- xfr-soa-tls, fix unit test for detecting changed zonefile and test

for SOA probe sent over TLS.

README.md

@@ -17,9 +17,7 @@ You can learn more about Unbound by reading our
 ## Compiling
 
 Make sure you have the C toolchain, OpenSSL and its include files, and libexpat
-installed.
-If building from the repository source you also need flex and bison installed.
-Unbound can be compiled and installed using:
+installed. Unbound can be compiled and installed using:
 
 ```
 ./configure && make && make install
@@ -29,7 +27,7 @@ You can use libevent if you want. libevent is useful when using many (10000)
 outgoing ports. By default max 256 ports are opened at the same time and the
 builtin alternative is equally capable and a little faster.
 
-Use the `--with-libevent` configure option to compile Unbound with libevent
+Use the `--with-libevent=dir` configure option to compile Unbound with libevent
 support.
 
 ## Unbound configuration

cachedb/cachedb.c

@@ -815,11 +815,6 @@ cachedb_handle_response(struct module_qstate* qstate,
 		qstate->ext_state[id] = module_finished;
 		return;
 	}
-	if(qstate->env->cfg->cachedb_no_store) {
-		/* do not store the item in the external cache */
-		qstate->ext_state[id] = module_finished;
-		return;
-	}
 
 	/* store the item into the backend cache */
 	cachedb_extcache_store(qstate, ie);

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.69 for unbound 1.19.0.
+# Generated by GNU Autoconf 2.69 for unbound 1.18.1.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues>.
 #
@@ -591,8 +591,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.19.0'
-PACKAGE_STRING='unbound 1.19.0'
+PACKAGE_VERSION='1.18.1'
+PACKAGE_STRING='unbound 1.18.1'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues'
 PACKAGE_URL=''
 
@@ -1477,7 +1477,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.19.0 to adapt to many kinds of systems.
+\`configure' configures unbound 1.18.1 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1543,7 +1543,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.19.0:";;
+     short | recursive ) echo "Configuration of unbound 1.18.1:";;
    esac
   cat <<\_ACEOF
 
@@ -1785,7 +1785,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.19.0
+unbound configure 1.18.1
 generated by GNU Autoconf 2.69
 
 Copyright (C) 2012 Free Software Foundation, Inc.
@@ -2494,7 +2494,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.19.0, which was
+It was created by unbound $as_me 1.18.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   $ $0 $@
@@ -2844,9 +2844,9 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 UNBOUND_VERSION_MAJOR=1
 
-UNBOUND_VERSION_MINOR=19
+UNBOUND_VERSION_MINOR=18
 
-UNBOUND_VERSION_MICRO=0
+UNBOUND_VERSION_MICRO=1
 
 
 LIBUNBOUND_CURRENT=9
@@ -2940,7 +2940,7 @@ LIBUNBOUND_AGE=1
 # 1.17.0 had 9:20:1
 # 1.17.1 had 9:21:1
 # 1.18.0 had 9:22:1
-# 1.19.0 had 9:23:1
+# 1.18.1 had 9:23:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -21340,7 +21340,7 @@ if test "$ac_res" != no; then :
   test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
 
 else
-  as_fn_error $? "The protobuf-c library was not found. Please install the development libraries for protobuf-c!" "$LINENO" 5
+  as_fn_error $? "The protobuf-c library was not found. Please install protobuf-c!" "$LINENO" 5
 fi
 
 
@@ -21894,7 +21894,7 @@ _ACEOF
 
 
 
-version=1.19.0
+version=1.18.1
 
 date=`date +'%b %e, %Y'`
 
@@ -22413,7 +22413,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.19.0, which was
+This file was extended by unbound $as_me 1.18.1, which was
 generated by GNU Autoconf 2.69.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -22479,7 +22479,7 @@ _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`"
 ac_cs_version="\\
-unbound config.status 1.19.0
+unbound config.status 1.18.1
 configured by $0, generated by GNU Autoconf 2.69,
   with options \\"\$ac_cs_config\\"
 

configure.ac

@@ -10,8 +10,8 @@ sinclude(dnscrypt/dnscrypt.m4)
 
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[19])
-m4_define([VERSION_MICRO],[0])
+m4_define([VERSION_MINOR],[18])
+m4_define([VERSION_MICRO],[1])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
@@ -108,7 +108,7 @@ LIBUNBOUND_AGE=1
 # 1.17.0 had 9:20:1
 # 1.17.1 had 9:21:1
 # 1.18.0 had 9:22:1
-# 1.19.0 had 9:23:1
+# 1.18.1 had 9:23:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary

dnstap/dnstap.m4

@@ -41,7 +41,7 @@ AC_DEFUN([dt_DNSTAP],
 	  fi
     ])
     AC_SEARCH_LIBS([protobuf_c_message_pack], [protobuf-c], [],
-      AC_MSG_ERROR([The protobuf-c library was not found. Please install the development libraries for protobuf-c!]))
+      AC_MSG_ERROR([The protobuf-c library was not found. Please install protobuf-c!]))
     $2
   else
     $3

doc/Changelog

@@ -1,37 +1,3 @@
-2 November 2023: Wouter
-	- Set version number to 1.19.0.
-	- Tag for 1.19.0rc1 release.
-
-1 November 2023: George
-	- Mention flex and bison in README.md when building from repository
-	  source.
-
-1 November 2023: Wouter
-	- Fix SSL compile failure for definition in log_crypto_err_io_code_arg.
-	- Fix SSL compile failure for other missing definitions in
-	  log_crypto_err_io_code_arg.
-	- Fix compilation without openssl, remove unused function warning.
-
-31 October 2023: George
-	- Fix #941: dnscrypt doesn't work after upgrade to 1.18 with
-	  suggestion by dukeartem to also fix the udp_ancil with dnscrypt.
-
-30 October 2023: George
-	- Merge #930 from Stuart Henderson: add void to
-	  log_ident_revert_to_default declaration.
-
-30 October 2023: Wouter
-	- autoconf.
-
-24 October 2023: George
-	- Clearer configure text for missing protobuf-c development libraries.
-
-20 October 2023: Wouter
-	- Merge #951: Cachedb no store. The cachedb-no-store: yes option is
-	  used to stop cachedb from writing messages to the backend storage.
-	  It reads messages when data is available from the backend. The
-	  default is no.
-
 19 October 2023: Wouter
 	- Fix to print detailed errors when an SSL IO routine fails via
 	  SSL_get_error.
@@ -4899,7 +4865,7 @@
 	- Fix that with openssl 1.1 control-use-cert: no uses less cpu, by
 	  using no encryption over the unix socket.
 
-22 November 2016: Ralph
+22 Novenber 2016: Ralph
 	- Make access-control-tag-data RDATA absolute. This makes the RDATA
 	  origin consistent between local-data and access-control-tag-data.
 	- Fix NSEC ENT wildcard check. Matching wildcard does not have to be a

doc/example.conf.in

@@ -1226,8 +1226,6 @@ remote-control:
 #     backend: "testframe"
 #     # secret seed string to calculate hashed keys
 #     secret-seed: "default"
-#     # if the backend should be read from, but not written to.
-#     cachedb-no-store: no
 #
 #     # For "redis" backend:
 #     # (to enable, use --with-libhiredis to configure before compiling)

doc/unbound.conf.5.in

@@ -2681,11 +2681,6 @@ operationally.
 If the backend database is shared by multiple Unbound instances,
 all instances must use the same secret seed.
 This option defaults to "default".
-.TP
-.B cachedb-no-store: \fI<yes or no>\fR
-If the backend should be read from, but not written to. This makes this
-instance not store dns messages in the backend. But if data is available it
-is retrieved. The default is no.
 .P
 The following
 .B cachedb

services/authzone.c

@@ -6345,6 +6345,16 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 
 	/* get master addr */
 	if(xfr->task_probe->scan_addr) {
+		/* parse the host string to get the auth name for scan_addr */
+		if(xfr->task_probe->scan_specific &&
+			xfr->task_probe->scan_specific->host &&
+			!authextstrtoaddr(xfr->task_probe->scan_specific->host, &addr, &addrlen, &auth_name)) {
+			char zname[255+1];
+			dname_str(xfr->name, zname);
+			log_err("%s: failed lookup, cannot probe to master %s",
+				zname, master->host);
+			return 0;
+		}
 		addrlen = xfr->task_probe->scan_addr->addrlen;
 		memmove(&addr, &xfr->task_probe->scan_addr->addr, addrlen);
 	} else {
@@ -6358,18 +6368,6 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 				zname, master->host);
 			return 0;
 		}
-		if (auth_name != NULL) {
-			if (addr.ss_family == AF_INET
-			&&  (int)ntohs(((struct sockaddr_in *)&addr)->sin_port)
-		            == env->cfg->ssl_port)
-				((struct sockaddr_in *)&addr)->sin_port
-					= htons((uint16_t)env->cfg->port);
-			else if (addr.ss_family == AF_INET6
-			&&  (int)ntohs(((struct sockaddr_in6 *)&addr)->sin6_port)
-		            == env->cfg->ssl_port)
-                        	((struct sockaddr_in6 *)&addr)->sin6_port
-					= htons((uint16_t)env->cfg->port);
-		}
 	}
 
 	/* create packet */
@@ -6379,11 +6377,12 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 		xfr->task_probe->id = GET_RANDOM_ID(env->rnd);
 	xfr_create_soa_probe_packet(xfr, env->scratch_buffer, 
 		xfr->task_probe->id);
-	/* we need to remove the cp if we have a different ip4/ip6 type now */
+	/* we need to remove the cp if we have a different ip4/ip6 type now.
+	 * And also for tls probes to get a new tcp commpoint. */
 	if(xfr->task_probe->cp &&
 		((xfr->task_probe->cp_is_ip6 && !addr_is_ip6(&addr, addrlen)) ||
-		(!xfr->task_probe->cp_is_ip6 && addr_is_ip6(&addr, addrlen)))
-		) {
+		(!xfr->task_probe->cp_is_ip6 && addr_is_ip6(&addr, addrlen)) ||
+		auth_name != NULL)) {
 		comm_point_delete(xfr->task_probe->cp);
 		xfr->task_probe->cp = NULL;
 	}
@@ -6391,14 +6390,19 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 		if(addr_is_ip6(&addr, addrlen))
 			xfr->task_probe->cp_is_ip6 = 1;
 		else 	xfr->task_probe->cp_is_ip6 = 0;
-		xfr->task_probe->cp = outnet_comm_point_for_udp(env->outnet,
-			auth_xfer_probe_udp_callback, xfr, &addr, addrlen);
+		if(auth_name != NULL)
+			xfr->task_probe->cp = outnet_comm_point_for_tcp(env->outnet,
+				auth_xfer_probe_tcp_callback, xfr, &addr, addrlen, env->scratch_buffer, -1, auth_name != NULL, auth_name);
+		else
+			xfr->task_probe->cp = outnet_comm_point_for_udp(env->outnet,
+				auth_xfer_probe_udp_callback, xfr, &addr, addrlen);
 		if(!xfr->task_probe->cp) {
 			char zname[255+1], as[256];
 			dname_str(xfr->name, zname);
 			addr_to_str(&addr, addrlen, as, sizeof(as));
-			verbose(VERB_ALGO, "cannot create udp cp for "
-				"probe %s to %s", zname, as);
+			verbose(VERB_ALGO, "cannot create %s cp for "
+				"probe %s to %s", (auth_name?"tcp":"udp"),
+				zname, as);
 			return 0;
 		}
 	}
@@ -6411,8 +6415,9 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 		}
 	}
 
-	/* send udp packet */
-	if(!comm_point_send_udp_msg(xfr->task_probe->cp, env->scratch_buffer,
+	/* send udp packet, for an UDP commpoint. */
+	if(auth_name == NULL &&
+	   !comm_point_send_udp_msg(xfr->task_probe->cp, env->scratch_buffer,
 		(struct sockaddr*)&addr, addrlen, 0)) {
 		char zname[255+1], as[256];
 		dname_str(xfr->name, zname);
@@ -6421,13 +6426,18 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 			zname, as);
 		return 0;
 	}
+	/* for a TCP commpoint, the packet is waiting to be sent in the
+	 * TCP commpoint buffer. The callback returns when there is a reply. */
 	if(verbosity >= VERB_ALGO) {
 		char zname[255+1], as[256];
 		dname_str(xfr->name, zname);
 		addr_to_str(&addr, addrlen, as, sizeof(as));
-		verbose(VERB_ALGO, "auth zone %s soa probe sent to %s", zname,
-			as);
+		verbose(VERB_ALGO, "auth zone %s soa probe sent to %s%s%s",
+			zname, as, (auth_name?"#":""),
+			(auth_name?auth_name:""));
 	}
+	if(auth_name != NULL)
+		timeout *= 10; /* TCP and TLS get a longer timeout */
 	xfr->task_probe->timeout = timeout;
 #ifndef S_SPLINT_S
 	t.tv_sec = timeout/1000;
@@ -6565,6 +6575,94 @@ auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
 	return 0;
 }
 
+/** callback for task_probe tcp replies */
+int
+auth_xfer_probe_tcp_callback(struct comm_point* c, void* arg, int err,
+	struct comm_reply* ATTR_UNUSED(repinfo))
+{
+	struct auth_xfer* xfr = (struct auth_xfer*)arg;
+	struct module_env* env;
+	log_assert(xfr->task_probe);
+	lock_basic_lock(&xfr->lock);
+	env = xfr->task_probe->env;
+	if(!env || env->outnet->want_to_quit) {
+		lock_basic_unlock(&xfr->lock);
+		return 0; /* stop on quit */
+	}
+	/* stop the timer */
+	comm_timer_disable(xfr->task_probe->timer);
+
+	/* see if we got a reply and what that means */
+	if(err == NETEVENT_NOERROR) {
+		uint32_t serial = 0;
+		if(check_packet_ok(c->buffer, LDNS_RR_TYPE_SOA, xfr,
+			&serial)) {
+			/* successful lookup */
+			if(verbosity >= VERB_ALGO) {
+				char buf[256];
+				dname_str(xfr->name, buf);
+				verbose(VERB_ALGO, "auth zone %s: soa probe "
+					"serial is %u", buf, (unsigned)serial);
+			}
+			/* see if this serial indicates that the zone has
+			 * to be updated */
+			if(xfr_serial_means_update(xfr, serial)) {
+				/* if updated, start the transfer task, if needed */
+				verbose(VERB_ALGO, "auth_zone updated, start transfer");
+				if(xfr->task_transfer->worker == NULL) {
+					struct auth_master* master =
+						xfr_probe_current_master(xfr);
+					/* if we have download URLs use them
+					 * in preference to this master we
+					 * just probed the SOA from */
+					if(xfr->task_transfer->masters &&
+						xfr->task_transfer->masters->http)
+						master = NULL;
+					xfr_probe_disown(xfr);
+					xfr_start_transfer(xfr, env, master);
+					return 0;
+
+				}
+				/* other tasks are running, we don't do this anymore */
+				xfr_probe_disown(xfr);
+				lock_basic_unlock(&xfr->lock);
+				/* return, we don't sent a reply to this udp packet,
+				 * and we setup the tasks to do next */
+				return 0;
+			} else {
+				verbose(VERB_ALGO, "auth_zone master reports unchanged soa serial");
+				/* we if cannot find updates amongst the
+				 * masters, this means we then have a new lease
+				 * on the zone */
+				xfr->task_probe->have_new_lease = 1;
+			}
+		} else {
+			if(verbosity >= VERB_ALGO) {
+				char buf[256];
+				dname_str(xfr->name, buf);
+				verbose(VERB_ALGO, "auth zone %s: bad reply to soa probe", buf);
+			}
+		}
+	} else {
+		if(verbosity >= VERB_ALGO) {
+			char buf[256];
+			dname_str(xfr->name, buf);
+			verbose(VERB_ALGO, "auth zone %s: soa probe failed", buf);
+		}
+	}
+
+	/* failed lookup or not an update */
+	/* delete commpoint so a new one is created, with a fresh port nr */
+	comm_point_delete(xfr->task_probe->cp);
+	xfr->task_probe->cp = NULL;
+
+	/* if the result was not a successful probe, we need
+	 * to send the next one */
+	xfr_probe_nextmaster(xfr);
+	xfr_probe_send_or_end(xfr, env);
+	return 0;
+}
+
 /** lookup a host name for its addresses, if needed */
 static int
 xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env)

services/authzone.h

@@ -678,6 +678,9 @@ void auth_xfer_timer(void* arg);
 /** callback for commpoint udp replies to task_probe */
 int auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
         struct comm_reply* repinfo);
+/** callback for commpoint tcp replies to task_probe */
+int auth_xfer_probe_tcp_callback(struct comm_point* c, void* arg, int err,
+        struct comm_reply* repinfo);
 /** callback for task_transfer tcp connections */
 int auth_xfer_transfer_tcp_callback(struct comm_point* c, void* arg, int err,
         struct comm_reply* repinfo);

testdata/auth_axfr_tls.tdir/auth_axfr_tls.conf

@@ -0,0 +1,22 @@
+server:
+	verbosity: 7
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	use-caps-for-id: no
+	tls-cert-bundle: "unbound_server.pem"
+auth-zone:
+	name: "example.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@#unbound"
+# if queries escape, send them to localhost
+forward-zone:
+	name: "."
+	forward-addr: 127.0.0.1@@PORT@

testdata/auth_axfr_tls.tdir/auth_axfr_tls.conf2

@@ -0,0 +1,22 @@
+server:
+	verbosity: 5
+	logfile: "/dev/stderr"
+	xfrdfile: "xfrd.state"
+	zonesdir: ""
+	username: ""
+	chroot: ""
+	pidfile: "nsd.pid"
+	database: ""
+	zonelistfile: "zone.list"
+	interface: 127.0.0.1@@AUTH_PORT@
+	tls-service-key: "unbound_server.key"
+	tls-service-pem: "unbound_server.pem"
+	tls-port: @AUTH_PORT@
+
+zone:
+	name: "example.com"
+	zonefile: "example.com.zone"
+	provide-xfr: 127.0.0.0/8 NOKEY
+	provide-xfr: ::1 NOKEY
+	provide-xfr: ::ffff:127.0.0.1 NOKEY
+	notify: 127.0.0.1@@PORT@ NOKEY

testdata/auth_axfr_tls.tdir/auth_axfr_tls.dsc

@@ -0,0 +1,16 @@
+BaseName: auth_axfr_tls
+Version: 1.0
+Description: Perform AXFR for authority zone using TLS
+CreationDate: Thu 19 Oct 09:25:40 CEST 2023
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: auth_axfr_tls.pre
+Post: auth_axfr_tls.post
+Test: auth_axfr_tls.test
+AuxFiles: 
+Passed:
+Failure:

testdata/auth_axfr_tls.tdir/auth_axfr_tls.post

@@ -0,0 +1,16 @@
+# #-- auth_axfr_tls.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $AUTH_PID
+kill_pid $UNBOUND_PID
+if test -f nsd.log; then
+	cat nsd.log
+fi
+if test -f unbound.log; then
+	cat unbound.log
+fi

testdata/auth_axfr_tls.tdir/auth_axfr_tls.pre

@@ -0,0 +1,51 @@
+# #-- auth_axfr_tls.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+# see if we have NSD as an auth server to serve xfr over tls.
+NSD=nsd
+if which nsd 2>/dev/null; then
+	echo "NSD=$NSD"
+else
+	NSD=""
+	for d in ".." "../.." "../../.." "../../../.." ; do
+		if test -z "$NSD" -o ! -f "$NSD"; then
+			if test -d "$d/nsd" && test -f "$d/nsd/nsd"; then
+				NSD="$d/nsd/nsd"
+				break;
+			fi
+		fi
+	done
+fi
+if test -z "$NSD"; then
+	skip_test "Need nsd for auth server, skip test"
+fi
+echo "NSD=$NSD" >> .tpkg.var.test
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+AUTH_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "AUTH_PORT=$AUTH_PORT" >> .tpkg.var.test
+
+# start auth server
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@AUTH_PORT\@/'$AUTH_PORT'/' < auth_axfr_tls.conf2 > nsd.conf
+$NSD -d -c nsd.conf >nsd.log 2>&1 &
+AUTH_PID=$!
+echo "AUTH_PID=$AUTH_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$AUTH_PORT'/' < auth_axfr_tls.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_nsd_up nsd.log
+wait_unbound_up unbound.log
+

testdata/auth_axfr_tls.tdir/auth_axfr_tls.test

@@ -0,0 +1,87 @@
+# #-- auth_axfr_tls.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+# try again if it needs time to do the zone transfer.
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.4" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# update the zone
+mv example.com.zone example.com.zone.old
+mv example.com.zone2 example.com.zone
+touch example.com.zone
+kill -1 $AUTH_PID
+#it would need to wait for the line to appear twice.
+#wait_server_up nsd.log "zone example.com read with success"
+echo "> auth server updated"
+
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+# try again if it needs time to do the zone transfer.
+if grep SERVFAIL outfile || grep "1.2.3.4" outfile; then
+	echo "> try again"
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile || grep "1.2.3.4" outfile; then
+	echo "> try again"
+	sleep 1
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile || grep "1.2.3.4" outfile; then
+	echo "> try again"
+	sleep 1
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile || grep "1.2.3.4" outfile; then
+	echo "> try again"
+	sleep 1
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.5" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+if grep "auth zone example.com. soa probe sent to 127.0.0.1#unbound" unbound.log; then
+	echo "SOA sent over TLS"
+else
+	echo "SOA not sent over TLS"
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0

testdata/auth_axfr_tls.tdir/example.com.zone

@@ -0,0 +1,2 @@
+example.com.	IN	SOA	nibbler.example.com. leela.example.com. 4 3600 3600 7200 300
+www.example.com. IN A 1.2.3.4

testdata/auth_axfr_tls.tdir/example.com.zone2

@@ -0,0 +1,2 @@
+example.com.	IN	SOA	nibbler.example.com. leela.example.com. 8 3600 3600 7200 300
+www.example.com. IN A 1.2.3.5

testdata/auth_axfr_tls.tdir/unbound_control.key

@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
+-----END RSA PRIVATE KEY-----

testdata/auth_axfr_tls.tdir/unbound_control.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
+-----END CERTIFICATE-----

testdata/auth_axfr_tls.tdir/unbound_server.key

@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
+-----END RSA PRIVATE KEY-----

testdata/auth_axfr_tls.tdir/unbound_server.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
+-----END CERTIFICATE-----

testdata/cachedb_no_store.tdir/cachedb_no_store.conf

@@ -1,29 +0,0 @@
-server:
-	verbosity: 4
-	interface: 127.0.0.1
-	port: @PORT@
-	use-syslog: no
-	directory: ""
-	pidfile: "unbound.pid"
-	chroot: ""
-	username: ""
-	module-config: "cachedb iterator"
-	do-not-query-localhost: no
-	qname-minimisation: no
-
-forward-zone:
-	name: "."
-	forward-addr: 127.0.0.1@@TOPORT@
-
-stub-zone:
-	name: "example.com"
-	stub-addr: 127.0.0.1@@TOPORT@
-
-remote-control:
-	control-enable: yes
-	control-interface: @CONTROL_PATH@/controlpipe.@CONTROL_PID@
-	control-use-cert: no
-
-cachedb:
-	backend: "testframe"
-	secret-seed: "testvalue"

testdata/cachedb_no_store.tdir/cachedb_no_store.dsc

@@ -1,16 +0,0 @@
-BaseName: cachedb_no_store
-Version: 1.0
-Description: cachedb test the cachedb-no-store option
-CreationDate: Wed 11 Oct 11:00:00 CEST 2023
-Maintainer: dr. W.C.A. Wijngaards
-Category: 
-Component:
-CmdDepends: 
-Depends: 
-Help:
-Pre: cachedb_no_store.pre
-Post: cachedb_no_store.post
-Test: cachedb_no_store.test
-AuxFiles: 
-Passed:
-Failure:

testdata/cachedb_no_store.tdir/cachedb_no_store.post

@@ -1,20 +0,0 @@
-# #-- cachedb_no_store.post --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# source the test var file when it's there
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-#
-# do your teardown here
-PRE="../.."
-. ../common.sh
-
-echo "> cat logfiles"
-cat fwd.log 
-if test -f fwd2.log; then cat fwd2.log; else echo "no fwd2.log"; fi
-if test -f fwd3.log; then cat fwd3.log; else echo "no fwd3.log"; fi
-if test -f fwd4.log; then cat fwd4.log; else echo "no fwd4.log"; fi
-cat unbound.log
-if test -f unbound2.log; then cat unbound2.log; else echo "no unbound2.log"; fi
-kill_pid $FWD_PID
-kill_pid `cat unbound.pid`
-rm -f $CONTROL_PATH/controlpipe.$CONTROL_PID

testdata/cachedb_no_store.tdir/cachedb_no_store.pre

@@ -1,36 +0,0 @@
-# #-- cachedb_no_store.pre--#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-if grep "define USE_CACHEDB 1" $PRE/config.h; then echo test enabled; else skip_test "test skipped"; fi
-
-get_random_port 2
-UNBOUND_PORT=$RND_PORT
-FWD_PORT=$(($RND_PORT + 1))
-echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
-echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
-
-# start forwarder
-get_ldns_testns
-$LDNS_TESTNS -p $FWD_PORT cachedb_no_store.testns >fwd.log 2>&1 &
-FWD_PID=$!
-echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
-
-# make config file
-CONTROL_PATH=/tmp
-CONTROL_PID=$$
-sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's?@CONTROL_PATH\@?'$CONTROL_PATH'?' -e 's/@CONTROL_PID@/'$CONTROL_PID'/' < cachedb_no_store.conf > ub.conf
-# start unbound in the background
-$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-echo "CONTROL_PATH=$CONTROL_PATH" >> .tpkg.var.test
-echo "CONTROL_PID=$CONTROL_PID" >> .tpkg.var.test
-
-cat .tpkg.var.test
-wait_ldns_testns_up fwd.log
-wait_unbound_up unbound.log

testdata/cachedb_no_store.tdir/cachedb_no_store.servfail.testns

@@ -1,8 +0,0 @@
-ENTRY_BEGIN
-MATCH opcode
-ADJUST copy_id copy_query
-REPLY QR AA SERVFAIL
-SECTION QUESTION
-txt1.example.com. IN TXT
-SECTION ANSWER
-ENTRY_END

testdata/cachedb_no_store.tdir/cachedb_no_store.test

@@ -1,132 +0,0 @@
-# #-- cachedb_no_store.test --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-
-# do the test
-get_ldns_testns
-
-# query for a text record that is stored by unbound's cache and cachedb
-# in the testframe cache.
-echo "> dig txt1.example.com."
-dig @localhost -p $UNBOUND_PORT txt1.example.com. TXT | tee outfile
-if grep "example text message" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-# stop the forwarder with servfail, to check the answer came from the cache
-echo "> stop ldns-testns"
-kill_pid $FWD_PID
-echo "> start ldns-testns with servfails"
-$LDNS_TESTNS -p $FWD_PORT cachedb_no_store.servfail.testns >fwd2.log 2>&1 &
-FWD_PID=$!
-echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
-wait_ldns_testns_up fwd2.log
-
-echo "> dig txt1.example.com. from unbound cache"
-dig @localhost -p $UNBOUND_PORT txt1.example.com. TXT | tee outfile
-if grep "example text message" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-# clear the cache of unbound, but not cachedb testframe cache
-echo "> unbound-control flush"
-$PRE/unbound-control -c ub.conf flush_type txt1.example.com. TXT
-if test $? -ne 0; then
-	echo "wrong exit value."
-	exit 1
-else
-	echo "exit value: OK"
-fi
-
-echo "> dig txt1.example.com. from cachedb"
-dig @localhost -p $UNBOUND_PORT txt1.example.com. TXT | tee outfile
-if grep "example text message" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-# start the forwarder again.
-echo "> stop ldns-testns"
-kill_pid $FWD_PID
-echo "> start ldns-testns"
-$LDNS_TESTNS -p $FWD_PORT cachedb_no_store.testns >fwd3.log 2>&1 &
-FWD_PID=$!
-echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
-wait_ldns_testns_up fwd3.log
-
-# stop unbound to flush the cachedb cache
-echo "> stop unbound"
-kill_pid `cat unbound.pid`
-
-echo ""
-echo "> config unbound with cachedb-no-store: yes"
-echo "cachedb: cachedb-no-store: yes" >> ub.conf
-
-# start unbound again.
-echo "> start unbound"
-$PRE/unbound -d -c ub.conf >unbound2.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-wait_unbound_up unbound2.log
-
-echo ""
-echo "> dig txt1.example.com."
-dig @localhost -p $UNBOUND_PORT txt1.example.com. TXT | tee outfile
-if grep "example text message" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-# stop the forwarder with servfail, to check the answer came from the cache
-echo "> stop ldns-testns"
-kill_pid $FWD_PID
-echo "> start ldns-testns with servfails"
-$LDNS_TESTNS -p $FWD_PORT cachedb_no_store.servfail.testns >fwd4.log 2>&1 &
-FWD_PID=$!
-echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
-wait_ldns_testns_up fwd4.log
-
-echo "> dig txt1.example.com. from unbound cache"
-dig @localhost -p $UNBOUND_PORT txt1.example.com. TXT | tee outfile
-if grep "example text message" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-# clear the cache of unbound, but not cachedb testframe cache
-echo "> unbound-control flush"
-$PRE/unbound-control -c ub.conf flush_type txt1.example.com. TXT
-if test $? -ne 0; then
-	echo "wrong exit value."
-	exit 1
-else
-	echo "exit value: OK"
-fi
-
-echo "> dig txt1.example.com. from cachedb, but that has no message stored"
-dig @localhost -p $UNBOUND_PORT txt1.example.com. TXT | tee outfile
-if grep "SERVFAIL" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-exit 0

testdata/cachedb_no_store.tdir/cachedb_no_store.testns

@@ -1,9 +0,0 @@
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-txt1.example.com. IN TXT
-SECTION ANSWER
-txt1.example.com. IN TXT "example text message"
-ENTRY_END

util/config_file.c

@@ -382,7 +382,6 @@ config_create(void)
 #ifdef USE_CACHEDB
 	if(!(cfg->cachedb_backend = strdup("testframe"))) goto error_exit;
 	if(!(cfg->cachedb_secret = strdup("default"))) goto error_exit;
-	cfg->cachedb_no_store = 0;
 #ifdef USE_REDIS
 	if(!(cfg->redis_server_host = strdup("127.0.0.1"))) goto error_exit;
 	cfg->redis_server_path = NULL;
@@ -823,9 +822,6 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	{ IS_NUMBER_OR_ZERO; cfg->ipsecmod_max_ttl = atoi(val); }
 	else S_YNO("ipsecmod-strict:", ipsecmod_strict)
 #endif
-#ifdef USE_CACHEDB
-	else S_YNO("cachedb-no-store:", cachedb_no_store)
-#endif /* USE_CACHEDB */
 	else if(strcmp(opt, "define-tag:") ==0) {
 		return config_add_tag(cfg, val);
 	/* val_sig_skew_min, max and val_max_restart are copied into val_env
@@ -1314,7 +1310,6 @@ config_get_option(struct config_file* cfg, const char* opt,
 #ifdef USE_CACHEDB
 	else O_STR(opt, "backend", cachedb_backend)
 	else O_STR(opt, "secret-seed", cachedb_secret)
-	else O_YNO(opt, "cachedb-no-store", cachedb_no_store)
 #ifdef USE_REDIS
 	else O_STR(opt, "redis-server-host", redis_server_host)
 	else O_DEC(opt, "redis-server-port", redis_server_port)

util/config_file.h

@@ -701,8 +701,6 @@ struct config_file {
 	char* cachedb_backend;
 	/** secret seed for hash key calculation */
 	char* cachedb_secret;
-	/** cachedb that does not store, but only reads from database, if on */
-	int cachedb_no_store;
 #ifdef USE_REDIS
 	/** redis server's IP address or host name */
 	char* redis_server_host;

util/configlexer.lex

@@ -558,7 +558,6 @@ ipsecmod-strict{COLON}		{ YDVAR(1, VAR_IPSECMOD_STRICT) }
 cachedb{COLON}			{ YDVAR(0, VAR_CACHEDB) }
 backend{COLON}			{ YDVAR(1, VAR_CACHEDB_BACKEND) }
 secret-seed{COLON}		{ YDVAR(1, VAR_CACHEDB_SECRETSEED) }
-cachedb-no-store{COLON}		{ YDVAR(1, VAR_CACHEDB_NO_STORE) }
 redis-server-host{COLON}	{ YDVAR(1, VAR_CACHEDB_REDISHOST) }
 redis-server-port{COLON}	{ YDVAR(1, VAR_CACHEDB_REDISPORT) }
 redis-server-path{COLON}	{ YDVAR(1, VAR_CACHEDB_REDISPATH) }

util/configparser.y

@@ -199,7 +199,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_INTERFACE_ACTION VAR_INTERFACE_VIEW VAR_INTERFACE_TAG
 %token VAR_INTERFACE_TAG_ACTION VAR_INTERFACE_TAG_DATA
 %token VAR_PROXY_PROTOCOL_PORT VAR_STATISTICS_INHIBIT_ZERO
-%token VAR_HARDEN_UNKNOWN_ADDITIONAL VAR_DISABLE_EDNS_DO VAR_CACHEDB_NO_STORE
+%token VAR_HARDEN_UNKNOWN_ADDITIONAL VAR_DISABLE_EDNS_DO
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -3712,7 +3712,7 @@ contents_cachedb: contents_cachedb content_cachedb
 content_cachedb: cachedb_backend_name | cachedb_secret_seed |
 	redis_server_host | redis_server_port | redis_timeout |
 	redis_expire_records | redis_server_path | redis_server_password |
-	cachedb_no_store | redis_logical_db
+	redis_logical_db
 	;
 cachedb_backend_name: VAR_CACHEDB_BACKEND STRING_ARG
 	{
@@ -3738,19 +3738,6 @@ cachedb_secret_seed: VAR_CACHEDB_SECRETSEED STRING_ARG
 	#endif
 	}
 	;
-cachedb_no_store: VAR_CACHEDB_NO_STORE STRING_ARG
-	{
-	#ifdef USE_CACHEDB
-		OUTYY(("P(cachedb_no_store:%s)\n", $2));
-		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
-			yyerror("expected yes or no.");
-		else cfg_parser->cfg->cachedb_no_store = (strcmp($2, "yes")==0);
-	#else
-		OUTYY(("P(Compiled without cachedb, ignoring)\n"));
-	#endif
-		free($2);
-	}
-	;
 redis_server_host: VAR_CACHEDB_REDISHOST STRING_ARG
 	{
 	#if defined(USE_CACHEDB) && defined(USE_REDIS)

util/fptr_wlist.c

@@ -108,6 +108,7 @@ fptr_whitelist_comm_point(comm_point_callback_type *fptr)
 	else if(fptr == &outnet_tcp_cb) return 1;
 	else if(fptr == &tube_handle_listen) return 1;
 	else if(fptr == &auth_xfer_probe_udp_callback) return 1;
+	else if(fptr == &auth_xfer_probe_tcp_callback) return 1;
 	else if(fptr == &auth_xfer_transfer_tcp_callback) return 1;
 	else if(fptr == &auth_xfer_transfer_http_callback) return 1;
 	return 0;

util/log.c

@@ -187,7 +187,7 @@ void log_ident_set_default(const char* id)
 	default_ident = id;
 }
 
-void log_ident_revert_to_default(void)
+void log_ident_revert_to_default()
 {
 	ident = default_ident;
 }

util/net_help.c

@@ -952,11 +952,11 @@ void log_crypto_err_code(const char* str, unsigned long err)
 #endif /* HAVE_SSL */
 }
 
-#ifdef HAVE_SSL
 /** Print crypt erro with SSL_get_error want code and err_get_error code */
 static void log_crypto_err_io_code_arg(const char* str, int r,
 	unsigned long err, int err_present)
 {
+#ifdef HAVE_SSL
 	int print_errno = 0, print_crypto_err = 0;
 	const char* inf = NULL;
 
@@ -982,21 +982,15 @@ static void log_crypto_err_io_code_arg(const char* str, int r,
 	case SSL_ERROR_WANT_X509_LOOKUP:
 		inf = "want X509 lookup";
 		break;
-#ifdef SSL_ERROR_WANT_ASYNC
 	case SSL_ERROR_WANT_ASYNC:
 		inf = "want async";
 		break;
-#endif
-#ifdef SSL_ERROR_WANT_ASYNC_JOB
 	case SSL_ERROR_WANT_ASYNC_JOB:
 		inf = "want async job";
 		break;
-#endif
-#ifdef SSL_ERROR_WANT_CLIENT_HELLO_CB
 	case SSL_ERROR_WANT_CLIENT_HELLO_CB:
 		inf = "want client hello cb";
 		break;
-#endif
 	case SSL_ERROR_SYSCALL:
 		print_errno = 1;
 		inf = "syscall";
@@ -1033,8 +1027,13 @@ static void log_crypto_err_io_code_arg(const char* str, int r,
 			log_err("str: %s", inf);
 		}
 	}
-}
+#else
+	(void)str;
+	(void)r;
+	(void)err;
+	(void)err_present;
 #endif /* HAVE_SSL */
+}
 
 void log_crypto_err_io(const char* str, int r)
 {

util/netevent.c

@@ -1070,13 +1070,7 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 		fptr_ok(fptr_whitelist_comm_point(rep.c->callback));
 		if((*rep.c->callback)(rep.c, rep.c->cb_arg, NETEVENT_NOERROR, &rep)) {
 			/* send back immediate reply */
-			struct sldns_buffer *buffer;
-#ifdef USE_DNSCRYPT
-			buffer = rep.c->dnscrypt_buffer;
-#else
-			buffer = rep.c->buffer;
-#endif
-			(void)comm_point_send_udp_msg_if(rep.c, buffer,
+			(void)comm_point_send_udp_msg_if(rep.c, rep.c->buffer,
 				(struct sockaddr*)&rep.remote_addr,
 				rep.remote_addrlen, &rep);
 		}