From 5bea29b01cdd79262dd19f27e03527c9e625ccb0 Mon Sep 17 00:00:00 2001
From: "W.C.A. Wijngaards" <wouter@nlnetlabs.nl>
Date: Tue, 23 Jul 2024 09:47:42 +0200
Subject: [PATCH] - For #1110: Test for fallthrough attribute in configure and
 add   fallthrough attribute annotations.

---
 config.h.in             |   6 ++
 configure               |  69 ++++++++++++
 configure.ac            |  41 ++++++++
 dns64/dns64.c           |   1 +
 doc/Changelog           |   5 +
 libunbound/libworker.c  |   3 +-
 services/cache/dns.c    |   1 +
 services/rpz.c          |  24 +++--
 sldns/parseutil.c       |   9 ++
 sldns/wire2str.c        |   1 +
 util/data/msgparse.c    |   1 +
 util/netevent.c         |   1 +
 util/proxy_protocol.c   |   1 +
 util/siphash.c          |   6 ++
 util/storage/lookup3.c  | 227 +++++++++++++++++++++++++++++++---------
 validator/val_secalgo.c |   3 +
 16 files changed, 345 insertions(+), 54 deletions(-)

diff --git a/config.h.in b/config.h.in
index 88347fe4d..4a7143c52 100644
--- a/config.h.in
+++ b/config.h.in
@@ -1,5 +1,8 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */
 
+/* apply the fallthrough attribute. */
+#undef ATTR_FALLTHROUGH
+
 /* apply the noreturn attribute to a function that exits the program */
 #undef ATTR_NORETURN
 
@@ -57,6 +60,9 @@
 /* Define to 1 if you have the <arpa/inet.h> header file. */
 #undef HAVE_ARPA_INET_H
 
+/* Whether the C compiler accepts the "fallthrough" attribute */
+#undef HAVE_ATTR_FALLTHROUGH
+
 /* Whether the C compiler accepts the "format" attribute */
 #undef HAVE_ATTR_FORMAT
 
diff --git a/configure b/configure
index 9dc603045..9998b36e4 100755
--- a/configure
+++ b/configure
@@ -7026,6 +7026,75 @@ printf "%s\n" "#define ATTR_NORETURN __attribute__((__noreturn__))" >>confdefs.h
 fi
 
 
+
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking whether the C compiler (${CC-cc}) accepts the \"fallthrough\" attribute" >&5
+printf %s "checking whether the C compiler (${CC-cc}) accepts the \"fallthrough\" attribute... " >&6; }
+BAKCFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -Werror"
+if test ${ac_cv_c_fallthrough_attribute+y}
+then :
+  printf %s "(cached) " >&6
+else $as_nop
+  ac_cv_c_fallthrough_attribute=no
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+ #include <stdio.h>
+void f(int x) {
+	int y = 0;
+	switch(x) {
+	case 1:
+		y = 1;
+		__attribute__((fallthrough));
+		/* fallthrough */
+	case 2:
+		y++;
+		break;
+	case 3:
+		y = 3;
+		break;
+	}
+	printf("%d", y);
+}
+
+int
+main (void)
+{
+
+   f(1);
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_compile "$LINENO"
+then :
+  ac_cv_c_fallthrough_attribute="yes"
+else $as_nop
+  ac_cv_c_fallthrough_attribute="no"
+fi
+rm -f core conftest.err conftest.$ac_objext conftest.beam conftest.$ac_ext
+
+fi
+
+CFLAGS="$BAKCFLAGS"
+
+{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: $ac_cv_c_fallthrough_attribute" >&5
+printf "%s\n" "$ac_cv_c_fallthrough_attribute" >&6; }
+if test $ac_cv_c_fallthrough_attribute = yes; then
+
+printf "%s\n" "#define HAVE_ATTR_FALLTHROUGH 1" >>confdefs.h
+
+
+printf "%s\n" "#define ATTR_FALLTHROUGH __attribute__((fallthrough));" >>confdefs.h
+
+else
+
+printf "%s\n" "#define ATTR_FALLTHROUGH /**/" >>confdefs.h
+
+fi
+
+
 if test "$srcdir" != "."; then
 	CPPFLAGS="$CPPFLAGS -I$srcdir"
 fi
diff --git a/configure.ac b/configure.ac
index 5597abb88..6adbe0e59 100644
--- a/configure.ac
+++ b/configure.ac
@@ -365,6 +365,47 @@ fi
 
 CHECK_NORETURN_ATTRIBUTE
 
+AC_DEFUN([CHECK_FALLTHROUGH_ATTRIBUTE],
+[AC_REQUIRE([AC_PROG_CC])
+AC_MSG_CHECKING(whether the C compiler (${CC-cc}) accepts the "fallthrough" attribute)
+BAKCFLAGS="$CFLAGS"
+CFLAGS="$CFLAGS -Werror"
+AC_CACHE_VAL(ac_cv_c_fallthrough_attribute,
+[ac_cv_c_fallthrough_attribute=no
+AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include <stdio.h>
+void f(int x) {
+	int y = 0;
+	switch(x) {
+	case 1:
+		y = 1;
+		__attribute__((fallthrough));
+		/* fallthrough */
+	case 2:
+		y++;
+		break;
+	case 3:
+		y = 3;
+		break;
+	}
+	printf("%d", y);
+}
+]], [[
+   f(1);
+]])],[ac_cv_c_fallthrough_attribute="yes"],[ac_cv_c_fallthrough_attribute="no"])
+])
+CFLAGS="$BAKCFLAGS"
+
+AC_MSG_RESULT($ac_cv_c_fallthrough_attribute)
+if test $ac_cv_c_fallthrough_attribute = yes; then
+  AC_DEFINE(HAVE_ATTR_FALLTHROUGH, 1, [Whether the C compiler accepts the "fallthrough" attribute])
+  AC_DEFINE(ATTR_FALLTHROUGH, [__attribute__((fallthrough));], [apply the fallthrough attribute.])
+else
+  AC_DEFINE(ATTR_FALLTHROUGH,[], [apply the fallthrough attribute.])
+fi
+])dnl End of CHECK_FALLTHROUGH_ATTRIBUTE
+
+CHECK_FALLTHROUGH_ATTRIBUTE
+
 if test "$srcdir" != "."; then
 	CPPFLAGS="$CPPFLAGS -I$srcdir"
 fi
diff --git a/dns64/dns64.c b/dns64/dns64.c
index 3a43698a8..cfb6ce63e 100644
--- a/dns64/dns64.c
+++ b/dns64/dns64.c
@@ -701,6 +701,7 @@ dns64_operate(struct module_qstate* qstate, enum module_ev event, int id,
 			iq->state = DNS64_NEW_QUERY;
 			iq->started_no_cache_store = qstate->no_cache_store;
 			qstate->no_cache_store = 1;
+			ATTR_FALLTHROUGH
   			/* fallthrough */
 		case module_event_pass:
 			qstate->ext_state[id] = handle_event_pass(qstate, id);
diff --git a/doc/Changelog b/doc/Changelog
index 6bac83a7c..221e8d02d 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,6 +1,11 @@
 23 July 2024: Yorgos
 	- Fix #1106: ratelimit-below-domain logs the wrong FROM address.
 
+23 July 2024: Wouter
+	- Merge #1110: Make fallthrough explicit for libworker.c.
+	- For #1110: Test for fallthrough attribute in configure and add
+	  fallthrough attribute annotations.
+
 19 July 2024: Wouter
 	- Add dnstap-sample-rate that logs only 1/N messages, for high volume
 	  server environments. Thanks Dan Luther.
diff --git a/libunbound/libworker.c b/libunbound/libworker.c
index 191aa0b27..94b644a49 100644
--- a/libunbound/libworker.c
+++ b/libunbound/libworker.c
@@ -292,7 +292,8 @@ libworker_do_cmd(struct libworker* w, uint8_t* msg, uint32_t len)
 			log_err("unknown command for bg worker %d", 
 				(int)context_serial_getcmd(msg, len));
 			/* and fall through to quit */
-			__attribute__((fallthrough));
+			ATTR_FALLTHROUGH
+			/* fallthrough */
 		case UB_LIBCMD_QUIT:
 			free(msg);
 			comm_base_exit(w->base);
diff --git a/services/cache/dns.c b/services/cache/dns.c
index 426c4506e..60e79a2e7 100644
--- a/services/cache/dns.c
+++ b/services/cache/dns.c
@@ -110,6 +110,7 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 			/* no break: also copy key item */
 			/* the line below is matched by gcc regex and silences
 			 * the fallthrough warning */
+			ATTR_FALLTHROUGH
 			/* fallthrough */
 		case 1: /* ref updated, item inserted */
 			rep->rrsets[i] = rep->ref[i].key;
diff --git a/services/rpz.c b/services/rpz.c
index 1223f6771..d8999a8a5 100644
--- a/services/rpz.c
+++ b/services/rpz.c
@@ -242,10 +242,14 @@ rpz_action_to_localzone_type(enum rpz_action a)
 	case RPZ_NODATA_ACTION: return local_zone_always_nodata;
 	case RPZ_DROP_ACTION: return local_zone_always_deny;
 	case RPZ_PASSTHRU_ACTION: return local_zone_always_transparent;
-	case RPZ_LOCAL_DATA_ACTION:	/* fallthrough */
+	case RPZ_LOCAL_DATA_ACTION:
+		ATTR_FALLTHROUGH
+		/* fallthrough */
 	case RPZ_CNAME_OVERRIDE_ACTION: return local_zone_redirect;
 	case RPZ_TCP_ONLY_ACTION: return local_zone_truncate;
-	case RPZ_INVALID_ACTION: /* fallthrough */
+	case RPZ_INVALID_ACTION:
+		ATTR_FALLTHROUGH
+		/* fallthrough */
 	default: return local_zone_invalid;
 	}
 }
@@ -258,10 +262,14 @@ rpz_action_to_respip_action(enum rpz_action a)
 	case RPZ_NODATA_ACTION: return respip_always_nodata;
 	case RPZ_DROP_ACTION: return respip_always_deny;
 	case RPZ_PASSTHRU_ACTION: return respip_always_transparent;
-	case RPZ_LOCAL_DATA_ACTION: /* fallthrough */
+	case RPZ_LOCAL_DATA_ACTION:
+		ATTR_FALLTHROUGH
+		/* fallthrough */
 	case RPZ_CNAME_OVERRIDE_ACTION: return respip_redirect;
 	case RPZ_TCP_ONLY_ACTION: return respip_truncate;
-	case RPZ_INVALID_ACTION: /* fallthrough */
+	case RPZ_INVALID_ACTION:
+		ATTR_FALLTHROUGH
+		/* fallthrough */
 	default: return respip_invalid;
 	}
 }
@@ -276,7 +284,9 @@ localzone_type_to_rpz_action(enum localzone_type lzt)
 	case local_zone_always_transparent: return RPZ_PASSTHRU_ACTION;
 	case local_zone_redirect: return RPZ_LOCAL_DATA_ACTION;
 	case local_zone_truncate: return RPZ_TCP_ONLY_ACTION;
-	case local_zone_invalid: /* fallthrough */
+	case local_zone_invalid:
+		ATTR_FALLTHROUGH
+		/* fallthrough */
 	default: return RPZ_INVALID_ACTION;
 	}
 }
@@ -291,7 +301,9 @@ respip_action_to_rpz_action(enum respip_action a)
 	case respip_always_transparent: return RPZ_PASSTHRU_ACTION;
 	case respip_redirect: return RPZ_LOCAL_DATA_ACTION;
 	case respip_truncate: return RPZ_TCP_ONLY_ACTION;
-	case respip_invalid: /* fallthrough */
+	case respip_invalid:
+		ATTR_FALLTHROUGH
+		/* fallthrough */
 	default: return RPZ_INVALID_ACTION;
 	}
 }
diff --git a/sldns/parseutil.c b/sldns/parseutil.c
index dd1f33484..f696c6af1 100644
--- a/sldns/parseutil.c
+++ b/sldns/parseutil.c
@@ -436,11 +436,13 @@ sldns_b32_ntop_base(const uint8_t* src, size_t src_sz, char* dst, size_t dst_sz,
 
 		/* ........ ........ ....4444 4....... ........ */
 			 c =  src[3]         >> 7 ;
+		ATTR_FALLTHROUGH
 		/* fallthrough */
 	case 3: dst[4] = b32[(src[2] & 0x0f) << 1 | c];
 
 		/* ........ .......3 3333.... ........ ........ */
 			 c =  src[2]         >> 4 ;
+		ATTR_FALLTHROUGH
 		/* fallthrough */
 	case 2:	dst[3] = b32[(src[1] & 0x01) << 4 | c];
 
@@ -449,6 +451,7 @@ sldns_b32_ntop_base(const uint8_t* src, size_t src_sz, char* dst, size_t dst_sz,
 
 		/* .....111 11...... ........ ........ ........ */
 			 c =  src[1]         >> 6 ;
+		ATTR_FALLTHROUGH
 		/* fallthrough */
 	case 1:	dst[1] = b32[(src[0] & 0x07) << 2 | c];
 
@@ -460,11 +463,14 @@ sldns_b32_ntop_base(const uint8_t* src, size_t src_sz, char* dst, size_t dst_sz,
 		switch (src_sz) {
 			case 1: dst[2] = '=';
 				dst[3] = '=';
+				ATTR_FALLTHROUGH
 				/* fallthrough */
 			case 2: dst[4] = '=';
+				ATTR_FALLTHROUGH
 				/* fallthrough */
 			case 3: dst[5] = '=';
 				dst[6] = '=';
+				ATTR_FALLTHROUGH
 				/* fallthrough */
 			case 4: dst[7] = '=';
 		}
@@ -577,17 +583,20 @@ sldns_b32_pton_base(const char* src, size_t src_sz, uint8_t* dst, size_t dst_sz,
 			/* ........ ........ ........ .55555.. ........ */
 			/* ........ ........ ....4444 4....... ........ */
 			dst[3] = buf[4] << 7 | buf[5] << 2 | buf[6] >> 3;
+			ATTR_FALLTHROUGH
 			/* fallthrough */
 
 		case 5: /* ........ ........ ....4444 4....... ........ */
 			/* ........ .......3 3333.... ........ ........ */
 			dst[2] = buf[3] << 4 | buf[4] >> 1;
+			ATTR_FALLTHROUGH
 			/* fallthrough */
 
 		case 4: /* ........ .......3 3333.... ........ ........ */
 			/* ........ ..22222. ........ ........ ........ */
 			/* .....111 11...... ........ ........ ........ */
 			dst[1] = buf[1] << 6 | buf[2] << 1 | buf[3] >> 4;
+			ATTR_FALLTHROUGH
 			/* fallthrough */
 
 		case 2: /* .....111 11...... ........ ........ ........ */
diff --git a/sldns/wire2str.c b/sldns/wire2str.c
index 6962d7bab..ff8399947 100644
--- a/sldns/wire2str.c
+++ b/sldns/wire2str.c
@@ -1241,6 +1241,7 @@ int sldns_wire2str_svcparam_scan(uint8_t** d, size_t* dlen, char** s, size_t* sl
 		r = sldns_wire2str_svcparam_ech2str(s, slen, data_len, *d);
 		break;
 	case SVCB_KEY_DOHPATH:
+		ATTR_FALLTHROUGH
 		/* fallthrough */
 	default:
 		r = sldns_str_print(s, slen, "=\"");
diff --git a/util/data/msgparse.c b/util/data/msgparse.c
index d06b7bb25..ab1e0b557 100644
--- a/util/data/msgparse.c
+++ b/util/data/msgparse.c
@@ -1091,6 +1091,7 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
 				break;
 			case COOKIE_STATUS_CLIENT_ONLY:
 				edns->cookie_client = 1;
+				ATTR_FALLTHROUGH
 				/* fallthrough */
 			case COOKIE_STATUS_FUTURE:
 			case COOKIE_STATUS_EXPIRED:
diff --git a/util/netevent.c b/util/netevent.c
index dc5fd63fa..9d5131da9 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -329,6 +329,7 @@ udp_send_errno_needs_log(struct sockaddr* addr, socklen_t addrlen)
 		case EACCES:
 			if(verbosity < VERB_ALGO)
 				return 0;
+			break;
 		default:
 			break;
 	}
diff --git a/util/proxy_protocol.c b/util/proxy_protocol.c
index a18804974..235538b62 100644
--- a/util/proxy_protocol.c
+++ b/util/proxy_protocol.c
@@ -153,6 +153,7 @@ pp2_write_to_buf(uint8_t* buf, size_t buflen,
 		break;
 #endif /* INET6 */
 	case AF_UNIX:
+		ATTR_FALLTHROUGH
 		/* fallthrough */
 	default:
 		return 0;
diff --git a/util/siphash.c b/util/siphash.c
index 32797dff6..a13657ccf 100644
--- a/util/siphash.c
+++ b/util/siphash.c
@@ -128,26 +128,32 @@ int siphash(const uint8_t *in, const size_t inlen, const uint8_t *k,
     case 7:
         b |= ((uint64_t)in[6]) << 48;
         /** EDIT annotate case statement fallthrough for gcc */
+	ATTR_FALLTHROUGH
         /* fallthrough */
     case 6:
         b |= ((uint64_t)in[5]) << 40;
         /** EDIT annotate case statement fallthrough for gcc */
+	ATTR_FALLTHROUGH
         /* fallthrough */
     case 5:
         b |= ((uint64_t)in[4]) << 32;
         /** EDIT annotate case statement fallthrough for gcc */
+	ATTR_FALLTHROUGH
         /* fallthrough */
     case 4:
         b |= ((uint64_t)in[3]) << 24;
         /** EDIT annotate case statement fallthrough for gcc */
+	ATTR_FALLTHROUGH
         /* fallthrough */
     case 3:
         b |= ((uint64_t)in[2]) << 16;
         /** EDIT annotate case statement fallthrough for gcc */
+	ATTR_FALLTHROUGH
         /* fallthrough */
     case 2:
         b |= ((uint64_t)in[1]) << 8;
         /** EDIT annotate case statement fallthrough for gcc */
+	ATTR_FALLTHROUGH
         /* fallthrough */
     case 1:
         b |= ((uint64_t)in[0]);
diff --git a/util/storage/lookup3.c b/util/storage/lookup3.c
index f2a48f413..ae7c166ec 100644
--- a/util/storage/lookup3.c
+++ b/util/storage/lookup3.c
@@ -254,11 +254,15 @@ uint32_t        initval)         /* the previous hash, or an arbitrary value */
   switch(length)                     /* all the case statements fall through */
   { 
   case 3 : c+=k[2];
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
   case 2 : b+=k[1];
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
   case 1 : a+=k[0];
     final(a,b,c);
+	ATTR_FALLTHROUGH
+	/* fallthrough */
   case 0:     /* case 0: nothing left to add */
     break;
   }
@@ -304,9 +308,15 @@ uint32_t       *pb)               /* IN: more seed OUT: secondary hash value */
   switch(length)                     /* all the case statements fall through */
   { 
   case 3 : c+=k[2];
+	ATTR_FALLTHROUGH
+	/* fallthrough */
   case 2 : b+=k[1];
+	ATTR_FALLTHROUGH
+	/* fallthrough */
   case 1 : a+=k[0];
     final(a,b,c);
+	ATTR_FALLTHROUGH
+	/* fallthrough */
   case 0:     /* case 0: nothing left to add */
     break;
   }
@@ -404,16 +414,32 @@ uint32_t hashlittle( const void *key, size_t length, uint32_t initval)
     switch(length)
     {
     case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
-    case 11: c+=((uint32_t)k8[10])<<16;  /* fall through */
-    case 10: c+=((uint32_t)k8[9])<<8;    /* fall through */
-    case 9 : c+=k8[8];                   /* fall through */
+    case 11: c+=((uint32_t)k8[10])<<16;
+	ATTR_FALLTHROUGH
+	/* fallthrough */
+    case 10: c+=((uint32_t)k8[9])<<8;
+	ATTR_FALLTHROUGH
+	/* fallthrough */
+    case 9 : c+=k8[8];
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 8 : b+=k[1]; a+=k[0]; break;
-    case 7 : b+=((uint32_t)k8[6])<<16;   /* fall through */
-    case 6 : b+=((uint32_t)k8[5])<<8;    /* fall through */
-    case 5 : b+=k8[4];                   /* fall through */
+    case 7 : b+=((uint32_t)k8[6])<<16;
+	ATTR_FALLTHROUGH
+	/* fallthrough */
+    case 6 : b+=((uint32_t)k8[5])<<8;
+	ATTR_FALLTHROUGH
+	/* fallthrough */
+    case 5 : b+=k8[4];
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 4 : a+=k[0]; break;
-    case 3 : a+=((uint32_t)k8[2])<<16;   /* fall through */
-    case 2 : a+=((uint32_t)k8[1])<<8;    /* fall through */
+    case 3 : a+=((uint32_t)k8[2])<<16;
+	ATTR_FALLTHROUGH
+	/* fallthrough */
+    case 2 : a+=((uint32_t)k8[1])<<8;
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 1 : a+=k8[0]; break;
     case 0 : return c;
     }
@@ -443,23 +469,33 @@ uint32_t hashlittle( const void *key, size_t length, uint32_t initval)
              b+=k[2]+(((uint32_t)k[3])<<16);
              a+=k[0]+(((uint32_t)k[1])<<16);
              break;
-    case 11: c+=((uint32_t)k8[10])<<16;     /* fall through */
+    case 11: c+=((uint32_t)k8[10])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 10: c+=k[4];
              b+=k[2]+(((uint32_t)k[3])<<16);
              a+=k[0]+(((uint32_t)k[1])<<16);
              break;
-    case 9 : c+=k8[8];                      /* fall through */
+    case 9 : c+=k8[8];
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 8 : b+=k[2]+(((uint32_t)k[3])<<16);
              a+=k[0]+(((uint32_t)k[1])<<16);
              break;
-    case 7 : b+=((uint32_t)k8[6])<<16;      /* fall through */
+    case 7 : b+=((uint32_t)k8[6])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 6 : b+=k[2];
              a+=k[0]+(((uint32_t)k[1])<<16);
              break;
-    case 5 : b+=k8[4];                      /* fall through */
+    case 5 : b+=k8[4];
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 4 : a+=k[0]+(((uint32_t)k[1])<<16);
              break;
-    case 3 : a+=((uint32_t)k8[2])<<16;      /* fall through */
+    case 3 : a+=((uint32_t)k8[2])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 2 : a+=k[0];
              break;
     case 1 : a+=k8[0];
@@ -494,27 +530,38 @@ uint32_t hashlittle( const void *key, size_t length, uint32_t initval)
     switch(length)                   /* all the case statements fall through */
     {
     case 12: c+=((uint32_t)k[11])<<24;
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 11: c+=((uint32_t)k[10])<<16;
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 10: c+=((uint32_t)k[9])<<8;
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 9 : c+=k[8];
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 8 : b+=((uint32_t)k[7])<<24;
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 7 : b+=((uint32_t)k[6])<<16;
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 6 : b+=((uint32_t)k[5])<<8;
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 5 : b+=k[4];
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 4 : a+=((uint32_t)k[3])<<24;
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 3 : a+=((uint32_t)k[2])<<16;
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 2 : a+=((uint32_t)k[1])<<8;
-  	/* fallthrough */
+	ATTR_FALLTHROUGH
+	/* fallthrough */
     case 1 : a+=k[0];
              break;
     case 0 : return c;
@@ -603,16 +650,32 @@ void hashlittle2(
     switch(length)
     {
     case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
-    case 11: c+=((uint32_t)k8[10])<<16;  /* fall through */
-    case 10: c+=((uint32_t)k8[9])<<8;    /* fall through */
-    case 9 : c+=k8[8];                   /* fall through */
+    case 11: c+=((uint32_t)k8[10])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
+    case 10: c+=((uint32_t)k8[9])<<8;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
+    case 9 : c+=k8[8];
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 8 : b+=k[1]; a+=k[0]; break;
-    case 7 : b+=((uint32_t)k8[6])<<16;   /* fall through */
-    case 6 : b+=((uint32_t)k8[5])<<8;    /* fall through */
-    case 5 : b+=k8[4];                   /* fall through */
+    case 7 : b+=((uint32_t)k8[6])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
+    case 6 : b+=((uint32_t)k8[5])<<8;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
+    case 5 : b+=k8[4];
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 4 : a+=k[0]; break;
-    case 3 : a+=((uint32_t)k8[2])<<16;   /* fall through */
-    case 2 : a+=((uint32_t)k8[1])<<8;    /* fall through */
+    case 3 : a+=((uint32_t)k8[2])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
+    case 2 : a+=((uint32_t)k8[1])<<8;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 1 : a+=k8[0]; break;
     case 0 : *pc=c; *pb=b; return;  /* zero length strings require no mixing */
     }
@@ -642,23 +705,33 @@ void hashlittle2(
              b+=k[2]+(((uint32_t)k[3])<<16);
              a+=k[0]+(((uint32_t)k[1])<<16);
              break;
-    case 11: c+=((uint32_t)k8[10])<<16;     /* fall through */
+    case 11: c+=((uint32_t)k8[10])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 10: c+=k[4];
              b+=k[2]+(((uint32_t)k[3])<<16);
              a+=k[0]+(((uint32_t)k[1])<<16);
              break;
-    case 9 : c+=k8[8];                      /* fall through */
+    case 9 : c+=k8[8];
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 8 : b+=k[2]+(((uint32_t)k[3])<<16);
              a+=k[0]+(((uint32_t)k[1])<<16);
              break;
-    case 7 : b+=((uint32_t)k8[6])<<16;      /* fall through */
+    case 7 : b+=((uint32_t)k8[6])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 6 : b+=k[2];
              a+=k[0]+(((uint32_t)k[1])<<16);
              break;
-    case 5 : b+=k8[4];                      /* fall through */
+    case 5 : b+=k8[4];
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 4 : a+=k[0]+(((uint32_t)k[1])<<16);
              break;
-    case 3 : a+=((uint32_t)k8[2])<<16;      /* fall through */
+    case 3 : a+=((uint32_t)k8[2])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 2 : a+=k[0];
              break;
     case 1 : a+=k8[0];
@@ -693,16 +766,38 @@ void hashlittle2(
     switch(length)                   /* all the case statements fall through */
     {
     case 12: c+=((uint32_t)k[11])<<24;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 11: c+=((uint32_t)k[10])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 10: c+=((uint32_t)k[9])<<8;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 9 : c+=k[8];
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 8 : b+=((uint32_t)k[7])<<24;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 7 : b+=((uint32_t)k[6])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 6 : b+=((uint32_t)k[5])<<8;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 5 : b+=k[4];
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 4 : a+=((uint32_t)k[3])<<24;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 3 : a+=((uint32_t)k[2])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 2 : a+=((uint32_t)k[1])<<8;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 1 : a+=k[0];
              break;
     case 0 : *pc=c; *pb=b; return;  /* zero length strings require no mixing */
@@ -784,16 +879,32 @@ uint32_t hashbig( const void *key, size_t length, uint32_t initval)
     switch(length)                   /* all the case statements fall through */
     {
     case 12: c+=k[2]; b+=k[1]; a+=k[0]; break;
-    case 11: c+=((uint32_t)k8[10])<<8;  /* fall through */
-    case 10: c+=((uint32_t)k8[9])<<16;  /* fall through */
-    case 9 : c+=((uint32_t)k8[8])<<24;  /* fall through */
+    case 11: c+=((uint32_t)k8[10])<<8;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
+    case 10: c+=((uint32_t)k8[9])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
+    case 9 : c+=((uint32_t)k8[8])<<24;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 8 : b+=k[1]; a+=k[0]; break;
-    case 7 : b+=((uint32_t)k8[6])<<8;   /* fall through */
-    case 6 : b+=((uint32_t)k8[5])<<16;  /* fall through */
-    case 5 : b+=((uint32_t)k8[4])<<24;  /* fall through */
+    case 7 : b+=((uint32_t)k8[6])<<8;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
+    case 6 : b+=((uint32_t)k8[5])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
+    case 5 : b+=((uint32_t)k8[4])<<24;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 4 : a+=k[0]; break;
-    case 3 : a+=((uint32_t)k8[2])<<8;   /* fall through */
-    case 2 : a+=((uint32_t)k8[1])<<16;  /* fall through */
+    case 3 : a+=((uint32_t)k8[2])<<8;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
+    case 2 : a+=((uint32_t)k8[1])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 1 : a+=((uint32_t)k8[0])<<24; break;
     case 0 : return c;
     }
@@ -827,16 +938,38 @@ uint32_t hashbig( const void *key, size_t length, uint32_t initval)
     switch(length)                   /* all the case statements fall through */
     {
     case 12: c+=k[11];
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 11: c+=((uint32_t)k[10])<<8;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 10: c+=((uint32_t)k[9])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 9 : c+=((uint32_t)k[8])<<24;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 8 : b+=k[7];
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 7 : b+=((uint32_t)k[6])<<8;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 6 : b+=((uint32_t)k[5])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 5 : b+=((uint32_t)k[4])<<24;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 4 : a+=k[3];
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 3 : a+=((uint32_t)k[2])<<8;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 2 : a+=((uint32_t)k[1])<<16;
+	     ATTR_FALLTHROUGH
+	     /* fallthrough */
     case 1 : a+=((uint32_t)k[0])<<24;
              break;
     case 0 : return c;
diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
index 40ebb1728..be8347b1b 100644
--- a/validator/val_secalgo.c
+++ b/validator/val_secalgo.c
@@ -2060,11 +2060,13 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 		digest_size = (digest_size ? digest_size : SHA1_DIGEST_SIZE);
 #endif
 		/* double fallthrough annotation to please gcc parser */
+		ATTR_FALLTHROUGH
 		/* fallthrough */
 #ifdef USE_SHA2
 		/* fallthrough */
 	case LDNS_RSASHA256:
 		digest_size = (digest_size ? digest_size : SHA256_DIGEST_SIZE);
+		ATTR_FALLTHROUGH
 		/* fallthrough */
 	case LDNS_RSASHA512:
 		digest_size = (digest_size ? digest_size : SHA512_DIGEST_SIZE);
@@ -2080,6 +2082,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
 #ifdef USE_ECDSA
 	case LDNS_ECDSAP256SHA256:
 		digest_size = (digest_size ? digest_size : SHA256_DIGEST_SIZE);
+		ATTR_FALLTHROUGH
 		/* fallthrough */
 	case LDNS_ECDSAP384SHA384:
 		digest_size = (digest_size ? digest_size : SHA384_DIGEST_SIZE);