1.0.0 tag.

git-svn-id: file:///svn/unbound/tags/release-1.0.0@1084 be551aaa-1e26-0410-a405-d3ace91eadb9

Makefile.in

@@ -114,7 +114,7 @@ ALL_OBJ=$(addprefix $(BUILD),$(ALL_SRC:.c=.o) \
 
 COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS)
 LINK=$(LIBTOOL) --tag=CC --mode=link $(CC) $(staticexe) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS)
-LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS) $(staticexe) -release $(VERSION) -no-undefined
+LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS) $(staticexe) -version-number @LIBUNBOUND_CURRENT@:@LIBUNBOUND_REVISION@:@LIBUNBOUND_AGE@ -no-undefined
 
 .PHONY:	clean realclean doc lint all install uninstall tests test download_ldns strip lib
 
@@ -227,6 +227,7 @@ util/configparser.c util/configparser.h:  $(srcdir)/util/configparser.y
 
 clean:
 	rm -f *.o *.d *.lo *~ tags
+	rm -f unbound unbound-checkconf unbound-host
 	rm -rf autom4te.cache .libs build doc/html
 
 realclean: clean
@@ -257,35 +258,35 @@ strip:
 	strip unbound-host
 
 install:
-	$(INSTALL) -m 755 -d $(sbindir)
-	$(INSTALL) -m 755 -d $(mandir)
-	$(INSTALL) -m 755 -d $(mandir)/man8
-	$(INSTALL) -m 755 -d $(mandir)/man5
-	$(INSTALL) -m 755 -d $(mandir)/man3
-	$(INSTALL) -m 755 -d $(mandir)/man1
-	$(INSTALL) -m 755 -d $(libdir)
-	$(INSTALL) -m 755 -d $(includedir)
-	$(LIBTOOL) --mode=install cp unbound $(sbindir)/unbound
-	$(LIBTOOL) --mode=install cp unbound-checkconf $(sbindir)/unbound-checkconf
-	$(LIBTOOL) --mode=install cp unbound-host $(sbindir)/unbound-host
-	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound.8 $(mandir)/man8
-	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-checkconf.8 $(mandir)/man8
-	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound.conf.5 $(mandir)/man5
-	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-host.1 $(mandir)/man1
-	$(INSTALL) -c -m 644 $(srcdir)/doc/libunbound.3 $(mandir)/man3
-	if test ! -e $(configfile); then $(INSTALL) -d `dirname $(configfile)`; $(INSTALL) -c -m 644 $(srcdir)/doc/example.conf $(configfile); fi
-	$(LIBTOOL) --mode=install cp $(srcdir)/libunbound/unbound.h $(includedir)/unbound.h
-	$(LIBTOOL) --mode=install cp libunbound.la $(libdir)
-	$(LIBTOOL) --mode=finish $(libdir)
+	$(INSTALL) -m 755 -d $(DESTDIR)$(sbindir)
+	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)
+	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man8
+	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man5
+	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man3
+	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man1
+	$(INSTALL) -m 755 -d $(DESTDIR)$(libdir)
+	$(INSTALL) -m 755 -d $(DESTDIR)$(includedir)
+	$(LIBTOOL) --mode=install cp unbound $(DESTDIR)$(sbindir)/unbound
+	$(LIBTOOL) --mode=install cp unbound-checkconf $(DESTDIR)$(sbindir)/unbound-checkconf
+	$(LIBTOOL) --mode=install cp unbound-host $(DESTDIR)$(sbindir)/unbound-host
+	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound.8 $(DESTDIR)$(mandir)/man8
+	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-checkconf.8 $(DESTDIR)$(mandir)/man8
+	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound.conf.5 $(DESTDIR)$(mandir)/man5
+	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-host.1 $(DESTDIR)$(mandir)/man1
+	$(INSTALL) -c -m 644 $(srcdir)/doc/libunbound.3 $(DESTDIR)$(mandir)/man3
+	if test ! -e $(DESTDIR)$(configfile); then $(INSTALL) -d `dirname $(DESTDIR)$(configfile)`; $(INSTALL) -c -m 644 $(srcdir)/doc/example.conf $(DESTDIR)$(configfile); fi
+	$(LIBTOOL) --mode=install cp $(srcdir)/libunbound/unbound.h $(DESTDIR)$(includedir)/unbound.h
+	$(LIBTOOL) --mode=install cp libunbound.la $(DESTDIR)$(libdir)
+	$(LIBTOOL) --mode=finish $(DESTDIR)$(libdir)
 
 uninstall:
-	rm -f -- $(sbindir)/unbound $(sbindir)/unbound-checkconf $(sbindir)/unbound-host
-	rm -f -- $(mandir)/man8/unbound.8 $(mandir)/man8/unbound-checkconf.8 $(mandir)/man5/unbound.conf.5
-	rm -f -- $(mandir)/man1/unbound-host.1 $(mandir)/man3/libunbound.3
-	rm -f -- $(includedir)/unbound.h
-	$(LIBTOOL) --mode=uninstall rm -f $(libdir)/libunbound.la
+	rm -f -- $(DESTDIR)$(sbindir)/unbound $(DESTDIR)$(sbindir)/unbound-checkconf $(DESTDIR)$(sbindir)/unbound-host
+	rm -f -- $(DESTDIR)$(mandir)/man8/unbound.8 $(DESTDIR)$(mandir)/man8/unbound-checkconf.8 $(DESTDIR)$(mandir)/man5/unbound.conf.5
+	rm -f -- $(DESTDIR)$(mandir)/man1/unbound-host.1 $(DESTDIR)$(mandir)/man3/libunbound.3
+	rm -f -- $(DESTDIR)$(includedir)/unbound.h
+	$(LIBTOOL) --mode=uninstall rm -f $(DESTDIR)$(libdir)/libunbound.la
 	@echo
-	@echo "You still need to remove `dirname $(configfile)` , $(configfile) by hand"
+	@echo "You still need to remove "`dirname $(DESTDIR)$(configfile)`" , $(DESTDIR)$(configfile) by hand"
 
 download_ldns:
 	svn export https://www.nlnetlabs.nl/ldns/svn/trunk/makedist.sh ldns_makedist.sh
@@ -293,6 +294,12 @@ download_ldns:
 	mv ldns-*_pre_*.tar.gz ldns-src.tar.gz
 	rm ldns-*_pre_*.tar.gz.sha1 ldns_makedist.sh
 
+iana_update:
+	curl -o port-numbers.tmp http://www.iana.org/assignments/port-numbers
+	egrep -v "Unassigned|Reserved" port-numbers.tmp | awk '{ match($$0, "[0-9]+/udp"); if (RLENGTH > 0) print substr($$0, RSTART, RLENGTH - 4) ","}' | sort -nu > portslist.tmp
+	cat portslist.tmp > util/iana_ports.inc
+	rm -f port-numbers.tmp portslist.tmp
+
 # Automatic dependencies.
 $(BUILD)%.d: $(srcdir)/%.c
 	$(INFO) Depend $<

config.h.in

@@ -27,6 +27,9 @@
 /* Define to 1 if you have the `event_base_free' function. */
 #undef HAVE_EVENT_BASE_FREE
 
+/* Define to 1 if you have the `event_base_get_method' function. */
+#undef HAVE_EVENT_BASE_GET_METHOD
+
 /* Define to 1 if you have the `event_base_once' function. */
 #undef HAVE_EVENT_BASE_ONCE
 
@@ -130,6 +133,9 @@
 /* Define to 1 if you have the <sys/param.h> header file. */
 #undef HAVE_SYS_PARAM_H
 
+/* Define to 1 if you have the <sys/resource.h> header file. */
+#undef HAVE_SYS_RESOURCE_H
+
 /* Define to 1 if you have the <sys/socket.h> header file. */
 #undef HAVE_SYS_SOCKET_H
 
@@ -262,6 +268,9 @@
 /* Define to `int' if <sys/types.h> does not define. */
 #undef pid_t
 
+/* Define to 'int' if not defined */
+#undef rlim_t
+
 /* Define to `unsigned int' if <sys/types.h> does not define. */
 #undef size_t
 

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.61 for unbound 0.10.
+# Generated by GNU Autoconf 2.61 for unbound 1.0.0.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -724,8 +724,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='0.10'
-PACKAGE_STRING='unbound 0.10'
+PACKAGE_VERSION='1.0.0'
+PACKAGE_STRING='unbound 1.0.0'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 
 # Factoring default headers for most tests.
@@ -801,6 +801,9 @@ LIBS
 build_alias
 host_alias
 target_alias
+LIBUNBOUND_CURRENT
+LIBUNBOUND_REVISION
+LIBUNBOUND_AGE
 CC
 CFLAGS
 LDFLAGS
@@ -1359,7 +1362,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 0.10 to adapt to many kinds of systems.
+\`configure' configures unbound 1.0.0 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1424,7 +1427,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 0.10:";;
+     short | recursive ) echo "Configuration of unbound 1.0.0:";;
    esac
   cat <<\_ACEOF
 
@@ -1549,7 +1552,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 0.10
+unbound configure 1.0.0
 generated by GNU Autoconf 2.61
 
 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1563,7 +1566,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 0.10, which was
+It was created by unbound $as_me 1.0.0, which was
 generated by GNU Autoconf 2.61.  Invocation command line was
 
   $ $0 $@
@@ -1917,6 +1920,33 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
 
+LIBUNBOUND_CURRENT=0
+LIBUNBOUND_REVISION=12
+LIBUNBOUND_AGE=0
+# 1.0.0 had 0:12:0
+
+#   Current  -- the number of the binary API that we're implementing
+#   Revision -- which iteration of the implementation of the binary
+#               API are we supplying?
+#   Age      -- How many previous binary API versions do we also
+#               support?
+#
+# If we release a new version that does not change the binary API,
+# increment Revision.
+#
+# If we release a new version that changes the binary API, but does
+# not break programs compiled against the old binary API, increment
+# Current and Age.  Set Revision to 0, since this is the first
+# implementation of the new API.
+#
+# Otherwise, we're changing the binary API and breaking bakward
+# compatibility with old binaries.  Increment Current.  Set Age to 0,
+# since we're backward compatible with no previous APIs.  Set Revision
+# to 0 too.
+
+
+
+
 CFLAGS=
 ac_ext=c
 ac_cpp='$CPP $CPPFLAGS'
@@ -3263,16 +3293,7 @@ rm -f conftest*
 
 case "$prefix" in
         NONE)
-                case "$sysconfdir" in
-                        '${prefix}/etc')
-                                sysconfdir=/etc
-                        ;;
-                esac
-                case "$localstatedir" in
-                        '${prefix}/var')
-                                localstatedir=/var
-                        ;;
-                esac
+		prefix="/usr/local"
         ;;
 esac
 
@@ -4647,7 +4668,6 @@ fi
 
 
 
-# Use libtool
 for ac_prog in glibtool libtool15 libtool
 do
   # Extract the first word of "$ac_prog", so it can be a program name with args.
@@ -5752,7 +5772,7 @@ ia64-*-hpux*)
   ;;
 *-*-irix6*)
   # Find out which ABI we are using.
-  echo '#line 5755 "configure"' > conftest.$ac_ext
+  echo '#line 5775 "configure"' > conftest.$ac_ext
   if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -7054,11 +7074,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7057: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7077: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:7061: \$? = $ac_status" >&5
+   echo "$as_me:7081: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -7322,11 +7342,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7325: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7345: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:7329: \$? = $ac_status" >&5
+   echo "$as_me:7349: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -7426,11 +7446,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7429: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7449: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:7433: \$? = $ac_status" >&5
+   echo "$as_me:7453: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -8891,7 +8911,7 @@ linux*)
   libsuff=
   case "$host_cpu" in
   x86_64*|s390x*|powerpc64*)
-    echo '#line 8894 "configure"' > conftest.$ac_ext
+    echo '#line 8914 "configure"' > conftest.$ac_ext
     if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -9755,7 +9775,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 9758 "configure"
+#line 9778 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -9855,7 +9875,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 9858 "configure"
+#line 9878 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -12191,11 +12211,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:12194: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:12214: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:12198: \$? = $ac_status" >&5
+   echo "$as_me:12218: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -12295,11 +12315,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:12298: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:12318: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:12302: \$? = $ac_status" >&5
+   echo "$as_me:12322: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -12831,7 +12851,7 @@ linux*)
   libsuff=
   case "$host_cpu" in
   x86_64*|s390x*|powerpc64*)
-    echo '#line 12834 "configure"' > conftest.$ac_ext
+    echo '#line 12854 "configure"' > conftest.$ac_ext
     if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -13886,11 +13906,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:13889: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:13909: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:13893: \$? = $ac_status" >&5
+   echo "$as_me:13913: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -13990,11 +14010,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:13993: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:14013: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:13997: \$? = $ac_status" >&5
+   echo "$as_me:14017: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -15435,7 +15455,7 @@ linux*)
   libsuff=
   case "$host_cpu" in
   x86_64*|s390x*|powerpc64*)
-    echo '#line 15438 "configure"' > conftest.$ac_ext
+    echo '#line 15458 "configure"' > conftest.$ac_ext
     if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -16209,11 +16229,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16212: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16232: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:16216: \$? = $ac_status" >&5
+   echo "$as_me:16236: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -16477,11 +16497,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16480: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16500: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:16484: \$? = $ac_status" >&5
+   echo "$as_me:16504: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -16581,11 +16601,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16584: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16604: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:16588: \$? = $ac_status" >&5
+   echo "$as_me:16608: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -18046,7 +18066,7 @@ linux*)
   libsuff=
   case "$host_cpu" in
   x86_64*|s390x*|powerpc64*)
-    echo '#line 18049 "configure"' > conftest.$ac_ext
+    echo '#line 18069 "configure"' > conftest.$ac_ext
     if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -19437,7 +19457,8 @@ fi
 
 
 
-for ac_header in stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h arpa/inet.h syslog.h
+
+for ac_header in stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h sys/resource.h arpa/inet.h syslog.h
 do
 as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
 { echo "$as_me:$LINENO: checking for $ac_header" >&5
@@ -20354,6 +20375,75 @@ _ACEOF
 fi
 
 
+{ echo "$as_me:$LINENO: checking for rlim_t" >&5
+echo $ECHO_N "checking for rlim_t... $ECHO_C" >&6; }
+if test "${ac_cv_type_rlim_t+set}" = set; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+$ac_includes_default
+#if HAVE_SYS_RESOURCE_H
+#  include <sys/resource.h>
+#endif
+
+
+typedef rlim_t ac__type_new_;
+int
+main ()
+{
+if ((ac__type_new_ *) 0)
+  return 0;
+if (sizeof (ac__type_new_))
+  return 0;
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  ac_cv_type_rlim_t=yes
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_cv_type_rlim_t=no
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+{ echo "$as_me:$LINENO: result: $ac_cv_type_rlim_t" >&5
+echo "${ECHO_T}$ac_cv_type_rlim_t" >&6; }
+if test $ac_cv_type_rlim_t = yes; then
+  :
+else
+
+cat >>confdefs.h <<\_ACEOF
+#define rlim_t unsigned long
+_ACEOF
+
+fi
+
 { echo "$as_me:$LINENO: checking for socklen_t" >&5
 echo $ECHO_N "checking for socklen_t... $ECHO_C" >&6; }
 if test "${ac_cv_type_socklen_t+set}" = set; then
@@ -20600,6 +20690,15 @@ else
   enable_rpath=yes
 fi
 
+if test "x$enable_rpath" = xno; then
+	{ echo "$as_me:$LINENO: result: Fixing libtool for -rpath problems." >&5
+echo "${ECHO_T}Fixing libtool for -rpath problems." >&6; }
+	sed < libtool > libtool-2 \
+	's/^hardcode_libdir_flag_spec.*$'/'hardcode_libdir_flag_spec=" -D__LIBTOOL_RPATH_SED__ "/'
+	mv libtool-2 libtool
+	chmod 755 libtool
+	libtool="./libtool"
+fi
 
 # Checks for libraries.
 
@@ -21871,8 +21970,71 @@ if test "$ac_res" != no; then
 
 fi
 
-# check for library used by libevent after 1.3c
-{ echo "$as_me:$LINENO: checking for library containing clock_gettime" >&5
+
+# check for libevent
+
+# Check whether --with-libevent was given.
+if test "${with_libevent+set}" = set; then
+  withval=$with_libevent;
+else
+   withval="no"
+fi
+
+if test x_$withval == x_yes -o x_$withval != x_no; then
+        { echo "$as_me:$LINENO: checking for libevent" >&5
+echo $ECHO_N "checking for libevent... $ECHO_C" >&6; }
+        if test x_$withval = x_ -o x_$withval = x_yes; then
+            withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
+        fi
+        for dir in $withval; do
+            thedir="$dir"
+            if test -f "$dir/include/event.h"; then
+                found_libevent="yes"
+                CPPFLAGS="$CPPFLAGS -I$thedir/include"
+                break;
+            fi
+        done
+        if test x_$found_libevent != x_yes; then
+		if test -f "$dir/event.h" -a \( -f "$dir/libevent.la" -o -f "$dir/libev.la" \) ; then
+			# libevent source directory
+            		{ echo "$as_me:$LINENO: result: found in $thedir" >&5
+echo "${ECHO_T}found in $thedir" >&6; }
+                	CPPFLAGS="$CPPFLAGS -I$thedir -I$thedir/include"
+			BAK_LDFLAGS="$LDFLAGS"
+			# remove evdns from linking
+			mkdir build >/dev/null 2>&1
+			mkdir build/libevent >/dev/null 2>&1
+			mkdir build/libevent/.libs >/dev/null 2>&1
+			ev_files_o=`ls $thedir/*.o | grep -v evdns\.o`
+			ev_files_lo=`ls $thedir/*.lo | grep -v evdns\.lo`
+			ev_files_libso=`ls $thedir/.libs/*.o | grep -v evdns\.o`
+			cp $ev_files_o build/libevent
+			cp $ev_files_lo build/libevent
+			cp $ev_files_libso build/libevent/.libs
+            		LATE_LDFLAGS="build/libevent/*.lo -lm"
+			LDFLAGS="build/libevent/*.o $LDFLAGS -lm"
+		else
+            		{ { echo "$as_me:$LINENO: error: Cannot find the libevent library in $withval
+You can restart ./configure --with-libevent=no to use a builtin alternative.
+Please note that this alternative is not as capable as libevent when using
+large outgoing port ranges.  " >&5
+echo "$as_me: error: Cannot find the libevent library in $withval
+You can restart ./configure --with-libevent=no to use a builtin alternative.
+Please note that this alternative is not as capable as libevent when using
+large outgoing port ranges.  " >&2;}
+   { (exit 1); exit 1; }; }
+		fi
+        else
+            { echo "$as_me:$LINENO: result: found in $thedir" >&5
+echo "${ECHO_T}found in $thedir" >&6; }
+            LDFLAGS="$LDFLAGS -L$thedir/lib"
+	    if test "x$enable_rpath" = xyes; then
+	        RUNTIME_PATH="$RUNTIME_PATH -R$thedir/lib"
+	    fi
+        fi
+
+	# check for library used by libevent after 1.3c
+	{ echo "$as_me:$LINENO: checking for library containing clock_gettime" >&5
 echo $ECHO_N "checking for library containing clock_gettime... $ECHO_C" >&6; }
 if test "${ac_cv_search_clock_gettime+set}" = set; then
   echo $ECHO_N "(cached) $ECHO_C" >&6
@@ -21956,68 +22118,6 @@ if test "$ac_res" != no; then
 fi
 
 
-# check for libevent
-
-# Check whether --with-libevent was given.
-if test "${with_libevent+set}" = set; then
-  withval=$with_libevent;
-else
-   withval="no"
-fi
-
-if test x_$withval == x_yes -o x_$withval != x_no; then
-        { echo "$as_me:$LINENO: checking for libevent" >&5
-echo $ECHO_N "checking for libevent... $ECHO_C" >&6; }
-        if test x_$withval = x_ -o x_$withval = x_yes; then
-            withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
-        fi
-        for dir in $withval; do
-            thedir="$dir"
-            if test -f "$dir/include/event.h"; then
-                found_libevent="yes"
-                CPPFLAGS="$CPPFLAGS -I$thedir/include"
-                break;
-            fi
-        done
-        if test x_$found_libevent != x_yes; then
-		if test -f "$dir/event.h" -a -f "$dir/libevent.la"; then
-			# libevent source directory
-            		{ echo "$as_me:$LINENO: result: found in $thedir" >&5
-echo "${ECHO_T}found in $thedir" >&6; }
-                	CPPFLAGS="$CPPFLAGS -I$thedir"
-			BAK_LDFLAGS="$LDFLAGS"
-			# remove evdns from linking
-			mkdir build >/dev/null 2>&1
-			mkdir build/libevent >/dev/null 2>&1
-			mkdir build/libevent/.libs >/dev/null 2>&1
-			ev_files_o=`ls $thedir/*.o | grep -v evdns\.o`
-			ev_files_lo=`ls $thedir/*.lo | grep -v evdns\.lo`
-			ev_files_libso=`ls $thedir/.libs/*.o | grep -v evdns\.o`
-			cp $ev_files_o build/libevent
-			cp $ev_files_lo build/libevent
-			cp $ev_files_libso build/libevent/.libs
-            		LATE_LDFLAGS="build/libevent/*.lo"
-			LDFLAGS="build/libevent/*.o $LDFLAGS"
-		else
-            		{ { echo "$as_me:$LINENO: error: Cannot find the libevent library in $withval
-You can restart ./configure --with-libevent=no to use a builtin alternative.
-Please note that this alternative is not as capable as libevent when using
-large outgoing port ranges.  " >&5
-echo "$as_me: error: Cannot find the libevent library in $withval
-You can restart ./configure --with-libevent=no to use a builtin alternative.
-Please note that this alternative is not as capable as libevent when using
-large outgoing port ranges.  " >&2;}
-   { (exit 1); exit 1; }; }
-		fi
-        else
-            { echo "$as_me:$LINENO: result: found in $thedir" >&5
-echo "${ECHO_T}found in $thedir" >&6; }
-            LDFLAGS="$LDFLAGS -L$thedir/lib"
-	    if test "x$enable_rpath" = xyes; then
-	        RUNTIME_PATH="$RUNTIME_PATH -R$thedir/lib"
-	    fi
-        fi
-
 	{ echo "$as_me:$LINENO: checking for library containing event_set" >&5
 echo $ECHO_N "checking for library containing event_set... $ECHO_C" >&6; }
 if test "${ac_cv_search_event_set+set}" = set; then
@@ -22347,6 +22447,100 @@ _ACEOF
 fi
 done
  # only in libevent 1.4? and later
+
+for ac_func in event_base_get_method
+do
+as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
+{ echo "$as_me:$LINENO: checking for $ac_func" >&5
+echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
+if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
+  echo $ECHO_N "(cached) $ECHO_C" >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
+   For example, HP-UX 11i <limits.h> declares gettimeofday.  */
+#define $ac_func innocuous_$ac_func
+
+/* System header to define __stub macros and hopefully few prototypes,
+    which can conflict with char $ac_func (); below.
+    Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+    <limits.h> exists even on freestanding compilers.  */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef $ac_func
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char $ac_func ();
+/* The GNU C library defines this for functions which it implements
+    to always fail with ENOSYS.  Some functions are actually named
+    something starting with __ and the normal name is an alias.  */
+#if defined __stub_$ac_func || defined __stub___$ac_func
+choke me
+#endif
+
+int
+main ()
+{
+return $ac_func ();
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
+  (eval "$ac_link") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest$ac_exeext &&
+       $as_test_x conftest$ac_exeext; then
+  eval "$as_ac_var=yes"
+else
+  echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	eval "$as_ac_var=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+      conftest$ac_exeext conftest.$ac_ext
+fi
+ac_res=`eval echo '${'$as_ac_var'}'`
+	       { echo "$as_me:$LINENO: result: $ac_res" >&5
+echo "${ECHO_T}$ac_res" >&6; }
+if test `eval echo '${'$as_ac_var'}'` = yes; then
+  cat >>confdefs.h <<_ACEOF
+#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+done
+ # only in libevent 1.4.3 and later
 	if test -n "$BAK_LDFLAGS"; then
 		LDFLAGS="$BAK_LDFLAGS"
 	fi
@@ -25213,7 +25407,7 @@ exec 6>&1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 0.10, which was
+This file was extended by unbound $as_me 1.0.0, which was
 generated by GNU Autoconf 2.61.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -25262,7 +25456,7 @@ Report bugs to <bug-autoconf@gnu.org>."
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF
 ac_cs_version="\\
-unbound config.status 0.10
+unbound config.status 1.0.0
 configured by $0, generated by GNU Autoconf 2.61,
   with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
 
@@ -25469,6 +25663,9 @@ LIBS!$LIBS$ac_delim
 build_alias!$build_alias$ac_delim
 host_alias!$host_alias$ac_delim
 target_alias!$target_alias$ac_delim
+LIBUNBOUND_CURRENT!$LIBUNBOUND_CURRENT$ac_delim
+LIBUNBOUND_REVISION!$LIBUNBOUND_REVISION$ac_delim
+LIBUNBOUND_AGE!$LIBUNBOUND_AGE$ac_delim
 CC!$CC$ac_delim
 CFLAGS!$CFLAGS$ac_delim
 LDFLAGS!$LDFLAGS$ac_delim
@@ -25515,7 +25712,7 @@ ldnsdir!$ldnsdir$ac_delim
 LTLIBOBJS!$LTLIBOBJS$ac_delim
 _ACEOF
 
-  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 81; then
+  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 84; then
     break
   elif $ac_last_try; then
     { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5

configure.ac

@@ -2,26 +2,44 @@
 # Process this file with autoconf to produce a configure script.
 AC_PREREQ(2.57)
 
-AC_INIT(unbound, 0.10, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound,1.0.0, unbound-bugs@nlnetlabs.nl, unbound)
+
+LIBUNBOUND_CURRENT=0
+LIBUNBOUND_REVISION=12
+LIBUNBOUND_AGE=0
+# 1.0.0 had 0:12:0
+
+#   Current  -- the number of the binary API that we're implementing
+#   Revision -- which iteration of the implementation of the binary
+#               API are we supplying?
+#   Age      -- How many previous binary API versions do we also
+#               support?
+#
+# If we release a new version that does not change the binary API,
+# increment Revision.
+#
+# If we release a new version that changes the binary API, but does
+# not break programs compiled against the old binary API, increment
+# Current and Age.  Set Revision to 0, since this is the first
+# implementation of the new API.
+#
+# Otherwise, we're changing the binary API and breaking bakward
+# compatibility with old binaries.  Increment Current.  Set Age to 0,
+# since we're backward compatible with no previous APIs.  Set Revision
+# to 0 too.
+AC_SUBST(LIBUNBOUND_CURRENT)
+AC_SUBST(LIBUNBOUND_REVISION)
+AC_SUBST(LIBUNBOUND_AGE)
 
 CFLAGS=
 AC_AIX
 
 dnl
-dnl By default set $sysconfdir to /etc and $localstatedir to /var
+dnl By default set prefix to /usr/local
 dnl
 case "$prefix" in
         NONE)
-                case "$sysconfdir" in
-                        '${prefix}/etc')
-                                sysconfdir=/etc
-                        ;;
-                esac
-                case "$localstatedir" in
-                        '${prefix}/var')
-                                localstatedir=/var
-                        ;;
-                esac
+		prefix="/usr/local"
         ;;
 esac
 
@@ -340,7 +358,6 @@ AC_DEFUN([AC_PROG_OBJC], [:])
 AC_DEFUN([AC_PROG_OBJCCPP], [:])
 AC_DEFUN([AC_LIBTOOL_CXX], [:])
 AC_DEFUN([AC_LIBTOOL_F77], [:])
-# Use libtool 
 AC_CHECK_PROGS(libtool, [glibtool libtool15 libtool], [./libtool])
 AC_PATH_TOOL(AR, ar, [false])
 if test $AR = false; then
@@ -358,7 +375,7 @@ AC_PROG_LIBTOOL
 
 # Checks for header files.
 AC_HEADER_STDC
-AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h arpa/inet.h syslog.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h sys/resource.h arpa/inet.h syslog.h],,, [AC_INCLUDES_DEFAULT])
 
 # check for types
 AC_CHECK_TYPE(int8_t, char)
@@ -376,6 +393,13 @@ AC_TYPE_PID_T
 AC_TYPE_OFF_T
 AC_CHECK_TYPE(u_char, unsigned char)
 
+AC_CHECK_TYPE(rlim_t, , 
+	[AC_DEFINE([rlim_t], [unsigned long], [Define to 'int' if not defined])], [
+AC_INCLUDES_DEFAULT
+#if HAVE_SYS_RESOURCE_H
+#  include <sys/resource.h>
+#endif
+])
 AC_CHECK_TYPE(socklen_t, , 
 	[AC_DEFINE([socklen_t], [int], [Define to 'int' if not defined])], [
 AC_INCLUDES_DEFAULT
@@ -427,6 +451,14 @@ dnl Check whether to use rpath or not
 AC_ARG_ENABLE(rpath,
         [  --disable-rpath         disable hardcoded rpath (default=enabled)],
 	enable_rpath=$enableval, enable_rpath=yes)
+if test "x$enable_rpath" = xno; then
+	AC_MSG_RESULT([Fixing libtool for -rpath problems.])
+	sed < libtool > libtool-2 \
+	's/^hardcode_libdir_flag_spec.*$'/'hardcode_libdir_flag_spec=" -D__LIBTOOL_RPATH_SED__ "/'
+	mv libtool-2 libtool
+	chmod 755 libtool
+	libtool="./libtool"
+fi
 
 # Checks for libraries.
 AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
@@ -508,8 +540,6 @@ fi
 # check to see if libraries are needed for these functions.
 AC_SEARCH_LIBS([inet_pton], [nsl])
 AC_SEARCH_LIBS([socket], [socket])
-# check for library used by libevent after 1.3c
-AC_SEARCH_LIBS([clock_gettime], [rt])
 
 # check for libevent
 AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
@@ -529,10 +559,10 @@ if test x_$withval == x_yes -o x_$withval != x_no; then
             fi
         done
         if test x_$found_libevent != x_yes; then
-		if test -f "$dir/event.h" -a -f "$dir/libevent.la"; then
+		if test -f "$dir/event.h" -a \( -f "$dir/libevent.la" -o -f "$dir/libev.la" \) ; then
 			# libevent source directory
             		AC_MSG_RESULT(found in $thedir)
-                	CPPFLAGS="$CPPFLAGS -I$thedir"
+                	CPPFLAGS="$CPPFLAGS -I$thedir -I$thedir/include"
 			BAK_LDFLAGS="$LDFLAGS"
 			# remove evdns from linking
 			mkdir build >/dev/null 2>&1
@@ -544,8 +574,8 @@ if test x_$withval == x_yes -o x_$withval != x_no; then
 			cp $ev_files_o build/libevent
 			cp $ev_files_lo build/libevent
 			cp $ev_files_libso build/libevent/.libs
-            		LATE_LDFLAGS="build/libevent/*.lo"
-			LDFLAGS="build/libevent/*.o $LDFLAGS"
+            		LATE_LDFLAGS="build/libevent/*.lo -lm"
+			LDFLAGS="build/libevent/*.o $LDFLAGS -lm"
 		else
             		AC_MSG_ERROR([Cannot find the libevent library in $withval
 You can restart ./configure --with-libevent=no to use a builtin alternative.
@@ -560,10 +590,14 @@ large outgoing port ranges.  ])
 	    fi
         fi
 	AC_SUBST(RUNTIME_PATH)
+	# check for library used by libevent after 1.3c
+	AC_SEARCH_LIBS([clock_gettime], [rt])
+
 	AC_SEARCH_LIBS(event_set, [event])
 	AC_CHECK_HEADERS([event.h],,, [AC_INCLUDES_DEFAULT])
 	AC_CHECK_FUNCS([event_base_free]) # only in libevent 1.2 and later
 	AC_CHECK_FUNCS([event_base_once]) # only in libevent 1.4? and later
+	AC_CHECK_FUNCS([event_base_get_method]) # only in libevent 1.4.3 and later
 	if test -n "$BAK_LDFLAGS"; then
 		LDFLAGS="$BAK_LDFLAGS"
 	fi

contrib/README

@@ -2,3 +2,6 @@ These files are contributed to unbound, and are not part of the official
 distribution but may be helpful.
 
 * rc_d_unbound: FreeBSD compatible /etc/rc.d script.
+* parseunbound.pl: perl script to run from cron that parses statistics from
+	the log file and stores them.
+* unbound.spec and unbound.init: RPM specfile and Linux rc.d initfile.

contrib/parseunbound.pl

@@ -0,0 +1,140 @@
+#!/usr/local/bin/perl -w
+#
+# Script to parse the output from the unbound namedaemon.
+# Unbound supports a threading model, and outputs a multiline log-blob for
+# every thread.
+#
+# This script should parse all threads of the once, and store it
+# in a local cached file for speedy results when queried lots.
+#
+use strict;
+use POSIX qw(SEEK_END);
+use Storable;
+use FileHandle;
+use Carp qw(croak carp);
+use constant UNBOUND_CACHE => "/var/tmp/unbound-cache.stor";
+
+my $run_from_cron = @ARGV && $ARGV[0] eq "--cron" && shift;
+my $DEBUG = -t STDERR;
+
+# NB. VERY IMPORTANTES: set this when running this script.
+my $numthreads = 4;
+
+### if cache exists, read it in. and is newer than 3 minutes
+if ( -r UNBOUND_CACHE ) {
+    my $result = retrieve(UNBOUND_CACHE);
+    if (-M _ < 3/24/60 && !$run_from_cron ) {
+        print STDERR "Cached results:\n" if $DEBUG;
+        print join("\n", @$result), "\n";
+        exit;
+    }
+}
+my $logfile = shift or die "Usage: parseunbound.pl --cron unboundlogfile";
+my $in = new FileHandle $logfile or die "Cannot open $logfile: $!\n";
+
+# there is a special key 'thread' that indicates the thread. its not used, but returned anyway.
+my @records = ('thread', 'queries', 'cachehits', 'recursions', 'recursionavg',
+        'outstandingmax', 'outstandingavg', 'outstandingexc',
+        'median25', 'median50', 'median75',
+        'us_0', 'us_1', 'us_2', 'us_4', 'us_8', 'us_16', 'us_32',
+        'us_64', 'us_128', 'us_256', 'us_512', 'us_1024', 'us_2048',
+        'us_4096', 'us_8192', 'us_16384', 'us_32768', 'us_65536',
+        'us_131072', 'us_262144', 'us_524288', 's_1', 's_2', 's_4',
+        's_8', 's_16', 's_32', 's_64', 's_128', 's_256', 's_512');
+# Stats hash containing one or more keys. for every thread, 1 key.
+my %allstats = (); # key="$threadid", stats={key => value}
+my %startstats = (); # when we got a queries entry for this thread
+my %donestats = (); # same, but only when we got a histogram entry for it
+# stats hash contains name/value pairs of the actual numbers for that thread.
+my $offset = 0;
+my $inthread=0;
+my $inpid;
+
+# We should continue looping untill we meet these conditions:
+# a) more total queries than the previous run (which defaults to 0) AND
+# b) parsed all $numthreads threads in the log.
+my $numqueries = $previousresult ? $previousresult->[1] : 0;
+
+# Main loop
+while ( scalar keys %startstats < $numthreads || scalar keys %donestats < $numthreads) {
+    $offset += 10000;
+    if ( $offset > -s $logfile or $offset > 10_000_000 ) {
+        die "Cannot find stats in $logfile\n";
+    }
+    $in->seek(-$offset, SEEK_END) or croak "cannot seek $logfile: $!\n";
+
+    for my $line ( <$in> ) {
+        chomp($line);
+
+        #[1208777234] unbound[6705:0] 
+        if ($line =~ m/^\[\d+\] unbound\[\d+:(\d+)\]/) {
+            $inthread = $1;
+            if ($inthread + 1 > $numthreads) {
+                die "Hey. lazy. change \$numthreads in this script to ($inthread)\n";
+            }
+        }
+        # this line doesn't contain a pid:thread. skip.
+        else {
+            next;
+        }
+
+        if ( $line =~ m/info: server stats for thread \d+: (\d+) queries, (\d+) answers from cache, (\d+) recursions/ ) {
+            $startstats{$inthread} = 1;
+            $allstats{$inthread}->{thread} = $inthread;
+            $allstats{$inthread}->{queries} = $1;
+            $allstats{$inthread}->{cachehits} = $2;
+            $allstats{$inthread}->{recursions} = $3;
+        }
+        elsif ( $line =~ m/info: server stats for thread (\d+): requestlist max (\d+) avg ([0-9\.]+) exceeded (\d+)/ ) {
+            $allstats{$inthread}->{outstandingmax} = $2;
+            $allstats{$inthread}->{outstandingavg} = int($3); # This is a float; rrdtool only handles ints.
+            $allstats{$inthread}->{outstandingexc} = $4;
+        }
+        elsif ( $line =~ m/info: average recursion processing time ([0-9\.]+) sec/ ) {
+            $allstats{$inthread}->{recursionavg} = int($1 * 1000); # change sec to milisec.
+        }
+        elsif ( $line =~ m/info: histogram of recursion processing times/ ) {
+            next;
+        }
+        elsif ( $line =~ m/info: \[25%\]=([0-9\.]+) median\[50%\]=([0-9\.]+) \[75%\]=([0-9\.]+)/ ) {
+            $allstats{$inthread}->{median25} = int($1 * 1000000); # change seconds to usec
+            $allstats{$inthread}->{median50} = int($2 * 1000000);
+            $allstats{$inthread}->{median75} = int($3 * 1000000);
+        }
+        elsif ( $line =~ m/info: lower\(secs\) upper\(secs\) recursions/ ) {
+            # since after this line we're unsure if we get these numbers
+            # at all, we sould consider this marker as the end of the
+            # block. Chances that we're parsing a file halfway written
+            # at this stage are small. Bold statement.
+            $donestats{$inthread} = 1;
+            next;
+        }
+        elsif ( $line =~ m/info:\s+(\d+)\.(\d+)\s+(\d+)\.(\d+)\s+(\d+)/ ) {
+            my ($froms, $fromus, $toms, $tous, $counter) = ($1, $2, $3, $4, $5);
+            my $prefix = '';
+            if ($froms > 0) {
+                $allstats{$inthread}->{'s_' . int($froms)} = $counter;
+            } else {
+                $allstats{$inthread}->{'us_' . int($fromus)} = $counter;
+            }
+        }
+    }
+}
+
+my @result;
+# loop on the records we want to store
+for my $key ( @records ) {
+    my $sum = 0;
+    # these are the different threads parsed
+    foreach my $thread ( 0 .. $numthreads - 1 ) {
+        $sum += ($allstats{$thread}->{$key} || 0);
+    }
+    print STDERR "$key = " . $sum . "\n" if $DEBUG;
+    push @result, $sum;
+}
+print join("\n", @result), "\n";
+store \@result, UNBOUND_CACHE;
+
+if ($DEBUG) {
+    print STDERR "Threads: " . (scalar keys %allstats) . "\n";
+}

contrib/rc_d_unbound

@@ -16,7 +16,7 @@ name="unbound"
 rcvar=`set_rcvar`
 
 command="/usr/local/sbin/unbound"
-pidfile="/etc/unbound/unbound.pid"
+pidfile="/usr/local/etc/unbound/unbound.pid"
 extra_commands="reload"
 
 load_rc_config $name

contrib/unbound.init

@@ -0,0 +1,139 @@
+#!/bin/sh
+#
+# unbound	This shell script takes care of starting and stopping
+#		unbound (DNS server).
+#
+# chkconfig:   - 14 86
+# description:	unbound is a Domain Name Server (DNS) \
+#		that is used to resolve host names to IP addresses.
+
+### BEGIN INIT INFO
+# Provides: $named unbound
+# Required-Start: $network $local_fs
+# Required-Stop: $network $local_fs
+# Should-Start: $syslog
+# Should-Stop: $syslog
+# Short-Description: unbound recursive Domain Name Server.
+# Description:  unbound is a Domain Name Server (DNS) 
+#		that is used to resolve host names to IP addresses.
+### END INIT INFO
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+exec="/usr/sbin/unbound"
+prog="unbound"
+config="/var/unbound/unbound.conf"
+pidfile="/var/unbound/unbound.pid"
+rootdir="/var/unbound"
+
+[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
+
+lockfile=/var/lock/subsys/$prog
+
+start() {
+    [ -x $exec ] || exit 5
+    [ -f $config ] || exit 6
+    echo -n $"Starting $prog: "
+
+    # setup root jail
+    if [ -s /etc/localtime ]; then 
+	[ -d ${rootdir}/etc ] || mkdir -p ${rootdir}/etc ;
+	if [ ! -e ${rootdir}/etc/localtime ] || /usr/bin/cmp -s /etc/localtime ${rootdir}/etc/localtime; then
+	    cp -fp /etc/localtime ${rootdir}/etc/localtime
+	fi;
+    fi;
+    if [ -s /etc/resolv.conf ]; then
+	[ -d ${rootdir}/etc ] || mkdir -p ${rootdir}/etc ;
+	if [ ! -e ${rootdir}/etc/resolv.conf ] || /usr/bin/cmp -s /etc/resolv.conf ${rootdir}/etc/resolv.conf; then
+	    cp -fp /etc/resolv.conf ${rootdir}/etc/resolv.conf
+	fi;
+    fi;
+    if ! egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
+	[ -d ${rootdir}/dev ] || mkdir -p ${rootdir}/dev ;
+	[ -e ${rootdir}/dev/log ] || touch ${rootdir}/dev/log
+	mount --bind -n /dev/log ${rootdir}/dev/log >/dev/null 2>&1;
+    fi;
+    if ! egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/random' /proc/mounts; then
+	[ -d ${rootdir}/dev ] || mkdir -p ${rootdir}/dev ;
+	[ -e ${rootdir}/dev/random ] || touch ${rootdir}/dev/random
+	mount --bind -n /dev/random ${rootdir}/dev/random >/dev/null 2>&1;
+    fi;
+
+    # if not running, start it up here
+    daemon $exec
+    retval=$?
+    echo
+    [ $retval -eq 0 ] && touch $lockfile
+    return $retval
+}
+
+stop() {
+    echo -n $"Stopping $prog: "
+    # stop it here, often "killproc $prog"
+    killproc -p $pidfile $prog
+    retval=$?
+    echo
+    [ $retval -eq 0 ] && rm -f $lockfile
+    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
+	umount ${rootdir}/dev/log >/dev/null 2>&1
+    fi;
+    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/random' /proc/mounts; then
+	umount ${rootdir}/dev/random >/dev/null 2>&1
+    fi;
+    return $retval
+}
+
+restart() {
+    stop
+    start
+}
+
+reload() {
+    kill -HUP `cat $pidfile`
+}
+
+force_reload() {
+    restart
+}
+
+rh_status() {
+    # run checks to determine if the service is running or use generic status
+    status -p $pidfile $prog
+}
+
+rh_status_q() {
+    rh_status -p $pidfile >/dev/null 2>&1
+}
+
+case "$1" in
+    start)
+        rh_status_q && exit 0
+        $1
+        ;;
+    stop)
+        rh_status_q || exit 0
+        $1
+        ;;
+    restart)
+        $1
+        ;;
+    reload)
+        rh_status_q || exit 7
+        $1
+        ;;
+    force-reload)
+        force_reload
+        ;;
+    status)
+        rh_status
+        ;;
+    condrestart|try-restart)
+        rh_status_q || exit 0
+        restart
+        ;;
+    *)
+        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
+        exit 2
+esac
+exit $?

contrib/unbound.spec

@@ -0,0 +1,99 @@
+Summary: Validating, recursive, and caching DNS resolver
+Name: unbound
+Version: 0.12
+Release: 1%{?dist}
+License: BSD
+Url: http://www.nlnetlabs.nl/unbound/
+Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
+Source1: unbound.init
+Group: System Environment/Daemons
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+BuildRequires: flex, openssl-devel
+
+%description
+Unbound is a validating, recursive, and caching DNS resolver.
+
+The C implementation of Unbound is developed and maintained by NLnet
+Labs. It is based on ideas and algorithms taken from a java prototype
+developed by Verisign labs, Nominet, Kirei and ep.net.
+
+Unbound is designed as a set of modular components, so that also
+DNSSEC (secure DNS) validation and stub-resolvers (that do not run
+as a server, but are linked into an application) are easily possible.
+
+The source code is under a BSD License.
+
+%prep
+%setup -q
+
+# configure with /var/unbound/unbound.conf so that all default chroot, 
+# pidfile and config file are in /var/unbound, ready for chroot jail set up.
+#
+# This is a build using libldns builtin version, the resulting binaries
+# do not require libldns and this package does not have version dependencies.
+# Could be smaller using a dependency on libldns (use --with-ldns=).
+%configure --enable-debug --with-conf-file=%{_localstatedir}/%{name}/unbound.conf --disable-static --disable-rpath
+
+%build
+%{__make} %{?_smp_mflags}
+
+%install
+rm -rf %{buildroot}
+%{__make} DESTDIR=%{buildroot} install
+install -d 0700 %{buildroot}%{_localstatedir}/%{name}
+install -d 0755 %{buildroot}%{_initrddir}
+install -m 0755 %{SOURCE1} %{buildroot}%{_initrddir}/unbound
+# add symbolic link from /etc/unbound.conf -> /var/unbound/unbound.conf
+ln -s %{_localstatedir}/unbound/unbound.conf %{buildroot}%{_sysconfdir}/unbound.conf 
+# remove static library from install (fedora packaging guidelines)
+rm -f %{buildroot}%{_libdir}/libunbound.a %{buildroot}%{_libdir}/libunbound.la
+
+%clean
+rm -rf ${RPM_BUILD_ROOT}
+
+%files
+%defattr(-,root,root,-)
+%doc doc/README doc/CREDITS doc/LICENSE doc/FEATURES
+%attr(0755,root,root) %{_initrddir}/%{name}
+%attr(0700,%{name},%{name}) %dir %{_localstatedir}/%{name}
+%attr(0644,%{name},%{name}) %config(noreplace) %{_localstatedir}/%{name}/unbound.conf
+%attr(0644,%{name},%{name}) %config(noreplace) %{_sysconfdir}/unbound.conf
+%{_sbindir}/*
+%{_mandir}/*/*
+%{_includedir}/*
+%{_libdir}/libunbound*
+
+%pre
+getent group unbound >/dev/null || groupadd -r unbound
+getent passwd unbound >/dev/null || \
+useradd -r -g unbound -d /var/unbound -s /sbin/nologin \
+    -c "unbound name daemon" unbound
+exit 0
+
+%post
+# This adds the proper /etc/rc*.d links for the script
+/sbin/chkconfig --add %{name}
+
+%preun
+if [ $1 -eq 0 ]; then
+	/sbin/service %{name} stop >/dev/null 2>&1
+	/sbin/chkconfig --del %{name}
+	# remove root jail 
+	rm -f /var/unbound/dev/log /var/unbound/dev/random /var/unbound/etc/localtime /var/unbound/etc/resolv.conf >/dev/null 2>&1
+	rmdir /var/unbound/dev >/dev/null 2>&1 || :
+	rmdir /var/unbound/etc >/dev/null 2>&1 || :
+	rmdir /var/unbound >/dev/null 2>&1 || :
+fi
+
+%postun
+if [ "$1" -ge "1" ]; then
+	/sbin/service %{name} condrestart >/dev/null 2>&1 || :
+fi
+
+%changelog
+* Thu Apr 25 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.12
+- Using parts from ports collection entry by Jaap Akkerhuis.
+- Using Fedoraproject wiki guidelines.
+
+* Wed Apr 23 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.11
+- Initial version.

daemon/acl_list.c

@@ -194,14 +194,16 @@ acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg)
 	/* insert defaults, with '0' to ignore them if they are duplicates */
 	if(!acl_list_str_cfg(acl, "0.0.0.0/0", "refuse", 0))
 		return 0;
-	if(!acl_list_str_cfg(acl, "::0/0", "refuse", 0))
-		return 0;
 	if(!acl_list_str_cfg(acl, "127.0.0.0/8", "allow", 0))
 		return 0;
-	if(!acl_list_str_cfg(acl, "::1", "allow", 0))
-		return 0;
-	if(!acl_list_str_cfg(acl, "::ffff:127.0.0.1", "allow", 0))
-		return 0;
+	if(cfg->do_ip6) {
+		if(!acl_list_str_cfg(acl, "::0/0", "refuse", 0))
+			return 0;
+		if(!acl_list_str_cfg(acl, "::1", "allow", 0))
+			return 0;
+		if(!acl_list_str_cfg(acl, "::ffff:127.0.0.1", "allow", 0))
+			return 0;
+	}
 	acl_list_init_parents(acl);
 	return 1;
 }

daemon/daemon.c

@@ -53,6 +53,7 @@
 #include "services/localzone.h"
 #include "services/modstack.h"
 #include "util/module.h"
+#include "util/random.h"
 #include <signal.h>
 
 /** How many quit requests happened. */
@@ -82,6 +83,8 @@ static RETSIGTYPE record_sigh(int sig)
 		case SIGHUP:
 			sig_record_reload++;
 			break;
+		case SIGPIPE:
+			break;
 		default:
 			log_err("ignoring signal %d", sig);
 	}
@@ -97,7 +100,8 @@ signal_handling_record()
 	if( signal(SIGTERM, record_sigh) == SIG_ERR ||
 		signal(SIGQUIT, record_sigh) == SIG_ERR ||
 		signal(SIGINT, record_sigh) == SIG_ERR ||
-		signal(SIGHUP, record_sigh) == SIG_ERR)
+		signal(SIGHUP, record_sigh) == SIG_ERR ||
+		signal(SIGPIPE, SIG_IGN) == SIG_ERR)
 		log_err("install sighandler: %s", strerror(errno));
 }
 
@@ -172,23 +176,74 @@ static void daemon_setup_modules(struct daemon* daemon)
 	}
 }
 
+/**
+ * Obtain allowed port numbers, concatenate the list, and shuffle them
+ * (ready to be handed out to threads).
+ * @param daemon: the daemon. Uses rand and cfg.
+ * @param shufport: the portlist output.
+ * @return number of ports available.
+ */
+int daemon_get_shufport(struct daemon* daemon, int* shufport)
+{
+	int i, n, k, temp;
+	int avail = 0;
+	for(i=0; i<65536; i++) {
+		if(daemon->cfg->outgoing_avail_ports[i]) {
+			shufport[avail++] = daemon->cfg->
+				outgoing_avail_ports[i];
+		}
+	}
+	if(avail == 0)
+		fatal_exit("no ports are permitted for UDP, add "
+			"with outgoing-port-permit");
+        /* Knuth shuffle */
+	n = avail;
+	while(--n > 0) {
+		k = ub_random(daemon->rand) % (n+1); /* 0<= k<= n */
+		temp = shufport[k];
+		shufport[k] = shufport[n];
+		shufport[n] = temp;
+	}
+	return avail;
+}
+
 /**
  * Allocate empty worker structures. With backptr and thread-number,
  * from 0..numthread initialised. Used as user arguments to new threads.
+ * Creates the daemon random generator if it does not exist yet.
+ * The random generator stays existing between reloads with a unique state.
  * @param daemon: the daemon with (new) config settings.
  */
 static void 
 daemon_create_workers(struct daemon* daemon)
 {
-	int i;
+	int i, numport;
+	int* shufport;
 	log_assert(daemon && daemon->cfg);
+	if(!daemon->rand) {
+		unsigned int seed = (unsigned int)time(NULL) ^ 
+			(unsigned int)getpid() ^ 0x438;
+		daemon->rand = ub_initstate(seed, NULL);
+		if(!daemon->rand)
+			fatal_exit("could not init random generator");
+	}
+	shufport = (int*)calloc(65536, sizeof(int));
+	if(!shufport)
+		fatal_exit("out of memory during daemon init");
+	numport = daemon_get_shufport(daemon, shufport);
+	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
+	
 	daemon->num = daemon->cfg->num_threads;
 	daemon->workers = (struct worker**)calloc((size_t)daemon->num, 
 		sizeof(struct worker*));
 	for(i=0; i<daemon->num; i++) {
-		if(!(daemon->workers[i] = worker_create(daemon, i)))
+		if(!(daemon->workers[i] = worker_create(daemon, i,
+			shufport+numport*i/daemon->num, 
+			numport*(i+1)/daemon->num - numport*i/daemon->num)))
+			/* the above is not ports/numthr, due to rounding */
 			fatal_exit("could not create worker");
 	}
+	free(shufport);
 }
 
 /**
@@ -363,6 +418,7 @@ daemon_delete(struct daemon* daemon)
 		rrset_cache_delete(daemon->env->rrset_cache);
 		infra_delete(daemon->env->infra_cache);
 	}
+	ub_randfree(daemon->rand);
 	alloc_clear(&daemon->superalloc);
 	acl_list_delete(daemon->acl);
 	free(daemon->pidfile);

daemon/daemon.h

@@ -53,6 +53,7 @@ struct module_env;
 struct rrset_cache;
 struct acl_list;
 struct local_zones;
+struct ub_randstate;
 
 /**
  * Structure holding worker list.
@@ -73,6 +74,8 @@ struct daemon {
 	struct worker** workers;
 	/** do we need to exit unbound (or is it only a reload?) */
 	int need_to_exit;
+	/** master random table ; used for port div between threads on reload*/
+	struct ub_randstate* rand;
 	/** master allocation cache */
 	struct alloc_cache superalloc;
 	/** the module environment master value, copied and changed by threads*/

daemon/unbound.c

@@ -53,8 +53,10 @@
 #include <signal.h>
 #include <fcntl.h>
 #include <pwd.h>
-#include <sys/resource.h>
 
+#ifdef HAVE_SYS_RESOURCE_H
+#include <sys/resource.h>
+#endif
 
 #ifdef USE_MINI_EVENT
 #include "util/mini_event.h"
@@ -91,18 +93,22 @@ checkrlimits(struct config_file* cfg)
 			(int)cfg->incoming_num_tcp:0));
 	size_t ifs = (size_t)(cfg->num_ifs==0?1:cfg->num_ifs);
 	size_t listen_num = list*ifs;
-	size_t out_ifs = (size_t)(cfg->num_out_ifs==0?1:cfg->num_out_ifs);
-	size_t outnum = cfg->outgoing_num_ports*out_ifs + cfg->outgoing_num_tcp;
+	size_t outudpnum = (size_t)cfg->outgoing_num_ports;
+	size_t outtcpnum = cfg->outgoing_num_tcp;
 	size_t misc = 4; /* logfile, pidfile, stdout... */
-	size_t perthread = listen_num + outnum + 2/*cmdpipe*/ + 2/*libevent*/
-		+ misc; 
+	size_t perthread_noudp = listen_num + outtcpnum + 
+		2/*cmdpipe*/ + 2/*libevent*/ + misc; 
+	size_t perthread = perthread_noudp + outudpnum;
+
 #if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 	int numthread = 1; /* it forks */
 #else
 	int numthread = cfg->num_threads;
 #endif
 	size_t total = numthread * perthread + misc;
+	size_t avail;
 	struct rlimit rlim;
+
 	if(getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
 		log_warn("getrlimit: %s", strerror(errno));
 		return;
@@ -110,13 +116,23 @@ checkrlimits(struct config_file* cfg)
 	if(rlim.rlim_cur == (rlim_t)RLIM_INFINITY)
 		return;
 	if((size_t)rlim.rlim_cur < total) {
-		log_err("Not enough sockets available. Increase "
-			"ulimit(open files).");
-		log_err("or decrease number of threads, outgoing num ports, "
-			"outgoing num tcp or number of interfaces");
-		log_err("estimate %u fds high mark, %u available", 
-			(unsigned)total, (unsigned)rlim.rlim_cur);
-		fatal_exit("Not enough file descriptors available");
+		avail = (size_t)rlim.rlim_cur;
+		rlim.rlim_cur = (rlim_t)(total + 10);
+		rlim.rlim_max = (rlim_t)(total + 10);
+		if(setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
+			log_warn("setrlimit: %s", strerror(errno));
+			log_warn("cannot increase max open fds from %u to %u",
+				(unsigned)avail, (unsigned)total+10);
+			cfg->outgoing_num_ports = (int)((avail 
+				- numthread*perthread_noudp 
+				- 10 /* safety margin */) /numthread);
+			log_warn("continuing with less udp ports: %u",
+				cfg->outgoing_num_ports);
+			log_warn("increase ulimit or decrease threads, ports in config to remove this warning");
+			return;
+		}
+		log_warn("increased limit(open files) from %u to %u",
+			(unsigned)avail, (unsigned)total+10);
 	}
 }
 
@@ -268,7 +284,8 @@ detach(struct config_file* cfg)
 
 /** daemonize, drop user priviliges and chroot if needed */
 static void
-do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode)
+do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode,
+	char** cfgfile)
 {
 	uid_t uid;
 	gid_t gid;
@@ -278,13 +295,6 @@ do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode)
 	log_assert(cfg);
 
 	/* daemonize last to be able to print error to user */
-	if(cfg->directory && cfg->directory[0]) {
-		if(chdir(cfg->directory)) {
-			fatal_exit("Could not chdir to %s: %s",
-				cfg->directory, strerror(errno));
-		}
-		verbose(VERB_QUERY, "chdir to %s", cfg->directory);
-	}
 	if(cfg->username && cfg->username[0]) {
 		struct passwd *pwd;
 		if((pwd = getpwnam(cfg->username)) == NULL)
@@ -294,10 +304,32 @@ do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode)
 		endpwent();
 	}
 	if(cfg->chrootdir && cfg->chrootdir[0]) {
+		if(chdir(cfg->chrootdir)) {
+			fatal_exit("unable to chdir to chroot %s: %s",
+				cfg->chrootdir, strerror(errno));
+		}
+		verbose(VERB_QUERY, "chdir to %s", cfg->chrootdir);
 		if(chroot(cfg->chrootdir))
 			fatal_exit("unable to chroot to %s: %s", 
 				cfg->chrootdir, strerror(errno));
 		verbose(VERB_QUERY, "chroot to %s", cfg->chrootdir);
+		if(strncmp(*cfgfile, cfg->chrootdir, 
+			strlen(cfg->chrootdir)) == 0) 
+			(*cfgfile) += strlen(cfg->chrootdir);
+	}
+	if(cfg->directory && cfg->directory[0]) {
+		char* dir = cfg->directory;
+		if(cfg->chrootdir && cfg->chrootdir[0] &&
+			strncmp(dir, cfg->chrootdir, 
+			strlen(cfg->chrootdir)) == 0)
+			dir += strlen(cfg->chrootdir);
+		if(dir[0]) {
+			if(chdir(dir)) {
+				fatal_exit("Could not chdir to %s: %s",
+					dir, strerror(errno));
+			}
+			verbose(VERB_QUERY, "chdir to %s", dir);
+		}
 	}
 	if(cfg->username && cfg->username[0]) {
 		if(setgid(gid) != 0)
@@ -366,7 +398,7 @@ run_daemon(char* cfgfile, int cmdline_verbose, int debug_mode)
 		if(!daemon_open_shared_ports(daemon))
 			fatal_exit("could not open ports");
 		if(!done_chroot) { 
-			do_chroot(daemon, cfg, debug_mode); 
+			do_chroot(daemon, cfg, debug_mode, &cfgfile); 
 			done_chroot = 1; 
 		} else log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
 		/* work */

daemon/worker.c

@@ -883,19 +883,27 @@ void worker_stat_timer_cb(void* arg)
 	server_stats_log(&worker->stats, worker->thread_num);
 	mesh_stats(worker->env.mesh, "mesh has");
 	worker_mem_report(worker, NULL);
-	server_stats_init(&worker->stats);
-	mesh_stats_clear(worker->env.mesh);
+	if(!worker->daemon->cfg->stat_cumulative) {
+		server_stats_init(&worker->stats);
+		mesh_stats_clear(worker->env.mesh);
+	}
 	/* start next timer */
 	worker_restart_timer(worker);
 }
 
 struct worker* 
-worker_create(struct daemon* daemon, int id)
+worker_create(struct daemon* daemon, int id, int* ports, int n)
 {
 	struct worker* worker = (struct worker*)calloc(1, 
 		sizeof(struct worker));
 	if(!worker) 
 		return NULL;
+	worker->numports = n;
+	worker->ports = (int*)memdup(ports, sizeof(int)*n);
+	if(!worker->ports) {
+		free(worker);
+		return NULL;
+	}
 	worker->daemon = daemon;
 	worker->thread_num = id;
 	worker->cmd_send_fd = -1;
@@ -925,7 +933,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	struct listen_port* ports, int do_sigs)
 {
 	unsigned int seed;
-	int startport;
 	worker->need_to_exit = 0;
 	worker->base = comm_base_create();
 	if(!worker->base) {
@@ -971,14 +978,12 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker_delete(worker);
 		return 0;
 	}
-	startport  = cfg->outgoing_base_port + 
-		cfg->outgoing_num_ports * worker->thread_num;
 	worker->back = outside_network_create(worker->base,
 		cfg->msg_buffer_size, (size_t)cfg->outgoing_num_ports, 
 		cfg->out_ifs, cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, 
-		startport, cfg->do_tcp?cfg->outgoing_num_tcp:0, 
+		cfg->do_tcp?cfg->outgoing_num_tcp:0, 
 		worker->daemon->env->infra_cache, worker->rndstate,
-		cfg->use_caps_bits_for_id);
+		cfg->use_caps_bits_for_id, worker->ports, worker->numports);
 	if(!worker->back) {
 		log_err("could not create outgoing sockets");
 		worker_delete(worker);
@@ -1067,6 +1072,7 @@ worker_delete(struct worker* worker)
 	comm_signal_delete(worker->comsig);
 	comm_point_delete(worker->cmd_com);
 	comm_timer_delete(worker->stat_timer);
+	free(worker->ports);
 	if(worker->thread_num == 0)
 		log_set_time(NULL);
 	comm_base_delete(worker->base);
@@ -1091,12 +1097,10 @@ worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
 	struct worker* worker = q->env->worker;
 	if(use_tcp) {
 		return pending_tcp_query(worker->back, pkt, addr, addrlen, 
-			timeout, worker_handle_reply, q, 
-			worker->rndstate) != 0;
+			timeout, worker_handle_reply, q) != 0;
 	}
 	return pending_udp_query(worker->back, pkt, addr, addrlen, 
-		timeout*1000, worker_handle_reply, q, 
-		worker->rndstate) != 0;
+		timeout*1000, worker_handle_reply, q) != 0;
 }
 
 /** compare outbound entry qstates */

daemon/worker.h

@@ -86,6 +86,10 @@ struct worker {
 	struct listen_dnsport* front;
 	/** the backside outside network interface to the auth servers */
 	struct outside_network* back;
+	/** ports to be used by this worker. */
+	int* ports;
+	/** number of ports for this worker */
+	int numports;
 	/** the signal handler */
 	struct comm_signal* comsig;
 	/** commpoint to listen to commands. */
@@ -116,9 +120,11 @@ struct worker {
  * with backpointers only. Use worker_init on it later.
  * @param daemon: the daemon that this worker thread is part of.
  * @param id: the thread number from 0.. numthreads-1.
+ * @param ports: the ports it is allowed to use, array.
+ * @param n: the number of ports.
  * @return: the new worker or NULL on alloc failure.
  */
-struct worker* worker_create(struct daemon* daemon, int id);
+struct worker* worker_create(struct daemon* daemon, int id, int* ports, int n);
 
 /**
  * Initialize worker.

doc/Changelog

@@ -1,3 +1,138 @@
+16 May 2008: Wouter
+	- fixup for MacOSX hosts file reading (reported by John Dickinson).
+	- created 1.0.0 svn tag.
+
+14 May 2008: Wouter
+	- accepted patch from Ondrej Sury for library version libtool option.
+	- configure --disable-rpath fixes up libtool for rpath trouble.
+	  Adapted from debian package patch file.
+
+13 May 2008: Wouter
+	- Added root ipv6 addresses to builtin root hints.
+	- TODO modified for post 1.0 plans.
+	- trunk version set to 1.0.0.
+	- no unnecessary linking with librt (only when libevent/libev used).
+
+7 May 2008: Wouter
+	- fixup no-ip4 problem with error callback in outside network.
+
+25 April 2008: Wouter
+	- DESTDIR is honored by the Makefile for rpms.
+	- contrib files unbound.spec and unbound.init, builds working RPM
+	  on FC7 Linux, a chrooted caching resolver, and libunbound.
+	- iana ports update.
+
+24 April 2008: Wouter
+	- chroot checks improved. working directory relative to chroot.
+	  checks if config file path is inside chroot. Documentation on it.
+	- nicer example.conf text.
+	- created 0.11 tag.
+
+23 April 2008: Wouter
+	- parseunbound.pl contrib update from Kai Storbeck for threads.
+	- iana ports update
+
+22 April 2008: Wouter
+	- ignore SIGPIPE.
+	- unit test for SIGPIPE ignore.
+
+21 April 2008: Wouter
+	- FEATURES document.
+	- fixup reread of config file if it was given as a full path
+	  and chroot was used.
+
+16 April 2008: Wouter
+	- requirements doc, updated clean query returns.
+	- parseunbound.pl update from Kai Storbeck.
+	- sunos4 porting changes.
+
+15 April 2008: Wouter
+	- fixup default rc.d pidfile location to /usr/local/etc.
+	- iana ports updated.
+	- copyright updated in ldns-testpkts to keep same as in ldns.
+	- fixup checkconf chroot tests a bit more, chdir must be inside
+	  chroot dir.
+	- documented 'gcc: unrecognized -KPIC option' errors on Solaris.
+	- example.conf values changed to /usr/local/etc/unbound
+	- DSA test work.
+	- DSA signatures: unbound is compatible with both encodings found.
+	  It will detect and convert when necessary.
+
+14 April 2008: Wouter
+	- got update for parseunbound.pl statistics script from Kai Storbeck.
+	- tpkg tests for udp wait list.
+	- documented 0x20 status.
+	- fixup chroot and checkconf, it is much smarter now.
+	- fixup DSA EVP signature decoding. Solution that Jelte found copied.
+	- and check first sig byte for the encoding type.
+
+11 April 2008: Wouter
+	- random port selection out of the configged ports.
+	- fixup threadsafety for libevent-1.4.3+ (event_base_get_method).
+	- removed base_port.
+	- created 256-port ephemeral space for the OS, 59802 available.
+	- fixup consistency of port_if out array during heavy use.
+
+10 April 2008: Wouter
+	- --with-libevent works with latest libevent 1.4.99-trunk.
+	- added log file statistics perl script to contrib.
+	- automatic iana ports update from makefile. 60058 available.
+
+9 April 2008: Wouter
+	- configure can detect libev(from its build directory) when passed
+	  --with-libevent=/home/wouter/libev-3.2
+	  libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%).
+	- unused commpoints not listed in epoll list.
+	- statistics-cumulative option so that the values are not reset.
+	- config creates array of available ports, 61841 available,
+	  it excludes <1024 and iana assigned numbers.
+	  config statements to modify the available port numbers.
+
+8 April 2008: Wouter
+	- unbound tries to set the ulimit fds when started as server.
+	  if that does not work, it will scale back its requirements.
+
+27 March 2008: Wouter
+	- documented /dev/random symlink from chrootdir as FAQ entry.
+
+26 March 2008: Wouter
+	- implemented AD bit signaling. If a query sets AD bit (but not DO)
+	  then the AD bit is set in the reply if the answer validated.
+	  Without including DNSSEC signatures. Useful if you have a trusted
+	  path from the client to the resolver. Follows dnssec-updates draft.
+
+25 March 2008: Wouter
+	- implemented check that for NXDOMAIN and NOERROR answers a query
+	  section must be present in the reply (by the scrubber). And it must
+	  be equal to the question sent, at least lowercase folded.
+	  Previously this feature happened because the cache code refused
+	  to store such messages. However blocking by the scrubber makes 
+	  sure nothing gets into the RRset cache. Also, this looks like a
+	  timeout (instead of an allocation failure) and this retries are
+	  done (which is useful in a spoofing situation).
+	- RTT banding. Band size 400 msec, this makes band around zero (fast)
+	  include unknown servers. This makes unbound explore unknown servers.
+
+7 March 2008: Wouter
+	- -C config feature for harvest program. 
+	- harvest handles CNAMEs too.
+
+5 March 2008: Wouter
+	- patch from Hugo Koji Kobayashi for iterator logs spelling.
+
+4 March 2008: Wouter
+	- From report by Jinmei Tatuya, rfc2181 trust value for remainder
+	  of a cname trust chain is lower; not full answer_AA. 
+	- test for this fix.
+	- default config file location is /usr/local/etc/unbound.
+	  Thus prefix is used to determine the location. This is also the
+	  chroot and pidfile default location.
+
+3 March 2008: Wouter
+	- Create 0.10 svn tag.
+	- 0.11 version in trunk.
+	- indentation nicer.
+
 29 February 2008: Wouter
 	- documentation update.
 	- fixup port to Solaris of perf test tool.

doc/FEATURES

@@ -0,0 +1,91 @@
+Unbound Features
+
+(C) Copyright 2008, Wouter Wijngaards, NLnet Labs.
+
+
+This document describes the features and RFCs that unbound 
+adheres to, and which ones are decided to be out of scope.
+
+
+Big Features
+------------
+Recursive service.
+Caching service.
+Forwarding and stub zones.
+No authoritative service.
+DNSSEC Validation options.
+EDNS0, NSEC3, Unknown-RR-types.
+
+
+Details
+-------
+Processing support
+RFC 1034-1035: as a recursive, caching server. Not authoritative.
+  including CNAMEs, referrals, wildcards, classes, ...
+RFC 4033-4035: as a validating caching server (unbound daemon). 
+  as a validating stub (libunbound).
+RFC 1918.
+RFC 2181: completely, including the trust model, keeping rrsets together.
+RFC 2672: DNAME support.
+RFC 3597: Unknown RR type support.
+RFC 2671: EDNS0 support, default advertisement 4Kb size. 
+RFC 5155: NSEC3, NSEC3PARAM types
+AAAA type. and IP6 dual stack support.
+type ANY queries are supported.
+RFC 2308: TTL directive, and the rest of the RFC too.
+RFC 4592: wildcards.
+
+RFC 1995, 1996, 2136: not authoritative, so no AXFR, IXFR, NOTIFY or
+  dynamic update services are appropriate.
+
+chroot and drop-root-privileges support, default enabled in config file.
+
+AD bit in query can be used to request AD bit in response (w/o using DO bit).
+CD bit in query can be used to request bogus data.
+UDP and TCP service is provided downstream.
+UDP and TCP are used to request from upstream servers.
+Multiple queries can be made over a TCP stream.
+
+No TSIG support at this time.
+No SIG0 support at this time.
+No dTLS support at this time.
+This is not a DNS statistics package, but some operationally useful
+values are provided.
+TXT RRs from the Chaos class (id.server, hostname.bind, ...) supported.
+
+draft-forgery-resilience: all recommendations followed.
+draft-0x20: experimental implementation (incomplete).
+  implements bitwise echo of the query to support downstream 0x20.
+draft-ietf-dnsop-default-local-zones is fully supported (-04).
+  It is possible to block zones or return an address for localhost.
+  This is a very limited authoritative service. Defaults as in draft.
+draft-ietf-dnsop-resolver-priming(-00): can prime and can fallback to 
+  a safety belt list.
+draft-ietf-dnsop-dnssec-trust-anchor(-01): DS records can be configured 
+  as trust anchors. Also DNSKEYs are allowed, by the way.
+draft-ietf-dnsop-reflectors-are-evil: access control list for recursive
+  service. In fact for all DNS service so cache snooping is halted.
+
+Record type syntax support, extensive, from lib ldns.
+For these types only syntax and parsing support is needed.
+RFC 1034-1035: basic RR types.
+RFC 1183: RP, AFSDB, X25, ISDN, RT
+RFC 1706: NSAP
+RFC 2535: KEY, SIG, NXT: treated as unknown data, syntax is parsed (obsolete).
+2163: PX
+AAAA type
+1876: LOC type
+2782: SRV type
+2915: NAPTR type.
+2230: KX type.
+2538: CERT type.
+2672: DNAME type.
+OPT type
+3123: APL
+SSHFP type
+4025: IPSECKEY
+4033-4035: DS, RRSIG, NSEC, DNSKEY
+4701: DHCID
+5155: NSEC3, NSEC3PARAM
+4408: SPF
+

doc/README

@@ -67,6 +67,11 @@ o If you are not receiving the correct source IP address on replies (e.g.
   source IP address on UDP replies. Listing all IP addresses explicitly in
   the config file is an alternative. The interface-automatic option uses
   non portable socket options, Linux and FreeBSD should work fine.
+o The warning 'openssl has no entropy, seeding with time', with chroot 
+  enabled, may be solved with a symbolic link to /dev/random from <chrootdir>.
+o On Solaris 5.10 some libtool packages from repositories do not work with
+  gcc, showing errors gcc: unrecognized option `-KPIC'
+  To solve this do ./configure libtool=./libtool [your options...].
 
 Acknowledgements
 ----------------

doc/TODO

@@ -1,4 +1,4 @@
-TODO items.
+TODO items. These are interesting todo items.
 o understand synthesized DNAMEs, so those TTL=0 packets are cached properly.
 o NSEC/NSEC3 aggressive negative caching, so that updates to NSEC/NSEC3 
   will result in proper negative responses.
@@ -28,14 +28,40 @@ o (option) proactively prime root, stubs and trust anchors, feature.
   early failure, faster on first query, but more traffic.
 o On Windows use CryptGenRandom() to get random seed for arc4random.
 o library add convenience functions for A, AAAA, PTR, getaddrinfo, libresolve.
-o library add function to get signature data (or whole reply message).
 o library add function to validate input from app that is signed.
 o add dynamic-update requests (making a dynupd request) to libunbound api.
 o in an ipv6 connected only environment unbound cannot use outgoing IP6 
   to send to ip4to6 mapped hosts, need ip4to6map of NS and disable 
   V6ONLY socket option.
-o support multiple dns messages in a TCP query stream for the unbound server.
 o SIG(0) and TSIG.
 o support OPT record placement on recv anywhere in the additional section. 
 o add local-file: config with authority features.
 o (option) to make local-data answers be secure for libunbound (default=no)
+o (option) to make chroot: copy all needed files into jail (or make jail)
+	perhaps also print reminder to link /dev/random and sysloghack.
+o (option) for extended statistics. If enabled (not by default) collect print
+	rcode, uptime, spoofnearmisses, cache size, qtype, 
+	bits(RD, CD, DO, EDNS-present, AD)query, (Secure, Bogus)reply.
+	perhaps also see which slow auth servers cause >1sec values.
+	stats-file possible with key: value or key=value lines in it.
+	stats on SIGUSR1. addup stats over threads.
+o overhaul outside-network servicedquery to merge with udpwait and tcpwait,
+  to make timers in servicedquery independent of udpwait queues.
+o 0x20 fallback so it can be enabled without trouble.
+o check into rebinding ports for efficiency, configure time test.
+o DLV is considered.
+o EVP hardware crypto support.
+
+Features soon after 1.0.
+o EDNS fallback after timeout (firewall drops all edns traffic problem).
+
+For 1.x; features that have been requested during the beta test.
+o command channel for couple of tasks. Like rndc.
+  o see delegation; what servers would be used to get data for a name.
+  o force stats display; easier than parsing logfiles.
+    stats display added over threads, displayed in rddtool easy format.
+  o flush names or domains (all under a name) from the cache. Include NSes.
+    And the A, AAAA for its NSes.
+  o add/del static preload data to change the domain redirections.
+  o and maybe also start, stop, reload.
+

doc/example.conf

@@ -18,6 +18,9 @@ server:
 	# print statistics to the log (for every thread) every N seconds.
 	# Set to "" or 0 to disable. Default is disabled.
 	# statistics-interval: 0
+	
+	# enable cumulative statistics, without clearing them after printing.
+	# statistics-cumulative: no
 
 	# number of threads to create. 1 disables threading.
 	# num-threads: 1
@@ -45,16 +48,20 @@ server:
 	# outgoing-interface: 2001:DB8::5
 	# outgoing-interface: 2001:DB8::6
 
-	# unbound needs to send packets to authoritative nameservers.
-	# it uses a range of ports for that.
-	# the start number of the port range
-	# outgoing-port: 1053
+	# number of ports to allocate per thread, determines the size of the
+	# port range that can be open simultaneously. 
+	# outgoing-range: 256
+	
+	# permit unbound to use this port number or port range for
+	# making outgoing queries, using an outgoing interface.
+	# outgoing-port-permit: 32768
 
-	# number of port to allocate per thread, determines the size of the
-	# port range. A larger port range gives more resistance to certain
-	# spoof attacks, as it gets harder to guess which port is used. 
-	# But also takes more system resources (for open sockets).
-	# outgoing-range: 16
+	# deny unbound the use this of port number or port range for
+	# making outgoing queries, using an outgoing interface.
+	# Use this to make sure unbound does not grab a UDP port that some
+	# other server on this computer needs. The default is to avoid
+	# IANA-assigned port numbers.
+	# outgoing-port-avoid: "3200-3208"
 
 	# number of outgoing simultaneous tcp buffers to hold per thread.
 	# outgoing-num-tcp: 10
@@ -137,16 +144,35 @@ server:
 	# if given, a chroot(2) is done to the given directory.
 	# i.e. you can chroot to the working directory, for example,
 	# for extra security, but make sure all files are in that directory.
-	# If you give "" no chroot is performed.
-	# chroot: "/etc/unbound"
+	#
+	# If chroot is enabled, you should pass the configfile (from the
+	# commandline) as a full path from the original root. After the
+	# chroot has been performed the now defunct portion of the config 
+	# file path is removed to be able to reread the config after a reload. 
+	#
+	# All other file paths (working dir, pidfile, logfile, roothints,
+	# key files) can be specified in several ways:
+	# 	o as an absolute path relative to the new root.
+	# 	o as a relative path to the working directory.
+	# 	o as an absolute path relative to the original root.
+	# In the last case the path is adjusted to remove the unused portion.
+	#
+	# Additionally, unbound may need to access /dev/random (for entropy)
+	# and to /dev/log (if you use syslog) from inside the chroot.
+	# How to do this is specific to your OS.
+	#
+	# If you give "" no chroot is performed. The path must not end in a /.
+	# chroot: "/usr/local/etc/unbound"
 
 	# if given, user privileges are dropped (after binding port),
 	# and the given username is assumed. Default is user "unbound".
 	# If you give "" no privileges are dropped.
 	# username: "unbound"
 
-	# the working directory.
-	# directory: "/etc/unbound"
+	# the working directory. The relative files in this config are 
+	# relative to this directory. If you give "" the working directory
+	# is not changed.
+	# directory: "/usr/local/etc/unbound"
 
 	# the log file, "" means log to stderr. 
 	# Use of this option sets use-syslog to "no".
@@ -157,7 +183,7 @@ server:
 	# use-syslog: yes 
 
 	# the pid file.
-	# pidfile: "/etc/unbound/unbound.pid"
+	# pidfile: "/usr/local/etc/unbound/unbound.pid"
 	
 	# file to read root hints from.
 	# get one from ftp://FTP.INTERNIC.NET/domain/named.cache
@@ -204,6 +230,8 @@ server:
 	# Disabled by default, because some caching forwarders may not
 	# support this (if you have forward-zones). Most authority servers do.
 	# This feature is an experimental implementation of draft dns-0x20.
+	# It is known that some authority servers do not support 0x20, and
+	# resolution will fail for them. A solution is on the TODO list.
 	# use-caps-for-id: no
 	
 	# Do not query the following addresses. No DNS queries are sent there.

doc/requirements.txt

@@ -203,6 +203,6 @@ o If a client makes a query without RD bit, in the case of a returned
 o Case preservation
   Unbound preserves the casing received from authority servers as best 
   as possible. It compresses without case, so case can get lost there.
-  The casing from the authority server is used in preference to the casing
-  of the query name. This is different from BIND. RFC4343 allows either 
+  The casing from the query name is used in preference to the casing
+  of the authority server. This is the same as BIND. RFC4343 allows either 
   behaviour.

doc/unbound-checkconf.8

@@ -36,7 +36,7 @@ The unbound-checkconf program exits with status code 1 on error,
 0 for a correct config file.
 .SH "FILES"
 .TP
-.I /etc/unbound/unbound.conf
+.I /usr/local/etc/unbound/unbound.conf
 unbound configuration file.
 .SH "SEE ALSO"
 \fIunbound.conf\fR(5), 

doc/unbound.8

@@ -32,7 +32,7 @@ Show the version and commandline option help.
 .TP
 .B \-c\fI cfgfile
 Set the config file with settings for unbound to read instead of the 
-file at default location /etc/unbound/unbound.conf. The syntax is
+file at default location /usr/local/etc/unbound/unbound.conf. The syntax is
 described in \fIunbound.conf\fR(5).
 .TP
 .B \-d

doc/unbound.conf.5

@@ -88,6 +88,10 @@ see
 The number of seconds between printing statistics to the log for every thread.
 Disable with value 0 or "". Default is disabled. 
 .TP
+.B statistics-cumulative: \fI<yes or no>
+If enabled, statistics are cumulative since starting unbound, without clearing
+the statistics counters after logging the statistics. Default is no.
+.TP
 .B num\-threads: \fI<number>
 The number of threads to create to serve clients. Use 1 for no threading.
 .TP
@@ -118,15 +122,24 @@ and
 lines, the interfaces are then used for both purposes. Outgoing queries are 
 sent via a random outgoing interface to counter spoofing.
 .TP
-.B outgoing\-port: \fI<port number>
-The starting port number where the outgoing query port range is allocated.
-Default is 1053.
-.TP
 .B outgoing\-range: \fI<number>
-Number of ports to open. This number is opened per thread for every outgoing
-query interface. Must be at least 1. Default is 16.
-Larger numbers give more protection against spoofing attempts, but need
-extra resources from the operating system.
+Number of ports to open. This number of file descriptors can be opened per 
+thread. Must be at least 1. Default is 256. Larger numbers need extra 
+resources from the operating system.
+.TP
+.B outgoing\-port\-permit: \fI<port number or range>
+Permit unbound to open this port or range of ports for use to send queries.
+A larger number of permitted outgoing ports increases resilience against
+spoofing attempts. Make sure these ports are not needed by other daemons. 
+By default only ports above 1024 that have not been assigned by IANA are used.
+Give a port number or a range of the form "low-high", without spaces.
+.TP
+.B outgoing\-port\-avoid: \fI<port number or range>
+Do not permit unbound to open this port or range of ports for use to send 
+queries. Use this to make sure unbound does not grab a port that another
+daemon needs. The port is avoided on all outgoing interfaces, both IP4 and IP6.
+By default only ports above 1024 that have not been assigned by IANA are used.
+Give a port number or a range of the form "low-high", without spaces.
 .TP
 .B outgoing\-num\-tcp: \fI<number>
 Number of outgoing TCP buffers to allocate per thread. Default is 10. If set
@@ -225,8 +238,23 @@ is not designed to handle dropped packets due to policy, and dropping may
 result in (possibly excessive) retried queries.
 .TP
 .B chroot: \fI<directory>
+If chroot is enabled, you should pass the configfile (from the
+commandline) as a full path from the original root. After the
+chroot has been performed the now defunct portion of the config 
+file path is removed to be able to reread the config after a reload. 
+.IP
+All other file paths (working dir, pidfile, logfile, roothints,
+key files) can be specified in several ways:
+as an absolute path relative to the new root,
+as a relative path to the working directory, or
+as an absolute path relative to the original root.
+In the last case the path is adjusted to remove the unused portion.
+.IP
+Additionally, unbound may need to access /dev/random (for entropy)
+and to /dev/log (if you use syslog) from inside the chroot.
+.IP
 If given a chroot is done to the given directory. The default is 
-"/etc/unbound". If you give "" no chroot is performed.
+"/usr/local/etc/unbound". If you give "" no chroot is performed.
 .TP
 .B username: \fI<name>
 If given, after binding the port the user privileges are dropped. Default is
@@ -258,14 +286,14 @@ The logfile setting is overridden when use\-syslog is turned on.
 The default is to log to syslog.
 .TP
 .B pidfile: \fI<filename>
-The process id is written to the file. Default is "/etc/unbound/unbound.pid". 
+The process id is written to the file. Default is "/usr/local/etc/unbound/unbound.pid". 
 So,
 .nf
-kill \-HUP `cat /etc/unbound/unbound.pid` 
+kill \-HUP `cat /usr/local/etc/unbound/unbound.pid` 
 .fi
 triggers a reload,
 .nf
-kill \-QUIT `cat /etc/unbound/unbound.pid` 
+kill \-QUIT `cat /usr/local/etc/unbound/unbound.pid` 
 .fi
 gracefully terminates.
 .TP
@@ -332,10 +360,9 @@ downgrade attack that disables security for a zone. Default is on.
 Use 0x20-encoded random bits in the query to foil spoof attempts.
 This perturbs the lowercase and uppercase of query names sent to 
 authority servers and checks if the reply still has the correct casing. 
-Use together with a large outgoing port range to obtain a high spoof resistance.
 Disabled by default, because some caching forwarders may not
-support this. If you have no forward\-zones it should be possible to enable
-this without problem, it works with most authority servers.
+support this. It is known that some authority servers do not support 0x20, 
+and resolution will fail for them. A solution is on the TODO list.
 This feature is an experimental implementation of draft dns\-0x20.
 .TP
 .B do\-not\-query\-address: \fI<IP address>
@@ -618,7 +645,7 @@ server:
 	num\-threads: 1
 	outgoing\-num\-tcp: 1	# this limits TCP service, uses less buffers.
 	incoming\-num\-tcp: 1
-	outgoing\-range: 1	# uses less memory, but less port randomness.
+	outgoing\-range: 16	# uses less memory, but less performance.
 	msg\-buffer\-size: 8192   # note this limits service, 'no huge stuff'.
 	msg\-cache\-size: 100k
 	msg\-cache\-slabs: 1
@@ -636,7 +663,7 @@ server:
 .fi
 .SH "FILES"
 .TP
-.I /etc/unbound
+.I /usr/local/etc/unbound
 default unbound working directory and default 
 \fIchroot\fR(2)
 location.

iterator/iter_delegpt.h

@@ -106,6 +106,8 @@ struct delegpt_addr {
 	socklen_t addrlen;
 	/** number of attempts for this addr */
 	int attempts;
+	/** rtt stored here in the selection algorithm */
+	int sel_rtt;
 };
 
 /**

iterator/iter_donotq.c

@@ -180,8 +180,10 @@ donotq_apply_cfg(struct iter_donotq* dq, struct config_file* cfg)
 	if(cfg->donotquery_localhost) {
 		if(!donotq_str_cfg(dq, "127.0.0.0/8"))
 			return 0;
-		if(!donotq_str_cfg(dq, "::1"))
-			return 0;
+		if(cfg->do_ip6) {
+			if(!donotq_str_cfg(dq, "::1"))
+				return 0;
+		}
 	}
 	donotq_init_parents(dq);
 	return 1;

iterator/iter_hints.c

@@ -112,7 +112,7 @@ ah(struct delegpt* dp, struct regional* r, const char* sv, const char* ip)
 
 /** obtain compiletime provided root hints */
 static struct delegpt* 
-compile_time_root_prime(struct regional* r)
+compile_time_root_prime(struct regional* r, int do_ip4, int do_ip6)
 {
 	/* from:
 	 ;       This file is made available by InterNIC
@@ -121,14 +121,14 @@ compile_time_root_prime(struct regional* r)
 	 ;           on server           FTP.INTERNIC.NET
 	 ;       -OR-                    RS.INTERNIC.NET
 	 ;
-	 ;       last update:    Jan 29, 2004
-	 ;       related version of root zone:   2004012900
+	 ;       related version of root zone:   2008051300
 	 */
 	struct delegpt* dp = delegpt_create(r);
 	if(!dp)
 		return NULL;
 	if(!delegpt_set_name(dp, r, (uint8_t*)"\000"))
 		return NULL;
+      if(do_ip4) {
 	if(!ah(dp, r, "A.ROOT-SERVERS.NET.", "198.41.0.4"))	return 0;
 	if(!ah(dp, r, "B.ROOT-SERVERS.NET.", "192.228.79.201")) return 0;
 	if(!ah(dp, r, "C.ROOT-SERVERS.NET.", "192.33.4.12"))	return 0;
@@ -142,6 +142,15 @@ compile_time_root_prime(struct regional* r)
 	if(!ah(dp, r, "K.ROOT-SERVERS.NET.", "193.0.14.129"))	return 0;
 	if(!ah(dp, r, "L.ROOT-SERVERS.NET.", "199.7.83.42"))	return 0;
 	if(!ah(dp, r, "M.ROOT-SERVERS.NET.", "202.12.27.33"))	return 0;
+      }
+      if(do_ip6) {
+	if(!ah(dp, r, "A.ROOT-SERVERS.NET.", "2001:503:ba3e::2:30")) return 0;
+	if(!ah(dp, r, "F.ROOT-SERVERS.NET.", "2001:500:2f::f")) return 0;
+	if(!ah(dp, r, "H.ROOT-SERVERS.NET.", "2001:500:1::803f:235")) return 0;
+	if(!ah(dp, r, "J.ROOT-SERVERS.NET.", "2001:503:c27::2:30")) return 0;
+	if(!ah(dp, r, "K.ROOT-SERVERS.NET.", "2001:7fd::1")) return 0;
+	if(!ah(dp, r, "M.ROOT-SERVERS.NET.", "2001:dc3::35")) return 0;
+      }
 	return dp;
 }
 
@@ -433,7 +442,8 @@ hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg)
 
 	/* use fallback compiletime root hints */
 	if(!hints_lookup_root(hints, LDNS_RR_CLASS_IN)) {
-		struct delegpt* dp = compile_time_root_prime(hints->region);
+		struct delegpt* dp = compile_time_root_prime(hints->region,
+			cfg->do_ip4, cfg->do_ip6);
 		verbose(VERB_ALGO, "no config, using builtin root hints.");
 		if(!dp) 
 			return 0;

iterator/iter_scrub.c

@@ -564,6 +564,14 @@ scrub_message(ldns_buffer* pkt, struct msg_parse* msg,
 	if( !(msg->flags&BIT_QR) )
 		return 0;
 	
+	/* make sure that a query is echoed back when NOERROR or NXDOMAIN */
+	/* this is not required for basic operation but is a forgery 
+	 * resistance (security) feature */
+	if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
+		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
+		msg->qdcount == 0)
+		return 0;
+
 	/* if a query is echoed back, make sure it is correct. Otherwise,
 	 * this may be not a reply to our query. */
 	if(msg->qdcount == 1) {

iterator/iter_utils.c

@@ -156,38 +156,61 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	return UNKNOWN_SERVER_NICENESS;
 }
 
+/** lookup RTT information, and also store fastest rtt (if any) */
+static int
+iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
+	uint8_t* name, size_t namelen, uint32_t now, struct delegpt* dp,
+	int* best_rtt)
+{
+	int got_it = 0;
+	struct delegpt_addr* a;
+	for(a=dp->result_list; a; a = a->next_result) {
+		a->sel_rtt = iter_filter_unsuitable(iter_env, env, 
+			name, namelen, now, a);
+		if(a->sel_rtt != -1) {
+			if(!got_it) {
+				*best_rtt = a->sel_rtt;
+				got_it = 1;
+			} else if(a->sel_rtt < *best_rtt) {
+				*best_rtt = a->sel_rtt;
+			}
+		}
+	}
+	return got_it;
+}
+
 /** filter the addres list, putting best targets at front,
  * returns number of best targets (or 0, no suitable targets) */
 static int
 iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 	uint8_t* name, size_t namelen, uint32_t now, struct delegpt* dp,
-	int* best_rtt)
+	int* selected_rtt)
 {
-	int got_num = 0, got_rtt = 0, thisrtt, swap_to_front;
+	int got_num = 0, low_rtt = 0, swap_to_front;
 	struct delegpt_addr* a, *n, *prev=NULL;
 
+	/* fillup sel_rtt and find best rtt in the bunch */
+	got_num = iter_fill_rtt(iter_env, env, name, namelen, now, dp, 
+		&low_rtt);
+	if(got_num == 0) 
+		return 0;
+
+	got_num = 0;
 	a = dp->result_list;
 	while(a) {
-		/* filter out unsuitable targets */
-		thisrtt = iter_filter_unsuitable(iter_env, env, name, namelen, 
-			now, a);
-		if(thisrtt == -1) {
+		/* skip unsuitable targets */
+		if(a->sel_rtt == -1) {
 			prev = a;
 			a = a->next_result;
 			continue;
 		}
 		/* classify the server address and determine what to do */
 		swap_to_front = 0;
-		if(got_num == 0) {
-			got_rtt = thisrtt;
-			got_num = 1;
-			swap_to_front = 1;
-		} else if(thisrtt == got_rtt) {
+		if(a->sel_rtt >= low_rtt && a->sel_rtt - low_rtt <= RTT_BAND) {
 			got_num++;
 			swap_to_front = 1;
-		} else if(thisrtt < got_rtt) {
-			got_rtt = thisrtt;
-			got_num = 1; /* start back at count of 1 */
+		} else if(a->sel_rtt<low_rtt && low_rtt-a->sel_rtt<=RTT_BAND) {
+			got_num++;
 			swap_to_front = 1;
 		}
 		/* swap to front if necessary, or move to next result */
@@ -202,7 +225,7 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 			a = a->next_result;
 		}
 	}
-	*best_rtt = got_rtt;
+	*selected_rtt = low_rtt;
 	return got_num;
 }
 

iterator/iterator.c

@@ -1717,7 +1717,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	iq->response = dns_alloc_msg(pkt, prs, qstate->region);
 	if(!iq->response)
 		goto handle_it;
-	log_query_info(VERB_DETAIL, "reponse for", &qstate->qinfo);
+	log_query_info(VERB_DETAIL, "response for", &qstate->qinfo);
 	log_name_addr(VERB_DETAIL, "reply from", iq->dp->name, 
 		&qstate->reply->addr, qstate->reply->addrlen);
 	if(verbosity >= VERB_ALGO)

iterator/iterator.h

@@ -66,6 +66,10 @@ struct iter_prep_list;
 #define USEFUL_SERVER_TOP_TIMEOUT	120000
 /** number of retries on outgoing queries */
 #define OUTBOUND_MSG_RETRY 4
+/** RTT band, within this amount from the best, servers are chosen randomly.
+ * Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a 
+ * fast server, this causes server exploration as a side benefit. msec. */
+#define RTT_BAND 400
 
 /**
  * Global state for the iterator. 

libunbound/libunbound.c

@@ -889,6 +889,8 @@ ub_ctx_hosts(struct ub_ctx* ctx, char* fname)
 			parse++;
 		if(*parse == '\n' || *parse == 0)
 			continue;
+		if(*parse == '%') 
+			continue; /* ignore macOSX fe80::1%lo0 localhost */
 		if(*parse != ' ' && *parse != '\t') {
 			/* must have whitespace after address */
 			fclose(in);

libunbound/libworker.c

@@ -93,6 +93,8 @@ libworker_setup(struct ub_ctx* ctx, int is_bg)
 	unsigned int seed;
 	struct libworker* w = (struct libworker*)calloc(1, sizeof(*w));
 	struct config_file* cfg = ctx->env->cfg;
+	int* ports;
+	int numports;
 	if(!w) return NULL;
 	w->is_bg = is_bg;
 	w->ctx = ctx;
@@ -149,14 +151,21 @@ libworker_setup(struct ub_ctx* ctx, int is_bg)
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_lock(&ctx->cfglock);
 	}
+	numports = cfg_condense_ports(cfg, &ports);
+	if(numports == 0) {
+		libworker_delete(w);
+		return NULL;
+	}
 	w->back = outside_network_create(w->base, cfg->msg_buffer_size,
 		(size_t)cfg->outgoing_num_ports, cfg->out_ifs,
-		cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, -1, 
+		cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, 
 		cfg->do_tcp?cfg->outgoing_num_tcp:0,
-		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id);
+		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id,
+		ports, numports);
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);
 	}
+	free(ports);
 	if(!w->back) {
 		libworker_delete(w);
 		return NULL;
@@ -767,12 +776,10 @@ int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
 	struct libworker* w = (struct libworker*)q->env->worker;
 	if(use_tcp) {
 		return pending_tcp_query(w->back, pkt, addr, addrlen,
-			timeout, libworker_handle_reply, q, 
-			q->env->rnd) != 0;
+			timeout, libworker_handle_reply, q) != 0;
 	}
 	return pending_udp_query(w->back, pkt, addr, addrlen,
-		timeout*1000, libworker_handle_reply, q, 
-		q->env->rnd) != 0;
+		timeout*1000, libworker_handle_reply, q) != 0;
 }
 
 /** compare outbound entry qstates */

services/listen_dnsport.c

@@ -86,7 +86,8 @@ verbose_print_addr(struct addrinfo *addr)
 }
 
 int
-create_udp_sock(struct addrinfo *addr, int v6only)
+create_udp_sock(int family, int socktype, struct sockaddr* addr,
+        socklen_t addrlen, int v6only, int* inuse)
 {
 	int s;
 # if defined(IPV6_USE_MIN_MTU)
@@ -94,12 +95,12 @@ create_udp_sock(struct addrinfo *addr, int v6only)
 # else
 	(void)v6only;
 # endif
-	verbose_print_addr(addr);
-	if((s = socket(addr->ai_family, addr->ai_socktype, 0)) == -1) {
+	if((s = socket(family, socktype, 0)) == -1) {
 		log_err("can't create socket: %s", strerror(errno));
+		*inuse = 0;
 		return -1;
 	}
-	if(addr->ai_family == AF_INET6) {
+	if(family == AF_INET6) {
 # if defined(IPV6_V6ONLY)
 		if(v6only) {
 			int val=(v6only==2)?0:1;
@@ -107,6 +108,8 @@ create_udp_sock(struct addrinfo *addr, int v6only)
 				&val, (socklen_t)sizeof(val)) < 0) {
 				log_err("setsockopt(..., IPV6_V6ONLY"
 					", ...) failed: %s", strerror(errno));
+				close(s);
+				*inuse = 0;
 				return -1;
 			}
 		}
@@ -124,16 +127,26 @@ create_udp_sock(struct addrinfo *addr, int v6only)
 			&on, (socklen_t)sizeof(on)) < 0) {
 			log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
 				"...) failed: %s", strerror(errno));
+			close(s);
+			*inuse = 0;
 			return -1;
 		}
 # endif
 	}
-	if(bind(s, (struct sockaddr*)addr->ai_addr, addr->ai_addrlen) != 0) {
-		log_err("can't bind socket: %s", strerror(errno));
+	if(bind(s, (struct sockaddr*)addr, addrlen) != 0) {
+#ifdef EADDRINUSE
+		*inuse = (errno == EADDRINUSE);
+		if(errno != EADDRINUSE)
+#endif
+			log_err("can't bind socket: %s", strerror(errno));
+		close(s);
 		return -1;
 	}
-	if(!fd_set_nonblock(s))
+	if(!fd_set_nonblock(s)) {
+		*inuse = 0;
+		close(s);
 		return -1;
+	}
 	return s;
 }
 
@@ -175,7 +188,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only)
 #else
 	(void)v6only;
 #endif /* IPV6_V6ONLY */
-	if(bind(s, (struct sockaddr*)addr->ai_addr, addr->ai_addrlen) != 0) {
+	if(bind(s, addr->ai_addr, addr->ai_addrlen) != 0) {
 		log_err("can't bind socket: %s", strerror(errno));
 		return -1;
 	}
@@ -203,7 +216,7 @@ make_sock(int stype, const char* ifname, const char* port,
 	struct addrinfo *hints, int v6only)
 {
 	struct addrinfo *res = NULL;
-	int r, s;
+	int r, s, inuse;
 	hints->ai_socktype = stype;
 	if((r=getaddrinfo(ifname, port, hints, &res)) != 0 || !res) {
 		log_err("node %s:%s getaddrinfo: %s %s", 
@@ -211,9 +224,15 @@ make_sock(int stype, const char* ifname, const char* port,
 			r==EAI_SYSTEM?(char*)strerror(errno):"");
 		return -1;
 	}
-	if(stype == SOCK_DGRAM)
-		s = create_udp_sock(res, v6only);
-	else	s = create_tcp_accept_sock(res, v6only);
+	if(stype == SOCK_DGRAM) {
+		verbose_print_addr(res);
+		s = create_udp_sock(res->ai_family, res->ai_socktype,
+			(struct sockaddr*)res->ai_addr, 
+			res->ai_addrlen, v6only, &inuse);
+		if(s == -1 && inuse) {
+			log_err("bind: address already in use");
+		}
+	}	else	s = create_tcp_accept_sock(res, v6only);
 	freeaddrinfo(res);
 	return s;
 }
@@ -243,7 +262,11 @@ port_insert(struct listen_port** list, int s, enum listen_type ftype)
 static int
 set_recvpktinfo(int s, int family) 
 {
+#if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || defined(IP_RECVDSTADDR) || defined(IP_PKTINFO)
 	int on = 1;
+#else
+	(void)s;
+#endif
 	if(family == AF_INET6) {
 #           ifdef IPV6_RECVPKTINFO
 		if(setsockopt(s, IPPROTO_IPV6, IPV6_RECVPKTINFO,

services/listen_dnsport.h

@@ -45,7 +45,6 @@
 #include "config.h"
 #include "util/netevent.h"
 struct listen_list;
-struct addrinfo;
 struct config_file;
 
 /**
@@ -165,11 +164,16 @@ size_t listen_get_mem(struct listen_dnsport* listen);
 
 /**
  * Create and bind nonblocking UDP socket
- * @param addr: address info ready to make socket.
+ * @param family: for socket call.
+ * @param socktype: for socket call.
+ * @param addr: for bind call.
+ * @param addrlen: for bind call.
  * @param v6only: if enabled, IP6 sockets get IP6ONLY option set.
  * 	if enabled with value 2 IP6ONLY option is disabled.
+ * @param inuse: on error, this is set true if the port was in use.
  * @return: the socket. -1 on error.
  */
-int create_udp_sock(struct addrinfo* addr, int v6only);
+int create_udp_sock(int family, int socktype, struct sockaddr* addr, 
+	socklen_t addrlen, int v6only, int* inuse);
 
 #endif /* LISTEN_DNSPORT_H */

services/outside_network.c

@@ -61,12 +61,17 @@
 
 /** number of times to retry making a random ID that is unique. */
 #define MAX_ID_RETRY 1000
+/** number of times to retry finding interface, port that can be opened. */
+#define MAX_PORT_RETRY 10000
 /** number of retries on outgoing UDP queries */
 #define OUTBOUND_UDP_RETRY 1
 
 /** initiate TCP transaction for serviced query */
 static void serviced_tcp_initiate(struct outside_network* outnet, 
 	struct serviced_query* sq, ldns_buffer* buff);
+/** with a fd available, randomize and send UDP */
+static int randomize_and_send_udp(struct outside_network* outnet, 
+	struct pending* pend, ldns_buffer* packet, int timeout);
 
 int 
 pending_cmp(const void* key1, const void* key2)
@@ -226,6 +231,55 @@ outnet_tcp_cb(struct comm_point* c, void* arg, int error,
 	return 0;
 }
 
+/** lower use count on pc, see if it can be closed */
+static void
+portcomm_loweruse(struct outside_network* outnet, struct port_comm* pc)
+{
+	struct port_if* pif;
+	pc->num_outstanding--;
+	if(pc->num_outstanding > 0) {
+		return;
+	}
+	/* close it and replace in unused list */
+	verbose(VERB_ALGO, "close of port %d", pc->number);
+	comm_point_close(pc->cp);
+	pif = pc->pif;
+	log_assert(pif->inuse > 0);
+	pif->avail_ports[pif->avail_total - pif->inuse] = pc->number;
+	pif->inuse--;
+	pif->out[pc->index] = pif->out[pif->inuse];
+	pif->out[pc->index]->index = pc->index;
+	pc->next = outnet->unused_fds;
+	outnet->unused_fds = pc;
+}
+
+/** try to send waiting UDP queries */
+static void
+outnet_send_wait_udp(struct outside_network* outnet)
+{
+	struct pending* pend;
+	/* process waiting queries */
+	while(outnet->udp_wait_first && outnet->unused_fds) {
+		pend = outnet->udp_wait_first;
+		outnet->udp_wait_first = pend->next_waiting;
+		if(!pend->next_waiting) outnet->udp_wait_last = NULL;
+		ldns_buffer_clear(outnet->udp_buff);
+		ldns_buffer_write(outnet->udp_buff, pend->pkt, pend->pkt_len);
+		ldns_buffer_flip(outnet->udp_buff);
+		free(pend->pkt); /* freeing now makes get_mem correct */
+		pend->pkt = NULL; 
+		pend->pkt_len = 0;
+		if(!randomize_and_send_udp(outnet, pend, outnet->udp_buff, 
+			pend->timeout)) {
+			/* callback error on pending */
+			fptr_ok(fptr_whitelist_pending_udp(pend->cb));
+			(void)(*pend->cb)(outnet->unused_fds->cp, pend->cb_arg, 
+				NETEVENT_CLOSED, NULL);
+			pending_delete(outnet, pend);
+		}
+	}
+}
+
 int 
 outnet_udp_cb(struct comm_point* c, void* arg, int error,
 	struct comm_reply *reply_info)
@@ -246,7 +300,7 @@ outnet_udp_cb(struct comm_point* c, void* arg, int error,
 	log_assert(reply_info);
 
 	/* setup lookup key */
-	key.id = LDNS_ID_WIRE(ldns_buffer_begin(c->buffer));
+	key.id = (unsigned)LDNS_ID_WIRE(ldns_buffer_begin(c->buffer));
 	memcpy(&key.addr, &reply_info->addr, reply_info->addrlen);
 	key.addrlen = reply_info->addrlen;
 	verbose(VERB_ALGO, "Incoming reply id = %4.4x", key.id);
@@ -264,7 +318,7 @@ outnet_udp_cb(struct comm_point* c, void* arg, int error,
 
 	verbose(VERB_ALGO, "received udp reply.");
 	log_buf(VERB_ALGO, "udp message", c->buffer);
-	if(p->c != c) {
+	if(p->pc->cp != c) {
 		verbose(VERB_QUERY, "received reply id,addr on wrong port. "
 			"dropped.");
 		return 0;
@@ -274,114 +328,36 @@ outnet_udp_cb(struct comm_point* c, void* arg, int error,
 	/* delete from tree first in case callback creates a retry */
 	(void)rbtree_delete(outnet->pending, p->node.key);
 	fptr_ok(fptr_whitelist_pending_udp(p->cb));
-	(void)(*p->cb)(p->c, p->cb_arg, NETEVENT_NOERROR, reply_info);
+	(void)(*p->cb)(p->pc->cp, p->cb_arg, NETEVENT_NOERROR, reply_info);
+	portcomm_loweruse(outnet, p->pc);
 	pending_delete(NULL, p);
+	outnet_send_wait_udp(outnet);
 	return 0;
 }
 
-/** open another udp port to listen to, every thread has its own range
-  * of open ports.
-  * @param ifname: on which interface to open the port.
-  * @param hints: hints on family and passiveness preset.
-  * @param porthint: if not -1, it gives the port to base range on.
-  * @return: file descriptor
-  */
-static int 
-open_udp_port_range(const char* ifname, struct addrinfo* hints, int porthint)
-{
-	struct addrinfo *res = NULL;
-	int r, s;
-	char portstr[32];
-	if(porthint != -1)
-		snprintf(portstr, sizeof(portstr), "%d", porthint);
-	else if(!ifname) {
-		if(hints->ai_family == AF_INET)
-			ifname = "0.0.0.0";
-		else	ifname="::";
-	}
-
-	if((r=getaddrinfo(ifname, ((porthint==-1)?NULL:portstr), hints, 
-		&res)) != 0 || !res) {
-		log_err("node %s %s getaddrinfo: %s %s",
-			ifname?ifname:"default", (porthint!=-1)?portstr:"eph", 
-			gai_strerror(r), 
-			r==EAI_SYSTEM?(char*)strerror(errno):"");
-		return -1;
-	}
-	s = create_udp_sock(res, 1);
-	freeaddrinfo(res);
-	return s;
-}
-
-/**
- * Create range of UDP ports on the given interface.
- * Returns number of ports bound.
- * @param coms: communication point array start position. Filled with entries.
- * @param ifname: name of interface to make port on.
- * @param num_ports: number of ports opened.
- * @param do_ip4: if true make ip4 ports.
- * @param do_ip6: if true make ip6 ports.
- * @param porthint: -1 for system chosen port, or a base of port range.
- * @param outnet: network structure with comm base, shared udp buffer.
- * @return: the number of ports successfully opened, entries filled in coms.
- */
-static size_t 
-make_udp_range(struct comm_point** coms, const char* ifname, 
-	size_t num_ports, int do_ip4, int do_ip6, int porthint,
-	struct outside_network* outnet)
-{
-	size_t i;
-	size_t done = 0;
-	struct addrinfo hints;
-	memset(&hints, 0, sizeof(hints));
-	hints.ai_flags = AI_PASSIVE;
-	if(ifname)
-		hints.ai_flags |= AI_NUMERICHOST;
-	hints.ai_family = AF_UNSPEC;
-	if(do_ip4 && do_ip6)
-		hints.ai_family = AF_UNSPEC;
-	else if(do_ip4)
-		hints.ai_family = AF_INET;
-	else if(do_ip6)
-		hints.ai_family = AF_INET6;
-	hints.ai_socktype = SOCK_DGRAM;
-	for(i=0; i<num_ports; i++) {
-		int fd = open_udp_port_range(ifname, &hints, porthint);
-		if(porthint != -1) 
-			porthint++;
-		if(fd == -1)
-			continue;
-		coms[done] = comm_point_create_udp(outnet->base, fd, 
-			outnet->udp_buff, outnet_udp_cb, outnet);
-		if(coms[done])
-			done++;
-	}
-	return done;
-}
-
-/** calculate number of ip4 and ip6 interfaces, times multiplier */
+/** calculate number of ip4 and ip6 interfaces*/
 static void 
 calc_num46(char** ifs, int num_ifs, int do_ip4, int do_ip6, 
-	size_t multiplier, size_t* num_ip4, size_t* num_ip6)
+	int* num_ip4, int* num_ip6)
 {
 	int i;
 	*num_ip4 = 0;
 	*num_ip6 = 0;
 	if(num_ifs <= 0) {
 		if(do_ip4)
-			*num_ip4 = multiplier;
+			*num_ip4 = 1;
 		if(do_ip6)
-			*num_ip6 = multiplier;
+			*num_ip6 = 1;
 		return;
 	}
 	for(i=0; i<num_ifs; i++)
 	{
 		if(str_is_ip6(ifs[i])) {
 			if(do_ip6)
-				*num_ip6 += multiplier;
+				(*num_ip6)++;
 		} else {
 			if(do_ip4)
-				*num_ip4 += multiplier;
+				(*num_ip4)++;
 		}
 	}
 
@@ -391,11 +367,14 @@ void
 pending_udp_timer_cb(void *arg)
 {
 	struct pending* p = (struct pending*)arg;
+	struct outside_network* outnet = p->outnet;
 	/* it timed out */
 	verbose(VERB_ALGO, "timeout udp");
 	fptr_ok(fptr_whitelist_pending_udp(p->cb));
-	(void)(*p->cb)(p->c, p->cb_arg, NETEVENT_TIMEOUT, NULL);
-	pending_delete(p->outnet, p);
+	(void)(*p->cb)(p->pc->cp, p->cb_arg, NETEVENT_TIMEOUT, NULL);
+	portcomm_loweruse(outnet, p->pc);
+	pending_delete(outnet, p);
+	outnet_send_wait_udp(outnet);
 }
 
 /** create pending_tcp buffers */
@@ -423,15 +402,35 @@ create_pending_tcp(struct outside_network* outnet, size_t bufsize)
 	return 1;
 }
 
+/** setup an outgoing interface, ready address */
+static int setup_if(struct port_if* pif, const char* addrstr, 
+	int* avail, int numavail, size_t numfd)
+{
+	pif->avail_total = numavail;
+	pif->avail_ports = (int*)memdup(avail, (size_t)numavail*sizeof(int));
+	if(!pif->avail_ports)
+		return 0;
+	if(!ipstrtoaddr(addrstr, UNBOUND_DNS_PORT, &pif->addr, &pif->addrlen))
+		return 0;
+	pif->maxout = (int)numfd;
+	pif->inuse = 0;
+	pif->out = (struct port_comm**)calloc(numfd, 
+		sizeof(struct port_comm*));
+	if(!pif->out)
+		return 0;
+	return 1;
+}
+
 struct outside_network* 
 outside_network_create(struct comm_base *base, size_t bufsize, 
 	size_t num_ports, char** ifs, int num_ifs, int do_ip4, 
-	int do_ip6, int port_base, size_t num_tcp, struct infra_cache* infra,
-	struct ub_randstate* rnd, int use_caps_for_id)
+	int do_ip6, size_t num_tcp, struct infra_cache* infra,
+	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
+	int numavailports)
 {
 	struct outside_network* outnet = (struct outside_network*)
 		calloc(1, sizeof(struct outside_network));
-	int k;
+	size_t k;
 	if(!outnet) {
 		log_err("malloc failed");
 		return NULL;
@@ -443,17 +442,33 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	outnet->rnd = rnd;
 	outnet->svcd_overhead = 0;
 	outnet->use_caps_for_id = use_caps_for_id;
+	if(numavailports == 0) {
+		log_err("no outgoing ports available");
+		outside_network_delete(outnet);
+		return NULL;
+	}
 #ifndef INET6
 	do_ip6 = 0;
 #endif
-	calc_num46(ifs, num_ifs, do_ip4, do_ip6, num_ports, 
-		&outnet->num_udp4, &outnet->num_udp6);
-	/* adds +1 to portnums so we do not allocate zero bytes. */
+	calc_num46(ifs, num_ifs, do_ip4, do_ip6, 
+		&outnet->num_ip4, &outnet->num_ip6);
+	if(outnet->num_ip4 != 0) {
+		if(!(outnet->ip4_ifs = (struct port_if*)calloc(
+			(size_t)outnet->num_ip4, sizeof(struct port_if)))) {
+			log_err("malloc failed");
+			outside_network_delete(outnet);
+			return NULL;
+		}
+	}
+	if(outnet->num_ip6 != 0) {
+		if(!(outnet->ip6_ifs = (struct port_if*)calloc(
+			(size_t)outnet->num_ip6, sizeof(struct port_if)))) {
+			log_err("malloc failed");
+			outside_network_delete(outnet);
+			return NULL;
+		}
+	}
 	if(	!(outnet->udp_buff = ldns_buffer_new(bufsize)) ||
-		!(outnet->udp4_ports = (struct comm_point **)calloc(
-			outnet->num_udp4+1, sizeof(struct comm_point*))) ||
-		!(outnet->udp6_ports = (struct comm_point **)calloc(
-			outnet->num_udp6+1, sizeof(struct comm_point*))) ||
 		!(outnet->pending = rbtree_create(pending_cmp)) ||
 		!(outnet->serviced = rbtree_create(serviced_cmp)) ||
 		!create_pending_tcp(outnet, bufsize)) {
@@ -461,49 +476,65 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 		outside_network_delete(outnet);
 		return NULL;
 	}
-	/* Try to get ip6 and ip4 ports. Ip6 first, in case second fails. */
+
+	/* allocate commpoints */
+	for(k=0; k<num_ports; k++) {
+		struct port_comm* pc;
+		pc = (struct port_comm*)calloc(1, sizeof(*pc));
+		if(!pc) {
+			log_err("malloc failed");
+			outside_network_delete(outnet);
+			return NULL;
+		}
+		pc->cp = comm_point_create_udp(outnet->base, -1, 
+			outnet->udp_buff, outnet_udp_cb, outnet);
+		if(!pc->cp) {
+			log_err("malloc failed");
+			free(pc);
+			outside_network_delete(outnet);
+			return NULL;
+		}
+		pc->next = outnet->unused_fds;
+		outnet->unused_fds = pc;
+	}
+
+	/* allocate interfaces */
 	if(num_ifs == 0) {
-		if(do_ip6) {
-		   	outnet->num_udp6 = make_udp_range(outnet->udp6_ports, 
-				NULL, num_ports, 0, 1, port_base, outnet);
-		}
-		if(do_ip4) {
-			outnet->num_udp4 = make_udp_range(outnet->udp4_ports, 
-				NULL, num_ports, 1, 0, port_base, outnet);
-		}
-		if( (do_ip4 && outnet->num_udp4 != num_ports) || 
-			(do_ip6 && outnet->num_udp6 != num_ports)) {
-			log_err("Could not open all networkside ports");
+		if(do_ip4 && !setup_if(&outnet->ip4_ifs[0], "0.0.0.0", 
+			availports, numavailports, num_ports)) {
+			log_err("malloc failed");
 			outside_network_delete(outnet);
 			return NULL;
 		}
-	}
-	else {
+		if(do_ip6 && !setup_if(&outnet->ip6_ifs[0], "::", 
+			availports, numavailports, num_ports)) {
+			log_err("malloc failed");
+			outside_network_delete(outnet);
+			return NULL;
+		}
+	} else {
 		size_t done_4 = 0, done_6 = 0;
-		for(k=0; k<num_ifs; k++) {
-			if(str_is_ip6(ifs[k]) && do_ip6) {
-				done_6 += make_udp_range(
-					outnet->udp6_ports+done_6, ifs[k],
-					num_ports, 0, 1, port_base, outnet);
+		int i;
+		for(i=0; i<num_ifs; i++) {
+			if(str_is_ip6(ifs[i]) && do_ip6) {
+				if(!setup_if(&outnet->ip6_ifs[done_6], ifs[i],
+					availports, numavailports, num_ports)){
+					log_err("malloc failed");
+					outside_network_delete(outnet);
+					return NULL;
+				}
+				done_6++;
 			}
-			if(!str_is_ip6(ifs[k]) && do_ip4) {
-				done_4 += make_udp_range(
-					outnet->udp4_ports+done_4, ifs[k],
-					num_ports, 1, 0, port_base, outnet);
+			if(!str_is_ip6(ifs[i]) && do_ip4) {
+				if(!setup_if(&outnet->ip4_ifs[done_4], ifs[i],
+					availports, numavailports, num_ports)){
+					log_err("malloc failed");
+					outside_network_delete(outnet);
+					return NULL;
+				}
+				done_4++;
 			}
 		}
-		if(done_6 != outnet->num_udp6 || done_4 != outnet->num_udp4) {
-			log_err("Could not open all ports on all interfaces");
-			outside_network_delete(outnet);
-			return NULL;
-		}
-		outnet->num_udp6 = done_6;
-		outnet->num_udp4 = done_4;
-	}
-	if(outnet->num_udp4 + outnet->num_udp6 == 0) {
-		log_err("Could not open any ports on outgoing interfaces");
-		outside_network_delete(outnet);
-		return NULL;
 	}
 	return outnet;
 }
@@ -549,17 +580,43 @@ outside_network_delete(struct outside_network* outnet)
 	}
 	if(outnet->udp_buff)
 		ldns_buffer_free(outnet->udp_buff);
-	if(outnet->udp4_ports) {
-		size_t i;
-		for(i=0; i<outnet->num_udp4; i++)
-			comm_point_delete(outnet->udp4_ports[i]);
-		free(outnet->udp4_ports);
+	if(outnet->unused_fds) {
+		struct port_comm* p = outnet->unused_fds, *np;
+		while(p) {
+			np = p->next;
+			comm_point_delete(p->cp);
+			free(p);
+			p = np;
+		}
+		outnet->unused_fds = NULL;
 	}
-	if(outnet->udp6_ports) {
-		size_t i;
-		for(i=0; i<outnet->num_udp6; i++)
-			comm_point_delete(outnet->udp6_ports[i]);
-		free(outnet->udp6_ports);
+	if(outnet->ip4_ifs) {
+		int i, k;
+		for(i=0; i<outnet->num_ip4; i++) {
+			for(k=0; k<outnet->ip4_ifs[i].inuse; k++) {
+				struct port_comm* pc = outnet->ip4_ifs[i].
+					out[k];
+				comm_point_delete(pc->cp);
+				free(pc);
+			}
+			free(outnet->ip4_ifs[i].avail_ports);
+			free(outnet->ip4_ifs[i].out);
+		}
+		free(outnet->ip4_ifs);
+	}
+	if(outnet->ip6_ifs) {
+		int i, k;
+		for(i=0; i<outnet->num_ip6; i++) {
+			for(k=0; k<outnet->ip6_ifs[i].inuse; k++) {
+				struct port_comm* pc = outnet->ip6_ifs[i].
+					out[k];
+				comm_point_delete(pc->cp);
+				free(pc);
+			}
+			free(outnet->ip6_ifs[i].avail_ports);
+			free(outnet->ip6_ifs[i].out);
+		}
+		free(outnet->ip6_ifs);
 	}
 	if(outnet->tcp_conns) {
 		size_t i;
@@ -579,7 +636,14 @@ outside_network_delete(struct outside_network* outnet)
 			p = np;
 		}
 	}
-
+	if(outnet->udp_wait_first) {
+		struct pending* p = outnet->udp_wait_first, *np;
+		while(p) {
+			np = p->next_waiting;
+			pending_delete(NULL, p);
+			p = np;
+		}
+	}
 	free(outnet);
 }
 
@@ -593,123 +657,162 @@ pending_delete(struct outside_network* outnet, struct pending* p)
 	}
 	if(p->timer)
 		comm_timer_delete(p->timer);
+	free(p->pkt);
 	free(p);
 }
 
-/** create a new pending item with given characteristics, false on failure */
-static struct pending*
-new_pending(struct outside_network* outnet, ldns_buffer* packet, 
-	struct sockaddr_storage* addr, socklen_t addrlen,
-	comm_point_callback_t* callback, void* callback_arg, 
-	struct ub_randstate* rnd)
+/**
+ * Try to open a UDP socket for outgoing communication.
+ * Sets sockets options as needed.
+ * @param addr: socket address.
+ * @param addrlen: length of address.
+ * @param port: port override for addr.
+ * @param inuse: if -1 is returned, this bool means the port was in use.
+ * @return fd or -1
+ */
+static int
+udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int port, 
+	int* inuse)
+{
+	int fd;
+	if(addr_is_ip6(addr, addrlen)) {
+		struct sockaddr_in6* sa = (struct sockaddr_in6*)addr;
+		sa->sin6_port = (in_port_t)htons((uint16_t)port);
+		fd = create_udp_sock(AF_INET6, SOCK_DGRAM, 
+			(struct sockaddr*)addr, addrlen, 1, inuse);
+	} else {
+		struct sockaddr_in* sa = (struct sockaddr_in*)addr;
+		sa->sin_port = (in_port_t)htons((uint16_t)port);
+		fd = create_udp_sock(AF_INET, SOCK_DGRAM, 
+			(struct sockaddr*)addr, addrlen, 1, inuse);
+	}
+	return fd;
+}
+
+/** Select random ID */
+static int
+select_id(struct outside_network* outnet, struct pending* pend,
+	ldns_buffer* packet)
 {
-	/* alloc */
 	int id_tries = 0;
-	struct pending* pend = (struct pending*)calloc(1, 
-		sizeof(struct pending));
-	if(!pend) {
-		log_err("malloc failure");
-		return NULL;
-	}
-	pend->timer = comm_timer_create(outnet->base, pending_udp_timer_cb, 
-		pend);
-	if(!pend->timer) {
-		free(pend);
-		return NULL;
-	}
-	/* set */
-	pend->id = ((unsigned)ub_random(rnd)>>8) & 0xffff;
+	pend->id = ((unsigned)ub_random(outnet->rnd)>>8) & 0xffff;
 	LDNS_ID_SET(ldns_buffer_begin(packet), pend->id);
-	memcpy(&pend->addr, addr, addrlen);
-	pend->addrlen = addrlen;
-	pend->cb = callback;
-	pend->cb_arg = callback_arg;
-	pend->outnet = outnet;
 
 	/* insert in tree */
 	pend->node.key = pend;
 	while(!rbtree_insert(outnet->pending, &pend->node)) {
 		/* change ID to avoid collision */
-		pend->id = ((unsigned)ub_random(rnd)>>8) & 0xffff;
+		pend->id = ((unsigned)ub_random(outnet->rnd)>>8) & 0xffff;
 		LDNS_ID_SET(ldns_buffer_begin(packet), pend->id);
 		id_tries++;
 		if(id_tries == MAX_ID_RETRY) {
+			pend->id=99999; /* non existant ID */
 			log_err("failed to generate unique ID, drop msg");
-			pending_delete(NULL, pend);
-			return NULL;
+			return 0;
 		}
 	}
 	verbose(VERB_ALGO, "inserted new pending reply id=%4.4x", pend->id);
-	return pend;
+	return 1;
 }
 
-/** 
- * Select outgoing comm point for a query. Fills in c. 
- * @param outnet: network structure that has arrays of ports to choose from.
- * @param pend: the message to send. c is filled in, randomly chosen.
- * @param rnd: random state for generating ID and port.
- */
-static void 
-select_port(struct outside_network* outnet, struct pending* pend,
-	struct ub_randstate* rnd)
+/** Select random interface and port */
+static int
+select_ifport(struct outside_network* outnet, struct pending* pend,
+	int num_if, struct port_if* ifs)
 {
-	double precho;
-	int chosen, nummax;
-
-	log_assert(outnet && pend);
-	/* first select ip4 or ip6. */
-	if(addr_is_ip6(&pend->addr, pend->addrlen))
-		nummax = (int)outnet->num_udp6;
-	else 	nummax = (int)outnet->num_udp4;
-
-	if(nummax == 0) {
-		/* could try ip4to6 mapping if no ip4 ports available */
-		log_err("Need to send query but have no ports of that family");
-		return;
+	int my_if, my_port, fd, portno, inuse, tries=0;
+	struct port_if* pif;
+	/* randomly select interface and port */
+	if(num_if == 0) {
+		verbose(VERB_QUERY, "Need to send query but have no "
+			"outgoing interfaces of that family");
+		return 0;
 	}
+	log_assert(outnet->unused_fds);
+	tries = 0;
+	while(1) {
+		my_if = ub_random(outnet->rnd) % num_if;
+		pif = &ifs[my_if];
+		my_port = ub_random(outnet->rnd) % pif->avail_total;
+		if(my_port < pif->inuse) {
+			/* port already open */
+			pend->pc = pif->out[my_port];
+			verbose(VERB_ALGO, "using UDP if=%d port=%d", 
+				my_if, pend->pc->number);
+			break;
+		}
+		/* try to open new port, if fails, loop to try again */
+		log_assert(pif->inuse < pif->maxout);
+		portno = pif->avail_ports[my_port - pif->inuse];
+		fd = udp_sockport(&pif->addr, pif->addrlen, portno, &inuse);
+		if(fd == -1 && !inuse) {
+			/* nonrecoverable error making socket */
+			return 0;
+		}
+		if(fd != -1) {
+			verbose(VERB_ALGO, "opened UDP if=%d port=%d", 
+				my_if, portno);
+			/* grab fd */
+			pend->pc = outnet->unused_fds;
+			outnet->unused_fds = pend->pc->next;
 
-	/* choose a random outgoing port and interface */
-	precho = (double)ub_random(rnd) * (double)nummax / 
-		((double)RAND_MAX + 1.0);
-	chosen = (int)precho;
+			/* setup portcomm */
+			pend->pc->next = NULL;
+			pend->pc->number = portno;
+			pend->pc->pif = pif;
+			pend->pc->index = pif->inuse;
+			pend->pc->num_outstanding = 0;
+			comm_point_start_listening(pend->pc->cp, fd, -1);
 
-	/* don't trust in perfect double rounding */
-	if(chosen < 0) chosen = 0;
-	if(chosen >= nummax) chosen = nummax-1;
+			/* grab port in interface */
+			pif->out[pif->inuse] = pend->pc;
+			pif->avail_ports[my_port - pif->inuse] =
+				pif->avail_ports[pif->avail_total-pif->inuse-1];
+			pif->inuse++;
+			break;
+		}
+		/* failed, already in use */
+		verbose(VERB_QUERY, "port %d in use, trying another", portno);
+		tries++;
+		if(tries == MAX_PORT_RETRY) {
+			log_err("failed to find an open port, drop msg");
+			return 0;
+		}
+	}
+	log_assert(pend->pc);
+	pend->pc->num_outstanding++;
 
-	if(addr_is_ip6(&pend->addr, pend->addrlen))
-		pend->c = outnet->udp6_ports[chosen];
-	else	pend->c = outnet->udp4_ports[chosen];
-	log_assert(pend->c);
-
-	verbose(VERB_ALGO, "query %x outbound on port %d of %d", pend->id, chosen, nummax);
+	return 1;
 }
 
-
-struct pending* 
-pending_udp_query(struct outside_network* outnet, ldns_buffer* packet, 
-	struct sockaddr_storage* addr, socklen_t addrlen, int timeout,
-	comm_point_callback_t* cb, void* cb_arg, struct ub_randstate* rnd)
+static int
+randomize_and_send_udp(struct outside_network* outnet, struct pending* pend,
+	ldns_buffer* packet, int timeout)
 {
-	struct pending* pend;
 	struct timeval tv;
 
-	/* create pending struct and change ID to be unique */
-	if(!(pend=new_pending(outnet, packet, addr, addrlen, cb, cb_arg, 
-		rnd))) {
-		return NULL;
-	}
-	select_port(outnet, pend, rnd);
-	if(!pend->c) {
-		pending_delete(outnet, pend);
-		return NULL;
+	/* select id */
+	if(!select_id(outnet, pend, packet)) {
+		return 0;
 	}
 
+	/* select src_if, port */
+	if(addr_is_ip6(&pend->addr, pend->addrlen)) {
+		if(!select_ifport(outnet, pend, 
+			outnet->num_ip6, outnet->ip6_ifs))
+			return 0;
+	} else {
+		if(!select_ifport(outnet, pend, 
+			outnet->num_ip4, outnet->ip4_ifs))
+			return 0;
+	}
+	log_assert(pend->pc && pend->pc->cp);
+
 	/* send it over the commlink */
-	if(!comm_point_send_udp_msg(pend->c, packet, (struct sockaddr*)addr, 
-		addrlen)) {
-		pending_delete(outnet, pend);
-		return NULL;
+	if(!comm_point_send_udp_msg(pend->pc->cp, packet, 
+		(struct sockaddr*)&pend->addr, pend->addrlen)) {
+		portcomm_loweruse(outnet, pend->pc);
+		return 0;
 	}
 
 	/* system calls to set timeout after sending UDP to make roundtrip
@@ -717,6 +820,53 @@ pending_udp_query(struct outside_network* outnet, ldns_buffer* packet,
 	tv.tv_sec = timeout/1000;
 	tv.tv_usec = (timeout%1000)*1000;
 	comm_timer_set(pend->timer, &tv);
+	return 1;
+}
+
+struct pending* 
+pending_udp_query(struct outside_network* outnet, ldns_buffer* packet, 
+	struct sockaddr_storage* addr, socklen_t addrlen, int timeout,
+	comm_point_callback_t* cb, void* cb_arg)
+{
+	struct pending* pend = (struct pending*)calloc(1, sizeof(*pend));
+	if(!pend) return NULL;
+	pend->outnet = outnet;
+	pend->addrlen = addrlen;
+	memmove(&pend->addr, addr, addrlen);
+	pend->cb = cb;
+	pend->cb_arg = cb_arg;
+	pend->node.key = pend;
+	pend->timer = comm_timer_create(outnet->base, pending_udp_timer_cb, 
+		pend);
+	if(!pend->timer) {
+		free(pend);
+		return NULL;
+	}
+
+	if(outnet->unused_fds == NULL) {
+		/* no unused fd, cannot create a new port (randomly) */
+		verbose(VERB_ALGO, "no fds available, udp query waiting");
+		pend->timeout = timeout;
+		pend->pkt_len = ldns_buffer_limit(packet);
+		pend->pkt = (uint8_t*)memdup(ldns_buffer_begin(packet),
+			pend->pkt_len);
+		if(!pend->pkt) {
+			comm_timer_delete(pend->timer);
+			free(pend);
+			return NULL;
+		}
+		/* put at end of waiting list */
+		if(outnet->udp_wait_last)
+			outnet->udp_wait_last->next_waiting = pend;
+		else 
+			outnet->udp_wait_first = pend;
+		outnet->udp_wait_last = pend;
+		return pend;
+	}
+	if(!randomize_and_send_udp(outnet, pend, packet, timeout)) {
+		pending_delete(outnet, pend);
+		return NULL;
+	}
 	return pend;
 }
 
@@ -759,8 +909,7 @@ outnet_tcptimer(void* arg)
 struct waiting_tcp* 
 pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet, 
 	struct sockaddr_storage* addr, socklen_t addrlen, int timeout,
-	comm_point_callback_t* callback, void* callback_arg,
-	struct ub_randstate* rnd)
+	comm_point_callback_t* callback, void* callback_arg)
 {
 	struct pending_tcp* pend = outnet->tcp_free;
 	struct waiting_tcp* w;
@@ -778,7 +927,7 @@ pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 	}
 	w->pkt = NULL;
 	w->pkt_len = 0;
-	id = ((unsigned)ub_random(rnd)>>8) & 0xffff;
+	id = ((unsigned)ub_random(outnet->rnd)>>8) & 0xffff;
 	LDNS_ID_SET(ldns_buffer_begin(packet), id);
 	memcpy(&w->addr, addr, addrlen);
 	w->addrlen = addrlen;
@@ -902,7 +1051,9 @@ serviced_delete(struct serviced_query* sq)
 		if(sq->status == serviced_query_UDP_EDNS ||
 			sq->status == serviced_query_UDP) {
 			struct pending* p = (struct pending*)sq->pending;
+			portcomm_loweruse(sq->outnet, p->pc);
 			pending_delete(sq->outnet, p);
+			outnet_send_wait_udp(sq->outnet);
 		} else {
 			struct waiting_tcp* p = (struct waiting_tcp*)
 				sq->pending;
@@ -1011,7 +1162,7 @@ serviced_udp_send(struct serviced_query* sq, ldns_buffer* buff)
 	sq->last_sent_time = *sq->outnet->now_tv;
 	verbose(VERB_ALGO, "serviced query UDP timeout=%d msec", rtt);
 	sq->pending = pending_udp_query(sq->outnet, buff, &sq->addr, 
-		sq->addrlen, rtt, serviced_udp_callback, sq, sq->outnet->rnd);
+		sq->addrlen, rtt, serviced_udp_callback, sq);
 	if(!sq->pending)
 		return 0;
 	return 1;
@@ -1184,7 +1335,7 @@ serviced_tcp_initiate(struct outside_network* outnet,
 	serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS);
 	sq->pending = pending_tcp_query(outnet, buff, &sq->addr,
 		sq->addrlen, TCP_AUTH_QUERY_TIMEOUT, serviced_tcp_callback, 
-		sq, outnet->rnd);
+		sq);
 	if(!sq->pending) {
 		/* delete from tree so that a retry by above layer does not
 		 * clash with this entry */
@@ -1367,22 +1518,52 @@ waiting_tcp_get_mem(struct waiting_tcp* w)
 	return s;
 }
 
+/** get memory used by port if */
+static size_t
+if_get_mem(struct port_if* pif)
+{
+	size_t s;
+	int i;
+	s = sizeof(*pif) + sizeof(int)*pif->avail_total +
+		sizeof(struct port_comm*)*pif->maxout;
+	for(i=0; i<pif->inuse; i++)
+		s += sizeof(*pif->out[i]) + 
+			comm_point_get_mem(pif->out[i]->cp);
+	return s;
+}
+
+/** get memory used by waiting udp */
+static size_t
+waiting_udp_get_mem(struct pending* w)
+{
+	size_t s;
+	s = sizeof(*w) + comm_timer_get_mem(w->timer) + w->pkt_len;
+	return s;
+}
+
 size_t outnet_get_mem(struct outside_network* outnet)
 {
 	size_t i;
+	int k;
 	struct waiting_tcp* w;
+	struct pending* u;
 	struct serviced_query* sq;
 	struct service_callback* sb;
+	struct port_comm* pc;
 	size_t s = sizeof(*outnet) + sizeof(*outnet->base) + 
 		sizeof(*outnet->udp_buff) + 
 		ldns_buffer_capacity(outnet->udp_buff);
 	/* second buffer is not ours */
-	s += sizeof(struct comm_point*)*outnet->num_udp4;
-	for(i=0; i<outnet->num_udp4; i++)
-		s += comm_point_get_mem(outnet->udp4_ports[i]);
-	s += sizeof(struct comm_point*)*outnet->num_udp6;
-	for(i=0; i<outnet->num_udp6; i++)
-		s += comm_point_get_mem(outnet->udp6_ports[i]);
+	for(pc = outnet->unused_fds; pc; pc = pc->next) {
+		s += sizeof(*pc) + comm_point_get_mem(pc->cp);
+	}
+	for(k=0; k<outnet->num_ip4; k++)
+		s += if_get_mem(&outnet->ip4_ifs[k]);
+	for(k=0; k<outnet->num_ip6; k++)
+		s += if_get_mem(&outnet->ip6_ifs[k]);
+	for(u=outnet->udp_wait_first; u; u=u->next_waiting)
+		s += waiting_udp_get_mem(u);
+	
 	s += sizeof(struct pending_tcp*)*outnet->num_tcp;
 	for(i=0; i<outnet->num_tcp; i++) {
 		s += sizeof(struct pending_tcp);

services/outside_network.h

@@ -51,7 +51,10 @@ struct pending_timeout;
 struct ub_randstate;
 struct pending_tcp;
 struct waiting_tcp;
+struct waiting_udp;
 struct infra_cache;
+struct port_comm;
+struct port_if;
 
 /**
  * Send queries to outside servers and wait for answers from servers.
@@ -74,20 +77,24 @@ struct outside_network {
 	/** use x20 bits to encode additional ID random bits */
 	int use_caps_for_id;
 
-	/** 
-	 * Array of udp comm point* that are used to listen to pending events.
-	 * Each is on a different port. This is for ip4 ports.
-	 */
-	struct comm_point** udp4_ports;
-	/** number of udp4 ports */
-	size_t num_udp4;
+	/** linked list of available commpoints, unused file descriptors,
+	 * for use as outgoing UDP ports. cp.fd=-1 in them. */
+	struct port_comm* unused_fds;
 
-	/**
-	 * The opened ip6 ports.
-	 */
-	struct comm_point** udp6_ports;
-	/** number of udp6 ports */
-	size_t num_udp6;
+	/** array of outgoing IP4 interfaces */
+	struct port_if* ip4_ifs;
+	/** number of outgoing IP4 interfaces */
+	int num_ip4;
+
+	/** array of outgoing IP6 interfaces */
+	struct port_if* ip6_ifs;
+	/** number of outgoing IP6 interfaces */
+	int num_ip6;
+
+	/** pending udp queries waiting to be sent out, waiting for fd */
+	struct pending* udp_wait_first;
+	/** last pending udp query in list */
+	struct pending* udp_wait_last;
 
 	/** pending udp answers. sorted by id, addr */
 	rbtree_t* pending;
@@ -115,20 +122,65 @@ struct outside_network {
 	struct waiting_tcp* tcp_wait_last;
 };
 
+/**
+ * Outgoing interface. Ports available and currently used are tracked
+ * per interface
+ */
+struct port_if {
+	/** address ready to allocate new socket (except port no). */
+	struct sockaddr_storage addr;
+	/** length of addr field */
+	socklen_t addrlen;
+
+	/** the available ports array. These are unused.
+	 * Only the first total-inuse part is filled. */
+	int* avail_ports;
+	/** the total number of available ports (size of the array) */
+	int avail_total;
+
+	/** array of the commpoints currently in use. 
+	 * allocated for max number of fds, first part in use. */
+	struct port_comm** out;
+	/** max number of fds, size of out array */
+	int maxout;
+	/** number of commpoints (and thus also ports) in use */
+	int inuse;
+};
+
+/**
+ * Outgoing commpoint for UDP port.
+ */
+struct port_comm {
+	/** next in free list */
+	struct port_comm* next;
+	/** which port number (when in use) */
+	int number;
+	/** interface it is used in */
+	struct port_if* pif;
+	/** index in the out array of the interface */
+	int index;
+	/** number of outstanding queries on this port */
+	int num_outstanding;
+	/** UDP commpoint, fd=-1 if not in use */
+	struct comm_point* cp;
+};
+
 /**
  * A query that has an answer pending for it.
  */
 struct pending {
 	/** redblacktree entry, key is the pending struct(id, addr). */
 	rbnode_t node;
-	/** the ID for the query */
-	uint16_t id;
+	/** the ID for the query. int so that a value out of range can
+	 * be used to signify a pending that is for certain not present in
+	 * the rbtree. (and for which deletion is safe). */
+	unsigned int id;
 	/** remote address. */
 	struct sockaddr_storage addr;
 	/** length of addr field in use. */
 	socklen_t addrlen;
 	/** comm point it was sent on (and reply must come back on). */
-	struct comm_point* c;
+	struct port_comm* pc;
 	/** timeout event */
 	struct comm_timer* timer;
 	/** callback for the timeout, error or reply to the message */
@@ -137,6 +189,16 @@ struct pending {
 	void* cb_arg;
 	/** the outside network it is part of */
 	struct outside_network* outnet;
+
+	/*---- filled if udp pending is waiting -----*/
+	/** next in waiting list. */
+	struct pending* next_waiting;
+	/** timeout in msec */
+	int timeout;
+	/** The query itself, the query packet to send. */
+	uint8_t* pkt;
+	/** length of query packet. */
+	size_t pkt_len;
 };
 
 /**
@@ -258,19 +320,19 @@ struct serviced_query {
  * @param num_ifs: number of names in array ifs.
  * @param do_ip4: service IP4.
  * @param do_ip6: service IP6.
- * @param port_base: if -1 system assigns ports, otherwise try to get
- *    the ports numbered from this starting number.
  * @param num_tcp: number of outgoing tcp buffers to preallocate.
  * @param infra: pointer to infra cached used for serviced queries.
  * @param rnd: stored to create random numbers for serviced queries.
  * @param use_caps_for_id: enable to use 0x20 bits to encode id randomness.
+ * @param availports: array of available ports. 
+ * @param numavailports: number of available ports in array.
  * @return: the new structure (with no pending answers) or NULL on error.
  */
 struct outside_network* outside_network_create(struct comm_base* base,
 	size_t bufsize, size_t num_ports, char** ifs, int num_ifs,
-	int do_ip4, int do_ip6, int port_base, size_t num_tcp, 
-	struct infra_cache* infra, struct ub_randstate* rnd,
-	int use_caps_for_id);
+	int do_ip4, int do_ip6, size_t num_tcp, struct infra_cache* infra, 
+	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
+	int numavailports);
 
 /**
  * Delete outside_network structure.
@@ -288,13 +350,12 @@ void outside_network_delete(struct outside_network* outnet);
  * @param timeout: in milliseconds from now.
  * @param callback: function to call on error, timeout or reply.
  * @param callback_arg: user argument for callback function.
- * @param rnd: random state for generating ID and port.
  * @return: NULL on error for malloc or socket. Else the pending query object.
  */
 struct pending* pending_udp_query(struct outside_network* outnet, 
 	ldns_buffer* packet, struct sockaddr_storage* addr, 
 	socklen_t addrlen, int timeout, comm_point_callback_t* callback, 
-	void* callback_arg, struct ub_randstate* rnd);
+	void* callback_arg);
 
 /**
  * Send TCP query. May wait for TCP buffer. Selects ID to be random, and 
@@ -308,13 +369,12 @@ struct pending* pending_udp_query(struct outside_network* outnet,
  *    without any query been sent to the server yet.
  * @param callback: function to call on error, timeout or reply.
  * @param callback_arg: user argument for callback function.
- * @param rnd: random state for generating ID.
  * @return: false on error for malloc or socket. Else the pending TCP object.
  */
 struct waiting_tcp* pending_tcp_query(struct outside_network* outnet, 
 	ldns_buffer* packet, struct sockaddr_storage* addr, 
 	socklen_t addrlen, int timeout, comm_point_callback_t* callback, 
-	void* callback_arg, struct ub_randstate* rnd);
+	void* callback_arg);
 
 /**
  * Delete pending answer.

smallapp/unbound-checkconf.c

@@ -52,6 +52,9 @@
 #include "validator/validator.h"
 #include "services/localzone.h"
 #include <pwd.h>
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif
 
 /** Give checkconf usage, and exit (1). */
 static void
@@ -171,25 +174,130 @@ aclchecks(struct config_file* cfg)
 	}
 }
 
+/** true if fname is a file */
+static int
+is_file(const char* fname) 
+{
+	struct stat buf;
+	if(stat(fname, &buf) < 0) {
+		if(errno==EACCES) {
+			printf("warning: no search permission for one of the directories in path: %s\n", fname);
+			return 1;
+		}
+		perror(fname);
+		return 0;
+	}
+	if(S_ISDIR(buf.st_mode)) {
+		printf("%s is not a file\n", fname);
+		return 0;
+	}
+	return 1;
+}
+
+/** true if fname is a directory */
+static int
+is_dir(const char* fname) 
+{
+	struct stat buf;
+	if(stat(fname, &buf) < 0) {
+		if(errno==EACCES) {
+			printf("warning: no search permission for one of the directories in path: %s\n", fname);
+			return 1;
+		}
+		perror(fname);
+		return 0;
+	}
+	if(!(S_ISDIR(buf.st_mode))) {
+		printf("%s is not a directory\n", fname);
+		return 0;
+	}
+	return 1;
+}
+
+/** convert a filename to full pathname in original filesys
+ * @param fname: the path name to convert.
+ * 	Must not be null or empty.
+ * @param cfg: config struct for chroot and chdir (if set).
+ * @param use_chdir: if false, only chroot is applied.
+ * @return pointer to static buffer which is: [chroot][chdir]fname
+ */
+static char*
+fname_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
+{
+	static char buf[1024];
+	int slashit = 0;
+	buf[0] = 0;
+	if(cfg->chrootdir && cfg->chrootdir[0] && 
+		strncmp(cfg->chrootdir, fname, strlen(cfg->chrootdir)) == 0) {
+		/* already full pathname, return it */
+		strncpy(buf, fname, sizeof(buf)-1);
+		buf[sizeof(buf)-1] = 0;
+		return buf;
+	}
+	/* chroot */
+	if(cfg->chrootdir && cfg->chrootdir[0]) {
+		/* start with chrootdir */
+		strncpy(buf, cfg->chrootdir, sizeof(buf)-1);
+		slashit = 1;
+	}
+	/* chdir */
+	if(fname[0] == '/' || !use_chdir) {
+		/* full path, no chdir */
+	} else if(cfg->directory && cfg->directory[0]) {
+		/* prepend chdir */
+		if(slashit && cfg->directory[0] != '/')
+			strncat(buf, "/", sizeof(buf)-1);
+		if(strncmp(cfg->chrootdir, cfg->directory, 
+			strlen(cfg->chrootdir)) == 0)
+			strncat(buf, cfg->directory+strlen(cfg->chrootdir), 
+				sizeof(buf)-1);
+		else strncat(buf, cfg->directory, sizeof(buf)-1);
+		slashit = 1;
+	}
+	/* fname */
+	if(slashit && fname[0] != '/')
+		strncat(buf, "/", sizeof(buf)-1);
+	strncat(buf, fname, sizeof(buf)-1);
+	buf[sizeof(buf)-1] = 0;
+	return buf;
+}
+
+/** get base dir of a fname */
+static char*
+basedir(const char* fname, struct config_file* cfg)
+{
+	char* d = fname_after_chroot(fname, cfg, 1);
+	char* rev = strrchr(d, '/');
+	if(!rev) return NULL;
+	if(d == rev) return NULL;
+	rev[0] = 0;
+	return d;
+}
+
 /** check file list, every file must be inside the chroot location */
 static void
 check_chroot_filelist(const char* desc, struct config_strlist* list,
-	const char* chrootdir)
+	const char* chrootdir, struct config_file* cfg)
 {
 	struct config_strlist* p;
-	if(!chrootdir) return;
+	char* old;
 	for(p=list; p; p=p->next) {
-		if(p->str && p->str[0] && strncmp(chrootdir, p->str,
-			strlen(chrootdir)) != 0) {
-			fatal_exit("%s: \"%s\" not in chrootdir %s", 
-				desc, p->str, chrootdir);
+		if(p->str && p->str[0]) {
+			if(!is_file(fname_after_chroot(p->str, cfg, 1))) {
+				fatal_exit("%s: \"%s\" does not exist in chrootdir %s", 
+					desc, p->str, chrootdir);
+			}
+			old = p->str;
+			/* put in a new full path for continued checking */
+			p->str = strdup(fname_after_chroot(p->str, cfg, 1));
+			free(old);
 		}
 	}
 }
 
 /** check configuration for errors */
 static void
-morechecks(struct config_file* cfg)
+morechecks(struct config_file* cfg, char* fname)
 {
 	warn_hosts("stub-host", cfg->stubs);
 	warn_hosts("forward-host", cfg->forwards);
@@ -209,26 +317,50 @@ morechecks(struct config_file* cfg)
 		cfg->chrootdir[strlen(cfg->chrootdir)-1] == '/')
 		fatal_exit("chootdir %s has trailing slash '/' please remove.",
 			cfg->chrootdir);
-	if(cfg->chrootdir && strncmp(cfg->chrootdir, cfg->directory,
-		strlen(cfg->chrootdir)) != 0)
-		fatal_exit("working directory %s not in chrootdir %s",
-			cfg->directory, cfg->chrootdir);
-	if(cfg->chrootdir && cfg->pidfile && cfg->pidfile[0] &&
-		strncmp(cfg->chrootdir, cfg->pidfile,
-			strlen(cfg->chrootdir)) != 0)
-		fatal_exit("pid file %s not in chrootdir %s",
-			cfg->pidfile, cfg->chrootdir);
-	if(cfg->chrootdir && cfg->logfile && cfg->logfile[0] &&
-		strncmp(cfg->chrootdir, cfg->logfile,
-			strlen(cfg->chrootdir)) != 0)
-		fatal_exit("log file %s not in chrootdir %s",
-			cfg->logfile, cfg->chrootdir);
+	if(cfg->chrootdir && cfg->chrootdir[0] && 
+		!is_dir(cfg->chrootdir)) {
+		fatal_exit("bad chroot directory");
+	}
+	if(cfg->chrootdir && cfg->chrootdir[0]) {
+		char buf[10240];
+		buf[0] = 0;
+		if(fname[0] != '/') {
+			if(getcwd(buf, sizeof(buf)) == NULL)
+				fatal_exit("getcwd: %s", strerror(errno));
+			strncat(buf, "/", sizeof(buf));
+		}
+		strncat(buf, fname, sizeof(buf));
+		if(strncmp(buf, cfg->chrootdir, strlen(cfg->chrootdir)) != 0)
+			fatal_exit("config file %s is not inside chroot %s",
+				buf, cfg->chrootdir);
+	}
+	if(cfg->directory && cfg->directory[0] && !is_dir(
+		fname_after_chroot(cfg->directory, cfg, 0))) {
+		fatal_exit("bad chdir directory");
+	}
+	if( (cfg->chrootdir && cfg->chrootdir[0]) ||
+	    (cfg->directory && cfg->directory[0])) {
+		if(cfg->pidfile && cfg->pidfile[0] &&
+		   basedir(cfg->pidfile, cfg) &&
+		   !is_dir(basedir(cfg->pidfile, cfg))) {
+			fatal_exit("pidfile directory does not exist");
+		}
+		if(cfg->logfile && cfg->logfile[0] &&
+		   basedir(cfg->logfile, cfg) &&
+		   !is_dir(basedir(cfg->logfile, cfg))) {
+			fatal_exit("logfile directory does not exist");
+		}
+	}
+
 	check_chroot_filelist("file with root-hints", 
-		cfg->root_hints, cfg->chrootdir);
+		cfg->root_hints, cfg->chrootdir, cfg);
 	check_chroot_filelist("trust-anchor-file", 
-		cfg->trust_anchor_file_list, cfg->chrootdir);
+		cfg->trust_anchor_file_list, cfg->chrootdir, cfg);
 	check_chroot_filelist("trusted-keys-file", 
-		cfg->trusted_keys_file_list, cfg->chrootdir);
+		cfg->trusted_keys_file_list, cfg->chrootdir, cfg);
+	/* remove chroot setting so that modules are not stripping pathnames*/
+	free(cfg->chrootdir);
+	cfg->chrootdir = NULL;
 	
 	if(strcmp(cfg->module_conf, "iterator") != 0 &&
 		strcmp(cfg->module_conf, "validator iterator") != 0) {
@@ -257,7 +389,7 @@ checkconf(char* cfgfile)
 		config_delete(cfg);
 		exit(1);
 	}
-	morechecks(cfg);
+	morechecks(cfg, cfgfile);
 	check_mod(cfg, iter_get_funcblock());
 	check_mod(cfg, val_get_funcblock());
 	config_delete(cfg);

testcode/do-tests.sh

@@ -2,9 +2,10 @@
 
 NEED_SPLINT='00-lint.tpkg'
 NEED_DOXYGEN='01-doc.tpkg'
-NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg fwd_ancil.tpkg stat_timer.tpkg 05-asynclook.tpkg stream_tcp.tpkg speed_cache.tpkg'
+NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg fwd_ancil.tpkg stat_timer.tpkg 05-asynclook.tpkg stream_tcp.tpkg speed_cache.tpkg fwd_oneport.tpkg fwd_udptmout.tpkg fwd_waitudp.tpkg'
 NEED_XXD='fwd_compress_c00c.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg'
+NEED_CURL='06-ianaports.tpkg'
 
 cd testdata;
 sh ../testcode/mini_tpkg.sh clean
@@ -21,6 +22,11 @@ for test in `ls *.tpkg`; do
 			SKIP=1;
 		fi
 	fi
+	if echo $NEED_CURL | grep $test >/dev/null; then
+		if test ! -x "`which curl`"; then
+			SKIP=1;
+		fi
+	fi
 	if echo $NEED_LDNS_TESTNS | grep $test >/dev/null; then
 		if test ! -x "`which ldns-testns`"; then
 			SKIP=1;

testcode/fake_event.c

@@ -684,9 +684,11 @@ struct outside_network*
 outside_network_create(struct comm_base* base, size_t bufsize, 
 	size_t ATTR_UNUSED(num_ports), char** ATTR_UNUSED(ifs), 
 	int ATTR_UNUSED(num_ifs), int ATTR_UNUSED(do_ip4), 
-	int ATTR_UNUSED(do_ip6), int ATTR_UNUSED(port_base),
-	size_t ATTR_UNUSED(num_tcp), struct infra_cache* ATTR_UNUSED(infra),
-	struct ub_randstate* ATTR_UNUSED(rnd), int ATTR_UNUSED(use_caps_for_id))
+	int ATTR_UNUSED(do_ip6), size_t ATTR_UNUSED(num_tcp), 
+	struct infra_cache* ATTR_UNUSED(infra),
+	struct ub_randstate* ATTR_UNUSED(rnd), 
+	int ATTR_UNUSED(use_caps_for_id), int* ATTR_UNUSED(availports),
+	int ATTR_UNUSED(numavailports))
 {
 	struct outside_network* outnet =  calloc(1, 
 		sizeof(struct outside_network));
@@ -711,8 +713,7 @@ outside_network_delete(struct outside_network* outnet)
 struct pending* 
 pending_udp_query(struct outside_network* outnet, ldns_buffer* packet,
 	struct sockaddr_storage* addr, socklen_t addrlen, int timeout,
-	comm_point_callback_t* callback, void* callback_arg,
-	struct ub_randstate* ATTR_UNUSED(rnd))
+	comm_point_callback_t* callback, void* callback_arg)
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,
@@ -764,8 +765,7 @@ pending_udp_query(struct outside_network* outnet, ldns_buffer* packet,
 struct waiting_tcp* 
 pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 	struct sockaddr_storage* addr, socklen_t addrlen, int timeout,
-	comm_point_callback_t* callback, void* callback_arg,
-	struct ub_randstate* ATTR_UNUSED(rnd))
+	comm_point_callback_t* callback, void* callback_arg)
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,

testcode/harvest.c

@@ -160,6 +160,7 @@ static void usage(char* nm)
 	printf("-f fnm	query list to read from file\n");
 	printf("	every line has format: qname qclass qtype\n");
 	printf("-v 	verbose (-v -v even more)\n");
+	printf("-C cfg	config file with resolver options\n");
 	exit(1);
 }
 
@@ -389,6 +390,18 @@ process_rr(struct harvest_data* data, ldns_rr* rr, int depth)
 	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA) {
 		new_todo_infra(data, find_create_lab(data, 
 			ldns_rr_rdf(rr, 0)), depth+1);
+	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_CNAME) {
+		int t = ldns_rr_get_type(rr);
+		if(t!=LDNS_RR_TYPE_A && t!=LDNS_RR_TYPE_AAAA &&
+			t!=LDNS_RR_TYPE_SOA && t!=LDNS_RR_TYPE_NS &&
+			t!=LDNS_RR_TYPE_DS && t!=LDNS_RR_TYPE_DNSKEY)
+			new_todo_item(data, ldns_rr_rdf(rr, 0), t,
+				ldns_rr_get_class(rr), depth+1);
+			/* can get caught in CNAME loop, but depth will
+			 * catch that; unbound cache helps too(servfails on
+			 * a cname loop) */
+		new_todo_infra(data, find_create_lab(data, 
+			ldns_rr_rdf(rr, 0)), depth+1);
 	}
 	/* store it */
 	if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NSEC) {
@@ -479,14 +492,19 @@ process(struct harvest_data* data, struct todo_item* it)
 		free(nm);
 		return;
 	}
+	if(result->rcode == LDNS_RCODE_SERVFAIL) {
+		free(nm);
+		return;
+	}
 	/* even if result is a negative, try to store resulting SOA/NSEC */
 
 	/* create ldns pkt */
 	s = ldns_wire2pkt(&pkt, result->answer_packet, 
 		(size_t)result->answer_len);
 	if(s != LDNS_STATUS_OK) {
-		printf("ldns_wire2pkt failed! %s %d %d %s", nm, 
-			it->qtype, it->qclass, ldns_get_errorstr_by_id(s));
+		printf("ldns_wire2pkt failed! %s %d %d %s %d\n", nm, 
+			it->qtype, it->qclass, ldns_get_errorstr_by_id(s),
+			result->answer_len);
 		free(nm);
 		return;
 	}
@@ -531,6 +549,7 @@ harvest_main(struct harvest_data* data)
 		}
 		data->numtodo--;
 		process(data, it);
+		usleep(1000000/100);
 	}
 }
 
@@ -785,8 +804,12 @@ int main(int argc, char* argv[])
 	data.maxdepth = 2;
 
 	/* parse the options */
-	while( (c=getopt(argc, argv, "hf:v")) != -1) {
+	while( (c=getopt(argc, argv, "hf:vC:")) != -1) {
 		switch(c) {
+		case 'C':
+			if(ub_ctx_config(data.ctx, optarg) != 0)
+				error_exit("config read failed");
+			break;
 		case 'f':
 			qlist_read_file(&data, optarg);
 			break;

testcode/ldns-testpkts.c

@@ -3,7 +3,7 @@
  *
  * Data storage for specially crafted replies for testing purposes.
  *
- * (c) NLnet Labs, 2005, 2006, 2007
+ * (c) NLnet Labs, 2005, 2006, 2007, 2008
  * See the file LICENSE for the license
  */
 

testcode/unitmain.c

@@ -394,6 +394,7 @@ main(int argc, char* argv[])
 		return 1;
 	}
 	printf("Start of %s unit test.\n", PACKAGE_STRING);
+	ERR_load_crypto_strings();
 	checklock_start();
 	rnd_test();
 	verify_test();
@@ -411,5 +412,7 @@ main(int argc, char* argv[])
 	printf("%d checks ok.\n", testcount);
 	EVP_cleanup();
 	CRYPTO_cleanup_all_ex_data();
+	ERR_remove_state(0);
+	ERR_free_strings();
 	return 0;
 }

testcode/unitverify.c

@@ -461,6 +461,13 @@ verify_test()
 {
 	printf("verify test\n");
 	verifytest_file("testdata/test_signatures.1", "20070818005004");
+	verifytest_file("testdata/test_signatures.2", "20080414005004");
+	verifytest_file("testdata/test_signatures.3", "20080416005004");
+	verifytest_file("testdata/test_signatures.4", "20080416005004");
+	verifytest_file("testdata/test_signatures.5", "20080416005004");
+	verifytest_file("testdata/test_signatures.6", "20080416005004");
+	verifytest_file("testdata/test_signatures.7", "20070829144150");
+	verifytest_file("testdata/test_signatures.8", "20070829144150");
 	dstest_file("testdata/test_ds_sig.1");
 	nsectest();
 	nsec3_hash_test("testdata/test_nsec3_hash.1");

testdata/iter_req_qname.rpl

@@ -0,0 +1,91 @@
+; config options
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test a query name in the reply is required by resolver
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+; always the same reply since we cannot match anything from the qsection.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+; no query section!
+; www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+
+; the query name is echoed properly to *our* client
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+SCENARIO_END

testdata/test_signatures.2

@@ -0,0 +1,23 @@
+; Signature test file
+
+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
+; later entries are verified with it.
+
+
+; DNSKEY used for testing, from april 2008
+ENTRY_BEGIN
+SECTION QUESTION
+cesar.sec3.br.                 IN      DNSKEY
+SECTION ANSWER
+cesar.sec3.br.          43200   IN      DNSKEY  257 3 3 AMAdw+X4IcinbsSOXamwV4BrJVbRjSJ63DYRV0NLR4W5cDMEQGmB3Lci ybjLvaEogs9RDmjhxQrQJRfaIVMG11LtOwlTPBr4yzyeK9zzeZPAQz2F 9yCCPqgUdts51v4XeK5evtn+b4AB7t/j+v7Vb+26k8No6hmJiRJAy59N Fpzrt5FoY5qFZ8QbPl59nzEcXTbOiXBNSu9mQbe/jFH5p9NP4KB0iNL/ oAthNIVVsDG8hQFh1hE5YlDNLxYY3U+TODjWx//DZvkn5Tyyvp7I6b33 oJiq
+ENTRY_END
+
+; entry to test
+ENTRY_BEGIN
+SECTION QUESTION
+cesar.sec3.br.       IN      SOA
+SECTION ANSWER
+cesar.sec3.br.  43200   IN      SOA     home.kuroiwa.eng.br. hostmaster.cesar.sec3.br. 2008040903 86400 86400 8640000 600
+cesar.sec3.br.  43200   IN      RRSIG   SOA 3 3 43200 20081010000000 20080410122550 14996 cesar.sec3.br. AJOGbuGOMggPspEBhIc58I8BXUHqR+DKiZqGZRwu9jMTgAX6JCPunSI= ;{id = 14996}
+ENTRY_END
+

testdata/test_signatures.3

@@ -0,0 +1,48 @@
+; Signature test file
+
+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
+; later entries are verified with it.
+
+; created test keys with bind tools:
+; dnssec-keygen 9.4.2: /usr/sbin/dnssec-keygen -a DSA -b 512 -n ZONE nlnetlabs.nl
+; Knlnetlabs.nl.+003+03510
+
+; private key file:
+; Private-key-format: v1.2
+; Algorithm: 3 (DSA)
+; Prime(p): 4nziv5P4tsXwaf71EoyKFoLzFq0/wN5fb6yb8IY5uwmVh5hvO0M4lR8LAjwimCIo3SYEdCnUPkl8WbJYHkRm9w==
+; Subprime(q): 3ueDKL3Jc2Ue1G/ZCfhwMEyR4v0=
+; Base(g): Ji9iYukmprX5qXO7V0MALKCTsfvz3kef2TsZdpM/VdetDK53OwKE1NRTMU6PSPGyumedOrkSD2BLa7CT1dJRJQ==
+; Private_value(x): wlEfaVwW10q6Re/ZOBL9PLJJb20=
+; Public_value(y): cHuTGyrkbj5QVkgmFm3KEpLnb5c7jH6tapeU5ugEIJiacbroPhfz/9vPw8tkZedBGImuYPSohRPfHIQPMxfxAg==
+
+
+; DSA key from bind tool 9.4.2
+ENTRY_BEGIN
+SECTION QUESTION
+nlnetlabs.nl.	IN DNSKEY
+SECTION ANSWER
+nlnetlabs.nl. IN DNSKEY 256 3 3 AN7ngyi9yXNlHtRv2Qn4cDBMkeL94nziv5P4tsXwaf71EoyKFoLzFq0/ wN5fb6yb8IY5uwmVh5hvO0M4lR8LAjwimCIo3SYEdCnUPkl8WbJYHkRm 9yYvYmLpJqa1+alzu1dDACygk7H7895Hn9k7GXaTP1XXrQyudzsChNTU UzFOj0jxsrpnnTq5Eg9gS2uwk9XSUSVwe5MbKuRuPlBWSCYWbcoSkudv lzuMfq1ql5Tm6AQgmJpxuug+F/P/28/Dy2Rl50EYia5g9KiFE98chA8z F/EC
+ENTRY_END
+
+; entry to test
+; from
+; /usr/sbin/dnssec-signzone nlnetlabs.nl
+ENTRY_BEGIN
+SECTION QUESTION
+nlnetlabs.nl. IN SOA
+SECTION ANSWER
+nlnetlabs.nl.   10200   IN SOA  open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. ( 2008040100 28800      7200       604800     3600       )
+nlnetlabs.nl.   10200   RRSIG   SOA 3 2 10200 20080515132632 ( 20080415132632 3510 nlnetlabs.nl.  ACYwIl9GQofKJ2xdgx1YelKbtmLrWRl8f+eC ToRnfyQ+gvdUIX3mTTw= )
+ENTRY_END
+
+ENTRY_BEGIN
+SECTION QUESTION
+nlnetlabs.nl. IN NS
+SECTION ANSWER
+nlnetlabs.nl. 10200   NS      omval.tednet.nl.
+nlnetlabs.nl. 10200   NS      ns7.domain-registry.nl.
+nlnetlabs.nl. 10200 NS      open.nlnetlabs.nl.
+nlnetlabs.nl. 10200   RRSIG   NS 3 2 10200 20080515132632 ( 20080415132632 3510 nlnetlabs.nl.  AEYy9ZN3KEDHybhZbL3PoR71jMQuufKM1lej +obA6uL6CjYQAPrL9tk= )
+ENTRY_END
+

testdata/test_signatures.4

@@ -0,0 +1,47 @@
+; Signature test file
+
+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
+; later entries are verified with it.
+
+; dnssec-keygen 9.4.2: /usr/sbin/dnssec-keygen -a DSA -b 768 -n ZONE nlnetlabs.nl
+; Knlnetlabs.nl.+003+03793
+
+; private key file
+; Private-key-format: v1.2
+; Algorithm: 3 (DSA)
+; Prime(p): lHKDKRMhV1yBk/gXk3IL29jkPwWwOqEskebo/hC0ieobdQkeuf9B3AgzCdn2hQOWVGoIMWyxChhqHVLwnQzUGY/uAhTZgSXBG47eHZC+Pj1hgX9tkB+9kzoK5jKhstR9
+; Subprime(q): 6u+5FI/H5WmwyTPWB5K0LjegVb0=
+; Base(g): hWj33Fnu7b9vhIriw6nXnJKpeus9pffjSaKzVJBNnlWTMXbo3+w3rObnJlbkVLfRsY4F8boWn1EbUUHCaRIW3bsqziE739S8HBJDDwxYx85n0xRqkg0djWoCG2e4uv4o
+; Private_value(x): xSLjPW1PE6twDgObqfkUk6EXO+g=
+; Public_value(y): ORFJhDQMHGQNdWXlh05vAJJ8Fqm6u+72qsIY2pnSgWL7vQIL6sKKJL14oIVJbsZW9FIjQCFpqe19leUdzUDQa9AxB8WSRAzmh4S6tWkmbAGpUjoAUJSLtqV1NgvH8ESg
+
+
+; DSA key from bind tool 9.4.2
+ENTRY_BEGIN
+SECTION QUESTION
+nlnetlabs.nl.	IN DNSKEY
+SECTION ANSWER
+nlnetlabs.nl. IN DNSKEY 256 3 3 BOrvuRSPx+VpsMkz1geStC43oFW9lHKDKRMhV1yBk/gXk3IL29jkPwWw OqEskebo/hC0ieobdQkeuf9B3AgzCdn2hQOWVGoIMWyxChhqHVLwnQzU GY/uAhTZgSXBG47eHZC+Pj1hgX9tkB+9kzoK5jKhstR9hWj33Fnu7b9v hIriw6nXnJKpeus9pffjSaKzVJBNnlWTMXbo3+w3rObnJlbkVLfRsY4F 8boWn1EbUUHCaRIW3bsqziE739S8HBJDDwxYx85n0xRqkg0djWoCG2e4 uv4oORFJhDQMHGQNdWXlh05vAJJ8Fqm6u+72qsIY2pnSgWL7vQIL6sKK JL14oIVJbsZW9FIjQCFpqe19leUdzUDQa9AxB8WSRAzmh4S6tWkmbAGp UjoAUJSLtqV1NgvH8ESg
+ENTRY_END
+
+; entry to test
+; from
+; /usr/sbin/dnssec-signzone nlnetlabs.nl
+ENTRY_BEGIN
+SECTION QUESTION
+nlnetlabs.nl. IN SOA
+SECTION ANSWER
+nlnetlabs.nl.   10200   IN SOA  open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. ( 2008040100 28800      7200       604800     3600       )
+nlnetlabs.nl.                         10200   RRSIG   SOA 3 2 10200 20080515133546 ( 20080415133546 3793 nlnetlabs.nl.  BHMt1eWN8HzfFOqrqL1PrsED43JVCrybDYL1 GJXymKlkWRAjar0wT6o= )
+ENTRY_END
+
+ENTRY_BEGIN
+SECTION QUESTION
+nlnetlabs.nl. IN NS
+SECTION ANSWER
+nlnetlabs.nl. 10200   NS      omval.tednet.nl.
+nlnetlabs.nl. 10200   NS      ns7.domain-registry.nl.
+nlnetlabs.nl. 10200 NS      open.nlnetlabs.nl.
+nlnetlabs.nl. 10200   RRSIG   NS 3 2 10200 20080515133546 ( 20080415133546 3793 nlnetlabs.nl.  BJZaThgkBaF3k6t2q+tr0ngKcF2EntSOn9gX Ut9Xipj3CdioZl8b0cY= )
+ENTRY_END
+

testdata/test_signatures.5

@@ -0,0 +1,48 @@
+; Signature test file
+
+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
+; later entries are verified with it.
+
+; ldns-keygen (svn trunk 1.3.0, 15 april 2008)
+; ./ldns-keygen -a DSAMD5 -b 512 nlnetlabs.nl
+; Knlnetlabs.nl.+003+08866
+
+; nlnetlabs.nl.   3600    IN      DS      8866 3 1 1300e7258af98cef40a47e6ac1e34ea79cb4b27f
+; Private-key-format: v1.2
+; Algorithm: 3 (DSA)
+; Prime(p): qp/0xtfW76CbSH29kZmI0iUEhJ9cIs/52WsgqogqBwrY/HpT+D6G2jd66WLi88DF0z/We3/YIjZYkR5PH03IRQ==
+; Subprime(q): iTRl4piaQvy9yxIsz/c5pAaVIeM=
+; Base(g): RJhjYU22ooiTKltbGmIR6OfXZjKDBfSODrT3e3/IrwiT8oQZriDFZkExYKrKqoqZFn7y0esTf9Bwvx2IhGabQw==
+; Private_value(x): gYjuQexf8JiiVBvCcxpXO+QaD88=
+; Public_value(y): aPtEU9ui/w2+9aFnCrWUB/fGvMEyAyLyGCCaT/N+l8bPYDPCv+wDxEKHoM3HT/ZOf3RuCE/CYKVK7CDX6+AZrA==
+
+; DSA key from ldns tool
+ENTRY_BEGIN
+SECTION QUESTION
+nlnetlabs.nl.	IN DNSKEY
+SECTION ANSWER
+nlnetlabs.nl.   3600    IN      DNSKEY  256 3 3 AIk0ZeKYmkL8vcsSLM/3OaQGlSHjqp/0xtfW76CbSH29kZmI0iUEhJ9cIs/52WsgqogqBwrY/HpT+D6G2jd66WLi88DF0z/We3/YIjZYkR5PH03IRUSYY2FNtqKIkypbWxpiEejn12YygwX0jg6093t/yK8Ik/KEGa4gxWZBMWCqyqqKmRZ+8tHrE3/QcL8diIRmm0No+0RT26L/Db71oWcKtZQH98a8wTIDIvIYIJpP836Xxs9gM8K/7APEQoegzcdP9k5/dG4IT8JgpUrsINfr4Bms ;{id = 8866 (zsk), size = 512b}
+ENTRY_END
+
+; entry to test
+; from
+; ldns-signzone nlnetlabs.nl Knlnetlabs.nl.+003+08866
+ENTRY_BEGIN
+SECTION QUESTION
+nlnetlabs.nl. IN SOA
+SECTION ANSWER
+nlnetlabs.nl.   10200   IN SOA  open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. ( 2008040100 28800      7200       604800     3600       )
+nlnetlabs.nl.   10200   IN      RRSIG   SOA 3 2 10200 20080513173901 20080415173901 8866 nlnetlabs.nl. MC0CFFI7JB0x4xaO0qhe9iQGk0eot8zGAhUAg/SFtf5MrR7DEkmd6vm2xf+SN9M= ;{id = 8866}
+ENTRY_END
+
+ENTRY_BEGIN
+SECTION QUESTION
+nlnetlabs.nl. IN NS
+SECTION ANSWER
+nlnetlabs.nl. 10200   NS      omval.tednet.nl.
+nlnetlabs.nl. 10200   NS      ns7.domain-registry.nl.
+nlnetlabs.nl. 10200 NS      open.nlnetlabs.nl.
+nlnetlabs.nl.   10200   IN      RRSIG   NS 3 2 10200 20080513173901 20080415173901 8866 nlnetlabs.nl. MCwCFFHwxz9Kx7Un60vLMMoOrZizagNrAhR6OskQNF/KVL5/xanbOmK3ZUj0vw== ;{id = 8866}
+
+ENTRY_END
+

testdata/test_signatures.6

@@ -0,0 +1,48 @@
+; Signature test file
+
+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
+; later entries are verified with it.
+
+; ldns-keygen (svn trunk 1.3.0, 15 april 2008)
+; ./ldns-keygen -a DSAMD5 -b 768 nlnetlabs.nl
+; Knlnetlabs.nl.+003+51124
+
+; nlnetlabs.nl.   3600    IN      DS      51124 3 1 6f7e3ea1d525f3428ce342596f7375b1c3a71c51
+; Private-key-format: v1.2
+; Algorithm: 3 (DSA)
+; Prime(p): 1kpY0hU98SJrpDCTKHv9TQyN6EGcY9FJ8bw0QiQdcm3nx3fkS298V9Y7ZRzjCQmkxVwNrwdhtNpz4MvrByHKy+YE/hSJamNhwKHAtiIAHNggqfutGQwUkfqHmybFO8Kx
+; Subprime(q): 3GwgwvHRyOeXNgZqR/5XpaNs6Pc=
+; Base(g): Rw1YckcZ/Es07FYrNV6soRTbcQ5NEDj7ITSUdGSLKRPQT0k4ofR3L8aslTeOJESR2s2sIay/ZHoYmdQuwLZ93HLEq5MooPO19c/GnVkOWZm1Ab9H7zttNcoKgzQ64dhT
+; Private_value(x): OoN8CQisHVjCIET7B3WdAwERRro=
+; Public_value(y): 08zY8i9l5qn1xC829beHq2Hhb8MUIvGHyW+eBchQa4S5XIRwf1rVpnw1iengslp/Y1Kx28/a9GEQbIESQORfxllPV23Uv2OJ3aNV0jP7kI2a7VLVSDSJrCh2wBCFj8tY
+
+; DSA key from ldns tool
+ENTRY_BEGIN
+SECTION QUESTION
+nlnetlabs.nl.	IN DNSKEY
+SECTION ANSWER
+nlnetlabs.nl.   3600    IN      DNSKEY  256 3 3 BNxsIMLx0cjnlzYGakf+V6WjbOj31kpY0hU98SJrpDCTKHv9TQyN6EGcY9FJ8bw0QiQdcm3nx3fkS298V9Y7ZRzjCQmkxVwNrwdhtNpz4MvrByHKy+YE/hSJamNhwKHAtiIAHNggqfutGQwUkfqHmybFO8KxRw1YckcZ/Es07FYrNV6soRTbcQ5NEDj7ITSUdGSLKRPQT0k4ofR3L8aslTeOJESR2s2sIay/ZHoYmdQuwLZ93HLEq5MooPO19c/GnVkOWZm1Ab9H7zttNcoKgzQ64dhT08zY8i9l5qn1xC829beHq2Hhb8MUIvGHyW+eBchQa4S5XIRwf1rVpnw1iengslp/Y1Kx28/a9GEQbIESQORfxllPV23Uv2OJ3aNV0jP7kI2a7VLVSDSJrCh2wBCFj8tY ;{id = 51124 (zsk), size = 768b}
+ENTRY_END
+
+; entry to test
+; from
+; ldns-signzone nlnetlabs.nl Knlnetlabs.nl.+003+51124
+ENTRY_BEGIN
+SECTION QUESTION
+nlnetlabs.nl. IN SOA
+SECTION ANSWER
+nlnetlabs.nl.   10200   IN SOA  open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. ( 2008040100 28800      7200       604800     3600       )
+nlnetlabs.nl.   10200   IN      RRSIG   SOA 3 2 10200 20080513174626 20080415174626 51124 nlnetlabs.nl. MC0CFB3cRDHQROzkGp4NtLNc4jDA1lhWAhUAgsbb8VMxGqifShEzuCNgczxDHHg= ;{id = 51124}
+ENTRY_END
+
+ENTRY_BEGIN
+SECTION QUESTION
+nlnetlabs.nl. IN NS
+SECTION ANSWER
+nlnetlabs.nl. 10200   NS      omval.tednet.nl.
+nlnetlabs.nl. 10200   NS      ns7.domain-registry.nl.
+nlnetlabs.nl. 10200 NS      open.nlnetlabs.nl.
+nlnetlabs.nl.   10200   IN      RRSIG   NS 3 2 10200 20080513174626 20080415174626 51124 nlnetlabs.nl. MCwCFEzgEjT0n/ooV/xZkRMzKNqeF4pkAhQxEPFtMt5LbIlsi9mSi0HS4+RZuA== ;{id = 51124}
+
+ENTRY_END
+

testdata/test_signatures.7

@@ -0,0 +1,32 @@
+; Signature test file
+
+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
+; later entries are verified with it.
+
+; DSA Key from ldns tool, key used in the testbound tests.
+
+; DSA key from ldns tool
+ENTRY_BEGIN
+SECTION QUESTION
+example.com.	IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+ENTRY_END
+
+; entry to test
+ENTRY_BEGIN
+SECTION QUESTION
+example.com.    IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+SECTION QUESTION
+ns.example.com.         IN      A
+SECTION ANSWER
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+

testdata/test_signatures.8

@@ -0,0 +1,24 @@
+; Signature test file
+
+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
+; later entries are verified with it.
+
+; RSA Key from ldns tool, key used in the testbound tests.
+
+; RSA key from ldns tool
+ENTRY_BEGIN
+SECTION QUESTION
+sub.example.com.	IN DNSKEY
+SECTION ANSWER
+sub.example.com.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+ENTRY_END
+
+; entry to test
+ENTRY_BEGIN
+SECTION QUESTION
+www.sub.example.com.    IN      A 
+SECTION ANSWER
+www.sub.example.com.    3600    IN      A       11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+ENTRY_END
+

testdata/trust_cname_chain.rpl

@@ -0,0 +1,158 @@
+; config options
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test trust in cname chain answer
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN CNAME xxx.example.com.
+xxx.example.com. IN CNAME yyy.example.com.
+yyy.example.com. IN A 10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+qqq.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+yyy.example.com. IN A 10.20.30.42
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+
+; This stores it into cache.
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN CNAME xxx.example.com.
+xxx.example.com. IN CNAME yyy.example.com.
+yyy.example.com. IN A 10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+; This query creates and overwrites the cache
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+qqq.example.com. IN A
+ENTRY_END
+
+STEP 21 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+qqq.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+yyy.example.com. IN A 10.20.30.42
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+; get it again from cache.
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 31 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN CNAME xxx.example.com.
+xxx.example.com. IN CNAME yyy.example.com.
+yyy.example.com. IN A 10.20.30.42
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+SCENARIO_END

testdata/val_adbit.rpl

@@ -0,0 +1,144 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator AD bit signaling
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD AD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+; ask from cache too
+STEP 21 QUERY
+ENTRY_BEGIN
+REPLY RD AD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 23 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+
+SCENARIO_END

util/config_file.c

@@ -61,6 +61,9 @@ int ub_c_wrap(void);
 /** print error with file and line number */
 void ub_c_error(const char *message);
 
+/** init ports possible for use */
+static void init_outgoing_availports(int* array, int num);
+
 struct config_file* 
 config_create()
 {
@@ -71,6 +74,7 @@ config_create()
 	/* the defaults if no config is present */
 	cfg->verbosity = 1;
 	cfg->stat_interval = 0;
+	cfg->stat_cumulative = 0;
 	cfg->num_threads = 1;
 	cfg->port = UNBOUND_DNS_PORT;
 	cfg->do_ip4 = 1;
@@ -78,8 +82,7 @@ config_create()
 	cfg->do_udp = 1;
 	cfg->do_tcp = 1;
 	cfg->use_syslog = 1;
-	cfg->outgoing_base_port = cfg->port + 2000;
-	cfg->outgoing_num_ports = 16;
+	cfg->outgoing_num_ports = 256;
 	cfg->outgoing_num_tcp = 10;
 	cfg->incoming_num_tcp = 10;
 	cfg->msg_buffer_size = 65552; /* 64 k + a small margin */
@@ -95,6 +98,9 @@ config_create()
 	cfg->infra_cache_slabs = 4;
 	cfg->infra_cache_numhosts = 10000;
 	cfg->infra_cache_lame_size = 10240; /* easily 40 or more entries */
+	if(!(cfg->outgoing_avail_ports = (int*)calloc(65536, sizeof(int))))
+		goto error_exit;
+	init_outgoing_availports(cfg->outgoing_avail_ports, 65536);
 	if(!(cfg->username = strdup("unbound"))) goto error_exit;
 	if(!(cfg->chrootdir = strdup(CHROOT_DIR))) goto error_exit;
 	if(!(cfg->directory = strdup(RUN_DIR))) goto error_exit;
@@ -150,6 +156,8 @@ struct config_file* config_create_forlib()
 	free(cfg->chrootdir);
 	cfg->chrootdir = NULL;
 	cfg->verbosity = 0;
+	cfg->outgoing_num_ports = 16; /* in library use, this is 'reasonable'
+		and probably within the ulimit(maxfds) of the user */
 	cfg->outgoing_num_tcp = 2;
 	cfg->msg_cache_size = 1024*1024;
 	cfg->msg_cache_slabs = 1;
@@ -204,12 +212,15 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	} else if(strcmp(opt, "do-tcp:") == 0) {
 		IS_YES_OR_NO;
 		cfg->do_tcp = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "outgoing-port:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->outgoing_base_port = atoi(val);
 	} else if(strcmp(opt, "outgoing-range:") == 0) {
 		IS_NONZERO_NUMBER;
 		cfg->outgoing_num_ports = atoi(val);
+	} else if(strcmp(opt, "outgoing-port-permit:") == 0) {
+		return cfg_mark_ports(val, 1, 
+			cfg->outgoing_avail_ports, 65536);
+	} else if(strcmp(opt, "outgoing-port-avoid:") == 0) {
+		return cfg_mark_ports(val, 0, 
+			cfg->outgoing_avail_ports, 65536);
 	} else if(strcmp(opt, "outgoing-num-tcp:") == 0) {
 		IS_NUMBER_OR_ZERO;
 		cfg->outgoing_num_tcp = (size_t)atoi(val);
@@ -431,6 +442,7 @@ config_delete(struct config_file* cfg)
 	free(cfg->identity);
 	free(cfg->version);
 	free(cfg->module_conf);
+	free(cfg->outgoing_avail_ports);
 	config_delstrlist(cfg->trust_anchor_file_list);
 	config_delstrlist(cfg->trusted_keys_file_list);
 	config_delstrlist(cfg->trust_anchor_list);
@@ -442,6 +454,100 @@ config_delete(struct config_file* cfg)
 	free(cfg);
 }
 
+static void 
+init_outgoing_availports(int* a, int num)
+{
+	/* generated with make iana_update */
+	const int iana_assigned[] = {
+#include "util/iana_ports.inc"
+		-1 }; /* end marker to put behind trailing comma */
+
+	int i;
+	/* do not use <1024, that could be trouble with the system, privs */
+	for(i=1024; i<num; i++) {
+		a[i] = i;
+	}
+	/* create empty spot at 49152 to keep ephemeral ports available 
+	 * to other programs */
+	for(i=49152; i<49152+256; i++)
+		a[i] = 0;
+	/* pick out all the IANA assigned ports */
+	for(i=0; iana_assigned[i]!=-1; i++) {
+		if(iana_assigned[i] < num)
+			a[iana_assigned[i]] = 0;
+	}
+}
+
+int 
+cfg_mark_ports(const char* str, int allow, int* avail, int num)
+{
+	char* mid = strchr(str, '-');
+	if(!mid) {
+		int port = atoi(str);
+		if(port == 0 && strcmp(str, "0") != 0) {
+			log_err("cannot parse port number '%s'", str);
+			return 0;
+		}
+		if(port < num)
+			avail[port] = (allow?port:0);
+	} else {
+		int i, low, high = atoi(mid+1);
+		char buf[16];
+		if(high == 0 && strcmp(mid+1, "0") != 0) {
+			log_err("cannot parse port number '%s'", mid+1);
+			return 0;
+		}
+		if( (int)(mid-str)+1 >= (int)sizeof(buf) ) {
+			log_err("cannot parse port number '%s'", str);
+			return 0;
+		}
+		if(mid > str)
+			memcpy(buf, str, (size_t)(mid-str));
+		buf[mid-str] = 0;
+		low = atoi(buf);
+		if(low == 0 && strcmp(buf, "0") != 0) {
+			log_err("cannot parse port number '%s'", buf);
+			return 0;
+		}
+		for(i=low; i<=high; i++) {
+			if(i < num)
+				avail[i] = (allow?i:0);
+		}
+		return 1;
+	}
+	return 1;
+}
+
+int 
+cfg_scan_ports(int* avail, int num)
+{
+	int i;
+	int count = 0;
+	for(i=0; i<num; i++) {
+		if(avail[i])
+			count++;
+	}
+	return count;
+}
+
+int cfg_condense_ports(struct config_file* cfg, int** avail)
+{
+	int num = cfg_scan_ports(cfg->outgoing_avail_ports, 65536);
+	int i, at = 0;
+	*avail = NULL;
+	if(num == 0)
+		return 0;
+	*avail = (int*)malloc(sizeof(int)*num);
+	if(!*avail)
+		return 0;
+	for(i=0; i<65536; i++) {
+		if(cfg->outgoing_avail_ports[i])
+			(*avail)[at++] = cfg->outgoing_avail_ports[i];
+	}
+	log_assert(at == num);
+	return num;
+}
+
 /** print error with file and line number */
 void ub_c_error_va_list(const char *fmt, va_list args)
 {

util/config_file.h

@@ -52,8 +52,11 @@ struct config_str2list;
 struct config_file {
 	/** verbosity level as specified in the config file */
 	int verbosity;
+
 	/** statistics interval (in seconds) */
 	int stat_interval;
+	/** if false, statistics values are reset after printing them */
+	int stat_cumulative;
 
 	/** number of threads to create */
 	int num_threads;
@@ -69,14 +72,14 @@ struct config_file {
 	/** do tcp query support. */
 	int do_tcp;
 
-	/** outgoing port range base number */
-	int outgoing_base_port;
-	/** outgoing port range number of ports (per thread, per if) */
+	/** outgoing port range number of ports (per thread) */
 	int outgoing_num_ports;
 	/** number of outgoing tcp buffers per (per thread) */
 	size_t outgoing_num_tcp;
 	/** number of incoming tcp buffers per (per thread) */
 	size_t incoming_num_tcp;
+	/** allowed udp port numbers, array with 0 if not allowed */
+	int* outgoing_avail_ports;
 
 	/** number of bytes buffer size for DNS messages */
 	size_t msg_buffer_size;
@@ -350,6 +353,33 @@ int cfg_count_numbers(const char* str);
  */
 int cfg_parse_memsize(const char* str, size_t* res);
 
+/**
+ * Mark "number" or "low-high" as available or not in ports array.
+ * @param str: string in input
+ * @param allow: give true if this range is permitted.
+ * @param avail: the array from cfg.
+ * @param num: size of the array (65536).
+ * @return: true if parsed correctly, or 0 on a parse error (and an error 
+ * is logged).
+ */
+int cfg_mark_ports(const char* str, int allow, int* avail, int num);
+
+/**
+ * Get a condensed list of ports returned. allocated.
+ * @param cfg: config file.
+ * @param avail: the available ports array is returned here.
+ * @return: number of ports in array or 0 on error.
+ */
+int cfg_condense_ports(struct config_file* cfg, int** avail);
+
+/**
+ * Scan ports available
+ * @param avail: the array from cfg.
+ * @param num: size of the array (65536).
+ * @return the number of ports available for use.
+ */
+int cfg_scan_ports(int* avail, int num);
+
 /**
  * Used during options parsing
  */

util/configlexer.lex

@@ -103,8 +103,9 @@ server{COLON}		{ YDOUT; return VAR_SERVER;}
 num-threads{COLON}	{ YDOUT; return VAR_NUM_THREADS;}
 verbosity{COLON}	{ YDOUT; return VAR_VERBOSITY;}
 port{COLON}		{ YDOUT; return VAR_PORT;}
-outgoing-port{COLON}	{ YDOUT; return VAR_OUTGOING_PORT;}
 outgoing-range{COLON}	{ YDOUT; return VAR_OUTGOING_RANGE;}
+outgoing-port-permit{COLON}	{ YDOUT; return VAR_OUTGOING_PORT_PERMIT;}
+outgoing-port-avoid{COLON}	{ YDOUT; return VAR_OUTGOING_PORT_AVOID;}
 outgoing-num-tcp{COLON}	{ YDOUT; return VAR_OUTGOING_NUM_TCP;}
 incoming-num-tcp{COLON}	{ YDOUT; return VAR_INCOMING_NUM_TCP;}
 do-ip4{COLON}		{ YDOUT; return VAR_DO_IP4;}
@@ -168,6 +169,7 @@ use-syslog{COLON}	{ YDOUT; return VAR_USE_SYSLOG;}
 local-zone{COLON}	{ YDOUT; return VAR_LOCAL_ZONE;}
 local-data{COLON}	{ YDOUT; return VAR_LOCAL_DATA;}
 statistics-interval{COLON}	{ YDOUT; return VAR_STATISTICS_INTERVAL;}
+statistics-cumulative{COLON}	{ YDOUT; return VAR_STATISTICS_CUMULATIVE;}
 {NEWLINE}		{ LEXOUT(("NL\n")); cfg_parser->line++;}
 
 	/* Quoted strings. Strip leading and ending quotes */

util/configparser.h

@@ -51,71 +51,73 @@
      VAR_VERBOSITY = 267,
      VAR_NUM_THREADS = 268,
      VAR_PORT = 269,
-     VAR_OUTGOING_PORT = 270,
-     VAR_OUTGOING_RANGE = 271,
-     VAR_INTERFACE = 272,
-     VAR_DO_IP4 = 273,
-     VAR_DO_IP6 = 274,
-     VAR_DO_UDP = 275,
-     VAR_DO_TCP = 276,
-     VAR_CHROOT = 277,
-     VAR_USERNAME = 278,
-     VAR_DIRECTORY = 279,
-     VAR_LOGFILE = 280,
-     VAR_PIDFILE = 281,
-     VAR_MSG_CACHE_SIZE = 282,
-     VAR_MSG_CACHE_SLABS = 283,
-     VAR_NUM_QUERIES_PER_THREAD = 284,
-     VAR_RRSET_CACHE_SIZE = 285,
-     VAR_RRSET_CACHE_SLABS = 286,
-     VAR_OUTGOING_NUM_TCP = 287,
-     VAR_INFRA_HOST_TTL = 288,
-     VAR_INFRA_LAME_TTL = 289,
-     VAR_INFRA_CACHE_SLABS = 290,
-     VAR_INFRA_CACHE_NUMHOSTS = 291,
-     VAR_INFRA_CACHE_LAME_SIZE = 292,
-     VAR_NAME = 293,
-     VAR_STUB_ZONE = 294,
-     VAR_STUB_HOST = 295,
-     VAR_STUB_ADDR = 296,
-     VAR_TARGET_FETCH_POLICY = 297,
-     VAR_HARDEN_SHORT_BUFSIZE = 298,
-     VAR_HARDEN_LARGE_QUERIES = 299,
-     VAR_FORWARD_ZONE = 300,
-     VAR_FORWARD_HOST = 301,
-     VAR_FORWARD_ADDR = 302,
-     VAR_DO_NOT_QUERY_ADDRESS = 303,
-     VAR_HIDE_IDENTITY = 304,
-     VAR_HIDE_VERSION = 305,
-     VAR_IDENTITY = 306,
-     VAR_VERSION = 307,
-     VAR_HARDEN_GLUE = 308,
-     VAR_MODULE_CONF = 309,
-     VAR_TRUST_ANCHOR_FILE = 310,
-     VAR_TRUST_ANCHOR = 311,
-     VAR_VAL_OVERRIDE_DATE = 312,
-     VAR_BOGUS_TTL = 313,
-     VAR_VAL_CLEAN_ADDITIONAL = 314,
-     VAR_VAL_PERMISSIVE_MODE = 315,
-     VAR_INCOMING_NUM_TCP = 316,
-     VAR_MSG_BUFFER_SIZE = 317,
-     VAR_KEY_CACHE_SIZE = 318,
-     VAR_KEY_CACHE_SLABS = 319,
-     VAR_TRUSTED_KEYS_FILE = 320,
-     VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 321,
-     VAR_USE_SYSLOG = 322,
-     VAR_OUTGOING_INTERFACE = 323,
-     VAR_ROOT_HINTS = 324,
-     VAR_DO_NOT_QUERY_LOCALHOST = 325,
-     VAR_CACHE_MAX_TTL = 326,
-     VAR_HARDEN_DNNSEC_STRIPPED = 327,
-     VAR_ACCESS_CONTROL = 328,
-     VAR_LOCAL_ZONE = 329,
-     VAR_LOCAL_DATA = 330,
-     VAR_INTERFACE_AUTOMATIC = 331,
-     VAR_STATISTICS_INTERVAL = 332,
-     VAR_DO_DAEMONIZE = 333,
-     VAR_USE_CAPS_FOR_ID = 334
+     VAR_OUTGOING_RANGE = 270,
+     VAR_INTERFACE = 271,
+     VAR_DO_IP4 = 272,
+     VAR_DO_IP6 = 273,
+     VAR_DO_UDP = 274,
+     VAR_DO_TCP = 275,
+     VAR_CHROOT = 276,
+     VAR_USERNAME = 277,
+     VAR_DIRECTORY = 278,
+     VAR_LOGFILE = 279,
+     VAR_PIDFILE = 280,
+     VAR_MSG_CACHE_SIZE = 281,
+     VAR_MSG_CACHE_SLABS = 282,
+     VAR_NUM_QUERIES_PER_THREAD = 283,
+     VAR_RRSET_CACHE_SIZE = 284,
+     VAR_RRSET_CACHE_SLABS = 285,
+     VAR_OUTGOING_NUM_TCP = 286,
+     VAR_INFRA_HOST_TTL = 287,
+     VAR_INFRA_LAME_TTL = 288,
+     VAR_INFRA_CACHE_SLABS = 289,
+     VAR_INFRA_CACHE_NUMHOSTS = 290,
+     VAR_INFRA_CACHE_LAME_SIZE = 291,
+     VAR_NAME = 292,
+     VAR_STUB_ZONE = 293,
+     VAR_STUB_HOST = 294,
+     VAR_STUB_ADDR = 295,
+     VAR_TARGET_FETCH_POLICY = 296,
+     VAR_HARDEN_SHORT_BUFSIZE = 297,
+     VAR_HARDEN_LARGE_QUERIES = 298,
+     VAR_FORWARD_ZONE = 299,
+     VAR_FORWARD_HOST = 300,
+     VAR_FORWARD_ADDR = 301,
+     VAR_DO_NOT_QUERY_ADDRESS = 302,
+     VAR_HIDE_IDENTITY = 303,
+     VAR_HIDE_VERSION = 304,
+     VAR_IDENTITY = 305,
+     VAR_VERSION = 306,
+     VAR_HARDEN_GLUE = 307,
+     VAR_MODULE_CONF = 308,
+     VAR_TRUST_ANCHOR_FILE = 309,
+     VAR_TRUST_ANCHOR = 310,
+     VAR_VAL_OVERRIDE_DATE = 311,
+     VAR_BOGUS_TTL = 312,
+     VAR_VAL_CLEAN_ADDITIONAL = 313,
+     VAR_VAL_PERMISSIVE_MODE = 314,
+     VAR_INCOMING_NUM_TCP = 315,
+     VAR_MSG_BUFFER_SIZE = 316,
+     VAR_KEY_CACHE_SIZE = 317,
+     VAR_KEY_CACHE_SLABS = 318,
+     VAR_TRUSTED_KEYS_FILE = 319,
+     VAR_VAL_NSEC3_KEYSIZE_ITERATIONS = 320,
+     VAR_USE_SYSLOG = 321,
+     VAR_OUTGOING_INTERFACE = 322,
+     VAR_ROOT_HINTS = 323,
+     VAR_DO_NOT_QUERY_LOCALHOST = 324,
+     VAR_CACHE_MAX_TTL = 325,
+     VAR_HARDEN_DNNSEC_STRIPPED = 326,
+     VAR_ACCESS_CONTROL = 327,
+     VAR_LOCAL_ZONE = 328,
+     VAR_LOCAL_DATA = 329,
+     VAR_INTERFACE_AUTOMATIC = 330,
+     VAR_STATISTICS_INTERVAL = 331,
+     VAR_DO_DAEMONIZE = 332,
+     VAR_USE_CAPS_FOR_ID = 333,
+     VAR_STATISTICS_CUMULATIVE = 334,
+     VAR_OUTGOING_PORT_PERMIT = 335,
+     VAR_OUTGOING_PORT_AVOID = 336
    };
 #endif
 /* Tokens.  */
@@ -131,71 +133,73 @@
 #define VAR_VERBOSITY 267
 #define VAR_NUM_THREADS 268
 #define VAR_PORT 269
-#define VAR_OUTGOING_PORT 270
-#define VAR_OUTGOING_RANGE 271
-#define VAR_INTERFACE 272
-#define VAR_DO_IP4 273
-#define VAR_DO_IP6 274
-#define VAR_DO_UDP 275
-#define VAR_DO_TCP 276
-#define VAR_CHROOT 277
-#define VAR_USERNAME 278
-#define VAR_DIRECTORY 279
-#define VAR_LOGFILE 280
-#define VAR_PIDFILE 281
-#define VAR_MSG_CACHE_SIZE 282
-#define VAR_MSG_CACHE_SLABS 283
-#define VAR_NUM_QUERIES_PER_THREAD 284
-#define VAR_RRSET_CACHE_SIZE 285
-#define VAR_RRSET_CACHE_SLABS 286
-#define VAR_OUTGOING_NUM_TCP 287
-#define VAR_INFRA_HOST_TTL 288
-#define VAR_INFRA_LAME_TTL 289
-#define VAR_INFRA_CACHE_SLABS 290
-#define VAR_INFRA_CACHE_NUMHOSTS 291
-#define VAR_INFRA_CACHE_LAME_SIZE 292
-#define VAR_NAME 293
-#define VAR_STUB_ZONE 294
-#define VAR_STUB_HOST 295
-#define VAR_STUB_ADDR 296
-#define VAR_TARGET_FETCH_POLICY 297
-#define VAR_HARDEN_SHORT_BUFSIZE 298
-#define VAR_HARDEN_LARGE_QUERIES 299
-#define VAR_FORWARD_ZONE 300
-#define VAR_FORWARD_HOST 301
-#define VAR_FORWARD_ADDR 302
-#define VAR_DO_NOT_QUERY_ADDRESS 303
-#define VAR_HIDE_IDENTITY 304
-#define VAR_HIDE_VERSION 305
-#define VAR_IDENTITY 306
-#define VAR_VERSION 307
-#define VAR_HARDEN_GLUE 308
-#define VAR_MODULE_CONF 309
-#define VAR_TRUST_ANCHOR_FILE 310
-#define VAR_TRUST_ANCHOR 311
-#define VAR_VAL_OVERRIDE_DATE 312
-#define VAR_BOGUS_TTL 313
-#define VAR_VAL_CLEAN_ADDITIONAL 314
-#define VAR_VAL_PERMISSIVE_MODE 315
-#define VAR_INCOMING_NUM_TCP 316
-#define VAR_MSG_BUFFER_SIZE 317
-#define VAR_KEY_CACHE_SIZE 318
-#define VAR_KEY_CACHE_SLABS 319
-#define VAR_TRUSTED_KEYS_FILE 320
-#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 321
-#define VAR_USE_SYSLOG 322
-#define VAR_OUTGOING_INTERFACE 323
-#define VAR_ROOT_HINTS 324
-#define VAR_DO_NOT_QUERY_LOCALHOST 325
-#define VAR_CACHE_MAX_TTL 326
-#define VAR_HARDEN_DNNSEC_STRIPPED 327
-#define VAR_ACCESS_CONTROL 328
-#define VAR_LOCAL_ZONE 329
-#define VAR_LOCAL_DATA 330
-#define VAR_INTERFACE_AUTOMATIC 331
-#define VAR_STATISTICS_INTERVAL 332
-#define VAR_DO_DAEMONIZE 333
-#define VAR_USE_CAPS_FOR_ID 334
+#define VAR_OUTGOING_RANGE 270
+#define VAR_INTERFACE 271
+#define VAR_DO_IP4 272
+#define VAR_DO_IP6 273
+#define VAR_DO_UDP 274
+#define VAR_DO_TCP 275
+#define VAR_CHROOT 276
+#define VAR_USERNAME 277
+#define VAR_DIRECTORY 278
+#define VAR_LOGFILE 279
+#define VAR_PIDFILE 280
+#define VAR_MSG_CACHE_SIZE 281
+#define VAR_MSG_CACHE_SLABS 282
+#define VAR_NUM_QUERIES_PER_THREAD 283
+#define VAR_RRSET_CACHE_SIZE 284
+#define VAR_RRSET_CACHE_SLABS 285
+#define VAR_OUTGOING_NUM_TCP 286
+#define VAR_INFRA_HOST_TTL 287
+#define VAR_INFRA_LAME_TTL 288
+#define VAR_INFRA_CACHE_SLABS 289
+#define VAR_INFRA_CACHE_NUMHOSTS 290
+#define VAR_INFRA_CACHE_LAME_SIZE 291
+#define VAR_NAME 292
+#define VAR_STUB_ZONE 293
+#define VAR_STUB_HOST 294
+#define VAR_STUB_ADDR 295
+#define VAR_TARGET_FETCH_POLICY 296
+#define VAR_HARDEN_SHORT_BUFSIZE 297
+#define VAR_HARDEN_LARGE_QUERIES 298
+#define VAR_FORWARD_ZONE 299
+#define VAR_FORWARD_HOST 300
+#define VAR_FORWARD_ADDR 301
+#define VAR_DO_NOT_QUERY_ADDRESS 302
+#define VAR_HIDE_IDENTITY 303
+#define VAR_HIDE_VERSION 304
+#define VAR_IDENTITY 305
+#define VAR_VERSION 306
+#define VAR_HARDEN_GLUE 307
+#define VAR_MODULE_CONF 308
+#define VAR_TRUST_ANCHOR_FILE 309
+#define VAR_TRUST_ANCHOR 310
+#define VAR_VAL_OVERRIDE_DATE 311
+#define VAR_BOGUS_TTL 312
+#define VAR_VAL_CLEAN_ADDITIONAL 313
+#define VAR_VAL_PERMISSIVE_MODE 314
+#define VAR_INCOMING_NUM_TCP 315
+#define VAR_MSG_BUFFER_SIZE 316
+#define VAR_KEY_CACHE_SIZE 317
+#define VAR_KEY_CACHE_SLABS 318
+#define VAR_TRUSTED_KEYS_FILE 319
+#define VAR_VAL_NSEC3_KEYSIZE_ITERATIONS 320
+#define VAR_USE_SYSLOG 321
+#define VAR_OUTGOING_INTERFACE 322
+#define VAR_ROOT_HINTS 323
+#define VAR_DO_NOT_QUERY_LOCALHOST 324
+#define VAR_CACHE_MAX_TTL 325
+#define VAR_HARDEN_DNNSEC_STRIPPED 326
+#define VAR_ACCESS_CONTROL 327
+#define VAR_LOCAL_ZONE 328
+#define VAR_LOCAL_DATA 329
+#define VAR_INTERFACE_AUTOMATIC 330
+#define VAR_STATISTICS_INTERVAL 331
+#define VAR_DO_DAEMONIZE 332
+#define VAR_USE_CAPS_FOR_ID 333
+#define VAR_STATISTICS_CUMULATIVE 334
+#define VAR_OUTGOING_PORT_PERMIT 335
+#define VAR_OUTGOING_PORT_AVOID 336
 
 
 
@@ -207,7 +211,7 @@ typedef union YYSTYPE
 	char*	str;
 }
 /* Line 1489 of yacc.c.  */
-#line 211 "util/configparser.h"
+#line 215 "util/configparser.h"
 	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1

util/configparser.y

@@ -68,7 +68,7 @@ extern struct config_parser_state* cfg_parser;
 %token SPACE LETTER NEWLINE COMMENT COLON ANY ZONESTR
 %token <str> STRING
 %token VAR_SERVER VAR_VERBOSITY VAR_NUM_THREADS VAR_PORT
-%token VAR_OUTGOING_PORT VAR_OUTGOING_RANGE VAR_INTERFACE
+%token VAR_OUTGOING_RANGE VAR_INTERFACE
 %token VAR_DO_IP4 VAR_DO_IP6 VAR_DO_UDP VAR_DO_TCP 
 %token VAR_CHROOT VAR_USERNAME VAR_DIRECTORY VAR_LOGFILE VAR_PIDFILE
 %token VAR_MSG_CACHE_SIZE VAR_MSG_CACHE_SLABS VAR_NUM_QUERIES_PER_THREAD
@@ -89,6 +89,8 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_CACHE_MAX_TTL VAR_HARDEN_DNNSEC_STRIPPED VAR_ACCESS_CONTROL
 %token VAR_LOCAL_ZONE VAR_LOCAL_DATA VAR_INTERFACE_AUTOMATIC
 %token VAR_STATISTICS_INTERVAL VAR_DO_DAEMONIZE VAR_USE_CAPS_FOR_ID
+%token VAR_STATISTICS_CUMULATIVE VAR_OUTGOING_PORT_PERMIT 
+%token VAR_OUTGOING_PORT_AVOID
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -105,7 +107,7 @@ serverstart: VAR_SERVER
 contents_server: contents_server content_server 
 	| ;
 content_server: server_num_threads | server_verbosity | server_port |
-	server_outgoing_port | server_outgoing_range | server_do_ip4 |
+	server_outgoing_range | server_do_ip4 |
 	server_do_ip6 | server_do_udp | server_do_tcp | 
 	server_interface | server_chroot | server_username | 
 	server_directory | server_logfile | server_pidfile |
@@ -129,7 +131,8 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_harden_dnssec_stripped | server_access_control |
 	server_local_zone | server_local_data | server_interface_automatic |
 	server_statistics_interval | server_do_daemonize | 
-	server_use_caps_for_id
+	server_use_caps_for_id | server_statistics_cumulative |
+	server_outgoing_port_permit | server_outgoing_port_avoid
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -192,6 +195,15 @@ server_statistics_interval: VAR_STATISTICS_INTERVAL STRING
 		free($2);
 	}
 	;
+server_statistics_cumulative: VAR_STATISTICS_CUMULATIVE STRING
+	{
+		OUTYY(("P(server_statistics_cumulative:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->stat_cumulative = (strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_port: VAR_PORT STRING
 	{
 		OUTYY(("P(server_port:%s)\n", $2));
@@ -229,15 +241,6 @@ server_outgoing_interface: VAR_OUTGOING_INTERFACE STRING
 				cfg_parser->cfg->num_out_ifs++] = $2;
 	}
 	;
-server_outgoing_port: VAR_OUTGOING_PORT STRING
-	{
-		OUTYY(("P(server_outgoing_port:%s)\n", $2));
-		if(atoi($2) == 0)
-			yyerror("port number expected");
-		else cfg_parser->cfg->outgoing_base_port = atoi($2);
-		free($2);
-	}
-	;
 server_outgoing_range: VAR_OUTGOING_RANGE STRING
 	{
 		OUTYY(("P(server_outgoing_range:%s)\n", $2));
@@ -247,6 +250,24 @@ server_outgoing_range: VAR_OUTGOING_RANGE STRING
 		free($2);
 	}
 	;
+server_outgoing_port_permit: VAR_OUTGOING_PORT_PERMIT STRING
+	{
+		OUTYY(("P(server_outgoing_port_permit:%s)\n", $2));
+		if(!cfg_mark_ports($2, 1, 
+			cfg_parser->cfg->outgoing_avail_ports, 65536))
+			yyerror("port number or range (\"low-high\") expected");
+		free($2);
+	}
+	;
+server_outgoing_port_avoid: VAR_OUTGOING_PORT_AVOID STRING
+	{
+		OUTYY(("P(server_outgoing_port_avoid:%s)\n", $2));
+		if(!cfg_mark_ports($2, 0, 
+			cfg_parser->cfg->outgoing_avail_ports, 65536))
+			yyerror("port number or range (\"low-high\") expected");
+		free($2);
+	}
+	;
 server_outgoing_num_tcp: VAR_OUTGOING_NUM_TCP STRING
 	{
 		OUTYY(("P(server_outgoing_num_tcp:%s)\n", $2));

util/data/msgencode.c

@@ -718,7 +718,7 @@ reply_info_answer_encode(struct query_info* qinf, struct reply_info* rep,
 		/* remove AA bit, copy RD and CD bits from query. */
 		flags = (rep->flags & ~BIT_AA) | (qflags & (BIT_RD|BIT_CD)); 
 	}
-	if(secure && dnssec)
+	if(secure && (dnssec || (qflags&BIT_AD)))
 		flags |= BIT_AD;
 	log_assert(flags & BIT_QR); /* QR bit must be on in our replies */
 	if(udpsize < LDNS_HEADER_SIZE)

util/data/msgreply.c

@@ -292,7 +292,25 @@ get_rrset_trust(struct msg_parse* msg, struct rrset_parse* rrset)
 {
 	uint16_t AA = msg->flags & BIT_AA;
 	if(rrset->section == LDNS_SECTION_ANSWER) {
-		if(AA)	return rrset_trust_ans_AA;
+		if(AA) {
+			/* RFC2181 says remainder of CNAME chain is nonauth*/
+			if(msg->rrset_first && 
+				msg->rrset_first->section==LDNS_SECTION_ANSWER
+				&& msg->rrset_first->type==LDNS_RR_TYPE_CNAME){
+				if(rrset == msg->rrset_first)
+					return rrset_trust_ans_AA;
+				else 	return rrset_trust_ans_noAA;
+			}
+			if(msg->rrset_first && 
+				msg->rrset_first->section==LDNS_SECTION_ANSWER
+				&& msg->rrset_first->type==LDNS_RR_TYPE_DNAME){
+				if(rrset == msg->rrset_first ||
+				   rrset == msg->rrset_first->rrset_all_next)
+					return rrset_trust_ans_AA;
+				else 	return rrset_trust_ans_noAA;
+			}
+			return rrset_trust_ans_AA;
+		}
 		else	return rrset_trust_ans_noAA;
 	} else if(rrset->section == LDNS_SECTION_AUTHORITY) {
 		if(AA)	return rrset_trust_auth_AA;

util/data/packed_rrset.c

@@ -164,9 +164,9 @@ rrset_key_hash(struct packed_rrset_key* key)
 	/* this routine does not have a compressed name */
 	hashvalue_t h = 0xab;
 	h = dname_query_hash(key->dname, h);
-        h = hashlittle(&t, sizeof(t), h);
-        h = hashlittle(&key->rrset_class, sizeof(uint16_t), h);
-        h = hashlittle(&key->flags, sizeof(uint32_t), h);
+	h = hashlittle(&t, sizeof(t), h);
+	h = hashlittle(&key->rrset_class, sizeof(uint16_t), h);
+	h = hashlittle(&key->flags, sizeof(uint32_t), h);
 	return h;
 }
 

util/netevent.c

@@ -152,7 +152,13 @@ comm_base_create()
 	}
 	comm_base_now(b);
 	verbose(VERB_ALGO, "libevent %s uses %s method.", 
-		event_get_version(), event_get_method());
+		event_get_version(), 
+#ifdef HAVE_EVENT_BASE_GET_METHOD
+		event_base_get_method(b->eb->base)
+#else
+		event_get_method()
+#endif
+	);
 	return b;
 }
 
@@ -270,6 +276,9 @@ void p_ancil(const char* str, struct comm_reply* r)
 			buf1, buf2);
 #endif
 	}
+#else
+	(void)str;
+	(void)r;
 #endif
 }
 
@@ -350,6 +359,11 @@ comm_point_send_udp_msg_if(struct comm_point *c, ldns_buffer* packet,
 	}
 	return 1;
 #else
+	(void)c;
+	(void)packet;
+	(void)addr;
+	(void)addrlen;
+	(void)r;
 	log_err("sendmsg: IPV6_PKTINFO not supported");
 	return 0;
 #endif
@@ -438,8 +452,13 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 			(void)comm_point_send_udp_msg_if(rep.c, rep.c->buffer,
 				(struct sockaddr*)&rep.addr, rep.addrlen, &rep);
 		}
+		if(rep.c->fd == -1) /* commpoint closed */
+			break;
 	}
 #else
+	(void)fd;
+	(void)event;
+	(void)arg;
 	fatal_exit("recvmsg: No support for IPV6_PKTINFO. "
 		"Please disable interface-automatic");
 #endif
@@ -482,6 +501,8 @@ comm_point_udp_callback(int fd, short event, void* arg)
 			(void)comm_point_send_udp_msg(rep.c, rep.c->buffer,
 				(struct sockaddr*)&rep.addr, rep.addrlen);
 		}
+		if(rep.c->fd == -1) /* commpoint closed */
+			break;
 	}
 }
 
@@ -850,13 +871,18 @@ comm_point_create_udp(struct comm_base *base, int fd, ldns_buffer* buffer,
 	c->do_not_close = 0;
 	c->tcp_do_toggle_rw = 0;
 	c->tcp_check_nb_connect = 0;
+	c->inuse = 0;
 	c->callback = callback;
 	c->cb_arg = callback_arg;
 	evbits = EV_READ | EV_PERSIST;
 	/* libevent stuff */
 	event_set(&c->ev->ev, c->fd, evbits, comm_point_udp_callback, c);
-	if(event_base_set(base->eb->base, &c->ev->ev) != 0 ||
-		event_add(&c->ev->ev, c->timeout) != 0 ) {
+	if(event_base_set(base->eb->base, &c->ev->ev) != 0) {
+		log_err("could not baseset udp event");
+		comm_point_delete(c);
+		return NULL;
+	}
+	if(fd!=-1 && event_add(&c->ev->ev, c->timeout) != 0 ) {
 		log_err("could not add udp event");
 		comm_point_delete(c);
 		return NULL;
@@ -893,6 +919,7 @@ comm_point_create_udp_ancil(struct comm_base *base, int fd,
 	c->type = comm_udp;
 	c->tcp_do_close = 0;
 	c->do_not_close = 0;
+	c->inuse = 0;
 	c->tcp_do_toggle_rw = 0;
 	c->tcp_check_nb_connect = 0;
 	c->callback = callback;
@@ -900,8 +927,12 @@ comm_point_create_udp_ancil(struct comm_base *base, int fd,
 	evbits = EV_READ | EV_PERSIST;
 	/* libevent stuff */
 	event_set(&c->ev->ev, c->fd, evbits, comm_point_udp_ancil_callback, c);
-	if(event_base_set(base->eb->base, &c->ev->ev) != 0 ||
-		event_add(&c->ev->ev, c->timeout) != 0 ) {
+	if(event_base_set(base->eb->base, &c->ev->ev) != 0) {
+		log_err("could not baseset udp event");
+		comm_point_delete(c);
+		return NULL;
+	}
+	if(fd!=-1 && event_add(&c->ev->ev, c->timeout) != 0 ) {
 		log_err("could not add udp event");
 		comm_point_delete(c);
 		return NULL;
@@ -1198,8 +1229,10 @@ comm_point_close(struct comm_point* c)
 			log_err("could not event_del on close");
 		}
 	/* close fd after removing from event lists, or epoll.. is messed up */
-	if(c->fd != -1 && !c->do_not_close)
+	if(c->fd != -1 && !c->do_not_close) {
+		verbose(VERB_ALGO, "close fd %d", c->fd);
 		close(c->fd);
+	}
 	c->fd = -1;
 }
 
@@ -1270,7 +1303,8 @@ comm_point_stop_listening(struct comm_point* c)
 void 
 comm_point_start_listening(struct comm_point* c, int newfd, int sec)
 {
-	verbose(VERB_ALGO, "comm point start listening %d", c->fd);
+	verbose(VERB_ALGO, "comm point start listening %d", 
+		c->fd==-1?newfd:c->fd);
 	if(c->type == comm_tcp_accept && !c->tcp_free) {
 		/* no use to start listening no free slots. */
 		return;

util/netevent.h

@@ -191,6 +191,10 @@ struct comm_point {
 	/** if set, checks for pending error from nonblocking connect() call.*/
 	int tcp_check_nb_connect;
 
+	/** number of queries outstanding on this socket, used by
+	 * outside network for udp ports */
+	int inuse;
+
 	/** callback when done.
 	    tcp_accept does not get called back, is NULL then.
 	    If a timeout happens, callback with timeout=1 is called.

validator/val_sigcrypt.c

@@ -1182,6 +1182,50 @@ log_crypto_error(const char* str, unsigned long e)
 	log_err("%s crypto %s", str, buf);
 }
 
+/**
+ * Setup DSA key digest in DER encoding ... 
+ * @param sig: input is signature output alloced ptr (unless failure).
+ * 	caller must free alloced ptr if this routine returns true.
+ * @param len: intput is initial siglen, output is output len.
+ * @return false on failure.
+ */
+static int
+setup_dsa_sig(unsigned char** sig, unsigned int* len)
+{
+	unsigned char* orig = *sig;
+	unsigned int origlen = *len;
+	int newlen;
+
+	uint8_t t;
+	BIGNUM *R, *S;
+	DSA_SIG *dsasig;
+
+	/* extract the R and S field from the sig buffer */
+	if(origlen < 1 + 2*SHA_DIGEST_LENGTH)
+		return 0;
+	t = orig[0];
+	R = BN_new();
+	if(!R) return 0;
+	(void) BN_bin2bn(orig + 1, SHA_DIGEST_LENGTH, R);
+	S = BN_new();
+	if(!S) return 0;
+	(void) BN_bin2bn(orig + 21, SHA_DIGEST_LENGTH, S);
+	dsasig = DSA_SIG_new();
+	if(!dsasig) return 0;
+
+	dsasig->r = R;
+	dsasig->s = S;
+	*sig = NULL;
+	newlen = i2d_DSA_SIG(dsasig, sig);
+	if(newlen < 0) {
+		free(sig);
+		return 0;
+	}
+	*len = (unsigned int)newlen;
+	DSA_SIG_free(dsasig);
+	return 1;
+}
+
 /**
  * Setup key and digest for verification. Adjust sig if necessary.
  *
@@ -1196,24 +1240,54 @@ static int
 setup_key_digest(int algo, EVP_PKEY* evp_key, const EVP_MD** digest_type, 
 	unsigned char* key, size_t keylen)
 {
+	DSA* dsa;
+	RSA* rsa;
+
 	switch(algo) {
 		case LDNS_DSA:
 		case LDNS_DSA_NSEC3:
-			EVP_PKEY_assign_DSA(evp_key, 
-				ldns_key_buf2dsa_raw(key, keylen));
+			dsa = ldns_key_buf2dsa_raw(key, keylen);
+			if(!dsa) {
+				verbose(VERB_QUERY, "verify: "
+					"ldns_key_buf2dsa_raw failed");
+				return 0;
+			}
+			if(EVP_PKEY_assign_DSA(evp_key, dsa) == 0) {
+				verbose(VERB_QUERY, "verify: "
+					"EVP_PKEY_assign_DSA failed");
+				return 0;
+			}
 			*digest_type = EVP_dss1();
 
 			break;
 		case LDNS_RSASHA1:
 		case LDNS_RSASHA1_NSEC3:
-			EVP_PKEY_assign_RSA(evp_key, 
-				ldns_key_buf2rsa_raw(key, keylen));
+			rsa = ldns_key_buf2rsa_raw(key, keylen);
+			if(!rsa) {
+				verbose(VERB_QUERY, "verify: "
+					"ldns_key_buf2rsa_raw SHA1 failed");
+				return 0;
+			}
+			if(EVP_PKEY_assign_RSA(evp_key, rsa) == 0) {
+				verbose(VERB_QUERY, "verify: "
+					"EVP_PKEY_assign_RSA SHA1 failed");
+				return 0;
+			}
 			*digest_type = EVP_sha1();
 
 			break;
 		case LDNS_RSAMD5:
-			EVP_PKEY_assign_RSA(evp_key, 
-				ldns_key_buf2rsa_raw(key, keylen));
+			rsa = ldns_key_buf2rsa_raw(key, keylen);
+			if(!rsa) {
+				verbose(VERB_QUERY, "verify: "
+					"ldns_key_buf2rsa_raw MD5 failed");
+				return 0;
+			}
+			if(EVP_PKEY_assign_RSA(evp_key, rsa) == 0) {
+				verbose(VERB_QUERY, "verify: "
+					"EVP_PKEY_assign_RSA MD5 failed");
+				return 0;
+			}
 			*digest_type = EVP_md5();
 
 			break;
@@ -1243,7 +1317,7 @@ verify_canonrrset(ldns_buffer* buf, int algo, unsigned char* sigblock,
 {
 	const EVP_MD *digest_type;
 	EVP_MD_CTX ctx;
-	int res;
+	int res, dofree = 0;
 	EVP_PKEY *evp_key = EVP_PKEY_new();
 	if(!evp_key) {
 		log_err("verify: malloc failure in crypto");
@@ -1255,21 +1329,52 @@ verify_canonrrset(ldns_buffer* buf, int algo, unsigned char* sigblock,
 		EVP_PKEY_free(evp_key);
 		return sec_status_bogus;
 	}
+	/* if it is a DSA signature in bind format, convert to DER format */
+	if((algo == LDNS_DSA || algo == LDNS_DSA_NSEC3) && 
+		sigblock_len == 1+2*SHA_DIGEST_LENGTH) {
+		if(!setup_dsa_sig(&sigblock, &sigblock_len)) {
+			verbose(VERB_QUERY, "verify: failed to setup DSA sig");
+			EVP_PKEY_free(evp_key);
+			return sec_status_bogus;
+		}
+		dofree = 1;
+	} 
 
 	/* do the signature cryptography work */
 	EVP_MD_CTX_init(&ctx);
-	EVP_VerifyInit(&ctx, digest_type);
-	EVP_VerifyUpdate(&ctx, (unsigned char*)ldns_buffer_begin(buf), 
-		(unsigned int)ldns_buffer_limit(buf));
+	if(EVP_VerifyInit(&ctx, digest_type) == 0) {
+		verbose(VERB_QUERY, "verify: EVP_VerifyInit failed");
+		EVP_PKEY_free(evp_key);
+		if(dofree) free(sigblock);
+		return sec_status_unchecked;
+	}
+	if(EVP_VerifyUpdate(&ctx, (unsigned char*)ldns_buffer_begin(buf), 
+		(unsigned int)ldns_buffer_limit(buf)) == 0) {
+		verbose(VERB_QUERY, "verify: EVP_VerifyUpdate failed");
+		EVP_PKEY_free(evp_key);
+		if(dofree) free(sigblock);
+		return sec_status_unchecked;
+	}
+		
 	res = EVP_VerifyFinal(&ctx, sigblock, sigblock_len, evp_key);
-	EVP_MD_CTX_cleanup(&ctx);
+	if(EVP_MD_CTX_cleanup(&ctx) == 0) {
+		verbose(VERB_QUERY, "verify: EVP_MD_CTX_cleanup failed");
+		EVP_PKEY_free(evp_key);
+		if(dofree) free(sigblock);
+		return sec_status_unchecked;
+	}
 	EVP_PKEY_free(evp_key);
 
+	if(dofree)
+		free(sigblock);
+
 	if(res == 1) {
 		return sec_status_secure;
 	} else if(res == 0) {
+		verbose(VERB_QUERY, "verify: signature mismatch");
 		return sec_status_bogus;
 	}
+
 	log_crypto_error("verify:", ERR_get_error());
 	return sec_status_unchecked;
 }
@@ -1385,7 +1490,7 @@ dnskey_verify_rrset_sig(struct regional* region, ldns_buffer* buf,
 	/* verify */
 	sec = verify_canonrrset(buf, (int)sig[2+2],
 		sigblock, sigblock_len, key, keylen);
-
+	
 	/* check if TTL is too high - reduce if so */
 	if(sec == sec_status_secure) {
 		adjust_ttl(ve, now, rrset, sig+2+4, sig+2+8, sig+2+12);