Merge branch 'master' into simdzone-zone-load

$INCLUDE in a zonefile read.

.github/workflows/analysis_ports.yml

@@ -173,10 +173,40 @@ jobs:
             cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
  
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
         with:
-          submodules: false
+          submodules: recursive
           persist-credentials: false
+      - name: test_windows_configure
+        if: ${{ matrix.test_windows == 'yes' }}
+        shell: bash
+        run: |
+          # The run starts with mount points for /c, /d, and
+          # C:/Program Files/Git on /
+          # C:/Program Files/Git/usr/bin on /bin
+          # C:/Users/RUNNER~1/AppData/Local/Temp on /tmp
+          echo "mount"
+          mount || echo "ignored"
+          echo "mount -o bind /c/msys64/usr /usr"
+          mount -o bind /c/msys64/usr /usr || echo "ignored"
+          # Now there is:
+          # C:/msys64 on /
+          # C:/msys64/usr/bin on /bin
+          # And those mount points should go away for the next 'run:' shell.
+          echo "mount"
+          mount || echo "ignored"
+          # probably installs to C:\msys64\usr\bin\bash.exe
+          echo "pacman -S --noconfirm autotools"
+          C:/msys64/usr/bin/pacman -S --noconfirm autotools
+          echo "rm -f aclocal.m4"
+          rm -f aclocal.m4
+          # The paths are mounted, so that /c/msys64/usr/share/autoconf-..,
+          # /c/msys64/usr/share/aclocal-.., /c/msys64/usr/share/automake-..
+          # are in /usr. Also for /usr/bin, autoreconf is from
+          # /c/msys64/usr/bin.
+          echo "autoreconf -fi"
+          #PATH="/c/msys64/usr/bin:$PATH" autoreconf -fi || echo "ignored"
+          autoreconf -fi
       - name: test_windows
         if: ${{ matrix.test_windows == 'yes' }}
         env:
@@ -189,8 +219,9 @@ jobs:
           cd ..
           export prepath=`pwd`
           echo prepath=${prepath}
-          # parralel build option
-          export MINJ="-j4"
+          # The mount should have the git directories.
+          echo "mount"
+          mount || echo "ignored"
           echo "choco install winflexbison3"
           choco install winflexbison3
           echo 'LEX="win_flex"'
@@ -208,13 +239,13 @@ jobs:
           #sed -e 's/use Pod::Usage//' < Configure > Configure.fix
           # ./Configure.fix no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl"
           # pacman is used to install for msys2, with
-          # C:/msys64/usr/bin/pacman -S perl
+          # C:/msys64/usr/bin/pacman -S --noconfirm perl
           echo "C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix=\""$prepath/openssl"\" PERL=\"C:/msys64/usr/bin/perl\""
           C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl" PERL="C:/msys64/usr/bin/perl"
           # make the libs only, build faster
           echo "make build_libs"
-          #make $MINJ
-          make $MINJ build_libs
+          #make
+          make build_libs
           mv Makefile Makefile.orig
           # fixup \\ in the installtop to /.
           echo "fixup INSTALLTOP"
@@ -246,7 +277,7 @@ jobs:
           mv xmlwf/Makefile xmlwf/Makefile.orig
           sed -e 's/SHELL/SHELLZZ/g' < xmlwf/Makefile.orig > xmlwf/Makefile
           echo "make"
-          make $MINJ
+          make
           echo "make install"
           make install
           cd ..
@@ -254,7 +285,7 @@ jobs:
           cd unbound
           echo "./configure --enable-debug --enable-static-exe --disable-flto \"--with-ssl=$prepath/openssl\" --with-libexpat=\"$prepath/expat\" --disable-shared"
           ./configure --enable-debug --enable-static-exe --disable-flto "--with-ssl=$prepath/openssl" --with-libexpat="$prepath/expat" --disable-shared
-          make $MINJ
+          make
           # specific test output
           #make testbound.exe; ./testbound.exe -s
           #make testbound; ./testbound.exe -p testdata/acl.rpl -o -vvvv
@@ -297,6 +328,8 @@ jobs:
           ./contrib/android/install_expat.sh
           echo "::endgroup::"
           echo "::group::configure"
+          echo "autoreconf -fi"
+          autoreconf -fi
           echo "./configure ${CONFIG_OPTS}"
           ./configure ${CONFIG_OPTS}
           echo "::endgroup::"
@@ -316,6 +349,7 @@ jobs:
           IOS_CPU: ${{ matrix.IOS_CPU }}
         run: |
           #(already installed) ./contrib/ios/install_tools.sh
+          brew install autoconf automake libtool make
           export AUTOTOOLS_BUILD="$(./config.guess)"
           echo AUTOTOOLS_BUILD=${AUTOTOOLS_BUILD}
           export IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
@@ -337,6 +371,8 @@ jobs:
           ./contrib/ios/install_expat.sh
           echo "::endgroup::"
           echo "::group::configure"
+          echo "autoreconf -fi"
+          autoreconf -fi
           echo "./configure ${CONFIG_OPTS}"
           ./configure ${CONFIG_OPTS}
           echo "::endgroup::"
@@ -349,7 +385,7 @@ jobs:
           echo "::endgroup::"
       - name: cross-platform-action on ${{ matrix.cross_platform_os }} ${{ matrix.cross_platform_version }}
         if: ${{ matrix.with_cross_platform_action == 'yes' }}
-        uses: cross-platform-actions/action@v1.0.0
+        uses: cross-platform-actions/action@v0.25.0
         env:
           CROSS_PLATFORM_OS: ${{ matrix.cross_platform_os }}
         with:
@@ -362,10 +398,12 @@ jobs:
           cpu_count: 2
           run: |
             set -e -x
-            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y openssl libevent expat; fi
-            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add libevent; fi
-            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install libevent; fi
+            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y autoconf automake libtool pkgconf openssl libevent expat; fi
+            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add autoconf-2.71 automake-1.16.5 libtool pkgconf libevent; export AUTOCONF_VERSION="2.71"; export AUTOMAKE_VERSION="1.16"; fi
+            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install autoconf automake libtool pkgconf libevent; export LDFLAGS="-Wl,--rpath=/usr/pkg/lib"; fi
             echo "::group::configure"
+            rm -f aclocal.m4
+            autoreconf -fi
             ./configure ${{ matrix.cross_platform_config }}
             echo "::endgroup::"
             echo "::group::make"
@@ -379,10 +417,15 @@ jobs:
         run: sudo apt-get install libevent-dev
       - name: install expat
         if: ${{ matrix.install_expat == 'yes' }}
-        run: brew install expat
+        run: |
+          brew install expat
+          brew install autoconf automake libtool make
       - name: configure
         if: ${{ matrix.config != 'no' }}
-        run: ./configure ${{ matrix.config }}
+        run: |
+          if test `uname` = "Linux"; then sudo apt-get install autoconf automake libtool make; fi
+          autoreconf -fi
+          ./configure ${{ matrix.config }}
       - name: make
         if: ${{ matrix.make != 'no' }}
         run: make

.github/workflows/ci.yml

@@ -12,11 +12,16 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
       with:
+        submodules: recursive
         persist-credentials: false
+    - name: install packages
+      run: sudo apt-get install autoconf automake libtool make
     - name: configure
-      run: ./configure --enable-debug
+      run: |
+        autoreconf -fi
+        ./configure --enable-debug
     - name: make
       run: make
     - name: make test

.gitignore

@@ -3,11 +3,17 @@
 /.libs/
 /.source
 /Makefile
+/aclocal.m4
 /autom4te.cache/
+/config.guess
 /config.h
+/config.h.in
 /config.h.in~
 /config.log
 /config.status
+/config.sub
+/configure
+/configure~
 /dnstap/dnstap_config.h
 /dnscrypt/dnscrypt_config.h
 /util/configlexer.c
@@ -22,8 +28,10 @@
 /doc/unbound-host.1
 /doc/unbound.8
 /doc/unbound.conf.5
+/install-sh
 /libtool
 /libunbound.la
+/ltmain.sh
 /_unbound.la
 /smallapp/unbound-control-setup.sh
 /unbound

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "simdzone"]
+	path = simdzone
+	url = https://github.com/NLnetLabs/simdzone.git

Makefile.in

@@ -56,7 +56,7 @@ YACC=@YACC@
 LEX=@LEX@
 STRIP=@STRIP@
 CC=@CC@
-CPPFLAGS=-I. @CPPFLAGS@
+CPPFLAGS=-I. @CPPFLAGS@ -Isimdzone/include -I@srcdir@/simdzone/include
 PYTHON_CPPFLAGS=-I. -I$(srcdir) @PYTHON_CPPFLAGS@
 CFLAGS=-DSRCDIR=$(srcdir) @CFLAGS@
 LDFLAGS=@LDFLAGS@
@@ -267,6 +267,7 @@ LIBUNBOUND_SRC=libunbound/context.c libunbound/libunbound.c \
 libunbound/libworker.c
 LIBUNBOUND_OBJ=context.lo libunbound.lo libworker.lo ub_event_pluggable.lo
 LIBUNBOUND_OBJ_LINK=$(LIBUNBOUND_OBJ) $(COMMON_OBJ_WITHOUT_UB_EVENT) $(SLDNS_OBJ) $(COMPAT_OBJ)
+SIMDZONE_OBJ=@SIMDZONE_OBJ@
 
 # win apps or "" if not on windows
 WINAPPS=@WINAPPS@
@@ -364,19 +365,24 @@ longtest:	tests
 	if test ! $(srcdir)/testdata -ef ./testdata; then rm -rf testcode testdata; mkdir testcode testdata; cp -R $(srcdir)/testdata/*.sh $(srcdir)/testdata/*.tdir $(srcdir)/testdata/*.rpl $(srcdir)/testdata/*.crpl testdata; cp $(srcdir)/testcode/*.sh testcode; if test ! -d util; then mkdir util; fi; cp $(srcdir)/util/iana_ports.inc util; fi
 	if test -x "`which bash`"; then bash testcode/do-tests.sh; else sh testcode/do-tests.sh; fi
 
+simdzone/libzone.la:
+	$(MAKE) -C simdzone
+
+simdzone/include/zone/export.h: simdzone/libzone.la
+
 lib:	libunbound.la unbound.h
 
-libunbound.la:	$(LIBUNBOUND_OBJ_LINK)
-	$(LINK_LIB) $(UBSYMS) -o $@ $(LIBUNBOUND_OBJ_LINK) -rpath $(libdir) $(SSLLIB) $(LIBS)
+libunbound.la:	simdzone/libzone.la $(LIBUNBOUND_OBJ_LINK)
+	$(LINK_LIB) $(UBSYMS) -o $@ $(LIBUNBOUND_OBJ_LINK) $(SIMDZONE_OBJ) -rpath $(libdir) $(SSLLIB) $(LIBS)
 
 unbound$(EXEEXT):	$(DAEMON_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
 
 unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 unbound-control$(EXEEXT):	$(CONTROL_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 unbound-host$(EXEEXT):	$(HOST_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(HOST_OBJ_LINK) libunbound.la $(SSLLIB) $(LIBS)
@@ -394,43 +400,43 @@ anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(ANCHORUPD_OBJ_LINK) libunbound.la $(LIBS)
 
 unittest$(EXEEXT):	$(UNITTEST_OBJ_LINK)
-	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 testbound$(EXEEXT):	$(TESTBOUND_OBJ_LINK)
-	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ_LINK)
-	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 petal$(EXEEXT):	$(PETAL_OBJ_LINK)
 	$(LINK) -o $@ $(PETAL_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 pktview$(EXEEXT):	$(PKTVIEW_OBJ_LINK)
-	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 memstats$(EXEEXT):	$(MEMSTATS_OBJ_LINK)
-	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(ASYNCLOOK_OBJ_LINK) libunbound.la $(SSLLIB) $(LIBS)
 
 streamtcp$(EXEEXT):	$(STREAMTCP_OBJ_LINK)
-	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 dohclient$(EXEEXT):	$(DOHCLIENT_OBJ_LINK)
-	$(LINK) -o $@ $(DOHCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DOHCLIENT_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 doqclient$(EXEEXT):	$(DOQCLIENT_OBJ_LINK)
-	$(LINK) -o $@ $(DOQCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DOQCLIENT_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 perf$(EXEEXT):	$(PERF_OBJ_LINK)
-	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 delayer$(EXEEXT):	$(DELAYER_OBJ_LINK)
-	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 readzone$(EXEEXT):	$(READZONE_OBJ_LINK)
-	$(LINK) -o $@ $(READZONE_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(READZONE_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 signit$(EXEEXT):	testcode/signit.c
 	$(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@ -o $@ testcode/signit.c $(LDFLAGS) -lldns $(SSLLIB) $(LIBS)
@@ -458,7 +464,7 @@ dnstap/dnstap.pb-c.h: dnstap/dnstap.pb-c.c
 	touch $@
 
 unbound-dnstap-socket$(EXEEXT):	$(DNSTAP_SOCKET_OBJ_LINK)
-	$(LINK) -o $@ $(DNSTAP_SOCKET_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DNSTAP_SOCKET_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h
 dtstream.lo dtstream.o: $(srcdir)/dnstap/dtstream.c config.h $(srcdir)/dnstap/dtstream.h
@@ -522,7 +528,9 @@ util/configparser.c:  $(srcdir)/util/configparser.y
 util/configparser.h: util/configparser.c
 	touch $@
 
-clean:
+.PHONY: .clean .distclean .maintainer-clean .realclean .devclean
+
+.clean:
 	rm -f *.o *.d *.lo *~ tags
 	rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup libunbound.la unbound.h
 	rm -f $(ALL_SRC:.c=.lint)
@@ -530,19 +538,37 @@ clean:
 	rm -f libunbound.a
 	rm -rf autom4te.cache .libs build doc/html doc/xml
 
-distclean: clean
+.distclean: .clean
 	rm -f config.status config.log config.h
 	rm -f doc/example.conf doc/libunbound.3 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound-control.8 doc/unbound.8 doc/unbound.conf.5 doc/unbound-host.1
 	rm -f smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service
 	rm -f $(TEST_BIN)
 	rm -f Makefile
 
-maintainer-clean: distclean
+.maintainer-clean: .distclean
 	rm -f util/configlexer.c util/configparser.c util/configparser.h
 
-realclean: maintainer-clean
+.realclean: .maintainer-clean
 	rm -f configure config.h.in config.sub config.guess ltmain.sh aclocal.m4 libtool
 
+.devclean: .realclean
+	rm -f config.h.in configure
+
+clean: .clean
+	$(MAKE) -C simdzone clean
+
+distclean: .distclean
+	$(MAKE) -C simdzone distclean
+
+realclean: .realclean
+	$(MAKE) -C simdzone realclean
+
+maintainer-clean: .maintainer-clean
+	$(MAKE) -C simdzone maintainer-clean
+
+devclean: .devclean
+	$(MAKE) -C simdzone devclean
+
 .SUFFIXES: .lint
 .c.lint:
 	$(LINT) $(LINTFLAGS) -I. -I$(srcdir) $<
@@ -703,6 +729,7 @@ depend:
 			-e 's?$$(srcdir)/edns-subnet/subnetmod.h $$(srcdir)/edns-subnet/subnet-whitelist.h $$(srcdir)/edns-subnet/edns-subnet.h $$(srcdir)/edns-subnet/addrtree.h?$$(SUBNET_HEADER)?g' \
 			-e 's?$$(srcdir)/ipsecmod/ipsecmod.h $$(srcdir)/ipsecmod/ipsecmod-whitelist.h?$$(IPSECMOD_HEADER)?g' \
 			-e 's?$$(srcdir)/dynlibmod/dynlibmod.h?$$(DYNLIBMOD_HEADER)?g' \
+			-e 's?$$(srcdir)/simdzone/include/zone/export.h?simdzone/include/zone/export.h?g' \
 			-e 's!\(.*\)\.o[ :]*!\1.lo \1.o: !g' \
 			> $(DEPEND_TMP)
 	cp $(DEPEND_TARGET) $(DEPEND_TMP2)
@@ -1000,7 +1027,9 @@ authzone.lo authzone.o: $(srcdir)/services/authzone.c config.h $(srcdir)/service
  $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
  $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/keyraw.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_secalgo.h \
- $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_utils.h
+ $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_utils.h \
+ $(srcdir)/simdzone/include/zone.h $(srcdir)/simdzone/include/zone/attributes.h \
+ simdzone/include/zone/export.h
 fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \

README

@@ -1,4 +1,5 @@
 Unbound README
+* From source repository: git submodule update --init && autoreconf -fi
 * ./configure && make && make install
 * You can use libevent if you want. libevent is useful when using 
   many (10000) outgoing ports. By default max 256 ports are opened at

README.md

@@ -19,6 +19,14 @@ You can learn more about Unbound by reading our
 Make sure you have the C toolchain, OpenSSL and its include files, and libexpat
 installed.
 If building from the repository source you also need flex and bison installed.
+If building from the repository source, also init the git submodule and
+create the configure script with:
+
+```
+git submodule update --init
+autoreconf -fi
+```
+
 Unbound can be compiled and installed using:
 
 ```

cachedb/cachedb.c

@@ -754,10 +754,8 @@ cachedb_intcache_store(struct module_qstate* qstate, int msg_expired,
 			"(original ttl: %d)", (int)original_ttl);
 		/* The expired entry does not get checked by the validator
 		 * and we need a validation value for it. */
-		/* By setting this to unchecked, bogus data is not returned
-		 * as non-bogus. */
 		if(qstate->env->cfg->cachedb_check_when_serve_expired)
-			qstate->return_msg->rep->security = sec_status_unchecked;
+			qstate->return_msg->rep->security = sec_status_insecure;
 	}
 	(void)dns_cache_store(qstate->env, &qstate->qinfo,
 		qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
@@ -805,11 +803,8 @@ cachedb_handle_query(struct module_qstate* qstate,
 		return;
 	}
 
-	if(qstate->blacklist || qstate->no_cache_lookup
-		|| iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL,
-		NULL, 0)) {
-		/* cache is blacklisted or we are instructed from edns to not
-		 * look or a forwarder/stub forbids it */
+	if(qstate->blacklist || qstate->no_cache_lookup) {
+		/* cache is blacklisted or we are instructed from edns to not look */
 		/* pass request to next module */
 		qstate->ext_state[id] = module_wait_module;
 		return;
@@ -897,9 +892,7 @@ cachedb_handle_response(struct module_qstate* qstate,
 {
 	qstate->is_cachedb_answer = 0;
 	/* check if we are not enabled or instructed to not cache, and skip */
-	if(!ie->enabled || qstate->no_cache_store
-		|| iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL,
-		NULL, 0)) {
+	if(!ie->enabled || qstate->no_cache_store) {
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
 		return;

compat/chacha_private.h

@@ -48,8 +48,8 @@ typedef struct
   a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \
   c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);
 
-static const char ATTR_NONSTRING(sigma[16]) = "expand 32-byte k";
-static const char ATTR_NONSTRING(tau[16]) = "expand 16-byte k";
+static const char sigma[16] = "expand 32-byte k";
+static const char tau[16] = "expand 16-byte k";
 
 static void
 chacha_keysetup(chacha_ctx *x,const u8 *k,u32 kbits,u32 ATTR_UNUSED(ivbits))

compat/gmtime_r.c

@@ -42,7 +42,10 @@ static const int	year_lengths[2] = {
 };
 
 static void
-timesub(const time_t * const timep, const long offset, struct tm * const tmp)
+timesub(timep, offset, tmp)
+const time_t * const			timep;
+const long				offset;
+struct tm * const		tmp;
 {
 	long			days;
 	long			rem;

configure.ac

@@ -11,15 +11,15 @@ sinclude(dnscrypt/dnscrypt.m4)
 
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[25])
-m4_define([VERSION_MICRO],[2])
+m4_define([VERSION_MINOR],[24])
+m4_define([VERSION_MICRO],[3])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=38
+LIBUNBOUND_REVISION=36
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -122,9 +122,7 @@ LIBUNBOUND_AGE=1
 # 1.24.0 had 9:33:1
 # 1.24.1 had 9:34:1
 # 1.24.2 had 9:35:1
-# 1.25.0 had 9:36:1
-# 1.25.1 had 9:37:1
-# 1.25.2 had 9:38:1
+# 1.24.3 had 9:36:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -179,6 +177,12 @@ else
 	else on_mingw="no"; fi
 fi
 
+dnl install the install-sh file with libtoolize -ci, and autoreconf -fi.
+AC_REQUIRE_AUX_FILE([install-sh])
+if test ! -f install-sh; then
+    AC_MSG_WARN([./install-sh is missing, use `libtoolize -ci` or `autoreconf -fi` to add it])
+fi
+
 #
 # Determine configuration file
 # the eval is to evaluate shell expansion twice
@@ -733,76 +737,6 @@ int main(void) {return 0;}
 		])
 fi
 
-if test x_$ub_have_pthreads != x_no; then
-	# Long checks to support pthread_setname_np().
-	# Some OSes have the extra non-portable functions in a specific
-	# header file.
-	AC_CHECK_HEADERS([pthread_np.h],,, [AC_INCLUDES_DEFAULT])
-	BAKCFLAGS="$CFLAGS"
-	CFLAGS="$CFLAGS -Werror"
-	# MacOS only has 1 argument, the name.
-	AC_MSG_CHECKING([whether pthread_setname_np has only 1 argument])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_setname_np("");
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP1, 1, [Define if pthread_setname_np has only 1 argument.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	# NetBSD has 3 arguments to allow for formatting of the name.
-	AC_MSG_CHECKING([whether pthread_setname_np has 3 arguments])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_setname_np(0, "", NULL);
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP3, 1, [Define if pthread_setname_np has 3 arguments.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	# Most OSes have the common 2 arguments, thread and name.
-	AC_MSG_CHECKING([whether pthread_setname_np has the common 2 arguments])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_setname_np(0, "");
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP, 1, [Define if pthread_setname_np has the common 2 arguments.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	# FreeBSD/OpenBSD use a slightly different function name.
-	AC_MSG_CHECKING([whether pthread_setname_np exists as pthread_set_name_np instead])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_set_name_np(0, "");
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SET_NAME_NP, 1, [Define if pthread_setname_np exists as pthread_set_name_np instead.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	CFLAGS="$BAKCFLAGS"
-fi
-
 # check solaris thread library
 AC_ARG_WITH(solaris-threads, AS_HELP_STRING([--with-solaris-threads],[use solaris native thread library.]), [ ],[ withval="no" ])
 ub_have_sol_threads=no
@@ -1736,22 +1670,6 @@ if test x_$withval = x_yes -o x_$withval != x_no; then
 	AC_MSG_RESULT(no)
     ])
 
-    AC_CHECK_DECL([CLOCK_MONOTONIC]
-        , []
-        , [AC_MSG_ERROR([ngtcp2 for QUIC needs at least CLOCK_MONOTONIC on the system])]
-        , [AC_INCLUDES_DEFAULT
-#ifdef TIME_WITH_SYS_TIME
-# include <sys/time.h>
-# include <time.h>
-#else
-# ifdef HAVE_SYS_TIME_H
-#  include <sys/time.h>
-# else
-#  include <time.h>
-# endif
-#endif
-        ])
-
 fi
 
 # set static linking for uninstalled libraries if requested
@@ -1857,7 +1775,6 @@ if test $ac_cv_func_daemon = yes; then
 ])
 fi
 
-AC_CHECK_MEMBERS([struct stat.st_mtimensec, struct stat.st_mtim.tv_nsec])
 AC_CHECK_MEMBERS([struct sockaddr_un.sun_len],,,[
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_SYS_UN_H
@@ -2125,6 +2042,9 @@ dt_DNSTAP([$UNBOUND_RUN_DIR/dnstap.sock],
         AC_SUBST([ENABLE_DNSTAP], [0])
     ]
 )
+dnstap_config="dnstap/dnstap_config.h.tmp:dnstap/dnstap_config.h.in"
+dnstap_config_tmp="dnstap/dnstap_config.h.tmp"
+dnstap_config_out="dnstap/dnstap_config.h"
 
 # check for dnscrypt if requested
 dnsc_DNSCRYPT([
@@ -2579,6 +2499,34 @@ AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
 AX_BUILD_DATE_EPOCH(date, [[%b %e, %Y]])
 AC_SUBST(date)
 
-AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
+AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh $dnstap_config dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
 AC_CONFIG_HEADERS([config.h])
+
+# Arguments introduced specifically for simdzone.
+AC_ARG_ENABLE(westmere, AS_HELP_STRING([--disable-westmere], [Disable Westmere (SSE4.2) parser kernel]))
+AC_ARG_ENABLE(haswell, AS_HELP_STRING([--disable-haswell], [Disable Haswell (AVX2) parser kernel]))
+if test ! -f simdzone/configure.ac; then AC_MSG_ERROR([There is no "simdzone/configure.ac" file. The simdzone directory has not been fetched, perhaps get it with 'git submodule update --init'.]); fi
+if test ! -f simdzone/configure; then AC_MSG_ERROR([There is no "simdzone/configure" file. The simdzone directory has no configure script file, perhaps run 'autoreconf -fi'.]); fi
+AC_CONFIG_SUBDIRS([simdzone])
+
 AC_OUTPUT
+# Pick up the objects for simdzone.
+SIMDZONE_OBJ=`(cd simdzone; make list_objs) | sed -e 's?src?simdzone/src?g'`
+AC_SUBST(SIMDZONE_OBJ)
+sed -e 's?^SIMDZONE_OBJ=.*$?SIMDZONE_OBJ='"$SIMDZONE_OBJ"'?' < Makefile > Makefile.tmp.$$
+mv -f Makefile.tmp.$$ Makefile
+# If dnstap config has changed, overwrite it.
+if test -n "$dnstap_config"; then
+	if test ! -f "$dnstap_config_out"; then
+		mv "$dnstap_config_tmp" "$dnstap_config_out" || AC_MSG_ERROR([Could not create $dnstap_config_out])
+	else if diff "$dnstap_config_out" "$dnstap_config_tmp" >/dev/null 2>&1; then
+		if test "x$opt_dnstap" != "xno"; then
+		  AC_MSG_NOTICE([In $srcdir: $dnstap_config_out is unchanged])
+		fi
+		rm -f "$dnstap_config_tmp"
+	else
+		rm -f "$dnstap_config_out"
+		mv "$dnstap_config_tmp" "$dnstap_config_out" || AC_MSG_ERROR([Could not create $dnstap_config_out])
+	  fi
+	fi
+fi

contrib/README

@@ -58,5 +58,3 @@ distribution but may be helpful.
 * unbound.init_yocto: An init script to start and stop the server. Put it
   in /etc/init.d/unbound to use it. It is for the Yocto Project, in
   embedded systems, contributed by beni-sandu.
-* gost12.patch: adds ECC-GOST12 support for the informational RFC9558.
-  Contributed by Igor V. Ruzanov.

contrib/gost12.patch

@@ -1,325 +0,0 @@
-diff --git a/sldns/keyraw.c b/sldns/keyraw.c
-index 42a9262a3..cc6406a56 100644
---- a/sldns/keyraw.c
-+++ b/sldns/keyraw.c
-@@ -85,7 +85,7 @@ sldns_rr_dnskey_key_size_raw(const unsigned char* keydata,
- 		}
- 		break;
- #ifdef USE_GOST
--	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 		return 512;
- #endif
- #ifdef USE_ECDSA
-@@ -146,7 +146,7 @@ sldns_key_EVP_load_gost_id(void)
- 	if(gost_id) return gost_id;
- 
- 	/* see if configuration loaded gost implementation from other engine*/
--	meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1);
-+	meth = EVP_PKEY_asn1_find_str(NULL, "gost2012_256", -1);
- 	if(meth) {
- 		EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
- 		return gost_id;
-@@ -170,7 +170,7 @@ sldns_key_EVP_load_gost_id(void)
- 		return 0;
- 	}
- 
--	meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1);
-+	meth = EVP_PKEY_asn1_find_str(&e, "gost2012_256", -1);
- 	if(!meth) {
- 		/* algo not found */
- 		ENGINE_finish(e);
-@@ -536,12 +536,17 @@ EVP_PKEY* sldns_key_rsa2pkey_raw(unsigned char* key, size_t len)
- EVP_PKEY*
- sldns_gost2pkey_raw(unsigned char* key, size_t keylen)
- {
--	/* prefix header for X509 encoding */
--	uint8_t asn[37] = { 0x30, 0x63, 0x30, 0x1c, 0x06, 0x06, 0x2a, 0x85, 
--		0x03, 0x02, 0x02, 0x13, 0x30, 0x12, 0x06, 0x07, 0x2a, 0x85, 
--		0x03, 0x02, 0x02, 0x23, 0x01, 0x06, 0x07, 0x2a, 0x85, 0x03, 
--		0x02, 0x02, 0x1e, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40};
--	unsigned char encoded[37+64];
-+	/* prefix header for X509 encoding
-+	 *
-+	 * note: based on draft-makarenko-gost2012-dnssec-01 (pre-RFC9558 and it DOES work!)
-+	 * ASN1 header described in RFC9558 is not suitable due to d2i_PUBKEY() works with
-+	 * non-compressed public keys (two additional bytes 0x04, 0x40 at the end of header)
-+	 */
-+	uint8_t asn[32] = { 0x30, 0x5e, 0x30, 0x17, 0x06, 0x08, 0x2a, 0x85,
-+			    0x03, 0x07, 0x01, 0x01, 0x01, 0x01, 0x30, 0x0b,
-+			    0x06, 0x09, 0x2a, 0x85, 0x03, 0x07, 0x01, 0x02,
-+			    0x01, 0x01, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40 };
-+	unsigned char encoded[32+64];
- 	const unsigned char* pp;
- 	if(keylen != 64) {
- 		/* key wrong size */
-@@ -549,8 +554,8 @@ sldns_gost2pkey_raw(unsigned char* key, size_t keylen)
- 	}
- 
- 	/* create evp_key */
--	memmove(encoded, asn, 37);
--	memmove(encoded+37, key, 64);
-+	memmove(encoded, asn, 32);
-+	memmove(encoded+32, key, 64);
- 	pp = (unsigned char*)&encoded[0];
- 
- 	return d2i_PUBKEY(NULL, &pp, (int)sizeof(encoded));
-diff --git a/sldns/rrdef.h b/sldns/rrdef.h
-index bbc3d5b86..7d5f3c057 100644
---- a/sldns/rrdef.h
-+++ b/sldns/rrdef.h
-@@ -384,11 +384,12 @@ enum sldns_enum_algorithm
-         LDNS_RSASHA1_NSEC3      = 7,
-         LDNS_RSASHA256          = 8,   /* RFC 5702 */
-         LDNS_RSASHA512          = 10,  /* RFC 5702 */
--        LDNS_ECC_GOST           = 12,  /* RFC 5933 */
-+        LDNS_ECC_GOST           = 12,  /* RFC 5933, deprecated */
-         LDNS_ECDSAP256SHA256    = 13,  /* RFC 6605 */
-         LDNS_ECDSAP384SHA384    = 14,  /* RFC 6605 */
- 	LDNS_ED25519		= 15,  /* RFC 8080 */
- 	LDNS_ED448		= 16,  /* RFC 8080 */
-+	LDNS_ECC_GOST12		= 23,  /* RFC 9558 */
-         LDNS_INDIRECT           = 252,
-         LDNS_PRIVATEDNS         = 253,
-         LDNS_PRIVATEOID         = 254
-@@ -402,8 +403,9 @@ enum sldns_enum_hash
- {
-         LDNS_SHA1               = 1,  /* RFC 4034 */
-         LDNS_SHA256             = 2,  /* RFC 4509 */
--        LDNS_HASH_GOST          = 3,  /* RFC 5933 */
--        LDNS_SHA384             = 4   /* RFC 6605 */
-+        LDNS_HASH_GOST          = 3,  /* RFC 5933, deprecated */
-+        LDNS_SHA384             = 4,  /* RFC 6605 */
-+        LDNS_HASH_GOST12        = 5   /* RFC 9558 */
- };
- typedef enum sldns_enum_hash sldns_hash;
- 
-diff --git a/sldns/wire2str.c b/sldns/wire2str.c
-index 75b8f37b0..b4c4755e6 100644
---- a/sldns/wire2str.c
-+++ b/sldns/wire2str.c
-@@ -45,11 +45,12 @@ static sldns_lookup_table sldns_algorithms_data[] = {
- 	{ LDNS_RSASHA1_NSEC3, "RSASHA1-NSEC3-SHA1" },
- 	{ LDNS_RSASHA256, "RSASHA256"},
- 	{ LDNS_RSASHA512, "RSASHA512"},
--	{ LDNS_ECC_GOST, "ECC-GOST"},
-+	{ LDNS_ECC_GOST, "ECC-GOST"}, /* deprecated */
- 	{ LDNS_ECDSAP256SHA256, "ECDSAP256SHA256"},
- 	{ LDNS_ECDSAP384SHA384, "ECDSAP384SHA384"},
- 	{ LDNS_ED25519, "ED25519"},
- 	{ LDNS_ED448, "ED448"},
-+	{ LDNS_ECC_GOST12, "ECC-GOST12"},
- 	{ LDNS_INDIRECT, "INDIRECT" },
- 	{ LDNS_PRIVATEDNS, "PRIVATEDNS" },
- 	{ LDNS_PRIVATEOID, "PRIVATEOID" },
-@@ -61,8 +62,9 @@ sldns_lookup_table* sldns_algorithms = sldns_algorithms_data;
- static sldns_lookup_table sldns_hashes_data[] = {
- 	{ LDNS_SHA1, "SHA1" },
- 	{ LDNS_SHA256, "SHA256" },
--	{ LDNS_HASH_GOST, "HASH-GOST" },
-+	{ LDNS_HASH_GOST, "HASH-GOST" }, /* deprecated */
- 	{ LDNS_SHA384, "SHA384" },
-+	{ LDNS_HASH_GOST12, "HASH-GOST12" },
- 	{ 0, NULL }
- };
- sldns_lookup_table* sldns_hashes = sldns_hashes_data;
-diff --git a/testcode/unitverify.c b/testcode/unitverify.c
-index fcf2e2ffe..4a33e9f6a 100644
---- a/testcode/unitverify.c
-+++ b/testcode/unitverify.c
-@@ -696,7 +696,7 @@ verify_test(void)
- #endif
- #ifdef USE_GOST
- 	if(sldns_key_EVP_load_gost_id())
--	  verifytest_file(SRCDIRSTR "/testdata/test_sigs.gost", "20090807060504");
-+	  verifytest_file(SRCDIRSTR "/testdata/test_sigs.gost12", "20251226060504");
- 	else printf("Warning: skipped GOST, openssl does not provide gost.\n");
- #endif
- #ifdef USE_ECDSA
-diff --git a/testdata/test_sigs.gost12 b/testdata/test_sigs.gost12
-new file mode 100644
-index 000000000..72a250cff
---- /dev/null
-+++ b/testdata/test_sigs.gost12
-@@ -0,0 +1,39 @@
-+; Signature test file
-+
-+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification.
-+; later entries are verified with it.
-+
-+; Test GOST signatures using algo number 23.
-+
-+ENTRY_BEGIN
-+SECTION QUESTION
-+nlnetlabs.nl.	IN DNSKEY
-+SECTION ANSWER
-+nlnetlabs.nl.   3600    IN      DNSKEY  256 3 23 cdOtkEcb6NhcdOpIbPYtWyWxdlUiKgtKQbYg3lIjtG7i3fYjUID9zyOgoQEiV9wuGCfrw5cNsnvNw+8HiVFK4g== ;{id = 12301 (zsk), size = 512b}
-+ENTRY_END
-+
-+; entry to test
-+ENTRY_BEGIN
-+SECTION QUESTION
-+open.nlnetlabs.nl. IN A
-+SECTION ANSWER
-+open.nlnetlabs.nl.      600     IN      A       213.154.224.1
-+open.nlnetlabs.nl.      600     IN      RRSIG   A 23 3 600 20260122084903 20251225084903 12301 nlnetlabs.nl. I12wYNs96DxMy26CWx296/sWMJAFg4nNXBo0sw7PnuMbJW5NFAmZYtFWhUdOWn4umaiodYOAmKG8Zg/OKvEtAQ==
-+ENTRY_END
-+
-+ENTRY_BEGIN
-+SECTION QUESTION
-+open.nlnetlabs.nl. IN AAAA
-+SECTION ANSWER
-+open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::1
-+open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::53
-+open.nlnetlabs.nl.      600     IN      RRSIG   AAAA 23 3 600 20260122084903 20251225084903 12301 nlnetlabs.nl. J0jHa+CP8HM6UDa2+uYgaze2mfpJTh2hkZ2KwMTYb5sfL6iBmxxql0c/403Itk4fMfYBMGn7zfzDQ+CxnCgSWw==
-+ENTRY_END
-+
-+ENTRY_BEGIN
-+SECTION QUESTION
-+open.nlnetlabs.nl. IN NSEC
-+SECTION ANSWER
-+open.nlnetlabs.nl.      86400   IN      NSEC    nlnetlabs.nl. A AAAA RRSIG NSEC
-+open.nlnetlabs.nl.      86400   IN      RRSIG   NSEC 23 3 86400 20260122084903 20251225084903 12301 nlnetlabs.nl. INCLYe9vAaNYaYx5Ay3Q6QdX+wPW9sMRvVlGt/jUEGgCi+88QlV80CT1oHrhRI66I14Wk6NRAGZRNx1tUPSHSg==
-+ENTRY_END
-diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
-index be8347b1b..4f621a309 100644
---- a/validator/val_secalgo.c
-+++ b/validator/val_secalgo.c
-@@ -246,10 +246,10 @@ ds_digest_size_supported(int algo)
- 			return SHA256_DIGEST_LENGTH;
- #endif
- #ifdef USE_GOST
--		case LDNS_HASH_GOST:
-+		case LDNS_HASH_GOST12:
- 			/* we support GOST if it can be loaded */
- 			(void)sldns_key_EVP_load_gost_id();
--			if(EVP_get_digestbyname("md_gost94"))
-+			if(EVP_get_digestbyname("md_gost12_256"))
- 				return 32;
- 			else	return 0;
- #endif
-@@ -265,9 +265,9 @@ ds_digest_size_supported(int algo)
- #ifdef USE_GOST
- /** Perform GOST hash */
- static int
--do_gost94(unsigned char* data, size_t len, unsigned char* dest)
-+do_gost12(unsigned char* data, size_t len, unsigned char* dest)
- {
--	const EVP_MD* md = EVP_get_digestbyname("md_gost94");
-+	const EVP_MD* md = EVP_get_digestbyname("md_gost12_256");
- 	if(!md) 
- 		return 0;
- 	return sldns_digest_evp(data, (unsigned int)len, dest, md);
-@@ -302,8 +302,8 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
- 			return 1;
- #endif
- #ifdef USE_GOST
--		case LDNS_HASH_GOST:
--			if(do_gost94(buf, len, res))
-+		case LDNS_HASH_GOST12:
-+			if(do_gost12(buf, len, res))
- 				return 1;
- 			break;
- #endif
-@@ -384,7 +384,7 @@ dnskey_algo_id_is_supported(int id)
- #endif
- 
- #ifdef USE_GOST
--	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 		/* we support GOST if it can be loaded */
- 		return sldns_key_EVP_load_gost_id();
- #endif
-@@ -612,17 +612,17 @@ setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type,
- 
- 			break;
- #ifdef USE_GOST
--		case LDNS_ECC_GOST:
-+		case LDNS_ECC_GOST12:
- 			*evp_key = sldns_gost2pkey_raw(key, keylen);
- 			if(!*evp_key) {
- 				verbose(VERB_QUERY, "verify: "
- 					"sldns_gost2pkey_raw failed");
- 				return 0;
- 			}
--			*digest_type = EVP_get_digestbyname("md_gost94");
-+			*digest_type = EVP_get_digestbyname("md_gost12_256");
- 			if(!*digest_type) {
- 				verbose(VERB_QUERY, "verify: "
--					"EVP_getdigest md_gost94 failed");
-+					"EVP_getdigest md_gost12_256 failed");
- 				return 0;
- 			}
- 			break;
-@@ -964,7 +964,7 @@ ds_digest_size_supported(int algo)
- 			return SHA384_LENGTH;
- #endif
- 		/* GOST not supported in NSS */
--		case LDNS_HASH_GOST:
-+		case LDNS_HASH_GOST12:
- 		default: break;
- 	}
- 	return 0;
-@@ -991,7 +991,7 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
- 			return HASH_HashBuf(HASH_AlgSHA384, res, buf, len)
- 				== SECSuccess;
- #endif
--		case LDNS_HASH_GOST:
-+		case LDNS_HASH_GOST12:
- 		default: 
- 			verbose(VERB_QUERY, "unknown DS digest algorithm %d", 
- 				algo);
-@@ -1031,7 +1031,7 @@ dnskey_algo_id_is_supported(int id)
- 	case LDNS_ECDSAP384SHA384:
- 		return PK11_TokenExists(CKM_ECDSA);
- #endif
--	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 	default:
- 		return 0;
- 	}
-@@ -1352,7 +1352,7 @@ nss_setup_key_digest(int algo, SECKEYPublicKey** pubkey, HASH_HashType* htype,
- 			/* no prefix for DSA verification */
- 			break;
- #endif /* USE_ECDSA */
--		case LDNS_ECC_GOST:
-+		case LDNS_ECC_GOST12:
- 		default:
- 			verbose(VERB_QUERY, "verify: unknown algorithm %d", 
- 				algo);
-@@ -1675,7 +1675,7 @@ ds_digest_size_supported(int algo)
- 			return SHA384_DIGEST_SIZE;
- #endif
- 		/* GOST not supported */
--		case LDNS_HASH_GOST:
-+		case LDNS_ECC_GOST12:
- 		default:
- 			break;
- 	}
-@@ -1700,7 +1700,7 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
- 			return _digest_nettle(SHA384_DIGEST_SIZE, buf, len, res);
- 
- #endif
--		case LDNS_HASH_GOST:
-+		case LDNS_ECC_GOST12:
- 		default:
- 			verbose(VERB_QUERY, "unknown DS digest algorithm %d",
- 				algo);
-@@ -1744,7 +1744,7 @@ dnskey_algo_id_is_supported(int id)
- 		return 1;
- #endif
- 	case LDNS_RSAMD5: /* RFC 6725 deprecates RSAMD5 */
--	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 	default:
- 		return 0;
- 	}
-@@ -2103,7 +2103,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
- 			return sec_status_secure;
- #endif
- 	case LDNS_RSAMD5:
--	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 	default:
- 		*reason = "unable to verify signature, unknown algorithm";
- 		return sec_status_bogus;

daemon/daemon.c

@@ -79,7 +79,6 @@
 #include "util/tcp_conn_limit.h"
 #include "util/edns.h"
 #include "services/listen_dnsport.h"
-#include "services/outside_network.h"
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
 #include "services/localzone.h"
@@ -200,255 +199,6 @@ signal_handling_playback(struct worker* wrk)
 	sig_record_reload = 0;
 }
 
-#ifdef HAVE_SSL
-/* setup a listening ssl context, fatal_exit() on any failure */
-static void
-setup_listen_sslctx(void** ctx, int is_dot, int is_doh,
-	struct config_file* cfg, char* chroot)
-{
-	char* key = cfg->ssl_service_key;
-	char* pem = cfg->ssl_service_pem;
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-	if(!(*ctx = listen_sslctx_create(key, pem, NULL,
-		cfg->tls_ciphers, cfg->tls_ciphersuites,
-		(cfg->tls_session_ticket_keys.first &&
-		cfg->tls_session_ticket_keys.first->str[0] != 0),
-		is_dot, is_doh, cfg->tls_protocols))) {
-		fatal_exit("could not set up listen SSL_CTX");
-	}
-}
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-void* daemon_setup_listen_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	(void)setup_listen_sslctx(&ctx, 1, 0, cfg, daemon->chroot);
-	return ctx;
-}
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-void* daemon_setup_listen_doh_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	(void)setup_listen_sslctx(&ctx, 0, 1, cfg, daemon->chroot);
-	return ctx;
-}
-#endif /* HAVE_NGHTTP2_NGHTTP2_H */
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-#ifdef HAVE_NGTCP2
-void* daemon_setup_listen_quic_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	char* chroot = daemon->chroot;
-	char* key = cfg->ssl_service_key;
-	char* pem = cfg->ssl_service_pem;
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-
-	if(!(ctx = quic_sslctx_create(key, pem, NULL))) {
-		fatal_exit("could not set up quic SSL_CTX");
-	}
-	return ctx;
-}
-#endif /* HAVE_NGTCP2 */
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-void* daemon_setup_connect_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	char* bundle, *chroot = daemon->chroot;
-	bundle = cfg->tls_cert_bundle;
-	if(chroot && bundle && strncmp(bundle, chroot, strlen(chroot)) == 0)
-		bundle += strlen(chroot);
-
-	if(!(ctx = connect_sslctx_create(NULL, NULL, bundle,
-		cfg->tls_win_cert)))
-		fatal_exit("could not set up connect SSL_CTX");
-	return ctx;
-}
-#endif /* HAVE_SSL */
-
-/* setups the needed ssl contexts, fatal_exit() on any failure */
-void
-daemon_setup_sslctxs(struct daemon* daemon, struct config_file* cfg)
-{
-#ifdef HAVE_SSL
-	char* chroot = daemon->chroot;
-	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
-		char* key = cfg->ssl_service_key;
-		char* pem = cfg->ssl_service_pem;
-		if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-			key += strlen(chroot);
-		if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-			pem += strlen(chroot);
-
-		/* setup the session keys; the callback to use them will be
-		 * attached to each sslctx separately */
-		if(cfg->tls_session_ticket_keys.first &&
-			cfg->tls_session_ticket_keys.first->str[0] != 0) {
-			if(!listen_sslctx_setup_ticket_keys(
-				cfg->tls_session_ticket_keys.first, chroot)) {
-				fatal_exit("could not set session ticket SSL_CTX");
-			}
-		}
-		daemon->listen_dot_sslctx = daemon_setup_listen_dot_sslctx(
-			daemon, cfg);
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-		if(cfg_has_https(cfg)) {
-			daemon->listen_doh_sslctx =
-				daemon_setup_listen_doh_sslctx(daemon, cfg);
-		}
-#endif
-#ifdef HAVE_NGTCP2
-		if(cfg_has_quic(cfg)) {
-			daemon->listen_quic_sslctx =
-				daemon_setup_listen_quic_sslctx(daemon, cfg);
-		}
-#endif /* HAVE_NGTCP2 */
-
-		/* Store the file name and mtime to detect changes later. */
-		daemon->ssl_service_key = strdup(cfg->ssl_service_key);
-		if(!daemon->ssl_service_key)
-			fatal_exit("could not setup ssl ctx: out of memory");
-		if(cfg->ssl_service_pem) {
-			daemon->ssl_service_pem = strdup(cfg->ssl_service_pem);
-			if(!daemon->ssl_service_pem)
-				fatal_exit("could not setup ssl ctx: out of memory");
-		} else {
-			daemon->ssl_service_pem = NULL;
-		}
-		if(!file_get_mtime(key,
-			&daemon->mtime_ssl_service_key,
-			&daemon->mtime_ns_ssl_service_key, NULL))
-			log_err("Could not stat(%s): %s",
-				key, strerror(errno));
-		if(pem) {
-			if(!file_get_mtime(pem,
-				&daemon->mtime_ssl_service_pem,
-				&daemon->mtime_ns_ssl_service_pem, NULL))
-				log_err("Could not stat(%s): %s",
-					pem, strerror(errno));
-		} else {
-			daemon->mtime_ssl_service_pem = 0;
-			daemon->mtime_ns_ssl_service_pem = 0;
-		}
-	}
-	daemon->connect_dot_sslctx = daemon_setup_connect_dot_sslctx(
-		daemon, cfg);
-#else /* HAVE_SSL */
-	(void)daemon;(void)cfg;
-#endif /* HAVE_SSL */
-}
-
-/** Delete the ssl ctxs */
-static void
-daemon_delete_sslctxs(struct daemon* daemon)
-{
-#ifdef HAVE_SSL
-	listen_sslctx_delete_ticket_keys();
-	SSL_CTX_free((SSL_CTX*)daemon->listen_dot_sslctx);
-	daemon->listen_dot_sslctx = NULL;
-	SSL_CTX_free((SSL_CTX*)daemon->listen_doh_sslctx);
-	daemon->listen_doh_sslctx = NULL;
-	SSL_CTX_free((SSL_CTX*)daemon->connect_dot_sslctx);
-	daemon->connect_dot_sslctx = NULL;
-	free(daemon->ssl_service_key);
-	daemon->ssl_service_key = NULL;
-	free(daemon->ssl_service_pem);
-	daemon->ssl_service_pem = NULL;
-#else
-	(void)daemon;
-#endif
-#ifdef HAVE_NGTCP2
-	SSL_CTX_free((SSL_CTX*)daemon->listen_quic_sslctx);
-	daemon->listen_quic_sslctx = NULL;
-#endif
-}
-
-int
-ssl_cert_changed(struct daemon* daemon, struct config_file* cfg)
-{
-	time_t mtime = 0;
-	long ns = 0;
-	char* chroot = daemon->chroot;
-	char* key = cfg->ssl_service_key;
-	char* pem = cfg->ssl_service_pem;
-	log_assert(daemon->ssl_service_key && cfg->ssl_service_key);
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-
-	if(strcmp(daemon->ssl_service_key, cfg->ssl_service_key) != 0)
-		return 1;
-	if(daemon->ssl_service_pem && cfg->ssl_service_pem &&
-	   strcmp(daemon->ssl_service_pem, cfg->ssl_service_pem) != 0)
-		return 1;
-	if(!file_get_mtime(key, &mtime, &ns, NULL)) {
-		log_err("Could not stat(%s): %s",
-			key, strerror(errno));
-		/* It has probably changed, but file read is likely going to
-		 * fail. */
-		return 0;
-	}
-	if(mtime != daemon->mtime_ssl_service_key ||
-		ns != daemon->mtime_ns_ssl_service_key)
-		return 1;
-	if(pem) {
-		if(!file_get_mtime(pem, &mtime, &ns, NULL)) {
-			log_err("Could not stat(%s): %s",
-				pem, strerror(errno));
-			/* It has probably changed, but file read is likely going to
-			 * fail. */
-			return 0;
-		}
-		if(mtime != daemon->mtime_ssl_service_pem ||
-			ns != daemon->mtime_ns_ssl_service_pem)
-			return 1;
-	}
-	return 0;
-}
-
-/** Reload the sslctxs if they have changed */
-static void
-daemon_reload_sslctxs(struct daemon* daemon)
-{
-#ifdef HAVE_SSL
-	if(daemon->cfg->ssl_service_key && daemon->cfg->ssl_service_key[0]) {
-		/* See if changed */
-		if(!daemon->ssl_service_key ||
-			ssl_cert_changed(daemon,daemon->cfg)) {
-			verbose(VERB_ALGO, "Reloading certificates");
-			daemon_delete_sslctxs(daemon);
-			daemon_setup_sslctxs(daemon, daemon->cfg);
-		}
-	} else {
-		/* See if sslctxs are removed from config. */
-		if(daemon->ssl_service_key) {
-			verbose(VERB_ALGO, "Removing certificates");
-			daemon_delete_sslctxs(daemon);
-		}
-	}
-#else
-	(void)daemon;
-#endif
-}
-
 struct daemon* 
 daemon_init(void)
 {
@@ -485,11 +235,7 @@ daemon_init(void)
 #  else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#    if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#    endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #  endif
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
 	/* grab the COMP method ptr because openssl leaks it */
@@ -498,11 +244,7 @@ daemon_init(void)
 #  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #  else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#    if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#    endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #  endif
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	if(!ub_openssl_lock_init())
@@ -814,10 +556,6 @@ daemon_create_workers(struct daemon* daemon)
 		fatal_exit("out of memory during daemon init");
 	numport = daemon_get_shufport(daemon, shufport);
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
-	if(!(daemon->shared_ports = shared_ports_create(daemon->cfg->out_ifs,
-		daemon->cfg->num_out_ifs, daemon->cfg->do_ip4,
-		daemon->cfg->do_ip6, shufport, numport)))
-		fatal_exit("could not setup shared ports: out of memory");
 
 #ifdef HAVE_NGTCP2
 	if (cfg_has_quic(daemon->cfg)) {
@@ -848,7 +586,10 @@ daemon_create_workers(struct daemon* daemon)
 #endif
 	}
 	for(i=0; i<daemon->num; i++) {
-		if(!(daemon->workers[i] = worker_create(daemon, i)))
+		if(!(daemon->workers[i] = worker_create(daemon, i,
+			shufport+numport*i/daemon->num, 
+			numport*(i+1)/daemon->num - numport*i/daemon->num)))
+			/* the above is not ports/numthr, due to rounding */
 			fatal_exit("could not create worker");
 	}
 	/* create per-worker alloc caches if not reusing existing ones. */
@@ -921,14 +662,7 @@ thread_start(void* arg)
 {
 	struct worker* worker = (struct worker*)arg;
 	int port_num = 0;
-	log_assert(worker->thr_id);
 	set_log_thread_id(worker, worker->daemon->cfg);
-	{
-		char name[16]; /* seems to be the safest size between
-				  different OSes */
-		snprintf(name, sizeof(name), "unbound/%u", worker->thread_num);
-		ub_thread_setname(worker->thr_id, name);
-	}
 	ub_thread_blocksigs();
 #ifdef THREADS_DISABLED
 	/* close pipe ends used by main */
@@ -1003,7 +737,6 @@ daemon_fork(struct daemon* daemon)
 #endif
 
 	log_assert(daemon);
-	daemon_reload_sslctxs(daemon);
 	if(!(daemon->env->views = views_create()))
 		fatal_exit("Could not create views: out of memory");
 	/* create individual views and their localzone/data trees */
@@ -1096,12 +829,6 @@ daemon_fork(struct daemon* daemon)
 	 * the thread_start() procedure.
 	 */
 	set_log_thread_id(daemon->workers[0], daemon->cfg);
-	/* If shm stats need an offset, calculate it */
-	if(daemon->cfg->shm_enable && daemon->cfg->stat_interval > 0) {
-		daemon->stat_time_specific = 1;
-		daemon->stat_time_offset =
-			((int)time(NULL))%daemon->cfg->stat_interval;
-	}
 
 #if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
 	/* in libev the first inited base gets signals */
@@ -1206,8 +933,6 @@ daemon_cleanup(struct daemon* daemon)
 	if(!daemon->reuse_cache || daemon->need_to_exit)
 		daemon_clear_allocs(daemon);
 	daemon->num = 0;
-	shared_ports_delete(daemon->shared_ports);
-	daemon->shared_ports = NULL;
 #ifdef USE_DNSTAP
 	dt_delete(daemon->dtenv);
 	daemon->dtenv = NULL;
@@ -1258,7 +983,15 @@ daemon_delete(struct daemon* daemon)
 	free(daemon->pidfile);
 	free(daemon->cfgfile);
 	free(daemon->env);
-	daemon_delete_sslctxs(daemon);
+#ifdef HAVE_SSL
+	listen_sslctx_delete_ticket_keys();
+	SSL_CTX_free((SSL_CTX*)daemon->listen_dot_sslctx);
+	SSL_CTX_free((SSL_CTX*)daemon->listen_doh_sslctx);
+	SSL_CTX_free((SSL_CTX*)daemon->connect_dot_sslctx);
+#endif
+#ifdef HAVE_NGTCP2
+	SSL_CTX_free((SSL_CTX*)daemon->listen_quic_sslctx);
+#endif
 	free(daemon);
 	/* lex cleanup */
 	ub_c_lex_destroy();

daemon/daemon.h

@@ -62,7 +62,6 @@ struct doq_table;
 struct cookie_secrets;
 struct fast_reload_thread;
 struct fast_reload_printq;
-struct shared_ports;
 
 #include "dnstap/dnstap_config.h"
 #ifdef USE_DNSTAP
@@ -98,8 +97,6 @@ struct daemon {
 	int rc_port;
 	/** listening ports for remote control */
 	struct listen_port* rc_ports;
-	/** the shared ports structure, with random ports numbers. */
-	struct shared_ports* shared_ports;
 	/** remote control connections management (for first worker) */
 	struct daemon_remote* rc;
 	/** ssl context for listening to dnstcp over ssl */
@@ -110,18 +107,6 @@ struct daemon {
 	void* listen_doh_sslctx;
 	/** ssl context for listening to quic */
 	void* listen_quic_sslctx;
-	/** the file name that the ssl context is made with, private key. */
-	char* ssl_service_key;
-	/** the file name that the ssl context is made with, certificate. */
-	char* ssl_service_pem;
-	/** modification time for ssl_service_key, in sec and ns. Like
-	 * in a struct timespec, but without that for portability. */
-	time_t mtime_ssl_service_key;
-	long mtime_ns_ssl_service_key;
-	/** modification time for ssl_service_pem, in sec and ns. Like
-	 * in a struct timespec, but without that for portability. */
-	time_t mtime_ssl_service_pem;
-	long mtime_ns_ssl_service_pem;
 	/** num threads allocated */
 	int num;
 	/** num threads allocated in the previous config or 0 at first */
@@ -158,14 +143,7 @@ struct daemon {
 	/** the dnstap environment master value, copied and changed by threads*/
 	struct dt_env* dtenv;
 #endif
-	/** The SHM info for shared memory stats. */
 	struct shm_main_info* shm_info;
-	/** if the timeout for statistics is attempted at specific offset.
-	 * If it is true, the stat timeout is the interval+offset, and that
-	 * picks (roughly) the same time offset every time period. */
-	int stat_time_specific;
-	/** if the timeout is specific, what offset in the period. */
-	int stat_time_offset;
 	/** some response-ip tags or actions are configured if true */
 	int use_response_ip;
 	/** some RPZ policies are configured */
@@ -251,26 +229,4 @@ void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg);
  */
 int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list);
 
-/* setups the needed ssl contexts, fatal_exit() on any failure */
-void daemon_setup_sslctxs(struct daemon* daemon, struct config_file* cfg);
-
-/** See if the SSL cert files have changed */
-int ssl_cert_changed(struct daemon* daemon, struct config_file* cfg);
-
-/** Setup the listening DoT SSL_CTX, returns the ssl ctx. */
-void* daemon_setup_listen_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
-/** Setup the listening DoH SSL_CTX, returns the ssl ctx. */
-void* daemon_setup_listen_doh_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
-/** Setup the listening Quic SSL_CTX, returns the ssl ctx */
-void* daemon_setup_listen_quic_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
-/** Setup the connect DoT SSL_CTX, returns the ssl ctx */
-void* daemon_setup_connect_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
 #endif /* DAEMON_H */

daemon/remote.c

@@ -153,7 +153,7 @@ remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg)
 		log_crypto_err("could not SSL_CTX_new");
 		return 0;
 	}
-	if(!listen_sslctx_setup(rc->ctx, cfg->tls_protocols)) {
+	if(!listen_sslctx_setup(rc->ctx, cfg->tls_use_system_policy_versions)) {
 		return 0;
 	}
 
@@ -307,26 +307,6 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 #endif
 		}
 	} else {
-		char* s = strchr(ip, '@');
-		char newif[128];
-		if(s) {
-			/* override port with ifspec@port */
-			int portnr;
-			if((size_t)(s-ip) >= sizeof(newif)) {
-				log_err("ifname too long: %s", ip);
-				return -1;
-			}
-			portnr = atoi(s+1);
-			if(portnr < 0 || 0 == portnr || portnr > 65535) {
-				log_err("invalid portnumber in control-interface: %s", ip);
-				return -1;
-			}
-			(void)strlcpy(newif, ip, sizeof(newif));
-			newif[s-ip] = 0;
-			ip = newif;
-			snprintf(port, sizeof(port), "%d", portnr);
-			port[sizeof(port)-1]=0;
-		}
 		hints.ai_socktype = SOCK_STREAM;
 		hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
 		if((r = getaddrinfo(ip, port, &hints, &res)) != 0 || !res) {
@@ -1658,14 +1638,6 @@ do_view_data_add(RES* ssl, struct worker* worker, char* arg)
 			ssl_printf(ssl,"error out of memory\n");
 			return;
 		}
-		if(!v->isfirst) {
-			/* Global local-zone is not used for this view,
-			 * therefore add defaults to this view-specific
-			 * local-zone. */
-			struct config_file lz_cfg;
-			memset(&lz_cfg, 0, sizeof(lz_cfg));
-			local_zone_enter_defaults(v->local_zones, &lz_cfg);
-		}
 	}
 	do_data_add(ssl, v->local_zones, arg2);
 	lock_rw_unlock(&v->lock);
@@ -1691,14 +1663,6 @@ do_view_datas_add(struct daemon_remote* rc, RES* ssl, struct worker* worker,
 			ssl_printf(ssl,"error out of memory\n");
 			return;
 		}
-		if(!v->isfirst) {
-			/* Global local-zone is not used for this view,
-			 * therefore add defaults to this view-specific
-			 * local-zone. */
-			struct config_file lz_cfg;
-			memset(&lz_cfg, 0, sizeof(lz_cfg));
-			local_zone_enter_defaults(v->local_zones, &lz_cfg);
-		}
 	}
 	/* put the view name in the command buf */
 	(void)snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "%s ", arg);
@@ -4669,26 +4633,6 @@ fr_init_time(struct timeval* time_start, struct timeval* time_read,
  * are kept in here. They can then be deleted.
  */
 struct fast_reload_construct {
-	/** ssl context for listening to dnstcp over ssl */
-	void* listen_dot_sslctx;
-	/** ssl context for connecting to dnstcp over ssl */
-	void* connect_dot_sslctx;
-	/** ssl context for listening to DoH */
-	void* listen_doh_sslctx;
-	/** ssl context for listening to quic */
-	void* listen_quic_sslctx;
-	/** the file name that the ssl context is made with, private key. */
-	char* ssl_service_key;
-	/** the file name that the ssl context is made with, certificate. */
-	char* ssl_service_pem;
-	/** modification time for ssl_service_key, in sec and ns. Like
-	 * in a struct timespec, but without that for portability. */
-	time_t mtime_ssl_service_key;
-	long mtime_ns_ssl_service_key;
-	/** modification time for ssl_service_pem, in sec and ns. Like
-	 * in a struct timespec, but without that for portability. */
-	time_t mtime_ssl_service_pem;
-	long mtime_ns_ssl_service_pem;
 	/** construct for views */
 	struct views* views;
 	/** construct for auth zones */
@@ -4992,7 +4936,9 @@ fr_check_compat_cfg(struct fast_reload_thread* fr, struct config_file* newcfg)
 	FR_CHECK_CHANGED_CFG("http_notls_downstream", http_notls_downstream, changed_str);
 	FR_CHECK_CHANGED_CFG("https-port", https_port, changed_str);
 	FR_CHECK_CHANGED_CFG("tls-port", ssl_port, changed_str);
-	FR_CHECK_CHANGED_CFG_STR("tls-protocols", tls_protocols, changed_str);
+	FR_CHECK_CHANGED_CFG_STR("tls-service-key", ssl_service_key, changed_str);
+	FR_CHECK_CHANGED_CFG_STR("tls-service-pem", ssl_service_pem, changed_str);
+	FR_CHECK_CHANGED_CFG_STR("tls-cert-bundle", tls_cert_bundle, changed_str);
 	FR_CHECK_CHANGED_CFG_STRLIST("proxy-protocol-port", proxy_protocol_port, changed_str);
 	FR_CHECK_CHANGED_CFG_STRLIST("tls-additional-port", tls_additional_port, changed_str);
 	FR_CHECK_CHANGED_CFG_STR("interface-automatic-ports", if_automatic_ports, changed_str);
@@ -5101,19 +5047,6 @@ fr_construct_clear(struct fast_reload_construct* ct)
 	wait_limits_free(&ct->wait_limits_netblock);
 	wait_limits_free(&ct->wait_limits_cookie_netblock);
 	domain_limits_free(&ct->domain_limits);
-#ifdef HAVE_SSL
-	/* The SSL contexts can be SSL_CTX_free here. It is reference
-	 * counted. So ongoing transfers with can continue.
-	 * Once they are done, the context is freed. */
-	SSL_CTX_free((SSL_CTX*)ct->listen_dot_sslctx);
-	SSL_CTX_free((SSL_CTX*)ct->connect_dot_sslctx);
-	SSL_CTX_free((SSL_CTX*)ct->listen_doh_sslctx);
-#endif /* HAVE_SSL */
-#ifdef HAVE_NGTCP2
-	SSL_CTX_free((SSL_CTX*)ct->listen_quic_sslctx);
-#endif
-	free(ct->ssl_service_key);
-	free(ct->ssl_service_pem);
 	/* Delete the log identity here so that the global value is not
 	 * reset by config_delete. */
 	if(ct->oldcfg && ct->oldcfg->log_identity) {
@@ -5246,7 +5179,6 @@ config_file_getmem(struct config_file* cfg)
 	m += getmem_config_strlist(cfg->tls_session_ticket_keys.first);
 	m += getmem_str(cfg->tls_ciphers);
 	m += getmem_str(cfg->tls_ciphersuites);
-	m += getmem_str(cfg->tls_protocols);
 	m += getmem_str(cfg->http_endpoint);
 	m += (cfg->outgoing_avail_ports?65536*sizeof(int):0);
 	m += getmem_str(cfg->target_fetch_policy);
@@ -5363,8 +5295,6 @@ fr_printmem(struct fast_reload_thread* fr,
 	size_t mem = 0;
 	if(fr_poll_for_quit(fr))
 		return 1;
-	mem += getmem_str(ct->ssl_service_key);
-	mem += getmem_str(ct->ssl_service_pem);
 	mem += views_get_mem(ct->views);
 	mem += respip_set_get_mem(ct->respip_set);
 	mem += auth_zones_get_mem(ct->auth_zones);
@@ -5598,96 +5528,6 @@ auth_zones_check_changes(struct fast_reload_thread* fr,
 	return 1;
 }
 
-/** Check if the sslctxs have changed. */
-static int
-fr_check_sslctx_change(struct fast_reload_thread* fr,
-	struct config_file* newcfg)
-{
-#ifdef HAVE_SSL
-	struct daemon* daemon = fr->worker->daemon;
-	if(newcfg->ssl_service_key && newcfg->ssl_service_key[0]) {
-		if(!daemon->ssl_service_key ||
-			ssl_cert_changed(daemon, newcfg))
-			return 1;
-	} else {
-		if(daemon->ssl_service_key)
-			return 1; /* it is removed */
-	}
-	if((daemon->cfg->tls_cert_bundle && !newcfg->tls_cert_bundle) ||
-	   (!daemon->cfg->tls_cert_bundle && newcfg->tls_cert_bundle) ||
-	   (daemon->cfg->tls_cert_bundle && newcfg->tls_cert_bundle &&
-	    strcmp(daemon->cfg->tls_cert_bundle, newcfg->tls_cert_bundle)!=0))
-		return 1; /* The tls-cert-bundle has changed and return
-			true here makes it reload the connect_dot_sslctx. */
-#else
-	(void)fr; (void)newcfg;
-#endif /* HAVE_SSL */
-	return 0;
-}
-
-/** Create the SSL CTXs when they have changed. */
-static int
-ct_create_sslctxs(struct fast_reload_construct* ct,
-	struct config_file* newcfg, struct daemon* daemon)
-{
-#ifdef HAVE_SSL
-	char* chroot = daemon->chroot;
-	char* key = newcfg->ssl_service_key;
-	char* pem = newcfg->ssl_service_pem;
-
-	if(!(newcfg->ssl_service_key && newcfg->ssl_service_key[0])) {
-		/* Leave listen ctxs and file str at NULL */
-		ct->connect_dot_sslctx = daemon_setup_connect_dot_sslctx(
-			daemon, newcfg);
-		return 1;
-	}
-
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-
-	ct->listen_dot_sslctx = daemon_setup_listen_dot_sslctx(daemon, newcfg);
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-	if(cfg_has_https(newcfg)) {
-		ct->listen_doh_sslctx = daemon_setup_listen_doh_sslctx(
-			daemon, newcfg);
-	}
-#endif
-#ifdef HAVE_NGTCP2
-	if(cfg_has_quic(newcfg)) {
-		ct->listen_quic_sslctx = daemon_setup_listen_quic_sslctx(
-			daemon, newcfg);
-	}
-#endif /* HAVE_NGTCP2 */
-	ct->connect_dot_sslctx = daemon_setup_connect_dot_sslctx(daemon,
-		newcfg);
-
-	/* Store mtime and names */
-	ct->ssl_service_key = strdup(newcfg->ssl_service_key);
-	if(!ct->ssl_service_key) {
-		log_err("ct_create_sslctxs: out of memory");
-		return 0;
-	}
-	ct->ssl_service_pem = strdup(newcfg->ssl_service_pem);
-	if(!ct->ssl_service_pem) {
-		log_err("ct_create_sslctxs: out of memory");
-		return 0;
-	}
-	if(!file_get_mtime(key, &ct->mtime_ssl_service_key,
-		&ct->mtime_ns_ssl_service_key, NULL))
-		log_err("Could not stat(%s): %s",
-			key, strerror(errno));
-	if(!file_get_mtime(pem, &ct->mtime_ssl_service_pem,
-		&ct->mtime_ns_ssl_service_pem, NULL))
-		log_err("Could not stat(%s): %s",
-			pem, strerror(errno));
-#else
-	(void)ct; (void)newcfg; (void)daemon;
-#endif /* HAVE_SSL */
-	return 1;
-}
-
 /** fast reload thread, construct from config the new items */
 static int
 fr_construct_from_config(struct fast_reload_thread* fr,
@@ -5695,13 +5535,6 @@ fr_construct_from_config(struct fast_reload_thread* fr,
 {
 	int have_view_respip_cfg = 0;
 
-	fr->sslctxs_changed = fr_check_sslctx_change(fr, newcfg);
-	if(fr->sslctxs_changed) {
-		if(!ct_create_sslctxs(ct, newcfg, fr->worker->daemon)) {
-			fr_construct_clear(ct);
-			return 0;
-		}
-	}
 	if(!(ct->views = views_create())) {
 		fr_construct_clear(ct);
 		return 0;
@@ -5979,44 +5812,6 @@ auth_zones_swap(struct auth_zones* az, struct auth_zones* data)
 	 * the xfer elements can continue to be their callbacks. */
 }
 
-/** Swap two void* */
-static void
-void_ptr_swap(void** a, void **b)
-{
-	void* tmp = *a;
-	*a = *b;
-	*b = tmp;
-}
-
-/** Swap two char* */
-static void
-char_ptr_swap(char** a, char **b)
-{
-	char* tmp = *a;
-	*a = *b;
-	*b = tmp;
-}
-
-/** Swap and set ssl ctx information */
-static void
-sslctxs_swap(struct daemon* daemon, struct fast_reload_construct* ct)
-{
-	void_ptr_swap(&daemon->listen_dot_sslctx, &ct->listen_dot_sslctx);
-	void_ptr_swap(&daemon->connect_dot_sslctx, &ct->connect_dot_sslctx);
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-	void_ptr_swap(&daemon->listen_doh_sslctx, &ct->listen_doh_sslctx);
-#endif
-#ifdef HAVE_NGTCP2
-	void_ptr_swap(&daemon->listen_quic_sslctx, &ct->listen_quic_sslctx);
-#endif /* HAVE_NGTCP2 */
-	char_ptr_swap(&daemon->ssl_service_key, &ct->ssl_service_key);
-	char_ptr_swap(&daemon->ssl_service_pem, &ct->ssl_service_pem);
-	daemon->mtime_ssl_service_key = ct->mtime_ssl_service_key;
-	daemon->mtime_ns_ssl_service_key = ct->mtime_ns_ssl_service_key;
-	daemon->mtime_ssl_service_pem = ct->mtime_ssl_service_pem;
-	daemon->mtime_ns_ssl_service_pem = ct->mtime_ns_ssl_service_pem;
-}
-
 #if defined(ATOMIC_POINTER_LOCK_FREE) && defined(HAVE_LINK_ATOMIC_STORE)
 /** Fast reload thread, if atomics are available, copy the config items
  * one by one with atomic store operations. */
@@ -6078,8 +5873,8 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(tls_session_ticket_keys.last);
 	COPY_VAR_ptr(tls_ciphers);
 	COPY_VAR_ptr(tls_ciphersuites);
-	COPY_VAR_ptr(tls_protocols);
 	COPY_VAR_int(tls_use_sni);
+	COPY_VAR_int(tls_use_system_policy_versions);
 	COPY_VAR_int(https_port);
 	COPY_VAR_ptr(http_endpoint);
 	COPY_VAR_uint32_t(http_max_streams);
@@ -6389,18 +6184,8 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_int(ede);
 	COPY_VAR_int(iter_scrub_ns);
 	COPY_VAR_int(iter_scrub_cname);
-	COPY_VAR_int(iter_scrub_rrsig);
 	COPY_VAR_int(max_global_quota);
 	COPY_VAR_int(iter_scrub_promiscuous);
-
-#undef COPY_VAR_int
-#undef COPY_VAR_ptr
-#undef COPY_VAR_unsigned_int
-#undef COPY_VAR_size_t
-#undef COPY_VAR_uint8_t
-#undef COPY_VAR_uint16_t
-#undef COPY_VAR_uint32_t
-#undef COPY_VAR_int32_t
 }
 #endif /* ATOMIC_POINTER_LOCK_FREE && HAVE_LINK_ATOMIC_STORE */
 
@@ -6626,9 +6411,6 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 	daemon->env->cachedb_enabled = cachedb_is_enabled(&daemon->mods,
 		daemon->env);
 #endif
-	if(fr->sslctxs_changed) {
-		sslctxs_swap(daemon, ct);
-	}
 #ifdef USE_DNSTAP
 	if(env->cfg->dnstap) {
 		if(!fr->fr_nopause)
@@ -6853,8 +6635,6 @@ static void* fast_reload_thread_main(void* arg)
 	struct fast_reload_thread* fast_reload_thread = (struct fast_reload_thread*)arg;
 	struct timeval time_start, time_read, time_construct, time_reload,
 		time_end;
-	const char name[16] = "unbound/freload"; /* seems to be the safest size
-						    between different OSes */
 
 #if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
 	fast_reload_thread->thread_tid = gettid();
@@ -6864,9 +6644,6 @@ static void* fast_reload_thread_main(void* arg)
 #endif
 		log_thread_set(&fast_reload_thread->threadnum);
 
-	ub_thread_setname(fast_reload_thread->tid, name);
-	(void)name; /* When setname is not defined, ignore the name variable. */
-
 	verbose(VERB_ALGO, "start fast reload thread");
 	if(fast_reload_thread->fr_verb >= 1) {
 		fr_init_time(&time_start, &time_read, &time_construct,
@@ -7830,44 +7607,6 @@ fr_worker_pickup_auth_changes(struct worker* worker,
 	}
 }
 
-/** Fast reload, the worker picks up changes in listen_dnsport. */
-static void
-fr_worker_pickup_listen_dnsport(struct worker* worker)
-{
-	struct listen_dnsport* front = worker->front;
-	struct daemon* daemon = worker->daemon;
-	if(worker->daemon->fast_reload_thread->sslctxs_changed) {
-		struct listen_list* ll;
-		void* dot_sslctx = daemon->listen_dot_sslctx;
-		void* doh_sslctx = daemon->listen_doh_sslctx;
-#ifdef HAVE_NGTCP2
-		void* quic_sslctx = daemon->listen_quic_sslctx;
-#endif  /* HAVE_NGTCP2 */
-		for(ll = front->cps; ll; ll = ll->next) {
-			struct comm_point* cp = ll->com;
-			if(cp->type == comm_tcp_accept &&
-				cp->tcp_handlers &&
-				cp->max_tcp_count > 0 &&
-				cp->tcp_handlers[0]->type == comm_http) {
-				if(cp->ssl)
-					cp->ssl = doh_sslctx;
-			} else if(cp->type == comm_tcp_accept) {
-				if(cp->ssl)
-					cp->ssl = dot_sslctx;
-#ifdef HAVE_NGTCP2
-			} else if(cp->type == comm_doq) {
-				if(cp->ssl) {
-					cp->ssl = quic_sslctx;
-					if(cp->doq_socket)
-						cp->doq_socket->ctx =
-							(SSL_CTX*)quic_sslctx;
-				}
-#endif  /* HAVE_NGTCP2 */
-			}
-		}
-	}
-}
-
 /** Fast reload, the worker picks up changes in outside_network. */
 static void
 fr_worker_pickup_outside_network(struct worker* worker)
@@ -7883,8 +7622,6 @@ fr_worker_pickup_outside_network(struct worker* worker)
 	outnet->tcp_reuse_timeout = cfg->tcp_reuse_timeout;
 	outnet->tcp_auth_query_timeout = cfg->tcp_auth_query_timeout;
 	outnet->delayclose = cfg->delay_close;
-	if(worker->daemon->fast_reload_thread->sslctxs_changed)
-		outnet->sslctx = worker->daemon->connect_dot_sslctx;
 	if(outnet->delayclose) {
 #ifndef S_SPLINT_S
 		outnet->delay_tv.tv_sec = cfg->delay_close/1000;
@@ -7955,7 +7692,6 @@ fast_reload_worker_pickup_changes(struct worker* worker)
 #ifdef USE_CACHEDB
 	worker->env.cachedb_enabled = worker->daemon->env->cachedb_enabled;
 #endif
-	fr_worker_pickup_listen_dnsport(worker);
 	fr_worker_pickup_outside_network(worker);
 #ifdef USE_DNSTAP
 	fr_worker_pickup_dnstap_changes(worker);

daemon/remote.h

@@ -255,8 +255,6 @@ struct fast_reload_thread {
 	struct fast_reload_auth_change* auth_zone_change_list;
 	/** the old tree of auth zones, to lookup. */
 	struct auth_zones* old_auth_zones;
-	/** If the ssl ctxs have changed. */
-	int sslctxs_changed;
 };
 
 /**

daemon/unbound.c

@@ -463,13 +463,57 @@ detach(void)
 #endif /* HAVE_DAEMON */
 }
 
-/** setup the remote and ticket keys */
+#ifdef HAVE_SSL
+/* setup a listening ssl context, fatal_exit() on any failure */
 static void
-setup_sslctx_remote(struct daemon* daemon, struct config_file* cfg)
+setup_listen_sslctx(void** ctx, int is_dot, int is_doh, struct config_file* cfg)
+{
+	if(!(*ctx = listen_sslctx_create(
+		cfg->ssl_service_key, cfg->ssl_service_pem, NULL,
+		cfg->tls_ciphers, cfg->tls_ciphersuites,
+		(cfg->tls_session_ticket_keys.first &&
+		cfg->tls_session_ticket_keys.first->str[0] != 0),
+		is_dot, is_doh, cfg->tls_use_system_policy_versions))) {
+		fatal_exit("could not set up listen SSL_CTX");
+	}
+}
+#endif /* HAVE_SSL */
+
+/* setups the needed ssl contexts, fatal_exit() on any failure */
+static void
+setup_sslctxs(struct daemon* daemon, struct config_file* cfg)
 {
 #ifdef HAVE_SSL
 	if(!(daemon->rc = daemon_remote_create(cfg)))
 		fatal_exit("could not set up remote-control");
+	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
+		/* setup the session keys; the callback to use them will be
+		 * attached to each sslctx separately */
+		if(cfg->tls_session_ticket_keys.first &&
+			cfg->tls_session_ticket_keys.first->str[0] != 0) {
+			if(!listen_sslctx_setup_ticket_keys(
+				cfg->tls_session_ticket_keys.first)) {
+				fatal_exit("could not set session ticket SSL_CTX");
+			}
+		}
+		(void)setup_listen_sslctx(&daemon->listen_dot_sslctx, 1, 0, cfg);
+#ifdef HAVE_NGHTTP2_NGHTTP2_H
+		if(cfg_has_https(cfg)) {
+			(void)setup_listen_sslctx(&daemon->listen_doh_sslctx, 0, 1, cfg);
+		}
+#endif
+#ifdef HAVE_NGTCP2
+		if(cfg_has_quic(cfg)) {
+			if(!(daemon->listen_quic_sslctx = quic_sslctx_create(
+				cfg->ssl_service_key, cfg->ssl_service_pem, NULL))) {
+				fatal_exit("could not set up quic SSL_CTX");
+			}
+		}
+#endif /* HAVE_NGTCP2 */
+	}
+	if(!(daemon->connect_dot_sslctx = connect_sslctx_create(NULL, NULL,
+		cfg->tls_cert_bundle, cfg->tls_win_cert)))
+		fatal_exit("could not set up connect SSL_CTX");
 #else /* HAVE_SSL */
 	(void)daemon;(void)cfg;
 #endif /* HAVE_SSL */
@@ -501,8 +545,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif
 
 	/* read ssl keys while superuser and outside chroot */
-	setup_sslctx_remote(daemon, cfg);
-	daemon_setup_sslctxs(daemon, cfg);
+	(void)setup_sslctxs(daemon, cfg);
 
 	/* init syslog (as root) if needed, before daemonize, otherwise
 	 * a fork error could not be printed since daemonize closed stderr.*/

daemon/worker.c

@@ -255,8 +255,7 @@ worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 		return 0;
 	}
 	/* sanity check. */
-	if(sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE
-		|| !LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
+	if(!LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
 		|| LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) !=
 			LDNS_PACKET_QUERY
 		|| LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) > 1) {
@@ -293,44 +292,6 @@ worker_err_ratelimit(struct worker* worker, int err)
 	return err;
 }
 
-/**
- * Reply with an error.
- * This reply includes the qname if it has been parsed.
- * For error ratelimiting, the err ratelimit routine should be checked
- * beforehand. The reply is without EDNS, and copies RD and sets QR flag.
- * @param pkt: the packet buffer from the comm point.
- * @param err: the error code that would be wanted.
- * @param qname_len: 0 if not parsed, and the qname length in packet.
- */
-static void
-query_error(sldns_buffer* pkt, int err, size_t qname_len)
-{
-	/* Preserve the RD flag.
-	 * The CD flag must be cleared in authoritative answers,
-	 * also the AD flag need not be copied into answers.
-	 * The other flags need not be copied into the answer. */
-	sldns_buffer_write_u16_at(pkt, 2,
-		sldns_buffer_read_u16_at(pkt, 2)&0x0100U);
-	LDNS_QR_SET(sldns_buffer_begin(pkt)); /* Set QR flag. */
-	LDNS_RCODE_SET(sldns_buffer_begin(pkt), err); /* Set rcode */
-
-	if(qname_len && LDNS_QDCOUNT(sldns_buffer_begin(pkt))>=1 &&
-		qname_len <= LDNS_MAX_DOMAINLEN) {
-		/* Copy query into the answer. */
-		LDNS_QDCOUNT_SET(sldns_buffer_begin(pkt), 1);
-		sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE +
-			qname_len + 2 /* type */ + 2 /* class */ );
-	} else {
-		/* No query section in answer. */
-		LDNS_QDCOUNT_SET(sldns_buffer_begin(pkt), 0);
-		sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE);
-	}
-	LDNS_ANCOUNT_SET(sldns_buffer_begin(pkt), 0);
-	LDNS_NSCOUNT_SET(sldns_buffer_begin(pkt), 0);
-	LDNS_ARCOUNT_SET(sldns_buffer_begin(pkt), 0);
-	sldns_buffer_flip(pkt);
-}
-
 /**
  * Structure holding the result of the worker_check_request function.
  * Based on configuration it could be called up to four times; ideally should
@@ -368,6 +329,7 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 		return;
 	}
 	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
+		LDNS_TC_CLR(sldns_buffer_begin(pkt));
 		verbose(VERB_QUERY, "request bad, has TC bit on");
 		out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 		return;
@@ -1009,7 +971,6 @@ chaos_replystr(sldns_buffer* pkt, char** str, int num, struct edns_data* edns,
 	size_t udpsize = edns->udp_size;
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
-	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_local_call(&worker->env, NULL, NULL, NULL,
 		LDNS_RCODE_NOERROR, edns, repinfo, worker->scratchpad,
@@ -1268,7 +1229,9 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		worker_check_request(c->buffer, worker, check_result);
 		if(check_result->value != 0) {
 			if(check_result->value != -1) {
-				query_error(c->buffer, check_result->value, 0);
+				LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+					check_result->value);
 				return 1;
 			}
 			comm_point_drop_reply(repinfo);
@@ -1285,17 +1248,41 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		/* check additional section is present and that we respond with EDEs */
 		if(LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) != 1
 			|| !ede) {
-			query_error(c->buffer, LDNS_RCODE_REFUSED, 0);
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				LDNS_RCODE_REFUSED);
+			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 
 		if (!query_dname_len(c->buffer)) {
-			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				LDNS_RCODE_FORMERR);
+			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 		/* space available for query type and class? */
 		if (sldns_buffer_remaining(c->buffer) < 2 * sizeof(uint16_t)) {
-			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+                        LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+                        LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				 LDNS_RCODE_FORMERR);
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+                        sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
@@ -1317,27 +1304,35 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 			if(!skip_pkt_rrs(c->buffer,
 				((int)LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)))+
 				((int)LDNS_NSCOUNT(sldns_buffer_begin(c->buffer))))) {
-				query_error(c->buffer, LDNS_RCODE_FORMERR,
-					opt_rr_mark - LDNS_HEADER_SIZE
-					- 2 /* qtype */ - 2 /* qclass */);
+				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+					LDNS_RCODE_FORMERR);
+				LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+				LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+				LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+				sldns_buffer_set_position(c->buffer, opt_rr_mark);
+				sldns_buffer_flip(c->buffer);
 				return 1;
 			}
 		}
 		/* Do we have a valid OPT RR here? If not return REFUSED (could be a valid TSIG or something so no FORMERR) */
 		/* domain name must be the root of length 1. */
 		if(sldns_buffer_remaining(c->buffer) < 1 || *sldns_buffer_current(c->buffer) != 0) {
-			query_error(c->buffer, LDNS_RCODE_REFUSED,
-				opt_rr_mark - LDNS_HEADER_SIZE
-				- 2 /* qtype */ - 2 /* qclass */);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, opt_rr_mark);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		} else {
 			sldns_buffer_skip(c->buffer, 1); /* skip root label */
 		}
 		if(sldns_buffer_remaining(c->buffer) < 2 ||
 			sldns_buffer_read_u16(c->buffer) != LDNS_RR_TYPE_OPT) {
-			query_error(c->buffer, LDNS_RCODE_REFUSED,
-				opt_rr_mark - LDNS_HEADER_SIZE
-				- 2 /* qtype */ - 2 /* qclass */);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, opt_rr_mark);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 		/* Write OPT RR directly after the query,
@@ -1533,10 +1528,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				"dnscrypt: worker check request: bad query.");
 			log_addr(VERB_CLIENT,"from",&repinfo->client_addr,
 				repinfo->client_addrlen);
-			if(check_result.value != -1) {
-				query_error(c->buffer, check_result.value, 0);
-				return 1;
-			}
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
@@ -1545,13 +1536,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				"dnscrypt: worker parse request: formerror.");
 			log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 				repinfo->client_addrlen);
-			if(worker_err_ratelimit(worker, LDNS_RCODE_FORMERR) == -1) {
-				comm_point_drop_reply(repinfo);
-				return 0;
-			}
-			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
-			sldns_buffer_copy(c->dnscrypt_buffer, c->buffer);
-			return 1;
+			comm_point_drop_reply(repinfo);
+			return 0;
 		}
 		dname_str(qinfo.qname, buf);
 		if(!(qinfo.qtype == LDNS_RR_TYPE_TXT &&
@@ -1562,15 +1548,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				worker->daemon->dnscenv->provider_name,
 				sldns_rr_descript(qinfo.qtype)->_name,
 				buf);
-			if(worker_err_ratelimit(worker, LDNS_RCODE_SERVFAIL) == -1) {
-				comm_point_drop_reply(repinfo);
-				return 0;
-			}
-			query_error(c->buffer, LDNS_RCODE_SERVFAIL,
-				qinfo.qname_len);
+			comm_point_drop_reply(repinfo);
 			worker->stats.num_query_dnscrypt_cleartext++;
-			sldns_buffer_copy(c->dnscrypt_buffer, c->buffer);
-			return 1;
+			return 0;
 		}
 		worker->stats.num_query_dnscrypt_cert++;
 		sldns_buffer_rewind(c->buffer);
@@ -1610,7 +1590,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker check request: bad query.");
 		log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
 		if(check_result.value != -1) {
-			query_error(c->buffer, check_result.value, 0);
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				check_result.value);
 			return 1;
 		}
 		comm_point_drop_reply(repinfo);
@@ -1644,7 +1626,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+		sldns_buffer_rewind(c->buffer);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_FORMERR);
 		goto send_reply;
 	}
 	if(worker->env.cfg->log_queries) {
@@ -1657,11 +1642,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker request: refused zone transfer.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
-			comm_point_drop_reply(repinfo);
-			return 0;
-		}
-		query_error(c->buffer, LDNS_RCODE_REFUSED, qinfo.qname_len);
+		sldns_buffer_rewind(c->buffer);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_REFUSED);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
 		}
@@ -1680,7 +1664,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		query_error(c->buffer, LDNS_RCODE_FORMERR, qinfo.qname_len);
+		sldns_buffer_rewind(c->buffer);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_FORMERR);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
 		}
@@ -1688,17 +1675,13 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}
 	if((ret=parse_edns_from_query_pkt(
 			c->buffer, &edns, worker->env.cfg, c, repinfo,
-			*worker->env.now, worker->scratchpad,
+			(worker->env.now ? *worker->env.now : time(NULL)),
+			worker->scratchpad,
 			worker->daemon->cookie_secrets)) != 0) {
 		struct edns_data reply_edns;
 		verbose(VERB_ALGO, "worker parse edns: formerror.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		if(worker_err_ratelimit(worker, ret) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		memset(&reply_edns, 0, sizeof(reply_edns));
 		reply_edns.edns_present = 1;
 		error_encode(c->buffer, ret, &qinfo,
@@ -1715,11 +1698,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			verbose(VERB_ALGO, "query with bad edns version.");
 			log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 				repinfo->client_addrlen);
-			if(worker_err_ratelimit(worker, EDNS_RCODE_BADVERS) == -1) {
-				comm_point_drop_reply(repinfo);
-				regional_free_all(worker->scratchpad);
-				return 0;
-			}
 			extended_error_encode(c->buffer, EDNS_RCODE_BADVERS, &qinfo,
 				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 				sldns_buffer_read_u16_at(c->buffer, 2), 0, &edns);
@@ -1765,11 +1743,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 
 	else if(edns.cookie_present) {
 		/* Cookie present, but not valid: Cookie was bad! */
-		if(worker_err_ratelimit(worker, LDNS_EXT_RCODE_BADCOOKIE) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		extended_error_encode(c->buffer,
 			LDNS_EXT_RCODE_BADCOOKIE, &qinfo,
 			*(uint16_t*)(void *)
@@ -1784,11 +1757,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			"need cookie or stateful transport");
 		log_addr(VERB_ALGO, "from",&repinfo->remote_addr
 		                          , repinfo->remote_addrlen);
-		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
 			worker->scratchpad, LDNS_EDE_OTHER,
 			"DNS Cookie needed for UDP replies");
@@ -1815,14 +1783,14 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker request: edns is too small.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		if(worker_err_ratelimit(worker, LDNS_RCODE_SERVFAIL) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
-		/* A small error without qname, and TC flag on. */
-		query_error(c->buffer, LDNS_RCODE_SERVFAIL, 0);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 		LDNS_TC_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_SERVFAIL);
+		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+		sldns_buffer_write_at(c->buffer, 4,
+			(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
+		sldns_buffer_flip(c->buffer);
 		regional_free_all(worker->scratchpad);
 		goto send_reply;
 	}
@@ -1830,13 +1798,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		server_stats_insquery(&worker->stats, c, qinfo.qtype,
 			qinfo.qclass, &edns, repinfo);
 	if(c->type != comm_udp)
-#ifdef USE_DNSCRYPT
-		edns.udp_size = (c->dnscrypt && repinfo->is_dnscrypted)
-			? sldns_buffer_capacity(c->buffer) - DNSCRYPT_REPLY_HEADER_SIZE
-			: 65535;
-#else
 		edns.udp_size = 65535; /* max size for TCP replies */
-#endif
 	if(qinfo.qclass == LDNS_RR_CLASS_CH && answer_chaos(worker, &qinfo,
 		&edns, repinfo, c->buffer)) {
 		regional_free_all(worker->scratchpad);
@@ -1913,15 +1875,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	 * ACLs allow the snooping. */
 	if(!(LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) &&
 		acl != acl_allow_snoop ) {
-		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
-			&repinfo->client_addr, repinfo->client_addrlen);
-		/* This ratelimited error query is accounted in the stats,
-		 * as an incoming query. */
-		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		if(worker->env.cfg->ede) {
 			EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
 				worker->scratchpad, LDNS_EDE_NOT_AUTHORITATIVE, "");
@@ -1930,6 +1883,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 			sldns_buffer_read_u16_at(c->buffer, 2), &edns);
 		regional_free_all(worker->scratchpad);
+		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
+			&repinfo->client_addr, repinfo->client_addrlen);
+
 		goto send_reply;
 	}
 
@@ -2120,7 +2076,7 @@ send_reply_rc:
 		}
 	}
 #ifdef USE_DNSCRYPT
-	if(!dnsc_handle_uncurved_request(repinfo, c->buffer)) {
+	if(!dnsc_handle_uncurved_request(repinfo)) {
 		return 0;
 	}
 #endif
@@ -2168,37 +2124,10 @@ worker_restart_timer(struct worker* worker)
 {
 	if(worker->env.cfg->stat_interval > 0) {
 		struct timeval tv;
-		if(worker->daemon->stat_time_specific) {
-			struct timeval dest, now;
-			int interval = worker->env.cfg->stat_interval;
-			int offset = worker->daemon->stat_time_offset;
-			int nows, spec;
-			if(gettimeofday(&now, NULL) < 0)
-				log_err("gettimeofday: %s", strerror(errno));
 #ifndef S_SPLINT_S
-			nows = (int)now.tv_sec;
-			/* The next time is on the timer interval, at the
-			 * specific offset, time value % interval = offset. */
-			/* It relies on the integer division below to drop the
-			 * remainder in order to calculate the expected
-			 * result. */
-			spec = ((nows-offset)/interval+1)*interval+offset;
-			/* This is instead of an assertion, and should not
-			 * be needed. So assert(spec > nows), tv is going to
-			 * be positive. */
-			if(spec<=nows) spec += interval;
-			dest.tv_sec = spec;
-			dest.tv_usec = 0;
+		tv.tv_sec = worker->env.cfg->stat_interval;
+		tv.tv_usec = 0;
 #endif
-			/* Subtract in timeval, so the fractions of a second
-			 * are rounded to the whole specific time. */
-			timeval_subtract(&tv, &dest, &now);
-		} else {
-#ifndef S_SPLINT_S
-			tv.tv_sec = worker->env.cfg->stat_interval;
-			tv.tv_usec = 0;
-#endif
-		}
 		comm_timer_set(worker->stat_timer, &tv);
 	}
 }
@@ -2233,16 +2162,23 @@ void worker_probe_timer_cb(void* arg)
 }
 
 struct worker*
-worker_create(struct daemon* daemon, int id)
+worker_create(struct daemon* daemon, int id, int* ports, int n)
 {
 	unsigned int seed;
 	struct worker* worker = (struct worker*)calloc(1,
 		sizeof(struct worker));
 	if(!worker)
 		return NULL;
+	worker->numports = n;
+	worker->ports = (int*)memdup(ports, sizeof(int)*n);
+	if(!worker->ports) {
+		free(worker);
+		return NULL;
+	}
 	worker->daemon = daemon;
 	worker->thread_num = id;
 	if(!(worker->cmd = tube_create())) {
+		free(worker->ports);
 		free(worker);
 		return NULL;
 	}
@@ -2250,6 +2186,7 @@ worker_create(struct daemon* daemon, int id)
 	if(!(worker->rndstate = ub_initstate(daemon->rand))) {
 		log_err("could not init random numbers.");
 		tube_delete(worker->cmd);
+		free(worker->ports);
 		free(worker);
 		return NULL;
 	}
@@ -2348,14 +2285,14 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		cfg->out_ifs, cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6,
 		cfg->do_tcp?cfg->outgoing_num_tcp:0, cfg->ip_dscp,
 		worker->daemon->env->infra_cache, worker->rndstate,
-		cfg->use_caps_bits_for_id,
+		cfg->use_caps_bits_for_id, worker->ports, worker->numports,
 		cfg->unwanted_threshold, cfg->outgoing_tcp_mss,
 		&worker_alloc_cleanup, worker,
 		cfg->do_udp || cfg->udp_upstream_without_downstream,
 		worker->daemon->connect_dot_sslctx, cfg->delay_close,
 		cfg->tls_use_sni, dtenv, cfg->udp_connect,
 		cfg->max_reuse_tcp_queries, cfg->tcp_reuse_timeout,
-		cfg->tcp_auth_query_timeout, worker->daemon->shared_ports);
+		cfg->tcp_auth_query_timeout);
 	if(!worker->back) {
 		log_err("could not create outgoing sockets");
 		worker_delete(worker);
@@ -2506,6 +2443,7 @@ worker_delete(struct worker* worker)
 	tube_delete(worker->cmd);
 	comm_timer_delete(worker->stat_timer);
 	comm_timer_delete(worker->env.probe_timer);
+	free(worker->ports);
 	if(worker->thread_num == 0) {
 #ifdef UB_ON_WINDOWS
 		wsvc_desetup_worker(worker);
@@ -2637,11 +2575,6 @@ void libworker_event_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
 	log_assert(0);
 }
 
-void libworker_alloc_cleanup(void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
 int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 {
 	log_assert(0);

daemon/worker.h

@@ -104,6 +104,10 @@ struct worker {
 	struct listen_dnsport* front;
 	/** the backside outside network interface to the auth servers */
 	struct outside_network* back;
+	/** ports to be used by this worker. */
+	int* ports;
+	/** number of ports for this worker */
+	int numports;
 	/** the signal handler */
 	struct comm_signal* comsig;
 	/** commpoint to listen to commands. */
@@ -142,9 +146,11 @@ struct worker {
  * with backpointers only. Use worker_init on it later.
  * @param daemon: the daemon that this worker thread is part of.
  * @param id: the thread number from 0.. numthreads-1.
+ * @param ports: the ports it is allowed to use, array.
+ * @param n: the number of ports.
  * @return: the new worker or NULL on alloc failure.
  */
-struct worker* worker_create(struct daemon* daemon, int id);
+struct worker* worker_create(struct daemon* daemon, int id, int* ports, int n);
 
 /**
  * Initialize worker.

dnscrypt/dnscrypt.c

@@ -361,7 +361,7 @@ dnscrypt_server_uncurve(struct dnsc_env* env,
 
     len -= DNSCRYPT_QUERY_HEADER_SIZE;
 
-    while (len>0 && *sldns_buffer_at(buffer, --len) == 0)
+    while (*sldns_buffer_at(buffer, --len) == 0)
         ;
 
     if (*sldns_buffer_at(buffer, len) != 0x80) {
@@ -474,18 +474,10 @@ dnscrypt_server_curve(const dnsccert *cert,
     uint8_t *const buf = sldns_buffer_begin(buffer);
     size_t len = sldns_buffer_limit(buffer);
 
-    if(len + DNSCRYPT_REPLY_HEADER_SIZE > sldns_buffer_capacity(buffer))
-	return -1;
-    sldns_buffer_clear(buffer);
-
     if(udp){
         if (max_len > max_reply_size)
             max_len = max_reply_size;
     }
-    if(max_len > sldns_buffer_capacity(buffer))
-	max_len = sldns_buffer_capacity(buffer);
-    if(max_len > 65535)
-	    max_len = 65535;
 
 
     memcpy(nonce, client_nonce, crypto_box_HALF_NONCEBYTES);
@@ -528,7 +520,6 @@ dnscrypt_server_curve(const dnsccert *cert,
                           DNSCRYPT_MAGIC_HEADER_LEN,
                           nonce,
                           crypto_box_NONCEBYTES);
-    sldns_buffer_flip(buffer);
     sldns_buffer_set_limit(buffer, len + DNSCRYPT_REPLY_HEADER_SIZE);
     return 0;
 }
@@ -672,8 +663,6 @@ dnsc_find_cert(struct dnsc_env* dnscenv, struct sldns_buffer* buffer)
 	}
 	dnscrypt_header = (struct dnscrypt_query_header *)sldns_buffer_begin(buffer);
 	for (i = 0U; i < dnscenv->signed_certs_count; i++) {
-		if(!certs[i].keypair)
-			continue;
 		if (memcmp(certs[i].magic_query, dnscrypt_header->magic_query,
                    DNSCRYPT_MAGIC_HEADER_LEN) == 0) {
 			return &certs[i];
@@ -815,7 +804,6 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
 		sizeof *env->keypairs);
 	env->certs = sodium_allocarray(env->signed_certs_count,
 		sizeof *env->certs);
-	memset(env->certs, 0, env->signed_certs_count * sizeof(*env->certs));
 
 	cert_id = 0U;
 	keypair_id = 0U;
@@ -924,13 +912,12 @@ dnsc_handle_curved_request(struct dnsc_env* dnscenv,
 }
 
 int
-dnsc_handle_uncurved_request(struct comm_reply *repinfo,
-	struct sldns_buffer* buffer)
+dnsc_handle_uncurved_request(struct comm_reply *repinfo)
 {
     if(!repinfo->c->dnscrypt) {
         return 1;
     }
-    sldns_buffer_copy(repinfo->c->dnscrypt_buffer, buffer);
+    sldns_buffer_copy(repinfo->c->dnscrypt_buffer, repinfo->c->buffer);
     if(!repinfo->is_dnscrypted) {
         return 1;
     }
@@ -976,19 +963,12 @@ dnsc_create(void)
 int
 dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg)
 {
-    int nkeys;
     if(dnsc_parse_certs(env, cfg) <= 0) {
         fatal_exit("dnsc_apply_cfg: no cert file loaded");
     }
-    nkeys = dnsc_parse_keys(env, cfg);
-    if(nkeys <= 0) {
+    if(dnsc_parse_keys(env, cfg) <= 0) {
         fatal_exit("dnsc_apply_cfg: no key file loaded");
     }
-    if((size_t)nkeys < env->signed_certs_count) {
-	fatal_exit("dnsc_apply_cfg: %u dnscrypt-provider-cert file(s) have no "
-		"matching dnscrypt-secret-key",
-		(unsigned)(env->signed_certs_count - (size_t)nkeys));
-    }
     randombytes_buf(env->hash_key, sizeof env->hash_key);
     env->provider_name = cfg->dnscrypt_provider;
 

dnscrypt/dnscrypt.h

@@ -128,8 +128,7 @@ int dnsc_handle_curved_request(struct dnsc_env* dnscenv,
  * \return 0 in case of failure.
  */
 
-int dnsc_handle_uncurved_request(struct comm_reply *repinfo,
-	struct sldns_buffer* buffer);
+int dnsc_handle_uncurved_request(struct comm_reply *repinfo);
 
 /**
  * Computes the size of the shared secret cache entry.

dnstap/dtstream.c

@@ -2133,8 +2133,6 @@ static void* dnstap_io(void* arg)
 	struct dt_io_thread* dtio = (struct dt_io_thread*)arg;
 	time_t secs = 0;
 	struct timeval now;
-	const char name[16] = "unbound/dnstap"; /* seems to be the safest size
-						   between different OSes */
 
 #if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
 	dtio->thread_tid = gettid();
@@ -2144,8 +2142,6 @@ static void* dnstap_io(void* arg)
 #endif
 		log_thread_set(&dtio->threadnum);
 
-	ub_thread_setname(dtio->tid, name);
-
 	/* setup */
 	verbose(VERB_ALGO, "start dnstap io thread");
 	dtio_setup_base(dtio, &secs, &now);

dnstap/unbound-dnstap-socket.c

@@ -330,7 +330,7 @@ static struct tap_socket* tap_socket_new_tcpaccept(char* ip,
 /** create new socket (unconnected, not base-added), or NULL malloc fail */
 static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	void (*ev_cb)(int, short, void*), void* data, char* server_key,
-	char* server_cert, char* verifypem, char* tls_protocols)
+	char* server_cert, char* verifypem)
 {
 	struct tap_socket* s = calloc(1, sizeof(*s));
 	if(!s) {
@@ -347,7 +347,7 @@ static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	s->ev_cb = ev_cb;
 	s->data = data;
 	s->sslctx = listen_sslctx_create(server_key, server_cert, verifypem,
-		NULL, NULL, 0, 0, 0, tls_protocols);
+		NULL, NULL, 0, 0, 0, 0);
 	if(!s->sslctx) {
 		log_err("could not create ssl context");
 		free(s->ip);
@@ -1261,13 +1261,13 @@ static void setup_tcp_list(struct main_tap_data* maindata,
 /** setup tls accept sockets */
 static void setup_tls_list(struct main_tap_data* maindata,
 	struct config_strlist_head* tls_list, char* server_key,
-	char* server_cert, char* verifypem, char* tls_protocols)
+	char* server_cert, char* verifypem)
 {
 	struct config_strlist* item;
 	for(item = tls_list->first; item; item = item->next) {
 		struct tap_socket* s;
 		s = tap_socket_new_tlsaccept(item->str, &dtio_mainfdcallback,
-			maindata, server_key, server_cert, verifypem, tls_protocols);
+			maindata, server_key, server_cert, verifypem);
 		if(!s) fatal_exit("out of memory");
 		if(!tap_socket_list_insert(&maindata->acceptlist, s))
 			fatal_exit("out of memory");
@@ -1300,7 +1300,7 @@ static void
 setup_and_run(struct config_strlist_head* local_list,
 	struct config_strlist_head* tcp_list,
 	struct config_strlist_head* tls_list, char* server_key,
-	char* server_cert, char* verifypem, char* tls_protocols)
+	char* server_cert, char* verifypem)
 {
 	time_t secs = 0;
 	struct timeval now;
@@ -1326,7 +1326,7 @@ setup_and_run(struct config_strlist_head* local_list,
 	setup_local_list(maindata, local_list);
 	setup_tcp_list(maindata, tcp_list);
 	setup_tls_list(maindata, tls_list, server_key, server_cert,
-		verifypem, tls_protocols);
+		verifypem);
 	if(!tap_socket_list_addevs(maindata->acceptlist, base))
 		fatal_exit("could not setup accept events");
 	if(verbosity) log_info("start of service");
@@ -1462,8 +1462,6 @@ int main(int argc, char** argv)
 	struct config_strlist_head tcp_list;
 	struct config_strlist_head tls_list;
 	char* server_key = NULL, *server_cert = NULL, *verifypem = NULL;
-
-	char* tls_protocols = "TLSv1.2 TLSv1.3";
 #ifdef USE_WINSOCK
 	WSADATA wsa_data;
 	if(WSAStartup(MAKEWORD(2,2), &wsa_data) != 0) {
@@ -1563,25 +1561,17 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 #endif /* HAVE_SSL */
 	}
 	setup_and_run(&local_list, &tcp_list, &tls_list, server_key,
-		server_cert, verifypem, tls_protocols);
+		server_cert, verifypem);
 	config_delstrlist(local_list.first);
 	config_delstrlist(tcp_list.first);
 	config_delstrlist(tls_list.first);
@@ -1735,11 +1725,6 @@ void libworker_event_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
 	log_assert(0);
 }
 
-void libworker_alloc_cleanup(void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
 int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 {
 	log_assert(0);

doc/Changelog

@@ -1,293 +1,3 @@
-20 May 2026: Wouter
-	- Fix CVE-2026-33278, Possible remote code execution during DNSSEC
-	  validation. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
-	- Fix CVE-2026-42944, Heap overflow and crash with multiple nsid,
-	  cookie, padding EDNS options. Thanks to Qifan Zhang, Palo Alto
-	  Networks, for the report.
-	- Fix CVE-2026-42959, Crash during DNSSEC validation of malicious
-	  content. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
-	- Fix CVE-2026-32792, Packet of death with DNSCrypt. Thanks to Andrew
-	  Griffiths from 'calif.io' for the report.
-	- Fix CVE-2026-40622, "Ghost domain name" variant. Thanks to Qifan
-	  Zhang, Palo Alto Networks, for the report.
-	- Fix CVE-2026-41292, Parsing a long list of incoming EDNS options
-	  degrades performance. Thanks to GitHub user 'N0zoM1z0', also Qifan
-	  Zhang from Palo Alto Networks, for the report.
-	- Fix CVE-2026-42534, Jostle logic bypass degrades resolution
-	  performance. Thanks to Qifan Zhang, Palo Alto Networks, for the
-	  report.
-	- Fix CVE-2026-42923, Degradation of service with unbounded NSEC3
-	  hash calculations. Thanks to Qifan Zhang, Palo Alto Networks, for
-	  the report.
-	- Fix CVE-2026-42960, Possible cache poisoning attack while following
-	  delegation. Thanks to TaoFei Guo from Peking University, Yang Luo
-	  and JianJun Chen, Tsinghua University, for the report.
-	- Fix CVE-2026-44390, Unbounded name compression in certain cases
-	  causes degradation of service. Thanks to Qifan Zhang, Palo Alto
-	  Networks, for the report.
-	- Fix CVE-2026-44608, Use after free and crash in RPZ code. Thanks
-	  to Qifan Zhang, Palo Alto Networks, for the report.
-
-23 April 2026: Wouter
-	- Merge #1441: Fix buffer overrun in
-	  doq_repinfo_retrieve_localaddr().
-	- For #1441: Fix type of ipv6 addr struct.
-
-21 April 2026: Wouter
-	- Add test case for malformed SVCB records. Thanks to
-	  Qifan Zhang, Palo Alto Networks for the additional test.
-	- Fix for the Jiggle Attack. The server is fixed to answer
-	  with errors for error cases, and does not stay silent.
-	  In addition, the error replies do not contain parts of the
-	  incoming query. This is more conformant, stops reflection
-	  and stops it as a covert channel. Thanks to Yuqi Qiu and
-	  Xiang Li, Nankai University (AOSP Lab) for the report.
-	  In addition, thanks to Qifan Zhang, Palo Alto Networks, for
-	  noting the fingerprinting possibility, that is also fixed
-	  with this.
-	- Fix EDNS extended RCODE reflection. This fixes that
-	  the server does not echo extended rcode values after class
-	  chaos queries. Thanks to Qifan Zhang, Palo Alto Networks
-	  for the report.
-	- Fix for iterator RCODE handling of YXDOMAIN. This fixes
-	  that the server only accepts YXDOMAIN answers that contain
-	  a DNAME record. This stops bad answers, and checks that
-	  the authoritative server gives correct replies.
-	  Thanks to Qifan Zhang, Palo Alto Networks for the report.
-	- Fix for missing bounds check for decompressing dnames
-	  for downloaded authority zones. This fixes that the server
-	  could end up with malformed zone content after receiving
-	  truncated packet contents from an AXFR. In addition, the
-	  domain names in the SOA rdata are checked before the
-	  authority code picks up the zone serial.
-	  Thanks to Halil Oktay for the report.
-	- Fix that upstream TLS connections are not reused as TLS
-	  connections for a different name, at the same IP. This
-	  checks that the tls name is correct when reusing the
-	  upstream connections. Thanks to TaoFei Guo from Peking
-	  University and JianJun Chen from Tsinghua University for
-	  the report.
-	- Fix that signatures are not allowed with revoked dnskeys.
-	  Thanks to Qifan Zhang, Palo Alto Networks for the report.
-	- Fix that a DNAME with an unsigned CNAME is checked for
-	  the correct match. This stops that for certain zone
-	  configurations an unchecked unsigned CNAME could get
-	  secure status. Thanks to Qifan Zhang, Palo Alto Networks
-	  for the report.
-	- Fix handling of wildcard CNAMEs in the chain of trust.
-	  An improper wildcard in the chain of trust would send
-	  the retries to the wrong upstream. Also it could label
-	  the step in the chain of trust as secure, when it was not.
-	  Thanks to Qifan Zhang, Palo Alto Networks for the report.
-	- Set version number to 1.25.0 of code repository.
-	- Fix doxygen comment syntax.
-
-20 April 2026: Wouter
-	- Fix compile warnings for thread setname routine, and test compile.
-	- Fix unused variable warning when compiled without ssl.
-	- Fix test with https zone for libressl.
-
-17 April 2026: Wouter
-	- Fix setup of ssl context copy of the tls service pem option,
-	  from a clang analyzer warning.
-	- Fix setup of ssl context copy, to check for the tls service
-	  pem option for stat calls.
-	- Fix to compile the shm code when there is no shmget.
-	- Update github ci to use actions/checkout@v6.
-	- Update github ci cross platform to use
-	  cross-platform-actions/action@v1.0.0.
-	- Fix github ci to speed up with parralel build, for windows ci.
-	- Fix compat/chacha_private sigma and tau definitions to use
-	  nonstring attribute.
-	- Fix compat/gmtime_r old style definition syntax.
-	- Fix to increase size of the buffer for the win_svc reportev log
-	  function.
-	- Fix ttl comparisons in rdata_copy for 32bit signed or unsigned.
-	- Fix subnet store of servfail to not leak memory.
-	- Update generated man pages.
-	- Update generated configure, with autoconf.
-	- Fix pthread_setname detection to fail on warnings.
-
-17 April 2026: Yorgos
-	- Merge #1400: Support pthread_setname_np. Adds support for
-	  pthread_setname_np and variants to set the name on spawned threads
-	  for easier debugging/monitoring.
-
-16 April 2026: Yorgos
-	- Merge #1406: Introduce new 'tls-protocols' configuration option.
-	- Introduce new 'tls-protocols' configuration option that specifies
-	  which of the supported TLS protocols will be used.
-	  This change invalidates some previous changes:
-	- TLSv1.2 is again enabled by default, but can be selectively turned
-	  off if desired (related to #1303).
-	- The biefly introduced (not yet released) 'tls-use-system-versions'
-	  configuration option, that addressed #1346, is reverted in favor of
-	  'tls-protocols'.
-	- The briefly introduced (not yet released) '--enable-system-tls'
-	  configure option, related to #1401, is no longer needed with the new
-	  option and the current default.
-	- Fix cleaning up DoH session. The same query can be on multiple
-	  streams in a session.
-
-16 April 2026: Wouter
-	- Fix configure, autoconf for #1406.
-
-15 April 2026: Wouter
-	- Fix RFC7766 compliance when client sends EOF over TCP. It stops
-	  pending replies and closes. Thanks to Yuxiao Wu, Tsinghua
-	  University for the report.
-	- Fix to shorten RRSIG count in scrubber, this protects against
-	  an overly large number of RRSIGs. It can be configured with
-	  `iter-scrub-rrsig: 8`, it has default 8. Thanks to Yuxiao Wu,
-	  Tsinghua University for the report.
-
-14 April 2026: Wouter
-	- Fix #1017: memory corruption related core dumps.
-	  When alloc_reg_obtain has an empty list, return a new allocation.
-	- Fix clang analyzer warning for subnetmod, when return_msg is
-	  NULL for update cache, like when it stores servfail status.
-	- iana portlist updated.
-
-13 April 2026: Yorgos
-	- Update the documentation of 'max-query-restarts' in the man page.
-
-10 April 2026: Wouter
-	- Fix for EDNS client subnet so that it does not store SERVFAIL in
-	  the global cache after a failed lookup, such as timeouts. A failure
-	  entry is stored in the subnet cache, for the query name, for a
-	  couple of seconds. Queries can continue to use the subnet cache
-	  during that time.
-
-7 April 2026: Yorgos
-	- Fix unused variable warning.
-
-30 March 2026: Wouter
-	- Merge #1408: Fix shared memory stats with threads.
-
-27 March 2026: Wouter
-	- Fix to allow the control-interface config to use ip@port notation.
-	- Fix test code to allow empty hex answer packets from testbound.
-	- Fix defense in depth for service callback with empty packet.
-
-24 March 2026: Wouter
-	- Fix to check for invalid http content length and chunk size,
-	  and to check the RR rdata field lengths when decompressing and
-	  inserting RRs from an authority zone transfer. This stops
-	  large memory use and heap buffer-overflow read errors. Thanks
-	  to Haruto Kimura (Stella) for the report.
-
-20 March 2026: Wouter
-	- Fix for testcode pktview to check buffer size and log errors.
-
-13 March 2026: Yorgos
-	- Fix to ignore out-of-zone DNAME records for CNAME synthesis. Thanks
-	  to Yuxiao Wu, Yiyi Wang, Zhang Chao, Baojun Liu, and Haixin Duan from
-	  Tsinghua University.
-
-13 March 2026: Wouter
-	- Fix #278: DoT: complete unbound restart required on certificate
-	  renew. Fix so that a reload checks if the files have changed, and
-	  if so, reload the contexts. Also for DoH, DoQ and outgoing DoT.
-	- iana portlist updated.
-	- For #278: fast_reload can reload tls-service-key, tls-service-pem
-	  and tls-cert-bundle changes. It checks the modification time of
-	  the tls-service-key and tls-service-pem files for update.
-	- Fix detection of http listening port in fast_reload.
-	- Fix to add tls-service-key to memory printout for fast_reload.
-
-9 March 2026: Wouter
-	- Fix compile failure in unbound-checkconf for older gcc compiler.
-	- Merge #1418: Apply cache TTL policy to DNAME and synthesized
-	  CNAME on wire path.
-
-6 March 2026: Wouter
-	- Merge #1415: Add lock unlock for view in memory error handling.
-
-6 March 2026: Yorgos
-	- Document the suggestion for a higher value for 'outgoing-range';
-	  helps when the request list is full.
-	- Warn for unused 'nodefault' local-zone configuration in
-	  unbound-checkconf (related to #1416).
-
-5 March 2026: Wouter
-	- Fix for DNS Rebinding Bypass via SVCB/HTTPS Records in Unbound.
-	  Thanks to Kunta Chu, School of Software, Tsinghua University,
-	  Taofei Guo, Peking University, and Jianjun Chen, Institute for
-	  Network Sciences and Cyberspace, Tsinghua University for the
-	  report. The private-address option is fixed to also elide
-	  SVCB and HTTPS records that match the filter.
-	- Update generated man pages.
-
-4 March 2026: Yorgos
-	- For #1411: Introduce a failing case in the rpl test so that it only
-	  passes with the fix in place.
-
-3 March 2026: Wouter
-	- Merge #1411: Allow synthesized DNAME TTL=0 to be served from cache
-	  within grace period. The responses are served from cache within
-	  a 1-second grace period. Reduces recursion when authoritative
-	  servers return DNAME with TTL=0 (RFC 2308). Response
-	  still returns TTL=0 to clients. Adds a test for it.
-	- For #1411: Fix that the lookup for DNAME uses flag. Fix assertion
-	  in expired calc debug routine.
-
-27 February 2026: Wouter
-	- Merge #1409: Documentation CNAME in redirect-type local-zone.
-	- Update generated man pages.
-
-25 February 2026: Wouter
-	- Fix validator to set unchecked when validation recursion
-	  requests are passed. The edns subnet module checks if validation
-	  is needed for a cache response, and set the validator to protect
-	  the cache with validation for non-subnet lookups.
-
-23 February 2026: Wouter
-	- Fix to have cachedb not return expired bogus data as non-bogus.
-	- Fix to make the cachedb_val_expired.crpl succeed.
-
-23 February 2026: Yorgos
-	- Fix to disallow cache lookup/store in external cachedb when a
-	  forwarder/stub forbids it with the no-cache option.
-	- Fixed some typos reported in #1395 by rezky_nightky.
-
-17 February 2026: Wouter
-	- Fix to remove unused conditional from cookie timestamp at
-	  worker env.
-	- For #1405: local-zone always_refuse also blocks queries of type DS.
-
-16 February 2026: Yorgos
-	- Fix #1404: Priming the root key fails after loading ipfire.org RPZ
-	  zones. Fixed by including the ZONEMD RRtype in the list of types to
-	  ignore for RPZ zones. Analysis and patch provided by ummeegge.
-
-16 February 2026: Wouter
-	- Fix that cachedb aggressive negative responses have the RA flag set.
-
-11 February 2026: Wouter
-	- Fix #1403: Inconsistency between do-nat64 and do-not-query-address
-	  during retries.
-
-9 February 2026: Wouter
-	- Merge #1401: Add a new build-time option for system TLS.
-	  The --enable-system-tls flag enables the
-	  tls-use-system-policy-versions setting by default.
-	- Update generated man pages.
-
-6 February 2026: Yorgos
-	- Fix #1389: [FR] replacement with ECC-GOST12 according to RFC9558.
-	  Patch contributed by Igor V. Ruzanov, available in
-	  contrib/gost12.patch.
-
-4 February 2026: Wouter
-	- Fix local privilege escalation on Windows. Thanks to Hao Huang and
-	  CrisprXiang with Fudan University for the report. The OpenSSL
-	  init calls are set to not load the openssl.cnf file when compiled
-	  for Windows.
-
-3 February 2026: Yorgos
-	- Eagerly remove .skip mark files in between mini_tdir.sh runs in case
-	  there has been a change on the environment.
-
 27 January 2026: Wouter
 	- Add test for allow-notify with a host name.
 

doc/example.conf.in

@@ -193,9 +193,6 @@ server:
 	# Limit on number of CNAME, DNAME records for incoming packets.
 	# iter-scrub-cname: 11
 
-	# Limit on number of RRSIGs for an RRset for incoming packets.
-	# iter-scrub-rrsig: 8
-
 	# Limit on upstream queries for an incoming query and its recursion.
 	# max-global-quota: 200
 
@@ -665,7 +662,7 @@ server:
 	# or, just before the iterator).
 	# module-config: "validator iterator"
 
-	# File with trusted keys, kept up-to-date using RFC5011 probes,
+	# File with trusted keys, kept uptodate using RFC5011 probes,
 	# initial file like trust-anchor-file, then it stores metadata.
 	# Use several entries, one per domain name, to track multiple zones.
 	#
@@ -725,7 +722,7 @@ server:
 	# val-max-restart: 5
 
 	# Should additional section of secure message also be kept clean of
-	# non-secure data. Useful to shield the users of this validator from
+	# unsecure data. Useful to shield the users of this validator from
 	# potential bogus data in the additional section. All unsigned data
 	# in the additional section is removed from secure messages.
 	# val-clean-additional: yes
@@ -968,12 +965,16 @@ server:
 	# tls-ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
 
 	# Use the SNI extension for TLS connections.  Default is yes.
-	# Changing the value requires a restart.
+	# Changing the value requires a reload.
 	# tls-use-sni: yes
 
-	# TLS protocols.
-	# Changing the value requires a restart.
-	# tls-protocols: "TLSv1.2 TLSv1.3"
+	# Allow general-purpose version-flexible TLS server configuration that
+	# may be further restricted by the system's policy.
+	# Use only if you want to support legacy TLS client connections.
+	# Default is no and Unbound will only use the latest available TLS
+	# version.
+	# Changing the value requires a reload.
+	# tls-use-system-policy-versions: no
 
 	# Add the secret file for TLS Session Ticket.
 	# Secret file must be 80 bytes of random data.

doc/unbound-control.8.in

@@ -168,8 +168,6 @@ ipset,
 \fI\%tcp\-auth\-query\-timeout\fP,
 \fI\%delay\-close\fP\&.
 \fI\%iter\-scrub\-promiscuous\fP\&.
-\fI\%tls\-service\-key\fP\&.
-\fI\%tls\-service\-pem\fP\&.
 .sp
 It does not work with
 \fI\%interface\fP and

doc/unbound-control.rst

@@ -170,8 +170,6 @@ There are several commands that the server understands.
     :ref:`tcp-auth-query-timeout<unbound.conf.tcp-auth-query-timeout>`,
     :ref:`delay-close<unbound.conf.delay-close>`.
     :ref:`iter-scrub-promiscuous<unbound.conf.iter-scrub-promiscuous>`.
-    :ref:`tls-service-key<unbound.conf.tls-service-key>`.
-    :ref:`tls-service-pem<unbound.conf.tls-service-pem>`.
 
     It does not work with
     :ref:`interface<unbound.conf.interface>` and

doc/unbound.conf.5.in

@@ -382,10 +382,6 @@ Default depends on compile options.
 Larger numbers need extra resources from the operating system.
 For performance a very large value is best, use libevent to make this
 possible.
-Should be higher (preferably double) than the value of
-\fI\%num\-queries\-per\-thread\fP to
-account for cases where the request list is full and avoid file descriptor
-starvation.
 .sp
 Default: 4096 (libevent) / 960 (minievent) / 48 (windows)
 .UNINDENT
@@ -1139,13 +1135,9 @@ The file must contain the private key for the TLS session, the public
 certificate is in the \fI\%tls\-service\-pem\fP
 file and it must also be specified if
 \fI\%tls\-service\-key\fP is specified.
-If the key is stored with root permissions or outside of chroot, then
-a change or enabling or disabling requires a restart (a reload is not
-enough).
-But if the key file (and tls\-service\-pem file) are accessible, then they
-are read in on reload, and fast_reload.
-The server checks the modification time of the file (and the filename)
-to see if the file has changed for reload.
+Enabling or disabling this service requires a restart (a reload is not
+enough), because the key is read while root permissions are held and before
+chroot (if any).
 The ports enabled implicitly or explicitly via
 \fI\%tls\-port\fP and
 \fI\%https\-port\fP do not provide normal DNS TCP
@@ -1298,7 +1290,7 @@ Enable or disable sending the SNI extension on TLS connections.
 \fBNOTE:\fP
 .INDENT 7.0
 .INDENT 3.5
-Changing the value requires a restart.
+Changing the value requires a reload.
 .UNINDENT
 .UNINDENT
 .sp
@@ -1306,19 +1298,30 @@ Default: yes
 .UNINDENT
 .INDENT 0.0
 .TP
-.B tls\-protocols: \fI\(dq<list of protocols>\(dq\fP 
-Specify the allowed TLS protocol versions to use, in no particular order.
-Possible values are \fBTLSv1.2\fP and \fBTLSv1.3\fP\&.
-Enclose list of protocols in quotes (\fB\(dq\(dq\fP) and put spaces between them.
+.B tls\-use\-system\-policy\-versions: \fI<yes or no>\fP 
+Enable or disable general\-puspose version\-flexible TLS server configuration
+when serving TLS.
+This will allow the whole list of available TLS versions provided by the
+crypto library, which may have been further restricted by the system\(aqs
+crypto policy.
+.sp
+By default Unbound only uses the latest available TLS version.
+.sp
+\fBCAUTION:\fP
+.INDENT 7.0
+.INDENT 3.5
+Use only if you want to support legacy TLS client connections.
+.UNINDENT
+.UNINDENT
 .sp
 \fBNOTE:\fP
 .INDENT 7.0
 .INDENT 3.5
-Changing the value requires a restart.
+Changing the value requires a reload.
 .UNINDENT
 .UNINDENT
 .sp
-Default: \(dqTLSv1.2 TLSv1.3\(dq
+Default: no
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -2269,11 +2272,6 @@ This protects against so\-called DNS Rebinding, where a user browser is
 turned into a network proxy, allowing remote access through the browser to
 other parts of your private network.
 .sp
-The option removes resource records of types A, AAAA, SVCB and HTTPS
-that match the filter.
-Inside the SVCB and HTTPS records, the svcparams of type ipv4hint
-and ipv6hint are checked for matches.
-.sp
 Some names can be allowed to contain your private addresses, by default all
 the \fI\%local\-data\fP that you configured is
 allowed to, and you can specify additional names using
@@ -3012,39 +3010,6 @@ local\-data: \(dqexample.com. A 127.0.0.1\(dq
 queries for \fBwww.example.com\fP and \fBwww.foo.example.com\fP are
 redirected, so that users with web browsers cannot access sites with
 suffix example.com.
-.sp
-A \fBCNAME\fP record can also be provided via local\-data:
-.INDENT 7.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-local\-zone: \(dqexample.com.\(dq redirect
-local\-data: \(dqexample.com. CNAME www.example.org.\(dq
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-In that case, the \fBCNAME\fP is resolved and the answer
-includes resolved target records as well.
-The \fBCNAME\fP record has to be with the zone name of the local\-zone,
-and there can be one CNAME, not more.
-The \fBCNAME\fP record has to be at the zone apex of the
-\fBredirect\fP zone, then it is used for redirection.
-The resolution proceeds with upstream DNS resolution, and
-that does not include the lookup in local zones.
-So the record is not able to point in local zones, but it
-can point to upstream DNS answers.
-.sp
-\fBCNAME\fP resolution is supported only in type \fBredirect\fP
-local\-zone, and in type \fBinform_redirect\fP local\-zone.
-.sp
-As different from \fBCNAME\fP records that are used elsewhere, in
-the \fBredirect\fP type local\-zone, it is supported that in the target
-of the record a wildcard label gets expanded to the query name, with
-for example: \fBexample.com. CNAME *.foo.net.\fP gets expanded
-to \fBwww.example.com. CNAME www.example.com.foo.net.\fP\&.
 .UNINDENT
 .INDENT 7.0
 .TP
@@ -3103,9 +3068,6 @@ use IPv6 protocol and avoid any queries to IPv4.
 .B always_refuse 
 Like \fI\%refuse\fP, but ignores
 local data and refuses the query.
-This type also blocks queries of type DS for the zone name.
-That can break the DNSSEC chain of trust, but it is refused anyway.
-The block for type DS assists in more completely blocking the zone.
 .UNINDENT
 .INDENT 7.0
 .TP
@@ -3769,10 +3731,6 @@ Default: 32
 Hard limit on the number of times Unbound is allowed to restart a query
 upon encountering a CNAME record.
 Results in SERVFAIL when reached.
-This applies to chained CNAME records but not sporadic CNAME records that
-could be encountered in the lifetime of the query\(aqs resolution effort.
-When a CNAME chain concludes, the counter keeping track of this limit is
-reset.
 Changing this value needs caution as it can allow long CNAME chains to be
 accepted, where Unbound needs to verify (resolve) each link individually.
 .sp
@@ -3800,16 +3758,6 @@ Default: 11
 .UNINDENT
 .INDENT 0.0
 .TP
-.B iter\-scrub\-rrsig: \fI<number>\fP 
-Limit on the number of RRSIGs allowed for an RRset, from the iterator
-scrubber.
-This protects against an overly large number of RRSIGs.
-Clips off the remainder of the RRSIG list at that point.
-.sp
-Default: 8
-.UNINDENT
-.INDENT 0.0
-.TP
 .B max\-global\-quota: \fI<number>\fP 
 Limit on the number of upstream queries sent out for an incoming query and
 its subqueries from recursion.
@@ -3991,7 +3939,7 @@ Default: no
 .UNINDENT
 .INDENT 0.0
 .TP
-.B control\-interface: \fI<IP address or interface name[@port] or path>\fP 
+.B control\-interface: \fI<IP address or interface name or path>\fP 
 Give IPv4 or IPv6 addresses or local socket path to listen on for control
 commands.
 If an interface name is used instead of an IP address, the list of IP
@@ -4808,17 +4756,6 @@ Default: no
 Use a specific NAT64 prefix to reach IPv4\-only servers.
 The prefix length must be one of /32, /40, /48, /56, /64 or /96.
 .sp
-The NAT64 prefix is allowed by the
-\fI\%do\-not\-query\-address\fP option,
-so that there is a clear outcome of addresses in both; the NAT64 prefix
-is allowed.
-The IPv4 address could be filtered by the
-\fI\%do\-not\-query\-address\fP option,
-if needed.
-Allowing the NAT64 prefix is useful when using do\-not\-query\-address
-for a cluster of machines that is IPv6\-only and uses NAT64, but does
-not have internet access.
-.sp
 Default: 64:ff9b::/96 (same as \fI\%dns64\-prefix\fP)
 .UNINDENT
 .SH DNSCRYPT OPTIONS

doc/unbound.conf.rst

@@ -366,10 +366,6 @@ These options are part of the ``server:`` section.
     Larger numbers need extra resources from the operating system.
     For performance a very large value is best, use libevent to make this
     possible.
-    Should be higher (preferably double) than the value of
-    :ref:`num-queries-per-thread<unbound.conf.num-queries-per-thread>` to
-    account for cases where the request list is full and avoid file descriptor
-    starvation.
 
     Default: 4096 (libevent) / 960 (minievent) / 48 (windows)
 
@@ -1048,13 +1044,9 @@ These options are part of the ``server:`` section.
     certificate is in the :ref:`tls-service-pem<unbound.conf.tls-service-pem>`
     file and it must also be specified if
     :ref:`tls-service-key<unbound.conf.tls-service-key>` is specified.
-    If the key is stored with root permissions or outside of chroot, then
-    a change or enabling or disabling requires a restart (a reload is not
-    enough).
-    But if the key file (and tls-service-pem file) are accessible, then they
-    are read in on reload, and fast_reload.
-    The server checks the modification time of the file (and the filename)
-    to see if the file has changed for reload.
+    Enabling or disabling this service requires a restart (a reload is not
+    enough), because the key is read while root permissions are held and before
+    chroot (if any).
     The ports enabled implicitly or explicitly via
     :ref:`tls-port<unbound.conf.tls-port>` and
     :ref:`https-port<unbound.conf.https-port>` do not provide normal DNS TCP
@@ -1180,19 +1172,25 @@ These options are part of the ``server:`` section.
 @@UAHL@unbound.conf@tls-use-sni@@: *<yes or no>*
     Enable or disable sending the SNI extension on TLS connections.
 
-    .. note:: Changing the value requires a restart.
+    .. note:: Changing the value requires a reload.
 
     Default: yes
 
 
-@@UAHL@unbound.conf@tls-protocols@@: *"<list of protocols>"*
-    Specify the allowed TLS protocol versions to use, in no particular order.
-    Possible values are ``TLSv1.2`` and ``TLSv1.3``.
-    Enclose list of protocols in quotes (``""``) and put spaces between them.
+@@UAHL@unbound.conf@tls-use-system-policy-versions@@: *<yes or no>*
+    Enable or disable general-puspose version-flexible TLS server configuration
+    when serving TLS.
+    This will allow the whole list of available TLS versions provided by the
+    crypto library, which may have been further restricted by the system's
+    crypto policy.
 
-    .. note:: Changing the value requires a restart.
+    By default Unbound only uses the latest available TLS version.
 
-    Default: "TLSv1.2 TLSv1.3"
+    .. caution:: Use only if you want to support legacy TLS client connections.
+
+    .. note:: Changing the value requires a reload.
+
+    Default: no
 
 
 @@UAHL@unbound.conf@pad-responses@@: *<yes or no>*
@@ -2014,11 +2012,6 @@ These options are part of the ``server:`` section.
     turned into a network proxy, allowing remote access through the browser to
     other parts of your private network.
 
-    The option removes resource records of types A, AAAA, SVCB and HTTPS
-    that match the filter.
-    Inside the SVCB and HTTPS records, the svcparams of type ipv4hint
-    and ipv6hint are checked for matches.
-
     Some names can be allowed to contain your private addresses, by default all
     the :ref:`local-data<unbound.conf.local-data>` that you configured is
     allowed to, and you can specify additional names using
@@ -2055,13 +2048,6 @@ These options are part of the ``server:`` section.
     flushing away any poison.
     A value of 10 million is suggested.
 
-    It is useful to add 0.0.0.0/8 and '::' to the
-    :ref:`do-not-query-address<unbound.conf.do-not-query-address>` list.
-    Otherwise they may be answered, from localhost, and the different source
-    makes an unwanted reply that unnecessarily ticks up.
-    The :ref:`do-not-query-localhost<unbound.conf.do-not-query-localhost>`
-    option includes them, the zero subnets, when it is enabled.
-
     Default: 0 (disabled)
 
 
@@ -2676,33 +2662,6 @@ These options are part of the ``server:`` section.
         redirected, so that users with web browsers cannot access sites with
         suffix example.com.
 
-        A ``CNAME`` record can also be provided via local-data:
-
-        .. code-block:: text
-
-            local-zone: "example.com." redirect
-            local-data: "example.com. CNAME www.example.org."
-
-        In that case, the ``CNAME`` is resolved and the answer
-        includes resolved target records as well.
-        The ``CNAME`` record has to be with the zone name of the local-zone,
-        and there can be one CNAME, not more.
-        The ``CNAME`` record has to be at the zone apex of the
-        ``redirect`` zone, then it is used for redirection.
-        The resolution proceeds with upstream DNS resolution, and
-        that does not include the lookup in local zones.
-        So the record is not able to point in local zones, but it
-        can point to upstream DNS answers.
-
-        ``CNAME`` resolution is supported only in type ``redirect``
-        local-zone, and in type ``inform_redirect`` local-zone.
-
-        As different from ``CNAME`` records that are used elsewhere, in
-        the ``redirect`` type local-zone, it is supported that in the target
-        of the record a wildcard label gets expanded to the query name, with
-        for example: ``example.com. CNAME *.foo.net.`` gets expanded
-        to ``www.example.com. CNAME www.example.com.foo.net.``.
-
     @@UAHL@unbound.conf.local-zone.type@inform@@
         The query is answered normally, same as
         :ref:`transparent<unbound.conf.local-zone.type.transparent>`.
@@ -2742,9 +2701,6 @@ These options are part of the ``server:`` section.
     @@UAHL@unbound.conf.local-zone.type@always_refuse@@
         Like :ref:`refuse<unbound.conf.local-zone.type.refuse>`, but ignores
         local data and refuses the query.
-        This type also blocks queries of type DS for the zone name.
-        That can break the DNSSEC chain of trust, but it is refused anyway.
-        The block for type DS assists in more completely blocking the zone.
 
     @@UAHL@unbound.conf.local-zone.type@always_nxdomain@@
         Like :ref:`static<unbound.conf.local-zone.type.static>`, but ignores
@@ -3267,10 +3223,6 @@ These options are part of the ``server:`` section.
     Hard limit on the number of times Unbound is allowed to restart a query
     upon encountering a CNAME record.
     Results in SERVFAIL when reached.
-    This applies to chained CNAME records but not sporadic CNAME records that
-    could be encountered in the lifetime of the query's resolution effort.
-    When a CNAME chain concludes, the counter keeping track of this limit is
-    reset.
     Changing this value needs caution as it can allow long CNAME chains to be
     accepted, where Unbound needs to verify (resolve) each link individually.
 
@@ -3295,15 +3247,6 @@ These options are part of the ``server:`` section.
     Default: 11
 
 
-@@UAHL@unbound.conf@iter-scrub-rrsig@@: *<number>*
-    Limit on the number of RRSIGs allowed for an RRset, from the iterator
-    scrubber.
-    This protects against an overly large number of RRSIGs.
-    Clips off the remainder of the RRSIG list at that point.
-
-    Default: 8
-
-
 @@UAHL@unbound.conf@max-global-quota@@: *<number>*
     Limit on the number of upstream queries sent out for an incoming query and
     its subqueries from recursion.
@@ -3468,7 +3411,7 @@ To setup the correct self-signed certificates use the
     Default: no
 
 
-@@UAHL@unbound.conf.remote@control-interface@@: *<IP address or interface name[@port] or path>*
+@@UAHL@unbound.conf.remote@control-interface@@: *<IP address or interface name or path>*
     Give IPv4 or IPv6 addresses or local socket path to listen on for control
     commands.
     If an interface name is used instead of an IP address, the list of IP
@@ -4218,17 +4161,6 @@ servers.
     Use a specific NAT64 prefix to reach IPv4-only servers.
     The prefix length must be one of /32, /40, /48, /56, /64 or /96.
 
-    The NAT64 prefix is allowed by the
-    :ref:`do-not-query-address<unbound.conf.do-not-query-address>` option,
-    so that there is a clear outcome of addresses in both; the NAT64 prefix
-    is allowed.
-    The IPv4 address could be filtered by the
-    :ref:`do-not-query-address<unbound.conf.do-not-query-address>` option,
-    if needed.
-    Allowing the NAT64 prefix is useful when using do-not-query-address
-    for a cluster of machines that is IPv6-only and uses NAT64, but does
-    not have internet access.
-
     Default: 64:ff9b::/96 (same as :ref:`dns64-prefix<unbound.conf.dns64.dns64-prefix>`)
 
 .. _unbound.conf.dnscrypt:

doc/unbound.doxygen

@@ -1007,6 +1007,7 @@ EXCLUDE                = ./build \
                          libunbound/python/doc \
                          libunbound/python/examples \
                          ./ldns-src \
+                         ./simdzone \
                          README.md \
                          doc/control_proto_spec.txt \
                          doc/requirements.txt

edns-subnet/subnetmod.c

@@ -70,7 +70,6 @@ subnet_data_delete(void *d, void *ATTR_UNUSED(arg))
 	r = (struct subnet_msg_cache_data*)d;
 	addrtree_delete(r->tree4);
 	addrtree_delete(r->tree6);
-	free(r->reason_fail);
 	free(r);
 }
 
@@ -85,8 +84,6 @@ msg_cache_sizefunc(void *k, void *d)
 		+ q->key.qname_len + lock_get_mem(&q->entry.lock);
 	s += addrtree_size(r->tree4);
 	s += addrtree_size(r->tree6);
-	if(r->reason_fail)
-		s += strlen(r->reason_fail)+1;
 	return s;
 }
 
@@ -203,18 +200,12 @@ int ecs_whitelist_check(struct query_info* qinfo,
 			if(sq->ecs_server_out.subnet_source_mask == 0) {
 				sq->subnet_sent_no_subnet = 1;
 				sq->subnet_sent = 0;
-				/* The result should end up in subnet cache,
-				 * not in global cache. */
-				qstate->no_cache_store = 1;
 				return 1;
 			}
 			subnet_ecs_opt_list_append(&sq->ecs_server_out,
 				&qstate->edns_opts_back_out, qstate, region);
 		}
 		sq->subnet_sent = 1;
-		/* Do not store servfails in global cache, since the subnet
-		 * option is sent out. */
-		qstate->no_cache_store = 1;
 	}
 	else {
 		/* Outgoing ECS option is set, but we don't want to sent it to
@@ -436,35 +427,6 @@ update_cache(struct module_qstate *qstate, int id)
 	}
 	/* lru_entry->lock is locked regardless of how we got here,
 	 * either from the slabhash_lookup, or above in the new allocated */
-	if(!qstate->return_msg && qstate->error_response_cache) {
-		struct subnet_msg_cache_data *data =
-			(struct subnet_msg_cache_data*)lru_entry->data;
-		data->ttl_servfail = *qstate->env->now + NORR_TTL;
-		data->ede_fail = errinf_to_reason_bogus(qstate);
-		diff_size = (data->reason_fail?strlen(data->reason_fail)+1:0);
-		if(qstate->errinf) {
-			char* str = errinf_to_str_misc(qstate);
-			free(data->reason_fail);
-			data->reason_fail = NULL;
-			if(str)
-				data->reason_fail = strdup(str);
-		}
-		diff_size = (data->reason_fail?strlen(data->reason_fail)+1:0)
-			- diff_size;
-		lock_rw_unlock(&lru_entry->lock);
-		if (need_to_insert) {
-			slabhash_insert(subnet_msg_cache, h, lru_entry,
-				lru_entry->data, NULL);
-		} else {
-			slabhash_update_space_used(subnet_msg_cache, h, NULL,
-				diff_size);
-		}
-		return;
-	}
-	if(!qstate->return_msg) {
-		lock_rw_unlock(&lru_entry->lock);
-		return;
-	}
 	/* Step 2, find the correct tree */
 	if (!(tree = get_tree(lru_entry->data, edns, sne, qstate->env->cfg))) {
 		lock_rw_unlock(&lru_entry->lock);
@@ -508,21 +470,6 @@ update_cache(struct module_qstate *qstate, int id)
 	}
 }
 
-/** See if there is a stored servfail, returns true if so, and sets reply. */
-static int
-lookup_check_servfail(struct module_qstate *qstate,
-	struct subnet_msg_cache_data *data)
-{
-	struct module_env *env = qstate->env;
-	if(!data)
-		return 0;
-	if(!data->ttl_servfail || TTL_IS_EXPIRED(data->ttl_servfail, *env->now))
-		return 0;
-	qstate->return_rcode = LDNS_RCODE_SERVFAIL;
-	errinf_ede(qstate, data->reason_fail, data->ede_fail);
-	return 1;
-}
-
 /** Lookup in cache and reply true iff reply is sent. */
 static int
 lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq, int prefetch)
@@ -536,8 +483,6 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 	struct addrtree *tree;
 	struct addrnode *node;
 	uint8_t scope;
-	int must_validate = (!(qstate->query_flags&BIT_CD)
-		|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;
 
 	memset(&sq->ecs_client_out, 0, sizeof(sq->ecs_client_out));
 
@@ -551,20 +496,12 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 	tree = (ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4)?
 		data->tree4 : data->tree6;
 	if (!tree) { /* qinfo in cache but not for this family */
-		if(lookup_check_servfail(qstate, data)) {
-			lock_rw_unlock(&e->lock);
-			return 1;
-		}
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
 	node = addrtree_find(tree, (addrkey_t*)ecs->subnet_addr, 
 		ecs->subnet_source_mask, *env->now);
 	if (!node) { /* plain old cache miss */
-		if(lookup_check_servfail(qstate, data)) {
-			lock_rw_unlock(&e->lock);
-			return 1;
-		}
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
@@ -573,24 +510,12 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 		(struct reply_info *)node->elem, qstate->region, *env->now, 0,
 		env->scratch);
 	scope = (uint8_t)node->scope;
+	lock_rw_unlock(&e->lock);
 	
 	if (!qstate->return_msg) { /* Failed allocation or expired TTL */
-		if(lookup_check_servfail(qstate, data)) {
-			lock_rw_unlock(&e->lock);
-			return 1;
-		}
-		lock_rw_unlock(&e->lock);
 		return 0;
 	}
-	lock_rw_unlock(&e->lock);
-	if(qstate->return_msg->rep->security == sec_status_unchecked
-		&& must_validate) {
-		/* The message has to be validated first. */
-		verbose(VERB_ALGO, "subnet: unchecked cache entry needs "
-			"validation");
-		return 0;
-	}
-
+	
 	if (sq->subnet_downstream) { /* relay to interested client */
 		sq->ecs_client_out.subnet_scope_mask = scope;
 		sq->ecs_client_out.subnet_addr_fam = ecs->subnet_addr_fam;
@@ -645,10 +570,7 @@ generate_sub_request(struct module_qstate *qstate, int id, struct subnet_qstate*
 	qflags |= BIT_RD;
 	if((qstate->query_flags & BIT_CD)!=0) {
 		qflags |= BIT_CD;
-		/* The valrec is left off. Leave out: valrec = 1;
-		 * So that the cache is protected with DNSSEC validation.
-		 * Just like the global cache. DNSSEC validation is performed
-		 * regardless of the setting of the querier's CD flag. */
+		valrec = 1;
 	}
 
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
@@ -718,12 +640,6 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		/* already an answer and its not a message, but retain
 		 * the actual rcode, instead of module_error, so send
 		 * module_finished */
-		if(qstate->error_response_cache) {
-			verbose(VERB_ALGO, "subnet: store error response");
-			lock_rw_wrlock(&sne->biglock);
-			update_cache(qstate, id);
-			lock_rw_unlock(&sne->biglock);
-		}
 		return module_finished;
 	}
 
@@ -973,11 +889,9 @@ ecs_edns_back_parsed(struct module_qstate* qstate, int id,
 				sq->max_scope = sq->ecs_server_in.subnet_scope_mask;
 	} else if(sq->subnet_sent_no_subnet) {
 		/* The answer can be stored as scope 0, not in global cache. */
-		/* This was already set in ecs_whitelist_check */
 		qstate->no_cache_store = 1;
 	} else if(sq->subnet_sent) {
 		/* Need another query to be able to store in global cache. */
-		/* This was already set in ecs_whitelist_check */
 		qstate->no_cache_store = 1;
 	}
 

edns-subnet/subnetmod.h

@@ -69,18 +69,8 @@ struct subnet_env {
 };
 
 struct subnet_msg_cache_data {
-	/** Tree for nodes with IPv4 subnets. */
 	struct addrtree* tree4;
-	/** Tree for nodes with IPv6 subnets. */
 	struct addrtree* tree6;
-	/** If servfail is stored, for how long. Abs time in seconds.
-	 * This protects against too much recusion on the item when
-	 * resolution fails, for a couple of seconds. */
-	time_t ttl_servfail;
-	/** servfail ede */
-	sldns_ede_code ede_fail;
-	/** servfail reason */
-	char* reason_fail;
 };
 
 struct subnet_qstate {

install-sh

@@ -1,501 +0,0 @@
-#!/usr/bin/sh
-# install - install a program, script, or datafile
-
-scriptversion=2013-12-25.23; # UTC
-
-# This originates from X11R5 (mit/util/scripts/install.sh), which was
-# later released in X11R6 (xc/config/util/install.sh) with the
-# following copyright and license.
-#
-# Copyright (C) 1994 X Consortium
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to
-# deal in the Software without restriction, including without limitation the
-# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-# sell copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
-# X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
-# AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC-
-# TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-#
-# Except as contained in this notice, the name of the X Consortium shall not
-# be used in advertising or otherwise to promote the sale, use or other deal-
-# ings in this Software without prior written authorization from the X Consor-
-# tium.
-#
-#
-# FSF changes to this file are in the public domain.
-#
-# Calling this script install-sh is preferred over install.sh, to prevent
-# 'make' implicit rules from creating a file called install from it
-# when there is no Makefile.
-#
-# This script is compatible with the BSD install script, but was written
-# from scratch.
-
-tab='	'
-nl='
-'
-IFS=" $tab$nl"
-
-# Set DOITPROG to "echo" to test this script.
-
-doit=${DOITPROG-}
-doit_exec=${doit:-exec}
-
-# Put in absolute file names if you don't have them in your path;
-# or use environment vars.
-
-chgrpprog=${CHGRPPROG-chgrp}
-chmodprog=${CHMODPROG-chmod}
-chownprog=${CHOWNPROG-chown}
-cmpprog=${CMPPROG-cmp}
-cpprog=${CPPROG-cp}
-mkdirprog=${MKDIRPROG-mkdir}
-mvprog=${MVPROG-mv}
-rmprog=${RMPROG-rm}
-stripprog=${STRIPPROG-strip}
-
-posix_mkdir=
-
-# Desired mode of installed file.
-mode=0755
-
-chgrpcmd=
-chmodcmd=$chmodprog
-chowncmd=
-mvcmd=$mvprog
-rmcmd="$rmprog -f"
-stripcmd=
-
-src=
-dst=
-dir_arg=
-dst_arg=
-
-copy_on_change=false
-is_target_a_directory=possibly
-
-usage="\
-Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
-   or: $0 [OPTION]... SRCFILES... DIRECTORY
-   or: $0 [OPTION]... -t DIRECTORY SRCFILES...
-   or: $0 [OPTION]... -d DIRECTORIES...
-
-In the 1st form, copy SRCFILE to DSTFILE.
-In the 2nd and 3rd, copy all SRCFILES to DIRECTORY.
-In the 4th, create DIRECTORIES.
-
-Options:
-     --help     display this help and exit.
-     --version  display version info and exit.
-
-  -c            (ignored)
-  -C            install only if different (preserve the last data modification time)
-  -d            create directories instead of installing files.
-  -g GROUP      $chgrpprog installed files to GROUP.
-  -m MODE       $chmodprog installed files to MODE.
-  -o USER       $chownprog installed files to USER.
-  -s            $stripprog installed files.
-  -t DIRECTORY  install into DIRECTORY.
-  -T            report an error if DSTFILE is a directory.
-
-Environment variables override the default commands:
-  CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
-  RMPROG STRIPPROG
-"
-
-while test $# -ne 0; do
-  case $1 in
-    -c) ;;
-
-    -C) copy_on_change=true;;
-
-    -d) dir_arg=true;;
-
-    -g) chgrpcmd="$chgrpprog $2"
-        shift;;
-
-    --help) echo "$usage"; exit $?;;
-
-    -m) mode=$2
-        case $mode in
-          *' '* | *"$tab"* | *"$nl"* | *'*'* | *'?'* | *'['*)
-            echo "$0: invalid mode: $mode" >&2
-            exit 1;;
-        esac
-        shift;;
-
-    -o) chowncmd="$chownprog $2"
-        shift;;
-
-    -s) stripcmd=$stripprog;;
-
-    -t)
-        is_target_a_directory=always
-        dst_arg=$2
-        # Protect names problematic for 'test' and other utilities.
-        case $dst_arg in
-          -* | [=\(\)!]) dst_arg=./$dst_arg;;
-        esac
-        shift;;
-
-    -T) is_target_a_directory=never;;
-
-    --version) echo "$0 $scriptversion"; exit $?;;
-
-    --) shift
-        break;;
-
-    -*) echo "$0: invalid option: $1" >&2
-        exit 1;;
-
-    *)  break;;
-  esac
-  shift
-done
-
-# We allow the use of options -d and -T together, by making -d
-# take the precedence; this is for compatibility with GNU install.
-
-if test -n "$dir_arg"; then
-  if test -n "$dst_arg"; then
-    echo "$0: target directory not allowed when installing a directory." >&2
-    exit 1
-  fi
-fi
-
-if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
-  # When -d is used, all remaining arguments are directories to create.
-  # When -t is used, the destination is already specified.
-  # Otherwise, the last argument is the destination.  Remove it from $@.
-  for arg
-  do
-    if test -n "$dst_arg"; then
-      # $@ is not empty: it contains at least $arg.
-      set fnord "$@" "$dst_arg"
-      shift # fnord
-    fi
-    shift # arg
-    dst_arg=$arg
-    # Protect names problematic for 'test' and other utilities.
-    case $dst_arg in
-      -* | [=\(\)!]) dst_arg=./$dst_arg;;
-    esac
-  done
-fi
-
-if test $# -eq 0; then
-  if test -z "$dir_arg"; then
-    echo "$0: no input file specified." >&2
-    exit 1
-  fi
-  # It's OK to call 'install-sh -d' without argument.
-  # This can happen when creating conditional directories.
-  exit 0
-fi
-
-if test -z "$dir_arg"; then
-  if test $# -gt 1 || test "$is_target_a_directory" = always; then
-    if test ! -d "$dst_arg"; then
-      echo "$0: $dst_arg: Is not a directory." >&2
-      exit 1
-    fi
-  fi
-fi
-
-if test -z "$dir_arg"; then
-  do_exit='(exit $ret); exit $ret'
-  trap "ret=129; $do_exit" 1
-  trap "ret=130; $do_exit" 2
-  trap "ret=141; $do_exit" 13
-  trap "ret=143; $do_exit" 15
-
-  # Set umask so as not to create temps with too-generous modes.
-  # However, 'strip' requires both read and write access to temps.
-  case $mode in
-    # Optimize common cases.
-    *644) cp_umask=133;;
-    *755) cp_umask=22;;
-
-    *[0-7])
-      if test -z "$stripcmd"; then
-        u_plus_rw=
-      else
-        u_plus_rw='% 200'
-      fi
-      cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;;
-    *)
-      if test -z "$stripcmd"; then
-        u_plus_rw=
-      else
-        u_plus_rw=,u+rw
-      fi
-      cp_umask=$mode$u_plus_rw;;
-  esac
-fi
-
-for src
-do
-  # Protect names problematic for 'test' and other utilities.
-  case $src in
-    -* | [=\(\)!]) src=./$src;;
-  esac
-
-  if test -n "$dir_arg"; then
-    dst=$src
-    dstdir=$dst
-    test -d "$dstdir"
-    dstdir_status=$?
-  else
-
-    # Waiting for this to be detected by the "$cpprog $src $dsttmp" command
-    # might cause directories to be created, which would be especially bad
-    # if $src (and thus $dsttmp) contains '*'.
-    if test ! -f "$src" && test ! -d "$src"; then
-      echo "$0: $src does not exist." >&2
-      exit 1
-    fi
-
-    if test -z "$dst_arg"; then
-      echo "$0: no destination specified." >&2
-      exit 1
-    fi
-    dst=$dst_arg
-
-    # If destination is a directory, append the input filename; won't work
-    # if double slashes aren't ignored.
-    if test -d "$dst"; then
-      if test "$is_target_a_directory" = never; then
-        echo "$0: $dst_arg: Is a directory" >&2
-        exit 1
-      fi
-      dstdir=$dst
-      dst=$dstdir/`basename "$src"`
-      dstdir_status=0
-    else
-      dstdir=`dirname "$dst"`
-      test -d "$dstdir"
-      dstdir_status=$?
-    fi
-  fi
-
-  obsolete_mkdir_used=false
-
-  if test $dstdir_status != 0; then
-    case $posix_mkdir in
-      '')
-        # Create intermediate dirs using mode 755 as modified by the umask.
-        # This is like FreeBSD 'install' as of 1997-10-28.
-        umask=`umask`
-        case $stripcmd.$umask in
-          # Optimize common cases.
-          *[2367][2367]) mkdir_umask=$umask;;
-          .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
-
-          *[0-7])
-            mkdir_umask=`expr $umask + 22 \
-              - $umask % 100 % 40 + $umask % 20 \
-              - $umask % 10 % 4 + $umask % 2
-            `;;
-          *) mkdir_umask=$umask,go-w;;
-        esac
-
-        # With -d, create the new directory with the user-specified mode.
-        # Otherwise, rely on $mkdir_umask.
-        if test -n "$dir_arg"; then
-          mkdir_mode=-m$mode
-        else
-          mkdir_mode=
-        fi
-
-        posix_mkdir=false
-        case $umask in
-          *[123567][0-7][0-7])
-            # POSIX mkdir -p sets u+wx bits regardless of umask, which
-            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
-            ;;
-          *)
-            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-            trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
-
-            if (umask $mkdir_umask &&
-                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
-            then
-              if test -z "$dir_arg" || {
-                   # Check for POSIX incompatibilities with -m.
-                   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
-                   # other-writable bit of parent directory when it shouldn't.
-                   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-                   ls_ld_tmpdir=`ls -ld "$tmpdir"`
-                   case $ls_ld_tmpdir in
-                     d????-?r-*) different_mode=700;;
-                     d????-?--*) different_mode=755;;
-                     *) false;;
-                   esac &&
-                   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
-                     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
-                     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
-                   }
-                 }
-              then posix_mkdir=:
-              fi
-              rmdir "$tmpdir/d" "$tmpdir"
-            else
-              # Remove any dirs left behind by ancient mkdir implementations.
-              rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
-            fi
-            trap '' 0;;
-        esac;;
-    esac
-
-    if
-      $posix_mkdir && (
-        umask $mkdir_umask &&
-        $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
-      )
-    then :
-    else
-
-      # The umask is ridiculous, or mkdir does not conform to POSIX,
-      # or it failed possibly due to a race condition.  Create the
-      # directory the slow way, step by step, checking for races as we go.
-
-      case $dstdir in
-        /*) prefix='/';;
-        [-=\(\)!]*) prefix='./';;
-        *)  prefix='';;
-      esac
-
-      oIFS=$IFS
-      IFS=/
-      set -f
-      set fnord $dstdir
-      shift
-      set +f
-      IFS=$oIFS
-
-      prefixes=
-
-      for d
-      do
-        test X"$d" = X && continue
-
-        prefix=$prefix$d
-        if test -d "$prefix"; then
-          prefixes=
-        else
-          if $posix_mkdir; then
-            (umask=$mkdir_umask &&
-             $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
-            # Don't fail if two instances are running concurrently.
-            test -d "$prefix" || exit 1
-          else
-            case $prefix in
-              *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
-              *) qprefix=$prefix;;
-            esac
-            prefixes="$prefixes '$qprefix'"
-          fi
-        fi
-        prefix=$prefix/
-      done
-
-      if test -n "$prefixes"; then
-        # Don't fail if two instances are running concurrently.
-        (umask $mkdir_umask &&
-         eval "\$doit_exec \$mkdirprog $prefixes") ||
-          test -d "$dstdir" || exit 1
-        obsolete_mkdir_used=true
-      fi
-    fi
-  fi
-
-  if test -n "$dir_arg"; then
-    { test -z "$chowncmd" || $doit $chowncmd "$dst"; } &&
-    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } &&
-    { test "$obsolete_mkdir_used$chowncmd$chgrpcmd" = false ||
-      test -z "$chmodcmd" || $doit $chmodcmd $mode "$dst"; } || exit 1
-  else
-
-    # Make a couple of temp file names in the proper directory.
-    dsttmp=$dstdir/_inst.$$_
-    rmtmp=$dstdir/_rm.$$_
-
-    # Trap to clean up those temp files at exit.
-    trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
-
-    # Copy the file name to the temp name.
-    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
-
-    # and set any options; do chmod last to preserve setuid bits.
-    #
-    # If any of these fail, we abort the whole thing.  If we want to
-    # ignore errors from any of these, just make sure not to ignore
-    # errors from the above "$doit $cpprog $src $dsttmp" command.
-    #
-    { test -z "$chowncmd" || $doit $chowncmd "$dsttmp"; } &&
-    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dsttmp"; } &&
-    { test -z "$stripcmd" || $doit $stripcmd "$dsttmp"; } &&
-    { test -z "$chmodcmd" || $doit $chmodcmd $mode "$dsttmp"; } &&
-
-    # If -C, don't bother to copy if it wouldn't change the file.
-    if $copy_on_change &&
-       old=`LC_ALL=C ls -dlL "$dst"     2>/dev/null` &&
-       new=`LC_ALL=C ls -dlL "$dsttmp"  2>/dev/null` &&
-       set -f &&
-       set X $old && old=:$2:$4:$5:$6 &&
-       set X $new && new=:$2:$4:$5:$6 &&
-       set +f &&
-       test "$old" = "$new" &&
-       $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
-    then
-      rm -f "$dsttmp"
-    else
-      # Rename the file to the real destination.
-      $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null ||
-
-      # The rename failed, perhaps because mv can't rename something else
-      # to itself, or perhaps because mv is so ancient that it does not
-      # support -f.
-      {
-        # Now remove or move aside any old file at destination location.
-        # We try this two ways since rm can't unlink itself on some
-        # systems and the destination file might be busy for other
-        # reasons.  In this case, the final cleanup might fail but the new
-        # file should still install successfully.
-        {
-          test ! -f "$dst" ||
-          $doit $rmcmd -f "$dst" 2>/dev/null ||
-          { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
-            { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
-          } ||
-          { echo "$0: cannot unlink or rename $dst" >&2
-            (exit 1); exit 1
-          }
-        } &&
-
-        # Now rename the file to the real destination.
-        $doit $mvcmd "$dsttmp" "$dst"
-      }
-    fi || exit 1
-
-    trap '' 0
-  fi
-done
-
-# Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
-# time-stamp-start: "scriptversion="
-# time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
-# time-stamp-end: "; # UTC"
-# End:

iterator/iter_donotq.c

@@ -132,18 +132,6 @@ donotq_apply_cfg(struct iter_donotq* dq, struct config_file* cfg)
 		if(cfg->do_ip6) {
 			if(!donotq_str_cfg(dq, "::1"))
 				return 0;
-			if(!donotq_str_cfg(dq, "::ffff:127.0.0.0/104"))
-				return 0;
-		}
-		/* RFC 1122 3.2.1.3 / RFC 6890 / RFC 4291 2.5.2: not valid as
-		 * destination; on Linux these route to the local host. */
-		if(!donotq_str_cfg(dq, "0.0.0.0/8"))
-			return 0;
-		if(cfg->do_ip6) {
-			if(!donotq_str_cfg(dq, "::"))
-				return 0;
-			if(!donotq_str_cfg(dq, "::ffff:0:0/96"))
-				return 0;
 		}
 	}
 	addr_tree_init_parents(&dq->tree);

iterator/iter_priv.c

@@ -207,168 +207,6 @@ size_t priv_get_mem(struct iter_priv* priv)
 	return sizeof(*priv) + regional_get_mem(priv->region);
 }
 
-/**
- * Check if svcparam ipv4hint contains a private address.
- * @param priv: private address lookup struct.
- * @param d: the data bytes.
- * @param data_len: number of data bytes in the svcparam.
- * @param addr: address to return the private address to log in to.
- *	It has space for IPv4 and IPv6 addresses.
- * @param addrlen: length of the addr. Returns the correct size for the addr.
- * @return true if the rdata contains a private address.
- */
-static int svcb_ipv4hint_contains_priv_addr(struct iter_priv* priv,
-	uint8_t* d, uint16_t data_len, struct sockaddr_storage* addr,
-	socklen_t* addrlen)
-{
-	struct sockaddr_in sa;
-	*addrlen = (socklen_t)sizeof(struct sockaddr_in);
-	memset(&sa, 0, sizeof(struct sockaddr_in));
-	sa.sin_family = AF_INET;
-	sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
-
-	while(data_len >= LDNS_IP4ADDRLEN) {
-		memmove(&sa.sin_addr, d, LDNS_IP4ADDRLEN);
-		memmove(addr, &sa, *addrlen);
-		if(priv_lookup_addr(priv, addr, *addrlen))
-			return 1;
-
-		d += LDNS_IP4ADDRLEN;
-		data_len -= LDNS_IP4ADDRLEN;
-	}
-	/* if data_len != 0 here, then the svcparam is malformed. */
-	return 0;
-}
-
-/**
- * Check if svcparam ipv6hint contains a private address.
- * @param priv: private address lookup struct.
- * @param d: the data bytes.
- * @param data_len: number of data bytes in the svcparam.
- * @param addr: address to return the private address to log in to.
- *	It has space for IPv4 and IPv6 addresses.
- * @param addrlen: length of the addr. Returns the correct size for the addr.
- * @return true if the rdata contains a private address.
- */
-static int svcb_ipv6hint_contains_priv_addr(struct iter_priv* priv,
-	uint8_t* d, uint16_t data_len, struct sockaddr_storage* addr,
-	socklen_t* addrlen)
-{
-	struct sockaddr_in6 sa;
-	*addrlen = (socklen_t)sizeof(struct sockaddr_in6);
-	memset(&sa, 0, sizeof(struct sockaddr_in6));
-	sa.sin6_family = AF_INET6;
-	sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
-
-	while(data_len >= LDNS_IP6ADDRLEN) {
-		memmove(&sa.sin6_addr, d, LDNS_IP6ADDRLEN);
-		memmove(addr, &sa, *addrlen);
-		if(priv_lookup_addr(priv, addr, *addrlen))
-			return 1;
-
-		d += LDNS_IP6ADDRLEN;
-		data_len -= LDNS_IP6ADDRLEN;
-	}
-	/* if data_len != 0 here, then the svcparam is malformed. */
-	return 0;
-}
-
-/**
- * Check if type SVCB and HTTPS rdata contains a private address.
- * @param priv: private address lookup struct.
- * @param pkt: the packet.
- * @param rr: the rr with rdata to check.
- * @param addr: address to return the private address to log in to.
- * @param addrlen: length of the addr. Initially the total size, on
- *	return the correct size for the addr.
- * @return true if the rdata contains a private address.
- */
-static int svcb_rr_contains_priv_addr(struct iter_priv* priv,
-	sldns_buffer* pkt, struct rr_parse* rr, struct sockaddr_storage* addr,
-	socklen_t* addrlen)
-{
-	uint8_t* d = rr->ttl_data;
-	uint16_t svcparamkey, data_len, rdatalen;
-	size_t oldpos, dname_len, dname_start, dname_compr_len;
-	d += 4; /* skip TTL */
-	rdatalen = sldns_read_uint16(d); /* read rdata length */
-	d += 2;
-
-	if(rdatalen < 2 /* priority */ + 1 /* 1 length target */)
-		return 0; /* malformed, too short */
-	d += 2; /* skip priority */
-	rdatalen -= 2;
-	oldpos = sldns_buffer_position(pkt);
-	sldns_buffer_set_position(pkt, (size_t)(d - sldns_buffer_begin(pkt)));
-	dname_start = sldns_buffer_position(pkt);
-	dname_len = pkt_dname_len(pkt);
-	dname_compr_len = sldns_buffer_position(pkt) - dname_start;
-	sldns_buffer_set_position(pkt, oldpos);
-	if(dname_len == 0)
-		return 0; /* dname malformed */
-	if(dname_compr_len > rdatalen)
-		return 0; /* malformed */
-	d += dname_compr_len; /* skip target */
-	rdatalen -= dname_compr_len;
-
-	while(rdatalen >= 4) {
-		svcparamkey = sldns_read_uint16(d);
-		data_len = sldns_read_uint16(d+2);
-		d += 4;
-		rdatalen -= 4;
-
-		/* verify that we have data_len data */
-		if(data_len > rdatalen) {
-			/* It is malformed, but if there are addresses
-			 * in there it can be rejected. */
-			data_len = rdatalen;
-		}
-
-		if(!data_len)
-			continue; /* no data for the svcparamkey */
-
-		if(svcparamkey == SVCB_KEY_IPV4HINT) {
-			if(svcb_ipv4hint_contains_priv_addr(priv, d, data_len,
-				addr, addrlen))
-				return 1;
-		} else if(svcparamkey == SVCB_KEY_IPV6HINT) {
-			if(svcb_ipv6hint_contains_priv_addr(priv, d, data_len,
-				addr, addrlen))
-				return 1;
-		}
-		d += data_len;
-		rdatalen -= data_len;
-	}
-	/* If rdatalen != 0 here, then the svcb rdata is malformed. */
-	return 0;
-}
-
-/**
- * Check if the SVCB and HTTPS rrset is bad.
- * @param priv: private address lookup struct.
- * @param pkt: the packet.
- * @param rrset: the rrset to check.
- * @return 1 if the entire rrset has to be removed. 0 if not.
- * It removes RRs if they have private addresses, and log that.
- */
-static int priv_svcb_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
-	struct rrset_parse* rrset)
-{
-	struct rr_parse* rr, *prev = NULL;
-	struct sockaddr_storage addr;
-	socklen_t addrlen = (socklen_t)sizeof(addr);
-	for(rr = rrset->rr_first; rr; rr = rr->next) {
-		if(svcb_rr_contains_priv_addr(priv, pkt, rr, &addr,
-			&addrlen)) {
-			if(msgparse_rrset_remove_rr("sanitize: removing public name with private address", pkt, rrset, prev, rr, &addr, addrlen))
-				return 1;
-			continue;
-		}
-		prev = rr;
-	}
-	return 0;
-}
-
 int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 	struct rrset_parse* rrset)
 {
@@ -430,11 +268,7 @@ int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 				}
 				prev = rr;
 			}
-		} else if(rrset->type == LDNS_RR_TYPE_SVCB ||
-			rrset->type == LDNS_RR_TYPE_HTTPS) {
-			if(priv_svcb_rrset_bad(priv, pkt, rrset))
-				return 1;
-		}
+		} 
 	}
 	return 0;
 }

iterator/iter_scrub.c

@@ -285,17 +285,6 @@ synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 		return NULL;
 	memmove(cn->rr_first->ttl_data, rrset->rr_first->ttl_data,
 		sizeof(uint32_t)); /* RFC6672: synth CNAME TTL == DNAME TTL */
-	/* Apply cache TTL policy so DNAME and synthesized CNAME stay equal
-	 * and respect cache-min-ttl/cache-max-ttl (same as rdata_copy path). */
-	if(!SERVE_ORIGINAL_TTL) {
-		uint32_t ttl = sldns_read_uint32(cn->rr_first->ttl_data);
-		time_t ttl_t = (time_t)ttl;
-		if(ttl_t < MIN_TTL) ttl_t = MIN_TTL;
-		if(ttl_t > MAX_TTL) ttl_t = MAX_TTL;
-		ttl = (uint32_t)ttl_t;
-		sldns_write_uint32(cn->rr_first->ttl_data, ttl);
-		sldns_write_uint32(rrset->rr_first->ttl_data, ttl);
-	}
 	sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
 	memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
 	cn->rr_first->size = sizeof(uint16_t)+aliaslen;
@@ -419,43 +408,6 @@ shorten_rrset(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
 	else	rrset->rr_first = NULL;
 }
 
-/** Shorten RRSIGs list */
-static void
-shorten_rrsig(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
-{
-	/* The too large list of RRSIGs on the RRset is shortened.
-	 * This is so that too large content does not overwhelm the cache.
-	 * The validator does not validate more than a max number of
-	 * RRSIGs as well. */
-	int i;
-	struct rr_parse* rr = rrset->rrsig_first, *prev = NULL;
-	if(!rr)
-		return;
-	for(i=0; i<count; i++) {
-		prev = rr;
-		rr = rr->next;
-		if(!rr)
-			return; /* The RRSIG list is already short. */
-	}
-	if(verbosity >= VERB_QUERY
-		&& rrset->dname_len <= LDNS_MAX_DOMAINLEN) {
-		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
-		dname_pkt_copy(pkt, buf, rrset->dname);
-		log_nametypeclass(VERB_QUERY, "normalize: shorten RRSIGs:",
-			buf, rrset->type, ntohs(rrset->rrset_class));
-	}
-	/* remove further rrsigs */
-	rrset->rrsig_last = prev;
-	rrset->rrsig_count = count;
-	while(rr) {
-		rrset->size -= rr->size;
-		rr = rr->next;
-	}
-	if(rrset->rrsig_last)
-		rrset->rrsig_last->next = NULL;
-	else	rrset->rrsig_first = NULL;
-}
-
 /**
  * This routine normalizes a response. This includes removing "irrelevant"
  * records from the answer and additional sections and (re)synthesizing
@@ -493,8 +445,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	prev = NULL;
 	rrset = msg->rrset_first;
 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
-		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
-			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		if(cname_length > env->cfg->iter_scrub_cname) {
 			/* Too many CNAMEs, or DNAMEs, from the authority
 			 * server, scrub down the length to something
@@ -505,9 +455,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				pkt, msg, prev, &rrset);
 			continue;
 		}
-		if(rrset->type == LDNS_RR_TYPE_DNAME &&
-			pkt_strict_sub(pkt, sname, rrset->dname) &&
-			pkt_sub(pkt, rrset->dname, zonename)) {
+		if(rrset->type == LDNS_RR_TYPE_DNAME && 
+			pkt_strict_sub(pkt, sname, rrset->dname)) {
 			/* check if next rrset is correct CNAME. else,
 			 * synthesize a CNAME */
 			struct rrset_parse* nx = rrset->rrset_all_next;
@@ -553,6 +502,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				log_err("out of memory synthesizing CNAME");
 				return 0;
 			}
+			/* FIXME: resolve the conflict between synthesized 
+			 * CNAME ttls and the cache. */
 			rrset = nx;
 			continue;
 
@@ -574,8 +525,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			if(nx && nx->section == LDNS_SECTION_ANSWER &&
 				nx->type == LDNS_RR_TYPE_DNAME &&
 				nx->rr_count == 1 &&
-				pkt_strict_sub(pkt, sname, nx->dname) &&
-				pkt_sub(pkt, nx->dname, zonename)) {
+				pkt_strict_sub(pkt, sname, nx->dname)) {
 				/* there is a DNAME after this CNAME, it 
 				 * is in the ANSWER section, and the DNAME
 				 * applies to the name we cover */
@@ -670,8 +620,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
-			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		/* only one NS set allowed in authority section */
 		if(rrset->type==LDNS_RR_TYPE_NS) {
 			/* NS set must be pertinent to the query */
@@ -777,13 +725,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			rrset->rrset_all_next = NULL;
 			return 1;
 		}
-		/* Only mark glue as allowed for type NS in the authority
-		 * section. Other RR types do not get glue for them, it
-		 * is allowed from the answer section, but not authority
-		 * so that a message can not have address records cached
-		 * as a side effect to the query. */
-		if(rrset->type==LDNS_RR_TYPE_NS)
-			mark_additional_rrset(pkt, msg, rrset);
+		mark_additional_rrset(pkt, msg, rrset);
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -820,8 +762,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
-			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -1032,10 +972,8 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 		}
 
 		/* remove private addresses */
-		if(rrset->type == LDNS_RR_TYPE_A ||
-			rrset->type == LDNS_RR_TYPE_AAAA ||
-			rrset->type == LDNS_RR_TYPE_SVCB ||
-			rrset->type == LDNS_RR_TYPE_HTTPS) {
+		if( (rrset->type == LDNS_RR_TYPE_A || 
+			rrset->type == LDNS_RR_TYPE_AAAA)) {
 
 			/* do not set servfail since this leads to too
 			 * many drops of other people using rfc1918 space */

iterator/iter_utils.c

@@ -308,30 +308,9 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	if(a->bogus)
 		return -1; /* address of server is bogus */
 	if(donotq_lookup(iter_env->donotq, &a->addr, a->addrlen)) {
-		if(iter_env->nat64.use_nat64 &&
-			addr_is_ip6(&a->addr, a->addrlen) &&
-			a->addrlen == iter_env->nat64.nat64_prefix_addrlen &&
-			addr_in_common(&a->addr, 128,
-				&iter_env->nat64.nat64_prefix_addr,
-				iter_env->nat64.nat64_prefix_net,
-				iter_env->nat64.nat64_prefix_addrlen) ==
-				iter_env->nat64.nat64_prefix_net) {
-			/* The NAT64 is enabled, and address is IPv6, it is
-			 * in the NAT64 prefix. It is allowed.
-			 * So that in an IPv6-only cluster without internet
-			 * access, that makes the NAT64 translation continue
-			 * to work. The NAT64 prefix is allowed. */
-			/* Otherwise, after a timeout, the already NAT64
-			 * translated address would be treated differently,
-			 * and that causes confusion. */
-			log_addr(VERB_ALGO, "the addr is on the donotquery "
-				"list, but allowed because it is NAT64",
-				&a->addr, a->addrlen);
-		} else {
-			log_addr(VERB_ALGO, "skip addr on the donotquery list",
-				&a->addr, a->addrlen);
-			return -1; /* server is on the donotquery list */
-		}
+		log_addr(VERB_ALGO, "skip addr on the donotquery list",
+			&a->addr, a->addrlen);
+		return -1; /* server is on the donotquery list */
 	}
 	if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip6 available */
@@ -1548,11 +1527,6 @@ iter_stub_fwd_no_cache(struct module_qstate *qstate, struct query_info *qinf,
 	struct delegpt *dp;
 	int nolock = 1;
 
-	log_assert((retdpname && retdpnamelen
-		&& dpname_storage && dpname_storage_len > 0) ||
-		(retdpname == NULL && retdpnamelen == NULL
-		 && dpname_storage == NULL && dpname_storage_len == 0));
-
 	/* Check for stub. */
 	/* Lock both forwards and hints for atomic read. */
 	lock_rw_rdlock(&qstate->env->fwds->lock);

iterator/iterator.c

@@ -81,8 +81,7 @@ int BLACKLIST_PENALTY = (120000*4);
 /** Timeout when only a single probe query per IP is allowed. */
 int PROBE_MAXRTO = PROBE_MAXRTO_DEFAULT; /* in msec */
 
-static void target_count_increase_nx(struct module_qstate* qstate,
-	struct iter_qstate* iq, int num);
+static void target_count_increase_nx(struct iter_qstate* iq, int num);
 
 int 
 iter_init(struct module_env* env, int id)
@@ -251,7 +250,7 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 		if((dpns->got4 == 2 || (!ie->supports_ipv4 && !ie->nat64.use_nat64)) &&
 			(dpns->got6 == 2 || !ie->supports_ipv6)) {
 			dpns->resolved = 1; /* mark as failed */
-			target_count_increase_nx(super, super_iq, 1);
+			target_count_increase_nx(super_iq, 1);
 		}
 	}
 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS) {
@@ -298,7 +297,6 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 	struct reply_info err;
 	struct msgreply_entry* msg;
 	if(qstate->no_cache_store) {
-		qstate->error_response_cache = 1;
 		return error_response(qstate, id, rcode);
 	}
 	if(qstate->prefetch_leeway > NORR_TTL) {
@@ -735,7 +733,7 @@ is_caps_whitelisted(struct iter_env* ie, struct iter_qstate* iq)
  * created for the parent query.
  */
 static void
-target_count_create(struct module_qstate* qstate, struct iter_qstate* iq)
+target_count_create(struct iter_qstate* iq)
 {
 	if(!iq->target_count) {
 		iq->target_count = (int*)calloc(TARGET_COUNT_MAX, sizeof(int));
@@ -743,57 +741,33 @@ target_count_create(struct module_qstate* qstate, struct iter_qstate* iq)
 		if(iq->target_count) {
 			iq->target_count[TARGET_COUNT_REF] = 1;
 			iq->nxns_dp = (uint8_t**)calloc(1, sizeof(uint8_t*));
-			/* continue global quota from where it was. */
-			if(qstate->global_quota_reached >
-				iq->target_count[TARGET_COUNT_GLOBAL_QUOTA])
-				iq->target_count[TARGET_COUNT_GLOBAL_QUOTA] =
-					qstate->global_quota_reached;
 		}
 	}
 }
 
 static void
-target_count_store(struct module_qstate* qstate, struct iter_qstate* iq)
+target_count_increase(struct iter_qstate* iq, int num)
 {
-	if(iq->target_count) {
-		/* By storing the global quota counter, it stays
-		 * there to be picked up if the module is restarted,
-		 * eg. due to a validator retry, and then the
-		 * target_count_create routine picks it up. */
-		if(iq->target_count[TARGET_COUNT_GLOBAL_QUOTA] >
-			qstate->global_quota_reached)
-			qstate->global_quota_reached =
-			  iq->target_count[TARGET_COUNT_GLOBAL_QUOTA];
-	}
-}
-
-static void
-target_count_increase(struct module_qstate* qstate,
-	struct iter_qstate* iq, int num)
-{
-	target_count_create(qstate, iq);
+	target_count_create(iq);
 	if(iq->target_count)
 		iq->target_count[TARGET_COUNT_QUERIES] += num;
 	iq->dp_target_count++;
 }
 
 static void
-target_count_increase_nx(struct module_qstate* qstate,
-	struct iter_qstate* iq, int num)
+target_count_increase_nx(struct iter_qstate* iq, int num)
 {
-	target_count_create(qstate, iq);
+	target_count_create(iq);
 	if(iq->target_count)
 		iq->target_count[TARGET_COUNT_NX] += num;
 }
 
 static void
-target_count_increase_global_quota(struct module_qstate* qstate,
-	struct iter_qstate* iq, int num)
+target_count_increase_global_quota(struct iter_qstate* iq, int num)
 {
-	target_count_create(qstate, iq);
+	target_count_create(iq);
 	if(iq->target_count)
 		iq->target_count[TARGET_COUNT_GLOBAL_QUOTA] += num;
-	target_count_store(qstate, iq);
 }
 
 /**
@@ -886,7 +860,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		subiq = (struct iter_qstate*)subq->minfo[id];
 		memset(subiq, 0, sizeof(*subiq));
 		subiq->num_target_queries = 0;
-		target_count_create(qstate, iq);
+		target_count_create(iq);
 		subiq->target_count = iq->target_count;
 		if(iq->target_count) {
 			iq->target_count[TARGET_COUNT_REF] ++; /* extra reference */
@@ -2259,7 +2233,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->num_target_queries += qs;
-		target_count_increase(qstate, iq, qs);
+		target_count_increase(iq, qs);
 		if(qs != 0) {
 			qstate->ext_state[id] = module_wait_subquery;
 			return 0; /* and wait for them */
@@ -2315,7 +2289,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 				 * lookups at a time. */
 				verbose(VERB_ALGO, "try parent-side glue lookup");
 				iq->num_target_queries += query_count;
-				target_count_increase(qstate, iq, query_count);
+				target_count_increase(iq, query_count);
 				qstate->ext_state[id] = module_wait_subquery;
 				return 0;
 			}
@@ -2335,7 +2309,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(query_count != 0) { /* suspend to await results */
 			verbose(VERB_ALGO, "try parent-side glue lookup");
 			iq->num_target_queries += query_count;
-			target_count_increase(qstate, iq, query_count);
+			target_count_increase(iq, query_count);
 			qstate->ext_state[id] = module_wait_subquery;
 			return 0;
 		}
@@ -2813,7 +2787,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->num_target_queries += extra;
-		target_count_increase(qstate, iq, extra);
+		target_count_increase(iq, extra);
 		if(iq->num_target_queries > 0) {
 			/* wait to get all targets, we want to try em */
 			verbose(VERB_ALGO, "wait for all targets for fallback");
@@ -2864,7 +2838,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* errors ignored, these targets are not strictly necessary for
 		 * this result, we do not have to reply with SERVFAIL */
 		iq->num_target_queries += extra;
-		target_count_increase(qstate, iq, extra);
+		target_count_increase(iq, extra);
 	}
 
 	/* Add the current set of unused targets to our queue. */
@@ -2987,7 +2961,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 						LDNS_RCODE_SERVFAIL);
 				}
 				iq->num_target_queries += qs;
-				target_count_increase(qstate, iq, qs);
+				target_count_increase(iq, qs);
 			}
 			/* Since a target query might have been made, we 
 			 * need to check again. */
@@ -3047,7 +3021,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		* this result, we do not have to reply with SERVFAIL */
 		if(extra > 0) {
 			iq->num_target_queries += extra;
-			target_count_increase(qstate, iq, extra);
+			target_count_increase(iq, extra);
 			check_waiting_queries(iq, qstate, id);
 			/* undo qname minimise step because we'll get back here
 			 * to do it again */
@@ -3060,7 +3034,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		}
 	}
 
-	target_count_increase_global_quota(qstate, iq, 1);
+	target_count_increase_global_quota(iq, 1);
 	if(iq->target_count && iq->target_count[TARGET_COUNT_GLOBAL_QUOTA]
 		> MAX_GLOBAL_QUOTA) {
 		char s[LDNS_MAX_DOMAINLEN];
@@ -3249,19 +3223,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	} else iter_scrub_ds(iq->response, NULL, NULL);
 	if(type == RESPONSE_TYPE_THROWAWAY &&
 		FLAGS_GET_RCODE(iq->response->rep->flags) == LDNS_RCODE_YXDOMAIN) {
-		/* YXDOMAIN is a permanent error for DNAME expansion overflow
-		 * (RFC 6672 Section 2.2). Only accept if the response
-		 * contains a DNAME record in the answer section; otherwise
-		 * treat as invalid, to make sure the authoritative answer
-		 * make sense. */
-		size_t i;
-		for(i=0; i<iq->response->rep->an_numrrsets; i++) {
-			if(ntohs(iq->response->rep->rrsets[i]->rk.type)
-				== LDNS_RR_TYPE_DNAME) {
-				type = RESPONSE_TYPE_ANSWER;
-				break;
-			}
-		}
+		/* YXDOMAIN is a permanent error, no need to retry */
+		type = RESPONSE_TYPE_ANSWER;
 	}
 	if(type == RESPONSE_TYPE_CNAME)
 		origtypecname = 1;
@@ -3904,7 +3867,7 @@ processTargetResponse(struct module_qstate* qstate, int id,
 			/* no new addresses, increase the nxns counter, like
 			 * this could be a list of wildcards with no new
 			 * addresses */
-			target_count_increase_nx(qstate, foriq, 1);
+			target_count_increase_nx(foriq, 1);
 		}
 		verbose(VERB_ALGO, "added target response");
 		delegpt_log(VERB_ALGO, foriq->dp);
@@ -3916,7 +3879,7 @@ processTargetResponse(struct module_qstate* qstate, int id,
 			dpns->resolved = 1; /* fail the target */
 			/* do not count cached answers */
 			if(qstate->reply_origin && qstate->reply_origin->len != 0) {
-				target_count_increase_nx(qstate, foriq, 1);
+				target_count_increase_nx(foriq, 1);
 			}
 		}
 	}
@@ -4141,7 +4104,6 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 			iter_store_parentside_neg(qstate->env, &qstate->qinfo,
 				iq->deleg_msg?iq->deleg_msg->rep:
 				(iq->response?iq->response->rep:NULL));
-	target_count_store(qstate, iq);
 	if(!iq->response) {
 		verbose(VERB_ALGO, "No response is set, servfail");
 		errinf(qstate, "(no response found at query finish)");
@@ -4557,7 +4519,6 @@ iter_clear(struct module_qstate* qstate, int id)
 	iq = (struct iter_qstate*)qstate->minfo[id];
 	if(iq) {
 		outbound_list_clear(&iq->outlist);
-		target_count_store(qstate, iq);
 		if(iq->target_count && --iq->target_count[TARGET_COUNT_REF] == 0) {
 			free(iq->target_count);
 			if(*iq->nxns_dp) free(*iq->nxns_dp);

libunbound/libworker.c

@@ -105,7 +105,6 @@ libworker_delete_env(struct libworker* w)
 	SSL_CTX_free(w->sslctx);
 #endif
 	outside_network_delete(w->back);
-	shared_ports_delete(w->shared_ports);
 }
 
 /** delete libworker struct */
@@ -220,25 +219,17 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
 		libworker_delete(w);
 		return NULL;
 	}
-	if(!(w->shared_ports = shared_ports_create(cfg->out_ifs,
-		cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, ports, numports))) {
-		if(!w->is_bg || w->is_bg_thread) {
-			lock_basic_unlock(&ctx->cfglock);
-		}
-		libworker_delete(w);
-		return NULL;
-	}
 	w->back = outside_network_create(w->base, cfg->msg_buffer_size,
 		(size_t)cfg->outgoing_num_ports, cfg->out_ifs,
 		cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, 
 		cfg->do_tcp?cfg->outgoing_num_tcp:0, cfg->ip_dscp,
 		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id,
-		cfg->unwanted_threshold,
+		ports, numports, cfg->unwanted_threshold,
 		cfg->outgoing_tcp_mss, &libworker_alloc_cleanup, w,
 		cfg->do_udp || cfg->udp_upstream_without_downstream, w->sslctx,
 		cfg->delay_close, cfg->tls_use_sni, NULL, cfg->udp_connect,
 		cfg->max_reuse_tcp_queries, cfg->tcp_reuse_timeout,
-		cfg->tcp_auth_query_timeout, w->shared_ports);
+		cfg->tcp_auth_query_timeout);
 	w->env->outnet = w->back;
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);

libunbound/libworker.h

@@ -60,7 +60,6 @@ struct tube;
 struct sldns_buffer;
 struct ub_event_base;
 struct query_info;
-struct shared_ports;
 
 /** 
  * The library-worker status structure
@@ -85,8 +84,6 @@ struct libworker {
 	struct comm_base* base;
 	/** the backside outside network interface to the auth servers */
 	struct outside_network* back;
-	/** shared ports structure */
-	struct shared_ports* shared_ports;
 	/** random() table for this worker. */
 	struct ub_randstate* rndstate;
 	/** sslcontext for SSL wrapped DNS over TCP queries */

makedist.sh

@@ -142,7 +142,7 @@ check_git_repo () {
 create_temp_dir () {
     # Creating temp directory
     info "Creating temporary working directory"
-    temp_dir=`mktemp -d unbound-dist-XXXXXX`
+    temp_dir=`mktemp -t -d unbound-dist-XXXXXX`
     info "Directory '$temp_dir' created."
     cd $temp_dir
 }
@@ -409,7 +409,14 @@ if [ "$DOWIN" = "yes" ]; then
 	info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 	git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"
 	cd unbound || error_cleanup "Unbound not exported correctly from git"
-	rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+	git submodule update --init || error_cleanup "Could not fetch submodule"
+	rm -rf .git .travis.yml .gitattributes .gitmodules .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+	rm -rf simdzone/.git simdzone/.github simdzone/.gitignore \
+	       simdzone/configure~ simdzone/config.h.in~ simdzone/autom4te.cache \
+	       simdzone/cmake simdzone/CMakeLists.txt simdzone/simdzoneConfig.cmake.in \
+	       simdzone/conanfile.txt simdzone/tests simdzone/.readthedocs.yaml \
+	       simdzone/doc simdzone/scripts || \
+	       error_cleanup "Failed to remove simdzone .git tracking and ci information"
 
 	# on a re-configure the cache may no longer be valid...
 	if test -f mingw32-config.cache; then rm mingw32-config.cache; fi
@@ -436,11 +443,14 @@ if [ "$DOWIN" = "yes" ]; then
 	replace_version "configure.ac" "$version" "$version2"
     	version="$version2"
     	info "Rebuilding configure script (autoconf) snapshot."
-	autoconf -f || error_cleanup "Autoconf failed."
+	autoreconf -fi || error_cleanup "Autoconf failed."
 	autoheader -f || error_cleanup "Autoheader failed."
     	rm -r autom4te* || echo "ignored"
 	rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 	rm -f configure~ || echo "ignore absence of configure~ file."
+	rm -r simdzone/autom4te* || echo "ignored"
+	rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
+	rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."
     fi
 
     if test "`uname`" = "Linux"; then 
@@ -598,7 +608,15 @@ info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"
 
 cd unbound || error_cleanup "Unbound not exported correctly from git"
-rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+git submodule update --init || error_cleanup "Could not fetch submodule"
+rm -rf .git .travis.yml .gitattributes .gitmodules .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+rm -rf simdzone/.git simdzone/.github simdzone/.gitignore \
+       simdzone/configure~ simdzone/config.h.in~ simdzone/autom4te.cache \
+       simdzone/cmake simdzone/CMakeLists.txt simdzone/simdzoneConfig.cmake.in \
+       simdzone/conanfile.txt simdzone/tests simdzone/.readthedocs.yaml \
+       simdzone/doc simdzone/scripts || \
+       error_cleanup "Failed to remove simdzone .git tracking and ci information"
+
 
 info "Adding libtool utils (libtoolize)."
 libtoolize -c --install || libtoolize -c || error_cleanup "Libtoolize failed."
@@ -618,11 +636,14 @@ if [ `uname -s | grep -i -c darwin` -ne 0 ]; then
 fi
 
 info "Building configure script (autoreconf)."
-autoreconf -f || error_cleanup "Autoconf failed."
+autoreconf -fi || error_cleanup "Autoconf failed."
 
 rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
 rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 rm -f configure~ || echo "ignore absence of configure~ file."
+rm -r simdzone/autom4te* || echo "ignored"
+rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
+rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."
 
 info "Building lexer and parser."
 echo "#include \"config.h\"" > util/configlexer.c || error_cleanup "Failed to create configlexer"
@@ -665,10 +686,13 @@ fi
 
 if [ "$RECONFIGURE" = "yes" ]; then
     info "Rebuilding configure script (autoconf) snapshot."
-    autoreconf -f || error_cleanup "Autoconf failed."
+    autoreconf -fi || error_cleanup "Autoconf failed."
     rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
     rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
     rm -f configure~ || echo "ignore absence of configure~ file."
+    rm -r simdzone/autom4te* || echo "ignored"
+    rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
+    rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."
 fi
 
 replace_all doc/README
@@ -685,7 +709,7 @@ info "Renaming Unbound directory to unbound-$version."
 cd ..
 mv unbound unbound-$version || error_cleanup "Failed to rename unbound directory."
 
-tarfile="../unbound-$version.tar.gz"
+tarfile="$cwd/unbound-$version.tar.gz"
 
 if [ -f $tarfile ]; then
     (question "The file $tarfile already exists.  Overwrite?" \
@@ -693,7 +717,7 @@ if [ -f $tarfile ]; then
 fi
 
 info "Creating tar unbound-$version.tar.gz"
-tar czf ../unbound-$version.tar.gz unbound-$version || error_cleanup "Failed to create tar file."
+tar czf $tarfile unbound-$version || error_cleanup "Failed to create tar file."
 
 cleanup
 

respip/respip.c

@@ -973,9 +973,6 @@ respip_rewrite_reply(const struct query_info* qinfo,
 					lock_rw_unlock(&raddr->lock);
 					lock_rw_unlock(&a->lock);
 					lock_rw_unlock(&az->rpz_lock);
-					if(view) {
-                    	lock_rw_unlock(&view->lock);
-					}
 					return 0;
 				}
 				if(rpz_used) {
@@ -1114,13 +1111,7 @@ respip_operate(struct module_qstate* qstate, enum module_ev event, int id,
 		if((qstate->qinfo.qtype == LDNS_RR_TYPE_A ||
 			qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA ||
 			qstate->qinfo.qtype == LDNS_RR_TYPE_ANY) &&
-			qstate->return_msg && qstate->return_msg->rep &&
-			!(qstate->env->need_to_validate &&
-			  (!(qstate->query_flags & BIT_CD)
-			    || qstate->env->cfg->ignore_cd) &&
-			  (qstate->return_msg->rep->security <= sec_status_bogus
-			    || qstate->return_msg->rep->security ==
-			    sec_status_secure_sentinel_fail))) {
+			qstate->return_msg && qstate->return_msg->rep) {
 			struct reply_info* new_rep = qstate->return_msg->rep;
 			struct ub_packed_rrset_key* alias_rrset = NULL;
 			struct respip_action_info actinfo = {0, 0, 0, 0, NULL, 0, NULL};

services/authzone.c

@@ -72,7 +72,11 @@
 #include "validator/val_sigcrypt.h"
 #include "validator/val_anchor.h"
 #include "validator/val_utils.h"
+#include "zone.h"
 #include <ctype.h>
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif
 
 /** bytes to use for NSEC3 hash buffer. 20 for sha1 */
 #define N3HASHBUFLEN 32
@@ -702,13 +706,15 @@ az_rrset_find_rrsig(struct packed_rrset_data* d, uint8_t* rdata, size_t len,
 
 /** see if rdata is duplicate */
 static int
-rdata_duplicate(struct packed_rrset_data* d, uint8_t* rdata, size_t len)
+rdata_duplicate(struct packed_rrset_data* d, uint8_t* rdata_wol, size_t len)
 {
-	size_t i;
+	size_t i, rdatawl_len = len+2;
+	uint16_t len16 = htons(len);
 	for(i=0; i<d->count + d->rrsig_count; i++) {
-		if(d->rr_len[i] != len)
+		if(d->rr_len[i] != rdatawl_len)
 			continue;
-		if(memcmp(d->rr_data[i], rdata, len) == 0)
+		if(memcmp(d->rr_data[i], &len16, 2) == 0 &&
+		   memcmp(d->rr_data[i]+2, rdata_wol, len) == 0)
 			return 1;
 	}
 	return 0;
@@ -727,6 +733,19 @@ rrsig_rdata_get_type_covered(uint8_t* rdata, size_t rdatalen)
 	return sldns_read_uint16(rdata+2);
 }
 
+/** get rrsig type covered from rdata.
+ * @param rdata_wol: rdata in wireformat, without the prefix rdlength.
+ * @param rdatalen: length of rdata buffer.
+ * @return type covered (or 0).
+ */
+static uint16_t
+rrsig_rdata_get_type_covered_wol(uint8_t* rdata_wol, size_t rdatalen)
+{
+	if(rdatalen < 2)
+		return 0;
+	return sldns_read_uint16(rdata_wol);
+}
+
 /** remove RR from existing RRset. Also sig, if it is a signature.
  * reallocates the packed rrset for a new one, false on alloc failure */
 static int
@@ -792,7 +811,7 @@ rrset_remove_rr(struct auth_rrset* rrset, size_t index)
 /** add RR to existing RRset. If insert_sig is true, add to rrsigs. 
  * This reallocates the packed rrset for a new one */
 static int
-rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
+rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata_wol,
 	size_t rdatalen, int insert_sig)
 {
 	struct packed_rrset_data* d, *old = rrset->data;
@@ -800,7 +819,7 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
 
 	d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old)
 		+ sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t)
-		+ rdatalen);
+		+ 2 /* rdlen */ + rdatalen);
 	if(!d) {
 		log_err("out of memory");
 		return 0;
@@ -823,8 +842,8 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
 		memmove(d->rr_len+d->count, old->rr_len+old->count,
 			old->rrsig_count*sizeof(size_t));
 	if(!insert_sig)
-		d->rr_len[d->count-1] = rdatalen;
-	else	d->rr_len[total-1] = rdatalen;
+		d->rr_len[d->count-1] = rdatalen + 2;
+	else	d->rr_len[total-1] = rdatalen + 2;
 	packed_rrset_ptr_fixup(d);
 	if((time_t)rr_ttl < d->ttl)
 		d->ttl = rr_ttl;
@@ -849,10 +868,12 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
 	/* insert new value */
 	if(!insert_sig) {
 		d->rr_ttl[d->count-1] = rr_ttl;
-		memmove(d->rr_data[d->count-1], rdata, rdatalen);
+		sldns_write_uint16(d->rr_data[d->count-1], rdatalen);
+		memmove(d->rr_data[d->count-1]+2, rdata_wol, rdatalen);
 	} else {
 		d->rr_ttl[total-1] = rr_ttl;
-		memmove(d->rr_data[total-1], rdata, rdatalen);
+		sldns_write_uint16(d->rr_data[total-1], rdatalen);
+		memmove(d->rr_data[total-1]+2, rdata_wol, rdatalen);
 	}
 
 	rrset->data = d;
@@ -860,10 +881,11 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
 	return 1;
 }
 
-/** Create new rrset for node with packed rrset with one RR element */
+/** Create new rrset for node with packed rrset with one RR element.
+ * rdata_wol is the rdata without prefixed rdlength. */
 static struct auth_rrset*
 rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
-	uint8_t* rdata, size_t rdatalen)
+	uint8_t* rdata_wol, size_t rdatalen)
 {
 	struct auth_rrset* rrset = (struct auth_rrset*)calloc(1,
 		sizeof(*rrset));
@@ -878,7 +900,7 @@ rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
 	/* the rrset data structure, with one RR */
 	d = (struct packed_rrset_data*)calloc(1,
 		sizeof(struct packed_rrset_data) + sizeof(size_t) +
-		sizeof(uint8_t*) + sizeof(time_t) + rdatalen);
+		sizeof(uint8_t*) + sizeof(time_t) + 2 /* rdlen*/ + rdatalen);
 	if(!d) {
 		free(rrset);
 		log_err("out of memory");
@@ -893,9 +915,10 @@ rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
 	d->rr_data[0] = (uint8_t*)&(d->rr_ttl[1]);
 
 	/* insert the RR */
-	d->rr_len[0] = rdatalen;
+	d->rr_len[0] = rdatalen + 2;
 	d->rr_ttl[0] = rr_ttl;
-	memmove(d->rr_data[0], rdata, rdatalen);
+	sldns_write_uint16(d->rr_data[0], rdatalen);
+	memmove(d->rr_data[0]+2, rdata_wol, rdatalen);
 	d->count++;
 
 	/* insert rrset into linked list for domain */
@@ -1079,14 +1102,14 @@ rrsigs_copy_from_rrset_to_rrsigset(struct auth_rrset* rrset,
 	 * duplicates are ignored */
 	for(i=rrset->data->count;
 		i<rrset->data->count+rrset->data->rrsig_count; i++) {
-		uint8_t* rdata = rrset->data->rr_data[i];
-		size_t rdatalen = rrset->data->rr_len[i];
+		uint8_t* rdata_wol = rrset->data->rr_data[i]+2;
+		size_t rdatalen = rrset->data->rr_len[i]-2;
 		time_t rr_ttl  = rrset->data->rr_ttl[i];
 
-		if(rdata_duplicate(rrsigset->data, rdata, rdatalen)) {
+		if(rdata_duplicate(rrsigset->data, rdata_wol, rdatalen)) {
 			continue;
 		}
-		if(!rrset_add_rr(rrsigset, rr_ttl, rdata, rdatalen, 0))
+		if(!rrset_add_rr(rrsigset, rr_ttl, rdata_wol, rdatalen, 0))
 			return 0;
 	}
 	return 1;
@@ -1096,32 +1119,35 @@ rrsigs_copy_from_rrset_to_rrsigset(struct auth_rrset* rrset,
  * rdata points to buffer with rdatalen octets, starts with 2bytelength. */
 static int
 az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
-	uint8_t* rdata, size_t rdatalen, int* duplicate)
+	uint8_t* rdata_wol, size_t rdatalen, int* duplicate)
 {
 	struct auth_rrset* rrset;
 	/* packed rrsets have their rrsigs along with them, sort them out */
 	if(rr_type == LDNS_RR_TYPE_RRSIG) {
-		uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen);
+		uint16_t ctype = rrsig_rdata_get_type_covered_wol(rdata_wol,
+			rdatalen);
 		if((rrset=az_domain_rrset(node, ctype))!= NULL) {
 			/* a node of the correct type exists, add the RRSIG
 			 * to the rrset of the covered data type */
-			if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
+			if(rdata_duplicate(rrset->data, rdata_wol, rdatalen)) {
 				if(duplicate) *duplicate = 1;
 				return 1;
 			}
-			if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 1))
+			if(!rrset_add_rr(rrset, rr_ttl, rdata_wol, rdatalen,
+				1))
 				return 0;
 		} else if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
 			/* add RRSIG to rrset of type RRSIG */
-			if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
+			if(rdata_duplicate(rrset->data, rdata_wol, rdatalen)) {
 				if(duplicate) *duplicate = 1;
 				return 1;
 			}
-			if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0))
+			if(!rrset_add_rr(rrset, rr_ttl, rdata_wol, rdatalen,
+				0))
 				return 0;
 		} else {
 			/* create rrset of type RRSIG */
-			if(!rrset_create(node, rr_type, rr_ttl, rdata,
+			if(!rrset_create(node, rr_type, rr_ttl, rdata_wol,
 				rdatalen))
 				return 0;
 		}
@@ -1129,17 +1155,18 @@ az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
 		/* normal RR type */
 		if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
 			/* add data to existing node with data type */
-			if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
+			if(rdata_duplicate(rrset->data, rdata_wol, rdatalen)) {
 				if(duplicate) *duplicate = 1;
 				return 1;
 			}
-			if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0))
+			if(!rrset_add_rr(rrset, rr_ttl, rdata_wol, rdatalen,
+				0))
 				return 0;
 		} else {
 			struct auth_rrset* rrsig;
 			/* create new node with data type */
-			if(!(rrset=rrset_create(node, rr_type, rr_ttl, rdata,
-				rdatalen)))
+			if(!(rrset=rrset_create(node, rr_type, rr_ttl,
+				rdata_wol, rdatalen)))
 				return 0;
 
 			/* see if node of type RRSIG has signatures that
@@ -1156,21 +1183,16 @@ az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
 	return 1;
 }
 
-/** insert RR into zone, ignore duplicates */
+/** insert RR as name,rdata into zone, ignore duplicates.
+ * The rdata_wol is the rdata without the prefix rdlength, because simdzone
+ * returns that as the parsed rdata byte string. */
 static int
-az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
-	size_t dname_len, int* duplicate)
+az_insert_rr_as_rdata(struct auth_zone* z, uint8_t* dname, size_t dname_len,
+	uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
+	uint8_t* rdata_wol, size_t rdatalen, int* duplicate,
+	uint8_t* rr, size_t rr_len)
 {
 	struct auth_data* node;
-	uint8_t* dname = rr;
-	uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len);
-	uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len);
-	uint32_t rr_ttl = sldns_wirerr_get_ttl(rr, rr_len, dname_len);
-	size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len,
-		dname_len))+2;
-	/* rdata points to rdata prefixed with uint16 rdatalength */
-	uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len);
-
 	if(rr_class != z->dclass) {
 		log_err("wrong class for RR");
 		return 0;
@@ -1179,20 +1201,64 @@ az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
 		log_err("cannot create domain");
 		return 0;
 	}
-	if(!az_domain_add_rr(node, rr_type, rr_ttl, rdata, rdatalen,
+	if(!az_domain_add_rr(node, rr_type, rr_ttl, rdata_wol, rdatalen,
 		duplicate)) {
 		log_err("cannot add RR to domain");
 		return 0;
 	}
 	if(z->rpz) {
+		uint8_t* rdata_wl;
+		uint8_t buf[65536];
+		if(rr == NULL) {
+			/* spool it into buffer. */
+			log_assert(dname);
+			if(dname_len + 10 /* type, class, ttl, rdlength */ +
+				rdatalen > sizeof(buf)) {
+				char dstr[LDNS_MAX_DOMAINLEN], t[16], c[16];
+				dname_str(dname, dstr);
+				sldns_wire2str_type_buf(rr_type, t, sizeof(t));
+				sldns_wire2str_class_buf(rr_class, c, sizeof(c));
+				log_err("record exceeds buffer length, %s %s %s", dstr, c, t);
+				return 0;
+			}
+			rr = buf;
+			rr_len = dname_len
+				+ 10 /* type, class, ttl, rdlength */ +
+				rdatalen;
+			memcpy(buf, dname, dname_len);
+			sldns_write_uint16(buf+dname_len, rr_type);
+			sldns_write_uint16(buf+dname_len+2, rr_class);
+			sldns_write_uint32(buf+dname_len+4, rr_ttl);
+			sldns_write_uint16(buf+dname_len+8, rdatalen);
+			memmove(buf+dname_len+10, rdata_wol, rdatalen);
+		}
+		rdata_wl = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len);
 		if(!(rpz_insert_rr(z->rpz, z->name, z->namelen, dname,
-			dname_len, rr_type, rr_class, rr_ttl, rdata, rdatalen,
-			rr, rr_len)))
+			dname_len, rr_type, rr_class, rr_ttl, rdata_wl,
+			rdatalen+2, rr, rr_len)))
 			return 0;
 	}
 	return 1;
 }
 
+/** insert RR into zone, ignore duplicates */
+static int
+az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
+	size_t dname_len, int* duplicate)
+{
+	uint8_t* dname = rr;
+	uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len);
+	uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len);
+	uint32_t rr_ttl = sldns_wirerr_get_ttl(rr, rr_len, dname_len);
+	size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len,
+		dname_len));
+	/* rdata points to rdata without prefix rdlength. */
+	uint8_t* rdata_wol = sldns_wirerr_get_rdata(rr, rr_len, dname_len);
+
+	return az_insert_rr_as_rdata(z, dname, dname_len, rr_type, rr_class,
+		rr_ttl, rdata_wol, rdatalen, duplicate, rr, rr_len);
+}
+
 /** Remove rr from node, ignores nonexisting RRs,
  * rdata points to buffer with rdatalen octets, starts with 2bytelength. */
 static int
@@ -1369,10 +1435,6 @@ decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt,
 				uncompressed_len = pkt_dname_len(&pktbuf);
 				if(!uncompressed_len)
 					return 0; /* parse error in dname */
-				compressed_len = sldns_buffer_position(
-					&pktbuf) - oldpos;
-				if(compressed_len > rdlen)
-					return 0; /* dname exceeds rdata */
 				if(!sldns_buffer_available(buf,
 					uncompressed_len))
 					/* dname too long for buffer */
@@ -1380,15 +1442,14 @@ decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt,
 				dname_pkt_copy(&pktbuf, 
 					sldns_buffer_current(buf), rd);
 				sldns_buffer_skip(buf, (ssize_t)uncompressed_len);
+				compressed_len = sldns_buffer_position(
+					&pktbuf) - oldpos;
 				rd += compressed_len;
 				rdlen -= compressed_len;
 				count--;
 				len = 0;
 				break;
 			case LDNS_RDF_TYPE_STR:
-				/* Check rdlen for resilience, because it is
-				 * checked above, that rdlen > 0 */
-				if(rdlen < 1) return 0; /* malformed */
 				len = rd[0] + 1;
 				break;
 			default:
@@ -1396,8 +1457,6 @@ decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt,
 				break;
 			}
 			if(len) {
-				if(len > rdlen)
-					return 0; /* malformed */
 				if(!sldns_buffer_available(buf, len))
 					return 0; /* too long for buffer */
 				sldns_buffer_write(buf, rd, len);
@@ -1570,13 +1629,153 @@ az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen,
 	return 1;
 }
 
+/** Structure for simdzone parse state */
+struct az_parse_state {
+	/** The zone that is processed. */
+	struct auth_zone* z;
+	/** number of errors, if 0 it was read successfully. */
+	int errors;
+	/** for http parse, chunk iterator. */
+	struct auth_chunk* chunk;
+	/** for http parse, position in chunk. */
+	size_t chunk_pos;
+};
+
+/** Callback for simdzone parse, log an error */
+static void
+az_parse_log(zone_parser_t *parser, uint32_t category,
+	const char *file, size_t line, const char *message, void *user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	(void)parser;
+
+	switch (category) {
+	case ZONE_INFO:
+		if (file)
+			log_info("%s:%d: %s", file, (int)line, message);
+		else
+			log_info("%s", message);
+		break;
+	case ZONE_WARNING:
+		if (file)
+			log_warn("%s:%d: %s", file, (int)line, message);
+		else
+			log_warn("%s", message);
+		break;
+	default:
+		if (file)
+			log_err("%s:%d: %s", file, (int)line, message);
+		else
+			log_err("%s", message);
+		state->errors++;
+		break;
+	}
+}
+
+/** Callback for simdzone parse, accept an RR that has been read in. */
+int32_t
+az_parse_accept(zone_parser_t *parser, const zone_name_t *owner,
+	uint16_t type, uint16_t dclass, uint32_t ttl, uint16_t rdlength,
+	const uint8_t *rdata, void *user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	if(verbosity >= 7) {
+		char dname[LDNS_MAX_DOMAINLEN], t[16], c[16];
+		dname_str((uint8_t*)owner->octets, dname);
+		sldns_wire2str_type_buf(type, t, sizeof(t));
+		sldns_wire2str_class_buf(dclass, c, sizeof(c));
+		verbose(7, "zone parse record %s %s %s", dname, c, t);
+	}
+
+	/* Duplicates can be ignored, do not insert them twice. */
+	if(!az_insert_rr_as_rdata(state->z, (uint8_t*)owner->octets,
+		owner->length, type, dclass, ttl, (uint8_t*)rdata, rdlength,
+		NULL, NULL, 0)) {
+		char dname[LDNS_MAX_DOMAINLEN], t[16], c[16];
+		dname_str((uint8_t*)owner->octets, dname);
+		sldns_wire2str_type_buf(type, t, sizeof(t));
+		sldns_wire2str_class_buf(dclass, c, sizeof(c));
+		log_err("record insert allocation failed, %s %s %s",
+			dname, c, t);
+		return ZONE_OUT_OF_MEMORY;
+	}
+	(void)parser;
+	return 0;
+}
+
+/**
+ * Callback for simdzone parse, include a zone file.
+ * It is called for every $INCLUDE entry. It could be used to save
+ * the file names, so that it can track if the files have changed, later.
+ */
+static int32_t
+az_parse_include(zone_parser_t *parser, const char *file,
+	const char *path, void *user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	(void)parser;
+	(void)state;
+	verbose(6, "zone parse descended into include file %s (full path %s)",
+		file, path);
+	return 0;
+}
+
+/**
+ * Parse file with simdzone.
+ */
+static int
+az_parse_file_simdzone(struct auth_zone* z, char* zfilename,
+	struct config_file* cfg)
+{
+	zone_parser_t parser;
+	zone_options_t options;
+	zone_name_buffer_t name_buffer;
+	zone_rdata_buffer_t rdata_buffer;
+	zone_buffers_t buffers = { 1, &name_buffer, &rdata_buffer };
+	struct az_parse_state state;
+
+	memset(&options, 0, sizeof(options));
+	options.origin.octets = z->name;
+	options.origin.length = z->namelen;
+	options.default_ttl = 3600;
+	options.default_class = LDNS_RR_CLASS_IN;
+	options.secondary = z->zone_is_slave;
+	options.pretty_ttls = true; /* non-standard, for backwards compatibility */
+	if(cfg->chrootdir && cfg->chrootdir[0])
+		options.chrootdir = cfg->chrootdir;
+	else	options.chrootdir = NULL;
+	options.log.callback = &az_parse_log;
+	options.accept.callback = &az_parse_accept;
+	options.include.callback = &az_parse_include;
+
+	memset(&state, 0, sizeof(state));
+	state.z = z;
+
+	/* Parse and process all RRs.  */
+	if (zone_parse(&parser, &options, &buffers, zfilename, &state) != 0) {
+		return 0;
+	}
+	return 1;
+}
+
+/** See if the file can be accessed, or if it does not exist. Look at errno. */
+static int
+file_exists(char* filename)
+{
+	struct stat buf;
+	if(stat(filename, &buf) < 0) {
+		return 0;
+	}
+	return 1;
+}
+
 int
 auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 {
+	int use_simdzone = 1;
 	uint8_t rr[LDNS_RR_BUF_SIZE];
 	struct sldns_file_parse_state state;
 	char* zfilename;
-	FILE* in;
 	if(!z || !z->zonefile || z->zonefile[0]==0)
 		return 1; /* no file, or "", nothing to read */
 	
@@ -1589,8 +1788,7 @@ auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 		dname_str(z->name, nm);
 		verbose(VERB_ALGO, "read zonefile %s for %s", zfilename, nm);
 	}
-	in = fopen(zfilename, "r");
-	if(!in) {
+	if(!file_exists(zfilename)) {
 		char* n = sldns_wire2str_dname(z->name, z->namelen);
 		if(z->zone_is_slave && errno == ENOENT) {
 			/* we fetch the zone contents later, no file yet */
@@ -1621,15 +1819,36 @@ auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 		state.origin_len = z->namelen;
 	}
 	/* parse the (toplevel) file */
-	if(!az_parse_file(z, in, rr, sizeof(rr), &state, zfilename, 0, cfg)) {
-		char* n = sldns_wire2str_dname(z->name, z->namelen);
-		log_err("error parsing zonefile %s for %s",
-			zfilename, n?n:"error");
-		free(n);
+	if(use_simdzone) {
+		/* Use simdzone. */
+		if(!az_parse_file_simdzone(z, zfilename, cfg)) {
+			char* n = sldns_wire2str_dname(z->name, z->namelen);
+			log_err("error parsing zonefile %s for %s",
+				zfilename, n?n:"error");
+			free(n);
+			return 0;
+		}
+	} else {
+		/* Read with sldns_str2wire functions. */
+		FILE* in;
+		in = fopen(zfilename, "r");
+		if(!in) {
+			char* n = sldns_wire2str_dname(z->name, z->namelen);
+			log_err("cannot open zonefile %s for %s: %s",
+				zfilename, n?n:"error", strerror(errno));
+			free(n);
+			return 0;
+		}
+		if(!az_parse_file(z, in, rr, sizeof(rr), &state, zfilename, 0, cfg)) {
+			char* n = sldns_wire2str_dname(z->name, z->namelen);
+			log_err("error parsing zonefile %s for %s",
+				zfilename, n?n:"error");
+			free(n);
+			fclose(in);
+			return 0;
+		}
 		fclose(in);
-		return 0;
 	}
-	fclose(in);
 
 	if(z->rpz)
 		rpz_finish_config(z->rpz);
@@ -2005,21 +2224,12 @@ auth_zone_get_serial(struct auth_zone* z, uint32_t* serial)
 	struct auth_data* apex;
 	struct auth_rrset* soa;
 	struct packed_rrset_data* d;
-	size_t primlen, mboxlen;
 	apex = az_find_name(z, z->name, z->namelen);
 	if(!apex) return 0;
 	soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
 	if(!soa || soa->data->count==0)
 		return 0; /* no RRset or no RRs in rrset */
 	if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */
-	if((primlen = dname_valid(soa->data->rr_data[0]+2,
-		soa->data->rr_len[0]-2)) == 0)
-		return 0; /* primary dname malformed */
-	if((mboxlen = dname_valid(soa->data->rr_data[0]+2+primlen,
-		soa->data->rr_len[0]-2-primlen)) == 0)
-		return 0; /* mailbox dname malformed */
-	if(2+primlen+mboxlen+4*5 != soa->data->rr_len[0])
-		return 0; /* rdata malformed */
 	d = soa->data;
 	*serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20));
 	return 1;
@@ -2032,21 +2242,12 @@ xfr_find_soa(struct auth_zone* z, struct auth_xfer* xfr)
 	struct auth_data* apex;
 	struct auth_rrset* soa;
 	struct packed_rrset_data* d;
-	size_t primlen, mboxlen;
 	apex = az_find_name(z, z->name, z->namelen);
 	if(!apex) return 0;
 	soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
 	if(!soa || soa->data->count==0)
 		return 0; /* no RRset or no RRs in rrset */
 	if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */
-	if((primlen = dname_valid(soa->data->rr_data[0]+2,
-		soa->data->rr_len[0]-2)) == 0)
-		return 0; /* primary dname malformed */
-	if((mboxlen = dname_valid(soa->data->rr_data[0]+2+primlen,
-		soa->data->rr_len[0]-2-primlen)) == 0)
-		return 0; /* mailbox dname malformed */
-	if(2+primlen+mboxlen+4*5 != soa->data->rr_len[0])
-		return 0; /* rdata malformed */
 	/* SOA record ends with serial, refresh, retry, expiry, minimum,
 	 * as 4 byte fields */
 	d = soa->data;
@@ -5122,14 +5323,11 @@ apply_axfr(struct auth_xfer* xfr, struct auth_zone* z,
 	return 1;
 }
 
-/** apply HTTP to zone in memory. z is locked. false on failure(mallocfail) */
+/** parse http zone with sldns. */
 static int
-apply_http(struct auth_xfer* xfr, struct auth_zone* z,
+parse_http_sldns(struct auth_xfer* xfr, struct auth_zone* z,
 	struct sldns_buffer* scratch_buffer)
 {
-	/* parse data in chunks */
-	/* parse RR's and read into memory. ignore $INCLUDE from the
-	 * downloaded file*/
 	struct sldns_file_parse_state pstate;
 	struct auth_chunk* chunk;
 	size_t chunk_pos;
@@ -5141,6 +5339,184 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 		memmove(pstate.origin, xfr->name, xfr->namelen);
 	}
 
+	chunk = xfr->task_transfer->chunks_first;
+	chunk_pos = 0;
+	pstate.lineno = 0;
+	while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer)) {
+		/* process this line */
+		pstate.lineno++;
+		chunkline_newline_removal(scratch_buffer);
+		if(chunkline_is_comment_line_or_empty(scratch_buffer)) {
+			continue;
+		}
+		/* parse line and add RR */
+		if((ret=http_parse_origin(scratch_buffer, &pstate))!=0) {
+			if(ret == 2) {
+				verbose(VERB_ALGO, "error parsing ORIGIN on line [%s:%d] %s",
+					xfr->task_transfer->master->file,
+					pstate.lineno,
+					sldns_buffer_begin(scratch_buffer));
+				return 0;
+			}
+			continue; /* $ORIGIN has been handled */
+		}
+		if((ret=http_parse_ttl(scratch_buffer, &pstate))!=0) {
+			if(ret == 2) {
+				verbose(VERB_ALGO, "error parsing TTL on line [%s:%d] %s",
+					xfr->task_transfer->master->file,
+					pstate.lineno,
+					sldns_buffer_begin(scratch_buffer));
+				return 0;
+			}
+			continue; /* $TTL has been handled */
+		}
+		if(!http_parse_add_rr(xfr, z, scratch_buffer, &pstate)) {
+			verbose(VERB_ALGO, "error parsing line [%s:%d] %s",
+				xfr->task_transfer->master->file,
+				pstate.lineno,
+				sldns_buffer_begin(scratch_buffer));
+			return 0;
+		}
+	}
+	return 1;
+}
+
+/**
+ * Callback for simdzone parse of http, include a zone file.
+ * It is called for every $INCLUDE entry.
+ */
+static int32_t
+az_http_parse_include(zone_parser_t *parser, const char *file,
+	const char *path, void *user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	char dname[LDNS_MAX_DOMAINLEN];
+	(void)parser;
+	verbose(6, "zone parse has include file %s (full path %s)",
+		file, path);
+	dname_str(state->z->name, dname);
+	verbose(1, "zone parse for zonefile of %s has $INCLUDE %s, but $INCLUDE not followed",
+		dname, file);
+	/* Not expecting a secondary zone file with includes. */
+	return ZONE_SEMANTIC_ERROR;
+}
+
+int32_t az_http_read_data(zone_parser_t* parser, char* data, size_t len,
+	size_t* outlen, void* user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	size_t written = 0;
+	(void)parser;
+
+	if(state->chunk == NULL) {
+		/* End of the chunk list */
+		*outlen = 0;
+		return 0;
+	}
+	if(state->chunk_pos == state->chunk->len) {
+		/* The end of the chunk list is reached, with 0 data. */
+		state->chunk = NULL;
+		*outlen = 0;
+		return 0;
+	}
+	if(len == 0) {
+		*outlen = 0;
+		return 0;
+	}
+
+	/* Fill up the data buffer with the requested amount. */
+	while(written < len) {
+		/* The amount that is wanted. */
+		size_t wanted = len - written;
+		/* That amount that is in this chunk. */
+		size_t avail = state->chunk->len - state->chunk_pos;
+
+		if(wanted < avail) {
+			/* Write a piece of this chunk. */
+			memmove(data+written,
+				state->chunk->data+state->chunk_pos, wanted);
+			state->chunk_pos += wanted;
+			*outlen = len;
+			return 0;
+		}
+		/* Write the entire chunk and continue on. */
+		if(avail > 0)
+			memmove(data+written,
+				state->chunk->data+state->chunk_pos, avail);
+		written += avail;
+
+		/* move to next chunk */
+		state->chunk = state->chunk->next;
+		state->chunk_pos = 0;
+
+		/* Is this the exact amount requested. */
+		if(written == len) {
+			/* continue later. */
+			*outlen = len;
+			return 0;
+		}
+		/* Is there no more data. */
+		if(state->chunk == NULL) {
+			/* End of data. */
+			*outlen = written;
+			return 0;
+		}
+	}
+	*outlen = written;
+	return 0;
+}
+
+/** parse http zone with simdzone. */
+static int
+parse_http_simdzone(struct auth_xfer* xfr, struct auth_zone* z)
+{
+	zone_parser_t parser;
+	zone_options_t options;
+	zone_name_buffer_t name_buffer;
+	zone_rdata_buffer_t rdata_buffer;
+	zone_buffers_t buffers = { 1, &name_buffer, &rdata_buffer };
+	struct az_parse_state state;
+
+	memset(&options, 0, sizeof(options));
+	options.origin.octets = z->name;
+	options.origin.length = z->namelen;
+	options.default_ttl = 3600;
+	options.default_class = LDNS_RR_CLASS_IN;
+	options.secondary = z->zone_is_slave;
+	options.pretty_ttls = true; /* non-standard, for backwards compatibility */
+	options.no_includes = true; /* the secondary zone file transferred over https is not expected to have $INCLUDE files. */
+	/* The log callback for file read prints the error and can be used
+	 * here too. */
+	options.log.callback = &az_parse_log;
+	/* The parse accept callback for file inserts the RR, and can be
+	 * used here too. */
+	options.accept.callback = &az_parse_accept;
+	options.include.callback = &az_http_parse_include;
+
+	memset(&state, 0, sizeof(state));
+	state.z = z;
+	state.chunk = xfr->task_transfer->chunks_first;
+	state.chunk_pos = 0;
+
+	/* Parse and process all RRs.  */
+	if (zone_parse_from_callback(&parser, &options, &buffers,
+		az_http_read_data, &state) != 0) {
+		return 0;
+	}
+	return 1;
+}
+
+/** apply HTTP to zone in memory. z is locked. false on failure(mallocfail) */
+static int
+apply_http(struct auth_xfer* xfr, struct auth_zone* z,
+	struct sldns_buffer* scratch_buffer)
+{
+	int use_simdzone = 1;
+
+	/* parse data in chunks */
+	/* parse RR's and read into memory. ignore $INCLUDE from the
+	 * downloaded file*/
+
 	if(verbosity >= VERB_ALGO)
 		verbose(VERB_ALGO, "http download %s of size %d",
 		xfr->task_transfer->master->file,
@@ -5180,44 +5556,14 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 	xfr->serial = 0;
 	xfr->soa_zone_acquired = 0;
 
-	chunk = xfr->task_transfer->chunks_first;
-	chunk_pos = 0;
-	pstate.lineno = 0;
-	while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer)) {
-		/* process this line */
-		pstate.lineno++;
-		chunkline_newline_removal(scratch_buffer);
-		if(chunkline_is_comment_line_or_empty(scratch_buffer)) {
-			continue;
-		}
-		/* parse line and add RR */
-		if((ret=http_parse_origin(scratch_buffer, &pstate))!=0) {
-			if(ret == 2) {
-				verbose(VERB_ALGO, "error parsing ORIGIN on line [%s:%d] %s",
-					xfr->task_transfer->master->file,
-					pstate.lineno,
-					sldns_buffer_begin(scratch_buffer));
-				return 0;
-			}
-			continue; /* $ORIGIN has been handled */
-		}
-		if((ret=http_parse_ttl(scratch_buffer, &pstate))!=0) {
-			if(ret == 2) {
-				verbose(VERB_ALGO, "error parsing TTL on line [%s:%d] %s",
-					xfr->task_transfer->master->file,
-					pstate.lineno,
-					sldns_buffer_begin(scratch_buffer));
-				return 0;
-			}
-			continue; /* $TTL has been handled */
-		}
-		if(!http_parse_add_rr(xfr, z, scratch_buffer, &pstate)) {
-			verbose(VERB_ALGO, "error parsing line [%s:%d] %s",
-				xfr->task_transfer->master->file,
-				pstate.lineno,
-				sldns_buffer_begin(scratch_buffer));
+	if(use_simdzone) {
+		/* Use simdzone for parse. */
+		if(!parse_http_simdzone(xfr, z))
+			return 0;
+	} else {
+		/* Parse with sldns. */
+		if(!parse_http_sldns(xfr, z, scratch_buffer))
 			return 0;
-		}
 	}
 	return 1;
 }
@@ -5745,7 +6091,8 @@ xfr_master_add_addrs(struct auth_master* m, struct ub_packed_rrset_key* rrset,
 
 /** callback for task_transfer lookup of host name, of A or AAAA */
 void auth_xfer_transfer_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
-	enum sec_status sec, char* why_bogus, int ATTR_UNUSED(was_ratelimited))
+	enum sec_status ATTR_UNUSED(sec), char* ATTR_UNUSED(why_bogus),
+	int ATTR_UNUSED(was_ratelimited))
 {
 	struct auth_xfer* xfr = (struct auth_xfer*)arg;
 	struct module_env* env;
@@ -5758,16 +6105,7 @@ void auth_xfer_transfer_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
 	}
 
 	/* process result */
-	if(sec == sec_status_bogus || sec == sec_status_secure_sentinel_fail) {
-		if(verbosity >= VERB_OPS) {
-			char zname[LDNS_MAX_DOMAINLEN];
-			dname_str(xfr->name, zname);
-			verbose(VERB_OPS, "auth zone %s: primary %s address lookup is DNSSEC bogus: %s",
-				zname, xfr->task_transfer->lookup_target->host,
-				(why_bogus?why_bogus:""));
-		}
-		/* fall through to next-lookup / next-master */
-	} else if(rcode == LDNS_RCODE_NOERROR) {
+	if(rcode == LDNS_RCODE_NOERROR) {
 		uint16_t wanted_qtype = LDNS_RR_TYPE_A;
 		struct regional* temp = env->scratch;
 		struct query_info rq;
@@ -6838,7 +7176,8 @@ xfr_probe_send_or_end(struct auth_xfer* xfr, struct module_env* env)
 
 /** callback for task_probe lookup of host name, of A or AAAA */
 void auth_xfer_probe_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
-	enum sec_status sec, char* why_bogus, int ATTR_UNUSED(was_ratelimited))
+	enum sec_status ATTR_UNUSED(sec), char* ATTR_UNUSED(why_bogus),
+	int ATTR_UNUSED(was_ratelimited))
 {
 	struct auth_xfer* xfr = (struct auth_xfer*)arg;
 	struct module_env* env;
@@ -6851,16 +7190,7 @@ void auth_xfer_probe_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
 	}
 
 	/* process result */
-	if(sec == sec_status_bogus || sec == sec_status_secure_sentinel_fail) {
-		if(verbosity >= VERB_OPS) {
-			char zname[LDNS_MAX_DOMAINLEN];
-			dname_str(xfr->name, zname);
-			verbose(VERB_OPS, "auth zone %s: primary %s address probe lookup is DNSSEC bogus: %s",
-				zname, xfr->task_transfer->lookup_target->host,
-				(why_bogus?why_bogus:""));
-		}
-		/* fall through to next-lookup / next-master */
-	} else if(rcode == LDNS_RCODE_NOERROR) {
+	if(rcode == LDNS_RCODE_NOERROR) {
 		uint16_t wanted_qtype = LDNS_RR_TYPE_A;
 		struct regional* temp = env->scratch;
 		struct query_info rq;

services/cache/dns.c

@@ -232,15 +232,8 @@ find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 
 	/* snip off front part of qname until the type is found */
 	while(qnamelen > 0) {
-		rrset = rrset_cache_lookup(env->rrset_cache, qname,
-			qnamelen, searchtype, qclass, 0, now, 0);
-		if(!rrset && searchtype == LDNS_RR_TYPE_DNAME)
-			/* If not found, for type DNAME, try 0TTL stored,
-			 * for its grace period. */
-			rrset = rrset_cache_lookup(env->rrset_cache, qname,
-				qnamelen, searchtype, qclass,
-				PACKED_RRSET_UPSTREAM_0TTL, now, 0);
-		if(rrset) {
+		if((rrset = rrset_cache_lookup(env->rrset_cache, qname, 
+			qnamelen, searchtype, qclass, 0, now, 0))) {
 			uint8_t* origqname = qname;
 			size_t origqnamelen = qnamelen;
 			if(!noexpiredabove)
@@ -277,8 +270,6 @@ find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 
 		/* snip off front label */
 		lablen = *qname;
-		if(lablen == 0)
-			break;
 		qname += lablen + 1;
 		qnamelen -= lablen + 1;
 	}
@@ -714,16 +705,10 @@ struct dns_msg*
 dns_msg_deepcopy_region(struct dns_msg* origin, struct regional* region)
 {
 	size_t i;
-	struct ub_packed_rrset_key** saved_rrsets;
 	struct dns_msg* res = NULL;
-	size_t rep_alloc_size = sizeof(struct reply_info)
-		- sizeof(struct rrset_ref);  /* this is the size of res->rep
-						allocated in gen_dns_msg() */
 	res = gen_dns_msg(region, &origin->qinfo, origin->rep->rrset_count);
 	if(!res) return NULL;
-	saved_rrsets = res->rep->rrsets; /* save rrsets alloc by gen_dns_msg */
-	memcpy(res->rep, origin->rep, rep_alloc_size);
-	res->rep->rrsets = saved_rrsets;
+	*res->rep = *origin->rep;
 	if(origin->rep->reason_bogus_str) {
 		res->rep->reason_bogus_str = regional_strdup(region,
 			origin->rep->reason_bogus_str);
@@ -781,15 +766,8 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 		rrset->entry.data;
 	uint8_t* newname, *dtarg = NULL;
 	size_t newlen, dtarglen;
-	time_t rr_ttl;
-	if(TTL_IS_EXPIRED(d->ttl, now)) {
-		/* Allow TTL=0 DNAME from upstream within grace period */
-		if(!(rrset->rk.flags & PACKED_RRSET_UPSTREAM_0TTL))
-			return NULL;
-		rr_ttl = 0;
-	} else {
-		rr_ttl = d->ttl - now;
-	}
+	if(TTL_IS_EXPIRED(d->ttl, now))
+		return NULL;
 	/* only allow validated (with DNSSEC) DNAMEs used from cache 
 	 * for insecure DNAMEs, query again. */
 	*sec_status = d->security;
@@ -801,7 +779,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	msg->rep->flags = BIT_QR; /* reply, no AA, no error */
         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 	msg->rep->qdcount = 1;
-	msg->rep->ttl = rr_ttl;
+	msg->rep->ttl = d->ttl - now;
 	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
 	msg->rep->serve_expired_norec_ttl = 0;
@@ -853,7 +831,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	if(!newd)
 		return NULL;
 	ck->entry.data = newd;
-	newd->ttl = rr_ttl; /* RFC6672: synth CNAME TTL == DNAME TTL */
+	newd->ttl = d->ttl - now; /* RFC6672: synth CNAME TTL == DNAME TTL */
 	newd->count = 1;
 	newd->rrsig_count = 0;
 	newd->trust = rrset_trust_ans_noAA;
@@ -1067,7 +1045,7 @@ dns_cache_lookup(struct module_env* env,
 	if(env->cfg->harden_below_nxdomain) {
 		while(!dname_is_root(k.qname)) {
 			if(dpname && dpnamelen
-				&& !dname_strict_subdomain_c(k.qname, dpname))
+				&& !dname_subdomain_c(k.qname, dpname))
 				break; /* no synth nxdomain above the stub */
 			dname_remove_label(&k.qname, &k.qname_len);
 			h = query_info_hash(&k, flags);

services/cache/rrset.c

@@ -50,7 +50,6 @@
 #include "util/regional.h"
 #include "util/alloc.h"
 #include "util/net_help.h"
-#include "validator/val_utils.h"
 
 void
 rrset_markdel(void* key)
@@ -127,8 +126,7 @@ rrset_cache_touch(struct rrset_cache* r, struct ub_packed_rrset_key* key,
 
 /** see if rrset needs to be updated in the cache */
 static int
-need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns,
-	int a_aaaa)
+need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns)
 {
 	struct packed_rrset_data* newd = (struct packed_rrset_data*)nd;
 	struct packed_rrset_data* cached = (struct packed_rrset_data*)cd;
@@ -151,20 +149,6 @@ need_to_update_rrset(void* nd, void* cd, time_t timenow, int equal, int ns,
 		if(equal && !TTL_IS_EXPIRED(cached->ttl, timenow) &&
 			cached->security == sec_status_bogus)
 			return 0;
-		/* ghost-domain: never let an NS overwrite extend lifetime
-		 * past the entry it replaces, regardless of trust. */
-		/* Also for A/AAAA and it is glue. */
-		if((ns ||
-			(a_aaaa && cached->trust==rrset_trust_add_noAA))
-			&& !TTL_IS_EXPIRED(cached->ttl, timenow) &&
-			newd->ttl > cached->ttl) {
-			size_t i;
-			if(a_aaaa) newd->trust=rrset_trust_add_noAA;
-			newd->ttl = cached->ttl;
-			for(i=0; i<(newd->count+newd->rrsig_count); i++)
-				if(newd->rr_ttl[i] > newd->ttl)
-					newd->rr_ttl[i] = newd->ttl;
-		}
                 return 1;
 	}
 	/*	o item in cache has expired */
@@ -229,8 +213,7 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 		equal = rrsetdata_equal((struct packed_rrset_data*)k->entry.
 			data, (struct packed_rrset_data*)e->data);
 		if(!need_to_update_rrset(k->entry.data, e->data, timenow,
-			equal, (rrset_type==LDNS_RR_TYPE_NS),
-			(rrset_type==LDNS_RR_TYPE_A || rrset_type==LDNS_RR_TYPE_AAAA))) {
+			equal, (rrset_type==LDNS_RR_TYPE_NS))) {
 			/* cache is superior, return that value */
 			lock_rw_unlock(&e->lock);
 			ub_packed_rrset_parsedelete(k, alloc);
@@ -262,43 +245,12 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 	return 0;
 }
 
-/** See if the name is a within signer authority */
-static int
-dname_subdomain_rrsig_signers(uint8_t* dname,
-	struct ub_packed_rrset_key* rrset)
-{
-	struct packed_rrset_data* d = (struct packed_rrset_data*)
-		rrset->entry.data;
-	size_t i;
-	if(!d || !d->rrsig_count)
-		return 0;
-	for(i=0; i<d->rrsig_count; i++) {
-		uint8_t* sname = NULL;
-		size_t slen = 0;
-		rrsig_get_signer(d->rr_data[d->count+i], d->rr_len[d->count+i],
-			&sname, &slen);
-		if(!sname || !slen)
-			return 0; /* malformed */
-		if(!dname_subdomain_c(dname, sname))
-			return 0; /* not a subdomain */
-	}
-	return 1;
-}
-
 void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache, 
 	struct ub_packed_rrset_key* rrset, uint8_t* ce, size_t ce_len,
 	struct alloc_cache* alloc, time_t timenow)
 {
 	struct rrset_ref ref;
 	uint8_t wc_dname[LDNS_MAX_DOMAINLEN+3];
-
-	/* See if the RRSIG signer name allows this wildcard,
-	 * the new rrset should fall within the zone of the RRSIG signer(s). */
-	if(!dname_subdomain_rrsig_signers(ce, rrset)) {
-		verbose(VERB_ALGO, "wildcard canonical parent outside signer authority");
-		return;
-	}
-
 	rrset = packed_rrset_copy_alloc(rrset, alloc, timenow);
 	if(!rrset) {
 		log_err("malloc failure in rrset_cache_update_wildcard");
@@ -326,10 +278,6 @@ void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache,
 	(void)rrset_cache_update(rrset_cache, &ref, alloc, timenow);
 }
 
-/** Grace period in seconds for TTL=0 DNAME rrsets (RFC 2308: do not cache).
- * Allows synthesis from cache within this window to reduce recursion load. */
-#define DNAME_TTL0_GRACE_SECONDS 1
-
 struct ub_packed_rrset_key* 
 rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen, 
 	uint16_t qtype, uint16_t qclass, uint32_t flags, time_t timenow,
@@ -352,20 +300,12 @@ rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen,
 		/* check TTL */
 		struct packed_rrset_data* data = 
 			(struct packed_rrset_data*)e->data;
-		struct ub_packed_rrset_key* k = (struct ub_packed_rrset_key*)e->key;
 		if(TTL_IS_EXPIRED(data->ttl, timenow)) {
-			/* Allow TTL=0 DNAME within grace period for synthesis */
-			if(qtype == LDNS_RR_TYPE_DNAME &&
-			   (k->rk.flags & PACKED_RRSET_UPSTREAM_0TTL) &&
-			   (timenow - data->ttl_add) <= DNAME_TTL0_GRACE_SECONDS) {
-				/* within grace: allow for synthesis */
-			} else {
-				lock_rw_unlock(&e->lock);
-				return NULL;
-			}
+			lock_rw_unlock(&e->lock);
+			return NULL;
 		}
 		/* we're done */
-		return k;
+		return (struct ub_packed_rrset_key*)e->key;
 	}
 	return NULL;
 }

services/listen_dnsport.c

@@ -42,6 +42,7 @@
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
+#include <sys/time.h>
 #include <limits.h>
 #ifdef USE_TCP_FASTOPEN
 #include <netinet/tcp.h>
@@ -2166,8 +2167,7 @@ void tcp_req_info_clear(struct tcp_req_info* req)
 	open = req->open_req_list;
 	while(open) {
 		nopen = open->next;
-		mesh_state_remove_reply(open->mesh, open->mesh_state, req->cp,
-			NULL);
+		mesh_state_remove_reply(open->mesh, open->mesh_state, req->cp);
 		free(open);
 		open = nopen;
 	}
@@ -2300,8 +2300,21 @@ int
 tcp_req_info_handle_read_close(struct tcp_req_info* req)
 {
 	verbose(VERB_ALGO, "tcp channel read side closed %d", req->cp->fd);
-	/* RFC 7766 6.2.4 says to drop pending replies when client closes. */
-	return 0; /* drop connection */
+	/* reset byte count for (potential) partial read */
+	req->cp->tcp_byte_count = 0;
+	/* if we still have results to write, pick up next and write it */
+	if(req->num_done_req != 0) {
+		tcp_req_pickup_next_result(req);
+		tcp_req_info_setup_listen(req);
+		return 1;
+	}
+	/* if nothing to do, this closes the connection */
+	if(req->num_open_req == 0 && req->num_done_req == 0)
+		return 0;
+	/* otherwise, we must be waiting for dns resolve, wait with timeout */
+	req->read_is_closed = 1;
+	tcp_req_info_setup_listen(req);
+	return 1;
 }
 
 void
@@ -3399,13 +3412,14 @@ doq_table_delete(struct doq_table* table)
 }
 
 struct doq_timer*
-doq_timer_find_time(struct doq_table* table, ngtcp2_tstamp ts)
+doq_timer_find_time(struct doq_table* table, struct timeval* tv)
 {
 	struct doq_timer key;
 	struct rbnode_type* node;
 	log_assert(table != NULL);
 	memset(&key, 0, sizeof(key));
-	key.time_mono = ts;
+	key.time.tv_sec = tv->tv_sec;
+	key.time.tv_usec = tv->tv_usec;
 	node = rbtree_search(table->timer_tree, &key);
 	if(node)
 		return (struct doq_timer*)node->key;
@@ -3453,7 +3467,7 @@ doq_timer_list_remove(struct doq_table* table, struct doq_timer* timer)
 	if(!timer->timer_in_list)
 		return;
 	/* The item in the rbtree has the list start and end. */
-	rb_timer = doq_timer_find_time(table, timer->time_mono);
+	rb_timer = doq_timer_find_time(table, &timer->time);
 	if(rb_timer) {
 		if(timer->setlist_prev)
 			timer->setlist_prev->setlist_next = timer->setlist_next;
@@ -3499,8 +3513,7 @@ doq_timer_unset(struct doq_table* table, struct doq_timer* timer)
 }
 
 void doq_timer_set(struct doq_table* table, struct doq_timer* timer,
-	struct doq_server_socket* worker_doq_socket, struct timeval* tv,
-	ngtcp2_tstamp ts)
+	struct doq_server_socket* worker_doq_socket, struct timeval* tv)
 {
 	struct doq_timer* rb_timer;
 	if(verbosity >= VERB_ALGO && timer->conn) {
@@ -3514,14 +3527,14 @@ void doq_timer_set(struct doq_table* table, struct doq_timer* timer,
 			(int)rel.tv_sec, (int)rel.tv_usec);
 	}
 	if(timer->timer_in_tree || timer->timer_in_list) {
-		if(timer->time_mono == ts)
+		if(timer->time.tv_sec == tv->tv_sec &&
+			timer->time.tv_usec == tv->tv_usec)
 			return; /* already set on that time */
 		doq_timer_unset(table, timer);
 	}
-	timer->time_real.tv_sec = tv->tv_sec;
-	timer->time_real.tv_usec = tv->tv_usec;
-	timer->time_mono = ts;
-	rb_timer = doq_timer_find_time(table, ts);
+	timer->time.tv_sec = tv->tv_sec;
+	timer->time.tv_usec = tv->tv_usec;
+	rb_timer = doq_timer_find_time(table, tv);
 	if(rb_timer) {
 		/* There is a timeout already with this value. Timer is
 		 * added to the setlist. */
@@ -3597,29 +3610,15 @@ doq_conn_create(struct comm_point* c, struct doq_pkt_addr* paddr,
 	return conn;
 }
 
-/** The arguments for doq stream tree del. */
-struct doq_stream_tree_del_args {
-	/** The doq table. */
-	struct doq_table* table;
-	/** The doq connection for the stream. */
-	struct doq_conn* conn;
-};
-
 /** delete stream tree node */
 static void
 stream_tree_del(rbnode_type* node, void* arg)
 {
-	struct doq_stream_tree_del_args* args = (struct doq_stream_tree_del_args*)arg;
-	struct doq_table* table = args->table;
+	struct doq_table* table = (struct doq_table*)arg;
 	struct doq_stream* stream;
 	if(!node)
 		return;
 	stream = (struct doq_stream*)node;
-	if(stream->mesh_state) {
-		mesh_state_remove_reply(stream->mesh, stream->mesh_state,
-			args->conn->doq_socket->cp, stream);
-		stream->mesh_state = NULL;
-	}
 	if(stream->in)
 		doq_table_quic_size_subtract(table, stream->inlen);
 	if(stream->out)
@@ -3641,11 +3640,7 @@ doq_conn_delete(struct doq_conn* conn, struct doq_table* table)
 	 * because the ngtcp2 conn is deleted. */
 	SSL_set_app_data(conn->ssl, NULL);
 	if(conn->stream_tree.count != 0) {
-		struct doq_stream_tree_del_args args;
-		memset(&args, 0, sizeof(args));
-		args.table = table;
-		args.conn = conn;
-		traverse_postorder(&conn->stream_tree, stream_tree_del, &args);
+		traverse_postorder(&conn->stream_tree, stream_tree_del, table);
 	}
 	free(conn->key.dcid);
 	SSL_free(conn->ssl);
@@ -3718,9 +3713,13 @@ int doq_timer_cmp(const void* key1, const void* key2)
 {
 	struct doq_timer* e = (struct doq_timer*)key1;
 	struct doq_timer* f = (struct doq_timer*)key2;
-	if(e->time_mono < f->time_mono)
+	if(e->time.tv_sec < f->time.tv_sec)
 		return -1;
-	if(e->time_mono > f->time_mono)
+	if(e->time.tv_sec > f->time.tv_sec)
+		return 1;
+	if(e->time.tv_usec < f->time.tv_usec)
+		return -1;
+	if(e->time.tv_usec > f->time.tv_usec)
 		return 1;
 	return 0;
 }
@@ -3781,7 +3780,7 @@ doq_repinfo_retrieve_localaddr(struct comm_reply* repinfo,
 		memset(sa6, 0, *localaddrlen);
 		sa6->sin6_family = AF_INET6;
 		memmove(&sa6->sin6_addr, &repinfo->pktinfo.v6info.ipi6_addr,
-			sizeof(struct in6_addr));
+			*localaddrlen);
 		sa6->sin6_port = repinfo->doq_srcport;
 #endif
 	} else {
@@ -3791,7 +3790,7 @@ doq_repinfo_retrieve_localaddr(struct comm_reply* repinfo,
 		memset(sa, 0, *localaddrlen);
 		sa->sin_family = AF_INET;
 		memmove(&sa->sin_addr, &repinfo->pktinfo.v4info.ipi_addr,
-			sizeof(struct in_addr));
+			*localaddrlen);
 		sa->sin_port = repinfo->doq_srcport;
 #elif defined(IP_RECVDSTADDR)
 		struct sockaddr_in* sa = (struct sockaddr_in*)localaddr;
@@ -3954,11 +3953,6 @@ doq_stream_close(struct doq_conn* conn, struct doq_stream* stream,
 	if(stream->is_closed)
 		return 1;
 	stream->is_closed = 1;
-	if(stream->mesh_state) {
-		mesh_state_remove_reply(stream->mesh, stream->mesh_state,
-			conn->doq_socket->cp, stream);
-		stream->mesh_state = NULL;
-	}
 	doq_stream_off_write_list(conn, stream);
 	if(send_shutdown) {
 		verbose(VERB_ALGO, "doq: shutdown stream_id %d with app_error_code %d",
@@ -3988,8 +3982,7 @@ doq_stream_close(struct doq_conn* conn, struct doq_stream* stream,
 
 /** doq stream pick up answer data from buffer */
 static int
-doq_stream_pickup_answer(struct doq_conn* conn, struct doq_stream* stream,
-	struct sldns_buffer* buf)
+doq_stream_pickup_answer(struct doq_stream* stream, struct sldns_buffer* buf)
 {
 	stream->is_answer_available = 1;
 	if(stream->out) {
@@ -3999,11 +3992,6 @@ doq_stream_pickup_answer(struct doq_conn* conn, struct doq_stream* stream,
 	}
 	stream->nwrite = 0;
 	stream->outlen = sldns_buffer_limit(buf);
-	if(!doq_table_quic_size_available(conn->doq_socket->table,
-		conn->doq_socket->cfg, stream->outlen)) {
-		verbose(VERB_ALGO, "doq stream: no space for reply length");
-		return 0;
-	}
 	/* For quic the output bytes have to stay allocated and available,
 	 * for potential resends, until the remote end has acknowledged them.
 	 * This includes the tcplen start uint16_t, in outlen_wire. */
@@ -4030,56 +4018,24 @@ doq_stream_send_reply(struct doq_conn* conn, struct doq_stream* stream,
 	if(stream->out)
 		doq_table_quic_size_subtract(conn->doq_socket->table,
 			stream->outlen);
-	if(!doq_stream_pickup_answer(conn, stream, buf))
+	if(!doq_stream_pickup_answer(stream, buf))
 		return 0;
 	doq_table_quic_size_add(conn->doq_socket->table, stream->outlen);
 	doq_stream_on_write_list(conn, stream);
 	doq_conn_write_enable(conn);
 	return 1;
 }
-#endif /* HAVE_NGTCP2 */
 
-void
-doq_stream_add_meshstate(struct doq_stream* stream,
-	struct mesh_area* mesh, struct mesh_state* m)
-{
-#ifdef HAVE_NGTCP2
-	stream->mesh = mesh;
-	stream->mesh_state = m;
-#else
-	(void)stream; (void)mesh; (void)m;
-#endif
-}
-
-void
-doq_stream_remove_mesh_state(struct doq_stream* stream)
-{
-#ifdef HAVE_NGTCP2
-	if(!stream)
-		return;
-	stream->mesh_state = NULL;
-#else
-	(void)stream;
-#endif
-}
-
-#ifdef HAVE_NGTCP2
 /** doq stream data length has completed, allocations can be done. False on
  * allocation failure. */
 static int
-doq_stream_datalen_complete(struct doq_conn* conn, struct doq_stream* stream,
-	struct doq_table* table)
+doq_stream_datalen_complete(struct doq_stream* stream, struct doq_table* table)
 {
 	if(stream->inlen > 1024*1024) {
 		log_err("doq stream in length too large %d",
 			(int)stream->inlen);
 		return 0;
 	}
-	if(!doq_table_quic_size_available(table, conn->doq_socket->cfg,
-		stream->inlen)) {
-		verbose(VERB_ALGO, "doq stream: no space for query length");
-		return 0;
-	}
 	stream->in = calloc(1, stream->inlen);
 	if(!stream->in) {
 		log_err("doq could not read stream, calloc failed: "
@@ -4124,7 +4080,6 @@ doq_stream_data_complete(struct doq_conn* conn, struct doq_stream* stream)
 		return 0;
 	}
 	c->repinfo.doq_streamid = stream->stream_id;
-	c->repinfo.doq_stream = stream;
 	conn->doq_socket->current_conn = conn;
 	fptr_ok(fptr_whitelist_comm_point(c->callback));
 	if( (*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &c->repinfo)) {
@@ -4141,9 +4096,8 @@ doq_stream_data_complete(struct doq_conn* conn, struct doq_stream* stream)
 
 /** doq receive data for a stream, more bytes of the incoming data */
 static int
-doq_stream_recv_data(struct doq_conn* conn, struct doq_stream* stream,
-	const uint8_t* data, size_t datalen, int* recv_done,
-	struct doq_table* table)
+doq_stream_recv_data(struct doq_stream* stream, const uint8_t* data,
+	size_t datalen, int* recv_done, struct doq_table* table)
 {
 	int got_data = 0;
 	/* read the tcplength uint16_t at the start */
@@ -4164,7 +4118,7 @@ doq_stream_recv_data(struct doq_conn* conn, struct doq_stream* stream,
 		if(stream->nread == 2) {
 			/* the initial length value is completed */
 			stream->inlen = ntohs(tcplen);
-			if(!doq_stream_datalen_complete(conn, stream, table))
+			if(!doq_stream_datalen_complete(stream, table))
 				return 0;
 		} else {
 			/* store for later */
@@ -4313,11 +4267,12 @@ doq_submit_new_token(struct doq_conn* conn)
 	ngtcp2_ssize tokenlen;
 	int ret;
 	const ngtcp2_path* path = ngtcp2_conn_get_path(conn->conn);
+	ngtcp2_tstamp ts = doq_get_timestamp_nanosec();
 
 	tokenlen = ngtcp2_crypto_generate_regular_token(token,
 		conn->doq_socket->static_secret,
 		conn->doq_socket->static_secret_len, path->remote.addr,
-		path->remote.addrlen, doq_get_timestamp_nanosec());
+		path->remote.addrlen, ts);
 	if(tokenlen < 0) {
 		log_err("doq ngtcp2_crypto_generate_regular_token failed");
 		return 1;
@@ -4380,7 +4335,8 @@ doq_stream_open_cb(ngtcp2_conn* ATTR_UNUSED(conn), int64_t stream_id,
 		verbose(VERB_ALGO, "doq: stream with this id already exists");
 		return 0;
 	}
-	if(!doq_table_quic_size_available(doq_conn->doq_socket->table,
+	if(stream_id != 0 && stream_id != 4 && /* allow one stream on a new connection */
+		!doq_table_quic_size_available(doq_conn->doq_socket->table,
 		doq_conn->doq_socket->cfg, sizeof(*stream)
 		+ 100 /* estimated query in */
 		+ 512 /* estimated response out */
@@ -4438,8 +4394,8 @@ doq_recv_stream_data_cb(ngtcp2_conn* ATTR_UNUSED(conn), uint32_t flags,
 		return 0;
 	}
 	if(datalen != 0) {
-		if(!doq_stream_recv_data(doq_conn, stream, data, datalen,
-			&recv_done, doq_conn->doq_socket->table))
+		if(!doq_stream_recv_data(stream, data, datalen, &recv_done,
+			doq_conn->doq_socket->table))
 			return NGTCP2_ERR_CALLBACK_FAILURE;
 	}
 	if((flags&NGTCP2_STREAM_DATA_FLAG_FIN)!=0) {
@@ -4508,29 +4464,6 @@ doq_stream_reset_cb(ngtcp2_conn* ATTR_UNUSED(conn), int64_t stream_id,
 	return 0;
 }
 
-/** ngtcp2 extend_max_stream_data function */
-int doq_extend_max_stream_data_cb(ngtcp2_conn* ATTR_UNUSED(conn),
-	int64_t stream_id, uint64_t max_data, void* user_data,
-	void* ATTR_UNUSED(stream_user_data))
-{
-	struct doq_conn* doq_conn = (struct doq_conn*)user_data;
-	struct doq_stream* stream;
-	verbose(VERB_ALGO, "doq extend_max_stream_data stream id %d "
-		"max_data %d ", (int)stream_id, (int)max_data);
-	if(max_data == 0)
-		return 0;
-	stream = doq_stream_find(doq_conn, stream_id);
-	if(!stream) {
-		verbose(VERB_ALGO, "doq: unknown stream %d", (int)stream_id);
-		return 0;
-	}
-	if(!stream->is_answer_available)
-		return 0;
-	doq_stream_on_write_list(doq_conn, stream);
-	doq_conn_write_enable(doq_conn);
-	return 0;
-}
-
 /** ngtcp2 acked_stream_data_offset callback function */
 static int
 doq_acked_stream_data_offset_cb(ngtcp2_conn* ATTR_UNUSED(conn),
@@ -4905,7 +4838,6 @@ doq_conn_setup(struct doq_conn* conn, uint8_t* scid, size_t scidlen,
 	callbacks.stream_open = doq_stream_open_cb;
 	callbacks.stream_close = doq_stream_close_cb;
 	callbacks.stream_reset = doq_stream_reset_cb;
-	callbacks.extend_max_stream_data = doq_extend_max_stream_data_cb;
 	callbacks.acked_stream_data_offset = doq_acked_stream_data_offset_cb;
 	callbacks.recv_stream_data = doq_recv_stream_data_cb;
 
@@ -5182,30 +5114,23 @@ doq_conn_clear_conids(struct doq_conn* conn)
 
 ngtcp2_tstamp doq_get_timestamp_nanosec(void)
 {
+#ifdef CLOCK_REALTIME
 	struct timespec tp;
 	memset(&tp, 0, sizeof(tp));
-#ifdef CLOCK_BOOTTIME
-	if(clock_gettime(CLOCK_BOOTTIME, &tp) == -1) {
-#endif
-		if(clock_gettime(CLOCK_MONOTONIC, &tp) == -1) {
-			log_err("clock_gettime failed: %s", strerror(errno));
-		}
-#ifdef CLOCK_BOOTTIME
+	/* Get a nanosecond time, that can be compared with the event base. */
+	if(clock_gettime(CLOCK_REALTIME, &tp) == -1) {
+		log_err("clock_gettime failed: %s", strerror(errno));
 	}
-#endif
 	return ((uint64_t)tp.tv_sec)*((uint64_t)1000000000) +
 		((uint64_t)tp.tv_nsec);
-}
-
-static struct timeval doq_get_timevalue(void)
-{
+#else
 	struct timeval tv;
-	memset(&tv, 0, sizeof(tv));
 	if(gettimeofday(&tv, NULL) < 0) {
 		log_err("gettimeofday failed: %s", strerror(errno));
-		memset(&tv, 0, sizeof(tv));
 	}
-	return tv;
+	return ((uint64_t)tv.tv_sec)*((uint64_t)1000000000) +
+		((uint64_t)tv.tv_usec)*((uint64_t)1000);
+#endif /* CLOCK_REALTIME */
 }
 
 /** doq start the closing period for the connection. */
@@ -5328,17 +5253,18 @@ doq_conn_recv(struct comm_point* c, struct doq_pkt_addr* paddr,
 	int* err_drop)
 {
 	int ret;
+	ngtcp2_tstamp ts;
 	struct ngtcp2_path path;
 	memset(&path, 0, sizeof(path));
 	path.remote.addr = (struct sockaddr*)&paddr->addr;
 	path.remote.addrlen = paddr->addrlen;
 	path.local.addr = (struct sockaddr*)&paddr->localaddr;
 	path.local.addrlen = paddr->localaddrlen;
+	ts = doq_get_timestamp_nanosec();
 
 	ret = ngtcp2_conn_read_pkt(conn->conn, &path, pi,
 		sldns_buffer_begin(c->doq_socket->pkt_buf),
-		sldns_buffer_limit(c->doq_socket->pkt_buf),
-		doq_get_timestamp_nanosec());
+		sldns_buffer_limit(c->doq_socket->pkt_buf), ts);
 	if(ret != 0) {
 		if(err_retry)
 			*err_retry = 0;
@@ -5426,6 +5352,7 @@ doq_conn_write_streams(struct comm_point* c, struct doq_conn* conn,
 {
 	struct doq_stream* stream = conn->stream_write_first;
 	ngtcp2_path_storage ps;
+	ngtcp2_tstamp ts = doq_get_timestamp_nanosec();
 	size_t num_packets = 0, max_packets = 65535;
 	ngtcp2_path_storage_zero(&ps);
 
@@ -5478,8 +5405,7 @@ doq_conn_write_streams(struct comm_point* c, struct doq_conn* conn,
 		ret = ngtcp2_conn_writev_stream(conn->conn, &ps.path, &pi,
 			sldns_buffer_begin(c->doq_socket->pkt_buf),
 			sldns_buffer_remaining(c->doq_socket->pkt_buf),
-			&ndatalen, flags, stream_id, datav, datav_count,
-			doq_get_timestamp_nanosec());
+			&ndatalen, flags, stream_id, datav, datav_count, ts);
 		if(ret < 0) {
 			if(ret == NGTCP2_ERR_WRITE_MORE) {
 				verbose(VERB_ALGO, "doq: write more, ndatalen %d", (int)ndatalen);
@@ -5494,20 +5420,26 @@ doq_conn_write_streams(struct comm_point* c, struct doq_conn* conn,
 				continue;
 			} else if(ret == NGTCP2_ERR_STREAM_DATA_BLOCKED) {
 				verbose(VERB_ALGO, "doq: ngtcp2_conn_writev_stream returned NGTCP2_ERR_STREAM_DATA_BLOCKED");
-				if(stream) {
-					doq_stream_off_write_list(conn, stream);
-					stream = stream->write_next;
-					continue;
-				} else {
-					break;
+#ifdef HAVE_NGTCP2_CCERR_DEFAULT
+				ngtcp2_ccerr_set_application_error(
+					&conn->ccerr, -1, NULL, 0);
+#else
+				ngtcp2_connection_close_error_set_application_error(&conn->last_error, -1, NULL, 0);
+#endif
+				if(err_drop)
+					*err_drop = 0;
+				if(!doq_conn_close_error(c, conn)) {
+					if(err_drop)
+						*err_drop = 1;
 				}
+				return 0;
 			} else if(ret == NGTCP2_ERR_STREAM_SHUT_WR) {
 				verbose(VERB_ALGO, "doq: ngtcp2_conn_writev_stream returned NGTCP2_ERR_STREAM_SHUT_WR");
 #ifdef HAVE_NGTCP2_CCERR_DEFAULT
 				ngtcp2_ccerr_set_application_error(
-					&conn->ccerr, DOQ_APP_ERROR_CODE, NULL, 0);
+					&conn->ccerr, -1, NULL, 0);
 #else
-				ngtcp2_connection_close_error_set_application_error(&conn->last_error, DOQ_APP_ERROR_CODE, NULL, 0);
+				ngtcp2_connection_close_error_set_application_error(&conn->last_error, -1, NULL, 0);
 #endif
 				if(err_drop)
 					*err_drop = 0;
@@ -5545,8 +5477,7 @@ doq_conn_write_streams(struct comm_point* c, struct doq_conn* conn,
 		if(ret == 0) {
 			/* congestion limited */
 			doq_conn_write_disable(conn);
-			ngtcp2_conn_update_pkt_tx_time(conn->conn,
-				doq_get_timestamp_nanosec());
+			ngtcp2_conn_update_pkt_tx_time(conn->conn, ts);
 			return 1;
 		}
 		sldns_buffer_set_position(c->doq_socket->pkt_buf, ret);
@@ -5560,7 +5491,7 @@ doq_conn_write_streams(struct comm_point* c, struct doq_conn* conn,
 		if(stream)
 			stream = stream->write_next;
 	}
-	ngtcp2_conn_update_pkt_tx_time(conn->conn, doq_get_timestamp_nanosec());
+	ngtcp2_conn_update_pkt_tx_time(conn->conn, ts);
 	return 1;
 }
 
@@ -5637,35 +5568,32 @@ doq_table_pop_first(struct doq_table* table)
 }
 
 int
-doq_conn_check_timer(struct doq_conn* conn, struct timeval* tv, ngtcp2_tstamp* ts)
+doq_conn_check_timer(struct doq_conn* conn, struct timeval* tv)
 {
-	ngtcp2_tstamp doq_expiry = ngtcp2_conn_get_expiry(conn->conn);
-	ngtcp2_tstamp doq_now = doq_get_timestamp_nanosec();
+	ngtcp2_tstamp expiry = ngtcp2_conn_get_expiry(conn->conn);
+	ngtcp2_tstamp now = doq_get_timestamp_nanosec();
 	ngtcp2_tstamp t;
-	struct timeval now = doq_get_timevalue();
 
-	if(doq_expiry <= doq_now || doq_expiry == UINT64_MAX) {
-		/* UINT64_MAX means there is no next expiry. */
+	if(expiry <= now) {
 		/* The timer has already expired, add with zero timeout.
 		 * This should call the callback straight away. Calling it
 		 * from the event callbacks is cleaner than calling it here,
 		 * because then it is always called with the same locks and
 		 * so on. This routine only has the conn.lock. */
-		t = doq_now;
-		memcpy(tv, &now, sizeof(*tv));
+		t = now;
 	} else {
-		t = doq_expiry;
-		memset(tv, 0, sizeof(*tv));
-		tv->tv_sec = (doq_expiry - doq_now) / NGTCP2_SECONDS;
-		tv->tv_usec = ((doq_expiry - doq_now) / NGTCP2_MICROSECONDS)%1000000;
-		timeval_add(tv, &now);
+		t = expiry;
 	}
 
-	*ts = t;
+	/* convert to timeval */
+	memset(tv, 0, sizeof(*tv));
+	tv->tv_sec = t / NGTCP2_SECONDS;
+	tv->tv_usec = (t / NGTCP2_MICROSECONDS)%1000000;
 
 	/* If we already have a timer, is it the right value? */
 	if(conn->timer.timer_in_tree || conn->timer.timer_in_list) {
-		if(conn->timer.time_mono == *ts)
+		if(conn->timer.time.tv_sec == tv->tv_sec &&
+			conn->timer.time.tv_usec == tv->tv_usec)
 			return 0;
 	}
 	return 1;
@@ -5686,12 +5614,13 @@ doq_conn_log_line(struct doq_conn* conn, char* s)
 int
 doq_conn_handle_timeout(struct doq_conn* conn)
 {
+	ngtcp2_tstamp now = doq_get_timestamp_nanosec();
 	int rv;
 
 	if(verbosity >= VERB_ALGO)
 		doq_conn_log_line(conn, "timeout");
 
-	rv = ngtcp2_conn_handle_expiry(conn->conn, doq_get_timestamp_nanosec());
+	rv = ngtcp2_conn_handle_expiry(conn->conn, now);
 	if(rv != 0) {
 		verbose(VERB_ALGO, "ngtcp2_conn_handle_expiry failed: %s",
 			ngtcp2_strerror(rv));

services/listen_dnsport.h

@@ -61,8 +61,6 @@ struct config_file;
 struct addrinfo;
 struct sldns_buffer;
 struct tcl_list;
-struct mesh_area;
-struct mesh_state;
 
 /**
  * Listening for queries structure.
@@ -540,11 +538,8 @@ void doq_table_delete(struct doq_table* table);
 struct doq_timer {
 	/** The rbnode in the tree sorted by timeout value. Key this struct. */
 	struct rbnode_type node;
-	/** The timeout value. Monotonic value used with ngtcp2.
-	 *  This time value is used for the tree operations. */
-	ngtcp2_tstamp time_mono;
 	/** The timeout value. Absolute time value. */
-	struct timeval time_real;
+	struct timeval time;
 	/** If the timer is in the time tree, with the node. */
 	int timer_in_tree;
 	/** If there are more timers with the exact same timeout value,
@@ -694,11 +689,6 @@ struct doq_stream {
 	uint8_t* out;
 	/** if the stream is on the write list */
 	uint8_t on_write_list;
-	/** The mesh area and mesh state, set when this stream's query was
-	 * dispatched into the mesh; used to detach the reply on stream close */
-	struct mesh_area* mesh;
-	/** the mesh state for the query, is nonNULL when there is one. */
-	struct mesh_state* mesh_state;
 	/** the prev and next on the write list, if on the list */
 	struct doq_stream* write_prev, *write_next;
 };
@@ -801,16 +791,7 @@ int doq_stream_close(struct doq_conn* conn, struct doq_stream* stream,
 /** send reply for a connection */
 int doq_stream_send_reply(struct doq_conn* conn, struct doq_stream* stream,
 	struct sldns_buffer* buf);
-#endif /* HAVE_NGTCP2 */
 
-/** add mesh state to doq stream */
-void doq_stream_add_meshstate(struct doq_stream* stream,
-	struct mesh_area* mesh, struct mesh_state* m);
-
-/** remove mesh state from doq stream */
-void doq_stream_remove_mesh_state(struct doq_stream* stream);
-
-#ifdef HAVE_NGTCP2
 /** the connection has write interest, wants to write packets */
 void doq_conn_write_enable(struct doq_conn* conn);
 
@@ -832,12 +813,10 @@ struct doq_conn* doq_table_pop_first(struct doq_table* table);
  * doq check if the timer for the conn needs to be changed.
  * @param conn: connection, caller must hold lock on it.
  * @param tv: time value, absolute time, returned.
- * @param ts: time stamp, absolute time, returned.
  * @return true if timer needs to be set to tv, false if no change is needed
  * 	to the timer. The timer is already set to the right time in that case.
  */
-int doq_conn_check_timer(struct doq_conn* conn, struct timeval* tv,
-	ngtcp2_tstamp* ts);
+int doq_conn_check_timer(struct doq_conn* conn, struct timeval* tv);
 
 /** doq remove timer from tree */
 void doq_timer_tree_remove(struct doq_table* table, struct doq_timer* timer);
@@ -850,12 +829,11 @@ void doq_timer_unset(struct doq_table* table, struct doq_timer* timer);
 
 /** doq set the timer and add it. */
 void doq_timer_set(struct doq_table* table, struct doq_timer* timer,
-	struct doq_server_socket* worker_doq_socket, struct timeval* tv,
-	ngtcp2_tstamp ts);
+	struct doq_server_socket* worker_doq_socket, struct timeval* tv);
 
 /** doq find a timeout in the timer tree */
 struct doq_timer* doq_timer_find_time(struct doq_table* table,
-	ngtcp2_tstamp ts);
+	struct timeval* tv);
 
 /** doq handle timeout for a connection. Pass conn locked. Returns false for
  * deletion. */
@@ -873,9 +851,6 @@ int doq_table_quic_size_available(struct doq_table* table,
 
 /** doq get the quic size value */
 size_t doq_table_quic_size_get(struct doq_table* table);
-
-/** get a timestamp in nanoseconds */
-ngtcp2_tstamp doq_get_timestamp_nanosec(void);
 #endif /* HAVE_NGTCP2 */
 
 char* set_ip_dscp(int socket, int addrfamily, int ds);
@@ -891,4 +866,8 @@ void doq_client_event_cb(int fd, short event, void* arg);
 /** timer event callback for testcode/doqclient */
 void doq_client_timer_cb(int fd, short event, void* arg);
 
+#ifdef HAVE_NGTCP2
+/** get a timestamp in nanoseconds */
+ngtcp2_tstamp doq_get_timestamp_nanosec(void);
+#endif
 #endif /* LISTEN_DNSPORT_H */

services/localzone.c

@@ -56,24 +56,6 @@
  * with 16 bytes for an A record, a 64K packet has about 4000 max */
 #define LOCALZONE_RRSET_COUNT_MAX 4096
 
-static const char* default_zones_reverse_array[] = {
-	"127.in-addr.arpa.", /* reverse ip4 zone */
-	"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", /* reverse ip6 zone */
-	0
-};
-const char** local_zones_default_reverse = default_zones_reverse_array;
-
-static const char* default_zones_special_array[] = {
-	"test.",		/* RFC 6761 */
-	"invalid.",		/* RFC 6761 */
-	"onion.",		/* RFC 7686 */
-	"home.arpa.",		/* RFC 8375 */
-	"resolver.arpa.",	/* RFC 9462 */
-	"service.arpa.",	/* RFC 9665 */
-	0
-};
-const char** local_zones_default_special = default_zones_special_array;
-
 /** print all RRsets in local zone */
 static void
 local_zone_out(struct local_zone* z)
@@ -668,7 +650,7 @@ lz_enter_rr_str(struct local_zones* zones, const char* rr)
 	}
 	labs = dname_count_size_labels(rr_name, &len);
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type, 1);
+	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
 	if(!z) {
 		lock_rw_unlock(&zones->lock);
 		fatal_exit("internal error: no zone for rr %s", rr);
@@ -852,7 +834,7 @@ lz_nodefault(struct config_file* cfg, const char* name)
 
 	for(p = cfg->local_zones_nodefault; p; p = p->next) {
 		/* compare zone name, lowercase, compare without ending . */
-		if(strncasecmp(p->str, name, len) == 0 &&
+		if(strncasecmp(p->str, name, len) == 0 && 
 			(strlen(p->str) == len || (strlen(p->str)==len+1 &&
 			p->str[len] == '.')))
 			return 1;
@@ -860,45 +842,6 @@ lz_nodefault(struct config_file* cfg, const char* name)
 	return 0;
 }
 
-/** enter reverse default zone */
-static int
-add_reverse_default(struct local_zones* zones, struct config_file* cfg,
-        const char* name)
-{
-	struct local_zone* z;
-	char str[1024]; /* known long enough */
-	if(lz_exists(zones, name) || lz_nodefault(cfg, name))
-		return 1; /* do not enter default content */
-	if(!(z=lz_enter_zone(zones, name, "static", LDNS_RR_CLASS_IN)))
-		return 0;
-	snprintf(str, sizeof(str), "%s 10800 IN SOA localhost. "
-		"nobody.invalid. 1 3600 1200 604800 10800", name);
-	if(!lz_enter_rr_into_zone(z, str)) {
-		lock_rw_unlock(&z->lock);
-		return 0;
-	}
-	snprintf(str, sizeof(str), "%s 10800 IN NS localhost. ", name);
-	if(!lz_enter_rr_into_zone(z, str)) {
-		lock_rw_unlock(&z->lock);
-		return 0;
-	}
-	if(strncasecmp("127.in-addr.arpa.", name, 17) ==  0) {
-		if(!lz_enter_rr_into_zone(z,
-			"1.0.0.127.in-addr.arpa. 10800 IN PTR localhost.")) {
-			lock_rw_unlock(&z->lock);
-			return 0;
-		}
-	} else if(strncasecmp("1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", name, 73) ==  0) {
-		snprintf(str, sizeof(str), "%s 10800 IN PTR localhost.", name);
-		if(!lz_enter_rr_into_zone(z, str)) {
-			lock_rw_unlock(&z->lock);
-			return 0;
-		}
-	}
-	lock_rw_unlock(&z->lock);
-	return 1;
-}
-
 /** enter (AS112) empty default zone */
 static int
 add_empty_default(struct local_zones* zones, struct config_file* cfg,
@@ -959,23 +902,72 @@ int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg
 		}
 		lock_rw_unlock(&z->lock);
 	}
-
-	/* ip4 and ip6 reverse */
-	for(zstr = local_zones_default_reverse; *zstr; zstr++) {
-		if(!add_reverse_default(zones, cfg, *zstr)) {
+	/* reverse ip4 zone */
+	if(!lz_exists(zones, "127.in-addr.arpa.") &&
+		!lz_nodefault(cfg, "127.in-addr.arpa.")) {
+		if(!(z=lz_enter_zone(zones, "127.in-addr.arpa.", "static", 
+			LDNS_RR_CLASS_IN)) ||
+		   !lz_enter_rr_into_zone(z,
+			"127.in-addr.arpa. 10800 IN NS localhost.") ||
+		   !lz_enter_rr_into_zone(z,
+			"127.in-addr.arpa. 10800 IN SOA localhost. "
+			"nobody.invalid. 1 3600 1200 604800 10800") ||
+		   !lz_enter_rr_into_zone(z,
+			"1.0.0.127.in-addr.arpa. 10800 IN PTR localhost.")) {
 			log_err("out of memory adding default zone");
+			if(z) { lock_rw_unlock(&z->lock); }
 			return 0;
 		}
+		lock_rw_unlock(&z->lock);
 	}
-
-	/* special-use zones */
-	for(zstr = local_zones_default_special; *zstr; zstr++) {
-		if(!add_empty_default(zones, cfg, *zstr)) {
+	/* reverse ip6 zone */
+	if(!lz_exists(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.") &&
+		!lz_nodefault(cfg, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.")) {
+		if(!(z=lz_enter_zone(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", "static", 
+			LDNS_RR_CLASS_IN)) ||
+		   !lz_enter_rr_into_zone(z,
+			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost.") ||
+		   !lz_enter_rr_into_zone(z,
+			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN SOA localhost. "
+			"nobody.invalid. 1 3600 1200 604800 10800") ||
+		   !lz_enter_rr_into_zone(z,
+			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN PTR localhost.")) {
 			log_err("out of memory adding default zone");
+			if(z) { lock_rw_unlock(&z->lock); }
 			return 0;
 		}
+		lock_rw_unlock(&z->lock);
+	}
+	/* home.arpa. zone (RFC 8375) */
+	if(!add_empty_default(zones, cfg, "home.arpa.")) {
+		log_err("out of memory adding default zone");
+		return 0;
+	}
+	/* resolver.arpa. zone (RFC 9462) */
+	if(!add_empty_default(zones, cfg, "resolver.arpa.")) {
+		log_err("out of memory adding default zone");
+		return 0;
+	}
+	/* service.arpa. zone (draft-ietf-dnssd-srp-25) */
+	if(!add_empty_default(zones, cfg, "service.arpa.")) {
+		log_err("out of memory adding default zone");
+		return 0;
+	}
+	/* onion. zone (RFC 7686) */
+	if(!add_empty_default(zones, cfg, "onion.")) {
+		log_err("out of memory adding default zone");
+		return 0;
+	}
+	/* test. zone (RFC 6761) */
+	if(!add_empty_default(zones, cfg, "test.")) {
+		log_err("out of memory adding default zone");
+		return 0;
+	}
+	/* invalid. zone (RFC 6761) */
+	if(!add_empty_default(zones, cfg, "invalid.")) {
+		log_err("out of memory adding default zone");
+		return 0;
 	}
-
 	/* block AS112 zones, unless asked not to */
 	if(!cfg->unblock_lan_zones) {
 		for(zstr = as112_zones; *zstr; zstr++) {
@@ -1070,15 +1062,14 @@ lz_setup_implicit(struct local_zones* zones, struct config_file* cfg)
 		labs = dname_count_size_labels(rr_name, &len);
 		lock_rw_rdlock(&zones->lock);
 		if(!local_zones_lookup(zones, rr_name, len, labs, rr_class,
-			rr_type, 1)) {
+			rr_type)) {
 			/* Check if there is a zone that this could go
 			 * under but for different class; created zones are
 			 * always for LDNS_RR_CLASS_IN. Create the zone with
 			 * a different class but the same configured
 			 * local_zone_type. */
 			struct local_zone* z = local_zones_lookup(zones,
-				rr_name, len, labs, LDNS_RR_CLASS_IN, rr_type,
-				1);
+				rr_name, len, labs, LDNS_RR_CLASS_IN, rr_type);
 			if(z) {
 				uint8_t* name = memdup(z->name, z->namelen);
 				size_t znamelen = z->namelen;
@@ -1240,48 +1231,28 @@ local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg)
 
 struct local_zone* 
 local_zones_lookup(struct local_zones* zones,
-        uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
-	int foradd)
+        uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype)
 {
 	return local_zones_tags_lookup(zones, name, len, labs,
-		dclass, dtype, NULL, 0, 1, foradd);
+		dclass, dtype, NULL, 0, 1);
 }
 
 struct local_zone* 
 local_zones_tags_lookup(struct local_zones* zones,
         uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
-	uint8_t* taglist, size_t taglen, int ignoretags, int foradd)
+	uint8_t* taglist, size_t taglen, int ignoretags)
 {
 	rbnode_type* res = NULL;
 	struct local_zone *result;
 	struct local_zone key;
 	int m;
-	key.node.key = &key;
-	key.dclass = dclass;
 	/* for type DS use a zone higher when on a zonecut */
 	if(dtype == LDNS_RR_TYPE_DS && !dname_is_root(name)) {
-		/* If this is at a zone cut, of a local-zone, and it is
-		 * of type always_refuse. Then also refuse the type DS
-		 * for it. That could make it DNSSEC bogus, but it is
-		 * REFUSED anyway. It stops CNAME type answers in the
-		 * type DS lookup. */
-		key.name = name;
-		key.namelen = len;
-		key.namelabs = labs;
-		/* For additions and removals, use the ordinary rule,
-		 * to remove a label for type DS to locate the parent zone.
-		 * That is where the DS RR needs to be put. */
-		if(!foradd &&
-			(result=(struct local_zone*)rbtree_search(
-			&zones->ztree, &key)) != NULL &&
-			result->type == local_zone_always_refuse) {
-			/* The type DS does not go up one label. */
-			return result;
-		} else {
-			dname_remove_label(&name, &len);
-			labs--;
-		}
+		dname_remove_label(&name, &len);
+		labs--;
 	}
+	key.node.key = &key;
+	key.dclass = dclass;
 	key.name = name;
 	key.namelen = len;
 	key.namelabs = labs;
@@ -1892,7 +1863,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 		if(view->local_zones &&
 			(z = local_zones_lookup(view->local_zones,
 			qinfo->qname, qinfo->qname_len, labs,
-			qinfo->qclass, qinfo->qtype, 0))) {
+			qinfo->qclass, qinfo->qtype))) {
 			lock_rw_rdlock(&z->lock);
 			lzt = z->type;
 		}
@@ -1926,7 +1897,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 		lock_rw_rdlock(&zones->lock);
 		if(!(z = local_zones_tags_lookup(zones, qinfo->qname,
 			qinfo->qname_len, labs, qinfo->qclass, qinfo->qtype,
-			taglist, taglen, 0, 0))) {
+			taglist, taglen, 0))) {
 			lock_rw_unlock(&zones->lock);
 			return 0;
 		}
@@ -2131,8 +2102,7 @@ local_zones_add_RR(struct local_zones* zones, const char* rr)
 	/* could first try readlock then get writelock if zone does not exist,
 	 * but we do not add enough RRs (from multiple threads) to optimize */
 	lock_rw_wrlock(&zones->lock);
-	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type,
-		1);
+	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
 	if(!z) {
 		z = local_zones_add_zone(zones, rr_name, len, labs, rr_class,
 			local_zone_transparent);
@@ -2210,8 +2180,7 @@ void local_zones_del_data(struct local_zones* zones,
 
 	/* remove DS */
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, name, len, labs, dclass, LDNS_RR_TYPE_DS,
-		1);
+	z = local_zones_lookup(zones, name, len, labs, dclass, LDNS_RR_TYPE_DS);
 	if(z) {
 		lock_rw_wrlock(&z->lock);
 		d = local_zone_find_data(z, name, len, labs);
@@ -2225,7 +2194,7 @@ void local_zones_del_data(struct local_zones* zones,
 
 	/* remove other types */
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, name, len, labs, dclass, 0, 1);
+	z = local_zones_lookup(zones, name, len, labs, dclass, 0);
 	if(!z) {
 		/* no such zone, we're done */
 		lock_rw_unlock(&zones->lock);

services/localzone.h

@@ -57,9 +57,6 @@ struct sldns_buffer;
 struct comm_reply;
 struct config_strlist;
 
-extern const char** local_zones_default_special;
-extern const char** local_zones_default_reverse;
-
 /**
  * Local zone type
  * This type determines processing for queries that did not match
@@ -265,13 +262,11 @@ void local_zone_delete(struct local_zone* z);
  * @param taglen: length of taglist.
  * @param ignoretags: lookup zone by name and class, regardless the
  * local-zone's tags.
- * @param foradd: if the lookup is for addition or removal of the type.
- *	Used for type DS. The lookup for answers turns this off.
  * @return closest local_zone or NULL if no covering zone is found.
  */
 struct local_zone* local_zones_tags_lookup(struct local_zones* zones, 
 	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
-	uint8_t* taglist, size_t taglen, int ignoretags, int foradd);
+	uint8_t* taglist, size_t taglen, int ignoretags);
 
 /**
  * Lookup zone that contains the given name, class.
@@ -283,13 +278,10 @@ struct local_zone* local_zones_tags_lookup(struct local_zones* zones,
  * @param dclass: class to lookup.
  * @param dtype: type of the record, if type DS then a zone higher up is found
  *   pass 0 to just plain find a zone for a name.
- * @param foradd: if the lookup is for addition or removal of the type.
- *	Used for type DS. The lookup for answers turns this off.
  * @return closest local_zone or NULL if no covering zone is found.
  */
 struct local_zone* local_zones_lookup(struct local_zones* zones, 
-	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
-	int foradd);
+	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype);
 
 /**
  * Debug helper. Print all zones 
@@ -573,7 +565,7 @@ enum respip_action {
 	respip_always_nxdomain = local_zone_always_nxdomain,
         /** answer with nodata response */
 	respip_always_nodata = local_zone_always_nodata,
-        /** drop query */
+        /** answer with nodata response */
 	respip_always_deny = local_zone_always_deny,
 	/** RPZ: truncate answer in order to force switch to tcp */
 	respip_truncate = local_zone_truncate,

services/mesh.c

@@ -297,14 +297,12 @@ int mesh_make_new_space(struct mesh_area* mesh, sldns_buffer* qbuf)
 	if(mesh->num_reply_states < mesh->max_reply_states)
 		return 1;
 	/* try to kick out a jostle-list item */
-	if(m && m->list_select == mesh_jostle_list) {
+	if(m && m->reply_list && m->list_select == mesh_jostle_list) {
 		/* how old is it? */
 		struct timeval age;
-		if(m->has_first_reply_time)
-			timeval_subtract(&age, mesh->env->now_tv,
-				&m->first_reply_time);
-		if(!m->has_first_reply_time ||
-			timeval_smaller(&mesh->jostle_max, &age)) {
+		timeval_subtract(&age, mesh->env->now_tv,
+			&m->reply_list->start_time);
+		if(timeval_smaller(&mesh->jostle_max, &age)) {
 			/* its a goner */
 			log_nametypeclass(VERB_ALGO, "query jostled out to "
 				"make space for a new one",
@@ -467,8 +465,6 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 				"incoming query.");
 			if(rep->c->use_h2)
 				http2_stream_remove_mesh_state(rep->c->h2_stream);
-			else if(rep->c->type == comm_doq && rep->doq_stream)
-				doq_stream_remove_mesh_state(rep->doq_stream);
 			comm_point_drop_reply(rep);
 			mesh->stats_dropped++;
 			return;
@@ -482,8 +478,6 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 				"dropping incoming query.");
 			if(rep->c->use_h2)
 				http2_stream_remove_mesh_state(rep->c->h2_stream);
-			else if(rep->c->type == comm_doq && rep->doq_stream)
-				doq_stream_remove_mesh_state(rep->doq_stream);
 			comm_point_drop_reply(rep);
 			mesh->num_queries_replyaddr_limit++;
 			return;
@@ -556,8 +550,6 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	}
 	if(rep->c->use_h2) {
 		http2_stream_add_meshstate(rep->c->h2_stream, mesh, s);
-	} else if(rep->c->type == comm_doq && rep->doq_stream) {
-		doq_stream_add_meshstate(rep->doq_stream, mesh, s);
 	}
 	/* add serve expired timer if required and not already there */
 	if(timeout && !mesh_serve_expired_init(s, timeout)) {
@@ -611,8 +603,6 @@ servfail_mem:
 		qinfo, qid, qflags, edns);
 	if(rep->c->use_h2)
 		http2_stream_remove_mesh_state(rep->c->h2_stream);
-	else if(rep->c->type == comm_doq && rep->doq_stream)
-		doq_stream_remove_mesh_state(rep->doq_stream);
 	comm_point_send_reply(rep);
 	if(added)
 		mesh_state_delete(&s->s);
@@ -933,7 +923,8 @@ cfg_region_strlist_copy(struct regional* region, struct config_strlist* list)
 	return result;
 }
 
-struct respip_client_info*
+/** Copy the client info to the query region. */
+static struct respip_client_info*
 mesh_copy_client_info(struct regional* region, struct respip_client_info* cinfo)
 {
 	size_t i;
@@ -978,11 +969,6 @@ mesh_copy_client_info(struct regional* region, struct respip_client_info* cinfo)
 			cinfo->view->name);
 		if(!client_info->view_name)
 			return NULL;
-	} else if(cinfo->view_name) {
-		client_info->view_name = regional_strdup(region,
-			cinfo->view_name);
-		if(!client_info->view_name)
-			return NULL;
 	}
 	return client_info;
 }
@@ -1050,7 +1036,6 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
 	mstate->s.no_cache_store = 0;
 	mstate->s.need_refetch = 0;
 	mstate->s.was_ratelimited = 0;
-	mstate->s.error_response_cache = 0;
 	mstate->s.qstarttime = *env->now;
 
 	/* init modules */
@@ -1090,14 +1075,6 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	if(!mstate->replies_sent) {
 		struct mesh_reply* rep = mstate->reply_list;
 		struct mesh_cb* cb;
-		/* One http2 stream could bring down its comm_point along with
-		 * the other streams which could share the same query. Do all
-		 * the http2 stream bookkeeping upfront. */
-		for(; rep; rep=rep->next) {
-			if(rep->query_reply.c->use_h2)
-				http2_stream_remove_mesh_state(rep->h2_stream);
-		}
-		rep = mstate->reply_list;
 		/* in tcp_req_info, the mstates linked are removed, but
 		 * the reply_list is now NULL, so the remove-from-empty-list
 		 * takes no time and also it does not do the mesh accounting */
@@ -1105,6 +1082,8 @@ mesh_state_cleanup(struct mesh_state* mstate)
 		for(; rep; rep=rep->next) {
 			infra_wait_limit_dec(mesh->env->infra_cache,
 				&rep->query_reply, mesh->env->cfg);
+			if(rep->query_reply.c->use_h2)
+				http2_stream_remove_mesh_state(rep->h2_stream);
 			comm_point_drop_reply(&rep->query_reply);
 			log_assert(mesh->num_reply_addrs > 0);
 			mesh->num_reply_addrs--;
@@ -1496,10 +1475,6 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		 * for HTTP/2 stream to refer to mesh state, in case
 		 * connection gets cleanup before HTTP/2 stream close. */
 		r->h2_stream->mesh_state = NULL;
-#ifdef HAVE_NGTCP2
-	} else if(r->query_reply.doq_stream) {
-		r->query_reply.doq_stream->mesh_state = NULL;
-#endif
 	}
 	/* send the reply */
 	/* We don't reuse the encoded answer if:
@@ -1654,9 +1629,9 @@ static void dns_error_reporting(struct module_qstate* qstate,
 	opt = edns_opt_list_find(qstate->edns_opts_back_in,
 		LDNS_EDNS_REPORT_CHANNEL);
 	if(!opt) return;
+	agent_domain_len = opt->opt_len;
 	agent_domain = opt->opt_data;
-	agent_domain_len = dname_valid(agent_domain, opt->opt_len);
-	if(agent_domain_len < 3) {
+	if(dname_valid(agent_domain, agent_domain_len) < 3) {
 		/* The agent domain needs to be a valid dname that is not the
 		 * root; from RFC9567. */
 		return;
@@ -1793,8 +1768,6 @@ void mesh_query_done(struct mesh_state* mstate)
 				mstate->reply_list = NULL;
 				if(r->query_reply.c->use_h2)
 					http2_stream_remove_mesh_state(r->h2_stream);
-				else if(r->query_reply.doq_stream)
-					doq_stream_remove_mesh_state(r->query_reply.doq_stream);
 				comm_point_drop_reply(&r->query_reply);
 				mstate->reply_list = reply_list;
 				log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
@@ -1832,8 +1805,6 @@ void mesh_query_done(struct mesh_state* mstate)
 			mstate->reply_list = NULL;
 			if(r->query_reply.c->use_h2) {
 				http2_stream_remove_mesh_state(r->h2_stream);
-			} else if(r->query_reply.doq_stream) {
-				doq_stream_remove_mesh_state(r->query_reply.doq_stream);
 			}
 			comm_point_drop_reply(&r->query_reply);
 			mstate->reply_list = reply_list;
@@ -2017,10 +1988,6 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
 	r->qid = qid;
 	r->qflags = qflags;
 	r->start_time = *s->s.env->now_tv;
-	if(s->reply_list == NULL && !s->has_first_reply_time) {
-		s->first_reply_time = r->start_time;
-		s->has_first_reply_time = 1;
-	}
 	r->next = s->reply_list;
 	r->qname = regional_alloc_init(s->s.region, qinfo->qname,
 		s->s.qinfo.qname_len);
@@ -2029,8 +1996,6 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
 	if(rep->c->use_h2)
 		r->h2_stream = rep->c->h2_stream;
 	else	r->h2_stream = NULL;
-	if(rep->c->type != comm_doq)
-		r->query_reply.doq_stream = NULL;
 
 	/* Data related to local alias stored in 'qinfo' (if any) is ephemeral
 	 * and can be different for different original queries (even if the
@@ -2388,7 +2353,7 @@ void mesh_list_remove(struct mesh_state* m, struct mesh_state** fp,
 }
 
 void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
-	struct comm_point* cp, struct doq_stream* doq_stream)
+	struct comm_point* cp)
 {
 	struct mesh_reply* n, *prev = NULL;
 	n = m->reply_list;
@@ -2396,8 +2361,7 @@ void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
 	 * there is no accounting twice */
 	if(!n) return; /* nothing to remove, also no accounting needed */
 	while(n) {
-		if(n->query_reply.c == cp
-			&& (!doq_stream || n->query_reply.doq_stream == doq_stream)) {
+		if(n->query_reply.c == cp) {
 			/* unlink it */
 			if(prev) prev->next = n->next;
 			else m->reply_list = n->next;
@@ -2406,14 +2370,6 @@ void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
 			mesh->num_reply_addrs--;
 			infra_wait_limit_dec(mesh->env->infra_cache,
 				&n->query_reply, mesh->env->cfg);
-			/* We may be removing more than one http2 stream (they
-			 * share the same comm_point); make sure the streams
-			 * don't point back. */
-			if(n->h2_stream) n->h2_stream->mesh_state = NULL;
-#ifdef HAVE_NGTCP2
-			if(n->query_reply.doq_stream)
-				n->query_reply.doq_stream->mesh_state = NULL;
-#endif
 
 			/* prev = prev; */
 			n = n->next;
@@ -2454,10 +2410,9 @@ apply_respip_action(struct module_qstate* qstate,
 
 	/* xxx_deny actions mean dropping the reply, unless the original reply
 	 * was redirected to response-ip data. */
-	if(actinfo->action == respip_always_deny ||
-		((actinfo->action == respip_deny ||
+	if((actinfo->action == respip_deny ||
 		actinfo->action == respip_inform_deny) &&
-		*encode_repp == rep))
+		*encode_repp == rep)
 		*encode_repp = NULL;
 
 	return 1;
@@ -2522,15 +2477,12 @@ mesh_serve_expired_callback(void* arg)
 			qstate->client_info, &actinfo, msg->rep, &alias_rrset, &encode_rep,
 			qstate->env->auth_zones)) {
 			return;
-		} else if(partial_rep) {
-			if(!respip_merge_cname(partial_rep, &qstate->qinfo, msg->rep,
+		} else if(partial_rep &&
+			!respip_merge_cname(partial_rep, &qstate->qinfo, msg->rep,
 			qstate->client_info, must_validate, &encode_rep, qstate->region,
 			qstate->env->auth_zones, qstate->env->views,
 			qstate->env->respip_set)) {
-				return;
-			}
-			/* merge succeeded; final reply, no further alias pass */
-			partial_rep = NULL;
+			return;
 		}
 		if(!encode_rep || alias_rrset) {
 			if(!encode_rep) {
@@ -2541,7 +2493,6 @@ mesh_serve_expired_callback(void* arg)
 				partial_rep = encode_rep;
 			}
 		}
-		msg->rep = encode_rep;
 		/* We've found a partial reply ending with an
 		* alias.  Replace the lookup qinfo for the
 		* alias target and lookup the cache again to
@@ -2568,10 +2519,9 @@ mesh_serve_expired_callback(void* arg)
 		log_dns_msg("Serve expired lookup", &qstate->qinfo, msg->rep);
 
 	for(r = mstate->reply_list; r; r = r->next) {
-		if(mesh_is_udp(r)) {
-		    struct timeval old;
-		    timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
-		    if(mstate->s.env->cfg->discard_timeout != 0 &&
+		struct timeval old;
+		timeval_subtract(&old, mstate->s.env->now_tv, &r->start_time);
+		if(mstate->s.env->cfg->discard_timeout != 0 &&
 			((int)old.tv_sec)*1000+((int)old.tv_usec)/1000 >
 			mstate->s.env->cfg->discard_timeout) {
 			/* Drop the reply, it is too old */
@@ -2587,15 +2537,10 @@ mesh_serve_expired_callback(void* arg)
 			mstate->reply_list = NULL;
 			if(r->query_reply.c->use_h2)
 				http2_stream_remove_mesh_state(r->h2_stream);
-			else if(r->query_reply.doq_stream)
-				doq_stream_remove_mesh_state(r->query_reply.doq_stream);
 			comm_point_drop_reply(&r->query_reply);
 			mstate->reply_list = reply_list;
-			log_assert(mstate->s.env->mesh->num_reply_addrs > 0);
-			mstate->s.env->mesh->num_reply_addrs--;
 			mstate->s.env->mesh->num_queries_discard_timeout++;
 			continue;
-		    }
 		}
 
 		i++;

services/mesh.h

@@ -191,12 +191,6 @@ struct mesh_state {
 	struct module_qstate s;
 	/** the list of replies to clients for the results */
 	struct mesh_reply* reply_list;
-	/** if it has a first reply time */
-	int has_first_reply_time;
-	/** wall-clock time the first client reply was attached;
-	 *  used by mesh_make_new_space() so duplicate retransmits
-	 *  cannot reset jostle aging. */
-	struct timeval first_reply_time;
 	/** the list of callbacks for the results */
 	struct mesh_cb* cb_list;
 	/** set of superstates (that want this state's result) 
@@ -683,11 +677,9 @@ void mesh_list_remove(struct mesh_state* m, struct mesh_state** fp,
  * @param mesh: to update the counters.
  * @param m: the mesh state.
  * @param cp: the comm_point to remove from the list.
- * @param doq_stream: if not NULL, it specifies the doq_stream to match
- *	for the delete.
  */
 void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
-	struct comm_point* cp, struct doq_stream* doq_stream);
+	struct comm_point* cp);
 
 /** Callback for when the serve expired client timer has run out.  Tries to
  * find an expired answer in the cache and reply that to the client.
@@ -738,8 +730,4 @@ void mesh_respond_serve_expired(struct mesh_state* mstate);
 void mesh_remove_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	uint16_t qflags, mesh_cb_func_type cb, void* cb_arg);
 
-/** Copy the client info to the query region. */
-struct respip_client_info* mesh_copy_client_info(struct regional* region,
-	struct respip_client_info* cinfo);
-
 #endif /* SERVICES_MESH_H */

services/outside_network.c

@@ -160,19 +160,6 @@ reuse_cmp_addrportssl(const void* key1, const void* key2)
 		return 1;
 	if(!r1->is_ssl && r2->is_ssl)
 		return -1;
-
-	/* compare tls_auth_name if SSL-enabled */
-	if(r1->is_ssl) {
-		if(r1->tls_auth_name && !r2->tls_auth_name)
-			return 1;
-		if(!r1->tls_auth_name && r2->tls_auth_name)
-			return -1;
-		if(r1->tls_auth_name && r2->tls_auth_name) {
-			r = strcmp(r1->tls_auth_name, r2->tls_auth_name);
-			if(r != 0)
-				return r;
-		}
-	}
 	return 0;
 }
 
@@ -208,7 +195,6 @@ static void
 waiting_tcp_delete(struct waiting_tcp* w)
 {
 	if(!w) return;
-	free(w->tls_auth_name);
 	if(w->timer)
 		comm_timer_delete(w->timer);
 	free(w);
@@ -545,7 +531,7 @@ reuse_tcp_insert(struct outside_network* outnet, struct pending_tcp* pend_tcp)
 /** find reuse tcp stream to destination for query, or NULL if none */
 static struct reuse_tcp*
 reuse_tcp_find(struct outside_network* outnet, struct sockaddr_storage* addr,
-	socklen_t addrlen, int use_ssl, char* tls_auth_name)
+	socklen_t addrlen, int use_ssl)
 {
 	struct waiting_tcp key_w;
 	struct pending_tcp key_p;
@@ -559,10 +545,8 @@ reuse_tcp_find(struct outside_network* outnet, struct sockaddr_storage* addr,
 	key_p.c = &c;
 	key_p.reuse.pending = &key_p;
 	key_p.reuse.node.key = &key_p.reuse;
-	if(use_ssl) {
+	if(use_ssl)
 		key_p.reuse.is_ssl = 1;
-		key_p.reuse.tls_auth_name = tls_auth_name;
-	}
 	if(addrlen > (socklen_t)sizeof(key_p.reuse.addr))
 		return NULL;
 	memmove(&key_p.reuse.addr, addr, addrlen);
@@ -662,7 +646,6 @@ static int
 outnet_tcp_take_into_use(struct waiting_tcp* w)
 {
 	struct pending_tcp* pend = w->outnet->tcp_free;
-	char* tls_auth_name = NULL;
 	int s;
 	log_assert(pend);
 	log_assert(w->pkt);
@@ -763,22 +746,7 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
 		comm_point_tcp_win_bio_cb(pend->c, pend->c->ssl);
 #endif
 		pend->c->ssl_shake_state = comm_ssl_shake_write;
-		if(w->tls_auth_name) {
-			/* strdup the auth name, while not linked the list yet,
-			 * in case of failure, easy cleanup. */
-			tls_auth_name = strdup(w->tls_auth_name);
-			if(!tls_auth_name) {
-				log_err("out of memory: alloc tls auth name");
-				pend->c->fd = s;
-#ifdef HAVE_SSL
-				SSL_free(pend->c->ssl);
-#endif
-				pend->c->ssl = NULL;
-				comm_point_close(pend->c);
-				return 0;
-			}
-		}
-		if(!set_auth_name_on_ssl(pend->c->ssl, tls_auth_name,
+		if(!set_auth_name_on_ssl(pend->c->ssl, w->tls_auth_name,
 			w->outnet->tls_use_sni)) {
 			pend->c->fd = s;
 #ifdef HAVE_SSL
@@ -786,7 +754,6 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
 #endif
 			pend->c->ssl = NULL;
 			comm_point_close(pend->c);
-			free(tls_auth_name);
 			return 0;
 		}
 	}
@@ -811,20 +778,9 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
 	if(pend->reuse.node.key)
 		reuse_tcp_remove_tree_list(w->outnet, &pend->reuse);
 
-	if(pend->c->ssl) {
+	if(pend->c->ssl)
 		pend->reuse.is_ssl = 1;
-		if(pend->reuse.tls_auth_name)
-			free(pend->reuse.tls_auth_name);
-		pend->reuse.tls_auth_name = tls_auth_name;
-		tls_auth_name = NULL;
-	} else {
-		pend->reuse.is_ssl = 0;
-		if(pend->reuse.tls_auth_name)
-			free(pend->reuse.tls_auth_name);
-		pend->reuse.tls_auth_name = NULL;
-	}
-	/* free tls auth name if nonNULL */
-	free(tls_auth_name);
+	else	pend->reuse.is_ssl = 0;
 	/* insert in reuse by address tree if not already inserted there */
 	(void)reuse_tcp_insert(w->outnet, pend);
 	reuse_tree_by_id_insert(&pend->reuse, w);
@@ -1013,7 +969,7 @@ use_free_buffer(struct outside_network* outnet)
 			(!outnet->tcp_reuse_first && !outnet->tcp_reuse_last) ||
 			(outnet->tcp_reuse_first && outnet->tcp_reuse_last));
 		reuse = reuse_tcp_find(outnet, &w->addr, w->addrlen,
-			w->ssl_upstream, w->tls_auth_name);
+			w->ssl_upstream);
 		/* re-select an ID when moving to a new TCP buffer */
 		w->id = tcp_select_id(outnet, reuse);
 		LDNS_ID_SET(w->pkt, w->id);
@@ -1242,10 +1198,6 @@ decommission_pending_tcp(struct outside_network* outnet,
 		/* needs unlink from the reuse tree to get deleted */
 		reuse_tcp_remove_tree_list(outnet, &pend->reuse);
 	}
-	if(pend->reuse.tls_auth_name) {
-		free(pend->reuse.tls_auth_name);
-		pend->reuse.tls_auth_name = NULL;
-	}
 	/* free SSL structure after remove from outnet tcp reuse tree,
 	 * because the c->ssl null or not is used for sorting in the tree */
 	if(pend->c->ssl) {
@@ -1481,7 +1433,7 @@ portcomm_loweruse(struct outside_network* outnet, struct port_comm* pc)
 	pif = pc->pif;
 	log_assert(pif->inuse > 0);
 #ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-	shared_ports_return_port(outnet->shared_ports, pif->shpif, pc->number);
+	pif->avail_ports[pif->avail_total - pif->inuse] = pc->number;
 #endif
 	pif->inuse--;
 	pif->out[pc->index] = pif->out[pif->inuse];
@@ -1695,19 +1647,19 @@ create_pending_tcp(struct outside_network* outnet, size_t bufsize)
 }
 
 /** setup an outgoing interface, ready address */
-static int setup_if(struct port_if* pif, const char* addrstr, size_t numfd,
-	struct shared_ports* shp)
+static int setup_if(struct port_if* pif, const char* addrstr, 
+	int* avail, int numavail, size_t numfd)
 {
+#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
+	pif->avail_total = numavail;
+	pif->avail_ports = (int*)memdup(avail, (size_t)numavail*sizeof(int));
+	if(!pif->avail_ports)
+		return 0;
+#endif
 	if(!ipstrtoaddr(addrstr, UNBOUND_DNS_PORT, &pif->addr, &pif->addrlen) &&
 	   !netblockstrtoaddr(addrstr, UNBOUND_DNS_PORT,
 			      &pif->addr, &pif->addrlen, &pif->pfxlen))
 		return 0;
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-	pif->shpif = shared_ports_find_if(shp, &pif->addr, pif->addrlen,
-		pif->pfxlen);
-#else
-	(void)shp;
-#endif
 	pif->maxout = (int)numfd;
 	pif->inuse = 0;
 	pif->out = (struct port_comm**)calloc(numfd, 
@@ -1721,12 +1673,12 @@ struct outside_network*
 outside_network_create(struct comm_base *base, size_t bufsize, 
 	size_t num_ports, char** ifs, int num_ifs, int do_ip4, 
 	int do_ip6, size_t num_tcp, int dscp, struct infra_cache* infra,
-	struct ub_randstate* rnd, int use_caps_for_id,
-	size_t unwanted_threshold, int tcp_mss,
+	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
+	int numavailports, size_t unwanted_threshold, int tcp_mss,
 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
 	void* sslctx, int delayclose, int tls_use_sni, struct dt_env* dtenv,
 	int udp_connect, int max_reuse_tcp_queries, int tcp_reuse_timeout,
-	int tcp_auth_query_timeout, struct shared_ports* shared_ports)
+	int tcp_auth_query_timeout)
 {
 	struct outside_network* outnet = (struct outside_network*)
 		calloc(1, sizeof(struct outside_network));
@@ -1761,7 +1713,6 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	outnet->do_udp = do_udp;
 	outnet->tcp_mss = tcp_mss;
 	outnet->ip_dscp = dscp;
-	outnet->shared_ports = shared_ports;
 #ifndef S_SPLINT_S
 	if(delayclose) {
 		outnet->delayclose = 1;
@@ -1772,7 +1723,7 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	if(udp_connect) {
 		outnet->udp_connect = 1;
 	}
-	if(num_ports == 0) {
+	if(numavailports == 0 || num_ports == 0) {
 		log_err("no outgoing ports available");
 		outside_network_delete(outnet);
 		return NULL;
@@ -1833,13 +1784,13 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	/* allocate interfaces */
 	if(num_ifs == 0) {
 		if(do_ip4 && !setup_if(&outnet->ip4_ifs[0], "0.0.0.0", 
-			num_ports, outnet->shared_ports)) {
+			availports, numavailports, num_ports)) {
 			log_err("malloc failed");
 			outside_network_delete(outnet);
 			return NULL;
 		}
 		if(do_ip6 && !setup_if(&outnet->ip6_ifs[0], "::", 
-			num_ports, outnet->shared_ports)) {
+			availports, numavailports, num_ports)) {
 			log_err("malloc failed");
 			outside_network_delete(outnet);
 			return NULL;
@@ -1850,7 +1801,7 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 		for(i=0; i<num_ifs; i++) {
 			if(str_is_ip6(ifs[i]) && do_ip6) {
 				if(!setup_if(&outnet->ip6_ifs[done_6], ifs[i],
-					num_ports, outnet->shared_ports)){
+					availports, numavailports, num_ports)){
 					log_err("malloc failed");
 					outside_network_delete(outnet);
 					return NULL;
@@ -1859,7 +1810,7 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 			}
 			if(!str_is_ip6(ifs[i]) && do_ip4) {
 				if(!setup_if(&outnet->ip4_ifs[done_4], ifs[i],
-					num_ports, outnet->shared_ports)){
+					availports, numavailports, num_ports)){
 					log_err("malloc failed");
 					outside_network_delete(outnet);
 					return NULL;
@@ -1937,6 +1888,9 @@ outside_network_delete(struct outside_network* outnet)
 				comm_point_delete(pc->cp);
 				free(pc);
 			}
+#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
+			free(outnet->ip4_ifs[i].avail_ports);
+#endif
 			free(outnet->ip4_ifs[i].out);
 		}
 		free(outnet->ip4_ifs);
@@ -1950,6 +1904,9 @@ outside_network_delete(struct outside_network* outnet)
 				comm_point_delete(pc->cp);
 				free(pc);
 			}
+#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
+			free(outnet->ip6_ifs[i].avail_ports);
+#endif
 			free(outnet->ip6_ifs[i].out);
 		}
 		free(outnet->ip6_ifs);
@@ -1965,10 +1922,6 @@ outside_network_delete(struct outside_network* outnet)
 					 * the tcp conn is working on */
 					decommission_pending_tcp(outnet, pend);
 				}
-				if(pend->reuse.tls_auth_name) {
-					free(pend->reuse.tls_auth_name);
-					pend->reuse.tls_auth_name = NULL;
-				}
 				comm_point_delete(outnet->tcp_conns[i]->c);
 				free(outnet->tcp_conns[i]);
 				outnet->tcp_conns[i] = NULL;
@@ -2159,10 +2112,7 @@ static int
 select_ifport(struct outside_network* outnet, struct pending* pend,
 	int num_if, struct port_if* ifs)
 {
-	int my_if, fd, portno, inuse, tries=0;
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-	int reused;
-#endif
+	int my_if, my_port, fd, portno, inuse, tries=0;
 	struct port_if* pif;
 	/* randomly select interface and port */
 	if(num_if == 0) {
@@ -2176,35 +2126,37 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 		my_if = ub_random_max(outnet->rnd, num_if);
 		pif = &ifs[my_if];
 #ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-		if(!shared_ports_fetch_random(outnet->shared_ports,
-			pif->shpif, outnet->rnd, outnet->udp_connect,
-			pif->inuse, &portno, &reused)) {
-			tries++;
-			if(tries < MAX_PORT_RETRY)
-				continue;
-			log_err("failed to find an open port, drop msg");
-			return 0;
+		if(outnet->udp_connect) {
+			/* if we connect() we cannot reuse fds for a port */
+			if(pif->inuse >= pif->avail_total) {
+				tries++;
+				if(tries < MAX_PORT_RETRY)
+					continue;
+				log_err("failed to find an open port, drop msg");
+				return 0;
+			}
+			my_port = pif->inuse + ub_random_max(outnet->rnd,
+				pif->avail_total - pif->inuse);
+		} else  {
+			my_port = ub_random_max(outnet->rnd, pif->avail_total);
+			if(my_port < pif->inuse) {
+				/* port already open */
+				pend->pc = pif->out[my_port];
+				verbose(VERB_ALGO, "using UDP if=%d port=%d",
+					my_if, pend->pc->number);
+				break;
+			}
 		}
-		if(reused) {
-			/* port already open */
-			log_assert(portno < pif->inuse);
-			pend->pc = pif->out[portno];
-			verbose(VERB_ALGO, "using UDP if=%d port=%d",
-				my_if, pend->pc->number);
-			break;
-		}
-#else
-		portno = 0;
-#endif
 		/* try to open new port, if fails, loop to try again */
+		log_assert(pif->inuse < pif->maxout);
+		portno = pif->avail_ports[my_port - pif->inuse];
+#else
+		my_port = portno = 0;
+#endif
 		fd = udp_sockport(&pif->addr, pif->addrlen, pif->pfxlen,
 			portno, &inuse, outnet->rnd, outnet->ip_dscp);
 		if(fd == -1 && !inuse) {
 			/* nonrecoverable error making socket */
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-			shared_ports_return_port(outnet->shared_ports,
-				pif->shpif, portno);
-#endif
 			return 0;
 		}
 		if(fd != -1) {
@@ -2221,11 +2173,6 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 							pend->addrlen);
 					}
 					sock_close(fd);
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-					shared_ports_return_port(
-						outnet->shared_ports,
-						pif->shpif, portno);
-#endif
 					return 0;
 				}
 			}
@@ -2243,14 +2190,14 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 
 			/* grab port in interface */
 			pif->out[pif->inuse] = pend->pc;
+#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
+			pif->avail_ports[my_port - pif->inuse] =
+				pif->avail_ports[pif->avail_total-pif->inuse-1];
+#endif
 			pif->inuse++;
 			break;
 		}
 		/* failed, already in use */
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-		shared_ports_return_port(outnet->shared_ports, pif->shpif,
-			portno);
-#endif
 		verbose(VERB_QUERY, "port %d in use, trying another", portno);
 		tries++;
 		if(tries == MAX_PORT_RETRY) {
@@ -2500,7 +2447,7 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
 	/* find out if a reused stream to the target exists */
 	/* if so, take it into use */
 	reuse = reuse_tcp_find(sq->outnet, &sq->addr, sq->addrlen,
-		sq->ssl_upstream, sq->tls_auth_name);
+		sq->ssl_upstream);
 	if(reuse) {
 		log_reuse_tcp(VERB_CLIENT, "pending_tcp_query: found reuse", reuse);
 		log_assert(reuse->pending);
@@ -2542,16 +2489,7 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
 	w->cb = callback;
 	w->cb_arg = callback_arg;
 	w->ssl_upstream = sq->ssl_upstream;
-	if(sq->tls_auth_name) {
-		w->tls_auth_name = strdup(sq->tls_auth_name);
-		if(!w->tls_auth_name) {
-			comm_timer_delete(w->timer);
-			free(w);
-			return NULL;
-		}
-	} else {
-		w->tls_auth_name = NULL;
-	}
+	w->tls_auth_name = sq->tls_auth_name;
 	w->timeout = timeout;
 	w->id_node.key = NULL;
 	w->write_wait_prev = NULL;
@@ -3641,16 +3579,13 @@ fd_for_dest(struct outside_network* outnet, struct sockaddr_storage* to_addr,
 {
 	struct sockaddr_storage* addr;
 	socklen_t addrlen;
-	int i, try, dscp;
+	int i, try, pnum, dscp;
 	struct port_if* pif;
 
 	/* create fd */
 	dscp = outnet->ip_dscp;
 	for(try = 0; try<1000; try++) {
 		int port = 0;
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-		int reused = 0;
-#endif
 		int freebind = 0;
 		int noproto = 0;
 		int inuse = 0;
@@ -3679,18 +3614,16 @@ fd_for_dest(struct outside_network* outnet, struct sockaddr_storage* to_addr,
 		addr = &pif->addr;
 		addrlen = pif->addrlen;
 #ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-		if(!shared_ports_fetch_random(outnet->shared_ports,
-			pif->shpif, outnet->rnd, 0, pif->inuse,
-			&port, &reused)) {
-			/* try again, perhaps another interface. */
-			continue;
-		}
-		if(reused) {
-			log_assert(port < pif->inuse);
-			port = pif->out[port]->number;
+		pnum = ub_random_max(outnet->rnd, pif->avail_total);
+		if(pnum < pif->inuse) {
+			/* port already open */
+			port = pif->out[pnum]->number;
+		} else {
+			/* unused ports in start part of array */
+			port = pif->avail_ports[pnum - pif->inuse];
 		}
 #else
-		port = 0;
+		pnum = port = 0;
 #endif
 		if(addr_is_ip6(to_addr, to_addrlen)) {
 			struct sockaddr_in6 sa = *(struct sockaddr_in6*)addr;
@@ -3705,14 +3638,6 @@ fd_for_dest(struct outside_network* outnet, struct sockaddr_storage* to_addr,
 				(struct sockaddr*)addr, addrlen, 1, &inuse, &noproto,
 				0, 0, 0, NULL, 0, freebind, 0, dscp);
 		}
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-		if(!reused) {
-			/* Return the port to the pool, since the caller does
-			 * not keep track of it, also have done fd, and bind. */
-			shared_ports_return_port(outnet->shared_ports,
-				pif->shpif, port);
-		}
-#endif
 		if(fd != -1) {
 			return fd;
 		}
@@ -3943,7 +3868,11 @@ if_get_mem(struct port_if* pif)
 {
 	size_t s;
 	int i;
-	s = sizeof(*pif) + sizeof(struct port_comm*)*pif->maxout;
+	s = sizeof(*pif) +
+#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
+	    sizeof(int)*pif->avail_total +
+#endif
+		sizeof(struct port_comm*)*pif->maxout;
 	for(i=0; i<pif->inuse; i++)
 		s += sizeof(*pif->out[i]) + 
 			comm_point_get_mem(pif->out[i]->cp);
@@ -4031,237 +3960,3 @@ serviced_get_mem(struct serviced_query* sq)
 	return s;
 }
 
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-/** Setup shared port interface */
-static int shared_ports_setup_if(struct shared_ports_if* shpif, char* str,
-	int* availports, int numavailports)
-{
-	shpif->avail_ports = (int*)memdup(availports,
-		(size_t)numavailports*sizeof(int));
-	if(!shpif->avail_ports)
-		return 0;
-	shpif->avail_total = numavailports;
-	shpif->inuse = 0;
-	shpif->pfxlen = 0;
-	if(!ipstrtoaddr(str, UNBOUND_DNS_PORT, &shpif->addr, &shpif->addrlen) &&
-	   !netblockstrtoaddr(str, UNBOUND_DNS_PORT, &shpif->addr,
-	   &shpif->addrlen, &shpif->pfxlen))
-		return 0;
-	return 1;
-}
-#endif
-
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-/** Allocate shared ports interfaces */
-static int shared_ports_alloc_ifs(struct shared_ports* shp, char** ifs,
-	int num_ifs, int do_ip4, int do_ip6, int* availports,
-	int numavailports)
-{
-#ifndef INET6
-	do_ip6 = 0;
-#endif
-	calc_num46(ifs, num_ifs, do_ip4, do_ip6,
-		&shp->num_ip4, &shp->num_ip6);
-	if(shp->num_ip4 != 0) {
-		if(!(shp->ip4_ifs = (struct shared_ports_if*)calloc(
-			(size_t)shp->num_ip4,
-			sizeof(struct shared_ports_if))))
-			return 0;
-	}
-	if(shp->num_ip6 != 0) {
-		if(!(shp->ip6_ifs = (struct shared_ports_if*)calloc(
-			(size_t)shp->num_ip6,
-			sizeof(struct shared_ports_if))))
-			return 0;
-	}
-	if(num_ifs == 0) {
-		if(do_ip4 && !shared_ports_setup_if(&shp->ip4_ifs[0],
-			"0.0.0.0", availports, numavailports))
-			return 0;
-		if(do_ip6 && !shared_ports_setup_if(&shp->ip6_ifs[0],
-			"::", availports, numavailports))
-			return 0;
-	} else {
-		size_t done_4 = 0, done_6 = 0;
-		int i;
-		for(i=0; i<num_ifs; i++) {
-			if(str_is_ip6(ifs[i]) && do_ip6) {
-				if(!shared_ports_setup_if(&shp->ip6_ifs[done_6],
-					ifs[i], availports, numavailports))
-					return 0;
-				done_6++;
-			}
-			if(!str_is_ip6(ifs[i]) && do_ip4) {
-				if(!shared_ports_setup_if(&shp->ip4_ifs[done_4],
-					ifs[i], availports, numavailports))
-					return 0;
-				done_4++;
-			}
-		}
-	}
-	return 1;
-}
-#endif
-
-struct shared_ports* shared_ports_create(char** ifs, int num_ifs, int do_ip4,
-	int do_ip6, int* availports, int numavailports)
-{
-	struct shared_ports* shp = calloc(1, sizeof(*shp));
-	if(!shp) {
-		log_err("malloc failed");
-		return NULL;
-	}
-	lock_basic_init(&shp->lock);
-	lock_protect(&shp->lock, shp, sizeof(*shp));
-
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-	/* Allocate interfaces */
-	if(!shared_ports_alloc_ifs(shp, ifs, num_ifs, do_ip4, do_ip6,
-		availports, numavailports)) {
-		log_err("malloc failed");
-		shared_ports_delete(shp);
-		return NULL;
-	}
-#else
-	(void)ifs; (void)num_ifs; (void)do_ip4; (void)do_ip6;
-	(void)availports; (void)numavailports;
-#endif
-	return shp;
-}
-
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-/** Delete shared ports interface structure */
-static void shared_ports_if_delete(struct shared_ports_if* shpif)
-{
-	if(!shpif)
-		return;
-	free(shpif->avail_ports);
-}
-#endif
-
-void shared_ports_delete(struct shared_ports* shp)
-{
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-	int i;
-#endif
-	if(!shp)
-		return;
-	lock_basic_destroy(&shp->lock);
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-	for(i=0; i<shp->num_ip4; i++) {
-		shared_ports_if_delete(&shp->ip4_ifs[i]);
-	}
-	free(shp->ip4_ifs);
-	for(i=0; i<shp->num_ip6; i++) {
-		shared_ports_if_delete(&shp->ip6_ifs[i]);
-	}
-	free(shp->ip6_ifs);
-#endif
-	free(shp);
-}
-
-struct shared_ports_if* shared_ports_find_if(struct shared_ports* shp,
-	struct sockaddr_storage* addr, socklen_t addrlen, int pfxlen)
-{
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-	struct shared_ports_if* ret, *ifs = NULL;
-	int i, num_ifs = 0;
-	lock_basic_lock(&shp->lock);
-	if(addr_is_ip6(addr, addrlen)) {
-		ifs = shp->ip6_ifs;
-		num_ifs = shp->num_ip6;
-	} else {
-		ifs = shp->ip4_ifs;
-		num_ifs = shp->num_ip4;
-	}
-	for(i=0; i<num_ifs; i++) {
-		if(sockaddr_cmp(addr, addrlen, &ifs[i].addr,
-			ifs[i].addrlen) == 0
-			&& pfxlen == ifs[i].pfxlen) {
-			ret = &ifs[i];
-			lock_basic_unlock(&shp->lock);
-			return ret;
-		}
-	}
-	lock_basic_unlock(&shp->lock);
-	return NULL;
-#else
-	(void)shp; (void)addr; (void)addrlen; (void)pfxlen;
-	return NULL;
-#endif
-}
-
-int shared_ports_fetch_random(struct shared_ports* shp,
-	struct shared_ports_if* shpif, struct ub_randstate* rnd,
-	int udp_connect, int reusenum, int* port, int* reused)
-{
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-	int portno = 0, my_port = 0;
-	if(!shpif)
-		return 0;
-	lock_basic_lock(&shp->lock);
-	if(udp_connect) {
-		/* if we connect() we cannot reuse fds for a port. */
-		if(shpif->inuse >= shpif->avail_total) {
-			lock_basic_unlock(&shp->lock);
-			return 0;
-		}
-		my_port = ub_random_max(rnd,
-			shpif->avail_total - shpif->inuse);
-	} else {
-		/* select from free ports and open ports on this thread. */
-		if(shpif->inuse >= shpif->avail_total) {
-			lock_basic_unlock(&shp->lock);
-			if(reusenum == 0) {
-				return 0;
-			}
-			my_port = ub_random_max(rnd, reusenum);
-			*port = my_port;
-			*reused = 1;
-			return 1;
-		}
-		my_port = ub_random_max(rnd, shpif->avail_total - shpif->inuse
-			+ reusenum);
-		if(my_port < reusenum) {
-			/* port already open */
-			lock_basic_unlock(&shp->lock);
-			*port = my_port;
-			*reused = 1;
-			return 1;
-		}
-		my_port -= reusenum;
-	}
-	log_assert(shpif->inuse < shpif->avail_total);
-	log_assert(my_port >= 0 && my_port < shpif->avail_total);
-	portno = shpif->avail_ports[my_port];
-	shpif->avail_ports[my_port] =
-		shpif->avail_ports[shpif->avail_total-shpif->inuse-1];
-	shpif->inuse++;
-	lock_basic_unlock(&shp->lock);
-	*port = portno;
-	*reused = 0;
-	return 1;
-#else
-	(void)shp; (void)shpif; (void)rnd; (void)udp_connect;
-	(void)reusenum;
-	*port = 0;
-	*reused = 0;
-	return 1;
-#endif
-}
-
-void shared_ports_return_port(struct shared_ports* shp,
-	struct shared_ports_if* shpif, int port)
-{
-#ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-	if(!shpif)
-		return;
-	lock_basic_lock(&shp->lock);
-	log_assert(shpif->inuse > 0);
-	shpif->avail_ports[shpif->avail_total - shpif->inuse] = port;
-	shpif->inuse--;
-	lock_basic_unlock(&shp->lock);
-#else
-	(void)shp; (void)shpif; (void)port;
-#endif
-}

services/outside_network.h

@@ -70,8 +70,6 @@ struct module_env;
 struct module_qstate;
 struct query_info;
 struct config_file;
-struct shared_ports;
-struct shared_ports_if;
 
 /**
  * Send queries to outside servers and wait for answers from servers.
@@ -121,9 +119,6 @@ struct outside_network {
 	int udp_connect;
 	/** number of udp packets sent. */
 	size_t num_udp_outgoing;
-	/** the shared ports structure, with random ports numbers.
-	 * This is a reference to the member in the daemon structure. */
-	struct shared_ports* shared_ports;
 
 	/** array of outgoing IP4 interfaces */
 	struct port_if* ip4_ifs;
@@ -216,8 +211,11 @@ struct port_if {
 	int pfxlen;
 
 #ifndef DISABLE_EXPLICIT_PORT_RANDOMISATION
-	/** the shared port numbers for this interface. */
-	struct shared_ports_if* shpif;
+	/** the available ports array. These are unused.
+	 * Only the first total-inuse part is filled. */
+	int* avail_ports;
+	/** the total number of available ports (size of the array) */
+	int avail_total;
 #endif
 
 	/** array of the commpoints currently in use. 
@@ -247,42 +245,6 @@ struct port_comm {
 	struct comm_point* cp;
 };
 
-/**
- * Shared ports, the list of ports shared across threads
- */
-struct shared_ports {
-	/** mutex on the ports */
-	lock_basic_type lock;
-	/** array of IP4 interfaces */
-	struct shared_ports_if* ip4_ifs;
-	/** number of outgoing IP4 interfaces */
-	int num_ip4;
-	/** array of IP6 interfaces */
-	struct shared_ports_if* ip6_ifs;
-	/** number of outgoing IP6 interfaces */
-	int num_ip6;
-};
-
-/**
- * Shared ports for an interface.
- */
-struct shared_ports_if {
-	/** address ready to allocate new socket (except port no). */
-	struct sockaddr_storage addr;
-	/** length of addr field */
-	socklen_t addrlen;
-	/** if a netblock, the prefix */
-	int pfxlen;
-
-	/** the available ports array. These are unused.
-	 * Only the first total-inuse part is filled. */
-	int* avail_ports;
-	/** the total number of available ports (size of the array) */
-	int avail_total;
-	/** the number in use. */
-	int inuse;
-};
-
 /**
  * Reuse TCP connection, still open can be used again.
  */
@@ -302,9 +264,6 @@ struct reuse_tcp {
 	socklen_t addrlen;
 	/** also key for tcp_reuse tree, if ssl is used */
 	int is_ssl;
-	/** If is_ssl is enabled, tls_auth_name is part of the key for
-	 * tcp_reuse tree. If the string is NULL, it without a tls_auth_name */
-	char* tls_auth_name;
 	/** lru chain, so that the oldest can be removed to get a new
 	 * connection when all are in (re)use. oldest is last in list.
 	 * The lru only contains empty connections waiting for reuse,
@@ -457,7 +416,7 @@ struct waiting_tcp {
 	void* cb_arg;
 	/** if it uses ssl upstream */
 	int ssl_upstream;
-	/** owned copy of the tls_auth_name (malloced) */
+	/** ref to the tls_auth_name from the serviced_query */
 	char* tls_auth_name;
 	/** the packet was involved in an error, to stop looping errors */
 	int error_count;
@@ -589,6 +548,8 @@ struct serviced_query {
  * @param infra: pointer to infra cached used for serviced queries.
  * @param rnd: stored to create random numbers for serviced queries.
  * @param use_caps_for_id: enable to use 0x20 bits to encode id randomness.
+ * @param availports: array of available ports. 
+ * @param numavailports: number of available ports in array.
  * @param unwanted_threshold: when to take defensive action.
  * @param unwanted_action: the action to take.
  * @param unwanted_param: user parameter to action.
@@ -603,18 +564,17 @@ struct serviced_query {
  * @param max_reuse_tcp_queries: max number of queries on a reuse connection.
  * @param tcp_reuse_timeout: timeout for REUSE entries in milliseconds.
  * @param tcp_auth_query_timeout: timeout in milliseconds for TCP queries to auth servers.
- * @param shared_ports: the shared_ports structure.
  * @return: the new structure (with no pending answers) or NULL on error.
  */
 struct outside_network* outside_network_create(struct comm_base* base,
 	size_t bufsize, size_t num_ports, char** ifs, int num_ifs,
 	int do_ip4, int do_ip6, size_t num_tcp, int dscp, struct infra_cache* infra, 
-	struct ub_randstate* rnd, int use_caps_for_id,
-	size_t unwanted_threshold, int tcp_mss,
+	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
+	int numavailports, size_t unwanted_threshold, int tcp_mss,
 	void (*unwanted_action)(void*), void* unwanted_param, int do_udp,
 	void* sslctx, int delayclose, int tls_use_sni, struct dt_env *dtenv,
 	int udp_connect, int max_reuse_tcp_queries, int tcp_reuse_timeout,
-	int tcp_auth_query_timeout, struct shared_ports* shared_ports);
+	int tcp_auth_query_timeout);
 
 /**
  * Delete outside_network structure.
@@ -856,54 +816,6 @@ struct comm_point* outnet_comm_point_for_http(struct outside_network* outnet,
 /** connect tcp connection to addr, 0 on failure */
 int outnet_tcp_connect(int s, struct sockaddr_storage* addr, socklen_t addrlen);
 
-/**
- * Create new shared ports structure.
- * @param ifs: interface names (or NULL for default interface).
- *    These interfaces must be able to access all authoritative servers.
- * @param num_ifs: number of names in array ifs.
- * @param do_ip4: service IP4.
- * @param do_ip6: service IP6.
- * @param availports: array of available ports.
- * @param numavailports: number of available ports in array.
- * @return new, or NULL on failure.
- */
-struct shared_ports* shared_ports_create(char** ifs, int num_ifs, int do_ip4,
-	int do_ip6, int* availports, int numavailports);
-
-/**
- * Delete shared ports structure.
- * @param shp: shared ports structure.
- */
-void shared_ports_delete(struct shared_ports* shp);
-
-/** Find interface in shared ports. */
-struct shared_ports_if* shared_ports_find_if(struct shared_ports* shp,
-	struct sockaddr_storage* addr, socklen_t addrlen, int pfxlen);
-
-/**
- * Get a shared port from the list of random ports.
- * @param shp: shared ports structure.
- * @param shpif: the shared ports interface.
- * @param rnd: used to make random numbers.
- * @param udp_connect: set to true if no reuse is possible.
- * @param reusenum: number of ports that can be reused (already open).
- * @param port: the port number is returned.
- * @param reused: if the port numer is reused, returned.
- * @return false on failure. That can mean no more free ports to use.
- */
-int shared_ports_fetch_random(struct shared_ports* shp,
-	struct shared_ports_if* shpif, struct ub_randstate* rnd,
-	int udp_connect, int reusenum, int* port, int* reused);
-
-/**
- * Return a shared port to the list of random ports.
- * @param shp: shared ports structure.
- * @param shpif: the shared ports interface.
- * @param port: port number to return to be used again.
- */
-void shared_ports_return_port(struct shared_ports* shp,
-	struct shared_ports_if* shpif, int port);
-
 /** callback for incoming udp answers from the network */
 int outnet_udp_cb(struct comm_point* c, void* arg, int error,
 	struct comm_reply *reply_info);

services/rpz.c

@@ -153,7 +153,6 @@ rpz_type_ignored(uint16_t rr_type)
 		case LDNS_RR_TYPE_SOA:
 		case LDNS_RR_TYPE_NS:
 		case LDNS_RR_TYPE_DNAME:
-		case LDNS_RR_TYPE_ZONEMD:
 		/* all DNSSEC-related RRs must be ignored */
 		case LDNS_RR_TYPE_DNSKEY:
 		case LDNS_RR_TYPE_DS:
@@ -2469,7 +2468,6 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
 {
 	struct auth_zones* az;
 	struct auth_zone* a;
-	struct dns_msg* ret = NULL;
 	struct clientip_synthesized_rr* raddr = NULL;
 	struct rpz* r = NULL;
 	struct local_zone* z = NULL;
@@ -2513,11 +2511,13 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
 		z = rpz_delegation_point_zone_lookup(is->dp, r->nsdname_zones,
 						     is->qchase.qclass, &match);
 		if(z != NULL) {
+			lock_rw_unlock(&a->lock);
 			break;
 		}
 
 		raddr = rpz_delegation_point_ipbased_trigger_lookup(r, is);
 		if(raddr != NULL) {
+			lock_rw_unlock(&a->lock);
 			break;
 		}
 		lock_rw_unlock(&a->lock);
@@ -2532,12 +2532,9 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
 		if(z) {
 			lock_rw_unlock(&z->lock);
 		}
-		ret = rpz_apply_nsip_trigger(ms, &is->qchase, r, raddr, a);
-	} else {
-		ret = rpz_apply_nsdname_trigger(ms, &is->qchase, r, z, &match, a);
+		return rpz_apply_nsip_trigger(ms, &is->qchase, r, raddr, a);
 	}
-	lock_rw_unlock(&a->lock);
-	return ret;
+	return rpz_apply_nsdname_trigger(ms, &is->qchase, r, z, &match, a);
 }
 
 struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms,

smallapp/unbound-anchor.c

@@ -2430,20 +2430,12 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 
 	if(dolist) do_list_builtin();

smallapp/unbound-checkconf.c

@@ -44,7 +44,6 @@
 
 #include "config.h"
 #include <ctype.h>
-#include "util/as112.h"
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/module.h"
@@ -189,56 +188,11 @@ donotquerylocalhostcheck(struct config_file* cfg)
 	}
 }
 
-static void
-nodefaultzonescheck(struct config_file* cfg)
-{
-	struct config_strlist* d;
-	const char** zstr;
-	size_t len;
-
-#define COMPARE_ZONE_NAME(confname, builtname, len)		\
-	(strncasecmp(confname, builtname, (len)) == 0 &&	\
-	(strlen(confname) == (len) ||				\
-	(strlen(confname) == (len) + 1				\
-	&& confname[(len)] == '.')))
-
-	for(d = cfg->local_zones_nodefault; d; d = d->next) {
-		if(!cfg->unblock_lan_zones) {
-			for(zstr = as112_zones; *zstr; zstr++) {
-				len = strlen(*zstr) - 1; /* trailing '.' */
-				if(COMPARE_ZONE_NAME(d->str, *zstr, len))
-					goto default_continue;
-			}
-		}
-		for(zstr = local_zones_default_special; *zstr; zstr++) {
-			len = strlen(*zstr) - 1; /* trailing '.' */
-			if(COMPARE_ZONE_NAME(d->str, *zstr, len))
-				goto default_continue;
-		}
-		for(zstr = local_zones_default_reverse; *zstr; zstr++) {
-			len = strlen(*zstr) - 1; /* trailing '.' */
-			if(COMPARE_ZONE_NAME(d->str, *zstr, len))
-				goto default_continue;
-		}
-		if(COMPARE_ZONE_NAME(d->str, "localhost.", 10 - 1))
-			goto default_continue;
-		fprintf(stderr, "unbound-checkconf: warning: local-zone: '%s' "
-			"is configured as 'nodefault' but there is no such "
-			"default local-zone. Check the unbound.conf "
-			"documentation for default configured local-zones.\n",
-			d->str);
-default_continue:
-		; /* statement to jump to, for older gcc. */
-	}
-#undef COMPARE_ZONE_NAME
-}
-
 /** check localzones */
 static void
 localzonechecks(struct config_file* cfg)
 {
 	struct local_zones* zs;
-	nodefaultzonescheck(cfg);
 	if(!(zs = local_zones_create()))
 		fatal_exit("out of memory");
 	if(!local_zones_apply_cfg(zs, cfg))

smallapp/unbound-control.c

@@ -1052,20 +1052,12 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 
 	if(!RAND_status()) {

smallapp/unbound-host.c

@@ -521,20 +521,12 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 #endif /* HAVE_SSL */
 #ifdef HAVE_NSS

smallapp/worker_cb.c

@@ -128,12 +128,6 @@ worker_alloc_cleanup(void* ATTR_UNUSED(arg))
 	log_assert(0);
 }
 
-void
-libworker_alloc_cleanup(void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
 struct outbound_entry* libworker_send_query(
 	struct query_info* ATTR_UNUSED(qinfo), uint16_t ATTR_UNUSED(flags),
 	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),

testcode/asynclook.c

@@ -488,20 +488,12 @@ int main(int argc, char** argv)
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 #endif /* HAVE_SSL */
 

testcode/checklocks.h

@@ -360,7 +360,6 @@ typedef pthread_key_t ub_thread_key_type;
 #define ub_thread_key_create(key, f) LOCKRET(pthread_key_create(key, f))
 #define ub_thread_key_set(key, v) LOCKRET(pthread_setspecific(key, v))
 #define ub_thread_key_get(key) pthread_getspecific(key)
-#define ub_thread_setname(thread, name) /* nop */
 
 #endif /* USE_THREAD_DEBUG */
 #endif /* TESTCODE_CHECK_LOCKS_H */

testcode/dohclient.c

@@ -642,20 +642,12 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 	}
 	run(h2_session, port, no_tls, argc, argv);

testcode/doqclient.c

@@ -1519,9 +1519,9 @@ doq_client_send_pkt(struct doq_client_data* data, uint32_t ecn, uint8_t* buf,
 		}
 		log_err("doq sendmsg: %s", strerror(errno));
 #ifdef HAVE_NGTCP2_CCERR_DEFAULT
-		ngtcp2_ccerr_set_application_error(&data->ccerr, 1, NULL, 0);
+		ngtcp2_ccerr_set_application_error(&data->ccerr, -1, NULL, 0);
 #else
-		ngtcp2_connection_close_error_set_application_error(&data->last_error, 1, NULL, 0);
+		ngtcp2_connection_close_error_set_application_error(&data->last_error, -1, NULL, 0);
 #endif
 		return 0;
 	}
@@ -2671,11 +2671,6 @@ void libworker_event_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
 	log_assert(0);
 }
 
-void libworker_alloc_cleanup(void* ATTR_UNUSED(arg))
-{
-	log_assert(0);
-}
-
 int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 {
 	log_assert(0);

testcode/fake_event.c

@@ -1126,16 +1126,15 @@ outside_network_create(struct comm_base* base, size_t bufsize,
 	int ATTR_UNUSED(dscp),
 	struct infra_cache* infra,
 	struct ub_randstate* ATTR_UNUSED(rnd),
-	int ATTR_UNUSED(use_caps_for_id),
-	size_t ATTR_UNUSED(unwanted_threshold),
+	int ATTR_UNUSED(use_caps_for_id), int* ATTR_UNUSED(availports),
+	int ATTR_UNUSED(numavailports), size_t ATTR_UNUSED(unwanted_threshold),
 	int ATTR_UNUSED(outgoing_tcp_mss),
 	void (*unwanted_action)(void*), void* ATTR_UNUSED(unwanted_param),
 	int ATTR_UNUSED(do_udp), void* ATTR_UNUSED(sslctx),
 	int ATTR_UNUSED(delayclose), int ATTR_UNUSED(tls_use_sni),
 	struct dt_env* ATTR_UNUSED(dtenv), int ATTR_UNUSED(udp_connect),
 	int ATTR_UNUSED(max_reuse_tcp_queries), int ATTR_UNUSED(tcp_reuse_timeout),
-	int ATTR_UNUSED(tcp_auth_query_timeout),
-	struct shared_ports* ATTR_UNUSED(shared_ports))
+	int ATTR_UNUSED(tcp_auth_query_timeout))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)base;
 	struct outside_network* outnet =  calloc(1,
@@ -1981,20 +1980,6 @@ int outnet_tcp_connect(int ATTR_UNUSED(s), struct sockaddr_storage* ATTR_UNUSED(
 	return 0;
 }
 
-struct shared_ports* shared_ports_create(char** ATTR_UNUSED(ifs),
-	int ATTR_UNUSED(num_ifs), int ATTR_UNUSED(do_ip4),
-        int ATTR_UNUSED(do_ip6), int* ATTR_UNUSED(availports),
-	int ATTR_UNUSED(numavailports))
-{
-	return calloc(1, sizeof(struct shared_ports));
-}
-
-void shared_ports_delete(struct shared_ports* shp)
-{
-	if(!shp) return;
-	free(shp);
-}
-
 int tcp_req_info_add_meshstate(struct tcp_req_info* ATTR_UNUSED(req),
         struct mesh_area* ATTR_UNUSED(mesh), struct mesh_state* ATTR_UNUSED(m))
 {
@@ -2036,15 +2021,6 @@ void http2_stream_remove_mesh_state(struct http2_stream* ATTR_UNUSED(h2_stream))
 {
 }
 
-void doq_stream_add_meshstate(struct doq_stream* ATTR_UNUSED(stream),
-	struct mesh_area* ATTR_UNUSED(mesh), struct mesh_state* ATTR_UNUSED(m))
-{
-}
-
-void doq_stream_remove_mesh_state(struct doq_stream* ATTR_UNUSED(stream))
-{
-}
-
 void fast_reload_service_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(event),
 	void* ATTR_UNUSED(arg))
 {

testcode/mini_tdir.sh

@@ -141,13 +141,6 @@ if test -f $done; then
 	exit 0
 fi
 
-# always clear the skip mark file in case something changed in the environment
-# in between runs
-if test -f $skip; then
-	echo "minitdir $skip exists; removing."
-	rm $skip
-fi
-
 # Copy
 if test $quiet = 0; then
 	echo "minitdir copy $1 to $dir"

testcode/petal.c

@@ -160,26 +160,11 @@ read_ssl_line(SSL* ssl, char* buf, size_t len)
 			return 0;
 		}
 		if((r = SSL_read(ssl, buf+n, 1)) <= 0) {
-			int e = SSL_get_error(ssl, r);
-			if(e == SSL_ERROR_ZERO_RETURN) {
+			if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN) {
 				/* EOF */
 				break;
-			} else if(e == SSL_ERROR_WANT_READ) {
-				continue;
-			} else if(e == SSL_ERROR_WANT_WRITE) {
-				continue;
-			} else if(e == SSL_ERROR_SYSCALL) {
-				if(verb) printf("could not SSL_read %s\n",
-					strerror(errno));
-			} else if(e == SSL_ERROR_SSL) {
-				int er = ERR_peek_error();
-				if(er)
-					printf("could not SSL_read: %s\n",
-						ERR_reason_error_string(er));
-			} else {
-				if(verb) printf("could not SSL_read "
-						"(SSL_get_error %d)\n", e);
 			}
+			if(verb) printf("could not SSL_read\n");
 			return 0;
 		}
 		if(endnl && buf[n] == '\n') {
@@ -690,20 +675,12 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 
 	do_service(addr, port, key, cert);

testcode/pktview.c

@@ -59,16 +59,12 @@ static void usage(char* argv[])
 /** read hex input */
 static void read_input(sldns_buffer* pkt, FILE* in)
 {
-	/* Buffer for 64Kib packet, in hex, with spaces and comments. */
-	char buf[1024000];
+	char buf[102400];
 	char* np = buf;
 	while(fgets(np, (int)sizeof(buf) - (np-buf), in)) {
 		if(buf[0] == ';') /* comment */
 			continue;
 		np = &np[strlen(np)];
-		if((size_t)(np-buf) >= sizeof(buf)-1)
-			fatal_exit("input too large (%lu bytes)",
-				(unsigned long)sizeof(buf));
 	}
 	hex_to_buf(pkt, buf);
 }
@@ -192,16 +188,10 @@ static void analyze(sldns_buffer* pkt)
 /** main program for pktview */
 int main(int argc, char* argv[]) 
 {
-	sldns_buffer* pkt;
-
-	log_init(NULL, 0, NULL);
-	log_ident_set("pktview");
-
+	sldns_buffer* pkt = sldns_buffer_new(65553);
 	if(argc != 1) {
 		usage(argv);
 	}
-
-	pkt = sldns_buffer_new(65553);
 	if(!pkt) fatal_exit("out of memory");
 
 	read_input(pkt, stdin);

testcode/streamtcp.c

@@ -652,20 +652,12 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 	}
 	send_em(svr, pp2_client, udp, usessl, noanswer, onarrival, delay, argc, argv);

testcode/testpkts.c

@@ -1774,14 +1774,11 @@ adjust_packet(struct entry* match, uint8_t** answer_pkt, size_t *answer_len,
 		memmove(res+LDNS_HEADER_SIZE+dlen+4,
 			orig+LDNS_HEADER_SIZE+olen+4,
 			reslen-(LDNS_HEADER_SIZE+dlen+4));
-	} else if(origlen == 0) {
-		res = NULL;
-		reslen = 0;
 	} else {
 		res = memdup(orig, origlen);
 		reslen = origlen;
 	}
-	if(!res && reslen > 0) {
+	if(!res) {
 		verbose(1, "out of memory; send without adjust\n");
 		return;
 	}

testcode/unitmain.c

@@ -1092,7 +1092,7 @@ static void edns_ede_encode_notxt_fit_test( struct query_info* qinfo,
 {
 	struct edns_data edns;
 	sldns_buffer* pkt;
-	size_t edns_field_size, ede_txt_size;
+	uint16_t edns_field_size, ede_txt_size;
 	int found_ede = 0, found_ede_other = 0, found_ede_txt = 0;
 	int found_other_edns = 0;
 	edns_ede_encode_setup(&edns, region);
@@ -1123,7 +1123,7 @@ static void edns_ede_encode_no_fit_test( struct query_info* qinfo,
 {
 	struct edns_data edns;
 	sldns_buffer* pkt;
-	size_t edns_field_size, ede_size, ede_txt_size;
+	uint16_t edns_field_size, ede_size, ede_txt_size;
 	int found_ede = 0, found_ede_other = 0, found_ede_txt = 0;
 	int found_other_edns = 0;
 	edns_ede_encode_setup(&edns, region);
@@ -1282,61 +1282,6 @@ static void localzone_test(void)
 	localzone_parents_test();
 }
 
-#include "services/mesh.h"
-/** mesh unit tests */
-static void mesh_test(void)
-{
-	struct regional* r2, *r3;
-	struct respip_client_info* c1, *c2, *c3;
-	unit_show_func("services/mesh.c", "mesh_copy_client_info");
-	r2 = regional_create();
-	r3 = regional_create();
-	if(!r2 || !r3) fatal_exit("out of memory");
-
-	c1 = calloc(1, sizeof(*c1));
-	if(!c1) fatal_exit("out of memory");
-	c1->view = calloc(1, sizeof(*c1->view));
-	if(!c1->view) fatal_exit("out of memory");
-	c1->view->name = strdup("view1");
-	if(!c1->view->name) fatal_exit("out of memory");
-
-	c2 = mesh_copy_client_info(r2, c1);
-	if(!c2) fatal_exit("out of memory");
-	c3 = mesh_copy_client_info(r3, c2);
-	if(!c3) fatal_exit("out of memory");
-
-	unit_assert(strcmp(c1->view->name, c2->view_name) == 0);
-	unit_assert(strcmp(c1->view->name, c3->view_name) == 0);
-
-	/* make sure that the c3 view_name is in the r3 region. */
-	unit_assert(r3->next == NULL);  /* only the first chunk present atm */
-	if(strlen(c3->view_name) >= r3->large_object_size) {
-		char* a = r3->large_list;
-		int found = 0;
-		while(a) {
-			if(strcmp(c3->view_name,
-				a + /* ALIGNEMENT */ sizeof(uint64_t)) == 0) {
-				found = 1;
-				break;
-			}
-			a = *(char**)a;
-		}
-		unit_assert(found == 1);
-	} else {
-		/* The allocation is expected in the r3 region first chunk */
-		unit_assert((uint8_t*)c3->view_name < ((uint8_t*)r3)+r3->first_size);
-	}
-
-	regional_destroy(r2);
-	/* ASAN should complain for the freed access below */
-	unit_assert(strcmp(c1->view->name, c3->view_name) == 0);
-
-	regional_destroy(r3);
-	free(c1->view->name);
-	free(c1->view);
-	free(c1);
-}
-
 void unit_show_func(const char* file, const char* func)
 {
 	printf("test %s:%s\n", file, func);
@@ -1411,7 +1356,6 @@ main(int argc, char* argv[])
 	msgparse_test();
 	edns_ede_answer_encode_test();
 	localzone_test();
-	mesh_test();
 #ifdef CLIENT_SUBNET
 	ecs_test();
 #endif /* CLIENT_SUBNET */

testcode/unittcpreuse.c

@@ -41,7 +41,6 @@
 #include "config.h"
 #include "testcode/unitmain.h"
 #include "util/log.h"
-#include "util/net_help.h"
 #include "util/random.h"
 #include "services/outside_network.h"
 
@@ -480,278 +479,6 @@ static void reuse_write_wait_test(void)
 	check_reuse_write_wait_removal(1, &reuse, store, 0, 1);
 }
 
-static void shared_port_test_ifs(void)
-{
-	struct shared_ports* shp;
-	struct shared_ports_if* shpif;
-	char* ifs[] = {"1.2.3.4", "1.2.3.5", "::1:2", "::1:3"};
-	int availports[] = {1, 2, 3, 4};
-	struct sockaddr_storage addr;
-	socklen_t addrlen;
-
-	shp = shared_ports_create(ifs, 4, 1, 1, availports, 4);
-	unit_assert(shp);
-
-	if(!ipstrtoaddr("1.2.3.4", UNBOUND_DNS_PORT, &addr, &addrlen))
-		log_err("could not parse");
-	shpif = shared_ports_find_if(shp, &addr, addrlen, 0);
-	unit_assert(shpif);
-
-	if(!ipstrtoaddr("1.2.3.5", UNBOUND_DNS_PORT, &addr, &addrlen))
-		log_err("could not parse");
-	shpif = shared_ports_find_if(shp, &addr, addrlen, 0);
-	unit_assert(shpif);
-
-	if(!ipstrtoaddr("::1:2", UNBOUND_DNS_PORT, &addr, &addrlen))
-		log_err("could not parse");
-	shpif = shared_ports_find_if(shp, &addr, addrlen, 0);
-	unit_assert(shpif);
-
-	if(!ipstrtoaddr("::1:3", UNBOUND_DNS_PORT, &addr, &addrlen))
-		log_err("could not parse");
-	shpif = shared_ports_find_if(shp, &addr, addrlen, 0);
-	unit_assert(shpif);
-
-	shared_ports_delete(shp);
-}
-
-/** See if a port is on the shared_ports ports list */
-static int
-pif_list_contains(struct shared_ports_if* shpif, int item)
-{
-	int i;
-	unit_assert(shpif->inuse >= 0 && shpif->inuse <= shpif->avail_total);
-	for(i=0; i< shpif->avail_total - shpif->inuse; i++) {
-		if(shpif->avail_ports[i] == item)
-			return 1;
-	}
-	return 0;
-}
-
-/** See if a number of ports are on the shared_ports list */
-static int
-pif_list_contains_items(struct shared_ports_if* shpif, int item1,
-	int item2, int item3, int item4)
-{
-	if(item1 != -1 && !pif_list_contains(shpif, item1))
-		return 0;
-	if(item2 != -1 && !pif_list_contains(shpif, item2))
-		return 0;
-	if(item3 != -1 && !pif_list_contains(shpif, item3))
-		return 0;
-	if(item4 != -1 && !pif_list_contains(shpif, item4))
-		return 0;
-	return 1;
-}
-
-static void shared_port_test_port(void)
-{
-	struct shared_ports* shp;
-	struct shared_ports_if* shpif;
-	char* ifs[] = {"1.2.3.4", "1.2.3.5"};
-	int availports[] = {1, 2, 3, 4};
-	struct sockaddr_storage addr;
-	socklen_t addrlen;
-	int p1, p2, p3, reused;
-	struct ub_randstate* rnd;
-
-	rnd = ub_initstate(NULL);
-	unit_assert(rnd);
-
-	shp = shared_ports_create(ifs, 2, 1, 1, availports, 4);
-	unit_assert(shp);
-
-	if(!ipstrtoaddr("1.2.3.4", UNBOUND_DNS_PORT, &addr, &addrlen))
-		log_err("could not parse");
-	shpif = shared_ports_find_if(shp, &addr, addrlen, 0);
-	unit_assert(shpif);
-
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 0);
-	unit_assert(pif_list_contains_items(shpif, 1, 2, 3, 4));
-
-	if(!shared_ports_fetch_random(shp, shpif, rnd,
-		0, 0, &p1, &reused)) {
-		unit_assert(0); /* should succeed */
-	}
-	unit_assert(reused == 0);
-	unit_assert(p1 != 0);
-	unit_assert(!pif_list_contains(shpif, p1));
-	if(p1 != 1) unit_assert(pif_list_contains(shpif, 1));
-	if(p1 != 2) unit_assert(pif_list_contains(shpif, 2));
-	if(p1 != 3) unit_assert(pif_list_contains(shpif, 3));
-	if(p1 != 4) unit_assert(pif_list_contains(shpif, 4));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 1);
-
-	shared_ports_return_port(shp, shpif, p1);
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 0);
-	unit_assert(pif_list_contains_items(shpif, 1, 2, 3, 4));
-
-	/* pick up two items */
-	if(!shared_ports_fetch_random(shp, shpif, rnd,
-		0, 0, &p1, &reused)) {
-		unit_assert(0); /* should succeed */
-	}
-	unit_assert(reused == 0);
-	unit_assert(p1 != 0);
-	if(!shared_ports_fetch_random(shp, shpif, rnd,
-		0, 0, &p2, &reused)) {
-		unit_assert(0); /* should succeed */
-	}
-	unit_assert(reused == 0);
-	unit_assert(p2 != 0);
-	unit_assert(!pif_list_contains(shpif, p1));
-	unit_assert(!pif_list_contains(shpif, p2));
-	if(p1 != 1 && p2 != 1) unit_assert(pif_list_contains(shpif, 1));
-	if(p1 != 2 && p2 != 2) unit_assert(pif_list_contains(shpif, 2));
-	if(p1 != 3 && p2 != 3) unit_assert(pif_list_contains(shpif, 3));
-	if(p1 != 4 && p2 != 4) unit_assert(pif_list_contains(shpif, 4));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 2);
-
-	shared_ports_return_port(shp, shpif, p1);
-	unit_assert(pif_list_contains(shpif, p1));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 1);
-
-	shared_ports_return_port(shp, shpif, p2);
-	unit_assert(pif_list_contains(shpif, p2));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 0);
-	unit_assert(pif_list_contains_items(shpif, 1, 2, 3, 4));
-
-	/* pick up three items */
-	if(!shared_ports_fetch_random(shp, shpif, rnd,
-		0, 0, &p1, &reused)) {
-		unit_assert(0); /* should succeed */
-	}
-	unit_assert(reused == 0);
-	unit_assert(p1 != 0);
-	if(!shared_ports_fetch_random(shp, shpif, rnd,
-		0, 0, &p2, &reused)) {
-		unit_assert(0); /* should succeed */
-	}
-	unit_assert(reused == 0);
-	unit_assert(p2 != 0);
-	if(!shared_ports_fetch_random(shp, shpif, rnd,
-		0, 0, &p3, &reused)) {
-		unit_assert(0); /* should succeed */
-	}
-	unit_assert(reused == 0);
-	unit_assert(p3 != 0);
-	unit_assert(!pif_list_contains(shpif, p1));
-	unit_assert(!pif_list_contains(shpif, p2));
-	unit_assert(!pif_list_contains(shpif, p3));
-	if(p1 != 1 && p2 != 1 && p3 != 1)
-		unit_assert(pif_list_contains(shpif, 1));
-	if(p1 != 2 && p2 != 2 && p3 != 2)
-		unit_assert(pif_list_contains(shpif, 2));
-	if(p1 != 3 && p2 != 3 && p3 != 3)
-		unit_assert(pif_list_contains(shpif, 3));
-	if(p1 != 4 && p2 != 4 && p3 != 4)
-		unit_assert(pif_list_contains(shpif, 4));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 3);
-
-	shared_ports_return_port(shp, shpif, p1);
-	unit_assert(pif_list_contains(shpif, p1));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 2);
-
-	shared_ports_return_port(shp, shpif, p2);
-	unit_assert(pif_list_contains(shpif, p2));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 1);
-
-	shared_ports_return_port(shp, shpif, p3);
-	unit_assert(pif_list_contains(shpif, p3));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 0);
-	unit_assert(pif_list_contains_items(shpif, 1, 2, 3, 4));
-
-	/* pick up all four items */
-	if(!shared_ports_fetch_random(shp, shpif, rnd,
-		0, 0, &p1, &reused)) {
-		unit_assert(0); /* should succeed */
-	}
-	unit_assert(reused == 0);
-	unit_assert(p1 != 0);
-
-	if(!shared_ports_fetch_random(shp, shpif, rnd,
-		0, 0, &p1, &reused)) {
-		unit_assert(0); /* should succeed */
-	}
-	unit_assert(reused == 0);
-	unit_assert(p1 != 0);
-
-	if(!shared_ports_fetch_random(shp, shpif, rnd,
-		0, 0, &p1, &reused)) {
-		unit_assert(0); /* should succeed */
-	}
-	unit_assert(reused == 0);
-	unit_assert(p1 != 0);
-
-	if(!shared_ports_fetch_random(shp, shpif, rnd,
-		0, 0, &p1, &reused)) {
-		unit_assert(0); /* should succeed */
-	}
-	unit_assert(reused == 0);
-	unit_assert(p1 != 0);
-	unit_assert(!pif_list_contains(shpif, 1));
-	unit_assert(!pif_list_contains(shpif, 2));
-	unit_assert(!pif_list_contains(shpif, 3));
-	unit_assert(!pif_list_contains(shpif, 4));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 4);
-
-	/* more fetches fail, it is fully inuse. */
-	unit_assert(!shared_ports_fetch_random(shp, shpif, rnd, 0, 0, &p2,
-		&reused));
-	unit_assert(!shared_ports_fetch_random(shp, shpif, rnd, 0, 0, &p3,
-		&reused));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 4);
-
-	/* reuse is then always the case */
-	if(!shared_ports_fetch_random(shp, shpif, rnd,
-		0 /* can reuse */, 4 /* reusenum */, &p1, &reused)) {
-		unit_assert(0); /* should succeed */
-	}
-	unit_assert(reused == 1);
-	unit_assert(p1 >= 0 && p1 < 4 /* reusenum */);
-
-	if(!shared_ports_fetch_random(shp, shpif, rnd,
-		0 /* can reuse */, 4 /* reusenum */, &p1, &reused)) {
-		unit_assert(0); /* should succeed */
-	}
-	unit_assert(reused == 1);
-	unit_assert(p1 >= 0 && p1 < 4 /* reusenum */);
-
-	/* return all the ports */
-	shared_ports_return_port(shp, shpif, 1);
-	unit_assert(pif_list_contains(shpif, 1));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 3);
-	shared_ports_return_port(shp, shpif, 2);
-	unit_assert(pif_list_contains(shpif, 2));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 2);
-	shared_ports_return_port(shp, shpif, 3);
-	unit_assert(pif_list_contains(shpif, 3));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 1);
-	shared_ports_return_port(shp, shpif, 4);
-	unit_assert(pif_list_contains(shpif, 4));
-	unit_assert(shpif->avail_total == 4);
-	unit_assert(shpif->inuse == 0);
-	unit_assert(pif_list_contains_items(shpif, 1, 2, 3, 4));
-
-	shared_ports_delete(shp);
-	ub_randfree(rnd);
-}
-
 void tcpreuse_test(void)
 {
     unit_show_feature("tcp_reuse");
@@ -759,7 +486,4 @@ void tcpreuse_test(void)
     tcp_reuse_tree_list_test();
     waiting_tcp_list_test();
     reuse_write_wait_test();
-    unit_show_feature("shared_ports");
-    shared_port_test_ifs();
-    shared_port_test_port();
 }

testdata/01-doc.tdir/01-doc.test

@@ -40,6 +40,8 @@ grep -F -v -e "dnstap" hlist > ilist; mv ilist hlist
 grep -F -v -e "util/siphash.c" hlist > ilist; mv ilist hlist
 # filter out compat
 grep -F -v -e "compat/" hlist > ilist; mv ilist hlist
+# filter out simdzone
+grep -F -v -e "simdzone/" hlist > ilist; mv ilist hlist
 for h in `cat hlist`; do
 	if grep -F "`basename $h`" $PRE/doc/html/files.html >/dev/null; then
 		: # ok

testdata/cachedb_val_expired.crpl

@@ -226,7 +226,6 @@ STEP 150 TIME_PASSES ELAPSE 200
 STEP 160 FLUSH_MESSAGE www.example.com. IN A
 
 ; cache has no answer, cachedb is expired
-; but it needs to be validated.
 STEP 170 QUERY
 ENTRY_BEGIN
 REPLY RD DO
@@ -236,14 +235,12 @@ ENTRY_END
 
 STEP 180 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-;ede=3
+MATCH all ttl ede=3
 REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-;www.example.com. 123 IN A 1.2.3.4
-www.example.com. 200 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 STEP 190 TRAFFIC
@@ -301,17 +298,14 @@ SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
 
-; but it needs to be validated
 STEP 280 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-;ede=3
+MATCH all ttl ede=3
 REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-;www.example.com. 123 IN A 1.2.3.4
-www.example.com. 200 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 STEP 290 TRAFFIC

testdata/dname_unsigned_cname.rpl

@@ -1,297 +0,0 @@
-; config options
-; The island of trust is at test.
-server:
-	trust-anchor: "test. DS 1444 8 2 8a87d067fd09a5965244fe2e317dd26d182c468e0a7f26ecc4c7b479bf89db9b"
-	val-override-date: "20201020135527"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-	iter-scrub-promiscuous: no
-	aggressive-nsec: yes
-	local-zone: test. nodefault
-	log-servfail: yes
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test DNAME with an unsigned CNAME that mismatches the DNAME.
-; The CNAME occurs later in a list of redirections.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-test. IN NS
-SECTION AUTHORITY
-test.	IN NS	ns.test.
-SECTION ADDITIONAL
-ns.test. IN A 1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.test
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-test. IN NS
-SECTION ANSWER
-test.    IN NS   ns.test
-test.	3600	IN	RRSIG	NS 8 1 3600 20201116135527 20201019135527 1444 test. RGCxIO32TbbLTk6xZmTr+fjYPH50hntBxeOQ2DIj2pDsmjALcHYtVkOfpfk2EhOhHZd+9PLuoJPbJh6a9NqLSFeBvr0XZoCZoQ2g0tCHUNHcH5EVjA2TuYBQem6DVYnPLJ3914aRx0uA1j42b8dC2xsam/XkOo7U+dLbUW2Os1s=
-SECTION ADDITIONAL
-ns.test. IN A 1.2.3.5
-ns.test.	3600	IN	RRSIG	A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.test. IN A
-SECTION ANSWER
-ns.test. IN A 1.2.3.5
-ns.test.	3600	IN	RRSIG	A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.test. IN AAAA
-SECTION AUTHORITY
-test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600
-test.	3600	IN	RRSIG	SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw=
-ns.test. 3600 IN NSEC nz.test. A RRSIG
-ns.test.	3600	IN	RRSIG	NSEC 8 2 3600 20201116135527 20201019135527 1444 test. PElArVB3KPg8KHAP7lzcNbhFuXNxTsHNTn1dZVncB5qmWRdIaeKpaXDjpH0JSXMaelGFS+/QhuQ6Hmw9+4VyZFRqMzGhw4agUR/2bxABHcDIG4ZpUwyeSP61ATTfHUkQVxaH2wjCWI/tfmesdP2xVE4GXyUvCIBxU914MkZbULU=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-test. IN DNSKEY
-SECTION ANSWER
-test.    3600    IN      DNSKEY  257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b}
-test.	3600	IN	RRSIG	DNSKEY 8 1 3600 20201116135527 20201019135527 1444 test. UmRMS4iG9NBBHZYOtpwFFcJgbEb5SfHSgHd9XRe/8pTWM31WSDayn5ViPOBMqI1T5TXg2amc13dDI574xIM2oKMus3b5cBW72jJLW13jprBtslO6P8BMWb4HNnvLrJtQjwf3ErRirtTxinLmywQtmyr1cdthyG3Gp4N7i90fHSc=
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname qtype
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-example.test. IN DS
-SECTION ANSWER
-example.test.	3600	IN	DS	55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39
-example.test.	3600	IN	RRSIG	DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.test. IN NS
-SECTION AUTHORITY
-example.test.    IN NS   ns.example.test.
-example.test.	3600	IN	DS	55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39
-example.test.	3600	IN	RRSIG	DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I=
-SECTION ADDITIONAL
-ns.example.test. IN A 1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-fox.test. IN NS
-SECTION AUTHORITY
-fox.test.    IN NS   ns.fox.test.
-fox.test.	3600	IN	DS	29332 8 2 5b06f16c7b8cc07ba7b8e1ab0a40a40ecf89e1e94da2f0b1d2159b64dba80d96
-fox.test.	3600	IN	RRSIG	DS 8 2 3600 20201116135527 20201019135527 1444 test. B9bKqUJgJcGlKSWyGkdGGS6unKUwNJteTq08caL40QEZcAy836vwypGzOIQJNUw+mYIEecvtrF9H4mG+EjzDKv+n+36DCNvJMn6b8+FC9COw4mqITAjYPZjDwtOXAKVbuBuZJsbP2ztacJ98tXcORozaaKDGH/3fmsUlaKcuPmo=
-SECTION ADDITIONAL
-ns.fox.test. IN A 1.2.3.6
-ENTRY_END
-RANGE_END
-
-; ns.example.test.
-RANGE_BEGIN 0 15
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.test. IN NS
-SECTION ANSWER
-example.test.    IN NS   ns.example.test.
-example.test.	3600	IN	RRSIG	NS 8 2 3600 20201116135527 20201019135527 55567 example.test. l1JT0wMlK0YI7/CWHzexf/k0iafUhCgN+BdgjBXIRXmSQNf4HDTiAkbcWL2/15qtnp12nQy9JeiTdSQ3vtPoHAJX4C5uTWaze4ms+Wrrf+n92sLCjacP9x50uuicH3URT6cKb1QCAPwlvlWxIlZjAMYFScSns7+C441NMJT8aE4=
-SECTION ADDITIONAL
-ns.example.test.         IN      A       1.2.3.4
-ns.example.test.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.example.test. IN A
-SECTION ANSWER
-ns.example.test.         IN      A       1.2.3.4
-ns.example.test.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.example.test. IN AAAA
-SECTION AUTHORITY
-example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600
-example.test.	3600	IN	RRSIG	SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8=
-ns.example.test. 3600 IN NSEC nz.example.test. A RRSIG
-ns.example.test.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 55567 example.test. v/5aO/n8Ow21y7LE7JKZsFkUJU5MjIfadVRm2Tdb8f3RLwYDdBTs3aWeeEQdCRSUF61TmfJM1jIxlWQPuHbqzGnjSk7adw9gFpP7wFwoqG3/xdCFHoxo/3/1F/4Ankey3sDgKgOFsgnu40TlL36mGPYszeK+/2o3SAx2GM+3BdU=
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.test. IN DNSKEY
-SECTION ANSWER
-example.test.	3600	IN	DNSKEY	257 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55567 (ksk), size = 1024b}
-example.test.	3600	IN	RRSIG	DNSKEY 8 2 3600 20201116135527 20201019135527 55567 example.test. IbWMC6quOuZFNPAVxQLqCJ9nLhindBo826rnLcg5yMgs9dGUSPOCXAfHTmbgJAUNs9HTFfrJWNvasnETs0UOpmEuifGwWdH1OlME7Gny4RL2QmITUFeMW81Jz1tiVQxFXl6yxT0jxOxvz+bqMHlrz+8IeWQXcO+GZTPu8ueq30g=
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-a.d.example.test. IN A
-SECTION ANSWER
-d.example.test. 3600 IN DNAME tgt.example.test.
-d.example.test.	3600	IN	RRSIG	DNAME 8 3 3600 20201116135527 20201019135527 55567 example.test. EGpXUnJuzkETAO2OWyZDrTeInnyxF7CXPXGDfFt2x3CBUeckUUZcgQQ3yMh+BATKph2nOhBfk8klvZ35C9sQO7Z32REAnqGjpHiR86xRPYxG62Nk9kXv1Odeh/adz2QhB93N8U7W57FM0P/VQDkP0GQXTSRGTuj+7ihfYVd4HWI=
-; with CNAME signature
-a.d.example.test. 3600 IN CNAME a.tgt.example.test.
-a.d.example.test.	3600	IN	RRSIG	CNAME 8 4 3600 20201116135527 20201019135527 55567 example.test. efnytLE7P95kLr/tA9H0Z77VTOUQk24ci2bDgdVe8EuodTXtgg5PVHVLljD3QQ1Cpyme50odH/fhn2j1ORQpJTMk24Un/VRhVNquf+kj1nawJ59J0hjag4i0FIwZEG3/P7ogTB3Yd2y0Osb42Aawp48KvtVkUeBukk/GSutaTVQ=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-a.tgt.example.test. IN A
-SECTION ANSWER
-a.tgt.example.test. 3600 IN CNAME b.d.example.test.
-a.tgt.example.test.	3600	IN	RRSIG	CNAME 8 4 3600 20201116135527 20201019135527 55567 example.test. XHYWSHIm9J8j8T1qMh1tHZS71UguXYUVescKPFtoGHRuyRhHNob+NAqdn3I4/+8HSSGrJDqhTX/Vo3rcc3/g5HOHScwzZByB/diyJWpG9IA7pm7c7FnHnHpGBVdHq9wXlkgCPiaJShpE1zg1nNy3p99ca9/wh4y9XWSfcl0L8aw=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-b.d.example.test. IN A
-SECTION ANSWER
-; This answer is injected
-; Without an RRSIG.
-b.d.example.test. 3600 IN CNAME www.fox.test.
-ENTRY_END
-RANGE_END
-
-; ns.fox.test.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.6
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.fox.test. IN AAAA
-SECTION AUTHORITY
-fox.test. 3600 IN SOA ns.fox.test. host.fox.test. 20601 3600 1800 604800 3600
-fox.test.	3600	IN	RRSIG	SOA 8 2 3600 20201116135527 20201019135527 29332 fox.test. QScf+vyis5/Km03ALuLQDfUDagA9/UG/oIQw6LnvmsVoqJSNXa3LIObWT9zfWgdJT0qFayWR4K9hnd9rT1enuVmXX8k47s7AjPZmE0qQxms5xz7jOhj/XLFplXOE9/GkgvAZKPb42qkU3Xf6Bevxzfy4/qW7+yXflWsjLV1vAhz38M4ESeWp0MDme8+DND0f7aoprGcC5saAPfa35nQhHS40q4IwiUDBBk1uwhCBF9ZGsjRfXmECOxIc1/0hBOv+Hhwog4K5b8rdl7LA2VggNiVOUuLFpXEH0XxknEspbQwWppP4TWC1H2QYGaKCc2Hu7NBhM/Ly7caGK+2u1MZvsg==
-ns.fox.test. 3600 IN NSEC nz.fox.test. A RRSIG
-ns.fox.test.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 29332 fox.test. RQjV2PHbBVdGhvSRl0lutzoIZ9KezBAAwvI5sQoIGLdlMeQxj/BOy16auYRLTxvB9xehkrTTeL5xYUwcbi4uFS/kr3IUmlVXeldHOk4T42huV9MGfWzguUsB2jjsrcdt11qEnLo27SVVcvQReswwfpOPRPHg52fS6vt50AIWwttLOLvZEGiGIjRGb4lBaCnoO6YYzOnwcRCV0UScTjlPxS1SBEKsdbPvzfUUyp+wOVnIVAXrd0xEChB7QrTIrcBt4mutXVUNBDcfkZCXgEwu3scWQQS8rNO6O3PvpLgs6PIHX191WjovkJ9/PL+8MO/7UUatSWhZUwuQBUq6VofCYw==
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-fox.test. IN DNSKEY
-SECTION ANSWER
-fox.test.	IN	DNSKEY	257 3 8 AwEAAb4WMOTBLTFvmBra5m6SK4VfViOzmvyUAU0qv861ZQXeEFvwlndqNU9rwRsMxrSWAYs5nHErKDn49usC/HyxxW1477iGFHhfgL4mjNreJm9zft2QFB1VLbRbEPYdDMLCn4co0qnG7/KG8W2i8Pym1L7f+aREwbLo+/716AS2PbaKMhfWLKLiq5wnBcUClQMNzCiwhqxDJp1oePqfkVdeUgXOtgi0dYRIKyQFhJ5VWJ22npoi/Gif0XLCADAlAwRLKc8o/yJkCxskzgpHpw5Cki1lclg0aq4ssOuPRQ+ne6IHYCz9D2mwzulblhLFamKdq7aHzNt4NlyxhpANVFiKLD8= ;{id = 29332 (ksk), size = 2048b}
-fox.test.	3600	IN	RRSIG	DNSKEY 8 2 3600 20201116135527 20201019135527 29332 fox.test. bTslCQKai9U9EWkBPnMiO+Rb34qMAZSzfgEb68x+ZKi2DDyzK7v8TCX8unTlqeQCnTqqgJ7cCUcqrbSV3ip9WGNe5fUy5j9hxH04ddLcDhygnjLi4C7iQX67ratRGu1JM3Evk/gVF76a5J2RSQk340jOFHC0nnjWOMHlDDxBeK4Zr6lYvAMJB2uy08xbi1FuGUSPcrbRFnVb74QMAPLS9Uj5JM8lMsOMtrhHX9zBN8Euo4M1X0sinBdJse3P/fIZ+ZvSnOEpVvur3bcUl+bqFJ18nM/Mj/e3XW3WBWE1dI6p6HdAXLrJyjJINzm+YnNzj11tzu/e4BQCjOutY9XkKA==
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.fox.test. IN A
-SECTION ANSWER
-www.fox.test. 3600 IN A 10.20.30.43
-www.fox.test.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 29332 fox.test. ehPLws7Jnlx5Trm7Z8Hxr0WkLdkxyif+E1aGzFMib4eP0nvLV89WOQ2Fpm1xT/VaNJBXjXhWPB0Oo/gAKVs1znqmyjutFdXi2+9rXnK73jD2+rWBGW/sgBl/9cr458j7441nEK18Mq4SserQcLBqM38IivTlK1J5uXUpEPKMCSA82waf0Z+LUk8czFqeYy+KlJSsiu33mrVWrjyNLIXCbZ2dxfdaVSKyAoQafiokp1NGnw3onQkXXOPqJ7GRsN8Ml4c2nOrEYIG6otoZXXjtkoNCOHzBBkPVEP82JjzQchq0fDWQ2UHOXXZYBG/B6m5PuOXmgKJVDKZ/iVNQofPp8w==
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-a.d.example.test. IN A
-ENTRY_END
-
-STEP 10 TRAFFIC
-; The unsigned CNAME should make SERVFAIL.
-
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO SERVFAIL
-SECTION QUESTION
-a.d.example.test. IN A
-SECTION ANSWER
-ENTRY_END
-
-SCENARIO_END

testdata/dns_error_reporting.rpl

@@ -12,7 +12,6 @@ server:
 	ede: no  # It is not needed for dns-error-reporting; only for clients to receive EDEs
 	dns-error-reporting: yes
 	do-ip6: no
-	do-not-query-localhost: no
 
 stub-zone:
 	name: domain

testdata/dnscrypt_cert.tdir/dnscrypt_cert.test

@@ -9,21 +9,20 @@ PRE="../.."
 
 # do the test
 
-# Query plain request over DNSCrypt.
-# This used to close the channel; now it returns SERVFAIL.
-# Old: We use TCP to avoid hanging on waiting for UDP.
-#      We expect `outfile` to contain no DNS payload
-echo "> dig www.example.com. DNSCrypt port"
-dig @127.0.0.1 -p $DNSCRYPT_PORT www.example.com. A | tee outfile
+# Query plain request over DNSCrypt channel get closed
+# We use TCP to avoid hanging on waiting for UDP.
+# We expect `outfile` to contain no DNS payload
+echo "> dig TCP www.example.com. DNSCrypt port"
+dig +tcp @127.0.0.1 -p $DNSCRYPT_PORT www.example.com. A | tee outfile
 echo "> cat logfiles"
 cat fwd.log
 cat unbound.log
 echo "> check answer"
-if grep "SERVFAIL" outfile; then
-	echo "OK"
-else
+if grep "QUESTION SECTION" outfile; then
 	echo "NOK"
 	exit 1
+else
+	echo "OK"
 fi
 
 

testdata/dnscrypt_cert_chacha.tdir/dnscrypt_cert_chacha.test

@@ -9,21 +9,20 @@ PRE="../.."
 
 # do the test
 
-# Query plain request over DNSCrypt.
-# This used to close the channel; now it returns SERVFAIL.
-# Old: We use TCP to avoid hanging on waiting for UDP.
-#      We expect `outfile` to contain no DNS payload
-echo "> dig www.example.com. DNSCrypt port"
-dig @127.0.0.1 -p $DNSCRYPT_PORT www.example.com. A | tee outfile
+# Query plain request over DNSCrypt channel get closed
+# We use TCP to avoid hanging on waiting for UDP.
+# We expect `outfile` to contain no DNS payload
+echo "> dig TCP www.example.com. DNSCrypt port"
+dig +tcp @127.0.0.1 -p $DNSCRYPT_PORT www.example.com. A | tee outfile
 echo "> cat logfiles"
 cat fwd.log
 cat unbound.log
 echo "> check answer"
-if grep "SERVFAIL" outfile; then
-	echo "OK"
-else
+if grep "QUESTION SECTION" outfile; then
 	echo "NOK"
 	exit 1
+else
+	echo "OK"
 fi
 
 

testdata/ds_wildcard_cname.rpl

@@ -1,374 +0,0 @@
-; config options
-; The island of trust is at test.
-server:
-	trust-anchor: "test. DS 1444 8 2 8a87d067fd09a5965244fe2e317dd26d182c468e0a7f26ecc4c7b479bf89db9b"
-	val-override-date: "20201020135527"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-	iter-scrub-promiscuous: no
-	aggressive-nsec: yes
-	local-zone: test. nodefault
-	log-servfail: yes
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test DS response with wildcard CNAME
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-test. IN NS
-SECTION AUTHORITY
-test.	IN NS	ns.test.
-SECTION ADDITIONAL
-ns.test. IN A 1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.test
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-test. IN NS
-SECTION ANSWER
-test.    IN NS   ns.test
-test.	3600	IN	RRSIG	NS 8 1 3600 20201116135527 20201019135527 1444 test. RGCxIO32TbbLTk6xZmTr+fjYPH50hntBxeOQ2DIj2pDsmjALcHYtVkOfpfk2EhOhHZd+9PLuoJPbJh6a9NqLSFeBvr0XZoCZoQ2g0tCHUNHcH5EVjA2TuYBQem6DVYnPLJ3914aRx0uA1j42b8dC2xsam/XkOo7U+dLbUW2Os1s=
-SECTION ADDITIONAL
-ns.test. IN A 1.2.3.5
-ns.test.	3600	IN	RRSIG	A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.test. IN A
-SECTION ANSWER
-ns.test. IN A 1.2.3.5
-ns.test.	3600	IN	RRSIG	A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.test. IN AAAA
-SECTION AUTHORITY
-test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600
-test.	3600	IN	RRSIG	SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw=
-ns.test. 3600 IN NSEC nz.test. A RRSIG
-ns.test.	3600	IN	RRSIG	NSEC 8 2 3600 20201116135527 20201019135527 1444 test. PElArVB3KPg8KHAP7lzcNbhFuXNxTsHNTn1dZVncB5qmWRdIaeKpaXDjpH0JSXMaelGFS+/QhuQ6Hmw9+4VyZFRqMzGhw4agUR/2bxABHcDIG4ZpUwyeSP61ATTfHUkQVxaH2wjCWI/tfmesdP2xVE4GXyUvCIBxU914MkZbULU=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-test. IN DNSKEY
-SECTION ANSWER
-test.    3600    IN      DNSKEY  257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b}
-test.	3600	IN	RRSIG	DNSKEY 8 1 3600 20201116135527 20201019135527 1444 test. UmRMS4iG9NBBHZYOtpwFFcJgbEb5SfHSgHd9XRe/8pTWM31WSDayn5ViPOBMqI1T5TXg2amc13dDI574xIM2oKMus3b5cBW72jJLW13jprBtslO6P8BMWb4HNnvLrJtQjwf3ErRirtTxinLmywQtmyr1cdthyG3Gp4N7i90fHSc=
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname qtype
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-example.test. IN DS
-SECTION ANSWER
-example.test.	3600	IN	DS	55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39
-example.test.	3600	IN	RRSIG	DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.test. IN NS
-SECTION AUTHORITY
-example.test.    IN NS   ns.example.test.
-example.test.	3600	IN	DS	55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39
-example.test.	3600	IN	RRSIG	DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I=
-SECTION ADDITIONAL
-ns.example.test. IN A 1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.test.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.test. IN NS
-SECTION ANSWER
-example.test.    IN NS   ns.example.test.
-example.test.	3600	IN	RRSIG	NS 8 2 3600 20201116135527 20201019135527 55567 example.test. l1JT0wMlK0YI7/CWHzexf/k0iafUhCgN+BdgjBXIRXmSQNf4HDTiAkbcWL2/15qtnp12nQy9JeiTdSQ3vtPoHAJX4C5uTWaze4ms+Wrrf+n92sLCjacP9x50uuicH3URT6cKb1QCAPwlvlWxIlZjAMYFScSns7+C441NMJT8aE4=
-SECTION ADDITIONAL
-ns.example.test.         IN      A       1.2.3.4
-ns.example.test.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.example.test. IN A
-SECTION ANSWER
-ns.example.test.         IN      A       1.2.3.4
-ns.example.test.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.example.test. IN AAAA
-SECTION ANSWER
-ns.example.test. 3600 IN AAAA 2001::1:2:3:4
-ns.example.test.	3600	IN	RRSIG	AAAA 8 3 3600 20201116135527 20201019135527 55567 example.test. IuFmNUqxRjWSw/Ua2A0XmeKbsVkw6Yzd/D4TGBZ5pyKtbYIFvmF/QfcqzONiwqG3KEW2tAeyEjZOYjrM37NqgIwwk56LJ16fFA7e2tShjSjPhgNzjHZW9zvFTjPyTTVpMVb3SGV59RQTm3jJwlQCq7qVHyKQ+HT3pa+XZQJEzdw=
-SECTION AUTHORITY
-;example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600
-;example.test.	3600	IN	RRSIG	SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8=
-;ns.example.test. 3600 IN NSEC nz.example.test. A RRSIG
-;ns.example.test.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 55567 example.test. v/5aO/n8Ow21y7LE7JKZsFkUJU5MjIfadVRm2Tdb8f3RLwYDdBTs3aWeeEQdCRSUF61TmfJM1jIxlWQPuHbqzGnjSk7adw9gFpP7wFwoqG3/xdCFHoxo/3/1F/4Ankey3sDgKgOFsgnu40TlL36mGPYszeK+/2o3SAx2GM+3BdU=
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.test. IN DNSKEY
-SECTION ANSWER
-example.test.	3600	IN	DNSKEY	257 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55567 (ksk), size = 1024b}
-example.test.	3600	IN	RRSIG	DNSKEY 8 2 3600 20201116135527 20201019135527 55567 example.test. IbWMC6quOuZFNPAVxQLqCJ9nLhindBo826rnLcg5yMgs9dGUSPOCXAfHTmbgJAUNs9HTFfrJWNvasnETs0UOpmEuifGwWdH1OlME7Gny4RL2QmITUFeMW81Jz1tiVQxFXl6yxT0jxOxvz+bqMHlrz+8IeWQXcO+GZTPu8ueq30g=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-tgt.example.test. DS
-SECTION ANSWER
-SECTION AUTHORITY
-; denial of the DS record for tgt.example.test.
-example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600
-example.test.	3600	IN	RRSIG	SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8=
-tgt.example.test. 3600 IN NSEC tgz.example.test. A RRSIG
-tgt.example.test.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 55567 example.test. R9v8k/M56dLOUbrTP/m2XnKsOjIj1kAfwCQvHW4KPdDn3XJIvCLs4mTjxvyQ70uP+zA8WxrPgbqPZv//Ms3Sher2j41VKIBRFkJpyJn6/D9/QmOOhWzoPYXuujHJAkB9IDit3YOgJutirFnB7reTTav42P5x7PzQDSt+crUnXkw=
-ENTRY_END
-
-; when there is a re-query for the DS record, this answer is used.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-sub.example.test. IN DS
-SECTION ANSWER
-; This reply is an injected reply.
-sub.example.test. 300 IN CNAME tgt.example.test.
-; signature for wildcard, *.example.test. 300 IN CNAME tgt.example.test.
-sub.example.test.	300	IN	RRSIG	CNAME 8 2 300 20201116135527 20201019135527 55567 example.test. fz+xLPcRAbGUcnF7hITQHRT6AeA/I/dSjyLWb3it+cHSMY7dN4Jpw7Dk0GJh0y71HXFwaWgk1If0O4IOVo4mfkm1RrRhBnxJT8R88AQlN69SXLZrlHIhoupBpZADz/J15hOcHG+/1svsEpAA5qkOrgZwf581X9ygwPGFkIHgS+o=
-ENTRY_END
-
-; The referral to sub.example.test, for other queries than type DS.
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR AA NOERROR
-SECTION QUESTION
-sub.example.test. IN NS
-SECTION ANSWER
-SECTION AUTHORITY
-sub.example.test. 3600 NS ns.sub.example.test.
-; Smaller TTL 300 for the DS.
-sub.example.test.	300	IN	DS	29332 8 2 69c8a09889e377fb1d1af78cc55984152adf25f4643b26d42654657a171e92aa
-sub.example.test.	300	IN	RRSIG	DS 8 3 300 20201116135527 20201019135527 55567 example.test. vyjkyx1UMCI5KftU7BQWxDkxNj25A60haEIR/Sy7JUkG2UnE0tNIVNE4mEmUGX6ICsddKGwba2xFQFYBMyfpnzsNxEMKv8VpOGObpiTlK4ICRaq6m+pVND1Benk6grzkb+6T2xogHEEMYqnMUF4bDGRe5tcftS9XdAl77pG6W7Q=
-SECTION ADDITIONAL
-ns.sub.example.test. IN A 1.2.3.7
-ENTRY_END
-RANGE_END
-
-; ns.sub.example.test.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.7
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.sub.example.test. IN AAAA
-SECTION ANSWER
-SECTION AUTHORITY
-sub.example.test. 3600 IN SOA ns.sub.example.test. host.sub.example.test. 20701 3600 1800 604800 3600
-sub.example.test.	3600	IN	RRSIG	SOA 8 3 3600 20201116135527 20201019135527 29332 sub.example.test. EEeC/XlG/XuItqRphAOREwHPzqSsJSs9TEhPnqOzXU4/+j0Eq05WN8ZE+GxHnmrxzaLiqAT6pLYLaQxCFcpkMVKUFYfMFyK6jOkTHZ1ODXNIdAA/ZGMCOQQUco3rcrY6F2U8ETHSxiFQkEl8iQntWM6wUoUF37Yd4hab+o1eD/HZXKLwgNXbXC1iY40ZzqwAlxLcCt0SexiTI9BNfyDy3iROeT3XuloC2x9o2zclAqz3m42n8UKAs8Gh7sAkoTua2fqtNfWZtQctlp1tZgdJFXbI4vuxMEldD+Rh5kUJ72aXvD2W7vd042G7z3n+d+I4vtnH2qKNbVA4YHMXzA/3ug==
-ns.sub.example.test. 3600 IN NSEC nz.sub.example.test. A RRSIG
-ns.sub.example.test.	3600	IN	RRSIG	NSEC 8 4 3600 20201116135527 20201019135527 29332 sub.example.test. CqaJIHttjfPIdBM1Ty8RDGRnrkaoC7Y7pzS/Kbzjn3lsEJg2XPWZGRln75imsoVOdi46YG95HZdgvnndTAAH3dE0eZHycvo2O7zR0f+Ty3v/HWpvOsRp/XE/8/7g45DHLuyTXxiO6cDSu0bW/qTC4xyix7vMFNEyOmGMGIZEnvkoRWJvUToj8VW6r+a8dU1KIGQXKSXg3lRcXc0Zfk2lk5P0XGrGzdLcITbZbVP3aFgusoi6uCTqhPmwZRVJjuh1E0qXTTE2A67vloVBvwVxfhNajHNkVhEYtxqZyiRLPs1tRyWit4J2Kkk5qoWuPwNRoTHsgzmPJoDGxheUxGEvbA==
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-sub.example.test. IN DNSKEY
-SECTION ANSWER
-sub.example.test. 300 	IN	DNSKEY	257 3 8 AwEAAb4WMOTBLTFvmBra5m6SK4VfViOzmvyUAU0qv861ZQXeEFvwlndqNU9rwRsMxrSWAYs5nHErKDn49usC/HyxxW1477iGFHhfgL4mjNreJm9zft2QFB1VLbRbEPYdDMLCn4co0qnG7/KG8W2i8Pym1L7f+aREwbLo+/716AS2PbaKMhfWLKLiq5wnBcUClQMNzCiwhqxDJp1oePqfkVdeUgXOtgi0dYRIKyQFhJ5VWJ22npoi/Gif0XLCADAlAwRLKc8o/yJkCxskzgpHpw5Cki1lclg0aq4ssOuPRQ+ne6IHYCz9D2mwzulblhLFamKdq7aHzNt4NlyxhpANVFiKLD8= ;{id = 29332 (ksk), size = 2048b}
-sub.example.test.	300	IN	RRSIG	DNSKEY 8 3 300 20201116135527 20201019135527 29332 sub.example.test. j8lyYKogmlBon1WsYJp2H4DSdXZIGkzKHplH2hs9b5D2I+4kZ7jiwHz5/OZca5aOOE1QbhcPNRyhenSmtwePjhvBLSDDYC4OhowVpWW5o5aRQMnsTYZgmgqX0zPtUWBoK8P+GZRd1VO/Jam0qWoHjHY9lQlDnblN6f2yDRHQI2CVrSal8x12zl1s/QHVNpodb4MwowvL4WeGxDVxBOiS3v+9SobnfPa9oecu9onrcPryr4KDQHi6i5BNvHVPqE9eBkHnRe3DcvfEbOke6vZY7CCNgfGttaJL64ubCVUv2xu3okTQS5gSX9pRbjaxKlw1ZWmJR0HSq/dn2HDuWjzxkQ==
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-a.sub.example.test. IN A
-SECTION ANSWER
-a.sub.example.test. 300 IN A 10.20.30.40
-a.sub.example.test.	300	IN	RRSIG	A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. lElblJBqr+LbNDO8mlyh9PbBzfC6LU5K8nh/fOHu9dFur5xuqtItw+D0/oo2ve6WIUnqblXKhfbZcKMa40DONog/uThmwyp6cBow7oZdfZSt5YTn74QwJb1M/yaJgU+OWNkM7RfG+VcvpB04+KH+g2qwEpHC5Jm5+e66beoiGHZuKle0qAxNAgM1kkJ5EdTngKk80YOciBv705xSSvySmCDktcIceV8zMgD9YFW1Q2I2SXtPCsVaJTA1jaf3Cm8rZfY1GrBW18JyLPOqf6eIBqdyXg/w/mi/pxgakIM3r9iKaDsEz01ZiN0jaEloteT+NhpjEJA/sFzu1nhV0Y3fJw==
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-b.sub.example.test. IN A
-SECTION ANSWER
-b.sub.example.test. 300 IN A 10.20.30.41
-b.sub.example.test.	300	IN	RRSIG	A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. KimigOgfAWic9JVbuqMc0cE2aUlfzBaG+LjZl5IqZr7RLeImG74cpBMbTyzWJ1h3IhCKnLde3KMYz+viVEwsirxlY70i3cDObl5t9XlBKombQzCJBMv5MNCGH1iYfsBL6JVhVX849J1fRTK7E6mW2v9eN0GUFplTsThodnRnh/R3KYsn7wdYFAQ3VAkGzdrxcsS9Lmua1hYhJtjMFBuJn/pmoWpOWQePN9u9P1jh3IkvKN7XuwSYvoGjhE1ZM0OtpsWbHdYmFbUePu4Ruqk0Yg+eW1tkWBsj1AHq1x75BDxOShypi+8zb9zGeatF+A65PSOH1WjmpWNdbAYz97gssw==
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.sub.example.test. IN A
-SECTION ANSWER
-www.sub.example.test. 300 IN A 10.20.30.42
-www.sub.example.test.	300	IN	RRSIG	A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. YuV5CADfhJ6yjxLrIZ243RvJmDJv0NgZKVZ9k5TorSY/O8fvPDzIMJFDjVs2gk6dZV81I6MmMbbcK5I3DEeBIHMswOZEhJYgfX7TiKi4sNfJQmyJJSx1SS1YQ38Asxst4cWgg5L6aoehsIlHvAqEz+JlObNus30nO7S6zMd+rFoThdbCpADK3AhbSI8xhO1u7Q8qgBchX7JZNIt5eiKnSrLSi5UAtuNMkczWv74ckFtd5PERpBGqpJRj50z0+7qiAbdahT3YQ7y2PkiBpZTtxG8Cmza4CkGPd1qzD/DRUsWOzZyiWwX5niD51sgqMj6ApGs8wbVSsk/vBudYw1/CIA==
-ENTRY_END
-RANGE_END
-
-; ns.example.test.
-RANGE_BEGIN 0 100
-	ADDRESS 2001::1:2:3:4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-sub.example.test. IN DS
-SECTION ANSWER
-; This is the correct reply.
-sub.example.test.	300	IN	DS	29332 8 2 69c8a09889e377fb1d1af78cc55984152adf25f4643b26d42654657a171e92aa
-sub.example.test.	300	IN	RRSIG	DS 8 3 300 20201116135527 20201019135527 55567 example.test. vyjkyx1UMCI5KftU7BQWxDkxNj25A60haEIR/Sy7JUkG2UnE0tNIVNE4mEmUGX6ICsddKGwba2xFQFYBMyfpnzsNxEMKv8VpOGObpiTlK4ICRaq6m+pVND1Benk6grzkb+6T2xogHEEMYqnMUF4bDGRe5tcftS9XdAl77pG6W7Q=
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-a.sub.example.test. IN A
-ENTRY_END
-
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-a.sub.example.test. IN A
-SECTION ANSWER
-a.sub.example.test. 300 IN A 10.20.30.40
-a.sub.example.test.	300	IN	RRSIG	A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. lElblJBqr+LbNDO8mlyh9PbBzfC6LU5K8nh/fOHu9dFur5xuqtItw+D0/oo2ve6WIUnqblXKhfbZcKMa40DONog/uThmwyp6cBow7oZdfZSt5YTn74QwJb1M/yaJgU+OWNkM7RfG+VcvpB04+KH+g2qwEpHC5Jm5+e66beoiGHZuKle0qAxNAgM1kkJ5EdTngKk80YOciBv705xSSvySmCDktcIceV8zMgD9YFW1Q2I2SXtPCsVaJTA1jaf3Cm8rZfY1GrBW18JyLPOqf6eIBqdyXg/w/mi/pxgakIM3r9iKaDsEz01ZiN0jaEloteT+NhpjEJA/sFzu1nhV0Y3fJw==
-ENTRY_END
-
-STEP 20 TIME_PASSES ELAPSE 320
-; The DS record has expired, but the NS record for sub.example.test. is in
-; cache.
-
-; The DS lookup fails with wildcard CNAME.
-; Then it should blacklist the parent (1.2.3.4) not the sub zone (1.2.3.7)
-; the AAAA for the parent can then be retrieved, and it is used.
-
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.sub.example.test. IN A
-ENTRY_END
-
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-www.sub.example.test. IN A
-SECTION ANSWER
-www.sub.example.test. 300 IN A 10.20.30.42
-www.sub.example.test.	300	IN	RRSIG	A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. YuV5CADfhJ6yjxLrIZ243RvJmDJv0NgZKVZ9k5TorSY/O8fvPDzIMJFDjVs2gk6dZV81I6MmMbbcK5I3DEeBIHMswOZEhJYgfX7TiKi4sNfJQmyJJSx1SS1YQ38Asxst4cWgg5L6aoehsIlHvAqEz+JlObNus30nO7S6zMd+rFoThdbCpADK3AhbSI8xhO1u7Q8qgBchX7JZNIt5eiKnSrLSi5UAtuNMkczWv74ckFtd5PERpBGqpJRj50z0+7qiAbdahT3YQ7y2PkiBpZTtxG8Cmza4CkGPd1qzD/DRUsWOzZyiWwX5niD51sgqMj6ApGs8wbVSsk/vBudYw1/CIA==
-ENTRY_END
-
-STEP 50 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-b.sub.example.test. IN A
-ENTRY_END
-
-STEP 60 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-b.sub.example.test. IN A
-SECTION ANSWER
-b.sub.example.test. 300 IN A 10.20.30.41
-b.sub.example.test.	300	IN	RRSIG	A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. KimigOgfAWic9JVbuqMc0cE2aUlfzBaG+LjZl5IqZr7RLeImG74cpBMbTyzWJ1h3IhCKnLde3KMYz+viVEwsirxlY70i3cDObl5t9XlBKombQzCJBMv5MNCGH1iYfsBL6JVhVX849J1fRTK7E6mW2v9eN0GUFplTsThodnRnh/R3KYsn7wdYFAQ3VAkGzdrxcsS9Lmua1hYhJtjMFBuJn/pmoWpOWQePN9u9P1jh3IkvKN7XuwSYvoGjhE1ZM0OtpsWbHdYmFbUePu4Ruqk0Yg+eW1tkWBsj1AHq1x75BDxOShypi+8zb9zGeatF+A65PSOH1WjmpWNdbAYz97gssw==
-ENTRY_END
-
-SCENARIO_END

testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.test

@@ -8,7 +8,7 @@
 if nc -h 2>&1 | grep "q secs"; then
 	ncopt="-q 3 -i 2"
 else
-	ncopt="-i 2 --no-shutdown"
+	ncopt="-i 2"
 fi
 
 PRE="../.."

testdata/fwd_scrub_rrsig.rpl

@@ -1,93 +0,0 @@
-; This is a comment
-server:
-
-forward-zone: name: "." forward-addr: 216.0.0.1
-CONFIG_END
-
-SCENARIO_BEGIN Test scrub of RRSIG amount
-
-RANGE_BEGIN 0 100
-	ADDRESS 216.0.0.1
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A 10.20.30.40
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MQ== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mg== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mw== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NA== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NQ== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Ng== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Nw== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . OA== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . OQ== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTA= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTE= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTI= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTM= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTQ= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTU= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTY= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTc= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTg= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTk= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjA= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjE= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjI= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjM= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjQ= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjU= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjY= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mjc= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mjg= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mjk= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzA= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzE= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzI= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzM= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzQ= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzU= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzY= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mzc= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mzg= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mzk= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NDA= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NDE= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NDI= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NDM= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NDQ= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NDU= ;{id = 12345}
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-MATCH TCP
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-STEP 4 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH opcode qname qtype all
-REPLY QR RD DO RA
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A 10.20.30.40
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MQ== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mg== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mw== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NA== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NQ== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Ng== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Nw== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . OA== ;{id = 12345}
-ENTRY_END
-SCENARIO_END

testdata/iter_dname_ttl0.rpl

@@ -1,272 +0,0 @@
-; config options
-; Test DNAME TTL=0 grace period: synthesis from cache within 1 second
-; Island of trust at example.com, DNSSEC signed DNAME with TTL=0 (RFC 2308)
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	trust-anchor: "example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test DNAME TTL=0: signed DNAME with TTL=0 and RRSIG Original TTL=0.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com. - DNAME with TTL=0 (RRSIG Original TTL=0)
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DNAME with TTL=0, RRSIG Original TTL=0 (signed with ldns-signzone)
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-foo.test-dname.example.com. IN A
-SECTION ANSWER
-test-dname.example.com.	0	IN	DNAME	example.net.
-test-dname.example.com.	0	IN	RRSIG	DNAME 3 3 0 20070926135752 20070829135752 2854 example.com. ADRb2Jl5SCTF2a9/5QFOCfwFzh4Cpt90pJptwrKc+vBHnlivGyPShrU=
-foo.test-dname.example.com. 0 IN CNAME foo.example.net.
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.	IN NS	ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-foo.example.net. IN A
-SECTION ANSWER
-foo.example.net. IN	A	11.12.13.15
-foo.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.net. X6T6SE9UzxAD/4zKpwGOxEDyE4g7lfYYw3lvw533uwRN8mWTcBvSva0/jjyhrogJcuLO32jPHK6zGb93w2xnuA==
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-foo2.example.net. IN A
-SECTION ANSWER
-foo2.example.net. IN	A	11.12.13.16
-foo2.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.net. BZm+GljD8m9N+pNJN8D+LlSyHqM+InNUe0+heKILR9be+Goqv6SEb7LKtX6+kj3239Y5by7u+/Cuk8kkWistEQ==
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-STEP 1 TIME_PASSES ELAPSE 10
-; First query: get DNAME TTL=0 into cache
-STEP 10 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-foo.test-dname.example.com. IN A
-ENTRY_END
-
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-foo.test-dname.example.com. IN A
-SECTION ANSWER
-test-dname.example.com.	0	IN	DNAME	example.net.
-test-dname.example.com.	0	IN	RRSIG	DNAME 3 3 0 20070926135752 20070829135752 2854 example.com. ADRb2Jl5SCTF2a9/5QFOCfwFzh4Cpt90pJptwrKc+vBHnlivGyPShrU=
-foo.test-dname.example.com. 0 IN CNAME foo.example.net.
-foo.example.net. IN	A	11.12.13.15
-foo.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.net. X6T6SE9UzxAD/4zKpwGOxEDyE4g7lfYYw3lvw533uwRN8mWTcBvSva0/jjyhrogJcuLO32jPHK6zGb93w2xnuA==
-ENTRY_END
-
-STEP 29 TIME_PASSES ELAPSE 1
-
-; Second query: within grace period (TIME_PASSES 1 above)
-; With cache grace: synthesis from cached TTL=0 DNAME
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-foo2.test-dname.example.com. IN A
-ENTRY_END
-
-; foo2.test-dname.example.com is not answered upstream
-; so this reply is synthesized by the cached (1 second grace period) DNAME
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-foo2.test-dname.example.com. IN A
-SECTION ANSWER
-test-dname.example.com.	0	IN	DNAME	example.net.
-test-dname.example.com.	0	IN	RRSIG	DNAME 3 3 0 20070926135752 20070829135752 2854 example.com. ADRb2Jl5SCTF2a9/5QFOCfwFzh4Cpt90pJptwrKc+vBHnlivGyPShrU=
-foo2.test-dname.example.com. 0 IN CNAME foo2.example.net.
-foo2.example.net. 	3600	IN	A	11.12.13.16
-foo2.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.net. BZm+GljD8m9N+pNJN8D+LlSyHqM+InNUe0+heKILR9be+Goqv6SEb7LKtX6+kj3239Y5by7u+/Cuk8kkWistEQ==
-ENTRY_END
-
-SCENARIO_END

testdata/iter_nat64_donotq.rpl

@@ -1,192 +0,0 @@
-; config options
-server:
-	do-nat64: yes
-	nat64-prefix: 2001:db8:1234::/96
-	target-fetch-policy: "0 0 0 0 0"
-
-	; This is like a machine that is part of a cluster of hosts that
-	; is IPv6-only, and uses NAT64. The cluster has no internet access.
-	do-not-query-address: ::0/0
-
-	qname-minimisation: no
-
-stub-zone:
-	name: "."
-	; Pick an address in the NAT64 prefix, so it is allowed.
-	; other addresses would not be allowed. Or without the bugfix,
-	; allowed depending on state machine activation sequence.
-	stub-addr: 2001:db8:1234::1
-CONFIG_END
-
-SCENARIO_BEGIN Test NAT64 transport for v4-only with do-not-query-addresses.
-
-RANGE_BEGIN 0 100
-	ADDRESS 2001:db8:1234::1
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	FAKE.ROOT.
-SECTION ADDITIONAL
-FAKE.ROOT.	IN	AAAA 2001:db8:1234::1
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-v4only. IN NS
-SECTION AUTHORITY
-v4only.	IN NS	ns.v4only.
-SECTION ADDITIONAL
-ns.v4only.	IN	A	192.0.2.1
-ENTRY_END
-
-RANGE_END
-
-; replies from NS over "NAT64"
-
-RANGE_BEGIN 0 20
-	ADDRESS 2001:db8:1234::c000:0201
-
-; A over NAT64
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY AA QR NOERROR
-SECTION QUESTION
-ns.v4only. IN A
-SECTION ANSWER
-ns.v4only.	IN	A	192.0.2.1
-SECTION AUTHORITY
-v4only.		IN	NS	ns.v4only.
-ENTRY_END
-
-; no AAAA
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY AA QR NOERROR
-SECTION QUESTION
-ns.v4only.	IN	AAAA
-SECTION AUTHORITY
-v4only.		IN	SOA	ns.v4only. host. 1 3600 300 48000 3600
-v4only.		IN	NS	ns.v4only.
-SECTION ADDITIONAL
-ns.v4only.	IN	A	192.0.2.1
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY AA QR NOERROR
-SECTION QUESTION
-v4only.		IN	NS
-SECTION ANSWER
-v4only.		IN	NS	ns.v4only.
-SECTION ADDITIONAL
-ns.v4only.	IN	A	192.0.2.1
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY AA QR NOERROR
-SECTION QUESTION
-test.v4only.	IN	A
-SECTION ANSWER
-test.v4only.	IN	A	192.0.2.2
-SECTION AUTHORITY
-v4only.		IN	NS	ns.v4only.
-SECTION ADDITIONAL
-ns.v4only.	IN	A	192.0.2.1
-ENTRY_END
-RANGE_END
-
-RANGE_BEGIN 50 100
-	ADDRESS 2001:db8:1234::c000:0201
-; no AAAA
-; The last resort lookup of the AAAA is blocked here,
-; the last resort processing is not desired, it should resolve test2
-; straight away.
-;ENTRY_BEGIN
-;MATCH opcode qtype qname
-;ADJUST copy_id
-;REPLY AA QR NOERROR
-;SECTION QUESTION
-;ns.v4only.	IN	AAAA
-;SECTION AUTHORITY
-;v4only.		IN	SOA	ns.v4only. host. 1 3600 300 48000 3600
-;v4only.		IN	NS	ns.v4only.
-;SECTION ADDITIONAL
-;ns.v4only.	IN	A	192.0.2.1
-;ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY AA QR NOERROR
-SECTION QUESTION
-ns.v4only.	IN	A
-SECTION ANSWER
-ns.v4only.	IN	A	192.0.2.1
-SECTION AUTHORITY
-v4only.		IN	NS	ns.v4only.
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY AA QR NOERROR
-SECTION QUESTION
-test2.v4only.	IN	A
-SECTION ANSWER
-test2.v4only.	IN	A	192.0.2.3
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-test.v4only. IN A
-ENTRY_END
-
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-test.v4only.	IN	A
-SECTION ANSWER
-test.v4only.	IN	A	192.0.2.2
-ENTRY_END
-
-; for a query where the upstream nameserver has a timeout.
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-test2.v4only. IN A
-ENTRY_END
-
-; Only the test2 query is there, and it has a timeout.
-; The address is already NAT64 translated, so now that it is
-; attempted again, it is looked up in dotnotq as the ipv6 address.
-STEP 40 TIMEOUT
-
-STEP 50 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-test2.v4only.	IN	A
-SECTION ANSWER
-test2.v4only.	IN	A	192.0.2.3
-ENTRY_END
-
-SCENARIO_END

testdata/iter_prefetch_fail.rpl

@@ -319,7 +319,7 @@ example.com.	360 IN NS	ns.example.com.
 SECTION ADDITIONAL
 ; this is picked up from the parent (because this simulation has the
 ; parent respond with servfail, not actually timeout)
-ns.example.com.	360 	IN 	A	1.2.3.4
+ns.example.com.	3600 	IN 	A	1.2.3.4
 ENTRY_END
 
 ; another query to see if there is another lookup towards the authority
@@ -342,7 +342,7 @@ www.example.com. 360 IN A	10.20.30.40
 SECTION AUTHORITY
 example.com.	360 IN NS	ns.example.com.
 SECTION ADDITIONAL
-ns.example.com.	360 	IN 	A	1.2.3.4
+ns.example.com.	3600 	IN 	A	1.2.3.4
 ENTRY_END
 
 ; some time later another query, and now it is fine to bother the authority
@@ -367,7 +367,7 @@ www.example.com. 330 IN A	10.20.30.40
 SECTION AUTHORITY
 example.com.	330 IN NS	ns.example.com.
 SECTION ADDITIONAL
-ns.example.com.	330 	IN 	A	1.2.3.4
+ns.example.com.	3570 	IN 	A	1.2.3.4
 ENTRY_END
 ; now the just-looked-up entry
 STEP 190 QUERY
@@ -388,7 +388,7 @@ www.example.com. 3600 IN A	10.20.30.40
 SECTION AUTHORITY
 example.com.	3600 IN NS	ns.example.com.
 SECTION ADDITIONAL
-ns.example.com.	3600 	IN 	A	1.2.3.4
+ns.example.com.	3570 	IN 	A	1.2.3.4
 ENTRY_END
 
 

testdata/iter_priv_svcb.rpl

@@ -1,283 +0,0 @@
-; config options
-server:
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: no
-	minimal-responses: yes
-	iter-scrub-promiscuous: yes
-
-	private-address: 10.0.0.0/8
-	private-address: 172.16.0.0/12
-	private-address: 192.168.0.0/16
-	private-address: 169.254.0.0/16
-	private-address: fd00::/8
-	private-address: fe80::/10
-
-	private-domain: "example.net"
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-
-CONFIG_END
-
-SCENARIO_BEGIN Test iterator scrubber with private addresses in SVCB.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-; root server authoritative for example.net too.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-mail.example.net. IN SVCB
-SECTION ANSWER
-mail.example.net. IN SVCB 1 foo.example.net. ipv4hint=10.20.30.40
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-ns.example.com. IN A
-SECTION ANSWER
-ns.example.com.		IN 	A	1.2.3.4
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-ns.example.com. IN AAAA
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA ns.example.com. root.example.com. 4 14400 3600 604800 3600
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.example.com. IN SVCB
-SECTION ANSWER
-www.example.com. IN SVCB 1 foo.example.com. ipv4hint=192.20.30.40
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-mail.example.com. IN SVCB
-SECTION ANSWER
-mail.example.com. IN SVCB 1 foo.example.com. ipv6hint=fe80::15
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-foo.example.com. IN SVCB
-SECTION ANSWER
-foo.example.com. IN SVCB 1 foo.example.com. ipv4hint=10.20.30.40
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-toss.example.com. IN SVCB
-SECTION ANSWER
-toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=10.20.30.40
-toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=10.20.30.40
-toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=1.2.3.4
-toss.example.com. IN SVCB 1 foo.example.com. ipv6hint=fe80::15
-toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=10.20.30.41
-toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=192.0.2.1,10.20.30.42,192.0.2.2
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; public address is not scrubbed
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN SVCB
-ENTRY_END
-
-; recursion happens here.
-STEP 2 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN SVCB
-SECTION ANSWER
-www.example.com. IN SVCB 1 foo.example.com. ipv4hint=192.20.30.40
-ENTRY_END
-
-; IPv4 address is scrubbed
-STEP 3 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-foo.example.com. IN SVCB
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-foo.example.com. IN SVCB
-SECTION ANSWER
-; scrubbed away
-ENTRY_END
-
-; IPv6 address is scrubbed
-STEP 20 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-mail.example.com. IN SVCB
-ENTRY_END
-
-STEP 30 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-mail.example.com. IN SVCB
-SECTION ANSWER
-ENTRY_END
-
-; allowed domain is not scrubbed.
-STEP 40 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-mail.example.net. IN SVCB
-ENTRY_END
-
-STEP 50 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-mail.example.net. IN SVCB
-SECTION ANSWER
-mail.example.net. IN SVCB 1 foo.example.net. ipv4hint=10.20.30.40
-ENTRY_END
-
-; rest of RRset intact, only 10/8 tossed away.
-STEP 60 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-toss.example.com. IN SVCB
-ENTRY_END
-
-STEP 70 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-toss.example.com. IN SVCB
-SECTION ANSWER
-toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=1.2.3.4
-ENTRY_END
-
-SCENARIO_END

testdata/iter_scrub_dname_out_of_zone.rpl

@@ -1,122 +0,0 @@
-; config options
-server:
-	harden-referral-path: no
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	minimal-responses: no
-	iter-scrub-promiscuous: no
-
-stub-zone:
-        name: "."
-	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test scrub of out-of-zone DNAME in answer section
-
-STEP 10 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-x.y.example.com. IN A
-ENTRY_END
-
-; root prime is sent
-STEP 20 CHECK_OUT_QUERY
-ENTRY_BEGIN
-MATCH qname qtype opcode
-SECTION QUESTION
-. IN NS
-ENTRY_END
-STEP 30 REPLY
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET. IN A 193.0.14.129
-ENTRY_END
-
-; query sent to root server
-STEP 40 CHECK_OUT_QUERY
-ENTRY_BEGIN
-MATCH qname qtype opcode
-SECTION QUESTION
-x.y.example.com. IN A
-ENTRY_END
-STEP 50 REPLY
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-x.y.example.com. IN A
-SECTION AUTHORITY
-com. IN NS a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net. IN A 192.5.6.30
-ENTRY_END
-
-; query sent to .com server
-STEP 60 CHECK_OUT_QUERY
-ENTRY_BEGIN
-MATCH qname qtype opcode
-SECTION QUESTION
-x.y.example.com. IN A
-ENTRY_END
-
-STEP 70 REPLY
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-x.y.example.com. IN A
-SECTION AUTHORITY
-example.com. IN NS ns1.example.com.
-SECTION ADDITIONAL
-ns1.example.com. IN A 168.192.2.2
-ENTRY_END
-
-STEP 80 CHECK_OUT_QUERY
-ENTRY_BEGIN
-MATCH qname qtype opcode
-SECTION QUESTION
-x.y.example.com. IN A
-ENTRY_END
-
-STEP 90 REPLY
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-x.y.example.com. IN A
-SECTION ANSWER
-com. DNAME z.example.com.
-SECTION AUTHORITY
-example.com. IN NS ns1.example.com.
-SECTION ADDITIONAL
-ns1.example.com. IN A 168.192.2.2
-ENTRY_END
-
-; answer to first query
-; nodata answer since the DNAME is ignored for synthesis and scrubbed
-; all together.
-STEP 120 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA
-SECTION QUESTION
-x.y.example.com. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN NS ns1.example.com.
-SECTION ADDITIONAL
-ns1.example.com. IN A 168.192.2.2
-ENTRY_END
-
-SCENARIO_END

testdata/iter_scrub_promiscuous.rpl

@@ -204,25 +204,6 @@ RANGE_END
 ; ns.pollute4.mesa
 RANGE_BEGIN 0 400
 	ADDRESS 1.2.4.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.pollute4.mesa. IN A
-SECTION ANSWER
-ns.pollute4.mesa. IN A 1.2.4.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.pollute4.mesa. IN AAAA
-SECTION AUTHORITY
-pollute4.mesa. IN SOA ns.pollute4.mesa. host.pollute4.mesa 20701 3600 3600 604800 3600
-ENTRY_END
 
 ; This is the spoofed answer that is returned.
 ENTRY_BEGIN
@@ -442,18 +423,14 @@ ENTRY_END
 STEP 130 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA SERVFAIL
+REPLY QR RD RA YXDOMAIN
 SECTION QUESTION
 test4.atkr.pollute4.mesa. IN A
-; Since the reply does not contain a DNAME, it is rejected as YXDOMAIN answer.
-;REPLY QR RD RA YXDOMAIN
-;SECTION QUESTION
-;test4.atkr.pollute4.mesa. IN A
-;SECTION ANSWER
-;test4.atkr.pollute4.mesa. 86400 IN A 1.2.3.4
-;SECTION AUTHORITY
-;; removed record
-;;pollute4.mesa.       0       IN      NS      ns.attacker.mesa.
+SECTION ANSWER
+test4.atkr.pollute4.mesa. 86400 IN A 1.2.3.4
+SECTION AUTHORITY
+; removed record
+;pollute4.mesa.       0       IN      NS      ns.attacker.mesa.
 ENTRY_END
 
 ; Check the cache contents, for query 4.

testdata/iter_svcb_malformed.rpl

@@ -1,200 +0,0 @@
-; config options
-server:
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	minimal-responses: no
-	iter-scrub-promiscuous: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test lookup of malformed SVCB
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain 
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.example.com. IN HTTPS
-SECTION ANSWER
-www.example.com. IN HTTPS \# 17 00 01 00 00 01 00 03 02 68 32 00 01 00 03 02 68 33
-; Duplicate `alpn` key (17 bytes)
-; Decoded:
-;   SvcPriority = 1  (service mode)
-;   TargetName  = .  (root label, 0x00)
-;   SvcParam[0]: key=1 (alpn), value_len=3, value=\x02h2   ← "h2"
-;   SvcParam[1]: key=1 (alpn), value_len=3, value=\x02h3   ← DUPLICATE KEY
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-testb.example.com. IN HTTPS
-SECTION ANSWER
-; The parser for testbound does allow this.
-;testb.example.com. IN HTTPS \# 9 00 01 00 00 01 00 04 02 68
-; Truncated `alpn` value (9 bytes)
-; Decoded:
-;   SvcPriority = 1
-;   TargetName  = .
-;   SvcParam[0]: key=1 (alpn), value_len=4 (claims 4 bytes), value=\x02h (only 2 bytes present)
-; placeholder for hex: testb.example.com. IN HTTPS \# 9 00 01 00 00 01 00 02 01 68
-HEX_ANSWER_BEGIN
-000084000001000100000000057465737462076578616D706C6503636F6D0000410001057465737462076578616D706C6503636F6D000041000100000E10
-0009
-0001
-00
-000100040268
-HEX_ANSWER_END
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-testc.example.com. IN HTTPS
-SECTION ANSWER
-testc.example.com. IN HTTPS \# 21 00 01 00 00 01 00 06 02 68 32 02 68 33 00 04 00 04 01 02 03 04
-; valid HTTPS RDATA
-;   SvcPriority=1, TargetName=., alpn=h2+h3, ipv4hint=1.2.3.4
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN HTTPS
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN HTTPS
-SECTION ANSWER
-www.example.com.        0       IN      HTTPS   1 . alpn="h2" alpn="h3"
-ENTRY_END
-
-STEP 20 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-testb.example.com. IN HTTPS
-ENTRY_END
-
-; recursion happens here.
-STEP 30 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH rcode
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-testb.example.com. IN HTTPS
-SECTION ANSWER
-; testb.example.com.      0       IN      HTTPS   \# 9 000100000100040268
-HEX_ANSWER_BEGIN
-000084000001000100000000057465737462076578616D706C6503636F6D0000410001057465737462076578616D706C6503636F6D000041000100000E10
-0009
-0001
-00
-000100040268
-HEX_ANSWER_END
-ENTRY_END
-
-STEP 40 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-testc.example.com. IN HTTPS
-ENTRY_END
-
-; recursion happens here.
-STEP 50 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-testc.example.com. IN HTTPS
-SECTION ANSWER
-testc.example.com.      0       IN      HTTPS   1 . alpn="h2,h3" ipv4hint=1.2.3.4
-ENTRY_END
-
-SCENARIO_END

testdata/long_qname.rpl

@@ -1,73 +0,0 @@
-; config options
-server:
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	minimal-responses: no
-	iter-scrub-promiscuous: no
-
-stub-zone:
-        name: "."
-	stub-addr: 1.2.3.4
-CONFIG_END
-
-SCENARIO_BEGIN Test long query name.
-
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qname qtype
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS ns.root.
-SECTION ADDITIONAL
-ns.root. IN A 1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-; matched anything
-MATCH opcode
-ADJUST copy_id copy_query
-REPLY QR AA NXDOMAIN
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-. SOA ns.root. host.invalid. 1 2 3 4 5
-ENTRY_END
-RANGE_END
-
-STEP 10 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-HEX_ANSWER_BEGIN
-00 00 01 00		; RD
-00 01 00 00 00 00 00 00 ; QDCOUNT=1, ANCOUNT=0, NSCOUNT=0, ARCOUNT=0.
-; www.example.com.
-;03 77 77 77
-;07 65 78 61 6d 70 6c 65
-;03 63 6f 6d
-;00
-;
-; a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.example.com.
-01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62
-07 65 78 61 6d 70 6c 65
-03 63 6f 6d
-00
-00 01 00 01
-HEX_ANSWER_END
-ENTRY_END
-
-; recursion happens here.
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD FORMERR
-SECTION QUESTION
-SECTION ANSWER
-ENTRY_END
-
-SCENARIO_END

testdata/refuse_xfr.rpl

@@ -28,11 +28,10 @@ STEP 4 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
 REPLY QR FORMERR
-; The SOA RR should not be echoed back.
-; The question section is absent, because it gives a formerr because of the
-; authority section contents.
-;SECTION QUESTION
-;nlnetlabs.nl. IN IXFR
+SECTION QUESTION
+nlnetlabs.nl. IN IXFR
+SECTION AUTHORITY
+nlnetlabs.nl. IN SOA mr. op. 12 0 0 0 0
 ENTRY_END
 
 SCENARIO_END

testdata/subnet_cached_servfail_timeout.crpl

@@ -1,239 +0,0 @@
-; Check if an SERVFAIL answer is not stored in the global cache, and
-; does not block ECS queries to reach the ECS cache.
-
-server:
-	trust-anchor-signaling: no
-	target-fetch-policy: "0 0 0 0 0"
-	;send-client-subnet: 1.2.3.4
-	client-subnet-zone: "example.com"
-	max-client-subnet-ipv4: 21
-	module-config: "subnetcache iterator"
-	verbosity: 3
-	access-control: 127.0.0.1 allow_snoop
-	qname-minimisation: no
-	minimal-responses: yes
-	prefetch: yes
-	outbound-msg-retry: 3
-	ede: yes
-	log-servfail: yes
-
-stub-zone:
-	name: "example.com."
-	stub-addr: 1.2.3.4
-CONFIG_END
-
-SCENARIO_BEGIN Test that SERVFAIL after timeout does not block clients to reach the ECS cache
-; And that withing the servfail time a couple of seconds have cached servfail
-; for the subnet queries for that name.
-
-; ns.example.com.
-RANGE_BEGIN 1 20
-ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname ednsdata
-ADJUST copy_id copy_ednsdata_assume_clientsubnet
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. 10 IN A	10.20.30.40
-SECTION AUTHORITY
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-			; client is 127.0.0.1
-	00 08 		; OPC
-	00 05 		; option length
-	00 01 		; Family
-	08 00 		; source mask, scopemask
-	7f		; address
-HEX_EDNSDATA_END
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 100 120
-ADDRESS 1.2.3.4
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname ednsdata
-ADJUST copy_id copy_ednsdata_assume_clientsubnet
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. 10 IN A	10.20.30.41
-SECTION AUTHORITY
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-			; client is 1.0.0.0
-	00 08 		; OPC
-	00 05 		; option length
-	00 01 		; Family
-	08 00 		; source mask, scopemask
-	01		; address
-HEX_EDNSDATA_END
-ENTRY_END
-RANGE_END
-
-; Put an item in subnet cache
-STEP 10 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 08	; ip4, source 8, scope 8
-	7f   		; 127.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.com.		IN A
-SECTION ANSWER
-www.example.com.	10	IN A	10.20.30.40
-SECTION AUTHORITY
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 08	; ip4, source 8, scope 8
-	7f		; 127.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-; There is a valid subnet query in cache.
-; this query timeouts.
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 00	; ip4, source 8, scope 0
-	01   		; 1.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-; This query faces timeouts during the resolution.
-; The timeouted query is the 1.0.0.0/8 subnet lookup of www.example.com. A.
-STEP 31 TIMEOUT
-STEP 32 TIMEOUT
-STEP 33 TIMEOUT
-
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD DO RA SERVFAIL
-SECTION QUESTION
-www.example.com.	IN A
-ENTRY_END
-
-; Check if subnet cache item can be accessed.
-STEP 50 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 00	; ip4, source 8, scope 0
-	7f   		; 127.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-STEP 60 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.com.		IN A
-SECTION ANSWER
-www.example.com.	10	IN A	10.20.30.40
-SECTION AUTHORITY
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 08	; ip4, source 8, scope 8
-	7f		; 127.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-; the existing subnet cache item can be accessed.
-; but another resolution, is now not cached at all?
-STEP 70 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 00	; ip4, source 8, scope 0
-	01   		; 1.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-STEP 80 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD DO RA SERVFAIL
-SECTION QUESTION
-www.example.com.	IN A
-ENTRY_END
-
-; after a couple of seconds, the servfail entry should have cleared.
-STEP 90 TIME_PASSES ELAPSE 10
-
-STEP 100 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 00	; ip4, source 8, scope 0
-	01   		; 1.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-STEP 110 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.com.		IN A
-SECTION ANSWER
-www.example.com.	10	IN A	10.20.30.41
-SECTION AUTHORITY
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 08	; ip4, source 8, scope 8
-	01		; 1.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-SCENARIO_END

testdata/subnet_scopezero_bogus.crpl

@@ -1,274 +0,0 @@
-; Test subnet option
-
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	trust-anchor-signaling: no
-	target-fetch-policy: "0 0 0 0 0"
-	send-client-subnet: 1.2.3.4
-	max-client-subnet-ipv4: 17
-	module-config: "subnetcache validator iterator"
-	verbosity: 3
-	fake-sha1: yes
-	fake-dsa: yes
-	qname-minimisation: no
-	minimal-responses: yes
-	iter-scrub-promiscuous: yes
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test subnet with scopezero bogus response
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			. IN NS
-		SECTION ANSWER
-			. IN NS	K.ROOT-SERVERS.NET.
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-	ENTRY_END
-
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			www.example.com. IN A
-		SECTION AUTHORITY
-			com.	IN NS	a.gtld-servers.net.
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			a.gtld-servers.net.	IN 	A	192.5.6.30
-	ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			com. IN NS
-		SECTION ANSWER
-			com.    IN NS   a.gtld-servers.net.
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			a.gtld-servers.net.     IN      A       192.5.6.30
-	ENTRY_END
-
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			www.example.com. IN A
-		SECTION AUTHORITY
-			example.com.	IN NS	ns.example.com.
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			ns.example.com.		IN 	A	1.2.3.4
-	ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			example.com. IN NS
-		SECTION ANSWER
-			example.com.    IN NS   ns.example.com.
-			example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			ns.example.com.         IN      A       1.2.3.4
-			ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-	ENTRY_END
-
-; no data for ns.example.com. AAAA
-	ENTRY_BEGIN
-		MATCH opcode qtype qname
-		ADJUST copy_id
-		REPLY QR AA NOERROR
-		SECTION QUESTION
-			ns.example.com. IN AAAA
-		SECTION AUTHORITY
-			example.com. IN SOA a. b. 3 28800 7200 604800 3600
-			example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. ACYHmWSLfBwPXwjI23+PW0db/DuqFwgpJYCbHOPeftbLR9nGy3nyEAE=
-			ns.example.com.	3600	IN	NSEC	op.example.com. A RRSIG NSEC
-			ns.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. AHMBw+lDAm9o2xG7v/8oWkYUc3WefUOuHFMHN9qZEp5/kooJqmlj974=
-	ENTRY_END
-
-	; response to DNSKEY priming query
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			example.com. IN DNSKEY
-		SECTION ANSWER
-			example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-			example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-		SECTION AUTHORITY
-			example.com.	IN NS	ns.example.com.
-			example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			ns.example.com.		IN 	A	1.2.3.4
-			ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-	ENTRY_END
-
-	; response to query of interest
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			www.example.com. IN A
-		SECTION ANSWER
-			; to make it bogus, the address is changed.
-			; and also the RRSIG is expired (dated in 2005).
-			;www.example.com. IN A	10.20.30.40
-			;www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-			www.example.com. IN A	10.20.30.41
-			www.example.com.        3600    IN      RRSIG   A 3 3 3600 20050926134150 20050829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-		SECTION AUTHORITY
-			example.com.	IN NS	ns.example.com.
-			example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-						; client is 127.0.0.1
-				00 08 		; OPC
-				00 07 		; option length
-				00 01 		; Family
-				11 00 		; source mask, scopemask
-				7f 00 00 	; address
-			HEX_EDNSDATA_END
-			ns.example.com.		IN 	A	1.2.3.4
-			ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
-	ENTRY_END
-
-	; response to query of interest without subnet
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			www.example.com. IN A
-		SECTION ANSWER
-			; to make it bogus, the address is changed.
-			; and also the RRSIG is expired (dated in 2005).
-			;www.example.com. IN A	10.20.30.40
-			;www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-			www.example.com. IN A	10.20.30.41
-			www.example.com.        3600    IN      RRSIG   A 3 3 3600 20050926134150 20050829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-		SECTION AUTHORITY
-			example.com.	IN NS	ns.example.com.
-			example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			ns.example.com.		IN 	A	1.2.3.4
-			ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
-	ENTRY_END
-RANGE_END
-
-; query for www.example.com 0.0.0.0/0 with CD flag
-STEP 10 QUERY
-ENTRY_BEGIN
-REPLY RD CD DO NOERROR
-SECTION QUESTION
-www.example.com. IN A
-HEX_EDNSDATA_BEGIN
-			; 0.0.0.0/0 scope /0
-	00 08           ; OPC
-	00 04           ; option length
-	00 01           ; Family
-	00 00           ; source mask, scopemask
-	                ; address
-HEX_EDNSDATA_END
-ENTRY_END
-
-; recursion happens here.
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-	MATCH all ednsdata
-	REPLY QR RD CD RA DO NOERROR
-	SECTION QUESTION
-		www.example.com. IN A
-	SECTION ANSWER
-		www.example.com. IN A	10.20.30.41
-		www.example.com.        3600    IN      RRSIG   A 3 3 3600 20050926134150 20050829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-				; 0.0.0.0/0 scope /0
-		00 08           ; OPC
-		00 04           ; option length
-		00 01           ; Family
-		00 00           ; source mask, scopemask
-	                	; address
-		HEX_EDNSDATA_END
-ENTRY_END
-
-; query for www.example.com 0.0.0.0/0 without CD flag
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD DO NOERROR
-SECTION QUESTION
-www.example.com. IN A
-HEX_EDNSDATA_BEGIN
-			; 0.0.0.0/0 scope /0
-	00 08           ; OPC
-	00 04           ; option length
-	00 01           ; Family
-	00 00           ; source mask, scopemask
-	                ; address
-HEX_EDNSDATA_END
-ENTRY_END
-
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-	MATCH all ednsdata
-	REPLY QR RD RA DO SERVFAIL
-	SECTION QUESTION
-		www.example.com. IN A
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-;				; 0.0.0.0/0 scope /0
-;		00 08           ; OPC
-;		00 04           ; option length
-;		00 01           ; Family
-;		00 00           ; source mask, scopemask
-;				; address
-		HEX_EDNSDATA_END
-ENTRY_END
-
-SCENARIO_END

testdata/test_sigs.revoked

@@ -15,29 +15,10 @@ ENTRY_END
 ; entry to test
 ENTRY_BEGIN
 SECTION QUESTION
-bogus.example.com.       IN      SOA
+secure.example.com.       IN      SOA
 SECTION ANSWER
-; The REVOKE key is not allowed to sign other data
 example.com.  43200   IN      SOA     home.kuroiwa.eng.br. hostmaster.cesar.sec3.br. 2008040903 86400 86400 8640000 600
 example.com.	43200	IN	RRSIG	SOA 5 2 43200 20081010000000 20080410122550 31027 example.com. af7nqRak6cEeQLytqLHMIUKPsOECA4Cu/Zpm7vdnKSh2q2+/8ZwIxwHLyCEGdiu/mTYffZEHTZytJyzxnB0oxA== ;{id = 31027}
 ENTRY_END
 
-; entry to test
-ENTRY_BEGIN
-SECTION QUESTION
-bogus.a.example.com.       IN      DNSKEY
-SECTION ANSWER
-a.example.com. 3600    IN      DNSKEY  384 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3
-a.example.com.	3600	IN	RRSIG	DNSKEY 5 3 3600 20081010000000 20080410122550 31027 example.com. MdkvlzXlNEUrnk7jTXZ0whEjYLp1bGjOevL4yyzWAl+/LgaQqbFVApXbAQhHvouFQeoMp2+NvEGTLW8unBzJEw==
-ENTRY_END
-
-; entry to test
-ENTRY_BEGIN
-SECTION QUESTION
-secure.example.com.       IN      DNSKEY
-SECTION ANSWER
-; the REVOKE key can sign itself
-example.com.	3600	IN	DNSKEY	384 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 31027 (zsk), size = 512b}
-example.com.	3600	IN	RRSIG	DNSKEY 5 2 3600 20081010000000 20080410122550 31027 example.com. NEEY7W2F0XGUo9pVhiLALoz1ToM1gIS4TwUvVBPlIQMF+ZRGtB7PMthV0BN+aR+AEurxYsMfVmXEH2vKUVepgw==
-ENTRY_END