for 0.7.2: fixup building in subdir.

git-svn-id: file:///svn/unbound/branches/beta-0.7@797 be551aaa-1e26-0410-a405-d3ace91eadb9

Makefile.in

@@ -33,7 +33,7 @@ configfile=@ub_conf_file@
 YACC=@YACC@
 LEX=@LEX@
 CC=@CC@
-CPPFLAGS=-I$(srcdir) @CPPFLAGS@ @DEFS@
+CPPFLAGS=-I$(srcdir) -I. @CPPFLAGS@ @DEFS@
 CFLAGS=@CFLAGS@
 LDFLAGS=@LDFLAGS@
 LIBS=@LIBS@

README

@@ -0,0 +1,10 @@
+Unbound README
+* ./configure && make && make install
+* on BSDs and Solaris use gmake (GNU make).
+* If it complains that no libevent can be found; libevent is useful when
+  using many (10000) outgoing ports. By default 16 ports are used and the
+  builtin alternative is equally capable.
+* More detailed README, README.svn, README.tests in doc directory
+* manual pages can be found in doc directory, and are installed, unbound(8).
+* example configuration file doc/example.conf
+

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.61 for unbound 0.6.
+# Generated by GNU Autoconf 2.61 for unbound 0.7.2.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -724,8 +724,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='0.6'
-PACKAGE_STRING='unbound 0.6'
+PACKAGE_VERSION='0.7.2'
+PACKAGE_STRING='unbound 0.7.2'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 
 # Factoring default headers for most tests.
@@ -1358,7 +1358,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 0.6 to adapt to many kinds of systems.
+\`configure' configures unbound 0.7.2 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1423,7 +1423,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 0.6:";;
+     short | recursive ) echo "Configuration of unbound 0.7.2:";;
    esac
   cat <<\_ACEOF
 
@@ -1544,7 +1544,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 0.6
+unbound configure 0.7.2
 generated by GNU Autoconf 2.61
 
 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1558,7 +1558,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 0.6, which was
+It was created by unbound $as_me 0.7.2, which was
 generated by GNU Autoconf 2.61.  Invocation command line was
 
   $ $0 $@
@@ -21692,11 +21692,11 @@ echo "${ECHO_T}found in $thedir" >&6; }
             		LDFLAGS="$thedir/.libs/*.o $LDFLAGS";
 		else
             		{ { echo "$as_me:$LINENO: error: Cannot find the libevent library in $withval
-You can restart configure with --with-libevent=no to use a builtin alternative.
+You can restart ./configure --with-libevent=no to use a builtin alternative.
 Please note that this alternative is not as capable as libevent when using
 many outgoing ports.  " >&5
 echo "$as_me: error: Cannot find the libevent library in $withval
-You can restart configure with --with-libevent=no to use a builtin alternative.
+You can restart ./configure --with-libevent=no to use a builtin alternative.
 Please note that this alternative is not as capable as libevent when using
 many outgoing ports.  " >&2;}
    { (exit 1); exit 1; }; }
@@ -24974,7 +24974,7 @@ exec 6>&1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 0.6, which was
+This file was extended by unbound $as_me 0.7.2, which was
 generated by GNU Autoconf 2.61.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -25023,7 +25023,7 @@ Report bugs to <bug-autoconf@gnu.org>."
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF
 ac_cs_version="\\
-unbound config.status 0.6
+unbound config.status 0.7.2
 configured by $0, generated by GNU Autoconf 2.61,
   with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
 

configure.ac

@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 AC_PREREQ(2.57)
 
-AC_INIT(unbound, 0.6, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 0.7.2, unbound-bugs@nlnetlabs.nl, unbound)
 
 CFLAGS=
 AC_AIX
@@ -503,7 +503,7 @@ if test x_$withval != x_no; then
             		LDFLAGS="$thedir/.libs/*.o $LDFLAGS";
 		else
             		AC_MSG_ERROR([Cannot find the libevent library in $withval
-You can restart configure with --with-libevent=no to use a builtin alternative.
+You can restart ./configure --with-libevent=no to use a builtin alternative.
 Please note that this alternative is not as capable as libevent when using
 many outgoing ports.  ])
 		fi

daemon/unbound.c

@@ -67,7 +67,7 @@ static void usage()
 	printf("-c file	config file to read instead of %s\n", CONFIGFILE);
 	printf("	file format is described in unbound.conf(5).\n");
 	printf("-d	do not fork into the background.\n");
-	printf("-v	verbose (multiple times increase verbosity)\n");
+	printf("-v	verbose (more times to increase verbosity)\n");
 	printf("Version %s\n", PACKAGE_VERSION);
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
@@ -292,9 +292,11 @@ do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode)
 	}
 	if(cfg->username && cfg->username[0]) {
 		if(setgid(gid) != 0)
-			fatal_exit("unable to set group id: %s", strerror(errno));
+			fatal_exit("unable to set group id of %s: %s", 
+				cfg->username, strerror(errno));
 		if(setuid(uid) != 0)
-			fatal_exit("unable to set user id: %s", strerror(errno));
+			fatal_exit("unable to set user id of %s: %s", 
+				cfg->username, strerror(errno));
 		verbose(VERB_DETAIL, "drop user privileges, run as %s", 
 			cfg->username);
 	}

doc/CREDITS

@@ -5,3 +5,5 @@ from the University of California and from Verisign. The Java prototype
 was made in further cooperation with Geoff Sisson and Roy Arends from Nominet.
 
 At NLnet Labs, Jelte Jansen and Mark Santcroos reviewed the unbound C sources.
+
+Jakob Schlyter - for advice on secure settings, random numbers and blacklists.

doc/Changelog

@@ -1,7 +1,25 @@
+3 December 2007: Wouter
+	- Fixup building in a subdirectory. (for 0.7.2)
+
+19 November 2007: Wouter
+	- version 0.7.1:
+		* includes tpkg fixes to kill daemons at end of test
+		* includes NSEC/RRSIG not downcasing fixup from
+		dnssec-bis-updates draft-06.
+		* README file updated.
+		* nice libevent not found error.
+		* README talks about gnu make.
+	- for 0.7.2:
+		* fixup for donotq matching.
+
+15 November 2007: Wouter
+	- review fixups from Jelte.
+
 14 November 2007: Wouter
 	- testbed script does not recreate configure, since its in svn now.
 	- fixup checkconf test so that it does not test 
 	  /etc/unbound/unbound.conf.
+	- tag 0.6.
 
 13 November 2007: Wouter
 	- remove debug print.

doc/README

@@ -18,13 +18,17 @@ This software is under BSD license, see LICENSE for details.
   * autoreconf (autoheader && autoconf), if ./configure is missing.
 
 * Make and install: ./configure; make; make install
+  * Use GNU make; default on linux, often called 'gmake' on BSD and Solaris.
   * --with-ldns=/path/to/ldns
-  	If ldns is not detected on the system, a prepackaged incuded tarball
+  	If ldns is not detected on the system, a prepackaged tarball
 	of the ldns library is used to compile and statically link against.
 	If detected on the system, it will dynamically link against it.
   * --with-libevent=/path/to/libevent
   	Can be set to either the system install or the build directory.
 	--with-libevent=no gives a builtin alternative implementation.
+	libevent is useful when having many (thousands) of outgoing ports.
+	This improves randomization and spoof resistance. For the default 
+	of 16 ports the builtin alternative works well.
   * --without-pthreads 
 	This disables pthreads, and uses Solaris thr library or no threading. 
 	Without this option the pthreads library is detected automatically.

doc/TODO

@@ -53,3 +53,6 @@ o inspect date on executable, then warn user in log if its more than 1 year.
 o proactively prime root, stubs and trust anchors, feature.
   early failure, faster on first query, but more traffic.
 o use privilege separation, to change privilege options during reload securely
+  not needed.
+o check if for PowerDNS(2.9.21) CNAME in Answer section & rcode=NXDOMAIN needs
+  to be fixed up to be rcode=NOERROR?

doc/requirements.txt

@@ -159,3 +159,19 @@ o The method by which dnssec-lameness is detected is not secure. DNSSEC lame
   on a server, dnssec-lameness detection does not work - no dnssec-lameness 
   is detected. Instead the zone that is dnssec-lame becomes bogus.
 
+o authority features.
+  This is a recursive server, and authority features are out of scope.
+  However, some authority features are expected in a recursor. Things like
+  localhost, reverse lookup for 127.0.0.1, or blocking AS112 traffic.
+  Also redirection of domain names with fixed data is needed by service
+  providers. Limited support is added specifically to address this.
+
+  Adding full authority support, requires much more code, and more complex
+  maintenance.
+
+  The limited support allows adding some static data (for localhost and so),
+  and to respond with a fixed rcode (NXDOMAIN) for domains (such as AS112).
+
+  You can put authority data on a separate server, and set the server in 
+  unbound.conf as stub for those zones, this allows clients to access data 
+  from the server without making unbound authoritative for the zones.

iterator/iter_donotq.c

@@ -112,7 +112,7 @@ donotq_insert(struct iter_donotq* dq, struct sockaddr_storage* addr,
 static void
 mask_block(int ip6, struct sockaddr_storage* addr, int net)
 {
-	uint8_t mask[8] = {0x0, 0x1, 0x3, 0x7, 0xf, 0x1f, 0x3f, 0x7f};
+	uint8_t mask[8] = {0x0, 0x80, 0xc0, 0xe0, 0xf0, 0xf8, 0xfc, 0xfe};
 	int i, max;
 	uint8_t* s;
 	if(ip6) {

validator/val_sigcrypt.c

@@ -748,7 +748,6 @@ canonical_compare(struct ub_packed_rrset_key* rrset, size_t i, size_t j)
 		 */
 		/* type starts with the name; remainder is binary compared */
 		case LDNS_RR_TYPE_NXT: 
-		case LDNS_RR_TYPE_NSEC: 
 		/* use rdata field formats */
 		case LDNS_RR_TYPE_MINFO:
 		case LDNS_RR_TYPE_RP:
@@ -758,7 +757,6 @@ canonical_compare(struct ub_packed_rrset_key* rrset, size_t i, size_t j)
 		case LDNS_RR_TYPE_KX:
 		case LDNS_RR_TYPE_MX:
 		case LDNS_RR_TYPE_SIG:
-		case LDNS_RR_TYPE_RRSIG:
 		case LDNS_RR_TYPE_PX:
 		case LDNS_RR_TYPE_NAPTR:
 		case LDNS_RR_TYPE_SRV:
@@ -773,6 +771,8 @@ canonical_compare(struct ub_packed_rrset_key* rrset, size_t i, size_t j)
 		case LDNS_RR_TYPE_HINFO:
 			return canonical_compare_hinfo(d, i, j);
 
+		case LDNS_RR_TYPE_NSEC: 
+		case LDNS_RR_TYPE_RRSIG:
 	default:
 		/* For unknown RR types, or types not listed above,
 		 * no canonicalization is needed, do binary compare */