* SECURITY UPDATE: unbounded cryptographic work in DNSSEC validation (KeyTrap). A crafted signed zone could force the validator into the cross product of a DNSKEY RRset's members and an RRset's signatures, stalling the resolver on signature verification. - src/config.h, src/dnsmasq.h, src/dnssec.c, src/forward.c, src/option.c, src/rrfilter.c, man/dnsmasq.8: cap the resources spent validating one query - 20 signature failures per RRset, 200 crypto operations per query, 40 DS/DNSKEY sub-queries per query - and abandon validation with SERVFAIL once a limit is hit; rework validate-by-DS to iterate over supported digest types rather than over every DNSKEY; add --dnssec-limits to override the defaults. - src/dnsmasq.h, src/dnsmasq.c: daemon->rr_status becomes an unsigned long TTL-ceiling array, as required by the imported validation code (upstream ae7a3b9d, first released in 2.81). - src/forward.c: keep the check-unsigned argument of the TCP validation path equal to the UDP one. The imported patch negates it, which is right for 2.90, where the option flag was renamed and inverted (OPT_DNSSEC_IGN_NS, set by --dnssec-check-unsigned=no), and wrong for 2.79, where OPT_DNSSEC_NO_SIGN is still set by --dnssec-check-unsigned itself. - CVE-2023-50387 * SECURITY UPDATE: unbounded NSEC3 hash iterations (KeyTrap) - src/config.h, src/dnssec.c, src/option.c: bound NSEC3 iterations at 150 per RFC 9276 instead of the previous 2500, and count each hash against the per-query crypto budget. - CVE-2023-50868