Scrubber fixup.

git-svn-id: file:///svn/unbound/branches/support-1.0@1179 be551aaa-1e26-0410-a405-d3ace91eadb9

Makefile.in

@@ -1,9 +1,13 @@
 # Copyright 2007 NLnet Labs
 # See the file LICENSE for the license
-# 
-# Standard installation pathnames
 
-QUIET=yes
+debug_enabled=@debug_enabled@
+ifeq ($(debug_enabled),yes)
+  QUIET=yes
+else
+  QUIET=no
+endif
+
 ifeq "$(QUIET)" "yes"
   Q=@
   INFO=@echo
@@ -18,6 +22,7 @@ srcdir=@srcdir@
 prefix=@prefix@
 exec_prefix=@exec_prefix@
 bindir=@bindir@
+sbindir=@sbindir@
 mandir=@mandir@
 libdir=@libdir@
 # datarootdir is here to please some checkers, use datadir.
@@ -29,11 +34,12 @@ libtool=@libtool@
 ldnsdir=@ldnsdir@
 staticexe=@staticexe@
 configfile=@ub_conf_file@
+CHECKLOCK_SRC=@CHECKLOCK_SRC@
 
 YACC=@YACC@
 LEX=@LEX@
 CC=@CC@
-CPPFLAGS=-I$(srcdir) @CPPFLAGS@ @DEFS@
+CPPFLAGS=-I$(srcdir) -I. @CPPFLAGS@ @DEFS@
 CFLAGS=@CFLAGS@
 LDFLAGS=@LDFLAGS@
 LIBS=@LIBS@
@@ -57,58 +63,82 @@ COMMON_SRC=$(patsubst $(srcdir)/%,%, $(wildcard $(srcdir)/services/*.c \
 	$(srcdir)/services/cache/*.c $(srcdir)/util/*.c \
 	$(srcdir)/util/data/*.c $(srcdir)/util/storage/*.c \
 	$(srcdir)/iterator/*.c $(srcdir)/validator/*.c)) \
-	util/configparser.c util/configlexer.c testcode/checklocks.c
-COMMON_OBJ=$(addprefix $(BUILD),$(COMMON_SRC:.c=.o))
-COMPAT_OBJ=$(addprefix $(BUILD)compat/,$(LIBOBJS))
+	util/configparser.c util/configlexer.c $(CHECKLOCK_SRC)
+COMMON_OBJ=$(addprefix $(BUILD),$(COMMON_SRC:.c=.lo))
+COMPAT_OBJ=$(addprefix $(BUILD)compat/,$(LIBOBJS:.o=.lo))
 UNITTEST_SRC=$(patsubst $(srcdir)/%,%, \
 	$(wildcard $(srcdir)/testcode/unit*.c)) \
-	testcode/readhex.c testcode/ldns-testpkts.c checkconf/worker_cb.c \
+	testcode/readhex.c testcode/ldns-testpkts.c smallapp/worker_cb.c \
 	$(COMMON_SRC)
-UNITTEST_OBJ=$(addprefix $(BUILD),$(UNITTEST_SRC:.c=.o)) $(COMPAT_OBJ)
+UNITTEST_OBJ=$(addprefix $(BUILD),$(UNITTEST_SRC:.c=.lo)) $(COMPAT_OBJ)
 DAEMON_SRC=$(patsubst $(srcdir)/%,%, $(wildcard $(srcdir)/daemon/*.c)) \
 	$(COMMON_SRC)
-DAEMON_OBJ=$(addprefix $(BUILD),$(DAEMON_SRC:.c=.o)) $(COMPAT_OBJ)
-CHECKCONF_SRC=checkconf/unbound-checkconf.c checkconf/worker_cb.c $(COMMON_SRC)
-CHECKCONF_OBJ=$(addprefix $(BUILD),$(CHECKCONF_SRC:.c=.o)) $(COMPAT_OBJ)
+DAEMON_OBJ=$(addprefix $(BUILD),$(DAEMON_SRC:.c=.lo)) $(COMPAT_OBJ)
+CHECKCONF_SRC=smallapp/unbound-checkconf.c smallapp/worker_cb.c $(COMMON_SRC)
+CHECKCONF_OBJ=$(addprefix $(BUILD),$(CHECKCONF_SRC:.c=.lo)) $(COMPAT_OBJ)
+HOST_SRC=smallapp/unbound-host.c
+HOST_OBJ=$(addprefix $(BUILD),$(HOST_SRC:.c=.lo)) $(COMPAT_OBJ)
 TESTBOUND_SRC=testcode/testbound.c testcode/ldns-testpkts.c \
 	daemon/worker.c daemon/acl_list.c daemon/daemon.c daemon/stats.c \
 	testcode/replay.c testcode/fake_event.c $(filter-out util/netevent.c \
 	services/listen_dnsport.c services/outside_network.c, $(COMMON_SRC))
-TESTBOUND_OBJ=$(addprefix $(BUILD),$(TESTBOUND_SRC:.c=.o)) $(COMPAT_OBJ)
-LOCKVERIFY_SRC=testcode/lock_verify.c checkconf/worker_cb.c $(COMMON_SRC)
-LOCKVERIFY_OBJ=$(addprefix $(BUILD),$(LOCKVERIFY_SRC:.c=.o)) $(COMPAT_OBJ)
-PKTVIEW_SRC=testcode/pktview.c testcode/readhex.c checkconf/worker_cb.c \
+TESTBOUND_OBJ=$(addprefix $(BUILD),$(TESTBOUND_SRC:.c=.lo)) $(COMPAT_OBJ)
+LOCKVERIFY_SRC=testcode/lock_verify.c smallapp/worker_cb.c $(COMMON_SRC)
+LOCKVERIFY_OBJ=$(addprefix $(BUILD),$(LOCKVERIFY_SRC:.c=.lo)) $(COMPAT_OBJ)
+PKTVIEW_SRC=testcode/pktview.c testcode/readhex.c smallapp/worker_cb.c \
 	$(COMMON_SRC)
-PKTVIEW_OBJ=$(addprefix $(BUILD),$(PKTVIEW_SRC:.c=.o)) $(COMPAT_OBJ)
-SIGNIT_SRC=testcode/signit.c checkconf/worker_cb.c $(COMMON_SRC)
-SIGNIT_OBJ=$(addprefix $(BUILD),$(SIGNIT_SRC:.c=.o)) $(COMPAT_OBJ)
-MEMSTATS_SRC=testcode/memstats.c checkconf/worker_cb.c $(COMMON_SRC)
-MEMSTATS_OBJ=$(addprefix $(BUILD),$(MEMSTATS_SRC:.c=.o)) $(COMPAT_OBJ)
-ALL_SRC=$(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
+PKTVIEW_OBJ=$(addprefix $(BUILD),$(PKTVIEW_SRC:.c=.lo)) $(COMPAT_OBJ)
+SIGNIT_SRC=testcode/signit.c smallapp/worker_cb.c $(COMMON_SRC)
+SIGNIT_OBJ=$(addprefix $(BUILD),$(SIGNIT_SRC:.c=.lo)) $(COMPAT_OBJ)
+MEMSTATS_SRC=testcode/memstats.c smallapp/worker_cb.c $(COMMON_SRC)
+MEMSTATS_OBJ=$(addprefix $(BUILD),$(MEMSTATS_SRC:.c=.lo)) $(COMPAT_OBJ)
+ASYNCLOOK_SRC=testcode/asynclook.c
+ASYNCLOOK_OBJ=$(addprefix $(BUILD),$(ASYNCLOOK_SRC:.c=.lo)) $(COMPAT_OBJ)
+STREAMTCP_SRC=testcode/streamtcp.c smallapp/worker_cb.c $(COMMON_SRC)
+STREAMTCP_OBJ=$(addprefix $(BUILD),$(STREAMTCP_SRC:.c=.lo)) $(COMPAT_OBJ)
+PERF_SRC=testcode/perf.c smallapp/worker_cb.c $(COMMON_SRC)
+PERF_OBJ=$(addprefix $(BUILD),$(PERF_SRC:.c=.lo)) $(COMPAT_OBJ)
+DELAYER_SRC=testcode/delayer.c smallapp/worker_cb.c $(COMMON_SRC)
+DELAYER_OBJ=$(addprefix $(BUILD),$(DELAYER_SRC:.c=.lo)) $(COMPAT_OBJ)
+HARVEST_SRC=testcode/harvest.c
+HARVEST_OBJ=$(addprefix $(BUILD),$(HARVEST_SRC:.c=.lo)) $(COMPAT_OBJ)
+LIBUNBOUND_SRC=$(patsubst $(srcdir)/%,%, \
+	$(wildcard $(srcdir)/libunbound/*.c) $(COMMON_SRC))
+LIBUNBOUND_OBJ=$(addprefix $(BUILD),$(LIBUNBOUND_SRC:.c=.lo)) $(COMPAT_OBJ)
+ALL_SRC=$(sort $(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
 	$(TESTBOUND_SRC) $(LOCKVERIFY_SRC) $(PKTVIEW_SRC) $(SIGNIT_SRC) \
-	$(MEMSTATS_SRC) $(CHECKCONF_SRC)
-ALL_OBJ=$(addprefix $(BUILD),$(ALL_SRC:.c=.o) \
-	$(addprefix compat/,$(LIBOBJS))) $(COMPAT_OBJ)
+	$(MEMSTATS_SRC) $(CHECKCONF_SRC) $(LIBUNBOUND_SRC) $(HOST_SRC) \
+	$(ASYNCLOOK_SRC) $(STREAMTCP_SRC) $(PERF_SRC) $(DELAYER_SRC) \
+	$(HARVEST_SRC) )
+ALL_OBJ=$(addprefix $(BUILD),$(ALL_SRC:.c=.lo) \
+	$(addprefix compat/,$(LIBOBJS:.o=.lo))) $(COMPAT_OBJ)
 
 COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS)
 LINK=$(LIBTOOL) --tag=CC --mode=link $(CC) $(staticexe) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS)
-LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(CC) $(CFLAGS) $(LDFLAGS) -release $(VERSION)
+LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(CC) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS) $(staticexe) -version-number @LIBUNBOUND_CURRENT@:@LIBUNBOUND_REVISION@:@LIBUNBOUND_AGE@ -no-undefined
 
-.PHONY:	clean realclean doc lint all install uninstall tests test download_ldns strip
+.PHONY:	clean realclean doc lint all install uninstall tests test download_ldns strip lib
 
-$(BUILD)%.o:    $(srcdir)/%.c 
+$(BUILD)%.lo:    $(srcdir)/%.c 
 	$(INFO) Build $<
 	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
 		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
-	@if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
+	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(COMPILE) -c $< -o $@
 
-all:	$(COMMON_OBJ) unbound unbound-checkconf
+all:	$(COMMON_OBJ) unbound unbound-checkconf lib unbound-host
 
-tests:	all unittest testbound lock-verify pktview signit memstats
+tests:	all unittest testbound lock-verify pktview signit memstats \
+	asynclook streamtcp perf delayer harvest
 
 test:	tests
-	bash testcode/do-tests.sh
+	if test -x "`which bash`"; then bash testcode/do-tests.sh; else sh testcode/do-tests.sh; fi
+
+lib:	libunbound.la
+
+libunbound.la:	$(LIBUNBOUND_OBJ)
+	$(INFO) Link $@
+	$Q$(LINK_LIB) --export-symbols $(srcdir)/libunbound/ubsyms.def -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
 
 ifeq ($(patsubst ldns-src%,ldns-src,$(ldnsdir)),ldns-src)
 ldnslib=$(ldnsdir)/lib/libldns.a
@@ -127,6 +157,10 @@ unbound-checkconf:	$(CHECKCONF_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(CHECKCONF_OBJ)) $(LIBS)
 
+unbound-host:	$(HOST_OBJ) libunbound.la $(ldnslib)
+	$(INFO) Link $@
+	$Q$(LINK) -o $@ $(sort $(HOST_OBJ)) -L. -L.libs -lunbound $(LIBS)
+
 unittest:	$(UNITTEST_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(UNITTEST_OBJ)) $(LIBS)
@@ -151,6 +185,26 @@ memstats:	$(MEMSTATS_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(MEMSTATS_OBJ)) $(LIBS)
 
+asynclook:	$(ASYNCLOOK_OBJ) $(ldnslib) libunbound.la
+	$(INFO) Link $@
+	$Q$(LINK) -o $@ $(sort $(ASYNCLOOK_OBJ)) $(LIBS) -L. -L.libs -lunbound
+
+streamtcp:	$(STREAMTCP_OBJ) $(ldnslib)
+	$(INFO) Link $@
+	$Q$(LINK) -o $@ $(sort $(STREAMTCP_OBJ)) $(LIBS)
+
+perf:	$(PERF_OBJ) $(ldnslib)
+	$(INFO) Link $@
+	$Q$(LINK) -o $@ $(sort $(PERF_OBJ)) $(LIBS)
+
+delayer:	$(DELAYER_OBJ) $(ldnslib)
+	$(INFO) Link $@
+	$Q$(LINK) -o $@ $(sort $(DELAYER_OBJ)) $(LIBS)
+
+harvest:	$(HARVEST_OBJ) $(ldnslib) libunbound.la
+	$(INFO) Link $@
+	$Q$(LINK) -o $@ $(sort $(HARVEST_OBJ)) $(LIBS) -L. -L.libs -lunbound
+
 #testcode/ldns-testpkts.c:	$(ldnsdir)/examples/ldns-testpkts.c \
 #			$(ldnsdir)/examples/ldns-testpkts.h
 #	cp $(ldnsdir)/examples/ldns-testpkts.c testcode/ldns-testpkts.c
@@ -162,18 +216,19 @@ util/configlexer.c:  $(srcdir)/util/configlexer.lex util/configparser.h
 ifeq "$(strip $(LEX))" ":"
 	$Qecho "rebuild lexer, but no lex program, skipped"
 else
-	@if test ! -d util; then $(INSTALL) -d util; fi
+	@-if test ! -d util; then $(INSTALL) -d util; fi
 	$Qecho "#include \"util/configyyrename.h\"" > $@
 	$Q$(LEX) -t $< >> $@
 endif
 
 util/configparser.c util/configparser.h:  $(srcdir)/util/configparser.y
 	$(INFO) Yacc $<
-	@if test ! -d util; then $(INSTALL) -d util; fi
+	@-if test ! -d util; then $(INSTALL) -d util; fi
 	$Q$(YACC) -d -o util/configparser.c $<
 
 clean:
 	rm -f *.o *.d *.lo *~ tags
+	rm -f unbound unbound-checkconf unbound-host
 	rm -rf autom4te.cache .libs build doc/html
 
 realclean: clean
@@ -185,7 +240,7 @@ realclean: clean
 
 $(BUILD)%.lint:    $(srcdir)/%.c 
 	$(INFO) Lint $<
-	@if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
+	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(LINT) $(LINTFLAGS) -I. -I$(srcdir) -I$(ldnsdir)/include $<
 	$Qtouch $@
 
@@ -195,50 +250,71 @@ tags:	$(srcdir)/*.[ch] $(srcdir)/*/*.[ch]
 	ctags  -f $(srcdir)/tags $(srcdir)/*.[ch] $(srcdir)/*/*.[ch]
 
 doc:
-ifdef doxygen
-	$(doxygen) $(srcdir)/doc/unbound.doxygen
-endif
+	if test -n "$(doxygen)"; then \
+		$(doxygen) $(srcdir)/doc/unbound.doxygen; fi
 
 strip:
 	strip unbound
 	strip unbound-checkconf
+	strip unbound-host
 
 install:
-	$(INSTALL) -d $(bindir)
-	$(INSTALL) -d $(mandir)
-	$(INSTALL) -d $(mandir)/man8
-	$(INSTALL) -d $(mandir)/man5
-	$(LIBTOOL) --mode=install cp unbound $(bindir)/unbound
-	$(LIBTOOL) --mode=install cp unbound-checkconf $(bindir)/unbound-checkconf
-	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound.8 $(mandir)/man8
-	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-checkconf.8 $(mandir)/man8
-	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound.conf.5 $(mandir)/man5
-	if test ! -e $(configfile); then $(INSTALL) -d `dirname $(configfile)`; $(INSTALL) -c -m 644 $(srcdir)/doc/example.conf $(configfile); fi
+	$(INSTALL) -m 755 -d $(DESTDIR)$(sbindir)
+	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)
+	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man8
+	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man5
+	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man3
+	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man1
+	$(INSTALL) -m 755 -d $(DESTDIR)$(libdir)
+	$(INSTALL) -m 755 -d $(DESTDIR)$(includedir)
+	$(LIBTOOL) --mode=install cp unbound $(DESTDIR)$(sbindir)/unbound
+	$(LIBTOOL) --mode=install cp unbound-checkconf $(DESTDIR)$(sbindir)/unbound-checkconf
+	$(LIBTOOL) --mode=install cp unbound-host $(DESTDIR)$(sbindir)/unbound-host
+	$(INSTALL) -c -m 644 doc/unbound.8 $(DESTDIR)$(mandir)/man8
+	$(INSTALL) -c -m 644 doc/unbound-checkconf.8 $(DESTDIR)$(mandir)/man8
+	$(INSTALL) -c -m 644 doc/unbound.conf.5 $(DESTDIR)$(mandir)/man5
+	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-host.1 $(DESTDIR)$(mandir)/man1
+	$(INSTALL) -c -m 644 doc/libunbound.3 $(DESTDIR)$(mandir)/man3
+	if test ! -e $(DESTDIR)$(configfile); then $(INSTALL) -d `dirname $(DESTDIR)$(configfile)`; $(INSTALL) -c -m 644 doc/example.conf $(DESTDIR)$(configfile); fi
+	$(LIBTOOL) --mode=install cp $(srcdir)/libunbound/unbound.h $(DESTDIR)$(includedir)/unbound.h
+	$(LIBTOOL) --mode=install cp libunbound.la $(DESTDIR)$(libdir)
+	$(LIBTOOL) --mode=finish $(DESTDIR)$(libdir)
 
 uninstall:
-	rm -f -- $(bindir)/unbound $(bindir)/unbound-checkconf
-	rm -f -- $(mandir)/man8/unbound.8 $(mandir)/man8/unbound-checkconf.8 $(mandir)/man5/unbound.conf.5
+	rm -f -- $(DESTDIR)$(sbindir)/unbound $(DESTDIR)$(sbindir)/unbound-checkconf $(DESTDIR)$(sbindir)/unbound-host
+	rm -f -- $(DESTDIR)$(mandir)/man8/unbound.8 $(DESTDIR)$(mandir)/man8/unbound-checkconf.8 $(DESTDIR)$(mandir)/man5/unbound.conf.5
+	rm -f -- $(DESTDIR)$(mandir)/man1/unbound-host.1 $(DESTDIR)$(mandir)/man3/libunbound.3
+	rm -f -- $(DESTDIR)$(includedir)/unbound.h
+	$(LIBTOOL) --mode=uninstall rm -f $(DESTDIR)$(libdir)/libunbound.la
 	@echo
-	@echo "You still need to remove `dirname $(configfile)` , $(configfile) by hand"
+	@echo "You still need to remove "`dirname $(DESTDIR)$(configfile)`" , $(DESTDIR)$(configfile) by hand"
 
 download_ldns:
-	svn export https://www.nlnetlabs.nl/ldns/svn/trunk/makedist.sh ldns_makedist.sh
-	./ldns_makedist.sh -s -d https://www.nlnetlabs.nl/ldns/svn/trunk
+	svn export https://www.nlnetlabs.nl/svn/ldns/trunk/makedist.sh ldns_makedist.sh
+	./ldns_makedist.sh -s -d https://www.nlnetlabs.nl/svn/ldns/trunk
 	mv ldns-*_pre_*.tar.gz ldns-src.tar.gz
 	rm ldns-*_pre_*.tar.gz.sha1 ldns_makedist.sh
 
+iana_update:
+	curl -o port-numbers.tmp http://www.iana.org/assignments/port-numbers
+	egrep -v "Unassigned|Reserved" port-numbers.tmp | awk '{ match($$0, "[0-9]+/udp"); if (RLENGTH > 0) print substr($$0, RSTART, RLENGTH - 4) ","}' | sort -nu > portslist.tmp
+	cat portslist.tmp > util/iana_ports.inc
+	rm -f port-numbers.tmp portslist.tmp
+
 # Automatic dependencies.
 $(BUILD)%.d: $(srcdir)/%.c
 	$(INFO) Depend $<
 	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
 		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
-	@if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
+	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(SHELL) -ec '$(CC) -MM $(CPPFLAGS) $(CFLAGS) $< \
-	              | sed '\''s!\(.*\)\.o[ :]*!$(dir $@)\1.o $@ : !g'\'' > $@; \
+	              | sed '\''s!\(.*\)\.o[ :]*!$(dir $@)\1.lo $@ : !g'\'' > $@; \
 	              [ -s $@ ] || rm -f $@'
 
 ifneq ($(MAKECMDGOALS),clean)
 ifneq ($(MAKECMDGOALS),realclean)
+ifeq ($(debug_enabled),yes)
 -include $(addprefix $(BUILD),$(ALL_SRC:.c=.d))
 endif
 endif
+endif

README

@@ -1,9 +1,9 @@
 Unbound README
 * ./configure && make && make install
 * on BSDs and Solaris use gmake (GNU make).
-* If it complains that no libevent can be found; libevent is useful when
-  using many (10000) outgoing ports. By default 16 ports are used and the
-  builtin alternative is equally capable.
+* You can use libevent if you want. libevent is useful when using 
+  many (10000) outgoing ports. By default 16 ports are used and the
+  builtin alternative is equally capable and a little faster.
 * More detailed README, README.svn, README.tests in doc directory
 * manual pages can be found in doc directory, and are installed, unbound(8).
 * example configuration file doc/example.conf

checkconf/unbound-checkconf.c

@@ -1,215 +0,0 @@
-/*
- * checkconf/unbound-checkconf.c - config file checker for unbound.conf file.
- *
- * Copyright (c) 2007, NLnet Labs. All rights reserved.
- *
- * This software is open source.
- * 
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 
- * Redistributions of source code must retain the above copyright notice,
- * this list of conditions and the following disclaimer.
- * 
- * Redistributions in binary form must reproduce the above copyright notice,
- * this list of conditions and the following disclaimer in the documentation
- * and/or other materials provided with the distribution.
- * 
- * Neither the name of the NLNET LABS nor the names of its contributors may
- * be used to endorse or promote products derived from this software without
- * specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
- * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
- * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
- * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
- * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
- * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
- * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
- * POSSIBILITY OF SUCH DAMAGE.
- */
-
-/**
- * \file
- *
- * The config checker checks for syntax and other errors in the unbound.conf
- * file, and can be used to check for errors before the server is started
- * or sigHUPped.
- * Exit status 1 means an error.
- */
-
-#include "config.h"
-#include "util/log.h"
-#include "util/config_file.h"
-#include "util/module.h"
-#include "util/net_help.h"
-#include "util/regional.h"
-#include "iterator/iterator.h"
-#include "validator/validator.h"
-#include "services/localzone.h"
-#include <pwd.h>
-
-/** Give checkconf usage, and exit (1). */
-static void
-usage()
-{
-	printf("Usage:	unbound-checkconf [file]\n");
-	printf("	Checks unbound configuration file for errors.\n");
-	printf("file	if omitted %s is used.\n", CONFIGFILE);
-	printf("-h	show this usage help.\n");
-	printf("Version %s\n", PACKAGE_VERSION);
-	printf("BSD licensed, see LICENSE in source package for details.\n");
-	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
-	exit(1);
-}
-
-/** check if module works with config */
-static void
-check_mod(struct config_file* cfg, struct module_func_block* fb)
-{
-	struct module_env env;
-	memset(&env, 0, sizeof(env));
-	env.cfg = cfg;
-	env.scratch = regional_create();
-	env.scratch_buffer = ldns_buffer_new(BUFSIZ);
-	if(!env.scratch || !env.scratch_buffer)
-		fatal_exit("out of memory");
-	if(!(*fb->init)(&env, 0)) {
-		fatal_exit("bad config for %s module", fb->name);
-	}
-	(*fb->deinit)(&env, 0);
-	ldns_buffer_free(env.scratch_buffer);
-	regional_destroy(env.scratch);
-}
-
-/** check configuration for errors */
-static void
-morechecks(struct config_file* cfg)
-{
-	int i;
-	struct sockaddr_storage a;
-	socklen_t alen;
-	struct config_str2list* acl;
-	struct local_zones* zs;
-	for(i=0; i<cfg->num_ifs; i++) {
-		if(!ipstrtoaddr(cfg->ifs[i], UNBOUND_DNS_PORT, &a, &alen)) {
-			fatal_exit("cannot parse interface specified as '%s'",
-				cfg->ifs[i]);
-		}
-	}
-	for(i=0; i<cfg->num_out_ifs; i++) {
-		if(!ipstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, 
-			&a, &alen)) {
-			fatal_exit("cannot parse outgoing-interface "
-				"specified as '%s'", cfg->out_ifs[i]);
-		}
-	}
-	for(acl=cfg->acls; acl; acl = acl->next) {
-		if(!netblockstrtoaddr(acl->str, UNBOUND_DNS_PORT, &a, &alen, 
-			&i)) {
-			fatal_exit("cannot parse access control address %s %s",
-				acl->str, acl->str2);
-		}
-	}
-
-	if(cfg->verbosity < 0)
-		fatal_exit("verbosity value < 0");
-	if(cfg->num_threads < 0 || cfg->num_threads > 10000)
-		fatal_exit("num_threads value weird");
-	if(!cfg->do_ip4 && !cfg->do_ip6)
-		fatal_exit("ip4 and ip6 are both disabled, pointless");
-	if(!cfg->do_udp && !cfg->do_tcp)
-		fatal_exit("udp and tcp are both disabled, pointless");
-
-	if(cfg->chrootdir && strncmp(cfg->chrootdir, cfg->directory,
-		strlen(cfg->chrootdir)) != 0)
-		fatal_exit("working directory %s not in chrootdir %s",
-			cfg->directory, cfg->chrootdir);
-	if(cfg->chrootdir && cfg->pidfile && cfg->pidfile[0] &&
-		strncmp(cfg->chrootdir, cfg->pidfile,
-			strlen(cfg->chrootdir)) != 0)
-		fatal_exit("pid file %s not in chrootdir %s",
-			cfg->pidfile, cfg->chrootdir);
-	if(cfg->chrootdir && cfg->logfile && cfg->logfile[0] &&
-		strncmp(cfg->chrootdir, cfg->logfile,
-			strlen(cfg->chrootdir)) != 0)
-		fatal_exit("log file %s not in chrootdir %s",
-			cfg->logfile, cfg->chrootdir);
-	
-	if(strcmp(cfg->module_conf, "iterator") != 0 &&
-		strcmp(cfg->module_conf, "validator iterator") != 0) {
-		fatal_exit("module conf '%s' is not known to work",
-			cfg->module_conf);
-	}
-
-	if(cfg->username && cfg->username[0]) {
-		struct passwd *pwd;
-		if((pwd = getpwnam(cfg->username)) == NULL)
-			fatal_exit("user '%s' does not exist.", cfg->username);
-		endpwent();
-	}
-
-	if(!(zs = local_zones_create()))
-		fatal_exit("out of memory");
-	if(!local_zones_apply_cfg(zs, cfg))
-		fatal_exit("failed local-zone, local-data configuration");
-	local_zones_print(zs); /* @@@ DEBUG */
-	local_zones_delete(zs);
-}
-
-/** check config file */
-static void
-checkconf(char* cfgfile)
-{
-	struct config_file* cfg = config_create();
-	if(!cfg)
-		fatal_exit("out of memory");
-	if(!config_read(cfg, cfgfile)) {
-		/* config_read prints messages to stderr */
-		config_delete(cfg);
-		exit(1);
-	}
-	morechecks(cfg);
-	check_mod(cfg, iter_get_funcblock());
-	check_mod(cfg, val_get_funcblock());
-	config_delete(cfg);
-	printf("unbound-checkconf: no errors in %s\n", cfgfile);
-}
-
-/** getopt global, in case header files fail to declare it. */
-extern int optind;
-/** getopt global, in case header files fail to declare it. */
-extern char* optarg;
-
-/** Main routine for checkconf */
-int main(int argc, char* argv[])
-{
-	int c;
-	char* f;
-	log_ident_set("unbound-checkconf");
-	log_init(NULL, 0, NULL);
-	checklock_start();
-	/* parse the options */
-	while( (c=getopt(argc, argv, "h")) != -1) {
-		switch(c) {
-		case '?':
-		case 'h':
-		default:
-			usage();
-		}
-	}
-	argc -= optind;
-	argv += optind;
-	if(argc != 0 && argc != 1)
-		usage();
-	if(argc == 1)
-		f = argv[0];
-	else	f = CONFIGFILE;
-	checkconf(f);
-	checklock_stop();
-	return 0;
-}

compat/gmtime_r.c

@@ -0,0 +1,107 @@
+/*
+ * Taken from FreeBSD src / lib / libc / stdtime / localtime.c 1.43 revision.
+ * localtime.c 7.78.
+ * tzfile.h 1.8
+ * adapted to be replacement gmtime_r.
+ */
+#include "config.h"
+
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+
+#define MONSPERYEAR 12
+#define DAYSPERNYEAR 365
+#define DAYSPERLYEAR 366
+#define SECSPERMIN 60
+#define SECSPERHOUR (60*60)
+#define SECSPERDAY (24*60*60)
+#define DAYSPERWEEK 7
+#define TM_SUNDAY	0
+#define TM_MONDAY	1
+#define TM_TUESDAY	2
+#define TM_WEDNESDAY	3
+#define TM_THURSDAY	4
+#define TM_FRIDAY	5
+#define TM_SATURDAY	6
+
+#define TM_YEAR_BASE	1900
+
+#define EPOCH_YEAR	1970
+#define EPOCH_WDAY	TM_THURSDAY
+
+#define isleap(y) (((y) % 4) == 0 && (((y) % 100) != 0 || ((y) % 400) == 0))
+
+static const int	mon_lengths[2][MONSPERYEAR] = {
+	{ 31, 28, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 },
+	{ 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 }
+};
+
+static const int	year_lengths[2] = {
+	DAYSPERNYEAR, DAYSPERLYEAR
+};
+
+static void
+timesub(timep, offset, tmp)
+const time_t * const			timep;
+const long				offset;
+struct tm * const		tmp;
+{
+	long			days;
+	long			rem;
+	long			y;
+	int			yleap;
+	const int *		ip;
+
+	days = *timep / SECSPERDAY;
+	rem = *timep % SECSPERDAY;
+	rem += (offset);
+	while (rem < 0) {
+		rem += SECSPERDAY;
+		--days;
+	}
+	while (rem >= SECSPERDAY) {
+		rem -= SECSPERDAY;
+		++days;
+	}
+	tmp->tm_hour = (int) (rem / SECSPERHOUR);
+	rem = rem % SECSPERHOUR;
+	tmp->tm_min = (int) (rem / SECSPERMIN);
+	/*
+	** A positive leap second requires a special
+	** representation.  This uses "... ??:59:60" et seq.
+	*/
+	tmp->tm_sec = (int) (rem % SECSPERMIN) ;
+	tmp->tm_wday = (int) ((EPOCH_WDAY + days) % DAYSPERWEEK);
+	if (tmp->tm_wday < 0)
+		tmp->tm_wday += DAYSPERWEEK;
+	y = EPOCH_YEAR;
+#define LEAPS_THRU_END_OF(y)	((y) / 4 - (y) / 100 + (y) / 400)
+	while (days < 0 || days >= (long) year_lengths[yleap = isleap(y)]) {
+		long	newy;
+
+		newy = y + days / DAYSPERNYEAR;
+		if (days < 0)
+			--newy;
+		days -= (newy - y) * DAYSPERNYEAR +
+			LEAPS_THRU_END_OF(newy - 1) -
+			LEAPS_THRU_END_OF(y - 1);
+		y = newy;
+	}
+	tmp->tm_year = y - TM_YEAR_BASE;
+	tmp->tm_yday = (int) days;
+	ip = mon_lengths[yleap];
+	for (tmp->tm_mon = 0; days >= (long) ip[tmp->tm_mon]; ++(tmp->tm_mon))
+		days = days - (long) ip[tmp->tm_mon];
+	tmp->tm_mday = (int) (days + 1);
+	tmp->tm_isdst = 0;
+}
+
+/*
+* Re-entrant version of gmtime.
+*/
+struct tm * gmtime_r(const time_t* timep, struct tm *tm)
+{
+	timesub(timep, 0L, tm);
+	return tm;
+}

compat/inet_aton.c

@@ -56,8 +56,12 @@
 
 #include <sys/types.h>
 #include <sys/param.h>
+#ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
 #include <arpa/inet.h>
+#endif
 #include <ctype.h>
 
 #if 0

compat/inet_ntop.c

@@ -23,8 +23,12 @@
 
 #include <sys/param.h>
 #include <sys/types.h>
+#ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
+#endif
+#ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
+#endif
 #include <string.h>
 #include <errno.h>
 #include <stdio.h>
@@ -62,7 +66,11 @@ inet_ntop(int af, const void *src, char *dst, size_t size)
 	case AF_INET6:
 		return (inet_ntop6(src, dst, size));
 	default:
+#ifdef EAFNOSUPPORT
 		errno = EAFNOSUPPORT;
+#else
+		errno = ENOSYS;
+#endif
 		return (NULL);
 	}
 	/* NOTREACHED */

compat/inet_pton.c

@@ -70,7 +70,11 @@ inet_pton(af, src, dst)
 	case AF_INET6:
 		return (inet_pton6(src, dst));
 	default:
+#ifdef EAFNOSUPPORT
 		errno = EAFNOSUPPORT;
+#else
+		errno = ENOSYS;
+#endif
 		return (-1);
 	}
 	/* NOTREACHED */

compat/snprintf.c

@@ -528,7 +528,7 @@ static long double abs_val (long double value)
   return result;
 }
 
-static long double pow10 (int exp)
+static long double compat_pow10 (int exp)
 {
   long double result = 1;
 
@@ -541,7 +541,7 @@ static long double pow10 (int exp)
   return result;
 }
 
-static long round (long double value)
+static long compat_round (long double value)
 {
   long intpart;
 
@@ -602,12 +602,12 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
   /* We "cheat" by converting the fractional part to integer by
    * multiplying by a factor of 10
    */
-  fracpart = round ((pow10 (max)) * (ufvalue - intpart));
+  fracpart = compat_round ((compat_pow10 (max)) * (ufvalue - intpart));
 
-  if (fracpart >= pow10 (max))
+  if (fracpart >= compat_pow10 (max))
   {
     intpart++;
-    fracpart -= pow10 (max);
+    fracpart -= compat_pow10 (max);
   }
 
 #ifdef DEBUG_SNPRINTF

compat/socketpair.c

@@ -0,0 +1,34 @@
+/* socketpair.c - windows mingw32 replacement for socketpair.
+ * creates a pipe that works like a socketpair a bit
+ * Taken from libevent-1.4.3.stable WIN32-Code/misc.c
+ * License: BSD.
+ */
+#include "config.h"
+#include <stdio.h>
+#include <windows.h>
+
+int
+socketpair(int d, int type, int protocol, int *sv)
+{
+	static int count;
+	char buf[64];
+	HANDLE fd;
+	DWORD dwMode;
+	(void)d; (void)type; (void)protocol;
+	sprintf(buf, "\\\\.\\pipe\\levent-%d", count++);
+	/* Create a duplex pipe which will behave like a socket pair */
+	fd = CreateNamedPipe(buf, PIPE_ACCESS_DUPLEX, PIPE_TYPE_BYTE | PIPE_NOWAIT, 
+		PIPE_UNLIMITED_INSTANCES, 4096, 4096, 0, NULL);
+	if (fd == INVALID_HANDLE_VALUE)
+		return (-1);
+	sv[0] = (int)fd;
+
+	fd = CreateFile(buf, GENERIC_READ|GENERIC_WRITE, 0, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+	if (fd == INVALID_HANDLE_VALUE)
+		return (-1);
+	dwMode = PIPE_NOWAIT;
+	SetNamedPipeHandleState(fd, &dwMode, NULL, NULL);
+	sv[1] = (int)fd;
+
+	return (0);
+}

config.guess

@@ -4,7 +4,7 @@
 #   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
 #   Inc.
 
-timestamp='2006-07-02'
+timestamp='2007-05-17'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -161,6 +161,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	    arm*) machine=arm-unknown ;;
 	    sh3el) machine=shl-unknown ;;
 	    sh3eb) machine=sh-unknown ;;
+	    sh5el) machine=sh5le-unknown ;;
 	    *) machine=${UNAME_MACHINE_ARCH}-unknown ;;
 	esac
 	# The Operating System including object format, if it has switched
@@ -329,7 +330,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
     sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
 	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
-    i86pc:SunOS:5.*:*)
+    i86pc:SunOS:5.*:* | ix86xen:SunOS:5.*:*)
 	echo i386-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
     sun4*:SunOS:6*:*)
@@ -780,7 +781,7 @@ EOF
     i*:CYGWIN*:*)
 	echo ${UNAME_MACHINE}-pc-cygwin
 	exit ;;
-    i*:MINGW*:*)
+    *:MINGW*:*)
 	echo ${UNAME_MACHINE}-pc-mingw32
 	exit ;;
     i*:windows32*:*)
@@ -790,12 +791,15 @@ EOF
     i*:PW*:*)
 	echo ${UNAME_MACHINE}-pc-pw32
 	exit ;;
-    x86:Interix*:[3456]*)
-	echo i586-pc-interix${UNAME_RELEASE}
-	exit ;;
-    EM64T:Interix*:[3456]*)
-	echo x86_64-unknown-interix${UNAME_RELEASE}
-	exit ;;
+    *:Interix*:[3456]*)
+    	case ${UNAME_MACHINE} in
+	    x86) 
+		echo i586-pc-interix${UNAME_RELEASE}
+		exit ;;
+	    EM64T | authenticamd)
+		echo x86_64-unknown-interix${UNAME_RELEASE}
+		exit ;;
+	esac ;;
     [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
 	echo i${UNAME_MACHINE}-pc-mks
 	exit ;;
@@ -950,6 +954,9 @@ EOF
     x86_64:Linux:*:*)
 	echo x86_64-unknown-linux-gnu
 	exit ;;
+    xtensa:Linux:*:*)
+    	echo xtensa-unknown-linux-gnu
+	exit ;;
     i*86:Linux:*:*)
 	# The BFD linker knows what the default object file format is, so
 	# first see if it will tell us. cd to the root directory to prevent
@@ -1208,6 +1215,15 @@ EOF
     SX-6:SUPER-UX:*:*)
 	echo sx6-nec-superux${UNAME_RELEASE}
 	exit ;;
+    SX-7:SUPER-UX:*:*)
+	echo sx7-nec-superux${UNAME_RELEASE}
+	exit ;;
+    SX-8:SUPER-UX:*:*)
+	echo sx8-nec-superux${UNAME_RELEASE}
+	exit ;;
+    SX-8R:SUPER-UX:*:*)
+	echo sx8r-nec-superux${UNAME_RELEASE}
+	exit ;;
     Power*:Rhapsody:*:*)
 	echo powerpc-apple-rhapsody${UNAME_RELEASE}
 	exit ;;

config.h.in

@@ -1,5 +1,8 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */
 
+/* Directory to chroot to */
+#undef CHROOT_DIR
+
 /* Pathname to the Unbound configuration file */
 #undef CONFIGFILE
 
@@ -18,30 +21,51 @@
 /* Define to 1 if your system has a working `chown' function. */
 #undef HAVE_CHOWN
 
+/* Define to 1 if you have the `chroot' function. */
+#undef HAVE_CHROOT
+
 /* Define to 1 if you have the <dlfcn.h> header file. */
 #undef HAVE_DLFCN_H
 
 /* Define to 1 if you have the `event_base_free' function. */
 #undef HAVE_EVENT_BASE_FREE
 
+/* Define to 1 if you have the `event_base_get_method' function. */
+#undef HAVE_EVENT_BASE_GET_METHOD
+
 /* Define to 1 if you have the `event_base_once' function. */
 #undef HAVE_EVENT_BASE_ONCE
 
 /* Define to 1 if you have the <event.h> header file. */
 #undef HAVE_EVENT_H
 
+/* Define to 1 if you have the `fcntl' function. */
+#undef HAVE_FCNTL
+
 /* Define to 1 if you have the `fork' function. */
 #undef HAVE_FORK
 
 /* Define to 1 if fseeko (and presumably ftello) exists and is declared. */
 #undef HAVE_FSEEKO
 
-/* Define to 1 if you have the `getaddrinfo' function. */
+/* Whether getaddrinfo is available */
 #undef HAVE_GETADDRINFO
 
 /* Define to 1 if you have the <getopt.h> header file. */
 #undef HAVE_GETOPT_H
 
+/* Define to 1 if you have the `getpwnam' function. */
+#undef HAVE_GETPWNAM
+
+/* Define to 1 if you have the `getrlimit' function. */
+#undef HAVE_GETRLIMIT
+
+/* Define to 1 if you have the `gmtime_r' function. */
+#undef HAVE_GMTIME_R
+
+/* If you have HMAC_CTX_init */
+#undef HAVE_HMAC_CTX_INIT
+
 /* Define to 1 if you have the `inet_aton' function. */
 #undef HAVE_INET_ATON
 
@@ -54,17 +78,14 @@
 /* Define to 1 if you have the <inttypes.h> header file. */
 #undef HAVE_INTTYPES_H
 
-/* Define to 1 if you have the `crypto' library (-lcrypto). */
-#undef HAVE_LIBCRYPTO
+/* if the function 'ioctlsocket' is available */
+#undef HAVE_IOCTLSOCKET
 
-/* Define to 1 if you have the `nsl' library (-lnsl). */
-#undef HAVE_LIBNSL
+/* Define to 1 if you have the `kill' function. */
+#undef HAVE_KILL
 
-/* Define to 1 if you have the `rt' library (-lrt). */
-#undef HAVE_LIBRT
-
-/* Define to 1 if you have the `socket' library (-lsocket). */
-#undef HAVE_LIBSOCKET
+/* Define to 1 if you have the `ldns' library (-lldns). */
+#undef HAVE_LIBLDNS
 
 /* Define to 1 if your system has a GNU libc compatible `malloc' function, and
    to 0 otherwise. */
@@ -76,12 +97,18 @@
 /* Define to 1 if you have the <memory.h> header file. */
 #undef HAVE_MEMORY_H
 
+/* Define to 1 if you have the <netdb.h> header file. */
+#undef HAVE_NETDB_H
+
 /* Define to 1 if you have the <netinet/in.h> header file. */
 #undef HAVE_NETINET_IN_H
 
 /* Define to 1 if you have the <openssl/err.h> header file. */
 #undef HAVE_OPENSSL_ERR_H
 
+/* Define to 1 if you have the <openssl/rand.h> header file. */
+#undef HAVE_OPENSSL_RAND_H
+
 /* Define to 1 if you have the <openssl/ssl.h> header file. */
 #undef HAVE_OPENSSL_SSL_H
 
@@ -94,12 +121,42 @@
 /* Define to 1 if the system has the type `pthread_spinlock_t'. */
 #undef HAVE_PTHREAD_SPINLOCK_T
 
+/* Define to 1 if you have the <pwd.h> header file. */
+#undef HAVE_PWD_H
+
+/* Define to 1 if you have the `random' function. */
+#undef HAVE_RANDOM
+
+/* Define to 1 if you have the `recvmsg' function. */
+#undef HAVE_RECVMSG
+
+/* Define to 1 if you have the `sbrk' function. */
+#undef HAVE_SBRK
+
+/* Define to 1 if you have the `sendmsg' function. */
+#undef HAVE_SENDMSG
+
+/* Define to 1 if you have the `setsid' function. */
+#undef HAVE_SETSID
+
+/* Define to 1 if you have the `sigprocmask' function. */
+#undef HAVE_SIGPROCMASK
+
+/* Define to 1 if you have the `sleep' function. */
+#undef HAVE_SLEEP
+
 /* Define to 1 if you have the `snprintf' function. */
 #undef HAVE_SNPRINTF
 
+/* Define to 1 if you have the `socketpair' function. */
+#undef HAVE_SOCKETPAIR
+
 /* Using Solaris threads */
 #undef HAVE_SOLARIS_THREADS
 
+/* Define to 1 if you have the `srandom' function. */
+#undef HAVE_SRANDOM
+
 /* Define if you have the SSL libraries installed. */
 #undef HAVE_SSL
 
@@ -130,6 +187,9 @@
 /* Define to 1 if you have the <sys/param.h> header file. */
 #undef HAVE_SYS_PARAM_H
 
+/* Define to 1 if you have the <sys/resource.h> header file. */
+#undef HAVE_SYS_RESOURCE_H
+
 /* Define to 1 if you have the <sys/socket.h> header file. */
 #undef HAVE_SYS_SOCKET_H
 
@@ -142,27 +202,54 @@
 /* Define to 1 if you have the <sys/uio.h> header file. */
 #undef HAVE_SYS_UIO_H
 
+/* Define to 1 if you have the <sys/wait.h> header file. */
+#undef HAVE_SYS_WAIT_H
+
 /* Define to 1 if you have the <time.h> header file. */
 #undef HAVE_TIME_H
 
+/* Define to 1 if you have the `tzset' function. */
+#undef HAVE_TZSET
+
 /* Define to 1 if you have the <unistd.h> header file. */
 #undef HAVE_UNISTD_H
 
+/* Define to 1 if you have the `usleep' function. */
+#undef HAVE_USLEEP
+
 /* Define to 1 if you have the `vfork' function. */
 #undef HAVE_VFORK
 
 /* Define to 1 if you have the <vfork.h> header file. */
 #undef HAVE_VFORK_H
 
+/* Define to 1 if you have the <windows.h> header file. */
+#undef HAVE_WINDOWS_H
+
+/* Using Windows threads */
+#undef HAVE_WINDOWS_THREADS
+
+/* Define to 1 if you have the <winsock2.h> header file. */
+#undef HAVE_WINSOCK2_H
+
 /* Define to 1 if `fork' works. */
 #undef HAVE_WORKING_FORK
 
 /* Define to 1 if `vfork' works. */
 #undef HAVE_WORKING_VFORK
 
+/* Define to 1 if you have the `writev' function. */
+#undef HAVE_WRITEV
+
+/* Define to 1 if you have the <ws2tcpip.h> header file. */
+#undef HAVE_WS2TCPIP_H
+
 /* Define to the maximum message length to pass to syslog. */
 #undef MAXSYSLOGMSGLEN
 
+/* Define if mkdir has one argument. */
+#undef MKDIR_HAS_ONE_ARG
+
 /* Define to the address where bug reports for this package should be sent. */
 #undef PACKAGE_BUGREPORT
 
@@ -178,6 +265,9 @@
 /* Define to the version of this package. */
 #undef PACKAGE_VERSION
 
+/* default pidfile location */
+#undef PIDFILE
+
 /* Define to necessary symbol if this constant uses a non-standard name on
    your system. */
 #undef PTHREAD_CREATE_JOINABLE
@@ -185,18 +275,30 @@
 /* Define as the return type of signal handlers (`int' or `void'). */
 #undef RETSIGTYPE
 
+/* Directory to chdir to */
+#undef RUN_DIR
+
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS
 
-/* Define to 'int' or type of struct msghdr.msg_iovlen. */
-#undef TYPE_MSGIOVLEN
+/* default username */
+#undef UB_USERNAME
 
 /* use statistics for allocs and frees, for debug use */
 #undef UNBOUND_ALLOC_STATS
 
+/* define this to enable debug checks. */
+#undef UNBOUND_DEBUG
+
 /* Define if you want to use internal select based events */
 #undef USE_MINI_EVENT
 
+/* Whether the windows socket API is used */
+#undef USE_WINSOCK
+
+/* the version of the windows API enabled */
+#undef WINVER
+
 /* Define to 1 if `lex' declares `yytext' as a `char *' by default, not a
    `char[]'. */
 #undef YYTEXT_POINTER
@@ -256,6 +358,9 @@
 /* Define to `int' if <sys/types.h> does not define. */
 #undef pid_t
 
+/* Define to 'int' if not defined */
+#undef rlim_t
+
 /* Define to `unsigned int' if <sys/types.h> does not define. */
 #undef size_t
 
@@ -287,6 +392,10 @@
 #undef vfork
 
 
+#ifndef UNBOUND_DEBUG
+#  define NDEBUG
+#endif
+
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
@@ -323,6 +432,14 @@
 #include <arpa/inet.h>
 #endif
 
+#ifdef HAVE_WINSOCK2_H
+#include <winsock2.h>
+#endif
+
+#ifdef HAVE_WS2TCPIP_H
+#include <ws2tcpip.h>
+#endif
+
 #ifdef HAVE_GETOPT_H
 #include <getopt.h>
 #endif
@@ -331,6 +448,10 @@
 #include <openssl/err.h>
 #endif
 
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
+
 #ifdef HAVE_ATTR_FORMAT
 #  define ATTR_FORMAT(archetype, string_index, first_to_check) \
     __attribute__ ((format (archetype, string_index, first_to_check)))
@@ -359,6 +480,10 @@
 #define RAND_MAX	2147483647
 #endif
 
+#ifndef MAXHOSTNAMELEN
+#define MAXHOSTNAMELEN 256
+#endif
+
 #ifndef IPV6_MIN_MTU
 #define IPV6_MIN_MTU 1280
 #endif /* IPV6_MIN_MTU */
@@ -376,30 +501,68 @@
 #define MAXINCLUDES 10
 
 #ifndef HAVE_SNPRINTF
+#define snprintf snprintf_unbound
+#define vsnprintf vsnprintf_unbound
 #include <stdarg.h>
 int snprintf (char *str, size_t count, const char *fmt, ...);
 int vsnprintf (char *str, size_t count, const char *fmt, va_list arg);
 #endif /* HAVE_SNPRINTF */
 #ifndef HAVE_INET_PTON
+#define inet_pton inet_pton_unbound
 int inet_pton(int af, const char* src, void* dst);
 #endif /* HAVE_INET_PTON */
 #ifndef HAVE_INET_NTOP
+#define inet_ntop inet_ntop_unbound
 const char *inet_ntop(int af, const void *src, char *dst, size_t size);
 #endif
 #ifndef HAVE_INET_ATON
+#define inet_aton inet_aton_unbound
 int inet_aton(const char *cp, struct in_addr *addr);
 #endif
 #ifndef HAVE_MEMMOVE
+#define memmove memmove_unbound
 void *memmove(void *dest, const void *src, size_t n);
 #endif
 #ifndef HAVE_STRLCPY
+#define strlcpy strlcpy_unbound
 size_t strlcpy(char *dst, const char *src, size_t siz);
 #endif
+#ifndef HAVE_GMTIME_R
+#define gmtime_r gmtime_r_unbound
+struct tm *gmtime_r(const time_t *timep, struct tm *result);
+#endif
 #ifndef HAVE_GETADDRINFO
+#define getaddrinfo getaddrinfo_unbound
+#define gai_strerror gai_strerror_unbound
+#define freeaddrinfo freeaddrinfo_unbound
+#define getnameinfo getnameinfo_unbound
 struct sockaddr_storage;
 #include "compat/fake-rfc2553.h"
 #endif
 
+#ifndef HAVE_SLEEP
+#define sleep(x) Sleep((x)*1000) /* on win32 */
+#endif /* HAVE_SLEEP */
+#ifndef HAVE_USLEEP
+#define usleep(x) Sleep((x)/1000 + 1) /* on win32 */
+#endif /* HAVE_USLEEP */
+#ifndef HAVE_RANDOM
+#define random rand /* on win32, for tests only (bad random) */
+#endif /* HAVE_RANDOM */
+#ifndef HAVE_SRANDOM
+#define srandom(x) srand(x) /* on win32, for tests only (bad random) */
+#endif /* HAVE_SRANDOM */
+#ifndef HAVE_SOCKETPAIR
+int socketpair(int d, int type, int protocol, int *sv);
+#endif
+
+/* detect if we need to cast to unsigned int for FD_SET to avoid warnings */
+#ifdef HAVE_WINSOCK2_H
+#define FD_SET_T (u_int)
+#else
+#define FD_SET_T 
+#endif
+
 #include "ldns/ldns.h"
 
 #ifdef UNBOUND_ALLOC_STATS

config.sub

@@ -4,7 +4,7 @@
 #   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
 #   Inc.
 
-timestamp='2006-09-20'
+timestamp='2007-04-29'
 
 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -245,12 +245,12 @@ case $basic_machine in
 	| bfin \
 	| c4x | clipper \
 	| d10v | d30v | dlx | dsp16xx \
-	| fr30 | frv \
+	| fido | fr30 | frv \
 	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
 	| i370 | i860 | i960 | ia64 \
 	| ip2k | iq2000 \
 	| m32c | m32r | m32rle | m68000 | m68k | m88k \
-	| maxq | mb | microblaze | mcore \
+	| maxq | mb | microblaze | mcore | mep \
 	| mips | mipsbe | mipseb | mipsel | mipsle \
 	| mips16 \
 	| mips64 | mips64el \
@@ -324,7 +324,7 @@ case $basic_machine in
 	| clipper-* | craynv-* | cydra-* \
 	| d10v-* | d30v-* | dlx-* \
 	| elxsi-* \
-	| f30[01]-* | f700-* | fr30-* | frv-* | fx80-* \
+	| f30[01]-* | f700-* | fido-* | fr30-* | frv-* | fx80-* \
 	| h8300-* | h8500-* \
 	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
 	| i*86-* | i860-* | i960-* | ia64-* \
@@ -683,6 +683,10 @@ case $basic_machine in
 		basic_machine=i386-pc
 		os=-mingw32
 		;;
+	mingw32ce)
+		basic_machine=arm-unknown
+		os=-mingw32ce
+		;;
 	miniframe)
 		basic_machine=m68000-convergent
 		;;
@@ -925,6 +929,9 @@ case $basic_machine in
 		basic_machine=sh-hitachi
 		os=-hms
 		;;
+	sh5el)
+		basic_machine=sh5le-unknown
+		;;
 	sh64)
 		basic_machine=sh64-unknown
 		;;
@@ -1219,7 +1226,7 @@ case $os in
 	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
 	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
 	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
-	      | -skyos* | -haiku* | -rdos* | -toppers*)
+	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1414,6 +1421,9 @@ case $basic_machine in
 	m68*-cisco)
 		os=-aout
 		;;
+        mep-*)
+		os=-elf
+		;;
 	mips*-cisco)
 		os=-elf
 		;;

configure.ac

@@ -1,40 +1,95 @@
 #                                               -*- Autoconf -*-
 # Process this file with autoconf to produce a configure script.
-AC_PREREQ(2.57)
+AC_PREREQ(2.56)
 
-AC_INIT(unbound, 0.8, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound,1.0.2, unbound-bugs@nlnetlabs.nl, unbound)
+
+LIBUNBOUND_CURRENT=0
+LIBUNBOUND_REVISION=14
+LIBUNBOUND_AGE=0
+# 1.0.0 had 0:12:0
+# 1.0.1 had 0:13:0
+# 1.0.2 had 0:14:0
+
+#   Current  -- the number of the binary API that we're implementing
+#   Revision -- which iteration of the implementation of the binary
+#               API are we supplying?
+#   Age      -- How many previous binary API versions do we also
+#               support?
+#
+# If we release a new version that does not change the binary API,
+# increment Revision.
+#
+# If we release a new version that changes the binary API, but does
+# not break programs compiled against the old binary API, increment
+# Current and Age.  Set Revision to 0, since this is the first
+# implementation of the new API.
+#
+# Otherwise, we're changing the binary API and breaking bakward
+# compatibility with old binaries.  Increment Current.  Set Age to 0,
+# since we're backward compatible with no previous APIs.  Set Revision
+# to 0 too.
+AC_SUBST(LIBUNBOUND_CURRENT)
+AC_SUBST(LIBUNBOUND_REVISION)
+AC_SUBST(LIBUNBOUND_AGE)
 
 CFLAGS=
 AC_AIX
 
 dnl
-dnl By default set $sysconfdir to /etc and $localstatedir to /var
+dnl By default set prefix to /usr/local
 dnl
 case "$prefix" in
         NONE)
-                case "$sysconfdir" in
-                        '${prefix}/etc')
-                                sysconfdir=/etc
-                        ;;
-                esac
-                case "$localstatedir" in
-                        '${prefix}/var')
-                                localstatedir=/var
-                        ;;
-                esac
+		prefix="/usr/local"
         ;;
 esac
 
 #
 # Determine configuration file
-ub_conf_file=${sysconfdir}/unbound/unbound.conf
+# the eval is to evaluate shell expansion twice
+ub_conf_file=`eval echo "${sysconfdir}/unbound/unbound.conf"`
 AC_ARG_WITH([conf_file],
-        AC_HELP_STRING([--with-conf-file=path], [Pathname to the Unbound configuration file]),
-	[ub_conf_file=$withval])
+        AC_HELP_STRING([--with-conf-file=path], 
+	[Pathname to the Unbound configuration file]),
+	[ub_conf_file="$withval"])
 AC_SUBST(ub_conf_file)
-# the eval is to evaluate shell expansion twice, once
-# for $nsd_conf_file and once for the ${prefix} within it.
-AC_DEFINE_UNQUOTED(CONFIGFILE, ["`eval echo $ub_conf_file`"], [Pathname to the Unbound configuration file])
+AC_DEFINE_UNQUOTED(CONFIGFILE, ["$ub_conf_file"], [Pathname to the Unbound configuration file])
+
+# Determine run, chroot directory and pidfile locations
+AC_ARG_WITH(run-dir, 
+    AC_HELP_STRING([--with-run-dir=path], 
+    [set default directory to chdir to (by default dir part of cfg file)]), 
+    UNBOUND_RUN_DIR="$withval", 
+    UNBOUND_RUN_DIR=`dirname "$ub_conf_file"`)
+AC_SUBST(UNBOUND_RUN_DIR)
+AC_DEFINE_UNQUOTED(RUN_DIR, ["$UNBOUND_RUN_DIR"], [Directory to chdir to])
+
+AC_ARG_WITH(chroot-dir, 
+    AC_HELP_STRING([--with-chroot-dir=path], 
+    [set default directory to chroot to (by default same as run-dir)]), 
+    UNBOUND_CHROOT_DIR="$withval", 
+    UNBOUND_CHROOT_DIR="$UNBOUND_RUN_DIR")
+AC_SUBST(UNBOUND_CHROOT_DIR)
+AC_DEFINE_UNQUOTED(CHROOT_DIR, ["$UNBOUND_CHROOT_DIR"], [Directory to chroot to])
+
+AC_ARG_WITH(pidfile, 
+    AC_HELP_STRING([--with-pidfile=filename], 
+    [set default pathname to unbound pidfile (default run-dir/unbound.pid)]), 
+    UNBOUND_PIDFILE="$withval", 
+    UNBOUND_PIDFILE="$UNBOUND_RUN_DIR/unbound.pid")
+AC_SUBST(UNBOUND_PIDFILE)
+AC_DEFINE_UNQUOTED(PIDFILE, ["$UNBOUND_PIDFILE"], [default pidfile location])
+
+AC_ARG_WITH(username, 
+    AC_HELP_STRING([--with-username=user], 
+    [set default user that unbound changes to (default user is unbound)]), 
+    UNBOUND_USERNAME="$withval", 
+    UNBOUND_USERNAME="unbound")
+AC_SUBST(UNBOUND_USERNAME)
+AC_DEFINE_UNQUOTED(UB_USERNAME, ["$UNBOUND_USERNAME"], [default username])
+
+AC_DEFINE(WINVER, 0x0502, [the version of the windows API enabled])
 
 dnl routine to help check for compiler flags.
 AC_DEFUN([CHECK_COMPILER_FLAG],
@@ -119,6 +174,43 @@ CHECK_COMPILER_FLAG(O2, [CFLAGS="$CFLAGS -O2"])
 
 AC_CHECK_HEADERS([getopt.h time.h],,, [AC_INCLUDES_DEFAULT])
 
+# MinGW32 tests
+AC_CHECK_HEADERS([winsock2.h ws2tcpip.h],,, [AC_INCLUDES_DEFAULT])
+# end mingw32 tests
+
+CHECK_COMPILER_FLAG_NEEDED(-std=c99 -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE,
+[
+#include "confdefs.h"
+#include <stdlib.h>
+#include <ctype.h>
+#include <sys/time.h>
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+#include <unistd.h>
+#include <netdb.h>
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+
+int test() {
+	int a;
+	char **opts = NULL;
+	struct timeval tv;
+	char *t;
+	time_t time = 0;
+	char *buf = NULL;
+	const char* str = NULL;
+	t = ctime_r(&time, buf);
+	tv.tv_usec = 10;
+	srandom(32);
+	a = getopt(2, opts, "a");
+	a = isascii(32);
+	str = gai_strerror(0);
+	return a;
+}
+], [CFLAGS="$CFLAGS -std=c99 -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_XOPEN_SOURCE_EXTENDED=1 -D_ALL_SOURCE"])
+
 CHECK_COMPILER_FLAG_NEEDED(-std=c99 -D__EXTENSIONS__ -D_BSD_SOURCE -D_POSIX_C_SOURCE=200112 -D_XOPEN_SOURCE=600 -D_ALL_SOURCE,
 [
 #include "confdefs.h"
@@ -173,6 +265,17 @@ int test() {
 }
 ], [CFLAGS="$CFLAGS -D_BSD_SOURCE"])
 
+CHECK_COMPILER_FLAG_NEEDED(-D_GNU_SOURCE,
+[
+#include <netinet/in.h>
+
+int test() {
+        struct in6_pktinfo inf;
+	int a = (int)sizeof(inf);
+        return a;
+}
+], [CFLAGS="$CFLAGS -D_GNU_SOURCE"])
+
 CHECK_COMPILER_FLAG_NEEDED(-D_POSIX_C_SOURCE=200112,
 [
 #include "confdefs.h"
@@ -223,10 +326,21 @@ int test() {
 CHECK_COMPILER_FLAG(xO4, [CFLAGS="$CFLAGS -xO4"])
 CHECK_COMPILER_FLAG(xtarget=generic, [CFLAGS="$CFLAGS -xtarget=generic"])
 # flag warnings.
-CHECK_COMPILER_FLAG(W, [CFLAGS="$CFLAGS -W"])
-CHECK_COMPILER_FLAG(Wall, [CFLAGS="$CFLAGS -Wall"])
-CHECK_COMPILER_FLAG(Wextra, [CFLAGS="$CFLAGS -Wextra"])
-CHECK_COMPILER_FLAG(Wdeclaration-after-statement, [CFLAGS="$CFLAGS -Wdeclaration-after-statement"])
+AC_ARG_ENABLE(debug, AC_HELP_STRING([--enable-debug], [Enable debug warnings, asserts, makefile-dependencies]))
+debug_enabled="$enable_debug"
+AC_SUBST(debug_enabled)
+case "$enable_debug" in
+        yes)
+		CHECK_COMPILER_FLAG(W, [CFLAGS="$CFLAGS -W"])
+		CHECK_COMPILER_FLAG(Wall, [CFLAGS="$CFLAGS -Wall"])
+		CHECK_COMPILER_FLAG(Wextra, [CFLAGS="$CFLAGS -Wextra"])
+		CHECK_COMPILER_FLAG(Wdeclaration-after-statement, [CFLAGS="$CFLAGS -Wdeclaration-after-statement"])
+		AC_DEFINE([UNBOUND_DEBUG], [], [define this to enable debug checks.])
+		;;
+	no|*)
+		# nothing to do.
+		;;
+esac
 
 AC_C_INLINE
 
@@ -277,7 +391,7 @@ AC_CHECK_FORMAT_ATTRIBUTE
 AC_CHECK_UNUSED_ATTRIBUTE
 
 if test "$srcdir" != "."; then
-	CPPFLAGS="$CPPFLAGS -I$srcdir";
+	CPPFLAGS="$CPPFLAGS -I$srcdir"
 fi
 
 # skip these tests, we do not need them.
@@ -289,8 +403,11 @@ AC_DEFUN([AC_PROG_OBJC], [:])
 AC_DEFUN([AC_PROG_OBJCCPP], [:])
 AC_DEFUN([AC_LIBTOOL_CXX], [:])
 AC_DEFUN([AC_LIBTOOL_F77], [:])
-# Use libtool 
-AC_CHECK_PROGS(libtool, [glibtool libtool15 libtool], [./libtool])
+# always use ./libtool unless override from commandline (libtool=mylibtool)
+if test -z "$libtool"; then
+	libtool="./libtool"
+fi
+AC_SUBST(libtool)
 AC_PATH_TOOL(AR, ar, [false])
 if test $AR = false; then
 	AC_MSG_ERROR([Cannot find 'ar', please extend PATH to include it])
@@ -307,7 +424,7 @@ AC_PROG_LIBTOOL
 
 # Checks for header files.
 AC_HEADER_STDC
-AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h arpa/inet.h syslog.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([stdarg.h stdbool.h netinet/in.h sys/param.h sys/socket.h sys/uio.h sys/resource.h arpa/inet.h syslog.h netdb.h sys/wait.h pwd.h],,, [AC_INCLUDES_DEFAULT])
 
 # check for types
 AC_CHECK_TYPE(int8_t, char)
@@ -325,6 +442,13 @@ AC_TYPE_PID_T
 AC_TYPE_OFF_T
 AC_CHECK_TYPE(u_char, unsigned char)
 
+AC_CHECK_TYPE(rlim_t, , 
+	[AC_DEFINE([rlim_t], [unsigned long], [Define to 'int' if not defined])], [
+AC_INCLUDES_DEFAULT
+#if HAVE_SYS_RESOURCE_H
+#  include <sys/resource.h>
+#endif
+])
 AC_CHECK_TYPE(socklen_t, , 
 	[AC_DEFINE([socklen_t], [int], [Define to 'int' if not defined])], [
 AC_INCLUDES_DEFAULT
@@ -351,54 +475,19 @@ AC_INCLUDES_DEFAULT
 #endif
 ])
 
-# Check the type of struct msghdr msg_iovlen.
-AC_MSG_CHECKING([sign of struct msghdr.msg_iovlen])
-AC_RUN_IFELSE([
-#include <stdlib.h>
-#include <stdio.h>
-#include <sys/socket.h>
-int main()
-{
-	struct msghdr h;
-	h.msg_iovlen = -1;
-	if(10/h.msg_iovlen == 0) return 0; /* unsigned */
-	return 1; /* signed */
-}
-], [ 
-# if compiled and exit status 0
-cv_msgiovlen_type="unsigned" ], [ 
-# not compiled or bad exit status
-cv_msgiovlen_type="int" ], 
-# when cross compiling
-[ cv_msgiovlen_type="int" ])
-AC_MSG_RESULT($cv_msgiovlen_type)
-AC_DEFINE_UNQUOTED([TYPE_MSGIOVLEN], $cv_msgiovlen_type, [Define to 'int' or type of struct msghdr.msg_iovlen.])
-
-# Check for yyunput
-AC_DEFUN([CHECK_YYUNPUT],
-[AC_MSG_CHECKING(whether lex can not generate yyunput)
-AC_CACHE_VAL(ac_cv_c_yy_unput,
-[ac_cv_c_yy_unput=no
-if $LEX --nounput -h 2>&1 | grep "do not generate" 2>&1 >/dev/null; then
-   ac_cv_c_yy_unput="yes"
-else
-   ac_cv_c_yy_unput="no"
-fi
-])
-
-AC_MSG_RESULT($ac_cv_c_yy_unput)
-if test $ac_cv_c_yy_unput = yes; then
-	LEX="$LEX --nounput"
-fi
-])dnl
-
-CHECK_YYUNPUT
-
 # add option to disable the evil rpath
 dnl Check whether to use rpath or not
 AC_ARG_ENABLE(rpath,
         [  --disable-rpath         disable hardcoded rpath (default=enabled)],
 	enable_rpath=$enableval, enable_rpath=yes)
+if test "x$enable_rpath" = xno; then
+	AC_MSG_RESULT([Fixing libtool for -rpath problems.])
+	sed < libtool > libtool-2 \
+	's/^hardcode_libdir_flag_spec.*$'/'hardcode_libdir_flag_spec=" -D__LIBTOOL_RPATH_SED__ "/'
+	mv libtool-2 libtool
+	chmod 755 libtool
+	libtool="./libtool"
+fi
 
 # Checks for libraries.
 AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
@@ -415,9 +504,9 @@ AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
         for dir in $withval; do
             ssldir="$dir"
             if test -f "$dir/include/openssl/ssl.h"; then
-                found_ssl="yes";
+                found_ssl="yes"
                 AC_DEFINE_UNQUOTED([HAVE_SSL], [], [Define if you have the SSL libraries installed.])
-                CPPFLAGS="$CPPFLAGS -I$ssldir/include";
+                CPPFLAGS="$CPPFLAGS -I$ssldir/include"
                 break;
             fi
         done
@@ -426,19 +515,45 @@ AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
         else
             AC_MSG_RESULT(found in $ssldir)
             HAVE_SSL=yes
-            LDFLAGS="$LDFLAGS -L$ssldir/lib";
+            LDFLAGS="$LDFLAGS -L$ssldir/lib"
 	    if test "x$enable_rpath" = xyes; then
 	        RUNTIME_PATH="$RUNTIME_PATH -R$ssldir/lib"
 	    fi
-            AC_CHECK_LIB(crypto, HMAC_CTX_init,, [
+	
+	    AC_MSG_CHECKING([for HMAC_CTX_init in -lcrypto])
+	    ORIGLIBS="$LIBS"
+	    LIBS="$LIBS -lcrypto"
+	    AC_TRY_LINK(, [
+		int HMAC_CTX_init(void);
+		(void)HMAC_CTX_init();
+	      ], [
+		AC_MSG_RESULT(yes)
+		AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
+			[If you have HMAC_CTX_init])
+	      ], [
+		AC_MSG_RESULT(no)
+	    	# check if -lwsock32 or -lgdi32 are needed.	
+		LIBS="$LIBS -lgdi32"
+		AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
+		AC_TRY_LINK([], [
+		    int HMAC_CTX_init(void);
+		    (void)HMAC_CTX_init();
+		  ],[
+		    AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
+			[If you have HMAC_CTX_init])
+		    AC_MSG_RESULT(yes) 
+		  ],[
+		    AC_MSG_RESULT(no)
                     AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
-                ])
+		])
+            ])
         fi
         AC_SUBST(HAVE_SSL)
 	AC_SUBST(RUNTIME_PATH)
     fi
 AC_CHECK_HEADERS([openssl/ssl.h],,, [AC_INCLUDES_DEFAULT])
 AC_CHECK_HEADERS([openssl/err.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([openssl/rand.h],,, [AC_INCLUDES_DEFAULT])
 
 # check for thread library.
 AC_ARG_WITH(pthreads, AC_HELP_STRING([--with-pthreads], 
@@ -460,6 +575,7 @@ fi
 # check solaris thread library 
 AC_ARG_WITH(solaris-threads, AC_HELP_STRING([--with-solaris-threads], 
 	[use solaris native thread library.]), [ ],[ withval="no" ])
+ub_have_sol_threads=no
 if test x_$withval != x_no; then
 	if test x_$ub_have_pthreads != x_no; then
 	    AC_WARN([Have pthreads already, ignoring --with-solaris-threads])
@@ -470,55 +586,95 @@ if test x_$withval != x_no; then
 
 		CHECK_COMPILER_FLAG(mt, [CFLAGS="$CFLAGS -mt"],
 			[CFLAGS="$CFLAGS -D_REENTRANT"])
+		ub_have_sol_threads=yes
 	] , [ 
 		AC_ERROR([no solaris threads found.]) 
 	])
 	fi
 fi
 
-# check for library used by libevent after 1.3c
-AC_CHECK_LIB(rt, clock_gettime)
+# check windows threads
+if test x_$ub_have_pthreads = x_no -a x_$ub_have_sol_threads = x_no; then
+	AC_CHECK_HEADERS([windows.h],,, [AC_INCLUDES_DEFAULT])
+	AC_MSG_CHECKING([for CreateThread])
+	AC_TRY_COMPILE([
+#ifdef HAVE_WINDOWS_H
+#include <windows.h>
+#endif
+], [
+	HANDLE t = CreateThread(NULL, 0, NULL, NULL, 0, NULL);
+],
+	AC_MSG_RESULT(yes)
+	AC_DEFINE(HAVE_WINDOWS_THREADS, 1, [Using Windows threads])
+,	
+	AC_MSG_RESULT(no)
+)
+fi
+
+# check to see if libraries are needed for these functions.
+AC_SEARCH_LIBS([inet_pton], [nsl])
+AC_SEARCH_LIBS([socket], [socket])
+
 # check for libevent
 AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
-    [set path to libevent  (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr)]),
-    [ ],[ withval="yes" ])
-if test x_$withval != x_no; then
+    [use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr  or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
+    [ ],[ withval="no" ])
+if test x_$withval = x_yes -o x_$withval != x_no; then
         AC_MSG_CHECKING(for libevent)
         if test x_$withval = x_ -o x_$withval = x_yes; then
-            withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr";
+            withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
         fi
         for dir in $withval; do
             thedir="$dir"
             if test -f "$dir/include/event.h"; then
-                found_libevent="yes";
-                CPPFLAGS="$CPPFLAGS -I$thedir/include";
+                found_libevent="yes"
+                CPPFLAGS="$CPPFLAGS -I$thedir/include"
                 break;
             fi
         done
         if test x_$found_libevent != x_yes; then
-		if test -f "$dir/event.h" -a -f "$dir/.libs/libevent.a"; then
+		if test -f "$dir/event.h" -a \( -f "$dir/libevent.la" -o -f "$dir/libev.la" \) ; then
 			# libevent source directory
             		AC_MSG_RESULT(found in $thedir)
-                	CPPFLAGS="$CPPFLAGS -I$thedir";
-            		LDFLAGS="$thedir/.libs/*.o $LDFLAGS";
+                	CPPFLAGS="$CPPFLAGS -I$thedir -I$thedir/include"
+			BAK_LDFLAGS="$LDFLAGS"
+			# remove evdns from linking
+			mkdir build >/dev/null 2>&1
+			mkdir build/libevent >/dev/null 2>&1
+			mkdir build/libevent/.libs >/dev/null 2>&1
+			ev_files_o=`ls $thedir/*.o | grep -v evdns\.o`
+			ev_files_lo=`ls $thedir/*.lo | grep -v evdns\.lo`
+			ev_files_libso=`ls $thedir/.libs/*.o | grep -v evdns\.o`
+			cp $ev_files_o build/libevent
+			cp $ev_files_lo build/libevent
+			cp $ev_files_libso build/libevent/.libs
+            		LATE_LDFLAGS="build/libevent/*.lo -lm"
+			LDFLAGS="build/libevent/*.o $LDFLAGS -lm"
 		else
             		AC_MSG_ERROR([Cannot find the libevent library in $withval
 You can restart ./configure --with-libevent=no to use a builtin alternative.
 Please note that this alternative is not as capable as libevent when using
-many outgoing ports.  ])
+large outgoing port ranges.  ])
 		fi
         else
             AC_MSG_RESULT(found in $thedir)
-            LDFLAGS="$LDFLAGS -L$thedir/lib";
+            LDFLAGS="$LDFLAGS -L$thedir/lib"
 	    if test "x$enable_rpath" = xyes; then
 	        RUNTIME_PATH="$RUNTIME_PATH -R$thedir/lib"
 	    fi
         fi
 	AC_SUBST(RUNTIME_PATH)
+	# check for library used by libevent after 1.3c
+	AC_SEARCH_LIBS([clock_gettime], [rt])
+
 	AC_SEARCH_LIBS(event_set, [event])
 	AC_CHECK_HEADERS([event.h],,, [AC_INCLUDES_DEFAULT])
 	AC_CHECK_FUNCS([event_base_free]) # only in libevent 1.2 and later
 	AC_CHECK_FUNCS([event_base_once]) # only in libevent 1.4? and later
+	AC_CHECK_FUNCS([event_base_get_method]) # only in libevent 1.4.3 and later
+	if test -n "$BAK_LDFLAGS"; then
+		LDFLAGS="$BAK_LDFLAGS"
+	fi
 else
 	AC_DEFINE(USE_MINI_EVENT, 1, [Define if you want to use internal select based events])
 fi
@@ -539,6 +695,8 @@ AC_ARG_ENABLE(lock_checks, AC_HELP_STRING([--enable-lock-checks],
 	, )
 if test x_$enable_lock_checks = x_yes; then
 	AC_DEFINE(ENABLE_LOCK_CHECKS, 1, [Define if you want to use debug lock checking (slow).])
+	CHECKLOCK_SRC="testcode/checklocks.c"
+	AC_SUBST(CHECKLOCK_SRC)
 fi
 
 # set memory allocation checking if requested
@@ -551,15 +709,121 @@ else
 	AC_FUNC_MALLOC
 fi
 
-# check to see if libraries are needed for these functions.
-AC_CHECK_LIB(socket, socket)
-AC_CHECK_LIB(nsl, inet_pton)
-
 AC_FUNC_CHOWN
 AC_FUNC_FORK
 AC_TYPE_SIGNAL
 AC_FUNC_FSEEKO
 AC_SYS_LARGEFILE
+dnl try to see if an additional _LARGEFILE_SOURCE 1 is needed to get fseeko
+CHECK_COMPILER_FLAG_NEEDED(-D_LARGEFILE_SOURCE=1,
+[
+#include <stdio.h>
+int test() {
+        int a = fseeko(stdin, 0, 0);
+        return a;
+}
+], [CFLAGS="$CFLAGS -D_LARGEFILE_SOURCE=1"])
+
+AC_DEFUN([AC_CHECK_GETADDRINFO_WITH_INCLUDES],
+[AC_REQUIRE([AC_PROG_CC])
+AC_MSG_CHECKING(for getaddrinfo)
+ac_cv_func_getaddrinfo=no
+AC_LINK_IFELSE(
+[
+#ifdef __cplusplus
+extern "C"
+{
+#endif
+char* getaddrinfo();
+char* (*f) () = getaddrinfo;
+#ifdef __cplusplus
+}
+#endif
+int main() {
+        ;
+        return 0;
+}
+],
+dnl this case on linux, solaris, bsd
+[ac_cv_func_getaddrinfo="yes"],
+dnl no quick getaddrinfo, try mingw32 and winsock2 library.
+ORIGLIBS="$LIBS"
+LIBS="$LIBS -lws2_32"
+AC_LINK_IFELSE(
+AC_LANG_PROGRAM(
+[
+#ifdef HAVE_WS2TCPIP_H
+#include <ws2tcpip.h>
+#endif
+],
+[
+        (void)getaddrinfo(NULL, NULL, NULL, NULL);
+]
+),
+[
+ac_cv_func_getaddrinfo="yes"
+dnl already: LIBS="$LIBS -lws2_32"
+AC_DEFINE(USE_WINSOCK, 1, [Whether the windows socket API is used])
+],
+[
+ac_cv_func_getaddrinfo="no"
+LIBS="$ORIGLIBS"
+])
+)
+
+AC_MSG_RESULT($ac_cv_func_getaddrinfo)
+if test $ac_cv_func_getaddrinfo = yes; then
+  AC_DEFINE(HAVE_GETADDRINFO, 1, [Whether getaddrinfo is available])
+fi
+])dnl
+
+AC_CHECK_GETADDRINFO_WITH_INCLUDES
+if test $ac_cv_func_getaddrinfo = no; then
+AC_LIBOBJ([fake-rfc2553])
+fi
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev])
+
+# check mkdir
+AC_MSG_CHECKING([whether mkdir has one arg])
+AC_TRY_COMPILE([
+#include <stdio.h>
+#include <unistd.h>
+#ifdef HAVE_WINSOCK2_H
+#include <winsock2.h>
+#endif
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif
+], [
+	(void)mkdir("directory");
+],
+AC_MSG_RESULT(yes)
+AC_DEFINE(MKDIR_HAS_ONE_ARG, 1, [Define if mkdir has one argument.])
+,
+AC_MSG_RESULT(no)
+)
+
+# check ioctlsocket
+AC_MSG_CHECKING(for ioctlsocket)
+AC_LINK_IFELSE(AC_LANG_PROGRAM([
+#ifdef HAVE_WINSOCK2_H
+#include <winsock2.h>
+#endif
+], [
+	(void)ioctlsocket(0, 0, NULL);
+]), [
+AC_MSG_RESULT(yes)
+AC_DEFINE(HAVE_IOCTLSOCKET, 1, [if the function 'ioctlsocket' is available])
+],[AC_MSG_RESULT(no)])
+
+AC_REPLACE_FUNCS(inet_aton)
+AC_REPLACE_FUNCS(inet_pton)
+AC_REPLACE_FUNCS(inet_ntop)
+AC_REPLACE_FUNCS(snprintf)
+AC_REPLACE_FUNCS(strlcpy)
+AC_REPLACE_FUNCS(memmove)
+AC_REPLACE_FUNCS(gmtime_r)
+AC_REPLACE_FUNCS(socketpair) dnl for mingw32
 
 # check this after all other compilation checks, since the linking of the lib
 # may break checks after this.
@@ -572,20 +836,9 @@ AC_ARG_WITH(ldns,
 	AC_SUBST(ldnsdir)
 ])
 
-AC_CHECK_LIB(ldns, ldns_rr_new, [
+AC_CHECK_LIB(ldns, ldns_buffer_copy, [
 dnl ldns was found, check compat functions
-AC_REPLACE_FUNCS(inet_aton)
-AC_REPLACE_FUNCS(inet_pton)
-AC_REPLACE_FUNCS(inet_ntop)
-AC_REPLACE_FUNCS(snprintf)
-AC_REPLACE_FUNCS(strlcpy)
-AC_REPLACE_FUNCS(memmove)
-
-AC_CHECK_FUNCS([getaddrinfo])
-if test $ac_cv_func_getaddrinfo = no; then
-AC_LIBOBJ([fake-rfc2553])
-fi
-
+AC_CHECK_LIB(ldns, [ldns_rr_free])
 ] , [
 dnl use the builtin ldns-src.tar.gz file to build ldns.
 if test ! -f $srcdir/ldns-src.tar.gz; then
@@ -597,29 +850,24 @@ echo "*** ldns library not found (--with-ldns= to specify by hand) ***"
 echo "*** Building ldns library from package included in this one. ***"
 echo "***                                                          ***"
 echo "****************************************************************"
-if test -d ldns-src; then rm -rf ldns-src; fi
-mkdir ldns-src; cp $srcdir/ldns-src.tar.gz ldns-src/ldns-src.tar.gz; (cd ldns-src; gzip -cd ldns-src.tar.gz | tar xf -); rm -f ldns-src/ldns-src.tar.gz
-ldnsdir=`ls -d ldns-src/ldns*`
-AC_MSG_NOTICE([Configure $ldnsdir])
-echo "(cd $ldnsdir; ./configure)"
-(cd $ldnsdir; ./configure)
-AC_MSG_NOTICE([Finished $ldnsdir configure])
-CPPFLAGS="$CPPFLAGS -I$ldnsdir/include"
-LDFLAGS="$LDFLAGS $ldnsdir/lib/*.o"
+if test -d $srcdir/ldns-src; then rm -rf $srcdir/ldns-src; fi
+mkdir $srcdir/ldns-src; cp $srcdir/ldns-src.tar.gz $srcdir/ldns-src/ldns-src.tar.gz; (cd $srcdir/ldns-src; gzip -cd ldns-src.tar.gz | tar xf -); rm -f $srcdir/ldns-src/ldns-src.tar.gz; mv $srcdir/ldns-src $srcdir/ldns-srcb; mv $srcdir/ldns-srcb/ldns* $srcdir/ldns-src; rmdir $srcdir/ldns-srcb
+ldnsdir="ldns-src"
+AC_MSG_NOTICE([Configure $ldnsdir scheduled after config.status])
+AC_CONFIG_SUBDIRS([ldns-src])
+CPPFLAGS="-I$ldnsdir/include $CPPFLAGS"
+LDFLAGS="$LDFLAGS $ldnsdir/*.lo"
 AC_SUBST(ldnsdir)
-dnl use ldns compat functions
-AC_DEFINE(HAVE_INET_ATON)
-AC_DEFINE(HAVE_INET_PTON)
-AC_DEFINE(HAVE_INET_NTOP)
-AC_DEFINE(HAVE_SNPRINTF)
-AC_DEFINE(HAVE_STRLCPY)
-AC_DEFINE(HAVE_MEMMOVE)
-AC_DEFINE(HAVE_GETADDRINFO)
 ])
+LDFLAGS="$LATE_LDFLAGS $LDFLAGS"
 
 AC_DEFINE_UNQUOTED([MAXSYSLOGMSGLEN], [5120], [Define to the maximum message length to pass to syslog.])
 
 AH_BOTTOM([
+#ifndef UNBOUND_DEBUG
+#  define NDEBUG
+#endif
+
 #include <stdio.h>
 #include <string.h>
 #include <unistd.h>
@@ -656,6 +904,14 @@ AH_BOTTOM([
 #include <arpa/inet.h>
 #endif
 
+#ifdef HAVE_WINSOCK2_H
+#include <winsock2.h>
+#endif
+
+#ifdef HAVE_WS2TCPIP_H
+#include <ws2tcpip.h>
+#endif
+
 #ifdef HAVE_GETOPT_H
 #include <getopt.h>
 #endif
@@ -664,6 +920,10 @@ AH_BOTTOM([
 #include <openssl/err.h>
 #endif
 
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
+
 #ifdef HAVE_ATTR_FORMAT
 #  define ATTR_FORMAT(archetype, string_index, first_to_check) \
     __attribute__ ((format (archetype, string_index, first_to_check)))
@@ -692,6 +952,10 @@ AH_BOTTOM([
 #define RAND_MAX	2147483647
 #endif
 
+#ifndef MAXHOSTNAMELEN
+#define MAXHOSTNAMELEN 256
+#endif
+
 #ifndef IPV6_MIN_MTU
 #define IPV6_MIN_MTU 1280
 #endif /* IPV6_MIN_MTU */
@@ -709,30 +973,68 @@ AH_BOTTOM([
 #define MAXINCLUDES 10
 
 #ifndef HAVE_SNPRINTF
+#define snprintf snprintf_unbound
+#define vsnprintf vsnprintf_unbound
 #include <stdarg.h>
 int snprintf (char *str, size_t count, const char *fmt, ...);
 int vsnprintf (char *str, size_t count, const char *fmt, va_list arg);
 #endif /* HAVE_SNPRINTF */
 #ifndef HAVE_INET_PTON
+#define inet_pton inet_pton_unbound
 int inet_pton(int af, const char* src, void* dst);
 #endif /* HAVE_INET_PTON */
 #ifndef HAVE_INET_NTOP
+#define inet_ntop inet_ntop_unbound
 const char *inet_ntop(int af, const void *src, char *dst, size_t size);
 #endif
 #ifndef HAVE_INET_ATON
+#define inet_aton inet_aton_unbound
 int inet_aton(const char *cp, struct in_addr *addr);
 #endif
 #ifndef HAVE_MEMMOVE
+#define memmove memmove_unbound
 void *memmove(void *dest, const void *src, size_t n);
 #endif
 #ifndef HAVE_STRLCPY
+#define strlcpy strlcpy_unbound
 size_t strlcpy(char *dst, const char *src, size_t siz);
 #endif
+#ifndef HAVE_GMTIME_R
+#define gmtime_r gmtime_r_unbound
+struct tm *gmtime_r(const time_t *timep, struct tm *result);
+#endif
 #ifndef HAVE_GETADDRINFO
+#define getaddrinfo getaddrinfo_unbound
+#define gai_strerror gai_strerror_unbound
+#define freeaddrinfo freeaddrinfo_unbound
+#define getnameinfo getnameinfo_unbound
 struct sockaddr_storage;
 #include "compat/fake-rfc2553.h"
 #endif
 
+#ifndef HAVE_SLEEP
+#define sleep(x) Sleep((x)*1000) /* on win32 */
+#endif /* HAVE_SLEEP */
+#ifndef HAVE_USLEEP
+#define usleep(x) Sleep((x)/1000 + 1) /* on win32 */
+#endif /* HAVE_USLEEP */
+#ifndef HAVE_RANDOM
+#define random rand /* on win32, for tests only (bad random) */
+#endif /* HAVE_RANDOM */
+#ifndef HAVE_SRANDOM
+#define srandom(x) srand(x) /* on win32, for tests only (bad random) */
+#endif /* HAVE_SRANDOM */
+#ifndef HAVE_SOCKETPAIR
+int socketpair(int d, int type, int protocol, int *sv);
+#endif
+
+/* detect if we need to cast to unsigned int for FD_SET to avoid warnings */
+#ifdef HAVE_WINSOCK2_H
+#define FD_SET_T (u_int)
+#else
+#define FD_SET_T 
+#endif
+
 #include "ldns/ldns.h"
 
 #ifdef UNBOUND_ALLOC_STATS
@@ -758,6 +1060,6 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 #define UNBOUND_DNS_PORT 53
 ])
 
-AC_CONFIG_FILES([Makefile])
+AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-checkconf.8 doc/unbound.conf.5])
 AC_CONFIG_HEADER([config.h])
 AC_OUTPUT

contrib/README

@@ -0,0 +1,9 @@
+These files are contributed to unbound, and are not part of the official
+distribution but may be helpful.
+
+* rc_d_unbound: FreeBSD compatible /etc/rc.d script.
+* parseunbound.pl: perl script to run from cron that parses statistics from
+	the log file and stores them.
+* unbound.spec and unbound.init: RPM specfile and Linux rc.d initfile.
+* update-anchor.sh: shell script that uses unbound-host to update a set
+	of trust anchor files. Run from cron twice a month.

contrib/parseunbound.pl

@@ -0,0 +1,140 @@
+#!/usr/local/bin/perl -w
+#
+# Script to parse the output from the unbound namedaemon.
+# Unbound supports a threading model, and outputs a multiline log-blob for
+# every thread.
+#
+# This script should parse all threads of the once, and store it
+# in a local cached file for speedy results when queried lots.
+#
+use strict;
+use POSIX qw(SEEK_END);
+use Storable;
+use FileHandle;
+use Carp qw(croak carp);
+use constant UNBOUND_CACHE => "/var/tmp/unbound-cache.stor";
+
+my $run_from_cron = @ARGV && $ARGV[0] eq "--cron" && shift;
+my $DEBUG = -t STDERR;
+
+# NB. VERY IMPORTANTES: set this when running this script.
+my $numthreads = 4;
+
+### if cache exists, read it in. and is newer than 3 minutes
+if ( -r UNBOUND_CACHE ) {
+    my $result = retrieve(UNBOUND_CACHE);
+    if (-M _ < 3/24/60 && !$run_from_cron ) {
+        print STDERR "Cached results:\n" if $DEBUG;
+        print join("\n", @$result), "\n";
+        exit;
+    }
+}
+my $logfile = shift or die "Usage: parseunbound.pl --cron unboundlogfile";
+my $in = new FileHandle $logfile or die "Cannot open $logfile: $!\n";
+
+# there is a special key 'thread' that indicates the thread. its not used, but returned anyway.
+my @records = ('thread', 'queries', 'cachehits', 'recursions', 'recursionavg',
+        'outstandingmax', 'outstandingavg', 'outstandingexc',
+        'median25', 'median50', 'median75',
+        'us_0', 'us_1', 'us_2', 'us_4', 'us_8', 'us_16', 'us_32',
+        'us_64', 'us_128', 'us_256', 'us_512', 'us_1024', 'us_2048',
+        'us_4096', 'us_8192', 'us_16384', 'us_32768', 'us_65536',
+        'us_131072', 'us_262144', 'us_524288', 's_1', 's_2', 's_4',
+        's_8', 's_16', 's_32', 's_64', 's_128', 's_256', 's_512');
+# Stats hash containing one or more keys. for every thread, 1 key.
+my %allstats = (); # key="$threadid", stats={key => value}
+my %startstats = (); # when we got a queries entry for this thread
+my %donestats = (); # same, but only when we got a histogram entry for it
+# stats hash contains name/value pairs of the actual numbers for that thread.
+my $offset = 0;
+my $inthread=0;
+my $inpid;
+
+# We should continue looping untill we meet these conditions:
+# a) more total queries than the previous run (which defaults to 0) AND
+# b) parsed all $numthreads threads in the log.
+my $numqueries = $previousresult ? $previousresult->[1] : 0;
+
+# Main loop
+while ( scalar keys %startstats < $numthreads || scalar keys %donestats < $numthreads) {
+    $offset += 10000;
+    if ( $offset > -s $logfile or $offset > 10_000_000 ) {
+        die "Cannot find stats in $logfile\n";
+    }
+    $in->seek(-$offset, SEEK_END) or croak "cannot seek $logfile: $!\n";
+
+    for my $line ( <$in> ) {
+        chomp($line);
+
+        #[1208777234] unbound[6705:0] 
+        if ($line =~ m/^\[\d+\] unbound\[\d+:(\d+)\]/) {
+            $inthread = $1;
+            if ($inthread + 1 > $numthreads) {
+                die "Hey. lazy. change \$numthreads in this script to ($inthread)\n";
+            }
+        }
+        # this line doesn't contain a pid:thread. skip.
+        else {
+            next;
+        }
+
+        if ( $line =~ m/info: server stats for thread \d+: (\d+) queries, (\d+) answers from cache, (\d+) recursions/ ) {
+            $startstats{$inthread} = 1;
+            $allstats{$inthread}->{thread} = $inthread;
+            $allstats{$inthread}->{queries} = $1;
+            $allstats{$inthread}->{cachehits} = $2;
+            $allstats{$inthread}->{recursions} = $3;
+        }
+        elsif ( $line =~ m/info: server stats for thread (\d+): requestlist max (\d+) avg ([0-9\.]+) exceeded (\d+)/ ) {
+            $allstats{$inthread}->{outstandingmax} = $2;
+            $allstats{$inthread}->{outstandingavg} = int($3); # This is a float; rrdtool only handles ints.
+            $allstats{$inthread}->{outstandingexc} = $4;
+        }
+        elsif ( $line =~ m/info: average recursion processing time ([0-9\.]+) sec/ ) {
+            $allstats{$inthread}->{recursionavg} = int($1 * 1000); # change sec to milisec.
+        }
+        elsif ( $line =~ m/info: histogram of recursion processing times/ ) {
+            next;
+        }
+        elsif ( $line =~ m/info: \[25%\]=([0-9\.]+) median\[50%\]=([0-9\.]+) \[75%\]=([0-9\.]+)/ ) {
+            $allstats{$inthread}->{median25} = int($1 * 1000000); # change seconds to usec
+            $allstats{$inthread}->{median50} = int($2 * 1000000);
+            $allstats{$inthread}->{median75} = int($3 * 1000000);
+        }
+        elsif ( $line =~ m/info: lower\(secs\) upper\(secs\) recursions/ ) {
+            # since after this line we're unsure if we get these numbers
+            # at all, we sould consider this marker as the end of the
+            # block. Chances that we're parsing a file halfway written
+            # at this stage are small. Bold statement.
+            $donestats{$inthread} = 1;
+            next;
+        }
+        elsif ( $line =~ m/info:\s+(\d+)\.(\d+)\s+(\d+)\.(\d+)\s+(\d+)/ ) {
+            my ($froms, $fromus, $toms, $tous, $counter) = ($1, $2, $3, $4, $5);
+            my $prefix = '';
+            if ($froms > 0) {
+                $allstats{$inthread}->{'s_' . int($froms)} = $counter;
+            } else {
+                $allstats{$inthread}->{'us_' . int($fromus)} = $counter;
+            }
+        }
+    }
+}
+
+my @result;
+# loop on the records we want to store
+for my $key ( @records ) {
+    my $sum = 0;
+    # these are the different threads parsed
+    foreach my $thread ( 0 .. $numthreads - 1 ) {
+        $sum += ($allstats{$thread}->{$key} || 0);
+    }
+    print STDERR "$key = " . $sum . "\n" if $DEBUG;
+    push @result, $sum;
+}
+print join("\n", @result), "\n";
+store \@result, UNBOUND_CACHE;
+
+if ($DEBUG) {
+    print STDERR "Threads: " . (scalar keys %allstats) . "\n";
+}

contrib/rc_d_unbound

@@ -0,0 +1,23 @@
+#!/bin/sh
+#
+# unbound freebsd startup rc.d script, modified from the named script.
+# uses the default unbound installation path and pidfile location.
+# copy this to /etc/rc.d/unbound
+# and put unbound_enable="YES" into rc.conf
+#
+
+# PROVIDE: unbound
+# REQUIRE: SERVERS cleanvar
+# KEYWORD: shutdown
+
+. /etc/rc.subr
+
+name="unbound"
+rcvar=`set_rcvar`
+
+command="/usr/local/sbin/unbound"
+pidfile="/usr/local/etc/unbound/unbound.pid"
+extra_commands="reload"
+
+load_rc_config $name
+run_rc_command "$1"

contrib/unbound.init

@@ -0,0 +1,139 @@
+#!/bin/sh
+#
+# unbound	This shell script takes care of starting and stopping
+#		unbound (DNS server).
+#
+# chkconfig:   - 14 86
+# description:	unbound is a Domain Name Server (DNS) \
+#		that is used to resolve host names to IP addresses.
+
+### BEGIN INIT INFO
+# Provides: $named unbound
+# Required-Start: $network $local_fs
+# Required-Stop: $network $local_fs
+# Should-Start: $syslog
+# Should-Stop: $syslog
+# Short-Description: unbound recursive Domain Name Server.
+# Description:  unbound is a Domain Name Server (DNS) 
+#		that is used to resolve host names to IP addresses.
+### END INIT INFO
+
+# Source function library.
+. /etc/rc.d/init.d/functions
+
+exec="/usr/sbin/unbound"
+prog="unbound"
+config="/var/unbound/unbound.conf"
+pidfile="/var/unbound/unbound.pid"
+rootdir="/var/unbound"
+
+[ -e /etc/sysconfig/$prog ] && . /etc/sysconfig/$prog
+
+lockfile=/var/lock/subsys/$prog
+
+start() {
+    [ -x $exec ] || exit 5
+    [ -f $config ] || exit 6
+    echo -n $"Starting $prog: "
+
+    # setup root jail
+    if [ -s /etc/localtime ]; then 
+	[ -d ${rootdir}/etc ] || mkdir -p ${rootdir}/etc ;
+	if [ ! -e ${rootdir}/etc/localtime ] || /usr/bin/cmp -s /etc/localtime ${rootdir}/etc/localtime; then
+	    cp -fp /etc/localtime ${rootdir}/etc/localtime
+	fi;
+    fi;
+    if [ -s /etc/resolv.conf ]; then
+	[ -d ${rootdir}/etc ] || mkdir -p ${rootdir}/etc ;
+	if [ ! -e ${rootdir}/etc/resolv.conf ] || /usr/bin/cmp -s /etc/resolv.conf ${rootdir}/etc/resolv.conf; then
+	    cp -fp /etc/resolv.conf ${rootdir}/etc/resolv.conf
+	fi;
+    fi;
+    if ! egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
+	[ -d ${rootdir}/dev ] || mkdir -p ${rootdir}/dev ;
+	[ -e ${rootdir}/dev/log ] || touch ${rootdir}/dev/log
+	mount --bind -n /dev/log ${rootdir}/dev/log >/dev/null 2>&1;
+    fi;
+    if ! egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/random' /proc/mounts; then
+	[ -d ${rootdir}/dev ] || mkdir -p ${rootdir}/dev ;
+	[ -e ${rootdir}/dev/random ] || touch ${rootdir}/dev/random
+	mount --bind -n /dev/random ${rootdir}/dev/random >/dev/null 2>&1;
+    fi;
+
+    # if not running, start it up here
+    daemon $exec
+    retval=$?
+    echo
+    [ $retval -eq 0 ] && touch $lockfile
+    return $retval
+}
+
+stop() {
+    echo -n $"Stopping $prog: "
+    # stop it here, often "killproc $prog"
+    killproc -p $pidfile $prog
+    retval=$?
+    echo
+    [ $retval -eq 0 ] && rm -f $lockfile
+    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/log' /proc/mounts; then
+	umount ${rootdir}/dev/log >/dev/null 2>&1
+    fi;
+    if egrep -q '^/[^[:space:]]+[[:space:]]+'${rootdir}'/dev/random' /proc/mounts; then
+	umount ${rootdir}/dev/random >/dev/null 2>&1
+    fi;
+    return $retval
+}
+
+restart() {
+    stop
+    start
+}
+
+reload() {
+    kill -HUP `cat $pidfile`
+}
+
+force_reload() {
+    restart
+}
+
+rh_status() {
+    # run checks to determine if the service is running or use generic status
+    status -p $pidfile $prog
+}
+
+rh_status_q() {
+    rh_status -p $pidfile >/dev/null 2>&1
+}
+
+case "$1" in
+    start)
+        rh_status_q && exit 0
+        $1
+        ;;
+    stop)
+        rh_status_q || exit 0
+        $1
+        ;;
+    restart)
+        $1
+        ;;
+    reload)
+        rh_status_q || exit 7
+        $1
+        ;;
+    force-reload)
+        force_reload
+        ;;
+    status)
+        rh_status
+        ;;
+    condrestart|try-restart)
+        rh_status_q || exit 0
+        restart
+        ;;
+    *)
+        echo $"Usage: $0 {start|stop|status|restart|condrestart|try-restart|reload|force-reload}"
+        exit 2
+esac
+exit $?

contrib/unbound.spec

@@ -0,0 +1,103 @@
+Summary: Validating, recursive, and caching DNS resolver
+Name: unbound
+Version: 1.0.1
+Release: 1%{?dist}
+License: BSD
+Url: http://www.nlnetlabs.nl/unbound/
+Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
+#Source1: unbound.init
+Group: System Environment/Daemons
+BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
+BuildRequires: flex, openssl-devel
+
+%description
+Unbound is a validating, recursive, and caching DNS resolver.
+
+The C implementation of Unbound is developed and maintained by NLnet
+Labs. It is based on ideas and algorithms taken from a java prototype
+developed by Verisign labs, Nominet, Kirei and ep.net.
+
+Unbound is designed as a set of modular components, so that also
+DNSSEC (secure DNS) validation and stub-resolvers (that do not run
+as a server, but are linked into an application) are easily possible.
+
+The source code is under a BSD License.
+
+%prep
+%setup -q
+
+# configure with /var/unbound/unbound.conf so that all default chroot, 
+# pidfile and config file are in /var/unbound, ready for chroot jail set up.
+#
+# This is a build using libldns builtin version, the resulting binaries
+# do not require libldns and this package does not have version dependencies.
+# Could be smaller using a dependency on libldns (use --with-ldns=).
+%configure --with-conf-file=%{_localstatedir}/%{name}/unbound.conf --disable-rpath
+
+%build
+#%{__make} %{?_smp_mflags}
+make
+
+%install
+rm -rf %{buildroot}
+%{__make} DESTDIR=%{buildroot} install
+install -d 0700 %{buildroot}%{_localstatedir}/%{name}
+install -d 0755 %{buildroot}%{_initrddir}
+install -m 0755 contrib/unbound.init %{buildroot}%{_initrddir}/unbound
+# add symbolic link from /etc/unbound.conf -> /var/unbound/unbound.conf
+ln -s %{_localstatedir}/unbound/unbound.conf %{buildroot}%{_sysconfdir}/unbound.conf 
+# remove static library from install (fedora packaging guidelines)
+rm -f %{buildroot}%{_libdir}/libunbound.a %{buildroot}%{_libdir}/libunbound.la
+
+%clean
+rm -rf ${RPM_BUILD_ROOT}
+
+%files
+%defattr(-,root,root,-)
+%doc doc/README doc/CREDITS doc/LICENSE doc/FEATURES
+%attr(0755,root,root) %{_initrddir}/%{name}
+%attr(0700,%{name},%{name}) %dir %{_localstatedir}/%{name}
+%attr(0644,%{name},%{name}) %config(noreplace) %{_localstatedir}/%{name}/unbound.conf
+%attr(0644,%{name},%{name}) %config(noreplace) %{_sysconfdir}/unbound.conf
+%{_sbindir}/*
+%{_mandir}/*/*
+%{_includedir}/*
+%{_libdir}/libunbound*
+
+%pre
+getent group unbound >/dev/null || groupadd -r unbound
+getent passwd unbound >/dev/null || \
+useradd -r -g unbound -d /var/unbound -s /sbin/nologin \
+    -c "unbound name daemon" unbound
+exit 0
+
+%post
+# This adds the proper /etc/rc*.d links for the script
+/sbin/chkconfig --add %{name}
+
+%preun
+if [ $1 -eq 0 ]; then
+	/sbin/service %{name} stop >/dev/null 2>&1
+	/sbin/chkconfig --del %{name}
+	# remove root jail 
+	rm -f /var/unbound/dev/log /var/unbound/dev/random /var/unbound/etc/localtime /var/unbound/etc/resolv.conf >/dev/null 2>&1
+	rmdir /var/unbound/dev >/dev/null 2>&1 || :
+	rmdir /var/unbound/etc >/dev/null 2>&1 || :
+	rmdir /var/unbound >/dev/null 2>&1 || :
+fi
+
+%postun
+if [ "$1" -ge "1" ]; then
+	/sbin/service %{name} condrestart >/dev/null 2>&1 || :
+fi
+
+%changelog
+* Thu May 22 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.0.0
+- contrib changes from Patrick Vande Walle.
+
+* Thu Apr 25 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.12
+- Using parts from ports collection entry by Jaap Akkerhuis.
+- Using Fedoraproject wiki guidelines.
+
+* Wed Apr 23 2008 Wouter Wijngaards <wouter@nlnetlabs.nl> - 0.11
+- Initial version.

contrib/update-anchor.sh

@@ -0,0 +1,134 @@
+#!/bin/sh
+# update-anchor.sh, update a trust anchor.
+# this file is BSD licensed.
+
+# which validating lookup to use.
+ubhost=unbound-host
+
+function usage()
+{
+	echo "usage: update-anchor [-b] <zone name> <trust anchor file>"
+	echo "    performs an update of trust anchor file"
+	echo "    the trust anchor file is overwritten with the latest keys"
+	echo "    the trust anchor file should contain only keys for one zone"
+	echo "    -b causes keyfile to be made in bind format."
+	echo "       without -b the file is made in unbound format."
+	echo "    "
+	echo "alternate:"
+	echo "    update-anchor [-b] -d directory"
+	echo "    update all <zone>.anchor files in the directory."
+	echo "    "
+	echo "    name the files br.anchor se.anchor ..., and include them in"
+	echo "    the validating resolver config file."
+	echo "    put keys for the root in a file with the name root.anchor."
+	exit 1
+}
+
+if test $# -eq 0; then
+	usage
+fi
+bindformat="no"
+filearg='-f'
+if test X"$1" = "X-b"; then
+	shift
+	bindformat="yes"
+	filearg='-F'
+fi
+if test $# -ne 2; then
+	echo "arguments wrong."
+	usage
+fi
+
+function do_update() {
+	# arguments: <zonename> <keyfile>
+	zonename="$1"
+	keyfile="$2"
+
+	tmpfile="/tmp/update-anchor.$$"
+	$ubhost -v $filearg "$keyfile" -t DNSKEY "$zonename" >$tmpfile
+	if test $? -ne 0; then
+		rm -f $tmpfile
+		echo "Error: Could not update zone $zonename anchor file $keyfile"
+		echo "Cause: $ubhost lookup failed" 
+		echo "    (Is the domain decommissioned? Is connectivity lost?)"
+		return 2
+	fi
+
+	# has the lookup been DNSSEC validated?
+	if grep '(secure)$' $tmpfile >/dev/null 2>&1; then
+		:
+	else
+		rm -f $tmpfile
+		echo "Error: Could not update zone $zonename anchor file $keyfile"
+		echo "Cause: result of lookup was not secure" 
+		echo "    (keys too far out of date? domain changed ownership?)"
+		return 3
+	fi
+
+	if test $bindformat = "yes"; then
+		# are there any KSK keys on board?
+		echo 'trusted-keys {' > "$keyfile"
+		if grep ' has DNSKEY record 257' $tmpfile >/dev/null 2>&1; then
+			# store KSK keys in anchor file
+			grep '(secure)$' $tmpfile | \
+			grep ' has DNSKEY record 257' | \
+			sed -e 's/ (secure)$/";/' | \
+			sed -e 's/ has DNSKEY record \([0-9]*\) \([0-9]*\) \([0-9]*\) /. \1 \2 \3 "/' | \
+			sed -e 's/^\.\././' >> "$keyfile"
+		else
+			# store all keys in the anchor file
+			grep '(secure)$' $tmpfile | \
+			sed -e 's/ (secure)$/";/' | \
+			sed -e 's/ has DNSKEY record \([0-9]*\) \([0-9]*\) \([0-9]*\) /. \1 \2 \3 "/' | \
+			sed -e 's/^\.\././' >> "$keyfile"
+		fi
+		echo '};' >> "$keyfile"
+	else #not bindformat
+		# are there any KSK keys on board?
+		if grep ' has DNSKEY record 257' $tmpfile >/dev/null 2>&1; then
+			# store KSK keys in anchor file
+			grep '(secure)$' $tmpfile | \
+			grep ' has DNSKEY record 257' | \
+			sed -e 's/ (secure)$//' | \
+			sed -e 's/ has DNSKEY record /. IN DNSKEY /' | \
+			sed -e 's/^\.\././' > "$keyfile"
+		else
+			# store all keys in the anchor file
+			grep '(secure)$' $tmpfile | \
+			sed -e 's/ (secure)$//' | \
+			sed -e 's/ has DNSKEY record /. IN DNSKEY /' | \
+			sed -e 's/^\.\././' > "$keyfile"
+		fi
+	fi # endif-bindformat
+
+	echo "$zonename key file $keyfile updated."
+
+	rm -f $tmpfile
+}
+
+if test X"$1" = "X-d"; then
+	tdir="$2"
+	echo "start updating in $2"
+	for x in $tdir/*.anchor; do
+		if test `basename "$x"` = "root.anchor"; then
+			zname="."
+		else
+			zname=`basename "$x" .anchor`
+		fi
+		do_update "$zname" "$x"
+	done
+	echo "done updating in $2"
+else
+	# regular invocation
+	if test X"$1" = "X."; then
+		zname="$1"
+	else
+		# strip trailing dot from zone name
+		zname="`echo $1 | sed -e 's/\.$//'`"
+	fi
+	kfile="$2"
+	do_update $zname $kfile
+	exit $?
+fi
+
+exit 0

daemon/acl_list.c

@@ -104,7 +104,7 @@ acl_list_insert(struct acl_list* acl, struct sockaddr_storage* addr,
 	node->control = control;
 	if(!rbtree_insert(acl->tree, &node->node)) {
 		if(complain_duplicates)
-			verbose(VERB_DETAIL, "duplicate acl address ignored.");
+			verbose(VERB_QUERY, "duplicate acl address ignored.");
 	}
 	return 1;
 }
@@ -194,12 +194,16 @@ acl_list_apply_cfg(struct acl_list* acl, struct config_file* cfg)
 	/* insert defaults, with '0' to ignore them if they are duplicates */
 	if(!acl_list_str_cfg(acl, "0.0.0.0/0", "refuse", 0))
 		return 0;
-	if(!acl_list_str_cfg(acl, "::0/0", "refuse", 0))
-		return 0;
 	if(!acl_list_str_cfg(acl, "127.0.0.0/8", "allow", 0))
 		return 0;
-	if(!acl_list_str_cfg(acl, "::1", "allow", 0))
-		return 0;
+	if(cfg->do_ip6) {
+		if(!acl_list_str_cfg(acl, "::0/0", "refuse", 0))
+			return 0;
+		if(!acl_list_str_cfg(acl, "::1", "allow", 0))
+			return 0;
+		if(!acl_list_str_cfg(acl, "::ffff:127.0.0.1", "allow", 0))
+			return 0;
+	}
 	acl_list_init_parents(acl);
 	return 1;
 }

daemon/acl_list.h

@@ -79,14 +79,14 @@ struct acl_list {
 struct acl_addr {
 	/** redblacktree node, key is this structure: addr and addrlen, net */
 	rbnode_t node;
+	/** parent node in acl tree that encompasses this entry */
+	struct acl_addr* parent;
 	/** address */
 	struct sockaddr_storage addr;
 	/** length of addr */
 	socklen_t addrlen;
 	/** netblock size */
 	int net;
-	/** parent node in acl tree that encompasses this entry */
-	struct acl_addr* parent;
 	/** access control on this netblock */
 	enum acl_access control;
 };

daemon/daemon.c

@@ -51,10 +51,9 @@
 #include "services/cache/rrset.h"
 #include "services/cache/infra.h"
 #include "services/localzone.h"
+#include "services/modstack.h"
 #include "util/module.h"
-#include "iterator/iterator.h"
-#include "validator/validator.h"
-#include "util/fptr_wlist.h"
+#include "util/random.h"
 #include <signal.h>
 
 /** How many quit requests happened. */
@@ -77,13 +76,24 @@ static RETSIGTYPE record_sigh(int sig)
 	switch(sig)
 	{
 		case SIGTERM:
+#ifdef SIGQUIT
 		case SIGQUIT:
+#endif
+#ifdef SIGBREAK
+		case SIGBREAK:
+#endif
 		case SIGINT:
 			sig_record_quit++;
 			break;
+#ifdef SIGHUP
 		case SIGHUP:
 			sig_record_reload++;
 			break;
+#endif
+#ifdef SIGPIPE
+		case SIGPIPE:
+			break;
+#endif
 		default:
 			log_err("ignoring signal %d", sig);
 	}
@@ -97,9 +107,20 @@ static void
 signal_handling_record()
 {
 	if( signal(SIGTERM, record_sigh) == SIG_ERR ||
+#ifdef SIGQUIT
 		signal(SIGQUIT, record_sigh) == SIG_ERR ||
-		signal(SIGINT, record_sigh) == SIG_ERR ||
-		signal(SIGHUP, record_sigh) == SIG_ERR)
+#endif
+#ifdef SIGBREAK
+		signal(SIGBREAK, record_sigh) == SIG_ERR ||
+#endif
+#ifdef SIGHUP
+		signal(SIGHUP, record_sigh) == SIG_ERR ||
+#endif
+#ifdef SIGPIPE
+		signal(SIGPIPE, SIG_IGN) == SIG_ERR ||
+#endif
+		signal(SIGINT, record_sigh) == SIG_ERR
+		)
 		log_err("install sighandler: %s", strerror(errno));
 }
 
@@ -110,8 +131,10 @@ signal_handling_record()
 static void
 signal_handling_playback(struct worker* wrk)
 {
+#ifdef SIGHUP
 	if(sig_record_reload)
 		worker_sighandler(SIGHUP, wrk);
+#endif
 	if(sig_record_quit)
 		worker_sighandler(SIGTERM, wrk);
 	sig_record_quit = 0;
@@ -123,13 +146,28 @@ daemon_init()
 {
 	struct daemon* daemon = (struct daemon*)calloc(1, 
 		sizeof(struct daemon));
+#ifdef USE_WINSOCK
+	int r;
+	WSADATA wsa_data;
+#endif
 	if(!daemon)
 		return NULL;
+#ifdef USE_WINSOCK
+	r = WSAStartup(MAKEWORD(2,2), &wsa_data);
+	if(r != 0) {
+		fatal_exit("could not init winsock. WSAStartup: %s",
+			wsa_strerror(r));
+	}
+#endif /* USE_WINSOCK */
 	signal_handling_record();
 	checklock_start();
 	ERR_load_crypto_strings();
+#ifdef HAVE_TZSET
+	/* init timezone info while we are not chrooted yet */
+	tzset();
+#endif
 	daemon->need_to_exit = 0;
-	daemon->num_modules = 0;
+	modstack_init(&daemon->mods);
 	if(!(daemon->env = (struct module_env*)calloc(1, 
 		sizeof(*daemon->env)))) {
 		free(daemon);
@@ -158,156 +196,90 @@ daemon_open_shared_ports(struct daemon* daemon)
 	return 1;
 }
 
-/** count number of modules (words) in the string */
-static int
-count_modules(const char* s)
-{
-	int num = 0;
-	if(!s)
-		return 0;
-	while(*s) {
-		/* skip whitespace */
-		while(*s && isspace((int)*s))
-			s++;
-		if(*s && !isspace((int)*s)) {
-			/* skip identifier */
-			num++;
-			while(*s && !isspace((int)*s))
-				s++;
-		}
-	}
-	return num;
-}
-
 /**
- * Get funcblock for module name
- * @param str: string with module name. Advanced to next value on success.
- * @return funcblock or NULL on error.
- */
-static struct module_func_block*
-daemon_module_factory(const char** str)
-{
-	/* these are the modules available */
-	int num = 2;
-	const char* names[] = {"iterator", "validator", NULL};
-	struct module_func_block* (*fb[])(void) = 
-		{&iter_get_funcblock, &val_get_funcblock, NULL};
-
-	int i;
-	const char* s = *str;
-	while(*s && isspace((int)*s))
-		s++;
-	for(i=0; i<num; i++) {
-		if(strncmp(names[i], s, strlen(names[i])) == 0) {
-			s += strlen(names[i]);
-			*str = s;
-			return (*fb[i])();
-		}
-	}
-	return NULL;
-}
-
-/**
- * Read config file module settings and set up the modfunc block
- * @param daemon: the daemon.
- * @return false on error
- */
-static int
-daemon_config_modules(struct daemon* daemon)
-{
-	const char* str = daemon->cfg->module_conf;
-	int i;
-	verbose(VERB_DETAIL, "module config: \"%s\"", str);
-	daemon->num_modules = count_modules(str);
-	if(daemon->num_modules == 0) {
-		log_err("error: no modules specified");
-		return 0;
-	}
-	if(daemon->num_modules > MAX_MODULE) {
-		log_err("error: too many modules (%d max %d)",
-			daemon->num_modules, MAX_MODULE);
-		return 0;
-	}
-	daemon->modfunc = (struct module_func_block**)calloc((size_t)
-		daemon->num_modules, sizeof(struct module_func_block*));
-	if(!daemon->modfunc) {
-		log_err("out of memory");
-		return 0;
-	}
-	for(i=0; i<daemon->num_modules; i++) {
-		daemon->modfunc[i] = daemon_module_factory(&str);
-		if(!daemon->modfunc[i]) {
-			log_err("Unknown value for first module in: '%s'",
-				str);
-			return 0;
-		}
-	}
-	return 1;
-}
-
-/**
- * Desetup the modules, deinit, delete.
- * @param daemon: the daemon.
- */
-static void
-daemon_desetup_modules(struct daemon* daemon)
-{
-	int i;
-	for(i=0; i<daemon->num_modules; i++) {
-		log_assert(fptr_whitelist_mod_deinit(
-			daemon->modfunc[i]->deinit));
-		(*daemon->modfunc[i]->deinit)(daemon->env, i);
-	}
-	daemon->num_modules = 0;
-	free(daemon->modfunc);
-	daemon->modfunc = 0;
-}
-
-/**
- * Setup modules. Assigns ids and calls module_init.
+ * Setup modules. setup module stack.
  * @param daemon: the daemon
  */
 static void daemon_setup_modules(struct daemon* daemon)
 {
-	int i;
-	if(daemon->num_modules != 0)
-		daemon_desetup_modules(daemon);
-	/* fixed setup of the modules */
-	if(!daemon_config_modules(daemon)) {
-		fatal_exit("failed to setup modules");
-	}
 	daemon->env->cfg = daemon->cfg;
 	daemon->env->alloc = &daemon->superalloc;
 	daemon->env->worker = NULL;
 	daemon->env->need_to_validate = 0; /* set by module init below */
-	for(i=0; i<daemon->num_modules; i++) {
-		verbose(VERB_OPS, "init module %d: %s", 
-			i, daemon->modfunc[i]->name);
-		log_assert(fptr_whitelist_mod_init(daemon->modfunc[i]->init));
-		if(!(*daemon->modfunc[i]->init)(daemon->env, i)) {
-			fatal_exit("module init for module %s failed",
-				daemon->modfunc[i]->name);
+	if(!modstack_setup(&daemon->mods, daemon->cfg->module_conf, 
+		daemon->env)) {
+		fatal_exit("failed to setup modules");
+	}
+}
+
+/**
+ * Obtain allowed port numbers, concatenate the list, and shuffle them
+ * (ready to be handed out to threads).
+ * @param daemon: the daemon. Uses rand and cfg.
+ * @param shufport: the portlist output.
+ * @return number of ports available.
+ */
+int daemon_get_shufport(struct daemon* daemon, int* shufport)
+{
+	int i, n, k, temp;
+	int avail = 0;
+	for(i=0; i<65536; i++) {
+		if(daemon->cfg->outgoing_avail_ports[i]) {
+			shufport[avail++] = daemon->cfg->
+				outgoing_avail_ports[i];
 		}
 	}
+	if(avail == 0)
+		fatal_exit("no ports are permitted for UDP, add "
+			"with outgoing-port-permit");
+        /* Knuth shuffle */
+	n = avail;
+	while(--n > 0) {
+		k = ub_random(daemon->rand) % (n+1); /* 0<= k<= n */
+		temp = shufport[k];
+		shufport[k] = shufport[n];
+		shufport[n] = temp;
+	}
+	return avail;
 }
 
 /**
  * Allocate empty worker structures. With backptr and thread-number,
  * from 0..numthread initialised. Used as user arguments to new threads.
+ * Creates the daemon random generator if it does not exist yet.
+ * The random generator stays existing between reloads with a unique state.
  * @param daemon: the daemon with (new) config settings.
  */
 static void 
 daemon_create_workers(struct daemon* daemon)
 {
-	int i;
+	int i, numport;
+	int* shufport;
 	log_assert(daemon && daemon->cfg);
+	if(!daemon->rand) {
+		unsigned int seed = (unsigned int)time(NULL) ^ 
+			(unsigned int)getpid() ^ 0x438;
+		daemon->rand = ub_initstate(seed, NULL);
+		if(!daemon->rand)
+			fatal_exit("could not init random generator");
+	}
+	shufport = (int*)calloc(65536, sizeof(int));
+	if(!shufport)
+		fatal_exit("out of memory during daemon init");
+	numport = daemon_get_shufport(daemon, shufport);
+	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
+	
 	daemon->num = daemon->cfg->num_threads;
 	daemon->workers = (struct worker**)calloc((size_t)daemon->num, 
 		sizeof(struct worker*));
 	for(i=0; i<daemon->num; i++) {
-		if(!(daemon->workers[i] = worker_create(daemon, i)))
+		if(!(daemon->workers[i] = worker_create(daemon, i,
+			shufport+numport*i/daemon->num, 
+			numport*(i+1)/daemon->num - numport*i/daemon->num)))
+			/* the above is not ports/numthr, due to rounding */
 			fatal_exit("could not create worker");
 	}
+	free(shufport);
 }
 
 /**
@@ -342,7 +314,7 @@ thread_start(void* arg)
 	struct worker* worker = (struct worker*)arg;
 	log_thread_set(&worker->thread_num);
 	ub_thread_blocksigs();
-#if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
+#ifdef THREADS_DISABLED
 	/* close pipe ends used by main */
 	close(worker->cmd_send_fd);
 	worker->cmd_send_fd = -1;
@@ -369,7 +341,7 @@ daemon_start_others(struct daemon* daemon)
 	for(i=1; i<daemon->num; i++) {
 		ub_thread_create(&daemon->workers[i]->thr_id,
 			thread_start, daemon->workers[i]);
-#if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
+#ifdef THREADS_DISABLED
 		/* close pipe end of child */
 		close(daemon->workers[i]->cmd_recv_fd);
 		daemon->workers[i]->cmd_recv_fd = -1;
@@ -475,13 +447,14 @@ daemon_delete(struct daemon* daemon)
 {
 	if(!daemon)
 		return;
-	daemon_desetup_modules(daemon);
+	modstack_desetup(&daemon->mods, daemon->env);
 	listening_ports_free(daemon->ports);
 	if(daemon->env) {
 		slabhash_delete(daemon->env->msg_cache);
 		rrset_cache_delete(daemon->env->rrset_cache);
 		infra_delete(daemon->env->infra_cache);
 	}
+	ub_randfree(daemon->rand);
 	alloc_clear(&daemon->superalloc);
 	acl_list_delete(daemon->acl);
 	free(daemon->pidfile);
@@ -494,5 +467,12 @@ daemon_delete(struct daemon* daemon)
 	CRYPTO_cleanup_all_ex_data(); /* safe, no more threads right now */
 	ERR_remove_state(0);
 	ERR_free_strings();
+	RAND_cleanup();
 	checklock_stop();
+#ifdef USE_WINSOCK
+	if(WSACleanup() != 0) {
+		log_err("Could not WSACleanup: %s", 
+			wsa_strerror(WSAGetLastError()));
+	}
+#endif
 }

daemon/daemon.h

@@ -44,6 +44,7 @@
 
 #include "util/locks.h"
 #include "util/alloc.h"
+#include "services/modstack.h"
 struct config_file;
 struct worker;
 struct listen_port;
@@ -52,6 +53,7 @@ struct module_env;
 struct rrset_cache;
 struct acl_list;
 struct local_zones;
+struct ub_randstate;
 
 /**
  * Structure holding worker list.
@@ -72,14 +74,14 @@ struct daemon {
 	struct worker** workers;
 	/** do we need to exit unbound (or is it only a reload?) */
 	int need_to_exit;
+	/** master random table ; used for port div between threads on reload*/
+	struct ub_randstate* rand;
 	/** master allocation cache */
 	struct alloc_cache superalloc;
 	/** the module environment master value, copied and changed by threads*/
 	struct module_env* env;
-	/** number of modules active, ids from 0 to num-1. */
-	int num_modules;
-	/** the module callbacks, array of num_modules length */
-	struct module_func_block** modfunc;
+	/** stack of module callbacks */
+	struct module_stack mods;
 	/** access control, which client IPs are allowed to connect */
 	struct acl_list* acl;
 	/** local authority zones */

daemon/stats.c

@@ -46,7 +46,7 @@
 
 void server_stats_init(struct server_stats* stats)
 {
-	memset(stats, 0, sizeof(stats));
+	memset(stats, 0, sizeof(*stats));
 }
 
 void server_stats_querymiss(struct server_stats* stats, struct worker* worker)
@@ -59,10 +59,12 @@ void server_stats_querymiss(struct server_stats* stats, struct worker* worker)
 
 void server_stats_log(struct server_stats* stats, int threadnum)
 {
-	log_info("server stats for thread %d: %u queries, %u from cache", 
+	log_info("server stats for thread %d: %u queries, "
+		"%u answers from cache, %u recursions", 
 		threadnum, (unsigned)stats->num_queries, 
 		(unsigned)(stats->num_queries - 
-			stats->num_queries_missed_cache));
+			stats->num_queries_missed_cache),
+		(unsigned)stats->num_queries_missed_cache);
 	log_info("server stats for thread %d: requestlist max %u avg %g "
 		"exceeded %u", threadnum, (unsigned)stats->max_query_list_size,
 		stats->num_queries_missed_cache?

daemon/unbound.c

@@ -52,8 +52,23 @@
 #include "util/module.h"
 #include <signal.h>
 #include <fcntl.h>
+#ifdef HAVE_PWD_H
 #include <pwd.h>
+#endif
+
+#ifdef HAVE_SYS_RESOURCE_H
 #include <sys/resource.h>
+#endif
+
+#ifdef USE_MINI_EVENT
+#  ifdef USE_WINSOCK
+#    include "util/winsock_event.h"
+#  else
+#    include "util/mini_event.h"
+#  endif
+#else
+#  include <event.h>
+#endif
 
 /** global debug value to keep track of heap memory allocation */
 void* unbound_start_brk = 0;
@@ -69,6 +84,8 @@ static void usage()
 	printf("-d	do not fork into the background.\n");
 	printf("-v	verbose (more times to increase verbosity)\n");
 	printf("Version %s\n", PACKAGE_VERSION);
+	printf("libevent %s, libldns %s\n", 
+		event_get_version(), ldns_version());
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
 }
@@ -77,23 +94,28 @@ static void usage()
 static void
 checkrlimits(struct config_file* cfg)
 {
+#ifdef HAVE_GETRLIMIT
 	int list = ((cfg->do_ip4?1:0) + (cfg->do_ip6?1:0)) * 
 		((cfg->do_udp?1:0) + (cfg->do_tcp?1 + 
 			(int)cfg->incoming_num_tcp:0));
 	size_t ifs = (size_t)(cfg->num_ifs==0?1:cfg->num_ifs);
 	size_t listen_num = list*ifs;
-	size_t out_ifs = (size_t)(cfg->num_out_ifs==0?1:cfg->num_out_ifs);
-	size_t outnum = cfg->outgoing_num_ports*out_ifs + cfg->outgoing_num_tcp;
+	size_t outudpnum = (size_t)cfg->outgoing_num_ports;
+	size_t outtcpnum = cfg->outgoing_num_tcp;
 	size_t misc = 4; /* logfile, pidfile, stdout... */
-	size_t perthread = listen_num + outnum + 2/*cmdpipe*/ + 2/*libevent*/
-		+ misc; 
+	size_t perthread_noudp = listen_num + outtcpnum + 
+		2/*cmdpipe*/ + 2/*libevent*/ + misc; 
+	size_t perthread = perthread_noudp + outudpnum;
+
 #if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 	int numthread = 1; /* it forks */
 #else
 	int numthread = cfg->num_threads;
 #endif
 	size_t total = numthread * perthread + misc;
+	size_t avail;
 	struct rlimit rlim;
+
 	if(getrlimit(RLIMIT_NOFILE, &rlim) < 0) {
 		log_warn("getrlimit: %s", strerror(errno));
 		return;
@@ -101,14 +123,42 @@ checkrlimits(struct config_file* cfg)
 	if(rlim.rlim_cur == (rlim_t)RLIM_INFINITY)
 		return;
 	if((size_t)rlim.rlim_cur < total) {
-		log_err("Not enough sockets available. Increase "
-			"ulimit(open files).");
-		log_err("or decrease number of threads, outgoing num ports, "
-			"outgoing num tcp or number of interfaces");
-		log_err("estimate %u fds high mark, %u available", 
-			(unsigned)total, (unsigned)rlim.rlim_cur);
-		fatal_exit("Not enough file descriptors available");
+		avail = (size_t)rlim.rlim_cur;
+		rlim.rlim_cur = (rlim_t)(total + 10);
+		rlim.rlim_max = (rlim_t)(total + 10);
+		if(setrlimit(RLIMIT_NOFILE, &rlim) < 0) {
+			log_warn("setrlimit: %s", strerror(errno));
+			log_warn("cannot increase max open fds from %u to %u",
+				(unsigned)avail, (unsigned)total+10);
+			cfg->outgoing_num_ports = (int)((avail 
+				- numthread*perthread_noudp 
+				- 10 /* safety margin */) /numthread);
+			log_warn("continuing with less udp ports: %u",
+				cfg->outgoing_num_ports);
+			log_warn("increase ulimit or decrease threads, ports in config to remove this warning");
+			return;
+		}
+		log_warn("increased limit(open files) from %u to %u",
+			(unsigned)avail, (unsigned)total+10);
 	}
+	if(total > 1024 && 
+		strncmp(event_get_version(), "mini-event", 10) == 0) {
+		log_err("too many file descriptors requested. The builtin"
+			"mini-event cannot handle more than 1024. Config "
+			"for less fds or compile with libevent");
+		fatal_exit("configuration needs too many file descriptors");
+	}
+	if(perthread > 64 && 
+		strncmp(event_get_version(), "winsock-event", 13) == 0) {
+		log_err("too many file descriptors requested. The winsock"
+			" event handler cannot handle more than 64 per "
+			" thread. Config for less fds or compile with "
+			" libevent");
+		fatal_exit("configuration needs too many file descriptors");
+	}
+#else	
+	(void)cfg;
+#endif /* HAVE_GETRLIMIT */
 }
 
 /** set verbosity, check rlimits, cache settings */
@@ -141,6 +191,7 @@ apply_settings(struct daemon* daemon, struct config_file* cfg,
 	checkrlimits(cfg);
 }
 
+#ifdef HAVE_KILL
 /** Read existing pid from pidfile. 
  * @param file: file name of pid file.
  * @return: the pid from the file or -1 if none.
@@ -228,11 +279,13 @@ checkoldpid(struct config_file* cfg)
 				(unsigned)old);
 	}
 }
+#endif /* HAVE_KILL */
 
 /** detach from command line */
 static void
 detach(struct config_file* cfg)
 {
+#ifdef HAVE_WORKING_FORK
 	int fd;
 	/* Take off... */
 	switch (fork()) {
@@ -246,8 +299,10 @@ detach(struct config_file* cfg)
 			exit(0);
 	}
 	/* detach */
+#ifdef HAVE_SETSID
 	if(setsid() == -1)
 		fatal_exit("setsid() failed: %s", strerror(errno));
+#endif
 	if ((fd = open("/dev/null", O_RDWR, 0)) != -1) {
 		(void)dup2(fd, STDIN_FILENO);
 		(void)dup2(fd, STDOUT_FILENO);
@@ -255,27 +310,25 @@ detach(struct config_file* cfg)
 		if (fd > 2)
 			(void)close(fd);
 	}
+#else
+	(void)cfg;
+#endif /* HAVE_WORKING_FORK */
 }
 
 /** daemonize, drop user priviliges and chroot if needed */
 static void
-do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode)
+do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode,
+	char** cfgfile)
 {
+#ifdef HAVE_GETPWNAM
 	uid_t uid;
 	gid_t gid;
 	/* initialize, but not to 0 (root) */
-	memset(&uid, -12, sizeof(uid));
-	memset(&gid, -12, sizeof(gid));
+	memset(&uid, 112, sizeof(uid));
+	memset(&gid, 112, sizeof(gid));
 	log_assert(cfg);
 
 	/* daemonize last to be able to print error to user */
-	if(cfg->directory && cfg->directory[0]) {
-		if(chdir(cfg->directory)) {
-			fatal_exit("Could not chdir to %s: %s",
-				cfg->directory, strerror(errno));
-		}
-		verbose(VERB_DETAIL, "chdir to %s", cfg->directory);
-	}
 	if(cfg->username && cfg->username[0]) {
 		struct passwd *pwd;
 		if((pwd = getpwnam(cfg->username)) == NULL)
@@ -284,12 +337,40 @@ do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode)
 		gid = pwd->pw_gid;
 		endpwent();
 	}
+#endif
+#ifdef HAVE_CHROOT
 	if(cfg->chrootdir && cfg->chrootdir[0]) {
+		if(chdir(cfg->chrootdir)) {
+			fatal_exit("unable to chdir to chroot %s: %s",
+				cfg->chrootdir, strerror(errno));
+		}
+		verbose(VERB_QUERY, "chdir to %s", cfg->chrootdir);
 		if(chroot(cfg->chrootdir))
 			fatal_exit("unable to chroot to %s: %s", 
 				cfg->chrootdir, strerror(errno));
-		verbose(VERB_DETAIL, "chroot to %s", cfg->chrootdir);
+		verbose(VERB_QUERY, "chroot to %s", cfg->chrootdir);
+		if(strncmp(*cfgfile, cfg->chrootdir, 
+			strlen(cfg->chrootdir)) == 0) 
+			(*cfgfile) += strlen(cfg->chrootdir);
 	}
+#else
+	(void)cfgfile;
+#endif
+	if(cfg->directory && cfg->directory[0]) {
+		char* dir = cfg->directory;
+		if(cfg->chrootdir && cfg->chrootdir[0] &&
+			strncmp(dir, cfg->chrootdir, 
+			strlen(cfg->chrootdir)) == 0)
+			dir += strlen(cfg->chrootdir);
+		if(dir[0]) {
+			if(chdir(dir)) {
+				fatal_exit("Could not chdir to %s: %s",
+					dir, strerror(errno));
+			}
+			verbose(VERB_QUERY, "chdir to %s", dir);
+		}
+	}
+#ifdef HAVE_GETPWNAM
 	if(cfg->username && cfg->username[0]) {
 		if(setgid(gid) != 0)
 			fatal_exit("unable to set group id of %s: %s", 
@@ -297,19 +378,23 @@ do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode)
 		if(setuid(uid) != 0)
 			fatal_exit("unable to set user id of %s: %s", 
 				cfg->username, strerror(errno));
-		verbose(VERB_DETAIL, "drop user privileges, run as %s", 
+		verbose(VERB_QUERY, "drop user privileges, run as %s", 
 			cfg->username);
 	}
+#endif
+#ifdef HAVE_KILL
 	/* check old pid file before forking */
 	if(cfg->pidfile && cfg->pidfile[0]) {
 		checkoldpid(cfg);
 	}
+#endif
 
 	/* init logfile just before fork */
 	log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
 	if(!debug_mode && cfg->do_daemonize) {
 		detach(cfg);
 	}
+#ifdef HAVE_KILL
 	if(cfg->pidfile && cfg->pidfile[0]) {
 		char* pf = cfg->pidfile;
 		if(cfg->chrootdir && cfg->chrootdir[0] &&
@@ -319,6 +404,9 @@ do_chroot(struct daemon* daemon, struct config_file* cfg, int debug_mode)
 		if(!(daemon->pidfile = strdup(pf)))
 			log_err("pidf: malloc failed");
 	}
+#else
+	(void)daemon;
+#endif
 }
 
 /**
@@ -345,15 +433,19 @@ run_daemon(char* cfgfile, int cmdline_verbose, int debug_mode)
 		/* config stuff */
 		if(!(cfg = config_create()))
 			fatal_exit("Could not alloc config defaults");
-		if(!config_read(cfg, cfgfile))
-			fatal_exit("Could not read config file: %s", cfgfile);
+		if(!config_read(cfg, cfgfile)) {
+			if(errno != ENOENT)
+				fatal_exit("Could not read config file: %s",
+					cfgfile);
+			log_warn("Continuing with default config settings");
+		}
 		apply_settings(daemon, cfg, cmdline_verbose);
 	
 		/* prepare */
 		if(!daemon_open_shared_ports(daemon))
 			fatal_exit("could not open ports");
 		if(!done_chroot) { 
-			do_chroot(daemon, cfg, debug_mode); 
+			do_chroot(daemon, cfg, debug_mode, &cfgfile); 
 			done_chroot = 1; 
 		} else log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
 		/* work */
@@ -389,8 +481,10 @@ main(int argc, char* argv[])
 	int cmdline_verbose = 0;
 	int debug_mode = 0;
 
+#ifdef HAVE_SBRK
 	/* take debug snapshot of heap */
 	unbound_start_brk = sbrk(0);
+#endif
 
 	log_init(NULL, 0, NULL);
 	/* parse the options */

daemon/worker.c

@@ -67,7 +67,9 @@
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
+#ifdef HAVE_NETDB_H
 #include <netdb.h>
+#endif
 #include <signal.h>
 
 /** Size of an UDP datagram */
@@ -102,6 +104,7 @@ debug_memleak(size_t accounted, size_t heap,
 static void
 debug_total_mem(size_t calctotal)
 {
+#ifdef HAVE_SBRK
 	extern void* unbound_start_brk;
 	extern size_t unbound_mem_alloc, unbound_mem_freed;
 	void* cur = sbrk(0);
@@ -111,6 +114,9 @@ debug_total_mem(size_t calctotal)
 		(unsigned)unbound_mem_alloc, (unsigned)unbound_mem_freed);
 	debug_memleak(calctotal, (size_t)total, 
 		unbound_mem_alloc, unbound_mem_freed);
+#else
+	(void)calctotal;
+#endif /* HAVE_SBRK */
 }
 #endif /* UNBOUND_ALLOC_STATS */
 
@@ -136,13 +142,13 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 	superac = alloc_get_mem(&worker->daemon->superalloc);
 	iter = 0;
 	val = 0;
-	for(i=0; i<worker->env.mesh->num_modules; i++) {
-		log_assert(fptr_whitelist_mod_get_mem(worker->env.mesh->
-			modfunc[i]->get_mem));
-		if(strcmp(worker->env.mesh->modfunc[i]->name, "validator")==0)
-			val += (*worker->env.mesh->modfunc[i]->get_mem)
+	for(i=0; i<worker->env.mesh->mods.num; i++) {
+		fptr_ok(fptr_whitelist_mod_get_mem(worker->env.mesh->
+			mods.mod[i]->get_mem));
+		if(strcmp(worker->env.mesh->mods.mod[i]->name, "validator")==0)
+			val += (*worker->env.mesh->mods.mod[i]->get_mem)
 				(&worker->env, i);
-		else	iter += (*worker->env.mesh->modfunc[i]->get_mem)
+		else	iter += (*worker->env.mesh->mods.mod[i]->get_mem)
 				(&worker->env, i);
 	}
 	me = sizeof(*worker) + sizeof(*worker->base) + sizeof(*worker->comsig)
@@ -163,6 +169,23 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 		(unsigned)infra, (unsigned)iter, (unsigned)val, (unsigned)ac, 
 		(unsigned)superac, (unsigned)me);
 	debug_total_mem(total);
+#else /* no UNBOUND_ALLOC_STATS */
+	size_t val = 0;
+	int i;
+	if(verbosity < VERB_QUERY)
+		return;
+	for(i=0; i<worker->env.mesh->mods.num; i++) {
+		fptr_ok(fptr_whitelist_mod_get_mem(worker->env.mesh->
+			mods.mod[i]->get_mem));
+		if(strcmp(worker->env.mesh->mods.mod[i]->name, "validator")==0)
+			val += (*worker->env.mesh->mods.mod[i]->get_mem)
+				(&worker->env, i);
+	}
+	verbose(VERB_QUERY, "cache memory msg=%u rrset=%u infra=%u val=%u",
+		(unsigned)slabhash_get_mem(worker->env.msg_cache),
+		(unsigned)slabhash_get_mem(&worker->env.rrset_cache->table),
+		(unsigned)infra_get_mem(worker->env.infra_cache),
+		(unsigned)val);
 #endif /* UNBOUND_ALLOC_STATS */
 }
 
@@ -250,40 +273,45 @@ static int
 worker_check_request(ldns_buffer* pkt, struct worker* worker)
 {
 	if(ldns_buffer_limit(pkt) < LDNS_HEADER_SIZE) {
-		verbose(VERB_DETAIL, "request too short, discarded");
+		verbose(VERB_QUERY, "request too short, discarded");
 		return -1;
 	}
 	if(ldns_buffer_limit(pkt) > NORMAL_UDP_SIZE && 
 		worker->daemon->cfg->harden_large_queries) {
-		verbose(VERB_DETAIL, "request too large, discarded");
+		verbose(VERB_QUERY, "request too large, discarded");
 		return -1;
 	}
 	if(LDNS_QR_WIRE(ldns_buffer_begin(pkt))) {
-		verbose(VERB_DETAIL, "request has QR bit on, discarded");
+		verbose(VERB_QUERY, "request has QR bit on, discarded");
 		return -1;
 	}
+	if(LDNS_TC_WIRE(ldns_buffer_begin(pkt))) {
+		LDNS_TC_CLR(ldns_buffer_begin(pkt));
+		verbose(VERB_QUERY, "request bad, has TC bit on");
+		return LDNS_RCODE_FORMERR;
+	}
 	if(LDNS_OPCODE_WIRE(ldns_buffer_begin(pkt)) != LDNS_PACKET_QUERY) {
-		verbose(VERB_DETAIL, "request unknown opcode %d", 
+		verbose(VERB_QUERY, "request unknown opcode %d", 
 			LDNS_OPCODE_WIRE(ldns_buffer_begin(pkt)));
 		return LDNS_RCODE_NOTIMPL;
 	}
 	if(LDNS_QDCOUNT(ldns_buffer_begin(pkt)) != 1) {
-		verbose(VERB_DETAIL, "request wrong nr qd=%d", 
+		verbose(VERB_QUERY, "request wrong nr qd=%d", 
 			LDNS_QDCOUNT(ldns_buffer_begin(pkt)));
 		return LDNS_RCODE_FORMERR;
 	}
 	if(LDNS_ANCOUNT(ldns_buffer_begin(pkt)) != 0) {
-		verbose(VERB_DETAIL, "request wrong nr an=%d", 
+		verbose(VERB_QUERY, "request wrong nr an=%d", 
 			LDNS_ANCOUNT(ldns_buffer_begin(pkt)));
 		return LDNS_RCODE_FORMERR;
 	}
 	if(LDNS_NSCOUNT(ldns_buffer_begin(pkt)) != 0) {
-		verbose(VERB_DETAIL, "request wrong nr ns=%d", 
+		verbose(VERB_QUERY, "request wrong nr ns=%d", 
 			LDNS_NSCOUNT(ldns_buffer_begin(pkt)));
 		return LDNS_RCODE_FORMERR;
 	}
 	if(LDNS_ARCOUNT(ldns_buffer_begin(pkt)) > 1) {
-		verbose(VERB_DETAIL, "request wrong nr ar=%d", 
+		verbose(VERB_QUERY, "request wrong nr ar=%d", 
 			LDNS_ARCOUNT(ldns_buffer_begin(pkt)));
 		return LDNS_RCODE_FORMERR;
 	}
@@ -384,7 +412,7 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	 */
 	uint16_t udpsize = edns->udp_size;
 	int secure = 0;
-	uint32_t timenow = (uint32_t)time(0);
+	uint32_t timenow = *worker->env.now;
 	int must_validate = !(flags&BIT_CD) && worker->env.need_to_validate;
 	struct dns_msg *msg = NULL;
 	struct delegpt *dp;
@@ -483,12 +511,11 @@ all_rrsets_secure(struct reply_info* rep) {
 
 /** answer query from the cache */
 static int
-answer_from_cache(struct worker* worker, struct lruhash_entry* e, uint16_t id,
-	uint16_t flags, struct comm_reply* repinfo, struct edns_data* edns)
+answer_from_cache(struct worker* worker, struct query_info* qinfo,
+	struct reply_info* rep, uint16_t id, uint16_t flags, 
+	struct comm_reply* repinfo, struct edns_data* edns)
 {
-	struct msgreply_entry* mrentry = (struct msgreply_entry*)e->key;
-	struct reply_info* rep = (struct reply_info*)e->data;
-	uint32_t timenow = time(0);
+	uint32_t timenow = *worker->env.now;
 	uint16_t udpsize = edns->udp_size;
 	int secure;
 	int must_validate = !(flags&BIT_CD) && worker->env.need_to_validate;
@@ -525,7 +552,7 @@ answer_from_cache(struct worker* worker, struct lruhash_entry* e, uint16_t id,
 		edns->ext_rcode = 0;
 		edns->bits &= EDNS_DO;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
-			&mrentry->key, id, flags, edns);
+			qinfo, id, flags, edns);
 		rrset_array_unlock_touch(worker->env.rrset_cache, 
 			worker->scratchpad, rep->ref, rep->rrset_count);
 		regional_free_all(worker->scratchpad);
@@ -551,11 +578,11 @@ answer_from_cache(struct worker* worker, struct lruhash_entry* e, uint16_t id,
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
 	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
-	if(!reply_info_answer_encode(&mrentry->key, rep, id, flags, 
+	if(!reply_info_answer_encode(qinfo, rep, id, flags, 
 		repinfo->c->buffer, timenow, 1, worker->scratchpad,
 		udpsize, edns, (int)(edns->bits & EDNS_DO), secure)) {
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
-			&mrentry->key, id, flags, edns);
+			qinfo, id, flags, edns);
 	}
 	/* cannot send the reply right now, because blocking network syscall
 	 * is bad while holding locks. */
@@ -684,6 +711,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		LDNS_QR_SET(ldns_buffer_begin(c->buffer));
 		LDNS_RCODE_SET(ldns_buffer_begin(c->buffer), 
 			LDNS_RCODE_REFUSED);
+		log_addr(VERB_ALGO, "refused query from",
+			&repinfo->addr, repinfo->addrlen);
 		log_buf(VERB_ALGO, "refuse", c->buffer);
 		return 1;
 	}
@@ -734,7 +763,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}
 	if(edns.edns_present && edns.udp_size < NORMAL_UDP_SIZE &&
 		worker->daemon->cfg->harden_short_bufsize) {
-		verbose(VERB_DETAIL, "worker request: EDNS bufsize %d ignored",
+		verbose(VERB_QUERY, "worker request: EDNS bufsize %d ignored",
 			(int)edns.udp_size);
 		edns.udp_size = NORMAL_UDP_SIZE;
 	}
@@ -763,7 +792,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	h = query_info_hash(&qinfo);
 	if((e=slabhash_lookup(worker->env.msg_cache, h, &qinfo, 0))) {
 		/* answer from cache - we have acquired a readlock on it */
-		if(answer_from_cache(worker, e, 
+		if(answer_from_cache(worker, &qinfo, 
+			(struct reply_info*)e->data, 
 			*(uint16_t*)ldns_buffer_begin(c->buffer), 
 			ldns_buffer_read_u16_at(c->buffer, 2), repinfo, 
 			&edns)) {
@@ -793,6 +823,12 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		worker->stats.num_query_list_exceeded++;
 		comm_point_drop_reply(repinfo);
 		return 0;
+	} else if(worker->env.mesh->num_reply_addrs>worker->request_size*16) {
+		verbose(VERB_ALGO, "Too many requests queued. "
+			"dropping incoming query.");
+		worker->stats.num_query_list_exceeded++;
+		comm_point_drop_reply(repinfo);
+		return 0;
 	}
 	mesh_new_client(worker->env.mesh, &qinfo, 
 		ldns_buffer_read_u16_at(c->buffer, 2),
@@ -810,22 +846,26 @@ worker_sighandler(int sig, void* arg)
 	 * in the cause for unbound to exit */
 	struct worker* worker = (struct worker*)arg;
 	switch(sig) {
+#ifdef SIGHUP
 		case SIGHUP:
-			verbose(VERB_DETAIL, "caught signal SIGHUP");
+			verbose(VERB_QUERY, "caught signal SIGHUP");
 			comm_base_exit(worker->base);
 			break;
+#endif
 		case SIGINT:
-			verbose(VERB_DETAIL, "caught signal SIGINT");
+			verbose(VERB_QUERY, "caught signal SIGINT");
 			worker->need_to_exit = 1;
 			comm_base_exit(worker->base);
 			break;
+#ifdef SIGQUIT
 		case SIGQUIT:
-			verbose(VERB_DETAIL, "caught signal SIGQUIT");
+			verbose(VERB_QUERY, "caught signal SIGQUIT");
 			worker->need_to_exit = 1;
 			comm_base_exit(worker->base);
 			break;
+#endif
 		case SIGTERM:
-			verbose(VERB_DETAIL, "caught signal SIGTERM");
+			verbose(VERB_QUERY, "caught signal SIGTERM");
 			worker->need_to_exit = 1;
 			comm_base_exit(worker->base);
 			break;
@@ -835,13 +875,45 @@ worker_sighandler(int sig, void* arg)
 	}
 }
 
+/** restart statistics timer for worker, if enabled */
+static void
+worker_restart_timer(struct worker* worker)
+{
+	if(worker->env.cfg->stat_interval > 0) {
+		struct timeval tv;
+		tv.tv_sec = worker->env.cfg->stat_interval;
+		tv.tv_usec = 0;
+		comm_timer_set(worker->stat_timer, &tv);
+	}
+}
+
+void worker_stat_timer_cb(void* arg)
+{
+	struct worker* worker = (struct worker*)arg;
+	server_stats_log(&worker->stats, worker->thread_num);
+	mesh_stats(worker->env.mesh, "mesh has");
+	worker_mem_report(worker, NULL);
+	if(!worker->daemon->cfg->stat_cumulative) {
+		server_stats_init(&worker->stats);
+		mesh_stats_clear(worker->env.mesh);
+	}
+	/* start next timer */
+	worker_restart_timer(worker);
+}
+
 struct worker* 
-worker_create(struct daemon* daemon, int id)
+worker_create(struct daemon* daemon, int id, int* ports, int n)
 {
 	struct worker* worker = (struct worker*)calloc(1, 
 		sizeof(struct worker));
 	if(!worker) 
 		return NULL;
+	worker->numports = n;
+	worker->ports = (int*)memdup(ports, sizeof(int)*n);
+	if(!worker->ports) {
+		free(worker);
+		return NULL;
+	}
 	worker->daemon = daemon;
 	worker->thread_num = id;
 	worker->cmd_send_fd = -1;
@@ -871,7 +943,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	struct listen_port* ports, int do_sigs)
 {
 	unsigned int seed;
-	int startport;
 	worker->need_to_exit = 0;
 	worker->base = comm_base_create();
 	if(!worker->base) {
@@ -880,17 +951,26 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		return 0;
 	}
 	if(do_sigs) {
+#ifdef SIGHUP
 		ub_thread_sig_unblock(SIGHUP);
+#endif
 		ub_thread_sig_unblock(SIGINT);
+#ifdef SIGQUIT
 		ub_thread_sig_unblock(SIGQUIT);
+#endif
 		ub_thread_sig_unblock(SIGTERM);
 #ifndef LIBEVENT_SIGNAL_PROBLEM
 		worker->comsig = comm_signal_create(worker->base, 
 			worker_sighandler, worker);
-		if(!worker->comsig || !comm_signal_bind(worker->comsig, SIGHUP)
-			|| !comm_signal_bind(worker->comsig, SIGINT)
+		if(!worker->comsig 
+#ifdef SIGHUP
+			|| !comm_signal_bind(worker->comsig, SIGHUP)
+#endif
+#ifdef SIGQUIT
+			|| !comm_signal_bind(worker->comsig, SIGQUIT)
+#endif
 			|| !comm_signal_bind(worker->comsig, SIGTERM)
-			|| !comm_signal_bind(worker->comsig, SIGQUIT)) {
+			|| !comm_signal_bind(worker->comsig, SIGINT)) {
 			log_err("could not create signal handlers");
 			worker_delete(worker);
 			return 0;
@@ -899,17 +979,10 @@ worker_init(struct worker* worker, struct config_file *cfg,
 	} else { /* !do_sigs */
 		worker->comsig = 0;
 	}
-	/* init random(), large table size. */
-	if(!(worker->rndstate = (struct ub_randstate*)calloc(1,
-		sizeof(struct ub_randstate)))) {
-		log_err("malloc rndtable failed.");
-		worker_delete(worker);
-		return 0;
-	}
 	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^
 		(((unsigned int)worker->thread_num)<<17);
 		/* shift thread_num so it does not match out pid bits */
-	if(!ub_initstate(seed, worker->rndstate, RND_STATE_SIZE)) {
+	if(!(worker->rndstate = ub_initstate(seed, NULL))) {
 		seed = 0;
 		log_err("could not init random numbers.");
 		worker_delete(worker);
@@ -924,13 +997,12 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker_delete(worker);
 		return 0;
 	}
-	startport  = cfg->outgoing_base_port + 
-		cfg->outgoing_num_ports * worker->thread_num;
 	worker->back = outside_network_create(worker->base,
 		cfg->msg_buffer_size, (size_t)cfg->outgoing_num_ports, 
 		cfg->out_ifs, cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, 
-		startport, cfg->do_tcp?cfg->outgoing_num_tcp:0, 
-		worker->daemon->env->infra_cache, worker->rndstate);
+		cfg->do_tcp?cfg->outgoing_num_tcp:0, 
+		worker->daemon->env->infra_cache, worker->rndstate,
+		cfg->use_caps_bits_for_id, worker->ports, worker->numports);
 	if(!worker->back) {
 		log_err("could not create outgoing sockets");
 		worker_delete(worker);
@@ -946,6 +1018,12 @@ worker_init(struct worker* worker, struct config_file *cfg,
 			return 0;
 		}
 	}
+	worker->stat_timer = comm_timer_create(worker->base, 
+		worker_stat_timer_cb, worker);
+	if(!worker->stat_timer) {
+		log_err("could not create statistics timer");
+	}
+
 	/* we use the msg_buffer_size as a good estimate for what the 
 	 * user wants for memory usage sizes */
 	worker->scratchpad = regional_create_custom(cfg->msg_buffer_size);
@@ -961,14 +1039,16 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker->thread_num);
 	alloc_set_id_cleanup(&worker->alloc, &worker_alloc_cleanup, worker);
 	worker->env = *worker->daemon->env;
+	comm_base_timept(worker->base, &worker->env.now, &worker->env.now_tv);
+	if(worker->thread_num == 0)
+		log_set_time(worker->env.now);
 	worker->env.worker = worker;
 	worker->env.send_packet = &worker_send_packet;
 	worker->env.send_query = &worker_send_query;
 	worker->env.alloc = &worker->alloc;
 	worker->env.rnd = worker->rndstate;
 	worker->env.scratch = worker->scratchpad;
-	worker->env.mesh = mesh_create(worker->daemon->num_modules,
-		worker->daemon->modfunc, &worker->env);
+	worker->env.mesh = mesh_create(&worker->daemon->mods, &worker->env);
 	worker->env.detach_subs = &mesh_detach_subs;
 	worker->env.attach_sub = &mesh_attach_sub;
 	worker->env.kill_sub = &mesh_state_delete;
@@ -979,6 +1059,12 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		return 0;
 	}
 	worker_mem_report(worker, NULL);
+	/* if statistics enabled start timer */
+	if(worker->env.cfg->stat_interval > 0) {
+		verbose(VERB_ALGO, "set statistics interval %d secs", 
+			worker->env.cfg->stat_interval);
+		worker_restart_timer(worker);
+	}
 	return 1;
 }
 
@@ -994,8 +1080,8 @@ worker_delete(struct worker* worker)
 	if(!worker) 
 		return;
 	if(worker->env.mesh && verbosity >= VERB_OPS) {
-		mesh_stats(worker->env.mesh, "mesh has");
 		server_stats_log(&worker->stats, worker->thread_num);
+		mesh_stats(worker->env.mesh, "mesh has");
 		worker_mem_report(worker, NULL);
 	}
 	mesh_delete(worker->env.mesh);
@@ -1004,9 +1090,12 @@ worker_delete(struct worker* worker)
 	outside_network_delete(worker->back);
 	comm_signal_delete(worker->comsig);
 	comm_point_delete(worker->cmd_com);
+	comm_timer_delete(worker->stat_timer);
+	free(worker->ports);
+	if(worker->thread_num == 0)
+		log_set_time(NULL);
 	comm_base_delete(worker->base);
 	ub_randfree(worker->rndstate);
-	free(worker->rndstate);
 	/* close fds after deleting commpoints, to be sure.
 	   Also epoll does not like closing fd before event_del */
 	if(worker->cmd_send_fd != -1)
@@ -1027,12 +1116,10 @@ worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
 	struct worker* worker = q->env->worker;
 	if(use_tcp) {
 		return pending_tcp_query(worker->back, pkt, addr, addrlen, 
-			timeout, worker_handle_reply, q, 
-			worker->rndstate) != 0;
+			timeout, worker_handle_reply, q) != 0;
 	}
 	return pending_udp_query(worker->back, pkt, addr, addrlen, 
-		timeout*1000, worker_handle_reply, q, 
-		worker->rndstate) != 0;
+		timeout*1000, worker_handle_reply, q) != 0;
 }
 
 /** compare outbound entry qstates */
@@ -1075,3 +1162,57 @@ worker_alloc_cleanup(void* arg)
 	slabhash_clear(&worker->env.rrset_cache->table);
 	slabhash_clear(worker->env.msg_cache);
 }
+
+/* --- fake callbacks for fptr_wlist to work --- */
+int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
+	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
+	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
+{
+	log_assert(0);
+	return 0;
+}
+
+struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
+	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
+	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
+	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
+{
+	log_assert(0);
+	return 0;
+}
+
+int libworker_handle_reply(struct comm_point* ATTR_UNUSED(c), 
+	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
+        struct comm_reply* ATTR_UNUSED(reply_info))
+{
+	log_assert(0);
+	return 0;
+}
+
+int libworker_handle_service_reply(struct comm_point* ATTR_UNUSED(c), 
+	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
+        struct comm_reply* ATTR_UNUSED(reply_info))
+{
+	log_assert(0);
+	return 0;
+}
+
+int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
+{
+	log_assert(0);
+	return 0;
+}
+
+int order_lock_cmp(const void* ATTR_UNUSED(e1), const void* ATTR_UNUSED(e2))
+{
+        log_assert(0);
+        return 0;
+}
+
+int codeline_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
+{
+        log_assert(0);
+        return 0;
+}

daemon/worker.h

@@ -59,9 +59,6 @@ struct listen_port;
 struct ub_randstate;
 struct regional;
 
-/** size of table used for random numbers. large to be more secure. */
-#define RND_STATE_SIZE 256
-
 /** worker commands */
 enum worker_commands {
 	/** make the worker quit */
@@ -89,10 +86,16 @@ struct worker {
 	struct listen_dnsport* front;
 	/** the backside outside network interface to the auth servers */
 	struct outside_network* back;
+	/** ports to be used by this worker. */
+	int* ports;
+	/** number of ports for this worker */
+	int numports;
 	/** the signal handler */
 	struct comm_signal* comsig;
 	/** commpoint to listen to commands. */
 	struct comm_point* cmd_com;
+	/** timer for statistics */
+	struct comm_timer* stat_timer;
 
 	/** number of requests that can be handled by this worker */
 	size_t request_size;
@@ -117,9 +120,11 @@ struct worker {
  * with backpointers only. Use worker_init on it later.
  * @param daemon: the daemon that this worker thread is part of.
  * @param id: the thread number from 0.. numthreads-1.
+ * @param ports: the ports it is allowed to use, array.
+ * @param n: the number of ports.
  * @return: the new worker or NULL on alloc failure.
  */
-struct worker* worker_create(struct daemon* daemon, int id);
+struct worker* worker_create(struct daemon* daemon, int id, int* ports, int n);
 
 /**
  * Initialize worker.
@@ -217,4 +222,7 @@ int worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 /** cleanup the cache to remove all rrset IDs from it, arg is worker */
 void worker_alloc_cleanup(void* arg);
 
+/** statistics timer callback handler */
+void worker_stat_timer_cb(void* arg);
+
 #endif /* DAEMON_WORKER_H */

doc/CREDITS

@@ -1,9 +1,16 @@
 Unbound was developed at NLnet Labs by Wouter Wijngaards.
 
-Unbound was devised by Bill Manning, David Blacka, and Matt Larson 
-from the University of California and from Verisign. The Java prototype
-was made in further cooperation with Geoff Sisson and Roy Arends from Nominet.
+Unbound was architected in January of 2004 by Jakob Schlyter of Kirei 
+and Roy Arends of Nominet. VeriSign and EP.Net funded development of 
+the prototype, which was built by David Blacka and Matt Larson of VeriSign. 
+Late in 2006, NLnet Labs joined the effort, writing an implementation in C 
+based on the existing prototype and using experience NLnet Labs gained
+during the development of NSD, an authoritative DNS server.
 
-At NLnet Labs, Jelte Jansen and Mark Santcroos reviewed the unbound C sources.
+At NLnet Labs, Jelte Jansen, Mark Santcroos and Matthijs Mekking 
+reviewed the unbound C sources.
 
 Jakob Schlyter - for advice on secure settings, random numbers and blacklists.
+
+Ondřej Surý - running coverity analysis tool on 0.9 dev version.
+Alexander Gall - multihomed, anycast testing of unbound resolver server.

doc/Changelog

@@ -1,3 +1,695 @@
+6 August 2008: Wouter
+	- patch for scrubber that removes ends of CNAMEs, no more DNAMEs
+	  from cache. Remove more irrelevant rrsets from the message.
+
+5 August 2008: Wouter
+	- fixup DS test so apex nodata works again (from trunk).
+
+4 August 2008: Wouter
+	- Bug #201 fixup from trunk; fixes segfault on exit cleanup
+	- iana port nrs updated.
+
+30 July 2008: Wouter
+	- fixup DS qtype validation bug. (fix taken from trunk).
+
+21 July 2008: Wouter
+	- #198: nicer entropy warning message. manpage OS hints.
+
+19 July 2008: Wouter
+	- #198: fixup manpage to suggest entropy chroot fix.
+
+18 July 2008: Wouter
+	- branch for 1.0 support.
+
+17 July 2008: Wouter
+	- fix bug #196, compile outside source tree.
+	- fix bug #195, add --with-username=user configure option.
+	- print error and exit if started with config that requires more
+	  fds than the builtin minievent can handle.
+
+16 July 2008: Wouter
+	- made svn tag 1.0.1, trunk now 1.0.2
+	- sha256 checksums enabled in makedist.sh
+
+15 July 2008: Wouter
+	- Follow draft-ietf-dnsop-default-local-zones-06 added reverse
+	  IPv6 example prefix to AS112 default blocklist.
+	- fixup lookup of DS records by client with trustanchor for same.
+	- libunbound ub_resolve, fix handling of error condition during setup.
+	- lowered log_hex blocksize to fit through BSD syslog linesize.
+	- no useless initialisation if getpwnam not available.
+	- iana, ldns snapshot updated.
+
+3 July 2008: Wouter
+	- Matthijs fixed memory leaks in root hints file reading.
+
+26 June 2008: Wouter
+	- fixup streamtcp bounds setting for udp mode, in the test framework.
+	- contrib item for updating trust anchors.
+
+25 June 2008: Wouter
+	- fixup fwd_ancil test typos.
+	- Fix for newegg lameness : ok for qtype=A, but lame for others.
+	- fixup unit test for infra cache, test lame merging.
+	- porting to mingw, bind, listen, getsockopt and setsockopt error
+	  handling.
+
+24 June 2008: Wouter
+	- removed testcode/checklocks from production code compilation path.
+	- streamtcp can use UDP mode (connected UDP socket), for testing IPv6
+	  on windows.
+	- fwd_ancil test fails if platform support is lacking.
+
+23 June 2008: Wouter
+	- fixup minitpkg to cleanup on windows with its file locking troubles.
+	- minitpkg shows skipped tests in report.
+	- skip ipv6 tests on ipv4 only hosts (requires only ipv6 localhost not
+	  ipv6 connectivity).
+	- winsock event handler keeps track of sticky TCP events, that have
+	  not been fully handled yet. when interest in the event(s) resumes,
+	  they are sent again. When WOULDBLOCK is returned events are cleared.
+	- skip tests that need signals when testing on mingw.
+
+18 June 2008: Wouter
+	- open testbound replay files in binary mode, because fseek/ftell
+	  do not work in ascii-mode on windows. The b does nothing on unix.
+	  unittest and testbound tests work on windows (xp too).
+	- ioctlsocket prints nicer error message.
+	- fixed up some TCP porting for winsock.
+	- lack of IPv6 gives a warning, no fatal error.
+	- use WSAGetLastError() on windows instead of errno for some errors.
+
+17 June 2008: Wouter
+	- outgoing num fds 32 by default on windows ; it supports less
+	  fds for waiting on than unixes.
+	- winsock_event minievent handler for windows. (you could also
+	  attempt to link with libevent/libev ports for windows).
+	- neater crypto check and gdi32 detection.
+	- unbound.exe works to resolve and validate www.nlnetlabs.nl on vista.
+
+16 June 2008: Wouter
+	- on windows, use windows threads, mutex and thread-local-storage(Tls).
+	- detect if openssl needs gdi32.
+	- if no threading, THREADS_DISABLED is defined for use in the code.
+	- sets USE_WINSOCK if using ws2_32 on windows.
+	- wsa_strerror() function for more readable errors.
+	- WSA Startup and Cleanup called in unbound.exe.
+
+13 June 2008: Wouter
+	- port mingw32, more signal ifdefs, detect sleep, usleep, 
+	  random, srandom (used inside the tests).
+	- signed or unsigned FD_SET is cast.
+
+10 June 2008: Wouter
+	- fixup warnings compiling on eeepc xandros linux.
+
+9 June 2008: Wouter
+	- in iteration response type code
+	  * first check for SOA record (negative answer) before NS record
+	    and lameness.
+	  * check if no AA bit for non-forwarder, and thus lame zone.
+	    In response to error report by Richard Doty for mail.opusnet.com.
+	- fixup unput warning from lexer on freeBSD.
+	- bug#183. pidfile, rundir, and chroot configure options. Also the
+	  example.conf and manual pages get the configured defaults.
+	  You can use: (or accept the defaults to /usr/local/etc/unbound/)
+	  --with-conf-file=filename
+	  --with-pidfile=filename
+	  --with-run-dir=path
+	  --with-chroot-dir=path
+
+8 June 2008: Wouter
+	- if multiple CNAMEs, use the first one. Fixup akamai CNAME bug.
+	  Reported by Robert Edmonds.
+	- iana port updated.
+
+4 June 2008: Wouter
+	- updated libtool files with newer version.
+	- iana portlist updated.
+
+3 June 2008: Wouter
+	- fixup local-zone: "30.172.in-addr.arpa." nodefault, so that the
+	  trailing dot is not used during comparison.
+
+2 June 2008: Wouter
+	- Jelte fixed bugs in my absence
+	  - bug 178: fixed unportable shell usage in configure (relied on 
+	    bash shell).
+	  - bug 180: fixed buffer overflow in unbound-checkconf use of strncat.
+	  - bug 181: fixed buffer overflow in ldns (called by unbound to parse
+	    config file parts).
+	- fixes by Wouter
+	  - bug 177: fixed compilation failure on opensuse, the 
+	    --disable-static configure flag caused problems.  (Patch from 
+	    Klaus Singvogel)
+	  - bug 179: same fix as 177.
+	  - bug 185: --disable-shared not passed along to ldns included with 
+	    unbound. Fixed so that configure parameters are passed to the
+	    subdir configure script.
+	    fixed that ./libtool is used always, you can still override
+	    manually with ./configure libtool=mylibtool or set $libtool in
+	    the environment.
+	- update of the ldns tarball to current ldns svn version (fix 181).
+	- bug 184: -r option for unbound-host, read resolv.conf for 
+	  forwarder. (Note that forwarder must support DNSSEC for validation
+	  to succeed).
+
+23 May 2008: Wouter
+	- mingw32 porting.
+	  - test for sys/wait.h
+	  - WSAEWOULDBLOCK test after nonblocking TCP connect.
+	  - write_iov_buffer removed: unused and no struct iov on windows.
+	  - signed/unsigned warning fixup mini_event.
+	  - use ioctlsocket to set nonblocking I/O if fnctl is unavailable.
+	  - skip signals that are not defined
+	  - detect pwd.h.
+	  - detect getpwnam, getrlimit, setsid, sbrk, chroot.
+	  - default config has no chroot if chroot() unavailable.
+	  - if no kill() then no pidfile is read or written.
+	  - gmtime_r is replaced by nonthreadsafe alternative if unavail.
+	    used in rrsig time validation errors.
+
+22 May 2008: Wouter
+	- contrib unbound.spec from Patrick Vande Walle.
+	- fixup bug#175: call tzset before chroot to have correct timestamps
+	  in system log.
+	- do not generate lex input and lex unput functions.
+	- mingw port. replacement functions labelled _unbound.
+	- fix bug 174 - check for tcp_sigpipe that ldns-testns is installed.
+
+19 May 2008: Wouter
+	- fedora 9, check in6_pktinfo define in configure.
+	- CREDITS fixup of history.
+	- ignore ldns-1.2.2 if installed, use builtin 1.3.0-pre alternative.
+
+16 May 2008: Wouter
+	- fixup for MacOSX hosts file reading (reported by John Dickinson).
+	- created 1.0.0 svn tag.
+	- trunk version 1.0.1.
+
+14 May 2008: Wouter
+	- accepted patch from Ondrej Sury for library version libtool option.
+	- configure --disable-rpath fixes up libtool for rpath trouble.
+	  Adapted from debian package patch file.
+
+13 May 2008: Wouter
+	- Added root ipv6 addresses to builtin root hints.
+	- TODO modified for post 1.0 plans.
+	- trunk version set to 1.0.0.
+	- no unnecessary linking with librt (only when libevent/libev used).
+
+7 May 2008: Wouter
+	- fixup no-ip4 problem with error callback in outside network.
+
+25 April 2008: Wouter
+	- DESTDIR is honored by the Makefile for rpms.
+	- contrib files unbound.spec and unbound.init, builds working RPM
+	  on FC7 Linux, a chrooted caching resolver, and libunbound.
+	- iana ports update.
+
+24 April 2008: Wouter
+	- chroot checks improved. working directory relative to chroot.
+	  checks if config file path is inside chroot. Documentation on it.
+	- nicer example.conf text.
+	- created 0.11 tag.
+
+23 April 2008: Wouter
+	- parseunbound.pl contrib update from Kai Storbeck for threads.
+	- iana ports update
+
+22 April 2008: Wouter
+	- ignore SIGPIPE.
+	- unit test for SIGPIPE ignore.
+
+21 April 2008: Wouter
+	- FEATURES document.
+	- fixup reread of config file if it was given as a full path
+	  and chroot was used.
+
+16 April 2008: Wouter
+	- requirements doc, updated clean query returns.
+	- parseunbound.pl update from Kai Storbeck.
+	- sunos4 porting changes.
+
+15 April 2008: Wouter
+	- fixup default rc.d pidfile location to /usr/local/etc.
+	- iana ports updated.
+	- copyright updated in ldns-testpkts to keep same as in ldns.
+	- fixup checkconf chroot tests a bit more, chdir must be inside
+	  chroot dir.
+	- documented 'gcc: unrecognized -KPIC option' errors on Solaris.
+	- example.conf values changed to /usr/local/etc/unbound
+	- DSA test work.
+	- DSA signatures: unbound is compatible with both encodings found.
+	  It will detect and convert when necessary.
+
+14 April 2008: Wouter
+	- got update for parseunbound.pl statistics script from Kai Storbeck.
+	- tpkg tests for udp wait list.
+	- documented 0x20 status.
+	- fixup chroot and checkconf, it is much smarter now.
+	- fixup DSA EVP signature decoding. Solution that Jelte found copied.
+	- and check first sig byte for the encoding type.
+
+11 April 2008: Wouter
+	- random port selection out of the configged ports.
+	- fixup threadsafety for libevent-1.4.3+ (event_base_get_method).
+	- removed base_port.
+	- created 256-port ephemeral space for the OS, 59802 available.
+	- fixup consistency of port_if out array during heavy use.
+
+10 April 2008: Wouter
+	- --with-libevent works with latest libevent 1.4.99-trunk.
+	- added log file statistics perl script to contrib.
+	- automatic iana ports update from makefile. 60058 available.
+
+9 April 2008: Wouter
+	- configure can detect libev(from its build directory) when passed
+	  --with-libevent=/home/wouter/libev-3.2
+	  libev-3.2 is a little faster than libevent-1.4.3-stable (about 5%).
+	- unused commpoints not listed in epoll list.
+	- statistics-cumulative option so that the values are not reset.
+	- config creates array of available ports, 61841 available,
+	  it excludes <1024 and iana assigned numbers.
+	  config statements to modify the available port numbers.
+
+8 April 2008: Wouter
+	- unbound tries to set the ulimit fds when started as server.
+	  if that does not work, it will scale back its requirements.
+
+27 March 2008: Wouter
+	- documented /dev/random symlink from chrootdir as FAQ entry.
+
+26 March 2008: Wouter
+	- implemented AD bit signaling. If a query sets AD bit (but not DO)
+	  then the AD bit is set in the reply if the answer validated.
+	  Without including DNSSEC signatures. Useful if you have a trusted
+	  path from the client to the resolver. Follows dnssec-updates draft.
+
+25 March 2008: Wouter
+	- implemented check that for NXDOMAIN and NOERROR answers a query
+	  section must be present in the reply (by the scrubber). And it must
+	  be equal to the question sent, at least lowercase folded.
+	  Previously this feature happened because the cache code refused
+	  to store such messages. However blocking by the scrubber makes 
+	  sure nothing gets into the RRset cache. Also, this looks like a
+	  timeout (instead of an allocation failure) and this retries are
+	  done (which is useful in a spoofing situation).
+	- RTT banding. Band size 400 msec, this makes band around zero (fast)
+	  include unknown servers. This makes unbound explore unknown servers.
+
+7 March 2008: Wouter
+	- -C config feature for harvest program. 
+	- harvest handles CNAMEs too.
+
+5 March 2008: Wouter
+	- patch from Hugo Koji Kobayashi for iterator logs spelling.
+
+4 March 2008: Wouter
+	- From report by Jinmei Tatuya, rfc2181 trust value for remainder
+	  of a cname trust chain is lower; not full answer_AA. 
+	- test for this fix.
+	- default config file location is /usr/local/etc/unbound.
+	  Thus prefix is used to determine the location. This is also the
+	  chroot and pidfile default location.
+
+3 March 2008: Wouter
+	- Create 0.10 svn tag.
+	- 0.11 version in trunk.
+	- indentation nicer.
+
+29 February 2008: Wouter
+	- documentation update.
+	- fixup port to Solaris of perf test tool.
+	- updated ldns-tarball with decl-after-statement fixes.
+
+28 February 2008: Wouter
+	- fixed memory leaks in libunbound (during cancellation and wait).
+	- libunbound returns the answer packet in full.
+	- snprintf compat update.
+	- harvest performs lookup.
+	- ldns-tarball update with fix for ldns_dname_label.
+	- installs to sbin by default.
+	- install all manual pages (unbound-host and libunbound too).
+
+27 February 2008: Wouter
+	- option to use caps for id randomness.
+	- config file option use-caps-for-id: yes
+	- harvest debug tool
+
+26 February 2008: Wouter
+	- delay utility delays TCP as well. If the server that is forwarded 
+	  to has a TCP error, the delay utility closes the connection.
+	- delay does REUSE_ADDR, and can handle a server that closes its end.
+	- answers use casing from query.
+
+25 February 2008: Wouter
+	- delay utility works. Gets decent thoughput too (>20000).
+
+22 February 2008: Wouter
+	- +2% for recursions, if identical queries (except for destination
+	  and query ID) in the reply list, avoid re-encoding the answer.
+	- removed TODO items for optimizations that do not show up in
+	  profile reports.
+	- default is now minievent - not libevent. As its faster and
+	  not needed for regular installs, only for very large port ranges.
+	- loop check different speedup pkt-dname-reading, 1% faster for
+	  nocache-recursion check.
+	- less hashing during msg parse, 4% for recursion.
+	- small speed fix for dname_count_size_labels, +1 or +2% recursion.
+	- some speed results noted:
+	  optimization resulted in +40% for recursion (cache miss) and
+	  +70 to +80 for cache hits, and +96% for version.bind.
+	  zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4
+	  www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3
+	  www with DO bit set : BIND 8269.31 Ub 28735.6 qps.
+	  So, unbound can be about equal qps to NSD in cache hits.
+	  And about 3.4x faster than BIND in cache performance.
+	- delay utility for testing.
+
+21 February 2008: Wouter
+	- speedup of root-delegation message encoding by 15%.
+	- minor speedup of compress tree_lookup, maybe 1%.
+	- speedup of dname_lab_cmp and memlowercmp - the top functions in 
+	  profiler output, maybe a couple percent when it matters.
+
+20 February 2008: Wouter
+	- setup speec_cache for need-ldns-testns in dotests.
+	- check number of queued replies on incoming queries to avoid overload
+	  on that account.
+	- fptr whitelist checks are not disabled in optimize mode.
+	- do-daemonize config file option.
+	- minievent time share initializes time at start.
+	- updated testdata for nsec3 new algorithm numbers (6, 7).
+	- small performance test of packet encoding (root delegation).
+
+19 February 2008: Wouter
+	- applied patch to unbound-host man page from Jan-Piet Mens.
+	- fix donotquery-localhost: yes default (it erroneously was switched
+	  to default 'no').
+	- time is only gotten once and the value is shared across unbound.
+	- unittest cleans up crypto, so that it has no memory leaks.
+	- mini_event shares the time value with unbound this results in 
+	  +3% speed for cache responses and +9% for recursions.
+	- ldns tarball update with new NSEC3 sign code numbers.
+	- perform several reads per UDP operation. This improves performance
+	  in DoS conditions, and costs very little in normal conditions.
+	  improves cache response +50%, and recursions +10%.
+	- modified asynclook test. because the callback from async is not
+	  in any sort of lock (and thus can use all library functions freely),
+	  this causes a tiny race condition window when the last lock is 
+	  released for a callback and a new cancel() for that callback.
+	  The only way to remove this is by putting callbacks into some 
+	  lock window. I'd rather have the small possibility of a callback
+	  for a cancelled function then no use of library functions in 
+	  callbacks. Could be possible to only outlaw process(), wait(),
+	  cancel() from callbacks, by adding another lock, but I'd rather not.
+
+18 February 2008: Wouter
+	- patch to unbound-host from Jan-Piet Mens.
+	- unbound host prints errors if fails to configure context.
+	- fixup perf to resend faster, so that long waiting requests do
+	  not hold up the queue, they become lost packets or SERVFAILs,
+	  or can be sent a little while later (i.e. processing time may 
+	  take long, but throughput has to be high).
+	- fixup iterator operating in no cache conditions (RD flag unset
+	  after a CNAME).
+	- streamlined code for RD flag setting.
+	- profiled code and changed dname compares to be faster. 
+	  The speedup is about +3% to +8% (depending on the test).
+	- minievent tests for eintr and eagain.
+
+15 February 2008: Wouter
+	- added FreeBSD rc.d script to contrib.
+	- --prefix option for configure also changes directory: pidfile:
+	  and chroot: defaults in config file.
+	- added cache speed test, for cache size OK and cache too small.
+
+14 February 2008: Wouter
+	- start without a config file (will complain, but start with
+	  defaults).
+	- perf test program works.
+
+13 February 2008: Wouter
+	- 0.9 released.
+	- 1.0 development. Printout ldns version on unbound -h.
+	- start of perf tool.
+	- bugfix to read empty lines from /etc/hosts.
+
+12 February 2008: Wouter
+	- fixup problem with configure calling itself if ldns-src tarball
+	  is not present.
+
+11 February 2008: Wouter
+	- changed library to use ub_ instead of ub_val_ as prefix.
+	- statistics output text nice.
+	- etc/hosts handling.
+	- library function to put logging to a stream.
+	- set any option interface.
+
+8 February 2008: Wouter
+	- test program for multiple queries over a TCP channel.
+	- tpkg test for stream tcp queries.
+	- unbound replies to multiple TCP queries on a TCP channel.
+	- fixup misclassification of root referral with NS in answer
+	  when validating a nonrec query.
+	- tag 0.9
+	- layout of manpages, spelling fix in header, manpages process by
+	  makedist, list asynclook and tcpstream tests as ldns-testns
+	  required.
+
+7 February 2008: Wouter
+	- moved up all current level 2 to be level 3. And 3 to 4.
+	  to make room for new debug level 2 for detailed information 
+	  for operators.
+	- verbosity level 2. Describes recursion and validation.
+	- cleaner configure script and fixes for libevent solaris.
+	- signedness for log output memory sizes in high verbosity.
+
+6 February 2008: Wouter
+	- clearer explanation of threading configure options.
+	- fixup asynclook test for nothreading (it creates only one process
+	  to do the extended test).
+	- changed name of ub_val_result_free to ub_val_resolve_free.
+	- removes warning message during library linking, renamed
+	  libunbound/unbound.c -> libunbound.c and worker to libworker.
+	- fallback without EDNS if result is NOTIMPL as well as on FORMERR.
+
+5 February 2008: Wouter
+	- statistics-interval: seconds option added.
+	- test for statistics option
+	- ignore errors making directories, these can occur in parallel builds
+	- fixup Makefile strip command and libunbound docs typo.
+
+31 January 2008: Wouter
+	- bg thread/process reads and writes the pipe nonblocking all the time
+	  so that even if the pipe is buffered or so, the bg thread does not
+	  block, and services both pipes and queries.
+
+30 January 2008: Wouter
+	- check trailing / on chrootdir in checkconf.
+	- check if root hints and anchor files are in chrootdir.
+	- no route to host tcp error is verbosity level 2. 
+	- removed unused send_reply_iov. and its configure check.
+	- added prints of 'remote address is 1.2.3.4 port 53' to errors
+	  from netevent; the basic socket errors.
+
+28 January 2008: Wouter
+	- fixup uninit use of buffer by libunbound (query id, flags) for
+	  local_zone answers.
+	- fixup uninit warning from random.c; also seems to fix sporadic
+	  sigFPE coming out of openssl.
+	- made openssl entropy warning more silent for library use. Needs
+	  verbosity 1 now.
+	- fixup forgotten locks for rbtree_searches on ctx->query tree.
+	- random generator cleanup - RND_STATE_SIZE removed, and instead
+	  a super-rnd can be passed at init to chain init random states.
+	- test also does lock checks if available.
+	- protect config access in libworker_setup().
+	- libevent doesn't like comm_base_exit outside of runloop.
+	- close fds after removing commpoints only (for epoll, kqueue).
+
+25 January 2008: Wouter
+	- added tpkg for asynclook and library use. 
+	- allows localhost to be queried when as a library.
+	- fixup race condition between cancel and answer (in case of
+	  really fast answers that beat the cancel).
+	- please doxygen, put doxygen comment in one place.
+	- asynclook -b blocking mode and test.
+	- refactor asynclook, nicer code.
+	- fixup race problems from opensll in rand init from library, with
+	  a mutex around the rand init.
+	- fix pass async_id=NULL to _async resolve().
+	- rewrote _wait() routine, so that it is threadsafe.
+	- cancelation is threadsafe.
+	- asynclook extended test in tpkg.
+	- fixed two races where forked bg process waits for (somehow shared?)
+	  locks, so does not service the query pipe on the bg side.
+	  Now those locks are only held for fg_threads and for bg_as_a_thread.
+
+24 January 2008: Wouter
+	- tested the cancel() function.
+	- asynclook -c (cancel) feature.
+	- fix fail to allocate context actions.
+	- make pipe nonblocking at start.
+	- update plane for retry mode with caution to limit bandwidth.
+	- fix Makefile for concurrent make of unbound-host.
+	- renamed ub_val_ctx_wait/poll/process/fd to ub_val*.
+	- new calls to set forwarding added to header and docs.
+
+23 January 2008: Wouter
+	- removed debug prints from if-auto, verb-algo enables some.
+	- libunbound QUIT setup, remove memory leaks, when using threads
+	  will share memory for passing results instead of writing it over
+	  the pipe, only writes ID number over the pipe (towards the handler
+	  thread that does process() ).
+
+22 January 2008: Wouter
+	- library code for async in libunbound/unbound.c.
+	- fix link testbound.
+	- fixup exit bug in mini_event.
+	- background worker query enter and result functions.
+	- bg query test application asynclook, it looks up multiple
+	  hostaddresses (A records) at the same time.
+
+21 January 2008: Wouter
+	- libworker work, netevent raw commpoints, write_msg, serialize.
+
+18 January 2008: Wouter
+	- touch up of manpage for libunbound.
+	- support for IP_RECVDSTADDR (for *BSD ip4).
+	- fix for BSD, do not use ip4to6 mapping, make two sockets, once
+	  ip6 and once ip4, uses socket options.
+	- goodbye ip4to6 mapping.
+	- update ldns-testpkts with latest version from ldns-trunk.
+	- updated makedist for relative ldns pathnames.
+	- library API with more information inside the result structure.
+	- work on background resolves.
+
+17 January 2008: Wouter
+	- fixup configure in case -lldns is installed.
+	- fixup a couple of doxygen warnings, about enum variables.
+	- interface-automatic now copies the interface address from the
+	  PKT_INFO structure as well.
+	- manual page with library API, all on one page 'man libunbound'.
+	- rewrite of PKTINFO structure, it also captures IP4 PKTINFO.
+
+16 January 2008: Wouter
+	- incoming queries to the server with TC bit on are replied FORMERR.
+	- interface-automatic replied the wrong source address on localhost
+	  queries. Seems to be due to ifnum=0 in recvmsg PKTINFO. Trying
+	  to use ifnum=-1 to mean 'no interface, use kernel route'.
+
+15 January 2008: Wouter
+	- interface-automatic feature. experimental. Nice for anycast.
+	- tpkg test for ip6 ancillary data.
+	- removed debug prints.
+	- porting experience, define for Solaris, test refined for BSD
+	  compatibility. The feature probably will not work on OpenBSD.
+	- makedist fixup for ldns-src in build-dir.
+
+14 January 2008: Wouter
+	- in no debug sets NDEBUG to remove asserts.
+	- configure --enable-debug is needed for dependency generation
+	  for assertions and for compiler warnings.
+	- ldns.tgz updated with ldns-trunk (where buffer.h is updated).
+	- fix lint, unit test in optimize mode.
+	- default access control allows ::ffff:127.0.0.1 v6mapped localhost.
+	
+11 January 2008: Wouter
+	- man page, warning removed.
+	- added text describing the use of stub zones for private zones.
+	- checkconf tests for bad hostnames (IP address), and for doubled
+	  interface lines.
+	- memory sizes can be given with 'k', 'Kb', or M or G appended.
+
+10 January 2008: Wouter
+	- typo in example.conf.
+	- made using ldns-src that is included the package more portable
+	  by linking with .lo instead of .o files in the ldns package.
+	- nicer do-ip6: yes/no documentation.
+	- nicer linking of libevent .o files.
+	- man pages render correctly on solaris.
+
+9 January 2008: Wouter
+	- fixup openssl RAND problem, when the system is not configured to
+	  give entropy, and the rng needs to be seeded.
+
+8 January 2008: Wouter
+	- print median and quartiles with extensive logging.
+
+4 January 2008: Wouter
+	- document misconfiguration in private network.
+
+2 January 2008: Wouter
+	- fixup typo in requirements.
+	- document that 'refused' is a better choice than 'drop' for 
+	  the access control list, as refused will stop retries.
+
+7 December 2007: Wouter
+	- unbound-host has a -d option to show what happens. This can help
+	  with debugging (why do I get this answer).
+	- fixup CNAME handling, on nodata, sets and display canonname.
+	- dot removed from CNAME display.
+	- respect -v for NXDOMAINs.
+	- updated ldns-src.tar.gz with ldns-trunk today (1.2.2 fixes).
+	- size_t to int for portability of the header file.
+	- fixup bogus handling.
+	- dependencies and lint for unbound-host.
+
+6 December 2007: Wouter
+	- library resolution works in foreground mode, unbound-host app
+	  receives data.
+	- unbound-host prints rdata using ldns.
+	- unbound-host accepts trust anchors, and prints validation
+	  information when you give -v.
+
+5 December 2007: Wouter
+	- locking in context_new() inside the function.
+	- setup of libworker.
+
+4 December 2007: Wouter
+	- minor Makefile fixup.
+	- moved module-stack code out of daemon/daemon into services/modstack,
+	  preparing for code-reuse.
+	- move context into own header file.
+	- context query structure.
+	- removed unused variable pwd from checkconf.
+	- removed unused assignment from outside netw.
+	- check timeval length of string.
+	- fixup error in val_utils getsigner.
+	- fixup same (*var) error in netblocktostr.
+	- fixup memleak on parse error in localzone.
+	- fixup memleak on packet parse error.
+	- put ; after union in parser.y.
+	- small hardening in iter_operate against iq==NULL.
+	- hardening, if error reply with rcode=0 (noerror) send servfail.
+	- fixup same (*var) error in find_rrset in msgparse, was harmless.
+	- check return value of evtimer_add().
+	- fixup lockorder in lruhash_reclaim(), building up a list of locked
+	  entries one at a time. Instead they are removed and unlocked.
+	- fptr_wlist for markdelfunc.
+	- removed is_locked param from lruhash delkeyfunc.
+	- moved bin_unlock during bin_split purely to please.
+
+3 December 2007: Wouter
+	- changed checkconf/ to smallapp/ to make room for more support tools.
+	  (such as unbound-host).
+	- install dirs created with -m 755 because they need to be accessible.
+	- library extensive featurelist added to TODO.
+	- please doxygen, lint.
+	- library test application, with basic functionality.
+	- fix for building in a subdirectory. 
+	- link lib fix for Leopard.
+
+30 November 2007: Wouter
+	- makefile that creates libunbound.la, basic file or libunbound.a
+	  when creating static executables (no libtool).
+	- more API setup.
+
+29 November 2007: Wouter
+	- 0.9 public API start.
+
 28 November 2007: Wouter
 	- Changeup plan for 0.8 - no complication needed, a simple solution
 	  has been chosen for authoritative features.
@@ -18,6 +710,7 @@
 	  have a SOA record in authority, so this is OK for the validator),
 	  and NS record is needed to be a referral.
 	- duplicate checking when adding NSECs for a CNAME, and test.
+	- created svn tag 0.8, after completing testbed tests.
 
 27 November 2007: Wouter
 	- per suggestion in rfc2308, replaced default max-ttl value with 1 day.

doc/FEATURES

@@ -0,0 +1,91 @@
+Unbound Features
+
+(C) Copyright 2008, Wouter Wijngaards, NLnet Labs.
+
+
+This document describes the features and RFCs that unbound 
+adheres to, and which ones are decided to be out of scope.
+
+
+Big Features
+------------
+Recursive service.
+Caching service.
+Forwarding and stub zones.
+No authoritative service.
+DNSSEC Validation options.
+EDNS0, NSEC3, Unknown-RR-types.
+
+
+Details
+-------
+Processing support
+RFC 1034-1035: as a recursive, caching server. Not authoritative.
+  including CNAMEs, referrals, wildcards, classes, ...
+RFC 4033-4035: as a validating caching server (unbound daemon). 
+  as a validating stub (libunbound).
+RFC 1918.
+RFC 2181: completely, including the trust model, keeping rrsets together.
+RFC 2672: DNAME support.
+RFC 3597: Unknown RR type support.
+RFC 2671: EDNS0 support, default advertisement 4Kb size. 
+RFC 5155: NSEC3, NSEC3PARAM types
+AAAA type. and IP6 dual stack support.
+type ANY queries are supported.
+RFC 2308: TTL directive, and the rest of the RFC too.
+RFC 4592: wildcards.
+
+RFC 1995, 1996, 2136: not authoritative, so no AXFR, IXFR, NOTIFY or
+  dynamic update services are appropriate.
+
+chroot and drop-root-privileges support, default enabled in config file.
+
+AD bit in query can be used to request AD bit in response (w/o using DO bit).
+CD bit in query can be used to request bogus data.
+UDP and TCP service is provided downstream.
+UDP and TCP are used to request from upstream servers.
+Multiple queries can be made over a TCP stream.
+
+No TSIG support at this time.
+No SIG0 support at this time.
+No dTLS support at this time.
+This is not a DNS statistics package, but some operationally useful
+values are provided.
+TXT RRs from the Chaos class (id.server, hostname.bind, ...) supported.
+
+draft-forgery-resilience: all recommendations followed.
+draft-0x20: experimental implementation (incomplete).
+  implements bitwise echo of the query to support downstream 0x20.
+draft-ietf-dnsop-default-local-zones is fully supported (-04).
+  It is possible to block zones or return an address for localhost.
+  This is a very limited authoritative service. Defaults as in draft.
+draft-ietf-dnsop-resolver-priming(-00): can prime and can fallback to 
+  a safety belt list.
+draft-ietf-dnsop-dnssec-trust-anchor(-01): DS records can be configured 
+  as trust anchors. Also DNSKEYs are allowed, by the way.
+draft-ietf-dnsop-reflectors-are-evil: access control list for recursive
+  service. In fact for all DNS service so cache snooping is halted.
+
+Record type syntax support, extensive, from lib ldns.
+For these types only syntax and parsing support is needed.
+RFC 1034-1035: basic RR types.
+RFC 1183: RP, AFSDB, X25, ISDN, RT
+RFC 1706: NSAP
+RFC 2535: KEY, SIG, NXT: treated as unknown data, syntax is parsed (obsolete).
+2163: PX
+AAAA type
+1876: LOC type
+2782: SRV type
+2915: NAPTR type.
+2230: KX type.
+2538: CERT type.
+2672: DNAME type.
+OPT type
+3123: APL
+SSHFP type
+4025: IPSECKEY
+4033-4035: DS, RRSIG, NSEC, DNSKEY
+4701: DHCID
+5155: NSEC3, NSEC3PARAM
+4408: SPF
+

doc/README

@@ -4,18 +4,16 @@ http://unbound.net
 
 This software is under BSD license, see LICENSE for details.
 
-* Download the latest version of this software from 
+* Download the latest release version of this software from 
   	http://unbound.net 
   or get a beta version from the svn repository at 
   	http://unbound.net/svn/
 
 * Uses the following libraries; 
   * ldns	http://www.nlnetlabs.nl/ldns/			(BSD license)
+    (required) can use tarball from source directory.
   * libevent	http://www.monkey.org/~provos/libevent/		(BSD license)
-
-* Create build environment 
-  * run libtoolize -c if config.sub is missing, or run glibtoolize.
-  * autoreconf (autoheader && autoconf), if ./configure is missing.
+    (optional) can use builtin alternative instead.
 
 * Make and install: ./configure; make; make install
   * Use GNU make; default on linux, often called 'gmake' on BSD and Solaris.
@@ -25,13 +23,15 @@ This software is under BSD license, see LICENSE for details.
 	If detected on the system, it will dynamically link against it.
   * --with-libevent=/path/to/libevent
   	Can be set to either the system install or the build directory.
-	--with-libevent=no gives a builtin alternative implementation.
-	libevent is useful when having many (thousands) of outgoing ports.
-	This improves randomization and spoof resistance. For the default 
-	of 16 ports the builtin alternative works well.
+	--with-libevent=no (default) gives a builtin alternative 
+	implementation. libevent is useful when having many (thousands) 
+	of outgoing ports. This improves randomization and spoof 
+	resistance. For the default of 16 ports the builtin alternative 
+	works well and is a little faster.
   * --without-pthreads 
-	This disables pthreads, and uses Solaris thr library or no threading. 
-	Without this option the pthreads library is detected automatically.
+	This disables pthreads. Without this option the pthreads library 
+	is detected automatically. Use this option to disable threading
+	altogether, or, on Solaris, also use --with(out)-solaris-threads.
   * --enable-static-exe
 	This enables a debug option to statically link, against ldns and 
 	libevent libraries.
@@ -43,6 +43,21 @@ This software is under BSD license, see LICENSE for details.
 	The server periodically checks if the amount of memory used fits with
 	the amount of memory it thinks it should be using, and reports 
 	memory usage in detail.
+  * --with-conf-file=filename
+  	Set default location of config file, 
+	the default is /usr/local/etc/unbound/unbound.conf.
+  * --with-pidfile=filename
+  	Set default location of pidfile,
+	the default is /usr/local/etc/unbound/unbound.pid.
+  * --with-run-dir=path
+  	Set default working directory,
+	the default is /usr/local/etc/unbound.
+  * --with-chroot-dir=path
+  	Set default chroot directory,
+	the default is /usr/local/etc/unbound.
+  * --with-username=user
+  	Set default user name to change to,
+	the default is the "unbound" user.
 
 * 'make test' attempts to run a series of tests, depending on the support
   programs that are installed.
@@ -53,9 +68,29 @@ o If libevent is older (before 1.3c), unbound will exit instead of reload
   on sighup. On a restart 'did not exit gracefully last time' warning is 
   printed. Perform ./configure --with-libevent=no or update libevent, rerun 
   configure and recompile unbound to make sighup work correctly.
+  It is strongly suggested to use the latest version of libevent (1.4 or more)
+  on Solaris, because of fixes in the solaris event port code in libevent.
+o If you receive no answers deploying unbound on a private network.
+  Check that the zone you configure as a stub zone is correct, listing working 
+  ip-addresses. Check that the NS data in the zone, those hostnames, are
+  in fact those same, working, ip-addresses. Unbound will fetch the NS data
+  from the zone and use that information in preference to the config 
+  information. 
+o If you are not receiving the correct source IP address on replies (e.g.
+  you are running a multihomed, anycast server), the interface-automatic
+  option can be enabled to set socket options to achieve the correct
+  source IP address on UDP replies. Listing all IP addresses explicitly in
+  the config file is an alternative. The interface-automatic option uses
+  non portable socket options, Linux and FreeBSD should work fine.
+o The warning 'openssl has no entropy, seeding with time', with chroot 
+  enabled, may be solved with a symbolic link to /dev/random from <chrootdir>.
+o On Solaris 5.10 some libtool packages from repositories do not work with
+  gcc, showing errors gcc: unrecognized option `-KPIC'
+  To solve this do ./configure libtool=./libtool [your options...].
 
 Acknowledgements
 ----------------
+o Unbound was written in portable C by Wouter Wijngaards (NLnet Labs).
 o Thanks to David Blacka and Matt Larson (Verisign) for the unbound-java
   prototype. Design and code from that prototype has been used to create
   this program. Such as the iterator state machine and the cache design.

doc/README.svn

@@ -1,11 +1,13 @@
 README.svn
 
 For a svn checkout
-* Create build environment - see README.
-  * possibly copy aclocal.m4 from your autoconf/libtool setup.
+* configure script, aclocal.m4, as well as yacc/lex output files are
+  committed to the repository.
+* use --enable-debug flag for configure to enable dependency tracking and
+  assertions, otherwise, use make clean; make after svn update.
 
 * Note changes in the Changelog.
-* Every checking a postcommit hook is run
+* Every check-in a postcommit hook is run
 	(the postcommit hook is in the svn/unbound/hooks directory).
 	* generates commit email with your changes and comment.
 	* compiles and runs the tests (with testcode/do-tests.sh).

doc/README.tests

@@ -3,7 +3,18 @@ README unbound tests
 There is a test setup for unbound. Use
 	make test
 To make and run the tests. The results are summarized at the end.
-You can also run ./unittest by hand, if the system lacks other debug tools.
+
+You need to have the following programs installed and in your PATH.
+* dig - from the bind-tools package. Used to send DNS queries.
+* splint (optional) - for lint test
+* doxygen (optional) - for doc completeness test
+* ldns-testns (optional) - from ldns examples. Used as DNS auth server.
+* xxd and nc (optional) - for (malformed) packet transmission.
+The optional programs are detected and can be omitted.
+
+Without any support programs, unittest and testbound can still be used.
+	(cd testdata; ../testcode/mini_tpkg.sh exe 02-unittest.tpkg)
+	(cd testdata; ../testcode/mini_tpkg.sh exe 03-testbound.tpkg)
 
 testdata/ contains the data for tests. 
 testcode/ contains scripts and c code for the tests.

doc/TODO

@@ -1,60 +1,78 @@
-TODO items.
-o use real entropy to make random (ID, port) numbers more random.
-o in production mode, do not free memory on exit. In debug mode, test leaks.
-o profile memory allocation, and if performance issues, use special memory
-  allocator. For example, with caches per thread.
-o #define BIT_... different on bigendian and smallendian systems so that
-  the htons on flags is not needed to send a message from the cache.
-o speed up pkt domain name decompression loop detection using counter perhaps.
-o detect OS/400 pthreads implementation that allows upgrading to writelock
-  on pthreads rwlocks and use it to examine-rd before storing-wr rrset cache.
+TODO items. These are interesting todo items.
 o understand synthesized DNAMEs, so those TTL=0 packets are cached properly.
-o understand NSEC/NSEC3, aggressive negative caching, so that updates to
-  NSEC/NSEC3 will result in proper negative responses.
-o fallback without EDNS if result is NOTIMPL, now only on FORMERR like in java.
-o scrubber has slow pkt_subdomain and pkt_strict_subdomain functions.
+o NSEC/NSEC3 aggressive negative caching, so that updates to NSEC/NSEC3 
+  will result in proper negative responses.
 o get serverselection algorithm out of local optimum.
   make subtargets to get rtt info for a couple of targets, like fetch-policy.
   or send out multiple queries to multiple servers.
-o donotqueryaddresses allow specification of subnets, use trie to store.
-  extend default list to contain illegal ip4 and ip6 addresses.
-o memory profile; and if needed put serviced queries under qstate->region
-  and special purpose region code, reuse blocks, shrink if too big.
-o check query, option to enforce presence of qdsection in noerror answers.
-o configuration option where port 53 is used for send and receive, no other
-  ports are used.
+o (option) where port 53 is used for send and receive, no other ports are used.
 o (option) to not send replies to clients after a timeout of (say 5 secs) has
   passed, but keep task active for later retries by client.
-o private TTL feature
-o pretend-dnssec-unaware, and pretend-edns-unaware modes for debug/workshops.
+o (option) private TTL feature (always report TTL x in answers).
+o (option) pretend-dnssec-unaware, and pretend-edns-unaware modes for workshops.
 o delegpt use rbtree for ns-list, to avoid slowdown for very large NS sets.
-o be able to have different listen and query-to addresses to bind to,
-  so you can listen to localhost and query-to to the internet.
-o reprime and refresh oft used data before timeout.
-o retain prime results in a overlaid roothints file.
-o store primed key data in a overlaid keyhints file (sort of like drafttimers).
+o (option) reprime and refresh oft used data before timeout.
+o (option) retain prime results in a overlaid roothints file.
+o (option) store primed key data in a overlaid keyhints file (sort of like drafttimers).
 o windows version, auto update feature, a query to check for the version.
-o autoreport of problems
-o logrotation, syslog
 o command the server with TSIG inband. get-config, clearcache, 
 	get stats, get memstats, get ..., reload, clear one zone from cache
-o watch for spoof nearmisses.
-o improve compression of DNS packets by first puttig uncompressible rrs, then
-  compress to their rdata.
-o if one server is not responsive do not spend 75 secs on that server, but
-  try other servers with lower rtt.
+o watch for spoof nearmisses. Keep counter of nearmisses and print that
+  in the stats lines, operator can determine what level is a redalert.
 o NSID rfc 5001 support.
 o timers rfc 5011 support.
 o Treat YXDOMAIN from a DNAME properly, in iterator (not throwaway), validator.
-o grab ports nonconsequtive and change the set after a while (change within
-  a given range). Could be bad for OS if wrong port. unsure if it helps secure.
 o make timeout backoffs randomized (a couple percent random) to spread traffic.
 o inspect date on executable, then warn user in log if its more than 1 year.
-o proactively prime root, stubs and trust anchors, feature.
+o (option) proactively prime root, stubs and trust anchors, feature.
   early failure, faster on first query, but more traffic.
-o use privilege separation, to change privilege options during reload securely
-  not needed.
-o check if for PowerDNS(2.9.21) CNAME in Answer section & rcode=NXDOMAIN needs
-  to be fixed up to be rcode=NOERROR?
 o On Windows use CryptGenRandom() to get random seed for arc4random.
-o Think about intermediate firewalls dropping EDNS UDP & handling that.
+o library add convenience functions for A, AAAA, PTR, getaddrinfo, libresolve.
+o library add function to validate input from app that is signed.
+o add dynamic-update requests (making a dynupd request) to libunbound api.
+o in an ipv6 connected only environment unbound cannot use outgoing IP6 
+  to send to ip4to6 mapped hosts, need ip4to6map of NS and disable 
+  V6ONLY socket option.
+o SIG(0) and TSIG.
+o support OPT record placement on recv anywhere in the additional section. 
+o add local-file: config with authority features.
+o (option) to make local-data answers be secure for libunbound (default=no)
+o (option) to make chroot: copy all needed files into jail (or make jail)
+	perhaps also print reminder to link /dev/random and sysloghack.
+o (option) for extended statistics. If enabled (not by default) collect print
+	rcode, uptime, spoofnearmisses, cache size, qtype, 
+	bits(RD, CD, DO, EDNS-present, AD)query, (Secure, Bogus)reply.
+	perhaps also see which slow auth servers cause >1sec values.
+	stats-file possible with key: value or key=value lines in it.
+	stats on SIGUSR1. addup stats over threads.
+o overhaul outside-network servicedquery to merge with udpwait and tcpwait,
+  to make timers in servicedquery independent of udpwait queues.
+o 0x20 fallback so it can be enabled without trouble.
+o check into rebinding ports for efficiency, configure time test.
+o DLV is considered.
+o EVP hardware crypto support.
+
+Features soon after 1.0.
+o EDNS fallback after timeout (firewall drops all edns traffic problem).
+o IPv6 reverse, IP4 reverse local-data shorthand for PTR records (?).
+  cumbersome to reverse notate by hand for the operator.
+o zone name appending for local-data. Perhaps read zonefiles. Perhaps it is
+  too much authority feature creep.
+o option to disable cache snooping from the clients (the nonRD queries),
+  with allow, refused, drop choices.
+
+For 1.x; features that have been requested during the beta test.
+o command channel for couple of tasks. Like rndc.
+  o see delegation; what servers would be used to get data for a name.
+  o force stats display; easier than parsing logfiles.
+    stats display added over threads, displayed in rddtool easy format.
+  o flush names or domains (all under a name) from the cache. Include NSes.
+    And the A, AAAA for its NSes.
+  o add/del static preload data to change the domain redirections.
+  o and maybe also start, stop, reload.
+
+
+o on windows version, libunbound uses a NamedPipe, examine security status
+  make sure the OS makes it safe like on unix.
+o on windows version, implement that OS ancillary data capabilities for
+  interface-automatic. IPPKTINFO, IP6PKTINFO for WSARecvMsg, WSASendMsg.

doc/example.conf.in

@@ -15,6 +15,13 @@ server:
 	# verbosity number, 0 is least verbose. 1 is default.
 	verbosity: 1
 
+	# print statistics to the log (for every thread) every N seconds.
+	# Set to "" or 0 to disable. Default is disabled.
+	# statistics-interval: 0
+	
+	# enable cumulative statistics, without clearing them after printing.
+	# statistics-cumulative: no
+
 	# number of threads to create. 1 disables threading.
 	# num-threads: 1
 
@@ -26,6 +33,10 @@ server:
 	# interface: 192.0.2.153
 	# interface: 192.0.2.154
 	# interface: 2001:DB8::5
+	
+	# enable this feature to copy the source address of queries to reply.
+	# Socket options not be supported on all platforms. experimental. 
+	# interface-automatic: no
 
 	# port to answer queries from
 	# port: 53
@@ -37,16 +48,20 @@ server:
 	# outgoing-interface: 2001:DB8::5
 	# outgoing-interface: 2001:DB8::6
 
-	# unbound needs to send packets to authoritative nameservers.
-	# it uses a range of ports for that.
-	# the start number of the port range
-	# outgoing-port: 1053
+	# number of ports to allocate per thread, determines the size of the
+	# port range that can be open simultaneously. 
+	# outgoing-range: 256
+	
+	# permit unbound to use this port number or port range for
+	# making outgoing queries, using an outgoing interface.
+	# outgoing-port-permit: 32768
 
-	# number of port to allocate per thread, determines the size of the
-	# port range. A larger port range gives more resistance to certain
-	# spoof attacks, as it gets harder to guess which port is used. 
-	# But also takes more system resources (for open sockets).
-	# outgoing-range: 16
+	# deny unbound the use this of port number or port range for
+	# making outgoing queries, using an outgoing interface.
+	# Use this to make sure unbound does not grab a UDP port that some
+	# other server on this computer needs. The default is to avoid
+	# IANA-assigned port numbers.
+	# outgoing-port-avoid: "3200-3208"
 
 	# number of outgoing simultaneous tcp buffers to hold per thread.
 	# outgoing-num-tcp: 10
@@ -59,8 +74,8 @@ server:
 	# msg-buffer-size: 65552
 
 	# the amount of memory to use for the message cache.
-	# in bytes. default is 4 Mb
-	# msg-cache-size: 4194304
+	# plain value in bytes or you can append k, m or G. default is "4Mb". 
+	# msg-cache-size: 4m
 
 	# the number of slabs to use for the message cache.
 	# the number of slabs must be a power of 2.
@@ -71,8 +86,8 @@ server:
 	# num-queries-per-thread: 1024
 
 	# the amount of memory to use for the RRset cache.
-	# in bytes. default is 4 Mb
-	# rrset-cache-size: 4194304
+	# plain value in bytes or you can append k, m or G. default is "4Mb". 
+	# rrset-cache-size: 4m
 
 	# the number of slabs to use for the RRset cache.
 	# the number of slabs must be a power of 2.
@@ -99,7 +114,7 @@ server:
 	# infra-cache-numhosts: 10000
 
 	# the maximum size of the lame zones cached per host. in bytes.
-	# infra-cache-lame-size: 10240
+	# infra-cache-lame-size: 10k
 
 	# Enable IPv4, "yes" or "no".
 	# do-ip4: yes
@@ -113,6 +128,9 @@ server:
 	# Enable TCP, "yes" or "no".
 	# do-tcp: yes
 
+	# Detach from the terminal, run in background, "yes" or "no".
+	# do-daemonize: yes
+
 	# control which clients are allowed to make (recursive) queries
 	# to this server. Specify classless netblocks with /size and action.
 	# By default everything is refused, except for localhost.
@@ -121,20 +139,40 @@ server:
 	# access-control: 127.0.0.0/8 allow
 	# access-control: ::0/0 refuse
 	# access-control: ::1 allow
+	# access-control: ::ffff:127.0.0.1 allow
 	
 	# if given, a chroot(2) is done to the given directory.
 	# i.e. you can chroot to the working directory, for example,
 	# for extra security, but make sure all files are in that directory.
-	# If you give "" no chroot is performed.
-	# chroot: "/etc/unbound"
+	#
+	# If chroot is enabled, you should pass the configfile (from the
+	# commandline) as a full path from the original root. After the
+	# chroot has been performed the now defunct portion of the config 
+	# file path is removed to be able to reread the config after a reload. 
+	#
+	# All other file paths (working dir, pidfile, logfile, roothints,
+	# key files) can be specified in several ways:
+	# 	o as an absolute path relative to the new root.
+	# 	o as a relative path to the working directory.
+	# 	o as an absolute path relative to the original root.
+	# In the last case the path is adjusted to remove the unused portion.
+	#
+	# Additionally, unbound may need to access /dev/random (for entropy)
+	# and to /dev/log (if you use syslog) from inside the chroot.
+	# How to do this is specific to your OS.
+	#
+	# If you give "" no chroot is performed. The path must not end in a /.
+	# chroot: "@UNBOUND_CHROOT_DIR@"
 
 	# if given, user privileges are dropped (after binding port),
 	# and the given username is assumed. Default is user "unbound".
-	# If you give "" no priviliges are dropped.
-	# username: "unbound"
+	# If you give "" no privileges are dropped.
+	# username: "@UNBOUND_USERNAME@"
 
-	# the working directory.
-	# directory: "/etc/unbound"
+	# the working directory. The relative files in this config are 
+	# relative to this directory. If you give "" the working directory
+	# is not changed.
+	# directory: "@UNBOUND_RUN_DIR@"
 
 	# the log file, "" means log to stderr. 
 	# Use of this option sets use-syslog to "no".
@@ -145,7 +183,7 @@ server:
 	# use-syslog: yes 
 
 	# the pid file.
-	# pidfile: "/etc/unbound/unbound.pid"
+	# pidfile: "@UNBOUND_PIDFILE@"
 	
 	# file to read root hints from.
 	# get one from ftp://FTP.INTERNIC.NET/domain/named.cache
@@ -188,6 +226,14 @@ server:
 	# Default on, which insists on dnssec data for trust-anchored zones.
 	# harden-dnssec-stripped: yes
 	
+	# Use 0x20-encoded random bits in the query to foil spoof attempts.
+	# Disabled by default, because some caching forwarders may not
+	# support this (if you have forward-zones). Most authority servers do.
+	# This feature is an experimental implementation of draft dns-0x20.
+	# It is known that some authority servers do not support 0x20, and
+	# resolution will fail for them. A solution is on the TODO list.
+	# use-caps-for-id: no
+	
 	# Do not query the following addresses. No DNS queries are sent there.
 	# List one address per entry. List classless netblocks with /size,
 	# do-not-query-address: 127.0.0.1/8
@@ -247,8 +293,8 @@ server:
 	# val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"
 
 	# the amount of memory to use for the key cache.
-	# in bytes. default is 4 Mb
-	# key-cache-size: 4194304
+	# plain value in bytes or you can append k, m or G. default is "4Mb". 
+	# key-cache-size: 4m
 
 	# the number of slabs to use for the key cache.
 	# the number of slabs must be a power of 2.

doc/libunbound.3.in

@@ -0,0 +1,335 @@
+.TH "libunbound" "3" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" libunbound.3 -- unbound library functions manual
+.\"
+.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+.LP
+.B libunbound,
+.B unbound.h,
+.B ub_ctx,
+.B ub_result,
+.B ub_callback_t,
+.B ub_ctx_create,
+.B ub_ctx_delete,
+.B ub_ctx_set_option,
+.B ub_ctx_config,
+.B ub_ctx_set_fwd,
+.B ub_ctx_resolvconf,
+.B ub_ctx_hosts,
+.B ub_ctx_add_ta,
+.B ub_ctx_add_ta_file,
+.B ub_ctx_trustedkeys,
+.B ub_ctx_debugout,
+.B ub_ctx_debuglevel,
+.B ub_ctx_async,
+.B ub_poll,
+.B ub_wait,
+.B ub_fd,
+.B ub_process,
+.B ub_resolve,
+.B ub_resolve_async,
+.B ub_cancel,
+.B ub_resolve_free,
+.B ub_strerror
+\- Unbound DNS validating resolver @version@ functions.
+.SH "SYNOPSIS"
+.LP
+.B #include <unbound.h>
+.LP
+\fIstruct ub_ctx *\fR
+\fBub_ctx_create\fR(\fIvoid\fR);
+.LP
+\fIvoid\fR
+\fBub_ctx_delete\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_ctx_set_option\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR opt, \fIchar*\fR val);
+.LP
+\fIint\fR
+\fBub_ctx_config\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_set_fwd\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR addr);
+.LP
+\fIint\fR
+\fBub_ctx_resolvconf\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_hosts\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_add_ta\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR ta);
+.LP
+\fIint\fR
+\fBub_ctx_add_ta_file\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_trustedkeys\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
+.LP
+\fIint\fR
+\fBub_ctx_debugout\fR(\fIstruct ub_ctx*\fR ctx, \fIFILE*\fR out);
+.LP
+\fIint\fR
+\fBub_ctx_debuglevel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR d);
+.LP
+\fIint\fR
+\fBub_ctx_async\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR dothread);
+.LP
+\fIint\fR
+\fBub_poll\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_wait\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_fd\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_process\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_resolve\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
+.br
+           \fIint\fR rrtype, \fIint\fR rrclass, \fIint*\fR secure, 
+.br
+           \fIint*\fR data, \fIstruct ub_result**\fR result);
+.LP
+\fIint\fR
+\fBub_resolve_async\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
+.br
+                 \fIint\fR rrtype, \fIint\fR rrclass, \fIvoid*\fR mydata, 
+.br
+                 \fIub_callback_t\fR callback, \fIint*\fR async_id);
+.LP
+\fIint\fR
+\fBub_cancel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR async_id);
+.LP
+\fIvoid\fR
+\fBub_resolve_free\fR(\fIstruct ub_result*\fR result);
+.LP
+\fIconst char *\fR
+\fBub_strerror\fR(\fIint\fR err);
+.SH "DESCRIPTION"
+.LP
+.B Unbound 
+is an implementation of a DNS resolver, that does caching and 
+DNSSEC validation. This is the library API, for using the \-lunbound library.
+The server daemon is described in \fIunbound\fR(8).
+The library can be used to convert hostnames to ip addresses, and back,
+and obtain other information from the DNS. The library performs public\-key
+validation of results with DNSSEC.
+.P
+The library uses a variable of type \fIstruct ub_ctx\fR to keep context
+between calls. The user must maintain it, creating it with
+.B ub_ctx_create
+and deleting it with
+.B ub_ctx_delete\fR.
+It can be created and deleted at any time. Creating it anew removes any 
+previous configuration (such as trusted keys) and clears any cached results.
+.P
+The functions are thread\-safe, and a context an be used in a threaded (as 
+well as in a non\-threaded) environment. Also resolution (and validation) 
+can be performed blocking and non\-blocking (also called asynchronous). 
+The async method returns from the call immediately, so that processing 
+can go on, while the results become available later. 
+.P
+The functions are discussed in turn below.
+.SH "FUNCTIONS"
+.TP 
+.B ub_ctx_create
+Create a new context, initialised with defaults.
+The information from /etc/resolv.conf and /etc/hosts is not utilised 
+by default. Use 
+.B ub_ctx_resolvconf
+and
+.B ub_ctx_hosts
+to read them.
+.TP
+.B ub_ctx_delete
+Delete validation context and free associated resources.
+Outstanding async queries are killed and callbacks are not called for them.
+.TP
+.B ub_ctx_set_option
+A power\-user interface that lets you specify one of the options from the
+config file format, see \fIunbound.conf\fR(5). Not all options are
+relevant. For some specific options, such as adding trust anchors, special
+routines exist. Pass the option name with the trailing ':'.
+.TP
+.B ub_ctx_config
+A power\-user interface that lets you specify an unbound config file, see
+\fIunbound.conf\fR(5), which is read for configuration. Not all options are
+relevant. For some specific options, such as adding trust anchors, special
+routines exist.
+.TP
+.B ub_ctx_set_fwd
+Set machine to forward DNS queries to, the caching resolver to use. 
+IP4 or IP6 address. Forwards all DNS requests to that machine, which 
+is expected to run a recursive resolver. If the proxy is not 
+DNSSEC capable, validation may fail. Can be called several times, in 
+that case the addresses are used as backup servers.
+At this time it is only possible to set configuration before the
+first resolve is done.
+.TP
+.B ub_ctx_resolvconf
+Read list of nameservers to use from the filename given.
+Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
+If they do not support DNSSEC, validation may fail.
+Only nameservers are picked up, the searchdomain, ndots and other
+settings from \fIresolv.conf\fR(5) are ignored.
+If fname NULL is passed, "/etc/resolv.conf" is used.
+At this time it is only possible to set configuration before the
+first resolve is done.
+.TP
+.B ub_ctx_hosts
+Read list of hosts from the filename given.
+Usually "/etc/hosts". When queried for, these addresses are not marked 
+DNSSEC secure. If fname NULL is passed, "/etc/hosts" is used.
+At this time it is only possible to set configuration before the
+first resolve is done.
+.TP
+.B
+ub_ctx_add_ta
+Add a trust anchor to the given context.
+At this time it is only possible to add trusted keys before the
+first resolve is done.
+The format is a string, similar to the zone-file format,
+[domainname] [type] [rdata contents]. Both DS and DNSKEY records are accepted.
+.TP
+.B ub_ctx_add_ta_file
+Add trust anchors to the given context.
+Pass name of a file with DS and DNSKEY records in zone file format.
+At this time it is only possible to add trusted keys before the
+first resolve is done.
+.TP
+.B ub_ctx_trustedkeys
+Add trust anchors to the given context.
+Pass the name of a bind-style config file with trusted-keys{}.
+At this time it is only possible to add trusted keys before the
+first resolve is done.
+.TP
+.B ub_ctx_debugout
+Set debug and error log output to the given stream. Pass NULL to disable
+output. Default is stderr. File-names or using syslog can be enabled
+using config options, this routine is for using your own stream.
+.TP
+.B ub_ctx_debuglevel
+Set debug verbosity for the context. Output is directed to stderr.
+Higher debug level gives more output.
+.TP
+.B ub_ctx_async
+Set a context behaviour for asynchronous action.
+if set to true, enables threading and a call to 
+.B ub_resolve_async 
+creates a thread to handle work in the background.
+If false, a process is forked to handle work in the background.
+Changes to this setting after 
+.B ub_resolve_async 
+calls have been made have no effect (delete and re\-create the context 
+to change).
+.TP
+.B ub_poll
+Poll a context to see if it has any new results.
+Do not poll in a loop, instead extract the fd below to poll for readiness,
+and then check, or wait using the wait routine.
+Returns 0 if nothing to read, or nonzero if a result is available.
+If nonzero, call 
+.B ub_process 
+to do callbacks.
+.TP
+.B ub_wait
+Wait for a context to finish with results. Calls 
+.B ub_process 
+after the wait for you. After the wait, there are no more outstanding 
+asynchronous queries.
+.TP
+.B ub_fd
+Get file descriptor. Wait for it to become readable, at this point
+answers are returned from the asynchronous validating resolver.
+Then call the \fBub_process\fR to continue processing.
+.TP
+.B ub_process
+Call this routine to continue processing results from the validating
+resolver (when the fd becomes readable).
+Will perform necessary callbacks.
+.TP
+.B ub_resolve
+Perform resolution and validation of the target name.
+The name is a domain name in a zero terminated text string.
+The rrtype and rrclass are DNS type and class codes.
+The value secure returns true if the answer validated securely.
+The value data returns true if there was data.
+The result structure is newly allocated with the resulting data.
+.TP
+.B ub_resolve_async
+Perform asynchronous resolution and validation of the target name.
+Arguments mean the same as for \fBub_resolve\fR except no
+data is returned immediately, instead a callback is called later.
+The callback receives a copy of the mydata pointer, that you can use to pass
+information to the callback. The callback type is a function pointer to
+a function declared as
+.IP
+void my_callback_function(void* my_arg, int err, 
+.br
+                  struct ub_result* result);
+.IP
+The async_id is returned so you can (at your option) decide to track it
+and cancel the request if needed.
+.TP
+.B ub_cancel
+Cancel an async query in progress.
+.TP
+.B ub_resolve_free
+Free struct ub_result contents after use.
+.TP
+.B ub_strerror
+Convert error value from one of the unbound library functions 
+to a human readable string.
+.SH "RESULT DATA STRUCTURE"
+.LP
+The result of the DNS resolution and validation is returned as 
+\fIstruct ub_result\fR. The result structure contains the following entries.
+.P
+.nf
+	struct ub_result {
+		char* qname; /* text string, original question */
+		int qtype;   /* type code asked for */
+		int qclass;  /* class code asked for */
+		char** data; /* array of rdata items, NULL terminated*/
+		int* len;    /* array with lengths of rdata items */
+		char* canonname; /* canonical name of result */
+		int rcode;   /* additional error code in case of no data */
+		void* answer_packet; /* full network format answer packet */
+		int answer_len; /* length of packet in octets */
+		int havedata; /* true if there is data */
+		int nxdomain; /* true if nodata because name does not exist */
+		int secure;  /* true if result is secure */
+		int bogus;   /* true if a security failure happened */
+	};
+.fi
+.P
+If both secure and bogus are false, security was not enabled for the 
+domain of the query.
+.SH "RETURN VALUES"
+Many routines return an error code. The value 0 (zero) denotes no error
+happened. Other values can be passed to
+.B ub_strerror
+to obtain a readable error string.
+.B ub_strerror
+returns a zero terminated string.
+.B ub_ctx_create
+returns NULL on an error (a malloc failure).
+.B ub_poll
+returns true if some information may be available, false otherwise.
+.B ub_fd
+returns a file descriptor or -1 on error.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5), 
+\fIunbound\fR(8).
+.SH "AUTHORS"
+.B Unbound
+developers are mentioned in the CREDITS file in the distribution.

doc/plan

@@ -250,6 +250,8 @@ X make overload mode work; phase 0 all ok, phase 1 some threads close ports,
 * private TTL, dTLS features.
 * retry-mode, where a bogus result triggers a retry-mode query, where a list
   of responses over a time interval is collected, and each is validated.
+  or try in TCP mode. Do not 'try all servers several times', since we must
+  not create packet storms with operator errors.
 * draft-timers, DLV features.
 
 treeshrew/

doc/requirements.txt

@@ -34,7 +34,7 @@ then interface with the modules to perform the necessary processing.
 
 In Section 2 the origins of the Unbound project are documented. Section
 3 lists the goals, while Section 4 lists the explicit non-goals of the
-project.
+project. Section 5 discusses choices made during development.
 
 
 2. History
@@ -138,7 +138,7 @@ o The method by which dnssec-lameness is detected is not secure. DNSSEC lame
   before the validator will properly verify the messages.
 
   Also for zones for which no chain of trust exists, but a DS is given by the
-  parent, dnssec-lameness detection enables. This delivers dnnsec to our 
+  parent, dnssec-lameness detection enables. This delivers dnssec to our 
   clients when possible (for client validators).
 
   The following issue needs to be resolved:
@@ -200,3 +200,9 @@ o If a client makes a query without RD bit, in the case of a returned
   ascertains that RRSIGs are OK (and not omitted), but does not
   check NSEC/NSEC3. 
 
+o Case preservation
+  Unbound preserves the casing received from authority servers as best 
+  as possible. It compresses without case, so case can get lost there.
+  The casing from the query name is used in preference to the casing
+  of the authority server. This is the same as BIND. RFC4343 allows either 
+  behaviour.

doc/unbound-checkconf.8.in

@@ -1,3 +1,4 @@
+.TH "unbound-checkconf" "8" "@date@" "NLnet Labs" "unbound @version@"
 .\"
 .\" unbound-checkconf.8 -- unbound configuration checker manual
 .\"
@@ -6,40 +7,37 @@
 .\" See LICENSE for the license.
 .\"
 .\"
-.Dd @date@
-.Dt unbound-checkconf 8
-.Sh NAME
+.SH "NAME"
+.LP
 unbound-checkconf
-.Nd Check unbound configuration file for errors.
-.Sh SYNOPSIS
-.Nm unbound-checkconf
-.Op Fl h
-.Op cfgfile
-.Sh DESCRIPTION
-.Ic Unbound-checkconf
+\- Check unbound configuration file for errors.
+.SH "SYNOPSIS"
+.B unbound-checkconf
+.RB [ \-h ]
+.IR cfgfile
+.SH "DESCRIPTION"
+.B Unbound-checkconf
 checks the configuration file for the
-.Xr unbound 8
+\fIunbound\fR(8)
 DNS resolver for syntax and other errors. 
-The config file syntax is
-described in 
-.Xr unbound.conf 5 .
-.Pp
+The config file syntax is described in 
+\fIunbound.conf\fR(5).
+.P
 The available options are:
-.Bl -tag -width indent
-.It Fl h
+.TP
+.B \-h
 Show the version and commandline option help.
-.It cfgfile
+.TP
+.I cfgfile
 The config file to read with settings for unbound. It is checked.
 If omitted, the config file at the default location is checked.
-.Sh EXIT CODE
+.SH "EXIT CODE"
 The unbound-checkconf program exits with status code 1 on error, 
 0 for a correct config file.
-.El
-.Sh FILES
-.Bl -tag -width indent
-.It Pa /etc/unbound/unbound.conf
+.SH "FILES"
+.TP
+.I @ub_conf_file@
 unbound configuration file.
-.El
-.Sh SEE ALSO
-.Xr unbound.conf 5 , 
-.Xr unbound 8 .
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5), 
+\fIunbound\fR(8).

doc/unbound-host.1

@@ -0,0 +1,106 @@
+.TH "unbound\-host" "1" "@date@" "NLnet Labs" "unbound @version@"
+.\"
+.\" unbound-host.1 -- unbound DNS lookup utility
+.\"
+.\" Copyright (c) 2007, NLnet Labs. All rights reserved.
+.\"
+.\" See LICENSE for the license.
+.\"
+.\"
+.SH "NAME"
+.LP
+.B unbound\-host
+\- unbound DNS lookup utility
+.SH "SYNOPSIS"
+.LP
+.B unbound\-host
+.RB [ \-vdhr ]
+.RB [ \-c 
+.IR class ]
+.RB [ \-t
+.IR type ]
+.I hostname
+.RB [ \-y
+.IR key ]
+.RB [ \-f
+.IR keyfile ]
+.RB [ \-F
+.IR namedkeyfile ]
+.RB [ \-C
+.IR configfile ]
+.SH "DESCRIPTION"
+.LP
+.B Unbound\-host
+uses the unbound validating resolver to query for the hostname and display
+results. With the \fB\-v\fR option it displays validation 
+status: secure, insecure, bogus (security failure).
+.P
+The available options are:
+.TP
+.I hostname
+This name is resolved (looked up in the DNS).
+If a IPv4 or IPv6 address is given, a reverse lookup is performed.
+.TP
+.B \-h
+Show the version and commandline option help.
+.TP
+.B \-v
+Enable verbose output and it shows validation results, on every line.
+Secure means that the NXDOMAIN (no such domain name), nodata (no such data)
+or positive data response validated correctly with one of the keys.
+Insecure means that that domain name has no security set up for it.
+Bogus (security failure) means that the response failed one or more checks,
+it is likely wrong, outdated, tampered with, or broken.
+.TP
+.B \-d
+Enable debug output to stderr. One \-d shows what the resolver and validator
+are doing and may tell you what is going on. More times, \-d \-d, gives a
+lot of output, with every packet sent and received.
+.TP
+.B \-c \fIclass
+Specify the class to lookup for, the default is IN the internet class.
+.TP
+.B \-t \fItype
+Specify the type of data to lookup. The default looks for IPv4, IPv6 and
+mail handler data, or domain name pointers for reverse queries.
+.TP
+.B \-y \fIkey
+Specify a public key to use as trust anchor. This is the base for a chain
+of trust that is built up from the trust anchor to the response, in order
+to validate the response message. Can be given as a DS or DNSKEY record.
+For example \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD".
+.TP
+.B \-f \fIkeyfile
+Reads keys from a file. Every line has a DS or DNSKEY record, in the format
+as for \-y. The zone file format, the same as dig and drill produce.
+.TP
+.B \-F \fInamedkeyfile
+Reads keys from a BIND\-style named.conf file. Only the trusted\-key {}; entries
+are read.
+.TP
+.B \-C \fIconfigfile
+Uses the specified unbound.conf to prime
+.IR libunbound (3).
+.TP
+.B \-r
+Read /etc/resolv.conf, and use the forward DNS servers from there (those could
+have been set by DHCP).  More info in
+.IR resolv.conf (5).
+Breaks validation if those servers do not support DNSSEC.
+.SH "EXAMPLES"
+.LP
+Some examples of use. The keys shown below are fakes, thus a security failure
+is encountered.
+.P
+$ unbound\-host www.example.com
+.P
+$ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" www.example.com
+.P
+$ unbound\-host \-v \-y "example.com DS 31560 5 1 1CFED84787E6E19CCF9372C1187325972FE546CD" 192.0.2.153
+.SH "EXIT CODE"
+The unbound\-host program exits with status code 1 on error, 
+0 on no error. The data may not be available on exit code 0, exit code 1
+means the lookup encountered a fatal error.
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5), 
+\fIunbound\fR(8).

doc/unbound.8.in

@@ -1,3 +1,4 @@
+.TH "unbound" "8" "@date@" "NLnet Labs" "unbound @version@"
 .\"
 .\" unbound.8 -- unbound manual
 .\"
@@ -6,42 +7,45 @@
 .\" See LICENSE for the license.
 .\"
 .\"
-.Dd @date@
-.Dt unbound 8
-.Sh NAME
-unbound
-.Nd Unbound DNS validating resolver @version@.
-.Sh SYNOPSIS
-.Nm unbound
-.Op Fl h
-.Op Fl d
-.Op Fl v
-.Op Fl c Ar cfgfile
-.Sh DESCRIPTION
-.Ic Unbound 
+.SH "NAME"
+.LP
+.B unbound
+\- Unbound DNS validating resolver @version@.
+.SH "SYNOPSIS"
+.LP
+.B unbound
+.RB [ \-h ]
+.RB [ \-d ]
+.RB [ \-v ]
+.RB [ \-c 
+.IR cfgfile ]
+.SH "DESCRIPTION"
+.LP
+.B Unbound 
 is an implementation of a DNS resolver, that does caching and 
 DNSSEC validation.
-.Pp
+.P
 The available options are:
-.Bl -tag -width indent
-.It Fl h
+.TP
+.B \-h
 Show the version and commandline option help.
-.It Fl c Ar cfgfile
-Set the config file with settings for unbound to read instead of the 
-file at default location /etc/unbound/unbound.conf. The syntax is
-described in 
-.Xr unbound.conf 5 .
-.It Fl d
+.TP
+.B \-c\fI cfgfile
+Set the config file with settings for unbound to read instead of reading the 
+file at the default location, @ub_conf_file@. The syntax is
+described in \fIunbound.conf\fR(5).
+.TP
+.B \-d
 Debug flag, do not fork into the background, but stay attached to the
 console. This flag will also delay writing to the logfile until the
-thread-spawn time. So that most config and setup errors appear on stderr.
-.It Fl v
+thread\-spawn time. So that most config and setup errors appear on stderr.
+.TP
+.B \-v
 Increase verbosity. If given multiple times, more information is logged.
 This is in addition to the verbosity (if any) from the config file.
-.El
-.Sh SEE ALSO
-.Xr unbound.conf 5 , 
-.Xr unbound-checkconf 8 .
-.Sh AUTHORS
-.Ic Unbound
+.SH "SEE ALSO"
+\fIunbound.conf\fR(5), 
+\fIunbound\-checkconf\fR(8).
+.SH "AUTHORS"
+.B Unbound
 developers are mentioned in the CREDITS file in the distribution.

doc/unbound.conf.5.in

@@ -1,3 +1,4 @@
+.TH "unbound.conf" "5" "@date@" "NLnet Labs" "unbound @version@"
 .\"
 .\" unbound.conf.5 -- unbound.conf manual
 .\"
@@ -6,247 +7,351 @@
 .\" See LICENSE for the license.
 .\"
 .\"
-.Dd @date@
-.Os FreeBSD
-.Dt unbound.conf 5
-.Sh NAME
-.Nm unbound.conf
-.Nd Unbound configuration file.
-.Sh SYNOPSIS
-.Nm unbound.conf
-.Sh DESCRIPTION
-.Ic unbound.conf
+.SH "NAME"
+.LP
+.B unbound.conf
+\- Unbound configuration file.
+.SH "SYNOPSIS"
+.LP
+.B unbound.conf
+.SH "DESCRIPTION"
+.LP
+.B unbound.conf
 is used to configure
-.Xr unbound 8 .
+\fIunbound\fR(8).
 The file format has attributes and values. Some attributes have attributes inside them.
 The notation is: attribute: value.
-.Pp
+.P
 Comments start with # and last to the end of line. Empty lines are
 ignored as is whitespace at the beginning of a line.
-.Pp
+.P
 The utility 
-.Xr unbound-checkconf 8
+\fIunbound\-checkconf\fR(8)
 can be used to check unbound.conf prior to usage.
-.Sh EXAMPLE
+.SH "EXAMPLE"
 An example config file is shown below. Copy this to /etc/unbound/unbound.conf
 and start the server with:
+.P
 .nf
-	$ unbound -c /etc/unbound/unbound.conf 
+	$ unbound \-c /etc/unbound/unbound.conf 
 .fi
+.P
 Most settings are the defaults. Stop the server with:
+.P
 .nf
 	$ kill `cat /etc/unbound/unbound.pid`
 .fi
+.P
 Below is a minimal config file. The source distribution contains an extensive
 example.conf file with all the options.
+.P
 .nf
 # unbound.conf(5) config file for unbound(8).
 server:
 	directory: "/etc/unbound"
 	username: unbound 	# make sure it can write to pidfile.
+	# make sure unbound can access entropy from inside the chroot.
+	# e.g. on linux the use these commands (on BSD, devfs(8) is used):
+	#      mount --bind -n /dev/random /etc/unbound/dev/random
+	# and  mount --bind -n /dev/log /etc/unbound/dev/log
 	chroot: "/etc/unbound"
 	# logfile: "/etc/unbound/unbound.log"  #uncomment to use logfile.
 	pidfile: "/etc/unbound/unbound.pid"
 	# verbosity: 1		# uncomment and increase to get more logging.
-
 	# listen on all interfaces, answer queries from the local subnet.
 	interface: 0.0.0.0
 	interface: ::0
-	access-control: 10.0.0.0/8 allow
-	access-control: 2001:DB8::/64 allow
+	access\-control: 10.0.0.0/8 allow
+	access\-control: 2001:DB8::/64 allow
 .fi
-.Sh FILE FORMAT
+.SH "FILE FORMAT"
+.LP
 There must be whitespace between keywords. Attribute keywords end with a colon ':'. An attribute
 is followed by its containing attributes, or a value.
-.Pp
+.P
 Files can be included using the
-.Ic include:
+.B include:
 directive. It can appear anywhere, and takes a single filename as an argument.
 Processing continues as if the text from the included file was copied into
 the config file at that point.
-.Ss Server Options
+.SS "Server Options"
 These options are part of the
-.Ic server:
+.B server:
 clause.
-.Bl -tag -width indent
-.It \fBverbosity:\fR <number>
+.TP
+.B verbosity: \fI<number>
 The verbosity number, level 0 means no verbosity, only errors. Level 1 
-gives operational information. Level 2 gives query level information, 
-output per query. Level 3 gives algorithm level information.  
+gives operational information. Level 2 gives detailed operational
+information. Level 3 gives query level information, output per query. 
+Level 4 gives algorithm level information.  
 Default is level 1. The verbosity can also be increased from the commandline,
 see
-.Xr unbound 8 .
-.It \fBnum-threads:\fR <number>
+\fIunbound\fR(8).
+.TP
+.B statistics-interval: \fI<seconds>
+The number of seconds between printing statistics to the log for every thread.
+Disable with value 0 or "". Default is disabled. 
+.TP
+.B statistics-cumulative: \fI<yes or no>
+If enabled, statistics are cumulative since starting unbound, without clearing
+the statistics counters after logging the statistics. Default is no.
+.TP
+.B num\-threads: \fI<number>
 The number of threads to create to serve clients. Use 1 for no threading.
-.It \fBport:\fR <port number>
+.TP
+.B port: \fI<port number>
 The port number, default 53, on which the server responds to queries.
-.It \fBinterface:\fR <ip address>
+.TP
+.B interface: \fI<ip address>
 Interface to use to connect to the network. This interface is listened to
 for queries from clients, and answers to clients are given from it.
 Can be given multiple times to work on several interfaces. If none are 
 given the default is to listen to localhost.
-The interfaces are not changed on a reload (kill -HUP) but only on restart.
-.It \fBoutgoing-interface:\fR <ip address>
+The interfaces are not changed on a reload (kill \-HUP) but only on restart.
+.TP
+.B interface-automatic: \fI<yes or no>
+Detect source interface on UDP queries and copy them to replies.  This 
+feature is experimental, and needs support in your OS for IPv6 
+(and its socket options) and IPv4 (and have source-interface socket options). 
+Default value is no.
+.TP
+.B outgoing\-interface: \fI<ip address>
 Interface to use to connect to the network. This interface is used to send
 queries to authoritative servers and receive their replies. Can be given 
 multiple times to work on several interfaces. If none are given the 
 default (all) is used. You can specify the same interfaces in 
-.Ic interface:
+.B interface:
 and
-.Ic outgoing-interface:
+.B outgoing\-interface:
 lines, the interfaces are then used for both purposes. Outgoing queries are 
 sent via a random outgoing interface to counter spoofing.
-.It \fBoutgoing-port:\fR <port number>
-The starting port number where the outgoing query port range is allocated.
-Default is 1053.
-.It \fBoutgoing-range:\fR <number>
-Number of ports to open. This number is opened per thread for every outgoing
-query interface. Must be at least 1. Default is 16.
-Larger numbers give more protection against spoofing attempts, but need
-extra resources from the operating system.
-.It \fBoutgoing-num-tcp:\fR <number>
+.TP
+.B outgoing\-range: \fI<number>
+Number of ports to open. This number of file descriptors can be opened per 
+thread. Must be at least 1. Default is 256. Larger numbers need extra 
+resources from the operating system.
+.TP
+.B outgoing\-port\-permit: \fI<port number or range>
+Permit unbound to open this port or range of ports for use to send queries.
+A larger number of permitted outgoing ports increases resilience against
+spoofing attempts. Make sure these ports are not needed by other daemons. 
+By default only ports above 1024 that have not been assigned by IANA are used.
+Give a port number or a range of the form "low-high", without spaces.
+.TP
+.B outgoing\-port\-avoid: \fI<port number or range>
+Do not permit unbound to open this port or range of ports for use to send 
+queries. Use this to make sure unbound does not grab a port that another
+daemon needs. The port is avoided on all outgoing interfaces, both IP4 and IP6.
+By default only ports above 1024 that have not been assigned by IANA are used.
+Give a port number or a range of the form "low-high", without spaces.
+.TP
+.B outgoing\-num\-tcp: \fI<number>
 Number of outgoing TCP buffers to allocate per thread. Default is 10. If set
 to 0, or if do_tcp is "no", no TCP queries to authoritative servers are done.
-.It \fBincoming-num-tcp:\fR <number>
+.TP
+.B incoming\-num\-tcp: \fI<number>
 Number of incoming TCP buffers to allocate per thread. Default is 10. If set
 to 0, or if do_tcp is "no", no TCP queries from clients are accepted.
-.It \fBmsg-buffer-size:\fR <number>
+.TP
+.B msg\-buffer\-size: \fI<number>
 Number of bytes size of the message buffers. Default is 65552 bytes, enough
 for 64 Kb packets, the maximum DNS message size. No message larger than this
 can be sent or received. Can be reduced to use less memory, but some requests
 for DNS data, such as for huge resource records, will result in a SERVFAIL 
 reply to the client.
-.It \fBmsg-cache-size:\fR <number>
+.TP
+.B msg\-cache\-size: \fI<number>
 Number of bytes size of the message cache. Default is 4 megabytes.
-.It \fBmsg-cache-slabs:\fR <number>
+A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
+or gigabytes (1024*1024 bytes in a megabyte).
+.TP
+.B msg\-cache\-slabs: \fI<number>
 Number of slabs in the message cache. Slabs reduce lock contention by threads.
 Must be set to a power of 2. Setting (close) to the number of cpus is a 
 reasonable guess.
-.It \fBnum-queries-per-thread:\fR <number>
+.TP
+.B num\-queries\-per\-thread: \fI<number>
 The number of queries that every thread will service simultaneously.
 If more queries arrive that need servicing, they are dropped. This forces
 the client to resend after a timeout; allowing the server time to work on
 the existing queries. Default 1024.
-.It \fBrrset-cache-size:\fR <number>
+.TP
+.B rrset\-cache\-size: \fI<number>
 Number of bytes size of the RRset cache. Default is 4 megabytes.
-.It \fBrrset-cache-slabs:\fR <number>
+A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
+or gigabytes (1024*1024 bytes in a megabyte).
+.TP
+.B rrset\-cache\-slabs: \fI<number>
 Number of slabs in the RRset cache. Slabs reduce lock contention by threads.
 Must be set to a power of 2. 
-.It \fBcache-max-ttl:\fR <seconds>
+.TP
+.B cache\-max\-ttl: \fI<seconds>
 Time to live maximum for RRsets and messages in the cache. Default is 
 86400 seconds (1 day). If the maximum kicks in, responses to clients 
 still get decrementing TTLs based on the original (larger) values. 
 When the internal TTL expires, the cache item has expired.
 Can be set lower to force the resolver to query for data often, and not
 trust (very large) TTL values.
-.It \fBinfra-host-ttl:\fR <seconds>
+.TP
+.B infra\-host\-ttl: \fI<seconds>
 Time to live for entries in the host cache. The host cache contains 
 roundtrip timing and EDNS support information. Default is 900.
-.It \fBinfra-lame-ttl:\fR <seconds>
+.TP
+.B infra\-lame\-ttl: \fI<seconds>
 The time to live when a delegation is discovered to be lame. Default is 900.
-.It \fBinfra-cache-slabs:\fR <number>
+.TP
+.B infra\-cache\-slabs: \fI<number>
 Number of slabs in the infrastructure cache. Slabs reduce lock contention 
 by threads. Must be set to a power of 2. 
-.It \fBinfra-cache-numhosts:\fR <number>
+.TP
+.B infra\-cache\-numhosts: \fI<number>
 Number of hosts for which information is cached. Default is 10000.
-.It \fBinfra-cache-lame-size:\fR <number>
+.TP
+.B infra\-cache\-lame\-size: \fI<number>
 Number of bytes that the lameness cache per host is allowed to use. Default
 is 10 kb, which gives maximum storage for a couple score zones, depending on 
 the lame zone name lengths.
-.It \fBdo-ip4:\fR <yes or no>
-Enable or disable whether ip4 queries are answered. Default is yes.
-.It \fBdo-ip6:\fR <yes or no>
-Enable or disable whether ip6 queries are answered. Default is yes.
-.It \fBdo-udp:\fR <yes or no>
-Enable or disable whether UDP queries are answered. Default is yes.
-.It \fBdo-tcp:\fR <yes or no>
-Enable or disable whether TCP queries are answered. Default is yes.
-.It \fBaccess-control:\fR <IP netblock> <action>
+.TP
+.B do\-ip4: \fI<yes or no>
+Enable or disable whether ip4 queries are answered or issued. Default is yes.
+.TP
+.B do\-ip6: \fI<yes or no>
+Enable or disable whether ip6 queries are answered or issued. Default is yes.
+If disabled, queries are not answered on IPv6, and queries are not sent on
+IPv6 to the internet nameservers.
+.TP
+.B do\-udp: \fI<yes or no>
+Enable or disable whether UDP queries are answered or issued. Default is yes.
+.TP
+.B do\-tcp: \fI<yes or no>
+Enable or disable whether TCP queries are answered or issued. Default is yes.
+.TP
+.B do\-daemonize: \fI<yes or no>
+Enable or disable whether the unbound server forks into the background as
+a daemon. Default is yes.
+.TP
+.B access\-control: \fI<IP netblock> <action>
 The netblock is given as an IP4 or IP6 address with /size appended for a 
 classless network block. The action can be deny, refuse or allow.
 Deny stops queries from hosts from that netblock.
 Refuse stops queries too, but sends a DNS rcode REFUSED error message back.
 Allow gives access to clients from that netblock.
 By default only localhost is allowed, the rest is refused.
-.It \fBchroot:\fR <directory>
+The default is refused, because that is protocol\-friendly. The DNS protocol
+is not designed to handle dropped packets due to policy, and dropping may 
+result in (possibly excessive) retried queries.
+.TP
+.B chroot: \fI<directory>
+If chroot is enabled, you should pass the configfile (from the
+commandline) as a full path from the original root. After the
+chroot has been performed the now defunct portion of the config 
+file path is removed to be able to reread the config after a reload. 
+.IP
+All other file paths (working dir, pidfile, logfile, roothints,
+key files) can be specified in several ways:
+as an absolute path relative to the new root,
+as a relative path to the working directory, or
+as an absolute path relative to the original root.
+In the last case the path is adjusted to remove the unused portion.
+.IP
+Additionally, unbound may need to access /dev/random (for entropy)
+and to /dev/log (if you use syslog) from inside the chroot.
+.IP
 If given a chroot is done to the given directory. The default is 
-"/etc/unbound". If you give "" no chroot is performed.
-.It \fBusername:\fR <name>
+"@UNBOUND_CHROOT_DIR@". If you give "" no chroot is performed.
+.TP
+.B username: \fI<name>
 If given, after binding the port the user privileges are dropped. Default is
-"unbound". If you give username: "" no user change is performed. 
-.Pp
+"@UNBOUND_USERNAME@". If you give username: "" no user change is performed. 
+.IP
 If this user is not capable of binding the
 port, reloads (by signal HUP) will still retain the opened ports.
 If you change the port number in the config file, and that new port number 
 requires privileges, then a reload will fail; a restart is needed.
-.It \fBdirectory:\fR <directory>
-Sets the working directory for the program.
-.It \fBlogfile:\fR <filename>
+.TP
+.B directory: \fI<directory>
+Sets the working directory for the program. Default is "@UNBOUND_RUN_DIR@".
+.TP
+.B logfile: \fI<filename>
 If "" is given, logging goes to stderr, or nowhere once daemonized.
 The logfile is appended to, in the following format: 
+.nf
 [seconds since 1970] unbound[pid:tid]: type: message. 
-If this option is given, the use-syslog is option is set to "no".
+.fi
+If this option is given, the use\-syslog is option is set to "no".
 The logfile is reopened (for append) when the config file is reread, on 
 SIGHUP.
-.It \fBuse-syslog:\fR <yes or no>
+.TP
+.B use\-syslog: \fI<yes or no>
 Sets unbound to send log messages to the syslogd, using 
-.Xr syslog 3 .
+\fIsyslog\fR(3). 
 The log facility LOG_DAEMON is used, with identity "unbound".
-The logfile setting is overridden when use-syslog is turned on.
+The logfile setting is overridden when use\-syslog is turned on.
 The default is to log to syslog.
-.It \fBpidfile:\fR <filename>
-The process id is written to the file. Default is "/etc/unbound/unbound.pid". 
+.TP
+.B pidfile: \fI<filename>
+The process id is written to the file. Default is "@UNBOUND_PIDFILE@". 
 So,
 .nf
-kill -HUP `cat /etc/unbound/unbound.pid` 
+kill \-HUP `cat @UNBOUND_PIDFILE@` 
 .fi
 triggers a reload,
 .nf
-kill -QUIT `cat /etc/unbound/unbound.pid` 
+kill \-QUIT `cat @UNBOUND_PIDFILE@` 
 .fi
 gracefully terminates.
-.It \fBroot-hints:\fR <filename>
+.TP
+.B root\-hints: \fI<filename>
 Read the root hints from this file. Default is nothing, using builtin hints
 for the IN class. The file has the format of zone files, with root 
 nameserver names and addresses only. The default may become outdated,
-when servers change, therefore it is good practice to use a root-hints file.
-.It \fBhide-identity:\fR <yes or no>
+when servers change, therefore it is good practice to use a root\-hints file.
+.TP
+.B hide\-identity: \fI<yes or no>
 If enabled id.server and hostname.bind queries are refused.
-.It \fBidentity:\fR <string>
+.TP
+.B identity: \fI<string>
 Set the identity to report. If set to "", the default, then the hostname
 of the server is returned.
-.It \fBhide-version:\fR <yes or no>
+.TP
+.B hide\-version: \fI<yes or no>
 If enabled version.server and version.bind queries are refused.
-.It \fBversion:\fR <string>
+.TP
+.B version: \fI<string>
 Set the version to report. If set to "", the default, then the package
 version is returned.
-.It \fBtarget-fetch-policy:\fR <"list of numbers">
+.TP
+.B target\-fetch\-policy: \fI<"list of numbers">
 Set the target fetch policy used by unbound to determine if it should fetch
 nameserver target addresses opportunistically. The policy is described per
 dependency depth. 
-.Pp
+.IP
 The number of values determines the maximum dependency depth
 that unbound will pursue in answering a query.  
-A value of -1 means to fetch all targets opportunistically for that dependency
+A value of \-1 means to fetch all targets opportunistically for that dependency
 depth. A value of 0 means to fetch on demand only. A positive value fetches
 that many targets opportunistically. 
-.Pp
+.IP
 Enclose the list between quotes ("") and put spaces between numbers.
 The default is "3 2 1 0 0". Setting all zeroes, "0 0 0 0 0" gives behaviour
-closer to that of BIND 9, while setting "-1 -1 -1 -1 -1" gives behaviour 
+closer to that of BIND 9, while setting "\-1 \-1 \-1 \-1 \-1" gives behaviour 
 rumoured to be closer to that of BIND 8.
-.It \fBharden-short-bufsize:\fR <yes or no>
+.TP
+.B harden\-short\-bufsize: \fI<yes or no>
 Very small EDNS buffer sizes from queries are ignored. Default is off, since
 it is legal protocol wise to send these, and unbound tries to give very 
 small answers to these queries, where possible.
-.It \fBharden-large-queries:\fR <yes or no>
+.TP
+.B harden\-large\-queries: \fI<yes or no>
 Very large queries are ignored. Default is off, since it is legal protocol
 wise to send these, and could be necessary for operation if TSIG or EDNS
 payload is very large.
-.It \fBharden-glue:\fR <yes or no>
+.TP
+.B harden\-glue: \fI<yes or no>
 Will trust glue only if it is within the servers authority. Default is on.
-.It \fBharden-dnssec-stripped:\fR <yes or no>
-Require DNSSEC data for trust-anchored zones, if such data is absent,
+.TP
+.B harden\-dnssec\-stripped: \fI<yes or no>
+Require DNSSEC data for trust\-anchored zones, if such data is absent,
 the zone becomes bogus. If turned off, and no DNSSEC data is received
 (or the DNSKEY data fails to validate), then the zone is made insecure, 
 this behaves like there is no trust anchor. You could turn this off if 
@@ -254,60 +359,80 @@ you are sometimes behind an intrusive firewall (of some sort) that
 removes DNSSEC data from packets, or a zone changes from signed to 
 unsigned to badly signed often. If turned off you run the risk of a 
 downgrade attack that disables security for a zone. Default is on.
-.It \fBdo-not-query-address:\fR <IP address>
+.TP
+.B use\-caps\-for\-id: \fI<yes or no>
+Use 0x20-encoded random bits in the query to foil spoof attempts.
+This perturbs the lowercase and uppercase of query names sent to 
+authority servers and checks if the reply still has the correct casing. 
+Disabled by default, because some caching forwarders may not
+support this. It is known that some authority servers do not support 0x20, 
+and resolution will fail for them. A solution is on the TODO list.
+This feature is an experimental implementation of draft dns\-0x20.
+.TP
+.B do\-not\-query\-address: \fI<IP address>
 Do not query the given IP address. Can be IP4 or IP6. Append /num to 
 indicate a classless delegation netblock, for example like
 10.2.3.4/24 or 2001::11/64.
-.It \fBdo-not-query-localhost:\fR <yes or no>
-If yes, localhost is added to the do-not-query-address entries, both
+.TP
+.B do\-not\-query\-localhost: \fI<yes or no>
+If yes, localhost is added to the do\-not\-query\-address entries, both
 IP6 ::1 and IP4 127.0.0.1/8. If no, then localhost can be used to send
 queries to. Default is yes.
-.It \fBmodule-config:\fR <"module names">
+.TP
+.B module\-config: \fI<"module names">
 Module configuration, a list of module names separated by spaces, surround
 the string with quotes (""). The modules can be validator, iterator.
-Setting this to "iterator" will result in a non-validating server.
+Setting this to "iterator" will result in a non\-validating server.
 Setting this to "validator iterator" will turn on DNSSEC validation.
-You must also set trust-anchors for validation to be useful.
-.It \fBtrust-anchor-file:\fR <filename>
+You must also set trust\-anchors for validation to be useful.
+.TP
+.B trust\-anchor\-file: \fI<filename>
 File with trusted keys for validation. Both DS and DNSKEY entries can appear
 in the file. The format of the file is the standard DNS Zone file format.
 Default is "", or no trust anchor file.
-.It \fBtrust-anchor:\fR <"Resource Record">
+.TP
+.B trust\-anchor: \fI<"Resource Record">
 A DS or DNSKEY RR for a key to use for validation. Multiple entries can be
-given to specify multiple trusted keys, in addition to the trust-anchor-files.
+given to specify multiple trusted keys, in addition to the trust\-anchor\-files.
 The resource record is entered in the same format as 'dig' or 'drill' prints
 them, the same format as in the zone file. Has to be on a single line, with
 "" around it. A TTL can be specified for ease of cut and paste, but is ignored. 
 A class can be specified, but class IN is default.
-.It \fBtrusted-keys-file:\fR <filename>
+.TP
+.B trusted\-keys\-file: \fI<filename>
 File with trusted keys for validation. Specify more than one file
-with several entries, one file per entry. Like \fBtrust-anchor-file\fR
-but has a different file format. Format is BIND-9 style format, 
-the trusted-keys { name flag proto algo "key"; }; clauses are read.
-.It \fBval-override-date:\fR <rrsig-style date spec>
+with several entries, one file per entry. Like \fBtrust\-anchor\-file\fR
+but has a different file format. Format is BIND\-9 style format, 
+the trusted\-keys { name flag proto algo "key"; }; clauses are read.
+.TP
+.B val\-override\-date: \fI<rrsig\-style date spec>
 Default is "" or "0", which disables this debugging feature. If enabled by
 giving a RRSIG style date, that date is used for verifying RRSIG inception
 and expiration dates, instead of the current date. Do not set this unless 
 you are debugging signature inception and expiration.
-.It \fBval-bogus-ttl:\fR <number>
+.TP
+.B val\-bogus\-ttl: \fI<number>
 The time to live for bogus data. This is data that has failed validation;
 due to invalid signatures or other checks. The TTL from that data cannot be
 trusted, and this value is used instead. The value is in seconds, default 900.
 The time interval prevents repeated revalidation of bogus data.
-.It \fBval-clean-additional:\fR <yes or no>
+.TP
+.B val\-clean\-additional: \fI<yes or no>
 Instruct the validator to remove data from the additional section of secure
 messages that are not signed properly. Messages that are insecure, bogus,
 indeterminate or unchecked are not affected. Default is yes. Use this setting
 to protect the users that rely on this validator for authentication from 
 protentially bad data in the additional section.
-.It \fBval-permissive-mode:\fR <yes or no>
+.TP
+.B val\-permissive\-mode: \fI<yes or no>
 Instruct the validator to mark bogus messages as indeterminate. The security
 checks are performed, but if the result is bogus (failed security), the
 reply is not withheld from the client with SERVFAIL as usual. The client 
 receives the bogus data. For messages that are found to be secure the AD bit 
 is set in replies. Also logging is performed as for full validation.
 The default value is "no". 
-.It \fBval-nsec3-keysize-iterations:\fR <"list of values">
+.TP
+.B val\-nsec3\-keysize\-iterations: \fI<"list of values">
 List of keysize and iteration count values, separated by spaces, surrounded
 by quotes. Default is "1024 150 2048 500 4096 2500". This determines the
 maximum allowed NSEC3 iteration count before a message is simply marked
@@ -315,188 +440,262 @@ insecure instead of performing the many hashing iterations. The list must
 be in ascending order and have at least one entry. If you set it to 
 "1024 65535" there is no restriction to NSEC3 iteration values.
 This table must be kept short; a very long list could cause slower operation.
-.It \fBkey-cache-size:\fR <number>
+.TP
+.B key\-cache\-size: \fI<number>
 Number of bytes size of the key cache. Default is 4 megabytes.
-.It \fBkey-cache-slabs:\fR <number>
+A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
+or gigabytes (1024*1024 bytes in a megabyte).
+.TP
+.B key\-cache\-slabs: \fI<number>
 Number of slabs in the key cache. Slabs reduce lock contention by threads.
 Must be set to a power of 2. Setting (close) to the number of cpus is a 
 reasonable guess.
-.It \fBlocal-zone:\fR <zone> <type>
+.TP
+.B local\-zone: \fI<zone> <type>
 Configure a local zone. The type determines the answer to give if there is
-no match from local-data. The types are deny, refuse, static, transparent, 
+no match from local\-data. The types are deny, refuse, static, transparent, 
 redirect, nodefault, and are explained below. After that the default settings
-are listed. Use local-data: to enter data into the local zone. Answers for
+are listed. Use local\-data: to enter data into the local zone. Answers for
 local zones are authoritative DNS answers. By default the zones are class IN.
-.Bl -tag -width indent
-.It \fIdeny\fR 
+.IP
+If you need more complicated authoritative data, with referrals, wildcards,
+CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for
+it as detailed in the stub zone section below.
+.TP 10
+\h'5'\fIdeny\fR
 Do not send an answer, drop the query.
 If there is a match from local data, the query is answered.
-.It \fIrefuse\fR 
+.TP 10
+\h'5'\fIrefuse\fR
 Send an error message reply, with rcode REFUSED.
 If there is a match from local data, the query is answered.
-.It \fIstatic\fR 
+.TP 10
+\h'5'\fIstatic\fR
 If there is a match from local data, the query is answered.
 Otherwise, the query is answered with nodata or nxdomain.
 For a negative answer a SOA is included in the answer if present
-as local-data for the zone apex domain.
-.It \fItransparent\fR 
+as local\-data for the zone apex domain.
+.TP 10
+\h'5'\fItransparent\fR 
 If there is a match from local data, the query is answered.
 Otherwise, the query is resolved normally.
-If no local-zone is given local-data causes a transparent zone
+If no local\-zone is given local\-data causes a transparent zone
 to be created by default.
-.It \fIredirect\fR 
+.TP 10
+\h'5'\fIredirect\fR 
 The query is answered from the local data for the zone name. 
 There may be no local data beneath the zone name.
 This answers queries for the zone, and all subdomains of the zone
 with the local data for the zone.
 It can be used to redirect a domain to a different address, with 
-local-zone: "example.com." redirect and 
-local-data: "example.com. A 127.0.0.1"
+local\-zone: "example.com." redirect and 
+local\-data: "example.com. A 127.0.0.1"
 queries for www.example.com and www.foo.example.com are redirected.
-.It \fInodefault\fR 
+.TP 10
+\h'5'\fInodefault\fR 
 Used to turn off default contents for AS112 zones. The other types
 also turn off default contents for the zone. The 'nodefault' option 
 has no other effect than turning off default contents for the 
 given zone.
-.El
+.P
 The default zones are localhost, reverse 127.0.0.1 and ::1, and the AS112
 zones. The AS112 zones are reverse DNS zones for private use and reserved
 IP addresses for which the servers on the internet cannot provide correct
 answers. They are configured by default to give nxdomain (no reverse 
 information) answers. The defaults can be turned off by specifying your
-own local-zone of that name, or using the 'nodefault' type. Below is a 
+own local\-zone of that name, or using the 'nodefault' type. Below is a 
 list of the default zone contents.
-.Bl -tag -width indent
-.It \fIlocalhost\fR 
+.TP 10
+\h'5'\fIlocalhost\fR 
 The IP4 and IP6 localhost information is given. NS and SOA records are provided
 for completeness and to satisfy some DNS update tools. Default content:
 .nf
-local-zone: "localhost." static
-local-data: "localhost. 10800 IN NS localhost."
-local-data: "localhost. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
-local-data: "localhost. 10800 IN A 127.0.0.1"
-local-data: "localhost. 10800 IN AAAA ::1"
+local\-zone: "localhost." static
+local\-data: "localhost. 10800 IN NS localhost."
+local\-data: "localhost. 10800 IN 
+    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
+local\-data: "localhost. 10800 IN A 127.0.0.1"
+local\-data: "localhost. 10800 IN AAAA ::1"
 .fi
-.It \fIreverse IPv4 loopback\fR 
+.TP 10
+\h'5'\fIreverse IPv4 loopback\fR 
 Default content:
 .nf
-local-zone: "127.in-addr.arpa." static
-local-data: "127.in-addr.arpa. 10800 IN NS localhost."
-local-data: "127.in-addr.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
-local-data: "1.0.0.127.in-addr.arpa. 10800 IN PTR localhost."
+local\-zone: "127.in\-addr.arpa." static
+local\-data: "127.in\-addr.arpa. 10800 IN NS localhost."
+local\-data: "127.in\-addr.arpa. 10800 IN 
+    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
+local\-data: "1.0.0.127.in\-addr.arpa. 10800 IN 
+    PTR localhost."
 .fi
-.It \fIreverse IPv6 loopback\fR 
+.TP 10
+\h'5'\fIreverse IPv6 loopback\fR 
 Default content:
 .nf
-local-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." static
-local-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost."
-local-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
-local-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN PTR localhost."
+local\-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
+    0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." static
+local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
+    0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN 
+    NS localhost."
+local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
+    0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN 
+    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
+local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
+    0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN 
+    PTR localhost."
 .fi
-.It \fIreverse RFC1918 local use zones\fR 
-Reverse data for zones 10.in-addr.arpa, 16.172.in-addr.arpa to 
-31.172.in-addr.arpa, 168.192.in-addr.arpa.
-The \fBlocal-zone:\fR is set static and as \fBlocal-data:\fR SOA and NS 
+.TP 10
+\h'5'\fIreverse RFC1918 local use zones\fR 
+Reverse data for zones 10.in\-addr.arpa, 16.172.in\-addr.arpa to 
+31.172.in\-addr.arpa, 168.192.in\-addr.arpa.
+The \fBlocal\-zone:\fR is set static and as \fBlocal\-data:\fR SOA and NS 
 records are provided.
-.It \fIreverse RFC3330 IP4 this, link-local, testnet and broadcast\fR 
-Reverse data for zones 0.in-addr.arpa, 254.169.in-addr.arpa, 
-2.0.192.in-addr.arpa, 255.255.255.255.in-addr.arpa.
-.It \fIreverse RFC4291 IP6 unspecified\fR
-Reverse data for zone 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.
-.It \fIreverse RFC4193 IPv6 Locally Assigned Local Addresses\fR
+.TP 10
+\h'5'\fIreverse RFC3330 IP4 this, link\-local, testnet and broadcast\fR 
+Reverse data for zones 0.in\-addr.arpa, 254.169.in\-addr.arpa, 
+2.0.192.in\-addr.arpa, 255.255.255.255.in\-addr.arpa.
+.TP 10
+\h'5'\fIreverse RFC4291 IP6 unspecified\fR
+Reverse data for zone 
+.nf
+0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
+0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.
+.fi
+.TP 10
+\h'5'\fIreverse RFC4193 IPv6 Locally Assigned Local Addresses\fR
 Reverse data for zone D.F.ip6.arpa.
-.It \fIreverse RFC4291 IPv6 Link Local Addresses\fR
+.TP 10
+\h'5'\fIreverse RFC4291 IPv6 Link Local Addresses\fR
 Reverse data for zones 8.E.F.ip6.arpa to B.E.F.ip6.arpa.
-.El
+.TP 10
+\h'5'\fIreverse IPv6 Example Prefix\fR
+Reverse data for zone 8.B.D.0.1.0.0.2.ip6.arpa. This zone is used for
+tutorials and examples. You can remove the block on this zone with:
+.nf
+  local-zone: 8.B.D.0.1.0.0.2.ip6.arpa. nodefault
+.fi
+This also works with the other default zones.
 .\" End of local-zone listing.
-.It \fBlocal-data:\fR "<resource record string>"
+.TP 5
+.B local\-data: \fI"<resource record string>"
 Configure local data, which is served in reply to queries for it.
-The query has to match exactly unless you configure the local-zone as 
-redirect. If not matched exactly, the local-zone type determines
-further processing. If local-data is configured that is not a subdomain of
-a local-zone, a transparent local-zone is configured. 
+The query has to match exactly unless you configure the local\-zone as 
+redirect. If not matched exactly, the local\-zone type determines
+further processing. If local\-data is configured that is not a subdomain of
+a local\-zone, a transparent local\-zone is configured. 
 For record types such as TXT, use single quotes, as in 
-local-data: 'example. TXT "text"'.
-.El
-.Ss Stub Zone Options
+local\-data: 'example. TXT "text"'.
+.IP
+If you need more complicated authoritative data, with referrals, wildcards,
+CNAME/DNAME support, or DNSSEC authoritative service, setup a stub\-zone for
+it as detailed in the stub zone section below.
+.SS "Stub Zone Options"
+.LP
 There may be multiple
-.Ic stub-zone:
+.B stub\-zone:
 clauses. Each with a name: and zero or more hostnames or IP addresses.
 For the stub zone this list of nameservers is used. Class IN is assumed.
-.Bl -tag -width indent
-.It \fBname:\fR <domain name>
+.P
+The stub zone can be used to configure authoritative data to be used
+by the resolver that cannot be accessed using the public internet servers.
+This is useful for company\-local data or private zones. Setup an 
+authoritative server on a different host (or different port). Enter a config 
+entry for unbound with 
+.B stub\-addr:
+<ip address of host[@port]>. 
+The unbound resolver can then access the data, without referring to the 
+public internet for it. 
+.P
+This setup allows DNSSEC signed zones to be served by that 
+authoritative server, in which case a trusted key entry with the public key
+can be put in config, so that unbound can validate the data and set the AD 
+bit on replies for the private zone (authoritative servers do not set the 
+AD bit).  This setup makes unbound capable of answering queries for the 
+private zone, and can even set the AD bit ('authentic'), but the AA 
+('authoritative') bit is not set on these replies. 
+.TP
+.B name: \fI<domain name>
 Name of the stub zone.
-.It \fBstub-host:\fR <domain name>
+.TP
+.B stub\-host: \fI<domain name>
 Name of stub zone nameserver. Is itself resolved before it is used.
-.It \fBstub-addr:\fR <IP address>
+.TP
+.B stub\-addr: \fI<IP address>
 IP address of stub zone nameserver. Can be IP 4 or IP 6.
 To use a nondefault port for DNS communication append '@' with the port number.
-.El
-.Ss Forward Zone Options
+.SS "Forward Zone Options"
+.LP
 There may be multiple
-.Ic forward-zone:
+.B forward\-zone:
 clauses. Each with a name: and zero or more hostnames or IP addresses.
 For the forward zone this list of nameservers is used to forward the queries
 to. The servers have to handle further recursion for the query. Class IN is 
-assumed. A forward-zone entry with name "." and a forward-addr target will 
+assumed. A forward\-zone entry with name "." and a forward\-addr target will 
 forward all queries to that other server (unless it can answer from the cache).
-.Bl -tag -width indent
-.It \fBname:\fR <domain name>
+.TP
+.B name: \fI<domain name>
 Name of the forward zone.
-.It \fBforward-host:\fR <domain name>
+.TP
+.B forward\-host: \fI<domain name>
 Name of server to forward to. Is itself resolved before it is used.
-.It \fBforward-addr:\fR <IP address>
+.TP
+.B forward\-addr: \fI<IP address>
 IP address of server to forward to. Can be IP 4 or IP 6.
 To use a nondefault port for DNS communication append '@' with the port number.
-.El
-.Sh MEMORY CONTROL EXAMPLE
+.SH "MEMORY CONTROL EXAMPLE"
 In the example config settings below memory usage is reduced. Some service
 levels are lower, notable very large data and a high TCP load are no longer
 supported. Very large data and high TCP loads are exceptional for the DNS.
 DNSSEC validation is enabled, just add trust anchors.
-If you do not have to worry about programs using more than 1 meg of memory,
-the below example is not for you. Use the defaults to receive full service.
-.Pp
+If you do not have to worry about programs using more than 3 Mb of memory,
+the below example is not for you. Use the defaults to receive full service,
+which on BSD-32bit tops out at 30-40 Mb after heavy usage. 
+.P
 .nf
 # example settings that reduce memory usage
 server:
-	num-threads: 1
-	outgoing-num-tcp: 1	# this limits TCP service, uses less buffers.
-	incoming-num-tcp: 1
-	outgoing-range: 1	# uses less memory, but less port randomness.
-	msg-buffer-size: 8192   # note this limits service, 'no huge stuff'.
-	msg-cache-size: 102400  # 100 Kb.
-	msg-cache-slabs: 1
-	rrset-cache-size: 102400  # 100 Kb.
-	rrset-cache-slabs: 1
-	infra-cache-numhosts: 200
-	infra-cache-numlame: 10
-	key-cache-size: 102400  # 100 Kb.
-	key-cache-slabs: 1
-	num-queries-per-thread: 30
-	target-fetch-policy: "2 1 0 0 0 0"
-	harden-large-queries: "yes"
-	harden-short-bufsize: "yes"
-	do-ip6: no	# save a bit of memory if not used.
+	num\-threads: 1
+	outgoing\-num\-tcp: 1	# this limits TCP service, uses less buffers.
+	incoming\-num\-tcp: 1
+	outgoing\-range: 16	# uses less memory, but less performance.
+	msg\-buffer\-size: 8192   # note this limits service, 'no huge stuff'.
+	msg\-cache\-size: 100k
+	msg\-cache\-slabs: 1
+	rrset\-cache\-size: 100k
+	rrset\-cache\-slabs: 1
+	infra\-cache\-numhosts: 200
+	infra\-cache\-slabs: 1
+	infra\-cache\-lame\-size: 1k
+	key\-cache\-size: 100k
+	key\-cache\-slabs: 1
+	num\-queries\-per\-thread: 30
+	target\-fetch\-policy: "2 1 0 0 0 0"
+	harden\-large\-queries: "yes"
+	harden\-short\-bufsize: "yes"
 .fi
-.Sh FILES
-.Bl -tag -width indent
-.It Pa /etc/unbound
-default unbound working directory and default 
-.Xr chroot 2 
+.SH "FILES"
+.TP
+.I @UNBOUND_RUN_DIR@
+default unbound working directory.
+.TP
+.I @UNBOUND_CHROOT_DIR@
+default
+\fIchroot\fR(2)
 location.
-.It Pa unbound.conf
+.TP
+.I @ub_conf_file@
 unbound configuration file.
-.It Pa unbound.pid
+.TP
+.I @UNBOUND_PIDFILE@
 default unbound pidfile with process ID of the running daemon.
-.It Pa unbound.log
+.TP
+.I unbound.log
 unbound log file. default is to log to 
-.Xr syslog 3 .
-.El
-.Sh SEE ALSO
-.Xr unbound 8 , 
-.Xr unbound-checkconf 8 .
-.Sh AUTHORS
-.Ic Unbound 
+\fIsyslog\fR(3). 
+.SH "SEE ALSO"
+\fIunbound\fR(8), 
+\fIunbound\-checkconf\fR(8).
+.SH "AUTHORS"
+.B Unbound 
 was written by NLnet Labs. Please see CREDITS file
 in the distribution for further details.

iterator/iter_delegpt.h

@@ -106,6 +106,8 @@ struct delegpt_addr {
 	socklen_t addrlen;
 	/** number of attempts for this addr */
 	int attempts;
+	/** rtt stored here in the selection algorithm */
+	int sel_rtt;
 };
 
 /**

iterator/iter_donotq.c

@@ -103,7 +103,7 @@ donotq_insert(struct iter_donotq* dq, struct sockaddr_storage* addr,
 	node->net = net;
 	node->parent = NULL;
 	if(!rbtree_insert(dq->tree, &node->node)) {
-		verbose(VERB_DETAIL, "duplicate donotquery address ignored.");
+		verbose(VERB_QUERY, "duplicate donotquery address ignored.");
 	}
 	return 1;
 }
@@ -115,6 +115,7 @@ donotq_str_cfg(struct iter_donotq* dq, const char* str)
 	struct sockaddr_storage addr;
 	int net;
 	socklen_t addrlen;
+	verbose(VERB_ALGO, "donotq: %s", str);
 	if(!netblockstrtoaddr(str, UNBOUND_DNS_PORT, &addr, &addrlen, &net)) {
 		log_err("cannot parse donotquery netblock: %s", str);
 		return 0;
@@ -179,8 +180,10 @@ donotq_apply_cfg(struct iter_donotq* dq, struct config_file* cfg)
 	if(cfg->donotquery_localhost) {
 		if(!donotq_str_cfg(dq, "127.0.0.0/8"))
 			return 0;
-		if(!donotq_str_cfg(dq, "::1"))
-			return 0;
+		if(cfg->do_ip6) {
+			if(!donotq_str_cfg(dq, "::1"))
+				return 0;
+		}
 	}
 	donotq_init_parents(dq);
 	return 1;

iterator/iter_fwd.c

@@ -228,8 +228,8 @@ read_forwards(struct iter_forwards* fwd, struct config_file* cfg)
 			return 0;
 		if(!forwards_insert(fwd, LDNS_RR_CLASS_IN, dp))
 			return 0;
-		verbose(VERB_DETAIL, "Forward zone server list:");
-		delegpt_log(VERB_DETAIL, dp);
+		verbose(VERB_QUERY, "Forward zone server list:");
+		delegpt_log(VERB_QUERY, dp);
 	}
 	return 1;
 }

iterator/iter_hints.c

@@ -112,7 +112,7 @@ ah(struct delegpt* dp, struct regional* r, const char* sv, const char* ip)
 
 /** obtain compiletime provided root hints */
 static struct delegpt* 
-compile_time_root_prime(struct regional* r)
+compile_time_root_prime(struct regional* r, int do_ip4, int do_ip6)
 {
 	/* from:
 	 ;       This file is made available by InterNIC
@@ -121,14 +121,14 @@ compile_time_root_prime(struct regional* r)
 	 ;           on server           FTP.INTERNIC.NET
 	 ;       -OR-                    RS.INTERNIC.NET
 	 ;
-	 ;       last update:    Jan 29, 2004
-	 ;       related version of root zone:   2004012900
+	 ;       related version of root zone:   2008051300
 	 */
 	struct delegpt* dp = delegpt_create(r);
 	if(!dp)
 		return NULL;
 	if(!delegpt_set_name(dp, r, (uint8_t*)"\000"))
 		return NULL;
+      if(do_ip4) {
 	if(!ah(dp, r, "A.ROOT-SERVERS.NET.", "198.41.0.4"))	return 0;
 	if(!ah(dp, r, "B.ROOT-SERVERS.NET.", "192.228.79.201")) return 0;
 	if(!ah(dp, r, "C.ROOT-SERVERS.NET.", "192.33.4.12"))	return 0;
@@ -142,6 +142,15 @@ compile_time_root_prime(struct regional* r)
 	if(!ah(dp, r, "K.ROOT-SERVERS.NET.", "193.0.14.129"))	return 0;
 	if(!ah(dp, r, "L.ROOT-SERVERS.NET.", "199.7.83.42"))	return 0;
 	if(!ah(dp, r, "M.ROOT-SERVERS.NET.", "202.12.27.33"))	return 0;
+      }
+      if(do_ip6) {
+	if(!ah(dp, r, "A.ROOT-SERVERS.NET.", "2001:503:ba3e::2:30")) return 0;
+	if(!ah(dp, r, "F.ROOT-SERVERS.NET.", "2001:500:2f::f")) return 0;
+	if(!ah(dp, r, "H.ROOT-SERVERS.NET.", "2001:500:1::803f:235")) return 0;
+	if(!ah(dp, r, "J.ROOT-SERVERS.NET.", "2001:503:c27::2:30")) return 0;
+	if(!ah(dp, r, "K.ROOT-SERVERS.NET.", "2001:7fd::1")) return 0;
+	if(!ah(dp, r, "M.ROOT-SERVERS.NET.", "2001:dc3::35")) return 0;
+      }
 	return dp;
 }
 
@@ -285,7 +294,7 @@ read_stubs(struct iter_hints* hints, struct config_file* cfg)
 			return 0;
 		if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp))
 			return 0;
-		delegpt_log(VERB_DETAIL, dp);
+		delegpt_log(VERB_QUERY, dp);
 	}
 	return 1;
 }
@@ -314,7 +323,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 		fclose(f);
 		return 0;
 	}
-	verbose(VERB_DETAIL, "Reading root hints from %s", fname);
+	verbose(VERB_QUERY, "Reading root hints from %s", fname);
 	while(!feof(f)) {
 		status = ldns_rr_new_frm_fp_l(&rr, f, 
 			&default_ttl, &origin, &prev_rr, &lineno);
@@ -325,23 +334,20 @@ read_root_hints(struct iter_hints* hints, char* fname)
 		if(status != LDNS_STATUS_OK) {
 			log_err("reading root hints %s %d: %s", fname,
 				lineno, ldns_get_errorstr_by_id(status));
-			fclose(f);
-			return 0;
+			goto stop_read;
 		}
 		if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NS) {
 			if(!delegpt_add_ns(dp, hints->region,
 				ldns_rdf_data(ldns_rr_rdf(rr, 0)))) {
 				log_err("out of memory reading root hints");
-				fclose(f);
-				return 0;
+				goto stop_read;
 			}
 			c = ldns_rr_get_class(rr);
 			if(!dp->name) {
 				if(!delegpt_set_name(dp, hints->region, 
 					ldns_rdf_data(ldns_rr_owner(rr)))){
 					log_err("out of memory.");
-					fclose(f);
-					return 0;
+					goto stop_read;
 				}
 			}
 		} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_A) {
@@ -357,8 +363,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 					ldns_rdf_size(ldns_rr_owner(rr)),
 					(struct sockaddr_storage*)&sa, len)) {
 				log_err("out of memory reading root hints");
-				fclose(f);
-				return 0;
+				goto stop_read;
 			}
 		} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_AAAA) {
 			struct sockaddr_in6 sa;
@@ -373,8 +378,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 					ldns_rdf_size(ldns_rr_owner(rr)),
 					(struct sockaddr_storage*)&sa, len)) {
 				log_err("out of memory reading root hints");
-				fclose(f);
-				return 0;
+				goto stop_read;
 			}
 		} else {
 			log_warn("root hints %s:%d skipping type %d",
@@ -383,6 +387,11 @@ read_root_hints(struct iter_hints* hints, char* fname)
 
 		ldns_rr_free(rr);
 	}
+
+	if (origin)
+		ldns_rdf_deep_free(origin);
+	if (prev_rr)
+		ldns_rdf_deep_free(prev_rr);
 	fclose(f);
 	if(!dp->name) {
 		log_warn("root hints %s: no NS content", fname);
@@ -391,8 +400,16 @@ read_root_hints(struct iter_hints* hints, char* fname)
 	if(!hints_insert(hints, c, dp)) {
 		return 0;
 	}
-	delegpt_log(VERB_DETAIL, dp);
+	delegpt_log(VERB_QUERY, dp);
 	return 1;
+
+stop_read:
+	if (origin)
+		ldns_rdf_deep_free(origin);
+	if (prev_rr)
+		ldns_rdf_deep_free(prev_rr);
+	fclose(f);
+	return 0;
 }
 
 /** read root hints list */
@@ -403,7 +420,12 @@ read_root_hints_list(struct iter_hints* hints, struct config_file* cfg)
 	for(p = cfg->root_hints; p; p = p->next) {
 		log_assert(p->str);
 		if(p->str && p->str[0]) {
-			if(!read_root_hints(hints, p->str))
+			char* f = p->str;
+			if(cfg->chrootdir && cfg->chrootdir[0] &&
+				strncmp(p->str, cfg->chrootdir, 
+				strlen(cfg->chrootdir)) == 0)
+				f += strlen(cfg->chrootdir);
+			if(!read_root_hints(hints, f))
 				return 0;
 		}
 	}
@@ -428,13 +450,13 @@ hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg)
 
 	/* use fallback compiletime root hints */
 	if(!hints_lookup_root(hints, LDNS_RR_CLASS_IN)) {
-		struct delegpt* dp = compile_time_root_prime(hints->region);
+		struct delegpt* dp = compile_time_root_prime(hints->region,
+			cfg->do_ip4, cfg->do_ip6);
 		verbose(VERB_ALGO, "no config, using builtin root hints.");
 		if(!dp) 
 			return 0;
 		if(!hints_insert(hints, LDNS_RR_CLASS_IN, dp))
 			return 0;
-		delegpt_log(VERB_DETAIL, dp);
 	}
 
 	init_parents(hints);

iterator/iter_resptype.c

@@ -104,6 +104,7 @@ response_type_from_server(int rdset,
 	struct dns_msg* msg, struct query_info* request, struct delegpt* dp)
 {
 	uint8_t* origzone = (uint8_t*)"\000"; /* the default */
+	struct ub_packed_rrset_key* s;
 	size_t origzonelen = 1;
 	size_t i;
 
@@ -188,12 +189,10 @@ response_type_from_server(int rdset,
 	}
 
 	/* Looking at the authority section, we just look and see if 
-	 * there is a delegation NS set, turning it into a delegation. 
-	 * Otherwise, we will have to conclude ANSWER (either it is 
-	 * NOERROR/NODATA, or an non-authoritative answer). */
+	 * there is a SOA record, that means a NOERROR/NODATA */
 	for(i = msg->rep->an_numrrsets; i < (msg->rep->an_numrrsets +
 		msg->rep->ns_numrrsets); i++) {
-		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
+		s = msg->rep->rrsets[i];
 
 		/* The normal way of detecting NOERROR/NODATA. */
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_SOA &&
@@ -204,19 +203,32 @@ response_type_from_server(int rdset,
 				return RESPONSE_TYPE_LAME;
 			return RESPONSE_TYPE_ANSWER;
 		}
+	}
+	/* Looking at the authority section, we just look and see if 
+	 * there is a delegation NS set, turning it into a delegation. 
+	 * Otherwise, we will have to conclude ANSWER (either it is 
+	 * NOERROR/NODATA, or an non-authoritative answer). */
+	for(i = msg->rep->an_numrrsets; i < (msg->rep->an_numrrsets +
+		msg->rep->ns_numrrsets); i++) {
+		s = msg->rep->rrsets[i];
 
 		/* Detect REFERRAL/LAME/ANSWER based on the relationship 
 		 * of the NS set to the originating zone name. */
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_NS) {
 			/* If we are getting an NS set for the zone we 
 			 * thought we were contacting, then it is an answer.*/
-			/* FIXME: is this correct? */
 			if(query_dname_compare(s->rk.dname, origzone) == 0) {
 				/* see if mistakenly a recursive server was
 				 * deployed and is responding nonAA */
 				if( (msg->rep->flags&BIT_RA) &&
 					!(msg->rep->flags&BIT_AA) && !rdset)
 					return RESPONSE_TYPE_LAME;
+				/* Or if a lame server is deployed,
+				 * which gives ns==zone delegation from cache 
+				 * without AA bit as well, with nodata nosoa*/
+				if(msg->rep->an_numrrsets==0 &&
+					!(msg->rep->flags&BIT_AA) && !rdset)
+					return RESPONSE_TYPE_LAME;
 				return RESPONSE_TYPE_ANSWER;
 			}
 			/* If we are getting a referral upwards (or to 

iterator/iter_scrub.c

@@ -60,11 +60,11 @@ static void
 remove_rrset(const char* str, ldns_buffer* pkt, struct msg_parse* msg, 
 	struct rrset_parse* prev, struct rrset_parse** rrset)
 {
-	if(verbosity >= VERB_DETAIL 
+	if(verbosity >= VERB_QUERY 
 		&& (*rrset)->dname_len <= LDNS_MAX_DOMAINLEN) {
 		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
 		dname_pkt_copy(pkt, buf, (*rrset)->dname);
-		log_nametypeclass(VERB_DETAIL, str, buf, 
+		log_nametypeclass(VERB_QUERY, str, buf, 
 			(*rrset)->type, ntohs((*rrset)->rrset_class));
 	}
 	if(prev)
@@ -189,7 +189,11 @@ parse_get_cname_target(struct rrset_parse* rrset, uint8_t** sname,
 	if(rrset->rr_count != 1) {
 		verbose(VERB_ALGO, "Found CNAME rrset with "
 			"size > 1: %u", (unsigned)rrset->rr_count);
-		return 0;
+		/* use the first CNAME! */
+		rrset->rr_count = 1;
+		rrset->size = rrset->rr_first->size;
+		rrset->rr_last = rrset->rr_first;
+		rrset->rr_first->next = NULL;
 	}
 	if(rrset->rr_first->size < sizeof(uint16_t)+1)
 		return 0; /* CNAME rdata too small */
@@ -316,7 +320,7 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 {
 	uint8_t* sname = qinfo->qname;
 	size_t snamelen = qinfo->qname_len;
-	struct rrset_parse* rrset, *prev;
+	struct rrset_parse* rrset, *prev, *nsset=NULL;
 
 	if(FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NOERROR &&
 		FLAGS_GET_RCODE(msg->flags) != LDNS_RCODE_NXDOMAIN)
@@ -412,7 +416,10 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 		}
 
 		/* Mark the additional names from relevant rrset as OK. */
-		mark_additional_rrset(pkt, msg, rrset);
+		/* only for RRsets that match the query name, other ones
+		 * will be removed by sanitize, so no additional for them */
+		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) == 0)
+			mark_additional_rrset(pkt, msg, rrset);
 		
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
@@ -420,6 +427,24 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 
 	/* Mark additional names from AUTHORITY */
 	while(rrset && rrset->section == LDNS_SECTION_AUTHORITY) {
+		if(rrset->type==LDNS_RR_TYPE_DNAME ||
+			rrset->type==LDNS_RR_TYPE_CNAME ||
+			rrset->type==LDNS_RR_TYPE_A ||
+			rrset->type==LDNS_RR_TYPE_AAAA) {
+			remove_rrset("normalize: removing irrelevant "
+				"RRset:", pkt, msg, prev, &rrset);
+			continue;
+		}
+		/* only one NS set allowed in authority section */
+		if(rrset->type==LDNS_RR_TYPE_NS) {
+			if(nsset == NULL) {
+				nsset = rrset;
+			} else {
+				remove_rrset("normalize: removing irrelevant "
+					"RRset:", pkt, msg, prev, &rrset);
+				continue;
+			}
+		}
 		mark_additional_rrset(pkt, msg, rrset);
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
@@ -443,6 +468,13 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 				continue;
 			}
 		}
+		if(rrset->type==LDNS_RR_TYPE_DNAME || 
+			rrset->type==LDNS_RR_TYPE_CNAME ||
+			rrset->type==LDNS_RR_TYPE_NS) {
+			remove_rrset("normalize: removing irrelevant "
+				"RRset:", pkt, msg, prev, &rrset);
+			continue;
+		}
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -467,7 +499,7 @@ store_rrset(ldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
 	struct ub_packed_rrset_key* k;
 	struct packed_rrset_data* d;
 	struct rrset_ref ref;
-	uint32_t now = time(NULL);
+	uint32_t now = *env->now;
 
 	k = alloc_special_obtain(env->alloc);
 	if(!k)
@@ -494,18 +526,47 @@ store_rrset(ldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
  *
  * @param pkt: packet.
  * @param msg: msg to normalize.
+ * @param qinfo: the question originally asked.
  * @param zonename: name of server zone.
  * @param env: module environment with config and cache.
  * @return 0 on error.
  */
 static int
-scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg, uint8_t* zonename,
-	struct module_env* env)
+scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg, 
+	struct query_info* qinfo, uint8_t* zonename, struct module_env* env)
 {
 	struct rrset_parse* rrset, *prev;
 	prev = NULL;
 	rrset = msg->rrset_first;
 
+	/* the first DNAME is allowed to stay. It needs checking before
+	 * it can be used from the cache. After normalization, an initial 
+	 * DNAME will have a correctly synthesized CNAME after it. */
+	if(rrset && rrset->type == LDNS_RR_TYPE_DNAME && 
+		rrset->section == LDNS_SECTION_ANSWER &&
+		pkt_strict_sub(pkt, qinfo->qname, rrset->dname) &&
+		pkt_sub(pkt, rrset->dname, zonename)) {
+		prev = rrset; /* DNAME allowed to stay in answer section */
+		rrset = rrset->rrset_all_next;
+	}
+	
+	/* remove all records from the answer section that are 
+	 * not the same domain name as the query domain name.
+	 * The answer section should contain rrsets with the same name
+	 * as the question. For DNAMEs a CNAME has been synthesized.
+	 * Wildcards have the query name in answer section.
+	 * ANY queries get query name in answer section.
+	 * Remainders of CNAME chains are cut off and resolved by iterator. */
+	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
+		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) != 0) {
+			remove_rrset("sanitize: removing extraneous answer "
+				"RRset:", pkt, msg, prev, &rrset);
+			continue;
+		}
+		prev = rrset;
+		rrset = rrset->rrset_all_next;
+	}
+
 	/* At this point, we brutally remove ALL rrsets that aren't 
 	 * children of the originating zone. The idea here is that, 
 	 * as far as we know, the server that we contacted is ONLY 
@@ -513,6 +574,8 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg, uint8_t* zonename,
 	 * be authoriative for any other zones, and of course, MAY 
 	 * NOT be authoritative for some subdomains of the originating 
 	 * zone. */
+	prev = NULL;
+	rrset = msg->rrset_first;
 	while(rrset) {
 		
 		/* skip DNAME records -- they will always be followed by a 
@@ -564,6 +627,14 @@ scrub_message(ldns_buffer* pkt, struct msg_parse* msg,
 	if( !(msg->flags&BIT_QR) )
 		return 0;
 	
+	/* make sure that a query is echoed back when NOERROR or NXDOMAIN */
+	/* this is not required for basic operation but is a forgery 
+	 * resistance (security) feature */
+	if((FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NOERROR ||
+		FLAGS_GET_RCODE(msg->flags) == LDNS_RCODE_NXDOMAIN) &&
+		msg->qdcount == 0)
+		return 0;
+
 	/* if a query is echoed back, make sure it is correct. Otherwise,
 	 * this may be not a reply to our query. */
 	if(msg->qdcount == 1) {
@@ -577,7 +648,7 @@ scrub_message(ldns_buffer* pkt, struct msg_parse* msg,
 	if(!scrub_normalize(pkt, msg, qinfo, region))
 		return 0;
 	/* delete all out-of-zone information */
-	if(!scrub_sanitize(pkt, msg, zonename, env))
+	if(!scrub_sanitize(pkt, msg, qinfo, zonename, env))
 		return 0;
 	return 1;
 }

iterator/iter_utils.c

@@ -102,7 +102,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 	if(!read_fetch_policy(iter_env, cfg->target_fetch_policy))
 		return 0;
 	for(i=0; i<iter_env->max_dependency_depth+1; i++)
-		verbose(VERB_DETAIL, "target fetch policy for level %d is %d",
+		verbose(VERB_QUERY, "target fetch policy for level %d is %d",
 			i, iter_env->target_fetch_policy[i]);
 	
 	if(!iter_env->hints)
@@ -130,7 +130,8 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 /** filter out unsuitable targets, return rtt or -1 */
 static int
 iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
-	uint8_t* name, size_t namelen, time_t now, struct delegpt_addr* a)
+	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
+	struct delegpt_addr* a)
 {
 	int rtt;
 	int lame;
@@ -143,7 +144,7 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	}
 	/* check lameness - need zone , class info */
 	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen, 
-		name, namelen, &lame, &dnsseclame, &rtt, now)) {
+		name, namelen, qtype, &lame, &dnsseclame, &rtt, now)) {
 		if(lame)
 			return -1; /* server is lame */
 		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT)
@@ -156,38 +157,61 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	return UNKNOWN_SERVER_NICENESS;
 }
 
+/** lookup RTT information, and also store fastest rtt (if any) */
+static int
+iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
+	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
+	struct delegpt* dp, int* best_rtt)
+{
+	int got_it = 0;
+	struct delegpt_addr* a;
+	for(a=dp->result_list; a; a = a->next_result) {
+		a->sel_rtt = iter_filter_unsuitable(iter_env, env, 
+			name, namelen, qtype, now, a);
+		if(a->sel_rtt != -1) {
+			if(!got_it) {
+				*best_rtt = a->sel_rtt;
+				got_it = 1;
+			} else if(a->sel_rtt < *best_rtt) {
+				*best_rtt = a->sel_rtt;
+			}
+		}
+	}
+	return got_it;
+}
+
 /** filter the addres list, putting best targets at front,
  * returns number of best targets (or 0, no suitable targets) */
 static int
 iter_filter_order(struct iter_env* iter_env, struct module_env* env,
-	uint8_t* name, size_t namelen, time_t now, struct delegpt* dp,
-	int* best_rtt)
+	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
+	struct delegpt* dp, int* selected_rtt)
 {
-	int got_num = 0, got_rtt = 0, thisrtt, swap_to_front;
+	int got_num = 0, low_rtt = 0, swap_to_front;
 	struct delegpt_addr* a, *n, *prev=NULL;
 
+	/* fillup sel_rtt and find best rtt in the bunch */
+	got_num = iter_fill_rtt(iter_env, env, name, namelen, qtype, now, dp, 
+		&low_rtt);
+	if(got_num == 0) 
+		return 0;
+
+	got_num = 0;
 	a = dp->result_list;
 	while(a) {
-		/* filter out unsuitable targets */
-		thisrtt = iter_filter_unsuitable(iter_env, env, name, namelen, 
-			now, a);
-		if(thisrtt == -1) {
+		/* skip unsuitable targets */
+		if(a->sel_rtt == -1) {
 			prev = a;
 			a = a->next_result;
 			continue;
 		}
 		/* classify the server address and determine what to do */
 		swap_to_front = 0;
-		if(got_num == 0) {
-			got_rtt = thisrtt;
-			got_num = 1;
-			swap_to_front = 1;
-		} else if(thisrtt == got_rtt) {
+		if(a->sel_rtt >= low_rtt && a->sel_rtt - low_rtt <= RTT_BAND) {
 			got_num++;
 			swap_to_front = 1;
-		} else if(thisrtt < got_rtt) {
-			got_rtt = thisrtt;
-			got_num = 1; /* start back at count of 1 */
+		} else if(a->sel_rtt<low_rtt && low_rtt-a->sel_rtt<=RTT_BAND) {
+			got_num++;
 			swap_to_front = 1;
 		}
 		/* swap to front if necessary, or move to next result */
@@ -202,21 +226,20 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 			a = a->next_result;
 		}
 	}
-	*best_rtt = got_rtt;
+	*selected_rtt = low_rtt;
 	return got_num;
 }
 
 struct delegpt_addr* 
 iter_server_selection(struct iter_env* iter_env, 
 	struct module_env* env, struct delegpt* dp, 
-	uint8_t* name, size_t namelen, int* dnssec_expected)
+	uint8_t* name, size_t namelen, uint16_t qtype, int* dnssec_expected)
 {
-	time_t now = time(NULL);
 	int sel;
 	int selrtt;
 	struct delegpt_addr* a, *prev;
-	int num = iter_filter_order(iter_env, env, name, namelen, now, dp,
-		&selrtt);
+	int num = iter_filter_order(iter_env, env, name, namelen, qtype,
+		*env->now, dp, &selrtt);
 
 	if(num == 0)
 		return NULL;
@@ -313,7 +336,7 @@ causes_cycle(struct module_qstate* qstate, uint8_t* name, size_t namelen,
 	qinf.qname_len = namelen;
 	qinf.qtype = t;
 	qinf.qclass = c;
-	log_assert(fptr_whitelist_modenv_detect_cycle(
+	fptr_ok(fptr_whitelist_modenv_detect_cycle(
 		qstate->env->detect_cycle));
 	return (*qstate->env->detect_cycle)(qstate, &qinf, 
 		(uint16_t)(BIT_RD|BIT_CD), qstate->is_priming);
@@ -331,7 +354,7 @@ iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
 			LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass) ||
 		   causes_cycle(qstate, ns->name, ns->namelen, 
 			LDNS_RR_TYPE_A, qstate->qinfo.qclass)) {
-			log_nametypeclass(VERB_DETAIL, "skipping target due "
+			log_nametypeclass(VERB_QUERY, "skipping target due "
 			 	"to dependency cycle (harden-glue: no may "
 				"fix some of the cycles)", 
 				ns->name, LDNS_RR_TYPE_A, 

iterator/iter_utils.h

@@ -74,6 +74,7 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
  * @param dp: delegation point with result list.
  * @param name: zone name (for lameness check).
  * @param namelen: length of name.
+ * @param qtype: query type that we want to send.
  * @param dnssec_expected: set to 0, if a known dnssec-lame server is selected
  *	these are not preferred, but are used as a last resort.
  * @return best target or NULL if no target.
@@ -81,7 +82,7 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
  */
 struct delegpt_addr* iter_server_selection(struct iter_env* iter_env, 
 	struct module_env* env, struct delegpt* dp, uint8_t* name, 
-	size_t namelen, int* dnssec_expected);
+	size_t namelen, uint16_t qtype, int* dnssec_expected);
 
 /**
  * Allocate dns_msg from parsed msg, in regional.

iterator/iterator.c

@@ -80,7 +80,7 @@ void
 iter_deinit(struct module_env* env, int id)
 {
 	struct iter_env* iter_env;
-	if(!env || !env->modinfo || !env->modinfo[id])
+	if(!env || !env->modinfo[id])
 		return;
 	iter_env = (struct iter_env*)env->modinfo[id];
 	free(iter_env->target_fetch_policy);
@@ -188,7 +188,8 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 			/* not interested */
 			verbose(VERB_ALGO, "subq error, but not interested");
 			log_query_info(VERB_ALGO, "superq", &super->qinfo);
-			delegpt_log(VERB_ALGO, super_iq->dp);
+			if(super_iq->dp)
+				delegpt_log(VERB_ALGO, super_iq->dp);
 			log_assert(0);
 			return;
 		}
@@ -215,7 +216,7 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 static int
 error_response(struct module_qstate* qstate, int id, int rcode)
 {
-	verbose(VERB_DETAIL, "return error response %s", 
+	verbose(VERB_QUERY, "return error response %s", 
 		ldns_lookup_by_id(ldns_rcodes, rcode)?
 		ldns_lookup_by_id(ldns_rcodes, rcode)->name:"??");
 	qstate->return_rcode = rcode;
@@ -455,7 +456,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	qflags |= BIT_CD;
 
 	/* attach subquery, lookup existing or make a new one */
-	log_assert(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
+	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
 	if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, &subq)) {
 		return 0;
 	}
@@ -468,7 +469,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 			sizeof(struct iter_qstate));
 		if(!subq->minfo[id]) {
 			log_err("init subq: out of memory");
-			log_assert(fptr_whitelist_modenv_kill_sub(
+			fptr_ok(fptr_whitelist_modenv_kill_sub(
 				qstate->env->kill_sub));
 			(*qstate->env->kill_sub)(subq);
 			return 0;
@@ -502,7 +503,7 @@ prime_root(struct module_qstate* qstate, struct iter_qstate* iq,
 {
 	struct delegpt* dp;
 	struct module_qstate* subq;
-	verbose(VERB_ALGO, "priming . NS %s", 
+	verbose(VERB_DETAIL, "priming . %s NS", 
 		ldns_lookup_by_id(ldns_rr_classes, (int)qclass)?
 		ldns_lookup_by_id(ldns_rr_classes, (int)qclass)->name:"??");
 	dp = hints_lookup_root(ie->hints, qclass);
@@ -586,7 +587,7 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq,
 		subiq->dp = delegpt_copy(stub_dp, subq->region);
 		if(!subiq->dp) {
 			log_err("out of memory priming stub, copydp");
-			log_assert(fptr_whitelist_modenv_kill_sub(
+			fptr_ok(fptr_whitelist_modenv_kill_sub(
 				qstate->env->kill_sub));
 			(*qstate->env->kill_sub)(subq);
 			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
@@ -661,7 +662,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 	/* We enforce a maximum number of query restarts. This is primarily a
 	 * cheap way to prevent CNAME loops. */
 	if(iq->query_restart_count > MAX_RESTART_COUNT) {
-		verbose(VERB_DETAIL, "request has exceeded the maximum number"
+		verbose(VERB_QUERY, "request has exceeded the maximum number"
 			" of query restarts with %d", iq->query_restart_count);
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
@@ -672,7 +673,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 	 * of work required to answer a given query. */
 	verbose(VERB_ALGO, "request has dependency depth of %d", iq->depth);
 	if(iq->depth > ie->max_dependency_depth) {
-		verbose(VERB_DETAIL, "request has exceeded the maximum "
+		verbose(VERB_QUERY, "request has exceeded the maximum "
 			"dependency depth with depth of %d", iq->depth);
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
@@ -758,7 +759,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * cache needs to be primed for the qclass. */
 		iq->dp = dns_cache_find_delegation(qstate->env, delname, 
 			delnamelen, iq->qchase.qtype, iq->qchase.qclass, 
-			qstate->region, &iq->deleg_msg, (uint32_t)time(NULL));
+			qstate->region, &iq->deleg_msg, *qstate->env->now);
 
 		/* If the cache has returned nothing, then we have a 
 		 * root priming situation. */
@@ -791,7 +792,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(iter_dp_is_useless(qstate, iq->dp)) {
 			if(dname_is_root(iq->dp->name)) {
 				/* use safety belt */
-				verbose(VERB_DETAIL, "Cache has root NS but "
+				verbose(VERB_QUERY, "Cache has root NS but "
 				"no addresses. Fallback to the safety belt.");
 				iq->dp = hints_lookup_root(ie->hints, 
 					iq->qchase.qclass);
@@ -824,17 +825,6 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 	verbose(VERB_ALGO, "cache delegation returns delegpt");
 	delegpt_log(VERB_ALGO, iq->dp);
 
-	/* if the cache reply dp equals a validation anchor or msg has DS,
-	 * then DNSSEC RRSIGs are expected in the reply */
-	iq->dnssec_expected = iter_indicates_dnssec(qstate->env, iq->dp, 
-		iq->deleg_msg, iq->qchase.qclass);
-
-	/* Reset the RD flag. If this is a query restart, then the RD 
-	 * will have been turned off. */
-	if(qstate->query_flags & BIT_RD)
-		iq->chase_flags |= BIT_RD;
-	else	iq->chase_flags &= ~BIT_RD;
-
 	/* Otherwise, set the current delegation point and move on to the 
 	 * next state. */
 	return next_state(iq, INIT_REQUEST_2_STATE);
@@ -860,7 +850,7 @@ static int
 processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq,
 	struct iter_env* ie, int id)
 {
-	log_query_info(VERB_DETAIL, "resolving (init part 2): ", 
+	log_query_info(VERB_QUERY, "resolving (init part 2): ", 
 		&qstate->qinfo);
 
 	/* Check to see if we need to prime a stub zone. */
@@ -887,11 +877,16 @@ processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq,
 static int
 processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq)
 {
-	log_query_info(VERB_DETAIL, "resolving (init part 3): ", 
+	log_query_info(VERB_QUERY, "resolving (init part 3): ", 
 		&qstate->qinfo);
+	/* if the cache reply dp equals a validation anchor or msg has DS,
+	 * then DNSSEC RRSIGs are expected in the reply */
+	iq->dnssec_expected = iter_indicates_dnssec(qstate->env, iq->dp, 
+		iq->deleg_msg, iq->qchase.qclass);
+
 	/* If the RD flag wasn't set, then we just finish with the 
 	 * cached referral as the response. */
-	if(!(iq->chase_flags & BIT_RD)) {
+	if(!(qstate->query_flags & BIT_RD)) {
 		iq->response = iq->deleg_msg;
 		if(verbosity >= VERB_ALGO)
 			log_dns_msg("no RD requested, using delegation msg", 
@@ -937,7 +932,7 @@ generate_target_query(struct module_qstate* qstate, struct iter_qstate* iq,
 			subiq->dp = delegpt_copy(iq->dp, subq->region);
 		}
 	}
-	log_nametypeclass(VERB_DETAIL, "new target", name, qtype, qclass);
+	log_nametypeclass(VERB_QUERY, "new target", name, qtype, qclass);
 	return 1;
 }
 
@@ -1051,7 +1046,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	 * needs to send a query to. That is, at least one per referral, 
 	 * more if some targets timeout or return throwaway answers. */
 
-	log_query_info(VERB_DETAIL, "processQueryTargets:", &qstate->qinfo);
+	log_query_info(VERB_QUERY, "processQueryTargets:", &qstate->qinfo);
 	verbose(VERB_ALGO, "processQueryTargets: targetqueries %d, "
 		"currentqueries %d", iq->num_target_queries, 
 		iq->num_current_queries);
@@ -1060,7 +1055,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	/* Make sure that we haven't run away */
 	/* FIXME: is this check even necessary? */
 	if(iq->referral_count > MAX_REFERRAL_COUNT) {
-		verbose(VERB_DETAIL, "request has exceeded the maximum "
+		verbose(VERB_QUERY, "request has exceeded the maximum "
 			"number of referrrals with %d", iq->referral_count);
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
@@ -1068,7 +1063,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	/* Make sure we have a delegation point, otherwise priming failed
 	 * or another failure occurred */
 	if(!iq->dp) {
-		verbose(VERB_DETAIL, "Failed to get a delegation, giving up");
+		verbose(VERB_QUERY, "Failed to get a delegation, giving up");
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 	delegpt_log(VERB_ALGO, iq->dp);
@@ -1105,7 +1100,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	/* Select the next usable target, filtering out unsuitable targets. */
 	target = iter_server_selection(ie, qstate->env, iq->dp, 
-		iq->dp->name, iq->dp->namelen, &iq->dnssec_expected);
+		iq->dp->name, iq->dp->namelen, iq->qchase.qtype,
+		&iq->dnssec_expected);
 
 	/* If no usable target was selected... */
 	if(!target) {
@@ -1136,7 +1132,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* Since a target query might have been made, we 
 			 * need to check again. */
 			if(iq->num_target_queries == 0) {
-				verbose(VERB_DETAIL, "out of query targets -- "
+				verbose(VERB_QUERY, "out of query targets -- "
 					"returning SERVFAIL");
 				/* fail -- no more targets, no more hope 
 				 * of targets, no hope of a response. */
@@ -1163,18 +1159,19 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 
 	/* We have a valid target. */
-	log_query_info(VERB_DETAIL, "sending query:", &iq->qchase);
-	log_name_addr(VERB_DETAIL, "sending to target:", iq->dp->name, 
+	log_query_info(VERB_QUERY, "sending query:", &iq->qchase);
+	log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, 
 		&target->addr, target->addrlen);
-	log_assert(fptr_whitelist_modenv_send_query(qstate->env->send_query));
+	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
 	outq = (*qstate->env->send_query)(
 		iq->qchase.qname, iq->qchase.qname_len, 
 		iq->qchase.qtype, iq->qchase.qclass, 
 		iq->chase_flags, EDNS_DO|BIT_CD, 
 		&target->addr, target->addrlen, qstate);
 	if(!outq) {
-		log_err("error sending query to auth server; skip this address");
-		log_addr(0, "error for address:", 
+		verbose(VERB_OPS, "error sending query to auth server; "
+			"skip this address");
+		log_addr(VERB_OPS, "error for address:", 
 			&target->addr, target->addrlen);
 		return next_state(iq, QUERYTARGETS_STATE);
 	}
@@ -1244,7 +1241,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* close down outstanding requests to be discarded */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
-		log_assert(fptr_whitelist_modenv_detach_subs(
+		fptr_ok(fptr_whitelist_modenv_detach_subs(
 			qstate->env->detach_subs));
 		(*qstate->env->detach_subs)(qstate);
 		iq->num_target_queries = 0;
@@ -1282,7 +1279,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
-		log_assert(fptr_whitelist_modenv_detach_subs(
+		fptr_ok(fptr_whitelist_modenv_detach_subs(
 			qstate->env->detach_subs));
 		(*qstate->env->detach_subs)(qstate);
 		iq->num_target_queries = 0;
@@ -1324,7 +1321,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
-		log_assert(fptr_whitelist_modenv_detach_subs(
+		fptr_ok(fptr_whitelist_modenv_detach_subs(
 			qstate->env->detach_subs));
 		(*qstate->env->detach_subs)(qstate);
 		iq->num_target_queries = 0;
@@ -1340,8 +1337,9 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			 * gotten this from cache, so test to be sure */
 			if(!infra_set_lame(qstate->env->infra_cache, 
 				&qstate->reply->addr, qstate->reply->addrlen, 
-				iq->dp->name, iq->dp->namelen, time(NULL),
-				dnsseclame))
+				iq->dp->name, iq->dp->namelen, 
+				*qstate->env->now, dnsseclame, 
+				iq->qchase.qtype))
 				log_err("mark host lame: out of memory");
 		} else log_err("%slame response from cache",
 			dnsseclame?"DNSSEC ":"");
@@ -1527,7 +1525,7 @@ static int
 processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 	int id)
 {
-	log_query_info(VERB_DETAIL, "finishing processing for", 
+	log_query_info(VERB_QUERY, "finishing processing for", 
 		&qstate->qinfo);
 
 	if(!iq->response) {
@@ -1570,11 +1568,6 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 					LDNS_RCODE_SERVFAIL);
 		}
 	}
-	if(query_dname_compare(qstate->qinfo.qname, 
-		iq->response->qinfo.qname) == 0) {
-		/* use server supplied upper/lower case */
-		qstate->qinfo.qname = iq->response->qinfo.qname;
-	}
 	qstate->return_rcode = LDNS_RCODE_NOERROR;
 	qstate->return_msg = iq->response;
 	return 0;
@@ -1726,7 +1719,8 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 	iq->response = dns_alloc_msg(pkt, prs, qstate->region);
 	if(!iq->response)
 		goto handle_it;
-	log_name_addr(VERB_DETAIL, "incoming packet from target:", iq->dp->name, 
+	log_query_info(VERB_DETAIL, "response for", &qstate->qinfo);
+	log_name_addr(VERB_DETAIL, "reply from", iq->dp->name, 
 		&qstate->reply->addr, qstate->reply->addrlen);
 	if(verbosity >= VERB_ALGO)
 		log_dns_msg("incoming scrubbed packet:", &iq->response->qinfo, 
@@ -1743,12 +1737,12 @@ iter_operate(struct module_qstate* qstate, enum module_ev event, int id,
 {
 	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
 	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
-	verbose(VERB_DETAIL, "iterator[module %d] operate: extstate:%s event:%s", 
+	verbose(VERB_QUERY, "iterator[module %d] operate: extstate:%s event:%s", 
 		id, strextstate(qstate->ext_state[id]), strmodulevent(event));
-	if(iq) log_query_info(VERB_DETAIL, "iterator operate: query", 
+	if(iq) log_query_info(VERB_QUERY, "iterator operate: query", 
 		&qstate->qinfo);
 	if(iq && qstate->qinfo.qname != iq->qchase.qname)
-		log_query_info(VERB_DETAIL, "iterator operate: chased to", 
+		log_query_info(VERB_QUERY, "iterator operate: chased to", 
 			&iq->qchase);
 
 	/* perform iterator state machine */
@@ -1762,11 +1756,11 @@ iter_operate(struct module_qstate* qstate, enum module_ev event, int id,
 		process_request(qstate, iq, ie, id);
 		return;
 	}
-	if(event == module_event_pass) {
+	if(iq && event == module_event_pass) {
 		iter_handle(qstate, iq, ie, id);
 		return;
 	}
-	if(outbound) {
+	if(iq && outbound) {
 		process_response(qstate, iq, ie, id, outbound, event);
 		return;
 	}

iterator/iterator.h

@@ -66,6 +66,10 @@ struct iter_prep_list;
 #define USEFUL_SERVER_TOP_TIMEOUT	120000
 /** number of retries on outgoing queries */
 #define OUTBOUND_MSG_RETRY 4
+/** RTT band, within this amount from the best, servers are chosen randomly.
+ * Chosen so that the UNKNOWN_SERVER_NICENESS falls within the band of a 
+ * fast server, this causes server exploration as a side benefit. msec. */
+#define RTT_BAND 400
 
 /**
  * Global state for the iterator. 

libunbound/context.c

@@ -0,0 +1,378 @@
+/*
+ * libunbound/context.c - validating context for unbound internal use
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains the validator context structure.
+ */
+#include "config.h"
+#include "libunbound/context.h"
+#include "util/module.h"
+#include "util/config_file.h"
+#include "util/net_help.h"
+#include "services/modstack.h"
+#include "services/localzone.h"
+#include "services/cache/rrset.h"
+#include "services/cache/infra.h"
+#include "util/data/msgreply.h"
+#include "util/storage/slabhash.h"
+
+int 
+context_finalize(struct ub_ctx* ctx)
+{
+	struct config_file* cfg = ctx->env->cfg;
+	verbosity = cfg->verbosity;
+	if(ctx->logfile_override)
+		log_file(ctx->log_out);
+	else	log_init(cfg->logfile, cfg->use_syslog, NULL);
+	config_apply(cfg);
+	if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env))
+		return UB_INITFAIL;
+	ctx->local_zones = local_zones_create();
+	if(!ctx->local_zones)
+		return UB_NOMEM;
+	if(!local_zones_apply_cfg(ctx->local_zones, cfg))
+		return UB_INITFAIL;
+	if(!ctx->env->msg_cache ||
+	   cfg->msg_cache_size != slabhash_get_size(ctx->env->msg_cache) || 
+	   cfg->msg_cache_slabs != ctx->env->msg_cache->size) {
+		slabhash_delete(ctx->env->msg_cache);
+		ctx->env->msg_cache = slabhash_create(cfg->msg_cache_slabs,
+			HASH_DEFAULT_STARTARRAY, cfg->msg_cache_size,
+			msgreply_sizefunc, query_info_compare,
+			query_entry_delete, reply_info_delete, NULL);
+		if(!ctx->env->msg_cache)
+			return UB_NOMEM;
+	}
+	ctx->env->rrset_cache = rrset_cache_adjust(ctx->env->rrset_cache,
+		ctx->env->cfg, ctx->env->alloc);
+	if(!ctx->env->rrset_cache)
+		return UB_NOMEM;
+	ctx->env->infra_cache = infra_adjust(ctx->env->infra_cache, cfg);
+	if(!ctx->env->infra_cache)
+		return UB_NOMEM;
+	ctx->finalized = 1;
+	return UB_NOERROR;
+}
+
+int context_query_cmp(const void* a, const void* b)
+{
+	if( *(int*)a < *(int*)b )
+		return -1;
+	if( *(int*)a > *(int*)b )
+		return 1;
+	return 0;
+}
+
+void
+context_query_delete(struct ctx_query* q) 
+{
+	if(!q) return;
+	ub_resolve_free(q->res);
+	free(q->msg);
+	free(q);
+}
+
+/** How many times to try to find an unused query-id-number for async */
+#define NUM_ID_TRIES 100000
+/** find next useful id number of 0 on error */
+static int
+find_id(struct ub_ctx* ctx, int* id)
+{
+	size_t tries = 0;
+	ctx->next_querynum++;
+	while(rbtree_search(&ctx->queries, &ctx->next_querynum)) {
+		ctx->next_querynum++; /* numerical wraparound is fine */
+		if(tries++ > NUM_ID_TRIES)
+			return 0;
+	}
+	*id = ctx->next_querynum;
+	return 1;
+}
+
+struct ctx_query* 
+context_new(struct ub_ctx* ctx, char* name, int rrtype, int rrclass, 
+	ub_callback_t cb, void* cbarg)
+{
+	struct ctx_query* q = (struct ctx_query*)calloc(1, sizeof(*q));
+	if(!q) return NULL;
+	lock_basic_lock(&ctx->cfglock);
+	if(!find_id(ctx, &q->querynum)) {
+		lock_basic_unlock(&ctx->cfglock);
+		free(q);
+		return NULL;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	q->node.key = &q->querynum;
+	q->async = (cb != NULL);
+	q->cb = cb;
+	q->cb_arg = cbarg;
+	q->res = (struct ub_result*)calloc(1, sizeof(*q->res));
+	if(!q->res) {
+		free(q);
+		return NULL;
+	}
+	q->res->qname = strdup(name);
+	if(!q->res->qname) {
+		free(q->res);
+		free(q);
+		return NULL;
+	}
+	q->res->qtype = rrtype;
+	q->res->qclass = rrclass;
+
+	/* add to query list */
+	lock_basic_lock(&ctx->cfglock);
+	if(q->async)
+		ctx->num_async ++;
+	(void)rbtree_insert(&ctx->queries, &q->node);
+	lock_basic_unlock(&ctx->cfglock);
+	return q;
+}
+
+struct alloc_cache* 
+context_obtain_alloc(struct ub_ctx* ctx, int locking)
+{
+	struct alloc_cache* a;
+	int tnum = 0;
+	if(locking) {
+		lock_basic_lock(&ctx->cfglock);
+	}
+	a = ctx->alloc_list;
+	if(a)
+		ctx->alloc_list = a->super; /* snip off list */
+	else	tnum = ctx->thr_next_num++;
+	if(locking) {
+		lock_basic_unlock(&ctx->cfglock);
+	}
+	if(a) {
+		a->super = &ctx->superalloc;
+		return a;
+	}
+	a = (struct alloc_cache*)calloc(1, sizeof(*a));
+	if(!a)
+		return NULL;
+	alloc_init(a, &ctx->superalloc, tnum);
+	return a;
+}
+
+void 
+context_release_alloc(struct ub_ctx* ctx, struct alloc_cache* alloc,
+	int locking)
+{
+	if(!ctx || !alloc)
+		return;
+	if(locking) {
+		lock_basic_lock(&ctx->cfglock);
+	}
+	alloc->super = ctx->alloc_list;
+	ctx->alloc_list = alloc;
+	if(locking) {
+		lock_basic_unlock(&ctx->cfglock);
+	}
+}
+
+uint8_t* 
+context_serialize_new_query(struct ctx_query* q, uint32_t* len)
+{
+	/* format for new query is
+	 * 	o uint32 cmd
+	 * 	o uint32 id
+	 * 	o uint32 type
+	 * 	o uint32 class
+	 * 	o rest queryname (string)
+	 */
+	uint8_t* p;
+	size_t slen = strlen(q->res->qname) + 1/*end of string*/;
+	*len = sizeof(uint32_t)*4 + slen;
+	p = (uint8_t*)malloc(*len);
+	if(!p) return NULL;
+	ldns_write_uint32(p, UB_LIBCMD_NEWQUERY);
+	ldns_write_uint32(p+sizeof(uint32_t), (uint32_t)q->querynum);
+	ldns_write_uint32(p+2*sizeof(uint32_t), (uint32_t)q->res->qtype);
+	ldns_write_uint32(p+3*sizeof(uint32_t), (uint32_t)q->res->qclass);
+	memmove(p+4*sizeof(uint32_t), q->res->qname, slen);
+	return p;
+}
+
+struct ctx_query* 
+context_deserialize_new_query(struct ub_ctx* ctx, uint8_t* p, uint32_t len)
+{
+	struct ctx_query* q = (struct ctx_query*)calloc(1, sizeof(*q));
+	if(!q) return NULL;
+	if(len < 4*sizeof(uint32_t)+1) {
+		free(q);
+		return NULL;
+	}
+	log_assert( ldns_read_uint32(p) == UB_LIBCMD_NEWQUERY);
+	q->querynum = (int)ldns_read_uint32(p+sizeof(uint32_t));
+	q->node.key = &q->querynum;
+	q->async = 1;
+	q->res = (struct ub_result*)calloc(1, sizeof(*q->res));
+	if(!q->res) {
+		free(q);
+		return NULL;
+	}
+	q->res->qtype = (int)ldns_read_uint32(p+2*sizeof(uint32_t));
+	q->res->qclass = (int)ldns_read_uint32(p+3*sizeof(uint32_t));
+	q->res->qname = strdup((char*)(p+4*sizeof(uint32_t)));
+	if(!q->res->qname) {
+		free(q->res);
+		free(q);
+		return NULL;
+	}
+
+	/** add to query list */
+	ctx->num_async++;
+	(void)rbtree_insert(&ctx->queries, &q->node);
+	return q;
+}
+
+struct ctx_query* 
+context_lookup_new_query(struct ub_ctx* ctx, uint8_t* p, uint32_t len)
+{
+	struct ctx_query* q;
+	int querynum;
+	if(len < 4*sizeof(uint32_t)+1) {
+		return NULL;
+	}
+	log_assert( ldns_read_uint32(p) == UB_LIBCMD_NEWQUERY);
+	querynum = (int)ldns_read_uint32(p+sizeof(uint32_t));
+	q = (struct ctx_query*)rbtree_search(&ctx->queries, &querynum);
+	if(!q) {
+		return NULL;
+	}
+	log_assert(q->async);
+	return q;
+}
+
+uint8_t* 
+context_serialize_answer(struct ctx_query* q, int err, ldns_buffer* pkt,
+	uint32_t* len)
+{
+	/* answer format
+	 * 	o uint32 cmd
+	 * 	o uint32 id
+	 * 	o uint32 error_code
+	 * 	o uint32 msg_security
+	 * 	o the remainder is the answer msg from resolver lookup.
+	 * 	  remainder can be length 0.
+	 */
+	size_t pkt_len = pkt?ldns_buffer_remaining(pkt):0;
+	uint8_t* p;
+	*len = sizeof(uint32_t)*4 + pkt_len;
+	p = (uint8_t*)malloc(*len);
+	if(!p) return NULL;
+	ldns_write_uint32(p, UB_LIBCMD_ANSWER);
+	ldns_write_uint32(p+sizeof(uint32_t), (uint32_t)q->querynum);
+	ldns_write_uint32(p+2*sizeof(uint32_t), (uint32_t)err);
+	ldns_write_uint32(p+3*sizeof(uint32_t), (uint32_t)q->msg_security);
+	if(pkt_len > 0)
+		memmove(p+4*sizeof(uint32_t), ldns_buffer_begin(pkt), pkt_len);
+	return p;
+}
+
+struct ctx_query* 
+context_deserialize_answer(struct ub_ctx* ctx,
+        uint8_t* p, uint32_t len, int* err)
+{
+	struct ctx_query* q = NULL ;
+	int id;
+	if(len < 4*sizeof(uint32_t)) return NULL;
+	log_assert( ldns_read_uint32(p) == UB_LIBCMD_ANSWER);
+	id = (int)ldns_read_uint32(p+sizeof(uint32_t));
+	q = (struct ctx_query*)rbtree_search(&ctx->queries, &id);
+	if(!q) return NULL; 
+	*err = (int)ldns_read_uint32(p+2*sizeof(uint32_t));
+	q->msg_security = ldns_read_uint32(p+3*sizeof(uint32_t));
+	if(len > 4*sizeof(uint32_t)) {
+		q->msg_len = len - 4*sizeof(uint32_t);
+		q->msg = (uint8_t*)memdup(p+4*sizeof(uint32_t), q->msg_len);
+		if(!q->msg) {
+			/* pass malloc failure to the user callback */
+			q->msg_len = 0;
+			*err = UB_NOMEM;
+			return q;
+		}
+	} 
+	return q;
+}
+
+uint8_t* 
+context_serialize_cancel(struct ctx_query* q, uint32_t* len)
+{
+	/* format of cancel:
+	 * 	o uint32 cmd
+	 * 	o uint32 async-id */
+	uint8_t* p = (uint8_t*)malloc(2*sizeof(uint32_t));
+	if(!p) return NULL;
+	*len = 2*sizeof(uint32_t);
+	ldns_write_uint32(p, UB_LIBCMD_CANCEL);
+	ldns_write_uint32(p+sizeof(uint32_t), (uint32_t)q->querynum);
+	return p;
+}
+
+struct ctx_query* context_deserialize_cancel(struct ub_ctx* ctx,
+        uint8_t* p, uint32_t len)
+{
+	struct ctx_query* q;
+	int id;
+	if(len != 2*sizeof(uint32_t)) return NULL;
+	log_assert( ldns_read_uint32(p) == UB_LIBCMD_CANCEL);
+	id = (int)ldns_read_uint32(p+sizeof(uint32_t));
+	q = (struct ctx_query*)rbtree_search(&ctx->queries, &id);
+	return q;
+}
+
+uint8_t* 
+context_serialize_quit(uint32_t* len)
+{
+	uint8_t* p = (uint8_t*)malloc(sizeof(uint32_t));
+	if(!p)
+		return NULL;
+	*len = sizeof(uint32_t);
+	ldns_write_uint32(p, UB_LIBCMD_QUIT);
+	return p;
+}
+
+enum ub_ctx_cmd context_serial_getcmd(uint8_t* p, uint32_t len)
+{
+	uint32_t v;
+	if((size_t)len < sizeof(v))
+		return UB_LIBCMD_QUIT;
+	v = ldns_read_uint32(p);
+	return v;
+}

libunbound/context.h

@@ -0,0 +1,342 @@
+/*
+ * libunbound/context.h - validating context for unbound internal use
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains the validator context structure.
+ */
+#ifndef LIBUNBOUND_CONTEXT_H
+#define LIBUNBOUND_CONTEXT_H
+#include "util/locks.h"
+#include "util/alloc.h"
+#include "util/rbtree.h"
+#include "services/modstack.h"
+#include "libunbound/unbound.h"
+#include "util/data/packed_rrset.h"
+struct libworker;
+
+/**
+ * The context structure
+ *
+ * Contains two pipes for async service
+ *	qq : write queries to the async service pid/tid.
+ *	rr : read results from the async service pid/tid.
+ */
+struct ub_ctx {
+	/* --- pipes --- */
+	/** mutex on query write pipe */
+	lock_basic_t qqpipe_lock;
+	/** the query write pipe, [0] read from, [1] write on */
+	int qqpipe[2];
+	/** mutex on result read pipe */
+	lock_basic_t rrpipe_lock;
+	/** the result read pipe, [0] read from, [1] write on */
+	int rrpipe[2];
+
+	/* --- shared data --- */
+	/** mutex for access to env.cfg, finalized and dothread */
+	lock_basic_t cfglock;
+	/** 
+	 * The context has been finalized 
+	 * This is after config when the first resolve is done.
+	 * The modules are inited (module-init()) and shared caches created.
+	 */
+	int finalized;
+
+	/** is bg worker created yet ? */
+	int created_bg;
+	/** pid of bg worker process */
+	pid_t bg_pid;
+	/** tid of bg worker thread */
+	ub_thread_t bg_tid;
+
+	/** do threading (instead of forking) for async resolution */
+	int dothread;
+	/** next thread number for new threads */
+	int thr_next_num;
+	/** if logfile is overriden */
+	int logfile_override;
+	/** what logfile to use instead */
+	FILE* log_out;
+	/** 
+	 * List of alloc-cache-id points per threadnum for notinuse threads.
+	 * Simply the entire struct alloc_cache with the 'super' member used
+	 * to link a simply linked list. Reset super member to the superalloc
+	 * before use.
+	 */
+	struct alloc_cache* alloc_list;
+
+	/** shared caches, and so on */
+	struct alloc_cache superalloc;
+	/** module env master value */
+	struct module_env* env;
+	/** module stack */
+	struct module_stack mods;
+	/** local authority zones */
+	struct local_zones* local_zones;
+	/** random state used to seed new random state structures */
+	struct ub_randstate* seed_rnd;
+
+	/** next query number (to try) to use */
+	int next_querynum;
+	/** number of async queries outstanding */
+	size_t num_async;
+	/** 
+	 * Tree of outstanding queries. Indexed by querynum 
+	 * Used when results come in for async to lookup.
+	 * Used when cancel is done for lookup (and delete).
+	 * Used to see if querynum is free for use.
+	 * Content of type ctx_query.
+	 */ 
+	rbtree_t queries;
+};
+
+/**
+ * The queries outstanding for the libunbound resolver.
+ * These are outstanding for async resolution.
+ * But also, outstanding for sync resolution by one of the threads that
+ * has joined the threadpool.
+ */
+struct ctx_query {
+	/** node in rbtree, must be first entry, key is ptr to the querynum */
+	struct rbnode_t node;
+	/** query id number, key for node */
+	int querynum;
+	/** was this an async query? */
+	int async;
+	/** was this query cancelled (for bg worker) */
+	int cancelled;
+
+	/** for async query, the callback function */
+	ub_callback_t cb;
+	/** for async query, the callback user arg */
+	void* cb_arg;
+
+	/** answer message, result from resolver lookup. */
+	uint8_t* msg;
+	/** resulting message length. */
+	size_t msg_len;
+	/** validation status on security */
+	enum sec_status msg_security;
+	/** store libworker that is handling this query */
+	struct libworker* w;
+
+	/** result structure, also contains original query, type, class.
+	 * malloced ptr ready to hand to the client. */
+	struct ub_result* res;
+};
+
+/**
+ * The error constants
+ */
+enum ub_ctx_err {
+	/** no error */
+	UB_NOERROR = 0,
+	/** socket operation. Set to -1, so that if an error from _fd() is
+	 * passed (-1) it gives a socket error. */
+	UB_SOCKET = -1,
+	/** alloc failure */
+	UB_NOMEM = -2,
+	/** syntax error */
+	UB_SYNTAX = -3,
+	/** DNS service failed */
+	UB_SERVFAIL = -4,
+	/** fork() failed */
+	UB_FORKFAIL = -5,
+	/** cfg change after finalize() */
+	UB_AFTERFINAL = -6,
+	/** initialization failed (bad settings) */
+	UB_INITFAIL = -7,
+	/** error in pipe communication with async bg worker */
+	UB_PIPE = -8,
+	/** error reading from file (resolv.conf) */
+	UB_READFILE = -9
+};
+
+/**
+ * Command codes for libunbound pipe.
+ *
+ * Serialization looks like this:
+ * 	o length (of remainder) uint32.
+ * 	o uint32 command code.
+ * 	o per command format.
+ */
+enum ub_ctx_cmd {
+	/** QUIT */
+	UB_LIBCMD_QUIT = 0,
+	/** New query, sent to bg worker */
+	UB_LIBCMD_NEWQUERY,
+	/** Cancel query, sent to bg worker */
+	UB_LIBCMD_CANCEL,
+	/** Query result, originates from bg worker */
+	UB_LIBCMD_ANSWER
+};
+
+/** 
+ * finalize a context.
+ * @param ctx: context to finalize. creates shared data.
+ * @return 0 if OK, or errcode.
+ */
+int context_finalize(struct ub_ctx* ctx);
+
+/** compare two ctx_query elements */
+int context_query_cmp(const void* a, const void* b);
+
+/** 
+ * delete context query
+ * @param q: query to delete, including message packet and prealloc result
+ */
+void context_query_delete(struct ctx_query* q);
+
+/**
+ * Create new query in context, add to querynum list.
+ * @param ctx: context
+ * @param name: query name
+ * @param rrtype: type
+ * @param rrclass: class
+ * @param cb: callback for async, or NULL for sync.
+ * @param cbarg: user arg for async queries.
+ * @return new ctx_query or NULL for malloc failure.
+ */
+struct ctx_query* context_new(struct ub_ctx* ctx, char* name, int rrtype,
+        int rrclass, ub_callback_t cb, void* cbarg);
+
+/**
+ * Get a new alloc. Creates a new one or uses a cached one.
+ * @param ctx: context
+ * @param locking: if true, cfglock is locked while getting alloc.
+ * @return an alloc, or NULL on mem error.
+ */
+struct alloc_cache* context_obtain_alloc(struct ub_ctx* ctx, int locking);
+
+/**
+ * Release an alloc. Puts it into the cache.
+ * @param ctx: context
+ * @param locking: if true, cfglock is locked while releasing alloc.
+ * @param alloc: alloc to relinquish.
+ */
+void context_release_alloc(struct ub_ctx* ctx, struct alloc_cache* alloc,
+	int locking);
+
+/**
+ * Serialize a context query that questions data.
+ * This serializes the query name, type, ...
+ * As well as command code 'new_query'.
+ * @param q: context query
+ * @param len: the length of the allocation is returned.
+ * @return: an alloc, or NULL on mem error.
+ */
+uint8_t* context_serialize_new_query(struct ctx_query* q, uint32_t* len);
+
+/**
+ * Serialize a context_query result to hand back to user.
+ * This serializes the query name, type, ..., and result.
+ * As well as command code 'answer'.
+ * @param q: context query
+ * @param err: error code to pass to client.
+ * @param pkt: the packet to add, can be NULL.
+ * @param len: the length of the allocation is returned.
+ * @return: an alloc, or NULL on mem error.
+ */
+uint8_t* context_serialize_answer(struct ctx_query* q, int err, 
+	ldns_buffer* pkt, uint32_t* len);
+
+/**
+ * Serialize a query cancellation. Serializes query async id
+ * as well as command code 'cancel'
+ * @param q: context query
+ * @param len: the length of the allocation is returned.
+ * @return: an alloc, or NULL on mem error.
+ */
+uint8_t* context_serialize_cancel(struct ctx_query* q, uint32_t* len);
+
+/**
+ * Serialize a 'quit' command.
+ * @param len: the length of the allocation is returned.
+ * @return: an alloc, or NULL on mem error.
+ */
+uint8_t* context_serialize_quit(uint32_t* len);
+
+/**
+ * Obtain command code from serialized buffer
+ * @param p: buffer serialized.
+ * @param len: length of buffer.
+ * @return command code or QUIT on error.
+ */
+enum ub_ctx_cmd context_serial_getcmd(uint8_t* p, uint32_t len);
+
+/**
+ * Lookup query from new_query buffer.
+ * @param ctx: context
+ * @param p: buffer serialized.
+ * @param len: length of buffer.
+ * @return looked up ctx_query or NULL for malloc failure.
+ */
+struct ctx_query* context_lookup_new_query(struct ub_ctx* ctx, 
+	uint8_t* p, uint32_t len);
+
+/**
+ * Deserialize a new_query buffer.
+ * @param ctx: context
+ * @param p: buffer serialized.
+ * @param len: length of buffer.
+ * @return new ctx_query or NULL for malloc failure.
+ */
+struct ctx_query* context_deserialize_new_query(struct ub_ctx* ctx, 
+	uint8_t* p, uint32_t len);
+
+/**
+ * Deserialize an answer buffer.
+ * @param ctx: context
+ * @param p: buffer serialized.
+ * @param len: length of buffer.
+ * @param err: error code to be returned to client is passed.
+ * @return ctx_query with answer added or NULL for malloc failure.
+ */
+struct ctx_query* context_deserialize_answer(struct ub_ctx* ctx, 
+	uint8_t* p, uint32_t len, int* err);
+
+/**
+ * Deserialize a cancel buffer.
+ * @param ctx: context
+ * @param p: buffer serialized.
+ * @param len: length of buffer.
+ * @return ctx_query to cancel or NULL for failure.
+ */
+struct ctx_query* context_deserialize_cancel(struct ub_ctx* ctx, 
+	uint8_t* p, uint32_t len);
+
+#endif /* LIBUNBOUND_CONTEXT_H */

libunbound/libunbound.c

@@ -0,0 +1,953 @@
+/*
+ * unbound.c - unbound validating resolver public API implementation
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains functions to resolve DNS queries and 
+ * validate the answers. Synchonously and asynchronously.
+ *
+ */
+
+/* include the public api first, it should be able to stand alone */
+#include "libunbound/unbound.h"
+#include "config.h"
+#include "libunbound/context.h"
+#include "libunbound/libworker.h"
+#include "util/locks.h"
+#include "util/config_file.h"
+#include "util/alloc.h"
+#include "util/module.h"
+#include "util/regional.h"
+#include "util/log.h"
+#include "util/random.h"
+#include "util/net_help.h"
+#include "services/modstack.h"
+#include "services/localzone.h"
+#include "services/cache/infra.h"
+#include "services/cache/rrset.h"
+
+struct ub_ctx* 
+ub_ctx_create()
+{
+	struct ub_ctx* ctx;
+	unsigned int seed;
+#ifdef USE_WINSOCK
+	int r;
+	WSADATA wsa_data;
+#endif
+	
+	log_init(NULL, 0, NULL); /* logs to stderr */
+	log_ident_set("libunbound");
+#ifdef USE_WINSOCK
+	if((r = WSAStartup(MAKEWORD(2,2), &wsa_data)) != 0) {
+		log_err("could not init winsock. WSAStartup: %s",
+			wsa_strerror(r));
+		return NULL;
+	}
+#endif
+	verbosity = 0; /* errors only */
+	checklock_start();
+	ctx = (struct ub_ctx*)calloc(1, sizeof(*ctx));
+	if(!ctx) {
+		errno = ENOMEM;
+		return NULL;
+	}
+	alloc_init(&ctx->superalloc, NULL, 0);
+	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid();
+	if(!(ctx->seed_rnd = ub_initstate(seed, NULL))) {
+		seed = 0;
+		ub_randfree(ctx->seed_rnd);
+		free(ctx);
+		errno = ENOMEM;
+		return NULL;
+	}
+	seed = 0;
+	if(socketpair(AF_UNIX, SOCK_STREAM, 0, ctx->qqpipe) == -1) {
+		ub_randfree(ctx->seed_rnd);
+		free(ctx);
+		return NULL;
+	}
+	if(socketpair(AF_UNIX, SOCK_STREAM, 0, ctx->rrpipe) == -1) {
+		int e = errno;
+		close(ctx->qqpipe[0]);
+		close(ctx->qqpipe[1]);
+		ub_randfree(ctx->seed_rnd);
+		free(ctx);
+		errno = e;
+		return NULL;
+	}
+#ifndef USE_WINSOCK
+	if(!fd_set_nonblock(ctx->rrpipe[0]) ||
+	   !fd_set_nonblock(ctx->rrpipe[1]) ||
+	   !fd_set_nonblock(ctx->qqpipe[0]) ||
+	   !fd_set_nonblock(ctx->qqpipe[1])) {
+		int e = errno;
+		close(ctx->rrpipe[0]);
+		close(ctx->rrpipe[1]);
+		close(ctx->qqpipe[0]);
+		close(ctx->qqpipe[1]);
+		ub_randfree(ctx->seed_rnd);
+		free(ctx);
+		errno = e;
+		return NULL;
+	}
+#endif /* !USE_WINSOCK - it is a pipe(nonsocket) on windows) */
+	lock_basic_init(&ctx->qqpipe_lock);
+	lock_basic_init(&ctx->rrpipe_lock);
+	lock_basic_init(&ctx->cfglock);
+	ctx->env = (struct module_env*)calloc(1, sizeof(*ctx->env));
+	if(!ctx->env) {
+		close(ctx->rrpipe[0]);
+		close(ctx->rrpipe[1]);
+		close(ctx->qqpipe[0]);
+		close(ctx->qqpipe[1]);
+		ub_randfree(ctx->seed_rnd);
+		free(ctx);
+		errno = ENOMEM;
+		return NULL;
+	}
+	ctx->env->cfg = config_create_forlib();
+	if(!ctx->env->cfg) {
+		close(ctx->rrpipe[0]);
+		close(ctx->rrpipe[1]);
+		close(ctx->qqpipe[0]);
+		close(ctx->qqpipe[1]);
+		free(ctx->env);
+		ub_randfree(ctx->seed_rnd);
+		free(ctx);
+		errno = ENOMEM;
+		return NULL;
+	}
+	ctx->env->alloc = &ctx->superalloc;
+	ctx->env->worker = NULL;
+	ctx->env->need_to_validate = 0;
+	modstack_init(&ctx->mods);
+	rbtree_init(&ctx->queries, &context_query_cmp);
+	return ctx;
+}
+
+/** delete q */
+static void
+delq(rbnode_t* n, void* ATTR_UNUSED(arg))
+{
+	struct ctx_query* q = (struct ctx_query*)n;
+	context_query_delete(q);
+}
+
+void 
+ub_ctx_delete(struct ub_ctx* ctx)
+{
+	struct alloc_cache* a, *na;
+	if(!ctx) return;
+	/* stop the bg thread */
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->created_bg) {
+		uint8_t* msg;
+		uint32_t len;
+		uint32_t cmd = UB_LIBCMD_QUIT;
+		lock_basic_unlock(&ctx->cfglock);
+		lock_basic_lock(&ctx->qqpipe_lock);
+		(void)libworker_write_msg(ctx->qqpipe[1], (uint8_t*)&cmd, 
+			(uint32_t)sizeof(cmd), 0);
+		lock_basic_unlock(&ctx->qqpipe_lock);
+		lock_basic_lock(&ctx->rrpipe_lock);
+		while(libworker_read_msg(ctx->rrpipe[0], &msg, &len, 0)) {
+			/* discard all results except a quit confirm */
+			if(context_serial_getcmd(msg, len) == UB_LIBCMD_QUIT) {
+				free(msg);
+				break;
+			}
+			free(msg);
+		}
+		lock_basic_unlock(&ctx->rrpipe_lock);
+
+		/* if bg worker is a thread, wait for it to exit, so that all
+	 	 * resources are really gone. */
+		lock_basic_lock(&ctx->cfglock);
+		if(ctx->dothread) {
+			lock_basic_unlock(&ctx->cfglock);
+			ub_thread_join(ctx->bg_tid);
+		} else {
+			lock_basic_unlock(&ctx->cfglock);
+		}
+	}
+	else {
+		lock_basic_unlock(&ctx->cfglock);
+	}
+
+
+	modstack_desetup(&ctx->mods, ctx->env);
+	a = ctx->alloc_list;
+	while(a) {
+		na = a->super;
+		a->super = &ctx->superalloc;
+		alloc_clear(a);
+		free(a);
+		a = na;
+	}
+	local_zones_delete(ctx->local_zones);
+	lock_basic_destroy(&ctx->qqpipe_lock);
+	lock_basic_destroy(&ctx->rrpipe_lock);
+	lock_basic_destroy(&ctx->cfglock);
+	if(ctx->qqpipe[0] != -1)
+		close(ctx->qqpipe[0]);
+	if(ctx->qqpipe[1] != -1)
+		close(ctx->qqpipe[1]);
+	if(ctx->rrpipe[0] != -1)
+		close(ctx->rrpipe[0]);
+	if(ctx->rrpipe[1] != -1)
+		close(ctx->rrpipe[1]);
+	ctx->qqpipe[0] = -1;
+	ctx->qqpipe[1] = -1;
+	ctx->rrpipe[0] = -1;
+	ctx->rrpipe[1] = -1;
+	if(ctx->env) {
+		slabhash_delete(ctx->env->msg_cache);
+		rrset_cache_delete(ctx->env->rrset_cache);
+		infra_delete(ctx->env->infra_cache);
+		config_delete(ctx->env->cfg);
+		free(ctx->env);
+	}
+	ub_randfree(ctx->seed_rnd);
+	alloc_clear(&ctx->superalloc);
+	traverse_postorder(&ctx->queries, delq, NULL);
+	free(ctx);
+#ifdef USE_WINSOCK
+	WSACleanup();
+#endif
+}
+
+int 
+ub_ctx_set_option(struct ub_ctx* ctx, char* opt, char* val)
+{
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_AFTERFINAL;
+	}
+	if(!config_set_option(ctx->env->cfg, opt, val)) {
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_SYNTAX;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+int 
+ub_ctx_config(struct ub_ctx* ctx, char* fname)
+{
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_AFTERFINAL;
+	}
+	if(!config_read(ctx->env->cfg, fname)) {
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_SYNTAX;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+int 
+ub_ctx_add_ta(struct ub_ctx* ctx, char* ta)
+{
+	char* dup = strdup(ta);
+	if(!dup) return UB_NOMEM;
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_AFTERFINAL;
+	}
+	if(!cfg_strlist_insert(&ctx->env->cfg->trust_anchor_list, dup)) {
+		lock_basic_unlock(&ctx->cfglock);
+		free(dup);
+		return UB_NOMEM;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+int 
+ub_ctx_add_ta_file(struct ub_ctx* ctx, char* fname)
+{
+	char* dup = strdup(fname);
+	if(!dup) return UB_NOMEM;
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_AFTERFINAL;
+	}
+	if(!cfg_strlist_insert(&ctx->env->cfg->trust_anchor_file_list, dup)) {
+		lock_basic_unlock(&ctx->cfglock);
+		free(dup);
+		return UB_NOMEM;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+int 
+ub_ctx_trustedkeys(struct ub_ctx* ctx, char* fname)
+{
+	char* dup = strdup(fname);
+	if(!dup) return UB_NOMEM;
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_AFTERFINAL;
+	}
+	if(!cfg_strlist_insert(&ctx->env->cfg->trusted_keys_file_list, dup)) {
+		lock_basic_unlock(&ctx->cfglock);
+		free(dup);
+		return UB_NOMEM;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+int
+ub_ctx_debuglevel(struct ub_ctx* ctx, int d)
+{
+	lock_basic_lock(&ctx->cfglock);
+	verbosity = d;
+	ctx->env->cfg->verbosity = d;
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+int ub_ctx_debugout(struct ub_ctx* ctx, void* out)
+{
+	lock_basic_lock(&ctx->cfglock);
+	log_file((FILE*)out);
+	ctx->logfile_override = 1;
+	ctx->log_out = out;
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+int 
+ub_ctx_async(struct ub_ctx* ctx, int dothread)
+{
+#ifdef THREADS_DISABLED
+	if(dothread) /* cannot do threading */
+		return UB_NOERROR;
+#endif
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_AFTERFINAL;
+	}
+	ctx->dothread = dothread;
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+/** perform a select() on the result read pipe */
+static int 
+pollit(struct ub_ctx* ctx, struct timeval* t)
+{
+	fd_set r;
+#ifndef S_SPLINT_S
+	FD_ZERO(&r);
+	FD_SET(FD_SET_T ctx->rrpipe[0], &r);
+#endif
+	if(select(ctx->rrpipe[0]+1, &r, NULL, NULL, t) == -1) {
+		return 0;
+	}
+	errno = 0;
+	return FD_ISSET(ctx->rrpipe[0], &r);
+}
+
+int 
+ub_poll(struct ub_ctx* ctx)
+{
+	struct timeval t;
+	memset(&t, 0, sizeof(t));
+	/* no need to hold lock while testing for readability. */
+	return pollit(ctx, &t);
+}
+
+int 
+ub_fd(struct ub_ctx* ctx)
+{
+	return ctx->rrpipe[0];
+}
+
+/** process answer from bg worker */
+static int
+process_answer_detail(struct ub_ctx* ctx, uint8_t* msg, uint32_t len,
+	ub_callback_t* cb, void** cbarg, int* err,
+	struct ub_result** res)
+{
+	struct ctx_query* q;
+	if(context_serial_getcmd(msg, len) != UB_LIBCMD_ANSWER) {
+		log_err("error: bad data from bg worker %d",
+			(int)context_serial_getcmd(msg, len));
+		return 0;
+	}
+
+	lock_basic_lock(&ctx->cfglock);
+	q = context_deserialize_answer(ctx, msg, len, err);
+	if(!q) {
+		lock_basic_unlock(&ctx->cfglock);
+		/* probably simply the lookup that failed, i.e.
+		 * response returned before cancel was sent out, so noerror */
+		return 1;
+	}
+	log_assert(q->async);
+
+	/* grab cb while locked */
+	if(q->cancelled) {
+		*cb = NULL;
+		*cbarg = NULL;
+	} else {
+		*cb = q->cb;
+		*cbarg = q->cb_arg;
+	}
+	if(*err) {
+		*res = NULL;
+		ub_resolve_free(q->res);
+	} else {
+		/* parse the message, extract rcode, fill result */
+		ldns_buffer* buf = ldns_buffer_new(q->msg_len);
+		struct regional* region = regional_create();
+		*res = q->res;
+		(*res)->rcode = LDNS_RCODE_SERVFAIL;
+		if(region && buf) {
+			ldns_buffer_clear(buf);
+			ldns_buffer_write(buf, q->msg, q->msg_len);
+			ldns_buffer_flip(buf);
+			libworker_enter_result(*res, buf, region,
+				q->msg_security);
+		}
+		(*res)->answer_packet = q->msg;
+		(*res)->answer_len = (int)q->msg_len;
+		q->msg = NULL;
+		ldns_buffer_free(buf);
+		regional_destroy(region);
+	}
+	q->res = NULL;
+	/* delete the q from list */
+	(void)rbtree_delete(&ctx->queries, q->node.key);
+	ctx->num_async--;
+	context_query_delete(q);
+	lock_basic_unlock(&ctx->cfglock);
+
+	if(*cb) return 2;
+	ub_resolve_free(*res);
+	return 1;
+}
+
+/** process answer from bg worker */
+static int
+process_answer(struct ub_ctx* ctx, uint8_t* msg, uint32_t len)
+{
+	int err;
+	ub_callback_t cb;
+	void* cbarg;
+	struct ub_result* res;
+	int r;
+
+	r = process_answer_detail(ctx, msg, len, &cb, &cbarg, &err, &res);
+
+	/* no locks held while calling callback, so that library is
+	 * re-entrant. */
+	if(r == 2)
+		(*cb)(cbarg, err, res);
+
+	return r;
+}
+
+int 
+ub_process(struct ub_ctx* ctx)
+{
+	int r;
+	uint8_t* msg;
+	uint32_t len;
+	while(1) {
+		msg = NULL;
+		lock_basic_lock(&ctx->rrpipe_lock);
+		r = libworker_read_msg(ctx->rrpipe[0], &msg, &len, 1);
+		lock_basic_unlock(&ctx->rrpipe_lock);
+		if(r == 0)
+			return UB_PIPE;
+		else if(r == -1)
+			return UB_NOERROR;
+		if(!process_answer(ctx, msg, len)) {
+			free(msg);
+			return UB_PIPE;
+		}
+		free(msg);
+	}
+	return UB_NOERROR;
+}
+
+int 
+ub_wait(struct ub_ctx* ctx)
+{
+	int err;
+	ub_callback_t cb;
+	void* cbarg;
+	struct ub_result* res;
+	int r;
+	uint8_t* msg;
+	uint32_t len;
+	/* this is basically the same loop as _process(), but with changes.
+	 * holds the rrpipe lock and waits with pollit */
+	while(1) {
+		lock_basic_lock(&ctx->rrpipe_lock);
+		lock_basic_lock(&ctx->cfglock);
+		if(ctx->num_async == 0) {
+			lock_basic_unlock(&ctx->cfglock);
+			lock_basic_unlock(&ctx->rrpipe_lock);
+			break;
+		}
+		lock_basic_unlock(&ctx->cfglock);
+
+		/* keep rrpipe locked, while
+		 * 	o waiting for pipe readable
+		 * 	o parsing message
+		 * 	o possibly decrementing num_async
+		 * do callback without lock
+		 */
+		r = pollit(ctx, NULL);
+		if(r) {
+			r = libworker_read_msg(ctx->rrpipe[0], &msg, &len, 1);
+			if(r == 0) {
+				lock_basic_unlock(&ctx->rrpipe_lock);
+				return UB_PIPE;
+			}
+			if(r == -1) {
+				lock_basic_unlock(&ctx->rrpipe_lock);
+				continue;
+			}
+			r = process_answer_detail(ctx, msg, len, 
+				&cb, &cbarg, &err, &res);
+			lock_basic_unlock(&ctx->rrpipe_lock);
+			free(msg);
+			if(r == 0)
+				return UB_PIPE;
+			if(r == 2)
+				(*cb)(cbarg, err, res);
+		} else {
+			lock_basic_unlock(&ctx->rrpipe_lock);
+		}
+	}
+	return UB_NOERROR;
+}
+
+int 
+ub_resolve(struct ub_ctx* ctx, char* name, int rrtype, 
+	int rrclass, struct ub_result** result)
+{
+	struct ctx_query* q;
+	int r;
+	*result = NULL;
+
+	lock_basic_lock(&ctx->cfglock);
+	if(!ctx->finalized) {
+		r = context_finalize(ctx);
+		if(r) {
+			lock_basic_unlock(&ctx->cfglock);
+			return r;
+		}
+	}
+	/* create new ctx_query and attempt to add to the list */
+	lock_basic_unlock(&ctx->cfglock);
+	q = context_new(ctx, name, rrtype, rrclass, NULL, NULL);
+	if(!q)
+		return UB_NOMEM;
+	/* become a resolver thread for a bit */
+
+	r = libworker_fg(ctx, q);
+	if(r) {
+		lock_basic_lock(&ctx->cfglock);
+		(void)rbtree_delete(&ctx->queries, q->node.key);
+		context_query_delete(q);
+		lock_basic_unlock(&ctx->cfglock);
+		return r;
+	}
+	q->res->answer_packet = q->msg;
+	q->res->answer_len = (int)q->msg_len;
+	q->msg = NULL;
+	*result = q->res;
+	q->res = NULL;
+
+	lock_basic_lock(&ctx->cfglock);
+	(void)rbtree_delete(&ctx->queries, q->node.key);
+	context_query_delete(q);
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+int 
+ub_resolve_async(struct ub_ctx* ctx, char* name, int rrtype, 
+	int rrclass, void* mydata, ub_callback_t callback, int* async_id)
+{
+	struct ctx_query* q;
+	uint8_t* msg = NULL;
+	uint32_t len = 0;
+
+	if(async_id)
+		*async_id = 0;
+	lock_basic_lock(&ctx->cfglock);
+	if(!ctx->finalized) {
+		int r = context_finalize(ctx);
+		if(r) {
+			lock_basic_unlock(&ctx->cfglock);
+			return r;
+		}
+	}
+	if(!ctx->created_bg) {
+		int r;
+		ctx->created_bg = 1;
+		lock_basic_unlock(&ctx->cfglock);
+		r = libworker_bg(ctx);
+		if(r) {
+			lock_basic_lock(&ctx->cfglock);
+			ctx->created_bg = 0;
+			lock_basic_unlock(&ctx->cfglock);
+			return r;
+		}
+	} else {
+		lock_basic_unlock(&ctx->cfglock);
+	}
+
+	/* create new ctx_query and attempt to add to the list */
+	q = context_new(ctx, name, rrtype, rrclass, callback, mydata);
+	if(!q)
+		return UB_NOMEM;
+
+	/* write over pipe to background worker */
+	lock_basic_lock(&ctx->cfglock);
+	msg = context_serialize_new_query(q, &len);
+	if(!msg) {
+		(void)rbtree_delete(&ctx->queries, q->node.key);
+		ctx->num_async--;
+		context_query_delete(q);
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_NOMEM;
+	}
+	if(async_id)
+		*async_id = q->querynum;
+	lock_basic_unlock(&ctx->cfglock);
+	
+	lock_basic_lock(&ctx->qqpipe_lock);
+	if(!libworker_write_msg(ctx->qqpipe[1], msg, len, 0)) {
+		lock_basic_unlock(&ctx->qqpipe_lock);
+		free(msg);
+		return UB_PIPE;
+	}
+	lock_basic_unlock(&ctx->qqpipe_lock);
+	free(msg);
+	return UB_NOERROR;
+}
+
+int 
+ub_cancel(struct ub_ctx* ctx, int async_id)
+{
+	struct ctx_query* q;
+	uint8_t* msg = NULL;
+	uint32_t len = 0;
+	lock_basic_lock(&ctx->cfglock);
+	q = (struct ctx_query*)rbtree_search(&ctx->queries, &async_id);
+	if(!q || !q->async) {
+		/* it is not there, so nothing to do */
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_NOERROR;
+	}
+	log_assert(q->async);
+	q->cancelled = 1;
+	
+	/* delete it */
+	if(!ctx->dothread) { /* if forked */
+		(void)rbtree_delete(&ctx->queries, q->node.key);
+		ctx->num_async--;
+		msg = context_serialize_cancel(q, &len);
+		context_query_delete(q);
+		lock_basic_unlock(&ctx->cfglock);
+		if(!msg) {
+			return UB_NOMEM;
+		}
+		/* send cancel to background worker */
+		lock_basic_lock(&ctx->qqpipe_lock);
+		if(!libworker_write_msg(ctx->qqpipe[1], msg, len, 0)) {
+			lock_basic_unlock(&ctx->qqpipe_lock);
+			free(msg);
+			return UB_PIPE;
+		}
+		lock_basic_unlock(&ctx->qqpipe_lock);
+		free(msg);
+	} else {
+		lock_basic_unlock(&ctx->cfglock);
+	}
+	return UB_NOERROR;
+}
+
+void 
+ub_resolve_free(struct ub_result* result)
+{
+	char** p;
+	if(!result) return;
+	free(result->qname);
+	if(result->canonname != result->qname)
+		free(result->canonname);
+	if(result->data)
+		for(p = result->data; *p; p++)
+			free(*p);
+	free(result->data);
+	free(result->len);
+	free(result->answer_packet);
+	free(result);
+}
+
+const char* 
+ub_strerror(int err)
+{
+	switch(err) {
+		case UB_NOERROR: return "no error";
+		case UB_SOCKET: return "socket io error";
+		case UB_NOMEM: return "out of memory";
+		case UB_SYNTAX: return "syntax error";
+		case UB_SERVFAIL: return "server failure";
+		case UB_FORKFAIL: return "could not fork";
+		case UB_INITFAIL: return "initialization failure";
+		case UB_AFTERFINAL: return "setting change after finalize";
+		case UB_PIPE: return "error in pipe communication with async";
+		case UB_READFILE: return "error reading file";
+		default: return "unknown error";
+	}
+}
+
+int 
+ub_ctx_set_fwd(struct ub_ctx* ctx, char* addr)
+{
+	struct sockaddr_storage storage;
+	socklen_t stlen;
+	struct config_stub* s;
+	char* dupl;
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		errno=EINVAL;
+		return UB_AFTERFINAL;
+	}
+	if(!addr) {
+		/* disable fwd mode - the root stub should be first. */
+		if(ctx->env->cfg->forwards &&
+			strcmp(ctx->env->cfg->forwards->name, ".") == 0) {
+			s = ctx->env->cfg->forwards;
+			ctx->env->cfg->forwards = s->next;
+			s->next = NULL;
+			config_delstubs(s);
+		}
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_NOERROR;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+
+	/* check syntax for addr */
+	if(!extstrtoaddr(addr, &storage, &stlen)) {
+		errno=EINVAL;
+		return UB_SYNTAX;
+	}
+	
+	/* it parses, add root stub in front of list */
+	lock_basic_lock(&ctx->cfglock);
+	if(!ctx->env->cfg->forwards ||
+		strcmp(ctx->env->cfg->forwards->name, ".") != 0) {
+		s = calloc(1, sizeof(*s));
+		if(!s) {
+			lock_basic_unlock(&ctx->cfglock);
+			errno=ENOMEM;
+			return UB_NOMEM;
+		}
+		s->name = strdup(".");
+		if(!s->name) {
+			free(s);
+			lock_basic_unlock(&ctx->cfglock);
+			errno=ENOMEM;
+			return UB_NOMEM;
+		}
+		s->next = ctx->env->cfg->forwards;
+		ctx->env->cfg->forwards = s;
+	} else {
+		log_assert(ctx->env->cfg->forwards);
+		s = ctx->env->cfg->forwards;
+	}
+	dupl = strdup(addr);
+	if(!dupl) {
+		lock_basic_unlock(&ctx->cfglock);
+		errno=ENOMEM;
+		return UB_NOMEM;
+	}
+	if(!cfg_strlist_insert(&s->addrs, dupl)) {
+		free(dupl);
+		lock_basic_unlock(&ctx->cfglock);
+		errno=ENOMEM;
+		return UB_NOMEM;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+int 
+ub_ctx_resolvconf(struct ub_ctx* ctx, char* fname)
+{
+	FILE* in;
+	int numserv = 0;
+	char buf[1024];
+	char* parse, *addr;
+	int r;
+	if(fname == NULL)
+		fname = "/etc/resolv.conf";
+	in = fopen(fname, "r");
+	if(!in) {
+		/* error in errno! perror(fname) */
+		return UB_READFILE;
+	}
+	while(fgets(buf, (int)sizeof(buf), in)) {
+		buf[sizeof(buf)-1] = 0;
+		parse=buf;
+		while(*parse == ' ' || *parse == '\t')
+			parse++;
+		if(strncmp(parse, "nameserver", 10) == 0) {
+			numserv++;
+			parse += 10; /* skip 'nameserver' */
+			/* skip whitespace */
+			while(*parse == ' ' || *parse == '\t')
+				parse++;
+			addr = parse;
+			/* skip [0-9a-fA-F.:]*, i.e. IP4 and IP6 address */
+			while(isxdigit(*parse) || *parse=='.' || *parse==':')
+				parse++;
+			/* terminate after the address, remove newline */
+			*parse = 0;
+			
+			if((r = ub_ctx_set_fwd(ctx, addr)) != UB_NOERROR) {
+				fclose(in);
+				return r;
+			}
+		}
+	}
+	fclose(in);
+	if(numserv == 0) {
+		/* from resolv.conf(5) if none given, use localhost */
+		return ub_ctx_set_fwd(ctx, "127.0.0.1");
+	}
+	return UB_NOERROR;
+}
+
+int
+ub_ctx_hosts(struct ub_ctx* ctx, char* fname)
+{
+	FILE* in;
+	char buf[1024], ldata[1024];
+	char* parse, *addr, *name, *ins;
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		errno=EINVAL;
+		return UB_AFTERFINAL;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	if(fname == NULL)
+		fname = "/etc/hosts";
+	in = fopen(fname, "r");
+	if(!in) {
+		/* error in errno! perror(fname) */
+		return UB_READFILE;
+	}
+	while(fgets(buf, (int)sizeof(buf), in)) {
+		buf[sizeof(buf)-1] = 0;
+		parse=buf;
+		while(*parse == ' ' || *parse == '\t')
+			parse++;
+		if(*parse == '#')
+			continue; /* skip comment */
+		/* format: <addr> spaces <name> spaces <name> ... */
+		addr = parse;
+		/* skip addr */
+		while(isxdigit(*parse) || *parse == '.' || *parse == ':')
+			parse++;
+		if(*parse == '\n' || *parse == 0)
+			continue;
+		if(*parse == '%') 
+			continue; /* ignore macOSX fe80::1%lo0 localhost */
+		if(*parse != ' ' && *parse != '\t') {
+			/* must have whitespace after address */
+			fclose(in);
+			errno=EINVAL;
+			return UB_SYNTAX;
+		}
+		*parse++ = 0; /* end delimiter for addr ... */
+		/* go to names and add them */
+		while(*parse) {
+			while(*parse == ' ' || *parse == '\t' || *parse=='\n')
+				parse++;
+			if(*parse == 0 || *parse == '#')
+				break;
+			/* skip name, allows (too) many printable characters */
+			name = parse;
+			while('!' <= *parse && *parse <= '~')
+				parse++;
+			if(*parse)
+				*parse++ = 0; /* end delimiter for name */
+			snprintf(ldata, sizeof(ldata), "%s %s %s",
+				name, str_is_ip6(addr)?"AAAA":"A", addr);
+			ins = strdup(ldata);
+			if(!ins) {
+				/* out of memory */
+				fclose(in);
+				errno=ENOMEM;
+				return UB_NOMEM;
+			}
+			lock_basic_lock(&ctx->cfglock);
+			if(!cfg_strlist_insert(&ctx->env->cfg->local_data, 
+				ins)) {
+				lock_basic_unlock(&ctx->cfglock);
+				fclose(in);
+				free(ins);
+				errno=ENOMEM;
+				return UB_NOMEM;
+			}
+			lock_basic_unlock(&ctx->cfglock);
+		}
+	}
+	fclose(in);
+	return UB_NOERROR;
+}

libunbound/libworker.h

@@ -0,0 +1,236 @@
+/*
+ * libunbound/worker.h - worker thread or process that resolves
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains the worker process or thread that performs
+ * the DNS resolving and validation. The worker is called by a procedure
+ * and if in the background continues until exit, if in the foreground
+ * returns from the procedure when done.
+ */
+#ifndef LIBUNBOUND_WORKER_H
+#define LIBUNBOUND_WORKER_H
+#include "util/data/packed_rrset.h"
+struct ub_ctx;
+struct ub_result;
+struct module_env;
+struct comm_base;
+struct outside_network;
+struct ub_randstate;
+struct ctx_query;
+struct outbound_entry;
+struct module_qstate;
+struct comm_point;
+struct comm_reply;
+struct libworker_res_list;
+struct regional;
+
+/** 
+ * The library-worker status structure
+ * Internal to the worker.
+ */
+struct libworker {
+	/** every worker has a unique thread_num. (first in struct) */
+	int thread_num;
+	/** context we are operating under */
+	struct ub_ctx* ctx;
+
+	/** is this the bg worker? */
+	int is_bg;
+	/** is this a bg worker that is threaded (not forked)? */
+	int is_bg_thread;
+
+	/** copy of the module environment with worker local entries. */
+	struct module_env* env;
+	/** the event base this worker works with */
+	struct comm_base* base;
+	/** the backside outside network interface to the auth servers */
+	struct outside_network* back;
+	/** random() table for this worker. */
+	struct ub_randstate* rndstate;
+	
+	/** commpoint to listen to commands */
+	struct comm_point* cmd_com;
+	/** are we currently reading a command, 0 if not, else bytecount */
+	size_t cmd_read;
+	/** size of current read command, may be partially read */
+	uint32_t cmd_len;
+	/** the current read command content, malloced, can be partially read*/
+	uint8_t* cmd_msg;
+
+	/** commpoint to write results back */
+	struct comm_point* res_com;
+	/** are we curently writing a result, 0 if not, else bytecount into
+	 * the res_list first entry. */
+	size_t res_write;
+	/** list of outstanding results to be written back */
+	struct libworker_res_list* res_list;
+	/** last in list */
+	struct libworker_res_list* res_last;
+};
+
+/**
+ * List of results (arbitrary command serializations) to write back
+ */
+struct libworker_res_list {
+	/** next in list */
+	struct libworker_res_list* next;
+	/** serialized buffer to write */
+	uint8_t* buf;
+	/** length to write */
+	uint32_t len;
+};
+
+/**
+ * Create a background worker
+ * @param ctx: is updated with pid/tid of the background worker.
+ *	a new allocation cache is obtained from ctx. It contains the
+ *	threadnumber and unique id for further (shared) cache insertions.
+ * @return 0 if OK, else error.
+ *	Further communication is done via the pipes in ctx. 
+ */
+int libworker_bg(struct ub_ctx* ctx);
+
+/**
+ * Create a foreground worker.
+ * This worker will join the threadpool of resolver threads.
+ * It exits when the query answer has been obtained (or error).
+ * This routine blocks until the worker is finished.
+ * @param ctx: new allocation cache obtained and returned to it.
+ * @param q: query (result is stored in here).
+ * @return 0 if finished OK, else error.
+ */
+int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q);
+
+/** cleanup the cache to remove all rrset IDs from it, arg is libworker */
+void libworker_alloc_cleanup(void* arg);
+
+/**
+ * Worker service routine to send udp messages for modules.
+ * @param pkt: packet to send.
+ * @param addr: where to.
+ * @param addrlen: length of addr.
+ * @param timeout: seconds to wait until timeout.
+ * @param q: wich query state to reactivate upon return.
+ * @param use_tcp: true to use TCP, false for UDP.
+ * @return: false on failure (memory or socket related). no query was
+ *      sent.
+ */
+int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
+        socklen_t addrlen, int timeout, struct module_qstate* q, int use_tcp);
+
+/**
+ * Worker service routine to send serviced queries to authoritative servers.
+ * @param qname: query name. (host order)
+ * @param qnamelen: length in bytes of qname, including trailing 0.
+ * @param qtype: query type. (host order)
+ * @param qclass: query class. (host order)
+ * @param flags: host order flags word, with opcode and CD bit.
+ * @param dnssec: if set, EDNS record will have DO bit set.
+ * @param addr: where to.
+ * @param addrlen: length of addr.
+ * @param q: wich query state to reactivate upon return.
+ * @return: false on failure (memory or socket related). no query was
+ *      sent.
+ */
+struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
+        uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
+        struct sockaddr_storage* addr, socklen_t addrlen,
+        struct module_qstate* q);
+
+/** process incoming replies from the network */
+int libworker_handle_reply(struct comm_point* c, void* arg, int error,
+        struct comm_reply* reply_info);
+
+/** process incoming serviced query replies from the network */
+int libworker_handle_service_reply(struct comm_point* c, void* arg, int error,
+        struct comm_reply* reply_info);
+
+/** handle control command coming into server */
+int libworker_handle_control_cmd(struct comm_point* c, void* arg, 
+	int err, struct comm_reply* rep);
+
+/** handle opportunity to write result back */
+int libworker_handle_result_write(struct comm_point* c, void* arg, 
+	int err, struct comm_reply* rep);
+
+/**
+ * Write length bytes followed by message.
+ * @param fd: the socket to write on. Is nonblocking.
+ * 	Set to blocking by the function,
+ * 	and back to non-blocking at exit of function.
+ * @param buf: the message.
+ * @param len: length of message.
+ * @param nonblock: if set to true, the first write is nonblocking.
+ * 	If the first write fails the function returns -1.
+ * 	If set false, the first write is blocking.
+ * @return: all remainder writes are nonblocking.
+ * 	return 0 on error, in that case blocking/nonblocking of socket is
+ * 		unknown.
+ * 	return 1 if all OK.
+ */
+int libworker_write_msg(int fd, uint8_t* buf, uint32_t len, int nonblock);
+
+/**
+ * Read length bytes followed by message.
+ * @param fd: the socket to write on. Is nonblocking.
+ * 	Set to blocking by the function,
+ * 	and back to non-blocking at exit of function.
+ * @param buf: the message, malloced.
+ * @param len: length of message, returned.
+ * @param nonblock: if set to true, the first read is nonblocking.
+ * 	If the first read fails the function returns -1.
+ * 	If set false, the first read is blocking.
+ * @return: all remainder reads are nonblocking.
+ * 	return 0 on error, in that case blocking/nonblocking of socket is 
+ * 		unknown. On EOF 0 is returned.
+ * 	return 1 if all OK.
+ */
+int libworker_read_msg(int fd, uint8_t** buf, uint32_t* len, int nonblock);
+
+/** 
+ * fill result from parsed message, on error fills servfail 
+ * @param res: is clear at start, filled in at end.
+ * @param buf: contains DNS message.
+ * @param temp: temporary buffer for parse.
+ * @param msg_security: security status of the DNS message.
+ *   On error, the res may contain a different status 
+ *   (out of memory is not secure, not bogus).
+ */
+void libworker_enter_result(struct ub_result* res, ldns_buffer* buf,
+	struct regional* temp, enum sec_status msg_security);
+
+#endif /* LIBUNBOUND_WORKER_H */

libunbound/ubsyms.def

@@ -0,0 +1,22 @@
+ub_ctx_create
+ub_ctx_delete
+ub_ctx_set_option
+ub_ctx_config
+ub_ctx_set_fwd
+ub_ctx_resolvconf
+ub_ctx_hosts
+ub_ctx_add_ta
+ub_ctx_add_ta_file
+ub_ctx_trustedkeys
+ub_ctx_debugout
+ub_ctx_debuglevel
+ub_ctx_async
+ub_poll
+ub_wait
+ub_fd
+ub_process
+ub_resolve
+ub_resolve_async
+ub_cancel
+ub_resolve_free
+ub_strerror

libunbound/unbound.h

@@ -0,0 +1,468 @@
+/*
+ * unbound.h - unbound validating resolver public API
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains functions to resolve DNS queries and 
+ * validate the answers. Synchonously and asynchronously.
+ *
+ * Several ways to use this interface from an application wishing
+ * to perform (validated) DNS lookups.
+ *
+ * All start with
+ *	ctx = ub_ctx_create();
+ *	err = ub_ctx_add_ta(ctx, "...");
+ *	err = ub_ctx_add_ta(ctx, "...");
+ *	... some lookups
+ *	... call ub_ctx_delete(ctx); when you want to stop.
+ *
+ * Application not threaded. Blocking.
+ *	int err = ub_resolve(ctx, "www.example.com", ...
+ *	if(err) fprintf(stderr, "lookup error: %s\n", ub_strerror(err));
+ *	... use the answer
+ *
+ * Application not threaded. Non-blocking ('asynchronous').
+ *      err = ub_resolve_async(ctx, "www.example.com", ... my_callback);
+ *	... application resumes processing ...
+ *	... and when either ub_poll(ctx) is true
+ *	... or when the file descriptor ub_fd(ctx) is readable,
+ *	... or whenever, the app calls ...
+ *	ub_process(ctx);
+ *	... if no result is ready, the app resumes processing above,
+ *	... or process() calls my_callback() with results.
+ *
+ *      ... if the application has nothing more to do, wait for answer
+ *      ub_wait(ctx); 
+ *
+ * Application threaded. Blocking.
+ *	Blocking, same as above. The current thread does the work.
+ *	Multiple threads can use the *same context*, each does work and uses
+ *	shared cache data from the context.
+ *
+ * Application threaded. Non-blocking ('asynchronous').
+ *	... setup threaded-asynchronous config option
+ *	err = ub_ctx_async(ctx, 1);
+ *	... same as async for non-threaded
+ *	... the callbacks are called in the thread that calls process(ctx)
+ *
+ * If no threading is compiled in, the above async example uses fork(2) to
+ * create a process to perform the work. The forked process exits when the 
+ * calling process exits, or ctx_delete() is called.
+ * Otherwise, for asynchronous with threading, a worker thread is created.
+ *
+ * The blocking calls use shared ctx-cache when threaded. Thus
+ * ub_resolve() and ub_resolve_async() && ub_wait() are
+ * not the same. The first makes the current thread do the work, setting
+ * up buffers, etc, to perform the work (but using shared cache data).
+ * The second calls another worker thread (or process) to perform the work.
+ * And no buffers need to be set up, but a context-switch happens.
+ */
+#ifndef _UB_UNBOUND_H
+#define _UB_UNBOUND_H
+
+/**
+ * The validation context is created to hold the resolver status,
+ * validation keys and a small cache (containing messages, rrsets,
+ * roundtrip times, trusted keys, lameness information).
+ *
+ * Its contents are internally defined.
+ */
+struct ub_ctx;
+
+/**
+ * The validation and resolution results.
+ * Allocated by the resolver, and need to be freed by the application
+ * with ub_resolve_free().
+ */
+struct ub_result {
+	/** The original question, name text string. */
+	char* qname;
+	/** the type asked for */
+	int qtype;
+	/** the class asked for */
+	int qclass;
+
+	/** 
+	 * a list of network order DNS rdata items, terminated with a 
+	 * NULL pointer, so that data[0] is the first result entry,
+	 * data[1] the second, and the last entry is NULL. 
+	 * If there was no data, data[0] is NULL.
+	 */
+	char** data;
+
+	/** the length in bytes of the data items, len[i] for data[i] */
+	int* len;
+
+	/** 
+	 * canonical name for the result (the final cname). 
+	 * zero terminated string.
+	 * May be NULL if no canonical name exists.
+	 */
+	char* canonname;
+
+	/**
+	 * DNS RCODE for the result. May contain additional error code if
+	 * there was no data due to an error. 0 (NOERROR) if okay.
+	 */
+	int rcode;
+
+	/**
+	 * The DNS answer packet. Network formatted. Can contain DNSSEC types.
+	 */
+	void* answer_packet;
+	/** length of the answer packet in octets. */
+	int answer_len;
+
+	/**
+	 * If there is any data, this is true.
+	 * If false, there was no data (nxdomain may be true, rcode can be set).
+	 */
+	int havedata;
+
+	/** 
+	 * If there was no data, and the domain did not exist, this is true.
+	 * If it is false, and there was no data, then the domain name 
+	 * is purported to exist, but the requested data type is not available.
+	 */
+	int nxdomain;
+
+	/**
+	 * True, if the result is validated securely.
+	 * False, if validation failed or domain queried has no security info.
+	 *
+	 * It is possible to get a result with no data (havedata is false),
+	 * and secure is true. This means that the non-existance of the data
+	 * was cryptographically proven (with signatures).
+	 */
+	int secure;
+
+	/** 
+	 * If the result was not secure (secure==0), and this result is due 
+	 * to a security failure, bogus is true.
+	 * This means the data has been actively tampered with, signatures
+	 * failed, expected signatures were not present, timestamps on 
+	 * signatures were out of date and so on.
+	 *
+	 * If !secure and !bogus, this can happen if the data is not secure 
+	 * because security is disabled for that domain name. 
+	 * This means the data is from a domain where data is not signed.
+	 */
+	int bogus;
+};
+
+/**
+ * Callback for results of async queries.
+ * The readable function definition looks like:
+ * void my_callback(void* my_arg, int err, struct ub_result* result);
+ * It is called with
+ *	void* my_arg: your pointer to a (struct of) data of your choice, 
+ *		or NULL.
+ *	int err: if 0 all is OK, otherwise an error occured and no results
+ *	     are forthcoming.
+ *	struct result: pointer to more detailed result structure.
+ *		This structure is allocated on the heap and needs to be
+ *		freed with ub_resolve_free(result);
+ */
+typedef void (*ub_callback_t)(void*, int, struct ub_result*);
+
+/**
+ * Create a resolving and validation context.
+ * The information from /etc/resolv.conf and /etc/hosts is not utilised by
+ * default. Use ub_ctx_resolvconf and ub_ctx_hosts to read them.
+ * @return a new context. default initialisation.
+ * 	returns NULL on error.
+ */
+struct ub_ctx* ub_ctx_create(void);
+
+/**
+ * Destroy a validation context and free all its resources.
+ * Outstanding async queries are killed and callbacks are not called for them.
+ * @param ctx: context to delete.
+ */
+void ub_ctx_delete(struct ub_ctx* ctx);
+
+/**
+ * Set an option for the context.
+ * @param ctx: context.
+ * @param opt: option name from the unbound.conf config file format.
+ *	(not all settings applicable). The name includes the trailing ':'
+ *	for example ub_ctx_set_option("logfile:", "mylog.txt");
+ * 	This is a power-users interface that lets you specify all sorts
+ * 	of options.
+ * 	For some specific options, such as adding trust anchors, special
+ * 	routines exist.
+ * @param val: value of the option.
+ * @return: 0 if OK, else error.
+ */
+int ub_ctx_set_option(struct ub_ctx* ctx, char* opt, char* val);
+
+/**
+ * setup configuration for the given context.
+ * @param ctx: context.
+ * @param fname: unbound config file (not all settings applicable).
+ * 	This is a power-users interface that lets you specify all sorts
+ * 	of options.
+ * 	For some specific options, such as adding trust anchors, special
+ * 	routines exist.
+ * @return: 0 if OK, else error.
+ */
+int ub_ctx_config(struct ub_ctx* ctx, char* fname);
+
+/**
+ * Set machine to forward DNS queries to, the caching resolver to use. 
+ * IP4 or IP6 address. Forwards all DNS requests to that machine, which 
+ * is expected to run a recursive resolver. If the proxy is not 
+ * DNSSEC-capable, validation may fail. Can be called several times, in 
+ * that case the addresses are used as backup servers.
+ *
+ * To read the list of nameservers from /etc/resolv.conf (from DHCP or so),
+ * use the call ub_ctx_resolvconf.
+ *
+ * @param ctx: context.
+ *	At this time it is only possible to set configuration before the
+ *	first resolve is done.
+ * @param addr: address, IP4 or IP6 in string format.
+ * 	If the addr is NULL, forwarding is disabled.
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_set_fwd(struct ub_ctx* ctx, char* addr);
+
+/**
+ * Read list of nameservers to use from the filename given.
+ * Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
+ * If they do not support DNSSEC, validation may fail.
+ *
+ * Only nameservers are picked up, the searchdomain, ndots and other
+ * settings from resolv.conf(5) are ignored.
+ *
+ * @param ctx: context.
+ *	At this time it is only possible to set configuration before the
+ *	first resolve is done.
+ * @param fname: file name string. If NULL "/etc/resolv.conf" is used.
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_resolvconf(struct ub_ctx* ctx, char* fname);
+
+/**
+ * Read list of hosts from the filename given.
+ * Usually "/etc/hosts". 
+ * These addresses are not flagged as DNSSEC secure when queried for.
+ *
+ * @param ctx: context.
+ *	At this time it is only possible to set configuration before the
+ *	first resolve is done.
+ * @param fname: file name string. If NULL "/etc/hosts" is used.
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_hosts(struct ub_ctx* ctx, char* fname);
+
+/**
+ * Add a trust anchor to the given context.
+ * The trust anchor is a string, on one line, that holds a valid DNSKEY or
+ * DS RR. 
+ * @param ctx: context.
+ *	At this time it is only possible to add trusted keys before the
+ *	first resolve is done.
+ * @param ta: string, with zone-format RR on one line.
+ * 	[domainname] [TTL optional] [type] [class optional] [rdata contents]
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_add_ta(struct ub_ctx* ctx, char* ta);
+
+/**
+ * Add trust anchors to the given context.
+ * Pass name of a file with DS and DNSKEY records (like from dig or drill).
+ * @param ctx: context.
+ *	At this time it is only possible to add trusted keys before the
+ *	first resolve is done.
+ * @param fname: filename of file with keyfile with trust anchors.
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_add_ta_file(struct ub_ctx* ctx, char* fname);
+
+/**
+ * Add trust anchors to the given context.
+ * Pass the name of a bind-style config file with trusted-keys{}.
+ * @param ctx: context.
+ *	At this time it is only possible to add trusted keys before the
+ *	first resolve is done.
+ * @param fname: filename of file with bind-style config entries with trust
+ * 	anchors.
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_trustedkeys(struct ub_ctx* ctx, char* fname);
+
+/**
+ * Set debug output (and error output) to the specified stream.
+ * Pass NULL to disable. Default is stderr.
+ * @param ctx: context.
+ * @param out: FILE* out file stream to log to.
+ * 	Type void* to avoid stdio dependency of this header file.
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_debugout(struct ub_ctx* ctx, void* out);
+
+/**
+ * Set debug verbosity for the context
+ * Output is directed to stderr.
+ * @param ctx: context.
+ * @param d: debug level, 0 is off, 1 is very minimal, 2 is detailed, 
+ *	and 3 is lots.
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_debuglevel(struct ub_ctx* ctx, int d);
+
+/**
+ * Set a context behaviour for asynchronous action.
+ * @param ctx: context.
+ * @param dothread: if true, enables threading and a call to resolve_async() 
+ *	creates a thread to handle work in the background.
+ *	If false, a process is forked to handle work in the background.
+ *	Changes to this setting after async() calls have been made have 
+ *	no effect (delete and re-create the context to change).
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_async(struct ub_ctx* ctx, int dothread);
+
+/**
+ * Poll a context to see if it has any new results
+ * Do not poll in a loop, instead extract the fd below to poll for readiness,
+ * and then check, or wait using the wait routine.
+ * @param ctx: context.
+ * @return: 0 if nothing to read, or nonzero if a result is available.
+ * 	If nonzero, call ctx_process() to do callbacks.
+ */
+int ub_poll(struct ub_ctx* ctx);
+
+/**
+ * Wait for a context to finish with results. Calls ub_process() after
+ * the wait for you. After the wait, there are no more outstanding 
+ * asynchronous queries.
+ * @param ctx: context.
+ * @return: 0 if OK, else error.
+ */
+int ub_wait(struct ub_ctx* ctx);
+
+/**
+ * Get file descriptor. Wait for it to become readable, at this point
+ * answers are returned from the asynchronous validating resolver.
+ * Then call the ub_process to continue processing.
+ * This routine works immediately after context creation, the fd
+ * does not change.
+ * @param ctx: context.
+ * @return: -1 on error, or file descriptor to use select(2) with.
+ */
+int ub_fd(struct ub_ctx* ctx);
+
+/**
+ * Call this routine to continue processing results from the validating
+ * resolver (when the fd becomes readable).
+ * Will perform necessary callbacks.
+ * @param ctx: context
+ * @return: 0 if OK, else error.
+ */
+int ub_process(struct ub_ctx* ctx);
+
+/**
+ * Perform resolution and validation of the target name.
+ * @param ctx: context.
+ *	The context is finalized, and can no longer accept config changes.
+ * @param name: domain name in text format (a zero terminated text string).
+ * @param rrtype: type of RR in host order, 1 is A (address).
+ * @param rrclass: class of RR in host order, 1 is IN (for internet).
+ * @param result: the result data is returned in a newly allocated result
+ * 	structure. May be NULL on return, return value is set to an error 
+ * 	in that case (out of memory).
+ * @return 0 if OK, else error.
+ */
+int ub_resolve(struct ub_ctx* ctx, char* name, int rrtype, 
+	int rrclass, struct ub_result** result);
+
+/**
+ * Perform resolution and validation of the target name.
+ * Asynchronous, after a while, the callback will be called with your
+ * data and the result.
+ * @param ctx: context.
+ *	If no thread or process has been created yet to perform the
+ *	work in the background, it is created now.
+ *	The context is finalized, and can no longer accept config changes.
+ * @param name: domain name in text format (a string).
+ * @param rrtype: type of RR in host order, 1 is A.
+ * @param rrclass: class of RR in host order, 1 is IN (for internet).
+ * @param mydata: this data is your own data (you can pass NULL),
+ * 	and is passed on to the callback function.
+ * @param callback: this is called on completion of the resolution.
+ * 	It is called as:
+ * 	void callback(void* mydata, int err, struct ub_result* result)
+ * 	with mydata: the same as passed here, you may pass NULL,
+ * 	with err: is 0 when a result has been found.
+ * 	with result: a newly allocated result structure.
+ *		The result may be NULL, in that case err is set.
+ *
+ * 	If an error happens during processing, your callback will be called
+ * 	with error set to a nonzero value (and result==NULL).
+ * @param async_id: if you pass a non-NULL value, an identifier number is
+ *	returned for the query as it is in progress. It can be used to 
+ *	cancel the query.
+ * @return 0 if OK, else error.
+ */
+int ub_resolve_async(struct ub_ctx* ctx, char* name, int rrtype, 
+	int rrclass, void* mydata, ub_callback_t callback, int* async_id);
+
+/**
+ * Cancel an async query in progress.
+ * Its callback will not be called.
+ *
+ * @param ctx: context.
+ * @param async_id: which query to cancel.
+ * @return 0 if OK, else error.
+ */
+int ub_cancel(struct ub_ctx* ctx, int async_id);
+
+/**
+ * Free storage associated with a result structure.
+ * @param result: to free
+ */
+void ub_resolve_free(struct ub_result* result);
+
+/** 
+ * Convert error value to a human readable string.
+ * @param err: error code from one of the ub_val* functions.
+ * @return pointer to constant text string, zero terminated.
+ */
+const char* ub_strerror(int err);
+
+#endif /* _UB_UNBOUND_H */

ltmain.sh

@@ -1,8 +1,8 @@
 # ltmain.sh - Provide generalized library-building support services.
 # NOTE: Changing this file will not affect anything until you rerun configure.
 #
-# Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2003, 2004, 2005
-# Free Software Foundation, Inc.
+# Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2003, 2004, 2005, 2006,
+# 2007  Free Software Foundation, Inc.
 # Originally by Gordon Matzigkeit <gord@gnu.ai.mit.edu>, 1996
 #
 # This program is free software; you can redistribute it and/or modify
@@ -43,8 +43,8 @@ EXIT_FAILURE=1
 
 PROGRAM=ltmain.sh
 PACKAGE=libtool
-VERSION=1.5.22
-TIMESTAMP=" (1.1220.2.365 2005/12/18 22:14:06)"
+VERSION=1.5.24
+TIMESTAMP=" (1.1220.2.456 2007/06/24 02:25:32)"
 
 # Be Bourne compatible (taken from Autoconf:_AS_BOURNE_COMPATIBLE).
 if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then
@@ -57,6 +57,8 @@ if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then
 else
   case `(set -o) 2>/dev/null` in *posix*) set -o posix;; esac
 fi
+BIN_SH=xpg4; export BIN_SH # for Tru64
+DUALCASE=1; export DUALCASE # for MKS sh
 
 # Check that we have a working $echo.
 if test "X$1" = X--no-reexec; then
@@ -114,10 +116,10 @@ esac
 for lt_var in LANG LC_ALL LC_CTYPE LC_COLLATE LC_MESSAGES
 do
   eval "if test \"\${$lt_var+set}\" = set; then
-         save_$lt_var=\$$lt_var
-         $lt_var=C
-         export $lt_var
-       fi"
+	  save_$lt_var=\$$lt_var
+	  $lt_var=C
+	  export $lt_var
+	fi"
 done
 
 # Make sure IFS has a sensible default
@@ -206,7 +208,13 @@ func_win32_libid ()
     if eval $OBJDUMP -f $1 | $SED -e '10q' 2>/dev/null | \
       $EGREP -e 'file format pe-i386(.*architecture: i386)?' >/dev/null ; then
       win32_nmres=`eval $NM -f posix -A $1 | \
-	$SED -n -e '1,100{/ I /{s,.*,import,;p;q;};}'`
+	$SED -n -e '1,100{
+		/ I /{
+			s,.*,import,
+			p
+			q
+			}
+		}'`
       case $win32_nmres in
       import*)  win32_libid_type="x86 archive import";;
       *)        win32_libid_type="x86 archive static";;
@@ -340,11 +348,11 @@ func_extract_archives ()
       my_xlib_u=$my_xlib
       while :; do
         case " $extracted_archives " in
-       *" $my_xlib_u "*)
-         extracted_serial=`expr $extracted_serial + 1`
-         my_xlib_u=lt$extracted_serial-$my_xlib ;;
-       *) break ;;
-       esac
+	*" $my_xlib_u "*)
+	  extracted_serial=`expr $extracted_serial + 1`
+	  my_xlib_u=lt$extracted_serial-$my_xlib ;;
+	*) break ;;
+	esac
       done
       extracted_archives="$extracted_archives $my_xlib_u"
       my_xdir="$my_gentop/$my_xlib_u"
@@ -474,11 +482,12 @@ do
     ;;
 
   --version)
-    $echo "$PROGRAM (GNU $PACKAGE) $VERSION$TIMESTAMP"
-    $echo
-    $echo "Copyright (C) 2005  Free Software Foundation, Inc."
-    $echo "This is free software; see the source for copying conditions.  There is NO"
-    $echo "warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
+    echo "\
+$PROGRAM (GNU $PACKAGE) $VERSION$TIMESTAMP
+
+Copyright (C) 2007  Free Software Foundation, Inc.
+This is free software; see the source for copying conditions.  There is NO
+warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
     exit $?
     ;;
 
@@ -775,7 +784,7 @@ if test -z "$show_help"; then
     *.class) xform=class ;;
     *.cpp) xform=cpp ;;
     *.cxx) xform=cxx ;;
-    *.f90) xform=f90 ;;
+    *.[fF][09]?) xform=[fF][09]. ;;
     *.for) xform=for ;;
     *.java) xform=java ;;
     *.obj) xform=obj ;;
@@ -1160,8 +1169,8 @@ EOF
     do
       case $arg in
       -all-static | -static | -static-libtool-libs)
-    case $arg in
-    -all-static)
+	case $arg in
+	-all-static)
 	  if test "$build_libtool_libs" = yes && test -z "$link_static_flag"; then
 	    $echo "$modename: warning: complete static linking is impossible in this configuration" 1>&2
 	  fi
@@ -1170,19 +1179,19 @@ EOF
 	  fi
 	  prefer_static_libs=yes
 	  ;;
-    -static)
+	-static)
 	  if test -z "$pic_flag" && test -n "$link_static_flag"; then
 	    dlopen_self=$dlopen_self_static
 	  fi
 	  prefer_static_libs=built
 	  ;;
-    -static-libtool-libs)
-      if test -z "$pic_flag" && test -n "$link_static_flag"; then
-        dlopen_self=$dlopen_self_static
-      fi
-      prefer_static_libs=yes
-      ;;
-    esac
+	-static-libtool-libs)
+	  if test -z "$pic_flag" && test -n "$link_static_flag"; then
+	    dlopen_self=$dlopen_self_static
+	  fi
+	  prefer_static_libs=yes
+	  ;;
+	esac
 	build_libtool_libs=no
 	build_old_libs=yes
 	break
@@ -1630,7 +1639,7 @@ EOF
 	continue
 	;;
 
-     -mt|-mthreads|-kthread|-Kthread|-pthread|-pthreads|--thread-safe)
+     -mt|-mthreads|-kthread|-Kthread|-pthread|-pthreads|--thread-safe|-threads)
 	compiler_flags="$compiler_flags $arg"
 	compile_command="$compile_command $arg"
 	finalize_command="$finalize_command $arg"
@@ -1650,10 +1659,11 @@ EOF
       # -m* pass through architecture-specific compiler args for GCC
       # -m*, -t[45]*, -txscale* pass through architecture-specific
       # compiler args for GCC
-      # -pg pass through profiling flag for GCC
+      # -p, -pg, --coverage, -fprofile-* pass through profiling flag for GCC
+      # -F/path gives path to uninstalled frameworks, gcc on darwin
       # @file GCC response files
-      -64|-mips[0-9]|-r[0-9][0-9]*|-xarch=*|-xtarget=*|+DA*|+DD*|-q*|-m*|-pg| \
-      -t[45]*|-txscale*|@*)
+      -64|-mips[0-9]|-r[0-9][0-9]*|-xarch=*|-xtarget=*|+DA*|+DD*|-q*|-m*| \
+      -t[45]*|-txscale*|-p|-pg|--coverage|-fprofile-*|-F*|@*)
 
 	# Unknown arguments in both finalize_command and compile_command need
 	# to be aesthetically quoted because they are evaled later.
@@ -1681,9 +1691,9 @@ EOF
 
       -no-install)
 	case $host in
-	*-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-os2*)
+	*-*-cygwin* | *-*-mingw* | *-*-pw32* | *-*-os2* | *-*-darwin*)
 	  # The PATH hackery in wrapper scripts is required on Windows
-	  # in order for the loader to find any dlls it needs.
+	  # and Darwin in order for the loader to find any dlls it needs.
 	  $echo "$modename: warning: \`-no-install' is ignored for $host" 1>&2
 	  $echo "$modename: warning: assuming \`-no-fast-install' instead" 1>&2
 	  fast_install=no
@@ -2124,7 +2134,7 @@ EOF
 	lib=
 	found=no
 	case $deplib in
-	-mt|-mthreads|-kthread|-Kthread|-pthread|-pthreads|--thread-safe)
+	-mt|-mthreads|-kthread|-Kthread|-pthread|-pthreads|--thread-safe|-threads)
 	  if test "$linkmode,$pass" = "prog,link"; then
 	    compile_deplibs="$deplib $compile_deplibs"
 	    finalize_deplibs="$deplib $finalize_deplibs"
@@ -2520,9 +2530,9 @@ EOF
 
 	if test "$linkmode,$pass" = "prog,link"; then
 	  if test -n "$library_names" &&
-         { { test "$prefer_static_libs" = no ||
-             test "$prefer_static_libs,$installed" = "built,yes"; } ||
-           test -z "$old_library"; }; then
+	     { { test "$prefer_static_libs" = no ||
+		 test "$prefer_static_libs,$installed" = "built,yes"; } ||
+	       test -z "$old_library"; }; then
 	    # We need to hardcode the library path
 	    if test -n "$shlibpath_var" && test -z "$avoidtemprpath" ; then
 	      # Make sure the rpath contains only unique directories.
@@ -3229,9 +3239,10 @@ EOF
 	    age="0"
 	    ;;
 	  irix|nonstopux)
-	    current=`expr $number_major + $number_minor - 1`
+	    current=`expr $number_major + $number_minor`
 	    age="$number_minor"
 	    revision="$number_minor"
+	    lt_irix_increment=no
 	    ;;
 	  esac
 	  ;;
@@ -3290,7 +3301,8 @@ EOF
 	  versuffix="$major.$age.$revision"
 	  # Darwin ld doesn't like 0 for these options...
 	  minor_current=`expr $current + 1`
-	  verstring="${wl}-compatibility_version ${wl}$minor_current ${wl}-current_version ${wl}$minor_current.$revision"
+	  xlcverstring="${wl}-compatibility_version ${wl}$minor_current ${wl}-current_version ${wl}$minor_current.$revision"
+	  verstring="-compatibility_version $minor_current -current_version $minor_current.$revision"
 	  ;;
 
 	freebsd-aout)
@@ -3304,8 +3316,11 @@ EOF
 	  ;;
 
 	irix | nonstopux)
-	  major=`expr $current - $age + 1`
-
+	  if test "X$lt_irix_increment" = "Xno"; then
+	    major=`expr $current - $age`
+	  else
+	    major=`expr $current - $age + 1`
+	  fi
 	  case $version_type in
 	    nonstopux) verstring_prefix=nonstopux ;;
 	    *)         verstring_prefix=sgi ;;
@@ -3442,11 +3457,11 @@ EOF
       fi
 
       # Eliminate all temporary directories.
-#      for path in $notinst_path; do
-#	lib_search_path=`$echo "$lib_search_path " | ${SED} -e "s% $path % %g"`
-#	deplibs=`$echo "$deplibs " | ${SED} -e "s% -L$path % %g"`
-#	dependency_libs=`$echo "$dependency_libs " | ${SED} -e "s% -L$path % %g"`
-#      done
+      #for path in $notinst_path; do
+      #	lib_search_path=`$echo "$lib_search_path " | ${SED} -e "s% $path % %g"`
+      #	deplibs=`$echo "$deplibs " | ${SED} -e "s% -L$path % %g"`
+      #	dependency_libs=`$echo "$dependency_libs " | ${SED} -e "s% -L$path % %g"`
+      #done
 
       if test -n "$xrpath"; then
 	# If the user specified any rpath flags, then add them.
@@ -3547,7 +3562,7 @@ EOF
 	  int main() { return 0; }
 EOF
 	  $rm conftest
-      if $LTCC $LTCFLAGS -o conftest conftest.c $deplibs; then
+	  if $LTCC $LTCFLAGS -o conftest conftest.c $deplibs; then
 	    ldd_output=`ldd conftest`
 	    for i in $deplibs; do
 	      name=`expr $i : '-l\(.*\)'`
@@ -3909,7 +3924,10 @@ EOF
 	     test -n "$hardcode_libdirs"; then
 	    libdir="$hardcode_libdirs"
 	    if test -n "$hardcode_libdir_flag_spec_ld"; then
-	      eval dep_rpath=\"$hardcode_libdir_flag_spec_ld\"
+	      case $archive_cmds in
+	      *\$LD*) eval dep_rpath=\"$hardcode_libdir_flag_spec_ld\" ;;
+	      *)      eval dep_rpath=\"$hardcode_libdir_flag_spec\" ;;
+	      esac
 	    else
 	      eval dep_rpath=\"$hardcode_libdir_flag_spec\"
 	    fi
@@ -4275,7 +4293,7 @@ EOF
       if test -n "$convenience"; then
 	if test -n "$whole_archive_flag_spec"; then
 	  eval tmp_whole_archive_flags=\"$whole_archive_flag_spec\"
-      reload_conv_objs=$reload_objs\ `$echo "X$tmp_whole_archive_flags" | $Xsed -e 's|,| |g'`
+	  reload_conv_objs=$reload_objs\ `$echo "X$tmp_whole_archive_flags" | $Xsed -e 's|,| |g'`
 	else
 	  gentop="$output_objdir/${obj}x"
 	  generated="$generated $gentop"
@@ -5295,6 +5313,8 @@ if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then
 else
   case \`(set -o) 2>/dev/null\` in *posix*) set -o posix;; esac
 fi
+BIN_SH=xpg4; export BIN_SH # for Tru64
+DUALCASE=1; export DUALCASE # for MKS sh
 
 # The HP-UX ksh and POSIX shell print the target directory to stdout
 # if CDPATH is set.
@@ -6391,8 +6411,10 @@ relink_command=\"$relink_command\""
 	if test -f "$dir/$objdir/$dlname"; then
 	  dir="$dir/$objdir"
 	else
-	  $echo "$modename: cannot find \`$dlname' in \`$dir' or \`$dir/$objdir'" 1>&2
-	  exit $EXIT_FAILURE
+	  if test ! -f "$dir/$dlname"; then
+	    $echo "$modename: cannot find \`$dlname' in \`$dir' or \`$dir/$objdir'" 1>&2
+	    exit $EXIT_FAILURE
+	  fi
 	fi
 	;;
 
@@ -6458,12 +6480,11 @@ relink_command=\"$relink_command\""
       # Restore saved environment variables
       for lt_var in LANG LC_ALL LC_CTYPE LC_COLLATE LC_MESSAGES
       do
-       eval "if test \"\${save_$lt_var+set}\" = set; then
-               $lt_var=\$save_$lt_var; export $lt_var
-             fi"
+	eval "if test \"\${save_$lt_var+set}\" = set; then
+		$lt_var=\$save_$lt_var; export $lt_var
+	      fi"
       done
 
-
       # Now prepare to actually exec the command.
       exec_cmd="\$cmd$args"
     else

makedist.sh

@@ -146,7 +146,9 @@ if test -z "$LDNSDIR"; then
     # try to autodetect from Makefile (if present)
     if test -f Makefile; then
 	  eval `grep 'ldnsdir=' Makefile`
-	  LDNSDIR="$ldnsdir"
+	  if echo "$ldnsdir" | grep -v ldns-src/ >/dev/null 2>&1; then
+	  	LDNSDIR="$ldnsdir"
+	  fi
     fi
 fi
 
@@ -182,6 +184,7 @@ flex -i -t util/configlexer.lex >> util/configlexer.c  || error_cleanup "Failed
 bison -y -d -o util/configparser.c util/configparser.y || error_cleanup "Failed to create configparser"
 
 # check shared code, ldns-testpkts from ldns examples, if possible.
+cd ../..
 if test ! -z "$LDNSDIR"; then
 	if diff -q $LDNSDIR/examples/ldns-testpkts.c testcode/ldns-testpkts.c &&
 	   diff -q $LDNSDIR/examples/ldns-testpkts.h testcode/ldns-testpkts.h; then
@@ -190,6 +193,7 @@ if test ! -z "$LDNSDIR"; then
 		error_cleanup "ldns-testpkts is different in ldns and unbound"
 	fi
 fi
+cd $temp_dir/unbound
 
 find . -name .c-mode-rc.el -exec rm {} \;
 find . -name .cvsignore -exec rm {} \;
@@ -208,7 +212,11 @@ if [ "$SNAPSHOT" = "yes" ]; then
 fi
 
 replace_all doc/README
-replace_all doc/unbound.8
+replace_all doc/unbound.8.in
+replace_all doc/unbound.conf.5.in
+replace_all doc/unbound-checkconf.8.in
+replace_all doc/unbound-host.1
+replace_all doc/libunbound.3.in
 
 info "Renaming Unbound directory to unbound-$version."
 cd ..
@@ -229,15 +237,19 @@ cleanup
 case $OSTYPE in
         linux*)
                 sha=`sha1sum unbound-$version.tar.gz |  awk '{ print $1 }'`
+                sha256=`sha256sum unbound-$version.tar.gz |  awk '{ print $1 }'`
                 ;;
         freebsd*)
                 sha=`sha1  unbound-$version.tar.gz |  awk '{ print $5 }'`
+                sha256=`sha256  unbound-$version.tar.gz |  awk '{ print $5 }'`
                 ;;
 	*)
                 sha=`sha1sum unbound-$version.tar.gz |  awk '{ print $1 }'`
+                sha256=`sha256sum unbound-$version.tar.gz |  awk '{ print $1 }'`
                 ;;
 esac
 echo $sha > unbound-$version.tar.gz.sha1
+echo $sha256 > unbound-$version.tar.gz.sha256
 
 info "Unbound distribution created successfully."
 info "SHA1sum: $sha"

services/cache/dns.c

@@ -52,7 +52,7 @@
 /** store rrsets in the rrset cache. 
  * @param env: module environment with caches.
  * @param rep: contains list of rrsets to store.
- * @param now: current time(NULL).
+ * @param now: current time.
  */
 static void
 store_rrsets(struct module_env* env, struct reply_info* rep, uint32_t now)
@@ -73,7 +73,7 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 	hashvalue_t hash, struct reply_info* rep)
 {
 	struct msgreply_entry* e;
-	uint32_t now = time(NULL), ttl = rep->ttl;
+	uint32_t ttl = rep->ttl;
 	size_t i;
 
 	/* store RRsets */
@@ -82,8 +82,8 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 		rep->ref[i].id = rep->rrsets[i]->id;
 	}
 	reply_info_sortref(rep);
-	reply_info_set_ttls(rep, now);
-	store_rrsets(env, rep, now);
+	reply_info_set_ttls(rep, *env->now);
+	store_rrsets(env, rep, *env->now);
 	if(ttl == 0) {
 		/* we do not store the message, but we did store the RRs,
 		 * which could be useful for delegation information */
@@ -219,7 +219,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 {
 	struct delegpt_ns* ns;
 	struct ub_packed_rrset_key* akey;
-	uint32_t now = time(NULL);
+	uint32_t now = *env->now;
 	for(ns = dp->nslist; ns; ns = ns->next) {
 		if(ns->resolved)
 			continue;
@@ -465,6 +465,10 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	size_t newlen, dtarglen;
 	if(now > d->ttl)
 		return NULL;
+	/* only allow validated (with DNSSEC) DNAMEs used from cache 
+	 * for insecure DNAMEs, query again. */
+	if(d->security != sec_status_secure)
+		return NULL;
 	msg = gen_dns_msg(region, q, 2); /* DNAME + CNAME RRset */
 	if(!msg)
 		return NULL;
@@ -543,7 +547,7 @@ dns_cache_lookup(struct module_env* env,
 	struct lruhash_entry* e;
 	struct query_info k;
 	hashvalue_t h;
-	uint32_t now = (uint32_t)time(NULL);
+	uint32_t now = *env->now;
 	struct ub_packed_rrset_key* rrset;
 
 	/* lookup first, this has both NXdomains and ANSWER responses */
@@ -630,16 +634,15 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 	if(is_referral) {
 		/* store rrsets */
 		struct rrset_ref ref;
-		uint32_t now = time(NULL);
 		size_t i;
 		for(i=0; i<rep->rrset_count; i++) {
 			packed_rrset_ttl_add((struct packed_rrset_data*)
-				rep->rrsets[i]->entry.data, now);
+				rep->rrsets[i]->entry.data, *env->now);
 			ref.key = rep->rrsets[i];
 			ref.id = rep->rrsets[i]->id;
 			/*ignore ret: it was in the cache, ref updated */
 			(void)rrset_cache_update(env->rrset_cache, &ref, 
-				env->alloc, now);
+				env->alloc, *env->now);
 		}
 		free(rep);
 		return 1;

services/cache/infra.c

@@ -64,12 +64,11 @@ infra_host_compfunc(void* key1, void* key2)
 }
 
 void 
-infra_host_delkeyfunc(void* k, void* ATTR_UNUSED(arg), int il)
+infra_host_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
 {
 	struct infra_host_key* key = (struct infra_host_key*)k;
 	if(!key)
 		return;
-	if(il) { lock_rw_unlock(&key->entry.lock); }
 	lock_rw_destroy(&key->entry.lock);
 	free(key);
 }
@@ -159,7 +158,7 @@ infra_lookup_host_nottl(struct infra_cache* infra,
 struct infra_host_data* 
 infra_lookup_host(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen, int wr,
-        time_t timenow, struct infra_host_key** key)
+        uint32_t timenow, struct infra_host_key** key)
 {
 	struct infra_host_data* data;
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
@@ -187,7 +186,7 @@ infra_lookup_host(struct infra_cache* infra,
  */
 static struct lruhash_entry*
 new_host_entry(struct infra_cache* infra, struct sockaddr_storage* addr, 
-	socklen_t addrlen, time_t tm)
+	socklen_t addrlen, uint32_t tm)
 {
 	struct infra_host_data* data;
 	struct infra_host_key* key = (struct infra_host_key*)malloc(
@@ -215,7 +214,7 @@ new_host_entry(struct infra_cache* infra, struct sockaddr_storage* addr,
 
 int 
 infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
-        socklen_t addrlen, time_t timenow, int* edns_vs, int* to)
+        socklen_t addrlen, uint32_t timenow, int* edns_vs, int* to)
 {
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
 		addrlen, 0);
@@ -261,12 +260,12 @@ hash_lameness(uint8_t* name, size_t namelen)
 
 int 
 infra_lookup_lame(struct infra_host_data* host,
-        uint8_t* name, size_t namelen, time_t timenow)
+        uint8_t* name, size_t namelen, uint32_t timenow,
+	int* dlame, int* alame, int* olame)
 {
 	struct lruhash_entry* e;
 	struct infra_lame_key k;
 	struct infra_lame_data *d;
-	int dl;
 	if(!host->lameness)
 		return 0;
 	k.entry.hash = hash_lameness(name, namelen);
@@ -282,9 +281,11 @@ infra_lookup_lame(struct infra_host_data* host,
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
-	dl = d->isdnsseclame;
+	*dlame = d->isdnsseclame;
+	*alame = d->lame_type_A;
+	*olame = d->lame_other;
 	lock_rw_unlock(&e->lock);
-	return dl?2:1;
+	return *dlame || *alame || *olame;
 }
 
 size_t 
@@ -309,12 +310,11 @@ infra_lame_compfunc(void* key1, void* key2)
 }
 
 void 
-infra_lame_delkeyfunc(void* k, void* ATTR_UNUSED(arg), int il)
+infra_lame_delkeyfunc(void* k, void* ATTR_UNUSED(arg))
 {
 	struct infra_lame_key* key = (struct infra_lame_key*)k;
 	if(!key) 
 		return;
-	if(il) { lock_rw_unlock(&key->entry.lock); }
 	lock_rw_destroy(&key->entry.lock);
 	free(key->zonename);
 	free(key);
@@ -331,7 +331,8 @@ infra_lame_deldatafunc(void* d, void* ATTR_UNUSED(arg))
 int 
 infra_set_lame(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-        uint8_t* name, size_t namelen, time_t timenow, int dnsseclame)
+        uint8_t* name, size_t namelen, uint32_t timenow, int dnsseclame,
+	uint16_t qtype)
 {
 	struct infra_host_data* data;
 	struct lruhash_entry* e;
@@ -363,6 +364,8 @@ infra_set_lame(struct infra_cache* infra,
 	k->entry.data = (void*)d;
 	d->ttl = timenow + infra->lame_ttl;
 	d->isdnsseclame = dnsseclame;
+	d->lame_type_A = (!dnsseclame && qtype == LDNS_RR_TYPE_A);
+	d->lame_other = (!dnsseclame && qtype != LDNS_RR_TYPE_A);
 	k->namelen = namelen;
 	e = infra_lookup_host_nottl(infra, addr, addrlen, 1);
 	if(!e) {
@@ -394,7 +397,18 @@ infra_set_lame(struct infra_cache* infra,
 			free(d);
 			return 0;
 		}
+	} else {
+		/* lookup existing lameness entry (if any) and merge data */
+		int dlame, alame, olame; 
+		if(infra_lookup_lame(data, name, namelen, timenow,
+			&dlame, &alame, &olame)) { 
+			/* merge data into new structure */
+			if(dlame) d->isdnsseclame = 1;
+			if(alame) d->lame_type_A = 1;
+			if(olame) d->lame_other = 1;
+		}
 	}
+
 	/* inserts new entry, or updates TTL of older entry */
 	lruhash_insert(data->lameness, k->entry.hash, &k->entry, d, NULL);
 	
@@ -424,7 +438,7 @@ infra_update_tcp_works(struct infra_cache* infra,
 int 
 infra_rtt_update(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-        int roundtrip, time_t timenow)
+        int roundtrip, uint32_t timenow)
 {
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
 		addrlen, 1);
@@ -454,7 +468,7 @@ infra_rtt_update(struct infra_cache* infra,
 int 
 infra_edns_update(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-        int edns_version, time_t timenow)
+        int edns_version, uint32_t timenow)
 {
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
 		addrlen, 1);
@@ -479,28 +493,36 @@ infra_edns_update(struct infra_cache* infra,
 int 
 infra_get_lame_rtt(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-        uint8_t* name, size_t namelen, int* lame, int* dnsseclame,
-	int* rtt, time_t timenow)
+        uint8_t* name, size_t namelen, uint16_t qtype, 
+	int* lame, int* dnsseclame, int* rtt, uint32_t timenow)
 {
 	struct infra_host_data* host;
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
 		addrlen, 0);
-	int lm;
+	int dlm, alm, olm;
 	if(!e) 
 		return 0;
 	host = (struct infra_host_data*)e->data;
 	*rtt = rtt_unclamped(&host->rtt);
 	/* check lameness first, if so, ttl on host does not matter anymore */
-	if((lm=infra_lookup_lame(host, name, namelen, timenow))) {
-		lock_rw_unlock(&e->lock);
-		if(lm == 1) {
+	if(infra_lookup_lame(host, name, namelen, timenow, &dlm, &alm, &olm)) {
+		if(alm && qtype == LDNS_RR_TYPE_A) {
+			lock_rw_unlock(&e->lock);
 			*lame = 1;
 			*dnsseclame = 0;
-		} else {
+			return 1;
+		} else if(olm && qtype != LDNS_RR_TYPE_A) {
+			lock_rw_unlock(&e->lock);
+			*lame = 1;
+			*dnsseclame = 0;
+			return 1;
+		} else if(dlm) {
+			lock_rw_unlock(&e->lock);
 			*lame = 0;
 			*dnsseclame = 1;
+			return 1;
 		}
-		return 1;
+		/* no lameness for this type of query */
 	}
 	*lame = 0;
 	*dnsseclame = 0;

services/cache/infra.h

@@ -63,7 +63,7 @@ struct infra_host_key {
  */
 struct infra_host_data {
 	/** TTL value for this entry. absolute time. */
-	time_t ttl;
+	uint32_t ttl;
 	/** round trip times for timeout calculation */
 	struct rtt_info rtt;
 	/** Names of the zones that are lame. NULL=no lame zones. */
@@ -90,10 +90,14 @@ struct infra_lame_key {
  */
 struct infra_lame_data {
 	/** TTL of this entry. absolute time. */
-	time_t ttl;
+	uint32_t ttl;
 	/** is the host lame (does not serve the zone authoritatively),
 	 * or is the host dnssec lame (does not serve DNSSEC data) */
 	int isdnsseclame;
+	/** the host is lame (not authoritative) for A records */
+	int lame_type_A;
+	/** the host is lame (not authoritative) for other query types */
+	int lame_other;
 };
 
 /**
@@ -151,7 +155,7 @@ struct infra_cache* infra_adjust(struct infra_cache* infra,
  */
 struct infra_host_data* infra_lookup_host(struct infra_cache* infra, 
 	struct sockaddr_storage* addr, socklen_t addrlen, int wr, 
-	time_t timenow, struct infra_host_key** key);
+	uint32_t timenow, struct infra_host_key** key);
 
 /**
  * Find host information to send a packet. Creates new entry if not found.
@@ -166,7 +170,7 @@ struct infra_host_data* infra_lookup_host(struct infra_cache* infra,
  * @return: 0 on error.
  */
 int infra_host(struct infra_cache* infra, struct sockaddr_storage* addr, 
-	socklen_t addrlen, time_t timenow, int* edns_vs, int* to);
+	socklen_t addrlen, uint32_t timenow, int* edns_vs, int* to);
 
 /**
  * Check for lameness of this server for a particular zone.
@@ -175,10 +179,14 @@ int infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
  * @param name: domain name of zone apex.
  * @param namelen: length of domain name.
  * @param timenow: what time it is now.
- * @return: 0 if not lame or unknown or timed out, 1 if lame, 2 if dnsseclame.
+ * @param dlame: if the function returns true, is set true if dnssec lame.
+ * @param alame: if the function returns true, is set true if qtype A lame.
+ * @param olame: if the function returns true, is set true if qtype other lame.
+ * @return: 0 if not lame or unknown or timed out, 1 if lame
  */
 int infra_lookup_lame(struct infra_host_data* host,
-	uint8_t* name, size_t namelen, time_t timenow);
+	uint8_t* name, size_t namelen, uint32_t timenow,
+	int* dlame, int* alame, int* olame);
 
 /**
  * Set a host to be lame for the given zone.
@@ -190,11 +198,13 @@ int infra_lookup_lame(struct infra_host_data* host,
  * @param timenow: what time it is now.
  * @param dnsseclame: if true the host is set dnssec lame.
  *	if false, the host is marked lame (not serving the zone).
+ * @param qtype: the query type for which it is lame.
  * @return: 0 on error.
  */
 int infra_set_lame(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-	uint8_t* name, size_t namelen, time_t timenow, int dnsseclame);
+	uint8_t* name, size_t namelen, uint32_t timenow, int dnsseclame,
+	uint16_t qtype);
 
 /**
  * Update rtt information for the host.
@@ -208,7 +218,7 @@ int infra_set_lame(struct infra_cache* infra,
  */
 int infra_rtt_update(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-	int roundtrip, time_t timenow);
+	int roundtrip, uint32_t timenow);
 
 /**
  * Update information for the host, store that a TCP transaction works.
@@ -230,7 +240,7 @@ void infra_update_tcp_works(struct infra_cache* infra,
  */
 int infra_edns_update(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-	int edns_version, time_t timenow);
+	int edns_version, uint32_t timenow);
 
 /**
  * Get Lameness information and average RTT if host is in the cache.
@@ -239,6 +249,7 @@ int infra_edns_update(struct infra_cache* infra,
  * @param addrlen: length of addr.
  * @param name: zone name.
  * @param namelen: zone name length.
+ * @param qtype: the query to be made.
  * @param lame: if function returns true, this returns lameness of the zone.
  * @param dnsseclame: if function returns true, this returns if the zone
  *	is dnssec-lame.
@@ -249,8 +260,8 @@ int infra_edns_update(struct infra_cache* infra,
  */
 int infra_get_lame_rtt(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen, 
-	uint8_t* name, size_t namelen, int* lame, int* dnsseclame,
-	int* rtt, time_t timenow);
+	uint8_t* name, size_t namelen, uint16_t qtype, 
+	int* lame, int* dnsseclame, int* rtt, uint32_t timenow);
 
 /**
  * Get memory used by the infra cache.
@@ -267,7 +278,7 @@ size_t infra_host_sizefunc(void* k, void* d);
 int infra_host_compfunc(void* key1, void* key2);
 
 /** delete key, and destroy the lock */
-void infra_host_delkeyfunc(void* k, void* arg, int il);
+void infra_host_delkeyfunc(void* k, void* arg);
 
 /** delete data and destroy the lameness hashtable */
 void infra_host_deldatafunc(void* d, void* arg);
@@ -280,7 +291,7 @@ size_t infra_lame_sizefunc(void* k, void* d);
 int infra_lame_compfunc(void* key1, void* key2);
 
 /** free key, lock and zonename */
-void infra_lame_delkeyfunc(void* k, void* arg, int il);
+void infra_lame_delkeyfunc(void* k, void* arg);
 
 /** free the lameness data */
 void infra_lame_deldatafunc(void* d, void* arg);

services/cache/rrset.c

@@ -47,6 +47,13 @@
 #include "util/regional.h"
 #include "util/alloc.h"
 
+void
+rrset_markdel(void* key)
+{
+	struct ub_packed_rrset_key* r = (struct ub_packed_rrset_key*)key;
+	r->id = 0;
+}
+
 struct rrset_cache* rrset_cache_create(struct config_file* cfg, 
 	struct alloc_cache* alloc)
 {
@@ -57,6 +64,7 @@ struct rrset_cache* rrset_cache_create(struct config_file* cfg,
 	struct rrset_cache *r = (struct rrset_cache*)slabhash_create(slabs,
 		startarray, maxmem, ub_rrset_sizefunc, ub_rrset_compare,
 		ub_rrset_key_delete, rrset_data_delete, alloc);
+	slabhash_setmarkdel(&r->table, &rrset_markdel);
 	return r;
 }
 
@@ -65,6 +73,7 @@ void rrset_cache_delete(struct rrset_cache* r)
 	if(!r) 
 		return;
 	slabhash_delete(&r->table);
+	/* slabhash delete also does free(r), since table is first in struct*/
 }
 
 struct rrset_cache* rrset_cache_adjust(struct rrset_cache *r, 
@@ -300,9 +309,8 @@ rrset_array_unlock_touch(struct rrset_cache* r, struct regional* scratch,
 
 void 
 rrset_update_sec_status(struct rrset_cache* r, 
-	struct ub_packed_rrset_key* rrset)
+	struct ub_packed_rrset_key* rrset, uint32_t now)
 {
-	uint32_t now = (uint32_t)time(0);
 	struct packed_rrset_data* updata = 
 		(struct packed_rrset_data*)rrset->entry.data;
 	struct lruhash_entry* e;
@@ -330,9 +338,8 @@ rrset_update_sec_status(struct rrset_cache* r,
 
 void 
 rrset_check_sec_status(struct rrset_cache* r, 
-	struct ub_packed_rrset_key* rrset)
+	struct ub_packed_rrset_key* rrset, uint32_t now)
 {
-	uint32_t now = (uint32_t)time(0);
 	struct packed_rrset_data* updata = 
 		(struct packed_rrset_data*)rrset->entry.data;
 	struct lruhash_entry* e;

services/cache/rrset.h

@@ -192,9 +192,10 @@ void rrset_array_unlock_touch(struct rrset_cache* r, struct regional* scratch,
  * @param r: the rrset cache. 
  * @param rrset: which rrset to attempt to update. This rrset is left 
  * 	untouched. The rrset in the cache is updated in-place.
+ * @param now: current time.
  */
 void rrset_update_sec_status(struct rrset_cache* r, 
-	struct ub_packed_rrset_key* rrset);
+	struct ub_packed_rrset_key* rrset, uint32_t now);
 
 /**
  * Looks up security status of an rrset. Looks up the rrset.
@@ -203,8 +204,12 @@ void rrset_update_sec_status(struct rrset_cache* r,
  * @param r: the rrset cache. 
  * @param rrset: This rrset may change security status due to the cache.
  * 	But its status will only improve, towards secure.
+ * @param now: current time.
  */
 void rrset_check_sec_status(struct rrset_cache* r, 
-	struct ub_packed_rrset_key* rrset);
+	struct ub_packed_rrset_key* rrset, uint32_t now);
+
+/** mark rrset to be deleted, set id=0 */
+void rrset_markdel(void* key);
 
 #endif /* SERVICES_CACHE_RRSET_H */

services/listen_dnsport.c

@@ -49,7 +49,9 @@
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
 #endif
+#ifdef HAVE_NETDB_H
 #include <netdb.h>
+#endif
 #include <fcntl.h>
 
 /** number of queued TCP connections for listen() */
@@ -86,24 +88,54 @@ verbose_print_addr(struct addrinfo *addr)
 }
 
 int
-create_udp_sock(struct addrinfo *addr)
+create_udp_sock(int family, int socktype, struct sockaddr* addr,
+        socklen_t addrlen, int v6only, int* inuse, int* noproto)
 {
 	int s;
-# if defined(IPV6_V6ONLY)
+# if defined(IPV6_USE_MIN_MTU)
 	int on=1;
+# else
+	(void)v6only;
 # endif
-	verbose_print_addr(addr);
-	if((s = socket(addr->ai_family, addr->ai_socktype, 0)) == -1) {
+	if((s = socket(family, socktype, 0)) == -1) {
+		*inuse = 0;
+#ifndef USE_WINSOCK
+		if(errno == EAFNOSUPPORT || errno == EPROTONOSUPPORT) {
+			*noproto = 1;
+			return -1;
+		}
 		log_err("can't create socket: %s", strerror(errno));
+#else
+		if(WSAGetLastError() == WSAEAFNOSUPPORT || 
+			WSAGetLastError() == WSAEPROTONOSUPPORT) {
+			*noproto = 1;
+			return -1;
+		}
+		log_err("can't create socket: %s", 
+			wsa_strerror(WSAGetLastError()));
+#endif
+		*noproto = 0;
 		return -1;
 	}
-	if(addr->ai_family == AF_INET6) {
+	if(family == AF_INET6) {
 # if defined(IPV6_V6ONLY)
-		if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, 
-			&on, (socklen_t)sizeof(on)) < 0) {
-			log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s",
-				strerror(errno));
-			return -1;
+		if(v6only) {
+			int val=(v6only==2)?0:1;
+			if (setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, 
+				(void*)&val, (socklen_t)sizeof(val)) < 0) {
+#ifndef USE_WINSOCK
+				log_err("setsockopt(..., IPV6_V6ONLY"
+					", ...) failed: %s", strerror(errno));
+#else
+				log_err("setsockopt(..., IPV6_V6ONLY"
+					", ...) failed: %s", 
+					wsa_strerror(WSAGetLastError()));
+#endif
+				close(s);
+				*noproto = 0;
+				*inuse = 0;
+				return -1;
+			}
 		}
 # endif
 # if defined(IPV6_USE_MIN_MTU)
@@ -116,72 +148,130 @@ create_udp_sock(struct addrinfo *addr)
 		 * network stack supports IPV6_USE_MIN_MTU.
 		 */
 		if (setsockopt(s, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
-			&on, (socklen_t)sizeof(on)) < 0) {
+			(void*)&on, (socklen_t)sizeof(on)) < 0) {
+#ifndef USE_WINSOCK
 			log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
 				"...) failed: %s", strerror(errno));
+#else
+			log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
+				"...) failed: %s", 
+				wsa_strerror(WSAGetLastError()));
+#endif
+			close(s);
+			*noproto = 0;
+			*inuse = 0;
 			return -1;
 		}
 # endif
 	}
-	if(bind(s, (struct sockaddr*)addr->ai_addr, addr->ai_addrlen) != 0) {
-		log_err("can't bind socket: %s", strerror(errno));
+	if(bind(s, (struct sockaddr*)addr, addrlen) != 0) {
+		*noproto = 0;
+#ifndef USE_WINSOCK
+#ifdef EADDRINUSE
+		*inuse = (errno == EADDRINUSE);
+		if(errno != EADDRINUSE)
+			log_err("can't bind socket: %s", strerror(errno));
+#endif
+#else /* USE_WINSOCK */
+		if(WSAGetLastError() != WSAEADDRINUSE &&
+			WSAGetLastError() != WSAEADDRNOTAVAIL)
+			log_err("can't bind socket: %s", 
+				wsa_strerror(WSAGetLastError()));
+#endif
+		close(s);
 		return -1;
 	}
-	if(!fd_set_nonblock(s))
+	if(!fd_set_nonblock(s)) {
+		*noproto = 0;
+		*inuse = 0;
+		close(s);
 		return -1;
+	}
 	return s;
 }
 
 /**
  * Create and bind TCP listening socket
  * @param addr: address info ready to make socket.
+ * @param v6only: enable ip6 only flag on ip6 sockets.
+ * @param noproto: if error caused by lack of protocol support.
  * @return: the socket. -1 on error.
  */
 static int
-create_tcp_accept_sock(struct addrinfo *addr)
+create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto)
 {
-	int s, flag;
+	int s;
 #if defined(SO_REUSEADDR) || defined(IPV6_V6ONLY)
 	int on = 1;
 #endif /* SO_REUSEADDR || IPV6_V6ONLY */
 	verbose_print_addr(addr);
+	*noproto = 0;
 	if((s = socket(addr->ai_family, addr->ai_socktype, 0)) == -1) {
+#ifndef USE_WINSOCK
+		if(errno == EAFNOSUPPORT || errno == EPROTONOSUPPORT) {
+			*noproto = 1;
+			return -1;
+		}
 		log_err("can't create socket: %s", strerror(errno));
+#else
+		if(WSAGetLastError() == WSAEAFNOSUPPORT ||
+			WSAGetLastError() == WSAEPROTONOSUPPORT) {
+			*noproto = 1;
+			return -1;
+		}
+		log_err("can't create socket: %s", 
+			wsa_strerror(WSAGetLastError()));
+#endif
 		return -1;
 	}
 #ifdef SO_REUSEADDR
-	if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, &on, 
+	if(setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void*)&on, 
 		(socklen_t)sizeof(on)) < 0) {
+#ifndef USE_WINSOCK
 		log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
 			strerror(errno));
+#else
+		log_err("setsockopt(.. SO_REUSEADDR ..) failed: %s",
+			wsa_strerror(WSAGetLastError()));
+#endif
 		return -1;
 	}
 #endif /* SO_REUSEADDR */
 #if defined(IPV6_V6ONLY)
-	if(addr->ai_family == AF_INET6) {
+	if(addr->ai_family == AF_INET6 && v6only) {
 		if(setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY, 
-			&on, (socklen_t)sizeof(on)) < 0) {
+			(void*)&on, (socklen_t)sizeof(on)) < 0) {
+#ifndef USE_WINSOCK
 			log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s",
 				strerror(errno));
+#else
+			log_err("setsockopt(..., IPV6_V6ONLY, ...) failed: %s",
+				wsa_strerror(WSAGetLastError()));
+#endif
 			return -1;
 		}
 	}
+#else
+	(void)v6only;
 #endif /* IPV6_V6ONLY */
-	if(bind(s, (struct sockaddr*)addr->ai_addr, addr->ai_addrlen) != 0) {
+	if(bind(s, addr->ai_addr, addr->ai_addrlen) != 0) {
+#ifndef USE_WINSOCK
 		log_err("can't bind socket: %s", strerror(errno));
+#else
+		log_err("can't bind socket: %s", 
+			wsa_strerror(WSAGetLastError()));
+#endif
 		return -1;
 	}
-	if((flag = fcntl(s, F_GETFL)) == -1) {
-		log_err("can't fcntl F_GETFL: %s", strerror(errno));
-		flag = 0;
-	}
-	flag |= O_NONBLOCK;
-	if(fcntl(s, F_SETFL, flag) == -1) {
-		log_err("can't fcntl F_SETFL: %s", strerror(errno));
+	if(!fd_set_nonblock(s)) {
 		return -1;
 	}
 	if(listen(s, TCP_BACKLOG) == -1) {
+#ifndef USE_WINSOCK
 		log_err("can't listen: %s", strerror(errno));
+#else
+		log_err("can't listen: %s", wsa_strerror(WSAGetLastError()));
+#endif
 		return -1;
 	}
 	return s;
@@ -192,20 +282,39 @@ create_tcp_accept_sock(struct addrinfo *addr)
  */
 static int
 make_sock(int stype, const char* ifname, const char* port, 
-	struct addrinfo *hints)
+	struct addrinfo *hints, int v6only, int* noip6)
 {
 	struct addrinfo *res = NULL;
-	int r, s;
+	int r, s, inuse, noproto;
 	hints->ai_socktype = stype;
+	*noip6 = 0;
 	if((r=getaddrinfo(ifname, port, hints, &res)) != 0 || !res) {
 		log_err("node %s:%s getaddrinfo: %s %s", 
 			ifname?ifname:"default", port, gai_strerror(r),
-			r==EAI_SYSTEM?(char*)strerror(errno):"");
+#ifdef EAI_SYSTEM
+			r==EAI_SYSTEM?(char*)strerror(errno):""
+#else
+			""
+#endif
+		);
 		return -1;
 	}
-	if(stype == SOCK_DGRAM)
-		s = create_udp_sock(res);
-	else	s = create_tcp_accept_sock(res);
+	if(stype == SOCK_DGRAM) {
+		verbose_print_addr(res);
+		s = create_udp_sock(res->ai_family, res->ai_socktype,
+			(struct sockaddr*)res->ai_addr, 
+			res->ai_addrlen, v6only, &inuse, &noproto);
+		if(s == -1 && inuse) {
+			log_err("bind: address already in use");
+		} else if(s == -1 && noproto && hints->ai_family == AF_INET6){
+			*noip6 = 1;
+		}
+	} else	{
+		s = create_tcp_accept_sock(res, v6only, &noproto);
+		if(s == -1 && noproto && hints->ai_family == AF_INET6){
+			*noip6 = 1;
+		}
+	}
 	freeaddrinfo(res);
 	return s;
 }
@@ -214,11 +323,11 @@ make_sock(int stype, const char* ifname, const char* port,
  * Add port to open ports list.
  * @param list: list head. changed.
  * @param s: fd.
- * @param is_udp: if fd is UDP.
+ * @param ftype: if fd is UDP.
  * @return false on failure. list in unchanged then.
  */
 static int
-port_insert(struct listen_port** list, int s, int is_udp)
+port_insert(struct listen_port** list, int s, enum listen_type ftype)
 {
 	struct listen_port* item = (struct listen_port*)malloc(
 		sizeof(struct listen_port));
@@ -226,14 +335,71 @@ port_insert(struct listen_port** list, int s, int is_udp)
 		return 0;
 	item->next = *list;
 	item->fd = s;
-	item->is_udp = is_udp;
+	item->ftype = ftype;
 	*list = item;
 	return 1;
 }
 
+/** set fd to receive source address packet info */
+static int
+set_recvpktinfo(int s, int family) 
+{
+#if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || defined(IP_RECVDSTADDR) || defined(IP_PKTINFO)
+	int on = 1;
+#else
+	(void)s;
+#endif
+	if(family == AF_INET6) {
+#           ifdef IPV6_RECVPKTINFO
+		if(setsockopt(s, IPPROTO_IPV6, IPV6_RECVPKTINFO,
+			(void*)&on, (socklen_t)sizeof(on)) < 0) {
+			log_err("setsockopt(..., IPV6_RECVPKTINFO, ...) failed: %s",
+				strerror(errno));
+			return 0;
+		}
+#           elif defined(IPV6_PKTINFO)
+		if(setsockopt(s, IPPROTO_IPV6, IPV6_PKTINFO,
+			(void*)&on, (socklen_t)sizeof(on)) < 0) {
+			log_err("setsockopt(..., IPV6_PKTINFO, ...) failed: %s",
+				strerror(errno));
+			return 0;
+		}
+#           else
+		log_err("no IPV6_RECVPKTINFO and no IPV6_PKTINFO option, please "
+			"disable interface-automatic in config");
+		return 0;
+#           endif /* defined IPV6_RECVPKTINFO */
+
+	} else if(family == AF_INET) {
+#           ifdef IP_RECVDSTADDR
+		if(setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR,
+			(void*)&on, (socklen_t)sizeof(on)) < 0) {
+			log_err("setsockopt(..., IP_RECVDSTADDR, ...) failed: %s",
+				strerror(errno));
+			return 0;
+		}
+#           elif defined(IP_PKTINFO)
+		if(setsockopt(s, IPPROTO_IP, IP_PKTINFO,
+			(void*)&on, (socklen_t)sizeof(on)) < 0) {
+			log_err("setsockopt(..., IP_PKTINFO, ...) failed: %s",
+				strerror(errno));
+			return 0;
+		}
+#           else
+		log_err("no IP_RECVDSTADDR or IP_PKTINFO option, please disable "
+			"interface-automatic in config");
+		return 0;
+#           endif /* IP_PKTINFO */
+
+	}
+	return 1;
+}
+
 /**
  * Helper for ports_open. Creates one interface (or NULL for default).
  * @param ifname: The interface ip address.
+ * @param do_auto: use automatic interface detection.
+ * 	If enabled, then ifname must be the wildcard name.
  * @param do_udp: if udp should be used.
  * @param do_tcp: if udp should be used.
  * @param hints: for getaddrinfo. family and flags have to be set by caller.
@@ -242,25 +408,53 @@ port_insert(struct listen_port** list, int s, int is_udp)
  * @return: returns false on error.
  */
 static int
-ports_create_if(const char* ifname, int do_udp, int do_tcp, 
+ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, 
 	struct addrinfo *hints, const char* port, struct listen_port** list)
 {
-	int s;
+	int s, noip6=0;
 	if(!do_udp && !do_tcp)
 		return 0;
-	if(do_udp) {
-		if((s = make_sock(SOCK_DGRAM, ifname, port, hints)) == -1)
+	if(do_auto) {
+		if((s = make_sock(SOCK_DGRAM, ifname, port, hints, 1, 
+			&noip6)) == -1) {
+			if(noip6) {
+				log_warn("IPv6 protocol not available");
+				return 1;
+			}
 			return 0;
-		if(!port_insert(list, s, 1)) {
+		}
+		/* getting source addr packet info is highly non-portable */
+		if(!set_recvpktinfo(s, hints->ai_family))
+			return 0;
+		if(!port_insert(list, s, listen_type_udpancil)) {
+			close(s);
+			return 0;
+		}
+	} else if(do_udp) {
+		/* regular udp socket */
+		if((s = make_sock(SOCK_DGRAM, ifname, port, hints, 1, 
+			&noip6)) == -1) {
+			if(noip6) {
+				log_warn("IPv6 protocol not available");
+				return 1;
+			}
+			return 0;
+		}
+		if(!port_insert(list, s, listen_type_udp)) {
 			close(s);
 			return 0;
 		}
 	}
 	if(do_tcp) {
-		if((s = make_sock(SOCK_STREAM, ifname, port, hints)) == -1) {
+		if((s = make_sock(SOCK_STREAM, ifname, port, hints, 1, 
+			&noip6)) == -1) {
+			if(noip6) {
+				/*log_warn("IPv6 protocol not available");*/
+				return 1;
+			}
 			return 0;
 		}
-		if(!port_insert(list, s, 0)) {
+		if(!port_insert(list, s, listen_type_tcp)) {
 			close(s);
 			return 0;
 		}
@@ -306,11 +500,15 @@ listen_create(struct comm_base* base, struct listen_port* ports,
 	/* create comm points as needed */
 	while(ports) {
 		struct comm_point* cp = NULL;
-		if(ports->is_udp) 
+		if(ports->ftype == listen_type_udp) 
 			cp = comm_point_create_udp(base, ports->fd, 
 				front->udp_buff, cb, cb_arg);
-		else 	cp = comm_point_create_tcp(base, ports->fd, 
+		else if(ports->ftype == listen_type_tcp)
+			cp = comm_point_create_tcp(base, ports->fd, 
 				tcp_accept_count, bufsize, cb, cb_arg);
+		else if(ports->ftype == listen_type_udpancil) 
+			cp = comm_point_create_udp_ancil(base, ports->fd, 
+				front->udp_buff, cb, cb_arg);
 		if(!cp) {
 			log_err("can't create commpoint");	
 			listen_delete(front);
@@ -383,12 +581,13 @@ listening_ports_open(struct config_file* cfg)
 	struct listen_port* list = NULL;
 	struct addrinfo hints;
 	int i, do_ip4, do_ip6;
-	int do_tcp;
+	int do_tcp, do_auto;
 	char portbuf[32];
 	snprintf(portbuf, sizeof(portbuf), "%d", cfg->port);
 	do_ip4 = cfg->do_ip4;
 	do_ip6 = cfg->do_ip6;
 	do_tcp = cfg->do_tcp;
+	do_auto = cfg->if_automatic && cfg->do_udp;
 	if(cfg->incoming_num_tcp == 0)
 		do_tcp = 0;
 
@@ -405,11 +604,16 @@ listening_ports_open(struct config_file* cfg)
 	if(!do_ip4 && !do_ip6) {
 		return NULL;
 	}
+	if(do_auto && (!do_ip4 || !do_ip6)) {
+		log_warn("interface_automatic option does not work when IP4 or IP6 is not enabled. Disabling option.");
+		do_auto = 0;
+	}
 	/* create ip4 and ip6 ports so that return addresses are nice. */
-	if(cfg->num_ifs == 0) {
+	if(do_auto || cfg->num_ifs == 0) {
 		if(do_ip6) {
 			hints.ai_family = AF_INET6;
-			if(!ports_create_if("::1", cfg->do_udp, do_tcp, 
+			if(!ports_create_if(do_auto?"::0":"::1", 
+				do_auto, cfg->do_udp, do_tcp, 
 				&hints, portbuf, &list)) {
 				listening_ports_free(list);
 				return NULL;
@@ -417,7 +621,8 @@ listening_ports_open(struct config_file* cfg)
 		}
 		if(do_ip4) {
 			hints.ai_family = AF_INET;
-			if(!ports_create_if("127.0.0.1", cfg->do_udp, do_tcp, 
+			if(!ports_create_if(do_auto?"0.0.0.0":"127.0.0.1", 
+				do_auto, cfg->do_udp, do_tcp, 
 				&hints, portbuf, &list)) {
 				listening_ports_free(list);
 				return NULL;
@@ -428,7 +633,7 @@ listening_ports_open(struct config_file* cfg)
 			if(!do_ip6)
 				continue;
 			hints.ai_family = AF_INET6;
-			if(!ports_create_if(cfg->ifs[i], cfg->do_udp, 
+			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
 				do_tcp, &hints, portbuf, &list)) {
 				listening_ports_free(list);
 				return NULL;
@@ -437,7 +642,7 @@ listening_ports_open(struct config_file* cfg)
 			if(!do_ip4)
 				continue;
 			hints.ai_family = AF_INET;
-			if(!ports_create_if(cfg->ifs[i], cfg->do_udp, 
+			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
 				do_tcp, &hints, portbuf, &list)) {
 				listening_ports_free(list);
 				return NULL;

services/listen_dnsport.h

@@ -45,7 +45,6 @@
 #include "config.h"
 #include "util/netevent.h"
 struct listen_list;
-struct addrinfo;
 struct config_file;
 
 /**
@@ -74,6 +73,18 @@ struct listen_list {
 	struct comm_point* com;
 };
 
+/**
+ * type of ports
+ */
+enum listen_type {
+	/** udp type */
+	listen_type_udp,
+	/** tcp type */
+	listen_type_tcp,
+	/** udp ipv6 (v4mapped) for use with ancillary data */
+	listen_type_udpancil
+};
+
 /**
  * Single linked list to store shared ports that have been 
  * opened for use by all threads.
@@ -84,7 +95,7 @@ struct listen_port {
 	/** file descriptor, open and ready for use */
 	int fd;
 	/** type of file descriptor, udp or tcp */
-	int is_udp;
+	enum listen_type ftype;
 };
 
 /**
@@ -153,9 +164,18 @@ size_t listen_get_mem(struct listen_dnsport* listen);
 
 /**
  * Create and bind nonblocking UDP socket
- * @param addr: address info ready to make socket.
+ * @param family: for socket call.
+ * @param socktype: for socket call.
+ * @param addr: for bind call.
+ * @param addrlen: for bind call.
+ * @param v6only: if enabled, IP6 sockets get IP6ONLY option set.
+ * 	if enabled with value 2 IP6ONLY option is disabled.
+ * @param inuse: on error, this is set true if the port was in use.
+ * @param noproto: on error, this is set true if cause is that the
+	IPv6 proto (family) is not available.
  * @return: the socket. -1 on error.
  */
-int create_udp_sock(struct addrinfo* addr);
+int create_udp_sock(int family, int socktype, struct sockaddr* addr, 
+	socklen_t addrlen, int v6only, int* inuse, int* noproto);
 
 #endif /* LISTEN_DNSPORT_H */

services/localzone.c

@@ -195,6 +195,7 @@ lz_enter_zone(struct local_zones* zones, const char* name, const char* type,
 		t = local_zone_redirect;
 	else {
 		log_err("bad lz_enter_zone type %s %s", name, type);
+		free(nm);
 		return NULL;
 	}
 	if(!(z=lz_enter_zone_dname(zones, nm, len, labs, t, dclass))) {
@@ -234,6 +235,8 @@ get_rr_content(const char* str, uint8_t** nm, uint16_t* type,
         if(status != LDNS_STATUS_OK) {
                 log_err("error converting RR '%s' to wireformat: %s",
                         str, ldns_get_errorstr_by_id(status));
+		free(*nm);
+		*nm = NULL;
                 return 0;
         }
         ldns_buffer_flip(rdata);
@@ -434,6 +437,7 @@ lz_enter_rr_into_zone(struct local_zone* z, ldns_buffer* buf,
 		query_dname_compare(z->name, nm) != 0) {
 		log_err("local-data in redirect zone must reside at top of zone"
 			", not at %s", rrstr);
+		free(nm);
 		return 0;
 	}
 	nmlabs = dname_count_size_labels(nm, &nmlen);
@@ -524,9 +528,15 @@ static int
 lz_nodefault(struct config_file* cfg, const char* name)
 {
 	struct config_strlist* p;
+	size_t len = strlen(name);
+	if(len == 0) return 0;
+	if(name[len-1] == '.') len--;
+
 	for(p = cfg->local_zones_nodefault; p; p = p->next) {
-		/* compare zone name, lowercase */
-		if(strcasecmp(p->str, name) == 0)
+		/* compare zone name, lowercase, compare without ending . */
+		if(strncasecmp(p->str, name, len) == 0 && 
+			(strlen(p->str) == len || (strlen(p->str)==len+1 &&
+			p->str[len] == '.')))
 			return 1;
 	}
 	return 0;
@@ -610,34 +620,35 @@ lz_enter_defaults(struct local_zones* zones, struct config_file* cfg,
 			return 0;
 		}
 	}
-	if (	!add_as112_default(zones, cfg, buf, "10.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "16.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "17.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "18.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "19.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "20.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "21.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "22.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "23.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "24.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "25.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "26.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "27.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "28.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "29.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "30.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "31.172.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "168.192.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "0.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "254.169.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "2.0.192.in-addr.arpa") ||
-		!add_as112_default(zones, cfg, buf, "255.255.255.255.in-addr.arpa") ||
+	if (	!add_as112_default(zones, cfg, buf, "10.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "16.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "17.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "18.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "19.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "20.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "21.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "22.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "23.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "24.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "25.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "26.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "27.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "28.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "29.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "30.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "31.172.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "168.192.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "0.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "254.169.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "2.0.192.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "255.255.255.255.in-addr.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "d.f.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "8.e.f.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "9.e.f.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "a.e.f.ip6.arpa.") ||
-		!add_as112_default(zones, cfg, buf, "b.e.f.ip6.arpa.")) {
+		!add_as112_default(zones, cfg, buf, "b.e.f.ip6.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "8.b.d.0.1.0.0.2.ip6.arpa.")) {
 		log_err("out of memory adding default zone");
 		return 0;
 	}

services/mesh.c

@@ -88,8 +88,7 @@ mesh_state_ref_compare(const void* ap, const void* bp)
 }
 
 struct mesh_area* 
-mesh_create(int num_modules, struct module_func_block** modfunc,
-	struct module_env* env)
+mesh_create(struct module_stack* stack, struct module_env* env)
 {
 	struct mesh_area* mesh = calloc(1, sizeof(struct mesh_area));
 	if(!mesh) {
@@ -102,8 +101,7 @@ mesh_create(int num_modules, struct module_func_block** modfunc,
 		log_err("mesh area alloc: out of memory");
 		return NULL;
 	}
-	mesh->num_modules = num_modules;
-	mesh->modfunc = modfunc;
+	mesh->mods = *stack;
 	mesh->env = env;
 	rbtree_init(&mesh->run, &mesh_state_compare);
 	rbtree_init(&mesh->all, &mesh_state_compare);
@@ -157,12 +155,12 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		mesh->num_detached_states++;
 		added = 1;
 	}
-	if(!s->reply_list && s->super_set.count == 0)
+	if(!s->reply_list && !s->cb_list && s->super_set.count == 0)
 		was_detached = 1;
-	if(!s->reply_list)
+	if(!s->reply_list && !s->cb_list)
 		was_noreply = 1;
 	/* add reply to s */
-	if(!mesh_state_add_reply(s, edns, rep, qid, qflags)) {
+	if(!mesh_state_add_reply(s, edns, rep, qid, qflags, qinfo->qname)) {
 			log_err("mesh_new_client: out of memory; SERVFAIL");
 			error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
 				qinfo, qid, qflags, edns);
@@ -184,6 +182,52 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		mesh_run(mesh, s, module_event_new, NULL);
 }
 
+int 
+mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
+	uint16_t qflags, struct edns_data* edns, ldns_buffer* buf, 
+	uint16_t qid, mesh_cb_func_t cb, void* cb_arg)
+{
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags, 0);
+	int was_detached = 0;
+	int was_noreply = 0;
+	int added = 0;
+	/* see if it already exists, if not, create one */
+	if(!s) {
+		struct rbnode_t* n;
+		s = mesh_state_create(mesh->env,qinfo, qflags, 0);
+		if(!s) {
+			return 0;
+		}
+		n = rbtree_insert(&mesh->all, &s->node);
+		log_assert(n != NULL);
+		/* set detached (it is now) */
+		mesh->num_detached_states++;
+		added = 1;
+	}
+	if(!s->reply_list && !s->cb_list && s->super_set.count == 0)
+		was_detached = 1;
+	if(!s->reply_list && !s->cb_list)
+		was_noreply = 1;
+	/* add reply to s */
+	if(!mesh_state_add_cb(s, edns, buf, cb, cb_arg, qid, qflags)) {
+			if(added)
+				mesh_state_delete(&s->s);
+			return 0;
+	}
+	/* update statistics */
+	if(was_detached) {
+		log_assert(mesh->num_detached_states > 0);
+		mesh->num_detached_states--;
+	}
+	if(was_noreply) {
+		mesh->num_reply_states ++;
+	}
+	mesh->num_reply_addrs++;
+	if(added)
+		mesh_run(mesh, s, module_event_new, NULL);
+	return 1;
+}
+
 void mesh_report_reply(struct mesh_area* mesh, struct outbound_entry* e,
         int is_ok, struct comm_reply* reply)
 {
@@ -237,7 +281,7 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
 	mstate->s.env = env;
 	mstate->s.mesh_info = mstate;
 	/* init modules */
-	for(i=0; i<env->mesh->num_modules; i++) {
+	for(i=0; i<env->mesh->mods.num; i++) {
 		mstate->s.minfo[i] = NULL;
 		mstate->s.ext_state[i] = module_state_initial;
 	}
@@ -253,9 +297,9 @@ mesh_state_cleanup(struct mesh_state* mstate)
 		return;
 	/* de-init modules */
 	mesh = mstate->s.env->mesh;
-	for(i=0; i<mesh->num_modules; i++) {
-		log_assert(fptr_whitelist_mod_clear(mesh->modfunc[i]->clear));
-		(*mesh->modfunc[i]->clear)(&mstate->s, i);
+	for(i=0; i<mesh->mods.num; i++) {
+		fptr_ok(fptr_whitelist_mod_clear(mesh->mods.mod[i]->clear));
+		(*mesh->mods.mod[i]->clear)(&mstate->s, i);
 		mstate->s.minfo[i] = NULL;
 		mstate->s.ext_state[i] = module_finished;
 	}
@@ -273,11 +317,12 @@ mesh_state_delete(struct module_qstate* qstate)
 	mstate = qstate->mesh_info;
 	mesh = mstate->s.env->mesh;
 	mesh_detach_subs(&mstate->s);
-	if(!mstate->reply_list && mstate->super_set.count == 0) {
+	if(!mstate->reply_list && !mstate->cb_list
+		&& mstate->super_set.count == 0) {
 		log_assert(mesh->num_detached_states > 0);
 		mesh->num_detached_states--;
 	}
-	if(mstate->reply_list) {
+	if(mstate->reply_list || mstate->cb_list) {
 		log_assert(mesh->num_reply_states > 0);
 		mesh->num_reply_states--;
 	}
@@ -301,7 +346,8 @@ void mesh_detach_subs(struct module_qstate* qstate)
 	RBTREE_FOR(ref, struct mesh_state_ref*, &qstate->mesh_info->sub_set) {
 		n = rbtree_delete(&ref->s->super_set, &lookup);
 		log_assert(n != NULL); /* must have been present */
-		if(!ref->s->reply_list && ref->s->super_set.count == 0) {
+		if(!ref->s->reply_list && !ref->s->cb_list
+			&& ref->s->super_set.count == 0) {
 			mesh->num_detached_states++;
 			log_assert(mesh->num_detached_states + 
 				mesh->num_reply_states <= mesh->all.count);
@@ -336,7 +382,7 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
 		*newq = NULL;
 	if(!mesh_state_attachment(qstate->mesh_info, sub))
 		return 0;
-	if(!sub->reply_list && sub->super_set.count == 1) {
+	if(!sub->reply_list && !sub->cb_list && sub->super_set.count == 1) {
 		/* it used to be detached, before this one got added */
 		log_assert(mesh->num_detached_states > 0);
 		mesh->num_detached_states--;
@@ -415,18 +461,63 @@ timeval_divide(struct timeval* avg, struct timeval* sum, size_t d)
 #endif
 }
 
+/**
+ * callback results to mesh cb entry
+ * @param m: mesh state to send it for.
+ * @param rcode: if not 0, error code.
+ * @param rep: reply to send (or NULL if rcode is set).
+ * @param r: callback entry
+ */
+static void
+mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
+	struct mesh_cb* r)
+{
+	int secure;
+	/* bogus messages are not made into servfail, sec_status passed 
+	 * to the callback function */
+	if(rep && rep->security == sec_status_secure)
+		secure = 1;
+	else	secure = 0;
+	if(!rep && rcode == LDNS_RCODE_NOERROR)
+		rcode = LDNS_RCODE_SERVFAIL;
+	/* send the reply */
+	if(rcode) {
+		(*r->cb)(r->cb_arg, rcode, r->buf, sec_status_unchecked);
+	} else {
+		size_t udp_size = r->edns.udp_size;
+		ldns_buffer_clear(r->buf);
+		r->edns.edns_version = EDNS_ADVERTISED_VERSION;
+		r->edns.udp_size = EDNS_ADVERTISED_SIZE;
+		r->edns.ext_rcode = 0;
+		r->edns.bits &= EDNS_DO;
+		if(!reply_info_answer_encode(&m->s.qinfo, rep, r->qid, 
+			r->qflags, r->buf, 0, 1, 
+			m->s.env->scratch, udp_size, &r->edns, 
+			(int)(r->edns.bits & EDNS_DO), secure)) 
+		{
+			(*r->cb)(r->cb_arg, LDNS_RCODE_SERVFAIL, r->buf,
+				sec_status_unchecked);
+		}
+		else	(*r->cb)(r->cb_arg, LDNS_RCODE_NOERROR, r->buf,
+				rep->security);
+	}
+	m->s.env->mesh->num_reply_addrs--;
+}
+
 /**
  * Send reply to mesh reply entry
  * @param m: mesh state to send it for.
  * @param rcode: if not 0, error code.
  * @param rep: reply to send (or NULL if rcode is set).
  * @param r: reply entry
+ * @param prev: previous reply, already has its answer encoded in buffer.
  */
 static void
 mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
-	struct mesh_reply* r)
+	struct mesh_reply* r, struct mesh_reply* prev)
 {
 	struct timeval end_time;
+	struct timeval duration;
 	int secure;
 	/* examine security status */
 	if(m->s.env->need_to_validate && !(r->qflags&BIT_CD) && rep && 
@@ -436,8 +527,24 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 	if(rep && rep->security == sec_status_secure)
 		secure = 1;
 	else	secure = 0;
+	if(!rep && rcode == LDNS_RCODE_NOERROR)
+		rcode = LDNS_RCODE_SERVFAIL;
 	/* send the reply */
-	if(rcode) {
+	if(prev && prev->qflags == r->qflags && 
+		prev->edns.edns_present == r->edns.edns_present && 
+		prev->edns.bits == r->edns.bits && 
+		prev->edns.udp_size == r->edns.udp_size) {
+		/* if the previous reply is identical to this one, fix ID */
+		if(prev->query_reply.c->buffer != r->query_reply.c->buffer)
+			ldns_buffer_copy(r->query_reply.c->buffer, 
+				prev->query_reply.c->buffer);
+		ldns_buffer_write_at(r->query_reply.c->buffer, 0, 
+			&r->qid, sizeof(uint16_t));
+		ldns_buffer_write_at(r->query_reply.c->buffer, 12, 
+			r->qname, m->s.qinfo.qname_len);
+		comm_point_send_reply(&r->query_reply);
+	} else if(rcode) {
+		m->s.qinfo.qname = r->qname;
 		error_encode(r->query_reply.c->buffer, rcode, &m->s.qinfo,
 			r->qid, r->qflags, &r->edns);
 		comm_point_send_reply(&r->query_reply);
@@ -447,6 +554,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		r->edns.udp_size = EDNS_ADVERTISED_SIZE;
 		r->edns.ext_rcode = 0;
 		r->edns.bits &= EDNS_DO;
+		m->s.qinfo.qname = r->qname;
 		if(!reply_info_answer_encode(&m->s.qinfo, rep, r->qid, 
 			r->qflags, r->query_reply.c->buffer, 0, 1, 
 			m->s.env->scratch, udp_size, &r->edns, 
@@ -460,27 +568,28 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 	}
 	/* account */
 	m->s.env->mesh->num_reply_addrs--;
-	if(gettimeofday(&end_time, NULL) < 0) {
-		log_err("gettimeofday: %s", strerror(errno));
-		return;
-	} else {
-		struct timeval duration;
-		timeval_subtract(&duration, &end_time, &r->start_time);
-		verbose(VERB_ALGO, "query took %d.%6.6d sec",
-			(int)duration.tv_sec, (int)duration.tv_usec);
-		m->s.env->mesh->replies_sent++;
-		timeval_add(&m->s.env->mesh->replies_sum_wait, &duration);
-		timehist_insert(m->s.env->mesh->histogram, &duration);
-	}
+	end_time = *m->s.env->now_tv;
+	timeval_subtract(&duration, &end_time, &r->start_time);
+	verbose(VERB_ALGO, "query took %d.%6.6d sec",
+		(int)duration.tv_sec, (int)duration.tv_usec);
+	m->s.env->mesh->replies_sent++;
+	timeval_add(&m->s.env->mesh->replies_sum_wait, &duration);
+	timehist_insert(m->s.env->mesh->histogram, &duration);
 }
 
 void mesh_query_done(struct mesh_state* mstate)
 {
 	struct mesh_reply* r;
+	struct mesh_reply* prev = NULL;
+	struct mesh_cb* c;
 	struct reply_info* rep = (mstate->s.return_msg?
 		mstate->s.return_msg->rep:NULL);
 	for(r = mstate->reply_list; r; r = r->next) {
-		mesh_send_reply(mstate, mstate->s.return_rcode, rep, r);
+		mesh_send_reply(mstate, mstate->s.return_rcode, rep, r, prev);
+		prev = r;
+	}
+	for(c = mstate->cb_list; c; c = c->next) {
+		mesh_do_callback(mstate, mstate->s.return_rcode, rep, c);
 	}
 }
 
@@ -492,9 +601,9 @@ void mesh_walk_supers(struct mesh_area* mesh, struct mesh_state* mstate)
 		/* make super runnable */
 		(void)rbtree_insert(&mesh->run, &ref->s->run_node);
 		/* callback the function to inform super of result */
-		log_assert(fptr_whitelist_mod_inform_super(
-			mesh->modfunc[ref->s->s.curmod]->inform_super));
-		(*mesh->modfunc[ref->s->s.curmod]->inform_super)(&mstate->s, 
+		fptr_ok(fptr_whitelist_mod_inform_super(
+			mesh->mods.mod[ref->s->s.curmod]->inform_super));
+		(*mesh->mods.mod[ref->s->s.curmod]->inform_super)(&mstate->s, 
 			ref->s->s.curmod, &ref->s->s);
 	}
 }
@@ -514,8 +623,28 @@ struct mesh_state* mesh_area_find(struct mesh_area* mesh,
 	return result;
 }
 
+int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
+        ldns_buffer* buf, mesh_cb_func_t cb, void* cb_arg,
+	uint16_t qid, uint16_t qflags)
+{
+	struct mesh_cb* r = regional_alloc(s->s.region, 
+		sizeof(struct mesh_cb));
+	if(!r)
+		return 0;
+	r->buf = buf;
+	r->cb = cb;
+	r->cb_arg = cb_arg;
+	r->edns = *edns;
+	r->qid = qid;
+	r->qflags = qflags;
+	r->next = s->cb_list;
+	s->cb_list = r;
+	return 1;
+
+}
+
 int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
-        struct comm_reply* rep, uint16_t qid, uint16_t qflags)
+        struct comm_reply* rep, uint16_t qid, uint16_t qflags, uint8_t* qname)
 {
 	struct mesh_reply* r = regional_alloc(s->s.region, 
 		sizeof(struct mesh_reply));
@@ -525,11 +654,12 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
 	r->edns = *edns;
 	r->qid = qid;
 	r->qflags = qflags;
-	if(gettimeofday(&r->start_time, NULL) < 0) {
-		log_err("addrep: gettimeofday: %s", strerror(errno));
-		memset(&r->start_time, 0, sizeof(r->start_time));
-	}
+	r->start_time = *s->s.env->now_tv;
 	r->next = s->reply_list;
+	r->qname = regional_alloc_init(s->s.region, qname, 
+		s->s.qinfo.qname_len);
+	if(!r->qname)
+		return 0;
 	s->reply_list = r;
 	return 1;
 
@@ -558,16 +688,16 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate,
 	if(mstate->num_activated > MESH_MAX_ACTIVATION) {
 		/* module is looping. Stop it. */
 		log_err("internal error: looping module stopped");
-		log_query_info(VERB_DETAIL, "pass error for qstate",
+		log_query_info(VERB_QUERY, "pass error for qstate",
 			&mstate->s.qinfo);
 		s = module_error;
 	}
 	if(s == module_wait_module) {
 		/* start next module */
 		mstate->s.curmod++;
-		if(mesh->num_modules == mstate->s.curmod) {
+		if(mesh->mods.num == mstate->s.curmod) {
 			log_err("Cannot pass to next module; at last module");
-			log_query_info(VERB_DETAIL, "pass error for qstate",
+			log_query_info(VERB_QUERY, "pass error for qstate",
 				&mstate->s.qinfo);
 			mstate->s.curmod--;
 			return mesh_continue(mesh, mstate, module_error, ev);
@@ -601,9 +731,9 @@ void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
 	verbose(VERB_ALGO, "mesh_run: start");
 	while(mstate) {
 		/* run the module */
-		log_assert(fptr_whitelist_mod_operate(
-			mesh->modfunc[mstate->s.curmod]->operate));
-		(*mesh->modfunc[mstate->s.curmod]->operate)
+		fptr_ok(fptr_whitelist_mod_operate(
+			mesh->mods.mod[mstate->s.curmod]->operate));
+		(*mesh->mods.mod[mstate->s.curmod]->operate)
 			(&mstate->s, ev, mstate->s.curmod, e);
 
 		/* examine results */
@@ -611,7 +741,7 @@ void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
 		regional_free_all(mstate->s.env->scratch);
 		s = mstate->s.ext_state[mstate->s.curmod];
 		verbose(VERB_ALGO, "mesh_run: %s module exit state is %s", 
-			mesh->modfunc[mstate->s.curmod]->name, strextstate(s));
+			mesh->mods.mod[mstate->s.curmod]->name, strextstate(s));
 		e = NULL;
 		if(mesh_continue(mesh, mstate, s, &ev))
 			continue;
@@ -637,13 +767,15 @@ mesh_log_list(struct mesh_area* mesh)
 	struct mesh_state* m;
 	int num = 0;
 	RBTREE_FOR(m, struct mesh_state*, &mesh->all) {
-		snprintf(buf, sizeof(buf), "%d%s%s%s%s%s mod%d %s", 
+		snprintf(buf, sizeof(buf), "%d%s%s%s%s%s mod%d %s%s", 
 			num++, (m->s.is_priming)?"p":"",  /* prime */
 			(m->s.query_flags&BIT_RD)?"RD":"",
 			(m->s.query_flags&BIT_CD)?"CD":"",
 			(m->super_set.count==0)?"d":"", /* detached */
 			(m->sub_set.count!=0)?"c":"",  /* children */
-			m->s.curmod, (m->reply_list)?"hr":"nr"); /*hasreply*/
+			m->s.curmod, (m->reply_list)?"rep":"", /*hasreply*/
+			(m->cb_list)?"cb":"" /* callbacks */
+			); 
 		log_query_info(VERB_ALGO, buf, &m->s.qinfo);
 	}
 }
@@ -651,23 +783,35 @@ mesh_log_list(struct mesh_area* mesh)
 void 
 mesh_stats(struct mesh_area* mesh, const char* str)
 {
-	log_info("%s %u states (%u with reply, %u detached), "
-		"%u waiting replies", str, (unsigned)mesh->all.count, 
+	verbose(VERB_DETAIL, "%s %u recursion states (%u with reply, "
+		"%u detached), %u waiting replies, %u recursion replies "
+		"sent", str, (unsigned)mesh->all.count, 
 		(unsigned)mesh->num_reply_states,
 		(unsigned)mesh->num_detached_states,
-		(unsigned)mesh->num_reply_addrs);
+		(unsigned)mesh->num_reply_addrs,
+		(unsigned)mesh->replies_sent);
 	if(mesh->replies_sent > 0) {
 		struct timeval avg;
 		timeval_divide(&avg, &mesh->replies_sum_wait, 
 			mesh->replies_sent);
-		log_info("sent %u replies, with average wait "
-			"of %d.%6.6d sec", (unsigned)mesh->replies_sent,
-			(int)avg.tv_sec, (int)avg.tv_usec);
-		log_info("histogram of reply wait times");
-		timehist_log(mesh->histogram);
+		log_info("average recursion processing time "
+			"%d.%6.6d sec", (int)avg.tv_sec, (int)avg.tv_usec);
+		log_info("histogram of recursion processing times");
+		timehist_log(mesh->histogram, "recursions");
 	}
 }
 
+void 
+mesh_stats_clear(struct mesh_area* mesh)
+{
+	if(!mesh)
+		return;
+	mesh->replies_sent = 0;
+	mesh->replies_sum_wait.tv_sec = 0;
+	mesh->replies_sum_wait.tv_usec = 0;
+	timehist_clear(mesh->histogram);
+}
+
 size_t 
 mesh_get_mem(struct mesh_area* mesh)
 {

services/mesh.h

@@ -50,8 +50,10 @@
 #include "util/netevent.h"
 #include "util/data/msgparse.h"
 #include "util/module.h"
+#include "services/modstack.h"
 struct mesh_state;
 struct mesh_reply;
+struct mesh_cb;
 struct query_info;
 struct reply_info;
 struct outbound_entry;
@@ -67,10 +69,8 @@ struct timehist;
  * Mesh of query states
  */
 struct mesh_area {
-	/** the number of modules */
-	int num_modules;
-	/** the module callbacks, array of num_modules length (ref only) */
-	struct module_func_block** modfunc;
+	/** active module stack */
+	struct module_stack mods;
 	/** environment for new states */
 	struct module_env* env;
 
@@ -117,6 +117,8 @@ struct mesh_state {
 	struct module_qstate s;
 	/** the list of replies to clients for the results */
 	struct mesh_reply* reply_list;
+	/** the list of callbacks for the results */
+	struct mesh_cb* cb_list;
 	/** set of superstates (that want this state's result) 
 	 * contains struct mesh_state_ref* */
 	rbtree_t super_set;
@@ -154,20 +156,49 @@ struct mesh_reply {
 	uint16_t qid;
 	/** flags of query, for reply flags */
 	uint16_t qflags;
+	/** qname from this query. len same as mesh qinfo. */
+	uint8_t* qname;
+};
+
+/** 
+ * Mesh result callback func.
+ * called as func(cb_arg, rcode, buffer_with_reply, security);
+ * */
+typedef void (*mesh_cb_func_t)(void*, int, ldns_buffer*, enum sec_status);
+
+/**
+ * Callback to result routine
+ */
+struct mesh_cb {
+	/** next in list */
+	struct mesh_cb* next;
+	/** edns data from query */
+	struct edns_data edns;
+	/** id of query, in network byteorder. */
+	uint16_t qid;
+	/** flags of query, for reply flags */
+	uint16_t qflags;
+	/** buffer for reply */
+	ldns_buffer* buf;
+
+	/** callback routine for results. if rcode != 0 buf has message.
+	 * called as cb(cb_arg, rcode, buf);
+	 */
+	mesh_cb_func_t cb;
+	/** user arg for callback */
+	void* cb_arg;
 };
 
 /* ------------------- Functions for worker -------------------- */
 
 /**
  * Allocate mesh, to empty.
- * @param num_modules: number of modules that are present.
- * @param modfunc: array passed (alloced and deleted by caller), that has
- * 	num_modules function callbacks for the modules.
+ * @param stack: module stack to activate, copied (as readonly reference).
  * @param env: environment for new queries.
  * @return mesh: the new mesh or NULL on error.
  */
-struct mesh_area* mesh_create(int num_modules, 
-	struct module_func_block** modfunc, struct module_env* env);
+struct mesh_area* mesh_create(struct module_stack* stack, 
+	struct module_env* env);
 
 /**
  * Delete mesh, and all query states and replies in it.
@@ -191,6 +222,25 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	uint16_t qflags, struct edns_data* edns, struct comm_reply* rep, 
 	uint16_t qid);
 
+/**
+ * New query with callback. Create new query state if needed, and
+ * add mesh_cb to it. 
+ * Will run the mesh area queries to process if a new query state is created.
+ *
+ * @param mesh: the mesh.
+ * @param qinfo: query from client.
+ * @param qflags: flags from client query.
+ * @param edns: edns data from client query.
+ * @param buf: buffer for reply contents.
+ * @param qid: query id to reply with.
+ * @param cb: callback function.
+ * @param cb_arg: callback user arg.
+ * @return 0 on error.
+ */
+int mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
+	uint16_t qflags, struct edns_data* edns, ldns_buffer* buf, 
+	uint16_t qid, mesh_cb_func_t cb, void* cb_arg);
+
 /**
  * Handle new event from the wire. A serviced query has returned.
  * The query state will be made runnable, and the mesh_area will process
@@ -327,10 +377,27 @@ int mesh_state_attachment(struct mesh_state* super, struct mesh_state* sub);
  * @param rep: comm point reply info.
  * @param qid: ID of reply.
  * @param qflags: original query flags.
+ * @param qname: original query name.
  * @return: 0 on alloc error.
  */
 int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns, 
-	struct comm_reply* rep, uint16_t qid, uint16_t qflags);
+	struct comm_reply* rep, uint16_t qid, uint16_t qflags, uint8_t* qname);
+
+/**
+ * Create new callback structure and attach it to a mesh state.
+ * Does not update stat items in mesh area.
+ * @param s: the mesh state.
+ * @param edns: edns data for reply (bufsize).
+ * @param buf: buffer for reply
+ * @param cb: callback to call with results.
+ * @param cb_arg: callback user arg.
+ * @param qid: ID of reply.
+ * @param qflags: original query flags.
+ * @return: 0 on alloc error.
+ */
+int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
+        ldns_buffer* buf, mesh_cb_func_t cb, void* cb_arg, uint16_t qid, 
+	uint16_t qflags);
 
 /**
  * Run the mesh. Run all runnable mesh states. Which can create new
@@ -351,6 +418,12 @@ void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
  */
 void mesh_stats(struct mesh_area* mesh, const char* str);
 
+/**
+ * Clear the stats that the mesh keeps (number of queries serviced)
+ * @param mesh: the mesh
+ */
+void mesh_stats_clear(struct mesh_area* mesh);
+
 /**
  * Print all the states in the mesh to the log.
  * @param mesh: the mesh to print all states of.

services/modstack.c

@@ -0,0 +1,167 @@
+/*
+ * services/modstack.c - stack of modules
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains functions to help maintain a stack of modules.
+ */
+#include "config.h"
+#include "services/modstack.h"
+#include "util/module.h"
+#include "util/fptr_wlist.h"
+#include "iterator/iterator.h"
+#include "validator/validator.h"
+
+/** count number of modules (words) in the string */
+static int
+count_modules(const char* s)
+{
+        int num = 0;
+        if(!s)
+                return 0;
+        while(*s) {
+                /* skip whitespace */
+                while(*s && isspace((int)*s))
+                        s++;
+                if(*s && !isspace((int)*s)) {
+                        /* skip identifier */
+                        num++;
+                        while(*s && !isspace((int)*s))
+                                s++;
+                }
+        }
+        return num;
+}
+
+void 
+modstack_init(struct module_stack* stack)
+{
+	stack->num = 0;
+	stack->mod = NULL;
+}
+
+int 
+modstack_config(struct module_stack* stack, const char* module_conf)
+{
+        int i;
+        verbose(VERB_QUERY, "module config: \"%s\"", module_conf);
+        stack->num = count_modules(module_conf);
+        if(stack->num == 0) {
+                log_err("error: no modules specified");
+                return 0;
+        }
+        if(stack->num > MAX_MODULE) {
+                log_err("error: too many modules (%d max %d)",
+                        stack->num, MAX_MODULE);
+                return 0;
+        }
+        stack->mod = (struct module_func_block**)calloc((size_t)
+                stack->num, sizeof(struct module_func_block*));
+        if(!stack->mod) {
+                log_err("out of memory");
+                return 0;
+        }
+        for(i=0; i<stack->num; i++) {
+                stack->mod[i] = module_factory(&module_conf);
+                if(!stack->mod[i]) {
+                        log_err("Unknown value for next module: '%s'",
+                                module_conf);
+                        return 0;
+                }
+        }
+        return 1;
+}
+
+struct 
+module_func_block* module_factory(const char** str)
+{
+        /* these are the modules available */
+        int num = 2;
+        const char* names[] = {"iterator", "validator", NULL};
+        struct module_func_block* (*fb[])(void) = 
+                {&iter_get_funcblock, &val_get_funcblock, NULL};
+
+        int i;
+        const char* s = *str;
+        while(*s && isspace((int)*s))
+                s++;
+        for(i=0; i<num; i++) {
+                if(strncmp(names[i], s, strlen(names[i])) == 0) {
+                        s += strlen(names[i]);
+                        *str = s;
+                        return (*fb[i])();
+                }
+        }
+        return NULL;
+}
+
+int 
+modstack_setup(struct module_stack* stack, const char* module_conf,
+	struct module_env* env)
+{
+        int i;
+        if(stack->num != 0)
+                modstack_desetup(stack, env);
+        /* fixed setup of the modules */
+        if(!modstack_config(stack, module_conf)) {
+		return 0;
+        }
+        env->need_to_validate = 0; /* set by module init below */
+        for(i=0; i<stack->num; i++) {
+                verbose(VERB_OPS, "init module %d: %s",
+                        i, stack->mod[i]->name);
+                fptr_ok(fptr_whitelist_mod_init(stack->mod[i]->init));
+                if(!(*stack->mod[i]->init)(env, i)) {
+                        log_err("module init for module %s failed",
+                                stack->mod[i]->name);
+			return 0;
+                }
+        }
+	return 1;
+}
+
+void 
+modstack_desetup(struct module_stack* stack, struct module_env* env)
+{
+        int i;
+        for(i=0; i<stack->num; i++) {
+                fptr_ok(fptr_whitelist_mod_deinit(stack->mod[i]->deinit));
+                (*stack->mod[i]->deinit)(env, i);
+        }
+        stack->num = 0;
+        free(stack->mod);
+        stack->mod = NULL;
+}

services/modstack.h

@@ -0,0 +1,99 @@
+/*
+ * services/modstack.h - stack of modules
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file contains functions to help maintain a stack of modules.
+ */
+
+#ifndef SERVICES_MODSTACK_H
+#define SERVICES_MODSTACK_H
+struct module_func_block;
+struct module_env;
+
+/**
+ * Stack of modules.
+ */
+struct module_stack {
+	/** the number of modules */
+	int num;
+	/** the module callbacks, array of num_modules length (ref only) */
+	struct module_func_block** mod;
+};
+
+/**
+ * Init a stack of modules
+ * @param stack: initialised as empty.
+ */
+void modstack_init(struct module_stack* stack);
+
+/**
+ * Read config file module settings and set up the modfunc block
+ * @param stack: the stack of modules (empty before call). 
+ * @param module_conf: string what modules to insert.
+ * @return false on error
+ */
+int modstack_config(struct module_stack* stack, const char* module_conf);
+
+/**
+ * Get funcblock for module name
+ * @param str: string with module name. Advanced to next value on success.
+ *	The string is assumed whitespace separated list of module names.
+ * @return funcblock or NULL on error.
+ */
+struct module_func_block* module_factory(const char** str);
+
+/**
+ * Setup modules. Assigns ids and calls module_init.
+ * @param stack: if not empty beforehand, it will be desetup()ed.
+ *	It is then modstack_configged().
+ * @param module_conf: string what modules to insert.
+ * @param env: module environment which is inited by the modules.
+ *	environment should have a superalloc, cfg,
+ *	env.need_to_validate is set by the modules.
+ * @return on false a module init failed.
+ */
+int modstack_setup(struct module_stack* stack, const char* module_conf,
+	struct module_env* env);
+
+/**
+ * Desetup the modules, deinit, delete.
+ * @param stack: made empty.
+ * @param env: module env for module deinit() calls.
+ */
+void modstack_desetup(struct module_stack* stack, struct module_env* env);
+
+#endif /* SERVICES_MODSTACK_H */

services/outside_network.h

@@ -51,7 +51,10 @@ struct pending_timeout;
 struct ub_randstate;
 struct pending_tcp;
 struct waiting_tcp;
+struct waiting_udp;
 struct infra_cache;
+struct port_comm;
+struct port_if;
 
 /**
  * Send queries to outside servers and wait for answers from servers.
@@ -60,6 +63,10 @@ struct infra_cache;
 struct outside_network {
 	/** Base for select calls */
 	struct comm_base* base;
+	/** pointer to time in seconds */
+	uint32_t* now_secs;
+	/** pointer to time in microseconds */
+	struct timeval* now_tv;
 
 	/** buffer shared by UDP connections, since there is only one
 	    datagram at any time. */
@@ -67,21 +74,27 @@ struct outside_network {
 	/** serviced_callbacks malloc overhead when processing multiple
 	 * identical serviced queries to the same server. */
 	size_t svcd_overhead;
+	/** use x20 bits to encode additional ID random bits */
+	int use_caps_for_id;
 
-	/** 
-	 * Array of udp comm point* that are used to listen to pending events.
-	 * Each is on a different port. This is for ip4 ports.
-	 */
-	struct comm_point** udp4_ports;
-	/** number of udp4 ports */
-	size_t num_udp4;
+	/** linked list of available commpoints, unused file descriptors,
+	 * for use as outgoing UDP ports. cp.fd=-1 in them. */
+	struct port_comm* unused_fds;
 
-	/**
-	 * The opened ip6 ports.
-	 */
-	struct comm_point** udp6_ports;
-	/** number of udp6 ports */
-	size_t num_udp6;
+	/** array of outgoing IP4 interfaces */
+	struct port_if* ip4_ifs;
+	/** number of outgoing IP4 interfaces */
+	int num_ip4;
+
+	/** array of outgoing IP6 interfaces */
+	struct port_if* ip6_ifs;
+	/** number of outgoing IP6 interfaces */
+	int num_ip6;
+
+	/** pending udp queries waiting to be sent out, waiting for fd */
+	struct pending* udp_wait_first;
+	/** last pending udp query in list */
+	struct pending* udp_wait_last;
 
 	/** pending udp answers. sorted by id, addr */
 	rbtree_t* pending;
@@ -109,20 +122,65 @@ struct outside_network {
 	struct waiting_tcp* tcp_wait_last;
 };
 
+/**
+ * Outgoing interface. Ports available and currently used are tracked
+ * per interface
+ */
+struct port_if {
+	/** address ready to allocate new socket (except port no). */
+	struct sockaddr_storage addr;
+	/** length of addr field */
+	socklen_t addrlen;
+
+	/** the available ports array. These are unused.
+	 * Only the first total-inuse part is filled. */
+	int* avail_ports;
+	/** the total number of available ports (size of the array) */
+	int avail_total;
+
+	/** array of the commpoints currently in use. 
+	 * allocated for max number of fds, first part in use. */
+	struct port_comm** out;
+	/** max number of fds, size of out array */
+	int maxout;
+	/** number of commpoints (and thus also ports) in use */
+	int inuse;
+};
+
+/**
+ * Outgoing commpoint for UDP port.
+ */
+struct port_comm {
+	/** next in free list */
+	struct port_comm* next;
+	/** which port number (when in use) */
+	int number;
+	/** interface it is used in */
+	struct port_if* pif;
+	/** index in the out array of the interface */
+	int index;
+	/** number of outstanding queries on this port */
+	int num_outstanding;
+	/** UDP commpoint, fd=-1 if not in use */
+	struct comm_point* cp;
+};
+
 /**
  * A query that has an answer pending for it.
  */
 struct pending {
 	/** redblacktree entry, key is the pending struct(id, addr). */
 	rbnode_t node;
-	/** the ID for the query */
-	uint16_t id;
+	/** the ID for the query. int so that a value out of range can
+	 * be used to signify a pending that is for certain not present in
+	 * the rbtree. (and for which deletion is safe). */
+	unsigned int id;
 	/** remote address. */
 	struct sockaddr_storage addr;
 	/** length of addr field in use. */
 	socklen_t addrlen;
 	/** comm point it was sent on (and reply must come back on). */
-	struct comm_point* c;
+	struct port_comm* pc;
 	/** timeout event */
 	struct comm_timer* timer;
 	/** callback for the timeout, error or reply to the message */
@@ -131,6 +189,16 @@ struct pending {
 	void* cb_arg;
 	/** the outside network it is part of */
 	struct outside_network* outnet;
+
+	/*---- filled if udp pending is waiting -----*/
+	/** next in waiting list. */
+	struct pending* next_waiting;
+	/** timeout in msec */
+	int timeout;
+	/** The query itself, the query packet to send. */
+	uint8_t* pkt;
+	/** length of query packet. */
+	size_t pkt_len;
 };
 
 /**
@@ -225,7 +293,9 @@ struct serviced_query {
 		serviced_query_TCP_EDNS,
 		/** TCP without EDNS sent */
 		serviced_query_TCP
-	} status;
+	} 	
+		/** variable with current status */ 
+		status;
 	/** true if serviced_query is scheduled for deletion already */
 	int to_be_deleted;
 	/** number of UDP retries */
@@ -250,17 +320,19 @@ struct serviced_query {
  * @param num_ifs: number of names in array ifs.
  * @param do_ip4: service IP4.
  * @param do_ip6: service IP6.
- * @param port_base: if -1 system assigns ports, otherwise try to get
- *    the ports numbered from this starting number.
  * @param num_tcp: number of outgoing tcp buffers to preallocate.
  * @param infra: pointer to infra cached used for serviced queries.
  * @param rnd: stored to create random numbers for serviced queries.
+ * @param use_caps_for_id: enable to use 0x20 bits to encode id randomness.
+ * @param availports: array of available ports. 
+ * @param numavailports: number of available ports in array.
  * @return: the new structure (with no pending answers) or NULL on error.
  */
 struct outside_network* outside_network_create(struct comm_base* base,
 	size_t bufsize, size_t num_ports, char** ifs, int num_ifs,
-	int do_ip4, int do_ip6, int port_base, size_t num_tcp, 
-	struct infra_cache* infra, struct ub_randstate* rnd);
+	int do_ip4, int do_ip6, size_t num_tcp, struct infra_cache* infra, 
+	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
+	int numavailports);
 
 /**
  * Delete outside_network structure.
@@ -278,13 +350,12 @@ void outside_network_delete(struct outside_network* outnet);
  * @param timeout: in milliseconds from now.
  * @param callback: function to call on error, timeout or reply.
  * @param callback_arg: user argument for callback function.
- * @param rnd: random state for generating ID and port.
  * @return: NULL on error for malloc or socket. Else the pending query object.
  */
 struct pending* pending_udp_query(struct outside_network* outnet, 
 	ldns_buffer* packet, struct sockaddr_storage* addr, 
 	socklen_t addrlen, int timeout, comm_point_callback_t* callback, 
-	void* callback_arg, struct ub_randstate* rnd);
+	void* callback_arg);
 
 /**
  * Send TCP query. May wait for TCP buffer. Selects ID to be random, and 
@@ -298,13 +369,12 @@ struct pending* pending_udp_query(struct outside_network* outnet,
  *    without any query been sent to the server yet.
  * @param callback: function to call on error, timeout or reply.
  * @param callback_arg: user argument for callback function.
- * @param rnd: random state for generating ID.
  * @return: false on error for malloc or socket. Else the pending TCP object.
  */
 struct waiting_tcp* pending_tcp_query(struct outside_network* outnet, 
 	ldns_buffer* packet, struct sockaddr_storage* addr, 
 	socklen_t addrlen, int timeout, comm_point_callback_t* callback, 
-	void* callback_arg, struct ub_randstate* rnd);
+	void* callback_arg);
 
 /**
  * Delete pending answer.

smallapp/unbound-checkconf.c

@@ -0,0 +1,435 @@
+/*
+ * checkconf/unbound-checkconf.c - config file checker for unbound.conf file.
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * The config checker checks for syntax and other errors in the unbound.conf
+ * file, and can be used to check for errors before the server is started
+ * or sigHUPped.
+ * Exit status 1 means an error.
+ */
+
+#include "config.h"
+#include "util/log.h"
+#include "util/config_file.h"
+#include "util/module.h"
+#include "util/net_help.h"
+#include "util/regional.h"
+#include "iterator/iterator.h"
+#include "validator/validator.h"
+#include "services/localzone.h"
+#ifdef HAVE_PWD_H
+#include <pwd.h>
+#endif
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif
+
+/** Give checkconf usage, and exit (1). */
+static void
+usage()
+{
+	printf("Usage:	unbound-checkconf [file]\n");
+	printf("	Checks unbound configuration file for errors.\n");
+	printf("file	if omitted %s is used.\n", CONFIGFILE);
+	printf("-h	show this usage help.\n");
+	printf("Version %s\n", PACKAGE_VERSION);
+	printf("BSD licensed, see LICENSE in source package for details.\n");
+	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
+	exit(1);
+}
+
+/** check if module works with config */
+static void
+check_mod(struct config_file* cfg, struct module_func_block* fb)
+{
+	struct module_env env;
+	memset(&env, 0, sizeof(env));
+	env.cfg = cfg;
+	env.scratch = regional_create();
+	env.scratch_buffer = ldns_buffer_new(BUFSIZ);
+	if(!env.scratch || !env.scratch_buffer)
+		fatal_exit("out of memory");
+	if(!(*fb->init)(&env, 0)) {
+		fatal_exit("bad config for %s module", fb->name);
+	}
+	(*fb->deinit)(&env, 0);
+	ldns_buffer_free(env.scratch_buffer);
+	regional_destroy(env.scratch);
+}
+
+/** check localzones */
+static void
+localzonechecks(struct config_file* cfg)
+{
+	struct local_zones* zs;
+	if(!(zs = local_zones_create()))
+		fatal_exit("out of memory");
+	if(!local_zones_apply_cfg(zs, cfg))
+		fatal_exit("failed local-zone, local-data configuration");
+	local_zones_delete(zs);
+}
+
+/** emit warnings for IP in hosts */
+static void
+warn_hosts(const char* typ, struct config_stub* list)
+{
+	struct sockaddr_storage a;
+	socklen_t alen;
+	struct config_stub* s;
+	struct config_strlist* h;
+	for(s=list; s; s=s->next) {
+		for(h=s->hosts; h; h=h->next) {
+			if(extstrtoaddr(h->str, &a, &alen)) {
+				fprintf(stderr, "unbound-checkconf: warning:"
+				  " %s %s: \"%s\" is an IP%s address, "
+				  "and when looked up as a host name "
+				  "during use may not resolve.\n", 
+				  s->name, typ, h->str,
+				  addr_is_ip6(&a, alen)?"6":"4");
+			}
+		}
+	}
+}
+
+/** check interface strings */
+static void
+interfacechecks(struct config_file* cfg)
+{
+	struct sockaddr_storage a;
+	socklen_t alen;
+	int i, j;
+	for(i=0; i<cfg->num_ifs; i++) {
+		if(!ipstrtoaddr(cfg->ifs[i], UNBOUND_DNS_PORT, &a, &alen)) {
+			fatal_exit("cannot parse interface specified as '%s'",
+				cfg->ifs[i]);
+		}
+		for(j=0; j<cfg->num_ifs; j++) {
+			if(i!=j && strcmp(cfg->ifs[i], cfg->ifs[j])==0)
+				fatal_exit("interface: %s present twice, "
+					"cannot bind same ports twice.",
+					cfg->ifs[i]);
+		}
+	}
+	for(i=0; i<cfg->num_out_ifs; i++) {
+		if(!ipstrtoaddr(cfg->out_ifs[i], UNBOUND_DNS_PORT, 
+			&a, &alen)) {
+			fatal_exit("cannot parse outgoing-interface "
+				"specified as '%s'", cfg->out_ifs[i]);
+		}
+		for(j=0; j<cfg->num_out_ifs; j++) {
+			if(i!=j && strcmp(cfg->out_ifs[i], cfg->out_ifs[j])==0)
+				fatal_exit("outgoing-interface: %s present "
+					"twice, cannot bind same ports twice.",
+					cfg->out_ifs[i]);
+		}
+	}
+}
+
+/** check acl ips */
+static void
+aclchecks(struct config_file* cfg)
+{
+	int d;
+	struct sockaddr_storage a;
+	socklen_t alen;
+	struct config_str2list* acl;
+	for(acl=cfg->acls; acl; acl = acl->next) {
+		if(!netblockstrtoaddr(acl->str, UNBOUND_DNS_PORT, &a, &alen, 
+			&d)) {
+			fatal_exit("cannot parse access control address %s %s",
+				acl->str, acl->str2);
+		}
+	}
+}
+
+/** true if fname is a file */
+static int
+is_file(const char* fname) 
+{
+	struct stat buf;
+	if(stat(fname, &buf) < 0) {
+		if(errno==EACCES) {
+			printf("warning: no search permission for one of the directories in path: %s\n", fname);
+			return 1;
+		}
+		perror(fname);
+		return 0;
+	}
+	if(S_ISDIR(buf.st_mode)) {
+		printf("%s is not a file\n", fname);
+		return 0;
+	}
+	return 1;
+}
+
+/** true if fname is a directory */
+static int
+is_dir(const char* fname) 
+{
+	struct stat buf;
+	if(stat(fname, &buf) < 0) {
+		if(errno==EACCES) {
+			printf("warning: no search permission for one of the directories in path: %s\n", fname);
+			return 1;
+		}
+		perror(fname);
+		return 0;
+	}
+	if(!(S_ISDIR(buf.st_mode))) {
+		printf("%s is not a directory\n", fname);
+		return 0;
+	}
+	return 1;
+}
+
+/** convert a filename to full pathname in original filesys
+ * @param fname: the path name to convert.
+ * 	Must not be null or empty.
+ * @param cfg: config struct for chroot and chdir (if set).
+ * @param use_chdir: if false, only chroot is applied.
+ * @return pointer to static buffer which is: [chroot][chdir]fname
+ */
+static char*
+fname_after_chroot(const char* fname, struct config_file* cfg, int use_chdir)
+{
+	static char buf[1024];
+	int slashit = 0;
+	buf[0] = 0;
+	if(cfg->chrootdir && cfg->chrootdir[0] && 
+		strncmp(cfg->chrootdir, fname, strlen(cfg->chrootdir)) == 0) {
+		/* already full pathname, return it */
+		strncpy(buf, fname, sizeof(buf)-1);
+		buf[sizeof(buf)-1] = 0;
+		return buf;
+	}
+	/* chroot */
+	if(cfg->chrootdir && cfg->chrootdir[0]) {
+		/* start with chrootdir */
+		strncpy(buf, cfg->chrootdir, sizeof(buf)-1);
+		slashit = 1;
+	}
+	/* chdir */
+	if(fname[0] == '/' || !use_chdir) {
+		/* full path, no chdir */
+	} else if(cfg->directory && cfg->directory[0]) {
+		/* prepend chdir */
+		if(slashit && cfg->directory[0] != '/')
+			strncat(buf, "/", sizeof(buf)-strlen(buf)-1);
+		if(strncmp(cfg->chrootdir, cfg->directory, 
+			strlen(cfg->chrootdir)) == 0)
+			strncat(buf, cfg->directory+strlen(cfg->chrootdir), 
+				   sizeof(buf)-strlen(buf)-1);
+		else strncat(buf, cfg->directory, sizeof(buf)-strlen(buf)-1);
+		slashit = 1;
+	}
+	/* fname */
+	if(slashit && fname[0] != '/')
+		strncat(buf, "/", sizeof(buf)-strlen(buf)-1);
+	strncat(buf, fname, sizeof(buf)-strlen(buf)-1);
+	buf[sizeof(buf)-1] = 0;
+	return buf;
+}
+
+/** get base dir of a fname */
+static char*
+basedir(const char* fname, struct config_file* cfg)
+{
+	char* d = fname_after_chroot(fname, cfg, 1);
+	char* rev = strrchr(d, '/');
+	if(!rev) return NULL;
+	if(d == rev) return NULL;
+	rev[0] = 0;
+	return d;
+}
+
+/** check file list, every file must be inside the chroot location */
+static void
+check_chroot_filelist(const char* desc, struct config_strlist* list,
+	const char* chrootdir, struct config_file* cfg)
+{
+	struct config_strlist* p;
+	char* old;
+	for(p=list; p; p=p->next) {
+		if(p->str && p->str[0]) {
+			if(!is_file(fname_after_chroot(p->str, cfg, 1))) {
+				fatal_exit("%s: \"%s\" does not exist in chrootdir %s", 
+					desc, p->str, chrootdir);
+			}
+			old = p->str;
+			/* put in a new full path for continued checking */
+			p->str = strdup(fname_after_chroot(p->str, cfg, 1));
+			free(old);
+		}
+	}
+}
+
+/** check configuration for errors */
+static void
+morechecks(struct config_file* cfg, char* fname)
+{
+	warn_hosts("stub-host", cfg->stubs);
+	warn_hosts("forward-host", cfg->forwards);
+	interfacechecks(cfg);
+	aclchecks(cfg);
+
+	if(cfg->verbosity < 0)
+		fatal_exit("verbosity value < 0");
+	if(cfg->num_threads < 0 || cfg->num_threads > 10000)
+		fatal_exit("num_threads value weird");
+	if(!cfg->do_ip4 && !cfg->do_ip6)
+		fatal_exit("ip4 and ip6 are both disabled, pointless");
+	if(!cfg->do_udp && !cfg->do_tcp)
+		fatal_exit("udp and tcp are both disabled, pointless");
+
+	if(cfg->chrootdir && cfg->chrootdir[0] && 
+		cfg->chrootdir[strlen(cfg->chrootdir)-1] == '/')
+		fatal_exit("chootdir %s has trailing slash '/' please remove.",
+			cfg->chrootdir);
+	if(cfg->chrootdir && cfg->chrootdir[0] && 
+		!is_dir(cfg->chrootdir)) {
+		fatal_exit("bad chroot directory");
+	}
+	if(cfg->chrootdir && cfg->chrootdir[0]) {
+		char buf[10240];
+		buf[0] = 0;
+		if(fname[0] != '/') {
+			if(getcwd(buf, sizeof(buf)) == NULL)
+				fatal_exit("getcwd: %s", strerror(errno));
+			strncat(buf, "/", sizeof(buf)-strlen(buf)-1);
+		}
+		strncat(buf, fname, sizeof(buf)-strlen(buf)-1);
+		if(strncmp(buf, cfg->chrootdir, strlen(cfg->chrootdir)) != 0)
+			fatal_exit("config file %s is not inside chroot %s",
+				buf, cfg->chrootdir);
+	}
+	if(cfg->directory && cfg->directory[0] && !is_dir(
+		fname_after_chroot(cfg->directory, cfg, 0))) {
+		fatal_exit("bad chdir directory");
+	}
+	if( (cfg->chrootdir && cfg->chrootdir[0]) ||
+	    (cfg->directory && cfg->directory[0])) {
+		if(cfg->pidfile && cfg->pidfile[0] &&
+		   basedir(cfg->pidfile, cfg) &&
+		   !is_dir(basedir(cfg->pidfile, cfg))) {
+			fatal_exit("pidfile directory does not exist");
+		}
+		if(cfg->logfile && cfg->logfile[0] &&
+		   basedir(cfg->logfile, cfg) &&
+		   !is_dir(basedir(cfg->logfile, cfg))) {
+			fatal_exit("logfile directory does not exist");
+		}
+	}
+
+	check_chroot_filelist("file with root-hints", 
+		cfg->root_hints, cfg->chrootdir, cfg);
+	check_chroot_filelist("trust-anchor-file", 
+		cfg->trust_anchor_file_list, cfg->chrootdir, cfg);
+	check_chroot_filelist("trusted-keys-file", 
+		cfg->trusted_keys_file_list, cfg->chrootdir, cfg);
+	/* remove chroot setting so that modules are not stripping pathnames*/
+	free(cfg->chrootdir);
+	cfg->chrootdir = NULL;
+	
+	if(strcmp(cfg->module_conf, "iterator") != 0 &&
+		strcmp(cfg->module_conf, "validator iterator") != 0) {
+		fatal_exit("module conf '%s' is not known to work",
+			cfg->module_conf);
+	}
+
+#ifdef HAVE_GETPWNAM
+	if(cfg->username && cfg->username[0]) {
+		if(getpwnam(cfg->username) == NULL)
+			fatal_exit("user '%s' does not exist.", cfg->username);
+		endpwent();
+	}
+#endif
+
+	localzonechecks(cfg);
+}
+
+/** check config file */
+static void
+checkconf(char* cfgfile)
+{
+	struct config_file* cfg = config_create();
+	if(!cfg)
+		fatal_exit("out of memory");
+	if(!config_read(cfg, cfgfile)) {
+		/* config_read prints messages to stderr */
+		config_delete(cfg);
+		exit(1);
+	}
+	morechecks(cfg, cfgfile);
+	check_mod(cfg, iter_get_funcblock());
+	check_mod(cfg, val_get_funcblock());
+	config_delete(cfg);
+	printf("unbound-checkconf: no errors in %s\n", cfgfile);
+}
+
+/** getopt global, in case header files fail to declare it. */
+extern int optind;
+/** getopt global, in case header files fail to declare it. */
+extern char* optarg;
+
+/** Main routine for checkconf */
+int main(int argc, char* argv[])
+{
+	int c;
+	char* f;
+	log_ident_set("unbound-checkconf");
+	log_init(NULL, 0, NULL);
+	checklock_start();
+	/* parse the options */
+	while( (c=getopt(argc, argv, "h")) != -1) {
+		switch(c) {
+		case '?':
+		case 'h':
+		default:
+			usage();
+		}
+	}
+	argc -= optind;
+	argv += optind;
+	if(argc != 0 && argc != 1)
+		usage();
+	if(argc == 1)
+		f = argv[0];
+	else	f = CONFIGFILE;
+	checkconf(f);
+	checklock_stop();
+	return 0;
+}

smallapp/unbound-host.c

@@ -0,0 +1,461 @@
+/*
+ * checkconf/unbound-host.c - replacement for host that supports validation.
+ *
+ * Copyright (c) 2007, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This file performs functionality like 'host', and also supports validation.
+ * It uses the libunbound library.
+ */
+
+#include "config.h"
+#include "libunbound/unbound.h"
+#include <ldns/ldns.h>
+
+/** verbosity for unbound-host app */
+static int verb = 0;
+
+/** Give unbound-host usage, and exit (1). */
+static void
+usage()
+{
+	printf("Usage:	unbound-host [-vdhr] [-c class] [-t type] hostname\n");
+	printf("                     [-y key] [-f keyfile] [-F namedkeyfile]\n");
+	printf("                     [-C configfile]\n");
+	printf("  Queries the DNS for information.\n");
+	printf("  The hostname is looked up for IP4, IP6 and mail.\n");
+	printf("  If an ip-address is given a reverse lookup is done.\n");
+	printf("  Use the -v option to see DNSSEC security information.\n");
+	printf("    -t type		what type to look for.\n");
+	printf("    -c class		what class to look for, if not class IN.\n");
+	printf("    -y 'keystring'	specify trust anchor, DS or DNSKEY, like\n");
+	printf("			-y 'example.com DS 31560 5 1 1CFED8478...'\n");
+	printf("    -f keyfile		read trust anchors from file, with lines as -y.\n");
+	printf("    -F keyfile		read named.conf-style trust anchors.\n");
+	printf("    -C config		use the specified unbound.conf\n");
+	printf("    -r			read forwarder information from /etc/resolv.conf\n");
+	printf("      			breaks validation if the fwder does not do DNSSEC.\n");
+	printf("    -v			be more verbose, shows nodata and security.\n");
+	printf("    -d			debug, traces the action, -d -d shows more.\n");
+	printf("    -h			show this usage help.\n");
+	printf("Version %s\n", PACKAGE_VERSION);
+	printf("BSD licensed, see LICENSE in source package for details.\n");
+	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
+	exit(1);
+}
+
+/** determine if str is ip4 and put into reverse lookup format */
+static int
+isip4(const char* nm, char** res)
+{
+	struct in_addr addr;
+	/* ddd.ddd.ddd.ddd.in-addr.arpa. is less than 32 */
+	char buf[32];
+	if(inet_pton(AF_INET, nm, &addr) <= 0) {
+		return 0;
+	}
+	snprintf(buf, sizeof(buf), "%u.%u.%u.%u.in-addr.arpa",
+		(unsigned)((uint8_t*)&addr)[3], (unsigned)((uint8_t*)&addr)[2],
+		(unsigned)((uint8_t*)&addr)[1], (unsigned)((uint8_t*)&addr)[0]);
+	*res = strdup(buf);
+	return 1;
+}
+
+/** determine if str is ip6 and put into reverse lookup format */
+static int
+isip6(const char* nm, char** res)
+{
+	struct in6_addr addr;
+	/* [nibble.]{32}.ip6.arpa. is less than 128 */
+	char* hex = "0123456789abcdef";
+	char buf[128];
+	char *p;
+	int i;
+	if(inet_pton(AF_INET6, nm, &addr) <= 0) {
+		return 0;
+	}
+	p = buf;
+	for(i=15; i>=0; i--) {
+		uint8_t b = ((uint8_t*)&addr)[i];
+		*p++ = hex[ (b&0x0f) ];
+		*p++ = '.';
+		*p++ = hex[ (b&0xf0) >> 4 ];
+		*p++ = '.';
+	}
+	snprintf(buf+16*4, sizeof(buf)-16*4, "ip6.arpa");
+	*res = strdup(buf);
+	if(!*res) {
+		fprintf(stderr, "error: out of memory\n");
+		exit(1);
+	}
+	return 1;
+}
+
+/** massage input name */
+static char*
+massage_qname(const char* nm, int* reverse)
+{
+	/* recognise IP4 and IP6, create reverse addresses if needed */
+	char* res;
+	if(isip4(nm, &res)) {
+		*reverse = 1;
+	} else if(isip6(nm, &res)) {
+		*reverse = 1;
+	} else {
+		res = strdup(nm);
+	}
+	if(!res) {
+		fprintf(stderr, "error: out of memory\n");
+		exit(1);
+	}
+	return res;
+}
+
+/** massage input type */
+static int
+massage_type(const char* t, int reverse, int* multi)
+{
+	if(t) {
+		int r = ldns_get_rr_type_by_name(t);
+		if(r == 0 && strcasecmp(t, "TYPE0") != 0 && 
+			strcmp(t, "") != 0) {
+			fprintf(stderr, "error unknown type %s\n", t);
+			exit(1);
+		}
+		return r;
+	}
+	if(!t && reverse)
+		return LDNS_RR_TYPE_PTR;
+	*multi = 1;
+	return LDNS_RR_TYPE_A;
+}
+
+/** massage input class */
+static int
+massage_class(const char* c)
+{
+	if(c) {
+		int r = ldns_get_rr_class_by_name(c);
+		if(r == 0 && strcasecmp(c, "CLASS0") != 0 && 
+			strcmp(c, "") != 0) {
+			fprintf(stderr, "error unknown class %s\n", c);
+			exit(1);
+		}
+		return r;
+	}
+	return LDNS_RR_CLASS_IN;
+}
+
+/** nice security status string */
+static const char* 
+secure_str(struct ub_result* result)
+{
+	if(result->secure) return "(secure)";
+	if(result->bogus) return "(BOGUS (security failure))";
+	return "(insecure)";
+}
+
+/** nice string for type */
+static void
+pretty_type(char* s, size_t len, int t)
+{
+	const ldns_rr_descriptor *d = ldns_rr_descript((uint16_t)t);
+	if(d) {
+		snprintf(s, len, "%s", d->_name);
+	} else {
+		snprintf(s, len, "TYPE%d", t);
+	}
+}
+
+/** nice string for class */
+static void
+pretty_class(char* s, size_t len, int c)
+{
+	ldns_lookup_table *cl = ldns_lookup_by_id(ldns_rr_classes, c);
+	if(cl) {
+		snprintf(s, len, "%s", cl->name);
+	} else {
+		snprintf(s, len, "CLASS%d", c);
+	}
+}
+
+/** nice string for rcode */
+static void
+pretty_rcode(char* s, size_t len, int r)
+{
+	ldns_lookup_table *rcode = ldns_lookup_by_id(ldns_rcodes, r);
+	if(rcode) {
+		snprintf(s, len, "%s", rcode->name);
+	} else {
+		snprintf(s, len, "RCODE%d", r);
+	}
+}
+
+/** convert and print rdata */
+static void
+print_rd(int t, char* data, size_t len)
+{
+	size_t i, pos = 0;
+	uint8_t* rd = (uint8_t*)malloc(len+2);
+	ldns_rr* rr = ldns_rr_new();
+	ldns_status status;
+	if(!rd || !rr) {
+		fprintf(stderr, "out of memory");
+		exit(1);
+	}
+	ldns_rr_set_type(rr, t);
+	ldns_write_uint16(rd, len);
+	memmove(rd+2, data, len);
+	ldns_rr_set_owner(rr, NULL);
+	status = ldns_wire2rdf(rr, rd, len+2, &pos);
+	if(status != LDNS_STATUS_OK) {
+	
+		free(rd);
+		printf("error_printing_data");
+	}
+	for(i=0; i<ldns_rr_rd_count(rr); i++) {
+		printf(" ");
+		ldns_rdf_print(stdout, ldns_rr_rdf(rr, i));
+	}
+	ldns_rr_free(rr);
+	free(rd);
+}
+
+/** pretty line of RR data for results */
+static void
+pretty_rdata(char* q, char* cstr, char* tstr, int t, const char* sec, 
+	char* data, size_t len)
+{
+	printf("%s", q);
+	if(strcmp(cstr, "IN") != 0)
+		printf(" in class %s", cstr);
+	if(t == LDNS_RR_TYPE_A)
+		printf(" has address");
+	else if(t == LDNS_RR_TYPE_AAAA)
+		printf(" has IPv6 address");
+	else if(t == LDNS_RR_TYPE_MX)
+		printf(" mail is handled by");
+	else if(t == LDNS_RR_TYPE_PTR)
+		printf(" domain name pointer");
+	else	printf(" has %s record", tstr);
+	print_rd(t, data, len);
+	if(verb > 0)
+		printf(" %s", sec);
+	printf("\n");
+}
+
+/** pretty line of output for results */
+static void
+pretty_output(char* q, int t, int c, struct ub_result* result, int docname)
+{
+	int i;
+	const char *secstatus = secure_str(result);
+	char tstr[16];
+	char cstr[16];
+	char rcodestr[16];
+	pretty_type(tstr, 16, t);
+	pretty_class(cstr, 16, c);
+	pretty_rcode(rcodestr, 16, result->rcode);
+
+	if(!result->havedata && result->rcode) {
+		printf("Host %s not found: %d(%s).",
+			q, result->rcode, rcodestr);
+		if(verb > 0)
+			printf(" %s", secstatus);
+		printf("\n");
+		return;
+	}
+	if(docname && result->canonname &&
+		result->canonname != result->qname) {
+		printf("%s is an alias for %s", result->qname, 
+			result->canonname);
+		if(verb > 0)
+			printf(" %s", secstatus);
+		printf("\n");
+	}
+	/* remove trailing . from long canonnames for nicer output */
+	if(result->canonname && strlen(result->canonname) > 1 &&
+		result->canonname[strlen(result->canonname)-1] == '.')
+		result->canonname[strlen(result->canonname)-1] = 0;
+	if(!result->havedata) {
+		if(verb > 0) {
+			printf("%s", result->canonname?result->canonname:q);
+			if(strcmp(cstr, "IN") != 0)
+				printf(" in class %s", cstr);
+			if(t == LDNS_RR_TYPE_A)
+				printf(" has no address");
+			else if(t == LDNS_RR_TYPE_AAAA)
+				printf(" has no IPv6 address");
+			else if(t == LDNS_RR_TYPE_PTR)
+				printf(" has no domain name ptr");
+			else if(t == LDNS_RR_TYPE_MX)
+				printf(" has no mail handler record");
+			else	printf(" has no %s record", tstr);
+			printf(" %s\n", secstatus);
+		}
+		/* else: emptiness to indicate no data */
+		return;
+	}
+	i=0;
+	while(result->data[i])
+	{
+		pretty_rdata(
+			result->canonname?result->canonname:q,
+			cstr, tstr, t, secstatus, result->data[i],
+			(size_t)result->len[i]);
+		i++;
+	}
+}
+
+/** perform a lookup and printout return if domain existed */
+static int
+dnslook(struct ub_ctx* ctx, char* q, int t, int c, int docname)
+{
+	int ret;
+	struct ub_result* result;
+
+	ret = ub_resolve(ctx, q, t, c, &result);
+	if(ret != 0) {
+		fprintf(stderr, "resolve error: %s\n", ub_strerror(ret));
+		exit(1);
+	}
+	pretty_output(q, t, c, result, docname);
+	ret = result->nxdomain;
+	ub_resolve_free(result);
+	return ret;
+}
+
+/** perform host lookup */
+static void
+lookup(struct ub_ctx* ctx, const char* nm, const char* qt, const char* qc)
+{
+	/* massage input into a query name, type and class */
+	int multi = 0;	 /* no type, so do A, AAAA, MX */
+	int reverse = 0; /* we are doing a reverse lookup */
+	char* realq = massage_qname(nm, &reverse);
+	int t = massage_type(qt, reverse, &multi);
+	int c = massage_class(qc);
+
+	/* perform the query */
+	if(multi) {
+		if(!dnslook(ctx, realq, LDNS_RR_TYPE_A, c, 1)) {
+			/* domain exists, lookup more */
+			(void)dnslook(ctx, realq, LDNS_RR_TYPE_AAAA, c, 0);
+			(void)dnslook(ctx, realq, LDNS_RR_TYPE_MX, c, 0);
+		}
+	} else {
+		(void)dnslook(ctx, realq, t, c, 1);
+	}
+	ub_ctx_delete(ctx);
+	free(realq);
+}
+
+/** print error if any */
+static void
+check_ub_res(int r)
+{
+	if(r != 0) {
+		fprintf(stderr, "error: %s\n", ub_strerror(r));
+		exit(1);
+	}
+}
+
+/** getopt global, in case header files fail to declare it. */
+extern int optind;
+/** getopt global, in case header files fail to declare it. */
+extern char* optarg;
+
+/** Main routine for checkconf */
+int main(int argc, char* argv[])
+{
+	int c;
+	char* qclass = NULL;
+	char* qtype = NULL;
+	struct ub_ctx* ctx = NULL;
+	int debuglevel = 0;
+	
+	ctx = ub_ctx_create();
+	if(!ctx) {
+		fprintf(stderr, "error: out of memory\n");
+		exit(1);
+	}
+
+	/* parse the options */
+	while( (c=getopt(argc, argv, "F:c:df:hrt:vy:C:")) != -1) {
+		switch(c) {
+		case 'c':
+			qclass = optarg;
+			break;
+		case 'C':
+			check_ub_res(ub_ctx_config(ctx, optarg));
+			break;
+		case 'd':
+			debuglevel++;
+			if(debuglevel < 2) 
+				debuglevel = 2; /* at least VERB_DETAIL */
+			check_ub_res(ub_ctx_debuglevel(ctx, debuglevel));
+			break;
+		case 'r':
+			check_ub_res(ub_ctx_resolvconf(ctx, "/etc/resolv.conf"));
+			break;
+		case 't':
+			qtype = optarg;
+			break;
+		case 'v':
+			verb++;
+			break;
+		case 'y':
+			check_ub_res(ub_ctx_add_ta(ctx, optarg));
+			break;
+		case 'f':
+			check_ub_res(ub_ctx_add_ta_file(ctx, optarg));
+			break;
+		case 'F':
+			check_ub_res(ub_ctx_trustedkeys(ctx, optarg));
+			break;
+		case '?':
+		case 'h':
+		default:
+			usage();
+		}
+	}
+	argc -= optind;
+	argv += optind;
+	if(argc != 1)
+		usage();
+
+	lookup(ctx, argv[0], qtype, qclass);
+	return 0;
+}

smallapp/worker_cb.c

@@ -114,3 +114,74 @@ acl_list_cmp(const void* ATTR_UNUSED(k1), const void* ATTR_UNUSED(k2))
 	log_assert(0);
 	return 0;
 }
+
+int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt), 
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
+	socklen_t ATTR_UNUSED(addrlen), int ATTR_UNUSED(timeout), 
+	struct module_qstate* ATTR_UNUSED(q), int ATTR_UNUSED(use_tcp))
+{
+	log_assert(0);
+	return 0;
+}
+
+struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
+	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
+	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
+	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
+{
+	log_assert(0);
+	return 0;
+}
+
+int libworker_handle_reply(struct comm_point* ATTR_UNUSED(c), 
+	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
+        struct comm_reply* ATTR_UNUSED(reply_info))
+{
+	log_assert(0);
+	return 0;
+}
+
+int libworker_handle_service_reply(struct comm_point* ATTR_UNUSED(c), 
+	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
+        struct comm_reply* ATTR_UNUSED(reply_info))
+{
+	log_assert(0);
+	return 0;
+}
+
+int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
+{
+	log_assert(0);
+	return 0;
+}
+
+void worker_stat_timer_cb(void* ATTR_UNUSED(arg))
+{
+	log_assert(0);
+}
+
+/** keep track of lock id in lock-verify application */
+struct order_id {
+        /** the thread id that created it */
+        int thr;
+        /** the instance number of creation */
+        int instance;
+};
+
+int order_lock_cmp(const void* e1, const void* e2)
+{
+        struct order_id* o1 = (struct order_id*)e1;
+        struct order_id* o2 = (struct order_id*)e2;
+        if(o1->thr < o2->thr) return -1;
+        if(o1->thr > o2->thr) return 1;
+        if(o1->instance < o2->instance) return -1;
+        if(o1->instance > o2->instance) return 1;
+        return 0;
+}
+
+int
+codeline_cmp(const void* a, const void* b)
+{
+        return strcmp((const char*)a, (const char*)b);
+}

testcode/asynclook.c

@@ -0,0 +1,485 @@
+/*
+ * testcode/asynclook.c - debug program perform async libunbound queries.
+ *
+ * Copyright (c) 2008, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This program shows the results from several background lookups,
+ * while printing time in the foreground.
+ */
+
+#include "config.h"
+#include "libunbound/unbound.h"
+#include "util/locks.h"
+#include "util/log.h"
+
+/**
+ * result list for the lookups
+ */
+struct lookinfo {
+	/** name to look up */
+	char* name;
+	/** tracking number that can be used to cancel the query */
+	int async_id;
+	/** error code from libunbound */
+	int err;
+	/** result from lookup */
+	struct ub_result* result;
+};
+
+/** global variable to see how many queries we have left */
+static int num_wait = 0;
+
+/** usage information for asynclook */
+void usage(char* argv[])
+{
+	printf("usage: %s [options] name ...\n", argv[0]);
+	printf("names are looked up at the same time, asynchronously.\n");
+	printf("	-b : use blocking requests\n");
+	printf("	-c : cancel the requests\n");
+	printf("	-d : enable debug output\n");
+	printf("	-f addr : use addr, forward to that server\n");
+	printf("	-h : this help message\n");
+	printf("	-H fname : read hosts from fname\n");
+	printf("	-r fname : read resolv.conf from fname\n");
+	printf("	-t : use a resolver thread instead of forking a process\n");
+	printf("	-x : perform extended threaded test\n");
+	exit(1);
+}
+
+/** print result from lookup nicely */
+static void
+print_result(struct lookinfo* info)
+{
+	char buf[100];
+	if(info->err) /* error (from libunbound) */
+		printf("%s: error %s\n", info->name,
+			ub_strerror(info->err));
+	else if(!info->result)
+		printf("%s: cancelled\n", info->name);
+	else if(info->result->havedata)
+		printf("%s: %s\n", info->name,
+			inet_ntop(AF_INET, info->result->data[0],
+			buf, (socklen_t)sizeof(buf)));
+	else {
+		/* there is no data, why that? */
+		if(info->result->rcode == 0 /*noerror*/ ||
+			info->result->nxdomain)
+			printf("%s: no data %s\n", info->name,
+			info->result->nxdomain?"(no such host)":
+			"(no IP4 address)");
+		else	/* some error (from the server) */
+			printf("%s: DNS error %d\n", info->name,
+				info->result->rcode);
+	}
+}
+
+/** this is a function of type ub_callback_t */
+static void 
+lookup_is_done(void* mydata, int err, struct ub_result* result)
+{
+	/* cast mydata back to the correct type */
+	struct lookinfo* info = (struct lookinfo*)mydata;
+	fprintf(stderr, "name %s resolved\n", info->name);
+	info->err = err;
+	info->result = result;
+	/* one less to wait for */
+	num_wait--;
+}
+
+/** check error, if bad, exit with error message */
+static void 
+checkerr(const char* desc, int err)
+{
+	if(err != 0) {
+		printf("%s error: %s\n", desc, ub_strerror(err));
+		exit(1);
+	}
+}
+
+#ifdef THREADS_DISABLED
+/** only one process can communicate with async worker */
+#define NUMTHR 1
+#else /* have threads */
+/** number of threads to make in extended test */
+#define NUMTHR 10
+#endif
+
+/** struct for extended thread info */
+struct ext_thr_info {
+	/** thread num for debug */
+	int thread_num;
+	/** thread id */
+	ub_thread_t tid;
+	/** context */
+	struct ub_ctx* ctx;
+	/** size of array to query */
+	int argc;
+	/** array of names to query */
+	char** argv;
+	/** number of queries to do */
+	int numq;
+};
+
+/** if true, we are testing against 'localhost' and extra checking is done */
+static int q_is_localhost = 0;
+
+/** check result structure for the 'correct' answer */
+static void
+ext_check_result(const char* desc, int err, struct ub_result* result)
+{
+	checkerr(desc, err);
+	if(result == NULL) {
+		printf("%s: error result is NULL.\n", desc);
+		exit(1);
+	}
+	if(q_is_localhost) {
+		if(strcmp(result->qname, "localhost") != 0) {
+			printf("%s: error result has wrong qname.\n", desc);
+			exit(1);
+		}
+		if(result->qtype != LDNS_RR_TYPE_A) {
+			printf("%s: error result has wrong qtype.\n", desc);
+			exit(1);
+		}
+		if(result->qclass != LDNS_RR_CLASS_IN) {
+			printf("%s: error result has wrong qclass.\n", desc);
+			exit(1);
+		}
+		if(result->data == NULL) {
+			printf("%s: error result->data is NULL.\n", desc);
+			exit(1);
+		}
+		if(result->len == NULL) {
+			printf("%s: error result->len is NULL.\n", desc);
+			exit(1);
+		}
+		if(result->rcode != 0) {
+			printf("%s: error result->rcode is set.\n", desc);
+			exit(1);
+		}
+		if(result->havedata == 0) {
+			printf("%s: error result->havedata is unset.\n", desc);
+			exit(1);
+		}
+		if(result->nxdomain != 0) {
+			printf("%s: error result->nxdomain is set.\n", desc);
+			exit(1);
+		}
+		if(result->secure || result->bogus) {
+			printf("%s: error result->secure or bogus is set.\n", 
+				desc);
+			exit(1);
+		}
+		if(result->data[0] == NULL) {
+			printf("%s: error result->data[0] is NULL.\n", desc);
+			exit(1);
+		}
+		if(result->len[0] != 4) {
+			printf("%s: error result->len[0] is wrong.\n", desc);
+			exit(1);
+		}
+		if(result->len[1] != 0 || result->data[1] != NULL) {
+			printf("%s: error result->data[1] or len[1] is "
+				"wrong.\n", desc);
+			exit(1);
+		}
+		if(result->answer_packet == NULL) {
+			printf("%s: error result->answer_packet is NULL.\n", 
+				desc);
+			exit(1);
+		}
+		if(result->answer_len != 54) {
+			printf("%s: error result->answer_len is wrong.\n", 
+				desc);
+			exit(1);
+		}
+	}
+}
+
+/** extended bg result callback, this function is ub_callback_t */
+static void 
+ext_callback(void* mydata, int err, struct ub_result* result)
+{
+	int* my_id = (int*)mydata;
+	int doprint = 0;
+	if(my_id) {
+		/* I have an id, make sure we are not cancelled */
+		if(*my_id == 0) {
+			printf("error: query returned, but was cancelled\n");
+			abort();
+			exit(1);
+		}
+		if(doprint) 
+			printf("cb %d: ", *my_id);
+	}
+	ext_check_result("ext_callback", err, result);
+	log_assert(result);
+	if(doprint) {
+		struct lookinfo pi;
+		pi.name = result?result->qname:"noname";
+		pi.result = result;
+		pi.err = 0;
+		print_result(&pi);
+	}
+	ub_resolve_free(result);
+}
+
+/** extended thread worker */
+static void*
+ext_thread(void* arg)
+{
+	struct ext_thr_info* inf = (struct ext_thr_info*)arg;
+	int i, r;
+	struct ub_result* result;
+	int* async_ids = NULL;
+	log_thread_set(&inf->thread_num);
+	if(inf->thread_num > NUMTHR*2/3) {
+		async_ids = (int*)calloc((size_t)inf->numq, sizeof(int));
+		if(!async_ids) {
+			printf("out of memory\n");
+			exit(1);
+		}
+	}
+	for(i=0; i<inf->numq; i++) {
+		if(async_ids) {
+			r = ub_resolve_async(inf->ctx, 
+				inf->argv[i%inf->argc], LDNS_RR_TYPE_A, 
+				LDNS_RR_CLASS_IN, &async_ids[i], ext_callback, 
+				&async_ids[i]);
+			checkerr("ub_resolve_async", r);
+			if(i > 100) {
+				r = ub_cancel(inf->ctx, async_ids[i-100]);
+				checkerr("ub_cancel", r);
+			}
+			if(i > 200) {
+				async_ids[i-200]=0;
+			}
+		} else if(inf->thread_num > NUMTHR/2) {
+			/* async */
+			r = ub_resolve_async(inf->ctx, 
+				inf->argv[i%inf->argc], LDNS_RR_TYPE_A, 
+				LDNS_RR_CLASS_IN, NULL, ext_callback, NULL);
+			checkerr("ub_resolve_async", r);
+		} else  {
+			/* blocking */
+			r = ub_resolve(inf->ctx, inf->argv[i%inf->argc], 
+				LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN, &result);
+			ext_check_result("ub_resolve", r, result);
+			ub_resolve_free(result);
+		}
+	}
+	if(inf->thread_num > NUMTHR/2) {
+		r = ub_wait(inf->ctx);
+		checkerr("ub_ctx_wait", r);
+	}
+	free(async_ids);
+	
+	return NULL;
+}
+
+/** perform extended threaded test */
+static int
+ext_test(struct ub_ctx* ctx, int argc, char** argv)
+{
+	struct ext_thr_info inf[NUMTHR];
+	int i;
+	if(argc == 1 && strcmp(argv[0], "localhost") == 0)
+		q_is_localhost = 1;
+	printf("extended test start (%d threads)\n", NUMTHR);
+	for(i=0; i<NUMTHR; i++) {
+		/* 0 = this, 1 = library bg worker */
+		inf[i].thread_num = i+2;
+		inf[i].ctx = ctx;
+		inf[i].argc = argc;
+		inf[i].argv = argv;
+		inf[i].numq = 1000;
+		ub_thread_create(&inf[i].tid, ext_thread, &inf[i]);
+	}
+	/* the work happens here */
+	for(i=0; i<NUMTHR; i++) {
+		ub_thread_join(inf[i].tid);
+	}
+	printf("extended test end\n");
+	ub_ctx_delete(ctx);
+	checklock_stop();
+	return 0;
+}
+
+/** getopt global, in case header files fail to declare it. */
+extern int optind;
+/** getopt global, in case header files fail to declare it. */
+extern char* optarg;
+
+/** main program for asynclook */
+int main(int argc, char** argv) 
+{
+	int c;
+	struct ub_ctx* ctx;
+	struct lookinfo* lookups;
+	int i, r, cancel=0, blocking=0, ext=0;
+
+	/* lock debug start (if any) */
+	checklock_start();
+
+	/* create context */
+	ctx = ub_ctx_create();
+	if(!ctx) {
+		printf("could not create context, %s\n", strerror(errno));
+		return 1;
+	}
+
+	/* command line options */
+	if(argc == 1) {
+		usage(argv);
+	}
+	while( (c=getopt(argc, argv, "bcdf:hH:r:tx")) != -1) {
+		switch(c) {
+			case 'd':
+				r = ub_ctx_debuglevel(ctx, 3);
+				checkerr("ub_ctx_debuglevel", r);
+				break;
+			case 't':
+				r = ub_ctx_async(ctx, 1);
+				checkerr("ub_ctx_async", r);
+				break;
+			case 'c':
+				cancel = 1;
+				break;
+			case 'b':
+				blocking = 1;
+				break;
+			case 'r':
+				r = ub_ctx_resolvconf(ctx, optarg);
+				if(r != 0) {
+					printf("ub_ctx_resolvconf "
+						"error: %s : %s\n",
+						ub_strerror(r), 
+						strerror(errno));
+					return 1;
+				}
+				break;
+			case 'H':
+				r = ub_ctx_hosts(ctx, optarg);
+				if(r != 0) {
+					printf("ub_ctx_hosts "
+						"error: %s : %s\n",
+						ub_strerror(r), 
+						strerror(errno));
+					return 1;
+				}
+				break;
+			case 'f':
+				r = ub_ctx_set_fwd(ctx, optarg);
+				checkerr("ub_ctx_set_fwd", r);
+				break;
+			case 'x':
+				ext = 1;
+				break;
+			case 'h':
+			case '?':
+			default:
+				usage(argv);
+		}
+	}
+	argc -= optind;
+	argv += optind;
+
+	if(ext)
+		return ext_test(ctx, argc, argv);
+
+	/* allocate array for results. */
+	lookups = (struct lookinfo*)calloc((size_t)argc, 
+		sizeof(struct lookinfo));
+	if(!lookups) {
+		printf("out of memory\n");
+		return 1;
+	}
+
+	/* perform asyncronous calls */
+	num_wait = argc;
+	for(i=0; i<argc; i++) {
+		lookups[i].name = argv[i];
+		if(blocking) {
+			fprintf(stderr, "lookup %s\n", argv[i]);
+			r = ub_resolve(ctx, argv[i], LDNS_RR_TYPE_A,
+				LDNS_RR_CLASS_IN, &lookups[i].result);
+			checkerr("ub_resolve", r);
+		} else {
+			fprintf(stderr, "start async lookup %s\n", argv[i]);
+			r = ub_resolve_async(ctx, argv[i], LDNS_RR_TYPE_A,
+				LDNS_RR_CLASS_IN, &lookups[i], &lookup_is_done, 
+				&lookups[i].async_id);
+			checkerr("ub_resolve_async", r);
+		}
+	}
+	if(blocking)
+		num_wait = 0;
+	else if(cancel) {
+		for(i=0; i<argc; i++) {
+			fprintf(stderr, "cancel %s\n", argv[i]);
+			r = ub_cancel(ctx, lookups[i].async_id);
+			checkerr("ub_cancel", r);
+		}
+		num_wait = 0;
+	}
+
+	/* wait while the hostnames are looked up. Do something useful here */
+	if(num_wait > 0)
+	    for(i=0; i<1000; i++) {
+		usleep(100000);
+		fprintf(stderr, "%g seconds passed\n", 0.1*(double)i);
+		r = ub_process(ctx);
+		checkerr("ub_process", r);
+		if(num_wait == 0)
+			break;
+	}
+	if(i>=999) {
+		printf("timed out\n");
+		return 0;
+	}
+	printf("lookup complete\n");
+
+	/* print lookup results */
+	for(i=0; i<argc; i++) {
+		print_result(&lookups[i]);
+		ub_resolve_free(lookups[i].result);
+	}
+
+	ub_ctx_delete(ctx);
+	free(lookups);
+	checklock_stop();
+	return 0;
+}

testcode/checklocks.c

@@ -658,7 +658,9 @@ static void* checklock_main(void* arg)
 	/* Hack to get same numbers as in log file */
 	thr->num = *(int*)(thr->arg);
 	log_assert(thr->num < THRDEBUG_MAX_THREADS);
-	log_assert(thread_infos[thr->num] == NULL);
+	/* as an aside, due to this, won't work for libunbound bg thread */
+	if(thread_infos[thr->num] != NULL)
+		log_warn("thread warning, thr->num %d not NULL", thr->num);
 	thread_infos[thr->num] = thr;
 	LOCKRET(pthread_setspecific(thr_debug_key, thr));
 	if(check_locking_order)
@@ -830,20 +832,3 @@ checklock_thrjoin(pthread_t thread)
 }
 
 #endif /* USE_THREAD_DEBUG */
-
-int order_lock_cmp(const void* e1, const void* e2)
-{
-	struct order_id* o1 = (struct order_id*)e1;
-	struct order_id* o2 = (struct order_id*)e2;
-	if(o1->thr < o2->thr) return -1;
-	if(o1->thr > o2->thr) return 1;
-	if(o1->instance < o2->instance) return -1;
-	if(o1->instance > o2->instance) return 1;
-	return 0;
-}
-
-int
-codeline_cmp(const void* a, const void* b)
-{
-	return strcmp((const char*)a, (const char*)b);
-}

testcode/checklocks.h

@@ -340,17 +340,4 @@ typedef pthread_key_t ub_thread_key_t;
 #define ub_thread_key_get(key) pthread_getspecific(key)
 
 #endif /* USE_THREAD_DEBUG */
-
-/** keep track of lock id in lock-verify application */
-struct order_id {
-	/** the thread id that created it */
-	int thr;
-	/** the instance number of creation */
-	int instance;
-};
-/** compare two order_ids */
-int order_lock_cmp(const void* e1, const void* e2);
-/** compare two codeline structs for rbtree */
-int codeline_cmp(const void* a, const void* b);
-
 #endif /* TESTCODE_CHECK_LOCKS_H */

testcode/do-tests.sh

@@ -2,12 +2,31 @@
 
 NEED_SPLINT='00-lint.tpkg'
 NEED_DOXYGEN='01-doc.tpkg'
-NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg'
+NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg fwd_ancil.tpkg stat_timer.tpkg 05-asynclook.tpkg stream_tcp.tpkg speed_cache.tpkg fwd_oneport.tpkg fwd_udptmout.tpkg fwd_waitudp.tpkg tcp_sigpipe.tpkg hostsfileosx.tpkg local_nodefault.tpkg'
 NEED_XXD='fwd_compress_c00c.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg'
+NEED_CURL='06-ianaports.tpkg'
+NEED_WHOAMI='07-confroot.tpkg'
+NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg'
+NEED_JOBCONTROL='tcp_sigpipe.tpkg'
+
+# test if job control - and also signals - are available (not on mingw).
+if wait %% 2>&1 | grep "job control not enabled" >/dev/null 2>&1; then
+	JOBCONTROL=no
+else
+	JOBCONTROL=yes
+fi
+
+# test for ipv6, uses streamptcp peculiarity.
+if ./streamtcp -f ::1 2>&1 | grep "not supported" >/dev/null 2>&1; then
+	HAVE_IPV6=no
+else
+	HAVE_IPV6=yes
+fi
 
 cd testdata;
 sh ../testcode/mini_tpkg.sh clean
+rm -f .perfstats.txt
 for test in `ls *.tpkg`; do
 	SKIP=0
 	if echo $NEED_SPLINT | grep $test >/dev/null; then
@@ -20,6 +39,11 @@ for test in `ls *.tpkg`; do
 			SKIP=1;
 		fi
 	fi
+	if echo $NEED_CURL | grep $test >/dev/null; then
+		if test ! -x "`which curl`"; then
+			SKIP=1;
+		fi
+	fi
 	if echo $NEED_LDNS_TESTNS | grep $test >/dev/null; then
 		if test ! -x "`which ldns-testns`"; then
 			SKIP=1;
@@ -35,6 +59,21 @@ for test in `ls *.tpkg`; do
 			SKIP=1;
 		fi
 	fi
+	if echo $NEED_WHOAMI | grep $test >/dev/null; then
+		if test ! -x "`which whoami`"; then
+			SKIP=1;
+		fi
+	fi
+	if echo $NEED_IPV6 | grep $test >/dev/null; then
+		if test "$HAVE_IPV6" = no; then
+			SKIP=1;
+		fi
+	fi
+	if echo $NEED_JOBCONTROL | grep $test >/dev/null; then
+		if test "$JOBCONTROL" = no; then
+			SKIP=1;
+		fi
+	fi
 	if test $SKIP -eq 0; then
 		echo $test
 		sh ../testcode/mini_tpkg.sh -a ../.. exe $test
@@ -43,3 +82,4 @@ for test in `ls *.tpkg`; do
 	fi
 done
 sh ../testcode/mini_tpkg.sh report
+cat .perfstats.txt

testcode/fake_event.c

@@ -592,6 +592,14 @@ comm_base_delete(struct comm_base* b)
 	free(runtime);
 }
 
+void
+comm_base_timept(struct comm_base* b, uint32_t** tt, struct timeval** tv)
+{
+	struct replay_runtime* runtime = (struct replay_runtime*)b;
+	*tt = &runtime->now_secs;
+	*tv = &runtime->now_tv;
+}
+
 void 
 comm_base_dispatch(struct comm_base* b)
 {
@@ -662,15 +670,6 @@ comm_point_send_reply(struct comm_reply* repinfo)
 	log_pkt("reply pkt: ", ans->pkt);
 }
 
-void 
-comm_point_send_reply_iov(struct comm_reply* repinfo, struct iovec* iov,
-        size_t iovlen)
-{
-	/* skip tcp len at [0]. */
-	write_iov_buffer(repinfo->c->buffer, iov+1, iovlen-1);
-	comm_point_send_reply(repinfo);
-}
-
 void 
 comm_point_drop_reply(struct comm_reply* repinfo)
 {
@@ -685,9 +684,11 @@ struct outside_network*
 outside_network_create(struct comm_base* base, size_t bufsize, 
 	size_t ATTR_UNUSED(num_ports), char** ATTR_UNUSED(ifs), 
 	int ATTR_UNUSED(num_ifs), int ATTR_UNUSED(do_ip4), 
-	int ATTR_UNUSED(do_ip6), int ATTR_UNUSED(port_base),
-	size_t ATTR_UNUSED(num_tcp), struct infra_cache* ATTR_UNUSED(infra),
-	struct ub_randstate* ATTR_UNUSED(rnd))
+	int ATTR_UNUSED(do_ip6), size_t ATTR_UNUSED(num_tcp), 
+	struct infra_cache* ATTR_UNUSED(infra),
+	struct ub_randstate* ATTR_UNUSED(rnd), 
+	int ATTR_UNUSED(use_caps_for_id), int* ATTR_UNUSED(availports),
+	int ATTR_UNUSED(numavailports))
 {
 	struct outside_network* outnet =  calloc(1, 
 		sizeof(struct outside_network));
@@ -712,8 +713,7 @@ outside_network_delete(struct outside_network* outnet)
 struct pending* 
 pending_udp_query(struct outside_network* outnet, ldns_buffer* packet,
 	struct sockaddr_storage* addr, socklen_t addrlen, int timeout,
-	comm_point_callback_t* callback, void* callback_arg,
-	struct ub_randstate* ATTR_UNUSED(rnd))
+	comm_point_callback_t* callback, void* callback_arg)
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,
@@ -765,8 +765,7 @@ pending_udp_query(struct outside_network* outnet, ldns_buffer* packet,
 struct waiting_tcp* 
 pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 	struct sockaddr_storage* addr, socklen_t addrlen, int timeout,
-	comm_point_callback_t* callback, void* callback_arg,
-	struct ub_randstate* ATTR_UNUSED(rnd))
+	comm_point_callback_t* callback, void* callback_arg)
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,
@@ -863,7 +862,7 @@ struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	pend->addrlen = addrlen;
 	pend->callback = callback;
 	pend->cb_arg = callback_arg;
-	pend->timeout = UDP_QUERY_TIMEOUT;
+	pend->timeout = UDP_AUTH_QUERY_TIMEOUT;
 	pend->transport = transport_udp; /* pretend UDP */
 	pend->pkt = NULL;
 	pend->runtime = runtime;
@@ -1005,6 +1004,12 @@ void comm_point_udp_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(event),
 	log_assert(0);
 }
 
+void comm_point_udp_ancil_callback(int ATTR_UNUSED(fd), 
+	short ATTR_UNUSED(event), void* ATTR_UNUSED(arg))
+{
+	log_assert(0);
+}
+
 void comm_point_tcp_accept_callback(int ATTR_UNUSED(fd), 
 	short ATTR_UNUSED(event), void* ATTR_UNUSED(arg))
 {
@@ -1035,6 +1040,12 @@ void comm_point_local_handle_callback(int ATTR_UNUSED(fd),
 	log_assert(0);
 }
 
+void comm_point_raw_handle_callback(int ATTR_UNUSED(fd), 
+	short ATTR_UNUSED(event), void* ATTR_UNUSED(arg))
+{
+	log_assert(0);
+}
+
 int serviced_udp_callback(struct comm_point* ATTR_UNUSED(c), 
 	void* ATTR_UNUSED(arg), int ATTR_UNUSED(error),
         struct comm_reply* ATTR_UNUSED(reply_info))
@@ -1063,4 +1074,26 @@ int serviced_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 	return 0;
 }
 
+/* no statistics timers in testbound */
+struct comm_timer* comm_timer_create(struct comm_base* ATTR_UNUSED(base), 
+	void (*cb)(void*), void* ATTR_UNUSED(cb_arg))
+{
+	(void)cb;
+	return malloc(1);
+}
+
+void comm_timer_disable(struct comm_timer* ATTR_UNUSED(timer))
+{
+}
+
+void comm_timer_set(struct comm_timer* ATTR_UNUSED(timer), 
+	struct timeval* ATTR_UNUSED(tv))
+{
+}
+
+void comm_timer_delete(struct comm_timer* timer)
+{
+	free(timer);
+}
+
 /*********** End of Dummy routines ***********/

testcode/harvest.c

@@ -0,0 +1,845 @@
+/*
+ * testcode/harvest.c - debug program to get relevant data to a set of queries.
+ *
+ * Copyright (c) 2008, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This program downloads relevant DNS data to a set of queries.
+ * This means that the queries are asked to root, TLD, SLD servers and
+ * the results stored per zone.
+ * The following data is pertinent:
+ *
+ * At each label:
+ *	SOA
+ *	NS
+ *	DNSKEY
+ *	DS
+ * For the whole query:
+ *	the result.
+ * For NS-records:
+ *	their label data
+ *	and the A and AAAA records for it.
+ *	(as if the name, with A and AAAA query type is in the list,
+ *	 referred to as recursion depth+1)
+ * Any NSEC, NSEC3, SOA records or additional data found in answers.
+ *
+ * All of this is data that would be encountered during an iterative lookup
+ * for the queries in the list. It is saved to enable a replay of iterative
+ * lookups for performance testing.
+ *
+ * A number of assumptions are made.
+ * 1) configuration is correct.
+ *    The parent has the same NS records as the child.
+ *    All nameservers carry the same data.
+ * 2) EDNS/nonEDNS responses and other behaviour is ignored.
+ *    Only the data is saved.
+ * This creates a snapshot that represents the data as this resolver saw it.
+ */
+
+#include "config.h"
+#include <signal.h>
+#include "libunbound/unbound.h"
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif
+struct todo_item;
+struct labdata;
+
+/** this represents the data that has been collected 
+ * as well as a todo list and some settings */
+struct harvest_data {
+	/** the unbound context */
+	struct ub_ctx* ctx;
+
+	/** a tree per label; thus this first one is one root entry,
+	 * that has a tree of TLD labels. Those have trees of SLD labels. */
+	struct labdata* root;
+	/** the original query list */
+	struct todo_item* orig_list;
+	/** the query list todo */
+	struct todo_item* todo_list;
+	/** last item in todo list */
+	struct todo_item* todo_last;
+	/** number of todo items */
+	int numtodo;
+
+	/** where to store the results */
+	char* resultdir;
+	/** maximum recursion depth */
+	int maxdepth;
+	/** current recursion depth */
+	int curdepth;
+
+	/** max depth of labels */
+	int maxlabels;
+	/** number of RRs stored */
+	int num_rrs;
+	/** number of zones written */
+	int num_zones;
+};
+
+/**
+ * Todo item
+ */
+struct todo_item {
+	/** the next item */
+	struct todo_item* next;
+
+	/** query as rdf */
+	ldns_rdf* qname;
+	/** the query type */
+	int qtype;
+	/** query class */
+	int qclass;
+
+	/** recursion depth of todo item (orig list is 0) */
+	int depth;
+	/** the label associated with the query */
+	struct labdata* lab;
+};
+
+/** 
+ * Every label has a sest of sublabels, that have sets of sublabels ...
+ * Per label is stored also a set of data items, and todo information
+ */
+struct labdata {
+	/** node in ldns rbtree */
+	ldns_rbnode_t node;
+	/** the name of this label */
+	ldns_rdf* label;
+	/** full name of point in domain tree */
+	ldns_rdf* name;
+
+	/** parent in label tree (NULL for root) */
+	struct labdata* parent;
+	/** tree of sublabels (if any) */
+	ldns_rbtree_t* sublabels;
+
+	/** list of RRs for this label */
+	ldns_rr_list* rrlist;
+	/** have queries for this label been queued */
+	int done;
+};
+
+/** usage information for harvest */
+static void usage(char* nm) 
+{
+	printf("usage: %s [options]\n", nm);
+	printf("-f fnm	query list to read from file\n");
+	printf("	every line has format: qname qclass qtype\n");
+	printf("-v 	verbose (-v -v even more)\n");
+	printf("-C cfg	config file with resolver options\n");
+	exit(1);
+}
+
+/** verbosity for harvest */
+static int hverb = 0;
+
+/** exit with error */
+static void error_exit(char* str)
+{
+	printf("error: %s\n", str);
+	exit(1);
+}
+
+/** read a query file */
+static void
+qlist_read_file(struct harvest_data* data, char* fname)
+{
+	char buf[1024];
+	char nm[1024], cl[1024], tp[1024];
+	int r;
+	int num = 0;
+	FILE* in = fopen(fname, "r");
+	struct todo_item* t;
+	if(!in) {
+		perror(fname);
+		error_exit("could not open file");
+	}
+	while(fgets(buf, (int)sizeof(buf), in)) {
+		if(buf[0] == 0) continue;
+		if(buf[0] == '\n') continue;
+		/* allow some comments */
+		if(buf[0] == ';') continue;
+		if(buf[0] == '#') continue;
+		nm[0] = 0; cl[0] = 0; tp[0] = 0;
+		r = sscanf(buf, " %1023s %1023s %1023s", nm, cl, tp);
+		if(r == 0) continue;
+		t = (struct todo_item*)calloc(1, sizeof(*t));
+		if(!t) error_exit("out of memory");
+		t->qname = ldns_dname_new_frm_str(nm);
+		if(!t->qname) {
+			printf("parse error: %s\n", nm);
+			error_exit("bad qname");
+		}
+		t->depth = 0;
+		t->qtype = LDNS_RR_TYPE_A;
+		t->qclass = LDNS_RR_CLASS_IN;
+		if(r >= 2) {
+			if(strcmp(cl, "IN") == 0 || strcmp(cl, "CH") == 0)
+				t->qclass = ldns_get_rr_class_by_name(cl);
+			else	t->qtype = ldns_get_rr_type_by_name(cl);
+		}
+		if(r >= 3) {
+			if(strcmp(tp, "IN") == 0 || strcmp(tp, "CH") == 0)
+				t->qclass = ldns_get_rr_class_by_name(tp);
+			else	t->qtype = ldns_get_rr_type_by_name(tp);
+		}
+		num++;
+
+		t->next = data->orig_list;
+		data->orig_list = t;
+	}
+	printf("read %s: %d queries\n", fname, num);
+	fclose(in);
+}
+
+/** compare two labels */
+static int
+lab_cmp(const void *x, const void *y)
+{
+	return ldns_dname_compare((const ldns_rdf*)x, (const ldns_rdf*)y);
+}
+
+/** create label entry */
+static struct labdata*
+lab_create(char* name)
+{
+	struct labdata* lab = (struct labdata*)calloc(1, sizeof(*lab));
+	if(!lab) error_exit("out of memory");
+	lab->label = ldns_dname_new_frm_str(name);
+	if(!lab->label) error_exit("out of memory");
+	lab->name = ldns_dname_new_frm_str(name);
+	if(!lab->name) error_exit("out of memory");
+	lab->node.key = lab->label;
+	lab->node.data = lab;
+	lab->sublabels = ldns_rbtree_create(lab_cmp);
+	if(!lab->sublabels) error_exit("out of memory");
+	lab->rrlist = ldns_rr_list_new();
+	if(!lab->rrlist) error_exit("out of memory");
+
+	return lab;
+}
+
+/** for this name, lookup the label, create if does not exist */
+static struct labdata*
+find_create_lab(struct harvest_data* data, ldns_rdf* name)
+{
+	struct labdata* lab = data->root;
+	struct labdata* nextlab;
+	ldns_rdf* next;
+	uint8_t numlab = ldns_dname_label_count(name);
+	if((int)numlab > data->maxlabels)
+		data->maxlabels = (int)numlab;
+	while(numlab--) {
+		next = ldns_dname_label(name, numlab);
+		if(!next) error_exit("ldns_dname_label");
+		
+		nextlab = (struct labdata*)
+			ldns_rbtree_search(lab->sublabels, next);
+		if(!nextlab) {
+			/* create it */
+			nextlab = (struct labdata*)calloc(1, sizeof(*lab));
+			if(!nextlab) error_exit("out of memory");
+			nextlab->label = ldns_rdf_clone(next);
+			if(!nextlab->label) error_exit("out of memory");
+			nextlab->node.key = nextlab->label;
+			nextlab->node.data = nextlab;
+			nextlab->sublabels = ldns_rbtree_create(lab_cmp);
+			if(!nextlab->sublabels) error_exit("out of memory");
+			nextlab->parent = lab;
+			nextlab->name = ldns_rdf_clone(next);
+			if(!nextlab->name) error_exit("out of memory");
+			if(ldns_dname_cat(nextlab->name, lab->name) 
+				!= LDNS_STATUS_OK) error_exit("outofmem");
+			nextlab->rrlist = ldns_rr_list_new();
+			if(!nextlab->rrlist) error_exit("out of memory");
+			(void)ldns_rbtree_insert(lab->sublabels, 
+				&nextlab->node);
+			if(hverb) {
+				printf("new label: ");
+				ldns_rdf_print(stdout, nextlab->name);
+				printf("\n");
+			}
+		}
+		lab = nextlab;
+		ldns_rdf_deep_free(next);
+	}
+	return lab;
+}
+
+/** for given query, create todo items, and labels if needed */
+static void
+new_todo_item(struct harvest_data* data, ldns_rdf* qname, int qtype, 
+	int qclass, int depth)
+{
+	struct labdata* lab = find_create_lab(data, qname);
+	struct todo_item* it;
+	if(!lab) error_exit("out of memory creating new label");
+	it = (struct todo_item*)calloc(1, sizeof(*it));
+	it->qname = ldns_rdf_clone(qname);
+	it->qtype = qtype;
+	it->qclass = qclass;
+	it->depth = depth;
+	it->lab = lab;
+	it->next = NULL;
+	if(data->todo_last)
+		data->todo_last->next = it;
+	else data->todo_list = it;
+	data->todo_last = it;
+	data->numtodo ++;
+	if(hverb >= 2) {
+		printf("new todo: ");
+		ldns_rdf_print(stdout, it->qname);
+		if(ldns_rr_descript((uint16_t)it->qtype) && 
+			ldns_rr_descript((uint16_t)it->qtype)->_name)
+			printf(" %s", ldns_rr_descript((uint16_t)
+			it->qtype)->_name);
+		if(ldns_lookup_by_id(ldns_rr_classes, it->qclass) && 
+			ldns_lookup_by_id(ldns_rr_classes, it->qclass)->name) 
+			printf(" %s", ldns_lookup_by_id(ldns_rr_classes, 
+				it->qclass)->name);
+		printf("\n");
+	}
+}
+
+/** add infra todo items for this query */
+static void
+new_todo_infra(struct harvest_data* data, struct labdata* startlab, int depth)
+{
+	struct labdata* lab;
+	for(lab = startlab; lab; lab = lab->parent) {
+		if(lab->done)
+			return;
+		new_todo_item(data, lab->name, LDNS_RR_TYPE_NS, 
+			LDNS_RR_CLASS_IN, depth);
+		new_todo_item(data, lab->name, LDNS_RR_TYPE_SOA, 
+			LDNS_RR_CLASS_IN, depth);
+		new_todo_item(data, lab->name, LDNS_RR_TYPE_DNSKEY, 
+			LDNS_RR_CLASS_IN, depth);
+		new_todo_item(data, lab->name, LDNS_RR_TYPE_DS, 
+			LDNS_RR_CLASS_IN, depth);
+		new_todo_item(data, lab->name, LDNS_RR_TYPE_A, 
+			LDNS_RR_CLASS_IN, depth);
+		new_todo_item(data, lab->name, LDNS_RR_TYPE_AAAA, 
+			LDNS_RR_CLASS_IN, depth);
+		lab->done = 1;
+	}
+}
+
+/** make todo items for initial data */
+static void
+make_todo(struct harvest_data* data)
+{
+	struct todo_item* it;
+	for(it=data->orig_list; it; it = it->next) {
+		/* create todo item for this query itself */
+		new_todo_item(data, it->qname, it->qtype, it->qclass, 0);
+		/* create todo items for infra queries to support it */
+		new_todo_infra(data, data->todo_list->lab, 
+			data->todo_list->depth);
+	}
+}
+
+/** store RR and make new work items for it if needed */
+static void
+process_rr(struct harvest_data* data, ldns_rr* rr, int depth)
+{
+	/* must free or store rr */
+	struct labdata* lab = find_create_lab(data, ldns_rr_owner(rr));
+	if(!lab) error_exit("cannot find/create label");
+	/* generate extra queries */
+	if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NS) {
+		new_todo_infra(data, find_create_lab(data, 
+			ldns_rr_ns_nsdname(rr)), depth+1);
+	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_MX) {
+		new_todo_infra(data, find_create_lab(data, 
+			ldns_rr_mx_exchange(rr)), depth+1);
+	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA) {
+		new_todo_infra(data, find_create_lab(data, 
+			ldns_rr_rdf(rr, 0)), depth+1);
+	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_CNAME) {
+		int t = ldns_rr_get_type(rr);
+		if(t!=LDNS_RR_TYPE_A && t!=LDNS_RR_TYPE_AAAA &&
+			t!=LDNS_RR_TYPE_SOA && t!=LDNS_RR_TYPE_NS &&
+			t!=LDNS_RR_TYPE_DS && t!=LDNS_RR_TYPE_DNSKEY)
+			new_todo_item(data, ldns_rr_rdf(rr, 0), t,
+				ldns_rr_get_class(rr), depth+1);
+			/* can get caught in CNAME loop, but depth will
+			 * catch that; unbound cache helps too(servfails on
+			 * a cname loop) */
+		new_todo_infra(data, find_create_lab(data, 
+			ldns_rr_rdf(rr, 0)), depth+1);
+	}
+	/* store it */
+	if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NSEC) {
+		/* find correct zone to store NSEC in (for delegation zones) */
+		if(ldns_dname_compare(ldns_rr_rdf(rr, 0), ldns_rr_owner(rr))
+			== 0) {
+			/* store at the single name = apex */
+		} else if(!ldns_dname_is_subdomain(ldns_rr_rdf(rr, 0), 
+			ldns_rr_owner(rr)) && lab->parent) {
+			/* if   owner NSEC subdomain-of-owner then
+		 	 * store at owner (owner is apex or empty nonterminal).
+		 	 * Otherwise at owner parent. */
+			lab = lab->parent;
+		}
+	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_DS) {
+		/* store DSes in parent zone */
+		if(lab->parent)
+			lab = lab->parent;
+	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NSEC3) {
+		/* store NSEC3s one label up at zone apex */
+		if(lab->parent)
+			lab = lab->parent;
+	}
+	/* we assume NS set is equal across parent-child border. */
+
+	if(!ldns_rr_list_contains_rr(lab->rrlist, rr)) {
+		if(hverb >= 2) {
+			printf("store RR ");
+			ldns_rr_print(stdout, rr);
+			printf("\n");
+		}
+		if(!ldns_rr_list_push_rr(lab->rrlist, rr))
+			error_exit("outofmem ldns_rr_list_push_rr");
+		data->num_rrs++;
+	} else {
+		if(hverb >= 2) {
+			printf("duplicate RR ");
+			ldns_rr_print(stdout, rr);
+			printf("\n");
+		}
+		ldns_rr_free(rr);
+	}
+}
+
+/** store RRs and make new work items if needed */
+static void
+process_pkt(struct harvest_data* data, ldns_pkt* pkt, int depth)
+{
+	size_t i;
+	ldns_rr_list* list;
+	list = ldns_pkt_get_section_clone(pkt, LDNS_SECTION_ANY_NOQUESTION);
+	if(!list) error_exit("outofmemory");
+	for(i=0; i<ldns_rr_list_rr_count(list); i++) {
+		process_rr(data, ldns_rr_list_rr(list, i), depth);
+	}
+	ldns_rr_list_free(list);
+}
+
+/** process a todo item */
+static void
+process(struct harvest_data* data, struct todo_item* it)
+{
+	int r;
+	char* nm;
+	struct ub_result* result = NULL;
+	ldns_pkt* pkt = NULL;
+	ldns_status s;
+	if(hverb) {
+		printf("process: ");
+		ldns_rdf_print(stdout, it->qname);
+		if(ldns_rr_descript((uint16_t)it->qtype) && 
+			ldns_rr_descript((uint16_t)it->qtype)->_name)
+			printf(" %s", ldns_rr_descript((uint16_t)
+			it->qtype)->_name);
+		if(ldns_lookup_by_id(ldns_rr_classes, it->qclass) && 
+			ldns_lookup_by_id(ldns_rr_classes, it->qclass)->name) 
+			printf(" %s", ldns_lookup_by_id(ldns_rr_classes, 
+				it->qclass)->name);
+		printf("\n");
+	}
+	/* do lookup */
+	nm = ldns_rdf2str(it->qname);
+	if(!nm) error_exit("ldns_rdf2str");
+	r = ub_resolve(data->ctx, nm, it->qtype, it->qclass, &result);
+	if(r != 0) {
+		printf("ub_resolve(%s, %d, %d): %s\n", nm, it->qtype, 
+			it->qclass, ub_strerror(r));
+		free(nm);
+		return;
+	}
+	if(result->rcode == LDNS_RCODE_SERVFAIL) {
+		free(nm);
+		return;
+	}
+	/* even if result is a negative, try to store resulting SOA/NSEC */
+
+	/* create ldns pkt */
+	s = ldns_wire2pkt(&pkt, result->answer_packet, 
+		(size_t)result->answer_len);
+	if(s != LDNS_STATUS_OK) {
+		printf("ldns_wire2pkt failed! %s %d %d %s %d\n", nm, 
+			it->qtype, it->qclass, ldns_get_errorstr_by_id(s),
+			result->answer_len);
+		free(nm);
+		return;
+	}
+	if(hverb >= 2) {
+		printf("answer: ");
+		ldns_pkt_print(stdout, pkt);
+		printf("\n");
+	}
+	/* process results */
+	process_pkt(data, pkt, it->depth);
+
+	ldns_pkt_free(pkt);
+	free(nm);
+	ub_resolve_free(result);
+}
+
+/** perform main harvesting */
+static void
+harvest_main(struct harvest_data* data)
+{
+	struct todo_item* it;
+	int numdone = 0;
+	/* register todo queries for all original queries */
+	make_todo(data);
+	printf("depth 0: done %d todo %d\n", 0, data->numtodo);
+	/* pick up a todo item and process it */
+	while(data->todo_list) {
+		numdone++;
+		it = data->todo_list;
+		data->todo_list = it->next;
+		if(!data->todo_list) data->todo_last = NULL;
+		if(numdone%1000==0 || it->depth > data->curdepth) {
+			data->curdepth = it->depth;
+			printf("depth %d: done %d todo %d, %d rrs\n", 
+				it->depth, numdone, data->numtodo, 
+				data->num_rrs);
+		}
+		if(it->depth >= data->maxdepth) {
+			printf("obtained %d rrs to a max of %d labels.\n",
+				data->num_rrs, data->maxlabels);
+			return;
+		}
+		data->numtodo--;
+		process(data, it);
+		usleep(1000000/100);
+	}
+}
+
+/** create directory if it does not exist */
+static void
+hv_mkdir(char* dir)
+{
+#ifdef MKDIR_HAS_ONE_ARG
+	if(mkdir(dir) == -1) {
+#else
+	if(mkdir(dir, 0755) == -1) {
+#endif
+		if(errno == EEXIST)
+			return;
+		perror(dir);
+		error_exit("mkdir failed");
+	}
+}
+
+
+/** see if rrlist contains a SOA record */
+static ldns_rr*
+has_SOA(ldns_rr_list* list)
+{
+	size_t i;
+	for(i=0; i<ldns_rr_list_rr_count(list); i++) {
+		if(ldns_rr_get_type(ldns_rr_list_rr(list, i)) 
+			== LDNS_RR_TYPE_SOA)
+			return ldns_rr_list_rr(list, i);
+	}
+	return NULL;
+}
+
+/** write moredata for a zone*/
+static void
+write_moredata(struct harvest_data* data, struct labdata* zone,
+	FILE *f, struct labdata* thislab, ldns_rr* nslist)
+{
+	struct labdata* lab;
+	size_t i;
+	ldns_rr* ns;
+	LDNS_RBTREE_FOR(lab, struct labdata*, thislab->sublabels) {
+		if(has_SOA(lab->rrlist)) {
+			/* copy only NS glue */
+			for(i=0; i<ldns_rr_list_rr_count(lab->rrlist); i++) {
+				ns = ldns_rr_list_rr(lab->rrlist, i);
+				if(ldns_rr_get_type(ns) == LDNS_RR_TYPE_NS) {
+					ldns_rr_print(f, ns);
+					if(ldns_dname_is_subdomain(
+						ldns_rr_ns_nsdname(ns), 
+						lab->name)) {
+						ldns_rr_push_rdf(nslist, 
+							ldns_rdf_clone(
+							ldns_rr_ns_nsdname(ns)));
+					}
+				}
+			}
+		} else {
+			/* copy all, recurse */
+			for(i=0; i<ldns_rr_list_rr_count(lab->rrlist); i++) {
+				ldns_rr_print(f, 
+					ldns_rr_list_rr(lab->rrlist, i));
+			}
+			write_moredata(data, zone, f, lab, nslist);
+		}
+	}
+}
+
+/** find and write glue into zone file */
+static void
+write_glue(struct harvest_data* data, struct labdata* thislab, FILE* f, 
+	ldns_rdf* name, int dep)
+{
+	size_t i;
+	struct labdata* lab;
+	ldns_rr* rr;
+	if(ldns_dname_compare(name, thislab->name) == 0) {
+		/* this is it! Did we go outside the zone? */
+		if(dep == 0)
+			return;
+		/* find A and AAAA */
+		for(i=0; i<ldns_rr_list_rr_count(thislab->rrlist); i++) {
+			rr = ldns_rr_list_rr(thislab->rrlist, i);
+			if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_A ||
+			   ldns_rr_get_type(rr) == LDNS_RR_TYPE_AAAA) {
+				ldns_rr_print(f, rr);
+			}
+		}
+		return;
+	}
+	/* recurse deeper */
+	LDNS_RBTREE_FOR(lab, struct labdata*, thislab->sublabels) {
+		if(has_SOA(lab->rrlist)) {
+			write_glue(data, lab, f, name, dep+1);
+		} else {
+			write_glue(data, lab, f, name, dep);
+		}
+	}
+}
+
+/** write zonefile for zone at this apex */
+static void
+write_zonefile(struct harvest_data* data, int dep, FILE* zlist, 
+	struct labdata* apex, ldns_rr* soa)
+{
+	FILE *f;
+	char fname[1024];
+	char* zname = ldns_rdf2str(apex->name);
+	time_t tm = time(NULL);
+	size_t i;
+	ldns_rr* nslist;
+	if(!zname) error_exit("out of mem ldns_rdf2str");
+	if(strcmp(zname, ".") == 0)
+		snprintf(fname, sizeof(fname), "l%d/root.zone", dep);
+	else	snprintf(fname, sizeof(fname), "l%d/%szone", dep, zname);
+
+	fprintf(zlist, "zone: name: \"%s\" %s%szonefile: \"%s\"\n",
+		zname, 
+		strlen(zname)/8<1?"\t":"",
+		strlen(zname)/8<2?"\t":"",
+		fname);
+
+	if(hverb) printf("writing %s\n", fname);
+	f = fopen(fname, "w");
+	if(!f) {
+		perror(fname);
+		error_exit("cannot open zone file");
+	}
+	fprintf(f, "; %s - generated by harvest program.\n", fname);
+	fprintf(f, "; zone name %s - this is a partial snapshot of "
+		"data relevant to the query list.\n", zname);
+	fprintf(f, "; created %u - date %s\n", (unsigned)tm, ctime(&tm));
+	ldns_rr_print(f, soa);
+	fprintf(f, "\n");
+	for(i=0; i<ldns_rr_list_rr_count(apex->rrlist); i++) {
+		if(ldns_rr_get_type(ldns_rr_list_rr(apex->rrlist, i))
+			== LDNS_RR_TYPE_SOA) continue;
+		ldns_rr_print(f, ldns_rr_list_rr(apex->rrlist, i));
+	}
+	/* search for more data - subdomains inside the zone, NS glue */
+	nslist = ldns_rr_new();
+	if(!nslist) error_exit("out of memory");
+	fprintf(f, "; end of apex, more data follows\n");
+	write_moredata(data, apex, f, apex, nslist);
+
+	/* add NS from apex that need glue too */
+	for(i=0; i<ldns_rr_list_rr_count(apex->rrlist); i++) {
+		if(ldns_rr_get_type(ldns_rr_list_rr(apex->rrlist, i)) !=
+			LDNS_RR_TYPE_NS)
+			continue;
+		/* these are only added again if in a subzone */
+		if(ldns_dname_is_subdomain(ldns_rr_ns_nsdname(
+			ldns_rr_list_rr(apex->rrlist, i)), apex->name)) {
+			ldns_rr_push_rdf(nslist, ldns_rdf_clone(
+				ldns_rr_ns_nsdname(ldns_rr_list_rr(
+				apex->rrlist, i))));
+		}
+	}
+
+	fprintf(f, "; glue data follows\n");
+	/* lookup and add glue (if not already in zone) */
+	for(i=0; i<ldns_rr_rd_count(nslist); i++) {
+		write_glue(data, apex, f, ldns_rr_rdf(nslist, i), 0);
+	}
+
+	fclose(f);
+	ldns_rr_free(nslist);
+	free(zname);
+}
+
+/** create zones at depth d in label tree */
+static void
+create_zones(struct harvest_data* data, int dep, FILE* zlist, 
+	struct labdata* labnow, int depnow)
+{
+	struct labdata* s;
+	ldns_rr* soa;
+	if(depnow == dep) {
+		/* see if this is a zone start - a SOA */
+		if((soa=has_SOA(labnow->rrlist))) {
+			write_zonefile(data, dep, zlist, labnow, soa);
+			data->num_zones++;
+		}
+		return;
+	}
+	/* recurse */
+	LDNS_RBTREE_FOR(s, struct labdata*, labnow->sublabels) {
+		create_zones(data, dep, zlist, s, depnow+1);
+	}
+}
+
+/** sort rrlists */
+static void
+harvest_sort(struct labdata* lab)
+{
+	struct labdata* s;
+	/* prettier output if sorted here */
+	ldns_rr_list_sort(lab->rrlist);
+	/* and recurse */
+	LDNS_RBTREE_FOR(s, struct labdata*, lab->sublabels) {
+		harvest_sort(s);
+	}
+}
+
+/** output harvested results */
+static void
+harvest_output(struct harvest_data* data)
+{
+	int d;
+	char buf[20];
+	FILE* zlist;
+	int lastzones;
+	hv_mkdir(data->resultdir);
+	if(chdir(data->resultdir) == -1) {
+		perror(data->resultdir);
+		error_exit("cannot chdir");
+	}
+	harvest_sort(data->root);
+	/* create zones */
+	for(d = 0; d<data->maxlabels; d++) {
+		lastzones = data->num_zones;
+		printf("creating zones %d\n", d);	
+		snprintf(buf, sizeof(buf), "l%d", d);
+		hv_mkdir(buf);
+		snprintf(buf, sizeof(buf), "l%d.zones", d);
+		zlist = fopen(buf, "w");
+		if(!zlist) {
+			perror(buf);
+			error_exit("cannot write zonelist file");
+		}
+		fprintf(zlist, "# partial zones at depth %d\n", d);
+		create_zones(data, d, zlist, data->root, 0);
+		fclose(zlist);
+		printf("creating zones %d - %d zones written\n", d,
+			data->num_zones - lastzones);	
+	}
+}
+
+/** getopt global, in case header files fail to declare it. */
+extern int optind;
+/** getopt global, in case header files fail to declare it. */
+extern char* optarg;
+
+/** main program for harvest */
+int main(int argc, char* argv[]) 
+{
+	struct harvest_data data;
+	char* nm = argv[0];
+	int c;
+
+	/* defaults */
+	memset(&data, 0, sizeof(data));
+	data.ctx = ub_ctx_create();
+	data.resultdir = strdup("harvested_zones");
+	if(!data.resultdir) error_exit("out of memory");
+	data.maxdepth = 2;
+
+	/* parse the options */
+	while( (c=getopt(argc, argv, "hf:vC:")) != -1) {
+		switch(c) {
+		case 'C':
+			if(ub_ctx_config(data.ctx, optarg) != 0)
+				error_exit("config read failed");
+			break;
+		case 'f':
+			qlist_read_file(&data, optarg);
+			break;
+		case 'v':
+			hverb++;
+			break;
+		case '?':
+		case 'h':
+		default:
+			usage(nm);
+		}
+	}
+	argc -= optind;
+	argv += optind;
+	if(argc != 0)
+		usage(nm);
+	if(data.orig_list == NULL)
+		error_exit("No queries to make, use -f (help with -h).");
+	data.root = lab_create(".");
+	if(!data.root) error_exit("out of memory");
+	
+	/* harvest the data */
+	harvest_main(&data);
+	harvest_output(&data);
+
+	/* no cleanup except the context (to close open sockets) */
+	ub_ctx_delete(data.ctx);
+	return 0;
+}

testcode/ldns-testpkts.c

@@ -3,7 +3,7 @@
  *
  * Data storage for specially crafted replies for testing purposes.
  *
- * (c) NLnet Labs, 2005, 2006, 2007
+ * (c) NLnet Labs, 2005, 2006, 2007, 2008
  * See the file LICENSE for the license
  */
 
@@ -504,7 +504,7 @@ read_entry(FILE* in, const char* name, int *lineno, uint32_t* default_ttl,
 	return 0;
 }
 
-/** reads the canned reply file and returns a list of structs */
+/* reads the canned reply file and returns a list of structs */
 struct entry* 
 read_datafile(const char* name)
 {
@@ -645,7 +645,7 @@ match_all(ldns_pkt* q, ldns_pkt* p, bool mttl)
 	return 1;
 }
 
-/** finds entry in list, or returns NULL */
+/* finds entry in list, or returns NULL */
 struct entry* 
 find_match(struct entry* entries, ldns_pkt* query_pkt,
 	enum transport_type transport)
@@ -708,7 +708,11 @@ adjust_packet(struct entry* match, ldns_pkt* answer_pkt, ldns_pkt* query_pkt)
 	}
 	if(match->sleeptime > 0) {
 		verbose(3, "sleeping for %d seconds\n", match->sleeptime);
+#ifdef HAVE_SLEEP
 		sleep(match->sleeptime);
+#else
+		Sleep(match->sleeptime * 1000);
+#endif
 	}
 }
 
@@ -781,9 +785,14 @@ handle_query(uint8_t* inbuf, ssize_t inlen, struct entry* entries, int* count,
 				answer_pkt = NULL;
 			} else {
 				verbose(3, "Could not parse hex data (%s), sending hex data directly.\n", ldns_get_errorstr_by_id(status));
+				/* still try to adjust ID */
 				answer_size = ldns_buffer_capacity(p->reply_from_hex);
 				outbuf = LDNS_XMALLOC(uint8_t, answer_size);
 				memcpy(outbuf, ldns_buffer_export(p->reply_from_hex), answer_size);
+				if(entry->copy_id) {
+					ldns_write_uint16(outbuf, 
+						ldns_pkt_id(query_pkt));
+				}
 			}
 		} else {
 			answer_pkt = ldns_pkt_clone(p->reply);
@@ -803,7 +812,11 @@ handle_query(uint8_t* inbuf, ssize_t inlen, struct entry* entries, int* count,
 		if(p->packet_sleep) {
 			verbose(3, "sleeping for next packet %d secs\n", 
 				p->packet_sleep);
+#ifdef HAVE_SLEEP
 			sleep(p->packet_sleep);
+#else
+			Sleep(p->packet_sleep * 1000);
+#endif
 			verbose(3, "wakeup for next packet "
 				"(slept %d secs)\n", p->packet_sleep);
 		}

testcode/ldns-testpkts.h

@@ -78,7 +78,7 @@
 				; with the SECTION keywords (only SECTION QUERY
 				; is used to match queries). If the data cannot
 				; be parsed, ADJUST rules for the answer packet
-				; are ignored
+				; are ignored. Only copy_id is done.
 	HEX_ANSWER_END
 	ENTRY_END
 

testcode/lock_verify.c

@@ -47,11 +47,21 @@
 #include "util/log.h"
 #include "util/rbtree.h"
 #include "util/locks.h"
-#include "testcode/checklocks.h"
+#include "util/fptr_wlist.h"
 
 /* --- data structures --- */
 struct lock_ref;
 
+/** keep track of lock id in lock-verify application 
+ * Also defined in smallapp/worker_cb.c for fptr_wlist encapsulation 
+ * breakage (the security tests break encapsulation for this test app) */
+struct order_id {
+        /** the thread id that created it */
+        int thr;
+        /** the instance number of creation */
+        int instance;
+};
+
 /** a lock */
 struct order_lock {
 	/** rbnode in all tree */

testcode/memstats.c

@@ -43,7 +43,7 @@
 #include "util/log.h"
 #include "util/rbtree.h"
 #include "util/locks.h"
-#include "testcode/checklocks.h"
+#include "util/fptr_wlist.h"
 #include <sys/stat.h>
 
 /**

testcode/mini_tpkg.sh

@@ -18,14 +18,18 @@ if test "$1" = "fake"; then
 fi
 if test "$1" = "report" || test "$2" = "report"; then
 	echo "Minitpkg Report"
-	for result in result.*; do
-		name=`echo $result | sed -e 's/result\.//'`
+	for result in *.tpkg; do
+		name=`basename $result .tpkg`
 		if test -f ".done-$name"; then
 			if test "$1" != "-q"; then
 				echo "** PASSED ** : $name"
 			fi
 		else
-			echo "!! FAILED !! : $name"
+			if test -f "result.$name"; then
+				echo "!! FAILED !! : $name"
+			else
+				echo ">> SKIPPED<< : $name"
+			fi
 		fi
 	done
 	exit 0
@@ -56,7 +60,11 @@ dir=$name.$$
 result=result.$name
 done=.done-$name
 success="no"
-shell="bash"
+if test -x "`which bash`"; then
+	shell="bash"
+else
+	shell="sh"
+fi
 
 # check already done
 if test -f .done-$name; then
@@ -109,3 +117,10 @@ fi
 mv $result ..
 cd ..
 rm -rf $dir
+# compat for windows where deletion may not succeed initially (files locked
+# by processes that still have to exit).
+if test $? -eq 1; then
+	echo "minitpkg waiting for processes to terminate"
+	sleep 2 # some time to exit, and try again
+	rm -rf $dir
+fi

testcode/perf.c

@@ -0,0 +1,646 @@
+/*
+ * testcode/perf.c - debug program to estimate name server performance.
+ *
+ * Copyright (c) 2008, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This program estimates DNS name server performance.
+ */
+
+#include "config.h"
+#include <signal.h>
+#include "util/log.h"
+#include "util/locks.h"
+#include "util/net_help.h"
+#include "util/data/msgencode.h"
+#include "util/data/msgreply.h"
+#include "util/data/msgparse.h"
+
+/** usage information for perf */
+static void usage(char* nm) 
+{
+	printf("usage: %s [options] server\n", nm);
+	printf("server: ip address of server, IP4 or IP6.\n");
+	printf("	If not on port %d add @port.\n", UNBOUND_DNS_PORT);
+	printf("-d sec	duration of test in whole seconds (0: wait for ^C)\n");
+	printf("-a str	query to ask, interpreted as a line from qfile\n");
+	printf("-f fnm	query list to read from file\n");
+	printf("	every line has format: qname qclass qtype [+-]{E}\n");
+	printf("	where + means RD set, E means EDNS enabled\n");
+	printf("-q 	quiet mode, print only final qps\n");
+	exit(1);
+}
+
+struct perfinfo;
+struct perfio;
+
+/** Global info for perf */
+struct perfinfo { 
+	/** need to exit */
+	volatile int exit;
+	/** all purpose buffer (for UDP send and receive) */
+	ldns_buffer* buf;
+
+	/** destination */
+	struct sockaddr_storage dest;
+	/** length of dest socket addr */
+	socklen_t destlen;
+
+	/** when did this time slice start */
+	struct timeval since;
+	/** number of queries received in that time */
+	size_t numrecv;
+	/** number of queries sent out in that time */
+	size_t numsent;
+
+	/** duration of test in seconds */
+	int duration;
+	/** quiet mode? */
+	int quiet;
+
+	/** when did the total test start */
+	struct timeval start;
+	/** total number recvd */
+	size_t total_recv;
+	/** total number sent */
+	size_t total_sent;
+	/** numbers by rcode */
+	size_t by_rcode[32];
+	
+	/** number of I/O ports */
+	size_t io_num;
+	/** I/O ports array */
+	struct perfio* io;
+	/** max fd value in io ports */
+	int maxfd;
+	/** readset */
+	fd_set rset;
+
+	/** size of querylist */
+	size_t qlist_size;
+	/** allocated size of qlist array */
+	size_t qlist_capacity;
+	/** list of query packets (data) */
+	uint8_t** qlist_data;
+	/** list of query packets (length of a packet) */
+	size_t* qlist_len;
+	/** index into querylist, for walking the list */
+	size_t qlist_idx;
+};
+
+/** I/O port for perf */
+struct perfio {
+	/** id number */
+	size_t id;
+	/** file descriptor of socket */
+	int fd;
+	/** timeout value */
+	struct timeval timeout;
+	/** ptr back to perfinfo */
+	struct perfinfo* info;
+};
+
+/** number of msec between starting io ports */
+#define START_IO_INTERVAL 10
+/** number of msec timeout on io ports */
+#define IO_TIMEOUT 10
+
+/** signal handler global info */
+static struct perfinfo* sig_info;
+
+/** signal handler for user quit */
+static RETSIGTYPE perf_sigh(int sig)
+{
+	log_assert(sig_info);
+	if(!sig_info->quiet)
+		printf("exit on signal %d\n", sig);
+	sig_info->exit = 1;
+}
+
+/** timeval compare, t1 < t2 */
+static int
+perf_tv_smaller(struct timeval* t1, struct timeval* t2) 
+{
+#ifndef S_SPLINT_S
+	if(t1->tv_sec < t2->tv_sec)
+		return 1;
+	if(t1->tv_sec == t2->tv_sec &&
+		t1->tv_usec < t2->tv_usec)
+		return 1;
+#endif
+	return 0;
+}
+
+/** timeval add, t1 += t2 */
+static void
+perf_tv_add(struct timeval* t1, struct timeval* t2) 
+{
+#ifndef S_SPLINT_S
+	t1->tv_sec += t2->tv_sec;
+	t1->tv_usec += t2->tv_usec;
+	while(t1->tv_usec > 1000000) {
+		t1->tv_usec -= 1000000;
+		t1->tv_sec++;
+	}
+#endif
+}
+
+/** timeval subtract, t1 -= t2 */
+static void
+perf_tv_subtract(struct timeval* t1, struct timeval* t2) 
+{
+#ifndef S_SPLINT_S
+	t1->tv_sec -= t2->tv_sec;
+	if(t1->tv_usec >= t2->tv_usec) {
+		t1->tv_usec -= t2->tv_usec;
+	} else {
+		t1->tv_sec--;
+		t1->tv_usec = 1000000-(t2->tv_usec-t1->tv_usec);
+	}
+#endif
+}
+
+
+/** setup perf test environment */
+static void
+perfsetup(struct perfinfo* info)
+{
+	size_t i;
+	if(gettimeofday(&info->start, NULL) < 0)
+		fatal_exit("gettimeofday: %s", strerror(errno));
+	sig_info = info;
+	if( signal(SIGINT, perf_sigh) == SIG_ERR || 
+#ifdef SIGQUIT
+		signal(SIGQUIT, perf_sigh) == SIG_ERR ||
+#endif
+#ifdef SIGHUP
+		signal(SIGHUP, perf_sigh) == SIG_ERR ||
+#endif
+#ifdef SIGBREAK
+		signal(SIGBREAK, perf_sigh) == SIG_ERR ||
+#endif
+		signal(SIGTERM, perf_sigh) == SIG_ERR)
+		fatal_exit("could not bind to signal");
+	info->io = (struct perfio*)calloc(sizeof(struct perfio), info->io_num);
+	if(!info->io) fatal_exit("out of memory");
+#ifndef S_SPLINT_S
+	FD_ZERO(&info->rset);
+#endif
+	info->since = info->start;
+	for(i=0; i<info->io_num; i++) {
+		info->io[i].id = i;
+		info->io[i].info = info;
+		info->io[i].fd = socket(
+			addr_is_ip6(&info->dest, info->destlen)?
+			AF_INET6:AF_INET, SOCK_DGRAM, 0);
+		if(info->io[i].fd == -1) {
+#ifndef USE_WINSOCK
+			fatal_exit("socket: %s", strerror(errno));
+#else
+			fatal_exit("socket: %s", 
+				wsa_strerror(WSAGetLastError()));
+#endif
+		}
+		if(info->io[i].fd > info->maxfd)
+			info->maxfd = info->io[i].fd;
+#ifndef S_SPLINT_S
+		FD_SET(FD_SET_T info->io[i].fd, &info->rset);
+		info->io[i].timeout.tv_usec = ((START_IO_INTERVAL*i)%1000)
+						*1000;
+		info->io[i].timeout.tv_sec = (START_IO_INTERVAL*i)/1000;
+		perf_tv_add(&info->io[i].timeout, &info->since);
+#endif
+	}
+}
+
+/** cleanup perf test environment */
+static void
+perffree(struct perfinfo* info)
+{
+	size_t i;
+	if(!info) return;
+	if(info->io) {
+		for(i=0; i<info->io_num; i++) {
+			close(info->io[i].fd);
+		}
+		free(info->io);
+	}
+	for(i=0; i<info->qlist_size; i++)
+		free(info->qlist_data[i]);
+	free(info->qlist_data);
+	free(info->qlist_len);
+}
+
+/** send new query for io */
+static void
+perfsend(struct perfinfo* info, size_t n, struct timeval* now)
+{
+	ssize_t r;
+	r = sendto(info->io[n].fd, info->qlist_data[info->qlist_idx],
+		info->qlist_len[info->qlist_idx], 0,
+		(struct sockaddr*)&info->dest, info->destlen);
+	/*log_hex("send", info->qlist_data[info->qlist_idx],
+		info->qlist_len[info->qlist_idx]);*/
+	if(r == -1) {
+#ifndef USE_WINSOCK
+		log_err("sendto: %s", strerror(errno));
+#else
+		log_err("sendto: %s", wsa_strerror(WSAGetLastError()));
+#endif
+	} else if(r != (ssize_t)info->qlist_len[info->qlist_idx]) {
+		log_err("partial sendto");
+	}
+	info->qlist_idx = (info->qlist_idx+1) % info->qlist_size;
+	info->numsent++;
+
+	info->io[n].timeout.tv_sec = IO_TIMEOUT/1000;
+	info->io[n].timeout.tv_usec = (IO_TIMEOUT%1000)*1000;
+	perf_tv_add(&info->io[n].timeout, now);
+}
+
+/** got reply for io */
+static void
+perfreply(struct perfinfo* info, size_t n, struct timeval* now)
+{
+	ssize_t r;
+	r = recv(info->io[n].fd, ldns_buffer_begin(info->buf),
+		ldns_buffer_capacity(info->buf), 0);
+	if(r == -1) {
+#ifndef USE_WINSOCK
+		log_err("recv: %s", strerror(errno));
+#else
+		log_err("recv: %s", wsa_strerror(WSAGetLastError()));
+#endif
+	} else {
+		info->by_rcode[LDNS_RCODE_WIRE(ldns_buffer_begin(
+			info->buf))]++;
+		info->numrecv++;
+	}
+	/*ldns_buffer_set_limit(info->buf, r);
+	log_buf(0, "reply", info->buf);*/
+	perfsend(info, n, now);
+}
+
+/** got timeout for io */
+static void
+perftimeout(struct perfinfo* info, size_t n, struct timeval* now)
+{
+	/* may not be a dropped packet, this is also used to start
+	 * up the sending IOs */
+	perfsend(info, n, now);
+}
+
+/** print nice stats about qps */
+static void
+stat_printout(struct perfinfo* info, struct timeval* now, 
+	struct timeval* elapsed)
+{
+	/* calculate qps */
+	double dt, qps = 0;
+#ifndef S_SPLINT_S
+	dt = (double)(elapsed->tv_sec*1000000 + elapsed->tv_usec) / 1000000;
+#endif
+	if(dt > 0.001)
+		qps = (double)(info->numrecv) / dt;
+	if(!info->quiet)
+		printf("qps: %g\n", qps);
+	/* setup next slice */
+	info->since = *now;
+	info->total_sent += info->numsent;
+	info->total_recv += info->numrecv;
+	info->numrecv = 0;
+	info->numsent = 0;
+}
+
+/** wait for new events for performance test */
+static void
+perfselect(struct perfinfo* info)
+{
+	fd_set rset = info->rset;
+	struct timeval timeout, now;
+	int num;
+	size_t i;
+	if(gettimeofday(&now, NULL) < 0)
+		fatal_exit("gettimeofday: %s", strerror(errno));
+	/* time to exit? */
+	if(info->duration > 0) {
+		timeout = now;
+		perf_tv_subtract(&timeout, &info->start);
+		if((int)timeout.tv_sec >= info->duration) {
+			info->exit = 1;
+			return;
+		}
+	}
+	/* time for stats printout? */
+	timeout = now;
+	perf_tv_subtract(&timeout, &info->since);
+	if(timeout.tv_sec > 0) {
+		stat_printout(info, &now, &timeout);
+	}
+	/* see what is closest port to timeout; or if there is a timeout */
+	timeout = info->io[0].timeout;
+	for(i=0; i<info->io_num; i++) {
+		if(perf_tv_smaller(&info->io[i].timeout, &now)) {
+			perftimeout(info, i, &now);
+			return;
+		}
+		if(perf_tv_smaller(&info->io[i].timeout, &timeout)) {
+			timeout = info->io[i].timeout;
+		}
+	}
+	perf_tv_subtract(&timeout, &now);
+	
+	num = select(info->maxfd+1, &rset, NULL, NULL, &timeout);
+	if(num == -1) {
+		if(errno == EAGAIN || errno == EINTR)
+			return;
+		log_err("select: %s", strerror(errno));
+	}
+
+	/* handle new events */
+	for(i=0; num && i<info->io_num; i++) {
+		if(FD_ISSET(info->io[i].fd, &rset)) {
+			perfreply(info, i, &now);
+			num--;
+		}
+	}
+}
+
+/** show end stats */
+static void
+perfendstats(struct perfinfo* info)
+{
+	double dt, qps;
+	struct timeval timeout, now;
+	int i, lost; 
+	if(gettimeofday(&now, NULL) < 0)
+		fatal_exit("gettimeofday: %s", strerror(errno));
+	timeout = now;
+	perf_tv_subtract(&timeout, &info->since);
+	stat_printout(info, &now, &timeout);
+	
+	timeout = now;
+	perf_tv_subtract(&timeout, &info->start);
+	dt = (double)(timeout.tv_sec*1000000 + timeout.tv_usec) / 1000000.0;
+	qps = (double)(info->total_recv) / dt;
+	lost = (int)(info->total_sent - info->total_recv) - (int)info->io_num;
+	if(!info->quiet) {
+		printf("overall time: 	%g sec\n", 
+			(double)timeout.tv_sec + 
+			(double)timeout.tv_usec/1000000.);
+		if(lost > 0) 
+			printf("Packets lost: 	%d\n", (int)lost);
+	
+		for(i=0; i<(int)(sizeof(info->by_rcode)/sizeof(size_t)); i++)
+		{
+			if(info->by_rcode[i] > 0) {
+				printf("%d(%5s): 	%u replies\n",
+					i, ldns_lookup_by_id(ldns_rcodes, i)?
+					ldns_lookup_by_id(ldns_rcodes, 
+					i)->name:"??", 
+					(unsigned)info->by_rcode[i]);
+			}
+		}
+	}
+	printf("average qps: 	%g\n", qps);
+}
+
+/** perform the performance test */
+static void
+perfmain(struct perfinfo* info)
+{
+	perfsetup(info);
+	while(!info->exit) {
+		perfselect(info);
+	}
+	perfendstats(info);
+	perffree(info);
+}
+
+/** parse a query line to a packet into buffer */
+static int
+qlist_parse_line(ldns_buffer* buf, char* p)
+{
+	char nm[1024], cl[1024], tp[1024], fl[1024];
+	int r; 
+	int rec = 1, edns = 0;
+	struct query_info qinfo;
+	ldns_rdf* rdf;
+	nm[0] = 0; cl[0] = 0; tp[0] = 0; fl[0] = 0;
+	r = sscanf(p, " %1023s %1023s %1023s %1023s", nm, cl, tp, fl);
+	if(r != 3 && r != 4)
+		return 0;
+	/*printf("nm='%s', cl='%s', tp='%s', fl='%s'\n", nm, cl, tp, fl);*/
+	if(strcmp(tp, "IN") == 0 || strcmp(tp, "CH") == 0) {
+		qinfo.qtype = ldns_get_rr_type_by_name(cl);
+		qinfo.qclass = ldns_get_rr_class_by_name(tp);
+	} else {
+		qinfo.qtype = ldns_get_rr_type_by_name(tp);
+		qinfo.qclass = ldns_get_rr_class_by_name(cl);
+	}
+	if(fl[0] == '+') rec = 1;
+	else if(fl[0] == '-') rec = 0;
+	else if(fl[0] == 'E') edns = 1;
+	if((fl[0] == '+' || fl[0] == '-') && fl[1] == 'E')
+		edns = 1;
+	rdf = ldns_dname_new_frm_str(nm);
+	if(!rdf)
+		return 0;
+	qinfo.qname = ldns_rdf_data(rdf);
+	qinfo.qname_len = ldns_rdf_size(rdf);
+	qinfo_query_encode(buf, &qinfo);
+	ldns_buffer_write_u16_at(buf, 0, 0); /* zero ID */
+	if(rec) LDNS_RD_SET(ldns_buffer_begin(buf));
+	if(edns) {
+		struct edns_data edns;
+		memset(&edns, 0, sizeof(edns));
+		edns.edns_present = 1;
+		edns.udp_size = EDNS_ADVERTISED_SIZE;
+		/* Set DO bit in all EDNS datagrams ... */
+		edns.bits = EDNS_DO;
+		attach_edns_record(buf, &edns);
+	}
+	ldns_rdf_deep_free(rdf);
+	return 1;
+}
+
+/** grow query list capacity */
+static void
+qlist_grow_capacity(struct perfinfo* info)
+{
+	size_t newcap = (size_t)((info->qlist_capacity==0)?16:
+		info->qlist_capacity*2);
+	uint8_t** d = (uint8_t**)calloc(sizeof(uint8_t*), newcap);
+	size_t* l = (size_t*)calloc(sizeof(size_t), newcap);
+	if(!d || !l) fatal_exit("out of memory");
+	memcpy(d, info->qlist_data, sizeof(uint8_t*)*
+		info->qlist_capacity);
+	memcpy(l, info->qlist_len, sizeof(size_t)*
+		info->qlist_capacity);
+	free(info->qlist_data);
+	free(info->qlist_len);
+	info->qlist_data = d;
+	info->qlist_len = l;
+	info->qlist_capacity = newcap;
+}
+
+/** setup query list in info */
+static void
+qlist_add_line(struct perfinfo* info, char* line, int no)
+{
+	if(!qlist_parse_line(info->buf, line)) {
+		printf("error parsing query %d: %s\n", no, line);
+		exit(1);
+	}
+	ldns_buffer_write_u16_at(info->buf, 0, (uint16_t)info->qlist_size); 
+	if(info->qlist_size + 1 > info->qlist_capacity) {
+		qlist_grow_capacity(info);
+	}
+	info->qlist_len[info->qlist_size] = ldns_buffer_limit(info->buf);
+	info->qlist_data[info->qlist_size] = memdup(
+		ldns_buffer_begin(info->buf), ldns_buffer_limit(info->buf));
+	if(!info->qlist_data[info->qlist_size])
+		fatal_exit("out of memory");
+	info->qlist_size ++;
+}
+
+/** setup query list in info */
+static void
+qlist_read_file(struct perfinfo* info, char* fname)
+{
+	char buf[1024];
+	char *p;
+	FILE* in = fopen(fname, "r");
+	int lineno = 0;
+	if(!in) {
+		perror(fname);
+		exit(1);
+	}
+	while(fgets(buf, (int)sizeof(buf), in)) {
+		lineno++;
+		buf[sizeof(buf)-1] = 0;
+		p = buf;
+		while(*p == ' ' || *p == '\t')
+			p++;
+		if(p[0] == 0 || p[0] == '\n' || p[0] == ';' || p[0] == '#')
+			continue;
+		qlist_add_line(info, p, lineno);
+	}
+	printf("Read %s, got %u queries\n", fname, (unsigned)info->qlist_size);
+	fclose(in);
+}
+
+/** getopt global, in case header files fail to declare it. */
+extern int optind;
+/** getopt global, in case header files fail to declare it. */
+extern char* optarg;
+
+/** main program for perf */
+int main(int argc, char* argv[]) 
+{
+	char* nm = argv[0];
+	int c;
+	struct perfinfo info;
+#ifdef USE_WINSOCK
+	int r;
+	WSADATA wsa_data;
+#endif
+
+	/* defaults */
+	memset(&info, 0, sizeof(info));
+	info.io_num = 16;
+
+	log_init(NULL, 0, NULL);
+	log_ident_set("perf");
+	checklock_start();
+#ifdef USE_WINSOCK
+	if((r = WSAStartup(MAKEWORD(2,2), &wsa_data)) != 0)
+		fatal_exit("WSAStartup failed: %s", wsa_strerror(r));
+#endif
+
+	info.buf = ldns_buffer_new(65553);
+	if(!info.buf) fatal_exit("out of memory");
+
+	/* parse the options */
+	while( (c=getopt(argc, argv, "d:ha:f:q")) != -1) {
+		switch(c) {
+		case 'q':
+			info.quiet = 1;
+			break;
+		case 'd':
+			if(atoi(optarg)==0 && strcmp(optarg, "0")!=0) {
+				printf("-d not a number %s", optarg);
+				return 1;
+			}
+			info.duration = atoi(optarg);
+			break;
+		case 'a':
+			qlist_add_line(&info, optarg, 0);
+			break;
+		case 'f':
+			qlist_read_file(&info, optarg);
+			break;
+		case '?':
+		case 'h':
+		default:
+			usage(nm);
+		}
+	}
+	argc -= optind;
+	argv += optind;
+
+	if(argc != 1) {
+		printf("error: pass server IP address on commandline.\n");
+		usage(nm);
+	}
+	if(!extstrtoaddr(argv[0], &info.dest, &info.destlen)) {
+		printf("Could not parse ip: %s\n", argv[0]);
+		return 1;
+	}
+	if(info.qlist_size == 0) {
+		printf("No queries to make, use -f or -a.\n");
+		return 1;
+	}
+	
+	/* do the performance test */
+	perfmain(&info);
+
+	ldns_buffer_free(info.buf);
+#ifdef USE_WINSOCK
+	WSACleanup();
+#endif
+	checklock_stop();
+	return 0;
+}

testcode/readhex.c

@@ -58,7 +58,7 @@ skip_whites(const char** p)
 	}
 }
 
-/** takes a hex string and puts into buffer */
+/* takes a hex string and puts into buffer */
 void hex_to_buf(ldns_buffer* pkt, const char* hex)
 {
 	const char* p = hex;

testcode/readhex.h

@@ -41,7 +41,11 @@
 #ifndef TESTCODE_READHEX_H
 #define TESTCODE_READHEX_H
 
-/** helper to convert hex string to packet buffer */
+/** 
+ * Helper to convert hex string to packet buffer.
+ * @param pkt: buffer to put result in.
+ * @param hex: string of hex data. Spaces and ';...' comments are skipped.
+ */
 void hex_to_buf(ldns_buffer* pkt, const char* hex);
 
 #endif /* TESTCODE_READHEX_H */

testcode/replay.c

@@ -235,7 +235,6 @@ replay_moment_read(char* remain, FILE* in, const char* name, int* lineno,
 			remain++;
 		if(strlen(remain) > 0) /* remove \n */
 			remain[strlen(remain)-1] = 0;
-		printf("remain '%s'\n", remain);
 		if(!extstrtoaddr(remain, &mom->addr, &mom->addrlen)) {
 			log_err("line %d: could not parse ADDRESS: %s", 
 				*lineno, remain);

testcode/replay.h

@@ -155,7 +155,9 @@ struct replay_moment {
 		repevt_back_query,
 		/** an error happens to outbound query */
 		repevt_error
-	} evt_type;
+	} 
+		/** variable with what is to happen this moment */
+		evt_type;
 
 	/** The sent packet must match this. Incoming events, the data. */
 	struct entry* match;
@@ -224,6 +226,11 @@ struct replay_runtime {
 	/** user argument for incoming query callback */
 	void *cb_arg;
 
+	/** the current time in seconds */
+	uint32_t now_secs;
+	/** the current time in microseconds */
+	struct timeval now_tv;
+
 	/** signal handler callback */
 	void (*sig_cb)(int, void*);
 	/** signal handler user arg */

testcode/streamtcp.c

@@ -0,0 +1,311 @@
+/*
+ * testcode/streamtcp.c - debug program perform multiple DNS queries on tcp.
+ *
+ * Copyright (c) 2008, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This program performs multiple DNS queries on a TCP stream.
+ */
+
+#include "config.h"
+#include <signal.h>
+#include "util/locks.h"
+#include "util/log.h"
+#include "util/net_help.h"
+#include "util/data/msgencode.h"
+#include "util/data/msgreply.h"
+#include "util/data/dname.h"
+
+/** usage information for streamtcp */
+void usage(char* argv[])
+{
+	printf("usage: %s [options] name type class ...\n", argv[0]);
+	printf("	sends the name-type-class queries over TCP.\n");
+	printf("-f server	what ipaddr@portnr to send the queries to\n");
+	printf("-u 		use UDP. No retries are attempted.\n");
+	printf("-n 		do not wait for an answer.\n");
+	printf("-h 		this help text\n");
+	exit(1);
+}
+
+/** open TCP socket to svr */
+static int
+open_svr(char* svr, int udp)
+{
+	struct sockaddr_storage addr;
+	socklen_t addrlen;
+	int fd = -1;
+	/* svr can be ip@port */
+	if(!extstrtoaddr(svr, &addr, &addrlen)) {
+		printf("fatal: bad server specs '%s'\n", svr);
+		exit(1);
+	}
+	fd = socket(addr_is_ip6(&addr, addrlen)?PF_INET6:PF_INET,
+		udp?SOCK_DGRAM:SOCK_STREAM, 0);
+	if(fd == -1) {
+#ifndef USE_WINSOCK
+		perror("socket() error");
+#else
+		printf("socket: %s\n", wsa_strerror(WSAGetLastError()));
+#endif
+		exit(1);
+	}
+	if(connect(fd, (struct sockaddr*)&addr, addrlen) < 0) {
+#ifndef USE_WINSOCK
+		perror("connect() error");
+#else
+		printf("connect: %s\n", wsa_strerror(WSAGetLastError()));
+#endif
+		exit(1);
+	}
+	return fd;
+}
+
+/** write a query over the TCP fd */
+static void
+write_q(int fd, int udp, ldns_buffer* buf, int id, 
+	char* strname, char* strtype, char* strclass)
+{
+	struct query_info qinfo;
+	ldns_rdf* rdf;
+	int labs;
+	uint16_t len;
+	/* qname */
+	rdf = ldns_dname_new_frm_str(strname);
+	if(!rdf) {
+		printf("cannot parse query name: '%s'\n", strname);
+		exit(1);
+	}
+	qinfo.qname = memdup(ldns_rdf_data(rdf), ldns_rdf_size(rdf));
+	labs = dname_count_size_labels(qinfo.qname, &qinfo.qname_len);
+	ldns_rdf_deep_free(rdf);
+	if(!qinfo.qname) fatal_exit("out of memory");
+
+	/* qtype and qclass */
+	qinfo.qtype = ldns_get_rr_type_by_name(strtype);
+	qinfo.qclass = ldns_get_rr_class_by_name(strclass);
+
+	/* make query */
+	qinfo_query_encode(buf, &qinfo);
+	ldns_buffer_write_u16_at(buf, 0, (uint16_t)id);
+	ldns_buffer_write_u16_at(buf, 2, BIT_RD);
+
+	/* send it */
+	if(!udp) {
+		len = (uint16_t)ldns_buffer_limit(buf);
+		len = htons(len);
+		if(send(fd, (void*)&len, sizeof(len), 0)<(ssize_t)sizeof(len)){
+#ifndef USE_WINSOCK
+			perror("send() len failed");
+#else
+			printf("send len: %s\n", 
+				wsa_strerror(WSAGetLastError()));
+#endif
+			exit(1);
+		}
+	}
+	if(send(fd, ldns_buffer_begin(buf), ldns_buffer_limit(buf), 0) < 
+		(ssize_t)ldns_buffer_limit(buf)) {
+#ifndef USE_WINSOCK
+		perror("send() data failed");
+#else
+		printf("send data: %s\n", wsa_strerror(WSAGetLastError()));
+#endif
+		exit(1);
+	}
+
+	free(qinfo.qname);
+}
+
+/** receive DNS datagram over TCP and print it */
+static void
+recv_one(int fd, int udp, ldns_buffer* buf)
+{
+	uint16_t len;
+	ldns_pkt* pkt;
+	ldns_status status;
+	if(!udp) {
+		if(recv(fd, (void*)&len, sizeof(len), 0)<(ssize_t)sizeof(len)){
+#ifndef USE_WINSOCK
+			perror("read() len failed");
+#else
+			printf("read len: %s\n", 
+				wsa_strerror(WSAGetLastError()));
+#endif
+			exit(1);
+		}
+		len = ntohs(len);
+		ldns_buffer_clear(buf);
+		ldns_buffer_set_limit(buf, len);
+		if(recv(fd, ldns_buffer_begin(buf), len, 0) < (ssize_t)len) {
+#ifndef USE_WINSOCK
+			perror("read() data failed");
+#else
+			printf("read data: %s\n", 
+				wsa_strerror(WSAGetLastError()));
+#endif
+			exit(1);
+		}
+	} else {
+		ssize_t l;
+		ldns_buffer_clear(buf);
+		if((l=recv(fd, ldns_buffer_begin(buf), 
+			ldns_buffer_capacity(buf), 0)) < 0) {
+#ifndef USE_WINSOCK
+			perror("read() data failed");
+#else
+			printf("read data: %s\n", 
+				wsa_strerror(WSAGetLastError()));
+#endif
+			exit(1);
+		}
+		ldns_buffer_set_limit(buf, (size_t)l);
+		len = (size_t)l;
+	}
+	printf("\nnext received packet\n");
+	log_buf(0, "data", buf);
+
+	status = ldns_wire2pkt(&pkt, ldns_buffer_begin(buf), len);
+	if(status != LDNS_STATUS_OK) {
+		printf("could not parse incoming packet: %s\n",
+			ldns_get_errorstr_by_id(status));
+		log_buf(0, "data was", buf);
+		exit(1);
+	}
+	ldns_pkt_print(stdout, pkt);
+	ldns_pkt_free(pkt);
+}
+
+/** send the TCP queries and print answers */
+static void
+send_em(char* svr, int udp, int noanswer, int num, char** qs)
+{
+	ldns_buffer* buf = ldns_buffer_new(65553);
+	int fd = open_svr(svr, udp);
+	int i;
+	if(!buf) fatal_exit("out of memory");
+	for(i=0; i<num; i+=3) {
+		printf("\nNext query is %s %s %s\n", qs[i], qs[i+1], qs[i+2]);
+		write_q(fd, udp, buf, i, qs[i], qs[i+1], qs[i+2]);
+		/* print at least one result */
+		if(!noanswer)
+			recv_one(fd, udp, buf);
+	}
+
+	close(fd);
+	ldns_buffer_free(buf);
+	printf("orderly exit\n");
+}
+
+#ifdef SIGPIPE
+/** SIGPIPE handler */
+static RETSIGTYPE sigh(int sig)
+{
+	if(sig == SIGPIPE) {
+		printf("got SIGPIPE, remote connection gone\n");
+		exit(1);
+	}
+	printf("Got unhandled signal %d\n", sig);
+	exit(1);
+}
+#endif /* SIGPIPE */
+
+/** getopt global, in case header files fail to declare it. */
+extern int optind;
+/** getopt global, in case header files fail to declare it. */
+extern char* optarg;
+
+/** main program for streamtcp */
+int main(int argc, char** argv) 
+{
+	int c;
+	char* svr = "127.0.0.1";
+	int udp = 0;
+	int noanswer = 0;
+
+#ifdef USE_WINSOCK
+	WSADATA wsa_data;
+	if(WSAStartup(MAKEWORD(2,2), &wsa_data) != 0) {
+		printf("WSAStartup failed\n");
+		return 1;
+	}
+#endif
+
+	/* lock debug start (if any) */
+	log_init(0, 0, 0);
+	checklock_start();
+
+#ifdef SIGPIPE
+	if(signal(SIGPIPE, &sigh) == SIG_ERR) {
+		perror("could not install signal handler");
+		return 1;
+	}
+#endif
+
+	/* command line options */
+	if(argc == 1) {
+		usage(argv);
+	}
+	while( (c=getopt(argc, argv, "f:hnu")) != -1) {
+		switch(c) {
+			case 'f':
+				svr = optarg;
+				break;
+			case 'n':
+				noanswer = 1;
+				break;
+			case 'u':
+				udp = 1;
+				break;
+			case 'h':
+			case '?':
+			default:
+				usage(argv);
+		}
+	}
+	argc -= optind;
+	argv += optind;
+
+	if(argc % 3 != 0) {
+		printf("queries must be multiples of name,type,class\n");
+		return 1;
+	}
+	send_em(svr, udp, noanswer, argc, argv);
+	checklock_stop();
+#ifdef USE_WINSOCK
+	WSACleanup();
+#endif
+	return 0;
+}

testcode/testbound.c

@@ -127,8 +127,13 @@ setup_config(FILE* in, char* configfile, int* lineno,
 	char line[MAX_LINE_LEN];
 	char* parse;
 	FILE* cfg;
+#ifdef USE_WINSOCK
+	snprintf(configfile, MAX_LINE_LEN, "testbound_cfg_%u.tmp", 
+		(unsigned)getpid());
+#else
 	snprintf(configfile, MAX_LINE_LEN, "/tmp/testbound_cfg_%u.tmp", 
 		(unsigned)getpid());
+#endif
 	add_opts("-c", pass_argc, pass_argv);
 	add_opts(configfile, pass_argc, pass_argv);
 	cfg = fopen(configfile, "w");
@@ -172,7 +177,7 @@ setup_playback(const char* filename, char* configfile,
 	int lineno = 0;
 
 	if(filename) {
-		FILE *in = fopen(filename, "r");
+		FILE *in = fopen(filename, "rb");
 		if(!in) {
 			perror(filename);
 			exit(1);