Merge branch 'master' into simdzone-zone-load

$INCLUDE in a zonefile read.

.github/workflows/analysis_ports.yml

@@ -173,10 +173,40 @@ jobs:
             cross_platform_config: "--enable-debug --disable-flto --with-libevent --disable-static"
  
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v4
         with:
-          submodules: false
+          submodules: recursive
           persist-credentials: false
+      - name: test_windows_configure
+        if: ${{ matrix.test_windows == 'yes' }}
+        shell: bash
+        run: |
+          # The run starts with mount points for /c, /d, and
+          # C:/Program Files/Git on /
+          # C:/Program Files/Git/usr/bin on /bin
+          # C:/Users/RUNNER~1/AppData/Local/Temp on /tmp
+          echo "mount"
+          mount || echo "ignored"
+          echo "mount -o bind /c/msys64/usr /usr"
+          mount -o bind /c/msys64/usr /usr || echo "ignored"
+          # Now there is:
+          # C:/msys64 on /
+          # C:/msys64/usr/bin on /bin
+          # And those mount points should go away for the next 'run:' shell.
+          echo "mount"
+          mount || echo "ignored"
+          # probably installs to C:\msys64\usr\bin\bash.exe
+          echo "pacman -S --noconfirm autotools"
+          C:/msys64/usr/bin/pacman -S --noconfirm autotools
+          echo "rm -f aclocal.m4"
+          rm -f aclocal.m4
+          # The paths are mounted, so that /c/msys64/usr/share/autoconf-..,
+          # /c/msys64/usr/share/aclocal-.., /c/msys64/usr/share/automake-..
+          # are in /usr. Also for /usr/bin, autoreconf is from
+          # /c/msys64/usr/bin.
+          echo "autoreconf -fi"
+          #PATH="/c/msys64/usr/bin:$PATH" autoreconf -fi || echo "ignored"
+          autoreconf -fi
       - name: test_windows
         if: ${{ matrix.test_windows == 'yes' }}
         env:
@@ -189,8 +219,9 @@ jobs:
           cd ..
           export prepath=`pwd`
           echo prepath=${prepath}
-          # parralel build option
-          export MINJ="-j4"
+          # The mount should have the git directories.
+          echo "mount"
+          mount || echo "ignored"
           echo "choco install winflexbison3"
           choco install winflexbison3
           echo 'LEX="win_flex"'
@@ -208,13 +239,13 @@ jobs:
           #sed -e 's/use Pod::Usage//' < Configure > Configure.fix
           # ./Configure.fix no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl"
           # pacman is used to install for msys2, with
-          # C:/msys64/usr/bin/pacman -S perl
+          # C:/msys64/usr/bin/pacman -S --noconfirm perl
           echo "C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix=\""$prepath/openssl"\" PERL=\"C:/msys64/usr/bin/perl\""
           C:/msys64/usr/bin/perl ./Configure no-shared no-asm -DOPENSSL_NO_CAPIENG mingw64 --prefix="$prepath/openssl" PERL="C:/msys64/usr/bin/perl"
           # make the libs only, build faster
           echo "make build_libs"
-          #make $MINJ
-          make $MINJ build_libs
+          #make
+          make build_libs
           mv Makefile Makefile.orig
           # fixup \\ in the installtop to /.
           echo "fixup INSTALLTOP"
@@ -246,7 +277,7 @@ jobs:
           mv xmlwf/Makefile xmlwf/Makefile.orig
           sed -e 's/SHELL/SHELLZZ/g' < xmlwf/Makefile.orig > xmlwf/Makefile
           echo "make"
-          make $MINJ
+          make
           echo "make install"
           make install
           cd ..
@@ -254,7 +285,7 @@ jobs:
           cd unbound
           echo "./configure --enable-debug --enable-static-exe --disable-flto \"--with-ssl=$prepath/openssl\" --with-libexpat=\"$prepath/expat\" --disable-shared"
           ./configure --enable-debug --enable-static-exe --disable-flto "--with-ssl=$prepath/openssl" --with-libexpat="$prepath/expat" --disable-shared
-          make $MINJ
+          make
           # specific test output
           #make testbound.exe; ./testbound.exe -s
           #make testbound; ./testbound.exe -p testdata/acl.rpl -o -vvvv
@@ -297,6 +328,8 @@ jobs:
           ./contrib/android/install_expat.sh
           echo "::endgroup::"
           echo "::group::configure"
+          echo "autoreconf -fi"
+          autoreconf -fi
           echo "./configure ${CONFIG_OPTS}"
           ./configure ${CONFIG_OPTS}
           echo "::endgroup::"
@@ -316,6 +349,7 @@ jobs:
           IOS_CPU: ${{ matrix.IOS_CPU }}
         run: |
           #(already installed) ./contrib/ios/install_tools.sh
+          brew install autoconf automake libtool make
           export AUTOTOOLS_BUILD="$(./config.guess)"
           echo AUTOTOOLS_BUILD=${AUTOTOOLS_BUILD}
           export IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
@@ -337,6 +371,8 @@ jobs:
           ./contrib/ios/install_expat.sh
           echo "::endgroup::"
           echo "::group::configure"
+          echo "autoreconf -fi"
+          autoreconf -fi
           echo "./configure ${CONFIG_OPTS}"
           ./configure ${CONFIG_OPTS}
           echo "::endgroup::"
@@ -349,7 +385,7 @@ jobs:
           echo "::endgroup::"
       - name: cross-platform-action on ${{ matrix.cross_platform_os }} ${{ matrix.cross_platform_version }}
         if: ${{ matrix.with_cross_platform_action == 'yes' }}
-        uses: cross-platform-actions/action@v1.0.0
+        uses: cross-platform-actions/action@v0.25.0
         env:
           CROSS_PLATFORM_OS: ${{ matrix.cross_platform_os }}
         with:
@@ -362,10 +398,12 @@ jobs:
           cpu_count: 2
           run: |
             set -e -x
-            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y openssl libevent expat; fi
-            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add libevent; fi
-            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install libevent; fi
+            if test "$CROSS_PLATFORM_OS" = "freebsd"; then sudo pkg install -y autoconf automake libtool pkgconf openssl libevent expat; fi
+            if test "$CROSS_PLATFORM_OS" = "openbsd"; then sudo pkg_add autoconf-2.71 automake-1.16.5 libtool pkgconf libevent; export AUTOCONF_VERSION="2.71"; export AUTOMAKE_VERSION="1.16"; fi
+            if test "$CROSS_PLATFORM_OS" = "netbsd"; then sudo pkgin -y install autoconf automake libtool pkgconf libevent; export LDFLAGS="-Wl,--rpath=/usr/pkg/lib"; fi
             echo "::group::configure"
+            rm -f aclocal.m4
+            autoreconf -fi
             ./configure ${{ matrix.cross_platform_config }}
             echo "::endgroup::"
             echo "::group::make"
@@ -379,10 +417,15 @@ jobs:
         run: sudo apt-get install libevent-dev
       - name: install expat
         if: ${{ matrix.install_expat == 'yes' }}
-        run: brew install expat
+        run: |
+          brew install expat
+          brew install autoconf automake libtool make
       - name: configure
         if: ${{ matrix.config != 'no' }}
-        run: ./configure ${{ matrix.config }}
+        run: |
+          if test `uname` = "Linux"; then sudo apt-get install autoconf automake libtool make; fi
+          autoreconf -fi
+          ./configure ${{ matrix.config }}
       - name: make
         if: ${{ matrix.make != 'no' }}
         run: make

.github/workflows/ci.yml

@@ -12,11 +12,16 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v4
       with:
+        submodules: recursive
         persist-credentials: false
+    - name: install packages
+      run: sudo apt-get install autoconf automake libtool make
     - name: configure
-      run: ./configure --enable-debug
+      run: |
+        autoreconf -fi
+        ./configure --enable-debug
     - name: make
       run: make
     - name: make test

.gitignore

@@ -3,11 +3,17 @@
 /.libs/
 /.source
 /Makefile
+/aclocal.m4
 /autom4te.cache/
+/config.guess
 /config.h
+/config.h.in
 /config.h.in~
 /config.log
 /config.status
+/config.sub
+/configure
+/configure~
 /dnstap/dnstap_config.h
 /dnscrypt/dnscrypt_config.h
 /util/configlexer.c
@@ -22,8 +28,10 @@
 /doc/unbound-host.1
 /doc/unbound.8
 /doc/unbound.conf.5
+/install-sh
 /libtool
 /libunbound.la
+/ltmain.sh
 /_unbound.la
 /smallapp/unbound-control-setup.sh
 /unbound

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "simdzone"]
+	path = simdzone
+	url = https://github.com/NLnetLabs/simdzone.git

Makefile.in

@@ -56,7 +56,7 @@ YACC=@YACC@
 LEX=@LEX@
 STRIP=@STRIP@
 CC=@CC@
-CPPFLAGS=-I. @CPPFLAGS@
+CPPFLAGS=-I. @CPPFLAGS@ -Isimdzone/include -I@srcdir@/simdzone/include
 PYTHON_CPPFLAGS=-I. -I$(srcdir) @PYTHON_CPPFLAGS@
 CFLAGS=-DSRCDIR=$(srcdir) @CFLAGS@
 LDFLAGS=@LDFLAGS@
@@ -267,6 +267,7 @@ LIBUNBOUND_SRC=libunbound/context.c libunbound/libunbound.c \
 libunbound/libworker.c
 LIBUNBOUND_OBJ=context.lo libunbound.lo libworker.lo ub_event_pluggable.lo
 LIBUNBOUND_OBJ_LINK=$(LIBUNBOUND_OBJ) $(COMMON_OBJ_WITHOUT_UB_EVENT) $(SLDNS_OBJ) $(COMPAT_OBJ)
+SIMDZONE_OBJ=@SIMDZONE_OBJ@
 
 # win apps or "" if not on windows
 WINAPPS=@WINAPPS@
@@ -364,19 +365,24 @@ longtest:	tests
 	if test ! $(srcdir)/testdata -ef ./testdata; then rm -rf testcode testdata; mkdir testcode testdata; cp -R $(srcdir)/testdata/*.sh $(srcdir)/testdata/*.tdir $(srcdir)/testdata/*.rpl $(srcdir)/testdata/*.crpl testdata; cp $(srcdir)/testcode/*.sh testcode; if test ! -d util; then mkdir util; fi; cp $(srcdir)/util/iana_ports.inc util; fi
 	if test -x "`which bash`"; then bash testcode/do-tests.sh; else sh testcode/do-tests.sh; fi
 
+simdzone/libzone.la:
+	$(MAKE) -C simdzone
+
+simdzone/include/zone/export.h: simdzone/libzone.la
+
 lib:	libunbound.la unbound.h
 
-libunbound.la:	$(LIBUNBOUND_OBJ_LINK)
-	$(LINK_LIB) $(UBSYMS) -o $@ $(LIBUNBOUND_OBJ_LINK) -rpath $(libdir) $(SSLLIB) $(LIBS)
+libunbound.la:	simdzone/libzone.la $(LIBUNBOUND_OBJ_LINK)
+	$(LINK_LIB) $(UBSYMS) -o $@ $(LIBUNBOUND_OBJ_LINK) $(SIMDZONE_OBJ) -rpath $(libdir) $(SSLLIB) $(LIBS)
 
 unbound$(EXEEXT):	$(DAEMON_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
+	$(LINK) -o $@ $(DAEMON_OBJ_LINK) $(EXTRALINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS) $(DYNLIBMOD_EXTRALIBS)
 
 unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(CHECKCONF_OBJ_LINK) $(EXTRALINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 unbound-control$(EXEEXT):	$(CONTROL_OBJ_LINK) libunbound.la
-	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(CONTROL_OBJ_LINK) $(EXTRALINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 unbound-host$(EXEEXT):	$(HOST_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(HOST_OBJ_LINK) libunbound.la $(SSLLIB) $(LIBS)
@@ -394,43 +400,43 @@ anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(ANCHORUPD_OBJ_LINK) libunbound.la $(LIBS)
 
 unittest$(EXEEXT):	$(UNITTEST_OBJ_LINK)
-	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(UNITTEST_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 testbound$(EXEEXT):	$(TESTBOUND_OBJ_LINK)
-	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(TESTBOUND_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ_LINK)
-	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(LOCKVERIFY_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 petal$(EXEEXT):	$(PETAL_OBJ_LINK)
 	$(LINK) -o $@ $(PETAL_OBJ_LINK) $(SSLLIB) $(LIBS)
 
 pktview$(EXEEXT):	$(PKTVIEW_OBJ_LINK)
-	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(PKTVIEW_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 memstats$(EXEEXT):	$(MEMSTATS_OBJ_LINK)
-	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(MEMSTATS_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ_LINK) libunbound.la
 	$(LINK) -o $@ $(ASYNCLOOK_OBJ_LINK) libunbound.la $(SSLLIB) $(LIBS)
 
 streamtcp$(EXEEXT):	$(STREAMTCP_OBJ_LINK)
-	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(STREAMTCP_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 dohclient$(EXEEXT):	$(DOHCLIENT_OBJ_LINK)
-	$(LINK) -o $@ $(DOHCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DOHCLIENT_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 doqclient$(EXEEXT):	$(DOQCLIENT_OBJ_LINK)
-	$(LINK) -o $@ $(DOQCLIENT_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DOQCLIENT_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 perf$(EXEEXT):	$(PERF_OBJ_LINK)
-	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(PERF_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 delayer$(EXEEXT):	$(DELAYER_OBJ_LINK)
-	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DELAYER_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 readzone$(EXEEXT):	$(READZONE_OBJ_LINK)
-	$(LINK) -o $@ $(READZONE_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(READZONE_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 signit$(EXEEXT):	testcode/signit.c
 	$(CC) $(CPPFLAGS) $(CFLAGS) @PTHREAD_CFLAGS_ONLY@ -o $@ testcode/signit.c $(LDFLAGS) -lldns $(SSLLIB) $(LIBS)
@@ -458,7 +464,7 @@ dnstap/dnstap.pb-c.h: dnstap/dnstap.pb-c.c
 	touch $@
 
 unbound-dnstap-socket$(EXEEXT):	$(DNSTAP_SOCKET_OBJ_LINK)
-	$(LINK) -o $@ $(DNSTAP_SOCKET_OBJ_LINK) $(SSLLIB) $(LIBS)
+	$(LINK) -o $@ $(DNSTAP_SOCKET_OBJ_LINK) $(SIMDZONE_OBJ) $(SSLLIB) $(LIBS)
 
 dnstap.pb-c.lo dnstap.pb-c.o: dnstap/dnstap.pb-c.c dnstap/dnstap.pb-c.h
 dtstream.lo dtstream.o: $(srcdir)/dnstap/dtstream.c config.h $(srcdir)/dnstap/dtstream.h
@@ -522,7 +528,9 @@ util/configparser.c:  $(srcdir)/util/configparser.y
 util/configparser.h: util/configparser.c
 	touch $@
 
-clean:
+.PHONY: .clean .distclean .maintainer-clean .realclean .devclean
+
+.clean:
 	rm -f *.o *.d *.lo *~ tags
 	rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-anchor$(EXEEXT) unbound-control-setup libunbound.la unbound.h
 	rm -f $(ALL_SRC:.c=.lint)
@@ -530,19 +538,37 @@ clean:
 	rm -f libunbound.a
 	rm -rf autom4te.cache .libs build doc/html doc/xml
 
-distclean: clean
+.distclean: .clean
 	rm -f config.status config.log config.h
 	rm -f doc/example.conf doc/libunbound.3 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound-control.8 doc/unbound.8 doc/unbound.conf.5 doc/unbound-host.1
 	rm -f smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service
 	rm -f $(TEST_BIN)
 	rm -f Makefile
 
-maintainer-clean: distclean
+.maintainer-clean: .distclean
 	rm -f util/configlexer.c util/configparser.c util/configparser.h
 
-realclean: maintainer-clean
+.realclean: .maintainer-clean
 	rm -f configure config.h.in config.sub config.guess ltmain.sh aclocal.m4 libtool
 
+.devclean: .realclean
+	rm -f config.h.in configure
+
+clean: .clean
+	$(MAKE) -C simdzone clean
+
+distclean: .distclean
+	$(MAKE) -C simdzone distclean
+
+realclean: .realclean
+	$(MAKE) -C simdzone realclean
+
+maintainer-clean: .maintainer-clean
+	$(MAKE) -C simdzone maintainer-clean
+
+devclean: .devclean
+	$(MAKE) -C simdzone devclean
+
 .SUFFIXES: .lint
 .c.lint:
 	$(LINT) $(LINTFLAGS) -I. -I$(srcdir) $<
@@ -703,6 +729,7 @@ depend:
 			-e 's?$$(srcdir)/edns-subnet/subnetmod.h $$(srcdir)/edns-subnet/subnet-whitelist.h $$(srcdir)/edns-subnet/edns-subnet.h $$(srcdir)/edns-subnet/addrtree.h?$$(SUBNET_HEADER)?g' \
 			-e 's?$$(srcdir)/ipsecmod/ipsecmod.h $$(srcdir)/ipsecmod/ipsecmod-whitelist.h?$$(IPSECMOD_HEADER)?g' \
 			-e 's?$$(srcdir)/dynlibmod/dynlibmod.h?$$(DYNLIBMOD_HEADER)?g' \
+			-e 's?$$(srcdir)/simdzone/include/zone/export.h?simdzone/include/zone/export.h?g' \
 			-e 's!\(.*\)\.o[ :]*!\1.lo \1.o: !g' \
 			> $(DEPEND_TMP)
 	cp $(DEPEND_TARGET) $(DEPEND_TMP2)
@@ -1000,7 +1027,9 @@ authzone.lo authzone.o: $(srcdir)/services/authzone.c config.h $(srcdir)/service
  $(srcdir)/services/listen_dnsport.h $(srcdir)/daemon/acl_list.h \
  $(srcdir)/sldns/str2wire.h $(srcdir)/sldns/wire2str.h $(srcdir)/sldns/parseutil.h $(srcdir)/sldns/keyraw.h \
  $(srcdir)/validator/val_nsec3.h $(srcdir)/validator/val_nsec.h $(srcdir)/validator/val_secalgo.h \
- $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_utils.h
+ $(srcdir)/validator/val_sigcrypt.h $(srcdir)/validator/val_anchor.h $(srcdir)/validator/val_utils.h \
+ $(srcdir)/simdzone/include/zone.h $(srcdir)/simdzone/include/zone/attributes.h \
+ simdzone/include/zone/export.h
 fptr_wlist.lo fptr_wlist.o: $(srcdir)/util/fptr_wlist.c config.h $(srcdir)/util/fptr_wlist.h \
  $(srcdir)/util/netevent.h $(srcdir)/dnscrypt/dnscrypt.h  \
  $(srcdir)/dnscrypt/cert.h $(srcdir)/util/locks.h $(srcdir)/util/log.h \

README

@@ -1,4 +1,5 @@
 Unbound README
+* From source repository: git submodule update --init && autoreconf -fi
 * ./configure && make && make install
 * You can use libevent if you want. libevent is useful when using 
   many (10000) outgoing ports. By default max 256 ports are opened at

README.md

@@ -19,6 +19,14 @@ You can learn more about Unbound by reading our
 Make sure you have the C toolchain, OpenSSL and its include files, and libexpat
 installed.
 If building from the repository source you also need flex and bison installed.
+If building from the repository source, also init the git submodule and
+create the configure script with:
+
+```
+git submodule update --init
+autoreconf -fi
+```
+
 Unbound can be compiled and installed using:
 
 ```

cachedb/cachedb.c

@@ -754,10 +754,8 @@ cachedb_intcache_store(struct module_qstate* qstate, int msg_expired,
 			"(original ttl: %d)", (int)original_ttl);
 		/* The expired entry does not get checked by the validator
 		 * and we need a validation value for it. */
-		/* By setting this to unchecked, bogus data is not returned
-		 * as non-bogus. */
 		if(qstate->env->cfg->cachedb_check_when_serve_expired)
-			qstate->return_msg->rep->security = sec_status_unchecked;
+			qstate->return_msg->rep->security = sec_status_insecure;
 	}
 	(void)dns_cache_store(qstate->env, &qstate->qinfo,
 		qstate->return_msg->rep, 0, qstate->prefetch_leeway, 0,
@@ -805,11 +803,8 @@ cachedb_handle_query(struct module_qstate* qstate,
 		return;
 	}
 
-	if(qstate->blacklist || qstate->no_cache_lookup
-		|| iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL,
-		NULL, 0)) {
-		/* cache is blacklisted or we are instructed from edns to not
-		 * look or a forwarder/stub forbids it */
+	if(qstate->blacklist || qstate->no_cache_lookup) {
+		/* cache is blacklisted or we are instructed from edns to not look */
 		/* pass request to next module */
 		qstate->ext_state[id] = module_wait_module;
 		return;
@@ -897,9 +892,7 @@ cachedb_handle_response(struct module_qstate* qstate,
 {
 	qstate->is_cachedb_answer = 0;
 	/* check if we are not enabled or instructed to not cache, and skip */
-	if(!ie->enabled || qstate->no_cache_store
-		|| iter_stub_fwd_no_cache(qstate, &qstate->qinfo, NULL, NULL,
-		NULL, 0)) {
+	if(!ie->enabled || qstate->no_cache_store) {
 		/* we are done with the query */
 		qstate->ext_state[id] = module_finished;
 		return;

compat/chacha_private.h

@@ -48,8 +48,8 @@ typedef struct
   a = PLUS(a,b); d = ROTATE(XOR(d,a), 8); \
   c = PLUS(c,d); b = ROTATE(XOR(b,c), 7);
 
-static const char ATTR_NONSTRING(sigma[16]) = "expand 32-byte k";
-static const char ATTR_NONSTRING(tau[16]) = "expand 16-byte k";
+static const char sigma[16] = "expand 32-byte k";
+static const char tau[16] = "expand 16-byte k";
 
 static void
 chacha_keysetup(chacha_ctx *x,const u8 *k,u32 kbits,u32 ATTR_UNUSED(ivbits))

compat/gmtime_r.c

@@ -42,7 +42,10 @@ static const int	year_lengths[2] = {
 };
 
 static void
-timesub(const time_t * const timep, const long offset, struct tm * const tmp)
+timesub(timep, offset, tmp)
+const time_t * const			timep;
+const long				offset;
+struct tm * const		tmp;
 {
 	long			days;
 	long			rem;

configure.ac

@@ -11,8 +11,8 @@ sinclude(dnscrypt/dnscrypt.m4)
 
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[25])
-m4_define([VERSION_MICRO],[0])
+m4_define([VERSION_MINOR],[24])
+m4_define([VERSION_MICRO],[3])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
@@ -122,7 +122,7 @@ LIBUNBOUND_AGE=1
 # 1.24.0 had 9:33:1
 # 1.24.1 had 9:34:1
 # 1.24.2 had 9:35:1
-# 1.25.0 had 9:36:1
+# 1.24.3 had 9:36:1
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -177,6 +177,12 @@ else
 	else on_mingw="no"; fi
 fi
 
+dnl install the install-sh file with libtoolize -ci, and autoreconf -fi.
+AC_REQUIRE_AUX_FILE([install-sh])
+if test ! -f install-sh; then
+    AC_MSG_WARN([./install-sh is missing, use `libtoolize -ci` or `autoreconf -fi` to add it])
+fi
+
 #
 # Determine configuration file
 # the eval is to evaluate shell expansion twice
@@ -731,76 +737,6 @@ int main(void) {return 0;}
 		])
 fi
 
-if test x_$ub_have_pthreads != x_no; then
-	# Long checks to support pthread_setname_np().
-	# Some OSes have the extra non-portable functions in a specific
-	# header file.
-	AC_CHECK_HEADERS([pthread_np.h],,, [AC_INCLUDES_DEFAULT])
-	BAKCFLAGS="$CFLAGS"
-	CFLAGS="$CFLAGS -Werror"
-	# MacOS only has 1 argument, the name.
-	AC_MSG_CHECKING([whether pthread_setname_np has only 1 argument])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_setname_np("");
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP1, 1, [Define if pthread_setname_np has only 1 argument.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	# NetBSD has 3 arguments to allow for formatting of the name.
-	AC_MSG_CHECKING([whether pthread_setname_np has 3 arguments])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_setname_np(0, "", NULL);
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP3, 1, [Define if pthread_setname_np has 3 arguments.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	# Most OSes have the common 2 arguments, thread and name.
-	AC_MSG_CHECKING([whether pthread_setname_np has the common 2 arguments])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_setname_np(0, "");
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SETNAME_NP, 1, [Define if pthread_setname_np has the common 2 arguments.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	# FreeBSD/OpenBSD use a slightly different function name.
-	AC_MSG_CHECKING([whether pthread_setname_np exists as pthread_set_name_np instead])
-	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([AC_INCLUDES_DEFAULT
-#include <pthread.h>
-#ifdef HAVE_PTHREAD_NP_H
-#include <pthread_np.h>
-#endif
-	],[
-	    (void)pthread_set_name_np(0, "");
-	])],[
-	    AC_MSG_RESULT(yes)
-	    AC_DEFINE(HAVE_PTHREAD_SET_NAME_NP, 1, [Define if pthread_setname_np exists as pthread_set_name_np instead.])
-	],[
-	    AC_MSG_RESULT(no)
-	])
-	CFLAGS="$BAKCFLAGS"
-fi
-
 # check solaris thread library
 AC_ARG_WITH(solaris-threads, AS_HELP_STRING([--with-solaris-threads],[use solaris native thread library.]), [ ],[ withval="no" ])
 ub_have_sol_threads=no
@@ -1839,7 +1775,6 @@ if test $ac_cv_func_daemon = yes; then
 ])
 fi
 
-AC_CHECK_MEMBERS([struct stat.st_mtimensec, struct stat.st_mtim.tv_nsec])
 AC_CHECK_MEMBERS([struct sockaddr_un.sun_len],,,[
 AC_INCLUDES_DEFAULT
 #ifdef HAVE_SYS_UN_H
@@ -2107,6 +2042,9 @@ dt_DNSTAP([$UNBOUND_RUN_DIR/dnstap.sock],
         AC_SUBST([ENABLE_DNSTAP], [0])
     ]
 )
+dnstap_config="dnstap/dnstap_config.h.tmp:dnstap/dnstap_config.h.in"
+dnstap_config_tmp="dnstap/dnstap_config.h.tmp"
+dnstap_config_out="dnstap/dnstap_config.h"
 
 # check for dnscrypt if requested
 dnsc_DNSCRYPT([
@@ -2561,6 +2499,34 @@ AC_SUBST(version, [VERSION_MAJOR.VERSION_MINOR.VERSION_MICRO])
 AX_BUILD_DATE_EPOCH(date, [[%b %e, %Y]])
 AC_SUBST(date)
 
-AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh dnstap/dnstap_config.h dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
+AC_CONFIG_FILES([Makefile doc/example.conf doc/libunbound.3 doc/unbound.8 doc/unbound-anchor.8 doc/unbound-checkconf.8 doc/unbound.conf.5 doc/unbound-control.8 doc/unbound-host.1 smallapp/unbound-control-setup.sh $dnstap_config dnscrypt/dnscrypt_config.h contrib/libunbound.pc contrib/unbound.socket contrib/unbound.service contrib/unbound_portable.service])
 AC_CONFIG_HEADERS([config.h])
+
+# Arguments introduced specifically for simdzone.
+AC_ARG_ENABLE(westmere, AS_HELP_STRING([--disable-westmere], [Disable Westmere (SSE4.2) parser kernel]))
+AC_ARG_ENABLE(haswell, AS_HELP_STRING([--disable-haswell], [Disable Haswell (AVX2) parser kernel]))
+if test ! -f simdzone/configure.ac; then AC_MSG_ERROR([There is no "simdzone/configure.ac" file. The simdzone directory has not been fetched, perhaps get it with 'git submodule update --init'.]); fi
+if test ! -f simdzone/configure; then AC_MSG_ERROR([There is no "simdzone/configure" file. The simdzone directory has no configure script file, perhaps run 'autoreconf -fi'.]); fi
+AC_CONFIG_SUBDIRS([simdzone])
+
 AC_OUTPUT
+# Pick up the objects for simdzone.
+SIMDZONE_OBJ=`(cd simdzone; make list_objs) | sed -e 's?src?simdzone/src?g'`
+AC_SUBST(SIMDZONE_OBJ)
+sed -e 's?^SIMDZONE_OBJ=.*$?SIMDZONE_OBJ='"$SIMDZONE_OBJ"'?' < Makefile > Makefile.tmp.$$
+mv -f Makefile.tmp.$$ Makefile
+# If dnstap config has changed, overwrite it.
+if test -n "$dnstap_config"; then
+	if test ! -f "$dnstap_config_out"; then
+		mv "$dnstap_config_tmp" "$dnstap_config_out" || AC_MSG_ERROR([Could not create $dnstap_config_out])
+	else if diff "$dnstap_config_out" "$dnstap_config_tmp" >/dev/null 2>&1; then
+		if test "x$opt_dnstap" != "xno"; then
+		  AC_MSG_NOTICE([In $srcdir: $dnstap_config_out is unchanged])
+		fi
+		rm -f "$dnstap_config_tmp"
+	else
+		rm -f "$dnstap_config_out"
+		mv "$dnstap_config_tmp" "$dnstap_config_out" || AC_MSG_ERROR([Could not create $dnstap_config_out])
+	  fi
+	fi
+fi

contrib/README

@@ -58,5 +58,3 @@ distribution but may be helpful.
 * unbound.init_yocto: An init script to start and stop the server. Put it
   in /etc/init.d/unbound to use it. It is for the Yocto Project, in
   embedded systems, contributed by beni-sandu.
-* gost12.patch: adds ECC-GOST12 support for the informational RFC9558.
-  Contributed by Igor V. Ruzanov.

contrib/gost12.patch

@@ -1,325 +0,0 @@
-diff --git a/sldns/keyraw.c b/sldns/keyraw.c
-index 42a9262a3..cc6406a56 100644
---- a/sldns/keyraw.c
-+++ b/sldns/keyraw.c
-@@ -85,7 +85,7 @@ sldns_rr_dnskey_key_size_raw(const unsigned char* keydata,
- 		}
- 		break;
- #ifdef USE_GOST
--	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 		return 512;
- #endif
- #ifdef USE_ECDSA
-@@ -146,7 +146,7 @@ sldns_key_EVP_load_gost_id(void)
- 	if(gost_id) return gost_id;
- 
- 	/* see if configuration loaded gost implementation from other engine*/
--	meth = EVP_PKEY_asn1_find_str(NULL, "gost2001", -1);
-+	meth = EVP_PKEY_asn1_find_str(NULL, "gost2012_256", -1);
- 	if(meth) {
- 		EVP_PKEY_asn1_get0_info(&gost_id, NULL, NULL, NULL, NULL, meth);
- 		return gost_id;
-@@ -170,7 +170,7 @@ sldns_key_EVP_load_gost_id(void)
- 		return 0;
- 	}
- 
--	meth = EVP_PKEY_asn1_find_str(&e, "gost2001", -1);
-+	meth = EVP_PKEY_asn1_find_str(&e, "gost2012_256", -1);
- 	if(!meth) {
- 		/* algo not found */
- 		ENGINE_finish(e);
-@@ -536,12 +536,17 @@ EVP_PKEY* sldns_key_rsa2pkey_raw(unsigned char* key, size_t len)
- EVP_PKEY*
- sldns_gost2pkey_raw(unsigned char* key, size_t keylen)
- {
--	/* prefix header for X509 encoding */
--	uint8_t asn[37] = { 0x30, 0x63, 0x30, 0x1c, 0x06, 0x06, 0x2a, 0x85, 
--		0x03, 0x02, 0x02, 0x13, 0x30, 0x12, 0x06, 0x07, 0x2a, 0x85, 
--		0x03, 0x02, 0x02, 0x23, 0x01, 0x06, 0x07, 0x2a, 0x85, 0x03, 
--		0x02, 0x02, 0x1e, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40};
--	unsigned char encoded[37+64];
-+	/* prefix header for X509 encoding
-+	 *
-+	 * note: based on draft-makarenko-gost2012-dnssec-01 (pre-RFC9558 and it DOES work!)
-+	 * ASN1 header described in RFC9558 is not suitable due to d2i_PUBKEY() works with
-+	 * non-compressed public keys (two additional bytes 0x04, 0x40 at the end of header)
-+	 */
-+	uint8_t asn[32] = { 0x30, 0x5e, 0x30, 0x17, 0x06, 0x08, 0x2a, 0x85,
-+			    0x03, 0x07, 0x01, 0x01, 0x01, 0x01, 0x30, 0x0b,
-+			    0x06, 0x09, 0x2a, 0x85, 0x03, 0x07, 0x01, 0x02,
-+			    0x01, 0x01, 0x01, 0x03, 0x43, 0x00, 0x04, 0x40 };
-+	unsigned char encoded[32+64];
- 	const unsigned char* pp;
- 	if(keylen != 64) {
- 		/* key wrong size */
-@@ -549,8 +554,8 @@ sldns_gost2pkey_raw(unsigned char* key, size_t keylen)
- 	}
- 
- 	/* create evp_key */
--	memmove(encoded, asn, 37);
--	memmove(encoded+37, key, 64);
-+	memmove(encoded, asn, 32);
-+	memmove(encoded+32, key, 64);
- 	pp = (unsigned char*)&encoded[0];
- 
- 	return d2i_PUBKEY(NULL, &pp, (int)sizeof(encoded));
-diff --git a/sldns/rrdef.h b/sldns/rrdef.h
-index bbc3d5b86..7d5f3c057 100644
---- a/sldns/rrdef.h
-+++ b/sldns/rrdef.h
-@@ -384,11 +384,12 @@ enum sldns_enum_algorithm
-         LDNS_RSASHA1_NSEC3      = 7,
-         LDNS_RSASHA256          = 8,   /* RFC 5702 */
-         LDNS_RSASHA512          = 10,  /* RFC 5702 */
--        LDNS_ECC_GOST           = 12,  /* RFC 5933 */
-+        LDNS_ECC_GOST           = 12,  /* RFC 5933, deprecated */
-         LDNS_ECDSAP256SHA256    = 13,  /* RFC 6605 */
-         LDNS_ECDSAP384SHA384    = 14,  /* RFC 6605 */
- 	LDNS_ED25519		= 15,  /* RFC 8080 */
- 	LDNS_ED448		= 16,  /* RFC 8080 */
-+	LDNS_ECC_GOST12		= 23,  /* RFC 9558 */
-         LDNS_INDIRECT           = 252,
-         LDNS_PRIVATEDNS         = 253,
-         LDNS_PRIVATEOID         = 254
-@@ -402,8 +403,9 @@ enum sldns_enum_hash
- {
-         LDNS_SHA1               = 1,  /* RFC 4034 */
-         LDNS_SHA256             = 2,  /* RFC 4509 */
--        LDNS_HASH_GOST          = 3,  /* RFC 5933 */
--        LDNS_SHA384             = 4   /* RFC 6605 */
-+        LDNS_HASH_GOST          = 3,  /* RFC 5933, deprecated */
-+        LDNS_SHA384             = 4,  /* RFC 6605 */
-+        LDNS_HASH_GOST12        = 5   /* RFC 9558 */
- };
- typedef enum sldns_enum_hash sldns_hash;
- 
-diff --git a/sldns/wire2str.c b/sldns/wire2str.c
-index 75b8f37b0..b4c4755e6 100644
---- a/sldns/wire2str.c
-+++ b/sldns/wire2str.c
-@@ -45,11 +45,12 @@ static sldns_lookup_table sldns_algorithms_data[] = {
- 	{ LDNS_RSASHA1_NSEC3, "RSASHA1-NSEC3-SHA1" },
- 	{ LDNS_RSASHA256, "RSASHA256"},
- 	{ LDNS_RSASHA512, "RSASHA512"},
--	{ LDNS_ECC_GOST, "ECC-GOST"},
-+	{ LDNS_ECC_GOST, "ECC-GOST"}, /* deprecated */
- 	{ LDNS_ECDSAP256SHA256, "ECDSAP256SHA256"},
- 	{ LDNS_ECDSAP384SHA384, "ECDSAP384SHA384"},
- 	{ LDNS_ED25519, "ED25519"},
- 	{ LDNS_ED448, "ED448"},
-+	{ LDNS_ECC_GOST12, "ECC-GOST12"},
- 	{ LDNS_INDIRECT, "INDIRECT" },
- 	{ LDNS_PRIVATEDNS, "PRIVATEDNS" },
- 	{ LDNS_PRIVATEOID, "PRIVATEOID" },
-@@ -61,8 +62,9 @@ sldns_lookup_table* sldns_algorithms = sldns_algorithms_data;
- static sldns_lookup_table sldns_hashes_data[] = {
- 	{ LDNS_SHA1, "SHA1" },
- 	{ LDNS_SHA256, "SHA256" },
--	{ LDNS_HASH_GOST, "HASH-GOST" },
-+	{ LDNS_HASH_GOST, "HASH-GOST" }, /* deprecated */
- 	{ LDNS_SHA384, "SHA384" },
-+	{ LDNS_HASH_GOST12, "HASH-GOST12" },
- 	{ 0, NULL }
- };
- sldns_lookup_table* sldns_hashes = sldns_hashes_data;
-diff --git a/testcode/unitverify.c b/testcode/unitverify.c
-index fcf2e2ffe..4a33e9f6a 100644
---- a/testcode/unitverify.c
-+++ b/testcode/unitverify.c
-@@ -696,7 +696,7 @@ verify_test(void)
- #endif
- #ifdef USE_GOST
- 	if(sldns_key_EVP_load_gost_id())
--	  verifytest_file(SRCDIRSTR "/testdata/test_sigs.gost", "20090807060504");
-+	  verifytest_file(SRCDIRSTR "/testdata/test_sigs.gost12", "20251226060504");
- 	else printf("Warning: skipped GOST, openssl does not provide gost.\n");
- #endif
- #ifdef USE_ECDSA
-diff --git a/testdata/test_sigs.gost12 b/testdata/test_sigs.gost12
-new file mode 100644
-index 000000000..72a250cff
---- /dev/null
-+++ b/testdata/test_sigs.gost12
-@@ -0,0 +1,39 @@
-+; Signature test file
-+
-+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification.
-+; later entries are verified with it.
-+
-+; Test GOST signatures using algo number 23.
-+
-+ENTRY_BEGIN
-+SECTION QUESTION
-+nlnetlabs.nl.	IN DNSKEY
-+SECTION ANSWER
-+nlnetlabs.nl.   3600    IN      DNSKEY  256 3 23 cdOtkEcb6NhcdOpIbPYtWyWxdlUiKgtKQbYg3lIjtG7i3fYjUID9zyOgoQEiV9wuGCfrw5cNsnvNw+8HiVFK4g== ;{id = 12301 (zsk), size = 512b}
-+ENTRY_END
-+
-+; entry to test
-+ENTRY_BEGIN
-+SECTION QUESTION
-+open.nlnetlabs.nl. IN A
-+SECTION ANSWER
-+open.nlnetlabs.nl.      600     IN      A       213.154.224.1
-+open.nlnetlabs.nl.      600     IN      RRSIG   A 23 3 600 20260122084903 20251225084903 12301 nlnetlabs.nl. I12wYNs96DxMy26CWx296/sWMJAFg4nNXBo0sw7PnuMbJW5NFAmZYtFWhUdOWn4umaiodYOAmKG8Zg/OKvEtAQ==
-+ENTRY_END
-+
-+ENTRY_BEGIN
-+SECTION QUESTION
-+open.nlnetlabs.nl. IN AAAA
-+SECTION ANSWER
-+open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::1
-+open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::53
-+open.nlnetlabs.nl.      600     IN      RRSIG   AAAA 23 3 600 20260122084903 20251225084903 12301 nlnetlabs.nl. J0jHa+CP8HM6UDa2+uYgaze2mfpJTh2hkZ2KwMTYb5sfL6iBmxxql0c/403Itk4fMfYBMGn7zfzDQ+CxnCgSWw==
-+ENTRY_END
-+
-+ENTRY_BEGIN
-+SECTION QUESTION
-+open.nlnetlabs.nl. IN NSEC
-+SECTION ANSWER
-+open.nlnetlabs.nl.      86400   IN      NSEC    nlnetlabs.nl. A AAAA RRSIG NSEC
-+open.nlnetlabs.nl.      86400   IN      RRSIG   NSEC 23 3 86400 20260122084903 20251225084903 12301 nlnetlabs.nl. INCLYe9vAaNYaYx5Ay3Q6QdX+wPW9sMRvVlGt/jUEGgCi+88QlV80CT1oHrhRI66I14Wk6NRAGZRNx1tUPSHSg==
-+ENTRY_END
-diff --git a/validator/val_secalgo.c b/validator/val_secalgo.c
-index be8347b1b..4f621a309 100644
---- a/validator/val_secalgo.c
-+++ b/validator/val_secalgo.c
-@@ -246,10 +246,10 @@ ds_digest_size_supported(int algo)
- 			return SHA256_DIGEST_LENGTH;
- #endif
- #ifdef USE_GOST
--		case LDNS_HASH_GOST:
-+		case LDNS_HASH_GOST12:
- 			/* we support GOST if it can be loaded */
- 			(void)sldns_key_EVP_load_gost_id();
--			if(EVP_get_digestbyname("md_gost94"))
-+			if(EVP_get_digestbyname("md_gost12_256"))
- 				return 32;
- 			else	return 0;
- #endif
-@@ -265,9 +265,9 @@ ds_digest_size_supported(int algo)
- #ifdef USE_GOST
- /** Perform GOST hash */
- static int
--do_gost94(unsigned char* data, size_t len, unsigned char* dest)
-+do_gost12(unsigned char* data, size_t len, unsigned char* dest)
- {
--	const EVP_MD* md = EVP_get_digestbyname("md_gost94");
-+	const EVP_MD* md = EVP_get_digestbyname("md_gost12_256");
- 	if(!md) 
- 		return 0;
- 	return sldns_digest_evp(data, (unsigned int)len, dest, md);
-@@ -302,8 +302,8 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
- 			return 1;
- #endif
- #ifdef USE_GOST
--		case LDNS_HASH_GOST:
--			if(do_gost94(buf, len, res))
-+		case LDNS_HASH_GOST12:
-+			if(do_gost12(buf, len, res))
- 				return 1;
- 			break;
- #endif
-@@ -384,7 +384,7 @@ dnskey_algo_id_is_supported(int id)
- #endif
- 
- #ifdef USE_GOST
--	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 		/* we support GOST if it can be loaded */
- 		return sldns_key_EVP_load_gost_id();
- #endif
-@@ -612,17 +612,17 @@ setup_key_digest(int algo, EVP_PKEY** evp_key, const EVP_MD** digest_type,
- 
- 			break;
- #ifdef USE_GOST
--		case LDNS_ECC_GOST:
-+		case LDNS_ECC_GOST12:
- 			*evp_key = sldns_gost2pkey_raw(key, keylen);
- 			if(!*evp_key) {
- 				verbose(VERB_QUERY, "verify: "
- 					"sldns_gost2pkey_raw failed");
- 				return 0;
- 			}
--			*digest_type = EVP_get_digestbyname("md_gost94");
-+			*digest_type = EVP_get_digestbyname("md_gost12_256");
- 			if(!*digest_type) {
- 				verbose(VERB_QUERY, "verify: "
--					"EVP_getdigest md_gost94 failed");
-+					"EVP_getdigest md_gost12_256 failed");
- 				return 0;
- 			}
- 			break;
-@@ -964,7 +964,7 @@ ds_digest_size_supported(int algo)
- 			return SHA384_LENGTH;
- #endif
- 		/* GOST not supported in NSS */
--		case LDNS_HASH_GOST:
-+		case LDNS_HASH_GOST12:
- 		default: break;
- 	}
- 	return 0;
-@@ -991,7 +991,7 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
- 			return HASH_HashBuf(HASH_AlgSHA384, res, buf, len)
- 				== SECSuccess;
- #endif
--		case LDNS_HASH_GOST:
-+		case LDNS_HASH_GOST12:
- 		default: 
- 			verbose(VERB_QUERY, "unknown DS digest algorithm %d", 
- 				algo);
-@@ -1031,7 +1031,7 @@ dnskey_algo_id_is_supported(int id)
- 	case LDNS_ECDSAP384SHA384:
- 		return PK11_TokenExists(CKM_ECDSA);
- #endif
--	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 	default:
- 		return 0;
- 	}
-@@ -1352,7 +1352,7 @@ nss_setup_key_digest(int algo, SECKEYPublicKey** pubkey, HASH_HashType* htype,
- 			/* no prefix for DSA verification */
- 			break;
- #endif /* USE_ECDSA */
--		case LDNS_ECC_GOST:
-+		case LDNS_ECC_GOST12:
- 		default:
- 			verbose(VERB_QUERY, "verify: unknown algorithm %d", 
- 				algo);
-@@ -1675,7 +1675,7 @@ ds_digest_size_supported(int algo)
- 			return SHA384_DIGEST_SIZE;
- #endif
- 		/* GOST not supported */
--		case LDNS_HASH_GOST:
-+		case LDNS_ECC_GOST12:
- 		default:
- 			break;
- 	}
-@@ -1700,7 +1700,7 @@ secalgo_ds_digest(int algo, unsigned char* buf, size_t len,
- 			return _digest_nettle(SHA384_DIGEST_SIZE, buf, len, res);
- 
- #endif
--		case LDNS_HASH_GOST:
-+		case LDNS_ECC_GOST12:
- 		default:
- 			verbose(VERB_QUERY, "unknown DS digest algorithm %d",
- 				algo);
-@@ -1744,7 +1744,7 @@ dnskey_algo_id_is_supported(int id)
- 		return 1;
- #endif
- 	case LDNS_RSAMD5: /* RFC 6725 deprecates RSAMD5 */
--	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 	default:
- 		return 0;
- 	}
-@@ -2103,7 +2103,7 @@ verify_canonrrset(sldns_buffer* buf, int algo, unsigned char* sigblock,
- 			return sec_status_secure;
- #endif
- 	case LDNS_RSAMD5:
--	case LDNS_ECC_GOST:
-+	case LDNS_ECC_GOST12:
- 	default:
- 		*reason = "unable to verify signature, unknown algorithm";
- 		return sec_status_bogus;

daemon/daemon.c

@@ -199,255 +199,6 @@ signal_handling_playback(struct worker* wrk)
 	sig_record_reload = 0;
 }
 
-#ifdef HAVE_SSL
-/* setup a listening ssl context, fatal_exit() on any failure */
-static void
-setup_listen_sslctx(void** ctx, int is_dot, int is_doh,
-	struct config_file* cfg, char* chroot)
-{
-	char* key = cfg->ssl_service_key;
-	char* pem = cfg->ssl_service_pem;
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-	if(!(*ctx = listen_sslctx_create(key, pem, NULL,
-		cfg->tls_ciphers, cfg->tls_ciphersuites,
-		(cfg->tls_session_ticket_keys.first &&
-		cfg->tls_session_ticket_keys.first->str[0] != 0),
-		is_dot, is_doh, cfg->tls_protocols))) {
-		fatal_exit("could not set up listen SSL_CTX");
-	}
-}
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-void* daemon_setup_listen_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	(void)setup_listen_sslctx(&ctx, 1, 0, cfg, daemon->chroot);
-	return ctx;
-}
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-void* daemon_setup_listen_doh_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	(void)setup_listen_sslctx(&ctx, 0, 1, cfg, daemon->chroot);
-	return ctx;
-}
-#endif /* HAVE_NGHTTP2_NGHTTP2_H */
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-#ifdef HAVE_NGTCP2
-void* daemon_setup_listen_quic_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	char* chroot = daemon->chroot;
-	char* key = cfg->ssl_service_key;
-	char* pem = cfg->ssl_service_pem;
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-
-	if(!(ctx = quic_sslctx_create(key, pem, NULL))) {
-		fatal_exit("could not set up quic SSL_CTX");
-	}
-	return ctx;
-}
-#endif /* HAVE_NGTCP2 */
-#endif /* HAVE_SSL */
-
-#ifdef HAVE_SSL
-void* daemon_setup_connect_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg)
-{
-	void* ctx;
-	char* bundle, *chroot = daemon->chroot;
-	bundle = cfg->tls_cert_bundle;
-	if(chroot && bundle && strncmp(bundle, chroot, strlen(chroot)) == 0)
-		bundle += strlen(chroot);
-
-	if(!(ctx = connect_sslctx_create(NULL, NULL, bundle,
-		cfg->tls_win_cert)))
-		fatal_exit("could not set up connect SSL_CTX");
-	return ctx;
-}
-#endif /* HAVE_SSL */
-
-/* setups the needed ssl contexts, fatal_exit() on any failure */
-void
-daemon_setup_sslctxs(struct daemon* daemon, struct config_file* cfg)
-{
-#ifdef HAVE_SSL
-	char* chroot = daemon->chroot;
-	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
-		char* key = cfg->ssl_service_key;
-		char* pem = cfg->ssl_service_pem;
-		if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-			key += strlen(chroot);
-		if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-			pem += strlen(chroot);
-
-		/* setup the session keys; the callback to use them will be
-		 * attached to each sslctx separately */
-		if(cfg->tls_session_ticket_keys.first &&
-			cfg->tls_session_ticket_keys.first->str[0] != 0) {
-			if(!listen_sslctx_setup_ticket_keys(
-				cfg->tls_session_ticket_keys.first, chroot)) {
-				fatal_exit("could not set session ticket SSL_CTX");
-			}
-		}
-		daemon->listen_dot_sslctx = daemon_setup_listen_dot_sslctx(
-			daemon, cfg);
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-		if(cfg_has_https(cfg)) {
-			daemon->listen_doh_sslctx =
-				daemon_setup_listen_doh_sslctx(daemon, cfg);
-		}
-#endif
-#ifdef HAVE_NGTCP2
-		if(cfg_has_quic(cfg)) {
-			daemon->listen_quic_sslctx =
-				daemon_setup_listen_quic_sslctx(daemon, cfg);
-		}
-#endif /* HAVE_NGTCP2 */
-
-		/* Store the file name and mtime to detect changes later. */
-		daemon->ssl_service_key = strdup(cfg->ssl_service_key);
-		if(!daemon->ssl_service_key)
-			fatal_exit("could not setup ssl ctx: out of memory");
-		if(cfg->ssl_service_pem) {
-			daemon->ssl_service_pem = strdup(cfg->ssl_service_pem);
-			if(!daemon->ssl_service_pem)
-				fatal_exit("could not setup ssl ctx: out of memory");
-		} else {
-			daemon->ssl_service_pem = NULL;
-		}
-		if(!file_get_mtime(key,
-			&daemon->mtime_ssl_service_key,
-			&daemon->mtime_ns_ssl_service_key, NULL))
-			log_err("Could not stat(%s): %s",
-				key, strerror(errno));
-		if(pem) {
-			if(!file_get_mtime(pem,
-				&daemon->mtime_ssl_service_pem,
-				&daemon->mtime_ns_ssl_service_pem, NULL))
-				log_err("Could not stat(%s): %s",
-					pem, strerror(errno));
-		} else {
-			daemon->mtime_ssl_service_pem = 0;
-			daemon->mtime_ns_ssl_service_pem = 0;
-		}
-	}
-	daemon->connect_dot_sslctx = daemon_setup_connect_dot_sslctx(
-		daemon, cfg);
-#else /* HAVE_SSL */
-	(void)daemon;(void)cfg;
-#endif /* HAVE_SSL */
-}
-
-/** Delete the ssl ctxs */
-static void
-daemon_delete_sslctxs(struct daemon* daemon)
-{
-#ifdef HAVE_SSL
-	listen_sslctx_delete_ticket_keys();
-	SSL_CTX_free((SSL_CTX*)daemon->listen_dot_sslctx);
-	daemon->listen_dot_sslctx = NULL;
-	SSL_CTX_free((SSL_CTX*)daemon->listen_doh_sslctx);
-	daemon->listen_doh_sslctx = NULL;
-	SSL_CTX_free((SSL_CTX*)daemon->connect_dot_sslctx);
-	daemon->connect_dot_sslctx = NULL;
-	free(daemon->ssl_service_key);
-	daemon->ssl_service_key = NULL;
-	free(daemon->ssl_service_pem);
-	daemon->ssl_service_pem = NULL;
-#else
-	(void)daemon;
-#endif
-#ifdef HAVE_NGTCP2
-	SSL_CTX_free((SSL_CTX*)daemon->listen_quic_sslctx);
-	daemon->listen_quic_sslctx = NULL;
-#endif
-}
-
-int
-ssl_cert_changed(struct daemon* daemon, struct config_file* cfg)
-{
-	time_t mtime = 0;
-	long ns = 0;
-	char* chroot = daemon->chroot;
-	char* key = cfg->ssl_service_key;
-	char* pem = cfg->ssl_service_pem;
-	log_assert(daemon->ssl_service_key && cfg->ssl_service_key);
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-
-	if(strcmp(daemon->ssl_service_key, cfg->ssl_service_key) != 0)
-		return 1;
-	if(daemon->ssl_service_pem && cfg->ssl_service_pem &&
-	   strcmp(daemon->ssl_service_pem, cfg->ssl_service_pem) != 0)
-		return 1;
-	if(!file_get_mtime(key, &mtime, &ns, NULL)) {
-		log_err("Could not stat(%s): %s",
-			key, strerror(errno));
-		/* It has probably changed, but file read is likely going to
-		 * fail. */
-		return 0;
-	}
-	if(mtime != daemon->mtime_ssl_service_key ||
-		ns != daemon->mtime_ns_ssl_service_key)
-		return 1;
-	if(pem) {
-		if(!file_get_mtime(pem, &mtime, &ns, NULL)) {
-			log_err("Could not stat(%s): %s",
-				pem, strerror(errno));
-			/* It has probably changed, but file read is likely going to
-			 * fail. */
-			return 0;
-		}
-		if(mtime != daemon->mtime_ssl_service_pem ||
-			ns != daemon->mtime_ns_ssl_service_pem)
-			return 1;
-	}
-	return 0;
-}
-
-/** Reload the sslctxs if they have changed */
-static void
-daemon_reload_sslctxs(struct daemon* daemon)
-{
-#ifdef HAVE_SSL
-	if(daemon->cfg->ssl_service_key && daemon->cfg->ssl_service_key[0]) {
-		/* See if changed */
-		if(!daemon->ssl_service_key ||
-			ssl_cert_changed(daemon,daemon->cfg)) {
-			verbose(VERB_ALGO, "Reloading certificates");
-			daemon_delete_sslctxs(daemon);
-			daemon_setup_sslctxs(daemon, daemon->cfg);
-		}
-	} else {
-		/* See if sslctxs are removed from config. */
-		if(daemon->ssl_service_key) {
-			verbose(VERB_ALGO, "Removing certificates");
-			daemon_delete_sslctxs(daemon);
-		}
-	}
-#else
-	(void)daemon;
-#endif
-}
-
 struct daemon* 
 daemon_init(void)
 {
@@ -484,11 +235,7 @@ daemon_init(void)
 #  else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#    if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#    endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #  endif
 #  if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
 	/* grab the COMP method ptr because openssl leaks it */
@@ -497,11 +244,7 @@ daemon_init(void)
 #  if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #  else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#    if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#    endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #  endif
 #  if defined(HAVE_SSL) && defined(OPENSSL_THREADS) && !defined(THREADS_DISABLED)
 	if(!ub_openssl_lock_init())
@@ -919,14 +662,7 @@ thread_start(void* arg)
 {
 	struct worker* worker = (struct worker*)arg;
 	int port_num = 0;
-	log_assert(worker->thr_id);
 	set_log_thread_id(worker, worker->daemon->cfg);
-	{
-		char name[16]; /* seems to be the safest size between
-				  different OSes */
-		snprintf(name, sizeof(name), "unbound/%u", worker->thread_num);
-		ub_thread_setname(worker->thr_id, name);
-	}
 	ub_thread_blocksigs();
 #ifdef THREADS_DISABLED
 	/* close pipe ends used by main */
@@ -1001,7 +737,6 @@ daemon_fork(struct daemon* daemon)
 #endif
 
 	log_assert(daemon);
-	daemon_reload_sslctxs(daemon);
 	if(!(daemon->env->views = views_create()))
 		fatal_exit("Could not create views: out of memory");
 	/* create individual views and their localzone/data trees */
@@ -1094,12 +829,6 @@ daemon_fork(struct daemon* daemon)
 	 * the thread_start() procedure.
 	 */
 	set_log_thread_id(daemon->workers[0], daemon->cfg);
-	/* If shm stats need an offset, calculate it */
-	if(daemon->cfg->shm_enable && daemon->cfg->stat_interval > 0) {
-		daemon->stat_time_specific = 1;
-		daemon->stat_time_offset =
-			((int)time(NULL))%daemon->cfg->stat_interval;
-	}
 
 #if defined(HAVE_EV_LOOP) || defined(HAVE_EV_DEFAULT_LOOP)
 	/* in libev the first inited base gets signals */
@@ -1254,7 +983,15 @@ daemon_delete(struct daemon* daemon)
 	free(daemon->pidfile);
 	free(daemon->cfgfile);
 	free(daemon->env);
-	daemon_delete_sslctxs(daemon);
+#ifdef HAVE_SSL
+	listen_sslctx_delete_ticket_keys();
+	SSL_CTX_free((SSL_CTX*)daemon->listen_dot_sslctx);
+	SSL_CTX_free((SSL_CTX*)daemon->listen_doh_sslctx);
+	SSL_CTX_free((SSL_CTX*)daemon->connect_dot_sslctx);
+#endif
+#ifdef HAVE_NGTCP2
+	SSL_CTX_free((SSL_CTX*)daemon->listen_quic_sslctx);
+#endif
 	free(daemon);
 	/* lex cleanup */
 	ub_c_lex_destroy();

daemon/daemon.h

@@ -107,18 +107,6 @@ struct daemon {
 	void* listen_doh_sslctx;
 	/** ssl context for listening to quic */
 	void* listen_quic_sslctx;
-	/** the file name that the ssl context is made with, private key. */
-	char* ssl_service_key;
-	/** the file name that the ssl context is made with, certificate. */
-	char* ssl_service_pem;
-	/** modification time for ssl_service_key, in sec and ns. Like
-	 * in a struct timespec, but without that for portability. */
-	time_t mtime_ssl_service_key;
-	long mtime_ns_ssl_service_key;
-	/** modification time for ssl_service_pem, in sec and ns. Like
-	 * in a struct timespec, but without that for portability. */
-	time_t mtime_ssl_service_pem;
-	long mtime_ns_ssl_service_pem;
 	/** num threads allocated */
 	int num;
 	/** num threads allocated in the previous config or 0 at first */
@@ -155,14 +143,7 @@ struct daemon {
 	/** the dnstap environment master value, copied and changed by threads*/
 	struct dt_env* dtenv;
 #endif
-	/** The SHM info for shared memory stats. */
 	struct shm_main_info* shm_info;
-	/** if the timeout for statistics is attempted at specific offset.
-	 * If it is true, the stat timeout is the interval+offset, and that
-	 * picks (roughly) the same time offset every time period. */
-	int stat_time_specific;
-	/** if the timeout is specific, what offset in the period. */
-	int stat_time_offset;
 	/** some response-ip tags or actions are configured if true */
 	int use_response_ip;
 	/** some RPZ policies are configured */
@@ -248,26 +229,4 @@ void daemon_apply_cfg(struct daemon* daemon, struct config_file* cfg);
  */
 int setup_acl_for_ports(struct acl_list* list, struct listen_port* port_list);
 
-/* setups the needed ssl contexts, fatal_exit() on any failure */
-void daemon_setup_sslctxs(struct daemon* daemon, struct config_file* cfg);
-
-/** See if the SSL cert files have changed */
-int ssl_cert_changed(struct daemon* daemon, struct config_file* cfg);
-
-/** Setup the listening DoT SSL_CTX, returns the ssl ctx. */
-void* daemon_setup_listen_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
-/** Setup the listening DoH SSL_CTX, returns the ssl ctx. */
-void* daemon_setup_listen_doh_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
-/** Setup the listening Quic SSL_CTX, returns the ssl ctx */
-void* daemon_setup_listen_quic_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
-/** Setup the connect DoT SSL_CTX, returns the ssl ctx */
-void* daemon_setup_connect_dot_sslctx(struct daemon* daemon,
-	struct config_file* cfg);
-
 #endif /* DAEMON_H */

daemon/remote.c

@@ -153,7 +153,7 @@ remote_setup_ctx(struct daemon_remote* rc, struct config_file* cfg)
 		log_crypto_err("could not SSL_CTX_new");
 		return 0;
 	}
-	if(!listen_sslctx_setup(rc->ctx, cfg->tls_protocols)) {
+	if(!listen_sslctx_setup(rc->ctx, cfg->tls_use_system_policy_versions)) {
 		return 0;
 	}
 
@@ -307,26 +307,6 @@ add_open(const char* ip, int nr, struct listen_port** list, int noproto_is_err,
 #endif
 		}
 	} else {
-		char* s = strchr(ip, '@');
-		char newif[128];
-		if(s) {
-			/* override port with ifspec@port */
-			int portnr;
-			if((size_t)(s-ip) >= sizeof(newif)) {
-				log_err("ifname too long: %s", ip);
-				return -1;
-			}
-			portnr = atoi(s+1);
-			if(portnr < 0 || 0 == portnr || portnr > 65535) {
-				log_err("invalid portnumber in control-interface: %s", ip);
-				return -1;
-			}
-			(void)strlcpy(newif, ip, sizeof(newif));
-			newif[s-ip] = 0;
-			ip = newif;
-			snprintf(port, sizeof(port), "%d", portnr);
-			port[sizeof(port)-1]=0;
-		}
 		hints.ai_socktype = SOCK_STREAM;
 		hints.ai_flags = AI_PASSIVE | AI_NUMERICHOST;
 		if((r = getaddrinfo(ip, port, &hints, &res)) != 0 || !res) {
@@ -4653,26 +4633,6 @@ fr_init_time(struct timeval* time_start, struct timeval* time_read,
  * are kept in here. They can then be deleted.
  */
 struct fast_reload_construct {
-	/** ssl context for listening to dnstcp over ssl */
-	void* listen_dot_sslctx;
-	/** ssl context for connecting to dnstcp over ssl */
-	void* connect_dot_sslctx;
-	/** ssl context for listening to DoH */
-	void* listen_doh_sslctx;
-	/** ssl context for listening to quic */
-	void* listen_quic_sslctx;
-	/** the file name that the ssl context is made with, private key. */
-	char* ssl_service_key;
-	/** the file name that the ssl context is made with, certificate. */
-	char* ssl_service_pem;
-	/** modification time for ssl_service_key, in sec and ns. Like
-	 * in a struct timespec, but without that for portability. */
-	time_t mtime_ssl_service_key;
-	long mtime_ns_ssl_service_key;
-	/** modification time for ssl_service_pem, in sec and ns. Like
-	 * in a struct timespec, but without that for portability. */
-	time_t mtime_ssl_service_pem;
-	long mtime_ns_ssl_service_pem;
 	/** construct for views */
 	struct views* views;
 	/** construct for auth zones */
@@ -4976,7 +4936,9 @@ fr_check_compat_cfg(struct fast_reload_thread* fr, struct config_file* newcfg)
 	FR_CHECK_CHANGED_CFG("http_notls_downstream", http_notls_downstream, changed_str);
 	FR_CHECK_CHANGED_CFG("https-port", https_port, changed_str);
 	FR_CHECK_CHANGED_CFG("tls-port", ssl_port, changed_str);
-	FR_CHECK_CHANGED_CFG_STR("tls-protocols", tls_protocols, changed_str);
+	FR_CHECK_CHANGED_CFG_STR("tls-service-key", ssl_service_key, changed_str);
+	FR_CHECK_CHANGED_CFG_STR("tls-service-pem", ssl_service_pem, changed_str);
+	FR_CHECK_CHANGED_CFG_STR("tls-cert-bundle", tls_cert_bundle, changed_str);
 	FR_CHECK_CHANGED_CFG_STRLIST("proxy-protocol-port", proxy_protocol_port, changed_str);
 	FR_CHECK_CHANGED_CFG_STRLIST("tls-additional-port", tls_additional_port, changed_str);
 	FR_CHECK_CHANGED_CFG_STR("interface-automatic-ports", if_automatic_ports, changed_str);
@@ -5085,19 +5047,6 @@ fr_construct_clear(struct fast_reload_construct* ct)
 	wait_limits_free(&ct->wait_limits_netblock);
 	wait_limits_free(&ct->wait_limits_cookie_netblock);
 	domain_limits_free(&ct->domain_limits);
-#ifdef HAVE_SSL
-	/* The SSL contexts can be SSL_CTX_free here. It is reference
-	 * counted. So ongoing transfers with can continue.
-	 * Once they are done, the context is freed. */
-	SSL_CTX_free((SSL_CTX*)ct->listen_dot_sslctx);
-	SSL_CTX_free((SSL_CTX*)ct->connect_dot_sslctx);
-	SSL_CTX_free((SSL_CTX*)ct->listen_doh_sslctx);
-#endif /* HAVE_SSL */
-#ifdef HAVE_NGTCP2
-	SSL_CTX_free((SSL_CTX*)ct->listen_quic_sslctx);
-#endif
-	free(ct->ssl_service_key);
-	free(ct->ssl_service_pem);
 	/* Delete the log identity here so that the global value is not
 	 * reset by config_delete. */
 	if(ct->oldcfg && ct->oldcfg->log_identity) {
@@ -5230,7 +5179,6 @@ config_file_getmem(struct config_file* cfg)
 	m += getmem_config_strlist(cfg->tls_session_ticket_keys.first);
 	m += getmem_str(cfg->tls_ciphers);
 	m += getmem_str(cfg->tls_ciphersuites);
-	m += getmem_str(cfg->tls_protocols);
 	m += getmem_str(cfg->http_endpoint);
 	m += (cfg->outgoing_avail_ports?65536*sizeof(int):0);
 	m += getmem_str(cfg->target_fetch_policy);
@@ -5347,8 +5295,6 @@ fr_printmem(struct fast_reload_thread* fr,
 	size_t mem = 0;
 	if(fr_poll_for_quit(fr))
 		return 1;
-	mem += getmem_str(ct->ssl_service_key);
-	mem += getmem_str(ct->ssl_service_pem);
 	mem += views_get_mem(ct->views);
 	mem += respip_set_get_mem(ct->respip_set);
 	mem += auth_zones_get_mem(ct->auth_zones);
@@ -5582,96 +5528,6 @@ auth_zones_check_changes(struct fast_reload_thread* fr,
 	return 1;
 }
 
-/** Check if the sslctxs have changed. */
-static int
-fr_check_sslctx_change(struct fast_reload_thread* fr,
-	struct config_file* newcfg)
-{
-#ifdef HAVE_SSL
-	struct daemon* daemon = fr->worker->daemon;
-	if(newcfg->ssl_service_key && newcfg->ssl_service_key[0]) {
-		if(!daemon->ssl_service_key ||
-			ssl_cert_changed(daemon, newcfg))
-			return 1;
-	} else {
-		if(daemon->ssl_service_key)
-			return 1; /* it is removed */
-	}
-	if((daemon->cfg->tls_cert_bundle && !newcfg->tls_cert_bundle) ||
-	   (!daemon->cfg->tls_cert_bundle && newcfg->tls_cert_bundle) ||
-	   (daemon->cfg->tls_cert_bundle && newcfg->tls_cert_bundle &&
-	    strcmp(daemon->cfg->tls_cert_bundle, newcfg->tls_cert_bundle)!=0))
-		return 1; /* The tls-cert-bundle has changed and return
-			true here makes it reload the connect_dot_sslctx. */
-#else
-	(void)fr; (void)newcfg;
-#endif /* HAVE_SSL */
-	return 0;
-}
-
-/** Create the SSL CTXs when they have changed. */
-static int
-ct_create_sslctxs(struct fast_reload_construct* ct,
-	struct config_file* newcfg, struct daemon* daemon)
-{
-#ifdef HAVE_SSL
-	char* chroot = daemon->chroot;
-	char* key = newcfg->ssl_service_key;
-	char* pem = newcfg->ssl_service_pem;
-
-	if(!(newcfg->ssl_service_key && newcfg->ssl_service_key[0])) {
-		/* Leave listen ctxs and file str at NULL */
-		ct->connect_dot_sslctx = daemon_setup_connect_dot_sslctx(
-			daemon, newcfg);
-		return 1;
-	}
-
-	if(chroot && strncmp(key, chroot, strlen(chroot)) == 0)
-		key += strlen(chroot);
-	if(chroot && pem && strncmp(pem, chroot, strlen(chroot)) == 0)
-		pem += strlen(chroot);
-
-	ct->listen_dot_sslctx = daemon_setup_listen_dot_sslctx(daemon, newcfg);
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-	if(cfg_has_https(newcfg)) {
-		ct->listen_doh_sslctx = daemon_setup_listen_doh_sslctx(
-			daemon, newcfg);
-	}
-#endif
-#ifdef HAVE_NGTCP2
-	if(cfg_has_quic(newcfg)) {
-		ct->listen_quic_sslctx = daemon_setup_listen_quic_sslctx(
-			daemon, newcfg);
-	}
-#endif /* HAVE_NGTCP2 */
-	ct->connect_dot_sslctx = daemon_setup_connect_dot_sslctx(daemon,
-		newcfg);
-
-	/* Store mtime and names */
-	ct->ssl_service_key = strdup(newcfg->ssl_service_key);
-	if(!ct->ssl_service_key) {
-		log_err("ct_create_sslctxs: out of memory");
-		return 0;
-	}
-	ct->ssl_service_pem = strdup(newcfg->ssl_service_pem);
-	if(!ct->ssl_service_pem) {
-		log_err("ct_create_sslctxs: out of memory");
-		return 0;
-	}
-	if(!file_get_mtime(key, &ct->mtime_ssl_service_key,
-		&ct->mtime_ns_ssl_service_key, NULL))
-		log_err("Could not stat(%s): %s",
-			key, strerror(errno));
-	if(!file_get_mtime(pem, &ct->mtime_ssl_service_pem,
-		&ct->mtime_ns_ssl_service_pem, NULL))
-		log_err("Could not stat(%s): %s",
-			pem, strerror(errno));
-#else
-	(void)ct; (void)newcfg; (void)daemon;
-#endif /* HAVE_SSL */
-	return 1;
-}
-
 /** fast reload thread, construct from config the new items */
 static int
 fr_construct_from_config(struct fast_reload_thread* fr,
@@ -5679,13 +5535,6 @@ fr_construct_from_config(struct fast_reload_thread* fr,
 {
 	int have_view_respip_cfg = 0;
 
-	fr->sslctxs_changed = fr_check_sslctx_change(fr, newcfg);
-	if(fr->sslctxs_changed) {
-		if(!ct_create_sslctxs(ct, newcfg, fr->worker->daemon)) {
-			fr_construct_clear(ct);
-			return 0;
-		}
-	}
 	if(!(ct->views = views_create())) {
 		fr_construct_clear(ct);
 		return 0;
@@ -5963,44 +5812,6 @@ auth_zones_swap(struct auth_zones* az, struct auth_zones* data)
 	 * the xfer elements can continue to be their callbacks. */
 }
 
-/** Swap two void* */
-static void
-void_ptr_swap(void** a, void **b)
-{
-	void* tmp = *a;
-	*a = *b;
-	*b = tmp;
-}
-
-/** Swap two char* */
-static void
-char_ptr_swap(char** a, char **b)
-{
-	char* tmp = *a;
-	*a = *b;
-	*b = tmp;
-}
-
-/** Swap and set ssl ctx information */
-static void
-sslctxs_swap(struct daemon* daemon, struct fast_reload_construct* ct)
-{
-	void_ptr_swap(&daemon->listen_dot_sslctx, &ct->listen_dot_sslctx);
-	void_ptr_swap(&daemon->connect_dot_sslctx, &ct->connect_dot_sslctx);
-#ifdef HAVE_NGHTTP2_NGHTTP2_H
-	void_ptr_swap(&daemon->listen_doh_sslctx, &ct->listen_doh_sslctx);
-#endif
-#ifdef HAVE_NGTCP2
-	void_ptr_swap(&daemon->listen_quic_sslctx, &ct->listen_quic_sslctx);
-#endif /* HAVE_NGTCP2 */
-	char_ptr_swap(&daemon->ssl_service_key, &ct->ssl_service_key);
-	char_ptr_swap(&daemon->ssl_service_pem, &ct->ssl_service_pem);
-	daemon->mtime_ssl_service_key = ct->mtime_ssl_service_key;
-	daemon->mtime_ns_ssl_service_key = ct->mtime_ns_ssl_service_key;
-	daemon->mtime_ssl_service_pem = ct->mtime_ssl_service_pem;
-	daemon->mtime_ns_ssl_service_pem = ct->mtime_ns_ssl_service_pem;
-}
-
 #if defined(ATOMIC_POINTER_LOCK_FREE) && defined(HAVE_LINK_ATOMIC_STORE)
 /** Fast reload thread, if atomics are available, copy the config items
  * one by one with atomic store operations. */
@@ -6062,8 +5873,8 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_ptr(tls_session_ticket_keys.last);
 	COPY_VAR_ptr(tls_ciphers);
 	COPY_VAR_ptr(tls_ciphersuites);
-	COPY_VAR_ptr(tls_protocols);
 	COPY_VAR_int(tls_use_sni);
+	COPY_VAR_int(tls_use_system_policy_versions);
 	COPY_VAR_int(https_port);
 	COPY_VAR_ptr(http_endpoint);
 	COPY_VAR_uint32_t(http_max_streams);
@@ -6373,18 +6184,8 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_int(ede);
 	COPY_VAR_int(iter_scrub_ns);
 	COPY_VAR_int(iter_scrub_cname);
-	COPY_VAR_int(iter_scrub_rrsig);
 	COPY_VAR_int(max_global_quota);
 	COPY_VAR_int(iter_scrub_promiscuous);
-
-#undef COPY_VAR_int
-#undef COPY_VAR_ptr
-#undef COPY_VAR_unsigned_int
-#undef COPY_VAR_size_t
-#undef COPY_VAR_uint8_t
-#undef COPY_VAR_uint16_t
-#undef COPY_VAR_uint32_t
-#undef COPY_VAR_int32_t
 }
 #endif /* ATOMIC_POINTER_LOCK_FREE && HAVE_LINK_ATOMIC_STORE */
 
@@ -6610,9 +6411,6 @@ fr_reload_config(struct fast_reload_thread* fr, struct config_file* newcfg,
 	daemon->env->cachedb_enabled = cachedb_is_enabled(&daemon->mods,
 		daemon->env);
 #endif
-	if(fr->sslctxs_changed) {
-		sslctxs_swap(daemon, ct);
-	}
 #ifdef USE_DNSTAP
 	if(env->cfg->dnstap) {
 		if(!fr->fr_nopause)
@@ -6837,8 +6635,6 @@ static void* fast_reload_thread_main(void* arg)
 	struct fast_reload_thread* fast_reload_thread = (struct fast_reload_thread*)arg;
 	struct timeval time_start, time_read, time_construct, time_reload,
 		time_end;
-	const char name[16] = "unbound/freload"; /* seems to be the safest size
-						    between different OSes */
 
 #if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
 	fast_reload_thread->thread_tid = gettid();
@@ -6848,9 +6644,6 @@ static void* fast_reload_thread_main(void* arg)
 #endif
 		log_thread_set(&fast_reload_thread->threadnum);
 
-	ub_thread_setname(fast_reload_thread->tid, name);
-	(void)name; /* When setname is not defined, ignore the name variable. */
-
 	verbose(VERB_ALGO, "start fast reload thread");
 	if(fast_reload_thread->fr_verb >= 1) {
 		fr_init_time(&time_start, &time_read, &time_construct,
@@ -7814,44 +7607,6 @@ fr_worker_pickup_auth_changes(struct worker* worker,
 	}
 }
 
-/** Fast reload, the worker picks up changes in listen_dnsport. */
-static void
-fr_worker_pickup_listen_dnsport(struct worker* worker)
-{
-	struct listen_dnsport* front = worker->front;
-	struct daemon* daemon = worker->daemon;
-	if(worker->daemon->fast_reload_thread->sslctxs_changed) {
-		struct listen_list* ll;
-		void* dot_sslctx = daemon->listen_dot_sslctx;
-		void* doh_sslctx = daemon->listen_doh_sslctx;
-#ifdef HAVE_NGTCP2
-		void* quic_sslctx = daemon->listen_quic_sslctx;
-#endif  /* HAVE_NGTCP2 */
-		for(ll = front->cps; ll; ll = ll->next) {
-			struct comm_point* cp = ll->com;
-			if(cp->type == comm_tcp_accept &&
-				cp->tcp_handlers &&
-				cp->max_tcp_count > 0 &&
-				cp->tcp_handlers[0]->type == comm_http) {
-				if(cp->ssl)
-					cp->ssl = doh_sslctx;
-			} else if(cp->type == comm_tcp_accept) {
-				if(cp->ssl)
-					cp->ssl = dot_sslctx;
-#ifdef HAVE_NGTCP2
-			} else if(cp->type == comm_doq) {
-				if(cp->ssl) {
-					cp->ssl = quic_sslctx;
-					if(cp->doq_socket)
-						cp->doq_socket->ctx =
-							(SSL_CTX*)quic_sslctx;
-				}
-#endif  /* HAVE_NGTCP2 */
-			}
-		}
-	}
-}
-
 /** Fast reload, the worker picks up changes in outside_network. */
 static void
 fr_worker_pickup_outside_network(struct worker* worker)
@@ -7867,8 +7622,6 @@ fr_worker_pickup_outside_network(struct worker* worker)
 	outnet->tcp_reuse_timeout = cfg->tcp_reuse_timeout;
 	outnet->tcp_auth_query_timeout = cfg->tcp_auth_query_timeout;
 	outnet->delayclose = cfg->delay_close;
-	if(worker->daemon->fast_reload_thread->sslctxs_changed)
-		outnet->sslctx = worker->daemon->connect_dot_sslctx;
 	if(outnet->delayclose) {
 #ifndef S_SPLINT_S
 		outnet->delay_tv.tv_sec = cfg->delay_close/1000;
@@ -7939,7 +7692,6 @@ fast_reload_worker_pickup_changes(struct worker* worker)
 #ifdef USE_CACHEDB
 	worker->env.cachedb_enabled = worker->daemon->env->cachedb_enabled;
 #endif
-	fr_worker_pickup_listen_dnsport(worker);
 	fr_worker_pickup_outside_network(worker);
 #ifdef USE_DNSTAP
 	fr_worker_pickup_dnstap_changes(worker);

daemon/remote.h

@@ -255,8 +255,6 @@ struct fast_reload_thread {
 	struct fast_reload_auth_change* auth_zone_change_list;
 	/** the old tree of auth zones, to lookup. */
 	struct auth_zones* old_auth_zones;
-	/** If the ssl ctxs have changed. */
-	int sslctxs_changed;
 };
 
 /**

daemon/unbound.c

@@ -463,13 +463,57 @@ detach(void)
 #endif /* HAVE_DAEMON */
 }
 
-/** setup the remote and ticket keys */
+#ifdef HAVE_SSL
+/* setup a listening ssl context, fatal_exit() on any failure */
 static void
-setup_sslctx_remote(struct daemon* daemon, struct config_file* cfg)
+setup_listen_sslctx(void** ctx, int is_dot, int is_doh, struct config_file* cfg)
+{
+	if(!(*ctx = listen_sslctx_create(
+		cfg->ssl_service_key, cfg->ssl_service_pem, NULL,
+		cfg->tls_ciphers, cfg->tls_ciphersuites,
+		(cfg->tls_session_ticket_keys.first &&
+		cfg->tls_session_ticket_keys.first->str[0] != 0),
+		is_dot, is_doh, cfg->tls_use_system_policy_versions))) {
+		fatal_exit("could not set up listen SSL_CTX");
+	}
+}
+#endif /* HAVE_SSL */
+
+/* setups the needed ssl contexts, fatal_exit() on any failure */
+static void
+setup_sslctxs(struct daemon* daemon, struct config_file* cfg)
 {
 #ifdef HAVE_SSL
 	if(!(daemon->rc = daemon_remote_create(cfg)))
 		fatal_exit("could not set up remote-control");
+	if(cfg->ssl_service_key && cfg->ssl_service_key[0]) {
+		/* setup the session keys; the callback to use them will be
+		 * attached to each sslctx separately */
+		if(cfg->tls_session_ticket_keys.first &&
+			cfg->tls_session_ticket_keys.first->str[0] != 0) {
+			if(!listen_sslctx_setup_ticket_keys(
+				cfg->tls_session_ticket_keys.first)) {
+				fatal_exit("could not set session ticket SSL_CTX");
+			}
+		}
+		(void)setup_listen_sslctx(&daemon->listen_dot_sslctx, 1, 0, cfg);
+#ifdef HAVE_NGHTTP2_NGHTTP2_H
+		if(cfg_has_https(cfg)) {
+			(void)setup_listen_sslctx(&daemon->listen_doh_sslctx, 0, 1, cfg);
+		}
+#endif
+#ifdef HAVE_NGTCP2
+		if(cfg_has_quic(cfg)) {
+			if(!(daemon->listen_quic_sslctx = quic_sslctx_create(
+				cfg->ssl_service_key, cfg->ssl_service_pem, NULL))) {
+				fatal_exit("could not set up quic SSL_CTX");
+			}
+		}
+#endif /* HAVE_NGTCP2 */
+	}
+	if(!(daemon->connect_dot_sslctx = connect_sslctx_create(NULL, NULL,
+		cfg->tls_cert_bundle, cfg->tls_win_cert)))
+		fatal_exit("could not set up connect SSL_CTX");
 #else /* HAVE_SSL */
 	(void)daemon;(void)cfg;
 #endif /* HAVE_SSL */
@@ -501,8 +545,7 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 #endif
 
 	/* read ssl keys while superuser and outside chroot */
-	setup_sslctx_remote(daemon, cfg);
-	daemon_setup_sslctxs(daemon, cfg);
+	(void)setup_sslctxs(daemon, cfg);
 
 	/* init syslog (as root) if needed, before daemonize, otherwise
 	 * a fork error could not be printed since daemonize closed stderr.*/

daemon/worker.c

@@ -255,8 +255,7 @@ worker_handle_service_reply(struct comm_point* c, void* arg, int error,
 		return 0;
 	}
 	/* sanity check. */
-	if(sldns_buffer_limit(c->buffer) < LDNS_HEADER_SIZE
-		|| !LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
+	if(!LDNS_QR_WIRE(sldns_buffer_begin(c->buffer))
 		|| LDNS_OPCODE_WIRE(sldns_buffer_begin(c->buffer)) !=
 			LDNS_PACKET_QUERY
 		|| LDNS_QDCOUNT(sldns_buffer_begin(c->buffer)) > 1) {
@@ -293,44 +292,6 @@ worker_err_ratelimit(struct worker* worker, int err)
 	return err;
 }
 
-/**
- * Reply with an error.
- * This reply includes the qname if it has been parsed.
- * For error ratelimiting, the err ratelimit routine should be checked
- * beforehand. The reply is without EDNS, and copies RD and sets QR flag.
- * @param pkt: the packet buffer from the comm point.
- * @param err: the error code that would be wanted.
- * @param qname_len: 0 if not parsed, and the qname length in packet.
- */
-static void
-query_error(sldns_buffer* pkt, int err, size_t qname_len)
-{
-	/* Preserve the RD flag.
-	 * The CD flag must be cleared in authoritative answers,
-	 * also the AD flag need not be copied into answers.
-	 * The other flags need not be copied into the answer. */
-	sldns_buffer_write_u16_at(pkt, 2,
-		sldns_buffer_read_u16_at(pkt, 2)&0x0100U);
-	LDNS_QR_SET(sldns_buffer_begin(pkt)); /* Set QR flag. */
-	LDNS_RCODE_SET(sldns_buffer_begin(pkt), err); /* Set rcode */
-
-	if(qname_len && LDNS_QDCOUNT(sldns_buffer_begin(pkt))>=1 &&
-		qname_len <= LDNS_MAX_DOMAINLEN) {
-		/* Copy query into the answer. */
-		LDNS_QDCOUNT_SET(sldns_buffer_begin(pkt), 1);
-		sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE +
-			qname_len + 2 /* type */ + 2 /* class */ );
-	} else {
-		/* No query section in answer. */
-		LDNS_QDCOUNT_SET(sldns_buffer_begin(pkt), 0);
-		sldns_buffer_set_position(pkt, LDNS_HEADER_SIZE);
-	}
-	LDNS_ANCOUNT_SET(sldns_buffer_begin(pkt), 0);
-	LDNS_NSCOUNT_SET(sldns_buffer_begin(pkt), 0);
-	LDNS_ARCOUNT_SET(sldns_buffer_begin(pkt), 0);
-	sldns_buffer_flip(pkt);
-}
-
 /**
  * Structure holding the result of the worker_check_request function.
  * Based on configuration it could be called up to four times; ideally should
@@ -368,6 +329,7 @@ worker_check_request(sldns_buffer* pkt, struct worker* worker,
 		return;
 	}
 	if(LDNS_TC_WIRE(sldns_buffer_begin(pkt))) {
+		LDNS_TC_CLR(sldns_buffer_begin(pkt));
 		verbose(VERB_QUERY, "request bad, has TC bit on");
 		out->value = worker_err_ratelimit(worker, LDNS_RCODE_FORMERR);
 		return;
@@ -1009,7 +971,6 @@ chaos_replystr(sldns_buffer* pkt, char** str, int num, struct edns_data* edns,
 	size_t udpsize = edns->udp_size;
 	edns->edns_version = EDNS_ADVERTISED_VERSION;
 	edns->udp_size = EDNS_ADVERTISED_SIZE;
-	edns->ext_rcode = 0;
 	edns->bits &= EDNS_DO;
 	if(!inplace_cb_reply_local_call(&worker->env, NULL, NULL, NULL,
 		LDNS_RCODE_NOERROR, edns, repinfo, worker->scratchpad,
@@ -1268,7 +1229,9 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		worker_check_request(c->buffer, worker, check_result);
 		if(check_result->value != 0) {
 			if(check_result->value != -1) {
-				query_error(c->buffer, check_result->value, 0);
+				LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+					check_result->value);
 				return 1;
 			}
 			comm_point_drop_reply(repinfo);
@@ -1285,17 +1248,41 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 		/* check additional section is present and that we respond with EDEs */
 		if(LDNS_ARCOUNT(sldns_buffer_begin(c->buffer)) != 1
 			|| !ede) {
-			query_error(c->buffer, LDNS_RCODE_REFUSED, 0);
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				LDNS_RCODE_REFUSED);
+			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 
 		if (!query_dname_len(c->buffer)) {
-			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				LDNS_RCODE_FORMERR);
+			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 		/* space available for query type and class? */
 		if (sldns_buffer_remaining(c->buffer) < 2 * sizeof(uint16_t)) {
-			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+                        LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+                        LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				 LDNS_RCODE_FORMERR);
+			LDNS_QDCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+                        sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
@@ -1317,27 +1304,35 @@ deny_refuse(struct comm_point* c, enum acl_access acl,
 			if(!skip_pkt_rrs(c->buffer,
 				((int)LDNS_ANCOUNT(sldns_buffer_begin(c->buffer)))+
 				((int)LDNS_NSCOUNT(sldns_buffer_begin(c->buffer))))) {
-				query_error(c->buffer, LDNS_RCODE_FORMERR,
-					opt_rr_mark - LDNS_HEADER_SIZE
-					- 2 /* qtype */ - 2 /* qclass */);
+				LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+					LDNS_RCODE_FORMERR);
+				LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+				LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+				LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+				sldns_buffer_set_position(c->buffer, opt_rr_mark);
+				sldns_buffer_flip(c->buffer);
 				return 1;
 			}
 		}
 		/* Do we have a valid OPT RR here? If not return REFUSED (could be a valid TSIG or something so no FORMERR) */
 		/* domain name must be the root of length 1. */
 		if(sldns_buffer_remaining(c->buffer) < 1 || *sldns_buffer_current(c->buffer) != 0) {
-			query_error(c->buffer, LDNS_RCODE_REFUSED,
-				opt_rr_mark - LDNS_HEADER_SIZE
-				- 2 /* qtype */ - 2 /* qclass */);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, opt_rr_mark);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		} else {
 			sldns_buffer_skip(c->buffer, 1); /* skip root label */
 		}
 		if(sldns_buffer_remaining(c->buffer) < 2 ||
 			sldns_buffer_read_u16(c->buffer) != LDNS_RR_TYPE_OPT) {
-			query_error(c->buffer, LDNS_RCODE_REFUSED,
-				opt_rr_mark - LDNS_HEADER_SIZE
-				- 2 /* qtype */ - 2 /* qclass */);
+			LDNS_ANCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_NSCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			LDNS_ARCOUNT_SET(sldns_buffer_begin(c->buffer), 0);
+			sldns_buffer_set_position(c->buffer, opt_rr_mark);
+			sldns_buffer_flip(c->buffer);
 			return 1;
 		}
 		/* Write OPT RR directly after the query,
@@ -1533,10 +1528,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				"dnscrypt: worker check request: bad query.");
 			log_addr(VERB_CLIENT,"from",&repinfo->client_addr,
 				repinfo->client_addrlen);
-			if(check_result.value != -1) {
-				query_error(c->buffer, check_result.value, 0);
-				return 1;
-			}
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
@@ -1545,12 +1536,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				"dnscrypt: worker parse request: formerror.");
 			log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 				repinfo->client_addrlen);
-			if(worker_err_ratelimit(worker, LDNS_RCODE_FORMERR) == -1) {
-				comm_point_drop_reply(repinfo);
-				return 0;
-			}
-			query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
-			return 1;
+			comm_point_drop_reply(repinfo);
+			return 0;
 		}
 		dname_str(qinfo.qname, buf);
 		if(!(qinfo.qtype == LDNS_RR_TYPE_TXT &&
@@ -1561,14 +1548,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 				worker->daemon->dnscenv->provider_name,
 				sldns_rr_descript(qinfo.qtype)->_name,
 				buf);
-			if(worker_err_ratelimit(worker, LDNS_RCODE_SERVFAIL) == -1) {
-				comm_point_drop_reply(repinfo);
-				return 0;
-			}
-			query_error(c->buffer, LDNS_RCODE_SERVFAIL,
-				qinfo.qname_len);
+			comm_point_drop_reply(repinfo);
 			worker->stats.num_query_dnscrypt_cleartext++;
-			return 1;
+			return 0;
 		}
 		worker->stats.num_query_dnscrypt_cert++;
 		sldns_buffer_rewind(c->buffer);
@@ -1608,7 +1590,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker check request: bad query.");
 		log_addr(VERB_CLIENT,"from",&repinfo->client_addr, repinfo->client_addrlen);
 		if(check_result.value != -1) {
-			query_error(c->buffer, check_result.value, 0);
+			LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+			LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+				check_result.value);
 			return 1;
 		}
 		comm_point_drop_reply(repinfo);
@@ -1642,7 +1626,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		query_error(c->buffer, LDNS_RCODE_FORMERR, 0);
+		sldns_buffer_rewind(c->buffer);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_FORMERR);
 		goto send_reply;
 	}
 	if(worker->env.cfg->log_queries) {
@@ -1655,11 +1642,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker request: refused zone transfer.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
-			comm_point_drop_reply(repinfo);
-			return 0;
-		}
-		query_error(c->buffer, LDNS_RCODE_REFUSED, qinfo.qname_len);
+		sldns_buffer_rewind(c->buffer);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_REFUSED);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
 		}
@@ -1678,7 +1664,10 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			comm_point_drop_reply(repinfo);
 			return 0;
 		}
-		query_error(c->buffer, LDNS_RCODE_FORMERR, qinfo.qname_len);
+		sldns_buffer_rewind(c->buffer);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_FORMERR);
 		if(worker->stats.extended) {
 			worker->stats.qtype[qinfo.qtype]++;
 		}
@@ -1686,17 +1675,13 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}
 	if((ret=parse_edns_from_query_pkt(
 			c->buffer, &edns, worker->env.cfg, c, repinfo,
-			*worker->env.now, worker->scratchpad,
+			(worker->env.now ? *worker->env.now : time(NULL)),
+			worker->scratchpad,
 			worker->daemon->cookie_secrets)) != 0) {
 		struct edns_data reply_edns;
 		verbose(VERB_ALGO, "worker parse edns: formerror.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		if(worker_err_ratelimit(worker, ret) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		memset(&reply_edns, 0, sizeof(reply_edns));
 		reply_edns.edns_present = 1;
 		error_encode(c->buffer, ret, &qinfo,
@@ -1713,11 +1698,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			verbose(VERB_ALGO, "query with bad edns version.");
 			log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 				repinfo->client_addrlen);
-			if(worker_err_ratelimit(worker, EDNS_RCODE_BADVERS) == -1) {
-				comm_point_drop_reply(repinfo);
-				regional_free_all(worker->scratchpad);
-				return 0;
-			}
 			extended_error_encode(c->buffer, EDNS_RCODE_BADVERS, &qinfo,
 				*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 				sldns_buffer_read_u16_at(c->buffer, 2), 0, &edns);
@@ -1763,11 +1743,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 
 	else if(edns.cookie_present) {
 		/* Cookie present, but not valid: Cookie was bad! */
-		if(worker_err_ratelimit(worker, LDNS_EXT_RCODE_BADCOOKIE) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		extended_error_encode(c->buffer,
 			LDNS_EXT_RCODE_BADCOOKIE, &qinfo,
 			*(uint16_t*)(void *)
@@ -1782,11 +1757,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			"need cookie or stateful transport");
 		log_addr(VERB_ALGO, "from",&repinfo->remote_addr
 		                          , repinfo->remote_addrlen);
-		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
 			worker->scratchpad, LDNS_EDE_OTHER,
 			"DNS Cookie needed for UDP replies");
@@ -1813,14 +1783,14 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		verbose(VERB_ALGO, "worker request: edns is too small.");
 		log_addr(VERB_CLIENT, "from", &repinfo->client_addr,
 			repinfo->client_addrlen);
-		if(worker_err_ratelimit(worker, LDNS_RCODE_SERVFAIL) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
-		/* A small error without qname, and TC flag on. */
-		query_error(c->buffer, LDNS_RCODE_SERVFAIL, 0);
+		LDNS_QR_SET(sldns_buffer_begin(c->buffer));
 		LDNS_TC_SET(sldns_buffer_begin(c->buffer));
+		LDNS_RCODE_SET(sldns_buffer_begin(c->buffer),
+			LDNS_RCODE_SERVFAIL);
+		sldns_buffer_set_position(c->buffer, LDNS_HEADER_SIZE);
+		sldns_buffer_write_at(c->buffer, 4,
+			(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
+		sldns_buffer_flip(c->buffer);
 		regional_free_all(worker->scratchpad);
 		goto send_reply;
 	}
@@ -1905,15 +1875,6 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	 * ACLs allow the snooping. */
 	if(!(LDNS_RD_WIRE(sldns_buffer_begin(c->buffer))) &&
 		acl != acl_allow_snoop ) {
-		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
-			&repinfo->client_addr, repinfo->client_addrlen);
-		/* This ratelimited error query is accounted in the stats,
-		 * as an incoming query. */
-		if(worker_err_ratelimit(worker, LDNS_RCODE_REFUSED) == -1) {
-			comm_point_drop_reply(repinfo);
-			regional_free_all(worker->scratchpad);
-			return 0;
-		}
 		if(worker->env.cfg->ede) {
 			EDNS_OPT_LIST_APPEND_EDE(&edns.opt_list_out,
 				worker->scratchpad, LDNS_EDE_NOT_AUTHORITATIVE, "");
@@ -1922,6 +1883,9 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 			sldns_buffer_read_u16_at(c->buffer, 2), &edns);
 		regional_free_all(worker->scratchpad);
+		log_addr(VERB_ALGO, "refused nonrec (cache snoop) query from",
+			&repinfo->client_addr, repinfo->client_addrlen);
+
 		goto send_reply;
 	}
 
@@ -2160,37 +2124,10 @@ worker_restart_timer(struct worker* worker)
 {
 	if(worker->env.cfg->stat_interval > 0) {
 		struct timeval tv;
-		if(worker->daemon->stat_time_specific) {
-			struct timeval dest, now;
-			int interval = worker->env.cfg->stat_interval;
-			int offset = worker->daemon->stat_time_offset;
-			int nows, spec;
-			if(gettimeofday(&now, NULL) < 0)
-				log_err("gettimeofday: %s", strerror(errno));
 #ifndef S_SPLINT_S
-			nows = (int)now.tv_sec;
-			/* The next time is on the timer interval, at the
-			 * specific offset, time value % interval = offset. */
-			/* It relies on the integer division below to drop the
-			 * remainder in order to calculate the expected
-			 * result. */
-			spec = ((nows-offset)/interval+1)*interval+offset;
-			/* This is instead of an assertion, and should not
-			 * be needed. So assert(spec > nows), tv is going to
-			 * be positive. */
-			if(spec<=nows) spec += interval;
-			dest.tv_sec = spec;
-			dest.tv_usec = 0;
+		tv.tv_sec = worker->env.cfg->stat_interval;
+		tv.tv_usec = 0;
 #endif
-			/* Subtract in timeval, so the fractions of a second
-			 * are rounded to the whole specific time. */
-			timeval_subtract(&tv, &dest, &now);
-		} else {
-#ifndef S_SPLINT_S
-			tv.tv_sec = worker->env.cfg->stat_interval;
-			tv.tv_usec = 0;
-#endif
-		}
 		comm_timer_set(worker->stat_timer, &tv);
 	}
 }

dnstap/dtstream.c

@@ -2133,8 +2133,6 @@ static void* dnstap_io(void* arg)
 	struct dt_io_thread* dtio = (struct dt_io_thread*)arg;
 	time_t secs = 0;
 	struct timeval now;
-	const char name[16] = "unbound/dnstap"; /* seems to be the safest size
-						   between different OSes */
 
 #if defined(HAVE_GETTID) && !defined(THREADS_DISABLED)
 	dtio->thread_tid = gettid();
@@ -2144,8 +2142,6 @@ static void* dnstap_io(void* arg)
 #endif
 		log_thread_set(&dtio->threadnum);
 
-	ub_thread_setname(dtio->tid, name);
-
 	/* setup */
 	verbose(VERB_ALGO, "start dnstap io thread");
 	dtio_setup_base(dtio, &secs, &now);

dnstap/unbound-dnstap-socket.c

@@ -330,7 +330,7 @@ static struct tap_socket* tap_socket_new_tcpaccept(char* ip,
 /** create new socket (unconnected, not base-added), or NULL malloc fail */
 static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	void (*ev_cb)(int, short, void*), void* data, char* server_key,
-	char* server_cert, char* verifypem, char* tls_protocols)
+	char* server_cert, char* verifypem)
 {
 	struct tap_socket* s = calloc(1, sizeof(*s));
 	if(!s) {
@@ -347,7 +347,7 @@ static struct tap_socket* tap_socket_new_tlsaccept(char* ip,
 	s->ev_cb = ev_cb;
 	s->data = data;
 	s->sslctx = listen_sslctx_create(server_key, server_cert, verifypem,
-		NULL, NULL, 0, 0, 0, tls_protocols);
+		NULL, NULL, 0, 0, 0, 0);
 	if(!s->sslctx) {
 		log_err("could not create ssl context");
 		free(s->ip);
@@ -1261,13 +1261,13 @@ static void setup_tcp_list(struct main_tap_data* maindata,
 /** setup tls accept sockets */
 static void setup_tls_list(struct main_tap_data* maindata,
 	struct config_strlist_head* tls_list, char* server_key,
-	char* server_cert, char* verifypem, char* tls_protocols)
+	char* server_cert, char* verifypem)
 {
 	struct config_strlist* item;
 	for(item = tls_list->first; item; item = item->next) {
 		struct tap_socket* s;
 		s = tap_socket_new_tlsaccept(item->str, &dtio_mainfdcallback,
-			maindata, server_key, server_cert, verifypem, tls_protocols);
+			maindata, server_key, server_cert, verifypem);
 		if(!s) fatal_exit("out of memory");
 		if(!tap_socket_list_insert(&maindata->acceptlist, s))
 			fatal_exit("out of memory");
@@ -1300,7 +1300,7 @@ static void
 setup_and_run(struct config_strlist_head* local_list,
 	struct config_strlist_head* tcp_list,
 	struct config_strlist_head* tls_list, char* server_key,
-	char* server_cert, char* verifypem, char* tls_protocols)
+	char* server_cert, char* verifypem)
 {
 	time_t secs = 0;
 	struct timeval now;
@@ -1326,7 +1326,7 @@ setup_and_run(struct config_strlist_head* local_list,
 	setup_local_list(maindata, local_list);
 	setup_tcp_list(maindata, tcp_list);
 	setup_tls_list(maindata, tls_list, server_key, server_cert,
-		verifypem, tls_protocols);
+		verifypem);
 	if(!tap_socket_list_addevs(maindata->acceptlist, base))
 		fatal_exit("could not setup accept events");
 	if(verbosity) log_info("start of service");
@@ -1462,8 +1462,6 @@ int main(int argc, char** argv)
 	struct config_strlist_head tcp_list;
 	struct config_strlist_head tls_list;
 	char* server_key = NULL, *server_cert = NULL, *verifypem = NULL;
-
-	char* tls_protocols = "TLSv1.2 TLSv1.3";
 #ifdef USE_WINSOCK
 	WSADATA wsa_data;
 	if(WSAStartup(MAKEWORD(2,2), &wsa_data) != 0) {
@@ -1563,25 +1561,17 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 #endif /* HAVE_SSL */
 	}
 	setup_and_run(&local_list, &tcp_list, &tls_list, server_key,
-		server_cert, verifypem, tls_protocols);
+		server_cert, verifypem);
 	config_delstrlist(local_list.first);
 	config_delstrlist(tcp_list.first);
 	config_delstrlist(tls_list.first);

doc/Changelog

@@ -1,263 +1,3 @@
-23 April 2026: Wouter
-	- Merge #1441: Fix buffer overrun in
-	  doq_repinfo_retrieve_localaddr().
-	- For #1441: Fix type of ipv6 addr struct.
-
-21 April 2026: Wouter
-	- Add test case for malformed SVCB records. Thanks to
-	  Qifan Zhang, Palo Alto Networks for the additional test.
-	- Fix for the Jiggle Attack. The server is fixed to answer
-	  with errors for error cases, and does not stay silent.
-	  In addition, the error replies do not contain parts of the
-	  incoming query. This is more conformant, stops reflection
-	  and stops it as a covert channel. Thanks to Yuqi Qiu and
-	  Xiang Li, Nankai University (AOSP Lab) for the report.
-	  In addition, thanks to Qifan Zhang, Palo Alto Networks, for
-	  noting the fingerprinting possibility, that is also fixed
-	  with this.
-	- Fix EDNS extended RCODE reflection. This fixes that
-	  the server does not echo extended rcode values after class
-	  chaos queries. Thanks to Qifan Zhang, Palo Alto Networks
-	  for the report.
-	- Fix for iterator RCODE handling of YXDOMAIN. This fixes
-	  that the server only accepts YXDOMAIN answers that contain
-	  a DNAME record. This stops bad answers, and checks that
-	  the authoritative server gives correct replies.
-	  Thanks to Qifan Zhang, Palo Alto Networks for the report.
-	- Fix for missing bounds check for decompressing dnames
-	  for downloaded authority zones. This fixes that the server
-	  could end up with malformed zone content after receiving
-	  truncated packet contents from an AXFR. In addition, the
-	  domain names in the SOA rdata are checked before the
-	  authority code picks up the zone serial.
-	  Thanks to Halil Oktay for the report.
-	- Fix that upstream TLS connections are not reused as TLS
-	  connections for a different name, at the same IP. This
-	  checks that the tls name is correct when reusing the
-	  upstream connections. Thanks to TaoFei Guo from Peking
-	  University and JianJun Chen from Tsinghua University for
-	  the report.
-	- Fix that signatures are not allowed with revoked dnskeys.
-	  Thanks to Qifan Zhang, Palo Alto Networks for the report.
-	- Fix that a DNAME with an unsigned CNAME is checked for
-	  the correct match. This stops that for certain zone
-	  configurations an unchecked unsigned CNAME could get
-	  secure status. Thanks to Qifan Zhang, Palo Alto Networks
-	  for the report.
-	- Fix handling of wildcard CNAMEs in the chain of trust.
-	  An improper wildcard in the chain of trust would send
-	  the retries to the wrong upstream. Also it could label
-	  the step in the chain of trust as secure, when it was not.
-	  Thanks to Qifan Zhang, Palo Alto Networks for the report.
-	- Set version number to 1.25.0 of code repository.
-	- Fix doxygen comment syntax.
-
-20 April 2026: Wouter
-	- Fix compile warnings for thread setname routine, and test compile.
-	- Fix unused variable warning when compiled without ssl.
-	- Fix test with https zone for libressl.
-
-17 April 2026: Wouter
-	- Fix setup of ssl context copy of the tls service pem option,
-	  from a clang analyzer warning.
-	- Fix setup of ssl context copy, to check for the tls service
-	  pem option for stat calls.
-	- Fix to compile the shm code when there is no shmget.
-	- Update github ci to use actions/checkout@v6.
-	- Update github ci cross platform to use
-	  cross-platform-actions/action@v1.0.0.
-	- Fix github ci to speed up with parralel build, for windows ci.
-	- Fix compat/chacha_private sigma and tau definitions to use
-	  nonstring attribute.
-	- Fix compat/gmtime_r old style definition syntax.
-	- Fix to increase size of the buffer for the win_svc reportev log
-	  function.
-	- Fix ttl comparisons in rdata_copy for 32bit signed or unsigned.
-	- Fix subnet store of servfail to not leak memory.
-	- Update generated man pages.
-	- Update generated configure, with autoconf.
-	- Fix pthread_setname detection to fail on warnings.
-
-17 April 2026: Yorgos
-	- Merge #1400: Support pthread_setname_np. Adds support for
-	  pthread_setname_np and variants to set the name on spawned threads
-	  for easier debugging/monitoring.
-
-16 April 2026: Yorgos
-	- Merge #1406: Introduce new 'tls-protocols' configuration option.
-	- Introduce new 'tls-protocols' configuration option that specifies
-	  which of the supported TLS protocols will be used.
-	  This change invalidates some previous changes:
-	- TLSv1.2 is again enabled by default, but can be selectively turned
-	  off if desired (related to #1303).
-	- The biefly introduced (not yet released) 'tls-use-system-versions'
-	  configuration option, that addressed #1346, is reverted in favor of
-	  'tls-protocols'.
-	- The briefly introduced (not yet released) '--enable-system-tls'
-	  configure option, related to #1401, is no longer needed with the new
-	  option and the current default.
-	- Fix cleaning up DoH session. The same query can be on multiple
-	  streams in a session.
-
-16 April 2026: Wouter
-	- Fix configure, autoconf for #1406.
-
-15 April 2026: Wouter
-	- Fix RFC7766 compliance when client sends EOF over TCP. It stops
-	  pending replies and closes. Thanks to Yuxiao Wu, Tsinghua
-	  University for the report.
-	- Fix to shorten RRSIG count in scrubber, this protects against
-	  an overly large number of RRSIGs. It can be configured with
-	  `iter-scrub-rrsig: 8`, it has default 8. Thanks to Yuxiao Wu,
-	  Tsinghua University for the report.
-
-14 April 2026: Wouter
-	- Fix #1017: memory corruption related core dumps.
-	  When alloc_reg_obtain has an empty list, return a new allocation.
-	- Fix clang analyzer warning for subnetmod, when return_msg is
-	  NULL for update cache, like when it stores servfail status.
-	- iana portlist updated.
-
-13 April 2026: Yorgos
-	- Update the documentation of 'max-query-restarts' in the man page.
-
-10 April 2026: Wouter
-	- Fix for EDNS client subnet so that it does not store SERVFAIL in
-	  the global cache after a failed lookup, such as timeouts. A failure
-	  entry is stored in the subnet cache, for the query name, for a
-	  couple of seconds. Queries can continue to use the subnet cache
-	  during that time.
-
-7 April 2026: Yorgos
-	- Fix unused variable warning.
-
-30 March 2026: Wouter
-	- Merge #1408: Fix shared memory stats with threads.
-
-27 March 2026: Wouter
-	- Fix to allow the control-interface config to use ip@port notation.
-	- Fix test code to allow empty hex answer packets from testbound.
-	- Fix defense in depth for service callback with empty packet.
-
-24 March 2026: Wouter
-	- Fix to check for invalid http content length and chunk size,
-	  and to check the RR rdata field lengths when decompressing and
-	  inserting RRs from an authority zone transfer. This stops
-	  large memory use and heap buffer-overflow read errors. Thanks
-	  to Haruto Kimura (Stella) for the report.
-
-20 March 2026: Wouter
-	- Fix for testcode pktview to check buffer size and log errors.
-
-13 March 2026: Yorgos
-	- Fix to ignore out-of-zone DNAME records for CNAME synthesis. Thanks
-	  to Yuxiao Wu, Yiyi Wang, Zhang Chao, Baojun Liu, and Haixin Duan from
-	  Tsinghua University.
-
-13 March 2026: Wouter
-	- Fix #278: DoT: complete unbound restart required on certificate
-	  renew. Fix so that a reload checks if the files have changed, and
-	  if so, reload the contexts. Also for DoH, DoQ and outgoing DoT.
-	- iana portlist updated.
-	- For #278: fast_reload can reload tls-service-key, tls-service-pem
-	  and tls-cert-bundle changes. It checks the modification time of
-	  the tls-service-key and tls-service-pem files for update.
-	- Fix detection of http listening port in fast_reload.
-	- Fix to add tls-service-key to memory printout for fast_reload.
-
-9 March 2026: Wouter
-	- Fix compile failure in unbound-checkconf for older gcc compiler.
-	- Merge #1418: Apply cache TTL policy to DNAME and synthesized
-	  CNAME on wire path.
-
-6 March 2026: Wouter
-	- Merge #1415: Add lock unlock for view in memory error handling.
-
-6 March 2026: Yorgos
-	- Document the suggestion for a higher value for 'outgoing-range';
-	  helps when the request list is full.
-	- Warn for unused 'nodefault' local-zone configuration in
-	  unbound-checkconf (related to #1416).
-
-5 March 2026: Wouter
-	- Fix for DNS Rebinding Bypass via SVCB/HTTPS Records in Unbound.
-	  Thanks to Kunta Chu, School of Software, Tsinghua University,
-	  Taofei Guo, Peking University, and Jianjun Chen, Institute for
-	  Network Sciences and Cyberspace, Tsinghua University for the
-	  report. The private-address option is fixed to also elide
-	  SVCB and HTTPS records that match the filter.
-	- Update generated man pages.
-
-4 March 2026: Yorgos
-	- For #1411: Introduce a failing case in the rpl test so that it only
-	  passes with the fix in place.
-
-3 March 2026: Wouter
-	- Merge #1411: Allow synthesized DNAME TTL=0 to be served from cache
-	  within grace period. The responses are served from cache within
-	  a 1-second grace period. Reduces recursion when authoritative
-	  servers return DNAME with TTL=0 (RFC 2308). Response
-	  still returns TTL=0 to clients. Adds a test for it.
-	- For #1411: Fix that the lookup for DNAME uses flag. Fix assertion
-	  in expired calc debug routine.
-
-27 February 2026: Wouter
-	- Merge #1409: Documentation CNAME in redirect-type local-zone.
-	- Update generated man pages.
-
-25 February 2026: Wouter
-	- Fix validator to set unchecked when validation recursion
-	  requests are passed. The edns subnet module checks if validation
-	  is needed for a cache response, and set the validator to protect
-	  the cache with validation for non-subnet lookups.
-
-23 February 2026: Wouter
-	- Fix to have cachedb not return expired bogus data as non-bogus.
-	- Fix to make the cachedb_val_expired.crpl succeed.
-
-23 February 2026: Yorgos
-	- Fix to disallow cache lookup/store in external cachedb when a
-	  forwarder/stub forbids it with the no-cache option.
-	- Fixed some typos reported in #1395 by rezky_nightky.
-
-17 February 2026: Wouter
-	- Fix to remove unused conditional from cookie timestamp at
-	  worker env.
-	- For #1405: local-zone always_refuse also blocks queries of type DS.
-
-16 February 2026: Yorgos
-	- Fix #1404: Priming the root key fails after loading ipfire.org RPZ
-	  zones. Fixed by including the ZONEMD RRtype in the list of types to
-	  ignore for RPZ zones. Analysis and patch provided by ummeegge.
-
-16 February 2026: Wouter
-	- Fix that cachedb aggressive negative responses have the RA flag set.
-
-11 February 2026: Wouter
-	- Fix #1403: Inconsistency between do-nat64 and do-not-query-address
-	  during retries.
-
-9 February 2026: Wouter
-	- Merge #1401: Add a new build-time option for system TLS.
-	  The --enable-system-tls flag enables the
-	  tls-use-system-policy-versions setting by default.
-	- Update generated man pages.
-
-6 February 2026: Yorgos
-	- Fix #1389: [FR] replacement with ECC-GOST12 according to RFC9558.
-	  Patch contributed by Igor V. Ruzanov, available in
-	  contrib/gost12.patch.
-
-4 February 2026: Wouter
-	- Fix local privilege escalation on Windows. Thanks to Hao Huang and
-	  CrisprXiang with Fudan University for the report. The OpenSSL
-	  init calls are set to not load the openssl.cnf file when compiled
-	  for Windows.
-
-3 February 2026: Yorgos
-	- Eagerly remove .skip mark files in between mini_tdir.sh runs in case
-	  there has been a change on the environment.
-
 27 January 2026: Wouter
 	- Add test for allow-notify with a host name.
 

doc/example.conf.in

@@ -193,9 +193,6 @@ server:
 	# Limit on number of CNAME, DNAME records for incoming packets.
 	# iter-scrub-cname: 11
 
-	# Limit on number of RRSIGs for an RRset for incoming packets.
-	# iter-scrub-rrsig: 8
-
 	# Limit on upstream queries for an incoming query and its recursion.
 	# max-global-quota: 200
 
@@ -665,7 +662,7 @@ server:
 	# or, just before the iterator).
 	# module-config: "validator iterator"
 
-	# File with trusted keys, kept up-to-date using RFC5011 probes,
+	# File with trusted keys, kept uptodate using RFC5011 probes,
 	# initial file like trust-anchor-file, then it stores metadata.
 	# Use several entries, one per domain name, to track multiple zones.
 	#
@@ -725,7 +722,7 @@ server:
 	# val-max-restart: 5
 
 	# Should additional section of secure message also be kept clean of
-	# non-secure data. Useful to shield the users of this validator from
+	# unsecure data. Useful to shield the users of this validator from
 	# potential bogus data in the additional section. All unsigned data
 	# in the additional section is removed from secure messages.
 	# val-clean-additional: yes
@@ -968,12 +965,16 @@ server:
 	# tls-ciphersuites: "TLS_AES_128_GCM_SHA256:TLS_AES_128_CCM_8_SHA256:TLS_AES_128_CCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256"
 
 	# Use the SNI extension for TLS connections.  Default is yes.
-	# Changing the value requires a restart.
+	# Changing the value requires a reload.
 	# tls-use-sni: yes
 
-	# TLS protocols.
-	# Changing the value requires a restart.
-	# tls-protocols: "TLSv1.2 TLSv1.3"
+	# Allow general-purpose version-flexible TLS server configuration that
+	# may be further restricted by the system's policy.
+	# Use only if you want to support legacy TLS client connections.
+	# Default is no and Unbound will only use the latest available TLS
+	# version.
+	# Changing the value requires a reload.
+	# tls-use-system-policy-versions: no
 
 	# Add the secret file for TLS Session Ticket.
 	# Secret file must be 80 bytes of random data.

doc/unbound-control.8.in

@@ -168,8 +168,6 @@ ipset,
 \fI\%tcp\-auth\-query\-timeout\fP,
 \fI\%delay\-close\fP\&.
 \fI\%iter\-scrub\-promiscuous\fP\&.
-\fI\%tls\-service\-key\fP\&.
-\fI\%tls\-service\-pem\fP\&.
 .sp
 It does not work with
 \fI\%interface\fP and

doc/unbound-control.rst

@@ -170,8 +170,6 @@ There are several commands that the server understands.
     :ref:`tcp-auth-query-timeout<unbound.conf.tcp-auth-query-timeout>`,
     :ref:`delay-close<unbound.conf.delay-close>`.
     :ref:`iter-scrub-promiscuous<unbound.conf.iter-scrub-promiscuous>`.
-    :ref:`tls-service-key<unbound.conf.tls-service-key>`.
-    :ref:`tls-service-pem<unbound.conf.tls-service-pem>`.
 
     It does not work with
     :ref:`interface<unbound.conf.interface>` and

doc/unbound.conf.5.in

@@ -382,10 +382,6 @@ Default depends on compile options.
 Larger numbers need extra resources from the operating system.
 For performance a very large value is best, use libevent to make this
 possible.
-Should be higher (preferably double) than the value of
-\fI\%num\-queries\-per\-thread\fP to
-account for cases where the request list is full and avoid file descriptor
-starvation.
 .sp
 Default: 4096 (libevent) / 960 (minievent) / 48 (windows)
 .UNINDENT
@@ -1139,13 +1135,9 @@ The file must contain the private key for the TLS session, the public
 certificate is in the \fI\%tls\-service\-pem\fP
 file and it must also be specified if
 \fI\%tls\-service\-key\fP is specified.
-If the key is stored with root permissions or outside of chroot, then
-a change or enabling or disabling requires a restart (a reload is not
-enough).
-But if the key file (and tls\-service\-pem file) are accessible, then they
-are read in on reload, and fast_reload.
-The server checks the modification time of the file (and the filename)
-to see if the file has changed for reload.
+Enabling or disabling this service requires a restart (a reload is not
+enough), because the key is read while root permissions are held and before
+chroot (if any).
 The ports enabled implicitly or explicitly via
 \fI\%tls\-port\fP and
 \fI\%https\-port\fP do not provide normal DNS TCP
@@ -1298,7 +1290,7 @@ Enable or disable sending the SNI extension on TLS connections.
 \fBNOTE:\fP
 .INDENT 7.0
 .INDENT 3.5
-Changing the value requires a restart.
+Changing the value requires a reload.
 .UNINDENT
 .UNINDENT
 .sp
@@ -1306,19 +1298,30 @@ Default: yes
 .UNINDENT
 .INDENT 0.0
 .TP
-.B tls\-protocols: \fI\(dq<list of protocols>\(dq\fP 
-Specify the allowed TLS protocol versions to use, in no particular order.
-Possible values are \fBTLSv1.2\fP and \fBTLSv1.3\fP\&.
-Enclose list of protocols in quotes (\fB\(dq\(dq\fP) and put spaces between them.
+.B tls\-use\-system\-policy\-versions: \fI<yes or no>\fP 
+Enable or disable general\-puspose version\-flexible TLS server configuration
+when serving TLS.
+This will allow the whole list of available TLS versions provided by the
+crypto library, which may have been further restricted by the system\(aqs
+crypto policy.
+.sp
+By default Unbound only uses the latest available TLS version.
+.sp
+\fBCAUTION:\fP
+.INDENT 7.0
+.INDENT 3.5
+Use only if you want to support legacy TLS client connections.
+.UNINDENT
+.UNINDENT
 .sp
 \fBNOTE:\fP
 .INDENT 7.0
 .INDENT 3.5
-Changing the value requires a restart.
+Changing the value requires a reload.
 .UNINDENT
 .UNINDENT
 .sp
-Default: \(dqTLSv1.2 TLSv1.3\(dq
+Default: no
 .UNINDENT
 .INDENT 0.0
 .TP
@@ -2269,11 +2272,6 @@ This protects against so\-called DNS Rebinding, where a user browser is
 turned into a network proxy, allowing remote access through the browser to
 other parts of your private network.
 .sp
-The option removes resource records of types A, AAAA, SVCB and HTTPS
-that match the filter.
-Inside the SVCB and HTTPS records, the svcparams of type ipv4hint
-and ipv6hint are checked for matches.
-.sp
 Some names can be allowed to contain your private addresses, by default all
 the \fI\%local\-data\fP that you configured is
 allowed to, and you can specify additional names using
@@ -3012,39 +3010,6 @@ local\-data: \(dqexample.com. A 127.0.0.1\(dq
 queries for \fBwww.example.com\fP and \fBwww.foo.example.com\fP are
 redirected, so that users with web browsers cannot access sites with
 suffix example.com.
-.sp
-A \fBCNAME\fP record can also be provided via local\-data:
-.INDENT 7.0
-.INDENT 3.5
-.sp
-.nf
-.ft C
-local\-zone: \(dqexample.com.\(dq redirect
-local\-data: \(dqexample.com. CNAME www.example.org.\(dq
-.ft P
-.fi
-.UNINDENT
-.UNINDENT
-.sp
-In that case, the \fBCNAME\fP is resolved and the answer
-includes resolved target records as well.
-The \fBCNAME\fP record has to be with the zone name of the local\-zone,
-and there can be one CNAME, not more.
-The \fBCNAME\fP record has to be at the zone apex of the
-\fBredirect\fP zone, then it is used for redirection.
-The resolution proceeds with upstream DNS resolution, and
-that does not include the lookup in local zones.
-So the record is not able to point in local zones, but it
-can point to upstream DNS answers.
-.sp
-\fBCNAME\fP resolution is supported only in type \fBredirect\fP
-local\-zone, and in type \fBinform_redirect\fP local\-zone.
-.sp
-As different from \fBCNAME\fP records that are used elsewhere, in
-the \fBredirect\fP type local\-zone, it is supported that in the target
-of the record a wildcard label gets expanded to the query name, with
-for example: \fBexample.com. CNAME *.foo.net.\fP gets expanded
-to \fBwww.example.com. CNAME www.example.com.foo.net.\fP\&.
 .UNINDENT
 .INDENT 7.0
 .TP
@@ -3103,9 +3068,6 @@ use IPv6 protocol and avoid any queries to IPv4.
 .B always_refuse 
 Like \fI\%refuse\fP, but ignores
 local data and refuses the query.
-This type also blocks queries of type DS for the zone name.
-That can break the DNSSEC chain of trust, but it is refused anyway.
-The block for type DS assists in more completely blocking the zone.
 .UNINDENT
 .INDENT 7.0
 .TP
@@ -3769,10 +3731,6 @@ Default: 32
 Hard limit on the number of times Unbound is allowed to restart a query
 upon encountering a CNAME record.
 Results in SERVFAIL when reached.
-This applies to chained CNAME records but not sporadic CNAME records that
-could be encountered in the lifetime of the query\(aqs resolution effort.
-When a CNAME chain concludes, the counter keeping track of this limit is
-reset.
 Changing this value needs caution as it can allow long CNAME chains to be
 accepted, where Unbound needs to verify (resolve) each link individually.
 .sp
@@ -3800,16 +3758,6 @@ Default: 11
 .UNINDENT
 .INDENT 0.0
 .TP
-.B iter\-scrub\-rrsig: \fI<number>\fP 
-Limit on the number of RRSIGs allowed for an RRset, from the iterator
-scrubber.
-This protects against an overly large number of RRSIGs.
-Clips off the remainder of the RRSIG list at that point.
-.sp
-Default: 8
-.UNINDENT
-.INDENT 0.0
-.TP
 .B max\-global\-quota: \fI<number>\fP 
 Limit on the number of upstream queries sent out for an incoming query and
 its subqueries from recursion.
@@ -3991,7 +3939,7 @@ Default: no
 .UNINDENT
 .INDENT 0.0
 .TP
-.B control\-interface: \fI<IP address or interface name[@port] or path>\fP 
+.B control\-interface: \fI<IP address or interface name or path>\fP 
 Give IPv4 or IPv6 addresses or local socket path to listen on for control
 commands.
 If an interface name is used instead of an IP address, the list of IP
@@ -4808,17 +4756,6 @@ Default: no
 Use a specific NAT64 prefix to reach IPv4\-only servers.
 The prefix length must be one of /32, /40, /48, /56, /64 or /96.
 .sp
-The NAT64 prefix is allowed by the
-\fI\%do\-not\-query\-address\fP option,
-so that there is a clear outcome of addresses in both; the NAT64 prefix
-is allowed.
-The IPv4 address could be filtered by the
-\fI\%do\-not\-query\-address\fP option,
-if needed.
-Allowing the NAT64 prefix is useful when using do\-not\-query\-address
-for a cluster of machines that is IPv6\-only and uses NAT64, but does
-not have internet access.
-.sp
 Default: 64:ff9b::/96 (same as \fI\%dns64\-prefix\fP)
 .UNINDENT
 .SH DNSCRYPT OPTIONS

doc/unbound.conf.rst

@@ -366,10 +366,6 @@ These options are part of the ``server:`` section.
     Larger numbers need extra resources from the operating system.
     For performance a very large value is best, use libevent to make this
     possible.
-    Should be higher (preferably double) than the value of
-    :ref:`num-queries-per-thread<unbound.conf.num-queries-per-thread>` to
-    account for cases where the request list is full and avoid file descriptor
-    starvation.
 
     Default: 4096 (libevent) / 960 (minievent) / 48 (windows)
 
@@ -1048,13 +1044,9 @@ These options are part of the ``server:`` section.
     certificate is in the :ref:`tls-service-pem<unbound.conf.tls-service-pem>`
     file and it must also be specified if
     :ref:`tls-service-key<unbound.conf.tls-service-key>` is specified.
-    If the key is stored with root permissions or outside of chroot, then
-    a change or enabling or disabling requires a restart (a reload is not
-    enough).
-    But if the key file (and tls-service-pem file) are accessible, then they
-    are read in on reload, and fast_reload.
-    The server checks the modification time of the file (and the filename)
-    to see if the file has changed for reload.
+    Enabling or disabling this service requires a restart (a reload is not
+    enough), because the key is read while root permissions are held and before
+    chroot (if any).
     The ports enabled implicitly or explicitly via
     :ref:`tls-port<unbound.conf.tls-port>` and
     :ref:`https-port<unbound.conf.https-port>` do not provide normal DNS TCP
@@ -1180,19 +1172,25 @@ These options are part of the ``server:`` section.
 @@UAHL@unbound.conf@tls-use-sni@@: *<yes or no>*
     Enable or disable sending the SNI extension on TLS connections.
 
-    .. note:: Changing the value requires a restart.
+    .. note:: Changing the value requires a reload.
 
     Default: yes
 
 
-@@UAHL@unbound.conf@tls-protocols@@: *"<list of protocols>"*
-    Specify the allowed TLS protocol versions to use, in no particular order.
-    Possible values are ``TLSv1.2`` and ``TLSv1.3``.
-    Enclose list of protocols in quotes (``""``) and put spaces between them.
+@@UAHL@unbound.conf@tls-use-system-policy-versions@@: *<yes or no>*
+    Enable or disable general-puspose version-flexible TLS server configuration
+    when serving TLS.
+    This will allow the whole list of available TLS versions provided by the
+    crypto library, which may have been further restricted by the system's
+    crypto policy.
 
-    .. note:: Changing the value requires a restart.
+    By default Unbound only uses the latest available TLS version.
 
-    Default: "TLSv1.2 TLSv1.3"
+    .. caution:: Use only if you want to support legacy TLS client connections.
+
+    .. note:: Changing the value requires a reload.
+
+    Default: no
 
 
 @@UAHL@unbound.conf@pad-responses@@: *<yes or no>*
@@ -2014,11 +2012,6 @@ These options are part of the ``server:`` section.
     turned into a network proxy, allowing remote access through the browser to
     other parts of your private network.
 
-    The option removes resource records of types A, AAAA, SVCB and HTTPS
-    that match the filter.
-    Inside the SVCB and HTTPS records, the svcparams of type ipv4hint
-    and ipv6hint are checked for matches.
-
     Some names can be allowed to contain your private addresses, by default all
     the :ref:`local-data<unbound.conf.local-data>` that you configured is
     allowed to, and you can specify additional names using
@@ -2669,33 +2662,6 @@ These options are part of the ``server:`` section.
         redirected, so that users with web browsers cannot access sites with
         suffix example.com.
 
-        A ``CNAME`` record can also be provided via local-data:
-
-        .. code-block:: text
-
-            local-zone: "example.com." redirect
-            local-data: "example.com. CNAME www.example.org."
-
-        In that case, the ``CNAME`` is resolved and the answer
-        includes resolved target records as well.
-        The ``CNAME`` record has to be with the zone name of the local-zone,
-        and there can be one CNAME, not more.
-        The ``CNAME`` record has to be at the zone apex of the
-        ``redirect`` zone, then it is used for redirection.
-        The resolution proceeds with upstream DNS resolution, and
-        that does not include the lookup in local zones.
-        So the record is not able to point in local zones, but it
-        can point to upstream DNS answers.
-
-        ``CNAME`` resolution is supported only in type ``redirect``
-        local-zone, and in type ``inform_redirect`` local-zone.
-
-        As different from ``CNAME`` records that are used elsewhere, in
-        the ``redirect`` type local-zone, it is supported that in the target
-        of the record a wildcard label gets expanded to the query name, with
-        for example: ``example.com. CNAME *.foo.net.`` gets expanded
-        to ``www.example.com. CNAME www.example.com.foo.net.``.
-
     @@UAHL@unbound.conf.local-zone.type@inform@@
         The query is answered normally, same as
         :ref:`transparent<unbound.conf.local-zone.type.transparent>`.
@@ -2735,9 +2701,6 @@ These options are part of the ``server:`` section.
     @@UAHL@unbound.conf.local-zone.type@always_refuse@@
         Like :ref:`refuse<unbound.conf.local-zone.type.refuse>`, but ignores
         local data and refuses the query.
-        This type also blocks queries of type DS for the zone name.
-        That can break the DNSSEC chain of trust, but it is refused anyway.
-        The block for type DS assists in more completely blocking the zone.
 
     @@UAHL@unbound.conf.local-zone.type@always_nxdomain@@
         Like :ref:`static<unbound.conf.local-zone.type.static>`, but ignores
@@ -3260,10 +3223,6 @@ These options are part of the ``server:`` section.
     Hard limit on the number of times Unbound is allowed to restart a query
     upon encountering a CNAME record.
     Results in SERVFAIL when reached.
-    This applies to chained CNAME records but not sporadic CNAME records that
-    could be encountered in the lifetime of the query's resolution effort.
-    When a CNAME chain concludes, the counter keeping track of this limit is
-    reset.
     Changing this value needs caution as it can allow long CNAME chains to be
     accepted, where Unbound needs to verify (resolve) each link individually.
 
@@ -3288,15 +3247,6 @@ These options are part of the ``server:`` section.
     Default: 11
 
 
-@@UAHL@unbound.conf@iter-scrub-rrsig@@: *<number>*
-    Limit on the number of RRSIGs allowed for an RRset, from the iterator
-    scrubber.
-    This protects against an overly large number of RRSIGs.
-    Clips off the remainder of the RRSIG list at that point.
-
-    Default: 8
-
-
 @@UAHL@unbound.conf@max-global-quota@@: *<number>*
     Limit on the number of upstream queries sent out for an incoming query and
     its subqueries from recursion.
@@ -3461,7 +3411,7 @@ To setup the correct self-signed certificates use the
     Default: no
 
 
-@@UAHL@unbound.conf.remote@control-interface@@: *<IP address or interface name[@port] or path>*
+@@UAHL@unbound.conf.remote@control-interface@@: *<IP address or interface name or path>*
     Give IPv4 or IPv6 addresses or local socket path to listen on for control
     commands.
     If an interface name is used instead of an IP address, the list of IP
@@ -4211,17 +4161,6 @@ servers.
     Use a specific NAT64 prefix to reach IPv4-only servers.
     The prefix length must be one of /32, /40, /48, /56, /64 or /96.
 
-    The NAT64 prefix is allowed by the
-    :ref:`do-not-query-address<unbound.conf.do-not-query-address>` option,
-    so that there is a clear outcome of addresses in both; the NAT64 prefix
-    is allowed.
-    The IPv4 address could be filtered by the
-    :ref:`do-not-query-address<unbound.conf.do-not-query-address>` option,
-    if needed.
-    Allowing the NAT64 prefix is useful when using do-not-query-address
-    for a cluster of machines that is IPv6-only and uses NAT64, but does
-    not have internet access.
-
     Default: 64:ff9b::/96 (same as :ref:`dns64-prefix<unbound.conf.dns64.dns64-prefix>`)
 
 .. _unbound.conf.dnscrypt:

doc/unbound.doxygen

@@ -1007,6 +1007,7 @@ EXCLUDE                = ./build \
                          libunbound/python/doc \
                          libunbound/python/examples \
                          ./ldns-src \
+                         ./simdzone \
                          README.md \
                          doc/control_proto_spec.txt \
                          doc/requirements.txt

edns-subnet/subnetmod.c

@@ -70,7 +70,6 @@ subnet_data_delete(void *d, void *ATTR_UNUSED(arg))
 	r = (struct subnet_msg_cache_data*)d;
 	addrtree_delete(r->tree4);
 	addrtree_delete(r->tree6);
-	free(r->reason_fail);
 	free(r);
 }
 
@@ -85,8 +84,6 @@ msg_cache_sizefunc(void *k, void *d)
 		+ q->key.qname_len + lock_get_mem(&q->entry.lock);
 	s += addrtree_size(r->tree4);
 	s += addrtree_size(r->tree6);
-	if(r->reason_fail)
-		s += strlen(r->reason_fail)+1;
 	return s;
 }
 
@@ -203,18 +200,12 @@ int ecs_whitelist_check(struct query_info* qinfo,
 			if(sq->ecs_server_out.subnet_source_mask == 0) {
 				sq->subnet_sent_no_subnet = 1;
 				sq->subnet_sent = 0;
-				/* The result should end up in subnet cache,
-				 * not in global cache. */
-				qstate->no_cache_store = 1;
 				return 1;
 			}
 			subnet_ecs_opt_list_append(&sq->ecs_server_out,
 				&qstate->edns_opts_back_out, qstate, region);
 		}
 		sq->subnet_sent = 1;
-		/* Do not store servfails in global cache, since the subnet
-		 * option is sent out. */
-		qstate->no_cache_store = 1;
 	}
 	else {
 		/* Outgoing ECS option is set, but we don't want to sent it to
@@ -436,35 +427,6 @@ update_cache(struct module_qstate *qstate, int id)
 	}
 	/* lru_entry->lock is locked regardless of how we got here,
 	 * either from the slabhash_lookup, or above in the new allocated */
-	if(!qstate->return_msg && qstate->error_response_cache) {
-		struct subnet_msg_cache_data *data =
-			(struct subnet_msg_cache_data*)lru_entry->data;
-		data->ttl_servfail = *qstate->env->now + NORR_TTL;
-		data->ede_fail = errinf_to_reason_bogus(qstate);
-		diff_size = (data->reason_fail?strlen(data->reason_fail)+1:0);
-		if(qstate->errinf) {
-			char* str = errinf_to_str_misc(qstate);
-			free(data->reason_fail);
-			data->reason_fail = NULL;
-			if(str)
-				data->reason_fail = strdup(str);
-		}
-		diff_size = (data->reason_fail?strlen(data->reason_fail)+1:0)
-			- diff_size;
-		lock_rw_unlock(&lru_entry->lock);
-		if (need_to_insert) {
-			slabhash_insert(subnet_msg_cache, h, lru_entry,
-				lru_entry->data, NULL);
-		} else {
-			slabhash_update_space_used(subnet_msg_cache, h, NULL,
-				diff_size);
-		}
-		return;
-	}
-	if(!qstate->return_msg) {
-		lock_rw_unlock(&lru_entry->lock);
-		return;
-	}
 	/* Step 2, find the correct tree */
 	if (!(tree = get_tree(lru_entry->data, edns, sne, qstate->env->cfg))) {
 		lock_rw_unlock(&lru_entry->lock);
@@ -508,21 +470,6 @@ update_cache(struct module_qstate *qstate, int id)
 	}
 }
 
-/** See if there is a stored servfail, returns true if so, and sets reply. */
-static int
-lookup_check_servfail(struct module_qstate *qstate,
-	struct subnet_msg_cache_data *data)
-{
-	struct module_env *env = qstate->env;
-	if(!data)
-		return 0;
-	if(!data->ttl_servfail || TTL_IS_EXPIRED(data->ttl_servfail, *env->now))
-		return 0;
-	qstate->return_rcode = LDNS_RCODE_SERVFAIL;
-	errinf_ede(qstate, data->reason_fail, data->ede_fail);
-	return 1;
-}
-
 /** Lookup in cache and reply true iff reply is sent. */
 static int
 lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq, int prefetch)
@@ -536,8 +483,6 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 	struct addrtree *tree;
 	struct addrnode *node;
 	uint8_t scope;
-	int must_validate = (!(qstate->query_flags&BIT_CD)
-		|| qstate->env->cfg->ignore_cd) && qstate->env->need_to_validate;
 
 	memset(&sq->ecs_client_out, 0, sizeof(sq->ecs_client_out));
 
@@ -551,20 +496,12 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 	tree = (ecs->subnet_addr_fam == EDNSSUBNET_ADDRFAM_IP4)?
 		data->tree4 : data->tree6;
 	if (!tree) { /* qinfo in cache but not for this family */
-		if(lookup_check_servfail(qstate, data)) {
-			lock_rw_unlock(&e->lock);
-			return 1;
-		}
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
 	node = addrtree_find(tree, (addrkey_t*)ecs->subnet_addr, 
 		ecs->subnet_source_mask, *env->now);
 	if (!node) { /* plain old cache miss */
-		if(lookup_check_servfail(qstate, data)) {
-			lock_rw_unlock(&e->lock);
-			return 1;
-		}
 		lock_rw_unlock(&e->lock);
 		return 0;
 	}
@@ -573,24 +510,12 @@ lookup_and_reply(struct module_qstate *qstate, int id, struct subnet_qstate *sq,
 		(struct reply_info *)node->elem, qstate->region, *env->now, 0,
 		env->scratch);
 	scope = (uint8_t)node->scope;
+	lock_rw_unlock(&e->lock);
 	
 	if (!qstate->return_msg) { /* Failed allocation or expired TTL */
-		if(lookup_check_servfail(qstate, data)) {
-			lock_rw_unlock(&e->lock);
-			return 1;
-		}
-		lock_rw_unlock(&e->lock);
 		return 0;
 	}
-	lock_rw_unlock(&e->lock);
-	if(qstate->return_msg->rep->security == sec_status_unchecked
-		&& must_validate) {
-		/* The message has to be validated first. */
-		verbose(VERB_ALGO, "subnet: unchecked cache entry needs "
-			"validation");
-		return 0;
-	}
-
+	
 	if (sq->subnet_downstream) { /* relay to interested client */
 		sq->ecs_client_out.subnet_scope_mask = scope;
 		sq->ecs_client_out.subnet_addr_fam = ecs->subnet_addr_fam;
@@ -645,10 +570,7 @@ generate_sub_request(struct module_qstate *qstate, int id, struct subnet_qstate*
 	qflags |= BIT_RD;
 	if((qstate->query_flags & BIT_CD)!=0) {
 		qflags |= BIT_CD;
-		/* The valrec is left off. Leave out: valrec = 1;
-		 * So that the cache is protected with DNSSEC validation.
-		 * Just like the global cache. DNSSEC validation is performed
-		 * regardless of the setting of the querier's CD flag. */
+		valrec = 1;
 	}
 
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
@@ -718,12 +640,6 @@ eval_response(struct module_qstate *qstate, int id, struct subnet_qstate *sq)
 		/* already an answer and its not a message, but retain
 		 * the actual rcode, instead of module_error, so send
 		 * module_finished */
-		if(qstate->error_response_cache) {
-			verbose(VERB_ALGO, "subnet: store error response");
-			lock_rw_wrlock(&sne->biglock);
-			update_cache(qstate, id);
-			lock_rw_unlock(&sne->biglock);
-		}
 		return module_finished;
 	}
 
@@ -973,11 +889,9 @@ ecs_edns_back_parsed(struct module_qstate* qstate, int id,
 				sq->max_scope = sq->ecs_server_in.subnet_scope_mask;
 	} else if(sq->subnet_sent_no_subnet) {
 		/* The answer can be stored as scope 0, not in global cache. */
-		/* This was already set in ecs_whitelist_check */
 		qstate->no_cache_store = 1;
 	} else if(sq->subnet_sent) {
 		/* Need another query to be able to store in global cache. */
-		/* This was already set in ecs_whitelist_check */
 		qstate->no_cache_store = 1;
 	}
 

edns-subnet/subnetmod.h

@@ -69,18 +69,8 @@ struct subnet_env {
 };
 
 struct subnet_msg_cache_data {
-	/** Tree for nodes with IPv4 subnets. */
 	struct addrtree* tree4;
-	/** Tree for nodes with IPv6 subnets. */
 	struct addrtree* tree6;
-	/** If servfail is stored, for how long. Abs time in seconds.
-	 * This protects against too much recusion on the item when
-	 * resolution fails, for a couple of seconds. */
-	time_t ttl_servfail;
-	/** servfail ede */
-	sldns_ede_code ede_fail;
-	/** servfail reason */
-	char* reason_fail;
 };
 
 struct subnet_qstate {

install-sh

@@ -1,501 +0,0 @@
-#!/usr/bin/sh
-# install - install a program, script, or datafile
-
-scriptversion=2013-12-25.23; # UTC
-
-# This originates from X11R5 (mit/util/scripts/install.sh), which was
-# later released in X11R6 (xc/config/util/install.sh) with the
-# following copyright and license.
-#
-# Copyright (C) 1994 X Consortium
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to
-# deal in the Software without restriction, including without limitation the
-# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-# sell copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
-# X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
-# AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC-
-# TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-#
-# Except as contained in this notice, the name of the X Consortium shall not
-# be used in advertising or otherwise to promote the sale, use or other deal-
-# ings in this Software without prior written authorization from the X Consor-
-# tium.
-#
-#
-# FSF changes to this file are in the public domain.
-#
-# Calling this script install-sh is preferred over install.sh, to prevent
-# 'make' implicit rules from creating a file called install from it
-# when there is no Makefile.
-#
-# This script is compatible with the BSD install script, but was written
-# from scratch.
-
-tab='	'
-nl='
-'
-IFS=" $tab$nl"
-
-# Set DOITPROG to "echo" to test this script.
-
-doit=${DOITPROG-}
-doit_exec=${doit:-exec}
-
-# Put in absolute file names if you don't have them in your path;
-# or use environment vars.
-
-chgrpprog=${CHGRPPROG-chgrp}
-chmodprog=${CHMODPROG-chmod}
-chownprog=${CHOWNPROG-chown}
-cmpprog=${CMPPROG-cmp}
-cpprog=${CPPROG-cp}
-mkdirprog=${MKDIRPROG-mkdir}
-mvprog=${MVPROG-mv}
-rmprog=${RMPROG-rm}
-stripprog=${STRIPPROG-strip}
-
-posix_mkdir=
-
-# Desired mode of installed file.
-mode=0755
-
-chgrpcmd=
-chmodcmd=$chmodprog
-chowncmd=
-mvcmd=$mvprog
-rmcmd="$rmprog -f"
-stripcmd=
-
-src=
-dst=
-dir_arg=
-dst_arg=
-
-copy_on_change=false
-is_target_a_directory=possibly
-
-usage="\
-Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
-   or: $0 [OPTION]... SRCFILES... DIRECTORY
-   or: $0 [OPTION]... -t DIRECTORY SRCFILES...
-   or: $0 [OPTION]... -d DIRECTORIES...
-
-In the 1st form, copy SRCFILE to DSTFILE.
-In the 2nd and 3rd, copy all SRCFILES to DIRECTORY.
-In the 4th, create DIRECTORIES.
-
-Options:
-     --help     display this help and exit.
-     --version  display version info and exit.
-
-  -c            (ignored)
-  -C            install only if different (preserve the last data modification time)
-  -d            create directories instead of installing files.
-  -g GROUP      $chgrpprog installed files to GROUP.
-  -m MODE       $chmodprog installed files to MODE.
-  -o USER       $chownprog installed files to USER.
-  -s            $stripprog installed files.
-  -t DIRECTORY  install into DIRECTORY.
-  -T            report an error if DSTFILE is a directory.
-
-Environment variables override the default commands:
-  CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
-  RMPROG STRIPPROG
-"
-
-while test $# -ne 0; do
-  case $1 in
-    -c) ;;
-
-    -C) copy_on_change=true;;
-
-    -d) dir_arg=true;;
-
-    -g) chgrpcmd="$chgrpprog $2"
-        shift;;
-
-    --help) echo "$usage"; exit $?;;
-
-    -m) mode=$2
-        case $mode in
-          *' '* | *"$tab"* | *"$nl"* | *'*'* | *'?'* | *'['*)
-            echo "$0: invalid mode: $mode" >&2
-            exit 1;;
-        esac
-        shift;;
-
-    -o) chowncmd="$chownprog $2"
-        shift;;
-
-    -s) stripcmd=$stripprog;;
-
-    -t)
-        is_target_a_directory=always
-        dst_arg=$2
-        # Protect names problematic for 'test' and other utilities.
-        case $dst_arg in
-          -* | [=\(\)!]) dst_arg=./$dst_arg;;
-        esac
-        shift;;
-
-    -T) is_target_a_directory=never;;
-
-    --version) echo "$0 $scriptversion"; exit $?;;
-
-    --) shift
-        break;;
-
-    -*) echo "$0: invalid option: $1" >&2
-        exit 1;;
-
-    *)  break;;
-  esac
-  shift
-done
-
-# We allow the use of options -d and -T together, by making -d
-# take the precedence; this is for compatibility with GNU install.
-
-if test -n "$dir_arg"; then
-  if test -n "$dst_arg"; then
-    echo "$0: target directory not allowed when installing a directory." >&2
-    exit 1
-  fi
-fi
-
-if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
-  # When -d is used, all remaining arguments are directories to create.
-  # When -t is used, the destination is already specified.
-  # Otherwise, the last argument is the destination.  Remove it from $@.
-  for arg
-  do
-    if test -n "$dst_arg"; then
-      # $@ is not empty: it contains at least $arg.
-      set fnord "$@" "$dst_arg"
-      shift # fnord
-    fi
-    shift # arg
-    dst_arg=$arg
-    # Protect names problematic for 'test' and other utilities.
-    case $dst_arg in
-      -* | [=\(\)!]) dst_arg=./$dst_arg;;
-    esac
-  done
-fi
-
-if test $# -eq 0; then
-  if test -z "$dir_arg"; then
-    echo "$0: no input file specified." >&2
-    exit 1
-  fi
-  # It's OK to call 'install-sh -d' without argument.
-  # This can happen when creating conditional directories.
-  exit 0
-fi
-
-if test -z "$dir_arg"; then
-  if test $# -gt 1 || test "$is_target_a_directory" = always; then
-    if test ! -d "$dst_arg"; then
-      echo "$0: $dst_arg: Is not a directory." >&2
-      exit 1
-    fi
-  fi
-fi
-
-if test -z "$dir_arg"; then
-  do_exit='(exit $ret); exit $ret'
-  trap "ret=129; $do_exit" 1
-  trap "ret=130; $do_exit" 2
-  trap "ret=141; $do_exit" 13
-  trap "ret=143; $do_exit" 15
-
-  # Set umask so as not to create temps with too-generous modes.
-  # However, 'strip' requires both read and write access to temps.
-  case $mode in
-    # Optimize common cases.
-    *644) cp_umask=133;;
-    *755) cp_umask=22;;
-
-    *[0-7])
-      if test -z "$stripcmd"; then
-        u_plus_rw=
-      else
-        u_plus_rw='% 200'
-      fi
-      cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;;
-    *)
-      if test -z "$stripcmd"; then
-        u_plus_rw=
-      else
-        u_plus_rw=,u+rw
-      fi
-      cp_umask=$mode$u_plus_rw;;
-  esac
-fi
-
-for src
-do
-  # Protect names problematic for 'test' and other utilities.
-  case $src in
-    -* | [=\(\)!]) src=./$src;;
-  esac
-
-  if test -n "$dir_arg"; then
-    dst=$src
-    dstdir=$dst
-    test -d "$dstdir"
-    dstdir_status=$?
-  else
-
-    # Waiting for this to be detected by the "$cpprog $src $dsttmp" command
-    # might cause directories to be created, which would be especially bad
-    # if $src (and thus $dsttmp) contains '*'.
-    if test ! -f "$src" && test ! -d "$src"; then
-      echo "$0: $src does not exist." >&2
-      exit 1
-    fi
-
-    if test -z "$dst_arg"; then
-      echo "$0: no destination specified." >&2
-      exit 1
-    fi
-    dst=$dst_arg
-
-    # If destination is a directory, append the input filename; won't work
-    # if double slashes aren't ignored.
-    if test -d "$dst"; then
-      if test "$is_target_a_directory" = never; then
-        echo "$0: $dst_arg: Is a directory" >&2
-        exit 1
-      fi
-      dstdir=$dst
-      dst=$dstdir/`basename "$src"`
-      dstdir_status=0
-    else
-      dstdir=`dirname "$dst"`
-      test -d "$dstdir"
-      dstdir_status=$?
-    fi
-  fi
-
-  obsolete_mkdir_used=false
-
-  if test $dstdir_status != 0; then
-    case $posix_mkdir in
-      '')
-        # Create intermediate dirs using mode 755 as modified by the umask.
-        # This is like FreeBSD 'install' as of 1997-10-28.
-        umask=`umask`
-        case $stripcmd.$umask in
-          # Optimize common cases.
-          *[2367][2367]) mkdir_umask=$umask;;
-          .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
-
-          *[0-7])
-            mkdir_umask=`expr $umask + 22 \
-              - $umask % 100 % 40 + $umask % 20 \
-              - $umask % 10 % 4 + $umask % 2
-            `;;
-          *) mkdir_umask=$umask,go-w;;
-        esac
-
-        # With -d, create the new directory with the user-specified mode.
-        # Otherwise, rely on $mkdir_umask.
-        if test -n "$dir_arg"; then
-          mkdir_mode=-m$mode
-        else
-          mkdir_mode=
-        fi
-
-        posix_mkdir=false
-        case $umask in
-          *[123567][0-7][0-7])
-            # POSIX mkdir -p sets u+wx bits regardless of umask, which
-            # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
-            ;;
-          *)
-            tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-            trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
-
-            if (umask $mkdir_umask &&
-                exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
-            then
-              if test -z "$dir_arg" || {
-                   # Check for POSIX incompatibilities with -m.
-                   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
-                   # other-writable bit of parent directory when it shouldn't.
-                   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-                   ls_ld_tmpdir=`ls -ld "$tmpdir"`
-                   case $ls_ld_tmpdir in
-                     d????-?r-*) different_mode=700;;
-                     d????-?--*) different_mode=755;;
-                     *) false;;
-                   esac &&
-                   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
-                     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
-                     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
-                   }
-                 }
-              then posix_mkdir=:
-              fi
-              rmdir "$tmpdir/d" "$tmpdir"
-            else
-              # Remove any dirs left behind by ancient mkdir implementations.
-              rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
-            fi
-            trap '' 0;;
-        esac;;
-    esac
-
-    if
-      $posix_mkdir && (
-        umask $mkdir_umask &&
-        $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
-      )
-    then :
-    else
-
-      # The umask is ridiculous, or mkdir does not conform to POSIX,
-      # or it failed possibly due to a race condition.  Create the
-      # directory the slow way, step by step, checking for races as we go.
-
-      case $dstdir in
-        /*) prefix='/';;
-        [-=\(\)!]*) prefix='./';;
-        *)  prefix='';;
-      esac
-
-      oIFS=$IFS
-      IFS=/
-      set -f
-      set fnord $dstdir
-      shift
-      set +f
-      IFS=$oIFS
-
-      prefixes=
-
-      for d
-      do
-        test X"$d" = X && continue
-
-        prefix=$prefix$d
-        if test -d "$prefix"; then
-          prefixes=
-        else
-          if $posix_mkdir; then
-            (umask=$mkdir_umask &&
-             $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
-            # Don't fail if two instances are running concurrently.
-            test -d "$prefix" || exit 1
-          else
-            case $prefix in
-              *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
-              *) qprefix=$prefix;;
-            esac
-            prefixes="$prefixes '$qprefix'"
-          fi
-        fi
-        prefix=$prefix/
-      done
-
-      if test -n "$prefixes"; then
-        # Don't fail if two instances are running concurrently.
-        (umask $mkdir_umask &&
-         eval "\$doit_exec \$mkdirprog $prefixes") ||
-          test -d "$dstdir" || exit 1
-        obsolete_mkdir_used=true
-      fi
-    fi
-  fi
-
-  if test -n "$dir_arg"; then
-    { test -z "$chowncmd" || $doit $chowncmd "$dst"; } &&
-    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } &&
-    { test "$obsolete_mkdir_used$chowncmd$chgrpcmd" = false ||
-      test -z "$chmodcmd" || $doit $chmodcmd $mode "$dst"; } || exit 1
-  else
-
-    # Make a couple of temp file names in the proper directory.
-    dsttmp=$dstdir/_inst.$$_
-    rmtmp=$dstdir/_rm.$$_
-
-    # Trap to clean up those temp files at exit.
-    trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
-
-    # Copy the file name to the temp name.
-    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
-
-    # and set any options; do chmod last to preserve setuid bits.
-    #
-    # If any of these fail, we abort the whole thing.  If we want to
-    # ignore errors from any of these, just make sure not to ignore
-    # errors from the above "$doit $cpprog $src $dsttmp" command.
-    #
-    { test -z "$chowncmd" || $doit $chowncmd "$dsttmp"; } &&
-    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dsttmp"; } &&
-    { test -z "$stripcmd" || $doit $stripcmd "$dsttmp"; } &&
-    { test -z "$chmodcmd" || $doit $chmodcmd $mode "$dsttmp"; } &&
-
-    # If -C, don't bother to copy if it wouldn't change the file.
-    if $copy_on_change &&
-       old=`LC_ALL=C ls -dlL "$dst"     2>/dev/null` &&
-       new=`LC_ALL=C ls -dlL "$dsttmp"  2>/dev/null` &&
-       set -f &&
-       set X $old && old=:$2:$4:$5:$6 &&
-       set X $new && new=:$2:$4:$5:$6 &&
-       set +f &&
-       test "$old" = "$new" &&
-       $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
-    then
-      rm -f "$dsttmp"
-    else
-      # Rename the file to the real destination.
-      $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null ||
-
-      # The rename failed, perhaps because mv can't rename something else
-      # to itself, or perhaps because mv is so ancient that it does not
-      # support -f.
-      {
-        # Now remove or move aside any old file at destination location.
-        # We try this two ways since rm can't unlink itself on some
-        # systems and the destination file might be busy for other
-        # reasons.  In this case, the final cleanup might fail but the new
-        # file should still install successfully.
-        {
-          test ! -f "$dst" ||
-          $doit $rmcmd -f "$dst" 2>/dev/null ||
-          { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
-            { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
-          } ||
-          { echo "$0: cannot unlink or rename $dst" >&2
-            (exit 1); exit 1
-          }
-        } &&
-
-        # Now rename the file to the real destination.
-        $doit $mvcmd "$dsttmp" "$dst"
-      }
-    fi || exit 1
-
-    trap '' 0
-  fi
-done
-
-# Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
-# time-stamp-start: "scriptversion="
-# time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-time-zone: "UTC"
-# time-stamp-end: "; # UTC"
-# End:

iterator/iter_priv.c

@@ -207,168 +207,6 @@ size_t priv_get_mem(struct iter_priv* priv)
 	return sizeof(*priv) + regional_get_mem(priv->region);
 }
 
-/**
- * Check if svcparam ipv4hint contains a private address.
- * @param priv: private address lookup struct.
- * @param d: the data bytes.
- * @param data_len: number of data bytes in the svcparam.
- * @param addr: address to return the private address to log in to.
- *	It has space for IPv4 and IPv6 addresses.
- * @param addrlen: length of the addr. Returns the correct size for the addr.
- * @return true if the rdata contains a private address.
- */
-static int svcb_ipv4hint_contains_priv_addr(struct iter_priv* priv,
-	uint8_t* d, uint16_t data_len, struct sockaddr_storage* addr,
-	socklen_t* addrlen)
-{
-	struct sockaddr_in sa;
-	*addrlen = (socklen_t)sizeof(struct sockaddr_in);
-	memset(&sa, 0, sizeof(struct sockaddr_in));
-	sa.sin_family = AF_INET;
-	sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
-
-	while(data_len >= LDNS_IP4ADDRLEN) {
-		memmove(&sa.sin_addr, d, LDNS_IP4ADDRLEN);
-		memmove(addr, &sa, *addrlen);
-		if(priv_lookup_addr(priv, addr, *addrlen))
-			return 1;
-
-		d += LDNS_IP4ADDRLEN;
-		data_len -= LDNS_IP4ADDRLEN;
-	}
-	/* if data_len != 0 here, then the svcparam is malformed. */
-	return 0;
-}
-
-/**
- * Check if svcparam ipv6hint contains a private address.
- * @param priv: private address lookup struct.
- * @param d: the data bytes.
- * @param data_len: number of data bytes in the svcparam.
- * @param addr: address to return the private address to log in to.
- *	It has space for IPv4 and IPv6 addresses.
- * @param addrlen: length of the addr. Returns the correct size for the addr.
- * @return true if the rdata contains a private address.
- */
-static int svcb_ipv6hint_contains_priv_addr(struct iter_priv* priv,
-	uint8_t* d, uint16_t data_len, struct sockaddr_storage* addr,
-	socklen_t* addrlen)
-{
-	struct sockaddr_in6 sa;
-	*addrlen = (socklen_t)sizeof(struct sockaddr_in6);
-	memset(&sa, 0, sizeof(struct sockaddr_in6));
-	sa.sin6_family = AF_INET6;
-	sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
-
-	while(data_len >= LDNS_IP6ADDRLEN) {
-		memmove(&sa.sin6_addr, d, LDNS_IP6ADDRLEN);
-		memmove(addr, &sa, *addrlen);
-		if(priv_lookup_addr(priv, addr, *addrlen))
-			return 1;
-
-		d += LDNS_IP6ADDRLEN;
-		data_len -= LDNS_IP6ADDRLEN;
-	}
-	/* if data_len != 0 here, then the svcparam is malformed. */
-	return 0;
-}
-
-/**
- * Check if type SVCB and HTTPS rdata contains a private address.
- * @param priv: private address lookup struct.
- * @param pkt: the packet.
- * @param rr: the rr with rdata to check.
- * @param addr: address to return the private address to log in to.
- * @param addrlen: length of the addr. Initially the total size, on
- *	return the correct size for the addr.
- * @return true if the rdata contains a private address.
- */
-static int svcb_rr_contains_priv_addr(struct iter_priv* priv,
-	sldns_buffer* pkt, struct rr_parse* rr, struct sockaddr_storage* addr,
-	socklen_t* addrlen)
-{
-	uint8_t* d = rr->ttl_data;
-	uint16_t svcparamkey, data_len, rdatalen;
-	size_t oldpos, dname_len, dname_start, dname_compr_len;
-	d += 4; /* skip TTL */
-	rdatalen = sldns_read_uint16(d); /* read rdata length */
-	d += 2;
-
-	if(rdatalen < 2 /* priority */ + 1 /* 1 length target */)
-		return 0; /* malformed, too short */
-	d += 2; /* skip priority */
-	rdatalen -= 2;
-	oldpos = sldns_buffer_position(pkt);
-	sldns_buffer_set_position(pkt, (size_t)(d - sldns_buffer_begin(pkt)));
-	dname_start = sldns_buffer_position(pkt);
-	dname_len = pkt_dname_len(pkt);
-	dname_compr_len = sldns_buffer_position(pkt) - dname_start;
-	sldns_buffer_set_position(pkt, oldpos);
-	if(dname_len == 0)
-		return 0; /* dname malformed */
-	if(dname_compr_len > rdatalen)
-		return 0; /* malformed */
-	d += dname_compr_len; /* skip target */
-	rdatalen -= dname_compr_len;
-
-	while(rdatalen >= 4) {
-		svcparamkey = sldns_read_uint16(d);
-		data_len = sldns_read_uint16(d+2);
-		d += 4;
-		rdatalen -= 4;
-
-		/* verify that we have data_len data */
-		if(data_len > rdatalen) {
-			/* It is malformed, but if there are addresses
-			 * in there it can be rejected. */
-			data_len = rdatalen;
-		}
-
-		if(!data_len)
-			continue; /* no data for the svcparamkey */
-
-		if(svcparamkey == SVCB_KEY_IPV4HINT) {
-			if(svcb_ipv4hint_contains_priv_addr(priv, d, data_len,
-				addr, addrlen))
-				return 1;
-		} else if(svcparamkey == SVCB_KEY_IPV6HINT) {
-			if(svcb_ipv6hint_contains_priv_addr(priv, d, data_len,
-				addr, addrlen))
-				return 1;
-		}
-		d += data_len;
-		rdatalen -= data_len;
-	}
-	/* If rdatalen != 0 here, then the svcb rdata is malformed. */
-	return 0;
-}
-
-/**
- * Check if the SVCB and HTTPS rrset is bad.
- * @param priv: private address lookup struct.
- * @param pkt: the packet.
- * @param rrset: the rrset to check.
- * @return 1 if the entire rrset has to be removed. 0 if not.
- * It removes RRs if they have private addresses, and log that.
- */
-static int priv_svcb_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
-	struct rrset_parse* rrset)
-{
-	struct rr_parse* rr, *prev = NULL;
-	struct sockaddr_storage addr;
-	socklen_t addrlen = (socklen_t)sizeof(addr);
-	for(rr = rrset->rr_first; rr; rr = rr->next) {
-		if(svcb_rr_contains_priv_addr(priv, pkt, rr, &addr,
-			&addrlen)) {
-			if(msgparse_rrset_remove_rr("sanitize: removing public name with private address", pkt, rrset, prev, rr, &addr, addrlen))
-				return 1;
-			continue;
-		}
-		prev = rr;
-	}
-	return 0;
-}
-
 int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 	struct rrset_parse* rrset)
 {
@@ -430,11 +268,7 @@ int priv_rrset_bad(struct iter_priv* priv, sldns_buffer* pkt,
 				}
 				prev = rr;
 			}
-		} else if(rrset->type == LDNS_RR_TYPE_SVCB ||
-			rrset->type == LDNS_RR_TYPE_HTTPS) {
-			if(priv_svcb_rrset_bad(priv, pkt, rrset))
-				return 1;
-		}
+		} 
 	}
 	return 0;
 }

iterator/iter_scrub.c

@@ -285,17 +285,6 @@ synth_cname_rrset(uint8_t** sname, size_t* snamelen, uint8_t* alias,
 		return NULL;
 	memmove(cn->rr_first->ttl_data, rrset->rr_first->ttl_data,
 		sizeof(uint32_t)); /* RFC6672: synth CNAME TTL == DNAME TTL */
-	/* Apply cache TTL policy so DNAME and synthesized CNAME stay equal
-	 * and respect cache-min-ttl/cache-max-ttl (same as rdata_copy path). */
-	if(!SERVE_ORIGINAL_TTL) {
-		uint32_t ttl = sldns_read_uint32(cn->rr_first->ttl_data);
-		time_t ttl_t = (time_t)ttl;
-		if(ttl_t < MIN_TTL) ttl_t = MIN_TTL;
-		if(ttl_t > MAX_TTL) ttl_t = MAX_TTL;
-		ttl = (uint32_t)ttl_t;
-		sldns_write_uint32(cn->rr_first->ttl_data, ttl);
-		sldns_write_uint32(rrset->rr_first->ttl_data, ttl);
-	}
 	sldns_write_uint16(cn->rr_first->ttl_data+4, aliaslen);
 	memmove(cn->rr_first->ttl_data+6, alias, aliaslen);
 	cn->rr_first->size = sizeof(uint16_t)+aliaslen;
@@ -419,43 +408,6 @@ shorten_rrset(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
 	else	rrset->rr_first = NULL;
 }
 
-/** Shorten RRSIGs list */
-static void
-shorten_rrsig(sldns_buffer* pkt, struct rrset_parse* rrset, int count)
-{
-	/* The too large list of RRSIGs on the RRset is shortened.
-	 * This is so that too large content does not overwhelm the cache.
-	 * The validator does not validate more than a max number of
-	 * RRSIGs as well. */
-	int i;
-	struct rr_parse* rr = rrset->rrsig_first, *prev = NULL;
-	if(!rr)
-		return;
-	for(i=0; i<count; i++) {
-		prev = rr;
-		rr = rr->next;
-		if(!rr)
-			return; /* The RRSIG list is already short. */
-	}
-	if(verbosity >= VERB_QUERY
-		&& rrset->dname_len <= LDNS_MAX_DOMAINLEN) {
-		uint8_t buf[LDNS_MAX_DOMAINLEN+1];
-		dname_pkt_copy(pkt, buf, rrset->dname);
-		log_nametypeclass(VERB_QUERY, "normalize: shorten RRSIGs:",
-			buf, rrset->type, ntohs(rrset->rrset_class));
-	}
-	/* remove further rrsigs */
-	rrset->rrsig_last = prev;
-	rrset->rrsig_count = count;
-	while(rr) {
-		rrset->size -= rr->size;
-		rr = rr->next;
-	}
-	if(rrset->rrsig_last)
-		rrset->rrsig_last->next = NULL;
-	else	rrset->rrsig_first = NULL;
-}
-
 /**
  * This routine normalizes a response. This includes removing "irrelevant"
  * records from the answer and additional sections and (re)synthesizing
@@ -493,8 +445,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 	prev = NULL;
 	rrset = msg->rrset_first;
 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
-		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
-			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		if(cname_length > env->cfg->iter_scrub_cname) {
 			/* Too many CNAMEs, or DNAMEs, from the authority
 			 * server, scrub down the length to something
@@ -505,9 +455,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				pkt, msg, prev, &rrset);
 			continue;
 		}
-		if(rrset->type == LDNS_RR_TYPE_DNAME &&
-			pkt_strict_sub(pkt, sname, rrset->dname) &&
-			pkt_sub(pkt, rrset->dname, zonename)) {
+		if(rrset->type == LDNS_RR_TYPE_DNAME && 
+			pkt_strict_sub(pkt, sname, rrset->dname)) {
 			/* check if next rrset is correct CNAME. else,
 			 * synthesize a CNAME */
 			struct rrset_parse* nx = rrset->rrset_all_next;
@@ -553,6 +502,8 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				log_err("out of memory synthesizing CNAME");
 				return 0;
 			}
+			/* FIXME: resolve the conflict between synthesized 
+			 * CNAME ttls and the cache. */
 			rrset = nx;
 			continue;
 
@@ -574,8 +525,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			if(nx && nx->section == LDNS_SECTION_ANSWER &&
 				nx->type == LDNS_RR_TYPE_DNAME &&
 				nx->rr_count == 1 &&
-				pkt_strict_sub(pkt, sname, nx->dname) &&
-				pkt_sub(pkt, nx->dname, zonename)) {
+				pkt_strict_sub(pkt, sname, nx->dname)) {
 				/* there is a DNAME after this CNAME, it 
 				 * is in the ANSWER section, and the DNAME
 				 * applies to the name we cover */
@@ -670,8 +620,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
-			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		/* only one NS set allowed in authority section */
 		if(rrset->type==LDNS_RR_TYPE_NS) {
 			/* NS set must be pertinent to the query */
@@ -814,8 +762,6 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
-		if((int)rrset->rrsig_count > env->cfg->iter_scrub_rrsig)
-			shorten_rrsig(pkt, rrset, env->cfg->iter_scrub_rrsig);
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -1026,10 +972,8 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 		}
 
 		/* remove private addresses */
-		if(rrset->type == LDNS_RR_TYPE_A ||
-			rrset->type == LDNS_RR_TYPE_AAAA ||
-			rrset->type == LDNS_RR_TYPE_SVCB ||
-			rrset->type == LDNS_RR_TYPE_HTTPS) {
+		if( (rrset->type == LDNS_RR_TYPE_A || 
+			rrset->type == LDNS_RR_TYPE_AAAA)) {
 
 			/* do not set servfail since this leads to too
 			 * many drops of other people using rfc1918 space */

iterator/iter_utils.c

@@ -308,30 +308,9 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	if(a->bogus)
 		return -1; /* address of server is bogus */
 	if(donotq_lookup(iter_env->donotq, &a->addr, a->addrlen)) {
-		if(iter_env->nat64.use_nat64 &&
-			addr_is_ip6(&a->addr, a->addrlen) &&
-			a->addrlen == iter_env->nat64.nat64_prefix_addrlen &&
-			addr_in_common(&a->addr, 128,
-				&iter_env->nat64.nat64_prefix_addr,
-				iter_env->nat64.nat64_prefix_net,
-				iter_env->nat64.nat64_prefix_addrlen) ==
-				iter_env->nat64.nat64_prefix_net) {
-			/* The NAT64 is enabled, and address is IPv6, it is
-			 * in the NAT64 prefix. It is allowed.
-			 * So that in an IPv6-only cluster without internet
-			 * access, that makes the NAT64 translation continue
-			 * to work. The NAT64 prefix is allowed. */
-			/* Otherwise, after a timeout, the already NAT64
-			 * translated address would be treated differently,
-			 * and that causes confusion. */
-			log_addr(VERB_ALGO, "the addr is on the donotquery "
-				"list, but allowed because it is NAT64",
-				&a->addr, a->addrlen);
-		} else {
-			log_addr(VERB_ALGO, "skip addr on the donotquery list",
-				&a->addr, a->addrlen);
-			return -1; /* server is on the donotquery list */
-		}
+		log_addr(VERB_ALGO, "skip addr on the donotquery list",
+			&a->addr, a->addrlen);
+		return -1; /* server is on the donotquery list */
 	}
 	if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip6 available */
@@ -1548,11 +1527,6 @@ iter_stub_fwd_no_cache(struct module_qstate *qstate, struct query_info *qinf,
 	struct delegpt *dp;
 	int nolock = 1;
 
-	log_assert((retdpname && retdpnamelen
-		&& dpname_storage && dpname_storage_len > 0) ||
-		(retdpname == NULL && retdpnamelen == NULL
-		 && dpname_storage == NULL && dpname_storage_len == 0));
-
 	/* Check for stub. */
 	/* Lock both forwards and hints for atomic read. */
 	lock_rw_rdlock(&qstate->env->fwds->lock);

iterator/iterator.c

@@ -297,7 +297,6 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 	struct reply_info err;
 	struct msgreply_entry* msg;
 	if(qstate->no_cache_store) {
-		qstate->error_response_cache = 1;
 		return error_response(qstate, id, rcode);
 	}
 	if(qstate->prefetch_leeway > NORR_TTL) {
@@ -3224,19 +3223,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	} else iter_scrub_ds(iq->response, NULL, NULL);
 	if(type == RESPONSE_TYPE_THROWAWAY &&
 		FLAGS_GET_RCODE(iq->response->rep->flags) == LDNS_RCODE_YXDOMAIN) {
-		/* YXDOMAIN is a permanent error for DNAME expansion overflow
-		 * (RFC 6672 Section 2.2). Only accept if the response
-		 * contains a DNAME record in the answer section; otherwise
-		 * treat as invalid, to make sure the authoritative answer
-		 * make sense. */
-		size_t i;
-		for(i=0; i<iq->response->rep->an_numrrsets; i++) {
-			if(ntohs(iq->response->rep->rrsets[i]->rk.type)
-				== LDNS_RR_TYPE_DNAME) {
-				type = RESPONSE_TYPE_ANSWER;
-				break;
-			}
-		}
+		/* YXDOMAIN is a permanent error, no need to retry */
+		type = RESPONSE_TYPE_ANSWER;
 	}
 	if(type == RESPONSE_TYPE_CNAME)
 		origtypecname = 1;

makedist.sh

@@ -142,7 +142,7 @@ check_git_repo () {
 create_temp_dir () {
     # Creating temp directory
     info "Creating temporary working directory"
-    temp_dir=`mktemp -d unbound-dist-XXXXXX`
+    temp_dir=`mktemp -t -d unbound-dist-XXXXXX`
     info "Directory '$temp_dir' created."
     cd $temp_dir
 }
@@ -409,7 +409,14 @@ if [ "$DOWIN" = "yes" ]; then
 	info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 	git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"
 	cd unbound || error_cleanup "Unbound not exported correctly from git"
-	rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+	git submodule update --init || error_cleanup "Could not fetch submodule"
+	rm -rf .git .travis.yml .gitattributes .gitmodules .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+	rm -rf simdzone/.git simdzone/.github simdzone/.gitignore \
+	       simdzone/configure~ simdzone/config.h.in~ simdzone/autom4te.cache \
+	       simdzone/cmake simdzone/CMakeLists.txt simdzone/simdzoneConfig.cmake.in \
+	       simdzone/conanfile.txt simdzone/tests simdzone/.readthedocs.yaml \
+	       simdzone/doc simdzone/scripts || \
+	       error_cleanup "Failed to remove simdzone .git tracking and ci information"
 
 	# on a re-configure the cache may no longer be valid...
 	if test -f mingw32-config.cache; then rm mingw32-config.cache; fi
@@ -436,11 +443,14 @@ if [ "$DOWIN" = "yes" ]; then
 	replace_version "configure.ac" "$version" "$version2"
     	version="$version2"
     	info "Rebuilding configure script (autoconf) snapshot."
-	autoconf -f || error_cleanup "Autoconf failed."
+	autoreconf -fi || error_cleanup "Autoconf failed."
 	autoheader -f || error_cleanup "Autoheader failed."
     	rm -r autom4te* || echo "ignored"
 	rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 	rm -f configure~ || echo "ignore absence of configure~ file."
+	rm -r simdzone/autom4te* || echo "ignored"
+	rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
+	rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."
     fi
 
     if test "`uname`" = "Linux"; then 
@@ -598,7 +608,15 @@ info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"
 
 cd unbound || error_cleanup "Unbound not exported correctly from git"
-rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+git submodule update --init || error_cleanup "Could not fetch submodule"
+rm -rf .git .travis.yml .gitattributes .gitmodules .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+rm -rf simdzone/.git simdzone/.github simdzone/.gitignore \
+       simdzone/configure~ simdzone/config.h.in~ simdzone/autom4te.cache \
+       simdzone/cmake simdzone/CMakeLists.txt simdzone/simdzoneConfig.cmake.in \
+       simdzone/conanfile.txt simdzone/tests simdzone/.readthedocs.yaml \
+       simdzone/doc simdzone/scripts || \
+       error_cleanup "Failed to remove simdzone .git tracking and ci information"
+
 
 info "Adding libtool utils (libtoolize)."
 libtoolize -c --install || libtoolize -c || error_cleanup "Libtoolize failed."
@@ -618,11 +636,14 @@ if [ `uname -s | grep -i -c darwin` -ne 0 ]; then
 fi
 
 info "Building configure script (autoreconf)."
-autoreconf -f || error_cleanup "Autoconf failed."
+autoreconf -fi || error_cleanup "Autoconf failed."
 
 rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
 rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
 rm -f configure~ || echo "ignore absence of configure~ file."
+rm -r simdzone/autom4te* || echo "ignored"
+rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
+rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."
 
 info "Building lexer and parser."
 echo "#include \"config.h\"" > util/configlexer.c || error_cleanup "Failed to create configlexer"
@@ -665,10 +686,13 @@ fi
 
 if [ "$RECONFIGURE" = "yes" ]; then
     info "Rebuilding configure script (autoconf) snapshot."
-    autoreconf -f || error_cleanup "Autoconf failed."
+    autoreconf -fi || error_cleanup "Autoconf failed."
     rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
     rm -f config.h.in~ || echo "ignore absence of config.h.in~ file."
     rm -f configure~ || echo "ignore absence of configure~ file."
+    rm -r simdzone/autom4te* || echo "ignored"
+    rm -f simdzone/config.h.in~ || echo "ignore absence of simdzone/config.h.in~ file."
+    rm -f simdzone/configure~ || echo "ignore absence of simdzone/configure~ file."
 fi
 
 replace_all doc/README
@@ -685,7 +709,7 @@ info "Renaming Unbound directory to unbound-$version."
 cd ..
 mv unbound unbound-$version || error_cleanup "Failed to rename unbound directory."
 
-tarfile="../unbound-$version.tar.gz"
+tarfile="$cwd/unbound-$version.tar.gz"
 
 if [ -f $tarfile ]; then
     (question "The file $tarfile already exists.  Overwrite?" \
@@ -693,7 +717,7 @@ if [ -f $tarfile ]; then
 fi
 
 info "Creating tar unbound-$version.tar.gz"
-tar czf ../unbound-$version.tar.gz unbound-$version || error_cleanup "Failed to create tar file."
+tar czf $tarfile unbound-$version || error_cleanup "Failed to create tar file."
 
 cleanup
 

respip/respip.c

@@ -973,9 +973,6 @@ respip_rewrite_reply(const struct query_info* qinfo,
 					lock_rw_unlock(&raddr->lock);
 					lock_rw_unlock(&a->lock);
 					lock_rw_unlock(&az->rpz_lock);
-					if(view) {
-                    	lock_rw_unlock(&view->lock);
-					}
 					return 0;
 				}
 				if(rpz_used) {

services/authzone.c

@@ -72,7 +72,11 @@
 #include "validator/val_sigcrypt.h"
 #include "validator/val_anchor.h"
 #include "validator/val_utils.h"
+#include "zone.h"
 #include <ctype.h>
+#ifdef HAVE_SYS_STAT_H
+#include <sys/stat.h>
+#endif
 
 /** bytes to use for NSEC3 hash buffer. 20 for sha1 */
 #define N3HASHBUFLEN 32
@@ -702,13 +706,15 @@ az_rrset_find_rrsig(struct packed_rrset_data* d, uint8_t* rdata, size_t len,
 
 /** see if rdata is duplicate */
 static int
-rdata_duplicate(struct packed_rrset_data* d, uint8_t* rdata, size_t len)
+rdata_duplicate(struct packed_rrset_data* d, uint8_t* rdata_wol, size_t len)
 {
-	size_t i;
+	size_t i, rdatawl_len = len+2;
+	uint16_t len16 = htons(len);
 	for(i=0; i<d->count + d->rrsig_count; i++) {
-		if(d->rr_len[i] != len)
+		if(d->rr_len[i] != rdatawl_len)
 			continue;
-		if(memcmp(d->rr_data[i], rdata, len) == 0)
+		if(memcmp(d->rr_data[i], &len16, 2) == 0 &&
+		   memcmp(d->rr_data[i]+2, rdata_wol, len) == 0)
 			return 1;
 	}
 	return 0;
@@ -727,6 +733,19 @@ rrsig_rdata_get_type_covered(uint8_t* rdata, size_t rdatalen)
 	return sldns_read_uint16(rdata+2);
 }
 
+/** get rrsig type covered from rdata.
+ * @param rdata_wol: rdata in wireformat, without the prefix rdlength.
+ * @param rdatalen: length of rdata buffer.
+ * @return type covered (or 0).
+ */
+static uint16_t
+rrsig_rdata_get_type_covered_wol(uint8_t* rdata_wol, size_t rdatalen)
+{
+	if(rdatalen < 2)
+		return 0;
+	return sldns_read_uint16(rdata_wol);
+}
+
 /** remove RR from existing RRset. Also sig, if it is a signature.
  * reallocates the packed rrset for a new one, false on alloc failure */
 static int
@@ -792,7 +811,7 @@ rrset_remove_rr(struct auth_rrset* rrset, size_t index)
 /** add RR to existing RRset. If insert_sig is true, add to rrsigs. 
  * This reallocates the packed rrset for a new one */
 static int
-rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
+rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata_wol,
 	size_t rdatalen, int insert_sig)
 {
 	struct packed_rrset_data* d, *old = rrset->data;
@@ -800,7 +819,7 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
 
 	d = (struct packed_rrset_data*)calloc(1, packed_rrset_sizeof(old)
 		+ sizeof(size_t) + sizeof(uint8_t*) + sizeof(time_t)
-		+ rdatalen);
+		+ 2 /* rdlen */ + rdatalen);
 	if(!d) {
 		log_err("out of memory");
 		return 0;
@@ -823,8 +842,8 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
 		memmove(d->rr_len+d->count, old->rr_len+old->count,
 			old->rrsig_count*sizeof(size_t));
 	if(!insert_sig)
-		d->rr_len[d->count-1] = rdatalen;
-	else	d->rr_len[total-1] = rdatalen;
+		d->rr_len[d->count-1] = rdatalen + 2;
+	else	d->rr_len[total-1] = rdatalen + 2;
 	packed_rrset_ptr_fixup(d);
 	if((time_t)rr_ttl < d->ttl)
 		d->ttl = rr_ttl;
@@ -849,10 +868,12 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
 	/* insert new value */
 	if(!insert_sig) {
 		d->rr_ttl[d->count-1] = rr_ttl;
-		memmove(d->rr_data[d->count-1], rdata, rdatalen);
+		sldns_write_uint16(d->rr_data[d->count-1], rdatalen);
+		memmove(d->rr_data[d->count-1]+2, rdata_wol, rdatalen);
 	} else {
 		d->rr_ttl[total-1] = rr_ttl;
-		memmove(d->rr_data[total-1], rdata, rdatalen);
+		sldns_write_uint16(d->rr_data[total-1], rdatalen);
+		memmove(d->rr_data[total-1]+2, rdata_wol, rdatalen);
 	}
 
 	rrset->data = d;
@@ -860,10 +881,11 @@ rrset_add_rr(struct auth_rrset* rrset, uint32_t rr_ttl, uint8_t* rdata,
 	return 1;
 }
 
-/** Create new rrset for node with packed rrset with one RR element */
+/** Create new rrset for node with packed rrset with one RR element.
+ * rdata_wol is the rdata without prefixed rdlength. */
 static struct auth_rrset*
 rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
-	uint8_t* rdata, size_t rdatalen)
+	uint8_t* rdata_wol, size_t rdatalen)
 {
 	struct auth_rrset* rrset = (struct auth_rrset*)calloc(1,
 		sizeof(*rrset));
@@ -878,7 +900,7 @@ rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
 	/* the rrset data structure, with one RR */
 	d = (struct packed_rrset_data*)calloc(1,
 		sizeof(struct packed_rrset_data) + sizeof(size_t) +
-		sizeof(uint8_t*) + sizeof(time_t) + rdatalen);
+		sizeof(uint8_t*) + sizeof(time_t) + 2 /* rdlen*/ + rdatalen);
 	if(!d) {
 		free(rrset);
 		log_err("out of memory");
@@ -893,9 +915,10 @@ rrset_create(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
 	d->rr_data[0] = (uint8_t*)&(d->rr_ttl[1]);
 
 	/* insert the RR */
-	d->rr_len[0] = rdatalen;
+	d->rr_len[0] = rdatalen + 2;
 	d->rr_ttl[0] = rr_ttl;
-	memmove(d->rr_data[0], rdata, rdatalen);
+	sldns_write_uint16(d->rr_data[0], rdatalen);
+	memmove(d->rr_data[0]+2, rdata_wol, rdatalen);
 	d->count++;
 
 	/* insert rrset into linked list for domain */
@@ -1079,14 +1102,14 @@ rrsigs_copy_from_rrset_to_rrsigset(struct auth_rrset* rrset,
 	 * duplicates are ignored */
 	for(i=rrset->data->count;
 		i<rrset->data->count+rrset->data->rrsig_count; i++) {
-		uint8_t* rdata = rrset->data->rr_data[i];
-		size_t rdatalen = rrset->data->rr_len[i];
+		uint8_t* rdata_wol = rrset->data->rr_data[i]+2;
+		size_t rdatalen = rrset->data->rr_len[i]-2;
 		time_t rr_ttl  = rrset->data->rr_ttl[i];
 
-		if(rdata_duplicate(rrsigset->data, rdata, rdatalen)) {
+		if(rdata_duplicate(rrsigset->data, rdata_wol, rdatalen)) {
 			continue;
 		}
-		if(!rrset_add_rr(rrsigset, rr_ttl, rdata, rdatalen, 0))
+		if(!rrset_add_rr(rrsigset, rr_ttl, rdata_wol, rdatalen, 0))
 			return 0;
 	}
 	return 1;
@@ -1096,32 +1119,35 @@ rrsigs_copy_from_rrset_to_rrsigset(struct auth_rrset* rrset,
  * rdata points to buffer with rdatalen octets, starts with 2bytelength. */
 static int
 az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
-	uint8_t* rdata, size_t rdatalen, int* duplicate)
+	uint8_t* rdata_wol, size_t rdatalen, int* duplicate)
 {
 	struct auth_rrset* rrset;
 	/* packed rrsets have their rrsigs along with them, sort them out */
 	if(rr_type == LDNS_RR_TYPE_RRSIG) {
-		uint16_t ctype = rrsig_rdata_get_type_covered(rdata, rdatalen);
+		uint16_t ctype = rrsig_rdata_get_type_covered_wol(rdata_wol,
+			rdatalen);
 		if((rrset=az_domain_rrset(node, ctype))!= NULL) {
 			/* a node of the correct type exists, add the RRSIG
 			 * to the rrset of the covered data type */
-			if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
+			if(rdata_duplicate(rrset->data, rdata_wol, rdatalen)) {
 				if(duplicate) *duplicate = 1;
 				return 1;
 			}
-			if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 1))
+			if(!rrset_add_rr(rrset, rr_ttl, rdata_wol, rdatalen,
+				1))
 				return 0;
 		} else if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
 			/* add RRSIG to rrset of type RRSIG */
-			if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
+			if(rdata_duplicate(rrset->data, rdata_wol, rdatalen)) {
 				if(duplicate) *duplicate = 1;
 				return 1;
 			}
-			if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0))
+			if(!rrset_add_rr(rrset, rr_ttl, rdata_wol, rdatalen,
+				0))
 				return 0;
 		} else {
 			/* create rrset of type RRSIG */
-			if(!rrset_create(node, rr_type, rr_ttl, rdata,
+			if(!rrset_create(node, rr_type, rr_ttl, rdata_wol,
 				rdatalen))
 				return 0;
 		}
@@ -1129,17 +1155,18 @@ az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
 		/* normal RR type */
 		if((rrset=az_domain_rrset(node, rr_type))!= NULL) {
 			/* add data to existing node with data type */
-			if(rdata_duplicate(rrset->data, rdata, rdatalen)) {
+			if(rdata_duplicate(rrset->data, rdata_wol, rdatalen)) {
 				if(duplicate) *duplicate = 1;
 				return 1;
 			}
-			if(!rrset_add_rr(rrset, rr_ttl, rdata, rdatalen, 0))
+			if(!rrset_add_rr(rrset, rr_ttl, rdata_wol, rdatalen,
+				0))
 				return 0;
 		} else {
 			struct auth_rrset* rrsig;
 			/* create new node with data type */
-			if(!(rrset=rrset_create(node, rr_type, rr_ttl, rdata,
-				rdatalen)))
+			if(!(rrset=rrset_create(node, rr_type, rr_ttl,
+				rdata_wol, rdatalen)))
 				return 0;
 
 			/* see if node of type RRSIG has signatures that
@@ -1156,21 +1183,16 @@ az_domain_add_rr(struct auth_data* node, uint16_t rr_type, uint32_t rr_ttl,
 	return 1;
 }
 
-/** insert RR into zone, ignore duplicates */
+/** insert RR as name,rdata into zone, ignore duplicates.
+ * The rdata_wol is the rdata without the prefix rdlength, because simdzone
+ * returns that as the parsed rdata byte string. */
 static int
-az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
-	size_t dname_len, int* duplicate)
+az_insert_rr_as_rdata(struct auth_zone* z, uint8_t* dname, size_t dname_len,
+	uint16_t rr_type, uint16_t rr_class, uint32_t rr_ttl,
+	uint8_t* rdata_wol, size_t rdatalen, int* duplicate,
+	uint8_t* rr, size_t rr_len)
 {
 	struct auth_data* node;
-	uint8_t* dname = rr;
-	uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len);
-	uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len);
-	uint32_t rr_ttl = sldns_wirerr_get_ttl(rr, rr_len, dname_len);
-	size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len,
-		dname_len))+2;
-	/* rdata points to rdata prefixed with uint16 rdatalength */
-	uint8_t* rdata = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len);
-
 	if(rr_class != z->dclass) {
 		log_err("wrong class for RR");
 		return 0;
@@ -1179,20 +1201,64 @@ az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
 		log_err("cannot create domain");
 		return 0;
 	}
-	if(!az_domain_add_rr(node, rr_type, rr_ttl, rdata, rdatalen,
+	if(!az_domain_add_rr(node, rr_type, rr_ttl, rdata_wol, rdatalen,
 		duplicate)) {
 		log_err("cannot add RR to domain");
 		return 0;
 	}
 	if(z->rpz) {
+		uint8_t* rdata_wl;
+		uint8_t buf[65536];
+		if(rr == NULL) {
+			/* spool it into buffer. */
+			log_assert(dname);
+			if(dname_len + 10 /* type, class, ttl, rdlength */ +
+				rdatalen > sizeof(buf)) {
+				char dstr[LDNS_MAX_DOMAINLEN], t[16], c[16];
+				dname_str(dname, dstr);
+				sldns_wire2str_type_buf(rr_type, t, sizeof(t));
+				sldns_wire2str_class_buf(rr_class, c, sizeof(c));
+				log_err("record exceeds buffer length, %s %s %s", dstr, c, t);
+				return 0;
+			}
+			rr = buf;
+			rr_len = dname_len
+				+ 10 /* type, class, ttl, rdlength */ +
+				rdatalen;
+			memcpy(buf, dname, dname_len);
+			sldns_write_uint16(buf+dname_len, rr_type);
+			sldns_write_uint16(buf+dname_len+2, rr_class);
+			sldns_write_uint32(buf+dname_len+4, rr_ttl);
+			sldns_write_uint16(buf+dname_len+8, rdatalen);
+			memmove(buf+dname_len+10, rdata_wol, rdatalen);
+		}
+		rdata_wl = sldns_wirerr_get_rdatawl(rr, rr_len, dname_len);
 		if(!(rpz_insert_rr(z->rpz, z->name, z->namelen, dname,
-			dname_len, rr_type, rr_class, rr_ttl, rdata, rdatalen,
-			rr, rr_len)))
+			dname_len, rr_type, rr_class, rr_ttl, rdata_wl,
+			rdatalen+2, rr, rr_len)))
 			return 0;
 	}
 	return 1;
 }
 
+/** insert RR into zone, ignore duplicates */
+static int
+az_insert_rr(struct auth_zone* z, uint8_t* rr, size_t rr_len,
+	size_t dname_len, int* duplicate)
+{
+	uint8_t* dname = rr;
+	uint16_t rr_type = sldns_wirerr_get_type(rr, rr_len, dname_len);
+	uint16_t rr_class = sldns_wirerr_get_class(rr, rr_len, dname_len);
+	uint32_t rr_ttl = sldns_wirerr_get_ttl(rr, rr_len, dname_len);
+	size_t rdatalen = ((size_t)sldns_wirerr_get_rdatalen(rr, rr_len,
+		dname_len));
+	/* rdata points to rdata without prefix rdlength. */
+	uint8_t* rdata_wol = sldns_wirerr_get_rdata(rr, rr_len, dname_len);
+
+	return az_insert_rr_as_rdata(z, dname, dname_len, rr_type, rr_class,
+		rr_ttl, rdata_wol, rdatalen, duplicate, rr, rr_len);
+}
+
 /** Remove rr from node, ignores nonexisting RRs,
  * rdata points to buffer with rdatalen octets, starts with 2bytelength. */
 static int
@@ -1369,10 +1435,6 @@ decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt,
 				uncompressed_len = pkt_dname_len(&pktbuf);
 				if(!uncompressed_len)
 					return 0; /* parse error in dname */
-				compressed_len = sldns_buffer_position(
-					&pktbuf) - oldpos;
-				if(compressed_len > rdlen)
-					return 0; /* dname exceeds rdata */
 				if(!sldns_buffer_available(buf,
 					uncompressed_len))
 					/* dname too long for buffer */
@@ -1380,15 +1442,14 @@ decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt,
 				dname_pkt_copy(&pktbuf, 
 					sldns_buffer_current(buf), rd);
 				sldns_buffer_skip(buf, (ssize_t)uncompressed_len);
+				compressed_len = sldns_buffer_position(
+					&pktbuf) - oldpos;
 				rd += compressed_len;
 				rdlen -= compressed_len;
 				count--;
 				len = 0;
 				break;
 			case LDNS_RDF_TYPE_STR:
-				/* Check rdlen for resilience, because it is
-				 * checked above, that rdlen > 0 */
-				if(rdlen < 1) return 0; /* malformed */
 				len = rd[0] + 1;
 				break;
 			default:
@@ -1396,8 +1457,6 @@ decompress_rr_into_buffer(struct sldns_buffer* buf, uint8_t* pkt,
 				break;
 			}
 			if(len) {
-				if(len > rdlen)
-					return 0; /* malformed */
 				if(!sldns_buffer_available(buf, len))
 					return 0; /* too long for buffer */
 				sldns_buffer_write(buf, rd, len);
@@ -1570,13 +1629,153 @@ az_parse_file(struct auth_zone* z, FILE* in, uint8_t* rr, size_t rrbuflen,
 	return 1;
 }
 
+/** Structure for simdzone parse state */
+struct az_parse_state {
+	/** The zone that is processed. */
+	struct auth_zone* z;
+	/** number of errors, if 0 it was read successfully. */
+	int errors;
+	/** for http parse, chunk iterator. */
+	struct auth_chunk* chunk;
+	/** for http parse, position in chunk. */
+	size_t chunk_pos;
+};
+
+/** Callback for simdzone parse, log an error */
+static void
+az_parse_log(zone_parser_t *parser, uint32_t category,
+	const char *file, size_t line, const char *message, void *user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	(void)parser;
+
+	switch (category) {
+	case ZONE_INFO:
+		if (file)
+			log_info("%s:%d: %s", file, (int)line, message);
+		else
+			log_info("%s", message);
+		break;
+	case ZONE_WARNING:
+		if (file)
+			log_warn("%s:%d: %s", file, (int)line, message);
+		else
+			log_warn("%s", message);
+		break;
+	default:
+		if (file)
+			log_err("%s:%d: %s", file, (int)line, message);
+		else
+			log_err("%s", message);
+		state->errors++;
+		break;
+	}
+}
+
+/** Callback for simdzone parse, accept an RR that has been read in. */
+int32_t
+az_parse_accept(zone_parser_t *parser, const zone_name_t *owner,
+	uint16_t type, uint16_t dclass, uint32_t ttl, uint16_t rdlength,
+	const uint8_t *rdata, void *user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	if(verbosity >= 7) {
+		char dname[LDNS_MAX_DOMAINLEN], t[16], c[16];
+		dname_str((uint8_t*)owner->octets, dname);
+		sldns_wire2str_type_buf(type, t, sizeof(t));
+		sldns_wire2str_class_buf(dclass, c, sizeof(c));
+		verbose(7, "zone parse record %s %s %s", dname, c, t);
+	}
+
+	/* Duplicates can be ignored, do not insert them twice. */
+	if(!az_insert_rr_as_rdata(state->z, (uint8_t*)owner->octets,
+		owner->length, type, dclass, ttl, (uint8_t*)rdata, rdlength,
+		NULL, NULL, 0)) {
+		char dname[LDNS_MAX_DOMAINLEN], t[16], c[16];
+		dname_str((uint8_t*)owner->octets, dname);
+		sldns_wire2str_type_buf(type, t, sizeof(t));
+		sldns_wire2str_class_buf(dclass, c, sizeof(c));
+		log_err("record insert allocation failed, %s %s %s",
+			dname, c, t);
+		return ZONE_OUT_OF_MEMORY;
+	}
+	(void)parser;
+	return 0;
+}
+
+/**
+ * Callback for simdzone parse, include a zone file.
+ * It is called for every $INCLUDE entry. It could be used to save
+ * the file names, so that it can track if the files have changed, later.
+ */
+static int32_t
+az_parse_include(zone_parser_t *parser, const char *file,
+	const char *path, void *user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	(void)parser;
+	(void)state;
+	verbose(6, "zone parse descended into include file %s (full path %s)",
+		file, path);
+	return 0;
+}
+
+/**
+ * Parse file with simdzone.
+ */
+static int
+az_parse_file_simdzone(struct auth_zone* z, char* zfilename,
+	struct config_file* cfg)
+{
+	zone_parser_t parser;
+	zone_options_t options;
+	zone_name_buffer_t name_buffer;
+	zone_rdata_buffer_t rdata_buffer;
+	zone_buffers_t buffers = { 1, &name_buffer, &rdata_buffer };
+	struct az_parse_state state;
+
+	memset(&options, 0, sizeof(options));
+	options.origin.octets = z->name;
+	options.origin.length = z->namelen;
+	options.default_ttl = 3600;
+	options.default_class = LDNS_RR_CLASS_IN;
+	options.secondary = z->zone_is_slave;
+	options.pretty_ttls = true; /* non-standard, for backwards compatibility */
+	if(cfg->chrootdir && cfg->chrootdir[0])
+		options.chrootdir = cfg->chrootdir;
+	else	options.chrootdir = NULL;
+	options.log.callback = &az_parse_log;
+	options.accept.callback = &az_parse_accept;
+	options.include.callback = &az_parse_include;
+
+	memset(&state, 0, sizeof(state));
+	state.z = z;
+
+	/* Parse and process all RRs.  */
+	if (zone_parse(&parser, &options, &buffers, zfilename, &state) != 0) {
+		return 0;
+	}
+	return 1;
+}
+
+/** See if the file can be accessed, or if it does not exist. Look at errno. */
+static int
+file_exists(char* filename)
+{
+	struct stat buf;
+	if(stat(filename, &buf) < 0) {
+		return 0;
+	}
+	return 1;
+}
+
 int
 auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 {
+	int use_simdzone = 1;
 	uint8_t rr[LDNS_RR_BUF_SIZE];
 	struct sldns_file_parse_state state;
 	char* zfilename;
-	FILE* in;
 	if(!z || !z->zonefile || z->zonefile[0]==0)
 		return 1; /* no file, or "", nothing to read */
 	
@@ -1589,8 +1788,7 @@ auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 		dname_str(z->name, nm);
 		verbose(VERB_ALGO, "read zonefile %s for %s", zfilename, nm);
 	}
-	in = fopen(zfilename, "r");
-	if(!in) {
+	if(!file_exists(zfilename)) {
 		char* n = sldns_wire2str_dname(z->name, z->namelen);
 		if(z->zone_is_slave && errno == ENOENT) {
 			/* we fetch the zone contents later, no file yet */
@@ -1621,15 +1819,36 @@ auth_zone_read_zonefile(struct auth_zone* z, struct config_file* cfg)
 		state.origin_len = z->namelen;
 	}
 	/* parse the (toplevel) file */
-	if(!az_parse_file(z, in, rr, sizeof(rr), &state, zfilename, 0, cfg)) {
-		char* n = sldns_wire2str_dname(z->name, z->namelen);
-		log_err("error parsing zonefile %s for %s",
-			zfilename, n?n:"error");
-		free(n);
+	if(use_simdzone) {
+		/* Use simdzone. */
+		if(!az_parse_file_simdzone(z, zfilename, cfg)) {
+			char* n = sldns_wire2str_dname(z->name, z->namelen);
+			log_err("error parsing zonefile %s for %s",
+				zfilename, n?n:"error");
+			free(n);
+			return 0;
+		}
+	} else {
+		/* Read with sldns_str2wire functions. */
+		FILE* in;
+		in = fopen(zfilename, "r");
+		if(!in) {
+			char* n = sldns_wire2str_dname(z->name, z->namelen);
+			log_err("cannot open zonefile %s for %s: %s",
+				zfilename, n?n:"error", strerror(errno));
+			free(n);
+			return 0;
+		}
+		if(!az_parse_file(z, in, rr, sizeof(rr), &state, zfilename, 0, cfg)) {
+			char* n = sldns_wire2str_dname(z->name, z->namelen);
+			log_err("error parsing zonefile %s for %s",
+				zfilename, n?n:"error");
+			free(n);
+			fclose(in);
+			return 0;
+		}
 		fclose(in);
-		return 0;
 	}
-	fclose(in);
 
 	if(z->rpz)
 		rpz_finish_config(z->rpz);
@@ -2005,21 +2224,12 @@ auth_zone_get_serial(struct auth_zone* z, uint32_t* serial)
 	struct auth_data* apex;
 	struct auth_rrset* soa;
 	struct packed_rrset_data* d;
-	size_t primlen, mboxlen;
 	apex = az_find_name(z, z->name, z->namelen);
 	if(!apex) return 0;
 	soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
 	if(!soa || soa->data->count==0)
 		return 0; /* no RRset or no RRs in rrset */
 	if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */
-	if((primlen = dname_valid(soa->data->rr_data[0]+2,
-		soa->data->rr_len[0]-2)) == 0)
-		return 0; /* primary dname malformed */
-	if((mboxlen = dname_valid(soa->data->rr_data[0]+2+primlen,
-		soa->data->rr_len[0]-2-primlen)) == 0)
-		return 0; /* mailbox dname malformed */
-	if(2+primlen+mboxlen+4*5 != soa->data->rr_len[0])
-		return 0; /* rdata malformed */
 	d = soa->data;
 	*serial = sldns_read_uint32(d->rr_data[0]+(d->rr_len[0]-20));
 	return 1;
@@ -2032,21 +2242,12 @@ xfr_find_soa(struct auth_zone* z, struct auth_xfer* xfr)
 	struct auth_data* apex;
 	struct auth_rrset* soa;
 	struct packed_rrset_data* d;
-	size_t primlen, mboxlen;
 	apex = az_find_name(z, z->name, z->namelen);
 	if(!apex) return 0;
 	soa = az_domain_rrset(apex, LDNS_RR_TYPE_SOA);
 	if(!soa || soa->data->count==0)
 		return 0; /* no RRset or no RRs in rrset */
 	if(soa->data->rr_len[0] < 2+4*5) return 0; /* SOA too short */
-	if((primlen = dname_valid(soa->data->rr_data[0]+2,
-		soa->data->rr_len[0]-2)) == 0)
-		return 0; /* primary dname malformed */
-	if((mboxlen = dname_valid(soa->data->rr_data[0]+2+primlen,
-		soa->data->rr_len[0]-2-primlen)) == 0)
-		return 0; /* mailbox dname malformed */
-	if(2+primlen+mboxlen+4*5 != soa->data->rr_len[0])
-		return 0; /* rdata malformed */
 	/* SOA record ends with serial, refresh, retry, expiry, minimum,
 	 * as 4 byte fields */
 	d = soa->data;
@@ -5122,14 +5323,11 @@ apply_axfr(struct auth_xfer* xfr, struct auth_zone* z,
 	return 1;
 }
 
-/** apply HTTP to zone in memory. z is locked. false on failure(mallocfail) */
+/** parse http zone with sldns. */
 static int
-apply_http(struct auth_xfer* xfr, struct auth_zone* z,
+parse_http_sldns(struct auth_xfer* xfr, struct auth_zone* z,
 	struct sldns_buffer* scratch_buffer)
 {
-	/* parse data in chunks */
-	/* parse RR's and read into memory. ignore $INCLUDE from the
-	 * downloaded file*/
 	struct sldns_file_parse_state pstate;
 	struct auth_chunk* chunk;
 	size_t chunk_pos;
@@ -5141,6 +5339,184 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 		memmove(pstate.origin, xfr->name, xfr->namelen);
 	}
 
+	chunk = xfr->task_transfer->chunks_first;
+	chunk_pos = 0;
+	pstate.lineno = 0;
+	while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer)) {
+		/* process this line */
+		pstate.lineno++;
+		chunkline_newline_removal(scratch_buffer);
+		if(chunkline_is_comment_line_or_empty(scratch_buffer)) {
+			continue;
+		}
+		/* parse line and add RR */
+		if((ret=http_parse_origin(scratch_buffer, &pstate))!=0) {
+			if(ret == 2) {
+				verbose(VERB_ALGO, "error parsing ORIGIN on line [%s:%d] %s",
+					xfr->task_transfer->master->file,
+					pstate.lineno,
+					sldns_buffer_begin(scratch_buffer));
+				return 0;
+			}
+			continue; /* $ORIGIN has been handled */
+		}
+		if((ret=http_parse_ttl(scratch_buffer, &pstate))!=0) {
+			if(ret == 2) {
+				verbose(VERB_ALGO, "error parsing TTL on line [%s:%d] %s",
+					xfr->task_transfer->master->file,
+					pstate.lineno,
+					sldns_buffer_begin(scratch_buffer));
+				return 0;
+			}
+			continue; /* $TTL has been handled */
+		}
+		if(!http_parse_add_rr(xfr, z, scratch_buffer, &pstate)) {
+			verbose(VERB_ALGO, "error parsing line [%s:%d] %s",
+				xfr->task_transfer->master->file,
+				pstate.lineno,
+				sldns_buffer_begin(scratch_buffer));
+			return 0;
+		}
+	}
+	return 1;
+}
+
+/**
+ * Callback for simdzone parse of http, include a zone file.
+ * It is called for every $INCLUDE entry.
+ */
+static int32_t
+az_http_parse_include(zone_parser_t *parser, const char *file,
+	const char *path, void *user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	char dname[LDNS_MAX_DOMAINLEN];
+	(void)parser;
+	verbose(6, "zone parse has include file %s (full path %s)",
+		file, path);
+	dname_str(state->z->name, dname);
+	verbose(1, "zone parse for zonefile of %s has $INCLUDE %s, but $INCLUDE not followed",
+		dname, file);
+	/* Not expecting a secondary zone file with includes. */
+	return ZONE_SEMANTIC_ERROR;
+}
+
+int32_t az_http_read_data(zone_parser_t* parser, char* data, size_t len,
+	size_t* outlen, void* user_data)
+{
+	struct az_parse_state* state = (struct az_parse_state*)user_data;
+	size_t written = 0;
+	(void)parser;
+
+	if(state->chunk == NULL) {
+		/* End of the chunk list */
+		*outlen = 0;
+		return 0;
+	}
+	if(state->chunk_pos == state->chunk->len) {
+		/* The end of the chunk list is reached, with 0 data. */
+		state->chunk = NULL;
+		*outlen = 0;
+		return 0;
+	}
+	if(len == 0) {
+		*outlen = 0;
+		return 0;
+	}
+
+	/* Fill up the data buffer with the requested amount. */
+	while(written < len) {
+		/* The amount that is wanted. */
+		size_t wanted = len - written;
+		/* That amount that is in this chunk. */
+		size_t avail = state->chunk->len - state->chunk_pos;
+
+		if(wanted < avail) {
+			/* Write a piece of this chunk. */
+			memmove(data+written,
+				state->chunk->data+state->chunk_pos, wanted);
+			state->chunk_pos += wanted;
+			*outlen = len;
+			return 0;
+		}
+		/* Write the entire chunk and continue on. */
+		if(avail > 0)
+			memmove(data+written,
+				state->chunk->data+state->chunk_pos, avail);
+		written += avail;
+
+		/* move to next chunk */
+		state->chunk = state->chunk->next;
+		state->chunk_pos = 0;
+
+		/* Is this the exact amount requested. */
+		if(written == len) {
+			/* continue later. */
+			*outlen = len;
+			return 0;
+		}
+		/* Is there no more data. */
+		if(state->chunk == NULL) {
+			/* End of data. */
+			*outlen = written;
+			return 0;
+		}
+	}
+	*outlen = written;
+	return 0;
+}
+
+/** parse http zone with simdzone. */
+static int
+parse_http_simdzone(struct auth_xfer* xfr, struct auth_zone* z)
+{
+	zone_parser_t parser;
+	zone_options_t options;
+	zone_name_buffer_t name_buffer;
+	zone_rdata_buffer_t rdata_buffer;
+	zone_buffers_t buffers = { 1, &name_buffer, &rdata_buffer };
+	struct az_parse_state state;
+
+	memset(&options, 0, sizeof(options));
+	options.origin.octets = z->name;
+	options.origin.length = z->namelen;
+	options.default_ttl = 3600;
+	options.default_class = LDNS_RR_CLASS_IN;
+	options.secondary = z->zone_is_slave;
+	options.pretty_ttls = true; /* non-standard, for backwards compatibility */
+	options.no_includes = true; /* the secondary zone file transferred over https is not expected to have $INCLUDE files. */
+	/* The log callback for file read prints the error and can be used
+	 * here too. */
+	options.log.callback = &az_parse_log;
+	/* The parse accept callback for file inserts the RR, and can be
+	 * used here too. */
+	options.accept.callback = &az_parse_accept;
+	options.include.callback = &az_http_parse_include;
+
+	memset(&state, 0, sizeof(state));
+	state.z = z;
+	state.chunk = xfr->task_transfer->chunks_first;
+	state.chunk_pos = 0;
+
+	/* Parse and process all RRs.  */
+	if (zone_parse_from_callback(&parser, &options, &buffers,
+		az_http_read_data, &state) != 0) {
+		return 0;
+	}
+	return 1;
+}
+
+/** apply HTTP to zone in memory. z is locked. false on failure(mallocfail) */
+static int
+apply_http(struct auth_xfer* xfr, struct auth_zone* z,
+	struct sldns_buffer* scratch_buffer)
+{
+	int use_simdzone = 1;
+
+	/* parse data in chunks */
+	/* parse RR's and read into memory. ignore $INCLUDE from the
+	 * downloaded file*/
+
 	if(verbosity >= VERB_ALGO)
 		verbose(VERB_ALGO, "http download %s of size %d",
 		xfr->task_transfer->master->file,
@@ -5180,44 +5556,14 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 	xfr->serial = 0;
 	xfr->soa_zone_acquired = 0;
 
-	chunk = xfr->task_transfer->chunks_first;
-	chunk_pos = 0;
-	pstate.lineno = 0;
-	while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer)) {
-		/* process this line */
-		pstate.lineno++;
-		chunkline_newline_removal(scratch_buffer);
-		if(chunkline_is_comment_line_or_empty(scratch_buffer)) {
-			continue;
-		}
-		/* parse line and add RR */
-		if((ret=http_parse_origin(scratch_buffer, &pstate))!=0) {
-			if(ret == 2) {
-				verbose(VERB_ALGO, "error parsing ORIGIN on line [%s:%d] %s",
-					xfr->task_transfer->master->file,
-					pstate.lineno,
-					sldns_buffer_begin(scratch_buffer));
-				return 0;
-			}
-			continue; /* $ORIGIN has been handled */
-		}
-		if((ret=http_parse_ttl(scratch_buffer, &pstate))!=0) {
-			if(ret == 2) {
-				verbose(VERB_ALGO, "error parsing TTL on line [%s:%d] %s",
-					xfr->task_transfer->master->file,
-					pstate.lineno,
-					sldns_buffer_begin(scratch_buffer));
-				return 0;
-			}
-			continue; /* $TTL has been handled */
-		}
-		if(!http_parse_add_rr(xfr, z, scratch_buffer, &pstate)) {
-			verbose(VERB_ALGO, "error parsing line [%s:%d] %s",
-				xfr->task_transfer->master->file,
-				pstate.lineno,
-				sldns_buffer_begin(scratch_buffer));
+	if(use_simdzone) {
+		/* Use simdzone for parse. */
+		if(!parse_http_simdzone(xfr, z))
+			return 0;
+	} else {
+		/* Parse with sldns. */
+		if(!parse_http_sldns(xfr, z, scratch_buffer))
 			return 0;
-		}
 	}
 	return 1;
 }

services/cache/dns.c

@@ -232,15 +232,8 @@ find_closest_of_type(struct module_env* env, uint8_t* qname, size_t qnamelen,
 
 	/* snip off front part of qname until the type is found */
 	while(qnamelen > 0) {
-		rrset = rrset_cache_lookup(env->rrset_cache, qname,
-			qnamelen, searchtype, qclass, 0, now, 0);
-		if(!rrset && searchtype == LDNS_RR_TYPE_DNAME)
-			/* If not found, for type DNAME, try 0TTL stored,
-			 * for its grace period. */
-			rrset = rrset_cache_lookup(env->rrset_cache, qname,
-				qnamelen, searchtype, qclass,
-				PACKED_RRSET_UPSTREAM_0TTL, now, 0);
-		if(rrset) {
+		if((rrset = rrset_cache_lookup(env->rrset_cache, qname, 
+			qnamelen, searchtype, qclass, 0, now, 0))) {
 			uint8_t* origqname = qname;
 			size_t origqnamelen = qnamelen;
 			if(!noexpiredabove)
@@ -773,15 +766,8 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 		rrset->entry.data;
 	uint8_t* newname, *dtarg = NULL;
 	size_t newlen, dtarglen;
-	time_t rr_ttl;
-	if(TTL_IS_EXPIRED(d->ttl, now)) {
-		/* Allow TTL=0 DNAME from upstream within grace period */
-		if(!(rrset->rk.flags & PACKED_RRSET_UPSTREAM_0TTL))
-			return NULL;
-		rr_ttl = 0;
-	} else {
-		rr_ttl = d->ttl - now;
-	}
+	if(TTL_IS_EXPIRED(d->ttl, now))
+		return NULL;
 	/* only allow validated (with DNSSEC) DNAMEs used from cache 
 	 * for insecure DNAMEs, query again. */
 	*sec_status = d->security;
@@ -793,7 +779,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	msg->rep->flags = BIT_QR; /* reply, no AA, no error */
         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 	msg->rep->qdcount = 1;
-	msg->rep->ttl = rr_ttl;
+	msg->rep->ttl = d->ttl - now;
 	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->serve_expired_ttl = msg->rep->ttl + SERVE_EXPIRED_TTL;
 	msg->rep->serve_expired_norec_ttl = 0;
@@ -845,7 +831,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	if(!newd)
 		return NULL;
 	ck->entry.data = newd;
-	newd->ttl = rr_ttl; /* RFC6672: synth CNAME TTL == DNAME TTL */
+	newd->ttl = d->ttl - now; /* RFC6672: synth CNAME TTL == DNAME TTL */
 	newd->count = 1;
 	newd->rrsig_count = 0;
 	newd->trust = rrset_trust_ans_noAA;

services/cache/rrset.c

@@ -278,10 +278,6 @@ void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache,
 	(void)rrset_cache_update(rrset_cache, &ref, alloc, timenow);
 }
 
-/** Grace period in seconds for TTL=0 DNAME rrsets (RFC 2308: do not cache).
- * Allows synthesis from cache within this window to reduce recursion load. */
-#define DNAME_TTL0_GRACE_SECONDS 1
-
 struct ub_packed_rrset_key* 
 rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen, 
 	uint16_t qtype, uint16_t qclass, uint32_t flags, time_t timenow,
@@ -304,20 +300,12 @@ rrset_cache_lookup(struct rrset_cache* r, uint8_t* qname, size_t qnamelen,
 		/* check TTL */
 		struct packed_rrset_data* data = 
 			(struct packed_rrset_data*)e->data;
-		struct ub_packed_rrset_key* k = (struct ub_packed_rrset_key*)e->key;
 		if(TTL_IS_EXPIRED(data->ttl, timenow)) {
-			/* Allow TTL=0 DNAME within grace period for synthesis */
-			if(qtype == LDNS_RR_TYPE_DNAME &&
-			   (k->rk.flags & PACKED_RRSET_UPSTREAM_0TTL) &&
-			   (timenow - data->ttl_add) <= DNAME_TTL0_GRACE_SECONDS) {
-				/* within grace: allow for synthesis */
-			} else {
-				lock_rw_unlock(&e->lock);
-				return NULL;
-			}
+			lock_rw_unlock(&e->lock);
+			return NULL;
 		}
 		/* we're done */
-		return k;
+		return (struct ub_packed_rrset_key*)e->key;
 	}
 	return NULL;
 }

services/listen_dnsport.c

@@ -2300,8 +2300,21 @@ int
 tcp_req_info_handle_read_close(struct tcp_req_info* req)
 {
 	verbose(VERB_ALGO, "tcp channel read side closed %d", req->cp->fd);
-	/* RFC 7766 6.2.4 says to drop pending replies when client closes. */
-	return 0; /* drop connection */
+	/* reset byte count for (potential) partial read */
+	req->cp->tcp_byte_count = 0;
+	/* if we still have results to write, pick up next and write it */
+	if(req->num_done_req != 0) {
+		tcp_req_pickup_next_result(req);
+		tcp_req_info_setup_listen(req);
+		return 1;
+	}
+	/* if nothing to do, this closes the connection */
+	if(req->num_open_req == 0 && req->num_done_req == 0)
+		return 0;
+	/* otherwise, we must be waiting for dns resolve, wait with timeout */
+	req->read_is_closed = 1;
+	tcp_req_info_setup_listen(req);
+	return 1;
 }
 
 void
@@ -3767,7 +3780,7 @@ doq_repinfo_retrieve_localaddr(struct comm_reply* repinfo,
 		memset(sa6, 0, *localaddrlen);
 		sa6->sin6_family = AF_INET6;
 		memmove(&sa6->sin6_addr, &repinfo->pktinfo.v6info.ipi6_addr,
-			sizeof(struct in6_addr));
+			*localaddrlen);
 		sa6->sin6_port = repinfo->doq_srcport;
 #endif
 	} else {
@@ -3777,7 +3790,7 @@ doq_repinfo_retrieve_localaddr(struct comm_reply* repinfo,
 		memset(sa, 0, *localaddrlen);
 		sa->sin_family = AF_INET;
 		memmove(&sa->sin_addr, &repinfo->pktinfo.v4info.ipi_addr,
-			sizeof(struct in_addr));
+			*localaddrlen);
 		sa->sin_port = repinfo->doq_srcport;
 #elif defined(IP_RECVDSTADDR)
 		struct sockaddr_in* sa = (struct sockaddr_in*)localaddr;

services/localzone.c

@@ -56,24 +56,6 @@
  * with 16 bytes for an A record, a 64K packet has about 4000 max */
 #define LOCALZONE_RRSET_COUNT_MAX 4096
 
-static const char* default_zones_reverse_array[] = {
-	"127.in-addr.arpa.", /* reverse ip4 zone */
-	"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", /* reverse ip6 zone */
-	0
-};
-const char** local_zones_default_reverse = default_zones_reverse_array;
-
-static const char* default_zones_special_array[] = {
-	"test.",		/* RFC 6761 */
-	"invalid.",		/* RFC 6761 */
-	"onion.",		/* RFC 7686 */
-	"home.arpa.",		/* RFC 8375 */
-	"resolver.arpa.",	/* RFC 9462 */
-	"service.arpa.",	/* RFC 9665 */
-	0
-};
-const char** local_zones_default_special = default_zones_special_array;
-
 /** print all RRsets in local zone */
 static void
 local_zone_out(struct local_zone* z)
@@ -668,7 +650,7 @@ lz_enter_rr_str(struct local_zones* zones, const char* rr)
 	}
 	labs = dname_count_size_labels(rr_name, &len);
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type, 1);
+	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
 	if(!z) {
 		lock_rw_unlock(&zones->lock);
 		fatal_exit("internal error: no zone for rr %s", rr);
@@ -852,7 +834,7 @@ lz_nodefault(struct config_file* cfg, const char* name)
 
 	for(p = cfg->local_zones_nodefault; p; p = p->next) {
 		/* compare zone name, lowercase, compare without ending . */
-		if(strncasecmp(p->str, name, len) == 0 &&
+		if(strncasecmp(p->str, name, len) == 0 && 
 			(strlen(p->str) == len || (strlen(p->str)==len+1 &&
 			p->str[len] == '.')))
 			return 1;
@@ -860,45 +842,6 @@ lz_nodefault(struct config_file* cfg, const char* name)
 	return 0;
 }
 
-/** enter reverse default zone */
-static int
-add_reverse_default(struct local_zones* zones, struct config_file* cfg,
-        const char* name)
-{
-	struct local_zone* z;
-	char str[1024]; /* known long enough */
-	if(lz_exists(zones, name) || lz_nodefault(cfg, name))
-		return 1; /* do not enter default content */
-	if(!(z=lz_enter_zone(zones, name, "static", LDNS_RR_CLASS_IN)))
-		return 0;
-	snprintf(str, sizeof(str), "%s 10800 IN SOA localhost. "
-		"nobody.invalid. 1 3600 1200 604800 10800", name);
-	if(!lz_enter_rr_into_zone(z, str)) {
-		lock_rw_unlock(&z->lock);
-		return 0;
-	}
-	snprintf(str, sizeof(str), "%s 10800 IN NS localhost. ", name);
-	if(!lz_enter_rr_into_zone(z, str)) {
-		lock_rw_unlock(&z->lock);
-		return 0;
-	}
-	if(strncasecmp("127.in-addr.arpa.", name, 17) ==  0) {
-		if(!lz_enter_rr_into_zone(z,
-			"1.0.0.127.in-addr.arpa. 10800 IN PTR localhost.")) {
-			lock_rw_unlock(&z->lock);
-			return 0;
-		}
-	} else if(strncasecmp("1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", name, 73) ==  0) {
-		snprintf(str, sizeof(str), "%s 10800 IN PTR localhost.", name);
-		if(!lz_enter_rr_into_zone(z, str)) {
-			lock_rw_unlock(&z->lock);
-			return 0;
-		}
-	}
-	lock_rw_unlock(&z->lock);
-	return 1;
-}
-
 /** enter (AS112) empty default zone */
 static int
 add_empty_default(struct local_zones* zones, struct config_file* cfg,
@@ -959,23 +902,72 @@ int local_zone_enter_defaults(struct local_zones* zones, struct config_file* cfg
 		}
 		lock_rw_unlock(&z->lock);
 	}
-
-	/* ip4 and ip6 reverse */
-	for(zstr = local_zones_default_reverse; *zstr; zstr++) {
-		if(!add_reverse_default(zones, cfg, *zstr)) {
+	/* reverse ip4 zone */
+	if(!lz_exists(zones, "127.in-addr.arpa.") &&
+		!lz_nodefault(cfg, "127.in-addr.arpa.")) {
+		if(!(z=lz_enter_zone(zones, "127.in-addr.arpa.", "static", 
+			LDNS_RR_CLASS_IN)) ||
+		   !lz_enter_rr_into_zone(z,
+			"127.in-addr.arpa. 10800 IN NS localhost.") ||
+		   !lz_enter_rr_into_zone(z,
+			"127.in-addr.arpa. 10800 IN SOA localhost. "
+			"nobody.invalid. 1 3600 1200 604800 10800") ||
+		   !lz_enter_rr_into_zone(z,
+			"1.0.0.127.in-addr.arpa. 10800 IN PTR localhost.")) {
 			log_err("out of memory adding default zone");
+			if(z) { lock_rw_unlock(&z->lock); }
 			return 0;
 		}
+		lock_rw_unlock(&z->lock);
 	}
-
-	/* special-use zones */
-	for(zstr = local_zones_default_special; *zstr; zstr++) {
-		if(!add_empty_default(zones, cfg, *zstr)) {
+	/* reverse ip6 zone */
+	if(!lz_exists(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.") &&
+		!lz_nodefault(cfg, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.")) {
+		if(!(z=lz_enter_zone(zones, "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.", "static", 
+			LDNS_RR_CLASS_IN)) ||
+		   !lz_enter_rr_into_zone(z,
+			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN NS localhost.") ||
+		   !lz_enter_rr_into_zone(z,
+			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN SOA localhost. "
+			"nobody.invalid. 1 3600 1200 604800 10800") ||
+		   !lz_enter_rr_into_zone(z,
+			"1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa. 10800 IN PTR localhost.")) {
 			log_err("out of memory adding default zone");
+			if(z) { lock_rw_unlock(&z->lock); }
 			return 0;
 		}
+		lock_rw_unlock(&z->lock);
+	}
+	/* home.arpa. zone (RFC 8375) */
+	if(!add_empty_default(zones, cfg, "home.arpa.")) {
+		log_err("out of memory adding default zone");
+		return 0;
+	}
+	/* resolver.arpa. zone (RFC 9462) */
+	if(!add_empty_default(zones, cfg, "resolver.arpa.")) {
+		log_err("out of memory adding default zone");
+		return 0;
+	}
+	/* service.arpa. zone (draft-ietf-dnssd-srp-25) */
+	if(!add_empty_default(zones, cfg, "service.arpa.")) {
+		log_err("out of memory adding default zone");
+		return 0;
+	}
+	/* onion. zone (RFC 7686) */
+	if(!add_empty_default(zones, cfg, "onion.")) {
+		log_err("out of memory adding default zone");
+		return 0;
+	}
+	/* test. zone (RFC 6761) */
+	if(!add_empty_default(zones, cfg, "test.")) {
+		log_err("out of memory adding default zone");
+		return 0;
+	}
+	/* invalid. zone (RFC 6761) */
+	if(!add_empty_default(zones, cfg, "invalid.")) {
+		log_err("out of memory adding default zone");
+		return 0;
 	}
-
 	/* block AS112 zones, unless asked not to */
 	if(!cfg->unblock_lan_zones) {
 		for(zstr = as112_zones; *zstr; zstr++) {
@@ -1070,15 +1062,14 @@ lz_setup_implicit(struct local_zones* zones, struct config_file* cfg)
 		labs = dname_count_size_labels(rr_name, &len);
 		lock_rw_rdlock(&zones->lock);
 		if(!local_zones_lookup(zones, rr_name, len, labs, rr_class,
-			rr_type, 1)) {
+			rr_type)) {
 			/* Check if there is a zone that this could go
 			 * under but for different class; created zones are
 			 * always for LDNS_RR_CLASS_IN. Create the zone with
 			 * a different class but the same configured
 			 * local_zone_type. */
 			struct local_zone* z = local_zones_lookup(zones,
-				rr_name, len, labs, LDNS_RR_CLASS_IN, rr_type,
-				1);
+				rr_name, len, labs, LDNS_RR_CLASS_IN, rr_type);
 			if(z) {
 				uint8_t* name = memdup(z->name, z->namelen);
 				size_t znamelen = z->namelen;
@@ -1240,48 +1231,28 @@ local_zones_apply_cfg(struct local_zones* zones, struct config_file* cfg)
 
 struct local_zone* 
 local_zones_lookup(struct local_zones* zones,
-        uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
-	int foradd)
+        uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype)
 {
 	return local_zones_tags_lookup(zones, name, len, labs,
-		dclass, dtype, NULL, 0, 1, foradd);
+		dclass, dtype, NULL, 0, 1);
 }
 
 struct local_zone* 
 local_zones_tags_lookup(struct local_zones* zones,
         uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
-	uint8_t* taglist, size_t taglen, int ignoretags, int foradd)
+	uint8_t* taglist, size_t taglen, int ignoretags)
 {
 	rbnode_type* res = NULL;
 	struct local_zone *result;
 	struct local_zone key;
 	int m;
-	key.node.key = &key;
-	key.dclass = dclass;
 	/* for type DS use a zone higher when on a zonecut */
 	if(dtype == LDNS_RR_TYPE_DS && !dname_is_root(name)) {
-		/* If this is at a zone cut, of a local-zone, and it is
-		 * of type always_refuse. Then also refuse the type DS
-		 * for it. That could make it DNSSEC bogus, but it is
-		 * REFUSED anyway. It stops CNAME type answers in the
-		 * type DS lookup. */
-		key.name = name;
-		key.namelen = len;
-		key.namelabs = labs;
-		/* For additions and removals, use the ordinary rule,
-		 * to remove a label for type DS to locate the parent zone.
-		 * That is where the DS RR needs to be put. */
-		if(!foradd &&
-			(result=(struct local_zone*)rbtree_search(
-			&zones->ztree, &key)) != NULL &&
-			result->type == local_zone_always_refuse) {
-			/* The type DS does not go up one label. */
-			return result;
-		} else {
-			dname_remove_label(&name, &len);
-			labs--;
-		}
+		dname_remove_label(&name, &len);
+		labs--;
 	}
+	key.node.key = &key;
+	key.dclass = dclass;
 	key.name = name;
 	key.namelen = len;
 	key.namelabs = labs;
@@ -1892,7 +1863,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 		if(view->local_zones &&
 			(z = local_zones_lookup(view->local_zones,
 			qinfo->qname, qinfo->qname_len, labs,
-			qinfo->qclass, qinfo->qtype, 0))) {
+			qinfo->qclass, qinfo->qtype))) {
 			lock_rw_rdlock(&z->lock);
 			lzt = z->type;
 		}
@@ -1926,7 +1897,7 @@ local_zones_answer(struct local_zones* zones, struct module_env* env,
 		lock_rw_rdlock(&zones->lock);
 		if(!(z = local_zones_tags_lookup(zones, qinfo->qname,
 			qinfo->qname_len, labs, qinfo->qclass, qinfo->qtype,
-			taglist, taglen, 0, 0))) {
+			taglist, taglen, 0))) {
 			lock_rw_unlock(&zones->lock);
 			return 0;
 		}
@@ -2131,8 +2102,7 @@ local_zones_add_RR(struct local_zones* zones, const char* rr)
 	/* could first try readlock then get writelock if zone does not exist,
 	 * but we do not add enough RRs (from multiple threads) to optimize */
 	lock_rw_wrlock(&zones->lock);
-	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type,
-		1);
+	z = local_zones_lookup(zones, rr_name, len, labs, rr_class, rr_type);
 	if(!z) {
 		z = local_zones_add_zone(zones, rr_name, len, labs, rr_class,
 			local_zone_transparent);
@@ -2210,8 +2180,7 @@ void local_zones_del_data(struct local_zones* zones,
 
 	/* remove DS */
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, name, len, labs, dclass, LDNS_RR_TYPE_DS,
-		1);
+	z = local_zones_lookup(zones, name, len, labs, dclass, LDNS_RR_TYPE_DS);
 	if(z) {
 		lock_rw_wrlock(&z->lock);
 		d = local_zone_find_data(z, name, len, labs);
@@ -2225,7 +2194,7 @@ void local_zones_del_data(struct local_zones* zones,
 
 	/* remove other types */
 	lock_rw_rdlock(&zones->lock);
-	z = local_zones_lookup(zones, name, len, labs, dclass, 0, 1);
+	z = local_zones_lookup(zones, name, len, labs, dclass, 0);
 	if(!z) {
 		/* no such zone, we're done */
 		lock_rw_unlock(&zones->lock);

services/localzone.h

@@ -57,9 +57,6 @@ struct sldns_buffer;
 struct comm_reply;
 struct config_strlist;
 
-extern const char** local_zones_default_special;
-extern const char** local_zones_default_reverse;
-
 /**
  * Local zone type
  * This type determines processing for queries that did not match
@@ -265,13 +262,11 @@ void local_zone_delete(struct local_zone* z);
  * @param taglen: length of taglist.
  * @param ignoretags: lookup zone by name and class, regardless the
  * local-zone's tags.
- * @param foradd: if the lookup is for addition or removal of the type.
- *	Used for type DS. The lookup for answers turns this off.
  * @return closest local_zone or NULL if no covering zone is found.
  */
 struct local_zone* local_zones_tags_lookup(struct local_zones* zones, 
 	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
-	uint8_t* taglist, size_t taglen, int ignoretags, int foradd);
+	uint8_t* taglist, size_t taglen, int ignoretags);
 
 /**
  * Lookup zone that contains the given name, class.
@@ -283,13 +278,10 @@ struct local_zone* local_zones_tags_lookup(struct local_zones* zones,
  * @param dclass: class to lookup.
  * @param dtype: type of the record, if type DS then a zone higher up is found
  *   pass 0 to just plain find a zone for a name.
- * @param foradd: if the lookup is for addition or removal of the type.
- *	Used for type DS. The lookup for answers turns this off.
  * @return closest local_zone or NULL if no covering zone is found.
  */
 struct local_zone* local_zones_lookup(struct local_zones* zones, 
-	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype,
-	int foradd);
+	uint8_t* name, size_t len, int labs, uint16_t dclass, uint16_t dtype);
 
 /**
  * Debug helper. Print all zones 

services/mesh.c

@@ -1036,7 +1036,6 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
 	mstate->s.no_cache_store = 0;
 	mstate->s.need_refetch = 0;
 	mstate->s.was_ratelimited = 0;
-	mstate->s.error_response_cache = 0;
 	mstate->s.qstarttime = *env->now;
 
 	/* init modules */
@@ -1076,14 +1075,6 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	if(!mstate->replies_sent) {
 		struct mesh_reply* rep = mstate->reply_list;
 		struct mesh_cb* cb;
-		/* One http2 stream could bring down its comm_point along with
-		 * the other streams which could share the same query. Do all
-		 * the http2 stream bookkeeping upfront. */
-		for(; rep; rep=rep->next) {
-			if(rep->query_reply.c->use_h2)
-				http2_stream_remove_mesh_state(rep->h2_stream);
-		}
-		rep = mstate->reply_list;
 		/* in tcp_req_info, the mstates linked are removed, but
 		 * the reply_list is now NULL, so the remove-from-empty-list
 		 * takes no time and also it does not do the mesh accounting */
@@ -1091,6 +1082,8 @@ mesh_state_cleanup(struct mesh_state* mstate)
 		for(; rep; rep=rep->next) {
 			infra_wait_limit_dec(mesh->env->infra_cache,
 				&rep->query_reply, mesh->env->cfg);
+			if(rep->query_reply.c->use_h2)
+				http2_stream_remove_mesh_state(rep->h2_stream);
 			comm_point_drop_reply(&rep->query_reply);
 			log_assert(mesh->num_reply_addrs > 0);
 			mesh->num_reply_addrs--;
@@ -2377,10 +2370,6 @@ void mesh_state_remove_reply(struct mesh_area* mesh, struct mesh_state* m,
 			mesh->num_reply_addrs--;
 			infra_wait_limit_dec(mesh->env->infra_cache,
 				&n->query_reply, mesh->env->cfg);
-			/* We may be removing more than one http2 stream (they
-			 * share the same comm_point); make sure the streams
-			 * don't point back. */
-			if(n->h2_stream) n->h2_stream->mesh_state = NULL;
 
 			/* prev = prev; */
 			n = n->next;

services/outside_network.c

@@ -160,19 +160,6 @@ reuse_cmp_addrportssl(const void* key1, const void* key2)
 		return 1;
 	if(!r1->is_ssl && r2->is_ssl)
 		return -1;
-
-	/* compare tls_auth_name if SSL-enabled */
-	if(r1->is_ssl) {
-		if(r1->tls_auth_name && !r2->tls_auth_name)
-			return 1;
-		if(!r1->tls_auth_name && r2->tls_auth_name)
-			return -1;
-		if(r1->tls_auth_name && r2->tls_auth_name) {
-			r = strcmp(r1->tls_auth_name, r2->tls_auth_name);
-			if(r != 0)
-				return r;
-		}
-	}
 	return 0;
 }
 
@@ -544,7 +531,7 @@ reuse_tcp_insert(struct outside_network* outnet, struct pending_tcp* pend_tcp)
 /** find reuse tcp stream to destination for query, or NULL if none */
 static struct reuse_tcp*
 reuse_tcp_find(struct outside_network* outnet, struct sockaddr_storage* addr,
-	socklen_t addrlen, int use_ssl, char* tls_auth_name)
+	socklen_t addrlen, int use_ssl)
 {
 	struct waiting_tcp key_w;
 	struct pending_tcp key_p;
@@ -558,10 +545,8 @@ reuse_tcp_find(struct outside_network* outnet, struct sockaddr_storage* addr,
 	key_p.c = &c;
 	key_p.reuse.pending = &key_p;
 	key_p.reuse.node.key = &key_p.reuse;
-	if(use_ssl) {
+	if(use_ssl)
 		key_p.reuse.is_ssl = 1;
-		key_p.reuse.tls_auth_name = tls_auth_name;
-	}
 	if(addrlen > (socklen_t)sizeof(key_p.reuse.addr))
 		return NULL;
 	memmove(&key_p.reuse.addr, addr, addrlen);
@@ -661,7 +646,6 @@ static int
 outnet_tcp_take_into_use(struct waiting_tcp* w)
 {
 	struct pending_tcp* pend = w->outnet->tcp_free;
-	char* tls_auth_name = NULL;
 	int s;
 	log_assert(pend);
 	log_assert(w->pkt);
@@ -762,22 +746,7 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
 		comm_point_tcp_win_bio_cb(pend->c, pend->c->ssl);
 #endif
 		pend->c->ssl_shake_state = comm_ssl_shake_write;
-		if(w->tls_auth_name) {
-			/* strdup the auth name, while not linked the list yet,
-			 * in case of failure, easy cleanup. */
-			tls_auth_name = strdup(w->tls_auth_name);
-			if(!tls_auth_name) {
-				log_err("out of memory: alloc tls auth name");
-				pend->c->fd = s;
-#ifdef HAVE_SSL
-				SSL_free(pend->c->ssl);
-#endif
-				pend->c->ssl = NULL;
-				comm_point_close(pend->c);
-				return 0;
-			}
-		}
-		if(!set_auth_name_on_ssl(pend->c->ssl, tls_auth_name,
+		if(!set_auth_name_on_ssl(pend->c->ssl, w->tls_auth_name,
 			w->outnet->tls_use_sni)) {
 			pend->c->fd = s;
 #ifdef HAVE_SSL
@@ -785,7 +754,6 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
 #endif
 			pend->c->ssl = NULL;
 			comm_point_close(pend->c);
-			free(tls_auth_name);
 			return 0;
 		}
 	}
@@ -810,20 +778,9 @@ outnet_tcp_take_into_use(struct waiting_tcp* w)
 	if(pend->reuse.node.key)
 		reuse_tcp_remove_tree_list(w->outnet, &pend->reuse);
 
-	if(pend->c->ssl) {
+	if(pend->c->ssl)
 		pend->reuse.is_ssl = 1;
-		if(pend->reuse.tls_auth_name)
-			free(pend->reuse.tls_auth_name);
-		pend->reuse.tls_auth_name = tls_auth_name;
-		tls_auth_name = NULL;
-	} else {
-		pend->reuse.is_ssl = 0;
-		if(pend->reuse.tls_auth_name)
-			free(pend->reuse.tls_auth_name);
-		pend->reuse.tls_auth_name = NULL;
-	}
-	/* free tls auth name if nonNULL */
-	free(tls_auth_name);
+	else	pend->reuse.is_ssl = 0;
 	/* insert in reuse by address tree if not already inserted there */
 	(void)reuse_tcp_insert(w->outnet, pend);
 	reuse_tree_by_id_insert(&pend->reuse, w);
@@ -1012,7 +969,7 @@ use_free_buffer(struct outside_network* outnet)
 			(!outnet->tcp_reuse_first && !outnet->tcp_reuse_last) ||
 			(outnet->tcp_reuse_first && outnet->tcp_reuse_last));
 		reuse = reuse_tcp_find(outnet, &w->addr, w->addrlen,
-			w->ssl_upstream, w->tls_auth_name);
+			w->ssl_upstream);
 		/* re-select an ID when moving to a new TCP buffer */
 		w->id = tcp_select_id(outnet, reuse);
 		LDNS_ID_SET(w->pkt, w->id);
@@ -1241,10 +1198,6 @@ decommission_pending_tcp(struct outside_network* outnet,
 		/* needs unlink from the reuse tree to get deleted */
 		reuse_tcp_remove_tree_list(outnet, &pend->reuse);
 	}
-	if(pend->reuse.tls_auth_name) {
-		free(pend->reuse.tls_auth_name);
-		pend->reuse.tls_auth_name = NULL;
-	}
 	/* free SSL structure after remove from outnet tcp reuse tree,
 	 * because the c->ssl null or not is used for sorting in the tree */
 	if(pend->c->ssl) {
@@ -1969,10 +1922,6 @@ outside_network_delete(struct outside_network* outnet)
 					 * the tcp conn is working on */
 					decommission_pending_tcp(outnet, pend);
 				}
-				if(pend->reuse.tls_auth_name) {
-					free(pend->reuse.tls_auth_name);
-					pend->reuse.tls_auth_name = NULL;
-				}
 				comm_point_delete(outnet->tcp_conns[i]->c);
 				free(outnet->tcp_conns[i]);
 				outnet->tcp_conns[i] = NULL;
@@ -2498,7 +2447,7 @@ pending_tcp_query(struct serviced_query* sq, sldns_buffer* packet,
 	/* find out if a reused stream to the target exists */
 	/* if so, take it into use */
 	reuse = reuse_tcp_find(sq->outnet, &sq->addr, sq->addrlen,
-		sq->ssl_upstream, sq->tls_auth_name);
+		sq->ssl_upstream);
 	if(reuse) {
 		log_reuse_tcp(VERB_CLIENT, "pending_tcp_query: found reuse", reuse);
 		log_assert(reuse->pending);

services/outside_network.h

@@ -264,9 +264,6 @@ struct reuse_tcp {
 	socklen_t addrlen;
 	/** also key for tcp_reuse tree, if ssl is used */
 	int is_ssl;
-	/** If is_ssl is enabled, tls_auth_name is part of the key for
-	 * tcp_reuse tree. If the string is NULL, it without a tls_auth_name */
-	char* tls_auth_name;
 	/** lru chain, so that the oldest can be removed to get a new
 	 * connection when all are in (re)use. oldest is last in list.
 	 * The lru only contains empty connections waiting for reuse,

services/rpz.c

@@ -153,7 +153,6 @@ rpz_type_ignored(uint16_t rr_type)
 		case LDNS_RR_TYPE_SOA:
 		case LDNS_RR_TYPE_NS:
 		case LDNS_RR_TYPE_DNAME:
-		case LDNS_RR_TYPE_ZONEMD:
 		/* all DNSSEC-related RRs must be ignored */
 		case LDNS_RR_TYPE_DNSKEY:
 		case LDNS_RR_TYPE_DS:

smallapp/unbound-anchor.c

@@ -2430,20 +2430,12 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 
 	if(dolist) do_list_builtin();

smallapp/unbound-checkconf.c

@@ -44,7 +44,6 @@
 
 #include "config.h"
 #include <ctype.h>
-#include "util/as112.h"
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/module.h"
@@ -189,56 +188,11 @@ donotquerylocalhostcheck(struct config_file* cfg)
 	}
 }
 
-static void
-nodefaultzonescheck(struct config_file* cfg)
-{
-	struct config_strlist* d;
-	const char** zstr;
-	size_t len;
-
-#define COMPARE_ZONE_NAME(confname, builtname, len)		\
-	(strncasecmp(confname, builtname, (len)) == 0 &&	\
-	(strlen(confname) == (len) ||				\
-	(strlen(confname) == (len) + 1				\
-	&& confname[(len)] == '.')))
-
-	for(d = cfg->local_zones_nodefault; d; d = d->next) {
-		if(!cfg->unblock_lan_zones) {
-			for(zstr = as112_zones; *zstr; zstr++) {
-				len = strlen(*zstr) - 1; /* trailing '.' */
-				if(COMPARE_ZONE_NAME(d->str, *zstr, len))
-					goto default_continue;
-			}
-		}
-		for(zstr = local_zones_default_special; *zstr; zstr++) {
-			len = strlen(*zstr) - 1; /* trailing '.' */
-			if(COMPARE_ZONE_NAME(d->str, *zstr, len))
-				goto default_continue;
-		}
-		for(zstr = local_zones_default_reverse; *zstr; zstr++) {
-			len = strlen(*zstr) - 1; /* trailing '.' */
-			if(COMPARE_ZONE_NAME(d->str, *zstr, len))
-				goto default_continue;
-		}
-		if(COMPARE_ZONE_NAME(d->str, "localhost.", 10 - 1))
-			goto default_continue;
-		fprintf(stderr, "unbound-checkconf: warning: local-zone: '%s' "
-			"is configured as 'nodefault' but there is no such "
-			"default local-zone. Check the unbound.conf "
-			"documentation for default configured local-zones.\n",
-			d->str);
-default_continue:
-		; /* statement to jump to, for older gcc. */
-	}
-#undef COMPARE_ZONE_NAME
-}
-
 /** check localzones */
 static void
 localzonechecks(struct config_file* cfg)
 {
 	struct local_zones* zs;
-	nodefaultzonescheck(cfg);
 	if(!(zs = local_zones_create()))
 		fatal_exit("out of memory");
 	if(!local_zones_apply_cfg(zs, cfg))

smallapp/unbound-control.c

@@ -1052,20 +1052,12 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 
 	if(!RAND_status()) {

smallapp/unbound-host.c

@@ -521,20 +521,12 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 #endif /* HAVE_SSL */
 #ifdef HAVE_NSS

testcode/asynclook.c

@@ -488,20 +488,12 @@ int main(int argc, char** argv)
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 #endif /* HAVE_SSL */
 

testcode/checklocks.h

@@ -360,7 +360,6 @@ typedef pthread_key_t ub_thread_key_type;
 #define ub_thread_key_create(key, f) LOCKRET(pthread_key_create(key, f))
 #define ub_thread_key_set(key, v) LOCKRET(pthread_setspecific(key, v))
 #define ub_thread_key_get(key) pthread_getspecific(key)
-#define ub_thread_setname(thread, name) /* nop */
 
 #endif /* USE_THREAD_DEBUG */
 #endif /* TESTCODE_CHECK_LOCKS_H */

testcode/dohclient.c

@@ -642,20 +642,12 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 	}
 	run(h2_session, port, no_tls, argc, argv);

testcode/mini_tdir.sh

@@ -141,13 +141,6 @@ if test -f $done; then
 	exit 0
 fi
 
-# always clear the skip mark file in case something changed in the environment
-# in between runs
-if test -f $skip; then
-	echo "minitdir $skip exists; removing."
-	rm $skip
-fi
-
 # Copy
 if test $quiet = 0; then
 	echo "minitdir copy $1 to $dir"

testcode/petal.c

@@ -160,26 +160,11 @@ read_ssl_line(SSL* ssl, char* buf, size_t len)
 			return 0;
 		}
 		if((r = SSL_read(ssl, buf+n, 1)) <= 0) {
-			int e = SSL_get_error(ssl, r);
-			if(e == SSL_ERROR_ZERO_RETURN) {
+			if(SSL_get_error(ssl, r) == SSL_ERROR_ZERO_RETURN) {
 				/* EOF */
 				break;
-			} else if(e == SSL_ERROR_WANT_READ) {
-				continue;
-			} else if(e == SSL_ERROR_WANT_WRITE) {
-				continue;
-			} else if(e == SSL_ERROR_SYSCALL) {
-				if(verb) printf("could not SSL_read %s\n",
-					strerror(errno));
-			} else if(e == SSL_ERROR_SSL) {
-				int er = ERR_peek_error();
-				if(er)
-					printf("could not SSL_read: %s\n",
-						ERR_reason_error_string(er));
-			} else {
-				if(verb) printf("could not SSL_read "
-						"(SSL_get_error %d)\n", e);
 			}
+			if(verb) printf("could not SSL_read\n");
 			return 0;
 		}
 		if(endnl && buf[n] == '\n') {
@@ -690,20 +675,12 @@ int main(int argc, char* argv[])
 #else
 	OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 		| OPENSSL_INIT_ADD_ALL_DIGESTS
-		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+		| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 	(void)SSL_library_init();
 #else
-	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-		| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-		, NULL);
+	(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 
 	do_service(addr, port, key, cert);

testcode/pktview.c

@@ -59,16 +59,12 @@ static void usage(char* argv[])
 /** read hex input */
 static void read_input(sldns_buffer* pkt, FILE* in)
 {
-	/* Buffer for 64Kib packet, in hex, with spaces and comments. */
-	char buf[1024000];
+	char buf[102400];
 	char* np = buf;
 	while(fgets(np, (int)sizeof(buf) - (np-buf), in)) {
 		if(buf[0] == ';') /* comment */
 			continue;
 		np = &np[strlen(np)];
-		if((size_t)(np-buf) >= sizeof(buf)-1)
-			fatal_exit("input too large (%lu bytes)",
-				(unsigned long)sizeof(buf));
 	}
 	hex_to_buf(pkt, buf);
 }
@@ -192,16 +188,10 @@ static void analyze(sldns_buffer* pkt)
 /** main program for pktview */
 int main(int argc, char* argv[]) 
 {
-	sldns_buffer* pkt;
-
-	log_init(NULL, 0, NULL);
-	log_ident_set("pktview");
-
+	sldns_buffer* pkt = sldns_buffer_new(65553);
 	if(argc != 1) {
 		usage(argv);
 	}
-
-	pkt = sldns_buffer_new(65553);
 	if(!pkt) fatal_exit("out of memory");
 
 	read_input(pkt, stdin);

testcode/streamtcp.c

@@ -652,20 +652,12 @@ int main(int argc, char** argv)
 #else
 		OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS
 			| OPENSSL_INIT_ADD_ALL_DIGESTS
-			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+			| OPENSSL_INIT_LOAD_CRYPTO_STRINGS, NULL);
 #endif
 #if OPENSSL_VERSION_NUMBER < 0x10100000 || !defined(HAVE_OPENSSL_INIT_SSL)
 		(void)SSL_library_init();
 #else
-		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS
-#  if defined(OPENSSL_INIT_NO_LOAD_CONFIG) && defined(UB_ON_WINDOWS)
-			| OPENSSL_INIT_NO_LOAD_CONFIG
-#  endif
-			, NULL);
+		(void)OPENSSL_init_ssl(OPENSSL_INIT_LOAD_SSL_STRINGS, NULL);
 #endif
 	}
 	send_em(svr, pp2_client, udp, usessl, noanswer, onarrival, delay, argc, argv);

testcode/testpkts.c

@@ -1774,14 +1774,11 @@ adjust_packet(struct entry* match, uint8_t** answer_pkt, size_t *answer_len,
 		memmove(res+LDNS_HEADER_SIZE+dlen+4,
 			orig+LDNS_HEADER_SIZE+olen+4,
 			reslen-(LDNS_HEADER_SIZE+dlen+4));
-	} else if(origlen == 0) {
-		res = NULL;
-		reslen = 0;
 	} else {
 		res = memdup(orig, origlen);
 		reslen = origlen;
 	}
-	if(!res && reslen > 0) {
+	if(!res) {
 		verbose(1, "out of memory; send without adjust\n");
 		return;
 	}

testdata/01-doc.tdir/01-doc.test

@@ -40,6 +40,8 @@ grep -F -v -e "dnstap" hlist > ilist; mv ilist hlist
 grep -F -v -e "util/siphash.c" hlist > ilist; mv ilist hlist
 # filter out compat
 grep -F -v -e "compat/" hlist > ilist; mv ilist hlist
+# filter out simdzone
+grep -F -v -e "simdzone/" hlist > ilist; mv ilist hlist
 for h in `cat hlist`; do
 	if grep -F "`basename $h`" $PRE/doc/html/files.html >/dev/null; then
 		: # ok

testdata/cachedb_val_expired.crpl

@@ -226,7 +226,6 @@ STEP 150 TIME_PASSES ELAPSE 200
 STEP 160 FLUSH_MESSAGE www.example.com. IN A
 
 ; cache has no answer, cachedb is expired
-; but it needs to be validated.
 STEP 170 QUERY
 ENTRY_BEGIN
 REPLY RD DO
@@ -236,14 +235,12 @@ ENTRY_END
 
 STEP 180 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-;ede=3
+MATCH all ttl ede=3
 REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-;www.example.com. 123 IN A 1.2.3.4
-www.example.com. 200 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 STEP 190 TRAFFIC
@@ -301,17 +298,14 @@ SECTION QUESTION
 www.example.com. IN A
 ENTRY_END
 
-; but it needs to be validated
 STEP 280 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ttl
-;ede=3
+MATCH all ttl ede=3
 REPLY QR RD RA DO NOERROR
 SECTION QUESTION
 www.example.com. IN A
 SECTION ANSWER
-;www.example.com. 123 IN A 1.2.3.4
-www.example.com. 200 IN A 1.2.3.4
+www.example.com. 123 IN A 1.2.3.4
 ENTRY_END
 
 STEP 290 TRAFFIC

testdata/dname_unsigned_cname.rpl

@@ -1,297 +0,0 @@
-; config options
-; The island of trust is at test.
-server:
-	trust-anchor: "test. DS 1444 8 2 8a87d067fd09a5965244fe2e317dd26d182c468e0a7f26ecc4c7b479bf89db9b"
-	val-override-date: "20201020135527"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-	iter-scrub-promiscuous: no
-	aggressive-nsec: yes
-	local-zone: test. nodefault
-	log-servfail: yes
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test DNAME with an unsigned CNAME that mismatches the DNAME.
-; The CNAME occurs later in a list of redirections.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-test. IN NS
-SECTION AUTHORITY
-test.	IN NS	ns.test.
-SECTION ADDITIONAL
-ns.test. IN A 1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.test
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-test. IN NS
-SECTION ANSWER
-test.    IN NS   ns.test
-test.	3600	IN	RRSIG	NS 8 1 3600 20201116135527 20201019135527 1444 test. RGCxIO32TbbLTk6xZmTr+fjYPH50hntBxeOQ2DIj2pDsmjALcHYtVkOfpfk2EhOhHZd+9PLuoJPbJh6a9NqLSFeBvr0XZoCZoQ2g0tCHUNHcH5EVjA2TuYBQem6DVYnPLJ3914aRx0uA1j42b8dC2xsam/XkOo7U+dLbUW2Os1s=
-SECTION ADDITIONAL
-ns.test. IN A 1.2.3.5
-ns.test.	3600	IN	RRSIG	A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.test. IN A
-SECTION ANSWER
-ns.test. IN A 1.2.3.5
-ns.test.	3600	IN	RRSIG	A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.test. IN AAAA
-SECTION AUTHORITY
-test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600
-test.	3600	IN	RRSIG	SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw=
-ns.test. 3600 IN NSEC nz.test. A RRSIG
-ns.test.	3600	IN	RRSIG	NSEC 8 2 3600 20201116135527 20201019135527 1444 test. PElArVB3KPg8KHAP7lzcNbhFuXNxTsHNTn1dZVncB5qmWRdIaeKpaXDjpH0JSXMaelGFS+/QhuQ6Hmw9+4VyZFRqMzGhw4agUR/2bxABHcDIG4ZpUwyeSP61ATTfHUkQVxaH2wjCWI/tfmesdP2xVE4GXyUvCIBxU914MkZbULU=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-test. IN DNSKEY
-SECTION ANSWER
-test.    3600    IN      DNSKEY  257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b}
-test.	3600	IN	RRSIG	DNSKEY 8 1 3600 20201116135527 20201019135527 1444 test. UmRMS4iG9NBBHZYOtpwFFcJgbEb5SfHSgHd9XRe/8pTWM31WSDayn5ViPOBMqI1T5TXg2amc13dDI574xIM2oKMus3b5cBW72jJLW13jprBtslO6P8BMWb4HNnvLrJtQjwf3ErRirtTxinLmywQtmyr1cdthyG3Gp4N7i90fHSc=
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname qtype
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-example.test. IN DS
-SECTION ANSWER
-example.test.	3600	IN	DS	55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39
-example.test.	3600	IN	RRSIG	DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.test. IN NS
-SECTION AUTHORITY
-example.test.    IN NS   ns.example.test.
-example.test.	3600	IN	DS	55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39
-example.test.	3600	IN	RRSIG	DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I=
-SECTION ADDITIONAL
-ns.example.test. IN A 1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-fox.test. IN NS
-SECTION AUTHORITY
-fox.test.    IN NS   ns.fox.test.
-fox.test.	3600	IN	DS	29332 8 2 5b06f16c7b8cc07ba7b8e1ab0a40a40ecf89e1e94da2f0b1d2159b64dba80d96
-fox.test.	3600	IN	RRSIG	DS 8 2 3600 20201116135527 20201019135527 1444 test. B9bKqUJgJcGlKSWyGkdGGS6unKUwNJteTq08caL40QEZcAy836vwypGzOIQJNUw+mYIEecvtrF9H4mG+EjzDKv+n+36DCNvJMn6b8+FC9COw4mqITAjYPZjDwtOXAKVbuBuZJsbP2ztacJ98tXcORozaaKDGH/3fmsUlaKcuPmo=
-SECTION ADDITIONAL
-ns.fox.test. IN A 1.2.3.6
-ENTRY_END
-RANGE_END
-
-; ns.example.test.
-RANGE_BEGIN 0 15
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.test. IN NS
-SECTION ANSWER
-example.test.    IN NS   ns.example.test.
-example.test.	3600	IN	RRSIG	NS 8 2 3600 20201116135527 20201019135527 55567 example.test. l1JT0wMlK0YI7/CWHzexf/k0iafUhCgN+BdgjBXIRXmSQNf4HDTiAkbcWL2/15qtnp12nQy9JeiTdSQ3vtPoHAJX4C5uTWaze4ms+Wrrf+n92sLCjacP9x50uuicH3URT6cKb1QCAPwlvlWxIlZjAMYFScSns7+C441NMJT8aE4=
-SECTION ADDITIONAL
-ns.example.test.         IN      A       1.2.3.4
-ns.example.test.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.example.test. IN A
-SECTION ANSWER
-ns.example.test.         IN      A       1.2.3.4
-ns.example.test.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.example.test. IN AAAA
-SECTION AUTHORITY
-example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600
-example.test.	3600	IN	RRSIG	SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8=
-ns.example.test. 3600 IN NSEC nz.example.test. A RRSIG
-ns.example.test.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 55567 example.test. v/5aO/n8Ow21y7LE7JKZsFkUJU5MjIfadVRm2Tdb8f3RLwYDdBTs3aWeeEQdCRSUF61TmfJM1jIxlWQPuHbqzGnjSk7adw9gFpP7wFwoqG3/xdCFHoxo/3/1F/4Ankey3sDgKgOFsgnu40TlL36mGPYszeK+/2o3SAx2GM+3BdU=
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.test. IN DNSKEY
-SECTION ANSWER
-example.test.	3600	IN	DNSKEY	257 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55567 (ksk), size = 1024b}
-example.test.	3600	IN	RRSIG	DNSKEY 8 2 3600 20201116135527 20201019135527 55567 example.test. IbWMC6quOuZFNPAVxQLqCJ9nLhindBo826rnLcg5yMgs9dGUSPOCXAfHTmbgJAUNs9HTFfrJWNvasnETs0UOpmEuifGwWdH1OlME7Gny4RL2QmITUFeMW81Jz1tiVQxFXl6yxT0jxOxvz+bqMHlrz+8IeWQXcO+GZTPu8ueq30g=
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-a.d.example.test. IN A
-SECTION ANSWER
-d.example.test. 3600 IN DNAME tgt.example.test.
-d.example.test.	3600	IN	RRSIG	DNAME 8 3 3600 20201116135527 20201019135527 55567 example.test. EGpXUnJuzkETAO2OWyZDrTeInnyxF7CXPXGDfFt2x3CBUeckUUZcgQQ3yMh+BATKph2nOhBfk8klvZ35C9sQO7Z32REAnqGjpHiR86xRPYxG62Nk9kXv1Odeh/adz2QhB93N8U7W57FM0P/VQDkP0GQXTSRGTuj+7ihfYVd4HWI=
-; with CNAME signature
-a.d.example.test. 3600 IN CNAME a.tgt.example.test.
-a.d.example.test.	3600	IN	RRSIG	CNAME 8 4 3600 20201116135527 20201019135527 55567 example.test. efnytLE7P95kLr/tA9H0Z77VTOUQk24ci2bDgdVe8EuodTXtgg5PVHVLljD3QQ1Cpyme50odH/fhn2j1ORQpJTMk24Un/VRhVNquf+kj1nawJ59J0hjag4i0FIwZEG3/P7ogTB3Yd2y0Osb42Aawp48KvtVkUeBukk/GSutaTVQ=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-a.tgt.example.test. IN A
-SECTION ANSWER
-a.tgt.example.test. 3600 IN CNAME b.d.example.test.
-a.tgt.example.test.	3600	IN	RRSIG	CNAME 8 4 3600 20201116135527 20201019135527 55567 example.test. XHYWSHIm9J8j8T1qMh1tHZS71UguXYUVescKPFtoGHRuyRhHNob+NAqdn3I4/+8HSSGrJDqhTX/Vo3rcc3/g5HOHScwzZByB/diyJWpG9IA7pm7c7FnHnHpGBVdHq9wXlkgCPiaJShpE1zg1nNy3p99ca9/wh4y9XWSfcl0L8aw=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-b.d.example.test. IN A
-SECTION ANSWER
-; This answer is injected
-; Without an RRSIG.
-b.d.example.test. 3600 IN CNAME www.fox.test.
-ENTRY_END
-RANGE_END
-
-; ns.fox.test.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.6
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.fox.test. IN AAAA
-SECTION AUTHORITY
-fox.test. 3600 IN SOA ns.fox.test. host.fox.test. 20601 3600 1800 604800 3600
-fox.test.	3600	IN	RRSIG	SOA 8 2 3600 20201116135527 20201019135527 29332 fox.test. QScf+vyis5/Km03ALuLQDfUDagA9/UG/oIQw6LnvmsVoqJSNXa3LIObWT9zfWgdJT0qFayWR4K9hnd9rT1enuVmXX8k47s7AjPZmE0qQxms5xz7jOhj/XLFplXOE9/GkgvAZKPb42qkU3Xf6Bevxzfy4/qW7+yXflWsjLV1vAhz38M4ESeWp0MDme8+DND0f7aoprGcC5saAPfa35nQhHS40q4IwiUDBBk1uwhCBF9ZGsjRfXmECOxIc1/0hBOv+Hhwog4K5b8rdl7LA2VggNiVOUuLFpXEH0XxknEspbQwWppP4TWC1H2QYGaKCc2Hu7NBhM/Ly7caGK+2u1MZvsg==
-ns.fox.test. 3600 IN NSEC nz.fox.test. A RRSIG
-ns.fox.test.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 29332 fox.test. RQjV2PHbBVdGhvSRl0lutzoIZ9KezBAAwvI5sQoIGLdlMeQxj/BOy16auYRLTxvB9xehkrTTeL5xYUwcbi4uFS/kr3IUmlVXeldHOk4T42huV9MGfWzguUsB2jjsrcdt11qEnLo27SVVcvQReswwfpOPRPHg52fS6vt50AIWwttLOLvZEGiGIjRGb4lBaCnoO6YYzOnwcRCV0UScTjlPxS1SBEKsdbPvzfUUyp+wOVnIVAXrd0xEChB7QrTIrcBt4mutXVUNBDcfkZCXgEwu3scWQQS8rNO6O3PvpLgs6PIHX191WjovkJ9/PL+8MO/7UUatSWhZUwuQBUq6VofCYw==
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-fox.test. IN DNSKEY
-SECTION ANSWER
-fox.test.	IN	DNSKEY	257 3 8 AwEAAb4WMOTBLTFvmBra5m6SK4VfViOzmvyUAU0qv861ZQXeEFvwlndqNU9rwRsMxrSWAYs5nHErKDn49usC/HyxxW1477iGFHhfgL4mjNreJm9zft2QFB1VLbRbEPYdDMLCn4co0qnG7/KG8W2i8Pym1L7f+aREwbLo+/716AS2PbaKMhfWLKLiq5wnBcUClQMNzCiwhqxDJp1oePqfkVdeUgXOtgi0dYRIKyQFhJ5VWJ22npoi/Gif0XLCADAlAwRLKc8o/yJkCxskzgpHpw5Cki1lclg0aq4ssOuPRQ+ne6IHYCz9D2mwzulblhLFamKdq7aHzNt4NlyxhpANVFiKLD8= ;{id = 29332 (ksk), size = 2048b}
-fox.test.	3600	IN	RRSIG	DNSKEY 8 2 3600 20201116135527 20201019135527 29332 fox.test. bTslCQKai9U9EWkBPnMiO+Rb34qMAZSzfgEb68x+ZKi2DDyzK7v8TCX8unTlqeQCnTqqgJ7cCUcqrbSV3ip9WGNe5fUy5j9hxH04ddLcDhygnjLi4C7iQX67ratRGu1JM3Evk/gVF76a5J2RSQk340jOFHC0nnjWOMHlDDxBeK4Zr6lYvAMJB2uy08xbi1FuGUSPcrbRFnVb74QMAPLS9Uj5JM8lMsOMtrhHX9zBN8Euo4M1X0sinBdJse3P/fIZ+ZvSnOEpVvur3bcUl+bqFJ18nM/Mj/e3XW3WBWE1dI6p6HdAXLrJyjJINzm+YnNzj11tzu/e4BQCjOutY9XkKA==
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.fox.test. IN A
-SECTION ANSWER
-www.fox.test. 3600 IN A 10.20.30.43
-www.fox.test.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 29332 fox.test. ehPLws7Jnlx5Trm7Z8Hxr0WkLdkxyif+E1aGzFMib4eP0nvLV89WOQ2Fpm1xT/VaNJBXjXhWPB0Oo/gAKVs1znqmyjutFdXi2+9rXnK73jD2+rWBGW/sgBl/9cr458j7441nEK18Mq4SserQcLBqM38IivTlK1J5uXUpEPKMCSA82waf0Z+LUk8czFqeYy+KlJSsiu33mrVWrjyNLIXCbZ2dxfdaVSKyAoQafiokp1NGnw3onQkXXOPqJ7GRsN8Ml4c2nOrEYIG6otoZXXjtkoNCOHzBBkPVEP82JjzQchq0fDWQ2UHOXXZYBG/B6m5PuOXmgKJVDKZ/iVNQofPp8w==
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-a.d.example.test. IN A
-ENTRY_END
-
-STEP 10 TRAFFIC
-; The unsigned CNAME should make SERVFAIL.
-
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA DO SERVFAIL
-SECTION QUESTION
-a.d.example.test. IN A
-SECTION ANSWER
-ENTRY_END
-
-SCENARIO_END

testdata/ds_wildcard_cname.rpl

@@ -1,374 +0,0 @@
-; config options
-; The island of trust is at test.
-server:
-	trust-anchor: "test. DS 1444 8 2 8a87d067fd09a5965244fe2e317dd26d182c468e0a7f26ecc4c7b479bf89db9b"
-	val-override-date: "20201020135527"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-	minimal-responses: no
-	iter-scrub-promiscuous: no
-	aggressive-nsec: yes
-	local-zone: test. nodefault
-	log-servfail: yes
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test DS response with wildcard CNAME
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-test. IN NS
-SECTION AUTHORITY
-test.	IN NS	ns.test.
-SECTION ADDITIONAL
-ns.test. IN A 1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.test
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-test. IN NS
-SECTION ANSWER
-test.    IN NS   ns.test
-test.	3600	IN	RRSIG	NS 8 1 3600 20201116135527 20201019135527 1444 test. RGCxIO32TbbLTk6xZmTr+fjYPH50hntBxeOQ2DIj2pDsmjALcHYtVkOfpfk2EhOhHZd+9PLuoJPbJh6a9NqLSFeBvr0XZoCZoQ2g0tCHUNHcH5EVjA2TuYBQem6DVYnPLJ3914aRx0uA1j42b8dC2xsam/XkOo7U+dLbUW2Os1s=
-SECTION ADDITIONAL
-ns.test. IN A 1.2.3.5
-ns.test.	3600	IN	RRSIG	A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.test. IN A
-SECTION ANSWER
-ns.test. IN A 1.2.3.5
-ns.test.	3600	IN	RRSIG	A 8 2 3600 20201116135527 20201019135527 1444 test. GskCc4/k6GjH9V9Jz2V5L2XLiizbOeWkB0feSbf+aN859S3vxVvtuqkvIgwY4LafUO1QAn/pUcv9zA7rcFO++rlg+8t6gvZTo9p3v0bfeIv2uJDsfSBD5jDh0WXlxjekfnrKrQp7zE+GiA93tWwKUWKPvxXDgP+n886e6WcbHJw=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.test. IN AAAA
-SECTION AUTHORITY
-test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600
-test.	3600	IN	RRSIG	SOA 8 1 3600 20201116135527 20201019135527 1444 test. IZJIDmEgf0W7A5G7hvvZ2hUqJ9Trbv1/i7ySapDmPbYV9lVCmHHobySxO01yDhI2/Pvpsvxqrm1Tiv3BxH8uzZ4keKgiQjBsSy4htAsFct9I4E7ly2glPj/Fm3oun3PsjJDv5QYhx0KS7w4IQKU7Nc9pfJc92uoUI5bdoC1pRGw=
-ns.test. 3600 IN NSEC nz.test. A RRSIG
-ns.test.	3600	IN	RRSIG	NSEC 8 2 3600 20201116135527 20201019135527 1444 test. PElArVB3KPg8KHAP7lzcNbhFuXNxTsHNTn1dZVncB5qmWRdIaeKpaXDjpH0JSXMaelGFS+/QhuQ6Hmw9+4VyZFRqMzGhw4agUR/2bxABHcDIG4ZpUwyeSP61ATTfHUkQVxaH2wjCWI/tfmesdP2xVE4GXyUvCIBxU914MkZbULU=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-test. IN DNSKEY
-SECTION ANSWER
-test.    3600    IN      DNSKEY  257 3 8 AwEAAbd9WqjzE2Pynz21OG5doSf9hFzMr5dhzz2waZ3vTa+0o5r7AjTAqmA1yH/B3+aAMihUm5ucZSfVqo7+kOaRE8yFj9aivOmA1n1+JLevJq/oyvQyjxQN2Qb89LyaNUT5oKZIiL+uyyhNW3KDR3SSbQ/GBwQNDHVcZi+JDR3RC0r7 ;{id = 1444 (ksk), size = 1024b}
-test.	3600	IN	RRSIG	DNSKEY 8 1 3600 20201116135527 20201019135527 1444 test. UmRMS4iG9NBBHZYOtpwFFcJgbEb5SfHSgHd9XRe/8pTWM31WSDayn5ViPOBMqI1T5TXg2amc13dDI574xIM2oKMus3b5cBW72jJLW13jprBtslO6P8BMWb4HNnvLrJtQjwf3ErRirtTxinLmywQtmyr1cdthyG3Gp4N7i90fHSc=
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qname qtype
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-example.test. IN DS
-SECTION ANSWER
-example.test.	3600	IN	DS	55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39
-example.test.	3600	IN	RRSIG	DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.test. IN NS
-SECTION AUTHORITY
-example.test.    IN NS   ns.example.test.
-example.test.	3600	IN	DS	55567 8 2 a2d578906330a10a57d40462257b6ce038bad3f7bf4a45c46c46086e20a94b39
-example.test.	3600	IN	RRSIG	DS 8 2 3600 20201116135527 20201019135527 1444 test. P7+FTYW2qHuJ4I1YbuvseEz5X1lOYAraGEHB3C5y0OOCQFmhmSiFRdquNi2NlpcS6FXLdsE0EU+Bo1+0atTG4EkMWXbpF21lrtbB51BdsnlX4Mzc/o375fvjiOMwmF6wPCUaOUN62jrVrhsE/hedaVyDphDToqL17ETohwgUO2I=
-SECTION ADDITIONAL
-ns.example.test. IN A 1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.test.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.test. IN NS
-SECTION ANSWER
-example.test.    IN NS   ns.example.test.
-example.test.	3600	IN	RRSIG	NS 8 2 3600 20201116135527 20201019135527 55567 example.test. l1JT0wMlK0YI7/CWHzexf/k0iafUhCgN+BdgjBXIRXmSQNf4HDTiAkbcWL2/15qtnp12nQy9JeiTdSQ3vtPoHAJX4C5uTWaze4ms+Wrrf+n92sLCjacP9x50uuicH3URT6cKb1QCAPwlvlWxIlZjAMYFScSns7+C441NMJT8aE4=
-SECTION ADDITIONAL
-ns.example.test.         IN      A       1.2.3.4
-ns.example.test.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.example.test. IN A
-SECTION ANSWER
-ns.example.test.         IN      A       1.2.3.4
-ns.example.test.	3600	IN	RRSIG	A 8 3 3600 20201116135527 20201019135527 55567 example.test. 2PWaVaccZFQgfPKXNsdEGYUVaashCAj1ZhBo9XRt5eQKUFvZcauBjMnXIuxZFyWeootn1fZGw6GuPI5W48Y0FDx38H6adprkFgQikso2Y64jDdDMWznSo38Z/XqP+U0+kq4vmwonvmEMpm7hKnNEXvhqGKyGzyBwb+CZVJ2L8Eo=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.example.test. IN AAAA
-SECTION ANSWER
-ns.example.test. 3600 IN AAAA 2001::1:2:3:4
-ns.example.test.	3600	IN	RRSIG	AAAA 8 3 3600 20201116135527 20201019135527 55567 example.test. IuFmNUqxRjWSw/Ua2A0XmeKbsVkw6Yzd/D4TGBZ5pyKtbYIFvmF/QfcqzONiwqG3KEW2tAeyEjZOYjrM37NqgIwwk56LJ16fFA7e2tShjSjPhgNzjHZW9zvFTjPyTTVpMVb3SGV59RQTm3jJwlQCq7qVHyKQ+HT3pa+XZQJEzdw=
-SECTION AUTHORITY
-;example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600
-;example.test.	3600	IN	RRSIG	SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8=
-;ns.example.test. 3600 IN NSEC nz.example.test. A RRSIG
-;ns.example.test.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 55567 example.test. v/5aO/n8Ow21y7LE7JKZsFkUJU5MjIfadVRm2Tdb8f3RLwYDdBTs3aWeeEQdCRSUF61TmfJM1jIxlWQPuHbqzGnjSk7adw9gFpP7wFwoqG3/xdCFHoxo/3/1F/4Ankey3sDgKgOFsgnu40TlL36mGPYszeK+/2o3SAx2GM+3BdU=
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.test. IN DNSKEY
-SECTION ANSWER
-example.test.	3600	IN	DNSKEY	257 3 8 AwEAAdug/L739i0mgN2nuK/bhxu3wFn5Ud9nK2+XUmZQlPUEZUC5YZvm1rfMmEWTGBn87fFxEu/kjFZHJ55JLzqsbbpVHLbmKCTT2gYR2FV2WDKROGKuYbVkJIXdKAjJ0ONuK507NinYvlWXIoxHn22KAWOd9wKgSTNHBlmGkX+ts3hh ;{id = 55567 (ksk), size = 1024b}
-example.test.	3600	IN	RRSIG	DNSKEY 8 2 3600 20201116135527 20201019135527 55567 example.test. IbWMC6quOuZFNPAVxQLqCJ9nLhindBo826rnLcg5yMgs9dGUSPOCXAfHTmbgJAUNs9HTFfrJWNvasnETs0UOpmEuifGwWdH1OlME7Gny4RL2QmITUFeMW81Jz1tiVQxFXl6yxT0jxOxvz+bqMHlrz+8IeWQXcO+GZTPu8ueq30g=
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-tgt.example.test. DS
-SECTION ANSWER
-SECTION AUTHORITY
-; denial of the DS record for tgt.example.test.
-example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600
-example.test.	3600	IN	RRSIG	SOA 8 2 3600 20201116135527 20201019135527 55567 example.test. 2UUkScBAN37fJpSrelhE8DotKvmOzj3q9wicaanCIaCv95DE4nQnePih5B+ek3FIRjB/Uv2+z4Ro5Uxy94XAnlK0rCkDLSa0U9U7KP0ytc88sevO0x1SCPAMoZoJO6JqHkv42pdh54WSz+Zb/D8npY0j/tksHe/uX+VQnMymgb8=
-tgt.example.test. 3600 IN NSEC tgz.example.test. A RRSIG
-tgt.example.test.	3600	IN	RRSIG	NSEC 8 3 3600 20201116135527 20201019135527 55567 example.test. R9v8k/M56dLOUbrTP/m2XnKsOjIj1kAfwCQvHW4KPdDn3XJIvCLs4mTjxvyQ70uP+zA8WxrPgbqPZv//Ms3Sher2j41VKIBRFkJpyJn6/D9/QmOOhWzoPYXuujHJAkB9IDit3YOgJutirFnB7reTTav42P5x7PzQDSt+crUnXkw=
-ENTRY_END
-
-; when there is a re-query for the DS record, this answer is used.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-sub.example.test. IN DS
-SECTION ANSWER
-; This reply is an injected reply.
-sub.example.test. 300 IN CNAME tgt.example.test.
-; signature for wildcard, *.example.test. 300 IN CNAME tgt.example.test.
-sub.example.test.	300	IN	RRSIG	CNAME 8 2 300 20201116135527 20201019135527 55567 example.test. fz+xLPcRAbGUcnF7hITQHRT6AeA/I/dSjyLWb3it+cHSMY7dN4Jpw7Dk0GJh0y71HXFwaWgk1If0O4IOVo4mfkm1RrRhBnxJT8R88AQlN69SXLZrlHIhoupBpZADz/J15hOcHG+/1svsEpAA5qkOrgZwf581X9ygwPGFkIHgS+o=
-ENTRY_END
-
-; The referral to sub.example.test, for other queries than type DS.
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR AA NOERROR
-SECTION QUESTION
-sub.example.test. IN NS
-SECTION ANSWER
-SECTION AUTHORITY
-sub.example.test. 3600 NS ns.sub.example.test.
-; Smaller TTL 300 for the DS.
-sub.example.test.	300	IN	DS	29332 8 2 69c8a09889e377fb1d1af78cc55984152adf25f4643b26d42654657a171e92aa
-sub.example.test.	300	IN	RRSIG	DS 8 3 300 20201116135527 20201019135527 55567 example.test. vyjkyx1UMCI5KftU7BQWxDkxNj25A60haEIR/Sy7JUkG2UnE0tNIVNE4mEmUGX6ICsddKGwba2xFQFYBMyfpnzsNxEMKv8VpOGObpiTlK4ICRaq6m+pVND1Benk6grzkb+6T2xogHEEMYqnMUF4bDGRe5tcftS9XdAl77pG6W7Q=
-SECTION ADDITIONAL
-ns.sub.example.test. IN A 1.2.3.7
-ENTRY_END
-RANGE_END
-
-; ns.sub.example.test.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.7
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.sub.example.test. IN AAAA
-SECTION ANSWER
-SECTION AUTHORITY
-sub.example.test. 3600 IN SOA ns.sub.example.test. host.sub.example.test. 20701 3600 1800 604800 3600
-sub.example.test.	3600	IN	RRSIG	SOA 8 3 3600 20201116135527 20201019135527 29332 sub.example.test. EEeC/XlG/XuItqRphAOREwHPzqSsJSs9TEhPnqOzXU4/+j0Eq05WN8ZE+GxHnmrxzaLiqAT6pLYLaQxCFcpkMVKUFYfMFyK6jOkTHZ1ODXNIdAA/ZGMCOQQUco3rcrY6F2U8ETHSxiFQkEl8iQntWM6wUoUF37Yd4hab+o1eD/HZXKLwgNXbXC1iY40ZzqwAlxLcCt0SexiTI9BNfyDy3iROeT3XuloC2x9o2zclAqz3m42n8UKAs8Gh7sAkoTua2fqtNfWZtQctlp1tZgdJFXbI4vuxMEldD+Rh5kUJ72aXvD2W7vd042G7z3n+d+I4vtnH2qKNbVA4YHMXzA/3ug==
-ns.sub.example.test. 3600 IN NSEC nz.sub.example.test. A RRSIG
-ns.sub.example.test.	3600	IN	RRSIG	NSEC 8 4 3600 20201116135527 20201019135527 29332 sub.example.test. CqaJIHttjfPIdBM1Ty8RDGRnrkaoC7Y7pzS/Kbzjn3lsEJg2XPWZGRln75imsoVOdi46YG95HZdgvnndTAAH3dE0eZHycvo2O7zR0f+Ty3v/HWpvOsRp/XE/8/7g45DHLuyTXxiO6cDSu0bW/qTC4xyix7vMFNEyOmGMGIZEnvkoRWJvUToj8VW6r+a8dU1KIGQXKSXg3lRcXc0Zfk2lk5P0XGrGzdLcITbZbVP3aFgusoi6uCTqhPmwZRVJjuh1E0qXTTE2A67vloVBvwVxfhNajHNkVhEYtxqZyiRLPs1tRyWit4J2Kkk5qoWuPwNRoTHsgzmPJoDGxheUxGEvbA==
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-sub.example.test. IN DNSKEY
-SECTION ANSWER
-sub.example.test. 300 	IN	DNSKEY	257 3 8 AwEAAb4WMOTBLTFvmBra5m6SK4VfViOzmvyUAU0qv861ZQXeEFvwlndqNU9rwRsMxrSWAYs5nHErKDn49usC/HyxxW1477iGFHhfgL4mjNreJm9zft2QFB1VLbRbEPYdDMLCn4co0qnG7/KG8W2i8Pym1L7f+aREwbLo+/716AS2PbaKMhfWLKLiq5wnBcUClQMNzCiwhqxDJp1oePqfkVdeUgXOtgi0dYRIKyQFhJ5VWJ22npoi/Gif0XLCADAlAwRLKc8o/yJkCxskzgpHpw5Cki1lclg0aq4ssOuPRQ+ne6IHYCz9D2mwzulblhLFamKdq7aHzNt4NlyxhpANVFiKLD8= ;{id = 29332 (ksk), size = 2048b}
-sub.example.test.	300	IN	RRSIG	DNSKEY 8 3 300 20201116135527 20201019135527 29332 sub.example.test. j8lyYKogmlBon1WsYJp2H4DSdXZIGkzKHplH2hs9b5D2I+4kZ7jiwHz5/OZca5aOOE1QbhcPNRyhenSmtwePjhvBLSDDYC4OhowVpWW5o5aRQMnsTYZgmgqX0zPtUWBoK8P+GZRd1VO/Jam0qWoHjHY9lQlDnblN6f2yDRHQI2CVrSal8x12zl1s/QHVNpodb4MwowvL4WeGxDVxBOiS3v+9SobnfPa9oecu9onrcPryr4KDQHi6i5BNvHVPqE9eBkHnRe3DcvfEbOke6vZY7CCNgfGttaJL64ubCVUv2xu3okTQS5gSX9pRbjaxKlw1ZWmJR0HSq/dn2HDuWjzxkQ==
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-a.sub.example.test. IN A
-SECTION ANSWER
-a.sub.example.test. 300 IN A 10.20.30.40
-a.sub.example.test.	300	IN	RRSIG	A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. lElblJBqr+LbNDO8mlyh9PbBzfC6LU5K8nh/fOHu9dFur5xuqtItw+D0/oo2ve6WIUnqblXKhfbZcKMa40DONog/uThmwyp6cBow7oZdfZSt5YTn74QwJb1M/yaJgU+OWNkM7RfG+VcvpB04+KH+g2qwEpHC5Jm5+e66beoiGHZuKle0qAxNAgM1kkJ5EdTngKk80YOciBv705xSSvySmCDktcIceV8zMgD9YFW1Q2I2SXtPCsVaJTA1jaf3Cm8rZfY1GrBW18JyLPOqf6eIBqdyXg/w/mi/pxgakIM3r9iKaDsEz01ZiN0jaEloteT+NhpjEJA/sFzu1nhV0Y3fJw==
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-b.sub.example.test. IN A
-SECTION ANSWER
-b.sub.example.test. 300 IN A 10.20.30.41
-b.sub.example.test.	300	IN	RRSIG	A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. KimigOgfAWic9JVbuqMc0cE2aUlfzBaG+LjZl5IqZr7RLeImG74cpBMbTyzWJ1h3IhCKnLde3KMYz+viVEwsirxlY70i3cDObl5t9XlBKombQzCJBMv5MNCGH1iYfsBL6JVhVX849J1fRTK7E6mW2v9eN0GUFplTsThodnRnh/R3KYsn7wdYFAQ3VAkGzdrxcsS9Lmua1hYhJtjMFBuJn/pmoWpOWQePN9u9P1jh3IkvKN7XuwSYvoGjhE1ZM0OtpsWbHdYmFbUePu4Ruqk0Yg+eW1tkWBsj1AHq1x75BDxOShypi+8zb9zGeatF+A65PSOH1WjmpWNdbAYz97gssw==
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.sub.example.test. IN A
-SECTION ANSWER
-www.sub.example.test. 300 IN A 10.20.30.42
-www.sub.example.test.	300	IN	RRSIG	A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. YuV5CADfhJ6yjxLrIZ243RvJmDJv0NgZKVZ9k5TorSY/O8fvPDzIMJFDjVs2gk6dZV81I6MmMbbcK5I3DEeBIHMswOZEhJYgfX7TiKi4sNfJQmyJJSx1SS1YQ38Asxst4cWgg5L6aoehsIlHvAqEz+JlObNus30nO7S6zMd+rFoThdbCpADK3AhbSI8xhO1u7Q8qgBchX7JZNIt5eiKnSrLSi5UAtuNMkczWv74ckFtd5PERpBGqpJRj50z0+7qiAbdahT3YQ7y2PkiBpZTtxG8Cmza4CkGPd1qzD/DRUsWOzZyiWwX5niD51sgqMj6ApGs8wbVSsk/vBudYw1/CIA==
-ENTRY_END
-RANGE_END
-
-; ns.example.test.
-RANGE_BEGIN 0 100
-	ADDRESS 2001::1:2:3:4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-sub.example.test. IN DS
-SECTION ANSWER
-; This is the correct reply.
-sub.example.test.	300	IN	DS	29332 8 2 69c8a09889e377fb1d1af78cc55984152adf25f4643b26d42654657a171e92aa
-sub.example.test.	300	IN	RRSIG	DS 8 3 300 20201116135527 20201019135527 55567 example.test. vyjkyx1UMCI5KftU7BQWxDkxNj25A60haEIR/Sy7JUkG2UnE0tNIVNE4mEmUGX6ICsddKGwba2xFQFYBMyfpnzsNxEMKv8VpOGObpiTlK4ICRaq6m+pVND1Benk6grzkb+6T2xogHEEMYqnMUF4bDGRe5tcftS9XdAl77pG6W7Q=
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-a.sub.example.test. IN A
-ENTRY_END
-
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-a.sub.example.test. IN A
-SECTION ANSWER
-a.sub.example.test. 300 IN A 10.20.30.40
-a.sub.example.test.	300	IN	RRSIG	A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. lElblJBqr+LbNDO8mlyh9PbBzfC6LU5K8nh/fOHu9dFur5xuqtItw+D0/oo2ve6WIUnqblXKhfbZcKMa40DONog/uThmwyp6cBow7oZdfZSt5YTn74QwJb1M/yaJgU+OWNkM7RfG+VcvpB04+KH+g2qwEpHC5Jm5+e66beoiGHZuKle0qAxNAgM1kkJ5EdTngKk80YOciBv705xSSvySmCDktcIceV8zMgD9YFW1Q2I2SXtPCsVaJTA1jaf3Cm8rZfY1GrBW18JyLPOqf6eIBqdyXg/w/mi/pxgakIM3r9iKaDsEz01ZiN0jaEloteT+NhpjEJA/sFzu1nhV0Y3fJw==
-ENTRY_END
-
-STEP 20 TIME_PASSES ELAPSE 320
-; The DS record has expired, but the NS record for sub.example.test. is in
-; cache.
-
-; The DS lookup fails with wildcard CNAME.
-; Then it should blacklist the parent (1.2.3.4) not the sub zone (1.2.3.7)
-; the AAAA for the parent can then be retrieved, and it is used.
-
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.sub.example.test. IN A
-ENTRY_END
-
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-www.sub.example.test. IN A
-SECTION ANSWER
-www.sub.example.test. 300 IN A 10.20.30.42
-www.sub.example.test.	300	IN	RRSIG	A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. YuV5CADfhJ6yjxLrIZ243RvJmDJv0NgZKVZ9k5TorSY/O8fvPDzIMJFDjVs2gk6dZV81I6MmMbbcK5I3DEeBIHMswOZEhJYgfX7TiKi4sNfJQmyJJSx1SS1YQ38Asxst4cWgg5L6aoehsIlHvAqEz+JlObNus30nO7S6zMd+rFoThdbCpADK3AhbSI8xhO1u7Q8qgBchX7JZNIt5eiKnSrLSi5UAtuNMkczWv74ckFtd5PERpBGqpJRj50z0+7qiAbdahT3YQ7y2PkiBpZTtxG8Cmza4CkGPd1qzD/DRUsWOzZyiWwX5niD51sgqMj6ApGs8wbVSsk/vBudYw1/CIA==
-ENTRY_END
-
-STEP 50 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-b.sub.example.test. IN A
-ENTRY_END
-
-STEP 60 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-b.sub.example.test. IN A
-SECTION ANSWER
-b.sub.example.test. 300 IN A 10.20.30.41
-b.sub.example.test.	300	IN	RRSIG	A 8 4 300 20201116135527 20201019135527 29332 sub.example.test. KimigOgfAWic9JVbuqMc0cE2aUlfzBaG+LjZl5IqZr7RLeImG74cpBMbTyzWJ1h3IhCKnLde3KMYz+viVEwsirxlY70i3cDObl5t9XlBKombQzCJBMv5MNCGH1iYfsBL6JVhVX849J1fRTK7E6mW2v9eN0GUFplTsThodnRnh/R3KYsn7wdYFAQ3VAkGzdrxcsS9Lmua1hYhJtjMFBuJn/pmoWpOWQePN9u9P1jh3IkvKN7XuwSYvoGjhE1ZM0OtpsWbHdYmFbUePu4Ruqk0Yg+eW1tkWBsj1AHq1x75BDxOShypi+8zb9zGeatF+A65PSOH1WjmpWNdbAYz97gssw==
-ENTRY_END
-
-SCENARIO_END

testdata/fwd_compress_c00c.tdir/fwd_compress_c00c.test

@@ -8,7 +8,7 @@
 if nc -h 2>&1 | grep "q secs"; then
 	ncopt="-q 3 -i 2"
 else
-	ncopt="-i 2 --no-shutdown"
+	ncopt="-i 2"
 fi
 
 PRE="../.."

testdata/fwd_scrub_rrsig.rpl

@@ -1,93 +0,0 @@
-; This is a comment
-server:
-
-forward-zone: name: "." forward-addr: 216.0.0.1
-CONFIG_END
-
-SCENARIO_BEGIN Test scrub of RRSIG amount
-
-RANGE_BEGIN 0 100
-	ADDRESS 216.0.0.1
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A 10.20.30.40
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MQ== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mg== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mw== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NA== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NQ== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Ng== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Nw== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . OA== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . OQ== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTA= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTE= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTI= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTM= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTQ= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTU= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTY= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTc= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTg= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MTk= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjA= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjE= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjI= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjM= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjQ= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjU= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MjY= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mjc= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mjg= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mjk= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzA= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzE= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzI= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzM= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzQ= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzU= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MzY= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mzc= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mzg= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mzk= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NDA= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NDE= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NDI= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NDM= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NDQ= ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NDU= ;{id = 12345}
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-MATCH TCP
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-STEP 4 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH opcode qname qtype all
-REPLY QR RD DO RA
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A 10.20.30.40
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . MQ== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mg== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Mw== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NA== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . NQ== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Ng== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . Nw== ;{id = 12345}
-www.example.com.      300     IN      RRSIG   A 8 3 300 20330518033320 20010909014640 12345 . OA== ;{id = 12345}
-ENTRY_END
-SCENARIO_END

testdata/iter_dname_ttl0.rpl

@@ -1,272 +0,0 @@
-; config options
-; Test DNAME TTL=0 grace period: synthesis from cache within 1 second
-; Island of trust at example.com, DNSSEC signed DNAME with TTL=0 (RFC 2308)
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	trust-anchor: "example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	fake-sha1: yes
-	trust-anchor-signaling: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test DNAME TTL=0: signed DNAME with TTL=0 and RRSIG Original TTL=0.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com. - DNAME with TTL=0 (RRSIG Original TTL=0)
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DNAME with TTL=0, RRSIG Original TTL=0 (signed with ldns-signzone)
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-foo.test-dname.example.com. IN A
-SECTION ANSWER
-test-dname.example.com.	0	IN	DNAME	example.net.
-test-dname.example.com.	0	IN	RRSIG	DNAME 3 3 0 20070926135752 20070829135752 2854 example.com. ADRb2Jl5SCTF2a9/5QFOCfwFzh4Cpt90pJptwrKc+vBHnlivGyPShrU=
-foo.test-dname.example.com. 0 IN CNAME foo.example.net.
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.5
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.	IN NS	ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN DNSKEY
-SECTION ANSWER
-example.net.    3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-example.net.    3600    IN      RRSIG   DNSKEY RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. hiFzlQ8VoYgCuvIsfVuxC3mfJDqsTh0yc6abs5xMx5uEcIjb0dndFQx7INOM+imlzveEN73Hqp4OLFpFhsWLlw== ;{id = 30899}
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-example.net.    3600    IN      RRSIG   NS RSASHA1 2 3600 20070926134150 20070829134150 30899 example.net. E8JX0l4B+cSR5bkHQwOJy1pBmlLMTYCJ8EwfNMU/eCv0YhKwo26rHhn52FGisgv+Nwp7/NbhHqQ+kJgoZC94XA== ;{id = 30899}
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ns.example.net. 3600    IN      RRSIG   A RSASHA1 3 3600 20070926134150 20070829134150 30899 example.net. x+tQMC9FhzT7Fcy1pM5NrOC7E8nLd7THPI3C6ie4EwL8PrxllqlR3q/DKB0d/m0qCOPcgN6HFOYURV1s4uAcsw== ;{id = 30899}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-foo.example.net. IN A
-SECTION ANSWER
-foo.example.net. IN	A	11.12.13.15
-foo.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.net. X6T6SE9UzxAD/4zKpwGOxEDyE4g7lfYYw3lvw533uwRN8mWTcBvSva0/jjyhrogJcuLO32jPHK6zGb93w2xnuA==
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-foo2.example.net. IN A
-SECTION ANSWER
-foo2.example.net. IN	A	11.12.13.16
-foo2.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.net. BZm+GljD8m9N+pNJN8D+LlSyHqM+InNUe0+heKILR9be+Goqv6SEb7LKtX6+kj3239Y5by7u+/Cuk8kkWistEQ==
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-STEP 1 TIME_PASSES ELAPSE 10
-; First query: get DNAME TTL=0 into cache
-STEP 10 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-foo.test-dname.example.com. IN A
-ENTRY_END
-
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-foo.test-dname.example.com. IN A
-SECTION ANSWER
-test-dname.example.com.	0	IN	DNAME	example.net.
-test-dname.example.com.	0	IN	RRSIG	DNAME 3 3 0 20070926135752 20070829135752 2854 example.com. ADRb2Jl5SCTF2a9/5QFOCfwFzh4Cpt90pJptwrKc+vBHnlivGyPShrU=
-foo.test-dname.example.com. 0 IN CNAME foo.example.net.
-foo.example.net. IN	A	11.12.13.15
-foo.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.net. X6T6SE9UzxAD/4zKpwGOxEDyE4g7lfYYw3lvw533uwRN8mWTcBvSva0/jjyhrogJcuLO32jPHK6zGb93w2xnuA==
-ENTRY_END
-
-STEP 29 TIME_PASSES ELAPSE 1
-
-; Second query: within grace period (TIME_PASSES 1 above)
-; With cache grace: synthesis from cached TTL=0 DNAME
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-foo2.test-dname.example.com. IN A
-ENTRY_END
-
-; foo2.test-dname.example.com is not answered upstream
-; so this reply is synthesized by the cached (1 second grace period) DNAME
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA AD DO NOERROR
-SECTION QUESTION
-foo2.test-dname.example.com. IN A
-SECTION ANSWER
-test-dname.example.com.	0	IN	DNAME	example.net.
-test-dname.example.com.	0	IN	RRSIG	DNAME 3 3 0 20070926135752 20070829135752 2854 example.com. ADRb2Jl5SCTF2a9/5QFOCfwFzh4Cpt90pJptwrKc+vBHnlivGyPShrU=
-foo2.test-dname.example.com. 0 IN CNAME foo2.example.net.
-foo2.example.net. 	3600	IN	A	11.12.13.16
-foo2.example.net.	3600	IN	RRSIG	A 5 3 3600 20070926134150 20070829134150 30899 example.net. BZm+GljD8m9N+pNJN8D+LlSyHqM+InNUe0+heKILR9be+Goqv6SEb7LKtX6+kj3239Y5by7u+/Cuk8kkWistEQ==
-ENTRY_END
-
-SCENARIO_END

testdata/iter_nat64_donotq.rpl

@@ -1,192 +0,0 @@
-; config options
-server:
-	do-nat64: yes
-	nat64-prefix: 2001:db8:1234::/96
-	target-fetch-policy: "0 0 0 0 0"
-
-	; This is like a machine that is part of a cluster of hosts that
-	; is IPv6-only, and uses NAT64. The cluster has no internet access.
-	do-not-query-address: ::0/0
-
-	qname-minimisation: no
-
-stub-zone:
-	name: "."
-	; Pick an address in the NAT64 prefix, so it is allowed.
-	; other addresses would not be allowed. Or without the bugfix,
-	; allowed depending on state machine activation sequence.
-	stub-addr: 2001:db8:1234::1
-CONFIG_END
-
-SCENARIO_BEGIN Test NAT64 transport for v4-only with do-not-query-addresses.
-
-RANGE_BEGIN 0 100
-	ADDRESS 2001:db8:1234::1
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	FAKE.ROOT.
-SECTION ADDITIONAL
-FAKE.ROOT.	IN	AAAA 2001:db8:1234::1
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-v4only. IN NS
-SECTION AUTHORITY
-v4only.	IN NS	ns.v4only.
-SECTION ADDITIONAL
-ns.v4only.	IN	A	192.0.2.1
-ENTRY_END
-
-RANGE_END
-
-; replies from NS over "NAT64"
-
-RANGE_BEGIN 0 20
-	ADDRESS 2001:db8:1234::c000:0201
-
-; A over NAT64
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY AA QR NOERROR
-SECTION QUESTION
-ns.v4only. IN A
-SECTION ANSWER
-ns.v4only.	IN	A	192.0.2.1
-SECTION AUTHORITY
-v4only.		IN	NS	ns.v4only.
-ENTRY_END
-
-; no AAAA
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY AA QR NOERROR
-SECTION QUESTION
-ns.v4only.	IN	AAAA
-SECTION AUTHORITY
-v4only.		IN	SOA	ns.v4only. host. 1 3600 300 48000 3600
-v4only.		IN	NS	ns.v4only.
-SECTION ADDITIONAL
-ns.v4only.	IN	A	192.0.2.1
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY AA QR NOERROR
-SECTION QUESTION
-v4only.		IN	NS
-SECTION ANSWER
-v4only.		IN	NS	ns.v4only.
-SECTION ADDITIONAL
-ns.v4only.	IN	A	192.0.2.1
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY AA QR NOERROR
-SECTION QUESTION
-test.v4only.	IN	A
-SECTION ANSWER
-test.v4only.	IN	A	192.0.2.2
-SECTION AUTHORITY
-v4only.		IN	NS	ns.v4only.
-SECTION ADDITIONAL
-ns.v4only.	IN	A	192.0.2.1
-ENTRY_END
-RANGE_END
-
-RANGE_BEGIN 50 100
-	ADDRESS 2001:db8:1234::c000:0201
-; no AAAA
-; The last resort lookup of the AAAA is blocked here,
-; the last resort processing is not desired, it should resolve test2
-; straight away.
-;ENTRY_BEGIN
-;MATCH opcode qtype qname
-;ADJUST copy_id
-;REPLY AA QR NOERROR
-;SECTION QUESTION
-;ns.v4only.	IN	AAAA
-;SECTION AUTHORITY
-;v4only.		IN	SOA	ns.v4only. host. 1 3600 300 48000 3600
-;v4only.		IN	NS	ns.v4only.
-;SECTION ADDITIONAL
-;ns.v4only.	IN	A	192.0.2.1
-;ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY AA QR NOERROR
-SECTION QUESTION
-ns.v4only.	IN	A
-SECTION ANSWER
-ns.v4only.	IN	A	192.0.2.1
-SECTION AUTHORITY
-v4only.		IN	NS	ns.v4only.
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY AA QR NOERROR
-SECTION QUESTION
-test2.v4only.	IN	A
-SECTION ANSWER
-test2.v4only.	IN	A	192.0.2.3
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-test.v4only. IN A
-ENTRY_END
-
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-test.v4only.	IN	A
-SECTION ANSWER
-test.v4only.	IN	A	192.0.2.2
-ENTRY_END
-
-; for a query where the upstream nameserver has a timeout.
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-test2.v4only. IN A
-ENTRY_END
-
-; Only the test2 query is there, and it has a timeout.
-; The address is already NAT64 translated, so now that it is
-; attempted again, it is looked up in dotnotq as the ipv6 address.
-STEP 40 TIMEOUT
-
-STEP 50 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-test2.v4only.	IN	A
-SECTION ANSWER
-test2.v4only.	IN	A	192.0.2.3
-ENTRY_END
-
-SCENARIO_END

testdata/iter_priv_svcb.rpl

@@ -1,283 +0,0 @@
-; config options
-server:
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: no
-	minimal-responses: yes
-	iter-scrub-promiscuous: yes
-
-	private-address: 10.0.0.0/8
-	private-address: 172.16.0.0/12
-	private-address: 192.168.0.0/16
-	private-address: 169.254.0.0/16
-	private-address: fd00::/8
-	private-address: fe80::/10
-
-	private-domain: "example.net"
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-
-CONFIG_END
-
-SCENARIO_BEGIN Test iterator scrubber with private addresses in SVCB.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-; root server authoritative for example.net too.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-mail.example.net. IN SVCB
-SECTION ANSWER
-mail.example.net. IN SVCB 1 foo.example.net. ipv4hint=10.20.30.40
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-ns.example.com. IN A
-SECTION ANSWER
-ns.example.com.		IN 	A	1.2.3.4
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-ns.example.com. IN AAAA
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA ns.example.com. root.example.com. 4 14400 3600 604800 3600
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.example.com. IN SVCB
-SECTION ANSWER
-www.example.com. IN SVCB 1 foo.example.com. ipv4hint=192.20.30.40
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-mail.example.com. IN SVCB
-SECTION ANSWER
-mail.example.com. IN SVCB 1 foo.example.com. ipv6hint=fe80::15
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-foo.example.com. IN SVCB
-SECTION ANSWER
-foo.example.com. IN SVCB 1 foo.example.com. ipv4hint=10.20.30.40
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-toss.example.com. IN SVCB
-SECTION ANSWER
-toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=10.20.30.40
-toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=10.20.30.40
-toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=1.2.3.4
-toss.example.com. IN SVCB 1 foo.example.com. ipv6hint=fe80::15
-toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=10.20.30.41
-toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=192.0.2.1,10.20.30.42,192.0.2.2
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; public address is not scrubbed
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN SVCB
-ENTRY_END
-
-; recursion happens here.
-STEP 2 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN SVCB
-SECTION ANSWER
-www.example.com. IN SVCB 1 foo.example.com. ipv4hint=192.20.30.40
-ENTRY_END
-
-; IPv4 address is scrubbed
-STEP 3 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-foo.example.com. IN SVCB
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-foo.example.com. IN SVCB
-SECTION ANSWER
-; scrubbed away
-ENTRY_END
-
-; IPv6 address is scrubbed
-STEP 20 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-mail.example.com. IN SVCB
-ENTRY_END
-
-STEP 30 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-mail.example.com. IN SVCB
-SECTION ANSWER
-ENTRY_END
-
-; allowed domain is not scrubbed.
-STEP 40 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-mail.example.net. IN SVCB
-ENTRY_END
-
-STEP 50 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-mail.example.net. IN SVCB
-SECTION ANSWER
-mail.example.net. IN SVCB 1 foo.example.net. ipv4hint=10.20.30.40
-ENTRY_END
-
-; rest of RRset intact, only 10/8 tossed away.
-STEP 60 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-toss.example.com. IN SVCB
-ENTRY_END
-
-STEP 70 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-toss.example.com. IN SVCB
-SECTION ANSWER
-toss.example.com. IN SVCB 1 foo.example.com. ipv4hint=1.2.3.4
-ENTRY_END
-
-SCENARIO_END

testdata/iter_scrub_dname_out_of_zone.rpl

@@ -1,122 +0,0 @@
-; config options
-server:
-	harden-referral-path: no
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	minimal-responses: no
-	iter-scrub-promiscuous: no
-
-stub-zone:
-        name: "."
-	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test scrub of out-of-zone DNAME in answer section
-
-STEP 10 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-x.y.example.com. IN A
-ENTRY_END
-
-; root prime is sent
-STEP 20 CHECK_OUT_QUERY
-ENTRY_BEGIN
-MATCH qname qtype opcode
-SECTION QUESTION
-. IN NS
-ENTRY_END
-STEP 30 REPLY
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET. IN A 193.0.14.129
-ENTRY_END
-
-; query sent to root server
-STEP 40 CHECK_OUT_QUERY
-ENTRY_BEGIN
-MATCH qname qtype opcode
-SECTION QUESTION
-x.y.example.com. IN A
-ENTRY_END
-STEP 50 REPLY
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-x.y.example.com. IN A
-SECTION AUTHORITY
-com. IN NS a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net. IN A 192.5.6.30
-ENTRY_END
-
-; query sent to .com server
-STEP 60 CHECK_OUT_QUERY
-ENTRY_BEGIN
-MATCH qname qtype opcode
-SECTION QUESTION
-x.y.example.com. IN A
-ENTRY_END
-
-STEP 70 REPLY
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-x.y.example.com. IN A
-SECTION AUTHORITY
-example.com. IN NS ns1.example.com.
-SECTION ADDITIONAL
-ns1.example.com. IN A 168.192.2.2
-ENTRY_END
-
-STEP 80 CHECK_OUT_QUERY
-ENTRY_BEGIN
-MATCH qname qtype opcode
-SECTION QUESTION
-x.y.example.com. IN A
-ENTRY_END
-
-STEP 90 REPLY
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-x.y.example.com. IN A
-SECTION ANSWER
-com. DNAME z.example.com.
-SECTION AUTHORITY
-example.com. IN NS ns1.example.com.
-SECTION ADDITIONAL
-ns1.example.com. IN A 168.192.2.2
-ENTRY_END
-
-; answer to first query
-; nodata answer since the DNAME is ignored for synthesis and scrubbed
-; all together.
-STEP 120 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA
-SECTION QUESTION
-x.y.example.com. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN NS ns1.example.com.
-SECTION ADDITIONAL
-ns1.example.com. IN A 168.192.2.2
-ENTRY_END
-
-SCENARIO_END

testdata/iter_scrub_promiscuous.rpl

@@ -204,25 +204,6 @@ RANGE_END
 ; ns.pollute4.mesa
 RANGE_BEGIN 0 400
 	ADDRESS 1.2.4.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.pollute4.mesa. IN A
-SECTION ANSWER
-ns.pollute4.mesa. IN A 1.2.4.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-ns.pollute4.mesa. IN AAAA
-SECTION AUTHORITY
-pollute4.mesa. IN SOA ns.pollute4.mesa. host.pollute4.mesa 20701 3600 3600 604800 3600
-ENTRY_END
 
 ; This is the spoofed answer that is returned.
 ENTRY_BEGIN
@@ -442,18 +423,14 @@ ENTRY_END
 STEP 130 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA SERVFAIL
+REPLY QR RD RA YXDOMAIN
 SECTION QUESTION
 test4.atkr.pollute4.mesa. IN A
-; Since the reply does not contain a DNAME, it is rejected as YXDOMAIN answer.
-;REPLY QR RD RA YXDOMAIN
-;SECTION QUESTION
-;test4.atkr.pollute4.mesa. IN A
-;SECTION ANSWER
-;test4.atkr.pollute4.mesa. 86400 IN A 1.2.3.4
-;SECTION AUTHORITY
-;; removed record
-;;pollute4.mesa.       0       IN      NS      ns.attacker.mesa.
+SECTION ANSWER
+test4.atkr.pollute4.mesa. 86400 IN A 1.2.3.4
+SECTION AUTHORITY
+; removed record
+;pollute4.mesa.       0       IN      NS      ns.attacker.mesa.
 ENTRY_END
 
 ; Check the cache contents, for query 4.

testdata/iter_svcb_malformed.rpl

@@ -1,200 +0,0 @@
-; config options
-server:
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	minimal-responses: no
-	iter-scrub-promiscuous: no
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test lookup of malformed SVCB
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain 
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-www.example.com. IN HTTPS
-SECTION ANSWER
-www.example.com. IN HTTPS \# 17 00 01 00 00 01 00 03 02 68 32 00 01 00 03 02 68 33
-; Duplicate `alpn` key (17 bytes)
-; Decoded:
-;   SvcPriority = 1  (service mode)
-;   TargetName  = .  (root label, 0x00)
-;   SvcParam[0]: key=1 (alpn), value_len=3, value=\x02h2   ← "h2"
-;   SvcParam[1]: key=1 (alpn), value_len=3, value=\x02h3   ← DUPLICATE KEY
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-testb.example.com. IN HTTPS
-SECTION ANSWER
-; The parser for testbound does allow this.
-;testb.example.com. IN HTTPS \# 9 00 01 00 00 01 00 04 02 68
-; Truncated `alpn` value (9 bytes)
-; Decoded:
-;   SvcPriority = 1
-;   TargetName  = .
-;   SvcParam[0]: key=1 (alpn), value_len=4 (claims 4 bytes), value=\x02h (only 2 bytes present)
-; placeholder for hex: testb.example.com. IN HTTPS \# 9 00 01 00 00 01 00 02 01 68
-HEX_ANSWER_BEGIN
-000084000001000100000000057465737462076578616D706C6503636F6D0000410001057465737462076578616D706C6503636F6D000041000100000E10
-0009
-0001
-00
-000100040268
-HEX_ANSWER_END
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-testc.example.com. IN HTTPS
-SECTION ANSWER
-testc.example.com. IN HTTPS \# 21 00 01 00 00 01 00 06 02 68 32 02 68 33 00 04 00 04 01 02 03 04
-; valid HTTPS RDATA
-;   SvcPriority=1, TargetName=., alpn=h2+h3, ipv4hint=1.2.3.4
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN HTTPS
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN HTTPS
-SECTION ANSWER
-www.example.com.        0       IN      HTTPS   1 . alpn="h2" alpn="h3"
-ENTRY_END
-
-STEP 20 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-testb.example.com. IN HTTPS
-ENTRY_END
-
-; recursion happens here.
-STEP 30 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH rcode
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-testb.example.com. IN HTTPS
-SECTION ANSWER
-; testb.example.com.      0       IN      HTTPS   \# 9 000100000100040268
-HEX_ANSWER_BEGIN
-000084000001000100000000057465737462076578616D706C6503636F6D0000410001057465737462076578616D706C6503636F6D000041000100000E10
-0009
-0001
-00
-000100040268
-HEX_ANSWER_END
-ENTRY_END
-
-STEP 40 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-testc.example.com. IN HTTPS
-ENTRY_END
-
-; recursion happens here.
-STEP 50 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-testc.example.com. IN HTTPS
-SECTION ANSWER
-testc.example.com.      0       IN      HTTPS   1 . alpn="h2,h3" ipv4hint=1.2.3.4
-ENTRY_END
-
-SCENARIO_END

testdata/long_qname.rpl

@@ -1,73 +0,0 @@
-; config options
-server:
-	target-fetch-policy: "0 0 0 0 0"
-	qname-minimisation: "no"
-	minimal-responses: no
-	iter-scrub-promiscuous: no
-
-stub-zone:
-        name: "."
-	stub-addr: 1.2.3.4
-CONFIG_END
-
-SCENARIO_BEGIN Test long query name.
-
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qname qtype
-ADJUST copy_id
-REPLY QR AA NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS ns.root.
-SECTION ADDITIONAL
-ns.root. IN A 1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-; matched anything
-MATCH opcode
-ADJUST copy_id copy_query
-REPLY QR AA NXDOMAIN
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-. SOA ns.root. host.invalid. 1 2 3 4 5
-ENTRY_END
-RANGE_END
-
-STEP 10 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-HEX_ANSWER_BEGIN
-00 00 01 00		; RD
-00 01 00 00 00 00 00 00 ; QDCOUNT=1, ANCOUNT=0, NSCOUNT=0, ARCOUNT=0.
-; www.example.com.
-;03 77 77 77
-;07 65 78 61 6d 70 6c 65
-;03 63 6f 6d
-;00
-;
-; a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.a.ab.example.com.
-01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62 01 61 02 61 62
-07 65 78 61 6d 70 6c 65
-03 63 6f 6d
-00
-00 01 00 01
-HEX_ANSWER_END
-ENTRY_END
-
-; recursion happens here.
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD FORMERR
-SECTION QUESTION
-SECTION ANSWER
-ENTRY_END
-
-SCENARIO_END

testdata/refuse_xfr.rpl

@@ -28,11 +28,10 @@ STEP 4 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
 REPLY QR FORMERR
-; The SOA RR should not be echoed back.
-; The question section is absent, because it gives a formerr because of the
-; authority section contents.
-;SECTION QUESTION
-;nlnetlabs.nl. IN IXFR
+SECTION QUESTION
+nlnetlabs.nl. IN IXFR
+SECTION AUTHORITY
+nlnetlabs.nl. IN SOA mr. op. 12 0 0 0 0
 ENTRY_END
 
 SCENARIO_END

testdata/subnet_cached_servfail_timeout.crpl

@@ -1,239 +0,0 @@
-; Check if an SERVFAIL answer is not stored in the global cache, and
-; does not block ECS queries to reach the ECS cache.
-
-server:
-	trust-anchor-signaling: no
-	target-fetch-policy: "0 0 0 0 0"
-	;send-client-subnet: 1.2.3.4
-	client-subnet-zone: "example.com"
-	max-client-subnet-ipv4: 21
-	module-config: "subnetcache iterator"
-	verbosity: 3
-	access-control: 127.0.0.1 allow_snoop
-	qname-minimisation: no
-	minimal-responses: yes
-	prefetch: yes
-	outbound-msg-retry: 3
-	ede: yes
-	log-servfail: yes
-
-stub-zone:
-	name: "example.com."
-	stub-addr: 1.2.3.4
-CONFIG_END
-
-SCENARIO_BEGIN Test that SERVFAIL after timeout does not block clients to reach the ECS cache
-; And that withing the servfail time a couple of seconds have cached servfail
-; for the subnet queries for that name.
-
-; ns.example.com.
-RANGE_BEGIN 1 20
-ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname ednsdata
-ADJUST copy_id copy_ednsdata_assume_clientsubnet
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. 10 IN A	10.20.30.40
-SECTION AUTHORITY
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-			; client is 127.0.0.1
-	00 08 		; OPC
-	00 05 		; option length
-	00 01 		; Family
-	08 00 		; source mask, scopemask
-	7f		; address
-HEX_EDNSDATA_END
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 100 120
-ADDRESS 1.2.3.4
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname ednsdata
-ADJUST copy_id copy_ednsdata_assume_clientsubnet
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. 10 IN A	10.20.30.41
-SECTION AUTHORITY
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-			; client is 1.0.0.0
-	00 08 		; OPC
-	00 05 		; option length
-	00 01 		; Family
-	08 00 		; source mask, scopemask
-	01		; address
-HEX_EDNSDATA_END
-ENTRY_END
-RANGE_END
-
-; Put an item in subnet cache
-STEP 10 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 08	; ip4, source 8, scope 8
-	7f   		; 127.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.com.		IN A
-SECTION ANSWER
-www.example.com.	10	IN A	10.20.30.40
-SECTION AUTHORITY
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 08	; ip4, source 8, scope 8
-	7f		; 127.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-; There is a valid subnet query in cache.
-; this query timeouts.
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 00	; ip4, source 8, scope 0
-	01   		; 1.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-; This query faces timeouts during the resolution.
-; The timeouted query is the 1.0.0.0/8 subnet lookup of www.example.com. A.
-STEP 31 TIMEOUT
-STEP 32 TIMEOUT
-STEP 33 TIMEOUT
-
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD DO RA SERVFAIL
-SECTION QUESTION
-www.example.com.	IN A
-ENTRY_END
-
-; Check if subnet cache item can be accessed.
-STEP 50 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 00	; ip4, source 8, scope 0
-	7f   		; 127.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-STEP 60 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.com.		IN A
-SECTION ANSWER
-www.example.com.	10	IN A	10.20.30.40
-SECTION AUTHORITY
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 08	; ip4, source 8, scope 8
-	7f		; 127.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-; the existing subnet cache item can be accessed.
-; but another resolution, is now not cached at all?
-STEP 70 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 00	; ip4, source 8, scope 0
-	01   		; 1.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-STEP 80 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD DO RA SERVFAIL
-SECTION QUESTION
-www.example.com.	IN A
-ENTRY_END
-
-; after a couple of seconds, the servfail entry should have cleared.
-STEP 90 TIME_PASSES ELAPSE 10
-
-STEP 100 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 00	; ip4, source 8, scope 0
-	01   		; 1.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-STEP 110 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all ttl
-REPLY QR RD RA DO NOERROR
-SECTION QUESTION
-www.example.com.		IN A
-SECTION ANSWER
-www.example.com.	10	IN A	10.20.30.41
-SECTION AUTHORITY
-SECTION ADDITIONAL
-HEX_EDNSDATA_BEGIN
-	00 08 00 05	; OPC, optlen
-	00 01 08 08	; ip4, source 8, scope 8
-	01		; 1.0.0.0/8
-HEX_EDNSDATA_END
-ENTRY_END
-
-SCENARIO_END

testdata/subnet_scopezero_bogus.crpl

@@ -1,274 +0,0 @@
-; Test subnet option
-
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	trust-anchor-signaling: no
-	target-fetch-policy: "0 0 0 0 0"
-	send-client-subnet: 1.2.3.4
-	max-client-subnet-ipv4: 17
-	module-config: "subnetcache validator iterator"
-	verbosity: 3
-	fake-sha1: yes
-	fake-dsa: yes
-	qname-minimisation: no
-	minimal-responses: yes
-	iter-scrub-promiscuous: yes
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test subnet with scopezero bogus response
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			. IN NS
-		SECTION ANSWER
-			. IN NS	K.ROOT-SERVERS.NET.
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-	ENTRY_END
-
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			www.example.com. IN A
-		SECTION AUTHORITY
-			com.	IN NS	a.gtld-servers.net.
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			a.gtld-servers.net.	IN 	A	192.5.6.30
-	ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			com. IN NS
-		SECTION ANSWER
-			com.    IN NS   a.gtld-servers.net.
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			a.gtld-servers.net.     IN      A       192.5.6.30
-	ENTRY_END
-
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			www.example.com. IN A
-		SECTION AUTHORITY
-			example.com.	IN NS	ns.example.com.
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			ns.example.com.		IN 	A	1.2.3.4
-	ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			example.com. IN NS
-		SECTION ANSWER
-			example.com.    IN NS   ns.example.com.
-			example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			ns.example.com.         IN      A       1.2.3.4
-			ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-	ENTRY_END
-
-; no data for ns.example.com. AAAA
-	ENTRY_BEGIN
-		MATCH opcode qtype qname
-		ADJUST copy_id
-		REPLY QR AA NOERROR
-		SECTION QUESTION
-			ns.example.com. IN AAAA
-		SECTION AUTHORITY
-			example.com. IN SOA a. b. 3 28800 7200 604800 3600
-			example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. ACYHmWSLfBwPXwjI23+PW0db/DuqFwgpJYCbHOPeftbLR9nGy3nyEAE=
-			ns.example.com.	3600	IN	NSEC	op.example.com. A RRSIG NSEC
-			ns.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. AHMBw+lDAm9o2xG7v/8oWkYUc3WefUOuHFMHN9qZEp5/kooJqmlj974=
-	ENTRY_END
-
-	; response to DNSKEY priming query
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			example.com. IN DNSKEY
-		SECTION ANSWER
-			example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-			example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-		SECTION AUTHORITY
-			example.com.	IN NS	ns.example.com.
-			example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			ns.example.com.		IN 	A	1.2.3.4
-			ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-	ENTRY_END
-
-	; response to query of interest
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			www.example.com. IN A
-		SECTION ANSWER
-			; to make it bogus, the address is changed.
-			; and also the RRSIG is expired (dated in 2005).
-			;www.example.com. IN A	10.20.30.40
-			;www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-			www.example.com. IN A	10.20.30.41
-			www.example.com.        3600    IN      RRSIG   A 3 3 3600 20050926134150 20050829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-		SECTION AUTHORITY
-			example.com.	IN NS	ns.example.com.
-			example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-						; client is 127.0.0.1
-				00 08 		; OPC
-				00 07 		; option length
-				00 01 		; Family
-				11 00 		; source mask, scopemask
-				7f 00 00 	; address
-			HEX_EDNSDATA_END
-			ns.example.com.		IN 	A	1.2.3.4
-			ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
-	ENTRY_END
-
-	; response to query of interest without subnet
-	ENTRY_BEGIN
-		MATCH opcode qtype qname ednsdata
-		ADJUST copy_id
-		REPLY QR NOERROR
-		SECTION QUESTION
-			www.example.com. IN A
-		SECTION ANSWER
-			; to make it bogus, the address is changed.
-			; and also the RRSIG is expired (dated in 2005).
-			;www.example.com. IN A	10.20.30.40
-			;www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-			www.example.com. IN A	10.20.30.41
-			www.example.com.        3600    IN      RRSIG   A 3 3 3600 20050926134150 20050829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-		SECTION AUTHORITY
-			example.com.	IN NS	ns.example.com.
-			example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-		SECTION ADDITIONAL
-			HEX_EDNSDATA_BEGIN
-				;; we expect to receive empty
-			HEX_EDNSDATA_END
-			ns.example.com.		IN 	A	1.2.3.4
-			ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
-	ENTRY_END
-RANGE_END
-
-; query for www.example.com 0.0.0.0/0 with CD flag
-STEP 10 QUERY
-ENTRY_BEGIN
-REPLY RD CD DO NOERROR
-SECTION QUESTION
-www.example.com. IN A
-HEX_EDNSDATA_BEGIN
-			; 0.0.0.0/0 scope /0
-	00 08           ; OPC
-	00 04           ; option length
-	00 01           ; Family
-	00 00           ; source mask, scopemask
-	                ; address
-HEX_EDNSDATA_END
-ENTRY_END
-
-; recursion happens here.
-STEP 20 CHECK_ANSWER
-ENTRY_BEGIN
-	MATCH all ednsdata
-	REPLY QR RD CD RA DO NOERROR
-	SECTION QUESTION
-		www.example.com. IN A
-	SECTION ANSWER
-		www.example.com. IN A	10.20.30.41
-		www.example.com.        3600    IN      RRSIG   A 3 3 3600 20050926134150 20050829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-				; 0.0.0.0/0 scope /0
-		00 08           ; OPC
-		00 04           ; option length
-		00 01           ; Family
-		00 00           ; source mask, scopemask
-	                	; address
-		HEX_EDNSDATA_END
-ENTRY_END
-
-; query for www.example.com 0.0.0.0/0 without CD flag
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD DO NOERROR
-SECTION QUESTION
-www.example.com. IN A
-HEX_EDNSDATA_BEGIN
-			; 0.0.0.0/0 scope /0
-	00 08           ; OPC
-	00 04           ; option length
-	00 01           ; Family
-	00 00           ; source mask, scopemask
-	                ; address
-HEX_EDNSDATA_END
-ENTRY_END
-
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-	MATCH all ednsdata
-	REPLY QR RD RA DO SERVFAIL
-	SECTION QUESTION
-		www.example.com. IN A
-	SECTION ADDITIONAL
-		HEX_EDNSDATA_BEGIN
-;				; 0.0.0.0/0 scope /0
-;		00 08           ; OPC
-;		00 04           ; option length
-;		00 01           ; Family
-;		00 00           ; source mask, scopemask
-;				; address
-		HEX_EDNSDATA_END
-ENTRY_END
-
-SCENARIO_END

testdata/test_sigs.revoked

@@ -15,29 +15,10 @@ ENTRY_END
 ; entry to test
 ENTRY_BEGIN
 SECTION QUESTION
-bogus.example.com.       IN      SOA
+secure.example.com.       IN      SOA
 SECTION ANSWER
-; The REVOKE key is not allowed to sign other data
 example.com.  43200   IN      SOA     home.kuroiwa.eng.br. hostmaster.cesar.sec3.br. 2008040903 86400 86400 8640000 600
 example.com.	43200	IN	RRSIG	SOA 5 2 43200 20081010000000 20080410122550 31027 example.com. af7nqRak6cEeQLytqLHMIUKPsOECA4Cu/Zpm7vdnKSh2q2+/8ZwIxwHLyCEGdiu/mTYffZEHTZytJyzxnB0oxA== ;{id = 31027}
 ENTRY_END
 
-; entry to test
-ENTRY_BEGIN
-SECTION QUESTION
-bogus.a.example.com.       IN      DNSKEY
-SECTION ANSWER
-a.example.com. 3600    IN      DNSKEY  384 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3
-a.example.com.	3600	IN	RRSIG	DNSKEY 5 3 3600 20081010000000 20080410122550 31027 example.com. MdkvlzXlNEUrnk7jTXZ0whEjYLp1bGjOevL4yyzWAl+/LgaQqbFVApXbAQhHvouFQeoMp2+NvEGTLW8unBzJEw==
-ENTRY_END
-
-; entry to test
-ENTRY_BEGIN
-SECTION QUESTION
-secure.example.com.       IN      DNSKEY
-SECTION ANSWER
-; the REVOKE key can sign itself
-example.com.	3600	IN	DNSKEY	384 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 31027 (zsk), size = 512b}
-example.com.	3600	IN	RRSIG	DNSKEY 5 2 3600 20081010000000 20080410122550 31027 example.com. NEEY7W2F0XGUo9pVhiLALoz1ToM1gIS4TwUvVBPlIQMF+ZRGtB7PMthV0BN+aR+AEurxYsMfVmXEH2vKUVepgw==
-ENTRY_END
 

testdata/tls_reuse_auth.tdir/tls_reuse_auth.conf

@@ -1,22 +0,0 @@
-server:
-	verbosity: 5
-	# num-threads: 1
-	interface: 127.0.0.1
-	port: @PORT@
-	use-syslog: no
-	directory: .
-	pidfile: "unbound.pid"
-	chroot: ""
-	username: ""
-	do-not-query-localhost: no
-
-	tls-cert-bundle: "unbound_server.pem"
-	tls-upstream: yes
-
-forward-zone:
-	name: "."
-	forward-addr: "127.0.0.1@@TOPORT@#unbound"
-
-forward-zone:
-	name: "example.org."
-	forward-addr: "127.0.0.1@@TOPORT@#badname"

testdata/tls_reuse_auth.tdir/tls_reuse_auth.conf2

@@ -1,40 +0,0 @@
-# this is the upstream server that has pipelining and responds to queries.
-server:
-	verbosity: 1
-	# num-threads: 1
-	interface: 127.0.0.1@@PORT@
-	port: @PORT@
-	use-syslog: no
-	directory: .
-	pidfile: "unbound2.pid"
-	chroot: ""
-	username: ""
-	do-not-query-localhost: no
-	tls-port: @PORT@
-	tls-service-key: "unbound_server.key"
-	tls-service-pem: "unbound_server.pem"
-	tcp-idle-timeout: 10000
-
-	log-queries: yes
-	log-replies: yes
-	log-identity: "upstream"
-
-	local-zone: "." refuse
-	local-zone: "example.com" static
-	local-data: "www.example.com  A 10.20.30.40"
-	local-data: "www1.example.com  A 10.20.30.41"
-	local-data: "www2.example.com  A 10.20.30.42"
-	local-data: "www3.example.com  A 10.20.30.43"
-	local-data: "www4.example.com  A 10.20.30.44"
-	local-data: "www5.example.com  A 10.20.30.45"
-	local-data: "www6.example.com  A 10.20.30.46"
-	local-data: "www7.example.com  A 10.20.30.47"
-
-	local-data: "www.example.org  A 10.20.31.40"
-	local-data: "badname.example.org  A 10.20.31.41"
-
-# if queries escape, send them to localhost
-forward-zone:
-	name: "."
-	forward-tls-upstream: yes
-	forward-addr: "127.0.0.1@@TOPORT@"

testdata/tls_reuse_auth.tdir/tls_reuse_auth.dsc

@@ -1,16 +0,0 @@
-BaseName: tls_reuse_auth
-Version: 1.0
-Description: Test tls stream reuse with tls auth name.
-CreationDate: Thu Apr 02 11:11:00 CEST 2026
-Maintainer: Wouter Wijngaards
-Category: 
-Component:
-CmdDepends: 
-Depends: 
-Help:
-Pre: tls_reuse_auth.pre
-Post: tls_reuse_auth.post
-Test: tls_reuse_auth.test
-AuxFiles: 
-Passed:
-Failure:

testdata/tls_reuse_auth.tdir/tls_reuse_auth.post

@@ -1,19 +0,0 @@
-# #-- tls_reuse_auth.post --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# source the test var file when it's there
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-#
-# do your teardown here
-. ../common.sh
-kill_from_pidfile "unbound2.pid"
-if test -f unbound2.log; then
-	echo ">>> upstream log"
-	cat unbound2.log
-fi
-#kill_pid $UNBOUND_PID
-kill_from_pidfile "unbound.pid"
-if test -f unbound.log; then
-	echo ">>> unbound log"
-	cat unbound.log
-fi

testdata/tls_reuse_auth.tdir/tls_reuse_auth.pre

@@ -1,34 +0,0 @@
-# #-- tls_reuse_auth.pre--#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-get_random_port 2
-UNBOUND_PORT=$RND_PORT
-UPSTREAM_PORT=$(($RND_PORT + 1))
-echo "UNBOUND_PORT=$UNBOUND_PORT" >> .tpkg.var.test
-echo "UPSTREAM_PORT=$UPSTREAM_PORT" >> .tpkg.var.test
-
-# make config file
-sed -e 's/@PORT\@/'$UNBOUND_PORT'/' -e 's/@TOPORT\@/'$UPSTREAM_PORT'/' < tls_reuse_auth.conf > ub.conf
-# start unbound in the background
-#$PRE/unbound -d -c ub.conf >unbound.log 2>&1 &
-$PRE/unbound -d -c ub.conf 2>&1 | tee unbound.log &
-UNBOUND_PID=$!
-echo "UNBOUND_PID=$UNBOUND_PID" >> .tpkg.var.test
-wait_unbound_up unbound.log
-
-# make upstream config file
-sed -e 's/@PORT\@/'$UPSTREAM_PORT'/' -e 's/@TOPORT\@/'$UPSTREAM_PORT'/' < tls_reuse_auth.conf2 > ub2.conf
-# start upstream unbound in the background
-#$PRE/unbound -d -c ub2.conf >unbound2.log 2>&1 &
-$PRE/unbound -d -c ub2.conf 2>&1 | tee unbound2.log &
-UPSTREAM_PID=$!
-echo "UPSTREAM_PID=$UPSTREAM_PID" >> .tpkg.var.test
-wait_unbound_up unbound2.log
-
-cat .tpkg.var.test
-

testdata/tls_reuse_auth.tdir/tls_reuse_auth.test

@@ -1,90 +0,0 @@
-# #-- tls_reuse_auth.test --#
-# source the master var file when it's there
-[ -f ../.tpkg.var.master ] && source ../.tpkg.var.master
-# use .tpkg.var.test for in test variable passing
-[ -f .tpkg.var.test ] && source .tpkg.var.test
-
-PRE="../.."
-. ../common.sh
-
-get_make
-(cd $PRE; $MAKE streamtcp)
-
-echo "> query www1.example.com."
-$PRE/streamtcp -f 127.0.0.1@$UNBOUND_PORT www1.example.com. A IN >outfile 2>&1
-cat outfile
-if test "$?" -ne 0; then
-	echo "exit status not OK"
-	echo "> cat logfiles"
-	cat outfile
-	cat unbound2.log 
-	cat unbound.log
-	echo "Not OK"
-	exit 1
-fi
-if grep "www1.example.com" outfile | grep "10.20.30.41"; then
-	echo "content OK"
-else
-	echo "result contents not OK, for www1.example.com"
-	echo "> cat logfiles"
-	cat outfile
-	cat unbound2.log 
-	cat unbound.log
-	echo "result contents not OK, for www1.example.com"
-	exit 1
-fi
-echo "OK"
-echo ""
-
-# this should be reused on the same tcp stream:
-echo "> query www2.example.com."
-$PRE/streamtcp -f 127.0.0.1@$UNBOUND_PORT www2.example.com. A IN >outfile 2>&1
-cat outfile
-if test "$?" -ne 0; then
-	echo "exit status not OK"
-	echo "> cat logfiles"
-	cat outfile
-	cat unbound2.log 
-	cat unbound.log
-	echo "Not OK"
-	exit 1
-fi
-if grep "www2.example.com" outfile | grep "10.20.30.42"; then
-	echo "content OK"
-else
-	echo "result contents not OK, for www2.example.com"
-	echo "> cat logfiles"
-	cat outfile
-	cat unbound2.log 
-	cat unbound.log
-	echo "result contents not OK, for www2.example.com"
-	exit 1
-fi
-
-# bad query with different auth name.
-echo "> query badname.example.org."
-$PRE/streamtcp -f 127.0.0.1@$UNBOUND_PORT badname.example.org. A IN >outfile 2>&1
-cat outfile
-if test "$?" -ne 0; then
-	echo "exit status not OK"
-	echo "> cat logfiles"
-	cat outfile
-	cat unbound2.log 
-	cat unbound.log
-	echo "Not OK"
-	exit 1
-fi
-if grep "badname.example.org" outfile | grep "10.20.31.41"; then
-	echo "result contents not OK, for badname.example.org"
-	echo "> cat logfiles"
-	cat outfile
-	cat unbound2.log 
-	cat unbound.log
-	echo "result contents not OK, for badname.example.org"
-	exit 1
-else
-	echo "content OK"
-fi
-
-echo "OK"
-exit 0

testdata/tls_reuse_auth.tdir/unbound_control.key

@@ -1,39 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIG4gIBAAKCAYEAstEp+Pyh8XGrtZ77A4FhYjvbeB3dMa7Q2rGWxobzlA9przhA
-1aChAvUtCOAuM+rB6NTNB8YWfZJbQHawyMNpmC77cg6vXLYCGUQHZyAqidN049RJ
-F5T7j4N8Vniv17LiRdr0S6swy4PRvEnIPPV43EQHZqC5jVvHsKkhIfmBF/Dj5TXR
-ypeawWV/m5jeU6/4HRYMfytBZdO1mPXuWLh0lgbQ4SCbgrOUVD3rniMk1yZIbQOm
-vlDHYqekjDb/vOW2KxUQLG04aZMJ1mWfdbwG0CKQkSjISEDZ1l76vhM6mTM0fwXb
-IvyFZ9yPPCle1mF5aSlxS2cmGuGVSRQaw8XF9fe3a9ACJJTr33HdSpyaZkKRAUzL
-cKqLCl323daKv3NwwAT03Tj4iQM416ASMoiyfFa/2GWTKQVjddu8Crar7tGaf5xr
-lig4DBmrBvdYA3njy72/RD71hLwmlRoCGU7dRuDr9O6KASUm1Ri91ONZ/qdjMvov
-15l2vj4GV+KXR00dAgMBAAECggGAHepIL1N0dEQkCdpy+/8lH54L9WhpnOo2HqAf
-LU9eaKK7d4jdr9+TkD8cLaPzltPrZNxVALvu/0sA4SP6J1wpyj/x6P7z73qzly5+
-Xo5PD4fEwmi9YaiW/UduAblnEZrnp/AddptJKoL/D5T4XtpiQddPtael4zQ7kB57
-YIexRSQTvEDovA/o3/nvA0TrzOxfgd4ycQP3iOWGN/TMzyLsvjydrUwbOB567iz9
-whL3Etdgvnwh5Sz2blbFfH+nAR8ctvFFz+osPvuIVR21VMEI6wm7kTpSNnQ6sh/c
-lrLb/bTADn4g7z/LpIZJ+MrLvyEcoqValrLYeFBhM9CV8woPxvkO2P3pU47HVGax
-tC7GV6a/kt5RoKFd/TNdiA3OC7NGZtaeXv9VkPf4fVwBtSO9d5ZZXTGEynDD/rUQ
-U4KFJe6OD23APjse08HiiKqTPhsOneOONU67iqoaTdIkT2R4EdlkVEDpXVtWb+G9
-Q+IqYzVljlzuyHrhWXLJw/FMa2aBAoHBAOnZbi4gGpH+P6886WDWVgIlTccuXoyc
-Mg9QQYk9UDeXxL0AizR5bZy49Sduegz9vkHpAiZARQsUnizHjZ8YlRcrmn4t6tx3
-ahTIKAjdprnxJfYINM580j8CGbXvX5LhIlm3O267D0Op+co3+7Ujy+cjsIuFQrP+
-1MqMgXSeBjzC1APivmps7HeFE+4w0k2PfN5wSMDNCzLo99PZuUG5XZ93OVOS5dpN
-b+WskdcD8NOoJy/X/5A08veEI/jYO/DyqQKBwQDDwUQCOWf41ecvJLtBHKmEnHDz
-ftzHino9DRKG8a9XaN4rmetnoWEaM2vHGX3pf3mwH+dAe8vJdAQueDhBKYeEpm6C
-TYNOpou1+Zs5s99BilCTNYo8fkMOAyqwRwmz9zgHS6QxXuPwsghKefLJGt6o6RFF
-tfWVTfLlYJ+I3GQe3ySsk3wjVz4oUTKiyiq5+KzD+HhEkS7u+RQ7Z0ZI2xd2cF8Y
-aN2hjKDpcOiFf3CDoqka5D1qMNLgIHO52AHww1UCgcA1h7o7AMpURRka6hyaODY0
-A4oMYEbwdQjYjIyT998W+rzkbu1us6UtzQEBZ760npkgyU/epbOoV63lnkCC/MOU
-LD0PST+L/CHiY/cWIHb79YG1EifUZKpUFg0Aoq0EGFkepF0MefGCkbRGYA5UZr9U
-R80wAu9D+L+JJiS0J0BSRF74DL196zUuHt5zFeXuLzxsRtPAnq9DliS08BACRYZy
-7H3I7cWD9Vn5/0jbKWHFcaaWwyETR6uekTcSzZzbCRECgcBeoE3/xUA9SSk34Mmj
-7/cB4522Ft0imA3+9RK/qJTZ7Bd5fC4PKjOGNtUiqW/0L2rjeIiQ40bfWvWqgPKw
-jSK1PL6uvkl6+4cNsFsYyZpiVDoe7wKju2UuoNlB3RUTqa2r2STFuNj2wRjA57I1
-BIgdnox65jqQsd14g/yaa+75/WP9CE45xzKEyrtvdcqxm0Pod3OrsYK+gikFjiar
-kT0GQ8u0QPzh2tjt/2ZnIfOBrl+QYERP0MofDZDjhUdq2wECgcB0Lu841+yP5cdR
-qbJhXO4zJNh7oWNcJlOuQp3ZMNFrA1oHpe9pmLukiROOy01k9WxIMQDzU5GSqRv3
-VLkYOIcbhJ3kClKAcM3j95SkKbU2H5/RENb3Ck52xtl4pNU1x/3PnVFZfDVuuHO9
-MZ9YBcIeK98MyP2jr5JtFKnOyPE7xKq0IHIhXadpbc2wjje5FtZ1cUtMyEECCXNa
-C1TpXebHGyXGpY9WdWXhjdE/1jPvfS+uO5WyuDpYPr339gsdq1g=
------END RSA PRIVATE KEY-----

testdata/tls_reuse_auth.tdir/unbound_control.pem

@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDszCCAhsCFGD5193whHQ2bVdzbaQfdf1gc4SkMA0GCSqGSIb3DQEBCwUAMBIx
-EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjMwWhcNNDAwMzI1MTMzMjMw
-WjAaMRgwFgYDVQQDDA91bmJvdW5kLWNvbnRyb2wwggGiMA0GCSqGSIb3DQEBAQUA
-A4IBjwAwggGKAoIBgQCy0Sn4/KHxcau1nvsDgWFiO9t4Hd0xrtDasZbGhvOUD2mv
-OEDVoKEC9S0I4C4z6sHo1M0HxhZ9kltAdrDIw2mYLvtyDq9ctgIZRAdnICqJ03Tj
-1EkXlPuPg3xWeK/XsuJF2vRLqzDLg9G8Scg89XjcRAdmoLmNW8ewqSEh+YEX8OPl
-NdHKl5rBZX+bmN5Tr/gdFgx/K0Fl07WY9e5YuHSWBtDhIJuCs5RUPeueIyTXJkht
-A6a+UMdip6SMNv+85bYrFRAsbThpkwnWZZ91vAbQIpCRKMhIQNnWXvq+EzqZMzR/
-Bdsi/IVn3I88KV7WYXlpKXFLZyYa4ZVJFBrDxcX197dr0AIklOvfcd1KnJpmQpEB
-TMtwqosKXfbd1oq/c3DABPTdOPiJAzjXoBIyiLJ8Vr/YZZMpBWN127wKtqvu0Zp/
-nGuWKDgMGasG91gDeePLvb9EPvWEvCaVGgIZTt1G4Ov07ooBJSbVGL3U41n+p2My
-+i/XmXa+PgZX4pdHTR0CAwEAATANBgkqhkiG9w0BAQsFAAOCAYEAd++Wen6l8Ifj
-4h3p/y16PhSsWJWuJ4wdNYy3/GM84S26wGjzlEEwiW76HpH6VJzPOiBAeWnFKE83
-hFyetEIxgJeIPbcs9ZP/Uoh8GZH9tRISBSN9Hgk2Slr9llo4t1H0g/XTgA5HqMQU
-9YydlBh43G7Vw3FVwh09OM6poNOGQKNc/tq2/QdKeUMtyBbLWpRmjH5XcCT35fbn
-ZiVOUldqSHD4kKrFO4nJYXZyipRbcXybsLiX9GP0GLemc3IgIvOXyJ2RPp06o/SJ
-pzlMlkcAfLJaSuEW57xRakhuNK7m051TKKzJzIEX+NFYOVdafFHS8VwGrYsdrFvD
-72tMfu+Fu55y3awdWWGc6YlaGogZiuMnJkvQphwgn+5qE/7CGEckoKEsH601rqIZ
-muaIc85+nEcHJeijd/ZlBN9zeltjFoMuqTUENgmv8+tUAdVm/UMY9Vjme6b43ydP
-uv6DS02+k9z8toxXworLiPr94BGaiGV1NxgwZKLZigYJt/Fi2Qte
------END CERTIFICATE-----

testdata/tls_reuse_auth.tdir/unbound_server.key

@@ -1,39 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIG5AIBAAKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI
-0x41iG32a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+Nqq
-GRS7XVQ24vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Z
-uh9MDgotaBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8K
-WaBe1ca4TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5
-FzUReSXZuTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xP
-q6O9UPj4+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XL
-A5UoZgRzXgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP
-7kFZSngxdy1+A/bNAgMBAAECggGBALpTOIqQwVg4CFBylL/a8K1IWJTI/I65sklf
-XxYL7G7SB2HlEJ//z+E+F0+S4Vlao1vyLQ5QkgE82pAUB8FoMWvY1qF0Y8A5wtm6
-iZSGk4OLK488ZbT8Ii9i+AGKgPe2XbVxsJwj8N4k7Zooqec9hz73Up8ATEWJkRz7
-2u7oMGG4z91E0PULA64dOi3l/vOQe5w/Aa+CwVbAWtI05o7kMvQEBMDJn6C7CByo
-MB5op9wueJMnz7PM7hns+U7Dy6oE4ljuolJUy51bDzFWwoM54cRoQqLFNHd8JVQj
-WxldCkbfF43iyprlsEcUrTyUjtdA+ZeiG39vg/mtdmgNpGmdupHJZQvSuG8IcVlz
-O+eMSeQS1QXPD6Ik8UK4SU0h+zOl8xIWtRrsxQuh4fnTN40udm/YUWl/6gOebsBI
-IrVLlKGqJSfB3tMjpCRqdTzJ0dA9keVpkqm2ugZkxEf1+/efq/rFIQ2pUBLCqNTN
-qpNqruK8y8FphP30I2uI4Ej2UIB8AQKBwQDd2Yptj2FyDyaXCycsyde0wYkNyzGU
-dRnzdibfHnMZwjgTjwAwgIUBVIS8H0/z7ZJQKN7osJfddMrtjJtYYUk9g/dCpHXs
-bNh2QSoWah3FdzNGuWd0iRf9+LFxhjAAMo/FS8zFJAJKrFsBdCGTfFUMdsLC0bjr
-YjiWBuvV72uKf8XIZX5KIZruKdWBBcWukcb21R1UDyFYyXRBsly5XHaIYKZql3km
-7pV7MKWO0IYgHbHIqGUqPQlzZ/lkunS1jKECgcEA23wHffD6Ou9/x3okPx2AWpTr
-gh8rgqbyo6hQkBW5Y90Wz824cqaYebZDaBR/xlVx/YwjKkohv8Bde2lpH/ZxRZ1Z
-5Sk2s6GJ/vU0L9RsJZgCgj4L6Coal1NMxuZtCXAlnOpiCdxSZgfqbshbTVz30KsG
-ZJG361Cua1ScdAHxlZBxT52/1Sm0zRC2hnxL7h4qo7Idmtzs40LAJvYOKekR0pPN
-oWeJfra7vgx/jVNvMFWoOoSLpidVO4g+ot4ery6tAoHAdW3rCic1C2zdnmH28Iw+
-s50l8Lk3mz+I5wgJd1zkzCO0DxZIoWPGA3g7cmCYr6N3KRsZMs4W9NAXgjpFGDkW
-zYsG3K21BdpvkdjYcFjnPVjlOXB2RIc0vehf9Jl02wXoeCSxVUDEPcaRvWk9RJYx
-ZpGOchUU7vNkxHURbIJ4yCzuAi9G8/Jp0dsu+kaV5tufF5SjG5WOrzKjaQsCbdN1
-oqaWMCHRrTvov/Z2C+xwsptFOdN5CSyZzg6hQiI4GMlBAoHAXyb6KINcOEi0YMp3
-BFXJ23tMTnEs78tozcKeipigcsbaqORK3omS+NEnj+uzKUzJyl4CsMbKstK2tFYS
-mSTCHqgE3PBtIpsZtEqhgUraR8IK9GPpzZDTTl9ynZgwFTNlWw3RyuyVXF56J+T8
-kCGJ3hEHCHqT/ZRQyX85BKIDFhA0z4tYKxWVqIFiYBNq56R0X9tMMmMs36mEnF93
-7Ht6mowxTZQRa7nU0qOgeKh/P7ki4Zus3y+WJ+T9IqahLtlRAoHBAIhqMrcxSAB8
-RpB9jukJlAnidw2jCMPgrFE8tP0khhVvGrXMldxAUsMKntDIo8dGCnG1KTcWDI0O
-jepvSPHSsxVLFugL79h0eVIS5z4huW48i9xgU8VlHdgAcgEPIAOFcOw2BCu/s0Vp
-O+MM/EyUOdo3NsibB3qc/GJI6iNBYS7AljYEVo6rXo5V/MZvZUF4vClen6Obzsre
-MTTb+4sJjfqleWuvr1XNMeu2mBfXBQkWGZP1byBK0MvD/aQ2PWq92A==
------END RSA PRIVATE KEY-----

testdata/tls_reuse_auth.tdir/unbound_server.pem

@@ -1,22 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIDqzCCAhMCFBHWXeQ6ZIa9QcQbXLFfC6tj+KA+MA0GCSqGSIb3DQEBCwUAMBIx
-EDAOBgNVBAMMB3VuYm91bmQwHhcNMjAwNzA4MTMzMjI5WhcNNDAwMzI1MTMzMjI5
-WjASMRAwDgYDVQQDDAd1bmJvdW5kMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIB
-igKCAYEAvjSVSN2QMXudpzukdLCqgg/IOhCX8KYkD0FFFfWcQjgKq5wI0x41iG32
-a6wbGanre4IX7VxaSPu9kkHfnGgynCk5nwDRedE/FLFhAU78PoT0+NqqGRS7XVQ2
-4vLmIz9Hqc2Ozx1um1BXBTmIT0UfN2e22I0LWQ6a3seZlEDRj45gnk7Zuh9MDgot
-aBdm+v1JAbupSf6Zis4VEH3JNdvVGE3O1DHEIeuuz/3BDhpf6WBDH+8KWaBe1ca4
-TZHr9ThL2gEMEfAQl0wXDwRWRoi3NjNMH+mw0L1rjwThI5GXqNIee7o5FzUReSXZ
-uTdFMyGe3Owcx+XoYnwi6cplSNoGsDBu4B9bKKglR9YleJVw4L4Xi8xPq6O9UPj4
-+nypHk/DOoC7DIM3ufN0yxPBsFo5TVowxfhdjZXJbbftd2TZv7AH8+XLA5UoZgRz
-XgzECelXSCTBFlMTnT48LfA9pMLydyjAz2UdPHs5Iv+TK5nnI+aJoeaP7kFZSngx
-dy1+A/bNAgMBAAEwDQYJKoZIhvcNAQELBQADggGBABunf93MKaCUHiZgnoOTinsW
-84/EgInrgtKzAyH+BhnKkJOhhR0kkIAx5d9BpDlaSiRTACFon9moWCgDIIsK/Ar7
-JE0Kln9cV//wiiNoFU0O4mnzyGUIMvlaEX6QHMJJQYvL05+w/3AAcf5XmMJtR5ca
-fJ8FqvGC34b2WxX9lTQoyT52sRt+1KnQikiMEnEyAdKktMG+MwKsFDdOwDXyZhZg
-XZhRrfX3/NVJolqB6EahjWIGXDeKuSSKZVtCyib6LskyeMzN5lcRfvubKDdlqFVF
-qlD7rHBsKhQUWK/IO64mGf7y/de+CgHtED5vDvr/p2uj/9sABATfbrOQR3W/Of25
-sLBj4OEfrJ7lX8hQgFaxkMI3x6VFT3W8dTCp7xnQgb6bgROWB5fNEZ9jk/gjSRmD
-yIU+r0UbKe5kBk/CmZVFXL2TyJ92V5NYEQh8V4DGy19qZ6u/XKYyNJL4ocs35GGe
-CA8SBuyrmdhx38h1RHErR2Skzadi1S7MwGf1y431fQ==
------END CERTIFICATE-----

testdata/val_ds_cname.rpl

@@ -199,7 +199,7 @@ ENTRY_END
 ; recursion happens here.
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ede=6
+MATCH all ede=10
 REPLY QR RD RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A
@@ -215,7 +215,7 @@ ENTRY_END
 
 STEP 12 CHECK_ANSWER
 ENTRY_BEGIN
-MATCH all ede=6
+MATCH all ede=10
 REPLY QR RA DO SERVFAIL
 SECTION QUESTION
 www.example.com. IN A

testdata/zonemd.example_a3.zone

@@ -24,7 +24,11 @@ example.      86400   IN  ZONEMD  2018031900 1 240 (
 example.      86400   IN  ZONEMD  2018031900 241 1 (
                                   e1846540e33a9e41
                                   89792d18d5d131f6
-                                  05fc283e )
+                                  05fc283e00000000
+                                  6792901f9f88e637
+                                  493daaf401c92c27
+                                  9dd10f0edb1c56f8
+				  )
 ns1.example.  3600    IN  A       203.0.113.63
 ns2.example.  86400   IN  TXT     "This example has multiple digests"
 ns2.example.  3600    IN  AAAA    2001:db8::63

util/alloc.c

@@ -328,7 +328,7 @@ size_t alloc_get_mem(struct alloc_cache* alloc)
 struct regional* 
 alloc_reg_obtain(struct alloc_cache* alloc)
 {
-	if(alloc->num_reg_blocks > 0 && alloc->reg_list) {
+	if(alloc->num_reg_blocks > 0) {
 		struct regional* r = alloc->reg_list;
 		alloc->reg_list = (struct regional*)r->next;
 		r->next = NULL;

util/config_file.c

@@ -62,9 +62,6 @@
 #include "sldns/wire2str.h"
 #include "sldns/parseutil.h"
 #include "iterator/iterator.h"
-#ifdef HAVE_SYS_STAT_H
-#include <sys/stat.h>
-#endif
 #ifdef HAVE_GLOB_H
 # include <glob.h>
 #endif
@@ -132,7 +129,7 @@ config_create(void)
 	cfg->tls_cert_bundle = NULL;
 	cfg->tls_win_cert = 0;
 	cfg->tls_use_sni = 1;
-	if(!(cfg->tls_protocols = strdup("TLSv1.2 TLSv1.3"))) goto error_exit;
+	cfg->tls_use_system_policy_versions = 0;
 	cfg->https_port = UNBOUND_DNS_OVER_HTTPS_PORT;
 	if(!(cfg->http_endpoint = strdup("/dns-query"))) goto error_exit;
 	cfg->http_max_streams = 100;
@@ -426,7 +423,6 @@ config_create(void)
 	cfg->dns_error_reporting = 0;
 	cfg->iter_scrub_ns = 20;
 	cfg->iter_scrub_cname = 11;
-	cfg->iter_scrub_rrsig = 8;
 	cfg->iter_scrub_promiscuous = 1;
 	cfg->max_global_quota = 200;
 	return cfg;
@@ -635,11 +631,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_STR("tls-ciphers:", tls_ciphers)
 	else S_STR("tls-ciphersuites:", tls_ciphersuites)
 	else S_YNO("tls-use-sni:", tls_use_sni)
-	else if(strcmp(opt, "tls-protocols:") == 0) {
-		if(!cfg_tls_protocols_is_valid(val)) return 0;
-		free(cfg->tls_protocols);
-		return (cfg->tls_protocols = strdup(val)) != NULL;
-	}
+	else S_YNO("tls-use-system-policy-versions:", tls_use_system_policy_versions)
 	else S_NUMBER_NONZERO("https-port:", https_port)
 	else S_STR("http-endpoint:", http_endpoint)
 	else S_NUMBER_NONZERO("http-max-streams:", http_max_streams)
@@ -778,7 +770,6 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_YNO("dns-error-reporting:", dns_error_reporting)
 	else S_NUMBER_OR_ZERO("iter-scrub-ns:", iter_scrub_ns)
 	else S_NUMBER_OR_ZERO("iter-scrub-cname:", iter_scrub_cname)
-	else S_NUMBER_OR_ZERO("iter-scrub-rrsig:", iter_scrub_rrsig)
 	else S_YNO("iter-scrub-promiscuous:", iter_scrub_promiscuous)
 	else S_NUMBER_OR_ZERO("max-global-quota:", max_global_quota)
 	else S_YNO("serve-original-ttl:", serve_original_ttl)
@@ -1194,7 +1185,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_STR(opt, "tls-ciphers", tls_ciphers)
 	else O_STR(opt, "tls-ciphersuites", tls_ciphersuites)
 	else O_YNO(opt, "tls-use-sni", tls_use_sni)
-	else O_STR(opt, "tls-protocols", tls_protocols)
+	else O_YNO(opt, "tls-use-system-policy-versions", tls_use_system_policy_versions)
 	else O_DEC(opt, "https-port", https_port)
 	else O_STR(opt, "http-endpoint", http_endpoint)
 	else O_UNS(opt, "http-max-streams", http_max_streams)
@@ -1258,7 +1249,6 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "dns-error-reporting", dns_error_reporting)
 	else O_DEC(opt, "iter-scrub-ns", iter_scrub_ns)
 	else O_DEC(opt, "iter-scrub-cname", iter_scrub_cname)
-	else O_DEC(opt, "iter-scrub-rrsig", iter_scrub_rrsig)
 	else O_YNO(opt, "iter-scrub-promiscuous", iter_scrub_promiscuous)
 	else O_DEC(opt, "max-global-quota", max_global_quota)
 	else O_YNO(opt, "serve-original-ttl", serve_original_ttl)
@@ -1766,7 +1756,6 @@ config_delete(struct config_file* cfg)
 	config_delstrlist(cfg->tls_session_ticket_keys.first);
 	free(cfg->tls_ciphers);
 	free(cfg->tls_ciphersuites);
-	free(cfg->tls_protocols);
 	free(cfg->http_endpoint);
 	if(cfg->log_identity) {
 		log_ident_revert_to_default();
@@ -2992,75 +2981,3 @@ cfg_has_quic(struct config_file* cfg)
 	return 0;
 #endif
 }
-
-int
-cfg_tls_protocols_is_valid(const char* tls_protocols)
-{
-	const char* s = tls_protocols;
-	while(*s && isspace((unsigned char)*s)) s++;
-	while(*s && !isspace((unsigned char)*s)) {
-		if(strncmp(s, "TLSv1.2", 7) == 0 ||
-			strncmp(s, "TLSv1.3", 7) == 0) {
-			s += 7;
-			if(*s && !isspace((unsigned char)*s)) {
-				/* something is attached; fail */
-				return 0;
-			}
-			while(*s && isspace((unsigned char)*s))
-				s++;
-			continue;
-		}
-		return 0;
-	}
-	return 1;
-}
-
-void
-cfg_tls_protocols_allowed(const char* tls_protocols, int* allow12, int* allow13)
-{
-	const char* s = tls_protocols;
-	*allow12 = 0;
-	*allow13 = 0;
-	if(tls_protocols == NULL) return;
-	while(*s && isspace((unsigned char)*s)) s++;
-	while(*s && !isspace((unsigned char)*s)) {
-		if(strncmp(s, "TLSv1.2", 7) == 0) {
-			*allow12 = 1;
-			s += 7;
-		} else if(strncmp(s, "TLSv1.3", 7) == 0) {
-			*allow13 = 1;
-			s += 7;
-		} else {
-			/* Unknown word, this should never happen but skip to
-			 * be safe */
-			while(*s && !isspace((unsigned char)*s))
-				s++;
-		}
-		while(*s && isspace((unsigned char)*s))
-			s++;
-	}
-}
-
-int
-file_get_mtime(const char* file, time_t* mtime, long* ns, int* nonexist)
-{
-	struct stat s;
-	if(stat(file, &s) != 0) {
-		*mtime = 0;
-		*ns = 0;
-		if(nonexist)
-			*nonexist = (errno == ENOENT);
-		return 0;
-	}
-	if(nonexist)
-		*nonexist = 0;
-	*mtime = s.st_mtime;
-#ifdef HAVE_STRUCT_STAT_ST_MTIMENSEC
-	*ns = s.st_mtimensec;
-#elif defined(HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC)
-	*ns = s.st_mtim.tv_nsec;
-#else
-	*ns = 0;
-#endif
-	return 1;
-}

util/config_file.h

@@ -148,8 +148,8 @@ struct config_file {
 	char* tls_ciphersuites;
 	/** if SNI is to be used */
 	int tls_use_sni;
-	/** TLS protocols */
-	char* tls_protocols;
+	/** if all TLS versions can be used; based on system policy (if any) */
+	int tls_use_system_policy_versions;
 
 	/** port on which to provide DNS over HTTPS service */
 	int https_port;
@@ -794,8 +794,6 @@ struct config_file {
 	size_t iter_scrub_ns;
 	/** limit on CNAME, DNAME RRs in answer for the iterator scrubber. */
 	int iter_scrub_cname;
-	/** limit on RRSIGs for an RRset for the iterator scrubber. */
-	int iter_scrub_rrsig;
 	/** limit on upstream queries for an incoming query and subqueries. */
 	int max_global_quota;
 	/** Should the iterator scrub promiscuous NS rrsets, from positive
@@ -1495,22 +1493,4 @@ size_t getmem_str(char* str);
  */
 int cfg_ports_list_contains(char* ports, int p);
 
-/**
- * Check if the configured string contains supported TLS protocols.
- * @param tls_protocols: String with TLS protocols.
- * @return true if all options are valid, else false.
- */
-int cfg_tls_protocols_is_valid(const char* tls_protocols);
-
-/**
- * Based on the configured TLS protocols fill which ones are allowed.
- * @param tls_protocols: String with TLS protocols.
- * @param allow12: will be true if TLSv1.2 is configured.
- * @param allow13: will be true if TLSv1.3 is configured.
- */
-void cfg_tls_protocols_allowed(const char* tls_protocols, int* allow12, int* allow13);
-
-/** get the file mtime stat (or error, with errno and nonexist) */
-int file_get_mtime(const char* file, time_t* mtime, long* ns, int* nonexist);
-
 #endif /* UTIL_CONFIG_FILE_H */

util/configlexer.lex

@@ -13,6 +13,7 @@
 #pragma GCC diagnostic ignored "-Wsign-compare"
 #endif
 
+#include <ctype.h>
 #include <strings.h>
 #ifdef HAVE_GLOB_H
 # include <glob.h>
@@ -261,7 +262,7 @@ tls-session-ticket-keys{COLON}	{ YDVAR(1, VAR_TLS_SESSION_TICKET_KEYS) }
 tls-ciphers{COLON}		{ YDVAR(1, VAR_TLS_CIPHERS) }
 tls-ciphersuites{COLON}		{ YDVAR(1, VAR_TLS_CIPHERSUITES) }
 tls-use-sni{COLON}		{ YDVAR(1, VAR_TLS_USE_SNI) }
-tls-protocols{COLON}		{ YDVAR(1, VAR_TLS_PROTOCOLS) }
+tls-use-system-policy-versions{COLON}		{ YDVAR(1, VAR_TLS_USE_SYSTEM_POLICY_VERSIONS) }
 https-port{COLON}		{ YDVAR(1, VAR_HTTPS_PORT) }
 http-endpoint{COLON}		{ YDVAR(1, VAR_HTTP_ENDPOINT) }
 http-max-streams{COLON}		{ YDVAR(1, VAR_HTTP_MAX_STREAMS) }
@@ -606,7 +607,6 @@ dns-error-reporting{COLON}	{ YDVAR(1, VAR_DNS_ERROR_REPORTING ) }
 proxy-protocol-port{COLON}	{ YDVAR(1, VAR_PROXY_PROTOCOL_PORT) }
 iter-scrub-ns{COLON}		{ YDVAR(1, VAR_ITER_SCRUB_NS) }
 iter-scrub-cname{COLON}		{ YDVAR(1, VAR_ITER_SCRUB_CNAME) }
-iter-scrub-rrsig{COLON}		{ YDVAR(1, VAR_ITER_SCRUB_RRSIG) }
 max-global-quota{COLON}		{ YDVAR(1, VAR_MAX_GLOBAL_QUOTA) }
 iter-scrub-promiscuous{COLON}	{ YDVAR(1, VAR_ITER_SCRUB_PROMISCUOUS) }
 <INITIAL,val>{NEWLINE}		{ LEXOUT(("NL\n")); cfg_parser->line++; }

util/configparser.y

@@ -199,7 +199,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_DISCARD_TIMEOUT VAR_WAIT_LIMIT VAR_WAIT_LIMIT_COOKIE
 %token VAR_WAIT_LIMIT_NETBLOCK VAR_WAIT_LIMIT_COOKIE_NETBLOCK
 %token VAR_STREAM_WAIT_SIZE VAR_TLS_CIPHERS VAR_TLS_CIPHERSUITES VAR_TLS_USE_SNI
-%token VAR_TLS_PROTOCOLS
+%token VAR_TLS_USE_SYSTEM_POLICY_VERSIONS
 %token VAR_IPSET VAR_IPSET_NAME_V4 VAR_IPSET_NAME_V6
 %token VAR_TLS_SESSION_TICKET_KEYS VAR_RPZ VAR_TAGS VAR_RPZ_ACTION_OVERRIDE
 %token VAR_RPZ_CNAME_OVERRIDE VAR_RPZ_LOG VAR_RPZ_LOG_NAME
@@ -215,7 +215,6 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_HARDEN_UNKNOWN_ADDITIONAL VAR_DISABLE_EDNS_DO VAR_CACHEDB_NO_STORE
 %token VAR_LOG_DESTADDR VAR_CACHEDB_CHECK_WHEN_SERVE_EXPIRED
 %token VAR_COOKIE_SECRET_FILE VAR_ITER_SCRUB_NS VAR_ITER_SCRUB_CNAME
-%token VAR_ITER_SCRUB_RRSIG
 %token VAR_MAX_GLOBAL_QUOTA VAR_HARDEN_UNVERIFIED_GLUE VAR_LOG_TIME_ISO
 %token VAR_ITER_SCRUB_PROMISCUOUS VAR_LOG_THREAD_ID
 
@@ -348,7 +347,8 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_stream_wait_size | server_tls_ciphers |
 	server_tls_ciphersuites | server_tls_session_ticket_keys |
 	server_answer_cookie | server_cookie_secret | server_ip_ratelimit_cookie |
-	server_tls_use_sni | server_edns_client_string | server_tls_protocols |
+	server_tls_use_sni | server_edns_client_string |
+	server_tls_use_system_policy_versions |
 	server_edns_client_string_opcode | server_nsid |
 	server_zonemd_permissive_mode | server_max_reuse_tcp_queries |
 	server_tcp_reuse_timeout | server_tcp_auth_query_timeout |
@@ -359,7 +359,6 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_harden_unknown_additional | server_disable_edns_do |
 	server_log_destaddr | server_cookie_secret_file |
 	server_iter_scrub_ns | server_iter_scrub_cname | server_max_global_quota |
-	server_iter_scrub_rrsig |
 	server_harden_unverified_glue | server_log_time_iso | server_iter_scrub_promiscuous
 	;
 stub_clause: stubstart contents_stub
@@ -1158,13 +1157,13 @@ server_tls_use_sni: VAR_TLS_USE_SNI STRING_ARG
 		free($2);
 	}
 	;
-server_tls_protocols: VAR_TLS_PROTOCOLS STRING_ARG
+server_tls_use_system_policy_versions: VAR_TLS_USE_SYSTEM_POLICY_VERSIONS STRING_ARG
 	{
-		OUTYY(("P(server_tls_protocols:%s)\n", $2));
-		if(!cfg_tls_protocols_is_valid($2))
-			yyerror("tls-protocols: valid values are 'TLSv1.2' and 'TLSv1.3'.");
-		free(cfg_parser->cfg->tls_protocols);
-		cfg_parser->cfg->tls_protocols = $2;
+		OUTYY(("P(server_tls_use_system_policy_versions:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->tls_use_system_policy_versions = (strcmp($2, "yes")==0);
+		free($2);
 	}
 	;
 server_https_port: VAR_HTTPS_PORT STRING_ARG
@@ -2400,7 +2399,7 @@ server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 			yyerror("local-zone type: expected static, deny, "
 				"refuse, redirect, transparent, "
 				"typetransparent, inform, inform_deny, "
-				"inform_redirect, always_transparent, block_a, "
+				"inform_redirect, always_transparent, block_a,"
 				"always_refuse, always_nxdomain, "
 				"always_nodata, always_deny, always_null, "
 				"noview, nodefault or ipset");
@@ -4256,15 +4255,6 @@ server_iter_scrub_cname: VAR_ITER_SCRUB_CNAME STRING_ARG
 		free($2);
 	}
 	;
-server_iter_scrub_rrsig: VAR_ITER_SCRUB_RRSIG STRING_ARG
-	{
-		OUTYY(("P(server_iter_scrub_rrsig:%s)\n", $2));
-		if(atoi($2) == 0 && strcmp($2, "0") != 0)
-			yyerror("number expected");
-		else cfg_parser->cfg->iter_scrub_rrsig = atoi($2);
-		free($2);
-	}
-	;
 server_max_global_quota: VAR_MAX_GLOBAL_QUOTA STRING_ARG
 	{
 		OUTYY(("P(server_max_global_quota:%s)\n", $2));