moved from trunk.

git-svn-id: file:///svn/unbound/tags/release-0.9@947 be551aaa-1e26-0410-a405-d3ace91eadb9
makedist fixup.
2026-08-17 21:25:50 +02:00 · 2008-02-11 15:46:40 +00:00 · 2008-02-08 13:09:25 +00:00 · 2008-02-08 12:59:36 +00:00 · 2008-02-08 12:46:21 +00:00 · 2008-02-08 12:27:41 +00:00
144 changed files with 2377 additions and 13401 deletions
@@ -22,7 +22,6 @@ srcdir=@srcdir@
 prefix=@prefix@
 exec_prefix=@exec_prefix@
 bindir=@bindir@
-sbindir=@sbindir@
 mandir=@mandir@
 libdir=@libdir@
 # datarootdir is here to please some checkers, use datadir.
@@ -95,20 +94,13 @@ ASYNCLOOK_SRC=testcode/asynclook.c
 ASYNCLOOK_OBJ=$(addprefix $(BUILD),$(ASYNCLOOK_SRC:.c=.o)) $(COMPAT_OBJ)
 STREAMTCP_SRC=testcode/streamtcp.c smallapp/worker_cb.c $(COMMON_SRC)
 STREAMTCP_OBJ=$(addprefix $(BUILD),$(STREAMTCP_SRC:.c=.o)) $(COMPAT_OBJ)
-PERF_SRC=testcode/perf.c smallapp/worker_cb.c $(COMMON_SRC)
-PERF_OBJ=$(addprefix $(BUILD),$(PERF_SRC:.c=.o)) $(COMPAT_OBJ)
-DELAYER_SRC=testcode/delayer.c smallapp/worker_cb.c $(COMMON_SRC)
-DELAYER_OBJ=$(addprefix $(BUILD),$(DELAYER_SRC:.c=.o)) $(COMPAT_OBJ)
-HARVEST_SRC=testcode/harvest.c
-HARVEST_OBJ=$(addprefix $(BUILD),$(HARVEST_SRC:.c=.o)) $(COMPAT_OBJ)
 LIBUNBOUND_SRC=$(patsubst $(srcdir)/%,%, \
 	$(wildcard $(srcdir)/libunbound/*.c) $(COMMON_SRC))
 LIBUNBOUND_OBJ=$(addprefix $(BUILD),$(LIBUNBOUND_SRC:.c=.o)) $(COMPAT_OBJ)
 ALL_SRC=$(sort $(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
 	$(TESTBOUND_SRC) $(LOCKVERIFY_SRC) $(PKTVIEW_SRC) $(SIGNIT_SRC) \
 	$(MEMSTATS_SRC) $(CHECKCONF_SRC) $(LIBUNBOUND_SRC) $(HOST_SRC) \
-	$(ASYNCLOOK_SRC) $(STREAMTCP_SRC) $(PERF_SRC) $(DELAYER_SRC) \
-	$(HARVEST_SRC) )
+	$(ASYNCLOOK_SRC) $(STREAMTCP_SRC))
 ALL_OBJ=$(addprefix $(BUILD),$(ALL_SRC:.c=.o) \
 	$(addprefix compat/,$(LIBOBJS))) $(COMPAT_OBJ)

@@ -128,7 +120,7 @@ $(BUILD)%.o:    $(srcdir)/%.c
 all:	$(COMMON_OBJ) unbound unbound-checkconf lib unbound-host

 tests:	all unittest testbound lock-verify pktview signit memstats \
-	asynclook streamtcp perf delayer harvest
+	asynclook streamtcp

 test:	tests
 	bash testcode/do-tests.sh
@@ -192,18 +184,6 @@ streamtcp:	$(STREAMTCP_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(STREAMTCP_OBJ)) $(LIBS)

-perf:	$(PERF_OBJ) $(ldnslib)
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(PERF_OBJ)) $(LIBS)
-
-delayer:	$(DELAYER_OBJ) $(ldnslib)
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(DELAYER_OBJ)) $(LIBS)
-
-harvest:	$(HARVEST_OBJ) $(ldnslib) libunbound.la
-	$(INFO) Link $@
-	$Q$(LINK) -o $@ $(sort $(HARVEST_OBJ)) $(LIBS) -L. -L.libs -lunbound
-
 #testcode/ldns-testpkts.c:	$(ldnsdir)/examples/ldns-testpkts.c \
 #			$(ldnsdir)/examples/ldns-testpkts.h
 #	cp $(ldnsdir)/examples/ldns-testpkts.c testcode/ldns-testpkts.c
@@ -257,31 +237,26 @@ strip:
 	strip unbound-host

 install:
-	$(INSTALL) -m 755 -d $(sbindir)
+	$(INSTALL) -m 755 -d $(bindir)
 	$(INSTALL) -m 755 -d $(mandir)
 	$(INSTALL) -m 755 -d $(mandir)/man8
 	$(INSTALL) -m 755 -d $(mandir)/man5
-	$(INSTALL) -m 755 -d $(mandir)/man3
-	$(INSTALL) -m 755 -d $(mandir)/man1
 	$(INSTALL) -m 755 -d $(libdir)
 	$(INSTALL) -m 755 -d $(includedir)
-	$(LIBTOOL) --mode=install cp unbound $(sbindir)/unbound
-	$(LIBTOOL) --mode=install cp unbound-checkconf $(sbindir)/unbound-checkconf
-	$(LIBTOOL) --mode=install cp unbound-host $(sbindir)/unbound-host
+	$(LIBTOOL) --mode=install cp unbound $(bindir)/unbound
+	$(LIBTOOL) --mode=install cp unbound-checkconf $(bindir)/unbound-checkconf
+	$(LIBTOOL) --mode=install cp unbound-host $(bindir)/unbound-host
 	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound.8 $(mandir)/man8
 	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-checkconf.8 $(mandir)/man8
 	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound.conf.5 $(mandir)/man5
-	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-host.1 $(mandir)/man1
-	$(INSTALL) -c -m 644 $(srcdir)/doc/libunbound.3 $(mandir)/man3
 	if test ! -e $(configfile); then $(INSTALL) -d `dirname $(configfile)`; $(INSTALL) -c -m 644 $(srcdir)/doc/example.conf $(configfile); fi
 	$(LIBTOOL) --mode=install cp $(srcdir)/libunbound/unbound.h $(includedir)/unbound.h
 	$(LIBTOOL) --mode=install cp libunbound.la $(libdir)
 	$(LIBTOOL) --mode=finish $(libdir)

 uninstall:
-	rm -f -- $(sbindir)/unbound $(sbindir)/unbound-checkconf $(sbindir)/unbound-host
+	rm -f -- $(bindir)/unbound $(bindir)/unbound-checkconf $(bindir)/unbound-host
 	rm -f -- $(mandir)/man8/unbound.8 $(mandir)/man8/unbound-checkconf.8 $(mandir)/man5/unbound.conf.5
-	rm -f -- $(mandir)/man1/unbound-host.1 $(mandir)/man3/libunbound.3
 	rm -f -- $(includedir)/unbound.h
 	$(LIBTOOL) --mode=uninstall rm -f $(libdir)/libunbound.la
 	@echo
@@ -293,12 +268,6 @@ download_ldns:
 	mv ldns-*_pre_*.tar.gz ldns-src.tar.gz
 	rm ldns-*_pre_*.tar.gz.sha1 ldns_makedist.sh

-iana_update:
-	curl -o port-numbers.tmp http://www.iana.org/assignments/port-numbers
-	egrep -v "Unassigned|Reserved" port-numbers.tmp | awk '{ match($$0, "[0-9]+/udp"); if (RLENGTH > 0) print substr($$0, RSTART, RLENGTH - 4) ","}' | sort -nu > portslist.tmp
-	cat portslist.tmp > util/iana_ports.inc
-	rm -f port-numbers.tmp portslist.tmp
-
 # Automatic dependencies.
 $(BUILD)%.d: $(srcdir)/%.c
 	$(INFO) Depend $<
@@ -1,9 +1,9 @@
 Unbound README
 * ./configure && make && make install
 * on BSDs and Solaris use gmake (GNU make).
-* You can use libevent if you want. libevent is useful when using 
-  many (10000) outgoing ports. By default 16 ports are used and the
-  builtin alternative is equally capable and a little faster.
+* If it complains that no libevent can be found; libevent is useful when
+  using many (10000) outgoing ports. By default 16 ports are used and the
+  builtin alternative is equally capable.
 * More detailed README, README.svn, README.tests in doc directory
 * manual pages can be found in doc directory, and are installed, unbound(8).
 * example configuration file doc/example.conf
@@ -528,7 +528,7 @@ static long double abs_val (long double value)
  return result;
 }

-static long double compat_pow10 (int exp)
+static long double pow10 (int exp)
 {
  long double result = 1;

@@ -541,7 +541,7 @@ static long double compat_pow10 (int exp)
  return result;
 }

-static long compat_round (long double value)
+static long round (long double value)
 {
  long intpart;

@@ -602,12 +602,12 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
  /* We "cheat" by converting the fractional part to integer by
   * multiplying by a factor of 10
   */
-  fracpart = compat_round ((compat_pow10 (max)) * (ufvalue - intpart));
+  fracpart = round ((pow10 (max)) * (ufvalue - intpart));

-  if (fracpart >= compat_pow10 (max))
+  if (fracpart >= pow10 (max))
  {
    intpart++;
-    fracpart -= compat_pow10 (max);
+    fracpart -= pow10 (max);
  }

 #ifdef DEBUG_SNPRINTF
@@ -1,8 +1,5 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */

-/* Directory to chroot to */
-#undef CHROOT_DIR
-
 /* Pathname to the Unbound configuration file */
 #undef CONFIGFILE

@@ -27,9 +24,6 @@
 /* Define to 1 if you have the `event_base_free' function. */
 #undef HAVE_EVENT_BASE_FREE

-/* Define to 1 if you have the `event_base_get_method' function. */
-#undef HAVE_EVENT_BASE_GET_METHOD
-
 /* Define to 1 if you have the `event_base_once' function. */
 #undef HAVE_EVENT_BASE_ONCE

@@ -133,9 +127,6 @@
 /* Define to 1 if you have the <sys/param.h> header file. */
 #undef HAVE_SYS_PARAM_H

-/* Define to 1 if you have the <sys/resource.h> header file. */
-#undef HAVE_SYS_RESOURCE_H
-
 /* Define to 1 if you have the <sys/socket.h> header file. */
 #undef HAVE_SYS_SOCKET_H

@@ -184,9 +175,6 @@
 /* Define to the version of this package. */
 #undef PACKAGE_VERSION

-/* Pathname to unbound process id file */
-#undef PIDFILE
-
 /* Define to necessary symbol if this constant uses a non-standard name on
   your system. */
 #undef PTHREAD_CREATE_JOINABLE
@@ -194,9 +182,6 @@
 /* Define as the return type of signal handlers (`int' or `void'). */
 #undef RETSIGTYPE

-/* Directory to chdir to */
-#undef RUN_DIR
-
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS

@@ -268,9 +253,6 @@
 /* Define to `int' if <sys/types.h> does not define. */
 #undef pid_t

-/* Define to 'int' if not defined */
-#undef rlim_t
-
 /* Define to `unsigned int' if <sys/types.h> does not define. */
 #undef size_t

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.61 for unbound 0.11.
+# Generated by GNU Autoconf 2.61 for unbound 0.9.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -724,8 +724,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='0.11'
-PACKAGE_STRING='unbound 0.11'
+PACKAGE_VERSION='0.9'
+PACKAGE_STRING='unbound 0.9'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'

 # Factoring default headers for most tests.
@@ -1359,7 +1359,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures unbound 0.11 to adapt to many kinds of systems.
+\`configure' configures unbound 0.9 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1424,7 +1424,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 0.11:";;
+     short | recursive ) echo "Configuration of unbound 0.9:";;
   esac
  cat <<\_ACEOF

@@ -1462,10 +1462,8 @@ Optional Packages:
                          disable threading support.
  --with-solaris-threads  use solaris native thread library.
  --with-libevent=pathname
-                          use libevent (will check /usr/local /opt/local
-                          /usr/lib /usr/pkg /usr/sfw /usr or you can specify
-                          an explicit path). Slower, but allows use of large
-                          outgoing port ranges.
+                          set path to libevent (will check /usr/local
+                          /opt/local /usr/lib /usr/pkg /usr/sfw /usr)
  --with-ldns=PATH        specify prefix of path of ldns library to use


@@ -1549,7 +1547,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-unbound configure 0.11
+unbound configure 0.9
 generated by GNU Autoconf 2.61

 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1563,7 +1561,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by unbound $as_me 0.11, which was
+It was created by unbound $as_me 0.9, which was
 generated by GNU Autoconf 2.61.  Invocation command line was

  $ $0 $@
@@ -3263,7 +3261,16 @@ rm -f conftest*

 case "$prefix" in
        NONE)
-		prefix="/usr/local"
+                case "$sysconfdir" in
+                        '${prefix}/etc')
+                                sysconfdir=/etc
+                        ;;
+                esac
+                case "$localstatedir" in
+                        '${prefix}/var')
+                                localstatedir=/var
+                        ;;
+                esac
        ;;
 esac

@@ -3285,25 +3292,6 @@ cat >>confdefs.h <<_ACEOF
 _ACEOF


-# Determine run, chroot directory and pidfile locations
-ub_cfg=`eval echo $ub_conf_file`
-ub_dir=`dirname $ub_cfg`
-
-cat >>confdefs.h <<_ACEOF
-#define RUN_DIR "$ub_dir"
-_ACEOF
-
-
-cat >>confdefs.h <<_ACEOF
-#define CHROOT_DIR "$ub_dir"
-_ACEOF
-
-
-cat >>confdefs.h <<_ACEOF
-#define PIDFILE "$ub_dir/unbound.pid"
-_ACEOF
-
-


 # if the given code compiles without the flag, execute argument 4
@@ -5743,7 +5731,7 @@ ia64-*-hpux*)
  ;;
 *-*-irix6*)
  # Find out which ABI we are using.
-  echo '#line 5746 "configure"' > conftest.$ac_ext
+  echo '#line 5734 "configure"' > conftest.$ac_ext
  if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
  (eval $ac_compile) 2>&5
  ac_status=$?
@@ -7045,11 +7033,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7048: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7036: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:7052: \$? = $ac_status" >&5
+   echo "$as_me:7040: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -7313,11 +7301,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7316: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7304: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:7320: \$? = $ac_status" >&5
+   echo "$as_me:7308: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -7417,11 +7405,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7420: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7408: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:7424: \$? = $ac_status" >&5
+   echo "$as_me:7412: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -8882,7 +8870,7 @@ linux*)
  libsuff=
  case "$host_cpu" in
  x86_64*|s390x*|powerpc64*)
-    echo '#line 8885 "configure"' > conftest.$ac_ext
+    echo '#line 8873 "configure"' > conftest.$ac_ext
    if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
  (eval $ac_compile) 2>&5
  ac_status=$?
@@ -9746,7 +9734,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<EOF
-#line 9749 "configure"
+#line 9737 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -9846,7 +9834,7 @@ else
  lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
  lt_status=$lt_dlunknown
  cat > conftest.$ac_ext <<EOF
-#line 9849 "configure"
+#line 9837 "configure"
 #include "confdefs.h"

 #if HAVE_DLFCN_H
@@ -12182,11 +12170,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:12185: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:12173: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:12189: \$? = $ac_status" >&5
+   echo "$as_me:12177: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -12286,11 +12274,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:12289: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:12277: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:12293: \$? = $ac_status" >&5
+   echo "$as_me:12281: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -12822,7 +12810,7 @@ linux*)
  libsuff=
  case "$host_cpu" in
  x86_64*|s390x*|powerpc64*)
-    echo '#line 12825 "configure"' > conftest.$ac_ext
+    echo '#line 12813 "configure"' > conftest.$ac_ext
    if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
  (eval $ac_compile) 2>&5
  ac_status=$?
@@ -13877,11 +13865,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:13880: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:13868: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:13884: \$? = $ac_status" >&5
+   echo "$as_me:13872: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -13981,11 +13969,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:13984: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:13972: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:13988: \$? = $ac_status" >&5
+   echo "$as_me:13976: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -15426,7 +15414,7 @@ linux*)
  libsuff=
  case "$host_cpu" in
  x86_64*|s390x*|powerpc64*)
-    echo '#line 15429 "configure"' > conftest.$ac_ext
+    echo '#line 15417 "configure"' > conftest.$ac_ext
    if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
  (eval $ac_compile) 2>&5
  ac_status=$?
@@ -16200,11 +16188,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16203: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16191: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:16207: \$? = $ac_status" >&5
+   echo "$as_me:16195: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -16468,11 +16456,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16471: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16459: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>conftest.err)
   ac_status=$?
   cat conftest.err >&5
-   echo "$as_me:16475: \$? = $ac_status" >&5
+   echo "$as_me:16463: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s "$ac_outfile"; then
     # The compiler can only warn and ignore the option if not recognized
     # So say no if there are warnings other than the usual output.
@@ -16572,11 +16560,11 @@ else
   -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
   -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
   -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16575: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16563: $lt_compile\"" >&5)
   (eval "$lt_compile" 2>out/conftest.err)
   ac_status=$?
   cat out/conftest.err >&5
-   echo "$as_me:16579: \$? = $ac_status" >&5
+   echo "$as_me:16567: \$? = $ac_status" >&5
   if (exit $ac_status) && test -s out/conftest2.$ac_objext
   then
     # The compiler can only warn and ignore the option if not recognized
@@ -18037,7 +18025,7 @@ linux*)
  libsuff=
  case "$host_cpu" in
  x86_64*|s390x*|powerpc64*)
-    echo '#line 18040 "configure"' > conftest.$ac_ext
+    echo '#line 18028 "configure"' > conftest.$ac_ext
    if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
  (eval $ac_compile) 2>&5
  ac_status=$?
@@ -19428,8 +19416,7 @@ fi



-
-for ac_header in stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h sys/resource.h arpa/inet.h syslog.h
+for ac_header in stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h arpa/inet.h syslog.h
 do
 as_ac_Header=`echo "ac_cv_header_$ac_header" | $as_tr_sh`
 { echo "$as_me:$LINENO: checking for $ac_header" >&5
@@ -20346,75 +20333,6 @@ _ACEOF
 fi


-{ echo "$as_me:$LINENO: checking for rlim_t" >&5
-echo $ECHO_N "checking for rlim_t... $ECHO_C" >&6; }
-if test "${ac_cv_type_rlim_t+set}" = set; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-
-$ac_includes_default
-#if HAVE_SYS_RESOURCE_H
-#  include <sys/resource.h>
-#endif
-
-
-typedef rlim_t ac__type_new_;
-int
-main ()
-{
-if ((ac__type_new_ *) 0)
-  return 0;
-if (sizeof (ac__type_new_))
-  return 0;
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext
-if { (ac_try="$ac_compile"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
-  (eval "$ac_compile") 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && {
-	 test -z "$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       } && test -s conftest.$ac_objext; then
-  ac_cv_type_rlim_t=yes
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-	ac_cv_type_rlim_t=no
-fi
-
-rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
-fi
-{ echo "$as_me:$LINENO: result: $ac_cv_type_rlim_t" >&5
-echo "${ECHO_T}$ac_cv_type_rlim_t" >&6; }
-if test $ac_cv_type_rlim_t = yes; then
-  :
-else
-
-cat >>confdefs.h <<\_ACEOF
-#define rlim_t unsigned long
-_ACEOF
-
-fi
-
 { echo "$as_me:$LINENO: checking for socklen_t" >&5
 echo $ECHO_N "checking for socklen_t... $ECHO_C" >&6; }
 if test "${ac_cv_type_socklen_t+set}" = set; then
@@ -22023,10 +21941,10 @@ fi
 if test "${with_libevent+set}" = set; then
  withval=$with_libevent;
 else
-   withval="no"
+   withval="yes"
 fi

-if test x_$withval == x_yes -o x_$withval != x_no; then
+if test x_$withval != x_no; then
        { echo "$as_me:$LINENO: checking for libevent" >&5
 echo $ECHO_N "checking for libevent... $ECHO_C" >&6; }
        if test x_$withval = x_ -o x_$withval = x_yes; then
@@ -22041,11 +21959,11 @@ echo $ECHO_N "checking for libevent... $ECHO_C" >&6; }
            fi
        done
        if test x_$found_libevent != x_yes; then
-		if test -f "$dir/event.h" -a \( -f "$dir/libevent.la" -o -f "$dir/libev.la" \) ; then
+		if test -f "$dir/event.h" -a -f "$dir/libevent.la"; then
 			# libevent source directory
            		{ echo "$as_me:$LINENO: result: found in $thedir" >&5
 echo "${ECHO_T}found in $thedir" >&6; }
-                	CPPFLAGS="$CPPFLAGS -I$thedir -I$thedir/include"
+                	CPPFLAGS="$CPPFLAGS -I$thedir"
 			BAK_LDFLAGS="$LDFLAGS"
 			# remove evdns from linking
 			mkdir build >/dev/null 2>&1
@@ -22057,17 +21975,17 @@ echo "${ECHO_T}found in $thedir" >&6; }
 			cp $ev_files_o build/libevent
 			cp $ev_files_lo build/libevent
 			cp $ev_files_libso build/libevent/.libs
-            		LATE_LDFLAGS="build/libevent/*.lo -lm"
-			LDFLAGS="build/libevent/*.o $LDFLAGS -lm"
+            		LATE_LDFLAGS="build/libevent/*.lo"
+			LDFLAGS="build/libevent/*.o $LDFLAGS"
 		else
            		{ { echo "$as_me:$LINENO: error: Cannot find the libevent library in $withval
 You can restart ./configure --with-libevent=no to use a builtin alternative.
 Please note that this alternative is not as capable as libevent when using
-large outgoing port ranges.  " >&5
+many outgoing ports.  " >&5
 echo "$as_me: error: Cannot find the libevent library in $withval
 You can restart ./configure --with-libevent=no to use a builtin alternative.
 Please note that this alternative is not as capable as libevent when using
-large outgoing port ranges.  " >&2;}
+many outgoing ports.  " >&2;}
   { (exit 1); exit 1; }; }
 		fi
        else
@@ -22408,100 +22326,6 @@ _ACEOF
 fi
 done
 # only in libevent 1.4? and later
-
-for ac_func in event_base_get_method
-do
-as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh`
-{ echo "$as_me:$LINENO: checking for $ac_func" >&5
-echo $ECHO_N "checking for $ac_func... $ECHO_C" >&6; }
-if { as_var=$as_ac_var; eval "test \"\${$as_var+set}\" = set"; }; then
-  echo $ECHO_N "(cached) $ECHO_C" >&6
-else
-  cat >conftest.$ac_ext <<_ACEOF
-/* confdefs.h.  */
-_ACEOF
-cat confdefs.h >>conftest.$ac_ext
-cat >>conftest.$ac_ext <<_ACEOF
-/* end confdefs.h.  */
-/* Define $ac_func to an innocuous variant, in case <limits.h> declares $ac_func.
-   For example, HP-UX 11i <limits.h> declares gettimeofday.  */
-#define $ac_func innocuous_$ac_func
-
-/* System header to define __stub macros and hopefully few prototypes,
-    which can conflict with char $ac_func (); below.
-    Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
-    <limits.h> exists even on freestanding compilers.  */
-
-#ifdef __STDC__
-# include <limits.h>
-#else
-# include <assert.h>
-#endif
-
-#undef $ac_func
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char $ac_func ();
-/* The GNU C library defines this for functions which it implements
-    to always fail with ENOSYS.  Some functions are actually named
-    something starting with __ and the normal name is an alias.  */
-#if defined __stub_$ac_func || defined __stub___$ac_func
-choke me
-#endif
-
-int
-main ()
-{
-return $ac_func ();
-  ;
-  return 0;
-}
-_ACEOF
-rm -f conftest.$ac_objext conftest$ac_exeext
-if { (ac_try="$ac_link"
-case "(($ac_try" in
-  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
-  *) ac_try_echo=$ac_try;;
-esac
-eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5
-  (eval "$ac_link") 2>conftest.er1
-  ac_status=$?
-  grep -v '^ *+' conftest.er1 >conftest.err
-  rm -f conftest.er1
-  cat conftest.err >&5
-  echo "$as_me:$LINENO: \$? = $ac_status" >&5
-  (exit $ac_status); } && {
-	 test -z "$ac_c_werror_flag" ||
-	 test ! -s conftest.err
-       } && test -s conftest$ac_exeext &&
-       $as_test_x conftest$ac_exeext; then
-  eval "$as_ac_var=yes"
-else
-  echo "$as_me: failed program was:" >&5
-sed 's/^/| /' conftest.$ac_ext >&5
-
-	eval "$as_ac_var=no"
-fi
-
-rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
-      conftest$ac_exeext conftest.$ac_ext
-fi
-ac_res=`eval echo '${'$as_ac_var'}'`
-	       { echo "$as_me:$LINENO: result: $ac_res" >&5
-echo "${ECHO_T}$ac_res" >&6; }
-if test `eval echo '${'$as_ac_var'}'` = yes; then
-  cat >>confdefs.h <<_ACEOF
-#define `echo "HAVE_$ac_func" | $as_tr_cpp` 1
-_ACEOF
-
-fi
-done
- # only in libevent 1.4.3 and later
 	if test -n "$BAK_LDFLAGS"; then
 		LDFLAGS="$BAK_LDFLAGS"
 	fi
@@ -24919,8 +24743,8 @@ mkdir ldns-src; cp $srcdir/ldns-src.tar.gz ldns-src/ldns-src.tar.gz; (cd ldns-sr
 ldnsdir=`ls -d ldns-src/ldns*`
 { echo "$as_me:$LINENO: Configure $ldnsdir" >&5
 echo "$as_me: Configure $ldnsdir" >&6;}
-echo "(cd $ldnsdir && ./configure)"
-(cd $ldnsdir && ./configure)
+echo "(cd $ldnsdir; ./configure)"
+(cd $ldnsdir; ./configure)
 { echo "$as_me:$LINENO: Finished $ldnsdir configure" >&5
 echo "$as_me: Finished $ldnsdir configure" >&6;}
 CPPFLAGS="$CPPFLAGS -I$ldnsdir/include"
@@ -25368,7 +25192,7 @@ exec 6>&1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 0.11, which was
+This file was extended by unbound $as_me 0.9, which was
 generated by GNU Autoconf 2.61.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -25417,7 +25241,7 @@ Report bugs to <bug-autoconf@gnu.org>."
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF
 ac_cs_version="\\
-unbound config.status 0.11
+unbound config.status 0.9
 configured by $0, generated by GNU Autoconf 2.61,
  with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"

@@ -2,17 +2,26 @@
 # Process this file with autoconf to produce a configure script.
 AC_PREREQ(2.57)

-AC_INIT(unbound, 0.11, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 0.9, unbound-bugs@nlnetlabs.nl, unbound)

 CFLAGS=
 AC_AIX

 dnl
-dnl By default set prefix to /usr/local
+dnl By default set $sysconfdir to /etc and $localstatedir to /var
 dnl
 case "$prefix" in
        NONE)
-		prefix="/usr/local"
+                case "$sysconfdir" in
+                        '${prefix}/etc')
+                                sysconfdir=/etc
+                        ;;
+                esac
+                case "$localstatedir" in
+                        '${prefix}/var')
+                                localstatedir=/var
+                        ;;
+                esac
        ;;
 esac

@@ -27,13 +36,6 @@ AC_SUBST(ub_conf_file)
 # for $nsd_conf_file and once for the ${prefix} within it.
 AC_DEFINE_UNQUOTED(CONFIGFILE, ["`eval echo $ub_conf_file`"], [Pathname to the Unbound configuration file])

-# Determine run, chroot directory and pidfile locations
-ub_cfg=`eval echo $ub_conf_file`
-ub_dir=`dirname $ub_cfg`
-AC_DEFINE_UNQUOTED(RUN_DIR, ["$ub_dir"], [Directory to chdir to])
-AC_DEFINE_UNQUOTED(CHROOT_DIR, ["$ub_dir"], [Directory to chroot to])
-AC_DEFINE_UNQUOTED(PIDFILE, ["$ub_dir/unbound.pid"], [Pathname to unbound process id file])
-
 dnl routine to help check for compiler flags.
 AC_DEFUN([CHECK_COMPILER_FLAG],
 [
@@ -349,7 +351,7 @@ AC_PROG_LIBTOOL

 # Checks for header files.
 AC_HEADER_STDC
-AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h sys/resource.h arpa/inet.h syslog.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h arpa/inet.h syslog.h],,, [AC_INCLUDES_DEFAULT])

 # check for types
 AC_CHECK_TYPE(int8_t, char)
@@ -367,13 +369,6 @@ AC_TYPE_PID_T
 AC_TYPE_OFF_T
 AC_CHECK_TYPE(u_char, unsigned char)

-AC_CHECK_TYPE(rlim_t, , 
-	[AC_DEFINE([rlim_t], [unsigned long], [Define to 'int' if not defined])], [
-AC_INCLUDES_DEFAULT
-#if HAVE_SYS_RESOURCE_H
-#  include <sys/resource.h>
-#endif
-])
 AC_CHECK_TYPE(socklen_t, , 
 	[AC_DEFINE([socklen_t], [int], [Define to 'int' if not defined])], [
 AC_INCLUDES_DEFAULT
@@ -511,9 +506,9 @@ AC_SEARCH_LIBS([clock_gettime], [rt])

 # check for libevent
 AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
-    [use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr  or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
-    [ ],[ withval="no" ])
-if test x_$withval == x_yes -o x_$withval != x_no; then
+    [set path to libevent  (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr)]),
+    [ ],[ withval="yes" ])
+if test x_$withval != x_no; then
        AC_MSG_CHECKING(for libevent)
        if test x_$withval = x_ -o x_$withval = x_yes; then
            withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
@@ -527,10 +522,10 @@ if test x_$withval == x_yes -o x_$withval != x_no; then
            fi
        done
        if test x_$found_libevent != x_yes; then
-		if test -f "$dir/event.h" -a \( -f "$dir/libevent.la" -o -f "$dir/libev.la" \) ; then
+		if test -f "$dir/event.h" -a -f "$dir/libevent.la"; then
 			# libevent source directory
            		AC_MSG_RESULT(found in $thedir)
-                	CPPFLAGS="$CPPFLAGS -I$thedir -I$thedir/include"
+                	CPPFLAGS="$CPPFLAGS -I$thedir"
 			BAK_LDFLAGS="$LDFLAGS"
 			# remove evdns from linking
 			mkdir build >/dev/null 2>&1
@@ -542,13 +537,13 @@ if test x_$withval == x_yes -o x_$withval != x_no; then
 			cp $ev_files_o build/libevent
 			cp $ev_files_lo build/libevent
 			cp $ev_files_libso build/libevent/.libs
-            		LATE_LDFLAGS="build/libevent/*.lo -lm"
-			LDFLAGS="build/libevent/*.o $LDFLAGS -lm"
+            		LATE_LDFLAGS="build/libevent/*.lo"
+			LDFLAGS="build/libevent/*.o $LDFLAGS"
 		else
            		AC_MSG_ERROR([Cannot find the libevent library in $withval
 You can restart ./configure --with-libevent=no to use a builtin alternative.
 Please note that this alternative is not as capable as libevent when using
-large outgoing port ranges.  ])
+many outgoing ports.  ])
 		fi
        else
            AC_MSG_RESULT(found in $thedir)
@@ -562,7 +557,6 @@ large outgoing port ranges.  ])
 	AC_CHECK_HEADERS([event.h],,, [AC_INCLUDES_DEFAULT])
 	AC_CHECK_FUNCS([event_base_free]) # only in libevent 1.2 and later
 	AC_CHECK_FUNCS([event_base_once]) # only in libevent 1.4? and later
-	AC_CHECK_FUNCS([event_base_get_method]) # only in libevent 1.4.3 and later
 	if test -n "$BAK_LDFLAGS"; then
 		LDFLAGS="$BAK_LDFLAGS"
 	fi
@@ -645,8 +639,8 @@ if test -d ldns-src; then rm -rf ldns-src; fi
 mkdir ldns-src; cp $srcdir/ldns-src.tar.gz ldns-src/ldns-src.tar.gz; (cd ldns-src; gzip -cd ldns-src.tar.gz | tar xf -); rm -f ldns-src/ldns-src.tar.gz
 ldnsdir=`ls -d ldns-src/ldns*`
 AC_MSG_NOTICE([Configure $ldnsdir])
-echo "(cd $ldnsdir && ./configure)"
-(cd $ldnsdir && ./configure)
+echo "(cd $ldnsdir; ./configure)"
+(cd $ldnsdir; ./configure)
 AC_MSG_NOTICE([Finished $ldnsdir configure])
 CPPFLAGS="$CPPFLAGS -I$ldnsdir/include"
 LDFLAGS="$LDFLAGS $ldnsdir/*.lo"
@@ -1,6 +0,0 @@
-These files are contributed to unbound, and are not part of the official
-distribution but may be helpful.
-
-* rc_d_unbound: FreeBSD compatible /etc/rc.d script.
-* parseunbound.pl: perl script to run from cron that parses statistics from
-	the log file and stores them.
@@ -1,140 +0,0 @@
-#!/usr/local/bin/perl -w
-#
-# Script to parse the output from the unbound namedaemon.
-# Unbound supports a threading model, and outputs a multiline log-blob for
-# every thread.
-#
-# This script should parse all threads of the once, and store it
-# in a local cached file for speedy results when queried lots.
-#
-use strict;
-use POSIX qw(SEEK_END);
-use Storable;
-use FileHandle;
-use Carp qw(croak carp);
-use constant UNBOUND_CACHE => "/var/tmp/unbound-cache.stor";
-
-my $run_from_cron = @ARGV && $ARGV[0] eq "--cron" && shift;
-my $DEBUG = -t STDERR;
-
-# NB. VERY IMPORTANTES: set this when running this script.
-my $numthreads = 4;
-
-### if cache exists, read it in. and is newer than 3 minutes
-if ( -r UNBOUND_CACHE ) {
-    my $result = retrieve(UNBOUND_CACHE);
-    if (-M _ < 3/24/60 && !$run_from_cron ) {
-        print STDERR "Cached results:\n" if $DEBUG;
-        print join("\n", @$result), "\n";
-        exit;
-    }
-}
-my $logfile = shift or die "Usage: parseunbound.pl --cron unboundlogfile";
-my $in = new FileHandle $logfile or die "Cannot open $logfile: $!\n";
-
-# there is a special key 'thread' that indicates the thread. its not used, but returned anyway.
-my @records = ('thread', 'queries', 'cachehits', 'recursions', 'recursionavg',
-        'outstandingmax', 'outstandingavg', 'outstandingexc',
-        'median25', 'median50', 'median75',
-        'us_0', 'us_1', 'us_2', 'us_4', 'us_8', 'us_16', 'us_32',
-        'us_64', 'us_128', 'us_256', 'us_512', 'us_1024', 'us_2048',
-        'us_4096', 'us_8192', 'us_16384', 'us_32768', 'us_65536',
-        'us_131072', 'us_262144', 'us_524288', 's_1', 's_2', 's_4',
-        's_8', 's_16', 's_32', 's_64', 's_128', 's_256', 's_512');
-# Stats hash containing one or more keys. for every thread, 1 key.
-my %allstats = (); # key="$threadid", stats={key => value}
-my %startstats = (); # when we got a queries entry for this thread
-my %donestats = (); # same, but only when we got a histogram entry for it
-# stats hash contains name/value pairs of the actual numbers for that thread.
-my $offset = 0;
-my $inthread=0;
-my $inpid;
-
-# We should continue looping untill we meet these conditions:
-# a) more total queries than the previous run (which defaults to 0) AND
-# b) parsed all $numthreads threads in the log.
-my $numqueries = $previousresult ? $previousresult->[1] : 0;
-
-# Main loop
-while ( scalar keys %startstats < $numthreads || scalar keys %donestats < $numthreads) {
-    $offset += 10000;
-    if ( $offset > -s $logfile or $offset > 10_000_000 ) {
-        die "Cannot find stats in $logfile\n";
-    }
-    $in->seek(-$offset, SEEK_END) or croak "cannot seek $logfile: $!\n";
-
-    for my $line ( <$in> ) {
-        chomp($line);
-
-        #[1208777234] unbound[6705:0] 
-        if ($line =~ m/^\[\d+\] unbound\[\d+:(\d+)\]/) {
-            $inthread = $1;
-            if ($inthread + 1 > $numthreads) {
-                die "Hey. lazy. change \$numthreads in this script to ($inthread)\n";
-            }
-        }
-        # this line doesn't contain a pid:thread. skip.
-        else {
-            next;
-        }
-
-        if ( $line =~ m/info: server stats for thread \d+: (\d+) queries, (\d+) answers from cache, (\d+) recursions/ ) {
-            $startstats{$inthread} = 1;
-            $allstats{$inthread}->{thread} = $inthread;
-            $allstats{$inthread}->{queries} = $1;
-            $allstats{$inthread}->{cachehits} = $2;
-            $allstats{$inthread}->{recursions} = $3;
-        }
-        elsif ( $line =~ m/info: server stats for thread (\d+): requestlist max (\d+) avg ([0-9\.]+) exceeded (\d+)/ ) {
-            $allstats{$inthread}->{outstandingmax} = $2;
-            $allstats{$inthread}->{outstandingavg} = int($3); # This is a float; rrdtool only handles ints.
-            $allstats{$inthread}->{outstandingexc} = $4;
-        }
-        elsif ( $line =~ m/info: average recursion processing time ([0-9\.]+) sec/ ) {
-            $allstats{$inthread}->{recursionavg} = int($1 * 1000); # change sec to milisec.
-        }
-        elsif ( $line =~ m/info: histogram of recursion processing times/ ) {
-            next;
-        }
-        elsif ( $line =~ m/info: \[25%\]=([0-9\.]+) median\[50%\]=([0-9\.]+) \[75%\]=([0-9\.]+)/ ) {
-            $allstats{$inthread}->{median25} = int($1 * 1000000); # change seconds to usec
-            $allstats{$inthread}->{median50} = int($2 * 1000000);
-            $allstats{$inthread}->{median75} = int($3 * 1000000);
-        }
-        elsif ( $line =~ m/info: lower\(secs\) upper\(secs\) recursions/ ) {
-            # since after this line we're unsure if we get these numbers
-            # at all, we sould consider this marker as the end of the
-            # block. Chances that we're parsing a file halfway written
-            # at this stage are small. Bold statement.
-            $donestats{$inthread} = 1;
-            next;
-        }
-        elsif ( $line =~ m/info:\s+(\d+)\.(\d+)\s+(\d+)\.(\d+)\s+(\d+)/ ) {
-            my ($froms, $fromus, $toms, $tous, $counter) = ($1, $2, $3, $4, $5);
-            my $prefix = '';
-            if ($froms > 0) {
-                $allstats{$inthread}->{'s_' . int($froms)} = $counter;
-            } else {
-                $allstats{$inthread}->{'us_' . int($fromus)} = $counter;
-            }
-        }
-    }
-}
-
-my @result;
-# loop on the records we want to store
-for my $key ( @records ) {
-    my $sum = 0;
-    # these are the different threads parsed
-    foreach my $thread ( 0 .. $numthreads - 1 ) {
-        $sum += ($allstats{$thread}->{$key} || 0);
-    }
-    print STDERR "$key = " . $sum . "\n" if $DEBUG;
-    push @result, $sum;
-}
-print join("\n", @result), "\n";
-store \@result, UNBOUND_CACHE;
-
-if ($DEBUG) {
-    print STDERR "Threads: " . (scalar keys %allstats) . "\n";
-}
@@ -1,23 +0,0 @@
-#!/bin/sh
-#
-# unbound freebsd startup rc.d script, modified from the named script.
-# uses the default unbound installation path and pidfile location.
-# copy this to /etc/rc.d/unbound
-# and put unbound_enable="YES" into rc.conf
-#
-
-# PROVIDE: unbound
-# REQUIRE: SERVERS cleanvar
-# KEYWORD: shutdown
-
-. /etc/rc.subr
-
-name="unbound"
-rcvar=`set_rcvar`
-
-command="/usr/local/sbin/unbound"
-pidfile="/usr/local/etc/unbound/unbound.pid"
-extra_commands="reload"
-
-load_rc_config $name
-run_rc_command "$1"
@@ -194,16 +194,14 @@ acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg)
 	/* insert defaults, with '0' to ignore them if they are duplicates */
 	if(!acl_list_str_cfg(acl, "0.0.0.0/0", "refuse", 0))
 		return 0;
+	if(!acl_list_str_cfg(acl, "::0/0", "refuse", 0))
+		return 0;
 	if(!acl_list_str_cfg(acl, "127.0.0.0/8", "allow", 0))
 		return 0;
-	if(cfg->do_ip6) {
-		if(!acl_list_str_cfg(acl, "::0/0", "refuse", 0))
-			return 0;
-		if(!acl_list_str_cfg(acl, "::1", "allow", 0))
-			return 0;
-		if(!acl_list_str_cfg(acl, "::ffff:127.0.0.1", "allow", 0))
-			return 0;
-	}
+	if(!acl_list_str_cfg(acl, "::1", "allow", 0))
+		return 0;
+	if(!acl_list_str_cfg(acl, "::ffff:127.0.0.1", "allow", 0))
+		return 0;
 	acl_list_init_parents(acl);
 	return 1;
 }
@@ -53,7 +53,6 @@
 #include "services/localzone.h"
 #include "services/modstack.h"
 #include "util/module.h"
-#include "util/random.h"
 #include <signal.h>

 /** How many quit requests happened. */
@@ -83,8 +82,6 @@ static RETSIGTYPE record_sigh(int sig)
 		case SIGHUP:
 			sig_record_reload++;
 			break;
-		case SIGPIPE:
-			break;
 		default:
 			log_err("ignoring signal %d", sig);
 	}
@@ -100,8 +97,7 @@ signal_handling_record()
 	if( signal(SIGTERM, record_sigh) == SIG_ERR ||
 		signal(SIGQUIT, record_sigh) == SIG_ERR ||
 		signal(SIGINT, record_sigh) == SIG_ERR ||
-		signal(SIGHUP, record_sigh) == SIG_ERR ||
-		signal(SIGPIPE, SIG_IGN) == SIG_ERR)
+		signal(SIGHUP, record_sigh) == SIG_ERR)
 		log_err("install sighandler: %s", strerror(errno));
 }

@@ -176,74 +172,23 @@ static void daemon_setup_modules(struct daemon* daemon)
 	}
 }

-/**
- * Obtain allowed port numbers, concatenate the list, and shuffle them
- * (ready to be handed out to threads).
- * @param daemon: the daemon. Uses rand and cfg.
- * @param shufport: the portlist output.
- * @return number of ports available.
- */
-int daemon_get_shufport(struct daemon* daemon, int* shufport)
-{
-	int i, n, k, temp;
-	int avail = 0;
-	for(i=0; i<65536; i++) {
-		if(daemon->cfg->outgoing_avail_ports[i]) {
-			shufport[avail++] = daemon->cfg->
-				outgoing_avail_ports[i];
-		}
-	}
-	if(avail == 0)
-		fatal_exit("no ports are permitted for UDP, add "
-			"with outgoing-port-permit");
-        /* Knuth shuffle */
-	n = avail;
-	while(--n > 0) {
-		k = ub_random(daemon->rand) % (n+1); /* 0<= k<= n */
-		temp = shufport[k];
-		shufport[k] = shufport[n];
-		shufport[n] = temp;
-	}
-	return avail;
-}
-
 /**
 * Allocate empty worker structures. With backptr and thread-number,
 * from 0..numthread initialised. Used as user arguments to new threads.
- * Creates the daemon random generator if it does not exist yet.
- * The random generator stays existing between reloads with a unique state.
 * @param daemon: the daemon with (new) config settings.
 */
 static void 
 daemon_create_workers(struct daemon* daemon)
 {
-	int i, numport;
-	int* shufport;
+	int i;
 	log_assert(daemon && daemon->cfg);
-	if(!daemon->rand) {
-		unsigned int seed = (unsigned int)time(NULL) ^ 
-			(unsigned int)getpid() ^ 0x438;
-		daemon->rand = ub_initstate(seed, NULL);
-		if(!daemon->rand)
-			fatal_exit("could not init random generator");
-	}
-	shufport = (int*)calloc(65536, sizeof(int));
-	if(!shufport)
-		fatal_exit("out of memory during daemon init");
-	numport = daemon_get_shufport(daemon, shufport);
-	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
-	
 	daemon->num = daemon->cfg->num_threads;
 	daemon->workers = (struct worker**)calloc((size_t)daemon->num, 
 		sizeof(struct worker*));
 	for(i=0; i<daemon->num; i++) {
-		if(!(daemon->workers[i] = worker_create(daemon, i,
-			shufport+numport*i/daemon->num, 
-			numport*(i+1)/daemon->num - numport*i/daemon->num)))
-			/* the above is not ports/numthr, due to rounding */
+		if(!(daemon->workers[i] = worker_create(daemon, i)))
 			fatal_exit("could not create worker");
 	}
-	free(shufport);
 }

 /**
@@ -418,7 +363,6 @@ daemon_delete(struct daemon* daemon)
 		rrset_cache_delete(daemon->env->rrset_cache);
 		infra_delete(daemon->env->infra_cache);
 	}
-	ub_randfree(daemon->rand);
 	alloc_clear(&daemon->superalloc);
 	acl_list_delete(daemon->acl);
 	free(daemon->pidfile);
@@ -53,7 +53,6 @@ struct module_env;
 struct rrset_cache;
 struct acl_list;
 struct local_zones;
-struct ub_randstate;

 /**
 * Structure holding worker list.
@@ -74,8 +73,6 @@ struct daemon {
 	struct worker** workers;
 	/** do we need to exit unbound (or is it only a reload?) */
 	int need_to_exit;
-	/** master random table ; used for port div between threads on reload*/
-	struct ub_randstate* rand;
 	/** master allocation cache */
 	struct alloc_cache superalloc;
 	/** the module environment master value, copied and changed by threads*/
@@ -53,16 +53,7 @@
 #include <signal.h>
 #include <fcntl.h>
 #include <pwd.h>
-
-#ifdef HAVE_SYS_RESOURCE_H
 #include <sys/resource.h>
-#endif
-
-#ifdef USE_MINI_EVENT
-#include "util/mini_event.h"
-#else
-#include <event.h>
-#endif

 /** global debug value to keep track of heap memory allocation */
 void* unbound_start_brk = 0;
@@ -78,8 +69,6 @@ static void usage()
 	printf("-d	do not fork into the background.\n");
 	printf("-v	verbose (more times to increase verbosity)\n");
 	printf("Version %s\n", PACKAGE_VERSION);
-	printf("libevent %s, libldns %s\n", 
-		event_get_version(), ldns_version());
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
 }
@@ -93,22 +82,18 @@ checkrlimits(struct config_file* cfg)
 			(int)cfg->incoming_num_tcp:0));
 	size_t ifs = (size_t)(cfg->num_ifs==0?1:cfg->num_ifs);
 	size_t listen_num = list*ifs;
-	size_t outudpnum = (size_t)cfg->outgoing_num_ports;
-	size_t outtcpnum = cfg->outgoing_num_tcp;
+	size_t out_ifs = (size_t)(cfg->num_out_ifs==0?1:cfg->num_out_ifs);
+	size_t outnum = cfg->outgoing_num_ports*out_ifs + cfg->outgoing_num_tcp;
 	size_t misc = 4; /* logfile, pidfile, stdout... */
-	size_t perthread_noudp = listen_num + outtcpnum + 
-		2/*cmdpipe*/ + 2/*libevent*/ + misc; 
-	size_t perthread = perthread_noudp + outudpnum;
-
+	size_t perthread = listen_num + outnum + 2/*cmdpipe*/ + 2/*libevent*/
+		+ misc; 
 #if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 	int numthread = 1; /* it forks */
 #else
 	int numthread = cfg->num_threads;
 #endif
 	size_t total = numthread * perthread + misc;
-	size_t avail;
 	struct rlimit rlim;
-
 	if(getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
 		log_warn("getrlimit: %s", strerror(errno));
 		return;
@@ -116,23 +101,13 @@ checkrlimits(struct config_file* cfg)
 	if(rlim.rlim_cur == (rlim_t)RLIM_INFINITY)
 		return;
 	if((size_t)rlim.rlim_cur < total) {
-		avail = (size_t)rlim.rlim_cur;
-		rlim.rlim_cur = (rlim_t)(total + 10);
-		rlim.rlim_max = (rlim_t)(total + 10);
-		if(setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
-			log_warn("setrlimit: %s", strerror(errno));
-			log_warn("cannot increase max open fds from %u to %u",
-				(unsigned)avail, (unsigned)total+10);
-			cfg->outgoing_num_ports = (int)((avail 
-				- numthread*perthread_noudp 
-				- 10 /* safety margin */) /numthread);
-			log_warn("continuing with less udp ports: %u",
-				cfg->outgoing_num_ports);
-			log_warn("increase ulimit or decrease threads, ports in config to remove this warning");
-			return;
-		}
-		log_warn("increased limit(open files) from %u to %u",
-			(unsigned)avail, (unsigned)total+10);
+		log_err("Not enough sockets available. Increase "
+			"ulimit(open files).");
+		log_err("or decrease number of threads, outgoing num ports, "
+			"outgoing num tcp or number of interfaces");
+		log_err("estimate %u fds high mark, %u available", 
+			(unsigned)total, (unsigned)rlim.rlim_cur);
+		fatal_exit("Not enough file descriptors available");
 	}
 }

@@ -284,8 +259,7 @@ detach(struct config_file* cfg)

 /** daemonize, drop user priviliges and chroot if needed */
 static void
-do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode,
-	char** cfgfile)
+do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode)
 {
 	uid_t uid;
 	gid_t gid;
@@ -295,6 +269,13 @@ do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	log_assert(cfg);

 	/* daemonize last to be able to print error to user */
+	if(cfg->directory && cfg->directory[0]) {
+		if(chdir(cfg->directory)) {
+			fatal_exit("Could not chdir to %s: %s",
+				cfg->directory, strerror(errno));
+		}
+		verbose(VERB_QUERY, "chdir to %s", cfg->directory);
+	}
 	if(cfg->username && cfg->username[0]) {
 		struct passwd *pwd;
 		if((pwd = getpwnam(cfg->username)) == NULL)
@@ -304,32 +285,10 @@ do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 		endpwent();
 	}
 	if(cfg->chrootdir && cfg->chrootdir[0]) {
-		if(chdir(cfg->chrootdir)) {
-			fatal_exit("unable to chdir to chroot %s: %s",
-				cfg->chrootdir, strerror(errno));
-		}
-		verbose(VERB_QUERY, "chdir to %s", cfg->chrootdir);
 		if(chroot(cfg->chrootdir))
 			fatal_exit("unable to chroot to %s: %s", 
 				cfg->chrootdir, strerror(errno));
 		verbose(VERB_QUERY, "chroot to %s", cfg->chrootdir);
-		if(strncmp(*cfgfile, cfg->chrootdir, 
-			strlen(cfg->chrootdir)) == 0) 
-			(*cfgfile) += strlen(cfg->chrootdir);
-	}
-	if(cfg->directory && cfg->directory[0]) {
-		char* dir = cfg->directory;
-		if(cfg->chrootdir && cfg->chrootdir[0] &&
-			strncmp(dir, cfg->chrootdir, 
-			strlen(cfg->chrootdir)) == 0)
-			dir += strlen(cfg->chrootdir);
-		if(dir[0]) {
-			if(chdir(dir)) {
-				fatal_exit("Could not chdir to %s: %s",
-					dir, strerror(errno));
-			}
-			verbose(VERB_QUERY, "chdir to %s", dir);
-		}
 	}
 	if(cfg->username && cfg->username[0]) {
 		if(setgid(gid) != 0)
@@ -386,19 +345,15 @@ run_daemon(char* cfgfile, int cmdline_verbose, int debug_mode)
 		/* config stuff */
 		if(!(cfg = config_create()))
 			fatal_exit("Could not alloc config defaults");
-		if(!config_read(cfg, cfgfile)) {
-			if(errno != ENOENT)
-				fatal_exit("Could not read config file: %s",
-					cfgfile);
-			log_warn("Continuing with default config settings");
-		}
+		if(!config_read(cfg, cfgfile))
+			fatal_exit("Could not read config file: %s", cfgfile);
 		apply_settings(daemon, cfg, cmdline_verbose);
 	
 		/* prepare */
 		if(!daemon_open_shared_ports(daemon))
 			fatal_exit("could not open ports");
 		if(!done_chroot) { 
-			do_chroot(daemon, cfg, debug_mode, &cfgfile); 
+			do_chroot(daemon, cfg, debug_mode); 
 			done_chroot = 1; 
 		} else log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
 		/* work */
@@ -137,7 +137,7 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 	iter = 0;
 	val = 0;
 	for(i=0; i<worker->env.mesh->mods.num; i++) {
-		fptr_ok(fptr_whitelist_mod_get_mem(worker->env.mesh->
+		log_assert(fptr_whitelist_mod_get_mem(worker->env.mesh->
 			mods.mod[i]->get_mem));
 		if(strcmp(worker->env.mesh->mods.mod[i]->name, "validator")==0)
 			val += (*worker->env.mesh->mods.mod[i]->get_mem)
@@ -169,7 +169,7 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 	if(verbosity < VERB_QUERY)
 		return;
 	for(i=0; i<worker->env.mesh->mods.num; i++) {
-		fptr_ok(fptr_whitelist_mod_get_mem(worker->env.mesh->
+		log_assert(fptr_whitelist_mod_get_mem(worker->env.mesh->
 			mods.mod[i]->get_mem));
 		if(strcmp(worker->env.mesh->mods.mod[i]->name, "validator")==0)
 			val += (*worker->env.mesh->mods.mod[i]->get_mem)
@@ -406,7 +406,7 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	 */
 	uint16_t udpsize = edns->udp_size;
 	int secure = 0;
-	uint32_t timenow = *worker->env.now;
+	uint32_t timenow = (uint32_t)time(0);
 	int must_validate = !(flags&BIT_CD) && worker->env.need_to_validate;
 	struct dns_msg *msg = NULL;
 	struct delegpt *dp;
@@ -505,11 +505,12 @@ all_rrsets_secure(struct reply_info* rep) {

 /** answer query from the cache */
 static int
-answer_from_cache(struct worker* worker, struct query_info* qinfo,
-	struct reply_info* rep, uint16_t id, uint16_t flags, 
-	struct comm_reply* repinfo, struct edns_data* edns)
+answer_from_cache(struct worker* worker, struct lruhash_entry* e, uint16_t id,
+	uint16_t flags, struct comm_reply* repinfo, struct edns_data* edns)
 {
-	uint32_t timenow = *worker->env.now;
+	struct msgreply_entry* mrentry = (struct msgreply_entry*)e->key;
+	struct reply_info* rep = (struct reply_info*)e->data;
+	uint32_t timenow = time(0);
 	uint16_t udpsize = edns->udp_size;
 	int secure;
 	int must_validate = !(flags&BIT_CD) && worker->env.need_to_validate;
@@ -546,7 +547,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 		edns->ext_rcode = 0;
 		edns->bits &= EDNS_DO;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
-			qinfo, id, flags, edns);
+			&mrentry->key, id, flags, edns);
 		rrset_array_unlock_touch(worker->env.rrset_cache, 
 			worker->scratchpad, rep->ref, rep->rrset_count);
 		regional_free_all(worker->scratchpad);
@@ -572,11 +573,11 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
 	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
-	if(!reply_info_answer_encode(qinfo, rep, id, flags, 
+	if(!reply_info_answer_encode(&mrentry->key, rep, id, flags, 
 		repinfo->c->buffer, timenow, 1, worker->scratchpad,
 		udpsize, edns, (int)(edns->bits & EDNS_DO), secure)) {
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
-			qinfo, id, flags, edns);
+			&mrentry->key, id, flags, edns);
 	}
 	/* cannot send the reply right now, because blocking network syscall
 	 * is bad while holding locks. */
@@ -786,8 +787,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	h = query_info_hash(&qinfo);
 	if((e=slabhash_lookup(worker->env.msg_cache, h, &qinfo, 0))) {
 		/* answer from cache - we have acquired a readlock on it */
-		if(answer_from_cache(worker, &qinfo, 
-			(struct reply_info*)e->data, 
+		if(answer_from_cache(worker, e, 
 			*(uint16_t*)ldns_buffer_begin(c->buffer), 
 			ldns_buffer_read_u16_at(c->buffer, 2), repinfo, 
 			&edns)) {
@@ -817,12 +817,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		worker->stats.num_query_list_exceeded++;
 		comm_point_drop_reply(repinfo);
 		return 0;
-	} else if(worker->env.mesh->num_reply_addrs>worker->request_size*16) {
-		verbose(VERB_ALGO, "Too many requests queued. "
-			"dropping incoming query.");
-		worker->stats.num_query_list_exceeded++;
-		comm_point_drop_reply(repinfo);
-		return 0;
 	}
 	mesh_new_client(worker->env.mesh, &qinfo, 
 		ldns_buffer_read_u16_at(c->buffer, 2),
@@ -883,27 +877,19 @@ void worker_stat_timer_cb(void* arg)
 	server_stats_log(&worker->stats, worker->thread_num);
 	mesh_stats(worker->env.mesh, "mesh has");
 	worker_mem_report(worker, NULL);
-	if(!worker->daemon->cfg->stat_cumulative) {
-		server_stats_init(&worker->stats);
-		mesh_stats_clear(worker->env.mesh);
-	}
+	server_stats_init(&worker->stats);
+	mesh_stats_clear(worker->env.mesh);
 	/* start next timer */
 	worker_restart_timer(worker);
 }

 struct worker* 
-worker_create(struct daemon* daemon, int id, int* ports, int n)
+worker_create(struct daemon* daemon, int id)
 {
 	struct worker* worker = (struct worker*)calloc(1, 
 		sizeof(struct worker));
 	if(!worker) 
 		return NULL;
-	worker->numports = n;
-	worker->ports = (int*)memdup(ports, sizeof(int)*n);
-	if(!worker->ports) {
-		free(worker);
-		return NULL;
-	}
 	worker->daemon = daemon;
 	worker->thread_num = id;
 	worker->cmd_send_fd = -1;
@@ -933,6 +919,7 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	struct listen_port* ports, int do_sigs)
 {
 	unsigned int seed;
+	int startport;
 	worker->need_to_exit = 0;
 	worker->base = comm_base_create();
 	if(!worker->base) {
@@ -978,12 +965,13 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker_delete(worker);
 		return 0;
 	}
+	startport  = cfg->outgoing_base_port + 
+		cfg->outgoing_num_ports * worker->thread_num;
 	worker->back = outside_network_create(worker->base,
 		cfg->msg_buffer_size, (size_t)cfg->outgoing_num_ports, 
 		cfg->out_ifs, cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, 
-		cfg->do_tcp?cfg->outgoing_num_tcp:0, 
-		worker->daemon->env->infra_cache, worker->rndstate,
-		cfg->use_caps_bits_for_id, worker->ports, worker->numports);
+		startport, cfg->do_tcp?cfg->outgoing_num_tcp:0, 
+		worker->daemon->env->infra_cache, worker->rndstate);
 	if(!worker->back) {
 		log_err("could not create outgoing sockets");
 		worker_delete(worker);
@@ -1020,9 +1008,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker->thread_num);
 	alloc_set_id_cleanup(&worker->alloc, &worker_alloc_cleanup, worker);
 	worker->env = *worker->daemon->env;
-	comm_base_timept(worker->base, &worker->env.now, &worker->env.now_tv);
-	if(worker->thread_num == 0)
-		log_set_time(worker->env.now);
 	worker->env.worker = worker;
 	worker->env.send_packet = &worker_send_packet;
 	worker->env.send_query = &worker_send_query;
@@ -1072,9 +1057,6 @@ worker_delete(struct worker* worker)
 	comm_signal_delete(worker->comsig);
 	comm_point_delete(worker->cmd_com);
 	comm_timer_delete(worker->stat_timer);
-	free(worker->ports);
-	if(worker->thread_num == 0)
-		log_set_time(NULL);
 	comm_base_delete(worker->base);
 	ub_randfree(worker->rndstate);
 	/* close fds after deleting commpoints, to be sure.
@@ -1097,10 +1079,12 @@ worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
 	struct worker* worker = q->env->worker;
 	if(use_tcp) {
 		return pending_tcp_query(worker->back, pkt, addr, addrlen, 
-			timeout, worker_handle_reply, q) != 0;
+			timeout, worker_handle_reply, q, 
+			worker->rndstate) != 0;
 	}
 	return pending_udp_query(worker->back, pkt, addr, addrlen, 
-		timeout*1000, worker_handle_reply, q) != 0;
+		timeout*1000, worker_handle_reply, q, 
+		worker->rndstate) != 0;
 }

 /** compare outbound entry qstates */
@@ -86,10 +86,6 @@ struct worker {
 	struct listen_dnsport* front;
 	/** the backside outside network interface to the auth servers */
 	struct outside_network* back;
-	/** ports to be used by this worker. */
-	int* ports;
-	/** number of ports for this worker */
-	int numports;
 	/** the signal handler */
 	struct comm_signal* comsig;
 	/** commpoint to listen to commands. */
@@ -120,11 +116,9 @@ struct worker {
 * with backpointers only. Use worker_init on it later.
 * @param daemon: the daemon that this worker thread is part of.
 * @param id: the thread number from 0.. numthreads-1.
- * @param ports: the ports it is allowed to use, array.
- * @param n: the number of ports.
 * @return: the new worker or NULL on alloc failure.
 */
-struct worker* worker_create(struct daemon* daemon, int id, int* ports, int n);
+struct worker* worker_create(struct daemon* daemon, int id);

 /**
 * Initialize worker.
@@ -1,240 +1,7 @@
-24 April 2008: Wouter
-	- chroot checks improved. working directory relative to chroot.
-	  checks if config file path is inside chroot. Documentation on it.
-
-23 April 2008: Wouter
-	- parseunbound.pl contrib update from Kai Storbeck for threads.
-	- iana ports update
-
-22 April 2008: Wouter
-	- ignore SIGPIPE.
-	- unit test for SIGPIPE ignore.
-
-21 April 2008: Wouter
-	- FEATURES document.
-	- fixup reread of config file if it was given as a full path
-	  and chroot was used.
-
-16 April 2008: Wouter
-	- requirements doc, updated clean query returns.
-	- parseunbound.pl update from Kai Storbeck.
-	- sunos4 porting changes.
-
-15 April 2008: Wouter
-	- fixup default rc.d pidfile location to /usr/local/etc.
-	- iana ports updated.
-	- copyright updated in ldns-testpkts to keep same as in ldns.
-	- fixup checkconf chroot tests a bit more, chdir must be inside
-	  chroot dir.
-	- documented 'gcc: unrecognized -KPIC option' errors on Solaris.
-	- example.conf values changed to /usr/local/etc/unbound
-	- DSA test work.
-	- DSA signatures: unbound is compatible with both encodings found.
-	  It will detect and convert when necessary.
-
-14 April 2008: Wouter
-	- got update for parseunbound.pl statistics script from Kai Storbeck.
-	- tpkg tests for udp wait list.
-	- documented 0x20 status.
-	- fixup chroot and checkconf, it is much smarter now.
-	- fixup DSA EVP signature decoding. Solution that Jelte found copied.
-	- and check first sig byte for the encoding type.
-
-11 April 2008: Wouter
-	- random port selection out of the configged ports.
-	- fixup threadsafety for libevent-1.4.3+ (event_base_get_method).
-	- removed base_port.
-	- created 256-port ephemeral space for the OS, 59802 available.
-	- fixup consistency of port_if out array during heavy use.
-
-10 April 2008: Wouter
-	- --with-libevent works with latest libevent 1.4.99-trunk.
-	- added log file statistics perl script to contrib.
-	- automatic iana ports update from makefile. 60058 available.
-
-9 April 2008: Wouter
-	- configure can detect libev(from its build directory) when passed
-	  --with-libevent=/home/wouter/libev-3.2
-	  libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%).
-	- unused commpoints not listed in epoll list.
-	- statistics-cumulative option so that the values are not reset.
-	- config creates array of available ports, 61841 available,
-	  it excludes <1024 and iana assigned numbers.
-	  config statements to modify the available port numbers.
-
-8 April 2008: Wouter
-	- unbound tries to set the ulimit fds when started as server.
-	  if that does not work, it will scale back its requirements.
-
-27 March 2008: Wouter
-	- documented /dev/random symlink from chrootdir as FAQ entry.
-
-26 March 2008: Wouter
-	- implemented AD bit signaling. If a query sets AD bit (but not DO)
-	  then the AD bit is set in the reply if the answer validated.
-	  Without including DNSSEC signatures. Useful if you have a trusted
-	  path from the client to the resolver. Follows dnssec-updates draft.
-
-25 March 2008: Wouter
-	- implemented check that for NXDOMAIN and NOERROR answers a query
-	  section must be present in the reply (by the scrubber). And it must
-	  be equal to the question sent, at least lowercase folded.
-	  Previously this feature happened because the cache code refused
-	  to store such messages. However blocking by the scrubber makes 
-	  sure nothing gets into the RRset cache. Also, this looks like a
-	  timeout (instead of an allocation failure) and this retries are
-	  done (which is useful in a spoofing situation).
-	- RTT banding. Band size 400 msec, this makes band around zero (fast)
-	  include unknown servers. This makes unbound explore unknown servers.
-
-7 March 2008: Wouter
-	- -C config feature for harvest program. 
-	- harvest handles CNAMEs too.
-
-5 March 2008: Wouter
-	- patch from Hugo Koji Kobayashi for iterator logs spelling.
-
-4 March 2008: Wouter
-	- From report by Jinmei Tatuya, rfc2181 trust value for remainder
-	  of a cname trust chain is lower; not full answer_AA. 
-	- test for this fix.
-	- default config file location is /usr/local/etc/unbound.
-	  Thus prefix is used to determine the location. This is also the
-	  chroot and pidfile default location.
-
-3 March 2008: Wouter
-	- Create 0.10 svn tag.
-	- 0.11 version in trunk.
-	- indentation nicer.
-
-29 February 2008: Wouter
-	- documentation update.
-	- fixup port to Solaris of perf test tool.
-	- updated ldns-tarball with decl-after-statement fixes.
-
-28 February 2008: Wouter
-	- fixed memory leaks in libunbound (during cancellation and wait).
-	- libunbound returns the answer packet in full.
-	- snprintf compat update.
-	- harvest performs lookup.
-	- ldns-tarball update with fix for ldns_dname_label.
-	- installs to sbin by default.
-	- install all manual pages (unbound-host and libunbound too).
-
-27 February 2008: Wouter
-	- option to use caps for id randomness.
-	- config file option use-caps-for-id: yes
-	- harvest debug tool
-
-26 February 2008: Wouter
-	- delay utility delays TCP as well. If the server that is forwarded 
-	  to has a TCP error, the delay utility closes the connection.
-	- delay does REUSE_ADDR, and can handle a server that closes its end.
-	- answers use casing from query.
-
-25 February 2008: Wouter
-	- delay utility works. Gets decent thoughput too (>20000).
-
-22 February 2008: Wouter
-	- +2% for recursions, if identical queries (except for destination
-	  and query ID) in the reply list, avoid re-encoding the answer.
-	- removed TODO items for optimizations that do not show up in
-	  profile reports.
-	- default is now minievent - not libevent. As its faster and
-	  not needed for regular installs, only for very large port ranges.
-	- loop check different speedup pkt-dname-reading, 1% faster for
-	  nocache-recursion check.
-	- less hashing during msg parse, 4% for recursion.
-	- small speed fix for dname_count_size_labels, +1 or +2% recursion.
-	- some speed results noted:
-	  optimization resulted in +40% for recursion (cache miss) and
-	  +70 to +80 for cache hits, and +96% for version.bind.
-	  zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4
-	  www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3
-	  www with DO bit set : BIND 8269.31 Ub 28735.6 qps.
-	  So, unbound can be about equal qps to NSD in cache hits.
-	  And about 3.4x faster than BIND in cache performance.
-	- delay utility for testing.
-
-21 February 2008: Wouter
-	- speedup of root-delegation message encoding by 15%.
-	- minor speedup of compress tree_lookup, maybe 1%.
-	- speedup of dname_lab_cmp and memlowercmp - the top functions in 
-	  profiler output, maybe a couple percent when it matters.
-
-20 February 2008: Wouter
-	- setup speec_cache for need-ldns-testns in dotests.
-	- check number of queued replies on incoming queries to avoid overload
-	  on that account.
-	- fptr whitelist checks are not disabled in optimize mode.
-	- do-daemonize config file option.
-	- minievent time share initializes time at start.
-	- updated testdata for nsec3 new algorithm numbers (6, 7).
-	- small performance test of packet encoding (root delegation).
-
-19 February 2008: Wouter
-	- applied patch to unbound-host man page from Jan-Piet Mens.
-	- fix donotquery-localhost: yes default (it erroneously was switched
-	  to default 'no').
-	- time is only gotten once and the value is shared across unbound.
-	- unittest cleans up crypto, so that it has no memory leaks.
-	- mini_event shares the time value with unbound this results in 
-	  +3% speed for cache responses and +9% for recursions.
-	- ldns tarball update with new NSEC3 sign code numbers.
-	- perform several reads per UDP operation. This improves performance
-	  in DoS conditions, and costs very little in normal conditions.
-	  improves cache response +50%, and recursions +10%.
-	- modified asynclook test. because the callback from async is not
-	  in any sort of lock (and thus can use all library functions freely),
-	  this causes a tiny race condition window when the last lock is 
-	  released for a callback and a new cancel() for that callback.
-	  The only way to remove this is by putting callbacks into some 
-	  lock window. I'd rather have the small possibility of a callback
-	  for a cancelled function then no use of library functions in 
-	  callbacks. Could be possible to only outlaw process(), wait(),
-	  cancel() from callbacks, by adding another lock, but I'd rather not.
-
-18 February 2008: Wouter
-	- patch to unbound-host from Jan-Piet Mens.
-	- unbound host prints errors if fails to configure context.
-	- fixup perf to resend faster, so that long waiting requests do
-	  not hold up the queue, they become lost packets or SERVFAILs,
-	  or can be sent a little while later (i.e. processing time may 
-	  take long, but throughput has to be high).
-	- fixup iterator operating in no cache conditions (RD flag unset
-	  after a CNAME).
-	- streamlined code for RD flag setting.
-	- profiled code and changed dname compares to be faster. 
-	  The speedup is about +3% to +8% (depending on the test).
-	- minievent tests for eintr and eagain.
-
-15 February 2008: Wouter
-	- added FreeBSD rc.d script to contrib.
-	- --prefix option for configure also changes directory: pidfile:
-	  and chroot: defaults in config file.
-	- added cache speed test, for cache size OK and cache too small.
-
-14 February 2008: Wouter
-	- start without a config file (will complain, but start with
-	  defaults).
-	- perf test program works.
-
-13 February 2008: Wouter
-	- 0.9 released.
-	- 1.0 development. Printout ldns version on unbound -h.
-	- start of perf tool.
-	- bugfix to read empty lines from /etc/hosts.
-
-12 February 2008: Wouter
-	- fixup problem with configure calling itself if ldns-src tarball
-	  is not present.
-
 11 February 2008: Wouter
-	- changed library to use ub_ instead of ub_val_ as prefix.
-	- statistics output text nice.
-	- etc/hosts handling.
-	- library function to put logging to a stream.
-	- set any option interface.
+	- nicer statistic output (from trunk).
+	- ub_val to ub_ for library API (from trunk).
+	- (from trunk) set_option, set_debugout, etc/hosts handling.

 8 February 2008: Wouter
 	- test program for multiple queries over a TCP channel.
@@ -243,9 +10,6 @@
 	- fixup misclassification of root referral with NS in answer
 	  when validating a nonrec query.
 	- tag 0.9
-	- layout of manpages, spelling fix in header, manpages process by
-	  makedist, list asynclook and tcpstream tests as ldns-testns
-	  required.

 7 February 2008: Wouter
 	- moved up all current level 2 to be level 3. And 3 to 4.
@@ -1,91 +0,0 @@
-Unbound Features
-
-(C) Copyright 2008, Wouter Wijngaards, NLnet Labs.
-
-
-This document describes the features and RFCs that unbound 
-adheres to, and which ones are decided to be out of scope.
-
-
-Big Features
------------
-Recursive service.
-Caching service.
-Forwarding and stub zones.
-No authoritative service.
-DNSSEC Validation options.
-EDNS0, NSEC3, Unknown-RR-types.
-
-
-Details
-------
-Processing support
-RFC 1034-1035: as a recursive, caching server. Not authoritative.
-  including CNAMEs, referrals, wildcards, classes, ...
-RFC 4033-4035: as a validating caching server (unbound daemon). 
-  as a validating stub (libunbound).
-RFC 1918.
-RFC 2181: completely, including the trust model, keeping rrsets together.
-RFC 2672: DNAME support.
-RFC 3597: Unknown RR type support.
-RFC 2671: EDNS0 support, default advertisement 4Kb size. 
-RFC 5155: NSEC3, NSEC3PARAM types
-AAAA type. and IP6 dual stack support.
-type ANY queries are supported.
-RFC 2308: TTL directive, and the rest of the RFC too.
-RFC 4592: wildcards.
-
-RFC 1995, 1996, 2136: not authoritative, so no AXFR, IXFR, NOTIFY or
-  dynamic update services are appropriate.
-
-chroot and drop-root-privileges support, default enabled in config file.
-
-AD bit in query can be used to request AD bit in response (w/o using DO bit).
-CD bit in query can be used to request bogus data.
-UDP and TCP service is provided downstream.
-UDP and TCP are used to request from upstream servers.
-Multiple queries can be made over a TCP stream.
-
-No TSIG support at this time.
-No SIG0 support at this time.
-No dTLS support at this time.
-This is not a DNS statistics package, but some operationally useful
-values are provided.
-TXT RRs from the Chaos class (id.server, hostname.bind, ...) supported.
-
-draft-forgery-resilience: all recommendations followed.
-draft-0x20: experimental implementation (incomplete).
-  implements bitwise echo of the query to support downstream 0x20.
-draft-ietf-dnsop-default-local-zones is fully supported (-04).
-  It is possible to block zones or return an address for localhost.
-  This is a very limited authoritative service. Defaults as in draft.
-draft-ietf-dnsop-resolver-priming(-00): can prime and can fallback to 
-  a safety belt list.
-draft-ietf-dnsop-dnssec-trust-anchor(-01): DS records can be configured 
-  as trust anchors. Also DNSKEYs are allowed, by the way.
-draft-ietf-dnsop-reflectors-are-evil: access control list for recursive
-  service. In fact for all DNS service so cache snooping is halted.
-
-Record type syntax support, extensive, from lib ldns.
-For these types only syntax and parsing support is needed.
-RFC 1034-1035: basic RR types.
-RFC 1183: RP, AFSDB, X25, ISDN, RT
-RFC 1706: NSAP
-RFC 2535: KEY, SIG, NXT: treated as unknown data, syntax is parsed (obsolete).
-2163: PX
-AAAA type
-1876: LOC type
-2782: SRV type
-2915: NAPTR type.
-2230: KX type.
-2538: CERT type.
-2672: DNAME type.
-OPT type
-3123: APL
-SSHFP type
-4025: IPSECKEY
-4033-4035: DS, RRSIG, NSEC, DNSKEY
-4701: DHCID
-5155: NSEC3, NSEC3PARAM
-4408: SPF
-
@@ -4,16 +4,18 @@ http://unbound.net

 This software is under BSD license, see LICENSE for details.

-* Download the latest release version of this software from 
+* Download the latest version of this software from 
  	http://unbound.net 
  or get a beta version from the svn repository at 
  	http://unbound.net/svn/

 * Uses the following libraries; 
  * ldns	http://www.nlnetlabs.nl/ldns/			(BSD license)
-    (required) can use tarball from source directory.
  * libevent	http://www.monkey.org/~provos/libevent/		(BSD license)
-    (optional) can use builtin alternative instead.
+
+* Create build environment 
+  * run libtoolize -c if config.sub is missing, or run glibtoolize.
+  * autoreconf (autoheader && autoconf), if ./configure is missing.

 * Make and install: ./configure; make; make install
  * Use GNU make; default on linux, often called 'gmake' on BSD and Solaris.
@@ -23,11 +25,10 @@ This software is under BSD license, see LICENSE for details.
 	If detected on the system, it will dynamically link against it.
  * --with-libevent=/path/to/libevent
  	Can be set to either the system install or the build directory.
-	--with-libevent=no (default) gives a builtin alternative 
-	implementation. libevent is useful when having many (thousands) 
-	of outgoing ports. This improves randomization and spoof 
-	resistance. For the default of 16 ports the builtin alternative 
-	works well and is a little faster.
+	--with-libevent=no gives a builtin alternative implementation.
+	libevent is useful when having many (thousands) of outgoing ports.
+	This improves randomization and spoof resistance. For the default 
+	of 16 ports the builtin alternative works well.
  * --without-pthreads 
 	This disables pthreads. Without this option the pthreads library 
 	is detected automatically. Use this option to disable threading
@@ -67,15 +68,9 @@ o If you are not receiving the correct source IP address on replies (e.g.
  source IP address on UDP replies. Listing all IP addresses explicitly in
  the config file is an alternative. The interface-automatic option uses
  non portable socket options, Linux and FreeBSD should work fine.
-o The warning 'openssl has no entropy, seeding with time', with chroot 
-  enabled, may be solved with a symbolic link to /dev/random from <chrootdir>.
-o On Solaris 5.10 some libtool packages from repositories do not work with
-  gcc, showing errors gcc: unrecognized option `-KPIC'
-  To solve this do ./configure libtool=./libtool [your options...].

 Acknowledgements
 ----------------
-o Unbound was written in portable C by Wouter Wijngaards (NLnet Labs).
 o Thanks to David Blacka and Matt Larson (Verisign) for the unbound-java
  prototype. Design and code from that prototype has been used to create
  this program. Such as the iterator state machine and the cache design.
@@ -1,13 +1,11 @@
 README.svn

 For a svn checkout
-* configure script, aclocal.m4, as well as yacc/lex output files are
-  committed to the repository.
-* use --enable-debug flag for configure to enable dependency tracking and
-  assertions, otherwise, use make clean; make after svn update.
+* Create build environment - see README.
+  * possibly copy aclocal.m4 from your autoconf/libtool setup.

 * Note changes in the Changelog.
-* Every check-in a postcommit hook is run
+* Every checking a postcommit hook is run
 	(the postcommit hook is in the svn/unbound/hooks directory).
 	* generates commit email with your changes and comment.
 	* compiles and runs the tests (with testcode/do-tests.sh).
@@ -3,18 +3,7 @@ README unbound tests
 There is a test setup for unbound. Use
 	make test
 To make and run the tests. The results are summarized at the end.
-
-You need to have the following programs installed and in your PATH.
-* dig - from the bind-tools package. Used to send DNS queries.
-* splint (optional) - for lint test
-* doxygen (optional) - for doc completeness test
-* ldns-testns (optional) - from ldns examples. Used as DNS auth server.
-* xxd and nc (optional) - for (malformed) packet transmission.
-The optional programs are detected and can be omitted.
-
-Without any support programs, unittest and testbound can still be used.
-	(cd testdata; ../testcode/mini_tpkg.sh exe 02-unittest.tpkg)
-	(cd testdata; ../testcode/mini_tpkg.sh exe 03-testbound.tpkg)
+You can also run ./unittest by hand, if the system lacks other debug tools.

 testdata/ contains the data for tests. 
 testcode/ contains scripts and c code for the tests.
@@ -1,51 +1,57 @@
 TODO items.
+o #define BIT_... different on bigendian and smallendian systems so that
+  the htons on flags is not needed to send a message from the cache.
+o speed up pkt domain name decompression loop detection using counter perhaps.
+o detect OS/400 pthreads implementation that allows upgrading to writelock
+  on pthreads rwlocks and use it to examine-rd before storing-wr rrset cache.
 o understand synthesized DNAMEs, so those TTL=0 packets are cached properly.
-o NSEC/NSEC3 aggressive negative caching, so that updates to NSEC/NSEC3 
-  will result in proper negative responses.
+o understand NSEC/NSEC3, aggressive negative caching, so that updates to
+  NSEC/NSEC3 will result in proper negative responses.
+o scrubber has slow pkt_subdomain and pkt_strict_subdomain functions.
 o get serverselection algorithm out of local optimum.
  make subtargets to get rtt info for a couple of targets, like fetch-policy.
  or send out multiple queries to multiple servers.
-o (option) where port 53 is used for send and receive, no other ports are used.
+o configuration option where port 53 is used for send and receive, no other
+  ports are used.
 o (option) to not send replies to clients after a timeout of (say 5 secs) has
  passed, but keep task active for later retries by client.
-o (option) private TTL feature (always report TTL x in answers).
-o (option) pretend-dnssec-unaware, and pretend-edns-unaware modes for workshops.
+o private TTL feature
+o pretend-dnssec-unaware, and pretend-edns-unaware modes for debug/workshops.
 o delegpt use rbtree for ns-list, to avoid slowdown for very large NS sets.
-o (option) reprime and refresh oft used data before timeout.
-o (option) retain prime results in a overlaid roothints file.
-o (option) store primed key data in a overlaid keyhints file (sort of like drafttimers).
+o reprime and refresh oft used data before timeout.
+o retain prime results in a overlaid roothints file.
+o store primed key data in a overlaid keyhints file (sort of like drafttimers).
 o windows version, auto update feature, a query to check for the version.
+o autoreport of problems
 o command the server with TSIG inband. get-config, clearcache, 
 	get stats, get memstats, get ..., reload, clear one zone from cache
 o watch for spoof nearmisses. Keep counter of nearmisses and print that
  in the stats lines, operator can determine what level is a redalert.
+o improve compression of DNS packets by first puttig uncompressible rrs, then
+  compress to their rdata.
 o NSID rfc 5001 support.
 o timers rfc 5011 support.
 o Treat YXDOMAIN from a DNAME properly, in iterator (not throwaway), validator.
+o grab ports nonconsequtive and change the set after a while (change within
+  a given range). Could be bad for OS if wrong port. unsure if it helps secure.
 o make timeout backoffs randomized (a couple percent random) to spread traffic.
 o inspect date on executable, then warn user in log if its more than 1 year.
-o (option) proactively prime root, stubs and trust anchors, feature.
+o proactively prime root, stubs and trust anchors, feature.
  early failure, faster on first query, but more traffic.
+o use privilege separation, to change privilege options during reload securely
+  not needed.
 o On Windows use CryptGenRandom() to get random seed for arc4random.
+o Think about intermediate firewalls dropping EDNS UDP & handling that.
+  detect nonEDNS middlebox by timeout on edns queries, and fallback to
+  nonEDNS when appropriate.
 o library add convenience functions for A, AAAA, PTR, getaddrinfo, libresolve.
+o library add function to get signature data (or whole reply message).
 o library add function to validate input from app that is signed.
 o add dynamic-update requests (making a dynupd request) to libunbound api.
 o in an ipv6 connected only environment unbound cannot use outgoing IP6 
  to send to ip4to6 mapped hosts, need ip4to6map of NS and disable 
  V6ONLY socket option.
+o support multiple dns messages in a TCP query stream for the unbound server.
 o SIG(0) and TSIG.
 o support OPT record placement on recv anywhere in the additional section. 
 o add local-file: config with authority features.
-o (option) to make local-data answers be secure for libunbound (default=no)
-o (option) to make chroot: copy all needed files into jail (or make jail)
-	perhaps also print reminder to link /dev/random and sysloghack.
-o (option) for extended statistics. If enabled (not by default) collect print
-	rcode, uptime, spoofnearmisses, cache size, qtype, 
-	bits(RD, CD, DO, EDNS-present, AD)query, (Secure, Bogus)reply.
-	perhaps also see which slow auth servers cause >1sec values.
-	stats-file possible with key: value or key=value lines in it.
-	stats on SIGUSR1. addup stats over threads.
-o overhaul outside-network servicedquery to merge with udpwait and tcpwait,
-  to make timers in servicedquery independent of udpwait queues.
-o 0x20 fallback so it can be enabled without trouble.
-o check into rebinding ports for efficiency, configure time test.
@@ -18,9 +18,6 @@ server:
 	# print statistics to the log (for every thread) every N seconds.
 	# Set to "" or 0 to disable. Default is disabled.
 	# statistics-interval: 0
-	
-	# enable cumulative statistics, without clearing them after printing.
-	# statistics-cumulative: no

 	# number of threads to create. 1 disables threading.
 	# num-threads: 1
@@ -48,20 +45,16 @@ server:
 	# outgoing-interface: 2001:DB8::5
 	# outgoing-interface: 2001:DB8::6

-	# number of ports to allocate per thread, determines the size of the
-	# port range that can be open simultaneously. 
-	# outgoing-range: 256
-	
-	# permit unbound to use this port number or port range for
-	# making outgoing queries, using an outgoing interface.
-	# outgoing-port-permit: 32768
+	# unbound needs to send packets to authoritative nameservers.
+	# it uses a range of ports for that.
+	# the start number of the port range
+	# outgoing-port: 1053

-	# deny unbound the use this of port number or port range for
-	# making outgoing queries, using an outgoing interface.
-	# Use this to make sure unbound does not grab a UDP port that some
-	# other server on this computer needs. The default is to avoid
-	# IANA-assigned port numbers.
-	# outgoing-port-avoid: "3200-3208"
+	# number of port to allocate per thread, determines the size of the
+	# port range. A larger port range gives more resistance to certain
+	# spoof attacks, as it gets harder to guess which port is used. 
+	# But also takes more system resources (for open sockets).
+	# outgoing-range: 16

 	# number of outgoing simultaneous tcp buffers to hold per thread.
 	# outgoing-num-tcp: 10
@@ -128,9 +121,6 @@ server:
 	# Enable TCP, "yes" or "no".
 	# do-tcp: yes

-	# Detach from the terminal, run in background, "yes" or "no".
-	# do-daemonize: yes
-
 	# control which clients are allowed to make (recursive) queries
 	# to this server. Specify classless netblocks with /size and action.
 	# By default everything is refused, except for localhost.
@@ -144,32 +134,16 @@ server:
 	# if given, a chroot(2) is done to the given directory.
 	# i.e. you can chroot to the working directory, for example,
 	# for extra security, but make sure all files are in that directory.
-	#
-	# If chroot is enabled, you should pass the configfile (from the
-	# commandline) as a full path from the original root. After the
-	# chroot has been performed the now defunct portion of the config 
-	# file path is removed to be able to reread the config after a reload. 
-	#
-	# All other file paths (working dir, pidfile, logfile, roothints,
-	# key files) can be specified in several ways:
-	# 	o as an absolute path relative to the new root.
-	# 	o as a relative path to the working directory.
-	# 	o as an absolute path relative to the original root.
-	# In the last case the path is adjusted to remove the unused portion.
-	#
-	# Additionally, unbound may need to access /dev/random (for entropy)
-	# and to /dev/log (if you use syslog) from inside the chroot.
-	#
-	# If you give "" no chroot is performed. The path must not end in a /.
-	# chroot: "/usr/local/etc/unbound"
+	# If you give "" no chroot is performed.
+	# chroot: "/etc/unbound"

 	# if given, user privileges are dropped (after binding port),
 	# and the given username is assumed. Default is user "unbound".
 	# If you give "" no privileges are dropped.
 	# username: "unbound"

-	# the working directory. "" disables.
-	# directory: "/usr/local/etc/unbound"
+	# the working directory.
+	# directory: "/etc/unbound"

 	# the log file, "" means log to stderr. 
 	# Use of this option sets use-syslog to "no".
@@ -180,7 +154,7 @@ server:
 	# use-syslog: yes 

 	# the pid file.
-	# pidfile: "/usr/local/etc/unbound/unbound.pid"
+	# pidfile: "/etc/unbound/unbound.pid"
 	
 	# file to read root hints from.
 	# get one from ftp://FTP.INTERNIC.NET/domain/named.cache
@@ -223,14 +197,6 @@ server:
 	# Default on, which insists on dnssec data for trust-anchored zones.
 	# harden-dnssec-stripped: yes
 	
-	# Use 0x20-encoded random bits in the query to foil spoof attempts.
-	# Disabled by default, because some caching forwarders may not
-	# support this (if you have forward-zones). Most authority servers do.
-	# This feature is an experimental implementation of draft dns-0x20.
-	# It is known that some authority servers do not support 0x20, and
-	# resolution will fail for them. A solution is on the TODO list.
-	# use-caps-for-id: no
-	
 	# Do not query the following addresses. No DNS queries are sent there.
 	# List one address per entry. List classless netblocks with /size,
 	# do-not-query-address: 127.0.0.1/8
@@ -303,8 +303,6 @@ The result of the DNS resolution and validation is returned as
 		int* len;    /* array with lengths of rdata items */
 		char* canonname; /* canonical name of result */
 		int rcode;   /* additional error code in case of no data */
-		void* answer_packet; /* full network format answer packet */
-		int answer_len; /* length of packet in octets */
 		int havedata; /* true if there is data */
 		int nxdomain; /* true if nodata because name does not exist */
 		int secure;  /* true if result is secure */
@@ -203,6 +203,6 @@ o If a client makes a query without RD bit, in the case of a returned
 o Case preservation
  Unbound preserves the casing received from authority servers as best 
  as possible. It compresses without case, so case can get lost there.
-  The casing from the query name is used in preference to the casing
-  of the authority server. This is the same as BIND. RFC4343 allows either 
+  The casing from the authority server is used in preference to the casing
+  of the query name. This is different from BIND. RFC4343 allows either 
  behaviour.
@@ -26,8 +26,6 @@
 .IR keyfile ]
 .RB [ \-F
 .IR namedkeyfile ]
-.RB [ \-C
-.IR configfile ]
 .SH "DESCRIPTION"
 .LP
 .B Unbound\-host
@@ -77,14 +75,9 @@ as for \-y. The zone file format, the same as dig and drill produce.
 .B \-F \fInamedkeyfile
 Reads keys from a BIND\-style named.conf file. Only the trusted\-key {}; entries
 are read.
-.TP
-.B \-C \fIconfigfile
-Uses the specified unbound.conf to prime
-.IR libunbound (3).
 .SH "EXAMPLES"
 .LP
-Some examples of use. The keys shown below are fakes, thus a security failure
-is encountered.
+Some examples of use.
 .P
 $ unbound\-host www.example.com
 .P
@@ -88,10 +88,6 @@ see
 The number of seconds between printing statistics to the log for every thread.
 Disable with value 0 or "". Default is disabled. 
 .TP
-.B statistics-cumulative: \fI<yes or no>
-If enabled, statistics are cumulative since starting unbound, without clearing
-the statistics counters after logging the statistics. Default is no.
-.TP
 .B num\-threads: \fI<number>
 The number of threads to create to serve clients. Use 1 for no threading.
 .TP
@@ -122,24 +118,15 @@ and
 lines, the interfaces are then used for both purposes. Outgoing queries are 
 sent via a random outgoing interface to counter spoofing.
 .TP
+.B outgoing\-port: \fI<port number>
+The starting port number where the outgoing query port range is allocated.
+Default is 1053.
+.TP
 .B outgoing\-range: \fI<number>
-Number of ports to open. This number of file descriptors can be opened per 
-thread. Must be at least 1. Default is 256. Larger numbers need extra 
-resources from the operating system.
-.TP
-.B outgoing\-port\-permit: \fI<port number or range>
-Permit unbound to open this port or range of ports for use to send queries.
-A larger number of permitted outgoing ports increases resilience against
-spoofing attempts. Make sure these ports are not needed by other daemons. 
-By default only ports above 1024 that have not been assigned by IANA are used.
-Give a port number or a range of the form "low-high", without spaces.
-.TP
-.B outgoing\-port\-avoid: \fI<port number or range>
-Do not permit unbound to open this port or range of ports for use to send 
-queries. Use this to make sure unbound does not grab a port that another
-daemon needs. The port is avoided on all outgoing interfaces, both IP4 and IP6.
-By default only ports above 1024 that have not been assigned by IANA are used.
-Give a port number or a range of the form "low-high", without spaces.
+Number of ports to open. This number is opened per thread for every outgoing
+query interface. Must be at least 1. Default is 16.
+Larger numbers give more protection against spoofing attempts, but need
+extra resources from the operating system.
 .TP
 .B outgoing\-num\-tcp: \fI<number>
 Number of outgoing TCP buffers to allocate per thread. Default is 10. If set
@@ -222,10 +209,6 @@ Enable or disable whether UDP queries are answered or issued. Default is yes.
 .B do\-tcp: \fI<yes or no>
 Enable or disable whether TCP queries are answered or issued. Default is yes.
 .TP
-.B do\-daemonize: \fI<yes or no>
-Enable or disable whether the unbound server forks into the background as
-a daemon. Default is yes.
-.TP
 .B access\-control: \fI<IP netblock> <action>
 The netblock is given as an IP4 or IP6 address with /size appended for a 
 classless network block. The action can be deny, refuse or allow.
@@ -238,23 +221,8 @@ is not designed to handle dropped packets due to policy, and dropping may
 result in (possibly excessive) retried queries.
 .TP
 .B chroot: \fI<directory>
-If chroot is enabled, you should pass the configfile (from the
-commandline) as a full path from the original root. After the
-chroot has been performed the now defunct portion of the config 
-file path is removed to be able to reread the config after a reload. 
-.IP
-All other file paths (working dir, pidfile, logfile, roothints,
-key files) can be specified in several ways:
-as an absolute path relative to the new root,
-as a relative path to the working directory, or
-as an absolute path relative to the original root.
-In the last case the path is adjusted to remove the unused portion.
-.IP
-Additionally, unbound may need to access /dev/random (for entropy)
-and to /dev/log (if you use syslog) from inside the chroot.
-.IP
 If given a chroot is done to the given directory. The default is 
-"/usr/local/etc/unbound". If you give "" no chroot is performed.
+"/etc/unbound". If you give "" no chroot is performed.
 .TP
 .B username: \fI<name>
 If given, after binding the port the user privileges are dropped. Default is
@@ -286,14 +254,14 @@ The logfile setting is overridden when use\-syslog is turned on.
 The default is to log to syslog.
 .TP
 .B pidfile: \fI<filename>
-The process id is written to the file. Default is "/usr/local/etc/unbound/unbound.pid". 
+The process id is written to the file. Default is "/etc/unbound/unbound.pid". 
 So,
 .nf
-kill \-HUP `cat /usr/local/etc/unbound/unbound.pid` 
+kill \-HUP `cat /etc/unbound/unbound.pid` 
 .fi
 triggers a reload,
 .nf
-kill \-QUIT `cat /usr/local/etc/unbound/unbound.pid` 
+kill \-QUIT `cat /etc/unbound/unbound.pid` 
 .fi
 gracefully terminates.
 .TP
@@ -356,15 +324,6 @@ removes DNSSEC data from packets, or a zone changes from signed to
 unsigned to badly signed often. If turned off you run the risk of a 
 downgrade attack that disables security for a zone. Default is on.
 .TP
-.B use\-caps\-for\-id: \fI<yes or no>
-Use 0x20-encoded random bits in the query to foil spoof attempts.
-This perturbs the lowercase and uppercase of query names sent to 
-authority servers and checks if the reply still has the correct casing. 
-Disabled by default, because some caching forwarders may not
-support this. It is known that some authority servers do not support 0x20, 
-and resolution will fail for them. A solution is on the TODO list.
-This feature is an experimental implementation of draft dns\-0x20.
-.TP
 .B do\-not\-query\-address: \fI<IP address>
 Do not query the given IP address. Can be IP4 or IP6. Append /num to 
 indicate a classless delegation netblock, for example like
@@ -635,9 +594,8 @@ In the example config settings below memory usage is reduced. Some service
 levels are lower, notable very large data and a high TCP load are no longer
 supported. Very large data and high TCP loads are exceptional for the DNS.
 DNSSEC validation is enabled, just add trust anchors.
-If you do not have to worry about programs using more than 3 Mb of memory,
-the below example is not for you. Use the defaults to receive full service,
-which on BSD-32bit tops out at 30-40 Mb after heavy usage. 
+If you do not have to worry about programs using more than 1 meg of memory,
+the below example is not for you. Use the defaults to receive full service.
 .P
 .nf
 # example settings that reduce memory usage
@@ -645,25 +603,25 @@ server:
 	num\-threads: 1
 	outgoing\-num\-tcp: 1	# this limits TCP service, uses less buffers.
 	incoming\-num\-tcp: 1
-	outgoing\-range: 16	# uses less memory, but less performance.
+	outgoing\-range: 1	# uses less memory, but less port randomness.
 	msg\-buffer\-size: 8192   # note this limits service, 'no huge stuff'.
-	msg\-cache\-size: 100k
+	msg\-cache\-size: 102400  # 100 Kb.
 	msg\-cache\-slabs: 1
-	rrset\-cache\-size: 100k
+	rrset\-cache\-size: 102400  # 100 Kb.
 	rrset\-cache\-slabs: 1
 	infra\-cache\-numhosts: 200
-	infra\-cache\-slabs: 1
-	infra\-cache\-lame\-size: 1k
-	key\-cache\-size: 100k
+	infra\-cache\-numlame: 10
+	key\-cache\-size: 102400  # 100 Kb.
 	key\-cache\-slabs: 1
 	num\-queries\-per\-thread: 30
 	target\-fetch\-policy: "2 1 0 0 0 0"
 	harden\-large\-queries: "yes"
 	harden\-short\-bufsize: "yes"
+	do\-ip6: no	# save a bit of memory if not used.
 .fi
 .SH "FILES"
 .TP
-.I /usr/local/etc/unbound
+.I /etc/unbound
 default unbound working directory and default 
 \fIchroot\fR(2)
 location.
@@ -106,8 +106,6 @@ struct delegpt_addr {
 	socklen_t addrlen;
 	/** number of attempts for this addr */
 	int attempts;
-	/** rtt stored here in the selection algorithm */
-	int sel_rtt;
 };

 /**
@@ -115,7 +115,6 @@ donotq_str_cfg(struct iter_donotq* dq, const char* str)
 	struct sockaddr_storage addr;
 	int net;
 	socklen_t addrlen;
-	verbose(VERB_ALGO, "donotq: %s", str);
 	if(!netblockstrtoaddr(str, UNBOUND_DNS_PORT, &addr, &addrlen, &net)) {
 		log_err("cannot parse donotquery netblock: %s", str);
 		return 0;
@@ -180,10 +179,8 @@ donotq_apply_cfg(struct iter_donotq* dq, struct config_file* cfg)
 	if(cfg->donotquery_localhost) {
 		if(!donotq_str_cfg(dq, "127.0.0.0/8"))
 			return 0;
-		if(cfg->do_ip6) {
-			if(!donotq_str_cfg(dq, "::1"))
-				return 0;
-		}
+		if(!donotq_str_cfg(dq, "::1"))
+			return 0;
 	}
 	donotq_init_parents(dq);
 	return 1;
@@ -467,7 +467,7 @@ store_rrset(ldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
 	struct ub_packed_rrset_key* k;
 	struct packed_rrset_data* d;
 	struct rrset_ref ref;
-	uint32_t now = *env->now;
+	uint32_t now = time(NULL);

 	k = alloc_special_obtain(env->alloc);
 	if(!k)
@@ -564,14 +564,6 @@ scrub_message(ldns_buffer* pkt, struct msg_parse* msg,
 	if( !(msg->flags&BIT_QR) )
 		return 0;
 	
-	/* make sure that a query is echoed back when NOERROR or NXDOMAIN */
-	/* this is not required for basic operation but is a forgery 
-	 * resistance (security) feature */
-	if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
-		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
-		msg->qdcount == 0)
-		return 0;
-
 	/* if a query is echoed back, make sure it is correct. Otherwise,
 	 * this may be not a reply to our query. */
 	if(msg->qdcount == 1) {
@@ -130,7 +130,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 /** filter out unsuitable targets, return rtt or -1 */
 static int
 iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
-	uint8_t* name, size_t namelen, uint32_t now, struct delegpt_addr* a)
+	uint8_t* name, size_t namelen, time_t now, struct delegpt_addr* a)
 {
 	int rtt;
 	int lame;
@@ -156,61 +156,38 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	return UNKNOWN_SERVER_NICENESS;
 }

-/** lookup RTT information, and also store fastest rtt (if any) */
-static int
-iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
-	uint8_t* name, size_t namelen, uint32_t now, struct delegpt* dp,
-	int* best_rtt)
-{
-	int got_it = 0;
-	struct delegpt_addr* a;
-	for(a=dp->result_list; a; a = a->next_result) {
-		a->sel_rtt = iter_filter_unsuitable(iter_env, env, 
-			name, namelen, now, a);
-		if(a->sel_rtt != -1) {
-			if(!got_it) {
-				*best_rtt = a->sel_rtt;
-				got_it = 1;
-			} else if(a->sel_rtt < *best_rtt) {
-				*best_rtt = a->sel_rtt;
-			}
-		}
-	}
-	return got_it;
-}
-
 /** filter the addres list, putting best targets at front,
 * returns number of best targets (or 0, no suitable targets) */
 static int
 iter_filter_order(struct iter_env* iter_env, struct module_env* env,
-	uint8_t* name, size_t namelen, uint32_t now, struct delegpt* dp,
-	int* selected_rtt)
+	uint8_t* name, size_t namelen, time_t now, struct delegpt* dp,
+	int* best_rtt)
 {
-	int got_num = 0, low_rtt = 0, swap_to_front;
+	int got_num = 0, got_rtt = 0, thisrtt, swap_to_front;
 	struct delegpt_addr* a, *n, *prev=NULL;

-	/* fillup sel_rtt and find best rtt in the bunch */
-	got_num = iter_fill_rtt(iter_env, env, name, namelen, now, dp, 
-		&low_rtt);
-	if(got_num == 0) 
-		return 0;
-
-	got_num = 0;
 	a = dp->result_list;
 	while(a) {
-		/* skip unsuitable targets */
-		if(a->sel_rtt == -1) {
+		/* filter out unsuitable targets */
+		thisrtt = iter_filter_unsuitable(iter_env, env, name, namelen, 
+			now, a);
+		if(thisrtt == -1) {
 			prev = a;
 			a = a->next_result;
 			continue;
 		}
 		/* classify the server address and determine what to do */
 		swap_to_front = 0;
-		if(a->sel_rtt >= low_rtt && a->sel_rtt - low_rtt <= RTT_BAND) {
+		if(got_num == 0) {
+			got_rtt = thisrtt;
+			got_num = 1;
+			swap_to_front = 1;
+		} else if(thisrtt == got_rtt) {
 			got_num++;
 			swap_to_front = 1;
-		} else if(a->sel_rtt<low_rtt && low_rtt-a->sel_rtt<=RTT_BAND) {
-			got_num++;
+		} else if(thisrtt < got_rtt) {
+			got_rtt = thisrtt;
+			got_num = 1; /* start back at count of 1 */
 			swap_to_front = 1;
 		}
 		/* swap to front if necessary, or move to next result */
@@ -225,7 +202,7 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 			a = a->next_result;
 		}
 	}
-	*selected_rtt = low_rtt;
+	*best_rtt = got_rtt;
 	return got_num;
 }

@@ -234,11 +211,12 @@ iter_server_selection(struct iter_env* iter_env,
 	struct module_env* env, struct delegpt* dp, 
 	uint8_t* name, size_t namelen, int* dnssec_expected)
 {
+	time_t now = time(NULL);
 	int sel;
 	int selrtt;
 	struct delegpt_addr* a, *prev;
-	int num = iter_filter_order(iter_env, env, name, namelen, 
-		*env->now, dp, &selrtt);
+	int num = iter_filter_order(iter_env, env, name, namelen, now, dp,
+		&selrtt);

 	if(num == 0)
 		return NULL;
@@ -335,7 +313,7 @@ causes_cycle(struct module_qstate* qstate, uint8_t* name, size_t namelen,
 	qinf.qname_len = namelen;
 	qinf.qtype = t;
 	qinf.qclass = c;
-	fptr_ok(fptr_whitelist_modenv_detect_cycle(
+	log_assert(fptr_whitelist_modenv_detect_cycle(
 		qstate->env->detect_cycle));
 	return (*qstate->env->detect_cycle)(qstate, &qinf, 
 		(uint16_t)(BIT_RD|BIT_CD), qstate->is_priming);
@@ -456,7 +456,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	qflags |= BIT_CD;

 	/* attach subquery, lookup existing or make a new one */
-	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
+	log_assert(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
 	if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, &subq)) {
 		return 0;
 	}
@@ -469,7 +469,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 			sizeof(struct iter_qstate));
 		if(!subq->minfo[id]) {
 			log_err("init subq: out of memory");
-			fptr_ok(fptr_whitelist_modenv_kill_sub(
+			log_assert(fptr_whitelist_modenv_kill_sub(
 				qstate->env->kill_sub));
 			(*qstate->env->kill_sub)(subq);
 			return 0;
@@ -587,7 +587,7 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq,
 		subiq->dp = delegpt_copy(stub_dp, subq->region);
 		if(!subiq->dp) {
 			log_err("out of memory priming stub, copydp");
-			fptr_ok(fptr_whitelist_modenv_kill_sub(
+			log_assert(fptr_whitelist_modenv_kill_sub(
 				qstate->env->kill_sub));
 			(*qstate->env->kill_sub)(subq);
 			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
@@ -759,7 +759,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * cache needs to be primed for the qclass. */
 		iq->dp = dns_cache_find_delegation(qstate->env, delname, 
 			delnamelen, iq->qchase.qtype, iq->qchase.qclass, 
-			qstate->region, &iq->deleg_msg, *qstate->env->now);
+			qstate->region, &iq->deleg_msg, (uint32_t)time(NULL));

 		/* If the cache has returned nothing, then we have a 
 		 * root priming situation. */
@@ -825,6 +825,17 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 	verbose(VERB_ALGO, "cache delegation returns delegpt");
 	delegpt_log(VERB_ALGO, iq->dp);

+	/* if the cache reply dp equals a validation anchor or msg has DS,
+	 * then DNSSEC RRSIGs are expected in the reply */
+	iq->dnssec_expected = iter_indicates_dnssec(qstate->env, iq->dp, 
+		iq->deleg_msg, iq->qchase.qclass);
+
+	/* Reset the RD flag. If this is a query restart, then the RD 
+	 * will have been turned off. */
+	if(qstate->query_flags & BIT_RD)
+		iq->chase_flags |= BIT_RD;
+	else	iq->chase_flags &= ~BIT_RD;
+
 	/* Otherwise, set the current delegation point and move on to the 
 	 * next state. */
 	return next_state(iq, INIT_REQUEST_2_STATE);
@@ -879,14 +890,9 @@ processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq)
 {
 	log_query_info(VERB_QUERY, "resolving (init part 3): ", 
 		&qstate->qinfo);
-	/* if the cache reply dp equals a validation anchor or msg has DS,
-	 * then DNSSEC RRSIGs are expected in the reply */
-	iq->dnssec_expected = iter_indicates_dnssec(qstate->env, iq->dp, 
-		iq->deleg_msg, iq->qchase.qclass);
-
 	/* If the RD flag wasn't set, then we just finish with the 
 	 * cached referral as the response. */
-	if(!(qstate->query_flags & BIT_RD)) {
+	if(!(iq->chase_flags & BIT_RD)) {
 		iq->response = iq->deleg_msg;
 		if(verbosity >= VERB_ALGO)
 			log_dns_msg("no RD requested, using delegation msg", 
@@ -1161,7 +1167,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	log_query_info(VERB_QUERY, "sending query:", &iq->qchase);
 	log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, 
 		&target->addr, target->addrlen);
-	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
+	log_assert(fptr_whitelist_modenv_send_query(qstate->env->send_query));
 	outq = (*qstate->env->send_query)(
 		iq->qchase.qname, iq->qchase.qname_len, 
 		iq->qchase.qtype, iq->qchase.qclass, 
@@ -1240,7 +1246,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* close down outstanding requests to be discarded */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
-		fptr_ok(fptr_whitelist_modenv_detach_subs(
+		log_assert(fptr_whitelist_modenv_detach_subs(
 			qstate->env->detach_subs));
 		(*qstate->env->detach_subs)(qstate);
 		iq->num_target_queries = 0;
@@ -1278,7 +1284,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
-		fptr_ok(fptr_whitelist_modenv_detach_subs(
+		log_assert(fptr_whitelist_modenv_detach_subs(
 			qstate->env->detach_subs));
 		(*qstate->env->detach_subs)(qstate);
 		iq->num_target_queries = 0;
@@ -1320,7 +1326,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
-		fptr_ok(fptr_whitelist_modenv_detach_subs(
+		log_assert(fptr_whitelist_modenv_detach_subs(
 			qstate->env->detach_subs));
 		(*qstate->env->detach_subs)(qstate);
 		iq->num_target_queries = 0;
@@ -1336,8 +1342,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			 * gotten this from cache, so test to be sure */
 			if(!infra_set_lame(qstate->env->infra_cache, 
 				&qstate->reply->addr, qstate->reply->addrlen, 
-				iq->dp->name, iq->dp->namelen, 
-				*qstate->env->now, dnsseclame))
+				iq->dp->name, iq->dp->namelen, time(NULL),
+				dnsseclame))
 				log_err("mark host lame: out of memory");
 		} else log_err("%slame response from cache",
 			dnsseclame?"DNSSEC ":"");
@@ -1566,6 +1572,11 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 					LDNS_RCODE_SERVFAIL);
 		}
 	}
+	if(query_dname_compare(qstate->qinfo.qname, 
+		iq->response->qinfo.qname) == 0) {
+		/* use server supplied upper/lower case */
+		qstate->qinfo.qname = iq->response->qinfo.qname;
+	}
 	qstate->return_rcode = LDNS_RCODE_NOERROR;
 	qstate->return_msg = iq->response;
 	return 0;
@@ -1717,7 +1728,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	iq->response = dns_alloc_msg(pkt, prs, qstate->region);
 	if(!iq->response)
 		goto handle_it;
-	log_query_info(VERB_DETAIL, "response for", &qstate->qinfo);
+	log_query_info(VERB_DETAIL, "reponse for", &qstate->qinfo);
 	log_name_addr(VERB_DETAIL, "reply from", iq->dp->name, 
 		&qstate->reply->addr, qstate->reply->addrlen);
 	if(verbosity >= VERB_ALGO)
@@ -66,10 +66,6 @@ struct iter_prep_list;
 #define USEFUL_SERVER_TOP_TIMEOUT	120000
 /** number of retries on outgoing queries */
 #define OUTBOUND_MSG_RETRY 4
-/** RTT band, within this amount from the best, servers are chosen randomly.
- * Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a 
- * fast server, this causes server exploration as a side benefit. msec. */
-#define RTT_BAND 400

 /**
 * Global state for the iterator. 
@@ -437,9 +437,6 @@ process_answer_detail(struct ub_ctx* ctx, uint8_t* msg, uint32_t len,
 			libworker_enter_result(*res, buf, region,
 				q->msg_security);
 		}
-		(*res)->answer_packet = q->msg;
-		(*res)->answer_len = (int)q->msg_len;
-		q->msg = NULL;
 		ldns_buffer_free(buf);
 		regional_destroy(region);
 	}
@@ -451,7 +448,6 @@ process_answer_detail(struct ub_ctx* ctx, uint8_t* msg, uint32_t len,
 	lock_basic_unlock(&ctx->cfglock);

 	if(*cb) return 2;
-	ub_resolve_free(*res);
 	return 1;
 }

@@ -541,7 +537,6 @@ ub_wait(struct ub_ctx* ctx)
 			r = process_answer_detail(ctx, msg, len, 
 				&cb, &cbarg, &err, &res);
 			lock_basic_unlock(&ctx->rrpipe_lock);
-			free(msg);
 			if(r == 0)
 				return UB_PIPE;
 			if(r == 2)
@@ -584,9 +579,6 @@ ub_resolve(struct ub_ctx* ctx, char* name, int rrtype,
 		lock_basic_unlock(&ctx->cfglock);
 		return r;
 	}
-	q->res->answer_packet = q->msg;
-	q->res->answer_len = (int)q->msg_len;
-	q->msg = NULL;
 	*result = q->res;
 	q->res = NULL;

@@ -680,8 +672,8 @@ ub_cancel(struct ub_ctx* ctx, int async_id)
 	if(!ctx->dothread) { /* if forked */
 		(void)rbtree_delete(&ctx->queries, q->node.key);
 		ctx->num_async--;
-		msg = context_serialize_cancel(q, &len);
 		context_query_delete(q);
+		msg = context_serialize_cancel(q, &len);
 		lock_basic_unlock(&ctx->cfglock);
 		if(!msg) {
 			return UB_NOMEM;
@@ -714,7 +706,6 @@ ub_resolve_free(struct ub_result* result)
 			free(*p);
 	free(result->data);
 	free(result->len);
-	free(result->answer_packet);
 	free(result);
 }

@@ -887,8 +878,6 @@ ub_ctx_hosts(struct ub_ctx* ctx, char* fname)
 		/* skip addr */
 		while(isxdigit(*parse) || *parse == '.' || *parse == ':')
 			parse++;
-		if(*parse == '\n' || *parse == 0)
-			continue;
 		if(*parse != ' ' && *parse != '\t') {
 			/* must have whitespace after address */
 			fclose(in);
@@ -93,8 +93,6 @@ libworker_setup(struct ub_ctx* ctx, int is_bg)
 	unsigned int seed;
 	struct libworker* w = (struct libworker*)calloc(1, sizeof(*w));
 	struct config_file* cfg = ctx->env->cfg;
-	int* ports;
-	int numports;
 	if(!w) return NULL;
 	w->is_bg = is_bg;
 	w->ctx = ctx;
@@ -151,21 +149,14 @@ libworker_setup(struct ub_ctx* ctx, int is_bg)
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_lock(&ctx->cfglock);
 	}
-	numports = cfg_condense_ports(cfg, &ports);
-	if(numports == 0) {
-		libworker_delete(w);
-		return NULL;
-	}
 	w->back = outside_network_create(w->base, cfg->msg_buffer_size,
 		(size_t)cfg->outgoing_num_ports, cfg->out_ifs,
-		cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, 
+		cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, -1, 
 		cfg->do_tcp?cfg->outgoing_num_tcp:0,
-		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id,
-		ports, numports);
+		w->env->infra_cache, w->env->rnd);
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);
 	}
-	free(ports);
 	if(!w->back) {
 		libworker_delete(w);
 		return NULL;
@@ -181,7 +172,6 @@ libworker_setup(struct ub_ctx* ctx, int is_bg)
 	w->env->attach_sub = &mesh_attach_sub;
 	w->env->kill_sub = &mesh_state_delete;
 	w->env->detect_cycle = &mesh_detect_cycle;
-	comm_base_timept(w->base, &w->env->now, &w->env->now_tv);
 	return w;
 }

@@ -776,10 +766,12 @@ int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
 	struct libworker* w = (struct libworker*)q->env->worker;
 	if(use_tcp) {
 		return pending_tcp_query(w->back, pkt, addr, addrlen,
-			timeout, libworker_handle_reply, q) != 0;
+			timeout, libworker_handle_reply, q, 
+			q->env->rnd) != 0;
 	}
 	return pending_udp_query(w->back, pkt, addr, addrlen,
-		timeout*1000, libworker_handle_reply, q) != 0;
+		timeout*1000, libworker_handle_reply, q, 
+		q->env->rnd) != 0;
 }

 /** compare outbound entry qstates */
@@ -942,18 +934,14 @@ libworker_read_msg(int fd, uint8_t** buf, uint32_t* len, int nonblock)
 	if((r=read(fd, *buf, *len)) == -1) {
 		log_err("msg read failed: %s", strerror(errno));
 		(void)fd_set_nonblock(fd);
-		free(*buf);
 		return 0;
 	}
 	if(r == 0) { /* EOF */
 		(void)fd_set_nonblock(fd);
-		free(*buf);
 		return 0;
 	}
-	if(!fd_set_nonblock(fd)) {
-		free(*buf);
+	if(!fd_set_nonblock(fd))
 		return 0;
-	}
 	return 1;
 }

@@ -139,13 +139,6 @@ struct ub_result {
 	 */
 	int rcode;

-	/**
-	 * The DNS answer packet. Network formatted. Can contain DNSSEC types.
-	 */
-	void* answer_packet;
-	/** length of the answer packet in octets. */
-	int answer_len;
-
 	/**
 	 * If there is any data, this is true.
 	 * If false, there was no data (nxdomain may be true, rcode can be set).
@@ -52,7 +52,7 @@
 /** store rrsets in the rrset cache. 
 * @param env: module environment with caches.
 * @param rep: contains list of rrsets to store.
- * @param now: current time.
+ * @param now: current time(NULL).
 */
 static void
 store_rrsets(struct module_env* env, struct reply_info* rep, uint32_t now)
@@ -73,7 +73,7 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 	hashvalue_t hash, struct reply_info* rep)
 {
 	struct msgreply_entry* e;
-	uint32_t ttl = rep->ttl;
+	uint32_t now = time(NULL), ttl = rep->ttl;
 	size_t i;

 	/* store RRsets */
@@ -82,8 +82,8 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 		rep->ref[i].id = rep->rrsets[i]->id;
 	}
 	reply_info_sortref(rep);
-	reply_info_set_ttls(rep, *env->now);
-	store_rrsets(env, rep, *env->now);
+	reply_info_set_ttls(rep, now);
+	store_rrsets(env, rep, now);
 	if(ttl == 0) {
 		/* we do not store the message, but we did store the RRs,
 		 * which could be useful for delegation information */
@@ -219,7 +219,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 {
 	struct delegpt_ns* ns;
 	struct ub_packed_rrset_key* akey;
-	uint32_t now = *env->now;
+	uint32_t now = time(NULL);
 	for(ns = dp->nslist; ns; ns = ns->next) {
 		if(ns->resolved)
 			continue;
@@ -543,7 +543,7 @@ dns_cache_lookup(struct module_env* env,
 	struct lruhash_entry* e;
 	struct query_info k;
 	hashvalue_t h;
-	uint32_t now = *env->now;
+	uint32_t now = (uint32_t)time(NULL);
 	struct ub_packed_rrset_key* rrset;

 	/* lookup first, this has both NXdomains and ANSWER responses */
@@ -630,15 +630,16 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 	if(is_referral) {
 		/* store rrsets */
 		struct rrset_ref ref;
+		uint32_t now = time(NULL);
 		size_t i;
 		for(i=0; i<rep->rrset_count; i++) {
 			packed_rrset_ttl_add((struct packed_rrset_data*)
-				rep->rrsets[i]->entry.data, *env->now);
+				rep->rrsets[i]->entry.data, now);
 			ref.key = rep->rrsets[i];
 			ref.id = rep->rrsets[i]->id;
 			/*ignore ret: it was in the cache, ref updated */
 			(void)rrset_cache_update(env->rrset_cache, &ref, 
-				env->alloc, *env->now);
+				env->alloc, now);
 		}
 		free(rep);
 		return 1;
@@ -158,7 +158,7 @@ infra_lookup_host_nottl(struct infra_cache* infra,
 struct infra_host_data* 
 infra_lookup_host(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen, int wr,
-        uint32_t timenow, struct infra_host_key** key)
+        time_t timenow, struct infra_host_key** key)
 {
 	struct infra_host_data* data;
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
@@ -186,7 +186,7 @@ infra_lookup_host(struct infra_cache* infra,
 */
 static struct lruhash_entry*
 new_host_entry(struct infra_cache* infra, struct sockaddr_storage* addr, 
-	socklen_t addrlen, uint32_t tm)
+	socklen_t addrlen, time_t tm)
 {
 	struct infra_host_data* data;
 	struct infra_host_key* key = (struct infra_host_key*)malloc(
@@ -214,7 +214,7 @@ new_host_entry(struct infra_cache* infra, struct sockaddr_storage* addr,

 int 
 infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
-        socklen_t addrlen, uint32_t timenow, int* edns_vs, int* to)
+        socklen_t addrlen, time_t timenow, int* edns_vs, int* to)
 {
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
 		addrlen, 0);
@@ -260,7 +260,7 @@ hash_lameness(uint8_t* name, size_t namelen)

 int 
 infra_lookup_lame(struct infra_host_data* host,
-        uint8_t* name, size_t namelen, uint32_t timenow)
+        uint8_t* name, size_t namelen, time_t timenow)
 {
 	struct lruhash_entry* e;
 	struct infra_lame_key k;
@@ -329,7 +329,7 @@ infra_lame_deldatafunc(void* d, void* ATTR_UNUSED(arg))
 int 
 infra_set_lame(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen,
-        uint8_t* name, size_t namelen, uint32_t timenow, int dnsseclame)
+        uint8_t* name, size_t namelen, time_t timenow, int dnsseclame)
 {
 	struct infra_host_data* data;
 	struct lruhash_entry* e;
@@ -422,7 +422,7 @@ infra_update_tcp_works(struct infra_cache* infra,
 int 
 infra_rtt_update(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen,
-        int roundtrip, uint32_t timenow)
+        int roundtrip, time_t timenow)
 {
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
 		addrlen, 1);
@@ -452,7 +452,7 @@ infra_rtt_update(struct infra_cache* infra,
 int 
 infra_edns_update(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen,
-        int edns_version, uint32_t timenow)
+        int edns_version, time_t timenow)
 {
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
 		addrlen, 1);
@@ -478,7 +478,7 @@ int
 infra_get_lame_rtt(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen,
        uint8_t* name, size_t namelen, int* lame, int* dnsseclame,
-	int* rtt, uint32_t timenow)
+	int* rtt, time_t timenow)
 {
 	struct infra_host_data* host;
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
@@ -63,7 +63,7 @@ struct infra_host_key {
 */
 struct infra_host_data {
 	/** TTL value for this entry. absolute time. */
-	uint32_t ttl;
+	time_t ttl;
 	/** round trip times for timeout calculation */
 	struct rtt_info rtt;
 	/** Names of the zones that are lame. NULL=no lame zones. */
@@ -90,7 +90,7 @@ struct infra_lame_key {
 */
 struct infra_lame_data {
 	/** TTL of this entry. absolute time. */
-	uint32_t ttl;
+	time_t ttl;
 	/** is the host lame (does not serve the zone authoritatively),
 	 * or is the host dnssec lame (does not serve DNSSEC data) */
 	int isdnsseclame;
@@ -151,7 +151,7 @@ struct infra_cache* infra_adjust(struct infra_cache* infra,
 */
 struct infra_host_data* infra_lookup_host(struct infra_cache* infra, 
 	struct sockaddr_storage* addr, socklen_t addrlen, int wr, 
-	uint32_t timenow, struct infra_host_key** key);
+	time_t timenow, struct infra_host_key** key);

 /**
 * Find host information to send a packet. Creates new entry if not found.
@@ -166,7 +166,7 @@ struct infra_host_data* infra_lookup_host(struct infra_cache* infra,
 * @return: 0 on error.
 */
 int infra_host(struct infra_cache* infra, struct sockaddr_storage* addr, 
-	socklen_t addrlen, uint32_t timenow, int* edns_vs, int* to);
+	socklen_t addrlen, time_t timenow, int* edns_vs, int* to);

 /**
 * Check for lameness of this server for a particular zone.
@@ -178,7 +178,7 @@ int infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
 * @return: 0 if not lame or unknown or timed out, 1 if lame, 2 if dnsseclame.
 */
 int infra_lookup_lame(struct infra_host_data* host,
-	uint8_t* name, size_t namelen, uint32_t timenow);
+	uint8_t* name, size_t namelen, time_t timenow);

 /**
 * Set a host to be lame for the given zone.
@@ -194,7 +194,7 @@ int infra_lookup_lame(struct infra_host_data* host,
 */
 int infra_set_lame(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen,
-	uint8_t* name, size_t namelen, uint32_t timenow, int dnsseclame);
+	uint8_t* name, size_t namelen, time_t timenow, int dnsseclame);

 /**
 * Update rtt information for the host.
@@ -208,7 +208,7 @@ int infra_set_lame(struct infra_cache* infra,
 */
 int infra_rtt_update(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen,
-	int roundtrip, uint32_t timenow);
+	int roundtrip, time_t timenow);

 /**
 * Update information for the host, store that a TCP transaction works.
@@ -230,7 +230,7 @@ void infra_update_tcp_works(struct infra_cache* infra,
 */
 int infra_edns_update(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen,
-	int edns_version, uint32_t timenow);
+	int edns_version, time_t timenow);

 /**
 * Get Lameness information and average RTT if host is in the cache.
@@ -250,7 +250,7 @@ int infra_edns_update(struct infra_cache* infra,
 int infra_get_lame_rtt(struct infra_cache* infra,
        struct sockaddr_storage* addr, socklen_t addrlen, 
 	uint8_t* name, size_t namelen, int* lame, int* dnsseclame,
-	int* rtt, uint32_t timenow);
+	int* rtt, time_t timenow);

 /**
 * Get memory used by the infra cache.
@@ -309,8 +309,9 @@ rrset_array_unlock_touch(struct rrset_cache* r, struct regional* scratch,

 void 
 rrset_update_sec_status(struct rrset_cache* r, 
-	struct ub_packed_rrset_key* rrset, uint32_t now)
+	struct ub_packed_rrset_key* rrset)
 {
+	uint32_t now = (uint32_t)time(0);
 	struct packed_rrset_data* updata = 
 		(struct packed_rrset_data*)rrset->entry.data;
 	struct lruhash_entry* e;
@@ -338,8 +339,9 @@ rrset_update_sec_status(struct rrset_cache* r,

 void 
 rrset_check_sec_status(struct rrset_cache* r, 
-	struct ub_packed_rrset_key* rrset, uint32_t now)
+	struct ub_packed_rrset_key* rrset)
 {
+	uint32_t now = (uint32_t)time(0);
 	struct packed_rrset_data* updata = 
 		(struct packed_rrset_data*)rrset->entry.data;
 	struct lruhash_entry* e;
@@ -192,10 +192,9 @@ void rrset_array_unlock_touch(struct rrset_cache* r, struct regional* scratch,
 * @param r: the rrset cache. 
 * @param rrset: which rrset to attempt to update. This rrset is left 
 * 	untouched. The rrset in the cache is updated in-place.
- * @param now: current time.
 */
 void rrset_update_sec_status(struct rrset_cache* r, 
-	struct ub_packed_rrset_key* rrset, uint32_t now);
+	struct ub_packed_rrset_key* rrset);

 /**
 * Looks up security status of an rrset. Looks up the rrset.
@@ -204,10 +203,9 @@ void rrset_update_sec_status(struct rrset_cache* r,
 * @param r: the rrset cache. 
 * @param rrset: This rrset may change security status due to the cache.
 * 	But its status will only improve, towards secure.
- * @param now: current time.
 */
 void rrset_check_sec_status(struct rrset_cache* r, 
-	struct ub_packed_rrset_key* rrset, uint32_t now);
+	struct ub_packed_rrset_key* rrset);

 /** mark rrset to be deleted, set id=0 */
 void rrset_markdel(void* key);
@@ -86,8 +86,7 @@ verbose_print_addr(struct addrinfo *addr)
 }

 int
-create_udp_sock(int family, int socktype, struct sockaddr* addr,
-        socklen_t addrlen, int v6only, int* inuse)
+create_udp_sock(struct addrinfo *addr, int v6only)
 {
 	int s;
 # if defined(IPV6_USE_MIN_MTU)
@@ -95,12 +94,12 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 # else
 	(void)v6only;
 # endif
-	if((s = socket(family, socktype, 0)) == -1) {
+	verbose_print_addr(addr);
+	if((s = socket(addr->ai_family, addr->ai_socktype, 0)) == -1) {
 		log_err("can't create socket: %s", strerror(errno));
-		*inuse = 0;
 		return -1;
 	}
-	if(family == AF_INET6) {
+	if(addr->ai_family == AF_INET6) {
 # if defined(IPV6_V6ONLY)
 		if(v6only) {
 			int val=(v6only==2)?0:1;
@@ -108,8 +107,6 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 				&val, (socklen_t)sizeof(val)) < 0) {
 				log_err("setsockopt(..., IPV6_V6ONLY"
 					", ...) failed: %s", strerror(errno));
-				close(s);
-				*inuse = 0;
 				return -1;
 			}
 		}
@@ -127,26 +124,16 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			&on, (socklen_t)sizeof(on)) < 0) {
 			log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
 				"...) failed: %s", strerror(errno));
-			close(s);
-			*inuse = 0;
 			return -1;
 		}
 # endif
 	}
-	if(bind(s, (struct sockaddr*)addr, addrlen) != 0) {
-#ifdef EADDRINUSE
-		*inuse = (errno == EADDRINUSE);
-		if(errno != EADDRINUSE)
-#endif
-			log_err("can't bind socket: %s", strerror(errno));
-		close(s);
+	if(bind(s, (struct sockaddr*)addr->ai_addr, addr->ai_addrlen) != 0) {
+		log_err("can't bind socket: %s", strerror(errno));
 		return -1;
 	}
-	if(!fd_set_nonblock(s)) {
-		*inuse = 0;
-		close(s);
+	if(!fd_set_nonblock(s))
 		return -1;
-	}
 	return s;
 }

@@ -188,7 +175,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only)
 #else
 	(void)v6only;
 #endif /* IPV6_V6ONLY */
-	if(bind(s, addr->ai_addr, addr->ai_addrlen) != 0) {
+	if(bind(s, (struct sockaddr*)addr->ai_addr, addr->ai_addrlen) != 0) {
 		log_err("can't bind socket: %s", strerror(errno));
 		return -1;
 	}
@@ -216,7 +203,7 @@ make_sock(int stype, const char* ifname, const char* port,
 	struct addrinfo *hints, int v6only)
 {
 	struct addrinfo *res = NULL;
-	int r, s, inuse;
+	int r, s;
 	hints->ai_socktype = stype;
 	if((r=getaddrinfo(ifname, port, hints, &res)) != 0 || !res) {
 		log_err("node %s:%s getaddrinfo: %s %s", 
@@ -224,15 +211,9 @@ make_sock(int stype, const char* ifname, const char* port,
 			r==EAI_SYSTEM?(char*)strerror(errno):"");
 		return -1;
 	}
-	if(stype == SOCK_DGRAM) {
-		verbose_print_addr(res);
-		s = create_udp_sock(res->ai_family, res->ai_socktype,
-			(struct sockaddr*)res->ai_addr, 
-			res->ai_addrlen, v6only, &inuse);
-		if(s == -1 && inuse) {
-			log_err("bind: address already in use");
-		}
-	}	else	s = create_tcp_accept_sock(res, v6only);
+	if(stype == SOCK_DGRAM)
+		s = create_udp_sock(res, v6only);
+	else	s = create_tcp_accept_sock(res, v6only);
 	freeaddrinfo(res);
 	return s;
 }
@@ -262,11 +243,7 @@ port_insert(struct listen_port** list, int s, enum listen_type ftype)
 static int
 set_recvpktinfo(int s, int family) 
 {
-#if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || defined(IP_RECVDSTADDR) || defined(IP_PKTINFO)
 	int on = 1;
-#else
-	(void)s;
-#endif
 	if(family == AF_INET6) {
 #           ifdef IPV6_RECVPKTINFO
 		if(setsockopt(s, IPPROTO_IPV6, IPV6_RECVPKTINFO,
@@ -45,6 +45,7 @@
 #include "config.h"
 #include "util/netevent.h"
 struct listen_list;
+struct addrinfo;
 struct config_file;

 /**
@@ -164,16 +165,11 @@ size_t listen_get_mem(struct listen_dnsport* listen);

 /**
 * Create and bind nonblocking UDP socket
- * @param family: for socket call.
- * @param socktype: for socket call.
- * @param addr: for bind call.
- * @param addrlen: for bind call.
+ * @param addr: address info ready to make socket.
 * @param v6only: if enabled, IP6 sockets get IP6ONLY option set.
 * 	if enabled with value 2 IP6ONLY option is disabled.
- * @param inuse: on error, this is set true if the port was in use.
 * @return: the socket. -1 on error.
 */
-int create_udp_sock(int family, int socktype, struct sockaddr* addr, 
-	socklen_t addrlen, int v6only, int* inuse);
+int create_udp_sock(struct addrinfo* addr, int v6only);

 #endif /* LISTEN_DNSPORT_H */
@@ -160,7 +160,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	if(!s->reply_list && !s->cb_list)
 		was_noreply = 1;
 	/* add reply to s */
-	if(!mesh_state_add_reply(s, edns, rep, qid, qflags, qinfo->qname)) {
+	if(!mesh_state_add_reply(s, edns, rep, qid, qflags)) {
 			log_err("mesh_new_client: out of memory; SERVFAIL");
 			error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
 				qinfo, qid, qflags, edns);
@@ -298,7 +298,7 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	/* de-init modules */
 	mesh = mstate->s.env->mesh;
 	for(i=0; i<mesh->mods.num; i++) {
-		fptr_ok(fptr_whitelist_mod_clear(mesh->mods.mod[i]->clear));
+		log_assert(fptr_whitelist_mod_clear(mesh->mods.mod[i]->clear));
 		(*mesh->mods.mod[i]->clear)(&mstate->s, i);
 		mstate->s.minfo[i] = NULL;
 		mstate->s.ext_state[i] = module_finished;
@@ -510,14 +510,12 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 * @param rcode: if not 0, error code.
 * @param rep: reply to send (or NULL if rcode is set).
 * @param r: reply entry
- * @param prev: previous reply, already has its answer encoded in buffer.
 */
 static void
 mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
-	struct mesh_reply* r, struct mesh_reply* prev)
+	struct mesh_reply* r)
 {
 	struct timeval end_time;
-	struct timeval duration;
 	int secure;
 	/* examine security status */
 	if(m->s.env->need_to_validate && !(r->qflags&BIT_CD) && rep && 
@@ -530,21 +528,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 	if(!rep && rcode == LDNS_RCODE_NOERROR)
 		rcode = LDNS_RCODE_SERVFAIL;
 	/* send the reply */
-	if(prev && prev->qflags == r->qflags && 
-		prev->edns.edns_present == r->edns.edns_present && 
-		prev->edns.bits == r->edns.bits && 
-		prev->edns.udp_size == r->edns.udp_size) {
-		/* if the previous reply is identical to this one, fix ID */
-		if(prev->query_reply.c->buffer != r->query_reply.c->buffer)
-			ldns_buffer_copy(r->query_reply.c->buffer, 
-				prev->query_reply.c->buffer);
-		ldns_buffer_write_at(r->query_reply.c->buffer, 0, 
-			&r->qid, sizeof(uint16_t));
-		ldns_buffer_write_at(r->query_reply.c->buffer, 12, 
-			r->qname, m->s.qinfo.qname_len);
-		comm_point_send_reply(&r->query_reply);
-	} else if(rcode) {
-		m->s.qinfo.qname = r->qname;
+	if(rcode) {
 		error_encode(r->query_reply.c->buffer, rcode, &m->s.qinfo,
 			r->qid, r->qflags, &r->edns);
 		comm_point_send_reply(&r->query_reply);
@@ -554,7 +538,6 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		r->edns.udp_size = EDNS_ADVERTISED_SIZE;
 		r->edns.ext_rcode = 0;
 		r->edns.bits &= EDNS_DO;
-		m->s.qinfo.qname = r->qname;
 		if(!reply_info_answer_encode(&m->s.qinfo, rep, r->qid, 
 			r->qflags, r->query_reply.c->buffer, 0, 1, 
 			m->s.env->scratch, udp_size, &r->edns, 
@@ -568,25 +551,28 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 	}
 	/* account */
 	m->s.env->mesh->num_reply_addrs--;
-	end_time = *m->s.env->now_tv;
-	timeval_subtract(&duration, &end_time, &r->start_time);
-	verbose(VERB_ALGO, "query took %d.%6.6d sec",
-		(int)duration.tv_sec, (int)duration.tv_usec);
-	m->s.env->mesh->replies_sent++;
-	timeval_add(&m->s.env->mesh->replies_sum_wait, &duration);
-	timehist_insert(m->s.env->mesh->histogram, &duration);
+	if(gettimeofday(&end_time, NULL) < 0) {
+		log_err("gettimeofday: %s", strerror(errno));
+		return;
+	} else {
+		struct timeval duration;
+		timeval_subtract(&duration, &end_time, &r->start_time);
+		verbose(VERB_ALGO, "query took %d.%6.6d sec",
+			(int)duration.tv_sec, (int)duration.tv_usec);
+		m->s.env->mesh->replies_sent++;
+		timeval_add(&m->s.env->mesh->replies_sum_wait, &duration);
+		timehist_insert(m->s.env->mesh->histogram, &duration);
+	}
 }

 void mesh_query_done(struct mesh_state* mstate)
 {
 	struct mesh_reply* r;
-	struct mesh_reply* prev = NULL;
 	struct mesh_cb* c;
 	struct reply_info* rep = (mstate->s.return_msg?
 		mstate->s.return_msg->rep:NULL);
 	for(r = mstate->reply_list; r; r = r->next) {
-		mesh_send_reply(mstate, mstate->s.return_rcode, rep, r, prev);
-		prev = r;
+		mesh_send_reply(mstate, mstate->s.return_rcode, rep, r);
 	}
 	for(c = mstate->cb_list; c; c = c->next) {
 		mesh_do_callback(mstate, mstate->s.return_rcode, rep, c);
@@ -601,7 +587,7 @@ void mesh_walk_supers(struct mesh_area* mesh, struct mesh_state* mstate)
 		/* make super runnable */
 		(void)rbtree_insert(&mesh->run, &ref->s->run_node);
 		/* callback the function to inform super of result */
-		fptr_ok(fptr_whitelist_mod_inform_super(
+		log_assert(fptr_whitelist_mod_inform_super(
 			mesh->mods.mod[ref->s->s.curmod]->inform_super));
 		(*mesh->mods.mod[ref->s->s.curmod]->inform_super)(&mstate->s, 
 			ref->s->s.curmod, &ref->s->s);
@@ -644,7 +630,7 @@ int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
 }

 int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
-        struct comm_reply* rep, uint16_t qid, uint16_t qflags, uint8_t* qname)
+        struct comm_reply* rep, uint16_t qid, uint16_t qflags)
 {
 	struct mesh_reply* r = regional_alloc(s->s.region, 
 		sizeof(struct mesh_reply));
@@ -654,12 +640,11 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
 	r->edns = *edns;
 	r->qid = qid;
 	r->qflags = qflags;
-	r->start_time = *s->s.env->now_tv;
+	if(gettimeofday(&r->start_time, NULL) < 0) {
+		log_err("addrep: gettimeofday: %s", strerror(errno));
+		memset(&r->start_time, 0, sizeof(r->start_time));
+	}
 	r->next = s->reply_list;
-	r->qname = regional_alloc_init(s->s.region, qname, 
-		s->s.qinfo.qname_len);
-	if(!r->qname)
-		return 0;
 	s->reply_list = r;
 	return 1;

@@ -731,7 +716,7 @@ void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
 	verbose(VERB_ALGO, "mesh_run: start");
 	while(mstate) {
 		/* run the module */
-		fptr_ok(fptr_whitelist_mod_operate(
+		log_assert(fptr_whitelist_mod_operate(
 			mesh->mods.mod[mstate->s.curmod]->operate));
 		(*mesh->mods.mod[mstate->s.curmod]->operate)
 			(&mstate->s, ev, mstate->s.curmod, e);
@@ -156,8 +156,6 @@ struct mesh_reply {
 	uint16_t qid;
 	/** flags of query, for reply flags */
 	uint16_t qflags;
-	/** qname from this query. len same as mesh qinfo. */
-	uint8_t* qname;
 };

 /** 
@@ -377,11 +375,10 @@ int mesh_state_attachment(struct mesh_state* super, struct mesh_state* sub);
 * @param rep: comm point reply info.
 * @param qid: ID of reply.
 * @param qflags: original query flags.
- * @param qname: original query name.
 * @return: 0 on alloc error.
 */
 int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns, 
-	struct comm_reply* rep, uint16_t qid, uint16_t qflags, uint8_t* qname);
+	struct comm_reply* rep, uint16_t qid, uint16_t qflags);

 /**
 * Create new callback structure and attach it to a mesh state.
@@ -143,7 +143,7 @@ modstack_setup(struct module_stack* stack, const char* module_conf,
        for(i=0; i<stack->num; i++) {
                verbose(VERB_OPS, "init module %d: %s",
                        i, stack->mod[i]->name);
-                fptr_ok(fptr_whitelist_mod_init(stack->mod[i]->init));
+                log_assert(fptr_whitelist_mod_init(stack->mod[i]->init));
                if(!(*stack->mod[i]->init)(env, i)) {
                        log_err("module init for module %s failed",
                                stack->mod[i]->name);
@@ -158,7 +158,7 @@ modstack_desetup(struct module_stack* stack, struct module_env* env)
 {
        int i;
        for(i=0; i<stack->num; i++) {
-                fptr_ok(fptr_whitelist_mod_deinit(stack->mod[i]->deinit));
+                log_assert(fptr_whitelist_mod_deinit(stack->mod[i]->deinit));
                (*stack->mod[i]->deinit)(env, i);
        }
        stack->num = 0;
@@ -51,10 +51,7 @@ struct pending_timeout;
 struct ub_randstate;
 struct pending_tcp;
 struct waiting_tcp;
-struct waiting_udp;
 struct infra_cache;
-struct port_comm;
-struct port_if;

 /**
 * Send queries to outside servers and wait for answers from servers.
@@ -63,10 +60,6 @@ struct port_if;
 struct outside_network {
 	/** Base for select calls */
 	struct comm_base* base;
-	/** pointer to time in seconds */
-	uint32_t* now_secs;
-	/** pointer to time in microseconds */
-	struct timeval* now_tv;

 	/** buffer shared by UDP connections, since there is only one
 	    datagram at any time. */
@@ -74,27 +67,21 @@ struct outside_network {
 	/** serviced_callbacks malloc overhead when processing multiple
 	 * identical serviced queries to the same server. */
 	size_t svcd_overhead;
-	/** use x20 bits to encode additional ID random bits */
-	int use_caps_for_id;

-	/** linked list of available commpoints, unused file descriptors,
-	 * for use as outgoing UDP ports. cp.fd=-1 in them. */
-	struct port_comm* unused_fds;
+	/** 
+	 * Array of udp comm point* that are used to listen to pending events.
+	 * Each is on a different port. This is for ip4 ports.
+	 */
+	struct comm_point** udp4_ports;
+	/** number of udp4 ports */
+	size_t num_udp4;

-	/** array of outgoing IP4 interfaces */
-	struct port_if* ip4_ifs;
-	/** number of outgoing IP4 interfaces */
-	int num_ip4;
-
-	/** array of outgoing IP6 interfaces */
-	struct port_if* ip6_ifs;
-	/** number of outgoing IP6 interfaces */
-	int num_ip6;
-
-	/** pending udp queries waiting to be sent out, waiting for fd */
-	struct pending* udp_wait_first;
-	/** last pending udp query in list */
-	struct pending* udp_wait_last;
+	/**
+	 * The opened ip6 ports.
+	 */
+	struct comm_point** udp6_ports;
+	/** number of udp6 ports */
+	size_t num_udp6;

 	/** pending udp answers. sorted by id, addr */
 	rbtree_t* pending;
@@ -122,65 +109,20 @@ struct outside_network {
 	struct waiting_tcp* tcp_wait_last;
 };

-/**
- * Outgoing interface. Ports available and currently used are tracked
- * per interface
- */
-struct port_if {
-	/** address ready to allocate new socket (except port no). */
-	struct sockaddr_storage addr;
-	/** length of addr field */
-	socklen_t addrlen;
-
-	/** the available ports array. These are unused.
-	 * Only the first total-inuse part is filled. */
-	int* avail_ports;
-	/** the total number of available ports (size of the array) */
-	int avail_total;
-
-	/** array of the commpoints currently in use. 
-	 * allocated for max number of fds, first part in use. */
-	struct port_comm** out;
-	/** max number of fds, size of out array */
-	int maxout;
-	/** number of commpoints (and thus also ports) in use */
-	int inuse;
-};
-
-/**
- * Outgoing commpoint for UDP port.
- */
-struct port_comm {
-	/** next in free list */
-	struct port_comm* next;
-	/** which port number (when in use) */
-	int number;
-	/** interface it is used in */
-	struct port_if* pif;
-	/** index in the out array of the interface */
-	int index;
-	/** number of outstanding queries on this port */
-	int num_outstanding;
-	/** UDP commpoint, fd=-1 if not in use */
-	struct comm_point* cp;
-};
-
 /**
 * A query that has an answer pending for it.
 */
 struct pending {
 	/** redblacktree entry, key is the pending struct(id, addr). */
 	rbnode_t node;
-	/** the ID for the query. int so that a value out of range can
-	 * be used to signify a pending that is for certain not present in
-	 * the rbtree. (and for which deletion is safe). */
-	unsigned int id;
+	/** the ID for the query */
+	uint16_t id;
 	/** remote address. */
 	struct sockaddr_storage addr;
 	/** length of addr field in use. */
 	socklen_t addrlen;
 	/** comm point it was sent on (and reply must come back on). */
-	struct port_comm* pc;
+	struct comm_point* c;
 	/** timeout event */
 	struct comm_timer* timer;
 	/** callback for the timeout, error or reply to the message */
@@ -189,16 +131,6 @@ struct pending {
 	void* cb_arg;
 	/** the outside network it is part of */
 	struct outside_network* outnet;
-
-	/*---- filled if udp pending is waiting -----*/
-	/** next in waiting list. */
-	struct pending* next_waiting;
-	/** timeout in msec */
-	int timeout;
-	/** The query itself, the query packet to send. */
-	uint8_t* pkt;
-	/** length of query packet. */
-	size_t pkt_len;
 };

 /**
@@ -320,19 +252,17 @@ struct serviced_query {
 * @param num_ifs: number of names in array ifs.
 * @param do_ip4: service IP4.
 * @param do_ip6: service IP6.
+ * @param port_base: if -1 system assigns ports, otherwise try to get
+ *    the ports numbered from this starting number.
 * @param num_tcp: number of outgoing tcp buffers to preallocate.
 * @param infra: pointer to infra cached used for serviced queries.
 * @param rnd: stored to create random numbers for serviced queries.
- * @param use_caps_for_id: enable to use 0x20 bits to encode id randomness.
- * @param availports: array of available ports. 
- * @param numavailports: number of available ports in array.
 * @return: the new structure (with no pending answers) or NULL on error.
 */
 struct outside_network* outside_network_create(struct comm_base* base,
 	size_t bufsize, size_t num_ports, char** ifs, int num_ifs,
-	int do_ip4, int do_ip6, size_t num_tcp, struct infra_cache* infra, 
-	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
-	int numavailports);
+	int do_ip4, int do_ip6, int port_base, size_t num_tcp, 
+	struct infra_cache* infra, struct ub_randstate* rnd);

 /**
 * Delete outside_network structure.
@@ -350,12 +280,13 @@ void outside_network_delete(struct outside_network* outnet);
 * @param timeout: in milliseconds from now.
 * @param callback: function to call on error, timeout or reply.
 * @param callback_arg: user argument for callback function.
+ * @param rnd: random state for generating ID and port.
 * @return: NULL on error for malloc or socket. Else the pending query object.
 */
 struct pending* pending_udp_query(struct outside_network* outnet, 
 	ldns_buffer* packet, struct sockaddr_storage* addr, 
 	socklen_t addrlen, int timeout, comm_point_callback_t* callback, 
-	void* callback_arg);
+	void* callback_arg, struct ub_randstate* rnd);

 /**
 * Send TCP query. May wait for TCP buffer. Selects ID to be random, and 
@@ -369,12 +300,13 @@ struct pending* pending_udp_query(struct outside_network* outnet,
 *    without any query been sent to the server yet.
 * @param callback: function to call on error, timeout or reply.
 * @param callback_arg: user argument for callback function.
+ * @param rnd: random state for generating ID.
 * @return: false on error for malloc or socket. Else the pending TCP object.
 */
 struct waiting_tcp* pending_tcp_query(struct outside_network* outnet, 
 	ldns_buffer* packet, struct sockaddr_storage* addr, 
 	socklen_t addrlen, int timeout, comm_point_callback_t* callback, 
-	void* callback_arg);
+	void* callback_arg, struct ub_randstate* rnd);

 /**
 * Delete pending answer.
@@ -52,9 +52,6 @@
 #include "validator/validator.h"
 #include "services/localzone.h"
 #include <pwd.h>
-#ifdef HAVE_SYS_STAT_H
-#include <sys/stat.h>
-#endif

 /** Give checkconf usage, and exit (1). */
 static void
@@ -174,130 +171,25 @@ aclchecks(struct config_file* cfg)
 	}
 }

-/** true if fname is a file */
-static int
-is_file(const char* fname) 
-{
-	struct stat buf;
-	if(stat(fname, &buf) < 0) {
-		if(errno==EACCES) {
-			printf("warning: no search permission for one of the directories in path: %s\n", fname);
-			return 1;
-		}
-		perror(fname);
-		return 0;
-	}
-	if(S_ISDIR(buf.st_mode)) {
-		printf("%s is not a file\n", fname);
-		return 0;
-	}
-	return 1;
-}
-
-/** true if fname is a directory */
-static int
-is_dir(const char* fname) 
-{
-	struct stat buf;
-	if(stat(fname, &buf) < 0) {
-		if(errno==EACCES) {
-			printf("warning: no search permission for one of the directories in path: %s\n", fname);
-			return 1;
-		}
-		perror(fname);
-		return 0;
-	}
-	if(!(S_ISDIR(buf.st_mode))) {
-		printf("%s is not a directory\n", fname);
-		return 0;
-	}
-	return 1;
-}
-
-/** convert a filename to full pathname in original filesys
- * @param fname: the path name to convert.
- * 	Must not be null or empty.
- * @param cfg: config struct for chroot and chdir (if set).
- * @param use_chdir: if false, only chroot is applied.
- * @return pointer to static buffer which is: [chroot][chdir]fname
- */
-static char*
-fname_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
-{
-	static char buf[1024];
-	int slashit = 0;
-	buf[0] = 0;
-	if(cfg->chrootdir && cfg->chrootdir[0] && 
-		strncmp(cfg->chrootdir, fname, strlen(cfg->chrootdir)) == 0) {
-		/* already full pathname, return it */
-		strncpy(buf, fname, sizeof(buf)-1);
-		buf[sizeof(buf)-1] = 0;
-		return buf;
-	}
-	/* chroot */
-	if(cfg->chrootdir && cfg->chrootdir[0]) {
-		/* start with chrootdir */
-		strncpy(buf, cfg->chrootdir, sizeof(buf)-1);
-		slashit = 1;
-	}
-	/* chdir */
-	if(fname[0] == '/' || !use_chdir) {
-		/* full path, no chdir */
-	} else if(cfg->directory && cfg->directory[0]) {
-		/* prepend chdir */
-		if(slashit && cfg->directory[0] != '/')
-			strncat(buf, "/", sizeof(buf)-1);
-		if(strncmp(cfg->chrootdir, cfg->directory, 
-			strlen(cfg->chrootdir)) == 0)
-			strncat(buf, cfg->directory+strlen(cfg->chrootdir), 
-				sizeof(buf)-1);
-		else strncat(buf, cfg->directory, sizeof(buf)-1);
-		slashit = 1;
-	}
-	/* fname */
-	if(slashit && fname[0] != '/')
-		strncat(buf, "/", sizeof(buf)-1);
-	strncat(buf, fname, sizeof(buf)-1);
-	buf[sizeof(buf)-1] = 0;
-	return buf;
-}
-
-/** get base dir of a fname */
-static char*
-basedir(const char* fname, struct config_file* cfg)
-{
-	char* d = fname_after_chroot(fname, cfg, 1);
-	char* rev = strrchr(d, '/');
-	if(!rev) return NULL;
-	if(d == rev) return NULL;
-	rev[0] = 0;
-	return d;
-}
-
 /** check file list, every file must be inside the chroot location */
 static void
 check_chroot_filelist(const char* desc, struct config_strlist* list,
-	const char* chrootdir, struct config_file* cfg)
+	const char* chrootdir)
 {
 	struct config_strlist* p;
-	char* old;
+	if(!chrootdir) return;
 	for(p=list; p; p=p->next) {
-		if(p->str && p->str[0]) {
-			if(!is_file(fname_after_chroot(p->str, cfg, 1))) {
-				fatal_exit("%s: \"%s\" does not exist in chrootdir %s", 
-					desc, p->str, chrootdir);
-			}
-			old = p->str;
-			/* put in a new full path for continued checking */
-			p->str = strdup(fname_after_chroot(p->str, cfg, 1));
-			free(old);
+		if(p->str && p->str[0] && strncmp(chrootdir, p->str,
+			strlen(chrootdir)) != 0) {
+			fatal_exit("%s: \"%s\" not in chrootdir %s", 
+				desc, p->str, chrootdir);
 		}
 	}
 }

 /** check configuration for errors */
 static void
-morechecks(struct config_file* cfg, char* fname)
+morechecks(struct config_file* cfg)
 {
 	warn_hosts("stub-host", cfg->stubs);
 	warn_hosts("forward-host", cfg->forwards);
@@ -317,50 +209,26 @@ morechecks(struct config_file* cfg, char* fname)
 		cfg->chrootdir[strlen(cfg->chrootdir)-1] == '/')
 		fatal_exit("chootdir %s has trailing slash '/' please remove.",
 			cfg->chrootdir);
-	if(cfg->chrootdir && cfg->chrootdir[0] && 
-		!is_dir(cfg->chrootdir)) {
-		fatal_exit("bad chroot directory");
-	}
-	if(cfg->chrootdir && cfg->chrootdir[0]) {
-		char buf[10240];
-		buf[0] = 0;
-		if(fname[0] != '/') {
-			if(getcwd(buf, sizeof(buf)) == NULL)
-				fatal_exit("getcwd: %s", strerror(errno));
-			strncat(buf, "/", sizeof(buf));
-		}
-		strncat(buf, fname, sizeof(buf));
-		if(strncmp(buf, cfg->chrootdir, strlen(cfg->chrootdir)) != 0)
-			fatal_exit("config file %s is not inside chroot %s",
-				buf, cfg->chrootdir);
-	}
-	if(cfg->directory && cfg->directory[0] && !is_dir(
-		fname_after_chroot(cfg->directory, cfg, 0))) {
-		fatal_exit("bad chdir directory");
-	}
-	if( (cfg->chrootdir && cfg->chrootdir[0]) ||
-	    (cfg->directory && cfg->directory[0])) {
-		if(cfg->pidfile && cfg->pidfile[0] &&
-		   basedir(cfg->pidfile, cfg) &&
-		   !is_dir(basedir(cfg->pidfile, cfg))) {
-			fatal_exit("pidfile directory does not exist");
-		}
-		if(cfg->logfile && cfg->logfile[0] &&
-		   basedir(cfg->logfile, cfg) &&
-		   !is_dir(basedir(cfg->logfile, cfg))) {
-			fatal_exit("logfile directory does not exist");
-		}
-	}
-
+	if(cfg->chrootdir && strncmp(cfg->chrootdir, cfg->directory,
+		strlen(cfg->chrootdir)) != 0)
+		fatal_exit("working directory %s not in chrootdir %s",
+			cfg->directory, cfg->chrootdir);
+	if(cfg->chrootdir && cfg->pidfile && cfg->pidfile[0] &&
+		strncmp(cfg->chrootdir, cfg->pidfile,
+			strlen(cfg->chrootdir)) != 0)
+		fatal_exit("pid file %s not in chrootdir %s",
+			cfg->pidfile, cfg->chrootdir);
+	if(cfg->chrootdir && cfg->logfile && cfg->logfile[0] &&
+		strncmp(cfg->chrootdir, cfg->logfile,
+			strlen(cfg->chrootdir)) != 0)
+		fatal_exit("log file %s not in chrootdir %s",
+			cfg->logfile, cfg->chrootdir);
 	check_chroot_filelist("file with root-hints", 
-		cfg->root_hints, cfg->chrootdir, cfg);
+		cfg->root_hints, cfg->chrootdir);
 	check_chroot_filelist("trust-anchor-file", 
-		cfg->trust_anchor_file_list, cfg->chrootdir, cfg);
+		cfg->trust_anchor_file_list, cfg->chrootdir);
 	check_chroot_filelist("trusted-keys-file", 
-		cfg->trusted_keys_file_list, cfg->chrootdir, cfg);
-	/* remove chroot setting so that modules are not stripping pathnames*/
-	free(cfg->chrootdir);
-	cfg->chrootdir = NULL;
+		cfg->trusted_keys_file_list, cfg->chrootdir);
 	
 	if(strcmp(cfg->module_conf, "iterator") != 0 &&
 		strcmp(cfg->module_conf, "validator iterator") != 0) {
@@ -389,7 +257,7 @@ checkconf(char* cfgfile)
 		config_delete(cfg);
 		exit(1);
 	}
-	morechecks(cfg, cfgfile);
+	morechecks(cfg);
 	check_mod(cfg, iter_get_funcblock());
 	check_mod(cfg, val_get_funcblock());
 	config_delete(cfg);
@@ -53,7 +53,6 @@ usage()
 {
 	printf("Usage:	unbound-host [-vdh] [-c class] [-t type] hostname\n");
 	printf("                     [-y key] [-f keyfile] [-F namedkeyfile]\n");
-	printf("                     [-C configfile]\n");
 	printf("  Queries the DNS for information.\n");
 	printf("  The hostname is looked up for IP4, IP6 and mail.\n");
 	printf("  If an ip-address is given a reverse lookup is done.\n");
@@ -64,7 +63,6 @@ usage()
 	printf("			-y 'example.com DS 31560 5 1 1CFED8478...'\n");
 	printf("    -f keyfile		read trust anchors from file, with lines as -y.\n");
 	printf("    -F keyfile		read named.conf-style trust anchors.\n");
-	printf("    -C config		use the specified unbound.conf\n");
 	printf("    -v			be more verbose, shows nodata and security.\n");
 	printf("    -d			debug, traces the action, -d -d shows more.\n");
 	printf("    -h			show this usage help.\n");
@@ -380,16 +378,6 @@ lookup(struct ub_ctx* ctx, const char* nm, const char* qt, const char* qc)
 	free(realq);
 }

-/** print error if any */
-static void
-check_ub_res(int r)
-{
-	if(r != 0) {
-		fprintf(stderr, "error: %s\n", ub_strerror(r));
-		exit(1);
-	}
-}
-
 /** getopt global, in case header files fail to declare it. */
 extern int optind;
 /** getopt global, in case header files fail to declare it. */
@@ -411,19 +399,16 @@ int main(int argc, char* argv[])
 	}

 	/* parse the options */
-	while( (c=getopt(argc, argv, "F:c:df:ht:vy:C:")) != -1) {
+	while( (c=getopt(argc, argv, "F:c:df:ht:vy:")) != -1) {
 		switch(c) {
 		case 'c':
 			qclass = optarg;
 			break;
-		case 'C':
-			check_ub_res(ub_ctx_config(ctx, optarg));
-			break;
 		case 'd':
 			debuglevel++;
 			if(debuglevel < 2) 
 				debuglevel = 2; /* at least VERB_DETAIL */
-			check_ub_res(ub_ctx_debuglevel(ctx, debuglevel));
+			ub_ctx_debuglevel(ctx, debuglevel);
 			break;
 		case 't':
 			qtype = optarg;
@@ -432,13 +417,13 @@ int main(int argc, char* argv[])
 			verb++;
 			break;
 		case 'y':
-			check_ub_res(ub_ctx_add_ta(ctx, optarg));
+			ub_ctx_add_ta(ctx, optarg);
 			break;
 		case 'f':
-			check_ub_res(ub_ctx_add_ta_file(ctx, optarg));
+			ub_ctx_add_ta_file(ctx, optarg);
 			break;
 		case 'F':
-			check_ub_res(ub_ctx_trustedkeys(ctx, optarg));
+			ub_ctx_trustedkeys(ctx, optarg);
 			break;
 		case '?':
 		case 'h':
@@ -216,16 +216,6 @@ ext_check_result(const char* desc, int err, struct ub_result* result)
 				"wrong.\n", desc);
 			exit(1);
 		}
-		if(result->answer_packet == NULL) {
-			printf("%s: error result->answer_packet is NULL.\n", 
-				desc);
-			exit(1);
-		}
-		if(result->answer_len != 54) {
-			printf("%s: error result->answer_len is wrong.\n", 
-				desc);
-			exit(1);
-		}
 	}
 }

@@ -283,9 +273,7 @@ ext_thread(void* arg)
 			if(i > 100) {
 				r = ub_cancel(inf->ctx, async_ids[i-100]);
 				checkerr("ub_cancel", r);
-			}
-			if(i > 200) {
-				async_ids[i-200]=0;
+				async_ids[i-100]=0;
 			}
 		} else if(inf->thread_num > NUMTHR/2) {
 			/* async */
@@ -298,7 +286,6 @@ ext_thread(void* arg)
 			r = ub_resolve(inf->ctx, inf->argv[i%inf->argc], 
 				LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN, &result);
 			ext_check_result("ub_resolve", r, result);
-			ub_resolve_free(result);
 		}
 	}
 	if(inf->thread_num > NUMTHR/2) {
@@ -2,14 +2,12 @@

 NEED_SPLINT='00-lint.tpkg'
 NEED_DOXYGEN='01-doc.tpkg'
-NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg fwd_ancil.tpkg stat_timer.tpkg 05-asynclook.tpkg stream_tcp.tpkg speed_cache.tpkg fwd_oneport.tpkg fwd_udptmout.tpkg fwd_waitudp.tpkg'
+NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg fwd_ancil.tpkg stat_timer.tpkg 05-asynclook.tpkg stream_tcp.tpkg'
 NEED_XXD='fwd_compress_c00c.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg'
-NEED_CURL='06-ianaports.tpkg'

 cd testdata;
 sh ../testcode/mini_tpkg.sh clean
-rm -f .perfstats.txt
 for test in `ls *.tpkg`; do
 	SKIP=0
 	if echo $NEED_SPLINT | grep $test >/dev/null; then
@@ -22,11 +20,6 @@ for test in `ls *.tpkg`; do
 			SKIP=1;
 		fi
 	fi
-	if echo $NEED_CURL | grep $test >/dev/null; then
-		if test ! -x "`which curl`"; then
-			SKIP=1;
-		fi
-	fi
 	if echo $NEED_LDNS_TESTNS | grep $test >/dev/null; then
 		if test ! -x "`which ldns-testns`"; then
 			SKIP=1;
@@ -50,4 +43,3 @@ for test in `ls *.tpkg`; do
 	fi
 done
 sh ../testcode/mini_tpkg.sh report
-cat .perfstats.txt
@@ -592,14 +592,6 @@ comm_base_delete(struct comm_base* b)
 	free(runtime);
 }

-void
-comm_base_timept(struct comm_base* b, uint32_t** tt, struct timeval** tv)
-{
-	struct replay_runtime* runtime = (struct replay_runtime*)b;
-	*tt = &runtime->now_secs;
-	*tv = &runtime->now_tv;
-}
-
 void 
 comm_base_dispatch(struct comm_base* b)
 {
@@ -684,11 +676,9 @@ struct outside_network*
 outside_network_create(struct comm_base* base, size_t bufsize, 
 	size_t ATTR_UNUSED(num_ports), char** ATTR_UNUSED(ifs), 
 	int ATTR_UNUSED(num_ifs), int ATTR_UNUSED(do_ip4), 
-	int ATTR_UNUSED(do_ip6), size_t ATTR_UNUSED(num_tcp), 
-	struct infra_cache* ATTR_UNUSED(infra),
-	struct ub_randstate* ATTR_UNUSED(rnd), 
-	int ATTR_UNUSED(use_caps_for_id), int* ATTR_UNUSED(availports),
-	int ATTR_UNUSED(numavailports))
+	int ATTR_UNUSED(do_ip6), int ATTR_UNUSED(port_base),
+	size_t ATTR_UNUSED(num_tcp), struct infra_cache* ATTR_UNUSED(infra),
+	struct ub_randstate* ATTR_UNUSED(rnd))
 {
 	struct outside_network* outnet =  calloc(1, 
 		sizeof(struct outside_network));
@@ -713,7 +703,8 @@ outside_network_delete(struct outside_network* outnet)
 struct pending* 
 pending_udp_query(struct outside_network* outnet, ldns_buffer* packet,
 	struct sockaddr_storage* addr, socklen_t addrlen, int timeout,
-	comm_point_callback_t* callback, void* callback_arg)
+	comm_point_callback_t* callback, void* callback_arg,
+	struct ub_randstate* ATTR_UNUSED(rnd))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,
@@ -765,7 +756,8 @@ pending_udp_query(struct outside_network* outnet, ldns_buffer* packet,
 struct waiting_tcp* 
 pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 	struct sockaddr_storage* addr, socklen_t addrlen, int timeout,
-	comm_point_callback_t* callback, void* callback_arg)
+	comm_point_callback_t* callback, void* callback_arg,
+	struct ub_randstate* ATTR_UNUSED(rnd))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,
@@ -1,841 +0,0 @@
-/*
- * testcode/harvest.c - debug program to get relevant data to a set of queries.
- *
- * Copyright (c) 2008, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This program downloads relevant DNS data to a set of queries.
- * This means that the queries are asked to root, TLD, SLD servers and
- * the results stored per zone.
- * The following data is pertinent:
- *
- * At each label:
- *	SOA
- *	NS
- *	DNSKEY
- *	DS
- * For the whole query:
- *	the result.
- * For NS-records:
- *	their label data
- *	and the A and AAAA records for it.
- *	(as if the name, with A and AAAA query type is in the list,
- *	 referred to as recursion depth+1)
- * Any NSEC, NSEC3, SOA records or additional data found in answers.
- *
- * All of this is data that would be encountered during an iterative lookup
- * for the queries in the list. It is saved to enable a replay of iterative
- * lookups for performance testing.
- *
- * A number of assumptions are made.
- * 1) configuration is correct.
- *    The parent has the same NS records as the child.
- *    All nameservers carry the same data.
- * 2) EDNS/nonEDNS responses and other behaviour is ignored.
- *    Only the data is saved.
- * This creates a snapshot that represents the data as this resolver saw it.
- */
-
-#include "config.h"
-#include <signal.h>
-#include "libunbound/unbound.h"
-#ifdef HAVE_SYS_STAT_H
-#include <sys/stat.h>
-#endif
-struct todo_item;
-struct labdata;
-
-/** this represents the data that has been collected 
- * as well as a todo list and some settings */
-struct harvest_data {
-	/** the unbound context */
-	struct ub_ctx* ctx;
-
-	/** a tree per label; thus this first one is one root entry,
-	 * that has a tree of TLD labels. Those have trees of SLD labels. */
-	struct labdata* root;
-	/** the original query list */
-	struct todo_item* orig_list;
-	/** the query list todo */
-	struct todo_item* todo_list;
-	/** last item in todo list */
-	struct todo_item* todo_last;
-	/** number of todo items */
-	int numtodo;
-
-	/** where to store the results */
-	char* resultdir;
-	/** maximum recursion depth */
-	int maxdepth;
-	/** current recursion depth */
-	int curdepth;
-
-	/** max depth of labels */
-	int maxlabels;
-	/** number of RRs stored */
-	int num_rrs;
-	/** number of zones written */
-	int num_zones;
-};
-
-/**
- * Todo item
- */
-struct todo_item {
-	/** the next item */
-	struct todo_item* next;
-
-	/** query as rdf */
-	ldns_rdf* qname;
-	/** the query type */
-	int qtype;
-	/** query class */
-	int qclass;
-
-	/** recursion depth of todo item (orig list is 0) */
-	int depth;
-	/** the label associated with the query */
-	struct labdata* lab;
-};
-
-/** 
- * Every label has a sest of sublabels, that have sets of sublabels ...
- * Per label is stored also a set of data items, and todo information
- */
-struct labdata {
-	/** node in ldns rbtree */
-	ldns_rbnode_t node;
-	/** the name of this label */
-	ldns_rdf* label;
-	/** full name of point in domain tree */
-	ldns_rdf* name;
-
-	/** parent in label tree (NULL for root) */
-	struct labdata* parent;
-	/** tree of sublabels (if any) */
-	ldns_rbtree_t* sublabels;
-
-	/** list of RRs for this label */
-	ldns_rr_list* rrlist;
-	/** have queries for this label been queued */
-	int done;
-};
-
-/** usage information for harvest */
-static void usage(char* nm) 
-{
-	printf("usage: %s [options]\n", nm);
-	printf("-f fnm	query list to read from file\n");
-	printf("	every line has format: qname qclass qtype\n");
-	printf("-v 	verbose (-v -v even more)\n");
-	printf("-C cfg	config file with resolver options\n");
-	exit(1);
-}
-
-/** verbosity for harvest */
-static int hverb = 0;
-
-/** exit with error */
-static void error_exit(char* str)
-{
-	printf("error: %s\n", str);
-	exit(1);
-}
-
-/** read a query file */
-static void
-qlist_read_file(struct harvest_data* data, char* fname)
-{
-	char buf[1024];
-	char nm[1024], cl[1024], tp[1024];
-	int r;
-	int num = 0;
-	FILE* in = fopen(fname, "r");
-	struct todo_item* t;
-	if(!in) {
-		perror(fname);
-		error_exit("could not open file");
-	}
-	while(fgets(buf, (int)sizeof(buf), in)) {
-		if(buf[0] == 0) continue;
-		if(buf[0] == '\n') continue;
-		/* allow some comments */
-		if(buf[0] == ';') continue;
-		if(buf[0] == '#') continue;
-		nm[0] = 0; cl[0] = 0; tp[0] = 0;
-		r = sscanf(buf, " %1023s %1023s %1023s", nm, cl, tp);
-		if(r == 0) continue;
-		t = (struct todo_item*)calloc(1, sizeof(*t));
-		if(!t) error_exit("out of memory");
-		t->qname = ldns_dname_new_frm_str(nm);
-		if(!t->qname) {
-			printf("parse error: %s\n", nm);
-			error_exit("bad qname");
-		}
-		t->depth = 0;
-		t->qtype = LDNS_RR_TYPE_A;
-		t->qclass = LDNS_RR_CLASS_IN;
-		if(r >= 2) {
-			if(strcmp(cl, "IN") == 0 || strcmp(cl, "CH") == 0)
-				t->qclass = ldns_get_rr_class_by_name(cl);
-			else	t->qtype = ldns_get_rr_type_by_name(cl);
-		}
-		if(r >= 3) {
-			if(strcmp(tp, "IN") == 0 || strcmp(tp, "CH") == 0)
-				t->qclass = ldns_get_rr_class_by_name(tp);
-			else	t->qtype = ldns_get_rr_type_by_name(tp);
-		}
-		num++;
-
-		t->next = data->orig_list;
-		data->orig_list = t;
-	}
-	printf("read %s: %d queries\n", fname, num);
-	fclose(in);
-}
-
-/** compare two labels */
-static int
-lab_cmp(const void *x, const void *y)
-{
-	return ldns_dname_compare((const ldns_rdf*)x, (const ldns_rdf*)y);
-}
-
-/** create label entry */
-static struct labdata*
-lab_create(char* name)
-{
-	struct labdata* lab = (struct labdata*)calloc(1, sizeof(*lab));
-	if(!lab) error_exit("out of memory");
-	lab->label = ldns_dname_new_frm_str(name);
-	if(!lab->label) error_exit("out of memory");
-	lab->name = ldns_dname_new_frm_str(name);
-	if(!lab->name) error_exit("out of memory");
-	lab->node.key = lab->label;
-	lab->node.data = lab;
-	lab->sublabels = ldns_rbtree_create(lab_cmp);
-	if(!lab->sublabels) error_exit("out of memory");
-	lab->rrlist = ldns_rr_list_new();
-	if(!lab->rrlist) error_exit("out of memory");
-
-	return lab;
-}
-
-/** for this name, lookup the label, create if does not exist */
-static struct labdata*
-find_create_lab(struct harvest_data* data, ldns_rdf* name)
-{
-	struct labdata* lab = data->root;
-	struct labdata* nextlab;
-	ldns_rdf* next;
-	uint8_t numlab = ldns_dname_label_count(name);
-	if((int)numlab > data->maxlabels)
-		data->maxlabels = (int)numlab;
-	while(numlab--) {
-		next = ldns_dname_label(name, numlab);
-		if(!next) error_exit("ldns_dname_label");
-		
-		nextlab = (struct labdata*)
-			ldns_rbtree_search(lab->sublabels, next);
-		if(!nextlab) {
-			/* create it */
-			nextlab = (struct labdata*)calloc(1, sizeof(*lab));
-			if(!nextlab) error_exit("out of memory");
-			nextlab->label = ldns_rdf_clone(next);
-			if(!nextlab->label) error_exit("out of memory");
-			nextlab->node.key = nextlab->label;
-			nextlab->node.data = nextlab;
-			nextlab->sublabels = ldns_rbtree_create(lab_cmp);
-			if(!nextlab->sublabels) error_exit("out of memory");
-			nextlab->parent = lab;
-			nextlab->name = ldns_rdf_clone(next);
-			if(!nextlab->name) error_exit("out of memory");
-			if(ldns_dname_cat(nextlab->name, lab->name) 
-				!= LDNS_STATUS_OK) error_exit("outofmem");
-			nextlab->rrlist = ldns_rr_list_new();
-			if(!nextlab->rrlist) error_exit("out of memory");
-			(void)ldns_rbtree_insert(lab->sublabels, 
-				&nextlab->node);
-			if(hverb) {
-				printf("new label: ");
-				ldns_rdf_print(stdout, nextlab->name);
-				printf("\n");
-			}
-		}
-		lab = nextlab;
-		ldns_rdf_deep_free(next);
-	}
-	return lab;
-}
-
-/** for given query, create todo items, and labels if needed */
-static void
-new_todo_item(struct harvest_data* data, ldns_rdf* qname, int qtype, 
-	int qclass, int depth)
-{
-	struct labdata* lab = find_create_lab(data, qname);
-	struct todo_item* it;
-	if(!lab) error_exit("out of memory creating new label");
-	it = (struct todo_item*)calloc(1, sizeof(*it));
-	it->qname = ldns_rdf_clone(qname);
-	it->qtype = qtype;
-	it->qclass = qclass;
-	it->depth = depth;
-	it->lab = lab;
-	it->next = NULL;
-	if(data->todo_last)
-		data->todo_last->next = it;
-	else data->todo_list = it;
-	data->todo_last = it;
-	data->numtodo ++;
-	if(hverb >= 2) {
-		printf("new todo: ");
-		ldns_rdf_print(stdout, it->qname);
-		if(ldns_rr_descript((uint16_t)it->qtype) && 
-			ldns_rr_descript((uint16_t)it->qtype)->_name)
-			printf(" %s", ldns_rr_descript((uint16_t)
-			it->qtype)->_name);
-		if(ldns_lookup_by_id(ldns_rr_classes, it->qclass) && 
-			ldns_lookup_by_id(ldns_rr_classes, it->qclass)->name) 
-			printf(" %s", ldns_lookup_by_id(ldns_rr_classes, 
-				it->qclass)->name);
-		printf("\n");
-	}
-}
-
-/** add infra todo items for this query */
-static void
-new_todo_infra(struct harvest_data* data, struct labdata* startlab, int depth)
-{
-	struct labdata* lab;
-	for(lab = startlab; lab; lab = lab->parent) {
-		if(lab->done)
-			return;
-		new_todo_item(data, lab->name, LDNS_RR_TYPE_NS, 
-			LDNS_RR_CLASS_IN, depth);
-		new_todo_item(data, lab->name, LDNS_RR_TYPE_SOA, 
-			LDNS_RR_CLASS_IN, depth);
-		new_todo_item(data, lab->name, LDNS_RR_TYPE_DNSKEY, 
-			LDNS_RR_CLASS_IN, depth);
-		new_todo_item(data, lab->name, LDNS_RR_TYPE_DS, 
-			LDNS_RR_CLASS_IN, depth);
-		new_todo_item(data, lab->name, LDNS_RR_TYPE_A, 
-			LDNS_RR_CLASS_IN, depth);
-		new_todo_item(data, lab->name, LDNS_RR_TYPE_AAAA, 
-			LDNS_RR_CLASS_IN, depth);
-		lab->done = 1;
-	}
-}
-
-/** make todo items for initial data */
-static void
-make_todo(struct harvest_data* data)
-{
-	struct todo_item* it;
-	for(it=data->orig_list; it; it = it->next) {
-		/* create todo item for this query itself */
-		new_todo_item(data, it->qname, it->qtype, it->qclass, 0);
-		/* create todo items for infra queries to support it */
-		new_todo_infra(data, data->todo_list->lab, 
-			data->todo_list->depth);
-	}
-}
-
-/** store RR and make new work items for it if needed */
-static void
-process_rr(struct harvest_data* data, ldns_rr* rr, int depth)
-{
-	/* must free or store rr */
-	struct labdata* lab = find_create_lab(data, ldns_rr_owner(rr));
-	if(!lab) error_exit("cannot find/create label");
-	/* generate extra queries */
-	if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NS) {
-		new_todo_infra(data, find_create_lab(data, 
-			ldns_rr_ns_nsdname(rr)), depth+1);
-	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_MX) {
-		new_todo_infra(data, find_create_lab(data, 
-			ldns_rr_mx_exchange(rr)), depth+1);
-	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA) {
-		new_todo_infra(data, find_create_lab(data, 
-			ldns_rr_rdf(rr, 0)), depth+1);
-	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_CNAME) {
-		int t = ldns_rr_get_type(rr);
-		if(t!=LDNS_RR_TYPE_A && t!=LDNS_RR_TYPE_AAAA &&
-			t!=LDNS_RR_TYPE_SOA && t!=LDNS_RR_TYPE_NS &&
-			t!=LDNS_RR_TYPE_DS && t!=LDNS_RR_TYPE_DNSKEY)
-			new_todo_item(data, ldns_rr_rdf(rr, 0), t,
-				ldns_rr_get_class(rr), depth+1);
-			/* can get caught in CNAME loop, but depth will
-			 * catch that; unbound cache helps too(servfails on
-			 * a cname loop) */
-		new_todo_infra(data, find_create_lab(data, 
-			ldns_rr_rdf(rr, 0)), depth+1);
-	}
-	/* store it */
-	if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NSEC) {
-		/* find correct zone to store NSEC in (for delegation zones) */
-		if(ldns_dname_compare(ldns_rr_rdf(rr, 0), ldns_rr_owner(rr))
-			== 0) {
-			/* store at the single name = apex */
-		} else if(!ldns_dname_is_subdomain(ldns_rr_rdf(rr, 0), 
-			ldns_rr_owner(rr)) && lab->parent) {
-			/* if   owner NSEC subdomain-of-owner then
-		 	 * store at owner (owner is apex or empty nonterminal).
-		 	 * Otherwise at owner parent. */
-			lab = lab->parent;
-		}
-	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_DS) {
-		/* store DSes in parent zone */
-		if(lab->parent)
-			lab = lab->parent;
-	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NSEC3) {
-		/* store NSEC3s one label up at zone apex */
-		if(lab->parent)
-			lab = lab->parent;
-	}
-	/* we assume NS set is equal across parent-child border. */
-
-	if(!ldns_rr_list_contains_rr(lab->rrlist, rr)) {
-		if(hverb >= 2) {
-			printf("store RR ");
-			ldns_rr_print(stdout, rr);
-			printf("\n");
-		}
-		if(!ldns_rr_list_push_rr(lab->rrlist, rr))
-			error_exit("outofmem ldns_rr_list_push_rr");
-		data->num_rrs++;
-	} else {
-		if(hverb >= 2) {
-			printf("duplicate RR ");
-			ldns_rr_print(stdout, rr);
-			printf("\n");
-		}
-		ldns_rr_free(rr);
-	}
-}
-
-/** store RRs and make new work items if needed */
-static void
-process_pkt(struct harvest_data* data, ldns_pkt* pkt, int depth)
-{
-	size_t i;
-	ldns_rr_list* list;
-	list = ldns_pkt_get_section_clone(pkt, LDNS_SECTION_ANY_NOQUESTION);
-	if(!list) error_exit("outofmemory");
-	for(i=0; i<ldns_rr_list_rr_count(list); i++) {
-		process_rr(data, ldns_rr_list_rr(list, i), depth);
-	}
-	ldns_rr_list_free(list);
-}
-
-/** process a todo item */
-static void
-process(struct harvest_data* data, struct todo_item* it)
-{
-	int r;
-	char* nm;
-	struct ub_result* result = NULL;
-	ldns_pkt* pkt = NULL;
-	ldns_status s;
-	if(hverb) {
-		printf("process: ");
-		ldns_rdf_print(stdout, it->qname);
-		if(ldns_rr_descript((uint16_t)it->qtype) && 
-			ldns_rr_descript((uint16_t)it->qtype)->_name)
-			printf(" %s", ldns_rr_descript((uint16_t)
-			it->qtype)->_name);
-		if(ldns_lookup_by_id(ldns_rr_classes, it->qclass) && 
-			ldns_lookup_by_id(ldns_rr_classes, it->qclass)->name) 
-			printf(" %s", ldns_lookup_by_id(ldns_rr_classes, 
-				it->qclass)->name);
-		printf("\n");
-	}
-	/* do lookup */
-	nm = ldns_rdf2str(it->qname);
-	if(!nm) error_exit("ldns_rdf2str");
-	r = ub_resolve(data->ctx, nm, it->qtype, it->qclass, &result);
-	if(r != 0) {
-		printf("ub_resolve(%s, %d, %d): %s\n", nm, it->qtype, 
-			it->qclass, ub_strerror(r));
-		free(nm);
-		return;
-	}
-	if(result->rcode == LDNS_RCODE_SERVFAIL) {
-		free(nm);
-		return;
-	}
-	/* even if result is a negative, try to store resulting SOA/NSEC */
-
-	/* create ldns pkt */
-	s = ldns_wire2pkt(&pkt, result->answer_packet, 
-		(size_t)result->answer_len);
-	if(s != LDNS_STATUS_OK) {
-		printf("ldns_wire2pkt failed! %s %d %d %s %d\n", nm, 
-			it->qtype, it->qclass, ldns_get_errorstr_by_id(s),
-			result->answer_len);
-		free(nm);
-		return;
-	}
-	if(hverb >= 2) {
-		printf("answer: ");
-		ldns_pkt_print(stdout, pkt);
-		printf("\n");
-	}
-	/* process results */
-	process_pkt(data, pkt, it->depth);
-
-	ldns_pkt_free(pkt);
-	free(nm);
-	ub_resolve_free(result);
-}
-
-/** perform main harvesting */
-static void
-harvest_main(struct harvest_data* data)
-{
-	struct todo_item* it;
-	int numdone = 0;
-	/* register todo queries for all original queries */
-	make_todo(data);
-	printf("depth 0: done %d todo %d\n", 0, data->numtodo);
-	/* pick up a todo item and process it */
-	while(data->todo_list) {
-		numdone++;
-		it = data->todo_list;
-		data->todo_list = it->next;
-		if(!data->todo_list) data->todo_last = NULL;
-		if(numdone%1000==0 || it->depth > data->curdepth) {
-			data->curdepth = it->depth;
-			printf("depth %d: done %d todo %d, %d rrs\n", 
-				it->depth, numdone, data->numtodo, 
-				data->num_rrs);
-		}
-		if(it->depth >= data->maxdepth) {
-			printf("obtained %d rrs to a max of %d labels.\n",
-				data->num_rrs, data->maxlabels);
-			return;
-		}
-		data->numtodo--;
-		process(data, it);
-		usleep(1000000/100);
-	}
-}
-
-/** create directory if it does not exist */
-static void
-hv_mkdir(char* dir)
-{
-	if(mkdir(dir, 0755) == -1) {
-		if(errno == EEXIST)
-			return;
-		perror(dir);
-		error_exit("mkdir failed");
-	}
-}
-
-
-/** see if rrlist contains a SOA record */
-static ldns_rr*
-has_SOA(ldns_rr_list* list)
-{
-	size_t i;
-	for(i=0; i<ldns_rr_list_rr_count(list); i++) {
-		if(ldns_rr_get_type(ldns_rr_list_rr(list, i)) 
-			== LDNS_RR_TYPE_SOA)
-			return ldns_rr_list_rr(list, i);
-	}
-	return NULL;
-}
-
-/** write moredata for a zone*/
-static void
-write_moredata(struct harvest_data* data, struct labdata* zone,
-	FILE *f, struct labdata* thislab, ldns_rr* nslist)
-{
-	struct labdata* lab;
-	size_t i;
-	ldns_rr* ns;
-	LDNS_RBTREE_FOR(lab, struct labdata*, thislab->sublabels) {
-		if(has_SOA(lab->rrlist)) {
-			/* copy only NS glue */
-			for(i=0; i<ldns_rr_list_rr_count(lab->rrlist); i++) {
-				ns = ldns_rr_list_rr(lab->rrlist, i);
-				if(ldns_rr_get_type(ns) == LDNS_RR_TYPE_NS) {
-					ldns_rr_print(f, ns);
-					if(ldns_dname_is_subdomain(
-						ldns_rr_ns_nsdname(ns), 
-						lab->name)) {
-						ldns_rr_push_rdf(nslist, 
-							ldns_rdf_clone(
-							ldns_rr_ns_nsdname(ns)));
-					}
-				}
-			}
-		} else {
-			/* copy all, recurse */
-			for(i=0; i<ldns_rr_list_rr_count(lab->rrlist); i++) {
-				ldns_rr_print(f, 
-					ldns_rr_list_rr(lab->rrlist, i));
-			}
-			write_moredata(data, zone, f, lab, nslist);
-		}
-	}
-}
-
-/** find and write glue into zone file */
-static void
-write_glue(struct harvest_data* data, struct labdata* thislab, FILE* f, 
-	ldns_rdf* name, int dep)
-{
-	size_t i;
-	struct labdata* lab;
-	ldns_rr* rr;
-	if(ldns_dname_compare(name, thislab->name) == 0) {
-		/* this is it! Did we go outside the zone? */
-		if(dep == 0)
-			return;
-		/* find A and AAAA */
-		for(i=0; i<ldns_rr_list_rr_count(thislab->rrlist); i++) {
-			rr = ldns_rr_list_rr(thislab->rrlist, i);
-			if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_A ||
-			   ldns_rr_get_type(rr) == LDNS_RR_TYPE_AAAA) {
-				ldns_rr_print(f, rr);
-			}
-		}
-		return;
-	}
-	/* recurse deeper */
-	LDNS_RBTREE_FOR(lab, struct labdata*, thislab->sublabels) {
-		if(has_SOA(lab->rrlist)) {
-			write_glue(data, lab, f, name, dep+1);
-		} else {
-			write_glue(data, lab, f, name, dep);
-		}
-	}
-}
-
-/** write zonefile for zone at this apex */
-static void
-write_zonefile(struct harvest_data* data, int dep, FILE* zlist, 
-	struct labdata* apex, ldns_rr* soa)
-{
-	FILE *f;
-	char fname[1024];
-	char* zname = ldns_rdf2str(apex->name);
-	time_t tm = time(NULL);
-	size_t i;
-	ldns_rr* nslist;
-	if(!zname) error_exit("out of mem ldns_rdf2str");
-	if(strcmp(zname, ".") == 0)
-		snprintf(fname, sizeof(fname), "l%d/root.zone", dep);
-	else	snprintf(fname, sizeof(fname), "l%d/%szone", dep, zname);
-
-	fprintf(zlist, "zone: name: \"%s\" %s%szonefile: \"%s\"\n",
-		zname, 
-		strlen(zname)/8<1?"\t":"",
-		strlen(zname)/8<2?"\t":"",
-		fname);
-
-	if(hverb) printf("writing %s\n", fname);
-	f = fopen(fname, "w");
-	if(!f) {
-		perror(fname);
-		error_exit("cannot open zone file");
-	}
-	fprintf(f, "; %s - generated by harvest program.\n", fname);
-	fprintf(f, "; zone name %s - this is a partial snapshot of "
-		"data relevant to the query list.\n", zname);
-	fprintf(f, "; created %u - date %s\n", (unsigned)tm, ctime(&tm));
-	ldns_rr_print(f, soa);
-	fprintf(f, "\n");
-	for(i=0; i<ldns_rr_list_rr_count(apex->rrlist); i++) {
-		if(ldns_rr_get_type(ldns_rr_list_rr(apex->rrlist, i))
-			== LDNS_RR_TYPE_SOA) continue;
-		ldns_rr_print(f, ldns_rr_list_rr(apex->rrlist, i));
-	}
-	/* search for more data - subdomains inside the zone, NS glue */
-	nslist = ldns_rr_new();
-	if(!nslist) error_exit("out of memory");
-	fprintf(f, "; end of apex, more data follows\n");
-	write_moredata(data, apex, f, apex, nslist);
-
-	/* add NS from apex that need glue too */
-	for(i=0; i<ldns_rr_list_rr_count(apex->rrlist); i++) {
-		if(ldns_rr_get_type(ldns_rr_list_rr(apex->rrlist, i)) !=
-			LDNS_RR_TYPE_NS)
-			continue;
-		/* these are only added again if in a subzone */
-		if(ldns_dname_is_subdomain(ldns_rr_ns_nsdname(
-			ldns_rr_list_rr(apex->rrlist, i)), apex->name)) {
-			ldns_rr_push_rdf(nslist, ldns_rdf_clone(
-				ldns_rr_ns_nsdname(ldns_rr_list_rr(
-				apex->rrlist, i))));
-		}
-	}
-
-	fprintf(f, "; glue data follows\n");
-	/* lookup and add glue (if not already in zone) */
-	for(i=0; i<ldns_rr_rd_count(nslist); i++) {
-		write_glue(data, apex, f, ldns_rr_rdf(nslist, i), 0);
-	}
-
-	fclose(f);
-	ldns_rr_free(nslist);
-	free(zname);
-}
-
-/** create zones at depth d in label tree */
-static void
-create_zones(struct harvest_data* data, int dep, FILE* zlist, 
-	struct labdata* labnow, int depnow)
-{
-	struct labdata* s;
-	ldns_rr* soa;
-	if(depnow == dep) {
-		/* see if this is a zone start - a SOA */
-		if((soa=has_SOA(labnow->rrlist))) {
-			write_zonefile(data, dep, zlist, labnow, soa);
-			data->num_zones++;
-		}
-		return;
-	}
-	/* recurse */
-	LDNS_RBTREE_FOR(s, struct labdata*, labnow->sublabels) {
-		create_zones(data, dep, zlist, s, depnow+1);
-	}
-}
-
-/** sort rrlists */
-static void
-harvest_sort(struct labdata* lab)
-{
-	struct labdata* s;
-	/* prettier output if sorted here */
-	ldns_rr_list_sort(lab->rrlist);
-	/* and recurse */
-	LDNS_RBTREE_FOR(s, struct labdata*, lab->sublabels) {
-		harvest_sort(s);
-	}
-}
-
-/** output harvested results */
-static void
-harvest_output(struct harvest_data* data)
-{
-	int d;
-	char buf[20];
-	FILE* zlist;
-	int lastzones;
-	hv_mkdir(data->resultdir);
-	if(chdir(data->resultdir) == -1) {
-		perror(data->resultdir);
-		error_exit("cannot chdir");
-	}
-	harvest_sort(data->root);
-	/* create zones */
-	for(d = 0; d<data->maxlabels; d++) {
-		lastzones = data->num_zones;
-		printf("creating zones %d\n", d);	
-		snprintf(buf, sizeof(buf), "l%d", d);
-		hv_mkdir(buf);
-		snprintf(buf, sizeof(buf), "l%d.zones", d);
-		zlist = fopen(buf, "w");
-		if(!zlist) {
-			perror(buf);
-			error_exit("cannot write zonelist file");
-		}
-		fprintf(zlist, "# partial zones at depth %d\n", d);
-		create_zones(data, d, zlist, data->root, 0);
-		fclose(zlist);
-		printf("creating zones %d - %d zones written\n", d,
-			data->num_zones - lastzones);	
-	}
-}
-
-/** getopt global, in case header files fail to declare it. */
-extern int optind;
-/** getopt global, in case header files fail to declare it. */
-extern char* optarg;
-
-/** main program for harvest */
-int main(int argc, char* argv[]) 
-{
-	struct harvest_data data;
-	char* nm = argv[0];
-	int c;
-
-	/* defaults */
-	memset(&data, 0, sizeof(data));
-	data.ctx = ub_ctx_create();
-	data.resultdir = strdup("harvested_zones");
-	if(!data.resultdir) error_exit("out of memory");
-	data.maxdepth = 2;
-
-	/* parse the options */
-	while( (c=getopt(argc, argv, "hf:vC:")) != -1) {
-		switch(c) {
-		case 'C':
-			if(ub_ctx_config(data.ctx, optarg) != 0)
-				error_exit("config read failed");
-			break;
-		case 'f':
-			qlist_read_file(&data, optarg);
-			break;
-		case 'v':
-			hverb++;
-			break;
-		case '?':
-		case 'h':
-		default:
-			usage(nm);
-		}
-	}
-	argc -= optind;
-	argv += optind;
-	if(argc != 0)
-		usage(nm);
-	if(data.orig_list == NULL)
-		error_exit("No queries to make, use -f (help with -h).");
-	data.root = lab_create(".");
-	if(!data.root) error_exit("out of memory");
-	
-	/* harvest the data */
-	harvest_main(&data);
-	harvest_output(&data);
-
-	/* no cleanup except the context (to close open sockets) */
-	ub_ctx_delete(data.ctx);
-	return 0;
-}
@@ -3,7 +3,7 @@
 *
 * Data storage for specially crafted replies for testing purposes.
 *
- * (c) NLnet Labs, 2005, 2006, 2007, 2008
+ * (c) NLnet Labs, 2005, 2006, 2007
 * See the file LICENSE for the license
 */

@@ -1,614 +0,0 @@
-/*
- * testcode/perf.c - debug program to estimate name server performance.
- *
- * Copyright (c) 2008, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * This program estimates DNS name server performance.
- */
-
-#include "config.h"
-#include <signal.h>
-#include "util/log.h"
-#include "util/locks.h"
-#include "util/net_help.h"
-#include "util/data/msgencode.h"
-#include "util/data/msgreply.h"
-#include "util/data/msgparse.h"
-
-/** usage information for perf */
-static void usage(char* nm) 
-{
-	printf("usage: %s [options] server\n", nm);
-	printf("server: ip address of server, IP4 or IP6.\n");
-	printf("	If not on port %d add @port.\n", UNBOUND_DNS_PORT);
-	printf("-d sec	duration of test in whole seconds (0: wait for ^C)\n");
-	printf("-a str	query to ask, interpreted as a line from qfile\n");
-	printf("-f fnm	query list to read from file\n");
-	printf("	every line has format: qname qclass qtype [+-]{E}\n");
-	printf("	where + means RD set, E means EDNS enabled\n");
-	printf("-q 	quiet mode, print only final qps\n");
-	exit(1);
-}
-
-struct perfinfo;
-struct perfio;
-
-/** Global info for perf */
-struct perfinfo { 
-	/** need to exit */
-	volatile int exit;
-	/** all purpose buffer (for UDP send and receive) */
-	ldns_buffer* buf;
-
-	/** destination */
-	struct sockaddr_storage dest;
-	/** length of dest socket addr */
-	socklen_t destlen;
-
-	/** when did this time slice start */
-	struct timeval since;
-	/** number of queries received in that time */
-	size_t numrecv;
-	/** number of queries sent out in that time */
-	size_t numsent;
-
-	/** duration of test in seconds */
-	int duration;
-	/** quiet mode? */
-	int quiet;
-
-	/** when did the total test start */
-	struct timeval start;
-	/** total number recvd */
-	size_t total_recv;
-	/** total number sent */
-	size_t total_sent;
-	/** numbers by rcode */
-	size_t by_rcode[32];
-	
-	/** number of I/O ports */
-	size_t io_num;
-	/** I/O ports array */
-	struct perfio* io;
-	/** max fd value in io ports */
-	int maxfd;
-	/** readset */
-	fd_set rset;
-
-	/** size of querylist */
-	size_t qlist_size;
-	/** allocated size of qlist array */
-	size_t qlist_capacity;
-	/** list of query packets (data) */
-	uint8_t** qlist_data;
-	/** list of query packets (length of a packet) */
-	size_t* qlist_len;
-	/** index into querylist, for walking the list */
-	size_t qlist_idx;
-};
-
-/** I/O port for perf */
-struct perfio {
-	/** id number */
-	size_t id;
-	/** file descriptor of socket */
-	int fd;
-	/** timeout value */
-	struct timeval timeout;
-	/** ptr back to perfinfo */
-	struct perfinfo* info;
-};
-
-/** number of msec between starting io ports */
-#define START_IO_INTERVAL 10
-/** number of msec timeout on io ports */
-#define IO_TIMEOUT 10
-
-/** signal handler global info */
-static struct perfinfo* sig_info;
-
-/** signal handler for user quit */
-static RETSIGTYPE perf_sigh(int sig)
-{
-	log_assert(sig_info);
-	if(!sig_info->quiet)
-		printf("exit on signal %d\n", sig);
-	sig_info->exit = 1;
-}
-
-/** timeval compare, t1 < t2 */
-static int
-perf_tv_smaller(struct timeval* t1, struct timeval* t2) 
-{
-#ifndef S_SPLINT_S
-	if(t1->tv_sec < t2->tv_sec)
-		return 1;
-	if(t1->tv_sec == t2->tv_sec &&
-		t1->tv_usec < t2->tv_usec)
-		return 1;
-#endif
-	return 0;
-}
-
-/** timeval add, t1 += t2 */
-static void
-perf_tv_add(struct timeval* t1, struct timeval* t2) 
-{
-#ifndef S_SPLINT_S
-	t1->tv_sec += t2->tv_sec;
-	t1->tv_usec += t2->tv_usec;
-	while(t1->tv_usec > 1000000) {
-		t1->tv_usec -= 1000000;
-		t1->tv_sec++;
-	}
-#endif
-}
-
-/** timeval subtract, t1 -= t2 */
-static void
-perf_tv_subtract(struct timeval* t1, struct timeval* t2) 
-{
-#ifndef S_SPLINT_S
-	t1->tv_sec -= t2->tv_sec;
-	if(t1->tv_usec >= t2->tv_usec) {
-		t1->tv_usec -= t2->tv_usec;
-	} else {
-		t1->tv_sec--;
-		t1->tv_usec = 1000000-(t2->tv_usec-t1->tv_usec);
-	}
-#endif
-}
-
-
-/** setup perf test environment */
-static void
-perfsetup(struct perfinfo* info)
-{
-	size_t i;
-	if(gettimeofday(&info->start, NULL) < 0)
-		fatal_exit("gettimeofday: %s", strerror(errno));
-	sig_info = info;
-	if( signal(SIGINT, perf_sigh) == SIG_ERR || 
-		signal(SIGTERM, perf_sigh) == SIG_ERR ||
-		signal(SIGHUP, perf_sigh) == SIG_ERR ||
-		signal(SIGQUIT, perf_sigh) == SIG_ERR)
-		fatal_exit("could not bind to signal");
-	info->io = (struct perfio*)calloc(sizeof(struct perfio), info->io_num);
-	if(!info->io) fatal_exit("out of memory");
-#ifndef S_SPLINT_S
-	FD_ZERO(&info->rset);
-#endif
-	info->since = info->start;
-	for(i=0; i<info->io_num; i++) {
-		info->io[i].id = i;
-		info->io[i].info = info;
-		info->io[i].fd = socket(
-			addr_is_ip6(&info->dest, info->destlen)?
-			AF_INET6:AF_INET, SOCK_DGRAM, 0);
-		if(info->io[i].fd == -1)
-			fatal_exit("socket: %s", strerror(errno));
-		if(info->io[i].fd > info->maxfd)
-			info->maxfd = info->io[i].fd;
-#ifndef S_SPLINT_S
-		FD_SET(info->io[i].fd, &info->rset);
-		info->io[i].timeout.tv_usec = ((START_IO_INTERVAL*i)%1000)
-						*1000;
-		info->io[i].timeout.tv_sec = (START_IO_INTERVAL*i)/1000;
-		perf_tv_add(&info->io[i].timeout, &info->since);
-#endif
-	}
-}
-
-/** cleanup perf test environment */
-static void
-perffree(struct perfinfo* info)
-{
-	size_t i;
-	if(!info) return;
-	if(info->io) {
-		for(i=0; i<info->io_num; i++) {
-			close(info->io[i].fd);
-		}
-		free(info->io);
-	}
-	for(i=0; i<info->qlist_size; i++)
-		free(info->qlist_data[i]);
-	free(info->qlist_data);
-	free(info->qlist_len);
-}
-
-/** send new query for io */
-static void
-perfsend(struct perfinfo* info, size_t n, struct timeval* now)
-{
-	ssize_t r;
-	r = sendto(info->io[n].fd, info->qlist_data[info->qlist_idx],
-		info->qlist_len[info->qlist_idx], 0,
-		(struct sockaddr*)&info->dest, info->destlen);
-	/*log_hex("send", info->qlist_data[info->qlist_idx],
-		info->qlist_len[info->qlist_idx]);*/
-	if(r == -1)
-		log_err("sendto: %s", strerror(errno));
-	else if(r != (ssize_t)info->qlist_len[info->qlist_idx]) {
-		log_err("partial sendto");
-	}
-	info->qlist_idx = (info->qlist_idx+1) % info->qlist_size;
-	info->numsent++;
-
-	info->io[n].timeout.tv_sec = IO_TIMEOUT/1000;
-	info->io[n].timeout.tv_usec = (IO_TIMEOUT%1000)*1000;
-	perf_tv_add(&info->io[n].timeout, now);
-}
-
-/** got reply for io */
-static void
-perfreply(struct perfinfo* info, size_t n, struct timeval* now)
-{
-	ssize_t r;
-	r = recv(info->io[n].fd, ldns_buffer_begin(info->buf),
-		ldns_buffer_capacity(info->buf), 0);
-	if(r == -1) {
-		log_err("recv: %s", strerror(errno));
-	} else {
-		info->by_rcode[LDNS_RCODE_WIRE(ldns_buffer_begin(
-			info->buf))]++;
-		info->numrecv++;
-	}
-	/*ldns_buffer_set_limit(info->buf, r);
-	log_buf(0, "reply", info->buf);*/
-	perfsend(info, n, now);
-}
-
-/** got timeout for io */
-static void
-perftimeout(struct perfinfo* info, size_t n, struct timeval* now)
-{
-	/* may not be a dropped packet, this is also used to start
-	 * up the sending IOs */
-	perfsend(info, n, now);
-}
-
-/** print nice stats about qps */
-static void
-stat_printout(struct perfinfo* info, struct timeval* now, 
-	struct timeval* elapsed)
-{
-	/* calculate qps */
-	double dt, qps = 0;
-#ifndef S_SPLINT_S
-	dt = (double)(elapsed->tv_sec*1000000 + elapsed->tv_usec) / 1000000;
-#endif
-	if(dt > 0.001)
-		qps = (double)(info->numrecv) / dt;
-	if(!info->quiet)
-		printf("qps: %g\n", qps);
-	/* setup next slice */
-	info->since = *now;
-	info->total_sent += info->numsent;
-	info->total_recv += info->numrecv;
-	info->numrecv = 0;
-	info->numsent = 0;
-}
-
-/** wait for new events for performance test */
-static void
-perfselect(struct perfinfo* info)
-{
-	fd_set rset = info->rset;
-	struct timeval timeout, now;
-	int num;
-	size_t i;
-	if(gettimeofday(&now, NULL) < 0)
-		fatal_exit("gettimeofday: %s", strerror(errno));
-	/* time to exit? */
-	if(info->duration > 0) {
-		timeout = now;
-		perf_tv_subtract(&timeout, &info->start);
-		if((int)timeout.tv_sec >= info->duration) {
-			info->exit = 1;
-			return;
-		}
-	}
-	/* time for stats printout? */
-	timeout = now;
-	perf_tv_subtract(&timeout, &info->since);
-	if(timeout.tv_sec > 0) {
-		stat_printout(info, &now, &timeout);
-	}
-	/* see what is closest port to timeout; or if there is a timeout */
-	timeout = info->io[0].timeout;
-	for(i=0; i<info->io_num; i++) {
-		if(perf_tv_smaller(&info->io[i].timeout, &now)) {
-			perftimeout(info, i, &now);
-			return;
-		}
-		if(perf_tv_smaller(&info->io[i].timeout, &timeout)) {
-			timeout = info->io[i].timeout;
-		}
-	}
-	perf_tv_subtract(&timeout, &now);
-	
-	num = select(info->maxfd+1, &rset, NULL, NULL, &timeout);
-	if(num == -1) {
-		if(errno == EAGAIN || errno == EINTR)
-			return;
-		log_err("select: %s", strerror(errno));
-	}
-
-	/* handle new events */
-	for(i=0; num && i<info->io_num; i++) {
-		if(FD_ISSET(info->io[i].fd, &rset)) {
-			perfreply(info, i, &now);
-			num--;
-		}
-	}
-}
-
-/** show end stats */
-static void
-perfendstats(struct perfinfo* info)
-{
-	double dt, qps;
-	struct timeval timeout, now;
-	int i, lost; 
-	if(gettimeofday(&now, NULL) < 0)
-		fatal_exit("gettimeofday: %s", strerror(errno));
-	timeout = now;
-	perf_tv_subtract(&timeout, &info->since);
-	stat_printout(info, &now, &timeout);
-	
-	timeout = now;
-	perf_tv_subtract(&timeout, &info->start);
-	dt = (double)(timeout.tv_sec*1000000 + timeout.tv_usec) / 1000000.0;
-	qps = (double)(info->total_recv) / dt;
-	lost = (int)(info->total_sent - info->total_recv) - (int)info->io_num;
-	if(!info->quiet) {
-		printf("overall time: 	%g sec\n", 
-			(double)timeout.tv_sec + 
-			(double)timeout.tv_usec/1000000.);
-		if(lost > 0) 
-			printf("Packets lost: 	%d\n", (int)lost);
-	
-		for(i=0; i<(int)(sizeof(info->by_rcode)/sizeof(size_t)); i++)
-		{
-			if(info->by_rcode[i] > 0) {
-				printf("%d(%5s): 	%u replies\n",
-					i, ldns_lookup_by_id(ldns_rcodes, i)?
-					ldns_lookup_by_id(ldns_rcodes, 
-					i)->name:"??", 
-					(unsigned)info->by_rcode[i]);
-			}
-		}
-	}
-	printf("average qps: 	%g\n", qps);
-}
-
-/** perform the performance test */
-static void
-perfmain(struct perfinfo* info)
-{
-	perfsetup(info);
-	while(!info->exit) {
-		perfselect(info);
-	}
-	perfendstats(info);
-	perffree(info);
-}
-
-/** parse a query line to a packet into buffer */
-static int
-qlist_parse_line(ldns_buffer* buf, char* p)
-{
-	char nm[1024], cl[1024], tp[1024], fl[1024];
-	int r; 
-	int rec = 1, edns = 0;
-	struct query_info qinfo;
-	ldns_rdf* rdf;
-	nm[0] = 0; cl[0] = 0; tp[0] = 0; fl[0] = 0;
-	r = sscanf(p, " %1023s %1023s %1023s %1023s", nm, cl, tp, fl);
-	if(r != 3 && r != 4)
-		return 0;
-	/*printf("nm='%s', cl='%s', tp='%s', fl='%s'\n", nm, cl, tp, fl);*/
-	if(strcmp(tp, "IN") == 0 || strcmp(tp, "CH") == 0) {
-		qinfo.qtype = ldns_get_rr_type_by_name(cl);
-		qinfo.qclass = ldns_get_rr_class_by_name(tp);
-	} else {
-		qinfo.qtype = ldns_get_rr_type_by_name(tp);
-		qinfo.qclass = ldns_get_rr_class_by_name(cl);
-	}
-	if(fl[0] == '+') rec = 1;
-	else if(fl[0] == '-') rec = 0;
-	else if(fl[0] == 'E') edns = 1;
-	if((fl[0] == '+' || fl[0] == '-') && fl[1] == 'E')
-		edns = 1;
-	rdf = ldns_dname_new_frm_str(nm);
-	if(!rdf)
-		return 0;
-	qinfo.qname = ldns_rdf_data(rdf);
-	qinfo.qname_len = ldns_rdf_size(rdf);
-	qinfo_query_encode(buf, &qinfo);
-	ldns_buffer_write_u16_at(buf, 0, 0); /* zero ID */
-	if(rec) LDNS_RD_SET(ldns_buffer_begin(buf));
-	if(edns) {
-		struct edns_data edns;
-		memset(&edns, 0, sizeof(edns));
-		edns.edns_present = 1;
-		edns.udp_size = EDNS_ADVERTISED_SIZE;
-		/* Set DO bit in all EDNS datagrams ... */
-		edns.bits = EDNS_DO;
-		attach_edns_record(buf, &edns);
-	}
-	ldns_rdf_deep_free(rdf);
-	return 1;
-}
-
-/** grow query list capacity */
-static void
-qlist_grow_capacity(struct perfinfo* info)
-{
-	size_t newcap = (size_t)((info->qlist_capacity==0)?16:
-		info->qlist_capacity*2);
-	uint8_t** d = (uint8_t**)calloc(sizeof(uint8_t*), newcap);
-	size_t* l = (size_t*)calloc(sizeof(size_t), newcap);
-	if(!d || !l) fatal_exit("out of memory");
-	memcpy(d, info->qlist_data, sizeof(uint8_t*)*
-		info->qlist_capacity);
-	memcpy(l, info->qlist_len, sizeof(size_t)*
-		info->qlist_capacity);
-	free(info->qlist_data);
-	free(info->qlist_len);
-	info->qlist_data = d;
-	info->qlist_len = l;
-	info->qlist_capacity = newcap;
-}
-
-/** setup query list in info */
-static void
-qlist_add_line(struct perfinfo* info, char* line, int no)
-{
-	if(!qlist_parse_line(info->buf, line)) {
-		printf("error parsing query %d: %s\n", no, line);
-		exit(1);
-	}
-	ldns_buffer_write_u16_at(info->buf, 0, (uint16_t)info->qlist_size); 
-	if(info->qlist_size + 1 > info->qlist_capacity) {
-		qlist_grow_capacity(info);
-	}
-	info->qlist_len[info->qlist_size] = ldns_buffer_limit(info->buf);
-	info->qlist_data[info->qlist_size] = memdup(
-		ldns_buffer_begin(info->buf), ldns_buffer_limit(info->buf));
-	if(!info->qlist_data[info->qlist_size])
-		fatal_exit("out of memory");
-	info->qlist_size ++;
-}
-
-/** setup query list in info */
-static void
-qlist_read_file(struct perfinfo* info, char* fname)
-{
-	char buf[1024];
-	char *p;
-	FILE* in = fopen(fname, "r");
-	int lineno = 0;
-	if(!in) {
-		perror(fname);
-		exit(1);
-	}
-	while(fgets(buf, (int)sizeof(buf), in)) {
-		lineno++;
-		buf[sizeof(buf)-1] = 0;
-		p = buf;
-		while(*p == ' ' || *p == '\t')
-			p++;
-		if(p[0] == 0 || p[0] == '\n' || p[0] == ';' || p[0] == '#')
-			continue;
-		qlist_add_line(info, p, lineno);
-	}
-	printf("Read %s, got %u queries\n", fname, (unsigned)info->qlist_size);
-	fclose(in);
-}
-
-/** getopt global, in case header files fail to declare it. */
-extern int optind;
-/** getopt global, in case header files fail to declare it. */
-extern char* optarg;
-
-/** main program for perf */
-int main(int argc, char* argv[]) 
-{
-	char* nm = argv[0];
-	int c;
-	struct perfinfo info;
-
-	/* defaults */
-	memset(&info, 0, sizeof(info));
-	info.io_num = 16;
-
-	log_init(NULL, 0, NULL);
-	log_ident_set("perf");
-	checklock_start();
-
-	info.buf = ldns_buffer_new(65553);
-	if(!info.buf) fatal_exit("out of memory");
-
-	/* parse the options */
-	while( (c=getopt(argc, argv, "d:ha:f:q")) != -1) {
-		switch(c) {
-		case 'q':
-			info.quiet = 1;
-			break;
-		case 'd':
-			if(atoi(optarg)==0 && strcmp(optarg, "0")!=0) {
-				printf("-d not a number %s", optarg);
-				return 1;
-			}
-			info.duration = atoi(optarg);
-			break;
-		case 'a':
-			qlist_add_line(&info, optarg, 0);
-			break;
-		case 'f':
-			qlist_read_file(&info, optarg);
-			break;
-		case '?':
-		case 'h':
-		default:
-			usage(nm);
-		}
-	}
-	argc -= optind;
-	argv += optind;
-
-	if(argc != 1) {
-		printf("error: pass server IP address on commandline.\n");
-		usage(nm);
-	}
-	if(!extstrtoaddr(argv[0], &info.dest, &info.destlen)) {
-		printf("Could not parse ip: %s\n", argv[0]);
-		return 1;
-	}
-	if(info.qlist_size == 0) {
-		printf("No queries to make, use -f or -a.\n");
-		return 1;
-	}
-	
-	/* do the performance test */
-	perfmain(&info);
-
-	ldns_buffer_free(info.buf);
-	checklock_stop();
-	return 0;
-}
@@ -226,11 +226,6 @@ struct replay_runtime {
 	/** user argument for incoming query callback */
 	void *cb_arg;

-	/** the current time in seconds */
-	uint32_t now_secs;
-	/** the current time in microseconds */
-	struct timeval now_tv;
-
 	/** signal handler callback */
 	void (*sig_cb)(int, void*);
 	/** signal handler user arg */
@@ -314,7 +314,7 @@ infra_test()
 	size_t zonelen = 13;
 	struct infra_cache* slab;
 	struct config_file* cfg = config_create();
-	uint32_t now = 0;
+	time_t now = 0;
 	int vs, to;
 	struct infra_host_key* k;
 	struct infra_host_data* d;
@@ -394,7 +394,6 @@ main(int argc, char* argv[])
 		return 1;
 	}
 	printf("Start of %s unit test.\n", PACKAGE_STRING);
-	ERR_load_crypto_strings();
 	checklock_start();
 	rnd_test();
 	verify_test();
@@ -410,9 +409,5 @@ main(int argc, char* argv[])
 	msgparse_test();
 	checklock_stop();
 	printf("%d checks ok.\n", testcount);
-	EVP_cleanup();
-	CRYPTO_cleanup_all_ex_data();
-	ERR_remove_state(0);
-	ERR_free_strings();
 	return 0;
 }
@@ -247,76 +247,6 @@ checkformerr(ldns_buffer* pkt)
 	unit_assert(status != LDNS_STATUS_OK);
 }

-/** performance test message encoding */
-static void
-perf_encode(struct query_info* qi, struct reply_info* rep, uint16_t id, 
-	uint16_t flags, ldns_buffer* out, uint32_t timenow, 
-	struct edns_data* edns)
-{
-	static int num = 0;
-	int ret;
-	size_t max = 10000;
-	size_t i;
-	struct timeval start, end;
-	double dt;
-	struct regional* r2 = regional_create();
-	if(gettimeofday(&start, NULL) < 0)
-		fatal_exit("gettimeofday: %s", strerror(errno));
-	/* encode a couple times */
-	for(i=0; i<max; i++) {
-		ret = reply_info_encode(qi, rep, id, flags, out, timenow,
-			r2, 65535, (int)(edns->bits & EDNS_DO) );
-		unit_assert(ret != 0); /* udp packets should fit */
-		attach_edns_record(out, edns);
-		regional_free_all(r2);
-	}
-	if(gettimeofday(&end, NULL) < 0)
-		fatal_exit("gettimeofday: %s", strerror(errno));
-	/* time in millisec */
-	dt = (double)(end.tv_sec - start.tv_sec)*1000. + 
-		((double)end.tv_usec - (double)start.tv_usec)/1000.;
-	printf("[%d] did %u in %g msec for %f encode/sec size %d\n", num++,
-		(unsigned)max, dt, (double)max / (dt/1000.), 
-		(int)ldns_buffer_limit(out));
-	regional_destroy(r2);
-}
-
-/** perf test a packet */
-static void
-perftestpkt(ldns_buffer* pkt, struct alloc_cache* alloc, ldns_buffer* out, 
-	const char* hex)
-{
-	struct query_info qi;
-	struct reply_info* rep = 0;
-	int ret;
-	uint16_t id;
-	uint16_t flags;
-	uint32_t timenow = 0;
-	struct regional* region = regional_create();
-	struct edns_data edns;
-
-	hex_to_buf(pkt, hex);
-	memmove(&id, ldns_buffer_begin(pkt), sizeof(id));
-	if(ldns_buffer_limit(pkt) < 2)
-		flags = 0;
-	else	memmove(&flags, ldns_buffer_at(pkt, 2), sizeof(flags));
-	flags = ntohs(flags);
-	ret = reply_info_parse(pkt, alloc, &qi, &rep, region, &edns);
-	if(ret != 0) {
-		if(vbmp) printf("parse code %d: %s\n", ret, 
-			ldns_lookup_by_id(ldns_rcodes, ret)->name);
-		if(ret == LDNS_RCODE_FORMERR)
-			checkformerr(pkt);
-		unit_assert(ret != LDNS_RCODE_SERVFAIL);
-	} else {
-		perf_encode(&qi, rep, id, flags, out, timenow, &edns);
-	} 
-
-	query_info_clear(&qi);
-	reply_info_parsedelete(rep, alloc);
-	regional_destroy(region);
-}
-
 /** test a packet */
 static void
 testpkt(ldns_buffer* pkt, struct alloc_cache* alloc, ldns_buffer* out, 
@@ -429,12 +359,6 @@ simpletest(ldns_buffer* pkt, struct alloc_cache* alloc, ldns_buffer* out)
 	" 00 01 00 01 00 02 64 b9 00 04 c6 29 00 04 01 4a 0c 52 4f 4f    ;        441- 460\n"
 	" 54 2d 53 45 52 56 45 52 53 03 4e 45 54 00 00 01 00 01 00 02    ;        461- 480\n"
 	" 64 b9 00 04 c0 3a 80 1e  ");
-
-	/* root delegation from unbound trace with new AAAA glue */
-	perftestpkt(pkt, alloc, out,
-	"55BC84000001000D00000014000002000100000200010007E900001401610C726F6F742D73657276657273036E65740000000200010007E90000040162C01E00000200010007E90000040163C01E00000200010007E90000040164C01E00000200010007E90000040165C01E00000200010007E90000040166C01E00000200010007E90000040167C01E00000200010007E90000040168C01E00000200010007E90000040169C01E00000200010007E9000004016AC01E00000200010007E9000004016BC01E00000200010007E9000004016CC01E00000200010007E9000004016DC01EC01C000100010007E9000004C6290004C03B000100010007E9000004C0E44FC9C04A000100010007E9000004C021040CC059000100010007E900000480080A5AC068000100010007E9000004C0CBE60AC077000100010007E9000004C00505F1C086000100010007E9000004C0702404C095000100010007E9000004803F0235C0A4000100010007E9000004C0249411C0B3000100010007E9000004C03A801EC0C2000100010007E9000004C1000E81C0D1000100010007E9000004C707532AC0E0000100010007E9000004CA0C1B21C01C001C00010007E900001020010503BA3E00000000000000020030C077001C00010007E900001020010500002F0000000000000000000FC095001C00010007E90000102001050000010000"
-	"00000000803F0235C0B3001C00010007E9000010200105030C2700000000000000020030C0C2001C00010007E9000010200107FD000000000000000000000001C0E0001C00010007E900001020010DC30000000000000000000000350000291000000000000000"
-	);
 }

 /** simple test of parsing, pcat file */
@@ -263,7 +263,6 @@ verifytest_file(const char* fname, const char* at_date)
 	struct entry* list = read_datafile(fname);
 	struct module_env env;
 	struct val_env ve;
-	uint32_t now = time(NULL);

 	if(!list)
 		fatal_exit("could not read %s: %s", fname, strerror(errno));
@@ -272,7 +271,6 @@ verifytest_file(const char* fname, const char* at_date)
 	memset(&ve, 0, sizeof(ve));
 	env.scratch = region;
 	env.scratch_buffer = buf;
-	env.now = &now;
 	ve.date_override = cfg_convert_timeval(at_date);
 	unit_assert(region && buf);
 	dnskey = extract_keys(list, &alloc, region, buf);
@@ -461,13 +459,6 @@ verify_test()
 {
 	printf("verify test\n");
 	verifytest_file("testdata/test_signatures.1", "20070818005004");
-	verifytest_file("testdata/test_signatures.2", "20080414005004");
-	verifytest_file("testdata/test_signatures.3", "20080416005004");
-	verifytest_file("testdata/test_signatures.4", "20080416005004");
-	verifytest_file("testdata/test_signatures.5", "20080416005004");
-	verifytest_file("testdata/test_signatures.6", "20080416005004");
-	verifytest_file("testdata/test_signatures.7", "20070829144150");
-	verifytest_file("testdata/test_signatures.8", "20070829144150");
 	dstest_file("testdata/test_ds_sig.1");
 	nsectest();
 	nsec3_hash_test("testdata/test_nsec3_hash.1");
@@ -1,98 +0,0 @@
-; config options
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test iterator donotquery of 127/8.
-; The scenario presents an iteration chain that has 127.0.0.2 and
-; 127.255.255.255 as nameserver IPs, like a spam-blocklist.
-; these are 127/8 localhost and should be blocked, causing servfail.
-; if not blocked, they cause a lookup, but this file does not specify
-; 127.* responses, so testbound will fail the test.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.	IN NS	ns2.example.com.
-SECTION ADDITIONAL
-;ns.example.com.	IN 	A	1.2.3.4
-ns.example.com.		IN 	A	127.255.255.255
-ns2.example.com.	IN 	A	127.0.0.2
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA SERVFAIL
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-SCENARIO_END
@@ -1,91 +0,0 @@
-; config options
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test a query name in the reply is required by resolver
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-; always the same reply since we cannot match anything from the qsection.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-; no query section!
-; www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-
-; the query name is echoed properly to *our* client
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA SERVFAIL
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-SCENARIO_END
@@ -1,230 +0,0 @@
-; config options
-; The island of trust is at example.com
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	trust-anchor: "example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}"
-	val-override-date: "20070916134226"
-	msg-cache-size: 8
-	rrset-cache-size: 8
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test cname to positive without cache
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qname
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN	CNAME	www.example.net.
-www.example.com.        3600    IN      RRSIG   CNAME DSA 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFGcJxnNxpWCBzXejiSdl4p1BKRMnAhUApoJrugVBRwFgAoYAhhqlZFac7fE= ;{id = 2854}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net. IN	A	11.12.13.14
-www.example.net.        3600    IN      RRSIG   A 5 3 3600 20070926134150 20070829134150 30899 example.net. CPxF5hK9Kg5eT7W6LgZwr0ePYEm9HMcSY4vvqCS6gDWB4X9jvXLCfBkCLhsNybPBpGWlsLi5wM6MTdJXuPpsRA== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN	CNAME	www.example.net.
-www.example.com.        3600    IN      RRSIG   CNAME DSA 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFGcJxnNxpWCBzXejiSdl4p1BKRMnAhUApoJrugVBRwFgAoYAhhqlZFac7fE= ;{id = 2854}
-www.example.net. IN	A	11.12.13.14
-www.example.net.        3600    IN      RRSIG   A 5 3 3600 20070926134150 20070829134150 30899 example.net. CPxF5hK9Kg5eT7W6LgZwr0ePYEm9HMcSY4vvqCS6gDWB4X9jvXLCfBkCLhsNybPBpGWlsLi5wM6MTdJXuPpsRA== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-SCENARIO_END
@@ -1,23 +0,0 @@
-; Signature test file
-
-; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
-; later entries are verified with it.
-
-
-; DNSKEY used for testing, from april 2008
-ENTRY_BEGIN
-SECTION QUESTION
-cesar.sec3.br.                 IN      DNSKEY
-SECTION ANSWER
-cesar.sec3.br.          43200   IN      DNSKEY  257 3 3 AMAdw+X4IcinbsSOXamwV4BrJVbRjSJ63DYRV0NLR4W5cDMEQGmB3Lci ybjLvaEogs9RDmjhxQrQJRfaIVMG11LtOwlTPBr4yzyeK9zzeZPAQz2F 9yCCPqgUdts51v4XeK5evtn+b4AB7t/j+v7Vb+26k8No6hmJiRJAy59N Fpzrt5FoY5qFZ8QbPl59nzEcXTbOiXBNSu9mQbe/jFH5p9NP4KB0iNL/ oAthNIVVsDG8hQFh1hE5YlDNLxYY3U+TODjWx//DZvkn5Tyyvp7I6b33 oJiq
-ENTRY_END
-
-; entry to test
-ENTRY_BEGIN
-SECTION QUESTION
-cesar.sec3.br.       IN      SOA
-SECTION ANSWER
-cesar.sec3.br.  43200   IN      SOA     home.kuroiwa.eng.br. hostmaster.cesar.sec3.br. 2008040903 86400 86400 8640000 600
-cesar.sec3.br.  43200   IN      RRSIG   SOA 3 3 43200 20081010000000 20080410122550 14996 cesar.sec3.br. AJOGbuGOMggPspEBhIc58I8BXUHqR+DKiZqGZRwu9jMTgAX6JCPunSI= ;{id = 14996}
-ENTRY_END
-
@@ -1,48 +0,0 @@
-; Signature test file
-
-; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
-; later entries are verified with it.
-
-; created test keys with bind tools:
-; dnssec-keygen 9.4.2: /usr/sbin/dnssec-keygen -a DSA -b 512 -n ZONE nlnetlabs.nl
-; Knlnetlabs.nl.+003+03510
-
-; private key file:
-; Private-key-format: v1.2
-; Algorithm: 3 (DSA)
-; Prime(p): 4nziv5P4tsXwaf71EoyKFoLzFq0/wN5fb6yb8IY5uwmVh5hvO0M4lR8LAjwimCIo3SYEdCnUPkl8WbJYHkRm9w==
-; Subprime(q): 3ueDKL3Jc2Ue1G/ZCfhwMEyR4v0=
-; Base(g): Ji9iYukmprX5qXO7V0MALKCTsfvz3kef2TsZdpM/VdetDK53OwKE1NRTMU6PSPGyumedOrkSD2BLa7CT1dJRJQ==
-; Private_value(x): wlEfaVwW10q6Re/ZOBL9PLJJb20=
-; Public_value(y): cHuTGyrkbj5QVkgmFm3KEpLnb5c7jH6tapeU5ugEIJiacbroPhfz/9vPw8tkZedBGImuYPSohRPfHIQPMxfxAg==
-
-
-; DSA key from bind tool 9.4.2
-ENTRY_BEGIN
-SECTION QUESTION
-nlnetlabs.nl.	IN DNSKEY
-SECTION ANSWER
-nlnetlabs.nl. IN DNSKEY 256 3 3 AN7ngyi9yXNlHtRv2Qn4cDBMkeL94nziv5P4tsXwaf71EoyKFoLzFq0/ wN5fb6yb8IY5uwmVh5hvO0M4lR8LAjwimCIo3SYEdCnUPkl8WbJYHkRm 9yYvYmLpJqa1+alzu1dDACygk7H7895Hn9k7GXaTP1XXrQyudzsChNTU UzFOj0jxsrpnnTq5Eg9gS2uwk9XSUSVwe5MbKuRuPlBWSCYWbcoSkudv lzuMfq1ql5Tm6AQgmJpxuug+F/P/28/Dy2Rl50EYia5g9KiFE98chA8z F/EC
-ENTRY_END
-
-; entry to test
-; from
-; /usr/sbin/dnssec-signzone nlnetlabs.nl
-ENTRY_BEGIN
-SECTION QUESTION
-nlnetlabs.nl. IN SOA
-SECTION ANSWER
-nlnetlabs.nl.   10200   IN SOA  open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. ( 2008040100 28800      7200       604800     3600       )
-nlnetlabs.nl.   10200   RRSIG   SOA 3 2 10200 20080515132632 ( 20080415132632 3510 nlnetlabs.nl.  ACYwIl9GQofKJ2xdgx1YelKbtmLrWRl8f+eC ToRnfyQ+gvdUIX3mTTw= )
-ENTRY_END
-
-ENTRY_BEGIN
-SECTION QUESTION
-nlnetlabs.nl. IN NS
-SECTION ANSWER
-nlnetlabs.nl. 10200   NS      omval.tednet.nl.
-nlnetlabs.nl. 10200   NS      ns7.domain-registry.nl.
-nlnetlabs.nl. 10200 NS      open.nlnetlabs.nl.
-nlnetlabs.nl. 10200   RRSIG   NS 3 2 10200 20080515132632 ( 20080415132632 3510 nlnetlabs.nl.  AEYy9ZN3KEDHybhZbL3PoR71jMQuufKM1lej +obA6uL6CjYQAPrL9tk= )
-ENTRY_END
-
@@ -1,47 +0,0 @@
-; Signature test file
-
-; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
-; later entries are verified with it.
-
-; dnssec-keygen 9.4.2: /usr/sbin/dnssec-keygen -a DSA -b 768 -n ZONE nlnetlabs.nl
-; Knlnetlabs.nl.+003+03793
-
-; private key file
-; Private-key-format: v1.2
-; Algorithm: 3 (DSA)
-; Prime(p): lHKDKRMhV1yBk/gXk3IL29jkPwWwOqEskebo/hC0ieobdQkeuf9B3AgzCdn2hQOWVGoIMWyxChhqHVLwnQzUGY/uAhTZgSXBG47eHZC+Pj1hgX9tkB+9kzoK5jKhstR9
-; Subprime(q): 6u+5FI/H5WmwyTPWB5K0LjegVb0=
-; Base(g): hWj33Fnu7b9vhIriw6nXnJKpeus9pffjSaKzVJBNnlWTMXbo3+w3rObnJlbkVLfRsY4F8boWn1EbUUHCaRIW3bsqziE739S8HBJDDwxYx85n0xRqkg0djWoCG2e4uv4o
-; Private_value(x): xSLjPW1PE6twDgObqfkUk6EXO+g=
-; Public_value(y): ORFJhDQMHGQNdWXlh05vAJJ8Fqm6u+72qsIY2pnSgWL7vQIL6sKKJL14oIVJbsZW9FIjQCFpqe19leUdzUDQa9AxB8WSRAzmh4S6tWkmbAGpUjoAUJSLtqV1NgvH8ESg
-
-
-; DSA key from bind tool 9.4.2
-ENTRY_BEGIN
-SECTION QUESTION
-nlnetlabs.nl.	IN DNSKEY
-SECTION ANSWER
-nlnetlabs.nl. IN DNSKEY 256 3 3 BOrvuRSPx+VpsMkz1geStC43oFW9lHKDKRMhV1yBk/gXk3IL29jkPwWw OqEskebo/hC0ieobdQkeuf9B3AgzCdn2hQOWVGoIMWyxChhqHVLwnQzU GY/uAhTZgSXBG47eHZC+Pj1hgX9tkB+9kzoK5jKhstR9hWj33Fnu7b9v hIriw6nXnJKpeus9pffjSaKzVJBNnlWTMXbo3+w3rObnJlbkVLfRsY4F 8boWn1EbUUHCaRIW3bsqziE739S8HBJDDwxYx85n0xRqkg0djWoCG2e4 uv4oORFJhDQMHGQNdWXlh05vAJJ8Fqm6u+72qsIY2pnSgWL7vQIL6sKK JL14oIVJbsZW9FIjQCFpqe19leUdzUDQa9AxB8WSRAzmh4S6tWkmbAGp UjoAUJSLtqV1NgvH8ESg
-ENTRY_END
-
-; entry to test
-; from
-; /usr/sbin/dnssec-signzone nlnetlabs.nl
-ENTRY_BEGIN
-SECTION QUESTION
-nlnetlabs.nl. IN SOA
-SECTION ANSWER
-nlnetlabs.nl.   10200   IN SOA  open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. ( 2008040100 28800      7200       604800     3600       )
-nlnetlabs.nl.                         10200   RRSIG   SOA 3 2 10200 20080515133546 ( 20080415133546 3793 nlnetlabs.nl.  BHMt1eWN8HzfFOqrqL1PrsED43JVCrybDYL1 GJXymKlkWRAjar0wT6o= )
-ENTRY_END
-
-ENTRY_BEGIN
-SECTION QUESTION
-nlnetlabs.nl. IN NS
-SECTION ANSWER
-nlnetlabs.nl. 10200   NS      omval.tednet.nl.
-nlnetlabs.nl. 10200   NS      ns7.domain-registry.nl.
-nlnetlabs.nl. 10200 NS      open.nlnetlabs.nl.
-nlnetlabs.nl. 10200   RRSIG   NS 3 2 10200 20080515133546 ( 20080415133546 3793 nlnetlabs.nl.  BJZaThgkBaF3k6t2q+tr0ngKcF2EntSOn9gX Ut9Xipj3CdioZl8b0cY= )
-ENTRY_END
-
@@ -1,48 +0,0 @@
-; Signature test file
-
-; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
-; later entries are verified with it.
-
-; ldns-keygen (svn trunk 1.3.0, 15 april 2008)
-; ./ldns-keygen -a DSAMD5 -b 512 nlnetlabs.nl
-; Knlnetlabs.nl.+003+08866
-
-; nlnetlabs.nl.   3600    IN      DS      8866 3 1 1300e7258af98cef40a47e6ac1e34ea79cb4b27f
-; Private-key-format: v1.2
-; Algorithm: 3 (DSA)
-; Prime(p): qp/0xtfW76CbSH29kZmI0iUEhJ9cIs/52WsgqogqBwrY/HpT+D6G2jd66WLi88DF0z/We3/YIjZYkR5PH03IRQ==
-; Subprime(q): iTRl4piaQvy9yxIsz/c5pAaVIeM=
-; Base(g): RJhjYU22ooiTKltbGmIR6OfXZjKDBfSODrT3e3/IrwiT8oQZriDFZkExYKrKqoqZFn7y0esTf9Bwvx2IhGabQw==
-; Private_value(x): gYjuQexf8JiiVBvCcxpXO+QaD88=
-; Public_value(y): aPtEU9ui/w2+9aFnCrWUB/fGvMEyAyLyGCCaT/N+l8bPYDPCv+wDxEKHoM3HT/ZOf3RuCE/CYKVK7CDX6+AZrA==
-
-; DSA key from ldns tool
-ENTRY_BEGIN
-SECTION QUESTION
-nlnetlabs.nl.	IN DNSKEY
-SECTION ANSWER
-nlnetlabs.nl.   3600    IN      DNSKEY  256 3 3 AIk0ZeKYmkL8vcsSLM/3OaQGlSHjqp/0xtfW76CbSH29kZmI0iUEhJ9cIs/52WsgqogqBwrY/HpT+D6G2jd66WLi88DF0z/We3/YIjZYkR5PH03IRUSYY2FNtqKIkypbWxpiEejn12YygwX0jg6093t/yK8Ik/KEGa4gxWZBMWCqyqqKmRZ+8tHrE3/QcL8diIRmm0No+0RT26L/Db71oWcKtZQH98a8wTIDIvIYIJpP836Xxs9gM8K/7APEQoegzcdP9k5/dG4IT8JgpUrsINfr4Bms ;{id = 8866 (zsk), size = 512b}
-ENTRY_END
-
-; entry to test
-; from
-; ldns-signzone nlnetlabs.nl Knlnetlabs.nl.+003+08866
-ENTRY_BEGIN
-SECTION QUESTION
-nlnetlabs.nl. IN SOA
-SECTION ANSWER
-nlnetlabs.nl.   10200   IN SOA  open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. ( 2008040100 28800      7200       604800     3600       )
-nlnetlabs.nl.   10200   IN      RRSIG   SOA 3 2 10200 20080513173901 20080415173901 8866 nlnetlabs.nl. MC0CFFI7JB0x4xaO0qhe9iQGk0eot8zGAhUAg/SFtf5MrR7DEkmd6vm2xf+SN9M= ;{id = 8866}
-ENTRY_END
-
-ENTRY_BEGIN
-SECTION QUESTION
-nlnetlabs.nl. IN NS
-SECTION ANSWER
-nlnetlabs.nl. 10200   NS      omval.tednet.nl.
-nlnetlabs.nl. 10200   NS      ns7.domain-registry.nl.
-nlnetlabs.nl. 10200 NS      open.nlnetlabs.nl.
-nlnetlabs.nl.   10200   IN      RRSIG   NS 3 2 10200 20080513173901 20080415173901 8866 nlnetlabs.nl. MCwCFFHwxz9Kx7Un60vLMMoOrZizagNrAhR6OskQNF/KVL5/xanbOmK3ZUj0vw== ;{id = 8866}
-
-ENTRY_END
-
@@ -1,48 +0,0 @@
-; Signature test file
-
-; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
-; later entries are verified with it.
-
-; ldns-keygen (svn trunk 1.3.0, 15 april 2008)
-; ./ldns-keygen -a DSAMD5 -b 768 nlnetlabs.nl
-; Knlnetlabs.nl.+003+51124
-
-; nlnetlabs.nl.   3600    IN      DS      51124 3 1 6f7e3ea1d525f3428ce342596f7375b1c3a71c51
-; Private-key-format: v1.2
-; Algorithm: 3 (DSA)
-; Prime(p): 1kpY0hU98SJrpDCTKHv9TQyN6EGcY9FJ8bw0QiQdcm3nx3fkS298V9Y7ZRzjCQmkxVwNrwdhtNpz4MvrByHKy+YE/hSJamNhwKHAtiIAHNggqfutGQwUkfqHmybFO8Kx
-; Subprime(q): 3GwgwvHRyOeXNgZqR/5XpaNs6Pc=
-; Base(g): Rw1YckcZ/Es07FYrNV6soRTbcQ5NEDj7ITSUdGSLKRPQT0k4ofR3L8aslTeOJESR2s2sIay/ZHoYmdQuwLZ93HLEq5MooPO19c/GnVkOWZm1Ab9H7zttNcoKgzQ64dhT
-; Private_value(x): OoN8CQisHVjCIET7B3WdAwERRro=
-; Public_value(y): 08zY8i9l5qn1xC829beHq2Hhb8MUIvGHyW+eBchQa4S5XIRwf1rVpnw1iengslp/Y1Kx28/a9GEQbIESQORfxllPV23Uv2OJ3aNV0jP7kI2a7VLVSDSJrCh2wBCFj8tY
-
-; DSA key from ldns tool
-ENTRY_BEGIN
-SECTION QUESTION
-nlnetlabs.nl.	IN DNSKEY
-SECTION ANSWER
-nlnetlabs.nl.   3600    IN      DNSKEY  256 3 3 BNxsIMLx0cjnlzYGakf+V6WjbOj31kpY0hU98SJrpDCTKHv9TQyN6EGcY9FJ8bw0QiQdcm3nx3fkS298V9Y7ZRzjCQmkxVwNrwdhtNpz4MvrByHKy+YE/hSJamNhwKHAtiIAHNggqfutGQwUkfqHmybFO8KxRw1YckcZ/Es07FYrNV6soRTbcQ5NEDj7ITSUdGSLKRPQT0k4ofR3L8aslTeOJESR2s2sIay/ZHoYmdQuwLZ93HLEq5MooPO19c/GnVkOWZm1Ab9H7zttNcoKgzQ64dhT08zY8i9l5qn1xC829beHq2Hhb8MUIvGHyW+eBchQa4S5XIRwf1rVpnw1iengslp/Y1Kx28/a9GEQbIESQORfxllPV23Uv2OJ3aNV0jP7kI2a7VLVSDSJrCh2wBCFj8tY ;{id = 51124 (zsk), size = 768b}
-ENTRY_END
-
-; entry to test
-; from
-; ldns-signzone nlnetlabs.nl Knlnetlabs.nl.+003+51124
-ENTRY_BEGIN
-SECTION QUESTION
-nlnetlabs.nl. IN SOA
-SECTION ANSWER
-nlnetlabs.nl.   10200   IN SOA  open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. ( 2008040100 28800      7200       604800     3600       )
-nlnetlabs.nl.   10200   IN      RRSIG   SOA 3 2 10200 20080513174626 20080415174626 51124 nlnetlabs.nl. MC0CFB3cRDHQROzkGp4NtLNc4jDA1lhWAhUAgsbb8VMxGqifShEzuCNgczxDHHg= ;{id = 51124}
-ENTRY_END
-
-ENTRY_BEGIN
-SECTION QUESTION
-nlnetlabs.nl. IN NS
-SECTION ANSWER
-nlnetlabs.nl. 10200   NS      omval.tednet.nl.
-nlnetlabs.nl. 10200   NS      ns7.domain-registry.nl.
-nlnetlabs.nl. 10200 NS      open.nlnetlabs.nl.
-nlnetlabs.nl.   10200   IN      RRSIG   NS 3 2 10200 20080513174626 20080415174626 51124 nlnetlabs.nl. MCwCFEzgEjT0n/ooV/xZkRMzKNqeF4pkAhQxEPFtMt5LbIlsi9mSi0HS4+RZuA== ;{id = 51124}
-
-ENTRY_END
-
@@ -1,32 +0,0 @@
-; Signature test file
-
-; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
-; later entries are verified with it.
-
-; DSA Key from ldns tool, key used in the testbound tests.
-
-; DSA key from ldns tool
-ENTRY_BEGIN
-SECTION QUESTION
-example.com.	IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJIIs70j+sDS/UT2QRp61SE7S3EEXopNXoFE73JLRmvpi/UrOO/Vz4Se6wXv/CYCKjGw06U4WRgRYXcpEhJROyNapmdIKSxhOzfLVE1gqA0PweZR8dtY3aNQSRn3sPpwJr6Mi/PqQKAMMrZ9ckJpf1+bQMOOvxgzz2U1GS18b3yZKcgTMEaJzd/GZYzi/BN2DzQ0MsrSwYXfsNLFOBbs8PJMW4LYIxeeOe6rUgkWOF7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-ENTRY_END
-
-; entry to test
-ENTRY_BEGIN
-SECTION QUESTION
-example.com.    IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-SECTION QUESTION
-ns.example.com.         IN      A
-SECTION ANSWER
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
@@ -1,24 +0,0 @@
-; Signature test file
-
-; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
-; later entries are verified with it.
-
-; RSA Key from ldns tool, key used in the testbound tests.
-
-; RSA key from ldns tool
-ENTRY_BEGIN
-SECTION QUESTION
-sub.example.com.	IN DNSKEY
-SECTION ANSWER
-sub.example.com.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-ENTRY_END
-
-; entry to test
-ENTRY_BEGIN
-SECTION QUESTION
-www.sub.example.com.    IN      A 
-SECTION ANSWER
-www.sub.example.com.    3600    IN      A       11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
-ENTRY_END
-
@@ -1,158 +0,0 @@
-; config options
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test trust in cname chain answer
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN CNAME xxx.example.com.
-xxx.example.com. IN CNAME yyy.example.com.
-yyy.example.com. IN A 10.20.30.40
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-qqq.example.com. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-yyy.example.com. IN A 10.20.30.42
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-
-; This stores it into cache.
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN CNAME xxx.example.com.
-xxx.example.com. IN CNAME yyy.example.com.
-yyy.example.com. IN A 10.20.30.40
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-; This query creates and overwrites the cache
-STEP 20 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-qqq.example.com. IN A
-ENTRY_END
-
-STEP 21 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-qqq.example.com. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-yyy.example.com. IN A 10.20.30.42
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-; get it again from cache.
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-STEP 31 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN CNAME xxx.example.com.
-xxx.example.com. IN CNAME yyy.example.com.
-yyy.example.com. IN A 10.20.30.42
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-SCENARIO_END
@@ -1,144 +0,0 @@
-; config options
-; The island of trust is at example.com
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator AD bit signaling
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD AD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-; ask from cache too
-STEP 21 QUERY
-ENTRY_BEGIN
-REPLY RD AD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-STEP 23 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-
-SCENARIO_END
@@ -1,6 +1,6 @@
 ; config options
 server:
-        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
+	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
 	val-override-date: "20120420235959"

 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
-example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
-example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
+example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
+example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
+example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
 ENTRY_END

 ENTRY_BEGIN
@@ -68,25 +68,25 @@ SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
+example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )

 ;; NSEC3 RR that covers the "next closer" name (c.x.w.example)
 ;; H(c.x.w.example) = 0va5bpr2ou0vk0lbqeeljri88laipsfh

 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )

 ;; NSEC3 RR that matches the closest encloser (x.w.example)
 ;; H(x.w.example) = b4um86eghhds6nea196smvmlo4ors995

 b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
-b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
+b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  GWDmUk8Sv0dxy/UZFol4Ss7Wz3wBiongcnVy strNODWwdnoO9z6pDh8JLk58ExfEgXm79i4b Ma6C/s/bkk1LvA== )

 ;; NSEC3 RR that covers wildcard at the closest encloser (*.x.w.example)
 ;; H(*.x.w.example) = 92pqneegtaue7pjatc3l3qnk738c6v5m

 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
 SECTION ADDITIONAL
 ENTRY_END

@@ -108,14 +108,14 @@ SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION ANSWER
 SECTION AUTHORITY
-example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
+example.       3600 IN SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
+example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )
 b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
-b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
+b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  GWDmUk8Sv0dxy/UZFol4Ss7Wz3wBiongcnVy strNODWwdnoO9z6pDh8JLk58ExfEgXm79i4b Ma6C/s/bkk1LvA== )
 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
 SECTION ADDITIONAL
 ENTRY_END

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
+	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
 	val-override-date: "20120420235959"

 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
-example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
-example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
+example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
+example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
+example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
 ENTRY_END

 ENTRY_BEGIN
@@ -68,25 +68,25 @@ SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.	RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
+example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )

 ;; NSEC3 RR that covers the "next closer" name (c.x.w.example)
 ;; H(c.x.w.example) = 0va5bpr2ou0vk0lbqeeljri88laipsfh

 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )

 ;; NSEC3 RR that matches the closest encloser (x.w.example)
 ;; H(x.w.example) = b4um86eghhds6nea196smvmlo4ors995

-; b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
-; b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
+;b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
+;b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  GWDmUk8Sv0dxy/UZFol4Ss7Wz3wBiongcnVy strNODWwdnoO9z6pDh8JLk58ExfEgXm79i4b Ma6C/s/bkk1LvA== )

 ;; NSEC3 RR that covers wildcard at the closest encloser (*.x.w.example)
 ;; H(*.x.w.example) = 92pqneegtaue7pjatc3l3qnk738c6v5m

 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
 SECTION ADDITIONAL
 ENTRY_END

@@ -1,6 +1,6 @@
 ; config options
 server:
-        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm 3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
+	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
 	val-override-date: "20120420235959"

 stub-zone:
@@ -55,10 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89ep O6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
-example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8 Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
-example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf 3bH+QsCtg== )
-
+example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
+example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
+example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
 ENTRY_END

 ENTRY_BEGIN
@@ -69,26 +68,25 @@ SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd V I2LmKusbZsT0Q== )
+example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )

 ;; NSEC3 RR that covers the "next closer" name (c.x.w.example)
 ;; H(c.x.w.example) = 0va5bpr2ou0vk0lbqeeljri88laipsfh

-;0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi 47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-;0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRx K9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
+;0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
+;0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )

 ;; NSEC3 RR that matches the closest encloser (x.w.example)
 ;; H(x.w.example) = b4um86eghhds6nea196smvmlo4ors995

 b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
-b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUi wtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
+b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  GWDmUk8Sv0dxy/UZFol4Ss7Wz3wBiongcnVy strNODWwdnoO9z6pDh8JLk58ExfEgXm79i4b Ma6C/s/bkk1LvA== )

 ;; NSEC3 RR that covers wildcard at the closest encloser (*.x.w.example)
 ;; H(*.x.w.example) = 92pqneegtaue7pjatc3l3qnk738c6v5m

 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH +z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
-
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
 SECTION ADDITIONAL
 ENTRY_END

@@ -1,6 +1,6 @@
 ; config options
 server:
-        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
+	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
 	val-override-date: "20120420235959"

 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
-example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
-example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
+example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
+example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
+example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
 ENTRY_END

 ENTRY_BEGIN
@@ -68,26 +68,25 @@ SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
+example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )

 ;; NSEC3 RR that covers the "next closer" name (c.x.w.example)
 ;; H(c.x.w.example) = 0va5bpr2ou0vk0lbqeeljri88laipsfh

 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )

 ;; NSEC3 RR that matches the closest encloser (x.w.example)
 ;; H(x.w.example) = b4um86eghhds6nea196smvmlo4ors995

 b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
-b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
+b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  GWDmUk8Sv0dxy/UZFol4Ss7Wz3wBiongcnVy strNODWwdnoO9z6pDh8JLk58ExfEgXm79i4b Ma6C/s/bkk1LvA== )

 ;; NSEC3 RR that covers wildcard at the closest encloser (*.x.w.example)
 ;; H(*.x.w.example) = 92pqneegtaue7pjatc3l3qnk738c6v5m

-
 ;35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-;35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
+;35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
 SECTION ADDITIONAL
 ENTRY_END

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
+	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
 	val-override-date: "20120420235959"

 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
-example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
-example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
+example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
+example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
+example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
 ENTRY_END

 ENTRY_BEGIN
@@ -68,12 +68,11 @@ SECTION QUESTION
 y.w.example.        IN A
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
+example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )

 ;; NSEC3 RR matches the QNAME and shows that the A type bit is not set.
 ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd ( k8udemvp1j2f7eg6jebps17vp3n8i58h )
-ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  gPkFp1s2QDQ6wQzcg1uSebZ61W33rUBDcTj7 2F3kQ490fEdp7k1BUIfbcZtPbX3YCpE+sIt0 MpzVSKfTwx4uYA== )
-
+ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  fvKWkD3lXNLyUn0/gN+i3Z8301oRujSFFrJy SfAPS2Q1bw1Q5eQoy7IE+ZtUVO15ha6C9cUh CArJyEk247MADA== )
 SECTION ADDITIONAL
 ENTRY_END

@@ -95,10 +94,10 @@ SECTION QUESTION
 y.w.example.        IN A
 SECTION ANSWER
 SECTION AUTHORITY
-example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
+example.       3600 IN SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
+example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
 ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd ( k8udemvp1j2f7eg6jebps17vp3n8i58h )
-ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  gPkFp1s2QDQ6wQzcg1uSebZ61W33rUBDcTj7 2F3kQ490fEdp7k1BUIfbcZtPbX3YCpE+sIt0 MpzVSKfTwx4uYA== )
+ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  fvKWkD3lXNLyUn0/gN+i3Z8301oRujSFFrJy SfAPS2Q1bw1Q5eQoy7IE+ZtUVO15ha6C9cUh CArJyEk247MADA== )
 SECTION ADDITIONAL
 ENTRY_END

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
+	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
 	val-override-date: "20120420235959"

 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
-example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
-example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
+example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
+example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
+example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
 ENTRY_END

 ENTRY_BEGIN
@@ -68,15 +68,16 @@ SECTION QUESTION
 y.w.example.        IN A
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
+example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )

 ;; NSEC3 RR matches the QNAME and shows that the A type bit is not set.
 ;ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd ( k8udemvp1j2f7eg6jebps17vp3n8i58h )
-;ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  gPkFp1s2QDQ6wQzcg1uSebZ61W33rUBDcTj7 2F3kQ490fEdp7k1BUIfbcZtPbX3YCpE+sIt0 MpzVSKfTwx4uYA== )
+;ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  fvKWkD3lXNLyUn0/gN+i3Z8301oRujSFFrJy SfAPS2Q1bw1Q5eQoy7IE+ZtUVO15ha6C9cUh CArJyEk247MADA== )

 ; instead the wrong NSEC3 rr is included
 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
+

 SECTION ADDITIONAL
 ENTRY_END
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Wouter Wijngaards	82e4110e09	moved from trunk. git-svn-id: file:///svn/unbound/tags/release-0.9@947 be551aaa-1e26-0410-a405-d3ace91eadb9	2008-02-11 15:46:40 +00:00
Wouter Wijngaards	fb57492c0a	makedist fixup. git-svn-id: file:///svn/unbound/tags/release-0.9@940 be551aaa-1e26-0410-a405-d3ace91eadb9	2008-02-08 13:09:25 +00:00
Wouter Wijngaards	bde1ce87d5	doc_layout git-svn-id: file:///svn/unbound/tags/release-0.9@939 be551aaa-1e26-0410-a405-d3ace91eadb9	2008-02-08 12:59:36 +00:00
Wouter Wijngaards	b7a627b8cc	Tests fixup. git-svn-id: file:///svn/unbound/tags/release-0.9@938 be551aaa-1e26-0410-a405-d3ace91eadb9	2008-02-08 12:46:21 +00:00
Wouter Wijngaards	ea7630845f	tag 0.9 git-svn-id: file:///svn/unbound/tags/release-0.9@937 be551aaa-1e26-0410-a405-d3ace91eadb9	2008-02-08 12:27:41 +00:00