tarball update.

git-svn-id: file:///svn/unbound/trunk@1010 be551aaa-1e26-0410-a405-d3ace91eadb9

Makefile.in

@@ -22,6 +22,7 @@ srcdir=@srcdir@
 prefix=@prefix@
 exec_prefix=@exec_prefix@
 bindir=@bindir@
+sbindir=@sbindir@
 mandir=@mandir@
 libdir=@libdir@
 # datarootdir is here to please some checkers, use datadir.
@@ -94,13 +95,20 @@ ASYNCLOOK_SRC=testcode/asynclook.c
 ASYNCLOOK_OBJ=$(addprefix $(BUILD),$(ASYNCLOOK_SRC:.c=.o)) $(COMPAT_OBJ)
 STREAMTCP_SRC=testcode/streamtcp.c smallapp/worker_cb.c $(COMMON_SRC)
 STREAMTCP_OBJ=$(addprefix $(BUILD),$(STREAMTCP_SRC:.c=.o)) $(COMPAT_OBJ)
+PERF_SRC=testcode/perf.c smallapp/worker_cb.c $(COMMON_SRC)
+PERF_OBJ=$(addprefix $(BUILD),$(PERF_SRC:.c=.o)) $(COMPAT_OBJ)
+DELAYER_SRC=testcode/delayer.c smallapp/worker_cb.c $(COMMON_SRC)
+DELAYER_OBJ=$(addprefix $(BUILD),$(DELAYER_SRC:.c=.o)) $(COMPAT_OBJ)
+HARVEST_SRC=testcode/harvest.c
+HARVEST_OBJ=$(addprefix $(BUILD),$(HARVEST_SRC:.c=.o)) $(COMPAT_OBJ)
 LIBUNBOUND_SRC=$(patsubst $(srcdir)/%,%, \
 	$(wildcard $(srcdir)/libunbound/*.c) $(COMMON_SRC))
 LIBUNBOUND_OBJ=$(addprefix $(BUILD),$(LIBUNBOUND_SRC:.c=.o)) $(COMPAT_OBJ)
 ALL_SRC=$(sort $(COMMON_SRC) $(UNITTEST_SRC) $(DAEMON_SRC) \
 	$(TESTBOUND_SRC) $(LOCKVERIFY_SRC) $(PKTVIEW_SRC) $(SIGNIT_SRC) \
 	$(MEMSTATS_SRC) $(CHECKCONF_SRC) $(LIBUNBOUND_SRC) $(HOST_SRC) \
-	$(ASYNCLOOK_SRC) $(STREAMTCP_SRC))
+	$(ASYNCLOOK_SRC) $(STREAMTCP_SRC) $(PERF_SRC) $(DELAYER_SRC) \
+	$(HARVEST_SRC) )
 ALL_OBJ=$(addprefix $(BUILD),$(ALL_SRC:.c=.o) \
 	$(addprefix compat/,$(LIBOBJS))) $(COMPAT_OBJ)
 
@@ -120,7 +128,7 @@ $(BUILD)%.o:    $(srcdir)/%.c
 all:	$(COMMON_OBJ) unbound unbound-checkconf lib unbound-host
 
 tests:	all unittest testbound lock-verify pktview signit memstats \
-	asynclook streamtcp
+	asynclook streamtcp perf delayer harvest
 
 test:	tests
 	bash testcode/do-tests.sh
@@ -184,6 +192,18 @@ streamtcp:	$(STREAMTCP_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(STREAMTCP_OBJ)) $(LIBS)
 
+perf:	$(PERF_OBJ) $(ldnslib)
+	$(INFO) Link $@
+	$Q$(LINK) -o $@ $(sort $(PERF_OBJ)) $(LIBS)
+
+delayer:	$(DELAYER_OBJ) $(ldnslib)
+	$(INFO) Link $@
+	$Q$(LINK) -o $@ $(sort $(DELAYER_OBJ)) $(LIBS)
+
+harvest:	$(HARVEST_OBJ) $(ldnslib) libunbound.la
+	$(INFO) Link $@
+	$Q$(LINK) -o $@ $(sort $(HARVEST_OBJ)) $(LIBS) -L. -L.libs -lunbound
+
 #testcode/ldns-testpkts.c:	$(ldnsdir)/examples/ldns-testpkts.c \
 #			$(ldnsdir)/examples/ldns-testpkts.h
 #	cp $(ldnsdir)/examples/ldns-testpkts.c testcode/ldns-testpkts.c
@@ -237,26 +257,31 @@ strip:
 	strip unbound-host
 
 install:
-	$(INSTALL) -m 755 -d $(bindir)
+	$(INSTALL) -m 755 -d $(sbindir)
 	$(INSTALL) -m 755 -d $(mandir)
 	$(INSTALL) -m 755 -d $(mandir)/man8
 	$(INSTALL) -m 755 -d $(mandir)/man5
+	$(INSTALL) -m 755 -d $(mandir)/man3
+	$(INSTALL) -m 755 -d $(mandir)/man1
 	$(INSTALL) -m 755 -d $(libdir)
 	$(INSTALL) -m 755 -d $(includedir)
-	$(LIBTOOL) --mode=install cp unbound $(bindir)/unbound
-	$(LIBTOOL) --mode=install cp unbound-checkconf $(bindir)/unbound-checkconf
-	$(LIBTOOL) --mode=install cp unbound-host $(bindir)/unbound-host
+	$(LIBTOOL) --mode=install cp unbound $(sbindir)/unbound
+	$(LIBTOOL) --mode=install cp unbound-checkconf $(sbindir)/unbound-checkconf
+	$(LIBTOOL) --mode=install cp unbound-host $(sbindir)/unbound-host
 	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound.8 $(mandir)/man8
 	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-checkconf.8 $(mandir)/man8
 	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound.conf.5 $(mandir)/man5
+	$(INSTALL) -c -m 644 $(srcdir)/doc/unbound-host.1 $(mandir)/man1
+	$(INSTALL) -c -m 644 $(srcdir)/doc/libunbound.3 $(mandir)/man3
 	if test ! -e $(configfile); then $(INSTALL) -d `dirname $(configfile)`; $(INSTALL) -c -m 644 $(srcdir)/doc/example.conf $(configfile); fi
 	$(LIBTOOL) --mode=install cp $(srcdir)/libunbound/unbound.h $(includedir)/unbound.h
 	$(LIBTOOL) --mode=install cp libunbound.la $(libdir)
 	$(LIBTOOL) --mode=finish $(libdir)
 
 uninstall:
-	rm -f -- $(bindir)/unbound $(bindir)/unbound-checkconf $(bindir)/unbound-host
+	rm -f -- $(sbindir)/unbound $(sbindir)/unbound-checkconf $(sbindir)/unbound-host
 	rm -f -- $(mandir)/man8/unbound.8 $(mandir)/man8/unbound-checkconf.8 $(mandir)/man5/unbound.conf.5
+	rm -f -- $(mandir)/man1/unbound-host.1 $(mandir)/man3/libunbound.3
 	rm -f -- $(includedir)/unbound.h
 	$(LIBTOOL) --mode=uninstall rm -f $(libdir)/libunbound.la
 	@echo

README

@@ -1,9 +1,9 @@
 Unbound README
 * ./configure && make && make install
 * on BSDs and Solaris use gmake (GNU make).
-* If it complains that no libevent can be found; libevent is useful when
-  using many (10000) outgoing ports. By default 16 ports are used and the
-  builtin alternative is equally capable.
+* You can use libevent if you want. libevent is useful when using 
+  many (10000) outgoing ports. By default 16 ports are used and the
+  builtin alternative is equally capable and a little faster.
 * More detailed README, README.svn, README.tests in doc directory
 * manual pages can be found in doc directory, and are installed, unbound(8).
 * example configuration file doc/example.conf

compat/snprintf.c

@@ -528,7 +528,7 @@ static long double abs_val (long double value)
   return result;
 }
 
-static long double pow10 (int exp)
+static long double compat_pow10 (int exp)
 {
   long double result = 1;
 
@@ -541,7 +541,7 @@ static long double pow10 (int exp)
   return result;
 }
 
-static long round (long double value)
+static long compat_round (long double value)
 {
   long intpart;
 
@@ -602,12 +602,12 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
   /* We "cheat" by converting the fractional part to integer by
    * multiplying by a factor of 10
    */
-  fracpart = round ((pow10 (max)) * (ufvalue - intpart));
+  fracpart = compat_round ((compat_pow10 (max)) * (ufvalue - intpart));
 
-  if (fracpart >= pow10 (max))
+  if (fracpart >= compat_pow10 (max))
   {
     intpart++;
-    fracpart -= pow10 (max);
+    fracpart -= compat_pow10 (max);
   }
 
 #ifdef DEBUG_SNPRINTF

config.h.in

@@ -1,5 +1,8 @@
 /* config.h.in.  Generated from configure.ac by autoheader.  */
 
+/* Directory to chroot to */
+#undef CHROOT_DIR
+
 /* Pathname to the Unbound configuration file */
 #undef CONFIGFILE
 
@@ -175,6 +178,9 @@
 /* Define to the version of this package. */
 #undef PACKAGE_VERSION
 
+/* Pathname to unbound process id file */
+#undef PIDFILE
+
 /* Define to necessary symbol if this constant uses a non-standard name on
    your system. */
 #undef PTHREAD_CREATE_JOINABLE
@@ -182,6 +188,9 @@
 /* Define as the return type of signal handlers (`int' or `void'). */
 #undef RETSIGTYPE
 
+/* Directory to chdir to */
+#undef RUN_DIR
+
 /* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS
 

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.61 for unbound 0.9.
+# Generated by GNU Autoconf 2.61 for unbound 0.10.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -724,8 +724,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='0.9'
-PACKAGE_STRING='unbound 0.9'
+PACKAGE_VERSION='0.10'
+PACKAGE_STRING='unbound 0.10'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 
 # Factoring default headers for most tests.
@@ -1359,7 +1359,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 0.9 to adapt to many kinds of systems.
+\`configure' configures unbound 0.10 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1424,7 +1424,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 0.9:";;
+     short | recursive ) echo "Configuration of unbound 0.10:";;
    esac
   cat <<\_ACEOF
 
@@ -1462,8 +1462,10 @@ Optional Packages:
                           disable threading support.
   --with-solaris-threads  use solaris native thread library.
   --with-libevent=pathname
-                          set path to libevent (will check /usr/local
-                          /opt/local /usr/lib /usr/pkg /usr/sfw /usr)
+                          use libevent (will check /usr/local /opt/local
+                          /usr/lib /usr/pkg /usr/sfw /usr or you can specify
+                          an explicit path). Slower, but allows use of large
+                          outgoing port ranges.
   --with-ldns=PATH        specify prefix of path of ldns library to use
 
 
@@ -1547,7 +1549,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 0.9
+unbound configure 0.10
 generated by GNU Autoconf 2.61
 
 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1561,7 +1563,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 0.9, which was
+It was created by unbound $as_me 0.10, which was
 generated by GNU Autoconf 2.61.  Invocation command line was
 
   $ $0 $@
@@ -3292,6 +3294,25 @@ cat >>confdefs.h <<_ACEOF
 _ACEOF
 
 
+# Determine run, chroot directory and pidfile locations
+ub_cfg=`eval echo $ub_conf_file`
+ub_dir=`dirname $ub_cfg`
+
+cat >>confdefs.h <<_ACEOF
+#define RUN_DIR "$ub_dir"
+_ACEOF
+
+
+cat >>confdefs.h <<_ACEOF
+#define CHROOT_DIR "$ub_dir"
+_ACEOF
+
+
+cat >>confdefs.h <<_ACEOF
+#define PIDFILE "$ub_dir/unbound.pid"
+_ACEOF
+
+
 
 
 # if the given code compiles without the flag, execute argument 4
@@ -5731,7 +5752,7 @@ ia64-*-hpux*)
   ;;
 *-*-irix6*)
   # Find out which ABI we are using.
-  echo '#line 5734 "configure"' > conftest.$ac_ext
+  echo '#line 5755 "configure"' > conftest.$ac_ext
   if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -7033,11 +7054,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7036: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7057: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:7040: \$? = $ac_status" >&5
+   echo "$as_me:7061: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -7301,11 +7322,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7304: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7325: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:7308: \$? = $ac_status" >&5
+   echo "$as_me:7329: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -7405,11 +7426,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:7408: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:7429: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:7412: \$? = $ac_status" >&5
+   echo "$as_me:7433: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -8870,7 +8891,7 @@ linux*)
   libsuff=
   case "$host_cpu" in
   x86_64*|s390x*|powerpc64*)
-    echo '#line 8873 "configure"' > conftest.$ac_ext
+    echo '#line 8894 "configure"' > conftest.$ac_ext
     if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -9734,7 +9755,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 9737 "configure"
+#line 9758 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -9834,7 +9855,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<EOF
-#line 9837 "configure"
+#line 9858 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -12170,11 +12191,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:12173: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:12194: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:12177: \$? = $ac_status" >&5
+   echo "$as_me:12198: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -12274,11 +12295,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:12277: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:12298: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:12281: \$? = $ac_status" >&5
+   echo "$as_me:12302: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -12810,7 +12831,7 @@ linux*)
   libsuff=
   case "$host_cpu" in
   x86_64*|s390x*|powerpc64*)
-    echo '#line 12813 "configure"' > conftest.$ac_ext
+    echo '#line 12834 "configure"' > conftest.$ac_ext
     if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -13865,11 +13886,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:13868: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:13889: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:13872: \$? = $ac_status" >&5
+   echo "$as_me:13893: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -13969,11 +13990,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:13972: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:13993: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:13976: \$? = $ac_status" >&5
+   echo "$as_me:13997: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -15414,7 +15435,7 @@ linux*)
   libsuff=
   case "$host_cpu" in
   x86_64*|s390x*|powerpc64*)
-    echo '#line 15417 "configure"' > conftest.$ac_ext
+    echo '#line 15438 "configure"' > conftest.$ac_ext
     if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -16188,11 +16209,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16191: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16212: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:16195: \$? = $ac_status" >&5
+   echo "$as_me:16216: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -16456,11 +16477,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16459: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16480: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:16463: \$? = $ac_status" >&5
+   echo "$as_me:16484: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -16560,11 +16581,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:16563: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:16584: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:16567: \$? = $ac_status" >&5
+   echo "$as_me:16588: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -18025,7 +18046,7 @@ linux*)
   libsuff=
   case "$host_cpu" in
   x86_64*|s390x*|powerpc64*)
-    echo '#line 18028 "configure"' > conftest.$ac_ext
+    echo '#line 18049 "configure"' > conftest.$ac_ext
     if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -21941,10 +21962,10 @@ fi
 if test "${with_libevent+set}" = set; then
   withval=$with_libevent;
 else
-   withval="yes"
+   withval="no"
 fi
 
-if test x_$withval != x_no; then
+if test x_$withval == x_yes -o x_$withval != x_no; then
         { echo "$as_me:$LINENO: checking for libevent" >&5
 echo $ECHO_N "checking for libevent... $ECHO_C" >&6; }
         if test x_$withval = x_ -o x_$withval = x_yes; then
@@ -21981,11 +22002,11 @@ echo "${ECHO_T}found in $thedir" >&6; }
             		{ { echo "$as_me:$LINENO: error: Cannot find the libevent library in $withval
 You can restart ./configure --with-libevent=no to use a builtin alternative.
 Please note that this alternative is not as capable as libevent when using
-many outgoing ports.  " >&5
+large outgoing port ranges.  " >&5
 echo "$as_me: error: Cannot find the libevent library in $withval
 You can restart ./configure --with-libevent=no to use a builtin alternative.
 Please note that this alternative is not as capable as libevent when using
-many outgoing ports.  " >&2;}
+large outgoing port ranges.  " >&2;}
    { (exit 1); exit 1; }; }
 		fi
         else
@@ -24743,8 +24764,8 @@ mkdir ldns-src; cp $srcdir/ldns-src.tar.gz ldns-src/ldns-src.tar.gz; (cd ldns-sr
 ldnsdir=`ls -d ldns-src/ldns*`
 { echo "$as_me:$LINENO: Configure $ldnsdir" >&5
 echo "$as_me: Configure $ldnsdir" >&6;}
-echo "(cd $ldnsdir; ./configure)"
-(cd $ldnsdir; ./configure)
+echo "(cd $ldnsdir && ./configure)"
+(cd $ldnsdir && ./configure)
 { echo "$as_me:$LINENO: Finished $ldnsdir configure" >&5
 echo "$as_me: Finished $ldnsdir configure" >&6;}
 CPPFLAGS="$CPPFLAGS -I$ldnsdir/include"
@@ -25192,7 +25213,7 @@ exec 6>&1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 0.9, which was
+This file was extended by unbound $as_me 0.10, which was
 generated by GNU Autoconf 2.61.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -25241,7 +25262,7 @@ Report bugs to <bug-autoconf@gnu.org>."
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF
 ac_cs_version="\\
-unbound config.status 0.9
+unbound config.status 0.10
 configured by $0, generated by GNU Autoconf 2.61,
   with options \\"`echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
 

configure.ac

@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 AC_PREREQ(2.57)
 
-AC_INIT(unbound, 0.9, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 0.10, unbound-bugs@nlnetlabs.nl, unbound)
 
 CFLAGS=
 AC_AIX
@@ -36,6 +36,13 @@ AC_SUBST(ub_conf_file)
 # for $nsd_conf_file and once for the ${prefix} within it.
 AC_DEFINE_UNQUOTED(CONFIGFILE, ["`eval echo $ub_conf_file`"], [Pathname to the Unbound configuration file])
 
+# Determine run, chroot directory and pidfile locations
+ub_cfg=`eval echo $ub_conf_file`
+ub_dir=`dirname $ub_cfg`
+AC_DEFINE_UNQUOTED(RUN_DIR, ["$ub_dir"], [Directory to chdir to])
+AC_DEFINE_UNQUOTED(CHROOT_DIR, ["$ub_dir"], [Directory to chroot to])
+AC_DEFINE_UNQUOTED(PIDFILE, ["$ub_dir/unbound.pid"], [Pathname to unbound process id file])
+
 dnl routine to help check for compiler flags.
 AC_DEFUN([CHECK_COMPILER_FLAG],
 [
@@ -506,9 +513,9 @@ AC_SEARCH_LIBS([clock_gettime], [rt])
 
 # check for libevent
 AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
-    [set path to libevent  (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr)]),
-    [ ],[ withval="yes" ])
-if test x_$withval != x_no; then
+    [use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr  or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
+    [ ],[ withval="no" ])
+if test x_$withval == x_yes -o x_$withval != x_no; then
         AC_MSG_CHECKING(for libevent)
         if test x_$withval = x_ -o x_$withval = x_yes; then
             withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
@@ -543,7 +550,7 @@ if test x_$withval != x_no; then
             		AC_MSG_ERROR([Cannot find the libevent library in $withval
 You can restart ./configure --with-libevent=no to use a builtin alternative.
 Please note that this alternative is not as capable as libevent when using
-many outgoing ports.  ])
+large outgoing port ranges.  ])
 		fi
         else
             AC_MSG_RESULT(found in $thedir)
@@ -639,8 +646,8 @@ if test -d ldns-src; then rm -rf ldns-src; fi
 mkdir ldns-src; cp $srcdir/ldns-src.tar.gz ldns-src/ldns-src.tar.gz; (cd ldns-src; gzip -cd ldns-src.tar.gz | tar xf -); rm -f ldns-src/ldns-src.tar.gz
 ldnsdir=`ls -d ldns-src/ldns*`
 AC_MSG_NOTICE([Configure $ldnsdir])
-echo "(cd $ldnsdir; ./configure)"
-(cd $ldnsdir; ./configure)
+echo "(cd $ldnsdir && ./configure)"
+(cd $ldnsdir && ./configure)
 AC_MSG_NOTICE([Finished $ldnsdir configure])
 CPPFLAGS="$CPPFLAGS -I$ldnsdir/include"
 LDFLAGS="$LDFLAGS $ldnsdir/*.lo"

contrib/README

@@ -0,0 +1,4 @@
+These files are contributed to unbound, and are not part of the official
+distribution but may be helpful.
+
+* rc_d_unbound: FreeBSD compatible /etc/rc.d script.

contrib/rc_d_unbound

@@ -0,0 +1,23 @@
+#!/bin/sh
+#
+# unbound freebsd startup rc.d script, modified from the named script.
+# uses the default unbound installation path and pidfile location.
+# copy this to /etc/rc.d/unbound
+# and put unbound_enable="YES" into rc.conf
+#
+
+# PROVIDE: unbound
+# REQUIRE: SERVERS cleanvar
+# KEYWORD: shutdown
+
+. /etc/rc.subr
+
+name="unbound"
+rcvar=`set_rcvar`
+
+command="/usr/local/sbin/unbound"
+pidfile="/etc/unbound/unbound.pid"
+extra_commands="reload"
+
+load_rc_config $name
+run_rc_command "$1"

daemon/stats.c

@@ -59,10 +59,12 @@ void server_stats_querymiss(struct server_stats* stats, struct worker* worker)
 
 void server_stats_log(struct server_stats* stats, int threadnum)
 {
-	log_info("server stats for thread %d: %u queries, %u from cache", 
+	log_info("server stats for thread %d: %u queries, "
+		"%u answers from cache, %u recursions", 
 		threadnum, (unsigned)stats->num_queries, 
 		(unsigned)(stats->num_queries - 
-			stats->num_queries_missed_cache));
+			stats->num_queries_missed_cache),
+		(unsigned)stats->num_queries_missed_cache);
 	log_info("server stats for thread %d: requestlist max %u avg %g "
 		"exceeded %u", threadnum, (unsigned)stats->max_query_list_size,
 		stats->num_queries_missed_cache?

daemon/unbound.c

@@ -55,6 +55,13 @@
 #include <pwd.h>
 #include <sys/resource.h>
 
+
+#ifdef USE_MINI_EVENT
+#include "util/mini_event.h"
+#else
+#include <event.h>
+#endif
+
 /** global debug value to keep track of heap memory allocation */
 void* unbound_start_brk = 0;
 
@@ -69,6 +76,8 @@ static void usage()
 	printf("-d	do not fork into the background.\n");
 	printf("-v	verbose (more times to increase verbosity)\n");
 	printf("Version %s\n", PACKAGE_VERSION);
+	printf("libevent %s, libldns %s\n", 
+		event_get_version(), ldns_version());
 	printf("BSD licensed, see LICENSE in source package for details.\n");
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
 }
@@ -345,8 +354,12 @@ run_daemon(char* cfgfile, int cmdline_verbose, int debug_mode)
 		/* config stuff */
 		if(!(cfg = config_create()))
 			fatal_exit("Could not alloc config defaults");
-		if(!config_read(cfg, cfgfile))
-			fatal_exit("Could not read config file: %s", cfgfile);
+		if(!config_read(cfg, cfgfile)) {
+			if(errno != ENOENT)
+				fatal_exit("Could not read config file: %s",
+					cfgfile);
+			log_warn("Continuing with default config settings");
+		}
 		apply_settings(daemon, cfg, cmdline_verbose);
 	
 		/* prepare */

daemon/worker.c

@@ -137,7 +137,7 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 	iter = 0;
 	val = 0;
 	for(i=0; i<worker->env.mesh->mods.num; i++) {
-		log_assert(fptr_whitelist_mod_get_mem(worker->env.mesh->
+		fptr_ok(fptr_whitelist_mod_get_mem(worker->env.mesh->
 			mods.mod[i]->get_mem));
 		if(strcmp(worker->env.mesh->mods.mod[i]->name, "validator")==0)
 			val += (*worker->env.mesh->mods.mod[i]->get_mem)
@@ -169,7 +169,7 @@ worker_mem_report(struct worker* ATTR_UNUSED(worker),
 	if(verbosity < VERB_QUERY)
 		return;
 	for(i=0; i<worker->env.mesh->mods.num; i++) {
-		log_assert(fptr_whitelist_mod_get_mem(worker->env.mesh->
+		fptr_ok(fptr_whitelist_mod_get_mem(worker->env.mesh->
 			mods.mod[i]->get_mem));
 		if(strcmp(worker->env.mesh->mods.mod[i]->name, "validator")==0)
 			val += (*worker->env.mesh->mods.mod[i]->get_mem)
@@ -406,7 +406,7 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	 */
 	uint16_t udpsize = edns->udp_size;
 	int secure = 0;
-	uint32_t timenow = (uint32_t)time(0);
+	uint32_t timenow = *worker->env.now;
 	int must_validate = !(flags&BIT_CD) && worker->env.need_to_validate;
 	struct dns_msg *msg = NULL;
 	struct delegpt *dp;
@@ -505,12 +505,11 @@ all_rrsets_secure(struct reply_info* rep) {
 
 /** answer query from the cache */
 static int
-answer_from_cache(struct worker* worker, struct lruhash_entry* e, uint16_t id,
-	uint16_t flags, struct comm_reply* repinfo, struct edns_data* edns)
+answer_from_cache(struct worker* worker, struct query_info* qinfo,
+	struct reply_info* rep, uint16_t id, uint16_t flags, 
+	struct comm_reply* repinfo, struct edns_data* edns)
 {
-	struct msgreply_entry* mrentry = (struct msgreply_entry*)e->key;
-	struct reply_info* rep = (struct reply_info*)e->data;
-	uint32_t timenow = time(0);
+	uint32_t timenow = *worker->env.now;
 	uint16_t udpsize = edns->udp_size;
 	int secure;
 	int must_validate = !(flags&BIT_CD) && worker->env.need_to_validate;
@@ -547,7 +546,7 @@ answer_from_cache(struct worker* worker, struct lruhash_entry* e, uint16_t id,
 		edns->ext_rcode = 0;
 		edns->bits &= EDNS_DO;
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
-			&mrentry->key, id, flags, edns);
+			qinfo, id, flags, edns);
 		rrset_array_unlock_touch(worker->env.rrset_cache, 
 			worker->scratchpad, rep->ref, rep->rrset_count);
 		regional_free_all(worker->scratchpad);
@@ -573,11 +572,11 @@ answer_from_cache(struct worker* worker, struct lruhash_entry* e, uint16_t id,
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
 	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
-	if(!reply_info_answer_encode(&mrentry->key, rep, id, flags, 
+	if(!reply_info_answer_encode(qinfo, rep, id, flags, 
 		repinfo->c->buffer, timenow, 1, worker->scratchpad,
 		udpsize, edns, (int)(edns->bits & EDNS_DO), secure)) {
 		error_encode(repinfo->c->buffer, LDNS_RCODE_SERVFAIL, 
-			&mrentry->key, id, flags, edns);
+			qinfo, id, flags, edns);
 	}
 	/* cannot send the reply right now, because blocking network syscall
 	 * is bad while holding locks. */
@@ -787,7 +786,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	h = query_info_hash(&qinfo);
 	if((e=slabhash_lookup(worker->env.msg_cache, h, &qinfo, 0))) {
 		/* answer from cache - we have acquired a readlock on it */
-		if(answer_from_cache(worker, e, 
+		if(answer_from_cache(worker, &qinfo, 
+			(struct reply_info*)e->data, 
 			*(uint16_t*)ldns_buffer_begin(c->buffer), 
 			ldns_buffer_read_u16_at(c->buffer, 2), repinfo, 
 			&edns)) {
@@ -817,6 +817,12 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		worker->stats.num_query_list_exceeded++;
 		comm_point_drop_reply(repinfo);
 		return 0;
+	} else if(worker->env.mesh->num_reply_addrs>worker->request_size*16) {
+		verbose(VERB_ALGO, "Too many requests queued. "
+			"dropping incoming query.");
+		worker->stats.num_query_list_exceeded++;
+		comm_point_drop_reply(repinfo);
+		return 0;
 	}
 	mesh_new_client(worker->env.mesh, &qinfo, 
 		ldns_buffer_read_u16_at(c->buffer, 2),
@@ -874,8 +880,8 @@ worker_restart_timer(struct worker* worker)
 void worker_stat_timer_cb(void* arg)
 {
 	struct worker* worker = (struct worker*)arg;
-	mesh_stats(worker->env.mesh, "mesh has");
 	server_stats_log(&worker->stats, worker->thread_num);
+	mesh_stats(worker->env.mesh, "mesh has");
 	worker_mem_report(worker, NULL);
 	server_stats_init(&worker->stats);
 	mesh_stats_clear(worker->env.mesh);
@@ -971,7 +977,8 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		cfg->msg_buffer_size, (size_t)cfg->outgoing_num_ports, 
 		cfg->out_ifs, cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, 
 		startport, cfg->do_tcp?cfg->outgoing_num_tcp:0, 
-		worker->daemon->env->infra_cache, worker->rndstate);
+		worker->daemon->env->infra_cache, worker->rndstate,
+		cfg->use_caps_bits_for_id);
 	if(!worker->back) {
 		log_err("could not create outgoing sockets");
 		worker_delete(worker);
@@ -1008,6 +1015,9 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker->thread_num);
 	alloc_set_id_cleanup(&worker->alloc, &worker_alloc_cleanup, worker);
 	worker->env = *worker->daemon->env;
+	comm_base_timept(worker->base, &worker->env.now, &worker->env.now_tv);
+	if(worker->thread_num == 0)
+		log_set_time(worker->env.now);
 	worker->env.worker = worker;
 	worker->env.send_packet = &worker_send_packet;
 	worker->env.send_query = &worker_send_query;
@@ -1046,8 +1056,8 @@ worker_delete(struct worker* worker)
 	if(!worker) 
 		return;
 	if(worker->env.mesh && verbosity >= VERB_OPS) {
-		mesh_stats(worker->env.mesh, "mesh has");
 		server_stats_log(&worker->stats, worker->thread_num);
+		mesh_stats(worker->env.mesh, "mesh has");
 		worker_mem_report(worker, NULL);
 	}
 	mesh_delete(worker->env.mesh);
@@ -1057,6 +1067,8 @@ worker_delete(struct worker* worker)
 	comm_signal_delete(worker->comsig);
 	comm_point_delete(worker->cmd_com);
 	comm_timer_delete(worker->stat_timer);
+	if(worker->thread_num == 0)
+		log_set_time(NULL);
 	comm_base_delete(worker->base);
 	ub_randfree(worker->rndstate);
 	/* close fds after deleting commpoints, to be sure.

doc/Changelog

@@ -1,7 +1,142 @@
+29 February 2008: Wouter
+	- documentation update.
+	- fixup port to Solaris of perf test tool.
+	- updated ldns-tarball with decl-after-statement fixes.
+
+28 February 2008: Wouter
+	- fixed memory leaks in libunbound (during cancellation and wait).
+	- libunbound returns the answer packet in full.
+	- snprintf compat update.
+	- harvest performs lookup.
+	- ldns-tarball update with fix for ldns_dname_label.
+	- installs to sbin by default.
+	- install all manual pages (unbound-host and libunbound too).
+
+27 February 2008: Wouter
+	- option to use caps for id randomness.
+	- config file option use-caps-for-id: yes
+	- harvest debug tool
+
+26 February 2008: Wouter
+	- delay utility delays TCP as well. If the server that is forwarded 
+	  to has a TCP error, the delay utility closes the connection.
+	- delay does REUSE_ADDR, and can handle a server that closes its end.
+	- answers use casing from query.
+
+25 February 2008: Wouter
+	- delay utility works. Gets decent thoughput too (>20000).
+
+22 February 2008: Wouter
+	- +2% for recursions, if identical queries (except for destination
+	  and query ID) in the reply list, avoid re-encoding the answer.
+	- removed TODO items for optimizations that do not show up in
+	  profile reports.
+	- default is now minievent - not libevent. As its faster and
+	  not needed for regular installs, only for very large port ranges.
+	- loop check different speedup pkt-dname-reading, 1% faster for
+	  nocache-recursion check.
+	- less hashing during msg parse, 4% for recursion.
+	- small speed fix for dname_count_size_labels, +1 or +2% recursion.
+	- some speed results noted:
+	  optimization resulted in +40% for recursion (cache miss) and
+	  +70 to +80 for cache hits, and +96% for version.bind.
+	  zone nsec3 example, 100 NXDOMAIN queries, NSD 35182.8 Ub 36048.4
+	  www.nlnetlabs.nl from cache: BIND 8987.99 Ub 31218.3
+	  www with DO bit set : BIND 8269.31 Ub 28735.6 qps.
+	  So, unbound can be about equal qps to NSD in cache hits.
+	  And about 3.4x faster than BIND in cache performance.
+	- delay utility for testing.
+
+21 February 2008: Wouter
+	- speedup of root-delegation message encoding by 15%.
+	- minor speedup of compress tree_lookup, maybe 1%.
+	- speedup of dname_lab_cmp and memlowercmp - the top functions in 
+	  profiler output, maybe a couple percent when it matters.
+
+20 February 2008: Wouter
+	- setup speec_cache for need-ldns-testns in dotests.
+	- check number of queued replies on incoming queries to avoid overload
+	  on that account.
+	- fptr whitelist checks are not disabled in optimize mode.
+	- do-daemonize config file option.
+	- minievent time share initializes time at start.
+	- updated testdata for nsec3 new algorithm numbers (6, 7).
+	- small performance test of packet encoding (root delegation).
+
+19 February 2008: Wouter
+	- applied patch to unbound-host man page from Jan-Piet Mens.
+	- fix donotquery-localhost: yes default (it erroneously was switched
+	  to default 'no').
+	- time is only gotten once and the value is shared across unbound.
+	- unittest cleans up crypto, so that it has no memory leaks.
+	- mini_event shares the time value with unbound this results in 
+	  +3% speed for cache responses and +9% for recursions.
+	- ldns tarball update with new NSEC3 sign code numbers.
+	- perform several reads per UDP operation. This improves performance
+	  in DoS conditions, and costs very little in normal conditions.
+	  improves cache response +50%, and recursions +10%.
+	- modified asynclook test. because the callback from async is not
+	  in any sort of lock (and thus can use all library functions freely),
+	  this causes a tiny race condition window when the last lock is 
+	  released for a callback and a new cancel() for that callback.
+	  The only way to remove this is by putting callbacks into some 
+	  lock window. I'd rather have the small possibility of a callback
+	  for a cancelled function then no use of library functions in 
+	  callbacks. Could be possible to only outlaw process(), wait(),
+	  cancel() from callbacks, by adding another lock, but I'd rather not.
+
+18 February 2008: Wouter
+	- patch to unbound-host from Jan-Piet Mens.
+	- unbound host prints errors if fails to configure context.
+	- fixup perf to resend faster, so that long waiting requests do
+	  not hold up the queue, they become lost packets or SERVFAILs,
+	  or can be sent a little while later (i.e. processing time may 
+	  take long, but throughput has to be high).
+	- fixup iterator operating in no cache conditions (RD flag unset
+	  after a CNAME).
+	- streamlined code for RD flag setting.
+	- profiled code and changed dname compares to be faster. 
+	  The speedup is about +3% to +8% (depending on the test).
+	- minievent tests for eintr and eagain.
+
+15 February 2008: Wouter
+	- added FreeBSD rc.d script to contrib.
+	- --prefix option for configure also changes directory: pidfile:
+	  and chroot: defaults in config file.
+	- added cache speed test, for cache size OK and cache too small.
+
+14 February 2008: Wouter
+	- start without a config file (will complain, but start with
+	  defaults).
+	- perf test program works.
+
+13 February 2008: Wouter
+	- 0.9 released.
+	- 1.0 development. Printout ldns version on unbound -h.
+	- start of perf tool.
+	- bugfix to read empty lines from /etc/hosts.
+
+12 February 2008: Wouter
+	- fixup problem with configure calling itself if ldns-src tarball
+	  is not present.
+
+11 February 2008: Wouter
+	- changed library to use ub_ instead of ub_val_ as prefix.
+	- statistics output text nice.
+	- etc/hosts handling.
+	- library function to put logging to a stream.
+	- set any option interface.
+
 8 February 2008: Wouter
 	- test program for multiple queries over a TCP channel.
 	- tpkg test for stream tcp queries.
 	- unbound replies to multiple TCP queries on a TCP channel.
+	- fixup misclassification of root referral with NS in answer
+	  when validating a nonrec query.
+	- tag 0.9
+	- layout of manpages, spelling fix in header, manpages process by
+	  makedist, list asynclook and tcpstream tests as ldns-testns
+	  required.
 
 7 February 2008: Wouter
 	- moved up all current level 2 to be level 3. And 3 to 4.

doc/README

@@ -4,18 +4,16 @@ http://unbound.net
 
 This software is under BSD license, see LICENSE for details.
 
-* Download the latest version of this software from 
+* Download the latest release version of this software from 
   	http://unbound.net 
   or get a beta version from the svn repository at 
   	http://unbound.net/svn/
 
 * Uses the following libraries; 
   * ldns	http://www.nlnetlabs.nl/ldns/			(BSD license)
+    (required) can use tarball from source directory.
   * libevent	http://www.monkey.org/~provos/libevent/		(BSD license)
-
-* Create build environment 
-  * run libtoolize -c if config.sub is missing, or run glibtoolize.
-  * autoreconf (autoheader && autoconf), if ./configure is missing.
+    (optional) can use builtin alternative instead.
 
 * Make and install: ./configure; make; make install
   * Use GNU make; default on linux, often called 'gmake' on BSD and Solaris.
@@ -25,10 +23,11 @@ This software is under BSD license, see LICENSE for details.
 	If detected on the system, it will dynamically link against it.
   * --with-libevent=/path/to/libevent
   	Can be set to either the system install or the build directory.
-	--with-libevent=no gives a builtin alternative implementation.
-	libevent is useful when having many (thousands) of outgoing ports.
-	This improves randomization and spoof resistance. For the default 
-	of 16 ports the builtin alternative works well.
+	--with-libevent=no (default) gives a builtin alternative 
+	implementation. libevent is useful when having many (thousands) 
+	of outgoing ports. This improves randomization and spoof 
+	resistance. For the default of 16 ports the builtin alternative 
+	works well and is a little faster.
   * --without-pthreads 
 	This disables pthreads. Without this option the pthreads library 
 	is detected automatically. Use this option to disable threading
@@ -71,6 +70,7 @@ o If you are not receiving the correct source IP address on replies (e.g.
 
 Acknowledgements
 ----------------
+o Unbound was written in portable C by Wouter Wijngaards (NLnet Labs).
 o Thanks to David Blacka and Matt Larson (Verisign) for the unbound-java
   prototype. Design and code from that prototype has been used to create
   this program. Such as the iterator state machine and the cache design.

doc/README.svn

@@ -1,11 +1,13 @@
 README.svn
 
 For a svn checkout
-* Create build environment - see README.
-  * possibly copy aclocal.m4 from your autoconf/libtool setup.
+* configure script, aclocal.m4, as well as yacc/lex output files are
+  committed to the repository.
+* use --enable-debug flag for configure to enable dependency tracking and
+  assertions, otherwise, use make clean; make after svn update.
 
 * Note changes in the Changelog.
-* Every checking a postcommit hook is run
+* Every check-in a postcommit hook is run
 	(the postcommit hook is in the svn/unbound/hooks directory).
 	* generates commit email with your changes and comment.
 	* compiles and runs the tests (with testcode/do-tests.sh).

doc/README.tests

@@ -3,7 +3,18 @@ README unbound tests
 There is a test setup for unbound. Use
 	make test
 To make and run the tests. The results are summarized at the end.
-You can also run ./unittest by hand, if the system lacks other debug tools.
+
+You need to have the following programs installed and in your PATH.
+* dig - from the bind-tools package. Used to send DNS queries.
+* splint (optional) - for lint test
+* doxygen (optional) - for doc completeness test
+* ldns-testns (optional) - from ldns examples. Used as DNS auth server.
+* xxd and nc (optional) - for (malformed) packet transmission.
+The optional programs are detected and can be omitted.
+
+Without any support programs, unittest and testbound can still be used.
+	(cd testdata; ../testcode/mini_tpkg.sh exe 02-unittest.tpkg)
+	(cd testdata; ../testcode/mini_tpkg.sh exe 03-testbound.tpkg)
 
 testdata/ contains the data for tests. 
 testcode/ contains scripts and c code for the tests.

doc/TODO

@@ -1,49 +1,32 @@
 TODO items.
-o #define BIT_... different on bigendian and smallendian systems so that
-  the htons on flags is not needed to send a message from the cache.
-o speed up pkt domain name decompression loop detection using counter perhaps.
-o detect OS/400 pthreads implementation that allows upgrading to writelock
-  on pthreads rwlocks and use it to examine-rd before storing-wr rrset cache.
 o understand synthesized DNAMEs, so those TTL=0 packets are cached properly.
-o understand NSEC/NSEC3, aggressive negative caching, so that updates to
-  NSEC/NSEC3 will result in proper negative responses.
-o scrubber has slow pkt_subdomain and pkt_strict_subdomain functions.
+o NSEC/NSEC3 aggressive negative caching, so that updates to NSEC/NSEC3 
+  will result in proper negative responses.
 o get serverselection algorithm out of local optimum.
   make subtargets to get rtt info for a couple of targets, like fetch-policy.
   or send out multiple queries to multiple servers.
-o configuration option where port 53 is used for send and receive, no other
-  ports are used.
+o (option) where port 53 is used for send and receive, no other ports are used.
 o (option) to not send replies to clients after a timeout of (say 5 secs) has
   passed, but keep task active for later retries by client.
-o private TTL feature
-o pretend-dnssec-unaware, and pretend-edns-unaware modes for debug/workshops.
+o (option) private TTL feature (always report TTL x in answers).
+o (option) pretend-dnssec-unaware, and pretend-edns-unaware modes for workshops.
 o delegpt use rbtree for ns-list, to avoid slowdown for very large NS sets.
-o reprime and refresh oft used data before timeout.
-o retain prime results in a overlaid roothints file.
-o store primed key data in a overlaid keyhints file (sort of like drafttimers).
+o (option) reprime and refresh oft used data before timeout.
+o (option) retain prime results in a overlaid roothints file.
+o (option) store primed key data in a overlaid keyhints file (sort of like drafttimers).
 o windows version, auto update feature, a query to check for the version.
-o autoreport of problems
 o command the server with TSIG inband. get-config, clearcache, 
 	get stats, get memstats, get ..., reload, clear one zone from cache
 o watch for spoof nearmisses. Keep counter of nearmisses and print that
   in the stats lines, operator can determine what level is a redalert.
-o improve compression of DNS packets by first puttig uncompressible rrs, then
-  compress to their rdata.
 o NSID rfc 5001 support.
 o timers rfc 5011 support.
 o Treat YXDOMAIN from a DNAME properly, in iterator (not throwaway), validator.
-o grab ports nonconsequtive and change the set after a while (change within
-  a given range). Could be bad for OS if wrong port. unsure if it helps secure.
 o make timeout backoffs randomized (a couple percent random) to spread traffic.
 o inspect date on executable, then warn user in log if its more than 1 year.
-o proactively prime root, stubs and trust anchors, feature.
+o (option) proactively prime root, stubs and trust anchors, feature.
   early failure, faster on first query, but more traffic.
-o use privilege separation, to change privilege options during reload securely
-  not needed.
 o On Windows use CryptGenRandom() to get random seed for arc4random.
-o Think about intermediate firewalls dropping EDNS UDP & handling that.
-  detect nonEDNS middlebox by timeout on edns queries, and fallback to
-  nonEDNS when appropriate.
 o library add convenience functions for A, AAAA, PTR, getaddrinfo, libresolve.
 o library add function to get signature data (or whole reply message).
 o library add function to validate input from app that is signed.
@@ -55,3 +38,4 @@ o support multiple dns messages in a TCP query stream for the unbound server.
 o SIG(0) and TSIG.
 o support OPT record placement on recv anywhere in the additional section. 
 o add local-file: config with authority features.
+o (option) to make local-data answers be secure for libunbound (default=no)

doc/example.conf

@@ -121,6 +121,9 @@ server:
 	# Enable TCP, "yes" or "no".
 	# do-tcp: yes
 
+	# Detach from the terminal, run in background, "yes" or "no".
+	# do-daemonize: yes
+
 	# control which clients are allowed to make (recursive) queries
 	# to this server. Specify classless netblocks with /size and action.
 	# By default everything is refused, except for localhost.
@@ -197,6 +200,12 @@ server:
 	# Default on, which insists on dnssec data for trust-anchored zones.
 	# harden-dnssec-stripped: yes
 	
+	# Use 0x20-encoded random bits in the query to foil spoof attempts.
+	# Disabled by default, because some caching forwarders may not
+	# support this (if you have forward-zones). Most authority servers do.
+	# This feature is an experimental implementation of draft dns-0x20.
+	# use-caps-for-id: no
+	
 	# Do not query the following addresses. No DNS queries are sent there.
 	# List one address per entry. List classless netblocks with /size,
 	# do-not-query-address: 127.0.0.1/8

doc/libunbound.3

@@ -11,101 +11,109 @@
 .LP
 .B libunbound,
 .B unbound.h,
-.B ub_val_ctx,
-.B ub_val_result,
-.B ub_val_callback_t,
-.B ub_val_ctx_create,
-.B ub_val_ctx_delete,
-.B ub_val_ctx_config,
-.B ub_val_ctx_set_fwd,
-.B ub_val_ctx_resolvconf,
-.B ub_val_ctx_add_ta,
-.B ub_val_ctx_add_ta_file,
-.B ub_val_ctx_trustedkeys,
-.B ub_val_ctx_debuglevel,
-.B ub_val_ctx_async,
-.B ub_val_poll,
-.B ub_val_wait,
-.B ub_val_fd,
-.B ub_val_process,
-.B ub_val_resolve,
-.B ub_val_resolve_async,
-.B ub_val_cancel,
-.B ub_val_resolve_free,
-.B ub_val_strerror
+.B ub_ctx,
+.B ub_result,
+.B ub_callback_t,
+.B ub_ctx_create,
+.B ub_ctx_delete,
+.B ub_ctx_set_option,
+.B ub_ctx_config,
+.B ub_ctx_set_fwd,
+.B ub_ctx_resolvconf,
+.B ub_ctx_hosts,
+.B ub_ctx_add_ta,
+.B ub_ctx_add_ta_file,
+.B ub_ctx_trustedkeys,
+.B ub_ctx_debugout,
+.B ub_ctx_debuglevel,
+.B ub_ctx_async,
+.B ub_poll,
+.B ub_wait,
+.B ub_fd,
+.B ub_process,
+.B ub_resolve,
+.B ub_resolve_async,
+.B ub_cancel,
+.B ub_resolve_free,
+.B ub_strerror
 \- Unbound DNS validating resolver @version@ functions.
 .SH "SYNOPSIS"
 .LP
 .B #include <unbound.h>
 .LP
-\fIstruct ub_val_ctx *\fR
-\fBub_val_ctx_create\fR(\fIvoid\fR);
+\fIstruct ub_ctx *\fR
+\fBub_ctx_create\fR(\fIvoid\fR);
 .LP
 \fIvoid\fR
-\fBub_val_ctx_delete\fR(\fIstruct ub_val_ctx*\fR ctx);
+\fBub_ctx_delete\fR(\fIstruct ub_ctx*\fR ctx);
 .LP
 \fIint\fR
-\fBub_val_ctx_config\fR(\fIstruct ub_val_ctx*\fR ctx, \fIchar*\fR fname);
+\fBub_ctx_set_option\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR opt, \fIchar*\fR val);
 .LP
 \fIint\fR
-\fBub_val_ctx_set_fwd\fR(\fIstruct ub_val_ctx*\fR ctx, \fIchar*\fR addr);
+\fBub_ctx_config\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
 .LP
 \fIint\fR
-\fBub_val_ctx_resolvconf\fR(\fIstruct ub_val_ctx*\fR ctx, \fIchar*\fR fname);
+\fBub_ctx_set_fwd\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR addr);
 .LP
 \fIint\fR
-\fBub_val_ctx_add_ta\fR(\fIstruct ub_val_ctx*\fR ctx, \fIchar*\fR ta);
+\fBub_ctx_resolvconf\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
 .LP
 \fIint\fR
-\fBub_val_ctx_add_ta_file\fR(\fIstruct ub_val_ctx*\fR ctx, 
-.br
-                       \fIchar*\fR fname);
+\fBub_ctx_hosts\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
 .LP
 \fIint\fR
-\fBub_val_ctx_trustedkeys\fR(\fIstruct ub_val_ctx*\fR ctx, 
-.br
-                       \fIchar*\fR fname);
+\fBub_ctx_add_ta\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR ta);
 .LP
 \fIint\fR
-\fBub_val_ctx_debuglevel\fR(\fIstruct ub_val_ctx*\fR ctx, \fIint\fR d);
+\fBub_ctx_add_ta_file\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
 .LP
 \fIint\fR
-\fBub_val_ctx_async\fR(\fIstruct ub_val_ctx*\fR ctx, \fIint\fR dothread);
+\fBub_ctx_trustedkeys\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
 .LP
 \fIint\fR
-\fBub_val_poll\fR(\fIstruct ub_val_ctx*\fR ctx);
+\fBub_ctx_debugout\fR(\fIstruct ub_ctx*\fR ctx, \fIFILE*\fR out);
 .LP
 \fIint\fR
-\fBub_val_wait\fR(\fIstruct ub_val_ctx*\fR ctx);
+\fBub_ctx_debuglevel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR d);
 .LP
 \fIint\fR
-\fBub_val_fd\fR(\fIstruct ub_val_ctx*\fR ctx);
+\fBub_ctx_async\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR dothread);
 .LP
 \fIint\fR
-\fBub_val_process\fR(\fIstruct ub_val_ctx*\fR ctx);
+\fBub_poll\fR(\fIstruct ub_ctx*\fR ctx);
 .LP
 \fIint\fR
-\fBub_val_resolve\fR(\fIstruct ub_val_ctx*\fR ctx, \fIchar*\fR name, 
+\fBub_wait\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_fd\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_process\fR(\fIstruct ub_ctx*\fR ctx);
+.LP
+\fIint\fR
+\fBub_resolve\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
 .br
            \fIint\fR rrtype, \fIint\fR rrclass, \fIint*\fR secure, 
 .br
-           \fIint*\fR data, \fIstruct ub_val_result**\fR result);
+           \fIint*\fR data, \fIstruct ub_result**\fR result);
 .LP
 \fIint\fR
-\fBub_val_resolve_async\fR(\fIstruct ub_val_ctx*\fR ctx, \fIchar*\fR name, 
+\fBub_resolve_async\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
 .br
                  \fIint\fR rrtype, \fIint\fR rrclass, \fIvoid*\fR mydata, 
 .br
-                 \fIub_val_callback_t\fR callback, \fIint*\fR async_id);
+                 \fIub_callback_t\fR callback, \fIint*\fR async_id);
 .LP
 \fIint\fR
-\fBub_val_cancel\fR(\fIstruct ub_val_ctx*\fR ctx, \fIint\fR async_id);
+\fBub_cancel\fR(\fIstruct ub_ctx*\fR ctx, \fIint\fR async_id);
 .LP
 \fIvoid\fR
-\fBub_val_resolve_free\fR(\fIstruct ub_val_result*\fR result);
+\fBub_resolve_free\fR(\fIstruct ub_result*\fR result);
 .LP
 \fIconst char *\fR
-\fBub_val_strerror\fR(\fIint\fR err);
+\fBub_strerror\fR(\fIint\fR err);
 .SH "DESCRIPTION"
 .LP
 .B Unbound 
@@ -116,11 +124,11 @@ The library can be used to convert hostnames to ip addresses, and back,
 and obtain other information from the DNS. The library performs public\-key
 validation of results with DNSSEC.
 .P
-The library uses a variable of type \fIstruct ub_val_ctx\fR to keep context
+The library uses a variable of type \fIstruct ub_ctx\fR to keep context
 between calls. The user must maintain it, creating it with
-.B ub_val_ctx_create
+.B ub_ctx_create
 and deleting it with
-.B ub_val_ctx_delete\fR.
+.B ub_ctx_delete\fR.
 It can be created and deleted at any time. Creating it anew removes any 
 previous configuration (such as trusted keys) and clears any cached results.
 .P
@@ -133,20 +141,32 @@ can go on, while the results become available later.
 The functions are discussed in turn below.
 .SH "FUNCTIONS"
 .TP 
-.B ub_val_ctx_create
+.B ub_ctx_create
 Create a new context, initialised with defaults.
+The information from /etc/resolv.conf and /etc/hosts is not utilised 
+by default. Use 
+.B ub_ctx_resolvconf
+and
+.B ub_ctx_hosts
+to read them.
 .TP
-.B ub_val_ctx_delete
+.B ub_ctx_delete
 Delete validation context and free associated resources.
 Outstanding async queries are killed and callbacks are not called for them.
 .TP
-.B ub_val_ctx_config
+.B ub_ctx_set_option
+A power\-user interface that lets you specify one of the options from the
+config file format, see \fIunbound.conf\fR(5). Not all options are
+relevant. For some specific options, such as adding trust anchors, special
+routines exist. Pass the option name with the trailing ':'.
+.TP
+.B ub_ctx_config
 A power\-user interface that lets you specify an unbound config file, see
 \fIunbound.conf\fR(5), which is read for configuration. Not all options are
 relevant. For some specific options, such as adding trust anchors, special
 routines exist.
 .TP
-.B ub_val_ctx_set_fwd
+.B ub_ctx_set_fwd
 Set machine to forward DNS queries to, the caching resolver to use. 
 IP4 or IP6 address. Forwards all DNS requests to that machine, which 
 is expected to run a recursive resolver. If the proxy is not 
@@ -155,7 +175,7 @@ that case the addresses are used as backup servers.
 At this time it is only possible to set configuration before the
 first resolve is done.
 .TP
-.B ub_val_ctx_resolvconf
+.B ub_ctx_resolvconf
 Read list of nameservers to use from the filename given.
 Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
 If they do not support DNSSEC, validation may fail.
@@ -165,67 +185,79 @@ If fname NULL is passed, "/etc/resolv.conf" is used.
 At this time it is only possible to set configuration before the
 first resolve is done.
 .TP
+.B ub_ctx_hosts
+Read list of hosts from the filename given.
+Usually "/etc/hosts". When queried for, these addresses are not marked 
+DNSSEC secure. If fname NULL is passed, "/etc/hosts" is used.
+At this time it is only possible to set configuration before the
+first resolve is done.
+.TP
 .B
-ub_val_ctx_add_ta
+ub_ctx_add_ta
 Add a trust anchor to the given context.
 At this time it is only possible to add trusted keys before the
 first resolve is done.
 The format is a string, similar to the zone-file format,
 [domainname] [type] [rdata contents]. Both DS and DNSKEY records are accepted.
 .TP
-.B ub_val_ctx_add_ta_file
+.B ub_ctx_add_ta_file
 Add trust anchors to the given context.
 Pass name of a file with DS and DNSKEY records in zone file format.
 At this time it is only possible to add trusted keys before the
 first resolve is done.
 .TP
-.B ub_val_ctx_trustedkeys
+.B ub_ctx_trustedkeys
 Add trust anchors to the given context.
 Pass the name of a bind-style config file with trusted-keys{}.
 At this time it is only possible to add trusted keys before the
 first resolve is done.
 .TP
-.B ub_val_ctx_debuglevel
+.B ub_ctx_debugout
+Set debug and error log output to the given stream. Pass NULL to disable
+output. Default is stderr. File-names or using syslog can be enabled
+using config options, this routine is for using your own stream.
+.TP
+.B ub_ctx_debuglevel
 Set debug verbosity for the context. Output is directed to stderr.
 Higher debug level gives more output.
 .TP
-.B ub_val_ctx_async
+.B ub_ctx_async
 Set a context behaviour for asynchronous action.
 if set to true, enables threading and a call to 
-.B ub_val_resolve_async 
+.B ub_resolve_async 
 creates a thread to handle work in the background.
 If false, a process is forked to handle work in the background.
 Changes to this setting after 
-.B ub_val_resolve_async 
+.B ub_resolve_async 
 calls have been made have no effect (delete and re\-create the context 
 to change).
 .TP
-.B ub_val_poll
+.B ub_poll
 Poll a context to see if it has any new results.
 Do not poll in a loop, instead extract the fd below to poll for readiness,
 and then check, or wait using the wait routine.
 Returns 0 if nothing to read, or nonzero if a result is available.
 If nonzero, call 
-.B ub_val_process 
+.B ub_process 
 to do callbacks.
 .TP
-.B ub_val_wait
+.B ub_wait
 Wait for a context to finish with results. Calls 
-.B ub_val_process 
+.B ub_process 
 after the wait for you. After the wait, there are no more outstanding 
 asynchronous queries.
 .TP
-.B ub_val_fd
+.B ub_fd
 Get file descriptor. Wait for it to become readable, at this point
 answers are returned from the asynchronous validating resolver.
-Then call the \fBub_val_process\fR to continue processing.
+Then call the \fBub_process\fR to continue processing.
 .TP
-.B ub_val_process
+.B ub_process
 Call this routine to continue processing results from the validating
 resolver (when the fd becomes readable).
 Will perform necessary callbacks.
 .TP
-.B ub_val_resolve
+.B ub_resolve
 Perform resolution and validation of the target name.
 The name is a domain name in a zero terminated text string.
 The rrtype and rrclass are DNS type and class codes.
@@ -233,9 +265,9 @@ The value secure returns true if the answer validated securely.
 The value data returns true if there was data.
 The result structure is newly allocated with the resulting data.
 .TP
-.B ub_val_resolve_async
+.B ub_resolve_async
 Perform asynchronous resolution and validation of the target name.
-Arguments mean the same as for \fBub_val_resolve\fR except no
+Arguments mean the same as for \fBub_resolve\fR except no
 data is returned immediately, instead a callback is called later.
 The callback receives a copy of the mydata pointer, that you can use to pass
 information to the callback. The callback type is a function pointer to
@@ -243,27 +275,27 @@ a function declared as
 .IP
 void my_callback_function(void* my_arg, int err, 
 .br
-                  struct ub_val_result* result);
+                  struct ub_result* result);
 .IP
 The async_id is returned so you can (at your option) decide to track it
 and cancel the request if needed.
 .TP
-.B ub_val_cancel
+.B ub_cancel
 Cancel an async query in progress.
 .TP
-.B ub_val_resolve_free
-Free struct ub_val_result contents after use.
+.B ub_resolve_free
+Free struct ub_result contents after use.
 .TP
-.B ub_val_strerror
+.B ub_strerror
 Convert error value from one of the unbound library functions 
 to a human readable string.
 .SH "RESULT DATA STRUCTURE"
 .LP
 The result of the DNS resolution and validation is returned as 
-\fIstruct ub_val_result\fR. The result structure contains the following entries.
+\fIstruct ub_result\fR. The result structure contains the following entries.
 .P
 .nf
-	struct ub_val_result {
+	struct ub_result {
 		char* qname; /* text string, original question */
 		int qtype;   /* type code asked for */
 		int qclass;  /* class code asked for */
@@ -271,6 +303,8 @@ The result of the DNS resolution and validation is returned as
 		int* len;    /* array with lengths of rdata items */
 		char* canonname; /* canonical name of result */
 		int rcode;   /* additional error code in case of no data */
+		void* answer_packet; /* full network format answer packet */
+		int answer_len; /* length of packet in octets */
 		int havedata; /* true if there is data */
 		int nxdomain; /* true if nodata because name does not exist */
 		int secure;  /* true if result is secure */
@@ -283,15 +317,15 @@ domain of the query.
 .SH "RETURN VALUES"
 Many routines return an error code. The value 0 (zero) denotes no error
 happened. Other values can be passed to
-.B ub_val_strerror
+.B ub_strerror
 to obtain a readable error string.
-.B ub_val_strerror
+.B ub_strerror
 returns a zero terminated string.
-.B ub_val_ctx_create
+.B ub_ctx_create
 returns NULL on an error (a malloc failure).
-.B ub_val_poll
+.B ub_poll
 returns true if some information may be available, false otherwise.
-.B ub_val_fd
+.B ub_fd
 returns a file descriptor or -1 on error.
 .SH "SEE ALSO"
 \fIunbound.conf\fR(5), 

doc/unbound-host.1

@@ -26,6 +26,8 @@
 .IR keyfile ]
 .RB [ \-F
 .IR namedkeyfile ]
+.RB [ \-C
+.IR configfile ]
 .SH "DESCRIPTION"
 .LP
 .B Unbound\-host
@@ -75,9 +77,14 @@ as for \-y. The zone file format, the same as dig and drill produce.
 .B \-F \fInamedkeyfile
 Reads keys from a BIND\-style named.conf file. Only the trusted\-key {}; entries
 are read.
+.TP
+.B \-C \fIconfigfile
+Uses the specified unbound.conf to prime
+.IR libunbound (3).
 .SH "EXAMPLES"
 .LP
-Some examples of use.
+Some examples of use. The keys shown below are fakes, thus a security failure
+is encountered.
 .P
 $ unbound\-host www.example.com
 .P

doc/unbound.conf.5

@@ -209,6 +209,10 @@ Enable or disable whether UDP queries are answered or issued. Default is yes.
 .B do\-tcp: \fI<yes or no>
 Enable or disable whether TCP queries are answered or issued. Default is yes.
 .TP
+.B do\-daemonize: \fI<yes or no>
+Enable or disable whether the unbound server forks into the background as
+a daemon. Default is yes.
+.TP
 .B access\-control: \fI<IP netblock> <action>
 The netblock is given as an IP4 or IP6 address with /size appended for a 
 classless network block. The action can be deny, refuse or allow.
@@ -324,6 +328,16 @@ removes DNSSEC data from packets, or a zone changes from signed to
 unsigned to badly signed often. If turned off you run the risk of a 
 downgrade attack that disables security for a zone. Default is on.
 .TP
+.B use\-caps\-for\-id: \fI<yes or no>
+Use 0x20-encoded random bits in the query to foil spoof attempts.
+This perturbs the lowercase and uppercase of query names sent to 
+authority servers and checks if the reply still has the correct casing. 
+Use together with a large outgoing port range to obtain a high spoof resistance.
+Disabled by default, because some caching forwarders may not
+support this. If you have no forward\-zones it should be possible to enable
+this without problem, it works with most authority servers.
+This feature is an experimental implementation of draft dns\-0x20.
+.TP
 .B do\-not\-query\-address: \fI<IP address>
 Do not query the given IP address. Can be IP4 or IP6. Append /num to 
 indicate a classless delegation netblock, for example like
@@ -467,7 +481,8 @@ for completeness and to satisfy some DNS update tools. Default content:
 .nf
 local\-zone: "localhost." static
 local\-data: "localhost. 10800 IN NS localhost."
-local\-data: "localhost. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
+local\-data: "localhost. 10800 IN 
+    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
 local\-data: "localhost. 10800 IN A 127.0.0.1"
 local\-data: "localhost. 10800 IN AAAA ::1"
 .fi
@@ -477,17 +492,26 @@ Default content:
 .nf
 local\-zone: "127.in\-addr.arpa." static
 local\-data: "127.in\-addr.arpa. 10800 IN NS localhost."
-local\-data: "127.in\-addr.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
-local\-data: "1.0.0.127.in\-addr.arpa. 10800 IN PTR localhost."
+local\-data: "127.in\-addr.arpa. 10800 IN 
+    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
+local\-data: "1.0.0.127.in\-addr.arpa. 10800 IN 
+    PTR localhost."
 .fi
 .TP 10
 \h'5'\fIreverse IPv6 loopback\fR 
 Default content:
 .nf
-local\-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." static
-local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost."
-local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
-local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN PTR localhost."
+local\-zone: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
+    0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa." static
+local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
+    0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN 
+    NS localhost."
+local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
+    0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN 
+    SOA localhost. nobody.invalid. 1 3600 1200 604800 10800"
+local\-data: "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
+    0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN 
+    PTR localhost."
 .fi
 .TP 10
 \h'5'\fIreverse RFC1918 local use zones\fR 
@@ -503,7 +527,8 @@ Reverse data for zones 0.in\-addr.arpa, 254.169.in\-addr.arpa,
 \h'5'\fIreverse RFC4291 IP6 unspecified\fR
 Reverse data for zone 
 .nf
-0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.
+0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.
+0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.
 .fi
 .TP 10
 \h'5'\fIreverse RFC4193 IPv6 Locally Assigned Local Addresses\fR
@@ -583,8 +608,9 @@ In the example config settings below memory usage is reduced. Some service
 levels are lower, notable very large data and a high TCP load are no longer
 supported. Very large data and high TCP loads are exceptional for the DNS.
 DNSSEC validation is enabled, just add trust anchors.
-If you do not have to worry about programs using more than 1 meg of memory,
-the below example is not for you. Use the defaults to receive full service.
+If you do not have to worry about programs using more than 3 Mb of memory,
+the below example is not for you. Use the defaults to receive full service,
+which on BSD-32bit tops out at 30-40 Mb after heavy usage. 
 .P
 .nf
 # example settings that reduce memory usage
@@ -594,19 +620,19 @@ server:
 	incoming\-num\-tcp: 1
 	outgoing\-range: 1	# uses less memory, but less port randomness.
 	msg\-buffer\-size: 8192   # note this limits service, 'no huge stuff'.
-	msg\-cache\-size: 102400  # 100 Kb.
+	msg\-cache\-size: 100k
 	msg\-cache\-slabs: 1
-	rrset\-cache\-size: 102400  # 100 Kb.
+	rrset\-cache\-size: 100k
 	rrset\-cache\-slabs: 1
 	infra\-cache\-numhosts: 200
-	infra\-cache\-numlame: 10
-	key\-cache\-size: 102400  # 100 Kb.
+	infra\-cache\-slabs: 1
+	infra\-cache\-lame\-size: 1k
+	key\-cache\-size: 100k
 	key\-cache\-slabs: 1
 	num\-queries\-per\-thread: 30
 	target\-fetch\-policy: "2 1 0 0 0 0"
 	harden\-large\-queries: "yes"
 	harden\-short\-bufsize: "yes"
-	do\-ip6: no	# save a bit of memory if not used.
 .fi
 .SH "FILES"
 .TP

iterator/iter_donotq.c

@@ -115,6 +115,7 @@ donotq_str_cfg(struct iter_donotq* dq, const char* str)
 	struct sockaddr_storage addr;
 	int net;
 	socklen_t addrlen;
+	verbose(VERB_ALGO, "donotq: %s", str);
 	if(!netblockstrtoaddr(str, UNBOUND_DNS_PORT, &addr, &addrlen, &net)) {
 		log_err("cannot parse donotquery netblock: %s", str);
 		return 0;

iterator/iter_scrub.c

@@ -467,7 +467,7 @@ store_rrset(ldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
 	struct ub_packed_rrset_key* k;
 	struct packed_rrset_data* d;
 	struct rrset_ref ref;
-	uint32_t now = time(NULL);
+	uint32_t now = *env->now;
 
 	k = alloc_special_obtain(env->alloc);
 	if(!k)

iterator/iter_utils.c

@@ -130,7 +130,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 /** filter out unsuitable targets, return rtt or -1 */
 static int
 iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
-	uint8_t* name, size_t namelen, time_t now, struct delegpt_addr* a)
+	uint8_t* name, size_t namelen, uint32_t now, struct delegpt_addr* a)
 {
 	int rtt;
 	int lame;
@@ -160,7 +160,7 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
  * returns number of best targets (or 0, no suitable targets) */
 static int
 iter_filter_order(struct iter_env* iter_env, struct module_env* env,
-	uint8_t* name, size_t namelen, time_t now, struct delegpt* dp,
+	uint8_t* name, size_t namelen, uint32_t now, struct delegpt* dp,
 	int* best_rtt)
 {
 	int got_num = 0, got_rtt = 0, thisrtt, swap_to_front;
@@ -211,12 +211,11 @@ iter_server_selection(struct iter_env* iter_env,
 	struct module_env* env, struct delegpt* dp, 
 	uint8_t* name, size_t namelen, int* dnssec_expected)
 {
-	time_t now = time(NULL);
 	int sel;
 	int selrtt;
 	struct delegpt_addr* a, *prev;
-	int num = iter_filter_order(iter_env, env, name, namelen, now, dp,
-		&selrtt);
+	int num = iter_filter_order(iter_env, env, name, namelen, 
+		*env->now, dp, &selrtt);
 
 	if(num == 0)
 		return NULL;
@@ -313,7 +312,7 @@ causes_cycle(struct module_qstate* qstate, uint8_t* name, size_t namelen,
 	qinf.qname_len = namelen;
 	qinf.qtype = t;
 	qinf.qclass = c;
-	log_assert(fptr_whitelist_modenv_detect_cycle(
+	fptr_ok(fptr_whitelist_modenv_detect_cycle(
 		qstate->env->detect_cycle));
 	return (*qstate->env->detect_cycle)(qstate, &qinf, 
 		(uint16_t)(BIT_RD|BIT_CD), qstate->is_priming);

iterator/iterator.c

@@ -456,7 +456,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	qflags |= BIT_CD;
 
 	/* attach subquery, lookup existing or make a new one */
-	log_assert(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
+	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
 	if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, &subq)) {
 		return 0;
 	}
@@ -469,7 +469,7 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 			sizeof(struct iter_qstate));
 		if(!subq->minfo[id]) {
 			log_err("init subq: out of memory");
-			log_assert(fptr_whitelist_modenv_kill_sub(
+			fptr_ok(fptr_whitelist_modenv_kill_sub(
 				qstate->env->kill_sub));
 			(*qstate->env->kill_sub)(subq);
 			return 0;
@@ -587,7 +587,7 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq,
 		subiq->dp = delegpt_copy(stub_dp, subq->region);
 		if(!subiq->dp) {
 			log_err("out of memory priming stub, copydp");
-			log_assert(fptr_whitelist_modenv_kill_sub(
+			fptr_ok(fptr_whitelist_modenv_kill_sub(
 				qstate->env->kill_sub));
 			(*qstate->env->kill_sub)(subq);
 			(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
@@ -759,7 +759,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * cache needs to be primed for the qclass. */
 		iq->dp = dns_cache_find_delegation(qstate->env, delname, 
 			delnamelen, iq->qchase.qtype, iq->qchase.qclass, 
-			qstate->region, &iq->deleg_msg, (uint32_t)time(NULL));
+			qstate->region, &iq->deleg_msg, *qstate->env->now);
 
 		/* If the cache has returned nothing, then we have a 
 		 * root priming situation. */
@@ -825,17 +825,6 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 	verbose(VERB_ALGO, "cache delegation returns delegpt");
 	delegpt_log(VERB_ALGO, iq->dp);
 
-	/* if the cache reply dp equals a validation anchor or msg has DS,
-	 * then DNSSEC RRSIGs are expected in the reply */
-	iq->dnssec_expected = iter_indicates_dnssec(qstate->env, iq->dp, 
-		iq->deleg_msg, iq->qchase.qclass);
-
-	/* Reset the RD flag. If this is a query restart, then the RD 
-	 * will have been turned off. */
-	if(qstate->query_flags & BIT_RD)
-		iq->chase_flags |= BIT_RD;
-	else	iq->chase_flags &= ~BIT_RD;
-
 	/* Otherwise, set the current delegation point and move on to the 
 	 * next state. */
 	return next_state(iq, INIT_REQUEST_2_STATE);
@@ -890,9 +879,14 @@ processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq)
 {
 	log_query_info(VERB_QUERY, "resolving (init part 3): ", 
 		&qstate->qinfo);
+	/* if the cache reply dp equals a validation anchor or msg has DS,
+	 * then DNSSEC RRSIGs are expected in the reply */
+	iq->dnssec_expected = iter_indicates_dnssec(qstate->env, iq->dp, 
+		iq->deleg_msg, iq->qchase.qclass);
+
 	/* If the RD flag wasn't set, then we just finish with the 
 	 * cached referral as the response. */
-	if(!(iq->chase_flags & BIT_RD)) {
+	if(!(qstate->query_flags & BIT_RD)) {
 		iq->response = iq->deleg_msg;
 		if(verbosity >= VERB_ALGO)
 			log_dns_msg("no RD requested, using delegation msg", 
@@ -1167,7 +1161,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	log_query_info(VERB_QUERY, "sending query:", &iq->qchase);
 	log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, 
 		&target->addr, target->addrlen);
-	log_assert(fptr_whitelist_modenv_send_query(qstate->env->send_query));
+	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
 	outq = (*qstate->env->send_query)(
 		iq->qchase.qname, iq->qchase.qname_len, 
 		iq->qchase.qtype, iq->qchase.qclass, 
@@ -1246,7 +1240,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* close down outstanding requests to be discarded */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
-		log_assert(fptr_whitelist_modenv_detach_subs(
+		fptr_ok(fptr_whitelist_modenv_detach_subs(
 			qstate->env->detach_subs));
 		(*qstate->env->detach_subs)(qstate);
 		iq->num_target_queries = 0;
@@ -1284,7 +1278,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
-		log_assert(fptr_whitelist_modenv_detach_subs(
+		fptr_ok(fptr_whitelist_modenv_detach_subs(
 			qstate->env->detach_subs));
 		(*qstate->env->detach_subs)(qstate);
 		iq->num_target_queries = 0;
@@ -1326,7 +1320,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 */
 		outbound_list_clear(&iq->outlist);
 		iq->num_current_queries = 0;
-		log_assert(fptr_whitelist_modenv_detach_subs(
+		fptr_ok(fptr_whitelist_modenv_detach_subs(
 			qstate->env->detach_subs));
 		(*qstate->env->detach_subs)(qstate);
 		iq->num_target_queries = 0;
@@ -1342,8 +1336,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			 * gotten this from cache, so test to be sure */
 			if(!infra_set_lame(qstate->env->infra_cache, 
 				&qstate->reply->addr, qstate->reply->addrlen, 
-				iq->dp->name, iq->dp->namelen, time(NULL),
-				dnsseclame))
+				iq->dp->name, iq->dp->namelen, 
+				*qstate->env->now, dnsseclame))
 				log_err("mark host lame: out of memory");
 		} else log_err("%slame response from cache",
 			dnsseclame?"DNSSEC ":"");
@@ -1572,11 +1566,6 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 					LDNS_RCODE_SERVFAIL);
 		}
 	}
-	if(query_dname_compare(qstate->qinfo.qname, 
-		iq->response->qinfo.qname) == 0) {
-		/* use server supplied upper/lower case */
-		qstate->qinfo.qname = iq->response->qinfo.qname;
-	}
 	qstate->return_rcode = LDNS_RCODE_NOERROR;
 	qstate->return_msg = iq->response;
 	return 0;

libunbound/context.c

@@ -51,11 +51,13 @@
 #include "util/storage/slabhash.h"
 
 int 
-context_finalize(struct ub_val_ctx* ctx)
+context_finalize(struct ub_ctx* ctx)
 {
 	struct config_file* cfg = ctx->env->cfg;
 	verbosity = cfg->verbosity;
-	log_init(cfg->logfile, cfg->use_syslog, NULL);
+	if(ctx->logfile_override)
+		log_file(ctx->log_out);
+	else	log_init(cfg->logfile, cfg->use_syslog, NULL);
 	config_apply(cfg);
 	if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env))
 		return UB_INITFAIL;
@@ -99,7 +101,7 @@ void
 context_query_delete(struct ctx_query* q) 
 {
 	if(!q) return;
-	ub_val_resolve_free(q->res);
+	ub_resolve_free(q->res);
 	free(q->msg);
 	free(q);
 }
@@ -108,7 +110,7 @@ context_query_delete(struct ctx_query* q)
 #define NUM_ID_TRIES 100000
 /** find next useful id number of 0 on error */
 static int
-find_id(struct ub_val_ctx* ctx, int* id)
+find_id(struct ub_ctx* ctx, int* id)
 {
 	size_t tries = 0;
 	ctx->next_querynum++;
@@ -122,8 +124,8 @@ find_id(struct ub_val_ctx* ctx, int* id)
 }
 
 struct ctx_query* 
-context_new(struct ub_val_ctx* ctx, char* name, int rrtype, int rrclass, 
-	ub_val_callback_t cb, void* cbarg)
+context_new(struct ub_ctx* ctx, char* name, int rrtype, int rrclass, 
+	ub_callback_t cb, void* cbarg)
 {
 	struct ctx_query* q = (struct ctx_query*)calloc(1, sizeof(*q));
 	if(!q) return NULL;
@@ -138,7 +140,7 @@ context_new(struct ub_val_ctx* ctx, char* name, int rrtype, int rrclass,
 	q->async = (cb != NULL);
 	q->cb = cb;
 	q->cb_arg = cbarg;
-	q->res = (struct ub_val_result*)calloc(1, sizeof(*q->res));
+	q->res = (struct ub_result*)calloc(1, sizeof(*q->res));
 	if(!q->res) {
 		free(q);
 		return NULL;
@@ -162,7 +164,7 @@ context_new(struct ub_val_ctx* ctx, char* name, int rrtype, int rrclass,
 }
 
 struct alloc_cache* 
-context_obtain_alloc(struct ub_val_ctx* ctx, int locking)
+context_obtain_alloc(struct ub_ctx* ctx, int locking)
 {
 	struct alloc_cache* a;
 	int tnum = 0;
@@ -188,7 +190,7 @@ context_obtain_alloc(struct ub_val_ctx* ctx, int locking)
 }
 
 void 
-context_release_alloc(struct ub_val_ctx* ctx, struct alloc_cache* alloc,
+context_release_alloc(struct ub_ctx* ctx, struct alloc_cache* alloc,
 	int locking)
 {
 	if(!ctx || !alloc)
@@ -227,7 +229,7 @@ context_serialize_new_query(struct ctx_query* q, uint32_t* len)
 }
 
 struct ctx_query* 
-context_deserialize_new_query(struct ub_val_ctx* ctx, uint8_t* p, uint32_t len)
+context_deserialize_new_query(struct ub_ctx* ctx, uint8_t* p, uint32_t len)
 {
 	struct ctx_query* q = (struct ctx_query*)calloc(1, sizeof(*q));
 	if(!q) return NULL;
@@ -239,7 +241,7 @@ context_deserialize_new_query(struct ub_val_ctx* ctx, uint8_t* p, uint32_t len)
 	q->querynum = (int)ldns_read_uint32(p+sizeof(uint32_t));
 	q->node.key = &q->querynum;
 	q->async = 1;
-	q->res = (struct ub_val_result*)calloc(1, sizeof(*q->res));
+	q->res = (struct ub_result*)calloc(1, sizeof(*q->res));
 	if(!q->res) {
 		free(q);
 		return NULL;
@@ -260,7 +262,7 @@ context_deserialize_new_query(struct ub_val_ctx* ctx, uint8_t* p, uint32_t len)
 }
 
 struct ctx_query* 
-context_lookup_new_query(struct ub_val_ctx* ctx, uint8_t* p, uint32_t len)
+context_lookup_new_query(struct ub_ctx* ctx, uint8_t* p, uint32_t len)
 {
 	struct ctx_query* q;
 	int querynum;
@@ -304,7 +306,7 @@ context_serialize_answer(struct ctx_query* q, int err, ldns_buffer* pkt,
 }
 
 struct ctx_query* 
-context_deserialize_answer(struct ub_val_ctx* ctx,
+context_deserialize_answer(struct ub_ctx* ctx,
         uint8_t* p, uint32_t len, int* err)
 {
 	struct ctx_query* q = NULL ;
@@ -343,7 +345,7 @@ context_serialize_cancel(struct ctx_query* q, uint32_t* len)
 	return p;
 }
 
-struct ctx_query* context_deserialize_cancel(struct ub_val_ctx* ctx,
+struct ctx_query* context_deserialize_cancel(struct ub_ctx* ctx,
         uint8_t* p, uint32_t len)
 {
 	struct ctx_query* q;

libunbound/context.h

@@ -55,7 +55,7 @@ struct libworker;
  *	qq : write queries to the async service pid/tid.
  *	rr : read results from the async service pid/tid.
  */
-struct ub_val_ctx {
+struct ub_ctx {
 	/* --- pipes --- */
 	/** mutex on query write pipe */
 	lock_basic_t qqpipe_lock;
@@ -87,6 +87,10 @@ struct ub_val_ctx {
 	int dothread;
 	/** next thread number for new threads */
 	int thr_next_num;
+	/** if logfile is overriden */
+	int logfile_override;
+	/** what logfile to use instead */
+	FILE* log_out;
 	/** 
 	 * List of alloc-cache-id points per threadnum for notinuse threads.
 	 * Simply the entire struct alloc_cache with the 'super' member used
@@ -137,7 +141,7 @@ struct ctx_query {
 	int cancelled;
 
 	/** for async query, the callback function */
-	ub_val_callback_t cb;
+	ub_callback_t cb;
 	/** for async query, the callback user arg */
 	void* cb_arg;
 
@@ -152,7 +156,7 @@ struct ctx_query {
 
 	/** result structure, also contains original query, type, class.
 	 * malloced ptr ready to hand to the client. */
-	struct ub_val_result* res;
+	struct ub_result* res;
 };
 
 /**
@@ -206,7 +210,7 @@ enum ub_ctx_cmd {
  * @param ctx: context to finalize. creates shared data.
  * @return 0 if OK, or errcode.
  */
-int context_finalize(struct ub_val_ctx* ctx);
+int context_finalize(struct ub_ctx* ctx);
 
 /** compare two ctx_query elements */
 int context_query_cmp(const void* a, const void* b);
@@ -227,8 +231,8 @@ void context_query_delete(struct ctx_query* q);
  * @param cbarg: user arg for async queries.
  * @return new ctx_query or NULL for malloc failure.
  */
-struct ctx_query* context_new(struct ub_val_ctx* ctx, char* name, int rrtype,
-        int rrclass, ub_val_callback_t cb, void* cbarg);
+struct ctx_query* context_new(struct ub_ctx* ctx, char* name, int rrtype,
+        int rrclass, ub_callback_t cb, void* cbarg);
 
 /**
  * Get a new alloc. Creates a new one or uses a cached one.
@@ -236,7 +240,7 @@ struct ctx_query* context_new(struct ub_val_ctx* ctx, char* name, int rrtype,
  * @param locking: if true, cfglock is locked while getting alloc.
  * @return an alloc, or NULL on mem error.
  */
-struct alloc_cache* context_obtain_alloc(struct ub_val_ctx* ctx, int locking);
+struct alloc_cache* context_obtain_alloc(struct ub_ctx* ctx, int locking);
 
 /**
  * Release an alloc. Puts it into the cache.
@@ -244,7 +248,7 @@ struct alloc_cache* context_obtain_alloc(struct ub_val_ctx* ctx, int locking);
  * @param locking: if true, cfglock is locked while releasing alloc.
  * @param alloc: alloc to relinquish.
  */
-void context_release_alloc(struct ub_val_ctx* ctx, struct alloc_cache* alloc,
+void context_release_alloc(struct ub_ctx* ctx, struct alloc_cache* alloc,
 	int locking);
 
 /**
@@ -301,7 +305,7 @@ enum ub_ctx_cmd context_serial_getcmd(uint8_t* p, uint32_t len);
  * @param len: length of buffer.
  * @return looked up ctx_query or NULL for malloc failure.
  */
-struct ctx_query* context_lookup_new_query(struct ub_val_ctx* ctx, 
+struct ctx_query* context_lookup_new_query(struct ub_ctx* ctx, 
 	uint8_t* p, uint32_t len);
 
 /**
@@ -311,7 +315,7 @@ struct ctx_query* context_lookup_new_query(struct ub_val_ctx* ctx,
  * @param len: length of buffer.
  * @return new ctx_query or NULL for malloc failure.
  */
-struct ctx_query* context_deserialize_new_query(struct ub_val_ctx* ctx, 
+struct ctx_query* context_deserialize_new_query(struct ub_ctx* ctx, 
 	uint8_t* p, uint32_t len);
 
 /**
@@ -322,7 +326,7 @@ struct ctx_query* context_deserialize_new_query(struct ub_val_ctx* ctx,
  * @param err: error code to be returned to client is passed.
  * @return ctx_query with answer added or NULL for malloc failure.
  */
-struct ctx_query* context_deserialize_answer(struct ub_val_ctx* ctx, 
+struct ctx_query* context_deserialize_answer(struct ub_ctx* ctx, 
 	uint8_t* p, uint32_t len, int* err);
 
 /**
@@ -332,7 +336,7 @@ struct ctx_query* context_deserialize_answer(struct ub_val_ctx* ctx,
  * @param len: length of buffer.
  * @return ctx_query to cancel or NULL for failure.
  */
-struct ctx_query* context_deserialize_cancel(struct ub_val_ctx* ctx, 
+struct ctx_query* context_deserialize_cancel(struct ub_ctx* ctx, 
 	uint8_t* p, uint32_t len);
 
 #endif /* LIBUNBOUND_CONTEXT_H */

libunbound/libunbound.c

@@ -59,16 +59,16 @@
 #include "services/cache/infra.h"
 #include "services/cache/rrset.h"
 
-struct ub_val_ctx* 
-ub_val_ctx_create()
+struct ub_ctx* 
+ub_ctx_create()
 {
-	struct ub_val_ctx* ctx;
+	struct ub_ctx* ctx;
 	unsigned int seed;
 	log_init(NULL, 0, NULL); /* logs to stderr */
 	log_ident_set("libunbound");
 	verbosity = 0; /* errors only */
 	checklock_start();
-	ctx = (struct ub_val_ctx*)calloc(1, sizeof(*ctx));
+	ctx = (struct ub_ctx*)calloc(1, sizeof(*ctx));
 	if(!ctx) {
 		errno = ENOMEM;
 		return NULL;
@@ -154,7 +154,7 @@ delq(rbnode_t* n, void* ATTR_UNUSED(arg))
 }
 
 void 
-ub_val_ctx_delete(struct ub_val_ctx* ctx)
+ub_ctx_delete(struct ub_ctx* ctx)
 {
 	struct alloc_cache* a, *na;
 	if(!ctx) return;
@@ -234,7 +234,23 @@ ub_val_ctx_delete(struct ub_val_ctx* ctx)
 }
 
 int 
-ub_val_ctx_config(struct ub_val_ctx* ctx, char* fname)
+ub_ctx_set_option(struct ub_ctx* ctx, char* opt, char* val)
+{
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_AFTERFINAL;
+	}
+	if(!config_set_option(ctx->env->cfg, opt, val)) {
+		lock_basic_unlock(&ctx->cfglock);
+		return UB_SYNTAX;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
+int 
+ub_ctx_config(struct ub_ctx* ctx, char* fname)
 {
 	lock_basic_lock(&ctx->cfglock);
 	if(ctx->finalized) {
@@ -250,7 +266,7 @@ ub_val_ctx_config(struct ub_val_ctx* ctx, char* fname)
 }
 
 int 
-ub_val_ctx_add_ta(struct ub_val_ctx* ctx, char* ta)
+ub_ctx_add_ta(struct ub_ctx* ctx, char* ta)
 {
 	char* dup = strdup(ta);
 	if(!dup) return UB_NOMEM;
@@ -269,7 +285,7 @@ ub_val_ctx_add_ta(struct ub_val_ctx* ctx, char* ta)
 }
 
 int 
-ub_val_ctx_add_ta_file(struct ub_val_ctx* ctx, char* fname)
+ub_ctx_add_ta_file(struct ub_ctx* ctx, char* fname)
 {
 	char* dup = strdup(fname);
 	if(!dup) return UB_NOMEM;
@@ -288,7 +304,7 @@ ub_val_ctx_add_ta_file(struct ub_val_ctx* ctx, char* fname)
 }
 
 int 
-ub_val_ctx_trustedkeys(struct ub_val_ctx* ctx, char* fname)
+ub_ctx_trustedkeys(struct ub_ctx* ctx, char* fname)
 {
 	char* dup = strdup(fname);
 	if(!dup) return UB_NOMEM;
@@ -307,7 +323,7 @@ ub_val_ctx_trustedkeys(struct ub_val_ctx* ctx, char* fname)
 }
 
 int
-ub_val_ctx_debuglevel(struct ub_val_ctx* ctx, int d)
+ub_ctx_debuglevel(struct ub_ctx* ctx, int d)
 {
 	lock_basic_lock(&ctx->cfglock);
 	verbosity = d;
@@ -316,8 +332,18 @@ ub_val_ctx_debuglevel(struct ub_val_ctx* ctx, int d)
 	return UB_NOERROR;
 }
 
+int ub_ctx_debugout(struct ub_ctx* ctx, void* out)
+{
+	lock_basic_lock(&ctx->cfglock);
+	log_file((FILE*)out);
+	ctx->logfile_override = 1;
+	ctx->log_out = out;
+	lock_basic_unlock(&ctx->cfglock);
+	return UB_NOERROR;
+}
+
 int 
-ub_val_ctx_async(struct ub_val_ctx* ctx, int dothread)
+ub_ctx_async(struct ub_ctx* ctx, int dothread)
 {
 #if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 	if(dothread) /* cannot do threading */
@@ -335,7 +361,7 @@ ub_val_ctx_async(struct ub_val_ctx* ctx, int dothread)
 
 /** perform a select() on the result read pipe */
 static int 
-pollit(struct ub_val_ctx* ctx, struct timeval* t)
+pollit(struct ub_ctx* ctx, struct timeval* t)
 {
 	fd_set r;
 #ifndef S_SPLINT_S
@@ -350,7 +376,7 @@ pollit(struct ub_val_ctx* ctx, struct timeval* t)
 }
 
 int 
-ub_val_poll(struct ub_val_ctx* ctx)
+ub_poll(struct ub_ctx* ctx)
 {
 	struct timeval t;
 	memset(&t, 0, sizeof(t));
@@ -359,16 +385,16 @@ ub_val_poll(struct ub_val_ctx* ctx)
 }
 
 int 
-ub_val_fd(struct ub_val_ctx* ctx)
+ub_fd(struct ub_ctx* ctx)
 {
 	return ctx->rrpipe[0];
 }
 
 /** process answer from bg worker */
 static int
-process_answer_detail(struct ub_val_ctx* ctx, uint8_t* msg, uint32_t len,
-	ub_val_callback_t* cb, void** cbarg, int* err,
-	struct ub_val_result** res)
+process_answer_detail(struct ub_ctx* ctx, uint8_t* msg, uint32_t len,
+	ub_callback_t* cb, void** cbarg, int* err,
+	struct ub_result** res)
 {
 	struct ctx_query* q;
 	if(context_serial_getcmd(msg, len) != UB_LIBCMD_ANSWER) {
@@ -397,7 +423,7 @@ process_answer_detail(struct ub_val_ctx* ctx, uint8_t* msg, uint32_t len,
 	}
 	if(*err) {
 		*res = NULL;
-		ub_val_resolve_free(q->res);
+		ub_resolve_free(q->res);
 	} else {
 		/* parse the message, extract rcode, fill result */
 		ldns_buffer* buf = ldns_buffer_new(q->msg_len);
@@ -411,6 +437,9 @@ process_answer_detail(struct ub_val_ctx* ctx, uint8_t* msg, uint32_t len,
 			libworker_enter_result(*res, buf, region,
 				q->msg_security);
 		}
+		(*res)->answer_packet = q->msg;
+		(*res)->answer_len = (int)q->msg_len;
+		q->msg = NULL;
 		ldns_buffer_free(buf);
 		regional_destroy(region);
 	}
@@ -422,17 +451,18 @@ process_answer_detail(struct ub_val_ctx* ctx, uint8_t* msg, uint32_t len,
 	lock_basic_unlock(&ctx->cfglock);
 
 	if(*cb) return 2;
+	ub_resolve_free(*res);
 	return 1;
 }
 
 /** process answer from bg worker */
 static int
-process_answer(struct ub_val_ctx* ctx, uint8_t* msg, uint32_t len)
+process_answer(struct ub_ctx* ctx, uint8_t* msg, uint32_t len)
 {
 	int err;
-	ub_val_callback_t cb;
+	ub_callback_t cb;
 	void* cbarg;
-	struct ub_val_result* res;
+	struct ub_result* res;
 	int r;
 
 	r = process_answer_detail(ctx, msg, len, &cb, &cbarg, &err, &res);
@@ -446,7 +476,7 @@ process_answer(struct ub_val_ctx* ctx, uint8_t* msg, uint32_t len)
 }
 
 int 
-ub_val_process(struct ub_val_ctx* ctx)
+ub_process(struct ub_ctx* ctx)
 {
 	int r;
 	uint8_t* msg;
@@ -470,12 +500,12 @@ ub_val_process(struct ub_val_ctx* ctx)
 }
 
 int 
-ub_val_wait(struct ub_val_ctx* ctx)
+ub_wait(struct ub_ctx* ctx)
 {
 	int err;
-	ub_val_callback_t cb;
+	ub_callback_t cb;
 	void* cbarg;
-	struct ub_val_result* res;
+	struct ub_result* res;
 	int r;
 	uint8_t* msg;
 	uint32_t len;
@@ -511,6 +541,7 @@ ub_val_wait(struct ub_val_ctx* ctx)
 			r = process_answer_detail(ctx, msg, len, 
 				&cb, &cbarg, &err, &res);
 			lock_basic_unlock(&ctx->rrpipe_lock);
+			free(msg);
 			if(r == 0)
 				return UB_PIPE;
 			if(r == 2)
@@ -523,8 +554,8 @@ ub_val_wait(struct ub_val_ctx* ctx)
 }
 
 int 
-ub_val_resolve(struct ub_val_ctx* ctx, char* name, int rrtype, 
-	int rrclass, struct ub_val_result** result)
+ub_resolve(struct ub_ctx* ctx, char* name, int rrtype, 
+	int rrclass, struct ub_result** result)
 {
 	struct ctx_query* q;
 	int r;
@@ -553,6 +584,9 @@ ub_val_resolve(struct ub_val_ctx* ctx, char* name, int rrtype,
 		lock_basic_unlock(&ctx->cfglock);
 		return r;
 	}
+	q->res->answer_packet = q->msg;
+	q->res->answer_len = (int)q->msg_len;
+	q->msg = NULL;
 	*result = q->res;
 	q->res = NULL;
 
@@ -564,8 +598,8 @@ ub_val_resolve(struct ub_val_ctx* ctx, char* name, int rrtype,
 }
 
 int 
-ub_val_resolve_async(struct ub_val_ctx* ctx, char* name, int rrtype, 
-	int rrclass, void* mydata, ub_val_callback_t callback, int* async_id)
+ub_resolve_async(struct ub_ctx* ctx, char* name, int rrtype, 
+	int rrclass, void* mydata, ub_callback_t callback, int* async_id)
 {
 	struct ctx_query* q;
 	uint8_t* msg = NULL;
@@ -627,7 +661,7 @@ ub_val_resolve_async(struct ub_val_ctx* ctx, char* name, int rrtype,
 }
 
 int 
-ub_val_cancel(struct ub_val_ctx* ctx, int async_id)
+ub_cancel(struct ub_ctx* ctx, int async_id)
 {
 	struct ctx_query* q;
 	uint8_t* msg = NULL;
@@ -646,8 +680,8 @@ ub_val_cancel(struct ub_val_ctx* ctx, int async_id)
 	if(!ctx->dothread) { /* if forked */
 		(void)rbtree_delete(&ctx->queries, q->node.key);
 		ctx->num_async--;
-		context_query_delete(q);
 		msg = context_serialize_cancel(q, &len);
+		context_query_delete(q);
 		lock_basic_unlock(&ctx->cfglock);
 		if(!msg) {
 			return UB_NOMEM;
@@ -668,7 +702,7 @@ ub_val_cancel(struct ub_val_ctx* ctx, int async_id)
 }
 
 void 
-ub_val_resolve_free(struct ub_val_result* result)
+ub_resolve_free(struct ub_result* result)
 {
 	char** p;
 	if(!result) return;
@@ -680,11 +714,12 @@ ub_val_resolve_free(struct ub_val_result* result)
 			free(*p);
 	free(result->data);
 	free(result->len);
+	free(result->answer_packet);
 	free(result);
 }
 
 const char* 
-ub_val_strerror(int err)
+ub_strerror(int err)
 {
 	switch(err) {
 		case UB_NOERROR: return "no error";
@@ -702,7 +737,7 @@ ub_val_strerror(int err)
 }
 
 int 
-ub_val_ctx_set_fwd(struct ub_val_ctx* ctx, char* addr)
+ub_ctx_set_fwd(struct ub_ctx* ctx, char* addr)
 {
 	struct sockaddr_storage storage;
 	socklen_t stlen;
@@ -774,7 +809,7 @@ ub_val_ctx_set_fwd(struct ub_val_ctx* ctx, char* addr)
 }
 
 int 
-ub_val_ctx_resolvconf(struct ub_val_ctx* ctx, char* fname)
+ub_ctx_resolvconf(struct ub_ctx* ctx, char* fname)
 {
 	FILE* in;
 	int numserv = 0;
@@ -806,7 +841,7 @@ ub_val_ctx_resolvconf(struct ub_val_ctx* ctx, char* fname)
 			/* terminate after the address, remove newline */
 			*parse = 0;
 			
-			if((r = ub_val_ctx_set_fwd(ctx, addr)) != UB_NOERROR) {
+			if((r = ub_ctx_set_fwd(ctx, addr)) != UB_NOERROR) {
 				fclose(in);
 				return r;
 			}
@@ -815,7 +850,85 @@ ub_val_ctx_resolvconf(struct ub_val_ctx* ctx, char* fname)
 	fclose(in);
 	if(numserv == 0) {
 		/* from resolv.conf(5) if none given, use localhost */
-		return ub_val_ctx_set_fwd(ctx, "127.0.0.1");
+		return ub_ctx_set_fwd(ctx, "127.0.0.1");
 	}
 	return UB_NOERROR;
 }
+
+int
+ub_ctx_hosts(struct ub_ctx* ctx, char* fname)
+{
+	FILE* in;
+	char buf[1024], ldata[1024];
+	char* parse, *addr, *name, *ins;
+	lock_basic_lock(&ctx->cfglock);
+	if(ctx->finalized) {
+		lock_basic_unlock(&ctx->cfglock);
+		errno=EINVAL;
+		return UB_AFTERFINAL;
+	}
+	lock_basic_unlock(&ctx->cfglock);
+	if(fname == NULL)
+		fname = "/etc/hosts";
+	in = fopen(fname, "r");
+	if(!in) {
+		/* error in errno! perror(fname) */
+		return UB_READFILE;
+	}
+	while(fgets(buf, (int)sizeof(buf), in)) {
+		buf[sizeof(buf)-1] = 0;
+		parse=buf;
+		while(*parse == ' ' || *parse == '\t')
+			parse++;
+		if(*parse == '#')
+			continue; /* skip comment */
+		/* format: <addr> spaces <name> spaces <name> ... */
+		addr = parse;
+		/* skip addr */
+		while(isxdigit(*parse) || *parse == '.' || *parse == ':')
+			parse++;
+		if(*parse == '\n' || *parse == 0)
+			continue;
+		if(*parse != ' ' && *parse != '\t') {
+			/* must have whitespace after address */
+			fclose(in);
+			errno=EINVAL;
+			return UB_SYNTAX;
+		}
+		*parse++ = 0; /* end delimiter for addr ... */
+		/* go to names and add them */
+		while(*parse) {
+			while(*parse == ' ' || *parse == '\t' || *parse=='\n')
+				parse++;
+			if(*parse == 0 || *parse == '#')
+				break;
+			/* skip name, allows (too) many printable characters */
+			name = parse;
+			while('!' <= *parse && *parse <= '~')
+				parse++;
+			if(*parse)
+				*parse++ = 0; /* end delimiter for name */
+			snprintf(ldata, sizeof(ldata), "%s %s %s",
+				name, str_is_ip6(addr)?"AAAA":"A", addr);
+			ins = strdup(ldata);
+			if(!ins) {
+				/* out of memory */
+				fclose(in);
+				errno=ENOMEM;
+				return UB_NOMEM;
+			}
+			lock_basic_lock(&ctx->cfglock);
+			if(!cfg_strlist_insert(&ctx->env->cfg->local_data, 
+				ins)) {
+				lock_basic_unlock(&ctx->cfglock);
+				fclose(in);
+				free(ins);
+				errno=ENOMEM;
+				return UB_NOMEM;
+			}
+			lock_basic_unlock(&ctx->cfglock);
+		}
+	}
+	fclose(in);
+	return UB_NOERROR;
+}

libunbound/libworker.c

@@ -88,7 +88,7 @@ libworker_delete(struct libworker* w)
 
 /** setup fresh libworker struct */
 static struct libworker*
-libworker_setup(struct ub_val_ctx* ctx, int is_bg)
+libworker_setup(struct ub_ctx* ctx, int is_bg)
 {
 	unsigned int seed;
 	struct libworker* w = (struct libworker*)calloc(1, sizeof(*w));
@@ -153,7 +153,7 @@ libworker_setup(struct ub_val_ctx* ctx, int is_bg)
 		(size_t)cfg->outgoing_num_ports, cfg->out_ifs,
 		cfg->num_out_ifs, cfg->do_ip4, cfg->do_ip6, -1, 
 		cfg->do_tcp?cfg->outgoing_num_tcp:0,
-		w->env->infra_cache, w->env->rnd);
+		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id);
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);
 	}
@@ -172,6 +172,7 @@ libworker_setup(struct ub_val_ctx* ctx, int is_bg)
 	w->env->attach_sub = &mesh_attach_sub;
 	w->env->kill_sub = &mesh_state_delete;
 	w->env->detect_cycle = &mesh_detect_cycle;
+	comm_base_timept(w->base, &w->env->now, &w->env->now_tv);
 	return w;
 }
 
@@ -354,7 +355,7 @@ libworker_dobg(void* arg)
 	uint32_t m;
 	int fd;
 	struct libworker* w = (struct libworker*)arg;
-	struct ub_val_ctx* ctx = w->ctx;
+	struct ub_ctx* ctx = w->ctx;
 	log_thread_set(&w->thread_num);
 #if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 	/* we are forked */
@@ -399,7 +400,7 @@ libworker_dobg(void* arg)
 	return NULL;
 }
 
-int libworker_bg(struct ub_val_ctx* ctx)
+int libworker_bg(struct ub_ctx* ctx)
 {
 	struct libworker* w;
 	/* fork or threadcreate */
@@ -457,7 +458,7 @@ parse_reply(ldns_buffer* pkt, struct regional* region, struct query_info* qi)
 
 /** insert canonname */
 static int
-fill_canon(struct ub_val_result* res, uint8_t* s)
+fill_canon(struct ub_result* res, uint8_t* s)
 {
 	char buf[255+2];
 	dname_str(s, buf);
@@ -467,7 +468,7 @@ fill_canon(struct ub_val_result* res, uint8_t* s)
 
 /** fill data into result */
 static int
-fill_res(struct ub_val_result* res, struct ub_packed_rrset_key* answer,
+fill_res(struct ub_result* res, struct ub_packed_rrset_key* answer,
 	uint8_t* finalcname, struct query_info* rq)
 {
 	size_t i;
@@ -504,7 +505,7 @@ fill_res(struct ub_val_result* res, struct ub_packed_rrset_key* answer,
 
 /** fill result from parsed message, on error fills servfail */
 void
-libworker_enter_result(struct ub_val_result* res, ldns_buffer* buf,
+libworker_enter_result(struct ub_result* res, ldns_buffer* buf,
 	struct regional* temp, enum sec_status msg_security)
 {
 	struct query_info rq;
@@ -591,7 +592,7 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 	return 1;
 }
 
-int libworker_fg(struct ub_val_ctx* ctx, struct ctx_query* q)
+int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
 {
 	struct libworker* w = libworker_setup(ctx, 0);
 	uint16_t qflags, qid;
@@ -690,7 +691,7 @@ libworker_bg_done_cb(void* arg, int rcode, ldns_buffer* buf, enum sec_status s)
 	if(q->cancelled) {
 		if(q->w->is_bg_thread) {
 			/* delete it now */
-			struct ub_val_ctx* ctx = q->w->ctx;
+			struct ub_ctx* ctx = q->w->ctx;
 			lock_basic_lock(&ctx->cfglock);
 			(void)rbtree_delete(&ctx->queries, q->node.key);
 			ctx->num_async--;
@@ -934,14 +935,18 @@ libworker_read_msg(int fd, uint8_t** buf, uint32_t* len, int nonblock)
 	if((r=read(fd, *buf, *len)) == -1) {
 		log_err("msg read failed: %s", strerror(errno));
 		(void)fd_set_nonblock(fd);
+		free(*buf);
 		return 0;
 	}
 	if(r == 0) { /* EOF */
 		(void)fd_set_nonblock(fd);
+		free(*buf);
 		return 0;
 	}
-	if(!fd_set_nonblock(fd))
+	if(!fd_set_nonblock(fd)) {
+		free(*buf);
 		return 0;
+	}
 	return 1;
 }
 

libunbound/libworker.h

@@ -44,8 +44,8 @@
 #ifndef LIBUNBOUND_WORKER_H
 #define LIBUNBOUND_WORKER_H
 #include "util/data/packed_rrset.h"
-struct ub_val_ctx;
-struct ub_val_result;
+struct ub_ctx;
+struct ub_result;
 struct module_env;
 struct comm_base;
 struct outside_network;
@@ -66,7 +66,7 @@ struct libworker {
 	/** every worker has a unique thread_num. (first in struct) */
 	int thread_num;
 	/** context we are operating under */
-	struct ub_val_ctx* ctx;
+	struct ub_ctx* ctx;
 
 	/** is this the bg worker? */
 	int is_bg;
@@ -122,7 +122,7 @@ struct libworker_res_list {
  * @return 0 if OK, else error.
  *	Further communication is done via the pipes in ctx. 
  */
-int libworker_bg(struct ub_val_ctx* ctx);
+int libworker_bg(struct ub_ctx* ctx);
 
 /**
  * Create a foreground worker.
@@ -133,7 +133,7 @@ int libworker_bg(struct ub_val_ctx* ctx);
  * @param q: query (result is stored in here).
  * @return 0 if finished OK, else error.
  */
-int libworker_fg(struct ub_val_ctx* ctx, struct ctx_query* q);
+int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q);
 
 /** cleanup the cache to remove all rrset IDs from it, arg is libworker */
 void libworker_alloc_cleanup(void* arg);
@@ -230,7 +230,7 @@ int libworker_read_msg(int fd, uint8_t** buf, uint32_t* len, int nonblock);
  *   On error, the res may contain a different status 
  *   (out of memory is not secure, not bogus).
  */
-void libworker_enter_result(struct ub_val_result* res, ldns_buffer* buf,
+void libworker_enter_result(struct ub_result* res, ldns_buffer* buf,
 	struct regional* temp, enum sec_status msg_security);
 
 #endif /* LIBUNBOUND_WORKER_H */

libunbound/ubsyms.def

@@ -1,19 +1,22 @@
-ub_val_ctx_create
-ub_val_ctx_delete
-ub_val_ctx_config
-ub_val_ctx_set_fwd
-ub_val_ctx_resolvconf
-ub_val_ctx_add_ta
-ub_val_ctx_add_ta_file
-ub_val_ctx_trustedkeys
-ub_val_ctx_debuglevel
-ub_val_ctx_async
-ub_val_poll
-ub_val_wait
-ub_val_fd
-ub_val_process
-ub_val_resolve
-ub_val_resolve_async
-ub_val_cancel
-ub_val_resolve_free
-ub_val_strerror
+ub_ctx_create
+ub_ctx_delete
+ub_ctx_set_option
+ub_ctx_config
+ub_ctx_set_fwd
+ub_ctx_resolvconf
+ub_ctx_hosts
+ub_ctx_add_ta
+ub_ctx_add_ta_file
+ub_ctx_trustedkeys
+ub_ctx_debugout
+ub_ctx_debuglevel
+ub_ctx_async
+ub_poll
+ub_wait
+ub_fd
+ub_process
+ub_resolve
+ub_resolve_async
+ub_cancel
+ub_resolve_free
+ub_strerror

libunbound/unbound.h

@@ -43,29 +43,29 @@
  * to perform (validated) DNS lookups.
  *
  * All start with
- *	ctx = ub_val_ctx_create();
- *	err = ub_val_ctx_add_ta(ctx, "...");
- *	err = ub_val_ctx_add_ta(ctx, "...");
+ *	ctx = ub_ctx_create();
+ *	err = ub_ctx_add_ta(ctx, "...");
+ *	err = ub_ctx_add_ta(ctx, "...");
  *	... some lookups
- *	... call ub_val_ctx_delete(ctx); when you want to stop.
+ *	... call ub_ctx_delete(ctx); when you want to stop.
  *
  * Application not threaded. Blocking.
- *	int err = ub_val_resolve(ctx, "www.example.com", ...
- *	if(err) fprintf(stderr, "lookup error: %s\n", ub_val_strerror(err));
+ *	int err = ub_resolve(ctx, "www.example.com", ...
+ *	if(err) fprintf(stderr, "lookup error: %s\n", ub_strerror(err));
  *	... use the answer
  *
  * Application not threaded. Non-blocking ('asynchronous').
- *      err = ub_val_resolve_async(ctx, "www.example.com", ... my_callback);
+ *      err = ub_resolve_async(ctx, "www.example.com", ... my_callback);
  *	... application resumes processing ...
- *	... and when either ub_val_poll(ctx) is true
- *	... or when the file descriptor ub_val_fd(ctx) is readable,
+ *	... and when either ub_poll(ctx) is true
+ *	... or when the file descriptor ub_fd(ctx) is readable,
  *	... or whenever, the app calls ...
- *	ub_val_process(ctx);
+ *	ub_process(ctx);
  *	... if no result is ready, the app resumes processing above,
  *	... or process() calls my_callback() with results.
  *
  *      ... if the application has nothing more to do, wait for answer
- *      ub_val_wait(ctx); 
+ *      ub_wait(ctx); 
  *
  * Application threaded. Blocking.
  *	Blocking, same as above. The current thread does the work.
@@ -74,7 +74,7 @@
  *
  * Application threaded. Non-blocking ('asynchronous').
  *	... setup threaded-asynchronous config option
- *	err = ub_val_ctx_async(ctx, 1);
+ *	err = ub_ctx_async(ctx, 1);
  *	... same as async for non-threaded
  *	... the callbacks are called in the thread that calls process(ctx)
  *
@@ -84,7 +84,7 @@
  * Otherwise, for asynchronous with threading, a worker thread is created.
  *
  * The blocking calls use shared ctx-cache when threaded. Thus
- * ub_val_resolve() and ub_val_resolve_async() && ub_val_wait() are
+ * ub_resolve() and ub_resolve_async() && ub_wait() are
  * not the same. The first makes the current thread do the work, setting
  * up buffers, etc, to perform the work (but using shared cache data).
  * The second calls another worker thread (or process) to perform the work.
@@ -100,14 +100,14 @@
  *
  * Its contents are internally defined.
  */
-struct ub_val_ctx;
+struct ub_ctx;
 
 /**
  * The validation and resolution results.
  * Allocated by the resolver, and need to be freed by the application
- * with ub_val_resolve_free().
+ * with ub_resolve_free().
  */
-struct ub_val_result {
+struct ub_result {
 	/** The original question, name text string. */
 	char* qname;
 	/** the type asked for */
@@ -139,6 +139,13 @@ struct ub_val_result {
 	 */
 	int rcode;
 
+	/**
+	 * The DNS answer packet. Network formatted. Can contain DNSSEC types.
+	 */
+	void* answer_packet;
+	/** length of the answer packet in octets. */
+	int answer_len;
+
 	/**
 	 * If there is any data, this is true.
 	 * If false, there was no data (nxdomain may be true, rcode can be set).
@@ -179,7 +186,7 @@ struct ub_val_result {
 /**
  * Callback for results of async queries.
  * The readable function definition looks like:
- * void my_callback(void* my_arg, int err, struct ub_val_result* result);
+ * void my_callback(void* my_arg, int err, struct ub_result* result);
  * It is called with
  *	void* my_arg: your pointer to a (struct of) data of your choice, 
  *		or NULL.
@@ -187,23 +194,40 @@ struct ub_val_result {
  *	     are forthcoming.
  *	struct result: pointer to more detailed result structure.
  *		This structure is allocated on the heap and needs to be
- *		freed with ub_val_resolve_free(result);
+ *		freed with ub_resolve_free(result);
  */
-typedef void (*ub_val_callback_t)(void*, int, struct ub_val_result*);
+typedef void (*ub_callback_t)(void*, int, struct ub_result*);
 
 /**
  * Create a resolving and validation context.
+ * The information from /etc/resolv.conf and /etc/hosts is not utilised by
+ * default. Use ub_ctx_resolvconf and ub_ctx_hosts to read them.
  * @return a new context. default initialisation.
  * 	returns NULL on error.
  */
-struct ub_val_ctx* ub_val_ctx_create(void);
+struct ub_ctx* ub_ctx_create(void);
 
 /**
  * Destroy a validation context and free all its resources.
  * Outstanding async queries are killed and callbacks are not called for them.
  * @param ctx: context to delete.
  */
-void ub_val_ctx_delete(struct ub_val_ctx* ctx);
+void ub_ctx_delete(struct ub_ctx* ctx);
+
+/**
+ * Set an option for the context.
+ * @param ctx: context.
+ * @param opt: option name from the unbound.conf config file format.
+ *	(not all settings applicable). The name includes the trailing ':'
+ *	for example ub_ctx_set_option("logfile:", "mylog.txt");
+ * 	This is a power-users interface that lets you specify all sorts
+ * 	of options.
+ * 	For some specific options, such as adding trust anchors, special
+ * 	routines exist.
+ * @param val: value of the option.
+ * @return: 0 if OK, else error.
+ */
+int ub_ctx_set_option(struct ub_ctx* ctx, char* opt, char* val);
 
 /**
  * setup configuration for the given context.
@@ -215,7 +239,7 @@ void ub_val_ctx_delete(struct ub_val_ctx* ctx);
  * 	routines exist.
  * @return: 0 if OK, else error.
  */
-int ub_val_ctx_config(struct ub_val_ctx* ctx, char* fname);
+int ub_ctx_config(struct ub_ctx* ctx, char* fname);
 
 /**
  * Set machine to forward DNS queries to, the caching resolver to use. 
@@ -225,7 +249,7 @@ int ub_val_ctx_config(struct ub_val_ctx* ctx, char* fname);
  * that case the addresses are used as backup servers.
  *
  * To read the list of nameservers from /etc/resolv.conf (from DHCP or so),
- * use the call ub_val_ctx_resolvconf.
+ * use the call ub_ctx_resolvconf.
  *
  * @param ctx: context.
  *	At this time it is only possible to set configuration before the
@@ -234,7 +258,7 @@ int ub_val_ctx_config(struct ub_val_ctx* ctx, char* fname);
  * 	If the addr is NULL, forwarding is disabled.
  * @return 0 if OK, else error.
  */
-int ub_val_ctx_set_fwd(struct ub_val_ctx* ctx, char* addr);
+int ub_ctx_set_fwd(struct ub_ctx* ctx, char* addr);
 
 /**
  * Read list of nameservers to use from the filename given.
@@ -250,7 +274,20 @@ int ub_val_ctx_set_fwd(struct ub_val_ctx* ctx, char* addr);
  * @param fname: file name string. If NULL "/etc/resolv.conf" is used.
  * @return 0 if OK, else error.
  */
-int ub_val_ctx_resolvconf(struct ub_val_ctx* ctx, char* fname);
+int ub_ctx_resolvconf(struct ub_ctx* ctx, char* fname);
+
+/**
+ * Read list of hosts from the filename given.
+ * Usually "/etc/hosts". 
+ * These addresses are not flagged as DNSSEC secure when queried for.
+ *
+ * @param ctx: context.
+ *	At this time it is only possible to set configuration before the
+ *	first resolve is done.
+ * @param fname: file name string. If NULL "/etc/hosts" is used.
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_hosts(struct ub_ctx* ctx, char* fname);
 
 /**
  * Add a trust anchor to the given context.
@@ -263,7 +300,7 @@ int ub_val_ctx_resolvconf(struct ub_val_ctx* ctx, char* fname);
  * 	[domainname] [TTL optional] [type] [class optional] [rdata contents]
  * @return 0 if OK, else error.
  */
-int ub_val_ctx_add_ta(struct ub_val_ctx* ctx, char* ta);
+int ub_ctx_add_ta(struct ub_ctx* ctx, char* ta);
 
 /**
  * Add trust anchors to the given context.
@@ -274,7 +311,7 @@ int ub_val_ctx_add_ta(struct ub_val_ctx* ctx, char* ta);
  * @param fname: filename of file with keyfile with trust anchors.
  * @return 0 if OK, else error.
  */
-int ub_val_ctx_add_ta_file(struct ub_val_ctx* ctx, char* fname);
+int ub_ctx_add_ta_file(struct ub_ctx* ctx, char* fname);
 
 /**
  * Add trust anchors to the given context.
@@ -286,7 +323,17 @@ int ub_val_ctx_add_ta_file(struct ub_val_ctx* ctx, char* fname);
  * 	anchors.
  * @return 0 if OK, else error.
  */
-int ub_val_ctx_trustedkeys(struct ub_val_ctx* ctx, char* fname);
+int ub_ctx_trustedkeys(struct ub_ctx* ctx, char* fname);
+
+/**
+ * Set debug output (and error output) to the specified stream.
+ * Pass NULL to disable. Default is stderr.
+ * @param ctx: context.
+ * @param out: FILE* out file stream to log to.
+ * 	Type void* to avoid stdio dependency of this header file.
+ * @return 0 if OK, else error.
+ */
+int ub_ctx_debugout(struct ub_ctx* ctx, void* out);
 
 /**
  * Set debug verbosity for the context
@@ -296,7 +343,7 @@ int ub_val_ctx_trustedkeys(struct ub_val_ctx* ctx, char* fname);
  *	and 3 is lots.
  * @return 0 if OK, else error.
  */
-int ub_val_ctx_debuglevel(struct ub_val_ctx* ctx, int d);
+int ub_ctx_debuglevel(struct ub_ctx* ctx, int d);
 
 /**
  * Set a context behaviour for asynchronous action.
@@ -308,7 +355,7 @@ int ub_val_ctx_debuglevel(struct ub_val_ctx* ctx, int d);
  *	no effect (delete and re-create the context to change).
  * @return 0 if OK, else error.
  */
-int ub_val_ctx_async(struct ub_val_ctx* ctx, int dothread);
+int ub_ctx_async(struct ub_ctx* ctx, int dothread);
 
 /**
  * Poll a context to see if it has any new results
@@ -318,27 +365,27 @@ int ub_val_ctx_async(struct ub_val_ctx* ctx, int dothread);
  * @return: 0 if nothing to read, or nonzero if a result is available.
  * 	If nonzero, call ctx_process() to do callbacks.
  */
-int ub_val_poll(struct ub_val_ctx* ctx);
+int ub_poll(struct ub_ctx* ctx);
 
 /**
- * Wait for a context to finish with results. Calls ub_val_process() after
+ * Wait for a context to finish with results. Calls ub_process() after
  * the wait for you. After the wait, there are no more outstanding 
  * asynchronous queries.
  * @param ctx: context.
  * @return: 0 if OK, else error.
  */
-int ub_val_wait(struct ub_val_ctx* ctx);
+int ub_wait(struct ub_ctx* ctx);
 
 /**
  * Get file descriptor. Wait for it to become readable, at this point
  * answers are returned from the asynchronous validating resolver.
- * Then call the ub_val_process to continue processing.
+ * Then call the ub_process to continue processing.
  * This routine works immediately after context creation, the fd
  * does not change.
  * @param ctx: context.
  * @return: -1 on error, or file descriptor to use select(2) with.
  */
-int ub_val_fd(struct ub_val_ctx* ctx);
+int ub_fd(struct ub_ctx* ctx);
 
 /**
  * Call this routine to continue processing results from the validating
@@ -347,7 +394,7 @@ int ub_val_fd(struct ub_val_ctx* ctx);
  * @param ctx: context
  * @return: 0 if OK, else error.
  */
-int ub_val_process(struct ub_val_ctx* ctx);
+int ub_process(struct ub_ctx* ctx);
 
 /**
  * Perform resolution and validation of the target name.
@@ -361,8 +408,8 @@ int ub_val_process(struct ub_val_ctx* ctx);
  * 	in that case (out of memory).
  * @return 0 if OK, else error.
  */
-int ub_val_resolve(struct ub_val_ctx* ctx, char* name, int rrtype, 
-	int rrclass, struct ub_val_result** result);
+int ub_resolve(struct ub_ctx* ctx, char* name, int rrtype, 
+	int rrclass, struct ub_result** result);
 
 /**
  * Perform resolution and validation of the target name.
@@ -379,7 +426,7 @@ int ub_val_resolve(struct ub_val_ctx* ctx, char* name, int rrtype,
  * 	and is passed on to the callback function.
  * @param callback: this is called on completion of the resolution.
  * 	It is called as:
- * 	void callback(void* mydata, int err, struct ub_val_result* result)
+ * 	void callback(void* mydata, int err, struct ub_result* result)
  * 	with mydata: the same as passed here, you may pass NULL,
  * 	with err: is 0 when a result has been found.
  * 	with result: a newly allocated result structure.
@@ -392,8 +439,8 @@ int ub_val_resolve(struct ub_val_ctx* ctx, char* name, int rrtype,
  *	cancel the query.
  * @return 0 if OK, else error.
  */
-int ub_val_resolve_async(struct ub_val_ctx* ctx, char* name, int rrtype, 
-	int rrclass, void* mydata, ub_val_callback_t callback, int* async_id);
+int ub_resolve_async(struct ub_ctx* ctx, char* name, int rrtype, 
+	int rrclass, void* mydata, ub_callback_t callback, int* async_id);
 
 /**
  * Cancel an async query in progress.
@@ -403,19 +450,19 @@ int ub_val_resolve_async(struct ub_val_ctx* ctx, char* name, int rrtype,
  * @param async_id: which query to cancel.
  * @return 0 if OK, else error.
  */
-int ub_val_cancel(struct ub_val_ctx* ctx, int async_id);
+int ub_cancel(struct ub_ctx* ctx, int async_id);
 
 /**
  * Free storage associated with a result structure.
  * @param result: to free
  */
-void ub_val_resolve_free(struct ub_val_result* result);
+void ub_resolve_free(struct ub_result* result);
 
 /** 
  * Convert error value to a human readable string.
  * @param err: error code from one of the ub_val* functions.
  * @return pointer to constant text string, zero terminated.
  */
-const char* ub_val_strerror(int err);
+const char* ub_strerror(int err);
 
 #endif /* _UB_UNBOUND_H */

makedist.sh

@@ -213,6 +213,10 @@ fi
 
 replace_all doc/README
 replace_all doc/unbound.8
+replace_all doc/unbound.conf.5
+replace_all doc/unbound-checkconf.8
+replace_all doc/unbound-host.1
+replace_all doc/libunbound.3
 
 info "Renaming Unbound directory to unbound-$version."
 cd ..

services/cache/dns.c

@@ -52,7 +52,7 @@
 /** store rrsets in the rrset cache. 
  * @param env: module environment with caches.
  * @param rep: contains list of rrsets to store.
- * @param now: current time(NULL).
+ * @param now: current time.
  */
 static void
 store_rrsets(struct module_env* env, struct reply_info* rep, uint32_t now)
@@ -73,7 +73,7 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 	hashvalue_t hash, struct reply_info* rep)
 {
 	struct msgreply_entry* e;
-	uint32_t now = time(NULL), ttl = rep->ttl;
+	uint32_t ttl = rep->ttl;
 	size_t i;
 
 	/* store RRsets */
@@ -82,8 +82,8 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 		rep->ref[i].id = rep->rrsets[i]->id;
 	}
 	reply_info_sortref(rep);
-	reply_info_set_ttls(rep, now);
-	store_rrsets(env, rep, now);
+	reply_info_set_ttls(rep, *env->now);
+	store_rrsets(env, rep, *env->now);
 	if(ttl == 0) {
 		/* we do not store the message, but we did store the RRs,
 		 * which could be useful for delegation information */
@@ -219,7 +219,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 {
 	struct delegpt_ns* ns;
 	struct ub_packed_rrset_key* akey;
-	uint32_t now = time(NULL);
+	uint32_t now = *env->now;
 	for(ns = dp->nslist; ns; ns = ns->next) {
 		if(ns->resolved)
 			continue;
@@ -543,7 +543,7 @@ dns_cache_lookup(struct module_env* env,
 	struct lruhash_entry* e;
 	struct query_info k;
 	hashvalue_t h;
-	uint32_t now = (uint32_t)time(NULL);
+	uint32_t now = *env->now;
 	struct ub_packed_rrset_key* rrset;
 
 	/* lookup first, this has both NXdomains and ANSWER responses */
@@ -630,16 +630,15 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 	if(is_referral) {
 		/* store rrsets */
 		struct rrset_ref ref;
-		uint32_t now = time(NULL);
 		size_t i;
 		for(i=0; i<rep->rrset_count; i++) {
 			packed_rrset_ttl_add((struct packed_rrset_data*)
-				rep->rrsets[i]->entry.data, now);
+				rep->rrsets[i]->entry.data, *env->now);
 			ref.key = rep->rrsets[i];
 			ref.id = rep->rrsets[i]->id;
 			/*ignore ret: it was in the cache, ref updated */
 			(void)rrset_cache_update(env->rrset_cache, &ref, 
-				env->alloc, now);
+				env->alloc, *env->now);
 		}
 		free(rep);
 		return 1;

services/cache/infra.c

@@ -158,7 +158,7 @@ infra_lookup_host_nottl(struct infra_cache* infra,
 struct infra_host_data* 
 infra_lookup_host(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen, int wr,
-        time_t timenow, struct infra_host_key** key)
+        uint32_t timenow, struct infra_host_key** key)
 {
 	struct infra_host_data* data;
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
@@ -186,7 +186,7 @@ infra_lookup_host(struct infra_cache* infra,
  */
 static struct lruhash_entry*
 new_host_entry(struct infra_cache* infra, struct sockaddr_storage* addr, 
-	socklen_t addrlen, time_t tm)
+	socklen_t addrlen, uint32_t tm)
 {
 	struct infra_host_data* data;
 	struct infra_host_key* key = (struct infra_host_key*)malloc(
@@ -214,7 +214,7 @@ new_host_entry(struct infra_cache* infra, struct sockaddr_storage* addr,
 
 int 
 infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
-        socklen_t addrlen, time_t timenow, int* edns_vs, int* to)
+        socklen_t addrlen, uint32_t timenow, int* edns_vs, int* to)
 {
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
 		addrlen, 0);
@@ -260,7 +260,7 @@ hash_lameness(uint8_t* name, size_t namelen)
 
 int 
 infra_lookup_lame(struct infra_host_data* host,
-        uint8_t* name, size_t namelen, time_t timenow)
+        uint8_t* name, size_t namelen, uint32_t timenow)
 {
 	struct lruhash_entry* e;
 	struct infra_lame_key k;
@@ -329,7 +329,7 @@ infra_lame_deldatafunc(void* d, void* ATTR_UNUSED(arg))
 int 
 infra_set_lame(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-        uint8_t* name, size_t namelen, time_t timenow, int dnsseclame)
+        uint8_t* name, size_t namelen, uint32_t timenow, int dnsseclame)
 {
 	struct infra_host_data* data;
 	struct lruhash_entry* e;
@@ -422,7 +422,7 @@ infra_update_tcp_works(struct infra_cache* infra,
 int 
 infra_rtt_update(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-        int roundtrip, time_t timenow)
+        int roundtrip, uint32_t timenow)
 {
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
 		addrlen, 1);
@@ -452,7 +452,7 @@ infra_rtt_update(struct infra_cache* infra,
 int 
 infra_edns_update(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-        int edns_version, time_t timenow)
+        int edns_version, uint32_t timenow)
 {
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
 		addrlen, 1);
@@ -478,7 +478,7 @@ int
 infra_get_lame_rtt(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
         uint8_t* name, size_t namelen, int* lame, int* dnsseclame,
-	int* rtt, time_t timenow)
+	int* rtt, uint32_t timenow)
 {
 	struct infra_host_data* host;
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 

services/cache/infra.h

@@ -63,7 +63,7 @@ struct infra_host_key {
  */
 struct infra_host_data {
 	/** TTL value for this entry. absolute time. */
-	time_t ttl;
+	uint32_t ttl;
 	/** round trip times for timeout calculation */
 	struct rtt_info rtt;
 	/** Names of the zones that are lame. NULL=no lame zones. */
@@ -90,7 +90,7 @@ struct infra_lame_key {
  */
 struct infra_lame_data {
 	/** TTL of this entry. absolute time. */
-	time_t ttl;
+	uint32_t ttl;
 	/** is the host lame (does not serve the zone authoritatively),
 	 * or is the host dnssec lame (does not serve DNSSEC data) */
 	int isdnsseclame;
@@ -151,7 +151,7 @@ struct infra_cache* infra_adjust(struct infra_cache* infra,
  */
 struct infra_host_data* infra_lookup_host(struct infra_cache* infra, 
 	struct sockaddr_storage* addr, socklen_t addrlen, int wr, 
-	time_t timenow, struct infra_host_key** key);
+	uint32_t timenow, struct infra_host_key** key);
 
 /**
  * Find host information to send a packet. Creates new entry if not found.
@@ -166,7 +166,7 @@ struct infra_host_data* infra_lookup_host(struct infra_cache* infra,
  * @return: 0 on error.
  */
 int infra_host(struct infra_cache* infra, struct sockaddr_storage* addr, 
-	socklen_t addrlen, time_t timenow, int* edns_vs, int* to);
+	socklen_t addrlen, uint32_t timenow, int* edns_vs, int* to);
 
 /**
  * Check for lameness of this server for a particular zone.
@@ -178,7 +178,7 @@ int infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
  * @return: 0 if not lame or unknown or timed out, 1 if lame, 2 if dnsseclame.
  */
 int infra_lookup_lame(struct infra_host_data* host,
-	uint8_t* name, size_t namelen, time_t timenow);
+	uint8_t* name, size_t namelen, uint32_t timenow);
 
 /**
  * Set a host to be lame for the given zone.
@@ -194,7 +194,7 @@ int infra_lookup_lame(struct infra_host_data* host,
  */
 int infra_set_lame(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-	uint8_t* name, size_t namelen, time_t timenow, int dnsseclame);
+	uint8_t* name, size_t namelen, uint32_t timenow, int dnsseclame);
 
 /**
  * Update rtt information for the host.
@@ -208,7 +208,7 @@ int infra_set_lame(struct infra_cache* infra,
  */
 int infra_rtt_update(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-	int roundtrip, time_t timenow);
+	int roundtrip, uint32_t timenow);
 
 /**
  * Update information for the host, store that a TCP transaction works.
@@ -230,7 +230,7 @@ void infra_update_tcp_works(struct infra_cache* infra,
  */
 int infra_edns_update(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
-	int edns_version, time_t timenow);
+	int edns_version, uint32_t timenow);
 
 /**
  * Get Lameness information and average RTT if host is in the cache.
@@ -250,7 +250,7 @@ int infra_edns_update(struct infra_cache* infra,
 int infra_get_lame_rtt(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen, 
 	uint8_t* name, size_t namelen, int* lame, int* dnsseclame,
-	int* rtt, time_t timenow);
+	int* rtt, uint32_t timenow);
 
 /**
  * Get memory used by the infra cache.

services/cache/rrset.c

@@ -309,9 +309,8 @@ rrset_array_unlock_touch(struct rrset_cache* r, struct regional* scratch,
 
 void 
 rrset_update_sec_status(struct rrset_cache* r, 
-	struct ub_packed_rrset_key* rrset)
+	struct ub_packed_rrset_key* rrset, uint32_t now)
 {
-	uint32_t now = (uint32_t)time(0);
 	struct packed_rrset_data* updata = 
 		(struct packed_rrset_data*)rrset->entry.data;
 	struct lruhash_entry* e;
@@ -339,9 +338,8 @@ rrset_update_sec_status(struct rrset_cache* r,
 
 void 
 rrset_check_sec_status(struct rrset_cache* r, 
-	struct ub_packed_rrset_key* rrset)
+	struct ub_packed_rrset_key* rrset, uint32_t now)
 {
-	uint32_t now = (uint32_t)time(0);
 	struct packed_rrset_data* updata = 
 		(struct packed_rrset_data*)rrset->entry.data;
 	struct lruhash_entry* e;

services/cache/rrset.h

@@ -192,9 +192,10 @@ void rrset_array_unlock_touch(struct rrset_cache* r, struct regional* scratch,
  * @param r: the rrset cache. 
  * @param rrset: which rrset to attempt to update. This rrset is left 
  * 	untouched. The rrset in the cache is updated in-place.
+ * @param now: current time.
  */
 void rrset_update_sec_status(struct rrset_cache* r, 
-	struct ub_packed_rrset_key* rrset);
+	struct ub_packed_rrset_key* rrset, uint32_t now);
 
 /**
  * Looks up security status of an rrset. Looks up the rrset.
@@ -203,9 +204,10 @@ void rrset_update_sec_status(struct rrset_cache* r,
  * @param r: the rrset cache. 
  * @param rrset: This rrset may change security status due to the cache.
  * 	But its status will only improve, towards secure.
+ * @param now: current time.
  */
 void rrset_check_sec_status(struct rrset_cache* r, 
-	struct ub_packed_rrset_key* rrset);
+	struct ub_packed_rrset_key* rrset, uint32_t now);
 
 /** mark rrset to be deleted, set id=0 */
 void rrset_markdel(void* key);

services/mesh.c

@@ -160,7 +160,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	if(!s->reply_list && !s->cb_list)
 		was_noreply = 1;
 	/* add reply to s */
-	if(!mesh_state_add_reply(s, edns, rep, qid, qflags)) {
+	if(!mesh_state_add_reply(s, edns, rep, qid, qflags, qinfo->qname)) {
 			log_err("mesh_new_client: out of memory; SERVFAIL");
 			error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
 				qinfo, qid, qflags, edns);
@@ -298,7 +298,7 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	/* de-init modules */
 	mesh = mstate->s.env->mesh;
 	for(i=0; i<mesh->mods.num; i++) {
-		log_assert(fptr_whitelist_mod_clear(mesh->mods.mod[i]->clear));
+		fptr_ok(fptr_whitelist_mod_clear(mesh->mods.mod[i]->clear));
 		(*mesh->mods.mod[i]->clear)(&mstate->s, i);
 		mstate->s.minfo[i] = NULL;
 		mstate->s.ext_state[i] = module_finished;
@@ -510,12 +510,14 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
  * @param rcode: if not 0, error code.
  * @param rep: reply to send (or NULL if rcode is set).
  * @param r: reply entry
+ * @param prev: previous reply, already has its answer encoded in buffer.
  */
 static void
 mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
-	struct mesh_reply* r)
+	struct mesh_reply* r, struct mesh_reply* prev)
 {
 	struct timeval end_time;
+	struct timeval duration;
 	int secure;
 	/* examine security status */
 	if(m->s.env->need_to_validate && !(r->qflags&BIT_CD) && rep && 
@@ -528,7 +530,21 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 	if(!rep && rcode == LDNS_RCODE_NOERROR)
 		rcode = LDNS_RCODE_SERVFAIL;
 	/* send the reply */
-	if(rcode) {
+	if(prev && prev->qflags == r->qflags && 
+		prev->edns.edns_present == r->edns.edns_present && 
+		prev->edns.bits == r->edns.bits && 
+		prev->edns.udp_size == r->edns.udp_size) {
+		/* if the previous reply is identical to this one, fix ID */
+		if(prev->query_reply.c->buffer != r->query_reply.c->buffer)
+			ldns_buffer_copy(r->query_reply.c->buffer, 
+				prev->query_reply.c->buffer);
+		ldns_buffer_write_at(r->query_reply.c->buffer, 0, 
+			&r->qid, sizeof(uint16_t));
+		ldns_buffer_write_at(r->query_reply.c->buffer, 12, 
+			r->qname, m->s.qinfo.qname_len);
+		comm_point_send_reply(&r->query_reply);
+	} else if(rcode) {
+		m->s.qinfo.qname = r->qname;
 		error_encode(r->query_reply.c->buffer, rcode, &m->s.qinfo,
 			r->qid, r->qflags, &r->edns);
 		comm_point_send_reply(&r->query_reply);
@@ -538,6 +554,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 		r->edns.udp_size = EDNS_ADVERTISED_SIZE;
 		r->edns.ext_rcode = 0;
 		r->edns.bits &= EDNS_DO;
+		m->s.qinfo.qname = r->qname;
 		if(!reply_info_answer_encode(&m->s.qinfo, rep, r->qid, 
 			r->qflags, r->query_reply.c->buffer, 0, 1, 
 			m->s.env->scratch, udp_size, &r->edns, 
@@ -551,28 +568,25 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 	}
 	/* account */
 	m->s.env->mesh->num_reply_addrs--;
-	if(gettimeofday(&end_time, NULL) < 0) {
-		log_err("gettimeofday: %s", strerror(errno));
-		return;
-	} else {
-		struct timeval duration;
-		timeval_subtract(&duration, &end_time, &r->start_time);
-		verbose(VERB_ALGO, "query took %d.%6.6d sec",
-			(int)duration.tv_sec, (int)duration.tv_usec);
-		m->s.env->mesh->replies_sent++;
-		timeval_add(&m->s.env->mesh->replies_sum_wait, &duration);
-		timehist_insert(m->s.env->mesh->histogram, &duration);
-	}
+	end_time = *m->s.env->now_tv;
+	timeval_subtract(&duration, &end_time, &r->start_time);
+	verbose(VERB_ALGO, "query took %d.%6.6d sec",
+		(int)duration.tv_sec, (int)duration.tv_usec);
+	m->s.env->mesh->replies_sent++;
+	timeval_add(&m->s.env->mesh->replies_sum_wait, &duration);
+	timehist_insert(m->s.env->mesh->histogram, &duration);
 }
 
 void mesh_query_done(struct mesh_state* mstate)
 {
 	struct mesh_reply* r;
+	struct mesh_reply* prev = NULL;
 	struct mesh_cb* c;
 	struct reply_info* rep = (mstate->s.return_msg?
 		mstate->s.return_msg->rep:NULL);
 	for(r = mstate->reply_list; r; r = r->next) {
-		mesh_send_reply(mstate, mstate->s.return_rcode, rep, r);
+		mesh_send_reply(mstate, mstate->s.return_rcode, rep, r, prev);
+		prev = r;
 	}
 	for(c = mstate->cb_list; c; c = c->next) {
 		mesh_do_callback(mstate, mstate->s.return_rcode, rep, c);
@@ -587,7 +601,7 @@ void mesh_walk_supers(struct mesh_area* mesh, struct mesh_state* mstate)
 		/* make super runnable */
 		(void)rbtree_insert(&mesh->run, &ref->s->run_node);
 		/* callback the function to inform super of result */
-		log_assert(fptr_whitelist_mod_inform_super(
+		fptr_ok(fptr_whitelist_mod_inform_super(
 			mesh->mods.mod[ref->s->s.curmod]->inform_super));
 		(*mesh->mods.mod[ref->s->s.curmod]->inform_super)(&mstate->s, 
 			ref->s->s.curmod, &ref->s->s);
@@ -630,7 +644,7 @@ int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
 }
 
 int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
-        struct comm_reply* rep, uint16_t qid, uint16_t qflags)
+        struct comm_reply* rep, uint16_t qid, uint16_t qflags, uint8_t* qname)
 {
 	struct mesh_reply* r = regional_alloc(s->s.region, 
 		sizeof(struct mesh_reply));
@@ -640,11 +654,12 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
 	r->edns = *edns;
 	r->qid = qid;
 	r->qflags = qflags;
-	if(gettimeofday(&r->start_time, NULL) < 0) {
-		log_err("addrep: gettimeofday: %s", strerror(errno));
-		memset(&r->start_time, 0, sizeof(r->start_time));
-	}
+	r->start_time = *s->s.env->now_tv;
 	r->next = s->reply_list;
+	r->qname = regional_alloc_init(s->s.region, qname, 
+		s->s.qinfo.qname_len);
+	if(!r->qname)
+		return 0;
 	s->reply_list = r;
 	return 1;
 
@@ -716,7 +731,7 @@ void mesh_run(struct mesh_area* mesh, struct mesh_state* mstate,
 	verbose(VERB_ALGO, "mesh_run: start");
 	while(mstate) {
 		/* run the module */
-		log_assert(fptr_whitelist_mod_operate(
+		fptr_ok(fptr_whitelist_mod_operate(
 			mesh->mods.mod[mstate->s.curmod]->operate));
 		(*mesh->mods.mod[mstate->s.curmod]->operate)
 			(&mstate->s, ev, mstate->s.curmod, e);
@@ -768,20 +783,21 @@ mesh_log_list(struct mesh_area* mesh)
 void 
 mesh_stats(struct mesh_area* mesh, const char* str)
 {
-	log_info("%s %u states (%u with reply, %u detached), "
-		"%u waiting replies", str, (unsigned)mesh->all.count, 
+	verbose(VERB_DETAIL, "%s %u recursion states (%u with reply, "
+		"%u detached), %u waiting replies, %u recursion replies "
+		"sent", str, (unsigned)mesh->all.count, 
 		(unsigned)mesh->num_reply_states,
 		(unsigned)mesh->num_detached_states,
-		(unsigned)mesh->num_reply_addrs);
+		(unsigned)mesh->num_reply_addrs,
+		(unsigned)mesh->replies_sent);
 	if(mesh->replies_sent > 0) {
 		struct timeval avg;
 		timeval_divide(&avg, &mesh->replies_sum_wait, 
 			mesh->replies_sent);
-		log_info("sent %u replies, with average wait "
-			"of %d.%6.6d sec", (unsigned)mesh->replies_sent,
-			(int)avg.tv_sec, (int)avg.tv_usec);
-		log_info("histogram of reply wait times");
-		timehist_log(mesh->histogram);
+		log_info("average recursion processing time "
+			"%d.%6.6d sec", (int)avg.tv_sec, (int)avg.tv_usec);
+		log_info("histogram of recursion processing times");
+		timehist_log(mesh->histogram, "recursions");
 	}
 }
 

services/mesh.h

@@ -156,6 +156,8 @@ struct mesh_reply {
 	uint16_t qid;
 	/** flags of query, for reply flags */
 	uint16_t qflags;
+	/** qname from this query. len same as mesh qinfo. */
+	uint8_t* qname;
 };
 
 /** 
@@ -375,10 +377,11 @@ int mesh_state_attachment(struct mesh_state* super, struct mesh_state* sub);
  * @param rep: comm point reply info.
  * @param qid: ID of reply.
  * @param qflags: original query flags.
+ * @param qname: original query name.
  * @return: 0 on alloc error.
  */
 int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns, 
-	struct comm_reply* rep, uint16_t qid, uint16_t qflags);
+	struct comm_reply* rep, uint16_t qid, uint16_t qflags, uint8_t* qname);
 
 /**
  * Create new callback structure and attach it to a mesh state.

services/modstack.c

@@ -143,7 +143,7 @@ modstack_setup(struct module_stack* stack, const char* module_conf,
         for(i=0; i<stack->num; i++) {
                 verbose(VERB_OPS, "init module %d: %s",
                         i, stack->mod[i]->name);
-                log_assert(fptr_whitelist_mod_init(stack->mod[i]->init));
+                fptr_ok(fptr_whitelist_mod_init(stack->mod[i]->init));
                 if(!(*stack->mod[i]->init)(env, i)) {
                         log_err("module init for module %s failed",
                                 stack->mod[i]->name);
@@ -158,7 +158,7 @@ modstack_desetup(struct module_stack* stack, struct module_env* env)
 {
         int i;
         for(i=0; i<stack->num; i++) {
-                log_assert(fptr_whitelist_mod_deinit(stack->mod[i]->deinit));
+                fptr_ok(fptr_whitelist_mod_deinit(stack->mod[i]->deinit));
                 (*stack->mod[i]->deinit)(env, i);
         }
         stack->num = 0;

services/outside_network.c

@@ -46,6 +46,7 @@
 #include "util/data/msgparse.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgencode.h"
+#include "util/data/dname.h"
 #include "util/netevent.h"
 #include "util/log.h"
 #include "util/net_help.h"
@@ -91,14 +92,19 @@ serviced_cmp(const void* key1, const void* key2)
 	if(q1->qbuflen > q2->qbuflen)
 		return 1;
 	log_assert(q1->qbuflen == q2->qbuflen);
-	/* will not detect alternate casing of qname */
-	if((r = memcmp(q1->qbuf, q2->qbuf, q1->qbuflen)) != 0)
+	log_assert(q1->qbuflen >= 15 /* 10 header, root, type, class */);
+	/* alternate casing of qname is still the same query */
+	if((r = memcmp(q1->qbuf, q2->qbuf, 10)) != 0)
+		return r;
+	if((r = memcmp(q1->qbuf+q1->qbuflen-4, q2->qbuf+q2->qbuflen-4, 4)) != 0)
 		return r;
 	if(q1->dnssec != q2->dnssec) {
 		if(q1->dnssec < q2->dnssec)
 			return -1;
 		return 1;
 	}
+	if((r = query_dname_compare(q1->qbuf+10, q2->qbuf+10)) != 0)
+		return r;
 	return sockaddr_cmp(&q1->addr, q1->addrlen, &q2->addr, q2->addrlen);
 }
 
@@ -175,7 +181,7 @@ use_free_buffer(struct outside_network* outnet)
 			comm_point_callback_t* cb = w->cb;
 			void* cb_arg = w->cb_arg;
 			waiting_tcp_delete(w);
-			log_assert(fptr_whitelist_pending_tcp(cb));
+			fptr_ok(fptr_whitelist_pending_tcp(cb));
 			(void)(*cb)(NULL, cb_arg, NETEVENT_CLOSED, NULL);
 		}
 	}
@@ -214,7 +220,7 @@ outnet_tcp_cb(struct comm_point* c, void* arg, int error,
 			error = NETEVENT_CLOSED;
 		}
 	}
-	log_assert(fptr_whitelist_pending_tcp(pend->query->cb));
+	fptr_ok(fptr_whitelist_pending_tcp(pend->query->cb));
 	(void)(*pend->query->cb)(c, pend->query->cb_arg, error, reply_info);
 	decomission_pending_tcp(outnet, pend);
 	return 0;
@@ -267,7 +273,7 @@ outnet_udp_cb(struct comm_point* c, void* arg, int error,
 	verbose(VERB_ALGO, "outnet handle udp reply");
 	/* delete from tree first in case callback creates a retry */
 	(void)rbtree_delete(outnet->pending, p->node.key);
-	log_assert(fptr_whitelist_pending_udp(p->cb));
+	fptr_ok(fptr_whitelist_pending_udp(p->cb));
 	(void)(*p->cb)(p->c, p->cb_arg, NETEVENT_NOERROR, reply_info);
 	pending_delete(NULL, p);
 	return 0;
@@ -387,7 +393,7 @@ pending_udp_timer_cb(void *arg)
 	struct pending* p = (struct pending*)arg;
 	/* it timed out */
 	verbose(VERB_ALGO, "timeout udp");
-	log_assert(fptr_whitelist_pending_udp(p->cb));
+	fptr_ok(fptr_whitelist_pending_udp(p->cb));
 	(void)(*p->cb)(p->c, p->cb_arg, NETEVENT_TIMEOUT, NULL);
 	pending_delete(p->outnet, p);
 }
@@ -421,7 +427,7 @@ struct outside_network*
 outside_network_create(struct comm_base *base, size_t bufsize, 
 	size_t num_ports, char** ifs, int num_ifs, int do_ip4, 
 	int do_ip6, int port_base, size_t num_tcp, struct infra_cache* infra,
-	struct ub_randstate* rnd)
+	struct ub_randstate* rnd, int use_caps_for_id)
 {
 	struct outside_network* outnet = (struct outside_network*)
 		calloc(1, sizeof(struct outside_network));
@@ -430,11 +436,13 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 		log_err("malloc failed");
 		return NULL;
 	}
+	comm_base_timept(base, &outnet->now_secs, &outnet->now_tv);
 	outnet->base = base;
 	outnet->num_tcp = num_tcp;
 	outnet->infra = infra;
 	outnet->rnd = rnd;
 	outnet->svcd_overhead = 0;
+	outnet->use_caps_for_id = use_caps_for_id;
 #ifndef INET6
 	do_ip6 = 0;
 #endif
@@ -743,7 +751,7 @@ outnet_tcptimer(void* arg)
 	cb = w->cb;
 	cb_arg = w->cb_arg;
 	waiting_tcp_delete(w);
-	log_assert(fptr_whitelist_pending_tcp(cb));
+	fptr_ok(fptr_whitelist_pending_tcp(cb));
 	(void)(*cb)(NULL, cb_arg, NETEVENT_TIMEOUT, NULL);
 	use_free_buffer(outnet);
 }
@@ -911,10 +919,52 @@ serviced_delete(struct serviced_query* sq)
 	serviced_node_del(&sq->node, NULL);
 }
 
+/** perturb a dname capitalization randomly */
+static void
+serviced_perturb_qname(struct ub_randstate* rnd, uint8_t* qbuf, size_t len)
+{
+	uint8_t lablen;
+	uint8_t* d = qbuf + 10;
+	long int random = 0;
+	int bits = 0;
+	log_assert(len >= 10 + 5 /* offset qname, root, qtype, qclass */);
+	lablen = *d++;
+	while(lablen) {
+		while(lablen--) {
+			/* only perturb A-Z, a-z */
+			if(isalpha((int)*d)) {
+				/* get a random bit */	
+				if(bits == 0) {
+					random = ub_random(rnd);
+					bits = 30;
+				}
+				if(random & 0x1) {
+					*d = (uint8_t)toupper((int)*d);
+				} else {
+					*d = (uint8_t)tolower((int)*d);
+				}
+				random >>= 1;
+				bits--;
+			}
+			d++;
+		}
+		lablen = *d++;
+	}
+	if(verbosity >= VERB_ALGO) {
+		char buf[LDNS_MAX_DOMAINLEN+1];
+		dname_str(qbuf+10, buf);
+		verbose(VERB_ALGO, "qname perturbed to %s", buf);
+	}
+}
+
 /** put serviced query into a buffer */
 static void
 serviced_encode(struct serviced_query* sq, ldns_buffer* buff, int with_edns)
 {
+	/* if we are using 0x20 bits for ID randomness, perturb them */
+	if(sq->outnet->use_caps_for_id) {
+		serviced_perturb_qname(sq->outnet->rnd, sq->qbuf, sq->qbuflen);
+	}
 	/* generate query */
 	ldns_buffer_clear(buff);
 	ldns_buffer_write_u16(buff, 0); /* id placeholder */
@@ -947,7 +997,7 @@ static int
 serviced_udp_send(struct serviced_query* sq, ldns_buffer* buff)
 {
 	int rtt, vs;
-	time_t now = time(0);
+	uint32_t now = *sq->outnet->now_secs;
 
 	if(!infra_host(sq->outnet->infra, &sq->addr, sq->addrlen, now, &vs,
 		&rtt))
@@ -958,10 +1008,7 @@ serviced_udp_send(struct serviced_query* sq, ldns_buffer* buff)
 		else 	sq->status = serviced_query_UDP;
 	}
 	serviced_encode(sq, buff, sq->status == serviced_query_UDP_EDNS);
-	if(gettimeofday(&sq->last_sent_time, NULL) < 0) {
-		log_err("gettimeofday: %s", strerror(errno));
-		return 0;
-	}
+	sq->last_sent_time = *sq->outnet->now_tv;
 	verbose(VERB_ALGO, "serviced query UDP timeout=%d msec", rtt);
 	sq->pending = pending_udp_query(sq->outnet, buff, &sq->addr, 
 		sq->addrlen, rtt, serviced_udp_callback, sq, sq->outnet->rnd);
@@ -970,6 +1017,49 @@ serviced_udp_send(struct serviced_query* sq, ldns_buffer* buff)
 	return 1;
 }
 
+/** check that perturbed qname is identical */
+static int
+serviced_check_qname(ldns_buffer* pkt, uint8_t* qbuf, size_t qbuflen)
+{
+	uint8_t* d1 = ldns_buffer_at(pkt, 12);
+	uint8_t* d2 = qbuf+10;
+	uint8_t len1, len2;
+	int count = 0;
+	log_assert(qbuflen >= 15 /* 10 header, root, type, class */);
+	len1 = *d1++;
+	len2 = *d2++;
+	if(ldns_buffer_limit(pkt) < 12+1+4) /* packet too small for qname */
+		return 0;
+	while(len1 != 0 || len2 != 0) {
+		if(LABEL_IS_PTR(len1)) {
+			d1 = ldns_buffer_at(pkt, PTR_OFFSET(len1, *d1));
+			if(d1 >= ldns_buffer_at(pkt, ldns_buffer_limit(pkt)))
+				return 0;
+			len1 = *d1++;
+			if(count++ > MAX_COMPRESS_PTRS)
+				return 0;
+			continue;
+		}
+		if(d2 > qbuf+qbuflen)
+			return 0;
+		if(len1 != len2)
+			return 0;
+		if(len1 > LDNS_MAX_LABELLEN)
+			return 0;
+		log_assert(len1 <= LDNS_MAX_LABELLEN);
+		log_assert(len2 <= LDNS_MAX_LABELLEN);
+		log_assert(len1 == len2 && len1 != 0);
+		/* compare the labels - bitwise identical */
+		if(memcmp(d1, d2, len1) != 0)
+			return 0;
+		d1 += len1;
+		d2 += len2;
+		len1 = *d1++;
+		len2 = *d2++;
+	}
+	return 1;
+}
+
 /** call the callbacks for a serviced query */
 static void
 serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
@@ -987,6 +1077,36 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
 	log_assert(rem); /* should have been present */
 	sq->to_be_deleted = 1; 
 	verbose(VERB_ALGO, "svcd callbacks start");
+	if(sq->outnet->use_caps_for_id && error == NETEVENT_NOERROR && c) {
+		/* noerror and nxdomain must have a qname in reply */
+		if(ldns_buffer_read_u16_at(c->buffer, 4) == 0 &&
+			(LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer))
+				== LDNS_RCODE_NOERROR || 
+			 LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer))
+				== LDNS_RCODE_NXDOMAIN)) {
+			verbose(VERB_OPS, "no qname in reply to check 0x20ID");
+			log_addr(VERB_OPS, "from server", 
+				&sq->addr, sq->addrlen);
+			log_buf(VERB_OPS, "for packet", c->buffer);
+			error = NETEVENT_CLOSED;
+			c = NULL;
+		} else if(ldns_buffer_read_u16_at(c->buffer, 4) > 0 &&
+			!serviced_check_qname(c->buffer, sq->qbuf, 
+			sq->qbuflen)) {
+			verbose(VERB_OPS, "wrong 0x20-ID in reply qname, "
+				"answer dropped");
+			log_addr(VERB_OPS, "from server", 
+				&sq->addr, sq->addrlen);
+			log_buf(VERB_OPS, "for packet", c->buffer);
+			error = NETEVENT_CLOSED;
+			c = NULL;
+		} else {
+			verbose(VERB_ALGO, "good 0x20-ID in reply qname");
+			/* cleanup caps, prettier cache contents. */
+			pkt_dname_tolower(c->buffer, 
+				ldns_buffer_at(c->buffer, 12));
+		}
+	}
 	if(dobackup && c) {
 		/* make a backup of the query, since the querystate processing
 		 * may send outgoing queries that overwrite the buffer.
@@ -1008,7 +1128,7 @@ serviced_callbacks(struct serviced_query* sq, int error, struct comm_point* c,
 			ldns_buffer_write(c->buffer, backup_p, backlen);
 			ldns_buffer_flip(c->buffer);
 		}
-		log_assert(fptr_whitelist_serviced_query(p->cb));
+		fptr_ok(fptr_whitelist_serviced_query(p->cb));
 		(void)(*p->cb)(c, p->cb_arg, error, rep);
 		p = n;
 	}
@@ -1039,7 +1159,7 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 		LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(ldns_buffer_begin(
 		c->buffer)) == LDNS_RCODE_NOTIMPL) ) {
 		if(!infra_edns_update(sq->outnet->infra, &sq->addr, 
-			sq->addrlen, -1, time(0)))
+			sq->addrlen, -1, *sq->outnet->now_secs))
 			log_err("Out of memory caching no edns for host");
 		sq->status = serviced_query_TCP;
 		serviced_tcp_initiate(sq->outnet, sq, c->buffer);
@@ -1079,19 +1199,15 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 {
 	struct serviced_query* sq = (struct serviced_query*)arg;
 	struct outside_network* outnet = sq->outnet;
-	struct timeval now;
+	struct timeval now = *sq->outnet->now_tv;
 	int fallback_tcp = 0;
-	if(gettimeofday(&now, NULL) < 0) {
-		log_err("gettimeofday: %s", strerror(errno));
-		/* this option does not need current time */
-		error = NETEVENT_CLOSED; 
-	}
+
 	sq->pending = NULL; /* removed after callback */
 	if(error == NETEVENT_TIMEOUT) {
 		int rto = 0;
 		sq->retry++;
 		if(!(rto=infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen,
-			-1, (time_t)now.tv_sec)))
+			-1, (uint32_t)now.tv_sec)))
 			log_err("out of memory in UDP exponential backoff");
 		if(sq->retry < OUTBOUND_UDP_RETRY) {
 			log_name_addr(VERB_ALGO, "retry query", sq->qbuf+10,
@@ -1115,7 +1231,7 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOTIMPL)) {
 		/* note no EDNS, fallback without EDNS */
 		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
-			-1, (time_t)now.tv_sec)) {
+			-1, (uint32_t)now.tv_sec)) {
 			log_err("Out of memory caching no edns for host");
 		}
 		sq->status = serviced_query_UDP;
@@ -1145,7 +1261,7 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "measured roundtrip at %d msec", roundtime);
 		log_assert(roundtime >= 0);
 		if(!infra_rtt_update(outnet->infra, &sq->addr, sq->addrlen, 
-			roundtime, (time_t)now.tv_sec))
+			roundtime, (uint32_t)now.tv_sec))
 			log_err("out of memory noting rtt.");
 	}
 	serviced_callbacks(sq, error, c, rep);

services/outside_network.h

@@ -60,6 +60,10 @@ struct infra_cache;
 struct outside_network {
 	/** Base for select calls */
 	struct comm_base* base;
+	/** pointer to time in seconds */
+	uint32_t* now_secs;
+	/** pointer to time in microseconds */
+	struct timeval* now_tv;
 
 	/** buffer shared by UDP connections, since there is only one
 	    datagram at any time. */
@@ -67,6 +71,8 @@ struct outside_network {
 	/** serviced_callbacks malloc overhead when processing multiple
 	 * identical serviced queries to the same server. */
 	size_t svcd_overhead;
+	/** use x20 bits to encode additional ID random bits */
+	int use_caps_for_id;
 
 	/** 
 	 * Array of udp comm point* that are used to listen to pending events.
@@ -257,12 +263,14 @@ struct serviced_query {
  * @param num_tcp: number of outgoing tcp buffers to preallocate.
  * @param infra: pointer to infra cached used for serviced queries.
  * @param rnd: stored to create random numbers for serviced queries.
+ * @param use_caps_for_id: enable to use 0x20 bits to encode id randomness.
  * @return: the new structure (with no pending answers) or NULL on error.
  */
 struct outside_network* outside_network_create(struct comm_base* base,
 	size_t bufsize, size_t num_ports, char** ifs, int num_ifs,
 	int do_ip4, int do_ip6, int port_base, size_t num_tcp, 
-	struct infra_cache* infra, struct ub_randstate* rnd);
+	struct infra_cache* infra, struct ub_randstate* rnd,
+	int use_caps_for_id);
 
 /**
  * Delete outside_network structure.

smallapp/unbound-host.c

@@ -53,6 +53,7 @@ usage()
 {
 	printf("Usage:	unbound-host [-vdh] [-c class] [-t type] hostname\n");
 	printf("                     [-y key] [-f keyfile] [-F namedkeyfile]\n");
+	printf("                     [-C configfile]\n");
 	printf("  Queries the DNS for information.\n");
 	printf("  The hostname is looked up for IP4, IP6 and mail.\n");
 	printf("  If an ip-address is given a reverse lookup is done.\n");
@@ -63,6 +64,7 @@ usage()
 	printf("			-y 'example.com DS 31560 5 1 1CFED8478...'\n");
 	printf("    -f keyfile		read trust anchors from file, with lines as -y.\n");
 	printf("    -F keyfile		read named.conf-style trust anchors.\n");
+	printf("    -C config		use the specified unbound.conf\n");
 	printf("    -v			be more verbose, shows nodata and security.\n");
 	printf("    -d			debug, traces the action, -d -d shows more.\n");
 	printf("    -h			show this usage help.\n");
@@ -176,7 +178,7 @@ massage_class(const char* c)
 
 /** nice security status string */
 static const char* 
-secure_str(struct ub_val_result* result)
+secure_str(struct ub_result* result)
 {
 	if(result->secure) return "(secure)";
 	if(result->bogus) return "(BOGUS (security failure))";
@@ -274,7 +276,7 @@ pretty_rdata(char* q, char* cstr, char* tstr, int t, const char* sec,
 
 /** pretty line of output for results */
 static void
-pretty_output(char* q, int t, int c, struct ub_val_result* result, int docname)
+pretty_output(char* q, int t, int c, struct ub_result* result, int docname)
 {
 	int i;
 	const char *secstatus = secure_str(result);
@@ -337,25 +339,25 @@ pretty_output(char* q, int t, int c, struct ub_val_result* result, int docname)
 
 /** perform a lookup and printout return if domain existed */
 static int
-dnslook(struct ub_val_ctx* ctx, char* q, int t, int c, int docname)
+dnslook(struct ub_ctx* ctx, char* q, int t, int c, int docname)
 {
 	int ret;
-	struct ub_val_result* result;
+	struct ub_result* result;
 
-	ret = ub_val_resolve(ctx, q, t, c, &result);
+	ret = ub_resolve(ctx, q, t, c, &result);
 	if(ret != 0) {
-		fprintf(stderr, "resolve error: %s\n", ub_val_strerror(ret));
+		fprintf(stderr, "resolve error: %s\n", ub_strerror(ret));
 		exit(1);
 	}
 	pretty_output(q, t, c, result, docname);
 	ret = result->nxdomain;
-	ub_val_resolve_free(result);
+	ub_resolve_free(result);
 	return ret;
 }
 
 /** perform host lookup */
 static void
-lookup(struct ub_val_ctx* ctx, const char* nm, const char* qt, const char* qc)
+lookup(struct ub_ctx* ctx, const char* nm, const char* qt, const char* qc)
 {
 	/* massage input into a query name, type and class */
 	int multi = 0;	 /* no type, so do A, AAAA, MX */
@@ -374,10 +376,20 @@ lookup(struct ub_val_ctx* ctx, const char* nm, const char* qt, const char* qc)
 	} else {
 		(void)dnslook(ctx, realq, t, c, 1);
 	}
-	ub_val_ctx_delete(ctx);
+	ub_ctx_delete(ctx);
 	free(realq);
 }
 
+/** print error if any */
+static void
+check_ub_res(int r)
+{
+	if(r != 0) {
+		fprintf(stderr, "error: %s\n", ub_strerror(r));
+		exit(1);
+	}
+}
+
 /** getopt global, in case header files fail to declare it. */
 extern int optind;
 /** getopt global, in case header files fail to declare it. */
@@ -389,26 +401,29 @@ int main(int argc, char* argv[])
 	int c;
 	char* qclass = NULL;
 	char* qtype = NULL;
-	struct ub_val_ctx* ctx = NULL;
+	struct ub_ctx* ctx = NULL;
 	int debuglevel = 0;
 	
-	ctx = ub_val_ctx_create();
+	ctx = ub_ctx_create();
 	if(!ctx) {
 		fprintf(stderr, "error: out of memory\n");
 		exit(1);
 	}
 
 	/* parse the options */
-	while( (c=getopt(argc, argv, "F:c:df:ht:vy:")) != -1) {
+	while( (c=getopt(argc, argv, "F:c:df:ht:vy:C:")) != -1) {
 		switch(c) {
 		case 'c':
 			qclass = optarg;
 			break;
+		case 'C':
+			check_ub_res(ub_ctx_config(ctx, optarg));
+			break;
 		case 'd':
 			debuglevel++;
 			if(debuglevel < 2) 
 				debuglevel = 2; /* at least VERB_DETAIL */
-			ub_val_ctx_debuglevel(ctx, debuglevel);
+			check_ub_res(ub_ctx_debuglevel(ctx, debuglevel));
 			break;
 		case 't':
 			qtype = optarg;
@@ -417,13 +432,13 @@ int main(int argc, char* argv[])
 			verb++;
 			break;
 		case 'y':
-			ub_val_ctx_add_ta(ctx, optarg);
+			check_ub_res(ub_ctx_add_ta(ctx, optarg));
 			break;
 		case 'f':
-			ub_val_ctx_add_ta_file(ctx, optarg);
+			check_ub_res(ub_ctx_add_ta_file(ctx, optarg));
 			break;
 		case 'F':
-			ub_val_ctx_trustedkeys(ctx, optarg);
+			check_ub_res(ub_ctx_trustedkeys(ctx, optarg));
 			break;
 		case '?':
 		case 'h':

testcode/asynclook.c

@@ -56,7 +56,7 @@ struct lookinfo {
 	/** error code from libunbound */
 	int err;
 	/** result from lookup */
-	struct ub_val_result* result;
+	struct ub_result* result;
 };
 
 /** global variable to see how many queries we have left */
@@ -72,6 +72,7 @@ void usage(char* argv[])
 	printf("	-d : enable debug output\n");
 	printf("	-f addr : use addr, forward to that server\n");
 	printf("	-h : this help message\n");
+	printf("	-H fname : read hosts from fname\n");
 	printf("	-r fname : read resolv.conf from fname\n");
 	printf("	-t : use a resolver thread instead of forking a process\n");
 	printf("	-x : perform extended threaded test\n");
@@ -85,7 +86,7 @@ print_result(struct lookinfo* info)
 	char buf[100];
 	if(info->err) /* error (from libunbound) */
 		printf("%s: error %s\n", info->name,
-			ub_val_strerror(info->err));
+			ub_strerror(info->err));
 	else if(!info->result)
 		printf("%s: cancelled\n", info->name);
 	else if(info->result->havedata)
@@ -105,9 +106,9 @@ print_result(struct lookinfo* info)
 	}
 }
 
-/** this is a function of type ub_val_callback_t */
+/** this is a function of type ub_callback_t */
 static void 
-lookup_is_done(void* mydata, int err, struct ub_val_result* result)
+lookup_is_done(void* mydata, int err, struct ub_result* result)
 {
 	/* cast mydata back to the correct type */
 	struct lookinfo* info = (struct lookinfo*)mydata;
@@ -123,7 +124,7 @@ static void
 checkerr(const char* desc, int err)
 {
 	if(err != 0) {
-		printf("%s error: %s\n", desc, ub_val_strerror(err));
+		printf("%s error: %s\n", desc, ub_strerror(err));
 		exit(1);
 	}
 }
@@ -143,7 +144,7 @@ struct ext_thr_info {
 	/** thread id */
 	ub_thread_t tid;
 	/** context */
-	struct ub_val_ctx* ctx;
+	struct ub_ctx* ctx;
 	/** size of array to query */
 	int argc;
 	/** array of names to query */
@@ -157,7 +158,7 @@ static int q_is_localhost = 0;
 
 /** check result structure for the 'correct' answer */
 static void
-ext_check_result(const char* desc, int err, struct ub_val_result* result)
+ext_check_result(const char* desc, int err, struct ub_result* result)
 {
 	checkerr(desc, err);
 	if(result == NULL) {
@@ -215,12 +216,22 @@ ext_check_result(const char* desc, int err, struct ub_val_result* result)
 				"wrong.\n", desc);
 			exit(1);
 		}
+		if(result->answer_packet == NULL) {
+			printf("%s: error result->answer_packet is NULL.\n", 
+				desc);
+			exit(1);
+		}
+		if(result->answer_len != 54) {
+			printf("%s: error result->answer_len is wrong.\n", 
+				desc);
+			exit(1);
+		}
 	}
 }
 
-/** extended bg result callback, this function is ub_val_callback_t */
+/** extended bg result callback, this function is ub_callback_t */
 static void 
-ext_callback(void* mydata, int err, struct ub_val_result* result)
+ext_callback(void* mydata, int err, struct ub_result* result)
 {
 	int* my_id = (int*)mydata;
 	int doprint = 0;
@@ -243,7 +254,7 @@ ext_callback(void* mydata, int err, struct ub_val_result* result)
 		pi.err = 0;
 		print_result(&pi);
 	}
-	ub_val_resolve_free(result);
+	ub_resolve_free(result);
 }
 
 /** extended thread worker */
@@ -252,7 +263,7 @@ ext_thread(void* arg)
 {
 	struct ext_thr_info* inf = (struct ext_thr_info*)arg;
 	int i, r;
-	struct ub_val_result* result;
+	struct ub_result* result;
 	int* async_ids = NULL;
 	log_thread_set(&inf->thread_num);
 	if(inf->thread_num > NUMTHR*2/3) {
@@ -264,32 +275,35 @@ ext_thread(void* arg)
 	}
 	for(i=0; i<inf->numq; i++) {
 		if(async_ids) {
-			r = ub_val_resolve_async(inf->ctx, 
+			r = ub_resolve_async(inf->ctx, 
 				inf->argv[i%inf->argc], LDNS_RR_TYPE_A, 
 				LDNS_RR_CLASS_IN, &async_ids[i], ext_callback, 
 				&async_ids[i]);
-			checkerr("ub_val_resolve_async", r);
+			checkerr("ub_resolve_async", r);
 			if(i > 100) {
-				r = ub_val_cancel(inf->ctx, async_ids[i-100]);
-				checkerr("ub_val_cancel", r);
-				async_ids[i-100]=0;
+				r = ub_cancel(inf->ctx, async_ids[i-100]);
+				checkerr("ub_cancel", r);
+			}
+			if(i > 200) {
+				async_ids[i-200]=0;
 			}
 		} else if(inf->thread_num > NUMTHR/2) {
 			/* async */
-			r = ub_val_resolve_async(inf->ctx, 
+			r = ub_resolve_async(inf->ctx, 
 				inf->argv[i%inf->argc], LDNS_RR_TYPE_A, 
 				LDNS_RR_CLASS_IN, NULL, ext_callback, NULL);
-			checkerr("ub_val_resolve_async", r);
+			checkerr("ub_resolve_async", r);
 		} else  {
 			/* blocking */
-			r = ub_val_resolve(inf->ctx, inf->argv[i%inf->argc], 
+			r = ub_resolve(inf->ctx, inf->argv[i%inf->argc], 
 				LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN, &result);
-			ext_check_result("ub_val_resolve", r, result);
+			ext_check_result("ub_resolve", r, result);
+			ub_resolve_free(result);
 		}
 	}
 	if(inf->thread_num > NUMTHR/2) {
-		r = ub_val_wait(inf->ctx);
-		checkerr("ub_val_ctx_wait", r);
+		r = ub_wait(inf->ctx);
+		checkerr("ub_ctx_wait", r);
 	}
 	free(async_ids);
 	
@@ -298,7 +312,7 @@ ext_thread(void* arg)
 
 /** perform extended threaded test */
 static int
-ext_test(struct ub_val_ctx* ctx, int argc, char** argv)
+ext_test(struct ub_ctx* ctx, int argc, char** argv)
 {
 	struct ext_thr_info inf[NUMTHR];
 	int i;
@@ -319,7 +333,7 @@ ext_test(struct ub_val_ctx* ctx, int argc, char** argv)
 		ub_thread_join(inf[i].tid);
 	}
 	printf("extended test end\n");
-	ub_val_ctx_delete(ctx);
+	ub_ctx_delete(ctx);
 	checklock_stop();
 	return 0;
 }
@@ -333,7 +347,7 @@ extern char* optarg;
 int main(int argc, char** argv) 
 {
 	int c;
-	struct ub_val_ctx* ctx;
+	struct ub_ctx* ctx;
 	struct lookinfo* lookups;
 	int i, r, cancel=0, blocking=0, ext=0;
 
@@ -341,7 +355,7 @@ int main(int argc, char** argv)
 	checklock_start();
 
 	/* create context */
-	ctx = ub_val_ctx_create();
+	ctx = ub_ctx_create();
 	if(!ctx) {
 		printf("could not create context, %s\n", strerror(errno));
 		return 1;
@@ -351,15 +365,15 @@ int main(int argc, char** argv)
 	if(argc == 1) {
 		usage(argv);
 	}
-	while( (c=getopt(argc, argv, "bcdf:hr:tx")) != -1) {
+	while( (c=getopt(argc, argv, "bcdf:hH:r:tx")) != -1) {
 		switch(c) {
 			case 'd':
-				r = ub_val_ctx_debuglevel(ctx, 3);
-				checkerr("ub_val_ctx_debuglevel", r);
+				r = ub_ctx_debuglevel(ctx, 3);
+				checkerr("ub_ctx_debuglevel", r);
 				break;
 			case 't':
-				r = ub_val_ctx_async(ctx, 1);
-				checkerr("ub_val_ctx_async", r);
+				r = ub_ctx_async(ctx, 1);
+				checkerr("ub_ctx_async", r);
 				break;
 			case 'c':
 				cancel = 1;
@@ -368,18 +382,28 @@ int main(int argc, char** argv)
 				blocking = 1;
 				break;
 			case 'r':
-				r = ub_val_ctx_resolvconf(ctx, optarg);
+				r = ub_ctx_resolvconf(ctx, optarg);
 				if(r != 0) {
-					printf("ub_val_ctx_resolvconf "
+					printf("ub_ctx_resolvconf "
 						"error: %s : %s\n",
-						ub_val_strerror(r), 
+						ub_strerror(r), 
+						strerror(errno));
+					return 1;
+				}
+				break;
+			case 'H':
+				r = ub_ctx_hosts(ctx, optarg);
+				if(r != 0) {
+					printf("ub_ctx_hosts "
+						"error: %s : %s\n",
+						ub_strerror(r), 
 						strerror(errno));
 					return 1;
 				}
 				break;
 			case 'f':
-				r = ub_val_ctx_set_fwd(ctx, optarg);
-				checkerr("ub_val_ctx_set_fwd", r);
+				r = ub_ctx_set_fwd(ctx, optarg);
+				checkerr("ub_ctx_set_fwd", r);
 				break;
 			case 'x':
 				ext = 1;
@@ -410,15 +434,15 @@ int main(int argc, char** argv)
 		lookups[i].name = argv[i];
 		if(blocking) {
 			fprintf(stderr, "lookup %s\n", argv[i]);
-			r = ub_val_resolve(ctx, argv[i], LDNS_RR_TYPE_A,
+			r = ub_resolve(ctx, argv[i], LDNS_RR_TYPE_A,
 				LDNS_RR_CLASS_IN, &lookups[i].result);
-			checkerr("ub_val_resolve", r);
+			checkerr("ub_resolve", r);
 		} else {
 			fprintf(stderr, "start async lookup %s\n", argv[i]);
-			r = ub_val_resolve_async(ctx, argv[i], LDNS_RR_TYPE_A,
+			r = ub_resolve_async(ctx, argv[i], LDNS_RR_TYPE_A,
 				LDNS_RR_CLASS_IN, &lookups[i], &lookup_is_done, 
 				&lookups[i].async_id);
-			checkerr("ub_val_resolve_async", r);
+			checkerr("ub_resolve_async", r);
 		}
 	}
 	if(blocking)
@@ -426,8 +450,8 @@ int main(int argc, char** argv)
 	else if(cancel) {
 		for(i=0; i<argc; i++) {
 			fprintf(stderr, "cancel %s\n", argv[i]);
-			r = ub_val_cancel(ctx, lookups[i].async_id);
-			checkerr("ub_val_cancel", r);
+			r = ub_cancel(ctx, lookups[i].async_id);
+			checkerr("ub_cancel", r);
 		}
 		num_wait = 0;
 	}
@@ -437,8 +461,8 @@ int main(int argc, char** argv)
 	    for(i=0; i<1000; i++) {
 		usleep(100000);
 		fprintf(stderr, "%g seconds passed\n", 0.1*(double)i);
-		r = ub_val_process(ctx);
-		checkerr("ub_val_process", r);
+		r = ub_process(ctx);
+		checkerr("ub_process", r);
 		if(num_wait == 0)
 			break;
 	}
@@ -451,10 +475,10 @@ int main(int argc, char** argv)
 	/* print lookup results */
 	for(i=0; i<argc; i++) {
 		print_result(&lookups[i]);
-		ub_val_resolve_free(lookups[i].result);
+		ub_resolve_free(lookups[i].result);
 	}
 
-	ub_val_ctx_delete(ctx);
+	ub_ctx_delete(ctx);
 	free(lookups);
 	checklock_stop();
 	return 0;

testcode/do-tests.sh

@@ -2,12 +2,13 @@
 
 NEED_SPLINT='00-lint.tpkg'
 NEED_DOXYGEN='01-doc.tpkg'
-NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg fwd_ancil.tpkg stat_timer.tpkg'
+NEED_LDNS_TESTNS='fwd_no_edns.tpkg fwd_tcp_tc.tpkg fwd_tcp.tpkg fwd_three_service.tpkg fwd_three.tpkg fwd_ttlexpire.tpkg fwd_udp.tpkg fwd_tcp_tc6.tpkg fwd_compress_c00c.tpkg fwd_ancil.tpkg stat_timer.tpkg 05-asynclook.tpkg stream_tcp.tpkg speed_cache.tpkg'
 NEED_XXD='fwd_compress_c00c.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg'
 
 cd testdata;
 sh ../testcode/mini_tpkg.sh clean
+rm -f .perfstats.txt
 for test in `ls *.tpkg`; do
 	SKIP=0
 	if echo $NEED_SPLINT | grep $test >/dev/null; then
@@ -43,3 +44,4 @@ for test in `ls *.tpkg`; do
 	fi
 done
 sh ../testcode/mini_tpkg.sh report
+cat .perfstats.txt

testcode/fake_event.c

@@ -592,6 +592,14 @@ comm_base_delete(struct comm_base* b)
 	free(runtime);
 }
 
+void
+comm_base_timept(struct comm_base* b, uint32_t** tt, struct timeval** tv)
+{
+	struct replay_runtime* runtime = (struct replay_runtime*)b;
+	*tt = &runtime->now_secs;
+	*tv = &runtime->now_tv;
+}
+
 void 
 comm_base_dispatch(struct comm_base* b)
 {
@@ -678,7 +686,7 @@ outside_network_create(struct comm_base* base, size_t bufsize,
 	int ATTR_UNUSED(num_ifs), int ATTR_UNUSED(do_ip4), 
 	int ATTR_UNUSED(do_ip6), int ATTR_UNUSED(port_base),
 	size_t ATTR_UNUSED(num_tcp), struct infra_cache* ATTR_UNUSED(infra),
-	struct ub_randstate* ATTR_UNUSED(rnd))
+	struct ub_randstate* ATTR_UNUSED(rnd), int ATTR_UNUSED(use_caps_for_id))
 {
 	struct outside_network* outnet =  calloc(1, 
 		sizeof(struct outside_network));

testcode/harvest.c

@@ -0,0 +1,818 @@
+/*
+ * testcode/harvest.c - debug program to get relevant data to a set of queries.
+ *
+ * Copyright (c) 2008, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This program downloads relevant DNS data to a set of queries.
+ * This means that the queries are asked to root, TLD, SLD servers and
+ * the results stored per zone.
+ * The following data is pertinent:
+ *
+ * At each label:
+ *	SOA
+ *	NS
+ *	DNSKEY
+ *	DS
+ * For the whole query:
+ *	the result.
+ * For NS-records:
+ *	their label data
+ *	and the A and AAAA records for it.
+ *	(as if the name, with A and AAAA query type is in the list,
+ *	 referred to as recursion depth+1)
+ * Any NSEC, NSEC3, SOA records or additional data found in answers.
+ *
+ * All of this is data that would be encountered during an iterative lookup
+ * for the queries in the list. It is saved to enable a replay of iterative
+ * lookups for performance testing.
+ *
+ * A number of assumptions are made.
+ * 1) configuration is correct.
+ *    The parent has the same NS records as the child.
+ *    All nameservers carry the same data.
+ * 2) EDNS/nonEDNS responses and other behaviour is ignored.
+ *    Only the data is saved.
+ * This creates a snapshot that represents the data as this resolver saw it.
+ */
+
+#include "config.h"
+#include <signal.h>
+#include "libunbound/unbound.h"
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif
+struct todo_item;
+struct labdata;
+
+/** this represents the data that has been collected 
+ * as well as a todo list and some settings */
+struct harvest_data {
+	/** the unbound context */
+	struct ub_ctx* ctx;
+
+	/** a tree per label; thus this first one is one root entry,
+	 * that has a tree of TLD labels. Those have trees of SLD labels. */
+	struct labdata* root;
+	/** the original query list */
+	struct todo_item* orig_list;
+	/** the query list todo */
+	struct todo_item* todo_list;
+	/** last item in todo list */
+	struct todo_item* todo_last;
+	/** number of todo items */
+	int numtodo;
+
+	/** where to store the results */
+	char* resultdir;
+	/** maximum recursion depth */
+	int maxdepth;
+	/** current recursion depth */
+	int curdepth;
+
+	/** max depth of labels */
+	int maxlabels;
+	/** number of RRs stored */
+	int num_rrs;
+	/** number of zones written */
+	int num_zones;
+};
+
+/**
+ * Todo item
+ */
+struct todo_item {
+	/** the next item */
+	struct todo_item* next;
+
+	/** query as rdf */
+	ldns_rdf* qname;
+	/** the query type */
+	int qtype;
+	/** query class */
+	int qclass;
+
+	/** recursion depth of todo item (orig list is 0) */
+	int depth;
+	/** the label associated with the query */
+	struct labdata* lab;
+};
+
+/** 
+ * Every label has a sest of sublabels, that have sets of sublabels ...
+ * Per label is stored also a set of data items, and todo information
+ */
+struct labdata {
+	/** node in ldns rbtree */
+	ldns_rbnode_t node;
+	/** the name of this label */
+	ldns_rdf* label;
+	/** full name of point in domain tree */
+	ldns_rdf* name;
+
+	/** parent in label tree (NULL for root) */
+	struct labdata* parent;
+	/** tree of sublabels (if any) */
+	ldns_rbtree_t* sublabels;
+
+	/** list of RRs for this label */
+	ldns_rr_list* rrlist;
+	/** have queries for this label been queued */
+	int done;
+};
+
+/** usage information for harvest */
+static void usage(char* nm) 
+{
+	printf("usage: %s [options]\n", nm);
+	printf("-f fnm	query list to read from file\n");
+	printf("	every line has format: qname qclass qtype\n");
+	printf("-v 	verbose (-v -v even more)\n");
+	exit(1);
+}
+
+/** verbosity for harvest */
+static int hverb = 0;
+
+/** exit with error */
+static void error_exit(char* str)
+{
+	printf("error: %s\n", str);
+	exit(1);
+}
+
+/** read a query file */
+static void
+qlist_read_file(struct harvest_data* data, char* fname)
+{
+	char buf[1024];
+	char nm[1024], cl[1024], tp[1024];
+	int r;
+	int num = 0;
+	FILE* in = fopen(fname, "r");
+	struct todo_item* t;
+	if(!in) {
+		perror(fname);
+		error_exit("could not open file");
+	}
+	while(fgets(buf, (int)sizeof(buf), in)) {
+		if(buf[0] == 0) continue;
+		if(buf[0] == '\n') continue;
+		/* allow some comments */
+		if(buf[0] == ';') continue;
+		if(buf[0] == '#') continue;
+		nm[0] = 0; cl[0] = 0; tp[0] = 0;
+		r = sscanf(buf, " %1023s %1023s %1023s", nm, cl, tp);
+		if(r == 0) continue;
+		t = (struct todo_item*)calloc(1, sizeof(*t));
+		if(!t) error_exit("out of memory");
+		t->qname = ldns_dname_new_frm_str(nm);
+		if(!t->qname) {
+			printf("parse error: %s\n", nm);
+			error_exit("bad qname");
+		}
+		t->depth = 0;
+		t->qtype = LDNS_RR_TYPE_A;
+		t->qclass = LDNS_RR_CLASS_IN;
+		if(r >= 2) {
+			if(strcmp(cl, "IN") == 0 || strcmp(cl, "CH") == 0)
+				t->qclass = ldns_get_rr_class_by_name(cl);
+			else	t->qtype = ldns_get_rr_type_by_name(cl);
+		}
+		if(r >= 3) {
+			if(strcmp(tp, "IN") == 0 || strcmp(tp, "CH") == 0)
+				t->qclass = ldns_get_rr_class_by_name(tp);
+			else	t->qtype = ldns_get_rr_type_by_name(tp);
+		}
+		num++;
+
+		t->next = data->orig_list;
+		data->orig_list = t;
+	}
+	printf("read %s: %d queries\n", fname, num);
+	fclose(in);
+}
+
+/** compare two labels */
+static int
+lab_cmp(const void *x, const void *y)
+{
+	return ldns_dname_compare((const ldns_rdf*)x, (const ldns_rdf*)y);
+}
+
+/** create label entry */
+static struct labdata*
+lab_create(char* name)
+{
+	struct labdata* lab = (struct labdata*)calloc(1, sizeof(*lab));
+	if(!lab) error_exit("out of memory");
+	lab->label = ldns_dname_new_frm_str(name);
+	if(!lab->label) error_exit("out of memory");
+	lab->name = ldns_dname_new_frm_str(name);
+	if(!lab->name) error_exit("out of memory");
+	lab->node.key = lab->label;
+	lab->node.data = lab;
+	lab->sublabels = ldns_rbtree_create(lab_cmp);
+	if(!lab->sublabels) error_exit("out of memory");
+	lab->rrlist = ldns_rr_list_new();
+	if(!lab->rrlist) error_exit("out of memory");
+
+	return lab;
+}
+
+/** for this name, lookup the label, create if does not exist */
+static struct labdata*
+find_create_lab(struct harvest_data* data, ldns_rdf* name)
+{
+	struct labdata* lab = data->root;
+	struct labdata* nextlab;
+	ldns_rdf* next;
+	uint8_t numlab = ldns_dname_label_count(name);
+	if((int)numlab > data->maxlabels)
+		data->maxlabels = (int)numlab;
+	while(numlab--) {
+		next = ldns_dname_label(name, numlab);
+		if(!next) error_exit("ldns_dname_label");
+		
+		nextlab = (struct labdata*)
+			ldns_rbtree_search(lab->sublabels, next);
+		if(!nextlab) {
+			/* create it */
+			nextlab = (struct labdata*)calloc(1, sizeof(*lab));
+			if(!nextlab) error_exit("out of memory");
+			nextlab->label = ldns_rdf_clone(next);
+			if(!nextlab->label) error_exit("out of memory");
+			nextlab->node.key = nextlab->label;
+			nextlab->node.data = nextlab;
+			nextlab->sublabels = ldns_rbtree_create(lab_cmp);
+			if(!nextlab->sublabels) error_exit("out of memory");
+			nextlab->parent = lab;
+			nextlab->name = ldns_rdf_clone(next);
+			if(!nextlab->name) error_exit("out of memory");
+			if(ldns_dname_cat(nextlab->name, lab->name) 
+				!= LDNS_STATUS_OK) error_exit("outofmem");
+			nextlab->rrlist = ldns_rr_list_new();
+			if(!nextlab->rrlist) error_exit("out of memory");
+			(void)ldns_rbtree_insert(lab->sublabels, 
+				&nextlab->node);
+			if(hverb) {
+				printf("new label: ");
+				ldns_rdf_print(stdout, nextlab->name);
+				printf("\n");
+			}
+		}
+		lab = nextlab;
+		ldns_rdf_deep_free(next);
+	}
+	return lab;
+}
+
+/** for given query, create todo items, and labels if needed */
+static void
+new_todo_item(struct harvest_data* data, ldns_rdf* qname, int qtype, 
+	int qclass, int depth)
+{
+	struct labdata* lab = find_create_lab(data, qname);
+	struct todo_item* it;
+	if(!lab) error_exit("out of memory creating new label");
+	it = (struct todo_item*)calloc(1, sizeof(*it));
+	it->qname = ldns_rdf_clone(qname);
+	it->qtype = qtype;
+	it->qclass = qclass;
+	it->depth = depth;
+	it->lab = lab;
+	it->next = NULL;
+	if(data->todo_last)
+		data->todo_last->next = it;
+	else data->todo_list = it;
+	data->todo_last = it;
+	data->numtodo ++;
+	if(hverb >= 2) {
+		printf("new todo: ");
+		ldns_rdf_print(stdout, it->qname);
+		if(ldns_rr_descript((uint16_t)it->qtype) && 
+			ldns_rr_descript((uint16_t)it->qtype)->_name)
+			printf(" %s", ldns_rr_descript((uint16_t)
+			it->qtype)->_name);
+		if(ldns_lookup_by_id(ldns_rr_classes, it->qclass) && 
+			ldns_lookup_by_id(ldns_rr_classes, it->qclass)->name) 
+			printf(" %s", ldns_lookup_by_id(ldns_rr_classes, 
+				it->qclass)->name);
+		printf("\n");
+	}
+}
+
+/** add infra todo items for this query */
+static void
+new_todo_infra(struct harvest_data* data, struct labdata* startlab, int depth)
+{
+	struct labdata* lab;
+	for(lab = startlab; lab; lab = lab->parent) {
+		if(lab->done)
+			return;
+		new_todo_item(data, lab->name, LDNS_RR_TYPE_NS, 
+			LDNS_RR_CLASS_IN, depth);
+		new_todo_item(data, lab->name, LDNS_RR_TYPE_SOA, 
+			LDNS_RR_CLASS_IN, depth);
+		new_todo_item(data, lab->name, LDNS_RR_TYPE_DNSKEY, 
+			LDNS_RR_CLASS_IN, depth);
+		new_todo_item(data, lab->name, LDNS_RR_TYPE_DS, 
+			LDNS_RR_CLASS_IN, depth);
+		new_todo_item(data, lab->name, LDNS_RR_TYPE_A, 
+			LDNS_RR_CLASS_IN, depth);
+		new_todo_item(data, lab->name, LDNS_RR_TYPE_AAAA, 
+			LDNS_RR_CLASS_IN, depth);
+		lab->done = 1;
+	}
+}
+
+/** make todo items for initial data */
+static void
+make_todo(struct harvest_data* data)
+{
+	struct todo_item* it;
+	for(it=data->orig_list; it; it = it->next) {
+		/* create todo item for this query itself */
+		new_todo_item(data, it->qname, it->qtype, it->qclass, 0);
+		/* create todo items for infra queries to support it */
+		new_todo_infra(data, data->todo_list->lab, 
+			data->todo_list->depth);
+	}
+}
+
+/** store RR and make new work items for it if needed */
+static void
+process_rr(struct harvest_data* data, ldns_rr* rr, int depth)
+{
+	/* must free or store rr */
+	struct labdata* lab = find_create_lab(data, ldns_rr_owner(rr));
+	if(!lab) error_exit("cannot find/create label");
+	/* generate extra queries */
+	if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NS) {
+		new_todo_infra(data, find_create_lab(data, 
+			ldns_rr_ns_nsdname(rr)), depth+1);
+	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_MX) {
+		new_todo_infra(data, find_create_lab(data, 
+			ldns_rr_mx_exchange(rr)), depth+1);
+	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_SOA) {
+		new_todo_infra(data, find_create_lab(data, 
+			ldns_rr_rdf(rr, 0)), depth+1);
+	}
+	/* store it */
+	if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NSEC) {
+		/* find correct zone to store NSEC in (for delegation zones) */
+		if(ldns_dname_compare(ldns_rr_rdf(rr, 0), ldns_rr_owner(rr))
+			== 0) {
+			/* store at the single name = apex */
+		} else if(!ldns_dname_is_subdomain(ldns_rr_rdf(rr, 0), 
+			ldns_rr_owner(rr)) && lab->parent) {
+			/* if   owner NSEC subdomain-of-owner then
+		 	 * store at owner (owner is apex or empty nonterminal).
+		 	 * Otherwise at owner parent. */
+			lab = lab->parent;
+		}
+	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_DS) {
+		/* store DSes in parent zone */
+		if(lab->parent)
+			lab = lab->parent;
+	} else if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NSEC3) {
+		/* store NSEC3s one label up at zone apex */
+		if(lab->parent)
+			lab = lab->parent;
+	}
+	/* we assume NS set is equal across parent-child border. */
+
+	if(!ldns_rr_list_contains_rr(lab->rrlist, rr)) {
+		if(hverb >= 2) {
+			printf("store RR ");
+			ldns_rr_print(stdout, rr);
+			printf("\n");
+		}
+		if(!ldns_rr_list_push_rr(lab->rrlist, rr))
+			error_exit("outofmem ldns_rr_list_push_rr");
+		data->num_rrs++;
+	} else {
+		if(hverb >= 2) {
+			printf("duplicate RR ");
+			ldns_rr_print(stdout, rr);
+			printf("\n");
+		}
+		ldns_rr_free(rr);
+	}
+}
+
+/** store RRs and make new work items if needed */
+static void
+process_pkt(struct harvest_data* data, ldns_pkt* pkt, int depth)
+{
+	size_t i;
+	ldns_rr_list* list;
+	list = ldns_pkt_get_section_clone(pkt, LDNS_SECTION_ANY_NOQUESTION);
+	if(!list) error_exit("outofmemory");
+	for(i=0; i<ldns_rr_list_rr_count(list); i++) {
+		process_rr(data, ldns_rr_list_rr(list, i), depth);
+	}
+	ldns_rr_list_free(list);
+}
+
+/** process a todo item */
+static void
+process(struct harvest_data* data, struct todo_item* it)
+{
+	int r;
+	char* nm;
+	struct ub_result* result = NULL;
+	ldns_pkt* pkt = NULL;
+	ldns_status s;
+	if(hverb) {
+		printf("process: ");
+		ldns_rdf_print(stdout, it->qname);
+		if(ldns_rr_descript((uint16_t)it->qtype) && 
+			ldns_rr_descript((uint16_t)it->qtype)->_name)
+			printf(" %s", ldns_rr_descript((uint16_t)
+			it->qtype)->_name);
+		if(ldns_lookup_by_id(ldns_rr_classes, it->qclass) && 
+			ldns_lookup_by_id(ldns_rr_classes, it->qclass)->name) 
+			printf(" %s", ldns_lookup_by_id(ldns_rr_classes, 
+				it->qclass)->name);
+		printf("\n");
+	}
+	/* do lookup */
+	nm = ldns_rdf2str(it->qname);
+	if(!nm) error_exit("ldns_rdf2str");
+	r = ub_resolve(data->ctx, nm, it->qtype, it->qclass, &result);
+	if(r != 0) {
+		printf("ub_resolve(%s, %d, %d): %s\n", nm, it->qtype, 
+			it->qclass, ub_strerror(r));
+		free(nm);
+		return;
+	}
+	/* even if result is a negative, try to store resulting SOA/NSEC */
+
+	/* create ldns pkt */
+	s = ldns_wire2pkt(&pkt, result->answer_packet, 
+		(size_t)result->answer_len);
+	if(s != LDNS_STATUS_OK) {
+		printf("ldns_wire2pkt failed! %s %d %d %s", nm, 
+			it->qtype, it->qclass, ldns_get_errorstr_by_id(s));
+		free(nm);
+		return;
+	}
+	if(hverb >= 2) {
+		printf("answer: ");
+		ldns_pkt_print(stdout, pkt);
+		printf("\n");
+	}
+	/* process results */
+	process_pkt(data, pkt, it->depth);
+
+	ldns_pkt_free(pkt);
+	free(nm);
+	ub_resolve_free(result);
+}
+
+/** perform main harvesting */
+static void
+harvest_main(struct harvest_data* data)
+{
+	struct todo_item* it;
+	int numdone = 0;
+	/* register todo queries for all original queries */
+	make_todo(data);
+	printf("depth 0: done %d todo %d\n", 0, data->numtodo);
+	/* pick up a todo item and process it */
+	while(data->todo_list) {
+		numdone++;
+		it = data->todo_list;
+		data->todo_list = it->next;
+		if(!data->todo_list) data->todo_last = NULL;
+		if(numdone%1000==0 || it->depth > data->curdepth) {
+			data->curdepth = it->depth;
+			printf("depth %d: done %d todo %d, %d rrs\n", 
+				it->depth, numdone, data->numtodo, 
+				data->num_rrs);
+		}
+		if(it->depth >= data->maxdepth) {
+			printf("obtained %d rrs to a max of %d labels.\n",
+				data->num_rrs, data->maxlabels);
+			return;
+		}
+		data->numtodo--;
+		process(data, it);
+	}
+}
+
+/** create directory if it does not exist */
+static void
+hv_mkdir(char* dir)
+{
+	if(mkdir(dir, 0755) == -1) {
+		if(errno == EEXIST)
+			return;
+		perror(dir);
+		error_exit("mkdir failed");
+	}
+}
+
+
+/** see if rrlist contains a SOA record */
+static ldns_rr*
+has_SOA(ldns_rr_list* list)
+{
+	size_t i;
+	for(i=0; i<ldns_rr_list_rr_count(list); i++) {
+		if(ldns_rr_get_type(ldns_rr_list_rr(list, i)) 
+			== LDNS_RR_TYPE_SOA)
+			return ldns_rr_list_rr(list, i);
+	}
+	return NULL;
+}
+
+/** write moredata for a zone*/
+static void
+write_moredata(struct harvest_data* data, struct labdata* zone,
+	FILE *f, struct labdata* thislab, ldns_rr* nslist)
+{
+	struct labdata* lab;
+	size_t i;
+	ldns_rr* ns;
+	LDNS_RBTREE_FOR(lab, struct labdata*, thislab->sublabels) {
+		if(has_SOA(lab->rrlist)) {
+			/* copy only NS glue */
+			for(i=0; i<ldns_rr_list_rr_count(lab->rrlist); i++) {
+				ns = ldns_rr_list_rr(lab->rrlist, i);
+				if(ldns_rr_get_type(ns) == LDNS_RR_TYPE_NS) {
+					ldns_rr_print(f, ns);
+					if(ldns_dname_is_subdomain(
+						ldns_rr_ns_nsdname(ns), 
+						lab->name)) {
+						ldns_rr_push_rdf(nslist, 
+							ldns_rdf_clone(
+							ldns_rr_ns_nsdname(ns)));
+					}
+				}
+			}
+		} else {
+			/* copy all, recurse */
+			for(i=0; i<ldns_rr_list_rr_count(lab->rrlist); i++) {
+				ldns_rr_print(f, 
+					ldns_rr_list_rr(lab->rrlist, i));
+			}
+			write_moredata(data, zone, f, lab, nslist);
+		}
+	}
+}
+
+/** find and write glue into zone file */
+static void
+write_glue(struct harvest_data* data, struct labdata* thislab, FILE* f, 
+	ldns_rdf* name, int dep)
+{
+	size_t i;
+	struct labdata* lab;
+	ldns_rr* rr;
+	if(ldns_dname_compare(name, thislab->name) == 0) {
+		/* this is it! Did we go outside the zone? */
+		if(dep == 0)
+			return;
+		/* find A and AAAA */
+		for(i=0; i<ldns_rr_list_rr_count(thislab->rrlist); i++) {
+			rr = ldns_rr_list_rr(thislab->rrlist, i);
+			if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_A ||
+			   ldns_rr_get_type(rr) == LDNS_RR_TYPE_AAAA) {
+				ldns_rr_print(f, rr);
+			}
+		}
+		return;
+	}
+	/* recurse deeper */
+	LDNS_RBTREE_FOR(lab, struct labdata*, thislab->sublabels) {
+		if(has_SOA(lab->rrlist)) {
+			write_glue(data, lab, f, name, dep+1);
+		} else {
+			write_glue(data, lab, f, name, dep);
+		}
+	}
+}
+
+/** write zonefile for zone at this apex */
+static void
+write_zonefile(struct harvest_data* data, int dep, FILE* zlist, 
+	struct labdata* apex, ldns_rr* soa)
+{
+	FILE *f;
+	char fname[1024];
+	char* zname = ldns_rdf2str(apex->name);
+	time_t tm = time(NULL);
+	size_t i;
+	ldns_rr* nslist;
+	if(!zname) error_exit("out of mem ldns_rdf2str");
+	if(strcmp(zname, ".") == 0)
+		snprintf(fname, sizeof(fname), "l%d/root.zone", dep);
+	else	snprintf(fname, sizeof(fname), "l%d/%szone", dep, zname);
+
+	fprintf(zlist, "zone: name: \"%s\" %s%szonefile: \"%s\"\n",
+		zname, 
+		strlen(zname)/8<1?"\t":"",
+		strlen(zname)/8<2?"\t":"",
+		fname);
+
+	if(hverb) printf("writing %s\n", fname);
+	f = fopen(fname, "w");
+	if(!f) {
+		perror(fname);
+		error_exit("cannot open zone file");
+	}
+	fprintf(f, "; %s - generated by harvest program.\n", fname);
+	fprintf(f, "; zone name %s - this is a partial snapshot of "
+		"data relevant to the query list.\n", zname);
+	fprintf(f, "; created %u - date %s\n", (unsigned)tm, ctime(&tm));
+	ldns_rr_print(f, soa);
+	fprintf(f, "\n");
+	for(i=0; i<ldns_rr_list_rr_count(apex->rrlist); i++) {
+		if(ldns_rr_get_type(ldns_rr_list_rr(apex->rrlist, i))
+			== LDNS_RR_TYPE_SOA) continue;
+		ldns_rr_print(f, ldns_rr_list_rr(apex->rrlist, i));
+	}
+	/* search for more data - subdomains inside the zone, NS glue */
+	nslist = ldns_rr_new();
+	if(!nslist) error_exit("out of memory");
+	fprintf(f, "; end of apex, more data follows\n");
+	write_moredata(data, apex, f, apex, nslist);
+
+	/* add NS from apex that need glue too */
+	for(i=0; i<ldns_rr_list_rr_count(apex->rrlist); i++) {
+		if(ldns_rr_get_type(ldns_rr_list_rr(apex->rrlist, i)) !=
+			LDNS_RR_TYPE_NS)
+			continue;
+		/* these are only added again if in a subzone */
+		if(ldns_dname_is_subdomain(ldns_rr_ns_nsdname(
+			ldns_rr_list_rr(apex->rrlist, i)), apex->name)) {
+			ldns_rr_push_rdf(nslist, ldns_rdf_clone(
+				ldns_rr_ns_nsdname(ldns_rr_list_rr(
+				apex->rrlist, i))));
+		}
+	}
+
+	fprintf(f, "; glue data follows\n");
+	/* lookup and add glue (if not already in zone) */
+	for(i=0; i<ldns_rr_rd_count(nslist); i++) {
+		write_glue(data, apex, f, ldns_rr_rdf(nslist, i), 0);
+	}
+
+	fclose(f);
+	ldns_rr_free(nslist);
+	free(zname);
+}
+
+/** create zones at depth d in label tree */
+static void
+create_zones(struct harvest_data* data, int dep, FILE* zlist, 
+	struct labdata* labnow, int depnow)
+{
+	struct labdata* s;
+	ldns_rr* soa;
+	if(depnow == dep) {
+		/* see if this is a zone start - a SOA */
+		if((soa=has_SOA(labnow->rrlist))) {
+			write_zonefile(data, dep, zlist, labnow, soa);
+			data->num_zones++;
+		}
+		return;
+	}
+	/* recurse */
+	LDNS_RBTREE_FOR(s, struct labdata*, labnow->sublabels) {
+		create_zones(data, dep, zlist, s, depnow+1);
+	}
+}
+
+/** sort rrlists */
+static void
+harvest_sort(struct labdata* lab)
+{
+	struct labdata* s;
+	/* prettier output if sorted here */
+	ldns_rr_list_sort(lab->rrlist);
+	/* and recurse */
+	LDNS_RBTREE_FOR(s, struct labdata*, lab->sublabels) {
+		harvest_sort(s);
+	}
+}
+
+/** output harvested results */
+static void
+harvest_output(struct harvest_data* data)
+{
+	int d;
+	char buf[20];
+	FILE* zlist;
+	int lastzones;
+	hv_mkdir(data->resultdir);
+	if(chdir(data->resultdir) == -1) {
+		perror(data->resultdir);
+		error_exit("cannot chdir");
+	}
+	harvest_sort(data->root);
+	/* create zones */
+	for(d = 0; d<data->maxlabels; d++) {
+		lastzones = data->num_zones;
+		printf("creating zones %d\n", d);	
+		snprintf(buf, sizeof(buf), "l%d", d);
+		hv_mkdir(buf);
+		snprintf(buf, sizeof(buf), "l%d.zones", d);
+		zlist = fopen(buf, "w");
+		if(!zlist) {
+			perror(buf);
+			error_exit("cannot write zonelist file");
+		}
+		fprintf(zlist, "# partial zones at depth %d\n", d);
+		create_zones(data, d, zlist, data->root, 0);
+		fclose(zlist);
+		printf("creating zones %d - %d zones written\n", d,
+			data->num_zones - lastzones);	
+	}
+}
+
+/** getopt global, in case header files fail to declare it. */
+extern int optind;
+/** getopt global, in case header files fail to declare it. */
+extern char* optarg;
+
+/** main program for harvest */
+int main(int argc, char* argv[]) 
+{
+	struct harvest_data data;
+	char* nm = argv[0];
+	int c;
+
+	/* defaults */
+	memset(&data, 0, sizeof(data));
+	data.ctx = ub_ctx_create();
+	data.resultdir = strdup("harvested_zones");
+	if(!data.resultdir) error_exit("out of memory");
+	data.maxdepth = 2;
+
+	/* parse the options */
+	while( (c=getopt(argc, argv, "hf:v")) != -1) {
+		switch(c) {
+		case 'f':
+			qlist_read_file(&data, optarg);
+			break;
+		case 'v':
+			hverb++;
+			break;
+		case '?':
+		case 'h':
+		default:
+			usage(nm);
+		}
+	}
+	argc -= optind;
+	argv += optind;
+	if(argc != 0)
+		usage(nm);
+	if(data.orig_list == NULL)
+		error_exit("No queries to make, use -f (help with -h).");
+	data.root = lab_create(".");
+	if(!data.root) error_exit("out of memory");
+	
+	/* harvest the data */
+	harvest_main(&data);
+	harvest_output(&data);
+
+	/* no cleanup except the context (to close open sockets) */
+	ub_ctx_delete(data.ctx);
+	return 0;
+}

testcode/perf.c

@@ -0,0 +1,614 @@
+/*
+ * testcode/perf.c - debug program to estimate name server performance.
+ *
+ * Copyright (c) 2008, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ * 
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ * 
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/**
+ * \file
+ *
+ * This program estimates DNS name server performance.
+ */
+
+#include "config.h"
+#include <signal.h>
+#include "util/log.h"
+#include "util/locks.h"
+#include "util/net_help.h"
+#include "util/data/msgencode.h"
+#include "util/data/msgreply.h"
+#include "util/data/msgparse.h"
+
+/** usage information for perf */
+static void usage(char* nm) 
+{
+	printf("usage: %s [options] server\n", nm);
+	printf("server: ip address of server, IP4 or IP6.\n");
+	printf("	If not on port %d add @port.\n", UNBOUND_DNS_PORT);
+	printf("-d sec	duration of test in whole seconds (0: wait for ^C)\n");
+	printf("-a str	query to ask, interpreted as a line from qfile\n");
+	printf("-f fnm	query list to read from file\n");
+	printf("	every line has format: qname qclass qtype [+-]{E}\n");
+	printf("	where + means RD set, E means EDNS enabled\n");
+	printf("-q 	quiet mode, print only final qps\n");
+	exit(1);
+}
+
+struct perfinfo;
+struct perfio;
+
+/** Global info for perf */
+struct perfinfo { 
+	/** need to exit */
+	volatile int exit;
+	/** all purpose buffer (for UDP send and receive) */
+	ldns_buffer* buf;
+
+	/** destination */
+	struct sockaddr_storage dest;
+	/** length of dest socket addr */
+	socklen_t destlen;
+
+	/** when did this time slice start */
+	struct timeval since;
+	/** number of queries received in that time */
+	size_t numrecv;
+	/** number of queries sent out in that time */
+	size_t numsent;
+
+	/** duration of test in seconds */
+	int duration;
+	/** quiet mode? */
+	int quiet;
+
+	/** when did the total test start */
+	struct timeval start;
+	/** total number recvd */
+	size_t total_recv;
+	/** total number sent */
+	size_t total_sent;
+	/** numbers by rcode */
+	size_t by_rcode[32];
+	
+	/** number of I/O ports */
+	size_t io_num;
+	/** I/O ports array */
+	struct perfio* io;
+	/** max fd value in io ports */
+	int maxfd;
+	/** readset */
+	fd_set rset;
+
+	/** size of querylist */
+	size_t qlist_size;
+	/** allocated size of qlist array */
+	size_t qlist_capacity;
+	/** list of query packets (data) */
+	uint8_t** qlist_data;
+	/** list of query packets (length of a packet) */
+	size_t* qlist_len;
+	/** index into querylist, for walking the list */
+	size_t qlist_idx;
+};
+
+/** I/O port for perf */
+struct perfio {
+	/** id number */
+	size_t id;
+	/** file descriptor of socket */
+	int fd;
+	/** timeout value */
+	struct timeval timeout;
+	/** ptr back to perfinfo */
+	struct perfinfo* info;
+};
+
+/** number of msec between starting io ports */
+#define START_IO_INTERVAL 10
+/** number of msec timeout on io ports */
+#define IO_TIMEOUT 10
+
+/** signal handler global info */
+static struct perfinfo* sig_info;
+
+/** signal handler for user quit */
+static RETSIGTYPE perf_sigh(int sig)
+{
+	log_assert(sig_info);
+	if(!sig_info->quiet)
+		printf("exit on signal %d\n", sig);
+	sig_info->exit = 1;
+}
+
+/** timeval compare, t1 < t2 */
+static int
+perf_tv_smaller(struct timeval* t1, struct timeval* t2) 
+{
+#ifndef S_SPLINT_S
+	if(t1->tv_sec < t2->tv_sec)
+		return 1;
+	if(t1->tv_sec == t2->tv_sec &&
+		t1->tv_usec < t2->tv_usec)
+		return 1;
+#endif
+	return 0;
+}
+
+/** timeval add, t1 += t2 */
+static void
+perf_tv_add(struct timeval* t1, struct timeval* t2) 
+{
+#ifndef S_SPLINT_S
+	t1->tv_sec += t2->tv_sec;
+	t1->tv_usec += t2->tv_usec;
+	while(t1->tv_usec > 1000000) {
+		t1->tv_usec -= 1000000;
+		t1->tv_sec++;
+	}
+#endif
+}
+
+/** timeval subtract, t1 -= t2 */
+static void
+perf_tv_subtract(struct timeval* t1, struct timeval* t2) 
+{
+#ifndef S_SPLINT_S
+	t1->tv_sec -= t2->tv_sec;
+	if(t1->tv_usec >= t2->tv_usec) {
+		t1->tv_usec -= t2->tv_usec;
+	} else {
+		t1->tv_sec--;
+		t1->tv_usec = 1000000-(t2->tv_usec-t1->tv_usec);
+	}
+#endif
+}
+
+
+/** setup perf test environment */
+static void
+perfsetup(struct perfinfo* info)
+{
+	size_t i;
+	if(gettimeofday(&info->start, NULL) < 0)
+		fatal_exit("gettimeofday: %s", strerror(errno));
+	sig_info = info;
+	if( signal(SIGINT, perf_sigh) == SIG_ERR || 
+		signal(SIGTERM, perf_sigh) == SIG_ERR ||
+		signal(SIGHUP, perf_sigh) == SIG_ERR ||
+		signal(SIGQUIT, perf_sigh) == SIG_ERR)
+		fatal_exit("could not bind to signal");
+	info->io = (struct perfio*)calloc(sizeof(struct perfio), info->io_num);
+	if(!info->io) fatal_exit("out of memory");
+#ifndef S_SPLINT_S
+	FD_ZERO(&info->rset);
+#endif
+	info->since = info->start;
+	for(i=0; i<info->io_num; i++) {
+		info->io[i].id = i;
+		info->io[i].info = info;
+		info->io[i].fd = socket(
+			addr_is_ip6(&info->dest, info->destlen)?
+			AF_INET6:AF_INET, SOCK_DGRAM, 0);
+		if(info->io[i].fd == -1)
+			fatal_exit("socket: %s", strerror(errno));
+		if(info->io[i].fd > info->maxfd)
+			info->maxfd = info->io[i].fd;
+#ifndef S_SPLINT_S
+		FD_SET(info->io[i].fd, &info->rset);
+		info->io[i].timeout.tv_usec = ((START_IO_INTERVAL*i)%1000)
+						*1000;
+		info->io[i].timeout.tv_sec = (START_IO_INTERVAL*i)/1000;
+		perf_tv_add(&info->io[i].timeout, &info->since);
+#endif
+	}
+}
+
+/** cleanup perf test environment */
+static void
+perffree(struct perfinfo* info)
+{
+	size_t i;
+	if(!info) return;
+	if(info->io) {
+		for(i=0; i<info->io_num; i++) {
+			close(info->io[i].fd);
+		}
+		free(info->io);
+	}
+	for(i=0; i<info->qlist_size; i++)
+		free(info->qlist_data[i]);
+	free(info->qlist_data);
+	free(info->qlist_len);
+}
+
+/** send new query for io */
+static void
+perfsend(struct perfinfo* info, size_t n, struct timeval* now)
+{
+	ssize_t r;
+	r = sendto(info->io[n].fd, info->qlist_data[info->qlist_idx],
+		info->qlist_len[info->qlist_idx], 0,
+		(struct sockaddr*)&info->dest, info->destlen);
+	/*log_hex("send", info->qlist_data[info->qlist_idx],
+		info->qlist_len[info->qlist_idx]);*/
+	if(r == -1)
+		log_err("sendto: %s", strerror(errno));
+	else if(r != (ssize_t)info->qlist_len[info->qlist_idx]) {
+		log_err("partial sendto");
+	}
+	info->qlist_idx = (info->qlist_idx+1) % info->qlist_size;
+	info->numsent++;
+
+	info->io[n].timeout.tv_sec = IO_TIMEOUT/1000;
+	info->io[n].timeout.tv_usec = (IO_TIMEOUT%1000)*1000;
+	perf_tv_add(&info->io[n].timeout, now);
+}
+
+/** got reply for io */
+static void
+perfreply(struct perfinfo* info, size_t n, struct timeval* now)
+{
+	ssize_t r;
+	r = recv(info->io[n].fd, ldns_buffer_begin(info->buf),
+		ldns_buffer_capacity(info->buf), 0);
+	if(r == -1) {
+		log_err("recv: %s", strerror(errno));
+	} else {
+		info->by_rcode[LDNS_RCODE_WIRE(ldns_buffer_begin(
+			info->buf))]++;
+		info->numrecv++;
+	}
+	/*ldns_buffer_set_limit(info->buf, r);
+	log_buf(0, "reply", info->buf);*/
+	perfsend(info, n, now);
+}
+
+/** got timeout for io */
+static void
+perftimeout(struct perfinfo* info, size_t n, struct timeval* now)
+{
+	/* may not be a dropped packet, this is also used to start
+	 * up the sending IOs */
+	perfsend(info, n, now);
+}
+
+/** print nice stats about qps */
+static void
+stat_printout(struct perfinfo* info, struct timeval* now, 
+	struct timeval* elapsed)
+{
+	/* calculate qps */
+	double dt, qps = 0;
+#ifndef S_SPLINT_S
+	dt = (double)(elapsed->tv_sec*1000000 + elapsed->tv_usec) / 1000000;
+#endif
+	if(dt > 0.001)
+		qps = (double)(info->numrecv) / dt;
+	if(!info->quiet)
+		printf("qps: %g\n", qps);
+	/* setup next slice */
+	info->since = *now;
+	info->total_sent += info->numsent;
+	info->total_recv += info->numrecv;
+	info->numrecv = 0;
+	info->numsent = 0;
+}
+
+/** wait for new events for performance test */
+static void
+perfselect(struct perfinfo* info)
+{
+	fd_set rset = info->rset;
+	struct timeval timeout, now;
+	int num;
+	size_t i;
+	if(gettimeofday(&now, NULL) < 0)
+		fatal_exit("gettimeofday: %s", strerror(errno));
+	/* time to exit? */
+	if(info->duration > 0) {
+		timeout = now;
+		perf_tv_subtract(&timeout, &info->start);
+		if((int)timeout.tv_sec >= info->duration) {
+			info->exit = 1;
+			return;
+		}
+	}
+	/* time for stats printout? */
+	timeout = now;
+	perf_tv_subtract(&timeout, &info->since);
+	if(timeout.tv_sec > 0) {
+		stat_printout(info, &now, &timeout);
+	}
+	/* see what is closest port to timeout; or if there is a timeout */
+	timeout = info->io[0].timeout;
+	for(i=0; i<info->io_num; i++) {
+		if(perf_tv_smaller(&info->io[i].timeout, &now)) {
+			perftimeout(info, i, &now);
+			return;
+		}
+		if(perf_tv_smaller(&info->io[i].timeout, &timeout)) {
+			timeout = info->io[i].timeout;
+		}
+	}
+	perf_tv_subtract(&timeout, &now);
+	
+	num = select(info->maxfd+1, &rset, NULL, NULL, &timeout);
+	if(num == -1) {
+		if(errno == EAGAIN || errno == EINTR)
+			return;
+		log_err("select: %s", strerror(errno));
+	}
+
+	/* handle new events */
+	for(i=0; num && i<info->io_num; i++) {
+		if(FD_ISSET(info->io[i].fd, &rset)) {
+			perfreply(info, i, &now);
+			num--;
+		}
+	}
+}
+
+/** show end stats */
+static void
+perfendstats(struct perfinfo* info)
+{
+	double dt, qps;
+	struct timeval timeout, now;
+	int i, lost; 
+	if(gettimeofday(&now, NULL) < 0)
+		fatal_exit("gettimeofday: %s", strerror(errno));
+	timeout = now;
+	perf_tv_subtract(&timeout, &info->since);
+	stat_printout(info, &now, &timeout);
+	
+	timeout = now;
+	perf_tv_subtract(&timeout, &info->start);
+	dt = (double)(timeout.tv_sec*1000000 + timeout.tv_usec) / 1000000.0;
+	qps = (double)(info->total_recv) / dt;
+	lost = (int)(info->total_sent - info->total_recv) - (int)info->io_num;
+	if(!info->quiet) {
+		printf("overall time: 	%g sec\n", 
+			(double)timeout.tv_sec + 
+			(double)timeout.tv_usec/1000000.);
+		if(lost > 0) 
+			printf("Packets lost: 	%d\n", (int)lost);
+	
+		for(i=0; i<(int)(sizeof(info->by_rcode)/sizeof(size_t)); i++)
+		{
+			if(info->by_rcode[i] > 0) {
+				printf("%d(%5s): 	%u replies\n",
+					i, ldns_lookup_by_id(ldns_rcodes, i)?
+					ldns_lookup_by_id(ldns_rcodes, 
+					i)->name:"??", 
+					(unsigned)info->by_rcode[i]);
+			}
+		}
+	}
+	printf("average qps: 	%g\n", qps);
+}
+
+/** perform the performance test */
+static void
+perfmain(struct perfinfo* info)
+{
+	perfsetup(info);
+	while(!info->exit) {
+		perfselect(info);
+	}
+	perfendstats(info);
+	perffree(info);
+}
+
+/** parse a query line to a packet into buffer */
+static int
+qlist_parse_line(ldns_buffer* buf, char* p)
+{
+	char nm[1024], cl[1024], tp[1024], fl[1024];
+	int r; 
+	int rec = 1, edns = 0;
+	struct query_info qinfo;
+	ldns_rdf* rdf;
+	nm[0] = 0; cl[0] = 0; tp[0] = 0; fl[0] = 0;
+	r = sscanf(p, " %1023s %1023s %1023s %1023s", nm, cl, tp, fl);
+	if(r != 3 && r != 4)
+		return 0;
+	/*printf("nm='%s', cl='%s', tp='%s', fl='%s'\n", nm, cl, tp, fl);*/
+	if(strcmp(tp, "IN") == 0 || strcmp(tp, "CH") == 0) {
+		qinfo.qtype = ldns_get_rr_type_by_name(cl);
+		qinfo.qclass = ldns_get_rr_class_by_name(tp);
+	} else {
+		qinfo.qtype = ldns_get_rr_type_by_name(tp);
+		qinfo.qclass = ldns_get_rr_class_by_name(cl);
+	}
+	if(fl[0] == '+') rec = 1;
+	else if(fl[0] == '-') rec = 0;
+	else if(fl[0] == 'E') edns = 1;
+	if((fl[0] == '+' || fl[0] == '-') && fl[1] == 'E')
+		edns = 1;
+	rdf = ldns_dname_new_frm_str(nm);
+	if(!rdf)
+		return 0;
+	qinfo.qname = ldns_rdf_data(rdf);
+	qinfo.qname_len = ldns_rdf_size(rdf);
+	qinfo_query_encode(buf, &qinfo);
+	ldns_buffer_write_u16_at(buf, 0, 0); /* zero ID */
+	if(rec) LDNS_RD_SET(ldns_buffer_begin(buf));
+	if(edns) {
+		struct edns_data edns;
+		memset(&edns, 0, sizeof(edns));
+		edns.edns_present = 1;
+		edns.udp_size = EDNS_ADVERTISED_SIZE;
+		/* Set DO bit in all EDNS datagrams ... */
+		edns.bits = EDNS_DO;
+		attach_edns_record(buf, &edns);
+	}
+	ldns_rdf_deep_free(rdf);
+	return 1;
+}
+
+/** grow query list capacity */
+static void
+qlist_grow_capacity(struct perfinfo* info)
+{
+	size_t newcap = (size_t)((info->qlist_capacity==0)?16:
+		info->qlist_capacity*2);
+	uint8_t** d = (uint8_t**)calloc(sizeof(uint8_t*), newcap);
+	size_t* l = (size_t*)calloc(sizeof(size_t), newcap);
+	if(!d || !l) fatal_exit("out of memory");
+	memcpy(d, info->qlist_data, sizeof(uint8_t*)*
+		info->qlist_capacity);
+	memcpy(l, info->qlist_len, sizeof(size_t)*
+		info->qlist_capacity);
+	free(info->qlist_data);
+	free(info->qlist_len);
+	info->qlist_data = d;
+	info->qlist_len = l;
+	info->qlist_capacity = newcap;
+}
+
+/** setup query list in info */
+static void
+qlist_add_line(struct perfinfo* info, char* line, int no)
+{
+	if(!qlist_parse_line(info->buf, line)) {
+		printf("error parsing query %d: %s\n", no, line);
+		exit(1);
+	}
+	ldns_buffer_write_u16_at(info->buf, 0, (uint16_t)info->qlist_size); 
+	if(info->qlist_size + 1 > info->qlist_capacity) {
+		qlist_grow_capacity(info);
+	}
+	info->qlist_len[info->qlist_size] = ldns_buffer_limit(info->buf);
+	info->qlist_data[info->qlist_size] = memdup(
+		ldns_buffer_begin(info->buf), ldns_buffer_limit(info->buf));
+	if(!info->qlist_data[info->qlist_size])
+		fatal_exit("out of memory");
+	info->qlist_size ++;
+}
+
+/** setup query list in info */
+static void
+qlist_read_file(struct perfinfo* info, char* fname)
+{
+	char buf[1024];
+	char *p;
+	FILE* in = fopen(fname, "r");
+	int lineno = 0;
+	if(!in) {
+		perror(fname);
+		exit(1);
+	}
+	while(fgets(buf, (int)sizeof(buf), in)) {
+		lineno++;
+		buf[sizeof(buf)-1] = 0;
+		p = buf;
+		while(*p == ' ' || *p == '\t')
+			p++;
+		if(p[0] == 0 || p[0] == '\n' || p[0] == ';' || p[0] == '#')
+			continue;
+		qlist_add_line(info, p, lineno);
+	}
+	printf("Read %s, got %u queries\n", fname, (unsigned)info->qlist_size);
+	fclose(in);
+}
+
+/** getopt global, in case header files fail to declare it. */
+extern int optind;
+/** getopt global, in case header files fail to declare it. */
+extern char* optarg;
+
+/** main program for perf */
+int main(int argc, char* argv[]) 
+{
+	char* nm = argv[0];
+	int c;
+	struct perfinfo info;
+
+	/* defaults */
+	memset(&info, 0, sizeof(info));
+	info.io_num = 16;
+
+	log_init(NULL, 0, NULL);
+	log_ident_set("perf");
+	checklock_start();
+
+	info.buf = ldns_buffer_new(65553);
+	if(!info.buf) fatal_exit("out of memory");
+
+	/* parse the options */
+	while( (c=getopt(argc, argv, "d:ha:f:q")) != -1) {
+		switch(c) {
+		case 'q':
+			info.quiet = 1;
+			break;
+		case 'd':
+			if(atoi(optarg)==0 && strcmp(optarg, "0")!=0) {
+				printf("-d not a number %s", optarg);
+				return 1;
+			}
+			info.duration = atoi(optarg);
+			break;
+		case 'a':
+			qlist_add_line(&info, optarg, 0);
+			break;
+		case 'f':
+			qlist_read_file(&info, optarg);
+			break;
+		case '?':
+		case 'h':
+		default:
+			usage(nm);
+		}
+	}
+	argc -= optind;
+	argv += optind;
+
+	if(argc != 1) {
+		printf("error: pass server IP address on commandline.\n");
+		usage(nm);
+	}
+	if(!extstrtoaddr(argv[0], &info.dest, &info.destlen)) {
+		printf("Could not parse ip: %s\n", argv[0]);
+		return 1;
+	}
+	if(info.qlist_size == 0) {
+		printf("No queries to make, use -f or -a.\n");
+		return 1;
+	}
+	
+	/* do the performance test */
+	perfmain(&info);
+
+	ldns_buffer_free(info.buf);
+	checklock_stop();
+	return 0;
+}

testcode/replay.h

@@ -226,6 +226,11 @@ struct replay_runtime {
 	/** user argument for incoming query callback */
 	void *cb_arg;
 
+	/** the current time in seconds */
+	uint32_t now_secs;
+	/** the current time in microseconds */
+	struct timeval now_tv;
+
 	/** signal handler callback */
 	void (*sig_cb)(int, void*);
 	/** signal handler user arg */

testcode/unitmain.c

@@ -314,7 +314,7 @@ infra_test()
 	size_t zonelen = 13;
 	struct infra_cache* slab;
 	struct config_file* cfg = config_create();
-	time_t now = 0;
+	uint32_t now = 0;
 	int vs, to;
 	struct infra_host_key* k;
 	struct infra_host_data* d;
@@ -409,5 +409,7 @@ main(int argc, char* argv[])
 	msgparse_test();
 	checklock_stop();
 	printf("%d checks ok.\n", testcount);
+	EVP_cleanup();
+	CRYPTO_cleanup_all_ex_data();
 	return 0;
 }

testcode/unitmsgparse.c

@@ -247,6 +247,76 @@ checkformerr(ldns_buffer* pkt)
 	unit_assert(status != LDNS_STATUS_OK);
 }
 
+/** performance test message encoding */
+static void
+perf_encode(struct query_info* qi, struct reply_info* rep, uint16_t id, 
+	uint16_t flags, ldns_buffer* out, uint32_t timenow, 
+	struct edns_data* edns)
+{
+	static int num = 0;
+	int ret;
+	size_t max = 10000;
+	size_t i;
+	struct timeval start, end;
+	double dt;
+	struct regional* r2 = regional_create();
+	if(gettimeofday(&start, NULL) < 0)
+		fatal_exit("gettimeofday: %s", strerror(errno));
+	/* encode a couple times */
+	for(i=0; i<max; i++) {
+		ret = reply_info_encode(qi, rep, id, flags, out, timenow,
+			r2, 65535, (int)(edns->bits & EDNS_DO) );
+		unit_assert(ret != 0); /* udp packets should fit */
+		attach_edns_record(out, edns);
+		regional_free_all(r2);
+	}
+	if(gettimeofday(&end, NULL) < 0)
+		fatal_exit("gettimeofday: %s", strerror(errno));
+	/* time in millisec */
+	dt = (double)(end.tv_sec - start.tv_sec)*1000. + 
+		((double)end.tv_usec - (double)start.tv_usec)/1000.;
+	printf("[%d] did %u in %g msec for %f encode/sec size %d\n", num++,
+		(unsigned)max, dt, (double)max / (dt/1000.), 
+		(int)ldns_buffer_limit(out));
+	regional_destroy(r2);
+}
+
+/** perf test a packet */
+static void
+perftestpkt(ldns_buffer* pkt, struct alloc_cache* alloc, ldns_buffer* out, 
+	const char* hex)
+{
+	struct query_info qi;
+	struct reply_info* rep = 0;
+	int ret;
+	uint16_t id;
+	uint16_t flags;
+	uint32_t timenow = 0;
+	struct regional* region = regional_create();
+	struct edns_data edns;
+
+	hex_to_buf(pkt, hex);
+	memmove(&id, ldns_buffer_begin(pkt), sizeof(id));
+	if(ldns_buffer_limit(pkt) < 2)
+		flags = 0;
+	else	memmove(&flags, ldns_buffer_at(pkt, 2), sizeof(flags));
+	flags = ntohs(flags);
+	ret = reply_info_parse(pkt, alloc, &qi, &rep, region, &edns);
+	if(ret != 0) {
+		if(vbmp) printf("parse code %d: %s\n", ret, 
+			ldns_lookup_by_id(ldns_rcodes, ret)->name);
+		if(ret == LDNS_RCODE_FORMERR)
+			checkformerr(pkt);
+		unit_assert(ret != LDNS_RCODE_SERVFAIL);
+	} else {
+		perf_encode(&qi, rep, id, flags, out, timenow, &edns);
+	} 
+
+	query_info_clear(&qi);
+	reply_info_parsedelete(rep, alloc);
+	regional_destroy(region);
+}
+
 /** test a packet */
 static void
 testpkt(ldns_buffer* pkt, struct alloc_cache* alloc, ldns_buffer* out, 
@@ -359,6 +429,12 @@ simpletest(ldns_buffer* pkt, struct alloc_cache* alloc, ldns_buffer* out)
 	" 00 01 00 01 00 02 64 b9 00 04 c6 29 00 04 01 4a 0c 52 4f 4f    ;        441- 460\n"
 	" 54 2d 53 45 52 56 45 52 53 03 4e 45 54 00 00 01 00 01 00 02    ;        461- 480\n"
 	" 64 b9 00 04 c0 3a 80 1e  ");
+
+	/* root delegation from unbound trace with new AAAA glue */
+	perftestpkt(pkt, alloc, out,
+	"55BC84000001000D00000014000002000100000200010007E900001401610C726F6F742D73657276657273036E65740000000200010007E90000040162C01E00000200010007E90000040163C01E00000200010007E90000040164C01E00000200010007E90000040165C01E00000200010007E90000040166C01E00000200010007E90000040167C01E00000200010007E90000040168C01E00000200010007E90000040169C01E00000200010007E9000004016AC01E00000200010007E9000004016BC01E00000200010007E9000004016CC01E00000200010007E9000004016DC01EC01C000100010007E9000004C6290004C03B000100010007E9000004C0E44FC9C04A000100010007E9000004C021040CC059000100010007E900000480080A5AC068000100010007E9000004C0CBE60AC077000100010007E9000004C00505F1C086000100010007E9000004C0702404C095000100010007E9000004803F0235C0A4000100010007E9000004C0249411C0B3000100010007E9000004C03A801EC0C2000100010007E9000004C1000E81C0D1000100010007E9000004C707532AC0E0000100010007E9000004CA0C1B21C01C001C00010007E900001020010503BA3E00000000000000020030C077001C00010007E900001020010500002F0000000000000000000FC095001C00010007E90000102001050000010000"
+	"00000000803F0235C0B3001C00010007E9000010200105030C2700000000000000020030C0C2001C00010007E9000010200107FD000000000000000000000001C0E0001C00010007E900001020010DC30000000000000000000000350000291000000000000000"
+	);
 }
 
 /** simple test of parsing, pcat file */

testcode/unitverify.c

@@ -263,6 +263,7 @@ verifytest_file(const char* fname, const char* at_date)
 	struct entry* list = read_datafile(fname);
 	struct module_env env;
 	struct val_env ve;
+	uint32_t now = time(NULL);
 
 	if(!list)
 		fatal_exit("could not read %s: %s", fname, strerror(errno));
@@ -271,6 +272,7 @@ verifytest_file(const char* fname, const char* at_date)
 	memset(&ve, 0, sizeof(ve));
 	env.scratch = region;
 	env.scratch_buffer = buf;
+	env.now = &now;
 	ve.date_override = cfg_convert_timeval(at_date);
 	unit_assert(region && buf);
 	dnskey = extract_keys(list, &alloc, region, buf);

testdata/iter_donotq127.rpl

@@ -0,0 +1,98 @@
+; config options
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test iterator donotquery of 127/8.
+; The scenario presents an iteration chain that has 127.0.0.2 and
+; 127.255.255.255 as nameserver IPs, like a spam-blocklist.
+; these are 127/8 localhost and should be blocked, causing servfail.
+; if not blocked, they cause a lookup, but this file does not specify
+; 127.* responses, so testbound will fail the test.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.	IN NS	ns2.example.com.
+SECTION ADDITIONAL
+;ns.example.com.	IN 	A	1.2.3.4
+ns.example.com.		IN 	A	127.255.255.255
+ns2.example.com.	IN 	A	127.0.0.2
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END

testdata/nomem_cnametopos.rpl

@@ -0,0 +1,230 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	trust-anchor: "example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}"
+	val-override-date: "20070916134226"
+	msg-cache-size: 8
+	rrset-cache-size: 8
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test cname to positive without cache
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.net. IN A
+SECTION AUTHORITY
+net.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN A
+SECTION AUTHORITY
+net.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN A
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.net. IN A
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.5
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN	CNAME	www.example.net.
+www.example.com.        3600    IN      RRSIG   CNAME DSA 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFGcJxnNxpWCBzXejiSdl4p1BKRMnAhUApoJrugVBRwFgAoYAhhqlZFac7fE= ;{id = 2854}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+; ns.example.net.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.5
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN DNSKEY
+SECTION ANSWER
+example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.5
+ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.net. IN A
+SECTION ANSWER
+www.example.net. IN	A	11.12.13.14
+www.example.net.        3600    IN      RRSIG   A 5 3 3600 20070926134150 20070829134150 30899 example.net. CPxF5hK9Kg5eT7W6LgZwr0ePYEm9HMcSY4vvqCS6gDWB4X9jvXLCfBkCLhsNybPBpGWlsLi5wM6MTdJXuPpsRA== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN	CNAME	www.example.net.
+www.example.com.        3600    IN      RRSIG   CNAME DSA 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFGcJxnNxpWCBzXejiSdl4p1BKRMnAhUApoJrugVBRwFgAoYAhhqlZFac7fE= ;{id = 2854}
+www.example.net. IN	A	11.12.13.14
+www.example.net.        3600    IN      RRSIG   A 5 3 3600 20070926134150 20070829134150 30899 example.net. CPxF5hK9Kg5eT7W6LgZwr0ePYEm9HMcSY4vvqCS6gDWB4X9jvXLCfBkCLhsNybPBpGWlsLi5wM6MTdJXuPpsRA== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END

testdata/val_nsec3_b1_nameerror.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -68,25 +68,25 @@ SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 
 ;; NSEC3 RR that covers the "next closer" name (c.x.w.example)
 ;; H(c.x.w.example) = 0va5bpr2ou0vk0lbqeeljri88laipsfh
 
 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
 
 ;; NSEC3 RR that matches the closest encloser (x.w.example)
 ;; H(x.w.example) = b4um86eghhds6nea196smvmlo4ors995
 
 b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
-b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  GWDmUk8Sv0dxy/UZFol4Ss7Wz3wBiongcnVy strNODWwdnoO9z6pDh8JLk58ExfEgXm79i4b Ma6C/s/bkk1LvA== )
+b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
 
 ;; NSEC3 RR that covers wildcard at the closest encloser (*.x.w.example)
 ;; H(*.x.w.example) = 92pqneegtaue7pjatc3l3qnk738c6v5m
 
 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
 SECTION ADDITIONAL
 ENTRY_END
 
@@ -108,14 +108,14 @@ SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION ANSWER
 SECTION AUTHORITY
-example.       3600 IN SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
 b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
-b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  GWDmUk8Sv0dxy/UZFol4Ss7Wz3wBiongcnVy strNODWwdnoO9z6pDh8JLk58ExfEgXm79i4b Ma6C/s/bkk1LvA== )
+b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
 SECTION ADDITIONAL
 ENTRY_END
 

testdata/val_nsec3_b1_nameerror_noce.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+	trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -68,25 +68,25 @@ SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.	RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 
 ;; NSEC3 RR that covers the "next closer" name (c.x.w.example)
 ;; H(c.x.w.example) = 0va5bpr2ou0vk0lbqeeljri88laipsfh
 
 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
 
 ;; NSEC3 RR that matches the closest encloser (x.w.example)
 ;; H(x.w.example) = b4um86eghhds6nea196smvmlo4ors995
 
-;b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
-;b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  GWDmUk8Sv0dxy/UZFol4Ss7Wz3wBiongcnVy strNODWwdnoO9z6pDh8JLk58ExfEgXm79i4b Ma6C/s/bkk1LvA== )
+; b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
+; b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
 
 ;; NSEC3 RR that covers wildcard at the closest encloser (*.x.w.example)
 ;; H(*.x.w.example) = 92pqneegtaue7pjatc3l3qnk738c6v5m
 
 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
 SECTION ADDITIONAL
 ENTRY_END
 

testdata/val_nsec3_b1_nameerror_nonc.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm 3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,10 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89ep O6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8 Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf 3bH+QsCtg== )
+
 ENTRY_END
 
 ENTRY_BEGIN
@@ -68,25 +69,26 @@ SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd V I2LmKusbZsT0Q== )
 
 ;; NSEC3 RR that covers the "next closer" name (c.x.w.example)
 ;; H(c.x.w.example) = 0va5bpr2ou0vk0lbqeeljri88laipsfh
 
-;0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-;0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )
+;0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi 47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
+;0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRx K9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
 
 ;; NSEC3 RR that matches the closest encloser (x.w.example)
 ;; H(x.w.example) = b4um86eghhds6nea196smvmlo4ors995
 
 b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
-b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  GWDmUk8Sv0dxy/UZFol4Ss7Wz3wBiongcnVy strNODWwdnoO9z6pDh8JLk58ExfEgXm79i4b Ma6C/s/bkk1LvA== )
+b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUi wtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
 
 ;; NSEC3 RR that covers wildcard at the closest encloser (*.x.w.example)
 ;; H(*.x.w.example) = 92pqneegtaue7pjatc3l3qnk738c6v5m
 
 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH +z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
+
 SECTION ADDITIONAL
 ENTRY_END
 

testdata/val_nsec3_b1_nameerror_nowc.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -68,25 +68,26 @@ SECTION QUESTION
 a.c.x.w.example. IN A
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 
 ;; NSEC3 RR that covers the "next closer" name (c.x.w.example)
 ;; H(c.x.w.example) = 0va5bpr2ou0vk0lbqeeljri88laipsfh
 
 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
 
 ;; NSEC3 RR that matches the closest encloser (x.w.example)
 ;; H(x.w.example) = b4um86eghhds6nea196smvmlo4ors995
 
 b4um86eghhds6nea196smvmlo4ors995.example. NSEC3 1 1 12 aabbccdd ( gjeqe526plbf1g8mklp59enfd789njgi MX RRSIG )
-b4um86eghhds6nea196smvmlo4ors995.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  GWDmUk8Sv0dxy/UZFol4Ss7Wz3wBiongcnVy strNODWwdnoO9z6pDh8JLk58ExfEgXm79i4b Ma6C/s/bkk1LvA== )
+b4um86eghhds6nea196smvmlo4ors995.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  ZkPG3M32lmoHM6pa3D6gZFGB/rhL//Bs3Omh 5u4m/CUiwtblEVOaAKKZd7S959OeiX43aLX3 pOv0TSTyiTxIZg== )
 
 ;; NSEC3 RR that covers wildcard at the closest encloser (*.x.w.example)
 ;; H(*.x.w.example) = 92pqneegtaue7pjatc3l3qnk738c6v5m
 
+
 ;35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-;35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
+;35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
 SECTION ADDITIONAL
 ENTRY_END
 

testdata/val_nsec3_b21_nodataent.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+	trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -68,11 +68,12 @@ SECTION QUESTION
 y.w.example.        IN A
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 
 ;; NSEC3 RR matches the QNAME and shows that the A type bit is not set.
 ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd ( k8udemvp1j2f7eg6jebps17vp3n8i58h )
-ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  fvKWkD3lXNLyUn0/gN+i3Z8301oRujSFFrJy SfAPS2Q1bw1Q5eQoy7IE+ZtUVO15ha6C9cUh CArJyEk247MADA== )
+ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  gPkFp1s2QDQ6wQzcg1uSebZ61W33rUBDcTj7 2F3kQ490fEdp7k1BUIfbcZtPbX3YCpE+sIt0 MpzVSKfTwx4uYA== )
+
 SECTION ADDITIONAL
 ENTRY_END
 
@@ -94,10 +95,10 @@ SECTION QUESTION
 y.w.example.        IN A
 SECTION ANSWER
 SECTION AUTHORITY
-example.       3600 IN SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd ( k8udemvp1j2f7eg6jebps17vp3n8i58h )
-ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  fvKWkD3lXNLyUn0/gN+i3Z8301oRujSFFrJy SfAPS2Q1bw1Q5eQoy7IE+ZtUVO15ha6C9cUh CArJyEk247MADA== )
+ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  gPkFp1s2QDQ6wQzcg1uSebZ61W33rUBDcTj7 2F3kQ490fEdp7k1BUIfbcZtPbX3YCpE+sIt0 MpzVSKfTwx4uYA== )
 SECTION ADDITIONAL
 ENTRY_END
 

testdata/val_nsec3_b21_nodataent_wr.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+	trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -68,16 +68,15 @@ SECTION QUESTION
 y.w.example.        IN A
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 
 ;; NSEC3 RR matches the QNAME and shows that the A type bit is not set.
 ;ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. NSEC3 1 1 12 aabbccdd ( k8udemvp1j2f7eg6jebps17vp3n8i58h )
-;ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  fvKWkD3lXNLyUn0/gN+i3Z8301oRujSFFrJy SfAPS2Q1bw1Q5eQoy7IE+ZtUVO15ha6C9cUh CArJyEk247MADA== )
+;ji6neoaepv8b5o6k4ev33abha8ht9fgc.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  gPkFp1s2QDQ6wQzcg1uSebZ61W33rUBDcTj7 2F3kQ490fEdp7k1BUIfbcZtPbX3YCpE+sIt0 MpzVSKfTwx4uYA== )
 
 ; instead the wrong NSEC3 rr is included
 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
-
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
 
 SECTION ADDITIONAL
 ENTRY_END

testdata/val_nsec3_b2_nodata.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -68,11 +68,12 @@ SECTION QUESTION
 ns1.example.        IN MX
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 
 ;; NSEC3 RR matches the QNAME and shows that the MX type bit is not set.
-2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. NSEC3 1 1 12 aabbccdd ( 2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG )
-2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  fJER1Z3nGoN0HmZm99lqNLSpIf7jLXTMoGm2 k4gIwlc0R4DztJp6Sq37OV6XnGdre4MfgRpB mAcgpPWC5A5eiw== )
+2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. NSEC3   1 1 12 aabbccdd ( 2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG )
+2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OmBvJ1Vgg1hCKMXHFiNeIYHK9XVW0iLDLwJN 4TFoNxZuP03gAXEI634YwOc4YBNITrj413iq NI6mRk/r1dOSUw== )
+
 SECTION ADDITIONAL
 ENTRY_END
 
@@ -94,10 +95,10 @@ SECTION QUESTION
 ns1.example.        IN MX
 SECTION ANSWER
 SECTION AUTHORITY
-example.       3600 IN SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
-2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. NSEC3 1 1 12 aabbccdd ( 2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG )
-2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  fJER1Z3nGoN0HmZm99lqNLSpIf7jLXTMoGm2 k4gIwlc0R4DztJp6Sq37OV6XnGdre4MfgRpB mAcgpPWC5A5eiw== )
+example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
+2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. NSEC3   1 1 12 aabbccdd ( 2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG )
+2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OmBvJ1Vgg1hCKMXHFiNeIYHK9XVW0iLDLwJN 4TFoNxZuP03gAXEI634YwOc4YBNITrj413iq NI6mRk/r1dOSUw== )
 SECTION ADDITIONAL
 ENTRY_END
 

testdata/val_nsec3_b2_nodata_nons.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ; response to DS query
@@ -77,11 +77,12 @@ SECTION QUESTION
 ns1.example.        IN MX
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 
 ;; NSEC3 RR matches the QNAME and shows that the MX type bit is not set.
-;2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. NSEC3 1 1 12 aabbccdd ( 2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG )
-;2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  fJER1Z3nGoN0HmZm99lqNLSpIf7jLXTMoGm2 k4gIwlc0R4DztJp6Sq37OV6XnGdre4MfgRpB mAcgpPWC5A5eiw== )
+;2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. NSEC3   1 1 12 aabbccdd ( 2vptu5timamqttgl4luu9kg21e0aor3s A RRSIG )
+;2t7b4g4vsa5smi47k61mv5bv1a22bojr.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OmBvJ1Vgg1hCKMXHFiNeIYHK9XVW0iLDLwJN 4TFoNxZuP03gAXEI634YwOc4YBNITrj413iq NI6mRk/r1dOSUw== )
+
 SECTION ADDITIONAL
 ENTRY_END
 

testdata/val_nsec3_b3_optout.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -73,12 +73,12 @@ c.example. 	NS      ns2.c.example.
 ;; NSEC3 RR that covers the "next closer" name (c.example)
 ;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck
 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
 
 ;; NSEC3 RR that matches the closest encloser (example)
 ;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
 
 SECTION ADDITIONAL
 ns1.c.example. A       192.0.2.7
@@ -96,12 +96,12 @@ SECTION AUTHORITY
 ;; NSEC3 RR that covers the "next closer" name (c.example)
 ;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck
 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
 
 ;; NSEC3 RR that matches the closest encloser (example)
 ;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
 ENTRY_END
 
 RANGE_END

testdata/val_nsec3_b3_optout_noce.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -73,12 +73,12 @@ c.example. 	NS      ns2.c.example.
 ;; NSEC3 RR that covers the "next closer" name (c.example)
 ;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck
 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
 
 ;; NSEC3 RR that matches the closest encloser (example)
 ;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
 
 SECTION ADDITIONAL
 ns1.c.example. A       192.0.2.7
@@ -96,12 +96,12 @@ SECTION AUTHORITY
 ;; NSEC3 RR that covers the "next closer" name (c.example)
 ;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck
 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
 
 ;; NSEC3 RR that matches the closest encloser (example)
 ;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
 ;0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-;0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )
+;0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
 ENTRY_END
 
 RANGE_END

testdata/val_nsec3_b3_optout_nonc.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -73,12 +73,12 @@ c.example. 	NS      ns2.c.example.
 ;; NSEC3 RR that covers the "next closer" name (c.example)
 ;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck
 35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
+35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
 
 ;; NSEC3 RR that matches the closest encloser (example)
 ;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
 
 SECTION ADDITIONAL
 ns1.c.example. A       192.0.2.7
@@ -96,12 +96,12 @@ SECTION AUTHORITY
 ;; NSEC3 RR that covers the "next closer" name (c.example)
 ;; H(c.example) = 4g6p9u5gvfshp30pqecj98b3maqbn1ck
 ;35mthgpgcu1qg68fab165klnsnk3dpvl.example. NSEC3 1 1 12 aabbccdd ( b4um86eghhds6nea196smvmlo4ors995 NS DS RRSIG )
-;35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  QrjOpXVIvodCw0O8uPMNA+yEeS/o3KKkEIPX r5DoEShq2hymAsRTc/t9BvRKpcSTExyc5m3T vYN3GgN0W/0WHQ== )
+;35mthgpgcu1qg68fab165klnsnk3dpvl.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  g6jPUUpduAJKRljUsN8gB4UagAX0NxY9shwQ Aynzo8EUWH+z6hEIBlUTPGj15eZll6VhQqgZ XtAIR3chwgW+SA== )
 
 ;; NSEC3 RR that matches the closest encloser (example)
 ;; H(example) = 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom
 0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. NSEC3 1 1 12 aabbccdd ( 2t7b4g4vsa5smi47k61mv5bv1a22bojr MX DNSKEY NS SOA NSEC3PARAM RRSIG )
-0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  rn2tv99+9StXbc7JaEnjT1+8I8f2vVOMOIbF xzlrn94lQLxEOYxQR4SrxDRP4/fC54Jui0Ix 4eI9tMfaTVgehQ== )
+0p9mhaveqvm6t7vbl5lop2u3t2rp3tom.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  OSgWSm26B+cS+dDL8b5QrWr/dEWhtCsKlwKL IBHYH6blRxK9rC0bMJPwQ4mLIuw85H2EY762 BOCXJZMnpuwhpA== )
 ENTRY_END
 
 RANGE_END

testdata/val_nsec3_b4_wild.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -68,22 +68,22 @@ SECTION QUESTION
 a.z.w.example. IN MX
 SECTION ANSWER
 a.z.w.example. MX      1 ai.example.
-a.z.w.example. RRSIG   MX 133 2 3600 20150420235959 20051021000000 ( 62827 example.  DnT0Y6dRBM8f3v8HdKmZUsGVkXh+b+htujCR c423x6c8erEMGVnxcrmcrZ53qGXcMYJ+TDkq a7Xfz/f9xzvSTw== )
+a.z.w.example. RRSIG   MX 7 2 3600 20150420235959 20051021000000 ( 40430 example.  CikebjQwGQPwijVcxgcZcSJKtfynugtlBiKb 9FcBTrmOoyQ4InoWVudhCWsh/URX3lc4WRUM ivEBP6+4KS3ldA== )
 SECTION AUTHORITY
 example.       NS      ns1.example.
 example.       NS      ns2.example.
-example.       RRSIG   NS 133 1 3600 20150420235959 20051021000000 ( 62827 example.  D9+iBwcbeKL5+TorTfYn4/pLr2lSFwyGYCyM gfq4TpFaZpxrCJPLxHbKjdkR18jAt7+SR7B5 JpiZcff2Cj2B0w== )
+example. RRSIG   NS 7 1 3600 20150420235959 20051021000000 ( 40430 example.  PVOgtMK1HHeSTau+HwDWC8Ts+6C8qtqd4pQJ qOtdEVgg+MA+ai4fWDEhu3qHJyLcQ9tbD2vv CnMXjtz6SyObxA== )
 
 ;; NSEC3 RR that covers the "next closer" name (z.w.example)
 ;; H(z.w.example) = qlu7gtfaeh0ek0c05ksfhdpbcgglbe03
 q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd ( r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
-q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  ktIfH8VRjEKYPB0Qf4EdTuSlYn4DVSRRaGWc kVGmKzreEU5zs97CL8OQSa6C0JZX2yMBXijC Wu6EvgCXrflgiQ== )
+q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3 ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN NlkxWcLsIlMmUg== )
 
 SECTION ADDITIONAL
 ai.example.    A       192.0.2.9
-ai.example.    RRSIG   A 133 2 3600 20150420235959 20051021000000 ( 62827 example.  qfXAvKr5o3Jixy5KXnVMEhABo3DDHYSR5+Ag lVxWCExWGMokdkafjW8Hb54+GrOFp/xmDoj5 BXfXAqURwLqznA== )
+ai.example.    RRSIG   A 7 2 3600 20150420235959 20051021000000 ( 40430 example.  hVe+wKYMlObTRPhX0NL67GxeZfdxqr/QeR6F tfdAj5+FgYxyzPEjIzvKWy00hWIl6wD3Vws+ rznEn8sQ64UdqA== )
 ai.example.    AAAA    2001:db8:0:0:0:0:f00:baa9
-ai.example.    RRSIG   AAAA 133 2 3600 20150420235959 ( 20051021000000 62827 example.  m65zc0A16Xbx3jYb0t5vPwMzE2xS15mKh76M hSuKfiFVhBFcQ9IilEM0pXnLzt3ozrM/3X0x 2ruyuN0zC+PABA== )
+ai.example.    RRSIG   AAAA 7 2 3600 20150420235959 20051021000000 ( 40430 example.  LcdxKaCB5bGZwPDg+3JJ4O02zoMBrjxqlf6W uaHQZZfTUpb9Nf2nxFGe2XRPfR5tpJT6GdRG cHueLuXkMjBArQ== )
 ENTRY_END
 
 ; catch glue queries
@@ -126,18 +126,18 @@ SECTION QUESTION
 a.z.w.example. IN MX
 SECTION ANSWER
 a.z.w.example. MX      1 ai.example.
-a.z.w.example. RRSIG   MX 133 2 3600 20150420235959 20051021000000 ( 62827 example.  DnT0Y6dRBM8f3v8HdKmZUsGVkXh+b+htujCR c423x6c8erEMGVnxcrmcrZ53qGXcMYJ+TDkq a7Xfz/f9xzvSTw== )
+a.z.w.example. RRSIG   MX 7 2 3600 20150420235959 20051021000000 ( 40430 example.  CikebjQwGQPwijVcxgcZcSJKtfynugtlBiKb 9FcBTrmOoyQ4InoWVudhCWsh/URX3lc4WRUM ivEBP6+4KS3ldA== )
 SECTION AUTHORITY
 example.       NS      ns1.example.
 example.       NS      ns2.example.
-example.       RRSIG   NS 133 1 3600 20150420235959 20051021000000 ( 62827 example.  D9+iBwcbeKL5+TorTfYn4/pLr2lSFwyGYCyM gfq4TpFaZpxrCJPLxHbKjdkR18jAt7+SR7B5 JpiZcff2Cj2B0w== )
+example. RRSIG   NS 7 1 3600 20150420235959 20051021000000 ( 40430 example.  PVOgtMK1HHeSTau+HwDWC8Ts+6C8qtqd4pQJ qOtdEVgg+MA+ai4fWDEhu3qHJyLcQ9tbD2vv CnMXjtz6SyObxA== )
 q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd ( r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
-q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  ktIfH8VRjEKYPB0Qf4EdTuSlYn4DVSRRaGWc kVGmKzreEU5zs97CL8OQSa6C0JZX2yMBXijC Wu6EvgCXrflgiQ== )
+q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3 ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN NlkxWcLsIlMmUg== )
 
 SECTION ADDITIONAL
 ai.example.    A       192.0.2.9
 ai.example.    AAAA    2001:db8:0:0:0:0:f00:baa9
-ai.example.    RRSIG   A 133 2 3600 20150420235959 20051021000000 ( 62827 example.  qfXAvKr5o3Jixy5KXnVMEhABo3DDHYSR5+Ag lVxWCExWGMokdkafjW8Hb54+GrOFp/xmDoj5 BXfXAqURwLqznA== )
-ai.example.    RRSIG   AAAA 133 2 3600 20150420235959 ( 20051021000000 62827 example.  m65zc0A16Xbx3jYb0t5vPwMzE2xS15mKh76M hSuKfiFVhBFcQ9IilEM0pXnLzt3ozrM/3X0x 2ruyuN0zC+PABA== )
+ai.example.    RRSIG   A 7 2 3600 20150420235959 20051021000000 ( 40430 example.  hVe+wKYMlObTRPhX0NL67GxeZfdxqr/QeR6F tfdAj5+FgYxyzPEjIzvKWy00hWIl6wD3Vws+ rznEn8sQ64UdqA== )
+ai.example.    RRSIG   AAAA 7 2 3600 20150420235959 20051021000000 ( 40430 example.  LcdxKaCB5bGZwPDg+3JJ4O02zoMBrjxqlf6W uaHQZZfTUpb9Nf2nxFGe2XRPfR5tpJT6GdRG cHueLuXkMjBArQ== )
 ENTRY_END
 SCENARIO_END

testdata/val_nsec3_b4_wild_wr.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+	trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -68,26 +68,26 @@ SECTION QUESTION
 a.z.w.example. IN MX
 SECTION ANSWER
 a.z.w.example. MX      1 ai.example.
-a.z.w.example. RRSIG   MX 133 2 3600 20150420235959 20051021000000 ( 62827 example.  DnT0Y6dRBM8f3v8HdKmZUsGVkXh+b+htujCR c423x6c8erEMGVnxcrmcrZ53qGXcMYJ+TDkq a7Xfz/f9xzvSTw== )
+a.z.w.example. RRSIG   MX 7 2 3600 20150420235959 20051021000000 ( 40430 example.  CikebjQwGQPwijVcxgcZcSJKtfynugtlBiKb 9FcBTrmOoyQ4InoWVudhCWsh/URX3lc4WRUM ivEBP6+4KS3ldA== )
 SECTION AUTHORITY
 example.       NS      ns1.example.
 example.       NS      ns2.example.
-example.       RRSIG   NS 133 1 3600 20150420235959 20051021000000 ( 62827 example.  D9+iBwcbeKL5+TorTfYn4/pLr2lSFwyGYCyM gfq4TpFaZpxrCJPLxHbKjdkR18jAt7+SR7B5 JpiZcff2Cj2B0w== )
+example. RRSIG   NS 7 1 3600 20150420235959 20051021000000 ( 40430 example.  PVOgtMK1HHeSTau+HwDWC8Ts+6C8qtqd4pQJ qOtdEVgg+MA+ai4fWDEhu3qHJyLcQ9tbD2vv CnMXjtz6SyObxA== )
 
 ;; NSEC3 RR that covers the "next closer" name (z.w.example)
 ;; H(z.w.example) = qlu7gtfaeh0ek0c05ksfhdpbcgglbe03
 ;q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd ( r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
-;q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  ktIfH8VRjEKYPB0Qf4EdTuSlYn4DVSRRaGWc kVGmKzreEU5zs97CL8OQSa6C0JZX2yMBXijC Wu6EvgCXrflgiQ== )
+;q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3 ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN NlkxWcLsIlMmUg== )
 
 ; The wrong NSEC3 here
 k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd ( kohar7mbb8dc2ce8a9qvl8hon4k53uhi )
-k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  IKJfInxfypsDiXKgT6HDvCPEIBu9lZCc0CWl c46+Gj/Jrg1NBkSJkKMjCERp1HT8tKU+zYp5 Kyio/cddEaa5Gg== )
+k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  FtXGbvF0+wf8iWkyo73enAuVx03klN+pILBK S6qCcftVtfH4yVzsEZquJ27NHR7ruxJWDNMt Otx7w9WfcIg62A== )
 
 SECTION ADDITIONAL
 ai.example.    A       192.0.2.9
-ai.example.    RRSIG   A 133 2 3600 20150420235959 20051021000000 ( 62827 example.  qfXAvKr5o3Jixy5KXnVMEhABo3DDHYSR5+Ag lVxWCExWGMokdkafjW8Hb54+GrOFp/xmDoj5 BXfXAqURwLqznA== )
+ai.example.    RRSIG   A 7 2 3600 20150420235959 20051021000000 ( 40430 example.  hVe+wKYMlObTRPhX0NL67GxeZfdxqr/QeR6F tfdAj5+FgYxyzPEjIzvKWy00hWIl6wD3Vws+ rznEn8sQ64UdqA== )
 ai.example.    AAAA    2001:db8:0:0:0:0:f00:baa9
-ai.example.    RRSIG   AAAA 133 2 3600 20150420235959 ( 20051021000000 62827 example.  m65zc0A16Xbx3jYb0t5vPwMzE2xS15mKh76M hSuKfiFVhBFcQ9IilEM0pXnLzt3ozrM/3X0x 2ruyuN0zC+PABA== )
+ai.example.    RRSIG   AAAA 7 2 3600 20150420235959 20051021000000 ( 40430 example.  LcdxKaCB5bGZwPDg+3JJ4O02zoMBrjxqlf6W uaHQZZfTUpb9Nf2nxFGe2XRPfR5tpJT6GdRG cHueLuXkMjBArQ== )
 ENTRY_END
 
 ; catch glue queries

testdata/val_nsec3_b5_wcnodata.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -69,24 +69,22 @@ a.z.w.example.      IN AAAA
 SECTION ANSWER
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 
 ;; NSEC3 RR that matches the closest encloser (w.example)
 ;; H(w.example) = k8udemvp1j2f7eg6jebps17vp3n8i58h
 k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd ( kohar7mbb8dc2ce8a9qvl8hon4k53uhi )
-k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  IKJfInxfypsDiXKgT6HDvCPEIBu9lZCc0CWl c46+Gj/Jrg1NBkSJkKMjCERp1HT8tKU+zYp5 Kyio/cddEaa5Gg== )
+k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  FtXGbvF0+wf8iWkyo73enAuVx03klN+pILBK S6qCcftVtfH4yVzsEZquJ27NHR7ruxJWDNMt Otx7w9WfcIg62A== )
 
 ;; NSEC3 RR that covers the "next closer" name (z.w.example)
 ;; H(z.w.example) = qlu7gtfaeh0ek0c05ksfhdpbcgglbe03
-
 q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd ( r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
-q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  ktIfH8VRjEKYPB0Qf4EdTuSlYn4DVSRRaGWc kVGmKzreEU5zs97CL8OQSa6C0JZX2yMBXijC Wu6EvgCXrflgiQ== )
+q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3 ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN NlkxWcLsIlMmUg== )
 
 ;; NSEC3 RR that matches a wildcard at the closest encloser.
 ;; H(*.w.example) = r53bq7cc2uvmubfu5ocmm6pers9tk9en
-
 r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd ( t644ebqk9bibcna874givr6joj62mlhv MX RRSIG )
-r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  SzeyaiFOy9dFO1RKHAK4uVCb5GF4rNnxFMXu 6hpM44cmLcDgshlnG1CwkkcihfKOiPIBWd7I bGhsbhqrBrn5Dg== )
+r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  aupviViruXs4bDg9rCbezzBMf9h1ZlDvbW/C ZFKulIGXXLj8B/fsDJarXVDA9bnUoRhEbKp+ HF1FWKW7RIJdtQ== )
 
 SECTION ADDITIONAL
 ENTRY_END
@@ -132,13 +130,13 @@ a.z.w.example.      IN AAAA
 SECTION ANSWER
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd ( kohar7mbb8dc2ce8a9qvl8hon4k53uhi )
-k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  IKJfInxfypsDiXKgT6HDvCPEIBu9lZCc0CWl c46+Gj/Jrg1NBkSJkKMjCERp1HT8tKU+zYp5 Kyio/cddEaa5Gg== )
+k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  FtXGbvF0+wf8iWkyo73enAuVx03klN+pILBK S6qCcftVtfH4yVzsEZquJ27NHR7ruxJWDNMt Otx7w9WfcIg62A== )
 q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd ( r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
-q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  ktIfH8VRjEKYPB0Qf4EdTuSlYn4DVSRRaGWc kVGmKzreEU5zs97CL8OQSa6C0JZX2yMBXijC Wu6EvgCXrflgiQ== )
+q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3 ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN NlkxWcLsIlMmUg== )
 r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd ( t644ebqk9bibcna874givr6joj62mlhv MX RRSIG )
-r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  SzeyaiFOy9dFO1RKHAK4uVCb5GF4rNnxFMXu 6hpM44cmLcDgshlnG1CwkkcihfKOiPIBWd7I bGhsbhqrBrn5Dg== )
+r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  aupviViruXs4bDg9rCbezzBMf9h1ZlDvbW/C ZFKulIGXXLj8B/fsDJarXVDA9bnUoRhEbKp+ HF1FWKW7RIJdtQ== )
 
 SECTION ADDITIONAL
 ENTRY_END

testdata/val_nsec3_b5_wcnodata_noce.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -69,24 +69,22 @@ a.z.w.example.      IN AAAA
 SECTION ANSWER
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 
 ;; NSEC3 RR that matches the closest encloser (w.example)
 ;; H(w.example) = k8udemvp1j2f7eg6jebps17vp3n8i58h
 ;k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd ( kohar7mbb8dc2ce8a9qvl8hon4k53uhi )
-;k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  IKJfInxfypsDiXKgT6HDvCPEIBu9lZCc0CWl c46+Gj/Jrg1NBkSJkKMjCERp1HT8tKU+zYp5 Kyio/cddEaa5Gg== )
+;k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  FtXGbvF0+wf8iWkyo73enAuVx03klN+pILBK S6qCcftVtfH4yVzsEZquJ27NHR7ruxJWDNMt Otx7w9WfcIg62A== )
 
 ;; NSEC3 RR that covers the "next closer" name (z.w.example)
 ;; H(z.w.example) = qlu7gtfaeh0ek0c05ksfhdpbcgglbe03
-
 q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd ( r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
-q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  ktIfH8VRjEKYPB0Qf4EdTuSlYn4DVSRRaGWc kVGmKzreEU5zs97CL8OQSa6C0JZX2yMBXijC Wu6EvgCXrflgiQ== )
+q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3 ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN NlkxWcLsIlMmUg== )
 
 ;; NSEC3 RR that matches a wildcard at the closest encloser.
 ;; H(*.w.example) = r53bq7cc2uvmubfu5ocmm6pers9tk9en
-
 r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd ( t644ebqk9bibcna874givr6joj62mlhv MX RRSIG )
-r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  SzeyaiFOy9dFO1RKHAK4uVCb5GF4rNnxFMXu 6hpM44cmLcDgshlnG1CwkkcihfKOiPIBWd7I bGhsbhqrBrn5Dg== )
+r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  aupviViruXs4bDg9rCbezzBMf9h1ZlDvbW/C ZFKulIGXXLj8B/fsDJarXVDA9bnUoRhEbKp+ HF1FWKW7RIJdtQ== )
 
 SECTION ADDITIONAL
 ENTRY_END

testdata/val_nsec3_b5_wcnodata_nonc.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -69,24 +69,22 @@ a.z.w.example.      IN AAAA
 SECTION ANSWER
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 
 ;; NSEC3 RR that matches the closest encloser (w.example)
 ;; H(w.example) = k8udemvp1j2f7eg6jebps17vp3n8i58h
 k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd ( kohar7mbb8dc2ce8a9qvl8hon4k53uhi )
-k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  IKJfInxfypsDiXKgT6HDvCPEIBu9lZCc0CWl c46+Gj/Jrg1NBkSJkKMjCERp1HT8tKU+zYp5 Kyio/cddEaa5Gg== )
+k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  FtXGbvF0+wf8iWkyo73enAuVx03klN+pILBK S6qCcftVtfH4yVzsEZquJ27NHR7ruxJWDNMt Otx7w9WfcIg62A== )
 
 ;; NSEC3 RR that covers the "next closer" name (z.w.example)
 ;; H(z.w.example) = qlu7gtfaeh0ek0c05ksfhdpbcgglbe03
-
 ;q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd ( r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
-;q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  ktIfH8VRjEKYPB0Qf4EdTuSlYn4DVSRRaGWc kVGmKzreEU5zs97CL8OQSa6C0JZX2yMBXijC Wu6EvgCXrflgiQ== )
+;q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3 ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN NlkxWcLsIlMmUg== )
 
 ;; NSEC3 RR that matches a wildcard at the closest encloser.
 ;; H(*.w.example) = r53bq7cc2uvmubfu5ocmm6pers9tk9en
-
 r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd ( t644ebqk9bibcna874givr6joj62mlhv MX RRSIG )
-r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  SzeyaiFOy9dFO1RKHAK4uVCb5GF4rNnxFMXu 6hpM44cmLcDgshlnG1CwkkcihfKOiPIBWd7I bGhsbhqrBrn5Dg== )
+r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  aupviViruXs4bDg9rCbezzBMf9h1ZlDvbW/C ZFKulIGXXLj8B/fsDJarXVDA9bnUoRhEbKp+ HF1FWKW7RIJdtQ== )
 
 SECTION ADDITIONAL
 ENTRY_END

testdata/val_nsec3_b5_wcnodata_nowc.rpl

@@ -1,6 +1,6 @@
 ; config options
 server:
-	trust-anchor: "example. DNSKEY  257 3 133 (AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )"
+        trust-anchor: "example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )"
 	val-override-date: "20120420235959"
 
 stub-zone:
@@ -55,9 +55,9 @@ REPLY QR NOERROR
 SECTION QUESTION
 example. IN DNSKEY
 SECTION ANSWER
-example. DNSKEY  256 3 133 ( AQO0gEmbZUL6xbD/xQczHbnwYnf+jQjwz/sU 5k44rHTt0Ty+3aOdYoome9TjGMhwkkGby1TL ExXT48OGGdbfIme5 )
-example. DNSKEY  257 3 133 ( AQOnsGyJvywVjYmiLbh0EwIRuWYcDiB/8blX cpkoxtpe19Oicv6Zko+8brVsTMeMOpcUeGB1 zsYKWJ7BvR2894hX )
-example. RRSIG   DNSKEY 133 1 3600 20150420235959 ( 20051021000000 22088 example.  Xpo9ptByXb8M1JR1i0KuRmKGc/YeOLcc6Ptn RJOx6ADLSL2mU6AYX5tAJRMTKTXk6waLIaxu liqUBOkCjLUZMw== )
+example. DNSKEY  256 3 7 AwEAAaetidLzsKWUt4swWR8yu0wPHPiUi8LU ( sAD0QPWU+wzt89epO6tHzkMBVDkC7qphQO2h TY4hHn9npWFRw5BYubE= )
+example. DNSKEY  257 3 7 AwEAAcUlFV1vhmqx6NSOUOq2R/dsR7Xm3upJ ( j7IommWSpJABVfW8Q0rOvXdM6kzt+TAu92L9 AbsUdblMFin8CVF3n4s= )
+example. RRSIG   DNSKEY 7 1 3600 20150420235959 ( 20051021000000 12708 example.  AuU4juU9RaxescSmStrQks3Gh9FblGBlVU31 uzMZ/U/FpsUb8aC6QZS+sTsJXnLnz7flGOsm MGQZf3bH+QsCtg== )
 ENTRY_END
 
 ENTRY_BEGIN
@@ -69,24 +69,22 @@ a.z.w.example.      IN AAAA
 SECTION ANSWER
 SECTION AUTHORITY
 example.       SOA     ns1.example. bugs.x.w.example. 1 3600 300 ( 3600000 3600 )
-example.       RRSIG   SOA 133 1 3600 20150420235959 20051021000000 ( 62827 example.  hNIkW1xzn+c+9P3W7PUVVptI72xEmOtn+eqQ ux0BE7Pfc6ikx4m7ivOVWETjbwHjqfY0X5G+ rynLZNqsbLm40Q== )
+example.        RRSIG   SOA 7 1 3600 20150420235959 20051021000000 ( 40430 example.  Hu25UIyNPmvPIVBrldN+9Mlp9Zql39qaUd8i q4ZLlYWfUUbbAS41pG+68z81q1xhkYAcEyHd VI2LmKusbZsT0Q== )
 
 ;; NSEC3 RR that matches the closest encloser (w.example)
 ;; H(w.example) = k8udemvp1j2f7eg6jebps17vp3n8i58h
 k8udemvp1j2f7eg6jebps17vp3n8i58h.example. NSEC3 1 1 12 aabbccdd ( kohar7mbb8dc2ce8a9qvl8hon4k53uhi )
-k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  IKJfInxfypsDiXKgT6HDvCPEIBu9lZCc0CWl c46+Gj/Jrg1NBkSJkKMjCERp1HT8tKU+zYp5 Kyio/cddEaa5Gg== )
+k8udemvp1j2f7eg6jebps17vp3n8i58h.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  FtXGbvF0+wf8iWkyo73enAuVx03klN+pILBK S6qCcftVtfH4yVzsEZquJ27NHR7ruxJWDNMt Otx7w9WfcIg62A== )
 
 ;; NSEC3 RR that covers the "next closer" name (z.w.example)
 ;; H(z.w.example) = qlu7gtfaeh0ek0c05ksfhdpbcgglbe03
-
 q04jkcevqvmu85r014c7dkba38o0ji5r.example. NSEC3 1 1 12 aabbccdd ( r53bq7cc2uvmubfu5ocmm6pers9tk9en A RRSIG )
-q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  ktIfH8VRjEKYPB0Qf4EdTuSlYn4DVSRRaGWc kVGmKzreEU5zs97CL8OQSa6C0JZX2yMBXijC Wu6EvgCXrflgiQ== )
+q04jkcevqvmu85r014c7dkba38o0ji5r.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  hV5I89b+4FHJDATp09g4bbN0R1F845CaXpL3 ZxlMKimoPAyqletMlEWwLfFia7sdpSzn+ZlN NlkxWcLsIlMmUg== )
 
 ;; NSEC3 RR that matches a wildcard at the closest encloser.
 ;; H(*.w.example) = r53bq7cc2uvmubfu5ocmm6pers9tk9en
-
 ;r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. NSEC3 1 1 12 aabbccdd ( t644ebqk9bibcna874givr6joj62mlhv MX RRSIG )
-;r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG NSEC3 133 2 3600 ( 20150420235959 20051021000000 62827 example.  SzeyaiFOy9dFO1RKHAK4uVCb5GF4rNnxFMXu 6hpM44cmLcDgshlnG1CwkkcihfKOiPIBWd7I bGhsbhqrBrn5Dg== )
+;r53bq7cc2uvmubfu5ocmm6pers9tk9en.example. RRSIG   NSEC3 7 2 3600 20150420235959 20051021000000 ( 40430 example.  aupviViruXs4bDg9rCbezzBMf9h1ZlDvbW/C ZFKulIGXXLj8B/fsDJarXVDA9bnUoRhEbKp+ HF1FWKW7RIJdtQ== )
 
 SECTION ADDITIONAL
 ENTRY_END

util/config_file.c

@@ -96,11 +96,10 @@ config_create()
 	cfg->infra_cache_numhosts = 10000;
 	cfg->infra_cache_lame_size = 10240; /* easily 40 or more entries */
 	if(!(cfg->username = strdup("unbound"))) goto error_exit;
-	if(!(cfg->chrootdir = strdup("/etc/unbound"))) goto error_exit;
-	if(!(cfg->directory = strdup("/etc/unbound"))) goto error_exit;
+	if(!(cfg->chrootdir = strdup(CHROOT_DIR))) goto error_exit;
+	if(!(cfg->directory = strdup(RUN_DIR))) goto error_exit;
 	if(!(cfg->logfile = strdup(""))) goto error_exit;
-	if(!(cfg->pidfile = strdup("/etc/unbound/unbound.pid"))) 
-		goto error_exit;
+	if(!(cfg->pidfile = strdup(PIDFILE))) goto error_exit;
 	if(!(cfg->target_fetch_policy = strdup("3 2 1 0 0"))) goto error_exit;
 	cfg->donotqueryaddrs = NULL;
 	cfg->donotquery_localhost = 1;
@@ -118,6 +117,7 @@ config_create()
 	cfg->harden_large_queries = 0;
 	cfg->harden_glue = 1;
 	cfg->harden_dnssec_stripped = 1;
+	cfg->use_caps_bits_for_id = 0;
 	cfg->hide_identity = 0;
 	cfg->hide_version = 0;
 	cfg->identity = NULL;
@@ -133,8 +133,6 @@ config_create()
 	cfg->local_zones = NULL;
 	cfg->local_zones_nodefault = NULL;
 	cfg->local_data = NULL;
-	cfg->donotquery_localhost = 0; /* allow, so that you can ask a
-		forward nameserver running on localhost */
 	if(!(cfg->module_conf = strdup("validator iterator"))) goto error_exit;
 	if(!(cfg->val_nsec3_key_iterations = 
 		strdup("1024 150 2048 500 4096 2500"))) goto error_exit;
@@ -161,9 +159,173 @@ struct config_file* config_create_forlib()
 	cfg->use_syslog = 0;
 	cfg->key_cache_size = 1024*1024;
 	cfg->key_cache_slabs = 1;
+	cfg->donotquery_localhost = 0; /* allow, so that you can ask a
+		forward nameserver running on localhost */
 	return cfg;
 }
 
+/** check that the value passed is >= 0 */
+#define IS_NUMBER_OR_ZERO \
+	if(atoi(val) == 0 && strcmp(val, "0") != 0) return 0
+/** check that the value passed is > 0 */
+#define IS_NONZERO_NUMBER \
+	if(atoi(val) == 0) return 0
+/** check that the value passed is not 0 and a power of 2 */
+#define IS_POW2_NUMBER \
+	if(atoi(val) == 0 || !is_pow2((size_t)atoi(val))) return 0
+/** check that the value passed is yes or no */
+#define IS_YES_OR_NO \
+	if(strcmp(val, "yes") != 0 && strcmp(val, "no") != 0) return 0
+
+int config_set_option(struct config_file* cfg, const char* opt,
+        const char* val)
+{
+	if(strcmp(opt, "verbosity:") == 0) {
+		IS_NUMBER_OR_ZERO;
+		cfg->verbosity = atoi(val);
+	} else if(strcmp(opt, "statistics-interval:") == 0) {
+		if(strcmp(val, "0") == 0 || strcmp(val, "") == 0)
+			cfg->stat_interval = 0;
+		else if(atoi(val) == 0)
+			return 0;
+		else cfg->stat_interval = atoi(val);
+	} else if(strcmp(opt, "num_threads:") == 0) {
+		/* not supported, library must have 1 thread in bgworker */
+		return 0;
+	} else if(strcmp(opt, "do-ip4:") == 0) {
+		IS_YES_OR_NO;
+		cfg->do_ip4 = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "do-ip6:") == 0) {
+		IS_YES_OR_NO;
+		cfg->do_ip6 = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "do-udp:") == 0) {
+		IS_YES_OR_NO;
+		cfg->do_udp = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "do-tcp:") == 0) {
+		IS_YES_OR_NO;
+		cfg->do_tcp = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "outgoing-port:") == 0) {
+		IS_NUMBER_OR_ZERO;
+		cfg->outgoing_base_port = atoi(val);
+	} else if(strcmp(opt, "outgoing-range:") == 0) {
+		IS_NONZERO_NUMBER;
+		cfg->outgoing_num_ports = atoi(val);
+	} else if(strcmp(opt, "outgoing-num-tcp:") == 0) {
+		IS_NUMBER_OR_ZERO;
+		cfg->outgoing_num_tcp = (size_t)atoi(val);
+	} else if(strcmp(opt, "incoming-num-tcp:") == 0) {
+		IS_NUMBER_OR_ZERO;
+		cfg->incoming_num_tcp = (size_t)atoi(val);
+	} else if(strcmp(opt, "msg-buffer-size:") == 0) {
+		IS_NONZERO_NUMBER;
+		cfg->msg_buffer_size = (size_t)atoi(val);
+	} else if(strcmp(opt, "msg-cache-size:") == 0) {
+		return cfg_parse_memsize(val, &cfg->msg_cache_size);
+	} else if(strcmp(opt, "msg-cache-slabs:") == 0) {
+		IS_POW2_NUMBER;
+		cfg->msg_cache_slabs = (size_t)atoi(val);
+	} else if(strcmp(opt, "num-queries-per-thread:") == 0) {
+		IS_NONZERO_NUMBER;
+		cfg->num_queries_per_thread = (size_t)atoi(val);
+	} else if(strcmp(opt, "rrset-cache-size:") == 0) {
+		return cfg_parse_memsize(val, &cfg->rrset_cache_size);
+	} else if(strcmp(opt, "rrset-cache-slabs:") == 0) {
+		IS_POW2_NUMBER;
+		cfg->rrset_cache_slabs = (size_t)atoi(val);
+	} else if(strcmp(opt, "cache-max-ttl:") == 0) {
+		IS_NUMBER_OR_ZERO;
+		cfg->max_ttl = atoi(val);
+	} else if(strcmp(opt, "infra-host-ttl:") == 0) {
+		IS_NUMBER_OR_ZERO;
+		cfg->host_ttl = atoi(val);
+	} else if(strcmp(opt, "infra-lame-ttl:") == 0) {
+		IS_NUMBER_OR_ZERO;
+		cfg->lame_ttl = atoi(val);
+	} else if(strcmp(opt, "infra-cache-slabs:") == 0) {
+		IS_POW2_NUMBER;
+		cfg->infra_cache_slabs = (size_t)atoi(val);
+	} else if(strcmp(opt, "infra-cache-numhosts:") == 0) {
+		IS_NONZERO_NUMBER;
+		cfg->infra_cache_numhosts = (size_t)atoi(val);
+	} else if(strcmp(opt, "infra-cache-lame-size:") == 0) {
+		return cfg_parse_memsize(val, &cfg->infra_cache_lame_size);
+	} else if(strcmp(opt, "logfile:") == 0) {
+		cfg->use_syslog = 0;
+		free(cfg->logfile);
+		return (cfg->logfile = strdup(val)) != NULL;
+	} else if(strcmp(opt, "use-syslog:") == 0) {
+		IS_YES_OR_NO;
+		cfg->use_syslog = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "root-hints:") == 0) {
+		return cfg_strlist_insert(&cfg->root_hints, strdup(val));
+	} else if(strcmp(opt, "target-fetch-policy:") == 0) {
+		free(cfg->target_fetch_policy);
+		return (cfg->target_fetch_policy = strdup(val)) != NULL;
+	} else if(strcmp(opt, "harden-glue:") == 0) {
+		IS_YES_OR_NO;
+		cfg->harden_glue = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "harden-short-bufsize:") == 0) {
+		IS_YES_OR_NO;
+		cfg->harden_short_bufsize = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "harden-large-queries:") == 0) {
+		IS_YES_OR_NO;
+		cfg->harden_large_queries = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "harden-dnssec-stripped:") == 0) {
+		IS_YES_OR_NO;
+		cfg->harden_dnssec_stripped = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "do-not-query-localhost:") == 0) {
+		IS_YES_OR_NO;
+		cfg->donotquery_localhost = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "do-not-query-address:") == 0) {
+		return cfg_strlist_insert(&cfg->donotqueryaddrs, strdup(val));
+	} else if(strcmp(opt, "trust-anchor-file:") == 0) {
+		return cfg_strlist_insert(&cfg->trust_anchor_file_list, 
+			strdup(val));
+	} else if(strcmp(opt, "trust-anchor:") == 0) {
+		return cfg_strlist_insert(&cfg->trust_anchor_list, 
+			strdup(val));
+	} else if(strcmp(opt, "trusted-keys-file:") == 0) {
+		return cfg_strlist_insert(&cfg->trusted_keys_file_list, 
+			strdup(val));
+	} else if(strcmp(opt, "val-override-date:") == 0) {
+		if(strcmp(val, "") == 0 || strcmp(val, "0") == 0) {
+			cfg->val_date_override = 0;
+		} else if(strlen(val) == 14) {
+			cfg->val_date_override = cfg_convert_timeval(val);
+			return cfg->val_date_override != 0;
+		} else {
+			if(atoi(val) == 0) return 0;
+			cfg->val_date_override = (uint32_t)atoi(val);
+		}
+	} else if(strcmp(opt, "val-bogus-ttl:") == 0) {
+		IS_NUMBER_OR_ZERO;
+		cfg->bogus_ttl = atoi(val);
+	} else if(strcmp(opt, "val-clean-additional:") == 0) {
+		IS_YES_OR_NO;
+		cfg->val_clean_additional = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "val-permissive-mode:") == 0) {
+		IS_YES_OR_NO;
+		cfg->val_permissive_mode = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "val-nsec3-keysize-iterations:") == 0) {
+		free(cfg->val_nsec3_key_iterations);
+		return (cfg->val_nsec3_key_iterations = strdup(val)) != NULL;
+	} else if(strcmp(opt, "key-cache-size:") == 0) {
+		return cfg_parse_memsize(val, &cfg->key_cache_size);
+	} else if(strcmp(opt, "key-cache-slabs:") == 0) {
+		IS_POW2_NUMBER;
+		cfg->key_cache_slabs = (size_t)atoi(val);
+	} else if(strcmp(opt, "local-data:") == 0) {
+		return cfg_strlist_insert(&cfg->local_data, strdup(val));
+	} else if(strcmp(opt, "module-config:") == 0) {
+		free(cfg->module_conf);
+		return (cfg->module_conf = strdup(val)) != NULL;
+	} else {
+		/* unknown or unsupported (from the library interface) */
+		return 0;
+	}
+	return 1;
+}
+
 /** initialize the global cfg_parser object */
 static void
 create_cfg_parser(struct config_file* cfg, char* filename)
@@ -195,6 +357,7 @@ config_read(struct config_file* cfg, char* filename)
 	if(cfg_parser->errors != 0) {
 		fprintf(stderr, "read %s failed: %d errors in configuration file\n",
 			cfg_parser->filename, cfg_parser->errors);
+		errno=EINVAL;
 		return 0;
 	}
 	return 1;

util/config_file.h

@@ -140,6 +140,8 @@ struct config_file {
 	int harden_glue;
 	/** harden against receiving no DNSSEC data for trust anchor */
 	int harden_dnssec_stripped;
+	/** use 0x20 bits in query as random ID bits */
+	int use_caps_bits_for_id;
 
 	/** chrootdir, if not "" or chroot will be done */
 	char* chrootdir;
@@ -255,7 +257,8 @@ struct config_file* config_create_forlib();
  * Read the config file from the specified filename.
  * @param config: where options are stored into, must be freshly created.
  * @param filename: name of configfile. If NULL nothing is done.
- * @return: false on error.
+ * @return: false on error. In that case errno is set, ENOENT means 
+ * 	file not found.
  */
 int config_read(struct config_file* config, char* filename);
 
@@ -271,6 +274,17 @@ void config_delete(struct config_file* config);
  */
 void config_apply(struct config_file* config);
 
+/**
+ * Set the given keyword to the given value.
+ * @param config: where to store config
+ * @param option: option name, including the ':' character.
+ * @param value: value, this string is copied if needed, or parsed.
+ * 	The caller owns the value string.
+ * @return 0 on error (malloc or syntax error).
+ */
+int config_set_option(struct config_file* config, const char* option,
+	const char* value);
+
 /**
  * Insert string into strlist.
  * @param head: pointer to strlist head variable.

util/configlexer.lex

@@ -111,6 +111,7 @@ do-ip4{COLON}		{ YDOUT; return VAR_DO_IP4;}
 do-ip6{COLON}		{ YDOUT; return VAR_DO_IP6;}
 do-udp{COLON}		{ YDOUT; return VAR_DO_UDP;}
 do-tcp{COLON}		{ YDOUT; return VAR_DO_TCP;}
+do-daemonize{COLON}		{ YDOUT; return VAR_DO_DAEMONIZE;}
 interface{COLON}	{ YDOUT; return VAR_INTERFACE;}
 outgoing-interface{COLON}	{ YDOUT; return VAR_OUTGOING_INTERFACE;}
 interface-automatic{COLON}	{ YDOUT; return VAR_INTERFACE_AUTOMATIC;}
@@ -137,6 +138,7 @@ harden-short-bufsize{COLON}	{ YDOUT; return VAR_HARDEN_SHORT_BUFSIZE;}
 harden-large-queries{COLON}	{ YDOUT; return VAR_HARDEN_LARGE_QUERIES;}
 harden-glue{COLON}	{ YDOUT; return VAR_HARDEN_GLUE;}
 harden-dnssec-stripped{COLON}	{ YDOUT; return VAR_HARDEN_DNNSEC_STRIPPED;}
+use-caps-for-id{COLON}	{ YDOUT; return VAR_USE_CAPS_FOR_ID;}
 stub-zone{COLON}	{ YDOUT; return VAR_STUB_ZONE;}
 name{COLON}		{ YDOUT; return VAR_NAME;}
 stub-addr{COLON}	{ YDOUT; return VAR_STUB_ADDR;}

util/configparser.h

@@ -113,7 +113,9 @@
      VAR_LOCAL_ZONE = 329,
      VAR_LOCAL_DATA = 330,
      VAR_INTERFACE_AUTOMATIC = 331,
-     VAR_STATISTICS_INTERVAL = 332
+     VAR_STATISTICS_INTERVAL = 332,
+     VAR_DO_DAEMONIZE = 333,
+     VAR_USE_CAPS_FOR_ID = 334
    };
 #endif
 /* Tokens.  */
@@ -192,6 +194,8 @@
 #define VAR_LOCAL_DATA 330
 #define VAR_INTERFACE_AUTOMATIC 331
 #define VAR_STATISTICS_INTERVAL 332
+#define VAR_DO_DAEMONIZE 333
+#define VAR_USE_CAPS_FOR_ID 334
 
 
 
@@ -203,7 +207,7 @@ typedef union YYSTYPE
 	char*	str;
 }
 /* Line 1489 of yacc.c.  */
-#line 207 "util/configparser.h"
+#line 211 "util/configparser.h"
 	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1

util/configparser.y

@@ -88,7 +88,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_OUTGOING_INTERFACE VAR_ROOT_HINTS VAR_DO_NOT_QUERY_LOCALHOST
 %token VAR_CACHE_MAX_TTL VAR_HARDEN_DNNSEC_STRIPPED VAR_ACCESS_CONTROL
 %token VAR_LOCAL_ZONE VAR_LOCAL_DATA VAR_INTERFACE_AUTOMATIC
-%token VAR_STATISTICS_INTERVAL
+%token VAR_STATISTICS_INTERVAL VAR_DO_DAEMONIZE VAR_USE_CAPS_FOR_ID
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -128,7 +128,8 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_do_not_query_localhost | server_cache_max_ttl |
 	server_harden_dnssec_stripped | server_access_control |
 	server_local_zone | server_local_data | server_interface_automatic |
-	server_statistics_interval
+	server_statistics_interval | server_do_daemonize | 
+	server_use_caps_for_id
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -309,6 +310,15 @@ server_do_tcp: VAR_DO_TCP STRING
 		free($2);
 	}
 	;
+server_do_daemonize: VAR_DO_DAEMONIZE STRING
+	{
+		OUTYY(("P(server_do_daemonize:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->do_daemonize = (strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_use_syslog: VAR_USE_SYSLOG STRING
 	{
 		OUTYY(("P(server_use_syslog:%s)\n", $2));
@@ -579,6 +589,16 @@ server_harden_dnssec_stripped: VAR_HARDEN_DNNSEC_STRIPPED STRING
 		free($2);
 	}
 	;
+server_use_caps_for_id: VAR_USE_CAPS_FOR_ID STRING
+	{
+		OUTYY(("P(server_use_caps_for_id:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->use_caps_bits_for_id = 
+			(strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_do_not_query_address: VAR_DO_NOT_QUERY_ADDRESS STRING
 	{
 		OUTYY(("P(server_do_not_query_address:%s)\n", $2));

util/data/dname.c

@@ -91,10 +91,11 @@ dname_valid(uint8_t* dname, size_t maxlen)
 	return len;
 }
 
+/** compare uncompressed, noncanonical, registers are hints for speed */
 int 
-query_dname_compare(uint8_t* d1, uint8_t* d2)
+query_dname_compare(register uint8_t* d1, register uint8_t* d2)
 {
-	uint8_t lab1, lab2;
+	register uint8_t lab1, lab2;
 	log_assert(d1 && d2);
 	lab1 = *d1++;
 	lab2 = *d2++;
@@ -109,7 +110,9 @@ query_dname_compare(uint8_t* d1, uint8_t* d2)
 		log_assert(lab1 == lab2 && lab1 != 0);
 		/* compare lowercased labels. */
 		while(lab1--) {
-			if(tolower((int)*d1) != tolower((int)*d2)) {
+			/* compare bytes first for speed */
+			if(*d1 != *d2 && 
+				tolower((int)*d1) != tolower((int)*d2)) {
 				if(tolower((int)*d1) < tolower((int)*d2))
 					return -1;
 				return 1;
@@ -140,21 +143,23 @@ query_dname_tolower(uint8_t* dname)
 	}
 }
 
-/** maximum compression pointer position pointed to */
-#define MAX_COMPRESS_POS 16384
-/** size of bitmap for loop detection */
-#define LOOP_BITMAP_SIZE (MAX_COMPRESS_POS/8)
-
-/** check bit in bitmap for loop detection, then set it for next check */
-static uint8_t 
-loopcheck(uint8_t loop[], size_t pos)
+void 
+pkt_dname_tolower(ldns_buffer* pkt, uint8_t* dname)
 {
-	const uint8_t bits[8] = {0x1, 0x2, 0x4, 0x8, 0x10, 0x20, 0x40, 0x80};
-	uint8_t ret;
-	log_assert(pos < MAX_COMPRESS_POS);
-	ret = loop[ pos / 8 ] & bits[ pos & 0x7 ];
-	loop[ pos / 8 ] |= bits[ pos & 0x7 ];	
-	return ret;
+	uint8_t lablen;
+	lablen = *dname++;
+	while(lablen) {
+		if(LABEL_IS_PTR(lablen)) {
+			dname = ldns_buffer_at(pkt, PTR_OFFSET(lablen, *dname));
+			lablen = *dname++;
+			continue;
+		}
+		while(lablen--) {
+			*dname = (uint8_t)tolower((int)*dname);
+			dname++;
+		}
+		lablen = *dname++;
+	}
 }
 
 
@@ -162,14 +167,12 @@ size_t
 pkt_dname_len(ldns_buffer* pkt)
 {
 	size_t len = 0;
-	uint8_t loop[LOOP_BITMAP_SIZE]; /* loopcheck array. */
+	int ptrcount = 0;
 	uint8_t labellen;
 	size_t endpos = 0;
 
 	/* read dname and determine length */
 	/* check compression pointers, loops, out of bounds */
-	memset(loop, 0, sizeof(loop));
-
 	while(1) {
 		/* read next label */
 		if(ldns_buffer_remaining(pkt) < 1)
@@ -181,7 +184,7 @@ pkt_dname_len(ldns_buffer* pkt)
 			if(ldns_buffer_remaining(pkt) < 1)
 				return 0;
 			ptr = PTR_OFFSET(labellen, ldns_buffer_read_u8(pkt));
-			if(loopcheck(loop, ptr))
+			if(ptrcount++ > MAX_COMPRESS_PTRS)
 				return 0; /* loop! */
 			if(ldns_buffer_limit(pkt) <= ptr)
 				return 0; /* out of bounds! */
@@ -259,16 +262,15 @@ dname_query_hash(uint8_t* dname, hashvalue_t h)
 	int i;
 
 	/* preserve case of query, make hash label by label */
-	lablen = *dname;
+	lablen = *dname++;
 	while(lablen) {
 		log_assert(lablen <= LDNS_MAX_LABELLEN);
 		labuf[0] = lablen;
-		dname++;
 		i=0;
 		while(lablen--)
 			labuf[++i] = (uint8_t)tolower((int)*dname++);
 		h = hashlittle(labuf, labuf[0] + 1, h);
-		lablen = *dname;
+		lablen = *dname++;
 	}
 
 	return h;
@@ -383,17 +385,17 @@ dname_count_size_labels(uint8_t* dname, size_t* size)
 {	
 	uint8_t lablen;
 	int labs = 1;
-	*size = 1;
+	size_t sz = 1;
 
 	lablen = *dname++;
 	while(lablen) {
 		labs++;
-		*size += lablen+1;
+		sz += lablen+1;
 		dname += lablen;
 		lablen = *dname++;
 	}
+	*size = sz;
 	return labs;
-
 }
 
 /**
@@ -407,16 +409,17 @@ static int
 memlowercmp(uint8_t* p1, uint8_t* p2, uint8_t len)
 {
 	while(len--) {
-		if(tolower((int)*p1++) != tolower((int)*p2++)) {
-			if(tolower((int)p1[-1]) < tolower((int)p2[-1]))
+		if(*p1 != *p2 && tolower((int)*p1) != tolower((int)*p2)) {
+			if(tolower((int)*p1) < tolower((int)*p2))
 				return -1;
 			return 1;
 		}
+		p1++;
+		p2++;
 	}
 	return 0;
 }
 
-
 int 
 dname_lab_cmp(uint8_t* d1, int labs1, uint8_t* d2, int labs2, int* mlabs)
 {
@@ -424,7 +427,6 @@ dname_lab_cmp(uint8_t* d1, int labs1, uint8_t* d2, int labs2, int* mlabs)
 	int atlabel = labs1;
 	int lastmlabs;
 	int lastdiff = 0;
-	int c;
 	/* first skip so that we compare same label. */
 	if(labs1 > labs2) {
 		while(atlabel > labs2) {
@@ -456,15 +458,35 @@ dname_lab_cmp(uint8_t* d1, int labs1, uint8_t* d2, int labs2, int* mlabs)
 				lastdiff = -1;
 			else	lastdiff = 1;
 			lastmlabs = atlabel;
-		} else if((c=memlowercmp(d1, d2, len1)) != 0) { 
-			if(c<0)
-				lastdiff = -1;
-			else	lastdiff = 1;
-			lastmlabs = atlabel;
+			d1 += len1;
+			d2 += len2;
+		} else {
+			/* memlowercmp is inlined here; or just like
+			 * if((c=memlowercmp(d1, d2, len1)) != 0) { 
+			 *	lastdiff = c;
+			 *	lastmlabs = atlabel; } apart from d1++,d2++ */
+			while(len1) {
+				if(*d1 != *d2 && tolower((int)*d1) 
+					!= tolower((int)*d2)) {
+					if(tolower((int)*d1) < 
+						tolower((int)*d2)) {
+						lastdiff = -1;
+						lastmlabs = atlabel;
+						d1 += len1;
+						d2 += len1;
+						break;
+					}
+					lastdiff = 1;
+					lastmlabs = atlabel;
+					d1 += len1;
+					d2 += len1;
+					break; /* out of memlowercmp */
+				}
+				d1++;
+				d2++;
+				len1--;
+			}
 		}
-
-		d1 += len1;
-		d2 += len2;
 		atlabel--;
 	}
 	/* last difference atlabel number, so number of labels matching,

util/data/dname.h

@@ -46,6 +46,9 @@
 #define UTIL_DATA_DNAME_H
 #include "util/storage/lruhash.h"
 
+/** max number of compression ptrs to follow */
+#define MAX_COMPRESS_PTRS 256
+
 /** 
  * Determine length of dname in buffer, no compression ptrs allowed, 
  * @param query: the ldns buffer, current position at start of dname.
@@ -65,6 +68,14 @@ size_t dname_valid(uint8_t* dname, size_t len);
 /** lowercase query dname */
 void query_dname_tolower(uint8_t* dname);
 
+/** 
+ * lowercase pkt dname (follows compression pointers)
+ * @param pkt: the packet, used to follow compression pointers. Position 
+ *	is unchanged.
+ * @param dname: start of dname in packet.
+ */
+void pkt_dname_tolower(ldns_buffer* pkt, uint8_t* dname);
+
 /**
  * Compare query dnames (uncompressed storage). The Dnames passed do not
  * have to be lowercased, comparison routine does this.

util/data/msgencode.c

@@ -93,15 +93,18 @@ struct compress_tree_node {
  *	can be null if the tree is empty.
  * @param matchlabels: number of labels that match with closest match.
  *	can be zero is there is no match.
+ * @param insertpt: insert location for dname, if not found.
  * @return: 0 if no exact match.
  */
 static int
-compress_tree_search(struct compress_tree_node* tree, uint8_t* dname,
-	int labs, struct compress_tree_node** match, int* matchlabels)
+compress_tree_search(struct compress_tree_node** tree, uint8_t* dname,
+	int labs, struct compress_tree_node** match, int* matchlabels,
+	struct compress_tree_node*** insertpt)
 {
 	int c, n, closen=0;
-	struct compress_tree_node* p = tree;
+	struct compress_tree_node* p = *tree;
 	struct compress_tree_node* close = 0;
+	struct compress_tree_node** prev = tree;
 	while(p) {
 		if((c = dname_lab_cmp(dname, labs, p->dname, p->labs, &n)) 
 			== 0) {
@@ -109,13 +112,17 @@ compress_tree_search(struct compress_tree_node* tree, uint8_t* dname,
 			*match = p;
 			return 1;
 		}
-		if(c<0) p = p->left;
-		else	{
+		if(c<0) {
+			prev = &p->left;
+			p = p->left;
+		} else	{
 			closen = n;
 			close = p; /* p->dname is smaller than dname */
+			prev = &p->right;
 			p = p->right;
 		}
 	}
+	*insertpt = prev;
 	*matchlabels = closen;
 	*match = close;
 	return 0;
@@ -126,17 +133,18 @@ compress_tree_search(struct compress_tree_node* tree, uint8_t* dname,
  * @param tree: root of tree (not the node with '.').
  * @param dname: pointer to uncompressed dname.
  * @param labs: number of labels in domain name.
+ * @param insertpt: insert location for dname, if not found.
  * @return: 0 if not found or compress treenode with best compression.
  */
 static struct compress_tree_node*
-compress_tree_lookup(struct compress_tree_node* tree, uint8_t* dname,
-	int labs)
+compress_tree_lookup(struct compress_tree_node** tree, uint8_t* dname,
+	int labs, struct compress_tree_node*** insertpt)
 {
 	struct compress_tree_node* p;
 	int m;
 	if(labs <= 1)
 		return 0; /* do not compress root node */
-	if(compress_tree_search(tree, dname, labs, &p, &m)) {
+	if(compress_tree_search(tree, dname, labs, &p, &m, insertpt)) {
 		/* exact match */
 		return p;
 	}
@@ -152,8 +160,7 @@ compress_tree_lookup(struct compress_tree_node* tree, uint8_t* dname,
 }
 
 /**
- * Insert node into domain name compression tree.
- * @param tree: root of tree (may be modified)
+ * Create node for domain name compression tree.
  * @param dname: pointer to uncompressed dname (stored in tree).
  * @param labs: number of labels in dname.
  * @param offset: offset into packet for dname.
@@ -161,11 +168,9 @@ compress_tree_lookup(struct compress_tree_node* tree, uint8_t* dname,
  * @return new node or 0 on malloc failure.
  */
 static struct compress_tree_node*
-compress_tree_insert(struct compress_tree_node** tree, uint8_t* dname,
-	int labs, size_t offset, struct regional* region)
+compress_tree_newnode(uint8_t* dname, int labs, size_t offset, 
+	struct regional* region)
 {
-	int c, m;
-	struct compress_tree_node* p, **prev;
 	struct compress_tree_node* n = (struct compress_tree_node*)
 		regional_alloc(region, sizeof(struct compress_tree_node));
 	if(!n) return 0;
@@ -175,29 +180,11 @@ compress_tree_insert(struct compress_tree_node** tree, uint8_t* dname,
 	n->dname = dname;
 	n->labs = labs;
 	n->offset = offset;
-
-	/* find spot to insert it into */
-	prev = tree;
-	p = *tree;
-	while(p) {
-		c = dname_lab_cmp(dname, labs, p->dname, p->labs, &m);
-		log_assert(c != 0); /* may not already be in tree */
-		if(c==0) return p; /* insert only once */
-		if(c<0)	{
-			prev = &p->left;
-			p = p->left;
-		} else {
-			prev = &p->right;
-			p = p->right;
-		}
-	}
-	*prev = n;
 	return n;
 }
 
 /**
  * Store domain name and ancestors into compression tree.
- * @param tree: root of tree (may be modified)
  * @param dname: pointer to uncompressed dname (stored in tree).
  * @param labs: number of labels in dname.
  * @param offset: offset into packet for dname.
@@ -205,44 +192,51 @@ compress_tree_insert(struct compress_tree_node** tree, uint8_t* dname,
  * @param closest: match from previous lookup, used to compress dname.
  *	may be NULL if no previous match.
  *	if the tree has an ancestor of dname already, this must be it.
+ * @param insertpt: where to insert the dname in tree. 
  * @return: 0 on memory error.
  */
 static int
-compress_tree_store(struct compress_tree_node** tree, uint8_t* dname,
-	int labs, size_t offset, struct regional* region,
-	struct compress_tree_node* closest)
+compress_tree_store(uint8_t* dname, int labs, size_t offset, 
+	struct regional* region, struct compress_tree_node* closest, 
+	struct compress_tree_node** insertpt)
 {
 	uint8_t lablen;
-	struct compress_tree_node** lastparentptr = 0;
 	struct compress_tree_node* newnode;
+	struct compress_tree_node* prevnode = NULL;
 	int uplabs = labs-1; /* does not store root in tree */
 	if(closest) uplabs = labs - closest->labs;
 	log_assert(uplabs >= 0);
+	/* algorithms builds up a vine of dname-labels to hang into tree */
 	while(uplabs--) {
 		if(offset > PTR_MAX_OFFSET) {
-			if(lastparentptr) 
-				*lastparentptr = closest;
+			/* insertion failed, drop vine */
 			return 1; /* compression pointer no longer useful */
 		}
-		/* store dname, labs, offset */
-		if(!(newnode = compress_tree_insert(tree, dname, labs, offset, 
+		if(!(newnode = compress_tree_newnode(dname, labs, offset, 
 			region))) {
-			if(lastparentptr) 
-				*lastparentptr = closest;
+			/* insertion failed, drop vine */
 			return 0;
 		}
-		if(lastparentptr)
-			*lastparentptr = newnode;
-		lastparentptr = &newnode->parent;
+
+		if(prevnode) {
+			/* chain nodes together, last one has one label more,
+			 * so is larger than newnode, thus goes right. */
+			newnode->right = prevnode;
+			prevnode->parent = newnode;
+		}
 
 		/* next label */
 		lablen = *dname++;
 		dname += lablen;
 		offset += lablen+1;
+		prevnode = newnode;
 		labs--;
 	}
-	if(lastparentptr)
-		*lastparentptr = closest;
+	/* if we have a vine, hang the vine into the tree */
+	if(prevnode) {
+		*insertpt = prevnode;
+		prevnode->parent = closest;
+	}
 	return 1;
 }
 
@@ -288,10 +282,11 @@ compress_owner(struct ub_packed_rrset_key* key, ldns_buffer* pkt,
 	size_t owner_pos, uint16_t* owner_ptr, int owner_labs)
 {
 	struct compress_tree_node* p;
+	struct compress_tree_node** insertpt;
 	if(!*owner_ptr) {
 		/* compress first time dname */
-		if((p = compress_tree_lookup(*tree, key->rk.dname, 
-			owner_labs))) {
+		if((p = compress_tree_lookup(tree, key->rk.dname, 
+			owner_labs, &insertpt))) {
 			if(p->labs == owner_labs) 
 				/* avoid ptr chains, since some software is
 				 * not capable of decoding ptr after a ptr. */
@@ -311,8 +306,8 @@ compress_owner(struct ub_packed_rrset_key* key, ldns_buffer* pkt,
 			if(owner_pos <= PTR_MAX_OFFSET)
 				*owner_ptr = htons(PTR_CREATE(owner_pos));
 		}
-		if(!compress_tree_store(tree, key->rk.dname, 
-			owner_labs, owner_pos, region, p))
+		if(!compress_tree_store(key->rk.dname, owner_labs, 
+			owner_pos, region, p, insertpt))
 			return RETVAL_OUTMEM;
 	} else {
 		/* always compress 2nd-further RRs in RRset */
@@ -335,15 +330,16 @@ compress_any_dname(uint8_t* dname, ldns_buffer* pkt, int labs,
 	struct regional* region, struct compress_tree_node** tree)
 {
 	struct compress_tree_node* p;
+	struct compress_tree_node** insertpt;
 	size_t pos = ldns_buffer_position(pkt);
-	if((p = compress_tree_lookup(*tree, dname, labs))) {
+	if((p = compress_tree_lookup(tree, dname, labs, &insertpt))) {
 		if(!write_compressed_dname(pkt, dname, labs, p))
 			return RETVAL_TRUNC;
 	} else {
 		if(!dname_buffer_write(pkt, dname))
 			return RETVAL_TRUNC;
 	}
-	if(!compress_tree_store(tree, dname, labs, pos, region, p))
+	if(!compress_tree_store(dname, labs, pos, region, p, insertpt))
 		return RETVAL_OUTMEM;
 	return RETVAL_OK;
 }
@@ -579,9 +575,10 @@ insert_query(struct query_info* qinfo, struct compress_tree_node** tree,
 	if(ldns_buffer_remaining(buffer) < 
 		qinfo->qname_len+sizeof(uint16_t)*2)
 		return RETVAL_TRUNC; /* buffer too small */
-	if(!compress_tree_store(tree, qinfo->qname, 
+	/* the query is the first name inserted into the tree */
+	if(!compress_tree_store(qinfo->qname, 
 		dname_count_labels(qinfo->qname), 
-		ldns_buffer_position(buffer), region, NULL))
+		ldns_buffer_position(buffer), region, NULL, tree))
 		return RETVAL_OUTMEM;
 	ldns_buffer_write(buffer, qinfo->qname, qinfo->qname_len);
 	ldns_buffer_write_u16(buffer, qinfo->qtype);

util/data/msgparse.c

@@ -160,13 +160,39 @@ pkt_hash_rrset(ldns_buffer* pkt, uint8_t* dname, uint16_t type,
 	/* note this MUST be identical to rrset_key_hash in packed_rrset.c */
 	/* this routine handles compressed names */
 	hashvalue_t h = 0xab;
+	h = dname_pkt_hash(pkt, dname, h);
 	h = hashlittle(&type, sizeof(type), h);		/* host order */
 	h = hashlittle(&dclass, sizeof(dclass), h);	/* netw order */
 	h = hashlittle(&rrset_flags, sizeof(uint32_t), h);
+	return h;
+}
+
+/** create partial dname hash for rrset hash */
+static hashvalue_t
+pkt_hash_rrset_first(ldns_buffer* pkt, uint8_t* dname)
+{
+	/* works together with pkt_hash_rrset_rest */
+	/* note this MUST be identical to rrset_key_hash in packed_rrset.c */
+	/* this routine handles compressed names */
+	hashvalue_t h = 0xab;
 	h = dname_pkt_hash(pkt, dname, h);
 	return h;
 }
 
+/** create a rrset hash from a partial dname hash */
+static hashvalue_t
+pkt_hash_rrset_rest(hashvalue_t dname_h, uint16_t type, uint16_t dclass, 
+	uint32_t rrset_flags)
+{
+	/* works together with pkt_hash_rrset_first */
+	/* note this MUST be identical to rrset_key_hash in packed_rrset.c */
+	hashvalue_t h;
+	h = hashlittle(&type, sizeof(type), dname_h);	/* host order */
+	h = hashlittle(&dclass, sizeof(dclass), h);	/* netw order */
+	h = hashlittle(&rrset_flags, sizeof(uint32_t), h);
+	return h;
+}
+
 /** compare rrset_parse with data */
 static int
 rrset_parse_equals(struct rrset_parse* p, ldns_buffer* pkt, hashvalue_t h, 
@@ -423,6 +449,7 @@ find_rrset(struct msg_parse* msg, ldns_buffer* pkt, uint8_t* dname,
 	uint16_t* prev_dclass, struct rrset_parse** rrset_prev,
 	ldns_pkt_section section, struct regional* region)
 {
+	hashvalue_t dname_h = pkt_hash_rrset_first(pkt, dname);
 	uint16_t covtype;
 	if(*rrset_prev) {
 		/* check if equal to previous item */
@@ -451,14 +478,14 @@ find_rrset(struct msg_parse* msg, ldns_buffer* pkt, uint8_t* dname,
 	/* if rrsig - try to lookup matching data set first */
 	if(type == LDNS_RR_TYPE_RRSIG && pkt_rrsig_covered(pkt, 
 		ldns_buffer_current(pkt), &covtype)) {
-		*hash = pkt_hash_rrset(pkt, dname, covtype, dclass, 
+		*hash = pkt_hash_rrset_rest(dname_h, covtype, dclass, 
 			*rrset_flags);
 		*rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, 
 			*rrset_flags, dname, dnamelen, covtype, dclass);
 		if(!*rrset_prev && covtype == LDNS_RR_TYPE_NSEC) {
 			/* if NSEC try with NSEC apex bit twiddled */
 			*rrset_flags ^= PACKED_RRSET_NSEC_AT_APEX;
-			*hash = pkt_hash_rrset(pkt, dname, covtype, dclass, 
+			*hash = pkt_hash_rrset_rest(dname_h, covtype, dclass, 
 				*rrset_flags);
 			*rrset_prev = msgparse_hashtable_lookup(msg, pkt, 
 				*hash, *rrset_flags, dname, dnamelen, covtype, 
@@ -476,7 +503,7 @@ find_rrset(struct msg_parse* msg, ldns_buffer* pkt, uint8_t* dname,
 	if(type != LDNS_RR_TYPE_RRSIG) {
 		int hasother = 0;
 		/* find matching rrsig */
-		*hash = pkt_hash_rrset(pkt, dname, LDNS_RR_TYPE_RRSIG, 
+		*hash = pkt_hash_rrset_rest(dname_h, LDNS_RR_TYPE_RRSIG, 
 			dclass, *rrset_flags);
 		*rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, 
 			*rrset_flags, dname, dnamelen, LDNS_RR_TYPE_RRSIG, 
@@ -497,7 +524,7 @@ find_rrset(struct msg_parse* msg, ldns_buffer* pkt, uint8_t* dname,
 		}
 	}
 
-	*hash = pkt_hash_rrset(pkt, dname, type, dclass, *rrset_flags);
+	*hash = pkt_hash_rrset_rest(dname_h, type, dclass, *rrset_flags);
 	*rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, *rrset_flags, 
 		dname, dnamelen, type, dclass);
 	if(*rrset_prev)

util/data/packed_rrset.c

@@ -163,10 +163,10 @@ rrset_key_hash(struct packed_rrset_key* key)
 	/* Note this MUST be identical to pkt_hash_rrset in msgparse.c */
 	/* this routine does not have a compressed name */
 	hashvalue_t h = 0xab;
+	h = dname_query_hash(key->dname, h);
         h = hashlittle(&t, sizeof(t), h);
         h = hashlittle(&key->rrset_class, sizeof(uint16_t), h);
         h = hashlittle(&key->flags, sizeof(uint32_t), h);
-	h = dname_query_hash(key->dname, h);
 	return h;
 }
 

util/fptr_wlist.h

@@ -58,6 +58,16 @@
 #include "util/storage/lruhash.h"
 #include "util/module.h"
 
+/**
+ * Macro to perform an assertion check for fptr wlist checks.
+ * Does not get disabled in optimize mode. Check adds security by layers.
+ */
+#define fptr_ok(x) \
+	do { if(!(x)) \
+		fatal_exit("%s:%d: %s: pointer whitelist %s failed", \
+		__FILE__, __LINE__, __func__, #x); \
+	} while(0);
+
 /**
  * Check function pointer whitelist for comm_point callback values.
  *

util/log.c

@@ -69,6 +69,8 @@ static const char* ident="unbound";
 /** are we using syslog(3) to log to */
 static int log_to_syslog = 0;
 #endif /* HAVE_SYSLOG_H */
+/** time to print in log, if NULL, use time(2) */
+static uint32_t* log_now = NULL;
 
 void
 log_init(const char* filename, int use_syslog, const char* chrootdir)
@@ -104,7 +106,7 @@ log_init(const char* filename, int use_syslog, const char* chrootdir)
 	}
 	/* open the file for logging */
 	if(chrootdir && chrootdir[0] && strncmp(filename, chrootdir,
-		strlen(chrootdir)) == 0)
+		strlen(chrootdir)) == 0) 
 		filename += strlen(chrootdir);
 	f = fopen(filename, "a");
 	if(!f) {
@@ -115,6 +117,11 @@ log_init(const char* filename, int use_syslog, const char* chrootdir)
 	logfile = f;
 }
 
+void log_file(FILE *f)
+{
+	logfile = f;
+}
+
 void log_thread_set(int* num)
 {
 	ub_thread_key_set(logkey, num);
@@ -125,12 +132,18 @@ void log_ident_set(const char* id)
 	ident = id;
 }
 
+void log_set_time(uint32_t* t)
+{
+	log_now = t;
+}
+
 void
 log_vmsg(int pri, const char* type,
 	const char *format, va_list args)
 {
 	char message[MAXSYSLOGMSGLEN];
 	unsigned int* tid = (unsigned int*)ub_thread_key_get(logkey);
+	uint32_t now;
 	(void)pri;
 	vsnprintf(message, sizeof(message), format, args);
 #ifdef HAVE_SYSLOG_H
@@ -140,7 +153,11 @@ log_vmsg(int pri, const char* type,
 		return;
 	}
 #endif /* HAVE_SYSLOG_H */
-	fprintf(logfile, "[%d] %s[%d:%x] %s: %s\n", (int)time(NULL), 
+	if(!logfile) return;
+	if(log_now)
+		now = *log_now;
+	else	now = (uint32_t)time(NULL);
+	fprintf(logfile, "[%u] %s[%d:%x] %s: %s\n", (unsigned)now, 
 		ident, (int)getpid(), tid?*tid:0, type, message);
 	fflush(logfile);
 }

util/log.h

@@ -84,6 +84,13 @@ void verbose(enum verbosity_value level,
  */
 void log_init(const char* filename, int use_syslog, const char* chrootdir);
 
+/**
+ * Set logging to go to the specified file *.
+ * This setting does not affect the use_syslog setting.
+ * @param f: to that file, or pass NULL to disable logging.
+ */
+void log_file(FILE *f);
+
 /**
  * Init a thread (will print this number for the thread log entries).
  * Must be called from the thread itself. If not called 0 is printed.
@@ -98,6 +105,13 @@ void log_thread_set(int* num);
  */
 void log_ident_set(const char* id);
 
+/**
+ * Set the time value to print in log entries.
+ * @param t: the point is copied and used to find the time.
+ * 	if NULL, time(2) is used.
+ */
+void log_set_time(uint32_t* t);
+
 /**
  * Log informational message.
  * Pass printf formatted arguments. No trailing newline is needed.

util/mini_event.c

@@ -67,14 +67,33 @@ int mini_ev_cmp(const void* a, const void* b)
 	return 0;
 }
 
+/** set time */
+static int
+settime(struct event_base* base)
+{
+	if(gettimeofday(base->time_tv, NULL) < 0) {
+		return -1;
+	}
+#ifndef S_SPLINT_S
+	*base->time_secs = (uint32_t)base->time_tv->tv_sec;
+#endif
+	return 0;
+}
+
 /** create event base */
-void *event_init(void)
+void *event_init(uint32_t* time_secs, struct timeval* time_tv)
 {
 	struct event_base* base = (struct event_base*)malloc(
 		sizeof(struct event_base));
 	if(!base)
 		return NULL;
 	memset(base, 0, sizeof(*base));
+	base->time_secs = time_secs;
+	base->time_tv = time_tv;
+	if(settime(base) < 0) {
+		event_base_free(base);
+		return NULL;
+	}
 	base->times = rbtree_create(mini_ev_cmp);
 	if(!base->times) {
 		event_base_free(base);
@@ -146,7 +165,7 @@ static void handle_timeouts(struct event_base* base, struct timeval* now,
 		/* event times out, remove it */
 		(void)rbtree_delete(base->times, p);
 		p->ev_events &= ~EV_TIMEOUT;
-		log_assert(fptr_whitelist_event(p->ev_callback));
+		fptr_ok(fptr_whitelist_event(p->ev_callback));
 		(*p->ev_callback)(p->ev_fd, EV_TIMEOUT, p->ev_arg);
 	}
 }
@@ -165,8 +184,16 @@ static int handle_select(struct event_base* base, struct timeval* wait)
 	memmove(&w, &base->writes, sizeof(fd_set));
 
 	if((ret = select(base->maxfd+1, &r, &w, NULL, wait)) == -1) {
+		ret = errno;
+		if(settime(base) < 0)
+			return -1;
+		errno = ret;
+		if(ret == EAGAIN || ret == EINTR)
+			return 0;
 		return -1;
 	}
+	if(settime(base) < 0)
+		return -1;
 	
 	for(i=0; i<base->maxfd+1; i++) {
 		short bits = 0;
@@ -183,7 +210,7 @@ static int handle_select(struct event_base* base, struct timeval* wait)
 		}
 		bits &= base->fds[i]->ev_events;
 		if(bits) {
-			log_assert(fptr_whitelist_event(
+			fptr_ok(fptr_whitelist_event(
 				base->fds[i]->ev_callback));
 			(*base->fds[i]->ev_callback)(base->fds[i]->ev_fd, 
 				bits, base->fds[i]->ev_arg);
@@ -197,13 +224,13 @@ static int handle_select(struct event_base* base, struct timeval* wait)
 /** run select in a loop */
 int event_base_dispatch(struct event_base* base)
 {
-	struct timeval now, wait;
+	struct timeval wait;
+	if(settime(base) < 0)
+		return -1;
 	while(!base->need_to_exit)
 	{
-		if(gettimeofday(&now, NULL) < 0)
-			return -1;
 		/* see if timeouts need handling */
-		handle_timeouts(base, &now, &wait);
+		handle_timeouts(base, base->time_tv, &wait);
 		if(base->need_to_exit)
 			return 0;
 		/* do select */
@@ -246,7 +273,7 @@ void event_set(struct event* ev, int fd, short bits,
 	ev->ev_fd = fd;
 	ev->ev_events = bits;
 	ev->ev_callback = cb;
-	log_assert(fptr_whitelist_event(ev->ev_callback));
+	fptr_ok(fptr_whitelist_event(ev->ev_callback));
 	ev->ev_arg = arg;
 	ev->added = 0;
 }
@@ -277,11 +304,9 @@ int event_add(struct event* ev, struct timeval* tv)
 	}
 	if(tv && (ev->ev_events&EV_TIMEOUT)) {
 #ifndef S_SPLINT_S
-		struct timeval now;
-		if(gettimeofday(&now, NULL) < 0)
-			return -1;
-		ev->ev_timeout.tv_sec = tv->tv_sec + now.tv_sec;
-		ev->ev_timeout.tv_usec = tv->tv_usec + now.tv_usec;
+		struct timeval *now = ev->ev_base->time_tv;
+		ev->ev_timeout.tv_sec = tv->tv_sec + now->tv_sec;
+		ev->ev_timeout.tv_usec = tv->tv_usec + now->tv_usec;
 		while(ev->ev_timeout.tv_usec > 1000000) {
 			ev->ev_timeout.tv_usec -= 1000000;
 			ev->ev_timeout.tv_sec++;
@@ -320,7 +345,7 @@ static RETSIGTYPE sigh(int sig)
 	ev = signal_base->signals[sig];
 	if(!ev)
 		return;
-	log_assert(fptr_whitelist_event(ev->ev_callback));
+	fptr_ok(fptr_whitelist_event(ev->ev_callback));
 	(*ev->ev_callback)(sig, EV_SIGNAL, ev->ev_arg);
 }
 

util/mini_event.h

@@ -94,6 +94,10 @@ struct event_base
 	struct event** signals;
 	/** if we need to exit */
 	int need_to_exit;
+	/** where to store time in seconds */
+	uint32_t* time_secs;
+	/** where to store time in microseconds */
+	struct timeval* time_tv;
 };
 
 /**
@@ -122,7 +126,7 @@ struct event {
 
 /* function prototypes as they appear in event.h */
 /** create event base */
-void *event_init(void);
+void *event_init(uint32_t* time_secs, struct timeval* time_tv);
 /** get version */
 const char *event_get_version(void);
 /** get polling method, select */

util/module.h

@@ -191,6 +191,10 @@ struct module_env {
 	struct alloc_cache* alloc;
 	/** random table to generate random numbers */
 	struct ub_randstate* rnd;
+	/** time in seconds, converted to integer */
+	uint32_t* now;
+	/** time in microseconds. Relatively recent. */
+	struct timeval* now_tv;
 	/** is validation required for messages, controls client-facing
 	 * validation status (AD bits) and servfails */
 	int need_to_validate;

util/netevent.c

@@ -48,6 +48,9 @@
 /** The TCP reading or writing query timeout in seconds */
 #define TCP_QUERY_TIMEOUT 120 
 
+/** number of UDP reads to perform per read indication from select */
+#define NUM_UDP_PER_SELECT 100
+
 /* We define libevent structures here to hide the libevent stuff. */
 
 #ifdef USE_MINI_EVENT
@@ -62,6 +65,8 @@
  * Possibly other structures (list, tree) this is part of.
  */
 struct internal_event {
+	/** the comm base */
+	struct comm_base* base;
 	/** libevent event type, alloced here */
 	struct event ev;
 };
@@ -72,12 +77,18 @@ struct internal_event {
 struct internal_base {
 	/** libevent event_base type. */
 	struct event_base* base;
+	/** seconds time pointer points here */
+	uint32_t secs;
+	/** timeval with current time */
+	struct timeval now;
 };
 
 /**
  * Internal timer structure, to store timer event in.
  */
 struct internal_timer {
+	/** the comm base */
+	struct comm_base* base;
 	/** libevent event type, alloced here */
 	struct event ev;
 	/** is timer enabled */
@@ -101,6 +112,21 @@ static struct comm_point* comm_point_create_tcp_handler(
 
 /* -------- End of local definitions -------- */
 
+#ifdef USE_MINI_EVENT
+/** minievent updates the time when it blocks. */
+#define comm_base_now(x) /* nothing to do */
+#else /* !USE_MINI_EVENT */
+/** fillup the time values in the event base */
+static void
+comm_base_now(struct comm_base* b)
+{
+	if(gettimeofday(&b->eb->now, NULL) < 0) {
+		log_err("gettimeofday: %s", strerror(errno));
+	}
+	b->eb->secs = (uint32_t)b->eb->now.tv_sec;
+}
+#endif /* USE_MINI_EVENT */
+
 struct comm_base* 
 comm_base_create()
 {
@@ -113,12 +139,18 @@ comm_base_create()
 		free(b);
 		return NULL;
 	}
+#ifdef USE_MINI_EVENT
+	/* use mini event time-sharing feature */
+	b->eb->base = event_init(&b->eb->secs, &b->eb->now);
+#else
 	b->eb->base = event_init();
+#endif
 	if(!b->eb->base) {
 		free(b->eb);
 		free(b);
 		return NULL;
 	}
+	comm_base_now(b);
 	verbose(VERB_ALGO, "libevent %s uses %s method.", 
 		event_get_version(), event_get_method());
 	return b;
@@ -142,6 +174,13 @@ comm_base_delete(struct comm_base* b)
 	free(b);
 }
 
+void 
+comm_base_timept(struct comm_base* b, uint32_t** tt, struct timeval** tv)
+{
+	*tt = &b->eb->secs;
+	*tv = &b->eb->now;
+}
+
 void 
 comm_base_dispatch(struct comm_base* b)
 {
@@ -325,6 +364,7 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 	struct iovec iov[1];
 	ssize_t recv;
 	char ancil[256];
+	int i;
 #ifndef S_SPLINT_S
 	struct cmsghdr* cmsg;
 #endif /* S_SPLINT_S */
@@ -335,66 +375,69 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 	if(!(event&EV_READ))
 		return;
 	log_assert(rep.c && rep.c->buffer && rep.c->fd == fd);
-	ldns_buffer_clear(rep.c->buffer);
-	rep.addrlen = (socklen_t)sizeof(rep.addr);
-	log_assert(fd != -1);
-	log_assert(ldns_buffer_remaining(rep.c->buffer) > 0);
-	msg.msg_name = &rep.addr;
-	msg.msg_namelen = (socklen_t)sizeof(rep.addr);
-	iov[0].iov_base = ldns_buffer_begin(rep.c->buffer);
-	iov[0].iov_len = ldns_buffer_remaining(rep.c->buffer);
-	msg.msg_iov = iov;
-	msg.msg_iovlen = 1;
-	msg.msg_control = ancil;
+	comm_base_now(rep.c->ev->base);
+	for(i=0; i<NUM_UDP_PER_SELECT; i++) {
+		ldns_buffer_clear(rep.c->buffer);
+		rep.addrlen = (socklen_t)sizeof(rep.addr);
+		log_assert(fd != -1);
+		log_assert(ldns_buffer_remaining(rep.c->buffer) > 0);
+		msg.msg_name = &rep.addr;
+		msg.msg_namelen = (socklen_t)sizeof(rep.addr);
+		iov[0].iov_base = ldns_buffer_begin(rep.c->buffer);
+		iov[0].iov_len = ldns_buffer_remaining(rep.c->buffer);
+		msg.msg_iov = iov;
+		msg.msg_iovlen = 1;
+		msg.msg_control = ancil;
 #ifndef S_SPLINT_S
-	msg.msg_controllen = sizeof(ancil);
+		msg.msg_controllen = sizeof(ancil);
 #endif /* S_SPLINT_S */
-	msg.msg_flags = 0;
-	recv = recvmsg(fd, &msg, 0);
-	if(recv == -1) {
-		if(errno != EAGAIN && errno != EINTR) {
-			log_err("recvmsg failed: %s", strerror(errno));
+		msg.msg_flags = 0;
+		recv = recvmsg(fd, &msg, 0);
+		if(recv == -1) {
+			if(errno != EAGAIN && errno != EINTR) {
+				log_err("recvmsg failed: %s", strerror(errno));
+			}
+			return;
 		}
-		return;
-	}
-	rep.addrlen = msg.msg_namelen;
-	ldns_buffer_skip(rep.c->buffer, recv);
-	ldns_buffer_flip(rep.c->buffer);
-	rep.srctype = 0;
+		rep.addrlen = msg.msg_namelen;
+		ldns_buffer_skip(rep.c->buffer, recv);
+		ldns_buffer_flip(rep.c->buffer);
+		rep.srctype = 0;
 #ifndef S_SPLINT_S
-	for(cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL;
-		cmsg = CMSG_NXTHDR(&msg, cmsg)) {
-		if( cmsg->cmsg_level == IPPROTO_IPV6 &&
-			cmsg->cmsg_type == IPV6_PKTINFO) {
-			rep.srctype = 6;
-			memmove(&rep.pktinfo.v6info, CMSG_DATA(cmsg),
-				sizeof(struct in6_pktinfo));
-			break;
+		for(cmsg = CMSG_FIRSTHDR(&msg); cmsg != NULL;
+			cmsg = CMSG_NXTHDR(&msg, cmsg)) {
+			if( cmsg->cmsg_level == IPPROTO_IPV6 &&
+				cmsg->cmsg_type == IPV6_PKTINFO) {
+				rep.srctype = 6;
+				memmove(&rep.pktinfo.v6info, CMSG_DATA(cmsg),
+					sizeof(struct in6_pktinfo));
+				break;
 #ifdef IP_RECVDSTADDR
-		} else if( cmsg->cmsg_level == IPPROTO_IP &&
-			cmsg->cmsg_type == IP_RECVDSTADDR) {
-			rep.srctype = 4;
-			memmove(&rep.pktinfo.v4addr, CMSG_DATA(cmsg),
-				sizeof(struct in_addr));
-			break;
+			} else if( cmsg->cmsg_level == IPPROTO_IP &&
+				cmsg->cmsg_type == IP_RECVDSTADDR) {
+				rep.srctype = 4;
+				memmove(&rep.pktinfo.v4addr, CMSG_DATA(cmsg),
+					sizeof(struct in_addr));
+				break;
 #elif defined(IP_PKTINFO)
-		} else if( cmsg->cmsg_level == IPPROTO_IP &&
-			cmsg->cmsg_type == IP_PKTINFO) {
-			rep.srctype = 4;
-			memmove(&rep.pktinfo.v4info, CMSG_DATA(cmsg),
-				sizeof(struct in_pktinfo));
-			break;
+			} else if( cmsg->cmsg_level == IPPROTO_IP &&
+				cmsg->cmsg_type == IP_PKTINFO) {
+				rep.srctype = 4;
+				memmove(&rep.pktinfo.v4info, CMSG_DATA(cmsg),
+					sizeof(struct in_pktinfo));
+				break;
 #endif
+			}
 		}
-	}
-	if(verbosity >= VERB_ALGO)
-		p_ancil("receive_udp on interface", &rep);
+		if(verbosity >= VERB_ALGO)
+			p_ancil("receive_udp on interface", &rep);
 #endif /* S_SPLINT_S */
-	log_assert(fptr_whitelist_comm_point(rep.c->callback));
-	if((*rep.c->callback)(rep.c, rep.c->cb_arg, NETEVENT_NOERROR, &rep)) {
-		/* send back immediate reply */
-		(void)comm_point_send_udp_msg_if(rep.c, rep.c->buffer,
-			(struct sockaddr*)&rep.addr, rep.addrlen, &rep);
+		fptr_ok(fptr_whitelist_comm_point(rep.c->callback));
+		if((*rep.c->callback)(rep.c, rep.c->cb_arg, NETEVENT_NOERROR, &rep)) {
+			/* send back immediate reply */
+			(void)comm_point_send_udp_msg_if(rep.c, rep.c->buffer,
+				(struct sockaddr*)&rep.addr, rep.addrlen, &rep);
+		}
 	}
 #else
 	fatal_exit("recvmsg: No support for IPV6_PKTINFO. "
@@ -407,6 +450,7 @@ comm_point_udp_callback(int fd, short event, void* arg)
 {
 	struct comm_reply rep;
 	ssize_t recv;
+	int i;
 
 	rep.c = (struct comm_point*)arg;
 	log_assert(rep.c->type == comm_udp);
@@ -414,27 +458,30 @@ comm_point_udp_callback(int fd, short event, void* arg)
 	if(!(event&EV_READ))
 		return;
 	log_assert(rep.c && rep.c->buffer && rep.c->fd == fd);
-	ldns_buffer_clear(rep.c->buffer);
-	rep.addrlen = (socklen_t)sizeof(rep.addr);
-	log_assert(fd != -1);
-	log_assert(ldns_buffer_remaining(rep.c->buffer) > 0);
-	recv = recvfrom(fd, ldns_buffer_begin(rep.c->buffer), 
-		ldns_buffer_remaining(rep.c->buffer), 0, 
-		(struct sockaddr*)&rep.addr, &rep.addrlen);
-	if(recv == -1) {
-		if(errno != EAGAIN && errno != EINTR) {
-			log_err("recvfrom failed: %s", strerror(errno));
+	comm_base_now(rep.c->ev->base);
+	for(i=0; i<NUM_UDP_PER_SELECT; i++) {
+		ldns_buffer_clear(rep.c->buffer);
+		rep.addrlen = (socklen_t)sizeof(rep.addr);
+		log_assert(fd != -1);
+		log_assert(ldns_buffer_remaining(rep.c->buffer) > 0);
+		recv = recvfrom(fd, ldns_buffer_begin(rep.c->buffer), 
+			ldns_buffer_remaining(rep.c->buffer), 0, 
+			(struct sockaddr*)&rep.addr, &rep.addrlen);
+		if(recv == -1) {
+			if(errno != EAGAIN && errno != EINTR) {
+				log_err("recvfrom failed: %s", strerror(errno));
+			}
+			return;
+		}
+		ldns_buffer_skip(rep.c->buffer, recv);
+		ldns_buffer_flip(rep.c->buffer);
+		rep.srctype = 0;
+		fptr_ok(fptr_whitelist_comm_point(rep.c->callback));
+		if((*rep.c->callback)(rep.c, rep.c->cb_arg, NETEVENT_NOERROR, &rep)) {
+			/* send back immediate reply */
+			(void)comm_point_send_udp_msg(rep.c, rep.c->buffer,
+				(struct sockaddr*)&rep.addr, rep.addrlen);
 		}
-		return;
-	}
-	ldns_buffer_skip(rep.c->buffer, recv);
-	ldns_buffer_flip(rep.c->buffer);
-	rep.srctype = 0;
-	log_assert(fptr_whitelist_comm_point(rep.c->callback));
-	if((*rep.c->callback)(rep.c, rep.c->cb_arg, NETEVENT_NOERROR, &rep)) {
-		/* send back immediate reply */
-		(void)comm_point_send_udp_msg(rep.c, rep.c->buffer,
-			(struct sockaddr*)&rep.addr, rep.addrlen);
 	}
 }
 
@@ -460,6 +507,7 @@ comm_point_tcp_accept_callback(int fd, short event, void* arg)
 		log_info("ignoring tcp accept event %d", (int)event);
 		return;
 	}
+	comm_base_now(c->ev->base);
 	/* find free tcp handler. */
 	if(!c->tcp_free) {
 		log_warn("accepted too many tcp, connections full");
@@ -537,7 +585,7 @@ tcp_callback_reader(struct comm_point* c)
 	c->tcp_byte_count = 0;
 	if(c->type == comm_tcp)
 		comm_point_stop_listening(c);
-	log_assert(fptr_whitelist_comm_point(c->callback));
+	fptr_ok(fptr_whitelist_comm_point(c->callback));
 	if( (*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, &c->repinfo) ) {
 		comm_point_start_listening(c, -1, TCP_QUERY_TIMEOUT);
 	}
@@ -706,12 +754,13 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg)
 {
 	struct comm_point* c = (struct comm_point*)arg;
 	log_assert(c->type == comm_tcp);
+	comm_base_now(c->ev->base);
 
 	if(event&EV_READ) {
 		if(!comm_point_tcp_handle_read(fd, c, 0)) {
 			reclaim_tcp_handler(c);
 			if(!c->tcp_do_close) {
-				log_assert(fptr_whitelist_comm_point(
+				fptr_ok(fptr_whitelist_comm_point(
 					c->callback));
 				(void)(*c->callback)(c, c->cb_arg, 
 					NETEVENT_CLOSED, NULL);
@@ -723,7 +772,7 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg)
 		if(!comm_point_tcp_handle_write(fd, c)) {
 			reclaim_tcp_handler(c);
 			if(!c->tcp_do_close) {
-				log_assert(fptr_whitelist_comm_point(
+				fptr_ok(fptr_whitelist_comm_point(
 					c->callback));
 				(void)(*c->callback)(c, c->cb_arg, 
 					NETEVENT_CLOSED, NULL);
@@ -735,7 +784,7 @@ comm_point_tcp_handle_callback(int fd, short event, void* arg)
 		verbose(VERB_QUERY, "tcp took too long, dropped");
 		reclaim_tcp_handler(c);
 		if(!c->tcp_do_close) {
-			log_assert(fptr_whitelist_comm_point(c->callback));
+			fptr_ok(fptr_whitelist_comm_point(c->callback));
 			(void)(*c->callback)(c, c->cb_arg,
 				NETEVENT_TIMEOUT, NULL);
 		}
@@ -748,10 +797,11 @@ void comm_point_local_handle_callback(int fd, short event, void* arg)
 {
 	struct comm_point* c = (struct comm_point*)arg;
 	log_assert(c->type == comm_local);
+	comm_base_now(c->ev->base);
 
 	if(event&EV_READ) {
 		if(!comm_point_tcp_handle_read(fd, c, 1)) {
-			log_assert(fptr_whitelist_comm_point(c->callback));
+			fptr_ok(fptr_whitelist_comm_point(c->callback));
 			(void)(*c->callback)(c, c->cb_arg, NETEVENT_CLOSED, 
 				NULL);
 		}
@@ -765,6 +815,7 @@ void comm_point_raw_handle_callback(int ATTR_UNUSED(fd),
 {
 	struct comm_point* c = (struct comm_point*)arg;
 	log_assert(c->type == comm_raw);
+	comm_base_now(c->ev->base);
 
 	(void)(*c->callback)(c, c->cb_arg, NETEVENT_NOERROR, NULL);
 }
@@ -784,6 +835,7 @@ comm_point_create_udp(struct comm_base *base, int fd, ldns_buffer* buffer,
 		free(c);
 		return NULL;
 	}
+	c->ev->base = base;
 	c->fd = fd;
 	c->buffer = buffer;
 	c->timeout = NULL;
@@ -828,6 +880,7 @@ comm_point_create_udp_ancil(struct comm_base *base, int fd,
 		free(c);
 		return NULL;
 	}
+	c->ev->base = base;
 	c->fd = fd;
 	c->buffer = buffer;
 	c->timeout = NULL;
@@ -872,6 +925,7 @@ comm_point_create_tcp_handler(struct comm_base *base,
 		free(c);
 		return NULL;
 	}
+	c->ev->base = base;
 	c->fd = -1;
 	c->buffer = ldns_buffer_new(bufsize);
 	if(!c->buffer) {
@@ -934,6 +988,7 @@ comm_point_create_tcp(struct comm_base *base, int fd, int num, size_t bufsize,
 		free(c);
 		return NULL;
 	}
+	c->ev->base = base;
 	c->fd = fd;
 	c->buffer = NULL;
 	c->timeout = NULL;
@@ -995,6 +1050,7 @@ comm_point_create_tcp_out(struct comm_base *base, size_t bufsize,
 		free(c);
 		return NULL;
 	}
+	c->ev->base = base;
 	c->fd = -1;
 	c->buffer = ldns_buffer_new(bufsize);
 	if(!c->buffer) {
@@ -1046,6 +1102,7 @@ comm_point_create_local(struct comm_base *base, int fd, size_t bufsize,
 		free(c);
 		return NULL;
 	}
+	c->ev->base = base;
 	c->fd = fd;
 	c->buffer = ldns_buffer_new(bufsize);
 	if(!c->buffer) {
@@ -1097,6 +1154,7 @@ comm_point_create_raw(struct comm_base* base, int fd, int writing,
 		free(c);
 		return NULL;
 	}
+	c->ev->base = base;
 	c->fd = fd;
 	c->buffer = NULL;
 	c->timeout = NULL;
@@ -1280,6 +1338,7 @@ comm_timer_create(struct comm_base* base, void (*cb)(void*), void* cb_arg)
 		free(tm);
 		return NULL;
 	}
+	tm->ev_timer->base = base;
 	tm->callback = cb;
 	tm->cb_arg = cb_arg;
 	event_set(&tm->ev_timer->ev, -1, EV_PERSIST|EV_TIMEOUT, 
@@ -1331,8 +1390,9 @@ comm_timer_callback(int ATTR_UNUSED(fd), short event, void* arg)
 	struct comm_timer* tm = (struct comm_timer*)arg;
 	if(!(event&EV_TIMEOUT))
 		return;
+	comm_base_now(tm->ev_timer->base);
 	tm->ev_timer->enabled = 0;
-	log_assert(fptr_whitelist_comm_timer(tm->callback));
+	fptr_ok(fptr_whitelist_comm_timer(tm->callback));
 	(*tm->callback)(tm->cb_arg);
 }
 
@@ -1371,7 +1431,8 @@ comm_signal_callback(int sig, short event, void* arg)
 	struct comm_signal* comsig = (struct comm_signal*)arg;
 	if(!(event & EV_SIGNAL))
 		return;
-	log_assert(fptr_whitelist_comm_signal(comsig->callback));
+	comm_base_now(comsig->base);
+	fptr_ok(fptr_whitelist_comm_signal(comsig->callback));
 	(*comsig->callback)(sig, comsig->cb_arg);
 }
 

util/netevent.h

@@ -264,6 +264,15 @@ struct comm_base* comm_base_create();
  */
 void comm_base_delete(struct comm_base* b);
 
+/**
+ * Obtain two pointers. The pointers never change (until base_delete()).
+ * The pointers point to time values that are updated regularly.
+ * @param b: the communication base that will update the time values.
+ * @param tt: pointer to time in seconds is returned.
+ * @param tv: pointer to time in microseconds is returned.
+ */
+void comm_base_timept(struct comm_base* b, uint32_t** tt, struct timeval** tv);
+
 /**
  * Dispatch the comm base events.
  * @param b: the communication to perform.
@@ -272,7 +281,7 @@ void comm_base_dispatch(struct comm_base* b);
 
 /**
  * Exit from dispatch loop.
- * @param b: the communicatio base that is in dispatch().
+ * @param b: the communication base that is in dispatch().
  */
 void comm_base_exit(struct comm_base* b);
 

util/rbtree.c

@@ -233,7 +233,7 @@ rbtree_insert (rbtree_t *rbtree, rbnode_t *data)
 	rbnode_t	*node = rbtree->root;
 	rbnode_t	*parent = RBTREE_NULL;
 
-	log_assert(fptr_whitelist_rbtree_cmp(rbtree->cmp));
+	fptr_ok(fptr_whitelist_rbtree_cmp(rbtree->cmp));
 	/* Lets find the new parent... */
 	while (node != RBTREE_NULL) {
 		/* Compare two keys, do we have a duplicate? */
@@ -515,7 +515,7 @@ rbtree_find_less_equal(rbtree_t *rbtree, const void *key, rbnode_t **result)
 	node = rbtree->root;
 
 	*result = NULL;
-	log_assert(fptr_whitelist_rbtree_cmp(rbtree->cmp));
+	fptr_ok(fptr_whitelist_rbtree_cmp(rbtree->cmp));
 
 	/* While there are children... */
 	while (node != RBTREE_NULL) {

util/storage/lruhash.c

@@ -302,11 +302,11 @@ lruhash_insert(struct lruhash* table, hashvalue_t hash,
 	struct lruhash_bin* bin;
 	struct lruhash_entry* found, *reclaimlist=NULL;
 	size_t need_size;
-	log_assert(fptr_whitelist_hash_sizefunc(table->sizefunc));
-	log_assert(fptr_whitelist_hash_delkeyfunc(table->delkeyfunc));
-	log_assert(fptr_whitelist_hash_deldatafunc(table->deldatafunc));
-	log_assert(fptr_whitelist_hash_compfunc(table->compfunc));
-	log_assert(fptr_whitelist_hash_markdelfunc(table->markdelfunc));
+	fptr_ok(fptr_whitelist_hash_sizefunc(table->sizefunc));
+	fptr_ok(fptr_whitelist_hash_delkeyfunc(table->delkeyfunc));
+	fptr_ok(fptr_whitelist_hash_deldatafunc(table->deldatafunc));
+	fptr_ok(fptr_whitelist_hash_compfunc(table->compfunc));
+	fptr_ok(fptr_whitelist_hash_markdelfunc(table->markdelfunc));
 	need_size = table->sizefunc(entry->key, data);
 	if(cb_arg == NULL) cb_arg = table->cb_arg;
 
@@ -356,7 +356,7 @@ lruhash_lookup(struct lruhash* table, hashvalue_t hash, void* key, int wr)
 {
 	struct lruhash_entry* entry;
 	struct lruhash_bin* bin;
-	log_assert(fptr_whitelist_hash_compfunc(table->compfunc));
+	fptr_ok(fptr_whitelist_hash_compfunc(table->compfunc));
 
 	lock_quick_lock(&table->lock);
 	bin = &table->array[hash & table->size_mask];
@@ -379,11 +379,11 @@ lruhash_remove(struct lruhash* table, hashvalue_t hash, void* key)
 	struct lruhash_entry* entry;
 	struct lruhash_bin* bin;
 	void *d;
-	log_assert(fptr_whitelist_hash_sizefunc(table->sizefunc));
-	log_assert(fptr_whitelist_hash_delkeyfunc(table->delkeyfunc));
-	log_assert(fptr_whitelist_hash_deldatafunc(table->deldatafunc));
-	log_assert(fptr_whitelist_hash_compfunc(table->compfunc));
-	log_assert(fptr_whitelist_hash_markdelfunc(table->markdelfunc));
+	fptr_ok(fptr_whitelist_hash_sizefunc(table->sizefunc));
+	fptr_ok(fptr_whitelist_hash_delkeyfunc(table->delkeyfunc));
+	fptr_ok(fptr_whitelist_hash_deldatafunc(table->deldatafunc));
+	fptr_ok(fptr_whitelist_hash_compfunc(table->compfunc));
+	fptr_ok(fptr_whitelist_hash_markdelfunc(table->markdelfunc));
 
 	lock_quick_lock(&table->lock);
 	bin = &table->array[hash & table->size_mask];
@@ -439,9 +439,9 @@ lruhash_clear(struct lruhash* table)
 	size_t i;
 	if(!table)
 		return;
-	log_assert(fptr_whitelist_hash_delkeyfunc(table->delkeyfunc));
-	log_assert(fptr_whitelist_hash_deldatafunc(table->deldatafunc));
-	log_assert(fptr_whitelist_hash_markdelfunc(table->markdelfunc));
+	fptr_ok(fptr_whitelist_hash_delkeyfunc(table->delkeyfunc));
+	fptr_ok(fptr_whitelist_hash_deldatafunc(table->deldatafunc));
+	fptr_ok(fptr_whitelist_hash_markdelfunc(table->markdelfunc));
 
 	lock_quick_lock(&table->lock);
 	for(i=0; i<table->size; i++) {

util/timehist.c

@@ -156,7 +156,7 @@ void timehist_print(struct timehist* hist)
 #endif
 }
 
-void timehist_log(struct timehist* hist)
+void timehist_log(struct timehist* hist, const char* name)
 {
 #ifndef S_SPLINT_S
 	size_t i;
@@ -165,7 +165,7 @@ void timehist_log(struct timehist* hist)
 		timehist_quartile(hist, 0.50),
 		timehist_quartile(hist, 0.75));
 	/*        0000.000000 0000.000000 0 */
-	log_info("lower(secs) upper(secs) replycount");
+	log_info("lower(secs) upper(secs) %s", name);
 	for(i=0; i<hist->num; i++) {
 		if(hist->buckets[i].count != 0) {
 			log_info("%4d.%6.6d %4d.%6.6d %u",