1.3.3 release.

git-svn-id: file:///svn/unbound/tags/release-1.3.3@1744 be551aaa-1e26-0410-a405-d3ace91eadb9
iana portlist updated.
2026-08-17 21:25:50 +02:00 · 2009-08-04 14:27:42 +00:00 · 2009-08-03 09:04:06 +00:00 · 2009-08-03 08:46:26 +00:00 · 2009-07-27 12:44:50 +00:00 · 2009-07-27 12:35:48 +00:00
99 changed files with 25898 additions and 23758 deletions
@@ -35,6 +35,7 @@ doxygen=@doxygen@
 libtool=@libtool@
 ldnsdir=@ldnsdir@
 staticexe=@staticexe@
+EXEEXT=@EXEEXT@
 configfile=@ub_conf_file@
 UNBOUND_RUN_DIR=@UNBOUND_RUN_DIR@
 CHECKLOCK_SRC=@CHECKLOCK_SRC@
@@ -46,6 +47,7 @@ PYTHON_SITE_PKG=@PYTHON_SITE_PKG@
 SWIG=@SWIG@
 YACC=@YACC@
 LEX=@LEX@
+STRIP=@STRIP@
 CC=@CC@
 CPPFLAGS=-I. @CPPFLAGS@
 ifneq "$(srcdir)" "."
@@ -65,11 +67,11 @@ ifeq "$(QUIET)" "yes"
 endif
 BUILD=build/

-WINDRES=windres
+WINDRES=@WINDRES@
 LINT=splint
 LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list -Dglob64=glob -Dglobfree64=globfree
 # compat with openssl linux edition.
-LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned
+LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray

 INSTALL=$(srcdir)/install-sh
 ifeq "$(WITH_PYTHONMODULE)" "yes"
@@ -82,6 +84,7 @@ COMMON_SRC=$(patsubst $(srcdir)/%,%, $(wildcard $(srcdir)/services/*.c \
 	$(srcdir)/iterator/*.c $(srcdir)/validator/*.c $(PYTHONMOD_SRC))) \
 	util/configparser.c util/configlexer.c $(CHECKLOCK_SRC)
 COMMON_OBJ=$(addprefix $(BUILD),$(COMMON_SRC:.c=.lo))
+COMPAT_SRC=$(addprefix compat/,$(LIBOBJS:.o=.c))
 COMPAT_OBJ=$(addprefix $(BUILD)compat/,$(LIBOBJS:.o=.lo))
 UNITTEST_SRC=$(patsubst $(srcdir)/%,%, \
 	$(wildcard $(srcdir)/testcode/unit*.c)) \
@@ -139,7 +142,8 @@ ifeq "$(UB_ON_WINDOWS)" "yes"
  CONTROL_OBJ+=$(BUILD)winrc/rsrc_unbound_control.o
  CHECKCONF_OBJ+=$(BUILD)winrc/rsrc_unbound_checkconf.o

-  WINAPPS=unbound-service-install unbound-service-remove anchor-update
+  WINAPPS=$(addsuffix $(EXEEXT), unbound-service-install \
+  	unbound-service-remove anchor-update)
  SVCINST_SRC=winrc/unbound-service-install.c winrc/w_inst.c
  SVCINST_OBJ=$(addprefix $(BUILD),$(SVCINST_SRC:.c=.lo)) $(COMPAT_OBJ) \
 	$(BUILD)winrc/rsrc_svcinst.o
@@ -173,10 +177,10 @@ $(BUILD)%.lo:    $(srcdir)/%.c
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(COMPILE) -c $< -o $@

-all:	$(COMMON_OBJ) unbound unbound-checkconf lib unbound-host unbound-control unbound-control-setup $(WINAPPS)
+all:	$(COMMON_OBJ) unbound$(EXEEXT) unbound-checkconf$(EXEEXT) lib unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-control-setup $(WINAPPS)

-TEST_BIN=asynclook delayer harvest lock-verify memstats perf pktview signit \
-	streamtcp testbound unittest
+TEST_BIN=$(addsuffix $(EXEEXT),asynclook delayer harvest lock-verify \
+	memstats perf pktview signit streamtcp testbound unittest)
 tests:	all $(TEST_BIN)

 test:	tests
@@ -190,82 +194,83 @@ libunbound.la:	$(LIBUNBOUND_OBJ)

 ifeq ($(patsubst ldns-src%,ldns-src,$(ldnsdir)),ldns-src)
 ldnslib=$(ldnsdir)/lib/libldns.a
-$(ldnslib):
+$(ldnslib):	$(ldnsdir)/lib
+$(ldnsdir)/lib:
 	@if test ! -z "$(ldnsdir)"; \
 	then (cd $(ldnsdir) && $(MAKE)); fi
 else
 ldnslib=
 endif

-unbound:	$(DAEMON_OBJ) $(ldnslib)
+unbound$(EXEEXT):	$(DAEMON_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(DAEMON_OBJ)) -lssl $(LIBS)

-unbound-checkconf:	$(CHECKCONF_OBJ) $(ldnslib)
+unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(CHECKCONF_OBJ)) $(LIBS)

-unbound-control:	$(CONTROL_OBJ) $(ldnslib)
+unbound-control$(EXEEXT):	$(CONTROL_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(CONTROL_OBJ)) -lssl $(LIBS)

-unbound-host:	$(HOST_OBJ) libunbound.la $(ldnslib)
+unbound-host$(EXEEXT):	$(HOST_OBJ) libunbound.la $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(HOST_OBJ)) -L. -L.libs -lunbound $(LIBS)

-unbound-service-install:	$(SVCINST_OBJ)
+unbound-service-install$(EXEEXT):	$(SVCINST_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SVCINST_OBJ)) $(LIBS)

-unbound-service-remove:	$(SVCUNINST_OBJ)
+unbound-service-remove$(EXEEXT):	$(SVCUNINST_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SVCUNINST_OBJ)) $(LIBS)

-anchor-update:  $(ANCHORUPD_OBJ) libunbound.la $(ldnslib)
+anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ) libunbound.la $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(ANCHORUPD_OBJ)) -L. -L.libs -lunbound $(LIBS)

-unittest:	$(UNITTEST_OBJ) $(ldnslib)
+unittest$(EXEEXT):	$(UNITTEST_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(UNITTEST_OBJ)) $(LIBS)

-testbound:	$(TESTBOUND_OBJ) $(ldnslib)
+testbound$(EXEEXT):	$(TESTBOUND_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(TESTBOUND_OBJ)) -lssl $(LIBS)

-lock-verify:	$(LOCKVERIFY_OBJ) $(ldnslib)
+lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(LOCKVERIFY_OBJ)) $(LIBS)

-pktview:	$(PKTVIEW_OBJ) $(ldnslib)
+pktview$(EXEEXT):	$(PKTVIEW_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PKTVIEW_OBJ)) $(LIBS)

-signit:	$(SIGNIT_OBJ) $(ldnslib)
+signit$(EXEEXT):	$(SIGNIT_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SIGNIT_OBJ)) $(LIBS)

-memstats:	$(MEMSTATS_OBJ) $(ldnslib)
+memstats$(EXEEXT):	$(MEMSTATS_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(MEMSTATS_OBJ)) $(LIBS)

-asynclook:	$(ASYNCLOOK_OBJ) $(ldnslib) libunbound.la
+asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ) $(ldnslib) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(ASYNCLOOK_OBJ)) $(LIBS) -L. -L.libs -lunbound

-streamtcp:	$(STREAMTCP_OBJ) $(ldnslib)
+streamtcp$(EXEEXT):	$(STREAMTCP_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(STREAMTCP_OBJ)) $(LIBS)

-perf:	$(PERF_OBJ) $(ldnslib)
+perf$(EXEEXT):	$(PERF_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PERF_OBJ)) $(LIBS)

-delayer:	$(DELAYER_OBJ) $(ldnslib)
+delayer$(EXEEXT):	$(DELAYER_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(DELAYER_OBJ)) $(LIBS)

-harvest:	$(HARVEST_OBJ) $(ldnslib) libunbound.la
+harvest$(EXEEXT):	$(HARVEST_OBJ) $(ldnslib) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(HARVEST_OBJ)) $(LIBS) -L. -L.libs -lunbound

@@ -318,7 +323,7 @@ util/configparser.c util/configparser.h:  $(srcdir)/util/configparser.y

 clean:
 	rm -f *.o *.d *.lo *~ tags
-	rm -f unbound unbound-checkconf unbound-host unbound-control unbound-control-setup libunbound.la
+	rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-control-setup libunbound.la
 	rm -rf autom4te.cache .libs build doc/html doc/xml

 realclean: clean
@@ -349,10 +354,10 @@ doc:
 	fi

 strip:
-	strip unbound
-	strip unbound-checkconf
-	strip unbound-control
-	strip unbound-host
+	$(STRIP) unbound$(EXEEXT)
+	$(STRIP) unbound-checkconf$(EXEEXT)
+	$(STRIP) unbound-control$(EXEEXT)
+	$(STRIP) unbound-host$(EXEEXT)

 install:
 	$(INSTALL) -m 755 -d $(DESTDIR)$(sbindir)
@@ -363,10 +368,10 @@ install:
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man1
 	$(INSTALL) -m 755 -d $(DESTDIR)$(libdir)
 	$(INSTALL) -m 755 -d $(DESTDIR)$(includedir)
-	$(LIBTOOL) --mode=install cp unbound $(DESTDIR)$(sbindir)/unbound
-	$(LIBTOOL) --mode=install cp unbound-checkconf $(DESTDIR)$(sbindir)/unbound-checkconf
-	$(LIBTOOL) --mode=install cp unbound-control $(DESTDIR)$(sbindir)/unbound-control
-	$(LIBTOOL) --mode=install cp unbound-host $(DESTDIR)$(sbindir)/unbound-host
+	$(LIBTOOL) --mode=install cp unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound$(EXEEXT)
+	$(LIBTOOL) --mode=install cp unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT)
+	$(LIBTOOL) --mode=install cp unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT)
+	$(LIBTOOL) --mode=install cp unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT)
 ifeq "$(WITH_PYTHONMODULE)" "yes"
 	$(INSTALL) -m 755 -d $(DESTDIR)$(PYTHON_SITE_PKG)
 	$(INSTALL) -c -m 644 pythonmod/unboundmodule.py $(DESTDIR)$(PYTHON_SITE_PKG)/unboundmodule.py
@@ -389,7 +394,7 @@ endif
 	$(LIBTOOL) --mode=finish $(DESTDIR)$(libdir)

 uninstall:
-	rm -f -- $(DESTDIR)$(sbindir)/unbound $(DESTDIR)$(sbindir)/unbound-checkconf $(DESTDIR)$(sbindir)/unbound-host $(DESTDIR)$(sbindir)/unbound-control $(DESTDIR)$(sbindir)/unbound-control-setup
+	rm -f -- $(DESTDIR)$(sbindir)/unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control-setup
 	rm -f -- $(DESTDIR)$(mandir)/man8/unbound.8 $(DESTDIR)$(mandir)/man8/unbound-checkconf.8 $(DESTDIR)$(mandir)/man5/unbound.conf.5 $(DESTDIR)$(mandir)/man8/unbound-control.8
 	rm -f -- $(DESTDIR)$(mandir)/man1/unbound-host.1 $(DESTDIR)$(mandir)/man3/libunbound.3
 	rm -f -- $(DESTDIR)$(includedir)/unbound.h
@@ -427,7 +432,7 @@ $(BUILD)%.d: $(srcdir)/%.c
 ifneq ($(MAKECMDGOALS),clean)
 ifneq ($(MAKECMDGOALS),realclean)
 ifeq ($(debug_enabled),yes)
-include $(addprefix $(BUILD),$(ALL_SRC:.c=.d))
+-include $(addprefix $(BUILD),$(ALL_SRC:.c=.d) $(COMPAT_SRC:.c=.d))
 endif
 endif
 endif
@@ -2,8 +2,14 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 1
-# 2009-04-23
+# Version 4
+# Changelog
+# 2009-07-14 U_CHAR detection improved for windows crosscompile.
+#            added ACX_FUNC_MALLOC
+#            fixup some #if to #ifdef
+#            NONBLOCKING test for mingw crosscompile.
+# 2009-07-13 added ACX_WITH_SSL_OPTIONAL
+# 2009-07-03 fixup LDFLAGS for empty ssl dir.
 #
 # Automates some of the checking constructs.  Aims at portability for POSIX.
 # Documentation for functions is below.
@@ -28,6 +34,8 @@
 # ACX_TYPE_IN_PORT_T		- in_port_t type.
 # ACX_ARG_RPATH			- add --disable-rpath option.
 # ACX_WITH_SSL			- add --with-ssl option, link -lcrypto.
+# ACX_WITH_SSL_OPTIONAL		- add --with-ssl option, link -lcrypto,
+				  where --without-ssl is also accepted
 # ACX_LIB_SSL			- setup to link -lssl.
 # ACX_SYS_LARGEFILE		- improved sys_largefile, fseeko, >2G files.
 # ACX_CHECK_GETADDRINFO_WITH_INCLUDES - find getaddrinfo, portably.
@@ -35,6 +43,7 @@
 # ACX_CHECK_NONBLOCKING_BROKEN	- see if nonblocking sockets really work.
 # ACX_MKDIR_ONE_ARG		- determine mkdir(2) number of arguments.
 # ACX_FUNC_IOCTLSOCKET		- find ioctlsocket, portably.
+# ACX_FUNC_MALLOC		- check malloc, define replacement .
 # AHX_CONFIG_FORMAT_ATTRIBUTE	- config.h text for format.
 # AHX_CONFIG_UNUSED_ATTRIBUTE	- config.h text for unused.
 # AHX_CONFIG_FSEEKO		- define fseeko, ftello fallback.
@@ -478,14 +487,20 @@ AC_PROG_LIBTOOL

 dnl Detect if u_char type is defined, otherwise define it.
 AC_DEFUN([ACX_TYPE_U_CHAR], 
-	[AC_CHECK_TYPE(u_char, unsigned char)])
+[AC_CHECK_TYPE([u_char], ,
+	[AC_DEFINE([u_char], [unsigned char], [Define to 'unsigned char if not defined])], [
+AC_INCLUDES_DEFAULT
+#ifdef HAVE_WINSOCK2_H
+#  include <winsock2.h>
+#endif
+]) ])

 dnl Detect if rlim_t type is defined, otherwise define it.
 AC_DEFUN([ACX_TYPE_RLIM_T],
 [AC_CHECK_TYPE(rlim_t, , 
 	[AC_DEFINE([rlim_t], [unsigned long], [Define to 'int' if not defined])], [
 AC_INCLUDES_DEFAULT
-#if HAVE_SYS_RESOURCE_H
+#ifdef HAVE_SYS_RESOURCE_H
 #  include <sys/resource.h>
 #endif
 ]) ])
@@ -496,31 +511,34 @@ AC_DEFUN([ACX_TYPE_SOCKLEN_T],
 AC_CHECK_TYPE(socklen_t, , 
 	[AC_DEFINE([socklen_t], [int], [Define to 'int' if not defined])], [
 AC_INCLUDES_DEFAULT
-#if HAVE_SYS_SOCKET_H
+#ifdef HAVE_SYS_SOCKET_H
 #  include <sys/socket.h>
 #endif
+#ifdef HAVE_WS2TCPIP_H
+#  include <ws2tcpip.h>
+#endif
 ]) ])

-dnl Detect if socklen_t type is defined, otherwise define it.
+dnl Detect if in_addr_t type is defined, otherwise define it.
 AC_DEFUN([ACX_TYPE_IN_ADDR_T],
 [ AC_CHECK_TYPE(in_addr_t, [], [AC_DEFINE([in_addr_t], [uint32_t], [in_addr_t])], [
 AC_INCLUDES_DEFAULT
-#if HAVE_SYS_TYPES_H
+#ifdef HAVE_SYS_TYPES_H
 # include <sys/types.h>
 #endif
-#if HAVE_NETINET_IN_H
+#ifdef HAVE_NETINET_IN_H
 # include <netinet/in.h>
 #endif
 ]) ])

-dnl Detect if socklen_t type is defined, otherwise define it.
+dnl Detect if in_port_t type is defined, otherwise define it.
 AC_DEFUN([ACX_TYPE_IN_PORT_T],
 [ AC_CHECK_TYPE(in_port_t, [], [AC_DEFINE([in_port_t], [uint16_t], [in_port_t])], [
 AC_INCLUDES_DEFAULT
-#if HAVE_SYS_TYPES_H
+#ifdef HAVE_SYS_TYPES_H
 # include <sys/types.h>
 #endif
-#if HAVE_NETINET_IN_H
+#ifdef HAVE_NETINET_IN_H
 # include <netinet/in.h>
 #endif
 ]) ])
@@ -553,7 +571,89 @@ AC_DEFUN([ACX_RUNTIME_PATH_ADD], [
 	fi
 ])

-dnl Check for SSL. 
+dnl Common code for both ACX_WITH_SSL and ACX_WITH_SSL_OPTIONAL
+dnl Takes one argument; the withval checked in those 2 functions
+dnl sets up the environment for the given openssl path
+AC_DEFUN([ACX_SSL_CHECKS], [
+    withval=$1
+    if test x_$withval != x_no; then
+        AC_MSG_CHECKING(for SSL)
+        if test x_$withval = x_ -o x_$withval = x_yes; then
+            withval="/usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr"
+        fi
+        for dir in $withval; do
+            ssldir="$dir"
+            if test -f "$dir/include/openssl/ssl.h"; then
+                found_ssl="yes"
+                AC_DEFINE_UNQUOTED([HAVE_SSL], [], [Define if you have the SSL libraries installed.])
+                dnl assume /usr/include is already in the include-path.
+                if test "$ssldir" != "/usr"; then
+                        CPPFLAGS="$CPPFLAGS -I$ssldir/include"
+                fi
+                break;
+            fi
+        done
+        if test x_$found_ssl != x_yes; then
+            AC_MSG_ERROR(Cannot find the SSL libraries in $withval)
+        else
+            AC_MSG_RESULT(found in $ssldir)
+            HAVE_SSL=yes
+            dnl assume /usr is already in the lib and dynlib paths.
+            if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
+                LDFLAGS="$LDFLAGS -L$ssldir/lib"
+                ACX_RUNTIME_PATH_ADD([$ssldir/lib])
+            fi
+        
+            AC_MSG_CHECKING([for HMAC_CTX_init in -lcrypto])
+            LIBS="$LIBS -lcrypto"
+            AC_TRY_LINK(, [
+                int HMAC_CTX_init(void);
+                (void)HMAC_CTX_init();
+              ], [
+                AC_MSG_RESULT(yes)
+                AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
+                          [If you have HMAC_CTX_init])
+              ], [
+                AC_MSG_RESULT(no)
+                # check if -lwsock32 or -lgdi32 are needed.	
+                BAKLIBS="$LIBS"
+                LIBS="$LIBS -lgdi32"
+                AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
+                AC_TRY_LINK([], [
+                    int HMAC_CTX_init(void);
+                    (void)HMAC_CTX_init();
+                  ],[
+                    AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
+                        [If you have HMAC_CTX_init])
+                    AC_MSG_RESULT(yes) 
+                  ],[
+                    AC_MSG_RESULT(no)
+                    LIBS="$BAKLIBS"
+                    LIBS="$LIBS -ldl"
+                    AC_MSG_CHECKING([if -lcrypto needs -ldl])
+                    AC_TRY_LINK([], [
+                        int HMAC_CTX_init(void);
+                        (void)HMAC_CTX_init();
+                      ],[
+                        AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
+                            [If you have HMAC_CTX_init])
+                        AC_MSG_RESULT(yes) 
+                      ],[
+                        AC_MSG_RESULT(no)
+                    AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
+                    ])
+                ])
+            ])
+        fi
+        AC_SUBST(HAVE_SSL)
+        AC_SUBST(RUNTIME_PATH)
+    fi
+AC_CHECK_HEADERS([openssl/ssl.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([openssl/err.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([openssl/rand.h],,, [AC_INCLUDES_DEFAULT])
+])dnl End of ACX_SSL_CHECKS
+
+dnl Check for SSL, where SSL is mandatory
 dnl Adds --with-ssl option, searches for openssl and defines HAVE_SSL if found
 dnl Setup of CPPFLAGS, CFLAGS.  Adds -lcrypto to LIBS. 
 dnl Checks main header files of SSL.
@@ -569,83 +669,25 @@ AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
    if test x_$withval = x_no; then
 	AC_MSG_ERROR([Need SSL library to do digital signature cryptography])
    fi
-    if test x_$withval != x_no; then
-        AC_MSG_CHECKING(for SSL)
-        if test x_$withval = x_ -o x_$withval = x_yes; then
-            withval="/usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr"
-        fi
-        for dir in $withval; do
-            ssldir="$dir"
-            if test -f "$dir/include/openssl/ssl.h"; then
-                found_ssl="yes"
-                AC_DEFINE_UNQUOTED([HAVE_SSL], [], [Define if you have the SSL libraries installed.])
-		dnl assume /usr/include is already in the include-path.
-		if test "$ssldir" != "/usr"; then
-			CPPFLAGS="$CPPFLAGS -I$ssldir/include"
-		fi
-                break;
-            fi
-        done
-        if test x_$found_ssl != x_yes; then
-            AC_MSG_ERROR(Cannot find the SSL libraries in $withval)
-        else
-            AC_MSG_RESULT(found in $ssldir)
-            HAVE_SSL=yes
-	    dnl assume /usr is already in the lib and dynlib paths.
-	    if test "$ssldir" != "/usr"; then
-                LDFLAGS="$LDFLAGS -L$ssldir/lib"
-		ACX_RUNTIME_PATH_ADD([$ssldir/lib])
-	    fi
-	
-	    AC_MSG_CHECKING([for HMAC_CTX_init in -lcrypto])
-	    LIBS="$LIBS -lcrypto"
-	    AC_TRY_LINK(, [
-		int HMAC_CTX_init(void);
-		(void)HMAC_CTX_init();
-	      ], [
-		AC_MSG_RESULT(yes)
-		AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
-			[If you have HMAC_CTX_init])
-	      ], [
-		AC_MSG_RESULT(no)
-	    	# check if -lwsock32 or -lgdi32 are needed.	
-		BAKLIBS="$LIBS"
-		LIBS="$LIBS -lgdi32"
-		AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
-		AC_TRY_LINK([], [
-		    int HMAC_CTX_init(void);
-		    (void)HMAC_CTX_init();
-		  ],[
-		    AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
-			[If you have HMAC_CTX_init])
-		    AC_MSG_RESULT(yes) 
-		  ],[
-		    AC_MSG_RESULT(no)
-		    LIBS="$BAKLIBS"
-		    LIBS="$LIBS -ldl"
-		    AC_MSG_CHECKING([if -lcrypto needs -ldl])
-		    AC_TRY_LINK([], [
-			int HMAC_CTX_init(void);
-			(void)HMAC_CTX_init();
-		      ],[
-			AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
-			    [If you have HMAC_CTX_init])
-			AC_MSG_RESULT(yes) 
-		      ],[
-			AC_MSG_RESULT(no)
-                    AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
-		    ])
-		])
-            ])
-        fi
-        AC_SUBST(HAVE_SSL)
-	AC_SUBST(RUNTIME_PATH)
-    fi
-AC_CHECK_HEADERS([openssl/ssl.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_HEADERS([openssl/err.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_HEADERS([openssl/rand.h],,, [AC_INCLUDES_DEFAULT])
+    ACX_SSL_CHECKS($withval)
 ])dnl End of ACX_WITH_SSL

+dnl Check for SSL, where ssl is optional (--without-ssl is allowed)
+dnl Adds --with-ssl option, searches for openssl and defines HAVE_SSL if found
+dnl Setup of CPPFLAGS, CFLAGS.  Adds -lcrypto to LIBS. 
+dnl Checks main header files of SSL.
+dnl
+AC_DEFUN([ACX_WITH_SSL_OPTIONAL],
+[
+AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
+                                [enable SSL (will check /usr/local/ssl
+                                /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr)]),[
+        ],[
+            withval="yes"
+        ])
+    ACX_SSL_CHECKS($withval)
+])dnl End of ACX_WITH_SSL_OPTIONAL
+
 dnl Setup to use -lssl
 dnl To use -lcrypto, use the ACX_WITH_SSL setup (before this one).
 AC_DEFUN([ACX_LIB_SSL],
@@ -777,6 +819,10 @@ dnl a nonblocking socket do not work, a new call to select is necessary.
 AC_DEFUN([ACX_CHECK_NONBLOCKING_BROKEN],
 [
 AC_MSG_CHECKING([if nonblocking sockets work])
+if echo $target | grep mingw32 >/dev/null; then 
+	AC_MSG_RESULT([no (windows)])
+	AC_DEFINE([NONBLOCKING_IS_BROKEN], 1, [Define if the network stack does not fully support nonblocking io (causes lower performance).])
+else
 AC_RUN_IFELSE(AC_LANG_PROGRAM([
 #include <stdio.h>
 #include <string.h>
@@ -902,6 +948,7 @@ AC_RUN_IFELSE(AC_LANG_PROGRAM([
 ], [
 	AC_MSG_RESULT([crosscompile(yes)])
 ])
+fi
 ])dnl End of ACX_CHECK_NONBLOCKING_BROKEN

 dnl Check if mkdir has one or two arguments.
@@ -945,6 +992,16 @@ AC_DEFINE(HAVE_IOCTLSOCKET, 1, [if the function 'ioctlsocket' is available])
 ],[AC_MSG_RESULT(no)])
 ])dnl end of ACX_FUNC_IOCTLSOCKET

+dnl detect malloc and provide malloc compat prototype.
+dnl $1: unique name for compat code
+AC_DEFUN([ACX_FUNC_MALLOC],
+[
+	AC_FUNC_MALLOC
+	if test "$ac_cv_func_malloc_0_nonnull" = no; then
+		AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])
+	fi
+])
+
 dnl Define fallback for fseeko and ftello if needed.
 AC_DEFUN([AHX_CONFIG_FSEEKO],
 [
@@ -3,7 +3,6 @@

 #include "config.h"
 #undef malloc
-
 #include <sys/types.h>

 void *malloc ();
@@ -12,7 +11,7 @@ void *malloc ();
   If N is zero, allocate a 1-byte block.  */

 void *
-rpl_malloc (size_t n)
+rpl_malloc_unbound (size_t n)
 {
  if (n == 0)
    n = 1;
@@ -1,10 +1,10 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
-#   Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
+#   Free Software Foundation, Inc.

-timestamp='2007-05-17'
+timestamp='2008-11-15'

 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -56,8 +56,8 @@ version="\
 GNU config.guess ($timestamp)

 Originally written by Per Bothner.
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
-Free Software Foundation, Inc.
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
+2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.

 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -330,8 +330,21 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
    sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
 	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
-    i86pc:SunOS:5.*:* | ix86xen:SunOS:5.*:*)
-	echo i386-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
+    i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
+	eval $set_cc_for_build
+	SUN_ARCH="i386"
+	# If there is a compiler, see if it is configured for 64-bit objects.
+	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
+	# This test works for both compilers.
+	if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+	    if echo '\n#ifdef __amd64\nIS_64BIT_ARCH\n#endif' | \
+		(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+		grep IS_64BIT_ARCH >/dev/null
+	    then
+		SUN_ARCH="x86_64"
+	    fi
+	fi
+	echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
    sun4*:SunOS:6*:*)
 	# According to config.sub, this is the proper way to canonicalize
@@ -532,7 +545,7 @@ EOF
 		echo rs6000-ibm-aix3.2
 	fi
 	exit ;;
-    *:AIX:*:[45])
+    *:AIX:*:[456])
 	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
 	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000
@@ -793,12 +806,15 @@ EOF
 	exit ;;
    *:Interix*:[3456]*)
    	case ${UNAME_MACHINE} in
-	    x86) 
+	    x86)
 		echo i586-pc-interix${UNAME_RELEASE}
 		exit ;;
-	    EM64T | authenticamd)
+	    EM64T | authenticamd | genuineintel)
 		echo x86_64-unknown-interix${UNAME_RELEASE}
 		exit ;;
+	    IA64)
+		echo ia64-unknown-interix${UNAME_RELEASE}
+		exit ;;
 	esac ;;
    [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
 	echo i${UNAME_MACHINE}-pc-mks
@@ -833,7 +849,14 @@ EOF
 	echo ${UNAME_MACHINE}-pc-minix
 	exit ;;
    arm*:Linux:*:*)
-	echo ${UNAME_MACHINE}-unknown-linux-gnu
+	eval $set_cc_for_build
+	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
+	    | grep -q __ARM_EABI__
+	then
+	    echo ${UNAME_MACHINE}-unknown-linux-gnu
+	else
+	    echo ${UNAME_MACHINE}-unknown-linux-gnueabi
+	fi
 	exit ;;
    avr32*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
@@ -925,6 +948,9 @@ EOF
 	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
 	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
 	exit ;;
+    padre:Linux:*:*)
+	echo sparc-unknown-linux-gnu
+	exit ;;
    parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
 	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
@@ -954,8 +980,8 @@ EOF
    x86_64:Linux:*:*)
 	echo x86_64-unknown-linux-gnu
 	exit ;;
-    xtensa:Linux:*:*)
-    	echo xtensa-unknown-linux-gnu
+    xtensa*:Linux:*:*)
+    	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
    i*86:Linux:*:*)
 	# The BFD linker knows what the default object file format is, so
@@ -975,9 +1001,6 @@ EOF
 	  a.out-i386-linux)
 		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
 		exit ;;
-	  coff-i386)
-		echo "${UNAME_MACHINE}-pc-linux-gnucoff"
-		exit ;;
 	  "")
 		# Either a pre-BFD a.out linker (linux-gnuoldld) or
 		# one that does not give us useful --help.
@@ -1206,6 +1229,9 @@ EOF
    BePC:BeOS:*:*)	# BeOS running on Intel PC compatible.
 	echo i586-pc-beos
 	exit ;;
+    BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
+	echo i586-pc-haiku
+	exit ;;
    SX-4:SUPER-UX:*:*)
 	echo sx4-nec-superux${UNAME_RELEASE}
 	exit ;;
@@ -1474,9 +1500,9 @@ This script, last modified $timestamp, has failed to recognize
 the operating system you are using. It is advised that you
 download the most up to date version of the config scripts from

-  http://savannah.gnu.org/cgi-bin/viewcvs/*checkout*/config/config/config.guess
+  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
 and
-  http://savannah.gnu.org/cgi-bin/viewcvs/*checkout*/config/config/config.sub
+  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD

 If the version you run ($0) is already up to date, please
 send the following data and any information you think might be
@@ -314,6 +314,10 @@
 /* Define to 1 if you have the `_beginthreadex' function. */
 #undef HAVE__BEGINTHREADEX

+/* Define to the sub-directory in which libtool stores uninstalled libraries.
+   */
+#undef LT_OBJDIR
+
 /* Define to the maximum message length to pass to syslog. */
 #undef MAXSYSLOGMSGLEN

@@ -403,6 +407,28 @@
 /* Define this to enable SHA256 and SHA512 support. */
 #undef USE_SHA2

+/* Enable extensions on AIX 3, Interix.  */
+#ifndef _ALL_SOURCE
+# undef _ALL_SOURCE
+#endif
+/* Enable GNU extensions on systems that have them.  */
+#ifndef _GNU_SOURCE
+# undef _GNU_SOURCE
+#endif
+/* Enable threading extensions on Solaris.  */
+#ifndef _POSIX_PTHREAD_SEMANTICS
+# undef _POSIX_PTHREAD_SEMANTICS
+#endif
+/* Enable extensions on HP NonStop.  */
+#ifndef _TANDEM_SOURCE
+# undef _TANDEM_SOURCE
+#endif
+/* Enable general extensions on Solaris.  */
+#ifndef __EXTENSIONS__
+# undef __EXTENSIONS__
+#endif
+
+
 /* Whether the windows socket API is used */
 #undef USE_WINSOCK

@@ -419,13 +445,6 @@
   `char[]'. */
 #undef YYTEXT_POINTER

-/* Define to 1 if on AIX 3.
-   System headers sometimes define this.
-   We just want to avoid a redefinition error message.  */
-#ifndef _ALL_SOURCE
-# undef _ALL_SOURCE
-#endif
-
 /* Number of bits in a file offset, on hosts where this is settable. */
 #undef _FILE_OFFSET_BITS

@@ -435,6 +454,16 @@
 /* Define for large files, on AIX-style hosts. */
 #undef _LARGE_FILES

+/* Define to 1 if on MINIX. */
+#undef _MINIX
+
+/* Define to 2 if the system does not provide POSIX.1 features except with
+   this defined. */
+#undef _POSIX_1_SOURCE
+
+/* Define to 1 if you need to in order for `stat' and other things to work. */
+#undef _POSIX_SOURCE
+
 /* Define to empty if `const' does not conform to ANSI C. */
 #undef const

@@ -465,7 +494,7 @@
 /* Define to `signed char' if <sys/types.h> does not define. */
 #undef int8_t

-/* Define to rpl_malloc if the replacement function should be used. */
+/* Define if replacement function should be used. */
 #undef malloc

 /* Define to `long int' if <sys/types.h> does not define. */
@@ -486,7 +515,7 @@
 /* Define to `int' if <sys/types.h> does not define. */
 #undef ssize_t

-/* Define to `unsigned char' if <sys/types.h> does not define. */
+/* Define to 'unsigned char if not defined */
 #undef u_char

 /* Define to `int' if <sys/types.h> doesn't define. */
@@ -629,11 +658,6 @@
 #endif /* HAVE_FSEEKO */


-#ifndef RAND_MAX
-#define RAND_MAX	2147483647
-#endif
-
-
 #ifndef MAXHOSTNAMELEN
 #define MAXHOSTNAMELEN 256
 #endif
@@ -1,10 +1,10 @@
 #! /bin/sh
 # Configuration validation subroutine script.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
-#   Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
+#   Free Software Foundation, Inc.

-timestamp='2007-04-29'
+timestamp='2008-09-08'

 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -72,8 +72,8 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)

-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
-Free Software Foundation, Inc.
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
+2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.

 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -250,12 +250,14 @@ case $basic_machine in
 	| i370 | i860 | i960 | ia64 \
 	| ip2k | iq2000 \
 	| m32c | m32r | m32rle | m68000 | m68k | m88k \
-	| maxq | mb | microblaze | mcore | mep \
+	| maxq | mb | microblaze | mcore | mep | metag \
 	| mips | mipsbe | mipseb | mipsel | mipsle \
 	| mips16 \
 	| mips64 | mips64el \
-	| mips64vr | mips64vrel \
+	| mips64octeon | mips64octeonel \
 	| mips64orion | mips64orionel \
+	| mips64r5900 | mips64r5900el \
+	| mips64vr | mips64vrel \
 	| mips64vr4100 | mips64vr4100el \
 	| mips64vr4300 | mips64vr4300el \
 	| mips64vr5000 | mips64vr5000el \
@@ -286,7 +288,7 @@ case $basic_machine in
 	| v850 | v850e \
 	| we32k \
 	| x86 | xc16x | xscale | xscalee[bl] | xstormy16 | xtensa \
-	| z8k)
+	| z8k | z80)
 		basic_machine=$basic_machine-unknown
 		;;
 	m6811 | m68hc11 | m6812 | m68hc12)
@@ -331,12 +333,14 @@ case $basic_machine in
 	| ip2k-* | iq2000-* \
 	| m32c-* | m32r-* | m32rle-* \
 	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | maxq-* | mcore-* \
+	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* \
 	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
 	| mips16-* \
 	| mips64-* | mips64el-* \
-	| mips64vr-* | mips64vrel-* \
+	| mips64octeon-* | mips64octeonel-* \
 	| mips64orion-* | mips64orionel-* \
+	| mips64r5900-* | mips64r5900el-* \
+	| mips64vr-* | mips64vrel-* \
 	| mips64vr4100-* | mips64vr4100el-* \
 	| mips64vr4300-* | mips64vr4300el-* \
 	| mips64vr5000-* | mips64vr5000el-* \
@@ -364,14 +368,18 @@ case $basic_machine in
 	| sparclite-* \
 	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | strongarm-* | sv1-* | sx?-* \
 	| tahoe-* | thumb-* \
-	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
+	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* | tile-* \
 	| tron-* \
 	| v850-* | v850e-* | vax-* \
 	| we32k-* \
 	| x86-* | x86_64-* | xc16x-* | xps100-* | xscale-* | xscalee[bl]-* \
-	| xstormy16-* | xtensa-* \
+	| xstormy16-* | xtensa*-* \
 	| ymp-* \
-	| z8k-*)
+	| z8k-* | z80-*)
+		;;
+	# Recognize the basic CPU types without company name, with glob match.
+	xtensa*)
+		basic_machine=$basic_machine-unknown
 		;;
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
@@ -443,10 +451,22 @@ case $basic_machine in
 		basic_machine=ns32k-sequent
 		os=-dynix
 		;;
+	blackfin)
+		basic_machine=bfin-unknown
+		os=-linux
+		;;
+	blackfin-*)
+		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
+		os=-linux
+		;;
 	c90)
 		basic_machine=c90-cray
 		os=-unicos
 		;;
+        cegcc)
+		basic_machine=arm-unknown
+		os=-cegcc
+		;;
 	convex-c1)
 		basic_machine=c1-convex
 		os=-bsd
@@ -475,8 +495,8 @@ case $basic_machine in
 		basic_machine=craynv-cray
 		os=-unicosmp
 		;;
-	cr16c)
-		basic_machine=cr16c-unknown
+	cr16)
+		basic_machine=cr16-unknown
 		os=-elf
 		;;
 	crds | unos)
@@ -514,6 +534,10 @@ case $basic_machine in
 		basic_machine=m88k-motorola
 		os=-sysv3
 		;;
+	dicos)
+		basic_machine=i686-pc
+		os=-dicos
+		;;
 	djgpp)
 		basic_machine=i586-pc
 		os=-msdosdjgpp
@@ -668,6 +692,14 @@ case $basic_machine in
 		basic_machine=m68k-isi
 		os=-sysv
 		;;
+	m68knommu)
+		basic_machine=m68k-unknown
+		os=-linux
+		;;
+	m68knommu-*)
+		basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'`
+		os=-linux
+		;;
 	m88k-omron*)
 		basic_machine=m88k-omron
 		;;
@@ -813,6 +845,14 @@ case $basic_machine in
 		basic_machine=i860-intel
 		os=-osf
 		;;
+	parisc)
+		basic_machine=hppa-unknown
+		os=-linux
+		;;
+	parisc-*)
+		basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'`
+		os=-linux
+		;;
 	pbd)
 		basic_machine=sparc-tti
 		;;
@@ -1021,6 +1061,10 @@ case $basic_machine in
 		basic_machine=tic6x-unknown
 		os=-coff
 		;;
+	tile*)
+		basic_machine=tile-unknown
+		os=-linux-gnu
+		;;
 	tx39)
 		basic_machine=mipstx39-unknown
 		;;
@@ -1096,6 +1140,10 @@ case $basic_machine in
 		basic_machine=z8k-unknown
 		os=-sim
 		;;
+	z80-*-coff)
+		basic_machine=z80-unknown
+		os=-sim
+		;;
 	none)
 		basic_machine=none-none
 		os=-none
@@ -1216,7 +1264,7 @@ case $os in
 	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* \
+	      | -chorusos* | -chorusrdb* | -cegcc* \
 	      | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
 	      | -mingw32* | -linux-gnu* | -linux-newlib* | -linux-uclibc* \
 	      | -uxpv* | -beos* | -mpeix* | -udk* \
@@ -1356,6 +1404,9 @@ case $os in
 	-zvmoe)
 		os=-zvmoe
 		;;
+	-dicos*)
+		os=-dicos
+		;;
 	-none)
 		;;
 	*)
@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)

-AC_INIT(unbound, 1.3.0, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.3.3, unbound-bugs@nlnetlabs.nl, unbound)

 LIBUNBOUND_CURRENT=1
-LIBUNBOUND_REVISION=0
+LIBUNBOUND_REVISION=3
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -19,6 +19,9 @@ LIBUNBOUND_AGE=0
 # 1.2.0 had 0:17:0
 # 1.2.1 had 0:18:0
 # 1.3.0 had 1:0:0   # ub_cancel and -export-symbols.
+# 1.3.1 had 1:1:0
+# 1.3.2 had 1:2:0
+# 1.3.3 had 1:3:0

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -56,7 +59,10 @@ esac

 # are we on MinGW?
 if uname -s 2>&1 | grep MINGW32 >/dev/null; then on_mingw="yes"
-else on_mingw="no"; fi
+else 
+	if echo $target | grep mingw32 >/dev/null; then on_mingw="yes"
+	else on_mingw="no"; fi
+fi

 #
 # Determine configuration file
@@ -178,6 +184,7 @@ fi
 AC_PROG_LEX
 AC_PROG_YACC
 AC_CHECK_PROG(doxygen, doxygen, doxygen)
+AC_CHECK_TOOL(STRIP, strip)
 ACX_LIBTOOL_C_ONLY

 # Checks for header files.
@@ -312,10 +319,7 @@ if test x_$ub_test_python != x_no; then
      AC_PROG_SWIG
      AC_MSG_CHECKING(SWIG)
      if test ! -x "$SWIG"; then
-         AC_MSG_RESULT(failed, won't build Python module and PyUnbound)
-         AC_SUBST(swig, "")
-         ub_with_pyunbound=no
-         ub_with_pythonmod=no
+         AC_ERROR([failed to find swig tool, install it, or do not build Python module and PyUnbound])
      else
         AC_DEFINE(HAVE_SWIG, 1, [Define if you have Swig libraries and header files.])
         AC_SUBST(swig, "$SWIG")
@@ -410,8 +414,8 @@ large outgoing port ranges.  ])
 		fi
        else
            AC_MSG_RESULT(found in $thedir)
-	    dnl assume /usr is in default path.
-	    if test "$thedir" != "/usr"; then
+	    dnl assume /usr is in default path, do not add "".
+	    if test "$thedir" != "/usr" -a "$thedir" != ""; then
                LDFLAGS="$LDFLAGS -L$thedir/lib"
 		ACX_RUNTIME_PATH_ADD([$thedir/lib])
 	    fi
@@ -443,6 +447,10 @@ if test x_$enable_static_exe = x_yes; then
 	staticexe="-static"
 	if test "$on_mingw" = yes; then
 		staticexe="-all-static"
+		# for static crosscompile, include gdi32 and zlib here.
+		if test "`uname`" = "Linux"; then
+			LIBS="$LIBS -lgdi32 -lz"
+		fi
 	fi
 fi

@@ -463,7 +471,7 @@ AC_ARG_ENABLE(alloc-checks, AC_HELP_STRING([--enable-alloc-checks],
 if test x_$enable_alloc_checks = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
 else
-	AC_FUNC_MALLOC
+	ACX_FUNC_MALLOC([unbound])
 fi

 AC_FUNC_CHOWN
@@ -477,6 +485,7 @@ if test "$USE_WINSOCK" = 1; then
 	AC_DEFINE(UB_ON_WINDOWS, 1, [Use win32 resources and API])
 	UB_ON_WINDOWS=yes
 	AC_SUBST(UB_ON_WINDOWS)
+	AC_CHECK_TOOL(WINDRES, windres)
 fi
 if test $ac_cv_func_getaddrinfo = no; then
 	AC_LIBOBJ([fake-rfc2553])
@@ -514,9 +523,11 @@ use_ldns_builtin="no"
 AC_ARG_WITH(ldns, AC_HELP_STRING([--with-ldns=PATH], 
 	[specify prefix of path of ldns library to use]), 
 	[ specialldnsdir="$withval"
-	CPPFLAGS="-I$withval/include $CPPFLAGS"
-	LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
-	ACX_RUNTIME_PATH_ADD([$withval/lib])
+	if test "$withval" != ""; then
+		CPPFLAGS="-I$withval/include $CPPFLAGS"
+		LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
+		ACX_RUNTIME_PATH_ADD([$withval/lib])
+	fi
 	ldnsdir="$withval"
 	AC_SUBST(ldnsdir)
 ])
@@ -633,7 +644,6 @@ dnl includes
 AHX_CONFIG_FORMAT_ATTRIBUTE
 AHX_CONFIG_UNUSED_ATTRIBUTE
 AHX_CONFIG_FSEEKO
-AHX_CONFIG_RAND_MAX
 AHX_CONFIG_MAXHOSTNAMELEN
 AHX_CONFIG_SNPRINTF(unbound)
 AHX_CONFIG_INET_PTON(unbound)
@@ -12,3 +12,5 @@ distribution but may be helpful.
 * unbound_cacti.tar.gz : setup files for cacti statistics report
 * selinux: the .fc and .te files for SElinux protection of the unbound daemon
 * unbound.plist: launchd configuration file for MacOSX.
+* build-unbound-localzone-from-hosts.pl: perl script to turn /etc/hosts into
+	a local-zone and local-data include file for unbound.conf.
@@ -0,0 +1,67 @@
+#!/usr/bin/perl -WT
+
+use strict;
+use warnings;
+
+my $hostsfile = '/etc/hosts';
+my $localzonefile = '/etc/unbound/localzone.conf.new';
+
+my $localzone = 'example.com';
+
+open( HOSTS,"<${hostsfile}" ) or die( "Could not open ${hostsfile}: $!" );
+open( ZONE,">${localzonefile}" ) or die( "Could not open ${localzonefile}: $!" );
+
+print ZONE "server:\n\n";
+print ZONE "local-zone: \"${localzone}\" transparent\n\n";
+
+my %ptrhash;
+
+while ( my $hostline = <HOSTS> ) {
+
+	# Skip comments
+	if ( $hostline !~ "^#" and $hostline !~ '^\s+$' ) {
+
+		my @entries = split( /\s+/, $hostline );
+
+		my $ip;
+
+		my $count = 0;
+		foreach my $entry ( @entries ) {
+			if ( $count == 0 ) {
+				$ip = $entry;
+			} else {
+
+				if ( $count == 1) {
+
+					# Only return localhost for 127.0.0.1 and ::1
+					if ( ($ip ne '127.0.0.1' and $ip ne '::1') or $entry =~ 'localhost' ) {
+						if ( ! defined $ptrhash{$ip} ) {
+							$ptrhash{$ip} = $entry;
+							print ZONE "local-data-ptr: \"$ip $entry\"\n";
+						}
+					}
+
+				}
+
+				# Use AAAA for IPv6 addresses
+				my $a = 'A';
+				if ( $ip =~ ':' ) {
+					$a = 'AAAA';
+				}
+
+				print ZONE "local-data: \"$entry ${a} $ip\"\n";
+
+			}
+			$count++;
+		}
+		print ZONE "\n";
+
+
+	}
+}
+
+
+
+
+__END__
+
@@ -1,6 +1,14 @@
+# initial python set up
+%{?!with_python:      %define with_python      0}
+
+%if %{with_python}
+%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")}
+%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
+%endif
+
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.2.1rc1
+Version: 1.3.1rc2
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
@@ -8,18 +16,23 @@ Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
 Source1: unbound.init
 Source2: unbound.conf
 Source3: unbound.munin
+# See the unbound svn repository for further documentation on these
+Patch0: unbound-1.2-glob.patch
+
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: flex, openssl-devel >= 0.9.8g-12, ldns-devel >= 1.5.0, 
-BuildRequires: libevent-devel >= 1.4.5
+BuildRequires: flex, openssl-devel , ldns-devel >= 1.5.0, 
+BuildRequires: libevent-devel 
+%if %{with_python}
+BuildRequires:  python-devel
+%endif
+
 Requires(post): chkconfig
 Requires(preun): chkconfig
 Requires(preun): initscripts
 Requires(postun): initscripts
-Requires: ldns >= 1.5.0
+Requires: ldns >= 1.5.0, dnssec-conf >= 1.19
 Requires(pre): shadow-utils
-# Is this obsolete?
-#Provides: caching-nameserver

 %description
 Unbound is a validating, recursive, and caching DNS(SEC) resolver.
@@ -59,14 +72,29 @@ Requires: openssl >= 0.9.8g-12
 %description libs
 Contains libraries used by the unbound server and client applications

+%if %{with_python}
+%package python
+Summary: Python modules and extensions for unbound
+Group: Applications/System
+Requires: %{name}-libs = %{version}-%{release}
+
+%description python
+Python modules and extensions for unbound
+%endif
+
 %prep
 %setup -q 
+%patch0 -p1

 %build
-%configure  --with-ldns= -with-libevent --with-pthreads --with-ssl \
+%configure  --with-ldns= --with-libevent --with-pthreads --with-ssl \
            --disable-rpath --enable-debug --disable-static \
            --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \
-            --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid
+            --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \
+%if %{with_python}
+            --with-pythonmodule --with-pyunbound \
+%endif
+            --enable-sha2 
 %{__make} CFLAGS="$RPM_OPT_FLAGS -D_GNU_SOURCE" QUIET=no %{?_smp_mflags}

 %install
@@ -102,6 +130,11 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_sbindir}/*
 %{_mandir}/*/*

+%if %{with_python}
+%files python
+%{python_sitelib}/*
+%endif
+
 %files munin
 %defattr(-,root,root,-)
 %config(noreplace) %{_sysconfdir}/munin/plugin-conf.d/unbound
@@ -125,12 +158,20 @@ useradd -r -g unbound -d %{_sysconfdir}/unbound -s /sbin/nologin \
 -c "Unbound DNS resolver" unbound
 exit 0

-%post 
+%post
 /sbin/chkconfig --add %{name}
+# Check DNSSEC settings if this is a fresh install
+if [ "$1" -eq 1 ]; then
+  if [ -r /etc/sysconfig/dnssec ]; then
+    . /etc/sysconfig/dnssec
+    [ -x /usr/sbin/dnssec-configure ] && \
+      dnssec-configure -u --norestart --nocheck --dnssec="$DNSSEC" --dlv="$DLV" > \
+        /dev/null 2>&1
+  fi;
+fi

 %post libs -p /sbin/ldconfig

-
 %preun
 if [ "$1" -eq 0 ]; then
        /sbin/service %{name} stop >/dev/null 2>&1
@@ -145,6 +186,42 @@ fi
 %postun libs -p /sbin/ldconfig

 %changelog
+* Sat Jun 20 2009 Paul Wouters <paul@xelerance.com> - 1.3.0-2
+- Added missing glob patch to cvs
+- Place python macros within the %%with_python check
+
+* Sat Jun 20 2009 Paul Wouters <paul@xelerance.com> - 1.3.0-1
+- Updated to 1.3.0
+- Added unbound-python sub package. disabled for now
+- Patch from svn to fix DLV lookups
+- Patches from svn to detect wrong truncated response from BIND 9.6.1 with
+  minimal-responses)
+- Added Default-Start and Default-Stop to unbound.init
+- Re-enabled --enable-sha2
+- Re-enabled glob.patch
+
+* Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-7
+- unbound-iterator.patch was not commited
+
+* Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-6
+- Fix for https://bugzilla.redhat.com/show_bug.cgi?id=499793
+
+* Tue Mar 17 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-5
+- Use --nocheck to avoid giving an error on missing unbound-remote certs/keys
+
+* Tue Mar 10 2009 Adam Tkac <atkac redhat com> - 1.2.1-4
+- enable DNSSEC only if it is enabled in sysconfig/dnssec
+
+* Mon Mar 09 2009 Adam Tkac <atkac redhat com> - 1.2.1-3
+- add DNSSEC support to initscript and enabled it per default
+- add requires dnssec-conf
+
+* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.1-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
+
+* Tue Feb 10 2009 Paul Wouters <paul@xelerance.com - 1.2.1-1
+- updated to 1.2.1
+
 * Sun Jan 18 2009 Tomas Mraz <tmraz@redhat.com> - 1.2.0-2
 - rebuild with new openssl

@@ -437,7 +437,21 @@ queue)
 	done
 	;;
 memory)
-	for x in mem.total.sbrk mem.cache.rrset mem.cache.message \
+	mn=`echo mem.total.sbrk | sed $ABBREV | tr . _`
+	get_value 'mem.total.sbrk'
+	if test $value -eq 0; then
+		chk=`echo $ctrl | sed -e 's/-control$/-checkconf/'`
+		pidf=`$chk -o pidfile $conf 2>&1`
+		pid=`cat $pidf 2>&1`
+		value=`ps -p "$pid" -o rss= 2>&1`
+		if test "`expr $value + 1 - 1 2>&1`" -eq "$value" 2>&1; then
+			value=`expr $value \* 1024` 
+		else
+			value=0
+		fi
+	fi
+	echo "$mn.value" $value
+	for x in mem.cache.rrset mem.cache.message \
 		mem.mod.iterator mem.mod.validator; do
 		print_value $x
 	done
@@ -8,7 +8,7 @@ ubhost=unbound-host

 usage ( )
 {
-	echo "usage: update-anchor [-b] <zone name> <trust anchor file>"
+	echo "usage: update-anchor [-r hs] [-b] <zone name> <trust anchor file>"
 	echo "    performs an update of trust anchor file"
 	echo "    the trust anchor file is overwritten with the latest keys"
 	echo "    the trust anchor file should contain only keys for one zone"
@@ -16,13 +16,15 @@ usage ( )
 	echo "       without -b the file is made in unbound format."
 	echo "    "
 	echo "alternate:"
-	echo "    update-anchor [-b] -d directory"
+	echo "    update-anchor [-r hints] [-b] -d directory"
 	echo "    update all <zone>.anchor files in the directory."
 	echo "    "
 	echo "    name the files br.anchor se.anchor ..., and include them in"
 	echo "    the validating resolver config file."
 	echo "    put keys for the root in a file with the name root.anchor."
 	echo ""
+	echo "-r root.hints	use different root hints. Strict option order."
+	echo ""
 	echo "Exit code 0 means anchors updated, 1 no changes, others are errors."
 	exit 2
 }
@@ -32,6 +34,12 @@ if test $# -eq 0; then
 fi
 bindformat="no"
 filearg='-f'
+roothints=""
+if test X"$1" = "X-r"; then
+	shift
+	roothints="$1"
+	shift
+fi
 if test X"$1" = "X-b"; then
 	shift
 	bindformat="yes"
@@ -46,10 +54,15 @@ do_update ( ) {
 	# arguments: <zonename> <keyfile>
 	zonename="$1"
 	keyfile="$2"
-	tmp2=$tmpfile.2
-
 	tmpfile="/tmp/update-anchor.$$"
-	$ubhost -v $filearg "$keyfile" -t DNSKEY "$zonename" >$tmpfile
+	tmp2=$tmpfile.2
+	tmp3=$tmpfile.3
+	rh=""
+	if test -n "$roothints"; then
+		echo "server: root-hints: '$roothints'" > $tmp3
+		rh="-C $tmp3"
+	fi
+	$ubhost -v $rh $filearg "$keyfile" -t DNSKEY "$zonename" >$tmpfile
 	if test $? -ne 0; then
 		rm -f $tmpfile
 		echo "Error: Could not update zone $zonename anchor file $keyfile"
@@ -65,7 +78,7 @@ do_update ( ) {
 		rm -f $tmpfile
 		echo "Error: Could not update zone $zonename anchor file $keyfile"
 		echo "Cause: result of lookup was not secure" 
-		echo "    (keys too far out of date? domain changed ownership?)"
+		echo "    (keys too far out of date? domain changed ownership? need root hints?)"
 		return 3
 	fi

@@ -115,7 +128,7 @@ do_update ( ) {
 		echo "$zonename key file $keyfile unchanged."
 	fi

-	rm -f $tmpfile $tmp2
+	rm -f $tmpfile $tmp2 $tmp3
 }

 no_updated=1
@@ -462,6 +462,7 @@ daemon_cleanup(struct daemon* daemon)
 	local_zones_delete(daemon->local_zones);
 	daemon->local_zones = NULL;
 	/* key cache is cleared by module desetup during next daemon_init() */
+	daemon_remote_clear(daemon->rc);
 	for(i=0; i<daemon->num; i++)
 		worker_delete(daemon->workers[i]);
 	free(daemon->workers);
@@ -476,6 +477,7 @@ daemon_delete(struct daemon* daemon)
 	if(!daemon)
 		return;
 	modstack_desetup(&daemon->mods, daemon->env);
+	daemon_remote_delete(daemon->rc);
 	listening_ports_free(daemon->ports);
 	listening_ports_free(daemon->rc_ports);
 	if(daemon->env) {
@@ -57,6 +57,7 @@ struct rrset_cache;
 struct acl_list;
 struct local_zones;
 struct ub_randstate;
+struct daemon_remote;

 /**
 * Structure holding worker list.
@@ -73,10 +74,12 @@ struct daemon {
 	int listening_port;
 	/** listening ports, opened, to be shared by threads */
 	struct listen_port* ports;
-	/** port number fore remote that has ports opened. */
+	/** port number for remote that has ports opened. */
 	int rc_port;
 	/** listening ports for remote control */
 	struct listen_port* rc_ports;
+	/** remote control connections management (for first worker) */
+	struct daemon_remote* rc;
 	/** num threads allocated */
 	int num;
 	/** the worker entries */
@@ -136,18 +136,16 @@ timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d)
 }

 struct daemon_remote*
-daemon_remote_create(struct worker* worker)
+daemon_remote_create(struct config_file* cfg)
 {
 	char* s_cert;
 	char* s_key;
-	struct config_file* cfg = worker->daemon->cfg;
 	struct daemon_remote* rc = (struct daemon_remote*)calloc(1, 
 		sizeof(*rc));
 	if(!rc) {
 		log_err("out of memory in daemon_remote_create");
 		return NULL;
 	}
-	rc->worker = worker;
 	rc->max_active = 10;

 	if(!cfg->remote_control_enable) {
@@ -166,50 +164,51 @@ daemon_remote_create(struct worker* worker)
 		daemon_remote_delete(rc);
 		return NULL;
 	}
-	s_cert = cfg->server_cert_file;
-	s_key = cfg->server_key_file;
-	if(cfg->chrootdir && cfg->chrootdir[0]) {
-		if(strncmp(s_cert, cfg->chrootdir, strlen(cfg->chrootdir))==0)
-			s_cert += strlen(cfg->chrootdir);
-		if(strncmp(s_key, cfg->chrootdir, strlen(cfg->chrootdir))==0)
-			s_key += strlen(cfg->chrootdir);
+	s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
+	s_key = fname_after_chroot(cfg->server_key_file, cfg, 1);
+	if(!s_cert || !s_key) {
+		log_err("out of memory in remote control fname");
+		goto setup_error;
 	}
 	verbose(VERB_ALGO, "setup SSL certificates");
 	if (!SSL_CTX_use_certificate_file(rc->ctx,s_cert,SSL_FILETYPE_PEM)) {
 		log_err("Error for server-cert-file: %s", s_cert);
 		log_crypto_err("Error in SSL_CTX use_certificate_file");
-		daemon_remote_delete(rc);
-		return NULL;
+		goto setup_error;
 	}
 	if(!SSL_CTX_use_PrivateKey_file(rc->ctx,s_key,SSL_FILETYPE_PEM)) {
 		log_err("Error for server-key-file: %s", s_key);
 		log_crypto_err("Error in SSL_CTX use_PrivateKey_file");
-		daemon_remote_delete(rc);
-		return NULL;
+		goto setup_error;
 	}
 	if(!SSL_CTX_check_private_key(rc->ctx)) {
 		log_err("Error for server-key-file: %s", s_key);
 		log_crypto_err("Error in SSL_CTX check_private_key");
-		daemon_remote_delete(rc);
-		return NULL;
+		goto setup_error;
 	}
 	if(!SSL_CTX_load_verify_locations(rc->ctx, s_cert, NULL)) {
 		log_crypto_err("Error setting up SSL_CTX verify locations");
+	setup_error:
+		free(s_cert);
+		free(s_key);
 		daemon_remote_delete(rc);
 		return NULL;
 	}
 	SSL_CTX_set_client_CA_list(rc->ctx, SSL_load_client_CA_file(s_cert));
 	SSL_CTX_set_verify(rc->ctx, SSL_VERIFY_PEER, NULL);
+	free(s_cert);
+	free(s_key);

 	return rc;
 }

-void daemon_remote_delete(struct daemon_remote* rc)
+void daemon_remote_clear(struct daemon_remote* rc)
 {
 	struct rc_state* p, *np;
 	if(!rc) return;
 	/* but do not close the ports */
 	listen_list_delete(rc->accept_list);
+	rc->accept_list = NULL;
 	/* do close these sockets */
 	p = rc->busy_list;
 	while(p) {
@@ -220,6 +219,15 @@ void daemon_remote_delete(struct daemon_remote* rc)
 		free(p);
 		p = np;
 	}
+	rc->busy_list = NULL;
+	rc->active = 0;
+	rc->worker = NULL;
+}
+
+void daemon_remote_delete(struct daemon_remote* rc)
+{
+	if(!rc) return;
+	daemon_remote_clear(rc);
 	if(rc->ctx) {
 		SSL_CTX_free(rc->ctx);
 	}
@@ -348,9 +356,10 @@ accept_open(struct daemon_remote* rc, int fd)
 }

 int daemon_remote_open_accept(struct daemon_remote* rc, 
-	struct listen_port* ports)
+	struct listen_port* ports, struct worker* worker)
 {
 	struct listen_port* p;
+	rc->worker = worker;
 	for(p = ports; p; p = p->next) {
 		if(!accept_open(rc, p->fd)) {
 			log_err("could not create accept comm point");
@@ -1034,6 +1043,22 @@ do_lookup(SSL* ssl, struct worker* worker, char* arg)
 	free(nm);
 }

+/** flush something from rrset and msg caches */
+static void
+do_cache_remove(struct worker* worker, uint8_t* nm, size_t nmlen,
+	uint16_t t, uint16_t c)
+{
+	hashvalue_t h;
+	struct query_info k;
+	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, t, c, 0);
+	k.qname = nm;
+	k.qname_len = nmlen;
+	k.qtype = t;
+	k.qclass = c;
+	h = query_info_hash(&k);
+	slabhash_remove(worker->env.msg_cache, h, &k);
+}
+
 /** flush a type */
 static void
 do_flush_type(SSL* ssl, struct worker* worker, char* arg)
@@ -1048,8 +1073,7 @@ do_flush_type(SSL* ssl, struct worker* worker, char* arg)
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
 		return;
 	t = ldns_get_rr_type_by_name(arg2);
-	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
-		t, LDNS_RR_CLASS_IN, 0);
+	do_cache_remove(worker, nm, nmlen, t, LDNS_RR_CLASS_IN);
 	
 	free(nm);
 	send_ok(ssl);
@@ -1179,33 +1203,23 @@ do_flush_zone(SSL* ssl, struct worker* worker, char* arg)

 /** remove name rrset from cache */
 static void
-do_flush_name(SSL* ssl, struct worker* worker, char* arg)
+do_flush_name(SSL* ssl, struct worker* w, char* arg)
 {
 	uint8_t* nm;
 	int nmlabs;
 	size_t nmlen;
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
 		return;
-	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
-		LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN, 0);
-	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
-		LDNS_RR_TYPE_AAAA, LDNS_RR_CLASS_IN, 0);
-	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
-		LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN, 0);
-	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
-		LDNS_RR_TYPE_SOA, LDNS_RR_CLASS_IN, 0);
-	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
-		LDNS_RR_TYPE_CNAME, LDNS_RR_CLASS_IN, 0);
-	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
-		LDNS_RR_TYPE_DNAME, LDNS_RR_CLASS_IN, 0);
-	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
-		LDNS_RR_TYPE_MX, LDNS_RR_CLASS_IN, 0);
-	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
-		LDNS_RR_TYPE_PTR, LDNS_RR_CLASS_IN, 0);
-	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
-		LDNS_RR_TYPE_SRV, LDNS_RR_CLASS_IN, 0);
-	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
-		LDNS_RR_TYPE_NAPTR, LDNS_RR_CLASS_IN, 0);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_AAAA, LDNS_RR_CLASS_IN);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SOA, LDNS_RR_CLASS_IN);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_CNAME, LDNS_RR_CLASS_IN);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_DNAME, LDNS_RR_CLASS_IN);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_MX, LDNS_RR_CLASS_IN);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_PTR, LDNS_RR_CLASS_IN);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SRV, LDNS_RR_CLASS_IN);
+	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NAPTR, LDNS_RR_CLASS_IN);
 	
 	free(nm);
 	send_ok(ssl);
@@ -96,10 +96,10 @@ struct daemon_remote {

 /**
 * Create new remote control state for the daemon.
- * @param worker: worker with communication base. and links to command channels.
+ * @param cfg: config file with key file settings.
 * @return new state, or NULL on failure.
 */
-struct daemon_remote* daemon_remote_create(struct worker* worker);
+struct daemon_remote* daemon_remote_create(struct config_file* cfg);

 /**
 * remote control state to delete.
@@ -107,6 +107,13 @@ struct daemon_remote* daemon_remote_create(struct worker* worker);
 */
 void daemon_remote_delete(struct daemon_remote* rc);

+/**
+ * remote control state to clear up. Busy and accept points are closed.
+ * Does not delete the rc itself, or the ssl context (with its keys).
+ * @param rc: state to clear.
+ */
+void daemon_remote_clear(struct daemon_remote* rc);
+
 /**
 * Open and create listening ports for remote control.
 * @param cfg: config options.
@@ -119,10 +126,11 @@ struct listen_port* daemon_remote_open_ports(struct config_file* cfg);
 * Setup comm points for accepting remote control connections.
 * @param rc: state
 * @param ports: already opened ports.
+ * @param worker: worker with communication base. and links to command channels.
 * @return false on error.
 */
 int daemon_remote_open_accept(struct daemon_remote* rc, 
-	struct listen_port* ports);
+	struct listen_port* ports, struct worker* worker);

 /**
 * Handle nonthreaded remote cmd execution.
@@ -43,6 +43,7 @@
 #include "config.h"
 #include "util/log.h"
 #include "daemon/daemon.h"
+#include "daemon/remote.h"
 #include "util/config_file.h"
 #include "util/storage/slabhash.h"
 #include "services/listen_dnsport.h"
@@ -366,6 +367,10 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	 * So, using a logfile, the user does not see errors unless -d is
 	 * given to unbound on the commandline. */

+	/* read ssl keys while superuser and outside chroot */
+	if(!(daemon->rc = daemon_remote_create(cfg)))
+		fatal_exit("could not set up remote-control");
+
 #ifdef HAVE_KILL
 	/* check old pid file before forking */
 	if(cfg->pidfile && cfg->pidfile[0]) {
@@ -496,43 +496,6 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	return 1;
 }

-/** check cname chain in cache reply */
-static int
-check_cache_chain(struct reply_info* rep) {
-	/* check only answer section rrs for matching cname chain.
-	 * the cache may return changed rdata, but owner names are untouched.*/
-	size_t i;
-	uint8_t* sname = rep->rrsets[0]->rk.dname;
-	size_t snamelen = rep->rrsets[0]->rk.dname_len;
-	for(i=0; i<rep->an_numrrsets; i++) {
-		uint16_t t = ntohs(rep->rrsets[i]->rk.type);
-		if(t == LDNS_RR_TYPE_DNAME)
-			continue; /* skip dnames; note TTL 0 not cached */
-		/* verify that owner matches current sname */
-		if(query_dname_compare(sname, rep->rrsets[i]->rk.dname) != 0){
-			/* cname chain broken */
-			return 0;
-		}
-		/* if this is a cname; move on */
-		if(t == LDNS_RR_TYPE_CNAME) {
-			get_cname_target(rep->rrsets[i], &sname, &snamelen);
-		}
-	}
-	return 1;
-}
-
-/** check security status in cache reply */
-static int
-all_rrsets_secure(struct reply_info* rep) {
-	size_t i;
-	for(i=0; i<rep->rrset_count; i++) {
-		if( ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
-			->security != sec_status_secure )
-			return 0;
-	}
-	return 1;
-}
-
 /** answer query from the cache */
 static int
 answer_from_cache(struct worker* worker, struct query_info* qinfo,
@@ -558,7 +521,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	if(rep->an_numrrsets > 0 && (rep->rrsets[0]->rk.type == 
 		htons(LDNS_RR_TYPE_CNAME) || rep->rrsets[0]->rk.type == 
 		htons(LDNS_RR_TYPE_DNAME))) {
-		if(!check_cache_chain(rep)) {
+		if(!reply_check_cname_chain(rep)) {
 			/* cname chain invalid, redo iterator steps */
 			verbose(VERB_ALGO, "Cache reply: cname chain broken");
 		bail_out:
@@ -590,7 +553,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 			"validation");
 		goto bail_out; /* need to validate cache entry first */
 	} else if(rep->security == sec_status_secure) {
-		if(all_rrsets_secure(rep))
+		if(reply_all_rrsets_secure(rep))
 			secure = 1;
 		else	{
 			if(must_validate) {
@@ -1038,12 +1001,8 @@ worker_init(struct worker* worker, struct config_file *cfg,
 			return 0;
 		}
 #endif /* LIBEVENT_SIGNAL_PROBLEM */
-		if(!(worker->rc = daemon_remote_create(worker))) {
-			worker_delete(worker);
-			return 0;
-		}
-		if(!daemon_remote_open_accept(worker->rc, 
-			worker->daemon->rc_ports)) {
+		if(!daemon_remote_open_accept(worker->daemon->rc, 
+			worker->daemon->rc_ports, worker)) {
 			worker_delete(worker);
 			return 0;
 		}
@@ -1052,7 +1011,6 @@ worker_init(struct worker* worker, struct config_file *cfg,
 #endif /* UB_ON_WINDOWS */
 	} else { /* !do_sigs */
 		worker->comsig = NULL;
-		worker->rc = NULL;
 	}
 	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^
 		(((unsigned int)worker->thread_num)<<17);
@@ -1172,7 +1130,6 @@ worker_delete(struct worker* worker)
 	comm_signal_delete(worker->comsig);
 	tube_delete(worker->cmd);
 	comm_timer_delete(worker->stat_timer);
-	daemon_remote_delete(worker->rc);
 	free(worker->ports);
 	if(worker->thread_num == 0) {
 		log_set_time(NULL);
@@ -1291,6 +1248,18 @@ void libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
 	log_assert(0);
 }

+void libworker_fg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
+        ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s))
+{
+	log_assert(0);
+}
+
+void libworker_bg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
+        ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s))
+{
+	log_assert(0);
+}
+
 int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 {
 	log_assert(0);
@@ -101,8 +101,6 @@ struct worker {
 	struct comm_point* cmd_com;
 	/** timer for statistics */
 	struct comm_timer* stat_timer;
-	/** remote control state (for first thread only) */
-	struct daemon_remote* rc;

 	/** number of requests that can be handled by this worker */
 	size_t request_size;
@@ -14,4 +14,5 @@ Jakob Schlyter - for advice on secure settings, random numbers and blacklists.
 Ondřej Surý - running coverity analysis tool on 0.9 dev version.
 Alexander Gall - multihomed, anycast testing of unbound resolver server.
 Zdenek Vasicek and Marek Vavrusa - python module.
+cz.nic - sponsoring 'summer of code' development by Zdenek and Marek.
 Brett Carr - windows beta testing.
@@ -1,3 +1,165 @@
+4 August 2009: Wouter
+	- Added test that the examples from draft rsasha256-14 verify.
+	- iana portlist updated.
+
+3 August 2009: Wouter
+	- nicer warning when algorithm not supported, tells you to upgrade.
+	- iana portlist updated.
+
+27 July 2009: Wouter
+	- Updated unbound-cacti contribution from Dmitriy Demidov, with
+	  the queue statistics displayed in its own graph.
+	- iana portlist updated.
+
+22 July 2009: Wouter
+	- Fix bug found by Michael Tokarev where unbound would try to
+	  prime the root servers even though forwarders are configured for
+	  the root.
+	- tagged 1.3.3rc1
+
+21 July 2009: Wouter
+	- Fix server selection, so that it waits for open target queries when
+	  faced with lameness.
+
+20 July 2009: Wouter
+	- Ignore transient sendto errors, no route to host, and host, net down.
+	- contrib/update-anchor.sh has -r option for root-hints.
+	- feature val-log-level: 1 prints validation failures so you can
+	  keep track of them during dnssec deployment.
+
+16 July 2009: Wouter
+	- fix replacement malloc code.  Used in crosscompile.
+	- makedist -w creates crosscompiled setup.exe on fedora11.
+
+15 July 2009: Wouter
+	- dependencies for compat items, for crosscompile.
+	- mingw32 crosscompile changes, dependencies and zipfile creation.
+	  and with System.dll from the windows NSIS you can make setup.exe.
+	- package libgcc_s_sjlj exception handler for NSISdl.dll.
+
+14 July 2009: Wouter
+	- updated ldns tarball for solaris x64 compile assistance.
+	- no need to define RAND_MAX from config.h.
+	- iana portlist updated.
+	- configure changes and ldns update for mingw32 crosscompile.
+
+13 July 2009: Wouter
+	- Fix for crash at start on windows.
+	- tag for release 1.3.2.
+	- trunk has version 1.3.3.
+	- Fix for ID bits on windows to use all 16. RAND_MAX was not
+	  defined like you'd expect on mingw. Reported by Mees de Roo.
+
+9 July 2009: Wouter
+	- tag for release 1.3.1.
+	- trunk has version 1.3.2.
+
+7 July 2009: Wouter
+	- iana portlist updated.
+
+6 July 2009: Wouter
+	- prettier error handling in SSL setup.
+	- makedist.sh uname fix (same as ldns).
+	- updated fedora spec file.
+
+3 July 2009: Wouter
+	- fixup linking when ldnsdir is "".
+
+30 June 2009: Wouter
+	- more lenient truncation checks.
+
+29 June 2009: Wouter
+	- ldns trunk r2959 imported as tarball, because of solaris cc compile
+	  support for c99.  r2960 for better configure.
+	- better wrongly_truncated check.
+	- On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to
+	  avoid dropped packets at routers.
+
+26 June 2009: Wouter
+	- Fix EDNS fallback when EDNS works for short answers but long answers
+	  are dropped.
+
+22 June 2009: Wouter
+	- fixup iter priv strict aliasing while preserving size of sockaddr.
+	- iana portlist updated.  (one less port allocated, one more fraction
+	  of a bit for security!)
+	- updated fedora specfile in contrib from Paul Wouters.
+	
+19 June 2009: Wouter
+	- Fixup strict aliasing warning in iter priv code.
+	  and config_file code.
+	- iana portlist updated.
+	- harden-referral-path: handle cases where NS is in answer section.
+
+18 June 2009: Wouter
+	- Fix of message parse bug where (specifically) an NSEC and RRSIG
+	  in the wrong order would be parsed, but put wrongly into internal
+	  structures so that later validation would fail.
+	- Extreme lenience for wrongly truncated replies where a positive
+	  reply has an NS in the authority but no signatures.  They are
+	  turned into minimal responses with only the (secure) answer.
+	- autoconf 2.63 for configure.
+	- python warnings suppress.  Keep python API away from header files.
+
+17 June 2009: Wouter
+	- CREDITS entry for cz.nic, sponsoring a 'summer of code' that was
+	  used for the python code in unbound. (http://www.nic.cz/vip/ in cz).
+
+16 June 2009: Wouter
+	- Fixup opportunistic target query generation to it does not
+	  generate queries that are known to fail.
+	- Touchup on munin total memory report.
+	- messages picked out of the cache by the iterator are checked
+	  if their cname chain is still correct and if validation status
+	  has to be reexamined.
+
+15 June 2009: Wouter
+	- iana portlist updated.
+
+14 June 2009: Wouter
+	- Fixed bug where cached responses would lose their security
+	  status on second validation, which especially impacted dlv
+	  lookups.  Reported by Hauke Lampe.
+
+13 June 2009: Wouter
+	- bug #254. removed random whitespace from example.conf.
+
+12 June 2009: Wouter
+	- Fixup potential wrong NSEC picked out of the cache.
+	- If unfulfilled callbacks are deleted they are called with an error.
+	- fptr wlist checks for mesh callbacks.
+	- fwd above stub in configuration works.
+
+11 June 2009: Wouter
+	- Fix queries for type DS when forward or stub zones are there.
+	  They are performed to higherup domains, and thus treated as if
+	  going to higher zones when looking up the right forward or stub
+	  server.  This makes a stub pointing to a local server that has
+	  a local view of example.com signed with the same keys as are
+	  publicly used work.  Reported by Johan Ihren.
+	- Added build-unbound-localzone-from-hosts.pl to contrib, from
+	  Dennis DeDonatis.  It converts /etc/hosts into config statements.
+	- same thing fixed for forward-zone and DS, chain of trust from
+	  public internet into the forward-zone works now.  Added unit test.
+
+9 June 2009: Wouter
+	- openssl key files are opened apache-style, when user is root and
+	  before chrooting.  This makes permissions on remote-control key 
+	  files easier to set up.  Fixes bug #251.
+	- flush_type and flush_name remove msg cache entries.
+	- codereview - dp copy bogus setting fix.
+
+8 June 2009: Wouter
+	- Removed RFC5011 REVOKE flag support. Partial 5011 support may cause
+	  inadvertant behaviour.
+	- 1.3.0 tarball for release created.
+	- 1.3.1 development in svn trunk.
+	- iana portlist updated.
+	- fix lint from complaining on ldns/sha.h.
+	- help compiler figure out aliasing in priv_rrset_bad() routine.
+	- fail to configure with python if swig is not found.
+	- unbound_munin_ in contrib uses ps to show rss if sbrk does not work.
+
 3 June 2009: Wouter
 	- fixup bad free() when wrongly encoded DSA signature is seen.
 	  Reported by Paul Wouters.
@@ -91,6 +91,13 @@ o The warning 'openssl has no entropy, seeding with time', with chroot
 o On Solaris 5.10 some libtool packages from repositories do not work with
  gcc, showing errors gcc: unrecognized option `-KPIC'
  To solve this do ./configure libtool=./libtool [your options...].
+o If unbound-control (or munin graphs) do not work, this can often be because
+  the unbound-control-setup script creates the keys with restricted 
+  permissions, and the files need to be made readable or ownered by both the
+  unbound daemon and unbound-control.
+o Crosscompile seems to hang.  You tried to install unbound under wine.
+  wine regedit and remove all the unbound entries from the registry or
+  delete .wine/drive_c.

 Acknowledgements
 ----------------
@@ -35,11 +35,15 @@ o overhaul outside-network servicedquery to merge with udpwait and tcpwait,
 o check into rebinding ports for efficiency, configure time test.
 o EVP hardware crypto support.
 o option to ignore all inception and expiration dates for rrsigs.
-o option to use builtin ldns explicitly.  Or stop shipping builtin tarball.
 o cleaner code; return and func statements on newline.
 o memcached module that sits before validator module; checks for memcached
  data (on local lan), stores recursion lookup.  Provides one cache for multiple resolver machines, coherent reply content in anycast setup.
 o no openssl_add_all_algorithms, but only the ones necessary, less space.
+o listen to NOTIFY messages for zones and flush the cache for that zone
+  if received.  Useful when also having a stub to that auth server.
+  Needs proper protection, TSIG, in place.
+o winevent - do not go more than 64 fds (by polling with select one by
+  one), win95/98 have 100fd limit in the kernel, so this ruins w9x portability.

 *** Features features, for later
 * dTLS, TLS, look to need special port numbers, cert storage, recent libssl.
@@ -55,4 +59,173 @@ o on windows version, implement that OS ancillary data capabilities for
 o local-zone directive with authority service, full authority server 
  is a non-goal.
 o infra and lame cache: easier size config (in Mb), show usage in graphs.
+- store time of dump in cachedumps, so that on a load the ttls can be
+  compared to the absolute time, and now-expired items can be dealt with.
+
+1.3.x:
+- spoofed delegpt fixes - if DNSKEY prime fails
+	- set DNSKEY bogus and DNSKEY query msg bogus.
+	- make NS set bogus too - if not validated as secure.
+	- check where queries go - otherwise reduce TTL on NS.
+	- also make DS NSEC bogus. Also DS msg cache entry.
+- mark bogus under stringent conditions
+	- if DS at parent and validly signed. Then DNSKEY must exist.
+	- Also for trust anchor points themselves. DNSKEY must exist.
+	- so if then DNSKEY keyprime fails
+	  - then it is not simply a server that only answers qtype A.
+	  - then parent is agreeing (somewhat) with the DS record
+	  - but it could still be a lame domain, these exist 
+	    The objective is to keep tries for genuinely lame domains to a
+	    minimum, while detecting forgeries quickly. exponential backoff.
+	- for unbound we can check if we got something to verify while
+	  building that chain of trust.  If so - not lame, agressive retry.
+	  - but security-lame zones also exist and should not pose 
+	    too high a burden. Exponential backoff again.
+	    (fe. badly signed or dnskey reply too large fails).
+	- the delegation NS for the domain is bogus.
+	  The referral retried, with exponential backoff.
+	  This exponential backoff should go towards values which are close
+	  to the TTLs that are used now (on lame delegations for example).
+	  so that the extra traffic is manageable.
+	- for unbound, reset the TTL on the NS rrset. Let it timeout.
+	  Set NS rrset bogus - no more queries to the domain are done.
+	  Also set DNSKEY and DS (rrset, NSEC, msg) bogus and ttl like that.
+	  (to the same absolute value, so a clean retry is done).
+	  TTL of NS is (rounddown) timeout in seconds.
+	  Until the NS times out and referral is done again.
+	  Make sure multiple validations for chains of trust do not result
+	  in a flood of queries or backoff too quickly.
+- bogus exponential backoff cache. hash(name,t,c), size(1M, 5%).
+	TTL of 24h.  Backoff from 200msec to 24h.
+	x2 on bogus(18 tries), x8 backoff on lameness(6 tries), 
+	  when servfail for DNSKEY.
+	remove entry when validated as secure.
+	delegptspoofrecheck on lameness when harden-referral-path NS
+	query has servfail, then build chain of trust down (check DS,
+	then perform DNSKEY query) if that DNSKEY query fails servfail,
+	perform the x8 lameness retry fallback.
+
+* keep a list of guilty IP addresses in the qstate, which contains both
+  the child side guilty IPs and the parent guilty IPs.  Valid signed DSes
+  are not made guilty in the global cache.  The child IP is made guilty
+  in the global cache.
+* Retry to higher trust anchors.
+  * option not to retry to higher from this ta.
+  * keep longest must-be-secure name. Do no accept insecure above this point.
+  * if failed ta, blame all lower tas for their DNSKEY (get IP from cached
+    rrset),  if failure is insecure - nothing, if at bogus - blame that too.
+    lower tas have isdata=false, so the IP address for the dnskeyrrset in
+    the cache is set to avoid in qstate. Nothing in infracache, no childretry.
+
+Retry harder to get valid DNSSEC data.
+Triggered by a trust anchor or by a signed DS record for a zone.
+* If data is fetched and validation fails for it
+  or DNSKEY is fetched and validated into chain-of-trust fails for it
+  or DS is fetched and validated into chain-of-trust fails for it
+  Then
+  	blame(signer zone, IP origin of the data/DNSKEY/DS, x2, isdata)
+* If data was not fetched (SERVFAIL, lame, ...), and the data
+  is under a signed DS then:
+  	blame(thatDSname, IP origin of the data/DNSKEY/DS, x8)
+  x8 because the zone may be lame.
+  This means a chain of trust is built also for unfetched data, to
+  determine if a signed DS is present.  If insecure, nothing is done.
+* If DNSKEY was not fetched for chain of trust (SERVFAIL, lame, ...),
+  Then
+  	blame(DNSKEYname, IP origin of the data/DNSKEY/DS, x8)
+  x8 because the zone may be lame.
+* blame(zonename, guiltyIP, multiplier, isdata):
+  * if isdata:
+    Set the guiltyIP,zonename as DNSSEC-bogus-data=true in lameness cache.
+    Thusly marked servers are avoided if possible, used as last resort.
+    The guilt TTL is the infra cache ttl (15 minutes).  
+    The dnssec retry scheme works without this cache entry.
+  * If the key cache entry 'being-backed-off' is true and isdata then:
+	The parent is backedoff, it must be the childs fault. Retry to child.
+	if the child-dnskey is bogus, then retry is useless, stop.
+	Perform a child-retry - purge dataonly, childside, mark
+	data-IPaddress from child as to avoid-forquery. counterperquery,
+	max is 3, if reached, set this data element RRset&msg to the 
+	current backoff TTL end-time or bogus-ttl(60 seconds) whichever is less
+	and done.
+  * if no retry entry exists for the zone key, create one with 24h TTL, 10 ms.
+    else the backoff *= multiplier.
+  * If the backoff is less than a second, remove entries from cache and
+    restart query.  Else set the TTL for the entries to that value.
+  * Entries to set or remove: DNSKEY RRset&msg, DS RRset&msg, NS RRset&msg, 
+  	in-zone glue (A and AAAA) RRset&msg, and key-cache-entry TTL.
+	The the data element RRset&msg to the backoff TTL or bogusttl.
+	If TTL>1sec set key-cache-entry flag 'being-backed-off' to true.
+	when entry times out that flag is reset to false again.
+* Storage extra is:
+  IP address per RRset and message.  A lot of memory really, since that is
+  132 bytes per RRset and per message.  Store plain IP: 4/16 bytes, len byte.
+  port number 2bytes. +19bytes per RRset, per msg.
+  guilt flag in infra(lameness) cache.
+  being-backed-off flag for key cache, also backoff time value and its TTL.
+  child-retry-count and guilty-ip-list in qstate.
+* Load on authorities:
+  For lame servers: 7 tries per day (one per three hours on average).
+  Others get up to 23 tries per day (one per hour on average).
+  +1 for original try makes 8/24 hours and 24/24 hours.
+  Unless the cache entry falls out of the cache due to memory. In that
+  case it can be tried more often, this is similar to the NS entry falling
+  out of the cache due to memory, in that case it also has to be retried.
+* Performance analysis:
+  * domain is sold.  Unbound sees invalid signature (expired) or the old
+    servers refuse the queries.  Retry within the second, if parent has
+    new DS and NS available instantly works again (no downtime).
+  * domain is bogus signed.  Parent gets 1 query per hour.
+	Domain itself gets couple tries per queryname, per minute.
+  * domain partly bogus.  Parent gets 1 query per hour.
+	Domain itself gets couple tries per bogus queryname, per minute.
+  * spoof attempt.  Unbound tries a couple times.  If not spoofed again,
+    it works, if spoofed every time unbound backs off and stops trying.
+	But childretry is attempted more often, once per minute.
+  * parent has inconsistently signed DS records.  Together with a subzone that
+    is badly managed.  Unbound backs up to the root once per hour.
+  * parent has bad DS records, different sets on different servers, but they
+    are signed ok.  Works as for every query a list of bad nameserver, parent
+    and child side is kept, walks through them.  But as backoff increases
+    and becomes bigger than the TTL on the DS records, unbound will blackout.
+    The parent really has to be fixed...
+    The issue is that it is validly signed, but bad data. Unbound will very
+    conservatively retry it.
+  * domain is sold, but decommission is faster than the setup of new server.
+    Unbound does exponential backoff, if new setup is fast, it'll pickup the
+    new data fast.
+  * key rollover failed.  The zone has bad keys.  Like it was bogus signed.
+  * one nameserver has bad data.  Unbound goes back to the parent but also
+    marks that server as guilty.  Picks data from other server right after,
+    retry without blackout for the user.  
+    When parent starts to get backed off, if the nameserver is childside,
+    queryretries for childservers are made when queries fail.
+  * domain was sold, but unbound has old entries in the cache.  These somehow
+    need (re)validation (were queried with +cd, now -cd).  The entries are
+    bogus.  
+    Unbound performs childretry for these entries.  Works once the keys
+    have been successfully reprimed with parentretry.
+  * unbound is configured to talk to upstream caches.  These caches have
+    inconsistent bad data.  If one is bad, it is marked bad for that zone.  
+    If all are bad, there may not be any way for unbound to remove the
+    bad entries from the upstream caches.  It simply fails.
+    Recommendation: make the upstream caches validate as well.
+  * Old data that was valid with a long TTL remains in the cache.
+    Valid data has a TTL and this is the protocol.
+  * listing bad servers and trying again may not be good enough, since
+    a combinatorial explosion for DSxDNSKEYxdata is possible for every
+    signature validation (using different nameservers for DS, DNSKEY and
+    data, assuming only the right combination has a chain of trust to data).
+    The parentretries perform DS and DNSKEY searching.
+    childretries perform data searching.
+
+
+later
+- selective verbosity; ubcontrol trace example.com
+- option to log only bogus domainname encountered, for demos
+- cache fork-dump, pre-load
+- for fwds, send queries to N servers in fwd-list, use first reply.
+  document high scalable, high available unbound setup onepager.
+- prefetch DNSKEY when DS in delegation seen (nonCD, underTA).
+- use libevent if available on system by default(?), default outgoing 256to1024

@@ -18,7 +18,7 @@ server:
 	# print statistics to the log (for every thread) every N seconds.
 	# Set to "" or 0 to disable. Default is disabled.
 	# statistics-interval: 0
-	
+
 	# enable cumulative statistics, without clearing them after printing.
 	# statistics-cumulative: no

@@ -37,7 +37,7 @@ server:
 	# interface: 192.0.2.153
 	# interface: 192.0.2.154
 	# interface: 2001:DB8::5
-	
+
 	# enable this feature to copy the source address of queries to reply.
 	# Socket options are not supported on all platforms. experimental. 
 	# interface-automatic: no
@@ -55,7 +55,7 @@ server:
 	# number of ports to allocate per thread, determines the size of the
 	# port range that can be open simultaneously. 
 	# outgoing-range: 256
-	
+
 	# permit unbound to use this port number or port range for
 	# making outgoing queries, using an outgoing interface.
 	# outgoing-port-permit: 32768
@@ -72,7 +72,7 @@ server:

 	# number of incoming simultaneous tcp buffers to hold per thread.
 	# incoming-num-tcp: 10
-	
+
 	# buffer size for handling DNS data. No messages larger than this
 	# size can be sent or received, by UDP or TCP. In bytes.
 	# msg-buffer-size: 65552
@@ -191,7 +191,7 @@ server:
 	# the log file, "" means log to stderr. 
 	# Use of this option sets use-syslog to "no".
 	# logfile: ""
-	
+
 	# Log to syslog(3) if yes. The log facility LOG_DAEMON is used to 
 	# log to, with identity "unbound". If yes, it overrides the logfile.
 	# use-syslog: yes 
@@ -201,23 +201,23 @@ server:

 	# the pid file. Can be an absolute path outside of chroot/work dir.
 	# pidfile: "@UNBOUND_PIDFILE@"
-	
+
 	# file to read root hints from.
 	# get one from ftp://FTP.INTERNIC.NET/domain/named.cache
 	# root-hints: ""
-	
+
 	# enable to not answer id.server and hostname.bind queries.
 	# hide-identity: no
-	
+
 	# enable to not answer version.server and version.bind queries.
 	# hide-version: no
-	
+
 	# the identity to report. Leave "" or default to return hostname.
 	# identity: ""
-	
+
 	# the version to report. Leave "" or default to return package version.
 	# version: ""
-	
+
 	# the target fetch policy.
 	# series of integers describing the policy per dependency depth. 
 	# The number of values in the list determines the maximum dependency 
@@ -227,16 +227,16 @@ server:
 	#	positive value: fetch that many targets opportunistically.
 	# Enclose the list of numbers between quotes ("").
 	# target-fetch-policy: "3 2 1 0 0"
-	
+
 	# Harden against very small EDNS buffer sizes. 
 	# harden-short-bufsize: no
-	
+
 	# Harden against unseemly large queries.
 	# harden-large-queries: no
-	
+
 	# Harden against out of zone rrsets, to avoid spoofing attempts. 
 	# harden-glue: yes
-	
+
 	# Harden against receiving dnssec-stripped data. If you turn it
 	# off, failing to validate dnskey data for a trustanchor will 
 	# trigger insecure mode for that zone (like without a trustanchor).
@@ -252,7 +252,7 @@ server:
 	# Use 0x20-encoded random bits in the query to foil spoof attempts.
 	# This feature is an experimental implementation of draft dns-0x20.
 	# use-caps-for-id: no
-	
+
 	# Enforce privacy of these addresses. Strips them away from answers. 
 	# It may cause DNSSEC validation to additionally mark it as bogus. 
 	# Protects against 'DNS Rebinding' (uses browser as network proxy). 
@@ -268,7 +268,7 @@ server:
 	# Allow the domain (and its subdomains) to contain private addresses.
 	# local-data statements are allowed to contain private addresses too.
 	# private-domain: "example.com"
-	
+
 	# If nonzero, unwanted replies are not only reported in statistics,
 	# but also a running total is kept per thread. If it reaches the
 	# threshold, a warning is printed and a defensive action is taken,
@@ -280,15 +280,15 @@ server:
 	# List one address per entry. List classless netblocks with /size,
 	# do-not-query-address: 127.0.0.1/8
 	# do-not-query-address: ::1
-	
+
 	# if yes, the above default do-not-query-address entries are present.
 	# if no, localhost can be queried (for testing and debugging).
 	# do-not-query-localhost: yes
-	
+
 	# module configuration of the server. A string with identifiers
 	# separated by spaces. "iterator" or "validator iterator"
 	# module-config: "validator iterator"
-	
+
 	# File with DLV trusted keys. Same format as trust-anchor-file.
 	# There can be only one DLV configured, it is trusted from root down.
 	# Download http://ftp.isc.org/www/dlv/dlv.isc.org.key
@@ -298,7 +298,7 @@ server:
 	# with several entries, one file per entry.
 	# Zone file format, with DS and DNSKEY entries.
 	# trust-anchor-file: ""
-	
+
 	# Trusted key for validation. DS or DNSKEY. specify the RR on a
 	# single line, surrounded by "". TTL is ignored. class is IN default.
 	# (These examples are from August 2007 and may not be valid anymore).
@@ -310,7 +310,7 @@ server:
 	# but has a different file format. Format is BIND-9 style format, 
 	# the trusted-keys { name flag proto algo "key"; }; clauses are read.
 	# trusted-keys-file: ""
-	
+
 	# Ignore chain of trust. Domain is treated as insecure.
 	# domain-insecure: "example.com"

@@ -318,30 +318,34 @@ server:
 	# Do not set this unless you are debugging signature inception
 	# and expiration. "" or "0" turns the feature off. 
 	# val-override-date: ""
-	
+
 	# The time to live for bogus data, rrsets and messages. This avoids
 	# some of the revalidation, until the time interval expires. in secs.
 	# val-bogus-ttl: 60
-	
+
 	# The signature inception and expiration dates are allowed to be off
 	# by 10% of the lifetime of the signature from our local clock.
 	# This leeway is capped with a minimum and a maximum.  In seconds.
 	# val-sig-skew-min: 3600
 	# val-sig-skew-max: 86400
-	
+
 	# Should additional section of secure message also be kept clean of
 	# unsecure data. Useful to shield the users of this validator from
 	# potential bogus data in the additional section. All unsigned data 
 	# in the additional section is removed from secure messages.
 	# val-clean-additional: yes
-	
+
 	# Turn permissive mode on to permit bogus messages. Thus, messages
 	# for which security checks failed will be returned to clients,
 	# instead of SERVFAIL. It still performs the security checks, which
 	# result in interesting log files and possibly the AD bit in
 	# replies if the message is found secure. The default is off.
 	# val-permissive-mode: no
-	
+
+	# Have the validator log failed validations for your diagnosis.
+	# 0: off. 1: A line per failed user query.
+	# val-log-level: 0
+
 	# It is possible to configure NSEC3 maximum iteration counts per
 	# keysize. Keep this table very short, as linear search is done.
 	# A message with an NSEC3 with larger count is marked insecure.
@@ -356,7 +360,7 @@ server:
 	# the number of slabs must be a power of 2.
 	# more slabs reduce lock contention, but fragment memory usage.
 	# key-cache-slabs: 4
-	
+
 	# the amount of memory to use for the negative cache (used for DLV).
 	# plain value in bytes or you can append k, m or G. default is "1Mb". 
 	# neg-cache-size: 1m
@@ -235,6 +235,9 @@ o EDNS fallback. Is done according to the EDNS RFC (and update draft-00).
  It minimizes the chances of a dropped query making a (DNSSEC) EDNS server
  falsely EDNS-nonsupporting, and thus DNSSEC-bogus, works well with 
  middleboxes, and can detect the occasional authority that drops EDNS.
+  For some boxes it is necessary to probe for every failing query, a
+  reassurance that the DNS server does EDNS does not mean that path can
+  take large DNS answers.

 o 0x20 backoff.
  The draft describes to back off to the next server, and go through all
@@ -563,6 +563,13 @@ indeterminate or unchecked are not affected. Default is yes. Use this setting
 to protect the users that rely on this validator for authentication from 
 protentially bad data in the additional section.
 .TP
+.B val\-log\-level: \fI<number>
+Have the validator print validation failures to the log.  Regardless of the
+verbosity setting.  Default is 0, off. At 1, for every user query that fails
+a line is printed to the logs.  This way you can monitor what happens with
+validation.  Use a diagnosis tool, such as dig or drill, to find out why 
+validation is failing for these queries.
+.TP
 .B val\-permissive\-mode: \fI<yes or no>
 Instruct the validator to mark bogus messages as indeterminate. The security
 checks are performed, but if the result is bogus (failed security), the
@@ -1,251 +1,519 @@
 #!/bin/sh
-#
 # install - install a program, script, or datafile
-# This comes from X11R5 (mit/util/scripts/install.sh).
+
+scriptversion=2006-12-25.00
+
+# This originates from X11R5 (mit/util/scripts/install.sh), which was
+# later released in X11R6 (xc/config/util/install.sh) with the
+# following copyright and license.
 #
-# Copyright 1991 by the Massachusetts Institute of Technology
+# Copyright (C) 1994 X Consortium
 #
-# Permission to use, copy, modify, distribute, and sell this software and its
-# documentation for any purpose is hereby granted without fee, provided that
-# the above copyright notice appear in all copies and that both that
-# copyright notice and this permission notice appear in supporting
-# documentation, and that the name of M.I.T. not be used in advertising or
-# publicity pertaining to distribution of the software without specific,
-# written prior permission.  M.I.T. makes no representations about the
-# suitability of this software for any purpose.  It is provided "as is"
-# without express or implied warranty.
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to
+# deal in the Software without restriction, including without limitation the
+# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+# sell copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
+# X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
+# AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC-
+# TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+#
+# Except as contained in this notice, the name of the X Consortium shall not
+# be used in advertising or otherwise to promote the sale, use or other deal-
+# ings in this Software without prior written authorization from the X Consor-
+# tium.
+#
+#
+# FSF changes to this file are in the public domain.
 #
 # Calling this script install-sh is preferred over install.sh, to prevent
 # `make' implicit rules from creating a file called install from it
 # when there is no Makefile.
 #
 # This script is compatible with the BSD install script, but was written
-# from scratch.  It can only install one file at a time, a restriction
-# shared with many OS's install programs.
+# from scratch.

+nl='
+'
+IFS=" ""	$nl"

 # set DOITPROG to echo to test this script

 # Don't use :- since 4.3BSD and earlier shells don't like it.
-doit="${DOITPROG-}"
-
-
-# put in absolute paths if you don't have them in your path; or use env. vars.
-
-mvprog="${MVPROG-mv}"
-cpprog="${CPPROG-cp}"
-chmodprog="${CHMODPROG-chmod}"
-chownprog="${CHOWNPROG-chown}"
-chgrpprog="${CHGRPPROG-chgrp}"
-stripprog="${STRIPPROG-strip}"
-rmprog="${RMPROG-rm}"
-mkdirprog="${MKDIRPROG-mkdir}"
-
-transformbasename=""
-transform_arg=""
-instcmd="$mvprog"
-chmodcmd="$chmodprog 0755"
-chowncmd=""
-chgrpcmd=""
-stripcmd=""
-rmcmd="$rmprog -f"
-mvcmd="$mvprog"
-src=""
-dst=""
-dir_arg=""
-
-while [ x"$1" != x ]; do
-    case $1 in
-	-c) instcmd="$cpprog"
-	    shift
-	    continue;;
-
-	-d) dir_arg=true
-	    shift
-	    continue;;
-
-	-m) chmodcmd="$chmodprog $2"
-	    shift
-	    shift
-	    continue;;
-
-	-o) chowncmd="$chownprog $2"
-	    shift
-	    shift
-	    continue;;
-
-	-g) chgrpcmd="$chgrpprog $2"
-	    shift
-	    shift
-	    continue;;
-
-	-s) stripcmd="$stripprog"
-	    shift
-	    continue;;
-
-	-t=*) transformarg=`echo $1 | sed 's/-t=//'`
-	    shift
-	    continue;;
-
-	-b=*) transformbasename=`echo $1 | sed 's/-b=//'`
-	    shift
-	    continue;;
-
-	*)  if [ x"$src" = x ]
-	    then
-		src=$1
-	    else
-		# this colon is to work around a 386BSD /bin/sh bug
-		:
-		dst=$1
-	    fi
-	    shift
-	    continue;;
-    esac
-done
-
-if [ x"$src" = x ]
-then
-	echo "install:	no input file specified"
-	exit 1
+doit=${DOITPROG-}
+if test -z "$doit"; then
+  doit_exec=exec
 else
-	true
+  doit_exec=$doit
 fi

-if [ x"$dir_arg" != x ]; then
-	dst=$src
-	src=""
-	
-	if [ -d $dst ]; then
-		instcmd=:
-		chmodcmd=""
-	else
-		instcmd=mkdir
-	fi
-else
+# Put in absolute file names if you don't have them in your path;
+# or use environment vars.

-# Waiting for this to be detected by the "$instcmd $src $dsttmp" command
-# might cause directories to be created, which would be especially bad 
-# if $src (and thus $dsttmp) contains '*'.
+chgrpprog=${CHGRPPROG-chgrp}
+chmodprog=${CHMODPROG-chmod}
+chownprog=${CHOWNPROG-chown}
+cmpprog=${CMPPROG-cmp}
+cpprog=${CPPROG-cp}
+mkdirprog=${MKDIRPROG-mkdir}
+mvprog=${MVPROG-mv}
+rmprog=${RMPROG-rm}
+stripprog=${STRIPPROG-strip}

-	if [ -f $src -o -d $src ]
-	then
-		true
-	else
-		echo "install:  $src does not exist"
-		exit 1
-	fi
-	
-	if [ x"$dst" = x ]
-	then
-		echo "install:	no destination specified"
-		exit 1
-	else
-		true
-	fi
-
-# If destination is a directory, append the input filename; if your system
-# does not like double slashes in filenames, you may need to add some logic
-
-	if [ -d $dst ]
-	then
-		dst="$dst"/`basename $src`
-	else
-		true
-	fi
-fi
-
-## this sed command emulates the dirname command
-dstdir=`echo $dst | sed -e 's,[^/]*$,,;s,/$,,;s,^$,.,'`
-
-# Make sure that the destination directory exists.
-#  this part is taken from Noah Friedman's mkinstalldirs script
-
-# Skip lots of stat calls in the usual case.
-if [ ! -d "$dstdir" ]; then
-defaultIFS='	
+posix_glob='?'
+initialize_posix_glob='
+  test "$posix_glob" != "?" || {
+    if (set -f) 2>/dev/null; then
+      posix_glob=
+    else
+      posix_glob=:
+    fi
+  }
 '
-IFS="${IFS-${defaultIFS}}"

-oIFS="${IFS}"
-# Some sh's can't handle IFS=/ for some reason.
-IFS='%'
-set - `echo ${dstdir} | sed -e 's@/@%@g' -e 's@^%@/@'`
-IFS="${oIFS}"
+posix_mkdir=

-pathcomp=''
+# Desired mode of installed file.
+mode=0755

-while [ $# -ne 0 ] ; do
-	pathcomp="${pathcomp}${1}"
-	shift
+chgrpcmd=
+chmodcmd=$chmodprog
+chowncmd=
+mvcmd=$mvprog
+rmcmd="$rmprog -f"
+stripcmd=

-	if [ ! -d "${pathcomp}" ] ;
-        then
-		$mkdirprog "${pathcomp}"
-	else
-		true
-	fi
+src=
+dst=
+dir_arg=
+dst_arg=

-	pathcomp="${pathcomp}/"
+copy_on_change=false
+no_target_directory=
+
+usage="\
+Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
+   or: $0 [OPTION]... SRCFILES... DIRECTORY
+   or: $0 [OPTION]... -t DIRECTORY SRCFILES...
+   or: $0 [OPTION]... -d DIRECTORIES...
+
+In the 1st form, copy SRCFILE to DSTFILE.
+In the 2nd and 3rd, copy all SRCFILES to DIRECTORY.
+In the 4th, create DIRECTORIES.
+
+Options:
+     --help     display this help and exit.
+     --version  display version info and exit.
+
+  -c            (ignored)
+  -C            install only if different (preserve the last data modification time)
+  -d            create directories instead of installing files.
+  -g GROUP      $chgrpprog installed files to GROUP.
+  -m MODE       $chmodprog installed files to MODE.
+  -o USER       $chownprog installed files to USER.
+  -s            $stripprog installed files.
+  -t DIRECTORY  install into DIRECTORY.
+  -T            report an error if DSTFILE is a directory.
+
+Environment variables override the default commands:
+  CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
+  RMPROG STRIPPROG
+"
+
+while test $# -ne 0; do
+  case $1 in
+    -c) ;;
+
+    -C) copy_on_change=true;;
+
+    -d) dir_arg=true;;
+
+    -g) chgrpcmd="$chgrpprog $2"
+	shift;;
+
+    --help) echo "$usage"; exit $?;;
+
+    -m) mode=$2
+	case $mode in
+	  *' '* | *'	'* | *'
+'*	  | *'*'* | *'?'* | *'['*)
+	    echo "$0: invalid mode: $mode" >&2
+	    exit 1;;
+	esac
+	shift;;
+
+    -o) chowncmd="$chownprog $2"
+	shift;;
+
+    -s) stripcmd=$stripprog;;
+
+    -t) dst_arg=$2
+	shift;;
+
+    -T) no_target_directory=true;;
+
+    --version) echo "$0 $scriptversion"; exit $?;;
+
+    --)	shift
+	break;;
+
+    -*)	echo "$0: invalid option: $1" >&2
+	exit 1;;
+
+    *)  break;;
+  esac
+  shift
 done
+
+if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
+  # When -d is used, all remaining arguments are directories to create.
+  # When -t is used, the destination is already specified.
+  # Otherwise, the last argument is the destination.  Remove it from $@.
+  for arg
+  do
+    if test -n "$dst_arg"; then
+      # $@ is not empty: it contains at least $arg.
+      set fnord "$@" "$dst_arg"
+      shift # fnord
+    fi
+    shift # arg
+    dst_arg=$arg
+  done
 fi

-if [ x"$dir_arg" != x ]
-then
-	$doit $instcmd $dst &&
+if test $# -eq 0; then
+  if test -z "$dir_arg"; then
+    echo "$0: no input file specified." >&2
+    exit 1
+  fi
+  # It's OK to call `install-sh -d' without argument.
+  # This can happen when creating conditional directories.
+  exit 0
+fi

-	if [ x"$chowncmd" != x ]; then $doit $chowncmd $dst; else true ; fi &&
-	if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dst; else true ; fi &&
-	if [ x"$stripcmd" != x ]; then $doit $stripcmd $dst; else true ; fi &&
-	if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dst; else true ; fi
-else
+if test -z "$dir_arg"; then
+  trap '(exit $?); exit' 1 2 13 15

-# If we're going to rename the final executable, determine the name now.
+  # Set umask so as not to create temps with too-generous modes.
+  # However, 'strip' requires both read and write access to temps.
+  case $mode in
+    # Optimize common cases.
+    *644) cp_umask=133;;
+    *755) cp_umask=22;;

-	if [ x"$transformarg" = x ] 
-	then
-		dstfile=`basename $dst`
+    *[0-7])
+      if test -z "$stripcmd"; then
+	u_plus_rw=
+      else
+	u_plus_rw='% 200'
+      fi
+      cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;;
+    *)
+      if test -z "$stripcmd"; then
+	u_plus_rw=
+      else
+	u_plus_rw=,u+rw
+      fi
+      cp_umask=$mode$u_plus_rw;;
+  esac
+fi
+
+for src
+do
+  # Protect names starting with `-'.
+  case $src in
+    -*) src=./$src;;
+  esac
+
+  if test -n "$dir_arg"; then
+    dst=$src
+    dstdir=$dst
+    test -d "$dstdir"
+    dstdir_status=$?
+  else
+
+    # Waiting for this to be detected by the "$cpprog $src $dsttmp" command
+    # might cause directories to be created, which would be especially bad
+    # if $src (and thus $dsttmp) contains '*'.
+    if test ! -f "$src" && test ! -d "$src"; then
+      echo "$0: $src does not exist." >&2
+      exit 1
+    fi
+
+    if test -z "$dst_arg"; then
+      echo "$0: no destination specified." >&2
+      exit 1
+    fi
+
+    dst=$dst_arg
+    # Protect names starting with `-'.
+    case $dst in
+      -*) dst=./$dst;;
+    esac
+
+    # If destination is a directory, append the input filename; won't work
+    # if double slashes aren't ignored.
+    if test -d "$dst"; then
+      if test -n "$no_target_directory"; then
+	echo "$0: $dst_arg: Is a directory" >&2
+	exit 1
+      fi
+      dstdir=$dst
+      dst=$dstdir/`basename "$src"`
+      dstdir_status=0
+    else
+      # Prefer dirname, but fall back on a substitute if dirname fails.
+      dstdir=`
+	(dirname "$dst") 2>/dev/null ||
+	expr X"$dst" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
+	     X"$dst" : 'X\(//\)[^/]' \| \
+	     X"$dst" : 'X\(//\)$' \| \
+	     X"$dst" : 'X\(/\)' \| . 2>/dev/null ||
+	echo X"$dst" |
+	    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
+		   s//\1/
+		   q
+		 }
+		 /^X\(\/\/\)[^/].*/{
+		   s//\1/
+		   q
+		 }
+		 /^X\(\/\/\)$/{
+		   s//\1/
+		   q
+		 }
+		 /^X\(\/\).*/{
+		   s//\1/
+		   q
+		 }
+		 s/.*/./; q'
+      `
+
+      test -d "$dstdir"
+      dstdir_status=$?
+    fi
+  fi
+
+  obsolete_mkdir_used=false
+
+  if test $dstdir_status != 0; then
+    case $posix_mkdir in
+      '')
+	# Create intermediate dirs using mode 755 as modified by the umask.
+	# This is like FreeBSD 'install' as of 1997-10-28.
+	umask=`umask`
+	case $stripcmd.$umask in
+	  # Optimize common cases.
+	  *[2367][2367]) mkdir_umask=$umask;;
+	  .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
+
+	  *[0-7])
+	    mkdir_umask=`expr $umask + 22 \
+	      - $umask % 100 % 40 + $umask % 20 \
+	      - $umask % 10 % 4 + $umask % 2
+	    `;;
+	  *) mkdir_umask=$umask,go-w;;
+	esac
+
+	# With -d, create the new directory with the user-specified mode.
+	# Otherwise, rely on $mkdir_umask.
+	if test -n "$dir_arg"; then
+	  mkdir_mode=-m$mode
 	else
-		dstfile=`basename $dst $transformbasename | 
-			sed $transformarg`$transformbasename
+	  mkdir_mode=
 	fi

-# don't allow the sed command to completely eliminate the filename
+	posix_mkdir=false
+	case $umask in
+	  *[123567][0-7][0-7])
+	    # POSIX mkdir -p sets u+wx bits regardless of umask, which
+	    # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
+	    ;;
+	  *)
+	    tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
+	    trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0

-	if [ x"$dstfile" = x ] 
-	then
-		dstfile=`basename $dst`
+	    if (umask $mkdir_umask &&
+		exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
+	    then
+	      if test -z "$dir_arg" || {
+		   # Check for POSIX incompatibilities with -m.
+		   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
+		   # other-writeable bit of parent directory when it shouldn't.
+		   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
+		   ls_ld_tmpdir=`ls -ld "$tmpdir"`
+		   case $ls_ld_tmpdir in
+		     d????-?r-*) different_mode=700;;
+		     d????-?--*) different_mode=755;;
+		     *) false;;
+		   esac &&
+		   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
+		     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
+		     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
+		   }
+		 }
+	      then posix_mkdir=:
+	      fi
+	      rmdir "$tmpdir/d" "$tmpdir"
+	    else
+	      # Remove any dirs left behind by ancient mkdir implementations.
+	      rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
+	    fi
+	    trap '' 0;;
+	esac;;
+    esac
+
+    if
+      $posix_mkdir && (
+	umask $mkdir_umask &&
+	$doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
+      )
+    then :
+    else
+
+      # The umask is ridiculous, or mkdir does not conform to POSIX,
+      # or it failed possibly due to a race condition.  Create the
+      # directory the slow way, step by step, checking for races as we go.
+
+      case $dstdir in
+	/*) prefix='/';;
+	-*) prefix='./';;
+	*)  prefix='';;
+      esac
+
+      eval "$initialize_posix_glob"
+
+      oIFS=$IFS
+      IFS=/
+      $posix_glob set -f
+      set fnord $dstdir
+      shift
+      $posix_glob set +f
+      IFS=$oIFS
+
+      prefixes=
+
+      for d
+      do
+	test -z "$d" && continue
+
+	prefix=$prefix$d
+	if test -d "$prefix"; then
+	  prefixes=
 	else
-		true
+	  if $posix_mkdir; then
+	    (umask=$mkdir_umask &&
+	     $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
+	    # Don't fail if two instances are running concurrently.
+	    test -d "$prefix" || exit 1
+	  else
+	    case $prefix in
+	      *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
+	      *) qprefix=$prefix;;
+	    esac
+	    prefixes="$prefixes '$qprefix'"
+	  fi
 	fi
+	prefix=$prefix/
+      done

-# Make a temp file name in the proper directory.
+      if test -n "$prefixes"; then
+	# Don't fail if two instances are running concurrently.
+	(umask $mkdir_umask &&
+	 eval "\$doit_exec \$mkdirprog $prefixes") ||
+	  test -d "$dstdir" || exit 1
+	obsolete_mkdir_used=true
+      fi
+    fi
+  fi

-	dsttmp=$dstdir/#inst.$$#
+  if test -n "$dir_arg"; then
+    { test -z "$chowncmd" || $doit $chowncmd "$dst"; } &&
+    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } &&
+    { test "$obsolete_mkdir_used$chowncmd$chgrpcmd" = false ||
+      test -z "$chmodcmd" || $doit $chmodcmd $mode "$dst"; } || exit 1
+  else

-# Move or copy the file name to the temp name
+    # Make a couple of temp file names in the proper directory.
+    dsttmp=$dstdir/_inst.$$_
+    rmtmp=$dstdir/_rm.$$_

-	$doit $instcmd $src $dsttmp &&
+    # Trap to clean up those temp files at exit.
+    trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0

-	trap "rm -f ${dsttmp}" 0 &&
+    # Copy the file name to the temp name.
+    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&

-# and set any options; do chmod last to preserve setuid bits
+    # and set any options; do chmod last to preserve setuid bits.
+    #
+    # If any of these fail, we abort the whole thing.  If we want to
+    # ignore errors from any of these, just make sure not to ignore
+    # errors from the above "$doit $cpprog $src $dsttmp" command.
+    #
+    { test -z "$chowncmd" || $doit $chowncmd "$dsttmp"; } &&
+    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dsttmp"; } &&
+    { test -z "$stripcmd" || $doit $stripcmd "$dsttmp"; } &&
+    { test -z "$chmodcmd" || $doit $chmodcmd $mode "$dsttmp"; } &&

-# If any of these fail, we abort the whole thing.  If we want to
-# ignore errors from any of these, just make sure not to ignore
-# errors from the above "$doit $instcmd $src $dsttmp" command.
+    # If -C, don't bother to copy if it wouldn't change the file.
+    if $copy_on_change &&
+       old=`LC_ALL=C ls -dlL "$dst"	2>/dev/null` &&
+       new=`LC_ALL=C ls -dlL "$dsttmp"	2>/dev/null` &&

-	if [ x"$chowncmd" != x ]; then $doit $chowncmd $dsttmp; else true;fi &&
-	if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dsttmp; else true;fi &&
-	if [ x"$stripcmd" != x ]; then $doit $stripcmd $dsttmp; else true;fi &&
-	if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dsttmp; else true;fi &&
+       eval "$initialize_posix_glob" &&
+       $posix_glob set -f &&
+       set X $old && old=:$2:$4:$5:$6 &&
+       set X $new && new=:$2:$4:$5:$6 &&
+       $posix_glob set +f &&

-# Now rename the file to the real destination.
+       test "$old" = "$new" &&
+       $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
+    then
+      rm -f "$dsttmp"
+    else
+      # Rename the file to the real destination.
+      $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null ||

-	$doit $rmcmd -f $dstdir/$dstfile &&
-	$doit $mvcmd $dsttmp $dstdir/$dstfile 
+      # The rename failed, perhaps because mv can't rename something else
+      # to itself, or perhaps because mv is so ancient that it does not
+      # support -f.
+      {
+	# Now remove or move aside any old file at destination location.
+	# We try this two ways since rm can't unlink itself on some
+	# systems and the destination file might be busy for other
+	# reasons.  In this case, the final cleanup might fail but the new
+	# file should still install successfully.
+	{
+	  test ! -f "$dst" ||
+	  $doit $rmcmd -f "$dst" 2>/dev/null ||
+	  { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
+	    { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
+	  } ||
+	  { echo "$0: cannot unlink or rename $dst" >&2
+	    (exit 1); exit 1
+	  }
+	} &&

-fi &&
+	# Now rename the file to the real destination.
+	$doit $mvcmd "$dsttmp" "$dst"
+      }
+    fi || exit 1

+    trap '' 0
+  fi
+done

-exit 0
+# Local variables:
+# eval: (add-hook 'write-file-hooks 'time-stamp)
+# time-stamp-start: "scriptversion="
+# time-stamp-format: "%:y-%02m-%02d.%02H"
+# time-stamp-end: "$"
+# End:
@@ -68,6 +68,7 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 		return NULL;
 	if(!delegpt_set_name(copy, region, dp->name))
 		return NULL;
+	copy->bogus = dp->bogus;
 	for(ns = dp->nslist; ns; ns = ns->next) {
 		if(!delegpt_add_ns(copy, region, ns->name))
 			return NULL;
@@ -88,9 +88,10 @@ forwards_delete(struct iter_forwards* fwd)
 	free(fwd);
 }

-/** insert new info into forward structure */
+/** insert info into forward structure */
 static int
-forwards_insert(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
+forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm, 
+	size_t nmlen, int nmlabs, struct delegpt* dp)
 {
 	struct iter_forward_zone* node = regional_alloc(fwd->region,
 		sizeof(struct iter_forward_zone));
@@ -98,11 +99,11 @@ forwards_insert(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
 		return 0;
 	node->node.key = node;
 	node->dclass = c;
-	node->name = regional_alloc_init(fwd->region, dp->name, dp->namelen);
+	node->name = regional_alloc_init(fwd->region, nm, nmlen);
 	if(!node->name)
 		return 0;
-	node->namelen = dp->namelen;
-	node->namelabs = dp->namelabs;
+	node->namelen = nmlen;
+	node->namelabs = nmlabs;
 	node->dp = dp;
 	if(!rbtree_insert(fwd->tree, &node->node)) {
 		log_err("duplicate forward zone ignored.");
@@ -110,6 +111,14 @@ forwards_insert(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
 	return 1;
 }

+/** insert new info into forward structure given dp */
+static int
+forwards_insert(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
+{
+	return forwards_insert_data(fwd, c, dp->name, dp->namelen,
+		dp->namelabs, dp);
+}
+
 /** initialise parent pointers in the tree */
 static void
 fwd_init_parents(struct iter_forwards* fwd)
@@ -234,6 +243,56 @@ read_forwards(struct iter_forwards* fwd, struct config_file* cfg)
 	return 1;
 }

+/** see if zone needs to have a hole inserted */
+static int
+need_hole_insert(rbtree_t* tree, struct iter_forward_zone* zone)
+{
+	struct iter_forward_zone k;
+	if(rbtree_search(tree, zone))
+		return 0; /* exact match exists */
+	k = *zone;
+	k.node.key = &k;
+	/* search up the tree */
+	do {
+		dname_remove_label(&k.name, &k.namelen);
+		k.namelabs --;
+		if(rbtree_search(tree, &k))
+			return 1; /* found an upper forward zone, need hole */
+	} while(k.namelabs > 1);
+	return 0; /* no forwards above, no holes needed */
+}
+
+/** make NULL entries for stubs */
+static int
+make_stub_holes(struct iter_forwards* fwd, struct config_file* cfg)
+{
+	struct config_stub* s;
+	struct iter_forward_zone key;
+	key.node.key = &key;
+	key.dclass = LDNS_RR_CLASS_IN;
+	for(s = cfg->stubs; s; s = s->next) {
+		ldns_rdf* rdf = ldns_dname_new_frm_str(s->name);
+		if(!rdf) {
+			log_err("cannot parse stub name '%s'", s->name);
+			return 0;
+		}
+		key.name = ldns_rdf_data(rdf);
+		key.namelabs = dname_count_size_labels(key.name, &key.namelen);
+		if(!need_hole_insert(fwd->tree, &key)) {
+			ldns_rdf_deep_free(rdf);
+			continue;
+		}
+		if(!forwards_insert_data(fwd, key.dclass, key.name, 
+			key.namelen, key.namelabs, NULL)) {
+			ldns_rdf_deep_free(rdf);
+			log_err("out of memory");
+			return 0;
+		}
+		ldns_rdf_deep_free(rdf);
+	}
+	return 1;
+}
+
 int 
 forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
 {
@@ -246,6 +305,8 @@ forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
 	/* read forward zones */
 	if(!read_forwards(fwd, cfg))
 		return 0;
+	if(!make_stub_holes(fwd, cfg))
+		return 0;
 	fwd_init_parents(fwd);
 	return 1;
 }
@@ -284,6 +345,13 @@ forwards_lookup(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
 	return NULL;
 }

+struct delegpt* 
+forwards_lookup_root(struct iter_forwards* fwd, uint16_t qclass)
+{
+	uint8_t root = 0;
+	return forwards_lookup(fwd, &root, qclass);
+}
+
 size_t 
 forwards_get_mem(struct iter_forwards* fwd)
 {
@@ -75,7 +75,9 @@ struct iter_forward_zone {
 	size_t namelen;
 	/** number of labels in name */
 	int namelabs;
-	/** delegation point with forward server information for this zone. */
+	/** delegation point with forward server information for this zone. 
+	 * If NULL then this forward entry is used to indicate that a
+	 * stub-zone with the same name exists, and should be used. */
 	struct delegpt* dp;
 	/** pointer to parent in tree (or NULL if none) */
 	struct iter_forward_zone* parent;
@@ -117,6 +119,15 @@ int forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg);
 struct delegpt* forwards_lookup(struct iter_forwards* fwd, 
 	uint8_t* qname, uint16_t qclass);

+/**
+ * Same as forwards_lookup, but for the root only
+ * @param fwd: forward storage.
+ * @param qclass: The qclass of the query.
+ * @return: A delegation point if root forward exists, otherwise null.
+ */
+struct delegpt* forwards_lookup_root(struct iter_forwards* fwd, 
+	uint16_t qclass);
+
 /**
 * Get memory in use by forward storage
 * @param fwd: forward storage.
@@ -210,43 +210,50 @@ size_t priv_get_mem(struct iter_priv* priv)
 int priv_rrset_bad(struct iter_priv* priv, ldns_buffer* pkt,
 	struct rrset_parse* rrset)
 {
+	if(priv->a.count == 0) 
+		return 0; /* there are no blocked addresses */
+
 	/* see if it is a private name, that is allowed to have any */
 	if(priv_lookup_name(priv, pkt, rrset->dname, rrset->dname_len,
 		ntohs(rrset->rrset_class))) {
 		return 0;
 	} else {
 		/* so its a public name, check the address */
-		struct sockaddr_storage addr;
 		socklen_t len;
 		struct rr_parse* rr;
 		if(rrset->type == LDNS_RR_TYPE_A) {
-			struct sockaddr_in* sa = (struct sockaddr_in*)&addr;
-			len = (socklen_t)sizeof(*sa);
-			memset(sa, 0, len);
-			sa->sin_family = AF_INET;
-			sa->sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
+			struct sockaddr_storage addr;
+			struct sockaddr_in sa;
+
+			len = (socklen_t)sizeof(sa);
+			memset(&sa, 0, len);
+			sa.sin_family = AF_INET;
+			sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
 			for(rr = rrset->rr_first; rr; rr = rr->next) {
 				if(ldns_read_uint16(rr->ttl_data+4) 
 					!= INET_SIZE)
 					continue;
-				memmove(&sa->sin_addr, rr->ttl_data+4+2, 
+				memmove(&sa.sin_addr, rr->ttl_data+4+2, 
 					INET_SIZE);
+				memmove(&addr, &sa, len);
 				if(priv_lookup_addr(priv, &addr, len))
 					return 1;
 			}
 		} else if(rrset->type == LDNS_RR_TYPE_AAAA) {
-			struct sockaddr_in6* sa = (struct sockaddr_in6*)&addr;
-			len = (socklen_t)sizeof(*sa);
-			memset(sa, 0, len);
-			sa->sin6_family = AF_INET6;
-			sa->sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
+			struct sockaddr_storage addr;
+			struct sockaddr_in6 sa;
+			len = (socklen_t)sizeof(sa);
+			memset(&sa, 0, len);
+			sa.sin6_family = AF_INET6;
+			sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
 			for(rr = rrset->rr_first; rr; rr = rr->next) {
 				if(ldns_read_uint16(rr->ttl_data+4) 
 					!= INET6_SIZE)
 					continue;
-				memmove(&sa->sin6_addr, rr->ttl_data+4+2, 
+				memmove(&sa.sin6_addr, rr->ttl_data+4+2, 
 					INET6_SIZE);
-				if(priv_lookup_addr(priv, &addr, len))
+				memmove(&addr, &sa, len);
+				if(priv_lookup_addr(priv, &addr, len)) 
 					return 1;
 			}
 		} 
@@ -233,7 +233,7 @@ iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
 static int
 iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
-	struct delegpt* dp, int* selected_rtt)
+	struct delegpt* dp, int* selected_rtt, int open_target)
 {
 	int got_num = 0, low_rtt = 0, swap_to_front;
 	struct delegpt_addr* a, *n, *prev=NULL;
@@ -244,7 +244,7 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 	if(got_num == 0) 
 		return 0;
 	if(low_rtt >= USEFUL_SERVER_TOP_TIMEOUT &&
-		delegpt_count_missing_targets(dp) > 0)
+		(delegpt_count_missing_targets(dp) > 0 || open_target > 0))
 		return 0; /* we want more choice. The best choice is a bad one.
 			     return 0 to force the caller to fetch more */

@@ -286,13 +286,13 @@ struct delegpt_addr*
 iter_server_selection(struct iter_env* iter_env, 
 	struct module_env* env, struct delegpt* dp, 
 	uint8_t* name, size_t namelen, uint16_t qtype, int* dnssec_expected,
-	int* chase_to_rd)
+	int* chase_to_rd, int open_target)
 {
 	int sel;
 	int selrtt;
 	struct delegpt_addr* a, *prev;
 	int num = iter_filter_order(iter_env, env, name, namelen, qtype,
-		*env->now, dp, &selrtt);
+		*env->now, dp, &selrtt, open_target);

 	if(num == 0)
 		return NULL;
@@ -79,13 +79,15 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
 *	these are not preferred, but are used as a last resort.
 * @param chase_to_rd: set to 1 if a known recursion lame server is selected
 * 	these are not preferred, but are used as a last resort.
+ * @param open_target: number of currently outstanding target queries.
+ * 	If we wait for these, perhaps more server addresses become available.
 * @return best target or NULL if no target.
 *	if not null, that target is removed from the result list in the dp.
 */
 struct delegpt_addr* iter_server_selection(struct iter_env* iter_env, 
 	struct module_env* env, struct delegpt* dp, uint8_t* name, 
 	size_t namelen, uint16_t qtype, int* dnssec_expected,
-	int* chase_to_rd);
+	int* chase_to_rd, int open_target);

 /**
 * Allocate dns_msg from parsed msg, in regional.
@@ -592,21 +592,27 @@ prime_root(struct module_qstate* qstate, struct iter_qstate* iq,
 * @param iq: iterator query state.
 * @param ie: iterator global state.
 * @param id: module id.
- * @param qname: request name.
- * @param qclass: the class to prime.
+ * @param q: request name.
 * @return true if a priming subrequest was made, false if not. The will only
 *         issue a priming request if it detects an unprimed stub.
 */
 static int
 prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, 
-	struct iter_env* ie, int id, uint8_t* qname, uint16_t qclass)
+	struct iter_env* ie, int id, struct query_info* q)
 {
 	/* Lookup the stub hint. This will return null if the stub doesn't 
 	 * need to be re-primed. */
-	struct iter_hints_stub* stub = hints_lookup_stub(ie->hints, 
-		qname, qclass, iq->dp);
+	struct iter_hints_stub* stub;
 	struct delegpt* stub_dp;
 	struct module_qstate* subq;
+	uint8_t* delname = q->qname;
+	size_t delnamelen = q->qname_len;
+
+	if(q->qtype == LDNS_RR_TYPE_DS && !dname_is_root(q->qname))
+		/* remove first label, but not for root */
+		dname_remove_label(&delname, &delnamelen);
+
+	stub = hints_lookup_stub(ie->hints, delname, q->qclass, iq->dp);
 	/* The stub (if there is one) does not need priming. */
 	if(!stub)
 		return 0;
@@ -623,18 +629,18 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq,
 			return 1; /* return 1 to make module stop, with error */
 		}
 		log_nametypeclass(VERB_DETAIL, "use stub", stub_dp->name, 
-			LDNS_RR_TYPE_NS, qclass);
+			LDNS_RR_TYPE_NS, q->qclass);
 		return 0;
 	}

 	/* Otherwise, we need to (re)prime the stub. */
 	log_nametypeclass(VERB_DETAIL, "priming stub", stub_dp->name, 
-		LDNS_RR_TYPE_NS, qclass);
+		LDNS_RR_TYPE_NS, q->qclass);

 	/* Stub priming events start at the QUERYTARGETS state to avoid the
 	 * redundant INIT state processing. */
 	if(!generate_sub_request(stub_dp->name, stub_dp->namelen, 
-		LDNS_RR_TYPE_NS, qclass, qstate, id, iq,
+		LDNS_RR_TYPE_NS, q->qclass, qstate, id, iq,
 		QUERYTARGETS_STATE, PRIME_RESP_STATE, &subq, 0)) {
 		verbose(VERB_ALGO, "could not prime stub");
 		(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
@@ -781,8 +787,14 @@ generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id)
 static int
 forward_request(struct module_qstate* qstate, struct iter_qstate* iq)
 {
-	struct delegpt* dp = forwards_lookup(qstate->env->fwds, 
-		iq->qchase.qname, iq->qchase.qclass);
+	struct delegpt* dp;
+	uint8_t* delname = iq->qchase.qname;
+	size_t delnamelen = iq->qchase.qname_len;
+	/* strip one label off of DS query to lookup higher for it */
+	if(iq->qchase.qtype == LDNS_RR_TYPE_DS 
+		&& !dname_is_root(iq->qchase.qname))
+		dname_remove_label(&delname, &delnamelen);
+	dp = forwards_lookup(qstate->env->fwds, delname, iq->qchase.qclass);
 	if(!dp) 
 		return 0;
 	/* send recursion desired to forward addr */
@@ -939,6 +951,25 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* If the cache has returned nothing, then we have a 
 		 * root priming situation. */
 		if(iq->dp == NULL) {
+			if(forwards_lookup_root(qstate->env->fwds, 
+				iq->qchase.qclass)) {
+				/* forward zone root, no root prime needed */
+				/* fill in some dp - safety belt */
+				iq->dp = hints_lookup_root(ie->hints, 
+					iq->qchase.qclass);
+				if(!iq->dp) {
+					log_err("internal error: no hints dp");
+					return error_response(qstate, id, 
+						LDNS_RCODE_SERVFAIL);
+				}
+				iq->dp = delegpt_copy(iq->dp, qstate->region);
+				if(!iq->dp) {
+					log_err("out of memory in safety belt");
+					return error_response(qstate, id, 
+						LDNS_RCODE_SERVFAIL);
+				}
+				return next_state(iq, INIT_REQUEST_2_STATE);
+			}
 			/* Note that the result of this will set a new
 			 * DelegationPoint based on the result of priming. */
 			if(!prime_root(qstate, iq, ie, id, iq->qchase.qclass))
@@ -1030,8 +1061,7 @@ processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq,
 		&qstate->qinfo);

 	/* Check to see if we need to prime a stub zone. */
-	if(prime_stub(qstate, iq, ie, id, iq->qchase.qname, 
-		iq->qchase.qclass)) {
+	if(prime_stub(qstate, iq, ie, id, &iq->qchase)) {
 		/* A priming sub request was made */
 		return 0;
 	}
@@ -1258,7 +1288,10 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}

 	tf_policy = 0;
-	if(iq->depth <= ie->max_dependency_depth) {
+	/* < not <=, because although the array is large enough for <=, the
+	 * generated query will immediately be discarded due to depth and
+	 * that servfail is cached, which is not good as opportunism goes. */
+	if(iq->depth < ie->max_dependency_depth) {
 		tf_policy = ie->target_fetch_policy[iq->depth];
 	}

@@ -1312,7 +1345,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	/* Select the next usable target, filtering out unsuitable targets. */
 	target = iter_server_selection(ie, qstate->env, iq->dp, 
 		iq->dp->name, iq->dp->namelen, iq->qchase.qtype,
-		&iq->dnssec_expected, &iq->chase_to_rd);
+		&iq->dnssec_expected, &iq->chase_to_rd, iq->num_target_queries);

 	/* If no usable target was selected... */
 	if(!target) {
@@ -1499,9 +1532,14 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			   /* we know that all other NS rrsets are scrubbed
 			    * away, thus on referral only one is left.
 			    * see if that equals the query name... */
-			&& reply_find_rrset_section_ns(iq->response->rep,
+			&& ( /* auth section, but sometimes in answer section*/
+			  reply_find_rrset_section_ns(iq->response->rep,
 				qstate->qinfo.qname, qstate->qinfo.qname_len,
 				LDNS_RR_TYPE_NS, qstate->qinfo.qclass)
+			  || reply_find_rrset_section_an(iq->response->rep,
+				qstate->qinfo.qname, qstate->qinfo.qname_len,
+				LDNS_RR_TYPE_NS, qstate->qinfo.qclass)
+			  )
 		    )) {
 			/* Store the referral under the current query */
 			if(!iter_dns_store(qstate->env, &iq->response->qinfo,
@@ -458,8 +458,7 @@ libworker_fillup_fg(struct ctx_query* q, int rcode, ldns_buffer* buf,
 	libworker_enter_result(q->res, buf, q->w->env->scratch, s);
 }

-/** callback with fg results */
-static void
+void
 libworker_fg_done_cb(void* arg, int rcode, ldns_buffer* buf, enum sec_status s)
 {
 	struct ctx_query* q = (struct ctx_query*)arg;
@@ -574,8 +573,7 @@ add_bg_result(struct libworker* w, struct ctx_query* q, ldns_buffer* pkt,
 	}
 }

-/** callback with bg results */
-static void
+void
 libworker_bg_done_cb(void* arg, int rcode, ldns_buffer* buf, enum sec_status s)
 {
 	struct ctx_query* q = (struct ctx_query*)arg;
@@ -156,6 +156,14 @@ void libworker_handle_control_cmd(struct tube* tube, uint8_t* msg, size_t len,
 void libworker_handle_result_write(struct tube* tube, uint8_t* msg, size_t len,
 	int err, void* arg);

+/** mesh callback with fg results */
+void libworker_fg_done_cb(void* arg, int rcode, ldns_buffer* buf, 
+	enum sec_status s);
+
+/** mesh callback with bg results */
+void libworker_bg_done_cb(void* arg, int rcode, ldns_buffer* buf, 
+	enum sec_status s);
+
 /** 
 * fill result from parsed message, on error fills servfail 
 * @param res: is clear at start, filled in at end.
@@ -42,26 +42,27 @@ help:

 .PHONY: testenv clean doc swig

-_unbound.so:	../../Makefile
-	$(MAKE) -C ../..
+#_unbound.so:	../../Makefile
+	#$(MAKE) -C ../..

-../../.libs/libunbound.so.0:	../../Makefile
-	$(MAKE) -C ../..
+#../../.libs/libunbound.so.0:	../../Makefile
+	#$(MAKE) -C ../..

-../../ldns-src/lib/libldns.so:	../../ldns-src/Makefile
-	$(MAKE) -C ../../ldns-src
+#../../ldns-src/lib/libldns.so:	../../ldns-src/Makefile
+	#$(MAKE) -C ../../ldns-src

 clean:
 	rm -rdf examples/unbound
 	rm -f _unbound.so libunbound_wrap.o
 	$(MAKE) -C ../.. clean

-testenv: ../../.libs/libunbound.so.0 ../../ldns-src/lib/libldns.so _unbound.so
+testenv: ../../.libs/libunbound.so.1 ../../ldns-src/lib/libldns.so ../../.libs/_unbound.so
 	rm -rdf examples/unbound
 	cd examples && mkdir unbound && ln -s ../../unbound.py unbound/__init__.py && ln -s ../../_unbound.so unbound/_unbound.so && ln -s ../../../../.libs/libunbound.so.1 unbound/libunbound.so.1 && ln -s ../../../../ldns-src/lib/libldns.so.1 unbound/libldns.so.1 && ls -la
+	cd examples && if test -f ../../../.libs/_unbound.so; then cp ../../../.libs/_unbound.so . ; fi
 	@echo "Run a script by typing ./script_name.py"
 	cd examples && LD_LIBRARY_PATH=unbound bash
-	rm -rdf examples/unbound
+	rm -rdf examples/unbound examples/_unbound.so

 doc: ../../.libs/libunbound.so.0 _unbound.so
 	$(MAKE) -C docs html
@@ -107,6 +107,27 @@ replace_all () {
    replace_text "$1" "@date@" "`date +'%b %e, %Y'`"
 }
    
+check_svn_root () {
+    # Check if SVNROOT is specified.
+    if [ -z "$SVNROOT" ]; then
+	if test -f .svn/entries; then
+	      eval `svn info | grep 'URL:' | sed -e 's/URL: /url=/' | head -1`
+	      SVNROOT="$url"
+	fi
+	if test -z "$SVNROOT"; then
+	    error "SVNROOT must be specified (using -d)"
+	fi
+    fi
+}
+
+create_temp_dir () {
+    # Creating temp directory
+    info "Creating temporary working directory"
+    temp_dir=`mktemp -d unbound-dist-XXXXXX`
+    info "Directory '$temp_dir' created."
+    cd $temp_dir
+}
+

 SNAPSHOT="no"
 RC="no"
@@ -147,6 +168,30 @@ while [ "$1" ]; do
 done

 if [ "$DOWIN" = "yes" ]; then
+    # detect crosscompile, from Fedora11 at this point.
+    if test "`uname`" = "Linux"; then 
+	info "Crosscompile windows dist"
+        cross="yes"
+	configure="mingw32-configure"
+	strip="i686-pc-mingw32-strip"
+	makensis="makensis"	# from mingw32-nsis package
+
+	check_svn_root
+	create_temp_dir
+	info "Exporting source from SVN."
+	svn export "$SVNROOT" unbound || error_cleanup "SVN command failed"
+	cd unbound || error_cleanup "Unbound not exported correctly from SVN"
+
+	# on a re-configure the cache may no longer be valid...
+	if test -f mingw32-config.cache; then rm mingw32-config.cache; fi
+    else 
+	cross="no"	# mingw and msys
+	configure="./configure"
+	strip="strip"
+	makensis="c:/Program Files/NSIS/makensis.exe" # http://nsis.sf.net
+    fi
+
+    # version gets compiled into source, edit the configure to set  it
    version=`./configure --version | head -1 | awk '{ print $3 }'` \
 	|| error_cleanup "Cannot determine version number."
    if [ "$RC" != "no" -o "$SNAPSHOT" != "no" ]; then
@@ -168,8 +213,8 @@ if [ "$DOWIN" = "yes" ]; then
    # procedure for making unbound installer on mingw. 
    info "Creating windows dist unbound $version"
    info "Calling configure"
-    echo './configure --enable-debug --enable-static-exe '"$*"
-    ./configure --enable-debug --enable-static-exe $* \
+    echo "$configure"' --enable-debug --enable-static-exe '"$*"
+    $configure --enable-debug --enable-static-exe $* \
 	|| error_cleanup "Could not configure"
    info "Calling make"
    make || error_cleanup "Could not make"
@@ -180,13 +225,13 @@ if [ "$DOWIN" = "yes" ]; then
    rm -f $file
    info "Creating $file"
    mkdir tmp.$$
-    strip unbound.exe
-    strip anchor-update.exe
-    strip unbound-control.exe
-    strip unbound-host.exe
-    strip unbound-checkconf.exe
-    strip unbound-service-install.exe
-    strip unbound-service-remove.exe
+    $strip unbound.exe
+    $strip anchor-update.exe
+    $strip unbound-control.exe
+    $strip unbound-host.exe
+    $strip unbound-checkconf.exe
+    $strip unbound-service-install.exe
+    $strip unbound-service-remove.exe
    cd tmp.$$
    cp ../doc/example.conf example.conf
    cp ../unbound.exe ../unbound-host.exe ../unbound-control.exe ../unbound-checkconf.exe ../unbound-service-install.exe ../unbound-service-remove.exe ../LICENSE ../winrc/unbound-website.url ../winrc/service.conf ../winrc/README.txt .
@@ -198,28 +243,23 @@ if [ "$DOWIN" = "yes" ]; then
    info "Creating installer"
    quadversion=`cat ../config.h | grep RSRC_PACKAGE_VERSION | sed -e 's/#define RSRC_PACKAGE_VERSION //' -e 's/,/\\./g'`
    cat ../winrc/setup.nsi | sed -e 's/define VERSION.*$/define VERSION "'$version'"/' -e 's/define QUADVERSION.*$/define QUADVERSION "'$quadversion'"/' > ../winrc/setup_ed.nsi
-    # get tool from http://nsis.sf.net
-    c:/Program\ Files/NSIS/makensis.exe ../winrc/setup_ed.nsi
+    "$makensis" ../winrc/setup_ed.nsi
    info "Created installer"
    cd ..
    rm -rf tmp.$$
    mv winrc/unbound_setup_$version.exe .
+    if test "$cross" = "yes"; then
+	    mv unbound_setup_$version.exe $cwd/.
+	    mv unbound-$version.zip $cwd/.
+	    cleanup
+    fi
    ls -lG unbound_setup_$version.exe
    ls -lG unbound-$version.zip
    info "Done"
    exit 0
 fi

-# Check if SVNROOT is specified.
-if [ -z "$SVNROOT" ]; then
-    if test -f .svn/entries; then
-	  eval `svn info | grep 'URL:' | sed -e 's/URL: /url=/' | head -1`
-	  SVNROOT="$url"
-    fi
-    if test -z "$SVNROOT"; then
-	error "SVNROOT must be specified (using -d)"
-    fi
-fi
+check_svn_root
 # Check if LDNSDIR is specified.
 if test -z "$LDNSDIR"; then
    # try to autodetect from Makefile (if present)
@@ -237,12 +277,7 @@ info "SNAPSHOT is $SNAPSHOT"

 #question "Do you wish to continue with these settings?" || error "User abort."

-
-# Creating temp directory
-info "Creating temporary working directory"
-temp_dir=`mktemp -d unbound-dist-XXXXXX`
-info "Directory '$temp_dir' created."
-cd $temp_dir
+create_temp_dir

 info "Exporting source from SVN."
 svn export "$SVNROOT" unbound || error_cleanup "SVN command failed"
@@ -346,8 +381,21 @@ case $OSTYPE in
                sha256=`sha256  unbound-$version.tar.gz |  awk '{ print $5 }'`
                ;;
 	*)
-                sha=`sha1sum unbound-$version.tar.gz |  awk '{ print $1 }'`
-                sha256=`sha256sum unbound-$version.tar.gz |  awk '{ print $1 }'`
+		# in case $OSTYPE is gone.
+		case `uname` in
+		Linux*)
+		  sha=`sha1sum unbound-$version.tar.gz |  awk '{ print $1 }'`
+		  sha256=`sha256sum unbound-$version.tar.gz |  awk '{ print $1 }'`
+		  ;;
+		FreeBSD*)
+		  sha=`sha1  unbound-$version.tar.gz |  awk '{ print $5 }'`
+		  sha256=`sha256  unbound-$version.tar.gz |  awk '{ print $5 }'`
+		  ;;
+		*)
+		  sha=`sha1sum unbound-$version.tar.gz |  awk '{ print $1 }'`
+		  sha256=`sha256sum unbound-$version.tar.gz |  awk '{ print $1 }'`
+		  ;;
+		esac
                ;;
 esac
 echo $sha > unbound-$version.tar.gz.sha1
@@ -44,11 +44,58 @@
 #endif

 #include "config.h"
+
+#undef _POSIX_C_SOURCE
+#undef _XOPEN_SOURCE
+#include <Python.h>
+
 #include "pythonmod/pythonmod.h"
 #include "util/module.h"
 #include "util/config_file.h"
 #include "pythonmod_utils.h"
-#include <Python.h>
+
+#ifdef S_SPLINT_S
+typedef struct PyObject PyObject;
+#endif
+
+/**
+ * Global state for the module. 
+ */
+struct pythonmod_env {
+
+	/** Python script filename. */
+	const char* fname;
+
+	/** Python module. */
+	PyObject* module;
+
+	/** Module init function */
+	PyObject* func_init;
+	/** Module deinit function */
+	PyObject* func_deinit;
+	/** Module operate function */
+	PyObject* func_operate;
+	/** Module super_inform function */
+	PyObject* func_inform;
+
+	/** Python dictionary. */
+	PyObject* dict;
+
+	/** Module data. */
+	PyObject* data;
+
+	/** Module qstate. */
+	struct module_qstate* qstate;
+};
+
+/**
+ * Per query state for the iterator module.
+ */
+struct pythonmod_qstate {
+
+	/** Module per query data. */
+	PyObject* data;
+};

 /* Generated */
 #ifndef S_SPLINT_S
@@ -41,51 +41,6 @@
 #define PYTHONMOD_H
 #include "util/module.h"
 #include "services/outbound_list.h"
-#include <Python.h>
-
-struct PyObject;
-#if S_SPLINT_S
-typedef struct PyObject PyObject;
-#endif
-
-/**
- * Global state for the module. 
- */
-struct pythonmod_env {
-
-   /** Python script filename. */
-   const char* fname;
-
-   /** Python module. */
-   PyObject* module;
-
-   /** Module init function */
-   PyObject* func_init;
-   /** Module deinit function */
-   PyObject* func_deinit;
-   /** Module operate function */
-   PyObject* func_operate;
-   /** Module super_inform function */
-   PyObject* func_inform;
-
-   /** Python dictionary. */
-   PyObject* dict;
-
-   /** Module data. */
-   PyObject* data;
-
-   /** Module qstate. */
-   struct module_qstate* qstate;
-};
-
-/**
- * Per query state for the iterator module.
- */
-struct pythonmod_qstate {
-
-   /** Module per query data. */
-   PyObject* data;
-};

 /**
 * Get the module function block.
@@ -47,6 +47,9 @@
 #include "util/data/msgreply.h"
 #include "util/storage/slabhash.h"
 #include "util/regional.h"
+
+#undef _POSIX_C_SOURCE
+#undef _XOPEN_SOURCE
 #include <Python.h>

 /** Store the reply_info and query_info pair in message cache (qstate->msg_cache) */
@@ -40,6 +40,7 @@
 */
 #include "config.h"
 #include "iterator/iter_delegpt.h"
+#include "validator/val_nsec.h"
 #include "services/cache/dns.h"
 #include "services/cache/rrset.h"
 #include "util/data/msgreply.h"
@@ -286,6 +287,10 @@ find_add_ds(struct module_env* env, struct regional* region,
 		/* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used.
 		 * since this is a referral, we need the NSEC at the parent
 		 * side of the zone cut, not the NSEC at apex side. */
+		if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) {
+			lock_rw_unlock(&rrset->entry.lock);
+			rrset = NULL; /* discard wrong NSEC */
+		}
 	}
 	if(rrset) {
 		/* add it to auth section. This is the second rrset. */
@@ -435,6 +440,18 @@ tomsg(struct module_env* env, struct msgreply_entry* e, struct reply_info* r,
        msg->rep->authoritative = r->authoritative;
 	if(!rrset_array_lock(r->ref, r->rrset_count, now))
 		return NULL;
+	if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons(
+		LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons(
+		LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(r)) {
+		/* cname chain is now invalid, reconstruct msg */
+		rrset_array_unlock(r->ref, r->rrset_count);
+		return NULL;
+	}
+	if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) {
+		/* message rrsets have changed status, revalidate */
+		rrset_array_unlock(r->ref, r->rrset_count);
+		return NULL;
+	}
 	for(i=0; i<msg->rep->rrset_count; i++) {
 		msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i], 
 			region, now);
@@ -92,11 +92,15 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
        socklen_t addrlen, int v6only, int* inuse, int* noproto)
 {
 	int s;
-# if defined(IPV6_USE_MIN_MTU)
+#if defined(IPV6_USE_MIN_MTU)
 	int on=1;
-# else
+#endif
+#ifdef IPV6_MTU
+	int mtu = IPV6_MIN_MTU;
+#endif
+#ifndef IPV6_V6ONLY
 	(void)v6only;
-# endif
+#endif
 	if((s = socket(family, socktype, 0)) == -1) {
 		*inuse = 0;
 #ifndef USE_WINSOCK
@@ -150,21 +154,42 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		 */
 		if (setsockopt(s, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
 			(void*)&on, (socklen_t)sizeof(on)) < 0) {
-#ifndef USE_WINSOCK
+#  ifndef USE_WINSOCK
 			log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
 				"...) failed: %s", strerror(errno));
 			close(s);
-#else
+#  else
 			log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
 				"...) failed: %s", 
 				wsa_strerror(WSAGetLastError()));
 			closesocket(s);
-#endif
+#  endif
 			*noproto = 0;
 			*inuse = 0;
 			return -1;
 		}
-# endif
+# elif defined(IPV6_MTU)
+		/*
+		 * On Linux, to send no larger than 1280, the PMTUD is
+		 * disabled by default for datagrams anyway, so we set
+		 * the MTU to use.
+		 */
+		if (setsockopt(s, IPPROTO_IPV6, IPV6_MTU,
+			(void*)&mtu, (socklen_t)sizeof(mtu)) < 0) {
+#  ifndef USE_WINSOCK
+			log_err("setsockopt(..., IPV6_MTU, ...) failed: %s", 
+				strerror(errno));
+			close(s);
+#  else
+			log_err("setsockopt(..., IPV6_MTU, ...) failed: %s", 
+				wsa_strerror(WSAGetLastError()));
+			closesocket(s);
+#  endif
+			*noproto = 0;
+			*inuse = 0;
+			return -1;
+		}
+# endif /* IPv6 MTU */
 	}
 	if(bind(s, (struct sockaddr*)addr, addrlen) != 0) {
 		*noproto = 0;
@@ -465,9 +465,15 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	/* drop unsent replies */
 	if(!mstate->replies_sent) {
 		struct mesh_reply* rep;
+		struct mesh_cb* cb;
 		for(rep=mstate->reply_list; rep; rep=rep->next) {
 			comm_point_drop_reply(&rep->query_reply);
 		}
+		for(cb=mstate->cb_list; cb; cb=cb->next) {
+			fptr_ok(fptr_whitelist_mesh_cb(cb->cb));
+			(*cb->cb)(cb->cb_arg, LDNS_RCODE_SERVFAIL, NULL,
+				sec_status_unchecked);
+		}
 	}

 	/* de-init modules */
@@ -618,6 +624,7 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 		rcode = LDNS_RCODE_SERVFAIL;
 	/* send the reply */
 	if(rcode) {
+		fptr_ok(fptr_whitelist_mesh_cb(r->cb));
 		(*r->cb)(r->cb_arg, rcode, r->buf, sec_status_unchecked);
 	} else {
 		size_t udp_size = r->edns.udp_size;
@@ -631,11 +638,14 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 			m->s.env->scratch, udp_size, &r->edns, 
 			(int)(r->edns.bits & EDNS_DO), secure)) 
 		{
+			fptr_ok(fptr_whitelist_mesh_cb(r->cb));
 			(*r->cb)(r->cb_arg, LDNS_RCODE_SERVFAIL, r->buf,
 				sec_status_unchecked);
-		}
-		else	(*r->cb)(r->cb_arg, LDNS_RCODE_NOERROR, r->buf,
+		} else {
+			fptr_ok(fptr_whitelist_mesh_cb(r->cb));
+			(*r->cb)(r->cb_arg, LDNS_RCODE_NOERROR, r->buf,
 				rep->security);
+		}
 	}
 	m->s.env->mesh->num_reply_addrs--;
 }
@@ -780,6 +790,7 @@ int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
 	if(!r)
 		return 0;
 	r->buf = buf;
+	log_assert(fptr_whitelist_mesh_cb(cb)); /* early failure ifmissing*/
 	r->cb = cb;
 	r->cb_arg = cb_arg;
 	r->edns = *edns;
@@ -226,7 +226,7 @@ struct mesh_cb {
 	ldns_buffer* buf;

 	/** callback routine for results. if rcode != 0 buf has message.
-	 * called as cb(cb_arg, rcode, buf);
+	 * called as cb(cb_arg, rcode, buf, sec_state);
 	 */
 	mesh_cb_func_t cb;
 	/** user arg for callback */
@@ -1234,7 +1234,8 @@ serviced_udp_send(struct serviced_query* sq, ldns_buffer* buff)
 		&edns_lame_known, &rtt))
 		return 0;
 	if(sq->status == serviced_initial) {
-		if(edns_lame_known == 0 && rtt > 5000) {
+		if((vs != -1 || edns_lame_known == 0) && 
+			rtt > 5000 && rtt < 10001) {
 			/* perform EDNS lame probe - check if server is
 			 * EDNS lame (EDNS queries to it are dropped) */
 			verbose(VERB_ALGO, "serviced query: send probe to see "
@@ -175,6 +175,7 @@ print_option(struct config_file* cfg, const char* opt)
 	else O_STR(opt, "dlv-anchor-file", dlv_anchor_file)
 	else O_DEC(opt, "val-bogus-ttl", bogus_ttl)
 	else O_YNO(opt, "val-clean-additional", val_clean_additional)
+	else O_DEC(opt, "val-log-level", val_log_level)
 	else O_YNO(opt, "val-permissive-mode", val_permissive_mode)
 	else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
 	else O_MEM(opt, "key-cache-size", key_cache_size)
@@ -42,6 +42,7 @@
 */
 #include "config.h"
 #include "util/log.h"
+#include "services/mesh.h"
 struct comm_reply;
 struct comm_point;
 struct module_qstate;
@@ -180,6 +181,18 @@ void libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
        log_assert(0);
 }

+void libworker_fg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode), 
+	ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s))
+{
+	log_assert(0);
+}
+
+void libworker_bg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode), 
+	ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s))
+{
+	log_assert(0);
+}
+
 int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 {
 	log_assert(0);
@@ -360,7 +360,7 @@ service_send(struct ringbuf* ring, struct timeval* now, ldns_buffer* pkt,
 			(unsigned)tv.tv_sec, (unsigned)tv.tv_usec);
 		log_addr(1, "from client", &p->addr, p->addr_len);
 		/* send it */
-		sent = sendto(p->s, ldns_buffer_begin(pkt), 
+		sent = sendto(p->s, (void*)ldns_buffer_begin(pkt), 
 			ldns_buffer_limit(pkt), 0, 
 			(struct sockaddr*)srv_addr, srv_len);
 		if(sent == -1) {
@@ -384,7 +384,7 @@ do_proxy(struct proxy* p, int retsock, ldns_buffer* pkt)
 	int i;
 	ssize_t r;
 	for(i=0; i<TRIES_PER_SELECT; i++) {
-		r = recv(p->s, ldns_buffer_begin(pkt), 
+		r = recv(p->s, (void*)ldns_buffer_begin(pkt), 
 			ldns_buffer_capacity(pkt), 0);
 		if(r == -1) {
 #ifndef USE_WINSOCK
@@ -403,8 +403,8 @@ do_proxy(struct proxy* p, int retsock, ldns_buffer* pkt)
 		log_addr(1, "return reply to client", &p->addr, p->addr_len);
 		/* send reply back to the real client */
 		p->numreturn++;
-		r = sendto(retsock, ldns_buffer_begin(pkt), (size_t)r, 0,
-			(struct sockaddr*)&p->addr, p->addr_len);
+		r = sendto(retsock, (void*)ldns_buffer_begin(pkt), (size_t)r, 
+			0, (struct sockaddr*)&p->addr, p->addr_len);
 		if(r == -1) {
 #ifndef USE_WINSOCK
 			log_err("sendto: %s", strerror(errno));
@@ -492,7 +492,7 @@ service_recv(int s, struct ringbuf* ring, ldns_buffer* pkt,
 	struct proxy* p;
 	for(i=0; i<TRIES_PER_SELECT; i++) {
 		from_len = (socklen_t)sizeof(from);
-		len = recvfrom(s, ldns_buffer_begin(pkt),
+		len = recvfrom(s, (void*)ldns_buffer_begin(pkt),
 			ldns_buffer_capacity(pkt), 0,
 			(struct sockaddr*)&from, &from_len);
 		if(len < 0) {
@@ -636,7 +636,7 @@ tcp_relay_read(int s, struct tcp_send_list** first,
 	struct timeval* delay, ldns_buffer* pkt)
 {
 	struct tcp_send_list* item;
-	ssize_t r = recv(s, ldns_buffer_begin(pkt), 
+	ssize_t r = recv(s, (void*)ldns_buffer_begin(pkt), 
 		ldns_buffer_capacity(pkt), 0);
 	if(r == -1) {
 #ifndef USE_WINSOCK
@@ -272,7 +272,7 @@ static void
 perfsend(struct perfinfo* info, size_t n, struct timeval* now)
 {
 	ssize_t r;
-	r = sendto(info->io[n].fd, info->qlist_data[info->qlist_idx],
+	r = sendto(info->io[n].fd, (void*)info->qlist_data[info->qlist_idx],
 		info->qlist_len[info->qlist_idx], 0,
 		(struct sockaddr*)&info->dest, info->destlen);
 	/*log_hex("send", info->qlist_data[info->qlist_idx],
@@ -299,7 +299,7 @@ static void
 perfreply(struct perfinfo* info, size_t n, struct timeval* now)
 {
 	ssize_t r;
-	r = recv(info->io[n].fd, ldns_buffer_begin(info->buf),
+	r = recv(info->io[n].fd, (void*)ldns_buffer_begin(info->buf),
 		ldns_buffer_capacity(info->buf), 0);
 	if(r == -1) {
 #ifndef USE_WINSOCK
@@ -137,7 +137,7 @@ write_q(int fd, int udp, ldns_buffer* buf, int id,
 			exit(1);
 		}
 	}
-	if(send(fd, ldns_buffer_begin(buf), ldns_buffer_limit(buf), 0) < 
+	if(send(fd, (void*)ldns_buffer_begin(buf), ldns_buffer_limit(buf), 0) < 
 		(ssize_t)ldns_buffer_limit(buf)) {
 #ifndef USE_WINSOCK
 		perror("send() data failed");
@@ -170,7 +170,8 @@ recv_one(int fd, int udp, ldns_buffer* buf)
 		len = ntohs(len);
 		ldns_buffer_clear(buf);
 		ldns_buffer_set_limit(buf, len);
-		if(recv(fd, ldns_buffer_begin(buf), len, 0) < (ssize_t)len) {
+		if(recv(fd, (void*)ldns_buffer_begin(buf), len, 0) < 
+			(ssize_t)len) {
 #ifndef USE_WINSOCK
 			perror("read() data failed");
 #else
@@ -182,7 +183,7 @@ recv_one(int fd, int udp, ldns_buffer* buf)
 	} else {
 		ssize_t l;
 		ldns_buffer_clear(buf);
-		if((l=recv(fd, ldns_buffer_begin(buf), 
+		if((l=recv(fd, (void*)ldns_buffer_begin(buf), 
 			ldns_buffer_capacity(buf), 0)) < 0) {
 #ifndef USE_WINSOCK
 			perror("read() data failed");
@@ -287,7 +287,7 @@ struct listen_port* daemon_remote_open_ports(struct config_file*
 	return NULL;
 }

-struct daemon_remote* daemon_remote_create(struct worker* ATTR_UNUSED(worker))
+struct daemon_remote* daemon_remote_create(struct config_file* ATTR_UNUSED(cfg))
 {
 	return (struct daemon_remote*)calloc(1,1);
 }
@@ -297,8 +297,14 @@ void daemon_remote_delete(struct daemon_remote* rc)
 	free(rc);
 }

+void daemon_remote_clear(struct daemon_remote* ATTR_UNUSED(rc))
+{
+	/* nothing */
+}
+
 int daemon_remote_open_accept(struct daemon_remote* ATTR_UNUSED(rc),
-        struct listen_port* ATTR_UNUSED(ports))
+        struct listen_port* ATTR_UNUSED(ports), 
+	struct worker* ATTR_UNUSED(worker))
 {
 	return 1;
 }
@@ -407,7 +407,7 @@ rnd_test()
 	for(i=0; i<num; i++) {
 		a[i] = ub_random(r);
 		unit_assert(a[i] >= 0);
-		unit_assert((size_t)a[i] <= (size_t)RAND_MAX);
+		unit_assert((size_t)a[i] <= (size_t)0x7fffffff);
 		if(i > 5)
 			unit_assert(a[i] != a[i-1] || a[i] != a[i-2] ||
 				a[i] != a[i-3] || a[i] != a[i-4] ||
@@ -477,11 +477,10 @@ verify_test()
 #if defined(HAVE_EVP_SHA256) && defined(USE_SHA2)
 	verifytest_file("testdata/test_signatures.9", "20070829144150");
 	verifytest_file("testdata/test_signatures.11", "20070829144150");
+	verifytest_file("testdata/test_signatures.14", "20090101000000");
 #endif
 #if defined(HAVE_EVP_SHA512) && defined(USE_SHA2)
-	/* Skip test. Algorithm number uncertainty
 	verifytest_file("testdata/test_signatures.10", "20070829144150");
-	*/
 #endif
 	verifytest_file("testdata/test_signatures.12", "20090107100022");
 	verifytest_file("testdata/test_signatures.13", "20080414005004");
@@ -0,0 +1,307 @@
+; config options
+; The island of trust is at example.com (the DLV repository)
+server:
+	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	harden-referral-path: no
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with insecure zone, no DLV from negative cache
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN A
+SECTION AUTHORITY
+net.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 300
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN NS
+SECTION ANSWER
+net.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN A
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.5
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; DLV query
+; could be picked out of the negative cache due to NS queries in between.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NXDOMAIN
+SECTION QUESTION
+www.example.net.example.com. IN DLV
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
+example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+zoink.name.example.com IN NSEC zazz.net.example.com. RRSIG NSEC DLV
+zoink.name.example.com. 3600    IN      RRSIG   NSEC 3 4 3600 20070926134150 20070829134150 2854 example.com. AHipxvshRHglCEN4nZCT4m/4RIj8TrCOE2AsqEoH9e+6OYSo+yuNzzo= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+net.example.com. IN DLV
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
+example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
+zoink.name.example.com IN NSEC zazz.net.example.com. RRSIG NSEC DLV
+zoink.name.example.com. 3600    IN      RRSIG   NSEC 3 4 3600 20070926134150 20070829134150 2854 example.com. AHipxvshRHglCEN4nZCT4m/4RIj8TrCOE2AsqEoH9e+6OYSo+yuNzzo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DLV
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
+example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
+example.com IN NSEC frump.aqua.example.com. SOA NS RRSIG NSEC DNSKEY
+example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AAscY9DfNm3Uy8f8Q4WX6AzR0flHYNSr3fKfgQ0Xc20fzj1lGP9ebfk= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NXDOMAIN
+SECTION QUESTION
+com.example.com. IN DLV
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
+example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
+example.com IN NSEC zazz.example.com. SOA NS RRSIG NSEC
+example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AAi21jQpno6gXnrPrtK0NvNgX9B8E9U5RvTd47QiCWLF7KdtKxB7Xz0= ;{id = 2854}
+ENTRY_END
+
+RANGE_END
+
+; ns.example.net.
+RANGE_BEGIN 0 300
+	ADDRESS 1.2.3.5
+; NS query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN NS
+SECTION ANSWER
+example.net.    IN NS   ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.         IN      A       1.2.3.5
+ENTRY_END
+
+; www.example.net query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.net. IN A
+SECTION ANSWER
+www.example.net.	10	IN	A	10.20.30.40
+SECTION AUTHORITY
+example.net.    IN NS   ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.         IN      A       1.2.3.5
+ENTRY_END
+
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.net. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.net. IN A
+SECTION ANSWER
+www.example.net.	10	IN	A	10.20.30.40
+SECTION AUTHORITY
+example.net.    IN NS   ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.         IN      A       1.2.3.5
+ENTRY_END
+
+STEP 150 TIME_PASSES ELAPSE 30
+
+; no more DLV authority reachable
+STEP 200 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.net. IN A
+ENTRY_END
+
+STEP 210 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.net. IN A
+SECTION ANSWER
+www.example.net.	10	IN	A	10.20.30.40
+SECTION AUTHORITY
+example.net.    IN NS   ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.         IN      A       1.2.3.5
+ENTRY_END
+
+STEP 220 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+net. IN NS
+ENTRY_END
+
+STEP 230 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+net. IN NS
+SECTION ANSWER
+net.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,131 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "dlv.isc.org. 5072    IN      DNSKEY  256 3 5 BEAAAAOlYGw53D+f01yCL5JsP0SB6EjYrnd0JYRBooAaGPT+Q0kpiN+7GviFh+nIazoB8e2Yv7mupgqkmIjObdcbGstYpUltdECdNpNmBvASKB9SBdtGeRvXXpORi3Qyxb9kHGG7SpzyYbc+KDVKnzYHB94pvqu3ZZpPFPBFtCibp/mkhw=="
+	val-override-date: "20090617133009"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test parse of packet when forwarding and dlv are in use
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+org. IN NS
+SECTION AUTHORITY
+org.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net. (for ORG)
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+org. IN NS
+SECTION ANSWER
+org.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+dlv.isc.org. IN NS
+SECTION AUTHORITY
+dlv.isc.org. IN NS ns.org.
+SECTION ADDITIONAL
+ns.org.	IN A 1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.org for dlv.isc.org
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+dlv.isc.org.	IN	DNSKEY
+SECTION ANSWER
+dlv.isc.org.	5072	IN	DNSKEY	256 3 5 BEAAAAOlYGw53D+f01yCL5JsP0SB6EjYrnd0JYRBooAaGPT+Q0kpiN+7GviFh+nIazoB8e2Yv7mupgqkmIjObdcbGstYpUltdECdNpNmBvASKB9SBdtGeRvXXpORi3Qyxb9kHGG7SpzyYbc+KDVKnzYHB94pvqu3ZZpPFPBFtCibp/mkhw== ;{id = 64263 (zsk), size = 1024b}
+dlv.isc.org.	5072	IN	DNSKEY	257 3 5 BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URkY62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboMQKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VStTDN0YUuWrBNh ;{id = 19297 (ksk), size = 2048b}
+dlv.isc.org.	5072	IN	RRSIG	DNSKEY 5 3 7200 20090717133009 20090617133009 19297 dlv.isc.org. iqGOzsIQKFHcPLbJHLb/kNzcm7TlHiyT4kzTknCjKsC7DCB86YCOhnZZjvZQyA+D0N0KDgNWY8v5czbyX57qR6qORciT2zmPSTGj7CIOe4zrq60n8HzsChKgvk+RSYQrzf6vRfnZhce6Y1waXQd4wh1buPAUw/l46Ovt74ALXzcWSgfMNyx6PBz7rbusuePKeSv0GZL9+M2qhXKe9LJmnzD9uCwnbV/Y5yu+xLfxLdm9q4IKp6Rn50CeHYKf3tO2jI9dkWqFR94XHSTNGfhC02i5UsfP1HRPnk49bX7OMstuuCq9zMX+qTt602MVFYdTSHTy/5+Yw5DvOA9JgOqO4w== ;{id = 19297}
+dlv.isc.org.	5072	IN	RRSIG	DNSKEY 5 3 7200 20090717133009 20090617133009 64263 dlv.isc.org. W1KX1PagXsaWWmxkaOfnLetnw1hhSw7ym91S4rSu14QfFbYi5iN9ZkSuKa21M7Do52S9om/2hDllMF7EFfnv9l4e4/rMOc59vKGVojpHOvZyRVhIiMyh1H9NfLTYUovORRvKO0Cnp65gBXspVf1WhzoY3pC1NZ+5pscPWLeD1rw= ;{id = 64263}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NXDOMAIN
+SECTION QUESTION
+www.example.com.dlv.isc.org.	IN	DLV
+SECTION ANSWER
+SECTION AUTHORITY
+dlv.isc.org.	2776	IN	SOA	ns-int.isc.org. hostmaster.isc.org. 2009061702 7200 3600 2419200 3600
+dlv.isc.org.	2776	IN	RRSIG	SOA 5 3 3600 20090717133009 20090617133009 64263 dlv.isc.org. S5iTFqF8k9XWoGq4Wajo1GQF6Oc1e5lI1kGFWyaKf3oM2asbzCbVk2aZLtyDCGjYA4euZWXD0q2vol7/1cPB5Ds4SteCuo5Jkpa/mw7mPAcbNu8mYexq1RaodVCbWrW8KSxEyVd8X5mZx2OBaSyK8zns/W5I3ZPNNLf4Kz6Zpo0= ;{id = 64263}
+seatex.com.cn.dlv.isc.org.	2776	IN	RRSIG	NSEC 5 6 3600 20090717133009 20090617133009 64263 dlv.isc.org. Rxv7gVdu8rpWbJ3fJm7cY66IKV+C94I4/HYiDQke1m2P7hXo5bpDBBShKpIvME34ANN8Lb0cZQK9XT7NYpWjE5rjW7CaMiVjiR6U1LyDGQyK4X3wdkbv3aJcHLSg7sWsxyZXj5iVUxkU5JO3JBjo412oKQ3bh+RGi1BxTIIq09g= ;{id = 64263}
+seatex.com.cn.dlv.isc.org.	2776	IN	NSEC	absolight.com.dlv.isc.org. RRSIG NSEC DLV 
+ericgermann.com.dlv.isc.org.	2776	IN	RRSIG	NSEC 5 5 3600 20090717133009 20090617133009 64263 dlv.isc.org. OEUizWAXsWFBzt4rN5+AUTaND8phZc4ezux06LA/Ua5N/B/LQQ1cb42eEqCQHwnGK8BsRhbsRiVywPNgnnPlL1Gy8n25gi+0qWOpA27fOwZJbO3n944gKvPDWZoDeCbdJr6AQG5Z9/Ka0ERRtHC6uI2Xn6KCQPjgTEihqhoayYg= ;{id = 64263}
+ericgermann.com.dlv.isc.org.	2776	IN	NSEC	fayengineering.com.dlv.isc.org. RRSIG NSEC DLV 
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com.dlv.isc.org. IN DLV
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NXDOMAIN
+SECTION QUESTION
+www.example.com.dlv.isc.org. IN DLV
+SECTION ANSWER
+SECTION AUTHORITY
+dlv.isc.org.    2776    IN      SOA     ns-int.isc.org. hostmaster.isc.org. 2009061702 7200 3600 2419200 3600
+dlv.isc.org.    2776    IN      RRSIG   SOA 5 3 3600 20090717133009 20090617133009 64263 dlv.isc.org. S5iTFqF8k9XWoGq4Wajo1GQF6Oc1e5lI1kGFWyaKf3oM2asbzCbVk2aZLtyDCGjYA4euZWXD0q2vol7/1cPB5Ds4SteCuo5Jkpa/mw7mPAcbNu8mYexq1RaodVCbWrW8KSxEyVd8X5mZx2OBaSyK8zns/W5I3ZPNNLf4Kz6Zpo0= ;{id = 64263}
+seatex.com.cn.dlv.isc.org.      2776    IN      NSEC    absolight.com.dlv.isc.org. RRSIG NSEC DLV
+seatex.com.cn.dlv.isc.org.      2776    IN      RRSIG   NSEC 5 6 3600 20090717133009 20090617133009 64263 dlv.isc.org. Rxv7gVdu8rpWbJ3fJm7cY66IKV+C94I4/HYiDQke1m2P7hXo5bpDBBShKpIvME34ANN8Lb0cZQK9XT7NYpWjE5rjW7CaMiVjiR6U1LyDGQyK4X3wdkbv3aJcHLSg7sWsxyZXj5iVUxkU5JO3JBjo412oKQ3bh+RGi1BxTIIq09g= ;{id = 64263}
+ericgermann.com.dlv.isc.org.    2776    IN      NSEC    fayengineering.com.dlv.isc.org. RRSIG NSEC DLV
+ericgermann.com.dlv.isc.org.    2776    IN      RRSIG   NSEC 5 5 3600 20090717133009 20090617133009 64263 dlv.isc.org. OEUizWAXsWFBzt4rN5+AUTaND8phZc4ezux06LA/Ua5N/B/LQQ1cb42eEqCQHwnGK8BsRhbsRiVywPNgnnPlL1Gy8n25gi+0qWOpA27fOwZJbO3n944gKvPDWZoDeCbdJr6AQG5Z9/Ka0ERRtHC6uI2Xn6KCQPjgTEihqhoayYg= ;{id = 64263}
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,465 @@
+; config options
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+
+CONFIG_END
+
+SCENARIO_BEGIN Bug test dnssec-lame detection at ds point with target queries.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN A
+SECTION AUTHORITY
+net.	IN NS	e.gtld-servers.net.
+SECTION ADDITIONAL
+e.gtld-servers.net.	IN 	A	192.12.94.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.net. IN AAAA
+SECTION AUTHORITY
+net.	IN NS	e.gtld-servers.net.
+SECTION ADDITIONAL
+e.gtld-servers.net.	IN 	A	192.12.94.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com. IN A	1.2.3.55
+ENTRY_END
+RANGE_END
+
+; e.gtld-servers.net.
+; Note this timing is so it will provide answers at the beginning.
+RANGE_BEGIN 0 30
+	ADDRESS 192.12.94.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN NS
+SECTION ANSWER
+net.	IN NS	e.gtld-servers.net.
+SECTION ADDITIONAL
+e.gtld-servers.net.	IN 	A	192.12.94.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+e.gtld-servers.net. IN AAAA
+SECTION ANSWER
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.gtld-servers.net. IN AAAA
+SECTION ANSWER
+ENTRY_END
+
+; no example.net delegation answers yet.
+
+RANGE_END
+
+; e.gtld-servers.net.
+; Note this timing is so it will not provide answers at the beginning,
+; but only later on.
+RANGE_BEGIN 30 100
+	ADDRESS 192.12.94.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN NS
+SECTION ANSWER
+net.	IN NS	e.gtld-servers.net.
+SECTION ADDITIONAL
+e.gtld-servers.net.	IN 	A	192.12.94.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+e.gtld-servers.net. IN AAAA
+SECTION ANSWER
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.gtld-servers.net. IN AAAA
+SECTION ANSWER
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.net. IN A
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.net. IN AAAA
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.44
+ENTRY_END
+RANGE_END
+
+; ns.example.net.
+; Note this timing is so it will not provide answers at the beginning,
+; but only later on.
+RANGE_BEGIN 30 100
+	ADDRESS 1.2.3.44
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN NS
+SECTION ANSWER
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.net. IN A
+SECTION ANSWER
+ns.example.net. IN A	1.2.3.44
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.net. IN AAAA
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net. IN A	1.2.3.44
+ENTRY_END
+
+; response to DNSKEY priming query
+; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
+SECTION AUTHORITY
+; no NS set. not needed for this test.
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN NS ns.sub.example.com.
+sub.example.com. IN NS ns.example.net.
+sub.example.com.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. C/0b+sqlsdSTkhd+aDXb6ELyuQreosIGBzLCtWxYGD+Q9QGB5rN8uB+4+48yhw36pd3MfeAn06AgAnJ6eu8tJg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A       11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN AAAA
+SECTION ANSWER
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.55
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com. IN A	1.2.3.55
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.com. IN A
+SECTION ANSWER
+ns.example.com. IN A	1.2.3.55
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+ENTRY_END
+
+; fine DNSKEY response.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION 
+example.com. IN DNSKEY  
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+ENTRY_END
+
+
+; correct delegation with DS
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN NS ns.sub.example.com.
+sub.example.com. IN NS ns.example.net.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+; response for delegation to sub.example.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION 
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN NS ns.sub.example.com.
+sub.example.com. IN NS ns.example.net.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+RANGE_END
+
+; This server is DNSSEC LAME!
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+        ADDRESS 1.2.3.6
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN NS ns.sub.example.com.
+sub.example.com. IN NS ns.example.net.
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+
+; response to DNSKEY priming query
+; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+SECTION AUTHORITY
+sub.example.com. IN     NS ns.sub.example.com.
+sub.example.com. IN     NS ns.example.net.
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN AAAA
+SECTION ANSWER
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A       11.11.11.11
+SECTION AUTHORITY
+; dnssec-lameness detection depends on this information
+sub.example.com. IN     NS ns.sub.example.com.
+sub.example.com. IN     NS ns.example.net.
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+RANGE_END
+
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+STEP 10 NOTHING
+; recursion at time 10.
+; first recursion with answers in 0-30 time
+; with bug it now resolves to the bad version
+; fixed, it stops waiting for more target queries.
+
+STEP 40 NOTHING
+; next recursion with more answers at time 40.
+
+; recursion happens here.
+STEP 50 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A       11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+ENTRY_END
+SCENARIO_END
@@ -0,0 +1,218 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+forward-zone:
+	name: "example.com"
+	forward-addr: 10.0.0.1
+stub-zone:
+	name: "sub.example.com"
+	stub-addr: 10.0.0.2
+CONFIG_END
+
+SCENARIO_BEGIN Test iterative resolve with a stub under a forward zone
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; forwarder for example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 10.0.0.1
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.0.0.4
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+; fail all other queries
+ENTRY_BEGIN
+MATCH opcode 
+ADJUST copy_id copy_query
+REPLY QR SERVFAIL
+SECTION QUESTION
+example.com. IN A
+ENTRY_END
+RANGE_END
+
+; stub for sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 10.0.0.2
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com.	IN NS	ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com.		IN 	A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	10.0.0.5
+SECTION AUTHORITY
+sub.example.com.	IN NS	ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com.		IN 	A	1.2.3.44
+ENTRY_END
+RANGE_END
+
+
+; check if forwarder is honored
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.0.0.4
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+; try to resolve from stub zone
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	10.0.0.5
+SECTION AUTHORITY
+sub.example.com.	IN NS	ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com.		IN 	A	1.2.3.44
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,175 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+forward-zone:
+	name: "."
+	forward-addr: 10.0.0.1
+stub-zone:
+	name: "sub.example.com"
+	stub-addr: 10.0.0.2
+CONFIG_END
+
+SCENARIO_BEGIN Test iterative resolve with a stub under a forward root zone
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+
+; No answers from the actual root, blocked.
+
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; forwarder for example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 10.0.0.1
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.0.0.4
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+; fail all other queries
+ENTRY_BEGIN
+MATCH opcode 
+ADJUST copy_id copy_query
+REPLY QR SERVFAIL
+SECTION QUESTION
+example.com. IN A
+ENTRY_END
+RANGE_END
+
+; stub for sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 10.0.0.2
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com.	IN NS	ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com.		IN 	A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	10.0.0.5
+SECTION AUTHORITY
+sub.example.com.	IN NS	ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com.		IN 	A	1.2.3.44
+ENTRY_END
+RANGE_END
+
+; try to resolve from stub zone
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	10.0.0.5
+SECTION AUTHORITY
+sub.example.com.	IN NS	ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com.		IN 	A	1.2.3.44
+ENTRY_END
+
+SCENARIO_END
@@ -3,24 +3,21 @@
 ; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
 ; later entries are verified with it.

-; Test RSASHA512 signatures.
+; Test RSASHA512 signatures from draft-ietf-dnsext-dnssec-rsasha256-14

-; RSA key from ldns tool
 ENTRY_BEGIN
 SECTION QUESTION
-sub.example.com.	IN DNSKEY
+example.net.	IN DNSKEY
 SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 9 AwEAAazmeO3BNv+xPYuFbQp8JN4XX+iKNuvJgD2QG5jRXI0IP5by+JGSob20OEmbPLqKcXWMRPICTyPBDaBh0tXA66DVlHV8rCtAT5Yqdrz2qw05SNYCGWJulscR6GM0e4gkO1FrBINr385IiMH3sJegBzm2HUbyb2I+xuFIfl7SgMuZ5fahHnhjDwsdgw+19OQlbYDRmNhMvtJemomIiGzPwrxEtKBlcUevcFPX7cPU7lpbcZwVP16xhLbtSNwMHvoCoRpJrAtdDGiSyAzTQef+jWuaUlFCPle6Qkghi51zmpBrPunqRCoYg7LIyJ9zS/KzPKX2zN2ASu9KJD3tDW9OSZM= ;{id = 48886 (zsk), size = 2048b}
-
+example.net.    3600  IN  DNSKEY  (256 3 10 AwEAAdHoNTOW+et86KuJOWRD p1pndvwb6Y83nSVXXyLA3DLroROUkN6X0O6pnWnjJQujX/AyhqFD xj13tOnD9u/1kTg7cV6rklMrZDtJCQ5PCl/D7QNPsgVsMu1J2Q8g pMpztNFLpPBz1bWXjDtaR7ZQBlZ3PFY12ZTSncorffcGmhOL);{id = 3740 (zsk), size = 1024b}
 ENTRY_END

 ; entry to test
 ENTRY_BEGIN
 SECTION QUESTION
-www.example.com.    IN      A 
+www.example.net.    IN      A 
 SECTION ANSWER
-www.example.com.	3600	IN	A	192.0.2.66
-www.example.com.        3600    IN      RRSIG   A 9 3 3600 20070926134150 20070829134150 48886 example.com. Ys6CGNAxJ+0lG/EoDJqZOoZTlX8Aa1k124VjnSE2A9NTecZUX44TiKtJQtUu7cnUcURuNsqX5rulr/70Vx+ANeUot/ewtY6fX6qaGZVgIaNyyDw0Gu7oiAsjOE0bt5RS4VGvDpLSdxDlPV0Kbbc4fYSTsqiSe2idMokfD2bgPcFrIx2TcX/sF8Jyhn2MGiQsWryMWyvhRTZ1+dwQcPhkeslGFLF/SQpGx5BbW/BYQG026xb6ckL/F/Pu4Jf5sQTimTZXHi9iASeRNO34DM9bS0yDgc+nm3bEg8/pEGCdFuCt6dVv7JTFgnR9fPTbEbBHIi4ORw1oef11G2sRV/Ubvw== ;{id = 48886}
-
+www.example.net. 3600  IN  A  192.0.2.91
+www.example.net. 3600  IN  RRSIG  (A 10 3 3600 20300101000000 20000101000000 3740 example.net. tsb4wnjRUDnB1BUi+t 6TMTXThjVnG+eCkWqjvvjhzQL1d0YRoOe0CbxrVDYd0xDtsuJRa eUw1ep94PzEWzr0iGYgZBWm/zpq+9fOuagYJRfDqfReKBzMweOL DiNa8iP5g9vMhpuv6OPlvpXwm9Sa9ZXIbNl1MBGk0fthPgxdDLw =);{id = 3740}
 ENTRY_END

@@ -15,7 +15,7 @@ ENTRY_END
 ; entry to test
 ENTRY_BEGIN
 SECTION QUESTION
-bogus.example.com.       IN      SOA
+secure.example.com.       IN      SOA
 SECTION ANSWER
 example.com.  43200   IN      SOA     home.kuroiwa.eng.br. hostmaster.cesar.sec3.br. 2008040903 86400 86400 8640000 600
 example.com.	43200	IN	RRSIG	SOA 5 2 43200 20081010000000 20080410122550 31027 example.com. af7nqRak6cEeQLytqLHMIUKPsOECA4Cu/Zpm7vdnKSh2q2+/8ZwIxwHLyCEGdiu/mTYffZEHTZytJyzxnB0oxA== ;{id = 31027}
@@ -0,0 +1,23 @@
+; Signature test file
+
+; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
+; later entries are verified with it.
+
+; Test RSASHA256 signatures from draft-ietf-dnsext-dnssec-rsasha256-14
+
+ENTRY_BEGIN
+SECTION QUESTION
+example.net.	IN DNSKEY
+SECTION ANSWER
+example.net.     3600  IN  DNSKEY  (256 3 8 AwEAAcFcGsaxxdgiuuGmCkVI my4h99CqT7jwY3pexPGcnUFtR2Fh36BponcwtkZ4cAgtvd4Qs8P kxUdp6p/DlUmObdk= );{id = 9033 (zsk), size = 512b}
+ENTRY_END
+
+; entry to test
+ENTRY_BEGIN
+SECTION QUESTION
+www.example.net.    IN      A 
+SECTION ANSWER
+www.example.net. 3600  IN  A  192.0.2.91
+www.example.net. 3600  IN  RRSIG  (A 8 3 3600 20300101000000 20000101000000 9033 example.net. kRCOH6u7l0QGy9qpC9 l1sLncJcOKFLJ7GhiUOibu4teYp5VE9RncriShZNz85mwlMgNEa cFYK/lPtPiVYP4bwg== ;{id = 9033}
+ENTRY_END
+
@@ -0,0 +1,258 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test pickup of DS NSEC from the cache.
+; make sure unbound does not pick up the wrong nsec.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response for   tub.example.com
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NXDOMAIN
+SECTION QUESTION
+tub.example.com. IN DNSKEY
+SECTION ANSWER
+SECTION AUTHORITY
+; SOA record
+example.com IN SOA ns.iana.org. NSTLD.iana.org. 2009061200 1800 900 604800 86400
+example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AAvpEruGS0UJzMoO6ou/+y8ZyHjjrFC6HKDWU8a61Ru9qtl4R66fC1c= ;{id = 2854}
+; qname denial
+sub.example.com. IN	NSEC wub.example.com. NS DS RRSIG NSEC
+sub.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. AA4+SSCI8kQZ2/iGj+9rxpNZyaIJNNRZ4eM0fEw2D5fVR/+WLUZ9GdE= ;{id = 2854}
+; wildcard denial
+example.com. IN NSEC blub.example.com. NS SOA RRSIG NSEC DNSKEY
+example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AARheDFiRjrnKHzsPloUJ0FC+8aAM6H49Lnm2AJrgxE9RlBlH2E4sRo= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+; DS query for sub.example.com
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; response for delegation to sub.example.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+;sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+;sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+RANGE_END
+
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response to DNSKEY priming query
+; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+; query for a domain next to it, so the wrong NSEC gets in the cache.
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.tub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NXDOMAIN
+SECTION QUESTION
+www.tub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.    3600    IN      SOA     ns.iana.org. NSTLD.iana.org. 2009061200 1800 900 604800 86400
+example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AAvpEruGS0UJzMoO6ou/+y8ZyHjjrFC6HKDWU8a61Ru9qtl4R66fC1c= ;{id = 2854}
+sub.example.com.        3600    IN      NSEC    wub.example.com. NS DS RRSIG NSEC 
+sub.example.com.        3600    IN      RRSIG   NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. AA4+SSCI8kQZ2/iGj+9rxpNZyaIJNNRZ4eM0fEw2D5fVR/+WLUZ9GdE= ;{id = 2854}
+example.com.    3600    IN      NSEC    blub.example.com. NS SOA RRSIG NSEC DNSKEY 
+example.com.    3600    IN      RRSIG   NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AARheDFiRjrnKHzsPloUJ0FC+8aAM6H49Lnm2AJrgxE9RlBlH2E4sRo= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+; query of interest.
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. 	3600	IN	A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+
+SCENARIO_END
@@ -0,0 +1,457 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+forward-zone:
+	name: "sub.example.com"
+	forward-addr: 1.2.3.6
+CONFIG_END
+
+SCENARIO_BEGIN Test forward-zone with DS query
+; The fwd zone is linked validly with a DS to the public internet zone.
+; unbound just has to be able to ask the DS from the right server (not 
+; from the fwd).
+; Here the fwd is not even recursive, just the plain server for sub.example.com
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response for DS of sub.example.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; response for delegation to sub.example.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+RANGE_END
+
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response to DNSKEY priming query
+; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response for qtype DS.  This is not available here.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR SERVFAIL
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. 	3600	IN	A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+stub-zone:
+	name: "sub.example.com"
+	stub-addr: 1.2.3.6
+CONFIG_END
+
+SCENARIO_BEGIN Test stub with DS query
+; The stub zone is linked validly with a DS to the public internet zone.
+; unbound just has to be able to ask the DS from the right server (not 
+; from the stub).
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response for DS of sub.example.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; response for delegation to sub.example.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+RANGE_END
+
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response to DNSKEY priming query
+; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response for qtype DS.  This is not available here.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR SERVFAIL
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. 	3600	IN	A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,148 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with badly truncated positive response
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+
+; Truncated, no signature for NS record.
+;;;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+;;;SECTION ADDITIONAL
+;;;ns.example.com.		IN 	A	1.2.3.4
+;;;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END
@@ -0,0 +1,456 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+stub-zone:
+	name: "sub.example.com"
+	stub-addr: 1.2.3.6
+CONFIG_END
+
+SCENARIO_BEGIN Test stub with DS query
+; The stub zone is linked validly with a DS to the public internet zone.
+; unbound just has to be able to ask the DS from the right server (not 
+; from the stub).
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response for DS of sub.example.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; response for delegation to sub.example.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+RANGE_END
+
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response to DNSKEY priming query
+; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response for qtype DS.  This is not available here.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR SERVFAIL
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. 	3600	IN	A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+stub-zone:
+	name: "sub.example.com"
+	stub-addr: 1.2.3.6
+CONFIG_END
+
+SCENARIO_BEGIN Test stub with DS query
+; The stub zone is linked validly with a DS to the public internet zone.
+; unbound just has to be able to ask the DS from the right server (not 
+; from the stub).
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response for DS of sub.example.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; response for delegation to sub.example.com.
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+RANGE_END
+
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response to DNSKEY priming query
+; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response for qtype DS.  This is not available here.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR SERVFAIL
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. 	3600	IN	A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END
@@ -155,6 +155,7 @@ config_create()
 	cfg->val_sig_skew_min = 3600; /* at least daylight savings trouble */
 	cfg->val_sig_skew_max = 86400; /* at most timezone settings trouble */
 	cfg->val_clean_additional = 1;
+	cfg->val_log_level = 0;
 	cfg->val_permissive_mode = 0;
 	cfg->key_cache_size = 4 * 1024 * 1024;
 	cfg->key_cache_slabs = 4;
@@ -375,6 +376,9 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	} else if(strcmp(opt, "val-clean-additional:") == 0) {
 		IS_YES_OR_NO;
 		cfg->val_clean_additional = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "val-log-level:") == 0) {
+		IS_NUMBER_OR_ZERO;
+		cfg->val_log_level = atoi(val);
 	} else if(strcmp(opt, "val-permissive-mode:") == 0) {
 		IS_YES_OR_NO;
 		cfg->val_permissive_mode = (strcmp(val, "yes") == 0);
@@ -1034,12 +1038,14 @@ char* cfg_ptr_reverse(char* str)
 	 * IPv6: (h.){32}.ip6.arpa.  */

 	if(addr_is_ip6(&addr, addrlen)) {
-		struct in6_addr* ad = &((struct sockaddr_in6*)&addr)->sin6_addr;
+		uint8_t ad[16];
 		const char* hex = "0123456789abcdef";
 		char *p = buf;
 		int i;
+		memmove(ad, &((struct sockaddr_in6*)&addr)->sin6_addr, 
+			sizeof(ad));
 		for(i=15; i>=0; i--) {
-			uint8_t b = ((uint8_t*)ad)[i];
+			uint8_t b = ad[i];
 			*p++ = hex[ (b&0x0f) ];
 			*p++ = '.';
 			*p++ = hex[ (b&0xf0) >> 4 ];
@@ -1047,10 +1053,12 @@ char* cfg_ptr_reverse(char* str)
 		}
 		snprintf(buf+16*4, sizeof(buf)-16*4, "ip6.arpa. ");
 	} else {
-		struct in_addr* ad = &((struct sockaddr_in*)&addr)->sin_addr;
+		uint8_t ad[4];
+		memmove(ad, &((struct sockaddr_in*)&addr)->sin_addr, 
+			sizeof(ad));
 		snprintf(buf, sizeof(buf), "%u.%u.%u.%u.in-addr.arpa. ",
-		(unsigned)((uint8_t*)ad)[3], (unsigned)((uint8_t*)ad)[2],
-		(unsigned)((uint8_t*)ad)[1], (unsigned)((uint8_t*)ad)[0]);
+			(unsigned)ad[3], (unsigned)ad[2],
+			(unsigned)ad[1], (unsigned)ad[0]);
 	}

 	/* printed the reverse address, now the between goop and name on end */
@@ -213,6 +213,8 @@ struct config_file {
 	int bogus_ttl; 
 	/** should validator clean additional section for secure msgs */
 	int val_clean_additional;
+	/** log bogus messages by the validator */
+	int val_log_level;
 	/** should validator allow bogus messages to go through */
 	int val_permissive_mode;
 	/** nsec3 maximum iterations per key size, string */
@@ -199,6 +199,7 @@ val-sig-skew-max{COLON}		{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
 val-bogus-ttl{COLON}		{ YDVAR(1, VAR_BOGUS_TTL) }
 val-clean-additional{COLON}	{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
 val-permissive-mode{COLON}	{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
+val-log-level{COLON}		{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
 key-cache-size{COLON}		{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
 key-cache-slabs{COLON}		{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
 neg-cache-size{COLON}		{ YDVAR(1, VAR_NEG_CACHE_SIZE) }
@@ -1,24 +1,23 @@
-/* A Bison parser, made by GNU Bison 2.3.  */
+
+/* A Bison parser, made by GNU Bison 2.4.1.  */

 /* Skeleton interface for Bison's Yacc-like parsers in C
-
-   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+   
+      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
   Free Software Foundation, Inc.
-
-   This program is free software; you can redistribute it and/or modify
+   
+   This program is free software: you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2, or (at your option)
-   any later version.
-
+   the Free Software Foundation, either version 3 of the License, or
+   (at your option) any later version.
+   
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
-
+   
   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 51 Franklin Street, Fifth Floor,
-   Boston, MA 02110-1301, USA.  */
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */

 /* As a special exception, you may create a larger work that contains
   part or all of the Bison parser skeleton and distribute that work
@@ -29,10 +28,11 @@
   special exception, which will cause the skeleton and the resulting
   Bison output files to be licensed under the GNU General Public
   License without this special exception.
-
+   
   This special exception was added by the Free Software Foundation in
   version 2.2 of Bison.  */

+
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -143,7 +143,8 @@
     VAR_PYTHON_SCRIPT = 359,
     VAR_VAL_SIG_SKEW_MIN = 360,
     VAR_VAL_SIG_SKEW_MAX = 361,
-     VAR_CACHE_MIN_TTL = 362
+     VAR_CACHE_MIN_TTL = 362,
+     VAR_VAL_LOG_LEVEL = 363
   };
 #endif
 /* Tokens.  */
@@ -252,23 +253,30 @@
 #define VAR_VAL_SIG_SKEW_MIN 360
 #define VAR_VAL_SIG_SKEW_MAX 361
 #define VAR_CACHE_MIN_TTL 362
+#define VAR_VAL_LOG_LEVEL 363




 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-#line 64 "util/configparser.y"
 {
+
+/* Line 1676 of yacc.c  */
+#line 64 "util/configparser.y"
+
 	char*	str;
-}
-/* Line 1489 of yacc.c.  */
-#line 267 "util/configparser.h"
-	YYSTYPE;
+
+
+
+/* Line 1676 of yacc.c  */
+#line 274 "util/configparser.h"
+} YYSTYPE;
+# define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
-# define YYSTYPE_IS_TRIVIAL 1
 #endif

 extern YYSTYPE yylval;

+
@@ -98,7 +98,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_EXTENDED_STATISTICS VAR_LOCAL_DATA_PTR VAR_JOSTLE_TIMEOUT
 %token VAR_STUB_PRIME VAR_UNWANTED_REPLY_THRESHOLD VAR_LOG_TIME_ASCII
 %token VAR_DOMAIN_INSECURE VAR_PYTHON VAR_PYTHON_SCRIPT VAR_VAL_SIG_SKEW_MIN
-%token VAR_VAL_SIG_SKEW_MAX VAR_CACHE_MIN_TTL
+%token VAR_VAL_SIG_SKEW_MAX VAR_CACHE_MIN_TTL VAR_VAL_LOG_LEVEL

 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -148,7 +148,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_local_data_ptr | server_jostle_timeout | 
 	server_unwanted_reply_threshold | server_log_time_ascii | 
 	server_domain_insecure | server_val_sig_skew_min | 
-	server_val_sig_skew_max | server_cache_min_ttl
+	server_val_sig_skew_max | server_cache_min_ttl | server_val_log_level
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -846,6 +846,14 @@ server_val_permissive_mode: VAR_VAL_PERMISSIVE_MODE STRING_ARG
 		free($2);
 	}
 	;
+server_val_log_level: VAR_VAL_LOG_LEVEL STRING_ARG
+	{
+		OUTYY(("P(server_val_log_level:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->val_log_level = atoi($2);
+	}
+	;
 server_val_nsec3_keysize_iterations: VAR_VAL_NSEC3_KEYSIZE_ITERATIONS STRING_ARG
 	{
 		OUTYY(("P(server_val_nsec3_keysize_iterations:%s)\n", $2));
@@ -490,6 +490,8 @@ find_rrset(struct msg_parse* msg, ldns_buffer* pkt, uint8_t* dname,
 			*rrset_prev = msgparse_hashtable_lookup(msg, pkt, 
 				*hash, *rrset_flags, dname, dnamelen, covtype, 
 				dclass);
+			if(!*rrset_prev) /* untwiddle if not found */
+				*rrset_flags ^= PACKED_RRSET_NSEC_AT_APEX;
 		}
 		if(*rrset_prev) {
 			*prev_dname_first = (*rrset_prev)->dname;
@@ -504,9 +506,9 @@ find_rrset(struct msg_parse* msg, ldns_buffer* pkt, uint8_t* dname,
 		int hasother = 0;
 		/* find matching rrsig */
 		*hash = pkt_hash_rrset_rest(dname_h, LDNS_RR_TYPE_RRSIG, 
-			dclass, *rrset_flags);
+			dclass, 0);
 		*rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, 
-			*rrset_flags, dname, dnamelen, LDNS_RR_TYPE_RRSIG, 
+			0, dname, dnamelen, LDNS_RR_TYPE_RRSIG, 
 			dclass);
 		if(*rrset_prev && rrset_has_sigover(pkt, *rrset_prev, type,
 			&hasother)) {
@@ -814,17 +816,17 @@ parse_section(ldns_buffer* pkt, struct msg_parse* msg,
 		ldns_buffer_read(pkt, &dclass, sizeof(dclass));

 		if(0) { /* debug show what is being parsed. */
-			printf("parse of %s(%d)",
+			fprintf(stderr, "parse of %s(%d)",
 				ldns_rr_descript(type)?
 				ldns_rr_descript(type)->_name: "??",
 				(int)type);
-			printf(" %s(%d) ",
+			fprintf(stderr, " %s(%d) ",
 				ldns_lookup_by_id(ldns_rr_classes, 
 				(int)ntohs(dclass))?ldns_lookup_by_id(
 				ldns_rr_classes, (int)ntohs(dclass))->name: 
 				"??", (int)ntohs(dclass));
-			dname_print(stdout, pkt, dname);
-			printf("\n");
+			dname_print(stderr, pkt, dname);
+			fprintf(stderr, "\n");
 		}

 		/* see if it is part of an existing RR set */
@@ -842,9 +844,9 @@ parse_section(ldns_buffer* pkt, struct msg_parse* msg,
 				return LDNS_RCODE_SERVFAIL;
 		}
 		else if(0)	{ 
-			printf("is part of existing: ");
-			dname_print(stdout, pkt, rrset->dname);
-			printf(" type %s(%d)\n",
+			fprintf(stderr, "is part of existing: ");
+			dname_print(stderr, pkt, rrset->dname);
+			fprintf(stderr, " type %s(%d)\n",
 				ldns_rr_descript(rrset->type)?
 				ldns_rr_descript(rrset->type)->_name: "??",
 				(int)rrset->type);
@@ -790,3 +790,40 @@ log_query_info(enum verbosity_value v, const char* str,
 {
 	log_nametypeclass(v, str, qinf->qname, qinf->qtype, qinf->qclass);
 }
+
+int
+reply_check_cname_chain(struct reply_info* rep) 
+{
+	/* check only answer section rrs for matching cname chain.
+	 * the cache may return changed rdata, but owner names are untouched.*/
+	size_t i;
+	uint8_t* sname = rep->rrsets[0]->rk.dname;
+	size_t snamelen = rep->rrsets[0]->rk.dname_len;
+	for(i=0; i<rep->an_numrrsets; i++) {
+		uint16_t t = ntohs(rep->rrsets[i]->rk.type);
+		if(t == LDNS_RR_TYPE_DNAME)
+			continue; /* skip dnames; note TTL 0 not cached */
+		/* verify that owner matches current sname */
+		if(query_dname_compare(sname, rep->rrsets[i]->rk.dname) != 0){
+			/* cname chain broken */
+			return 0;
+		}
+		/* if this is a cname; move on */
+		if(t == LDNS_RR_TYPE_CNAME) {
+			get_cname_target(rep->rrsets[i], &sname, &snamelen);
+		}
+	}
+	return 1;
+}
+
+int
+reply_all_rrsets_secure(struct reply_info* rep) 
+{
+	size_t i;
+	for(i=0; i<rep->rrset_count; i++) {
+		if( ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
+			->security != sec_status_secure )
+		return 0;
+	}
+	return 1;
+}
@@ -329,6 +329,21 @@ int parse_copy_decompress_rrset(ldns_buffer* pkt, struct msg_parse* msg,
 uint8_t* reply_find_final_cname_target(struct query_info* qinfo,
 	struct reply_info* rep);

+/**
+ * Check if cname chain in cached reply is still valid.
+ * @param rep: reply to check.
+ * @return: true if valid, false if invalid.
+ */
+int reply_check_cname_chain(struct reply_info* rep);
+
+/**
+ * Check security status of all RRs in the message.
+ * @param rep: reply to check
+ * @return: true if all RRs are secure. False if not.
+ *    True if there are zero RRs.
+ */
+int reply_all_rrsets_secure(struct reply_info* rep);
+
 /**
 * Find answer rrset in reply, the one matching qinfo. Follows CNAMEs, so the
 * result may have a different owner name.
@@ -376,3 +376,10 @@ int fptr_whitelist_tube_listen(tube_callback_t* fptr)
 	else if(fptr == &libworker_handle_control_cmd) return 1;
 	return 0;
 }
+
+int fptr_whitelist_mesh_cb(mesh_cb_func_t fptr)
+{
+	if(fptr == &libworker_fg_done_cb) return 1;
+	else if(fptr == &libworker_bg_done_cb) return 1;
+	return 0;
+}
@@ -58,6 +58,7 @@
 #include "util/storage/lruhash.h"
 #include "util/module.h"
 #include "util/tube.h"
+#include "services/mesh.h"

 /**
 * Macro to perform an assertion check for fptr wlist checks.
@@ -307,6 +308,14 @@ int fptr_whitelist_alloc_cleanup(void (*fptr)(void*));
 */
 int fptr_whitelist_tube_listen(tube_callback_t* fptr);

+/**
+ * Check function pointer whitelist for mesh state callback values.
+ *
+ * @param fptr: function pointer to check.
+ * @return false if not in whitelist.
+ */
+int fptr_whitelist_mesh_cb(mesh_cb_func_t fptr);
+
 /** Due to module breakage by fptr wlist, these test app declarations
 * are presented here */
 /** 
@@ -223,6 +223,7 @@
 267,
 268,
 269,
+270,
 280,
 281,
 282,
@@ -3374,7 +3375,6 @@
 3763,
 3764,
 3765,
-3766,
 3767,
 3768,
 3769,
@@ -3878,6 +3878,8 @@
 4554,
 4555,
 4556,
+4557,
+4558,
 4559,
 4566,
 4567,
@@ -4020,6 +4022,7 @@
 5025,
 5026,
 5027,
+5029,
 5030,
 5042,
 5043,
@@ -4059,6 +4062,7 @@
 5102,
 5111,
 5112,
+5113,
 5116,
 5133,
 5137,
@@ -4500,6 +4504,7 @@
 7200,
 7201,
 7227,
+7262,
 7272,
 7273,
 7274,
@@ -4761,6 +4766,7 @@
 9102,
 9103,
 9104,
+9105,
 9119,
 9131,
 9160,
@@ -4999,6 +5005,7 @@
 16367,
 16368,
 16384,
+16900,
 16950,
 16991,
 16992,
@@ -5049,6 +5056,7 @@
 20005,
 20014,
 20034,
+20046,
 20049,
 20167,
 20202,
@@ -5121,6 +5129,7 @@
 25793,
 25900,
 25901,
+25902,
 25903,
 26000,
 26133,
@@ -5206,6 +5215,7 @@
 44818,
 45054,
 45678,
+45825,
 45966,
 46999,
 47000,
@@ -246,13 +246,30 @@ comm_point_send_udp_msg(struct comm_point *c, ldns_buffer* packet,
 		log_err("error: send empty UDP packet");
 #endif
 	log_assert(addr && addrlen > 0);
-	sent = sendto(c->fd, ldns_buffer_begin(packet), 
+	sent = sendto(c->fd, (void*)ldns_buffer_begin(packet), 
 		ldns_buffer_remaining(packet), 0,
 		addr, addrlen);
 	if(sent == -1) {
-#ifdef ENETUNREACH
-		if(errno == ENETUNREACH && verbosity < VERB_ALGO)
-			return 0;
+		/* do not log transient errors (unless high verbosity) */
+#if defined(ENETUNREACH) || defined(EHOSTDOWN) || defined(EHOSTUNREACH) || defined(ENETDOWN)
+		switch(errno) {
+#  ifdef ENETUNREACH
+			case ENETUNREACH:
+#  endif
+#  ifdef EHOSTDOWN
+			case EHOSTDOWN:
+#  endif
+#  ifdef EHOSTUNREACH
+			case EHOSTUNREACH:
+#  endif
+#  ifdef ENETDOWN
+			case ENETDOWN:
+#  endif
+				if(verbosity < VERB_ALGO)
+					return 0;
+			default:
+				break;
+		}
 #endif
 		/* squelch errors where people deploy AAAA ::ffff:bla for
 		 * authority servers, which we try for intranets. */
@@ -530,7 +547,7 @@ comm_point_udp_callback(int fd, short event, void* arg)
 		rep.addrlen = (socklen_t)sizeof(rep.addr);
 		log_assert(fd != -1);
 		log_assert(ldns_buffer_remaining(rep.c->buffer) > 0);
-		recv = recvfrom(fd, ldns_buffer_begin(rep.c->buffer), 
+		recv = recvfrom(fd, (void*)ldns_buffer_begin(rep.c->buffer), 
 			ldns_buffer_remaining(rep.c->buffer), 0, 
 			(struct sockaddr*)&rep.addr, &rep.addrlen);
 		if(recv == -1) {
@@ -711,7 +728,7 @@ comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok)
 	log_assert(fd != -1);
 	if(c->tcp_byte_count < sizeof(uint16_t)) {
 		/* read length bytes */
-		r = recv(fd, ldns_buffer_at(c->buffer, c->tcp_byte_count), 
+		r = recv(fd,(void*)ldns_buffer_at(c->buffer,c->tcp_byte_count),
 			sizeof(uint16_t)-c->tcp_byte_count, 0);
 		if(r == 0)
 			return 0;
@@ -760,7 +777,7 @@ comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok)
 	}

 	log_assert(ldns_buffer_remaining(c->buffer) > 0);
-	r = recv(fd, ldns_buffer_current(c->buffer), 
+	r = recv(fd, (void*)ldns_buffer_current(c->buffer), 
 		ldns_buffer_remaining(c->buffer), 0);
 	if(r == 0) {
 		return 0;
@@ -902,7 +919,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
 		}
 	}
 	log_assert(ldns_buffer_remaining(c->buffer) > 0);
-	r = send(fd, ldns_buffer_current(c->buffer), 
+	r = send(fd, (void*)ldns_buffer_current(c->buffer), 
 		ldns_buffer_remaining(c->buffer), 0);
 	if(r == -1) {
 #ifndef USE_WINSOCK
@@ -78,6 +78,12 @@ struct ub_randstate {
 /** Size of key to use */
 #define SEED_SIZE 20

+/** 
+ * Max random value.  Similar to RAND_MAX, but more portable
+ * (mingw uses only 15 bits random).
+ */
+#define MAX_VALUE 0x7fffffff
+
 /** Number of bytes to reseed after */
 #define REKEY_BYTES	(1 << 24)

@@ -168,7 +174,7 @@ ub_random(struct ub_randstate* s)
 	RC4(&s->rc4, sizeof(r), 
 		(unsigned char *)&r, (unsigned char *)&r);
 	s->rc4_ready -= sizeof(r);
-	return (long int)((r) % (((unsigned)RAND_MAX + 1)));
+	return (long int)((r) % (((unsigned)MAX_VALUE + 1)));
 }

 void 
@@ -76,6 +76,7 @@ settime(struct event_base* base)
        return 0;
 }

+#ifdef UNBOUND_DEBUG
 /**
 * Find a fd in the list of items.
 * Note that not all items have a fd associated (those are -1).
@@ -94,9 +95,10 @@ find_fd(struct event_base* base, int fd)
 	}
 	return -1;
 }
+#endif

 /** Find ptr in base array */
-static int
+static void
 zero_waitfor(WSAEVENT waitfor[], WSAEVENT x)
 {
 	int i;
@@ -915,7 +915,8 @@ anchors_assemble_rrsets(struct val_anchors* anchors)
 			char b[257];
 			dname_str(ta->name, b);
 			log_warn("trust anchor %s has no supported algorithms,"
-				" the anchor is ignored", b);
+				" the anchor is ignored (check if you need to"
+				" upgrade unbound and openssl)", b);
 			(void)rbtree_delete(anchors->tree, &ta->node);
 		}
 		ta = next;
@@ -522,9 +522,6 @@ dnskeyset_verify_rrset_sig(struct module_env* env, struct val_env* ve,
 			tag != dnskey_calc_keytag(dnskey, i))
 			continue;
 		numchecked ++;
-		/* skip revoked keys */
-		if(dnskey_get_flags(dnskey, i) & LDNS_KEY_REVOKE_KEY)
-			continue;

 		/* see if key verifies */
 		sec = dnskey_verify_rrset_sig(env->scratch, 
@@ -663,6 +663,21 @@ val_check_nonsecure(struct val_env* ve, struct reply_info* rep)
 			 * But this rrset did not verify.
 			 * Therefore the message is bogus.
 			 */
+
+			/* check if authority consists of only an NS record
+			 * which is bad, and there is an answer section with
+			 * data.  In that case, delete NS and additional to 
+			 * be lenient and make a minimal response */
+			if(rep->an_numrrsets != 0 && rep->ns_numrrsets == 1 &&
+				ntohs(rep->rrsets[i]->rk.type) 
+				== LDNS_RR_TYPE_NS) {
+				verbose(VERB_ALGO, "truncate to minimal");
+				rep->ns_numrrsets = 0;
+				rep->ar_numrrsets = 0;
+				rep->rrset_count = rep->an_numrrsets;
+				return;
+			}
+
 			log_nametypeclass(VERB_QUERY, "message is bogus, "
 				"non secure rrset",
 				rep->rrsets[i]->rk.dname, 
@@ -251,9 +251,8 @@ val_error(struct module_qstate* qstate, int id)
 /** 
 * Check to see if a given response needs to go through the validation
 * process. Typical reasons for this routine to return false are: CD bit was
- * on in the original request, the response was already validated, or the
- * response is a kind of message that is unvalidatable (i.e., SERVFAIL,
- * REFUSED, etc.)
+ * on in the original request, or the response is a kind of message that 
+ * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.)
 *
 * @param qstate: query state.
 * @param ret_rc: rcode for this message (if noerror - examine ret_msg).
@@ -292,14 +291,25 @@ needs_validation(struct module_qstate* qstate, int ret_rc,
 		verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs.");
 		return 0;
 	}
+	return 1;
+}

+/**
+ * Check to see if the response has already been validated.
+ * @param ret_msg: return msg, can be NULL
+ * @return true if the response has already been validated
+ */
+static int
+already_validated(struct dns_msg* ret_msg)
+{
 	/* validate unchecked, and re-validate bogus messages */
 	if (ret_msg && ret_msg->rep->security > sec_status_bogus)
 	{
-		verbose(VERB_ALGO, "response has already been validated");
-		return 0;
+		verbose(VERB_ALGO, "response has already been validated: %s",
+			sec_status_to_string(ret_msg->rep->security));
+		return 1;
 	}
-	return 1;
+	return 0;
 }

 /**
@@ -468,6 +478,37 @@ validate_msg_signatures(struct module_env* env, struct val_env* ve,
 	return 1;
 }

+/**
+ * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding
+ * and saw the NS record without signatures from a referral).
+ * The positive response has a mangled authority section.
+ * Remove that authority section and the additional section.
+ * @param rep: reply
+ * @return true if a wrongly truncated response.
+ */
+static int
+detect_wrongly_truncated(struct reply_info* rep)
+{
+	size_t i;
+	/* only NS in authority, and it is bogus */
+	if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0)
+		return 0;
+	if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS)
+		return 0;
+	if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ]
+		->entry.data)->security == sec_status_secure)
+		return 0;
+	/* answer section is present and secure */
+	for(i=0; i<rep->an_numrrsets; i++) {
+		if(((struct packed_rrset_data*)rep->rrsets[ i ]
+			->entry.data)->security != sec_status_secure)
+			return 0;
+	}
+	verbose(VERB_ALGO, "truncating to minimal response");
+	return 1;
+}
+
+
 /**
 * Given a "positive" response -- a response that contains an answer to the
 * question, and no CNAME chain, validate this response. 
@@ -1439,17 +1480,36 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 		vq->chase_reply->security = sec_status_bogus;
 		return 1;
 	}
+	subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
+		&vq->qchase, vq->orig_msg->rep, vq->rrset_skip);

 	/* check signatures in the message; 
 	 * answer and authority must be valid, additional is only checked. */
 	if(!validate_msg_signatures(qstate->env, ve, &vq->qchase, 
 		vq->chase_reply, vq->key_entry)) {
-		verbose(VERB_DETAIL, "Validate: message contains bad rrsets");
-		return 1;
+		/* workaround bad recursor out there that truncates (even
+		 * with EDNS4k) to 512 by removing RRSIG from auth section
+		 * for positive replies*/
+		if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY
+			|| subtype == VAL_CLASS_CNAME) &&
+			detect_wrongly_truncated(vq->orig_msg->rep)) {
+			/* truncate the message some more */
+			vq->orig_msg->rep->ns_numrrsets = 0;
+			vq->orig_msg->rep->ar_numrrsets = 0;
+			vq->orig_msg->rep->rrset_count = 
+				vq->orig_msg->rep->an_numrrsets;
+			vq->chase_reply->ns_numrrsets = 0;
+			vq->chase_reply->ar_numrrsets = 0;
+			vq->chase_reply->rrset_count = 
+				vq->chase_reply->an_numrrsets;
+		}
+		else {
+			verbose(VERB_DETAIL, "Validate: message contains "
+				"bad rrsets");
+			return 1;
+		}
 	}

-	subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
-		&vq->qchase, vq->orig_msg->rep, vq->rrset_skip);
 	switch(subtype) {
 		case VAL_CLASS_POSITIVE:
 			verbose(VERB_ALGO, "Validating a positive response");
@@ -1736,6 +1796,9 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 	 * endless bogus revalidation */
 	if(vq->orig_msg->rep->security == sec_status_bogus) {
 		vq->orig_msg->rep->ttl = *qstate->env->now + ve->bogus_ttl;
+		if(qstate->env->cfg->val_log_level >= 1) {
+			log_query_info(0, "validation failure", &qstate->qinfo);
+		}
 		/* If we are in permissive mode, bogus gets indeterminate */
 		if(ve->permissive_mode)
 			vq->orig_msg->rep->security = sec_status_indeterminate;
@@ -1937,6 +2000,10 @@ val_operate(struct module_qstate* qstate, enum module_ev event, int id,
 			qstate->ext_state[id] = module_finished;
 			return;
 		}
+		if(already_validated(qstate->return_msg)) {
+			qstate->ext_state[id] = module_finished;
+			return;
+		}
 		/* create state to start validation */
 		qstate->ext_state[id] = module_error; /* override this */
 		if(!vq) {
@@ -2038,7 +2105,7 @@ primeResponseToKE(int rcode, struct dns_msg* msg, struct trust_anchor* ta,

 	if(sec != sec_status_secure) {
 		log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
-			"could not fetch secure DNSKEY rrset", 
+			"DNSKEY rrset is not secure", 
 			ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
 		/* NOTE: in this case, we should probably reject the trust 
 		 * anchor for longer, perhaps forever. */
@@ -2397,7 +2464,8 @@ process_dlv_response(struct module_qstate* qstate, struct val_qstate* vq,
 	}
 	if(msg->rep->security != sec_status_secure) {
 		vq->dlv_status = dlv_error;
-		verbose(VERB_ALGO, "response is not secure");
+		verbose(VERB_ALGO, "response is not secure, %s",
+			sec_status_to_string(msg->rep->security));
 		return;
 	}
 	/* was the lookup a success? validated DLV? */
@@ -79,6 +79,28 @@ Unbound and its utilities also work from the commandline (like on unix) if
 you prefer.


+++ Cross compile
+
+You can crosscompile unbound.  This results in .exe files.
+Install the packages: mingw32-binutils mingw32-cpp mingw32-filesystem 
+mingw32-gcc mingw32-openssl mingw32-openssl-static mingw32-runtime zip
+mingw32-termcap mingw32-w32api mingw32-zlib mingw32-zlib-static mingw32-nsis
+(package names for fedora 11).
+
+For dynamic linked executables
+$ mingw32-configure
+$ make
+$ mkdir /home/user/installdir
+$ make install DESTDIR=/home/user/installdir
+Find the dlls and exes in /home/user/installdir and
+crypto in /usr/i686-pc-mingw32/sys-root/mingw/bin
+
+For static linked executables
+Use --enable-staticexe for mingw32-configure, see above. Or use makedist.sh,
+copy System.dll from the windows dist of NSIS to /usr/share/nsis/Plugins/
+Then do ./makedist.sh -w and the setup.exe is created using nsis.
+
+
 +++ CREDITS

 Unbound was written in portable C by Wouter Wijngaards (NLnet Labs).
@@ -4,7 +4,6 @@ SetCompressor /solid /final lzma

 !include LogicLib.nsh
 !include MUI2.nsh
-!include setup_servicelib.nsh

 !define VERSION "0.0.0"
 !define QUADVERSION "0.0.0.0"
@@ -33,8 +32,8 @@ Var StartMenuFolder
 #ReserveFile "System.dll"
 #ReserveFile "NsExec.dll"

-!define MUI_ICON "${NSISDIR}\contrib\graphics\icons\orange-install-nsis.ico"
-!define MUI_UNICON "${NSISDIR}\contrib\graphics\icons\orange-uninstall-nsis.ico"
+!define MUI_ICON "${NSISDIR}\Contrib\Graphics\Icons\orange-install-nsis.ico"
+!define MUI_UNICON "${NSISDIR}\Contrib\Graphics\Icons\orange-uninstall-nsis.ico"

 !define MUI_HEADERIMAGE
 !define MUI_HEADERIMAGE_RIGHT
@@ -75,6 +74,10 @@ section "DLV - dlv.isc.org" SectionDLV
 	# add estimated size for key (Kb)
 	AddSize 2
 	SetOutPath $INSTDIR
+
+	# libgcc exception lib used by NSISdl plugin (in crosscompile).
+	File /nonfatal "/oname=$PLUGINSDIR\libgcc_s_sjlj-1.dll" "/usr/i686-pc-mingw32/sys-root/mingw/bin/libgcc_s_sjlj-1.dll"
+
 	NSISdl::download "http://ftp.isc.org/www/dlv/dlv.isc.org.key" "$INSTDIR\dlv.isc.org.key"
 	Pop $R0 # result from Inetc::get
 	${If} $R0 != "success"
@@ -144,7 +147,7 @@ section "-hidden.postinstall"
 	# install service entry
 	nsExec::ExecToLog '"$INSTDIR\unbound-service-install.exe"'
 	# start unbound service
-	!insertmacro SERVICE "start" "unbound" ""
+	nsExec::ExecToLog '"$INSTDIR\unbound-service-install.exe" start'
 sectionEnd

 # set section descriptions
@@ -157,13 +160,15 @@ LangString DESC_dlv ${LANG_ENGLISH} "Set up to use DLV with dlv.isc.org. Downloa
 !insertmacro MUI_FUNCTION_DESCRIPTION_END

 # setup macros for uninstall functions.
+!ifdef UN
 !undef UN
+!endif
 !define UN "un."

 # uninstaller section
 section "un.Unbound"
 	# stop unbound service
-	!insertmacro SERVICE "stop" "unbound" ""
+	nsExec::ExecToLog '"$INSTDIR\unbound-service-remove.exe" stop'
 	# uninstall service entry
 	nsExec::ExecToLog '"$INSTDIR\unbound-service-remove.exe"'
 	# deregister uninstall
@@ -1,372 +0,0 @@
-; Taken from http://nsis.sourceforge.net/NSIS_Service_Lib on 10-mar-2009
-;
-
-; NSIS SERVICE LIBRARY - servicelib.nsh
-; Version 1.5 - Jun 25th, 2008
-; Questions/Comments - dselkirk@hotmail.com
-;
-; Description:
-;   Provides an interface to window services
-;
-; Inputs:
-;   action     - systemlib action ie. create, delete, start, stop, pause,
-;              continue, installed, running, status
-;   name       - name of service to manipulate
-;   param      - action parameters; usage: var1=value1;var2=value2;...etc.
-;                 (don't forget to add a ';' after the last value!)
-;
-; Actions:
-;   create     - creates a new windows service
-;              Parameters:
-;                path        - path to service executable
-;                autostart   - automatically start with system ie. 1|0
-;                interact    - interact with the desktop ie. 1|0
-;                depend      - service dependencies
-;                user        - user that runs the service
-;                password    - password of the above user
-;                display     - display name in service's console
-;                description - Description of service
-;
-;   delete     - deletes a windows service
-;   start      - start a stopped windows service
-;   stop       - stops a running windows service
-;   pause      - pauses a running windows service
-;   continue   - continues a paused windows service
-;   installed  - is the provided service installed
-;              Parameters:
-;                action      - if true then invokes the specified action
-;   running    - is the provided service running
-;              Parameters:
-;                action      - if true then invokes the specified action
-;   status     - check the status of the provided service
-;
-; If run from uninstall define "UN" as "un." before running.
-;
-; Usage:
-;   Method 1:
-;     Push "action"
-;     Push "name"
-;     Push "param"
-;     Call Service
-;     Pop $0 ;response
-;
-;   Method 2:
-;     !insertmacro SERVICE "action" "name" "param"
-;
-; History:
-;   1.0 - 09/15/2003 - Initial release
-;   1.1 - 09/16/2003 - Changed &l to i, thx brainsucker
-;   1.2 - 02/29/2004 - Fixed documentation.
-;   1.3 - 01/05/2006 - Fixed interactive flag and pop order (Kichik)
-;   1.4 - 12/07/2006 - Added display and depend, fixed datatypes (Vitoco)
-;   1.5 - 06/25/2008 - Added description of service.(DeSafe.com/liuqixing#gmail.com)
- 
-!ifndef SERVICELIB
-  !define SERVICELIB
- 
-  !define SC_MANAGER_ALL_ACCESS 0x3F
-  !define SERVICE_ALL_ACCESS 0xF01FF
- 
-  !define SERVICE_CONTROL_STOP  1
-  !define SERVICE_CONTROL_PAUSE  2
-  !define SERVICE_CONTROL_CONTINUE  3
- 
-  !define SERVICE_STOPPED 0x1
-  !define SERVICE_START_PENDING 0x2
-  !define SERVICE_STOP_PENDING 0x3
-  !define SERVICE_RUNNING 0x4
-  !define SERVICE_CONTINUE_PENDING 0x5
-  !define SERVICE_PAUSE_PENDING 0x6
-  !define SERVICE_PAUSED 0x7
- 
-  !ifndef UN
-    !define UN ""
-  !endif
- 
-  !macro SERVICE ACTION NAME PARAM
-    Push '${ACTION}'
-    Push '${NAME}'
-    Push '${PARAM}'
-    Call ${UN}Service
-  !macroend
- 
-  !macro FUNC_GETPARAM
-    Push $0
-    Push $1
-    Push $2
-    Push $3
-    Push $4
-    Push $5
-    Push $6
-    Push $7
-    Exch 8
-    Pop $1 ;name
-    Exch 8
-    Pop $2 ;source
-    StrCpy $0 ""
-    StrLen $7 $2
-    StrCpy $3 0
-    lbl_loop:
-      IntCmp $3 $7 0 0 lbl_done
-      StrLen $4 "$1="
-      StrCpy $5 $2 $4 $3
-      StrCmp $5 "$1=" 0 lbl_next
-      IntOp $5 $3 + $4
-      StrCpy $3 $5
-      lbl_loop2:
-        IntCmp $3 $7 0 0 lbl_done
-        StrCpy $6 $2 1 $3
-        StrCmp $6 ";" 0 lbl_next2
-        IntOp $6 $3 - $5
-        StrCpy $0 $2 $6 $5
-        Goto lbl_done
-        lbl_next2:
-        IntOp $3 $3 + 1
-        Goto lbl_loop2
-      lbl_next:
-      IntOp $3 $3 + 1
-      Goto lbl_loop
-    lbl_done:
-    Pop $5
-    Pop $4
-    Pop $3
-    Pop $2
-    Pop $1
-    Exch 2
-    Pop $6
-    Pop $7
-    Exch $0
-  !macroend
- 
-  !macro CALL_GETPARAM VAR NAME DEFAULT LABEL
-    Push $1
-    Push ${NAME}
-    Call ${UN}GETPARAM
-    Pop $6
-    StrCpy ${VAR} "${DEFAULT}"
-    StrCmp $6 "" "${LABEL}" 0
-    StrCpy ${VAR} $6
-  !macroend
- 
-  !macro FUNC_SERVICE UN
-    Push $0
-    Push $1
-    Push $2
-    Push $3
-    Push $4
-    Push $5
-    Push $6
-    Push $7
-    Exch 8
-    Pop $1 ;param
-    Exch 8
-    Pop $2 ;name
-    Exch 8
-    Pop $3 ;action
-    ;$0 return
-    ;$4 OpenSCManager
-    ;$5 OpenService
- 
-    StrCpy $0 "false"
-    System::Call 'advapi32::OpenSCManagerA(n, n, i ${SC_MANAGER_ALL_ACCESS}) i.r4'
-    IntCmp $4 0 lbl_done
-    StrCmp $3 "create" lbl_create
-    System::Call 'advapi32::OpenServiceA(i r4, t r2, i ${SERVICE_ALL_ACCESS}) i.r5'
-    IntCmp $5 0 lbl_done
- 
-    lbl_select:
-    StrCmp $3 "delete" lbl_delete
-    StrCmp $3 "start" lbl_start
-    StrCmp $3 "stop" lbl_stop
-    StrCmp $3 "pause" lbl_pause
-    StrCmp $3 "continue" lbl_continue
-    StrCmp $3 "installed" lbl_installed
-    StrCmp $3 "running" lbl_running
-    StrCmp $3 "status" lbl_status
-    Goto lbl_done
- 
-    ; create service
-    lbl_create:
-      Push $R1 ;depend
-      Push $R2 ;user
-      Push $R3 ;password
-      Push $R4 ;interact
-      Push $R5 ;autostart
-      Push $R6 ;path
-      Push $R7 ;display
-      Push $R8 ;description
- 
-      !insertmacro CALL_GETPARAM $R1 "depend" "n" "lbl_depend"
-        StrCpy $R1 't "$R1"'
-      lbl_depend:
-      StrCmp $R1 "n" 0 lbl_machine ;old name of depend param
-      !insertmacro CALL_GETPARAM $R1 "machine" "n" "lbl_machine"
-        StrCpy $R1 't "$R1"'
-      lbl_machine:
- 
-      !insertmacro CALL_GETPARAM $R2 "user" "n" "lbl_user"
-        StrCpy $R2 't "$R2"'
-      lbl_user:
- 
-      !insertmacro CALL_GETPARAM $R3 "password" "n" "lbl_password"
-        StrCpy $R3 't "$R3"'
-      lbl_password:
- 
-      !insertmacro CALL_GETPARAM $R4 "interact" "0x10" "lbl_interact"
-        StrCpy $6 0x10
-        IntCmp $R4 0 +2
-        IntOp $6 $6 | 0x100
-        StrCpy $R4 $6
-      lbl_interact:
- 
-      !insertmacro CALL_GETPARAM $R5 "autostart" "0x3" "lbl_autostart"
-        StrCpy $6 0x3
-        IntCmp $R5 0 +2
-        StrCpy $6 0x2
-        StrCpy $R5 $6
-      lbl_autostart:
- 
-      !insertmacro CALL_GETPARAM $R6 "path" "n" "lbl_path"
-      lbl_path:
- 
-      !insertmacro CALL_GETPARAM $R7 "display" "$2" "lbl_display"
-      lbl_display:
- 
-      !insertmacro CALL_GETPARAM $R8 "description" "$2" "lbl_description"
-      lbl_description:
- 
-      System::Call 'advapi32::CreateServiceA(i r4, t r2, t R7, i ${SERVICE_ALL_ACCESS}, \
-                                             i R4, i R5, i 0, t R6, n, n, $R1, $R2, $R3) i.r6'
- 
-      ;	write description of service
-      WriteRegStr HKLM "SYSTEM\ControlSet001\Services\$2" "Description" $R8
- 
-      Pop $R8
-      Pop $R7
-      Pop $R6
-      Pop $R5
-      Pop $R4
-      Pop $R3
-      Pop $R2
-      Pop $R1
-      StrCmp $6 0 lbl_done lbl_good
- 
-    ; delete service
-    lbl_delete:
-      System::Call 'advapi32::DeleteService(i r5) i.r6'
-      StrCmp $6 0 lbl_done lbl_good
- 
-    ; start service
-    lbl_start:
-      System::Call 'advapi32::StartServiceA(i r5, i 0, i 0) i.r6'
-      StrCmp $6 0 lbl_done lbl_good
- 
-    ; stop service
-    lbl_stop:
-      Push $R1
-      System::Call '*(i,i,i,i,i,i,i) i.R1'
-      System::Call 'advapi32::ControlService(i r5, i ${SERVICE_CONTROL_STOP}, i $R1) i'
-      System::Free $R1
-      Pop $R1
-      StrCmp $6 0 lbl_done lbl_good
- 
-    ; pause service
-    lbl_pause:
-      Push $R1
-      System::Call '*(i,i,i,i,i,i,i) i.R1'
-      System::Call 'advapi32::ControlService(i r5, i ${SERVICE_CONTROL_PAUSE}, i $R1) i'
-      System::Free $R1
-      Pop $R1
-      StrCmp $6 0 lbl_done lbl_good
- 
-    ; continue service
-    lbl_continue:
-      Push $R1
-      System::Call '*(i,i,i,i,i,i,i) i.R1'
-      System::Call 'advapi32::ControlService(i r5, i ${SERVICE_CONTROL_CONTINUE}, i $R1) i'
-      System::Free $R1
-      Pop $R1
-      StrCmp $6 0 lbl_done lbl_good
- 
-    ; is installed
-    lbl_installed:
-      !insertmacro CALL_GETPARAM $7 "action" "" "lbl_good"
-        StrCpy $3 $7
-        Goto lbl_select
- 
-    ; is service running
-    lbl_running:
-      Push $R1
-      System::Call '*(i,i,i,i,i,i,i) i.R1'
-      System::Call 'advapi32::QueryServiceStatus(i r5, i $R1) i'
-      System::Call '*$R1(i, i.r6)'
-      System::Free $R1
-      Pop $R1
-      IntFmt $6 "0x%X" $6
-      StrCmp $6 ${SERVICE_RUNNING} 0 lbl_done
-      !insertmacro CALL_GETPARAM $7 "action" "" "lbl_good"
-        StrCpy $3 $7
-        Goto lbl_select
- 
-    lbl_status:
-      Push $R1
-      System::Call '*(i,i,i,i,i,i,i) i.R1'
-      System::Call 'advapi32::QueryServiceStatus(i r5, i $R1) i'
-      System::Call '*$R1(i, i .r6)'
-      System::Free $R1
-      Pop $R1
-      IntFmt $6 "0x%X" $6
-      StrCpy $0 "running"
-      IntCmp $6 ${SERVICE_RUNNING} lbl_done
-      StrCpy $0 "stopped"
-      IntCmp $6 ${SERVICE_STOPPED} lbl_done
-      StrCpy $0 "start_pending"
-      IntCmp $6 ${SERVICE_START_PENDING} lbl_done
-      StrCpy $0 "stop_pending"
-      IntCmp $6 ${SERVICE_STOP_PENDING} lbl_done
-      StrCpy $0 "running"
-      IntCmp $6 ${SERVICE_RUNNING} lbl_done
-      StrCpy $0 "continue_pending"
-      IntCmp $6 ${SERVICE_CONTINUE_PENDING} lbl_done
-      StrCpy $0 "pause_pending"
-      IntCmp $6 ${SERVICE_PAUSE_PENDING} lbl_done
-      StrCpy $0 "paused"
-      IntCmp $6 ${SERVICE_PAUSED} lbl_done
-      StrCpy $0 "unknown"
-      Goto lbl_done
- 
-    lbl_good:
-    StrCpy $0 "true"
-    lbl_done:
-    IntCmp $5 0 +2
-    System::Call 'advapi32::CloseServiceHandle(i r5) n'
-    IntCmp $4 0 +2
-    System::Call 'advapi32::CloseServiceHandle(i r4) n'
-    Pop $4
-    Pop $3
-    Pop $2
-    Pop $1
-    Exch 3
-    Pop $5
-    Pop $7
-    Pop $6
-    Exch $0
-  !macroend
- 
-  Function Service
-    !insertmacro FUNC_SERVICE ""
-  FunctionEnd
- 
-  Function un.Service
-    !insertmacro FUNC_SERVICE "un."
-  FunctionEnd
- 
-  Function GetParam
-    !insertmacro FUNC_GETPARAM
-  FunctionEnd
- 
-  Function un.GetParam
-    !insertmacro FUNC_GETPARAM
-  FunctionEnd
- 
-!endif
@@ -47,9 +47,19 @@
 #include "winrc/w_inst.h"

 /** Install service main */
-int main(int ATTR_UNUSED(argc), char** ATTR_UNUSED(argv))
+int main(int argc, char** argv)
 {
-	/*FILE* out = fopen("unbound-service-install.log", "w");*/
-	wsvc_install(NULL, "unbound-service-install.exe");
+	FILE* out = stdout;
+	/* out = fopen("unbound-service-install.log", "w");*/
+	if(argc == 2 && strcmp(argv[1], "start")==0) {
+		wsvc_rc_start(out);
+		return 0;
+	}
+	if(argc != 1) {
+		if(out) fprintf(out, "Usage: %s [start]\n", argv[0]);
+		else	printf("Usage: %s [start]\n", argv[0]);
+		return 1;
+	}
+	wsvc_install(out, "unbound-service-install.exe");
 	return 0;
 }
@@ -1,5 +1,5 @@
 /*
- * winrc/unbound-service-install.c - windows services installation util
+ * winrc/unbound-service-remove.c - windows services installation util
 *
 * Copyright (c) 2009, NLnet Labs. All rights reserved.
 *
@@ -46,10 +46,20 @@
 #include "config.h"
 #include "winrc/w_inst.h"

-/** Install service main */
-int main(int ATTR_UNUSED(argc), char** ATTR_UNUSED(argv))
+/** Remove service main */
+int main(int argc, char** argv)
 {
-	/*FILE* out = fopen("unbound-service-remove.log", "w");*/
+	FILE* out = stdout;
+	/* out = fopen("unbound-service-remove.log", "w");*/
+	if(argc == 2 && strcmp(argv[1], "stop")==0) {
+		wsvc_rc_stop(out);
+		return 0;
+	}
+	if(argc != 1) {
+		if(out) fprintf(out, "Usage: %s [stop]\n", argv[0]);
+		else	printf("Usage: %s [stop]\n", argv[0]);
+		return 1;
+	}
 	wsvc_remove(NULL);
 	return 0;
 }
@@ -43,11 +43,28 @@
 #include "winrc/w_inst.h"
 #include "winrc/win_svc.h"

+void wsvc_err2str(char* str, size_t len, const char* fixed, DWORD err)
+{
+	LPTSTR buf;
+	if(FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | 
+		FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_ALLOCATE_BUFFER, 
+		NULL, err, 0, (LPTSTR)&buf, 0, NULL) == 0) {
+		/* could not format error message */
+		snprintf(str, len, "%s GetLastError=%d", fixed, (int)err);
+		return;
+	}
+	snprintf(str, len, "%s (err=%d): %s", fixed, (int)err, buf);
+	LocalFree(buf);
+}
+
 /** exit with windows error */
 static void
 fatal_win(FILE* out, const char* str)
 {
-        if(out) fprintf(out, "%s (%d)\n", str, (int)GetLastError());
+	char e[256];
+	wsvc_err2str(e, sizeof(e), str, (int)GetLastError());
+        if(out) fprintf(out, "%s\n", e);
+        else fprintf(stderr, "%s\n", e);
        exit(1);
 }

@@ -75,7 +92,7 @@ event_reg_install(FILE* out, const char* pathname)
 	if(RegSetValueEx(hk, (LPCTSTR)"EventMessageFile", 
 		0, /* reserved, mustbezero */
 		REG_EXPAND_SZ, /* value type (string w env subst) */
-		pathname, /* data */
+		(BYTE*)pathname, /* data */
 		(DWORD)strlen(pathname)+1)) /* length of data */
 	{
 		RegCloseKey(hk);
@@ -93,7 +110,7 @@ event_reg_install(FILE* out, const char* pathname)

 	/* category message file */
 	if(RegSetValueEx(hk, (LPCTSTR)"CategoryMessageFile", 0, REG_EXPAND_SZ, 
-		pathname, (DWORD)strlen(pathname)+1)) {
+		(BYTE*)pathname, (DWORD)strlen(pathname)+1)) {
 		RegCloseKey(hk);
 		fatal_win(out, "could not registry set CategoryMessageFile");
 	}
@@ -109,7 +126,7 @@ event_reg_install(FILE* out, const char* pathname)
 	if(out) fprintf(out, "installed reg entries\n");
 }

-/** remove regisytry entries for eventlog */
+/** remove registry entries for eventlog */
 static void
 event_reg_remove(FILE* out)
 {
@@ -213,6 +230,7 @@ wsvc_install(FILE* out, const char* rename)
        if(out) fprintf(out, "unbound service installed\n");
 }

+
 /* Remove installed service from servicecontrolmanager */
 void
 wsvc_remove(FILE* out)
@@ -228,6 +246,8 @@ wsvc_remove(FILE* out)
                fatal_win(out, "could not OpenService");
        }
        if(!DeleteService(sv)) {
+		CloseServiceHandle(sv);
+		CloseServiceHandle(scm);
                fatal_win(out, "could not DeleteService");
        }
        CloseServiceHandle(sv);
@@ -235,3 +255,54 @@ wsvc_remove(FILE* out)
 	event_reg_remove(out);
        if(out) fprintf(out, "unbound service removed\n");
 }
+
+
+/* Start daemon */
+void
+wsvc_rc_start(FILE* out)
+{
+	SC_HANDLE scm;
+	SC_HANDLE sv;
+        if(out) fprintf(out, "start unbound service\n");
+	scm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
+	if(!scm) fatal_win(out, "could not OpenSCManager");
+	sv = OpenService(scm, SERVICE_NAME, SERVICE_START);
+	if(!sv) {
+		CloseServiceHandle(scm);
+		fatal_win(out, "could not OpenService");
+	}
+	if(!StartService(sv, 0, NULL)) {
+		CloseServiceHandle(sv);
+		CloseServiceHandle(scm);
+		fatal_win(out, "could not StartService");
+	}
+	CloseServiceHandle(sv);
+	CloseServiceHandle(scm);
+        if(out) fprintf(out, "unbound service started\n");
+}
+
+
+/* Stop daemon */
+void
+wsvc_rc_stop(FILE* out)
+{
+	SC_HANDLE scm;
+	SC_HANDLE sv;
+	SERVICE_STATUS st;
+        if(out) fprintf(out, "stop unbound service\n");
+	scm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
+	if(!scm) fatal_win(out, "could not OpenSCManager");
+	sv = OpenService(scm, SERVICE_NAME, SERVICE_STOP);
+	if(!sv) {
+		CloseServiceHandle(scm);
+		fatal_win(out, "could not OpenService");
+	}
+	if(!ControlService(sv, SERVICE_CONTROL_STOP, &st)) {
+		CloseServiceHandle(sv);
+		CloseServiceHandle(scm);
+		fatal_win(out, "could not ControlService");
+	}
+	CloseServiceHandle(sv);
+	CloseServiceHandle(scm);
+        if(out) fprintf(out, "unbound service stopped\n");
+}
@@ -56,4 +56,25 @@ void wsvc_install(FILE* out, const char* rename);
 */
 void wsvc_remove(FILE* out);

+/**
+ * Start the service from servicecontrolmanager, tells OS to start daemon.
+ * @param out: debug output printed here (errors). or NULL.
+ */
+void wsvc_rc_start(FILE* out);
+
+/**
+ * Stop the service from servicecontrolmanager, tells OS to stop daemon.
+ * @param out: debug output printed here (errors). or NULL.
+ */
+void wsvc_rc_stop(FILE* out);
+
+/** 
+ * Convert windows GetLastError() value to a neat string.
+ * @param str: destination buffer
+ * @param len: length of dest buffer
+ * @param fixed: fixed text to prepend to string.
+ * @param err: the GetLastError() value.
+ */
+void wsvc_err2str(char* str, size_t len, const char* fixed, DWORD err);
+
 #endif /* WINRC_W_INST_H */
@@ -48,6 +48,7 @@
 #include "winrc/w_inst.h"
 #include "daemon/daemon.h"
 #include "daemon/worker.h"
+#include "daemon/remote.h"
 #include "util/config_file.h"
 #include "util/netevent.h"
 #include "util/winsock_event.h"
@@ -126,11 +127,12 @@ static void
 reportev(const char* str)
 {
 	char b[256];
+	char e[256];
 	HANDLE* s;
 	LPCTSTR msg = b;
 	/* print quickly to keep GetLastError value */
-	snprintf(b, sizeof(b), "%s: %s (%d)", SERVICE_NAME, 
-		str, (int)GetLastError());
+	wsvc_err2str(e, sizeof(e), str, GetLastError());
+	snprintf(b, sizeof(b), "%s: %s", SERVICE_NAME, e);
 	s = RegisterEventSource(NULL, SERVICE_NAME);
 	if(!s) return;
 	ReportEvent(s, /* event log */
@@ -180,7 +182,7 @@ lookup_reg_str(const char* key, const char* name)
 	if(type == REG_SZ || type == REG_MULTI_SZ || type == REG_EXPAND_SZ) {
 		buf[sizeof(buf)-1] = 0;
 		buf[sizeof(buf)-2] = 0; /* for multi_sz */
-		result = strdup(buf);
+		result = strdup((char*)buf);
 		if(!result) reportev("out of memory");
 	}
 	return result;
@@ -220,9 +222,11 @@ lookup_reg_int(const char* key, const char* name)
 	if(type == REG_SZ || type == REG_MULTI_SZ || type == REG_EXPAND_SZ) {
 		buf[sizeof(buf)-1] = 0;
 		buf[sizeof(buf)-2] = 0; /* for multi_sz */
-		result = atoi(buf);
+		result = atoi((char*)buf);
 	} else if(type == REG_DWORD) {
-		result = *(DWORD*)buf;
+		DWORD r;
+		memmove(&r, buf, sizeof(r));
+		result = r;
 	} 
 	return result;
 }
@@ -283,7 +287,15 @@ service_init(int r, struct daemon** d, struct config_file** c)
 	if(!r) report_status(SERVICE_START_PENDING, NO_ERROR, 2400);
 	verbose(VERB_QUERY, "winservice - apply cfg");
 	daemon_apply_cfg(daemon, cfg);
-	
+
+	if(!r) report_status(SERVICE_START_PENDING, NO_ERROR, 2300);
+	if(!(daemon->rc = daemon_remote_create(cfg))) {
+		log_err("could not set up remote-control");
+		daemon_delete(daemon);
+		config_delete(cfg);
+		return 0;
+	}
+
 	/* open ports */
 	/* keep reporting that we are busy starting */
 	if(!r) report_status(SERVICE_START_PENDING, NO_ERROR, 2200);
Author	SHA1	Message	Date
Wouter Wijngaards	2f85c5817c	1.3.3 release. git-svn-id: file:///svn/unbound/tags/release-1.3.3@1744 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-08-04 14:27:42 +00:00
Wouter Wijngaards	6f4522a55c	iana portlist updated. git-svn-id: file:///svn/unbound/trunk@1741 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-08-03 09:04:06 +00:00
Wouter Wijngaards	b97dbd3c8f	Fix for Roland, tell why the error happens. git-svn-id: file:///svn/unbound/trunk@1740 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-08-03 08:46:26 +00:00
Wouter Wijngaards	112df5ab6c	iana portlist updated. git-svn-id: file:///svn/unbound/trunk@1739 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-27 12:44:50 +00:00
Wouter Wijngaards	a134925d91	Updated cacti files for request queue statistics counters. git-svn-id: file:///svn/unbound/trunk@1738 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-27 12:35:48 +00:00
Wouter Wijngaards	38bc0800ee	1.3.3rc1 tag. git-svn-id: file:///svn/unbound/trunk@1737 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-23 13:40:26 +00:00
Wouter Wijngaards	dcea0777bf	Fixup for root prime requests sent when not needed. git-svn-id: file:///svn/unbound/trunk@1736 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-23 13:21:42 +00:00
Wouter Wijngaards	894ba681f0	Fixup lameness handling in server selection. git-svn-id: file:///svn/unbound/trunk@1735 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-21 13:52:39 +00:00
Wouter Wijngaards	72aa0bad92	Log option for bogus only. git-svn-id: file:///svn/unbound/trunk@1734 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-20 14:22:29 +00:00
Wouter Wijngaards	f73ce55c6e	nicer error message git-svn-id: file:///svn/unbound/trunk@1733 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-20 13:31:45 +00:00
Wouter Wijngaards	658e84f7a0	root hints update-anchor.sh git-svn-id: file:///svn/unbound/trunk@1732 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-20 09:43:40 +00:00
Wouter Wijngaards	f1bd145b60	ignore transient sendto conditions. git-svn-id: file:///svn/unbound/trunk@1731 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-20 08:35:13 +00:00
Wouter Wijngaards	b5f7bf86ac	makedist can setup.exe crosscompile git-svn-id: file:///svn/unbound/trunk@1730 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-16 10:56:00 +00:00
Wouter Wijngaards	56d8c3d59d	remove debug print git-svn-id: file:///svn/unbound/trunk@1729 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-16 10:19:48 +00:00
Wouter Wijngaards	2b9e9b4111	fix replacement malloc git-svn-id: file:///svn/unbound/trunk@1728 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-16 10:17:52 +00:00
Wouter Wijngaards	d9a6ccfb52	Setup.exe making on crosscompile. git-svn-id: file:///svn/unbound/trunk@1727 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-15 15:10:17 +00:00
Wouter Wijngaards	cd5ac9634c	with autoconf git-svn-id: file:///svn/unbound/trunk@1726 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-15 14:24:45 +00:00
Wouter Wijngaards	b5f2b7d36b	fixup compile on XP. git-svn-id: file:///svn/unbound/trunk@1725 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-15 13:47:58 +00:00
Wouter Wijngaards	91e49260a7	documented. Makefile slightly better at dependencies. git-svn-id: file:///svn/unbound/trunk@1724 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-15 13:08:52 +00:00
Wouter Wijngaards	a0d67a87f0	setup.exe can be created from crosscompile. git-svn-id: file:///svn/unbound/trunk@1723 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-15 11:50:13 +00:00
Wouter Wijngaards	43d9c09372	crosscompile with mingw32 works. git-svn-id: file:///svn/unbound/trunk@1722 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-14 14:44:53 +00:00
Wouter Wijngaards	e33276b5c3	iana portlist updated. git-svn-id: file:///svn/unbound/trunk@1721 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-14 08:24:23 +00:00
Wouter Wijngaards	630e83f58b	ldns update and RAND_MAX clean up git-svn-id: file:///svn/unbound/trunk@1720 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-14 07:54:05 +00:00
Wouter Wijngaards	ff77c81fd1	fixup unit test for portability git-svn-id: file:///svn/unbound/trunk@1719 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-13 17:06:11 +00:00
Wouter Wijngaards	560e1c86b3	reported by Mees de Roo git-svn-id: file:///svn/unbound/trunk@1718 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-13 16:00:20 +00:00
Wouter Wijngaards	73da11fe07	Fix mingw ID randomness from 8 to 16 bits. git-svn-id: file:///svn/unbound/trunk@1717 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-13 15:47:42 +00:00
Wouter Wijngaards	7b03403efd	examine dnskey on child side retry. git-svn-id: file:///svn/unbound/trunk@1716 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-13 14:14:11 +00:00
Wouter Wijngaards	902cad61c6	trunk moves to 1.3.3. git-svn-id: file:///svn/unbound/trunk@1715 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-13 13:28:12 +00:00
Wouter Wijngaards	82f83d8d06	Fix for windows crash at start (after install for example) git-svn-id: file:///svn/unbound/trunk@1713 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-13 07:45:19 +00:00
Wouter Wijngaards	fa842c30de	Final version git-svn-id: file:///svn/unbound/trunk@1712 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-10 12:27:16 +00:00
Wouter Wijngaards	506af05011	child retry git-svn-id: file:///svn/unbound/trunk@1711 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-10 10:01:58 +00:00
Wouter Wijngaards	f644c06516	updated plans git-svn-id: file:///svn/unbound/trunk@1710 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-09 14:48:31 +00:00
Wouter Wijngaards	9755c94372	version 1.3.2 in trunk git-svn-id: file:///svn/unbound/trunk@1709 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-09 09:08:08 +00:00
Wouter Wijngaards	f0138c1cca	Tag 1.3.1 git-svn-id: file:///svn/unbound/trunk@1708 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-09 09:00:24 +00:00
Wouter Wijngaards	374a7f45c2	it could be worse git-svn-id: file:///svn/unbound/trunk@1707 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-08 12:07:03 +00:00
Wouter Wijngaards	f3b66c177b	Second precision. git-svn-id: file:///svn/unbound/trunk@1706 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-08 11:37:50 +00:00
Wouter Wijngaards	d535e6919e	more thinking git-svn-id: file:///svn/unbound/trunk@1705 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-07 15:00:18 +00:00
Wouter Wijngaards	0c7b289051	iana portlist updated git-svn-id: file:///svn/unbound/trunk@1704 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-07 10:37:56 +00:00
Wouter Wijngaards	5decb468c2	rrset id for cache flush git-svn-id: file:///svn/unbound/trunk@1703 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-07 10:16:34 +00:00
Wouter Wijngaards	5e90d568eb	updated fedora spec file. git-svn-id: file:///svn/unbound/trunk@1702 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-06 17:02:41 +00:00
Wouter Wijngaards	9e8a5100ad	updated fedora spec file git-svn-id: file:///svn/unbound/trunk@1701 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-06 17:02:17 +00:00
Wouter Wijngaards	1dc1ffabb4	Plans. git-svn-id: file:///svn/unbound/trunk@1700 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-06 14:51:58 +00:00
Wouter Wijngaards	c299e49384	uname fixup. git-svn-id: file:///svn/unbound/trunk@1699 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-06 12:13:15 +00:00
Wouter Wijngaards	8595d94e0f	Prettier, comments from Jelte. git-svn-id: file:///svn/unbound/trunk@1698 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-06 09:34:47 +00:00
Wouter Wijngaards	bfceac5b2e	reviewcomments git-svn-id: file:///svn/unbound/trunk@1697 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-06 08:34:54 +00:00
Wouter Wijngaards	b794eb84ac	changelog git-svn-id: file:///svn/unbound/trunk@1696 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-03 19:41:31 +00:00
Wouter Wijngaards	1cf8bdae51	Fix for linking when ldns installed. git-svn-id: file:///svn/unbound/trunk@1695 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-03 19:40:14 +00:00
Wouter Wijngaards	1bc4092127	fixup git-svn-id: file:///svn/unbound/trunk@1694 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-07-01 11:48:34 +00:00
Wouter Wijngaards	1e97b85e45	Ldns 1.6.0 to be. git-svn-id: file:///svn/unbound/trunk@1693 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-30 14:08:39 +00:00
Wouter Wijngaards	edae0ad954	More lenient. git-svn-id: file:///svn/unbound/trunk@1692 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-30 13:20:02 +00:00
Wouter Wijngaards	d453b4a43b	More lenient checks. git-svn-id: file:///svn/unbound/trunk@1691 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-30 12:50:57 +00:00
Wouter Wijngaards	7bd415ffdd	Removed debug prints. git-svn-id: file:///svn/unbound/trunk@1690 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-30 08:24:19 +00:00
Wouter Wijngaards	d232dbd4a5	Linux IPv6 large response support. git-svn-id: file:///svn/unbound/trunk@1689 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-29 13:47:48 +00:00
Wouter Wijngaards	373758092f	ldns tarball update. git-svn-id: file:///svn/unbound/trunk@1688 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-29 10:36:52 +00:00
Wouter Wijngaards	b6406cae1e	Better wrongly truncated check. And debug statements. git-svn-id: file:///svn/unbound/trunk@1687 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-29 10:15:27 +00:00
Wouter Wijngaards	298aff3ad2	ldns tarball update. git-svn-id: file:///svn/unbound/trunk@1686 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-29 09:59:43 +00:00
Wouter Wijngaards	efee0803d0	debugprint for wrongly_truncated git-svn-id: file:///svn/unbound/trunk@1685 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-29 08:52:58 +00:00
Wouter Wijngaards	ec30ae3ca6	Fixup for EDNS probe (neater than patch on mailing list). git-svn-id: file:///svn/unbound/trunk@1684 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-26 13:15:06 +00:00
Wouter Wijngaards	4ead61eb63	Updated fedora spec file, with python support. git-svn-id: file:///svn/unbound/trunk@1683 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-22 15:00:21 +00:00
Wouter Wijngaards	206a6bb539	iana portlist updated. git-svn-id: file:///svn/unbound/trunk@1682 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-22 08:04:01 +00:00
Wouter Wijngaards	fb5fa2bdb1	and changelog separate. git-svn-id: file:///svn/unbound/trunk@1681 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-22 07:56:27 +00:00
Wouter Wijngaards	8b2f5dcaf0	Fixup strict aliasing safer. git-svn-id: file:///svn/unbound/trunk@1680 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-22 07:56:19 +00:00
Wouter Wijngaards	4d97a3a400	documentation git-svn-id: file:///svn/unbound/trunk@1679 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-19 11:40:44 +00:00
Wouter Wijngaards	368dc659ea	Handle referral path check cases where NS is in the answer section. git-svn-id: file:///svn/unbound/trunk@1678 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-19 08:55:12 +00:00
Wouter Wijngaards	e49e0539d8	newer bison. git-svn-id: file:///svn/unbound/trunk@1677 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-19 07:47:46 +00:00
Wouter Wijngaards	aec8f4644f	strict aliasing warning in config_file code. git-svn-id: file:///svn/unbound/trunk@1676 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-19 07:45:45 +00:00
Wouter Wijngaards	6f745bc49e	iana portlist updated. git-svn-id: file:///svn/unbound/trunk@1675 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-19 07:27:53 +00:00
Wouter Wijngaards	ef564b5a29	Fixup strict aliasing warning on Fedora 11. git-svn-id: file:///svn/unbound/trunk@1674 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-19 07:09:12 +00:00
Wouter Wijngaards	c1b2364d1d	please lint git-svn-id: file:///svn/unbound/trunk@1673 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-18 14:39:50 +00:00
Wouter Wijngaards	790fe91662	python warning suppress. git-svn-id: file:///svn/unbound/trunk@1672 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-18 14:28:28 +00:00
Wouter Wijngaards	819f9d817a	autoconf 2.63 for configure git-svn-id: file:///svn/unbound/trunk@1671 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-18 14:08:56 +00:00
Wouter Wijngaards	e0bc4f2c97	extremely lenient for truncated positive replies git-svn-id: file:///svn/unbound/trunk@1670 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-18 10:59:59 +00:00
Wouter Wijngaards	efcb61fb22	Fixup parse problem reported by Hauke Lampe. git-svn-id: file:///svn/unbound/trunk@1669 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-18 09:31:58 +00:00
Wouter Wijngaards	d94c548dab	non-TODO. git-svn-id: file:///svn/unbound/trunk@1668 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-17 15:18:38 +00:00
Wouter Wijngaards	a18c4eaebc	Do later, notabug but a feature. git-svn-id: file:///svn/unbound/trunk@1667 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-17 14:58:07 +00:00
Wouter Wijngaards	e92fd4ff33	typo git-svn-id: file:///svn/unbound/trunk@1666 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-17 11:55:48 +00:00
Wouter Wijngaards	7bd75483e1	credits entry for cz.nic git-svn-id: file:///svn/unbound/trunk@1665 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-17 07:12:16 +00:00
Wouter Wijngaards	573fd6652b	Extra test, but no dlv negative cache failures discovered. git-svn-id: file:///svn/unbound/trunk@1664 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-16 14:57:19 +00:00
Wouter Wijngaards	13d2817b62	python testenv easier to use. git-svn-id: file:///svn/unbound/trunk@1663 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-16 12:38:46 +00:00
Wouter Wijngaards	f39e5fe3a8	check messages taken from cache, also in iterator. git-svn-id: file:///svn/unbound/trunk@1662 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-16 12:03:41 +00:00
Wouter Wijngaards	a569062627	touchup to munin memory report git-svn-id: file:///svn/unbound/trunk@1661 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-16 09:34:18 +00:00
Wouter Wijngaards	a40ec4b935	Fix max depth check. git-svn-id: file:///svn/unbound/trunk@1660 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-16 09:06:52 +00:00
Wouter Wijngaards	427ddba6d7	iana portlist updated. git-svn-id: file:///svn/unbound/trunk@1659 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-16 08:31:07 +00:00
Wouter Wijngaards	b757b29910	FAQ entry. git-svn-id: file:///svn/unbound/trunk@1658 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-16 08:23:32 +00:00
Wouter Wijngaards	3898abde02	Fixup DLV lookups and pickup responses from cache. git-svn-id: file:///svn/unbound/trunk@1657 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-15 13:27:53 +00:00
Wouter Wijngaards	8466ac7e7f	bug #254 , whitespace in example.conf git-svn-id: file:///svn/unbound/trunk@1656 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-13 09:49:53 +00:00
Wouter Wijngaards	80f6ed2ff0	Check right value. git-svn-id: file:///svn/unbound/trunk@1655 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-12 14:16:13 +00:00
Wouter Wijngaards	19d72a41cb	todo git-svn-id: file:///svn/unbound/trunk@1654 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-12 10:04:29 +00:00
Wouter Wijngaards	07411c16a9	Fixup stub below a forward, the stub is still honored and not trumped by the forward zone. git-svn-id: file:///svn/unbound/trunk@1653 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-12 09:01:42 +00:00
Wouter Wijngaards	5ca6d8c50b	mesh callbacks review, call error if deleted unfulfilled, check fptr wlist. git-svn-id: file:///svn/unbound/trunk@1652 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-12 07:53:36 +00:00
Wouter Wijngaards	16e920f416	Fixed potential wrong NSEC, but the bug could not be triggered. Unit test added anyway. git-svn-id: file:///svn/unbound/trunk@1651 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-12 07:23:04 +00:00
Wouter Wijngaards	89f0fd7252	forward-zone and DS fixup. Test. git-svn-id: file:///svn/unbound/trunk@1650 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-11 18:54:07 +00:00
Wouter Wijngaards	a40ec010be	Got contributed script to turn etc hosts into unbound config. git-svn-id: file:///svn/unbound/trunk@1649 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-11 18:30:53 +00:00
Wouter Wijngaards	1b8519e619	Fixup stub chain of trust from public to private servers. git-svn-id: file:///svn/unbound/trunk@1648 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-11 14:02:37 +00:00
Wouter Wijngaards	add0079981	And review fixup recommit. git-svn-id: file:///svn/unbound/trunk@1647 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-11 10:52:28 +00:00
Wouter Wijngaards	2c56564e4e	recommit 9 June 2009. git-svn-id: file:///svn/unbound/trunk@1646 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-11 09:43:23 +00:00
Wouter Wijngaards	baaaae857a	munin show total memory if sbrk trick does not work (eg. FreeBSD). git-svn-id: file:///svn/unbound/trunk@1645 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-08 15:43:15 +00:00
Wouter Wijngaards	b6099d5f55	fail python if no swig git-svn-id: file:///svn/unbound/trunk@1644 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-08 14:53:27 +00:00
Wouter Wijngaards	8c36960c29	lint, aliasing. git-svn-id: file:///svn/unbound/trunk@1643 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-08 14:51:00 +00:00
Wouter Wijngaards	3c5c0b2727	iana post list updated. git-svn-id: file:///svn/unbound/trunk@1642 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-08 13:55:58 +00:00
Wouter Wijngaards	6dd6542f04	TODO items. git-svn-id: file:///svn/unbound/trunk@1641 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-08 13:47:06 +00:00
Wouter Wijngaards	6451748967	Remove REVOKE flag support. git-svn-id: file:///svn/unbound/trunk@1639 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-08 08:29:17 +00:00
Wouter Wijngaards	b2ff49e4c4	review comments Matthijs. git-svn-id: file:///svn/unbound/trunk@1637 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-03 08:06:42 +00:00
Wouter Wijngaards	38ec4f4777	Fixup bad free. git-svn-id: file:///svn/unbound/trunk@1635 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-03 07:57:19 +00:00
Wouter Wijngaards	413d579e58	1.3.0 tag remove git-svn-id: file:///svn/unbound/trunk@1633 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-02 13:44:57 +00:00