- xfr-soa-tls, fix unit test for detecting changed zonefile and test

for SOA probe sent over TLS.

.github/workflows/analysis_ports.yml

@@ -163,7 +163,7 @@ jobs:
             make: "no"
  
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v3
         with:
           submodules: false
       - name: test_windows
@@ -181,20 +181,21 @@ jobs:
           export LEX="win_flex"
           echo 'YACC="win_bison -y"'
           export YACC="win_bison -y"
+          #echo "curl cpanm"
+          #curl -L -k -s -S -o cpanm https://cpanmin.us/
+          #echo "perl cpanm Pod::Usage"
+          #perl cpanm Pod::Usage
           mkdir openssl
           echo "curl openssl"
-          curl -L -k -s -S -o openssl-3.2.0.tar.gz https://www.openssl.org/source/openssl-3.2.0.tar.gz
-          tar xzf openssl-3.2.0.tar.gz
-          cd openssl-3.2.0
+          curl -L -k -s -S -o openssl-1.1.1j.tar.gz https://www.openssl.org/source/openssl-1.1.1j.tar.gz
+          tar xzf openssl-1.1.1j.tar.gz
+          cd openssl-1.1.1j
           # remove pod::Usage because we do not need -help or -man output
-          # from the Configure script, this fixes it for openssl 1.1.1
-          #echo "Fixup ./Configure by removing use Pod::Usage require"
-          #sed -e 's/use Pod::Usage//' < Configure > Configure.fix
-          # ./Configure.fix no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl"
-          # pacman is used to install for msys2, with
-          # C:/msys64/usr/bin/pacman -S perl
-          echo "C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix=\""$prepath/openssl"\" PERL=\"C:/msys64/usr/bin/perl\""
-          C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl" PERL="C:/msys64/usr/bin/perl"
+          # from the Configure script
+          echo "Fixup ./Configure by removing use Pod::Usage require"
+          sed -e 's/use Pod::Usage//' < Configure > Configure.fix
+          echo "./Configure.fix no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix=\""$prepath/openssl\"""
+          ./Configure.fix no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl"
           # make the libs only, build faster
           echo "make build_libs"
           #make

.github/workflows/ci.yml

@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v3
     - name: configure
       run: ./configure --enable-debug
     - name: make

README.md

@@ -17,9 +17,7 @@ You can learn more about Unbound by reading our
 ## Compiling
 
 Make sure you have the C toolchain, OpenSSL and its include files, and libexpat
-installed.
-If building from the repository source you also need flex and bison installed.
-Unbound can be compiled and installed using:
+installed. Unbound can be compiled and installed using:
 
 ```
 ./configure && make && make install
@@ -29,7 +27,7 @@ You can use libevent if you want. libevent is useful when using many (10000)
 outgoing ports. By default max 256 ports are opened at the same time and the
 builtin alternative is equally capable and a little faster.
 
-Use the `--with-libevent` configure option to compile Unbound with libevent
+Use the `--with-libevent=dir` configure option to compile Unbound with libevent
 support.
 
 ## Unbound configuration

acx_nlnetlabs.m4

@@ -2,10 +2,7 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 48
-# 2024-01-16 fix to add -l:libssp.a to -lcrypto link check.
-#	     and check for getaddrinfo with only header.
-# 2024-01-15 fix to add crypt32 to -lcrypto link check when checking for gdi32.
+# Version 46
 # 2023-05-04 fix to remove unused whitespace.
 # 2023-01-26 fix -Wstrict-prototypes.
 # 2022-09-01 fix checking if nonblocking sockets work on OpenBSD.
@@ -710,7 +707,7 @@ AC_DEFUN([ACX_SSL_CHECKS], [
 		    LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir_lib"
 	    	    ACX_RUNTIME_PATH_ADD([$ssldir_lib])
 	    fi
-
+        
             AC_MSG_CHECKING([for EVP_sha256 in -lcrypto])
             LIBS="$LIBS -lcrypto"
             LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
@@ -735,73 +732,40 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                   ]])],[
                     AC_DEFINE([HAVE_EVP_SHA256], 1,
                         [If you have EVP_sha256])
-                    AC_MSG_RESULT(yes)
+                    AC_MSG_RESULT(yes) 
                   ],[
                     AC_MSG_RESULT(no)
                     LIBS="$BAKLIBS"
                     LIBSSL_LIBS="$BAKSSLLIBS"
-
-		    LIBS="$LIBS -lgdi32 -lws2_32 -lcrypt32"
-		    LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32 -lws2_32 -lcrypt32"
-                    AC_MSG_CHECKING([if -lcrypto needs -lgdi32 -lws2_32 -lcrypt32])
-		    AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
-			int EVP_sha256(void);
-			(void)EVP_sha256();
-		      ]])],[
-			AC_DEFINE([HAVE_EVP_SHA256], 1,
-			    [If you have EVP_sha256])
-			AC_MSG_RESULT(yes)
-		      ],[
-			AC_MSG_RESULT(no)
-			LIBS="$BAKLIBS"
-			LIBSSL_LIBS="$BAKSSLLIBS"
-
-			LIBS="$LIBS -lgdi32 -lws2_32 -lcrypt32 -l:libssp.a"
-			LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32 -lws2_32 -lcrypt32 -l:libssp.a"
-			AC_MSG_CHECKING([if -lcrypto needs -lgdi32 -lws2_32 -lcrypt32 -l:libssp.a])
-			AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
-			    int EVP_sha256(void);
-			    (void)EVP_sha256();
-			  ]])],[
-			    AC_DEFINE([HAVE_EVP_SHA256], 1,
-				[If you have EVP_sha256])
-			    AC_MSG_RESULT(yes)
-			  ],[
-			    AC_MSG_RESULT(no)
-			    LIBS="$BAKLIBS"
-			    LIBSSL_LIBS="$BAKSSLLIBS"
-
-			    LIBS="$LIBS -ldl"
-			    LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
-			    AC_MSG_CHECKING([if -lcrypto needs -ldl])
-			    AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
-				int EVP_sha256(void);
-				(void)EVP_sha256();
-			      ]])],[
-				AC_DEFINE([HAVE_EVP_SHA256], 1,
-				    [If you have EVP_sha256])
-				AC_MSG_RESULT(yes)
-			      ],[
-				AC_MSG_RESULT(no)
-				LIBS="$BAKLIBS"
-				LIBSSL_LIBS="$BAKSSLLIBS"
-				LIBS="$LIBS -ldl -pthread"
-				LIBSSL_LIBS="$LIBSSL_LIBS -ldl -pthread"
-				AC_MSG_CHECKING([if -lcrypto needs -ldl -pthread])
-				AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
-				    int EVP_sha256(void);
-				    (void)EVP_sha256();
-				  ]])],[
-				    AC_DEFINE([HAVE_EVP_SHA256], 1,
-					[If you have EVP_sha256])
-				    AC_MSG_RESULT(yes)
-				  ],[
-				    AC_MSG_RESULT(no)
-				    AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
-				])
-			    ])
+                    LIBS="$LIBS -ldl"
+                    LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
+                    AC_MSG_CHECKING([if -lcrypto needs -ldl])
+                    AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
+                        int EVP_sha256(void);
+                        (void)EVP_sha256();
+                      ]])],[
+                        AC_DEFINE([HAVE_EVP_SHA256], 1,
+                            [If you have EVP_sha256])
+                        AC_MSG_RESULT(yes) 
+                      ],[
+                        AC_MSG_RESULT(no)
+                        LIBS="$BAKLIBS"
+                        LIBSSL_LIBS="$BAKSSLLIBS"
+                        LIBS="$LIBS -ldl -pthread"
+                        LIBSSL_LIBS="$LIBSSL_LIBS -ldl -pthread"
+                        AC_MSG_CHECKING([if -lcrypto needs -ldl -pthread])
+                        AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[
+                            int EVP_sha256(void);
+                            (void)EVP_sha256();
+                          ]])],[
+                            AC_DEFINE([HAVE_EVP_SHA256], 1,
+                                [If you have EVP_sha256])
+                            AC_MSG_RESULT(yes) 
+                          ],[
+                            AC_MSG_RESULT(no)
+                            AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
 			])
-		    ])
+                    ])
                 ])
             ])
         fi
@@ -815,7 +779,7 @@ AC_CHECK_HEADERS([openssl/rand.h],,, [AC_INCLUDES_DEFAULT])
 
 dnl Check for SSL, where SSL is mandatory
 dnl Adds --with-ssl option, searches for openssl and defines HAVE_SSL if found
-dnl Setup of CPPFLAGS, CFLAGS.  Adds -lcrypto to LIBS.
+dnl Setup of CPPFLAGS, CFLAGS.  Adds -lcrypto to LIBS. 
 dnl Checks main header files of SSL.
 dnl
 AC_DEFUN([ACX_WITH_SSL],
@@ -908,7 +872,7 @@ dnl see if on windows
 if test "$ac_cv_header_windows_h" = "yes"; then
 	AC_DEFINE(USE_WINSOCK, 1, [Whether the windows socket API is used])
 	USE_WINSOCK="1"
-	if echo "$LIBS" | grep 'lws2_32' >/dev/null; then
+	if echo $LIBS | grep 'lws2_32' >/dev/null; then
 		:
 	else
 		LIBS="$LIBS -lws2_32"
@@ -916,24 +880,6 @@ if test "$ac_cv_header_windows_h" = "yes"; then
 fi
 ],
 dnl no quick getaddrinfo, try mingw32 and winsock2 library.
-dnl perhaps getaddrinfo needs only the include
-AC_LINK_IFELSE(
-[AC_LANG_PROGRAM(
-[
-#ifdef HAVE_WS2TCPIP_H
-#include <ws2tcpip.h>
-#endif
-],
-[
-        (void)getaddrinfo(NULL, NULL, NULL, NULL);
-]
-)],
-[
-ac_cv_func_getaddrinfo="yes"
-AC_DEFINE(USE_WINSOCK, 1, [Whether the windows socket API is used])
-USE_WINSOCK="1"
-],
-
 ORIGLIBS="$LIBS"
 LIBS="$LIBS -lws2_32"
 AC_LINK_IFELSE(
@@ -958,7 +904,6 @@ ac_cv_func_getaddrinfo="no"
 LIBS="$ORIGLIBS"
 ])
 )
-)
 
 AC_MSG_RESULT($ac_cv_func_getaddrinfo)
 if test $ac_cv_func_getaddrinfo = yes; then

cachedb/cachedb.c

@@ -815,11 +815,6 @@ cachedb_handle_response(struct module_qstate* qstate,
 		qstate->ext_state[id] = module_finished;
 		return;
 	}
-	if(qstate->env->cfg->cachedb_no_store) {
-		/* do not store the item in the external cache */
-		qstate->ext_state[id] = module_finished;
-		return;
-	}
 
 	/* store the item into the backend cache */
 	cachedb_extcache_store(qstate, ie);

config.h.in

@@ -379,8 +379,8 @@
 /* Define to 1 if you have the `memmove' function. */
 #undef HAVE_MEMMOVE
 
-/* Define to 1 if you have the <minix/config.h> header file. */
-#undef HAVE_MINIX_CONFIG_H
+/* Define to 1 if you have the <memory.h> header file. */
+#undef HAVE_MEMORY_H
 
 /* Define to 1 if you have the <netdb.h> header file. */
 #undef HAVE_NETDB_H
@@ -587,9 +587,6 @@
 /* Define to 1 if you have the <stdint.h> header file. */
 #undef HAVE_STDINT_H
 
-/* Define to 1 if you have the <stdio.h> header file. */
-#undef HAVE_STDIO_H
-
 /* Define to 1 if you have the <stdlib.h> header file. */
 #undef HAVE_STDLIB_H
 
@@ -692,9 +689,6 @@
 /* Define to 1 if you have the <vfork.h> header file. */
 #undef HAVE_VFORK_H
 
-/* Define to 1 if you have the <wchar.h> header file. */
-#undef HAVE_WCHAR_H
-
 /* Define to 1 if you have the <windows.h> header file. */
 #undef HAVE_WINDOWS_H
 
@@ -836,9 +830,7 @@
 /* Define to 1 if libsodium supports sodium_set_misuse_handler */
 #undef SODIUM_MISUSE_HANDLER
 
-/* Define to 1 if all of the C90 standard headers exist (not just the ones
-   required in a freestanding environment). This macro is provided for
-   backward compatibility; new code need not use it. */
+/* Define to 1 if you have the ANSI C header files. */
 #undef STDC_HEADERS
 
 /* use default strptime. */
@@ -934,87 +926,21 @@
 #ifndef _ALL_SOURCE
 # undef _ALL_SOURCE
 #endif
-/* Enable general extensions on macOS.  */
-#ifndef _DARWIN_C_SOURCE
-# undef _DARWIN_C_SOURCE
-#endif
-/* Enable general extensions on Solaris.  */
-#ifndef __EXTENSIONS__
-# undef __EXTENSIONS__
-#endif
 /* Enable GNU extensions on systems that have them.  */
 #ifndef _GNU_SOURCE
 # undef _GNU_SOURCE
 #endif
-/* Enable X/Open compliant socket functions that do not require linking
-   with -lxnet on HP-UX 11.11.  */
-#ifndef _HPUX_ALT_XOPEN_SOCKET_API
-# undef _HPUX_ALT_XOPEN_SOCKET_API
-#endif
-/* Identify the host operating system as Minix.
-   This macro does not affect the system headers' behavior.
-   A future release of Autoconf may stop defining this macro.  */
-#ifndef _MINIX
-# undef _MINIX
-#endif
-/* Enable general extensions on NetBSD.
-   Enable NetBSD compatibility extensions on Minix.  */
-#ifndef _NETBSD_SOURCE
-# undef _NETBSD_SOURCE
-#endif
-/* Enable OpenBSD compatibility extensions on NetBSD.
-   Oddly enough, this does nothing on OpenBSD.  */
-#ifndef _OPENBSD_SOURCE
-# undef _OPENBSD_SOURCE
-#endif
-/* Define to 1 if needed for POSIX-compatible behavior.  */
-#ifndef _POSIX_SOURCE
-# undef _POSIX_SOURCE
-#endif
-/* Define to 2 if needed for POSIX-compatible behavior.  */
-#ifndef _POSIX_1_SOURCE
-# undef _POSIX_1_SOURCE
-#endif
-/* Enable POSIX-compatible threading on Solaris.  */
+/* Enable threading extensions on Solaris.  */
 #ifndef _POSIX_PTHREAD_SEMANTICS
 # undef _POSIX_PTHREAD_SEMANTICS
 #endif
-/* Enable extensions specified by ISO/IEC TS 18661-5:2014.  */
-#ifndef __STDC_WANT_IEC_60559_ATTRIBS_EXT__
-# undef __STDC_WANT_IEC_60559_ATTRIBS_EXT__
-#endif
-/* Enable extensions specified by ISO/IEC TS 18661-1:2014.  */
-#ifndef __STDC_WANT_IEC_60559_BFP_EXT__
-# undef __STDC_WANT_IEC_60559_BFP_EXT__
-#endif
-/* Enable extensions specified by ISO/IEC TS 18661-2:2015.  */
-#ifndef __STDC_WANT_IEC_60559_DFP_EXT__
-# undef __STDC_WANT_IEC_60559_DFP_EXT__
-#endif
-/* Enable extensions specified by ISO/IEC TS 18661-4:2015.  */
-#ifndef __STDC_WANT_IEC_60559_FUNCS_EXT__
-# undef __STDC_WANT_IEC_60559_FUNCS_EXT__
-#endif
-/* Enable extensions specified by ISO/IEC TS 18661-3:2015.  */
-#ifndef __STDC_WANT_IEC_60559_TYPES_EXT__
-# undef __STDC_WANT_IEC_60559_TYPES_EXT__
-#endif
-/* Enable extensions specified by ISO/IEC TR 24731-2:2010.  */
-#ifndef __STDC_WANT_LIB_EXT2__
-# undef __STDC_WANT_LIB_EXT2__
-#endif
-/* Enable extensions specified by ISO/IEC 24747:2009.  */
-#ifndef __STDC_WANT_MATH_SPEC_FUNCS__
-# undef __STDC_WANT_MATH_SPEC_FUNCS__
-#endif
 /* Enable extensions on HP NonStop.  */
 #ifndef _TANDEM_SOURCE
 # undef _TANDEM_SOURCE
 #endif
-/* Enable X/Open extensions.  Define to 500 only if necessary
-   to make mbstate_t available.  */
-#ifndef _XOPEN_SOURCE
-# undef _XOPEN_SOURCE
+/* Enable general extensions on Solaris.  */
+#ifndef __EXTENSIONS__
+# undef __EXTENSIONS__
 #endif
 
 
@@ -1040,6 +966,11 @@
    `char[]'. */
 #undef YYTEXT_POINTER
 
+/* Enable large inode numbers on Mac OS X 10.5.  */
+#ifndef _DARWIN_USE_64_BIT_INODE
+# define _DARWIN_USE_64_BIT_INODE 1
+#endif
+
 /* Number of bits in a file offset, on hosts where this is settable. */
 #undef _FILE_OFFSET_BITS
 
@@ -1049,9 +980,19 @@
 /* Define for large files, on AIX-style hosts. */
 #undef _LARGE_FILES
 
+/* Define to 1 if on MINIX. */
+#undef _MINIX
+
 /* Enable for compile on Minix */
 #undef _NETBSD_SOURCE
 
+/* Define to 2 if the system does not provide POSIX.1 features except with
+   this defined. */
+#undef _POSIX_1_SOURCE
+
+/* Define to 1 if you need to in order for `stat' and other things to work. */
+#undef _POSIX_SOURCE
+
 /* defined to use gcc ansi snprintf and sscanf that understands %lld when
    compiled for windows. */
 #undef __USE_MINGW_ANSI_STDIO
@@ -1092,7 +1033,7 @@
 /* Define to `long int' if <sys/types.h> does not define. */
 #undef off_t
 
-/* Define as a signed integer type capable of holding a process identifier. */
+/* Define to `int' if <sys/types.h> does not define. */
 #undef pid_t
 
 /* Define to 'int' if not defined */

configure.ac

@@ -10,15 +10,15 @@ sinclude(dnscrypt/dnscrypt.m4)
 
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[19])
-m4_define([VERSION_MICRO],[3])
+m4_define([VERSION_MINOR],[18])
+m4_define([VERSION_MICRO],[1])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=26
+LIBUNBOUND_REVISION=23
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -108,10 +108,7 @@ LIBUNBOUND_AGE=1
 # 1.17.0 had 9:20:1
 # 1.17.1 had 9:21:1
 # 1.18.0 had 9:22:1
-# 1.19.0 had 9:23:1
-# 1.19.1 had 9:24:1
-# 1.19.2 had 9:25:1
-# 1.19.3 had 9:26:1
+# 1.18.1 had 9:23:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -409,7 +406,7 @@ AC_CHECK_TOOL(STRIP, strip)
 ACX_LIBTOOL_C_ONLY
 
 # pkg-config is only needed for these options, do not require it otherwise
-if test "$enable_systemd" = "yes" -o "$enable_dnstap" = "yes" -o "$with_pyunbound" = "yes" -o "$with_pythonmod" = "yes"; then
+if test "$enable_systemd" = "yes" -o "$with_pyunbound" = "yes" -o "$with_pythonmod" = "yes"; then
 PKG_PROG_PKG_CONFIG
 fi
 
@@ -1528,17 +1525,13 @@ if test x_$enable_static_exe = x_yes; then
 	if test "$on_mingw" = yes; then
 		staticexe="-all-static"
 		# for static compile, include gdi32 and zlib here.
-		if echo "$LIBS" | grep 'lgdi32' >/dev/null; then
+		if echo $LIBS | grep 'lgdi32' >/dev/null; then
 			:
 		else
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-			:
-		else
-			LIBS="$LIBS -l:libssp.a"
-		fi
+		LIBS="$LIBS -l:libssp.a"
 	fi
 fi
 
@@ -1555,11 +1548,7 @@ if test x_$enable_fully_static = x_yes; then
 			LIBS="$LIBS -lgdi32"
 		fi
 		AC_CHECK_LIB([z], [compress], [ LIBS="$LIBS -lz" ])
-		if echo "$LIBS" | grep -e "libssp.a" -e "lssp" >/dev/null; then
-			:
-		else
-			LIBS="$LIBS -l:libssp.a"
-		fi
+		LIBS="$LIBS -l:libssp.a"
 	fi
 fi
 
@@ -1579,11 +1568,7 @@ if test "$USE_WINSOCK" = 1; then
 #include <windows.h>
 	])
 	AC_CHECK_TOOL(WINDRES, windres)
-	if echo "$LIBS" | grep crypt32 >/dev/null; then
-		LIBS="$LIBS -liphlpapi"
-	else
-		LIBS="$LIBS -liphlpapi -lcrypt32"
-	fi
+	LIBS="$LIBS -liphlpapi -lcrypt32"
 	WINAPPS="unbound-service-install.exe unbound-service-remove.exe anchor-update.exe"
 	AC_SUBST(WINAPPS)
 	WIN_DAEMON_SRC="winrc/win_svc.c winrc/w_inst.c"

daemon/remote.c

@@ -553,7 +553,7 @@ ssl_print_text(RES* res, const char* text)
 static int
 ssl_print_vmsg(RES* ssl, const char* format, va_list args)
 {
-	char msg[65535];
+	char msg[1024];
 	vsnprintf(msg, sizeof(msg), format, args);
 	return ssl_print_text(ssl, msg);
 }
@@ -3181,10 +3181,10 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 		do_flush_bogus(ssl, worker);
 	} else if(cmdcmp(p, "flush_negative", 14)) {
 		do_flush_negative(ssl, worker);
-	} else if(cmdcmp(p, "rpz_enable", 10)) {
-		do_rpz_enable(ssl, worker, skipwhite(p+10));
-	} else if(cmdcmp(p, "rpz_disable", 11)) {
-		do_rpz_disable(ssl, worker, skipwhite(p+11));
+    } else if(cmdcmp(p, "rpz_enable", 10)) {
+        do_rpz_enable(ssl, worker, skipwhite(p+10));
+    } else if(cmdcmp(p, "rpz_disable", 11)) {
+        do_rpz_disable(ssl, worker, skipwhite(p+11));
 	} else {
 		(void)ssl_printf(ssl, "error unknown command '%s'\n", p);
 	}

daemon/worker.c

@@ -1151,7 +1151,7 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		log_assert(sldns_buffer_limit(c->buffer) >= LDNS_HEADER_SIZE
 			&& LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) == 1);
 
-		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE); /* skip header */
+		sldns_buffer_skip(c->buffer, LDNS_HEADER_SIZE); /* skip header */
 
 		/* check additional section is present and that we respond with EDEs */
 		if(LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) != 1
@@ -1163,7 +1163,6 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
 				LDNS_RCODE_REFUSED);
-			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
 			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
@@ -1327,6 +1326,15 @@ deny_refuse_non_local(struct comm_point* c, enum acl_access acl,
 		worker, repinfo, acladdr, ede, check_result);
 }
 
+/* Returns 1 if the ip rate limit check can happen before EDNS parsing,
+ * else 0 */
+static int
+pre_edns_ip_ratelimit_check(enum acl_access acl)
+{
+	if(acl == acl_allow_cookie) return 0;
+	return 1;
+}
+
 /* Check if the query is blocked by source IP rate limiting.
  * Returns 1 if it passes the check, 0 otherwise. */
 static int
@@ -1455,7 +1463,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	if(worker->dtenv.log_client_query_messages) {
 		log_addr(VERB_ALGO, "request from client", &repinfo->client_addr, repinfo->client_addrlen);
 		log_addr(VERB_ALGO, "to local addr", (void*)repinfo->c->socket->addr->ai_addr, repinfo->c->socket->addr->ai_addrlen);
-		dt_msg_send_client_query(&worker->dtenv, &repinfo->client_addr, (void*)repinfo->c->socket->addr->ai_addr, c->type, c->ssl, c->buffer,
+		dt_msg_send_client_query(&worker->dtenv, &repinfo->client_addr, (void*)repinfo->c->socket->addr->ai_addr, c->type, c->buffer,
 		((worker->env.cfg->sock_queue_timeout && timeval_isset(&c->recv_tv))?&c->recv_tv:NULL));
 	}
 #endif
@@ -1490,9 +1498,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}
 
 	worker->stats.num_queries++;
-	pre_edns_ip_ratelimit = !worker->env.cfg->do_answer_cookie
-		|| sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE
-		|| LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) == 0;
+	pre_edns_ip_ratelimit = pre_edns_ip_ratelimit_check(acl);
 
 	/* If the IP rate limiting check needs extra EDNS information (e.g.,
 	 * DNS Cookies) postpone the check until after EDNS is parsed. */
@@ -1946,7 +1952,7 @@ send_reply_rc:
 	if(worker->dtenv.log_client_response_messages) {
 		log_addr(VERB_ALGO, "from local addr", (void*)repinfo->c->socket->addr->ai_addr, repinfo->c->socket->addr->ai_addrlen);
 		log_addr(VERB_ALGO, "response to client", &repinfo->client_addr, repinfo->client_addrlen);
-		dt_msg_send_client_response(&worker->dtenv, &repinfo->client_addr, (void*)repinfo->c->socket->addr->ai_addr, c->type, c->ssl, c->buffer);
+		dt_msg_send_client_response(&worker->dtenv, &repinfo->client_addr, (void*)repinfo->c->socket->addr->ai_addr, c->type, c->buffer);
 	}
 #endif
 	if(worker->env.cfg->log_replies)
@@ -1960,15 +1966,11 @@ send_reply_rc:
 			qinfo.qname = qinfo.local_alias->rrset->rk.dname;
 			log_reply_info(NO_VERBOSE, &qinfo,
 				&repinfo->client_addr, repinfo->client_addrlen,
-				tv, 1, c->buffer,
-				(worker->env.cfg->log_destaddr?(void*)repinfo->c->socket->addr->ai_addr:NULL),
-				c->type);
+				tv, 1, c->buffer);
 		} else {
 			log_reply_info(NO_VERBOSE, &qinfo,
 				&repinfo->client_addr, repinfo->client_addrlen,
-				tv, 1, c->buffer,
-				(worker->env.cfg->log_destaddr?(void*)repinfo->c->socket->addr->ai_addr:NULL),
-				c->type);
+				tv, 1, c->buffer);
 		}
 	}
 #ifdef USE_DNSCRYPT

dnstap/dnstap.c

@@ -305,7 +305,6 @@ dt_msg_fill_net(struct dt_msg *dm,
 		struct sockaddr_storage *qs,
 		struct sockaddr_storage *rs,
 		enum comm_point_type cptype,
-		void *cpssl,
 		ProtobufCBinaryData *qaddr, protobuf_c_boolean *has_qaddr,
 		uint32_t *qport, protobuf_c_boolean *has_qport,
 		ProtobufCBinaryData *raddr, protobuf_c_boolean *has_raddr,
@@ -372,26 +371,13 @@ dt_msg_fill_net(struct dt_msg *dm,
                 *has_rport = 1;
         }
 
+	log_assert(cptype == comm_udp || cptype == comm_tcp);
 	if (cptype == comm_udp) {
 		/* socket_protocol */
 		dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__UDP;
 		dm->m.has_socket_protocol = 1;
 	} else if (cptype == comm_tcp) {
-		if (cpssl == NULL) {
-			/* socket_protocol */
-			dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP;
-			dm->m.has_socket_protocol = 1;
-		} else {
-			/* socket_protocol */
-			dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__DOT;
-			dm->m.has_socket_protocol = 1;
-		}
-	} else if (cptype == comm_http) {
 		/* socket_protocol */
-		dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__DOH;
-		dm->m.has_socket_protocol = 1;
-	} else {
-		/* other socket protocol */
 		dm->m.socket_protocol = DNSTAP__SOCKET_PROTOCOL__TCP;
 		dm->m.has_socket_protocol = 1;
 	}
@@ -402,7 +388,6 @@ dt_msg_send_client_query(struct dt_env *env,
 			 struct sockaddr_storage *qsock,
 			 struct sockaddr_storage *rsock,
 			 enum comm_point_type cptype,
-			 void *cpssl,
 			 sldns_buffer *qmsg,
 			 struct timeval* tstamp)
 {
@@ -425,7 +410,8 @@ dt_msg_send_client_query(struct dt_env *env,
 	dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);
 
 	/* socket_family, socket_protocol, query_address, query_port, response_address, response_port */
-	dt_msg_fill_net(&dm, qsock, rsock, cptype, cpssl,
+	log_assert(cptype == comm_udp || cptype == comm_tcp);
+	dt_msg_fill_net(&dm, qsock, rsock, cptype,
 			&dm.m.query_address, &dm.m.has_query_address,
 			&dm.m.query_port, &dm.m.has_query_port,
 			&dm.m.response_address, &dm.m.has_response_address,
@@ -441,7 +427,6 @@ dt_msg_send_client_response(struct dt_env *env,
 			    struct sockaddr_storage *qsock,
 			    struct sockaddr_storage *rsock,
 			    enum comm_point_type cptype,
-			    void *cpssl,
 			    sldns_buffer *rmsg)
 {
 	struct dt_msg dm;
@@ -461,7 +446,8 @@ dt_msg_send_client_response(struct dt_env *env,
 	dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);
 
 	/* socket_family, socket_protocol, query_address, query_port, response_address, response_port */
-	dt_msg_fill_net(&dm, qsock, rsock, cptype, cpssl,
+	log_assert(cptype == comm_udp || cptype == comm_tcp);
+	dt_msg_fill_net(&dm, qsock, rsock, cptype,
 			&dm.m.query_address, &dm.m.has_query_address,
 			&dm.m.query_port, &dm.m.has_query_port,
                         &dm.m.response_address, &dm.m.has_response_address,
@@ -476,7 +462,6 @@ dt_msg_send_outside_query(struct dt_env *env,
 			  struct sockaddr_storage *rsock,
 			  struct sockaddr_storage *qsock,
 			  enum comm_point_type cptype,
-			  void *cpssl,
 			  uint8_t *zone, size_t zone_len,
 			  sldns_buffer *qmsg)
 {
@@ -512,7 +497,8 @@ dt_msg_send_outside_query(struct dt_env *env,
 	dt_fill_buffer(qmsg, &dm.m.query_message, &dm.m.has_query_message);
 
 	/* socket_family, socket_protocol, response_address, response_port, query_address, query_port */
-	dt_msg_fill_net(&dm, rsock, qsock, cptype, cpssl,
+	log_assert(cptype == comm_udp || cptype == comm_tcp);
+	dt_msg_fill_net(&dm, rsock, qsock, cptype,
 			&dm.m.response_address, &dm.m.has_response_address,
 			&dm.m.response_port, &dm.m.has_response_port,
 			&dm.m.query_address, &dm.m.has_query_address,
@@ -527,7 +513,6 @@ dt_msg_send_outside_response(struct dt_env *env,
 	struct sockaddr_storage *rsock,
 	struct sockaddr_storage *qsock,
 	enum comm_point_type cptype,
-	void *cpssl,
 	uint8_t *zone, size_t zone_len,
 	uint8_t *qbuf, size_t qbuf_len,
 	const struct timeval *qtime,
@@ -571,7 +556,8 @@ dt_msg_send_outside_response(struct dt_env *env,
 	dt_fill_buffer(rmsg, &dm.m.response_message, &dm.m.has_response_message);
 
 	/* socket_family, socket_protocol, response_address, response_port, query_address, query_port */
-	dt_msg_fill_net(&dm, rsock, qsock, cptype, cpssl,
+	log_assert(cptype == comm_udp || cptype == comm_tcp);
+	dt_msg_fill_net(&dm, rsock, qsock, cptype,
 			&dm.m.response_address, &dm.m.has_response_address,
 			&dm.m.response_port, &dm.m.has_response_port,
 			&dm.m.query_address, &dm.m.has_query_address,

dnstap/dnstap.h

@@ -133,7 +133,6 @@ dt_msg_send_client_query(struct dt_env *env,
 			 struct sockaddr_storage *qsock,
 			 struct sockaddr_storage *rsock,
 			 enum comm_point_type cptype,
-			 void *cpssl,
 			 struct sldns_buffer *qmsg,
 			 struct timeval* tstamp);
 
@@ -150,7 +149,6 @@ dt_msg_send_client_response(struct dt_env *env,
 			    struct sockaddr_storage *qsock,
 			    struct sockaddr_storage *rsock,
 			    enum comm_point_type cptype,
-			    void *cpssl,
 			    struct sldns_buffer *rmsg);
 
 /**
@@ -170,7 +168,6 @@ dt_msg_send_outside_query(struct dt_env *env,
 			  struct sockaddr_storage *rsock,
 			  struct sockaddr_storage *qsock,
 			  enum comm_point_type cptype,
-			  void *cpssl,
 			  uint8_t *zone, size_t zone_len,
 			  struct sldns_buffer *qmsg);
 
@@ -195,7 +192,6 @@ dt_msg_send_outside_response(struct dt_env *env,
 			     struct sockaddr_storage *rsock,
 			     struct sockaddr_storage *qsock,
 			     enum comm_point_type cptype,
-			     void *cpssl,
 			     uint8_t *zone, size_t zone_len,
 			     uint8_t *qbuf, size_t qbuf_len,
 			     const struct timeval *qtime,

dnstap/dnstap.m4

@@ -5,76 +5,45 @@
 # Check for required dnstap libraries and add dnstap configure args.
 AC_DEFUN([dt_DNSTAP],
 [
-    AC_ARG_ENABLE([dnstap],
-        AS_HELP_STRING([--enable-dnstap],
-            [Enable dnstap support (requires protobuf-c)]),
-        [opt_dnstap=$enableval],
-        [opt_dnstap=no])
+  AC_ARG_ENABLE([dnstap],
+    AS_HELP_STRING([--enable-dnstap],
+                   [Enable dnstap support (requires protobuf-c)]),
+    [opt_dnstap=$enableval], [opt_dnstap=no])
 
-    AC_ARG_WITH([dnstap-socket-path],
-        AS_HELP_STRING([--with-dnstap-socket-path=pathname],
-            [set default dnstap socket path]),
-        [opt_dnstap_socket_path=$withval],
-        [opt_dnstap_socket_path="$1"])
+  AC_ARG_WITH([dnstap-socket-path],
+    AS_HELP_STRING([--with-dnstap-socket-path=pathname],
+                   [set default dnstap socket path]),
+    [opt_dnstap_socket_path=$withval], [opt_dnstap_socket_path="$1"])
 
-    if test "x$opt_dnstap" != "xno"; then
-        AC_PATH_PROG([PROTOC_C], [protoc-c])
-        if test -z "$PROTOC_C"; then
-          AC_MSG_ERROR([The protoc-c program was not found. Please install protobuf-c!])
-        fi
-        AC_ARG_WITH([protobuf-c],
-            AS_HELP_STRING([--with-protobuf-c=path], [Path where protobuf-c is installed, for dnstap]),
-            [
-                # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                if test -f $withval/include/google/protobuf-c/protobuf-c.h; then
-                    CFLAGS="$CFLAGS -I$withval/include/google"
-                else
-                    CFLAGS="$CFLAGS -I$withval/include"
-                fi
-                LDFLAGS="$LDFLAGS -L$withval/lib"
-            ],
-            [
-                ifdef([PKG_CHECK_MODULES],
-                    [
-                        PKG_CHECK_MODULES([PROTOBUFC], [libprotobuf-c],
-                            [
-                                CFLAGS="$CFLAGS $PROTOBUFC_CFLAGS"
-                                LIBS="$LIBS $PROTOBUFC_LIBS"
-                            ],
-                            [
-                                # pkg-config failed; try falling back to known values
-                                # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                                if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
-                                    CFLAGS="$CFLAGS -I/usr/include/google"
-                                else
-                                    if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
-                                        CFLAGS="$CFLAGS -I/usr/local/include/google"
-                                        LDFLAGS="$LDFLAGS -L/usr/local/lib"
-                                    else
-                                        AC_MSG_ERROR([The protobuf-c package was not found with pkg-config. Please install protobuf-c!])
-                                    fi
-                                fi
-                            ]
-                        )
-                    ],
-                    [
-                        # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                        if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
-                            CFLAGS="$CFLAGS -I/usr/include/google"
-                        else
-                            if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
-                                CFLAGS="$CFLAGS -I/usr/local/include/google"
-                                LDFLAGS="$LDFLAGS -L/usr/local/lib"
-                            fi
-                        fi
-                    ]
-                )
-            ]
-        )
-        AC_SEARCH_LIBS([protobuf_c_message_pack], [protobuf-c], [],
-            AC_MSG_ERROR([The protobuf-c library was not found. Please install the development libraries for protobuf-c!]))
-        $2
-    else
-        $3
+  if test "x$opt_dnstap" != "xno"; then
+    AC_PATH_PROG([PROTOC_C], [protoc-c])
+    if test -z "$PROTOC_C"; then
+      AC_MSG_ERROR([The protoc-c program was not found. Please install protobuf-c!])
     fi
+    AC_ARG_WITH([protobuf-c], AS_HELP_STRING([--with-protobuf-c=path],
+    	[Path where protobuf-c is installed, for dnstap]), [
+	  # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+	  if test -f $withval/include/google/protobuf-c/protobuf-c.h; then
+	    CFLAGS="$CFLAGS -I$withval/include/google"
+	  else
+	    CFLAGS="$CFLAGS -I$withval/include"
+	  fi
+	  LDFLAGS="$LDFLAGS -L$withval/lib"
+	], [
+	  # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+	  if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
+	    CFLAGS="$CFLAGS -I/usr/include/google"
+	  else
+	    if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
+	      CFLAGS="$CFLAGS -I/usr/local/include/google"
+	      LDFLAGS="$LDFLAGS -L/usr/local/lib"
+	    fi
+	  fi
+    ])
+    AC_SEARCH_LIBS([protobuf_c_message_pack], [protobuf-c], [],
+      AC_MSG_ERROR([The protobuf-c library was not found. Please install protobuf-c!]))
+    $2
+  else
+    $3
+  fi
 ])

dnstap/dnstap.proto

@@ -13,8 +13,8 @@
 // with this file. If not, see:
 //
 // <http://creativecommons.org/publicdomain/zero/1.0/>.
-
 syntax = "proto2";
+
 package dnstap;
 
 // "Dnstap": this is the top-level dnstap type, which is a "union" type that
@@ -56,60 +56,11 @@ enum SocketFamily {
     INET6 = 2;  // IPv6 (RFC 2460)
 }
 
-// SocketProtocol: the protocol used to transport a DNS message.
+// SocketProtocol: the transport protocol of a socket. This specifies how to
+// interpret "transport port" fields.
 enum SocketProtocol {
-    UDP = 1;         // DNS over UDP transport (RFC 1035 section 4.2.1)
-    TCP = 2;         // DNS over TCP transport (RFC 1035 section 4.2.2)
-    DOT = 3;         // DNS over TLS (RFC 7858)
-    DOH = 4;         // DNS over HTTPS (RFC 8484)
-    DNSCryptUDP = 5; // DNSCrypt over UDP (https://dnscrypt.info/protocol)
-    DNSCryptTCP = 6; // DNSCrypt over TCP (https://dnscrypt.info/protocol)
-    DOQ = 7;         // DNS over QUIC (RFC 9250)
-}
-
-// Policy: information about any name server operator policy
-// applied to the processing of a DNS message.
-message Policy {
-
-    // Match: what aspect of the message or message exchange
-    // triggered the application of the Policy.
-    enum Match {
-        QNAME = 1;       // Name in question section of query
-        CLIENT_IP = 2;   // Client IP address
-        RESPONSE_IP = 3; // Address in A/AAAA RRSet
-        NS_NAME = 4;     // Authoritative name server, by name
-        NS_IP = 5;       // Authoritative name server, by IP address
-    }
-
-    // The Action taken to implement the Policy.
-    enum Action {
-        NXDOMAIN = 1;   // Respond with NXDOMAIN
-        NODATA = 2;     // Respond with empty answer section
-        PASS = 3;       // Do not alter the response (passthrough)
-        DROP = 4;       // Do not respond.
-        TRUNCATE = 5;   // Truncate UDP response, forcing TCP retry
-        LOCAL_DATA = 6; // Respond with local data from policy
-    }
-
-    // type: the type of policy applied, e.g. "RPZ" for a
-    // policy from a Response Policy Zone.
-    optional string type = 1;
-
-    // rule: the rule matched by the message.
-    //
-    // In a RPZ context, this is the owner name of the rule in
-    // the Reponse Policy Zone in wire format.
-    optional bytes rule = 2;
-
-    // action: the policy action taken in response to the
-    // rule match.
-    optional Action action = 3;
-
-    // match: the feature of the message exchange which matched the rule.
-    optional Match match = 4;
-
-    // The matched value. Format depends on the matched feature .
-    optional bytes value = 5;
+    UDP = 1;    // User Datagram Protocol (RFC 768)
+    TCP = 2;    // Transmission Control Protocol (RFC 793)
 }
 
 // Message: a wire-format (RFC 1035 section 4) DNS message and associated
@@ -207,24 +158,6 @@ message Message {
         // STUB_RESPONSE is a DNS response message sent from a DNS server to a
         // stub resolver, from the perspective of the stub resolver.
         STUB_RESPONSE = 10;
-
-        // TOOL_QUERY is a DNS query message sent from a DNS software tool to a
-        // DNS server, from the perspective of the tool.
-        TOOL_QUERY = 11;
-
-        // TOOL_RESPONSE is a DNS response message received by a DNS software
-        // tool from a DNS server, from the perspective of the tool.
-        TOOL_RESPONSE = 12;
-
-        // UPDATE_QUERY is a Dynamic DNS Update request (RFC 2136) received
-        // by an authoritative name server, from the perspective of the
-        // authoritative name server.
-        UPDATE_QUERY = 13;
-
-        // UPDATE_RESPONSE is a Dynamic DNS Update response (RFC 2136) sent
-        // from an authoritative name server, from the perspective of the
-        // authoritative name server.
-        UPDATE_RESPONSE = 14;
     }
 
     // One of the Type values described above.
@@ -282,9 +215,6 @@ message Message {
 
     // The responder's original wire-format DNS response message, verbatim.
     optional bytes              response_message = 14;
-
-    // Operator policy applied to the processing of this message, if any.
-    optional Policy             policy = 15;
 }
 
 // All fields except for 'type' in the Message schema are optional.
@@ -306,6 +236,7 @@ message Message {
 
 // RESOLVER_QUERY:
 //      socket_family, socket_protocol
+//      query_name, query_type, query_class
 //      query_message
 //      query_time_sec, query_time_nsec
 //      query_zone
@@ -313,6 +244,7 @@ message Message {
 
 // RESOLVER_RESPONSE:
 //      socket_family, socket_protocol
+//      query_name, query_type, query_class
 //      query_time_sec, query_time_nsec
 //      query_zone
 //      response_address, response_port

doc/Changelog

@@ -1,175 +1,3 @@
-8 March 2024: Wouter
-	- Fix unbound-control-setup.cmd to use 3072 bits so that certificates
-	  are long enough for newer OpenSSL versions.
-	- Fix TTL of synthesized CNAME when a DNAME is used from cache.
-	- Fix unbound-control-setup.cmd to have CA v3 basicConstraints,
-	  like unbound-control-setup.sh has.
-
-7 March 2024: Wouter
-	- Version set to 1.19.3 for release. After 1.19.2 point release with
-	  security fix for CVE-2024-1931, Denial of service when trimming
-	  EDE text on positive replies. The code repo includes the fix and
-	  is for version 1.19.3.
-
-5 March 2024: Wouter
-	- Fix for #1022: Fix ede prohibited in access control refused answers.
-
-4 March 2024: Wouter
-	- Fix edns subnet replies for scope zero answers to not get stored
-	  in the global cache, and in cachedb, when the upstream replies
-	  without an EDNS record.
-
-28 February 2024: Wouter
-	- Move github workflows to use checkoutv4.
-
-23 February 2024: Yorgos
-	- Document the suspend argument for process_ds_response().
-
-22 February 2024: Wouter
-	- Fix trim of EDE text from large udp responses from spinning cpu.
-
-20 February 2024: Yorgos
-	- Merge #1010: Mention REFUSED has the TC bit set with unmatched
-	  allow_cookie acl in the manpage. It also fixes the code to match the
-	  documentation about clients with a valid cookie that bypass the
-	  ratelimit regardless of the allow_cookie acl.
-
-13 February 2024: Wouter
-	- Fix CVE-2023-50387, DNSSEC verification complexity can be exploited
-	  to exhaust CPU resources and stall DNS resolvers.
-	- Fix CVE-2023-50868, NSEC3 closest encloser proof can exhaust CPU.
-	- These fixes are part of the 1.19.1 release, that is a security
-	  point release on 1.19.0, the code repository continues with these
-	  fixes, with version number 1.19.2.
-
-8 February 2024: Wouter
-	- Fix documentation for access-control in the unbound.conf man page.
-
-7 February 2024: Yorgos
-	- Fix #1006: Can't find protobuf-c package since #999.
-
-30 January 2024: Wouter
-	- Merge #999: Search for protobuf-c with pkg-config.
-
-23 January 2024: Yorgos
-	- Update message TTL when using cached RRSETs. It could result in
-	  non-expired messages with expired RRSETs (non-usable messages by
-	  Unbound).
-
-22 January 2024: Yorgos
-	- Update error printout for duplicate trust anchors to include the
-	  trust anchor name (relates to #920).
-
-22 January 2024: Wouter
-	- Fix for #997: Print details for SSL certificate failure.
-
-17 January 2024: Wouter
-	- Update workflow for ports to use newer openssl on windows compile.
-	- Fix warning for windres on resource files due to redefinition.
-
-16 January 2024: Wouter
-	- Fix to link with libssp for libcrypto and getaddrinfo check for
-	  only header. Also update crosscompile to remove ssp for 32bit.
-	- Merge #993: Update b.root-servers.net also in example config file.
-
-15 January 2024: Wouter
-	- Fix to link with -lcrypt32 for OpenSSL 3.2.0 on Windows.
-
-9 January 2024: Wouter
-	- Merge #988: Fix NLnetLabs#981: dump_cache truncates large records.
-
-5 January 2024: Wouter
-	- Merge #987: skip edns frag retry if advertised udp payload size is
-	  not smaller.
-	- Fix unit test for #987 change in udp1xxx retry packet send.
-
-4 January 2024: Wouter
-	- Remove unneeded newlines and improve indentation in remote control
-	  code.
-
-3 January 2024: Wouter
-	- Merge #980: DoH: reject non-h2 early. To fix #979: Improve errors
-	  for non-HTTP/2 DoH clients.
-	- Merge #985: Add DoH and DoT to dnstap message.
-	- Fix #983: Sha1 runtime insecure change was incomplete.
-
-22 December 2023: Yorgos
-	- Update example.conf with cookie options.
-
-8 December 2023: Yorgos
-	- Merge PR #973: Use the origin (DNAME) TTL for synthesized CNAMEs as
-	  per RFC 6672.
-
-8 December 2023: Wouter
-	- Fix root_zonemd unit test, it checks that the root ZONEMD verifies,
-	  now that the root has a valid ZONEMD.
-
-7 December 2023: Wouter
-	- Fix #974: doc: default number of outgoing ports without libevent.
-	- Merge #975: Fixed some syntax errors in rpl files.
-
-6 December 2023: Wouter
-	- Fix to sync the tests script file common.sh.
-	- iana portlist update.
-	- Updated IPv4 and IPv6 address for b.root-servers.net in root hints.
-	- Update test script file common.sh.
-	- Fix tests to use new common.sh functions, wait_logfile and
-	  kill_from_pidfile.
-
-5 December 2023: Wouter
-	- Merge #971: fix 'WARNING: Message has 41 extra bytes at end'.
-	- Fix #969: [FR] distinguish Do53, DoT and DoH in the logs.
-	- Fix dnstap that assertion failed on logging other than UDP and TCP
-	  traffic. It lists it as TCP traffic.
-
-27 November 2023: Yorgos
-	- Merge #968: Replace the obsolescent fgrep with grep -F in tests.
-
-27 November 2023: Wouter
-	- Fix #964: config.h.in~ backup file in release tar balls.
-
-24 November 2023: Yorgos
-	- Use 127.0.0.1 explicitly in tests to avoid delays and errors on
-	  newer systems.
-
-9 November 2023: Wouter
-	- Fix unit test parse of origin syntax.
-
-2 November 2023: Wouter
-	- Set version number to 1.19.0.
-	- Tag for 1.19.0rc1 release. It became 1.19.0 release on 8 nov 2023.
-	  The repository continues with 1.19.1.
-
-1 November 2023: George
-	- Mention flex and bison in README.md when building from repository
-	  source.
-
-1 November 2023: Wouter
-	- Fix SSL compile failure for definition in log_crypto_err_io_code_arg.
-	- Fix SSL compile failure for other missing definitions in
-	  log_crypto_err_io_code_arg.
-	- Fix compilation without openssl, remove unused function warning.
-
-31 October 2023: George
-	- Fix #941: dnscrypt doesn't work after upgrade to 1.18 with
-	  suggestion by dukeartem to also fix the udp_ancil with dnscrypt.
-
-30 October 2023: George
-	- Merge #930 from Stuart Henderson: add void to
-	  log_ident_revert_to_default declaration.
-
-30 October 2023: Wouter
-	- autoconf.
-
-24 October 2023: George
-	- Clearer configure text for missing protobuf-c development libraries.
-
-20 October 2023: Wouter
-	- Merge #951: Cachedb no store. The cachedb-no-store: yes option is
-	  used to stop cachedb from writing messages to the backend storage.
-	  It reads messages when data is available from the backend. The
-	  default is no.
-
 19 October 2023: Wouter
 	- Fix to print detailed errors when an SSL IO routine fails via
 	  SSL_get_error.
@@ -5037,7 +4865,7 @@
 	- Fix that with openssl 1.1 control-use-cert: no uses less cpu, by
 	  using no encryption over the unix socket.
 
-22 November 2016: Ralph
+22 Novenber 2016: Ralph
 	- Make access-control-tag-data RDATA absolute. This makes the RDATA
 	  origin consistent between local-data and access-control-tag-data.
 	- Fix NSEC ENT wildcard check. Matching wildcard does not have to be a

doc/README

@@ -19,10 +19,11 @@ The DNSTAP code has BSD license in dnstap/dnstap.c.
 * Make and install: ./configure; make; make install
   * --with-libevent=/path/to/libevent
   	Can be set to either the system install or the build directory.
-	--with-libevent=no gives a builtin alternative implementation.
-	Libevent is enabled by default, it is useful when having many
-	(thousands) of outgoing ports. This improves randomization and spoof
-	resistance. It also allows a higher number of outgoing queries.
+	--with-libevent=no (default) gives a builtin alternative 
+	implementation. libevent is useful when having many (thousands) 
+	of outgoing ports. This improves randomization and spoof 
+	resistance. For the default of 16 ports the builtin alternative 
+	works well and is a little faster.
   * --with-libexpat=/path/to/libexpat
   	Can be set to the install directory of libexpat.
   * --without-pthreads 

doc/example.conf.in

@@ -303,7 +303,6 @@ server:
 	# Choose deny (drop message), refuse (polite error reply),
 	# allow (recursive ok), allow_setrd (recursive ok, rd bit is forced on),
 	# allow_snoop (recursive and nonrecursive ok)
-	# allow_cookie (allow UDP with valid cookie or stateful transport)
 	# deny_non_local (drop queries unless can be answered from local-data)
 	# refuse_non_local (like deny_non_local but polite error reply).
 	# access-control: 127.0.0.0/8 allow
@@ -442,9 +441,6 @@ server:
 	# filtering log-queries and log-replies from the log.
 	# log-tag-queryreply: no
 
-	# log with destination address, port and type for log-replies.
-	# log-destaddr: no
-
 	# log the local-zone actions, like local-zone type inform is enabled
 	# also for the other local zone types.
 	# log-local-actions: no
@@ -987,13 +983,6 @@ server:
 	# if 0(default) it is disabled, otherwise states qps allowed per ip address
 	# ip-ratelimit: 0
 
-	# global query ratelimit for all ip addresses with a valid DNS Cookie.
-	# feature is experimental.
-	# if 0(default) it is disabled, otherwise states qps allowed per ip address
-	# useful in combination with 'allow_cookie'.
-	# If used, suggested to be higher than ip-ratelimit, tenfold.
-	# ip-ratelimit-cookie: 0
-
 	# ip ratelimits are tracked in a cache, size in bytes of cache (or k,m).
 	# ip-ratelimit-size: 4m
 	# ip ratelimit cache slabs, reduces lock contention if equal to cpucount.
@@ -1015,14 +1004,6 @@ server:
 	# the number of servers that will be used in the fast server selection.
 	# fast-server-num: 3
 
-	# reply to requests containing DNS Cookies as specified in RFC 7873 and RFC 9018.
-	# answer-cookie: no
-
-	# secret for DNS Cookie generation.
-	# useful for anycast deployments.
-	# example value "000102030405060708090a0b0c0d0e0f".
-	# cookie-secret: <128 bit random hex string>
-
 	# Enable to attach Extended DNS Error codes (RFC8914) to responses.
 	# ede: no
 
@@ -1169,7 +1150,7 @@ remote-control:
 # sources of notifies.
 # auth-zone:
 #	name: "."
-#	primary: 170.247.170.2        # b.root-servers.net
+#	primary: 199.9.14.201         # b.root-servers.net
 #	primary: 192.33.4.12          # c.root-servers.net
 #	primary: 199.7.91.13          # d.root-servers.net
 #	primary: 192.5.5.241          # f.root-servers.net
@@ -1177,7 +1158,7 @@ remote-control:
 #	primary: 193.0.14.129         # k.root-servers.net
 #	primary: 192.0.47.132         # xfr.cjr.dns.icann.org
 #	primary: 192.0.32.132         # xfr.lax.dns.icann.org
-#	primary: 2801:1b8:10::b       # b.root-servers.net
+#	primary: 2001:500:200::b      # b.root-servers.net
 #	primary: 2001:500:2::c        # c.root-servers.net
 #	primary: 2001:500:2d::d       # d.root-servers.net
 #	primary: 2001:500:2f::f       # f.root-servers.net
@@ -1245,8 +1226,6 @@ remote-control:
 #     backend: "testframe"
 #     # secret seed string to calculate hashed keys
 #     secret-seed: "default"
-#     # if the backend should be read from, but not written to.
-#     cachedb-no-store: no
 #
 #     # For "redis" backend:
 #     # (to enable, use --with-libhiredis to configure before compiling)

doc/unbound.conf.5.in

@@ -699,12 +699,6 @@ When at the limit, further connections are accepted but closed immediately.
 This option is experimental at this time.
 .TP
 .B access\-control: \fI<IP netblock> <action>
-Specify treatment of incoming queries from their originating IP address.
-Queries can be allowed to have access to this server that gives DNS
-answers, or refused, with other actions possible. The IP address range
-can be specified as a netblock, it is possible to give the statement
-several times in order to specify the treatment of different netblocks.
-.IP
 The netblock is given as an IP4 or IP6 address with /size appended for a
 classless network block. The action can be \fIdeny\fR, \fIrefuse\fR,
 \fIallow\fR, \fIallow_setrd\fR, \fIallow_snoop\fR, \fIallow_cookie\fR,
@@ -744,7 +738,7 @@ the cache contents (for malicious acts).  However, nonrecursive queries can
 also be a valuable debugging tool (when you want to examine the cache
 contents). In that case use \fIallow_snoop\fR for your administration host.
 .IP
-The \fIallow_cookie\fR action allows access only to UDP queries that contain a
+The \fIallow_cookie\fR action allows access to UDP queries that contain a
 valid DNS Cookie as specified in RFC 7873 and RFC 9018, when the
 \fBanswer\-cookie\fR option is enabled.
 UDP queries containing only a DNS Client Cookie and no Server Cookie, or an
@@ -753,8 +747,10 @@ generated DNS Cookie, allowing clients to retry with that DNS Cookie.
 The \fIallow_cookie\fR action will also accept requests over stateful
 transports, regardless of the presence of an DNS Cookie and regardless of the
 \fBanswer\-cookie\fR setting.
-UDP queries without a DNS Cookie receive REFUSED responses with the TC flag set,
-that may trigger fall back to TCP for those clients.
+If \fBip\-ratelimit\fR is used, clients with a valid DNS Cookie will bypass the
+ratelimit.
+If a ratelimit for such clients is still needed, \fBip\-ratelimit\-cookie\fR
+can be used instead.
 .IP
 By default only localhost is \fIallow\fRed, the rest is \fIrefuse\fRd.
 The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS
@@ -917,11 +913,6 @@ Prints the word 'query' and 'reply' with log\-queries and log\-replies.
 This makes filtering logs easier.  The default is off (for backwards
 compatibility).
 .TP
-.B log\-destaddr: \fI<yes or no>
-Prints the destination address, port and type in the log\-replies output.
-This disambiguates what type of traffic, eg. udp or tcp, and to what local
-port the traffic was sent to.
-.TP
 .B log\-local\-actions: \fI<yes or no>
 Print log lines to inform about local zone actions.  These lines are like the
 local\-zone type inform prints out, but they are also printed for the other
@@ -1848,9 +1839,6 @@ The ratelimit is in queries per second that are allowed.  More queries are
 completely dropped and will not receive a reply, SERVFAIL or otherwise.
 IP ratelimiting happens before looking in the cache. This may be useful for
 mitigating amplification attacks.
-Clients with a valid DNS Cookie will bypass the ratelimit.
-If a ratelimit for such clients is still needed, \fBip\-ratelimit\-cookie\fR
-can be used instead.
 Default is 0 (disabled).
 .TP 5
 .B ip\-ratelimit\-cookie: \fI<number or 0>
@@ -2693,11 +2681,6 @@ operationally.
 If the backend database is shared by multiple Unbound instances,
 all instances must use the same secret seed.
 This option defaults to "default".
-.TP
-.B cachedb-no-store: \fI<yes or no>\fR
-If the backend should be read from, but not written to. This makes this
-instance not store dns messages in the backend. But if data is available it
-is retrieved. The default is no.
 .P
 The following
 .B cachedb

iterator/iter_fwd.c

@@ -523,3 +523,4 @@ forwards_delete_stub_hole(struct iter_forwards* fwd, uint16_t c, uint8_t* nm)
 	fwd_zone_free(z);
 	fwd_init_parents(fwd);
 }
+

iterator/iter_hints.c

@@ -129,7 +129,7 @@ compile_time_root_prime(int do_ip4, int do_ip6)
 	dp->has_parent_side_NS = 1;
       if(do_ip4) {
 	if(!ah(dp, "A.ROOT-SERVERS.NET.", "198.41.0.4"))	goto failed;
-	if(!ah(dp, "B.ROOT-SERVERS.NET.", "170.247.170.2"))	goto failed;
+	if(!ah(dp, "B.ROOT-SERVERS.NET.", "199.9.14.201")) goto failed;
 	if(!ah(dp, "C.ROOT-SERVERS.NET.", "192.33.4.12"))	goto failed;
 	if(!ah(dp, "D.ROOT-SERVERS.NET.", "199.7.91.13"))	goto failed;
 	if(!ah(dp, "E.ROOT-SERVERS.NET.", "192.203.230.10")) goto failed;
@@ -144,7 +144,7 @@ compile_time_root_prime(int do_ip4, int do_ip6)
       }
       if(do_ip6) {
 	if(!ah(dp, "A.ROOT-SERVERS.NET.", "2001:503:ba3e::2:30")) goto failed;
-	if(!ah(dp, "B.ROOT-SERVERS.NET.", "2801:1b8:10::b")) goto failed;
+	if(!ah(dp, "B.ROOT-SERVERS.NET.", "2001:500:200::b")) goto failed;
 	if(!ah(dp, "C.ROOT-SERVERS.NET.", "2001:500:2::c")) goto failed;
 	if(!ah(dp, "D.ROOT-SERVERS.NET.", "2001:500:2d::d")) goto failed;
 	if(!ah(dp, "E.ROOT-SERVERS.NET.", "2001:500:a8::e")) goto failed;
@@ -560,3 +560,4 @@ hints_delete_stub(struct iter_hints* hints, uint16_t c, uint8_t* nm)
 	hints_stub_free(z);
 	name_tree_init_parents(&hints->tree);
 }
+

iterator/iter_scrub.c

@@ -283,8 +283,7 @@ synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 		sizeof(uint32_t)+sizeof(uint16_t)+aliaslen);
 	if(!cn->rr_first->ttl_data)
 		return NULL;
-	memmove(cn->rr_first->ttl_data, rrset->rr_first->ttl_data,
-		sizeof(uint32_t)); /* RFC6672: synth CNAME TTL == DNAME TTL */
+	sldns_write_uint32(cn->rr_first->ttl_data, 0); /* TTL = 0 */
 	sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
 	memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
 	cn->rr_first->size = sizeof(uint16_t)+aliaslen;

iterator/iterator.c

@@ -4151,10 +4151,10 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* like packet got dropped */
 			goto handle_it;
 		}
-	}
-	if(!inplace_cb_edns_back_parsed_call(qstate->env, qstate)) {
-		log_err("unable to call edns_back_parsed callback");
-		goto handle_it;
+		if(!inplace_cb_edns_back_parsed_call(qstate->env, qstate)) {
+			log_err("unable to call edns_back_parsed callback");
+			goto handle_it;
+		}
 	}
 
 	/* remove CD-bit, we asked for in case we handle validation ourself */

makedist.sh

@@ -267,10 +267,10 @@ if [ "$DOWIN" = "yes" ]; then
 		# cross-compilation and it is not used anyway
 		# before 1.0.1i need --cross-compile-prefix=i686-w64-mingw32-
 		if test "$mw64" = "mingw64"; then
-			sslflags="no-asm no-tests -DOPENSSL_NO_CAPIENG mingw64"
+			sslflags="no-asm -DOPENSSL_NO_CAPIENG mingw64"
 			sspdll="/usr/x86_64-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
 		else
-			sslflags="no-asm no-tests -DOPENSSL_NO_CAPIENG mingw"
+			sslflags="no-asm -DOPENSSL_NO_CAPIENG mingw"
 			sspdll="/usr/i686-w64-mingw32/sys-root/mingw/bin/libssp-0.dll"
 		fi
 		if test -f "$sspdll"; then
@@ -282,18 +282,9 @@ if [ "$DOWIN" = "yes" ]; then
 			SSPLIB=""
 		fi
 		info "winssl: Configure no-shared $sslflags"
-		if test "$W64" = "no"; then
-			# Disable stack-protector for 32-bit windows builds.
-			# mingw passes an LDFLAGS, so there is something
-			# passed in the LDFLAGS to stop -lssp passed in it.
-			set -x # echo the configure command
-			__CNF_LDLIBS=$SSPLIB __CNF_LDFLAGS="-fno-stack-protector" CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib WINDRES=${warch}-w64-mingw32-windres ./Configure --prefix="$sslinstall" no-shared $sslflags || error_cleanup "OpenSSL Configure failed"
-			set +x
-		else
-			set -x # echo the configure command
-			__CNF_LDLIBS=$SSPLIB CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib WINDRES=${warch}-w64-mingw32-windres ./Configure --prefix="$sslinstall" no-shared $sslflags || error_cleanup "OpenSSL Configure failed"
-			set +x
-		fi
+		set -x # echo the configure command
+		__CNF_LDLIBS=$SSPLIB CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib WINDRES=${warch}-w64-mingw32-windres ./Configure --prefix="$sslinstall" no-shared $sslflags || error_cleanup "OpenSSL Configure failed"
+		set +x
 		info "winssl: make"
 		make $MINJ || error_cleanup "OpenSSL crosscompile failed"
 		# only install sw not docs, which take a long time.
@@ -306,15 +297,9 @@ if [ "$DOWIN" = "yes" ]; then
 		sslsharedinstall="`pwd`/sslsharedinstall"
 		cd openssl_shared
 		info "winssl: Configure shared $sslflags"
-		if test "$W64" = "no"; then
-			set -x # echo the configure command
-			__CNF_LDLIBS=$SSPLIB __CNF_LDFLAGS="-fno-stack-protector" CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib WINDRES=${warch}-w64-mingw32-windres ./Configure --prefix="$sslsharedinstall" shared $sslflags || error_cleanup "OpenSSL Configure failed"
-			set +x
-		else
-			set -x # echo the configure command
-			__CNF_LDLIBS=$SSPLIB CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib WINDRES=${warch}-w64-mingw32-windres ./Configure --prefix="$sslsharedinstall" shared $sslflags || error_cleanup "OpenSSL Configure failed"
-			set +x
-		fi
+		set -x # echo the configure command
+		__CNF_LDLIBS=$SSPLIB CC=${warch}-w64-mingw32-gcc AR=${warch}-w64-mingw32-ar RANLIB=${warch}-w64-mingw32-ranlib WINDRES=${warch}-w64-mingw32-windres ./Configure --prefix="$sslsharedinstall" shared $sslflags || error_cleanup "OpenSSL Configure failed"
+		set +x
 		info "winssl: make"
 		make $MINJ || error_cleanup "OpenSSL crosscompile failed"
 		info "winssl: make install_sw"
@@ -330,16 +315,7 @@ if [ "$DOWIN" = "yes" ]; then
 		wxpinstall="`pwd`/wxpinstall"
 		cd expat-* || error_cleanup "no expat-X dir in tarball"
 		info "wxp: configure"
-		if test "$W64" = "no"; then
-			# Disable stack-protector for 32-bit windows builds.
-			set -x # echo the configure command
-			$configure --prefix="$wxpinstall" --exec-prefix="$wxpinstall" --bindir="$wxpinstall/bin" --includedir="$wxpinstall/include" --mandir="$wxpinstall/man" --libdir="$wxpinstall/lib" LDFLAGS="-fno-stack-protector" || error_cleanup "libexpat configure failed"
-			set +x
-		else
-			set -x # echo the configure command
-			$configure --prefix="$wxpinstall" --exec-prefix="$wxpinstall" --bindir="$wxpinstall/bin" --includedir="$wxpinstall/include" --mandir="$wxpinstall/man" --libdir="$wxpinstall/lib"  || error_cleanup "libexpat configure failed"
-			set +x
-		fi
+		$configure --prefix="$wxpinstall" --exec-prefix="$wxpinstall" --bindir="$wxpinstall/bin" --includedir="$wxpinstall/include" --mandir="$wxpinstall/man" --libdir="$wxpinstall/lib"  || error_cleanup "libexpat configure failed"
 		info "wxp: make"
 		make $MINJ || error_cleanup "libexpat crosscompile failed"
 		info "wxp: make install"
@@ -385,7 +361,6 @@ if [ "$DOWIN" = "yes" ]; then
 	autoconf -f || error_cleanup "Autoconf failed."
 	autoheader -f || error_cleanup "Autoheader failed."
     	rm -r autom4te* || echo "ignored"
-	rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
     fi
 
     if test "`uname`" = "Linux"; then 
@@ -403,8 +378,8 @@ if [ "$DOWIN" = "yes" ]; then
     fi
     if test "$W64" = "no"; then
 		# Disable stack-protector for 32-bit windows builds.
-		echo "$configure"' --enable-debug --enable-static-exe --disable-flto --disable-gost '"$* $cross_flag" "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector' LDFLAGS="-fno-stack-protector"
-		$configure --enable-debug --enable-static-exe --disable-flto --disable-gost $* $cross_flag "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector' LDFLAGS="-fno-stack-protector" \
+		echo "$configure"' --enable-debug --enable-static-exe --disable-flto --disable-gost '"$* $cross_flag" "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector'
+		$configure --enable-debug --enable-static-exe --disable-flto --disable-gost $* $cross_flag "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector'\
 		|| error_cleanup "Could not configure"
     else
 		echo "$configure"' --enable-debug --enable-static-exe --disable-flto --disable-gost '"$* $cross_flag"
@@ -420,8 +395,8 @@ if [ "$DOWIN" = "yes" ]; then
     cd ../unbound_shared
     if test "$W64" = "no"; then
 	# Disable stack-protector for 32-bit windows builds.
-		echo "$configure"' --enable-debug --disable-flto --disable-gost '"$* $shared_cross_flag" "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector' LDFLAGS="-fno-stack-protector"
-		$configure --enable-debug --disable-flto --disable-gost $* $shared_cross_flag "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector' LDFLAGS="-fno-stack-protector" \
+		echo "$configure"' --enable-debug --disable-flto --disable-gost '"$* $shared_cross_flag" "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector'
+		$configure --enable-debug --disable-flto --disable-gost $* $shared_cross_flag "$file_flag" "$file2_flag" "$file3_flag" CFLAGS='-O2 -g -fno-stack-protector'\
 		|| error_cleanup "Could not configure"
     else
 		echo "$configure"' --enable-debug --disable-flto --disable-gost '"$* $shared_cross_flag"
@@ -539,7 +514,6 @@ info "Building configure script (autoreconf)."
 autoreconf -f || error_cleanup "Autoconf failed."
 
 rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
-rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 
 info "Building lexer and parser."
 echo "#include \"config.h\"" > util/configlexer.c || error_cleanup "Failed to create configlexer"
@@ -584,7 +558,6 @@ if [ "$RECONFIGURE" = "yes" ]; then
     info "Rebuilding configure script (autoconf) snapshot."
     autoreconf -f || error_cleanup "Autoconf failed."
     rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
-    rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 fi
 
 replace_all doc/README

services/authzone.c

@@ -2702,7 +2702,7 @@ create_synth_cname(uint8_t* qname, size_t qname_len, struct regional* region,
 	if(!d)
 		return 0; /* out of memory */
 	(*cname)->entry.data = d;
-	d->ttl = dname->data->ttl; /* RFC6672: synth CNAME TTL == DNAME TTL */
+	d->ttl = 0; /* 0 for synthesized CNAME TTL */
 	d->count = 1;
 	d->rrsig_count = 0;
 	d->trust = rrset_trust_ans_noAA;
@@ -6345,6 +6345,16 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 
 	/* get master addr */
 	if(xfr->task_probe->scan_addr) {
+		/* parse the host string to get the auth name for scan_addr */
+		if(xfr->task_probe->scan_specific &&
+			xfr->task_probe->scan_specific->host &&
+			!authextstrtoaddr(xfr->task_probe->scan_specific->host, &addr, &addrlen, &auth_name)) {
+			char zname[255+1];
+			dname_str(xfr->name, zname);
+			log_err("%s: failed lookup, cannot probe to master %s",
+				zname, master->host);
+			return 0;
+		}
 		addrlen = xfr->task_probe->scan_addr->addrlen;
 		memmove(&addr, &xfr->task_probe->scan_addr->addr, addrlen);
 	} else {
@@ -6358,18 +6368,6 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 				zname, master->host);
 			return 0;
 		}
-		if (auth_name != NULL) {
-			if (addr.ss_family == AF_INET
-			&&  (int)ntohs(((struct sockaddr_in *)&addr)->sin_port)
-		            == env->cfg->ssl_port)
-				((struct sockaddr_in *)&addr)->sin_port
-					= htons((uint16_t)env->cfg->port);
-			else if (addr.ss_family == AF_INET6
-			&&  (int)ntohs(((struct sockaddr_in6 *)&addr)->sin6_port)
-		            == env->cfg->ssl_port)
-                        	((struct sockaddr_in6 *)&addr)->sin6_port
-					= htons((uint16_t)env->cfg->port);
-		}
 	}
 
 	/* create packet */
@@ -6379,11 +6377,12 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 		xfr->task_probe->id = GET_RANDOM_ID(env->rnd);
 	xfr_create_soa_probe_packet(xfr, env->scratch_buffer, 
 		xfr->task_probe->id);
-	/* we need to remove the cp if we have a different ip4/ip6 type now */
+	/* we need to remove the cp if we have a different ip4/ip6 type now.
+	 * And also for tls probes to get a new tcp commpoint. */
 	if(xfr->task_probe->cp &&
 		((xfr->task_probe->cp_is_ip6 && !addr_is_ip6(&addr, addrlen)) ||
-		(!xfr->task_probe->cp_is_ip6 && addr_is_ip6(&addr, addrlen)))
-		) {
+		(!xfr->task_probe->cp_is_ip6 && addr_is_ip6(&addr, addrlen)) ||
+		auth_name != NULL)) {
 		comm_point_delete(xfr->task_probe->cp);
 		xfr->task_probe->cp = NULL;
 	}
@@ -6391,14 +6390,19 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 		if(addr_is_ip6(&addr, addrlen))
 			xfr->task_probe->cp_is_ip6 = 1;
 		else 	xfr->task_probe->cp_is_ip6 = 0;
-		xfr->task_probe->cp = outnet_comm_point_for_udp(env->outnet,
-			auth_xfer_probe_udp_callback, xfr, &addr, addrlen);
+		if(auth_name != NULL)
+			xfr->task_probe->cp = outnet_comm_point_for_tcp(env->outnet,
+				auth_xfer_probe_tcp_callback, xfr, &addr, addrlen, env->scratch_buffer, -1, auth_name != NULL, auth_name);
+		else
+			xfr->task_probe->cp = outnet_comm_point_for_udp(env->outnet,
+				auth_xfer_probe_udp_callback, xfr, &addr, addrlen);
 		if(!xfr->task_probe->cp) {
 			char zname[255+1], as[256];
 			dname_str(xfr->name, zname);
 			addr_to_str(&addr, addrlen, as, sizeof(as));
-			verbose(VERB_ALGO, "cannot create udp cp for "
-				"probe %s to %s", zname, as);
+			verbose(VERB_ALGO, "cannot create %s cp for "
+				"probe %s to %s", (auth_name?"tcp":"udp"),
+				zname, as);
 			return 0;
 		}
 	}
@@ -6411,8 +6415,9 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 		}
 	}
 
-	/* send udp packet */
-	if(!comm_point_send_udp_msg(xfr->task_probe->cp, env->scratch_buffer,
+	/* send udp packet, for an UDP commpoint. */
+	if(auth_name == NULL &&
+	   !comm_point_send_udp_msg(xfr->task_probe->cp, env->scratch_buffer,
 		(struct sockaddr*)&addr, addrlen, 0)) {
 		char zname[255+1], as[256];
 		dname_str(xfr->name, zname);
@@ -6421,13 +6426,18 @@ xfr_probe_send_probe(struct auth_xfer* xfr, struct module_env* env,
 			zname, as);
 		return 0;
 	}
+	/* for a TCP commpoint, the packet is waiting to be sent in the
+	 * TCP commpoint buffer. The callback returns when there is a reply. */
 	if(verbosity >= VERB_ALGO) {
 		char zname[255+1], as[256];
 		dname_str(xfr->name, zname);
 		addr_to_str(&addr, addrlen, as, sizeof(as));
-		verbose(VERB_ALGO, "auth zone %s soa probe sent to %s", zname,
-			as);
+		verbose(VERB_ALGO, "auth zone %s soa probe sent to %s%s%s",
+			zname, as, (auth_name?"#":""),
+			(auth_name?auth_name:""));
 	}
+	if(auth_name != NULL)
+		timeout *= 10; /* TCP and TLS get a longer timeout */
 	xfr->task_probe->timeout = timeout;
 #ifndef S_SPLINT_S
 	t.tv_sec = timeout/1000;
@@ -6565,6 +6575,94 @@ auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
 	return 0;
 }
 
+/** callback for task_probe tcp replies */
+int
+auth_xfer_probe_tcp_callback(struct comm_point* c, void* arg, int err,
+	struct comm_reply* ATTR_UNUSED(repinfo))
+{
+	struct auth_xfer* xfr = (struct auth_xfer*)arg;
+	struct module_env* env;
+	log_assert(xfr->task_probe);
+	lock_basic_lock(&xfr->lock);
+	env = xfr->task_probe->env;
+	if(!env || env->outnet->want_to_quit) {
+		lock_basic_unlock(&xfr->lock);
+		return 0; /* stop on quit */
+	}
+	/* stop the timer */
+	comm_timer_disable(xfr->task_probe->timer);
+
+	/* see if we got a reply and what that means */
+	if(err == NETEVENT_NOERROR) {
+		uint32_t serial = 0;
+		if(check_packet_ok(c->buffer, LDNS_RR_TYPE_SOA, xfr,
+			&serial)) {
+			/* successful lookup */
+			if(verbosity >= VERB_ALGO) {
+				char buf[256];
+				dname_str(xfr->name, buf);
+				verbose(VERB_ALGO, "auth zone %s: soa probe "
+					"serial is %u", buf, (unsigned)serial);
+			}
+			/* see if this serial indicates that the zone has
+			 * to be updated */
+			if(xfr_serial_means_update(xfr, serial)) {
+				/* if updated, start the transfer task, if needed */
+				verbose(VERB_ALGO, "auth_zone updated, start transfer");
+				if(xfr->task_transfer->worker == NULL) {
+					struct auth_master* master =
+						xfr_probe_current_master(xfr);
+					/* if we have download URLs use them
+					 * in preference to this master we
+					 * just probed the SOA from */
+					if(xfr->task_transfer->masters &&
+						xfr->task_transfer->masters->http)
+						master = NULL;
+					xfr_probe_disown(xfr);
+					xfr_start_transfer(xfr, env, master);
+					return 0;
+
+				}
+				/* other tasks are running, we don't do this anymore */
+				xfr_probe_disown(xfr);
+				lock_basic_unlock(&xfr->lock);
+				/* return, we don't sent a reply to this udp packet,
+				 * and we setup the tasks to do next */
+				return 0;
+			} else {
+				verbose(VERB_ALGO, "auth_zone master reports unchanged soa serial");
+				/* we if cannot find updates amongst the
+				 * masters, this means we then have a new lease
+				 * on the zone */
+				xfr->task_probe->have_new_lease = 1;
+			}
+		} else {
+			if(verbosity >= VERB_ALGO) {
+				char buf[256];
+				dname_str(xfr->name, buf);
+				verbose(VERB_ALGO, "auth zone %s: bad reply to soa probe", buf);
+			}
+		}
+	} else {
+		if(verbosity >= VERB_ALGO) {
+			char buf[256];
+			dname_str(xfr->name, buf);
+			verbose(VERB_ALGO, "auth zone %s: soa probe failed", buf);
+		}
+	}
+
+	/* failed lookup or not an update */
+	/* delete commpoint so a new one is created, with a fresh port nr */
+	comm_point_delete(xfr->task_probe->cp);
+	xfr->task_probe->cp = NULL;
+
+	/* if the result was not a successful probe, we need
+	 * to send the next one */
+	xfr_probe_nextmaster(xfr);
+	xfr_probe_send_or_end(xfr, env);
+	return 0;
+}
+
 /** lookup a host name for its addresses, if needed */
 static int
 xfr_probe_lookup_host(struct auth_xfer* xfr, struct module_env* env)
@@ -7774,7 +7872,6 @@ static int zonemd_dnssec_verify_rrset(struct auth_zone* z,
 	enum sec_status sec;
 	struct val_env* ve;
 	int m;
-	int verified = 0;
 	m = modstack_find(mods, "validator");
 	if(m == -1) {
 		auth_zone_log(z->name, VERB_ALGO, "zonemd dnssec verify: have "
@@ -7798,7 +7895,7 @@ static int zonemd_dnssec_verify_rrset(struct auth_zone* z,
 			"zonemd: verify %s RRset with DNSKEY", typestr);
 	}
 	sec = dnskeyset_verify_rrset(env, ve, &pk, dnskey, sigalg, why_bogus, NULL,
-		LDNS_SECTION_ANSWER, NULL, &verified);
+		LDNS_SECTION_ANSWER, NULL);
 	if(sec == sec_status_secure) {
 		return 1;
 	}

services/authzone.h

@@ -678,6 +678,9 @@ void auth_xfer_timer(void* arg);
 /** callback for commpoint udp replies to task_probe */
 int auth_xfer_probe_udp_callback(struct comm_point* c, void* arg, int err,
         struct comm_reply* repinfo);
+/** callback for commpoint tcp replies to task_probe */
+int auth_xfer_probe_tcp_callback(struct comm_point* c, void* arg, int err,
+        struct comm_reply* repinfo);
 /** callback for task_transfer tcp connections */
 int auth_xfer_transfer_tcp_callback(struct comm_point* c, void* arg, int err,
         struct comm_reply* repinfo);

services/cache/dns.c

@@ -80,7 +80,6 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 	struct regional* region, time_t qstarttime)
 {
 	size_t i;
-	time_t ttl, min_ttl = rep->ttl;
 	/* see if rrset already exists in cache, if not insert it. */
 	for(i=0; i<rep->rrset_count; i++) {
 		rep->ref[i].key = rep->rrsets[i];
@@ -113,15 +112,6 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 		case 1: /* ref updated, item inserted */
 			rep->rrsets[i] = rep->ref[i].key;
 		}
-		/* if ref was updated make sure the message ttl is updated to
-		 * the minimum of the current rrsets. */
-		ttl = ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)->ttl;
-		if(ttl < min_ttl) min_ttl = ttl;
-	}
-	if(min_ttl < rep->ttl) {
-		rep->ttl = min_ttl;
-		rep->prefetch_ttl = PREFETCH_TTL_CALC(rep->ttl);
-		rep->serve_expired_ttl = rep->ttl + SERVE_EXPIRED_TTL;
 	}
 }
 
@@ -700,28 +690,6 @@ tomsg(struct module_env* env, struct query_info* q, struct reply_info* r,
 	return msg;
 }
 
-struct dns_msg*
-dns_msg_deepcopy_region(struct dns_msg* origin, struct regional* region)
-{
-	size_t i;
-	struct dns_msg* res = NULL;
-	res = gen_dns_msg(region, &origin->qinfo, origin->rep->rrset_count);
-	if(!res) return NULL;
-	*res->rep = *origin->rep;
-	if(origin->rep->reason_bogus_str) {
-		res->rep->reason_bogus_str = regional_strdup(region,
-			origin->rep->reason_bogus_str);
-	}
-	for(i=0; i<res->rep->rrset_count; i++) {
-		res->rep->rrsets[i] = packed_rrset_copy_region(
-			origin->rep->rrsets[i], region, 0);
-		if(!res->rep->rrsets[i]) {
-			return NULL;
-		}
-	}
-	return res;
-}
-
 /** synthesize RRset-only response from cached RRset item */
 static struct dns_msg*
 rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region, 
@@ -828,7 +796,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	if(!newd)
 		return NULL;
 	ck->entry.data = newd;
-	newd->ttl = d->ttl - now; /* RFC6672: synth CNAME TTL == DNAME TTL */
+	newd->ttl = 0; /* 0 for synthesized CNAME TTL */
 	newd->count = 1;
 	newd->rrsig_count = 0;
 	newd->trust = rrset_trust_ans_noAA;

services/cache/dns.h

@@ -164,15 +164,6 @@ struct dns_msg* tomsg(struct module_env* env, struct query_info* q,
 	struct reply_info* r, struct regional* region, time_t now,
 	int allow_expired, struct regional* scratch);
 
-/**
- * Deep copy a dns_msg to a region.
- * @param origin: the dns_msg to copy.
- * @param region: the region to copy all the data to.
- * @return the new dns_msg or NULL on malloc error.
- */
-struct dns_msg* dns_msg_deepcopy_region(struct dns_msg* origin,
-	struct regional* region);
-
 /** 
  * Find cached message 
  * @param env: module environment with the DNS cache.

services/localzone.c

@@ -1532,7 +1532,7 @@ local_data_answer(struct local_zone* z, struct module_env* env,
 			return 0; /* invalid cname */
 		if(dname_is_wild(ctarget)) {
 			/* synthesize cname target */
-			struct packed_rrset_data* d, *lr_d;
+			struct packed_rrset_data* d;
 			/* -3 for wildcard label and root label from qname */
 			size_t newtargetlen = qinfo->qname_len + ctargetlen - 3;
 
@@ -1560,10 +1560,8 @@ local_data_answer(struct local_zone* z, struct module_env* env,
 				+ newtargetlen);
 			if(!d)
 				return 0; /* out of memory */
-			lr_d = (struct packed_rrset_data*)lr->rrset->entry.data;
 			qinfo->local_alias->rrset->entry.data = d;
-			d->ttl = lr_d->rr_ttl[0]; /* RFC6672-like behavior:
-					    synth CNAME TTL uses original TTL*/
+			d->ttl = 0; /* 0 for synthesized CNAME TTL */
 			d->count = 1;
 			d->rrsig_count = 0;
 			d->trust = rrset_trust_ans_noAA;

services/mesh.c

@@ -69,12 +69,6 @@
 #include "edns-subnet/subnetmod.h"
 #include "edns-subnet/edns-subnet.h"
 #endif
-#ifdef HAVE_SYS_TYPES_H
-#  include <sys/types.h>
-#endif
-#ifdef HAVE_NETDB_H
-#include <netdb.h>
-#endif
 
 /**
  * Compare two response-ip client info entries for the purpose of mesh state
@@ -1435,9 +1429,7 @@ mesh_send_reply(struct mesh_state* m, int rcode, struct reply_info* rep,
 	if(m->s.env->cfg->log_replies) {
 		log_reply_info(NO_VERBOSE, &m->s.qinfo,
 			&r->query_reply.client_addr,
-			r->query_reply.client_addrlen, duration, 0, r_buffer,
-			(m->s.env->cfg->log_destaddr?(void*)r->query_reply.c->socket->addr->ai_addr:NULL),
-			r->query_reply.c->type);
+			r->query_reply.client_addrlen, duration, 0, r_buffer);
 	}
 }
 

services/outside_network.c

@@ -1009,7 +1009,7 @@ use_free_buffer(struct outside_network* outnet)
 			sldns_buffer tmp;
 			sldns_buffer_init_frm_data(&tmp, w->pkt, w->pkt_len);
 			dt_msg_send_outside_query(outnet->dtenv, &w->sq->addr,
-				&pend_tcp->pi->addr, comm_tcp, NULL, w->sq->zone,
+				&pend_tcp->pi->addr, comm_tcp, w->sq->zone,
 				w->sq->zonelen, &tmp);
 		}
 #endif
@@ -2237,7 +2237,7 @@ randomize_and_send_udp(struct pending* pend, sldns_buffer* packet, int timeout)
 		outnet->dtenv->log_forwarder_query_messages)) {
 			log_addr(VERB_ALGO, "from local addr", &pend->pc->pif->addr, pend->pc->pif->addrlen);
 			log_addr(VERB_ALGO, "request to upstream", &pend->addr, pend->addrlen);
-			dt_msg_send_outside_query(outnet->dtenv, &pend->addr, &pend->pc->pif->addr, comm_udp, NULL,
+			dt_msg_send_outside_query(outnet->dtenv, &pend->addr, &pend->pc->pif->addr, comm_udp,
 				pend->sq->zone, pend->sq->zonelen, packet);
 	}
 #endif
@@ -2517,7 +2517,7 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
 			sldns_buffer tmp;
 			sldns_buffer_init_frm_data(&tmp, w->pkt, w->pkt_len);
 			dt_msg_send_outside_query(sq->outnet->dtenv, &sq->addr,
-				&pend->pi->addr, comm_tcp, NULL, sq->zone,
+				&pend->pi->addr, comm_tcp, sq->zone,
 				sq->zonelen, &tmp);
 		}
 #endif
@@ -2820,25 +2820,6 @@ serviced_perturb_qname(struct ub_randstate* rnd, uint8_t* qbuf, size_t len)
 	}
 }
 
-static uint16_t
-serviced_query_udp_size(struct serviced_query* sq, enum serviced_query_status status) {
-	uint16_t udp_size;
-	if(status == serviced_query_UDP_EDNS_FRAG) {
-		if(addr_is_ip6(&sq->addr, sq->addrlen)) {
-			if(EDNS_FRAG_SIZE_IP6 < EDNS_ADVERTISED_SIZE)
-				udp_size = EDNS_FRAG_SIZE_IP6;
-			else	udp_size = EDNS_ADVERTISED_SIZE;
-		} else {
-			if(EDNS_FRAG_SIZE_IP4 < EDNS_ADVERTISED_SIZE)
-				udp_size = EDNS_FRAG_SIZE_IP4;
-			else	udp_size = EDNS_ADVERTISED_SIZE;
-		}
-	} else {
-		udp_size = EDNS_ADVERTISED_SIZE;
-	}
-	return udp_size;
-}
-
 /** put serviced query into a buffer */
 static void
 serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns)
@@ -2862,7 +2843,19 @@ serviced_encode(struct serviced_query* sq, sldns_buffer* buff, int with_edns)
 		edns.opt_list_in = NULL;
 		edns.opt_list_out = sq->opt_list;
 		edns.opt_list_inplace_cb_out = NULL;
-		edns.udp_size = serviced_query_udp_size(sq, sq->status);
+		if(sq->status == serviced_query_UDP_EDNS_FRAG) {
+			if(addr_is_ip6(&sq->addr, sq->addrlen)) {
+				if(EDNS_FRAG_SIZE_IP6 < EDNS_ADVERTISED_SIZE)
+					edns.udp_size = EDNS_FRAG_SIZE_IP6;
+				else	edns.udp_size = EDNS_ADVERTISED_SIZE;
+			} else {
+				if(EDNS_FRAG_SIZE_IP4 < EDNS_ADVERTISED_SIZE)
+					edns.udp_size = EDNS_FRAG_SIZE_IP4;
+				else	edns.udp_size = EDNS_ADVERTISED_SIZE;
+			}
+		} else {
+			edns.udp_size = EDNS_ADVERTISED_SIZE;
+		}
 		edns.bits = 0;
 		if(sq->dnssec & EDNS_DO)
 			edns.bits = EDNS_DO;
@@ -3090,7 +3083,7 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 		log_addr(VERB_ALGO, "response from upstream", &sq->addr, sq->addrlen);
 		log_addr(VERB_ALGO, "to local addr", &pi->addr, pi->addrlen);
 		dt_msg_send_outside_response(sq->outnet->dtenv, &sq->addr,
-			&pi->addr, c->type, c->ssl, sq->zone, sq->zonelen, sq->qbuf,
+			&pi->addr, c->type, sq->zone, sq->zonelen, sq->qbuf,
 			sq->qbuflen, &sq->last_sent_time, sq->outnet->now_tv,
 			c->buffer);
 	}
@@ -3259,8 +3252,7 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 
 	sq->pending = NULL; /* removed after callback */
 	if(error == NETEVENT_TIMEOUT) {
-		if(sq->status == serviced_query_UDP_EDNS && sq->last_rtt < 5000 &&
-		   (serviced_query_udp_size(sq, serviced_query_UDP_EDNS_FRAG) < serviced_query_udp_size(sq, serviced_query_UDP_EDNS))) {
+		if(sq->status == serviced_query_UDP_EDNS && sq->last_rtt < 5000) {
 			/* fallback to 1480/1280 */
 			sq->status = serviced_query_UDP_EDNS_FRAG;
 			log_name_addr(VERB_ALGO, "try edns1xx0", sq->qbuf+10,
@@ -3304,7 +3296,7 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 		log_addr(VERB_ALGO, "to local addr", &p->pc->pif->addr,
 			p->pc->pif->addrlen);
 		dt_msg_send_outside_response(outnet->dtenv, &sq->addr,
-			&p->pc->pif->addr, c->type, c->ssl, sq->zone, sq->zonelen,
+			&p->pc->pif->addr, c->type, sq->zone, sq->zonelen,
 			sq->qbuf, sq->qbuflen, &sq->last_sent_time,
 			sq->outnet->now_tv, c->buffer);
 	}

testcode/testpkts.c

@@ -470,7 +470,6 @@ get_origin(const char* name, struct sldns_file_parse_state* pstate, char* parse)
 	store = *end;
 	*end = 0;
 	verbose(3, "parsing '%s'\n", parse);
-	pstate->origin_len = sizeof(pstate->origin);
 	status = sldns_str2wire_dname_buf(parse, pstate->origin,
 		&pstate->origin_len);
 	*end = store;

testcode/unitauth.c

@@ -279,14 +279,14 @@ static struct q_ans example_com_queries[] = {
 ";flags QR AA rcode NOERROR\n"
 ";answer section\n"
 "redir.example.com.	3600	IN	DNAME	redir.example.org.\n"
-"abc.redir.example.com.	3600	IN	CNAME	abc.redir.example.org.\n"
+"abc.redir.example.com.	0	IN	CNAME	abc.redir.example.org.\n"
 	},
 
 	{ "example.com", "foo.abc.redir.example.com. A", "",
 ";flags QR AA rcode NOERROR\n"
 ";answer section\n"
 "redir.example.com.	3600	IN	DNAME	redir.example.org.\n"
-"foo.abc.redir.example.com.	3600	IN	CNAME	foo.abc.redir.example.org.\n"
+"foo.abc.redir.example.com.	0	IN	CNAME	foo.abc.redir.example.org.\n"
 	},
 
 	{ "example.com", "redir2.example.com. DNAME", "",
@@ -299,42 +299,42 @@ static struct q_ans example_com_queries[] = {
 ";flags QR AA rcode NOERROR\n"
 ";answer section\n"
 "redir2.example.com.	3600	IN	DNAME	redir2.example.org.\n"
-"abc.redir2.example.com.	3600	IN	CNAME	abc.redir2.example.org.\n"
+"abc.redir2.example.com.	0	IN	CNAME	abc.redir2.example.org.\n"
 	},
 
 	{ "example.com", "obscured.redir2.example.com. A", "",
 ";flags QR AA rcode NOERROR\n"
 ";answer section\n"
 "redir2.example.com.	3600	IN	DNAME	redir2.example.org.\n"
-"obscured.redir2.example.com.	3600	IN	CNAME	obscured.redir2.example.org.\n"
+"obscured.redir2.example.com.	0	IN	CNAME	obscured.redir2.example.org.\n"
 	},
 
 	{ "example.com", "under2.redir2.example.com. A", "",
 ";flags QR AA rcode NOERROR\n"
 ";answer section\n"
 "redir2.example.com.	3600	IN	DNAME	redir2.example.org.\n"
-"under2.redir2.example.com.	3600	IN	CNAME	under2.redir2.example.org.\n"
+"under2.redir2.example.com.	0	IN	CNAME	under2.redir2.example.org.\n"
 	},
 
 	{ "example.com", "doubleobscured.under2.redir2.example.com. A", "",
 ";flags QR AA rcode NOERROR\n"
 ";answer section\n"
 "redir2.example.com.	3600	IN	DNAME	redir2.example.org.\n"
-"doubleobscured.under2.redir2.example.com.	3600	IN	CNAME	doubleobscured.under2.redir2.example.org.\n"
+"doubleobscured.under2.redir2.example.com.	0	IN	CNAME	doubleobscured.under2.redir2.example.org.\n"
 	},
 
 	{ "example.com", "foo.doubleobscured.under2.redir2.example.com. A", "",
 ";flags QR AA rcode NOERROR\n"
 ";answer section\n"
 "redir2.example.com.	3600	IN	DNAME	redir2.example.org.\n"
-"foo.doubleobscured.under2.redir2.example.com.	3600	IN	CNAME	foo.doubleobscured.under2.redir2.example.org.\n"
+"foo.doubleobscured.under2.redir2.example.com.	0	IN	CNAME	foo.doubleobscured.under2.redir2.example.org.\n"
 	},
 
 	{ "example.com", "foo.under2.redir2.example.com. A", "",
 ";flags QR AA rcode NOERROR\n"
 ";answer section\n"
 "redir2.example.com.	3600	IN	DNAME	redir2.example.org.\n"
-"foo.under2.redir2.example.com.	3600	IN	CNAME	foo.under2.redir2.example.org.\n"
+"foo.under2.redir2.example.com.	0	IN	CNAME	foo.under2.redir2.example.org.\n"
 	},
 
 	{ "example.com", "sub.example.com. NS", "",

testcode/unitverify.c

@@ -180,7 +180,6 @@ verifytest_rrset(struct module_env* env, struct val_env* ve,
 	enum sec_status sec;
 	char* reason = NULL;
 	uint8_t sigalg[ALGO_NEEDS_MAX+1];
-	int verified = 0;
 	if(vsig) {
 		log_nametypeclass(VERB_QUERY, "verify of rrset",
 			rrset->rk.dname, ntohs(rrset->rk.type),
@@ -189,7 +188,7 @@ verifytest_rrset(struct module_env* env, struct val_env* ve,
 	setup_sigalg(dnskey, sigalg); /* check all algorithms in the dnskey */
 	/* ok to give null as qstate here, won't be used for answer section. */
 	sec = dnskeyset_verify_rrset(env, ve, rrset, dnskey, sigalg, &reason, NULL,
-		LDNS_SECTION_ANSWER, NULL, &verified);
+		LDNS_SECTION_ANSWER, NULL);
 	if(vsig) {
 		printf("verify outcome is: %s %s\n", sec_status_to_string(sec),
 			reason?reason:"");
@@ -443,9 +442,9 @@ nsec3_hash_test_entry(struct entry* e, rbtree_type* ct,
 
 	ret = nsec3_hash_name(ct, region, buf, nsec3, 0, qname,
 		qinfo.qname_len, &hash);
-	if(ret < 1) {
+	if(ret != 1) {
 		printf("Bad nsec3_hash_name retcode %d\n", ret);
-		unit_assert(ret == 1 || ret == 2);
+		unit_assert(ret == 1);
 	}
 	unit_assert(hash->dname && hash->hash && hash->hash_len &&
 		hash->b32 && hash->b32_len);

testdata/01-doc.tdir/01-doc.test

@@ -24,21 +24,21 @@ fi
 (cd $PRE; find . -name "*.h" -print) >hlist
 (cd $PRE; find . -name "*.c" -print) >>hlist
 # filter out config.h
-grep -F -v -e "config.h" hlist > ilist; mv ilist hlist
-grep -F -v -e "util/configparser" hlist > ilist; mv ilist hlist
-grep -F -v -e "util/configlexer" hlist > ilist; mv ilist hlist
-grep -F -v -e "util/configyyrename" hlist > ilist; mv ilist hlist
-grep -F -v -e "util/locks.h" hlist > ilist; mv ilist hlist
-grep -F -v -e "util/storage/lookup3.c" hlist > ilist; mv ilist hlist
-grep -F -v -e "ldns-src/" hlist > ilist; mv ilist hlist
-grep -F -v -e "libunbound/python/libunbound_wrap.c" hlist > ilist; mv ilist hlist
-grep -F -v -e "pythonmod/interface.h" hlist > ilist; mv ilist hlist
-grep -F -v -e "dnstap" hlist > ilist; mv ilist hlist
-grep -F -v -e "util/siphash.c" hlist > ilist; mv ilist hlist
+fgrep -v -e "config.h" hlist > ilist; mv ilist hlist
+fgrep -v -e "util/configparser" hlist > ilist; mv ilist hlist
+fgrep -v -e "util/configlexer" hlist > ilist; mv ilist hlist
+fgrep -v -e "util/configyyrename" hlist > ilist; mv ilist hlist
+fgrep -v -e "util/locks.h" hlist > ilist; mv ilist hlist
+fgrep -v -e "util/storage/lookup3.c" hlist > ilist; mv ilist hlist
+fgrep -v -e "ldns-src/" hlist > ilist; mv ilist hlist
+fgrep -v -e "libunbound/python/libunbound_wrap.c" hlist > ilist; mv ilist hlist
+fgrep -v -e "pythonmod/interface.h" hlist > ilist; mv ilist hlist
+fgrep -v -e "dnstap" hlist > ilist; mv ilist hlist
+fgrep -v -e "util/siphash.c" hlist > ilist; mv ilist hlist
 # filter out compat
-grep -F -v -e "compat/" hlist > ilist; mv ilist hlist
+fgrep -v -e "compat/" hlist > ilist; mv ilist hlist
 for h in `cat hlist`; do
-	if grep -F "`basename $h`" $PRE/doc/html/files.html >/dev/null; then
+	if fgrep "`basename $h`" $PRE/doc/html/files.html >/dev/null; then
 		: # ok
 	else
 		echo "Warning: $h has no documentation."

testdata/auth_axfr.tdir/auth_axfr.test

@@ -7,35 +7,35 @@
 PRE="../.."
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 if grep SERVFAIL outfile; then
 	echo "> try again"
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 10
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 10
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 fi
 echo "> cat logfiles"
 cat fwd.log 

testdata/auth_axfr_tls.tdir/auth_axfr_tls.conf

@@ -0,0 +1,22 @@
+server:
+	verbosity: 7
+	# num-threads: 1
+	interface: 127.0.0.1
+	port: @PORT@
+	use-syslog: no
+	directory: ""
+	pidfile: "unbound.pid"
+	chroot: ""
+	username: ""
+	do-not-query-localhost: no
+	use-caps-for-id: no
+	tls-cert-bundle: "unbound_server.pem"
+auth-zone:
+	name: "example.com"
+	for-upstream: yes
+	for-downstream: yes
+	master: "127.0.0.1@@TOPORT@#unbound"
+# if queries escape, send them to localhost
+forward-zone:
+	name: "."
+	forward-addr: 127.0.0.1@@PORT@

testdata/auth_axfr_tls.tdir/auth_axfr_tls.conf2

@@ -0,0 +1,22 @@
+server:
+	verbosity: 5
+	logfile: "/dev/stderr"
+	xfrdfile: "xfrd.state"
+	zonesdir: ""
+	username: ""
+	chroot: ""
+	pidfile: "nsd.pid"
+	database: ""
+	zonelistfile: "zone.list"
+	interface: 127.0.0.1@@AUTH_PORT@
+	tls-service-key: "unbound_server.key"
+	tls-service-pem: "unbound_server.pem"
+	tls-port: @AUTH_PORT@
+
+zone:
+	name: "example.com"
+	zonefile: "example.com.zone"
+	provide-xfr: 127.0.0.0/8 NOKEY
+	provide-xfr: ::1 NOKEY
+	provide-xfr: ::ffff:127.0.0.1 NOKEY
+	notify: 127.0.0.1@@PORT@ NOKEY

testdata/auth_axfr_tls.tdir/auth_axfr_tls.dsc

@@ -0,0 +1,16 @@
+BaseName: auth_axfr_tls
+Version: 1.0
+Description: Perform AXFR for authority zone using TLS
+CreationDate: Thu 19 Oct 09:25:40 CEST 2023
+Maintainer: dr. W.C.A. Wijngaards
+Category: 
+Component:
+CmdDepends: 
+Depends: 
+Help:
+Pre: auth_axfr_tls.pre
+Post: auth_axfr_tls.post
+Test: auth_axfr_tls.test
+AuxFiles: 
+Passed:
+Failure:

testdata/auth_axfr_tls.tdir/auth_axfr_tls.post

@@ -0,0 +1,16 @@
+# #-- auth_axfr_tls.post --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# source the test var file when it's there
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+#
+# do your teardown here
+. ../common.sh
+kill_pid $AUTH_PID
+kill_pid $UNBOUND_PID
+if test -f nsd.log; then
+	cat nsd.log
+fi
+if test -f unbound.log; then
+	cat unbound.log
+fi

testdata/auth_axfr_tls.tdir/auth_axfr_tls.pre

@@ -0,0 +1,51 @@
+# #-- auth_axfr_tls.pre--#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+# see if we have NSD as an auth server to serve xfr over tls.
+NSD=nsd
+if which nsd 2>/dev/null; then
+	echo "NSD=$NSD"
+else
+	NSD=""
+	for d in ".." "../.." "../../.." "../../../.." ; do
+		if test -z "$NSD" -o ! -f "$NSD"; then
+			if test -d "$d/nsd" && test -f "$d/nsd/nsd"; then
+				NSD="$d/nsd/nsd"
+				break;
+			fi
+		fi
+	done
+fi
+if test -z "$NSD"; then
+	skip_test "Need nsd for auth server, skip test"
+fi
+echo "NSD=$NSD" >> .tpkg.var.test
+
+get_random_port 2
+UNBOUND_PORT=$RND_PORT
+AUTH_PORT=$(($RND_PORT + 1))
+echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
+echo "AUTH_PORT=$AUTH_PORT" >> .tpkg.var.test
+
+# start auth server
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@AUTH_PORT\@/'$AUTH_PORT'/' < auth_axfr_tls.conf2 > nsd.conf
+$NSD -d -c nsd.conf >nsd.log 2>&1 &
+AUTH_PID=$!
+echo "AUTH_PID=$AUTH_PID" >> .tpkg.var.test
+
+# make config file
+sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$AUTH_PORT'/' < auth_axfr_tls.conf > ub.conf
+# start unbound in the background
+PRE="../.."
+$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
+UNBOUND_PID=$!
+echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
+
+cat .tpkg.var.test
+wait_nsd_up nsd.log
+wait_unbound_up unbound.log
+

testdata/auth_axfr_tls.tdir/auth_axfr_tls.test

@@ -0,0 +1,87 @@
+# #-- auth_axfr_tls.test --#
+# source the master var file when it's there
+[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
+# use .tpkg.var.test for in test variable passing
+[ -f .tpkg.var.test ] && source .tpkg.var.test
+
+. ../common.sh
+PRE="../.."
+# do the test
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+# try again if it needs time to do the zone transfer.
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile; then
+	echo "> try again"
+	sleep 1
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.4" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+# update the zone
+mv example.com.zone example.com.zone.old
+mv example.com.zone2 example.com.zone
+touch example.com.zone
+kill -1 $AUTH_PID
+#it would need to wait for the line to appear twice.
+#wait_server_up nsd.log "zone example.com read with success"
+echo "> auth server updated"
+
+echo "> dig www.example.com."
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+# try again if it needs time to do the zone transfer.
+if grep SERVFAIL outfile || grep "1.2.3.4" outfile; then
+	echo "> try again"
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile || grep "1.2.3.4" outfile; then
+	echo "> try again"
+	sleep 1
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile || grep "1.2.3.4" outfile; then
+	echo "> try again"
+	sleep 1
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+if grep SERVFAIL outfile || grep "1.2.3.4" outfile; then
+	echo "> try again"
+	sleep 1
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
+fi
+echo "> check answer"
+if grep "1.2.3.5" outfile; then
+	echo "OK"
+else
+	echo "Not OK"
+	exit 1
+fi
+
+if grep "auth zone example.com. soa probe sent to 127.0.0.1#unbound" unbound.log; then
+	echo "SOA sent over TLS"
+else
+	echo "SOA not sent over TLS"
+	echo "Not OK"
+	exit 1
+fi
+
+exit 0

testdata/auth_axfr_tls.tdir/example.com.zone

@@ -0,0 +1,2 @@
+example.com.	IN	SOA	nibbler.example.com. leela.example.com. 4 3600 3600 7200 300
+www.example.com. IN A 1.2.3.4

testdata/auth_axfr_tls.tdir/example.com.zone2

@@ -0,0 +1,2 @@
+example.com.	IN	SOA	nibbler.example.com. leela.example.com. 8 3600 3600 7200 300
+www.example.com. IN A 1.2.3.5

testdata/auth_axfr_tls.tdir/unbound_control.key

@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
+1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
+F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
+ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
+vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
+IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
+cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
+lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
+15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
+LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
+Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
+YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
+whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
+lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
+tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
+U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
+Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
+Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
+ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
+1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
+b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
+ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
+TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
+tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
+aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
+A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
+LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
+R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
+7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
+7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
+jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
+BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
+kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
+qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
+VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
+MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
+C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
+-----END RSA PRIVATE KEY-----

testdata/auth_axfr_tls.tdir/unbound_control.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
+WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
+A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
+OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
+1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
+NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
+A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
+Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
+TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
+nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
++i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
+4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
+hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
+9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
+ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
+pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
+72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
+muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
+uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
+-----END CERTIFICATE-----

testdata/auth_axfr_tls.tdir/unbound_server.key

@@ -0,0 +1,39 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
+0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
+GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
+uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
+WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
+FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
+q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
+A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
+7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
+XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
+iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
+2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
+MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
+WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
+O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
+IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
+qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
+dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
+bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
+YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
+7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
+gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
+5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
+ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
+oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
+s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
+zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
+ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
+oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
+BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
+mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
+kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
+7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
+RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
+jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
+O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
+MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
+-----END RSA PRIVATE KEY-----

testdata/auth_axfr_tls.tdir/unbound_server.pem

@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
+EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
+WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
+igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
+a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
+4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
+aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
+TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
+uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
++nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
+XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
+dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
+84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
+JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
+fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
+XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
+qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
+sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
+yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
+CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
+-----END CERTIFICATE-----

testdata/auth_https.tdir/auth_https.test

@@ -8,35 +8,35 @@ PRE="../.."
 . ../common.sh
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 if grep SERVFAIL outfile; then
 	echo "> try again"
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 10
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 10
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 fi
 echo "> cat logfiles"
 cat petal.log 

testdata/blanks_cached_zone.tdir/blanks_cached_zone.test

@@ -8,35 +8,35 @@ PRE="../.."
 # do the test
 TARGET=ns1.blanks.example.com.
 echo "> dig $TARGET"
-dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 if grep SERVFAIL outfile; then
 	echo "> try again"
-	dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 10
-	dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 10
-	dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 fi
 echo "> cat logfiles"
 cat unbound.log

testdata/blanks_https.tdir/blanks_https.test

@@ -8,35 +8,35 @@ PRE="../.."
 # do the test
 TARGET=ns1.blanks.example.com.
 echo "> dig $TARGET"
-dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 if grep SERVFAIL outfile; then
 	echo "> try again"
-	dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 1
-	dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 10
-	dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 fi
 if grep SERVFAIL outfile; then
 	echo "> try again"
 	sleep 10
-	dig @127.0.0.1 -p $UNBOUND_PORT $TARGET | tee outfile
+	dig @localhost -p $UNBOUND_PORT $TARGET | tee outfile
 fi
 echo "> cat logfiles"
 cat petal.log 

testdata/cachedb_no_store.tdir/cachedb_no_store.conf

@@ -1,29 +0,0 @@
-server:
-	verbosity: 4
-	interface: 127.0.0.1
-	port: @PORT@
-	use-syslog: no
-	directory: ""
-	pidfile: "unbound.pid"
-	chroot: ""
-	username: ""
-	module-config: "cachedb iterator"
-	do-not-query-localhost: no
-	qname-minimisation: no
-
-forward-zone:
-	name: "."
-	forward-addr: 127.0.0.1@@TOPORT@
-
-stub-zone:
-	name: "example.com"
-	stub-addr: 127.0.0.1@@TOPORT@
-
-remote-control:
-	control-enable: yes
-	control-interface: @CONTROL_PATH@/controlpipe.@CONTROL_PID@
-	control-use-cert: no
-
-cachedb:
-	backend: "testframe"
-	secret-seed: "testvalue"

testdata/cachedb_no_store.tdir/cachedb_no_store.dsc

@@ -1,16 +0,0 @@
-BaseName: cachedb_no_store
-Version: 1.0
-Description: cachedb test the cachedb-no-store option
-CreationDate: Wed 11 Oct 11:00:00 CEST 2023
-Maintainer: dr. W.C.A. Wijngaards
-Category: 
-Component:
-CmdDepends: 
-Depends: 
-Help:
-Pre: cachedb_no_store.pre
-Post: cachedb_no_store.post
-Test: cachedb_no_store.test
-AuxFiles: 
-Passed:
-Failure:

testdata/cachedb_no_store.tdir/cachedb_no_store.post

@@ -1,20 +0,0 @@
-# #-- cachedb_no_store.post --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# source the test var file when it's there
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-#
-# do your teardown here
-PRE="../.."
-. ../common.sh
-
-echo "> cat logfiles"
-cat fwd.log 
-if test -f fwd2.log; then cat fwd2.log; else echo "no fwd2.log"; fi
-if test -f fwd3.log; then cat fwd3.log; else echo "no fwd3.log"; fi
-if test -f fwd4.log; then cat fwd4.log; else echo "no fwd4.log"; fi
-cat unbound.log
-if test -f unbound2.log; then cat unbound2.log; else echo "no unbound2.log"; fi
-kill_pid $FWD_PID
-kill_from_pidfile "unbound.pid"
-rm -f $CONTROL_PATH/controlpipe.$CONTROL_PID

testdata/cachedb_no_store.tdir/cachedb_no_store.pre

@@ -1,36 +0,0 @@
-# #-- cachedb_no_store.pre--#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-if grep "define USE_CACHEDB 1" $PRE/config.h; then echo test enabled; else skip_test "test skipped"; fi
-
-get_random_port 2
-UNBOUND_PORT=$RND_PORT
-FWD_PORT=$(($RND_PORT + 1))
-echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
-echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
-
-# start forwarder
-get_ldns_testns
-$LDNS_TESTNS -p $FWD_PORT cachedb_no_store.testns >fwd.log 2>&1 &
-FWD_PID=$!
-echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
-
-# make config file
-CONTROL_PATH=/tmp
-CONTROL_PID=$$
-sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's?@CONTROL_PATH\@?'$CONTROL_PATH'?' -e 's/@CONTROL_PID@/'$CONTROL_PID'/' < cachedb_no_store.conf > ub.conf
-# start unbound in the background
-$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-echo "CONTROL_PATH=$CONTROL_PATH" >> .tpkg.var.test
-echo "CONTROL_PID=$CONTROL_PID" >> .tpkg.var.test
-
-cat .tpkg.var.test
-wait_ldns_testns_up fwd.log
-wait_unbound_up unbound.log

testdata/cachedb_no_store.tdir/cachedb_no_store.servfail.testns

@@ -1,8 +0,0 @@
-ENTRY_BEGIN
-MATCH opcode
-ADJUST copy_id copy_query
-REPLY QR AA SERVFAIL
-SECTION QUESTION
-txt1.example.com. IN TXT
-SECTION ANSWER
-ENTRY_END

testdata/cachedb_no_store.tdir/cachedb_no_store.test

@@ -1,132 +0,0 @@
-# #-- cachedb_no_store.test --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-
-# do the test
-get_ldns_testns
-
-# query for a text record that is stored by unbound's cache and cachedb
-# in the testframe cache.
-echo "> dig txt1.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT txt1.example.com. TXT | tee outfile
-if grep "example text message" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-# stop the forwarder with servfail, to check the answer came from the cache
-echo "> stop ldns-testns"
-kill_pid $FWD_PID
-echo "> start ldns-testns with servfails"
-$LDNS_TESTNS -p $FWD_PORT cachedb_no_store.servfail.testns >fwd2.log 2>&1 &
-FWD_PID=$!
-echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
-wait_ldns_testns_up fwd2.log
-
-echo "> dig txt1.example.com. from unbound cache"
-dig @127.0.0.1 -p $UNBOUND_PORT txt1.example.com. TXT | tee outfile
-if grep "example text message" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-# clear the cache of unbound, but not cachedb testframe cache
-echo "> unbound-control flush"
-$PRE/unbound-control -c ub.conf flush_type txt1.example.com. TXT
-if test $? -ne 0; then
-	echo "wrong exit value."
-	exit 1
-else
-	echo "exit value: OK"
-fi
-
-echo "> dig txt1.example.com. from cachedb"
-dig @127.0.0.1 -p $UNBOUND_PORT txt1.example.com. TXT | tee outfile
-if grep "example text message" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-# start the forwarder again.
-echo "> stop ldns-testns"
-kill_pid $FWD_PID
-echo "> start ldns-testns"
-$LDNS_TESTNS -p $FWD_PORT cachedb_no_store.testns >fwd3.log 2>&1 &
-FWD_PID=$!
-echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
-wait_ldns_testns_up fwd3.log
-
-# stop unbound to flush the cachedb cache
-echo "> stop unbound"
-kill_from_pidfile "unbound.pid"
-
-echo ""
-echo "> config unbound with cachedb-no-store: yes"
-echo "cachedb: cachedb-no-store: yes" >> ub.conf
-
-# start unbound again.
-echo "> start unbound"
-$PRE/unbound -d -c ub.conf >unbound2.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-wait_unbound_up unbound2.log
-
-echo ""
-echo "> dig txt1.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT txt1.example.com. TXT | tee outfile
-if grep "example text message" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-# stop the forwarder with servfail, to check the answer came from the cache
-echo "> stop ldns-testns"
-kill_pid $FWD_PID
-echo "> start ldns-testns with servfails"
-$LDNS_TESTNS -p $FWD_PORT cachedb_no_store.servfail.testns >fwd4.log 2>&1 &
-FWD_PID=$!
-echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
-wait_ldns_testns_up fwd4.log
-
-echo "> dig txt1.example.com. from unbound cache"
-dig @127.0.0.1 -p $UNBOUND_PORT txt1.example.com. TXT | tee outfile
-if grep "example text message" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-# clear the cache of unbound, but not cachedb testframe cache
-echo "> unbound-control flush"
-$PRE/unbound-control -c ub.conf flush_type txt1.example.com. TXT
-if test $? -ne 0; then
-	echo "wrong exit value."
-	exit 1
-else
-	echo "exit value: OK"
-fi
-
-echo "> dig txt1.example.com. from cachedb, but that has no message stored"
-dig @127.0.0.1 -p $UNBOUND_PORT txt1.example.com. TXT | tee outfile
-if grep "SERVFAIL" outfile; then
-	echo "OK"
-else
-	echo "Not OK"
-	exit 1
-fi
-
-exit 0

testdata/cachedb_no_store.tdir/cachedb_no_store.testns

@@ -1,9 +0,0 @@
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-txt1.example.com. IN TXT
-SECTION ANSWER
-txt1.example.com. IN TXT "example text message"
-ENTRY_END

testdata/common.sh

@@ -1,12 +1,7 @@
 # common.sh - an include file for commonly used functions for test code.
 # BSD licensed (see LICENSE file).
 #
-# Version 6
-# 2023-12-06: list wait_for_soa_serial in overview
-# 2023-12-06: get_ldns_notify, skip_test and teststep, and previous changes
-# also included are wait_logfile, cpu_count, process_cpu_list, and
-# kill_from_pidfile, and use HOME variable for HOME/bin.
-# 2011-04-06: tpk wait_logfile to wait (with timeout) for a logfile line to appear
+# Version 3
 # 2011-02-23: get_pcat for PCAT, PCAT_DIFF and PCAT_PRINT defines.
 # 2011-02-18: ports check on BSD,Solaris. wait_nsd_up.
 # 2011-02-11: first version.
@@ -26,19 +21,14 @@
 # set_doxygen_path	: set doxygen path
 # skip_if_in_list	: set SKIP=1 if name in list and tool not available.
 # get_random_port x	: get RND_PORT a sequence of free random port numbers.
-# wait_logfile		: wait on logfile to see entry.
 # wait_server_up	: wait on logfile to see when server comes up.
 # wait_ldns_testns_up   : wait for ldns-testns to come up.
 # wait_unbound_up	: wait for unbound to come up.
 # wait_petal_up		: wait for petal to come up.
 # wait_nsd_up		: wait for nsd to come up.
 # wait_server_up_or_fail: wait for server to come up or print a failure string
-# wait_for_soa_serial	: wait and dig at server for serial.
 # skip_test x		: print message and skip test (must be called in .pre)
 # kill_pid		: kill a server, make sure and wait for it to go down.
-# cpu_count		: get number of cpus in system
-# process_cpu_list	: get cpu affinity list for process
-# kill_from_pidfile     : kill the pid in the given pid file
 # teststep		: print the current test step in the output
 
 
@@ -71,7 +61,7 @@ get_ldns_testns () {
 	if test -x "`which ldns-testns 2>&1`"; then
 		LDNS_TESTNS=ldns-testns
 	else
-		LDNS_TESTNS=$HOME/bin/ldns-testns
+		LDNS_TESTNS=/home/wouter/bin/ldns-testns
 	fi
 }
 
@@ -80,7 +70,7 @@ get_ldns_notify () {
 	if test -x "`which ldns-notify 2>&1`"; then
 		LDNS_NOTIFY=ldns-notify
 	else
-		LDNS_NOTIFY=$HOME/bin/ldns-notify
+		LDNS_NOTIFY=/home/wouter/bin/ldns-notify
 	fi
 }
 
@@ -170,42 +160,16 @@ get_random_port () {
 	done
 }
 
-# wait for  a logfile line to appear, with a timeout.
-# pass <logfilename> <string to watch> <timeout>
-# $1 : logfilename
-# $2 : string to watch for.
-# $3 : timeout in seconds.
-# exits with failure if it times out
-wait_logfile () {
-	local WAIT_THRES=30
-	local MAX_UP_TRY=`expr $3 + $WAIT_THRES`
-	local try
-	for (( try=0 ; try <= $MAX_UP_TRY ; try++ )) ; do
-		if test -f $1 && grep -F "$2" $1 >/dev/null; then
-			#echo "done on try $try"
-			break;
-		fi
-		if test $try -eq $MAX_UP_TRY; then
-			echo "Logfile in $1 did not get $2!"
-			cat $1
-			exit 1;
-		fi
-		if test $try -ge $WAIT_THRES; then
-			sleep 1
-		fi
-	done
-}
-
 # wait for server to go up, pass <logfilename> <string to watch>
 # $1 : logfilename
 # $2 : string to watch for.
 # exits with failure if it does not come up
 wait_server_up () {
-	local WAIT_THRES=30
 	local MAX_UP_TRY=120
+	local WAIT_THRES=30
 	local try
 	for (( try=0 ; try <= $MAX_UP_TRY ; try++ )) ; do
-		if test -f $1 && grep -F "$2" $1 >/dev/null; then
+		if test -f $1 && fgrep "$2" $1 >/dev/null; then
 			#echo "done on try $try"
 			break;
 		fi
@@ -256,11 +220,11 @@ wait_server_up_or_fail () {
 	local WAIT_THRES=30
 	local try
 	for (( try=0 ; try <= $MAX_UP_TRY ; try++ )) ; do
-		if test -f $1 && grep -F "$2" $1 >/dev/null; then
+		if test -f $1 && fgrep "$2" $1 >/dev/null; then
 			echo "done on try $try"
 			break;
 		fi
-		if test -f $1 && grep -F "$3" $1 >/dev/null; then
+		if test -f $1 && fgrep "$3" $1 >/dev/null; then
 			echo "failed on try $try"
 			break;
 		fi
@@ -275,33 +239,6 @@ wait_server_up_or_fail () {
 	done
 }
 
-# $1: zone
-# $2: serial to be expected
-# $3: server to query
-# $4: port
-# $5: # times to try (# seconds dig is ran)
-wait_for_soa_serial () {
-	TS_START=`date +%s`
-	for i in `seq 1 $5`
-	do
-		SERIAL=`dig -p $4 @$3 $1 SOA +short | awk '{ print $3 }'`
-		if test "$?" != "0"
-		then
-			echo "** \"dig -p $4 @$3 $1 SOA +short\" failed!"
-			return 1
-		fi
-		if test "$SERIAL" = "$2"
-		then
-			TS_END=`date +%s`
-			echo "*** Serial $2 was seen in $i tries (`expr $TS_END - $TS_START`) seconds"
-			return 0
-		fi
-		sleep 1
-	done
-	echo "** Serial $2 was not seen in $5 tries (did see: $SERIAL)"
-	return 1
-}
-
 # kill a pid, make sure and wait for it to go down.
 # $1 : pid to kill
 kill_pid () {
@@ -331,58 +268,11 @@ kill_pid () {
 
 # set doxygen path, so that make doc can find doxygen
 set_doxygen_path () {
-	if test -x '$HOME/bin/doxygen'; then
-	        export PATH="$HOME/bin:$PATH"
+	if test -x '/home/wouter/bin/doxygen'; then
+	        export PATH="/home/wouter/bin:$PATH"
 	fi
 }
 
-# get number of cpus in system
-cpu_count()
-{
-  local sys=$(uname -s)
-  if [ "${sys}" = "Linux" ]; then
-    nproc
-  elif [ "${sys}" = "FreeBSD" ]; then
-    sysctl -n hw.ncpu
-  fi
-}
-
-# get cpu affinity list for process
-# $1 : pid
-process_cpu_list() {
-  local pid=${1}
-  local sys=$(uname -s)
-
-  if [ "${sys}" = "Linux" ]; then
-    local defl=$(taskset -pc ${pid} | sed -n -e 's/^.*: //p' | head -n 1)
-  elif [ "${sys}" = "FreeBSD" ]; then
-    local defl=$(cpuset -g -p ${pid} | sed -n -e 's/^.*: //p' | head -n 1)
-  fi
-
-  if [ -n "${defl}" ]; then
-    local infl
-    defl=$(echo "${defl}" | sed -e 's/,/ /g')
-    for i in ${defl}; do
-      rng=$(echo "${i}-${i}" | sed -e 's/^\([0-9]*\)-\([0-9]*\).*$/\1 \2/')
-      infl="${infl} $(seq -s ' ' ${rng})"
-    done
-    infl=$(echo ${infl} | sed -e 's/ */ /' -e 's/^ *//')
-    echo "${infl}"
-  fi
-}
-
-#
-#
-kill_from_pidfile() {
-  local pidfile="$1"
-  if test -f "$pidfile"; then
-    local pid=`head -n 1 "$pidfile"`
-    if test ! -z "$pid"; then
-      kill_pid "$pid"
-    fi
-  fi
-}
-
 # Print the current test step in the output
 teststep () {
 	echo

testdata/fwd_ancil.tdir/fwd_ancil.post

@@ -7,10 +7,10 @@
 # do your teardown here
 . ../common.sh
 kill_pid $FWD_PID
-if grep -F "service stopped" unbound.log; then
+if fgrep "service stopped" unbound.log; then
 	exit 0
 fi
-if grep -F "disable interface-automatic" unbound.log; then
+if fgrep "disable interface-automatic" unbound.log; then
 	echo "skip test"
 	exit 0
 fi

testdata/fwd_ancil.tdir/fwd_ancil.pre

@@ -36,7 +36,7 @@ wait_ldns_testns_up fwd.log
 # wait for unbound to come up
 # string 'Start of service' in log.
 wait_server_up_or_fail unbound.log "start of service" "disable interface-automatic"
-if grep -F "disable interface-automatic" unbound.log; then
+if fgrep "disable interface-automatic" unbound.log; then
 	skip_test "skip test"
 fi
 

testdata/fwd_ancil.tdir/fwd_ancil.test

@@ -7,7 +7,7 @@
 PRE="../.."
 . ../common.sh
 
-if grep -F "disable interface-automatic" unbound.log; then
+if fgrep "disable interface-automatic" unbound.log; then
 	echo "skip test"
 	exit 0
 fi

testdata/fwd_bogus.tdir/fwd_bogus.test

@@ -8,7 +8,7 @@ PRE="../.."
 
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/fwd_capsid.tdir/fwd_capsid.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/fwd_capsid_fallback.tdir/fwd_capsid_fallback.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT wwwabcdefghijklmnopqrstuvwxyzwww.example.com | tee outfile
+dig @localhost -p $UNBOUND_PORT wwwabcdefghijklmnopqrstuvwxyzwww.example.com | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/fwd_capsid_strip.tdir/fwd_capsid_strip.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT wwwabcdefghijklmnopqrstuvwxyzwww.example.com | tee outfile
+dig @localhost -p $UNBOUND_PORT wwwabcdefghijklmnopqrstuvwxyzwww.example.com | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat fwd2.log 

testdata/fwd_capsid_white.tdir/fwd_capsid_white.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT wwwabcdefghijklmnopqrstuvwxyzwww.example.com | tee outfile
+dig @localhost -p $UNBOUND_PORT wwwabcdefghijklmnopqrstuvwxyzwww.example.com | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat fwd2.log 

testdata/fwd_edns_bksec.tdir/fwd_edns_bksec.test

@@ -10,7 +10,7 @@ PRE="../.."
 # First the nasty name.
 # The server should not have performed EDNS fallback and cached it.
 echo "> dig nasty.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT nasty.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT nasty.example.com. | tee outfile
 
 # no answer possible for it.
 echo "> check backed-off"
@@ -27,7 +27,7 @@ fi
 # Then the www name.
 # See if we can still get the EDNS data.
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/fwd_edns_probe.tdir/fwd_edns_probe.test

@@ -10,7 +10,7 @@ PRE="../.."
 # First the nasty name.
 # The server should not have performed EDNS fallback and cached it.
 echo "> dig nasty.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT nasty.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT nasty.example.com. | tee outfile
 
 # no answer possible for it.
 echo "> check no-answer"
@@ -27,7 +27,7 @@ fi
 # Then the www name.
 # See if we can still get the EDNS data.
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/fwd_malformed.tdir/fwd_malformed.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/fwd_no_edns.tdir/fwd_no_edns.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/fwd_oneport.tdir/fwd_oneport.post

@@ -9,7 +9,7 @@
 kill_pid $FWD_PID
 
 # find all extra forked testns and kill them.
-pidlist=`grep -F "forked pid:" fwd.log | sed -e 's/forked pid: //'`
+pidlist=`fgrep "forked pid:" fwd.log | sed -e 's/forked pid: //'`
 for p in $pidlist; do
 	kill_pid $p
 done

testdata/fwd_oneport.tdir/fwd_oneport.test

@@ -11,7 +11,7 @@ PRE="../.."
 # so that all three queries get timeouts during the later test.
 #
 #echo "> dig www1.example.com."
-#dig @127.0.0.1 -p $UNBOUND_PORT www1.example.com. | tee outfile
+#dig @localhost -p $UNBOUND_PORT www1.example.com. | tee outfile
 #echo "> cat logfiles"
 #cat fwd.log 
 #cat unbound.log
@@ -24,17 +24,17 @@ PRE="../.."
 #fi
 
 echo "> do queries"
-dig @127.0.0.1 -p $UNBOUND_PORT www1.example.com. >outfile1 &
+dig @localhost -p $UNBOUND_PORT www1.example.com. >outfile1 &
 digpid1=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. >outfile2 &
+dig @localhost -p $UNBOUND_PORT www2.example.com. >outfile2 &
 digpid2=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www3.example.com. >outfile3 &
+dig @localhost -p $UNBOUND_PORT www3.example.com. >outfile3 &
 digpid3=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www4.example.com. >outfile4 &
+dig @localhost -p $UNBOUND_PORT www4.example.com. >outfile4 &
 digpid4=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www5.example.com. >outfile5 &
+dig @localhost -p $UNBOUND_PORT www5.example.com. >outfile5 &
 digpid5=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www6.example.com. >outfile6 &
+dig @localhost -p $UNBOUND_PORT www6.example.com. >outfile6 &
 digpid6=$!
 sleep 12
 kill -9 $digpid1

testdata/fwd_tcp.tdir/fwd_tcp.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 +vc -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost +vc -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/fwd_tcp_tc.tdir/fwd_tcp_tc.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/fwd_three.tdir/fwd_three.post

@@ -11,7 +11,7 @@
 kill_pid $FWD_PID
 
 # find all extra forked testns and kill them.
-pidlist=`grep -F "forked pid:" fwd.log | sed -e 's/forked pid: //'`
+pidlist=`fgrep "forked pid:" fwd.log | sed -e 's/forked pid: //'`
 for p in $pidlist; do
 	kill_pid $p
 done

testdata/fwd_three.tdir/fwd_three.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig www1.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www1.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www1.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log
@@ -20,11 +20,11 @@ else
 fi
 
 echo "> do three queries"
-dig @127.0.0.1 -p $UNBOUND_PORT +retry=10 +time=1 www1.example.com. >outfile1 &
+dig @localhost -p $UNBOUND_PORT +retry=10 +time=1 www1.example.com. >outfile1 &
 digpid1=$!
-dig @127.0.0.1 -p $UNBOUND_PORT +retry=10 +time=1 www2.example.com. >outfile2 &
+dig @localhost -p $UNBOUND_PORT +retry=10 +time=1 www2.example.com. >outfile2 &
 digpid2=$!
-dig @127.0.0.1 -p $UNBOUND_PORT +retry=10 +time=1 www3.example.com. >outfile3 &
+dig @localhost -p $UNBOUND_PORT +retry=10 +time=1 www3.example.com. >outfile3 &
 digpid3=$!
 sleep 5
 kill -9 $digpid1

testdata/fwd_three_service.tdir/fwd_three_service.post

@@ -11,7 +11,7 @@
 kill_pid $FWD_PID
 
 # find all extra forked testns and kill them.
-pidlist=`grep -F "forked pid:" fwd.log | sed -e 's/forked pid: //'`
+pidlist=`fgrep "forked pid:" fwd.log | sed -e 's/forked pid: //'`
 for p in $pidlist; do
 	kill_pid $p
 done

testdata/fwd_three_service.tdir/fwd_three_service.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig www1.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www1.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www1.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log
@@ -20,11 +20,11 @@ else
 fi
 
 echo "> do three queries"
-dig @127.0.0.1 -p $UNBOUND_PORT www1.example.com. >outfile1 &
+dig @localhost -p $UNBOUND_PORT www1.example.com. >outfile1 &
 digpid1=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. >outfile2 &
+dig @localhost -p $UNBOUND_PORT www2.example.com. >outfile2 &
 digpid2=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www3.example.com. >outfile3 &
+dig @localhost -p $UNBOUND_PORT www3.example.com. >outfile3 &
 digpid3=$!
 sleep 5
 kill -9 $digpid1

testdata/fwd_ttlexpire.tdir/fwd_ttlexpire.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> check answer"
 if grep "10.20.30.40" outfile; then
 	echo "OK"
@@ -20,7 +20,7 @@ sleep 4
 # query again
 rm outfile
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> check answer"
 if grep "10.20.30.40" outfile; then
 	echo "OK"

testdata/fwd_udp.tdir/fwd_udp.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/fwd_udp_with_tcp_upstream.tdir/fwd_udp_with_tcp_upstream.test

@@ -7,7 +7,7 @@
 PRE="../.."
 # do the test
 echo "> dig tcp.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT tcp.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT tcp.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log
@@ -20,7 +20,7 @@ else
 fi
 
 echo "> dig udp.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT udp.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT udp.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log
 cat unbound.log

testdata/fwd_udptmout.tdir/fwd_udptmout.post

@@ -10,7 +10,7 @@
 kill_pid $FWD_PID
 
 # find all extra forked testns and kill them.
-pidlist=`grep -F "forked pid:" fwd.log | sed -e 's/forked pid: //'`
+pidlist=`fgrep "forked pid:" fwd.log | sed -e 's/forked pid: //'`
 for p in $pidlist; do
 	kill_pid $p
 done

testdata/fwd_udptmout.tdir/fwd_udptmout.test

@@ -11,7 +11,7 @@ PRE="../.."
 # so that all three queries get timeouts during the later test.
 #
 #echo "> dig www1.example.com."
-#dig @127.0.0.1 -p $UNBOUND_PORT www1.example.com. | tee outfile
+#dig @localhost -p $UNBOUND_PORT www1.example.com. | tee outfile
 #echo "> cat logfiles"
 #cat fwd.log 
 #cat unbound.log
@@ -24,17 +24,17 @@ PRE="../.."
 #fi
 
 echo "> do queries"
-dig @127.0.0.1 -p $UNBOUND_PORT www1.example.com. >outfile1 &
+dig @localhost -p $UNBOUND_PORT www1.example.com. >outfile1 &
 digpid1=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. >outfile2 &
+dig @localhost -p $UNBOUND_PORT www2.example.com. >outfile2 &
 digpid2=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www3.example.com. >outfile3 &
+dig @localhost -p $UNBOUND_PORT www3.example.com. >outfile3 &
 digpid3=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www4.example.com. >outfile4 &
+dig @localhost -p $UNBOUND_PORT www4.example.com. >outfile4 &
 digpid4=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www5.example.com. >outfile5 &
+dig @localhost -p $UNBOUND_PORT www5.example.com. >outfile5 &
 digpid5=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www6.example.com. >outfile6 &
+dig @localhost -p $UNBOUND_PORT www6.example.com. >outfile6 &
 digpid6=$!
 
 sleep 15

testdata/fwd_waitudp.tdir/fwd_waitudp.post

@@ -11,7 +11,7 @@
 kill_pid $FWD_PID
 
 # find all extra forked testns and kill them.
-pidlist=`grep -F "forked pid:" fwd.log | sed -e 's/forked pid: //'`
+pidlist=`fgrep "forked pid:" fwd.log | sed -e 's/forked pid: //'`
 for p in $pidlist; do
 	kill_pid $p
 done

testdata/fwd_waitudp.tdir/fwd_waitudp.test

@@ -11,7 +11,7 @@ PRE="../.."
 # so that all three queries get timeouts during the later test.
 #
 #echo "> dig www1.example.com."
-#dig @127.0.0.1 -p $UNBOUND_PORT www1.example.com. | tee outfile
+#dig @localhost -p $UNBOUND_PORT www1.example.com. | tee outfile
 #echo "> cat logfiles"
 #cat fwd.log 
 #cat unbound.log
@@ -24,11 +24,11 @@ PRE="../.."
 #fi
 
 echo "> do three queries"
-dig @127.0.0.1 -p $UNBOUND_PORT www1.example.com. >outfile1 &
+dig @localhost -p $UNBOUND_PORT www1.example.com. >outfile1 &
 digpid1=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. >outfile2 &
+dig @localhost -p $UNBOUND_PORT www2.example.com. >outfile2 &
 digpid2=$!
-dig @127.0.0.1 -p $UNBOUND_PORT www3.example.com. >outfile3 &
+dig @localhost -p $UNBOUND_PORT www3.example.com. >outfile3 &
 digpid3=$!
 sleep 15
 kill -9 $digpid1

testdata/fwd_zero.tdir/fwd_zero.test

@@ -17,7 +17,7 @@ echo "b4380100000100000000000003777777076578616d706c6503636f6d00" | xxd -r -p |
 
 # now test that server is still up
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/http_user_agent.tdir/http_user_agent.test

@@ -9,35 +9,35 @@ PRE="../.."
 # Query and check check that we get the correct answer from the auth_zone
 query () {
 	echo "> dig www.example.com."
-	dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+	dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 	if grep SERVFAIL outfile; then
 		echo "> try again"
-		dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+		dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 	fi
 	if grep SERVFAIL outfile; then
 		echo "> try again"
 		sleep 1
-		dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+		dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 	fi
 	if grep SERVFAIL outfile; then
 		echo "> try again"
 		sleep 1
-		dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+		dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 	fi
 	if grep SERVFAIL outfile; then
 		echo "> try again"
 		sleep 1
-		dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+		dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 	fi
 	if grep SERVFAIL outfile; then
 		echo "> try again"
 		sleep 10
-		dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+		dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 	fi
 	if grep SERVFAIL outfile; then
 		echo "> try again"
 		sleep 10
-		dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+		dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 	fi
 	echo "> check answer"
 	if grep "1.2.3.4" outfile; then

testdata/iter_cname_minimise_nx.rpl

@@ -241,5 +241,6 @@ v.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 ex
 example.com.	3600	IN	NSEC	abc.example.com. NS SOA RRSIG NSEC DNSKEY
 example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. ABEOu6iietfjKY1MS0TutZZxUtRYA6XKsC1rMTrenwBF2darY3/Emco=
 ENTRY_END
+ENTRY_END
 
 SCENARIO_END

testdata/iter_dname_insec.rpl

@@ -397,7 +397,7 @@ ENTRY_END
 
 STEP 220302 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
+MATCH all
 REPLY QR RD RA DO
 SECTION QUESTION
 a.example.com. IN A
@@ -420,7 +420,7 @@ ENTRY_END
 
 STEP 220402 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
+MATCH all
 REPLY QR RD RA DO
 SECTION QUESTION
 a.b.example.com. IN A
@@ -523,7 +523,7 @@ ENTRY_END
 
 STEP 220702 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
+MATCH all
 REPLY QR RD RA DO
 SECTION QUESTION
 a.x.example.com. IN A
@@ -607,7 +607,7 @@ ENTRY_END
 
 STEP 220802 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
+MATCH all
 REPLY QR RD RA DO
 SECTION QUESTION
 a2.example.com. IN A
@@ -691,14 +691,14 @@ ENTRY_END
 ; CNAME chains should be followed and CNAME loops signalled as an error
 STEP 220902 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
+MATCH all
 REPLY QR RD RA DO
 REPLY NOERROR
 SECTION QUESTION
 cyc.example.com. IN A
 SECTION ANSWER
-example.com.	3600	IN	DNAME	example.com.
-cyc.example.com.	3600	IN	CNAME	cyc.example.com.
+example.com.	0	IN	DNAME	example.com.
+cyc.example.com.	0	IN	CNAME	cyc.example.com.
 ENTRY_END
 
 ; ns1.example.com.
@@ -857,7 +857,7 @@ ENTRY_END
 
 STEP 221102 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
+MATCH all
 REPLY QR RD RA DO
 SECTION QUESTION
 shortloop.x.x.	IN TXT
@@ -885,7 +885,7 @@ ENTRY_END
 
 STEP 221202 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
+MATCH all
 REPLY QR RD RA DO
 SECTION QUESTION
 shortloop.x.	IN TXT
@@ -999,7 +999,7 @@ ENTRY_END
 ; query returning maximal permissible length - should work
 STEP 229002 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
+MATCH all
 REPLY QR RD RA DO
 SECTION QUESTION
 x.long.	IN A

testdata/iter_dname_ttl.rpl

@@ -1,310 +0,0 @@
-; config options
-; The island of trust is at example.com
-; validation is enabled because the pickup of DNAME from cache wants
-; a DNSSEC signed DNAME.
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	trust-anchor: "example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test iterator for TTL of synthesized CNAME of a DNAME from cache.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN CNAME
-SECTION ANSWER
-www.example.com. IN	CNAME	www.example.net.
-www.example.com.        3600    IN      RRSIG   CNAME DSA 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFGcJxnNxpWCBzXejiSdl4p1BKRMnAhUApoJrugVBRwFgAoYAhhqlZFac7fE= ;{id = 2854}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www2.example.com. IN A
-SECTION ANSWER
-www2.example.com.	3600	IN	CNAME	www.example.net.
-www2.example.com.	3600	IN	RRSIG	CNAME 3 3 3600 20070926135752 20070829135752 2854 example.com. AGgh6pDCL7VF0uJablClW7cgvsPuNzpHZ+M7nZIwi61+0RPhFZLHcN4=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-foo.test-dname.example.com. IN A
-SECTION ANSWER
-test-dname.example.com.	3600	IN	DNAME	example.net.
-test-dname.example.com.	3600	IN	RRSIG	DNAME 3 3 3600 20070926135752 20070829135752 2854 example.com. ACp31Evt1c6tKzmTh/smAuGFydZ1OO26Qkej/BW4Bw5RFBQiKaY22Z0=
-foo.test-dname.example.com. 3600 IN CNAME foo.example.net.
-ENTRY_END
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.	IN NS	ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net. IN	A	11.12.13.14
-www.example.net.        3600    IN      RRSIG   A 5 3 3600 20070926134150 20070829134150 30899 example.net. CPxF5hK9Kg5eT7W6LgZwr0ePYEm9HMcSY4vvqCS6gDWB4X9jvXLCfBkCLhsNybPBpGWlsLi5wM6MTdJXuPpsRA== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-foo.example.net. IN A
-SECTION ANSWER
-foo.example.net. IN	A	11.12.13.15
-foo.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.net. X6T6SE9UzxAD/4zKpwGOxEDyE4g7lfYYw3lvw533uwRN8mWTcBvSva0/jjyhrogJcuLO32jPHK6zGb93w2xnuA==
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-foo2.example.net. IN A
-SECTION ANSWER
-foo2.example.net. IN	A	11.12.13.16
-foo2.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.net. BZm+GljD8m9N+pNJN8D+LlSyHqM+InNUe0+heKILR9be+Goqv6SEb7LKtX6+kj3239Y5by7u+/Cuk8kkWistEQ==
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-STEP 1 TIME_PASSES ELAPSE 10
-; Get DNAME in cache and then pick it up again from cache.
-STEP 10 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-foo.test-dname.example.com. IN A
-ENTRY_END
-
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-foo.test-dname.example.com. IN A
-SECTION ANSWER
-test-dname.example.com.	3600	IN	DNAME	example.net.
-test-dname.example.com.	3600	IN	RRSIG	DNAME 3 3 3600 20070926135752 20070829135752 2854 example.com. ACp31Evt1c6tKzmTh/smAuGFydZ1OO26Qkej/BW4Bw5RFBQiKaY22Z0=
-foo.test-dname.example.com. 3600 IN CNAME foo.example.net.
-foo.example.net. IN	A	11.12.13.15
-foo.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.net. X6T6SE9UzxAD/4zKpwGOxEDyE4g7lfYYw3lvw533uwRN8mWTcBvSva0/jjyhrogJcuLO32jPHK6zGb93w2xnuA==
-ENTRY_END
-
-STEP 30 TIME_PASSES ELAPSE 10
-
-; Use DNAME from cache
-STEP 40 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-foo2.test-dname.example.com. IN A
-ENTRY_END
-
-; Test the TTL on the synthesized CNAME for the DNAME record from cache.
-STEP 50 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-foo2.test-dname.example.com. IN A
-SECTION ANSWER
-test-dname.example.com.	3590	IN	DNAME	example.net.
-test-dname.example.com.	3590	IN	RRSIG	DNAME 3 3 3600 20070926135752 20070829135752 2854 example.com. ACp31Evt1c6tKzmTh/smAuGFydZ1OO26Qkej/BW4Bw5RFBQiKaY22Z0=
-foo2.test-dname.example.com. 3590 IN CNAME foo2.example.net.
-foo2.example.net. 	3600	IN	A	11.12.13.16
-foo2.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.net. BZm+GljD8m9N+pNJN8D+LlSyHqM+InNUe0+heKILR9be+Goqv6SEb7LKtX6+kj3239Y5by7u+/Cuk8kkWistEQ==
-ENTRY_END
-
-SCENARIO_END

testdata/iter_dname_yx.rpl

@@ -2,8 +2,6 @@
 server:
 	harden-referral-path: no
 	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	minimal-responses: no
 
 stub-zone:
         name: "."
@@ -323,6 +321,680 @@ ENTRY_END
 RANGE_END
 ; end of a.gtld-servers.net.
 
+; RFC 6672 section 2.2. The DNAME Substitution table tests
+;#  QNAME            owner  DNAME   target         result
+;-- ---------------- -------------- -------------- -----------------
+;1  com.             example.com.   example.net.   <no match>
+;2  example.com.     example.com.   example.net.   [0]
+;3  a.example.com.   example.com.   example.net.   a.example.net.
+;4  a.b.example.com. example.com.   example.net.   a.b.example.net.
+;5  ab.example.com.  b.example.com. example.net.   <no match>
+;6  foo.example.com. example.com.   example.net.   foo.example.net.
+;7  a.x.example.com. x.example.com. example.net.   a.example.net.
+;8  a.example.com.   example.com.   y.example.net. a.y.example.net.
+;9  cyc.example.com. example.com.   example.com.   cyc.example.com.
+;10 cyc.example.com. example.com.   c.example.com. cyc.c.example.com.
+;11 shortloop.x.x.   x.             .              shortloop.x.
+;12 shortloop.x.     x.             .              shortloop.
+;
+;  [0] The result depends on the QTYPE.  If the QTYPE = DNAME, then
+;      the result is "example.com.", else "<no match>".
+;
+;                  Table 1. DNAME Substitution Examples
+
+;        ; line no. 1 is mostly for authoritative server
+;        ; line no. 2 QTYPE != DNAME
+;        STEP 220201 QUERY
+;        ENTRY_BEGIN
+;        REPLY RD DO
+;        SECTION QUESTION
+;        example.com. IN NS
+;        ENTRY_END
+;        
+;        STEP 220202 CHECK_ANSWER
+;        ENTRY_BEGIN
+;        MATCH rcode answer
+;        REPLY QR RD RA DO
+;        SECTION QUESTION
+;        example.com. IN NS
+;        SECTION ANSWER
+;        example.com. IN NS ns1.example.com.
+;        ENTRY_END
+;        
+;        ; line no. 2 QTYPE == DNAME
+;        STEP 220203 QUERY
+;        ENTRY_BEGIN
+;        REPLY RD DO
+;        SECTION QUESTION
+;        example.com. IN DNAME
+;        ENTRY_END
+;        
+;        STEP 220204 CHECK_ANSWER
+;        ENTRY_BEGIN
+;        MATCH rcode question answer
+;        REPLY QR RD RA DO
+;        SECTION QUESTION
+;        example.com. IN DNAME
+;        SECTION ANSWER
+;        example.com. IN DNAME example.net.
+;        ENTRY_END
+;        
+;        
+;        ;#  QNAME            owner  DNAME   target         result
+;        ;-- ---------------- -------------- -------------- -----------------
+;        ;3  a.example.com.   example.com.   example.net.   a.example.net.
+;        
+;        STEP 220301 QUERY
+;        ENTRY_BEGIN
+;        REPLY RD DO
+;        SECTION QUESTION
+;        a.example.com. IN A
+;        ENTRY_END
+;        
+;        STEP 220302 CHECK_ANSWER
+;        ENTRY_BEGIN
+;        MATCH rcode question answer
+;        SECTION QUESTION
+;        a.example.com. IN A
+;        SECTION ANSWER
+;        example.com. IN DNAME example.net.
+;        a.example.com. IN CNAME a.example.net.
+;        a.example.net. IN A 10.0.0.97
+;        ENTRY_END
+;        
+;        ;#  QNAME            owner  DNAME   target         result
+;        ;-- ---------------- -------------- -------------- -----------------
+;        ;4  a.b.example.com. example.com.   example.net.   a.b.example.net.
+;        
+;        STEP 220401 QUERY
+;        ENTRY_BEGIN
+;        REPLY RD DO
+;        SECTION QUESTION
+;        a.b.example.com. IN A
+;        ENTRY_END
+;        
+;        STEP 220402 CHECK_ANSWER
+;        ENTRY_BEGIN
+;        MATCH rcode question answer
+;        SECTION QUESTION
+;        a.b.example.com. IN A
+;        SECTION ANSWER
+;        example.com. IN DNAME example.net.
+;        a.b.example.com. IN CNAME a.b.example.net.
+;        a.b.example.net. IN A 10.0.97.98
+;        ENTRY_END
+;        
+;        ;#  QNAME            owner  DNAME   target         result
+;        ;-- ---------------- -------------- -------------- -----------------
+;        ;5  ab.example.com.  b.example.com. example.net.   <no match>
+;        ;6  foo.example.com. example.com.   example.net.   foo.example.net.
+;        
+;        ; line no. 5 is mostly for authoritative server
+;        ; line no. 6 is basically the same as line no. 3
+;        
+;        ; ns1.example.com.
+;        RANGE_BEGIN 220000 220699
+;        	ADDRESS 168.192.2.2
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        example.com. IN NS
+;        SECTION ANSWER
+;        example.com. IN NS ns1.example.com.
+;        SECTION ADDITIONAL
+;        ns1.example.com. IN A 168.192.2.2
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        ns1.example.com. IN A
+;        SECTION ANSWER
+;        ns1.example.com. IN A 168.192.2.2
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        ns1.example.com. IN AAAA
+;        SECTION ANSWER
+;        ENTRY_END
+;        
+;        ; line 2 DNAME
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        example.com. IN DNAME
+;        SECTION ANSWER
+;        example.com. IN DNAME example.net.
+;        ENTRY_END
+;        
+;        ; line 3
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        a.example.com. IN A
+;        SECTION ANSWER
+;        example.com. IN DNAME example.net.
+;        a.example.com. IN CNAME a.example.net.
+;        ENTRY_END
+;        
+;        ; line 4
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        a.b.example.com. IN A
+;        SECTION ANSWER
+;        example.com. IN DNAME example.net.
+;        a.b.example.com. IN CNAME a.b.example.net.
+;        ENTRY_END
+;        RANGE_END
+;        ; end of ns1.example.com.
+;        
+;        
+;        ;#  QNAME            owner  DNAME   target         result
+;        ;-- ---------------- -------------- -------------- -----------------
+;        ;7  a.x.example.com. x.example.com. example.net.   a.example.net.
+;        
+;        STEP 220701 QUERY
+;        ENTRY_BEGIN
+;        REPLY RD DO
+;        SECTION QUESTION
+;        a.x.example.com. IN A
+;        ENTRY_END
+;        
+;        STEP 220702 CHECK_ANSWER
+;        ENTRY_BEGIN
+;        MATCH rcode question answer
+;        SECTION QUESTION
+;        a.x.example.com. IN A
+;        SECTION ANSWER
+;        x.example.com. IN DNAME example.net.
+;        a.x.example.com. IN CNAME a.example.net.
+;        a.example.net. IN A 10.0.0.97
+;        ENTRY_END
+;        
+;        ; ns1.example.com.
+;        RANGE_BEGIN 220700 220799
+;        	ADDRESS 168.192.2.2
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        example.com. IN NS
+;        SECTION ANSWER
+;        example.com. IN NS ns1.example.com.
+;        SECTION ADDITIONAL
+;        ns1.example.com. IN A 168.192.2.2
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        ns1.example.com. IN A
+;        SECTION ANSWER
+;        ns1.example.com. IN A 168.192.2.2
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        ns1.example.com. IN AAAA
+;        SECTION ANSWER
+;        ENTRY_END
+;        
+;        ; line 7 DNAME
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        example.com. IN DNAME
+;        SECTION ANSWER
+;        x.example.com. IN DNAME example.net.
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        a.x.example.com. IN A
+;        SECTION ANSWER
+;        x.example.com. IN DNAME example.net.
+;        a.x.example.com. IN CNAME a.example.net.
+;        ENTRY_END
+;        RANGE_END
+;        ; end of ns1.example.com.
+;        
+;        ;#  QNAME            owner  DNAME   target         result
+;        ;-- ---------------- -------------- -------------- -----------------
+;        ;8  a.example.com.   example.com.   y.example.net. a.y.example.net.
+;        ;
+;        ; a.example.com. was renamed to a2.example.com. to avoid cache clashes
+;        ; on the synthetized CNAME (caching CNAMEs is allowed by RFC 6672 section 3.4)
+;        
+;        STEP 220801 QUERY
+;        ENTRY_BEGIN
+;        REPLY RD DO
+;        SECTION QUESTION
+;        a2.example.com. IN A
+;        ENTRY_END
+;        
+;        STEP 220802 CHECK_ANSWER
+;        ENTRY_BEGIN
+;        MATCH rcode question answer
+;        SECTION QUESTION
+;        a2.example.com. IN A
+;        SECTION ANSWER
+;        example.com. IN DNAME y.example.net.
+;        a2.example.com. IN CNAME a2.y.example.net.
+;        a2.y.example.net. IN A 10.97.50.121
+;        ENTRY_END
+;        
+;        ; ns1.example.com.
+;        RANGE_BEGIN 220800 220899
+;        	ADDRESS 168.192.2.2
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        example.com. IN NS
+;        SECTION ANSWER
+;        example.com. IN NS ns1.example.com.
+;        SECTION ADDITIONAL
+;        ns1.example.com. IN A 168.192.2.2
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        ns1.example.com. IN A
+;        SECTION ANSWER
+;        ns1.example.com. IN A 168.192.2.2
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        ns1.example.com. IN AAAA
+;        SECTION ANSWER
+;        ENTRY_END
+;        
+;        ; line 8 DNAME
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        example.com. IN DNAME
+;        SECTION ANSWER
+;        example.com. IN DNAME y.example.net.
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        a2.example.com. IN A
+;        SECTION ANSWER
+;        example.com. IN DNAME y.example.net.
+;        a2.example.com. IN CNAME a2.y.example.net.
+;        ENTRY_END
+;        RANGE_END
+;        ; end of ns1.example.com.
+;        
+;        
+;        ;#  QNAME            owner  DNAME   target         result
+;        ;-- ---------------- -------------- -------------- -----------------
+;        ;9  cyc.example.com. example.com.   example.com.   cyc.example.com.
+;        
+;        STEP 220901 QUERY
+;        ENTRY_BEGIN
+;        REPLY RD DO
+;        SECTION QUESTION
+;        cyc.example.com. IN A
+;        ENTRY_END
+;        
+;        ; Expected result is defined by RFC 1034 section 3.6.2:
+;        ; CNAME chains should be followed and CNAME loops signalled as an error
+;        STEP 220902 CHECK_ANSWER
+;        ENTRY_BEGIN
+;        MATCH rcode question answer
+;        REPLY SERVFAIL
+;        SECTION QUESTION
+;        cyc.example.com. IN A
+;        ENTRY_END
+;        
+;        ; ns1.example.com.
+;        RANGE_BEGIN 220900 220999
+;        	ADDRESS 168.192.2.2
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        example.com. IN NS
+;        SECTION ANSWER
+;        example.com. IN NS ns1.example.com.
+;        SECTION ADDITIONAL
+;        ns1.example.com. IN A 168.192.2.2
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        ns1.example.com. IN A
+;        SECTION ANSWER
+;        ns1.example.com. IN A 168.192.2.2
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        ns1.example.com. IN AAAA
+;        SECTION ANSWER
+;        ENTRY_END
+;        
+;        ; line 9 DNAME
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        example.com. IN DNAME
+;        SECTION ANSWER
+;        example.com. IN DNAME example.com.
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        cyc.example.com. IN A
+;        SECTION ANSWER
+;        example.com. IN DNAME example.com.
+;        cyc.example.com. IN CNAME cyc.example.com.
+;        ENTRY_END
+;        RANGE_END
+;        ; end of ns1.example.com.
+;        
+;        ;#  QNAME            owner  DNAME   target         result
+;        ;-- ---------------- -------------- -------------- -----------------
+;        ;10 cyc.example.com. example.com.   c.example.com. cyc.c.example.com.
+;        ;
+;        ; cyc.example.com. was renamed to cyc2.example.com. to avoid cache clashes
+;        ; on the synthetized CNAME (caching CNAMEs is allowed by RFC 6672 section 3.4)
+;        ;
+;        ; target c.example.com. was renamed to cyc2.example.net.
+;        ; to limit number of pre-canned answers required for the test
+;        
+;        STEP 221001 QUERY
+;        ENTRY_BEGIN
+;        REPLY RD DO
+;        SECTION QUESTION
+;        cyc2.example.com. IN A
+;        ENTRY_END
+;        
+;        ; Expected result is defined by RFC 1034 section 3.6.2:
+;        ; CNAME chains should be followed and CNAME loops signalled as an error
+;        STEP 221002 CHECK_ANSWER
+;        ENTRY_BEGIN
+;        MATCH rcode question answer
+;        REPLY SERVFAIL
+;        SECTION QUESTION
+;        cyc2.example.com. IN A
+;        ENTRY_END
+;        
+;        ; ns1.example.com.
+;        RANGE_BEGIN 221000 221099
+;        	ADDRESS 168.192.2.2
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        example.com. IN NS
+;        SECTION ANSWER
+;        example.com. IN NS ns1.example.com.
+;        SECTION ADDITIONAL
+;        ns1.example.com. IN A 168.192.2.2
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        ns1.example.com. IN A
+;        SECTION ANSWER
+;        ns1.example.com. IN A 168.192.2.2
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        ns1.example.com. IN AAAA
+;        SECTION ANSWER
+;        ENTRY_END
+;        
+;        ; line 10 DNAME
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        example.com. IN DNAME
+;        SECTION ANSWER
+;        example.com. IN DNAME cyc2.example.net.
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        cyc2.example.com. IN A
+;        SECTION ANSWER
+;        example.com. IN DNAME cyc2.example.net.
+;        cyc2.example.com. IN CNAME cyc2.cyc2.example.net.
+;        ENTRY_END
+;        RANGE_END
+;        ; end of ns1.example.com.
+;        
+;        ;#  QNAME            owner  DNAME   target         result
+;        ;-- ---------------- -------------- -------------- -----------------
+;        ;11 shortloop.x.x.   x.             .              shortloop.x.
+;        
+;        STEP 221101 QUERY
+;        ENTRY_BEGIN
+;        REPLY RD DO
+;        SECTION QUESTION
+;        shortloop.x.x.	TXT
+;        ENTRY_END
+;        
+;        STEP 221102 CHECK_ANSWER
+;        ENTRY_BEGIN
+;        MATCH rcode question answer
+;        SECTION QUESTION
+;        shortloop.x.x.	IN TXT
+;        SECTION ANSWER
+;        x.		IN DNAME	.
+;        ; unbound hack
+;        x.		IN DNAME	.
+;        shortloop.x.x.	IN CNAME	shortloop.x.
+;        shortloop.x.	IN CNAME	shortloop.
+;        shortloop.	IN TXT		"shortloop end"
+;        ENTRY_END
+;        
+;        ;#  QNAME            owner  DNAME   target         result
+;        ;-- ---------------- -------------- -------------- -----------------
+;        ;12 shortloop.x.     x.             .              shortloop.
+;        
+;        ; expire potentically cached CNAMEs for shortloop.x. from cache
+;        STEP 221200 TIME_PASSES ELAPSE 10000
+;        
+;        STEP 221201 QUERY
+;        ENTRY_BEGIN
+;        REPLY RD DO
+;        SECTION QUESTION
+;        shortloop.x.	TXT
+;        ENTRY_END
+;        
+;        STEP 221202 CHECK_ANSWER
+;        ENTRY_BEGIN
+;        MATCH rcode question answer
+;        SECTION QUESTION
+;        shortloop.x.	IN TXT
+;        SECTION ANSWER
+;        x.		IN DNAME	.
+;        shortloop.x.	IN CNAME	shortloop.
+;        shortloop.	IN TXT		"shortloop end"
+;        ENTRY_END
+;        
+;        
+;        ; ns1.example.net. (data shared by whole 22xxxx range)
+;        RANGE_BEGIN 220000 229999
+;        	ADDRESS 168.192.3.3
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        example.net. IN NS
+;        SECTION ANSWER
+;        example.net. IN NS ns1.example.net.
+;        SECTION ADDITIONAL
+;        example.net. IN A 168.192.3.3
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        ns1.example.net. IN A
+;        SECTION ANSWER
+;        ns1.example.net. IN A 168.192.3.3
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        ns1.example.net. IN AAAA
+;        SECTION ANSWER
+;        ENTRY_END
+;        
+;        ; line 3
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        a.example.net. IN A
+;        SECTION ANSWER
+;        a.example.net. IN A 10.0.0.97
+;        ENTRY_END
+;        
+;        ; line 4
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        a.b.example.net. IN A
+;        SECTION ANSWER
+;        a.b.example.net. IN A 10.0.97.98
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        a2.y.example.net. IN A
+;        SECTION ANSWER
+;        a2.y.example.net. IN A 10.97.50.121
+;        ENTRY_END
+;        
+;        ; line 10
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        cyc2.example.net. IN DNAME
+;        SECTION ANSWER
+;        cyc2.example.net. IN DNAME example.com.
+;        ENTRY_END
+;        
+;        ENTRY_BEGIN
+;        MATCH opcode qtype qname
+;        ADJUST copy_id
+;        REPLY QR AA NOERROR
+;        SECTION QUESTION
+;        cyc2.cyc2.example.net. IN A
+;        SECTION ANSWER
+;        cyc2.example.net. IN DNAME example.com.
+;        cyc2.cyc2.example.com. IN CNAME cyc2.example.com.
+;        ENTRY_END
+;        RANGE_END
+;        ; end of ns1.example.net.
+;        
+;        
+;        ; RFC 6672 section 2.2: YXDOMAIN answers for too long results for substitution
+;        ; RFC 6672 section 2.3: DNAME can be at zone apex: zone apex = long.
+;        STEP 229001 QUERY
+;        ENTRY_BEGIN
+;        REPLY RD DO
+;        SECTION QUESTION
+;        x.long.	IN A
+;        ENTRY_END
+;        
+;        ; query returning maximal permissible length - should work
+;        STEP 229002 CHECK_ANSWER
+;        ENTRY_BEGIN
+;        MATCH rcode question answer
+;        SECTION QUESTION
+;        x.long.	IN A
+;        SECTION ANSWER
+;        long.			3600	IN	DNAME	63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.60o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
+;        x.long.			3600	IN	CNAME	x.63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.60o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
+;        x.63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.60o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.	3600	IN	A	192.0.2.1
+;        ENTRY_END
+
 ; result of substitution has too long name
 ; YXDOMAIN should be propagated to the client
 ; Unbound SEVFAILs: https://www.ietf.org/mail-archive/web/dnsext/current/msg11282.html
@@ -343,4 +1015,27 @@ SECTION ANSWER
 long.			3600	IN	DNAME	63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.60o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
 ENTRY_END
 
+    ; ; YXDOMAIN should work even if the cache is empty
+    ; STEP 229005 TIME_PASSES ELAPSE 4000
+    ; 
+    ; STEP 229006 QUERY
+    ; ENTRY_BEGIN
+    ; REPLY RD DO
+    ; SECTION QUESTION
+    ; too.long.	IN A
+    ; ENTRY_END
+    ; 
+    ; STEP 229007 CHECK_ANSWER
+    ; ENTRY_BEGIN
+    ; MATCH rcode question answer
+    ; REPLY QR YXDOMAIN
+    ; SECTION QUESTION
+    ; x.long.	IN A
+    ; SECTION ANSWER
+    ; long.			3600	IN	DNAME	63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.63o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.60o-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.
+    ; ENTRY_END
+
+
+
+
 SCENARIO_END

testdata/iter_ghost_sub.rpl

@@ -19,7 +19,7 @@ MATCH opcode qtype qname
 ADJUST copy_id
 REPLY QR NOERROR
 SECTION QUESTION
-. IN NS
+. 86400 IN NS
 SECTION ANSWER
 . 86400 IN NS	K.ROOT-SERVERS.NET.
 SECTION ADDITIONAL

testdata/iter_scrub_dname_insec.rpl

@@ -166,7 +166,7 @@ ENTRY_END
 ; answer to first query (simply puts DNAME in cache)
 STEP 120 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
+MATCH all
 REPLY QR RD RA
 SECTION QUESTION
 x.y.example.com. IN A
@@ -235,7 +235,7 @@ ENTRY_END
 
 STEP 250 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
+MATCH all
 REPLY QR RD RA
 SECTION QUESTION
 other.y.example.com. IN A

testdata/local_cname.rpl

@@ -52,10 +52,6 @@ server:
 	local-zone: example.net redirect
 	local-data: "example.net. IN CNAME cname.example.org."
 
-	# Test setup for synthesized CNAMEs
-	local-zone: synth.cname redirect
-	local-data: "synth.cname. IN CNAME *.from.resolution."
-
 	### template zone and tag intended to be used for tests with CNAME and
 	### other data.
 	##local-zone: ambiguous.example.com redirect
@@ -137,18 +133,6 @@ SECTION AUTHORITY
 SECTION ADDITIONAL
 ENTRY_END
 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.synth.cname.from.resolution. IN A
-SECTION ANSWER
-www.synth.cname.from.resolution. IN A 192.0.2.3
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
 ENTRY_BEGIN
 MATCH opcode qtype qname
 ADJUST copy_id
@@ -412,26 +396,6 @@ SECTION AUTHORITY
 SECTION ADDITIONAL
 ENTRY_END
 
-; Check CNAME synthesis
-STEP 201 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.synth.cname. IN A
-ENTRY_END
-
-STEP 202 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA AA NOERROR
-SECTION QUESTION
-www.synth.cname. IN A
-SECTION ANSWER
-www.synth.cname. IN CNAME www.synth.cname.from.resolution.
-www.synth.cname.from.resolution. IN A 192.0.2.3
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
 
 ; Relatively minor cases follow
 

testdata/local_nodefault.tdir/local_nodefault.test

@@ -9,7 +9,7 @@ PRE="../.."
 # this one should have NXDOMAIN builtin
 #
 echo "> dig 1.0.31.172.in-addr.arpa."
-dig @127.0.0.1 -p $UNBOUND_PORT 1.0.31.172.in-addr.arpa. | tee outfile
+dig @localhost -p $UNBOUND_PORT 1.0.31.172.in-addr.arpa. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log
@@ -23,7 +23,7 @@ fi
 
 # this one should give our own data as the reply
 echo "> dig 1.0.30.172.in-addr.arpa."
-dig @127.0.0.1 -p $UNBOUND_PORT 1.0.30.172.in-addr.arpa. | tee outfile
+dig @localhost -p $UNBOUND_PORT 1.0.30.172.in-addr.arpa. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log
@@ -38,7 +38,7 @@ fi
 # this one should give our own data as the reply
 # but different trailing dot in unbound.conf file
 echo "> dig 1.0.29.172.in-addr.arpa."
-dig @127.0.0.1 -p $UNBOUND_PORT 1.0.29.172.in-addr.arpa. | tee outfile
+dig @localhost -p $UNBOUND_PORT 1.0.29.172.in-addr.arpa. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/local_norec.tdir/local_norec.test

@@ -11,7 +11,7 @@ PRE="../.."
 # foo.example.com is available through local-data (and recursion...).
 #
 echo "> dig www.example.com. +RD"
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log
@@ -24,7 +24,7 @@ else
 fi
 
 echo "> dig www.example.com. +norec"
-dig @127.0.0.1 +norec -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost +norec -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log
@@ -37,7 +37,7 @@ else
 fi
 
 echo "> dig foo.example.com. +RD"
-dig @127.0.0.1 -p $UNBOUND_PORT foo.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT foo.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log
@@ -50,7 +50,7 @@ else
 fi
 
 echo "> dig foo.example.com. +norec"
-dig @127.0.0.1 +norec -p $UNBOUND_PORT foo.example.com. | tee outfile
+dig @localhost +norec -p $UNBOUND_PORT foo.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/local_nosnoop.tdir/local_nosnoop.test

@@ -14,7 +14,7 @@ PRE="../.."
 # 	dig +norec for www does not work any more.
 #
 echo "> dig www.example.com. +RD"
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log
@@ -27,7 +27,7 @@ else
 fi
 
 echo "> dig www.example.com. +norec"
-dig @127.0.0.1 +norec -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost +norec -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log
@@ -47,7 +47,7 @@ else
 fi
 
 echo "> dig foo.example.com. +RD"
-dig @127.0.0.1 -p $UNBOUND_PORT foo.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT foo.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log
@@ -60,7 +60,7 @@ else
 fi
 
 echo "> dig foo.example.com. +norec"
-dig @127.0.0.1 +norec -p $UNBOUND_PORT foo.example.com. | tee outfile
+dig @localhost +norec -p $UNBOUND_PORT foo.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log

testdata/padding.tdir/padding.post

@@ -9,13 +9,13 @@
 PRE="../.."
 kill_pid $DNSTAP_SOCKET_PID
 kill_pid $FWD_PID
-kill_from_pidfile "unbound2.pid"
+kill_pid `cat unbound2.pid`
 if test -f unbound2.log; then
 	echo ">>> upstream log"
 	cat unbound2.log
 fi
 #kill_pid $UNBOUND_PID
-kill_from_pidfile "unbound.pid"
+kill_pid `cat unbound.pid`
 if test -f unbound.log; then
 	echo ">>> unbound log"
 	cat unbound.log

testdata/padding.tdir/padding.test

@@ -25,10 +25,17 @@ else
         exit 1
 fi
 
-echo "> wait for log to happen"
-wait_logfile tap.log "www.example.com" 45
+echo "> wait for log to happen on timer"
+sleep 3
 echo "> check tap.log for dnstap info"
 # see if it logged the information in tap.log
+# wait for a moment for filesystem to catch up.
+if grep "www.example.com" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "www.example.com" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "www.example.com" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "www.example.com" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "www.example.com" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "www.example.com" tap.log >/dev/null; then :; else sleep 10; fi
 if grep "www.example.com" tap.log; then echo "yes it is in tap.log";
 else
         echo "information not in tap.log"
@@ -60,7 +67,12 @@ fi
 echo "> check tap.log for dnstap info"
 # see if it logged the information in tap.log
 # wait for a moment for filesystem to catch up.
-wait_logfile tap.log "txt.example.com" 45
+if grep "txt.example.com" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "txt.example.com" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "txt.example.com" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "txt.example.com" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "txt.example.com" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "txt.example.com" tap.log >/dev/null; then :; else sleep 10; fi
 if grep "txt.example.com" tap.log; then echo "yes it is in tap.log";
 else
         echo "information not in tap.log"
@@ -119,7 +131,12 @@ dig @127.0.0.1 -p $UNBOUND_PORT fin.example.com. TXT | tee outfile
 echo "> check tap.log for dnstap info"
 # see if it logged the information in tap.log
 # wait for a moment for filesystem to catch up.
-wait_logfile tap.log "fini" 45
+if grep "fini" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "fini" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "fini" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "fini" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "fini" tap.log >/dev/null; then :; else sleep 1; fi
+if grep "fini" tap.log >/dev/null; then :; else sleep 10; fi
 if grep "fini" tap.log; then echo "yes it is in tap.log";
 else
         echo "information not in tap.log"

testdata/pymod.tdir/pymod.test

@@ -22,7 +22,7 @@ fi
 
 # do the test
 echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log
@@ -35,7 +35,7 @@ else
 fi
 
 echo "> dig www2.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www2.example.com. | tee outfile
+dig @localhost -p $UNBOUND_PORT www2.example.com. | tee outfile
 echo "> cat logfiles"
 cat fwd.log 
 cat unbound.log