also see RFC 1123 section 6.1.2.5. Whenever an answer cannot been provided we return a SERVFAIL. It has been argued that this is a policy decision and thus a REFUSE should be returned. However, in the spirit of RFC1034/1035 a server should return cached data, if that cache cannot be reached a SERVFAIL is an appropriate response. Also see the discussion on the 'namedroppers list' Starting April 2002 with subject "name server without root cache " (ftp://ops.ietf.org/pub/lists/) ______________________________________________________________________ Appendix C (Planned) Features NSD Version 1.0.0. and above The first release ( 1.0.0 ) contains an implementation of the standard RFC 1034 and RFC 1035, of proposed standards RFC2181 (clarifications), RFC2308 (negative caching). AXFR is not implemented in v1.0.0. The RRs specified in the following RFCs are implemented in v1.0.0 - RFC 1183 (Multiple RRs) - RFC 1706 (NSAP) (Informational) - RFC 1876 (LOC RR) - RFC 1886 (AAAA RR) - RFC 2230 (KX RR) (Informational) - RFC 2536 (CERT RR) - RFC 2671 (EDNS0) - RFC 2782 (SRV) - RFC 2915 (NAPTR RR) - RFC 2915 (SRV RR) - Version 1.0.1 will also support features from draft-ietf-dnsop-serverid-00.txt: The following names have associated TXT RRs in the CHAOS class: ID.SERVER. and VERSION.SERVER. - RFC2535 (DNSSEC) will be implemented in (1.1.0) once the current drafts DS and OPT-IN have made it to the standards track. (DNSSEC also includes RFC2536 (DSA), RFC2537 (RSA), RFC3225 (DO bit) Version 1.1.0 will not allow wildcards in DNSEC signed zones. NSD Version 2.0. and above - AXFR will be implemented in 1.0.1 with simple IP based ACLs. In 1.1.0. AXFR will also supported with RFC 2845 (TSIG) Using external tool nsd-xfer, that supports TSIG to download a zone from a server. - DNSSEC supported RRSIG/NSEC/DNSKEY, RFC 4033, 4034, 4035. - wildcards allowed in dnssec secured zones. - RFC 2673 (Binary labels) - RFC 2874 (A6) NSD Version 3.0. and above AXFR: - NSD serves AXFR, with TSIG if needed. - NSD requests AXFR from xfrd. This is noncompliant with RFC. It does not ask for the SOA serial number using a query beforehand (nsd-xfer does). It terminates the AXFR after the first packet if it determines the AXFR is not needed. RFC 1995 (IXFR) support only for making requests to other servers. - IXFR is not served. RFC 1996 (NOTIFY): - will ignore extraneous data in notify (instead of checking if they differ from content in zone). Only checks SOA serial. This is too hard, since other information is not available in xfrd, the process that handles the notify. - Will not send notify to NS-servers of a zone. Only notify sent to 'notify:' entries in config file. - Incoming has an ip-based and key-based access control list. - can be with TSIG. RFC 2845 (TSIG): - TSIG is supported for notify, axfr, ixfr, regular queries. RFC 2672 (DNAME) support. Secondary zones: - follows SOA timers. (NSD 2 and before did not) (RFC 1034, 1035). RFC 4509 (SHA-256 DS) support. RFC 4635 (HMAC SHA TSIG) support for mandatory algorithms: hmac-md5, hmac-sha1, hmac-sha256. RFC 5001 (NSID) support. RFC 5155 (NSEC3) support. RFC 5702 (SHA-2) support. RFC 5936 (AXFR) support. RFC 6605 (ECDSA) support. RFC 6698 (DANE) support for TLSA RR type. RFC 6742 (ILNP) support for NID, L32, L64, LP RR types. draft-jabley-dnsext-eui48-eui64-rrtypes support for EUI48, EUI64 RR types. Not implemented: RFC2136 (Dynamic update) are not implemented and will not be implemented as zone control is not implemented in NSD itself. Appendix D. Changes to this file. 10 april 2013 (Matthijs Mekking). - Updated file with EUI48 and EUI64 RRtype support. 20 march 2013 (Matthijs Mekking). - Removed requirements label compression for RP, RT and AFSDB. 19 november 2012 (Matthijs Mekking). - Updated file with RFC 6698 (DANE) support for TLSA RR type and RFC 6742 (ILNP) support for NID, L32, L64, LP RR types. 17 april 2012 (Matthijs Mekking). - Updated file with RFC 5936 (AXFR) and RFC 6605 (ECDSA) support. 17 october 2011 (Matthijs Mekking). - Updated file with RFC 5702 (SHA-2) and RFC 4509 (SHA-256 DS) support. - Added section on minimal responses. 24 february 2010 (Matthijs Mekking). - Updated file with RFC 5001 (NSID) and RFC 5155 (NSEC3) support (version 3.0.0 and above). 30 october 2008 (Matthijs Mekking). - Added support for RFC 4635 (HMAC SHA TSIG). 26 july 2006 (Wouter Wijngaards). - Comments changed to background items. - KEY->DNSKEY, SIG->RRSIG in the text, dnssec-bis style. ______________________________________________________________________ $Id: REQUIREMENTS 4015 2013-07-09 12:27:22Z matje $ nsd-3.2.16/doc/CREDITS0000664000175000017500000000462012167000652013141 0ustar matjematjeThe NSD was primarily developed by NLnet Labs on request from and close cooperation with RIPE NCC, as an alternative name server software to be run on the root name server RIPE NCC operates. Below is the NSD team (nsd-team@nlnetlabs.nl) in alphabetical order: Alexis Yushin, NLnet Labs - design and implementation for NSD 1.0.x and 1.1.x. Erik Rozendaal, NLnet Labs - design and implementation for NSD 1.2.x and later. Daniel Karrenberg, RIPE NCC - design, major testing and bug reports Jaap Akkerhuis, SIDN NL - consultancy, advice and company :) Jelte Jansen, NLnet Labs - testing, patches, advice, NSD 3 Matthijs Mekking, NLnet Labs - testing, patches, maintenance, NSD 3 Miek Gieben, NLnet Labs - testing, patches, zone compiler, NSD 2 Olaf Kolkman, RIPE NCC - protocol purist, design, perl test implementation Ronald van der Pol, NLnet Labs - code review, MacOS X portability, IPv6. Ted Lindgreen, NLnet Labs - design, code review, testing Wouter Wijngaards, NLnet Labs - design and implementation for NSD 3. Contributors (in alphabetical order): Aaron Glenn - DragonflyBSD, BSD/sparc64 testing. Ben Laurie - NSEC3 patch. Bin Zhang - NSD 3 prerelease testing. Colm MacCárthaigh, - IPv6 binding and cleanups. Farkas Levente - rpm specfile improvements. Gary O'Brien - NSEC3 prehashing patch. Jakob Schlyter, Kirei - chroot and several other patches Jun-ichiro itojun Hagino, IIJLab - IPv6 transport Kai - NSD 3 prerelease testing. Mans Nilsson - (Solaris) Testing Markus Heimhilcher - .AT zones for testing Martin Svec - Optimalization patches. Matthew Smith - NetBSD testing. Ondrej Sury - nsd-notify.8 man page Paul Wouters - zone compiler testing Peter Hessler - OpenBSD, amd64 testing. Stephane Bortzmeyer - Tru64 portability. Config conversion. nsd-3.2.16/doc/README0000664000175000017500000006531612173226547013024 0ustar matjematje1.0 Introduction 1.1 ... Basic theory of operation 1.2 ... Quick build & install 2.0 Building nsd 2.1 ... Unpacking the source 2.2 ... Configuring NSD 2.3 ... Building 2.4 ... Installing 3.0 Running NSD 3.1 ... Logging 3.2 ... AXFR access 3.3 ... Using TSIG 3.4 ... Zone expiry of secondary zones 3.5 ... Diagnosing NSD log entries 3.6 ... Interfaces 4.0 Support and Feedback 4.1 ... Your Support 1.0 Introduction This is NSD Name Server Daemon (NSD) version 3.2.16. The NLnet Labs Name Server Daemon (NSD) is an authoritative RFC compliant DNS nameserver. It was first conceived to allow for more genetic diversity for DNS server implementations used by the root-server system and it has been developed for operations in environments where speed, reliability, stability, and security are of high importance. NSD is currently used on root servers such as k.root-servers.net and is also in use by several top-level domain registries. NSD is a complete implementation of an authoritative DNS name server. For further information about what NSD is and what NSD is not please consult the REQUIREMENTS document which is a part of this distribution. If you are a BIND user (the named daemon) consult NSD_FOR_BIND_USERS. The source code is available for download from: http://www.nlnetlabs.nl/downloads 1.1 Basic Theory of Operation NSD consists of two programs: the zone compiler 'zonec' and the name server 'nsd' itself. The name server works with an intermediate database prepared by the zone compiler from standard zone files. For NSD operation this means that zones have to be compiled by zonec before NSD can use them. All this can be controlled by a simple control script called 'nsdc' and uses a simple configuration file 'nsd.conf'. 1.2 Quick build and install Step 1: Unpack the source with gtar -xzvf nsd-3.2.16.tar.gz Step 2: Create user nsd or any other unprivileged user of your choice. In case of later make sure to use --with-user= while running configure. You can also set "username: " in the nsd.conf file later. Step 3: ./configure Step 4: make all (or simply 'make'). Step 5: make install Step 6: Create and edit /etc/nsd/nsd.conf file possibly from nsd.conf.sample template that comes with the distribution. (installed by default at /etc/nsd/nsd.conf.sample) Here you need to configure the zones you want to serve. TSIG keys used for secure zone transfers must be included. Also server parameters can be set, see nsd.conf(5) man page. If you have a NSD 2 nsd.zones config file take a look at the python script contrib/nsd.zones2nsd.conf, it will convert zone and TSIG key settings for you. Step 7: Copy necessary master zone files into appropriate directories under /etc/nsd/primary & /etc/nsd/secondary. Step 8: Run nsdc rebuild Step 9: Run nsdc start Step 10: Test the NSD with dig, drill or host. Step 11: If you're happy add nsdc start into your OS boot up sequence. nsdc stop can be used in the shutdown sequence. Step 12: If desired add nsdc patch to your superuser crontab to update the zone files with the content transferred from master servers periodically, such as once per day. Got any problems or questions with the steps above? Read the rest of this file. 2.0 Building NSD 2.1 Unpacking the source Use your favorite combination of tar and gnu zip to unpack the source, for example $ gtar -xzvf nsd-3.2.16.tar.gz will unpack the source into the ./nsd-3.2.16 directory... 2.2 Configuring NSD NSD can be configured using GNU autoconf's configure script. In addition to standard configure options, one may use the following: CC=compiler Specify the C compiler. The default is gcc or cc. The compiler must support ANSI C89. CPPFLAGS=flags Specify the C preprocessor flags. Such as -I. CFLAGS=flags Specify the C compiler flags. These include code generation, optimization, warning, and debugging flags. These flags are also passed to the linker. The default for gcc is "-g -O2". LD=linker Specify the linker (defaults to the C compiler). LDFLAGS=flags Specify linker flags. LIBS=libs Specify additional libraries to link with. --enable-root-server Configure NSD as a root server. Unless this option is specified, NSD will refuse to serve the ``.'' zone as a misconfiguration safeguard. --disable-ipv6 Disables IPv6 support in NSD. --enable-checking Enable some internal development checks. Useful if you want to modify NSD. This option enables the standard C "assert" macro and compiler warnings. This will instruct NSD to be stricter when validating its input. This could lead to a reduced service level. --enable-bind8-stats Enables BIND8-like statistics. --enable-zone-stats Enables per zone statistics (if BIND8 stats is enabled). This does not scale and should not be used if serving many zones. This option could lead to a reduced service level and increased memory footprint. --enable-ratelimit Enables ratelimiting, based on query name, type and source. --enable-draft-rrtypes Enables draft RRtypes. --with-configdir=dir Specified, NSD configuration directory, default /etc/nsd --with-nsd_conf_file=path Pathname to the NSD configuration file, default /etc/nsd/nsd.conf --with-pidfile=path Pathname to the NSD pidfile, default is platform specific, mostly /var/run/nsd.pid --with-dbfile=path Pathname to the NSD database, default is /etc/nsd/nsd.db --with-zonesdir=dir NSD default location for master zone files, default /etc/nsd/ --with-user=username User name or ID to answer the queries with, default is nsd --with-facility=facility Specify the syslog facility to use. The default is LOG_DAEMON. See the syslog(3) manual page for the available facilities. --with-ssl=path Specify the location of the OpenSSL libraries. OpenSSL 0.9.7 or higher is required for TSIG support. --with-start_priority=number Startup priority for NSD. --with-kill_priority=number Shutdown priority for NSD. --with-tcp-timeout=number Set the default TCP timeout (in seconds). Default 120 seconds. --disable-nsec3 Disable NSEC3 support. With NSEC3 support enabled, very large zones, also non-nsec3 zones, use about 20% more memory. --disable-minimal-responses Disable minimal responses. If disabled, responses are more likely to get truncated, resulting in TCP fallback. --disable-largefile Disable large file support (64 bit file lengths). Makes off_t a 32bit length during compilation. --disable-full-prehash Disables full NSEC3 prehashing. This will make NSD handle zone transfers faster, but will decrease the performance of NXDOMAIN and wildcard NODATA responses by 15% (with NSEC3). 2.3 Building Use ``make'' to create NSD and support tools. If you get errors, try to use ``gmake'' (gnu version of make), especially on old systems. If so, do a `gmake realclean` first, to remove stuff that the make call messed up. 2.4 Installing Become a superuser (if necessary) and type ``make install'' This step should install seven binaries nsd - the daemon itself nsdc - a shell script to control the daemon zonec - zone compiler nsd-notify - a simple C program to send outbound notifies nsd-xfer - a program to receive zones from a master server using AXFR from the command line. nsd-checkconf - simple C program to check nsd.conf before use. nsd-patch - simple program that cleans IXFR changes back to zone files. Plus the manual pages and a sample configuration file. 3.0 Running NSD Before running NSD you need to create a configuration file for it. The config file contains server settings, secret keys and zone settings. The server settings start with a line with the keyword 'server:'. In the server settings set 'database: ' with the filename of the name database that NSD will use. Set 'chroot:

' to run nsd in a chroot-jail. Make sure the zone files, database file, xfrdfile, difffile and pidfile can be accessed from the chroot-jail. Set 'username: ' to an unprivileged user, for security. For example: # This is a sample configuration server: database: "/etc/nsd/nsd.db" pidfile: "/etc/nsd/nsd.pid" chroot: "/etc/nsd/" username: nsd After the global server settings to need to make entries for the zones that you wish to serve. For each zone you need to list the zone name, the file name with the zone contents, and access control lists. zone: name: "example.com" zonefile: "example.com.zone" The zonefile needs to be filled with the correct zone information for master zones. For secondary zones an empty file will suffice, a zone transfer will be initiated to obtain the slave zone contents. Access control lists are needed for zone transfer and notifications. For a slave zone list the masters, by IP address. Below is an example of a slave zone with two master servers. If a master only supports AXFR transfers and not IXFR transfers (like NSD), specify the master as "request-xfr: AXFR ". By default, all zone transfer requests are made over TCP. If you want the IXFR request be transmitted over UDP, use "request-xfr: UDP ". zone: name: "example.com" zonefile: "example.com.zone" allow-notify: 168.192.185.33 NOKEY request-xfr: 168.192.185.33 NOKEY allow-notify: 168.192.199.2 NOKEY request-xfr: 168.192.199.2 NOKEY By default, a slave will fallback to AXFR requests if the master told us it does not support IXFR. You can configure the slave not to do AXFR fallback with: allow-axfr-fallback: "no" For a master zone, list the slave servers, by IP address or subnet. Below is an example of a master zone with two slave servers. zone: name: "example.com" zonefile: "example.com.zone" notify: 168.192.133.75 NOKEY provide-xfr: 168.192.133.75 NOKEY notify: 168.192.5.44 NOKEY provide-xfr: 168.192.5.44 NOKEY You also can set the outgoing interface for notifies and zone transfer requests to satisfy access control lists at the other end: outgoing-interface: 168.192.5.69 By default, NSD will retry a notify up to 5 times. You can override that value with: notify-retry: 5 Zone transfers can be secured with TSIG keys, replace NOKEY with the name of the tsig key to use. See section 3.3. Since NSD is written to be run on the root name servers, the config file can to contain something like: zone: name: "." zonefile: "root.zone" provide-xfr: 0.0.0.0/0 NOKEY # allow axfr for everyone. provide-xfr: ::0/0 NOKEY You should only do that if you're intending to run a root server, NSD is not suited for running a . cache. Therefore if you choose to serve the . zone you have to make sure that the complete root zone is timely and fully updated. To prevent misconfiguration, NSD configure has the --enable-root-server switch, that is by default disabled. When you are done with the configuration file, check the syntax using nsd-checkconf To build the name database, use nsdc. Use -c configfile if your config file is not in the default location. nsdc rebuild This starts zonec on your zone files. If zonec reports no errors, your database is now ready for the daemon which can be started with nsdc start To check if the daemon is running use nsdc running To reload a new database after you recompiled it with 'nsdc rebuild' without stopping the daemon issue nsdc reload To restart the daemon (should never be necessary, unless you do some development work) nsdc restart To shut it down (for example on the system shutdown) do nsdc stop NSD will automatically keep track of secondary zones and update them when needed. When primary zones are updated and reloaded notifications are sent to slave servers. NSD keeps a journal file with the contents of the zone transfers (difffile: "ixfr.db" setting in the configuration file). This file will slowly grow as zone transfers are done. To clean up the journal file issue a patch command nsdc patch This will see if a transfer journal exists, and if so, move it away, proceed with writing new contents to the zone files (listed as zonefile: for the zones). If any zone files have been changed (including master zones) the nsd database is rebuild with the updates zone contents and NSD is issued a reload command. The patch process will break a zone transfer in progress, which will be reattempted later. The patch process does this to avoid certain race conditions, which could otherwise happen. NSD will send notifications to slave zones if a master zone is updated. NSD will check for updates at master servers periodically and transfer the updated zone by AXFR/IXFR and reload the new zone contents. If you wish exert manual control use the nsdc update and nsdc notify commands. The update command will check for new versions of all secondary zones hosted by this NSD. The notify command will send notifications to all slave servers in 'notify:' statements. the follow cron(8) command will take care of synchronizing the database with zone updates received: # nsd to patch every day 5 5 * * * /usr/local/sbin/nsdc patch 3.1 Logging NSD doesn't do any logging. We believe that logging is a separate task and has to be done independently from the core operation. This consciously is not part of nsd itself in order to keep nsd focused and minimize its complexity. It is better to leave logging and tracing to separate dedicated tools. dnsstat can also easily be configured and/or modified to suit local statistics requirements without any danger of affecting the name server itself. We have run dnsstat on the same machine as nsd, we would recommend using a multiprocessor if performance is an issue. Of course it can also run on a separate machine that has MAC layer access to the network of the server. The CAIDA dnsstat tool referenced is recommended to nsd operators as a means of keeping statistics and check on abnormal query loads. http://www.caida.org/tools/utilities/dnsstat/dnsstat-3.5.1a.tar.gz Another tool is the dnstop, that displays DNS statistics on your network. http://dns.measurement-factory.com/tools/dnstop/src/dnstop-20060517.tar.gz A sample invocation of dnsstat: /usr/local/Coral/bin/crl_dnsstat -D -Ci=60 -Cd=240 -C'filter dst 10.1.1.3' -h -u if:fxp1 A sample output of a slightly modified version: # dnsstat output version: 0.2 "dfk" # begin trace interval at 1025267664.859043, duration 15.000000 # DNS messages: 74973 (4998.200000/s); DNS queries: 151983 (10132.200000/s) # print threshold: 30 messages/sec #src op type class queries msgs rd notes 208.18.162.10 - - - 533 533 0 " 0 MX IN 6 " 0 A IN 264 " 0 ANY IN 263 209.11.18.248 - - - 661 661 0 " 0 A IN 655 " 0 MX IN 6 210.117.65.137 - - - 745 745 0 " 0 A IN 745 216.54.221.131 - - - 477 477 0 " 0 A IN 477 193.97.205.80 - - - 681 681 0 " 0 A IN 3 " 0 ANY IN 678 168.30.240.11 - - - 685 685 0 " 0 A IN 405 " 0 MX IN 280 210.94.6.67 - - - 742 742 0 " 0 A IN 742 63.66.68.237 - - - 1375 1375 0 " 0 A IN 1375 168.30.240.12 - - - 493 493 0 " 0 A IN 493 139.142.205.225 - - - 5579 5579 0 " 0 A IN 3006 " 0 MX IN 2573 210.117.65.2 - - - 700 700 0 " 0 A IN 700 # end trace interval 3.2 AXFR access The access list for AXFR should be set with provide-xfr: in the nsd config file. This is per zone. See nsd.conf(5). For example to grant zone 'example.com' AXFR right to localhost for IPv4 and IPv6, use the below config options. zone: name: "example.com" provide-xfr: 127.0.0.1 NOKEY provide-xfr: ::1 NOKEY You can use dig @localhost example.com axfr to test this. 3.3 Using TSIG NSD supports TSIG for any query to the server, for zone transfer and for notify sending and receiving. TSIG keys are based on shared secrets. These must be configured in the config file. To keep the secret in a separate file use include: "filename" to include that file. An example tsig key named sec1_key. key: name: "sec1_key" algorithm: hmac-md5 secret: "6KM6qiKfwfEpamEq72HQdA==" This key can then be used for any query to the NSD server. NSD will check if the signature is valid, and if so, return a signed answer. Unsigned queries will be given unsigned replies. The key can be used to restrict the access control lists, for example to only allow zone transfer with the key, by listing the key name on the access control line. # provides AXFR to the subnet when TSIG is used. provide-xfr: 10.11.12.0/24 sec1_key # allow only notifications that are signed allow-notify: 192.168.0.0/16 sec1_key If the TSIG key name is used in notify or request-xfr lines, the key is used to sign the request/notification messages. nsd-notify uses the -y keyname:secret format that dig uses too. For example nsd-notify -y sec1_key:6KM6qiKfwfEpamEq72HQdA== -z example.com 127.0.0.1 If you want to perform manual zone transfers you can use nsd-xfer. nsd-xfer(8) uses the same cryptic file format as named-xfer(8) (to be backward compatible). This is a so called tsig-info file. Lets say we have the following: zone: nlnetlabs.nl server: 213.53.69.1 key-name: nlnetlabs-axfr algorithm: hmac-md5 secret: Y87923jksdXlsdv+LeXpUA== Then we need to create file nlnetlabs.nl.tsiginfo containing: 213.53.69.1 nlnetlabs-axfr 157 Y87923jksdXlsdv+LeXpUA== Cryptic? Yes. The first line tells this key is to be used for 213.53.69.1 Second one is the name of the key. 157 stands for hmac-md5 algorithm and the last line is the secret. Here's a list of algorithms with their corresponding algorithm numbers. hmac-md5: 157 hmac-sha1: 158 hmac-sha256: 159 3.4 Zone expiry of secondary zones NSD will keep track of the status of secondary zones, according to the timing values in the SOA record for the zone. When the refresh time of a zone is reached, the serial number is checked and a zone transfer is started if the zone has changed. Each master server is tried in turn. Master zones cannot expire. They are always served. Zones are master zones if they have no 'request-xfr:' statements in the config file. After the expire timeout (from the SOA record at the zone apex) is reached, the zone becomes expired. NSD will return SERVFAIL for expired zones, and will attempt to perform a zone transfer from any of the masters. After a zone transfer succeeds, or if the master indicates that the SOA serial number is still the same, the zone will be OK again. In contrast with e.g. BIND, the inception time for a slave zone is stored on disk (in the xfrdfile: "xfrd.state"), together with timeouts. If a slave zone acquisition time is recent enough, this means that NSD can start serving a zone immediately on loading, without querying the master server. If your slave zone has expired, and no masters can be reached, but you still want NSD to serve the zone. (i.e. ''My network is in shambles, but serve the zone dangit!''). You can delete the file 'xfrd.state', but leave the zonefile for the zone intact. Make sure to stop nsd before you delete the file, as NSD writes it on exit. Upon loading NSD will treat the zonefile that you as operator have provided as recent and will serve the zone. Even though NSD will start to serve the zone immediately, the zone will expire after the timeout is reached again. NSD will also attempt to confirm that you have provided the correct data by polling the masters. So when the master servers come back up, it will transfer the updated zone within seconds. In general it is possible to provide zone files for both master and slave zones manually (say from email or rsync). Use nsdc rebuild to put the new zonefile contents into the name database. Upon the next reload or start, your zone will be served. For master zones, NSD will issue notifications to all configured 'notify:' targets. For slave zones the above happens; NSD attempts to validate the zone from the master. 3.5 Diagnosing NSD log entries NSD will print log messages to the system log (or 'logfile:' configuration entry). Some of these messages are discussed below. These messages can get extra support if errors happen. - "Reload process failed with status , continuing with old database" This log message indicates the reload process of NSD has failed for some reason. The reason can be anything from a missing database file to internal errors. If this happens often, please let us know, this error message can be caught in the code, and appropriate action could be taken. We are as of yet not sure what action is appropriate, if any. - "snipping off trailing partial part of " Please let us know if, and how often, this happens. What happens is the file ixfr.db contains only part of expected data. The corruption is removed by snipping off the trailing part. - "memory recyclebin holds bytes" This is printed for every reload. NSD allocates and deallocates memory to service IXFR updates. The recyclebin holds deallocated memory ready for future use. If the number grows too large, nsdc patch will reset it. - "xfrd: max number of tcp connections (10) reached." This line is printed when more than 10 zones need a zone transfer at the same time. The value is a compile constant (xfrd-tcp.h), but if this happens often for you, we could make this a config option. If this happens, more zones have to wait until a zone transfer completes (or is aborted) before they can have a zone transfer too. - "error: NSEC3PARAM entry has unknown hash algo " This error means that the zone has NSEC3 chain(s) with hash algorithms that are not supported by this version of NSD, and thus cannot be served by NSD. If there are also no NSECs or NSEC3 chain(s) with known hash algorithms, NSD will not be able to serve DNSSEC authenticated denials for the zone. 3.6 Interfaces NSD will by default bind itself to the system default interface and service ip4 and if available also ip6. It is possible to service only ip4 or ip6 using the -4, -6 commandline options, or the ip4-only and ip6-only config file options. The commandline option -a and config file option ip-address can be given to bind to specific interfaces. Multiple interfaces can be specified. This is useful for two reasons: o The specific interface bound will result in the OS bypassing routing tables for the interface selection. This results in a small performance gain. It is not the performance gain that is the problem, sometimes the routing tables can give the wrong answer, see the next point. o The answer will be routed via the interface the query came from. This makes sure that the return address on the DNS replies is the same as the query was sent to. Many resolvers require the source address of the replies to be correct. The ip-address: option is easier than configuring the OS routing table to return the DNS replies via the correct interface. The above means that even for systems with multiple interfaces where you intend to provide DNS service to all interfaces, it is prudent to specify all the interfaces as ip-address config file options. With the config file option ip-transparent you can allow NSD to bind to non local addresses. 4.0 Support and Feedback NLnet Labs is committed to support NSD and its other software products on a best effort basis, free of charge. This form of community support is offered through a mailing lists and the 'bugzilla' web interface. http://www.nlnetlabs.nl/bugs/ If for any reason NLnet Labs would stop community support of NSD such would be announced on our web pages at least two years in advance. The community mailing list nsd-users@nlnetlabs.nl can be used to discuss issues with other users of NSD. Subscribe here http://open.nlnetlabs.nl/mailman/listinfo/nsd-users NLnet Labs recognizes that in some corporate environments this commitment to community support is not sufficient and that support needs to be codified. We therefore offer paid support contracts that come in 3 varieties. More information about these support varieties can be found at Alternatively you can contact mailto:nsd-support@nlnetlabs.nl . Support goes two ways. By acquiring one of the support contracts you also support NLnet Labs to continue to participate in the development of the Internet architecture. We do this through our participation in the (IETF) standards process and by developing and maintaining reference implementations of standards and tools to support operation and deployment of new and existing Internet technology. We are interested in our users and in the environment you use NSD. Please drop us a mail when you use NSD. Indicate in what kind of operation you deploy NSD and let us know what your positive and negative experiences are. http://www.nlnetlabs.nl/nsd and mailto:nsd-info@nlnetlabs.nl 4.1 Your Support NLnet Labs offers all of its software products as open source, most are published under a BDS license. You can download them, not only from the NLnet Labs website but also through the various OS distributions for which NSD, ldns, and Unbound are packaged. We therefore have little idea who uses our software in production environments and have no direct ties with 'our customers'. Therefore, we ask you to contact us at users@NLnetLabs.nl and tell us whether you use one of our products in your production environment, what that environment looks like, and maybe even share some praise. We would like to refer to the fact that your organization is using our products. We will only do that if you explicitly allow us. In all other cases we will keep the information you share with us to ourselves. In addition to the moral support you can also support us financially. NLnet Labs is a recognized not-for-profit charity foundation that is chartered to develop open-source software and open-standards for the Internet. If you use our software to satisfaction please express that by giving us a donation. For small donations PayPal can be used. For larger and regular donations please contact us at users@NLnetLabs.nl. Also see http://www.nlnetlabs.nl/labs/contributors/. $Id: README 3971 2013-06-25 11:26:26Z matje $ nsd-3.2.16/doc/README.icc0000664000175000017500000000144610443534063013544 0ustar matjematjeCompiling with the Intel C Compiler (ICC) version 7.0. Configure NSD to use ICC. $ CC=icc ./configure [configure-options] Then everything should compile (just ignore the warnings), except on RedHat 8.0. This is due to a bug in the GNU C library used. This bug may apply to other Linux distributions or systems using the GNU C library. To compile NSD with the ICC compiler on RedHat 8.0 you need to patch the file /usr/include/bits/byteswap.h. The following patch should work: --- byteswap.h.orig 2003-02-26 13:59:41.000000000 +0100 +++ byteswap.h 2003-02-26 13:59:57.000000000 +0100 @@ -81,7 +81,7 @@ __v; })) # endif #else -# define __bswap_16(x) \ +# define __bswap_32(x) \ (__extension__ \ ({ register unsigned int __x = (x); __bswap_constant_32 (__x); })) #endif nsd-3.2.16/doc/NSD-DIFFFILE0000664000175000017500000000327311102334016013631 0ustar matjematjeDIFF support file format. This file contains changes to the main NSD-DATABASE file. The file contents is in network format. Diff file parts, each part has - 32 bits type field. - 64 bits timestamp field. - 32 bits length field. - length bytes of content. - 32 bits repeat of the length field. TYPE="IXFR" - zone name - 32 bit new serial number. - 16 bit ID number (the query ID from the query, could be different from the ID in this packet) - 32 bit sequence number of the packet (starting from 0). - remaining contents is IXFR packet contents, max 64K (the RRs). (or contents is AXFR, since IXFR spec allows for that) without a SURE part, it is probably sent with bad tsig. TYPE="SURE" contents is: a) reference to the IXFR packet that is OKed. - str: zone name, - 32 bit old serial number. (to check that db-serial is unchanged). or 0 if no serial available yet. - 32 bit new serial number, - 16 bit ID number (query_id) ( note that due to having one TCP per zone, and checking that the queryID on incoming packets, one transfer,commit for a zone; no interleaved IXFR packets for different commits. ) ( so the serial, ID are for checking only ) - 32 bit number of IXFR packets that are to be applied. - these IXFR packets must precede the SURE packet. b) uint8: commit=1(IXFR is OK) or rollback=0(ignore that IXFR). c) space for a text string message (preceded by 32bitcount), i.e. 'at time came from , tsig checked with key '. or rejected . Unknown types are an error. A part truncated by EOF must be ignored. A part that ends in a bad length field must be ignored. xfrd only appends the file or truncates trailing garbage. reload only reads the file. nsd-3.2.16/doc/ChangeLog0000664000175000017500000026520012166742755013716 0ustar matjematje9 July 2013: Matthijs - Code review Wouter, Yuri, Willem. 28 June 2013: Matthijs - Update tmp serial in xfr checking. - Fix warning in labellength 0 code. 27 June 2013: Matthijs - Bugfix #357: Parent process waits until children closed down sockets, to prevent nsd failing to bind to sockets when restarting. - zonec: Don't crash on domain names with label length 0. 26 June 2013: Matthijs - Fix bind8 stats test. - Force stats if mode is NSD_STATS. - Better xfr syntax checking in xfrd, fallback to axfr after three bad xfr packets. 25 June 2013: Matthijs - Rename --enable-eui-rrtypes to --enable-draft-rrtypes. 25 June 2013: Wouter - acx_nlnetlabs.m4 updated, --disable-flto option. 20 June 2013: Matthijs - Merge some things from trunk: * NSD does not print statistics to logfile if period is 0. * Bug #491: pick program name (0th argument) as syslog identity. * Add hash to rrl bucket. * Fix segfault if no logfile is used. * Fix memory leak in zone parser for txt record (since the large number of txt subsections fix). 17 June 2013: Matthijs - While reading xfr, make sure there are no multiple SOA records. 13 June 2013: Matthijs - Use IPV6 minimum MTU settings with TCP to reduce failures that are caused by delays in learning working PMTU when communicating through a tunnel. - Improved RRL logging: also print triggering query src addr and qtype (thanks Klaus Darilion). - Enable EUI48 and EUI64 with --enable-eui-rrtypes. - Zone directory should be relative to chroot (thanks Lukas Wunner). 6 May 2013: Matthijs - Add rrl-slip config option (thanks Stephane Bortzmeyer). - Add rrl-ipv{4,6}-prefix-length config option. 3 May 2013: Wouter - update acx_nlnetlabs.m4 to v23, w32 fixes with no impact on NSD3. 24 April 2013: Matthijs - New config option "ip-transparent:", to bind to non local addresses (thanks Arjen Zonneveld). 19 April 2013: Wouter - Own snprintf. Fix use of snprintf return value in debug print. 10 April 2013: Matthijs - Fix B64_NTOP/PTON replacement definitions in configure.ac. - Bug #496: Support for EUI48 and EUI64 RR types. 3 April 2013: Matthijs - Bug #494: Exit with return code 1 if socket code fails. - Bug #495: Wrong bufsize in dname_to_string for root domain. 26 March 2013: Wouter - updated lookup3 with endianness detection changes. 25 March 2013: Matthijs - RRtypes ASFDB, RP, RT should not compress dnames (thanks Peter van Dijk). 7 February 2013: Matthijs - detect endianness in lookup3 on BSD, patch from Brad Smith. 6 February 2013: Matthijs - Fix outgoing-interface: Don't fail if family is IPv6 but only IPv4 outgoing-interface is set, or vice versa. 4 February 2013: Matthijs - Bump to 3.2.16 29 January 2013: Matthijs - RRL documented in nsd.conf.sample 24 January 2013: Wouter - fix compile --disable-nsec3. 23 January 2013: Matthijs - Final code review thingies. - Tag 3.2.15 18 January 2013: Wouter - Fix spurious assertion in RRL for block. 16 January 2013: Matthijs - Code review Wouter - Only use config.h created in build dir. 3 January 2013: Matthijs - Bug #485: Fallback to DEFAULT_TTL if MSB is set. 2 January 2013: Matthijs - TSIG initialization only fails if no digests at all can be found. Makes nsd perform better in FIPS mode, where there is no MD5. 28 December 2012: Matthijs - Fix for --disable-full-prehash, where NSEC3s can be illegaly removed after IXFRs, possibly resulting in an assertion failure (reported by Kabindra Shrestha). - Bug #485: NSD transmits RRs with TTL exceeding the max value (2^31-1). 12 December 2012: Matthijs - Fix RCODE when CNAME loop final answer does not exist, should return NXDOMAIN as stated by RFC 6604 (reported by Peter van Dijk). 10 December 2012: Matthijs - Better ILNP RR parsing (thanks Stephane Bortzmeyer). 6 December 2012: Matthijs - Bug #483: Better error messages for TSIG errors. - RFC 2845: If BADKEY or BADSIG, RCODE should be NOTAUTH. Also, continue TSIG verication if NOTAUTH. 4 December 2012: Wouter - NSD-RRL documented in manpage. 3 December 2012: Matthijs - Fixup exit of server-child (merge from trunk). 28 November 2012: Wouter - RRL implements classification type RRSIG. 21 November 2012: Wouter - Implement rrl log of unblock for collision. 19 November 2012: Matthijs - Bump version to 3.2.15. - Implement RR types for ILNP, RFC6742. 19 November 2012: Wouter - Fix that nsd-checkconf works with printout of RRL values and thus nsdc works again. 9 November 2012: Wouter - Log when NSD-RRL stops a stream from being blocked. 8 November 2012: Willem - Fix AXFR. Loop through the zone to transfer only 2 November 2012: Wouter - Fix bug 478: declaration after statement (for gcc 2.95). 1 November 2012: Wouter - Fix default settings for rrl. 30 October 2012: Wouter - --enable-ratelimit enables RRL code (ported from NSD4). 18 October 2012: Matthijs - Bump version 11 October 2012: Wouter - Fix build on OpenBSD (Thanks Oliver Peter). 28 September 2012: Wouter - fixed --disable-full-prehash when new nsd.db is read in and there are already ixfrs to apply, it did not rehash the new nsd.db. 21 September 2012: Wouter - tzset before chroot for correct timezone (from Camiel Dobbelaar). 11 September 2012: Wouter - writev support for TCP. 27 Agust 2012: Yuri - Fix crash in zonec if TXT string too long. (thanks Ilya Bakulin) 21 August 2012: Matthijs - Fix hang on exit in xfrd. - Fix bug#464: Conditionally define MAXHOSTNAMELEN 9 August 2012: Matthijs - Code review (Thanks CZ.NIC) 26 July 2012: Yuri - Prioritize notify sender for requesting XFR. (thanks Ilya Bakulin) 25 July 2012: Matthijs - Bug #461: NSD denial of service vulnerability when using per zone statistics. 23 July 2012: Matthijs - Fix for nsd-patch segfault if zone has been removed from nsd.conf (thanks Ilya Bakulin) 19 July 2012: Willem - Fix for VU#624931 CVE-2012-2978: NSD denial of service vulnerability from non-standard DNS packet from any host on the internet. http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt 18 July 2012: Wouter - Fix bug#460: man page correction - identity. 19 June 2012: Matthijs - Fix restart failed after removing zone (that still lives in ixfr.db) 18 June 2012: Matthijs - Bug #453: typo in nsdc man page 1 June 2012: Matthijs - Per zone stats, enable with --enable-zone-stats. 31 May 2012: Matthijs - Fix for accept spinning reported by OpenBSD. 17 April 2012: Matthijs - Changes according to RFC 5936 (AXFR clarify) and EDNS0bis. 16 April 2012: Matthijs - Allow for fd 0 in ipc. - Add TLSA RRtype support. 4 April 2012: Matthijs - Add ECDSA support for zonec 2 April 2012: Matthijs - Undo #235 (so dname compression starts at QNAME again). 28 February 2012: Matthijs - Allow reading in new DNSKEY algorithm mnemonics in zonefile. Always write unsigned integer value of algorithm. 27 February 2012: Matthijs - Fix for qtype ANY for a wildcard domain in NSEC signed zone. 16 February 2012: Matthijs - Fallback to AXFR if IXFR is misinterpreted. 23 January 2012: Wouter - remove clang warning from region_log_stats(). 20 January 2012: Wouter - Fix bug #430: segfault when MAX_INTERFACES set to more than 65K. - Fix configure.ac strptime check for gcc 4.6.2, acx_nlnetlabs update. 18 January 2012: Matthijs - Fix bug #423: Fix up empty terminals after applying complete XFR, to make zone transfers go fast again 10 January 2012: Wouter - Remove unused variables. 6 January 2012: Matthijs - Fix bug #421: truncate pidfile on shutdown, instead of unlink. This way, the piddir does not have to fall under nsd ownership. 2 November 2011: Matthijs - Apply Secure64 patch (use --disable-full-prehash to activate it) 26 October 2011: Matthijs - Custom patch for bug #390 on NSEC3 wildcards. - Fix bug #397: an $INCLUDE directive with a relative origin. Don't allow. 17 October 2011: Matthijs - configuration option --disable-minimal-responses. - Minimize responses to reduce truncation, leave out optional NS RRsets from the authority section and all RRsets from additional section. 10 October 2011: Matthijs - Don't clear the AA bit if there is an authoritative CNAME in the answer section (as shown in RFC 1034, Section 6.2.7, 2nd example). 10 October 2011: Wouter - squelch EPIPE when writing AXFR, enable with verbosity 2. 26 September 2011: Matthijs - Copy the DO bit to the response. - Don't return SERVFAIL on a domain that looks like a NSEC3 domain but is actually a empty non-terminal. 27 July 2011: Wouter - Fix nsd-checkconf to check tsig algorithms properly. 5 July 2011: Wouter - Increase nsd.db version number because nsd 3.2.7 and earlier zonec is not compatible due to the TXT strings change. 14 June 2011: Wouter - Fix to have no authority NS set processing for CNAMEs. 27 May 2011: Matthijs - Bump to 3.2.9 20 May 2011: Wouter - Fix bug if the zonefile is changed for a secondary but stored transfers are applied, and stop it from applying ixfr to empty zone. The zone is flagged with error and AXFR-ed. 13 May 2011: Matthijs - Fix bug #365, do renaming of NSDC_ZONEC_VERBOSE and NSDC_PATCH_STYLE environment variable names that were forgotten. - Fix bug #381 - Binary escaped and transfers. 13 April 2011: Wouter - Fix is_existing flag for ENT when domain that has a shared ENT is deleted by IXFR. 5 April 2011: Wouter - Fix uninitialised value in xfrd nsd_soa, the rdata_count. 4 April 2011: Wouter - Fix printout of IPSECKEY by nsd-patch. 26 March 2011: Matthijs - @logfile@ was not substituted 25 March 2011: Wouter - Fix bug #365, you can set NSDC_ZONEC_VERBOSE and NSDC_PATCH_STYLE in the environment where nsdc runs. - Fix bug #375, typos in nsd.conf.5. - First step of bug #369: RRSIG DNSKEY sets zone to be treated DNSSEC. - Fix bug #302, nsd accepts XFR but refuses to re-read the slave zone. 7 March 2011: Matthijs - Update 3.2 branch (3.2.3 -> 3.2.8rc1, 18 August 2009 - 3 March 2011) 7 March 2011: Wouter - check chown value and report high verbosity its error. 3 March 2011: Matthijs - fix #bug352: fix hardcoded paths in manpages. 2 March 2011: Matthijs - fix #bug354: make realclean cleans too much - added make devclean for cleaning up autoconf and automake stuff - Fix hardcoded paths in nsd.conf.sample and nsd.conf.5 24 February 2011: Matthijs - fix #bug350: refused notifies should log client ip. 24 February 2011: Wouter - fix bug#362: outgoing-interface and v4 vs. v6 leads to spurious warning messages. - fix bug#363: nsd-checkconf -v does not print outgoing-interface ok. - fix that nsd-checkconf -o outgoing-interface omits NOKEY. 23 February 2011: Wouter - (merged with nsd4 on 22nd). - fix for bug#357, make xfrd quit with many zones. 22 February 2011: Matthijs - Patch Jakob Schlyter (setusercontext before chroot). 18 February 2011: Wouter - overhaul of testset, with port uniqueness and fast start and stop. 17 February 2011: Wouter - Fix leak of compressiontable when the domain table increases in size. - 24 January 2011 was release 3.2.7, move trunk to 3.2.8. 11 February 2011: Wouter - added test case to do with bug357. 24 January 2011: Matthijs - Patch Tom Hendrikx (only errors to stderr when doing nsdc patch). 20 January 2011: Wouter - Fix on shutdown, then getaddrinfo acquired data uses freeaddrinfo. 19 January 2011: Wouter - Bug #348: no -I/usr and -L/usr for libcrypto in /usr. 17 January 2011: Matthijs - Bump to 3.2.8. 5 January 2011: Matthijs - Fix nsdc update and nsdc notify - Force outgoing interface to be a single range acl - Update documentation about acl options - Code review - Fix nsdc so it can use hmac-sha* tsigs - Bug #347: NSEC3 nodata QTYPE=DS not at delegation mismatch 4 January 2011: Yuri - Doc spelling error, bug#345 15 December 2010: Wouter - fix race condition when nsd is stopped while a reload is in progress, often when rc.d does nsdc patch; nsdc stop in sequence. reload is now signalled to stop too. 10 December 2010: Matthijs - fix bug#306: applied documentation patch - fix bug#253: now also for QTYPE=DS. 12 October 2010: Wouter - Fix compilation on SunOS4. 24 September 2010: Matthijs - Bug #328: nsd-checkconf overrun 1 September 2010: Yuri - Support for huge TXT records. 23 Aug 2010: Wouter - fix bug#325: remove stale files from cvs from repo. 16 Aug 2010: Yuri - zonec, MAXRDATALEN check was off by one. 9 Aug 2010: Matthijs - nsdc return 1 outside function, should be exit 1 - Bug #320: arc4random 2 Aug 2010: Matthijs - Bump to 3.2.7. 19 July 2010: Matthijs - fix bug#314, NSEC next field now correctly escapes spaces. Also fixes label overflow issue. - Put back HAVE_SSL. - Code reviews. - Add donor text. 6 July 2010: Wouter - Compiles on Minix 3.1.7; checks ss_family, suseconds_t, some warning fixes. Needs socketpair to work, e.g. http://wiki.minix3.org/en/SummerOfCode2010/UnixDomainSockets. 2 July 2010: Wouter - Put back CHECK_SSL in configure (removed with disable-tsig). 17 June 2010: Matthijs - Expand command line option '-a' and config option 'ip-address:' with port number. - Removed --disable-nsid, --disable-dnssec, --disable-tsig 14 April 2010: Matthijs - Bump to 3.2.6. 14 April 2010: Matthijs - uintptr_t fallback value to void* - Backwards compatibality for MAP_ANONYMOUS - Tag 3.2.5. 31 March 2010: Matthijs - Commit b64_pton optimalized compat code (Martin Svec). - Commit (experimental) mmap-alloc-namedb patch (Martin Svec). - Commit parse-token-leaks patch (Martin Svec). 27 March 2010: Wouter - fix bug#303: misspelled error message. 19 March 2010: Wouter - documented nsid: "hex string" setting in nsd.conf.sample. 24 February 2010: Matthijs - nsid: option - Enable NSID support by default - --with-chroot configure option - Less stupid chroot error handling 15 February 2010: Matthijs - Skip memory cleanup to speed up reload (Martin Svec) 1 February 2010: Wouter - compat code for memcmp unsigned comparsions. 21 January 2010: Wouter - fixup debug sprintf to snprintf. 21 Januari 2010: Matthijs - Secure string functions, including compat code for strlcat. - Randomness utility function - Prepare for default chroot 6 Januari 2010: Wouter - check write errors when marking commit failed when difffile is broken. 6 Januari 2010: Matthijs - Move to 3.2.5 23 December 2009: Matthijs - Store new options in nsd structure. 22 December 2009: Matthijs - New options 'ipv4-edns-size:' and 'ipv6-edns-size'. - Bug 276 - Bug 286 - Bug 288 21 December 2009: Matthijs - New option 'tcp-query-count:'. - New option 'tcp-timeout:' and configure option '--with-tcp-timeout'. - New zone option 'notify-retry:'. 11 December 2009: Wouter - Disable UDP IPv4 DF flag on Linux/FreeBSD/AIX with socket option. 20 November 2009: Matthijs - NSID bugfix: NSD did not recognize NSID in the query. 9 September 2009: Matthijs - DLV support 18 August 2009: Matthijs - Bug 269. - Typo: logincap.h -> login_cap.h 12 August 2009: Matthijs - Maintainers feedback 10 August 2009: Matthijs - Code review. - Also send errors to /dev/null in controlled_stop. - chown nsd.db 7 August 2009: Matthijs - Bug 266: don't have strptime build error 28 July 2009: Matthijs - Bug 263: make TSIG algorithms comparison case insensitive. 23 July 2009: Matthijs - Patch Paul Wouters for NSD using hardcoded name. 13 July 2009: Matthijs - Bug 236: allow RRs before the SOA RR. - Bug 253: No need for NS RRset in authority section, when returning final answer for QTYPE=DNSKEY. 29 June 2009: Wouter - patch for use of Linux IPV6_MTU option, so that on linux the default EDNS UDP size advertised becomes 4096 over IPv6. It fragments the packets using the IPv6 minimum MTU. 19 May 2009: Matthijs - Clean up configure script (install hickup) - Bug 249: Remove unnecessary LLONG_MIN and LLONG_MAX code. - Replace strtoll code with own strtoserial function. - Move up to 3.2.3. 11 May 2009: Matthijs - Add Off-by-one test 6 May 2009: Matthijs - Small fix in SO_REUSEADDR warning log message. - Off-by-one bugfix (thanks Ilja van Sprundel, IOActive) 29 April 2009: Matthijs - A more ensured do_stop (useful fo nsdc restart). 2 February 2009: Matthijs - Bugfix #234. - Bugfix #235. - Reset 'error occurred' after notifying an error occurred at the $TTL or $ORIGIN directive (Otherwise, the whole zone is skipped because the error is reset after reading the SOA). 2 February 2009: Matthijs - Bugfix: return BADVERS when EDNS version > 0, instead of 0x1. 19 January 2009: Matthijs - Bug 230: nsd-*: use stdout for non-error output (instead of stderr). - Don't do strptime test when cross compiling. 17 January 2009: Jelte - Fix file rotation when no logfile but chroot. 8 January 2009: Matthijs - New nsd-patch option -o dbfile (set output.db) - update nsdc to deal with the new nsd-patch options - strptime compat fix 6 January 2009: Matthijs - New nsd-patch option -s (skip writing zonefiles) - Removed some region_create memchecks (not needed) 5 January 2009: Matthijs - Bug 218 - Bug 222 - Replace SHA256_DIGEST_LENGTH with nicer HAVE_EVP_SHA256 10 December 2008: Matthijs - Bugfix: better error message when ixfr.db cannot be read 18 November 2008: Matthijs - chown logfile, don't do file rotation if logfile is outside absolute and outside chroot. 17 November 2008: Matthijs - File rotation for nsd.log when owned by nsd (+ tpkg test). - Only AXFR fallback if master responded NOTIMPL or FORMATERR on IXFR request. - allow-axfr-fallback option. 7 November 2008: Matthijs - Bugfix: don't fclose if logfile == NULL. 30 October 2008: Matthijs - Allow escape characters in literal dnames - Fix typo in zonec manpage - Some fixes from code review 20 October 2008: Matthijs - Redo bugfix literal domain names in rdata (code adjustment) - Added tests for case sensitive dns names and "Bug #162" - Adjust nsd-patch to new ixfr.db format 14 October 2008: Matthijs - Only SO_LINGER when outgoing port is set - Reset diff_skip when a new difffile is created (parts in the difffile now have a timestamp). - Undo bugfix literal domain names in rdata (code adjustment) - Split up dname_parse to parse literal dnames and normalized dnames. 3 October 2008: Matthijs - setsockopt SO_LINGER, for portability outgoing-interface (BSD/Solaris) 1 October 2008: Matthijs - Configure the source ip-address for notifies by the master and zone transfer requests by the slave in nsd.conf. - Previously added source hostname/ip and port configuration for nsd-notify and nsd-xfer - Finetuned nsdc for nsdc notify and nsdc update 29 September 2008: Matthijs - Bugfix: only normalize domain names in rdatas when rrtype is listed in RFC 4034, section 6.2: Canonical RR Form. - Update TODO list 25 September 2008: Matthijs - Fix bug where hmac-sha256 was in algorithm table, but could not be retrieved by name or id. - Additional arguments for nsd-notify and nsd-xfer: set outgoing hostname/ip-address and source port. - Additional TODO entry: optimize code in nsd-* programs. 8 September 2008: Matthijs - RFC 4635, bugfix #130: support for hmac-sha1 and hmac-sha256 tsig algorithms. - modify and add tpkg tests for hmac-sha1 algorithms. 2 September 2008: Matthijs - AXFR fallback when IXFR/UDP failed on all masters - Bugfix: strip off chroot value in corner cases - Additional debug and verbose log messages 29 August 2008: Matthijs - IXFR allow UDP option 26 August 2008: Matthijs - Code layout, additional comments and documentation typo fixes - IXFR over TCP, no longer UDP 17 July 2008: Matthijs - Make the maximum number of interfaces configurable. - Write pidfile *after* succesfull server initialization, instead of writing, and unlink if fail. 16 July 2008: Matthijs - Set upcoming release to 3.1.1 - Wouter: fixed memory leaks that happened on error, mostly on zone transfer errors. 11 July 2008: Matthijs - Avoid race condition in nsdc: let nsd server update pidfile before closing old parent process. 8 July 2008: Jelte - Fixed NSEC3 memory leak in the case NSEC3 is not needed. 7 July 2008: Matthijs - Bugfix #191 9 June 2008: Matthijs - When comparing RRs, do not compare TTL values (since the same record with different TTL values are considered equal). - Fixup some more unaligned memory access that could occur when reading ixfr.db. 19 May 2008: Matthijs - Do not always log tcp read errors, only when real error or high verbosity 28 April 2008: Matthijs - Bugfix #172 (misleading error from zonec) 27 March 2008: Matthijs - Port some branch modifications to trunk 28 February 2008: Matthijs - Do not answer nsec3 wildcard information when DO bit is not set 19 February 2008: Matthijs - Fixed strptime bug (for MacOS Leopard) 22 January 2008: Matthijs - Add configuration for chkconfig to control nsd service (bug 164) 15 January 2008: Matthijs - Fixed bug 157 where nsd would return FORMERR if edns query is received with version set to zero and rdlen is larger than zero. 8 January 2008: Wouter - no warning about optout records. also no warning about missing nsec3 records. - check for hash(apex)==nsec3 with SOA bit was done in duplicate. - removed old commented out code - using SOA bit in NSEC3 typemap to detect parameters - using nonhashed NSEC3 to prove qtype=NSEC3 nxdomains - prints for debugging. - nicer comment on nsec3_lookup. 7 January 2008: Wouter - Fixup nsec3 tests, they need zonesdir: "." in conf files. The tests pass. - configure default is --enable-nsec3. Disabling this will save 20% more memory (for very large zones). Moved tests to test on commit. - set RRTYPE numbers for NSEC3=50, NSEC3PARAM=51. - fixup checkconf test - updated parser lexer gives syntax error on some garbage instead of parse error. Parselexer is updated for new options (hide-version, verbosity). - removed highrange rrtype code. fixup cutest for that. - speedup of prehash code. - skip nonexistent domains (operator.example.com). - skip only-nsec3 domains (that could be 2x speedup) - skip glue nameserver domains (for TLD with 2 glue per delegation this is a 3x speedup). - skip the prehash_domain for delegation points, which saves another 2/3 hash operations, 3x speedup. - printout how long nsec3 prepare took (verbosity >= 1). 3 December 2007: Matthijs - Fixup bug where data related files are looked up in the wrong directory when chrooted with chrootdir ending with a slash. 26 November 2007: Matthijs - Fixup bug start nsd while already running: do not initialize server, since it is already running. 15 November 2007: Matthijs - Changed man pages format from mdoc to mansun, to support the Solaris OS. - Better logging for nsd-notify (show 'broken' zone) 13 November 2007: Wouter - CREDITS and RELNOTES now in utf-8. 12 November 2007: Matthijs - Changed man pages according to bug 162. 30 October 2007: Wouter - Fixup for skip after unknown deleted IXFR RR, otherwise processing would continue at the wrong spot in the packet and process the IXFR as if it were malformed. - added unit test for this in long (needs ldns-testns, updated it). - added unit test for rollback of malformed zone transfers. Fixup for it, and fixup in ldns-testns to be randomport and copy id for hex packets. 29 October 2007: Wouter - Fixup bug where malformed IXFR replies cause partial processing in reload (or nsd-patch or nsd-startup). One result is multiple SOA records in zone apex. Fixup rolls back the zone transfer, and waits for NSD to try to load again. 26 October 2008: Wouter - small fix in descriptive text in sample config for debug-mode. 9 October 2007: Mark - Change default location of: nsd.db, ixfr.db & xfrd.state to /var/db/nsd. 5 October 2007: Wouter - Fixup manual page entry for allow AXFR to anyone. 3 August 2007: Mark - Report source and zone for denied AXFR attempts. 25 July 2007: Wouter - bind2nsd to 0.5.0, fixup of includes, key{} handling. 19 July 2007: Wouter - bind2nsd to 0.4.8, fixup of include bug. 18 July 2007: Wouter - added contrib for bind2nsd, Al Stone provided an abridged version that neatly fits for contrib. 17 July 2007: Wouter - fixup commithooks. 16 July 2007: Wouter - Added reference to http://bind2nsd.sourceforge.net/ to contrib/README. 3 July 2007: Mark - Zone compiler now gives more sane error message when out of diskspace. - Fixed a call to drill in tpkg that made a test check bind instead of nsd. 2 July 2007: Mark - Remove last traces of mmap usage. - Some cleanups in tpkg. 24 April 2007: Mark - Added "hide-version" configuration setting. Enabling this feature stops NSD from answering to CHAOS class version requests. 19 April 2007: Wouter - Compiled on minix 3.1.3 and make some adjustments to ease porting. ECONNABORTED is checked for. sys/select.h included in nsd-notify. SO_REUSEADDR failure is not fatal. PF_INET compat code added. If you compile yourself; strptime and socketpair need compat code. 13 April 2007: Wouter - Minor tweak to nsec3.c, more elegant handling of malformed nsec3 records from a zone transfer. 10 April 2007: Wouter - Fixup ignored return value in region-allocator. Now returns a NULL memory allocation failure and leaves region in a consistent state. 20 March 2007: Wouter - Released 3.0.5. - (for 3.0.6) -O2 test for Alpha moved to saner position. 16 March 2007: Wouter - port configure to AIX, removed warning on ALIGNMENT in region code. defined _ALL_SOURCE to get recent C definitions on AIX. - improved nsec3.h comments. 22 February 2007: Wouter - Zonesdir default is now /etc/nsd. So that the invocation directory is not used to dump files into. The user can change the zonesdir by editing the config file. The directory is created by install, if not an error is printed. - updated tpkg tests to use current dir for testing. - tcp connections that drop do not spam the log file. Unless verbosity is set high. 19 February 2007: Wouter - Fix empty line printed with warning on 'force zone transfer'. 15 February 2007: Wouter - Check for EPROTO definition to compile on FreeBSD4/Alpha. 13 February 2007: Mark - Debug flag (-d) behavior changed. Nsd now also forks children when run in debug mode. - Added verbosity mode (-V ) for extra operational logging. 8 January 2007: Wouter - README text on interface configuration added. 2 January 2007: Wouter - Fixup accept() that could block due to already closed connection. Made listen() nonblocking, ignores errcodes that indicate closed tcp. 29 January 2007: Mark - Handle the new CERT RDATA types defined in RFC 4398 (submitted by Mans Nilsson). - Change nsd-notify retry timer from linear into exponential backoff (submitted by Mans Nilsson). - Due to a small bug in a comparison statement, zonec would fail on the parsing of unknown CERT types. This got triggered by the first bugfix today, as that one shouldn't have been discovered in the first place. Took the opportunity to sanitize two other comparison statements related to strtol(). 24 January 2007: Wouter - Tentative change to set UDP sockets nonblocking. Perhaps it helps Howard. 19 January 2007: Wouter - NSEC3 work. prehash printed only once with time taken to prepare. - prints are now only in DEBUG mode (except errors). - rr descriptor counts for NSEC3 updated, has an extra field flags. - now NSEC3PARAMs with flags!=0 are ignored, as per draft-09. - Fixed where only first NSEC3PARAM was properly detected. - Added tpkg in manual (because you need to compile with nsec3) that performs the test queries from draft-09 and checks them. - Made tpkg to test NSEC3 parameter detection. NSD will skip any NSEC3PARAMs that don't work until the first working one is found. Also, this means unknown hash algorithms are simply ignored. A zone that uses exclusively unknown hash algorithms for NSEC3 will give errors on loading (or after zone transfer) but NSD will load and serve the zone (but no NSEC3s are returned). - added tpkg in manual to test parent side DS answers. These follow a different code path than child side DS. - Will allow NSEC3s(and signatures) below a DNAME. - A query for an NSEC3 ownername will lead to DNAME redirection as if the NSEC3 did not exist. - Test package in manual that tests NSEC3 and DNAME in the apex. - Changed NSEC3 memory requirements from 5 pointers per domain name to 3 pointers and 2 bits. - Added jumpstart for nsec3 search, will greatly speed up optout zone nxdomains. At the cost of one ptr per domain name. The speedup also speeds up the nsec3 prepare stage. 18 January 2007: Wouter - Created 3.0.4 release tag. - 3.0.5 number in trunk. - add nsd.spec patch from Farkas Levente to contrib. - NSEC3 new wireformat and presentation format from draft-09. 11 January 2007: Wouter - The message 'server .. closed cmd channel' is now priority INFO. This to reduce the 'error' amount in the logs. - On error in a tcp request, set to retry next instead of waiting for the tcp timeout. 9 January 2007: Wouter - TSIG acl matching changed so that NOKEY allow-notify entries match only queries without a tsig. Otherwise NSD would crash. This only affects servers that have allow-notify: ip NOKEY and someone sends a TSIG signed notify from that ip. - test package for that. - Fix for reply to notify messages with ANCOUNT wrong. The ack to notify messages that passed the ACL, and had a SOA in the answer section of the query, included wrong RR counts in the header. - test package for notify reply wireformat. 8 January 2007: Wouter - ipc_send_blocked will not lead to busy waiting on it, but will block in select, until SOA_END comes by. - server_main sends SOA_END if reload crashes, to xfrd. So that xfrd can set ipc_blocked=0 and can_send_reload=1; and thus resume service, assuming that the crash was a temporary condition. This will lead to trying every reload-timeout seconds to reload if it is a permanent condition. Which is more obvious to the operator. - put the error "error: diff: RR ns.kiev.ua. already exists" in debug mode only. Zone transfers with this error are liberally accepted, and we should not spam the logfile. - empty zones will not be retried forever every 10 seconds, but exponential backoff to a max of every 4 hours. The exact value is randomised to spread out attempts. 5 January 2007: Wouter - Fixed --zonesdir= for configure. The value did not get used as a default value. Now it is used as a default value. If a default value is set for zonesdir, you can go to a 'no value specified' by giving the empty string, zonesdir: "" in nsd.config. - Fixed checkconf.tpkg for this change. nsd-checkconf will output zonesdir: "" as this is the default for --zonesdir. 2 January 2007: Wouter - Added contrib script from Stephane Bortzmeyer to convert NSD 2 to NSD 3 config files. Converts secondary zones and TSIG keys. - Made config conversion script skip empty lines. - Made config conversion script convert primary zones (and notify). - Nsdc control script will exit with 'nsd startup failed.' if nsd fails to start (due to bad config file for example). 15 December 2006: Wouter - Removed dlopen() checks from configure.ac, NSD3 no longer has dynamic plugin support (since 3.0.0). - added .rpm spec file to contrib. - Updated README to remove reference to buildzones script. 12 December 2006: Wouter - Added missing include to ipc.c to compile on SunOS. - Cast to avoid signed/unsigned comparison in compat/inet_ntop.c. 11 December 2006: Wouter - Added test to check for CNAME and other data error by zonec. Currently NSEC, NSEC3, RRSIG, SIG, NXT are allowed next to CNAME. - Fixup unaligned memory access that could occur when reading ixfr.db with a partial transfer inside. - RR type WKS (well known service) was not printed correctly, htons() was forgotten when calling getservbyport. - NSD does not complain about not being able to read the db CRC when all that happens is the file became longer or shorter. 8 December 2006: Wouter - Moved down max XFRD UDP sockets for zone transfer queries to 100 down from 300. This makes the total socket max at 200, so it fits easily under 256 ulimit (a common default). 7 December 2006: Wouter - Improved error message to help operator. - created 3.0.3 svn tag. - default of zonesdir corrected (no directory is default). 4 December 2006: Wouter - updated test packages. Moved 213_large from manual to long. size_0, source_port_0 made more working (needs root permission). 1 December 2006: Wouter - Moved xfrd ipc and reload handlers to front of event handler lists for a 10% speedup in xfrd. - Fixed so that NSD no longer interrupts zone transfers when a notify comes in for that zone. Added package to test it. - Fixed warning on Solaris 10. 30 November 2006: Wouter - Test for fallback in getaddrinfo more portable. Ported to FreeBSD 6.1 without inet6. - New quit sync had a problem with blocking in dispatch. Fixed. - reload will retry quit_sync if nothing happens. - parent tries to empty the pipes before closing them on quitsync. - xfrd does not send reload when previous reload request busy. - netio will only deliver the number of bits from select and then stop. Optimisation. 29 November 2006: Wouter - Fixed getaddrinfo error message to be more descriptive. - Fallback to ip4 also if getaddrinfo fails for ip6. - instead of EAI_ADDRFAMILY uses EAI_FAMILY which is portable to FreeBSD. - signed/unsigned warning fix for FD_SETSIZE comparison. - Lots of debug statements and new quit sync feature, where the server children are synced with. So as not to lose buffers. 28 November 2006: Wouter - Debugging 10k zones transfer, set so that zones waiting for a socket do not get timeouts. - Debug change so that an event is only returned to one handler by netio. Reversed this. Netio will not deliver events you do not listen to, and since xfrd first listens to write then read, it will not have problems with stale events (for the fd from the previous select) because these are always read, while it needs a write. Re-Reversed it: netio will deliver events only once. This is easier to understand for the poor hapless developer. - Need to set notify_current for notify on waiting list. Fixed. 27 November 2006: Wouter - Debugging 10k zones transfer, noticed that it is possible for netio to give a callback for an event that you were not listening to. Now no longer does that. 16 November 2006: Wouter - Bug #153: now checks for FD_SETSIZE when adding fd to select fdset. - Easy overview of socket allocation for xfrd in xfrd.h - Upped the default xfrd socket limits a bit. - Log message that the TCP connection limit is reach is now only in -L 2 logging. It is spammy. - updated dependencies. - Added test for notify-socketcount, and removed unused files from bug153 test package. - Notify udp sockets are also capped at a max number. The rest has to wait in a queue. 15 November 2006: Wouter - Fixed bug #152: identity keyword in nsd.conf did not work. What happened was that the hostname() from the computer was overriding the nsd.conf identity. Fixed now. If commandline is given that is used. Else nsd.conf entry is used. Else hostname() detected from computer is used. Else default string "unidentified" is used. 14 November 2006: Wouter - Fixed bug where NSD tries to create 10000 udp sockets, when starting with 10000 secondary zones. Limited to 50 at a time. The XFRD_MAX_UDP constant controls this. 3 November 2006: Wouter - Created tags/NSD_3_0_2_REL. 2 November 2006: Wouter - Added pdf for differences.tex for ease of use. - Updated text in readme on memory usage. 24 October 2006: Wouter - Recycle rrset memory after doing special processing on the deleted rrset data. - log message clearer for 'duplicate xfr part' to 'discarding partial xfr part'. - if you have a server that has IXFR turned off but sends a TC flag for IXFR queries, xfrd will retry to TCP. This makes the use of 'AXFR' flag in nsd.conf file not needed in certain cases. - Be thrifty and save up the memory that was lost at end of chunks in the recycle bin. Saved 1.3Mb on 170(rrs)/220(total) Mb dataset. 23 October 2006: Wouter - Added checks for out of memory in reload (diff file). And it exits if so neatly. 13 October 2006: Wouter - Bug #149: Wrong text for NOTAUTH error code. When notify is not authorised REFUSED error code returned instead. 4 October 2006: Wouter - More fixes from Koh-ichi Ito (kohi@iri.co.jp now), for bug #146, his bash does not do $(( )), so nsdc.sh has to use test of course. 29 September 2006: Wouter - recyclebin works, added a test that uses it (about 3 Mb goes through the recyclebin). This resolves bug #147. - Made -L 1 logging is little less verbose (-L 2 gets it all). - added search path for openssl on Solaris 10 (/usr/sfw). 28 September 2006: Wouter - Removed unused global variable current_region, and routines for it in region-allocator.c and .h. - Added recycle option to regions. It will keep track of small objects in a recycle bin. Large objects are deallocated. No calls to recycle yet, unit test it first. - added unit test for region recycle. 27 September 2006: Wouter - Further suggestion from Koh-ichi Ito, I've set opt->xfrdfile to XFRDFILE in options_create. So opt->xfrdfile and opt->difffile are never NULL. This simplifies code elsewhere. And also handles chroot case (+=l) for default values. - Fix for bug #145. The skip file position in the diff file was used inconsistently - one part of the code skipped to before the 'IXFR' type code and another part skipped to after that. Now all skip to before the type code. This bug only happens if your diff file is like: zone1_part1, zone2_part_1, zone1_part2, zone1_commit, zone2_part2, zone2_commit. The skip over zone1_part1 failed. - tpkg test in long dir that tests for the bugfix. Takes a long time and uses ldns-testns feature to wait partway through an AXFR. - removed debug log of strerror on diff read failure, when the errno was already output to the logfile (resulting in a nonsense error). 26 September 2006: Wouter - NSD compiles on Solaris 10 with the sun cc compiler. Added a define for _STDC_C99 for that. - Checked that the patch for solaris for bug 143 indeed fixes the bug. - Fixed bug #146 reported by Koh-ichi Ito: when chrooted nsd failed to write xfrdfile/difffile. 18 September 2006: Wouter - no queries for NSEC3, RRSIG, ANY succeed for nsec3 only domains. 15 September 2006: Wouter - Fixed LOC parsing of integer overflow causing maximum values. Added to test and backported fix to 2.3.6. - NSEC3 qtype queries get noerror/nodata or nxdomain answers. You can query for NSEC3PARAM. - warnings for printf format on maxOS (sizet needs cast to int). 13 September 2006: Wouter - added fsync to AF_UNIX sockets to write last command (QUIT) before closing them. - sent explicit QUIT command to xfrd on final shutdown of the server. 12 September 2006: Wouter - Bug #144: LOC defaults for unspecified values wrong. Error in zonec. Set defaults. Also fixed parser if LOC has no minutes or seconds. - Also fixed rounding error in seconds 0.001 decimal. - Test tpkg for bug 144. 11 September 2006: Wouter - nsdc now more portable in use of 'which'. Does not only look at exit code but also checks for '^no ' string. - nsd-patch does a chdir to zonesdir for relative difffile or dbfile path names. - nsdc handles zonesdir: for relative pidfile, dbfile, difffile pathnames. 7 September 2006: Wouter - bumped version to 3.0.2. - Nice configuration error when you had the wrong zone name in the nsd.conf file. Zonec will give an error already. - When you start a secondary zone without a zone file, you get a much nicer error message, warning you of the zone transfer. - Credits for prerelease testers; Thanks guys! 6 September 2006: Wouter - Fixed nsd-patch so that it writes the SOA at the start of the file. - test tpkg that tests for the bug, has multiple rrsets at zone apex and does nsd-patch followed by zonec. Previous tests did not catch this: they used nsd-xfer to test zone contents, or only checked the zone-file after nsd-patch. - version number bumped to 3.0.1. - svn tag 3_0_1 made. 5 September 2006: Wouter - differences file improvements. - created 3.0.0 release in svn tags. 4 September 2006: Wouter - From suggestions by Bin Zhang: - nsdc restart does not fail if nsd was not running. - fixes to man pages, wrong locations for files. - NSEC3-PARAM has no optout bit in presentation format. - NSEC3PARAM spelling. - differences in latex format (needs nlnetlabs housestyle). 31 August 2006: Wouter - Fix for tsig size still set when data is null ptr. - Fix configure for NetBSD (1.6 - 2.0) to find struct timespec. - DIFFERENCES file completion. 30 August 2006: Wouter - Print error nicely when nonblocking connect fails on systems in a portable way. - doc/UPGRADING document to assist NSD 2 to 3 upgrades. - updates of error print - ignore EINPROGRESS if we check too early. - wait for select writable before testing for connect error. - echo "" >&2 is not as portable as we would like, removed from nsdc. - fixed debug print of a null ptr. - fixed bug where query for CNAME that points to unserved zone caused nullptr exception on empty zone ptr. Now original zone is restored after CNAME-pointed data is added to the packet. Test in dname.tpkg. Reported by Kai. - fixed stack corruption when ipv6 disabled. 29 August 2006: Wouter - NSEC3 made it so it can handle the case where the NSEC3 RRSET with the SOA bit on does not have the RR with the soa bit set as the first RR. - Handle NSEC3-PARAM type. Checks to see if any of them work: zone apex hashed exists, with NSEC3 type, and RR that has the same parameters and the SOA bit set. - in presentation format of NSEC3, NSEC3-PARAM reversed hash, optout. - update to the DIFFERENCES file, bind 9.3.2 vs NSD 3 and NSD 2 and 3 comparisons are completed. 28 August 2006: Wouter - echo messages in nsdc made clearer. nsdc notify and nsdc update only send notify messages to slaves / localhost to force transfers. - initial NSEC3-PARAM type code entry. parsed, ignored. 25 August 2006: Wouter - disabled make test target as tests are not shipped. - performed prerelease static snapshot. - updates to the DIFFERENCES document. 24 August 2006: Wouter - Fix bug 141 port from 2.3.6, copies behaviour from bind 9.3.2. - Added a test for bug 141. - Bug141: save the opcode from the query. 23 August 2006: Wouter - Fixed % by 0 exception in the bugfix #139. - Fixed RFC 4035 says CD flag SHOULD be cleared on authoritative reponses, now NSD clears the CD flag. This is bug #140. RFC 4035 could be confusing on this, as it states 'all servers MUST copy the CD bit' more than once, but then makes clear only recursive servers are meant with that statement. - Differences document updates for bind 9.3.2 and nsd 3. 22 August 2006: Wouter - version number to 3.0.0 in preparation for release. - Bug #139: resync stats to whole period. Fixed. 21 August 2006: Wouter - check for error in ftruncate call. - replaced fwrite call with write_data call from util that does error checking. 15 August 2006: Wouter - removed unused struct nsd.named8_stats variable. - Bug #138: nsd aborts trying to bind all interfaces if ip6 is not enabled, instead it will fallback to ip4. 14 August 2006: Wouter - Added test for rollback of an IXFR transfer by xfrd. - Added test for reload timeout in xfrd, the reload does happen after a while, but not immediately. - Test that makes xfrd connect to ip6 address. - Test that overloads the number of tcp connections in xfrd, simulating a slow master, so that zones have to queue up to get it. - code coverage is now 2514 of 10636 uncovered. Still a lot uncovered. - ixfr queries return NOT_IMPL errors. 11 August 2006: Wouter - srandom to init random() in xfrd based on PID and time. - improved usage() information to be more helpful, and with version. - in makedist.sh, flex and bison called like in Makefile. - test for tcp underrun and overrun of the buffer. 10 August 2006: Wouter - added more tests to increase code coverage of testset. - moved acl parsing code from configparser.c to options.c to help unit testing. - nsd-checkconf echod wrong difffile filename with -v. - nsd-patch can now be used with -f to force printing of all RRs. - TYPE_NULL crashed NSD when it printed it, arg was ZF_DNAME, now ZF_UNKNOWN. - unknown rr test was faulty on input, the length was in nibbles not in octets, but rfc specifies octets for unknown rrs. NSD does not look at the length, and prints the length correctly. - added type NXT to the rr-test for weird RRs. - added printing test to rr-test, ipseckey and unknown-rr tests. checks if NSD prints the same RR on output as it read in. - put -x option for nsd-patch in usage(). - test that kills an nsd child server and checks that it is restarted. 9 August 2006: Wouter - tested nsdc functionality, make install and make uninstall. - set O_NONBLOCKING on xfrd tcp sockets before the connect call, because the handshaking can take very long too. - difffile and xfrdfile set via configure, to absolute pathnames, so that chroot checks work for them. - updated tpkgs, they need to set relative paths now for diffile. - gcov says 2821 of 10617 total code lines are not covered. compiled with --coverage, not -O2, ran tpkg/* and long/testplan*. counted grep '#####:' *.gcov | wc and grep '^ *[0-9]*:' *.gcov | wc. - cleaned up the log functions, NSD no longer spams the syslog with debug messages. The standard NSD debug util is used, -F -1 -L 2 for a compile configured with --enable-checking will enable them again. Errors are logged, as is the automated reload of a new serial. - tpkgs for bug077 and bug107 were silently failing to test properly. 8 August 2006: Wouter - fixes for checkconf test, more portable. - removed items from TODO that have been tested. for multihomed servers you have to bind to each interface explicitly to get outgoing ip-address the same as query destination ip-address. Forks and if-existing are tested and ok in testplan tests. close_all_sockets is called by child, if tcponly, so leave it. - user name check is hard portably with shell scripts, and packaging could set a default user that does not exist on a machine. - empty nodes (nonterminals) give no nxdomain any more (todo item done). - removed (old) from TODO. - removed contrib/buildzones.pl, it is outdated. 7 August 2006: Wouter - Made the tests a little more portable. - fixed mempcy unable to handle unaligned memory addresses on Solaris, used memmove istead of memcpy in zonec LOC conversion code. - another unaligned memory access, when storing off_t pointer in difffile.c, used memmove. 4 August 2006: Wouter - nsd will start if diff file is corrupt, with a log message. It ignores the bad data. - tpkg files do not override PATH, svnhook sets it. So user can set path to utilities on the system to run the tests. - running testset on DecAlpha discovered uninitialised variable in NSD. Fixed. - Jakob Schlyter asked for building nsd3 in an obj dir, i.e. mkdir obj; cd obj; ../configure && make. Fixed up makefile for that. - and bug137.tpkg for separate obj dir building. 3 August 2006: Wouter - more tests in mesh test. - changed test packages to put nsd log to test result "/dev/stdout". - test packages more portable - use default 'dig' location. also, path is appended to, instead of replaced. 2 August 2006: Wouter - Region can be customised for detailed memory handling. Especially if you set large_object_size=0, chunk_size=0, the region will perform individual allocs, and 'save memory'. The region still keeps tracks of allocations so that at region_free time all memory is released. - tsig.region removed, it was not used after attaching a cleanup at creation. tsig creation uses custom region settings. - xfrd inits the tsig records with memory saving settings, so the regions alloced for tsig take up about 60 + 4*8 bytes. - new custom region for query region - to make chunksize larger there. The chunksize for the query region is important, if all allocations for a query fit in it, no mallocs are needed. - TSIG other_data field size according to RFC 2845 is 0 or 6. In tsig implementation put a maximum to the field of 16, otherwise a formerror results. - query with IXFR appended SOA not formerror. IXFR queries not reach the handler in axfr.c for IXFR queries. - removed annoying debug message of added tsig key. - added test that starts 7 servers in a mesh and lets them fight out what zones to transfer and serve. - xfrd logic bug: if notified a slave would not see the renewal of its current zone. 1 August 2006: Wouter - Test for remove domains with IXFR. - Fix for empty nonterminals and IXFR deletes. - Test for timeouts, including expiry, and expiry and zone updates. - Test for axfr refused authorisation. - Test for deadlock in ipc. 31 July 2006: Wouter - Test plan ixfr test in tpkg/long directory. - IXFR with many packets tested (one RR per packet). 28 July 2006: Wouter - tentative change, that preserves ordering of rrtypes for a domain. - fix for serial rollover (old_serial + 2**31), now works, is seen as new serial and rolled over to new. - serial numbers, and time values, printed as unsigned to logfile. - set so that if info is provided by operator, refreshing state not expired is used. - forgot to * a pointer to boolean, is_ixfr in the difffile reader. This fixes the testplan_ixfr test 1. 27 July 2006: Wouter - fixup desc of tsig xfer test, remove debug from xfr_huge. - fixed compressed dname tables cleanup, to set ptr to NULL. - initialised xfrd_listener.fd to -1. - fixed difffile handling of very short AXFRs, with no data. 26 July 2006: Wouter - Updated the requirements with comments from Olaf. - README discourages use of experimental nsec3 rr a bit more. - typo in DNAME code, used original qname instead of CNAME adapted qname variable. - added IPSECKEY RR type, RFC 4025. - tpkg test with sample ipseckey rrs. - wireformat for IPSECKEY depends on the value of a rdata atom, added WF_IPSECGATEWAY to handle that. - DHCID type, data is encoded in one binary/b64 blob. 25 July 2006: Wouter - max number of tries for nsd-notify is 15, so that the total time for sending is about 75 seconds. - forward port of fixes for bug 105 and 135 in nsdc. forward port of test for bug 105. - fixed nasty bug with configure --prefix=<...> where config.h was wrong. Now double evaluate the shell expansion on the defines. 5 July 2006: Wouter - helped in README with gnu make; need to make clean so that botched attempts by make to create the lexer files do not stay around. - removed %zd, replaced by casts to int. - updated REQUIREMENTS file, the sections on RR types, on what algorithm NSD follows and on which RFCs are supported are updated. 3 July 2006: Wouter - 'make depend' target in makefile. (updates both Makefile.in and Makefile, so it works for users and for svn). - doc minor update. 2 July 2006: Wouter - TESTPLAN, README, bugzilla-bugs docs updated. - NSD for BIND users update. 29 June 2006: Wouter - removed --zonesfile nsd.zones configure option. - doc/README updated for 3.0. - doc update. NSD_FOR_BIND_USERS document. - moved from -Ds to the config.h header, cleaner compilation output. - use autoconfs built in large file support enabler. 28 June 2006: Wouter - nsdc neater, checks for BLOCKED ips more strictly. - nsd -d also disables xfrd forking, and thus all reloads and secondary zone treatment. Stated so in manual page. - fixup, apart from ip4 need to allow ip6 in example.conf line showing how to allow access for everyone to axfr. 27 June 2006: Wouter - Fixed read in server.c to be a blocking read for sure, even if ipc is not blocking on the OS. - nsd-notify tries to send notify 5 times, then exits with error. - nsd-checkconf can lookup key secrets by name from a config file. - difffile option is always set in options struct with default or config value. - nsd-patch uses dnames to compare zone names (for trailing .). - nsdc updated to work with config file. 26 June 2006: Wouter - Nicer check in autoconf for struct timespec type. - NSEC3 next hashed ownername is a length byte followed by data. - nsd-checkconf more quiet, clearer error message. - NSEC3 does not complain about glue records without nsec3. - nsdc work (did start, stop, running, rebuild, restart, reload, stats). 21 June 2006: Wouter - nsid commandline parsed using hex_pton routine. - unit test for hex_pton. - added include stdlib, needed for free() on sunos4. - fixup of disable-ipv6 compilation. - memmove compat implementation (created fresh). - yy_set_bol() for old flex compat define. - compat implementation from openssh4.3p2 for strlcpy, inet_aton, and inet_ntop routines. - changed ctime_r usage to ctime() call, nsd is not threaded. - compiles on SunOS4/gcc-2.95. - debug statements go to the log_msg route instead of the fprintf route, so they will get to a nice logfile even if we forked away, with xfrd. logfile=/dev/stderr gives old way. - minor changes to cutest to make unit test compile on SunOS4/gcc-2.95, it checks out fine there. 20 June 2006: Wouter - updated configure to disable -O2 on platforms where gcc does not like it (such as dec-alpha). - nsd-notify used recvfrom and passed addrinfo.ai_addrlen which is a size_t, but recfrom needs a socklen_t*. On dec alpha these types differ in size (size_t is 64bit, socklen_t is 32bit). Therefore, used a wrapper variable to pass to recvfrom. - changed long int to time_t in nsd-patch.c to please compiler on dec alpha. - dec alpha complains if statements are in front of variable definitions. Fixed code for some mixups on this. - Fixup cutest for dec alpha. Code, lowercase filename, %lf->%f. - cutest fixup uses (size_t) cast and %zx to print ptrs (for debug). - for SunOS4 configure detects ssize_t and struct timespec. - removed usage of fpos_t, instead using fseeko/ftello for 64bit. - configure will define fseeko/ftello with fseek/ftell if unavailable. - added missing include from buffer.c (stdlib for free()). - defines for snprintf and vsnprintf in config.h if needed. - configlexer flex is called more cleanly with -t to write stdout. - missing include from configparser, stdlib for atoi. - config.h provide inet_pton define if it is not available. - fixup of INET6 defines, where sockaddr_storage is used outside of INET6 defines, in xfrd-tcp. - edns_init_nsid was not defined in edns.h. - added compat/fake-rfc2553.c and h from openssh 4.3p2. That has a BSD license as well. They replace getaddrinfo() (and friends) when those are missing. 19 June 2006: Wouter - updated the tpkg/manual tests for NSD 3 config files. Some need root privileges to run (using hping), they all pass. - also the tpkg/long test bug_sighup. - nsec3 code will warn at prehash time for missing exact nsec3 records. So faulty signed zones are more easily spotted. - fixed NSEC3 and CNAME/DNAME chains, it will disprove the new qname. - removed for() look in CNAME processing, only first CNAME is processed now. - zonec will error on a zone with multiple CNAMEs for one name. 16 June 2006: Wouter - Swapped read and write ops in xfrd_handle_ipc, so that a read of a signal from main can stop further writes. - xfrd will complete its last message before shutting down the ipc writes and then acknowledge the reload-sync. This resolves the race where half of ipc messages caused bad modes from the main. 15 June 2006: Wouter - In preparation of notify send overhaul, moved the notify send code to xfrd-notify.c and h files. - created cleaner split of notify send and xfr code. Still in the xfr process, because it is a convenient location. - fixed bug where notify sending would read from wrong fd. - send master zone notifies. Does not skips master zone SOA INFO updates. - fixed bug where port number acls did not match. - fixed bug where tsig keys are checked for twice, but not error_code. - fixed notify send retry counting. - added test tpkg for notifies from nsd master to nsd slave. - nsd-checkconf flags if you set allow-notify without request-xfr. 14 June 2006: Wouter - fixed crash bug when dnssec/NSEC enabled and query DNAME target did not exist. 13 June 2006: Wouter - created doc subdirectory for documentation. - removed unused DIFF FILE MAGIC string. 12 June 2006: Wouter - dname_test tpkg with very extensive DNAME testing. - moved sizes of zone_name buffers to 3072 - for escaped names. - nsd-patch has a debug option to list the contents of the difffile/ixfr.db/transfer patch log in a journal fashion. You can then manually inspect the contents. 9 June 2006: Wouter - after a reload NSD will report the memory churn: number of bytes of memory wasted by the zone transfer code. 8 June 2006: Wouter - When zone is re-chosen after a CNAME/DNAME no SERVFAIL is set, noerror is returned instead. - zonec will error on multiple DNAMEs for the same name. - zonec will error on DNAME and CNAME together. - improved loop log message. 7 June 2006: Wouter - after DNAME the closest_match is set correctly for another DNAME. - in case of a loop returns gracefully instead of crash. - nsec3 checks if it is enabled for the zone for wildcards. - NSD will give referrals for zone cuts encountered after a CNAME or a DNAME. This also fixed various subtle stuff with CNAME/DNAME and TYPE_DS at zone cuts. It basically re-determines the zone to use after the CNAME/DNAME. 6 June 2066: Wouter - zonec checks for data below a DNAME, and will not create the db, as per rfc 2672. Tpkg test to make sure such a zone is not loaded. - updated rr-test tpkg so it has no data below a DNAME. - DNAME synthesis of CNAME records, including compression for cname. - included cname creation in dname test. - preallocate the extra temporary domain_type structures. - too many temp domains returns OK packet so that the resolver will recurse and ask us again with the last name in the chain. - fixed bug introduced in preallocation on temp domain numbering. 2 June 2006: Wouter - dname_replace function that does DNAME replace and unit tests. - added error codes from DNSUPD rfc2136 to constants in dns.h. - in query.c added DNAME following code. - fixed bug 134: hints[i] in nsd.c to hints[0]. - added tpkg small test for DNAME. - tpkg to test bug 134 (starts 100 processes). 1 June 2006: Wouter - tsig test with NSD master and NSD slave server. Tsig AXFR transfer. nsd-xfer used to test slave zone contents. - fixed bug where buffer_flip() is done before appending tsig rr. - version printed at start of nsd in logfile. - xfrd prints name of tsig key used during transfer in commit comments so it appears in the log file and in zonefile after nsd-patch. - prints RRs from diff file only if debug level >= 1. - scalable transfer test xfr_gig added, you can set the size to try in the .pre file. Now set very small. 31 May 2006: Wouter - xfrd check for failed updates. It compares the time it wrote the commit to disk with the time of the last reload command. Failed updates are restarted like the zone is notified of the soa. It also catches reloads that have been lost (reload cmd while reload is running, or a crashed reload process, for example). - when reload is issued, times at that second are put back one second, so that after a reload all the zones that should have been loaded have a time from before the reload. - if a reload crashes, NSD will continue with the old database, xfrd is not informed, since it cannot fix that. - nsd-checkconf strdups arg strings before writing to it. - tsig error replies contain error data, but no signature. also crashproof, badly formatted tsigs get a format error. - tsig error print knows about DNS rcodes in tsig error field. - added tpkg tests for tsig. - tpkg test for nsd-xfer with TSIG from nsd. - small stuff with makedist.sh, CREDITS, Features, make test. 30 May 2006: Wouter - tsig pre-allocs the rr_region, not at runtime, tsig_create_record(). - redid some region work for tsig. Now has another temporary region for the context data. User is only aware of the region passed at start that exists for the lifetime of the struct. During TSIG checks no more mallocs are done, only region_free_all and region allocs (of small size). - checkconf, port is stored as a string. - tsig now keeps a max_digest_size for giving reserved space. - AXFR does tsig every 96 packets (and first and last packet). - tsig signing works for all queries. SOA queries, ... If you configured the key in the config file, you can use that key for any query for any zone. Except for NOTIFY and AXFR queries; those are only allowed for the zone (and source ip address) which are configured in the config. - cleaner compile with tsig disabled. - fixed unknown key error reply in tsig. 29 May 2006: Wouter - The nonblocking write routines disable silently if they have nothing to do. - put xfrd read/write state routines (almost 500 lines of code) into xfrd-disk.c file. - little readme blurb on xfrd state file for the operator. - put ipc code in its own file for ease of reading. - removed --disable-axfr, you can control this via acls. With no provide-xfr: statements, a zone will not do axfr. 25 May 2006: Wouter - fixed reload sending; it checks for EAGAIN and EINTR. - reload sends parent quit command blocking to make sure of arrival. - send_children_quit in parent uses nonblocking writes and closes the pipe to signal the child to quit (even if the write does not come through, the closed pipe will cause the child to quit). - need_to_send_STATS flag in parent. - reload has its own ipc-listening handler in server_main. - nonblocking writes for server_main; this solved write-blocking race. - another race condition solved, if a process dies, half a read or write buffer could be left behind on another process. These are dropped. Now: * The server_main drops ipc from dead children. * The server_main drops ipc if xfrd dies. * The server_main drops xfrd(old) and all children ipc on reload. * The xfrd drops ipc to parent on a SOA_BEGIN from reload. So after reload, but parent and xfrd start with clean ipc buffers. 24 May 2006: Wouter - unit tests print progress while running to stderr. Included license of cutest with its source in svn repository. - stack type (for the IPC buffer of zone update dirty). And unit test. - only update zone-is_ok if needed to reduce memory copy on write. - split off conn_write() from xfrd tcp nonblocking write routines. - nonblocking writes for xfrd. 22 May 2006: Wouter - ported over minor nits from 2.3.5 NSD fixups. Cast to (void) unused function return values. - removed kill signal to children, superfluous due to quit cmd ipc. - moved is_ok for zones to the zone_type in namedb, not in the options, it is a runtime value not a config value. For zones that have no data, parent and children keep no state. 12 May 2006: Wouter - fixed up usage print for zonec to include -f option. - xfrd send notifies. - server no longer sends SOA INFO for master zones. - removed possible debug log print of a null string. 11 May 2006: Wouter - nsd.conf.sample shows defaults for ip4-only, ip6-only and debug-mode. - SOA_BEGIN message on start of reload sending soa info so that xfrd will not reply with expire-notifications and thus deadlock both on blocking writes (and no OS buffer on the pipes). 10 May 2006: Wouter - nsdc.sh is set +x after creation. - improved error message when zone in db has no config info. - support for broken nsec3 chains (if the one with the SOA bit is complete, it is OK for there to be other nsec3 chains with different parameters in the zone). 9 May 2006: Wouter - Fix for finding bad zone when populating SOA info on start. it would find a parent zone instead of the zone in question ( which is empty). - request-xfr: AXFR 10.0.0.153 keytouse syntax to interoperate with NSD machines. Will only send AXFR queries to the machine. - documented AXFR option in nsd.conf.5 manual page, and updated nsd-checkconf, nsd.conf.sample. - made 'skipping zone' log entry clearer (Sam Weiler asked). 8 May 2006: Wouter - updated zparser.y to handle empty nsec_seq lists. for empty nonterminals in NSEC3. - nicer without ambiguous grammer. 5 May 2006: Wouter - nsd-notify handles option -y key:secret to TSIG sign outgoing queries. - the acl checks now verify TSIG signatures on the query. - iterated_hash compiles with ssl disabled. - new ipc NSD_ZONE_STATE sent by xfrd to nsd process. notifies nsd of the state (ok or expired) of a zone. - reload process waits for the old server_main to exit to make sure there is no race condition listening to the NSD_ZONE_STATE messages generated when reload sends SOA_INFO to xfrd. - server_main and children all set zone_ok state in config options. also server_main so that newly forked children get the right state. - if a secondary zone is expired, NSD returns SERVFAIL. a transient error, so resolvers try again later. - SOA_END ipc message, sent by reload to xfrd, so it can repeat all zone states (which can have changed during reload). - zone_is_ok kept in config section so that state for zones without data is not lost. Those have no zone_type*. - secondary zones start in the expired state. - if expired zones are updated, then NSD gets the go ahead from xfrd after reload sends SOAINFO/SOAEND msg, so it is really updated in nsd memory. - fixed tpkg xfr_1 to have longer expiry times (from 0 and 3 seconds to 2000 and 3000 seconds), so the zone does not expire during the test anymore. 4 May 2006: Wouter - when a new lease is acquired xfrd_packet_newlease result is used. - if a zone is lost in nsd db, xfrd will update state to match. - IXFR can use TSIG in queries and verify responses. - Fixed memory leak in xfrd tsig handling. 3 May 2006: Wouter - forward of 2.3.4 RELNOTES into trunk. - debug log statements to track xfrd request rounds. - removed memleak from handle_passed_packet in xfrd. - faster find_zone in difffile.c. - nsd-patch writes commit log entries into zone file. - took some tsig.c enhancements from 3 branch, -> if key or algo changes during connection, return bad_key, -> debug statement neater. - nsd adds tsig keys to tsig keyring at startup. 2 May 2006: Wouter - ifdef inet6 back on ss_family usage in server.c. - nsd-checkconf ip6 ifdefs improved. - xfrd tries servers 3 rounds, then waits for next retry. 1 May 2006: Wouter - off_t used for 64bit fileio. - searches for smallest unused part and sets diff_skip to that. - doc comment near the region_free_all for every query about malloc speed. - null ptr in strcmp does not work on bsd, fixed nsd-checkconf. - made nsd.conf.sample.in so the sample gets prefix-corrected. - removed nsd.zones.sample. - makedist.sh added manual pages for nsd-xfer nsd-patch. - install/uninstall nsd-patch, nsd-checkconf and manpage. small update readme. 28 Apr 2006: Wouter - ixfr >64k in xfrd. - fixed length of new commit parts. - fixed multiple ipc reads in xfrd. - fixed multiple packet ixfr read in diff file. Miek: - Forward port fixes for nsd-xfer and nsd-notify 27 Apr 2006: Wouter: - nsec3 review fixes. - diff file format expanded for >64kb transfer support. - diff reader adjusted for >64kb. Jelte: - small non-null options check in nsd.c. Miek: - updated nsd-checkconf for zone parse shell script support. 25 Apr 2006: Wouter - Tests on NSEC3 code. Fixed that the unsecure delegations also have _ds_ parent nsec3 prehashes, so that they get proper NSEC3s. NSD will serve NSEC3s to prove 'opt-out' also if the opt-out bit is (erroneously) not set. - For the 05pre2 draft section 5.4.8.1. QTYPE is NSEC3, only NSEC3 RRsets at name. Fixed that RRSIGs present do not matter. And also the closest encloser proof in that case fixed. If wildcard exists below zone apex servfails (cannot disprove it and NSD cannot instantiate the wildcard at that point). 24 Apr 2006: Miek Miek: - forward port nsid (disabled by default) Wouter: - nsd-patch manual page. - minor MacOSX port fixes. - xfrd-reload-timeout: config option. - if you set the xfrd reload timeout to -1 it will not automatically reload after a transfer. User can reload. - reload timeout is a wait period after the reload is triggered. - more verbose acl logging. Validated acls are logged in detail. Invalid acls are only logged in debug mode, level >= 1. - log message when xfrd tcp connections max out. - if unknown NSEC3 hash type (not SHA-1), disable NSEC3. - xfrd randomizes the timeouts, within 10% of original, to spread out activity. Short timeouts < 10 seconds are not affected, and will give activity bursts (on startup for example). 21 Apr 2006: Wouter - put NSEC3 code in nsec3.c and nsec3.h. - iterated_hash only adds the salt if salt_len > 0. - added some assertions and cleanups to nsec3 code. - prehash also calcs the nsec3_last domain*. - dbaccess when reading in will set the rr_type.owner value. - changed namedb_find_zone to domain_find_zone, log msgs. - implemented logic from nsec draft 05-pre2 section 5.4.1 - 5.4.8. NSEC3 responses only happen for nsd compiled with --enable-nsec3 and for zones where an NSEC3 with the SOA bit set exists. - added prehash pointer to ds parent side cover for opt out. - removed dynamic plugins. Dynamic plugin support is an explicit non-requirement (under creeping featurism). - in domain table create root nsec3 ptrs are NULL. 20 Apr 2006: Wouter - Unittest of base 32 encoding. - unittest start for iterated hash. - fixed for ctrlc in debug mode. - delete zparser_conv_long, not used, not needed - nsd-xfer will display NSEC3 correctly. zonec parses. - improved usage() line from zonec, about -c none, must be -C. - base32 printed in lowercase (canonical format for DNS). - NSEC3 added prehash pointers to the namedb. - NSEC3 autodetects presence of NSEC3 in zone and parameters. 19 Apr 2006: Wouter - port fix base10 in zonec conv short from 2_2 branch to trunk. and conv byte, algo, certificate, long. - configure option to enable NSEC3 (--enable-nsec3) support. - from Ben Laurie's NSEC3 patch, loaned the parse code, base32 conversion code and iterated_hash. With some small modifications. The type rrdescriptors are indexed by value below SPF, and in rdata_wireformat_to_rdata_atoms BINARYWITHLENGTH checks for end of buffer. Also parser checks for '-' salt. Some layout (spaces after ,s). And NSEC3 define is used. strtol used for iterations is base 10. - moved rrtype descriptor table sanity check to unittest. 18 Apr 2006: Wouter - Fixed check for SOA IN, bad ntohs in the check. - minimum timeout also enforced for very low expire times. - report the actual used length of the sockaddr to sento for FreeBSD. 7 Apr 2006: Wouter - modified the kill_nsd tpkg so that it waits up to 10x5 secs for nsd to make the pid file, and it wait up to 10x5 secs for nsd to exit after the kill signal is given. - xfrd checks on startup if there is trailing garbage in the diff file, left there by a previous xfrd killed in action. It then snips off any partial parts, so service can resume. Also the difffile_skip pos is set before any partial record there. - first version of nsd-patch; reads db and ixfrs and updates zones. - moved print_rdata from nsd-xfer to rdata.h to share code. - moved print_rr from nsd-xfer to util.h to share code. 6 Apr 2006: Wouter - notify handler passes acl number that matches to xfrd. - xfrd keeps a next_master for a zone, and sets it after notify. when notified nsd will try to contact the master that sent the notify, if send from an address that is both in acl allow-notify and request-xfr. - xfrd closes its tcp and udp sockets on exit. - default names for diff file and xfrd state nicer. - fixed up kill nsd grep on ps. - fixed up race conditions in test script for kill nsd wait for pid file creation by nsd, and grep -v grep in check. - in nsd signal-flags inherited from the parent are zeroed when a server_child starts. Also the server_child switches back to NSD_RUN mode when a bad mode happens. - check if ixfrs start from the version in memory. - if IXFR/AXFR ends in a serial that is newer than the serial that was sent in an notify, update the notified serial. 5 Apr 2006: Wouter - added lowerbound for retry timeout. - added extra assertions to xfrd-tcp.c, saying that the waiting line for tcp connections must be empty if the counter is below max. - setup so that the first master tried is the first in acl list. - diff file skips OPT and TSIG RRs if they are put into the answer section. - if IXFR contains an RR to delete that does not exist, nothing happens. - update zone for NS, RRSIG also if multiple RRs in the rrset. - difffile: create zone struct also if domain exists already. - difffile: destroy temp region on error. - difffile: in delete_RR, create temp region outside of the routine, so no alloc region, destroy region for every deleted RR. - difffile: for IXFR: do not delete final SOA RR. - difffile: unknown parts in file is an error. - difffile: EOF on last packet is ignored w/o giving an error. 4 Apr 2006: Wouter - Addes EACCES to the netio dispatch error bailout. - Removed EACCESS (probably due to log_msg), error on close xfrd pipe is small, main process closes its end, and hopes for the best). - review: return on error condition in xfrd_tcp_open fixed. - review: expired when time >= expire_time, so it will not wait for the retry after expire until it will detect the expiredness. - removed duplicate lines from xfrd_handle_zone_timeout. - review: copy of uint32_t using memcpy to avoid unaligned memory accesses. - review: fd=-1 removed from set_refresh_now; only does timer. - on a tcp timeout it will retry immediately (instead of waiting another retry timeout). This means if you set refresh_now, it will interrupt a tcp-timer for a fresh retry with the next master. - put null in buffer for xfrd read state. - log msg uses string that exists instead of overwritten buffer. - read entry sets refresh depending on current time, and makes sure not to check soa contents if none provided. added explanatory comments. - EACCES back in check. - server_main first checks for terminated children, then select(). So when select is interrupted, by kill or quitting children, it will first see if it has to quit itself, before restarting the children. - destroy tempregion xfrd read on error. - check for serial existance in xfrd_handle_incoming_soa. - handle_incoming_soa uses set_timer_refresh routine. and can handle expire times < refresh times. - log msg for udp socket() error. - review: xfrd_parse_soa_info email parse uses correct buffer spot. - added a lowerbound to refresh interval (=1 second now). - upon receipt of a IXFR, if the serial is older than the notified serial, the zone stays refreshing (but the ixfr is saved). 3 Apr 2006: Wouter - Added buffer length check to internal ipc. - split out packet_read_query_section from the process_query_section routine (and moved to packet.c/h). - xfrd reads passed packet via ipc. - ported over fix to 2_2 on missing rr types by removing the duplicate RRtype array, and using rrtype_to_string. - xfrd handles notifies. immediately starts updating. - xfrd state file format fix. - removed libwrap stuff - superseded by acls. use provide-xfr: statements for your zone in the config file. updated README for this. - updated tpkg tests for axfr to use provide-xfr: 127.0.0.1 NOKEY - review: move var create to start of function (xfrd_init()). 31 Mar 2006: Wouter - zone type has a pointer to zone options. - nsd options has an rbtree to find zone options in. - nsd checks acl for incoming notifies and replies error or confirmation. - nicer layout in options.c. - updated makefile dependencies. - fixed sz for SOA_INFO ipc, which was too small. - notify is sent to server_main, server_main sends it to xfrd. 30 Mar 2006: Wouter - include: documented in manual page. - MAXINCLUDES define in one place (config.h). - configure checks for strptime in include files. - use %d instead of %zd (sparc5 machine does not get zd). - use region_strdup in configlexer. - added a check for EINVAL in dispatch - will abort on the error instead of busy hang. 29 Mar 2006: Wouter - \r for config lexer. (similar changes to zonelexer). - forward port of fix to 2_2 branch: short int in var_arg is promoted to int, according to B. Laurie. The same logic for %o, %d %x would hold for %u I think. - in XFRD, soa prim_ns and email domain names are kept in a max size buffer. - split up dname_parse into parse from string to wireformat and parse from wireformat to memoryformat, so both can be called. - split up dname_make_from_packet into reading the wireformat from the packet and the dname_make, so both can be called. - xfrd reads all soa info from incoming xfr packets. - xfrd will ignore TC bit on tcp channels. - nsd sends xfrd all soa info, including ttl and dnames. - config file now has an include: filename directive. 28 Mar 2006: Miek - forward port fixes for zone compiler and \r. svn:1926-1927 - add DO bit MASK and remove the !! construct 17 Mar 2006: Wouter - according to axfr-clarify, added comments that we check more leniently on further responses on a TCP stream. 16 Mar 2006: Wouter - Fixed up SOA INFO Send routines. Send from server works. - niced up xfrd state file. - Fixed up so that after a reload it will continue in diff file where it left off. - made send of SOA info use write_socket, in case of short writes. - redesigned xfrd_tcp_read to use the same code for ipc read. - no free()s before xfrd exit. - xfrd handles incoming SOA INFO ipc packets. - removed debug, updated zones get SOA INFO sent. 15 Mar 2006: Wouter - Fixed up domain table insert, it was being used in routines that originate from nsd-xfer that do not set compression numbers correctly. - memleak fix in diffile in case of error. - difffile processing works so that NSD can read an axfr saved into the nsd.diff file. (xfrd already request and save it there). - split off xfrd tcp handling into xfrd-tcp.c. - cleaned up send_udp in xfrd, and read_state. - removed xfrd tcp_send_blocking. - xfrd sets state from ok to refresh to expired based on timeout. - xfrd sets reload timeout. - Added zone updated to keep track of zones that are changed after a reload. These zones get their information notifified to xfrd. - removed unused zprintrr declaration from zonec.h - nsd sends soa information to xfrd. 14 Mar 2006: Wouter - TODO updated - worked on reload ixfr. It will add/delete RRs and zones. - xfrd receive parse of xfr messages improved. writes commit. - server compressed_dname_offsets table is increased if reload creates extra names. - difffile will create zone and apex if not there (i.e. the zone is configured but no data file provided). - bit more verbose in error message for bad diff file. - Typo fix in sample config file. 13 Mar 2006: Wouter - configure sets fseek (fgetpos/fsetpos) to use 64 bit interface with _FILE_OFFSET_BITS=64. - nsd will skip loading the .db if the DB checksum is the same. - Miek added trace test and nsd kill test. - Wouter worked on diff file c. 10 Mar 2006: Wouter - Cleanup of UDP/TCP code in XFRD. - xfrd now has tcp max connections and managing. tcp read/write. - response TC on UDP ixfr, starts TCP. - sends correct ixfr and axfr queries, a bind server answers. - made packet_skip_dname() public. - sets read/write event flags for tcp fd right. 9 Mar 2006: Wouter - Removed header from DIFF file format. CRC not that imporant there, you have to check the packets anyway. - cutest rbtree removed unused clean_rbtree and always_fail routines. - xfrd timeout handler, more work. Checks expire. 8 Mar 2006: Wouter - xfrd sends UDP xfr request to master(s) with timeouts, and stores returned data on disk. - updated dependencies and declaration of write_soa_buffer. 7 Mar 2006: Wouter - Fixed printfs for size_t warnings on Mac OsX. 6 Mar 2006: nsd-team * Wouter: xfrd read and write work. Statefile is "nsd.xfst". * Wouter: nsd-checkconf checks dname parse of zone name:. * Wouter: updated difffile in parser.y, production in server: clause. * Wouter: zonec now takes -C for 'no config file' option. * Wouter: updated configyyrename.h for bison 1.875d on sparc. * Miek: zonec -h and nsd -h exit with exit code = 0. * Miek & Wouter: updated tpkgs to work again. * Wouter: xfrd read handle soas, handle soa_incoming part. * Wouter: moved compare_serial() from nsd-xfer to util.h. 4 Mar 2006: Wouter - xfrd zone and soa memory structure definitions. - xfrd init zones. - xfrd read and write state file code. - option for difffile: and xfrdfile: config lines. 3 Mar 2006: Wouter - Removed double kill after reload. Only socket cmd send. - Added code to handle race condition where xfrd is restarted during a succesfull reload. Afterwards, the new server_main only has the old xfrd pid, new xfrd is an orphan. Solution: when xfrd closes cmd channel (i.e. it quit) unexpectedly, send sighup to all processes in the group. This should quit the orphan & all children & reload the server_main, which will fork the children and xfrd again. 2 Mar 2006: Wouter - Added nsd-checkconf.8 to makedist.sh replace list. - DIFF file format updated. - removed tsigkey->server value, it was read in, but unused. - new function to add config file keys to tsig. - nsd-checkconf checks parsing of keys. - Updated sample key file with valid keys. - added first xfrd files. xfrd is started from server_main. xfrd listens to server and server to xfrd. xfrd is restarted if it dies unexpectedly. xfrd quits when server signals it. xfrd survives nsd reloads. - nsd_options no longer global variable. 1 Mar 2006: Wouter - Nicer text in nsd.8. - nsd.c prettier code in option handling. - zonec.c code prettier in option handling, also chdir bug removed. zonec uses the zone definitions in the config file. updated zonec.8 and usage(). - nsd also chdirs to the zonedir, otherwise nsd and zonec would try to read the database: file from different directories. .(it does the chdir before the chroot call.) - new calling syntax for zonec and nsd, because of new config file. - options added acl acceptance tests (no tsig yet). - added unit test for options.c - for acl tests. - zonec removed unused vars, nsd-checkconf print arguments. - nsd-checkconf.8 manual page. 28 Feb 2006: Wouter - checked in options.h and config parser code. - also nsd-checkconf that will test a config file .(and optionally show what was read). - default identity has a spelling error. - Small fix (typo in example) to config manual page. - Added ; to configparser.y to please bison 1.75 on bsd. - Will check for blocked addresses in outgoing acls. Also ranges. - Check configuration tpkg test added. Uses checkconf. - checkconf does extra semantic tests. i.e. enable absent features. - tcpcount and servercount cannot be negative. - updated nsd.conf.5 manpage for @port syntax. - changed config parser: allows empty server: part (defaults). - made nsd.conf.sample file. - put option to configure for CONFIG_FILE nsd.conf location. Note. Already nsdc.conf exists. Both exist now. - updated makefile dependencies (gcc -MM). - getopt optstring in nsd-checkconf updated ("v" only option). - Added config .o files to nsd and zonec. This compiles. - Added commandline option -c configfile to zonec and nsd. configure defaults < configfile < commandline options in importance. 24 Feb 2006: Wouter - Added compute_crc in util.h and unit tests for it. - in cutest.tpkg the number of unit tests was hardcoded in the tpkg package. Removed the dependency, cutest exit value indicates if any failures happened. - Added crc at end of NSD-database format. Unique per db. upped db version to 7 because of this. - Tested that crcs are big/little endian correct. - Added DIFF file spec - updated tpkg213 which compares md5 on a zonefile for new format. - added nsd.conf.5 manual page with a draft contents. 22 Feb 2006: nsd-team * Miek: Changed over to Cutest testing framework. * Miek: fixed typo in netio.h * Miek: fix syntax in rbtree.c put functions on multiple lines. * Miek: unit test tpkg for cutest. * Wouter: fixed ptr bug in rbtree unit test. 17 Feb 2006: Wouter - rbtree_delete is added and works. Unit tests are there too. - Changed tail recursion in rbtree_delete to while loop. - Tagged this version as NSD_3_signalsocket_solution. It is the stable 2_2 branch with cleanups, portable, and signalhandler solution by socket communication redesign. 15 Feb 2006: nsd-team * Wouter: Fixed server_child would wait for two kill signals before quit. * Miek: don't check for port==0 pkt, just try to send them. Forward Port of 2.3. * Wouter: Removed unused, not substituted, @nsdxfer@ from Makefile.in. 14 Feb 2006: Wouter - Added unit tests for rbtree. Extensive testing of all functions. - Added tpkg unit test. - configure tests for CUnit(optional lib for unit tests). Makefile cleanup so it works on non-gmake on freebsd. 13 Feb 2006: Wouter - Removed timespec_add(current_time) in server_main, the timeout was relative, not absolute. This fixes EINVAL on the timeout on freebsd. - Added check in configure for compiler flags. Used for -Wextra. - Added check in configure for va_list definition conflict between stdio and stdarg. This happens on DEC Alpha/Debian. - removed --enable-mmap configure option. There is no mmap support in the current codebase. - renamed local prev to next in domain_next() in namedb.h. - Removed heap.h. It was not used. Heap and rbtree are mingled anyway. - in netio.c, in dispatch, it would store the next pointer 'in case the handler removes itself'. But if the handler removes that next. Then it would fail. So stored the next in struct netio. This removes a potential bug. Netio_dispatch is not reentrant. Reentry would need a list of iterator* in struct netio. - Changed process_query() to server_process_query(). It is too similar to query_process(). 10 Feb 2006: nsd-team * Wouter: Improved configure.ac to detect pselect in sys/select. The check works on freebsd(yes) and fedoracore 3 and 4 (no). I hope it also works on Solaris. Also various other protoypes were implicit: chroot, strptime, ... These are also solved. * Wouter: Checked configure on sparc5(solaris). Added check for ctime_r in time.h (for tsig.c). This conf also works on freebsd/linux. * Wouter: Updated dependencies in makefile for plugin headers. These are included only when --enable-plugins is present. * Wouter: Added a send quit over socket to kill commands in server_main, These act when the fork children fails. If the kill fails, the socket command hopefully still works. * Wouter: Put reload code into a separate function. It communicates with a socket to the old parent, and sends it a quit command. This works and terminates the old nsd. Left in the kill as a double failsafe. If the reload process dies, then the parent closes the socket. * Wouter: Separated the signal mode from the socket-determined nsd->mode. Every signal function has a variable, so that multiple signals can arrive. Only the number of signals of the same type is lost, but not important for nsd. The signals are handled in turn by the run loop. This completes the coding to remove signal race conditions: - nsd uses sockets to communicate with its subprocesses(server,reload). - signal handler routine contains no lengthy system calls. - signals cannot overwrite a previous signal. * Wouter: fixed problem where nsd->mode and mode are different in server_main. Nsd would kill the children, but then restart them again. 09 Feb 2006: nsd-team * Wouter: Updated dependencies in Makefile (regenerated them with gcc -MM). * Wouter: Used splint on the source (with settings to reduce spam.) And came to the following changes: - In util.h, make it respect HAVE_CONFIG_H and HAVE_SYSLOG_H. Also it now defines fallback values for #defines in syslog h. - Added explicit cast to (unsigned int) in snprintf in dname.c, dname_to_string routine. * Wouter: Used extra warnings during gcc compile. -Wextra -Wall -pedantic -Wbad-function-cast -Wmissing-declarations -Wmissing-prototypes -Wnested-externs -Wold-style-definition -Wstrict-prototypes -Wdeclaration-after-statement. Using -Wtraditional gives too many warnings. * Wouter: Found a problem with pselect. sys/select.h does not by default provide the pselect function definition. configure script is adjusted to test for this and enable _XOPEN_SOURCE=600 to get it. Found this using the gcc warnings. * Wouter: dname and rbtree test apps were in make clean target, but do not exist anymore. Removed from make clean target. * Wouter: in util log_file() the epoch time_t is passed to printf without an int cast. Found using extra gcc warnings. * Wouter: In server.c fixed some signed-unsigned comparisons using the extra gcc warnings. - in shutdown and int was used instead of size_t. - in server_main timeout(signed) was compared with unsigned. - unused variable in new handler functions. - in handle_child_command int i instead of size_t was used. - in zonec the process_rr routine was missing (void) as paramlist. * Wouter: Added -Wall and -Wextra when --enable-checking is enabled. * Miek: Ported over the big fat enable checking configure warning. * Wouter: fixed configure check for pselect on freebsd. 08 Feb 2006: nsd-team * Wouter: In server.c also sockets from unexpectedly dead childs are closed. * Wouter: in nsd.c and server.c cleaned out the signal handler, so that it only includes two switch/if statements and alters only the mode. No more calls to alarm(), waitpid(), write(), log_msg(). Instead the work is done in the runloop in server.c and sent by socket. Also the parent now waits for children. Parent restarts them. * Wouter: Fixup, the children will quit if the parent closes the command socket. If parent is killed, they will exit too. * Wouter: The server_main now listens to children command channels. Included timeout to check for terminated processes. Test says that new signal handler works, and child->parent comm. 07 Feb 2006: nsd-team * Miek: configure.ac version to 3.0.0 * Miek: looked at: buffer.{ch}, answer.{ch}, dns.{ch} those files don't have any changes, except for dns.{ch} for the explicit compression. * Miek: looked at: zlexer.lex and zparser.y; only changes there for the database changes. * Wouter: Changed buffer in write_pid from 16 bytes to 32 bytes, this makes 64 bit numbers fit in the buffer. * Wouter: Socket connection between parent and child nsds added. But sighandler now in worse shape. Need to close them. Remove kills. * Wouter: close the parent and child command channel sockets in shutdown(). nsd-3.2.16/doc/NSD-FOR-BIND-USERS0000664000175000017500000001564010452415241014530 0ustar matjematjeNSD for BIND users ------------------ Contents 1. Zone compiler. 2. Authoritative only. 3. Config file format. 4. Keys not per IP address. 5. NOTIFY of NS-entries. 6. Less options. 7. Master-Slave meshes. 8. AXFR behaviour. 9. Ports. 10. nsdc needs no secret to talk to the server. Please see the README for general information. This document assumes the reader is familiar with BIND tools and explains the differences between BIND and NSD. 1. Zone compiler. In its memory NSD maintains fragments of data that are ready to put 'on the wire' without a lot of additional work by the server. Those fragments of data need to be compiled from the zone file. Therefore NSD has a zone compiler that translates the text format zone files into a binary format database file that the server reads. 2. Authoritative only. NSD only serves authoritatively. So, NSD does not provide caching, and does not provide recursion, or resolver functionality. NSD can, in other words, function as master or slave server. This also means no root zone '.' type hint is used; leave out the root zone entirely from your configuration. NSD does not cache the root. NSD will not provide an upward referral in case an authoritative answer cannot be found. Because of this design choice (see Appendix B.1 of the REQUIREMENTS file) NSD does not need to maintain knowledge of the root-server set and there is no need for a root.hints file. Also leave out localhost zones from NSD config. 3. Config file format. The config file for NSD nsd.conf(5) is different from BIND named.conf(5). See the manual pages for differences in syntax. The zone files with resource records have the same format however. A short configuration file for BIND can look like this: // Name server configuration named.conf options { directory "/etc/dns"; pid-file "/etc/dns/pid-file"; dnssec-enable yes; listen-on-v6 { any; }; recursion no; }; // logging options for the DNS Server logging { channel mainlog { file "/var/log/dns.log" size 10m; severity info; }; category default { mainlog; }; }; // root hints zone "." IN { type hint; file "root.servers"; }; zone "localhost" IN { type master; file "localhost.zone"; allow-update { none; }; }; zone "0.0.127.in-addr.arpa" IN { type master; file "localhost.rev"; allow-update { none; }; }; // authoritative server for example.com zone "example.com" IN { type master; file "example.com.signed"; }; The equivalent configuration file for NSD is shown below. Note no ;s at the end of statements. No braces {}, and comment is with #. # Name server config for NSD, nsd.conf server: zonesdir: "/etc/dns" pidfile: "/etc/dns/pid-file" # dnssec is automatically enabled in NSD for signed zones. # ip6 is also enabled for NSD. (ip4-only: yes to turn off). # NSD does not do recursion. database: "/etc/dns/nsd.db" # logging clause comes here, no size or severity options. logfile: "/var/log/dns.log" # NOTE: no root hints. # no localhost, and no 0.0.127.in-addr.arpa zone. # authoritative server for example.com zone: name: "example.com" zonefile: "example.com.signed" 4. Keys not per IP address. BIND associates TSIG keys with an IP address. When communicating from/to that address BIND will TSIG sign. NSD associates TSIG keys with the acl entries, when performing these functions NSD will sign with TSIG. It is thus possible to configure NSD to use a different key for notifications then for zone transfers, and a different key in one direction from the other. Additionally, NSD will reply TSIG signed queries with TSIG signed responses. In BIND you might have a master that uses tsig for zone updates. // ... rest of named.conf config file // the TSIG key shared secret with the slave server key key23.example.com. { algorithm hmac-md5; secret "6KM6qiKfwfEpamEq72HQdA=="; }; // when BIND communicates with this server, use the key server 168.192.0.15 { keys { key23.example.com.; }; }; zone "example.com" IN { type master; file "example.com.signed"; allow-transfer { key key23.example.com.; }; }; For NSD the master configuration would look a little different. # ... rest of nsd.conf config file. # The TSIG key shared secret with the slave server key: name: "key23.example.com." algorithm: hmac-md5 secret: "6KM6qiKfwfEpamEq72HQdA==" # no need to list the server { keys { keyname; }; }; statement zone: name: "example.com" zonefile: "key23.example.com." # the allow-tranfer and server statements from BIND rolled into one. provide-xfr: 168.192.0.15 key23.example.com. # # since NSD does not send notifies to the servers listed in the NS rrs, # the above server must be explicitly named to get notify messages. # see item 5, below. Note, the keyname is repeated here. notify: 168.192.0.15 key23.example.com. 5. NOTIFY of NS-entries. BIND sends notification messages automatically to the servers named in the SOA and NS entries of a zone. NSD does not. It sends only to the 'notify:' entries in the config file. If you want NSD to send notifications to these servers, include notify: statements in the config file for them. 6. Less options. NSD has less options than bind has. It is designed to be small. Some options that are *not* available in NSD are: provide-ixfr trusted-keys {} controls {} logging options lwres {} rrset-order recursion yes; cache options zone types: hint, forward, stub view clauses 7. Master-Slave meshes. NSD can be configure as both a slave of a (hidden) master and as a master to further slaves as well. This way meshes of name servers can be created, like with BIND. 8. AXFR behaviour. To do a manual AXFR, nsd-xfer will perform like the BIND tools. But, the initial query for the SOA is done by TCP, where the BIND tools use UDP for that SOA query. According to RFC (1034, 1035) specs, both UDP and TCP for the initial SOA probe are OK. An AXFR initiated by the built-in transfer process will not start with a SOA query at all. The first packet of the AXFR transfer will be used to determine the SOA version number in that case. This is a conscious breach of RFC spec to ease implementation and efficiency. Note that usually the built-in transfer process will request an IXFR, and preceed the IXFR with a UDP IXFR request like the RFC says. 9. Ports. Nsd can be configured to run on another port than port 53. See the 'port:' statement in the nsd.conf file. Access control list elements can be appended with @port_number to refer to a specific port only, such as 10.11.12.100@8853. NSD will not set its source port for outgoing connections to be equal to the configured port, ephemeral ports are used for notify, ixfr and axfr requests to other servers. 10. nsdc needs no secret to talk to the server. The rndc tool for BIND named needs a secret to communicate securely with the server. rndc is designed to work on remote machines. The NSD nsdc tool does not need that. It works on the local machine, and sends signals instead of opening a socket. Since nsdc is on the local machine a secret is not so opportune. nsd-3.2.16/doc/NSD-DATABASE0000664000175000017500000000310410507203415013624 0ustar matjematjeNSD 1.4-2.0 DATABASE FORMAT NSD 3.0 DATABASE FORMAT (adds crc at end). As of NSD release 1.4 the database is extensively redesigned. The main goal for the redesign was to accomodate DNSSEC. The idea of the database is that it stores RRsets in stead of complete answers. Also the name compression is done run time. NSD 1.2 did all compression at zone compile time. This has the following tradeoffs: - the database is smaller (less duplication of material) - the answer generation is slower (~ 15 %) Is was already suspected that DNSSEC would make NSD slower, that it will be only about 15 % is a big plus. That the database doesn't blow up in your face is also a big plus. The database is constructed as follows. MAGIC ZONE_COUNT [*] dname of zone dname of zone ... DNAME_COUNT [**] dname dname ... DNAME (index to [**]) ZONE (index to [*]) TYPE CLASS TTL #rr in rrset foreach rr #rdata rdata_1 rdata_2 ... rdata_N NULL TERMINATED CRC (32 bits crc sum over all previous bytes) MAGIC Dname's that can be compressed at compile time are compressed. Those are stored as an index into DNAME_COUNT. The rdata is stored as a uint16_t, where the first byte indicated the length of the data. The data itself is stored in wireformat. nsd-3.2.16/doc/RELNOTES0000664000175000017500000011734412173225560013313 0ustar matjematjeNSD RELEASE NOTES 3.2.16 ================ FEATURES: - New config option "ip-transparent:" to allow NSD to bind to non local addresses. Default no. - Use IPV6 minimum MTU settings with TCP to reduce failures that are caused by delays in learning working PMTU when communicating through a tunnel. - Bugfix #496: Support for EUI48 and EUI64 RR types. Experimental, turned off by default. Enable with --enable-draft-rrtypes. - New config option "rrl-slip:" to set the average number of packets discarded before we send back a truncated response. - New config option "rrl-ipv4-prefix-length:" and "rrl-ipv6-prefix-length:" to set the prefix lengths. - Improved RRL logging, also print triggering query src address and QTYPE. - Provide RRL documentation in nsd.conf.sample. BUG FIXES: - Bugfix #357: Parent process waits until children closed down sockets, to prevent NSD failing to bind to sockets when restarting. - Bugfix #487: lookup3.c determine endianness for BSD systems. - Bugfix #491: pick program name (0th argument) as syslog identity. - Bugfix #494: Exit with return code 1 if socket code fails. - Bugfix #495: Wrong bufsize in dname_to_string for root. - Fix outgoing-interface: Don't fail if family is IPv6 but only IPv4 outgoing-interface is set, or vice versa. - RRtypes ASFDB, RP, RT should not compress dnames. - Check that zone directory is within chroot directory. - Better XFR checking, fallback to AXFR (if allowed) if three malformed XFR packets have been seen. 3.2.15 ================ FEATURES: - Support for ILNP RR types: NID, L32, L64, LP (RFC6742). - RRL, --enable-ratelimit at configure time and config options. - TSIG initialization only fails when there is no digest found at all. BUG FIXES: - Bugfix #478: Declaration after statement (for gcc 2.95). - Bugfix #483: Better error message in case of TSIG error. - Bugfix #485: TTL should not be greater than 2^31 - 1. - Fix RCODE when CNAME loop final answer does not exist, should return NXDOMAIN as stated by RFC 6604. - Fix --disable-full-prehash bug, where after multiple incoming IXFRs, NSEC3 can be removed unjustified. 3.2.14 ================ FEATURES: - TCP writev support. BUG FIXES: - Fix build on OpenBSD (thanks Oliver Peter). - Prioritize notify sender for requesting XFR (thanks Ilya Bakulin). - Fix crash in zonec if TXT string too long (thanks Ilya Bakulin). - tzset before chroot for correct timezone (thanks Camiel Dobbelaar). - Fix --disable-full-prehash bug when nsdc patch happens while ixfr too, it did not rehash the new database. - Bugfix #464: Conditionally define MAXHOSTNAMELEN. 3.2.13 ================ BUG FIXES: - Fix for nsd-patch segfault if zone has been removed from nsd.conf (thanks Ilya Bakulin). - Bugfix #460: man page correction - identity. - Bugfix #461: NSD child segfaults when asked for out-of-zone data with --enable-zone-stats. [VU#517036 CVE-2012-2979] 3.2.12 ================ BUG FIXES: - Fix for VU#624931 CVE-2012-2978: NSD denial of service vulnerability from non-standard DNS packet from any host on the internet. http://www.nlnetlabs.nl/downloads/CVE-2012-2978.txt 3.2.11 ================ FEATURES: - Fallback to AXFR if IXFR is unknown at the primary. NSD considers IXFR unknown at the primary if there is a negative response for the IXFR RRtype. This does not override the value for 'allow-axfr-fallback'. - Allow for reading in new DNSKEY algorithm mnemonics (RFC5155, RFC5702, RFC5933, and RFC6605 (ECDSA)). - Zone statistics, enable with --enable-zone-stats. This stores the BIND8 stats per zone in a configurable statistics file. This option does not scale and should therefore not be enabled when serving many zones. - Support for TLSA RRtype (DANE). BUG FIXES: - Fix for qtype ANY for a wildcard domain in NSEC signed zone: Don't add the wildcard domain NSEC into the answer section. Instead, put the wildcard expanded NSEC into the answer section and keep the wildcard domain NSEC in the authority section. - Fix for accept spinning reported by OpenBSD. - Fix restart failed due to bad ixfr packet because of zone removed from nsd.conf. - Bugfix #453: typo in nsdc man page. OPERATIONAL NOTES: - NSD uses the query name for dname compression again (Fix #235 had as side effect that this didn't happen anymore and is hereby undone). 3.2.10 ================ BUG FIXES: - Bugfix #421: Truncate pidfile on shutdown, before unlink. - Bugfix #423: Fix slow zone transfer processing due to 'Fix is_existing flag for ENT' bugfix. - Fix bug #430: segfault when MAX_INTERFACES set to more than 65K. - Fix configure.ac strptime check for gcc 4.6.2, acx_nlnetlabs update. 3.2.9 ================ FEATURES: - Minimize responses to reduce truncation: NSD will only add optional records to the authority and additional sections when the response size does not exceed the minimal response size. The minimal response size is 512 (no-EDNS), 1480 (EDNS/IPv4), 1220 (EDNS/IPv6), or the advertized EDNS buffer size if that is smaller than the EDNS default. The feature is enabled by default. You can disable it by configuring NSD with --disable-minimal-responses. - Less NSEC3 prehashing. This will make NSD handle zone transfers faster, but will decrease the performance of NXDOMAIN and wildcard NODATA responses. Full prehashing is enabled by default. If you want less NSEC3 prehashing, configure NSD with --disable-full-prehash. Thanks Secure64 for the patch. BUG FIXES: - Bugfix #302: nsd accepts XFR but refuses to re-read the slave zone. - Bugfix #365: set patch style and zonec verbose for nsdc. - First step of bug #369: RRSIG DNSKEY sets zone to be treated DNSSEC. - Bugfix #375: typos in nsd.conf.5. - Bugfix #381: Binary escaped and transfers. - Bugfix #397: Don't allow relative domain names as origin in $INCLUDE directives. - Fix printout of IPSECKEY by nsd-patch. - Fix is_existing flag for ENT when domain that has a shared ENT is deleted by IXFR. (ENT == Empty Non-Terminal) - Fix bug if the zonefile is changed for a secondary but stored transfers are applied, and stop it from applying ixfr to empty zone. The zone is flagged with error and AXFR-ed. - Fix to have no authority NS set processing for CNAMEs. - Fix nsd-checkconf to check tsig algorithms properly. - Set the AA bit on responses that have an authoritative CNAME. - Fix denial of existence response for empty non-terminal that looks like a NSEC3-only domain (but has data below it). OPERATIONAL NOTES: - nsd.db version number increased because NSD 3.2.7 and earlier zonec is not compatible due to the TXT strings change. Please run nsdc rebuild before running NSD 3.2.9 and later versions. 3.2.8 ============= BUG FIXES: - Do setusercontext() before chroot(), otherwise login.conf etc. are required inside chroot. - Bugfix #216: Fix leak of compressiontable when the domain table increases in size. - Bugfix #348: Don't include header/library path if OpenSSL is in /usr - Bugfix #350: Refused notifies should log client ip. - Bugfix #352: Fix hard coded paths in man pages. - Bugfix #354: The realclean target deletes a bit too much. - Bugfix #357, make xfrd quit with many zones. - Bugfix #362: outgoing-interface and v4 vs. v6 leads to spurious warning messages. - Bugfix #363: nsd-checkconf -v does not print outgoing-interface ok. - Bugfix: nsd-checkconf -o outgoing-interface omits NOKEY. OPERATIONAL NOTES: - Use 'make clean' to clean up files that make created. - Use 'make realclean' to also clean up files that were generated by running ./configure. - Use 'make devclean' to also clean up autoconf, autoheader files. 3.2.7 ============= BUG FIXES: - Bugfix #253: Don't put NS RRs in a response with QTYPE=DS. - Bugfix #320: use arcrandom(4) for QID generation if available. - Bugfix #328: nsd-checkconf overrun. - Bugfix #343: nsdc update fix. - Bugfix #347: Wrong NSEC3 returned for nodata response QTYPE=DS no delegation. - Bugfix: Allow for huge amount of strings in TXT (and other) records. - Bugfix: nsdc can now deal with tsig algorithms other than hmac-md5. - Fixed several parts in the documentation, including #306, #345. 3.2.6 ============= BUG FIXES: - Bugfix #314: correctly print NSEC next field, escape spaces and fix label overflows. FEATURES: - Expand command line option '-a' and config option 'ip-address:' with port number. OPERATIONAL NOTES: - Configure options --disable-dnssec, --disable-nsid, --disable-tsig are removed. - Configure option --max-interfaces is renamed to --max-ips. 3.2.5 ============= BUG FIXES: - NSD will not start if chroot is configured, but changing root is not possible (it used to ignore the badly configured chroot). - Make use of the more secure strl* functions. - Bugfix #303: spelling error. FEATURES: - New option 'nsid:', to specify the NSID (Bugfix #298). - The default chroot can be set with --with-chroot=. If not set, by default chroot will not be used (thanks Jakob Schlyter). - Optimized zonec and b64_pton compatibility code (thanks Martin Svec). - Optimized memory allocations. Use mmap/munmap instead of malloc/free. Experimental, by default off. Enable it at build time with --enable-mmap (thanks Martin Svec). OPERATIONAL NOTES: - NSID support is now enabled by default. 3.2.4 ============= BUG FIXES: - Bugfix #269: Additional C99 syntax. - Bugfix #276: Zonec prints debug data to stderr. - Bugfix #286: Document verbosity levels in nsd.conf manual page. - Bugfix #288: Ignore SIGHUP to child processes. - Fix typo in include file for setusercontext. FEATURES: - Support DLV records. - New option 'tcp-query-count:', to limit the maximum number of DNS queries on a single tcp connection. - New option 'tcp-timeout:', to override the default tcp timeout. The default can also be set at build time, --with-tcp-timeout=. - New option 'notify-retry:', to configure how many times NSD should retry a NOTIFY message. - New options 'ipv4-edns-size:' and 'ipv6-edns-size:'. to set your preferred EDNS buffer size. OPERATIONAL NOTES: - UDP/IPv4 sockets have new options set that will disable the DF flag in IP packets. 3.2.3 ============= BUG FIXES: - Bugfix #236: Allow RRs before the SOA in a zonefile. - Bugfix #249: Remove the C99 code. - Bugfix #253: Don't put NS RRs in a response with QTYPE=DNSKEY. - Bugfix #263: Make TSIG algorithm comparison case insensitive. - Bugfix #266: Build failed on systems without strptime. - Bugfix: install hickup. - Fix to use 4096 EDNS limit for IPv6 on Linux. 3.2.2 ============= BUG FIXES: - Off-by-one buffer overflow fix while processing the QUESTION section. - Return BADVERS when NSD does not implement the VERSION level of the request, instead of 0x1. - Bugfix #234. - Bugfix #235. - Reset 'error occurred' after notifying an error occurred at the $TTL or $ORIGIN directive (Otherwise, the whole zone is skipped because the error is reset after reading the SOA). - Minor bugfixes. 3.2.1 ============= OPERATIONAL NOTES: - NSD will now fallback to AXFR, only if the master does not support IXFR. - You can adjust nsdc patch to skip textfile patching. This will increase the patching process, but will not output to zonefiles anymore. By default, this is off. BUG FIXES: - When configuring, don't do strptime test when cross-compiling. - Bug #230: Output non-error messages to stdout. - Better error message when ixfr.db old file format is read. - Bug #218: shared UDP query for all interfaces. - Bug #222: Remove bashism from nsdc script. - Nicer check for SHA-256 functionality. - Fixed some minor memory leaks that occured on reload. - nsdc: check if a lockfile has not gone stale, when lock failed. - Bugfix strptime compatibility function FEATURES: - New configuration option 'allow-afxr-fallback', "yes" by default. If set to "no", NSD will never do AXFR fallback, even if the master does not support IXFR. - Allow file rotation on nsd.log. - The new nsd-patch options -s and -o allows you to skip writing zonefiles and store the output directly to a database file, respectively. 3.2.0 ============= OPERATIONAL NOTES: - Format of ixfr.db has changed. When you are planning an upgrade to the new NSD release, make sure to process the old ixfr.db before starting the new release (by running nsdc patch). - IXFR is transmitted over TCP by default instead of UDP. If you want to continue the use of IXFR/UDP, please modify your zone configuration file to: request-xfr: UDP 1.2.3.4 tsigkey We strongly recommend to enable TSIG if you send IXFR over UDP. When all masters fail to transmit IXFR/UDP, slave will fallback to IXFR/TCP and eventually AXFR/TCP. - nsd-patch prints errors to stderr instead of stdout. BUG FIXES: - Only normalize dnames in rdatas when rrtype is listed in RFC 4034, section 6.2: Canonical RR Form, following draft-ietf-dnsext-dnssec-bis-updates (affects RRSIG and NSEC records). - Typo in zonec manpage. - Bugfix in log_finalize. - Fix race condition between nsdc patch and server reload. FEATURES: - AXFR/TCP fallback in case of failing IXFR zone transfers. - RFC 4635: support for hmac-sha1 and hmac-sha256 TSIG algorithm identifiers, "Bugfix #130". - Configure the source ip-address for notifies (master) and zone requests (slave) in nsd.conf, "Bugfix #148". - nsd-notify and nsd-xfer allow you to configure the outgoing hostname and source port, in addition to the source address. - Additional debug and verbose log messages. 3.1.1 ============= BUG FIXES: - Try to avoid race conditions with NSD reloading and nsdc running, by writing pidfile before closing old parent process. - Fixed NSEC3 memory leak in the case NSEC3 is not needed. - Fixed some memory leaks that happened on error, mostly on zone transfer errors. - Bugfix #191: nsd-checkconf allowed only (max_interfaces-1) interfaces. FEATURES: - The number of maximum interfaces allowed is configurable with --with-max_interfaces= (thanks John Lightsey). 3.1.0 ============= OPERATIONAL NOTES: - Default locations of nsd.db, ixfr.db & xfrd.state are changed to the /var/db/nsd directory. BUG FIXES: - Zone compiler gives more sane error messages when out of diskspace and bug #172: when compiling single zone file. - Changed man pages format from mdoc to mansun, to support the Solaris OS. - Log tcp read error only when connection not reset by peer or when verbosity level is high. - RRs are compared without checking the TTL value. FEATURES: - NSD is now NSEC3 enabled by default. You can disable it by configuring NSD with --disable-nsec3. - Added "hide-version" configuration setting. Enabling this feature stops NSD from answering to CHAOS class version requests. - Added bind2nsd 0.5.0 (http://bind2nsd.sourceforge.net) in contrib/. - Report source and zone for denied AXFR attempts. 3.0.8 ============= FEATURES: - Better logging for nsd-notify (show 'broken' zone) - Add configuration for chkconfig to control nsd service. BUG FIXES: - Fixed nsdc start when nsd already running: do not initialize server, since it is already running. - Fixup bug where data related files are looked up in the wrong directory when chrooted with chrootdir ending with a slash. - Fixup bug where nsd would return FORMERR if received an edns query with version set to zero and rdlen larger than zero. - Fixed strptime, so that zonec will also work on systems with broken strptime (like leopard :-)) - Do not answer nsec3 wildcard information when DO bit is not set - Better logging when creating database failed. - Various spelling errors 3.0.7 ============= BUG FIXES: - Error handling for malformed IXFRs improved. - Fixed man pages, consistent syntax. 3.0.6 ============= FEATURES: - Report source and zone for denied AXFR attempts. BUG FIXES: - More elegant handling of malformed nsec3 records from a zone transfer. - Fixup ignored return value in region-allocator. - Added bind2nsd 0.5.0 (http://bind2nsd.sourceforge.net) in contrib/. 3.0.5 ============= BUG FIXES: - Fixed problem with reload waiting very long. If the OS has a raging herd problem, NSD could block in a UDP operation and that process would stop reload from finishing. Made UDP sockets nonblocking. - Made TCP listen sockets nonblocking. NSD could block in accept. - Handle the new CERT RDATA types defined in RFC 4398 (submitted by Mans Nilsson). - Fixed a bug where zonec would choke on unknown CERT RDATA types. - Change nsd-notify retry timer from linear into exponential backoff (submitted by Mans Nilsson). - Debug flag (-d) behavior changed. Nsd now also forks children when run in debug mode. - Added verbosity mode (-V ) for extra operational logging. - zonesdir default is /etc/nsd. This can be overridden in nsd.conf. - if clients drop the tcp connection this does not result in a logfile entry, unless verbosity is set 2 or more. 3.0.4 ============= BUG FIXES: - zonec will print an error when other data is put next to a CNAME. - Fixup unaligned memory access that could occur when reading ixfr.db with a partial transfer inside. - Fixup for the WKS RR type printout by nsd-patch and nsd-xfer. - Error message 'could not read database CRC' now only given on error. - ./configure --zonesdir= now works to set a default value for the zonesdir: nsd.conf directive. Set zonesdir: "" to disable the change of directory. - Bug: reload crashes with log message 'continuing with old database', and after that no more zone updates. Manual fix is to kill -HUP, but now fixed in software to try to reload again (and again). - Small speedup where xfrd could briefly be busy-waiting. - If master sends IXFR with glue that is already present in the zone this is silently accepted. Printed in debug mode -L 2. To make the log file smaller. - Exponential backoff for zones that never worked to max of 4 hours. For expired zones the SOA retry values are used. - allow-notify acl entries 'NOKEY' match only queries without TSIG. - Answers to valid notifies contained wrong RR counts in the header. The notifies were processed correctly, but now the acknowledgement reply is in correct DNS format. FEATURES: - Added contrib/nsd.zones2nsd.conf python script to convert NSD 2 to NSD 3 config files, contributed by Stephane Bortzmeyer. - The nsdc control script will print 'nsd startup failed' if the nsd executable does not start (due to bad permissions, bad config, ...). 3.0.3 ============= BUG FIXES: - Bug #152: NSD would not use the identity from nsd.conf, fixed. - Bug #153: When running with thousands of secondary zones, NSD would run out of UDP sockets. Caused crash on FreeBSD, errors on Linux ('out of file descriptors'), depending on ulimits. Fixed. - Fixed getaddrinfo error message to be more descriptive. - Fallback to ip4 if getaddrinfo fails for ip6. - Will no longer lose a notify message during reloads (IPC). - Will no longer lose transfer in progress when notified for that zone. - Nicer error when operator forgets to rebuild after deleting a zone. 3.0.2 ============= BUG FIXES: - Nice error from zonec on a wrong configuration zone name. - Nicer warning from zonec when starting secondary zone with no zone file for the first time. - nsdc makes more portable use of 'which' (for SunOS5.9/bash2.05). - Bug #143: Improved handling of zonesdir: directive and relative pidfile, database, diff file, xfrdfile paths in nsdc.sh and nsd-patch. They would not find the files. - Bug #144: LOC RRtype default values for precision wrong. Fixed. - Bug #145: NSD failed to reload cases of simultaneous zone transfer. - Bug #146: NSD fails to write to xfrdfile when chrooted. Fixed. Also fix for difffile when chrooted. - Bug #147: NSD runs out of memory. Fixed, memory is reused. Occurred when running NSD with very big zones and large updates. - nsd -L 1 logging is smaller, -L 2 contains all debug information. (only available for debug compiles). - Bug #149: Fixed text for NOTAUTH error code. When notify is not authorised REFUSED error code returned instead. 3.0.1 ============= BUG FIXES: - nsd-patch prints SOA record at start of zone files. 3.0.0 ============= FEATURES: - AXFR/IXFR zone transfer supported. - NSD requests but does not provide IXFR transfers. - NSD keeps track of SOA timeouts for secondary zones. - TSIG authentication supported. - For queries, for notifies, for zone transfers. - NOTIFY messages of zone updates, incoming and outgoing. - DNAME type is supported, including CNAME synthesis. - config file, nsd.conf(5), place to put TSIG keys, server settings, and lists of ip-addresses/ranges for AXFR/IXFR and NOTIFY. - prepared for NSEC3 (--enable-nsec3), experimental code for testing in workshops. - prepared for NSID (--enable-nsid), experimental code for testing in workshops. OPERATIONAL NOTES: - config file needed, nsd.conf(5) supersedes nsd.zones and nsdc.conf. - AXFR transfers are denied by default. Allow in config file. - Zones only become secondary with "request-xfr:" items in config file. - NSD produces "ixfr.db" file with a journal of zone transfers. Use nsdc patch to merge changes back to zone files and remake db. - NSD produces "xfrd.state" file with zone timeout information. The file is text formatted. - NSD sends notifies automatically, nsd-notify is deprecated and will be removed from the package. - NSD requests AXFR/IXFR and reloads the updates automatically, nsd-xfer is deprecated and will be removed from the package. - Check your config file with nsd-checkconf. BUG FIXES: - contains all bug fixes from 2.3.5 and before. - The sighandler() bug is fixed more thoroughly, by using pipes for interprocess communication. - CNAMEs are followed by the server to different zones and information from that zone is returned. This saves a followup query. - bug fixes (ported) 2.3.6. - nsd-notify will retry max 15 times 5 second retries. - Bug #105: nsdc lacks locking, fixed locking for root user. - Bug #134: nsd: make -N work again - Bug #135: Typo in locking code for nsdc, fixed. - uninitialised variable fixed. - unaligned memory access (on Solaris SPARC), in zonec LOC parsing, fixed. - Bug #138: nsd aborts trying to bind all interfaces if ip6 is not enabled, instead it will fallback to ip4. - Bug #139: resync timer for stats to whole minute. - Bug #140: NSD did not clear CD bit on authoritative answers. - Bug #141: NSD did not clear flags on a formerror reply. 2.3.5 ============= BUG FIXES: - Bug #132: regression, nsd: fix compile with --disable-ipv6 - Makefile: remove gnuisms 2.3.4 ============= BUG FIXES: - Unknown type codes for type code numbers > 48 and < 97 work again. (this implies --enable-checking can be enabled again) - nsd: sighandler() fixes - Bug #118: nsd: nsd_notify waits for a response. Will retry the notify after a timeout. - Bug #124: $(DESTDIR) was added to Makefile.in. - Bug #128: zonec: parser can handle \\ at the end of a string. - zonec: lexer: add \r to the newline delimeter - zonec: use strtol with an explicit base 10 as parameter. (Scott Rose, Roy Arends) - nsd-xfer: print human readable error codes. Change logging to be more in line with the rest 2.3.3 ============= BUG FIXES: - Apply the correct patch to nsdc.sh.in. 2.3.2 ============= FEATURES: - Bug #101: add support for the SPF record. BUG FIXES: - Bug #100: replaced non-portable use of timegm(3) with portable implementation (mktime_from_utc). - Bug #103: nsd: trim the SOA's TTL to the MINIMUM value when returning a negative answer. - Bug #104: nsd: add a time_t timestamp to the log when logging to a file. - Bug #105: nsdc: use a lock file when rebuilding the database (patch by Jakob Schlyter/Ted Lindgreen/Sebastian/Ondrej Sury). - Bug #106: zonec: don't walk all 256 NSEC windows when that is not needed. - Bug #107: zonec: fixed a crash when encountering bad unknown rdata. - nsd: Don't print: "error: nsd is already running as , stopping" when in fact NSD continues to run. - nsd: Minimize the race window in sig_handler(). 2.3.1 ============= BUG FIXES: - zonec: Don't crash when generating error messages outside of zone files. - nsd: when logging to a file the pid is now printed. - nsd: Reset 'boot' time in statistics when reloading the database, since the statistics are reset to 0 on a reload. - nsd-xfer.c: Added '-a' option to specify local address to connect from. Original patch supplied by Walter Hop . - Bug #98: Allow mnemonics for DS and RRSIG algorithm field. 2.3.0 ============= FEATURES: - DNSSEC is now enabled by default. NSD should be fully compliant with RFC4033, RFC4034, and RFC4035. BUG FIXES: - nsd: Ensure that the number of -a flags does not exceed the maximum specified by MAX_INTERFACES in config.h. - nsd-xfer: Use serial number arithmetic (RFC1982) for the zone serial check - nsdc: Don't pass (fake) serial number to nsd-xfer if the zone file does not exist. - zonec: Loading many zones would cause namedb_find_zone to slow down, performance patch by Kazunori Fujiwara. - Bug #96: nsd-xfer did not handle 8-bit domain names correctly. 2.2.1 ============= FEATURES: - The message priority is now included when logging to a file. BUG FIXES: - Zero length RDATA using the unknown RR notation was not working (except for the APL RR type). - Bug #93: './configure' error message containing a comma must be properly bracketed. - Bug #94: nsd-xfer: Handle unexpected EOF when receiving AXFR data. Timeout if no data is received for more than 120 seconds (see the TCP_TIMEOUT parameter in config.h). - Bug #95: An owner starting with an asterisk label ("*") was being treated as its own wildcard child. 2.2.0 ============= FEATURES: - nsd-xfer: replacement program for named-xfer to perform zone transfers using AXFR. TSIG is supported by nsd-xfer but not yet by the nsd server. DNSSEC is also supported. TSIG requires OpenSSL version 0.9.7 or higher, configure using --disable-tsig if you do not have OpenSSL installed. Configure using --with-ssl=path if OpenSSL is not installed at a standard location. CODE CHANGES: - New data structure 'buffer_type' for representing binary buffers that can be read, written, and resized. Data in these buffers is stored in network byte order. This data structure replaces the iobuf field of 'struct query'. BUG FIXES: - Fixed endian problem in WKS record. - Protocol can now be specified numerically in WKS record. - Allow escape sequences (\DDD) in TTL, RR class, and RR type. - The zone compiler now accepts many more characters in unquoted strings such as domain name labels. The characters no longer need to be escaped with a backslash. - Close included files after reading. - Maximum TCP message size is now 65535 bytes. AXFR response packets are still limited to 16383 bytes for optimal compression of dnames. - The TSIG key for AXFRs can now also be stored in the file .tsiginfo. This makes it possible to use TSIG with multiple master servers. - Signals are no longer blocked while performing I/O so the server should respond quicker to signals. - Fixed parsing of LOC rdata. Fractions and altitude were not handled correctly. 2.1.5 ============= BUG FIXES: - Bug #90: handle \000 in TXT records correctly - Fixed undefined behavior in the use of vsnprintf when logging messages. This caused crashes on Linux/PPC. 2.1.4 ============= BUG FIXES: - nsdc: Fixed a typo that caused AXFRs to stop working. 2.1.3 ============= FEATURES: - nsd: The pidfile can be specified using the '-P' option. BUG FIXES: - Bug #87: allow @ in the rdata - Bug #88: allow ::FFFF:ipv4addr in AAAA records - Bug #89: Count the number of queries received over TCP, instead of the number of TCP connections. - Zonec: when - is used as input, set the filename to 'STDIN'. - The nsdc script handles failed AXFRs more gracefully. - NSD emits an error when it sees bitlabels (RFC 2673). - Only copy the CD bit when DNSSEC is enabled. 2.1.2 ============= FEATURES: - NSD now fully supports unknown record types using the notation specified in RFC3597. - Support for the following RR types has been added: WKS, X25, ISDN, RT, NSAP, PX, NAPTR, KX, CERT, DNAME, and APL. DNAME special processing is not supported. BUG FIXES: - Bug #84: NSD now uses SIGUSR1 instead of SIGILL to report stats. - Bug #85: Support for WKS records. - Bug #86: The characters "#%&^[]?" can now be used without backslash in zone file domain names. - Plugin callback return type fixed. - The maximum message length for IPv6 UDP packets is now limited to the IPv6 minimum MTU (1280) unless the IPV6_USE_MIN_MTU socket option is supported. 2.1.1 ============= BUG FIXES: - Bug #81: Handle unknown types correctly. - Bug #82: Zonec: don't report "0 errors" unless -v is specified. - Bug #83: Close zone files after parsing. - Handle AFSDB RR type. 2.1.0 ============= FEATURES: - New networking code allows a single server to handle both UDP and TCP connections. By default up to 10 simultaneous TCP connections are supported. Use the '-n' flag to change the default. 2.0.2 ============= BUG FIXES: - Allow the use of a mnemonic for the algorithm field of a DNSKEY record. - Behavior of the zonec -v flag has been modified. By default zonec will only print a single line with a summary of the error count. - Bug #75: Fixed typo in previous "fix". 2.0.1 ============= BUG FIXES: - Queries for QTYPE DS (DNSSEC) were not handled correctly in certain cases. - Partial support for unknown RRs. Known RR types with unknown RR data format is not yet supported. - Bug #75: Fixed bad error message when nsdc update is run for the first time. - Bug #78: Multiple zones, each with include directives, are now compiled correctly. 2.0.0 ============= FEATURES: - Experimental DNSSEC support implemented, but disabled by default. Enable using the --enable-dnssec configuration option. - IPv6 enabled by default. Disable using the --disable-ipv6 configuration option. BUG FIXES: - Bug #47: Domain name is now logged when a notify is received. - Bug #70: First include all A records in the additional section, followed by AAAA records. - Bug #77: Check length of domain name and label. - LOC records are supported again. 1.4.0-alpha1 ============= FEATURES: - New database format that is much more compact and portable across architectures. - The new zone compiler is now the default and the old zone compiler has been removed. - Name compression is done dynamically, removing one other difference with BIND in the responses generated (the full query name is now used for compression). - CNAME target records are now generated from wildcard records if necessary. REGRESSIONS: - mmap(2) isn't currently supported. - Not all RR types are supported by zonec (such as LOC). 1.3.0-alpha1 ============= FEATURES: - New name lookup algorithm. This required a change to the database format. Performance should increase at the expense of database size and memory usage. - New zone compiler (zonec2) based on flex and yacc, fully RFC compliant (still in alpha). - Database can be loaded using mmap(2) (use the --enable-mmap configure option to enable). This is useful on operating systems such as Solaris that do not allow memory overcommit. - Region based memory allocation and resource management. - New internal format for storing domain names. Each dname now includes an array of label offsets within the domain name. - Updates to the plugin API. BUG FIXES: - Bug #65: The syslog facility is now a compile time option (--with-facility=FACILITY). The default facility is DAEMON. - Bug #66: Automatic periodic dumping of the statistics (using the -s option) is now continued after a database reload. 1.2.4 ============= BUG FIXES: - Bug #72: If an RRset for a child domain is defined before the RRset of the parent domain the parent's RRset would be "lost". 1.2.3 ============= BUG FIXES: - Bug #65: The syslog facility is now a compile time option (--with-facility=FACILITY). The default facility is DAEMON. - Bug #66: Automatic periodic dumping of the statistics (using the -s option) is now continued after a database reload. - NSD would try to kill pid -1 on startup if forking of a child process failed. - Do not log EAGAIN errors on calls to recvfrom. These errors should be harmless. 1.2.2 ============= BUG FIXES: - Bug #59: NSD returns FORMERR when the query name is >= 246 bytes. - Bug #60: Zonec runs out of file descriptors with many zones. - Bug #61: nsdc uses /bin/sh hardwired (and should not). - Bug #62: NSD is not able to log to a file. - Bug #63: nsdc update and zonec are too tallkative. - Bug #64: Answer for request of a host resolved by a wildcard-resource-record is not understandable by dig. 1.2.1 ============= BUG FIXES: - AXFR terminates early if a zone containa a CNAME pointing the the zone's domain name (SOA record) (bug #56). - During an AXFR memory above the top of the stack was accessed. This could lead to occassional AXFR errors (bad packets). - NSD now prints its version number and exits when invoked with the -v flag (bug #57). - NSD prints help information and exits when invoked with the -h flag. 1.2.0 ============= FEATURES: - NSD is now a single parent process (handling child termination and database reloads) plus multiple UDP and TCP child processes handling queries. Before the parent process also handled UDP queries. This change simplifies the parent and child processes and allows the use of multiple concurrent UDP servers. - Experimental plugin support. This required a minor, incompatible change to the database format. Make sure you recompile your database. Use --enable-plugins to enable. - Full IPv6 support (for multi-homing and for Linux, thanks to Colm MacCárthaigh and Jun-ichiro itojun Hagino). Use --enable-ipv6 to enable. - Support for multi-homing with TCP connections. - Support for SunOS 4.x has been dropped. CODE CHANGES: - NSD should now conform to the Single Unix Specification (http://www.unix.org/). - Const correctness for strings and some other data types. - Removed code for Berkeley DB, hash tables, and mmap(2). - Separate preprocessor flags from code flags (CPPFLAGS and CFLAGS). - Use uint8_t instead of u_char, uint{16,32}_t instead of u_int{16,32}_t. - Fixed warnings from mixing signed and unsigned types. - Use sigaction(2) instead of signal(2). - The query_process function has been split up for clarity. BUG FIXES: - CHAOS TXT queries failed on big-endian machines. - Portability fixes for Tru64 (thanks to Stephane Bortzmeyer), HP-UX, and MacOS X (thanks to Ronald van der Pol). - Removed compile time limit on maximum number of TCP child servers. - Support for debugging UDP and TCP queries. - Always ensure there is enough room for the EDNS record when answering a query with EDNS enabled. 1.1 ============= FEATURES: - ANSI C - autoconf/configure - new parser - support for various RR types in zonec - support for UNKN RR types BUG FIXES: - lots of zone parsing errors eliminated - empty node matching bug gives NXDOMAIN 1.0.3 ============= This release is a bug fix release and does not add any new features. BUG FIXES: - Ignore SIGPIPE errors (bug #43). - Keep track of TCP child servers and restart if necessary. (bug #55) - Handle database reload failures correctly. - Close UDP sockets in TCP child servers. - Handle escaped characters (besides \.) in labels. - Preserve the query's RD flag in the answer. 1.0.2 ============= FEATURES: - -DBIND8_STATS to enable bind8 like [NX]STATS - -t flag to make nsd chroot to a certain directory - -s flag to make nsd produce statistics every s seconds - /etc/nsd/nsdc.conf to overwrite default variables for nsdc.sh - less loggin and more radical tcp connection (mis)handling - prefork -n processes to handle tcp connections - multiple -a flags CHANGES: - named.stats file functionality is removed BUG FIXES: - couple of pedantic fixes in C code - last zone in database axfr bug fixed - nsdc update wont update bug fixed 1.0.1 ============= FEATURES: - NSD drops permissions after binding the sockets - ``cache'' zones are no longer allowed - ID.Server & Version.Server compile time options - AXFR implemented (with tcpwrapper for access control) - nsdc update and nsdc notify functinality - using named-xfer with TSIG for inbound axfr CHANGES: - the order of records in the database is from now on significant - since Berkeley DB doesnt define order for sequential access it is no longer supported BUG FIXES: - white space problem in zonec is fixed KNOWN BUGS: - please see appropriate man pages for the known bugs 1.0.0 RELEASE ============= KNOWN BUGS: - Although NSD allows one to configure a zone without SOA record and use it as so called ``cached'' non-authoritative data, it is decided that having this functionality is wrong, dangerous and will be removed from the further versions. - If while processing EDNS(0) OPT record NSD encounters bad EDNS(0) version it will answer with Format Error instead of EDNS(0) BADVERS PLATFORMS: Tested and working on i386 FreeBSD-4.4, i386 Linux, dec alpha Linux, sparc SunOS 4.x 1.0.0-BETA2 =========== FIXES: - wildcards bug fixed - AA bit for class ANY bug fixed - minor coredumps with really broken zones in zonec fixed - linux & SunOS port 1.0-ALPHA2 ========== FIXES: - IPv6 transport support added by Jun-ichiro itojun Hagino (Use -DINET6) - Makefile modified for easier compile time configuration - EDNS(0) bug fixed - Default database changed to all lowercase, red-black tree to make nsd DNSSEC ready - REQUIREMENTS are cleaned up and updated - Signal names changed in nsdc.sh.in - Default compile options dont include -DMIMIC_BIND8 nsd-3.2.16/doc/UPGRADING0000664000175000017500000000315010475247033013367 0ustar matjematjeUpgrading from NSD 2.x to NSD 3 by Wouter C.A. Wijngaards, NLnetLabs, Aug 2006 This document lists the changes in the upgrade from NSD 2 to NSD 3 systems. * The nsdc.conf file is gone. * specify the config file to nsdc by using the -c option. * binaries are searched for in the installation bin directory, in the PATH and in the directory of nsdc.sh itself. * other options go into the new nsd.conf file. * The nsd.masters file is gone, replaced by nsd.conf. * Look at nsd.conf.5 manual page to see format. * you can list nsd-commandline-options, zones, masters, slaves, keys. * TSIG support: please list the TSIG keys in nsd.conf, or do this with include: "keys.conf" and provide additional security for that file. * For every zone include lines: zone: name: "example.com" zonefile: "example.com.txt" * For secondary zones include in the zone entry: request-xfr: allow-notify: * For master zones include in the zone entry: provide-xfr: notify: * NSD does not provide IXFR, so for secondaries that connect to NSD use request-xfr: AXFR that will only use AXFR, not IXFR to request zone transfers. * No more need for a cron job to do a nsdc update. * nsd will update automatically all secondary zones from master. * You should never need to do nsdc update or nsdc notify by hand. * You can still use a cronjob to do nsdc patch. nsdc patch moves the zone transfer content from temporary storage to the zone files, recompiles the database and reloads nsd. nsd-3.2.16/doc/coding-style0000664000175000017500000000056010443534063014447 0ustar matjematjeCoding Style for NSD [This is incomplete, but a start] o No space after function/keyword o { on the same line as the if/while/for statement o If an 'if' has one statement in the 'then' part omit the braces: if (!x) return NULL; Indent the 'then' part with tabs o Function: return-type functionname(parameters, ...) { ... } nsd-3.2.16/doc/NEW-CFG-OPTION0000664000175000017500000000470512135742630014110 0ustar matjematjeWhen adding a new configuration option to NSD, several files need to be touched. This file is an enumeration of files that need to be edited. Suppose we are going to add a configuration option 'dummy:' that can take a string. We need to update the following files: 1. configlexer.lex 2. configparser.y 3. options.h 4. options.c 5. nsd.conf.sample.in 6. nsd.conf.5.in 7. nsd-checkconf.c 8. tpkg/checkconf.tpkg 1. Update configlexer.lex Make sure that zonec understands the new option by adding the following line into configlexer.lex dummy{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_DUMMY;} 2. Update configparser.y Make sure that zonec can parse the new option by adding VAR_DUMMY to the set of tokens: %token VAR_DUMMY Update the grammar. For example, if it a server option, extend content_server: content_server: server_ip_address | ... server_hide_version | server_dummy; And write down the dummy rule: server_dummy: VAR_DUMMY STRING { OUTYY(("P(server_dummy:%s)\n", $2)); cfg_parser->opt->dummy = region_strdup(cfg_parser->opt->region, $2); } ; 3. Update options.h Make sure that there is storage for the dummy option. In struct nsd_options, add: const char* dummy; 4. Update options.c Set a default dummy string. In the function nsd_options_create(), add: opt->dummy = "dummy"; 5. Update nsd.conf.sample.in Add a reference in the sample configuration file: # This option does nothing. # dummy: "dummy" 6. Update nsd.conf.5.in Update the nsd.conf manpage: .TP .B dummy:\fR Does nothing. 7. Update nsd-checkconf.c Make the checkconf tool aware of the new option. In config_print_zone(), add: SERV_GET_STR(dummy, o); and in config_test_print_server(), add: print_string_var("dummy:", opt->dummy); 8. Update tpkg/checkconf.tpkg Make the test aware of the new option. Extract checkconf.tpkg: $ cd tpkg; $ tpkg extract checkconf.tpkg $ cd checkconf.dir And add to the various checkconf.check[1-9] files: dummy: "dummy" Go back to the tpkg directory and create the new test: $ cd .. $ tpkg create checkconf.tpkg 9. Update other files You might need to edit other files too: - If the new option requires to be enabled at build time, you need to add stuff to configure.ac and Makefile.in. - Update documentation files, like doc/README, doc/RELNOTES, doc/Changelog. - Obviously, the source code files need to be edited to implement the new functionality. nsd-3.2.16/netio.h0000664000175000017500000001255712160600467012656 0ustar matjematje/* * netio.h -- network I/O support. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * * * The netio module implements event based I/O handling using * pselect(2). Multiple event handlers can wait for a certain event * to occur simultaneously. Each event handler is called when an * event occurs that the event handler has indicated that it is * willing to handle. * * There are four types of events that can be handled: * * NETIO_EVENT_READ: reading will not block. * NETIO_EVENT_WRITE: writing will not block. * NETIO_EVENT_EXCEPT: an exception occurred. * NETIO_EVENT_TIMEOUT: the timeout expired. * * A file descriptor must be specified if the handler is interested in * the first three event types. A timeout must be specified if the * event handler is interested in timeouts. These event types can be * OR'ed together if the handler is willing to handle multiple types * of events. * * The special event type NETIO_EVENT_NONE is available if you wish to * temporarily disable the event handler without removing and adding * the handler to the netio structure. * * The event callbacks are free to modify the netio_handler_type * structure to change the file descriptor, timeout, event types, user * data, or handler functions. * * The main loop of the program must call netio_dispatch to check for * events and dispatch them to the handlers. An additional timeout * can be specified as well as the signal mask to install while * blocked in pselect(2). */ #ifndef _NETIO_H_ #define _NETIO_H_ #ifdef HAVE_SYS_SELECT_H #include #endif #include #include "region-allocator.h" #define NETIO_SLOW_ACCEPT_TIMEOUT 2 /* in seconds */ /* * The type of events a handler is interested in. These can be OR'ed * together to specify multiple event types. */ enum netio_event_types { NETIO_EVENT_NONE = 0, NETIO_EVENT_READ = 1, NETIO_EVENT_WRITE = 2, NETIO_EVENT_EXCEPT = 4, NETIO_EVENT_TIMEOUT = 8, NETIO_EVENT_ACCEPT = 16 }; typedef enum netio_event_types netio_event_types_type; typedef struct netio netio_type; typedef struct netio_handler netio_handler_type; typedef struct netio_handler_list netio_handler_list_type; struct netio { region_type *region; netio_handler_list_type *handlers; netio_handler_list_type *deallocated; /* * Cached value of the current time. The cached value is * cleared at the start of netio_dispatch to calculate the * relative timeouts of the event handlers and after calling * pselect(2) so handlers can use it to calculate a new * absolute timeout. * * Use netio_current_time() to read the current time. */ int have_current_time; struct timespec cached_current_time; /* * Next handler in the dispatch. Only valid during callbacks. * To make sure that deletes respect the state of the iterator. */ netio_handler_list_type *dispatch_next; }; typedef void (*netio_event_handler_type)(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); struct netio_handler { /* * The file descriptor that should be checked for events. If * the file descriptor is negative only timeout events are * checked for. */ int fd; /* * The time when no events should be checked for and the * handler should be called with the NETIO_EVENT_TIMEOUT * event type. Unlike most timeout parameters the time should * be absolute, not relative! */ struct timespec *timeout; /* * Additional user data. */ void *user_data; /* * The type of events that should be checked for. These types * can be OR'ed together to wait for multiple types of events. */ netio_event_types_type event_types; /* * The event handler. The event_types parameter contains the * OR'ed set of event types that actually triggered. The * event handler is allowed to modify this handler object. * The event handler SHOULD NOT block. */ netio_event_handler_type event_handler; }; struct netio_handler_list { netio_handler_list_type *next; netio_handler_type *handler; }; /* * Create a new netio instance using the specified REGION. The netio * instance is cleaned up when the REGION is deallocated. */ netio_type *netio_create(region_type *region); /* * Add a new HANDLER to NETIO. */ void netio_add_handler(netio_type *netio, netio_handler_type *handler); /* * Remove the HANDLER from NETIO. */ void netio_remove_handler(netio_type *netio, netio_handler_type *handler); /* * Retrieve the current time (using gettimeofday(2). */ const struct timespec *netio_current_time(netio_type *netio); /* * Check for events and dispatch them to the handlers. If TIMEOUT is * specified it specifies the maximum time to wait for an event to * arrive. SIGMASK is passed to the underlying pselect(2) call. * Returns the number of non-timeout events dispatched, 0 on timeout, * and -1 on error (with errno set appropriately). */ int netio_dispatch(netio_type *netio, const struct timespec *timeout, const sigset_t *sigmask); #ifdef __cplusplus inline netio_event_types_type operator | (netio_event_types_type lhs, netio_event_types_type rhs) { return (netio_event_types_type) (lhs | rhs); } inline netio_event_types_type operator |= (netio_event_types_type &lhs, netio_event_types_type rhs) { lhs = (netio_event_types_type) (lhs | rhs); return lhs; } #endif /* __cplusplus */ #endif /* _NETIO_H_ */ nsd-3.2.16/configparser.h0000664000175000017500000001201312173226547014214 0ustar matjematje/* A Bison parser, made by GNU Bison 2.5. */ /* Bison interface for Yacc-like parsers in C Copyright (C) 1984, 1989-1990, 2000-2011 Free Software Foundation, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ /* As a special exception, you may create a larger work that contains part or all of the Bison parser skeleton and distribute that work under terms of your choice, so long as that work isn't itself a parser generator using the skeleton or a modified version thereof as a parser skeleton. Alternatively, if you modify or redistribute the parser skeleton itself, you may (at your option) remove this special exception, which will cause the skeleton and the resulting Bison output files to be licensed under the GNU General Public License without this special exception. This special exception was added by the Free Software Foundation in version 2.2 of Bison. */ /* Tokens. */ #ifndef YYTOKENTYPE # define YYTOKENTYPE /* Put the tokens into the symbol table, so that GDB and other debuggers know about them. */ enum yytokentype { SPACE = 258, LETTER = 259, NEWLINE = 260, COMMENT = 261, COLON = 262, ANY = 263, ZONESTR = 264, STRING = 265, VAR_SERVER = 266, VAR_NAME = 267, VAR_IP_ADDRESS = 268, VAR_IP_TRANSPARENT = 269, VAR_DEBUG_MODE = 270, VAR_IP4_ONLY = 271, VAR_IP6_ONLY = 272, VAR_DATABASE = 273, VAR_IDENTITY = 274, VAR_NSID = 275, VAR_LOGFILE = 276, VAR_SERVER_COUNT = 277, VAR_TCP_COUNT = 278, VAR_PIDFILE = 279, VAR_PORT = 280, VAR_STATISTICS = 281, VAR_ZONESTATSFILE = 282, VAR_CHROOT = 283, VAR_USERNAME = 284, VAR_ZONESDIR = 285, VAR_XFRDFILE = 286, VAR_DIFFFILE = 287, VAR_XFRD_RELOAD_TIMEOUT = 288, VAR_TCP_QUERY_COUNT = 289, VAR_TCP_TIMEOUT = 290, VAR_IPV4_EDNS_SIZE = 291, VAR_IPV6_EDNS_SIZE = 292, VAR_ZONEFILE = 293, VAR_ZONE = 294, VAR_ALLOW_NOTIFY = 295, VAR_REQUEST_XFR = 296, VAR_NOTIFY = 297, VAR_PROVIDE_XFR = 298, VAR_NOTIFY_RETRY = 299, VAR_OUTGOING_INTERFACE = 300, VAR_ALLOW_AXFR_FALLBACK = 301, VAR_KEY = 302, VAR_ALGORITHM = 303, VAR_SECRET = 304, VAR_AXFR = 305, VAR_UDP = 306, VAR_VERBOSITY = 307, VAR_HIDE_VERSION = 308, VAR_RRL_SIZE = 309, VAR_RRL_RATELIMIT = 310, VAR_RRL_SLIP = 311, VAR_RRL_IPV4_PREFIX_LENGTH = 312, VAR_RRL_IPV6_PREFIX_LENGTH = 313, VAR_RRL_WHITELIST_RATELIMIT = 314, VAR_RRL_WHITELIST = 315 }; #endif /* Tokens. */ #define SPACE 258 #define LETTER 259 #define NEWLINE 260 #define COMMENT 261 #define COLON 262 #define ANY 263 #define ZONESTR 264 #define STRING 265 #define VAR_SERVER 266 #define VAR_NAME 267 #define VAR_IP_ADDRESS 268 #define VAR_IP_TRANSPARENT 269 #define VAR_DEBUG_MODE 270 #define VAR_IP4_ONLY 271 #define VAR_IP6_ONLY 272 #define VAR_DATABASE 273 #define VAR_IDENTITY 274 #define VAR_NSID 275 #define VAR_LOGFILE 276 #define VAR_SERVER_COUNT 277 #define VAR_TCP_COUNT 278 #define VAR_PIDFILE 279 #define VAR_PORT 280 #define VAR_STATISTICS 281 #define VAR_ZONESTATSFILE 282 #define VAR_CHROOT 283 #define VAR_USERNAME 284 #define VAR_ZONESDIR 285 #define VAR_XFRDFILE 286 #define VAR_DIFFFILE 287 #define VAR_XFRD_RELOAD_TIMEOUT 288 #define VAR_TCP_QUERY_COUNT 289 #define VAR_TCP_TIMEOUT 290 #define VAR_IPV4_EDNS_SIZE 291 #define VAR_IPV6_EDNS_SIZE 292 #define VAR_ZONEFILE 293 #define VAR_ZONE 294 #define VAR_ALLOW_NOTIFY 295 #define VAR_REQUEST_XFR 296 #define VAR_NOTIFY 297 #define VAR_PROVIDE_XFR 298 #define VAR_NOTIFY_RETRY 299 #define VAR_OUTGOING_INTERFACE 300 #define VAR_ALLOW_AXFR_FALLBACK 301 #define VAR_KEY 302 #define VAR_ALGORITHM 303 #define VAR_SECRET 304 #define VAR_AXFR 305 #define VAR_UDP 306 #define VAR_VERBOSITY 307 #define VAR_HIDE_VERSION 308 #define VAR_RRL_SIZE 309 #define VAR_RRL_RATELIMIT 310 #define VAR_RRL_SLIP 311 #define VAR_RRL_IPV4_PREFIX_LENGTH 312 #define VAR_RRL_IPV6_PREFIX_LENGTH 313 #define VAR_RRL_WHITELIST_RATELIMIT 314 #define VAR_RRL_WHITELIST 315 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED typedef union YYSTYPE { /* Line 2068 of yacc.c */ #line 41 "configparser.y" char* str; /* Line 2068 of yacc.c */ #line 176 "configparser.h" } YYSTYPE; # define YYSTYPE_IS_TRIVIAL 1 # define yystype YYSTYPE /* obsolescent; will be withdrawn */ # define YYSTYPE_IS_DECLARED 1 #endif extern YYSTYPE yylval; nsd-3.2.16/difffile.h0000664000175000017500000000411711761673243013311 0ustar matjematje/* * difffile.h - nsd.diff file handling header file. Read/write diff files. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef DIFFFILE_H #define DIFFFILE_H #include "config.h" #include "rbtree.h" #include "namedb.h" #include "options.h" #define DIFF_PART_IXFR ('I'<<24 | 'X'<<16 | 'F'<<8 | 'R') #define DIFF_PART_SURE ('S'<<24 | 'U'<<16 | 'R'<<8 | 'E') /* * Used to pass commit logs */ struct diff_log { char* zone_name; char* error; char* comment; struct diff_log* next; }; /* write an xfr packet data to the diff file, type=IXFR. The diff file is created if necessary. */ void diff_write_packet(const char* zone, uint32_t new_serial, uint16_t id, uint32_t seq_nr, uint8_t* data, size_t len, nsd_options_t* opt); /* * Write a commit packet to the diff file, type=SURE. * The zone data (preceding ixfr packets) are committed. * See NSD-DIFFFILE for meaning of the arguments. */ void diff_write_commit(const char* zone, uint32_t old_serial, uint32_t new_serial, uint16_t id, uint32_t num_parts, uint8_t commit, const char* log_msg, nsd_options_t* opt); /* check if the crc in the nsd.db is the same in memory as on disk. returns 1 if different. 0 if the same. returns -1 on error. */ int db_crc_different(namedb_type* db); /* read the diff file and apply to the database in memory. It will attempt to skip bad data. If you pass a non-null value log, log comments are alloced in namedb.region then, *log must be 0 on start of call (entries are prepended). returns 0 on an unrecoverable error. */ int diff_read_file(namedb_type* db, nsd_options_t* opt, struct diff_log** log, size_t child_count); /* check the diff file for garbage at the end (bad type, partial write) * and snip it off. */ void diff_snip_garbage(namedb_type* db, nsd_options_t* opt); /* * These functions read parts of the diff file. */ int diff_read_32(FILE *in, uint32_t* result); int diff_read_16(FILE *in, uint16_t* result); int diff_read_8(FILE *in, uint8_t* result); int diff_read_str(FILE* in, char* buf, size_t len); #endif /* DIFFFILE_H */ nsd-3.2.16/configlexer.lex0000664000175000017500000001721612141727345014407 0ustar matjematje%{ /* * configlexer.lex - lexical analyzer for NSD config file * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include "options.h" #include "configyyrename.h" #include "configparser.h" void c_error(const char *message); #define YY_NO_UNPUT #if 0 #define LEXOUT(s) printf s /* used ONLY when debugging */ #else #define LEXOUT(s) #endif struct inc_state { const char* filename; int line; }; static struct inc_state parse_stack[MAXINCLUDES]; static YY_BUFFER_STATE include_stack[MAXINCLUDES]; static int config_include_stack_ptr = 0; static void config_start_include(const char* filename) { FILE *input; if(strlen(filename) == 0) { c_error_msg("empty include file name"); return; } if(config_include_stack_ptr >= MAXINCLUDES) { c_error_msg("includes nested too deeply, skipped (>%d)", MAXINCLUDES); return; } input = fopen(filename, "r"); if(!input) { c_error_msg("cannot open include file '%s': %s", filename, strerror(errno)); return; } LEXOUT(("switch_to_include_file(%s) ", filename)); parse_stack[config_include_stack_ptr].filename = cfg_parser->filename; parse_stack[config_include_stack_ptr].line = cfg_parser->line; include_stack[config_include_stack_ptr] = YY_CURRENT_BUFFER; cfg_parser->filename = region_strdup(cfg_parser->opt->region, filename); cfg_parser->line = 1; yy_switch_to_buffer(yy_create_buffer(input, YY_BUF_SIZE)); ++config_include_stack_ptr; } static void config_end_include(void) { --config_include_stack_ptr; cfg_parser->filename = parse_stack[config_include_stack_ptr].filename; cfg_parser->line = parse_stack[config_include_stack_ptr].line; yy_delete_buffer(YY_CURRENT_BUFFER); yy_switch_to_buffer(include_stack[config_include_stack_ptr]); } #ifndef yy_set_bol /* compat definition, for flex 2.4.6 */ #define yy_set_bol(at_bol) \ { \ if ( ! yy_current_buffer ) \ yy_current_buffer = yy_create_buffer( yyin, YY_BUF_SIZE ); \ yy_current_buffer->yy_ch_buf[0] = ((at_bol)?'\n':' '); \ } #endif %} SPACE [ \t] LETTER [a-zA-Z] UNQUOTEDLETTER [^\"\n\r \t\\]|\\. NEWLINE [\r\n] COMMENT \# COLON \: ANY [^\"\n\r\\]|\\. %x quotedstring include include_quoted %% {SPACE}* { LEXOUT(("SP ")); /* ignore */ } {SPACE}*{COMMENT}.* { LEXOUT(("comment(%s) ", yytext)); /* ignore */ } server{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_SERVER;} name{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_NAME;} ip-address{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_IP_ADDRESS;} ip-transparent{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_IP_TRANSPARENT;} debug-mode{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_DEBUG_MODE;} hide-version{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_HIDE_VERSION;} ip4-only{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_IP4_ONLY;} ip6-only{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_IP6_ONLY;} database{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_DATABASE;} identity{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_IDENTITY;} nsid{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_NSID;} logfile{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_LOGFILE;} server-count{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_SERVER_COUNT;} tcp-count{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_TCP_COUNT;} tcp-query-count{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_TCP_QUERY_COUNT;} tcp-timeout{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_TCP_TIMEOUT;} ipv4-edns-size{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_IPV4_EDNS_SIZE;} ipv6-edns-size{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_IPV6_EDNS_SIZE;} pidfile{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_PIDFILE;} port{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_PORT;} statistics{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_STATISTICS;} zone-stats-file{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_ZONESTATSFILE;} chroot{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_CHROOT;} username{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_USERNAME;} zonesdir{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_ZONESDIR;} difffile{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_DIFFFILE;} xfrdfile{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_XFRDFILE;} xfrd-reload-timeout{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_XFRD_RELOAD_TIMEOUT;} verbosity{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_VERBOSITY;} zone{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_ZONE;} zonefile{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_ZONEFILE;} allow-notify{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_ALLOW_NOTIFY;} request-xfr{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_REQUEST_XFR;} notify{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_NOTIFY;} notify-retry{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_NOTIFY_RETRY;} provide-xfr{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_PROVIDE_XFR;} outgoing-interface{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_OUTGOING_INTERFACE;} allow-axfr-fallback{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_ALLOW_AXFR_FALLBACK;} key{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_KEY;} algorithm{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_ALGORITHM;} secret{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_SECRET;} AXFR { LEXOUT(("v(%s) ", yytext)); return VAR_AXFR;} UDP { LEXOUT(("v(%s) ", yytext)); return VAR_UDP;} rrl-size{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_SIZE;} rrl-ratelimit{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_RATELIMIT;} rrl-slip{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_SLIP;} rrl-ipv4-prefix-length{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_IPV4_PREFIX_LENGTH;} rrl-ipv6-prefix-length{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_IPV6_PREFIX_LENGTH;} rrl-whitelist-ratelimit{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_WHITELIST_RATELIMIT;} rrl-whitelist{COLON} { LEXOUT(("v(%s) ", yytext)); return VAR_RRL_WHITELIST;} {NEWLINE} { LEXOUT(("NL\n")); cfg_parser->line++;} /* Quoted strings. Strip leading and ending quotes */ \" { BEGIN(quotedstring); LEXOUT(("QS ")); } <> { yyerror("EOF inside quoted string"); BEGIN(INITIAL); } {ANY}* { LEXOUT(("STR(%s) ", yytext)); yymore(); } \n { cfg_parser->line++; yymore(); } \" { LEXOUT(("QE ")); BEGIN(INITIAL); yytext[yyleng - 1] = '\0'; yylval.str = region_strdup(cfg_parser->opt->region, yytext); return STRING; } /* include: directive */ include{COLON} { LEXOUT(("v(%s) ", yytext)); BEGIN(include); } <> { yyerror("EOF inside include directive"); BEGIN(INITIAL); } {SPACE}* { LEXOUT(("ISP ")); /* ignore */ } {NEWLINE} { LEXOUT(("NL\n")); cfg_parser->line++;} \" { LEXOUT(("IQS ")); BEGIN(include_quoted); } {UNQUOTEDLETTER}* { LEXOUT(("Iunquotedstr(%s) ", yytext)); config_start_include(yytext); BEGIN(INITIAL); } <> { yyerror("EOF inside quoted string"); BEGIN(INITIAL); } {ANY}* { LEXOUT(("ISTR(%s) ", yytext)); yymore(); } {NEWLINE} { cfg_parser->line++; yymore(); } \" { LEXOUT(("IQE ")); yytext[yyleng - 1] = '\0'; config_start_include(yytext); BEGIN(INITIAL); } <> { yy_set_bol(1); /* Set beginning of line, so "^" rules match. */ if (config_include_stack_ptr == 0) { yyterminate(); } else { fclose(yyin); config_end_include(); } } {UNQUOTEDLETTER}* { LEXOUT(("unquotedstr(%s) ", yytext)); yylval.str = region_strdup(cfg_parser->opt->region, yytext); return STRING; } %% nsd-3.2.16/edns.c0000664000175000017500000000554511761673243012473 0ustar matjematje/* * edns.c -- EDNS definitions (RFC 2671). * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include "dns.h" #include "edns.h" void edns_init_data(edns_data_type *data, uint16_t max_length) { memset(data, 0, sizeof(edns_data_type)); /* record type: OPT */ data->ok[1] = (TYPE_OPT & 0xff00) >> 8; /* type_hi */ data->ok[2] = TYPE_OPT & 0x00ff; /* type_lo */ /* udp payload size */ data->ok[3] = (max_length & 0xff00) >> 8; /* size_hi */ data->ok[4] = max_length & 0x00ff; /* size_lo */ data->error[1] = (TYPE_OPT & 0xff00) >> 8; /* type_hi */ data->error[2] = TYPE_OPT & 0x00ff; /* type_lo */ data->error[3] = (max_length & 0xff00) >> 8; /* size_hi */ data->error[4] = max_length & 0x00ff; /* size_lo */ data->error[5] = 1; /* XXX Extended RCODE=BAD VERS */ } void edns_init_nsid(edns_data_type *data, uint16_t nsid_len) { /* add nsid length bytes */ data->rdata_nsid[0] = ((OPT_HDR + nsid_len) & 0xff00) >> 8; /* length_hi */ data->rdata_nsid[1] = ((OPT_HDR + nsid_len) & 0x00ff); /* length_lo */ /* NSID OPT HDR */ data->nsid[0] = (NSID_CODE & 0xff00) >> 8; data->nsid[1] = (NSID_CODE & 0x00ff); data->nsid[2] = (nsid_len & 0xff00) >> 8; data->nsid[3] = (nsid_len & 0x00ff); } void edns_init_record(edns_record_type *edns) { edns->status = EDNS_NOT_PRESENT; edns->position = 0; edns->maxlen = 0; edns->dnssec_ok = 0; edns->nsid = 0; } int edns_parse_record(edns_record_type *edns, buffer_type *packet) { /* OPT record type... */ uint8_t opt_owner; uint16_t opt_type; uint16_t opt_class; uint8_t opt_version; uint16_t opt_flags; uint16_t opt_rdlen; uint16_t opt_nsid; edns->position = buffer_position(packet); if (!buffer_available(packet, (OPT_LEN + OPT_RDATA))) return 0; opt_owner = buffer_read_u8(packet); opt_type = buffer_read_u16(packet); if (opt_owner != 0 || opt_type != TYPE_OPT) { /* Not EDNS. */ buffer_set_position(packet, edns->position); return 0; } opt_class = buffer_read_u16(packet); (void)buffer_read_u8(packet); /* opt_extended_rcode */ opt_version = buffer_read_u8(packet); opt_flags = buffer_read_u16(packet); opt_rdlen = buffer_read_u16(packet); if (opt_version != 0) { /* The only error is VERSION not implemented */ edns->status = EDNS_ERROR; return 1; } if (opt_rdlen > 0) { /* there is more to come, read opt code * should be NSID - there are no others */ opt_nsid = buffer_read_u16(packet); edns->nsid = (opt_nsid == NSID_CODE); /* extra check for the value */ } edns->status = EDNS_OK; edns->maxlen = opt_class; edns->dnssec_ok = opt_flags & DNSSEC_OK_MASK; return 1; } size_t edns_reserved_space(edns_record_type *edns) { /* MIEK; when a pkt is too large?? */ return edns->status == EDNS_NOT_PRESENT ? 0 : (OPT_LEN + OPT_RDATA); } nsd-3.2.16/nsd-checkconf.8.in0000664000175000017500000000425012173226547014570 0ustar matjematje.TH "nsd\-checkconf" "8" "Jul 22, 2013" "NLnet Labs" "nsd 3.2.16" .\" Copyright (c) 2001\-2011, NLnet Labs. All rights reserved. .\" See LICENSE for the license. .SH "NAME" .LP .B nsd\-checkconf \- NSD configuration file checker. .SH "SYNOPSIS" .LP .B nsd\-checkconf .RB [ \-v ] .RB [ \-h ] .RB [ \-o .IR option ] .RB [ \-z .IR zonename ] .RB [ \-s .IR keyname ] .I configfile .SH "DESCRIPTION" .LP .B nsd\-checkconf reads a configuration file. It prints parse errors to standard error, and performs additional checks on the contents. The configfile format is described in nsd.conf(5). .P The utility of this program is to check a config file for errors before using it in nsd(8) or zonec(8). This program can also be used for shell scripts to access the nsd config file, using the \-o and \-z options. .P .SH "OPTIONS" .TP .B \-v After reading print the options to standard output in configfile format. Without this option, only success or parse errors are reported. .TP .B \-h Print usage help information and exit. .TP .B \-o\fI option Return only this option from the config file. This option can to be used in conjunction with the .B \-z option. The special value .I zones prints out a list of configured zones. .P .RS This option is primarily used by .B nsdc to parse the config file from the shell. If the .B \-z option is given, but the .B \-o option is not given, nothing is printed. .RE .TP .B \-s\fI keyname Prints the key secret (base64 blob) configured for this key in the config file. Used to help shell scripts parse the config file. .TP .B \-z\fI zonename Return the option specified with .B \-o for zone 'zonename'. .P .RS If this option is not given, the server section of the config file is used. This option is primarily used by .B nsdc to parse the config file from the shell. .RE .P .RS The \-o, \-s and \-z option print configfile options to standard output. .RE .SH "FILES" .TP @nsdconfigfile@ default .B NSD configuration file .SH "SEE ALSO" .LP nsd(8), nsdc(8), nsd.conf(5), nsd\-notify(8), nsd\-patch(8), nsd-xfer(8), zonec(8) .SH "AUTHORS" .LP .B NSD was written by NLnet Labs and RIPE NCC joint team. Please see CREDITS file in the distribution for further details. nsd-3.2.16/zonec.8.in0000664000175000017500000000550212173226547013202 0ustar matjematje.TH "zonec" "8" "Jul 22, 2013" "NLnet Labs" "nsd 3.2.16" .\" Copyright (c) 2001\-2011, NLnet Labs. All rights reserved. .\" See LICENSE for the license. .SH "NAME" .LP .B zonec \- NSD zone compiler version 3.2.16. .SH "SYNOPSIS" .LP .B zonec .RB [ \-v ] .RB [ \-h ] .RB [ \-C ] .RB [ \-L ] .RB [ \-F ] .RB [ \-c .IR configfile ] .RB [ \-d .IR directory ] .RB [ \-o .IR origin ] .RB [ \-z .IR zonefile ] .RB [ \-f .IR database ] .SH "DESCRIPTION" .LP .B Zonec is the nsd(8) database compiler for creating name space databases from a set of input master zone files specified in nsd.conf(5) file. .LP It is normally invoked via nsdc(8) rebuild command. .B Zonec will then parse every zone in nsd.conf(5) file and add it to the name space database, .I @dbfile@ by default, that is used by nsd(8) to answer incoming queries. .SH "OPTIONS" .TP .B \-c\fI configfile Read specified configfile instead of the default .IR @nsdconfigfile@ . .TP .B \-C No config file is read (use with \-f, \-o and \-z). .TP .B \-d\fI directory Change the working directory to .I directory before doing any work. Overrides zonesdir: option in config file. .TP .B \-f\fI database Create the specified .I database instead of the file specified as database: in the config file. .TP .B \-o\fI origin Use this as the first origin. Zone information is read from zonefile specified with \-z. When reading zones from config file this option is ignored. .TP .B \-z\fI zonefile Reads all zone information from .IR zonefile . If .IR zonefile equals `\-`, then all zone information is read from stdin, making constructs like: .LP .RS .B # cat zones* | .B ./zonec \-C \-f nsd.db \-o example.net \-z \- .RE .LP .RS possible. When reading zones from config file this option is ignored. .RE .TP .B \-v Increase the verbosity of zonec. This flag can be specified multiple times to increase the level of verbosity. The first level of verbosity will print per zone summary information. The second level of will print progress information for each 10,000 RRs processed. .TP .B \-F Set debug facilities. (If compiled with \-\-enable\-checking.) .TP .B \-L Set debug level. (If compiled with \-\-enable\-checking.) .SH "FILES" .TP @dbfile@ default .B NSD database .TP @nsdconfigfile@ default .B NSD configuration file .SH "DIAGNOSTICS" .LP .B Zonec will log all the problems via the standard error output and progress via stdout if the .B v option is specified. .SH "SEE ALSO" .LP nsd(8), nsdc(8), nsd.conf(5), nsd\-checkconf(8), nsd-notify(8), nsd-patch(8), nsd-xfer(8) .SH "AUTHORS" .LP .B NSD was written by NLnet Labs and RIPE NCC joint team. Please see CREDITS file in the distribution for further details. .SH "BUGS" .LP .B Zonec has rather weak error diagnostics that will change in further versions. .B Zonec expects the input files to be free of syntax errors and very little fool proof checks are done. nsd-3.2.16/difffile.c0000664000175000017500000012734312157572063013311 0ustar matjematje/* * difffile.c - DIFF file handling source code. Read and write diff files. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include "difffile.h" #include "util.h" #include "packet.h" #include "rdata.h" #include "nsec3.h" static int write_32(FILE *out, uint32_t val) { val = htonl(val); return write_data(out, &val, sizeof(val)); } static int write_16(FILE *out, uint16_t val) { val = htons(val); return write_data(out, &val, sizeof(val)); } static int write_8(FILE *out, uint8_t val) { return write_data(out, &val, sizeof(val)); } static int write_str(FILE *out, const char* str) { uint32_t len = strlen(str); if(!write_32(out, len)) return 0; return write_data(out, str, len); } void diff_write_packet(const char* zone, uint32_t new_serial, uint16_t id, uint32_t seq_nr, uint8_t* data, size_t len, nsd_options_t* opt) { const char* filename = opt->difffile; struct timeval tv; FILE *df; uint32_t file_len = sizeof(uint32_t) + strlen(zone) + sizeof(new_serial) + sizeof(id) + sizeof(seq_nr) + len; if (gettimeofday(&tv, NULL) != 0) { log_msg(LOG_ERR, "could not set timestamp for %s: %s", filename, strerror(errno)); return; } df = fopen(filename, "a"); if(!df) { log_msg(LOG_ERR, "could not open file %s for append: %s", filename, strerror(errno)); return; } if(!write_32(df, DIFF_PART_IXFR) || !write_32(df, (uint32_t) tv.tv_sec) || !write_32(df, (uint32_t) tv.tv_usec) || !write_32(df, file_len) || !write_str(df, zone) || !write_32(df, new_serial) || !write_16(df, id) || !write_32(df, seq_nr) || !write_data(df, data, len) || !write_32(df, file_len)) { log_msg(LOG_ERR, "could not write to file %s: %s", filename, strerror(errno)); } fclose(df); } void diff_write_commit(const char* zone, uint32_t old_serial, uint32_t new_serial, uint16_t id, uint32_t num_parts, uint8_t commit, const char* log_str, nsd_options_t* opt) { const char* filename = opt->difffile; struct timeval tv; FILE *df; uint32_t len; if (gettimeofday(&tv, NULL) != 0) { log_msg(LOG_ERR, "could not set timestamp for %s: %s", filename, strerror(errno)); return; } df = fopen(filename, "a"); if(!df) { log_msg(LOG_ERR, "could not open file %s for append: %s", filename, strerror(errno)); return; } len = strlen(zone) + sizeof(len) + sizeof(old_serial) + sizeof(new_serial) + sizeof(id) + sizeof(num_parts) + sizeof(commit) + strlen(log_str) + sizeof(len); if(!write_32(df, DIFF_PART_SURE) || !write_32(df, (uint32_t) tv.tv_sec) || !write_32(df, (uint32_t) tv.tv_usec) || !write_32(df, len) || !write_str(df, zone) || !write_32(df, old_serial) || !write_32(df, new_serial) || !write_16(df, id) || !write_32(df, num_parts) || !write_8(df, commit) || !write_str(df, log_str) || !write_32(df, len)) { log_msg(LOG_ERR, "could not write to file %s: %s", filename, strerror(errno)); } fflush(df); fclose(df); } /* * Checksum to signal no data change occured (for example, by a * zonec run. */ int db_crc_different(namedb_type* db) { FILE *fd = fopen(db->filename, "r"); uint32_t crc_file; char buf[NAMEDB_MAGIC_SIZE]; if(fd == NULL) { log_msg(LOG_ERR, "unable to load %s: %s", db->filename, strerror(errno)); return -1; } /* seek to position of CRC, check it and magic no */ if(fseeko(fd, db->crc_pos, SEEK_SET)==-1) { log_msg(LOG_ERR, "unable to fseeko %s: %s. db changed?", db->filename, strerror(errno)); fclose(fd); return -1; } if(fread(&crc_file, sizeof(crc_file), 1, fd) != 1) { if(!feof(fd)) log_msg(LOG_ERR, "could not read %s CRC: %s. " "db changed?", db->filename, strerror(errno)); fclose(fd); return -1; } crc_file = ntohl(crc_file); if(fread(buf, sizeof(char), sizeof(buf), fd) != sizeof(buf)) { if(!feof(fd)) log_msg(LOG_ERR, "could not read %s magic: %s. " "db changed?", db->filename, strerror(errno)); fclose(fd); return -1; } if(memcmp(buf, NAMEDB_MAGIC, NAMEDB_MAGIC_SIZE) != 0) { fclose(fd); return -1; } fclose(fd); if(db->crc == crc_file) return 0; return 1; } int diff_read_32(FILE *in, uint32_t* result) { if (fread(result, sizeof(*result), 1, in) == 1) { *result = ntohl(*result); return 1; } else { return 0; } } int diff_read_16(FILE *in, uint16_t* result) { if (fread(result, sizeof(*result), 1, in) == 1) { *result = ntohs(*result); return 1; } else { return 0; } } int diff_read_8(FILE *in, uint8_t* result) { if (fread(result, sizeof(*result), 1, in) == 1) { return 1; } else { return 0; } } int diff_read_str(FILE* in, char* buf, size_t len) { uint32_t disklen; if(!diff_read_32(in, &disklen)) return 0; if(disklen >= len) return 0; if(fread(buf, disklen, 1, in) != 1) return 0; buf[disklen] = 0; return 1; } static void add_rdata_to_recyclebin(namedb_type* db, rr_type* rr) { /* add rdatas to recycle bin. */ size_t i; for(i=0; irdata_count; i++) { if(!rdata_atom_is_domain(rr->type, i)) region_recycle(db->region, rr->rdatas[i].data, rdata_atom_size(rr->rdatas[i]) + sizeof(uint16_t)); } region_recycle(db->region, rr->rdatas, sizeof(rdata_atom_type)*rr->rdata_count); } /* this routine determines if below a domain there exist names with * data (is_existing) or no names below the domain have data. */ static int has_data_below(domain_type* top) { domain_type* d = top; assert(d != NULL); /* in the canonical ordering subdomains are after this name */ d = domain_next(d); while(d != NULL && dname_is_subdomain(domain_dname(d), domain_dname(top))) { if(d->is_existing) return 1; d = domain_next(d); } return 0; } /* this routine makes empty terminals non-existent. * @domain the lowest empty terminal * @ce the closest encloser */ static domain_type* rrset_delete_empty_terminals(domain_type* domain, domain_type* ce) { assert(domain); if (domain->rrsets == 0) { /* if there is no data below it, it becomes non existing. also empty nonterminals above it become nonexisting */ /* check for data below this node. */ if(!has_data_below(domain)) { /* nonexist this domain and all parent empty nonterminals */ domain_type* p = domain; while(p != NULL && p->rrsets == 0) { if(p == ce || has_data_below(p)) return p; p->is_existing = 0; p = p->parent; } } } return NULL; } static domain_type* rrset_delete(namedb_type* db, domain_type* domain, rrset_type* rrset) { int i; /* find previous */ rrset_type** pp = &domain->rrsets; while(*pp && *pp != rrset) { pp = &( (*pp)->next ); } if(!*pp) { /* rrset does not exist for domain */ return NULL; } *pp = rrset->next; DEBUG(DEBUG_XFRD,2, (LOG_INFO, "delete rrset of %s type %s", dname_to_string(domain_dname(domain),0), rrtype_to_string(rrset_rrtype(rrset)))); /* is this a SOA rrset ? */ if(rrset->zone->soa_rrset == rrset) { rrset->zone->soa_rrset = 0; rrset->zone->updated = 1; domain->has_SOA = 0; } if(rrset->zone->ns_rrset == rrset) { rrset->zone->ns_rrset = 0; } if(domain == rrset->zone->apex && rrset_rrtype(rrset) == TYPE_RRSIG) { for (i = 0; i < rrset->rr_count; ++i) { if (rr_rrsig_type_covered(&rrset->rrs[i]) == TYPE_DNSKEY) { rrset->zone->is_secure = 0; break; } } } #ifdef NSEC3 #ifndef FULL_PREHASH if (rrset->rrs[0].type == TYPE_NSEC3) { namedb_del_nsec3_domain(db, domain, rrset->zone); } #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ /* recycle the memory space of the rrset */ for (i = 0; i < rrset->rr_count; ++i) add_rdata_to_recyclebin(db, &rrset->rrs[i]); region_recycle(db->region, rrset->rrs, sizeof(rr_type) * rrset->rr_count); rrset->rr_count = 0; region_recycle(db->region, rrset, sizeof(rrset_type)); /* is the node now an empty node (completely deleted) */ if (domain->rrsets == 0) { return domain; } return NULL; } static int rdatas_equal(rdata_atom_type *a, rdata_atom_type *b, int num, uint16_t type) { int k; for(k = 0; k < num; k++) { if(rdata_atom_is_domain(type, k)) { if(dname_compare(domain_dname(a[k].domain), domain_dname(b[k].domain))!=0) return 0; } else { /* check length */ if(a[k].data[0] != b[k].data[0]) return 0; /* check data */ if(memcmp(a[k].data+1, b[k].data+1, a[k].data[0])!=0) return 0; } } return 1; } static int find_rr_num(rrset_type* rrset, uint16_t type, uint16_t klass, rdata_atom_type *rdatas, ssize_t rdata_num) { int i; for(i=0; i < rrset->rr_count; ++i) { if(rrset->rrs[i].type == type && rrset->rrs[i].klass == klass && rrset->rrs[i].rdata_count == rdata_num && rdatas_equal(rdatas, rrset->rrs[i].rdatas, rdata_num, type)) { return i; } } return -1; } static int delete_RR(namedb_type* db, const dname_type* dname, uint16_t type, uint16_t klass, domain_type* prevdomain, buffer_type* packet, size_t rdatalen, zone_type *zone, region_type* temp_region, int is_axfr) { domain_type *domain; rrset_type *rrset; domain = domain_table_find(db->domains, dname); if(!domain) { log_msg(LOG_WARNING, "diff: domain %s does not exist", dname_to_string(dname,0)); buffer_skip(packet, rdatalen); return 1; /* not fatal error */ } rrset = domain_find_rrset(domain, zone, type); if(!rrset) { log_msg(LOG_WARNING, "diff: rrset %s does not exist", dname_to_string(dname,0)); buffer_skip(packet, rdatalen); return 1; /* not fatal error */ } else { /* find the RR in the rrset */ domain_table_type *temptable; rdata_atom_type *rdatas; ssize_t rdata_num; int rrnum; temptable = domain_table_create(temp_region); /* This will ensure that the dnames in rdata are * normalized, conform RFC 4035, section 6.2 */ rdata_num = rdata_wireformat_to_rdata_atoms( temp_region, temptable, type, rdatalen, packet, &rdatas); if(rdata_num == -1) { log_msg(LOG_ERR, "diff: bad rdata for %s", dname_to_string(dname,0)); return 0; } rrnum = find_rr_num(rrset, type, klass, rdatas, rdata_num); if(rrnum == -1) { log_msg(LOG_WARNING, "diff: RR <%s, %s> does not exist", dname_to_string(dname,0), rrtype_to_string(type)); return 1; /* not fatal error */ } #ifdef NSEC3 #ifndef FULL_PREHASH if (is_axfr == 0) { struct domain *parent = domain; do { if (0 != namedb_add_nsec3_mod_domain(db, parent)) { return 0; } parent = parent->parent; } while (parent != zone->apex->parent); } #else (void)is_axfr; #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ if(rrset->rr_count == 1) { /* delete entire rrset */ domain = rrset_delete(db, domain, rrset); if (domain && domain != prevdomain && !domain->nextdiff) { /* this domain is not yet in the diff chain */ prevdomain->nextdiff = domain; } } else { /* swap out the bad RR and decrease the count */ rr_type* rrs_orig = rrset->rrs; add_rdata_to_recyclebin(db, &rrset->rrs[rrnum]); if(rrnum < rrset->rr_count-1) rrset->rrs[rrnum] = rrset->rrs[rrset->rr_count-1]; memset(&rrset->rrs[rrset->rr_count-1], 0, sizeof(rr_type)); /* realloc the rrs array one smaller */ rrset->rrs = region_alloc_init(db->region, rrs_orig, sizeof(rr_type) * (rrset->rr_count-1)); if(!rrset->rrs) { log_msg(LOG_ERR, "out of memory, %s:%d", __FILE__, __LINE__); exit(1); } region_recycle(db->region, rrs_orig, sizeof(rr_type) * rrset->rr_count); rrset->rr_count --; } } return 1; } static int add_RR(namedb_type* db, const dname_type* dname, uint16_t type, uint16_t klass, uint32_t ttl, buffer_type* packet, size_t rdatalen, zone_type *zone, int is_axfr) { domain_type* domain; rrset_type* rrset; rdata_atom_type *rdatas; rr_type *rrs_old; ssize_t rdata_num; int rrnum; domain = domain_table_find(db->domains, dname); if(!domain) { /* create the domain */ domain = domain_table_insert(db->domains, dname); } rrset = domain_find_rrset(domain, zone, type); if(!rrset) { /* create the rrset */ rrset = region_alloc(db->region, sizeof(rrset_type)); if(!rrset) { log_msg(LOG_ERR, "out of memory, %s:%d", __FILE__, __LINE__); exit(1); } rrset->zone = zone; rrset->rrs = 0; rrset->rr_count = 0; domain_add_rrset(domain, rrset); } /* dnames in rdata are normalized, conform RFC 4035, * Section 6.2 */ rdata_num = rdata_wireformat_to_rdata_atoms( db->region, db->domains, type, rdatalen, packet, &rdatas); if(rdata_num == -1) { log_msg(LOG_ERR, "diff: bad rdata for %s", dname_to_string(dname,0)); return 0; } rrnum = find_rr_num(rrset, type, klass, rdatas, rdata_num); if(rrnum != -1) { DEBUG(DEBUG_XFRD, 2, (LOG_ERR, "diff: RR <%s, %s> already exists", dname_to_string(dname,0), rrtype_to_string(type))); /* ignore already existing RR: lenient accepting of messages */ return 1; } if(domain == zone->apex) { /* make sure we don't get multiple soa rrs */ if (type == TYPE_SOA && rrset->rr_count > 0) { log_msg(LOG_ERR, "diff: multiple soa records for %s", dname_to_string(dname,0)); return 0; } } /* re-alloc the rrs and add the new */ rrs_old = rrset->rrs; rrset->rrs = region_alloc(db->region, (rrset->rr_count+1) * sizeof(rr_type)); if(!rrset->rrs) { log_msg(LOG_ERR, "out of memory, %s:%d", __FILE__, __LINE__); exit(1); } if(rrs_old) memcpy(rrset->rrs, rrs_old, rrset->rr_count * sizeof(rr_type)); region_recycle(db->region, rrs_old, sizeof(rr_type) * rrset->rr_count); rrset->rr_count ++; rrset->rrs[rrset->rr_count - 1].owner = domain; rrset->rrs[rrset->rr_count - 1].rdatas = rdatas; rrset->rrs[rrset->rr_count - 1].ttl = ttl; rrset->rrs[rrset->rr_count - 1].type = type; rrset->rrs[rrset->rr_count - 1].klass = klass; rrset->rrs[rrset->rr_count - 1].rdata_count = rdata_num; /* see if it is a SOA */ if(domain == zone->apex) { if(type == TYPE_SOA) { uint32_t soa_minimum; zone->soa_rrset = rrset; zone->updated = 1; /* BUG #103 tweaked SOA ttl value */ if(zone->soa_nx_rrset == 0) { zone->soa_nx_rrset = region_alloc(db->region, sizeof(rrset_type)); if(!zone->soa_nx_rrset) { log_msg(LOG_ERR, "out of memory, %s:%d", __FILE__, __LINE__); exit(1); } zone->soa_nx_rrset->rr_count = 1; zone->soa_nx_rrset->next = 0; zone->soa_nx_rrset->zone = zone; zone->soa_nx_rrset->rrs = region_alloc(db->region, sizeof(rr_type)); if(!zone->soa_nx_rrset->rrs) { log_msg(LOG_ERR, "out of memory, %s:%d", __FILE__, __LINE__); exit(1); } } memcpy(zone->soa_nx_rrset->rrs, rrset->rrs, sizeof(rr_type)); memcpy(&soa_minimum, rdata_atom_data(rrset->rrs->rdatas[6]), rdata_atom_size(rrset->rrs->rdatas[6])); if (rrset->rrs->ttl > ntohl(soa_minimum)) { rrset->zone->soa_nx_rrset->rrs[0].ttl = ntohl(soa_minimum); } domain->has_SOA = 1; } if(type == TYPE_NS) { zone->ns_rrset = rrset; } if(type == TYPE_RRSIG) { int i; for (i = 0; i < rrset->rr_count; ++i) { if (rr_rrsig_type_covered(&rrset->rrs[i]) == TYPE_DNSKEY) { zone->is_secure = 1; break; } } } } #ifdef NSEC3 #ifndef FULL_PREHASH if ((type == TYPE_NSEC3) && (rrset->rr_count == 1)) { /* NSEC3 RRset just added */ if (0 != namedb_add_nsec3_domain(db, domain, zone)) return 0; } if (is_axfr == 0) { struct domain *parent = domain; do { if (0 != namedb_add_nsec3_mod_domain(db, parent)) return 0; parent = parent->parent; } while (parent != zone->apex->parent); } #else (void)is_axfr; #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ return 1; } static zone_type* find_zone(namedb_type* db, const dname_type* zone_name, nsd_options_t* opt, size_t child_count) { domain_type *domain; zone_type* zone; zone_options_t* opts; domain = domain_table_find(db->domains, zone_name); if(!domain) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfr: creating domain %s", dname_to_string(zone_name,0))); /* create the zone and domain of apex (zone has config options) */ domain = domain_table_insert(db->domains, zone_name); } else { /* O(1) if SOA exists */ zone = domain_find_zone(domain); /* if domain was empty (no rrsets, empty zone) search in zonelist */ /* check apex to make sure we don't find a parent zone */ if(!zone || zone->apex != domain) zone = namedb_find_zone(db, domain); if(zone) { assert(zone->apex == domain); return zone; } } /* lookup in config */ opts = zone_options_find(opt, domain_dname(domain)); if(!opts) { log_msg(LOG_ERR, "xfr: zone %s not in config.", dname_to_string(zone_name,0)); return 0; } /* create the zone */ DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfr: creating zone_type %s", dname_to_string(zone_name,0))); zone = (zone_type *) region_alloc(db->region, sizeof(zone_type)); if(!zone) { log_msg(LOG_ERR, "out of memory, %s:%d", __FILE__, __LINE__); exit(1); } zone->next = db->zones; zone->opts = opts; db->zones = zone; db->zone_count++; zone->apex = domain; zone->soa_rrset = 0; zone->soa_nx_rrset = 0; zone->ns_rrset = 0; #ifdef NSEC3 zone->nsec3_soa_rr = NULL; zone->nsec3_last = NULL; #endif zone->dirty = region_alloc(db->region, sizeof(uint8_t)*child_count); if(!zone->dirty) { log_msg(LOG_ERR, "out of memory, %s:%d", __FILE__, __LINE__); exit(1); } memset(zone->dirty, 0, sizeof(uint8_t)*child_count); #ifdef NSEC3 #ifndef FULL_PREHASH zone->nsec3_domains = NULL; if (0 != zone_nsec3_domains_create(db, zone)) { log_msg(LOG_ERR, "xfr: zone NSEC3 domains " "memory allocation failure"); return 0; } #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ zone->number = db->zone_count; zone->is_secure = 0; zone->updated = 1; zone->is_ok = 0; return zone; } static void delete_zone_rrs(namedb_type* db, zone_type* zone) { rrset_type *rrset; domain_type *domain = zone->apex; domain_type *next = NULL; zone->updated = 1; #ifdef NSEC3 #ifndef FULL_PREHASH zone_nsec3_domains_destroy(db, zone); #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ /* go through entire tree below the zone apex (incl subzones) */ while(domain && dname_is_subdomain( domain_dname(domain), domain_dname(zone->apex))) { DEBUG(DEBUG_XFRD,2, (LOG_INFO, "delete zone visit %s", dname_to_string(domain_dname(domain),0))); /* delete all rrsets of the zone */ while((rrset = domain_find_any_rrset(domain, zone))) { (void)rrset_delete(db, domain, rrset); } next = domain_next(domain); domain->nextdiff = next; domain = next; } #ifdef NSEC3 #ifndef FULL_PREHASH if (0 != zone_nsec3_domains_create(db, zone)) { log_msg(LOG_ERR, "Zone %s: unable to create zone NSEC3 prehash table", dname_to_string(domain_dname(zone->apex), NULL)); } #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ DEBUG(DEBUG_XFRD, 1, (LOG_INFO, "axfrdel: recyclebin holds %lu bytes", (unsigned long) region_get_recycle_size(db->region))); #ifndef NDEBUG if(nsd_debug_level >= 1) region_log_stats(db->region); #endif assert(zone->soa_rrset == 0); /* keep zone->soa_nx_rrset alloced */ assert(zone->ns_rrset == 0); assert(zone->is_secure == 0); assert(zone->updated == 1); } /* fix empty terminals */ static void fix_empty_terminals(zone_type* zone_db) { domain_type* domain = zone_db->apex, *ce = NULL, *next = NULL; while (domain) { ce = rrset_delete_empty_terminals(domain, ce); next = domain->nextdiff; domain->nextdiff = NULL; domain = next; } } /* return value 0: syntaxerror,badIXFR, 1:OK, 2:done_and_skip_it */ static int apply_ixfr(namedb_type* db, FILE *in, const off_t* startpos, const char* zone, uint32_t serialno, nsd_options_t* opt, uint16_t id, uint32_t seq_nr, uint32_t seq_total, int* is_axfr, int* delete_mode, int* rr_count, size_t child_count) { uint32_t filelen, msglen, pkttype, timestamp[2]; int qcount, ancount, counter; buffer_type* packet; region_type* region; int i; uint16_t rrlen; const dname_type *dname_zone, *dname; zone_type* zone_db; domain_type* last_in_list; char file_zone_name[3072]; uint32_t file_serial, file_seq_nr; uint16_t file_id; off_t mempos; memmove(&mempos, startpos, sizeof(off_t)); if(fseeko(in, mempos, SEEK_SET) == -1) { log_msg(LOG_INFO, "could not fseeko: %s.", strerror(errno)); return 0; } /* read ixfr packet RRs and apply to in memory db */ if(!diff_read_32(in, &pkttype) || pkttype != DIFF_PART_IXFR) { log_msg(LOG_ERR, "could not read type or wrong type"); return 0; } if(!diff_read_32(in, ×tamp[0]) || !diff_read_32(in, ×tamp[1])) { log_msg(LOG_ERR, "could not read timestamp"); return 0; } if(!diff_read_32(in, &filelen)) { log_msg(LOG_ERR, "could not read len"); return 0; } /* read header */ if(filelen < QHEADERSZ + sizeof(uint32_t)*3 + sizeof(uint16_t)) { log_msg(LOG_ERR, "msg too short"); return 0; } region = region_create(xalloc, free); if(!region) { log_msg(LOG_ERR, "out of memory"); return 0; } if(!diff_read_str(in, file_zone_name, sizeof(file_zone_name)) || !diff_read_32(in, &file_serial) || !diff_read_16(in, &file_id) || !diff_read_32(in, &file_seq_nr)) { log_msg(LOG_ERR, "could not part data"); region_destroy(region); return 0; } if(strcmp(file_zone_name, zone) != 0 || serialno != file_serial || id != file_id || seq_nr != file_seq_nr) { log_msg(LOG_ERR, "internal error: reading part with changed id"); region_destroy(region); return 0; } msglen = filelen - sizeof(uint32_t)*3 - sizeof(uint16_t) - strlen(file_zone_name); packet = buffer_create(region, QIOBUFSZ); dname_zone = dname_parse(region, zone); zone_db = find_zone(db, dname_zone, opt, child_count); if(!zone_db) { log_msg(LOG_ERR, "no zone exists"); region_destroy(region); /* break out and stop the IXFR, ignore it */ return 2; } if(msglen > QIOBUFSZ) { log_msg(LOG_ERR, "msg too long"); region_destroy(region); return 0; } buffer_clear(packet); if(fread(buffer_begin(packet), msglen, 1, in) != 1) { log_msg(LOG_ERR, "short fread: %s", strerror(errno)); region_destroy(region); return 0; } buffer_set_limit(packet, msglen); /* only answer section is really used, question, additional and authority section RRs are skipped */ qcount = QDCOUNT(packet); ancount = ANCOUNT(packet); buffer_skip(packet, QHEADERSZ); /* skip queries */ for(i=0; iapex; for(; counter < ancount; ++counter,++(*rr_count)) { uint16_t type, klass; uint32_t ttl; if(!(dname=dname_make_from_packet(region, packet, 1,1))) { log_msg(LOG_ERR, "bad xfr RR dname %d", *rr_count); region_destroy(region); return 0; } if(!buffer_available(packet, 10)) { log_msg(LOG_ERR, "bad xfr RR format %d", *rr_count); region_destroy(region); return 0; } type = buffer_read_u16(packet); klass = buffer_read_u16(packet); ttl = buffer_read_u32(packet); rrlen = buffer_read_u16(packet); if(!buffer_available(packet, rrlen)) { log_msg(LOG_ERR, "bad xfr RR rdata %d, len %d have %d", *rr_count, rrlen, (int)buffer_remaining(packet)); region_destroy(region); return 0; } DEBUG(DEBUG_XFRD,2, (LOG_INFO, "diff: %s parsed count %d, ax %d, delmode %d", dname_to_string(dname_zone, 0), *rr_count, *is_axfr, *delete_mode)); if(*rr_count == 1 && type != TYPE_SOA) { /* second RR: if not SOA: this is an AXFR; delete all zone contents */ delete_zone_rrs(db, zone_db); /* add everything else (incl end SOA) */ *delete_mode = 0; *is_axfr = 1; DEBUG(DEBUG_XFRD,2, (LOG_INFO, "diff: %s sawAXFR count %d, ax %d, delmode %d", dname_to_string(dname_zone, 0), *rr_count, *is_axfr, *delete_mode)); } if(*rr_count == 1 && type == TYPE_SOA) { /* if the serial no of the SOA equals the serialno, then AXFR */ size_t bufpos = buffer_position(packet); uint32_t thisserial; if(!packet_skip_dname(packet) || !packet_skip_dname(packet) || buffer_remaining(packet) < sizeof(uint32_t)*5) { log_msg(LOG_ERR, "bad xfr SOA RR formerr."); region_destroy(region); return 0; } thisserial = buffer_read_u32(packet); if(thisserial == serialno) { /* AXFR */ delete_zone_rrs(db, zone_db); *delete_mode = 0; *is_axfr = 1; } /* must have stuff in memory for a successful IXFR, * the serial number of the SOA has been checked * previously (by check_for_bad_serial) if it exists */ if(!*is_axfr && !domain_find_rrset(zone_db->apex, zone_db, TYPE_SOA)) { log_msg(LOG_ERR, "%s SOA serial %d is not " "in memory, skip IXFR", zone, serialno); region_destroy(region); /* break out and stop the IXFR, ignore it */ return 2; } buffer_set_position(packet, bufpos); } if(type == TYPE_SOA && !*is_axfr) { /* switch from delete-part to add-part and back again, just before soa - so it gets deleted and added too */ /* this means we switch to delete mode for the final SOA */ *delete_mode = !*delete_mode; DEBUG(DEBUG_XFRD,2, (LOG_INFO, "diff: %s IXFRswapdel count %d, ax %d, delmode %d", dname_to_string(dname_zone, 0), *rr_count, *is_axfr, *delete_mode)); } if(type == TYPE_TSIG || type == TYPE_OPT) { /* ignore pseudo RRs */ buffer_skip(packet, rrlen); continue; } DEBUG(DEBUG_XFRD,2, (LOG_INFO, "xfr %s RR dname is %s type %s", *delete_mode?"del":"add", dname_to_string(dname,0), rrtype_to_string(type))); if(*delete_mode) { /* delete this rr */ if(!*is_axfr && type == TYPE_SOA && counter==ancount-1 && seq_nr == seq_total-1) { continue; /* do not delete final SOA RR for IXFR */ } if(!delete_RR(db, dname, type, klass, last_in_list, packet, rrlen, zone_db, region, *is_axfr)) { region_destroy(region); return 0; } if (!*is_axfr && last_in_list->nextdiff) { last_in_list = last_in_list->nextdiff; } } else { /* add this rr */ if(!add_RR(db, dname, type, klass, ttl, packet, rrlen, zone_db, *is_axfr)) { region_destroy(region); return 0; } } } fix_empty_terminals(zone_db); region_destroy(region); return 1; } static int check_for_bad_serial(namedb_type* db, const char* zone_str, uint32_t old_serial) { /* see if serial OK with in-memory serial */ domain_type* domain; region_type* region = region_create(xalloc, free); const dname_type* zone_name = dname_parse(region, zone_str); zone_type* zone = 0; domain = domain_table_find(db->domains, zone_name); if(domain) zone = domain_find_zone(domain); if(zone && zone->apex == domain && zone->soa_rrset && old_serial) { uint32_t memserial; memcpy(&memserial, rdata_atom_data(zone->soa_rrset->rrs[0].rdatas[2]), sizeof(uint32_t)); if(old_serial != ntohl(memserial)) { region_destroy(region); return 1; } } region_destroy(region); return 0; } /* for multiple tcp packets use a data structure that has * a rbtree (zone_names) with for each zone: * has a rbtree by sequence number * with inside a serial_number and ID (for checking only) * and contains a off_t to the IXFR packet in the file. * so when you get a commit for a zone, get zone obj, find sequence, * then check if you have all sequence numbers available. Apply all packets. */ struct diff_read_data { /* rbtree of struct diff_zone*/ rbtree_t* zones; /* region for allocation */ region_type* region; }; struct diff_zone { /* key is dname of zone */ rbnode_t node; /* rbtree of struct diff_xfrpart */ rbtree_t* parts; }; struct diff_xfrpart { /* key is sequence number */ rbnode_t node; uint32_t seq_nr; uint32_t new_serial; uint16_t id; off_t file_pos; }; static struct diff_read_data* diff_read_data_create() { region_type* region = region_create(xalloc, free); struct diff_read_data* data = (struct diff_read_data*) region_alloc(region, sizeof(struct diff_read_data)); if(!data) { log_msg(LOG_ERR, "out of memory, %s:%d", __FILE__, __LINE__); exit(1); } data->region = region; data->zones = rbtree_create(region, (int (*)(const void *, const void *)) dname_compare); return data; } static struct diff_zone* diff_read_find_zone(struct diff_read_data* data, const char* name) { const dname_type* dname = dname_parse(data->region, name); struct diff_zone* zp = (struct diff_zone*) rbtree_search(data->zones, dname); return zp; } static int intcompf(const void* a, const void* b) { if(*(uint32_t*)a < *(uint32_t*)b) return -1; if(*(uint32_t*)a > *(uint32_t*)b) return +1; return 0; } static struct diff_zone* diff_read_insert_zone(struct diff_read_data* data, const char* name) { const dname_type* dname = dname_parse(data->region, name); struct diff_zone* zp = region_alloc(data->region, sizeof(struct diff_zone)); if(!zp) { log_msg(LOG_ERR, "out of memory, %s:%d", __FILE__, __LINE__); exit(1); } zp->node = *RBTREE_NULL; zp->node.key = dname; zp->parts = rbtree_create(data->region, intcompf); rbtree_insert(data->zones, (rbnode_t*)zp); return zp; } static struct diff_xfrpart* diff_read_find_part(struct diff_zone* zp, uint32_t seq_nr) { struct diff_xfrpart* xp = (struct diff_xfrpart*) rbtree_search(zp->parts, &seq_nr); return xp; } static struct diff_xfrpart* diff_read_insert_part(struct diff_read_data* data, struct diff_zone* zp, uint32_t seq_nr) { struct diff_xfrpart* xp = region_alloc(data->region, sizeof(struct diff_xfrpart)); if(!xp) { log_msg(LOG_ERR, "out of memory, %s:%d", __FILE__, __LINE__); exit(1); } xp->node = *RBTREE_NULL; xp->node.key = &xp->seq_nr; xp->seq_nr = seq_nr; rbtree_insert(zp->parts, (rbnode_t*)xp); return xp; } /* mark commit as rollback and close inputfile, fatal exits */ static void mark_and_exit(nsd_options_t* opt, FILE* f, off_t commitpos, const char* desc) { const char* filename = opt->difffile; fclose(f); if(!(f = fopen(filename, "r+"))) { log_msg(LOG_ERR, "mark xfr, failed to re-open difffile %s: %s", filename, strerror(errno)); } else if(fseeko(f, commitpos, SEEK_SET) == -1) { log_msg(LOG_INFO, "could not fseeko: %s.", strerror(errno)); fclose(f); } else { uint8_t c = 0; (void)write_data(f, &c, sizeof(c)); fclose(f); log_msg(LOG_ERR, "marked xfr as failed: %s", desc); log_msg(LOG_ERR, "marked xfr so that next reload can succeed"); } exit(1); } static int read_sure_part(namedb_type* db, FILE *in, nsd_options_t* opt, struct diff_read_data* data, struct diff_log** log, size_t child_count) { char zone_buf[3072]; char log_buf[5120]; uint32_t old_serial, new_serial, num_parts; uint16_t id; uint8_t committed; struct diff_zone *zp; uint32_t i; int have_all_parts = 1; struct diff_log* thislog = 0; off_t commitpos; /* read zone name and serial */ if(!diff_read_str(in, zone_buf, sizeof(zone_buf)) || !diff_read_32(in, &old_serial) || !diff_read_32(in, &new_serial) || !diff_read_16(in, &id) || !diff_read_32(in, &num_parts)) { log_msg(LOG_ERR, "diff file bad commit part"); return 0; } commitpos = ftello(in); /* position of commit byte */ if(commitpos == -1) { log_msg(LOG_INFO, "could not ftello: %s.", strerror(errno)); return 0; } if(!diff_read_8(in, &committed) || !diff_read_str(in, log_buf, sizeof(log_buf)) ) { log_msg(LOG_ERR, "diff file bad commit part"); return 0; } if(log) { thislog = (struct diff_log*)region_alloc(db->region, sizeof(struct diff_log)); if(!thislog) { log_msg(LOG_ERR, "out of memory, %s:%d", __FILE__, __LINE__); exit(1); } thislog->zone_name = region_strdup(db->region, zone_buf); thislog->comment = region_strdup(db->region, log_buf); thislog->error = 0; thislog->next = *log; *log = thislog; } /* has been read in completely */ zp = diff_read_find_zone(data, zone_buf); if(!zp) { log_msg(LOG_ERR, "diff file commit without IXFR"); if(thislog) thislog->error = "error no IXFR parts"; return 1; } if(committed && check_for_bad_serial(db, zone_buf, old_serial)) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "skipping diff file commit with bad serial")); zp->parts->root = RBTREE_NULL; zp->parts->count = 0; if(thislog) thislog->error = "error bad serial"; return 1; } for(i=0; iid != id || xp->new_serial != new_serial) { have_all_parts = 0; } } if(!have_all_parts) { DEBUG(DEBUG_XFRD,1, (LOG_ERR, "skipping diff file commit without all parts")); if(thislog) thislog->error = "error missing parts"; } if(committed && have_all_parts) { int is_axfr=0, delete_mode=0, rr_count=0; off_t resume_pos; #ifdef NSEC3 #ifndef FULL_PREHASH struct region *region; dname_type const *zone_dname; struct zone *zone; region = region_create(xalloc, free); if (region == NULL) { log_msg(LOG_ERR, "out of memory"); return 0; } zone_dname = dname_parse(region, zone_buf); if (zone_dname == NULL) { log_msg(LOG_ERR, "out of memory"); region_destroy(region); return 0; } zone = find_zone(db, zone_dname, opt, child_count); region_destroy(region); if (zone == NULL) { log_msg(LOG_ERR, "no zone exists"); /* just stop trying applying ixfr */ return 1; } if (0 != namedb_nsec3_mod_domains_create(db)) { log_msg(LOG_ERR, "unable to allocate space " "for modified NSEC3 domains"); return 0; } #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ DEBUG(DEBUG_XFRD,1, (LOG_INFO, "processing xfr: %s", log_buf)); resume_pos = ftello(in); if(resume_pos == -1) { log_msg(LOG_INFO, "could not ftello: %s.", strerror(errno)); return 0; } for(i=0; ifile_pos, zone_buf, new_serial, opt, id, xp->seq_nr, num_parts, &is_axfr, &delete_mode, &rr_count, child_count); if(ret == 0) { log_msg(LOG_ERR, "bad ixfr packet part %d in %s", (int)i, opt->difffile); mark_and_exit(opt, in, commitpos, log_buf); } else if(ret == 2) { break; } } #ifdef NSEC3 #ifndef FULL_PREHASH if (is_axfr != 0) prehash_zone(db, zone); else prehash_zone_incremental(db, zone); #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ if(fseeko(in, resume_pos, SEEK_SET) == -1) { log_msg(LOG_INFO, "could not fseeko: %s.", strerror(errno)); return 0; } } else { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "skipping xfr: %s", log_buf)); } /* clean out the parts for the zone after the commit/rollback */ zp->parts->root = RBTREE_NULL; zp->parts->count = 0; return 1; } static int store_ixfr_data(FILE *in, uint32_t len, struct diff_read_data* data, off_t* startpos) { char zone_name[3072]; struct diff_zone* zp; struct diff_xfrpart* xp; uint32_t new_serial, seq; uint16_t id; if(!diff_read_str(in, zone_name, sizeof(zone_name)) || !diff_read_32(in, &new_serial) || !diff_read_16(in, &id) || !diff_read_32(in, &seq)) { log_msg(LOG_INFO, "could not read ixfr store info: file format error"); return 0; } len -= sizeof(uint32_t)*3 + sizeof(uint16_t) + strlen(zone_name); if(fseeko(in, len, SEEK_CUR) == -1) log_msg(LOG_INFO, "fseek failed: %s", strerror(errno)); /* store the info */ zp = diff_read_find_zone(data, zone_name); if(!zp) zp = diff_read_insert_zone(data, zone_name); xp = diff_read_find_part(zp, seq); if(xp) { log_msg(LOG_INFO, "discarding partial xfr part: %s %d", zone_name, seq); /* overwrite with newer value (which probably relates to next commit) */ } else { xp = diff_read_insert_part(data, zp, seq); } xp->new_serial = new_serial; xp->id = id; memmove(&xp->file_pos, startpos, sizeof(off_t)); return 1; } static int read_process_part(namedb_type* db, FILE *in, uint32_t type, nsd_options_t* opt, struct diff_read_data* data, struct diff_log** log, size_t child_count, off_t* startpos) { uint32_t len, len2; /* read length */ if(!diff_read_32(in, &len)) return 1; /* read content */ if(type == DIFF_PART_IXFR) { DEBUG(DEBUG_XFRD,2, (LOG_INFO, "part IXFR len %d", len)); if(!store_ixfr_data(in, len, data, startpos)) return 0; } else if(type == DIFF_PART_SURE) { DEBUG(DEBUG_XFRD,2, (LOG_INFO, "part SURE len %d", len)); if(!read_sure_part(db, in, opt, data, log, child_count)) return 0; } else { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "unknown part %x len %d", type, len)); return 0; } /* read length */ if(!diff_read_32(in, &len2)) return 1; /* short read is OK */ /* verify length */ if(len != len2) return 0; /* bad data is wrong */ return 1; } /* * Finds smallest offset in data structs * returns 0 if no offsets in the data structs. */ static int find_smallest_offset(struct diff_read_data* data, off_t* offset) { int found_any = 0; struct diff_zone* dz; struct diff_xfrpart* dx; off_t mem_offset, mem_fpos; if(!data || !data->zones) return 0; RBTREE_FOR(dz, struct diff_zone*, data->zones) { if(!dz->parts) continue; RBTREE_FOR(dx, struct diff_xfrpart*, dz->parts) { memmove(&mem_fpos, &dx->file_pos, sizeof(off_t)); if(found_any) { memmove(&mem_offset, offset, sizeof(off_t)); if(mem_fpos < mem_offset) memmove(offset, &mem_fpos, sizeof(off_t)); } else { found_any = 1; memmove(offset, &mem_fpos, sizeof(off_t)); } } } return found_any; } int diff_read_file(namedb_type* db, nsd_options_t* opt, struct diff_log** log, size_t child_count) { const char* filename = opt->difffile; FILE *df; uint32_t type, timestamp[2], curr_timestamp[2]; struct diff_read_data* data = diff_read_data_create(); off_t startpos; df = fopen(filename, "r"); if(!df) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "could not open file %s for reading: %s", filename, strerror(errno))); region_destroy(data->region); return 1; } /* check timestamp */ curr_timestamp[0] = (uint32_t) db->diff_timestamp.tv_sec; curr_timestamp[1] = (uint32_t) db->diff_timestamp.tv_usec; if(!diff_read_32(df, &type)) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "difffile %s is empty", filename)); db->diff_skip = 0; db->diff_pos = 0; } else if (!diff_read_32(df, ×tamp[0]) || !diff_read_32(df, ×tamp[1])) { log_msg(LOG_ERR, "difffile %s bad first part: no timestamp", filename); region_destroy(data->region); fclose(df); return 0; } else if (curr_timestamp[0] != timestamp[0] || curr_timestamp[1] != timestamp[1]) { /* new timestamp, no skipping */ db->diff_timestamp.tv_sec = (time_t) timestamp[0]; db->diff_timestamp.tv_usec = (suseconds_t) timestamp[1]; if (db->diff_skip) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "new timestamp on " "difffile %s, restoring diff_skip and diff_pos " "[old timestamp: %u.%u; new timestamp: %u.%u]", filename, curr_timestamp[0], curr_timestamp[1], timestamp[0], timestamp[1])); db->diff_skip = 0; db->diff_pos = 0; } } /* Always seek, to diff_pos or to beginning of the file. */ if (fseeko(df, 0, SEEK_SET)==-1) { log_msg(LOG_INFO, "could not fseeko file %s: %s.", filename, strerror(errno)); region_destroy(data->region); fclose(df); return 0; } if(db->diff_skip) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "skip diff file")); if(fseeko(df, db->diff_pos, SEEK_SET)==-1) { log_msg(LOG_INFO, "could not fseeko file %s: %s. " "Reread from start.", filename, strerror(errno)); } } startpos = ftello(df); if(startpos == -1) { log_msg(LOG_INFO, "could not ftello: %s.", strerror(errno)); region_destroy(data->region); fclose(df); return 0; } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "start of diff file read at pos %u", (uint32_t) db->diff_pos)); while(diff_read_32(df, &type)) { DEBUG(DEBUG_XFRD,2, (LOG_INFO, "iter loop")); /* read timestamp */ if(!diff_read_32(df, ×tamp[0]) || !diff_read_32(df, ×tamp[1])) { log_msg(LOG_INFO, "could not read timestamp: %s.", strerror(errno)); region_destroy(data->region); fclose(df); return 0; } if(!read_process_part(db, df, type, opt, data, log, child_count, &startpos)) { log_msg(LOG_INFO, "error processing diff file"); region_destroy(data->region); fclose(df); return 0; } startpos = ftello(df); if(startpos == -1) { log_msg(LOG_INFO, "could not ftello: %s.", strerror(errno)); region_destroy(data->region); fclose(df); return 0; } } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "end of diff file read")); if(find_smallest_offset(data, &db->diff_pos)) { /* can skip to the first unused element */ DEBUG(DEBUG_XFRD,2, (LOG_INFO, "next time skip diff file")); db->diff_skip = 1; } else { /* all processed, can skip to here next time */ DEBUG(DEBUG_XFRD,2, (LOG_INFO, "next time skip diff file")); db->diff_skip = 1; db->diff_pos = ftello(df); if(db->diff_pos == -1) { log_msg(LOG_INFO, "could not ftello: %s.", strerror(errno)); db->diff_skip = 0; } } region_destroy(data->region); fclose(df); return 1; } static int diff_broken(FILE *df, off_t* break_pos) { uint32_t type, len, len2; *break_pos = ftello(df); /* try to read and validate parts of the file */ while(diff_read_32(df, &type)) /* cannot read type is no error, normal EOF */ { /* check type */ if(type != DIFF_PART_IXFR && type != DIFF_PART_SURE) return 1; /* check length */ if(!diff_read_32(df, &len)) return 1; /* EOF inside the part is error */ if(fseeko(df, len, SEEK_CUR) == -1) { log_msg(LOG_INFO, "fseeko failed: %s", strerror(errno)); return 1; } /* fseek clears EOF flag, but try reading length value, if EOF, the part is truncated */ if(!diff_read_32(df, &len2)) return 1; if(len != len2) return 1; /* bad part, lengths must agree */ /* this part is ok */ *break_pos = ftello(df); } return 0; } void diff_snip_garbage(namedb_type* db, nsd_options_t* opt) { off_t break_pos; const char* filename = opt->difffile; FILE *df; /* open file here and keep open, so it cannot change under our nose */ df = fopen(filename, "r+"); if(!df) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "could not open file %s for garbage collecting: %s", filename, strerror(errno))); return; } /* and skip into file, since nsd does not read anything before the pos */ if(db->diff_skip) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "garbage collect skip diff file")); if(fseeko(df, db->diff_pos, SEEK_SET)==-1) { log_msg(LOG_INFO, "could not fseeko file %s: %s.", filename, strerror(errno)); fclose(df); return; } } /* detect break point */ if(diff_broken(df, &break_pos)) { /* snip off at break_pos */ DEBUG(DEBUG_XFRD,1, (LOG_INFO, "snipping off trailing partial part of %s", filename)); if(ftruncate(fileno(df), break_pos) == -1) log_msg(LOG_ERR, "ftruncate %s failed: %s", filename, strerror(errno)); } fclose(df); } nsd-3.2.16/answer.c0000664000175000017500000000461411761673243013035 0ustar matjematje/* * answer.c -- manipulating query answers and encoding them. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include "answer.h" #include "packet.h" #include "query.h" void answer_init(answer_type *answer) { answer->rrset_count = 0; } int answer_add_rrset(answer_type *answer, rr_section_type section, domain_type *domain, rrset_type *rrset) { size_t i; assert(section >= ANSWER_SECTION && section < RR_SECTION_COUNT); assert(domain); assert(rrset); /* Don't add an RRset multiple times. */ for (i = 0; i < answer->rrset_count; ++i) { if (answer->rrsets[i] == rrset && answer->domains[i] == domain) { if (section < answer->section[i]) { answer->section[i] = section; return 1; } else { return 0; } } } if (answer->rrset_count >= MAXRRSPP) { /* XXX: Generate warning/error? */ return 0; } answer->section[answer->rrset_count] = section; answer->domains[answer->rrset_count] = domain; answer->rrsets[answer->rrset_count] = rrset; ++answer->rrset_count; return 1; } void encode_answer(query_type *q, const answer_type *answer) { uint16_t counts[RR_SECTION_COUNT]; rr_section_type section; size_t i; int minimal_respsize = IPV4_MINIMAL_RESPONSE_SIZE; int done = 0; #if defined(INET6) && defined(MINIMAL_RESPONSES) if (q->addr.ss_family == AF_INET6) minimal_respsize = IPV6_MINIMAL_RESPONSE_SIZE; #endif for (section = ANSWER_SECTION; section < RR_SECTION_COUNT; ++section) { counts[section] = 0; } for (section = ANSWER_SECTION; !TC(q->packet) && section < RR_SECTION_COUNT; ++section) { for (i = 0; !TC(q->packet) && i < answer->rrset_count; ++i) { if (answer->section[i] == section) { counts[section] += packet_encode_rrset( q, answer->domains[i], answer->rrsets[i], section, minimal_respsize, &done); } } #ifdef MINIMAL_RESPONSES /** * done is set prematurely, because the minimal response size * has been reached. No need to try adding RRsets in following * sections. */ if (done) { break; } #endif } ANCOUNT_SET(q->packet, counts[ANSWER_SECTION]); NSCOUNT_SET(q->packet, counts[AUTHORITY_SECTION] + counts[OPTIONAL_AUTHORITY_SECTION]); ARCOUNT_SET(q->packet, counts[ADDITIONAL_A_SECTION] + counts[ADDITIONAL_AAAA_SECTION] + counts[ADDITIONAL_OTHER_SECTION]); } nsd-3.2.16/axfr.h0000664000175000017500000000103411535444205012465 0ustar matjematje/* * axfr.h -- generating AXFR responses. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _AXFR_H_ #define _AXFR_H_ #include "nsd.h" #include "query.h" /* * For optimal compression AXFR response packets are limited in size * to MAX_COMPRESSION_OFFSET. */ #define AXFR_MAX_MESSAGE_LEN MAX_COMPRESSION_OFFSET query_state_type answer_axfr_ixfr(struct nsd *nsd, struct query *q); query_state_type query_axfr(struct nsd *nsd, struct query *query); #endif /* _AXFR_H_ */ nsd-3.2.16/xfrd-disk.c0000664000175000017500000003111412160600467013414 0ustar matjematje/* * xfrd-disk.c - XFR (transfer) Daemon TCP system source file. Read/Write state to disk. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include "xfrd-disk.h" #include "xfrd.h" #include "buffer.h" #include "nsd.h" #include "options.h" /* quick tokenizer, reads words separated by whitespace. No quoted strings. Comments are skipped (#... eol). */ static char* xfrd_read_token(FILE* in) { static char buf[4000]; buf[sizeof(buf)-1]=0; while(1) { if(fscanf(in, " %3990s", buf) != 1) return 0; if(buf[0] != '#') return buf; if(!fgets(buf, sizeof(buf), in)) return 0; } } static int xfrd_read_i16(FILE *in, uint16_t* v) { char* p = xfrd_read_token(in); if(!p) return 0; *v=atoi(p); return 1; } static int xfrd_read_i32(FILE *in, uint32_t* v) { char* p = xfrd_read_token(in); if(!p) return 0; *v=atoi(p); return 1; } static int xfrd_read_time_t(FILE *in, time_t* v) { char* p = xfrd_read_token(in); if(!p) return 0; *v=atol(p); return 1; } static int xfrd_read_check_str(FILE* in, const char* str) { char *p = xfrd_read_token(in); if(!p) return 0; if(strcmp(p, str) != 0) return 0; return 1; } static int xfrd_read_state_soa(FILE* in, const char* id_acquired, const char* id, xfrd_soa_t* soa, time_t* soatime) { char *p; if(!xfrd_read_check_str(in, id_acquired) || !xfrd_read_time_t(in, soatime)) { return 0; } if(*soatime == 0) return 1; if(!xfrd_read_check_str(in, id) || !xfrd_read_i16(in, &soa->type) || !xfrd_read_i16(in, &soa->klass) || !xfrd_read_i32(in, &soa->ttl) || !xfrd_read_i16(in, &soa->rdata_count)) { return 0; } soa->type = htons(soa->type); soa->klass = htons(soa->klass); soa->ttl = htonl(soa->ttl); soa->rdata_count = htons(soa->rdata_count); if(!(p=xfrd_read_token(in)) || !(soa->prim_ns[0] = dname_parse_wire(soa->prim_ns+1, p))) return 0; if(!(p=xfrd_read_token(in)) || !(soa->email[0] = dname_parse_wire(soa->email+1, p))) return 0; if(!xfrd_read_i32(in, &soa->serial) || !xfrd_read_i32(in, &soa->refresh) || !xfrd_read_i32(in, &soa->retry) || !xfrd_read_i32(in, &soa->expire) || !xfrd_read_i32(in, &soa->minimum)) { return 0; } soa->serial = htonl(soa->serial); soa->refresh = htonl(soa->refresh); soa->retry = htonl(soa->retry); soa->expire = htonl(soa->expire); soa->minimum = htonl(soa->minimum); return 1; } void xfrd_read_state(struct xfrd_state* xfrd) { const char* statefile = xfrd->nsd->options->xfrdfile; FILE *in; uint32_t filetime = 0; uint32_t numzones, i; region_type *tempregion; tempregion = region_create(xalloc, free); if(!tempregion) return; in = fopen(statefile, "r"); if(!in) { if(errno != ENOENT) { log_msg(LOG_ERR, "xfrd: Could not open file %s for reading: %s", statefile, strerror(errno)); } else { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: no file %s. refreshing all zones.", statefile)); } region_destroy(tempregion); return; } if(!xfrd_read_check_str(in, XFRD_FILE_MAGIC) || !xfrd_read_check_str(in, "filetime:") || !xfrd_read_i32(in, &filetime) || (time_t)filetime > xfrd_time()+15 || !xfrd_read_check_str(in, "numzones:") || !xfrd_read_i32(in, &numzones)) { log_msg(LOG_ERR, "xfrd: corrupt state file %s dated %d (now=%d)", statefile, (int)filetime, (int)xfrd_time()); fclose(in); region_destroy(tempregion); return; } for(i=0; i2) || !xfrd_read_check_str(in, "master:") || !xfrd_read_i32(in, &masnum) || !xfrd_read_check_str(in, "next_master:") || !xfrd_read_i32(in, &nextmas) || !xfrd_read_check_str(in, "round_num:") || !xfrd_read_i32(in, &round_num) || !xfrd_read_check_str(in, "next_timeout:") || !xfrd_read_i32(in, &timeout) || !xfrd_read_state_soa(in, "soa_nsd_acquired:", "soa_nsd:", &soa_nsd_read, &soa_nsd_acquired_read) || !xfrd_read_state_soa(in, "soa_disk_acquired:", "soa_disk:", &soa_disk_read, &soa_disk_acquired_read) || !xfrd_read_state_soa(in, "soa_notify_acquired:", "soa_notify:", &soa_notified_read, &soa_notified_acquired_read)) { log_msg(LOG_ERR, "xfrd: corrupt state file %s dated %d (now=%d)", statefile, (int)filetime, (int)xfrd_time()); fclose(in); region_destroy(tempregion); return; } zone = (xfrd_zone_t*)rbtree_search(xfrd->zones, dname); if(!zone) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: state file has info for not configured zone %s", p)); continue; } if(soa_nsd_acquired_read>xfrd_time()+15 || soa_disk_acquired_read>xfrd_time()+15 || soa_notified_acquired_read>xfrd_time()+15) { log_msg(LOG_ERR, "xfrd: statefile %s contains" " times in the future for zone %s. Ignoring.", statefile, zone->apex_str); continue; } zone->state = state; zone->master_num = masnum; zone->next_master = nextmas; zone->round_num = round_num; zone->timeout.tv_sec = timeout; zone->timeout.tv_nsec = 0; /* read the zone OK, now set the master properly */ zone->master = acl_find_num( zone->zone_options->request_xfr, zone->master_num); if(!zone->master) { DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: masters changed for zone %s", zone->apex_str)); zone->master = zone->zone_options->request_xfr; zone->master_num = 0; zone->round_num = 0; } /* * There is no timeout, * or there is a notification, * or there is a soa && current time is past refresh point */ if(timeout == 0 || soa_notified_acquired_read != 0 || (soa_disk_acquired_read != 0 && (uint32_t)xfrd_time() - soa_disk_acquired_read > ntohl(soa_disk_read.refresh))) { zone->state = xfrd_zone_refreshing; xfrd_set_refresh_now(zone); } /* There is a soa && current time is past expiry point */ if(soa_disk_acquired_read!=0 && (uint32_t)xfrd_time() - soa_disk_acquired_read > ntohl(soa_disk_read.expire)) { zone->state = xfrd_zone_expired; xfrd_set_refresh_now(zone); } /* handle as an incoming SOA. */ incoming_soa = zone->soa_nsd; incoming_acquired = zone->soa_nsd_acquired; zone->soa_nsd = soa_nsd_read; zone->soa_disk = soa_disk_read; zone->soa_notified = soa_notified_read; zone->soa_nsd_acquired = soa_nsd_acquired_read; /* we had better use what we got from starting NSD, not * what we store in this file, because the actual zone * contents trumps the contents of this cache */ /* zone->soa_disk_acquired = soa_disk_acquired_read; */ zone->soa_notified_acquired = soa_notified_acquired_read; xfrd_handle_incoming_soa(zone, &incoming_soa, incoming_acquired); } if(!xfrd_read_check_str(in, XFRD_FILE_MAGIC)) { log_msg(LOG_ERR, "xfrd: corrupt state file %s dated %d (now=%d)", statefile, (int)filetime, (int)xfrd_time()); region_destroy(tempregion); fclose(in); return; } DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: read %d zones from state file", (int)numzones)); fclose(in); region_destroy(tempregion); } /* prints neato days hours and minutes. */ static void neato_timeout(FILE* out, const char* str, uint32_t secs) { fprintf(out, "%s", str); if(secs <= 0) { fprintf(out, " %ds", (int)secs); return; } if(secs >= 3600*24) { fprintf(out, " %dd", (int)secs/(3600*24)); secs = secs % (3600*24); } if(secs >= 3600) { fprintf(out, " %dh", (int)secs/3600); secs = secs%3600; } if(secs >= 60) { fprintf(out, " %dm", (int)secs/60); secs = secs%60; } if(secs > 0) { fprintf(out, " %ds", (int)secs); } } static void xfrd_write_dname(FILE* out, uint8_t* dname) { uint8_t* d= dname+1; uint8_t len = *d++; uint8_t i; if(dname[0]<=1) { fprintf(out, "."); return; } while(len) { assert(d - (dname+1) <= dname[0]); for(i=0; itype), (unsigned)ntohs(soa->klass), (unsigned)ntohl(soa->ttl), (unsigned)ntohs(soa->rdata_count)); fprintf(out, " "); xfrd_write_dname(out, soa->prim_ns); fprintf(out, " "); xfrd_write_dname(out, soa->email); fprintf(out, " %u", (unsigned)ntohl(soa->serial)); fprintf(out, " %u", (unsigned)ntohl(soa->refresh)); fprintf(out, " %u", (unsigned)ntohl(soa->retry)); fprintf(out, " %u", (unsigned)ntohl(soa->expire)); fprintf(out, " %u\n", (unsigned)ntohl(soa->minimum)); fprintf(out, "\t#"); neato_timeout(out, " refresh =", ntohl(soa->refresh)); neato_timeout(out, " retry =", ntohl(soa->retry)); neato_timeout(out, " expire =", ntohl(soa->expire)); neato_timeout(out, " minimum =", ntohl(soa->minimum)); fprintf(out, "\n"); } void xfrd_write_state(struct xfrd_state* xfrd) { rbnode_t* p; const char* statefile = xfrd->nsd->options->xfrdfile; FILE *out; time_t now = xfrd_time(); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: write file %s", statefile)); out = fopen(statefile, "w"); if(!out) { log_msg(LOG_ERR, "xfrd: Could not open file %s for writing: %s", statefile, strerror(errno)); return; } fprintf(out, "%s\n", XFRD_FILE_MAGIC); fprintf(out, "# This file is written on exit by nsd xfr daemon.\n"); fprintf(out, "# This file contains slave zone information:\n"); fprintf(out, "# * timeouts (when was zone data acquired)\n"); fprintf(out, "# * state (OK, refreshing, expired)\n"); fprintf(out, "# * which master transfer to attempt next\n"); fprintf(out, "# The file is read on start (but not on reload) by nsd xfr daemon.\n"); fprintf(out, "# You can edit; but do not change statement order\n"); fprintf(out, "# and no fancy stuff (like quoted \"strings\").\n"); fprintf(out, "#\n"); fprintf(out, "# If you remove a zone entry, it will be refreshed.\n"); fprintf(out, "# This can be useful for an expired zone; it revives\n"); fprintf(out, "# the zone temporarily, from refresh-expiry time.\n"); fprintf(out, "# If you delete the file all slave zones are updated.\n"); fprintf(out, "#\n"); fprintf(out, "# Note: if you edit this file while nsd is running,\n"); fprintf(out, "# it will be overwritten on exit by nsd.\n"); fprintf(out, "\n"); fprintf(out, "filetime: %d\t# %s\n", (int)now, ctime(&now)); fprintf(out, "# The number of zone entries in this file\n"); fprintf(out, "numzones: %d\n", (int)xfrd->zones->count); fprintf(out, "\n"); for(p = rbtree_first(xfrd->zones); p && p!=RBTREE_NULL; p=rbtree_next(p)) { xfrd_zone_t* zone = (xfrd_zone_t*)p; fprintf(out, "zone: \tname: %s\n", zone->apex_str); fprintf(out, "\tstate: %d", (int)zone->state); fprintf(out, " # %s", zone->state==xfrd_zone_ok?"OK":( zone->state==xfrd_zone_refreshing?"refreshing":"expired")); fprintf(out, "\n"); fprintf(out, "\tmaster: %d\n", zone->master_num); fprintf(out, "\tnext_master: %d\n", zone->next_master); fprintf(out, "\tround_num: %d\n", zone->round_num); fprintf(out, "\tnext_timeout: %d", zone->zone_handler.timeout?(int)zone->timeout.tv_sec:0); if(zone->zone_handler.timeout) { neato_timeout(out, "\t# =", zone->timeout.tv_sec - xfrd_time()); } fprintf(out, "\n"); xfrd_write_state_soa(out, "soa_nsd", &zone->soa_nsd, zone->soa_nsd_acquired, zone->apex); xfrd_write_state_soa(out, "soa_disk", &zone->soa_disk, zone->soa_disk_acquired, zone->apex); xfrd_write_state_soa(out, "soa_notify", &zone->soa_notified, zone->soa_notified_acquired, zone->apex); fprintf(out, "\n"); } fprintf(out, "%s\n", XFRD_FILE_MAGIC); DEBUG(DEBUG_XFRD,1, (LOG_INFO, "xfrd: written %d zones to state file", (int)xfrd->zones->count)); fclose(out); } nsd-3.2.16/zonec.h0000664000175000017500000001065012162277142012650 0ustar matjematje/* * zonec.h -- zone compiler. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _ZONEC_H_ #define _ZONEC_H_ #include "namedb.h" #define MAXTOKENSLEN 512 /* Maximum number of tokens per entry */ #define B64BUFSIZE 65535 /* Buffer size for b64 conversion */ #define ROOT (const uint8_t *)"\001" #define NSEC_WINDOW_COUNT 256 #define NSEC_WINDOW_BITS_COUNT 256 #define NSEC_WINDOW_BITS_SIZE (NSEC_WINDOW_BITS_COUNT / 8) #define IPSECKEY_NOGATEWAY 0 /* RFC 4025 */ #define IPSECKEY_IP4 1 #define IPSECKEY_IP6 2 #define IPSECKEY_DNAME 3 #define LINEBUFSZ 1024 struct lex_data { size_t len; /* holds the label length */ char *str; /* holds the data */ }; #define DEFAULT_TTL 3600 /* administration struct */ typedef struct zparser zparser_type; struct zparser { region_type *region; /* Allocate for parser lifetime data. */ region_type *rr_region; /* Allocate RR lifetime data. */ namedb_type *db; const char *filename; uint32_t default_ttl; uint16_t default_class; zone_type *current_zone; domain_type *origin; domain_type *prev_dname; domain_type *default_apex; int error_occurred; unsigned int errors; unsigned int line; rr_type current_rr; rdata_atom_type *temporary_rdatas; }; extern zparser_type *parser; /* used in zonec.lex */ extern FILE *yyin; /* * Used to mark bad domains and domain names. Do not dereference * these pointers! */ extern const dname_type *error_dname; extern domain_type *error_domain; int yyparse(void); int yylex(void); /*int yyerror(const char *s);*/ void yyrestart(FILE *); void zc_warning(const char *fmt, ...) ATTR_FORMAT(printf, 1, 2); void zc_warning_prev_line(const char *fmt, ...) ATTR_FORMAT(printf, 1, 2); void zc_error(const char *fmt, ...) ATTR_FORMAT(printf, 1, 2); void zc_error_prev_line(const char *fmt, ...) ATTR_FORMAT(printf, 1, 2); int process_rr(void); uint16_t *zparser_conv_hex(region_type *region, const char *hex, size_t len); uint16_t *zparser_conv_hex_length(region_type *region, const char *hex, size_t len); uint16_t *zparser_conv_time(region_type *region, const char *time); uint16_t *zparser_conv_services(region_type *region, const char *protostr, char *servicestr); uint16_t *zparser_conv_serial(region_type *region, const char *periodstr); uint16_t *zparser_conv_period(region_type *region, const char *periodstr); uint16_t *zparser_conv_short(region_type *region, const char *text); uint16_t *zparser_conv_long(region_type *region, const char *text); uint16_t *zparser_conv_byte(region_type *region, const char *text); uint16_t *zparser_conv_a(region_type *region, const char *text); uint16_t *zparser_conv_aaaa(region_type *region, const char *text); uint16_t *zparser_conv_ilnp64(region_type *region, const char *text); #ifdef DRAFT_RRTYPES uint16_t *zparser_conv_eui(region_type *region, const char *text, size_t len); #endif uint16_t *zparser_conv_text(region_type *region, const char *text, size_t len); uint16_t *zparser_conv_dns_name(region_type *region, const uint8_t* name, size_t len); uint16_t *zparser_conv_b32(region_type *region, const char *b32); uint16_t *zparser_conv_b64(region_type *region, const char *b64); uint16_t *zparser_conv_rrtype(region_type *region, const char *rr); uint16_t *zparser_conv_nxt(region_type *region, uint8_t nxtbits[]); uint16_t *zparser_conv_nsec(region_type *region, uint8_t nsecbits[NSEC_WINDOW_COUNT][NSEC_WINDOW_BITS_SIZE]); uint16_t *zparser_conv_loc(region_type *region, char *str); uint16_t *zparser_conv_algorithm(region_type *region, const char *algstr); uint16_t *zparser_conv_certificate_type(region_type *region, const char *typestr); uint16_t *zparser_conv_apl_rdata(region_type *region, char *str); void parse_unknown_rdata(uint16_t type, uint16_t *wireformat); uint32_t zparser_ttl2int(const char *ttlstr, int* error); void zadd_rdata_wireformat(uint16_t *data); void zadd_rdata_txt_wireformat(uint16_t *data, int first); void zadd_rdata_txt_clean_wireformat(); void zadd_rdata_domain(domain_type *domain); void set_bitnsec(uint8_t bits[NSEC_WINDOW_COUNT][NSEC_WINDOW_BITS_SIZE], uint16_t index); uint16_t *alloc_rdata_init(region_type *region, const void *data, size_t size); /* zparser.y */ zparser_type *zparser_create(region_type *region, region_type *rr_region, namedb_type *db); void zparser_init(const char *filename, uint32_t ttl, uint16_t klass, const dname_type *origin); #endif /* _ZONEC_H_ */ nsd-3.2.16/options.c0000664000175000017500000004225112162532574013225 0ustar matjematje/* * options.c -- options functions. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include "options.h" #include "query.h" #include "tsig.h" #include "rrl.h" #include "configyyrename.h" nsd_options_t* nsd_options = 0; config_parser_state_t* cfg_parser = 0; extern FILE* c_in, *c_out; int c_parse(void); int c_lex(void); int c_wrap(void); void c_error(const char *message); nsd_options_t* nsd_options_create(region_type* region) { nsd_options_t* opt; opt = (nsd_options_t*)region_alloc(region, sizeof(nsd_options_t)); opt->region = region; opt->zone_options = rbtree_create(region, (int (*)(const void *, const void *)) dname_compare); opt->keys = NULL; opt->numkeys = 0; opt->ip_addresses = NULL; opt->ip_transparent = 0; opt->debug_mode = 0; opt->verbosity = 0; opt->hide_version = 0; opt->ip4_only = 0; opt->ip6_only = 0; opt->database = DBFILE; opt->identity = 0; opt->nsid = 0; opt->logfile = 0; opt->server_count = 1; opt->tcp_count = 10; opt->tcp_query_count = 0; opt->tcp_timeout = TCP_TIMEOUT; opt->ipv4_edns_size = EDNS_MAX_MESSAGE_LEN; opt->ipv6_edns_size = EDNS_MAX_MESSAGE_LEN; opt->pidfile = PIDFILE; opt->port = UDP_PORT; /* deprecated? opt->port = TCP_PORT; */ opt->statistics = 0; #ifdef USE_ZONE_STATS opt->zonestatsfile = ZONESTATSFILE; #else opt->zonestatsfile = 0; #endif opt->chroot = 0; opt->username = USER; opt->zonesdir = ZONESDIR; opt->difffile = DIFFFILE; opt->xfrdfile = XFRDFILE; opt->xfrd_reload_timeout = 10; #ifdef RATELIMIT opt->rrl_size = RRL_BUCKETS; opt->rrl_ratelimit = RRL_LIMIT/2; opt->rrl_slip = RRL_SLIP; opt->rrl_ipv4_prefix_length = RRL_IPV4_PREFIX_LENGTH; opt->rrl_ipv6_prefix_length = RRL_IPV6_PREFIX_LENGTH; opt->rrl_whitelist_ratelimit = RRL_WLIST_LIMIT/2; #endif nsd_options = opt; return opt; } int nsd_options_insert_zone(nsd_options_t* opt, zone_options_t* zone) { /* create dname for lookup */ const dname_type* dname = dname_parse(opt->region, zone->name); if(!dname) return 0; zone->node.key = dname; if(!rbtree_insert(opt->zone_options, (rbnode_t*)zone)) return 0; return 1; } int parse_options_file(nsd_options_t* opt, const char* file) { FILE *in = 0; zone_options_t* zone; acl_options_t* acl; if(!cfg_parser) cfg_parser = (config_parser_state_t*)region_alloc( opt->region, sizeof(config_parser_state_t)); cfg_parser->filename = file; cfg_parser->line = 1; cfg_parser->errors = 0; cfg_parser->opt = opt; cfg_parser->current_zone = 0; cfg_parser->current_key = opt->keys; while(cfg_parser->current_key && cfg_parser->current_key->next) cfg_parser->current_key = cfg_parser->current_key->next; cfg_parser->current_ip_address_option = opt->ip_addresses; while(cfg_parser->current_ip_address_option && cfg_parser->current_ip_address_option->next) cfg_parser->current_ip_address_option = cfg_parser->current_ip_address_option->next; cfg_parser->current_allow_notify = 0; cfg_parser->current_request_xfr = 0; cfg_parser->current_notify = 0; cfg_parser->current_provide_xfr = 0; in = fopen(cfg_parser->filename, "r"); if(!in) { fprintf(stderr, "Could not open %s: %s\n", file, strerror(errno)); return 0; } c_in = in; c_parse(); fclose(in); if(cfg_parser->current_zone) { if(!cfg_parser->current_zone->name) c_error("last zone has no name"); else { if(!nsd_options_insert_zone(opt, cfg_parser->current_zone)) c_error("duplicate zone"); } if(!cfg_parser->current_zone->zonefile) c_error("last zone has no zonefile"); } if(opt->keys) { if(!opt->keys->name) c_error("last key has no name"); if(!opt->keys->algorithm) c_error("last key has no algorithm"); if(!opt->keys->secret) c_error("last key has no secret blob"); } RBTREE_FOR(zone, zone_options_t*, opt->zone_options) { if(!zone->name) continue; if(!zone->zonefile) continue; /* lookup keys for acls */ for(acl=zone->allow_notify; acl; acl=acl->next) { if(acl->nokey || acl->blocked) continue; acl->key_options = key_options_find(opt, acl->key_name); if(!acl->key_options) c_error_msg("key %s in zone %s could not be found", acl->key_name, zone->name); } for(acl=zone->notify; acl; acl=acl->next) { if(acl->nokey || acl->blocked) continue; acl->key_options = key_options_find(opt, acl->key_name); if(!acl->key_options) c_error_msg("key %s in zone %s could not be found", acl->key_name, zone->name); } for(acl=zone->request_xfr; acl; acl=acl->next) { if(acl->nokey || acl->blocked) continue; acl->key_options = key_options_find(opt, acl->key_name); if(!acl->key_options) c_error_msg("key %s in zone %s could not be found", acl->key_name, zone->name); } for(acl=zone->provide_xfr; acl; acl=acl->next) { if(acl->nokey || acl->blocked) continue; acl->key_options = key_options_find(opt, acl->key_name); if(!acl->key_options) c_error_msg("key %s in zone %s could not be found", acl->key_name, zone->name); } } if(cfg_parser->errors > 0) { fprintf(stderr, "read %s failed: %d errors in configuration file\n", cfg_parser->filename, cfg_parser->errors); return 0; } return 1; } void c_error_va_list(const char *fmt, va_list args) { cfg_parser->errors++; fprintf(stderr, "%s:%d: error: ", cfg_parser->filename, cfg_parser->line); vfprintf(stderr, fmt, args); fprintf(stderr, "\n"); } void c_error_msg(const char* fmt, ...) { va_list args; va_start(args, fmt); c_error_va_list(fmt, args); va_end(args); } void c_error(const char *str) { cfg_parser->errors++; fprintf(stderr, "%s:%d: error: %s\n", cfg_parser->filename, cfg_parser->line, str); } int c_wrap() { return 1; } zone_options_t* zone_options_create(region_type* region) { zone_options_t* zone; zone = (zone_options_t*)region_alloc(region, sizeof(zone_options_t)); zone->node = *RBTREE_NULL; zone->name = 0; zone->zonefile = 0; zone->allow_notify = 0; zone->request_xfr = 0; zone->notify = 0; zone->notify_retry = 5; zone->provide_xfr = 0; zone->outgoing_interface = 0; zone->allow_axfr_fallback = 1; #ifdef RATELIMIT zone->rrl_whitelist = 0; #endif return zone; } key_options_t* key_options_create(region_type* region) { key_options_t* key; key = (key_options_t*)region_alloc(region, sizeof(key_options_t)); key->name = 0; key->next = 0; key->algorithm = 0; key->secret = 0; key->tsig_key = 0; return key; } key_options_t* key_options_find(nsd_options_t* opt, const char* name) { key_options_t* key = opt->keys; while(key) { if(strcmp(key->name, name)==0) return key; key = key->next; } return 0; } int acl_check_incoming(acl_options_t* acl, struct query* q, acl_options_t** reason) { /* check each acl element. if 1 blocked element matches - return -1. if any element matches - return number. else return -1. */ int found_match = -1; int number = 0; acl_options_t* match = 0; if(reason) *reason = NULL; while(acl) { DEBUG(DEBUG_XFRD,2, (LOG_INFO, "testing acl %s %s", acl->ip_address_spec, acl->nokey?"NOKEY": (acl->blocked?"BLOCKED":acl->key_name))); if(acl_addr_matches(acl, q) && acl_key_matches(acl, q)) { if(!match) { match = acl; /* remember first match */ found_match=number; } if(acl->blocked) { if(reason) *reason = acl; return -1; } } number++; acl = acl->next; } if(reason) *reason = match; return found_match; } #ifdef INET6 int acl_addr_matches_ipv6host(acl_options_t* acl, struct sockaddr_storage* addr_storage, unsigned int port) { struct sockaddr_in6* addr = (struct sockaddr_in6*)addr_storage; if(acl->port != 0 && acl->port != port) return 0; switch(acl->rangetype) { case acl_range_mask: case acl_range_subnet: if(!acl_addr_match_mask((uint32_t*)&acl->addr.addr6, (uint32_t*)&addr->sin6_addr, (uint32_t*)&acl->range_mask.addr6, sizeof(struct in6_addr))) return 0; break; case acl_range_minmax: if(!acl_addr_match_range((uint32_t*)&acl->addr.addr6, (uint32_t*)&addr->sin6_addr, (uint32_t*)&acl->range_mask.addr6, sizeof(struct in6_addr))) return 0; break; case acl_range_single: default: if(memcmp(&addr->sin6_addr, &acl->addr.addr6, sizeof(struct in6_addr)) != 0) return 0; break; } return 1; } #endif int acl_addr_matches_ipv4host(acl_options_t* acl, struct sockaddr_in* addr, unsigned int port) { if(acl->port != 0 && acl->port != port) return 0; switch(acl->rangetype) { case acl_range_mask: case acl_range_subnet: if(!acl_addr_match_mask((uint32_t*)&acl->addr.addr, (uint32_t*)&addr->sin_addr, (uint32_t*)&acl->range_mask.addr, sizeof(struct in_addr))) return 0; break; case acl_range_minmax: if(!acl_addr_match_range((uint32_t*)&acl->addr.addr, (uint32_t*)&addr->sin_addr, (uint32_t*)&acl->range_mask.addr, sizeof(struct in_addr))) return 0; break; case acl_range_single: default: if(memcmp(&addr->sin_addr, &acl->addr.addr, sizeof(struct in_addr)) != 0) return 0; break; } return 1; } int acl_addr_matches_host(acl_options_t* acl, acl_options_t* host) { if(acl->is_ipv6) { #ifdef INET6 struct sockaddr_storage* addr = (struct sockaddr_storage*)&host->addr; if(!host->is_ipv6) return 0; return acl_addr_matches_ipv6host(acl, addr, host->port); #else return 0; /* no inet6, no match */ #endif } else { struct sockaddr_in* addr = (struct sockaddr_in*)&host->addr; if(host->is_ipv6) return 0; return acl_addr_matches_ipv4host(acl, addr, host->port); } /* ENOTREACH */ return 0; } int acl_addr_matches(acl_options_t* acl, struct query* q) { if(acl->is_ipv6) { #ifdef INET6 struct sockaddr_storage* addr = (struct sockaddr_storage*)&q->addr; if(addr->ss_family != AF_INET6) return 0; return acl_addr_matches_ipv6host(acl, addr, ntohs(((struct sockaddr_in6*)addr)->sin6_port)); #else return 0; /* no inet6, no match */ #endif } else { struct sockaddr_in* addr = (struct sockaddr_in*)&q->addr; if(addr->sin_family != AF_INET) return 0; return acl_addr_matches_ipv4host(acl, addr, ntohs(addr->sin_port)); } /* ENOTREACH */ return 0; } int acl_addr_match_mask(uint32_t* a, uint32_t* b, uint32_t* mask, size_t sz) { size_t i; #ifndef NDEBUG assert(sz % 4 == 0); #endif sz /= 4; for(i=0; i x[i]) return 0; if(checkmax) if(maxval[i] < x[i]) return 0; /* if x is equal to a bound, that bound needs further checks */ if(checkmin && minval[i]!=x[i]) checkmin = 0; if(checkmax && maxval[i]!=x[i]) checkmax = 0; if(!checkmin && !checkmax) return 1; /* will always match */ } return 1; } int acl_key_matches(acl_options_t* acl, struct query* q) { if(acl->blocked) return 1; if(acl->nokey) { if(q->tsig.status == TSIG_NOT_PRESENT) return 1; return 0; } /* check name of tsig key */ if(q->tsig.status != TSIG_OK) { DEBUG(DEBUG_XFRD,2, (LOG_INFO, "keymatch fail query has no TSIG")); return 0; /* query has no TSIG */ } if(q->tsig.error_code != TSIG_ERROR_NOERROR) { DEBUG(DEBUG_XFRD,2, (LOG_INFO, "keymatch fail, tsig has error")); return 0; /* some tsig error */ } if(!acl->key_options->tsig_key) { DEBUG(DEBUG_XFRD,2, (LOG_INFO, "keymatch fail no config")); return 0; /* key not properly configged */ } if(dname_compare(q->tsig.key_name, acl->key_options->tsig_key->name) != 0) { DEBUG(DEBUG_XFRD,2, (LOG_INFO, "keymatch fail wrong key name")); return 0; /* wrong key name */ } if(tsig_strlowercmp(q->tsig.algorithm->short_name, acl->key_options->algorithm) != 0) { DEBUG(DEBUG_XFRD,2, (LOG_ERR, "query tsig wrong algorithm")); return 0; /* no such algo */ } return 1; } int acl_same_host(acl_options_t* a, acl_options_t* b) { if(a->is_ipv6 && !b->is_ipv6) return 0; if(!a->is_ipv6 && b->is_ipv6) return 0; if(a->port != b->port) return 0; if(a->rangetype != b->rangetype) return 0; if(!a->is_ipv6) { if(memcmp(&a->addr.addr, &b->addr.addr, sizeof(struct in_addr)) != 0) return 0; if(a->rangetype != acl_range_single && memcmp(&a->range_mask.addr, &b->range_mask.addr, sizeof(struct in_addr)) != 0) return 0; } else { #ifdef INET6 if(memcmp(&a->addr.addr6, &b->addr.addr6, sizeof(struct in6_addr)) != 0) return 0; if(a->rangetype != acl_range_single && memcmp(&a->range_mask.addr6, &b->range_mask.addr6, sizeof(struct in6_addr)) != 0) return 0; #else return 0; #endif } return 1; } #if defined(HAVE_SSL) void key_options_tsig_add(nsd_options_t* opt) { key_options_t* optkey; uint8_t data[4000]; tsig_key_type* tsigkey; const dname_type* dname; int size; for(optkey = opt->keys; optkey; optkey = optkey->next) { dname = dname_parse(opt->region, optkey->name); if(!dname) { log_msg(LOG_ERR, "Failed to parse tsig key name %s", optkey->name); continue; } size = b64_pton(optkey->secret, data, sizeof(data)); if(size == -1) { log_msg(LOG_ERR, "Failed to parse tsig key data %s", optkey->name); continue; } tsigkey = (tsig_key_type *) region_alloc(opt->region, sizeof(tsig_key_type)); tsigkey->name = dname; tsigkey->size = size; tsigkey->data = (uint8_t *) region_alloc_init(opt->region, data, tsigkey->size); tsig_add_key(tsigkey); optkey->tsig_key = tsigkey; } } #endif int zone_is_slave(zone_options_t* opt) { return opt->request_xfr != 0; } zone_options_t* zone_options_find(nsd_options_t* opt, const struct dname* apex) { return (zone_options_t*) rbtree_search(opt->zone_options, apex); } acl_options_t* acl_find_num(acl_options_t* acl, int num) { int count = num; if(num < 0) return 0; while(acl && count > 0) { acl = acl->next; count--; } if(count == 0) return acl; return 0; } /* true if ipv6 address, false if ipv4 */ int parse_acl_is_ipv6(const char* p) { /* see if addr is ipv6 or ipv4 -- by : and . */ while(*p) { if(*p == '.') return 0; if(*p == ':') return 1; ++p; } return 0; } /* returns range type. mask is the 2nd part of the range */ int parse_acl_range_type(char* ip, char** mask) { char *p; if((p=strchr(ip, '&'))!=0) { *p = 0; *mask = p+1; return acl_range_mask; } if((p=strchr(ip, '/'))!=0) { *p = 0; *mask = p+1; return acl_range_subnet; } if((p=strchr(ip, '-'))!=0) { *p = 0; *mask = p+1; return acl_range_minmax; } *mask = 0; return acl_range_single; } /* parses subnet mask, fills 0 mask as well */ void parse_acl_range_subnet(char* p, void* addr, int maxbits) { int subnet_bits = atoi(p); uint8_t* addr_bytes = (uint8_t*)addr; if(subnet_bits == 0 && strcmp(p, "0")!=0) { c_error_msg("bad subnet range '%s'", p); return; } if(subnet_bits < 0 || subnet_bits > maxbits) { c_error_msg("subnet of %d bits out of range [0..%d]", subnet_bits, maxbits); return; } /* fill addr with n bits of 1s (struct has been zeroed) */ while(subnet_bits >= 8) { *addr_bytes++ = 0xff; subnet_bits -= 8; } if(subnet_bits > 0) { uint8_t shifts[] = {0x0, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe, 0xff}; *addr_bytes = shifts[subnet_bits]; } } acl_options_t* parse_acl_info(region_type* region, char* ip, const char* key) { char* p; acl_options_t* acl = (acl_options_t*)region_alloc(region, sizeof(acl_options_t)); acl->next = 0; /* ip */ acl->ip_address_spec = region_strdup(region, ip); acl->use_axfr_only = 0; acl->allow_udp = 0; acl->ixfr_disabled = 0; acl->bad_xfr_count = 0; acl->key_options = 0; acl->is_ipv6 = 0; acl->port = 0; memset(&acl->addr, 0, sizeof(union acl_addr_storage)); memset(&acl->range_mask, 0, sizeof(union acl_addr_storage)); if((p=strrchr(ip, '@'))!=0) { if(atoi(p+1) == 0) c_error("expected port number after '@'"); else acl->port = atoi(p+1); *p=0; } acl->rangetype = parse_acl_range_type(ip, &p); if(parse_acl_is_ipv6(ip)) { acl->is_ipv6 = 1; #ifdef INET6 if(inet_pton(AF_INET6, ip, &acl->addr.addr6) != 1) c_error_msg("Bad ip6 address '%s'", ip); if(acl->rangetype==acl_range_mask || acl->rangetype==acl_range_minmax) if(inet_pton(AF_INET6, p, &acl->range_mask.addr6) != 1) c_error_msg("Bad ip6 address mask '%s'", p); if(acl->rangetype==acl_range_subnet) parse_acl_range_subnet(p, &acl->range_mask.addr6, 128); #else c_error_msg("encountered IPv6 address '%s'.", ip); #endif /* INET6 */ } else { acl->is_ipv6 = 0; if(inet_pton(AF_INET, ip, &acl->addr.addr) != 1) c_error_msg("Bad ip4 address '%s'", ip); if(acl->rangetype==acl_range_mask || acl->rangetype==acl_range_minmax) if(inet_pton(AF_INET, p, &acl->range_mask.addr) != 1) c_error_msg("Bad ip4 address mask '%s'", p); if(acl->rangetype==acl_range_subnet) parse_acl_range_subnet(p, &acl->range_mask.addr, 32); } /* key */ if(strcmp(key, "NOKEY")==0) { acl->nokey = 1; acl->blocked = 0; acl->key_name = 0; } else if(strcmp(key, "BLOCKED")==0) { acl->nokey = 0; acl->blocked = 1; acl->key_name = 0; } else { acl->nokey = 0; acl->blocked = 0; acl->key_name = region_strdup(region, key); } return acl; } void nsd_options_destroy(nsd_options_t* opt) { region_destroy(opt->region); } nsd-3.2.16/xfrd.h0000664000175000017500000002123712163035102012465 0ustar matjematje/* * xfrd.h - XFR (transfer) Daemon header file. Coordinates SOA updates. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef XFRD_H #define XFRD_H #include "config.h" #include "netio.h" #include "rbtree.h" #include "namedb.h" #include "options.h" #include "dns.h" #include "tsig.h" struct nsd; struct region; struct buffer; struct xfrd_tcp; struct xfrd_tcp_set; struct notify_zone_t; typedef struct xfrd_state xfrd_state_t; typedef struct xfrd_zone xfrd_zone_t; typedef struct xfrd_soa xfrd_soa_t; /* * The global state for the xfrd daemon process. * The time_t times are epochs in secs since 1970, absolute times. */ struct xfrd_state { /* time when daemon was last started */ time_t xfrd_start_time; struct region* region; netio_type* netio; struct nsd* nsd; struct xfrd_tcp_set* tcp_set; /* packet buffer for udp packets */ struct buffer* packet; /* udp waiting list */ struct xfrd_zone *udp_waiting_first, *udp_waiting_last; /* number of udp sockets (for sending queries) in use */ size_t udp_use_num; /* current time is cached */ uint8_t got_time; time_t current_time; /* timer for NSD reload */ struct timespec reload_timeout; netio_handler_type reload_handler; /* last reload must have caught all zone updates before this time */ time_t reload_cmd_last_sent; uint8_t can_send_reload; /* communication channel with server_main */ netio_handler_type ipc_handler; uint8_t ipc_is_soa; uint8_t parent_soa_info_pass; struct xfrd_tcp *ipc_conn; struct buffer* ipc_pass; /* sending ipc to server_main */ struct xfrd_tcp *ipc_conn_write; uint8_t need_to_send_reload; uint8_t need_to_send_quit; uint8_t sending_zone_state; uint8_t ipc_send_blocked; stack_type* dirty_zones; /* stack of xfrd_zone* */ /* xfrd shutdown flag */ uint8_t shutdown; /* tree of zones, by apex name, contains xfrd_zone_t*. Only secondary zones. */ rbtree_t *zones; /* tree of zones, by apex name, contains notify_zone_t*. All zones. */ rbtree_t *notify_zones; /* number of notify_zone_t active using UDP socket */ int notify_udp_num; /* first and last notify_zone_t* entries waiting for a UDP socket */ struct notify_zone_t *notify_waiting_first, *notify_waiting_last; }; /* * XFR daemon SOA information kept in network format. * This is in packet order. */ struct xfrd_soa { /* name of RR is zone apex dname */ uint16_t type; /* = TYPE_SOA */ uint16_t klass; /* = CLASS_IN */ uint32_t ttl; uint16_t rdata_count; /* = 7 */ /* format is 1 octet length, + wireformat dname. one more octet since parse_dname_wire_from_packet needs it. maximum size is allocated to avoid memory alloc/free. */ uint8_t prim_ns[MAXDOMAINLEN + 2]; uint8_t email[MAXDOMAINLEN + 2]; uint32_t serial; uint32_t refresh; uint32_t retry; uint32_t expire; uint32_t minimum; }; /* * XFRD state for a single zone */ struct xfrd_zone { rbnode_t node; /* name of the zone */ const dname_type* apex; const char* apex_str; /* Three types of soas: * NSD: in use by running server * disk: stored on disk in db/diff file * notified: from notification, could be available on a master. * And the time the soa was acquired (start time for timeouts). * If the time==0, no SOA is available. */ xfrd_soa_t soa_nsd; time_t soa_nsd_acquired; xfrd_soa_t soa_disk; time_t soa_disk_acquired; xfrd_soa_t soa_notified; time_t soa_notified_acquired; enum xfrd_zone_state { xfrd_zone_ok, xfrd_zone_refreshing, xfrd_zone_expired } state; /* if state is dirty it needs to be sent to server_main. * it is also on the dirty_stack. Not saved on disk. */ uint8_t dirty; /* master to try to transfer from, number for persistence */ acl_options_t* master; int master_num; int next_master; /* -1 or set by notify where to try next */ /* round of xfrattempts, -1 is waiting for timeout */ int round_num; zone_options_t* zone_options; int fresh_xfr_timeout; /* handler for timeouts */ struct timespec timeout; netio_handler_type zone_handler; /* tcp connection zone is using, or -1 */ int tcp_conn; /* zone is waiting for a tcp connection */ uint8_t tcp_waiting; /* next zone in waiting list */ xfrd_zone_t* tcp_waiting_next; /* zone is waiting for a udp connection (tcp is preferred) */ uint8_t udp_waiting; /* next zone in waiting list for UDP */ xfrd_zone_t* udp_waiting_next; /* xfr message handling data */ /* query id */ uint16_t query_id; uint32_t msg_seq_nr; /* number of messages already handled */ uint32_t msg_old_serial, msg_new_serial; /* host byte order */ size_t msg_rr_count; uint8_t msg_is_ixfr; /* 1:IXFR detected. 2:middle IXFR SOA seen. */ tsig_record_type tsig; /* tsig state for IXFR/AXFR */ }; enum xfrd_packet_result { xfrd_packet_bad, /* drop the packet/connection */ xfrd_packet_drop, /* drop the connection, but not report bad */ xfrd_packet_more, /* more packets to follow on tcp */ xfrd_packet_notimpl, /* server responded with NOTIMPL or FORMATERR */ xfrd_packet_tcp, /* try tcp connection */ xfrd_packet_transfer, /* server responded with transfer*/ xfrd_packet_newlease /* no changes, soa OK */ }; /* Division of the (portably: 1024) max number of sockets that can be open. The sum of the below numbers should be below the user limit for sockets open, or you see errors in your logfile. And it should be below FD_SETSIZE, to be able to select() on replies. Note that also some sockets are used for writing the ixfr.db, xfrd.state files and for the pipes to the main parent process. */ #define XFRD_MAX_TCP 50 /* max number of TCP AXFR/IXFR concurrent connections.*/ /* Each entry has 64Kb buffer preallocated.*/ #define XFRD_MAX_UDP 100 /* max number of UDP sockets at a time for IXFR */ #define XFRD_MAX_UDP_NOTIFY 50 /* max concurrent UDP sockets for NOTIFY */ extern xfrd_state_t* xfrd; /* start xfrd, new start. Pass socket to server_main. */ void xfrd_init(int socket, struct nsd* nsd); /* get the current time epoch. Cached for speed. */ time_t xfrd_time(); /* * Handle final received packet from network. * returns enum of packet discovery results */ enum xfrd_packet_result xfrd_handle_received_xfr_packet( xfrd_zone_t* zone, buffer_type* packet); /* set timer to specific value */ void xfrd_set_timer(xfrd_zone_t* zone, time_t t); /* set refresh timer of zone to refresh at time now */ void xfrd_set_refresh_now(xfrd_zone_t* zone); /* unset the timer - no more timeouts, for when zone is queued */ void xfrd_unset_timer(xfrd_zone_t* zone); /* * Make a new request to next master server. * uses next_master if set (and a fresh set of rounds). * otherwised, starts new round of requests if none started already. * starts next round of requests if at last master. * if too many rounds of requests, sets timer for next retry. */ void xfrd_make_request(xfrd_zone_t* zone); /* * send packet via udp (returns UDP fd source socket) to acl addr. * returns -1 on failure. */ int xfrd_send_udp(acl_options_t* acl, buffer_type* packet, acl_options_t* ifc); /* * read from udp port packet into buffer, returns 0 on failure */ int xfrd_udp_read_packet(buffer_type* packet, int fd); /* * Release udp socket that a zone is using */ void xfrd_udp_release(xfrd_zone_t* zone); /* * Get a static buffer for temporary use (to build a packet). */ struct buffer* xfrd_get_temp_buffer(); /* * TSIG sign outgoing request. Call if acl has a key. */ void xfrd_tsig_sign_request(buffer_type* packet, struct tsig_record* tsig, acl_options_t* acl); /* handle incoming soa information (NSD is running it, time acquired=guess). Pass soa=NULL,acquired=now if NSD has nothing loaded for the zone (i.e. zonefile was deleted). */ void xfrd_handle_incoming_soa(xfrd_zone_t* zone, xfrd_soa_t* soa, time_t acquired); /* handle a packet passed along ipc route. acl is the one that accepted the packet. The packet is the network blob received. acl_xfr is provide-xfr acl matching notify sender or -1 */ void xfrd_handle_passed_packet(buffer_type* packet, int acl_num, int acl_xfr); /* send expiry notify for all zones to nsd (sets all dirty). */ void xfrd_send_expy_all_zones(); /* try to reopen the logfile. */ void xfrd_reopen_logfile(); /* copy SOA info from rr to soa struct. */ void xfrd_copy_soa(xfrd_soa_t* soa, rr_type* rr); /* check for failed updates - it is assumed that now the reload has finished, and all zone SOAs have been sent. */ void xfrd_check_failed_updates(); /* * Prepare zones for a reload, this sets the times on the zones to be * before the current time, so the reload happens after. */ void xfrd_prepare_zones_for_reload(); /* Bind a local interface to a socket descriptor, return 1 on success */ int xfrd_bind_local_interface(int sockd, acl_options_t* ifc, acl_options_t* acl, int tcp); #endif /* XFRD_H */ nsd-3.2.16/packet.h0000664000175000017500000001444411647025756013017 0ustar matjematje/* * packet.h -- low-level DNS packet encoding and decoding functions. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _PACKET_H_ #define _PACKET_H_ #include #include "dns.h" #include "namedb.h" struct query; /* * Set of macro's to deal with the dns message header as specified * in RFC1035 in portable way. * */ /* * * 1 1 1 1 1 1 * 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 * +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ * | ID | * +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ * |QR| Opcode |AA|TC|RD|RA| Z|AD|CD| RCODE | * +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ * | QDCOUNT | * +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ * | ANCOUNT | * +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ * | NSCOUNT | * +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ * | ARCOUNT | * +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ * */ /* The length of the header */ #define QHEADERSZ 12 /* First octet of flags */ #define RD_MASK 0x01U #define RD_SHIFT 0 #define RD(packet) (*buffer_at((packet), 2) & RD_MASK) #define RD_SET(packet) (*buffer_at((packet), 2) |= RD_MASK) #define RD_CLR(packet) (*buffer_at((packet), 2) &= ~RD_MASK) #define TC_MASK 0x02U #define TC_SHIFT 1 #define TC(packet) (*buffer_at((packet), 2) & TC_MASK) #define TC_SET(packet) (*buffer_at((packet), 2) |= TC_MASK) #define TC_CLR(packet) (*buffer_at((packet), 2) &= ~TC_MASK) #define AA_MASK 0x04U #define AA_SHIFT 2 #define AA(packet) (*buffer_at((packet), 2) & AA_MASK) #define AA_SET(packet) (*buffer_at((packet), 2) |= AA_MASK) #define AA_CLR(packet) (*buffer_at((packet), 2) &= ~AA_MASK) #define OPCODE_MASK 0x78U #define OPCODE_SHIFT 3 #define OPCODE(packet) ((*buffer_at((packet), 2) & OPCODE_MASK) >> OPCODE_SHIFT) #define OPCODE_SET(packet, opcode) \ (*buffer_at((packet), 2) = (*buffer_at((packet), 2) & ~OPCODE_MASK) | ((opcode) << OPCODE_SHIFT)) #define QR_MASK 0x80U #define QR_SHIFT 7 #define QR(packet) (*buffer_at((packet), 2) & QR_MASK) #define QR_SET(packet) (*buffer_at((packet), 2) |= QR_MASK) #define QR_CLR(packet) (*buffer_at((packet), 2) &= ~QR_MASK) /* Second octet of flags */ #define RCODE_MASK 0x0fU #define RCODE_SHIFT 0 #define RCODE(packet) (*buffer_at((packet), 3) & RCODE_MASK) #define RCODE_SET(packet, rcode) \ (*buffer_at((packet), 3) = (*buffer_at((packet), 3) & ~RCODE_MASK) | (rcode)) #define CD_MASK 0x10U #define CD_SHIFT 4 #define CD(packet) (*buffer_at((packet), 3) & CD_MASK) #define CD_SET(packet) (*buffer_at((packet), 3) |= CD_MASK) #define CD_CLR(packet) (*buffer_at((packet), 3) &= ~CD_MASK) #define AD_MASK 0x20U #define AD_SHIFT 5 #define AD(packet) (*buffer_at((packet), 3) & AD_MASK) #define AD_SET(packet) (*buffer_at((packet), 3) |= AD_MASK) #define AD_CLR(packet) (*buffer_at((packet), 3) &= ~AD_MASK) #define Z_MASK 0x40U #define Z_SHIFT 6 #define Z(packet) (*buffer_at((packet), 3) & Z_MASK) #define Z_SET(packet) (*buffer_at((packet), 3) |= Z_MASK) #define Z_CLR(packet) (*buffer_at((packet), 3) &= ~Z_MASK) #define RA_MASK 0x80U #define RA_SHIFT 7 #define RA(packet) (*buffer_at((packet), 3) & RA_MASK) #define RA_SET(packet) (*buffer_at((packet), 3) |= RA_MASK) #define RA_CLR(packet) (*buffer_at((packet), 3) &= ~RA_MASK) /* Query ID */ #define ID(packet) (buffer_read_u16_at((packet), 0)) #define ID_SET(packet, id) (buffer_write_u16_at((packet), 0, (id))) /* Flags, RCODE, and OPCODE. */ #define FLAGS(packet) (buffer_read_u16_at((packet), 2)) #define FLAGS_SET(packet, f) (buffer_write_u16_at((packet), 2, (f))) /* Counter of the question section */ #define QDCOUNT(packet) (buffer_read_u16_at((packet), 4)) #define QDCOUNT_SET(packet, c) (buffer_write_u16_at((packet), 4, (c))) /* Counter of the answer section */ #define ANCOUNT(packet) (buffer_read_u16_at((packet), 6)) #define ANCOUNT_SET(packet, c) (buffer_write_u16_at((packet), 6, (c))) /* Counter of the authority section */ #define NSCOUNT(packet) (buffer_read_u16_at((packet), 8)) #define NSCOUNT_SET(packet, c) (buffer_write_u16_at((packet), 8, (c))) /* Counter of the additional section */ #define ARCOUNT(packet) (buffer_read_u16_at((packet), 10)) #define ARCOUNT_SET(packet, c) (buffer_write_u16_at((packet), 10, (c))) /* Miscelaneous limits */ #define MAX_PACKET_SIZE 65535 /* Maximum supported size of DNS packets. */ #define QIOBUFSZ (MAX_PACKET_SIZE + MAX_RR_SIZE) #define MAXRRSPP 10240 /* Maximum number of rr's per packet */ #define MAX_COMPRESSED_DNAMES MAXRRSPP /* Maximum number of compressed domains. */ #define MAX_COMPRESSION_OFFSET 16383 /* Compression pointers are 14 bit. */ #define IPV4_MINIMAL_RESPONSE_SIZE 1480 /* Recommended minimal edns size for IPv4 */ #define IPV6_MINIMAL_RESPONSE_SIZE 1220 /* Recommended minimal edns size for IPv6 */ /* * Encode RR with OWNER as owner name into QUERY. Returns the number * of RRs successfully encoded. */ int packet_encode_rr(struct query *query, domain_type *owner, rr_type *rr); /* * Encode RRSET with OWNER as the owner name into QUERY. Returns the * number of RRs successfully encoded. If TRUNCATE_RRSET the entire * RRset is truncated in case an RR (or the RRsets signature) does not * fit. */ int packet_encode_rrset(struct query *query, domain_type *owner, rrset_type *rrset, int truncate_rrset, size_t minimal_respsize, int* done); /* * Skip the RR at the current position in PACKET. */ int packet_skip_rr(buffer_type *packet, int question_section); /* * Skip the dname at the current position in PACKET. */ int packet_skip_dname(buffer_type *packet); /* * Read the RR at the current position in PACKET. */ rr_type *packet_read_rr(region_type *region, domain_table_type *owners, buffer_type *packet, int question_section); /* * read a query entry from network packet given in buffer. * does not follow compression ptrs, checks for errors (returns 0). * Dest must be at least MAXDOMAINLEN long. */ int packet_read_query_section(buffer_type *packet, uint8_t* dest, uint16_t* qtype, uint16_t* qclass); #endif /* _PACKET_H_ */ nsd-3.2.16/zparser.c0000664000175000017500000040232012173226547013217 0ustar matjematje/* A Bison parser, made by GNU Bison 2.5. */ /* Bison implementation for Yacc-like parsers in C Copyright (C) 1984, 1989-1990, 2000-2011 Free Software Foundation, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program. If not, see . */ /* As a special exception, you may create a larger work that contains part or all of the Bison parser skeleton and distribute that work under terms of your choice, so long as that work isn't itself a parser generator using the skeleton or a modified version thereof as a parser skeleton. Alternatively, if you modify or redistribute the parser skeleton itself, you may (at your option) remove this special exception, which will cause the skeleton and the resulting Bison output files to be licensed under the GNU General Public License without this special exception. This special exception was added by the Free Software Foundation in version 2.2 of Bison. */ /* C LALR(1) parser skeleton written by Richard Stallman, by simplifying the original so-called "semantic" parser. */ /* All symbols defined below should begin with yy or YY, to avoid infringing on user name space. This should be done even for local variables, as they might otherwise be expanded by user macros. There are some unavoidable exceptions within include files to define necessary library symbols; they are noted "INFRINGES ON USER NAME SPACE" below. */ /* Identify Bison output. */ #define YYBISON 1 /* Bison version. */ #define YYBISON_VERSION "2.5" /* Skeleton name. */ #define YYSKELETON_NAME "yacc.c" /* Pure parsers. */ #define YYPURE 0 /* Push parsers. */ #define YYPUSH 0 /* Pull parsers. */ #define YYPULL 1 /* Using locations. */ #define YYLSP_NEEDED 0 /* Copy the first part of user declarations. */ /* Line 268 of yacc.c */ #line 1 "zparser.y" /* * zyparser.y -- yacc grammar for (DNS) zone files * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include "dname.h" #include "namedb.h" #include "zonec.h" /* these need to be global, otherwise they cannot be used inside yacc */ zparser_type *parser; #ifdef __cplusplus extern "C" #endif /* __cplusplus */ int yywrap(void); /* this hold the nxt bits */ static uint8_t nxtbits[16]; static int dlv_warn = 1; /* 256 windows of 256 bits (32 bytes) */ /* still need to reset the bastard somewhere */ static uint8_t nsecbits[NSEC_WINDOW_COUNT][NSEC_WINDOW_BITS_SIZE]; /* hold the highest rcode seen in a NSEC rdata , BUG #106 */ uint16_t nsec_highest_rcode; void yyerror(const char *message); #ifdef NSEC3 /* parse nsec3 parameters and add the (first) rdata elements */ static void nsec3_add_params(const char* hash_algo_str, const char* flag_str, const char* iter_str, const char* salt_str, int salt_len); #endif /* NSEC3 */ /* Line 268 of yacc.c */ #line 122 "zparser.c" /* Enabling traces. */ #ifndef YYDEBUG # define YYDEBUG 0 #endif /* Enabling verbose error messages. */ #ifdef YYERROR_VERBOSE # undef YYERROR_VERBOSE # define YYERROR_VERBOSE 1 #else # define YYERROR_VERBOSE 0 #endif /* Enabling the token table. */ #ifndef YYTOKEN_TABLE # define YYTOKEN_TABLE 0 #endif /* Tokens. */ #ifndef YYTOKENTYPE # define YYTOKENTYPE /* Put the tokens into the symbol table, so that GDB and other debuggers know about them. */ enum yytokentype { T_A = 258, T_NS = 259, T_MX = 260, T_TXT = 261, T_CNAME = 262, T_AAAA = 263, T_PTR = 264, T_NXT = 265, T_KEY = 266, T_SOA = 267, T_SIG = 268, T_SRV = 269, T_CERT = 270, T_LOC = 271, T_MD = 272, T_MF = 273, T_MB = 274, T_MG = 275, T_MR = 276, T_NULL = 277, T_WKS = 278, T_HINFO = 279, T_MINFO = 280, T_RP = 281, T_AFSDB = 282, T_X25 = 283, T_ISDN = 284, T_RT = 285, T_NSAP = 286, T_NSAP_PTR = 287, T_PX = 288, T_GPOS = 289, T_EID = 290, T_NIMLOC = 291, T_ATMA = 292, T_NAPTR = 293, T_KX = 294, T_A6 = 295, T_DNAME = 296, T_SINK = 297, T_OPT = 298, T_APL = 299, T_UINFO = 300, T_UID = 301, T_GID = 302, T_UNSPEC = 303, T_TKEY = 304, T_TSIG = 305, T_IXFR = 306, T_AXFR = 307, T_MAILB = 308, T_MAILA = 309, T_DS = 310, T_DLV = 311, T_SSHFP = 312, T_RRSIG = 313, T_NSEC = 314, T_DNSKEY = 315, T_SPF = 316, T_NSEC3 = 317, T_IPSECKEY = 318, T_DHCID = 319, T_NSEC3PARAM = 320, T_TLSA = 321, T_NID = 322, T_L32 = 323, T_L64 = 324, T_LP = 325, T_EUI48 = 326, T_EUI64 = 327, DOLLAR_TTL = 328, DOLLAR_ORIGIN = 329, NL = 330, SP = 331, STR = 332, PREV = 333, BITLAB = 334, T_TTL = 335, T_RRCLASS = 336, URR = 337, T_UTYPE = 338 }; #endif /* Tokens. */ #define T_A 258 #define T_NS 259 #define T_MX 260 #define T_TXT 261 #define T_CNAME 262 #define T_AAAA 263 #define T_PTR 264 #define T_NXT 265 #define T_KEY 266 #define T_SOA 267 #define T_SIG 268 #define T_SRV 269 #define T_CERT 270 #define T_LOC 271 #define T_MD 272 #define T_MF 273 #define T_MB 274 #define T_MG 275 #define T_MR 276 #define T_NULL 277 #define T_WKS 278 #define T_HINFO 279 #define T_MINFO 280 #define T_RP 281 #define T_AFSDB 282 #define T_X25 283 #define T_ISDN 284 #define T_RT 285 #define T_NSAP 286 #define T_NSAP_PTR 287 #define T_PX 288 #define T_GPOS 289 #define T_EID 290 #define T_NIMLOC 291 #define T_ATMA 292 #define T_NAPTR 293 #define T_KX 294 #define T_A6 295 #define T_DNAME 296 #define T_SINK 297 #define T_OPT 298 #define T_APL 299 #define T_UINFO 300 #define T_UID 301 #define T_GID 302 #define T_UNSPEC 303 #define T_TKEY 304 #define T_TSIG 305 #define T_IXFR 306 #define T_AXFR 307 #define T_MAILB 308 #define T_MAILA 309 #define T_DS 310 #define T_DLV 311 #define T_SSHFP 312 #define T_RRSIG 313 #define T_NSEC 314 #define T_DNSKEY 315 #define T_SPF 316 #define T_NSEC3 317 #define T_IPSECKEY 318 #define T_DHCID 319 #define T_NSEC3PARAM 320 #define T_TLSA 321 #define T_NID 322 #define T_L32 323 #define T_L64 324 #define T_LP 325 #define T_EUI48 326 #define T_EUI64 327 #define DOLLAR_TTL 328 #define DOLLAR_ORIGIN 329 #define NL 330 #define SP 331 #define STR 332 #define PREV 333 #define BITLAB 334 #define T_TTL 335 #define T_RRCLASS 336 #define URR 337 #define T_UTYPE 338 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED typedef union YYSTYPE { /* Line 293 of yacc.c */ #line 50 "zparser.y" domain_type *domain; const dname_type *dname; struct lex_data data; uint32_t ttl; uint16_t klass; uint16_t type; uint16_t *unknown; /* Line 293 of yacc.c */ #line 336 "zparser.c" } YYSTYPE; # define YYSTYPE_IS_TRIVIAL 1 # define yystype YYSTYPE /* obsolescent; will be withdrawn */ # define YYSTYPE_IS_DECLARED 1 #endif /* Copy the second part of user declarations. */ /* Line 343 of yacc.c */ #line 348 "zparser.c" #ifdef short # undef short #endif #ifdef YYTYPE_UINT8 typedef YYTYPE_UINT8 yytype_uint8; #else typedef unsigned char yytype_uint8; #endif #ifdef YYTYPE_INT8 typedef YYTYPE_INT8 yytype_int8; #elif (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) typedef signed char yytype_int8; #else typedef short int yytype_int8; #endif #ifdef YYTYPE_UINT16 typedef YYTYPE_UINT16 yytype_uint16; #else typedef unsigned short int yytype_uint16; #endif #ifdef YYTYPE_INT16 typedef YYTYPE_INT16 yytype_int16; #else typedef short int yytype_int16; #endif #ifndef YYSIZE_T # ifdef __SIZE_TYPE__ # define YYSIZE_T __SIZE_TYPE__ # elif defined size_t # define YYSIZE_T size_t # elif ! defined YYSIZE_T && (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) # include /* INFRINGES ON USER NAME SPACE */ # define YYSIZE_T size_t # else # define YYSIZE_T unsigned int # endif #endif #define YYSIZE_MAXIMUM ((YYSIZE_T) -1) #ifndef YY_ # if defined YYENABLE_NLS && YYENABLE_NLS # if ENABLE_NLS # include /* INFRINGES ON USER NAME SPACE */ # define YY_(msgid) dgettext ("bison-runtime", msgid) # endif # endif # ifndef YY_ # define YY_(msgid) msgid # endif #endif /* Suppress unused-variable warnings by "using" E. */ #if ! defined lint || defined __GNUC__ # define YYUSE(e) ((void) (e)) #else # define YYUSE(e) /* empty */ #endif /* Identity function, used to suppress warnings about constant conditions. */ #ifndef lint # define YYID(n) (n) #else #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static int YYID (int yyi) #else static int YYID (yyi) int yyi; #endif { return yyi; } #endif #if ! defined yyoverflow || YYERROR_VERBOSE /* The parser invokes alloca or malloc; define the necessary symbols. */ # ifdef YYSTACK_USE_ALLOCA # if YYSTACK_USE_ALLOCA # ifdef __GNUC__ # define YYSTACK_ALLOC __builtin_alloca # elif defined __BUILTIN_VA_ARG_INCR # include /* INFRINGES ON USER NAME SPACE */ # elif defined _AIX # define YYSTACK_ALLOC __alloca # elif defined _MSC_VER # include /* INFRINGES ON USER NAME SPACE */ # define alloca _alloca # else # define YYSTACK_ALLOC alloca # if ! defined _ALLOCA_H && ! defined EXIT_SUCCESS && (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) # include /* INFRINGES ON USER NAME SPACE */ # ifndef EXIT_SUCCESS # define EXIT_SUCCESS 0 # endif # endif # endif # endif # endif # ifdef YYSTACK_ALLOC /* Pacify GCC's `empty if-body' warning. */ # define YYSTACK_FREE(Ptr) do { /* empty */; } while (YYID (0)) # ifndef YYSTACK_ALLOC_MAXIMUM /* The OS might guarantee only one guard page at the bottom of the stack, and a page size can be as small as 4096 bytes. So we cannot safely invoke alloca (N) if N exceeds 4096. Use a slightly smaller number to allow for a few compiler-allocated temporary stack slots. */ # define YYSTACK_ALLOC_MAXIMUM 4032 /* reasonable circa 2006 */ # endif # else # define YYSTACK_ALLOC YYMALLOC # define YYSTACK_FREE YYFREE # ifndef YYSTACK_ALLOC_MAXIMUM # define YYSTACK_ALLOC_MAXIMUM YYSIZE_MAXIMUM # endif # if (defined __cplusplus && ! defined EXIT_SUCCESS \ && ! ((defined YYMALLOC || defined malloc) \ && (defined YYFREE || defined free))) # include /* INFRINGES ON USER NAME SPACE */ # ifndef EXIT_SUCCESS # define EXIT_SUCCESS 0 # endif # endif # ifndef YYMALLOC # define YYMALLOC malloc # if ! defined malloc && ! defined EXIT_SUCCESS && (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) void *malloc (YYSIZE_T); /* INFRINGES ON USER NAME SPACE */ # endif # endif # ifndef YYFREE # define YYFREE free # if ! defined free && ! defined EXIT_SUCCESS && (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) void free (void *); /* INFRINGES ON USER NAME SPACE */ # endif # endif # endif #endif /* ! defined yyoverflow || YYERROR_VERBOSE */ #if (! defined yyoverflow \ && (! defined __cplusplus \ || (defined YYSTYPE_IS_TRIVIAL && YYSTYPE_IS_TRIVIAL))) /* A type that is properly aligned for any stack member. */ union yyalloc { yytype_int16 yyss_alloc; YYSTYPE yyvs_alloc; }; /* The size of the maximum gap between one aligned stack and the next. */ # define YYSTACK_GAP_MAXIMUM (sizeof (union yyalloc) - 1) /* The size of an array large to enough to hold all stacks, each with N elements. */ # define YYSTACK_BYTES(N) \ ((N) * (sizeof (yytype_int16) + sizeof (YYSTYPE)) \ + YYSTACK_GAP_MAXIMUM) # define YYCOPY_NEEDED 1 /* Relocate STACK from its old location to the new one. The local variables YYSIZE and YYSTACKSIZE give the old and new number of elements in the stack, and YYPTR gives the new location of the stack. Advance YYPTR to a properly aligned location for the next stack. */ # define YYSTACK_RELOCATE(Stack_alloc, Stack) \ do \ { \ YYSIZE_T yynewbytes; \ YYCOPY (&yyptr->Stack_alloc, Stack, yysize); \ Stack = &yyptr->Stack_alloc; \ yynewbytes = yystacksize * sizeof (*Stack) + YYSTACK_GAP_MAXIMUM; \ yyptr += yynewbytes / sizeof (*yyptr); \ } \ while (YYID (0)) #endif #if defined YYCOPY_NEEDED && YYCOPY_NEEDED /* Copy COUNT objects from FROM to TO. The source and destination do not overlap. */ # ifndef YYCOPY # if defined __GNUC__ && 1 < __GNUC__ # define YYCOPY(To, From, Count) \ __builtin_memcpy (To, From, (Count) * sizeof (*(From))) # else # define YYCOPY(To, From, Count) \ do \ { \ YYSIZE_T yyi; \ for (yyi = 0; yyi < (Count); yyi++) \ (To)[yyi] = (From)[yyi]; \ } \ while (YYID (0)) # endif # endif #endif /* !YYCOPY_NEEDED */ /* YYFINAL -- State number of the termination state. */ #define YYFINAL 2 /* YYLAST -- Last index in YYTABLE. */ #define YYLAST 847 /* YYNTOKENS -- Number of terminals. */ #define YYNTOKENS 86 /* YYNNTS -- Number of nonterminals. */ #define YYNNTS 70 /* YYNRULES -- Number of rules. */ #define YYNRULES 215 /* YYNRULES -- Number of states. */ #define YYNSTATES 528 /* YYTRANSLATE(YYLEX) -- Bison symbol number corresponding to YYLEX. */ #define YYUNDEFTOK 2 #define YYMAXUTOK 338 #define YYTRANSLATE(YYX) \ ((unsigned int) (YYX) <= YYMAXUTOK ? yytranslate[YYX] : YYUNDEFTOK) /* YYTRANSLATE[YYLEX] -- Bison symbol number corresponding to YYLEX. */ static const yytype_uint8 yytranslate[] = { 0, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 84, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 85, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 2, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83 }; #if YYDEBUG /* YYPRHS[YYN] -- Index of the first RHS symbol of rule number YYN in YYRHS. */ static const yytype_uint16 yyprhs[] = { 0, 0, 3, 4, 7, 9, 12, 15, 17, 19, 21, 24, 26, 29, 31, 34, 39, 44, 49, 53, 56, 58, 59, 62, 65, 70, 75, 77, 79, 81, 83, 86, 88, 90, 92, 96, 98, 100, 102, 105, 107, 109, 113, 115, 119, 121, 123, 127, 131, 133, 137, 140, 142, 145, 147, 150, 152, 156, 158, 162, 164, 166, 169, 173, 177, 181, 185, 189, 193, 197, 201, 205, 209, 213, 217, 221, 225, 229, 233, 237, 241, 245, 249, 253, 257, 261, 265, 269, 273, 277, 281, 285, 289, 293, 297, 301, 305, 309, 313, 317, 321, 325, 329, 333, 337, 341, 345, 349, 353, 357, 361, 365, 369, 373, 377, 381, 385, 389, 393, 397, 401, 405, 409, 413, 417, 421, 425, 429, 433, 437, 441, 445, 449, 453, 456, 460, 464, 468, 472, 476, 480, 484, 488, 492, 496, 500, 504, 508, 512, 516, 520, 524, 528, 532, 536, 540, 544, 548, 552, 556, 560, 564, 568, 572, 576, 580, 584, 588, 592, 595, 598, 613, 620, 625, 630, 635, 638, 643, 648, 651, 654, 659, 664, 667, 674, 677, 680, 685, 694, 707, 712, 721, 724, 726, 730, 739, 748, 755, 758, 777, 780, 791, 800, 809, 818, 826, 831, 834, 839, 844, 849, 854, 857, 860, 867, 872 }; /* YYRHS -- A `-1'-separated list of the rules' RHS. */ static const yytype_int16 yyrhs[] = { 87, 0, -1, -1, 87, 88, -1, 75, -1, 89, 75, -1, 78, 75, -1, 91, -1, 92, -1, 93, -1, 1, 75, -1, 76, -1, 89, 76, -1, 75, -1, 89, 75, -1, 73, 89, 77, 90, -1, 74, 89, 97, 90, -1, 74, 89, 99, 90, -1, 94, 95, 112, -1, 96, 89, -1, 78, -1, -1, 81, 89, -1, 80, 89, -1, 80, 89, 81, 89, -1, 81, 89, 80, 89, -1, 97, -1, 99, -1, 84, -1, 85, -1, 99, 84, -1, 77, -1, 79, -1, 98, -1, 99, 84, 98, -1, 101, -1, 103, -1, 84, -1, 103, 84, -1, 77, -1, 102, -1, 103, 84, 102, -1, 77, -1, 104, 89, 77, -1, 77, -1, 84, -1, 105, 89, 77, -1, 105, 84, 77, -1, 77, -1, 106, 89, 77, -1, 76, 107, -1, 75, -1, 77, 108, -1, 75, -1, 76, 107, -1, 77, -1, 109, 89, 77, -1, 77, -1, 110, 84, 77, -1, 77, -1, 84, -1, 111, 84, -1, 111, 84, 77, -1, 3, 89, 113, -1, 3, 89, 155, -1, 4, 89, 114, -1, 4, 89, 155, -1, 17, 89, 114, -1, 17, 89, 155, -1, 18, 89, 114, -1, 18, 89, 155, -1, 7, 89, 114, -1, 7, 89, 155, -1, 12, 89, 115, -1, 12, 89, 155, -1, 19, 89, 114, -1, 19, 89, 155, -1, 20, 89, 114, -1, 20, 89, 155, -1, 21, 89, 114, -1, 21, 89, 155, -1, 23, 89, 116, -1, 23, 89, 155, -1, 9, 89, 114, -1, 9, 89, 155, -1, 24, 89, 117, -1, 24, 89, 155, -1, 25, 89, 118, -1, 25, 89, 155, -1, 5, 89, 119, -1, 5, 89, 155, -1, 6, 89, 120, -1, 6, 89, 155, -1, 61, 89, 120, -1, 61, 89, 155, -1, 26, 89, 121, -1, 26, 89, 155, -1, 27, 89, 122, -1, 27, 89, 155, -1, 28, 89, 123, -1, 28, 89, 155, -1, 29, 89, 124, -1, 29, 89, 155, -1, 63, 89, 148, -1, 63, 89, 155, -1, 64, 89, 140, -1, 64, 89, 155, -1, 30, 89, 125, -1, 30, 89, 155, -1, 31, 89, 126, -1, 31, 89, 155, -1, 13, 89, 141, -1, 13, 89, 155, -1, 11, 89, 146, -1, 11, 89, 155, -1, 33, 89, 127, -1, 33, 89, 155, -1, 8, 89, 128, -1, 8, 89, 155, -1, 16, 89, 129, -1, 16, 89, 155, -1, 10, 89, 130, -1, 10, 89, 155, -1, 14, 89, 131, -1, 14, 89, 155, -1, 38, 89, 132, -1, 38, 89, 155, -1, 39, 89, 133, -1, 39, 89, 155, -1, 15, 89, 134, -1, 15, 89, 155, -1, 41, 89, 114, -1, 41, 89, 155, -1, 44, 90, -1, 44, 89, 135, -1, 44, 89, 155, -1, 55, 89, 137, -1, 55, 89, 155, -1, 56, 89, 138, -1, 56, 89, 155, -1, 57, 89, 139, -1, 57, 89, 155, -1, 58, 89, 141, -1, 58, 89, 155, -1, 59, 89, 142, -1, 59, 89, 155, -1, 62, 89, 143, -1, 62, 89, 155, -1, 65, 89, 144, -1, 65, 89, 155, -1, 60, 89, 146, -1, 60, 89, 155, -1, 66, 89, 145, -1, 66, 89, 155, -1, 67, 89, 149, -1, 67, 89, 155, -1, 68, 89, 150, -1, 68, 89, 155, -1, 69, 89, 151, -1, 69, 89, 155, -1, 70, 89, 152, -1, 70, 89, 155, -1, 71, 89, 153, -1, 71, 89, 155, -1, 72, 89, 154, -1, 72, 89, 155, -1, 83, 89, 155, -1, 77, 1, 75, -1, 111, 90, -1, 96, 90, -1, 96, 89, 96, 89, 77, 89, 77, 89, 77, 89, 77, 89, 77, 90, -1, 111, 89, 77, 89, 105, 90, -1, 77, 89, 77, 90, -1, 96, 89, 96, 90, -1, 77, 89, 96, 90, -1, 104, 90, -1, 96, 89, 96, 90, -1, 77, 89, 96, 90, -1, 77, 90, -1, 77, 90, -1, 77, 89, 77, 90, -1, 77, 89, 96, 90, -1, 110, 90, -1, 77, 89, 96, 89, 96, 90, -1, 111, 90, -1, 105, 90, -1, 96, 89, 106, 90, -1, 77, 89, 77, 89, 77, 89, 96, 90, -1, 77, 89, 77, 89, 77, 89, 77, 89, 77, 89, 96, 90, -1, 77, 89, 96, 90, -1, 77, 89, 77, 89, 77, 89, 109, 90, -1, 136, 90, -1, 111, -1, 136, 89, 111, -1, 77, 89, 77, 89, 77, 89, 109, 90, -1, 77, 89, 77, 89, 77, 89, 109, 90, -1, 77, 89, 77, 89, 109, 90, -1, 109, 90, -1, 77, 89, 77, 89, 77, 89, 77, 89, 77, 89, 77, 89, 77, 89, 100, 89, 109, 90, -1, 100, 108, -1, 77, 89, 77, 89, 77, 89, 77, 89, 77, 108, -1, 77, 89, 77, 89, 77, 89, 77, 90, -1, 77, 89, 77, 89, 77, 89, 109, 90, -1, 77, 89, 77, 89, 77, 89, 109, 90, -1, 77, 89, 77, 89, 77, 89, 111, -1, 147, 89, 109, 90, -1, 147, 90, -1, 77, 89, 111, 90, -1, 77, 89, 111, 90, -1, 77, 89, 111, 90, -1, 77, 89, 96, 90, -1, 77, 90, -1, 77, 90, -1, 82, 89, 77, 89, 109, 90, -1, 82, 89, 77, 90, -1, 82, 1, 75, -1 }; /* YYRLINE[YYN] -- source line where rule number YYN was defined. */ static const yytype_uint16 yyrline[] = { 0, 91, 91, 92, 95, 96, 97, 98, 102, 106, 126, 130, 131, 134, 135, 138, 148, 152, 158, 165, 170, 177, 181, 186, 191, 196, 203, 204, 222, 226, 230, 240, 254, 261, 262, 280, 281, 284, 292, 304, 321, 322, 339, 343, 353, 354, 359, 368, 380, 389, 400, 403, 406, 420, 421, 428, 429, 445, 446, 461, 462, 467, 477, 495, 496, 497, 498, 499, 500, 505, 506, 512, 513, 514, 515, 516, 517, 523, 524, 525, 526, 528, 529, 530, 531, 532, 533, 534, 535, 536, 537, 538, 539, 540, 541, 542, 543, 544, 545, 546, 547, 548, 549, 550, 551, 552, 553, 554, 555, 556, 557, 558, 559, 560, 561, 562, 563, 564, 565, 566, 567, 568, 569, 570, 571, 572, 573, 574, 575, 576, 577, 578, 579, 580, 581, 582, 583, 584, 585, 586, 587, 588, 589, 590, 591, 592, 593, 594, 595, 596, 597, 598, 599, 600, 601, 602, 603, 604, 605, 606, 607, 608, 609, 610, 611, 612, 613, 614, 626, 632, 639, 652, 659, 666, 674, 681, 688, 696, 704, 711, 715, 723, 731, 743, 751, 757, 763, 771, 781, 793, 801, 811, 814, 818, 824, 833, 842, 850, 856, 871, 881, 896, 906, 915, 924, 958, 962, 966, 973, 980, 987, 994, 1004, 1014, 1020, 1024 }; #endif #if YYDEBUG || YYERROR_VERBOSE || YYTOKEN_TABLE /* YYTNAME[SYMBOL-NUM] -- String name of the symbol SYMBOL-NUM. First, the terminals, then, starting at YYNTOKENS, nonterminals. */ static const char *const yytname[] = { "$end", "error", "$undefined", "T_A", "T_NS", "T_MX", "T_TXT", "T_CNAME", "T_AAAA", "T_PTR", "T_NXT", "T_KEY", "T_SOA", "T_SIG", "T_SRV", "T_CERT", "T_LOC", "T_MD", "T_MF", "T_MB", "T_MG", "T_MR", "T_NULL", "T_WKS", "T_HINFO", "T_MINFO", "T_RP", "T_AFSDB", "T_X25", "T_ISDN", "T_RT", "T_NSAP", "T_NSAP_PTR", "T_PX", "T_GPOS", "T_EID", "T_NIMLOC", "T_ATMA", "T_NAPTR", "T_KX", "T_A6", "T_DNAME", "T_SINK", "T_OPT", "T_APL", "T_UINFO", "T_UID", "T_GID", "T_UNSPEC", "T_TKEY", "T_TSIG", "T_IXFR", "T_AXFR", "T_MAILB", "T_MAILA", "T_DS", "T_DLV", "T_SSHFP", "T_RRSIG", "T_NSEC", "T_DNSKEY", "T_SPF", "T_NSEC3", "T_IPSECKEY", "T_DHCID", "T_NSEC3PARAM", "T_TLSA", "T_NID", "T_L32", "T_L64", "T_LP", "T_EUI48", "T_EUI64", "DOLLAR_TTL", "DOLLAR_ORIGIN", "NL", "SP", "STR", "PREV", "BITLAB", "T_TTL", "T_RRCLASS", "URR", "T_UTYPE", "'.'", "'@'", "$accept", "lines", "line", "sp", "trail", "ttl_directive", "origin_directive", "rr", "owner", "classttl", "dname", "abs_dname", "label", "rel_dname", "wire_dname", "wire_abs_dname", "wire_label", "wire_rel_dname", "str_seq", "concatenated_str_seq", "nxt_seq", "nsec_more", "nsec_seq", "str_sp_seq", "str_dot_seq", "dotted_str", "type_and_rdata", "rdata_a", "rdata_domain_name", "rdata_soa", "rdata_wks", "rdata_hinfo", "rdata_minfo", "rdata_mx", "rdata_txt", "rdata_rp", "rdata_afsdb", "rdata_x25", "rdata_isdn", "rdata_rt", "rdata_nsap", "rdata_px", "rdata_aaaa", "rdata_loc", "rdata_nxt", "rdata_srv", "rdata_naptr", "rdata_kx", "rdata_cert", "rdata_apl", "rdata_apl_seq", "rdata_ds", "rdata_dlv", "rdata_sshfp", "rdata_dhcid", "rdata_rrsig", "rdata_nsec", "rdata_nsec3", "rdata_nsec3_param", "rdata_tlsa", "rdata_dnskey", "rdata_ipsec_base", "rdata_ipseckey", "rdata_nid", "rdata_l32", "rdata_l64", "rdata_lp", "rdata_eui48", "rdata_eui64", "rdata_unknown", 0 }; #endif # ifdef YYPRINT /* YYTOKNUM[YYLEX-NUM] -- Internal token number corresponding to token YYLEX-NUM. */ static const yytype_uint16 yytoknum[] = { 0, 256, 257, 258, 259, 260, 261, 262, 263, 264, 265, 266, 267, 268, 269, 270, 271, 272, 273, 274, 275, 276, 277, 278, 279, 280, 281, 282, 283, 284, 285, 286, 287, 288, 289, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 311, 312, 313, 314, 315, 316, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 331, 332, 333, 334, 335, 336, 337, 338, 46, 64 }; # endif /* YYR1[YYN] -- Symbol number of symbol that rule YYN derives. */ static const yytype_uint8 yyr1[] = { 0, 86, 87, 87, 88, 88, 88, 88, 88, 88, 88, 89, 89, 90, 90, 91, 92, 92, 93, 94, 94, 95, 95, 95, 95, 95, 96, 96, 97, 97, 97, 98, 98, 99, 99, 100, 100, 101, 101, 102, 103, 103, 104, 104, 105, 105, 105, 105, 106, 106, 107, 107, 107, 108, 108, 109, 109, 110, 110, 111, 111, 111, 111, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 134, 135, 136, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 148, 149, 150, 151, 152, 153, 154, 155, 155, 155 }; /* YYR2[YYN] -- Number of symbols composing right hand side of rule YYN. */ static const yytype_uint8 yyr2[] = { 0, 2, 0, 2, 1, 2, 2, 1, 1, 1, 2, 1, 2, 1, 2, 4, 4, 4, 3, 2, 1, 0, 2, 2, 4, 4, 1, 1, 1, 1, 2, 1, 1, 1, 3, 1, 1, 1, 2, 1, 1, 3, 1, 3, 1, 1, 3, 3, 1, 3, 2, 1, 2, 1, 2, 1, 3, 1, 3, 1, 1, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 2, 2, 14, 6, 4, 4, 4, 2, 4, 4, 2, 2, 4, 4, 2, 6, 2, 2, 4, 8, 12, 4, 8, 2, 1, 3, 8, 8, 6, 2, 18, 2, 10, 8, 8, 8, 7, 4, 2, 4, 4, 4, 4, 2, 2, 6, 4, 3 }; /* YYDEFACT[STATE-NAME] -- Default reduction number in state STATE-NUM. Performed when YYTABLE doesn't specify something else to do. Zero means the default is an error. */ static const yytype_uint8 yydefact[] = { 2, 0, 1, 0, 0, 0, 4, 11, 31, 20, 32, 28, 29, 3, 0, 7, 8, 9, 21, 0, 26, 33, 27, 10, 0, 0, 6, 5, 12, 0, 0, 0, 19, 30, 0, 0, 0, 23, 22, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 18, 34, 13, 0, 15, 16, 17, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 133, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 14, 24, 25, 59, 0, 60, 0, 63, 64, 0, 65, 66, 0, 89, 90, 42, 0, 91, 92, 71, 72, 0, 117, 118, 83, 84, 0, 121, 122, 0, 113, 114, 0, 73, 74, 0, 111, 112, 0, 123, 124, 0, 129, 130, 44, 45, 0, 119, 120, 67, 68, 69, 70, 75, 76, 77, 78, 79, 80, 0, 81, 82, 0, 85, 86, 0, 87, 88, 0, 95, 96, 0, 97, 98, 0, 99, 100, 0, 101, 102, 0, 107, 108, 57, 0, 109, 110, 0, 115, 116, 0, 125, 126, 0, 127, 128, 131, 132, 192, 134, 0, 135, 0, 136, 137, 0, 138, 139, 0, 140, 141, 142, 143, 39, 37, 0, 35, 40, 36, 144, 145, 150, 151, 93, 94, 0, 146, 147, 0, 0, 103, 104, 55, 0, 105, 106, 0, 148, 149, 0, 152, 153, 0, 154, 155, 0, 156, 157, 0, 158, 159, 0, 160, 161, 0, 162, 163, 0, 164, 165, 167, 166, 0, 0, 61, 168, 169, 0, 0, 175, 184, 0, 0, 0, 0, 0, 0, 0, 0, 185, 0, 0, 0, 0, 0, 178, 0, 179, 0, 0, 182, 0, 0, 0, 0, 191, 0, 0, 0, 53, 0, 199, 38, 0, 0, 0, 206, 0, 197, 0, 0, 0, 0, 0, 0, 211, 212, 215, 0, 62, 0, 43, 48, 0, 0, 0, 0, 0, 0, 47, 46, 0, 0, 0, 0, 0, 0, 0, 58, 0, 0, 0, 193, 0, 0, 0, 51, 0, 0, 54, 41, 0, 0, 0, 56, 0, 0, 0, 0, 0, 0, 0, 214, 174, 0, 186, 0, 0, 0, 0, 0, 0, 172, 173, 176, 177, 180, 181, 0, 0, 189, 0, 0, 0, 50, 52, 0, 0, 205, 0, 0, 207, 208, 209, 210, 0, 49, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 213, 0, 0, 0, 0, 0, 171, 183, 0, 0, 0, 196, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 204, 0, 0, 203, 0, 0, 187, 190, 0, 194, 195, 0, 201, 202, 0, 0, 0, 0, 0, 0, 0, 200, 0, 0, 0, 0, 0, 188, 0, 0, 170, 0, 0, 0, 0, 198 }; /* YYDEFGOTO[NTERM-NUM]. */ static const yytype_int16 yydefgoto[] = { -1, 1, 13, 95, 96, 15, 16, 17, 18, 31, 164, 20, 21, 22, 270, 271, 272, 273, 171, 201, 378, 404, 356, 288, 239, 161, 92, 162, 165, 188, 215, 218, 221, 168, 172, 224, 227, 230, 233, 236, 240, 243, 177, 202, 182, 194, 246, 249, 197, 254, 255, 258, 261, 264, 289, 191, 274, 281, 292, 295, 185, 284, 285, 298, 301, 304, 307, 310, 313, 163 }; /* YYPACT[STATE-NUM] -- Index in YYTABLE of the portion describing STATE-NUM. */ #define YYPACT_NINF -398 static const yytype_int16 yypact[] = { -398, 100, -398, -70, -52, -52, -398, -398, -398, -40, -398, -398, -398, -398, 20, -398, -398, -398, 88, -52, -398, -398, 51, -398, 95, 41, -398, -398, -398, -52, -52, 764, 62, 30, 189, 189, -54, 56, 17, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, 189, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, -52, 139, -52, -398, -398, -398, 202, -398, -398, -398, -52, -52, -69, -65, 105, 114, -65, -69, -65, -65, 117, -65, 125, 127, 129, 70, -65, -65, -65, -65, -65, -69, 138, -65, -65, 141, 150, 153, 160, 163, 173, 181, 184, -65, -50, -398, 191, 204, 212, 125, 80, 117, 114, 215, 224, 227, 231, 238, 241, 248, 250, 258, 265, 268, 73, -45, -398, 62, 62, -398, 15, -398, 40, -398, -398, 189, -398, -398, -52, -398, -398, -398, 189, -398, -398, -398, -398, 40, -398, -398, -398, -398, -52, -398, -398, -52, -398, -398, -52, -398, -398, -52, -398, -398, -52, -398, -398, -52, -398, -398, -398, -398, 55, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -74, -398, -398, -52, -398, -398, -52, -398, -398, -52, -398, -398, -52, -398, -398, 189, -398, -398, 189, -398, -398, -52, -398, -398, -398, 58, -398, -398, -52, -398, -398, -52, -398, -398, -52, -398, -398, -398, -398, 69, -398, 189, -398, -52, -398, -398, -52, -398, -398, -52, -398, -398, -398, -398, -398, -398, 209, -398, -398, 77, -398, -398, -398, -398, -398, -398, -52, -398, -398, -52, 189, -398, -398, -398, 189, -398, -398, -52, -398, -398, -52, -398, -398, -52, -398, -398, -52, -398, -398, -52, -398, -398, -52, -398, -398, 189, -398, -398, 189, -398, -398, -398, -398, 90, 294, 86, -398, -398, 41, 276, -398, -398, 310, 312, 41, 314, 319, 326, 111, 279, -398, 336, 338, 41, 41, 41, -398, 282, -398, 41, 120, -398, 41, 341, 41, 52, -398, 343, 345, 347, -398, 285, -398, 131, 349, 351, 288, -398, 291, -398, 353, 355, 37, 37, 37, 41, -398, -398, -398, 189, -398, 189, -398, -398, 189, -52, -52, -52, -52, -52, -398, -398, -52, 189, 189, 189, 189, 189, 189, -398, -52, -52, 189, 69, -52, -52, -52, -398, 285, 209, -398, -398, -52, -52, 189, -398, -52, -52, 40, 40, 40, 189, 288, -398, -398, 298, -398, 358, 360, 362, 366, 368, 67, -398, -398, -398, -398, -398, -398, 41, 370, -398, 390, 397, 399, -398, -398, 401, 404, -398, 415, 420, -398, -398, -398, -398, 189, -398, -52, -52, -52, -52, -52, 55, 189, -52, -52, -52, 189, -52, -52, -52, -52, -398, 399, 422, 424, 41, 399, -398, -398, 426, 399, 399, -398, 432, 37, 434, 399, 189, -52, -52, 189, 189, -52, 189, 189, -52, 69, 189, 189, -398, 439, 441, -398, -398, 445, -398, -398, 450, -398, -398, -52, -52, -52, 209, 453, 455, 41, -398, -52, -52, 189, 457, 459, -398, 189, -52, -398, 83, -52, 399, 189, -398 }; /* YYPGOTO[NTERM-NUM]. */ static const yytype_int16 yypgoto[] = { -398, -398, -398, -1, 240, -398, -398, -398, -398, -398, 0, 185, 179, 196, -299, -398, -129, -398, -398, -193, -398, -164, -397, -327, -398, -97, -398, -398, -13, -398, -398, -398, -398, -398, 102, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, -398, 108, -398, -398, -398, -398, 113, -398, -398, -398, -398, -398, -398, -398, -398, 451 }; /* YYTABLE[YYPACT[STATE-NUM]]. What to do in state STATE-NUM. If positive, shift that token. If negative, reduce the rule which number is the opposite. If YYTABLE_NINF, syntax error. */ #define YYTABLE_NINF -1 static const yytype_uint16 yytable[] = { 14, 19, 7, 24, 25, 23, 440, 28, 158, 176, 319, 28, 8, 159, 10, 160, 317, 159, 32, 11, 12, 94, 7, 214, 7, 155, 28, 158, 37, 38, 33, 28, 159, 408, 160, 26, 253, 159, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, 450, 154, 7, 174, 28, 179, 27, 28, 100, 156, 157, 2, 3, 204, 206, 208, 210, 212, 8, 181, 10, 187, 462, 513, 28, 158, 94, 7, 28, 8, 251, 10, 160, 220, 223, 319, 11, 12, 155, 28, 158, 94, 7, 28, 94, 7, 33, 160, 99, 28, 332, 153, 483, 344, 28, 199, 487, 28, 199, 315, 489, 490, 200, 159, 319, 200, 494, 28, 268, 318, 28, 268, 357, 159, 374, 269, 372, 322, 269, 29, 30, 323, 28, 34, 4, 5, 6, 7, 8, 9, 10, 326, 28, 167, 327, 11, 12, 328, 159, 384, 329, 28, 170, 330, 28, 184, 331, 159, 393, 526, 159, 333, 28, 190, 28, 193, 28, 196, 159, 268, 159, 35, 159, 93, 335, 28, 217, 336, 28, 226, 337, 159, 36, 338, 159, 524, 339, 28, 229, 405, 28, 232, 341, 159, 457, 343, 159, 28, 235, 439, 28, 238, 346, 159, 278, 347, 159, 266, 348, 0, 28, 242, 0, 397, 276, 349, 159, 351, 28, 245, 352, 28, 248, 353, 159, 94, 7, 159, 28, 257, 412, 413, 414, 0, 159, 0, 97, 98, 155, 28, 358, 28, 260, 359, 360, 354, 355, 159, 362, 28, 263, 364, 28, 280, 365, 159, 0, 366, 159, 0, 367, 28, 283, 368, 28, 287, 369, 159, 28, 291, 159, 0, 134, 0, 159, 28, 294, 0, 28, 297, 0, 159, 0, 375, 159, 28, 300, 28, 303, 380, 0, 159, 0, 159, 0, 28, 306, 0, 388, 389, 390, 159, 28, 309, 392, 28, 312, 394, 159, 396, 0, 159, 155, 28, 376, 155, 28, 385, 155, 28, 391, 401, 402, 403, 155, 28, 287, 155, 28, 409, 415, 28, 373, 416, 155, 28, 451, 0, 419, 421, 422, 423, 424, 425, 492, 0, 426, 28, 377, 28, 379, 28, 381, 0, 433, 434, 28, 382, 436, 437, 438, 0, 320, 28, 383, 321, 441, 442, 362, 0, 444, 445, 324, 28, 386, 28, 387, 325, 28, 395, 28, 398, 28, 399, 28, 400, 28, 406, 28, 407, 28, 410, 28, 411, 458, 28, 452, 28, 453, 28, 454, 0, 334, 28, 455, 28, 456, 28, 459, 0, 362, 0, 468, 469, 470, 471, 472, 333, 0, 475, 476, 477, 362, 479, 480, 481, 482, 28, 460, 0, 340, 0, 486, 342, 28, 461, 28, 287, 28, 463, 345, 28, 464, 362, 496, 497, 0, 362, 500, 362, 362, 503, 28, 465, 362, 0, 350, 28, 466, 28, 484, 28, 485, 28, 488, 0, 510, 511, 512, 28, 491, 28, 493, 516, 517, 518, 28, 506, 28, 507, 0, 523, 28, 508, 525, 361, 362, 28, 509, 363, 28, 514, 28, 515, 28, 520, 28, 521, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 370, 0, 0, 371, 166, 169, 173, 175, 178, 180, 183, 186, 189, 192, 195, 198, 203, 205, 207, 209, 211, 213, 216, 219, 222, 225, 228, 231, 234, 237, 241, 244, 247, 250, 252, 256, 0, 259, 262, 265, 267, 275, 277, 279, 282, 286, 290, 293, 296, 299, 302, 305, 308, 311, 314, 0, 316, 0, 0, 0, 0, 0, 0, 0, 417, 0, 418, 0, 0, 420, 0, 0, 0, 0, 0, 0, 0, 0, 427, 428, 429, 430, 431, 432, 0, 0, 0, 435, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 443, 0, 0, 0, 446, 447, 448, 449, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 467, 0, 0, 0, 0, 0, 0, 473, 474, 0, 0, 0, 478, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 495, 0, 0, 498, 499, 0, 501, 502, 0, 0, 504, 505, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 519, 0, 0, 0, 522, 0, 0, 0, 0, 0, 527, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 0, 58, 59, 60, 61, 62, 63, 64, 65, 66, 0, 67, 0, 0, 0, 0, 68, 69, 0, 70, 0, 0, 71, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 0, 0, 0, 0, 90, 0, 0, 0, 0, 0, 91 }; #define yypact_value_is_default(yystate) \ ((yystate) == (-398)) #define yytable_value_is_error(yytable_value) \ YYID (0) static const yytype_int16 yycheck[] = { 1, 1, 76, 4, 5, 75, 403, 76, 77, 106, 84, 76, 77, 82, 79, 84, 1, 82, 19, 84, 85, 75, 76, 120, 76, 75, 76, 77, 29, 30, 84, 76, 82, 360, 84, 75, 133, 82, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 73, 74, 75, 76, 77, 78, 79, 80, 81, 82, 83, 84, 85, 86, 87, 88, 89, 416, 91, 76, 105, 76, 107, 75, 76, 80, 99, 100, 0, 1, 115, 116, 117, 118, 119, 77, 108, 79, 110, 438, 509, 76, 77, 75, 76, 76, 77, 132, 79, 84, 122, 123, 84, 84, 85, 75, 76, 77, 75, 76, 76, 75, 76, 84, 84, 81, 76, 84, 1, 468, 84, 76, 77, 472, 76, 77, 75, 476, 477, 84, 82, 84, 84, 482, 76, 77, 159, 76, 77, 84, 82, 77, 84, 75, 167, 84, 80, 81, 171, 76, 77, 73, 74, 75, 76, 77, 78, 79, 181, 76, 77, 184, 84, 85, 187, 82, 77, 190, 76, 77, 193, 76, 77, 196, 82, 77, 525, 82, 201, 76, 77, 76, 77, 76, 77, 82, 77, 82, 25, 82, 33, 214, 76, 77, 217, 76, 77, 220, 82, 25, 223, 82, 523, 226, 76, 77, 357, 76, 77, 232, 82, 426, 235, 82, 76, 77, 402, 76, 77, 242, 82, 141, 245, 82, 138, 248, -1, 76, 77, -1, 349, 140, 255, 82, 257, 76, 77, 260, 76, 77, 263, 82, 75, 76, 82, 76, 77, 366, 367, 368, -1, 82, -1, 35, 36, 75, 76, 280, 76, 77, 283, 284, 75, 76, 82, 288, 76, 77, 291, 76, 77, 294, 82, -1, 297, 82, -1, 300, 76, 77, 303, 76, 77, 306, 82, 76, 77, 82, -1, 71, -1, 82, 76, 77, -1, 76, 77, -1, 82, -1, 322, 82, 76, 77, 76, 77, 328, -1, 82, -1, 82, -1, 76, 77, -1, 337, 338, 339, 82, 76, 77, 343, 76, 77, 346, 82, 348, -1, 82, 75, 76, 77, 75, 76, 77, 75, 76, 77, 75, 76, 77, 75, 76, 77, 75, 76, 77, 369, 76, 77, 373, 75, 76, 77, -1, 378, 379, 380, 381, 382, 383, 480, -1, 386, 76, 77, 76, 77, 76, 77, -1, 394, 395, 76, 77, 398, 399, 400, -1, 161, 76, 77, 164, 406, 407, 408, -1, 410, 411, 171, 76, 77, 76, 77, 176, 76, 77, 76, 77, 76, 77, 76, 77, 76, 77, 76, 77, 76, 77, 76, 77, 433, 76, 77, 76, 77, 76, 77, -1, 201, 76, 77, 76, 77, 76, 77, -1, 450, -1, 452, 453, 454, 455, 456, 457, -1, 459, 460, 461, 462, 463, 464, 465, 466, 76, 77, -1, 229, -1, 471, 232, 76, 77, 76, 77, 76, 77, 239, 76, 77, 483, 484, 485, -1, 487, 488, 489, 490, 491, 76, 77, 494, -1, 255, 76, 77, 76, 77, 76, 77, 76, 77, -1, 506, 507, 508, 76, 77, 76, 77, 512, 514, 515, 76, 77, 76, 77, -1, 521, 76, 77, 524, 284, 526, 76, 77, 288, 76, 77, 76, 77, 76, 77, 76, 77, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 309, -1, -1, 312, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127, 128, 129, 130, 131, 132, 133, -1, 135, 136, 137, 138, 139, 140, 141, 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152, -1, 154, -1, -1, -1, -1, -1, -1, -1, 373, -1, 375, -1, -1, 378, -1, -1, -1, -1, -1, -1, -1, -1, 387, 388, 389, 390, 391, 392, -1, -1, -1, 396, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 408, -1, -1, -1, 412, 413, 414, 415, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 450, -1, -1, -1, -1, -1, -1, 457, 458, -1, -1, -1, 462, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 483, -1, -1, 486, 487, -1, 489, 490, -1, -1, 493, 494, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 516, -1, -1, -1, 520, -1, -1, -1, -1, -1, 526, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, -1, 23, 24, 25, 26, 27, 28, 29, 30, 31, -1, 33, -1, -1, -1, -1, 38, 39, -1, 41, -1, -1, 44, -1, -1, -1, -1, -1, -1, -1, -1, -1, -1, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, -1, -1, -1, -1, 77, -1, -1, -1, -1, -1, 83 }; /* YYSTOS[STATE-NUM] -- The (internal number of the) accessing symbol of state STATE-NUM. */ static const yytype_uint8 yystos[] = { 0, 87, 0, 1, 73, 74, 75, 76, 77, 78, 79, 84, 85, 88, 89, 91, 92, 93, 94, 96, 97, 98, 99, 75, 89, 89, 75, 75, 76, 80, 81, 95, 89, 84, 77, 97, 99, 89, 89, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 23, 24, 25, 26, 27, 28, 29, 30, 31, 33, 38, 39, 41, 44, 55, 56, 57, 58, 59, 60, 61, 62, 63, 64, 65, 66, 67, 68, 69, 70, 71, 72, 77, 83, 112, 98, 75, 89, 90, 90, 90, 81, 80, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 90, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 89, 1, 89, 75, 89, 89, 77, 82, 84, 111, 113, 155, 96, 114, 155, 77, 119, 155, 77, 104, 120, 155, 114, 155, 111, 128, 155, 114, 155, 96, 130, 155, 77, 146, 155, 96, 115, 155, 77, 141, 155, 77, 131, 155, 77, 134, 155, 77, 84, 105, 129, 155, 114, 155, 114, 155, 114, 155, 114, 155, 114, 155, 111, 116, 155, 77, 117, 155, 96, 118, 155, 96, 121, 155, 77, 122, 155, 77, 123, 155, 77, 124, 155, 77, 125, 155, 77, 110, 126, 155, 77, 127, 155, 77, 132, 155, 77, 133, 155, 114, 155, 111, 135, 136, 155, 77, 137, 155, 77, 138, 155, 77, 139, 155, 141, 155, 77, 84, 100, 101, 102, 103, 142, 155, 146, 155, 120, 155, 77, 143, 155, 77, 147, 148, 155, 77, 109, 140, 155, 77, 144, 155, 77, 145, 155, 77, 149, 155, 77, 150, 155, 77, 151, 155, 77, 152, 155, 77, 153, 155, 77, 154, 155, 75, 155, 1, 89, 84, 90, 90, 89, 89, 90, 90, 89, 89, 89, 89, 89, 89, 84, 89, 90, 89, 89, 89, 89, 89, 90, 89, 90, 89, 84, 90, 89, 89, 89, 89, 90, 89, 89, 89, 75, 76, 108, 84, 89, 89, 89, 90, 89, 90, 89, 89, 89, 89, 89, 89, 90, 90, 75, 77, 77, 96, 77, 77, 106, 77, 96, 77, 77, 77, 77, 77, 77, 77, 96, 96, 96, 77, 96, 77, 96, 77, 96, 111, 77, 77, 77, 75, 76, 77, 107, 102, 77, 77, 109, 77, 77, 77, 111, 111, 111, 96, 89, 90, 90, 89, 90, 89, 89, 89, 89, 89, 89, 90, 90, 90, 90, 90, 90, 89, 89, 90, 89, 89, 89, 107, 108, 89, 89, 90, 89, 89, 90, 90, 90, 90, 109, 77, 77, 77, 77, 77, 77, 105, 96, 77, 77, 77, 109, 77, 77, 77, 77, 90, 89, 89, 89, 89, 89, 90, 90, 89, 89, 89, 90, 89, 89, 89, 89, 109, 77, 77, 96, 109, 77, 109, 109, 77, 111, 77, 109, 90, 89, 89, 90, 90, 89, 90, 90, 89, 90, 90, 77, 77, 77, 77, 89, 89, 89, 108, 77, 77, 96, 89, 89, 90, 77, 77, 90, 89, 100, 89, 109, 90 }; #define yyerrok (yyerrstatus = 0) #define yyclearin (yychar = YYEMPTY) #define YYEMPTY (-2) #define YYEOF 0 #define YYACCEPT goto yyacceptlab #define YYABORT goto yyabortlab #define YYERROR goto yyerrorlab /* Like YYERROR except do call yyerror. This remains here temporarily to ease the transition to the new meaning of YYERROR, for GCC. Once GCC version 2 has supplanted version 1, this can go. However, YYFAIL appears to be in use. Nevertheless, it is formally deprecated in Bison 2.4.2's NEWS entry, where a plan to phase it out is discussed. */ #define YYFAIL goto yyerrlab #if defined YYFAIL /* This is here to suppress warnings from the GCC cpp's -Wunused-macros. Normally we don't worry about that warning, but some users do, and we want to make it easy for users to remove YYFAIL uses, which will produce warnings from Bison 2.5. */ #endif #define YYRECOVERING() (!!yyerrstatus) #define YYBACKUP(Token, Value) \ do \ if (yychar == YYEMPTY && yylen == 1) \ { \ yychar = (Token); \ yylval = (Value); \ YYPOPSTACK (1); \ goto yybackup; \ } \ else \ { \ yyerror (YY_("syntax error: cannot back up")); \ YYERROR; \ } \ while (YYID (0)) #define YYTERROR 1 #define YYERRCODE 256 /* YYLLOC_DEFAULT -- Set CURRENT to span from RHS[1] to RHS[N]. If N is 0, then set CURRENT to the empty location which ends the previous symbol: RHS[0] (always defined). */ #define YYRHSLOC(Rhs, K) ((Rhs)[K]) #ifndef YYLLOC_DEFAULT # define YYLLOC_DEFAULT(Current, Rhs, N) \ do \ if (YYID (N)) \ { \ (Current).first_line = YYRHSLOC (Rhs, 1).first_line; \ (Current).first_column = YYRHSLOC (Rhs, 1).first_column; \ (Current).last_line = YYRHSLOC (Rhs, N).last_line; \ (Current).last_column = YYRHSLOC (Rhs, N).last_column; \ } \ else \ { \ (Current).first_line = (Current).last_line = \ YYRHSLOC (Rhs, 0).last_line; \ (Current).first_column = (Current).last_column = \ YYRHSLOC (Rhs, 0).last_column; \ } \ while (YYID (0)) #endif /* This macro is provided for backward compatibility. */ #ifndef YY_LOCATION_PRINT # define YY_LOCATION_PRINT(File, Loc) ((void) 0) #endif /* YYLEX -- calling `yylex' with the right arguments. */ #ifdef YYLEX_PARAM # define YYLEX yylex (YYLEX_PARAM) #else # define YYLEX yylex () #endif /* Enable debugging if requested. */ #if YYDEBUG # ifndef YYFPRINTF # include /* INFRINGES ON USER NAME SPACE */ # define YYFPRINTF fprintf # endif # define YYDPRINTF(Args) \ do { \ if (yydebug) \ YYFPRINTF Args; \ } while (YYID (0)) # define YY_SYMBOL_PRINT(Title, Type, Value, Location) \ do { \ if (yydebug) \ { \ YYFPRINTF (stderr, "%s ", Title); \ yy_symbol_print (stderr, \ Type, Value); \ YYFPRINTF (stderr, "\n"); \ } \ } while (YYID (0)) /*--------------------------------. | Print this symbol on YYOUTPUT. | `--------------------------------*/ /*ARGSUSED*/ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static void yy_symbol_value_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep) #else static void yy_symbol_value_print (yyoutput, yytype, yyvaluep) FILE *yyoutput; int yytype; YYSTYPE const * const yyvaluep; #endif { if (!yyvaluep) return; # ifdef YYPRINT if (yytype < YYNTOKENS) YYPRINT (yyoutput, yytoknum[yytype], *yyvaluep); # else YYUSE (yyoutput); # endif switch (yytype) { default: break; } } /*--------------------------------. | Print this symbol on YYOUTPUT. | `--------------------------------*/ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static void yy_symbol_print (FILE *yyoutput, int yytype, YYSTYPE const * const yyvaluep) #else static void yy_symbol_print (yyoutput, yytype, yyvaluep) FILE *yyoutput; int yytype; YYSTYPE const * const yyvaluep; #endif { if (yytype < YYNTOKENS) YYFPRINTF (yyoutput, "token %s (", yytname[yytype]); else YYFPRINTF (yyoutput, "nterm %s (", yytname[yytype]); yy_symbol_value_print (yyoutput, yytype, yyvaluep); YYFPRINTF (yyoutput, ")"); } /*------------------------------------------------------------------. | yy_stack_print -- Print the state stack from its BOTTOM up to its | | TOP (included). | `------------------------------------------------------------------*/ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static void yy_stack_print (yytype_int16 *yybottom, yytype_int16 *yytop) #else static void yy_stack_print (yybottom, yytop) yytype_int16 *yybottom; yytype_int16 *yytop; #endif { YYFPRINTF (stderr, "Stack now"); for (; yybottom <= yytop; yybottom++) { int yybot = *yybottom; YYFPRINTF (stderr, " %d", yybot); } YYFPRINTF (stderr, "\n"); } # define YY_STACK_PRINT(Bottom, Top) \ do { \ if (yydebug) \ yy_stack_print ((Bottom), (Top)); \ } while (YYID (0)) /*------------------------------------------------. | Report that the YYRULE is going to be reduced. | `------------------------------------------------*/ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static void yy_reduce_print (YYSTYPE *yyvsp, int yyrule) #else static void yy_reduce_print (yyvsp, yyrule) YYSTYPE *yyvsp; int yyrule; #endif { int yynrhs = yyr2[yyrule]; int yyi; unsigned long int yylno = yyrline[yyrule]; YYFPRINTF (stderr, "Reducing stack by rule %d (line %lu):\n", yyrule - 1, yylno); /* The symbols being reduced. */ for (yyi = 0; yyi < yynrhs; yyi++) { YYFPRINTF (stderr, " $%d = ", yyi + 1); yy_symbol_print (stderr, yyrhs[yyprhs[yyrule] + yyi], &(yyvsp[(yyi + 1) - (yynrhs)]) ); YYFPRINTF (stderr, "\n"); } } # define YY_REDUCE_PRINT(Rule) \ do { \ if (yydebug) \ yy_reduce_print (yyvsp, Rule); \ } while (YYID (0)) /* Nonzero means print parse trace. It is left uninitialized so that multiple parsers can coexist. */ int yydebug; #else /* !YYDEBUG */ # define YYDPRINTF(Args) # define YY_SYMBOL_PRINT(Title, Type, Value, Location) # define YY_STACK_PRINT(Bottom, Top) # define YY_REDUCE_PRINT(Rule) #endif /* !YYDEBUG */ /* YYINITDEPTH -- initial size of the parser's stacks. */ #ifndef YYINITDEPTH # define YYINITDEPTH 200 #endif /* YYMAXDEPTH -- maximum size the stacks can grow to (effective only if the built-in stack extension method is used). Do not make this value too large; the results are undefined if YYSTACK_ALLOC_MAXIMUM < YYSTACK_BYTES (YYMAXDEPTH) evaluated with infinite-precision integer arithmetic. */ #ifndef YYMAXDEPTH # define YYMAXDEPTH 10000 #endif #if YYERROR_VERBOSE # ifndef yystrlen # if defined __GLIBC__ && defined _STRING_H # define yystrlen strlen # else /* Return the length of YYSTR. */ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static YYSIZE_T yystrlen (const char *yystr) #else static YYSIZE_T yystrlen (yystr) const char *yystr; #endif { YYSIZE_T yylen; for (yylen = 0; yystr[yylen]; yylen++) continue; return yylen; } # endif # endif # ifndef yystpcpy # if defined __GLIBC__ && defined _STRING_H && defined _GNU_SOURCE # define yystpcpy stpcpy # else /* Copy YYSRC to YYDEST, returning the address of the terminating '\0' in YYDEST. */ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static char * yystpcpy (char *yydest, const char *yysrc) #else static char * yystpcpy (yydest, yysrc) char *yydest; const char *yysrc; #endif { char *yyd = yydest; const char *yys = yysrc; while ((*yyd++ = *yys++) != '\0') continue; return yyd - 1; } # endif # endif # ifndef yytnamerr /* Copy to YYRES the contents of YYSTR after stripping away unnecessary quotes and backslashes, so that it's suitable for yyerror. The heuristic is that double-quoting is unnecessary unless the string contains an apostrophe, a comma, or backslash (other than backslash-backslash). YYSTR is taken from yytname. If YYRES is null, do not copy; instead, return the length of what the result would have been. */ static YYSIZE_T yytnamerr (char *yyres, const char *yystr) { if (*yystr == '"') { YYSIZE_T yyn = 0; char const *yyp = yystr; for (;;) switch (*++yyp) { case '\'': case ',': goto do_not_strip_quotes; case '\\': if (*++yyp != '\\') goto do_not_strip_quotes; /* Fall through. */ default: if (yyres) yyres[yyn] = *yyp; yyn++; break; case '"': if (yyres) yyres[yyn] = '\0'; return yyn; } do_not_strip_quotes: ; } if (! yyres) return yystrlen (yystr); return yystpcpy (yyres, yystr) - yyres; } # endif /* Copy into *YYMSG, which is of size *YYMSG_ALLOC, an error message about the unexpected token YYTOKEN for the state stack whose top is YYSSP. Return 0 if *YYMSG was successfully written. Return 1 if *YYMSG is not large enough to hold the message. In that case, also set *YYMSG_ALLOC to the required number of bytes. Return 2 if the required number of bytes is too large to store. */ static int yysyntax_error (YYSIZE_T *yymsg_alloc, char **yymsg, yytype_int16 *yyssp, int yytoken) { YYSIZE_T yysize0 = yytnamerr (0, yytname[yytoken]); YYSIZE_T yysize = yysize0; YYSIZE_T yysize1; enum { YYERROR_VERBOSE_ARGS_MAXIMUM = 5 }; /* Internationalized format string. */ const char *yyformat = 0; /* Arguments of yyformat. */ char const *yyarg[YYERROR_VERBOSE_ARGS_MAXIMUM]; /* Number of reported tokens (one for the "unexpected", one per "expected"). */ int yycount = 0; /* There are many possibilities here to consider: - Assume YYFAIL is not used. It's too flawed to consider. See for details. YYERROR is fine as it does not invoke this function. - If this state is a consistent state with a default action, then the only way this function was invoked is if the default action is an error action. In that case, don't check for expected tokens because there are none. - The only way there can be no lookahead present (in yychar) is if this state is a consistent state with a default action. Thus, detecting the absence of a lookahead is sufficient to determine that there is no unexpected or expected token to report. In that case, just report a simple "syntax error". - Don't assume there isn't a lookahead just because this state is a consistent state with a default action. There might have been a previous inconsistent state, consistent state with a non-default action, or user semantic action that manipulated yychar. - Of course, the expected token list depends on states to have correct lookahead information, and it depends on the parser not to perform extra reductions after fetching a lookahead from the scanner and before detecting a syntax error. Thus, state merging (from LALR or IELR) and default reductions corrupt the expected token list. However, the list is correct for canonical LR with one exception: it will still contain any token that will not be accepted due to an error action in a later state. */ if (yytoken != YYEMPTY) { int yyn = yypact[*yyssp]; yyarg[yycount++] = yytname[yytoken]; if (!yypact_value_is_default (yyn)) { /* Start YYX at -YYN if negative to avoid negative indexes in YYCHECK. In other words, skip the first -YYN actions for this state because they are default actions. */ int yyxbegin = yyn < 0 ? -yyn : 0; /* Stay within bounds of both yycheck and yytname. */ int yychecklim = YYLAST - yyn + 1; int yyxend = yychecklim < YYNTOKENS ? yychecklim : YYNTOKENS; int yyx; for (yyx = yyxbegin; yyx < yyxend; ++yyx) if (yycheck[yyx + yyn] == yyx && yyx != YYTERROR && !yytable_value_is_error (yytable[yyx + yyn])) { if (yycount == YYERROR_VERBOSE_ARGS_MAXIMUM) { yycount = 1; yysize = yysize0; break; } yyarg[yycount++] = yytname[yyx]; yysize1 = yysize + yytnamerr (0, yytname[yyx]); if (! (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM)) return 2; yysize = yysize1; } } } switch (yycount) { # define YYCASE_(N, S) \ case N: \ yyformat = S; \ break YYCASE_(0, YY_("syntax error")); YYCASE_(1, YY_("syntax error, unexpected %s")); YYCASE_(2, YY_("syntax error, unexpected %s, expecting %s")); YYCASE_(3, YY_("syntax error, unexpected %s, expecting %s or %s")); YYCASE_(4, YY_("syntax error, unexpected %s, expecting %s or %s or %s")); YYCASE_(5, YY_("syntax error, unexpected %s, expecting %s or %s or %s or %s")); # undef YYCASE_ } yysize1 = yysize + yystrlen (yyformat); if (! (yysize <= yysize1 && yysize1 <= YYSTACK_ALLOC_MAXIMUM)) return 2; yysize = yysize1; if (*yymsg_alloc < yysize) { *yymsg_alloc = 2 * yysize; if (! (yysize <= *yymsg_alloc && *yymsg_alloc <= YYSTACK_ALLOC_MAXIMUM)) *yymsg_alloc = YYSTACK_ALLOC_MAXIMUM; return 1; } /* Avoid sprintf, as that infringes on the user's name space. Don't have undefined behavior even if the translation produced a string with the wrong number of "%s"s. */ { char *yyp = *yymsg; int yyi = 0; while ((*yyp = *yyformat) != '\0') if (*yyp == '%' && yyformat[1] == 's' && yyi < yycount) { yyp += yytnamerr (yyp, yyarg[yyi++]); yyformat += 2; } else { yyp++; yyformat++; } } return 0; } #endif /* YYERROR_VERBOSE */ /*-----------------------------------------------. | Release the memory associated to this symbol. | `-----------------------------------------------*/ /*ARGSUSED*/ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) static void yydestruct (const char *yymsg, int yytype, YYSTYPE *yyvaluep) #else static void yydestruct (yymsg, yytype, yyvaluep) const char *yymsg; int yytype; YYSTYPE *yyvaluep; #endif { YYUSE (yyvaluep); if (!yymsg) yymsg = "Deleting"; YY_SYMBOL_PRINT (yymsg, yytype, yyvaluep, yylocationp); switch (yytype) { default: break; } } /* Prevent warnings from -Wmissing-prototypes. */ #ifdef YYPARSE_PARAM #if defined __STDC__ || defined __cplusplus int yyparse (void *YYPARSE_PARAM); #else int yyparse (); #endif #else /* ! YYPARSE_PARAM */ #if defined __STDC__ || defined __cplusplus int yyparse (void); #else int yyparse (); #endif #endif /* ! YYPARSE_PARAM */ /* The lookahead symbol. */ int yychar; /* The semantic value of the lookahead symbol. */ YYSTYPE yylval; /* Number of syntax errors so far. */ int yynerrs; /*----------. | yyparse. | `----------*/ #ifdef YYPARSE_PARAM #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) int yyparse (void *YYPARSE_PARAM) #else int yyparse (YYPARSE_PARAM) void *YYPARSE_PARAM; #endif #else /* ! YYPARSE_PARAM */ #if (defined __STDC__ || defined __C99__FUNC__ \ || defined __cplusplus || defined _MSC_VER) int yyparse (void) #else int yyparse () #endif #endif { int yystate; /* Number of tokens to shift before error messages enabled. */ int yyerrstatus; /* The stacks and their tools: `yyss': related to states. `yyvs': related to semantic values. Refer to the stacks thru separate pointers, to allow yyoverflow to reallocate them elsewhere. */ /* The state stack. */ yytype_int16 yyssa[YYINITDEPTH]; yytype_int16 *yyss; yytype_int16 *yyssp; /* The semantic value stack. */ YYSTYPE yyvsa[YYINITDEPTH]; YYSTYPE *yyvs; YYSTYPE *yyvsp; YYSIZE_T yystacksize; int yyn; int yyresult; /* Lookahead token as an internal (translated) token number. */ int yytoken; /* The variables used to return semantic value and location from the action routines. */ YYSTYPE yyval; #if YYERROR_VERBOSE /* Buffer for error messages, and its allocated size. */ char yymsgbuf[128]; char *yymsg = yymsgbuf; YYSIZE_T yymsg_alloc = sizeof yymsgbuf; #endif #define YYPOPSTACK(N) (yyvsp -= (N), yyssp -= (N)) /* The number of symbols on the RHS of the reduced rule. Keep to zero when no symbol should be popped. */ int yylen = 0; yytoken = 0; yyss = yyssa; yyvs = yyvsa; yystacksize = YYINITDEPTH; YYDPRINTF ((stderr, "Starting parse\n")); yystate = 0; yyerrstatus = 0; yynerrs = 0; yychar = YYEMPTY; /* Cause a token to be read. */ /* Initialize stack pointers. Waste one element of value and location stack so that they stay on the same level as the state stack. The wasted elements are never initialized. */ yyssp = yyss; yyvsp = yyvs; goto yysetstate; /*------------------------------------------------------------. | yynewstate -- Push a new state, which is found in yystate. | `------------------------------------------------------------*/ yynewstate: /* In all cases, when you get here, the value and location stacks have just been pushed. So pushing a state here evens the stacks. */ yyssp++; yysetstate: *yyssp = yystate; if (yyss + yystacksize - 1 <= yyssp) { /* Get the current used size of the three stacks, in elements. */ YYSIZE_T yysize = yyssp - yyss + 1; #ifdef yyoverflow { /* Give user a chance to reallocate the stack. Use copies of these so that the &'s don't force the real ones into memory. */ YYSTYPE *yyvs1 = yyvs; yytype_int16 *yyss1 = yyss; /* Each stack pointer address is followed by the size of the data in use in that stack, in bytes. This used to be a conditional around just the two extra args, but that might be undefined if yyoverflow is a macro. */ yyoverflow (YY_("memory exhausted"), &yyss1, yysize * sizeof (*yyssp), &yyvs1, yysize * sizeof (*yyvsp), &yystacksize); yyss = yyss1; yyvs = yyvs1; } #else /* no yyoverflow */ # ifndef YYSTACK_RELOCATE goto yyexhaustedlab; # else /* Extend the stack our own way. */ if (YYMAXDEPTH <= yystacksize) goto yyexhaustedlab; yystacksize *= 2; if (YYMAXDEPTH < yystacksize) yystacksize = YYMAXDEPTH; { yytype_int16 *yyss1 = yyss; union yyalloc *yyptr = (union yyalloc *) YYSTACK_ALLOC (YYSTACK_BYTES (yystacksize)); if (! yyptr) goto yyexhaustedlab; YYSTACK_RELOCATE (yyss_alloc, yyss); YYSTACK_RELOCATE (yyvs_alloc, yyvs); # undef YYSTACK_RELOCATE if (yyss1 != yyssa) YYSTACK_FREE (yyss1); } # endif #endif /* no yyoverflow */ yyssp = yyss + yysize - 1; yyvsp = yyvs + yysize - 1; YYDPRINTF ((stderr, "Stack size increased to %lu\n", (unsigned long int) yystacksize)); if (yyss + yystacksize - 1 <= yyssp) YYABORT; } YYDPRINTF ((stderr, "Entering state %d\n", yystate)); if (yystate == YYFINAL) YYACCEPT; goto yybackup; /*-----------. | yybackup. | `-----------*/ yybackup: /* Do appropriate processing given the current state. Read a lookahead token if we need one and don't already have one. */ /* First try to decide what to do without reference to lookahead token. */ yyn = yypact[yystate]; if (yypact_value_is_default (yyn)) goto yydefault; /* Not known => get a lookahead token if don't already have one. */ /* YYCHAR is either YYEMPTY or YYEOF or a valid lookahead symbol. */ if (yychar == YYEMPTY) { YYDPRINTF ((stderr, "Reading a token: ")); yychar = YYLEX; } if (yychar <= YYEOF) { yychar = yytoken = YYEOF; YYDPRINTF ((stderr, "Now at end of input.\n")); } else { yytoken = YYTRANSLATE (yychar); YY_SYMBOL_PRINT ("Next token is", yytoken, &yylval, &yylloc); } /* If the proper action on seeing token YYTOKEN is to reduce or to detect an error, take that action. */ yyn += yytoken; if (yyn < 0 || YYLAST < yyn || yycheck[yyn] != yytoken) goto yydefault; yyn = yytable[yyn]; if (yyn <= 0) { if (yytable_value_is_error (yyn)) goto yyerrlab; yyn = -yyn; goto yyreduce; } /* Count tokens shifted since error; after three, turn off error status. */ if (yyerrstatus) yyerrstatus--; /* Shift the lookahead token. */ YY_SYMBOL_PRINT ("Shifting", yytoken, &yylval, &yylloc); /* Discard the shifted token. */ yychar = YYEMPTY; yystate = yyn; *++yyvsp = yylval; goto yynewstate; /*-----------------------------------------------------------. | yydefault -- do the default action for the current state. | `-----------------------------------------------------------*/ yydefault: yyn = yydefact[yystate]; if (yyn == 0) goto yyerrlab; goto yyreduce; /*-----------------------------. | yyreduce -- Do a reduction. | `-----------------------------*/ yyreduce: /* yyn is the number of a rule to reduce with. */ yylen = yyr2[yyn]; /* If YYLEN is nonzero, implement the default value of the action: `$$ = $1'. Otherwise, the following line sets YYVAL to garbage. This behavior is undocumented and Bison users should not rely upon it. Assigning to YYVAL unconditionally makes the parser a bit smaller, and it avoids a GCC warning that YYVAL may be used uninitialized. */ yyval = yyvsp[1-yylen]; YY_REDUCE_PRINT (yyn); switch (yyn) { case 6: /* Line 1806 of yacc.c */ #line 97 "zparser.y" {} break; case 7: /* Line 1806 of yacc.c */ #line 99 "zparser.y" { parser->error_occurred = 0; } break; case 8: /* Line 1806 of yacc.c */ #line 103 "zparser.y" { parser->error_occurred = 0; } break; case 9: /* Line 1806 of yacc.c */ #line 107 "zparser.y" { /* rr should be fully parsed */ if (!parser->error_occurred) { parser->current_rr.rdatas = (rdata_atom_type *) region_alloc_init( parser->region, parser->current_rr.rdatas, (parser->current_rr.rdata_count * sizeof(rdata_atom_type))); process_rr(); } region_free_all(parser->rr_region); parser->current_rr.type = 0; parser->current_rr.rdata_count = 0; parser->current_rr.rdatas = parser->temporary_rdatas; parser->error_occurred = 0; } break; case 15: /* Line 1806 of yacc.c */ #line 139 "zparser.y" { parser->default_ttl = zparser_ttl2int((yyvsp[(3) - (4)].data).str, &(parser->error_occurred)); if (parser->error_occurred == 1) { parser->default_ttl = DEFAULT_TTL; parser->error_occurred = 0; } } break; case 16: /* Line 1806 of yacc.c */ #line 149 "zparser.y" { parser->origin = (yyvsp[(3) - (4)].domain); } break; case 17: /* Line 1806 of yacc.c */ #line 153 "zparser.y" { zc_error_prev_line("$ORIGIN directive requires absolute domain name"); } break; case 18: /* Line 1806 of yacc.c */ #line 159 "zparser.y" { parser->current_rr.owner = (yyvsp[(1) - (3)].domain); parser->current_rr.type = (yyvsp[(3) - (3)].type); } break; case 19: /* Line 1806 of yacc.c */ #line 166 "zparser.y" { parser->prev_dname = (yyvsp[(1) - (2)].domain); (yyval.domain) = (yyvsp[(1) - (2)].domain); } break; case 20: /* Line 1806 of yacc.c */ #line 171 "zparser.y" { (yyval.domain) = parser->prev_dname; } break; case 21: /* Line 1806 of yacc.c */ #line 177 "zparser.y" { parser->current_rr.ttl = parser->default_ttl; parser->current_rr.klass = parser->default_class; } break; case 22: /* Line 1806 of yacc.c */ #line 182 "zparser.y" { parser->current_rr.ttl = parser->default_ttl; parser->current_rr.klass = (yyvsp[(1) - (2)].klass); } break; case 23: /* Line 1806 of yacc.c */ #line 187 "zparser.y" { parser->current_rr.ttl = (yyvsp[(1) - (2)].ttl); parser->current_rr.klass = parser->default_class; } break; case 24: /* Line 1806 of yacc.c */ #line 192 "zparser.y" { parser->current_rr.ttl = (yyvsp[(1) - (4)].ttl); parser->current_rr.klass = (yyvsp[(3) - (4)].klass); } break; case 25: /* Line 1806 of yacc.c */ #line 197 "zparser.y" { parser->current_rr.ttl = (yyvsp[(3) - (4)].ttl); parser->current_rr.klass = (yyvsp[(1) - (4)].klass); } break; case 27: /* Line 1806 of yacc.c */ #line 205 "zparser.y" { if ((yyvsp[(1) - (1)].dname) == error_dname) { (yyval.domain) = error_domain; } else if ((yyvsp[(1) - (1)].dname)->name_size + domain_dname(parser->origin)->name_size - 1 > MAXDOMAINLEN) { zc_error("domain name exceeds %d character limit", MAXDOMAINLEN); (yyval.domain) = error_domain; } else { (yyval.domain) = domain_table_insert( parser->db->domains, dname_concatenate( parser->rr_region, (yyvsp[(1) - (1)].dname), domain_dname(parser->origin))); } } break; case 28: /* Line 1806 of yacc.c */ #line 223 "zparser.y" { (yyval.domain) = parser->db->domains->root; } break; case 29: /* Line 1806 of yacc.c */ #line 227 "zparser.y" { (yyval.domain) = parser->origin; } break; case 30: /* Line 1806 of yacc.c */ #line 231 "zparser.y" { if ((yyvsp[(1) - (2)].dname) != error_dname) { (yyval.domain) = domain_table_insert(parser->db->domains, (yyvsp[(1) - (2)].dname)); } else { (yyval.domain) = error_domain; } } break; case 31: /* Line 1806 of yacc.c */ #line 241 "zparser.y" { if ((yyvsp[(1) - (1)].data).len > MAXLABELLEN) { zc_error("label exceeds %d character limit", MAXLABELLEN); (yyval.dname) = error_dname; } else if ((yyvsp[(1) - (1)].data).len <= 0) { zc_error("zero label length"); (yyval.dname) = error_dname; } else { (yyval.dname) = dname_make_from_label(parser->rr_region, (uint8_t *) (yyvsp[(1) - (1)].data).str, (yyvsp[(1) - (1)].data).len); } } break; case 32: /* Line 1806 of yacc.c */ #line 255 "zparser.y" { zc_error("bitlabels are now deprecated. RFC2673 is obsoleted."); (yyval.dname) = error_dname; } break; case 34: /* Line 1806 of yacc.c */ #line 263 "zparser.y" { if ((yyvsp[(1) - (3)].dname) == error_dname || (yyvsp[(3) - (3)].dname) == error_dname) { (yyval.dname) = error_dname; } else if ((yyvsp[(1) - (3)].dname)->name_size + (yyvsp[(3) - (3)].dname)->name_size - 1 > MAXDOMAINLEN) { zc_error("domain name exceeds %d character limit", MAXDOMAINLEN); (yyval.dname) = error_dname; } else { (yyval.dname) = dname_concatenate(parser->rr_region, (yyvsp[(1) - (3)].dname), (yyvsp[(3) - (3)].dname)); } } break; case 37: /* Line 1806 of yacc.c */ #line 285 "zparser.y" { char *result = (char *) region_alloc(parser->rr_region, 2); result[0] = 0; result[1] = '\0'; (yyval.data).str = result; (yyval.data).len = 1; } break; case 38: /* Line 1806 of yacc.c */ #line 293 "zparser.y" { char *result = (char *) region_alloc(parser->rr_region, (yyvsp[(1) - (2)].data).len + 2); memcpy(result, (yyvsp[(1) - (2)].data).str, (yyvsp[(1) - (2)].data).len); result[(yyvsp[(1) - (2)].data).len] = 0; result[(yyvsp[(1) - (2)].data).len+1] = '\0'; (yyval.data).str = result; (yyval.data).len = (yyvsp[(1) - (2)].data).len + 1; } break; case 39: /* Line 1806 of yacc.c */ #line 305 "zparser.y" { char *result = (char *) region_alloc(parser->rr_region, (yyvsp[(1) - (1)].data).len + 1); if ((yyvsp[(1) - (1)].data).len > MAXLABELLEN) zc_error("label exceeds %d character limit", MAXLABELLEN); /* make label anyway */ result[0] = (yyvsp[(1) - (1)].data).len; memcpy(result+1, (yyvsp[(1) - (1)].data).str, (yyvsp[(1) - (1)].data).len); (yyval.data).str = result; (yyval.data).len = (yyvsp[(1) - (1)].data).len + 1; } break; case 41: /* Line 1806 of yacc.c */ #line 323 "zparser.y" { if ((yyvsp[(1) - (3)].data).len + (yyvsp[(3) - (3)].data).len - 3 > MAXDOMAINLEN) zc_error("domain name exceeds %d character limit", MAXDOMAINLEN); /* make dname anyway */ (yyval.data).len = (yyvsp[(1) - (3)].data).len + (yyvsp[(3) - (3)].data).len; (yyval.data).str = (char *) region_alloc(parser->rr_region, (yyval.data).len + 1); memcpy((yyval.data).str, (yyvsp[(1) - (3)].data).str, (yyvsp[(1) - (3)].data).len); memcpy((yyval.data).str + (yyvsp[(1) - (3)].data).len, (yyvsp[(3) - (3)].data).str, (yyvsp[(3) - (3)].data).len); (yyval.data).str[(yyval.data).len] = '\0'; } break; case 42: /* Line 1806 of yacc.c */ #line 340 "zparser.y" { zadd_rdata_txt_wireformat(zparser_conv_text(parser->rr_region, (yyvsp[(1) - (1)].data).str, (yyvsp[(1) - (1)].data).len), 1); } break; case 43: /* Line 1806 of yacc.c */ #line 344 "zparser.y" { zadd_rdata_txt_wireformat(zparser_conv_text(parser->rr_region, (yyvsp[(3) - (3)].data).str, (yyvsp[(3) - (3)].data).len), 0); } break; case 45: /* Line 1806 of yacc.c */ #line 355 "zparser.y" { (yyval.data).len = 1; (yyval.data).str = region_strdup(parser->rr_region, "."); } break; case 46: /* Line 1806 of yacc.c */ #line 360 "zparser.y" { (yyval.data).len = (yyvsp[(1) - (3)].data).len + (yyvsp[(3) - (3)].data).len + 1; (yyval.data).str = (char *) region_alloc(parser->rr_region, (yyval.data).len + 1); memcpy((yyval.data).str, (yyvsp[(1) - (3)].data).str, (yyvsp[(1) - (3)].data).len); memcpy((yyval.data).str + (yyvsp[(1) - (3)].data).len, " ", 1); memcpy((yyval.data).str + (yyvsp[(1) - (3)].data).len + 1, (yyvsp[(3) - (3)].data).str, (yyvsp[(3) - (3)].data).len); (yyval.data).str[(yyval.data).len] = '\0'; } break; case 47: /* Line 1806 of yacc.c */ #line 369 "zparser.y" { (yyval.data).len = (yyvsp[(1) - (3)].data).len + (yyvsp[(3) - (3)].data).len + 1; (yyval.data).str = (char *) region_alloc(parser->rr_region, (yyval.data).len + 1); memcpy((yyval.data).str, (yyvsp[(1) - (3)].data).str, (yyvsp[(1) - (3)].data).len); memcpy((yyval.data).str + (yyvsp[(1) - (3)].data).len, ".", 1); memcpy((yyval.data).str + (yyvsp[(1) - (3)].data).len + 1, (yyvsp[(3) - (3)].data).str, (yyvsp[(3) - (3)].data).len); (yyval.data).str[(yyval.data).len] = '\0'; } break; case 48: /* Line 1806 of yacc.c */ #line 381 "zparser.y" { uint16_t type = rrtype_from_string((yyvsp[(1) - (1)].data).str); if (type != 0 && type < 128) { set_bit(nxtbits, type); } else { zc_error("bad type %d in NXT record", (int) type); } } break; case 49: /* Line 1806 of yacc.c */ #line 390 "zparser.y" { uint16_t type = rrtype_from_string((yyvsp[(3) - (3)].data).str); if (type != 0 && type < 128) { set_bit(nxtbits, type); } else { zc_error("bad type %d in NXT record", (int) type); } } break; case 50: /* Line 1806 of yacc.c */ #line 401 "zparser.y" { } break; case 51: /* Line 1806 of yacc.c */ #line 404 "zparser.y" { } break; case 52: /* Line 1806 of yacc.c */ #line 407 "zparser.y" { uint16_t type = rrtype_from_string((yyvsp[(1) - (2)].data).str); if (type != 0) { if (type > nsec_highest_rcode) { nsec_highest_rcode = type; } set_bitnsec(nsecbits, type); } else { zc_error("bad type %d in NSEC record", (int) type); } } break; case 56: /* Line 1806 of yacc.c */ #line 430 "zparser.y" { char *result = (char *) region_alloc(parser->rr_region, (yyvsp[(1) - (3)].data).len + (yyvsp[(3) - (3)].data).len + 1); memcpy(result, (yyvsp[(1) - (3)].data).str, (yyvsp[(1) - (3)].data).len); memcpy(result + (yyvsp[(1) - (3)].data).len, (yyvsp[(3) - (3)].data).str, (yyvsp[(3) - (3)].data).len); (yyval.data).str = result; (yyval.data).len = (yyvsp[(1) - (3)].data).len + (yyvsp[(3) - (3)].data).len; (yyval.data).str[(yyval.data).len] = '\0'; } break; case 58: /* Line 1806 of yacc.c */ #line 447 "zparser.y" { char *result = (char *) region_alloc(parser->rr_region, (yyvsp[(1) - (3)].data).len + (yyvsp[(3) - (3)].data).len + 1); memcpy(result, (yyvsp[(1) - (3)].data).str, (yyvsp[(1) - (3)].data).len); memcpy(result + (yyvsp[(1) - (3)].data).len, (yyvsp[(3) - (3)].data).str, (yyvsp[(3) - (3)].data).len); (yyval.data).str = result; (yyval.data).len = (yyvsp[(1) - (3)].data).len + (yyvsp[(3) - (3)].data).len; (yyval.data).str[(yyval.data).len] = '\0'; } break; case 60: /* Line 1806 of yacc.c */ #line 463 "zparser.y" { (yyval.data).str = "."; (yyval.data).len = 1; } break; case 61: /* Line 1806 of yacc.c */ #line 468 "zparser.y" { char *result = (char *) region_alloc(parser->rr_region, (yyvsp[(1) - (2)].data).len + 2); memcpy(result, (yyvsp[(1) - (2)].data).str, (yyvsp[(1) - (2)].data).len); result[(yyvsp[(1) - (2)].data).len] = '.'; (yyval.data).str = result; (yyval.data).len = (yyvsp[(1) - (2)].data).len + 1; (yyval.data).str[(yyval.data).len] = '\0'; } break; case 62: /* Line 1806 of yacc.c */ #line 478 "zparser.y" { char *result = (char *) region_alloc(parser->rr_region, (yyvsp[(1) - (3)].data).len + (yyvsp[(3) - (3)].data).len + 2); memcpy(result, (yyvsp[(1) - (3)].data).str, (yyvsp[(1) - (3)].data).len); result[(yyvsp[(1) - (3)].data).len] = '.'; memcpy(result + (yyvsp[(1) - (3)].data).len + 1, (yyvsp[(3) - (3)].data).str, (yyvsp[(3) - (3)].data).len); (yyval.data).str = result; (yyval.data).len = (yyvsp[(1) - (3)].data).len + (yyvsp[(3) - (3)].data).len + 1; (yyval.data).str[(yyval.data).len] = '\0'; } break; case 64: /* Line 1806 of yacc.c */ #line 496 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 66: /* Line 1806 of yacc.c */ #line 498 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 67: /* Line 1806 of yacc.c */ #line 499 "zparser.y" { zc_warning_prev_line("MD is obsolete"); } break; case 68: /* Line 1806 of yacc.c */ #line 501 "zparser.y" { zc_warning_prev_line("MD is obsolete"); (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 69: /* Line 1806 of yacc.c */ #line 505 "zparser.y" { zc_warning_prev_line("MF is obsolete"); } break; case 70: /* Line 1806 of yacc.c */ #line 507 "zparser.y" { zc_warning_prev_line("MF is obsolete"); (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 72: /* Line 1806 of yacc.c */ #line 513 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 74: /* Line 1806 of yacc.c */ #line 515 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 75: /* Line 1806 of yacc.c */ #line 516 "zparser.y" { zc_warning_prev_line("MB is obsolete"); } break; case 76: /* Line 1806 of yacc.c */ #line 518 "zparser.y" { zc_warning_prev_line("MB is obsolete"); (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 78: /* Line 1806 of yacc.c */ #line 524 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 80: /* Line 1806 of yacc.c */ #line 526 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 82: /* Line 1806 of yacc.c */ #line 529 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 84: /* Line 1806 of yacc.c */ #line 531 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 86: /* Line 1806 of yacc.c */ #line 533 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 88: /* Line 1806 of yacc.c */ #line 535 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 90: /* Line 1806 of yacc.c */ #line 537 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 92: /* Line 1806 of yacc.c */ #line 539 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 94: /* Line 1806 of yacc.c */ #line 541 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 96: /* Line 1806 of yacc.c */ #line 543 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 98: /* Line 1806 of yacc.c */ #line 545 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 100: /* Line 1806 of yacc.c */ #line 547 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 102: /* Line 1806 of yacc.c */ #line 549 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 104: /* Line 1806 of yacc.c */ #line 551 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 106: /* Line 1806 of yacc.c */ #line 553 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 108: /* Line 1806 of yacc.c */ #line 555 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 110: /* Line 1806 of yacc.c */ #line 557 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 112: /* Line 1806 of yacc.c */ #line 559 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 114: /* Line 1806 of yacc.c */ #line 561 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 116: /* Line 1806 of yacc.c */ #line 563 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 118: /* Line 1806 of yacc.c */ #line 565 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 120: /* Line 1806 of yacc.c */ #line 567 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 122: /* Line 1806 of yacc.c */ #line 569 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 124: /* Line 1806 of yacc.c */ #line 571 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 126: /* Line 1806 of yacc.c */ #line 573 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 128: /* Line 1806 of yacc.c */ #line 575 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 130: /* Line 1806 of yacc.c */ #line 577 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 132: /* Line 1806 of yacc.c */ #line 579 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 135: /* Line 1806 of yacc.c */ #line 582 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 137: /* Line 1806 of yacc.c */ #line 584 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 138: /* Line 1806 of yacc.c */ #line 585 "zparser.y" { if (dlv_warn) { dlv_warn = 0; zc_warning_prev_line("DLV is experimental"); } } break; case 139: /* Line 1806 of yacc.c */ #line 586 "zparser.y" { if (dlv_warn) { dlv_warn = 0; zc_warning_prev_line("DLV is experimental"); } (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 141: /* Line 1806 of yacc.c */ #line 588 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 143: /* Line 1806 of yacc.c */ #line 590 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 145: /* Line 1806 of yacc.c */ #line 592 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 147: /* Line 1806 of yacc.c */ #line 594 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 149: /* Line 1806 of yacc.c */ #line 596 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 151: /* Line 1806 of yacc.c */ #line 598 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 153: /* Line 1806 of yacc.c */ #line 600 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 155: /* Line 1806 of yacc.c */ #line 602 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 157: /* Line 1806 of yacc.c */ #line 604 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 159: /* Line 1806 of yacc.c */ #line 606 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 161: /* Line 1806 of yacc.c */ #line 608 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 163: /* Line 1806 of yacc.c */ #line 610 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 165: /* Line 1806 of yacc.c */ #line 612 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 166: /* Line 1806 of yacc.c */ #line 613 "zparser.y" { (yyval.type) = (yyvsp[(1) - (3)].type); parse_unknown_rdata((yyvsp[(1) - (3)].type), (yyvsp[(3) - (3)].unknown)); } break; case 167: /* Line 1806 of yacc.c */ #line 615 "zparser.y" { zc_error_prev_line("unrecognized RR type '%s'", (yyvsp[(1) - (3)].data).str); } break; case 168: /* Line 1806 of yacc.c */ #line 627 "zparser.y" { zadd_rdata_wireformat(zparser_conv_a(parser->region, (yyvsp[(1) - (2)].data).str)); } break; case 169: /* Line 1806 of yacc.c */ #line 633 "zparser.y" { /* convert a single dname record */ zadd_rdata_domain((yyvsp[(1) - (2)].domain)); } break; case 170: /* Line 1806 of yacc.c */ #line 640 "zparser.y" { /* convert the soa data */ zadd_rdata_domain((yyvsp[(1) - (14)].domain)); /* prim. ns */ zadd_rdata_domain((yyvsp[(3) - (14)].domain)); /* email */ zadd_rdata_wireformat(zparser_conv_serial(parser->region, (yyvsp[(5) - (14)].data).str)); /* serial */ zadd_rdata_wireformat(zparser_conv_period(parser->region, (yyvsp[(7) - (14)].data).str)); /* refresh */ zadd_rdata_wireformat(zparser_conv_period(parser->region, (yyvsp[(9) - (14)].data).str)); /* retry */ zadd_rdata_wireformat(zparser_conv_period(parser->region, (yyvsp[(11) - (14)].data).str)); /* expire */ zadd_rdata_wireformat(zparser_conv_period(parser->region, (yyvsp[(13) - (14)].data).str)); /* minimum */ } break; case 171: /* Line 1806 of yacc.c */ #line 653 "zparser.y" { zadd_rdata_wireformat(zparser_conv_a(parser->region, (yyvsp[(1) - (6)].data).str)); /* address */ zadd_rdata_wireformat(zparser_conv_services(parser->region, (yyvsp[(3) - (6)].data).str, (yyvsp[(5) - (6)].data).str)); /* protocol and services */ } break; case 172: /* Line 1806 of yacc.c */ #line 660 "zparser.y" { zadd_rdata_wireformat(zparser_conv_text(parser->region, (yyvsp[(1) - (4)].data).str, (yyvsp[(1) - (4)].data).len)); /* CPU */ zadd_rdata_wireformat(zparser_conv_text(parser->region, (yyvsp[(3) - (4)].data).str, (yyvsp[(3) - (4)].data).len)); /* OS*/ } break; case 173: /* Line 1806 of yacc.c */ #line 667 "zparser.y" { /* convert a single dname record */ zadd_rdata_domain((yyvsp[(1) - (4)].domain)); zadd_rdata_domain((yyvsp[(3) - (4)].domain)); } break; case 174: /* Line 1806 of yacc.c */ #line 675 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (4)].data).str)); /* priority */ zadd_rdata_domain((yyvsp[(3) - (4)].domain)); /* MX host */ } break; case 175: /* Line 1806 of yacc.c */ #line 682 "zparser.y" { zadd_rdata_txt_clean_wireformat(); } break; case 176: /* Line 1806 of yacc.c */ #line 689 "zparser.y" { zadd_rdata_domain((yyvsp[(1) - (4)].domain)); /* mbox d-name */ zadd_rdata_domain((yyvsp[(3) - (4)].domain)); /* txt d-name */ } break; case 177: /* Line 1806 of yacc.c */ #line 697 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (4)].data).str)); /* subtype */ zadd_rdata_domain((yyvsp[(3) - (4)].domain)); /* domain name */ } break; case 178: /* Line 1806 of yacc.c */ #line 705 "zparser.y" { zadd_rdata_wireformat(zparser_conv_text(parser->region, (yyvsp[(1) - (2)].data).str, (yyvsp[(1) - (2)].data).len)); /* X.25 address. */ } break; case 179: /* Line 1806 of yacc.c */ #line 712 "zparser.y" { zadd_rdata_wireformat(zparser_conv_text(parser->region, (yyvsp[(1) - (2)].data).str, (yyvsp[(1) - (2)].data).len)); /* address */ } break; case 180: /* Line 1806 of yacc.c */ #line 716 "zparser.y" { zadd_rdata_wireformat(zparser_conv_text(parser->region, (yyvsp[(1) - (4)].data).str, (yyvsp[(1) - (4)].data).len)); /* address */ zadd_rdata_wireformat(zparser_conv_text(parser->region, (yyvsp[(3) - (4)].data).str, (yyvsp[(3) - (4)].data).len)); /* sub-address */ } break; case 181: /* Line 1806 of yacc.c */ #line 724 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (4)].data).str)); /* preference */ zadd_rdata_domain((yyvsp[(3) - (4)].domain)); /* intermediate host */ } break; case 182: /* Line 1806 of yacc.c */ #line 732 "zparser.y" { /* String must start with "0x" or "0X". */ if (strncasecmp((yyvsp[(1) - (2)].data).str, "0x", 2) != 0) { zc_error_prev_line("NSAP rdata must start with '0x'"); } else { zadd_rdata_wireformat(zparser_conv_hex(parser->region, (yyvsp[(1) - (2)].data).str + 2, (yyvsp[(1) - (2)].data).len - 2)); /* NSAP */ } } break; case 183: /* Line 1806 of yacc.c */ #line 744 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (6)].data).str)); /* preference */ zadd_rdata_domain((yyvsp[(3) - (6)].domain)); /* MAP822 */ zadd_rdata_domain((yyvsp[(5) - (6)].domain)); /* MAPX400 */ } break; case 184: /* Line 1806 of yacc.c */ #line 752 "zparser.y" { zadd_rdata_wireformat(zparser_conv_aaaa(parser->region, (yyvsp[(1) - (2)].data).str)); /* IPv6 address */ } break; case 185: /* Line 1806 of yacc.c */ #line 758 "zparser.y" { zadd_rdata_wireformat(zparser_conv_loc(parser->region, (yyvsp[(1) - (2)].data).str)); /* Location */ } break; case 186: /* Line 1806 of yacc.c */ #line 764 "zparser.y" { zadd_rdata_domain((yyvsp[(1) - (4)].domain)); /* nxt name */ zadd_rdata_wireformat(zparser_conv_nxt(parser->region, nxtbits)); /* nxt bitlist */ memset(nxtbits, 0, sizeof(nxtbits)); } break; case 187: /* Line 1806 of yacc.c */ #line 772 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (8)].data).str)); /* prio */ zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(3) - (8)].data).str)); /* weight */ zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(5) - (8)].data).str)); /* port */ zadd_rdata_domain((yyvsp[(7) - (8)].domain)); /* target name */ } break; case 188: /* Line 1806 of yacc.c */ #line 782 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (12)].data).str)); /* order */ zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(3) - (12)].data).str)); /* preference */ zadd_rdata_wireformat(zparser_conv_text(parser->region, (yyvsp[(5) - (12)].data).str, (yyvsp[(5) - (12)].data).len)); /* flags */ zadd_rdata_wireformat(zparser_conv_text(parser->region, (yyvsp[(7) - (12)].data).str, (yyvsp[(7) - (12)].data).len)); /* service */ zadd_rdata_wireformat(zparser_conv_text(parser->region, (yyvsp[(9) - (12)].data).str, (yyvsp[(9) - (12)].data).len)); /* regexp */ zadd_rdata_domain((yyvsp[(11) - (12)].domain)); /* target name */ } break; case 189: /* Line 1806 of yacc.c */ #line 794 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (4)].data).str)); /* preference */ zadd_rdata_domain((yyvsp[(3) - (4)].domain)); /* exchanger */ } break; case 190: /* Line 1806 of yacc.c */ #line 802 "zparser.y" { zadd_rdata_wireformat(zparser_conv_certificate_type(parser->region, (yyvsp[(1) - (8)].data).str)); /* type */ zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(3) - (8)].data).str)); /* key tag */ zadd_rdata_wireformat(zparser_conv_algorithm(parser->region, (yyvsp[(5) - (8)].data).str)); /* algorithm */ zadd_rdata_wireformat(zparser_conv_b64(parser->region, (yyvsp[(7) - (8)].data).str)); /* certificate or CRL */ } break; case 192: /* Line 1806 of yacc.c */ #line 815 "zparser.y" { zadd_rdata_wireformat(zparser_conv_apl_rdata(parser->region, (yyvsp[(1) - (1)].data).str)); } break; case 193: /* Line 1806 of yacc.c */ #line 819 "zparser.y" { zadd_rdata_wireformat(zparser_conv_apl_rdata(parser->region, (yyvsp[(3) - (3)].data).str)); } break; case 194: /* Line 1806 of yacc.c */ #line 825 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (8)].data).str)); /* keytag */ zadd_rdata_wireformat(zparser_conv_algorithm(parser->region, (yyvsp[(3) - (8)].data).str)); /* alg */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, (yyvsp[(5) - (8)].data).str)); /* type */ zadd_rdata_wireformat(zparser_conv_hex(parser->region, (yyvsp[(7) - (8)].data).str, (yyvsp[(7) - (8)].data).len)); /* hash */ } break; case 195: /* Line 1806 of yacc.c */ #line 834 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (8)].data).str)); /* keytag */ zadd_rdata_wireformat(zparser_conv_algorithm(parser->region, (yyvsp[(3) - (8)].data).str)); /* alg */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, (yyvsp[(5) - (8)].data).str)); /* type */ zadd_rdata_wireformat(zparser_conv_hex(parser->region, (yyvsp[(7) - (8)].data).str, (yyvsp[(7) - (8)].data).len)); /* hash */ } break; case 196: /* Line 1806 of yacc.c */ #line 843 "zparser.y" { zadd_rdata_wireformat(zparser_conv_byte(parser->region, (yyvsp[(1) - (6)].data).str)); /* alg */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, (yyvsp[(3) - (6)].data).str)); /* fp type */ zadd_rdata_wireformat(zparser_conv_hex(parser->region, (yyvsp[(5) - (6)].data).str, (yyvsp[(5) - (6)].data).len)); /* hash */ } break; case 197: /* Line 1806 of yacc.c */ #line 851 "zparser.y" { zadd_rdata_wireformat(zparser_conv_b64(parser->region, (yyvsp[(1) - (2)].data).str)); /* data blob */ } break; case 198: /* Line 1806 of yacc.c */ #line 857 "zparser.y" { zadd_rdata_wireformat(zparser_conv_rrtype(parser->region, (yyvsp[(1) - (18)].data).str)); /* rr covered */ zadd_rdata_wireformat(zparser_conv_algorithm(parser->region, (yyvsp[(3) - (18)].data).str)); /* alg */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, (yyvsp[(5) - (18)].data).str)); /* # labels */ zadd_rdata_wireformat(zparser_conv_period(parser->region, (yyvsp[(7) - (18)].data).str)); /* # orig TTL */ zadd_rdata_wireformat(zparser_conv_time(parser->region, (yyvsp[(9) - (18)].data).str)); /* sig exp */ zadd_rdata_wireformat(zparser_conv_time(parser->region, (yyvsp[(11) - (18)].data).str)); /* sig inc */ zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(13) - (18)].data).str)); /* key id */ zadd_rdata_wireformat(zparser_conv_dns_name(parser->region, (const uint8_t*) (yyvsp[(15) - (18)].data).str,(yyvsp[(15) - (18)].data).len)); /* sig name */ zadd_rdata_wireformat(zparser_conv_b64(parser->region, (yyvsp[(17) - (18)].data).str)); /* sig data */ } break; case 199: /* Line 1806 of yacc.c */ #line 872 "zparser.y" { zadd_rdata_wireformat(zparser_conv_dns_name(parser->region, (const uint8_t*) (yyvsp[(1) - (2)].data).str, (yyvsp[(1) - (2)].data).len)); /* nsec name */ zadd_rdata_wireformat(zparser_conv_nsec(parser->region, nsecbits)); /* nsec bitlist */ memset(nsecbits, 0, sizeof(nsecbits)); nsec_highest_rcode = 0; } break; case 200: /* Line 1806 of yacc.c */ #line 882 "zparser.y" { #ifdef NSEC3 nsec3_add_params((yyvsp[(1) - (10)].data).str, (yyvsp[(3) - (10)].data).str, (yyvsp[(5) - (10)].data).str, (yyvsp[(7) - (10)].data).str, (yyvsp[(7) - (10)].data).len); zadd_rdata_wireformat(zparser_conv_b32(parser->region, (yyvsp[(9) - (10)].data).str)); /* next hashed name */ zadd_rdata_wireformat(zparser_conv_nsec(parser->region, nsecbits)); /* nsec bitlist */ memset(nsecbits, 0, sizeof(nsecbits)); nsec_highest_rcode = 0; #else zc_error_prev_line("nsec3 not supported"); #endif /* NSEC3 */ } break; case 201: /* Line 1806 of yacc.c */ #line 897 "zparser.y" { #ifdef NSEC3 nsec3_add_params((yyvsp[(1) - (8)].data).str, (yyvsp[(3) - (8)].data).str, (yyvsp[(5) - (8)].data).str, (yyvsp[(7) - (8)].data).str, (yyvsp[(7) - (8)].data).len); #else zc_error_prev_line("nsec3 not supported"); #endif /* NSEC3 */ } break; case 202: /* Line 1806 of yacc.c */ #line 907 "zparser.y" { zadd_rdata_wireformat(zparser_conv_byte(parser->region, (yyvsp[(1) - (8)].data).str)); /* usage */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, (yyvsp[(3) - (8)].data).str)); /* selector */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, (yyvsp[(5) - (8)].data).str)); /* matching type */ zadd_rdata_wireformat(zparser_conv_hex(parser->region, (yyvsp[(7) - (8)].data).str, (yyvsp[(7) - (8)].data).len)); /* ca data */ } break; case 203: /* Line 1806 of yacc.c */ #line 916 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (8)].data).str)); /* flags */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, (yyvsp[(3) - (8)].data).str)); /* proto */ zadd_rdata_wireformat(zparser_conv_algorithm(parser->region, (yyvsp[(5) - (8)].data).str)); /* alg */ zadd_rdata_wireformat(zparser_conv_b64(parser->region, (yyvsp[(7) - (8)].data).str)); /* hash */ } break; case 204: /* Line 1806 of yacc.c */ #line 925 "zparser.y" { const dname_type* name = 0; zadd_rdata_wireformat(zparser_conv_byte(parser->region, (yyvsp[(1) - (7)].data).str)); /* precedence */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, (yyvsp[(3) - (7)].data).str)); /* gateway type */ zadd_rdata_wireformat(zparser_conv_byte(parser->region, (yyvsp[(5) - (7)].data).str)); /* algorithm */ switch(atoi((yyvsp[(3) - (7)].data).str)) { case IPSECKEY_NOGATEWAY: zadd_rdata_wireformat(alloc_rdata_init(parser->region, "", 0)); break; case IPSECKEY_IP4: zadd_rdata_wireformat(zparser_conv_a(parser->region, (yyvsp[(7) - (7)].data).str)); break; case IPSECKEY_IP6: zadd_rdata_wireformat(zparser_conv_aaaa(parser->region, (yyvsp[(7) - (7)].data).str)); break; case IPSECKEY_DNAME: /* convert and insert the dname */ if(strlen((yyvsp[(7) - (7)].data).str) == 0) zc_error_prev_line("IPSECKEY must specify gateway name"); if(!(name = dname_parse(parser->region, (yyvsp[(7) - (7)].data).str))) zc_error_prev_line("IPSECKEY bad gateway dname %s", (yyvsp[(7) - (7)].data).str); if((yyvsp[(7) - (7)].data).str[strlen((yyvsp[(7) - (7)].data).str)-1] != '.') name = dname_concatenate(parser->rr_region, name, domain_dname(parser->origin)); zadd_rdata_wireformat(alloc_rdata_init(parser->region, dname_name(name), name->name_size)); break; default: zc_error_prev_line("unknown IPSECKEY gateway type"); } } break; case 205: /* Line 1806 of yacc.c */ #line 959 "zparser.y" { zadd_rdata_wireformat(zparser_conv_b64(parser->region, (yyvsp[(3) - (4)].data).str)); /* public key */ } break; case 207: /* Line 1806 of yacc.c */ #line 967 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (4)].data).str)); /* preference */ zadd_rdata_wireformat(zparser_conv_ilnp64(parser->region, (yyvsp[(3) - (4)].data).str)); /* NodeID */ } break; case 208: /* Line 1806 of yacc.c */ #line 974 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (4)].data).str)); /* preference */ zadd_rdata_wireformat(zparser_conv_a(parser->region, (yyvsp[(3) - (4)].data).str)); /* Locator32 */ } break; case 209: /* Line 1806 of yacc.c */ #line 981 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (4)].data).str)); /* preference */ zadd_rdata_wireformat(zparser_conv_ilnp64(parser->region, (yyvsp[(3) - (4)].data).str)); /* Locator64 */ } break; case 210: /* Line 1806 of yacc.c */ #line 988 "zparser.y" { zadd_rdata_wireformat(zparser_conv_short(parser->region, (yyvsp[(1) - (4)].data).str)); /* preference */ zadd_rdata_domain((yyvsp[(3) - (4)].domain)); /* FQDN */ } break; case 211: /* Line 1806 of yacc.c */ #line 995 "zparser.y" { #ifdef DRAFT_RRTYPES zadd_rdata_wireformat(zparser_conv_eui(parser->region, (yyvsp[(1) - (2)].data).str, 48)); #else zc_error_prev_line("EUI48 not supported, enable with --enable-draft-rrtypes."); #endif } break; case 212: /* Line 1806 of yacc.c */ #line 1005 "zparser.y" { #ifdef DRAFT_RRTYPES zadd_rdata_wireformat(zparser_conv_eui(parser->region, (yyvsp[(1) - (2)].data).str, 64)); #else zc_error_prev_line("EUI64 not supported, enable with --enable-draft-rrtypes."); #endif } break; case 213: /* Line 1806 of yacc.c */ #line 1015 "zparser.y" { /* $2 is the number of octects, currently ignored */ (yyval.unknown) = zparser_conv_hex(parser->region, (yyvsp[(5) - (6)].data).str, (yyvsp[(5) - (6)].data).len); } break; case 214: /* Line 1806 of yacc.c */ #line 1021 "zparser.y" { (yyval.unknown) = zparser_conv_hex(parser->region, "", 0); } break; case 215: /* Line 1806 of yacc.c */ #line 1025 "zparser.y" { (yyval.unknown) = zparser_conv_hex(parser->region, "", 0); } break; /* Line 1806 of yacc.c */ #line 3563 "zparser.c" default: break; } /* User semantic actions sometimes alter yychar, and that requires that yytoken be updated with the new translation. We take the approach of translating immediately before every use of yytoken. One alternative is translating here after every semantic action, but that translation would be missed if the semantic action invokes YYABORT, YYACCEPT, or YYERROR immediately after altering yychar or if it invokes YYBACKUP. In the case of YYABORT or YYACCEPT, an incorrect destructor might then be invoked immediately. In the case of YYERROR or YYBACKUP, subsequent parser actions might lead to an incorrect destructor call or verbose syntax error message before the lookahead is translated. */ YY_SYMBOL_PRINT ("-> $$ =", yyr1[yyn], &yyval, &yyloc); YYPOPSTACK (yylen); yylen = 0; YY_STACK_PRINT (yyss, yyssp); *++yyvsp = yyval; /* Now `shift' the result of the reduction. Determine what state that goes to, based on the state we popped back to and the rule number reduced by. */ yyn = yyr1[yyn]; yystate = yypgoto[yyn - YYNTOKENS] + *yyssp; if (0 <= yystate && yystate <= YYLAST && yycheck[yystate] == *yyssp) yystate = yytable[yystate]; else yystate = yydefgoto[yyn - YYNTOKENS]; goto yynewstate; /*------------------------------------. | yyerrlab -- here on detecting error | `------------------------------------*/ yyerrlab: /* Make sure we have latest lookahead translation. See comments at user semantic actions for why this is necessary. */ yytoken = yychar == YYEMPTY ? YYEMPTY : YYTRANSLATE (yychar); /* If not already recovering from an error, report this error. */ if (!yyerrstatus) { ++yynerrs; #if ! YYERROR_VERBOSE yyerror (YY_("syntax error")); #else # define YYSYNTAX_ERROR yysyntax_error (&yymsg_alloc, &yymsg, \ yyssp, yytoken) { char const *yymsgp = YY_("syntax error"); int yysyntax_error_status; yysyntax_error_status = YYSYNTAX_ERROR; if (yysyntax_error_status == 0) yymsgp = yymsg; else if (yysyntax_error_status == 1) { if (yymsg != yymsgbuf) YYSTACK_FREE (yymsg); yymsg = (char *) YYSTACK_ALLOC (yymsg_alloc); if (!yymsg) { yymsg = yymsgbuf; yymsg_alloc = sizeof yymsgbuf; yysyntax_error_status = 2; } else { yysyntax_error_status = YYSYNTAX_ERROR; yymsgp = yymsg; } } yyerror (yymsgp); if (yysyntax_error_status == 2) goto yyexhaustedlab; } # undef YYSYNTAX_ERROR #endif } if (yyerrstatus == 3) { /* If just tried and failed to reuse lookahead token after an error, discard it. */ if (yychar <= YYEOF) { /* Return failure if at end of input. */ if (yychar == YYEOF) YYABORT; } else { yydestruct ("Error: discarding", yytoken, &yylval); yychar = YYEMPTY; } } /* Else will try to reuse lookahead token after shifting the error token. */ goto yyerrlab1; /*---------------------------------------------------. | yyerrorlab -- error raised explicitly by YYERROR. | `---------------------------------------------------*/ yyerrorlab: /* Pacify compilers like GCC when the user code never invokes YYERROR and the label yyerrorlab therefore never appears in user code. */ if (/*CONSTCOND*/ 0) goto yyerrorlab; /* Do not reclaim the symbols of the rule which action triggered this YYERROR. */ YYPOPSTACK (yylen); yylen = 0; YY_STACK_PRINT (yyss, yyssp); yystate = *yyssp; goto yyerrlab1; /*-------------------------------------------------------------. | yyerrlab1 -- common code for both syntax error and YYERROR. | `-------------------------------------------------------------*/ yyerrlab1: yyerrstatus = 3; /* Each real token shifted decrements this. */ for (;;) { yyn = yypact[yystate]; if (!yypact_value_is_default (yyn)) { yyn += YYTERROR; if (0 <= yyn && yyn <= YYLAST && yycheck[yyn] == YYTERROR) { yyn = yytable[yyn]; if (0 < yyn) break; } } /* Pop the current state because it cannot handle the error token. */ if (yyssp == yyss) YYABORT; yydestruct ("Error: popping", yystos[yystate], yyvsp); YYPOPSTACK (1); yystate = *yyssp; YY_STACK_PRINT (yyss, yyssp); } *++yyvsp = yylval; /* Shift the error token. */ YY_SYMBOL_PRINT ("Shifting", yystos[yyn], yyvsp, yylsp); yystate = yyn; goto yynewstate; /*-------------------------------------. | yyacceptlab -- YYACCEPT comes here. | `-------------------------------------*/ yyacceptlab: yyresult = 0; goto yyreturn; /*-----------------------------------. | yyabortlab -- YYABORT comes here. | `-----------------------------------*/ yyabortlab: yyresult = 1; goto yyreturn; #if !defined(yyoverflow) || YYERROR_VERBOSE /*-------------------------------------------------. | yyexhaustedlab -- memory exhaustion comes here. | `-------------------------------------------------*/ yyexhaustedlab: yyerror (YY_("memory exhausted")); yyresult = 2; /* Fall through. */ #endif yyreturn: if (yychar != YYEMPTY) { /* Make sure we have latest lookahead translation. See comments at user semantic actions for why this is necessary. */ yytoken = YYTRANSLATE (yychar); yydestruct ("Cleanup: discarding lookahead", yytoken, &yylval); } /* Do not reclaim the symbols of the rule which action triggered this YYABORT or YYACCEPT. */ YYPOPSTACK (yylen); YY_STACK_PRINT (yyss, yyssp); while (yyssp != yyss) { yydestruct ("Cleanup: popping", yystos[*yyssp], yyvsp); YYPOPSTACK (1); } #ifndef yyoverflow if (yyss != yyssa) YYSTACK_FREE (yyss); #endif #if YYERROR_VERBOSE if (yymsg != yymsgbuf) YYSTACK_FREE (yymsg); #endif /* Make sure YYID is used. */ return YYID (yyresult); } /* Line 2067 of yacc.c */ #line 1029 "zparser.y" int yywrap(void) { return 1; } /* * Create the parser. */ zparser_type * zparser_create(region_type *region, region_type *rr_region, namedb_type *db) { zparser_type *result; result = (zparser_type *) region_alloc(region, sizeof(zparser_type)); result->region = region; result->rr_region = rr_region; result->db = db; result->filename = NULL; result->current_zone = NULL; result->origin = NULL; result->prev_dname = NULL; result->default_apex = NULL; result->temporary_rdatas = (rdata_atom_type *) region_alloc( result->region, MAXRDATALEN * sizeof(rdata_atom_type)); return result; } /* * Initialize the parser for a new zone file. */ void zparser_init(const char *filename, uint32_t ttl, uint16_t klass, const dname_type *origin) { memset(nxtbits, 0, sizeof(nxtbits)); memset(nsecbits, 0, sizeof(nsecbits)); nsec_highest_rcode = 0; parser->default_ttl = ttl; parser->default_class = klass; parser->current_zone = NULL; parser->origin = domain_table_insert(parser->db->domains, origin); parser->prev_dname = parser->origin; parser->default_apex = parser->origin; parser->error_occurred = 0; parser->errors = 0; parser->line = 1; parser->filename = filename; parser->current_rr.rdata_count = 0; parser->current_rr.rdatas = parser->temporary_rdatas; } void yyerror(const char *message) { zc_error("%s", message); } static void error_va_list(unsigned line, const char *fmt, va_list args) { if (parser->filename) { fprintf(stderr, "%s:%u: ", parser->filename, line); } fprintf(stderr, "error: "); vfprintf(stderr, fmt, args); fprintf(stderr, "\n"); ++parser->errors; parser->error_occurred = 1; } /* the line counting sux, to say the least * with this grose hack we try do give sane * numbers back */ void zc_error_prev_line(const char *fmt, ...) { va_list args; va_start(args, fmt); error_va_list(parser->line - 1, fmt, args); va_end(args); } void zc_error(const char *fmt, ...) { /* send an error message to stderr */ va_list args; va_start(args, fmt); error_va_list(parser->line, fmt, args); va_end(args); } static void warning_va_list(unsigned line, const char *fmt, va_list args) { if (parser->filename) { fprintf(stderr, "%s:%u: ", parser->filename, line); } fprintf(stderr, "warning: "); vfprintf(stderr, fmt, args); fprintf(stderr, "\n"); } void zc_warning_prev_line(const char *fmt, ...) { va_list args; va_start(args, fmt); warning_va_list(parser->line - 1, fmt, args); va_end(args); } void zc_warning(const char *fmt, ... ) { va_list args; va_start(args, fmt); warning_va_list(parser->line, fmt, args); va_end(args); } #ifdef NSEC3 static void nsec3_add_params(const char* hashalgo_str, const char* flag_str, const char* iter_str, const char* salt_str, int salt_len) { zadd_rdata_wireformat(zparser_conv_byte(parser->region, hashalgo_str)); zadd_rdata_wireformat(zparser_conv_byte(parser->region, flag_str)); zadd_rdata_wireformat(zparser_conv_short(parser->region, iter_str)); /* salt */ if(strcmp(salt_str, "-") != 0) zadd_rdata_wireformat(zparser_conv_hex_length(parser->region, salt_str, salt_len)); else zadd_rdata_wireformat(alloc_rdata_init(parser->region, "", 1)); } #endif /* NSEC3 */ nsd-3.2.16/nsdc.8.in0000664000175000017500000001014212173226547013007 0ustar matjematje.TH "NSDC" "8" "Jul 22, 2013" "NLnet Labs" "NSDC 3.2.16" .\" Copyright (c) 2001\-2011, NLnet Labs. All rights reserved. .\" See LICENSE for the license. .SH "NAME" .LP .B nsdc \- Name Server Daemon (NSD) control script. .SH "SYNOPSIS" .LP .B nsdc .RB [ \-c .IR configfile ] .I start | .I stop | .I reload | .I rebuild | .I restart | .I running | .I update | .I notify | .I patch .SH "DESCRIPTION" .LP .B Nsdc is the shell script that used to control nsd(8) and zonec(8) from .B NSD distribution. .B Nsdc is also suitable to be linked into .I /etc/rc.d directory on .I BSD like systems for automatic startup of nsd(8) at boot time. .P At every invokation, .B nsdc will try to read the nsd.conf(5) configuration file. An example of such configuration file is distributed with the .B NSD package as .IR nsd.conf.sample . The config file is checked for errors before it is used, see nsd\-checkconf(8). .P Possible .B nsdc applications are: .TP .I start Start nsd(8). .TP .I stop Shut down nsd(8) by sending .I SIGTERM to it. .TP .I reload Initiate nsd(8) name space database reload by sending .IR SIGHUP. .TP .I rebuild Rebuild the nsd(8) database by invoking zonec(8) with appropriate arguments. .TP .I restart Restart nsd(8). This equals to nsdc stop && nsdc start. .TP .I running Check whether nsd(8) is running. Returns error message and error code if it is not running, and no message and zero error code otherwise. .TP .I update Updates all the slave zones which have .I allow\-notify: from localhost (127.0.0.1 or ::1) allowed. If a TSIG key is specified for the allow\-notify statement in the config file, it will be used to secure the notify. Note that NSD keeps track of zone timeouts automatically, this is only needed if you want to manually force updates by sending notify messages to the localhost. .P .RS Another method you can use is to stop nsd, delete the xfrd.state file and then start nsd again. It will try to update all zones. This method does not require allow\-notify: statements. .RE .TP .I notify Sends notify messages to all the slaves for all the zones that have the .I notify: keyword in the .I nsd.conf file. If a TSIG key is specified for a notify statement, it will be used to secure the notification message to that slave server. .TP .I patch Merge zone transfer changes back to zone files. It reads in the nsd database (nsd.db) and difffile (ixfr.db), and overwrites the zone text files if they have been updated. Running this regularly ensures that the difffile does not grow infinitely. If any zone text files have been changed (including those of the master zones), the nsd.db is rebuild and nsd is reloaded. .SH "OPTIONS" .TP .B \-c\fI configfile Specify configfile to use instead of the default .IR @nsdconfigfile@ . .SH "FILES" .TP @nsdconfigfile@ Configuration file for nsd to change default pathnames and .B NSD flags. The zone names, pathnames to zone files and access control lists are also in nsd.conf(5). .TP @dbfile@ default .B NSD database .TP @dbfile@.lock Lockfile for the .B NSD database access by operator tools. .TP @difffile@ Journal of zone transfers, the diff file containing the new zone contents transferred. .TP @xfrdfile@ State for the zone transfer process of .BR NSD. Contains timeouts for the zones and whether zones are expired. .TP @pidfile@ the process id of the name server. .SH "DIAGNOSTICS" .LP .B Nsdc will return zero return code if operation was successful and an error message to standard output plus a non\-zero return code otherwise. .SH "SEE ALSO" .LP nsd(8), nsd.conf(5), nsd\-checkconf(8), nsd\-notify(8), nsd\-patch(8), nsd\-xfer(8), zonec(8) .SH "AUTHORS" .LP .B NSD was written by NLnet Labs and RIPE NCC joint team. Please see CREDITS file in the distribution for further details. .SH "BUGS" Syntax checking of the config file is rudimentary and error messages may be wrong. If you do a nsdc patch, whilst a (long) zone transfer is busy, the zone transfer contents will be partially lost. After a reload, this will be detected and the zone transfer should be restarted. The reload that happens at the end of nsdc patch also frees up memory churn in .B NSD caused by zone transfers. nsd-3.2.16/nsd-xfer.c0000664000175000017500000006011612071046230013244 0ustar matjematje/* * nsd-xfer.c -- nsd-xfer(8). * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include "dname.h" #include "dns.h" #include "packet.h" #include "query.h" #include "region-allocator.h" #include "tsig.h" #include "tsig-openssl.h" #include "util.h" /* * Number of seconds to wait when recieving no data from the remote * server. */ #define MAX_WAITING_TIME TCP_TIMEOUT /* * Exit codes are based on named-xfer for now. See ns_defs.h in * bind8. */ #define XFER_UPTODATE 0 #define XFER_SUCCESS 1 #define XFER_FAIL 3 struct axfr_state { int verbose; size_t packets_received; size_t bytes_received; int s; /* AXFR socket. */ query_type *q; /* Query buffer. */ uint16_t query_id; /* AXFR query ID. */ tsig_record_type *tsig; /* TSIG data. */ int first_transfer; /* First transfer of this zone. */ uint32_t last_serial; /* Otherwise the last serial. */ uint32_t zone_serial; /* And the new zone serial. */ const dname_type *zone; /* Zone name. */ int done; /* AXFR is complete. */ size_t rr_count; /* Number of RRs received so far. */ /* * Region used to allocate data needed to process a single RR. */ region_type *rr_region; /* * Region used to store owner and origin of previous RR (used * for pretty printing of zone data). */ struct state_pretty_rr *pretty_rr; }; typedef struct axfr_state axfr_state_type; static sig_atomic_t timeout_flag = 0; static void to_alarm(int sig); /* our alarm() signal handler */ extern char *optarg; extern int optind; static uint16_t init_query(query_type *q, const dname_type *dname, uint16_t type, uint16_t klass, tsig_record_type *tsig); /* * Check if two getaddrinfo result lists have records with matching * ai_family fields. */ int check_matching_address_family(struct addrinfo *a, struct addrinfo *b); /* * Returns the first record with ai_family == FAMILY, or NULL if no * such record is found. */ struct addrinfo *find_by_address_family(struct addrinfo *addrs, int family); /* * Assigns pointers to hostname and port and wipes out the optional delimiter. */ void get_hostname_port_frm_str(char* arg, const char** hostname, const char** port); /* * Log an error message and exit. */ static void error(const char *format, ...) ATTR_FORMAT(printf, 1, 2); static void error(const char *format, ...) { va_list args; va_start(args, format); log_vmsg(LOG_ERR, format, args); va_end(args); exit(XFER_FAIL); } /* * Log a warning message. */ static void warning(const char *format, ...) ATTR_FORMAT(printf, 1, 2); static void warning(const char *format, ...) { va_list args; va_start(args, format); log_vmsg(LOG_WARNING, format, args); va_end(args); } /* * Display usage information and exit. */ static void usage (void) { fprintf(stderr, "Usage: nsd-xfer [OPTION]... -z zone -f file server...\n" "NSD AXFR client.\n\nSupported options:\n" " -4 Only use IPv4 connections.\n" " -6 Only use IPv6 connections.\n" " -a src[@port] Local hostname/ip-address for the \ connection, including optional source port.\n" " -f file Output zone file name.\n" " -p port The port to connect to.\n" " -s serial The current zone serial.\n" " -T tsiginfo The TSIG key file name. The file is removed " "after reading the\n key.\n" " -v Verbose output.\n"); fprintf(stderr, " -z zone Specify the name of the zone to transfer.\n" " server The name or IP address of the master server.\n" "\nVersion %s. Report bugs to <%s>.\n", PACKAGE_VERSION, PACKAGE_BUGREPORT); exit(XFER_FAIL); } /* * Find an HMAC algorithm based on its id. */ static tsig_algorithm_type * tsig_get_algorithm_by_id(uint8_t alg) { if (alg == TSIG_HMAC_MD5) return tsig_get_algorithm_by_name("hmac-md5"); #ifdef HAVE_EVP_SHA1 if (alg == TSIG_HMAC_SHA1) return tsig_get_algorithm_by_name("hmac-sha1"); #endif /* HAVE_EVP_SHA1 */ #ifdef HAVE_EVP_SHA256 if (alg == TSIG_HMAC_SHA256) return tsig_get_algorithm_by_name("hmac-sha256"); #endif /* HAVE_EVP_SHA256 */ return NULL; } /* * Signal handler for timeouts (SIGALRM). This function is called when * the alarm() value that was set counts down to zero. This indicates * that we haven't received a response from the server. * * All we do is set a flag and return from the signal handler. The * occurrence of the signal interrupts the read() system call (errno * == EINTR) above, and we then check the timeout_flag flag. */ static void to_alarm(int ATTR_UNUSED(sig)) { timeout_flag = 1; } /* * Read a line from IN. If successful, the line is stripped of * leading and trailing whitespace and non-zero is returned. */ static int tsig_read_line(FILE *in, char *line, size_t size) { if (!fgets(line, size, in)) { return 0; } else { strip_string(line); return 1; } } static tsig_key_type * read_tsig_key_data(region_type *region, FILE *in, int ATTR_UNUSED(default_family), tsig_algorithm_type** tsig_algo) { char line[4000]; tsig_key_type *key = (tsig_key_type *) region_alloc( region, sizeof(tsig_key_type)); int size; uint8_t algo = 0; uint8_t data[4000]; /* server address */ if (!tsig_read_line(in, line, sizeof(line))) { error("failed to read TSIG key server address: '%s'", strerror(errno)); return NULL; } /* server address unused */ /* tsig keyname */ if (!tsig_read_line(in, line, sizeof(line))) { error("failed to read TSIG key name: '%s'", strerror(errno)); return NULL; } key->name = dname_parse(region, line); if (!key->name) { error("failed to parse TSIG key name '%s'", line); return NULL; } /* tsig algorithm */ if (!tsig_read_line(in, line, sizeof(line))) { error("failed to read TSIG key algorithm: '%s'", strerror(errno)); return NULL; } algo = (uint8_t) atoi((const char*) line); *tsig_algo = tsig_get_algorithm_by_id(algo); if (*tsig_algo == NULL) { error("failed to parse TSIG key algorithm %i: '%s'\n", algo, strerror(errno)); return NULL; } /* tsig secret */ if (!tsig_read_line(in, line, sizeof(line))) { error("failed to read TSIG key data: '%s'\n", strerror(errno)); return NULL; } size = b64_pton(line, data, sizeof(data)); if (size == -1) { error("failed to parse TSIG key data"); return NULL; } key->size = size; key->data = (uint8_t *) region_alloc_init(region, data, key->size); return key; } /* * Read the TSIG key from a .tsiginfo file and remove the file. */ static tsig_key_type * read_tsig_key(region_type *region, const char *tsiginfo_filename, int default_family, tsig_algorithm_type** algo) { FILE *in; tsig_key_type *key; in = fopen(tsiginfo_filename, "r"); if (!in) { error("failed to open %s: %s", tsiginfo_filename, strerror(errno)); return NULL; } key = read_tsig_key_data(region, in, default_family, algo); fclose(in); if (unlink(tsiginfo_filename) == -1) { warning("failed to remove %s: %s", tsiginfo_filename, strerror(errno)); } return key; } /* * Read SIZE bytes from the socket into BUF. Keep reading unless an * error occurs (except for EAGAIN) or EOF is reached. */ static int read_socket(int s, void *buf, size_t size) { char *data = (char *) buf; size_t total_count = 0; while (total_count < size) { ssize_t count = read(s, data + total_count, size - total_count); if (count == -1) { /* Error or interrupt. */ if (errno != EAGAIN) { error("network read failed: %s", strerror(errno)); return 0; } else { continue; } } else if (count == 0) { /* End of file (connection closed?) */ error("network read failed: Connection closed by peer"); return 0; } total_count += count; } return 1; } static int parse_response(FILE *out, axfr_state_type *state) { size_t rr_count; size_t qdcount = QDCOUNT(state->q->packet); size_t ancount = ANCOUNT(state->q->packet); /* Skip question section. */ for (rr_count = 0; rr_count < qdcount; ++rr_count) { if (!packet_skip_rr(state->q->packet, 1)) { error("bad RR in question section"); return 0; } } /* Read RRs from answer section and print them. */ for (rr_count = 0; rr_count < ancount; ++rr_count) { domain_table_type *owners = domain_table_create(state->rr_region); rr_type *record = packet_read_rr( state->rr_region, owners, state->q->packet, 0); if (!record) { error("bad RR in answer section"); return 0; } if (state->rr_count == 0 && (record->type != TYPE_SOA || record->klass != CLASS_IN)) { error("First RR must be the SOA record, but is a %s record", rrtype_to_string(record->type)); return 0; } else if (state->rr_count > 0 && record->type == TYPE_SOA && record->klass == CLASS_IN) { state->done = 1; return 1; } ++state->rr_count; if (!print_rr(out, state->pretty_rr, record)) { return 0; } region_free_all(state->rr_region); } return 1; } static int send_query(int s, query_type *q) { uint16_t size = htons(buffer_remaining(q->packet)); if (!write_socket(s, &size, sizeof(size))) { error("network write failed: %s", strerror(errno)); return 0; } if (!write_socket(s, buffer_begin(q->packet), buffer_limit(q->packet))) { error("network write failed: %s", strerror(errno)); return 0; } return 1; } static int receive_response_no_timeout(axfr_state_type *state) { uint16_t size; buffer_clear(state->q->packet); if (!read_socket(state->s, &size, sizeof(size))) { return 0; } size = ntohs(size); if (size > state->q->maxlen) { error("response size (%d) exceeds maximum (%d)", (int) size, (int) state->q->maxlen); return 0; } if (!read_socket(state->s, buffer_begin(state->q->packet), size)) { return 0; } buffer_set_position(state->q->packet, size); ++state->packets_received; state->bytes_received += sizeof(size) + size; return 1; } static int receive_response(axfr_state_type *state) { int result; timeout_flag = 0; alarm(MAX_WAITING_TIME); result = receive_response_no_timeout(state); alarm(0); if (!result && timeout_flag) { error("timeout reading response, server unreachable?"); } return result; } static int check_response_tsig(query_type *q, tsig_record_type *tsig) { if (!tsig) return 1; if (!tsig_find_rr(tsig, q->packet)) { error("error parsing response"); return 0; } if (tsig->status == TSIG_NOT_PRESENT) { if (tsig->response_count == 0) { error("required TSIG not present"); return 0; } if (tsig->updates_since_last_prepare > 100) { error("too many response packets without TSIG"); return 0; } tsig_update(tsig, q->packet, buffer_limit(q->packet)); return 1; } ARCOUNT_SET(q->packet, ARCOUNT(q->packet) - 1); if (tsig->status == TSIG_ERROR) { error("TSIG record is not correct"); return 0; } else if (tsig->error_code != TSIG_ERROR_NOERROR) { error("TSIG error code: %s", tsig_error(tsig->error_code)); return 0; } else { tsig_update(tsig, q->packet, tsig->position); if (!tsig_verify(tsig)) { error("TSIG record did not authenticate"); return 0; } tsig_prepare(tsig); } return 1; } /* * Query the server for the zone serial. Return 1 if the zone serial * is higher than the current serial, 0 if the zone serial is lower or * equal to the current serial, and -1 on error. * * On success, the zone serial is returned in ZONE_SERIAL. */ static int check_serial(axfr_state_type *state) { region_type *local; uint16_t query_id; uint16_t i; domain_table_type *owners; query_id = init_query( state->q, state->zone, TYPE_SOA, CLASS_IN, state->tsig); if (!send_query(state->s, state->q)) { return -1; } if (state->tsig) { /* Prepare for checking responses. */ tsig_prepare(state->tsig); } if (!receive_response(state)) { return -1; } buffer_flip(state->q->packet); if (buffer_limit(state->q->packet) <= QHEADERSZ) { error("response size (%d) is too small", (int) buffer_limit(state->q->packet)); return -1; } if (!QR(state->q->packet)) { error("response is not a response"); return -1; } if (TC(state->q->packet)) { error("response is truncated"); return -1; } if (ID(state->q->packet) != query_id) { error("bad response id (%d), expected (%d)", (int) ID(state->q->packet), (int) query_id); return -1; } if (RCODE(state->q->packet) != RCODE_OK) { error("error response %d (%s)", (int) RCODE(state->q->packet), rcode2str((int) RCODE(state->q->packet))); return -1; } if (QDCOUNT(state->q->packet) != 1) { error("question section count not equal to 1"); return -1; } if (ANCOUNT(state->q->packet) == 0) { error("answer section is empty"); return -1; } if (!check_response_tsig(state->q, state->tsig)) { return -1; } buffer_set_position(state->q->packet, QHEADERSZ); local = region_create(xalloc, free); owners = domain_table_create(local); /* Skip question records. */ for (i = 0; i < QDCOUNT(state->q->packet); ++i) { rr_type *record = packet_read_rr(local, owners, state->q->packet, 1); if (!record) { error("bad RR in question section"); region_destroy(local); return -1; } if (dname_compare(state->zone, domain_dname(record->owner)) != 0 || record->type != TYPE_SOA || record->klass != CLASS_IN) { error("response does not match query"); region_destroy(local); return -1; } } /* Find the SOA record in the response. */ for (i = 0; i < ANCOUNT(state->q->packet); ++i) { rr_type *record = packet_read_rr(local, owners, state->q->packet, 0); if (!record) { error("bad RR in answer section"); region_destroy(local); return -1; } if (dname_compare(state->zone, domain_dname(record->owner)) == 0 && record->type == TYPE_SOA && record->klass == CLASS_IN) { assert(record->rdata_count == 7); assert(rdata_atom_size(record->rdatas[2]) == 4); state->zone_serial = read_uint32( rdata_atom_data(record->rdatas[2])); region_destroy(local); return (state->first_transfer || compare_serial(state->zone_serial, state->last_serial) > 0); } } error("SOA not found in answer"); region_destroy(local); return -1; } /* * Receive and parse the AXFR response packets. */ static int handle_axfr_response(FILE *out, axfr_state_type *axfr) { while (!axfr->done) { if (!receive_response(axfr)) { return 0; } buffer_flip(axfr->q->packet); if (buffer_limit(axfr->q->packet) <= QHEADERSZ) { error("response size (%d) is too small", (int) buffer_limit(axfr->q->packet)); return 0; } if (!QR(axfr->q->packet)) { error("response is not a response"); return 0; } if (ID(axfr->q->packet) != axfr->query_id) { error("bad response id (%d), expected (%d)", (int) ID(axfr->q->packet), (int) axfr->query_id); return 0; } if (RCODE(axfr->q->packet) != RCODE_OK) { error("error response %d (%s)", (int) RCODE(axfr->q->packet), rcode2str((int) RCODE(axfr->q->packet))); return 0; } if (QDCOUNT(axfr->q->packet) > 1) { error("query section count greater than 1"); return 0; } if (ANCOUNT(axfr->q->packet) == 0) { error("answer section is empty"); return 0; } if (!check_response_tsig(axfr->q, axfr->tsig)) { return 0; } buffer_set_position(axfr->q->packet, QHEADERSZ); if (!parse_response(out, axfr)) { return 0; } } return 1; } static int axfr(FILE *out, axfr_state_type *state, const char *server) { state->query_id = init_query( state->q, state->zone, TYPE_AXFR, CLASS_IN, state->tsig); log_msg(LOG_INFO, "send AXFR query to %s for %s", server, dname_to_string(state->zone, NULL)); if (!send_query(state->s, state->q)) { return 0; } if (state->tsig) { /* Prepare for checking responses. */ tsig_prepare(state->tsig); } return handle_axfr_response(out, state); } static uint16_t init_query(query_type *q, const dname_type *dname, uint16_t type, uint16_t klass, tsig_record_type *tsig) { uint16_t query_id = qid_generate(); buffer_clear(q->packet); /* Set up the header */ ID_SET(q->packet, query_id); FLAGS_SET(q->packet, 0); OPCODE_SET(q->packet, OPCODE_QUERY); AA_SET(q->packet); QDCOUNT_SET(q->packet, 1); ANCOUNT_SET(q->packet, 0); NSCOUNT_SET(q->packet, 0); ARCOUNT_SET(q->packet, 0); buffer_skip(q->packet, QHEADERSZ); /* The question record. */ buffer_write(q->packet, dname_name(dname), dname->name_size); buffer_write_u16(q->packet, type); buffer_write_u16(q->packet, klass); if (tsig) { tsig_init_query(tsig, query_id); tsig_prepare(tsig); tsig_update(tsig, q->packet, buffer_position(q->packet)); tsig_sign(tsig); tsig_append_rr(tsig, q->packet); ARCOUNT_SET(q->packet, 1); } buffer_flip(q->packet); return ID(q->packet); } static void print_zone_header(FILE *out, axfr_state_type *state, const char *server) { time_t now = time(NULL); fprintf(out, "; NSD version %s\n", PACKAGE_VERSION); fprintf(out, "; zone '%s'", dname_to_string(state->zone, NULL)); if (state->first_transfer) { fprintf(out, " first transfer\n"); } else { fprintf(out, " last serial %lu\n", (unsigned long) state->last_serial); } fprintf(out, "; from %s using AXFR at %s", server, ctime(&now)); if (state->tsig) { fprintf(out, "; TSIG verified with key '%s'\n", dname_to_string(state->tsig->key->name, NULL)); } else { fprintf(out, "; NOT TSIG verified\n"); } } static void print_stats(axfr_state_type *state) { log_msg(LOG_INFO, "received %lu RRs in %lu bytes (using %lu response packets)", (unsigned long) state->rr_count, (unsigned long) state->bytes_received, (unsigned long) state->packets_received); } int main(int argc, char *argv[]) { region_type *region = region_create(xalloc, free); int c; query_type q; struct addrinfo hints, *res0, *res; const char *zone_filename = NULL; const char *local_hostname = NULL; struct addrinfo *local_address, *local_addresses = NULL; const char *port = TCP_PORT; const char *local_port = NULL; int default_family = DEFAULT_AI_FAMILY; struct sigaction mysigaction; FILE *zone_file; const char *tsig_key_filename = NULL; tsig_key_type *tsig_key = NULL; axfr_state_type state; log_init("nsd-xfer"); /* Initialize the query. */ memset(&q, 0, sizeof(query_type)); q.region = region; q.addrlen = sizeof(q.addr); q.packet = buffer_create(region, QIOBUFSZ); q.maxlen = TCP_MAX_MESSAGE_LEN; /* Initialize the state. */ state.verbose = 0; state.packets_received = 0; state.bytes_received = 0; state.q = &q; state.tsig = NULL; state.zone = NULL; state.first_transfer = 1; state.done = 0; state.rr_count = 0; state.rr_region = region_create(xalloc, free); state.pretty_rr = create_pretty_rr(region); region_add_cleanup(region, cleanup_region, state.rr_region); srandom((unsigned long) getpid() * (unsigned long) time(NULL)); if (!tsig_init(region)) { error("TSIG initialization failed"); } /* Parse the command line... */ while ((c = getopt(argc, argv, "46a:f:hp:s:T:vz:")) != -1) { switch (c) { case '4': default_family = AF_INET; break; case '6': #ifdef INET6 default_family = AF_INET6; #else /* !INET6 */ error("IPv6 support not enabled."); #endif /* !INET6 */ break; case 'a': get_hostname_port_frm_str((char *) optarg, &local_hostname, &local_port); break; case 'f': zone_filename = optarg; break; case 'h': usage(); break; case 'p': port = optarg; break; case 's': { uint32_t v; const char *t; state.first_transfer = 0; v = strtoserial(optarg, &t); if (optarg[0] == '\0' || *t != '\0') { error("bad serial '%s'", optarg); exit(XFER_FAIL); } state.last_serial = v; break; } case 'T': tsig_key_filename = optarg; break; case 'v': ++state.verbose; break; case 'z': state.zone = dname_parse(region, optarg); if (!state.zone) { error("incorrect domain name '%s'", optarg); } break; case '?': default: usage(); } } argc -= optind; argv += optind; if (argc == 0 || !zone_filename || !state.zone) usage(); if (tsig_key_filename) { tsig_algorithm_type *tsig_algo = NULL; tsig_key = read_tsig_key( region, tsig_key_filename, default_family, &tsig_algo); if (!tsig_key) { error("cannot initialize TSIG: error in tsiginfo file"); exit(XFER_FAIL); } tsig_add_key(tsig_key); state.tsig = (tsig_record_type *) region_alloc( region, sizeof(tsig_record_type)); tsig_create_record(state.tsig, region); tsig_init_record(state.tsig, tsig_algo, tsig_key); } mysigaction.sa_handler = to_alarm; sigfillset(&mysigaction.sa_mask); mysigaction.sa_flags = 0; if (sigaction(SIGALRM, &mysigaction, NULL) < 0) { error("cannot set signal handler"); } memset(&hints, 0, sizeof(hints)); hints.ai_family = default_family; hints.ai_socktype = SOCK_STREAM; hints.ai_protocol = IPPROTO_TCP; if (local_hostname) { int rc = getaddrinfo(local_hostname, local_port, &hints, &local_addresses); if (rc) { error("local hostname '%s' not found: %s", local_hostname, gai_strerror(rc)); } } for (/*empty*/; *argv; ++argv) { /* Try each server separately until one succeeds. */ int rc; rc = getaddrinfo(*argv, port, &hints, &res0); if (rc) { warning("skipping bad address %s: %s\n", *argv, gai_strerror(rc)); continue; } if (local_addresses && !check_matching_address_family(res0, local_addresses)) { warning("no local address family matches remote " "address family, skipping server '%s'", *argv); continue; } for (res = res0; res; res = res->ai_next) { if (res->ai_addrlen > (socklen_t)sizeof(q.addr)) continue; /* * If a local address is specified, use an * address with the same family as the remote * address. */ local_address = find_by_address_family(local_addresses, res->ai_family); if (local_addresses && !local_address) { /* Continue with next remote address. */ continue; } state.s = socket(res->ai_family, res->ai_socktype, res->ai_protocol); if (state.s == -1) { warning("cannot create socket: %s\n", strerror(errno)); continue; } /* Bind socket to local address, if required. */ if (local_address && bind(state.s, local_address->ai_addr, local_address->ai_addrlen) < 0) { warning("cannot bind to %s: %s\n", local_hostname, strerror(errno)); } if (connect(state.s, res->ai_addr, res->ai_addrlen) < 0) { warning("cannot connect to %s: %s\n", *argv, strerror(errno)); close(state.s); continue; } memcpy(&q.addr, res->ai_addr, res->ai_addrlen); rc = check_serial(&state); if (rc == -1) { close(state.s); continue; } if (rc == 0) { /* Zone is up-to-date. */ close(state.s); exit(XFER_UPTODATE); } else if (rc > 0) { zone_file = fopen(zone_filename, "w"); if (!zone_file) { error("cannot open or create zone file '%s' for writing: %s", zone_filename, strerror(errno)); close(state.s); exit(XFER_FAIL); } print_zone_header(zone_file, &state, *argv); if (axfr(zone_file, &state, *argv)) { /* AXFR succeeded, done. */ fclose(zone_file); close(state.s); if (state.verbose > 0) { print_stats(&state); } exit(XFER_SUCCESS); } fclose(zone_file); } close(state.s); } freeaddrinfo(res0); } log_msg(LOG_ERR, "cannot contact an authoritative server, zone NOT transferred"); exit(XFER_FAIL); } void get_hostname_port_frm_str(char* arg, const char** hostname, const char** port) { /* parse -a src[@port] option */ char* delim = strchr(arg, '@'); if (delim) { *delim = '\0'; *port = delim+1; } *hostname = arg; } int check_matching_address_family(struct addrinfo *a0, struct addrinfo *b0) { struct addrinfo *a; struct addrinfo *b; for (a = a0; a; a = a->ai_next) { for (b = b0; b; b = b->ai_next) { if (a->ai_family == b->ai_family) { return 1; } } } return 0; } struct addrinfo * find_by_address_family(struct addrinfo *addrs, int family) { for (; addrs; addrs = addrs->ai_next) { if (addrs->ai_family == family) { return addrs; } } return NULL; } nsd-3.2.16/answer.h0000664000175000017500000000176311535444205013035 0ustar matjematje/* * answer.h -- manipulating query answers and encoding them. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _ANSWER_H_ #define _ANSWER_H_ #include #include "dns.h" #include "namedb.h" #include "packet.h" #include "query.h" /* * Structure used to keep track of RRsets that need to be stored in * the answer packet. */ typedef struct answer answer_type; struct answer { size_t rrset_count; rrset_type *rrsets[MAXRRSPP]; domain_type *domains[MAXRRSPP]; rr_section_type section[MAXRRSPP]; }; void encode_answer(query_type *q, const answer_type *answer); void answer_init(answer_type *answer); /* * Add the specified RRset to the answer in the specified section. If * the RRset is already present and in the same (or "higher") section * return 0, otherwise return 1. */ int answer_add_rrset(answer_type *answer, rr_section_type section, domain_type *domain, rrset_type *rrset); #endif /* _ANSWER_H_ */ nsd-3.2.16/ipc.h0000664000175000017500000000450012004511543012271 0ustar matjematje/* * ipc.h - Interprocess communication routines. Handlers read and write. * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef NSD_IPC_H #define NSD_IPC_H #include "config.h" #include "netio.h" struct buffer; struct nsd; struct nsd_child; struct xfrd_tcp; /* * Data for the server_main IPC handler * Used by parent side to listen to children, and write to children. */ struct main_ipc_handler_data { struct nsd *nsd; struct nsd_child *child; int child_num; /* pointer to the socket, as it may change if it is restarted */ int *xfrd_sock; struct buffer *packet; int forward_mode; size_t got_bytes; uint16_t total_bytes; uint32_t acl_num; int32_t acl_xfr; /* writing data, connection and state */ uint8_t busy_writing_zone_state; struct xfrd_tcp *write_conn; }; /* * Data for ipc handler, nsd and a conn for reading ipc msgs. * Used by children to listen to parent. * Used by parent to listen to xfrd. */ struct ipc_handler_conn_data { struct nsd *nsd; struct xfrd_tcp *conn; }; /* * Routine used by server_main. * Handle a command received from the xfrdaemon processes. */ void parent_handle_xfrd_command(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); /* * Routine used by server_main. * Handle a command received from the reload process. */ void parent_handle_reload_command(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); /* * Routine used by server_main. * Handle a command received from the children processes. * Send commands and forwarded xfrd packets when writable. */ void parent_handle_child_command(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); /* * Routine used by server_child. * Handle a command received from the parent process. */ void child_handle_parent_command(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); /* * Routine used by xfrd * Handle interprocess communication with parent process, read and write. */ void xfrd_handle_ipc(netio_type *netio, netio_handler_type *handler, netio_event_types_type event_types); /* check if all children have exited in an orderly fashion and set mode */ void parent_check_all_children_exited(struct nsd* nsd); #endif /* NSD_IPC_H */ nsd-3.2.16/install-sh0000775000175000017500000001273607612733365013404 0ustar matjematje#!/bin/sh # # install - install a program, script, or datafile # This comes from X11R5 (mit/util/scripts/install.sh). # # Copyright 1991 by the Massachusetts Institute of Technology # # Permission to use, copy, modify, distribute, and sell this software and its # documentation for any purpose is hereby granted without fee, provided that # the above copyright notice appear in all copies and that both that # copyright notice and this permission notice appear in supporting # documentation, and that the name of M.I.T. not be used in advertising or # publicity pertaining to distribution of the software without specific, # written prior permission. M.I.T. makes no representations about the # suitability of this software for any purpose. It is provided "as is" # without express or implied warranty. # # Calling this script install-sh is preferred over install.sh, to prevent # `make' implicit rules from creating a file called install from it # when there is no Makefile. # # This script is compatible with the BSD install script, but was written # from scratch. It can only install one file at a time, a restriction # shared with many OS's install programs. # set DOITPROG to echo to test this script # Don't use :- since 4.3BSD and earlier shells don't like it. doit="${DOITPROG-}" # put in absolute paths if you don't have them in your path; or use env. vars. mvprog="${MVPROG-mv}" cpprog="${CPPROG-cp}" chmodprog="${CHMODPROG-chmod}" chownprog="${CHOWNPROG-chown}" chgrpprog="${CHGRPPROG-chgrp}" stripprog="${STRIPPROG-strip}" rmprog="${RMPROG-rm}" mkdirprog="${MKDIRPROG-mkdir}" transformbasename="" transform_arg="" instcmd="$mvprog" chmodcmd="$chmodprog 0755" chowncmd="" chgrpcmd="" stripcmd="" rmcmd="$rmprog -f" mvcmd="$mvprog" src="" dst="" dir_arg="" while [ x"$1" != x ]; do case $1 in -c) instcmd="$cpprog" shift continue;; -d) dir_arg=true shift continue;; -m) chmodcmd="$chmodprog $2" shift shift continue;; -o) chowncmd="$chownprog $2" shift shift continue;; -g) chgrpcmd="$chgrpprog $2" shift shift continue;; -s) stripcmd="$stripprog" shift continue;; -t=*) transformarg=`echo $1 | sed 's/-t=//'` shift continue;; -b=*) transformbasename=`echo $1 | sed 's/-b=//'` shift continue;; *) if [ x"$src" = x ] then src=$1 else # this colon is to work around a 386BSD /bin/sh bug : dst=$1 fi shift continue;; esac done if [ x"$src" = x ] then echo "install: no input file specified" exit 1 else true fi if [ x"$dir_arg" != x ]; then dst=$src src="" if [ -d $dst ]; then instcmd=: chmodcmd="" else instcmd=mkdir fi else # Waiting for this to be detected by the "$instcmd $src $dsttmp" command # might cause directories to be created, which would be especially bad # if $src (and thus $dsttmp) contains '*'. if [ -f $src -o -d $src ] then true else echo "install: $src does not exist" exit 1 fi if [ x"$dst" = x ] then echo "install: no destination specified" exit 1 else true fi # If destination is a directory, append the input filename; if your system # does not like double slashes in filenames, you may need to add some logic if [ -d $dst ] then dst="$dst"/`basename $src` else true fi fi ## this sed command emulates the dirname command dstdir=`echo $dst | sed -e 's,[^/]*$,,;s,/$,,;s,^$,.,'` # Make sure that the destination directory exists. # this part is taken from Noah Friedman's mkinstalldirs script # Skip lots of stat calls in the usual case. if [ ! -d "$dstdir" ]; then defaultIFS=' ' IFS="${IFS-${defaultIFS}}" oIFS="${IFS}" # Some sh's can't handle IFS=/ for some reason. IFS='%' set - `echo ${dstdir} | sed -e 's@/@%@g' -e 's@^%@/@'` IFS="${oIFS}" pathcomp='' while [ $# -ne 0 ] ; do pathcomp="${pathcomp}${1}" shift if [ ! -d "${pathcomp}" ] ; then $mkdirprog "${pathcomp}" else true fi pathcomp="${pathcomp}/" done fi if [ x"$dir_arg" != x ] then $doit $instcmd $dst && if [ x"$chowncmd" != x ]; then $doit $chowncmd $dst; else true ; fi && if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dst; else true ; fi && if [ x"$stripcmd" != x ]; then $doit $stripcmd $dst; else true ; fi && if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dst; else true ; fi else # If we're going to rename the final executable, determine the name now. if [ x"$transformarg" = x ] then dstfile=`basename $dst` else dstfile=`basename $dst $transformbasename | sed $transformarg`$transformbasename fi # don't allow the sed command to completely eliminate the filename if [ x"$dstfile" = x ] then dstfile=`basename $dst` else true fi # Make a temp file name in the proper directory. dsttmp=$dstdir/#inst.$$# # Move or copy the file name to the temp name $doit $instcmd $src $dsttmp && trap "rm -f ${dsttmp}" 0 && # and set any options; do chmod last to preserve setuid bits # If any of these fail, we abort the whole thing. If we want to # ignore errors from any of these, just make sure not to ignore # errors from the above "$doit $instcmd $src $dsttmp" command. if [ x"$chowncmd" != x ]; then $doit $chowncmd $dsttmp; else true;fi && if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dsttmp; else true;fi && if [ x"$stripcmd" != x ]; then $doit $stripcmd $dsttmp; else true;fi && if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dsttmp; else true;fi && # Now rename the file to the real destination. $doit $rmcmd -f $dstdir/$dstfile && $doit $mvcmd $dsttmp $dstdir/$dstfile fi && exit 0 nsd-3.2.16/rrl.h0000664000175000017500000000407512160066241012327 0ustar matjematje/* rrl.h - Response Rate Limiting for NSD. * By W.C.A. Wijngaards * Copyright 2012, NLnet Labs. * BSD, see LICENSE. */ #ifndef RRL_H #define RRL_H #include "query.h" /** the classification types for the rrl */ enum rrl_type { /* classification types */ rrl_type_nxdomain = 0x01, rrl_type_error = 0x02, rrl_type_referral = 0x04, rrl_type_any = 0x08, rrl_type_wildcard = 0x10, rrl_type_nodata = 0x20, rrl_type_dnskey = 0x40, rrl_type_positive = 0x80, rrl_type_rrsig = 0x100, /* all classification types */ rrl_type_all = 0x1ff, /* to distinguish between ip4 and ip6 netblocks, used in code */ rrl_ip6 = 0x8000 }; /** Number of buckets */ #define RRL_BUCKETS 1000000 /** default rrl limit, in 2x qps , the default is 200 qps */ #define RRL_LIMIT 400 /** default slip */ #define RRL_SLIP 2 /** default prefix lengths */ #define RRL_IPV4_PREFIX_LENGTH 24 #define RRL_IPV6_PREFIX_LENGTH 64 /** default whitelist rrl limit, in 2x qps, default is thus 2000 qps */ #define RRL_WLIST_LIMIT 4000 /** * Initialize for n children (optional, otherwise no mmaps used) * ratelimits lm and wlm are in qps (this routines x2s them for internal use). * plf and pls are in prefix lengths. */ void rrl_mmap_init(int numch, size_t numbuck, size_t lm, size_t wlm, size_t sm, size_t plf, size_t pls); /** * Initialize rate limiting (for this child server process) */ void rrl_init(size_t ch); /** * Process query that happens, the query structure contains the * information about the query and the answer. * returns true if the query is ratelimited. */ int rrl_process_query(query_type* query); /** * Deny the query, with slip. * Returns DISCARD or PROCESSED(with TC flag). */ query_state_type rrl_slip(query_type* query); /** convert classification type to string */ const char* rrltype2str(enum rrl_type c); /** convert string to classification type */ enum rrl_type rrlstr2type(const char* s); /** for unit test, update rrl bucket; return rate */ uint32_t rrl_update(query_type* query, uint32_t hash, uint64_t source, uint16_t flags, int32_t now, uint32_t lm); #endif /* RRL_H */ nsd-3.2.16/buffer.c0000664000175000017500000000522311761673243013004 0ustar matjematje/* * buffer.c -- generic memory buffer . * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include "buffer.h" static void buffer_cleanup(void *arg) { buffer_type *buffer = (buffer_type *) arg; assert(!buffer->_fixed); free(buffer->_data); } buffer_type * buffer_create(region_type *region, size_t capacity) { buffer_type *buffer = (buffer_type *) region_alloc(region, sizeof(buffer_type)); if (!buffer) return NULL; buffer->_data = (uint8_t *) xalloc(capacity); buffer->_position = 0; buffer->_limit = buffer->_capacity = capacity; buffer->_fixed = 0; buffer_invariant(buffer); region_add_cleanup(region, buffer_cleanup, buffer); return buffer; } void buffer_create_from(buffer_type *buffer, void *data, size_t size) { assert(data); buffer->_position = 0; buffer->_limit = buffer->_capacity = size; buffer->_data = (uint8_t *) data; buffer->_fixed = 1; buffer_invariant(buffer); } void buffer_clear(buffer_type *buffer) { buffer_invariant(buffer); buffer->_position = 0; buffer->_limit = buffer->_capacity; } void buffer_flip(buffer_type *buffer) { buffer_invariant(buffer); buffer->_limit = buffer->_position; buffer->_position = 0; } void buffer_rewind(buffer_type *buffer) { buffer_invariant(buffer); buffer->_position = 0; } void buffer_set_capacity(buffer_type *buffer, size_t capacity) { buffer_invariant(buffer); assert(buffer->_position <= capacity); buffer->_data = (uint8_t *) xrealloc(buffer->_data, capacity); buffer->_limit = buffer->_capacity = capacity; } void buffer_reserve(buffer_type *buffer, size_t amount) { buffer_invariant(buffer); assert(!buffer->_fixed); if (buffer->_capacity < buffer->_position + amount) { size_t new_capacity = buffer->_capacity * 3 / 2; if (new_capacity < buffer->_position + amount) { new_capacity = buffer->_position + amount; } buffer_set_capacity(buffer, new_capacity); } buffer->_limit = buffer->_capacity; } int buffer_printf(buffer_type *buffer, const char *format, ...) { va_list args; int written; size_t remaining; buffer_invariant(buffer); assert(buffer->_limit == buffer->_capacity); remaining = buffer_remaining(buffer); va_start(args, format); written = vsnprintf((char *) buffer_current(buffer), remaining, format, args); va_end(args); if (written >= 0 && (size_t) written >= remaining) { buffer_reserve(buffer, written + 1); va_start(args, format); written = vsnprintf((char *) buffer_current(buffer), buffer_remaining(buffer), format, args); va_end(args); } buffer->_position += written; return written; } nsd-3.2.16/dbaccess.c0000664000175000017500000003037311761673243013306 0ustar matjematje/* * dbaccess.c -- access methods for nsd(8) database * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #include "config.h" #include #include #include #include #include #include #include #include /* DEBUG */ #include "dns.h" #include "namedb.h" #include "util.h" #include "options.h" int namedb_lookup(struct namedb *db, const dname_type *dname, domain_type **closest_match, domain_type **closest_encloser) { return domain_table_search( db->domains, dname, closest_match, closest_encloser); } static int read_magic(namedb_type *db) { char buf[NAMEDB_MAGIC_SIZE]; if (fread(buf, sizeof(char), sizeof(buf), db->fd) != sizeof(buf)) return 0; return memcmp(buf, NAMEDB_MAGIC, NAMEDB_MAGIC_SIZE) == 0; } static const dname_type * read_dname(FILE *fd, region_type *region) { uint8_t size; uint8_t temp[MAXDOMAINLEN]; if (fread(&size, sizeof(uint8_t), 1, fd) != 1) return NULL; if (fread(temp, sizeof(uint8_t), size, fd) != size) return NULL; return dname_make(region, temp, 1); } static int read_size(namedb_type *db, uint32_t *result) { if (fread(result, sizeof(*result), 1, db->fd) == 1) { *result = ntohl(*result); return 1; } else { return 0; } } static domain_type * read_domain(namedb_type *db, uint32_t domain_count, domain_type **domains) { uint32_t domain_number; if (!read_size(db, &domain_number)) return NULL; if (domain_number == 0 || domain_number > domain_count) return NULL; return domains[domain_number - 1]; } static zone_type * read_zone(namedb_type *db, uint32_t zone_count, zone_type **zones) { uint32_t zone_number; if (!read_size(db, &zone_number)) return NULL; if (zone_number == 0 || zone_number > zone_count) return NULL; return zones[zone_number - 1]; } static int read_rdata_atom(namedb_type *db, uint16_t type, int index, uint32_t domain_count, domain_type **domains, rdata_atom_type *result) { uint8_t data[65536]; if (rdata_atom_is_domain(type, index)) { result->domain = read_domain(db, domain_count, domains); if (!result->domain) return 0; } else { uint16_t size; if (fread(&size, sizeof(size), 1, db->fd) != 1) return 0; size = ntohs(size); if (fread(data, sizeof(uint8_t), size, db->fd) != size) return 0; result->data = (uint16_t *) region_alloc( db->region, sizeof(uint16_t) + size); memcpy(result->data, &size, sizeof(uint16_t)); memcpy((uint8_t *) result->data + sizeof(uint16_t), data, size); } return 1; } static rrset_type * read_rrset(namedb_type *db, uint32_t domain_count, domain_type **domains, uint32_t zone_count, zone_type **zones) { rrset_type *rrset; int i, j; domain_type *owner; uint16_t type; uint16_t klass; uint32_t soa_minimum; owner = read_domain(db, domain_count, domains); if (!owner) return NULL; rrset = (rrset_type *) region_alloc(db->region, sizeof(rrset_type)); rrset->zone = read_zone(db, zone_count, zones); if (!rrset->zone) return NULL; if (fread(&type, sizeof(type), 1, db->fd) != 1) return NULL; type = ntohs(type); if (fread(&klass, sizeof(klass), 1, db->fd) != 1) return NULL; klass = ntohs(klass); if (fread(&rrset->rr_count, sizeof(rrset->rr_count), 1, db->fd) != 1) return NULL; rrset->rr_count = ntohs(rrset->rr_count); rrset->rrs = (rr_type *) region_alloc( db->region, rrset->rr_count * sizeof(rr_type)); assert(rrset->rr_count > 0); for (i = 0; i < rrset->rr_count; ++i) { rr_type *rr = &rrset->rrs[i]; rr->owner = owner; rr->type = type; rr->klass = klass; if (fread(&rr->rdata_count, sizeof(rr->rdata_count), 1, db->fd) != 1) return NULL; rr->rdata_count = ntohs(rr->rdata_count); rr->rdatas = (rdata_atom_type *) region_alloc( db->region, rr->rdata_count * sizeof(rdata_atom_type)); if (fread(&rr->ttl, sizeof(rr->ttl), 1, db->fd) != 1) return NULL; rr->ttl = ntohl(rr->ttl); for (j = 0; j < rr->rdata_count; ++j) { if (!read_rdata_atom(db, rr->type, j, domain_count, domains, &rr->rdatas[j])) return NULL; } } domain_add_rrset(owner, rrset); if (rrset_rrtype(rrset) == TYPE_SOA) { assert(owner == rrset->zone->apex); rrset->zone->soa_rrset = rrset; /* BUG #103 add another soa with a tweaked ttl */ rrset->zone->soa_nx_rrset = region_alloc(db->region, sizeof(rrset_type)); rrset->zone->soa_nx_rrset->rrs = region_alloc(db->region, rrset->rr_count * sizeof(rr_type)); memcpy(rrset->zone->soa_nx_rrset->rrs, rrset->rrs, sizeof(rr_type)); rrset->zone->soa_nx_rrset->rr_count = 1; rrset->zone->soa_nx_rrset->next = 0; /* also add a link to the zone */ rrset->zone->soa_nx_rrset->zone = rrset->zone; /* check the ttl and MINIMUM value and set accordinly */ memcpy(&soa_minimum, rdata_atom_data(rrset->rrs->rdatas[6]), rdata_atom_size(rrset->rrs->rdatas[6])); if (rrset->rrs->ttl > ntohl(soa_minimum)) { rrset->zone->soa_nx_rrset->rrs[0].ttl = ntohl(soa_minimum); } owner->has_SOA = 1; } else if (owner == rrset->zone->apex && rrset_rrtype(rrset) == TYPE_NS) { rrset->zone->ns_rrset = rrset; } #ifdef NSEC3 #ifndef FULL_PREHASH else if (type == TYPE_NSEC3) { if (0 != namedb_add_nsec3_domain(db, owner, rrset->zone)) { return NULL; } } #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ if (rrset_rrtype(rrset) == TYPE_RRSIG && owner == rrset->zone->apex) { for (i = 0; i < rrset->rr_count; ++i) { if (rr_rrsig_type_covered(&rrset->rrs[i]) == TYPE_DNSKEY) { rrset->zone->is_secure = 1; break; } } } return rrset; } struct namedb * namedb_open (const char *filename, nsd_options_t* opt, size_t num_children) { namedb_type *db; /* * Temporary region used while loading domain names from the * database. The region is freed after each time a dname is * read from the database. */ region_type *dname_region; /* * Temporary region used to store array of domains and zones * while loading the database. The region is freed before * returning. */ region_type *temp_region; uint32_t dname_count; domain_type **domains; /* Indexed by domain number. */ uint32_t zone_count; zone_type **zones; /* Indexed by zone number. */ uint32_t i; uint32_t rrset_count = 0; uint32_t rr_count = 0; rrset_type *rrset; DEBUG(DEBUG_DBACCESS, 2, (LOG_INFO, "sizeof(namedb_type) = %lu\n", (unsigned long) sizeof(namedb_type))); DEBUG(DEBUG_DBACCESS, 2, (LOG_INFO, "sizeof(zone_type) = %lu\n", (unsigned long) sizeof(zone_type))); DEBUG(DEBUG_DBACCESS, 2, (LOG_INFO, "sizeof(domain_type) = %lu\n", (unsigned long) sizeof(domain_type))); DEBUG(DEBUG_DBACCESS, 2, (LOG_INFO, "sizeof(rrset_type) = %lu\n", (unsigned long) sizeof(rrset_type))); DEBUG(DEBUG_DBACCESS, 2, (LOG_INFO, "sizeof(rr_type) = %lu\n", (unsigned long) sizeof(rr_type))); DEBUG(DEBUG_DBACCESS, 2, (LOG_INFO, "sizeof(rdata_atom_type) = %lu\n", (unsigned long) sizeof(rdata_atom_type))); DEBUG(DEBUG_DBACCESS, 2, (LOG_INFO, "sizeof(rbnode_t) = %lu\n", (unsigned long) sizeof(rbnode_t))); if ((db = namedb_create()) == NULL) { log_msg(LOG_ERR, "insufficient memory to create database"); return NULL; } db->filename = region_strdup(db->region, filename); if (gettimeofday(&(db->diff_timestamp), NULL) != 0) { log_msg(LOG_ERR, "unable to load %s: cannot initialize" "timestamp", db->filename); namedb_destroy(db); return NULL; } /* Open it... */ db->fd = fopen(db->filename, "r"); if (db->fd == NULL) { log_msg(LOG_ERR, "unable to load %s: %s", db->filename, strerror(errno)); namedb_destroy(db); return NULL; } if (!read_magic(db)) { log_msg(LOG_ERR, "corrupted database (read magic): %s", db->filename); log_msg(LOG_ERR, "cannot load database, incompatible version " "number. Please rebuild database and " "start again."); namedb_close(db); return NULL; } if (!read_size(db, &zone_count)) { log_msg(LOG_ERR, "corrupted database (read size): %s", db->filename); namedb_close(db); return NULL; } DEBUG(DEBUG_DBACCESS, 1, (LOG_INFO, "Retrieving %lu zones\n", (unsigned long) zone_count)); temp_region = region_create(xalloc, free); dname_region = region_create(xalloc, free); db->zone_count = zone_count; zones = (zone_type **) region_alloc(temp_region, zone_count * sizeof(zone_type *)); for (i = 0; i < zone_count; ++i) { const dname_type *dname = read_dname(db->fd, dname_region); if (!dname) { log_msg(LOG_ERR, "corrupted database (read dname): %s", db->filename); region_destroy(dname_region); region_destroy(temp_region); namedb_close(db); return NULL; } zones[i] = (zone_type *) region_alloc(db->region, sizeof(zone_type)); zones[i]->next = db->zones; db->zones = zones[i]; zones[i]->apex = domain_table_insert(db->domains, dname); zones[i]->soa_rrset = NULL; zones[i]->soa_nx_rrset = NULL; zones[i]->ns_rrset = NULL; #ifdef NSEC3 zones[i]->nsec3_soa_rr = NULL; zones[i]->nsec3_last = NULL; #endif zones[i]->opts = zone_options_find(opt, domain_dname(zones[i]->apex)); zones[i]->number = i + 1; zones[i]->is_secure = 0; zones[i]->updated = 1; zones[i]->is_ok = 0; zones[i]->dirty = region_alloc(db->region, sizeof(uint8_t)*num_children); memset(zones[i]->dirty, 0, sizeof(uint8_t)*num_children); if(!zones[i]->opts) { log_msg(LOG_ERR, "cannot load database. Zone %s in db " "%s, but not in config file (might " "happen if you edited the config " "file). Please rebuild database and " "start again.", dname_to_string(dname, NULL), db->filename); region_destroy(dname_region); region_destroy(temp_region); namedb_close(db); return NULL; } #ifdef NSEC3 #ifndef FULL_PREHASH zones[i]->nsec3_domains = NULL; if (0 != zone_nsec3_domains_create(db, zones[i])) { log_msg(LOG_ERR, "insufficient memory for NSEC3 tree, " "unable to read database"); region_destroy(dname_region); region_destroy(temp_region); namedb_close(db); return NULL; } #endif /* !FULL_PREHASH */ #endif /* NSEC3 */ region_free_all(dname_region); } if (!read_size(db, &dname_count)) { log_msg(LOG_ERR, "corrupted database (read size): %s", db->filename); region_destroy(dname_region); region_destroy(temp_region); namedb_close(db); return NULL; } DEBUG(DEBUG_DBACCESS, 1, (LOG_INFO, "Retrieving %lu domain names\n", (unsigned long) dname_count)); domains = (domain_type **) region_alloc( temp_region, dname_count * sizeof(domain_type *)); for (i = 0; i < dname_count; ++i) { const dname_type *dname = read_dname(db->fd, dname_region); if (!dname) { log_msg(LOG_ERR, "corrupted database (read dname): %s", db->filename); region_destroy(dname_region); region_destroy(temp_region); namedb_close(db); return NULL; } domains[i] = domain_table_insert(db->domains, dname); region_free_all(dname_region); } region_destroy(dname_region); #ifndef NDEBUG fprintf(stderr, "database region after loading domain names: "); region_dump_stats(db->region, stderr); fprintf(stderr, "\n"); #endif while ((rrset = read_rrset(db, dname_count, domains, zone_count, zones))) { ++rrset_count; rr_count += rrset->rr_count; } DEBUG(DEBUG_DBACCESS, 1, (LOG_INFO, "Retrieved %lu RRs in %lu RRsets\n", (unsigned long) rr_count, (unsigned long) rrset_count)); region_destroy(temp_region); if ((db->crc_pos = ftello(db->fd)) == -1) { log_msg(LOG_ERR, "ftello %s failed: %s", db->filename, strerror(errno)); namedb_close(db); return NULL; } if (!read_size(db, &db->crc)) { log_msg(LOG_ERR, "corrupted database (read size): %s", db->filename); namedb_close(db); return NULL; } if (!read_magic(db)) { log_msg(LOG_ERR, "corrupted database (read magic): %s", db->filename); log_msg(LOG_ERR, "cannot load database, incompatible version " "number. Please rebuild database and " "start again."); namedb_close(db); return NULL; } fclose(db->fd); db->fd = NULL; #ifndef NDEBUG fprintf(stderr, "database region after loading database: "); region_dump_stats(db->region, stderr); fprintf(stderr, "\n"); #endif return db; } void namedb_close (struct namedb *db) { namedb_fd_close(db); if (db) { namedb_destroy(db); } } void namedb_fd_close (struct namedb *db) { if (db && db->fd) { fclose(db->fd); } } nsd-3.2.16/nsd.h0000664000175000017500000001277112163044664012326 0ustar matjematje/* * nsd.h -- nsd(8) definitions and prototypes * * Copyright (c) 2001-2011, NLnet Labs. All rights reserved. * * See LICENSE for the license. * */ #ifndef _NSD_H_ #define _NSD_H_ #include #include "dns.h" #include "edns.h" #include "util.h" struct netio_handler; struct nsd_options; /* The NSD runtime states and NSD ipc command values */ #define NSD_RUN 0 #define NSD_RELOAD 1 #define NSD_SHUTDOWN 2 #define NSD_STATS 3 #define NSD_REAP_CHILDREN 4 #define NSD_QUIT 5 /* * NSD_SOA_INFO is followed by u16(len in network byte order), dname, * and then nothing (no info) or soa info. */ #define NSD_SOA_INFO 6 /* * PASS_TO_XFRD is followed by the u16(len in network order) and * then network packet contents. packet is a notify(acl checked), or * xfr reply from a master(acl checked). * followed by u32(acl number that matched from notify/xfr acl). */ #define NSD_PASS_TO_XFRD 7 /* * NSD_ZONE_STATE is followed by u16(len in network byte order), * octet 0: zone is expired, 1: zone ok. and dname of zone. */ #define NSD_ZONE_STATE 8 /* * SOA BEGIN is sent at the start of a reload SOA_INFO pass * xfrd will not send to the parent (deadlock prevention). */ #define NSD_SOA_BEGIN 9 /* * SOA END is sent at the end of a reload SOA_INFO pass. * xfrd then knows that reload phase is over. */ #define NSD_SOA_END 10 /* * QUIT_SYNC is sent to signify a synchronisation of ipc * channel content during reload */ #define NSD_QUIT_SYNC 11 /* * QUIT_CHILD is sent at exit, to make sure the child has exited so that * port53 is free when all of nsd's processes have exited at shutdown time */ #define NSD_QUIT_CHILD 12 #define NSD_SERVER_MAIN 0x0U #define NSD_SERVER_UDP 0x1U #define NSD_SERVER_TCP 0x2U #define NSD_SERVER_BOTH (NSD_SERVER_UDP | NSD_SERVER_TCP) #ifdef INET6 #define DEFAULT_AI_FAMILY AF_UNSPEC #else #define DEFAULT_AI_FAMILY AF_INET #endif #ifdef BIND8_STATS #define LASTELEM(arr) (sizeof(arr) / sizeof(arr[0]) - 1) #define STATUP(nsd, stc) nsd->st.stc++ #define STATUP2(nsd, stc, i) nsd->st.stc[(i) <= (LASTELEM(nsd->st.stc) - 1) ? i : LASTELEM(nsd->st.stc)]++ # ifdef USE_ZONE_STATS # define ZTATUP(zone, stc) zone->st.stc++ # define ZTATUP2(zone, stc, i) zone->st.stc[(i) <= (LASTELEM(zone->st.stc) - 1) ? i : LASTELEM(zone->st.stc)]++ # else # define ZTATUP(zone, stc) /* Nothing */ # define ZTATUP2(zone, stc, i) /* Nothing */ # endif /* USE_ZONE_STATS */ #else /* BIND8_STATS */ #define STATUP(nsd, stc) /* Nothing */ #define STATUP2(nsd, stc, i) /* Nothing */ #define ZTATUP(zone, stc) /* Nothing */ #define ZTATUP2(zone, stc, i) /* Nothing */ #endif /* BIND8_STATS */ struct nsd_socket { struct addrinfo * addr; int s; }; struct nsd_child { /* The type of child process (UDP or TCP handler). */ int kind; /* The child's process id. */ pid_t pid; /* * Socket used by the parent process to send commands and * receive responses to/from this child process. */ int child_fd; /* * Socket used by the child process to receive commands and * send responses from/to the parent process. */ int parent_fd; /* * IPC info, buffered for nonblocking writes to the child */ uint8_t need_to_send_STATS, need_to_send_QUIT; uint8_t need_to_exit, has_exited; stack_type* dirty_zones; /* stack of type zone_type* */ /* * The handler for handling the commands from the child. */ struct netio_handler* handler; }; /* NSD configuration and run-time variables */ typedef struct nsd nsd_type; struct nsd { /* * Global region that is not deallocated until NSD shuts down. */ region_type *region; /* Run-time variables */ pid_t pid; volatile sig_atomic_t mode; volatile sig_atomic_t signal_hint_reload; volatile sig_atomic_t signal_hint_child; volatile sig_atomic_t signal_hint_quit; volatile sig_atomic_t signal_hint_shutdown; volatile sig_atomic_t signal_hint_stats; volatile sig_atomic_t signal_hint_statsusr; volatile sig_atomic_t quit_sync_done; unsigned server_kind; struct namedb *db; int debug; size_t child_count; struct nsd_child *children; /* NULL if this is the parent process. */ struct nsd_child *this_child; /* Configuration */ const char *dbfile; const char *pidfile; #ifdef USE_ZONE_STATS const char *zonestatsfile; #endif const char *log_filename; const char *username; uid_t uid; gid_t gid; const char *chrootdir; const char *version; const char *identity; uint16_t nsid_len; unsigned char *nsid; uint8_t file_rotation_ok; /* number of interfaces, ifs < MAX_INTERFACES */ size_t ifs; uint8_t grab_ip6_optional; /* TCP specific configuration */ struct nsd_socket tcp[MAX_INTERFACES]; /* UDP specific configuration */ struct nsd_socket udp[MAX_INTERFACES]; edns_data_type edns_ipv4; #if defined(INET6) edns_data_type edns_ipv6; #endif int maximum_tcp_count; int current_tcp_count; int tcp_query_count; int tcp_timeout; size_t ipv4_edns_size; size_t ipv6_edns_size; #ifdef BIND8_STATS struct nsdst st; #endif /* BIND8_STATS */ struct nsd_options* options; }; /* nsd.c */ pid_t readpid(const char *file); int writepid(struct nsd *nsd); void unlinkpid(const char* file); void sig_handler(int sig); void bind8_stats(struct nsd *nsd); /* server.c */ int server_init(struct nsd *nsd); int server_prepare(struct nsd *nsd); void server_main(struct nsd *nsd); void server_child(struct nsd *nsd); void server_shutdown(struct nsd *nsd); void server_close_all_sockets(struct nsd_socket sockets[], size_t n); /* extra domain numbers for temporary domains */ #define EXTRA_DOMAIN_NUMBERS 1024 #endif /* _NSD_H_ */