unbound: Vendor import 1.19.1

Release notes at
    https://www.nlnetlabs.nl/news/2024/Feb/13/unbound-1.19.1-released/

Security:	CVE-2023-50387, CVE-2023-50868
Security:       FreeBSD-SA-24:03.unbound
Approved by:    so

(cherry picked from commit 8f76bb7dad48538c6832c2fb466a433d2a3f8cd5)
(cherry picked from commit 1b5982339ced0f39ef588a07a3e960954e87c65e)
(cherry picked from commit 948e11aaf420cd7d493cc2e118cacc06d18653fe)
(cherry picked from commit 9afc0c849e6e0436351fbdaf6157d1c822793d80)
(cherry picked from commit 6e71235e558ef579605e7f35b02f983b9a246a4a)
(cherry picked from commit 8a9416b18f8a894c4bb0c3a284746d5e0bc81152)
(cherry picked from commit 103ba509e72e3949d22485666949e9705d4af8cd)
(cherry picked from commit 4631a5104763c01123dad62546b1325cb16bf44c)
(cherry picked from commit 5aab39b24ce7437265b94461ffdd9b12c0723658)
(cherry picked from commit a118088ff3741023c24caeff1a4fff7b660817fd)
(cherry picked from commit 67267734315c6a48db31697f0a0669fa1f985969)
(cherry picked from commit 1318715277325a508ad5b76c8cd9c17c8146693b)
(cherry picked from commit b76ef9a7cb8a7c62d10ae8101f41014f34819174)
(cherry picked from commit e2b44c401cc2a59da8c4c0515c6bcb533d09cc73)

1 files changed, 41 insertions, 0 deletions

diff --git a/contrib/unbound/util/net_help.h b/contrib/unbound/util/net_help.h
index f1881b3ed0ca..edaea42353d4 100644
--- a/contrib/unbound/util/net_help.h
+++ b/contrib/unbound/util/net_help.h
@@ -332,6 +332,29 @@ void addr_to_str(struct sockaddr_storage* addr, socklen_t addrlen,
 	char* buf, size_t len);
 
 /**
+ * Check if the prefix network length is one of the allowed 32, 40, 48, 56, 64,
+ * or 96.
+ * @param prefixnet: prefix network length to check.
+ * @return 1 on success, 0 on failure.
+ */
+int prefixnet_is_nat64(int prefixnet);
+
+/**
+ * Create a NAT64 address from a given address (needs to be IPv4) and a given
+ * NAT64 prefix. The NAT64 prefix net needs to be one of 32, 40, 48, 56, 64, 96.
+ * @param addr: IPv4 address.
+ * @param nat64_prefix: NAT64 prefix.
+ * @param nat64_prefixlen: NAT64 prefix len.
+ * @param nat64_prefixnet: NAT64 prefix mask.
+ * @param nat64_addr: the resulting NAT64 address.
+ * @param nat64_addrlen: the resulting NAT64 address length.
+ */
+void addr_to_nat64(const struct sockaddr_storage* addr,
+	const struct sockaddr_storage* nat64_prefix,
+	socklen_t nat64_prefixlen, int nat64_prefixnet,
+	struct sockaddr_storage* nat64_addr, socklen_t* nat64_addrlen);
+
+/**
  * See if sockaddr is an ipv6 mapped ipv4 address, "::ffff:0.0.0.0"
  * @param addr: address
  * @param addrlen: length of address
@@ -407,6 +430,24 @@ void log_crypto_err(const char* str);
 void log_crypto_err_code(const char* str, unsigned long err);
 
 /**
+ * Log an error from libcrypto that came from SSL_write and so on, with
+ * a value from SSL_get_error, calls log_err. If that fails it logs with
+ * log_crypto_err.
+ * @param str: what failed
+ * @param r: output of SSL_get_error on the I/O operation result.
+ */
+void log_crypto_err_io(const char* str, int r);
+
+/**
+ * Log an error from libcrypt that came from an I/O routine with the
+ * errcode from ERR_get_error. Calls log_err() and log_crypto_err_code.
+ * @param str: what failed
+ * @param r: output of SSL_get_error on the I/O operation result.
+ * @param err: error code from ERR_get_error
+ */
+void log_crypto_err_io_code(const char* str, int r, unsigned long err);
+
+/**
  * Log certificate details verbosity, string, of X509 cert
  * @param level: verbosity level
  * @param str: string to prefix on output