Changelog entry for #1510 :

- Merge #1510 from Andy Warner: Move unlink of temp file to before fatal exit.
Merge pull request #1510 from aww-aww/patch-1
2026-09-22 01:34:56 +02:00 · 2026-09-21 14:13:00 +02:00 · 2026-09-21 14:08:55 +02:00 · 2026-09-21 03:51:24 -06:00 · 2026-09-16 10:47:44 +02:00 · 2026-09-16 10:44:49 +02:00
57 changed files with 3333 additions and 549 deletions
@@ -1,380 +0,0 @@
-language: c
-
-git:
-  depth: 5
-
-addons:
-  apt:
-    packages:
-    - libssl-dev
-    - libevent-dev
-    - libexpat-dev
-    - clang
-  homebrew:
-    packages:
-      - openssl
-      - libevent
-      - expat
-    # homebrew update takes 20min or hangs, so disable update
-    #update: true
-
-jobs:
-  include:
-    - os: linux
-      name: GCC on Linux, Amd64
-      compiler: gcc
-      arch: amd64
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: linux
-      name: Clang on Linux, Amd64, clang-analysis
-      compiler: clang
-      arch: amd64
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-        - TEST_ANALYZER=yes
-    - os: osx
-      osx_image: xcode12.2
-      name: Clang on OS X, Amd64, clang-analysis
-      compiler: clang
-      arch: amd64
-      env:
-        - TEST_OSX=yes
-        - CONFIG_OPTS="--enable-debug --disable-flto --with-ssl=/usr/local/opt/openssl --with-libexpat=/usr/local/opt/expat"
-        - TEST_ANALYZER=yes
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: linux
-      name: Libevent, GCC on Linux, Amd64
-      compiler: gcc
-      arch: amd64
-      env:
-        - TEST_LIBEVENT=yes
-        - CONFIG_OPTS="--with-libevent"
-    - os: linux
-      name: Libevent, Clang on Linux, Amd64
-      compiler: clang
-      arch: amd64
-      env:
-        - TEST_LIBEVENT=yes
-        - CONFIG_OPTS="--with-libevent"
-    - os: osx
-      osx_image: xcode12.2
-      name: Libevent, Clang on OS X, Amd64
-      compiler: clang
-      arch: amd64
-      env:
-        - TEST_OSX=yes
-        - TEST_LIBEVENT=yes
-        - CONFIG_OPTS="--disable-flto --with-ssl=/usr/local/opt/openssl --with-libevent=/usr/local/opt/libevent --with-libexpat=/usr/local/opt/expat"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: linux
-      name: UBsan, GCC on Linux, Amd64
-      compiler: gcc
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_UBSAN=yes
-    - os: linux
-      name: UBsan, Clang on Linux, Amd64
-      compiler: clang
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_UBSAN=yes
-    - os: linux
-      name: Asan, GCC on Linux, Amd64
-      compiler: gcc
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_ASAN=yes
-    - os: linux
-      name: Asan, Clang on Linux, Amd64
-      compiler: clang
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_ASAN=yes
-    - os: linux
-      name: GCC on Linux, Aarch64
-      compiler: gcc
-      arch: arm64
-      dist: bionic
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: linux
-      name: Clang on Linux, Aarch64
-      compiler: clang
-      arch: arm64
-      dist: bionic
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: linux
-      name: GCC on Linux, PowerPC64
-      compiler: gcc
-      arch: ppc64le
-      dist: bionic
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: linux
-      name: Clang on Linux, PowerPC64
-      compiler: clang
-      arch: ppc64le
-      dist: bionic
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: linux
-      name: GCC on Linux, s390x
-      compiler: gcc
-      arch: s390x
-      dist: bionic
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: linux
-      name: Clang on Linux, s390x
-      compiler: clang
-      arch: s390x
-      dist: bionic
-      env:
-        - CONFIG_OPTS="--enable-debug --disable-flto"
-    - os: osx
-      osx_image: xcode12.2
-      name: Apple iPhone on iOS, armv7
-      compiler: clang
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=armv7-apple-ios
-        - OPENSSL_HOST=ios-cross
-        - IOS_SDK=iPhoneOS
-        - IOS_CPU=armv7s
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: Apple iPhone on iOS, arm64
-      compiler: clang
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=aarch64-apple-ios
-        - OPENSSL_HOST=ios64-cross
-        - IOS_SDK=iPhoneOS
-        - IOS_CPU=arm64
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: Apple TV on iOS, arm64
-      compiler: clang
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=aarch64-apple-ios
-        - OPENSSL_HOST=ios64-cross
-        - IOS_SDK=AppleTVOS
-        - IOS_CPU=arm64
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: Apple Watch on iOS, armv7
-      compiler: clang
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=armv7-apple-ios
-        - OPENSSL_HOST=ios-cross
-        - IOS_SDK=WatchOS
-        - IOS_CPU=armv7k
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: iPhoneSimulator on OS X, i386
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=i386-apple-ios
-        - OPENSSL_HOST=iphoneos-cross
-        - IOS_CPU=i386
-        - IOS_SDK=iPhoneSimulator
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: iPhoneSimulator on OS X, x86_64
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=x86_64-apple-ios
-        - OPENSSL_HOST=iphoneos-cross
-        - IOS_CPU=x86_64
-        - IOS_SDK=iPhoneSimulator
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: AppleTVSimulator on OS X, x86_64
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=x86_64-apple-ios
-        - OPENSSL_HOST=iphoneos-cross
-        - IOS_CPU=x86_64
-        - IOS_SDK=AppleTVSimulator
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: osx
-      osx_image: xcode12.2
-      name: WatchSimulator on OS X, i386
-      env:
-        - TEST_IOS=yes
-        - AUTOTOOLS_HOST=i386-apple-ios
-        - OPENSSL_HOST=iphoneos-cross
-        - IOS_CPU=i386
-        - IOS_SDK=WatchSimulator
-        - IOS_PREFIX="$HOME/$IOS_SDK-$IOS_CPU"
-        - HOMEBREW_NO_AUTO_UPDATE=1
-    - os: linux
-      name: Android armv7a, Linux, Amd64
-      compiler: clang
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_ANDROID=yes
-        - AUTOTOOLS_HOST=armv7a-linux-androideabi
-        - OPENSSL_HOST=android-arm
-        - ANDROID_CPU=armv7a
-        - ANDROID_API=23
-        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
-        - ANDROID_SDK_ROOT="$HOME/android-sdk"
-        - ANDROID_NDK_ROOT="$HOME/android-ndk"
-    - os: linux
-      name: Android aarch64, Linux, Amd64
-      compiler: clang
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_ANDROID=yes
-        - AUTOTOOLS_HOST=aarch64-linux-android
-        - OPENSSL_HOST=android-arm64
-        - ANDROID_CPU=aarch64
-        - ANDROID_API=23
-        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
-        - ANDROID_SDK_ROOT="$HOME/android-sdk"
-        - ANDROID_NDK_ROOT="$HOME/android-ndk"
-    - os: linux
-      name: Android x86, Linux, Amd64
-      compiler: clang
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_ANDROID=yes
-        - AUTOTOOLS_HOST=i686-linux-android
-        - OPENSSL_HOST=android-x86
-        - ANDROID_CPU=x86
-        - ANDROID_API=23
-        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
-        - ANDROID_SDK_ROOT="$HOME/android-sdk"
-        - ANDROID_NDK_ROOT="$HOME/android-ndk"
-    - os: linux
-      name: Android x86_64, Linux, Amd64
-      compiler: clang
-      arch: amd64
-      dist: bionic
-      env:
-        - TEST_ANDROID=yes
-        - AUTOTOOLS_HOST=x86_64-linux-android
-        - OPENSSL_HOST=android-x86_64
-        - ANDROID_CPU=x86_64
-        - ANDROID_API=23
-        - ANDROID_PREFIX="$HOME/android$ANDROID_API-$ANDROID_CPU"
-        - ANDROID_SDK_ROOT="$HOME/android-sdk"
-        - ANDROID_NDK_ROOT="$HOME/android-ndk"
-
-  allow_failures:
-    - os: osx
-      name: Apple iPhone on iOS, armv7
-    - os: osx
-      name: Apple iPhone on iOS, arm64
-    - os: osx
-      name: Apple TV on iOS, arm64
-    - os: osx
-      name: Apple Watch on iOS, armv7
-    - os: osx
-      name: iPhoneSimulator on OS X, i386
-    - os: osx
-      name: iPhoneSimulator on OS X, x86_64
-    - os: osx
-      name: AppleTVSimulator on OS X, x86_64
-    - os: osx
-      name: WatchSimulator on OS X, i386
-    - os: linux
-      name: Android armv7a, Linux, Amd64
-    - os: linux
-      name: Android aarch64, Linux, Amd64
-    - os: linux
-      name: Android x86, Linux, Amd64
-    - os: linux
-      name: Android x86_64, Linux, Amd64
-
-before_script:
-  - |
-    if [ "$TEST_ANDROID" = "yes" ]; then
-      ./contrib/android/install_tools.sh
-    elif [ "$TEST_IOS" = "yes" ]; then
-      ./contrib/ios/install_tools.sh
-    fi
-
-# The Travis docs say to avoid calling exit in the script. It leads to
-# some code duplication to avoid failures in cross-compiles. Also see
-# https://docs.travis-ci.com/user/job-lifecycle/ in the Travis docs.
-script:
-  - |
-    export MAKE_TEST="yes"
-    if [ "$TEST_UBSAN" = "yes" ]; then
-      export CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=undefined -fno-sanitize-recover=all"
-    elif [ "$TEST_ASAN" = "yes" ]; then
-      export CFLAGS="-DNDEBUG -g2 -O3 -fsanitize=address"
-    fi
-  - |
-    if [ "$TEST_IOS" = "yes" ]; then
-      export AUTOTOOLS_BUILD="$(./config.guess)"
-      export PKG_CONFIG_PATH="$IOS_PREFIX/lib/pkgconfig"
-      source ./contrib/ios/setenv_ios.sh
-      ./contrib/ios/install_openssl.sh
-      ./contrib/ios/install_expat.sh
-      export CONFIG_OPTS="\
-        --build=$AUTOTOOLS_BUILD --host=$AUTOTOOLS_HOST \
-        --prefix=$IOS_PREFIX \
-        --with-ssl=$IOS_PREFIX --disable-gost \
-        --with-libexpat=$IOS_PREFIX "
-      echo CONFIG_OPTS ${CONFIG_OPTS}
-      export MAKE_TEST=no
-      export TEST_INSTALL=yes
-    fi
-  - |
-    if [ "$TEST_ANDROID" = "yes" ]; then
-      export AUTOTOOLS_BUILD="$(./config.guess)"
-      export PKG_CONFIG_PATH="$ANDROID_PREFIX/lib/pkgconfig"
-      ./contrib/android/install_ndk.sh
-      source ./contrib/android/setenv_android.sh
-      ./contrib/android/install_openssl.sh
-      ./contrib/android/install_expat.sh
-      export CONFIG_OPTS="\
-        --build=$AUTOTOOLS_BUILD --host=$AUTOTOOLS_HOST \
-        --prefix=$ANDROID_PREFIX \
-        --with-ssl=$ANDROID_PREFIX --disable-gost \
-        --with-libexpat=$ANDROID_PREFIX "
-      echo CONFIG_OPTS ${CONFIG_OPTS}
-      export MAKE_TEST=no
-      export TEST_INSTALL=yes
-    fi
-  - ./configure ${CONFIG_OPTS}
-  - make -j 2
-  - |
-    if [ "$MAKE_TEST" = "yes" ]; then
-      make test
-    fi
-  - |
-    if [ "$TEST_INSTALL" = "yes" ]; then
-      make install
-    fi
-  - |
-    if [ "$TEST_ANALYZER" = "yes" ]; then
-      (cd testdata/clang-analysis.tdir; bash clang-analysis.test)
-    fi
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for unbound 1.26.1.
+# Generated by GNU Autoconf 2.71 for unbound 1.26.2.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues>.
 #
@@ -622,8 +622,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.26.1'
-PACKAGE_STRING='unbound 1.26.1'
+PACKAGE_VERSION='1.26.2'
+PACKAGE_STRING='unbound 1.26.2'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues'
 PACKAGE_URL=''

@@ -1513,7 +1513,7 @@ if test "$ac_init_help" = "long"; then
  # Omit some internal or obsolete options to make the list less imposing.
  # This message is too long to be a string in the A/UX 3.1 sh.
  cat <<_ACEOF
-\`configure' configures unbound 1.26.1 to adapt to many kinds of systems.
+\`configure' configures unbound 1.26.2 to adapt to many kinds of systems.

 Usage: $0 [OPTION]... [VAR=VALUE]...

@@ -1579,7 +1579,7 @@ fi

 if test -n "$ac_init_help"; then
  case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.26.1:";;
+     short | recursive ) echo "Configuration of unbound 1.26.2:";;
   esac
  cat <<\_ACEOF

@@ -1832,7 +1832,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
  cat <<\_ACEOF
-unbound configure 1.26.1
+unbound configure 1.26.2
 generated by GNU Autoconf 2.71

 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2489,7 +2489,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.

-It was created by unbound $as_me 1.26.1, which was
+It was created by unbound $as_me 1.26.2, which was
 generated by GNU Autoconf 2.71.  Invocation command line was

  $ $0$ac_configure_args_raw
@@ -3253,11 +3253,11 @@ UNBOUND_VERSION_MAJOR=1

 UNBOUND_VERSION_MINOR=26

-UNBOUND_VERSION_MICRO=1
+UNBOUND_VERSION_MICRO=2


 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=40
+LIBUNBOUND_REVISION=41
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -3365,6 +3365,7 @@ LIBUNBOUND_AGE=1
 # 1.25.2 had 9:38:1
 # 1.26.0 had 9:39:1
 # 1.26.1 had 9:40:1
+# 1.26.2 had 9:41:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -25712,7 +25713,7 @@ printf "%s\n" "#define MAXSYSLOGMSGLEN 10240" >>confdefs.h



-version=1.26.1
+version=1.26.2

 { printf "%s\n" "$as_me:${as_lineno-$LINENO}: checking for build time" >&5
 printf %s "checking for build time... " >&6; }
@@ -26242,7 +26243,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.26.1, which was
+This file was extended by unbound $as_me 1.26.2, which was
 generated by GNU Autoconf 2.71.  Invocation command line was

  CONFIG_FILES    = $CONFIG_FILES
@@ -26310,7 +26311,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-unbound config.status 1.26.1
+unbound config.status 1.26.2
 configured by $0, generated by GNU Autoconf 2.71,
  with options \\"\$ac_cs_config\\"

@@ -12,14 +12,14 @@ sinclude(dnscrypt/dnscrypt.m4)
 # must be numbers. ac_defun because of later processing
 m4_define([VERSION_MAJOR],[1])
 m4_define([VERSION_MINOR],[26])
-m4_define([VERSION_MICRO],[1])
+m4_define([VERSION_MICRO],[2])
 AC_INIT([unbound],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues],[unbound])
 AC_SUBST(UNBOUND_VERSION_MAJOR, [VERSION_MAJOR])
 AC_SUBST(UNBOUND_VERSION_MINOR, [VERSION_MINOR])
 AC_SUBST(UNBOUND_VERSION_MICRO, [VERSION_MICRO])

 LIBUNBOUND_CURRENT=9
-LIBUNBOUND_REVISION=40
+LIBUNBOUND_REVISION=41
 LIBUNBOUND_AGE=1
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -127,6 +127,7 @@ LIBUNBOUND_AGE=1
 # 1.25.2 had 9:38:1
 # 1.26.0 had 9:39:1
 # 1.26.1 had 9:40:1
+# 1.26.2 had 9:41:1

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -554,7 +554,7 @@ move_into_cache(struct ub_packed_rrset_key* k,

 	ref.key = ak;
 	ref.id = ak->id;
-	(void)rrset_cache_update(worker->env.rrset_cache, &ref,
+	rrset_cache_update_unlock(worker->env.rrset_cache, &ref,
 		worker->alloc, *worker->env.now);

 	return 1;
@@ -2681,7 +2681,7 @@ static int
 ssl_print_name_dp(RES* ssl, const char* str, uint8_t* nm, uint16_t dclass,
 	struct delegpt* dp)
 {
-	char buf[LDNS_MAX_DOMAINLEN];
+	char buf[LDNS_MAX_DOMAINLEN], portstr[128], tls_auth_name[256];
 	struct delegpt_ns* ns;
 	struct delegpt_addr* a;
 	int f = 0;
@@ -2696,13 +2696,32 @@ ssl_print_name_dp(RES* ssl, const char* str, uint8_t* nm, uint16_t dclass,
 	}
 	for(ns = dp->nslist; ns; ns = ns->next) {
 		dname_str(ns->name, buf);
-		if(!ssl_printf(ssl, "%s%s", (f?" ":""), buf))
+		if(ns->port != UNBOUND_DNS_PORT)
+			snprintf(portstr, sizeof(portstr), "@%d", ns->port);
+		else	portstr[0]=0;
+		if(ns->tls_auth_name)
+			snprintf(tls_auth_name, sizeof(tls_auth_name), "#%s",
+				ns->tls_auth_name);
+		else	tls_auth_name[0]=0;
+		if(!ssl_printf(ssl, "%s%s%s%s", (f?" ":""), buf, portstr,
+			tls_auth_name))
 			return 0;
 		f = 1;
 	}
 	for(a = dp->target_list; a; a = a->next_target) {
+		int port = (unsigned)((a->addr.ss_family == AF_INET) ?
+			ntohs(((struct sockaddr_in*)&a->addr)->sin_port) :
+			ntohs(((struct sockaddr_in6*)&a->addr)->sin6_port));
 		addr_to_str(&a->addr, a->addrlen, buf, sizeof(buf));
-		if(!ssl_printf(ssl, "%s%s", (f?" ":""), buf))
+		if(port != UNBOUND_DNS_PORT)
+			snprintf(portstr, sizeof(portstr), "@%d", port);
+		else	portstr[0]=0;
+		if(a->tls_auth_name)
+			snprintf(tls_auth_name, sizeof(tls_auth_name), "#%s",
+				a->tls_auth_name);
+		else	tls_auth_name[0]=0;
+		if(!ssl_printf(ssl, "%s%s%s%s", (f?" ":""), buf, portstr,
+			tls_auth_name))
 			return 0;
 		f = 1;
 	}
@@ -6354,6 +6373,7 @@ fr_atomic_copy_cfg(struct config_file* oldcfg, struct config_file* cfg,
 	COPY_VAR_int(harden_referral_path);
 	COPY_VAR_int(harden_algo_downgrade);
 	COPY_VAR_int(harden_unknown_additional);
+	COPY_VAR_int(harden_cname_follow);
 	COPY_VAR_int(use_caps_bits_for_id);
 	COPY_VAR_ptr(caps_whitelist);
 	COPY_VAR_ptr(private_address);
@@ -1706,6 +1706,8 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 		}
 		memset(&reply_edns, 0, sizeof(reply_edns));
 		reply_edns.edns_present = 1;
+		reply_edns.edns_version = EDNS_ADVERTISED_VERSION;
+		reply_edns.udp_size = EDNS_ADVERTISED_SIZE;
 		error_encode(c->buffer, ret, &qinfo,
 			*(uint16_t*)(void *)sldns_buffer_begin(c->buffer),
 			sldns_buffer_read_u16_at(c->buffer, 2), &reply_edns);
@@ -1,3 +1,162 @@
+21 September 2026: Yorgos
+	- Merge #1510 from Andy Warner: Move unlink of temp file to before
+	  fatal exit.
+
+16 September 2026: Wouter
+	- Release of 1.26.1 with the following security fixes.
+	- Fix CVE-2026-81642, Heap buffer overflow and possible Remote Code
+	  Execution when digesting DNSKEY. Thanks to Yuqi Qiu and Xiang Li
+	  from Nankai University, AOSP Lab for the report.
+	- Fix CVE-2026-81634, Possible heap buffer overflow during DNSSEC
+	  canonicalization. Thanks to Vlatko Kosturjak with Marlink Cyber,
+	  for the report.
+	- Fix CVE-2026-82717, CNAME synthesis could lead to heap corruption.
+	  Thanks to Ben Morris from Anthropic for the report.
+	- Fix CVE-2026-77955, Possible ZONEMD verification bypass window.
+	  Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab,
+	  for the report. In addition, thanks to Qifan Zhang from Palo Alto
+	  Networks for also reporting this issue.
+	- Fix CVE-2026-78227, Use-after-free in DoQ stream output buffer on
+	  reset re-transmission. Thanks to Yuqi Qiu and Xiang Li from Nankai
+	  University, AOSP Lab for the report.
+	- Fix CVE-2026-80225, Possible degradation of service from continuous
+	  queries on the same TCP/DoT connection. Thanks to Qifan Zhang from
+	  Palo Alto Networks for the report.
+	- Fix CVE-2026-82720, Use-after-free in DoH stream cleanup code path.
+	  Thanks to Yuqi Qiu and Xiang Li from Nankai University, AOSP Lab,
+	  for the report.
+	- Fix CVE-2026-85501, Retrap: Novel Vulnerabilities to launch
+	  Algorithmic Complexity Attacks on DNSSEC. Thanks to Zuyao Xu and
+	  Xiang Li from Nankai University, AOSP Lab for the report. In
+	  addition, thanks to Qifan Zhang from Palo Alto Networks for a
+	  complimentary report.
+	- Fix CVE-2026-77860, 'serve-expired' can bypass Unbound 'wait-limit'.
+	  Thanks to Xuanchao Xie, Lutong Chen, and Kaiping Xue from the
+	  University of Science and Technology of China (USTC) for the
+	  report.
+	- The code repository continues with 1.26.2 under development,
+	  that includes the changes from before the 1.26.1 commits.
+	- Unit test for CVE-2026-81642.
+	- Unit test for CVE-2026-82717.
+	- Unit test for CVE-2026-85501.
+
+15 September 2026: Wouter
+	- For #1507: TOCTOU race in store_rrsets() can return a
+	  CNAME chain whose target owns no address.
+
+10 September 2026: Wouter
+	- Fix to construct the delegation point during DS NS find
+	  as a child side delegation point if that was the response.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+	- Fix to error on missing close parenthesis for zone file
+	  read and for url content read. Thanks to Qifan Zhang, Palo
+	  Alto Networks, for the report.
+
+8 September 2026: Wouter
+	- Fix to elevate the diagnostic for no matches for a wildcard
+	  trusted-keys-file, make it more descriptive, and more man
+	  page content for it. Thanks to Qifan Zhang, Palo Alto
+	  Networks, for the report.
+
+4 September 2026: Wouter
+	- Fix to make rpz_config leave the rpz with correct set up
+	  on failure. The struct is not half configured on exit.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+	- Fix to not change the action override in rpz_config, before
+	  the cname override has succeeded.
+
+3 September 2026: Wouter
+	- Fix to match NSEC3 hash length to the NSEC3 algorithm,
+	  this stops negative cache overdeletion. It also contrains
+	  the hash label length and checks if the NSEC nextowner
+	  is valid. Thanks to Yuqi Qiu & Xiang Li (Nankai University,
+	  AOSP Lab).
+	- Remove unused .travis.yml for ci integration.
+	- Fix to reorder SVCB and HTTPS svcparams for unknown RR form
+	  zonefile input. If it can not be parsed it is leniently
+	  accepted, much like as a secondary it leniently accepts it.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+	- Fix that when extended EDNS RCODE does not fit, at short
+	  udpsize, the reply is truncated with TC and fix for the
+	  rcode in that short reply to be a sensible rcode.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+	- Fix that when a partial EDNS option is in a query, the
+	  response is a more RFC conformant FORMERR, since the EDNS
+	  option is malformed. Also fix to have an EDNS size for
+	  the reply error encoding for failed EDNS parse of the query.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+
+2 September 2026: Wouter
+	- Fix to not commit to have_zone at apply AXFR time for auth
+	  zone transfers, so that later failure rolls back to not.
+	  The have_zone value is set later when the SOA is retrieved.
+	  Also fix to clear the zone data when a transfer does not
+	  have a valid SOA record in the zone for it.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+
+1 September 2026: Wouter
+	- Fix to allow block_a and other local-zone types in a view.
+	- Fix LOC RR parse to avoid double to uint32 cast overflow.
+	  Thanks to Qifan Zhang, Palo Alto Networks, for the report.
+
+26 August 2026: Wouter
+	- Fix notify for auth-zone during initial start up. It
+	  performs the transfer and not only lookup.
+
+24 August 2026: Wouter
+	- Fix #132: Add `harden-cname-follow: yes` config option, that
+	  can be used to disable cname scrubbing. That can be useful
+	  for when the traffic is on localhost only.
+
+21 August 2026: Wouter
+	- Fix to defend against double event deletion, that could cause
+	  event corruption and use after free, for comm_timer_disable.
+
+11 August 2026: Wouter
+	- Fix #1492 from zacek: Data race in log_init() on
+	  key_created/log_lock when calling ub_ctx_create()
+	  concurrently from multiple threads.
+	- Fix stat_values.tdir test to have less test failures.
+
+7 August 2026: Wouter
+	- Fix #1489 from jplesnik: Replace removed Python 2 C API
+	  macros for SWIG 4.5.0 compatibility.
+
+6 August 2026: Alex Khanin
+	- Fix #1488: bounds check in packed_rr_to_string, it checked
+	  the assembled rr length against the output string length
+	  dest_len, instead of against the size of the rr buffer it
+	  writes into. Callers in cachedump.c and remote.c pass a
+	  dest_len larger than that buffer.
+	- Unit test for packed_rr_to_string.
+
+6 August 2026: Wouter
+	- Fix #1485: the list_forwards command omits port numbers.
+	  The list_forwards and list_stubs commands for
+	  unbound-control print port and tls auth name.
+	- Fix #1487: regression in 1.26.0, ipsecmod is now always
+	  partly enabled.
+
+4 August 2026: Wouter
+	- Fix to set makedist.sh to not wget config.sub and
+	  config.guess from git repo. The fetch times out, and the
+	  version from libtoolize is much more recent now than
+	  that it was when the wget was added.
+
+31 July 2026: Wouter
+	- For #1483: The failure reason when an NSEC NXDOMAIN is
+	  encountered when looking for an insecure delegation, is
+	  fixed to mention the NSEC records, instead of nonexistent
+	  NSEC3 records, that it attempted.
+
+30 July 2026: Wouter
+	- Fix #1482: DNS-over-QUIC doesn't work with simple config.
+	  That fixes interface-automatic for use with doq service.
+
+28 July 2026: Wouter
+	- Tag for 1.26.0rc1. The repo continues with version 1.26.1.
+	  This became 1.26.0 on 4 aug 2026.
+
 24 July 2026: Wouter
 	- Merge #1433 from jisakiel: Add new static zone type
 	  block_aaaa to suppress AAAA queries.
@@ -588,6 +588,9 @@ server:
 	# additional section.
 	# harden-unknown-additional: no

+	# Harden CNAME redirections by following them.
+	# harden-cname-follow: yes
+
 	# Sent minimum amount of information to upstream servers to enhance
 	# privacy. Only sent minimum required labels of the QNAME and set QTYPE
 	# to A when possible.
@@ -1952,6 +1952,17 @@ These options are part of the ``server:`` section.
    Default: no


+@@UAHL@unbound.conf@harden-cname-follow@@: *<yes or no>*
+    Harden CNAME redirections by following them.
+    If no, then upstream CNAME and DNAME redirections are allowed in a
+    response without checking with further messages if those are valid.
+    It can only really be disabled safely on localhost net or encrypted
+    connectivity.
+    Default is on to protect the cache integrity.
+
+    Default: yes
+
+
@@UAHL@unbound.conf@use-caps-for-id@@: *<yes or no>*
    Use 0x20-encoded random bits in the query to foil spoof attempts.
    This perturbs the lowercase and uppercase of query names sent to authority
@@ -2226,6 +2237,9 @@ These options are part of the ``server:`` section.
    It is possible to use wildcards with this statement, the wildcard is
    expanded on start and on reload.

+    A wildcard that matches no files is not an error: the entry loads no
+    trust anchors, and the condition is logged at operational verbosity.
+
    Default: "" (no trusted keys file)


@@ -59,6 +59,11 @@
 static int
 ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
 {
+	if(cfg->ipsecmod_whitelist &&
+		!ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
+		return 0;
+	if(!cfg->ipsecmod_enabled)
+		return 1;
 	if(!cfg->ipsecmod_hook || (cfg->ipsecmod_hook && !cfg->ipsecmod_hook[0])) {
 		log_err("ipsecmod: missing ipsecmod-hook.");
 		return 0;
@@ -68,9 +73,6 @@ ipsecmod_apply_cfg(struct ipsecmod_env* ipsecmod_env, struct config_file* cfg)
 			cfg->ipsecmod_hook, strerror(errno));
 		return 0;
 	}
-	if(cfg->ipsecmod_whitelist &&
-		!ipsecmod_whitelist_apply_cfg(ipsecmod_env, cfg))
-		return 0;
 	return 1;
 }

@@ -626,6 +628,8 @@ ipsecmod_inform_super(struct module_qstate* qstate, int id,
 		verbose(VERB_ALGO, "super has no ipsecmod state");
 		return;
 	}
+	if(!siq->enabled)
+		return;

 	if(qstate->return_msg) {
 		struct ub_packed_rrset_key* rrset_key = reply_find_answer_rrset(
@@ -46,6 +46,7 @@
 #include "services/cache/dns.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
+#include "util/config_file.h"
 #include "sldns/rrdef.h"
 #include "sldns/pkthdr.h"

@@ -107,7 +108,8 @@ response_type_from_cache(struct dns_msg* msg,
 enum response_type 
 response_type_from_server(int rdset,
 	struct dns_msg* msg, struct query_info* request, struct delegpt* dp,
-	int* empty_nodata_found, int msg_lame_empty, int msg_lame_referral)
+	int* empty_nodata_found, int msg_lame_empty, int msg_lame_referral,
+	struct config_file* cfg)
 {
 	uint8_t* origzone = (uint8_t*)"\000"; /* the default */
 	struct ub_packed_rrset_key* s;
@@ -130,6 +132,16 @@ response_type_from_server(int rdset,
 		if( (msg->rep->flags&BIT_RA) &&
 			!(msg->rep->flags&BIT_AA) && !rdset)
 				return RESPONSE_TYPE_REC_LAME;
+		if(!cfg->harden_cname_follow /* follow CNAME chain */) {
+			/* If the CNAME chain is allowed, see if there is a
+			 * SOA record, if so, the chain is complete to the
+			 * end of it, otherwise it could be a partial chain.*/
+			for(i=msg->rep->an_numrrsets; i<msg->rep->an_numrrsets+msg->rep->ns_numrrsets; i++) {
+				s = msg->rep->rrsets[i];
+				if(ntohs(s->rk.type) == LDNS_RR_TYPE_SOA)
+					return RESPONSE_TYPE_ANSWER;
+			}
+		}
 		/* it could be a CNAME with NXDOMAIN rcode */
 		for(i=0; i<msg->rep->an_numrrsets; i++) {
 			s = msg->rep->rrsets[i];
@@ -162,6 +174,7 @@ response_type_from_server(int rdset,
 	if(msg->rep->an_numrrsets > 0) {
 		uint8_t* mname = request->qname;
 		size_t mname_len = request->qname_len;
+		int sawanswer = 0;

 		/* Now look at the answer section first. 3 states: our 
 		 * answer is there directly, our answer is there after 
@@ -197,6 +210,7 @@ response_type_from_server(int rdset,
 				 * the answer, we only provisionally say 
 				 * 'ANSWER' -- it very well could be a 
 				 * REFERRAL. */
+				sawanswer = 1;
 				break;
 			}

@@ -214,6 +228,10 @@ response_type_from_server(int rdset,
 		 * still got to here, then it is a CNAME response. 
 		 * (This is regardless of the AA bit at this point) */
 		if(mname != request->qname) {
+			if(!cfg->harden_cname_follow /* allow CNAMEs */ &&
+				sawanswer /* The last was not CNAME, and
+				there is an answer RRset. */ )
+				return RESPONSE_TYPE_ANSWER;
 			return RESPONSE_TYPE_CNAME;
 		}
 	}
@@ -45,6 +45,7 @@
 struct dns_msg;
 struct query_info;
 struct delegpt;
+struct config_file;

 /**
 * The response type is used to interpret the response.
@@ -115,7 +116,7 @@ enum response_type response_type_from_cache(struct dns_msg* msg,
 * detection, mostly).
 *
 * @param rdset: if RD bit was sent in query sent by unbound.
- * @param msg: the message from the cache.
+ * @param msg: the message.
 * @param request: the request that generated the response.
 * @param dp: The delegation point that was being queried
 *          when the response was returned.
@@ -124,10 +125,12 @@ enum response_type response_type_from_cache(struct dns_msg* msg,
 *	is lame, before it became empty.
 * @param msg_lame_referral: returned true if the reply has a referral before
 *	scrub.
+ * @param cfg: config with options.
 * @return the response type (CNAME or ANSWER).
 */
 enum response_type response_type_from_server(int rdset, 
 	struct dns_msg* msg, struct query_info* request, struct delegpt* dp,
-	int* empty_nodata_found, int msg_lame_empty, int msg_lame_referral);
+	int* empty_nodata_found, int msg_lame_empty, int msg_lame_referral,
+	struct config_file* cfg);

 #endif /* ITERATOR_ITER_RESPTYPE_H */
@@ -524,7 +524,7 @@ scrub_normalize(sldns_buffer* pkt, struct msg_parse* msg,
 			 * server, scrub down the length to something
 			 * shorter. This deletes everything after the limit
 			 * is reached. The iterator is going to look up
-			 * the content one by one anyway. */
+			 * the content one by one, if harden-cname-follow . */
 			remove_rrset("normalize: removing because too many cnames:",
 				pkt, msg, prev, &rrset);
 			continue;
@@ -911,8 +911,8 @@ store_rrset(sldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
 	packed_rrset_ttl_add(d, now);
 	ref.key = k;
 	ref.id = k->id;
-	/*ignore ret: it was in the cache, ref updated */
-	(void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, now);
+	/* if it was in the cache, ref updated */
+	rrset_cache_update_unlock(env->rrset_cache, &ref, env->alloc, now);
 }

 /**
@@ -1039,6 +1039,8 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	uint8_t* ns_rrset_dname = NULL;
 	int added_rrlen_ede = 0;
 	struct rrset_parse* rrset, *prev;
+	uint8_t* sname = qinfo->qname;
+	size_t snamelen = qinfo->qname_len;
 	prev = NULL;
 	rrset = msg->rrset_first;

@@ -1046,6 +1048,7 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	 * it can be used from the cache. After normalization, an initial 
 	 * DNAME will have a correctly synthesized CNAME after it. */
 	if(rrset && rrset->type == LDNS_RR_TYPE_DNAME && 
+		env->cfg->harden_cname_follow /* CNAME chain is cut off, one DNAME is allowed here. */ &&
 		rrset->section == LDNS_SECTION_ANSWER &&
 		pkt_strict_sub(pkt, qinfo->qname, rrset->dname) &&
 		pkt_sub(pkt, rrset->dname, zonename)) {
@@ -1061,12 +1064,33 @@ scrub_sanitize(sldns_buffer* pkt, struct msg_parse* msg,
 	 * ANY queries get query name in answer section.
 	 * Remainders of CNAME chains are cut off and resolved by iterator. */
 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
-		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) != 0) {
+		if(!env->cfg->harden_cname_follow /* CNAME chain is allowed to stay */ &&
+			rrset->type == LDNS_RR_TYPE_DNAME &&
+			pkt_strict_sub(pkt, sname, rrset->dname) &&
+			pkt_sub(pkt, rrset->dname, zonename)) {
+			/* This DNAME is allowed to stay, the synthesized
+			 * CNAME follows next. */
+			prev = rrset;
+			rrset = rrset->rrset_all_next;
+			continue;
+		}
+		if(dname_pkt_compare(pkt, sname, rrset->dname) != 0) {
 			if(has_additional(rrset->type)) del_addi = 1;
 			remove_rrset("sanitize: removing extraneous answer "
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
 		}
+		if(!env->cfg->harden_cname_follow /* CNAME chain is allowed to stay */ &&
+			qinfo->qtype != LDNS_RR_TYPE_ANY &&
+			rrset->type == LDNS_RR_TYPE_CNAME &&
+			dname_pkt_compare(pkt, sname, rrset->dname) == 0) {
+			/* Follow the CNAME chain, and allow the elements
+			 * that match the CNAME chain. Also allow a DNAME
+			 * in front. */
+			if(!parse_get_cname_target(rrset, &sname, &snamelen,
+				pkt))
+				return 0;
+		}
 		prev = rrset;
 		rrset = rrset->rrset_all_next;
 	}
@@ -1215,8 +1215,8 @@ iter_store_parentside_rrset(struct module_env* env,
 	rrset->entry.hash = rrset_key_hash(&rrset->rk);
 	ref.key = rrset;
 	ref.id = rrset->id;
-	/* ignore ret: if it was in the cache, ref updated */
-	(void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, *env->now);
+	/* if it was in the cache, ref updated */
+	rrset_cache_update_unlock(env->rrset_cache, &ref, env->alloc, *env->now);
 }

 /** fetch NS record from reply, if any */
@@ -1712,3 +1712,28 @@ deleg_port_number(struct module_env* env)
 		return env->cfg->ssl_port;
 	return -1;
 }
+
+void
+shorten_answer_cname(struct reply_info* rep, uint8_t* cutoff)
+{
+	size_t i, found = 0, removenum;
+	uint8_t* sname = NULL;
+	size_t snamelen = 0;
+	for(i=0; i<rep->an_numrrsets; i++) {
+		if(query_dname_compare(rep->rrsets[i]->rk.dname, cutoff) == 0) {
+			found = 1;
+			removenum = i;
+			break;
+		}
+		if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_CNAME) {
+			get_cname_target(rep->rrsets[i], &sname, &snamelen);
+			if(query_dname_compare(sname, cutoff) == 0) {
+				found = 1;
+				removenum = i+1;
+				break;
+			}
+		}
+	}
+	if(!found) return; /* not found */
+	val_reply_remove_answers(rep, removenum, rep->an_numrrsets-removenum);
+}
@@ -486,4 +486,7 @@ void iter_make_minimal(struct reply_info* rep);
 /** See if we need a different port number */
 int deleg_port_number(struct module_env* env);

+/** Shorten reply CNAME chain to cutoff, cutoff is excluded. */
+void shorten_answer_cname(struct reply_info* rep, uint8_t* cutoff);
+
 #endif /* ITERATOR_ITER_UTILS_H */
@@ -3189,7 +3189,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	type = response_type_from_server(
 		(int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd),
 		iq->response, &iq->qinfo_out, iq->dp, &iq->empty_nodata_found,
-		iq->msg_lame_empty, iq->msg_lame_referral);
+		iq->msg_lame_empty, iq->msg_lame_referral, qstate->env->cfg);
 	iq->chase_to_rd = 0;
 	/* remove TC flag, if this is erroneously set by TCP upstream */
 	iq->response->rep->flags &= ~BIT_TC;
@@ -3302,6 +3302,47 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * to send another query with a new qtype. */
 		type = RESPONSE_TYPE_ANSWER;
 	}
+	if(type == RESPONSE_TYPE_ANSWER &&
+		!qstate->env->cfg->harden_cname_follow /* cname chain from upstream is allowed */ &&
+		qstate->env->auth_zones &&
+		/* Check for CNAMEs in answer and RPZ after the CNAME. */
+		reply_find_rrset_section_an(
+		iq->response->rep, iq->qchase.qname,
+		iq->qchase.qname_len, LDNS_RR_TYPE_CNAME,
+		iq->qchase.qclass) != NULL) {
+		/* If this is an answer with CNAMEs in front, and
+		 * RPZ wants to modify after CNAME(s), cut off, the
+		 * remainder, and treat as the CNAME response */
+		size_t i;
+		uint8_t* origname = iq->qchase.qname;
+		size_t orignamelen = iq->qchase.qname_len;
+		for(i=0; i<iq->response->rep->an_numrrsets; i++) {
+			struct dns_msg* forged_response;
+			if(ntohs(iq->response->rep->rrsets[i]->rk.type) ==
+				LDNS_RR_TYPE_DNAME) {
+				continue;
+			}
+			if(ntohs(iq->response->rep->rrsets[i]->rk.type) !=
+				LDNS_RR_TYPE_CNAME) {
+				break;
+			}
+			get_cname_target(iq->response->rep->rrsets[i],
+				&iq->qchase.qname, &iq->qchase.qname_len);
+			forged_response = rpz_callback_from_iterator_cname(qstate, iq);
+			if(forged_response) {
+				/* Cut off the answer section at this point.
+				 * RPZ is going to make an answer, in the
+				 * processInit after the CNAME(s) in front
+				 * are handled. */
+				shorten_answer_cname(iq->response->rep,
+					iq->qchase.qname);
+				type = RESPONSE_TYPE_CNAME;
+				break;
+			}
+		}
+		iq->qchase.qname = origname;
+		iq->qchase.qname_len = orignamelen;
+	}

 	/* handle each of the type cases */
 	if(type == RESPONSE_TYPE_ANSWER) {
@@ -3804,7 +3845,7 @@ processPrimeResponse(struct module_qstate* qstate, int id)
 	type = response_type_from_server(
 		(int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd), 
 		iq->response, &iq->qchase, iq->dp, NULL, iq->msg_lame_empty,
-		iq->msg_lame_referral);
+		iq->msg_lame_referral, qstate->env->cfg);
 	if(type == RESPONSE_TYPE_ANSWER) {
 		qstate->return_rcode = LDNS_RCODE_NOERROR;
 		qstate->return_msg = iq->response;
@@ -3954,15 +3995,32 @@ processDSNSResponse(struct module_qstate* qstate, int id,
 	struct module_qstate* forq)
 {
 	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];
+	int sec_an = 0, sec_ns = 0;

 	/* if the finished (iq->response) query has no NS set: continue
 	 * up to look for the right dp; nothing to change, do DPNSstate */
 	if(qstate->return_rcode != LDNS_RCODE_NOERROR)
 		return; /* seek further */
 	/* find the NS RRset (without allowing CNAMEs) */
-	if(!reply_find_rrset(qstate->return_msg->rep, qstate->qinfo.qname,
-		qstate->qinfo.qname_len, LDNS_RR_TYPE_NS,
-		qstate->qinfo.qclass)){
+	/* Usually, the response has a NS in the answer section, since that
+	 * was the query type. And it is then the child side part of the NS
+	 * set. This child side part would be used if next up a delegation
+	 * point was constructed from cache, for example. But now it uses that
+	 * child side part for constructing a delegation point for the DS
+	 * lookup.
+	 * If that is not there, we can pick up the NS from the authority
+	 * section as well, like from a referral. */
+	if(reply_find_rrset_section_an(qstate->return_msg->rep,
+		qstate->qinfo.qname, qstate->qinfo.qname_len,
+		LDNS_RR_TYPE_NS, qstate->qinfo.qclass))
+		sec_an = 1;
+	if(!sec_an && reply_find_rrset_section_ns(qstate->return_msg->rep,
+		qstate->qinfo.qname, qstate->qinfo.qname_len,
+		LDNS_RR_TYPE_NS, qstate->qinfo.qclass))
+		sec_ns = 1;
+	if(!sec_an && !sec_ns) {
+		/* We probably hit an intermediate label, without a type NS
+		 * record there. To find the nameservers, it must go up more.*/
 		return; /* seek further */
 	}

@@ -3975,6 +4033,11 @@ processDSNSResponse(struct module_qstate* qstate, int id,
 		errinf(qstate, "malloc failure, in DS search");
 		return; /* dp==NULL in QUERYTARGETS makes SERVFAIL */
 	}
+	if(sec_an) {
+		/* The NS is in the answer section, this is not a parent side,
+		 * but a child side response for it. */
+		foriq->dp->has_parent_side_NS = 0;
+	}
 	/* success, go query the querytargets in the new dp (and go down) */
 }

@@ -409,7 +409,7 @@ if [ "$DOWIN" = "yes" ]; then
 	info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 	git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"
 	cd unbound || error_cleanup "Unbound not exported correctly from git"
-	rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+	rm -rf .git .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"

 	# on a re-configure the cache may no longer be valid...
 	if test -f mingw32-config.cache; then rm mingw32-config.cache; fi
@@ -603,11 +603,13 @@ info "git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound"
 git clone --depth=1 --no-tags -b $GITBRANCH $GITREPO unbound || error_cleanup "git clone failed"

 cd unbound || error_cleanup "Unbound not exported correctly from git"
-rm -rf .git .travis.yml .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"
+rm -rf .git .gitattributes .github .gitignore || error_cleanup "Failed to remove .git tracking and ci information"

 info "Adding libtool utils (libtoolize)."
 libtoolize -c --install || libtoolize -c || error_cleanup "Libtoolize failed."

+# Turn this off, if the git repo times out for lookups.
+if test "updateconfigsub" = "false"; then
 # https://www.gnu.org/software/gettext/manual/html_node/config_002eguess.html
 info "Updating config.guess and config.sub"
 wget -O config.guess 'https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD'
@@ -621,6 +623,7 @@ if [ `uname -s | grep -i -c darwin` -ne 0 ]; then
        xattr -d com.apple.quarantine config.sub
    fi
 fi
+fi

 info "Building configure script (autoreconf)."
 autoreconf -f || error_cleanup "Autoconf failed."
@@ -79,7 +79,7 @@
                i+(int)((unsigned int)name[i]) < len) {
                memmove(buf, name + i + 1, (unsigned int)name[i]);
                buf[(unsigned int)name[i]] = 0;
-                PyList_SetItem(list, cnt, PyString_FromString(buf));
+                PyList_SetItem(list, cnt, PyUnicode_FromString(buf));
        }
        i += ((unsigned int)name[i]) + 1;
        cnt++;
@@ -96,7 +96,7 @@

     list = PyList_New(len);
     for (i=0; i < len; i++) {
-            PyList_SET_ITEM(list, i, PyString_FromString(array[i]));
+            PyList_SET_ITEM(list, i, PyUnicode_FromString(array[i]));
     }
     return list;
   }
@@ -207,7 +207,7 @@ struct query_info {
       char buf[LDNS_MAX_DOMAINLEN];
       buf[0] = '\0';
       dname_str((uint8_t*)PyBytes_AsString(dname), buf);
-       return PyString_FromString(buf);
+       return PyUnicode_FromString(buf);
   }
 %}

@@ -345,7 +345,7 @@ struct packed_rrset_data {
   PyObject* _get_data_rr_len(struct packed_rrset_data* d, int idx) {
     if ((d != NULL) && (idx >= 0) &&
             ((size_t)idx < (d->count+d->rrsig_count)))
-        return PyInt_FromLong(d->rr_len[idx]);
+        return PyLong_FromLong(d->rr_len[idx]);
     return Py_None;
   }
   void _set_data_rr_ttl(struct packed_rrset_data* d, int idx, uint32_t ttl)
@@ -357,7 +357,7 @@ struct packed_rrset_data {
   PyObject* _get_data_rr_ttl(struct packed_rrset_data* d, int idx) {
     if ((d != NULL) && (idx >= 0) &&
             ((size_t)idx < (d->count+d->rrsig_count)))
-        return PyInt_FromLong(d->rr_ttl[idx]);
+        return PyLong_FromLong(d->rr_ttl[idx]);
     return Py_None;
   }
   PyObject* _get_data_rr_data(struct packed_rrset_data* d, int idx) {
@@ -555,12 +555,12 @@ struct sockaddr_storage {};

        if (ss->ss_family == AF_INET) {
            const struct sockaddr_in *sa4 = (struct sockaddr_in *)ss;
-            return PyInt_FromLong(ntohs(sa4->sin_port));
+            return PyLong_FromLong(ntohs(sa4->sin_port));
        }

        if (ss->ss_family == AF_INET6) {
            const struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)ss;
-            return PyInt_FromLong(ntohs(sa6->sin6_port));
+            return PyLong_FromLong(ntohs(sa6->sin6_port));
        }

        return Py_None;
@@ -574,7 +574,7 @@ struct sockaddr_storage {};
        }

        sa6 = (struct sockaddr_in6 *)ss;
-        return PyInt_FromLong(ntohl(sa6->sin6_flowinfo));
+        return PyLong_FromLong(ntohl(sa6->sin6_flowinfo));
    }

    PyObject *_sockaddr_storage_scope_id(const struct sockaddr_storage *ss) {
@@ -585,7 +585,7 @@ struct sockaddr_storage {};
        }

        sa6 = (struct sockaddr_in6 *)ss;
-        return PyInt_FromLong(ntohl(sa6->sin6_scope_id));
+        return PyLong_FromLong(ntohl(sa6->sin6_scope_id));
    }
 %}

@@ -661,7 +661,7 @@ struct edns_option {
 %inline %{
    PyObject* _edns_option_opt_code_get(struct edns_option* option) {
        uint16_t opt_code = option->opt_code;
-        return PyInt_FromLong(opt_code);
+        return PyLong_FromLong(opt_code);
    }

    PyObject* _edns_option_opt_data_get(struct edns_option* option) {
@@ -1627,7 +1627,7 @@ int edns_opt_list_append(struct edns_option** list, uint16_t code, size_t len,
        }
        result = PyObject_Call(func, py_args, py_kwargs);
        if (result) {
-            res = PyInt_AsLong(result);
+            res = PyLong_AsLong(result);
        }
 out:
        Py_XDECREF(py_edns);
@@ -1711,7 +1711,7 @@ out:
        }
        result = PyObject_Call(func, py_args, py_kwargs);
        if (result) {
-            res = PyInt_AsLong(result);
+            res = PyLong_AsLong(result);
        }
 out:
        Py_XDECREF(py_qinfo);
@@ -1765,7 +1765,7 @@ out:
        }
        result = PyObject_Call(func, py_args, py_kwargs);
        if (result) {
-            res = PyInt_AsLong(result);
+            res = PyLong_AsLong(result);
        }
 out:
        Py_XDECREF(py_qstate);
@@ -1814,7 +1814,7 @@ out:
        }
        result = PyObject_Call(func, py_args, py_kwargs);
        if (result) {
-            res = PyInt_AsLong(result);
+            res = PyLong_AsLong(result);
        }
 out:
        Py_XDECREF(py_qstate);
@@ -246,14 +246,14 @@ log_py_err(void)
 	}

 	/* And it should be a string all ready to go - duplicate it. */
-	if (!PyString_Check(obResult) && !PyUnicode_Check(obResult)) {
+	if (!PyBytes_Check(obResult) && !PyUnicode_Check(obResult)) {
 		log_err("pythonmod: cannot print exception, "
 			"StringIO.getvalue() result did not String_Check"
 			" or Unicode_Check");
 		goto cleanup;
 	}
-	if(PyString_Check(obResult)) {
-		result = PyString_AsString(obResult);
+	if(PyBytes_Check(obResult)) {
+		result = PyBytes_AsString(obResult);
 	} else {
 		ascstr = PyUnicode_AsASCIIString(obResult);
 		result = PyBytes_AsString(ascstr);
@@ -450,7 +450,7 @@ int pythonmod_init(struct module_env* env, int id)

   pe->data = PyDict_New();
   /* add the script filename to the global "mod_env" for trivial access */
-   fname = PyString_FromString(pe->fname);
+   fname = PyUnicode_FromString(pe->fname);
   if(PyDict_SetItemString(pe->data, "script", fname) < 0) {
 	log_err("pythonmod: could not add item to dictionary");
 	Py_XDECREF(fname);
@@ -3928,6 +3928,12 @@ xfr_process_notify(struct auth_xfer* xfr, struct module_env* env,
 		return;
 	}
 	/* start new probe with this addr src, or note serial */
+	if(xfr->task_probe->worker == NULL && xfr->task_probe->only_lookup) {
+		/* Perform transfer, not just lookup this notify.
+		 * The only_lookup could be set during initial start up
+		 * when the timer sets it for address lookup. */
+		xfr->task_probe->only_lookup = 0;
+	}
 	if(!xfr_start_probe(xfr, env, fromhost)) {
 		/* not started because already in progress, note the serial */
 		xfr_note_notify_serial(xfr, has_serial, serial);
@@ -4525,7 +4531,7 @@ check_packet_ok(sldns_buffer* pkt, uint16_t qtype, struct auth_xfer* xfr,
 /** read one line from chunks into buffer at current position */
 static int
 chunkline_get_line(struct auth_chunk** chunk, size_t* chunk_pos,
-	sldns_buffer* buf)
+	sldns_buffer* buf, int* eof)
 {
 	int readsome = 0;
 	while(*chunk) {
@@ -4554,6 +4560,7 @@ chunkline_get_line(struct auth_chunk** chunk, size_t* chunk_pos,
 	}
 	/* no more text */
 	if(readsome) return 1;
+	*eof = 1;
 	return 0;
 }

@@ -4631,13 +4638,13 @@ chunkline_is_comment_line_or_empty(sldns_buffer* buf)
 /** find a line with ( ) collated */
 static int
 chunkline_get_line_collated(struct auth_chunk** chunk, size_t* chunk_pos,
-	sldns_buffer* buf)
+	sldns_buffer* buf, int* eof)
 {
 	size_t pos;
 	int parens = 0;
 	sldns_buffer_clear(buf);
 	pos = sldns_buffer_position(buf);
-	if(!chunkline_get_line(chunk, chunk_pos, buf)) {
+	if(!chunkline_get_line(chunk, chunk_pos, buf, eof)) {
 		if(sldns_buffer_position(buf) < sldns_buffer_limit(buf))
 			sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0);
 		else sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf)-1, 0);
@@ -4648,11 +4655,16 @@ chunkline_get_line_collated(struct auth_chunk** chunk, size_t* chunk_pos,
 	while(parens > 0) {
 		chunkline_remove_trailcomment(buf, pos);
 		pos = sldns_buffer_position(buf);
-		if(!chunkline_get_line(chunk, chunk_pos, buf)) {
+		if(!chunkline_get_line(chunk, chunk_pos, buf, eof)) {
 			if(sldns_buffer_position(buf) < sldns_buffer_limit(buf))
 				sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0);
 			else sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf)-1, 0);
 			sldns_buffer_flip(buf);
+			if(eof) {
+				verbose(VERB_ALGO, "http chunkline: "
+					"missing closing parenthesis");
+				*eof = 0; /* It is an error instead of EOF */
+			}
 			return 0;
 		}
 		parens += chunkline_count_parens(buf, pos);
@@ -4661,6 +4673,8 @@ chunkline_get_line_collated(struct auth_chunk** chunk, size_t* chunk_pos,
 	if(sldns_buffer_remaining(buf) < 1) {
 		verbose(VERB_ALGO, "http chunkline: "
 			"line too long");
+		/* null terminate for safety */
+		sldns_buffer_write_u8_at(buf, sldns_buffer_capacity(buf)-1, 0);
 		return 0;
 	}
 	sldns_buffer_write_u8_at(buf, sldns_buffer_position(buf), 0);
@@ -4729,8 +4743,8 @@ static int
 chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos,
 	sldns_buffer* buf, struct sldns_file_parse_state* pstate)
 {
-	int ret;
-	while(chunkline_get_line_collated(chunk, chunk_pos, buf)) {
+	int ret, eof = 0;
+	while(chunkline_get_line_collated(chunk, chunk_pos, buf, &eof)) {
 		chunkline_newline_removal(buf);
 		if(chunkline_is_comment_line_or_empty(buf)) {
 			/* a comment, go to next line */
@@ -4748,6 +4762,7 @@ chunkline_non_comment_RR(struct auth_chunk** chunk, size_t* chunk_pos,
 		}
 		return 1;
 	}
+	if(!eof) return 0;
 	/* no noncomments, fail */
 	return 0;
 }
@@ -5215,7 +5230,6 @@ apply_axfr(struct auth_xfer* xfr, struct auth_zone* z,
 	}

 	xfr->serial = serial;
-	xfr->have_zone = 1;
 	return 1;
 }

@@ -5230,7 +5244,7 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 	struct sldns_file_parse_state pstate;
 	struct auth_chunk* chunk;
 	size_t chunk_pos;
-	int ret;
+	int ret, eof=0;
 	memset(&pstate, 0, sizeof(pstate));
 	pstate.default_ttl = 3600;
 	if(xfr->namelen < sizeof(pstate.origin)) {
@@ -5275,7 +5289,8 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 	chunk = xfr->task_transfer->chunks_first;
 	chunk_pos = 0;
 	pstate.lineno = 0;
-	while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer)) {
+	while(chunkline_get_line_collated(&chunk, &chunk_pos, scratch_buffer,
+		&eof)) {
 		/* process this line */
 		pstate.lineno++;
 		chunkline_newline_removal(scratch_buffer);
@@ -5311,6 +5326,13 @@ apply_http(struct auth_xfer* xfr, struct auth_zone* z,
 			return 0;
 		}
 	}
+	if(!eof) {
+		verbose(VERB_ALGO, "error parsing line [%s:%d] %s",
+			xfr->task_transfer->master->file,
+			pstate.lineno,
+			sldns_buffer_begin(scratch_buffer));
+		return 0;
+	}
 	return 1;
 }

@@ -5513,6 +5535,7 @@ xfr_process_chunk_list(struct auth_xfer* xfr, struct module_env* env,
 	xfr->zone_expired = 0;
 	z->zone_expired = 0;
 	if(!xfr_find_soa(z, xfr)) {
+		auth_zone_clear_data(z);
 		lock_rw_unlock(&z->lock);
 		verbose(VERB_ALGO, "xfr from %s: no SOA in zone after update"
 			" (or malformed RR)", xfr->task_transfer->master->host);
@@ -95,7 +95,8 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 		case 2: /* ref updated, cache is superior */
 			if(region) {
 				struct ub_packed_rrset_key* ck;
-				lock_rw_rdlock(&rep->ref[i].key->entry.lock);
+				/* the entry is already readlocked from the
+				 * check in rrset_cache_update. */
 				/* if deleted rrset, do not copy it */
 				if(rep->ref[i].key->id == 0 ||
 					rep->ref[i].id != rep->ref[i].key->id)
@@ -116,6 +117,8 @@ store_rrsets(struct module_env* env, struct reply_info* rep, time_t now,
 						qrep->serve_expired_ttl = qrep->ttl + SERVE_EXPIRED_TTL;
 					}
 				}
+			} else {
+				lock_rw_unlock(&rep->ref[i].key->entry.lock);
 			}
 			/* no break: also copy key item */
 			/* the line below is matched by gcc regex and silences
@@ -1208,9 +1211,9 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 				rep->rrsets[i]->entry.data, *env->now);
 			ref.key = rep->rrsets[i];
 			ref.id = rep->rrsets[i]->id;
-			/*ignore ret: it was in the cache, ref updated */
+			/* if it was in the cache, ref updated */
 			/* no leeway for typeNS */
-			(void)rrset_cache_update(env->rrset_cache, &ref, 
+			rrset_cache_update_unlock(env->rrset_cache, &ref,
 				env->alloc,
 				((ntohs(ref.key->rk.type)==LDNS_RR_TYPE_NS
 				 && !pside) ? qstarttime:*env->now + leeway));
@@ -239,9 +239,13 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 			equal, (rrset_type==LDNS_RR_TYPE_NS),
 			(rrset_type==LDNS_RR_TYPE_A || rrset_type==LDNS_RR_TYPE_AAAA))) {
 			/* cache is superior, return that value */
+			if(equal) {
+				ub_packed_rrset_parsedelete(k, alloc);
+				/* return readlocked item. */
+				return 2;
+			}
 			lock_rw_unlock(&e->lock);
 			ub_packed_rrset_parsedelete(k, alloc);
-			if(equal) return 2;
 			return 1;
 		}
 		lock_rw_unlock(&e->lock);
@@ -269,6 +273,15 @@ rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref,
 	return 0;
 }

+void rrset_cache_update_unlock(struct rrset_cache* r, struct rrset_ref* ref,
+	struct alloc_cache* alloc, time_t timenow)
+{
+	int ret = rrset_cache_update(r, ref, alloc, timenow);
+	if(ret == 2) {
+		lock_rw_unlock(&ref->key->entry.lock);
+	}
+}
+
 /** See if the name is a within signer authority */
 static int
 dname_subdomain_rrsig_signers(uint8_t* dname,
@@ -333,8 +346,8 @@ void rrset_cache_update_wildcard(struct rrset_cache* rrset_cache,
 	rrset->entry.hash = rrset_key_hash(&rrset->rk);
 	ref.key = rrset;
 	ref.id = rrset->id;
-	/* ignore ret: if it was in the cache, ref updated */
-	(void)rrset_cache_update(rrset_cache, &ref, alloc, timenow);
+	/* if it was in the cache, ref updated */
+	rrset_cache_update_unlock(rrset_cache, &ref, alloc, timenow);
 }

 /** Grace period in seconds for TTL=0 DNAME rrsets (RFC 2308: do not cache).
@@ -129,10 +129,16 @@ void rrset_cache_touch(struct rrset_cache* r, struct ub_packed_rrset_key* key,
 * 	1: reference updated, item is inserted in cache.
 * 	2: reference updated, item in cache is considered superior.
 *	   also the rdata is equal (but other parameters in cache are superior).
+ *	   In case 2 the item is returned under a readlock. The caller must
+ *	   unlock.
 */
 int rrset_cache_update(struct rrset_cache* r, struct rrset_ref* ref, 
 	struct alloc_cache* alloc, time_t timenow);

+/** The rrset_cache_update routine that unlocks at end */
+void rrset_cache_update_unlock(struct rrset_cache* r, struct rrset_ref* ref,
+	struct alloc_cache* alloc, time_t timenow);
+
 /**
 * Update or add an rrset in the rrset cache using a wildcard dname.
 * Generates wildcard dname by prepending the wildcard label to the closest
@@ -1341,13 +1341,33 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 	if((is_doq) && !(is_https || is_ssl)) do_tcp = 0;

 	if(do_auto) {
+		enum listen_type auto_port_type;
 		ub_sock = calloc(1, sizeof(struct unbound_socket));
 		if(!ub_sock)
 			return 0;
+		if(is_dnscrypt) {
+			auto_port_type = listen_type_udpancil_dnscrypt;
+			add = "udpancil_dnscrypt";
+		} else if(is_doq) {
+			auto_port_type = listen_type_doq;
+			add = "doq";
+			if(if_listens_on(ifname, port, 53, NULL)) {
+				log_err("DNS over QUIC is strictly not "
+					"allowed on port 53 as per RFC 9250. "
+					"Port 53 is for DNS datagrams. Error "
+					"for interface '%s'.", ifname);
+				free(ub_sock->addr);
+				free(ub_sock);
+				return 0;
+			}
+		} else {
+			auto_port_type = listen_type_udpancil;
+			add = "udpancil";
+		}
 		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1,
 			&noip6, rcv, snd, reuseport, transparent,
 			tcp_mss, nodelay, freebind, use_systemd, dscp, ub_sock,
-			(is_dnscrypt?"udpancil_dnscrypt":"udpancil"))) == -1) {
+			add)) == -1) {
 			free(ub_sock->addr);
 			free(ub_sock);
 			if(noip6) {
@@ -1366,9 +1386,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 		if (sock_queue_timeout && !set_recvtimestamp(s)) {
 			log_warn("socket timestamping is not available");
 		}
-		if(!port_insert(list, s, is_dnscrypt
-			?listen_type_udpancil_dnscrypt:listen_type_udpancil,
-			is_pp2, ub_sock)) {
+		if(!port_insert(list, s, auto_port_type, is_pp2, ub_sock)) {
 			sock_close(s);
 			free(ub_sock->addr);
 			free(ub_sock);
@@ -506,24 +506,37 @@ delete_cname_override(struct rpz* r)
 static int
 rpz_apply_cfg_elements(struct rpz* r, struct config_auth* p)
 {
+	enum rpz_action action_override;
 	if(p->rpz_taglist && p->rpz_taglistlen) {
-		r->taglistlen = p->rpz_taglistlen;
-		r->taglist = memdup(p->rpz_taglist, r->taglistlen);
-		if(!r->taglist) {
+		uint8_t* taglist = memdup(p->rpz_taglist, p->rpz_taglistlen);
+		if(!taglist) {
 			log_err("malloc failure on RPZ taglist alloc");
 			return 0;
 		}
+		if(r->taglist)
+			free(r->taglist);
+		r->taglist = taglist;
+		r->taglistlen = p->rpz_taglistlen;
+	} else {
+		/* free taglist, if any */
+		if(r->taglist) {
+			free(r->taglist);
+			r->taglist = NULL;
+			r->taglistlen = 0;
+		}
 	}

 	if(p->rpz_action_override) {
-		r->action_override = rpz_config_to_action(p->rpz_action_override);
+		action_override = rpz_config_to_action(p->rpz_action_override);
 	}
 	else
-		r->action_override = RPZ_NO_OVERRIDE_ACTION;
+		action_override = RPZ_NO_OVERRIDE_ACTION;

-	if(r->action_override == RPZ_CNAME_OVERRIDE_ACTION) {
+	if(action_override == RPZ_CNAME_OVERRIDE_ACTION) {
 		uint8_t nm[LDNS_MAX_DOMAINLEN+1];
 		size_t nmlen = sizeof(nm);
+		struct regional* newr;
+		struct ub_packed_rrset_key* cname_override;

 		if(!p->rpz_cname) {
 			log_err("rpz: override with cname action found, but no "
@@ -536,18 +549,40 @@ rpz_apply_cfg_elements(struct rpz* r, struct config_auth* p)
 				p->rpz_cname);
 			return 0;
 		}
-		r->cname_override = new_cname_override(r->region, nm, nmlen);
-		if(!r->cname_override) {
+		newr = regional_create_custom(sizeof(struct regional));
+		if(!newr) {
+			log_err("malloc failure on RPZ cname override region");
 			return 0;
 		}
+		cname_override = new_cname_override(newr, nm, nmlen);
+		if(!cname_override) {
+			regional_destroy(newr);
+			return 0;
+		}
+		regional_destroy(r->region);
+		r->region = newr;
+		r->cname_override = cname_override;
+	} else {
+		delete_cname_override(r);
 	}
+	r->action_override = action_override;
 	r->log = p->rpz_log;
 	r->signal_nxdomain_ra = p->rpz_signal_nxdomain_ra;
 	if(p->rpz_log_name) {
-		if(!(r->log_name = strdup(p->rpz_log_name))) {
+		char* log_name = strdup(p->rpz_log_name);
+		if(!log_name) {
 			log_err("malloc failure on RPZ log_name strdup");
 			return 0;
 		}
+		if(r->log_name)
+			free(r->log_name);
+		r->log_name = log_name;
+	} else {
+		/* free logname, if any */
+		if(r->log_name) {
+			free(r->log_name);
+			r->log_name = NULL;
+		}
 	}
 	return 1;
 }
@@ -616,22 +651,6 @@ rpz_config(struct rpz* r, struct config_auth* p)
 {
 	/* If the zonefile changes, it is read later, after which
 	 * rpz_clear and rpz_finish_config is called. */
-
-	/* free taglist, if any */
-	if(r->taglist) {
-		free(r->taglist);
-		r->taglist = NULL;
-		r->taglistlen = 0;
-	}
-
-	/* free logname, if any */
-	if(r->log_name) {
-		free(r->log_name);
-		r->log_name = NULL;
-	}
-
-	delete_cname_override(r);
-
 	if(!rpz_apply_cfg_elements(r, p))
 		return 0;
 	return 1;
@@ -197,6 +197,8 @@ sldns_fget_token_l(FILE *f, char *token, const char *delim, size_t limit, int *l
 	}
 	*t = '\0';
 	if (c == EOF) {
+		if(p != 0 || quoted)
+			return -1;
 		return (ssize_t)i;
 	}

@@ -842,8 +842,7 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len,
 	sldns_write_uint16(rr+dname_len+8, (uint16_t)(rr_cur_len-dname_len-10));
 	*rr_len = rr_cur_len;
 	/* SVCB/HTTPS handling  */
-	if ((rr_type == LDNS_RR_TYPE_SVCB || rr_type == LDNS_RR_TYPE_HTTPS)
-		&& !was_unknown_rr_format) {
+	if (rr_type == LDNS_RR_TYPE_SVCB || rr_type == LDNS_RR_TYPE_HTTPS) {
 		size_t rdata_len = rr_cur_len - dname_len - 10;
 		uint8_t *rdata = rr+dname_len + 10;

@@ -875,7 +874,14 @@ rrinternal_parse_rdata(sldns_buffer* strbuf, char* token, size_t token_len,

 		rdata_len -= 1;
 		rdata += 1;
-		return sldns_str2wire_check_svcbparams(rdata, rdata_len);
+		status = sldns_str2wire_check_svcbparams(rdata, rdata_len);
+		/* For RFC3597 generic-form input, preserve unprintable records.
+		 * Those could have appeared due to secondary zones, and also
+		 * unbound writing invalid-format records out in generic form.
+		 * If it can be parsed, it fixes the svcparam ordering. */
+		if(was_unknown_rr_format && status != LDNS_WIREPARSE_ERR_OK)
+			status = LDNS_WIREPARSE_ERR_OK;
+		return status;

 	}
 	return LDNS_WIREPARSE_ERR_OK;
@@ -2304,6 +2310,8 @@ int sldns_str2wire_loc_buf(const char* str, uint8_t* rd, size_t* len)

 	if (isdigit((unsigned char) *my_str)) {
 		s = strtod(my_str, &my_str);
+		if(s > 60.0)
+			return LDNS_WIREPARSE_ERR_SYNTAX;
 	}

 	/* skip blanks before northerness */
@@ -2362,6 +2370,8 @@ north:

 	if (isdigit((unsigned char) *my_str)) {
 		s = strtod(my_str, &my_str);
+		if(s > 60.0)
+			return LDNS_WIREPARSE_ERR_SYNTAX;
 	}

 	/* skip blanks before easterness */
@@ -2394,8 +2404,17 @@ east:
 		longitude = equator - longitude;
 	}

-	altitude = (uint32_t)(strtod(my_str, &my_str)*100.0 +
-		10000000.0 + 0.5);
+	while (isblank((unsigned char) *my_str)) {
+		my_str++;
+	}
+
+	/* altitude */
+	if(!(isdigit((unsigned char) *my_str) || *my_str == '-'))
+		return LDNS_WIREPARSE_ERR_SYNTAX;
+	s = strtod(my_str, &my_str);
+	if(s < -100000.0 || s > 42849672.95)
+		return LDNS_WIREPARSE_ERR_SYNTAX;
+	altitude = (uint32_t)(s*100.0 + 10000000.0 + 0.5);
 	if (*my_str == 'm' || *my_str == 'M') {
 		my_str++;
 	}
@@ -1337,6 +1337,89 @@ static void mesh_test(void)
 	free(c1);
 }

+#include "util/data/packed_rrset.h"
+#include "sldns/sbuffer.h"
+/** packed_rrset unit tests */
+static void packed_rrset_test(void)
+{
+	/* packed_rr_to_string assembles the dname, type, class, ttl and
+	 * rdata of one rr into a buffer of 65535 bytes.  Check that it
+	 * refuses an rr that does not fit in there, also when the caller
+	 * passes a dest_len that is larger than that, like the callers in
+	 * daemon/cachedump.c and daemon/remote.c do.  Without the check it
+	 * writes past the end of the assembly buffer. */
+	uint8_t smalldname[] = "\003www\007example\003com";
+	uint8_t smallrdata[] = {0, 4, 1, 2, 3, 4};
+	uint8_t maxdname[LDNS_MAX_DOMAINLEN];
+	struct ub_packed_rrset_key rrk;
+	struct packed_rrset_data d;
+	uint8_t* rr_data[1];
+	size_t rr_len[1];
+	time_t rr_ttl[1];
+	size_t dest_len = 65535*4+2048; /* the size daemon/cachedump.c uses */
+	char* dest = (char*)malloc(dest_len);
+	int i;
+
+	unit_show_func("util/data/packed_rrset.c", "packed_rr_to_string");
+	if(!dest) fatal_exit("out of memory");
+	memset(&rrk, 0, sizeof(rrk));
+	memset(&d, 0, sizeof(d));
+	rrk.entry.data = &d;
+	rrk.rk.rrset_class = htons(LDNS_RR_CLASS_IN);
+	d.count = 1;
+	d.rr_len = rr_len;
+	d.rr_ttl = rr_ttl;
+	d.rr_data = rr_data;
+	rr_ttl[0] = 3600;
+
+	/* an ordinary rr is printed, also with the large dest_len */
+	rrk.rk.dname = smalldname;
+	rrk.rk.dname_len = sizeof(smalldname);
+	rrk.rk.type = htons(LDNS_RR_TYPE_A);
+	rr_data[0] = smallrdata;
+	rr_len[0] = sizeof(smallrdata);
+	unit_assert(packed_rr_to_string(&rrk, 0, 0, dest, dest_len) == 1);
+	unit_assert(strstr(dest, "1.2.3.4") != NULL);
+
+	/* a dname of the maximum length, 127 labels of one character */
+	for(i=0; i<127; i++) {
+		maxdname[i*2] = 1;
+		maxdname[i*2+1] = (uint8_t)'a';
+	}
+	maxdname[254] = 0;
+	rrk.rk.dname = maxdname;
+	rrk.rk.dname_len = sizeof(maxdname);
+	rrk.rk.type = htons(LDNS_RR_TYPE_TXT);
+
+	/* 255+2+2+4+65272 is exactly 65535, that still fits */
+	rr_len[0] = 65535 - 255 - 8;
+	rr_data[0] = (uint8_t*)calloc(1, rr_len[0]);
+	if(!rr_data[0]) fatal_exit("out of memory");
+	sldns_write_uint16(rr_data[0], (uint16_t)(rr_len[0]-2));
+	unit_assert(packed_rr_to_string(&rrk, 0, 0, dest, dest_len) == 1);
+	free(rr_data[0]);
+
+	/* one more byte of rdata does not fit and must be refused */
+	rr_len[0] = 65535 - 255 - 8 + 1;
+	rr_data[0] = (uint8_t*)calloc(1, rr_len[0]);
+	if(!rr_data[0]) fatal_exit("out of memory");
+	sldns_write_uint16(rr_data[0], (uint16_t)(rr_len[0]-2));
+	unit_assert(packed_rr_to_string(&rrk, 0, 0, dest, dest_len) == 0);
+	unit_assert(dest[0] == 0);
+	free(rr_data[0]);
+
+	/* the largest rdata an rr can hold, well over the buffer */
+	rr_len[0] = 2 + 65535;
+	rr_data[0] = (uint8_t*)calloc(1, rr_len[0]);
+	if(!rr_data[0]) fatal_exit("out of memory");
+	sldns_write_uint16(rr_data[0], 65535);
+	unit_assert(packed_rr_to_string(&rrk, 0, 0, dest, dest_len) == 0);
+	unit_assert(dest[0] == 0);
+	free(rr_data[0]);
+
+	free(dest);
+}
+
 void unit_show_func(const char* file, const char* func)
 {
 	printf("test %s:%s\n", file, func);
@@ -1409,6 +1492,7 @@ main(int argc, char* argv[])
 	zonemd_test();
 	tcpreuse_test();
 	msgparse_test();
+	packed_rrset_test();
 	edns_ede_answer_encode_test();
 	localzone_test();
 	mesh_test();
@@ -0,0 +1,236 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+auth-zone:
+	name: "example.com."
+	master: 1.2.3.44
+	for-downstream: yes
+	for-upstream: yes
+	## fallback-enabled: no
+	allow-notify: 127.0.0.1/32
+
+	## this line generates zonefile: \n"/tmp/xxx.example.com"\n
+	zonefile:
+TEMPFILE_NAME example.com
+	## this is the inline file /tmp/xxx.example.com
+	## the tempfiles are deleted when the testrun is over.
+TEMPFILE_CONTENTS example.com
+example.com.	3600	IN	SOA	ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+example.com.	3600	IN	NS	ns.example.net.
+www.example.com.	3600	IN	A	1.2.3.4
+TEMPFILE_END
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test authority zone with NOTIFY during initial lookup
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com. IN A 1.2.3.44
+ENTRY_END
+RANGE_END
+
+; ns.example.net.
+RANGE_BEGIN 0 45
+	ADDRESS 1.2.3.44
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN NS
+SECTION ANSWER
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.net. IN A
+SECTION ANSWER
+ns.example.net. IN A	1.2.3.44
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.net. IN AAAA
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+www.example.net. IN A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.net.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+; serial, refresh, retry, expire, minimum
+example.com.	3600	IN	SOA	ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname serial=1
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN IXFR
+SECTION ANSWER
+example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
+example.com. IN SOA ns.example.com. hostmaster.example.com. 1 3600 900 86400 3600
+example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
+add.example.com. IN A 1.2.3.5
+example.com. IN SOA ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 20 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR AA RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	1.2.3.4
+ENTRY_END
+
+; NOTIFY example.com
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY NOTIFY
+SECTION QUESTION
+example.com. IN SOA
+ENTRY_END
+; notify reply
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RA NOTIFY NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+ENTRY_END
+
+STEP 45 TRAFFIC
+
+STEP 50 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+add.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 60 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR AA RD RA NOERROR
+SECTION QUESTION
+add.example.com. IN A
+SECTION ANSWER
+add.example.com. IN A	1.2.3.5
+ENTRY_END
+
+; the zonefile was updated with new contents
+STEP 70 CHECK_TEMPFILE example.com
+FILE_BEGIN
+example.com.	3600	IN	SOA	ns.example.com. hostmaster.example.com. 2 3600 900 86400 3600
+example.com.	3600	IN	NS	ns.example.net.
+add.example.com.	3600	IN	A	1.2.3.5
+www.example.com.	3600	IN	A	1.2.3.4
+FILE_END
+
+SCENARIO_END
@@ -0,0 +1,206 @@
+; config options
+; The island of trust is at test.
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+	minimal-responses: no
+	local-zone: test. nodefault
+	log-servfail: yes
+	cache-max-ttl: 86400
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test DNAME for post parse packet alteration
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+test. IN NS
+SECTION AUTHORITY
+test.	IN NS	ns.test.
+SECTION ADDITIONAL
+ns.test. IN A 1.2.3.5
+ENTRY_END
+RANGE_END
+
+; ns.test
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+test. IN NS
+SECTION ANSWER
+test.    IN NS   ns.test
+SECTION ADDITIONAL
+ns.test. IN A 1.2.3.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.test. IN A
+SECTION ANSWER
+ns.test. IN A 1.2.3.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.test. IN AAAA
+SECTION AUTHORITY
+test. 3600 IN SOA ns.test. host.test. 20201 3600 1800 604800 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.test. IN NS
+SECTION AUTHORITY
+example.test.    IN NS   ns.example.test.
+SECTION ADDITIONAL
+ns.example.test. IN A 1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.test.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.test. IN NS
+SECTION ANSWER
+example.test.    IN NS   ns.example.test.
+SECTION ADDITIONAL
+ns.example.test.         IN      A       1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.test. IN A
+SECTION ANSWER
+ns.example.test.         IN      A       1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.test. IN AAAA
+SECTION AUTHORITY
+example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.d.example.test. IN CNAME
+SECTION ANSWER
+HEX_ANSWER_BEGIN
+00 00 84 00             ; QR AA
+00 01 00 02 00 01 00 00 ; QDCOUNT=1, ANCOUNT=2, NSCOUNT=1, ARCOUNT=0.
+; a.d.example.test. IN CNAME
+01 61 01 64 07 6578616d706c65 04 74657374 00 00 05 00 01
+; answer d.example.test. DNAME IN TTL=.. e.example.test.
+01 64 07 6578616d706c65 04 74657374 00 00 27 00 01 FF 00 12 34
+00 10 01 65 07 6578616d706c65 04 74657374 00
+; . TXT len to have space.
+00 00 10 00 01 00 00 00 15
+00 10
+0F 000102030405060708090A0B0C0D0E
+; auth SOA, with rdata compression pointer that points to the
+; DNAME TTL value. That gets clamped with max-ttl.
+; example.test. SOA IN ttl
+07 6578616d706c65 04 74657374 00 00 06 00 01 00 00 00 15
+00 18
+; DNAME TTL is at 36
+c0 37
+c0 0c
+00 00 00 01
+00 00 00 02
+00 00 00 03
+00 00 00 04
+00 00 00 05
+HEX_ANSWER_END
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.e.example.test. IN A
+SECTION AUTHORITY
+example.test. 3600 IN SOA ns.example.test. host.example.test. 20301 3600 1800 604800 3600
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+a.d.example.test. IN CNAME 
+ENTRY_END
+
+; The query is for type CNAME, so that the DNAME redirect is not followed,
+; but we get the processed answer from that DNAME reply.
+; The packet alteration would have changed the domain name in the SOA rdata.
+; but it should not have happened, the check below has the correct outcome,
+; where the packet data has not been altered, from its already awkward
+; contents.
+; The TXT RR has been scrubbed from the reply.
+; The malformed rdata would read something like:
+; example.test. 5 IN SOA . \001e\007example\004test\000. 1048577 21 1052416 16909060 84281096
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+a.d.example.test. IN CNAME
+SECTION ANSWER
+d.example.test. 21 IN DNAME e.example.test.
+a.d.example.test. 21 IN CNAME a.e.example.test.
+SECTION AUTHORITY
+example.test. 3600 IN SOA . a.d.example.test. 1 2 3 4 5
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,436 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: "no"
+	fake-sha1: yes
+	trust-anchor-signaling: no
+	minimal-responses: no
+	ede: yes
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with DS loop with duplicate DS records.
+; the DS records match digest.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub1.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub1.example.com.	IN NS	ns.sub1.example.com.
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+
+sub1.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AA2wcVQsxCw2VQcgrSp2zjxYP5ElbMVNMMdc/pMU77k5VkMThtZKygE=
+SECTION ADDITIONAL
+ns.sub1.example.com.		IN 	A	1.2.3.5
+ENTRY_END
+RANGE_END
+
+; ns.sub1.example.com.
+; 24 DSes and 24 DNSKEYs
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub1.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+sub1.example.com. IN SOA a. b. 3600 3600 3600 3600 3600
+sub1.example.com.	3600	IN	RRSIG	SOA 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. PyHa+O9jyNBtKuVilpPoqQGDKHdMCrfhm6A7GDj0+ZPXZAax/+hl10CVIUhl5YqCS3xGc3Zae/WNbD+1w3cIUQ==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub1.example.com. IN DNSKEY
+SECTION ANSWER
+sub1.example.com.	IN	DNSKEY	257 3 13 n2P99SKaAUDt50U/cToH/0TmGJKG8+Pbiwl1WY/f5EVWZD/auO5QEyY6Tm9kLHzAEOcjWR701V74ZgyFPirxIA== ;{id = 20 (ksk), size = 256b}
+; invalid signatures  There is AAAA01 in it.
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA01==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA02==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA03==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA04==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA05==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA06==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA07==
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQAAAA08==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub1.example.com. IN A
+SECTION ANSWER
+www.sub1.example.com. IN A	10.20.30.41
+www.sub1.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 20 sub1.example.com. utG2+wuHSbmyQCaIjL7ElDe3DJCMqZGrPqsOEyJj8ljGGa5JaTY+KdYvZ6oGmprV7utRPNyRormou1zRWoG8ew==
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+
+; sub1.example.com.
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub1.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ede=6
+;ednsdata
+REPLY QR RD RA DO SERVFAIL
+SECTION QUESTION
+www.sub1.example.com. IN A
+SECTION ANSWER
+;www.sub1.example.com. IN A	10.20.30.41
+;SECTION ADDITIONAL
+;HEX_EDNSDATA_BEGIN
+;; EDE: DNSSEC Bogus "validation failure <www.sub1.example.com. A IN>: DS verify has too many tag matches from 1.2.3.5 for key sub1.example.com. while building chain of trust"
+;000F009A000676616C69646174696F6E206661696C757265203C7777772E737562312E
+;6578616D706C652E636F6D2E204120494E3E3A20445320766572696679206861732074
+;6F6F206D616E7920746167206D6174636865732066726F6D20312E322E332E3520666F
+;72206B657920737562312E6578616D706C652E636F6D2E207768696C65206275696C64
+;696E6720636861696E206F66207472757374
+;HEX_EDNSDATA_END
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,74 @@
+; config options
+server:
+	answer-cookie: yes
+	cookie-secret: "000102030405060708090a0b0c0d0e0f"
+	access-control: 127.0.0.1 allow_cookie
+	access-control: 1.2.3.4 allow
+	local-data: "test. TXT test"
+	harden-short-bufsize: no
+
+CONFIG_END
+
+SCENARIO_BEGIN Test downstream DNS Cookies with short bufsize
+
+; Note: When a valid hash was required, it was generated by running this test
+; with an invalid one and checking the output for the valid one.
+; Actual hash generation is tested with unit tests.
+
+; Query without a client cookie ...
+; There is no space in udpsize for the EDE.
+STEP 0 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+test. IN TXT
+SECTION ADDITIONAL
+. 0 CLASS20 OPT \# 00
+ENTRY_END
+; ... get TC and refused
+STEP 1 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA TC REFUSED
+SECTION QUESTION
+test. IN TXT
+ENTRY_END
+
+; Query with only a client cookie ...
+; The OPT udpsize is short so the reply EDNS OPT does not fit.
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+test. IN TXT
+SECTION ADDITIONAL
+. 0 CLASS24 OPT \# 12 00 0a 00 08 31 32 33 34 35 36 37 38
+ENTRY_END
+; ... the BADCOOKIE and a new cookie, does not fit.
+STEP 21 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA TC SERVFAIL
+SECTION QUESTION
+test. IN TXT
+ENTRY_END
+
+; Check an EDNS option with a too short content
+; The EDNS OPT rdata is too short, for the option opt_len.
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+test. IN TXT
+SECTION ADDITIONAL
+. 32768 CLASS1230 OPT \# 04 00 0a 00 08
+ENTRY_END
+STEP 31 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO FORMERR
+SECTION QUESTION
+test. IN TXT
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,137 @@
+; This is a comment.
+; config options go here.
+server:
+	# allow cname chains from the upstream.
+	harden-cname-follow: no
+
+forward-zone: name: "." forward-addr: 216.0.0.1
+CONFIG_END
+
+SCENARIO_BEGIN Forward and follow CNAME chain.
+RANGE_BEGIN 0 100
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+SECTION AUTHORITY
+www.example.com. IN NS ns.example.com.
+www.example.com. IN NS ns.example.com.
+www.example.com. IN NS ns.example.com.
+SECTION ADDITIONAL
+ns.example.com. IN A 10.20.30.50
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www2.example.com. IN A
+SECTION ANSWER
+www2.example.com. IN CNAME b.ex2.com.
+b.ex2.com. IN A 10.20.30.42
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www3.example.com. IN A
+SECTION ANSWER
+www3.example.com. IN CNAME b.ex2.com.
+b.ex2.com. IN CNAME b.ex3.com.
+b.ex3.com. IN A 10.20.30.43
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www4.example.com. IN A
+SECTION ANSWER
+www4.example.com. IN CNAME b4.ex2.com.
+b4.ex2.com. IN CNAME b4.ex3.com.
+b4.ex3.com. IN CNAME b4.ex4.com.
+b4.ex4.com. IN A 10.20.30.44
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 4 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A 10.20.30.40
+ENTRY_END
+
+STEP 11 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www2.example.com. IN A
+ENTRY_END
+
+STEP 14 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www2.example.com. IN A
+SECTION ANSWER
+www2.example.com. IN CNAME b.ex2.com.
+b.ex2.com. IN A 10.20.30.42
+ENTRY_END
+
+STEP 21 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www3.example.com. IN A
+ENTRY_END
+
+STEP 24 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www3.example.com. IN A
+SECTION ANSWER
+www3.example.com. IN CNAME b.ex2.com.
+b.ex2.com. IN CNAME b.ex3.com.
+b.ex3.com. IN A 10.20.30.43
+ENTRY_END
+
+STEP 31 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www4.example.com. IN A
+ENTRY_END
+
+STEP 34 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH opcode qname qtype
+SECTION QUESTION
+www4.example.com. IN A
+SECTION ANSWER
+www4.example.com. IN CNAME b4.ex2.com.
+b4.ex2.com. IN CNAME b4.ex3.com.
+b4.ex3.com. IN CNAME b4.ex4.com.
+b4.ex4.com. IN A 10.20.30.44
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,506 @@
+; config options
+server: 
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+	local-zone: test. nodefault
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129
+CONFIG_END
+
+SCENARIO_BEGIN Test locate of DS NS records when middle NS is another server.
+; There are several zones hosted on one server. The DS lookup needs to
+; locate the NS for one of the middle zones. That middle zone has an NS
+; record where the child-data does not precisely match the parent referral.
+; Even though that parent referral is not visible due to the zones that are
+; on one server. The DS lookup fetches the child-side NS record.
+; And then should lookup the DS with it.
+;
+; In foo2.test there is an actual referral, the server host the upper and
+; lower zone, but not the middle, so it gives a referral instead of the
+; child side data when queried for the middle NS record.
+;
+; In foo3.test the zone is co-hosted, also the middle zone, and the glue
+; is correct, there is no mismatch with the NS record. It points to the
+; same server. That server answers from the lower zone for qtype DS,
+; that is from the wrong zone if that server supported DNSSEC for qtype DS.
+;
+; In foo4.test the zone is co-hosted and the server supports DNSSEC for
+; qtype DS, and so uses the correct middle zone, answering the query.
+; And DSNS find is not used.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 200
+	ADDRESS 193.0.14.129
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET. IN A 193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+test. IN A
+SECTION AUTHORITY
+test. IN NS ns.test.
+SECTION ADDITIONAL
+ns.test. IN A 192.5.0.1
+ENTRY_END
+RANGE_END
+
+; ns.test.
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.1
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo.test. IN A
+SECTION AUTHORITY
+foo.test. IN NS ns.foo.test.
+SECTION ADDITIONAL
+ns.foo.test. IN A 192.5.0.2
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+ex2.test. IN A
+SECTION AUTHORITY
+ex2.test. IN NS ns.ex2.test.
+SECTION ADDITIONAL
+ns.ex2.test. IN A 192.5.0.3
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo2.test. IN A
+SECTION AUTHORITY
+foo2.test. IN NS ns.foo2.test.
+SECTION ADDITIONAL
+ns.foo2.test. IN A 192.5.0.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+ex3.test. IN A
+SECTION AUTHORITY
+ex3.test. IN NS ns.ex3.test.
+SECTION ADDITIONAL
+ns.ex3.test. IN A 192.5.0.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo3.test. IN A
+SECTION AUTHORITY
+foo3.test. IN NS ns.foo3.test.
+SECTION ADDITIONAL
+ns.foo3.test. IN A 192.5.0.6
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo4.test. IN A
+SECTION AUTHORITY
+foo4.test. IN NS ns.foo4.test.
+SECTION ADDITIONAL
+ns.foo4.test. IN A 192.5.0.7
+ENTRY_END
+RANGE_END
+
+; ns.foo.test.
+; This server hosts a number of zones.
+; foo.test
+; mid.foo.test
+; x.mid.foo.test
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.2
+
+; This answer is too low, for the DS query, it should have been answered
+; from a higher zone. This starts DSNS find.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+x.mid.foo.test. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+x.mid.foo.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+; The server is also authoriative for mid.foo.test and that
+; has a mismatching NS record, that lists another server than ns.foo.test.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+mid.foo.test. IN NS
+SECTION ANSWER
+mid.foo.test. IN NS ns2.ex2.test.
+SECTION AUTHORITY
+ENTRY_END
+
+; If it goes up further, this is the answer for the foo.test NS.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+foo.test. IN NS
+SECTION ANSWER
+foo.test. IN NS ns.foo.test.
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ns.foo.test. IN A 192.5.0.2
+ENTRY_END
+RANGE_END
+
+; ns.ex2.test.
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns2.ex2.test. IN A
+SECTION ANSWER
+; it is on this same server for ex2.test.
+ns2.ex2.test. IN A 192.5.0.3
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns2.ex2.test. IN AAAA
+SECTION AUTHORITY
+ex2.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+x.mid.foo.test. IN DS
+SECTION ANSWER
+; The DS and RRSIG content are for the test. Not actually DNSSEC valid,
+; but supposedly the zone is signed, and has a signed DS to the lower zone.
+x.mid.foo.test. IN DS 30899 5 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+x.mid.foo.test. IN RRSIG DS 3 4 3600 20070926134150 20070829134150 2854 mid.foo.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+SECTION AUTHORITY
+ENTRY_END
+RANGE_END
+
+; ns.foo2.test.
+; This server hosts a number of zones.
+; foo2.test
+; x.mid.foo2.test
+; but not: mid.foo2.test
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.4
+
+; This answer is too low, for the DS query, it should have been answered
+; from a higher zone. This starts DSNS find.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+x.mid.foo2.test. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+x.mid.foo2.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+; The server has a referral for mid.foo2.test.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+mid.foo2.test. IN NS
+SECTION AUTHORITY
+mid.foo2.test. IN NS ns.ex3.test.
+ENTRY_END
+
+; If it goes up further, this is the answer for the foo2.test NS.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+foo2.test. IN NS
+SECTION ANSWER
+foo2.test. IN NS ns.foo2.test.
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ns.foo2.test. IN A 192.5.0.4
+ENTRY_END
+RANGE_END
+
+; ns.ex3.test.
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.ex3.test. IN A
+SECTION ANSWER
+ns.ex3.test. IN A 192.5.0.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.ex3.test. IN AAAA
+SECTION AUTHORITY
+ex3.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+mid.foo2.test. IN NS
+SECTION ANSWER
+mid.foo2.test. IN NS ns.ex3.test.
+; Not actually valid signature, but content is here for the test.
+mid.foo2.test. IN RRSIG NS 3 3 3600 20070926134150 20070829134150 2854 mid.foo2.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+x.mid.foo2.test. IN DS
+SECTION ANSWER
+; The DS and RRSIG content are for the test. Not actually DNSSEC valid,
+; but supposedly the zone is signed, and has a signed DS to the lower zone.
+x.mid.foo2.test. IN DS 30899 5 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+x.mid.foo2.test. IN RRSIG DS 3 4 3600 20070926134150 20070829134150 2854 mid.foo2.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+SECTION AUTHORITY
+ENTRY_END
+RANGE_END
+
+; ns.foo3.test.
+; This server hosts a number of zones.
+; foo3.test
+; mid.foo3.test
+; x.mid.foo3.test
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.6
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.foo3.test. IN A
+SECTION ANSWER
+ns.foo3.test. IN A 192.5.0.6
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.foo3.test. IN AAAA
+SECTION AUTHORITY
+foo3.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+; This answer is too low, for the DS query, it should have been answered
+; from a higher zone. This starts DSNS find.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+x.mid.foo3.test. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+x.mid.foo3.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+; The middle zone is actually hosted on this server, and this is its
+; child side NS record.
+; But since this nameserver gives the wrong answer, from the wrong zone
+; for qtype DS, it is not going to resolve the DS lookup from mid.foo3.test,
+; but from x.mid.foo3.test instead. This can happen for a server that does
+; not support DNSSEC, and qtype DS then has lookup in the zone for it.
+; Servers that support DNSSEC are supposed to pick the right zone for the
+; qtype DS lookup in the multiple zone situation.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+mid.foo3.test. IN NS
+SECTION ANSWER
+mid.foo3.test. IN NS ns.foo3.test.
+ENTRY_END
+RANGE_END
+
+; ns.foo4.test.
+; This server hosts a number of zones.
+; foo4.test
+; mid.foo4.test
+; x.mid.foo4.test
+RANGE_BEGIN 0 200
+	ADDRESS 192.5.0.7
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.foo4.test. IN A
+SECTION ANSWER
+ns.foo4.test. IN A 192.5.0.7
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.foo4.test. IN AAAA
+SECTION AUTHORITY
+foo4.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+; The server supports DNSSEC, it hosts the correct zone for the answer,
+; and it uses the mid.foo4.test zone for the qtype DS answer.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+x.mid.foo4.test. IN DS
+SECTION ANSWER
+x.mid.foo4.test. IN DS 30899 5 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+x.mid.foo4.test. IN RRSIG DS 3 4 3600 20070926134150 20070829134150 2854 mid.foo4.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+x.mid.foo.test. IN DS
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+x.mid.foo.test. IN DS
+SECTION ANSWER
+x.mid.foo.test. IN DS 30899 5 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+x.mid.foo.test. IN RRSIG DS 3 4 3600 20070926134150 20070829134150 2854 mid.foo.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+ENTRY_END
+RANGE_END
+
+; to resolve pending messages for nameserver lookups.
+STEP 20 TRAFFIC
+
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+x.mid.foo2.test. IN DS
+ENTRY_END
+
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+x.mid.foo2.test. IN DS
+SECTION ANSWER
+x.mid.foo2.test. IN DS 30899 5 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+x.mid.foo2.test. IN RRSIG DS 3 4 3600 20070926134150 20070829134150 2854 mid.foo2.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+ENTRY_END
+
+; to resolve pending messages for nameserver lookups.
+STEP 50 TRAFFIC
+
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+x.mid.foo3.test. IN DS
+ENTRY_END
+
+STEP 70 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+x.mid.foo3.test. IN DS
+SECTION AUTHORITY
+x.mid.foo3.test. IN SOA a. b. 1 2 3 4 5
+ENTRY_END
+
+; to resolve pending messages for nameserver lookups.
+STEP 80 TRAFFIC
+
+STEP 90 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+x.mid.foo4.test. IN DS
+ENTRY_END
+
+STEP 100 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+x.mid.foo4.test. IN DS
+SECTION ANSWER
+x.mid.foo4.test. IN DS 30899 5 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+x.mid.foo4.test. IN RRSIG DS 3 4 3600 20070926134150 20070829134150 2854 mid.foo4.test. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA==
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,215 @@
+; EXP testbound scenario for <finding-id>
+; Tests: malicious NSEC3 in referral response triggers wipeout over-deletion
+;
+; Scenario:
+; 1. Query www.sub.example.com (A) - triggers referral from example.com
+; 2. The referral includes a malicious NSEC3 with oversized next owner
+;    (200 'v' chars = 125 bytes raw, > 63 LDNS_MAX_LABELLEN)
+; 3. The malicious NSEC3 enters val_neg_addreferral -> neg_insert_data -> wipeout
+; 4. wipeout over-deletes existing neg cache entries
+; 5. The query still resolves (the referral is valid), but the neg cache
+;    is now corrupted
+
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: "no"
+	fake-sha1: yes
+	trust-anchor-signaling: no
+	module-config: "validator iterator"
+	aggressive-nsec: yes
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129
+CONFIG_END
+
+SCENARIO_BEGIN EXP: malicious NSEC3 in referral triggers wipeout
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; DS query response: no DS for sub.example.com (NODATA with NSEC3 proof)
+; This is a separate query from the validator to verify the delegation
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION AUTHORITY
+example.com.	IN SOA	ns.example.com. hostmaster.example.com. 2007090400 28800 7200 604800 18000
+example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCM6lsu9byZIQ1yYjJmyYfFWM2RWAIUcR5t84r2La824oWCkLjmHXRQlco= ;{id = 2854}
+; NODATA response with NSEC3 proof
+; H(sub.example.com.) = kg19n32806c832kijdnglq8p9m2r5mdj
+kg19n32806c832kijdnglq8p9m2r5mdj.example.com.	3600	IN	NSEC3	1 0 0 -  kg19n32806c832kijdnglq8p9m2r5mdk NS RRSIG
+kg19n32806c832kijdnglq8p9m2r5mdj.example.com.	3600	IN	RRSIG	NSEC3 3 3 3600 20070926134150 20070829134150 2854 example.com. AD1ed7zhMyd/S4fTCwip94DwMbiDV1lF+11zFI/yeR4R7k/n0Hh7GcE=
+ENTRY_END
+
+; REFERRAL response with MALICIOUS NSEC3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+; MALICIOUS NSEC3: next owner = vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv (125 bytes, all 0xFF)
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.example.com.	3600	IN	NSEC3	1 0 0 - vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv NS RRSIG
+aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.example.com.	3600	IN	RRSIG	NSEC3 3 3 3600 20070926134150 20070829134150 2854 example.com. AC8XUZo1he4odxG32SfOzFznQn83N4/gJv8AWE0wzrbPO+bbO80+0pg=
+
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+RANGE_END
+
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN	NS ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+sub.example.com.        3600    IN      RRSIG   DNSKEY 3 3 3600 20070926135752 20070829135752 2854 sub.example.com. MCwCFBznBTYM/SrdUnjQdBnLtRO79KAaAhQReG5nRuL7Xsdf6D0KKwPa1GpWyQ== ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A 11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 3 4 3600 20070926135752 20070829135752 2854 sub.example.com. MC0CFEExteiCsLkRi/md6o5K8BhRJAKFAhUAgg2tkvwaDn8Xbm9q+5xnjvgIB8k= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. 	3600	IN	A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 3 4 3600 20070926135752 20070829135752 2854 sub.example.com. MC0CFEExteiCsLkRi/md6o5K8BhRJAKFAhUAgg2tkvwaDn8Xbm9q+5xnjvgIB8k= ;{id = 2854}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END
@@ -107,7 +107,12 @@ check_expected_stats () {
 # Check that the rest (unspecified) stats are all 0 (no surprises).
 check_rest_stats () {
 	echo "> Checking rest stats"
-	grep -F -x -v -f $EXPECTED_STATS_FILE $FILTERED_STATS_FILE > $REST_STATS_FILE
+	grep -F -x -v -f $EXPECTED_STATS_FILE $FILTERED_STATS_FILE | \
+		grep -F -v -e "msg.cache.max_collisions" \
+			-e "rrset.cache.max_collisions" | \
+		> $REST_STATS_FILE
+	# It filtered out the 'max_collisions', since at random, a msg
+	# or rrset cache entry could have a cache hash collision. */
 	if test $DEBUG -ne 0; then
 		echo "Rest:"
 		cat $REST_STATS_FILE
@@ -90,3 +90,11 @@ v18	HTTPS	16 foo.example.org. (alpn=h2,h3-19 mandatory=ipv4hint,alpn
 v19	HTTPS	16 foo.example.org. alpn="f\\\\oo\\,bar,h2"
 v20	HTTPS	16 foo.example.org. alpn=f\\\092oo\092,bar,h2

+; This vector is out-of-order in the wireformat encoding. That could come
+; from an upstream when this is the secondary zone. To leniently accept such
+; content as a secondary, it has to be able to be written and read back in.
+v21	HTTPS	1 . alpn="h3" port=7777
+
+; If the server can leniently accept broken svcparams, then it should be able
+; to write and read them back in. This svcparam is broken, it is truncated.
+v22	HTTPS	\# 8 000100000300021e
@@ -230,3 +230,11 @@ v20	HTTPS	\# 35 (
 68 32                                              ; alpn value
 )

+; This vector is out-of-order in the wireformat encoding. That could come
+; from an upstream when this is the secondary zone. To leniently accept such
+; content as a secondary, it has to be able to be written and read back in.
+v21	HTTPS	\# 16 000100000300021e6100010003026833
+
+; If the server can leniently accept broken svcparams, then it should be able
+; to write and read them back in. This svcparam is broken, it is truncated.
+v22	HTTPS	\# 8 000100000300021e
@@ -0,0 +1,602 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: "no"
+	fake-sha1: yes
+	trust-anchor-signaling: no
+	minimal-responses: no
+	ede: yes
+	# this is not the limit that is tested here.
+	val-hash-attempts: 128
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with too many tag matches
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub1.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub1.example.com.	IN NS	ns.sub1.example.com.
+
+sub1.example.com.	IN	DS	20 13 2 c3bd4c6000cff93b4ce8ca6c934d7f46ab1f2bb7283e40493798395627c9ca41
+sub1.example.com.	IN	DS	3539 13 2 2e33e1da915795ab2412fa116cab8b219707135aa6bcc48a5f8b1ca097c5a297
+sub1.example.com.	IN	DS	12688 13 2 87a10b8df44945b7dae0c12c98f82d04992587a8e0a2ed823b0789dd48fe889f
+sub1.example.com.	IN	DS	13058 13 2 e8f15b542b537cb7b4a2370575988d5e6dc58c495fe695961fc482be580396fa
+sub1.example.com.	IN	DS	18006 13 2 2a35a6f7d086c11493d34712ac819f74baaa674399d5d478fd056d0227c17b83
+sub1.example.com.	IN	DS	18279 13 2 4a4c9053b35a89d4ba1453fb8c0df658c6f473aa9042dabc9269f00e888751be
+sub1.example.com.	IN	DS	20669 13 2 6958b937ef837d76361e03eb11e780de5ee65e44faac5ec19daecdb9e4722b0d
+sub1.example.com.	IN	DS	25106 13 2 56bbbbaee440eb3649afebdd6a806105bdc345613bffa156b9b5f708cddb44cf
+sub1.example.com.	IN	DS	25932 13 2 76c6e7506e9b7306e547913d35e4cc9162c2cf3000b9b62cc0acb21c5e85b960
+sub1.example.com.	IN	DS	27845 13 2 ed630a116a6049eb5ccdd3f46aa09228bde76a0f3c43ac40731d3ebcdb65c161
+sub1.example.com.	IN	DS	29183 13 2 2a573047cd9945ec15aa6278dc3cd908d59732fa253ebffed6b35485e4e3d6f9
+sub1.example.com.	IN	DS	30380 13 2 a1dac7f7185404ca826ce62c5ec57b50f5584ee86e762c809af3f5ebc207f0a8
+sub1.example.com.	IN	DS	31753 13 2 c811dca5f7cfb8d82be1c145b1bf0f5f6275bed42f31ffdec45fb7ba54d76564
+sub1.example.com.	IN	DS	32621 13 2 4ba7774dbfa9115c6a188dce790b6b45480e0aa5c39602be08ccc139c68492de
+sub1.example.com.	IN	DS	33127 13 2 d45c3cbcc4cb71d53c80374efe2b6081e9d1add53bae66fb6bf61028b68d3cf9
+sub1.example.com.	IN	DS	37404 13 2 2480a04461a7425a5d897921eb6b493428abaf46ed6809f3fac53fd1465415ab
+sub1.example.com.	IN	DS	38693 13 2 ad6a97280b20cf4eac60c9e70db9712a5357d12166993f55c201b91d2b4c1ff5
+sub1.example.com.	IN	DS	40580 13 2 93ace4ec403fd790d1debb05f539f58797822fc75ac3dd0d7e2f8b1d3fdb126d
+sub1.example.com.	IN	DS	43985 13 2 2c8f7712ebd5fd18df7e6e58995b13d8204b258322078f473d5c28a76c03b8d7
+sub1.example.com.	IN	DS	44725 13 2 9e6631ddbc09355f8891c7713d8703c4e213d8c51b1126826d31c05a4b7991be
+sub1.example.com.	IN	DS	44975 13 2 4ea12a0336c18766537d195c608ce76a7ab7cbb5cce873a65fe0d9a662fcd9aa
+sub1.example.com.	IN	DS	49819 13 2 c7f1a7b39c26ffab7ff3775624a2e40aa73af44c84ebd80442c52cdb1abb991e
+sub1.example.com.	IN	DS	56088 13 2 653cff8afa5cda5d6efda676c2a73eccc3301f7e32437bff72a8b761fa1b6379
+sub1.example.com.	IN	DS	58926 13 2 39000f49e8914dee8602795fd559ac2b0b4d434da4c8d1908936e9acc0e42485
+sub1.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AA2wcVQsxCw2VQcgrSp2zjxYP5ElbMVNMMdc/pMU77k5VkMThtZKygE=
+SECTION ADDITIONAL
+ns.sub1.example.com.		IN 	A	1.2.3.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub2.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub2.example.com.	IN NS	ns.sub2.example.com.
+
+; With this one DS record it works for sub2.example.com, since not that
+; many DNSKEY to RRSIG attempts are made.
+;sub2.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AHyR2q4kMaOs9/SFLRgftMXPMu0CQRjRk8z2+3M7VAcnKzIck7VAcl0=
+; Here with 8 DS records, that match.
+sub2.example.com.	3600	IN	DS	3539 13 2 e94cf5357bdb8ce5423a0a5eacf564105ea1935fbf813c76bcc13eb34594167c
+sub2.example.com.	3600	IN	DS	12688 13 2 73d5613cba9bfe510ffa8241c20277d78b57a28d9b1d3c8ad23c2032fbe86a78
+sub2.example.com.	3600	IN	DS	13058 13 2 12e107e5a4c72620cfcdfe7c4186eccaf1b46501afb7bb3ca9e395a083e16fea
+sub2.example.com.	3600	IN	DS	18006 13 2 7a3525ee9385e36a2819a3b0e650f0aff4788b787d6ef7870d4956692b1d6feb
+sub2.example.com.	3600	IN	DS	18279 13 2 8a900772c1ff65553343920868996b2cf3be2dc5bdf182e962cb996dbd3f1682
+sub2.example.com.	3600	IN	DS	20669 13 2 54ad32be8029ce48cb6d45ffbdba918c11e70fbd416c2f3501321a4fcc2692c8
+sub2.example.com.	3600	IN	DS	25106 13 2 a6c125c2be2f301888e16255405d994c1b31ccc3ca72217399ae2a16c721cbeb
+sub2.example.com.	3600	IN	DS	20 13 2 87f0229abc95a9a463e15e572c52869224ac07098e72ec7bacf0b3e358e44674
+sub2.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AFluwWeqE8NSEI+u1S+pDZBfgdBvbXBeGez5Wf35ojP0HIW+MIFCWL4=
+
+SECTION ADDITIONAL
+ns.sub2.example.com.		IN 	A	1.2.3.6
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub3.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub3.example.com.	IN NS	ns.sub3.example.com.
+sub3.example.com.	3600	IN	DS	20 13 2 64d2a1243b619ba0b1f14912fd560f3e9d27b0ae6f4df35625c74fe3015fb1d3
+sub3.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AE7A38rpBCyGBEkqyQVqLHwFnjSmoIwOVEm5oh9bErGhqdB0fIF2ddw=
+SECTION ADDITIONAL
+ns.sub3.example.com.		IN 	A	1.2.3.7
+ENTRY_END
+RANGE_END
+
+; ns.sub1.example.com.
+; 24 DSes and 24 DNSKEYs
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub1.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+sub1.example.com. IN SOA a. b. 3600 3600 3600 3600 3600
+sub1.example.com.	3600	IN	RRSIG	SOA 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. PyHa+O9jyNBtKuVilpPoqQGDKHdMCrfhm6A7GDj0+ZPXZAax/+hl10CVIUhl5YqCS3xGc3Zae/WNbD+1w3cIUQ==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub1.example.com. IN DNSKEY
+SECTION ANSWER
+; These keys actually match the DS record, but to have more match attempts they
+; are altered, below.
+;sub1.example.com.	IN	DNSKEY	257 3 13 n2P99SKaAUDt50U/cToH/0TmGJKG8+Pbiwl1WY/f5EVWZD/auO5QEyY6Tm9kLHzAEOcjWR701V74ZgyFPirxIA== ;{id = 20 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 2biK+rkC8P/MV/UMDbksGCov08Tya5wrtrjeDOSez5W1qFqqPKXzxuMxecGSXIYgNM8Y/m8XdlwOd8Q6vUuw5A== ;{id = 3539 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 UeL+mKovo+r7+B3egif1JxCHPfmbR4SU4m3s0Fp42ozze0FiMzEwRM85O4aYViPOmu0AKgfwuRjEM5aEM1pBug== ;{id = 12688 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 iFe//OnLHLGXpE9i+4y3H+NefdDTZAEwYzDv0U+OIzs37lnOEMYTVqBxkLA82JDKMtnjupCOtSXMoru7lQcckw== ;{id = 13058 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 0/lAWEpW94Rkjion6aUxepvCO6MxoRRJ5aIX9fdEPjUJXCGeHviFLmeDnNzTB0egvC5CgthSnQfyxqMqbbuMAQ== ;{id = 18006 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 P1rwuvxZ8tQOxtOHsbzHAIpMNkleGRtg7gynoesq2gSJT+NAmYRrk+BzEGvHWTHKWd5KnusSt2BpBBlWw5pLiw== ;{id = 18279 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 WraqJ/JvyS8xQZOKpVscbAUuYU8lVCiuEHjekR0kADMP/eWOvdJkaPZ++REeHclBejqXp+NcP0dnyweObnZDsA== ;{id = 20669 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 /fci65ankZ0cKOPdJAJBIyXHYGzjngEyqGbBVmeDk2RwAqxmyUB5OORRmlPMY80ipMU+e8Pt3itKpglwpT7qSA== ;{id = 25106 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 MEfZQnvjQI/L/0QlglQ2YrxSCQ6fRruKF2aQ+nD5JV9ecE1AhA/RujbKkg9UrG4ScjqC7f0fhCW+eUqsSoUcTg== ;{id = 25932 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 KbKK1C8ZtHNsBicJnjrvTB56BoTTjL9pvNEbRVwCKIcWYdNP8l3dpsvVEAZ/ujxmKRA/ToA7ua4/IBDtALFWvg== ;{id = 27845 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 G3I9nIlyTOrn12D8luAgZR4ZTK+iNegzz9UG8b5YsC9IV4UtgbdZkoEDRsH2uu429qvezzlUsjTzR+fu/74Saw== ;{id = 29183 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 fBgVewGRqRmvJUVm/ZQqPLynt1lM6ilPdENMd9uESPh30CzUsi8Q7tbGZoH52CJjpcb17z3zSjJv40ASVEBhNw== ;{id = 30380 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 3LbmoAShX4cKq4qyIqHLI7+UH4/EVOaXCF7AhJHaRJsgbyCEwn4Ofjh6l15Pxbk/UH851tR8MBaaOz8+ROcL2A== ;{id = 31753 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 xMfArWljU25/0ePkuncQHH8U+/NMLIqy3IpJ7IqcOKRXmR7hrY2dQ6MgBN1rUBW8Q7Uq3mFbozdJbr3oDeZcdQ== ;{id = 32621 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 YsXykW60iTTY+1DY7CG9izDd+RAzx+oPUk2UBiHBPengMUmu3R9rgsJHYfjwWgYWB60sy0CPcdAeu+jD2tB4eA== ;{id = 33127 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 wzS1uBaSWR+bTTYgtLm3jNxNnLSNv6abvnHABXQD5yDFs17rGqDCdvkk6JM3qI4BJ+npNLdADJZt118PWlQ7eQ== ;{id = 37404 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 9nDuSJ9wRTsvFYubQ7KQyOmzlY+UzG1cESD8NK9eOj9VMX1O71d5GxBwzc4UtBs+kZBi49BLjZIV5qWbD9FbXQ== ;{id = 38693 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 EFDgOhEi43zsVaJdytsq3HjtAh6dVDaAnR0PY7O0S4q/svucxOVxmJsG/2rXYMHTej9jRTg/qWWbW4gdReDoSQ== ;{id = 40580 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 wq8UI3DydI9svWJEQ1G0JHGVHykgo3YXFF8CRG055gshZAVyfIiTRwCemG0mbziuobOeZSpCtK05KGp20NHRTA== ;{id = 43985 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 wRMENWFMd+9c4p9agfd/3qLnum1SS555CP9lgJKtU0t7Q689SrAUwBJP7ymXTDGtWSjlFBzbts6SUARX47SK1Q== ;{id = 44725 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 zeWh2eFjuwp9K9yaJq16XMVNC8Ys0TOk91eYkGa0Dgez59aG/PvPYV1qi9pxbmG/c4tuXcRV9Z9cxcVev9DdYw== ;{id = 44975 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 O/y794Mc/kIwRltqnqj+puIS1ejFQeE9Xmjz1NVU82x+UyEvx2InNpwaU2TFNKaT7aned72CE1u//CahV6zeEg== ;{id = 49819 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 edr2Ai2uObWeVfFjvCF01Xa9SQD706baatsttcUuI4MblMTNG4blOSN1pMpZJ/wymkqt4c7eQSCETlD/mPeWPQ== ;{id = 56088 (ksk), size = 256b}
+;sub1.example.com.	IN	DNSKEY	257 3 13 PlfsudScPXH3VdDVv6nnuBEXQpP6coF6F2w99u4Es5VbJHZrgFhvxL9os0jnfiGCL6VJ0Q+bNKnzfoP3ByP1Kg== ;{id = 58926 (ksk), size = 256b}
+;sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQbqA7tA==
+
+; The altered keys, with 'AAAA' at the end.
+sub1.example.com.	IN	DNSKEY	257 3 13 n2P99SKaAUDt50U/cToH/0TmGJKG8+Pbiwl1WY/f5EVWZD/auO5QEyY6Tm9kLHzAEOcjWR701V74ZgyFPiAAAA== ;{id = 20 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 2biK+rkC8P/MV/UMDbksGCov08Tya5wrtrjeDOSez5W1qFqqPKXzxuMxecGSXIYgNM8Y/m8XdlwOd8Q6vAAAAA== ;{id = 3539 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 UeL+mKovo+r7+B3egif1JxCHPfmbR4SU4m3s0Fp42ozze0FiMzEwRM85O4aYViPOmu0AKgfwuRjEM5aEM1AAAA== ;{id = 12688 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 iFe//OnLHLGXpE9i+4y3H+NefdDTZAEwYzDv0U+OIzs37lnOEMYTVqBxkLA82JDKMtnjupCOtSXMoru7lQAAAA== ;{id = 13058 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 0/lAWEpW94Rkjion6aUxepvCO6MxoRRJ5aIX9fdEPjUJXCGeHviFLmeDnNzTB0egvC5CgthSnQfyxqMqbbAAAA== ;{id = 18006 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 P1rwuvxZ8tQOxtOHsbzHAIpMNkleGRtg7gynoesq2gSJT+NAmYRrk+BzEGvHWTHKWd5KnusSt2BpBBlWw5AAAA== ;{id = 18279 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 WraqJ/JvyS8xQZOKpVscbAUuYU8lVCiuEHjekR0kADMP/eWOvdJkaPZ++REeHclBejqXp+NcP0dnyweObnAAAA== ;{id = 20669 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 /fci65ankZ0cKOPdJAJBIyXHYGzjngEyqGbBVmeDk2RwAqxmyUB5OORRmlPMY80ipMU+e8Pt3itKpglwpTAAAA== ;{id = 25106 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 MEfZQnvjQI/L/0QlglQ2YrxSCQ6fRruKF2aQ+nD5JV9ecE1AhA/RujbKkg9UrG4ScjqC7f0fhCW+eUqsSoAAAA== ;{id = 25932 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 KbKK1C8ZtHNsBicJnjrvTB56BoTTjL9pvNEbRVwCKIcWYdNP8l3dpsvVEAZ/ujxmKRA/ToA7ua4/IBDtALAAAA== ;{id = 27845 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 G3I9nIlyTOrn12D8luAgZR4ZTK+iNegzz9UG8b5YsC9IV4UtgbdZkoEDRsH2uu429qvezzlUsjTzR+fu/7AAAA== ;{id = 29183 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 fBgVewGRqRmvJUVm/ZQqPLynt1lM6ilPdENMd9uESPh30CzUsi8Q7tbGZoH52CJjpcb17z3zSjJv40ASVEAAAA== ;{id = 30380 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 3LbmoAShX4cKq4qyIqHLI7+UH4/EVOaXCF7AhJHaRJsgbyCEwn4Ofjh6l15Pxbk/UH851tR8MBaaOz8+ROAAAA== ;{id = 31753 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 xMfArWljU25/0ePkuncQHH8U+/NMLIqy3IpJ7IqcOKRXmR7hrY2dQ6MgBN1rUBW8Q7Uq3mFbozdJbr3oDeAAAA== ;{id = 32621 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 YsXykW60iTTY+1DY7CG9izDd+RAzx+oPUk2UBiHBPengMUmu3R9rgsJHYfjwWgYWB60sy0CPcdAeu+jD2tAAAA== ;{id = 33127 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 wzS1uBaSWR+bTTYgtLm3jNxNnLSNv6abvnHABXQD5yDFs17rGqDCdvkk6JM3qI4BJ+npNLdADJZt118PWlAAAA== ;{id = 37404 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 9nDuSJ9wRTsvFYubQ7KQyOmzlY+UzG1cESD8NK9eOj9VMX1O71d5GxBwzc4UtBs+kZBi49BLjZIV5qWbD9AAAA== ;{id = 38693 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 EFDgOhEi43zsVaJdytsq3HjtAh6dVDaAnR0PY7O0S4q/svucxOVxmJsG/2rXYMHTej9jRTg/qWWbW4gdReAAAA== ;{id = 40580 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 wq8UI3DydI9svWJEQ1G0JHGVHykgo3YXFF8CRG055gshZAVyfIiTRwCemG0mbziuobOeZSpCtK05KGp20NAAAA== ;{id = 43985 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 wRMENWFMd+9c4p9agfd/3qLnum1SS555CP9lgJKtU0t7Q689SrAUwBJP7ymXTDGtWSjlFBzbts6SUARX47AAAA== ;{id = 44725 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 zeWh2eFjuwp9K9yaJq16XMVNC8Ys0TOk91eYkGa0Dgez59aG/PvPYV1qi9pxbmG/c4tuXcRV9Z9cxcVev9AAAA== ;{id = 44975 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 O/y794Mc/kIwRltqnqj+puIS1ejFQeE9Xmjz1NVU82x+UyEvx2InNpwaU2TFNKaT7aned72CE1u//CahV6AAAA== ;{id = 49819 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 edr2Ai2uObWeVfFjvCF01Xa9SQD706baatsttcUuI4MblMTNG4blOSN1pMpZJ/wymkqt4c7eQSCETlD/mPAAAA== ;{id = 56088 (ksk), size = 256b}
+sub1.example.com.	IN	DNSKEY	257 3 13 PlfsudScPXH3VdDVv6nnuBEXQpP6coF6F2w99u4Es5VbJHZrgFhvxL9os0jnfiGCL6VJ0Q+bNKnzfoP3ByAAAA== ;{id = 58926 (ksk), size = 256b}
+sub1.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub1.example.com. p6ScxBgybYLIhpD9SVDSquhPsytpehEUVncg2zRoXTxkuKXUsQIDKUuLhZxgeHNAnkKQn8e3xnoDWCGQbqA7tA==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub1.example.com. IN A
+SECTION ANSWER
+www.sub1.example.com. IN A	10.20.30.41
+www.sub1.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 20 sub1.example.com. utG2+wuHSbmyQCaIjL7ElDe3DJCMqZGrPqsOEyJj8ljGGa5JaTY+KdYvZ6oGmprV7utRPNyRormou1zRWoG8ew==
+ENTRY_END
+RANGE_END
+
+; ns.sub2.example.com.
+; 24 DNSKEYs with 24 RRSIGs on DNSKEY, that works with one DS.
+; 8 DS with 24 DNSKEYs with 40 RRSIGs on DNSKEY.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub2.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+sub2.example.com. IN SOA a. b. 3600 3600 3600 3600 3600
+sub2.example.com.	3600	IN	RRSIG	SOA 13 3 3600 20070926134150 20070829134150 20 sub2.example.com. Uzdsj01UwK807QiRzTxZffHYpd7uEDEfPwbH4XsVilR238gk/fObaNBVij8Y2HiZHmch8I7GeNqB6RXpKQKU1w==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub2.example.com. IN DNSKEY
+SECTION ANSWER
+sub2.example.com.	IN	DNSKEY	257 3 13 n2P99SKaAUDt50U/cToH/0TmGJKG8+Pbiwl1WY/f5EVWZD/auO5QEyY6Tm9kLHzAEOcjWR701V74ZgyFPirxIA== ;{id = 20 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 2biK+rkC8P/MV/UMDbksGCov08Tya5wrtrjeDOSez5W1qFqqPKXzxuMxecGSXIYgNM8Y/m8XdlwOd8Q6vUuw5A== ;{id = 3539 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 UeL+mKovo+r7+B3egif1JxCHPfmbR4SU4m3s0Fp42ozze0FiMzEwRM85O4aYViPOmu0AKgfwuRjEM5aEM1pBug== ;{id = 12688 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 iFe//OnLHLGXpE9i+4y3H+NefdDTZAEwYzDv0U+OIzs37lnOEMYTVqBxkLA82JDKMtnjupCOtSXMoru7lQcckw== ;{id = 13058 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 0/lAWEpW94Rkjion6aUxepvCO6MxoRRJ5aIX9fdEPjUJXCGeHviFLmeDnNzTB0egvC5CgthSnQfyxqMqbbuMAQ== ;{id = 18006 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 P1rwuvxZ8tQOxtOHsbzHAIpMNkleGRtg7gynoesq2gSJT+NAmYRrk+BzEGvHWTHKWd5KnusSt2BpBBlWw5pLiw== ;{id = 18279 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 WraqJ/JvyS8xQZOKpVscbAUuYU8lVCiuEHjekR0kADMP/eWOvdJkaPZ++REeHclBejqXp+NcP0dnyweObnZDsA== ;{id = 20669 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 /fci65ankZ0cKOPdJAJBIyXHYGzjngEyqGbBVmeDk2RwAqxmyUB5OORRmlPMY80ipMU+e8Pt3itKpglwpT7qSA== ;{id = 25106 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 MEfZQnvjQI/L/0QlglQ2YrxSCQ6fRruKF2aQ+nD5JV9ecE1AhA/RujbKkg9UrG4ScjqC7f0fhCW+eUqsSoUcTg== ;{id = 25932 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 KbKK1C8ZtHNsBicJnjrvTB56BoTTjL9pvNEbRVwCKIcWYdNP8l3dpsvVEAZ/ujxmKRA/ToA7ua4/IBDtALFWvg== ;{id = 27845 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 G3I9nIlyTOrn12D8luAgZR4ZTK+iNegzz9UG8b5YsC9IV4UtgbdZkoEDRsH2uu429qvezzlUsjTzR+fu/74Saw== ;{id = 29183 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 fBgVewGRqRmvJUVm/ZQqPLynt1lM6ilPdENMd9uESPh30CzUsi8Q7tbGZoH52CJjpcb17z3zSjJv40ASVEBhNw== ;{id = 30380 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 3LbmoAShX4cKq4qyIqHLI7+UH4/EVOaXCF7AhJHaRJsgbyCEwn4Ofjh6l15Pxbk/UH851tR8MBaaOz8+ROcL2A== ;{id = 31753 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 xMfArWljU25/0ePkuncQHH8U+/NMLIqy3IpJ7IqcOKRXmR7hrY2dQ6MgBN1rUBW8Q7Uq3mFbozdJbr3oDeZcdQ== ;{id = 32621 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 YsXykW60iTTY+1DY7CG9izDd+RAzx+oPUk2UBiHBPengMUmu3R9rgsJHYfjwWgYWB60sy0CPcdAeu+jD2tB4eA== ;{id = 33127 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 wzS1uBaSWR+bTTYgtLm3jNxNnLSNv6abvnHABXQD5yDFs17rGqDCdvkk6JM3qI4BJ+npNLdADJZt118PWlQ7eQ== ;{id = 37404 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 9nDuSJ9wRTsvFYubQ7KQyOmzlY+UzG1cESD8NK9eOj9VMX1O71d5GxBwzc4UtBs+kZBi49BLjZIV5qWbD9FbXQ== ;{id = 38693 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 EFDgOhEi43zsVaJdytsq3HjtAh6dVDaAnR0PY7O0S4q/svucxOVxmJsG/2rXYMHTej9jRTg/qWWbW4gdReDoSQ== ;{id = 40580 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 wq8UI3DydI9svWJEQ1G0JHGVHykgo3YXFF8CRG055gshZAVyfIiTRwCemG0mbziuobOeZSpCtK05KGp20NHRTA== ;{id = 43985 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 wRMENWFMd+9c4p9agfd/3qLnum1SS555CP9lgJKtU0t7Q689SrAUwBJP7ymXTDGtWSjlFBzbts6SUARX47SK1Q== ;{id = 44725 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 zeWh2eFjuwp9K9yaJq16XMVNC8Ys0TOk91eYkGa0Dgez59aG/PvPYV1qi9pxbmG/c4tuXcRV9Z9cxcVev9DdYw== ;{id = 44975 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 O/y794Mc/kIwRltqnqj+puIS1ejFQeE9Xmjz1NVU82x+UyEvx2InNpwaU2TFNKaT7aned72CE1u//CahV6zeEg== ;{id = 49819 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 edr2Ai2uObWeVfFjvCF01Xa9SQD706baatsttcUuI4MblMTNG4blOSN1pMpZJ/wymkqt4c7eQSCETlD/mPeWPQ== ;{id = 56088 (ksk), size = 256b}
+sub2.example.com.	IN	DNSKEY	257 3 13 PlfsudScPXH3VdDVv6nnuBEXQpP6coF6F2w99u4Es5VbJHZrgFhvxL9os0jnfiGCL6VJ0Q+bNKnzfoP3ByP1Kg== ;{id = 58926 (ksk), size = 256b}
+
+; 44 invalid signatures, modified with different tags.
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 22 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 23 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 24 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 25 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 26 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 27 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 28 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 29 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 30 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 31 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 32 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 33 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 34 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 35 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 36 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 37 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 38 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 39 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 40 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 41 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 42 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 43 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 44 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 45 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 46 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 47 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 48 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 49 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 50 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 51 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 52 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 53 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 54 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 55 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 56 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 57 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 58 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 59 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 60 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 61 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 62 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 63 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 64 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 65 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+
+; this signature is valid
+sub2.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub2.example.com. fu5MNWhUdr7xd3u3PENBOdg3sZiaOo+TAoj+ZIc2E+6p4SMZYya64a/gdppEqd2kCCPsW0FyxhUlfi9mGmgjcw==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub2.example.com. IN A
+SECTION ANSWER
+www.sub2.example.com. IN A	10.20.30.42
+www.sub2.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 20 sub2.example.com. VCy6Ggk2HZ+fQ8Bube9UIVDXfF6iWo6Gm5MFRVikWdgqTNizrP5F/z2HzgYFPd+K9WNzsWbi4n+9m4sgYRHAnA==
+ENTRY_END
+RANGE_END
+
+; ns.sub3.example.com.
+; 24 DNSKEYs and 24 RRSIGs on A
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.7
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub3.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+sub3.example.com. IN SOA a. b. 3600 3600 3600 3600 3600
+sub3.example.com.	3600	IN	RRSIG	SOA 13 3 3600 20070926134150 20070829134150 20 sub3.example.com. ghR8Y1uUeoJaADEVdXMkNTE2/LtCBt/lmnTX5TOYZSWsT2+Ut6RclRrR9gi771T8IihYwvcf3ZsNyfjfEENSfw==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub3.example.com. IN DNSKEY
+SECTION ANSWER
+sub3.example.com.	IN	DNSKEY	257 3 13 n2P99SKaAUDt50U/cToH/0TmGJKG8+Pbiwl1WY/f5EVWZD/auO5QEyY6Tm9kLHzAEOcjWR701V74ZgyFPirxIA== ;{id = 20 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 2biK+rkC8P/MV/UMDbksGCov08Tya5wrtrjeDOSez5W1qFqqPKXzxuMxecGSXIYgNM8Y/m8XdlwOd8Q6vUuw5A== ;{id = 3539 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 UeL+mKovo+r7+B3egif1JxCHPfmbR4SU4m3s0Fp42ozze0FiMzEwRM85O4aYViPOmu0AKgfwuRjEM5aEM1pBug== ;{id = 12688 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 iFe//OnLHLGXpE9i+4y3H+NefdDTZAEwYzDv0U+OIzs37lnOEMYTVqBxkLA82JDKMtnjupCOtSXMoru7lQcckw== ;{id = 13058 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 0/lAWEpW94Rkjion6aUxepvCO6MxoRRJ5aIX9fdEPjUJXCGeHviFLmeDnNzTB0egvC5CgthSnQfyxqMqbbuMAQ== ;{id = 18006 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 P1rwuvxZ8tQOxtOHsbzHAIpMNkleGRtg7gynoesq2gSJT+NAmYRrk+BzEGvHWTHKWd5KnusSt2BpBBlWw5pLiw== ;{id = 18279 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 WraqJ/JvyS8xQZOKpVscbAUuYU8lVCiuEHjekR0kADMP/eWOvdJkaPZ++REeHclBejqXp+NcP0dnyweObnZDsA== ;{id = 20669 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 /fci65ankZ0cKOPdJAJBIyXHYGzjngEyqGbBVmeDk2RwAqxmyUB5OORRmlPMY80ipMU+e8Pt3itKpglwpT7qSA== ;{id = 25106 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 MEfZQnvjQI/L/0QlglQ2YrxSCQ6fRruKF2aQ+nD5JV9ecE1AhA/RujbKkg9UrG4ScjqC7f0fhCW+eUqsSoUcTg== ;{id = 25932 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 KbKK1C8ZtHNsBicJnjrvTB56BoTTjL9pvNEbRVwCKIcWYdNP8l3dpsvVEAZ/ujxmKRA/ToA7ua4/IBDtALFWvg== ;{id = 27845 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 G3I9nIlyTOrn12D8luAgZR4ZTK+iNegzz9UG8b5YsC9IV4UtgbdZkoEDRsH2uu429qvezzlUsjTzR+fu/74Saw== ;{id = 29183 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 fBgVewGRqRmvJUVm/ZQqPLynt1lM6ilPdENMd9uESPh30CzUsi8Q7tbGZoH52CJjpcb17z3zSjJv40ASVEBhNw== ;{id = 30380 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 3LbmoAShX4cKq4qyIqHLI7+UH4/EVOaXCF7AhJHaRJsgbyCEwn4Ofjh6l15Pxbk/UH851tR8MBaaOz8+ROcL2A== ;{id = 31753 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 xMfArWljU25/0ePkuncQHH8U+/NMLIqy3IpJ7IqcOKRXmR7hrY2dQ6MgBN1rUBW8Q7Uq3mFbozdJbr3oDeZcdQ== ;{id = 32621 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 YsXykW60iTTY+1DY7CG9izDd+RAzx+oPUk2UBiHBPengMUmu3R9rgsJHYfjwWgYWB60sy0CPcdAeu+jD2tB4eA== ;{id = 33127 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 wzS1uBaSWR+bTTYgtLm3jNxNnLSNv6abvnHABXQD5yDFs17rGqDCdvkk6JM3qI4BJ+npNLdADJZt118PWlQ7eQ== ;{id = 37404 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 9nDuSJ9wRTsvFYubQ7KQyOmzlY+UzG1cESD8NK9eOj9VMX1O71d5GxBwzc4UtBs+kZBi49BLjZIV5qWbD9FbXQ== ;{id = 38693 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 EFDgOhEi43zsVaJdytsq3HjtAh6dVDaAnR0PY7O0S4q/svucxOVxmJsG/2rXYMHTej9jRTg/qWWbW4gdReDoSQ== ;{id = 40580 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 wq8UI3DydI9svWJEQ1G0JHGVHykgo3YXFF8CRG055gshZAVyfIiTRwCemG0mbziuobOeZSpCtK05KGp20NHRTA== ;{id = 43985 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 wRMENWFMd+9c4p9agfd/3qLnum1SS555CP9lgJKtU0t7Q689SrAUwBJP7ymXTDGtWSjlFBzbts6SUARX47SK1Q== ;{id = 44725 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 zeWh2eFjuwp9K9yaJq16XMVNC8Ys0TOk91eYkGa0Dgez59aG/PvPYV1qi9pxbmG/c4tuXcRV9Z9cxcVev9DdYw== ;{id = 44975 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 O/y794Mc/kIwRltqnqj+puIS1ejFQeE9Xmjz1NVU82x+UyEvx2InNpwaU2TFNKaT7aned72CE1u//CahV6zeEg== ;{id = 49819 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 edr2Ai2uObWeVfFjvCF01Xa9SQD706baatsttcUuI4MblMTNG4blOSN1pMpZJ/wymkqt4c7eQSCETlD/mPeWPQ== ;{id = 56088 (ksk), size = 256b}
+sub3.example.com.	IN	DNSKEY	257 3 13 PlfsudScPXH3VdDVv6nnuBEXQpP6coF6F2w99u4Es5VbJHZrgFhvxL9os0jnfiGCL6VJ0Q+bNKnzfoP3ByP1Kg== ;{id = 58926 (ksk), size = 256b}
+sub3.example.com.	3600	IN	RRSIG	DNSKEY 13 3 3600 20070926134150 20070829134150 20 sub3.example.com. bHMk1YyEhCSaG4zvIeEyy0CKrMVKx+LctpKLCGWhfFGmItIlEdsT/GPwpWUPrTpp990tSSzUFvxkRc+unavAVA==
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub3.example.com. IN A
+SECTION ANSWER
+www.sub3.example.com. IN A	10.20.30.43
+; invalid signatures, with wrong keytag.
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 22 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 23 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 24 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 25 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 26 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 27 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 28 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 29 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 30 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 31 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 32 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 33 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 34 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 35 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 36 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 37 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 38 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 39 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 40 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 41 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 42 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 43 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 44 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 45 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+
+; valid signature.
+www.sub3.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 20 sub3.example.com. mqnO7+cyQw79Lt+TwcZhvt5ybNidAjIaap2/NuNnYZeJhluveSoiwzyT+vvLLluD97nuGHym6+d4vrdFLaFYFw==
+
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+
+; sub1.example.com.
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub1.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ednsdata
+REPLY QR RD RA DO SERVFAIL
+SECTION QUESTION
+www.sub1.example.com. IN A
+SECTION ANSWER
+;www.sub1.example.com. IN A	10.20.30.41
+SECTION ADDITIONAL
+HEX_EDNSDATA_BEGIN
+; EDE: DNSSEC Bogus "validation failure <www.sub1.example.com. A IN>: DS verify has too many tag matches from 1.2.3.5 for key sub1.example.com. while building chain of trust"
+000F009A000676616C69646174696F6E206661696C757265203C7777772E737562312E
+6578616D706C652E636F6D2E204120494E3E3A20445320766572696679206861732074
+6F6F206D616E7920746167206D6174636865732066726F6D20312E322E332E3520666F
+72206B657920737562312E6578616D706C652E636F6D2E207768696C65206275696C64
+696E6720636861696E206F66207472757374
+HEX_EDNSDATA_END
+ENTRY_END
+
+; sub2.example.com.
+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub2.example.com. IN A
+ENTRY_END
+
+STEP 50 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ede=6
+;ednsdata
+REPLY QR RD RA DO SERVFAIL
+SECTION QUESTION
+www.sub2.example.com. IN A
+SECTION ANSWER
+;www.sub2.example.com. IN A	10.20.30.42
+;www.sub2.example.com.	3600	IN	RRSIG	A 13 4 3600 20070926134150 20070829134150 20 sub2.example.com. VCy6Ggk2HZ+fQ8Bube9UIVDXfF6iWo6Gm5MFRVikWdgqTNizrP5F/z2HzgYFPd+K9WNzsWbi4n+9m4sgYRHAnA==
+SECTION ADDITIONAL
+;HEX_EDNSDATA_BEGIN
+;; EDE: DNSSEC Bogus "validation failure <www.sub2.example.com. A IN>: DS verify has too many DNSKEY to RRSIG tag matches from 1.2.3.6 for key sub2.example.com. while building chain of trust"
+;000F00AA000676616C69646174696F6E206661696C757265203C7777772E737562322E
+;6578616D706C652E636F6D2E204120494E3E3A20445320766572696679206861732074
+;6F6F206D616E7920444E534B455920746F20525253494720746167206D617463686573
+;2066726F6D20312E322E332E3620666F72206B657920737562322E6578616D706C652E
+;636F6D2E207768696C65206275696C64696E6720636861696E206F66207472757374
+;HEX_EDNSDATA_END
+ENTRY_END
+
+; sub3.example.com.
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub3.example.com. IN A
+ENTRY_END
+
+STEP 70 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ede=9
+;ednsdata
+REPLY QR RD RA DO SERVFAIL
+SECTION QUESTION
+www.sub3.example.com. IN A
+SECTION ANSWER
+;www.sub3.example.com. IN A	10.20.30.43
+SECTION ADDITIONAL
+;HEX_EDNSDATA_BEGIN
+;; EDE: DNSSEC Bogus "validation failure <www.sub3.example.com. A IN>: too many tag matches from 1.2.3.7"
+;000F0054000676616C69646174696F6E206661696C757265203C7777772E737562332E
+;6578616D706C652E636F6D2E204120494E3E3A20746F6F206D616E7920746167206D61
+;74636865732066726F6D20312E322E332E37
+;HEX_EDNSDATA_END
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,82 @@
+; config options
+server:
+	; This is the test key 29332 in the testdata.
+	trust-anchor: ". 3600 IN DS 29332 8 2 b75e26316631b6e37cbc977323a08769f86e36a10fee888676d35f61e2ff4181"
+	val-override-date: "20201020135527"
+	target-fetch-policy: "0 0 0 0 0"
+	qname-minimisation: no
+	fake-sha1: yes
+	trust-anchor-signaling: no
+	minimal-responses: no
+	log-servfail: yes
+
+forward-zone:
+	name: "."
+	forward-addr: 10.5.5.5
+CONFIG_END
+
+SCENARIO_BEGIN Test nxdomain that gets unsigned response
+; and the DS lookup that it makes gets an NSEC NXDOMAIN response.
+
+; 10.5.5.5 forwarder
+RANGE_BEGIN 0 100
+	ADDRESS 10.5.5.5
+
+; unsigned NXDOMAIN response, from the first forwarder, here it is served
+; from the upstream.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NXDOMAIN
+SECTION QUESTION
+example.veryinvalid. IN TXT
+SECTION AUTHORITY
+. 3600 IN SOA ns.root. host.root. 1 3600 3600 3600 3600
+ENTRY_END
+
+; DNSKEY answer, using CSK for test simplicity.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN DNSKEY
+SECTION ANSWER
+.       IN      DNSKEY  257 3 8 AwEAAb4WMOTBLTFvmBra5m6SK4VfViOzmvyUAU0qv861ZQXeEFvwlndqNU9rwRsMxrSWAYs5nHErKDn49usC/HyxxW1477iGFHhfgL4mjNreJm9zft2QFB1VLbRbEPYdDMLCn4co0qnG7/KG8W2i8Pym1L7f+aREwbLo+/716AS2PbaKMhfWLKLiq5wnBcUClQMNzCiwhqxDJp1oePqfkVdeUgXOtgi0dYRIKyQFhJ5VWJ22npoi/Gif0XLCADAlAwRLKc8o/yJkCxskzgpHpw5Cki1lclg0aq4ssOuPRQ+ne6IHYCz9D2mwzulblhLFamKdq7aHzNt4NlyxhpANVFiKLD8= ;{id = 29332 (ksk), size = 2048b}
+.	3600	IN	RRSIG	DNSKEY 8 0 3600 20201116135527 20201019135527 29332 . ToK8hJrGa+kNu6y8FpRwZq2FjDPBAk5Ctchia3Vu9yTth2dR7BhK2ALTWVBwAQGwiwxXKoVK9QCxdQM0ti7CVb9x75bejkd2E6UGWVmqyTRPpn3D43qYARm87y3ZVKG7LlWHp8UOf21XLp1H7R+wuipIvBJ1XA+QGXThPdbV9EEz1kKGdprBfdpFkQdcAiuYYrOTa5cJ11z32mGiQ12fWjpb4UUbfcoDD9YOoa/S5a6h7jYBOfm75ZB8UCW3Z/SlsN8KIfYZsg5CZphpf38XH5uNLMmzpaWYhfamJZJve9Isx4eILNmdMLK4E8ESwDFCVNzMIqdf20VRg6Lh7nwQeA==
+ENTRY_END
+
+; answer for DS, from another forwarder, here returned from the test upstream.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NXDOMAIN
+SECTION QUESTION
+veryinvalid. IN DS
+SECTION AUTHORITY
+versicherung.	3600	IN	NSEC	vet. NS DS RRSIG NSEC
+versicherung.	3600	IN	RRSIG	NSEC 8 1 3600 20201116135527 20201019135527 29332 . AVAON9Y7AVwX9YWQK8JPcB6Wk/tEfQT7JrLiCRlBBQA0+mpVYYYtMyrm4aMjkhusqYcnpIZoLGOI/dxJjIwDgnMkd4EqY2oICea3I260f8z2v9e7zNobyUTjkoWsmLPc7VRLtEGKu1XyVpt7DX6ElGoSUhU4JsTx7wkkXU0SGAakL0bhK8K68B92NEVwgKX4D7+kVfpjc0aHaB3rAkhQCM/G0jEFp0RuhTX1aru6IuYrZmjW0dvQ2niec6NaYzvuGnbhMLlFLuXqSmI2B7uIFx894usd1cVWnSRg49bAkuiEv5q04ltRel1huJBGGiZlLEwanS5g53C5DHfq10OUrw==
+.	3600	IN	NSEC	aaa. NS SOA RRSIG NSEC DNSKEY ZONEMD
+.	3600	IN	RRSIG	NSEC 8 0 3600 20201116135527 20201019135527 29332 . E8r6rpFgFBUda2GnFSMzHZLtjy1dT+ZS0wPRE12RNwVK547bo2vByv9EFhOHS6sEIFqX+AmIJotuiEPKnCFUTr6FKscaxtw38dJRZ3wldqV6dmqUiRmz91crDCV5nSL45FIbkWKk1Q+tnXie3sZ4zwBc12kGg2BttMAQ0i4sbMbf6EUNYZGwYzSB0/VhXVJcl8gl+5lfpiVqfWNZI7vTEaHqrC2gBC3UK1cQE9lQOqhJ6H5ThA1FR9j/mZFM9sG5vQ2Mqlzl2iiN2Y6mCptDY1vwfff6AnT0YeDwJ/XwGisMZrSvTCYaiRndb8CUUmCr23AFy5OER1rmeFGkHX5+WQ==
+.	3600	IN	SOA	ns.root. host.root. 1 3600 3600 3600 3600
+.	3600	IN	RRSIG	SOA 8 0 3600 20201116135527 20201019135527 29332 . tVeReLMXPnl6rk4QX94xy9lCodQ+xc39lokbNkvbXnTURNCOAwtNiMMPlAAJ3/HTpIxo175gPfupACIveBtgajdp85jUIvLMOM5B6lX80+dUPBGZ4gHVjf+8EGnr7q2wnW2+KcJu0OhN2g+YqCV6aPi8pzuAp+AMsBYcMfXqEQq9Lxqv6TL50MUCJN3GPCyBIdjbs/A+ZB7D1EOO1YgdbsMHK/pWKYt4UfBFfekoA6joIGf4vBKKRTWnoo0BcrFob3AW1SyJkoxoqEsN3YAVL9jNkJCkU0/adLypHgDNayLgsWI5/o4Ng8LxN6tNxAilkMhcGY80T5g0uo+ukY7McA==
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+example.veryinvalid. IN TXT
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA DO SERVFAIL
+SECTION QUESTION
+example.veryinvalid. IN TXT
+SECTION ANSWER
+ENTRY_END
+
+SCENARIO_END
@@ -252,6 +252,7 @@ config_create(void)
 	cfg->harden_referral_path = 0;
 	cfg->harden_algo_downgrade = 0;
 	cfg->harden_unknown_additional = 0;
+	cfg->harden_cname_follow = 1;
 	cfg->use_caps_bits_for_id = 0;
 	cfg->caps_whitelist = NULL;
 	cfg->private_address = NULL;
@@ -739,6 +740,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_YNO("harden-referral-path:", harden_referral_path)
 	else S_YNO("harden-algo-downgrade:", harden_algo_downgrade)
 	else S_YNO("harden-unknown-additional:", harden_unknown_additional)
+	else S_YNO("harden-cname-follow:", harden_cname_follow)
 	else S_YNO("use-caps-for-id:", use_caps_bits_for_id)
 	else S_STRLIST("caps-whitelist:", caps_whitelist)
 	else S_SIZET_OR_ZERO("unwanted-reply-threshold:", unwanted_threshold)
@@ -1244,6 +1246,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "harden-referral-path", harden_referral_path)
 	else O_YNO(opt, "harden-algo-downgrade", harden_algo_downgrade)
 	else O_YNO(opt, "harden-unknown-additional", harden_unknown_additional)
+	else O_YNO(opt, "harden-cname-follow", harden_cname_follow)
 	else O_YNO(opt, "use-caps-for-id", use_caps_bits_for_id)
 	else O_LST(opt, "caps-whitelist", caps_whitelist)
 	else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold)
@@ -3093,3 +3096,40 @@ file_get_mtime(const char* file, time_t* mtime, long* ns, int* nonexist)
 #endif
 	return 1;
 }
+
+int cfg_local_zone_type_value_check(const char* str)
+{
+	if(strcmp(str, "static")!=0 && strcmp(str, "deny")!=0 &&
+	   strcmp(str, "refuse")!=0 && strcmp(str, "redirect")!=0 &&
+	   strcmp(str, "transparent")!=0 && strcmp(str, "nodefault")!=0
+	   && strcmp(str, "typetransparent")!=0
+	   && strcmp(str, "always_transparent")!=0
+	   && strcmp(str, "block_a")!=0
+	   && strcmp(str, "block_aaaa")!=0
+	   && strcmp(str, "block_a_wdata")!=0
+	   && strcmp(str, "block_aaaa_wdata")!=0
+	   && strcmp(str, "always_refuse")!=0
+	   && strcmp(str, "always_nxdomain")!=0
+	   && strcmp(str, "always_nodata")!=0
+	   && strcmp(str, "always_deny")!=0
+	   && strcmp(str, "always_null")!=0
+	   && strcmp(str, "noview")!=0
+	   && strcmp(str, "inform")!=0 && strcmp(str, "inform_deny")!=0
+	   && strcmp(str, "inform_redirect") != 0
+	   && strcmp(str, "ipset") != 0)
+		return 0;
+	return 1;
+}
+
+const char* cfg_local_zone_type_list(void)
+{
+	return "static, deny, "
+		"refuse, redirect, transparent, "
+		"typetransparent, inform, inform_deny, "
+		"inform_redirect, always_transparent, "
+		"block_a, block_aaaa, "
+		"block_a_wdata, block_aaaa_wdata, "
+		"always_refuse, always_nxdomain, "
+		"always_nodata, always_deny, always_null, "
+		"noview, nodefault or ipset";
+}
@@ -311,6 +311,8 @@ struct config_file {
 	/** harden against unknown records in the authority section and in
 	 * the additional section */
 	int harden_unknown_additional;
+	/** harden to follow cname redirections */
+	int harden_cname_follow;
 	/** use 0x20 bits in query as random ID bits */
 	int use_caps_bits_for_id;
 	/** 0x20 whitelist, domains that do not use capsforid */
@@ -1521,4 +1523,10 @@ void cfg_tls_protocols_allowed(const char* tls_protocols, int* allow12, int* all
 /** get the file mtime stat (or error, with errno and nonexist) */
 int file_get_mtime(const char* file, time_t* mtime, long* ns, int* nonexist);

+/** check local-zone type for correctness */
+int cfg_local_zone_type_value_check(const char* str);
+
+/** the list of local-zone types, for error printout. */
+const char* cfg_local_zone_type_list(void);
+
 #endif /* UTIL_CONFIG_FILE_H */
@@ -323,6 +323,7 @@ harden-below-nxdomain{COLON}	{ YDVAR(1, VAR_HARDEN_BELOW_NXDOMAIN) }
 harden-referral-path{COLON}	{ YDVAR(1, VAR_HARDEN_REFERRAL_PATH) }
 harden-algo-downgrade{COLON}	{ YDVAR(1, VAR_HARDEN_ALGO_DOWNGRADE) }
 harden-unknown-additional{COLON}	{ YDVAR(1, VAR_HARDEN_UNKNOWN_ADDITIONAL) }
+harden-cname-follow{COLON}	{ YDVAR(1, VAR_HARDEN_CNAME_FOLLOW) }
 use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 caps-whitelist{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
 caps-exempt{COLON}		{ YDVAR(1, VAR_CAPS_WHITELIST) }
@@ -220,6 +220,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_MAX_GLOBAL_QUOTA VAR_HARDEN_UNVERIFIED_GLUE VAR_LOG_TIME_ISO
 %token VAR_VAL_VALIDATION_ATTEMPTS VAR_VAL_HASH_ATTEMPTS
 %token VAR_ITER_SCRUB_PROMISCUOUS VAR_LOG_THREAD_ID
+%token VAR_HARDEN_CNAME_FOLLOW

 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -363,7 +364,8 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_iter_scrub_ns | server_iter_scrub_cname | server_max_global_quota |
 	server_val_validation_attempts |
 	server_val_hash_attempts | server_iter_scrub_rrsig |
-	server_harden_unverified_glue | server_log_time_iso | server_iter_scrub_promiscuous
+	server_harden_unverified_glue | server_log_time_iso | server_iter_scrub_promiscuous |
+	server_harden_cname_follow
 	;
 stub_clause: stubstart contents_stub
 	{
@@ -1949,6 +1951,16 @@ server_harden_unknown_additional: VAR_HARDEN_UNKNOWN_ADDITIONAL STRING_ARG
 		free($2);
 	}
 	;
+server_harden_cname_follow: VAR_HARDEN_CNAME_FOLLOW STRING_ARG
+	{
+		OUTYY(("P(server_harden_cname_follow:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->harden_cname_follow =
+			(strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_use_caps_for_id: VAR_USE_CAPS_FOR_ID STRING_ARG
 	{
 		OUTYY(("P(server_use_caps_for_id:%s)\n", $2));
@@ -2391,33 +2403,9 @@ server_neg_cache_size: VAR_NEG_CACHE_SIZE STRING_ARG
 server_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 	{
 		OUTYY(("P(server_local_zone:%s %s)\n", $2, $3));
-		if(strcmp($3, "static")!=0 && strcmp($3, "deny")!=0 &&
-		   strcmp($3, "refuse")!=0 && strcmp($3, "redirect")!=0 &&
-		   strcmp($3, "transparent")!=0 && strcmp($3, "nodefault")!=0
-		   && strcmp($3, "typetransparent")!=0
-		   && strcmp($3, "always_transparent")!=0
-		   && strcmp($3, "block_a")!=0
-		   && strcmp($3, "block_aaaa")!=0
-		   && strcmp($3, "block_a_wdata")!=0
-		   && strcmp($3, "block_aaaa_wdata")!=0
-		   && strcmp($3, "always_refuse")!=0
-		   && strcmp($3, "always_nxdomain")!=0
-		   && strcmp($3, "always_nodata")!=0
-		   && strcmp($3, "always_deny")!=0
-		   && strcmp($3, "always_null")!=0
-		   && strcmp($3, "noview")!=0
-		   && strcmp($3, "inform")!=0 && strcmp($3, "inform_deny")!=0
-		   && strcmp($3, "inform_redirect") != 0
-		   && strcmp($3, "ipset") != 0) {
-			yyerror("local-zone type: expected static, deny, "
-				"refuse, redirect, transparent, "
-				"typetransparent, inform, inform_deny, "
-				"inform_redirect, always_transparent, "
-				"block_a, block_aaaa, "
-				"block_a_wdata, block_aaaa_wdata, "
-				"always_refuse, always_nxdomain, "
-				"always_nodata, always_deny, always_null, "
-				"noview, nodefault or ipset");
+		if(!cfg_local_zone_type_value_check($3)) {
+			ub_c_error_msg("local-zone type: expected %s",
+				cfg_local_zone_type_list());
 			free($2);
 			free($3);
 		} else if(strcmp($3, "nodefault")==0) {
@@ -3383,27 +3371,9 @@ view_name: VAR_NAME STRING_ARG
 view_local_zone: VAR_LOCAL_ZONE STRING_ARG STRING_ARG
 	{
 		OUTYY(("P(view_local_zone:%s %s)\n", $2, $3));
-		if(strcmp($3, "static")!=0 && strcmp($3, "deny")!=0 &&
-		   strcmp($3, "refuse")!=0 && strcmp($3, "redirect")!=0 &&
-		   strcmp($3, "transparent")!=0 && strcmp($3, "nodefault")!=0
-		   && strcmp($3, "typetransparent")!=0
-		   && strcmp($3, "always_transparent")!=0
-		   && strcmp($3, "always_refuse")!=0
-		   && strcmp($3, "always_nxdomain")!=0
-		   && strcmp($3, "always_nodata")!=0
-		   && strcmp($3, "always_deny")!=0
-		   && strcmp($3, "always_null")!=0
-		   && strcmp($3, "noview")!=0
-		   && strcmp($3, "inform")!=0 && strcmp($3, "inform_deny")!=0
-		   && strcmp($3, "inform_redirect") != 0
-		   && strcmp($3, "ipset") != 0) {
-			yyerror("local-zone type: expected static, deny, "
-				"refuse, redirect, transparent, "
-				"typetransparent, inform, inform_deny, "
-				"inform_redirect, always_transparent, "
-				"always_refuse, always_nxdomain, "
-				"always_nodata, always_deny, always_null, "
-				"noview, nodefault or ipset");
+		if(!cfg_local_zone_type_value_check($3)) {
+			ub_c_error_msg("local-zone type: expected %s",
+				cfg_local_zone_type_list());
 			free($2);
 			free($3);
 		} else if(strcmp($3, "nodefault")==0) {
@@ -1166,6 +1166,12 @@ extended_error_encode(sldns_buffer* buf, uint16_t rcode,
 			edns_opt_list_remove(&es.opt_list_inplace_cb_out, LDNS_EDNS_EDE);
 			edns_opt_list_remove(&es.opt_list_out, LDNS_EDNS_EDE);
 			attach_edns_record_max_msg_sz(buf, &es, edns->udp_size);
+		} else {
+			LDNS_TC_SET(sldns_buffer_begin(buf));
+			if(es.ext_rcode != 0) {
+				LDNS_RCODE_SET(sldns_buffer_begin(buf),
+					LDNS_RCODE_SERVFAIL);
+			}
 		}
 	}
 }
@@ -974,7 +974,6 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
 	}

 	/* while still more options, and have code+len to read */
-	/* ignores partial content (i.e. rdata len 3) */
 	while(rdata_len >= 4 && i < MAX_PARSED_EDNS_OPTIONS) {
 		uint16_t opt_code = sldns_read_uint16(rdata_ptr);
 		uint16_t opt_len = sldns_read_uint16(rdata_ptr+2);
@@ -984,8 +983,10 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,

 		rdata_ptr += 4;
 		rdata_len -= 4;
-		if(opt_len > rdata_len)
-			break; /* option code partial */
+		if(opt_len > rdata_len) {
+			/* option code partial */
+			return LDNS_RCODE_FORMERR;
+		}

 		/* handle parse time edns options here */
 		switch(opt_code) {
@@ -1160,6 +1161,9 @@ parse_edns_options_from_query(uint8_t* rdata_ptr, size_t rdata_len,
 		rdata_len -= opt_len;
 		i++;
 	}
+	/* partial content (i.e. rdata len 3) is FORMERR */
+	if(rdata_len > 0 && rdata_len <= 3)
+		return LDNS_RCODE_FORMERR;
 	return LDNS_RCODE_NOERROR;
 }

@@ -1240,6 +1244,8 @@ parse_extract_edns_from_response_msg(struct msg_parse* msg,
 		rdata_len -= 4;
 		if(opt_len > rdata_len)
 			break; /* option code partial */
+			/* This is lenient for partially broken messages
+			 * from upstream. With a partial EDNS option. */

 		if(!edns_opt_list_append(&edns->opt_list_in,
 				opt_code, opt_len, rdata_ptr, region)) {
@@ -280,7 +280,9 @@ int packed_rr_to_string(struct ub_packed_rrset_key* rrset, size_t i,
 	size_t rlen = rrset->rk.dname_len + 2 + 2 + 4 + d->rr_len[i];
 	time_t adjust = 0;
 	log_assert(dest_len > 0 && dest);
-	if(rlen > dest_len) {
+	/* rlen is the length written into rr, dest_len bounds the output
+	 * string; check both, callers can pass a dest_len over sizeof(rr). */
+	if(rlen > dest_len || rlen > sizeof(rr)) {
 		dest[0] = 0;
 		return 0;
 	}
@@ -72,6 +72,14 @@ static ub_thread_key_type logkey;
 #ifndef THREADS_DISABLED
 /** pthread mutex to protect FILE* */
 static lock_basic_type log_lock;
+#ifdef HAVE_PTHREAD
+/* Guards the one-time initialization below. Without this, two threads
+ * calling log_init() for the first time concurrently (e.g. via
+ * ub_ctx_create() from a multi-threaded application) can both observe
+ * key_created==0 and both call lock_basic_init(&log_lock), a data race
+ * that reinitializes/corrupts an in-use mutex. */
+static pthread_once_t log_lock_once = PTHREAD_ONCE_INIT;
+#endif
 #endif
 /** the identity of this executable/process */
 static const char* ident="unbound";
@@ -85,15 +93,28 @@ static int log_time_asc = 0;
 /** print time in iso format */
 static int log_time_iso = 0;

+#if !defined(THREADS_DISABLED) && defined(HAVE_PTHREAD)
+static void log_lock_init_once(void)
+{
+	ub_thread_key_create(&logkey, NULL);
+	lock_basic_init(&log_lock);
+	key_created = 1;
+}
+#endif
+
 void
 log_init(const char* filename, int use_syslog, const char* chrootdir)
 {
 	FILE *f;
+#if !defined(THREADS_DISABLED) && defined(HAVE_PTHREAD)
+	(void)pthread_once(&log_lock_once, log_lock_init_once);
+#else
 	if(!key_created) {
 		key_created = 1;
 		ub_thread_key_create(&logkey, NULL);
 		lock_basic_init(&log_lock);
 	}
+#endif
 	lock_basic_lock(&log_lock);
 	if(logfile 
 #if defined(HAVE_SYSLOG_H) || defined(UB_ON_WINDOWS)
@@ -7121,8 +7121,12 @@ comm_timer_disable(struct comm_timer* timer)
 {
 	if(!timer)
 		return;
-	ub_timer_del(timer->ev_timer->ev);
-	timer->ev_timer->enabled = 0;
+	/* The event backend can not always deal with event del if it was not
+	 * added before. For that, there is a check if it was added here.*/
+	if(timer->ev_timer->enabled) {
+		ub_timer_del(timer->ev_timer->ev);
+		timer->ev_timer->enabled = 0;
+	}
 }

 void
@@ -1275,9 +1275,9 @@ void autr_write_file(struct module_env* env, struct trust_anchor* tp)
 	FlushFileBuffers((HANDLE)_get_osfhandle(_fileno(out)));
 #endif
 	if(fclose(out) != 0) {
+		unlink(tempf);
 		fatal_exit("could not complete write: %s: %s",
 			fname, strerror(errno));
-		unlink(tempf);
 		return;
 	}
 	/* success; overwrite actual file */
@@ -829,8 +829,9 @@ anchor_read_bind_file_wild(struct val_anchors* anchors, sldns_buffer* buffer,
 	if(r) {
 		/* some error */
 		if(r == GLOB_NOMATCH) {
-			verbose(VERB_QUERY, "trusted-keys-file: "
-				"no matches for %s", pat);
+			verbose(VERB_OPS, "trusted-keys-file: "
+				"no matches for %s; "
+				"no trust anchors loaded from it", pat);
 			return 1;
 		} else if(r == GLOB_NOSPACE) {
 			log_err("wildcard trusted-keys-file %s: "
@@ -42,12 +42,6 @@
 * from cached NSEC records.
 */
 #include "config.h"
-#ifdef HAVE_OPENSSL_SSL_H
-#include <openssl/ssl.h>
-#define NSEC3_SHA_LEN SHA_DIGEST_LENGTH
-#else
-#define NSEC3_SHA_LEN 20
-#endif
 #include "validator/val_neg.h"
 #include "validator/val_nsec.h"
 #include "validator/val_nsec3.h"
@@ -694,6 +688,8 @@ static void wipeout(struct val_neg_cache* neg, struct val_neg_zone* zone,
 	if(ntohs(nsec->rk.type) == LDNS_RR_TYPE_NSEC) {
 		end = d->rr_data[0]+2;
 		end_len = dname_valid(end, d->rr_len[0]-2);
+		if(!end_len)
+			return;
 		end_labs = dname_count_labels(end);
 	} else {
 		/* NSEC3 */
@@ -265,6 +265,8 @@ size_t nsec3_hash_to_b32(uint8_t* hash, size_t hashlen, uint8_t* zone,
 	ret = sldns_b32_ntop_extended_hex(hash, hashlen, (char*)buf+1, max-1);
 	if(ret < 1) 
 		return 0;
+	if(ret > LDNS_MAX_LABELLEN)
+		return 0; /* label length too long */
 	buf[0] = (uint8_t)ret; /* length of b32 label */
 	ret++;
 	if(max - ret < zonelen)
@@ -273,13 +275,30 @@ size_t nsec3_hash_to_b32(uint8_t* hash, size_t hashlen, uint8_t* zone,
 	return zonelen+(size_t)ret;
 }

+/** Check that the hash length corresponds to the nsec3 algo */
+static int
+nsec3_algo_has_hashlen(int algo, size_t hlen)
+{
+	if(algo == NSEC3_HASH_SHA1) {
+		if(hlen != NSEC3_SHA_LEN)
+			return 0; /* wrong hash length for this algo */
+	} else {
+		return 0; /* unknown algo */
+	}
+	return 1;
+}
+
 size_t nsec3_get_nextowner_b32(struct ub_packed_rrset_key* rrset, int r,
 	uint8_t* buf, size_t max)
 {
 	uint8_t* nm, *zone;
 	size_t nmlen, zonelen;
+	int algo;
 	if(!nsec3_get_nextowner(rrset, r, &nm, &nmlen))
 		return 0;
+	algo = nsec3_get_algo(rrset, r);
+	if(!nsec3_algo_has_hashlen(algo, nmlen))
+		return 0; /* wrong hash length for this algo */
 	/* append zone name; the owner name must be <b32>.zone */
 	zone = rrset->rk.dname;
 	zonelen = rrset->rk.dname_len;
@@ -105,6 +105,9 @@ struct val_qstate;
 */
 #define MAX_NSEC3_CALCULATIONS 8

+/** Length of the hash in bytes for the NSEC3 algorithm SHA1 */
+#define NSEC3_SHA_LEN 20
+
 /**
 * Cache table for NSEC3 hashes.
 * It keeps a *pointer* to the region its items are allocated.
@@ -1390,6 +1390,20 @@ int val_has_signed_nsecs(struct reply_info* rep, char** reason)
 	return 0;
 }

+void val_has_auth_nsecs(struct reply_info* rep, int* has_nsec, int* has_nsec3)
+{
+	size_t i, num_nsec = 0, num_nsec3 = 0;
+	for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
+		if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC))
+			num_nsec++;
+		else if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NSEC3))
+			num_nsec3++;
+		else continue;
+	}
+	*has_nsec = (num_nsec != 0);
+	*has_nsec3 = (num_nsec3 != 0);
+}
+
 struct dns_msg* 
 val_find_DS(struct module_env* env, uint8_t* nm, size_t nmlen, uint16_t c, 
 	struct regional* region, uint8_t* topname)
@@ -421,6 +421,14 @@ void val_blacklist(struct sock_list** blacklist, struct regional* region,
 */
 int val_has_signed_nsecs(struct reply_info* rep, char** reason);

+/**
+ * See if there are NSECs, or NSEC3s in the authority section.
+ * @param rep: reply to check
+ * @param has_nsec: returned true if it has nsecs.
+ * @param has_nsec3: returned true if it has nsec3s.
+ */
+void val_has_auth_nsecs(struct reply_info* rep, int* has_nsec, int* has_nsec3);
+
 /**
 * Return algo number for favorite (best) algorithm that we support in DS.
 * @param ds_rrset: the DSes in this rrset are inspected and best algo chosen.
@@ -3146,6 +3146,7 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
 			case sec_status_unchecked:
 			default:
 				/* NSEC proof did not work, try next */
+				verbose(VERB_ALGO, "NSEC proof did not prove insecure delegation, try NSEC3");
 				break;
 		}

@@ -3181,6 +3182,25 @@ ds_response_to_ke(struct module_qstate* qstate, struct val_qstate* vq,
 				*ke = NULL;
 				return 0;
 			case sec_status_bogus:
+				/* It could be that the NSEC proof failed,
+				 * and, then tried NSEC3. */
+				{
+					int has_nsec=0, has_nsec3=0;
+					val_has_auth_nsecs(msg->rep, &has_nsec,
+						&has_nsec3);
+					if(!has_nsec3 && has_nsec) {
+						/* The NSECs are the cause, mention that in the error message. */
+						verbose(VERB_DETAIL, "NSECs for the "
+							"referral did not prove no DS.");
+						errinf_ede(qstate, "NSECs for the referral did not prove no DS", LDNS_EDE_DNSSEC_BOGUS);
+						goto return_bogus;
+					}
+					if(!has_nsec3 && !has_nsec) {
+						verbose(VERB_DETAIL, "absence of NSECs and NSEC3s when attempting to prove no DS.");
+						errinf_ede(qstate, "no NSECs or NSEC3s when attempting to prove no DS", LDNS_EDE_DNSSEC_BOGUS);
+						goto return_bogus;
+					}
+				}
 				verbose(VERB_DETAIL, "NSEC3s for the "
 					"referral did not prove no DS.");
 				errinf_ede(qstate, reason, reason_bogus);
Author	SHA1	Message	Date
Yorgos Thessalonikefs	65814ad6f3	Changelog entry for #1510 : - Merge #1510 from Andy Warner: Move unlink of temp file to before fatal exit.	2026-09-21 14:13:00 +02:00
Yorgos ThessalonikefsandGitHub	97d6cc3643	Merge pull request #1510 from aww-aww/patch-1 Move unlink of temp file to before fatal exit	2026-09-21 14:08:55 +02:00
Andy WarnerandGitHub	e79365ec61	Move unlink of temp file to before fatal exit Ensure temporary file is deleted only on failure. As written this would never be executed.	2026-09-21 03:51:24 -06:00
W.C.A. Wijngaards	a7fc80d8c5	- Unit test for CVE-2026-85501.	2026-09-16 10:47:44 +02:00
W.C.A. Wijngaards	5d89e0c2a7	- Unit test for CVE-2026-82717.	2026-09-16 10:44:49 +02:00
W.C.A. Wijngaards	b45c8b4b53	- The code repository continues with 1.26.2 under development, that includes the changes from before the 1.26.1 commits.	2026-09-16 10:34:06 +02:00
W.C.A. Wijngaards	a6586ced92	Merge branch 'branch-1.26.1'	2026-09-16 10:26:54 +02:00
W.C.A. Wijngaards	3ad9b6aade	- For #1507 : TOCTOU race in store_rrsets() can return a CNAME chain whose target owns no address.	2026-09-15 13:03:24 +02:00
W.C.A. Wijngaards	5ccee67af2	- Fix to error on missing close parenthesis for zone file read and for url content read. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-10 16:12:49 +02:00
W.C.A. Wijngaards	b8577a9c04	- Fix to construct the delegation point during DS NS find as a child side delegation point if that was the response. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-10 11:09:39 +02:00
W.C.A. Wijngaards	18d9a5519e	- Fix to elevate the diagnostic for no matches for a wildcard trusted-keys-file, make it more descriptive, and more man page content for it. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-08 16:01:08 +02:00
W.C.A. Wijngaards	2df646e05f	- Fix to not change the action override in rpz_config, before the cname override has succeeded.	2026-09-04 17:20:15 +02:00
W.C.A. Wijngaards	bdfa4d4c5d	- Fix to make rpz_config leave the rpz with correct set up on failure. The struct is not half configured on exit. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-04 17:06:34 +02:00
W.C.A. Wijngaards	bd210d124b	- Fix that when a partial EDNS option is in a query, the response is a more RFC conformant FORMERR, since the EDNS option is malformed. Also fix to have an EDNS size for the reply error encoding for failed EDNS parse of the query. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-03 17:20:35 +02:00
W.C.A. Wijngaards	11900cc2b0	- Fix that when extended EDNS RCODE does not fit, at short udpsize, the reply is truncated with TC and fix for the rcode in that short reply to be a sensible rcode. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-03 15:27:10 +02:00
W.C.A. Wijngaards	c04a5efb07	- Fix to reorder SVCB and HTTPS svcparams for unknown RR form zonefile input. If it can not be parsed it is leniently accepted, much like as a secondary it leniently accepts it. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-03 10:59:08 +02:00
W.C.A. Wijngaards	1060760650	- Remove unused .travis.yml for ci integration.	2026-09-03 10:25:31 +02:00
W.C.A. Wijngaards	f251a1157b	- Remove unused .travis.yml for ci integration.	2026-09-03 10:24:51 +02:00
W.C.A. Wijngaards	292cf6526b	- Fix to match NSEC3 hash length to the NSEC3 algorithm, this stops negative cache overdeletion. It also contrains the hash label length and checks if the NSEC nextowner is valid. Thanks to Yuqi Qiu & Xiang Li (Nankai University, AOSP Lab).	2026-09-03 08:38:46 +02:00
W.C.A. Wijngaards	ac935b9144	- Fix to not commit to have_zone at apply AXFR time for auth zone transfers, so that later failure rolls back to not. The have_zone value is set later when the SOA is retrieved. Also fix to clear the zone data when a transfer does not have a valid SOA record in the zone for it. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-02 11:42:31 +02:00
W.C.A. Wijngaards	9dd370ba04	- Fix LOC RR parse to avoid double to uint32 cast overflow. Thanks to Qifan Zhang, Palo Alto Networks, for the report.	2026-09-01 17:21:45 +02:00
W.C.A. Wijngaards	a6ccb2f74d	- Fix to allow block_a and other local-zone types in a view.	2026-09-01 08:48:27 +02:00
W.C.A. Wijngaards	32ff948a5b	- Fix notify for auth-zone during initial start up. It performs the transfer and not only lookup.	2026-08-26 16:50:33 +02:00
W.C.A. Wijngaards	2ec2afd6b0	- Fix #132 : Add `harden-cname-follow: yes` config option, that can be used to disable cname scrubbing. That can be useful for when the traffic is on localhost only.	2026-08-24 16:06:17 +02:00
W.C.A. Wijngaards	7fb79b0677	- Fix to defend against double event deletion, that could cause event corruption and use after free, for comm_timer_disable.	2026-08-21 10:29:58 +02:00
W.C.A. Wijngaards	8ee0bca833	- Fix stat_values.tdir test to have less test failures.	2026-08-11 10:07:38 +02:00
W.C.A. Wijngaards	c58e6add2b	- Fix #1492 from zacek: Data race in log_init() on key_created/log_lock when calling ub_ctx_create() concurrently from multiple threads.	2026-08-11 09:42:30 +02:00
W.C.A. Wijngaards	93a56205cf	- Fix #1489 from jplesnik: Replace removed Python 2 C API macros for SWIG 4.5.0 compatibility.	2026-08-07 08:57:32 +02:00
W.C.A. Wijngaards	709f622658	Note issue number in Changlog entry.	2026-08-06 17:15:55 +02:00
akhanin-dnsfandGitHub	307fc6f062	- Fix bounds check in packed_rr_to_string, it checked the (#1488 ) assembled rr length against the output string length dest_len, instead of against the size of the rr buffer it writes into. Callers in cachedump.c and remote.c pass a dest_len larger than that buffer. - Unit test for packed_rr_to_string.	2026-08-06 17:04:05 +02:00
W.C.A. Wijngaards	8b33c5d7ff	- Fix #1487 : regression in 1.26.0, ipsecmod is now always partly enabled.	2026-08-06 09:46:18 +02:00
W.C.A. Wijngaards	36bd52afb9	Fix typo in Changelog.	2026-08-06 09:08:33 +02:00
W.C.A. Wijngaards	b7d13ff12b	- Fix ##1485: the list_forwards command omits port numbers. The list_forwards and list_stubs commands for unbound-control print port and tls auth name.	2026-08-06 09:08:17 +02:00
W.C.A. Wijngaards	bdfcfb861f	- Fix to set makedist.sh to not wget config.sub and config.guess from git repo. The fetch times out, and the version from libtoolize is much more recent now than that it was when the wget was added.	2026-08-04 10:04:34 +02:00
W.C.A. Wijngaards	b444deffd2	Note 1.26.0 release.	2026-08-04 10:01:59 +02:00
W.C.A. Wijngaards	ff28b7e5cf	- For #1483 : The failure reason when an NSEC NXDOMAIN is encountered when looking for an insecure delegation, is fixed to mention the NSEC records, instead of nonexistent NSEC3 records, that it attempted.	2026-07-31 09:53:47 +02:00
W.C.A. Wijngaards	79b84bbc91	- Fix #1482 : DNS-over-QUIC doesn't work with simple config. That fixes interface-automatic for use with doq service.	2026-07-30 08:24:42 +02:00
W.C.A. Wijngaards	cbfc3b0342	- Tag for 1.26.0rc1. The repo continues with version 1.26.1.	2026-07-28 09:45:59 +02:00