Shumon's invalid query type EDE return

increased, a timer is started when the dtio thread is sleeping,
  the timer set disabled when the dtio thread goes to sleep, and
  after sleep the thread checks to see if there are messages to log
  immediately.

.gitignore

@@ -10,6 +10,9 @@
 /config.status
 /dnstap/dnstap_config.h
 /dnscrypt/dnscrypt_config.h
+/util/configlexer.c
+/util/configparser.c
+/util/configparser.h
 /clubsyms.def
 /doc/example.conf
 /doc/libunbound.3
@@ -55,6 +58,7 @@
 /pythonmod/unboundmodule.py
 /testdata/result.*
 /testdata/.done-*
+/testdata/.skip-*
 /testdata/.perfstats.txt
 /doc/html
 /doc/xml

Makefile.in

@@ -439,7 +439,8 @@ unbound-control-setup:	smallapp/unbound-control-setup.sh
 dnstap.lo dnstap.o: $(srcdir)/dnstap/dnstap.c config.h dnstap/dnstap_config.h \
 	dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h $(srcdir)/dnstap/dnstap.h \
 	$(srcdir)/util/config_file.h $(srcdir)/util/log.h \
-	$(srcdir)/util/netevent.h $(srcdir)/util/net_help.h
+	$(srcdir)/util/netevent.h $(srcdir)/util/net_help.h \
+	$(srcdir)/util/locks.h
 
 dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h: $(srcdir)/dnstap/dnstap.proto
 	@-if test ! -d dnstap; then $(INSTALL) -d dnstap; fi

acx_python.m4

@@ -9,7 +9,7 @@ AC_DEFUN([AC_PYTHON_DEVEL],[
 
         AC_PATH_PROG([PYTHON],[python[$PYTHON_VERSION]])
         if test -z "$PYTHON"; then
-           AC_MSG_ERROR([Cannot find python$PYTHON_VERSION in your system path])
+           AC_MSG_ERROR([Cannot find 'python$PYTHON_VERSION' in your system path. You can use the environment variable 'PYTHON_VERSION=version_number' for an explicit version.])
            PYTHON_VERSION=""
         fi
 

cachedb/cachedb.c

@@ -322,30 +322,30 @@ error_response(struct module_qstate* qstate, int id, int rcode)
 
 /**
  * Hash the query name, type, class and dbacess-secret into lookup buffer.
- * @param qstate: query state with query info
- * 	and env->cfg with secret.
+ * @param qinfo: query info
+ * @param env: with env->cfg with secret.
  * @param buf: returned buffer with hash to lookup
  * @param len: length of the buffer.
  */
 static void
-calc_hash(struct module_qstate* qstate, char* buf, size_t len)
+calc_hash(struct query_info* qinfo, struct module_env* env, char* buf,
+	size_t len)
 {
 	uint8_t clear[1024];
 	size_t clen = 0;
 	uint8_t hash[CACHEDB_HASHSIZE/8];
 	const char* hex = "0123456789ABCDEF";
-	const char* secret = qstate->env->cfg->cachedb_secret;
+	const char* secret = env->cfg->cachedb_secret;
 	size_t i;
 
 	/* copy the hash info into the clear buffer */
-	if(clen + qstate->qinfo.qname_len < sizeof(clear)) {
-		memmove(clear+clen, qstate->qinfo.qname,
-			qstate->qinfo.qname_len);
-		clen += qstate->qinfo.qname_len;
+	if(clen + qinfo->qname_len < sizeof(clear)) {
+		memmove(clear+clen, qinfo->qname, qinfo->qname_len);
+		clen += qinfo->qname_len;
 	}
 	if(clen + 4 < sizeof(clear)) {
-		uint16_t t = htons(qstate->qinfo.qtype);
-		uint16_t c = htons(qstate->qinfo.qclass);
+		uint16_t t = htons(qinfo->qtype);
+		uint16_t c = htons(qinfo->qclass);
 		memmove(clear+clen, &t, 2);
 		memmove(clear+clen+2, &c, 2);
 		clen += 4;
@@ -645,7 +645,7 @@ cachedb_extcache_lookup(struct module_qstate* qstate, struct cachedb_env* ie,
 	int* msg_expired)
 {
 	char key[(CACHEDB_HASHSIZE/8)*2+1];
-	calc_hash(qstate, key, sizeof(key));
+	calc_hash(&qstate->qinfo, qstate->env, key, sizeof(key));
 
 	/* call backend to fetch data for key into scratch buffer */
 	if( !(*ie->backend->lookup)(qstate->env, ie, key,
@@ -672,7 +672,7 @@ static void
 cachedb_extcache_store(struct module_qstate* qstate, struct cachedb_env* ie)
 {
 	char key[(CACHEDB_HASHSIZE/8)*2+1];
-	calc_hash(qstate, key, sizeof(key));
+	calc_hash(&qstate->qinfo, qstate->env, key, sizeof(key));
 
 	/* prepare data in scratch buffer */
 	if(!prep_data(qstate, qstate->env->scratch_buffer))
@@ -745,6 +745,10 @@ cachedb_intcache_store(struct module_qstate* qstate, int msg_expired)
 		 * going to be now-3 seconds. Making it expired
 		 * in the cache. */
 		set_msg_ttl(qstate->return_msg, (time_t)-3);
+		/* The expired entry does not get checked by the validator
+		 * and we need a validation value for it. */
+		if(qstate->env->cfg->cachedb_check_when_serve_expired)
+			qstate->return_msg->rep->security = sec_status_insecure;
 	}
 	(void)dns_cache_store(qstate->env, &qstate->qinfo,
 		qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
@@ -979,7 +983,7 @@ cachedb_get_mem(struct module_env* env, int id)
  */
 static struct module_func_block cachedb_block = {
 	"cachedb",
-	&cachedb_init, &cachedb_deinit, &cachedb_operate,
+	NULL, NULL, &cachedb_init, &cachedb_deinit, &cachedb_operate,
 	&cachedb_inform_super, &cachedb_clear, &cachedb_get_mem
 };
 
@@ -1004,20 +1008,25 @@ cachedb_is_enabled(struct module_stack* mods, struct module_env* env)
 
 void cachedb_msg_remove(struct module_qstate* qstate)
 {
-	char key[(CACHEDB_HASHSIZE/8)*2+1];
-	int id = modstack_find(qstate->env->modstack, "cachedb");
-	struct cachedb_env* ie = (struct cachedb_env*)qstate->env->modinfo[id];
+	cachedb_msg_remove_qinfo(qstate->env, &qstate->qinfo);
+}
 
-	log_query_info(VERB_ALGO, "cachedb msg remove", &qstate->qinfo);
-	calc_hash(qstate, key, sizeof(key));
-	sldns_buffer_clear(qstate->env->scratch_buffer);
-	sldns_buffer_write_u32(qstate->env->scratch_buffer, 0);
-	sldns_buffer_flip(qstate->env->scratch_buffer);
+void cachedb_msg_remove_qinfo(struct module_env* env, struct query_info* qinfo)
+{
+	char key[(CACHEDB_HASHSIZE/8)*2+1];
+	int id = modstack_find(env->modstack, "cachedb");
+	struct cachedb_env* ie = (struct cachedb_env*)env->modinfo[id];
+
+	log_query_info(VERB_ALGO, "cachedb msg remove", qinfo);
+	calc_hash(qinfo, env, key, sizeof(key));
+	sldns_buffer_clear(env->scratch_buffer);
+	sldns_buffer_write_u32(env->scratch_buffer, 0);
+	sldns_buffer_flip(env->scratch_buffer);
 
 	/* call backend */
-	(*ie->backend->store)(qstate->env, ie, key,
-		sldns_buffer_begin(qstate->env->scratch_buffer),
-		sldns_buffer_limit(qstate->env->scratch_buffer),
+	(*ie->backend->store)(env, ie, key,
+		sldns_buffer_begin(env->scratch_buffer),
+		sldns_buffer_limit(env->scratch_buffer),
 		0);
 }
 #endif /* USE_CACHEDB */

cachedb/cachedb.h

@@ -126,3 +126,11 @@ int cachedb_is_enabled(struct module_stack* mods, struct module_env* env);
  * @param qstate: query state.
  */
 void cachedb_msg_remove(struct module_qstate* qstate);
+
+/**
+ * Remove message from the cachedb cache, by query info.
+ * @param env: module environment to look up cachedb state.
+ * @param qinfo: the message to remove.
+ */
+void cachedb_msg_remove_qinfo(struct module_env* env,
+	struct query_info* qinfo);

config.h.in

@@ -406,6 +406,9 @@
 /* Define to 1 if you have the <net/if.h> header file. */
 #undef HAVE_NET_IF_H
 
+/* Define to 1 if you have the <net/pfvar.h> header file. */
+#undef HAVE_NET_PFVAR_H
+
 /* Define this to use nghttp2 client. */
 #undef HAVE_NGHTTP2
 
@@ -566,6 +569,9 @@
    function. */
 #undef HAVE_SSL_CTX_SET_TLSEXT_TICKET_KEY_EVP_CB
 
+/* Define to 1 if you have the `SSL_CTX_set_tmp_ecdh' function. */
+#undef HAVE_SSL_CTX_SET_TMP_ECDH
+
 /* Define to 1 if you have the `SSL_get0_alpn_selected' function. */
 #undef HAVE_SSL_GET0_ALPN_SELECTED
 

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for unbound 1.20.0.
+# Generated by GNU Autoconf 2.71 for unbound 1.20.1.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues>.
 #
@@ -622,8 +622,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.20.0'
-PACKAGE_STRING='unbound 1.20.0'
+PACKAGE_VERSION='1.20.1'
+PACKAGE_STRING='unbound 1.20.1'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues'
 PACKAGE_URL=''
 
@@ -1508,7 +1508,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.20.0 to adapt to many kinds of systems.
+\`configure' configures unbound 1.20.1 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1574,7 +1574,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.20.0:";;
+     short | recursive ) echo "Configuration of unbound 1.20.1:";;
    esac
   cat <<\_ACEOF
 
@@ -1596,7 +1596,8 @@ Optional Features:
   --disable-libtool-lock  avoid locking (might break parallel builds)
   --disable-rpath         disable hardcoded rpath (default=enabled)
   --disable-largefile     omit support for large files
-  --enable-systemd        compile with systemd support
+  --enable-systemd        compile with systemd support (requires libsystemd,
+                          pkg-config)
   --enable-alloc-checks   enable to memory allocation statistics, for debug
                           purposes
   --enable-alloc-lite     enable for lightweight alloc assertions, for debug
@@ -1821,7 +1822,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.20.0
+unbound configure 1.20.1
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2478,7 +2479,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.20.0, which was
+It was created by unbound $as_me 1.20.1, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -3242,11 +3243,11 @@ UNBOUND_VERSION_MAJOR=1
 
 UNBOUND_VERSION_MINOR=20
 
-UNBOUND_VERSION_MICRO=0
+UNBOUND_VERSION_MICRO=1
 
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=27
+LIBUNBOUND_REVISION=28
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -3341,6 +3342,7 @@ LIBUNBOUND_AGE=1
 # 1.19.2 had 9:25:1
 # 1.19.3 had 9:26:1
 # 1.20.0 had 9:27:1
+# 1.20.1 had 9:28:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -17623,7 +17625,8 @@ have_systemd=no
 if test "x$enable_systemd" != xno
 then :
 
-
+    if test -n "$PKG_CONFIG"; then
+		have_systemd=no
 
 pkg_failed=no
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for SYSTEMD" >&5
@@ -17683,11 +17686,31 @@ fi
 	# Put the nasty error message in config.log where it belongs
 	echo "$SYSTEMD_PKG_ERRORS" >&5
 
-	have_systemd=no
+	as_fn_error $? "Package requirements (libsystemd) were not met:
+
+$SYSTEMD_PKG_ERRORS
+
+Consider adjusting the PKG_CONFIG_PATH environment variable if you
+installed software in a non-standard prefix.
+
+Alternatively, you may set the environment variables SYSTEMD_CFLAGS
+and SYSTEMD_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
      	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
 printf "%s\n" "no" >&6; }
-	have_systemd=no
+	{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "The pkg-config script could not be found or is too old.  Make sure it
+is in your PATH or set the PKG_CONFIG environment variable to the full
+path to pkg-config.
+
+Alternatively, you may set the environment variables SYSTEMD_CFLAGS
+and SYSTEMD_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details.
+
+To get pkg-config, see <http://pkg-config.freedesktop.org/>.
+See \`config.log' for more details" "$LINENO" 5; }
 else
 	SYSTEMD_CFLAGS=$pkg_cv_SYSTEMD_CFLAGS
 	SYSTEMD_LIBS=$pkg_cv_SYSTEMD_LIBS
@@ -17698,6 +17721,7 @@ fi
 		if test "x$have_systemd" != "xyes"
 then :
 
+		have_systemd_daemon=no
 
 pkg_failed=no
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for SYSTEMD_DAEMON" >&5
@@ -17757,11 +17781,31 @@ fi
 	# Put the nasty error message in config.log where it belongs
 	echo "$SYSTEMD_DAEMON_PKG_ERRORS" >&5
 
-	have_systemd_daemon=no
+	as_fn_error $? "Package requirements (libsystemd-daemon) were not met:
+
+$SYSTEMD_DAEMON_PKG_ERRORS
+
+Consider adjusting the PKG_CONFIG_PATH environment variable if you
+installed software in a non-standard prefix.
+
+Alternatively, you may set the environment variables SYSTEMD_DAEMON_CFLAGS
+and SYSTEMD_DAEMON_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details." "$LINENO" 5
 elif test $pkg_failed = untried; then
      	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
 printf "%s\n" "no" >&6; }
-	have_systemd_daemon=no
+	{ { printf "%s\n" "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5
+printf "%s\n" "$as_me: error: in \`$ac_pwd':" >&2;}
+as_fn_error $? "The pkg-config script could not be found or is too old.  Make sure it
+is in your PATH or set the PKG_CONFIG environment variable to the full
+path to pkg-config.
+
+Alternatively, you may set the environment variables SYSTEMD_DAEMON_CFLAGS
+and SYSTEMD_DAEMON_LIBS to avoid the need to call pkg-config.
+See the pkg-config man page for more details.
+
+To get pkg-config, see <http://pkg-config.freedesktop.org/>.
+See \`config.log' for more details" "$LINENO" 5; }
 else
 	SYSTEMD_DAEMON_CFLAGS=$pkg_cv_SYSTEMD_DAEMON_CFLAGS
 	SYSTEMD_DAEMON_LIBS=$pkg_cv_SYSTEMD_DAEMON_LIBS
@@ -17788,7 +17832,9 @@ printf "%s\n" "#define HAVE_SYSTEMD 1" >>confdefs.h
   *) :
      ;;
 esac
-
+    else
+    	as_fn_error $? "systemd enabled but need pkg-config to configure for it" "$LINENO" 5
+    fi
 
 fi
  if test "x$have_systemd" = xyes; then
@@ -19184,7 +19230,7 @@ fi
 
 
         if test -z "$PYTHON"; then
-           as_fn_error $? "Cannot find python$PYTHON_VERSION in your system path" "$LINENO" 5
+           as_fn_error $? "Cannot find 'python$PYTHON_VERSION' in your system path. You can use the environment variable 'PYTHON_VERSION=version_number' for an explicit version." "$LINENO" 5
            PYTHON_VERSION=""
         fi
 
@@ -20655,6 +20701,12 @@ then :
   printf "%s\n" "#define HAVE_BIO_SET_CALLBACK_EX 1" >>confdefs.h
 
 fi
+ac_fn_c_check_func "$LINENO" "SSL_CTX_set_tmp_ecdh" "ac_cv_func_SSL_CTX_set_tmp_ecdh"
+if test "x$ac_cv_func_SSL_CTX_set_tmp_ecdh" = xyes
+then :
+  printf "%s\n" "#define HAVE_SSL_CTX_SET_TMP_ECDH 1" >>confdefs.h
+
+fi
 
 
 # these check_funcs need -lssl
@@ -21189,7 +21241,25 @@ case "$enable_ecdsa" in
       ;;
     *)
       if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
-	      ac_fn_c_check_func "$LINENO" "ECDSA_sign" "ac_cv_func_ECDSA_sign"
+	      ac_fn_c_check_func "$LINENO" "EVP_PKEY_fromdata" "ac_cv_func_EVP_PKEY_fromdata"
+if test "x$ac_cv_func_EVP_PKEY_fromdata" = xyes
+then :
+
+	          # with EVP_PKEY_fromdata, check if EC is not disabled
+	          ac_fn_check_decl "$LINENO" "OPENSSL_NO_EC" "ac_cv_have_decl_OPENSSL_NO_EC" "$ac_includes_default
+#include <openssl/evp.h>
+
+" "$ac_c_undeclared_builtin_options" "CFLAGS"
+if test "x$ac_cv_have_decl_OPENSSL_NO_EC" = xyes
+then :
+  as_fn_error $? "OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa" "$LINENO" 5
+
+fi
+
+else $as_nop
+
+		  # without EVP_PKEY_fromdata, older openssl, check for support
+		  ac_fn_c_check_func "$LINENO" "ECDSA_sign" "ac_cv_func_ECDSA_sign"
 if test "x$ac_cv_func_ECDSA_sign" = xyes
 then :
 
@@ -21197,12 +21267,15 @@ else $as_nop
   as_fn_error $? "OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa" "$LINENO" 5
 fi
 
-	      ac_fn_c_check_func "$LINENO" "SHA384_Init" "ac_cv_func_SHA384_Init"
+		  ac_fn_c_check_func "$LINENO" "SHA384_Init" "ac_cv_func_SHA384_Init"
 if test "x$ac_cv_func_SHA384_Init" = xyes
 then :
 
 else $as_nop
   as_fn_error $? "OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa" "$LINENO" 5
+fi
+
+
 fi
 
 	      ac_fn_check_decl "$LINENO" "NID_X9_62_prime256v1" "ac_cv_have_decl_NID_X9_62_prime256v1" "$ac_includes_default
@@ -23732,7 +23805,7 @@ then :
 
 else $as_nop
 
-
+                if test -n "$PKG_CONFIG"; then
 
 pkg_failed=no
 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for PROTOBUFC" >&5
@@ -23793,36 +23866,36 @@ fi
 	echo "$PROTOBUFC_PKG_ERRORS" >&5
 
 
-                                # pkg-config failed; try falling back to known values
-                                # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                                if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
-                                    CFLAGS="$CFLAGS -I/usr/include/google"
+                            # pkg-config failed; try falling back to known values
+                            # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+                            if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
+                                CFLAGS="$CFLAGS -I/usr/include/google"
+                            else
+                                if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
+                                    CFLAGS="$CFLAGS -I/usr/local/include/google"
+                                    LDFLAGS="$LDFLAGS -L/usr/local/lib"
                                 else
-                                    if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
-                                        CFLAGS="$CFLAGS -I/usr/local/include/google"
-                                        LDFLAGS="$LDFLAGS -L/usr/local/lib"
-                                    else
-                                        as_fn_error $? "The protobuf-c package was not found with pkg-config. Please install protobuf-c!" "$LINENO" 5
-                                    fi
+                                    as_fn_error $? "The protobuf-c package was not found with pkg-config. Please install protobuf-c!" "$LINENO" 5
                                 fi
+                            fi
 
 
 elif test $pkg_failed = untried; then
      	{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: no" >&5
 printf "%s\n" "no" >&6; }
 
-                                # pkg-config failed; try falling back to known values
-                                # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                                if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
-                                    CFLAGS="$CFLAGS -I/usr/include/google"
+                            # pkg-config failed; try falling back to known values
+                            # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+                            if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
+                                CFLAGS="$CFLAGS -I/usr/include/google"
+                            else
+                                if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
+                                    CFLAGS="$CFLAGS -I/usr/local/include/google"
+                                    LDFLAGS="$LDFLAGS -L/usr/local/lib"
                                 else
-                                    if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
-                                        CFLAGS="$CFLAGS -I/usr/local/include/google"
-                                        LDFLAGS="$LDFLAGS -L/usr/local/lib"
-                                    else
-                                        as_fn_error $? "The protobuf-c package was not found with pkg-config. Please install protobuf-c!" "$LINENO" 5
-                                    fi
+                                    as_fn_error $? "The protobuf-c package was not found with pkg-config. Please install protobuf-c!" "$LINENO" 5
                                 fi
+                            fi
 
 
 else
@@ -23831,11 +23904,21 @@ else
         { printf "%s\n" "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 printf "%s\n" "yes" >&6; }
 
-                                CFLAGS="$CFLAGS $PROTOBUFC_CFLAGS"
-                                LIBS="$LIBS $PROTOBUFC_LIBS"
+                            CFLAGS="$CFLAGS $PROTOBUFC_CFLAGS"
+                            LIBS="$LIBS $PROTOBUFC_LIBS"
 
 fi
-
+                else
+                    # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+                    if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
+                        CFLAGS="$CFLAGS -I/usr/include/google"
+                    else
+                        if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
+                            CFLAGS="$CFLAGS -I/usr/local/include/google"
+                            LDFLAGS="$LDFLAGS -L/usr/local/lib"
+                        fi
+                    fi
+                fi
 
 
 fi
@@ -24234,7 +24317,21 @@ printf "%s\n" "#define USE_IPSET 1" >>confdefs.h
 		IPSET_OBJ="ipset.lo"
 
 
-		# mnl
+		# BSD's pf
+		       for ac_header in net/pfvar.h
+do :
+  ac_fn_c_check_header_compile "$LINENO" "net/pfvar.h" "ac_cv_header_net_pfvar_h" "
+		  #include <netinet/in.h>
+		  #include <net/if.h>
+
+"
+if test "x$ac_cv_header_net_pfvar_h" = xyes
+then :
+  printf "%s\n" "#define HAVE_NET_PFVAR_H 1" >>confdefs.h
+
+else $as_nop
+
+		    # mnl
 
 # Check whether --with-libmnl was given.
 if test ${with_libmnl+y}
@@ -24244,13 +24341,13 @@ else $as_nop
    withval="yes"
 fi
 
-		found_libmnl="no"
-		{ printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for libmnl" >&5
+		    found_libmnl="no"
+		    { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for libmnl" >&5
 printf %s "checking for libmnl... " >&6; }
-		if test x_$withval = x_ -o x_$withval = x_yes; then
+		    if test x_$withval = x_ -o x_$withval = x_yes; then
 			withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
-		fi
-		for dir in $withval ; do
+		    fi
+		    for dir in $withval ; do
 			if test -f "$dir/include/libmnl/libmnl.h" -o -f "$dir/include/libmnl/libmnl/libmnl.h"; then
 				found_libmnl="yes"
 								extralibmnl=""
@@ -24268,10 +24365,14 @@ printf "%s\n" "found in $dir" >&6; }
 				LIBS="$LIBS -lmnl"
 				break;
 			fi
-		done
-		if test x_$found_libmnl != x_yes; then
-			as_fn_error $? "Could not find libmnl, libmnl.h" "$LINENO" 5
-		fi
+		    done
+		    if test x_$found_libmnl != x_yes; then
+			  as_fn_error $? "Could not find libmnl, libmnl.h" "$LINENO" 5
+		    fi
+
+fi
+
+done
 		;;
     no|*)
     	# nothing
@@ -24466,7 +24567,7 @@ printf "%s\n" "#define MAXSYSLOGMSGLEN 10240" >>confdefs.h
 
 
 
-version=1.20.0
+version=1.20.1
 
 date=`date +'%b %e, %Y'`
 
@@ -24978,7 +25079,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.20.0, which was
+This file was extended by unbound $as_me 1.20.1, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -25046,7 +25147,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-unbound config.status 1.20.0
+unbound config.status 1.20.1
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 

configure.ac

@@ -11,14 +11,14 @@ sinclude(dnscrypt/dnscrypt.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[20])
-m4_define([VERSION_MICRO],[0])
+m4_define([VERSION_MICRO],[1])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])
 
 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=27
+LIBUNBOUND_REVISION=28
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -113,6 +113,7 @@ LIBUNBOUND_AGE=1
 # 1.19.2 had 9:25:1
 # 1.19.3 had 9:26:1
 # 1.20.0 had 9:27:1
+# 1.20.1 had 9:28:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -943,7 +944,7 @@ else
 	AC_MSG_RESULT([no])
 fi
 AC_CHECK_HEADERS([openssl/conf.h openssl/engine.h openssl/bn.h openssl/dh.h openssl/dsa.h openssl/rsa.h openssl/core_names.h openssl/param_build.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex])
+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512 FIPS_mode EVP_default_properties_is_fips_enabled EVP_MD_CTX_new OpenSSL_add_all_digests OPENSSL_init_crypto EVP_cleanup ENGINE_cleanup ERR_load_crypto_strings CRYPTO_cleanup_all_ex_data ERR_free_strings RAND_cleanup DSA_SIG_set0 EVP_dss1 EVP_DigestVerify EVP_aes_256_cbc EVP_EncryptInit_ex HMAC_Init_ex CRYPTO_THREADID_set_callback EVP_MAC_CTX_set_params OSSL_PARAM_BLD_new BIO_set_callback_ex SSL_CTX_set_tmp_ecdh])
 
 # these check_funcs need -lssl
 BAKLIBS="$LIBS"
@@ -1180,8 +1181,17 @@ case "$enable_ecdsa" in
       ;;
     *)
       if test $USE_NSS = "no" -a $USE_NETTLE = "no"; then
-	      AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])])
-	      AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa])])
+	      AC_CHECK_FUNC(EVP_PKEY_fromdata, [
+	          # with EVP_PKEY_fromdata, check if EC is not disabled
+	          AC_CHECK_DECL([OPENSSL_NO_EC], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])
+		  ], [], [AC_INCLUDES_DEFAULT
+#include <openssl/evp.h>
+		  ])
+		], [
+		  # without EVP_PKEY_fromdata, older openssl, check for support
+		  AC_CHECK_FUNC(ECDSA_sign, [], [AC_MSG_ERROR([OpenSSL does not support ECDSA: please upgrade or rerun with --disable-ecdsa])])
+		  AC_CHECK_FUNC(SHA384_Init, [], [AC_MSG_ERROR([OpenSSL does not support SHA384: please upgrade or rerun with --disable-ecdsa])])
+		])
 	      AC_CHECK_DECLS([NID_X9_62_prime256v1, NID_secp384r1], [], [AC_MSG_ERROR([OpenSSL does not support the ECDSA curves: please upgrade or rerun with --disable-ecdsa])], [AC_INCLUDES_DEFAULT
 #include <openssl/evp.h>
 	      ])
@@ -1921,15 +1931,17 @@ case "$enable_ipset" in
 		IPSET_OBJ="ipset.lo"
 		AC_SUBST(IPSET_OBJ)
 
-		# mnl
-		AC_ARG_WITH(libmnl, AS_HELP_STRING([--with-libmnl=path],[specify explicit path for libmnl.]),
+		# BSD's pf
+		AC_CHECK_HEADERS([net/pfvar.h], [], [
+		    # mnl
+		    AC_ARG_WITH(libmnl, AS_HELP_STRING([--with-libmnl=path],[specify explicit path for libmnl.]),
 			[ ],[ withval="yes" ])
-		found_libmnl="no"
-		AC_MSG_CHECKING(for libmnl)
-		if test x_$withval = x_ -o x_$withval = x_yes; then
+		    found_libmnl="no"
+		    AC_MSG_CHECKING(for libmnl)
+		    if test x_$withval = x_ -o x_$withval = x_yes; then
 			withval="/usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr"
-		fi
-		for dir in $withval ; do
+		    fi
+		    for dir in $withval ; do
 			if test -f "$dir/include/libmnl/libmnl.h" -o -f "$dir/include/libmnl/libmnl/libmnl.h"; then
 				found_libmnl="yes"
 				dnl assume /usr is in default path.
@@ -1947,10 +1959,14 @@ case "$enable_ipset" in
 				LIBS="$LIBS -lmnl"
 				break;
 			fi
-		done
-		if test x_$found_libmnl != x_yes; then
-			AC_MSG_ERROR([Could not find libmnl, libmnl.h])
-		fi
+		    done
+		    if test x_$found_libmnl != x_yes; then
+			  AC_MSG_ERROR([Could not find libmnl, libmnl.h])
+		    fi
+		], [
+		  #include <netinet/in.h>
+		  #include <net/if.h>
+		])
 		;;
     no|*)
     	# nothing

contrib/unbound.service.in

@@ -42,8 +42,8 @@
 [Unit]
 Description=Validating, recursive, and caching DNS resolver
 Documentation=man:unbound(8)
-After=network.target
-Before=network-online.target nss-lookup.target
+After=network-online.target
+Before=nss-lookup.target
 
 [Install]
 WantedBy=multi-user.target

contrib/unbound_portable.service.in

@@ -14,8 +14,8 @@
 [Unit]
 Description=Validating, recursive, and caching DNS resolver
 Documentation=man:unbound(8)
-After=network.target
-Before=network-online.target nss-lookup.target
+After=network-online.target
+Before=nss-lookup.target
 Wants=nss-lookup.target
 
 [Install]

daemon/daemon.c

@@ -344,7 +344,7 @@ static int setup_acl_for_ports(struct acl_list* list,
 	return 1;
 }
 
-int 
+int
 daemon_open_shared_ports(struct daemon* daemon)
 {
 	log_assert(daemon);
@@ -444,6 +444,19 @@ daemon_open_shared_ports(struct daemon* daemon)
 	return 1;
 }
 
+int
+daemon_privileged(struct daemon* daemon)
+{
+	daemon->env->cfg = daemon->cfg;
+	daemon->env->alloc = &daemon->superalloc;
+	daemon->env->worker = NULL;
+	if(!modstack_call_startup(&daemon->mods, daemon->cfg->module_conf,
+		daemon->env)) {
+		fatal_exit("failed to startup modules");
+	}
+	return 1;
+}
+
 /**
  * Setup modules. setup module stack.
  * @param daemon: the daemon
@@ -453,11 +466,15 @@ static void daemon_setup_modules(struct daemon* daemon)
 	daemon->env->cfg = daemon->cfg;
 	daemon->env->alloc = &daemon->superalloc;
 	daemon->env->worker = NULL;
-	daemon->env->need_to_validate = 0; /* set by module init below */
-	if(!modstack_setup(&daemon->mods, daemon->cfg->module_conf, 
-		daemon->env)) {
-		fatal_exit("failed to setup modules");
+	if(daemon->mods_inited) {
+		modstack_call_deinit(&daemon->mods, daemon->env);
 	}
+	daemon->env->need_to_validate = 0; /* set by module init below */
+	if(!modstack_call_init(&daemon->mods, daemon->cfg->module_conf,
+		daemon->env)) {
+		fatal_exit("failed to init modules");
+	}
+	daemon->mods_inited = 1;
 	log_edns_known_options(VERB_ALGO, daemon->env);
 }
 
@@ -503,7 +520,10 @@ daemon_clear_allocs(struct daemon* daemon)
 {
 	int i;
 
-	for(i=0; i<daemon->num; i++) {
+	/* daemon->num may be different during reloads (after configuration
+	 * read). Use old_num which has the correct value used to setup the
+	 * worker_allocs */
+	for(i=0; i<daemon->old_num; i++) {
 		alloc_clear(daemon->worker_allocs[i]);
 		free(daemon->worker_allocs[i]);
 	}
@@ -858,7 +878,7 @@ daemon_cleanup(struct daemon* daemon)
 	daemon->views = NULL;
 	if(daemon->env->auth_zones)
 		auth_zones_cleanup(daemon->env->auth_zones);
-	/* key cache is cleared by module desetup during next daemon_fork() */
+	/* key cache is cleared by module deinit during next daemon_fork() */
 	daemon_remote_clear(daemon->rc);
 	for(i=0; i<daemon->num; i++)
 		worker_delete(daemon->workers[i]);
@@ -888,7 +908,9 @@ daemon_delete(struct daemon* daemon)
 	size_t i;
 	if(!daemon)
 		return;
-	modstack_desetup(&daemon->mods, daemon->env);
+	modstack_call_deinit(&daemon->mods, daemon->env);
+	modstack_call_destartup(&daemon->mods, daemon->env);
+	modstack_free(&daemon->mods);
 	daemon_remote_delete(daemon->rc);
 	for(i = 0; i < daemon->num_ports; i++)
 		listening_ports_free(daemon->ports[i]);

daemon/daemon.h

@@ -115,6 +115,8 @@ struct daemon {
 	struct module_env* env;
 	/** stack of module callbacks */
 	struct module_stack mods;
+	/** The module stack has been inited */
+	int mods_inited;
 	/** access control, which client IPs are allowed to connect */
 	struct acl_list* acl;
 	/** access control, which interfaces are allowed to connect */
@@ -162,6 +164,15 @@ struct daemon* daemon_init(void);
  */
 int daemon_open_shared_ports(struct daemon* daemon);
 
+/**
+ * Do daemon setup that needs privileges
+ * like opening privileged ports or opening device files.
+ * The cfg member pointer must have been set for the daemon.
+ * @param daemon: the daemon.
+ * @return: false on error.
+ */
+int daemon_privileged(struct daemon* daemon);
+
 /**
  * Fork workers and start service.
  * When the routine exits, it is no longer forked.

daemon/remote.c

@@ -88,6 +88,9 @@
 #include "sldns/wire2str.h"
 #include "sldns/sbuffer.h"
 #include "util/timeval_func.h"
+#ifdef USE_CACHEDB
+#include "cachedb/cachedb.h"
+#endif
 
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
@@ -107,6 +110,10 @@
 /** what to put on statistics lines between var and value, ": " or "=" */
 #define SQ "="
 
+/** Acceptable lengths of str lines */
+#define MAX_CMD_STRLINE 1024
+#define MAX_STDIN_STRLINE 2048
+
 static int
 remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg)
 {
@@ -633,6 +640,25 @@ static void send_ok(RES* ssl)
 	(void)ssl_printf(ssl, "ok\n");
 }
 
+/** tell other processes to execute the command */
+static void
+distribute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd)
+{
+	int i;
+	if(!cmd || !ssl)
+		return;
+	/* skip i=0 which is me */
+	for(i=1; i<rc->worker->daemon->num; i++) {
+		worker_send_cmd(rc->worker->daemon->workers[i],
+			worker_cmd_remote);
+		if(!tube_write_msg(rc->worker->daemon->workers[i]->cmd,
+			(uint8_t*)cmd, strlen(cmd)+1, 0)) {
+			(void)ssl_printf(ssl, "error could not distribute cmd\n");
+			return;
+		}
+	}
+}
+
 /** do the stop command */
 static void
 do_stop(RES* ssl, struct worker* worker)
@@ -1220,19 +1246,28 @@ do_zone_add(RES* ssl, struct local_zones* zones, char* arg)
 
 /** Do the local_zones command */
 static void
-do_zones_add(RES* ssl, struct local_zones* zones)
+do_zones_add(struct daemon_remote* rc, RES* ssl, struct worker* worker)
 {
-	char buf[2048];
+	char buf[MAX_CMD_STRLINE + MAX_STDIN_STRLINE] = "local_zone ";
 	int num = 0;
-	while(ssl_read_line(ssl, buf, sizeof(buf))) {
-		if(buf[0] == 0 || (buf[0] == 0x04 && buf[1] == 0))
+	size_t cmd_len = strlen(buf);
+	while(ssl_read_line(ssl, buf+cmd_len, MAX_STDIN_STRLINE)) {
+		if(buf[0+cmd_len] == 0 ||
+			(buf[0+cmd_len] == 0x04 && buf[1+cmd_len] == 0))
 			break; /* zero byte line or end of transmission */
-		if(!perform_zone_add(ssl, zones, buf)) {
-			if(!ssl_printf(ssl, "error for input line: %s\n", buf))
+#ifdef THREADS_DISABLED
+		/* distribute single item command */
+		if(rc) distribute_cmd(rc, ssl, buf);
+#else
+		(void)rc; /* unused */
+#endif
+		if(!perform_zone_add(ssl, worker->daemon->local_zones,
+			buf+cmd_len)) {
+			if(!ssl_printf(ssl, "error for input line: %s\n",
+				buf+cmd_len))
 				return;
 		}
-		else
-			num++;
+		else	num++;
 	}
 	(void)ssl_printf(ssl, "added %d zones\n", num);
 }
@@ -1269,19 +1304,28 @@ do_zone_remove(RES* ssl, struct local_zones* zones, char* arg)
 
 /** Do the local_zones_remove command */
 static void
-do_zones_remove(RES* ssl, struct local_zones* zones)
+do_zones_remove(struct daemon_remote* rc, RES* ssl, struct worker* worker)
 {
-	char buf[2048];
+	char buf[MAX_CMD_STRLINE + MAX_STDIN_STRLINE] = "local_zone_remove ";
 	int num = 0;
-	while(ssl_read_line(ssl, buf, sizeof(buf))) {
-		if(buf[0] == 0 || (buf[0] == 0x04 && buf[1] == 0))
+	size_t cmd_len = strlen(buf);
+	while(ssl_read_line(ssl, buf+cmd_len, MAX_STDIN_STRLINE)) {
+		if(buf[0+cmd_len] == 0 ||
+			(buf[0+cmd_len] == 0x04 && buf[1+cmd_len] == 0))
 			break; /* zero byte line or end of transmission */
-		if(!perform_zone_remove(ssl, zones, buf)) {
-			if(!ssl_printf(ssl, "error for input line: %s\n", buf))
+#ifdef THREADS_DISABLED
+		/* distribute single item command */
+		if(rc) distribute_cmd(rc, ssl, buf);
+#else
+		(void)rc; /* unused */
+#endif
+		if(!perform_zone_remove(ssl, worker->daemon->local_zones,
+			buf+cmd_len)) {
+			if(!ssl_printf(ssl, "error for input line: %s\n",
+				buf+cmd_len))
 				return;
 		}
-		else
-			num++;
+		else	num++;
 	}
 	(void)ssl_printf(ssl, "removed %d zones\n", num);
 }
@@ -1333,15 +1377,24 @@ do_data_add(RES* ssl, struct local_zones* zones, char* arg)
 
 /** Do the local_datas command */
 static void
-do_datas_add(RES* ssl, struct local_zones* zones)
+do_datas_add(struct daemon_remote* rc, RES* ssl, struct worker* worker)
 {
-	char buf[2048];
+	char buf[MAX_CMD_STRLINE + MAX_STDIN_STRLINE] = "local_data ";
 	int num = 0, line = 0;
-	while(ssl_read_line(ssl, buf, sizeof(buf))) {
-		if(buf[0] == 0 || (buf[0] == 0x04 && buf[1] == 0))
+	size_t cmd_len = strlen(buf);
+	while(ssl_read_line(ssl, buf+cmd_len, MAX_STDIN_STRLINE)) {
+		if(buf[0+cmd_len] == 0 ||
+			(buf[0+cmd_len] == 0x04 && buf[1+cmd_len] == 0))
 			break; /* zero byte line or end of transmission */
+#ifdef THREADS_DISABLED
+		/* distribute single item command */
+		if(rc) distribute_cmd(rc, ssl, buf);
+#else
+		(void)rc; /* unused */
+#endif
 		line++;
-		if(perform_data_add(ssl, zones, buf, line))
+		if(perform_data_add(ssl, worker->daemon->local_zones,
+			buf+cmd_len, line))
 			num++;
 	}
 	(void)ssl_printf(ssl, "added %d datas\n", num);
@@ -1373,19 +1426,28 @@ do_data_remove(RES* ssl, struct local_zones* zones, char* arg)
 
 /** Do the local_datas_remove command */
 static void
-do_datas_remove(RES* ssl, struct local_zones* zones)
+do_datas_remove(struct daemon_remote* rc, RES* ssl, struct worker* worker)
 {
-	char buf[2048];
+	char buf[MAX_CMD_STRLINE + MAX_STDIN_STRLINE] = "local_data_remove ";
 	int num = 0;
-	while(ssl_read_line(ssl, buf, sizeof(buf))) {
-		if(buf[0] == 0 || (buf[0] == 0x04 && buf[1] == 0))
+	size_t cmd_len = strlen(buf);
+	while(ssl_read_line(ssl, buf+cmd_len, MAX_STDIN_STRLINE)) {
+		if(buf[0+cmd_len] == 0 ||
+			(buf[0+cmd_len] == 0x04 && buf[1+cmd_len] == 0))
 			break; /* zero byte line or end of transmission */
-		if(!perform_data_remove(ssl, zones, buf)) {
-			if(!ssl_printf(ssl, "error for input line: %s\n", buf))
+#ifdef THREADS_DISABLED
+		/* distribute single item command */
+		if(rc) distribute_cmd(rc, ssl, buf);
+#else
+		(void)rc; /* unused */
+#endif
+		if(!perform_data_remove(ssl, worker->daemon->local_zones,
+			buf+cmd_len)) {
+			if(!ssl_printf(ssl, "error for input line: %s\n",
+				buf+cmd_len))
 				return;
 		}
-		else
-			num++;
+		else	num++;
 	}
 	(void)ssl_printf(ssl, "removed %d datas\n", num);
 }
@@ -1473,9 +1535,13 @@ do_view_data_add(RES* ssl, struct worker* worker, char* arg)
 
 /** Add new RR data from stdin to view */
 static void
-do_view_datas_add(RES* ssl, struct worker* worker, char* arg)
+do_view_datas_add(struct daemon_remote* rc, RES* ssl, struct worker* worker,
+	char* arg)
 {
 	struct view* v;
+	char buf[MAX_CMD_STRLINE + MAX_STDIN_STRLINE] = "view_local_data ";
+	size_t cmd_len;
+	int num = 0, line = 0;
 	v = views_find_view(worker->daemon->views,
 		arg, 1 /* get write lock*/);
 	if(!v) {
@@ -1489,8 +1555,25 @@ do_view_datas_add(RES* ssl, struct worker* worker, char* arg)
 			return;
 		}
 	}
-	do_datas_add(ssl, v->local_zones);
+	/* put the view name in the command buf */
+	(void)snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "%s ", arg);
+	cmd_len = strlen(buf);
+	while(ssl_read_line(ssl, buf+cmd_len, MAX_STDIN_STRLINE)) {
+		if(buf[0+cmd_len] == 0 ||
+			(buf[0+cmd_len] == 0x04 && buf[1+cmd_len] == 0))
+			break; /* zero byte line or end of transmission */
+#ifdef THREADS_DISABLED
+		/* distribute single item command */
+		if(rc) distribute_cmd(rc, ssl, buf);
+#else
+		(void)rc; /* unused */
+#endif
+		line++;
+		if(perform_data_add(ssl, v->local_zones, buf+cmd_len, line))
+			num++;
+	}
 	lock_rw_unlock(&v->lock);
+	(void)ssl_printf(ssl, "added %d datas\n", num);
 }
 
 /** Remove RR data from view */
@@ -1518,9 +1601,13 @@ do_view_data_remove(RES* ssl, struct worker* worker, char* arg)
 
 /** Remove RR data from stdin from view */
 static void
-do_view_datas_remove(RES* ssl, struct worker* worker, char* arg)
+do_view_datas_remove(struct daemon_remote* rc, RES* ssl, struct worker* worker,
+	char* arg)
 {
 	struct view* v;
+	char buf[MAX_CMD_STRLINE + MAX_STDIN_STRLINE] = "view_local_data_remove ";
+	int num = 0;
+	size_t cmd_len;
 	v = views_find_view(worker->daemon->views,
 		arg, 1 /* get write lock*/);
 	if(!v) {
@@ -1532,9 +1619,28 @@ do_view_datas_remove(RES* ssl, struct worker* worker, char* arg)
 		ssl_printf(ssl, "removed 0 datas\n");
 		return;
 	}
-
-	do_datas_remove(ssl, v->local_zones);
+	/* put the view name in the command buf */
+	(void)snprintf(buf+strlen(buf), sizeof(buf)-strlen(buf), "%s ", arg);
+	cmd_len = strlen(buf);
+	while(ssl_read_line(ssl, buf+cmd_len, MAX_STDIN_STRLINE)) {
+		if(buf[0+cmd_len] == 0 ||
+			(buf[0+cmd_len] == 0x04 && buf[1+cmd_len] == 0))
+			break; /* zero byte line or end of transmission */
+#ifdef THREADS_DISABLED
+		/* distribute single item command */
+		if(rc) distribute_cmd(rc, ssl, buf);
+#else
+		(void)rc; /* unused */
+#endif
+		if(!perform_data_remove(ssl, v->local_zones, buf+cmd_len)) {
+			if(!ssl_printf(ssl, "error for input line: %s\n",
+				buf+cmd_len))
+				return;
+		}
+		else	num++;
+	}
 	lock_rw_unlock(&v->lock);
+	(void)ssl_printf(ssl, "removed %d datas\n", num);
 }
 
 /** cache lookup of nameservers */
@@ -1553,7 +1659,7 @@ do_lookup(RES* ssl, struct worker* worker, char* arg)
 /** flush something from rrset and msg caches */
 static void
 do_cache_remove(struct worker* worker, uint8_t* nm, size_t nmlen,
-	uint16_t t, uint16_t c)
+	uint16_t t, uint16_t c, int remcachedb)
 {
 	hashvalue_type h;
 	struct query_info k;
@@ -1573,6 +1679,29 @@ do_cache_remove(struct worker* worker, uint8_t* nm, size_t nmlen,
 		h = query_info_hash(&k, BIT_CD);
 		slabhash_remove(worker->env.msg_cache, h, &k);
 	}
+#ifdef USE_CACHEDB
+	if(remcachedb && worker->env.cachedb_enabled)
+		cachedb_msg_remove_qinfo(&worker->env, &k);
+#else
+	(void)remcachedb;
+#endif
+}
+
+/** parse '+c' option, modifies string to return remainder. */
+static int
+parse_remcachedb(RES* ssl, char** arg, int* pc)
+{
+	*arg = skipwhite(*arg);
+	if((*arg)[0] == '+' && (*arg)[1] == 'c') {
+		char* arg2;
+		*pc = 1;
+		if(!find_arg2(ssl, *arg, &arg2))
+			return 0;
+		*arg = arg2;
+		return 1;
+	}
+	/* The option was not found, no problem */
+	return 1;
 }
 
 /** flush a type */
@@ -1584,15 +1713,20 @@ do_flush_type(RES* ssl, struct worker* worker, char* arg)
 	size_t nmlen;
 	char* arg2;
 	uint16_t t;
+	int pc = 0; /* '+c' option */
+	if(!parse_remcachedb(ssl, &arg, &pc))
+		return;
 	if(!find_arg2(ssl, arg, &arg2))
 		return;
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
 		return;
 	t = sldns_get_rr_type_by_name(arg2);
 	if(t == 0 && strcmp(arg2, "TYPE0") != 0) {
+		(void)ssl_printf(ssl, "error parsing RRset type: '%s'\n", arg2);
+		free(nm);
 		return;
 	}
-	do_cache_remove(worker, nm, nmlen, t, LDNS_RR_CLASS_IN);
+	do_cache_remove(worker, nm, nmlen, t, LDNS_RR_CLASS_IN, pc);
 
 	free(nm);
 	send_ok(ssl);
@@ -1630,6 +1764,8 @@ struct del_info {
 	socklen_t addrlen;
 	/** socket address for host deletion */
 	struct sockaddr_storage addr;
+	/** if cachedb information should be flushed too */
+	int remcachedb;
 };
 
 /** callback to delete hosts in infra cache */
@@ -1681,6 +1817,7 @@ do_flush_infra(RES* ssl, struct worker* worker, char* arg)
 	inf.num_msgs = 0;
 	inf.num_keys = 0;
 	inf.addrlen = len;
+	inf.remcachedb = 0;
 	memmove(&inf.addr, &addr, len);
 	slabhash_traverse(worker->env.infra_cache->hosts, 1, &infra_del_host,
 		&inf);
@@ -1727,6 +1864,10 @@ zone_del_msg(struct lruhash_entry* e, void* arg)
 			d->serve_expired_ttl = inf->expired;
 			inf->num_msgs++;
 		}
+#ifdef USE_CACHEDB
+		if(inf->remcachedb && inf->worker->env.cachedb_enabled)
+			cachedb_msg_remove_qinfo(&inf->worker->env, &k->key);
+#endif
 	}
 }
 
@@ -1754,6 +1895,9 @@ do_flush_zone(RES* ssl, struct worker* worker, char* arg)
 	int nmlabs;
 	size_t nmlen;
 	struct del_info inf;
+	int pc = 0; /* '+c' option */
+	if(!parse_remcachedb(ssl, &arg, &pc))
+		return;
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
 		return;
 	/* delete all RRs and key entries from zone */
@@ -1767,6 +1911,7 @@ do_flush_zone(RES* ssl, struct worker* worker, char* arg)
 	inf.num_rrsets = 0;
 	inf.num_msgs = 0;
 	inf.num_keys = 0;
+	inf.remcachedb = pc;
 	slabhash_traverse(&worker->env.rrset_cache->table, 1,
 		&zone_del_rrset, &inf);
 
@@ -1808,6 +1953,11 @@ bogus_del_msg(struct lruhash_entry* e, void* arg)
 	if(d->security == sec_status_bogus) {
 		d->ttl = inf->expired;
 		inf->num_msgs++;
+#ifdef USE_CACHEDB
+		if(inf->remcachedb && inf->worker->env.cachedb_enabled)
+			cachedb_msg_remove_qinfo(&inf->worker->env,
+				&((struct msgreply_entry*)e->key)->key);
+#endif
 	}
 }
 
@@ -1826,9 +1976,12 @@ bogus_del_kcache(struct lruhash_entry* e, void* arg)
 
 /** remove all bogus rrsets, msgs and keys from cache */
 static void
-do_flush_bogus(RES* ssl, struct worker* worker)
+do_flush_bogus(RES* ssl, struct worker* worker, char* arg)
 {
 	struct del_info inf;
+	int pc = 0; /* '+c' option */
+	if(!parse_remcachedb(ssl, &arg, &pc))
+		return;
 	/* what we do is to set them all expired */
 	inf.worker = worker;
 	inf.expired = *worker->env.now;
@@ -1836,6 +1989,7 @@ do_flush_bogus(RES* ssl, struct worker* worker)
 	inf.num_rrsets = 0;
 	inf.num_msgs = 0;
 	inf.num_keys = 0;
+	inf.remcachedb = pc;
 	slabhash_traverse(&worker->env.rrset_cache->table, 1,
 		&bogus_del_rrset, &inf);
 
@@ -1881,6 +2035,11 @@ negative_del_msg(struct lruhash_entry* e, void* arg)
 	if(FLAGS_GET_RCODE(d->flags) != 0 || d->an_numrrsets == 0) {
 		d->ttl = inf->expired;
 		inf->num_msgs++;
+#ifdef USE_CACHEDB
+		if(inf->remcachedb && inf->worker->env.cachedb_enabled)
+			cachedb_msg_remove_qinfo(&inf->worker->env,
+				&((struct msgreply_entry*)e->key)->key);
+#endif
 	}
 }
 
@@ -1901,9 +2060,12 @@ negative_del_kcache(struct lruhash_entry* e, void* arg)
 
 /** remove all negative(NODATA,NXDOMAIN), and servfail messages from cache */
 static void
-do_flush_negative(RES* ssl, struct worker* worker)
+do_flush_negative(RES* ssl, struct worker* worker, char* arg)
 {
 	struct del_info inf;
+	int pc = 0; /* '+c' option */
+	if(!parse_remcachedb(ssl, &arg, &pc))
+		return;
 	/* what we do is to set them all expired */
 	inf.worker = worker;
 	inf.expired = *worker->env.now;
@@ -1911,6 +2073,7 @@ do_flush_negative(RES* ssl, struct worker* worker)
 	inf.num_rrsets = 0;
 	inf.num_msgs = 0;
 	inf.num_keys = 0;
+	inf.remcachedb = pc;
 	slabhash_traverse(&worker->env.rrset_cache->table, 1,
 		&negative_del_rrset, &inf);
 
@@ -1934,20 +2097,23 @@ do_flush_name(RES* ssl, struct worker* w, char* arg)
 	uint8_t* nm;
 	int nmlabs;
 	size_t nmlen;
+	int pc = 0; /* '+c' option */
+	if(!parse_remcachedb(ssl, &arg, &pc))
+		return;
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
 		return;
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_AAAA, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SOA, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_CNAME, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_DNAME, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_MX, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_PTR, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SRV, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NAPTR, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SVCB, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_HTTPS, LDNS_RR_CLASS_IN);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN, pc);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_AAAA, LDNS_RR_CLASS_IN, pc);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN, pc);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SOA, LDNS_RR_CLASS_IN, pc);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_CNAME, LDNS_RR_CLASS_IN, pc);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_DNAME, LDNS_RR_CLASS_IN, pc);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_MX, LDNS_RR_CLASS_IN, pc);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_PTR, LDNS_RR_CLASS_IN, pc);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SRV, LDNS_RR_CLASS_IN, pc);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NAPTR, LDNS_RR_CLASS_IN, pc);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SVCB, LDNS_RR_CLASS_IN, pc);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_HTTPS, LDNS_RR_CLASS_IN, pc);
 
 	free(nm);
 	send_ok(ssl);
@@ -2070,7 +2236,7 @@ parse_delegpt(RES* ssl, char* args, uint8_t* nm)
 	return dp;
 }
 
-/** do the status command */
+/** do the forward command */
 static void
 do_forward(RES* ssl, struct worker* worker, char* args)
 {
@@ -3029,25 +3195,6 @@ do_rpz_disable(RES* ssl, struct worker* worker, char* arg)
     do_rpz_enable_disable(ssl, worker, arg, 0);
 }
 
-/** tell other processes to execute the command */
-static void
-distribute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd)
-{
-	int i;
-	if(!cmd || !ssl)
-		return;
-	/* skip i=0 which is me */
-	for(i=1; i<rc->worker->daemon->num; i++) {
-		worker_send_cmd(rc->worker->daemon->workers[i],
-			worker_cmd_remote);
-		if(!tube_write_msg(rc->worker->daemon->workers[i]->cmd,
-			(uint8_t*)cmd, strlen(cmd)+1, 0)) {
-			ssl_printf(ssl, "error could not distribute cmd\n");
-			return;
-		}
-	}
-}
-
 /** check for name with end-of-string, space or tab after it */
 static int
 cmdcmp(char* p, const char* cmd, size_t len)
@@ -3081,9 +3228,23 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 		do_status(ssl, worker);
 		return;
 	} else if(cmdcmp(p, "dump_cache", 10)) {
+#ifdef THREADS_DISABLED
+		if(worker->daemon->num > 1) {
+			(void)ssl_printf(ssl, "dump_cache/load_cache is not "
+				"supported in multi-process operation\n");
+			return;
+		}
+#endif
 		(void)dump_cache(ssl, worker);
 		return;
 	} else if(cmdcmp(p, "load_cache", 10)) {
+#ifdef THREADS_DISABLED
+		if(worker->daemon->num > 1) {
+			/* The warning can't be printed when stdin is sending
+			 * data; just return */
+			return;
+		}
+#endif
 		if(load_cache(ssl, worker)) send_ok(ssl);
 		return;
 	} else if(cmdcmp(p, "list_forwards", 13)) {
@@ -3145,6 +3306,27 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 	} else if(cmdcmp(p, "lookup", 6)) {
 		do_lookup(ssl, worker, skipwhite(p+6));
 		return;
+	/* The following are commands that read stdin.
+	 * Each line needs to be distributed if THREADS_DISABLED.
+	 */
+	} else if(cmdcmp(p, "local_zones_remove", 18)) {
+		do_zones_remove(rc, ssl, worker);
+		return;
+	} else if(cmdcmp(p, "local_zones", 11)) {
+		do_zones_add(rc, ssl, worker);
+		return;
+	} else if(cmdcmp(p, "local_datas_remove", 18)) {
+		do_datas_remove(rc, ssl, worker);
+		return;
+	} else if(cmdcmp(p, "local_datas", 11)) {
+		do_datas_add(rc, ssl, worker);
+		return;
+	} else if(cmdcmp(p, "view_local_datas_remove", 23)){
+		do_view_datas_remove(rc, ssl, worker, skipwhite(p+23));
+		return;
+	} else if(cmdcmp(p, "view_local_datas", 16)) {
+		do_view_datas_add(rc, ssl, worker, skipwhite(p+16));
+		return;
 	}
 
 #ifdef THREADS_DISABLED
@@ -3159,20 +3341,12 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 		do_verbosity(ssl, skipwhite(p+9));
 	} else if(cmdcmp(p, "local_zone_remove", 17)) {
 		do_zone_remove(ssl, worker->daemon->local_zones, skipwhite(p+17));
-	} else if(cmdcmp(p, "local_zones_remove", 18)) {
-		do_zones_remove(ssl, worker->daemon->local_zones);
 	} else if(cmdcmp(p, "local_zone", 10)) {
 		do_zone_add(ssl, worker->daemon->local_zones, skipwhite(p+10));
-	} else if(cmdcmp(p, "local_zones", 11)) {
-		do_zones_add(ssl, worker->daemon->local_zones);
 	} else if(cmdcmp(p, "local_data_remove", 17)) {
 		do_data_remove(ssl, worker->daemon->local_zones, skipwhite(p+17));
-	} else if(cmdcmp(p, "local_datas_remove", 18)) {
-		do_datas_remove(ssl, worker->daemon->local_zones);
 	} else if(cmdcmp(p, "local_data", 10)) {
 		do_data_add(ssl, worker->daemon->local_zones, skipwhite(p+10));
-	} else if(cmdcmp(p, "local_datas", 11)) {
-		do_datas_add(ssl, worker->daemon->local_zones);
 	} else if(cmdcmp(p, "forward_add", 11)) {
 		do_forward_add(ssl, worker, skipwhite(p+11));
 	} else if(cmdcmp(p, "forward_remove", 14)) {
@@ -3189,12 +3363,8 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 		do_view_zone_add(ssl, worker, skipwhite(p+15));
 	} else if(cmdcmp(p, "view_local_data_remove", 22)) {
 		do_view_data_remove(ssl, worker, skipwhite(p+22));
-	} else if(cmdcmp(p, "view_local_datas_remove", 23)){
-		do_view_datas_remove(ssl, worker, skipwhite(p+23));
 	} else if(cmdcmp(p, "view_local_data", 15)) {
 		do_view_data_add(ssl, worker, skipwhite(p+15));
-	} else if(cmdcmp(p, "view_local_datas", 16)) {
-		do_view_datas_add(ssl, worker, skipwhite(p+16));
 	} else if(cmdcmp(p, "flush_zone", 10)) {
 		do_flush_zone(ssl, worker, skipwhite(p+10));
 	} else if(cmdcmp(p, "flush_type", 10)) {
@@ -3214,9 +3384,9 @@ execute_cmd(struct daemon_remote* rc, RES* ssl, char* cmd,
 	} else if(cmdcmp(p, "get_option", 10)) {
 		do_get_option(ssl, worker, skipwhite(p+10));
 	} else if(cmdcmp(p, "flush_bogus", 11)) {
-		do_flush_bogus(ssl, worker);
+		do_flush_bogus(ssl, worker, skipwhite(p+11));
 	} else if(cmdcmp(p, "flush_negative", 14)) {
-		do_flush_negative(ssl, worker);
+		do_flush_negative(ssl, worker, skipwhite(p+14));
 	} else if(cmdcmp(p, "rpz_enable", 10)) {
 		do_rpz_enable(ssl, worker, skipwhite(p+10));
 	} else if(cmdcmp(p, "rpz_disable", 11)) {
@@ -3248,7 +3418,7 @@ handle_req(struct daemon_remote* rc, struct rc_state* s, RES* res)
 	int r;
 	char pre[10];
 	char magic[7];
-	char buf[1024];
+	char buf[MAX_CMD_STRLINE];
 #ifdef USE_WINSOCK
 	/* makes it possible to set the socket blocking again. */
 	/* basically removes it from winsock_event ... */

daemon/stats.c

@@ -391,6 +391,13 @@ void server_stats_obtain(struct worker* worker, struct worker* who,
 	else 	worker_send_cmd(who, worker_cmd_stats_noreset);
 	verbose(VERB_ALGO, "wait for stats reply");
 	if(tube_wait_timeout(worker->cmd, STATS_THREAD_WAIT) == 0) {
+#if defined(HAVE_PTHREAD) && defined(SIZEOF_PTHREAD_T) && defined(SIZEOF_UNSIGNED_LONG)
+#  if SIZEOF_PTHREAD_T == SIZEOF_UNSIGNED_LONG
+		unsigned long pthid = 0;
+		if(verbosity >= VERB_OPS)
+			memcpy(&pthid, &who->thr_id, sizeof(unsigned long));
+#  endif
+#endif
 		verbose(VERB_OPS, "no response from thread %d"
 #ifdef HAVE_GETTID
 			" LWP %u"
@@ -407,7 +414,7 @@ void server_stats_obtain(struct worker* worker, struct worker* who,
 #endif
 #if defined(HAVE_PTHREAD) && defined(SIZEOF_PTHREAD_T) && defined(SIZEOF_UNSIGNED_LONG)
 #  if SIZEOF_PTHREAD_T == SIZEOF_UNSIGNED_LONG
-			, (unsigned long)*((unsigned long*)&who->thr_id)
+			, pthid
 #  endif
 #endif
 			);

daemon/unbound.c

@@ -473,7 +473,11 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif
 #ifdef HAVE_GETPWNAM
 	struct passwd *pwd = NULL;
+#endif
 
+	if(!daemon_privileged(daemon))
+		fatal_exit("could not do privileged setup");
+#ifdef HAVE_GETPWNAM
 	if(cfg->username && cfg->username[0]) {
 		if((pwd = getpwnam(cfg->username)) == NULL)
 			fatal_exit("user '%s' does not exist.", cfg->username);
@@ -550,7 +554,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 		 * because that creates privilege escape problems, with the
 		 * pidfile writable by unprivileged users, but used by
 		 * privileged users. */
-		if(cfg->username && cfg->username[0])
+		if(!(cfg->username && cfg->username[0]))
 			checkoldpid(daemon->pidfile, pidinchroot);
 	}
 #endif

daemon/worker.c

@@ -1111,6 +1111,172 @@ answer_notify(struct worker* w, struct query_info* qinfo,
 	LDNS_OPCODE_SET(sldns_buffer_begin(pkt), LDNS_PACKET_NOTIFY);
 }
 
+static int
+make_ede_error(struct comm_point* c, struct worker* worker,
+		struct comm_reply* repinfo, int rcode, int16_t ede_code,
+		int ede, struct check_request_result* check_result)
+{
+	size_t opt_rr_mark;
+
+	if(worker->stats.extended)
+		worker->stats.unwanted_queries++;
+	worker_check_request(c->buffer, worker, check_result);
+	if(check_result->value != 0) {
+		if(check_result->value != -1) {
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				check_result->value);
+			return 1;
+		}
+		comm_point_drop_reply(repinfo);
+		return 0;
+	}
+	/* worker_check_request() above guarantees that the buffer contains at
+	 * least a header and that qdcount == 1
+	 */
+	log_assert(sldns_buffer_limit(c->buffer) >= LDNS_HEADER_SIZE
+		&& LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) == 1);
+
+	sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE); /* skip header */
+
+	/* check additional section is present and that we respond with EDEs */
+	if(LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) != 1
+		|| !ede) {
+		LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), rcode);
+		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+		sldns_buffer_flip(c->buffer);
+		return 1;
+	}
+
+	if (!query_dname_len(c->buffer)) {
+		LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_FORMERR);
+		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+		sldns_buffer_flip(c->buffer);
+		return 1;
+	}
+	/* space available for query type and class? */
+	if (sldns_buffer_remaining(c->buffer) < 2 * sizeof(uint16_t)) {
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			 LDNS_RCODE_FORMERR);
+		LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+		sldns_buffer_flip(c->buffer);
+		return 1;
+	}
+	LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+	LDNS_RCODE_SET(sldns_buffer_begin(c->buffer), rcode);
+
+	sldns_buffer_skip(c->buffer, (ssize_t)sizeof(uint16_t)); /* skip qtype */
+
+	sldns_buffer_skip(c->buffer, (ssize_t)sizeof(uint16_t)); /* skip qclass */
+
+	/* The OPT RR to be returned should come directly after
+	 * the query, so mark this spot.
+	 */
+	opt_rr_mark = sldns_buffer_position(c->buffer);
+
+	/* Skip through the RR records */
+	if(LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)) != 0 ||
+		LDNS_NSCOUNT(sldns_buffer_begin(c->buffer)) != 0) {
+		if(!skip_pkt_rrs(c->buffer,
+			((int)LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)))+
+			((int)LDNS_NSCOUNT(sldns_buffer_begin(c->buffer))))) {
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				LDNS_RCODE_FORMERR);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, opt_rr_mark);
+			sldns_buffer_flip(c->buffer);
+			return 1;
+		}
+	}
+	/* Do we have a valid OPT RR here? If not return rcode (could be a valid TSIG or something so no FORMERR) */
+	/* domain name must be the root of length 1. */
+	if(sldns_buffer_remaining(c->buffer) < 1 || *sldns_buffer_current(c->buffer) != 0) {
+		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		sldns_buffer_set_position(c->buffer, opt_rr_mark);
+		sldns_buffer_flip(c->buffer);
+		return 1;
+	} else {
+		sldns_buffer_skip(c->buffer, 1); /* skip root label */
+	}
+	if(sldns_buffer_remaining(c->buffer) < 2 ||
+		sldns_buffer_read_u16(c->buffer) != LDNS_RR_TYPE_OPT) {
+		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		sldns_buffer_set_position(c->buffer, opt_rr_mark);
+		sldns_buffer_flip(c->buffer);
+		return 1;
+	}
+	/* Write OPT RR directly after the query,
+	 * so without the (possibly skipped) Answer and NS RRs
+	 */
+	LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+	LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+	sldns_buffer_clear(c->buffer); /* reset write limit */
+	sldns_buffer_set_position(c->buffer, opt_rr_mark);
+
+	/* Check if OPT record can be written
+	 * 17 == root label (1) + RR type (2) + UDP Size (2)
+	 *     + Fields (4) + rdata len (2) + EDE Option code (2)
+	 *     + EDE Option length (2) + EDE info-code (2)
+	 */
+	if (sldns_buffer_available(c->buffer, 17) == 0) {
+		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+		sldns_buffer_flip(c->buffer);
+		return 1;
+	}
+
+	LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 1);
+
+	/* root label */
+	sldns_buffer_write_u8(c->buffer, 0);
+	sldns_buffer_write_u16(c->buffer, LDNS_RR_TYPE_OPT);
+	sldns_buffer_write_u16(c->buffer, EDNS_ADVERTISED_SIZE);
+
+	/* write OPT Record TTL Field */
+	sldns_buffer_write_u32(c->buffer, 0);
+
+	/* write rdata len: EDE option + length + info-code */
+	sldns_buffer_write_u16(c->buffer, 6);
+
+	/* write OPTIONS; add EDE option code */
+	sldns_buffer_write_u16(c->buffer, LDNS_EDNS_EDE);
+
+	/* write single EDE option length (for just 1 info-code) */
+	sldns_buffer_write_u16(c->buffer, 2);
+
+	/* write single EDE info-code */
+	sldns_buffer_write_u16(c->buffer, ede_code);
+
+	sldns_buffer_flip(c->buffer);
+
+	verbose(VERB_ALGO, "attached EDE code: %d", ede_code);
+
+	return 1;
+
+
+}
+
 static int
 deny_refuse(struct comm_point* c, enum acl_access acl,
 	enum acl_access deny, enum acl_access refuse,
@@ -1129,174 +1295,14 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 			worker->stats.unwanted_queries++;
 		return 0;
 	} else if(acl == refuse) {
-		size_t opt_rr_mark;
-
 		if(verbosity >= VERB_ALGO) {
 			log_acl_action("refused", &repinfo->client_addr,
 				repinfo->client_addrlen, acl, acladdr);
 			log_buf(VERB_ALGO, "refuse", c->buffer);
 		}
-
-		if(worker->stats.extended)
-			worker->stats.unwanted_queries++;
-		worker_check_request(c->buffer, worker, check_result);
-		if(check_result->value != 0) {
-			if(check_result->value != -1) {
-				LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-					check_result->value);
-				return 1;
-			}
-			comm_point_drop_reply(repinfo);
-			return 0;
-		}
-		/* worker_check_request() above guarantees that the buffer contains at
-		 * least a header and that qdcount == 1
-		 */
-		log_assert(sldns_buffer_limit(c->buffer) >= LDNS_HEADER_SIZE
-			&& LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) == 1);
-
-		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE); /* skip header */
-
-		/* check additional section is present and that we respond with EDEs */
-		if(LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) != 1
-			|| !ede) {
-			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-				LDNS_RCODE_REFUSED);
-			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
-			sldns_buffer_flip(c->buffer);
-			return 1;
-		}
-
-		if (!query_dname_len(c->buffer)) {
-			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-				LDNS_RCODE_FORMERR);
-			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
-			sldns_buffer_flip(c->buffer);
-			return 1;
-		}
-		/* space available for query type and class? */
-		if (sldns_buffer_remaining(c->buffer) < 2 * sizeof(uint16_t)) {
-                        LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-                        LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-				 LDNS_RCODE_FORMERR);
-			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
-                        sldns_buffer_flip(c->buffer);
-			return 1;
-		}
-		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-			LDNS_RCODE_REFUSED);
-
-		sldns_buffer_skip(c->buffer, (ssize_t)sizeof(uint16_t)); /* skip qtype */
-
-		sldns_buffer_skip(c->buffer, (ssize_t)sizeof(uint16_t)); /* skip qclass */
-
-		/* The OPT RR to be returned should come directly after
-		 * the query, so mark this spot.
-		 */
-		opt_rr_mark = sldns_buffer_position(c->buffer);
-
-		/* Skip through the RR records */
-		if(LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)) != 0 ||
-			LDNS_NSCOUNT(sldns_buffer_begin(c->buffer)) != 0) {
-			if(!skip_pkt_rrs(c->buffer,
-				((int)LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)))+
-				((int)LDNS_NSCOUNT(sldns_buffer_begin(c->buffer))))) {
-				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-					LDNS_RCODE_FORMERR);
-				LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-				LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-				LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-				sldns_buffer_set_position(c->buffer, opt_rr_mark);
-				sldns_buffer_flip(c->buffer);
-				return 1;
-			}
-		}
-		/* Do we have a valid OPT RR here? If not return REFUSED (could be a valid TSIG or something so no FORMERR) */
-		/* domain name must be the root of length 1. */
-		if(sldns_buffer_remaining(c->buffer) < 1 || *sldns_buffer_current(c->buffer) != 0) {
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_set_position(c->buffer, opt_rr_mark);
-			sldns_buffer_flip(c->buffer);
-			return 1;
-		} else {
-			sldns_buffer_skip(c->buffer, 1); /* skip root label */
-		}
-		if(sldns_buffer_remaining(c->buffer) < 2 ||
-			sldns_buffer_read_u16(c->buffer) != LDNS_RR_TYPE_OPT) {
-			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_set_position(c->buffer, opt_rr_mark);
-			sldns_buffer_flip(c->buffer);
-			return 1;
-		}
-		/* Write OPT RR directly after the query,
-		 * so without the (possibly skipped) Answer and NS RRs
-		 */
-		LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-		LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-		sldns_buffer_clear(c->buffer); /* reset write limit */
-		sldns_buffer_set_position(c->buffer, opt_rr_mark);
-
-		/* Check if OPT record can be written
-		 * 17 == root label (1) + RR type (2) + UDP Size (2)
-		 *     + Fields (4) + rdata len (2) + EDE Option code (2)
-		 *     + EDE Option length (2) + EDE info-code (2)
-		 */
-		if (sldns_buffer_available(c->buffer, 17) == 0) {
-			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
-			sldns_buffer_flip(c->buffer);
-			return 1;
-		}
-
-		LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 1);
-
-		/* root label */
-		sldns_buffer_write_u8(c->buffer, 0);
-		sldns_buffer_write_u16(c->buffer, LDNS_RR_TYPE_OPT);
-		sldns_buffer_write_u16(c->buffer, EDNS_ADVERTISED_SIZE);
-
-		/* write OPT Record TTL Field */
-		sldns_buffer_write_u32(c->buffer, 0);
-
-		/* write rdata len: EDE option + length + info-code */
-		sldns_buffer_write_u16(c->buffer, 6);
-
-		/* write OPTIONS; add EDE option code */
-		sldns_buffer_write_u16(c->buffer, LDNS_EDNS_EDE);
-
-		/* write single EDE option length (for just 1 info-code) */
-		sldns_buffer_write_u16(c->buffer, 2);
-
-		/* write single EDE info-code */
-		sldns_buffer_write_u16(c->buffer, LDNS_EDE_PROHIBITED);
-
-		sldns_buffer_flip(c->buffer);
-
-		verbose(VERB_ALGO, "attached EDE code: %d", LDNS_EDE_PROHIBITED);
-
-		return 1;
-
+		return make_ede_error(c, worker, repinfo, LDNS_RCODE_REFUSED,
+				LDNS_EDE_PROHIBITED, ede, check_result);
 	}
-
 	return -1;
 }
 
@@ -1552,6 +1558,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		qinfo.qtype == LDNS_RR_TYPE_MAILA ||
 		qinfo.qtype == LDNS_RR_TYPE_MAILB ||
 		(qinfo.qtype >= 128 && qinfo.qtype <= 248)) {
+		size_t opt_rr_mark;
+
 		verbose(VERB_ALGO, "worker request: formerror for meta-type.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
@@ -1559,14 +1567,12 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		sldns_buffer_rewind(c->buffer);
-		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
-		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
-			LDNS_RCODE_FORMERR);
-		if(worker->stats.extended) {
-			worker->stats.qtype[qinfo.qtype]++;
+		if (make_ede_error(c, worker, repinfo, LDNS_RCODE_FORMERR,
+				LDNS_EDE_INVALID_QUERY_TYPE,
+				worker->env.cfg->ede, &check_result)) {
+			goto send_reply;
 		}
-		goto send_reply;
+		return 0;
 	}
 	if((ret=parse_edns_from_query_pkt(
 			c->buffer, &edns, worker->env.cfg, c, repinfo,

dns64/dns64.c

@@ -1044,8 +1044,8 @@ dns64_get_mem(struct module_env* env, int id)
  */
 static struct module_func_block dns64_block = {
 	"dns64",
-	&dns64_init, &dns64_deinit, &dns64_operate, &dns64_inform_super,
-	&dns64_clear, &dns64_get_mem
+	NULL, NULL, &dns64_init, &dns64_deinit, &dns64_operate,
+	&dns64_inform_super, &dns64_clear, &dns64_get_mem
 };
 
 /**

dnstap/dnstap.c

@@ -86,6 +86,31 @@ dt_pack(const Dnstap__Dnstap *d, void **buf, size_t *sz)
 	return 1;
 }
 
+/** See if the message is sent due to dnstap sample rate */
+static int
+dt_sample_rate_limited(struct dt_env* env)
+{
+	lock_basic_lock(&env->sample_lock);
+	/* Sampling is every [n] packets. Where n==1, every packet is sent */
+	if(env->sample_rate > 1) {
+		int submit = 0;
+		/* if sampling is engaged... */
+		if (env->sample_rate_count > env->sample_rate) {
+			/* once the count passes the limit */
+			/* submit the message */
+			submit = 1;
+			/* and reset the count */
+			env->sample_rate_count = 0;
+		}
+		/* increment count regardless */
+		env->sample_rate_count++;
+		lock_basic_unlock(&env->sample_lock);
+		return !submit;
+	}
+	lock_basic_unlock(&env->sample_lock);
+	return 0;
+}
+
 static void
 dt_send(const struct dt_env *env, void *buf, size_t len_buf)
 {
@@ -146,6 +171,7 @@ dt_create(struct config_file* cfg)
 	env = (struct dt_env *) calloc(1, sizeof(struct dt_env));
 	if (!env)
 		return NULL;
+	lock_basic_init(&env->sample_lock);
 
 	env->dtio = dt_io_thread_create();
 	if(!env->dtio) {
@@ -241,6 +267,12 @@ dt_apply_cfg(struct dt_env *env, struct config_file *cfg)
 	{
 		verbose(VERB_OPS, "dnstap Message/FORWARDER_RESPONSE enabled");
 	}
+	lock_basic_lock(&env->sample_lock);
+	if((env->sample_rate = (unsigned int)cfg->dnstap_sample_rate))
+	{
+		verbose(VERB_OPS, "dnstap SAMPLE_RATE enabled and set to \"%d\"", (int)env->sample_rate);
+	}
+	lock_basic_unlock(&env->sample_lock);
 }
 
 int
@@ -273,6 +305,7 @@ dt_delete(struct dt_env *env)
 	if (!env)
 		return;
 	dt_io_thread_delete(env->dtio);
+	lock_basic_destroy(&env->sample_lock);
 	free(env->identity);
 	free(env->version);
 	free(env);
@@ -409,6 +442,9 @@ dt_msg_send_client_query(struct dt_env *env,
 	struct dt_msg dm;
 	struct timeval qtime;
 
+	if(dt_sample_rate_limited(env))
+		return;
+
 	if(tstamp)
 		memcpy(&qtime, tstamp, sizeof(qtime));
 	else 	gettimeofday(&qtime, NULL);
@@ -447,6 +483,9 @@ dt_msg_send_client_response(struct dt_env *env,
 	struct dt_msg dm;
 	struct timeval rtime;
 
+	if(dt_sample_rate_limited(env))
+		return;
+
 	gettimeofday(&rtime, NULL);
 
 	/* type */
@@ -484,6 +523,9 @@ dt_msg_send_outside_query(struct dt_env *env,
 	struct timeval qtime;
 	uint16_t qflags;
 
+	if(dt_sample_rate_limited(env))
+		return;
+
 	gettimeofday(&qtime, NULL);
 	qflags = sldns_buffer_read_u16_at(qmsg, 2);
 
@@ -537,6 +579,9 @@ dt_msg_send_outside_response(struct dt_env *env,
 	struct dt_msg dm;
 	uint16_t qflags;
 
+	if(dt_sample_rate_limited(env))
+		return;
+
 	(void)qbuf_len; log_assert(qbuf_len >= sizeof(qflags));
 	memcpy(&qflags, qbuf, sizeof(qflags));
 	qflags = ntohs(qflags);

dnstap/dnstap.h

@@ -39,6 +39,7 @@
 
 #ifdef USE_DNSTAP
 
+#include "util/locks.h"
 struct config_file;
 struct sldns_buffer;
 struct dt_msg_queue;
@@ -75,6 +76,13 @@ struct dt_env {
 	unsigned log_forwarder_query_messages : 1;
 	/** whether to log Message/FORWARDER_RESPONSE */
 	unsigned log_forwarder_response_messages : 1;
+
+	/** lock on sample count */
+	lock_basic_type sample_lock;
+	/** rate limit value from config, samples 1/N messages */
+	unsigned int sample_rate;
+	/** rate limit counter */
+	unsigned int sample_rate_count;
 };
 
 /**

dnstap/dnstap.m4

@@ -34,41 +34,38 @@ AC_DEFUN([dt_DNSTAP],
                 LDFLAGS="$LDFLAGS -L$withval/lib"
             ],
             [
-                ifdef([PKG_CHECK_MODULES],
-                    [
-                        PKG_CHECK_MODULES([PROTOBUFC], [libprotobuf-c],
-                            [
-                                CFLAGS="$CFLAGS $PROTOBUFC_CFLAGS"
-                                LIBS="$LIBS $PROTOBUFC_LIBS"
-                            ],
-                            [
-                                # pkg-config failed; try falling back to known values
-                                # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                                if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
-                                    CFLAGS="$CFLAGS -I/usr/include/google"
+                if test -n "$PKG_CONFIG"; then
+                    PKG_CHECK_MODULES([PROTOBUFC], [libprotobuf-c],
+                        [
+                            CFLAGS="$CFLAGS $PROTOBUFC_CFLAGS"
+                            LIBS="$LIBS $PROTOBUFC_LIBS"
+                        ],
+                        [
+                            # pkg-config failed; try falling back to known values
+                            # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+                            if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
+                                CFLAGS="$CFLAGS -I/usr/include/google"
+                            else
+                                if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
+                                    CFLAGS="$CFLAGS -I/usr/local/include/google"
+                                    LDFLAGS="$LDFLAGS -L/usr/local/lib"
                                 else
-                                    if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
-                                        CFLAGS="$CFLAGS -I/usr/local/include/google"
-                                        LDFLAGS="$LDFLAGS -L/usr/local/lib"
-                                    else
-                                        AC_MSG_ERROR([The protobuf-c package was not found with pkg-config. Please install protobuf-c!])
-                                    fi
+                                    AC_MSG_ERROR([The protobuf-c package was not found with pkg-config. Please install protobuf-c!])
                                 fi
-                            ]
-                        )
-                    ],
-                    [
-                        # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
-                        if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
-                            CFLAGS="$CFLAGS -I/usr/include/google"
-                        else
-                            if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
-                                CFLAGS="$CFLAGS -I/usr/local/include/google"
-                                LDFLAGS="$LDFLAGS -L/usr/local/lib"
                             fi
+                        ]
+                    )
+                else
+                    # workaround for protobuf-c includes at old dir before protobuf-c-1.0.0
+                    if test -f /usr/include/google/protobuf-c/protobuf-c.h; then
+                        CFLAGS="$CFLAGS -I/usr/include/google"
+                    else
+                        if test -f /usr/local/include/google/protobuf-c/protobuf-c.h; then
+                            CFLAGS="$CFLAGS -I/usr/local/include/google"
+                            LDFLAGS="$LDFLAGS -L/usr/local/lib"
                         fi
-                    ]
-                )
+                    fi
+                fi
             ]
         )
         AC_SEARCH_LIBS([protobuf_c_message_pack], [protobuf-c], [],

dnstap/dtstream.c

@@ -176,10 +176,7 @@ void
 mq_wakeup_cb(void* arg)
 {
 	struct dt_msg_queue* mq = (struct dt_msg_queue*)arg;
-	/* even if the dtio is already active, because perhaps much
-	 * traffic suddenly, we leave the timer running to save on
-	 * managing it, the once a second timer is less work then
-	 * starting and stopping the timer frequently */
+
 	lock_basic_lock(&mq->dtio->wakeup_timer_lock);
 	mq->dtio->wakeup_timer_enabled = 0;
 	lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
@@ -210,6 +207,8 @@ dt_msg_queue_start_timer(struct dt_msg_queue* mq, int wakeupnow)
 	lock_basic_lock(&mq->dtio->wakeup_timer_lock);
 	if(mq->dtio->wakeup_timer_enabled) {
 		if(wakeupnow) {
+			tv.tv_sec = 0;
+			tv.tv_usec = 0;
 			comm_timer_set(mq->wakeup_timer, &tv);
 		}
 		lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
@@ -221,8 +220,14 @@ dt_msg_queue_start_timer(struct dt_msg_queue* mq, int wakeupnow)
 	if(!wakeupnow) {
 		tv.tv_sec = 1;
 		tv.tv_usec = 0;
+		/* If it is already set, keep it running. */
+		if(!comm_timer_is_set(mq->wakeup_timer))
+			comm_timer_set(mq->wakeup_timer, &tv);
+	} else {
+		tv.tv_sec = 0;
+		tv.tv_usec = 0;
+		comm_timer_set(mq->wakeup_timer, &tv);
 	}
-	comm_timer_set(mq->wakeup_timer, &tv);
 	lock_basic_unlock(&mq->dtio->wakeup_timer_lock);
 }
 
@@ -260,8 +265,9 @@ dt_msg_queue_submit(struct dt_msg_queue* mq, void* buf, size_t len)
 
 	/* acquire lock */
 	lock_basic_lock(&mq->lock);
-	/* if list was empty, start timer for (eventual) wakeup */
-	if(mq->first == NULL)
+	/* if list was empty, start timer for (eventual) wakeup,
+	 * or if dtio is not writing now an eventual wakeup is needed. */
+	if(mq->first == NULL || !mq->dtio->event_added_is_write)
 		wakeupstarttimer = 1;
 	/* if list contains more than wakeupnum elements, wakeup now,
 	 * or if list is (going to be) almost full */
@@ -1259,6 +1265,13 @@ static void dtio_sleep(struct dt_io_thread* dtio)
 	/* unregister the event polling for write, because there is
 	 * nothing to be written */
 	(void)dtio_add_output_event_read(dtio);
+
+	/* Set wakeuptimer enabled off; so that the next worker thread that
+	 * wants to log starts a timer if needed, since the writer thread
+	 * has gone to sleep. */
+	lock_basic_lock(&dtio->wakeup_timer_lock);
+	dtio->wakeup_timer_enabled = 0;
+	lock_basic_unlock(&dtio->wakeup_timer_lock);
 }
 
 #ifdef HAVE_SSL
@@ -1322,7 +1335,11 @@ static int dtio_ssl_check_peer(struct dt_io_thread* dtio)
 	if((SSL_get_verify_mode(dtio->ssl)&SSL_VERIFY_PEER)) {
 		/* verification */
 		if(SSL_get_verify_result(dtio->ssl) == X509_V_OK) {
+#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
+			X509* x = SSL_get1_peer_certificate(dtio->ssl);
+#else
 			X509* x = SSL_get_peer_certificate(dtio->ssl);
+#endif
 			if(!x) {
 				verbose(VERB_ALGO, "dnstap io, %s, SSL "
 					"connection failed no certificate",
@@ -1347,7 +1364,11 @@ static int dtio_ssl_check_peer(struct dt_io_thread* dtio)
 #endif
 			X509_free(x);
 		} else {
+#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
+			X509* x = SSL_get1_peer_certificate(dtio->ssl);
+#else
 			X509* x = SSL_get_peer_certificate(dtio->ssl);
+#endif
 			if(x) {
 				log_cert(VERB_ALGO, "dnstap io, peer "
 					"certificate", x);
@@ -1513,8 +1534,22 @@ void dtio_output_cb(int ATTR_UNUSED(fd), short bits, void* arg)
 					/* no messages on the first iteration,
 					 * the queues are all empty */
 					dtio_sleep(dtio);
+					/* After putting to sleep, see if
+					 * a message is in a message queue,
+					 * if so, resume service. Stops a
+					 * race condition where a thread could
+					 * have one message but the dtio
+					 * also just went to sleep. With the
+					 * message queued between the
+					 * dtio_find_msg and dtio_sleep
+					 * calls. */
+					if(dtio_find_msg(dtio)) {
+						if(!dtio_add_output_event_write(dtio))
+							return;
+					}
 				}
-				return; /* nothing to do */
+				if(!dtio->cur_msg)
+					return; /* nothing to do */
 			}
 		}
 

dnstap/unbound-dnstap-socket.c

@@ -75,17 +75,18 @@
 static void usage(char* argv[])
 {
 	printf("usage: %s [options]\n", argv[0]);
-	printf(" 	Listen to dnstap messages\n");
+	printf("	Listen to dnstap messages\n");
 	printf("stdout has dnstap log, stderr has verbose server log\n");
-	printf("-u <socketpath> listen to unix socket with this file name\n");
-	printf("-s <serverip[@port]> listen for TCP on the IP and port\n");
-	printf("-t <serverip[@port]> listen for TLS on IP and port\n");
-	printf("-x <server.key> server key file for TLS service\n");
-	printf("-y <server.pem> server cert file for TLS service\n");
-	printf("-z <verify.pem> cert file to verify client connections\n");
-	printf("-l 		long format for DNS printout\n");
-	printf("-v 		more verbose log output\n");
-	printf("-h 		this help text\n");
+	printf("-u <socketpath>		listen to unix socket with this file name\n");
+	printf("-s <serverip[@port]>	listen for TCP on the IP and port\n");
+	printf("-t <serverip[@port]>	listen for TLS on IP and port\n");
+	printf("-x <server.key>		server key file for TLS service\n");
+	printf("-y <server.pem>		server cert file for TLS service\n");
+	printf("-z <verify.pem>		cert file to verify client connections\n");
+	printf("-l			long format for DNS printout\n");
+	printf("-v			more verbose log output\n");
+	printf("-c			internal unit test and exit\n");
+	printf("-h			this help text\n");
 	exit(1);
 }
 
@@ -102,6 +103,14 @@ struct main_tap_data {
 	struct tap_socket_list* acceptlist;
 };
 
+/* list of data */
+struct tap_data_list {
+	/** next in list */
+	struct tap_data_list* next;
+	/** the data */
+	struct tap_data* d;
+};
+
 /** tap callback variables */
 struct tap_data {
 	/** the fd */
@@ -128,6 +137,10 @@ struct tap_data {
 	uint8_t* frame;
 	/** length of this frame */
 	size_t len;
+	/** back pointer to the tap_data_list entry;
+	 * used to NULL the forward pointer to this data
+	 * when this data is freed. */
+	struct tap_data_list* data_list;
 };
 
 /** list of sockets */
@@ -156,8 +169,82 @@ struct tap_socket {
 	char* ip;
 	/** for a TLS socket, the tls context */
 	SSL_CTX* sslctx;
+	/** dumb way to deal with memory leaks:
+	 * tap_data was only freed on errors and not during exit leading to
+	 * false positives when testing for memory leaks. */
+	struct tap_data_list* data_list;
 };
 
+/** try to delete tail entries from the list if all of them have no data */
+static void tap_data_list_try_to_free_tail(struct tap_data_list* list)
+{
+	struct tap_data_list* current = list;
+	log_assert(!list->d);
+	if(!list->next) /* we are the last, we can't remove ourselves */
+		return;
+	list = list->next;
+	while(list) {
+		if(list->d) /* a tail entry still has data; return */
+			return;
+		list = list->next;
+	}
+	/* keep the next */
+	list = current->next;
+	/* the tail will be removed; but not ourselves */
+	current->next = NULL;
+	while(list) {
+		current = list;
+		list = list->next;
+		free(current);
+	}
+}
+
+/** delete the tap structure */
+static void tap_data_free(struct tap_data* data)
+{
+	ub_event_del(data->ev);
+	ub_event_free(data->ev);
+#ifdef HAVE_SSL
+	SSL_free(data->ssl);
+#endif
+	close(data->fd);
+	free(data->id);
+	free(data->frame);
+	data->data_list->d = NULL;
+	tap_data_list_try_to_free_tail(data->data_list);
+	free(data);
+}
+
+/** insert tap_data in the tap_data_list */
+static int tap_data_list_insert(struct tap_data_list** liststart,
+	struct tap_data* d)
+{
+	struct tap_data_list* entry = (struct tap_data_list*)
+		malloc(sizeof(*entry));
+	if(!entry)
+		return 0;
+	entry->next = *liststart;
+	entry->d = d;
+	d->data_list = entry;
+	*liststart = entry;
+	return 1;
+}
+
+/** delete the tap_data_list and free any remaining tap_data */
+static void tap_data_list_delete(struct tap_data_list* list)
+{
+	struct tap_data_list* e = list, *next;
+	while(e) {
+		next = e->next;
+		if(e->d) {
+			tap_data_free(e->d);
+			e->d = NULL;
+		}
+		free(e);
+		e = next;
+	}
+}
+
 /** del the tap event */
 static void tap_socket_delev(struct tap_socket* s)
 {
@@ -184,6 +271,7 @@ static void tap_socket_delete(struct tap_socket* s)
 #ifdef HAVE_SSL
 	SSL_CTX_free(s->sslctx);
 #endif
+	tap_data_list_delete(s->data_list);
 	ub_event_free(s->ev);
 	free(s->socketpath);
 	free(s->ip);
@@ -728,20 +816,6 @@ static ssize_t tap_receive(struct tap_data* data, void* buf, size_t len)
 	return receive_bytes(data, data->fd, buf, len);
 }
 
-/** delete the tap structure */
-static void tap_data_free(struct tap_data* data)
-{
-	ub_event_del(data->ev);
-	ub_event_free(data->ev);
-#ifdef HAVE_SSL
-	SSL_free(data->ssl);
-#endif
-	close(data->fd);
-	free(data->id);
-	free(data->frame);
-	free(data);
-}
-
 /** reply with ACCEPT control frame to bidirectional client,
  * returns 0 on error */
 static int reply_with_accept(struct tap_data* data)
@@ -842,7 +916,11 @@ static int tap_check_peer(struct tap_data* data)
 	if((SSL_get_verify_mode(data->ssl)&SSL_VERIFY_PEER)) {
 		/* verification */
 		if(SSL_get_verify_result(data->ssl) == X509_V_OK) {
+#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
+			X509* x = SSL_get1_peer_certificate(data->ssl);
+#else
 			X509* x = SSL_get_peer_certificate(data->ssl);
+#endif
 			if(!x) {
 				if(verbosity) log_info("SSL connection %s"
 					" failed no certificate", data->id);
@@ -864,7 +942,11 @@ static int tap_check_peer(struct tap_data* data)
 #endif
 			X509_free(x);
 		} else {
+#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
+			X509* x = SSL_get1_peer_certificate(data->ssl);
+#else
 			X509* x = SSL_get_peer_certificate(data->ssl);
+#endif
 			if(x) {
 				if(verbosity)
 					log_cert(VERB_ALGO, "peer certificate", x);
@@ -1046,7 +1128,6 @@ void dtio_tap_callback(int ATTR_UNUSED(fd), short ATTR_UNUSED(bits), void* arg)
 	data->len = 0;
 	data->len_done = 0;
 	data->data_done = 0;
-
 }
 
 /** callback for main listening file descriptor */
@@ -1129,6 +1210,8 @@ void dtio_mainfdcallback(int fd, short ATTR_UNUSED(bits), void* arg)
 		&dtio_tap_callback, data);
 	if(!data->ev) fatal_exit("could not ub_event_new");
 	if(ub_event_add(data->ev, NULL) != 0) fatal_exit("could not ub_event_add");
+	if(!tap_data_list_insert(&tap_sock->data_list, data))
+		fatal_exit("could not tap_data_list_insert");
 }
 
 /** setup local accept sockets */
@@ -1243,6 +1326,79 @@ setup_and_run(struct config_strlist_head* local_list,
 	free(maindata);
 }
 
+/* internal unit tests */
+static int internal_unittest()
+{
+	/* unit test tap_data_list_try_to_free_tail() */
+#define unit_tap_datas_max 5
+	struct tap_data* datas[unit_tap_datas_max];
+	struct tap_data_list* list;
+	struct tap_socket* socket = calloc(1, sizeof(*socket));
+	size_t i = 0;
+	log_assert(socket);
+	log_assert(unit_tap_datas_max>2); /* needed for the test */
+	for(i=0; i<unit_tap_datas_max; i++) {
+		datas[i] = calloc(1, sizeof(struct tap_data));
+		log_assert(datas[i]);
+		log_assert(tap_data_list_insert(&socket->data_list, datas[i]));
+	}
+	/* sanity base check */
+	list = socket->data_list;
+	for(i=0; list; i++) list = list->next;
+	log_assert(i==unit_tap_datas_max);
+
+	/* Free the last data, tail cannot be erased */
+	list = socket->data_list;
+	while(list->next) list = list->next;
+	free(list->d);
+	list->d = NULL;
+	tap_data_list_try_to_free_tail(list);
+	list = socket->data_list;
+	for(i=0; list; i++) list = list->next;
+	log_assert(i==unit_tap_datas_max);
+
+	/* Free the third to last data, tail cannot be erased */
+	list = socket->data_list;
+	for(i=0; i<unit_tap_datas_max-3; i++) list = list->next;
+	free(list->d);
+	list->d = NULL;
+	tap_data_list_try_to_free_tail(list);
+	list = socket->data_list;
+	for(i=0; list; i++) list = list->next;
+	log_assert(i==unit_tap_datas_max);
+
+	/* Free the second to last data, try to remove tail from the third
+	 * again, tail (last 2) should be removed */
+	list = socket->data_list;
+	for(i=0; i<unit_tap_datas_max-2; i++) list = list->next;
+	free(list->d);
+	list->d = NULL;
+	list = socket->data_list;
+	while(list->d) list = list->next;
+	tap_data_list_try_to_free_tail(list);
+	list = socket->data_list;
+	for(i=0; list; i++) list = list->next;
+	log_assert(i==unit_tap_datas_max-2);
+
+	/* Free all the remaining data, try to remove tail from the start,
+	 * only the start should remain */
+	list = socket->data_list;
+	while(list) {
+		free(list->d);
+		list->d = NULL;
+		list = list->next;
+	}
+	tap_data_list_try_to_free_tail(socket->data_list);
+	list = socket->data_list;
+	for(i=0; list; i++) list = list->next;
+	log_assert(i==1);
+
+	/* clean up */
+	tap_data_list_delete(socket->data_list);
+	free(socket);
+	return 0;
+}
+
 /** getopt global, in case header files fail to declare it. */
 extern int optind;
 /** getopt global, in case header files fail to declare it. */
@@ -1293,7 +1449,7 @@ int main(int argc, char** argv)
 #endif
 
 	/* command line options */
-	while( (c=getopt(argc, argv, "hls:t:u:vx:y:z:")) != -1) {
+	while( (c=getopt(argc, argv, "hcls:t:u:vx:y:z:")) != -1) {
 		switch(c) {
 			case 'u':
 				if(!cfg_strlist_append(&local_list,
@@ -1329,6 +1485,12 @@ int main(int argc, char** argv)
 			case 'v':
 				verbosity++;
 				break;
+			case 'c':
+#ifndef UNBOUND_DEBUG
+				fatal_exit("-c option needs compilation with "
+					"--enable-debug");
+#endif
+				return internal_unittest();
 			case 'h':
 			case '?':
 			default:

doc/Changelog

@@ -1,8 +1,201 @@
+19 July 2024: Wouter
+	- Add dnstap-sample-rate that logs only 1/N messages, for high volume
+	  server environments. Thanks Dan Luther.
+	- Fix dnstap wakeup, a running wakeup timer is left to expire and not
+	  increased, a timer is started when the dtio thread is sleeping,
+	  the timer set disabled when the dtio thread goes to sleep, and
+	  after sleep the thread checks to see if there are messages to log
+	  immediately.
+
+16 July 2024: Wouter
+	- For #1103: Fix to drop mesh state reference for the http2 stream
+	  associated with the reply, not the currently active stream. And
+	  it does not remove it twice on a mesh_send_reply call. The reply
+	  h2_stream is NULL when not in use, for more initialisation.
+
+15 July 2024: Wouter
+	- For #1103: fix to also drop mesh state reference when the discard
+	  limit is reached, when there is an error making a new recursion
+	  state and when the connection is dropped with is_drop.
+
+12 July 2024: Yorgos
+	- Add RPZ tag tests in acl_interface.tdir.
+	- For #1102: clearer text for using interface-* options for the
+	  loopback interface.
+
+12 July 2024: Wouter
+	- Fix #1103: unbound 1.20.0 segmentation fault with nghttp2.
+	- For #1103: fix to also drop mesh state reference when a h2 reply is
+	  dropped.
+
+10 July 2024: Wouter
+	- For #773: In contrib/unbound.service.in set unbound to start after
+	  network-online.target. Also for contrib/unbound_portable.service.in.
+
+9 July 2024: Yorgos
+	- Update list of known EDE codes.
+
+8 July 2024: Wouter
+	- Fix that validation reason failure that uses string print uses
+	  separate buffer that is passed, from the scratch validation buffer.
+	- Fixup algo_needs_reason string buffer length.
+	- Fix shadowed error string variable in validator dnskey handling.
+
+5 July 2024: Yorgos
+	- Don't check for message TTL changes if the RRsets remain the same.
+
+5 July 2024: Wouter
+	- Fix for neater printout for error for missing DS response.
+	- Fix neater printout.
+	- Fix #1099: Unbound core dump on SIGSEGV.
+	- Fix for #1099: Fix to check for deleted RRset when the contents
+	  is updated and fetched after it is stored, and also check for a
+	  changed RRset.
+
+4 July 2024: Wouter
+	- Fix to print details about the failure to lookup a DNSKEY record
+	  when validation fails due to the missing DNSKEY. Also for key prime
+	  and DS lookups.
+
+3 July 2024: Yorgos
+	- Fix for repeated use of a DNAME record: first overallocate and then
+	  move the exact size of the init value to avoid false positive heap
+	  overflow reads from address sanitizers.
+
+3 July 2024: Wouter
+	- Fix #144: Port ipset to BSD pf tables.
+	- Add unit test skip files and bison and flex output to gitignore.
+	- Fix to use modstack_init in zonemd unit test.
+	- Fix to remove unneeded linebreak in fptr_wlist.c.
+	- Fix compile warnings in fptr_wlist.c.
+
+2 July 2024: Wouter
+	- Fix to remove unused include from the readzone test program.
+	- Fix unused variable warning in do_cache_remove.
+	- Fix compile warning in worker pthread id printout.
+
+17 June 2024: Wouter
+	- Fix ip-ratelimit-cookie setting, it was not applied.
+
+26 June 2024: Yorgos
+	- Explicitly set the RD bit for the mesh query flags when prefetching.
+	  These queries have no waiting client but they need to be treated as
+	  recursive.
+
+21 June 2024: Yorgos
+	- Fix pkg-config availability check in dnstap/dnstap.m4 and
+	  systemd.m4.
+
+19 June 2024: Yorgos
+	- Fix #1092: Ubuntu 22.04 Jammy fails to compile unbound 1.20.0; by
+	  adding helpful text for the Python interpreter version and allowing
+	  the default pkg-config unavailability error message to be shown.
+
+17 June 2024: Wouter
+	- Fix #1091: Build fails with OpenSSL >= 3.0 built with
+	  OPENSSL_NO_DEPRECATED.
+
+7 June 2024: Wouter
+	- Add unit test for validation of repeated use of a DNAME record.
+
+6 June 2024: Wouter
+	- Fix memory leak in setup of dsa sig.
+	- Fix typos for 'the the' in text.
+	- Fix validation for repeated use of a DNAME record.
+
+4 June 2024: Yorgos
+	- Merge #1080: AddressSanitizer detection in tdir tests and memory leak
+	  fixes.
+	- Fix memory leak when reload_keep_cache is used and num-threads
+	  changes.
+	- Fix memory leak on exit for unbound-dnstap-socket; creates false
+	  negatives during testing.
+
+3 June 2024: Wouter
+	- Fix to squelch connection reset by peer errors from log. And fix
+	  that the tcp read errors are labeled as initial for the first calls.
+
+30 May 2024: Wouter
+	- Fix #1079: tags from tagged rpz zones are no longer honored after
+	  upgrade from 1.19.3 to 1.20.0.
+	- Fix for #1079: fix RPZ taglist in iterator callback that no client
+	  info is like no taglist intersection.
+
+29 May 2024: Wouter
+	- Merge #1078: Only check old pid if no username.
+
+27 May 2024: Wouter
+	- Fix to enable that SERVFAIL is cached, for a short period, for more
+	  cases. In the cases where limits are exceeded.
+	- Fix spelling of tcp-idle-timeout docs, from Michael Tokarev.
+
+27 May 2024: Yorgos
+	- Fix unused variable warning on compilation with no thread support.
+	- unbound-control-setup: check openssl availability before doing
+	  anything, patch from Michael Tokarev.
+	- Update patch to remove 'command' shell builtin and update error
+	  text.
+
+24 May 2024: Wouter
+	- Fix #1064: Unbound 1.20 Cachedb broken?
+
+24 May 2024: Yorgos
+	- Fix #1059: Intermittent DNS blocking failure with local-zone and
+	  always_nxdomain. Addition of local_zones dynamically via
+	  unbound-control was not finding the zone's parent correctly.
+
+21 May 2024: Wouter
+	- Merge #1073: fix null pointer dereference issue in function
+	  ub_ctx_set_fwd.
+	- Fix to print a parse error when config is read with no name for
+	  a forward-zone, stub-zone or view.
+	- Fix for parse end of forward-zone, stub-zone and view.
+	- Fix for #1064: Fix that cachedb expired messages are considered
+	  insecure, and thus can be served to clients when dnssec is enabled.
+
+17 May 2024: Yorgos
+	- Merge #1069: Fix unbound-control stdin commands for multi-process
+	  Unbounds.
+	- Fix unbound-control commands that read stdin in multi-process
+	  operation (local_zones_remove, local_zones, local_datas_remove,
+	  local_datas, view_local_datas_remove, view_local_datas). They will
+	  be properly distributed to all processes. dump_cache and load_cache
+	  are no longer supported in multi-process operation.
+	- Remove testdata/remote-threaded.tdir. testdata/09-unbound-control.tdir
+	  now checks both single and multi process/thread operation.
+
+16 May 2024: Yorgos
+	- Merge #1070: Fix rtt assignement for low values of
+	  infra-cache-max-rtt.
+
+16 May 2024: Wouter
+	- Fix #1071: [FR] Clear both in-memory and cachedb module cache with
+	  `unbound-control flush*` commands.
+
+15 May 2024: Yorgos
+	- Add missing common functions to tdir tests.
+
+10 May 2024: Wouter
+	- Fix when the mesh jostle is exceeded that nameserver targets are
+	  marked as resolved, so that the lookup is not stuck on the
+	  requestlist.
+
+8 May 2024: Wouter
+	- Fix to squelch udp connect errors in the log at low verbosity about
+	  invalid argument for IPv6 link local addresses.
+
+7 May 2024: Wouter
+	- Merge #1062: Fix potential overflow bug while parsing port in
+	  function cfg_mark_ports.
+	- Fix for #1062: declaration before statement, avoid print of null,
+	  and redundant check for array size.
+
 1 May 2024: Wouter
 	- Fix for the DNSBomb vulnerability CVE-2024-33655. Thanks to Xiang Li
 	  from the Network and Information Security Lab of Tsinghua University
 	  for reporting it.
-	- Set version number to 1.20.0 for release.
+	- Set version number to 1.20.0 for release. This became the release
+	  on 8 may 2024, the repository continues with version 1.20.1.
 
 29 April 2024: Yorgos
 	- Cleanup unnecessary strdup calls for EDE strings.

doc/example.conf.in

@@ -1329,6 +1329,8 @@ remote-control:
 # 	dnstap-identity: ""
 # 	# if "" it uses the package version.
 # 	dnstap-version: ""
+# 	# log only 1/N messages, if 0 it is disabled. default 0.
+# 	dnstap-sample-rate: 0
 # 	dnstap-log-resolver-query-messages: no
 # 	dnstap-log-resolver-response-messages: no
 # 	dnstap-log-client-query-messages: no

doc/unbound-control.8.in

@@ -121,31 +121,38 @@ Remove local data RRs read from stdin of unbound\-control. Input is one name per
 line. For bulk removals.
 .TP
 .B dump_cache
-The contents of the cache is printed in a text format to stdout. You can
-redirect it to a file to store the cache in a file.
+The content of the cache is printed in a text format to stdout.
+You can redirect it to a file to store the cache in a file.
+Not supported in remote Unbounds in multi-process operation.
 .TP
 .B load_cache
-The contents of the cache is loaded from stdin.  Uses the same format as
-dump_cache uses.  Loading the cache with old, or wrong data can result
-in old or wrong data returned to clients.  Loading data into the cache
-in this way is supported in order to aid with debugging.
+The content of the cache is loaded from stdin.
+Uses the same format as dump_cache uses.
+Loading the cache with old, or wrong data can result in old or wrong data
+returned to clients.
+Loading data into the cache in this way is supported in order to aid with
+debugging.
+Not supported in remote Unbounds in multi-process operation.
 .TP
 .B lookup \fIname
 Print to stdout the name servers that would be used to look up the
 name specified.
 .TP
-.B flush \fIname
+.B flush \fR[\fI+c\fR] \fIname
 Remove the name from the cache. Removes the types
 A, AAAA, NS, SOA, CNAME, DNAME, MX, PTR, SRV, NAPTR, SVCB and HTTPS.
 Because that is fast to do. Other record types can be removed using
 .B flush_type
 or
 .B flush_zone\fR.
+.IP
+The '+c' option removes the items also from the cachedb cache. If
+cachedb is in use.
 .TP
-.B flush_type \fIname\fR \fItype
+.B flush_type \fR[\fI+c\fR] \fIname\fR \fItype
 Remove the name, type information from the cache.
 .TP
-.B flush_zone \fIname
+.B flush_zone \fR[\fI+c\fR] \fIname
 Remove all information at or below the name from the cache.
 The rrsets and key entries are removed so that new lookups will be performed.
 This needs to walk and inspect the entire cache, and is a slow operation.
@@ -153,10 +160,10 @@ The entries are set to expired in the implementation of this command (so,
 with serve\-expired enabled, it'll serve that information but schedule a
 prefetch for new information).
 .TP
-.B flush_bogus
+.B flush_bogus \fR[\fI+c\fR]
 Remove all bogus data from the cache.
 .TP
-.B flush_negative
+.B flush_negative \fR[\fI+c\fR]
 Remove all negative data from the cache.  This is nxdomain answers,
 nodata answers and servfail answers.  Also removes bad key entries
 (which could be due to failed lookups) from the dnssec key cache, and

doc/unbound.conf.5.in

@@ -511,7 +511,7 @@ configured value if the number of free buffers falls below 35% of the
 total number configured, and finally to 0 if the number of free buffers
 falls below 20% of the total number configured. A minimum timeout of
 200 milliseconds is observed regardless of the option value used.
-It will be overriden by \fBedns\-tcp\-keepalive\-timeout\fR if
+It will be overridden by \fBedns\-tcp\-keepalive\-timeout\fR if
 \fBedns\-tcp\-keepalive\fR is enabled.
 .TP
 .B tcp-reuse-timeout: \fI<msec>\fR
@@ -788,7 +788,8 @@ transports, regardless of the presence of an DNS Cookie and regardless of the
 UDP queries without a DNS Cookie receive REFUSED responses with the TC flag set,
 that may trigger fall back to TCP for those clients.
 .IP
-By default only localhost is \fIallow\fRed, the rest is \fIrefuse\fRd.
+By default only localhost (the 127.0.0.0/8 IP netblock, not the loopback
+interface) is implicitly \fIallow\fRed, the rest is \fIrefuse\fRd.
 The default is \fIrefuse\fRd, because that is protocol\-friendly. The DNS
 protocol is not designed to handle dropped packets due to policy, and
 dropping may result in (possibly excessive) retried queries.
@@ -824,8 +825,12 @@ Similar to \fBaccess\-control:\fR but for interfaces.
 .IP
 The action is the same as the ones defined under \fBaccess\-control:\fR.
 Interfaces are \fIrefuse\fRd by default.
-By default only localhost (the IP netblock, not the loopback interface) is
-\fIallow\fRed through the default \fBaccess\-control:\fR behavior.
+By default only localhost (the 127.0.0.0/8 IP netblock, not the loopback
+interface) is implicitly \fIallow\fRed through the default
+\fBaccess\-control:\fR behavior.
+This also means that any attempt to use the \fBinterface-*:\fR options for the
+loopback interface will not work as they will be overridden by the implicit
+default "\fBaccess\-control:\fR 127.0.0.0/8 allow" option.
 .IP
 Note that the interface needs to be already specified with \fBinterface:\fR
 and that any \fBaccess-control*:\fR setting overrides all \fBinterface-*:\fR
@@ -2847,6 +2852,13 @@ Default is "".
 The version to send with messages, if "" the package version is used.
 Default is "".
 .TP
+.B dnstap-sample-rate: \fI<number>
+The sample rate for log of messages, it logs only 1/N messages. With 0 it
+is disabled. Default is 0. This is useful in a high volume environment,
+where log functionality would otherwise not be reliable. For example 10
+would spend only 1/10th time on logging, and 100 would only spend a
+hundredth of the time on logging.
+.TP
 .B dnstap-log-resolver-query-messages: \fI<yes or no>
 Enable to log resolver query messages.  Default is no.
 These are messages from Unbound to upstream servers.

dynlibmod/dynlibmod.c

@@ -297,8 +297,8 @@ inplace_cb_delete_wrapped(struct module_env* env, enum inplace_cb_list_type type
  */
 static struct module_func_block dynlibmod_block = {
    "dynlib",
-   &dynlibmod_init, &dynlibmod_deinit, &dynlibmod_operate, &dynlibmod_inform_super,
-   &dynlibmod_clear, &dynlibmod_get_mem
+   NULL, NULL, &dynlibmod_init, &dynlibmod_deinit, &dynlibmod_operate,
+   &dynlibmod_inform_super, &dynlibmod_clear, &dynlibmod_get_mem
 };
 
 struct module_func_block* dynlibmod_get_funcblock(void)

edns-subnet/subnetmod.c

@@ -995,7 +995,8 @@ subnetmod_get_mem(struct module_env *env, int id)
  * The module function block 
  */
 static struct module_func_block subnetmod_block = {
-	"subnetcache", &subnetmod_init, &subnetmod_deinit, &subnetmod_operate,
+	"subnetcache",
+	NULL, NULL, &subnetmod_init, &subnetmod_deinit, &subnetmod_operate,
 	&subnetmod_inform_super, &subnetmod_clear, &subnetmod_get_mem
 };
 

ipsecmod/ipsecmod.c

@@ -615,7 +615,7 @@ ipsecmod_get_mem(struct module_env* env, int id)
  */
 static struct module_func_block ipsecmod_block = {
 	"ipsecmod",
-	&ipsecmod_init, &ipsecmod_deinit, &ipsecmod_operate,
+	NULL, NULL, &ipsecmod_init, &ipsecmod_deinit, &ipsecmod_operate,
 	&ipsecmod_inform_super, &ipsecmod_clear, &ipsecmod_get_mem
 };
 

ipset/ipset.c

@@ -17,9 +17,19 @@
 #include "sldns/wire2str.h"
 #include "sldns/parseutil.h"
 
+#ifdef HAVE_NET_PFVAR_H
+#include <fcntl.h>
+#include <sys/ioctl.h>
+#include <netinet/in.h>
+#include <net/if.h>
+#include <net/pfvar.h>
+typedef intptr_t filter_dev;
+#else
 #include <libmnl/libmnl.h>
 #include <linux/netfilter/nfnetlink.h>
 #include <linux/netfilter/ipset/ip_set.h>
+typedef struct mnl_socket * filter_dev;
+#endif
 
 #define BUFF_LEN 256
 
@@ -41,24 +51,95 @@ static int error_response(struct module_qstate* qstate, int id, int rcode) {
 	return 0;
 }
 
-static struct mnl_socket * open_mnl_socket() {
-	struct mnl_socket *mnl;
+#ifdef HAVE_NET_PFVAR_H
+static void * open_filter() {
+	filter_dev dev;
 
-	mnl = mnl_socket_open(NETLINK_NETFILTER);
-	if (!mnl) {
+	dev = open("/dev/pf", O_RDWR);
+	if (dev == -1) {
+		log_err("open(\"/dev/pf\") failed: %s", strerror(errno));
+		return NULL;
+	}
+	else
+		return (void *)dev;
+}
+#else
+static void * open_filter() {
+	filter_dev dev;
+
+	dev = mnl_socket_open(NETLINK_NETFILTER);
+	if (!dev) {
 		log_err("ipset: could not open netfilter.");
 		return NULL;
 	}
 
-	if (mnl_socket_bind(mnl, 0, MNL_SOCKET_AUTOPID) < 0) {
-		mnl_socket_close(mnl);
+	if (mnl_socket_bind(dev, 0, MNL_SOCKET_AUTOPID) < 0) {
+		mnl_socket_close(dev);
 		log_err("ipset: could not bind netfilter.");
 		return NULL;
 	}
-	return mnl;
+	return (void *)dev;
 }
+#endif
 
-static int add_to_ipset(struct mnl_socket *mnl, const char *setname, const void *ipaddr, int af) {
+#ifdef HAVE_NET_PFVAR_H
+static int add_to_ipset(filter_dev dev, const char *setname, const void *ipaddr, int af) {
+	struct pfioc_table io;
+	struct pfr_addr addr;
+	const char *p;
+	int i;
+
+	bzero(&io, sizeof(io));
+	bzero(&addr, sizeof(addr));
+
+	p = strrchr(setname, '/');
+	if (p) {
+		i = p - setname;
+		if (i >= PATH_MAX) {
+			errno = ENAMETOOLONG;
+			return -1;
+		}
+		memcpy(io.pfrio_table.pfrt_anchor, setname, i);
+		if (i < PATH_MAX)
+			io.pfrio_table.pfrt_anchor[i] = '\0';
+		p++;
+	}
+	else
+		p = setname;
+
+	if (strlen(p) >= PF_TABLE_NAME_SIZE) {
+		errno = ENAMETOOLONG;
+		return -1;
+	}
+	strlcpy(io.pfrio_table.pfrt_name, p, PF_TABLE_NAME_SIZE);
+
+	io.pfrio_buffer = &addr;
+	io.pfrio_size = 1;
+	io.pfrio_esize = sizeof(addr);
+
+	switch (af) {
+		case AF_INET:
+			addr.pfra_ip4addr = *(struct in_addr *)ipaddr;
+			addr.pfra_net = 32;
+			break;
+		case AF_INET6:
+			addr.pfra_ip6addr = *(struct in6_addr *)ipaddr;
+			addr.pfra_net = 128;
+			break;
+		default:
+		errno = EAFNOSUPPORT;
+		return -1;
+	}
+	addr.pfra_af = af;
+
+	if (ioctl(dev, DIOCRADDADDRS, &io) == -1) {
+		log_err("ioctl failed: %s", strerror(errno));
+		return -1;
+	}
+	return 0;
+}
+#else
+static int add_to_ipset(filter_dev dev, const char *setname, const void *ipaddr, int af) {
 	struct nlmsghdr *nlh;
 	struct nfgenmsg *nfg;
 	struct nlattr *nested[2];
@@ -91,14 +172,15 @@ static int add_to_ipset(struct mnl_socket *mnl, const char *setname, const void
 	mnl_attr_nest_end(nlh, nested[1]);
 	mnl_attr_nest_end(nlh, nested[0]);
 
-	if (mnl_socket_sendto(mnl, nlh, nlh->nlmsg_len) < 0) {
+	if (mnl_socket_sendto(dev, nlh, nlh->nlmsg_len) < 0) {
 		return -1;
 	}
 	return 0;
 }
+#endif
 
 static void
-ipset_add_rrset_data(struct ipset_env *ie, struct mnl_socket *mnl,
+ipset_add_rrset_data(struct ipset_env *ie,
 	struct packed_rrset_data *d, const char* setname, int af,
 	const char* dname)
 {
@@ -123,12 +205,16 @@ ipset_add_rrset_data(struct ipset_env *ie, struct mnl_socket *mnl,
 					snprintf(ip, sizeof(ip), "(inet_ntop_error)");
 				verbose(VERB_QUERY, "ipset: add %s to %s for %s", ip, setname, dname);
 			}
-			ret = add_to_ipset(mnl, setname, rr_data + 2, af);
+			ret = add_to_ipset((filter_dev)ie->dev, setname, rr_data + 2, af);
 			if (ret < 0) {
 				log_err("ipset: could not add %s into %s", dname, setname);
 
-				mnl_socket_close(mnl);
-				ie->mnl = NULL;
+#if HAVE_NET_PFVAR_H
+				/* don't close as we might not be able to open again due to dropped privs */
+#else
+				mnl_socket_close((filter_dev)ie->dev);
+				ie->dev = NULL;
+#endif
 				break;
 			}
 		}
@@ -137,8 +223,8 @@ ipset_add_rrset_data(struct ipset_env *ie, struct mnl_socket *mnl,
 
 static int
 ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
-	struct mnl_socket *mnl, struct ub_packed_rrset_key *rrset,
-	const char *qname, const int qlen, const char *setname, int af)
+	struct ub_packed_rrset_key *rrset, const char *qname, int qlen,
+	const char *setname, int af)
 {
 	static char dname[BUFF_LEN];
 	const char *ds, *qs;
@@ -152,11 +238,20 @@ ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 		log_err("bad domain name");
 		return -1;
 	}
+	if (dname[dlen - 1] == '.') {
+		dlen--;
+	}
+	if (qname[qlen - 1] == '.') {
+		qlen--;
+	}
 
 	for (p = env->cfg->local_zones_ipset; p; p = p->next) {
 		ds = NULL;
 		qs = NULL;
 		plen = strlen(p->str);
+		if (p->str[plen - 1] == '.') {
+			plen--;
+		}
 
 		if (dlen == plen || (dlen > plen && dname[dlen - plen - 1] == '.' )) {
 			ds = dname + (dlen - plen);
@@ -167,8 +262,7 @@ ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 		if ((ds && strncasecmp(p->str, ds, plen) == 0)
 			|| (qs && strncasecmp(p->str, qs, plen) == 0)) {
 			d = (struct packed_rrset_data*)rrset->entry.data;
-			ipset_add_rrset_data(ie, mnl, d, setname,
-				af, dname);
+			ipset_add_rrset_data(ie, d, setname, af, dname);
 			break;
 		}
 	}
@@ -178,7 +272,6 @@ ipset_check_zones_for_rrset(struct module_env *env, struct ipset_env *ie,
 static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 	struct query_info qinfo, struct ipset_env *ie)
 {
-	struct mnl_socket *mnl;
 	size_t i;
 	const char *setname;
 	struct ub_packed_rrset_key *rrset;
@@ -186,15 +279,17 @@ static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 	static char qname[BUFF_LEN];
 	int qlen;
 
-	mnl = (struct mnl_socket *)ie->mnl;
-	if (!mnl) {
+#ifdef HAVE_NET_PFVAR_H
+#else
+	if (!ie->dev) {
 		/* retry to create mnl socket */
-		mnl = open_mnl_socket();
-		if (!mnl) {
+		ie->dev = open_filter();
+		if (!ie->dev) {
+			log_warn("ipset open_filter failed");
 			return -1;
 		}
-		ie->mnl = mnl;
 	}
+#endif
 
 	qlen = sldns_wire2str_dname_buf(qinfo.qname, qinfo.qname_len,
 		qname, BUFF_LEN);
@@ -217,8 +312,8 @@ static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 		}
 
 		if (setname) {
-			if(ipset_check_zones_for_rrset(env, ie, mnl, rrset,
-				qname, qlen, setname, af) == -1)
+			if(ipset_check_zones_for_rrset(env, ie, rrset, qname,
+				qlen, setname, af) == -1)
 				return -1;
 		}
 	}
@@ -226,7 +321,7 @@ static int ipset_update(struct module_env *env, struct dns_msg *return_msg,
 	return 0;
 }
 
-int ipset_init(struct module_env* env, int id) {
+int ipset_startup(struct module_env* env, int id) {
 	struct ipset_env *ipset_env;
 
 	ipset_env = (struct ipset_env *)calloc(1, sizeof(struct ipset_env));
@@ -237,7 +332,43 @@ int ipset_init(struct module_env* env, int id) {
 
 	env->modinfo[id] = (void *)ipset_env;
 
-	ipset_env->mnl = NULL;
+#ifdef HAVE_NET_PFVAR_H
+	ipset_env->dev = open_filter();
+	if (!ipset_env->dev) {
+		log_err("ipset open_filter failed");
+		return 0;
+	}
+#else
+	ipset_env->dev = NULL;
+#endif
+	return 1;
+}
+
+void ipset_destartup(struct module_env* env, int id) {
+	filter_dev dev;
+	struct ipset_env *ipset_env;
+
+	if (!env || !env->modinfo[id]) {
+		return;
+	}
+	ipset_env = (struct ipset_env*)env->modinfo[id];
+
+	dev = (filter_dev)ipset_env->dev;
+	if (dev) {
+#if HAVE_NET_PFVAR_H
+		close(dev);
+#else
+		mnl_socket_close(dev);
+#endif
+		ipset_env->dev = NULL;
+	}
+
+	free(ipset_env);
+	env->modinfo[id] = NULL;
+}
+
+int ipset_init(struct module_env* env, int id) {
+	struct ipset_env *ipset_env = env->modinfo[id];
 
 	ipset_env->name_v4 = env->cfg->ipset_name_v4;
 	ipset_env->name_v6 = env->cfg->ipset_name_v6;
@@ -253,24 +384,8 @@ int ipset_init(struct module_env* env, int id) {
 	return 1;
 }
 
-void ipset_deinit(struct module_env *env, int id) {
-	struct mnl_socket *mnl;
-	struct ipset_env *ipset_env;
-
-	if (!env || !env->modinfo[id]) {
-		return;
-	}
-
-	ipset_env = (struct ipset_env *)env->modinfo[id];
-
-	mnl = (struct mnl_socket *)ipset_env->mnl;
-	if (mnl) {
-		mnl_socket_close(mnl);
-		ipset_env->mnl = NULL;
-	}
-
-	free(ipset_env);
-	env->modinfo[id] = NULL;
+void ipset_deinit(struct module_env *ATTR_UNUSED(env), int ATTR_UNUSED(id)) {
+	/* nothing */
 }
 
 static int ipset_new(struct module_qstate* qstate, int id) {
@@ -376,8 +491,8 @@ size_t ipset_get_mem(struct module_env *env, int id) {
  */
 static struct module_func_block ipset_block = {
 	"ipset",
-	&ipset_init, &ipset_deinit, &ipset_operate,
-	&ipset_inform_super, &ipset_clear, &ipset_get_mem
+	&ipset_startup, &ipset_destartup, &ipset_init, &ipset_deinit,
+	&ipset_operate, &ipset_inform_super, &ipset_clear, &ipset_get_mem
 };
 
 struct module_func_block * ipset_get_funcblock(void) {

ipset/ipset.h

@@ -37,7 +37,7 @@ extern "C" {
 #endif
 
 struct ipset_env {
-    void* mnl;
+	void* dev;
 
 	int v4_enabled;
 	int v6_enabled;
@@ -50,6 +50,10 @@ struct ipset_qstate {
 	int dummy;
 };
 
+/** Startup the ipset module */
+int ipset_startup(struct module_env* env, int id);
+/** Destartup the ipset module */
+void ipset_destartup(struct module_env* env, int id);
 /** Init the ipset module */
 int ipset_init(struct module_env* env, int id);
 /** Deinit the ipset module */

iterator/iter_utils.c

@@ -279,9 +279,10 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 		name, namelen, qtype, &lame, &dnsseclame, &reclame,
 		&rtt, now)) {
 		log_addr(VERB_ALGO, "servselect", &a->addr, a->addrlen);
-		verbose(VERB_ALGO, "   rtt=%d%s%s%s%s", rtt,
+		verbose(VERB_ALGO, "   rtt=%d%s%s%s%s%s", rtt,
 			lame?" LAME":"",
 			dnsseclame?" DNSSEC_LAME":"",
+			a->dnsseclame?" ADDR_DNSSEC_LAME":"",
 			reclame?" REC_LAME":"",
 			a->lame?" ADDR_LAME":"");
 		if(lame)

iterator/iterator.c

@@ -1378,7 +1378,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			"restarts (eg. indirections)");
 		if(iq->qchase.qname)
 			errinf_dname(qstate, "stop at", iq->qchase.qname);
-		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 
 	/* We enforce a maximum recursion/dependency depth -- in general, 
@@ -1654,7 +1654,7 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 				if(!iq->dp) {
 					log_err("internal error: no hints dp");
 					errinf(qstate, "no hints for this class");
-					return error_response(qstate, id, 
+					return error_response_cache(qstate, id,
 						LDNS_RCODE_SERVFAIL);
 				}
 				iq->dp = delegpt_copy(iq->dp, qstate->region);
@@ -1974,7 +1974,8 @@ generate_target_query(struct module_qstate* qstate, struct iter_qstate* iq,
  *	if it is negative, there is no maximum number of targets.
  * @param num: returns the number of queries generated and processed, 
  *	which may be zero if there were no missing targets.
- * @return false on error.
+ * @return 0 on success, nonzero on error. 1 means temporary failure and
+ * 	2 means the failure can be cached.
  */
 static int
 query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
@@ -1997,13 +1998,13 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 	else	toget = maxtargets;
 	if(toget == 0) {
 		*num = 0;
-		return 1;
+		return 0;
 	}
 
 	/* now that we are sure that a target query is going to be made,
 	 * check the limits. */
 	if(iq->depth == ie->max_dependency_depth)
-		return 0;
+		return 1;
 	if(iq->depth > 0 && iq->target_count &&
 		iq->target_count[TARGET_COUNT_QUERIES] > MAX_TARGET_COUNT) {
 		char s[LDNS_MAX_DOMAINLEN+1];
@@ -2011,7 +2012,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_QUERY, "request %s has exceeded the maximum "
 			"number of glue fetches %d", s,
 			iq->target_count[TARGET_COUNT_QUERIES]);
-		return 0;
+		return 2;
 	}
 	if(iq->dp_target_count > MAX_DP_TARGET_COUNT) {
 		char s[LDNS_MAX_DOMAINLEN+1];
@@ -2019,7 +2020,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_QUERY, "request %s has exceeded the maximum "
 			"number of glue fetches %d to a single delegation point",
 			s, iq->dp_target_count);
-		return 0;
+		return 2;
 	}
 
 	/* select 'toget' items from the total of 'missing' items */
@@ -2048,7 +2049,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 				*num = query_count;
 				if(query_count > 0)
 					qstate->ext_state[id] = module_wait_subquery;
-				return 0;
+				return 1;
 			}
 			query_count++;
 			/* If the mesh query list is full, exit the loop here.
@@ -2057,8 +2058,16 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 			 * increase, because the spawned state uses cpu and a
 			 * socket while this state waits for that spawned
 			 * state. Next time we can look up further targets */
-			if(mesh_jostle_exceeded(qstate->env->mesh))
+			if(mesh_jostle_exceeded(qstate->env->mesh)) {
+				/* If no ip4 query is possible, that makes
+				 * this ns resolved. */
+				if(!((ie->supports_ipv4 || ie->use_nat64) &&
+					((ns->lame && !ns->done_pside4) ||
+					(!ns->lame && !ns->got4)))) {
+					ns->resolved = 1;
+				}
 				break;
+			}
 		}
 		/* Send the A request. */
 		if((ie->supports_ipv4 || ie->use_nat64) &&
@@ -2070,12 +2079,17 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 				*num = query_count;
 				if(query_count > 0)
 					qstate->ext_state[id] = module_wait_subquery;
-				return 0;
+				return 1;
 			}
 			query_count++;
 			/* If the mesh query list is full, exit the loop. */
-			if(mesh_jostle_exceeded(qstate->env->mesh))
+			if(mesh_jostle_exceeded(qstate->env->mesh)) {
+				/* With the ip6 query already checked for,
+				 * this makes the ns resolved. It is no longer
+				 * a missing target. */
+				ns->resolved = 1;
 				break;
+			}
 		}
 
 		/* mark this target as in progress. */
@@ -2089,7 +2103,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 	if(query_count > 0)
 		qstate->ext_state[id] = module_wait_subquery;
 
-	return 1;
+	return 0;
 }
 
 /**
@@ -2180,12 +2194,14 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	/* query for an extra name added by the parent-NS record */
 	if(delegpt_count_missing_targets(iq->dp, NULL) > 0) {
-		int qs = 0;
+		int qs = 0, ret;
 		verbose(VERB_ALGO, "try parent-side target name");
-		if(!query_for_targets(qstate, iq, ie, id, 1, &qs)) {
+		if((ret=query_for_targets(qstate, iq, ie, id, 1, &qs))!=0) {
 			errinf(qstate, "could not fetch nameserver");
 			errinf_dname(qstate, "at zone", iq->dp->name);
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			if(ret == 1)
+				return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->num_target_queries += qs;
 		target_count_increase(iq, qs);
@@ -2414,13 +2430,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_QUERY, "request has exceeded the maximum "
 			"number of referrrals with %d", iq->referral_count);
 		errinf(qstate, "exceeded the maximum of referrals");
-		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 	if(iq->sent_count > ie->max_sent_count) {
 		verbose(VERB_QUERY, "request has exceeded the maximum "
 			"number of sends with %d", iq->sent_count);
 		errinf(qstate, "exceeded the maximum number of sends");
-		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 
 	/* Check if we reached MAX_TARGET_NX limit without a fallback activation. */
@@ -2450,7 +2466,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 				"already present for the delegation point, no "
 				"fallback possible");
 			errinf(qstate, "exceeded the maximum nameserver nxdomains");
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		verbose(VERB_ALGO, "initiating parent-side fallback for "
 			"nxdomain nameserver lookups");
@@ -2493,7 +2509,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 				"lookups (%d) with %d", MAX_TARGET_NX_FALLBACK,
 				iq->target_count[TARGET_COUNT_NX]);
 			errinf(qstate, "exceeded the maximum nameserver nxdomains");
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 
 		if(!iq->dp->has_parent_side_NS) {
@@ -2707,7 +2723,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_ALGO, "auth zone lookup failed, no fallback,"
 			" servfail");
 		errinf(qstate, "auth zone lookup failed, fallback is off");
-		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+		return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 	if(iq->dp->auth_dp) {
 		/* we wanted to fallback, but had no delegpt, only the
@@ -2736,11 +2752,13 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 
 	/* if in 0x20 fallback get as many targets as possible */
 	if(iq->caps_fallback) {
-		int extra = 0;
+		int extra = 0, ret;
 		size_t naddr, nres, navail;
-		if(!query_for_targets(qstate, iq, ie, id, -1, &extra)) {
+		if((ret=query_for_targets(qstate, iq, ie, id, -1, &extra))!=0) {
 			errinf(qstate, "could not fetch nameservers for 0x20 fallback");
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			if(ret == 1)
+				return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		iq->num_target_queries += extra;
 		target_count_increase(iq, extra);
@@ -2883,14 +2901,17 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			 * to distinguish between generating (a) new target 
 			 * query, or failing. */
 			if(delegpt_count_missing_targets(iq->dp, NULL) > 0) {
-				int qs = 0;
+				int qs = 0, ret;
 				verbose(VERB_ALGO, "querying for next "
 					"missing target");
-				if(!query_for_targets(qstate, iq, ie, id, 
-					1, &qs)) {
+				if((ret=query_for_targets(qstate, iq, ie, id, 
+					1, &qs))!=0) {
 					errinf(qstate, "could not fetch nameserver");
 					errinf_dname(qstate, "at zone", iq->dp->name);
-					return error_response(qstate, id,
+					if(ret == 1)
+						return error_response(qstate, id,
+							LDNS_RCODE_SERVFAIL);
+					return error_response_cache(qstate, id,
 						LDNS_RCODE_SERVFAIL);
 				}
 				if(qs == 0 && 
@@ -2902,6 +2923,17 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 					 * so this is not a loop. */
 					return 1;
 				}
+				if(qs == 0) {
+					/* There should be targets now, and
+					 * if there are not, it should not
+					 * wait for no targets. Stop it from
+					 * waiting forever, or looping to
+					 * here, as a safeguard. */
+					errinf(qstate, "could not generate nameserver lookups");
+					errinf_dname(qstate, "at zone", iq->dp->name);
+					return error_response(qstate, id,
+						LDNS_RCODE_SERVFAIL);
+				}
 				iq->num_target_queries += qs;
 				target_count_increase(iq, qs);
 			}
@@ -3025,7 +3057,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			qstate->was_ratelimited = 1;
 			errinf_dname(qstate, "exceeded ratelimit for zone",
 				iq->dp->name);
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		log_addr(VERB_QUERY, "error sending query to auth server",
 			&real_addr, real_addrlen);
@@ -3247,7 +3279,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 						iter_scrub_nxdomain(iq->response);
 						return final_state(iq);
 					}
-					return error_response(qstate, id,
+					return error_response_cache(qstate, id,
 						LDNS_RCODE_SERVFAIL);
 				}
 				/* Best effort qname-minimisation. 
@@ -3582,7 +3614,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				" fallback possible, servfail");
 			errinf_dname(qstate, "response is bad, no fallback, "
 				"for auth zone", iq->dp->name);
-			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+			return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
 		}
 		verbose(VERB_ALGO, "auth zone response was bad, "
 			"fallback enabled");
@@ -3990,7 +4022,7 @@ processCollectClass(struct module_qstate* qstate, int id)
 		if(iq->num_current_queries == 0) {
 			verbose(VERB_ALGO, "No root hints or fwds, giving up "
 				"on qclass ANY");
-			return error_response(qstate, id, LDNS_RCODE_REFUSED);
+			return error_response_cache(qstate, id, LDNS_RCODE_REFUSED);
 		}
 		/* return false, wait for queries to return */
 	}
@@ -4357,7 +4389,7 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 					"getting different replies, failed");
 				outbound_list_remove(&iq->outlist, outbound);
 				errinf(qstate, "0x20 failed, then got different replies in fallback");
-				(void)error_response(qstate, id, 
+				(void)error_response_cache(qstate, id,
 					LDNS_RCODE_SERVFAIL);
 				return;
 			}
@@ -4457,8 +4489,8 @@ iter_get_mem(struct module_env* env, int id)
  */
 static struct module_func_block iter_block = {
 	"iterator",
-	&iter_init, &iter_deinit, &iter_operate, &iter_inform_super, 
-	&iter_clear, &iter_get_mem
+	NULL, NULL, &iter_init, &iter_deinit, &iter_operate,
+	&iter_inform_super, &iter_clear, &iter_get_mem
 };
 
 struct module_func_block* 

libunbound/context.c

@@ -75,7 +75,9 @@ context_finalize(struct ub_ctx* ctx)
 	ctx->pipe_pid = getpid();
 	cfg_apply_local_port_policy(cfg, 65536);
 	config_apply(cfg);
-	if(!modstack_setup(&ctx->mods, cfg->module_conf, ctx->env))
+	if(!modstack_call_startup(&ctx->mods, cfg->module_conf, ctx->env))
+		return UB_INITFAIL;
+	if(!modstack_call_init(&ctx->mods, cfg->module_conf, ctx->env))
 		return UB_INITFAIL;
 	listen_setup_locks();
 	log_edns_known_options(VERB_ALGO, ctx->env);

libunbound/libunbound.c

@@ -188,7 +188,9 @@ ub_ctx_create(void)
 		int e = errno;
 		ub_randfree(ctx->seed_rnd);
 		config_delete(ctx->env->cfg);
-		modstack_desetup(&ctx->mods, ctx->env);
+		modstack_call_deinit(&ctx->mods, ctx->env);
+		modstack_call_destartup(&ctx->mods, ctx->env);
+		modstack_free(&ctx->mods);
 		listen_desetup_locks();
 		edns_known_options_delete(ctx->env);
 		edns_strings_delete(ctx->env->edns_strings);
@@ -202,7 +204,9 @@ ub_ctx_create(void)
 		tube_delete(ctx->qq_pipe);
 		ub_randfree(ctx->seed_rnd);
 		config_delete(ctx->env->cfg);
-		modstack_desetup(&ctx->mods, ctx->env);
+		modstack_call_deinit(&ctx->mods, ctx->env);
+		modstack_call_destartup(&ctx->mods, ctx->env);
+		modstack_free(&ctx->mods);
 		listen_desetup_locks();
 		edns_known_options_delete(ctx->env);
 		edns_strings_delete(ctx->env->edns_strings);
@@ -360,7 +364,9 @@ ub_ctx_delete(struct ub_ctx* ctx)
 	}
 	libworker_delete_event(ctx->event_worker);
 
-	modstack_desetup(&ctx->mods, ctx->env);
+	modstack_call_deinit(&ctx->mods, ctx->env);
+	modstack_call_destartup(&ctx->mods, ctx->env);
+	modstack_free(&ctx->mods);
 	a = ctx->alloc_list;
 	while(a) {
 		na = a->super;
@@ -981,7 +987,8 @@ ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr)
 	if(!addr) {
 		/* disable fwd mode - the root stub should be first. */
 		if(ctx->env->cfg->forwards &&
-			strcmp(ctx->env->cfg->forwards->name, ".") == 0) {
+			(ctx->env->cfg->forwards->name &&
+			strcmp(ctx->env->cfg->forwards->name, ".") == 0)) {
 			s = ctx->env->cfg->forwards;
 			ctx->env->cfg->forwards = s->next;
 			s->next = NULL;
@@ -1001,7 +1008,8 @@ ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr)
 	/* it parses, add root stub in front of list */
 	lock_basic_lock(&ctx->cfglock);
 	if(!ctx->env->cfg->forwards ||
-		strcmp(ctx->env->cfg->forwards->name, ".") != 0) {
+		(ctx->env->cfg->forwards->name &&
+		strcmp(ctx->env->cfg->forwards->name, ".") != 0)) {
 		s = calloc(1, sizeof(*s));
 		if(!s) {
 			lock_basic_unlock(&ctx->cfglock);
@@ -1019,6 +1027,7 @@ ub_ctx_set_fwd(struct ub_ctx* ctx, const char* addr)
 		ctx->env->cfg->forwards = s;
 	} else {
 		log_assert(ctx->env->cfg->forwards);
+		log_assert(ctx->env->cfg->forwards->name);
 		s = ctx->env->cfg->forwards;
 	}
 	dupl = strdup(addr);

makedist.sh

@@ -53,7 +53,7 @@ Generate a distribution tar file for unbound.
                         (which will then be unbound-<version>rc<number>)
     -u git_url          Retrieve the source from the specified repository url.
                         Detected from the working copy if not specified.
-    -b git_branch       Retrieve the the specified branch or tag.
+    -b git_branch       Retrieve the specified branch or tag.
                         Detected from the working copy if not specified.
     -wssl openssl.xx.tar.gz Also build openssl from tarball for windows dist.
     -wxp expat.xx.tar.gz Also build expat from tarball for windows dist.

pythonmod/pythonmod.c

@@ -777,8 +777,8 @@ size_t pythonmod_get_mem(struct module_env* env, int id)
  */
 static struct module_func_block pythonmod_block = {
    "python",
-   &pythonmod_init, &pythonmod_deinit, &pythonmod_operate, &pythonmod_inform_super,
-   &pythonmod_clear, &pythonmod_get_mem
+   NULL, NULL, &pythonmod_init, &pythonmod_deinit, &pythonmod_operate,
+   &pythonmod_inform_super, &pythonmod_clear, &pythonmod_get_mem
 };
 
 struct module_func_block* pythonmod_get_funcblock(void)

respip/respip.c

@@ -1259,8 +1259,8 @@ respip_get_mem(struct module_env* env, int id)
  */
 static struct module_func_block respip_block = {
 	"respip",
-	&respip_init, &respip_deinit, &respip_operate, &respip_inform_super,
-	&respip_clear, &respip_get_mem
+	NULL, NULL, &respip_init, &respip_deinit, &respip_operate,
+	&respip_inform_super, &respip_clear, &respip_get_mem
 };
 
 struct module_func_block*

services/authzone.c

@@ -7778,7 +7778,8 @@ static void auth_zone_log(uint8_t* name, enum verbosity_value level,
 static int zonemd_dnssec_verify_rrset(struct auth_zone* z,
 	struct module_env* env, struct module_stack* mods,
 	struct ub_packed_rrset_key* dnskey, struct auth_data* node,
-	struct auth_rrset* rrset, char** why_bogus, uint8_t* sigalg)
+	struct auth_rrset* rrset, char** why_bogus, uint8_t* sigalg,
+	char* reasonbuf, size_t reasonlen)
 {
 	struct ub_packed_rrset_key pk;
 	enum sec_status sec;
@@ -7808,7 +7809,7 @@ static int zonemd_dnssec_verify_rrset(struct auth_zone* z,
 			"zonemd: verify %s RRset with DNSKEY", typestr);
 	}
 	sec = dnskeyset_verify_rrset(env, ve, &pk, dnskey, sigalg, why_bogus, NULL,
-		LDNS_SECTION_ANSWER, NULL, &verified);
+		LDNS_SECTION_ANSWER, NULL, &verified, reasonbuf, reasonlen);
 	if(sec == sec_status_secure) {
 		return 1;
 	}
@@ -7851,7 +7852,8 @@ static int nsec3_of_param_has_type(struct auth_rrset* nsec3, int algo,
 static int zonemd_check_dnssec_absence(struct auth_zone* z,
 	struct module_env* env, struct module_stack* mods,
 	struct ub_packed_rrset_key* dnskey, struct auth_data* apex,
-	char** reason, char** why_bogus, uint8_t* sigalg)
+	char** reason, char** why_bogus, uint8_t* sigalg, char* reasonbuf,
+	size_t reasonlen)
 {
 	struct auth_rrset* nsec = NULL;
 	if(!apex) {
@@ -7863,7 +7865,7 @@ static int zonemd_check_dnssec_absence(struct auth_zone* z,
 		struct ub_packed_rrset_key pk;
 		/* dnssec verify the NSEC */
 		if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, apex,
-			nsec, why_bogus, sigalg)) {
+			nsec, why_bogus, sigalg, reasonbuf, reasonlen)) {
 			*reason = "DNSSEC verify failed for NSEC RRset";
 			return 0;
 		}
@@ -7906,7 +7908,7 @@ static int zonemd_check_dnssec_absence(struct auth_zone* z,
 		}
 		/* dnssec verify the NSEC3 */
 		if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, match,
-			nsec3, why_bogus, sigalg)) {
+			nsec3, why_bogus, sigalg, reasonbuf, reasonlen)) {
 			*reason = "DNSSEC verify failed for NSEC3 RRset";
 			return 0;
 		}
@@ -7928,7 +7930,7 @@ static int zonemd_check_dnssec_soazonemd(struct auth_zone* z,
 	struct module_env* env, struct module_stack* mods,
 	struct ub_packed_rrset_key* dnskey, struct auth_data* apex,
 	struct auth_rrset* zonemd_rrset, char** reason, char** why_bogus,
-	uint8_t* sigalg)
+	uint8_t* sigalg, char* reasonbuf, size_t reasonlen)
 {
 	struct auth_rrset* soa;
 	if(!apex) {
@@ -7941,12 +7943,12 @@ static int zonemd_check_dnssec_soazonemd(struct auth_zone* z,
 		return 0;
 	}
 	if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, apex, soa,
-		why_bogus, sigalg)) {
+		why_bogus, sigalg, reasonbuf, reasonlen)) {
 		*reason = "DNSSEC verify failed for SOA RRset";
 		return 0;
 	}
 	if(!zonemd_dnssec_verify_rrset(z, env, mods, dnskey, apex,
-		zonemd_rrset, why_bogus, sigalg)) {
+		zonemd_rrset, why_bogus, sigalg, reasonbuf, reasonlen)) {
 		*reason = "DNSSEC verify failed for ZONEMD RRset";
 		return 0;
 	}
@@ -8014,6 +8016,7 @@ auth_zone_verify_zonemd_with_key(struct auth_zone* z, struct module_env* env,
 	struct module_stack* mods, struct ub_packed_rrset_key* dnskey,
 	int is_insecure, char** result, uint8_t* sigalg)
 {
+	char reasonbuf[256];
 	char* reason = NULL, *why_bogus = NULL;
 	struct auth_data* apex = NULL;
 	struct auth_rrset* zonemd_rrset = NULL;
@@ -8042,7 +8045,8 @@ auth_zone_verify_zonemd_with_key(struct auth_zone* z, struct module_env* env,
 	} else if(!zonemd_rrset && dnskey && !is_insecure) {
 		/* fetch, DNSSEC verify, and check NSEC/NSEC3 */
 		if(!zonemd_check_dnssec_absence(z, env, mods, dnskey, apex,
-			&reason, &why_bogus, sigalg)) {
+			&reason, &why_bogus, sigalg, reasonbuf,
+			sizeof(reasonbuf))) {
 			auth_zone_zonemd_fail(z, env, reason, why_bogus, result);
 			return;
 		}
@@ -8050,7 +8054,8 @@ auth_zone_verify_zonemd_with_key(struct auth_zone* z, struct module_env* env,
 	} else if(zonemd_rrset && dnskey && !is_insecure) {
 		/* check DNSSEC verify of SOA and ZONEMD */
 		if(!zonemd_check_dnssec_soazonemd(z, env, mods, dnskey, apex,
-			zonemd_rrset, &reason, &why_bogus, sigalg)) {
+			zonemd_rrset, &reason, &why_bogus, sigalg, reasonbuf,
+			sizeof(reasonbuf))) {
 			auth_zone_zonemd_fail(z, env, reason, why_bogus, result);
 			return;
 		}
@@ -8114,7 +8119,8 @@ static struct ub_packed_rrset_key*
 zonemd_get_dnskey_from_anchor(struct auth_zone* z, struct module_env* env,
 	struct module_stack* mods, struct trust_anchor* anchor,
 	int* is_insecure, char** why_bogus,
-	struct ub_packed_rrset_key* keystorage)
+	struct ub_packed_rrset_key* keystorage, char* reasonbuf,
+	size_t reasonlen)
 {
 	struct auth_data* apex;
 	struct auth_rrset* dnskey_rrset;
@@ -8150,7 +8156,8 @@ zonemd_get_dnskey_from_anchor(struct auth_zone* z, struct module_env* env,
 	auth_zone_log(z->name, VERB_QUERY,
 		"zonemd: verify DNSKEY RRset with trust anchor");
 	sec = val_verify_DNSKEY_with_TA(env, ve, keystorage, anchor->ds_rrset,
-		anchor->dnskey_rrset, NULL, why_bogus, NULL, NULL);
+		anchor->dnskey_rrset, NULL, why_bogus, NULL, NULL, reasonbuf,
+		reasonlen);
 	regional_free_all(env->scratch);
 	if(sec == sec_status_secure) {
 		/* success */
@@ -8173,7 +8180,8 @@ static struct ub_packed_rrset_key*
 auth_zone_verify_zonemd_key_with_ds(struct auth_zone* z,
 	struct module_env* env, struct module_stack* mods,
 	struct ub_packed_rrset_key* ds, int* is_insecure, char** why_bogus,
-	struct ub_packed_rrset_key* keystorage, uint8_t* sigalg)
+	struct ub_packed_rrset_key* keystorage, uint8_t* sigalg,
+	char* reasonbuf, size_t reasonlen)
 {
 	struct auth_data* apex;
 	struct auth_rrset* dnskey_rrset;
@@ -8209,7 +8217,7 @@ auth_zone_verify_zonemd_key_with_ds(struct auth_zone* z,
 	keystorage->rk.rrset_class = htons(z->dclass);
 	auth_zone_log(z->name, VERB_QUERY, "zonemd: verify zone DNSKEY with DS");
 	sec = val_verify_DNSKEY_with_DS(env, ve, keystorage, ds, sigalg,
-		why_bogus, NULL, NULL);
+		why_bogus, NULL, NULL, reasonbuf, reasonlen);
 	regional_free_all(env->scratch);
 	if(sec == sec_status_secure) {
 		/* success */
@@ -8235,6 +8243,7 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
 {
 	struct auth_zone* z = (struct auth_zone*)arg;
 	struct module_env* env;
+	char reasonbuf[256];
 	char* reason = NULL, *ds_bogus = NULL, *typestr="DNSKEY";
 	struct ub_packed_rrset_key* dnskey = NULL, *ds = NULL;
 	int is_insecure = 0, downprot;
@@ -8346,7 +8355,8 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
 	if(!reason && !is_insecure && !dnskey && ds) {
 		dnskey = auth_zone_verify_zonemd_key_with_ds(z, env,
 			&env->mesh->mods, ds, &is_insecure, &ds_bogus,
-			&keystorage, downprot?sigalg:NULL);
+			&keystorage, downprot?sigalg:NULL, reasonbuf,
+			sizeof(reasonbuf));
 		if(!dnskey && !is_insecure && !reason)
 			reason = "DNSKEY verify with DS failed";
 	}
@@ -8354,6 +8364,7 @@ void auth_zonemd_dnskey_lookup_callback(void* arg, int rcode, sldns_buffer* buf,
 	if(reason) {
 		auth_zone_zonemd_fail(z, env, reason, ds_bogus, NULL);
 		lock_rw_unlock(&z->lock);
+		regional_free_all(env->scratch);
 		return;
 	}
 
@@ -8438,6 +8449,7 @@ zonemd_lookup_dnskey(struct auth_zone* z, struct module_env* env)
 void auth_zone_verify_zonemd(struct auth_zone* z, struct module_env* env,
 	struct module_stack* mods, char** result, int offline, int only_online)
 {
+	char reasonbuf[256];
 	char* reason = NULL, *why_bogus = NULL;
 	struct trust_anchor* anchor = NULL;
 	struct ub_packed_rrset_key* dnskey = NULL;
@@ -8472,7 +8484,8 @@ void auth_zone_verify_zonemd(struct auth_zone* z, struct module_env* env,
 		}
 		/* equal to trustanchor, no need for online lookups */
 		dnskey = zonemd_get_dnskey_from_anchor(z, env, mods, anchor,
-			&is_insecure, &why_bogus, &keystorage);
+			&is_insecure, &why_bogus, &keystorage, reasonbuf,
+			sizeof(reasonbuf));
 		lock_basic_unlock(&anchor->lock);
 		if(!dnskey && !reason && !is_insecure) {
 			reason = "verify DNSKEY RRset with trust anchor failed";
@@ -8498,6 +8511,7 @@ void auth_zone_verify_zonemd(struct auth_zone* z, struct module_env* env,
 
 	if(reason) {
 		auth_zone_zonemd_fail(z, env, reason, why_bogus, result);
+		regional_free_all(env->scratch);
 		return;
 	}
 

services/cache/dns.c

@@ -96,7 +96,8 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 				struct ub_packed_rrset_key* ck;
 				lock_rw_rdlock(&rep->ref[i].key->entry.lock);
 				/* if deleted rrset, do not copy it */
-				if(rep->ref[i].key->id == 0)
+				if(rep->ref[i].key->id == 0 ||
+					rep->ref[i].id != rep->ref[i].key->id)
 					ck = NULL;
 				else 	ck = packed_rrset_copy_region(
 					rep->ref[i].key, region, now);
@@ -112,11 +113,18 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 			/* fallthrough */
 		case 1: /* ref updated, item inserted */
 			rep->rrsets[i] = rep->ref[i].key;
+			/* ref was updated; make sure the message ttl is
+			 * updated to the minimum of the current rrsets. */
+			lock_rw_rdlock(&rep->ref[i].key->entry.lock);
+			/* if deleted, skip ttl update. */
+			if(rep->ref[i].key->id != 0 &&
+				rep->ref[i].id == rep->ref[i].key->id) {
+				ttl = ((struct packed_rrset_data*)
+				    rep->rrsets[i]->entry.data)->ttl;
+				if(ttl < min_ttl) min_ttl = ttl;
+			}
+			lock_rw_unlock(&rep->ref[i].key->entry.lock);
 		}
-		/* if ref was updated make sure the message ttl is updated to
-		 * the minimum of the current rrsets. */
-		ttl = ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)->ttl;
-		if(ttl < min_ttl) min_ttl = ttl;
 	}
 	if(min_ttl < rep->ttl) {
 		rep->ttl = min_ttl;

services/cache/infra.c

@@ -60,6 +60,16 @@
  * can do this number of packets (until those all timeout too) */
 #define TIMEOUT_COUNT_MAX 3
 
+/** Minus 1000 because that is outside of the RTTBAND, so
+ * blacklisted servers stay blacklisted if this is chosen.
+ * If USEFUL_SERVER_TOP_TIMEOUT is below 1000 (configured via RTT_MAX_TIMEOUT,
+ * infra-cache-max-rtt) change it to just above the RTT_BAND. */
+#define STILL_USEFUL_TIMEOUT (				\
+	USEFUL_SERVER_TOP_TIMEOUT < 1000 ||		\
+	USEFUL_SERVER_TOP_TIMEOUT - 1000 <= RTT_BAND	\
+		?RTT_BAND + 1				\
+		:USEFUL_SERVER_TOP_TIMEOUT - 1000)
+
 /** ratelimit value for delegation point */
 int infra_dp_ratelimit = 0;
 
@@ -347,6 +357,7 @@ infra_create(struct config_file* cfg)
 		return NULL;
 	}
 	infra_ip_ratelimit = cfg->ip_ratelimit;
+	infra_ip_ratelimit_cookie = cfg->ip_ratelimit_cookie;
 	infra->client_ip_rates = slabhash_create(cfg->ip_ratelimit_slabs,
 	    INFRA_HOST_STARTSIZE, cfg->ip_ratelimit_size, &ip_rate_sizefunc,
 	    &ip_rate_compfunc, &ip_rate_delkeyfunc, &ip_rate_deldatafunc, NULL);
@@ -398,6 +409,7 @@ infra_adjust(struct infra_cache* infra, struct config_file* cfg)
 	infra->infra_keep_probing = cfg->infra_keep_probing;
 	infra_dp_ratelimit = cfg->ratelimit;
 	infra_ip_ratelimit = cfg->ip_ratelimit;
+	infra_ip_ratelimit_cookie = cfg->ip_ratelimit_cookie;
 	maxmem = cfg->infra_cache_numhosts * (sizeof(struct infra_key)+
 		sizeof(struct infra_data)+INFRA_BYTES_NAME);
 	/* divide cachesize by slabs and multiply by slabs, because if the
@@ -656,7 +668,7 @@ infra_update_tcp_works(struct infra_cache* infra,
 	if(data->rtt.rto >= RTT_MAX_TIMEOUT)
 		/* do not disqualify this server altogether, it is better
 		 * than nothing */
-		data->rtt.rto = RTT_MAX_TIMEOUT-1000;
+		data->rtt.rto = STILL_USEFUL_TIMEOUT;
 	lock_rw_unlock(&e->lock);
 }
 
@@ -796,7 +808,7 @@ infra_get_lame_rtt(struct infra_cache* infra,
 		&& infra->infra_keep_probing) {
 		/* single probe, keep probing */
 		if(*rtt >= USEFUL_SERVER_TOP_TIMEOUT)
-			*rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
+			*rtt = STILL_USEFUL_TIMEOUT;
 	} else if(host->rtt.rto >= PROBE_MAXRTO && timenow < host->probedelay
 		&& rtt_notimeout(&host->rtt)*4 <= host->rtt.rto) {
 		/* single probe for this domain, and we are not probing */
@@ -804,26 +816,23 @@ infra_get_lame_rtt(struct infra_cache* infra,
 		if(qtype == LDNS_RR_TYPE_A) {
 			if(host->timeout_A >= TIMEOUT_COUNT_MAX)
 				*rtt = USEFUL_SERVER_TOP_TIMEOUT;
-			else	*rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
+			else	*rtt = STILL_USEFUL_TIMEOUT;
 		} else if(qtype == LDNS_RR_TYPE_AAAA) {
 			if(host->timeout_AAAA >= TIMEOUT_COUNT_MAX)
 				*rtt = USEFUL_SERVER_TOP_TIMEOUT;
-			else	*rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
+			else	*rtt = STILL_USEFUL_TIMEOUT;
 		} else {
 			if(host->timeout_other >= TIMEOUT_COUNT_MAX)
 				*rtt = USEFUL_SERVER_TOP_TIMEOUT;
-			else	*rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
+			else	*rtt = STILL_USEFUL_TIMEOUT;
 		}
 	}
 	/* expired entry */
 	if(timenow > host->ttl) {
-
 		/* see if this can be a re-probe of an unresponsive server */
-		/* minus 1000 because that is outside of the RTTBAND, so
-		 * blacklisted servers stay blacklisted if this is chosen */
 		if(host->rtt.rto >= USEFUL_SERVER_TOP_TIMEOUT) {
 			lock_rw_unlock(&e->lock);
-			*rtt = USEFUL_SERVER_TOP_TIMEOUT-1000;
+			*rtt = STILL_USEFUL_TIMEOUT;
 			*lame = 0;
 			*dnsseclame = 0;
 			*reclame = 0;

services/cache/infra.h

@@ -234,7 +234,7 @@ struct infra_cache* infra_adjust(struct infra_cache* infra,
 	struct config_file* cfg);
 
 /**
- * Plain find infra data function (used by the the other functions)
+ * Plain find infra data function (used by the other functions)
  * @param infra: infrastructure cache.
  * @param addr: host address.
  * @param addrlen: length of addr.

services/localzone.c

@@ -242,7 +242,7 @@ lz_enter_zone_dname(struct local_zones* zones, uint8_t* nm, size_t len,
 }
 
 /** enter a new zone */
-static struct local_zone*
+struct local_zone*
 lz_enter_zone(struct local_zones* zones, const char* name, const char* type,
 	uint16_t dclass)
 {
@@ -983,40 +983,43 @@ lz_enter_overrides(struct local_zones* zones, struct config_file* cfg)
 	return 1;
 }
 
-/** setup parent pointers, so that a lookup can be done for closest match */
-static void
-init_parents(struct local_zones* zones)
+/* return closest parent in the tree, NULL if none */
+static struct local_zone* find_closest_parent(struct local_zone* curr,
+	struct local_zone* prev)
 {
-        struct local_zone* node, *prev = NULL, *p;
-        int m;
-	lock_rw_wrlock(&zones->lock);
-        RBTREE_FOR(node, struct local_zone*, &zones->ztree) {
-		lock_rw_wrlock(&node->lock);
-                node->parent = NULL;
-                if(!prev || prev->dclass != node->dclass) {
-                        prev = node;
-			lock_rw_unlock(&node->lock);
-                        continue;
-                }
-                (void)dname_lab_cmp(prev->name, prev->namelabs, node->name,
-                        node->namelabs, &m); /* we know prev is smaller */
-                /* sort order like: . com. bla.com. zwb.com. net. */
-                /* find the previous, or parent-parent-parent */
-                for(p = prev; p; p = p->parent)
-                        /* looking for name with few labels, a parent */
-                        if(p->namelabs <= m) {
-                                /* ==: since prev matched m, this is closest*/
-                                /* <: prev matches more, but is not a parent,
-                                 * this one is a (grand)parent */
-                                node->parent = p;
-                                break;
-                        }
-                prev = node;
+	struct local_zone* p;
+	int m;
+	if(!prev || prev->dclass != curr->dclass) return NULL;
+	(void)dname_lab_cmp(prev->name, prev->namelabs, curr->name,
+		curr->namelabs, &m); /* we know prev is smaller */
+	/* sort order like: . com. bla.com. zwb.com. net. */
+	/* find the previous, or parent-parent-parent */
+	for(p = prev; p; p = p->parent) {
+		/* looking for name with few labels, a parent */
+		if(p->namelabs <= m) {
+			/* ==: since prev matched m, this is closest*/
+			/* <: prev matches more, but is not a parent,
+			    * this one is a (grand)parent */
+			return p;
+		}
+	}
+	return NULL;
+}
 
+/** setup parent pointers, so that a lookup can be done for closest match */
+void
+lz_init_parents(struct local_zones* zones)
+{
+	struct local_zone* node, *prev = NULL;
+	lock_rw_wrlock(&zones->lock);
+	RBTREE_FOR(node, struct local_zone*, &zones->ztree) {
+		lock_rw_wrlock(&node->lock);
+		node->parent = find_closest_parent(node, prev);
+		prev = node;
 		if(node->override_tree)
 			addr_tree_init_parents(node->override_tree);
 		lock_rw_unlock(&node->lock);
-        }
+	}
 	lock_rw_unlock(&zones->lock);
 }
 
@@ -1036,7 +1039,7 @@ lz_setup_implicit(struct local_zones* zones, struct config_file* cfg)
 	int nmlabs = 0;
 	int match = 0; /* number of labels match count */
 
-	init_parents(zones); /* to enable local_zones_lookup() */
+	lz_init_parents(zones); /* to enable local_zones_lookup() */
 	for(p = cfg->local_data; p; p = p->next) {
 		uint8_t* rr_name;
 		uint16_t rr_class, rr_type;
@@ -1202,7 +1205,7 @@ local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg)
 	}
 
 	/* setup parent ptrs for lookup during data entry */
-	init_parents(zones);
+	lz_init_parents(zones);
 	/* insert local zone tags */
 	if(!lz_enter_zone_tags(zones, cfg)) {
 		return 0;
@@ -2028,7 +2031,9 @@ struct local_zone* local_zones_add_zone(struct local_zones* zones,
 	uint8_t* name, size_t len, int labs, uint16_t dclass,
 	enum localzone_type tp)
 {
+	int exact;
 	/* create */
+	struct local_zone *prev;
 	struct local_zone* z = local_zone_create(name, len, labs, tp, dclass);
 	if(!z) {
 		free(name);
@@ -2037,10 +2042,12 @@ struct local_zone* local_zones_add_zone(struct local_zones* zones,
 	lock_rw_wrlock(&z->lock);
 
 	/* find the closest parent */
-	z->parent = local_zones_find(zones, name, len, labs, dclass);
+	prev = local_zones_find_le(zones, name, len, labs, dclass, &exact);
+	if(!exact)
+		z->parent = find_closest_parent(z, prev);
 
 	/* insert into the tree */
-	if(!rbtree_insert(&zones->ztree, &z->node)) {
+	if(exact||!rbtree_insert(&zones->ztree, &z->node)) {
 		/* duplicate entry! */
 		lock_rw_unlock(&z->lock);
 		local_zone_delete(z);

services/localzone.h

@@ -641,4 +641,23 @@ local_zone_enter_rr(struct local_zone* z, uint8_t* nm, size_t nmlen,
  */
 struct local_data* 
 local_zone_find_data(struct local_zone* z, uint8_t* nm, size_t nmlen, int nmlabs);
+
+/** Enter a new zone; returns with WRlock
+ *  Made public for unit testing
+ *  @param zones: the local zones tree
+ *  @param name: name of the zone
+ *  @param type: type of the zone
+ *  @param dclass: class of the zone
+ *  @return local_zone (or duplicate), NULL on parse and malloc failures
+ */
+struct local_zone*
+lz_enter_zone(struct local_zones* zones, const char* name, const char* type,
+	uint16_t dclass);
+
+/** Setup parent pointers, so that a lookup can be done for closest match
+ *  Made public for unit testing
+ *  @param zones: the local zones tree
+ */
+void
+lz_init_parents(struct local_zones* zones);
 #endif /* SERVICES_LOCALZONE_H */

services/mesh.c

@@ -413,6 +413,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	int timeout = mesh->env->cfg->serve_expired?
 		mesh->env->cfg->serve_expired_client_timeout:0;
 	struct sldns_buffer* r_buffer = rep->c->buffer;
+	uint16_t mesh_flags = qflags&(BIT_RD|BIT_CD);
 	if(rep->c->tcp_req_info) {
 		r_buffer = rep->c->tcp_req_info->spool_buffer;
 	}
@@ -425,7 +426,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		return;
 	}
 	if(!unique)
-		s = mesh_area_find(mesh, cinfo, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
+		s = mesh_area_find(mesh, cinfo, qinfo, mesh_flags, 0, 0);
 	/* does this create a new reply state? */
 	if(!s || s->list_select == mesh_no_list) {
 		if(!mesh_make_new_space(mesh, rep->c->buffer)) {
@@ -453,7 +454,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 		struct rbnode_type* n;
 #endif
 		s = mesh_state_create(mesh->env, qinfo, cinfo,
-			qflags&(BIT_RD|BIT_CD), 0, 0);
+			mesh_flags, 0, 0);
 		if(!s) {
 			log_err("mesh_state_create: out of memory; SERVFAIL");
 			if(!inplace_cb_reply_servfail_call(mesh->env, qinfo, NULL, NULL,
@@ -565,6 +566,8 @@ servfail_mem:
 			edns->opt_list_inplace_cb_out = NULL;
 	error_encode(r_buffer, LDNS_RCODE_SERVFAIL,
 		qinfo, qid, qflags, edns);
+	if(rep->c->use_h2)
+		http2_stream_remove_mesh_state(rep->c->h2_stream);
 	comm_point_send_reply(rep);
 	if(added)
 		mesh_state_delete(&s->s);
@@ -583,8 +586,9 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	int was_detached = 0;
 	int was_noreply = 0;
 	int added = 0;
+	uint16_t mesh_flags = qflags&(BIT_RD|BIT_CD);
 	if(!unique)
-		s = mesh_area_find(mesh, NULL, qinfo, qflags&(BIT_RD|BIT_CD), 0, 0);
+		s = mesh_area_find(mesh, NULL, qinfo, mesh_flags, 0, 0);
 
 	/* there are no limits on the number of callbacks */
 
@@ -594,7 +598,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 		struct rbnode_type* n;
 #endif
 		s = mesh_state_create(mesh->env, qinfo, NULL,
-			qflags&(BIT_RD|BIT_CD), 0, 0);
+			mesh_flags, 0, 0);
 		if(!s) {
 			return 0;
 		}
@@ -673,8 +677,12 @@ static void mesh_schedule_prefetch(struct mesh_area* mesh,
 	struct query_info* qinfo, uint16_t qflags, time_t leeway, int run,
 	int rpz_passthru)
 {
+	/* Explicitly set the BIT_RD regardless of the client's flags. This is
+	 * for a prefetch query (no client attached) but it needs to be treated
+	 * as a recursion query. */
+	uint16_t mesh_flags = BIT_RD|(qflags&BIT_CD);
 	struct mesh_state* s = mesh_area_find(mesh, NULL, qinfo,
-		qflags&(BIT_RD|BIT_CD), 0, 0);
+		mesh_flags, 0, 0);
 #ifdef UNBOUND_DEBUG
 	struct rbnode_type* n;
 #endif
@@ -694,8 +702,7 @@ static void mesh_schedule_prefetch(struct mesh_area* mesh,
 		return;
 	}
 
-	s = mesh_state_create(mesh->env, qinfo, NULL,
-		qflags&(BIT_RD|BIT_CD), 0, 0);
+	s = mesh_state_create(mesh->env, qinfo, NULL, mesh_flags, 0, 0);
 	if(!s) {
 		log_err("prefetch mesh_state_create: out of memory");
 		return;
@@ -756,14 +763,17 @@ static void mesh_schedule_prefetch_subnet(struct mesh_area* mesh,
 #ifdef UNBOUND_DEBUG
 	struct rbnode_type* n;
 #endif
+	/* Explicitly set the BIT_RD regardless of the client's flags. This is
+	 * for a prefetch query (no client attached) but it needs to be treated
+	 * as a recursion query. */
+	uint16_t mesh_flags = BIT_RD|(qflags&BIT_CD);
 	if(!mesh_make_new_space(mesh, NULL)) {
 		verbose(VERB_ALGO, "Too many queries. dropped prefetch.");
 		mesh->stats_dropped ++;
 		return;
 	}
 
-	s = mesh_state_create(mesh->env, qinfo, NULL,
-		qflags&(BIT_RD|BIT_CD), 0, 0);
+	s = mesh_state_create(mesh->env, qinfo, NULL, mesh_flags, 0, 0);
 	if(!s) {
 		log_err("prefetch_subnet mesh_state_create: out of memory");
 		return;
@@ -966,6 +976,8 @@ mesh_state_cleanup(struct mesh_state* mstate)
 		for(; rep; rep=rep->next) {
 			infra_wait_limit_dec(mesh->env->infra_cache,
 				&rep->query_reply, mesh->env->cfg);
+			if(rep->query_reply.c->use_h2)
+				http2_stream_remove_mesh_state(rep->h2_stream);
 			comm_point_drop_reply(&rep->query_reply);
 			log_assert(mesh->num_reply_addrs > 0);
 			mesh->num_reply_addrs--;
@@ -1522,6 +1534,8 @@ void mesh_query_done(struct mesh_state* mstate)
 			infra_wait_limit_dec(mstate->s.env->infra_cache,
 				&r->query_reply, mstate->s.env->cfg);
 			mstate->reply_list = NULL;
+			if(r->query_reply.c->use_h2)
+				http2_stream_remove_mesh_state(r->h2_stream);
 			comm_point_drop_reply(&r->query_reply);
 			mstate->reply_list = reply_list;
 			mstate->s.env->mesh->stats_dropped++;
@@ -1554,6 +1568,9 @@ void mesh_query_done(struct mesh_state* mstate)
 			infra_wait_limit_dec(mstate->s.env->infra_cache,
 				&r->query_reply, mstate->s.env->cfg);
 			mstate->reply_list = NULL;
+			if(r->query_reply.c->use_h2) {
+				http2_stream_remove_mesh_state(r->h2_stream);
+			}
 			comm_point_drop_reply(&r->query_reply);
 			mstate->reply_list = reply_list;
 		} else {
@@ -1568,6 +1585,8 @@ void mesh_query_done(struct mesh_state* mstate)
 				tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
 				r_buffer = NULL;
 			}
+			/* mesh_send_reply removed mesh state from
+			 * http2_stream. */
 			prev = r;
 			prev_buffer = r_buffer;
 		}
@@ -1720,6 +1739,7 @@ int mesh_state_add_reply(struct mesh_state* s, struct edns_data* edns,
 		return 0;
 	if(rep->c->use_h2)
 		r->h2_stream = rep->c->h2_stream;
+	else	r->h2_stream = NULL;
 
 	/* Data related to local alias stored in 'qinfo' (if any) is ephemeral
 	 * and can be different for different original queries (even if the
@@ -2243,6 +2263,8 @@ mesh_serve_expired_callback(void* arg)
 			infra_wait_limit_dec(mstate->s.env->infra_cache,
 				&r->query_reply, mstate->s.env->cfg);
 			mstate->reply_list = NULL;
+			if(r->query_reply.c->use_h2)
+				http2_stream_remove_mesh_state(r->h2_stream);
 			comm_point_drop_reply(&r->query_reply);
 			mstate->reply_list = reply_list;
 			mstate->s.env->mesh->stats_dropped++;
@@ -2276,6 +2298,7 @@ mesh_serve_expired_callback(void* arg)
 			r, r_buffer, prev, prev_buffer);
 		if(r->query_reply.c->tcp_req_info)
 			tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
+		/* mesh_send_reply removed mesh state from http2_stream. */
 		infra_wait_limit_dec(mstate->s.env->infra_cache,
 			&r->query_reply, mstate->s.env->cfg);
 		prev = r;

services/modstack.c

@@ -95,6 +95,16 @@ modstack_init(struct module_stack* stack)
 	stack->mod = NULL;
 }
 
+void
+modstack_free(struct module_stack* stack)
+{
+	if(!stack)
+		return;
+        stack->num = 0;
+        free(stack->mod);
+        stack->mod = NULL;
+}
+
 int
 modstack_config(struct module_stack* stack, const char* module_conf)
 {
@@ -222,18 +232,59 @@ module_func_block* module_factory(const char** str)
         return NULL;
 }
 
-int 
-modstack_setup(struct module_stack* stack, const char* module_conf,
+int
+modstack_call_startup(struct module_stack* stack, const char* module_conf,
 	struct module_env* env)
 {
         int i;
         if(stack->num != 0)
-                modstack_desetup(stack, env);
+		fatal_exit("unexpected already initialised modules");
         /* fixed setup of the modules */
         if(!modstack_config(stack, module_conf)) {
 		return 0;
         }
+        for(i=0; i<stack->num; i++) {
+		if(stack->mod[i]->startup == NULL)
+			continue;
+                verbose(VERB_OPS, "startup module %d: %s",
+                        i, stack->mod[i]->name);
+                fptr_ok(fptr_whitelist_mod_startup(stack->mod[i]->startup));
+                if(!(*stack->mod[i]->startup)(env, i)) {
+                        log_err("module startup for module %s failed",
+                                stack->mod[i]->name);
+			return 0;
+                }
+        }
+	return 1;
+}
+
+int
+modstack_call_init(struct module_stack* stack, const char* module_conf,
+	struct module_env* env)
+{
+        int i, changed = 0;
         env->need_to_validate = 0; /* set by module init below */
+        for(i=0; i<stack->num; i++) {
+		while(*module_conf && isspace(*module_conf))
+			module_conf++;
+                if(strncmp(stack->mod[i]->name, module_conf,
+			strlen(stack->mod[i]->name))) {
+			if(stack->mod[i]->startup || stack->mod[i]->destartup) {
+				log_err("changed module ordering during reload not supported, for module that needs startup");
+				return 0;
+			} else {
+				changed = 1;
+			}
+		}
+		module_conf += strlen(stack->mod[i]->name);
+	}
+	if(changed) {
+		modstack_free(stack);
+		if(!modstack_config(stack, module_conf)) {
+			return 0;
+		}
+	}
+
         for(i=0; i<stack->num; i++) {
                 verbose(VERB_OPS, "init module %d: %s",
                         i, stack->mod[i]->name);
@@ -247,20 +298,29 @@ modstack_setup(struct module_stack* stack, const char* module_conf,
 	return 1;
 }
 
-void 
-modstack_desetup(struct module_stack* stack, struct module_env* env)
+void
+modstack_call_deinit(struct module_stack* stack, struct module_env* env)
 {
         int i;
         for(i=0; i<stack->num; i++) {
                 fptr_ok(fptr_whitelist_mod_deinit(stack->mod[i]->deinit));
                 (*stack->mod[i]->deinit)(env, i);
         }
-        stack->num = 0;
-        free(stack->mod);
-        stack->mod = NULL;
 }
 
-int 
+void
+modstack_call_destartup(struct module_stack* stack, struct module_env* env)
+{
+        int i;
+        for(i=0; i<stack->num; i++) {
+		if(stack->mod[i]->destartup == NULL)
+			continue;
+                fptr_ok(fptr_whitelist_mod_destartup(stack->mod[i]->destartup));
+                (*stack->mod[i]->destartup)(env, i);
+        }
+}
+
+int
 modstack_find(struct module_stack* stack, const char* name)
 {
 	int i;

services/modstack.h

@@ -60,6 +60,23 @@ struct module_stack {
  */
 void modstack_init(struct module_stack* stack);
 
+/**
+ * Free the stack of modules
+ * @param stack: stack that frees up memory.
+ */
+void modstack_free(struct module_stack* stack);
+
+/**
+ * Initialises modules and assignes ids. Calls module_startup().
+ * @param stack: Expected empty, filled according to module_conf
+ * @param module_conf: string what modules to initialize
+ * @param env: module environment which is inited by the modules.
+ *	environment should have a superalloc, cfg,
+ * @return on false a module init failed.
+ */
+int modstack_call_startup(struct module_stack* stack, const char* module_conf,
+	struct module_env* env);
+
 /**
  * Read config file module settings and set up the modfunc block
  * @param stack: the stack of modules (empty before call). 
@@ -83,24 +100,31 @@ struct module_func_block* module_factory(const char** str);
 const char** module_list_avail(void);
 
 /**
- * Setup modules. Assigns ids and calls module_init.
- * @param stack: if not empty beforehand, it will be desetup()ed.
- *	It is then modstack_configged().
- * @param module_conf: string what modules to insert.
+ * Init modules. Calls module_init().
+ * @param stack: It is modstack_setupped().
+ * @param module_conf: module ordering to check against the ordering in stack.
+ *	fails on changed ordering.
  * @param env: module environment which is inited by the modules.
  *	environment should have a superalloc, cfg,
  *	env.need_to_validate is set by the modules.
  * @return on false a module init failed.
  */
-int modstack_setup(struct module_stack* stack, const char* module_conf,
+int modstack_call_init(struct module_stack* stack, const char* module_conf,
 	struct module_env* env);
 
 /**
- * Desetup the modules, deinit, delete.
+ * Deinit the modules.
  * @param stack: made empty.
  * @param env: module env for module deinit() calls.
  */
-void modstack_desetup(struct module_stack* stack, struct module_env* env);
+void modstack_call_deinit(struct module_stack* stack, struct module_env* env);
+
+/**
+ * Destartup the modules, close, delete.
+ * @param stack: made empty.
+ * @param env: module env for module destartup() calls.
+ */
+void modstack_call_destartup(struct module_stack* stack, struct module_env* env);
 
 /**
  * Find index of module by name.

services/outside_network.c

@@ -2051,7 +2051,8 @@ select_id(struct outside_network* outnet, struct pending* pend,
 }
 
 /** return true is UDP connect error needs to be logged */
-static int udp_connect_needs_log(int err)
+static int udp_connect_needs_log(int err, struct sockaddr_storage* addr,
+	socklen_t addrlen)
 {
 	switch(err) {
 	case ECONNREFUSED:
@@ -2075,6 +2076,15 @@ static int udp_connect_needs_log(int err)
 		if(verbosity >= VERB_ALGO)
 			return 1;
 		return 0;
+	case EINVAL:
+		/* Stop 'Invalid argument for fe80::/10' addresses appearing
+		 * in the logs, at low verbosity. They cannot be sent to. */
+		if(addr_is_ip6linklocal(addr, addrlen)) {
+			if(verbosity >= VERB_ALGO)
+				return 1;
+			return 0;
+		}
+		break;
 	default:
 		break;
 	}
@@ -2141,7 +2151,8 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 				/* connect() to the destination */
 				if(connect(fd, (struct sockaddr*)&pend->addr,
 					pend->addrlen) < 0) {
-					if(udp_connect_needs_log(errno)) {
+					if(udp_connect_needs_log(errno,
+						&pend->addr, pend->addrlen)) {
 						log_err_addr("udp connect failed",
 							strerror(errno), &pend->addr,
 							pend->addrlen);

services/rpz.c

@@ -2435,11 +2435,10 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
 	if(ms->env == NULL || ms->env->auth_zones == NULL) { return 0; }
 
 	az = ms->env->auth_zones;
+	lock_rw_rdlock(&az->rpz_lock);
 
 	verbose(VERB_ALGO, "rpz: iterator module callback: have_rpz=%d", az->rpz_first != NULL);
 
-	lock_rw_rdlock(&az->rpz_lock);
-
 	/* precedence of RPZ works, loosely, like this:
 	 * CNAMEs in order of the CNAME chain. rpzs in the order they are
 	 * configured. In an RPZ: first client-IP addr, then QNAME, then
@@ -2454,6 +2453,13 @@ rpz_callback_from_iterator_module(struct module_qstate* ms, struct iter_qstate*
 			lock_rw_unlock(&a->lock);
 			continue;
 		}
+		if(r->taglist && (!ms->client_info ||
+			!taglist_intersect(r->taglist, r->taglistlen,
+				ms->client_info->taglist,
+				ms->client_info->taglen))) {
+			lock_rw_unlock(&a->lock);
+			continue;
+		}
 
 		/* the nsdname has precedence over the nsip triggers */
 		z = rpz_delegation_point_zone_lookup(is->dp, r->nsdname_zones,
@@ -2512,6 +2518,13 @@ struct dns_msg* rpz_callback_from_iterator_cname(struct module_qstate* ms,
 			lock_rw_unlock(&a->lock);
 			continue;
 		}
+		if(r->taglist && (!ms->client_info ||
+			!taglist_intersect(r->taglist, r->taglistlen,
+				ms->client_info->taglist,
+				ms->client_info->taglen))) {
+			lock_rw_unlock(&a->lock);
+			continue;
+		}
 		z = rpz_find_zone(r->local_zones, is->qchase.qname,
 			is->qchase.qname_len, is->qchase.qclass, 0, 0, 0);
 		if(z && r->action_override == RPZ_DISABLED_ACTION) {

sldns/parse.h

@@ -106,7 +106,7 @@ ssize_t sldns_bget_token(struct sldns_buffer *b, char *token, const char *delim,
  * \param[in] k_del keyword delimiter 
  * \param[out] data the data found 
  * \param[in] d_del the data delimiter
- * \param[in] data_limit maximum size the the data buffer
+ * \param[in] data_limit maximum size the data buffer
  * \return the number of character read
  */
 ssize_t sldns_fget_keyword_data(FILE *f, const char *keyword, const char *k_del, char *data, const char *d_del, size_t data_limit);
@@ -119,7 +119,7 @@ ssize_t sldns_fget_keyword_data(FILE *f, const char *keyword, const char *k_del,
  * \param[in] k_del keyword delimiter 
  * \param[out] data the data found 
  * \param[in] d_del the data delimiter
- * \param[in] data_limit maximum size the the data buffer
+ * \param[in] data_limit maximum size the data buffer
  * \param[in] line_nr pointer to an integer containing the current line number (for
 debugging purposes)
  * \return the number of character read
@@ -134,7 +134,7 @@ ssize_t sldns_fget_keyword_data_l(FILE *f, const char *keyword, const char *k_de
  * \param[in] k_del keyword delimiter 
  * \param[out] data the data found 
  * \param[in] d_del the data delimiter
- * \param[in] data_limit maximum size the the data buffer
+ * \param[in] data_limit maximum size the data buffer
  * \return the number of character read
  */
 ssize_t sldns_bget_keyword_data(struct sldns_buffer *b, const char *keyword, const char *k_del, char *data, const char *d_del, size_t data_limit);

sldns/rrdef.h

@@ -470,6 +470,12 @@ enum sldns_enum_ede_code
 	LDNS_EDE_NO_REACHABLE_AUTHORITY = 22,
 	LDNS_EDE_NETWORK_ERROR = 23,
 	LDNS_EDE_INVALID_DATA = 24,
+	LDNS_EDE_SIGNATURE_EXPIRED_BEFORE_VALID = 25,
+	LDNS_EDE_TOO_EARLY = 26,
+	LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS = 27,
+	LDNS_EDE_BADPROXYPOLICY = 28,
+	LDNS_EDE_SYNTHESIZED = 29,
+	LDNS_EDE_INVALID_QUERY_TYPE = 30
 };
 typedef enum sldns_enum_ede_code sldns_ede_code;
 

sldns/wire2str.c

@@ -228,6 +228,11 @@ static sldns_lookup_table sldns_edns_ede_codes_data[] = {
 	{ LDNS_EDE_NO_REACHABLE_AUTHORITY, "No Reachable Authority" },
 	{ LDNS_EDE_NETWORK_ERROR, "Network Error" },
 	{ LDNS_EDE_INVALID_DATA, "Invalid Data" },
+	{ LDNS_EDE_SIGNATURE_EXPIRED_BEFORE_VALID, "Signature Expired Before Valid" },
+	{ LDNS_EDE_TOO_EARLY, "Non-Replayable Transactions Received in 0-RTT Data" },
+	{ LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS, "Unsupported NSEC3 Iterations Value" },
+	{ LDNS_EDE_BADPROXYPOLICY, "Unable to Conform to Policy" },
+	{ LDNS_EDE_SYNTHESIZED, "Synthesized Answer" },
 	{ 0, NULL}
 };
 sldns_lookup_table* sldns_edns_ede_codes = sldns_edns_ede_codes_data;

smallapp/unbound-anchor.c

@@ -151,7 +151,7 @@
 #define HTTPS_PORT 443
 
 #ifdef USE_WINSOCK
-/* sneakily reuse the the wsa_strerror function, on windows */
+/* sneakily reuse the wsa_strerror function, on windows */
 char* wsa_strerror(int err);
 #endif
 
@@ -805,7 +805,11 @@ TLS_initiate(SSL_CTX* sslctx, int fd, const char* urlname, int use_sni)
 		}
 		/* wants to be called again */
 	}
+#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
+	x = SSL_get1_peer_certificate(ssl);
+#else
 	x = SSL_get_peer_certificate(ssl);
+#endif
 	if(!x) {
 		if(verb) printf("Server presented no peer certificate\n");
 		SSL_free(ssl);

smallapp/unbound-checkconf.c

@@ -140,10 +140,13 @@ check_mod(struct config_file* cfg, struct module_func_block* fb)
 		fatal_exit("out of memory");
 	if(!edns_known_options_init(&env))
 		fatal_exit("out of memory");
-	if(!(*fb->init)(&env, 0)) {
-		fatal_exit("bad config for %s module", fb->name);
-	}
+	if(fb->startup && !(*fb->startup)(&env, 0))
+		fatal_exit("bad config during startup for %s module", fb->name);
+	if(!(*fb->init)(&env, 0))
+		fatal_exit("bad config during init for %s module", fb->name);
 	(*fb->deinit)(&env, 0);
+	if(fb->destartup)
+		(*fb->destartup)(&env, 0);
 	sldns_buffer_free(env.scratch_buffer);
 	regional_destroy(env.scratch);
 	edns_known_options_delete(&env);

smallapp/unbound-control-setup.sh.in

@@ -104,6 +104,10 @@ while getopts 'd:hr' arg; do
 done
 shift $((OPTIND - 1))
 
+if ! openssl >/dev/null 2>&1; then
+    echo "$0 requires openssl to be installed for keys/certificates generation." >&2
+    exit 1
+fi
 
 echo "setup in directory $DESTDIR"
 cd "$DESTDIR"

smallapp/unbound-control.c

@@ -122,20 +122,27 @@ usage(void)
 	printf("  local_data <RR data...>	add local data, for example\n");
 	printf("				local_data www.example.com A 192.0.2.1\n");
 	printf("  local_data_remove <name>	remove local RR data from name\n");
-	printf("  local_zones, local_zones_remove, local_datas, local_datas_remove\n");
-	printf("  				same, but read list from stdin\n");
+	printf("  local_zones,\n");
+	printf("  local_zones_remove,\n");
+	printf("  local_datas,\n");
+	printf("  local_datas_remove		same, but read list from stdin\n");
 	printf("  				(one entry per line).\n");
 	printf("  dump_cache			print cache to stdout\n");
+	printf("				(not supported in remote unbounds in\n");
+	printf("				multi-process operation)\n");
 	printf("  load_cache			load cache from stdin\n");
+	printf("				(not supported in remote unbounds in\n");
+	printf("				multi-process operation)\n");
 	printf("  lookup <name>			print nameservers for name\n");
-	printf("  flush <name>			flushes common types for name from cache\n");
+	printf("  flush [+c] <name>			flushes common types for name from cache\n");
 	printf("  				types:  A, AAAA, MX, PTR, NS,\n");
 	printf("					SOA, CNAME, DNAME, SRV, NAPTR\n");
-	printf("  flush_type <name> <type>	flush name, type from cache\n");
-	printf("  flush_zone <name>		flush everything at or under name\n");
+	printf("  flush_type [+c] <name> <type>	flush name, type from cache\n");
+	printf("		+c		remove from cachedb too\n");
+	printf("  flush_zone [+c] <name>	flush everything at or under name\n");
 	printf("  				from rr and dnssec caches\n");
-	printf("  flush_bogus			flush all bogus data\n");
-	printf("  flush_negative		flush all negative data\n");
+	printf("  flush_bogus [+c]		flush all bogus data\n");
+	printf("  flush_negative [+c]		flush all negative data\n");
 	printf("  flush_stats 			flush statistics, make zero\n");
 	printf("  flush_requestlist 		drop queries that are worked on\n");
 	printf("  dump_requestlist		show what is worked on by first thread\n");
@@ -752,7 +759,11 @@ setup_ssl(SSL_CTX* ctx, int fd)
 	/* check authenticity of server */
 	if(SSL_get_verify_result(ssl) != X509_V_OK)
 		ssl_err("SSL verification failed");
+#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
+	x = SSL_get1_peer_certificate(ssl);
+#else
 	x = SSL_get_peer_certificate(ssl);
+#endif
 	if(!x)
 		ssl_err("Server presented no peer certificate");
 	X509_free(x);

systemd.m4

@@ -2,17 +2,19 @@
 #   Copyright 2015, Sami Kerola, CloudFlare.
 #   BSD licensed.
 AC_ARG_ENABLE([systemd],
-	[AS_HELP_STRING([--enable-systemd], [compile with systemd support])],
+	[AS_HELP_STRING([--enable-systemd], [compile with systemd support (requires libsystemd, pkg-config)])],
 	[], [enable_systemd=no])
 have_systemd=no
 AS_IF([test "x$enable_systemd" != xno], [
-    ifdef([PKG_CHECK_MODULES], [
+    if test -n "$PKG_CONFIG"; then
 	dnl systemd v209 or newer
-	PKG_CHECK_MODULES([SYSTEMD], [libsystemd], [have_systemd=yes], [have_systemd=no])
+	have_systemd=no
+	PKG_CHECK_MODULES([SYSTEMD], [libsystemd], [have_systemd=yes], [])
 	dnl old systemd library
 	AS_IF([test "x$have_systemd" != "xyes"], [
+		have_systemd_daemon=no
 		PKG_CHECK_MODULES([SYSTEMD_DAEMON], [libsystemd-daemon],
-			[have_systemd_daemon=yes], [have_systemd_daemon=no])
+			[have_systemd_daemon=yes], [])
 		AS_IF([test "x$have_systemd_daemon" = "xyes"],
 			[have_systemd=yes])
 	])
@@ -24,8 +26,8 @@ AS_IF([test "x$enable_systemd" != xno], [
 		LIBS="$LIBS $SYSTEMD_LIBS"
 		]
 	)
-    ], [
+    else
     	AC_MSG_ERROR([systemd enabled but need pkg-config to configure for it])
-    ])
+    fi
 ])
 AM_CONDITIONAL([USE_SYSTEMD], [test "x$have_systemd" = xyes])

testcode/fake_event.c

@@ -1655,6 +1655,12 @@ void comm_timer_set(struct comm_timer* timer, struct timeval* tv)
 	timeval_add(&t->tv, &t->runtime->now_tv);
 }
 
+int comm_timer_is_set(struct comm_timer* timer)
+{
+	struct fake_timer* t = (struct fake_timer*)timer;
+	return t->enabled;
+}
+
 void comm_timer_delete(struct comm_timer* timer)
 {
 	struct fake_timer* t = (struct fake_timer*)timer;
@@ -1978,4 +1984,8 @@ void http2_stream_add_meshstate(struct http2_stream* ATTR_UNUSED(h2_stream),
 {
 }
 
+void http2_stream_remove_mesh_state(struct http2_stream* ATTR_UNUSED(h2_stream))
+{
+}
+
 /*********** End of Dummy routines ***********/

testcode/mini_tdir.sh

@@ -127,6 +127,7 @@ dir=$name.$$
 result=result.$name
 done=.done-$name
 skip=.skip-$name
+asan_text="SUMMARY: AddressSanitizer"
 success="no"
 if test -x "`which bash`"; then
 	shell="bash"
@@ -200,6 +201,16 @@ if test -f $name.post -a ! -f ../$skip; then
 		echo "Warning: $name.post did not exit successfully"
 	fi
 fi
+# Check if there were any AddressSanitizer errors
+# if compiled with -fsanitize=address
+if grep "$asan_text" $result >/dev/null 2>&1; then
+	if test -f ../$done; then
+		rm ../$done
+	fi
+	echo "$name: FAILED (AddressSanitizer)" >> $result
+	echo "$name: FAILED (AddressSanitizer)"
+	success="no"
+fi
 echo "DateRunEnd: "`date "+%s" 2>/dev/null` >> $result
 
 mv $result ..

testcode/petal.c

@@ -256,7 +256,7 @@ setup_ctx(char* key, char* cert)
 #if HAVE_DECL_SSL_CTX_SET_ECDH_AUTO
 	if (!SSL_CTX_set_ecdh_auto(ctx,1))
 		if(verb>=1) printf("failed to set_ecdh_auto, not enabling ECDHE\n");
-#elif defined(USE_ECDSA)
+#elif defined(USE_ECDSA) && defined(HAVE_SSL_CTX_SET_TMP_ECDH)
 	if(1) {
 		EC_KEY *ecdh = EC_KEY_new_by_curve_name (NID_X9_62_prime256v1);
 		if (!ecdh) {

testcode/readzone.c

@@ -45,7 +45,6 @@
 #include <string.h>
 #include <unistd.h>
 
-#include <stdint.h>
 #include "sldns/str2wire.h"
 #include "sldns/wire2str.h"
 

testcode/streamtcp.c

@@ -471,7 +471,11 @@ send_em(const char* svr, const char* pp2_client, int udp, int usessl,
 			}
 		}
 		if(1) {
+#ifdef HAVE_SSL_GET1_PEER_CERTIFICATE
+			X509* x = SSL_get1_peer_certificate(ssl);
+#else
 			X509* x = SSL_get_peer_certificate(ssl);
+#endif
 			if(!x) printf("SSL: no peer certificate\n");
 			else {
 				X509_print_fp(stdout, x);

testcode/unitmain.c

@@ -1252,6 +1252,109 @@ static void edns_ede_answer_encode_test(void)
 	regional_destroy(region);
 }
 
+#include "services/localzone.h"
+/* Utility function that compares two localzone trees */
+static void compare_localzone_trees(struct local_zones* z1,
+	struct local_zones* z2)
+{
+	struct local_zone *node1, *node2;
+	lock_rw_rdlock(&z1->lock);
+	lock_rw_rdlock(&z2->lock);
+	/* size should be the same */
+	unit_assert(z1->ztree.count == z2->ztree.count);
+	for(node1=(struct local_zone*)rbtree_first(&z1->ztree),
+		node2=(struct local_zone*)rbtree_first(&z2->ztree);
+		(rbnode_type*)node1 != RBTREE_NULL &&
+		(rbnode_type*)node2 != RBTREE_NULL;
+		node1=(struct local_zone*)rbtree_next((rbnode_type*)node1),
+		node2=(struct local_zone*)rbtree_next((rbnode_type*)node2)) {
+		int labs;
+		/* the same zone should be at the same nodes */
+		unit_assert(!dname_lab_cmp(
+			node1->name, node1->namelabs,
+			node2->name, node2->namelabs,
+			&labs));
+		/* the zone's parent should be the same on both nodes */
+		unit_assert(
+			(node1->parent == NULL && node2->parent == NULL) ||
+			(node1->parent != NULL && node2->parent != NULL));
+		if(node1->parent) {
+			unit_assert(!dname_lab_cmp(
+				node1->parent->name, node1->parent->namelabs,
+				node2->parent->name, node2->parent->namelabs,
+				&labs));
+		}
+	}
+	lock_rw_unlock(&z1->lock);
+	lock_rw_unlock(&z2->lock);
+}
+
+/* test that zone addition results in the same tree from both the configuration
+ * file and the unbound-control commands */
+static void localzone_parents_test(void)
+{
+	struct local_zones *z1, *z2;
+	size_t i;
+	char* zone_data[] = {
+		"one",
+		"a.b.c.one",
+		"b.c.one",
+		"c.one",
+		"two",
+		"c.two",
+		"b.c.two",
+		"a.b.c.two",
+		"a.b.c.three",
+		"b.c.three",
+		"c.three",
+		"three",
+		"c.four",
+		"b.c.four",
+		"a.b.c.four",
+		"four",
+		"."
+	};
+	unit_show_feature("localzones parent calculation");
+	z1 = local_zones_create();
+	z2 = local_zones_create();
+	/* parse test data */
+	for(i=0; i<sizeof(zone_data)/sizeof(zone_data[0]); i++) {
+		uint8_t* nm;
+		int nmlabs;
+		size_t nmlen;
+		struct local_zone* z;
+
+		/* This is the config way */
+		z = lz_enter_zone(z1, zone_data[i], "always_nxdomain",
+			LDNS_RR_CLASS_IN);
+		(void)z;  /* please compiler when no threading and no lock
+		code; the following line disappears and z stays unused */
+		lock_rw_unlock(&z->lock);
+		lz_init_parents(z1);
+
+		/* This is the unbound-control way */
+		nm = sldns_str2wire_dname(zone_data[i], &nmlen);
+		if(!nm) unit_assert(0);
+		nmlabs = dname_count_size_labels(nm, &nmlen);
+		lock_rw_wrlock(&z2->lock);
+		local_zones_add_zone(z2, nm, nmlen, nmlabs, LDNS_RR_CLASS_IN,
+			local_zone_always_nxdomain);
+		lock_rw_unlock(&z2->lock);
+	}
+	/* The trees should be the same, iterate and check the nodes */
+	compare_localzone_trees(z1, z2);
+
+	/* cleanup */
+	local_zones_delete(z1);
+	local_zones_delete(z2);
+}
+
+/** localzone unit tests */
+static void localzone_test(void)
+{
+	localzone_parents_test();
+}
+
 void unit_show_func(const char* file, const char* func)
 {
 	printf("test %s:%s\n", file, func);
@@ -1325,6 +1428,7 @@ main(int argc, char* argv[])
 	tcpreuse_test();
 	msgparse_test();
 	edns_ede_answer_encode_test();
+	localzone_test();
 #ifdef CLIENT_SUBNET
 	ecs_test();
 #endif /* CLIENT_SUBNET */

testcode/unitverify.c

@@ -178,6 +178,7 @@ verifytest_rrset(struct module_env* env, struct val_env* ve,
 	struct query_info* qinfo)
 {
 	enum sec_status sec;
+	char reasonbuf[256];
 	char* reason = NULL;
 	uint8_t sigalg[ALGO_NEEDS_MAX+1];
 	int verified = 0;
@@ -188,8 +189,9 @@ verifytest_rrset(struct module_env* env, struct val_env* ve,
 	}
 	setup_sigalg(dnskey, sigalg); /* check all algorithms in the dnskey */
 	/* ok to give null as qstate here, won't be used for answer section. */
-	sec = dnskeyset_verify_rrset(env, ve, rrset, dnskey, sigalg, &reason, NULL,
-		LDNS_SECTION_ANSWER, NULL, &verified);
+	sec = dnskeyset_verify_rrset(env, ve, rrset, dnskey, sigalg, &reason,
+		NULL, LDNS_SECTION_ANSWER, NULL, &verified, reasonbuf,
+		sizeof(reasonbuf));
 	if(vsig) {
 		printf("verify outcome is: %s %s\n", sec_status_to_string(sec),
 			reason?reason:"");

testcode/unitzonemd.c

@@ -256,7 +256,6 @@ static void zonemd_verify_test(char* zname, char* zfile, char* tastr,
 	struct auth_zone* z;
 
 	/* setup test harness */
-	memset(&mods, 0, sizeof(mods));
 	memset(&env, 0, sizeof(env));
 	env.scratch = regional_create();
 	if(!env.scratch)
@@ -288,8 +287,10 @@ static void zonemd_verify_test(char* zname, char* zfile, char* tastr,
 	if(!env.auth_zones)
 		fatal_exit("out of memory");
 	modstack_init(&mods);
-	if(!modstack_setup(&mods, env.cfg->module_conf, &env))
-		fatal_exit("could not modstack_setup");
+	if(!modstack_call_startup(&mods, env.cfg->module_conf, &env))
+		fatal_exit("could not modstack_startup");
+	if(!modstack_call_init(&mods, env.cfg->module_conf, &env))
+		fatal_exit("could not modstack_call_init");
 	env.mesh = mesh_create(&mods, &env);
 	if(!env.mesh)
 		fatal_exit("out of memory");
@@ -327,7 +328,9 @@ static void zonemd_verify_test(char* zname, char* zfile, char* tastr,
 
 	/* desetup test harness */
 	mesh_delete(env.mesh);
-	modstack_desetup(&mods, &env);
+	modstack_call_deinit(&mods, &env);
+	modstack_call_destartup(&mods, &env);
+	modstack_free(&mods);
 	auth_zones_delete(env.auth_zones);
 	anchors_delete(env.anchors);
 	config_delete(env.cfg);

testdata/02-unittest.tdir/02-unittest.test

@@ -7,57 +7,69 @@
 . ../common.sh
 PRE="../.."
 get_make
-(cd $PRE ; $MAKE unittest; $MAKE lock-verify)
+(cd $PRE ; $MAKE unittest; $MAKE lock-verify; $MAKE unbound-dnstap-socket)
 
 if test -f $PRE/unbound_do_valgrind_in_test; then
-	do_valgrind=yes
+	DO_VALGRIND=yes
 else
-	do_valgrind=no
+	DO_VALGRIND=no
 fi
 VALGRIND_FLAGS="--leak-check=full --show-leak-kinds=all"
 
-if test $do_valgrind = "yes"; then
-	echo "valgrind yes"
-	echo
-	tmpout=/tmp/tmpout.$$
-	if (cd $PRE; valgrind $VALGRIND_FLAGS ./unittest >$tmpout 2>&1); then
-		echo "unit test worked."
+# Run a unit test; it exits on failure
+# $1: the command to start the unit test
+run_unittest () {
+	unit_cmd=$1
+	echo "> testing $unit_cmd"
+	if test $DO_VALGRIND = "yes"; then
+		echo "valgrind yes"
+		echo
+		tmpout=/tmp/tmpout.$$
+		if (cd $PRE; valgrind $VALGRIND_FLAGS ./$unit_cmd >$tmpout 2>&1); then
+			echo "unit test worked."
+		else
+			echo "unit test failed."
+			exit 1
+		fi
+		if grep "All heap blocks were freed -- no leaks are possible" $tmpout; then
+			:  # clean
+		else
+			cat $tmpout
+			echo "Memory leaked in unit test"
+			grep "in use at exit" $tmpout
+			exit 1
+		fi
+		if grep "ERROR SUMMARY: 0 errors from 0 contexts" $tmpout; then
+			:  # clean
+		else
+			cat $tmpout
+			echo "Errors in unit test"
+			grep "ERROR SUMMARY" $tmpout
+			exit 1
+		fi
+		rm -f $tmpout
 	else
-		echo "unit test failed."
-		exit 1
+		# without valgrind
+		if (cd $PRE; ./$unit_cmd); then
+			echo "unit test worked."
+		else
+			echo "unit test failed."
+			exit 1
+		fi
 	fi
-	if grep "All heap blocks were freed -- no leaks are possible" $tmpout; then
-		:  # clean
-	else
-		cat $tmpout
-		echo "Memory leaked in unittest"
-		grep "in use at exit" $tmpout
-		exit 1
-	fi
-	if grep "ERROR SUMMARY: 0 errors from 0 contexts" $tmpout; then
-		:  # clean
-	else
-		cat $tmpout
-		echo "Errors in unittest"
-		grep "ERROR SUMMARY" $tmpout
-		exit 1
-	fi
-	rm -f $tmpout
-else
-	# without valgrind
-	if (cd $PRE; ./unittest); then
-		echo "unit test worked."
-	else
-		echo "unit test failed."
-		exit 1
-	fi
-fi
-if test -f $PRE/ublocktrace.0; then
-	if (cd $PRE; ./lock-verify ublocktrace.*); then
-		echo "lock-verify test worked."
-	else
-		echo "lock-verify test failed."
-		exit 1
+	if test -f $PRE/ublocktrace.0; then
+		if (cd $PRE; ./lock-verify ublocktrace.*); then
+			echo "lock-verify test worked."
+		else
+			echo "lock-verify test failed."
+			exit 1
+		fi
 	fi
+}
+
+run_unittest "unittest"
+if grep "define UNBOUND_DEBUG" $PRE/config.h >/dev/null;  then
+	run_unittest "unbound-dnstap-socket -c"
 fi
+
 exit 0

testdata/07-confroot.tdir/07-confroot.pre

@@ -4,6 +4,7 @@
 # use .tpkg.var.test for in test variable passing
 [ -f .tpkg.var.test ] && source .tpkg.var.test
 
+. ../common.sh
 PRE="../.."
 
 if uname | grep "MINGW" >/dev/null; then

testdata/09-unbound-control.tdir/09-unbound-control.conf

@@ -1,8 +1,7 @@
 server:
-	verbosity: 2
-	num-threads: 1
-	interface: 127.0.0.1
-	port: @PORT@
+	verbosity: 5
+	num-threads: 1  # This is dynamically handled by the test when needed
+	interface: 127.0.0.1@@PORT@
 	use-syslog: no
 	directory: ""
 	pidfile: "unbound.pid"
@@ -10,9 +9,13 @@ server:
 	username: ""
 	do-not-query-localhost: no
 	access-control: 127.0.0.1 allow_snoop
+	access-control-view: 127.0.0.1 testview
 	msg-cache-size: 4m
 	rrset-cache-size: 4m
 	minimal-responses: yes
+view:
+	name: testview
+	view-first: yes  # Allow falling back to global local data
 remote-control:
 	control-enable: yes
 	control-interface: 127.0.0.1

testdata/09-unbound-control.tdir/09-unbound-control.pre

@@ -30,4 +30,3 @@ echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
 cat .tpkg.var.test
 wait_ldns_testns_up fwd.log
 wait_unbound_up unbound.log
-

testdata/09-unbound-control.tdir/09-unbound-control.test

@@ -73,6 +73,29 @@ control_command () {
 	$PRE/unbound-control $@ > outfile
 }
 
+# Reload the server for a clean state
+clean_reload () {
+	echo "> Reloading the server for a clean state"
+	cp main.conf ub.conf
+	control_command -c ub.conf reload
+	expect_exit_value 0
+}
+
+# Reload the server for a clean state and populate the cache
+clean_reload_and_fill_cache () {
+	clean_reload
+	echo "> Populating the cache"
+	query www.example.com
+	expect_answer "10.20.30.40"
+	if test "$have_threads" = "no"; then
+		# Try to get the answer in all processes' cache.
+		for (( try=0 ; try < num_threads * 2 * 2 ; try++ )) ; do
+			query www.example.com
+			expect_answer "10.20.30.40"
+		done
+	fi
+}
+
 # Dump the cache contents
 # $@: optional options to unbound-control
 cache_dump () {
@@ -111,8 +134,28 @@ fail_in_cache_dump () {
 	fi
 }
 
-# start the test
+# Check if multi-threading or multi-process environment
+have_threads="no"
+if grep "define HAVE_PTHREAD 1" $PRE/config.h; then have_threads="yes"; fi
+if grep "define HAVE_SOLARIS_THREADS 1" $PRE/config.h; then have_threads="yes"; fi
+if grep "define HAVE_WINDOWS_THREADS 1" $PRE/config.h; then have_threads="yes"; fi
+
+# start the test; keep the original conf file around
+cp ub.conf orig.conf
+
+
+# START - thread configuration
+# Do both single thread/process and multi thread/process runs.
+# The number of threads can only go up from the initial configuration between
+# reloads so starting with 1.
+for num_threads in 1 4; do
+
+cp orig.conf ub.conf
+echo "> setting num-threads: $num_threads"
+echo "server: num-threads: $num_threads" >> ub.conf
 cp ub.conf main.conf
+clean_reload
+
 
 teststep "exit value is 1 on usage"
 control_command -h
@@ -163,6 +206,9 @@ cat conf.spoofed_credentials >> bad.conf
 control_command -c bad.conf verbosity 2
 expect_exit_value 1
 
+teststep "clean reload"
+clean_reload
+
 teststep "create a new local zone"
 control_command -c ub.conf local_zone example.net static
 expect_exit_value 0
@@ -194,6 +240,76 @@ expect_exit_value 0
 query www.example.net.
 expect_answer "SERVFAIL"
 
+teststep "load local-zones from file"
+control_command -c ub.conf local_zones < local_zones
+expect_exit_value 0
+query localzonefromfile
+expect_answer "REFUSED"
+if test "$have_threads" = "no"; then
+	# Try to see if a process other than the first one
+	# has updated data from stdin.
+	for (( try=0 ; try < num_threads * 2 ; try++ )) ; do
+		query localzonefromfile
+		expect_answer "REFUSED"
+	done
+fi
+
+teststep "load local-data from file"
+control_command -c ub.conf local_datas < local_data
+expect_exit_value 0
+query -t txt localdatafromfile
+expect_answer "local data from file OK"
+if test "$have_threads" = "no"; then
+	# Try to see if a process other than the first one
+	# has updated data from stdin.
+	for (( try=0 ; try < num_threads * 2 ; try++ )) ; do
+		query -t txt localdatafromfile
+		expect_answer "local data from file OK"
+	done
+fi
+
+teststep "load view-local-data from file"
+control_command -c ub.conf view_local_datas testview < view_local_data
+expect_exit_value 0
+control_command -c ub.conf view_list_local_zones testview
+query -t txt viewlocaldatafromfile
+expect_answer "view local data from file OK"
+if test "$have_threads" = "no"; then
+	# Try to see if a process other than the first one
+	# has updated data from stdin.
+	for (( try=0 ; try < num_threads * 2 ; try++ )) ; do
+		query -t txt viewlocaldatafromfile
+		expect_answer "view local data from file OK"
+	done
+fi
+
+teststep "remove local-zone, local-data and view-local-data from file"
+control_command -c ub.conf local_zones_remove < local_zones_remove
+expect_exit_value 0
+control_command -c ub.conf local_datas_remove < local_data_remove
+expect_exit_value 0
+control_command -c ub.conf view_local_datas_remove testview < view_local_data_remove
+expect_exit_value 0
+control_command -c ub.conf list_local_zones
+fail_answer "localzonefromfile"
+fail_answer "local data from file OK"
+expect_answer "otherlocalzone"
+control_command -c ub.conf view_list_local_data testview
+fail_answer "viewlocaldatafromfile"
+
+teststep "flushing"
+control_command -c ub.conf flush www.example.net
+expect_exit_value 0
+control_command -c ub.conf flush_type www.example.net TXT
+expect_exit_value 0
+control_command -c ub.conf flush_zone example.net
+expect_exit_value 0
+
+# START - single thread/process tests only
+if test $num_threads -le 1; then
+
+clean_reload_and_fill_cache
+
 teststep "dump the cache"
 query www.example.com.
 cache_dump -c ub.conf
@@ -208,123 +324,79 @@ expect_exit_value 0
 teststep "load the cache dump"
 cache_load -c ub.conf
 expect_exit_value 0
-query www.example.com.
+query www.example.com. +nordflag
 expect_answer "10.20.30.40"
 
-teststep "load local-zones from file"
-control_command -c ub.conf local_zones < local_zones
-expect_exit_value 0
-query localzonefromfile
-expect_answer "REFUSED"
+else
+	echo ""
+	echo "> skip test parts that need single thread/process"
+fi
+# END - single thread/process tests only
 
-teststep "load local-data from file"
-control_command -c ub.conf local_datas < local_data
-expect_exit_value 0
-query -t txt localdatafromfile
-expect_answer "local data from file OK"
+clean_reload_and_fill_cache
 
-teststep "remove local-zone and local-data from file"
-control_command -c ub.conf local_zones_remove < local_zones_remove
-expect_exit_value 0
-control_command -c ub.conf local_datas_remove < local_data_remove
-expect_exit_value 0
-control_command -c ub.conf list_local_zones
-fail_answer "localzonefromfile"
-fail_answer "local data from file OK"
-expect_answer "otherlocalzone"
-
-teststep "flushing"
-control_command -c ub.conf flush www.example.net
-expect_exit_value 0
-control_command -c ub.conf flush_type www.example.net TXT
-expect_exit_value 0
-control_command -c ub.conf flush_zone example.net
-expect_exit_value 0
-
-teststep "reload the server for a clean state and populate the cache"
-cp main.conf ub.conf
+teststep "reload and check cache - should be empty"
 control_command -c ub.conf reload
 expect_exit_value 0
-query www.example.com
-expect_answer "10.20.30.40"
+query www.example.com +nordflag
+fail_answer "10.20.30.40"
 
-teststep "reload and check cache dump - should be empty"
-control_command -c ub.conf reload
-expect_exit_value 0
-cache_dump -c ub.conf
-expect_exit_value 0
-fail_in_cache_dump "www.example.com.*10.20.30.40"
-fail_in_cache_dump "msg www.example.com. IN A"
+clean_reload_and_fill_cache
 
-query www.example.com
-expect_answer "10.20.30.40"
-
-teststep "reload_keep_cache and check cache dump - should not be empty"
+teststep "reload_keep_cache and check cache - should not be empty"
 control_command -c ub.conf reload_keep_cache
 expect_exit_value 0
-cache_dump -c ub.conf
-expect_exit_value 0
-cat cache.dump
-expect_in_cache_dump "www.example.com.*10.20.30.40"
-expect_in_cache_dump "msg www.example.com. IN A"
 query www.example.com +nordflag
 expect_answer "10.20.30.40"
 
+clean_reload_and_fill_cache
+
 teststep "change msg-cache-size and reload_keep_cache - should be empty"
 echo "server: msg-cache-size: 2m" >> ub.conf
 control_command -c ub.conf reload_keep_cache
 expect_exit_value 0
-cache_dump -c ub.conf
-expect_exit_value 0
-fail_in_cache_dump "www.example.com.*10.20.30.40"
-fail_in_cache_dump "msg www.example.com. IN A"
-query www.example.com
-expect_answer "10.20.30.40"
+query www.example.com +nordflag
+fail_answer "10.20.30.40"
+
+clean_reload_and_fill_cache
 
 teststep "change rrset-cache-size and reload_keep_cache - should be empty"
 echo "server: rrset-cache-size: 2m" >> ub.conf
 control_command -c ub.conf reload_keep_cache
 expect_exit_value 0
-cache_dump -c ub.conf
-expect_exit_value 0
-fail_in_cache_dump "www.example.com.*10.20.30.40"
-fail_in_cache_dump "msg www.example.com. IN A"
-query www.example.com
-expect_answer "10.20.30.40"
+query www.example.com +nordflag
+fail_answer "10.20.30.40"
 
-# See if this part of the test can be enabled, it needs threads for combined
-# output.
-have_threads="no"
-if grep "define HAVE_PTHREAD 1" $PRE/config.h; then have_threads="yes"; fi
-if grep "define HAVE_SOLARIS_THREADS 1" $PRE/config.h; then have_threads="yes"; fi
-if grep "define HAVE_WINDOWS_THREADS 1" $PRE/config.h; then have_threads="yes"; fi
+# START - have_threads tests
+# This part of the test needs threads for combined output.
 if test "$have_threads" = "yes"; then
 
+clean_reload_and_fill_cache
+
 teststep "change num-threads and reload_keep_cache - should be empty"
 echo "server: num-threads: 2" >> ub.conf
 control_command -c ub.conf reload_keep_cache
 expect_exit_value 0
-cache_dump -c ub.conf
-expect_exit_value 0
-fail_in_cache_dump "www.example.com.*10.20.30.40"
-fail_in_cache_dump "msg www.example.com. IN A"
-query www.example.com
-expect_answer "10.20.30.40"
+query www.example.com +nordflag
+fail_answer "10.20.30.40"
+
+clean_reload_and_fill_cache
 
 teststep "change minimal-responses and reload_keep_cache - should not be empty"
 echo "server: minimal-responses: no" >> ub.conf
 control_command -c ub.conf reload_keep_cache
 expect_exit_value 0
-cache_dump -c ub.conf
-expect_exit_value 0
-expect_in_cache_dump "www.example.com.*10.20.30.40"
-expect_in_cache_dump "msg www.example.com. IN A"
+query www.example.com +nordflag
+expect_answer "10.20.30.40"
 
 else
 	echo ""
 	echo "> skip test parts that need threads, have_threads=no"
-# end of check for have_threads
 fi
+# END - have_threads tests
+
+done
+# END - thread configuration
 
 teststep "now stop the server"
 control_command -c ub.conf stop

testdata/09-unbound-control.tdir/09-unbound-control.testns

@@ -19,4 +19,3 @@ ADJUST copy_id
 SECTION QUESTION
 www.example.net.	IN	A
 ENTRY_END
-

testdata/09-unbound-control.tdir/local_data

@@ -1 +1,4 @@
 localdatafromfile 3600 TXT "local data from file OK"
+localdatafromfile1 3600 A 1.1.1.1
+localdatafromfile2 3600 A 2.2.2.2
+localdatafromfile3 3600 A 3.3.3.3

testdata/09-unbound-control.tdir/local_data_remove

@@ -1 +1,4 @@
 localdatafromfile
+localdatafromfile1
+localdatafromfile2
+localdatafromfile3

testdata/09-unbound-control.tdir/local_zones

@@ -1,2 +1,5 @@
 localzonefromfile refuse
 otherlocalzone	static
+localzonefromfile1 static
+localzonefromfile2 static
+localzonefromfile3 static

testdata/09-unbound-control.tdir/local_zones_remove

@@ -1 +1,4 @@
 localzonefromfile
+localzonefromfile1
+localzonefromfile2
+localzonefromfile3

testdata/09-unbound-control.tdir/view_local_data

@@ -0,0 +1,4 @@
+viewlocaldatafromfile 3600 TXT "view local data from file OK"
+viewlocaldatafromfile1 3600 A 1.1.1.1
+viewlocaldatafromfile2 3600 A 2.2.2.2
+viewlocaldatafromfile3 3600 A 3.3.3.3

testdata/09-unbound-control.tdir/view_local_data_remove

@@ -0,0 +1,4 @@
+viewlocaldatafromfile
+viewlocaldatafromfile1
+viewlocaldatafromfile2
+viewlocaldatafromfile3

testdata/acl_interface.tdir/acl_interface.conf

@@ -5,9 +5,10 @@ server:
 	pidfile: "unbound.pid"
 	chroot: ""
 	username: ""
+	module-config: "respip validator iterator"  # respip for the RPZ part
 	do-not-query-localhost: no
 	use-caps-for-id: no
-	define-tag: "one two refuse"
+	define-tag: "one two refuse rpz-one rpz-two rpz-nx"
 
 # Interface configuration for IPv4
 	interface: @IPV4_ADDR@@@PORT_ALLOW@
@@ -16,6 +17,9 @@ server:
 	interface: @IPV4_ADDR@@@PORT_TAG_1@
 	interface: @IPV4_ADDR@@@PORT_TAG_2@
 	interface: @IPV4_ADDR@@@PORT_TAG_3@
+	interface: @IPV4_ADDR@@@PORT_RPZ_1@
+	interface: @IPV4_ADDR@@@PORT_RPZ_2@
+	interface: @IPV4_ADDR@@@PORT_RPZ_NX@
 	interface: @IPV4_ADDR@@@PORT_VIEW_INT@
 	interface: @IPV4_ADDR@@@PORT_VIEW_EXT@
 	interface: @IPV4_ADDR@@@PORT_VIEW_INTEXT@
@@ -26,6 +30,9 @@ server:
 	interface-action: @IPV4_ADDR@@@PORT_TAG_1@ allow
 	interface-action: @IPV4_ADDR@@@PORT_TAG_2@ allow
 	interface-action: @IPV4_ADDR@@@PORT_TAG_3@ allow
+	interface-action: @IPV4_ADDR@@@PORT_RPZ_1@ allow
+	interface-action: @IPV4_ADDR@@@PORT_RPZ_2@ allow
+	interface-action: @IPV4_ADDR@@@PORT_RPZ_NX@ allow
 	interface-action: @IPV4_ADDR@@@PORT_VIEW_INT@ allow
 	interface-action: @IPV4_ADDR@@@PORT_VIEW_EXT@ allow
 	interface-action: @IPV4_ADDR@@@PORT_VIEW_INTEXT@ allow
@@ -33,6 +40,9 @@ server:
 	interface-tag: @IPV4_ADDR@@@PORT_TAG_1@ "one"
 	interface-tag: @IPV4_ADDR@@@PORT_TAG_2@ "two"
 	interface-tag: @IPV4_ADDR@@@PORT_TAG_3@ "refuse"
+	interface-tag: @IPV4_ADDR@@@PORT_RPZ_1@ "rpz-one"
+	interface-tag: @IPV4_ADDR@@@PORT_RPZ_2@ "rpz-two"
+	interface-tag: @IPV4_ADDR@@@PORT_RPZ_NX@ "rpz-nx"
 	interface-tag-action: @IPV4_ADDR@@@PORT_TAG_1@ one redirect
 	interface-tag-data: @IPV4_ADDR@@@PORT_TAG_1@ one "A 1.1.1.1"
 	interface-tag-action: @IPV4_ADDR@@@PORT_TAG_2@ two redirect
@@ -50,6 +60,9 @@ server:
 	interface: @IPV6_ADDR@@@PORT_TAG_1@
 	interface: @IPV6_ADDR@@@PORT_TAG_2@
 	interface: @IPV6_ADDR@@@PORT_TAG_3@
+	interface: @IPV6_ADDR@@@PORT_RPZ_1@
+	interface: @IPV6_ADDR@@@PORT_RPZ_2@
+	interface: @IPV6_ADDR@@@PORT_RPZ_NX@
 	interface: @IPV6_ADDR@@@PORT_VIEW_INT@
 	interface: @IPV6_ADDR@@@PORT_VIEW_EXT@
 	interface: @IPV6_ADDR@@@PORT_VIEW_INTEXT@
@@ -60,6 +73,9 @@ server:
 	interface-action: @IPV6_ADDR@@@PORT_TAG_1@ allow
 	interface-action: @IPV6_ADDR@@@PORT_TAG_2@ allow
 	interface-action: @IPV6_ADDR@@@PORT_TAG_3@ allow
+	interface-action: @IPV6_ADDR@@@PORT_RPZ_1@ allow
+	interface-action: @IPV6_ADDR@@@PORT_RPZ_2@ allow
+	interface-action: @IPV6_ADDR@@@PORT_RPZ_NX@ allow
 	interface-action: @IPV6_ADDR@@@PORT_VIEW_INT@ allow
 	interface-action: @IPV6_ADDR@@@PORT_VIEW_EXT@ allow
 	interface-action: @IPV6_ADDR@@@PORT_VIEW_INTEXT@ allow
@@ -67,6 +83,9 @@ server:
 	interface-tag: @IPV6_ADDR@@@PORT_TAG_1@ "one"
 	interface-tag: @IPV6_ADDR@@@PORT_TAG_2@ "two"
 	interface-tag: @IPV6_ADDR@@@PORT_TAG_3@ "refuse"
+	interface-tag: @IPV6_ADDR@@@PORT_RPZ_1@ "rpz-one"
+	interface-tag: @IPV6_ADDR@@@PORT_RPZ_2@ "rpz-two"
+	interface-tag: @IPV6_ADDR@@@PORT_RPZ_NX@ "rpz-nx"
 	interface-tag-action: @IPV6_ADDR@@@PORT_TAG_1@ one redirect
 	interface-tag-data: @IPV6_ADDR@@@PORT_TAG_1@ one "A 1.1.1.1"
 	interface-tag-action: @IPV6_ADDR@@@PORT_TAG_2@ two redirect
@@ -84,6 +103,9 @@ server:
 	interface: @INTERFACE@@@PORT_TAG_1@
 	interface: @INTERFACE@@@PORT_TAG_2@
 	interface: @INTERFACE@@@PORT_TAG_3@
+	interface: @INTERFACE@@@PORT_RPZ_1@
+	interface: @INTERFACE@@@PORT_RPZ_2@
+	interface: @INTERFACE@@@PORT_RPZ_NX@
 	interface: @INTERFACE@@@PORT_VIEW_INT@
 	interface: @INTERFACE@@@PORT_VIEW_EXT@
 	interface: @INTERFACE@@@PORT_VIEW_INTEXT@
@@ -94,6 +116,9 @@ server:
 	interface-action: @INTERFACE@@@PORT_TAG_1@ allow
 	interface-action: @INTERFACE@@@PORT_TAG_2@ allow
 	interface-action: @INTERFACE@@@PORT_TAG_3@ allow
+	interface-action: @INTERFACE@@@PORT_RPZ_1@ allow
+	interface-action: @INTERFACE@@@PORT_RPZ_2@ allow
+	interface-action: @INTERFACE@@@PORT_RPZ_NX@ allow
 	interface-action: @INTERFACE@@@PORT_VIEW_INT@ allow
 	interface-action: @INTERFACE@@@PORT_VIEW_EXT@ allow
 	interface-action: @INTERFACE@@@PORT_VIEW_INTEXT@ allow
@@ -101,6 +126,9 @@ server:
 	interface-tag: @INTERFACE@@@PORT_TAG_1@ "one"
 	interface-tag: @INTERFACE@@@PORT_TAG_2@ "two"
 	interface-tag: @INTERFACE@@@PORT_TAG_3@ "refuse"
+	interface-tag: @INTERFACE@@@PORT_RPZ_1@ "rpz-one"
+	interface-tag: @INTERFACE@@@PORT_RPZ_2@ "rpz-two"
+	interface-tag: @INTERFACE@@@PORT_RPZ_NX@ "rpz-nx"
 	interface-tag-action: @INTERFACE@@@PORT_TAG_1@ one redirect
 	interface-tag-data: @INTERFACE@@@PORT_TAG_1@ one "A 1.1.1.1"
 	interface-tag-action: @INTERFACE@@@PORT_TAG_2@ two redirect
@@ -130,6 +158,22 @@ view:
 	name: "intext"
 	view-first: yes
 
+# RPZ configuration
+rpz:
+	name: "rpz-one"
+	zonefile: "rpz-one.zone"
+	tags: "rpz-one"
+
+rpz:
+	name: "rpz-two"
+	zonefile: "rpz-two.zone"
+	tags: "rpz-two"
+
+rpz:
+	name: "rpz-nx"
+	zonefile: "rpz-nx.zone"
+	tags: "rpz-nx"
+
 # Stubs configuration
 forward-zone:
 	name: "."

testdata/acl_interface.tdir/acl_interface.pre

@@ -7,7 +7,7 @@ if test ! -x "`which unshare 2>&1`"; then
 	skip_test "no unshare (from util-linux package) available, skip test"
 fi
 
-get_random_port 11
+get_random_port 14
 
 PORT_ALLOW=$RND_PORT
 PORT_DENY=$(($RND_PORT + 1))
@@ -18,8 +18,11 @@ PORT_TAG_3=$(($RND_PORT + 5))
 PORT_VIEW_INT=$(($RND_PORT + 6))
 PORT_VIEW_EXT=$(($RND_PORT + 7))
 PORT_VIEW_INTEXT=$(($RND_PORT + 8))
-FORWARD_PORT=$(($RND_PORT + 9))
-STUB_PORT=$(($RND_PORT + 10))
+PORT_RPZ_1=$(($RND_PORT + 9))
+PORT_RPZ_2=$(($RND_PORT + 10))
+PORT_RPZ_NX=$(($RND_PORT + 11))
+FORWARD_PORT=$(($RND_PORT + 12))
+STUB_PORT=$(($RND_PORT + 13))
 
 IPV4_ADDR=192.168.1.1
 IPV6_ADDR=2001:db8::1
@@ -41,6 +44,9 @@ sed \
 	-e 's/@PORT_VIEW_INT\@/'$PORT_VIEW_INT'/' \
 	-e 's/@PORT_VIEW_EXT\@/'$PORT_VIEW_EXT'/' \
 	-e 's/@PORT_VIEW_INTEXT\@/'$PORT_VIEW_INTEXT'/' \
+	-e 's/@PORT_RPZ_1\@/'$PORT_RPZ_1'/' \
+	-e 's/@PORT_RPZ_2\@/'$PORT_RPZ_2'/' \
+	-e 's/@PORT_RPZ_NX\@/'$PORT_RPZ_NX'/' \
 	-e 's/@FORWARD_PORT\@/'$FORWARD_PORT'/' \
 	-e 's/@STUB_PORT\@/'$STUB_PORT'/' \
 	-e 's/@IPV4_ADDR\@/'$IPV4_ADDR'/' \
@@ -63,6 +69,9 @@ echo "PORT_TAG_3=$PORT_TAG_3" >> .tpkg.var.test
 echo "PORT_VIEW_INT=$PORT_VIEW_INT" >> .tpkg.var.test
 echo "PORT_VIEW_EXT=$PORT_VIEW_EXT" >> .tpkg.var.test
 echo "PORT_VIEW_INTEXT=$PORT_VIEW_INTEXT" >> .tpkg.var.test
+echo "PORT_RPZ_1=$PORT_RPZ_1" >> .tpkg.var.test
+echo "PORT_RPZ_2=$PORT_RPZ_2" >> .tpkg.var.test
+echo "PORT_RPZ_NX=$PORT_RPZ_NX" >> .tpkg.var.test
 echo "FORWARD_PORT=$FORWARD_PORT" >> .tpkg.var.test
 echo "STUB_PORT=$STUB_PORT" >> .tpkg.var.test
 echo "IPV4_ADDR=$IPV4_ADDR" >> .tpkg.var.test

testdata/acl_interface.tdir/acl_interface.test.scenario

@@ -78,6 +78,16 @@ expect_refused () {
 	fi
 }
 
+expect_nx_answer () {
+	echo "> check answer for NXDOMAIN"
+	if grep "NXDOMAIN" outfile; then
+		echo "OK"
+	else
+		echo "Not OK"
+		end 1
+	fi
+}
+
 expect_external_answer () {
 	echo "> check external answer"
 	if grep "1.2.3.4" outfile; then
@@ -118,6 +128,26 @@ expect_tag_two_answer () {
 	fi
 }
 
+expect_rpz_one_answer () {
+	echo "> check tag 'one' answer"
+	if grep "11.11.11.11" outfile; then
+		echo "OK"
+	else
+		echo "Not OK"
+		end 1
+	fi
+}
+
+expect_rpz_two_answer () {
+	echo "> check tag 'two' answer"
+	if grep "22.22.22.22" outfile; then
+		echo "OK"
+	else
+		echo "Not OK"
+		end 1
+	fi
+}
+
 # do the test
 
 for i in 4 6; do
@@ -142,6 +172,15 @@ for i in 4 6; do
 	query $i $PORT_TAG_3 "local"
 	expect_refused
 
+	query $i $PORT_RPZ_1 "local"
+	expect_rpz_one_answer
+
+	query $i $PORT_RPZ_2 "local"
+	expect_rpz_two_answer
+
+	query $i $PORT_RPZ_NX "local"
+	expect_nx_answer
+
 	query $i $PORT_VIEW_INT "www.internal"
 	expect_internal_answer
 
@@ -183,6 +222,15 @@ for addr in $INTERFACE_ADDR_1 $INTERFACE_ADDR_2 $INTERFACE_ADDR_3 $INTERFACE_ADD
 	query_addr $addr $PORT_TAG_3 "local"
 	expect_refused
 
+	query_addr $addr $PORT_RPZ_1 "local"
+	expect_rpz_one_answer
+
+	query_addr $addr $PORT_RPZ_2 "local"
+	expect_rpz_two_answer
+
+	query_addr $addr $PORT_RPZ_NX "local"
+	expect_nx_answer
+
 	query_addr $addr $PORT_VIEW_INT "www.internal"
 	expect_internal_answer
 

testdata/acl_interface.tdir/rpz-nx.zone

@@ -0,0 +1,3 @@
+$ORIGIN rpz-nx.
+@ IN SOA no.no no.no 1 2 3 4 5
+local IN CNAME .

testdata/acl_interface.tdir/rpz-one.zone

@@ -0,0 +1,3 @@
+$ORIGIN rpz-one.
+@ IN SOA no.no no.no 1 2 3 4 5
+local IN A 11.11.11.11

testdata/acl_interface.tdir/rpz-two.zone

@@ -0,0 +1,3 @@
+$ORIGIN rpz-two.
+@ IN SOA no.no no.no 1 2 3 4 5
+local IN A 22.22.22.22

testdata/cachedb_val_expired.crpl

@@ -0,0 +1,327 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+	minimal-responses: yes
+	serve-expired: yes
+	;module-config: "subnetcache validator cachedb iterator"
+	module-config: "validator cachedb iterator"
+
+cachedb:
+	backend: "testframe"
+	secret-seed: "testvalue"
+	cachedb-check-when-serve-expired: yes
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129
+CONFIG_END
+
+SCENARIO_BEGIN Test cachedb, validator and serve expired.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 400
+	ADDRESS 193.0.14.129
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.     IN      A       193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com. IN NS a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 400
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com. IN NS ns2.example.com.
+SECTION ADDITIONAL
+ns2.example.com.	IN	A	1.2.3.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo.com. IN NS
+SECTION AUTHORITY
+foo.com. IN NS ns.example.com.
+ENTRY_END
+RANGE_END
+
+; ns2.example.com.
+RANGE_BEGIN 0 400
+	ADDRESS 1.2.3.5
+ENTRY_BEGIN
+MATCH opcode qname qtype
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 10 IN A 1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+REPLY QR AA NOERROR
+SECTION QUESTION
+www2.example.com. IN A
+SECTION ANSWER
+www2.example.com. 10 IN A 1.2.3.5
+ENTRY_END
+RANGE_END
+
+; Get an entry in cache, to make it expired.
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; get the answer for it
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 10 IN A 1.2.3.4
+ENTRY_END
+
+; Get another query in cache to make it expired.
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www2.example.com. IN A
+ENTRY_END
+
+; get the answer for it
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www2.example.com. IN A
+SECTION ANSWER
+www2.example.com. 10 IN A 1.2.3.5
+ENTRY_END
+
+; it is now expired
+STEP 40 TIME_PASSES ELAPSE 20
+
+; cache is expired, and cachedb is expired.
+; The expired reply, from cachedb, needs a validation status,
+; because the validator module set that validation is needed.
+STEP 50 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www2.example.com. IN A
+ENTRY_END
+
+STEP 60 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www2.example.com. IN A
+SECTION ANSWER
+www2.example.com. 30 IN A 1.2.3.5
+ENTRY_END
+
+; cache is expired, cachedb has no answer
+STEP 70 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 80 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 30 IN A 1.2.3.4
+ENTRY_END
+
+STEP 90 TRAFFIC
+; the entry should be refreshed in cache now.
+; cache is valid and cachedb is valid.
+STEP 100 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 110 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 10 IN A 1.2.3.4
+ENTRY_END
+
+; flush the entry from cache
+STEP 120 FLUSH_MESSAGE www.example.com. IN A
+
+; cache has no answer, cachedb valid
+STEP 130 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 140 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 10 IN A 1.2.3.4
+ENTRY_END
+
+; it is now expired
+STEP 150 TIME_PASSES ELAPSE 20
+; flush the entry from cache
+STEP 160 FLUSH_MESSAGE www.example.com. IN A
+
+; cache has no answer, cachedb is expired
+STEP 170 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 180 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 30 IN A 1.2.3.4
+ENTRY_END
+
+STEP 190 TRAFFIC
+; the expired message is updated.
+
+; cache is valid, cachedb is valid
+STEP 200 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 210 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 10 IN A 1.2.3.4
+ENTRY_END
+
+; expire the entry in cache
+STEP 220 EXPIRE_MESSAGE www.example.com. IN A
+
+; cache is expired, cachedb valid
+STEP 230 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 240 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 10 IN A 1.2.3.4
+ENTRY_END
+
+; it is now expired
+STEP 250 TIME_PASSES ELAPSE 20
+; expire the entry in cache
+STEP 260 EXPIRE_MESSAGE www.example.com. IN A
+
+; cache is expired, cachedb is expired
+STEP 270 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 280 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 30 IN A 1.2.3.4
+ENTRY_END
+
+STEP 290 TRAFFIC
+; the expired message is updated.
+
+; cache is valid, cachedb is valid
+STEP 300 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 310 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 10 IN A 1.2.3.4
+ENTRY_END
+
+SCENARIO_END

testdata/ipset.tdir/ipset.pre

@@ -8,6 +8,11 @@
 
 PRE="../.."
 if grep "define USE_IPSET 1" $PRE/config.h; then echo test enabled; else skip_test "test skipped"; fi
+if grep "define HAVE_NET_PFVAR_H 1" $PRE/config.h; then
+	if test ! -f /dev/pf; then
+		skip_test "no /dev/pf"
+	fi
+fi
 
 get_random_port 2
 UNBOUND_PORT=$RND_PORT

testdata/remote-threaded.tdir/bad_control.key

@@ -1,15 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIICXAIBAAKBgQDti51Z6qASvAjPFFhLLlq8BwtsnmfqMPMn57dKAghb4OifeL4G
-SLOE02/hKDkdkOvaUG2UqDNh2OoPTuJk4A+mG2LJoziFhHKlIebo9v2YiFWOBVtO
-DWc3tXPT1IlSEN0xnAGelMmeLcPeCPe+A5IDlIHzF/+YiDgS38S9dL17owIDAQAB
-AoGAG3w/DatfMCu/nS5OdQx9BSqPgNbnUSqux9xA0fhgPTlN0T3oRtPcqa7JUDUW
-PryI/a62ry+zGkw98N2AxolCZg3N7Z3vuRx2FMcKKNwpTzDmcZW7TmMk5FPof6gE
-PnYl/ff0w+kxqA+L2EexH3Xi6ApLSZcjyzKWj+dL2AuT9gkCQQD3dPitwITxgCAD
-IaHw23e3FRkM/hw1Gp8bt6nbuxitVxxpO96q1EQ+fCy/mf0bMEJDp3xzMEIfP3r4
-GmNbaxa1AkEA9b8LeBLbQ2cm2+UMeUgygBsRirdUQ786auqH38Jbvi/j6S9sDl2x
-q1vRtikEBZJWfkhsOzrzwFDKe1bI/EEn9wJAAzOwRA9JqRZPU7sLrWIpmmTbfh+L
-neRKSsGFoSI6n4ORCouLxgoZF/XjXldPvxpQwS9ZnOPy9xSLMsqknno0QQJAeDtA
-IT8Yh6GwIWWu9KeeDY8wxe1sDLlCm4yjbZZpzGMh3rSU6XJtuqjxsW3fydoO9zn3
-ugLdvvnIFxAexUwbgQJBANyM13xcObfUJOj9rjlGCh0CDh/04ONl8SH8HBnM8guA
-RJI5S6vBHweVRopEZcF1sQm6wMf3ej/sGkyyNvJxRkY=
------END RSA PRIVATE KEY-----

testdata/remote-threaded.tdir/bad_control.pem

@@ -1,11 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBozCCAQwCCQDd5/rocjG5vDANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkyNjEyMjQ0NFoXDTI4MDYxMzEyMjQ0NFowGjEYMBYGA1UE
-AxMPdW5ib3VuZC1jb250cm9sMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDt
-i51Z6qASvAjPFFhLLlq8BwtsnmfqMPMn57dKAghb4OifeL4GSLOE02/hKDkdkOva
-UG2UqDNh2OoPTuJk4A+mG2LJoziFhHKlIebo9v2YiFWOBVtODWc3tXPT1IlSEN0x
-nAGelMmeLcPeCPe+A5IDlIHzF/+YiDgS38S9dL17owIDAQABMA0GCSqGSIb3DQEB
-BQUAA4GBAHpvcKqY48X9WsqogV16L+zT7iXhZ4tySA9EBk1a+0gud/iDPKSBi7mK
-4rzphVfb4S207dVmTG+1WNpa6l3pTGML6XLElxqIu/kr7w4cF0rKvZxWPsBRqYjH
-5HrK8CrQ0+YvUHXiu7IaACLGvKXY4Tqa3HQyvEtzLWJ4HhOrGx8F
------END CERTIFICATE-----

testdata/remote-threaded.tdir/bad_server.key

@@ -1,15 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIICWwIBAAKBgQC9hurNHBtB7QFEuPJOnCylUWUF2/US3v9yQQQXnstuXMQXRaq1
-1uviLmwaGurV9tngX59HITsBT74NQrtFKfEDLViLrm2arAM9Ozsn4tnv30HXPRDj
-UOc1M05Q7UzjaSrOv+TkPEqyhtUyaP1DYo0bcmbxtSkYc2ZEWCwhPklUwQIDAQAB
-AoGATjzZxN4ramWaNnJapJTX4U7eczK/0pB3xwSL2exVcjOdRzYdKH+WVIJxYb1m
-3/jNLFCNAeH356yxeevoPr73nG75YJ9I1ZWQWTnS3SDK6JD1+3pmAD0bQWFoitpf
-FoSH9H4X5gFB5vCZ99YVoYH1UXWPcgvUHwxz0voImt6lCKECQQD4YQ4A3M0+Ki8v
-Hl+5FKULnS0UtBkweCvkF/X1zZRjjYr6hLnqldFkkgTBKWe17pUXX0nwRMbP1YZX
-i+vDq5JNAkEAw1eYsmC0nVAMawo57N6LYavGv/n5u1cvpTpKDtn4cXH0Uqq13Kyu
-2FUTzan2NhCEK78UzbWaeewBJmxYda1+RQJAdShKk6uTAEyjnwUjv8h2JWlJN2fQ
-LeWxRlDrCruiz+aW9J4gl/99GoQpy/c83TshhjnDRZsbcDNWv/rXBZ/rTQJAFQva
-CtX6f7yBKgM3DHtJvyM3zbVMH9Ab9QxbsE/xwZ9KeKGl6Hm+eNZpxM3cFiUfaGs0
-/ZjkZOB1m0MvILaplQJAXC3PJ/E+87banGZRJl5qtS6/HoX5lH9TPkL8Essy7ANO
-2BT2OTQawD1A+VKIrQHXs085Of8tQUfrfHHt7s3Kqg==
------END RSA PRIVATE KEY-----

testdata/remote-threaded.tdir/bad_server.pem

@@ -1,11 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIBmzCCAQQCCQCDugnhq8B6LzANBgkqhkiG9w0BAQUFADASMRAwDgYDVQQDEwd1
-bmJvdW5kMB4XDTA4MDkyNjEyMjQ0M1oXDTI4MDYxMzEyMjQ0M1owEjEQMA4GA1UE
-AxMHdW5ib3VuZDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAvYbqzRwbQe0B
-RLjyTpwspVFlBdv1Et7/ckEEF57LblzEF0Wqtdbr4i5sGhrq1fbZ4F+fRyE7AU++
-DUK7RSnxAy1Yi65tmqwDPTs7J+LZ799B1z0Q41DnNTNOUO1M42kqzr/k5DxKsobV
-Mmj9Q2KNG3Jm8bUpGHNmRFgsIT5JVMECAwEAATANBgkqhkiG9w0BAQUFAAOBgQCy
-zGMW35/9xXoEWsuLFWUOaEKVq5DXuXtXbcMpDW6k2ELoraa305vh7Zwhj5JSqfcm
-O0xyqIzXvz/cYdyOTgEkdMDZ/EvQsxKTwvj6eA4614yB1r3Ju5eZd4Gpo6BHhSpu
-oqsrr0duJ+JOANTyaBplIxM1sjHbR4FGtmrFknBYBQ==
------END CERTIFICATE-----

testdata/remote-threaded.tdir/remote-threaded.conf

@@ -1,25 +0,0 @@
-server:
-	verbosity: 2
-	num-threads: 4
-	outgoing-range: 16
-	interface: 127.0.0.1
-	port: @PORT@
-	use-syslog: no
-	directory: ""
-	pidfile: "unbound.pid"
-	chroot: ""
-	username: ""
-	do-not-query-localhost: no
-remote-control:
-	control-enable: yes
-	control-interface: 127.0.0.1
-	# control-interface: ::1
-	control-port: @CONTROL_PORT@
-	server-key-file: "unbound_server.key"
-	server-cert-file: "unbound_server.pem"
-	control-key-file: "unbound_control.key"
-	control-cert-file: "unbound_control.pem"
-forward-zone:
-	name: "."
-	forward-addr: "127.0.0.1@@TOPORT@"
-

testdata/remote-threaded.tdir/remote-threaded.dsc

@@ -1,16 +0,0 @@
-BaseName: remote-threaded
-Version: 1.0
-Description: remote control test with thread communication
-CreationDate: Wed Dec  3 15:00:38 CET 2008
-Maintainer: dr. W.C.A. Wijngaards
-Category: 
-Component:
-CmdDepends: 
-Depends: 
-Help:
-Pre: remote-threaded.pre
-Post: remote-threaded.post
-Test: remote-threaded.test
-AuxFiles: 
-Passed:
-Failure:

testdata/remote-threaded.tdir/remote-threaded.post

@@ -1,13 +0,0 @@
-# #-- remote-threaded.post --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# source the test var file when it's there
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-#
-# do your teardown here
-. ../common.sh
-kill_pid $FWD_PID
-# unbound stopped by test (if successful)
-kill $UNBOUND_PID >/dev/null 2>&1
-kill $UNBOUND_PID >/dev/null 2>&1
-exit 0

testdata/remote-threaded.tdir/remote-threaded.pre

@@ -1,33 +0,0 @@
-# #-- remote-threaded.pre--#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-. ../common.sh
-get_random_port 3
-UNBOUND_PORT=$RND_PORT
-FWD_PORT=$(($RND_PORT + 1))
-CONTROL_PORT=$(($RND_PORT + 2))
-echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
-echo "FWD_PORT=$FWD_PORT" >> .tpkg.var.test
-echo "CONTROL_PORT=$CONTROL_PORT" >> .tpkg.var.test
-
-# start forwarder
-get_ldns_testns
-$LDNS_TESTNS -p $FWD_PORT remote-threaded.testns >fwd.log 2>&1 &
-FWD_PID=$!
-echo "FWD_PID=$FWD_PID" >> .tpkg.var.test
-
-# make config file
-sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$FWD_PORT'/' -e 's/@CONTROL_PORT\@/'$CONTROL_PORT'/' < remote-threaded.conf > ub.conf
-# start unbound in the background
-PRE="../.."
-$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-
-cat .tpkg.var.test
-wait_ldns_testns_up fwd.log
-wait_unbound_up unbound.log
-

testdata/remote-threaded.tdir/remote-threaded.test

@@ -1,310 +0,0 @@
-# #-- remote-threaded.test --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-
-# exit value is 1 on usage
-$PRE/unbound-control -h
-if test $? -ne 1; then
-	echo "wrong exit value for usage."
-	exit 1
-else
-	echo "exit value for usage: OK"
-fi
-
-# use lock-verify if possible
-
-# test if the server is up.
-echo "> dig www.example.com."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com. | tee outfile
-echo "> check answer"
-if grep "10.20.30.40" outfile; then
-	echo "OK"
-else
-	echo "> cat logfiles"
-	cat fwd.log
-	cat unbound.log
-	echo "Not OK"
-	exit 1
-fi
-
-# exit value is 1 when a bad command is given.
-echo "$PRE/unbound-control -c ub.conf blablargh"
-$PRE/unbound-control -c ub.conf blablargh
-if test $? -ne 1; then
-	echo "wrong exit value on error."
-	echo "> cat logfiles"
-	cat fwd.log
-	cat unbound.log
-	exit 1
-else
-	echo "correct exit value on error"
-fi
-
-# reload the server. test if the server came up by putting a new
-# local-data element in the server.
-echo "server: local-data: 'afterreload. IN A 5.6.7.8'" >> ub.conf
-echo "$PRE/unbound-control -c ub.conf reload"
-$PRE/unbound-control -c ub.conf reload
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-
-echo "> dig afterreload."
-dig @127.0.0.1 -p $UNBOUND_PORT afterreload. | tee outfile
-echo "> check answer"
-if grep "5.6.7.8" outfile; then
-	echo "OK"
-else
-	echo "> cat logfiles"
-	cat fwd.log
-	cat unbound.log
-	echo "Not OK"
-	exit 1
-fi
-
-# must have had queries now.  1 since reload.
-echo "$PRE/unbound-control -c ub.conf stats"
-$PRE/unbound-control -c ub.conf stats > tmp.$$
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	cat fwd.log
-	cat unbound.log
-	exit 1
-fi
-if grep "^total.num.queries=[1-9][0-9]*$" tmp.$$; then
-	echo "OK"
-else
-	echo "bad stats"
-	cat tmp.$$
-	exit 1
-fi
-
-# verbosity
-echo "$PRE/unbound-control -c ub.conf verbosity 4"
-$PRE/unbound-control -c ub.conf verbosity 4
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-
-# check syntax error in parse
-echo "$PRE/unbound-control -c ub.conf verbosity jkdf"
-$PRE/unbound-control -c ub.conf verbosity jkdf
-if test $? -ne 1; then
-	echo "wrong exit value after failure"
-	exit 1
-fi
-
-# check bad credentials
-cp ub.conf bad.conf
-echo "remote-control:" >> bad.conf
-echo "	server-key-file: bad_server.key" >> bad.conf
-echo "	server-cert-file: bad_server.pem" >> bad.conf
-echo "	control-key-file: bad_control.key" >> bad.conf
-echo "	control-cert-file: bad_control.pem" >> bad.conf
-echo "$PRE/unbound-control -c bad.conf verbosity 2"
-$PRE/unbound-control -c bad.conf verbosity 2
-if test $? -ne 1; then
-	echo "wrong exit value after failure"
-	exit 1
-fi
-
-# create a new local zone
-echo "> test of local zone"
-echo "$PRE/unbound-control -c ub.conf local_zone example.net static"
-$PRE/unbound-control -c ub.conf local_zone example.net static
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-echo "$PRE/unbound-control -c ub.conf local_data www.example.net A 192.0.2.1"
-$PRE/unbound-control -c ub.conf local_data www.example.net A 192.0.2.1
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-
-# check that www.example.net exists
-echo "> dig www.example.net."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.net. | tee outfile
-echo "> check answer"
-if grep "192.0.2.1" outfile; then
-	echo "OK"
-else
-	echo "> cat logfiles"
-	cat fwd.log
-	cat unbound.log
-	echo "Not OK"
-	exit 1
-fi
-
-# check that mail.example.net has nxdomain
-echo "> dig mail.example.net."
-dig @127.0.0.1 -p $UNBOUND_PORT mail.example.net. | tee outfile
-echo "> check answer"
-if grep "NXDOMAIN" outfile; then
-	echo "OK"
-else
-	echo "> cat logfiles"
-	cat fwd.log
-	cat unbound.log
-	echo "Not OK"
-	exit 1
-fi
-
-# remove www.example.net - check it gets nxdomain
-echo "$PRE/unbound-control -c ub.conf local_data_remove www.example.net"
-$PRE/unbound-control -c ub.conf local_data_remove www.example.net
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-echo "> dig www.example.net."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.net. | tee outfile
-echo "> check answer"
-if grep "NXDOMAIN" outfile; then
-	echo "OK"
-else
-	echo "> cat logfiles"
-	cat fwd.log
-	cat unbound.log
-	echo "Not OK"
-	exit 1
-fi
-
-# remove example.net - check its gone.
-echo "$PRE/unbound-control -c ub.conf local_zone_remove example.net"
-$PRE/unbound-control -c ub.conf local_zone_remove example.net
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-echo "> dig www.example.net."
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.net. | tee outfile
-echo "> check answer"
-if grep "SERVFAIL" outfile; then
-	echo "OK"
-else
-	echo "> cat logfiles"
-	cat fwd.log
-	cat unbound.log
-	echo "Not OK"
-	exit 1
-fi
-
-# dump the cache
-echo "> test cache dump"
-# fillup cache
-echo "dig www.example.com"
-dig @127.0.0.1 -p $UNBOUND_PORT www.example.com.
-echo "$PRE/unbound-control -c ub.conf dump_cache"
-$PRE/unbound-control -c ub.conf dump_cache > tmp.$$
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-cat tmp.$$
-# we do not look at content. Only thread 0 content.
-# because it may not be there when it is compiled with processes only.
-if grep MSG_CACHE tmp.$$; then
-	echo "OK this is a cache dump"
-else
-	echo "Not OK cache dump"
-	exit 1
-fi
-
-# test lookup
-echo "$PRE/unbound-control -c ub.conf lookup www.example.com"
-$PRE/unbound-control -c ub.conf lookup www.example.com
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-# answer to lookup is meaningless because of use a forwarder, oh well.
-
-# load the cache dump.
-echo "$PRE/unbound-control -c ub.conf load_cache < tmp.$$"
-$PRE/unbound-control -c ub.conf load_cache < tmp.$$
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-# do not check if cache dump contents are present ; other threads
-# may not have gotten it when it is compiled with processes only.
-
-# flushing
-echo "$PRE/unbound-control -c ub.conf flush www.example.net"
-$PRE/unbound-control -c ub.conf flush www.example.net
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-
-echo "$PRE/unbound-control -c ub.conf flush_type www.example.net TXT"
-$PRE/unbound-control -c ub.conf flush_type www.example.net TXT
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-
-echo "$PRE/unbound-control -c ub.conf flush_zone example.net"
-$PRE/unbound-control -c ub.conf flush_zone example.net
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-
-# now stop the server
-echo "$PRE/unbound-control -c ub.conf stop"
-$PRE/unbound-control -c ub.conf stop
-if test $? -ne 0; then
-	echo "wrong exit value after success"
-	exit 1
-fi
-# see if the server has really exited.
-TRY_MAX=20
-for (( try=0 ; try <= $TRY_MAX ; try++ )) ; do
-	if kill -0 $UNBOUND_PID 2>&1 | tee tmp.$$; then
-		echo "not stopped yet, waiting"
-		sleep 1
-	else
-		echo "stopped OK; break"
-		break;
-	fi
-	if grep "No such process" tmp.$$; then
-		echo "stopped OK; break"
-		break;
-	fi
-done
-if kill -0 $UNBOUND_PID; then
-	echo "still up!"
-	echo "> cat logfiles"
-	cat fwd.log
-	cat unbound.log
-	echo "not stopped, failure"
-	exit 1
-else
-	echo "stopped OK"
-
-        if test -f ublocktrace.0; then
-		if $PRE/lock-verify ublocktrace.*; then
-			echo "lock-verify test worked."
-		else
-			echo "lock-verify test failed."
-			cat fwd.log
-			cat unbound.log
-			exit 1
-		fi
-	fi
-fi
-
-echo "> cat logfiles"
-cat fwd.log
-cat unbound.log
-echo "> OK"
-exit 0

testdata/remote-threaded.tdir/remote-threaded.testns

@@ -1,22 +0,0 @@
-; nameserver test file
-$ORIGIN example.com.
-$TTL 3600
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA NOERROR
-ADJUST copy_id
-SECTION QUESTION
-www	IN	A
-SECTION ANSWER
-www	IN	A	10.20.30.40
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-REPLY QR AA SERVFAIL
-ADJUST copy_id
-SECTION QUESTION
-www.example.net.	IN	A
-ENTRY_END
-

testdata/remote-threaded.tdir/unbound_control.key

@@ -1,39 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
-1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
-F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
-ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
-vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
-IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
-cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
-lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
-15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
-LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
-Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
-YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
-whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
-lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
-tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
-U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
-Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
-Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
-ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
-1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
-b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
-ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
-TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
-tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
-aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
-A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
-LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
-R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
-7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
-7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
-jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
-BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
-kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
-qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
-VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
-MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
-C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
------END RSA PRIVATE KEY-----

testdata/remote-threaded.tdir/unbound_control.pem

@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
-EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
-WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
-A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
-OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
-1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
-NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
-A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
-Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
-TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
-nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
-+i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
-4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
-hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
-9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
-ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
-pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
-72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
-muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
-uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
------END CERTIFICATE-----

testdata/remote-threaded.tdir/unbound_server.key

@@ -1,39 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
-0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
-GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
-uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
-WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
-FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
-q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
-A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
-7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
-XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
-iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
-2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
-MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
-WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
-O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
-IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
-qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
-dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
-bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
-YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
-7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
-gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
-5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
-ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
-oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
-s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
-zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
-ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
-oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
-BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
-mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
-kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
-7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
-RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
-jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
-O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
-MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
------END RSA PRIVATE KEY-----

testdata/remote-threaded.tdir/unbound_server.pem

@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
-EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
-WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
-igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
-a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
-4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
-aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
-TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
-uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
-+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
-XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
-dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
-84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
-JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
-fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
-XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
-qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
-sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
-yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
-CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
------END CERTIFICATE-----

testdata/root_anchor.tdir/root_anchor.pre

@@ -3,6 +3,8 @@
 # use .tpkg.var.test for in test variable passing
 [ -f .tpkg.var.test ] && source .tpkg.var.test
 
+. ../common.sh
+
 # only do this test if the network is up.
 if dig @k.root-servers.net . SOA 2>&1 | grep NOERROR ; then
 	: