Review comments Matthijs.

git-svn-id: file:///svn/unbound/tags/release-1.3.0@1638 be551aaa-1e26-0410-a405-d3ace91eadb9
Fixup bad free.
2026-08-17 21:25:50 +02:00 · 2009-06-03 08:06:56 +00:00 · 2009-06-03 07:57:39 +00:00 · 2009-06-02 13:49:22 +00:00 · 2009-04-28 09:07:29 +00:00 · 2009-04-28 08:28:45 +00:00
69 changed files with 22136 additions and 23312 deletions
@@ -69,7 +69,7 @@ WINDRES=windres
 LINT=splint
 LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list -Dglob64=glob -Dglobfree64=globfree
 # compat with openssl linux edition.
-LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray
+LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned

 INSTALL=$(srcdir)/install-sh
 ifeq "$(WITH_PYTHONMODULE)" "yes"
@@ -2,10 +2,8 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 2
-# 2009-07-03
-# Changelog
-# - fixup LDFLAGS for empty ssl dir.
+# Version 1
+# 2009-04-23
 #
 # Automates some of the checking constructs.  Aims at portability for POSIX.
 # Documentation for functions is below.
@@ -594,7 +592,7 @@ AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
            AC_MSG_RESULT(found in $ssldir)
            HAVE_SSL=yes
 	    dnl assume /usr is already in the lib and dynlib paths.
-	    if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
+	    if test "$ssldir" != "/usr"; then
                LDFLAGS="$LDFLAGS -L$ssldir/lib"
 		ACX_RUNTIME_PATH_ADD([$ssldir/lib])
 	    fi
@@ -1,10 +1,10 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
-#   Free Software Foundation, Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
+#   Inc.

-timestamp='2008-11-15'
+timestamp='2007-05-17'

 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -56,8 +56,8 @@ version="\
 GNU config.guess ($timestamp)

 Originally written by Per Bothner.
-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
-2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
+Free Software Foundation, Inc.

 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -330,21 +330,8 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
    sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
 	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
-    i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
-	eval $set_cc_for_build
-	SUN_ARCH="i386"
-	# If there is a compiler, see if it is configured for 64-bit objects.
-	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
-	# This test works for both compilers.
-	if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
-	    if echo '\n#ifdef __amd64\nIS_64BIT_ARCH\n#endif' | \
-		(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
-		grep IS_64BIT_ARCH >/dev/null
-	    then
-		SUN_ARCH="x86_64"
-	    fi
-	fi
-	echo ${SUN_ARCH}-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
+    i86pc:SunOS:5.*:* | ix86xen:SunOS:5.*:*)
+	echo i386-pc-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
    sun4*:SunOS:6*:*)
 	# According to config.sub, this is the proper way to canonicalize
@@ -545,7 +532,7 @@ EOF
 		echo rs6000-ibm-aix3.2
 	fi
 	exit ;;
-    *:AIX:*:[456])
+    *:AIX:*:[45])
 	IBM_CPU_ID=`/usr/sbin/lsdev -C -c processor -S available | sed 1q | awk '{ print $1 }'`
 	if /usr/sbin/lsattr -El ${IBM_CPU_ID} | grep ' POWER' >/dev/null 2>&1; then
 		IBM_ARCH=rs6000
@@ -806,15 +793,12 @@ EOF
 	exit ;;
    *:Interix*:[3456]*)
    	case ${UNAME_MACHINE} in
-	    x86)
+	    x86) 
 		echo i586-pc-interix${UNAME_RELEASE}
 		exit ;;
-	    EM64T | authenticamd | genuineintel)
+	    EM64T | authenticamd)
 		echo x86_64-unknown-interix${UNAME_RELEASE}
 		exit ;;
-	    IA64)
-		echo ia64-unknown-interix${UNAME_RELEASE}
-		exit ;;
 	esac ;;
    [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
 	echo i${UNAME_MACHINE}-pc-mks
@@ -849,14 +833,7 @@ EOF
 	echo ${UNAME_MACHINE}-pc-minix
 	exit ;;
    arm*:Linux:*:*)
-	eval $set_cc_for_build
-	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
-	    | grep -q __ARM_EABI__
-	then
-	    echo ${UNAME_MACHINE}-unknown-linux-gnu
-	else
-	    echo ${UNAME_MACHINE}-unknown-linux-gnueabi
-	fi
+	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
    avr32*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
@@ -948,9 +925,6 @@ EOF
 	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
 	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
 	exit ;;
-    padre:Linux:*:*)
-	echo sparc-unknown-linux-gnu
-	exit ;;
    parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
 	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
@@ -980,8 +954,8 @@ EOF
    x86_64:Linux:*:*)
 	echo x86_64-unknown-linux-gnu
 	exit ;;
-    xtensa*:Linux:*:*)
-    	echo ${UNAME_MACHINE}-unknown-linux-gnu
+    xtensa:Linux:*:*)
+    	echo xtensa-unknown-linux-gnu
 	exit ;;
    i*86:Linux:*:*)
 	# The BFD linker knows what the default object file format is, so
@@ -1001,6 +975,9 @@ EOF
 	  a.out-i386-linux)
 		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
 		exit ;;
+	  coff-i386)
+		echo "${UNAME_MACHINE}-pc-linux-gnucoff"
+		exit ;;
 	  "")
 		# Either a pre-BFD a.out linker (linux-gnuoldld) or
 		# one that does not give us useful --help.
@@ -1229,9 +1206,6 @@ EOF
    BePC:BeOS:*:*)	# BeOS running on Intel PC compatible.
 	echo i586-pc-beos
 	exit ;;
-    BePC:Haiku:*:*)	# Haiku running on Intel PC compatible.
-	echo i586-pc-haiku
-	exit ;;
    SX-4:SUPER-UX:*:*)
 	echo sx4-nec-superux${UNAME_RELEASE}
 	exit ;;
@@ -1500,9 +1474,9 @@ This script, last modified $timestamp, has failed to recognize
 the operating system you are using. It is advised that you
 download the most up to date version of the config scripts from

-  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
+  http://savannah.gnu.org/cgi-bin/viewcvs/*checkout*/config/config/config.guess
 and
-  http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
+  http://savannah.gnu.org/cgi-bin/viewcvs/*checkout*/config/config/config.sub

 If the version you run ($0) is already up to date, please
 send the following data and any information you think might be
@@ -314,10 +314,6 @@
 /* Define to 1 if you have the `_beginthreadex' function. */
 #undef HAVE__BEGINTHREADEX

-/* Define to the sub-directory in which libtool stores uninstalled libraries.
-   */
-#undef LT_OBJDIR
-
 /* Define to the maximum message length to pass to syslog. */
 #undef MAXSYSLOGMSGLEN

@@ -407,28 +403,6 @@
 /* Define this to enable SHA256 and SHA512 support. */
 #undef USE_SHA2

-/* Enable extensions on AIX 3, Interix.  */
-#ifndef _ALL_SOURCE
-# undef _ALL_SOURCE
-#endif
-/* Enable GNU extensions on systems that have them.  */
-#ifndef _GNU_SOURCE
-# undef _GNU_SOURCE
-#endif
-/* Enable threading extensions on Solaris.  */
-#ifndef _POSIX_PTHREAD_SEMANTICS
-# undef _POSIX_PTHREAD_SEMANTICS
-#endif
-/* Enable extensions on HP NonStop.  */
-#ifndef _TANDEM_SOURCE
-# undef _TANDEM_SOURCE
-#endif
-/* Enable general extensions on Solaris.  */
-#ifndef __EXTENSIONS__
-# undef __EXTENSIONS__
-#endif
-
-
 /* Whether the windows socket API is used */
 #undef USE_WINSOCK

@@ -445,6 +419,13 @@
   `char[]'. */
 #undef YYTEXT_POINTER

+/* Define to 1 if on AIX 3.
+   System headers sometimes define this.
+   We just want to avoid a redefinition error message.  */
+#ifndef _ALL_SOURCE
+# undef _ALL_SOURCE
+#endif
+
 /* Number of bits in a file offset, on hosts where this is settable. */
 #undef _FILE_OFFSET_BITS

@@ -454,16 +435,6 @@
 /* Define for large files, on AIX-style hosts. */
 #undef _LARGE_FILES

-/* Define to 1 if on MINIX. */
-#undef _MINIX
-
-/* Define to 2 if the system does not provide POSIX.1 features except with
-   this defined. */
-#undef _POSIX_1_SOURCE
-
-/* Define to 1 if you need to in order for `stat' and other things to work. */
-#undef _POSIX_SOURCE
-
 /* Define to empty if `const' does not conform to ANSI C. */
 #undef const

@@ -1,10 +1,10 @@
 #! /bin/sh
 # Configuration validation subroutine script.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
-#   Free Software Foundation, Inc.
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006 Free Software Foundation,
+#   Inc.

-timestamp='2008-09-08'
+timestamp='2007-04-29'

 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -72,8 +72,8 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)

-Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001,
-2002, 2003, 2004, 2005, 2006, 2007, 2008 Free Software Foundation, Inc.
+Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004, 2005
+Free Software Foundation, Inc.

 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -250,14 +250,12 @@ case $basic_machine in
 	| i370 | i860 | i960 | ia64 \
 	| ip2k | iq2000 \
 	| m32c | m32r | m32rle | m68000 | m68k | m88k \
-	| maxq | mb | microblaze | mcore | mep | metag \
+	| maxq | mb | microblaze | mcore | mep \
 	| mips | mipsbe | mipseb | mipsel | mipsle \
 	| mips16 \
 	| mips64 | mips64el \
-	| mips64octeon | mips64octeonel \
-	| mips64orion | mips64orionel \
-	| mips64r5900 | mips64r5900el \
 	| mips64vr | mips64vrel \
+	| mips64orion | mips64orionel \
 	| mips64vr4100 | mips64vr4100el \
 	| mips64vr4300 | mips64vr4300el \
 	| mips64vr5000 | mips64vr5000el \
@@ -288,7 +286,7 @@ case $basic_machine in
 	| v850 | v850e \
 	| we32k \
 	| x86 | xc16x | xscale | xscalee[bl] | xstormy16 | xtensa \
-	| z8k | z80)
+	| z8k)
 		basic_machine=$basic_machine-unknown
 		;;
 	m6811 | m68hc11 | m6812 | m68hc12)
@@ -333,14 +331,12 @@ case $basic_machine in
 	| ip2k-* | iq2000-* \
 	| m32c-* | m32r-* | m32rle-* \
 	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* \
+	| m88110-* | m88k-* | maxq-* | mcore-* \
 	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
 	| mips16-* \
 	| mips64-* | mips64el-* \
-	| mips64octeon-* | mips64octeonel-* \
-	| mips64orion-* | mips64orionel-* \
-	| mips64r5900-* | mips64r5900el-* \
 	| mips64vr-* | mips64vrel-* \
+	| mips64orion-* | mips64orionel-* \
 	| mips64vr4100-* | mips64vr4100el-* \
 	| mips64vr4300-* | mips64vr4300el-* \
 	| mips64vr5000-* | mips64vr5000el-* \
@@ -368,18 +364,14 @@ case $basic_machine in
 	| sparclite-* \
 	| sparcv8-* | sparcv9-* | sparcv9b-* | sparcv9v-* | strongarm-* | sv1-* | sx?-* \
 	| tahoe-* | thumb-* \
-	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* | tile-* \
+	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* \
 	| tron-* \
 	| v850-* | v850e-* | vax-* \
 	| we32k-* \
 	| x86-* | x86_64-* | xc16x-* | xps100-* | xscale-* | xscalee[bl]-* \
-	| xstormy16-* | xtensa*-* \
+	| xstormy16-* | xtensa-* \
 	| ymp-* \
-	| z8k-* | z80-*)
-		;;
-	# Recognize the basic CPU types without company name, with glob match.
-	xtensa*)
-		basic_machine=$basic_machine-unknown
+	| z8k-*)
 		;;
 	# Recognize the various machine names and aliases which stand
 	# for a CPU type and a company and sometimes even an OS.
@@ -451,22 +443,10 @@ case $basic_machine in
 		basic_machine=ns32k-sequent
 		os=-dynix
 		;;
-	blackfin)
-		basic_machine=bfin-unknown
-		os=-linux
-		;;
-	blackfin-*)
-		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=-linux
-		;;
 	c90)
 		basic_machine=c90-cray
 		os=-unicos
 		;;
-        cegcc)
-		basic_machine=arm-unknown
-		os=-cegcc
-		;;
 	convex-c1)
 		basic_machine=c1-convex
 		os=-bsd
@@ -495,8 +475,8 @@ case $basic_machine in
 		basic_machine=craynv-cray
 		os=-unicosmp
 		;;
-	cr16)
-		basic_machine=cr16-unknown
+	cr16c)
+		basic_machine=cr16c-unknown
 		os=-elf
 		;;
 	crds | unos)
@@ -534,10 +514,6 @@ case $basic_machine in
 		basic_machine=m88k-motorola
 		os=-sysv3
 		;;
-	dicos)
-		basic_machine=i686-pc
-		os=-dicos
-		;;
 	djgpp)
 		basic_machine=i586-pc
 		os=-msdosdjgpp
@@ -692,14 +668,6 @@ case $basic_machine in
 		basic_machine=m68k-isi
 		os=-sysv
 		;;
-	m68knommu)
-		basic_machine=m68k-unknown
-		os=-linux
-		;;
-	m68knommu-*)
-		basic_machine=m68k-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=-linux
-		;;
 	m88k-omron*)
 		basic_machine=m88k-omron
 		;;
@@ -845,14 +813,6 @@ case $basic_machine in
 		basic_machine=i860-intel
 		os=-osf
 		;;
-	parisc)
-		basic_machine=hppa-unknown
-		os=-linux
-		;;
-	parisc-*)
-		basic_machine=hppa-`echo $basic_machine | sed 's/^[^-]*-//'`
-		os=-linux
-		;;
 	pbd)
 		basic_machine=sparc-tti
 		;;
@@ -1061,10 +1021,6 @@ case $basic_machine in
 		basic_machine=tic6x-unknown
 		os=-coff
 		;;
-	tile*)
-		basic_machine=tile-unknown
-		os=-linux-gnu
-		;;
 	tx39)
 		basic_machine=mipstx39-unknown
 		;;
@@ -1140,10 +1096,6 @@ case $basic_machine in
 		basic_machine=z8k-unknown
 		os=-sim
 		;;
-	z80-*-coff)
-		basic_machine=z80-unknown
-		os=-sim
-		;;
 	none)
 		basic_machine=none-none
 		os=-none
@@ -1264,7 +1216,7 @@ case $os in
 	      | -bosx* | -nextstep* | -cxux* | -aout* | -elf* | -oabi* \
 	      | -ptx* | -coff* | -ecoff* | -winnt* | -domain* | -vsta* \
 	      | -udi* | -eabi* | -lites* | -ieee* | -go32* | -aux* \
-	      | -chorusos* | -chorusrdb* | -cegcc* \
+	      | -chorusos* | -chorusrdb* \
 	      | -cygwin* | -pe* | -psos* | -moss* | -proelf* | -rtems* \
 	      | -mingw32* | -linux-gnu* | -linux-newlib* | -linux-uclibc* \
 	      | -uxpv* | -beos* | -mpeix* | -udk* \
@@ -1404,9 +1356,6 @@ case $os in
 	-zvmoe)
 		os=-zvmoe
 		;;
-	-dicos*)
-		os=-dicos
-		;;
 	-none)
 		;;
 	*)
@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)

-AC_INIT(unbound, 1.3.2, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.3.0, unbound-bugs@nlnetlabs.nl, unbound)

 LIBUNBOUND_CURRENT=1
-LIBUNBOUND_REVISION=2
+LIBUNBOUND_REVISION=0
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -19,8 +19,6 @@ LIBUNBOUND_AGE=0
 # 1.2.0 had 0:17:0
 # 1.2.1 had 0:18:0
 # 1.3.0 had 1:0:0   # ub_cancel and -export-symbols.
-# 1.3.1 had 1:1:0
-# 1.3.2 had 1:2:0

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -314,7 +312,10 @@ if test x_$ub_test_python != x_no; then
      AC_PROG_SWIG
      AC_MSG_CHECKING(SWIG)
      if test ! -x "$SWIG"; then
-         AC_ERROR([failed to find swig tool, install it, or do not build Python module and PyUnbound])
+         AC_MSG_RESULT(failed, won't build Python module and PyUnbound)
+         AC_SUBST(swig, "")
+         ub_with_pyunbound=no
+         ub_with_pythonmod=no
      else
         AC_DEFINE(HAVE_SWIG, 1, [Define if you have Swig libraries and header files.])
         AC_SUBST(swig, "$SWIG")
@@ -409,8 +410,8 @@ large outgoing port ranges.  ])
 		fi
        else
            AC_MSG_RESULT(found in $thedir)
-	    dnl assume /usr is in default path, do not add "".
-	    if test "$thedir" != "/usr" -a "$thedir" != ""; then
+	    dnl assume /usr is in default path.
+	    if test "$thedir" != "/usr"; then
                LDFLAGS="$LDFLAGS -L$thedir/lib"
 		ACX_RUNTIME_PATH_ADD([$thedir/lib])
 	    fi
@@ -513,11 +514,9 @@ use_ldns_builtin="no"
 AC_ARG_WITH(ldns, AC_HELP_STRING([--with-ldns=PATH], 
 	[specify prefix of path of ldns library to use]), 
 	[ specialldnsdir="$withval"
-	if test "$withval" != ""; then
-		CPPFLAGS="-I$withval/include $CPPFLAGS"
-		LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
-		ACX_RUNTIME_PATH_ADD([$withval/lib])
-	fi
+	CPPFLAGS="-I$withval/include $CPPFLAGS"
+	LDFLAGS="-L$withval -L$withval/lib $LDFLAGS"
+	ACX_RUNTIME_PATH_ADD([$withval/lib])
 	ldnsdir="$withval"
 	AC_SUBST(ldnsdir)
 ])
@@ -12,5 +12,3 @@ distribution but may be helpful.
 * unbound_cacti.tar.gz : setup files for cacti statistics report
 * selinux: the .fc and .te files for SElinux protection of the unbound daemon
 * unbound.plist: launchd configuration file for MacOSX.
-* build-unbound-localzone-from-hosts.pl: perl script to turn /etc/hosts into
-	a local-zone and local-data include file for unbound.conf.
@@ -1,67 +0,0 @@
-#!/usr/bin/perl -WT
-
-use strict;
-use warnings;
-
-my $hostsfile = '/etc/hosts';
-my $localzonefile = '/etc/unbound/localzone.conf.new';
-
-my $localzone = 'example.com';
-
-open( HOSTS,"<${hostsfile}" ) or die( "Could not open ${hostsfile}: $!" );
-open( ZONE,">${localzonefile}" ) or die( "Could not open ${localzonefile}: $!" );
-
-print ZONE "server:\n\n";
-print ZONE "local-zone: \"${localzone}\" transparent\n\n";
-
-my %ptrhash;
-
-while ( my $hostline = <HOSTS> ) {
-
-	# Skip comments
-	if ( $hostline !~ "^#" and $hostline !~ '^\s+$' ) {
-
-		my @entries = split( /\s+/, $hostline );
-
-		my $ip;
-
-		my $count = 0;
-		foreach my $entry ( @entries ) {
-			if ( $count == 0 ) {
-				$ip = $entry;
-			} else {
-
-				if ( $count == 1) {
-
-					# Only return localhost for 127.0.0.1 and ::1
-					if ( ($ip ne '127.0.0.1' and $ip ne '::1') or $entry =~ 'localhost' ) {
-						if ( ! defined $ptrhash{$ip} ) {
-							$ptrhash{$ip} = $entry;
-							print ZONE "local-data-ptr: \"$ip $entry\"\n";
-						}
-					}
-
-				}
-
-				# Use AAAA for IPv6 addresses
-				my $a = 'A';
-				if ( $ip =~ ':' ) {
-					$a = 'AAAA';
-				}
-
-				print ZONE "local-data: \"$entry ${a} $ip\"\n";
-
-			}
-			$count++;
-		}
-		print ZONE "\n";
-
-
-	}
-}
-
-
-
-
-__END__
-
@@ -1,14 +1,6 @@
-# initial python set up
-%{?!with_python:      %define with_python      0}
-
-%if %{with_python}
-%{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")}
-%{!?python_sitearch: %global python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
-%endif
-
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.3.1rc2
+Version: 1.2.1rc1
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
@@ -16,23 +8,18 @@ Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
 Source1: unbound.init
 Source2: unbound.conf
 Source3: unbound.munin
-# See the unbound svn repository for further documentation on these
-Patch0: unbound-1.2-glob.patch
-
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: flex, openssl-devel , ldns-devel >= 1.5.0, 
-BuildRequires: libevent-devel 
-%if %{with_python}
-BuildRequires:  python-devel
-%endif
-
+BuildRequires: flex, openssl-devel >= 0.9.8g-12, ldns-devel >= 1.5.0, 
+BuildRequires: libevent-devel >= 1.4.5
 Requires(post): chkconfig
 Requires(preun): chkconfig
 Requires(preun): initscripts
 Requires(postun): initscripts
-Requires: ldns >= 1.5.0, dnssec-conf >= 1.19
+Requires: ldns >= 1.5.0
 Requires(pre): shadow-utils
+# Is this obsolete?
+#Provides: caching-nameserver

 %description
 Unbound is a validating, recursive, and caching DNS(SEC) resolver.
@@ -72,29 +59,14 @@ Requires: openssl >= 0.9.8g-12
 %description libs
 Contains libraries used by the unbound server and client applications

-%if %{with_python}
-%package python
-Summary: Python modules and extensions for unbound
-Group: Applications/System
-Requires: %{name}-libs = %{version}-%{release}
-
-%description python
-Python modules and extensions for unbound
-%endif
-
 %prep
 %setup -q 
-%patch0 -p1

 %build
-%configure  --with-ldns= --with-libevent --with-pthreads --with-ssl \
+%configure  --with-ldns= -with-libevent --with-pthreads --with-ssl \
            --disable-rpath --enable-debug --disable-static \
            --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \
-            --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \
-%if %{with_python}
-            --with-pythonmodule --with-pyunbound \
-%endif
-            --enable-sha2 
+            --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid
 %{__make} CFLAGS="$RPM_OPT_FLAGS -D_GNU_SOURCE" QUIET=no %{?_smp_mflags}

 %install
@@ -130,11 +102,6 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_sbindir}/*
 %{_mandir}/*/*

-%if %{with_python}
-%files python
-%{python_sitelib}/*
-%endif
-
 %files munin
 %defattr(-,root,root,-)
 %config(noreplace) %{_sysconfdir}/munin/plugin-conf.d/unbound
@@ -158,20 +125,12 @@ useradd -r -g unbound -d %{_sysconfdir}/unbound -s /sbin/nologin \
 -c "Unbound DNS resolver" unbound
 exit 0

-%post
+%post 
 /sbin/chkconfig --add %{name}
-# Check DNSSEC settings if this is a fresh install
-if [ "$1" -eq 1 ]; then
-  if [ -r /etc/sysconfig/dnssec ]; then
-    . /etc/sysconfig/dnssec
-    [ -x /usr/sbin/dnssec-configure ] && \
-      dnssec-configure -u --norestart --nocheck --dnssec="$DNSSEC" --dlv="$DLV" > \
-        /dev/null 2>&1
-  fi;
-fi

 %post libs -p /sbin/ldconfig

+
 %preun
 if [ "$1" -eq 0 ]; then
        /sbin/service %{name} stop >/dev/null 2>&1
@@ -186,42 +145,6 @@ fi
 %postun libs -p /sbin/ldconfig

 %changelog
-* Sat Jun 20 2009 Paul Wouters <paul@xelerance.com> - 1.3.0-2
- Added missing glob patch to cvs
- Place python macros within the %%with_python check
-
-* Sat Jun 20 2009 Paul Wouters <paul@xelerance.com> - 1.3.0-1
- Updated to 1.3.0
- Added unbound-python sub package. disabled for now
- Patch from svn to fix DLV lookups
- Patches from svn to detect wrong truncated response from BIND 9.6.1 with
-  minimal-responses)
- Added Default-Start and Default-Stop to unbound.init
- Re-enabled --enable-sha2
- Re-enabled glob.patch
-
-* Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-7
- unbound-iterator.patch was not commited
-
-* Wed May 20 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-6
- Fix for https://bugzilla.redhat.com/show_bug.cgi?id=499793
-
-* Tue Mar 17 2009 Paul Wouters <paul@xelerance.com> - 1.2.1-5
- Use --nocheck to avoid giving an error on missing unbound-remote certs/keys
-
-* Tue Mar 10 2009 Adam Tkac <atkac redhat com> - 1.2.1-4
- enable DNSSEC only if it is enabled in sysconfig/dnssec
-
-* Mon Mar 09 2009 Adam Tkac <atkac redhat com> - 1.2.1-3
- add DNSSEC support to initscript and enabled it per default
- add requires dnssec-conf
-
-* Wed Feb 25 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.2.1-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild
-
-* Tue Feb 10 2009 Paul Wouters <paul@xelerance.com - 1.2.1-1
- updated to 1.2.1
-
 * Sun Jan 18 2009 Tomas Mraz <tmraz@redhat.com> - 1.2.0-2
 - rebuild with new openssl

@@ -437,21 +437,7 @@ queue)
 	done
 	;;
 memory)
-	mn=`echo mem.total.sbrk | sed $ABBREV | tr . _`
-	get_value 'mem.total.sbrk'
-	if test $value -eq 0; then
-		chk=`echo $ctrl | sed -e 's/-control$/-checkconf/'`
-		pidf=`$chk -o pidfile $conf 2>&1`
-		pid=`cat $pidf 2>&1`
-		value=`ps -p "$pid" -o rss= 2>&1`
-		if test "`expr $value + 1 - 1 2>&1`" -eq "$value" 2>&1; then
-			value=`expr $value \* 1024` 
-		else
-			value=0
-		fi
-	fi
-	echo "$mn.value" $value
-	for x in mem.cache.rrset mem.cache.message \
+	for x in mem.total.sbrk mem.cache.rrset mem.cache.message \
 		mem.mod.iterator mem.mod.validator; do
 		print_value $x
 	done
@@ -462,7 +462,6 @@ daemon_cleanup(struct daemon* daemon)
 	local_zones_delete(daemon->local_zones);
 	daemon->local_zones = NULL;
 	/* key cache is cleared by module desetup during next daemon_init() */
-	daemon_remote_clear(daemon->rc);
 	for(i=0; i<daemon->num; i++)
 		worker_delete(daemon->workers[i]);
 	free(daemon->workers);
@@ -477,7 +476,6 @@ daemon_delete(struct daemon* daemon)
 	if(!daemon)
 		return;
 	modstack_desetup(&daemon->mods, daemon->env);
-	daemon_remote_delete(daemon->rc);
 	listening_ports_free(daemon->ports);
 	listening_ports_free(daemon->rc_ports);
 	if(daemon->env) {
@@ -57,7 +57,6 @@ struct rrset_cache;
 struct acl_list;
 struct local_zones;
 struct ub_randstate;
-struct daemon_remote;

 /**
 * Structure holding worker list.
@@ -74,12 +73,10 @@ struct daemon {
 	int listening_port;
 	/** listening ports, opened, to be shared by threads */
 	struct listen_port* ports;
-	/** port number for remote that has ports opened. */
+	/** port number fore remote that has ports opened. */
 	int rc_port;
 	/** listening ports for remote control */
 	struct listen_port* rc_ports;
-	/** remote control connections management (for first worker) */
-	struct daemon_remote* rc;
 	/** num threads allocated */
 	int num;
 	/** the worker entries */
@@ -136,16 +136,18 @@ timeval_divide(struct timeval* avg, const struct timeval* sum, size_t d)
 }

 struct daemon_remote*
-daemon_remote_create(struct config_file* cfg)
+daemon_remote_create(struct worker* worker)
 {
 	char* s_cert;
 	char* s_key;
+	struct config_file* cfg = worker->daemon->cfg;
 	struct daemon_remote* rc = (struct daemon_remote*)calloc(1, 
 		sizeof(*rc));
 	if(!rc) {
 		log_err("out of memory in daemon_remote_create");
 		return NULL;
 	}
+	rc->worker = worker;
 	rc->max_active = 10;

 	if(!cfg->remote_control_enable) {
@@ -164,51 +166,50 @@ daemon_remote_create(struct config_file* cfg)
 		daemon_remote_delete(rc);
 		return NULL;
 	}
-	s_cert = fname_after_chroot(cfg->server_cert_file, cfg, 1);
-	s_key = fname_after_chroot(cfg->server_key_file, cfg, 1);
-	if(!s_cert || !s_key) {
-		log_err("out of memory in remote control fname");
-		goto setup_error;
+	s_cert = cfg->server_cert_file;
+	s_key = cfg->server_key_file;
+	if(cfg->chrootdir && cfg->chrootdir[0]) {
+		if(strncmp(s_cert, cfg->chrootdir, strlen(cfg->chrootdir))==0)
+			s_cert += strlen(cfg->chrootdir);
+		if(strncmp(s_key, cfg->chrootdir, strlen(cfg->chrootdir))==0)
+			s_key += strlen(cfg->chrootdir);
 	}
 	verbose(VERB_ALGO, "setup SSL certificates");
 	if (!SSL_CTX_use_certificate_file(rc->ctx,s_cert,SSL_FILETYPE_PEM)) {
 		log_err("Error for server-cert-file: %s", s_cert);
 		log_crypto_err("Error in SSL_CTX use_certificate_file");
-		goto setup_error;
+		daemon_remote_delete(rc);
+		return NULL;
 	}
 	if(!SSL_CTX_use_PrivateKey_file(rc->ctx,s_key,SSL_FILETYPE_PEM)) {
 		log_err("Error for server-key-file: %s", s_key);
 		log_crypto_err("Error in SSL_CTX use_PrivateKey_file");
-		goto setup_error;
+		daemon_remote_delete(rc);
+		return NULL;
 	}
 	if(!SSL_CTX_check_private_key(rc->ctx)) {
 		log_err("Error for server-key-file: %s", s_key);
 		log_crypto_err("Error in SSL_CTX check_private_key");
-		goto setup_error;
+		daemon_remote_delete(rc);
+		return NULL;
 	}
 	if(!SSL_CTX_load_verify_locations(rc->ctx, s_cert, NULL)) {
 		log_crypto_err("Error setting up SSL_CTX verify locations");
-	setup_error:
-		free(s_cert);
-		free(s_key);
 		daemon_remote_delete(rc);
 		return NULL;
 	}
 	SSL_CTX_set_client_CA_list(rc->ctx, SSL_load_client_CA_file(s_cert));
 	SSL_CTX_set_verify(rc->ctx, SSL_VERIFY_PEER, NULL);
-	free(s_cert);
-	free(s_key);

 	return rc;
 }

-void daemon_remote_clear(struct daemon_remote* rc)
+void daemon_remote_delete(struct daemon_remote* rc)
 {
 	struct rc_state* p, *np;
 	if(!rc) return;
 	/* but do not close the ports */
 	listen_list_delete(rc->accept_list);
-	rc->accept_list = NULL;
 	/* do close these sockets */
 	p = rc->busy_list;
 	while(p) {
@@ -219,15 +220,6 @@ void daemon_remote_clear(struct daemon_remote* rc)
 		free(p);
 		p = np;
 	}
-	rc->busy_list = NULL;
-	rc->active = 0;
-	rc->worker = NULL;
-}
-
-void daemon_remote_delete(struct daemon_remote* rc)
-{
-	if(!rc) return;
-	daemon_remote_clear(rc);
 	if(rc->ctx) {
 		SSL_CTX_free(rc->ctx);
 	}
@@ -356,10 +348,9 @@ accept_open(struct daemon_remote* rc, int fd)
 }

 int daemon_remote_open_accept(struct daemon_remote* rc, 
-	struct listen_port* ports, struct worker* worker)
+	struct listen_port* ports)
 {
 	struct listen_port* p;
-	rc->worker = worker;
 	for(p = ports; p; p = p->next) {
 		if(!accept_open(rc, p->fd)) {
 			log_err("could not create accept comm point");
@@ -1043,22 +1034,6 @@ do_lookup(SSL* ssl, struct worker* worker, char* arg)
 	free(nm);
 }

-/** flush something from rrset and msg caches */
-static void
-do_cache_remove(struct worker* worker, uint8_t* nm, size_t nmlen,
-	uint16_t t, uint16_t c)
-{
-	hashvalue_t h;
-	struct query_info k;
-	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, t, c, 0);
-	k.qname = nm;
-	k.qname_len = nmlen;
-	k.qtype = t;
-	k.qclass = c;
-	h = query_info_hash(&k);
-	slabhash_remove(worker->env.msg_cache, h, &k);
-}
-
 /** flush a type */
 static void
 do_flush_type(SSL* ssl, struct worker* worker, char* arg)
@@ -1073,7 +1048,8 @@ do_flush_type(SSL* ssl, struct worker* worker, char* arg)
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
 		return;
 	t = ldns_get_rr_type_by_name(arg2);
-	do_cache_remove(worker, nm, nmlen, t, LDNS_RR_CLASS_IN);
+	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
+		t, LDNS_RR_CLASS_IN, 0);
 	
 	free(nm);
 	send_ok(ssl);
@@ -1203,23 +1179,33 @@ do_flush_zone(SSL* ssl, struct worker* worker, char* arg)

 /** remove name rrset from cache */
 static void
-do_flush_name(SSL* ssl, struct worker* w, char* arg)
+do_flush_name(SSL* ssl, struct worker* worker, char* arg)
 {
 	uint8_t* nm;
 	int nmlabs;
 	size_t nmlen;
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
 		return;
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_AAAA, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SOA, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_CNAME, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_DNAME, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_MX, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_PTR, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_SRV, LDNS_RR_CLASS_IN);
-	do_cache_remove(w, nm, nmlen, LDNS_RR_TYPE_NAPTR, LDNS_RR_CLASS_IN);
+	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
+		LDNS_RR_TYPE_A, LDNS_RR_CLASS_IN, 0);
+	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
+		LDNS_RR_TYPE_AAAA, LDNS_RR_CLASS_IN, 0);
+	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
+		LDNS_RR_TYPE_NS, LDNS_RR_CLASS_IN, 0);
+	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
+		LDNS_RR_TYPE_SOA, LDNS_RR_CLASS_IN, 0);
+	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
+		LDNS_RR_TYPE_CNAME, LDNS_RR_CLASS_IN, 0);
+	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
+		LDNS_RR_TYPE_DNAME, LDNS_RR_CLASS_IN, 0);
+	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
+		LDNS_RR_TYPE_MX, LDNS_RR_CLASS_IN, 0);
+	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
+		LDNS_RR_TYPE_PTR, LDNS_RR_CLASS_IN, 0);
+	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
+		LDNS_RR_TYPE_SRV, LDNS_RR_CLASS_IN, 0);
+	rrset_cache_remove(worker->env.rrset_cache, nm, nmlen, 
+		LDNS_RR_TYPE_NAPTR, LDNS_RR_CLASS_IN, 0);
 	
 	free(nm);
 	send_ok(ssl);
@@ -96,10 +96,10 @@ struct daemon_remote {

 /**
 * Create new remote control state for the daemon.
- * @param cfg: config file with key file settings.
+ * @param worker: worker with communication base. and links to command channels.
 * @return new state, or NULL on failure.
 */
-struct daemon_remote* daemon_remote_create(struct config_file* cfg);
+struct daemon_remote* daemon_remote_create(struct worker* worker);

 /**
 * remote control state to delete.
@@ -107,13 +107,6 @@ struct daemon_remote* daemon_remote_create(struct config_file* cfg);
 */
 void daemon_remote_delete(struct daemon_remote* rc);

-/**
- * remote control state to clear up. Busy and accept points are closed.
- * Does not delete the rc itself, or the ssl context (with its keys).
- * @param rc: state to clear.
- */
-void daemon_remote_clear(struct daemon_remote* rc);
-
 /**
 * Open and create listening ports for remote control.
 * @param cfg: config options.
@@ -126,11 +119,10 @@ struct listen_port* daemon_remote_open_ports(struct config_file* cfg);
 * Setup comm points for accepting remote control connections.
 * @param rc: state
 * @param ports: already opened ports.
- * @param worker: worker with communication base. and links to command channels.
 * @return false on error.
 */
 int daemon_remote_open_accept(struct daemon_remote* rc, 
-	struct listen_port* ports, struct worker* worker);
+	struct listen_port* ports);

 /**
 * Handle nonthreaded remote cmd execution.
@@ -43,7 +43,6 @@
 #include "config.h"
 #include "util/log.h"
 #include "daemon/daemon.h"
-#include "daemon/remote.h"
 #include "util/config_file.h"
 #include "util/storage/slabhash.h"
 #include "services/listen_dnsport.h"
@@ -367,10 +366,6 @@ perform_setup(struct daemon* daemon, struct config_file* cfg, int debug_mode,
 	 * So, using a logfile, the user does not see errors unless -d is
 	 * given to unbound on the commandline. */

-	/* read ssl keys while superuser and outside chroot */
-	if(!(daemon->rc = daemon_remote_create(cfg)))
-		fatal_exit("could not set up remote-control");
-
 #ifdef HAVE_KILL
 	/* check old pid file before forking */
 	if(cfg->pidfile && cfg->pidfile[0]) {
@@ -496,6 +496,43 @@ answer_norec_from_cache(struct worker* worker, struct query_info* qinfo,
 	return 1;
 }

+/** check cname chain in cache reply */
+static int
+check_cache_chain(struct reply_info* rep) {
+	/* check only answer section rrs for matching cname chain.
+	 * the cache may return changed rdata, but owner names are untouched.*/
+	size_t i;
+	uint8_t* sname = rep->rrsets[0]->rk.dname;
+	size_t snamelen = rep->rrsets[0]->rk.dname_len;
+	for(i=0; i<rep->an_numrrsets; i++) {
+		uint16_t t = ntohs(rep->rrsets[i]->rk.type);
+		if(t == LDNS_RR_TYPE_DNAME)
+			continue; /* skip dnames; note TTL 0 not cached */
+		/* verify that owner matches current sname */
+		if(query_dname_compare(sname, rep->rrsets[i]->rk.dname) != 0){
+			/* cname chain broken */
+			return 0;
+		}
+		/* if this is a cname; move on */
+		if(t == LDNS_RR_TYPE_CNAME) {
+			get_cname_target(rep->rrsets[i], &sname, &snamelen);
+		}
+	}
+	return 1;
+}
+
+/** check security status in cache reply */
+static int
+all_rrsets_secure(struct reply_info* rep) {
+	size_t i;
+	for(i=0; i<rep->rrset_count; i++) {
+		if( ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
+			->security != sec_status_secure )
+			return 0;
+	}
+	return 1;
+}
+
 /** answer query from the cache */
 static int
 answer_from_cache(struct worker* worker, struct query_info* qinfo,
@@ -521,7 +558,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	if(rep->an_numrrsets > 0 && (rep->rrsets[0]->rk.type == 
 		htons(LDNS_RR_TYPE_CNAME) || rep->rrsets[0]->rk.type == 
 		htons(LDNS_RR_TYPE_DNAME))) {
-		if(!reply_check_cname_chain(rep)) {
+		if(!check_cache_chain(rep)) {
 			/* cname chain invalid, redo iterator steps */
 			verbose(VERB_ALGO, "Cache reply: cname chain broken");
 		bail_out:
@@ -553,7 +590,7 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 			"validation");
 		goto bail_out; /* need to validate cache entry first */
 	} else if(rep->security == sec_status_secure) {
-		if(reply_all_rrsets_secure(rep))
+		if(all_rrsets_secure(rep))
 			secure = 1;
 		else	{
 			if(must_validate) {
@@ -1001,8 +1038,12 @@ worker_init(struct worker* worker, struct config_file *cfg,
 			return 0;
 		}
 #endif /* LIBEVENT_SIGNAL_PROBLEM */
-		if(!daemon_remote_open_accept(worker->daemon->rc, 
-			worker->daemon->rc_ports, worker)) {
+		if(!(worker->rc = daemon_remote_create(worker))) {
+			worker_delete(worker);
+			return 0;
+		}
+		if(!daemon_remote_open_accept(worker->rc, 
+			worker->daemon->rc_ports)) {
 			worker_delete(worker);
 			return 0;
 		}
@@ -1011,6 +1052,7 @@ worker_init(struct worker* worker, struct config_file *cfg,
 #endif /* UB_ON_WINDOWS */
 	} else { /* !do_sigs */
 		worker->comsig = NULL;
+		worker->rc = NULL;
 	}
 	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^
 		(((unsigned int)worker->thread_num)<<17);
@@ -1130,6 +1172,7 @@ worker_delete(struct worker* worker)
 	comm_signal_delete(worker->comsig);
 	tube_delete(worker->cmd);
 	comm_timer_delete(worker->stat_timer);
+	daemon_remote_delete(worker->rc);
 	free(worker->ports);
 	if(worker->thread_num == 0) {
 		log_set_time(NULL);
@@ -1248,18 +1291,6 @@ void libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
 	log_assert(0);
 }

-void libworker_fg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
-        ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s))
-{
-	log_assert(0);
-}
-
-void libworker_bg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
-        ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s))
-{
-	log_assert(0);
-}
-
 int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 {
 	log_assert(0);
@@ -101,6 +101,8 @@ struct worker {
 	struct comm_point* cmd_com;
 	/** timer for statistics */
 	struct comm_timer* stat_timer;
+	/** remote control state (for first thread only) */
+	struct daemon_remote* rc;

 	/** number of requests that can be handled by this worker */
 	size_t request_size;
@@ -14,5 +14,4 @@ Jakob Schlyter - for advice on secure settings, random numbers and blacklists.
 Ondřej Surý - running coverity analysis tool on 0.9 dev version.
 Alexander Gall - multihomed, anycast testing of unbound resolver server.
 Zdenek Vasicek and Marek Vavrusa - python module.
-cz.nic - sponsoring 'summer of code' development by Zdenek and Marek.
 Brett Carr - windows beta testing.
@@ -1,116 +1,3 @@
-13 July 2009: Wouter
-	- Fix for crash at start on windows.
-
-9 July 2009: Wouter
-	- tag for release 1.3.1.
-	- trunk has version 1.3.2.
-
-7 July 2009: Wouter
-	- iana portlist updated.
-
-6 July 2009: Wouter
-	- prettier error handling in SSL setup.
-	- makedist.sh uname fix (same as ldns).
-	- updated fedora spec file.
-
-3 July 2009: Wouter
-	- fixup linking when ldnsdir is "".
-
-30 June 2009: Wouter
-	- more lenient truncation checks.
-
-29 June 2009: Wouter
-	- ldns trunk r2959 imported as tarball, because of solaris cc compile
-	  support for c99.  r2960 for better configure.
-	- better wrongly_truncated check.
-	- On Linux, fragment IPv6 datagrams to the IPv6 minimum MTU, to
-	  avoid dropped packets at routers.
-
-26 June 2009: Wouter
-	- Fix EDNS fallback when EDNS works for short answers but long answers
-	  are dropped.
-
-22 June 2009: Wouter
-	- fixup iter priv strict aliasing while preserving size of sockaddr.
-	- iana portlist updated.  (one less port allocated, one more fraction
-	  of a bit for security!)
-	- updated fedora specfile in contrib from Paul Wouters.
-	
-19 June 2009: Wouter
-	- Fixup strict aliasing warning in iter priv code.
-	  and config_file code.
-	- iana portlist updated.
-	- harden-referral-path: handle cases where NS is in answer section.
-
-18 June 2009: Wouter
-	- Fix of message parse bug where (specifically) an NSEC and RRSIG
-	  in the wrong order would be parsed, but put wrongly into internal
-	  structures so that later validation would fail.
-	- Extreme lenience for wrongly truncated replies where a positive
-	  reply has an NS in the authority but no signatures.  They are
-	  turned into minimal responses with only the (secure) answer.
-	- autoconf 2.63 for configure.
-	- python warnings suppress.  Keep python API away from header files.
-
-17 June 2009: Wouter
-	- CREDITS entry for cz.nic, sponsoring a 'summer of code' that was
-	  used for the python code in unbound. (http://www.nic.cz/vip/ in cz).
-
-16 June 2009: Wouter
-	- Fixup opportunistic target query generation to it does not
-	  generate queries that are known to fail.
-	- Touchup on munin total memory report.
-	- messages picked out of the cache by the iterator are checked
-	  if their cname chain is still correct and if validation status
-	  has to be reexamined.
-
-15 June 2009: Wouter
-	- iana portlist updated.
-
-14 June 2009: Wouter
-	- Fixed bug where cached responses would lose their security
-	  status on second validation, which especially impacted dlv
-	  lookups.  Reported by Hauke Lampe.
-
-13 June 2009: Wouter
-	- bug #254. removed random whitespace from example.conf.
-
-12 June 2009: Wouter
-	- Fixup potential wrong NSEC picked out of the cache.
-	- If unfulfilled callbacks are deleted they are called with an error.
-	- fptr wlist checks for mesh callbacks.
-	- fwd above stub in configuration works.
-
-11 June 2009: Wouter
-	- Fix queries for type DS when forward or stub zones are there.
-	  They are performed to higherup domains, and thus treated as if
-	  going to higher zones when looking up the right forward or stub
-	  server.  This makes a stub pointing to a local server that has
-	  a local view of example.com signed with the same keys as are
-	  publicly used work.  Reported by Johan Ihren.
-	- Added build-unbound-localzone-from-hosts.pl to contrib, from
-	  Dennis DeDonatis.  It converts /etc/hosts into config statements.
-	- same thing fixed for forward-zone and DS, chain of trust from
-	  public internet into the forward-zone works now.  Added unit test.
-
-9 June 2009: Wouter
-	- openssl key files are opened apache-style, when user is root and
-	  before chrooting.  This makes permissions on remote-control key 
-	  files easier to set up.  Fixes bug #251.
-	- flush_type and flush_name remove msg cache entries.
-	- codereview - dp copy bogus setting fix.
-
-8 June 2009: Wouter
-	- Removed RFC5011 REVOKE flag support. Partial 5011 support may cause
-	  inadvertant behaviour.
-	- 1.3.0 tarball for release created.
-	- 1.3.1 development in svn trunk.
-	- iana portlist updated.
-	- fix lint from complaining on ldns/sha.h.
-	- help compiler figure out aliasing in priv_rrset_bad() routine.
-	- fail to configure with python if swig is not found.
-	- unbound_munin_ in contrib uses ps to show rss if sbrk does not work.
-
 3 June 2009: Wouter
 	- fixup bad free() when wrongly encoded DSA signature is seen.
 	  Reported by Paul Wouters.
@@ -91,10 +91,6 @@ o The warning 'openssl has no entropy, seeding with time', with chroot
 o On Solaris 5.10 some libtool packages from repositories do not work with
  gcc, showing errors gcc: unrecognized option `-KPIC'
  To solve this do ./configure libtool=./libtool [your options...].
-o If unbound-control (or munin graphs) do not work, this can often be because
-  the unbound-control-setup script creates the keys with restricted 
-  permissions, and the files need to be made readable or ownered by both the
-  unbound daemon and unbound-control.

 Acknowledgements
 ----------------
@@ -35,15 +35,11 @@ o overhaul outside-network servicedquery to merge with udpwait and tcpwait,
 o check into rebinding ports for efficiency, configure time test.
 o EVP hardware crypto support.
 o option to ignore all inception and expiration dates for rrsigs.
+o option to use builtin ldns explicitly.  Or stop shipping builtin tarball.
 o cleaner code; return and func statements on newline.
 o memcached module that sits before validator module; checks for memcached
  data (on local lan), stores recursion lookup.  Provides one cache for multiple resolver machines, coherent reply content in anycast setup.
 o no openssl_add_all_algorithms, but only the ones necessary, less space.
-o listen to NOTIFY messages for zones and flush the cache for that zone
-  if received.  Useful when also having a stub to that auth server.
-  Needs proper protection, TSIG, in place.
-o winevent - do not go more than 64 fds (by polling with select one by
-  one), win95/98 have 100fd limit in the kernel, so this ruins w9x portability.

 *** Features features, for later
 * dTLS, TLS, look to need special port numbers, cert storage, recent libssl.
@@ -59,172 +55,4 @@ o on windows version, implement that OS ancillary data capabilities for
 o local-zone directive with authority service, full authority server 
  is a non-goal.
 o infra and lame cache: easier size config (in Mb), show usage in graphs.
- store time of dump in cachedumps, so that on a load the ttls can be
-  compared to the absolute time, and now-expired items can be dealt with.
-
-1.3.x:
- spoofed delegpt fixes - if DNSKEY prime fails
-	- set DNSKEY bogus and DNSKEY query msg bogus.
-	- make NS set bogus too - if not validated as secure.
-	- check where queries go - otherwise reduce TTL on NS.
-	- also make DS NSEC bogus. Also DS msg cache entry.
- mark bogus under stringent conditions
-	- if DS at parent and validly signed. Then DNSKEY must exist.
-	- Also for trust anchor points themselves. DNSKEY must exist.
-	- so if then DNSKEY keyprime fails
-	  - then it is not simply a server that only answers qtype A.
-	  - then parent is agreeing (somewhat) with the DS record
-	  - but it could still be a lame domain, these exist 
-	    The objective is to keep tries for genuinely lame domains to a
-	    minimum, while detecting forgeries quickly. exponential backoff.
-	- for unbound we can check if we got something to verify while
-	  building that chain of trust.  If so - not lame, agressive retry.
-	  - but security-lame zones also exist and should not pose 
-	    too high a burden. Exponential backoff again.
-	    (fe. badly signed or dnskey reply too large fails).
-	- the delegation NS for the domain is bogus.
-	  The referral retried, with exponential backoff.
-	  This exponential backoff should go towards values which are close
-	  to the TTLs that are used now (on lame delegations for example).
-	  so that the extra traffic is manageable.
-	- for unbound, reset the TTL on the NS rrset. Let it timeout.
-	  Set NS rrset bogus - no more queries to the domain are done.
-	  Also set DNSKEY and DS (rrset, NSEC, msg) bogus and ttl like that.
-	  (to the same absolute value, so a clean retry is done).
-	  TTL of NS is (rounddown) timeout in seconds.
-	  Until the NS times out and referral is done again.
-	  Make sure multiple validations for chains of trust do not result
-	  in a flood of queries or backoff too quickly.
- bogus exponential backoff cache. hash(name,t,c), size(1M, 5%).
-	TTL of 24h.  Backoff from 200msec to 24h.
-	x2 on bogus(18 tries), x8 backoff on lameness(6 tries), 
-	  when servfail for DNSKEY.
-	remove entry when validated as secure.
-	delegptspoofrecheck on lameness when harden-referral-path NS
-	query has servfail, then build chain of trust down (check DS,
-	then perform DNSKEY query) if that DNSKEY query fails servfail,
-	perform the x8 lameness retry fallback.
-
-* keep a list of guilty IP addresses in the qstate, which contains both
-  the child side guilty IPs and the parent guilty IPs.  Valid signed DSes
-  are not made guilty in the global cache.  The child IP is made guilty
-  in the global cache.
-* Retry to higher trust anchors.
-  * option not to retry to higher from this ta.
-  * keep longest must-be-secure name. Do no accept insecure above this point.
-  * if failed ta, blame all lower tas for their DNSKEY (get IP from cached
-    rrset),  if failure is insecure - nothing, if at bogus - blame that too.
-    lower tas have isdata=false, so the IP address for the dnskeyrrset in
-    the cache is set to avoid in qstate. Nothing in infracache, no childretry.
-
-Retry harder to get valid DNSSEC data.
-Triggered by a trust anchor or by a signed DS record for a zone.
-* If data is fetched and validation fails for it
-  or DNSKEY is fetched and validated into chain-of-trust fails for it
-  or DS is fetched and validated into chain-of-trust fails for it
-  Then
-  	blame(signer zone, IP origin of the data/DNSKEY/DS, x2, isdata)
-* If data was not fetched (SERVFAIL, lame, ...), and the data
-  is under a signed DS then:
-  	blame(thatDSname, IP origin of the data/DNSKEY/DS, x8)
-  x8 because the zone may be lame.
-  This means a chain of trust is built also for unfetched data, to
-  determine if a signed DS is present.  If insecure, nothing is done.
-* If DNSKEY was not fetched for chain of trust (SERVFAIL, lame, ...),
-  Then
-  	blame(DNSKEYname, IP origin of the data/DNSKEY/DS, x8)
-  x8 because the zone may be lame.
-* blame(zonename, guiltyIP, multiplier, isdata):
-  * if isdata:
-    Set the guiltyIP,zonename as DNSSEC-bogus-data=true in lameness cache.
-    Thusly marked servers are avoided if possible, used as last resort.
-    The guilt TTL is the infra cache ttl (15 minutes).  
-    The dnssec retry scheme works without this cache entry.
-  * If the key cache entry 'being-backed-off' is true and isdata then:
-	The parent is backedoff, it must be the childs fault. Retry to child.
-	Perform a child-retry - purge dataonly, childside, mark
-	data-IPaddress from child as to avoid-forquery. counterperquery,
-	max is 3, if reached, set this data element RRset&msg to the 
-	current backoff TTL end-time or bogus-ttl(60 seconds) whichever is less
-	and done.
-  * if no retry entry exists for the zone key, create one with 24h TTL, 10 ms.
-    else the backoff *= multiplier.
-  * If the backoff is less than a second, remove entries from cache and
-    restart query.  Else set the TTL for the entries to that value.
-  * Entries to set or remove: DNSKEY RRset&msg, DS RRset&msg, NS RRset&msg, 
-  	in-zone glue (A and AAAA) RRset&msg, and key-cache-entry TTL.
-	The the data element RRset&msg to the backoff TTL or bogusttl.
-	If TTL>1sec set key-cache-entry flag 'being-backed-off' to true.
-	when entry times out that flag is reset to false again.
-* Storage extra is:
-  IP address per RRset and message.  A lot of memory really, since that is
-  132 bytes per RRset and per message.  Store plain IP: 4/16 bytes, len byte.
-  port number 2bytes. +19bytes per RRset, per msg.
-  guilt flag in infra(lameness) cache.
-  being-backed-off flag for key cache, also backoff time value and its TTL.
-  child-retry-count and guilty-ip-list in qstate.
-* Load on authorities:
-  For lame servers: 7 tries per day (one per three hours on average).
-  Others get up to 23 tries per day (one per hour on average).
-  +1 for original try makes 8/24 hours and 24/24 hours.
-  Unless the cache entry falls out of the cache due to memory. In that
-  case it can be tried more often, this is similar to the NS entry falling
-  out of the cache due to memory, in that case it also has to be retried.
-* Performance analysis:
-  * domain is sold.  Unbound sees invalid signature (expired) or the old
-    servers refuse the queries.  Retry within the second, if parent has
-    new DS and NS available instantly works again (no downtime).
-  * domain is bogus signed.  Parent gets 1 query per hour.
-	Domain itself gets couple tries per queryname, per minute.
-  * domain partly bogus.  Parent gets 1 query per hour.
-	Domain itself gets couple tries per bogus queryname, per minute.
-  * spoof attempt.  Unbound tries a couple times.  If not spoofed again,
-    it works, if spoofed every time unbound backs off and stops trying.
-	But childretry is attempted more often, once per minute.
-  * parent has inconsistently signed DS records.  Together with a subzone that
-    is badly managed.  Unbound backs up to the root once per hour.
-  * parent has bad DS records, different sets on different servers, but they
-    are signed ok.  Works as for every query a list of bad nameserver, parent
-    and child side is kept, walks through them.  But as backoff increases
-    and becomes bigger than the TTL on the DS records, unbound will blackout.
-    The parent really has to be fixed...
-    The issue is that it is validly signed, but bad data. Unbound will very
-    conservatively retry it.
-  * domain is sold, but decommission is faster than the setup of new server.
-    Unbound does exponential backoff, if new setup is fast, it'll pickup the
-    new data fast.
-  * key rollover failed.  The zone has bad keys.  Like it was bogus signed.
-  * one nameserver has bad data.  Unbound goes back to the parent but also
-    marks that server as guilty.  Picks data from other server right after,
-    retry without blackout for the user.  
-    When parent starts to get backed off, if the nameserver is childside,
-    queryretries for childservers are made when queries fail.
-  * domain was sold, but unbound has old entries in the cache.  These somehow
-    need (re)validation (were queried with +cd, now -cd).  The entries are
-    bogus.  
-    Unbound performs childretry for these entries.  Works once the keys
-    have been successfully reprimed with parentretry.
-  * unbound is configured to talk to upstream caches.  These caches have
-    inconsistent bad data.  If one is bad, it is marked bad for that zone.  
-    If all are bad, there may not be any way for unbound to remove the
-    bad entries from the upstream caches.  It simply fails.
-    Recommendation: make the upstream caches validate as well.
-  * Old data that was valid with a long TTL remains in the cache.
-    Valid data has a TTL and this is the protocol.
-  * listing bad servers and trying again may not be good enough, since
-    a combinatorial explosion for DSxDNSKEYxdata is possible for every
-    signature validation (using different nameservers for DS, DNSKEY and
-    data, assuming only the right combination has a chain of trust to data).
-    The parentretries perform DS and DNSKEY searching.
-    childretries perform data searching.
-
-
-later
- selective verbosity; ubcontrol trace example.com
- option to log only bogus domainname encountered, for demos
- cache fork-dump, pre-load
- for fwds, send queries to N servers in fwd-list, use first reply.
-  document high scalable, high available unbound setup onepager.
- prefetch DNSKEY when DS in delegation seen (nonCD, underTA).
- use libevent if available on system by default(?), default outgoing 256to1024

@@ -18,7 +18,7 @@ server:
 	# print statistics to the log (for every thread) every N seconds.
 	# Set to "" or 0 to disable. Default is disabled.
 	# statistics-interval: 0
-
+	
 	# enable cumulative statistics, without clearing them after printing.
 	# statistics-cumulative: no

@@ -37,7 +37,7 @@ server:
 	# interface: 192.0.2.153
 	# interface: 192.0.2.154
 	# interface: 2001:DB8::5
-
+	
 	# enable this feature to copy the source address of queries to reply.
 	# Socket options are not supported on all platforms. experimental. 
 	# interface-automatic: no
@@ -55,7 +55,7 @@ server:
 	# number of ports to allocate per thread, determines the size of the
 	# port range that can be open simultaneously. 
 	# outgoing-range: 256
-
+	
 	# permit unbound to use this port number or port range for
 	# making outgoing queries, using an outgoing interface.
 	# outgoing-port-permit: 32768
@@ -72,7 +72,7 @@ server:

 	# number of incoming simultaneous tcp buffers to hold per thread.
 	# incoming-num-tcp: 10
-
+	
 	# buffer size for handling DNS data. No messages larger than this
 	# size can be sent or received, by UDP or TCP. In bytes.
 	# msg-buffer-size: 65552
@@ -191,7 +191,7 @@ server:
 	# the log file, "" means log to stderr. 
 	# Use of this option sets use-syslog to "no".
 	# logfile: ""
-
+	
 	# Log to syslog(3) if yes. The log facility LOG_DAEMON is used to 
 	# log to, with identity "unbound". If yes, it overrides the logfile.
 	# use-syslog: yes 
@@ -201,23 +201,23 @@ server:

 	# the pid file. Can be an absolute path outside of chroot/work dir.
 	# pidfile: "@UNBOUND_PIDFILE@"
-
+	
 	# file to read root hints from.
 	# get one from ftp://FTP.INTERNIC.NET/domain/named.cache
 	# root-hints: ""
-
+	
 	# enable to not answer id.server and hostname.bind queries.
 	# hide-identity: no
-
+	
 	# enable to not answer version.server and version.bind queries.
 	# hide-version: no
-
+	
 	# the identity to report. Leave "" or default to return hostname.
 	# identity: ""
-
+	
 	# the version to report. Leave "" or default to return package version.
 	# version: ""
-
+	
 	# the target fetch policy.
 	# series of integers describing the policy per dependency depth. 
 	# The number of values in the list determines the maximum dependency 
@@ -227,16 +227,16 @@ server:
 	#	positive value: fetch that many targets opportunistically.
 	# Enclose the list of numbers between quotes ("").
 	# target-fetch-policy: "3 2 1 0 0"
-
+	
 	# Harden against very small EDNS buffer sizes. 
 	# harden-short-bufsize: no
-
+	
 	# Harden against unseemly large queries.
 	# harden-large-queries: no
-
+	
 	# Harden against out of zone rrsets, to avoid spoofing attempts. 
 	# harden-glue: yes
-
+	
 	# Harden against receiving dnssec-stripped data. If you turn it
 	# off, failing to validate dnskey data for a trustanchor will 
 	# trigger insecure mode for that zone (like without a trustanchor).
@@ -252,7 +252,7 @@ server:
 	# Use 0x20-encoded random bits in the query to foil spoof attempts.
 	# This feature is an experimental implementation of draft dns-0x20.
 	# use-caps-for-id: no
-
+	
 	# Enforce privacy of these addresses. Strips them away from answers. 
 	# It may cause DNSSEC validation to additionally mark it as bogus. 
 	# Protects against 'DNS Rebinding' (uses browser as network proxy). 
@@ -268,7 +268,7 @@ server:
 	# Allow the domain (and its subdomains) to contain private addresses.
 	# local-data statements are allowed to contain private addresses too.
 	# private-domain: "example.com"
-
+	
 	# If nonzero, unwanted replies are not only reported in statistics,
 	# but also a running total is kept per thread. If it reaches the
 	# threshold, a warning is printed and a defensive action is taken,
@@ -280,15 +280,15 @@ server:
 	# List one address per entry. List classless netblocks with /size,
 	# do-not-query-address: 127.0.0.1/8
 	# do-not-query-address: ::1
-
+	
 	# if yes, the above default do-not-query-address entries are present.
 	# if no, localhost can be queried (for testing and debugging).
 	# do-not-query-localhost: yes
-
+	
 	# module configuration of the server. A string with identifiers
 	# separated by spaces. "iterator" or "validator iterator"
 	# module-config: "validator iterator"
-
+	
 	# File with DLV trusted keys. Same format as trust-anchor-file.
 	# There can be only one DLV configured, it is trusted from root down.
 	# Download http://ftp.isc.org/www/dlv/dlv.isc.org.key
@@ -298,7 +298,7 @@ server:
 	# with several entries, one file per entry.
 	# Zone file format, with DS and DNSKEY entries.
 	# trust-anchor-file: ""
-
+	
 	# Trusted key for validation. DS or DNSKEY. specify the RR on a
 	# single line, surrounded by "". TTL is ignored. class is IN default.
 	# (These examples are from August 2007 and may not be valid anymore).
@@ -310,7 +310,7 @@ server:
 	# but has a different file format. Format is BIND-9 style format, 
 	# the trusted-keys { name flag proto algo "key"; }; clauses are read.
 	# trusted-keys-file: ""
-
+	
 	# Ignore chain of trust. Domain is treated as insecure.
 	# domain-insecure: "example.com"

@@ -318,30 +318,30 @@ server:
 	# Do not set this unless you are debugging signature inception
 	# and expiration. "" or "0" turns the feature off. 
 	# val-override-date: ""
-
+	
 	# The time to live for bogus data, rrsets and messages. This avoids
 	# some of the revalidation, until the time interval expires. in secs.
 	# val-bogus-ttl: 60
-
+	
 	# The signature inception and expiration dates are allowed to be off
 	# by 10% of the lifetime of the signature from our local clock.
 	# This leeway is capped with a minimum and a maximum.  In seconds.
 	# val-sig-skew-min: 3600
 	# val-sig-skew-max: 86400
-
+	
 	# Should additional section of secure message also be kept clean of
 	# unsecure data. Useful to shield the users of this validator from
 	# potential bogus data in the additional section. All unsigned data 
 	# in the additional section is removed from secure messages.
 	# val-clean-additional: yes
-
+	
 	# Turn permissive mode on to permit bogus messages. Thus, messages
 	# for which security checks failed will be returned to clients,
 	# instead of SERVFAIL. It still performs the security checks, which
 	# result in interesting log files and possibly the AD bit in
 	# replies if the message is found secure. The default is off.
 	# val-permissive-mode: no
-
+	
 	# It is possible to configure NSEC3 maximum iteration counts per
 	# keysize. Keep this table very short, as linear search is done.
 	# A message with an NSEC3 with larger count is marked insecure.
@@ -356,7 +356,7 @@ server:
 	# the number of slabs must be a power of 2.
 	# more slabs reduce lock contention, but fragment memory usage.
 	# key-cache-slabs: 4
-
+	
 	# the amount of memory to use for the negative cache (used for DLV).
 	# plain value in bytes or you can append k, m or G. default is "1Mb". 
 	# neg-cache-size: 1m
@@ -235,9 +235,6 @@ o EDNS fallback. Is done according to the EDNS RFC (and update draft-00).
  It minimizes the chances of a dropped query making a (DNSSEC) EDNS server
  falsely EDNS-nonsupporting, and thus DNSSEC-bogus, works well with 
  middleboxes, and can detect the occasional authority that drops EDNS.
-  For some boxes it is necessary to probe for every failing query, a
-  reassurance that the DNS server does EDNS does not mean that path can
-  take large DNS answers.

 o 0x20 backoff.
  The draft describes to back off to the next server, and go through all
@@ -1,519 +1,251 @@
 #!/bin/sh
+#
 # install - install a program, script, or datafile
-
-scriptversion=2006-12-25.00
-
-# This originates from X11R5 (mit/util/scripts/install.sh), which was
-# later released in X11R6 (xc/config/util/install.sh) with the
-# following copyright and license.
+# This comes from X11R5 (mit/util/scripts/install.sh).
 #
-# Copyright (C) 1994 X Consortium
+# Copyright 1991 by the Massachusetts Institute of Technology
 #
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to
-# deal in the Software without restriction, including without limitation the
-# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-# sell copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in
-# all copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.  IN NO EVENT SHALL THE
-# X CONSORTIUM BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN
-# AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNEC-
-# TION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
-#
-# Except as contained in this notice, the name of the X Consortium shall not
-# be used in advertising or otherwise to promote the sale, use or other deal-
-# ings in this Software without prior written authorization from the X Consor-
-# tium.
-#
-#
-# FSF changes to this file are in the public domain.
+# Permission to use, copy, modify, distribute, and sell this software and its
+# documentation for any purpose is hereby granted without fee, provided that
+# the above copyright notice appear in all copies and that both that
+# copyright notice and this permission notice appear in supporting
+# documentation, and that the name of M.I.T. not be used in advertising or
+# publicity pertaining to distribution of the software without specific,
+# written prior permission.  M.I.T. makes no representations about the
+# suitability of this software for any purpose.  It is provided "as is"
+# without express or implied warranty.
 #
 # Calling this script install-sh is preferred over install.sh, to prevent
 # `make' implicit rules from creating a file called install from it
 # when there is no Makefile.
 #
 # This script is compatible with the BSD install script, but was written
-# from scratch.
+# from scratch.  It can only install one file at a time, a restriction
+# shared with many OS's install programs.

-nl='
-'
-IFS=" ""	$nl"

 # set DOITPROG to echo to test this script

 # Don't use :- since 4.3BSD and earlier shells don't like it.
-doit=${DOITPROG-}
-if test -z "$doit"; then
-  doit_exec=exec
-else
-  doit_exec=$doit
-fi
+doit="${DOITPROG-}"

-# Put in absolute file names if you don't have them in your path;
-# or use environment vars.

-chgrpprog=${CHGRPPROG-chgrp}
-chmodprog=${CHMODPROG-chmod}
-chownprog=${CHOWNPROG-chown}
-cmpprog=${CMPPROG-cmp}
-cpprog=${CPPROG-cp}
-mkdirprog=${MKDIRPROG-mkdir}
-mvprog=${MVPROG-mv}
-rmprog=${RMPROG-rm}
-stripprog=${STRIPPROG-strip}
+# put in absolute paths if you don't have them in your path; or use env. vars.

-posix_glob='?'
-initialize_posix_glob='
-  test "$posix_glob" != "?" || {
-    if (set -f) 2>/dev/null; then
-      posix_glob=
-    else
-      posix_glob=:
-    fi
-  }
-'
+mvprog="${MVPROG-mv}"
+cpprog="${CPPROG-cp}"
+chmodprog="${CHMODPROG-chmod}"
+chownprog="${CHOWNPROG-chown}"
+chgrpprog="${CHGRPPROG-chgrp}"
+stripprog="${STRIPPROG-strip}"
+rmprog="${RMPROG-rm}"
+mkdirprog="${MKDIRPROG-mkdir}"

-posix_mkdir=
-
-# Desired mode of installed file.
-mode=0755
-
-chgrpcmd=
-chmodcmd=$chmodprog
-chowncmd=
-mvcmd=$mvprog
+transformbasename=""
+transform_arg=""
+instcmd="$mvprog"
+chmodcmd="$chmodprog 0755"
+chowncmd=""
+chgrpcmd=""
+stripcmd=""
 rmcmd="$rmprog -f"
-stripcmd=
+mvcmd="$mvprog"
+src=""
+dst=""
+dir_arg=""

-src=
-dst=
-dir_arg=
-dst_arg=
+while [ x"$1" != x ]; do
+    case $1 in
+	-c) instcmd="$cpprog"
+	    shift
+	    continue;;

-copy_on_change=false
-no_target_directory=
+	-d) dir_arg=true
+	    shift
+	    continue;;

-usage="\
-Usage: $0 [OPTION]... [-T] SRCFILE DSTFILE
-   or: $0 [OPTION]... SRCFILES... DIRECTORY
-   or: $0 [OPTION]... -t DIRECTORY SRCFILES...
-   or: $0 [OPTION]... -d DIRECTORIES...
+	-m) chmodcmd="$chmodprog $2"
+	    shift
+	    shift
+	    continue;;

-In the 1st form, copy SRCFILE to DSTFILE.
-In the 2nd and 3rd, copy all SRCFILES to DIRECTORY.
-In the 4th, create DIRECTORIES.
+	-o) chowncmd="$chownprog $2"
+	    shift
+	    shift
+	    continue;;

-Options:
-     --help     display this help and exit.
-     --version  display version info and exit.
+	-g) chgrpcmd="$chgrpprog $2"
+	    shift
+	    shift
+	    continue;;

-  -c            (ignored)
-  -C            install only if different (preserve the last data modification time)
-  -d            create directories instead of installing files.
-  -g GROUP      $chgrpprog installed files to GROUP.
-  -m MODE       $chmodprog installed files to MODE.
-  -o USER       $chownprog installed files to USER.
-  -s            $stripprog installed files.
-  -t DIRECTORY  install into DIRECTORY.
-  -T            report an error if DSTFILE is a directory.
+	-s) stripcmd="$stripprog"
+	    shift
+	    continue;;

-Environment variables override the default commands:
-  CHGRPPROG CHMODPROG CHOWNPROG CMPPROG CPPROG MKDIRPROG MVPROG
-  RMPROG STRIPPROG
-"
+	-t=*) transformarg=`echo $1 | sed 's/-t=//'`
+	    shift
+	    continue;;

-while test $# -ne 0; do
-  case $1 in
-    -c) ;;
+	-b=*) transformbasename=`echo $1 | sed 's/-b=//'`
+	    shift
+	    continue;;

-    -C) copy_on_change=true;;
-
-    -d) dir_arg=true;;
-
-    -g) chgrpcmd="$chgrpprog $2"
-	shift;;
-
-    --help) echo "$usage"; exit $?;;
-
-    -m) mode=$2
-	case $mode in
-	  *' '* | *'	'* | *'
-'*	  | *'*'* | *'?'* | *'['*)
-	    echo "$0: invalid mode: $mode" >&2
-	    exit 1;;
-	esac
-	shift;;
-
-    -o) chowncmd="$chownprog $2"
-	shift;;
-
-    -s) stripcmd=$stripprog;;
-
-    -t) dst_arg=$2
-	shift;;
-
-    -T) no_target_directory=true;;
-
-    --version) echo "$0 $scriptversion"; exit $?;;
-
-    --)	shift
-	break;;
-
-    -*)	echo "$0: invalid option: $1" >&2
-	exit 1;;
-
-    *)  break;;
-  esac
-  shift
-done
-
-if test $# -ne 0 && test -z "$dir_arg$dst_arg"; then
-  # When -d is used, all remaining arguments are directories to create.
-  # When -t is used, the destination is already specified.
-  # Otherwise, the last argument is the destination.  Remove it from $@.
-  for arg
-  do
-    if test -n "$dst_arg"; then
-      # $@ is not empty: it contains at least $arg.
-      set fnord "$@" "$dst_arg"
-      shift # fnord
-    fi
-    shift # arg
-    dst_arg=$arg
-  done
-fi
-
-if test $# -eq 0; then
-  if test -z "$dir_arg"; then
-    echo "$0: no input file specified." >&2
-    exit 1
-  fi
-  # It's OK to call `install-sh -d' without argument.
-  # This can happen when creating conditional directories.
-  exit 0
-fi
-
-if test -z "$dir_arg"; then
-  trap '(exit $?); exit' 1 2 13 15
-
-  # Set umask so as not to create temps with too-generous modes.
-  # However, 'strip' requires both read and write access to temps.
-  case $mode in
-    # Optimize common cases.
-    *644) cp_umask=133;;
-    *755) cp_umask=22;;
-
-    *[0-7])
-      if test -z "$stripcmd"; then
-	u_plus_rw=
-      else
-	u_plus_rw='% 200'
-      fi
-      cp_umask=`expr '(' 777 - $mode % 1000 ')' $u_plus_rw`;;
-    *)
-      if test -z "$stripcmd"; then
-	u_plus_rw=
-      else
-	u_plus_rw=,u+rw
-      fi
-      cp_umask=$mode$u_plus_rw;;
-  esac
-fi
-
-for src
-do
-  # Protect names starting with `-'.
-  case $src in
-    -*) src=./$src;;
-  esac
-
-  if test -n "$dir_arg"; then
-    dst=$src
-    dstdir=$dst
-    test -d "$dstdir"
-    dstdir_status=$?
-  else
-
-    # Waiting for this to be detected by the "$cpprog $src $dsttmp" command
-    # might cause directories to be created, which would be especially bad
-    # if $src (and thus $dsttmp) contains '*'.
-    if test ! -f "$src" && test ! -d "$src"; then
-      echo "$0: $src does not exist." >&2
-      exit 1
-    fi
-
-    if test -z "$dst_arg"; then
-      echo "$0: no destination specified." >&2
-      exit 1
-    fi
-
-    dst=$dst_arg
-    # Protect names starting with `-'.
-    case $dst in
-      -*) dst=./$dst;;
-    esac
-
-    # If destination is a directory, append the input filename; won't work
-    # if double slashes aren't ignored.
-    if test -d "$dst"; then
-      if test -n "$no_target_directory"; then
-	echo "$0: $dst_arg: Is a directory" >&2
-	exit 1
-      fi
-      dstdir=$dst
-      dst=$dstdir/`basename "$src"`
-      dstdir_status=0
-    else
-      # Prefer dirname, but fall back on a substitute if dirname fails.
-      dstdir=`
-	(dirname "$dst") 2>/dev/null ||
-	expr X"$dst" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \
-	     X"$dst" : 'X\(//\)[^/]' \| \
-	     X"$dst" : 'X\(//\)$' \| \
-	     X"$dst" : 'X\(/\)' \| . 2>/dev/null ||
-	echo X"$dst" |
-	    sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\/\)[^/].*/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\/\)$/{
-		   s//\1/
-		   q
-		 }
-		 /^X\(\/\).*/{
-		   s//\1/
-		   q
-		 }
-		 s/.*/./; q'
-      `
-
-      test -d "$dstdir"
-      dstdir_status=$?
-    fi
-  fi
-
-  obsolete_mkdir_used=false
-
-  if test $dstdir_status != 0; then
-    case $posix_mkdir in
-      '')
-	# Create intermediate dirs using mode 755 as modified by the umask.
-	# This is like FreeBSD 'install' as of 1997-10-28.
-	umask=`umask`
-	case $stripcmd.$umask in
-	  # Optimize common cases.
-	  *[2367][2367]) mkdir_umask=$umask;;
-	  .*0[02][02] | .[02][02] | .[02]) mkdir_umask=22;;
-
-	  *[0-7])
-	    mkdir_umask=`expr $umask + 22 \
-	      - $umask % 100 % 40 + $umask % 20 \
-	      - $umask % 10 % 4 + $umask % 2
-	    `;;
-	  *) mkdir_umask=$umask,go-w;;
-	esac
-
-	# With -d, create the new directory with the user-specified mode.
-	# Otherwise, rely on $mkdir_umask.
-	if test -n "$dir_arg"; then
-	  mkdir_mode=-m$mode
-	else
-	  mkdir_mode=
-	fi
-
-	posix_mkdir=false
-	case $umask in
-	  *[123567][0-7][0-7])
-	    # POSIX mkdir -p sets u+wx bits regardless of umask, which
-	    # is incompatible with FreeBSD 'install' when (umask & 300) != 0.
-	    ;;
-	  *)
-	    tmpdir=${TMPDIR-/tmp}/ins$RANDOM-$$
-	    trap 'ret=$?; rmdir "$tmpdir/d" "$tmpdir" 2>/dev/null; exit $ret' 0
-
-	    if (umask $mkdir_umask &&
-		exec $mkdirprog $mkdir_mode -p -- "$tmpdir/d") >/dev/null 2>&1
+	*)  if [ x"$src" = x ]
 	    then
-	      if test -z "$dir_arg" || {
-		   # Check for POSIX incompatibilities with -m.
-		   # HP-UX 11.23 and IRIX 6.5 mkdir -m -p sets group- or
-		   # other-writeable bit of parent directory when it shouldn't.
-		   # FreeBSD 6.1 mkdir -m -p sets mode of existing directory.
-		   ls_ld_tmpdir=`ls -ld "$tmpdir"`
-		   case $ls_ld_tmpdir in
-		     d????-?r-*) different_mode=700;;
-		     d????-?--*) different_mode=755;;
-		     *) false;;
-		   esac &&
-		   $mkdirprog -m$different_mode -p -- "$tmpdir" && {
-		     ls_ld_tmpdir_1=`ls -ld "$tmpdir"`
-		     test "$ls_ld_tmpdir" = "$ls_ld_tmpdir_1"
-		   }
-		 }
-	      then posix_mkdir=:
-	      fi
-	      rmdir "$tmpdir/d" "$tmpdir"
+		src=$1
 	    else
-	      # Remove any dirs left behind by ancient mkdir implementations.
-	      rmdir ./$mkdir_mode ./-p ./-- 2>/dev/null
+		# this colon is to work around a 386BSD /bin/sh bug
+		:
+		dst=$1
 	    fi
-	    trap '' 0;;
-	esac;;
+	    shift
+	    continue;;
    esac
-
-    if
-      $posix_mkdir && (
-	umask $mkdir_umask &&
-	$doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir"
-      )
-    then :
-    else
-
-      # The umask is ridiculous, or mkdir does not conform to POSIX,
-      # or it failed possibly due to a race condition.  Create the
-      # directory the slow way, step by step, checking for races as we go.
-
-      case $dstdir in
-	/*) prefix='/';;
-	-*) prefix='./';;
-	*)  prefix='';;
-      esac
-
-      eval "$initialize_posix_glob"
-
-      oIFS=$IFS
-      IFS=/
-      $posix_glob set -f
-      set fnord $dstdir
-      shift
-      $posix_glob set +f
-      IFS=$oIFS
-
-      prefixes=
-
-      for d
-      do
-	test -z "$d" && continue
-
-	prefix=$prefix$d
-	if test -d "$prefix"; then
-	  prefixes=
-	else
-	  if $posix_mkdir; then
-	    (umask=$mkdir_umask &&
-	     $doit_exec $mkdirprog $mkdir_mode -p -- "$dstdir") && break
-	    # Don't fail if two instances are running concurrently.
-	    test -d "$prefix" || exit 1
-	  else
-	    case $prefix in
-	      *\'*) qprefix=`echo "$prefix" | sed "s/'/'\\\\\\\\''/g"`;;
-	      *) qprefix=$prefix;;
-	    esac
-	    prefixes="$prefixes '$qprefix'"
-	  fi
-	fi
-	prefix=$prefix/
-      done
-
-      if test -n "$prefixes"; then
-	# Don't fail if two instances are running concurrently.
-	(umask $mkdir_umask &&
-	 eval "\$doit_exec \$mkdirprog $prefixes") ||
-	  test -d "$dstdir" || exit 1
-	obsolete_mkdir_used=true
-      fi
-    fi
-  fi
-
-  if test -n "$dir_arg"; then
-    { test -z "$chowncmd" || $doit $chowncmd "$dst"; } &&
-    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dst"; } &&
-    { test "$obsolete_mkdir_used$chowncmd$chgrpcmd" = false ||
-      test -z "$chmodcmd" || $doit $chmodcmd $mode "$dst"; } || exit 1
-  else
-
-    # Make a couple of temp file names in the proper directory.
-    dsttmp=$dstdir/_inst.$$_
-    rmtmp=$dstdir/_rm.$$_
-
-    # Trap to clean up those temp files at exit.
-    trap 'ret=$?; rm -f "$dsttmp" "$rmtmp" && exit $ret' 0
-
-    # Copy the file name to the temp name.
-    (umask $cp_umask && $doit_exec $cpprog "$src" "$dsttmp") &&
-
-    # and set any options; do chmod last to preserve setuid bits.
-    #
-    # If any of these fail, we abort the whole thing.  If we want to
-    # ignore errors from any of these, just make sure not to ignore
-    # errors from the above "$doit $cpprog $src $dsttmp" command.
-    #
-    { test -z "$chowncmd" || $doit $chowncmd "$dsttmp"; } &&
-    { test -z "$chgrpcmd" || $doit $chgrpcmd "$dsttmp"; } &&
-    { test -z "$stripcmd" || $doit $stripcmd "$dsttmp"; } &&
-    { test -z "$chmodcmd" || $doit $chmodcmd $mode "$dsttmp"; } &&
-
-    # If -C, don't bother to copy if it wouldn't change the file.
-    if $copy_on_change &&
-       old=`LC_ALL=C ls -dlL "$dst"	2>/dev/null` &&
-       new=`LC_ALL=C ls -dlL "$dsttmp"	2>/dev/null` &&
-
-       eval "$initialize_posix_glob" &&
-       $posix_glob set -f &&
-       set X $old && old=:$2:$4:$5:$6 &&
-       set X $new && new=:$2:$4:$5:$6 &&
-       $posix_glob set +f &&
-
-       test "$old" = "$new" &&
-       $cmpprog "$dst" "$dsttmp" >/dev/null 2>&1
-    then
-      rm -f "$dsttmp"
-    else
-      # Rename the file to the real destination.
-      $doit $mvcmd -f "$dsttmp" "$dst" 2>/dev/null ||
-
-      # The rename failed, perhaps because mv can't rename something else
-      # to itself, or perhaps because mv is so ancient that it does not
-      # support -f.
-      {
-	# Now remove or move aside any old file at destination location.
-	# We try this two ways since rm can't unlink itself on some
-	# systems and the destination file might be busy for other
-	# reasons.  In this case, the final cleanup might fail but the new
-	# file should still install successfully.
-	{
-	  test ! -f "$dst" ||
-	  $doit $rmcmd -f "$dst" 2>/dev/null ||
-	  { $doit $mvcmd -f "$dst" "$rmtmp" 2>/dev/null &&
-	    { $doit $rmcmd -f "$rmtmp" 2>/dev/null; :; }
-	  } ||
-	  { echo "$0: cannot unlink or rename $dst" >&2
-	    (exit 1); exit 1
-	  }
-	} &&
-
-	# Now rename the file to the real destination.
-	$doit $mvcmd "$dsttmp" "$dst"
-      }
-    fi || exit 1
-
-    trap '' 0
-  fi
 done

-# Local variables:
-# eval: (add-hook 'write-file-hooks 'time-stamp)
-# time-stamp-start: "scriptversion="
-# time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-end: "$"
-# End:
+if [ x"$src" = x ]
+then
+	echo "install:	no input file specified"
+	exit 1
+else
+	true
+fi
+
+if [ x"$dir_arg" != x ]; then
+	dst=$src
+	src=""
+	
+	if [ -d $dst ]; then
+		instcmd=:
+		chmodcmd=""
+	else
+		instcmd=mkdir
+	fi
+else
+
+# Waiting for this to be detected by the "$instcmd $src $dsttmp" command
+# might cause directories to be created, which would be especially bad 
+# if $src (and thus $dsttmp) contains '*'.
+
+	if [ -f $src -o -d $src ]
+	then
+		true
+	else
+		echo "install:  $src does not exist"
+		exit 1
+	fi
+	
+	if [ x"$dst" = x ]
+	then
+		echo "install:	no destination specified"
+		exit 1
+	else
+		true
+	fi
+
+# If destination is a directory, append the input filename; if your system
+# does not like double slashes in filenames, you may need to add some logic
+
+	if [ -d $dst ]
+	then
+		dst="$dst"/`basename $src`
+	else
+		true
+	fi
+fi
+
+## this sed command emulates the dirname command
+dstdir=`echo $dst | sed -e 's,[^/]*$,,;s,/$,,;s,^$,.,'`
+
+# Make sure that the destination directory exists.
+#  this part is taken from Noah Friedman's mkinstalldirs script
+
+# Skip lots of stat calls in the usual case.
+if [ ! -d "$dstdir" ]; then
+defaultIFS='	
+'
+IFS="${IFS-${defaultIFS}}"
+
+oIFS="${IFS}"
+# Some sh's can't handle IFS=/ for some reason.
+IFS='%'
+set - `echo ${dstdir} | sed -e 's@/@%@g' -e 's@^%@/@'`
+IFS="${oIFS}"
+
+pathcomp=''
+
+while [ $# -ne 0 ] ; do
+	pathcomp="${pathcomp}${1}"
+	shift
+
+	if [ ! -d "${pathcomp}" ] ;
+        then
+		$mkdirprog "${pathcomp}"
+	else
+		true
+	fi
+
+	pathcomp="${pathcomp}/"
+done
+fi
+
+if [ x"$dir_arg" != x ]
+then
+	$doit $instcmd $dst &&
+
+	if [ x"$chowncmd" != x ]; then $doit $chowncmd $dst; else true ; fi &&
+	if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dst; else true ; fi &&
+	if [ x"$stripcmd" != x ]; then $doit $stripcmd $dst; else true ; fi &&
+	if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dst; else true ; fi
+else
+
+# If we're going to rename the final executable, determine the name now.
+
+	if [ x"$transformarg" = x ] 
+	then
+		dstfile=`basename $dst`
+	else
+		dstfile=`basename $dst $transformbasename | 
+			sed $transformarg`$transformbasename
+	fi
+
+# don't allow the sed command to completely eliminate the filename
+
+	if [ x"$dstfile" = x ] 
+	then
+		dstfile=`basename $dst`
+	else
+		true
+	fi
+
+# Make a temp file name in the proper directory.
+
+	dsttmp=$dstdir/#inst.$$#
+
+# Move or copy the file name to the temp name
+
+	$doit $instcmd $src $dsttmp &&
+
+	trap "rm -f ${dsttmp}" 0 &&
+
+# and set any options; do chmod last to preserve setuid bits
+
+# If any of these fail, we abort the whole thing.  If we want to
+# ignore errors from any of these, just make sure not to ignore
+# errors from the above "$doit $instcmd $src $dsttmp" command.
+
+	if [ x"$chowncmd" != x ]; then $doit $chowncmd $dsttmp; else true;fi &&
+	if [ x"$chgrpcmd" != x ]; then $doit $chgrpcmd $dsttmp; else true;fi &&
+	if [ x"$stripcmd" != x ]; then $doit $stripcmd $dsttmp; else true;fi &&
+	if [ x"$chmodcmd" != x ]; then $doit $chmodcmd $dsttmp; else true;fi &&
+
+# Now rename the file to the real destination.
+
+	$doit $rmcmd -f $dstdir/$dstfile &&
+	$doit $mvcmd $dsttmp $dstdir/$dstfile 
+
+fi &&
+
+
+exit 0
@@ -68,7 +68,6 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 		return NULL;
 	if(!delegpt_set_name(copy, region, dp->name))
 		return NULL;
-	copy->bogus = dp->bogus;
 	for(ns = dp->nslist; ns; ns = ns->next) {
 		if(!delegpt_add_ns(copy, region, ns->name))
 			return NULL;
@@ -88,10 +88,9 @@ forwards_delete(struct iter_forwards* fwd)
 	free(fwd);
 }

-/** insert info into forward structure */
+/** insert new info into forward structure */
 static int
-forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm, 
-	size_t nmlen, int nmlabs, struct delegpt* dp)
+forwards_insert(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
 {
 	struct iter_forward_zone* node = regional_alloc(fwd->region,
 		sizeof(struct iter_forward_zone));
@@ -99,11 +98,11 @@ forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
 		return 0;
 	node->node.key = node;
 	node->dclass = c;
-	node->name = regional_alloc_init(fwd->region, nm, nmlen);
+	node->name = regional_alloc_init(fwd->region, dp->name, dp->namelen);
 	if(!node->name)
 		return 0;
-	node->namelen = nmlen;
-	node->namelabs = nmlabs;
+	node->namelen = dp->namelen;
+	node->namelabs = dp->namelabs;
 	node->dp = dp;
 	if(!rbtree_insert(fwd->tree, &node->node)) {
 		log_err("duplicate forward zone ignored.");
@@ -111,14 +110,6 @@ forwards_insert_data(struct iter_forwards* fwd, uint16_t c, uint8_t* nm,
 	return 1;
 }

-/** insert new info into forward structure given dp */
-static int
-forwards_insert(struct iter_forwards* fwd, uint16_t c, struct delegpt* dp)
-{
-	return forwards_insert_data(fwd, c, dp->name, dp->namelen,
-		dp->namelabs, dp);
-}
-
 /** initialise parent pointers in the tree */
 static void
 fwd_init_parents(struct iter_forwards* fwd)
@@ -243,56 +234,6 @@ read_forwards(struct iter_forwards* fwd, struct config_file* cfg)
 	return 1;
 }

-/** see if zone needs to have a hole inserted */
-static int
-need_hole_insert(rbtree_t* tree, struct iter_forward_zone* zone)
-{
-	struct iter_forward_zone k;
-	if(rbtree_search(tree, zone))
-		return 0; /* exact match exists */
-	k = *zone;
-	k.node.key = &k;
-	/* search up the tree */
-	do {
-		dname_remove_label(&k.name, &k.namelen);
-		k.namelabs --;
-		if(rbtree_search(tree, &k))
-			return 1; /* found an upper forward zone, need hole */
-	} while(k.namelabs > 1);
-	return 0; /* no forwards above, no holes needed */
-}
-
-/** make NULL entries for stubs */
-static int
-make_stub_holes(struct iter_forwards* fwd, struct config_file* cfg)
-{
-	struct config_stub* s;
-	struct iter_forward_zone key;
-	key.node.key = &key;
-	key.dclass = LDNS_RR_CLASS_IN;
-	for(s = cfg->stubs; s; s = s->next) {
-		ldns_rdf* rdf = ldns_dname_new_frm_str(s->name);
-		if(!rdf) {
-			log_err("cannot parse stub name '%s'", s->name);
-			return 0;
-		}
-		key.name = ldns_rdf_data(rdf);
-		key.namelabs = dname_count_size_labels(key.name, &key.namelen);
-		if(!need_hole_insert(fwd->tree, &key)) {
-			ldns_rdf_deep_free(rdf);
-			continue;
-		}
-		if(!forwards_insert_data(fwd, key.dclass, key.name, 
-			key.namelen, key.namelabs, NULL)) {
-			ldns_rdf_deep_free(rdf);
-			log_err("out of memory");
-			return 0;
-		}
-		ldns_rdf_deep_free(rdf);
-	}
-	return 1;
-}
-
 int 
 forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
 {
@@ -305,8 +246,6 @@ forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg)
 	/* read forward zones */
 	if(!read_forwards(fwd, cfg))
 		return 0;
-	if(!make_stub_holes(fwd, cfg))
-		return 0;
 	fwd_init_parents(fwd);
 	return 1;
 }
@@ -75,9 +75,7 @@ struct iter_forward_zone {
 	size_t namelen;
 	/** number of labels in name */
 	int namelabs;
-	/** delegation point with forward server information for this zone. 
-	 * If NULL then this forward entry is used to indicate that a
-	 * stub-zone with the same name exists, and should be used. */
+	/** delegation point with forward server information for this zone. */
 	struct delegpt* dp;
 	/** pointer to parent in tree (or NULL if none) */
 	struct iter_forward_zone* parent;
@@ -210,50 +210,43 @@ size_t priv_get_mem(struct iter_priv* priv)
 int priv_rrset_bad(struct iter_priv* priv, ldns_buffer* pkt,
 	struct rrset_parse* rrset)
 {
-	if(priv->a.count == 0) 
-		return 0; /* there are no blocked addresses */
-
 	/* see if it is a private name, that is allowed to have any */
 	if(priv_lookup_name(priv, pkt, rrset->dname, rrset->dname_len,
 		ntohs(rrset->rrset_class))) {
 		return 0;
 	} else {
 		/* so its a public name, check the address */
+		struct sockaddr_storage addr;
 		socklen_t len;
 		struct rr_parse* rr;
 		if(rrset->type == LDNS_RR_TYPE_A) {
-			struct sockaddr_storage addr;
-			struct sockaddr_in sa;
-
-			len = (socklen_t)sizeof(sa);
-			memset(&sa, 0, len);
-			sa.sin_family = AF_INET;
-			sa.sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
+			struct sockaddr_in* sa = (struct sockaddr_in*)&addr;
+			len = (socklen_t)sizeof(*sa);
+			memset(sa, 0, len);
+			sa->sin_family = AF_INET;
+			sa->sin_port = (in_port_t)htons(UNBOUND_DNS_PORT);
 			for(rr = rrset->rr_first; rr; rr = rr->next) {
 				if(ldns_read_uint16(rr->ttl_data+4) 
 					!= INET_SIZE)
 					continue;
-				memmove(&sa.sin_addr, rr->ttl_data+4+2, 
+				memmove(&sa->sin_addr, rr->ttl_data+4+2, 
 					INET_SIZE);
-				memmove(&addr, &sa, len);
 				if(priv_lookup_addr(priv, &addr, len))
 					return 1;
 			}
 		} else if(rrset->type == LDNS_RR_TYPE_AAAA) {
-			struct sockaddr_storage addr;
-			struct sockaddr_in6 sa;
-			len = (socklen_t)sizeof(sa);
-			memset(&sa, 0, len);
-			sa.sin6_family = AF_INET6;
-			sa.sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
+			struct sockaddr_in6* sa = (struct sockaddr_in6*)&addr;
+			len = (socklen_t)sizeof(*sa);
+			memset(sa, 0, len);
+			sa->sin6_family = AF_INET6;
+			sa->sin6_port = (in_port_t)htons(UNBOUND_DNS_PORT);
 			for(rr = rrset->rr_first; rr; rr = rr->next) {
 				if(ldns_read_uint16(rr->ttl_data+4) 
 					!= INET6_SIZE)
 					continue;
-				memmove(&sa.sin6_addr, rr->ttl_data+4+2, 
+				memmove(&sa->sin6_addr, rr->ttl_data+4+2, 
 					INET6_SIZE);
-				memmove(&addr, &sa, len);
-				if(priv_lookup_addr(priv, &addr, len)) 
+				if(priv_lookup_addr(priv, &addr, len))
 					return 1;
 			}
 		} 
@@ -592,27 +592,21 @@ prime_root(struct module_qstate* qstate, struct iter_qstate* iq,
 * @param iq: iterator query state.
 * @param ie: iterator global state.
 * @param id: module id.
- * @param q: request name.
+ * @param qname: request name.
+ * @param qclass: the class to prime.
 * @return true if a priming subrequest was made, false if not. The will only
 *         issue a priming request if it detects an unprimed stub.
 */
 static int
 prime_stub(struct module_qstate* qstate, struct iter_qstate* iq, 
-	struct iter_env* ie, int id, struct query_info* q)
+	struct iter_env* ie, int id, uint8_t* qname, uint16_t qclass)
 {
 	/* Lookup the stub hint. This will return null if the stub doesn't 
 	 * need to be re-primed. */
-	struct iter_hints_stub* stub;
+	struct iter_hints_stub* stub = hints_lookup_stub(ie->hints, 
+		qname, qclass, iq->dp);
 	struct delegpt* stub_dp;
 	struct module_qstate* subq;
-	uint8_t* delname = q->qname;
-	size_t delnamelen = q->qname_len;
-
-	if(q->qtype == LDNS_RR_TYPE_DS && !dname_is_root(q->qname))
-		/* remove first label, but not for root */
-		dname_remove_label(&delname, &delnamelen);
-
-	stub = hints_lookup_stub(ie->hints, delname, q->qclass, iq->dp);
 	/* The stub (if there is one) does not need priming. */
 	if(!stub)
 		return 0;
@@ -629,18 +623,18 @@ prime_stub(struct module_qstate* qstate, struct iter_qstate* iq,
 			return 1; /* return 1 to make module stop, with error */
 		}
 		log_nametypeclass(VERB_DETAIL, "use stub", stub_dp->name, 
-			LDNS_RR_TYPE_NS, q->qclass);
+			LDNS_RR_TYPE_NS, qclass);
 		return 0;
 	}

 	/* Otherwise, we need to (re)prime the stub. */
 	log_nametypeclass(VERB_DETAIL, "priming stub", stub_dp->name, 
-		LDNS_RR_TYPE_NS, q->qclass);
+		LDNS_RR_TYPE_NS, qclass);

 	/* Stub priming events start at the QUERYTARGETS state to avoid the
 	 * redundant INIT state processing. */
 	if(!generate_sub_request(stub_dp->name, stub_dp->namelen, 
-		LDNS_RR_TYPE_NS, q->qclass, qstate, id, iq,
+		LDNS_RR_TYPE_NS, qclass, qstate, id, iq,
 		QUERYTARGETS_STATE, PRIME_RESP_STATE, &subq, 0)) {
 		verbose(VERB_ALGO, "could not prime stub");
 		(void)error_response(qstate, id, LDNS_RCODE_SERVFAIL);
@@ -787,14 +781,8 @@ generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id)
 static int
 forward_request(struct module_qstate* qstate, struct iter_qstate* iq)
 {
-	struct delegpt* dp;
-	uint8_t* delname = iq->qchase.qname;
-	size_t delnamelen = iq->qchase.qname_len;
-	/* strip one label off of DS query to lookup higher for it */
-	if(iq->qchase.qtype == LDNS_RR_TYPE_DS 
-		&& !dname_is_root(iq->qchase.qname))
-		dname_remove_label(&delname, &delnamelen);
-	dp = forwards_lookup(qstate->env->fwds, delname, iq->qchase.qclass);
+	struct delegpt* dp = forwards_lookup(qstate->env->fwds, 
+		iq->qchase.qname, iq->qchase.qclass);
 	if(!dp) 
 		return 0;
 	/* send recursion desired to forward addr */
@@ -1042,7 +1030,8 @@ processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq,
 		&qstate->qinfo);

 	/* Check to see if we need to prime a stub zone. */
-	if(prime_stub(qstate, iq, ie, id, &iq->qchase)) {
+	if(prime_stub(qstate, iq, ie, id, iq->qchase.qname, 
+		iq->qchase.qclass)) {
 		/* A priming sub request was made */
 		return 0;
 	}
@@ -1269,10 +1258,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}

 	tf_policy = 0;
-	/* < not <=, because although the array is large enough for <=, the
-	 * generated query will immediately be discarded due to depth and
-	 * that servfail is cached, which is not good as opportunism goes. */
-	if(iq->depth < ie->max_dependency_depth) {
+	if(iq->depth <= ie->max_dependency_depth) {
 		tf_policy = ie->target_fetch_policy[iq->depth];
 	}

@@ -1513,14 +1499,9 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			   /* we know that all other NS rrsets are scrubbed
 			    * away, thus on referral only one is left.
 			    * see if that equals the query name... */
-			&& ( /* auth section, but sometimes in answer section*/
-			  reply_find_rrset_section_ns(iq->response->rep,
+			&& reply_find_rrset_section_ns(iq->response->rep,
 				qstate->qinfo.qname, qstate->qinfo.qname_len,
 				LDNS_RR_TYPE_NS, qstate->qinfo.qclass)
-			  || reply_find_rrset_section_an(iq->response->rep,
-				qstate->qinfo.qname, qstate->qinfo.qname_len,
-				LDNS_RR_TYPE_NS, qstate->qinfo.qclass)
-			  )
 		    )) {
 			/* Store the referral under the current query */
 			if(!iter_dns_store(qstate->env, &iq->response->qinfo,
@@ -458,7 +458,8 @@ libworker_fillup_fg(struct ctx_query* q, int rcode, ldns_buffer* buf,
 	libworker_enter_result(q->res, buf, q->w->env->scratch, s);
 }

-void
+/** callback with fg results */
+static void
 libworker_fg_done_cb(void* arg, int rcode, ldns_buffer* buf, enum sec_status s)
 {
 	struct ctx_query* q = (struct ctx_query*)arg;
@@ -573,7 +574,8 @@ add_bg_result(struct libworker* w, struct ctx_query* q, ldns_buffer* pkt,
 	}
 }

-void
+/** callback with bg results */
+static void
 libworker_bg_done_cb(void* arg, int rcode, ldns_buffer* buf, enum sec_status s)
 {
 	struct ctx_query* q = (struct ctx_query*)arg;
@@ -156,14 +156,6 @@ void libworker_handle_control_cmd(struct tube* tube, uint8_t* msg, size_t len,
 void libworker_handle_result_write(struct tube* tube, uint8_t* msg, size_t len,
 	int err, void* arg);

-/** mesh callback with fg results */
-void libworker_fg_done_cb(void* arg, int rcode, ldns_buffer* buf, 
-	enum sec_status s);
-
-/** mesh callback with bg results */
-void libworker_bg_done_cb(void* arg, int rcode, ldns_buffer* buf, 
-	enum sec_status s);
-
 /** 
 * fill result from parsed message, on error fills servfail 
 * @param res: is clear at start, filled in at end.
@@ -42,27 +42,26 @@ help:

 .PHONY: testenv clean doc swig

-#_unbound.so:	../../Makefile
-	#$(MAKE) -C ../..
+_unbound.so:	../../Makefile
+	$(MAKE) -C ../..

-#../../.libs/libunbound.so.0:	../../Makefile
-	#$(MAKE) -C ../..
+../../.libs/libunbound.so.0:	../../Makefile
+	$(MAKE) -C ../..

-#../../ldns-src/lib/libldns.so:	../../ldns-src/Makefile
-	#$(MAKE) -C ../../ldns-src
+../../ldns-src/lib/libldns.so:	../../ldns-src/Makefile
+	$(MAKE) -C ../../ldns-src

 clean:
 	rm -rdf examples/unbound
 	rm -f _unbound.so libunbound_wrap.o
 	$(MAKE) -C ../.. clean

-testenv: ../../.libs/libunbound.so.1 ../../ldns-src/lib/libldns.so ../../.libs/_unbound.so
+testenv: ../../.libs/libunbound.so.0 ../../ldns-src/lib/libldns.so _unbound.so
 	rm -rdf examples/unbound
 	cd examples && mkdir unbound && ln -s ../../unbound.py unbound/__init__.py && ln -s ../../_unbound.so unbound/_unbound.so && ln -s ../../../../.libs/libunbound.so.1 unbound/libunbound.so.1 && ln -s ../../../../ldns-src/lib/libldns.so.1 unbound/libldns.so.1 && ls -la
-	cd examples && if test -f ../../../.libs/_unbound.so; then cp ../../../.libs/_unbound.so . ; fi
 	@echo "Run a script by typing ./script_name.py"
 	cd examples && LD_LIBRARY_PATH=unbound bash
-	rm -rdf examples/unbound examples/_unbound.so
+	rm -rdf examples/unbound

 doc: ../../.libs/libunbound.so.0 _unbound.so
 	$(MAKE) -C docs html
@@ -346,21 +346,8 @@ case $OSTYPE in
                sha256=`sha256  unbound-$version.tar.gz |  awk '{ print $5 }'`
                ;;
 	*)
-		# in case $OSTYPE is gone.
-		case `uname` in
-		Linux*)
-		  sha=`sha1sum unbound-$version.tar.gz |  awk '{ print $1 }'`
-		  sha256=`sha256sum unbound-$version.tar.gz |  awk '{ print $1 }'`
-		  ;;
-		FreeBSD*)
-		  sha=`sha1  unbound-$version.tar.gz |  awk '{ print $5 }'`
-		  sha256=`sha256  unbound-$version.tar.gz |  awk '{ print $5 }'`
-		  ;;
-		*)
-		  sha=`sha1sum unbound-$version.tar.gz |  awk '{ print $1 }'`
-		  sha256=`sha256sum unbound-$version.tar.gz |  awk '{ print $1 }'`
-		  ;;
-		esac
+                sha=`sha1sum unbound-$version.tar.gz |  awk '{ print $1 }'`
+                sha256=`sha256sum unbound-$version.tar.gz |  awk '{ print $1 }'`
                ;;
 esac
 echo $sha > unbound-$version.tar.gz.sha1
@@ -44,58 +44,11 @@
 #endif

 #include "config.h"
-
-#undef _POSIX_C_SOURCE
-#undef _XOPEN_SOURCE
-#include <Python.h>
-
 #include "pythonmod/pythonmod.h"
 #include "util/module.h"
 #include "util/config_file.h"
 #include "pythonmod_utils.h"
-
-#ifdef S_SPLINT_S
-typedef struct PyObject PyObject;
-#endif
-
-/**
- * Global state for the module. 
- */
-struct pythonmod_env {
-
-	/** Python script filename. */
-	const char* fname;
-
-	/** Python module. */
-	PyObject* module;
-
-	/** Module init function */
-	PyObject* func_init;
-	/** Module deinit function */
-	PyObject* func_deinit;
-	/** Module operate function */
-	PyObject* func_operate;
-	/** Module super_inform function */
-	PyObject* func_inform;
-
-	/** Python dictionary. */
-	PyObject* dict;
-
-	/** Module data. */
-	PyObject* data;
-
-	/** Module qstate. */
-	struct module_qstate* qstate;
-};
-
-/**
- * Per query state for the iterator module.
- */
-struct pythonmod_qstate {
-
-	/** Module per query data. */
-	PyObject* data;
-};
+#include <Python.h>

 /* Generated */
 #ifndef S_SPLINT_S
@@ -41,6 +41,51 @@
 #define PYTHONMOD_H
 #include "util/module.h"
 #include "services/outbound_list.h"
+#include <Python.h>
+
+struct PyObject;
+#if S_SPLINT_S
+typedef struct PyObject PyObject;
+#endif
+
+/**
+ * Global state for the module. 
+ */
+struct pythonmod_env {
+
+   /** Python script filename. */
+   const char* fname;
+
+   /** Python module. */
+   PyObject* module;
+
+   /** Module init function */
+   PyObject* func_init;
+   /** Module deinit function */
+   PyObject* func_deinit;
+   /** Module operate function */
+   PyObject* func_operate;
+   /** Module super_inform function */
+   PyObject* func_inform;
+
+   /** Python dictionary. */
+   PyObject* dict;
+
+   /** Module data. */
+   PyObject* data;
+
+   /** Module qstate. */
+   struct module_qstate* qstate;
+};
+
+/**
+ * Per query state for the iterator module.
+ */
+struct pythonmod_qstate {
+
+   /** Module per query data. */
+   PyObject* data;
+};

 /**
 * Get the module function block.
@@ -47,9 +47,6 @@
 #include "util/data/msgreply.h"
 #include "util/storage/slabhash.h"
 #include "util/regional.h"
-
-#undef _POSIX_C_SOURCE
-#undef _XOPEN_SOURCE
 #include <Python.h>

 /** Store the reply_info and query_info pair in message cache (qstate->msg_cache) */
@@ -40,7 +40,6 @@
 */
 #include "config.h"
 #include "iterator/iter_delegpt.h"
-#include "validator/val_nsec.h"
 #include "services/cache/dns.h"
 #include "services/cache/rrset.h"
 #include "util/data/msgreply.h"
@@ -287,10 +286,6 @@ find_add_ds(struct module_env* env, struct regional* region,
 		/* Note: the PACKED_RRSET_NSEC_AT_APEX flag is not used.
 		 * since this is a referral, we need the NSEC at the parent
 		 * side of the zone cut, not the NSEC at apex side. */
-		if(rrset && nsec_has_type(rrset, LDNS_RR_TYPE_DS)) {
-			lock_rw_unlock(&rrset->entry.lock);
-			rrset = NULL; /* discard wrong NSEC */
-		}
 	}
 	if(rrset) {
 		/* add it to auth section. This is the second rrset. */
@@ -440,18 +435,6 @@ tomsg(struct module_env* env, struct msgreply_entry* e, struct reply_info* r,
        msg->rep->authoritative = r->authoritative;
 	if(!rrset_array_lock(r->ref, r->rrset_count, now))
 		return NULL;
-	if(r->an_numrrsets > 0 && (r->rrsets[0]->rk.type == htons(
-		LDNS_RR_TYPE_CNAME) || r->rrsets[0]->rk.type == htons(
-		LDNS_RR_TYPE_DNAME)) && !reply_check_cname_chain(r)) {
-		/* cname chain is now invalid, reconstruct msg */
-		rrset_array_unlock(r->ref, r->rrset_count);
-		return NULL;
-	}
-	if(r->security == sec_status_secure && !reply_all_rrsets_secure(r)) {
-		/* message rrsets have changed status, revalidate */
-		rrset_array_unlock(r->ref, r->rrset_count);
-		return NULL;
-	}
 	for(i=0; i<msg->rep->rrset_count; i++) {
 		msg->rep->rrsets[i] = packed_rrset_copy_region(r->rrsets[i], 
 			region, now);
@@ -92,15 +92,11 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
        socklen_t addrlen, int v6only, int* inuse, int* noproto)
 {
 	int s;
-#if defined(IPV6_USE_MIN_MTU)
+# if defined(IPV6_USE_MIN_MTU)
 	int on=1;
-#endif
-#ifdef IPV6_MTU
-	int mtu = IPV6_MIN_MTU;
-#endif
-#ifndef IPV6_V6ONLY
+# else
 	(void)v6only;
-#endif
+# endif
 	if((s = socket(family, socktype, 0)) == -1) {
 		*inuse = 0;
 #ifndef USE_WINSOCK
@@ -154,42 +150,21 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		 */
 		if (setsockopt(s, IPPROTO_IPV6, IPV6_USE_MIN_MTU,
 			(void*)&on, (socklen_t)sizeof(on)) < 0) {
-#  ifndef USE_WINSOCK
+#ifndef USE_WINSOCK
 			log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
 				"...) failed: %s", strerror(errno));
 			close(s);
-#  else
+#else
 			log_err("setsockopt(..., IPV6_USE_MIN_MTU, "
 				"...) failed: %s", 
 				wsa_strerror(WSAGetLastError()));
 			closesocket(s);
-#  endif
+#endif
 			*noproto = 0;
 			*inuse = 0;
 			return -1;
 		}
-# elif defined(IPV6_MTU)
-		/*
-		 * On Linux, to send no larger than 1280, the PMTUD is
-		 * disabled by default for datagrams anyway, so we set
-		 * the MTU to use.
-		 */
-		if (setsockopt(s, IPPROTO_IPV6, IPV6_MTU,
-			(void*)&mtu, (socklen_t)sizeof(mtu)) < 0) {
-#  ifndef USE_WINSOCK
-			log_err("setsockopt(..., IPV6_MTU, ...) failed: %s", 
-				strerror(errno));
-			close(s);
-#  else
-			log_err("setsockopt(..., IPV6_MTU, ...) failed: %s", 
-				wsa_strerror(WSAGetLastError()));
-			closesocket(s);
-#  endif
-			*noproto = 0;
-			*inuse = 0;
-			return -1;
-		}
-# endif /* IPv6 MTU */
+# endif
 	}
 	if(bind(s, (struct sockaddr*)addr, addrlen) != 0) {
 		*noproto = 0;
@@ -465,15 +465,9 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	/* drop unsent replies */
 	if(!mstate->replies_sent) {
 		struct mesh_reply* rep;
-		struct mesh_cb* cb;
 		for(rep=mstate->reply_list; rep; rep=rep->next) {
 			comm_point_drop_reply(&rep->query_reply);
 		}
-		for(cb=mstate->cb_list; cb; cb=cb->next) {
-			fptr_ok(fptr_whitelist_mesh_cb(cb->cb));
-			(*cb->cb)(cb->cb_arg, LDNS_RCODE_SERVFAIL, NULL,
-				sec_status_unchecked);
-		}
 	}

 	/* de-init modules */
@@ -624,7 +618,6 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 		rcode = LDNS_RCODE_SERVFAIL;
 	/* send the reply */
 	if(rcode) {
-		fptr_ok(fptr_whitelist_mesh_cb(r->cb));
 		(*r->cb)(r->cb_arg, rcode, r->buf, sec_status_unchecked);
 	} else {
 		size_t udp_size = r->edns.udp_size;
@@ -638,14 +631,11 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 			m->s.env->scratch, udp_size, &r->edns, 
 			(int)(r->edns.bits & EDNS_DO), secure)) 
 		{
-			fptr_ok(fptr_whitelist_mesh_cb(r->cb));
 			(*r->cb)(r->cb_arg, LDNS_RCODE_SERVFAIL, r->buf,
 				sec_status_unchecked);
-		} else {
-			fptr_ok(fptr_whitelist_mesh_cb(r->cb));
-			(*r->cb)(r->cb_arg, LDNS_RCODE_NOERROR, r->buf,
-				rep->security);
 		}
+		else	(*r->cb)(r->cb_arg, LDNS_RCODE_NOERROR, r->buf,
+				rep->security);
 	}
 	m->s.env->mesh->num_reply_addrs--;
 }
@@ -790,7 +780,6 @@ int mesh_state_add_cb(struct mesh_state* s, struct edns_data* edns,
 	if(!r)
 		return 0;
 	r->buf = buf;
-	log_assert(fptr_whitelist_mesh_cb(cb)); /* early failure ifmissing*/
 	r->cb = cb;
 	r->cb_arg = cb_arg;
 	r->edns = *edns;
@@ -226,7 +226,7 @@ struct mesh_cb {
 	ldns_buffer* buf;

 	/** callback routine for results. if rcode != 0 buf has message.
-	 * called as cb(cb_arg, rcode, buf, sec_state);
+	 * called as cb(cb_arg, rcode, buf);
 	 */
 	mesh_cb_func_t cb;
 	/** user arg for callback */
@@ -1234,8 +1234,7 @@ serviced_udp_send(struct serviced_query* sq, ldns_buffer* buff)
 		&edns_lame_known, &rtt))
 		return 0;
 	if(sq->status == serviced_initial) {
-		if((vs != -1 || edns_lame_known == 0) && 
-			rtt > 5000 && rtt < 10001) {
+		if(edns_lame_known == 0 && rtt > 5000) {
 			/* perform EDNS lame probe - check if server is
 			 * EDNS lame (EDNS queries to it are dropped) */
 			verbose(VERB_ALGO, "serviced query: send probe to see "
@@ -42,7 +42,6 @@
 */
 #include "config.h"
 #include "util/log.h"
-#include "services/mesh.h"
 struct comm_reply;
 struct comm_point;
 struct module_qstate;
@@ -181,18 +180,6 @@ void libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
        log_assert(0);
 }

-void libworker_fg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode), 
-	ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s))
-{
-	log_assert(0);
-}
-
-void libworker_bg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode), 
-	ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s))
-{
-	log_assert(0);
-}
-
 int context_query_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 {
 	log_assert(0);
@@ -287,7 +287,7 @@ struct listen_port* daemon_remote_open_ports(struct config_file*
 	return NULL;
 }

-struct daemon_remote* daemon_remote_create(struct config_file* ATTR_UNUSED(cfg))
+struct daemon_remote* daemon_remote_create(struct worker* ATTR_UNUSED(worker))
 {
 	return (struct daemon_remote*)calloc(1,1);
 }
@@ -297,14 +297,8 @@ void daemon_remote_delete(struct daemon_remote* rc)
 	free(rc);
 }

-void daemon_remote_clear(struct daemon_remote* ATTR_UNUSED(rc))
-{
-	/* nothing */
-}
-
 int daemon_remote_open_accept(struct daemon_remote* ATTR_UNUSED(rc),
-        struct listen_port* ATTR_UNUSED(ports), 
-	struct worker* ATTR_UNUSED(worker))
+        struct listen_port* ATTR_UNUSED(ports))
 {
 	return 1;
 }
@@ -1,307 +0,0 @@
-; config options
-; The island of trust is at example.com (the DLV repository)
-server:
-	dlv-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	harden-referral-path: no
-	target-fetch-policy: "0 0 0 0 0"
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with insecure zone, no DLV from negative cache
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN A
-SECTION AUTHORITY
-net.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 300
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN A
-SECTION AUTHORITY
-example.net.	IN NS	ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.		IN 	A	1.2.3.5
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; DLV query
-; could be picked out of the negative cache due to NS queries in between.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-www.example.net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-zoink.name.example.com IN NSEC zazz.net.example.com. RRSIG NSEC DLV
-zoink.name.example.com. 3600    IN      RRSIG   NSEC 3 4 3600 20070926134150 20070829134150 2854 example.com. AHipxvshRHglCEN4nZCT4m/4RIj8TrCOE2AsqEoH9e+6OYSo+yuNzzo= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-net.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-zoink.name.example.com IN NSEC zazz.net.example.com. RRSIG NSEC DLV
-zoink.name.example.com. 3600    IN      RRSIG   NSEC 3 4 3600 20070926134150 20070829134150 2854 example.com. AHipxvshRHglCEN4nZCT4m/4RIj8TrCOE2AsqEoH9e+6OYSo+yuNzzo= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC frump.aqua.example.com. SOA NS RRSIG NSEC DNSKEY
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AAscY9DfNm3Uy8f8Q4WX6AzR0flHYNSr3fKfgQ0Xc20fzj1lGP9ebfk= ;{id = 2854}
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-com.example.com. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-example.com. IN SOA open.nlnetlabs.nl. hostmaster.nlnetlabs.nl. 2008081300 28800 7200 604800 3600
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AKPJnPBqfJKxE4P2iVYkSRJno9HmiXJZtjdqE8oBeq9Lk9FytcMdcig= ;{id = 2854}
-example.com IN NSEC zazz.example.com. SOA NS RRSIG NSEC
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926135752 20070829135752 2854 example.com. AAi21jQpno6gXnrPrtK0NvNgX9B8E9U5RvTd47QiCWLF7KdtKxB7Xz0= ;{id = 2854}
-ENTRY_END
-
-RANGE_END
-
-; ns.example.net.
-RANGE_BEGIN 0 300
-	ADDRESS 1.2.3.5
-; NS query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.net. IN NS
-SECTION ANSWER
-example.net.    IN NS   ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ENTRY_END
-
-; www.example.net query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	10	IN	A	10.20.30.40
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ENTRY_END
-
-
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	10	IN	A	10.20.30.40
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ENTRY_END
-
-STEP 150 TIME_PASSES ELAPSE 30
-
-; no more DLV authority reachable
-STEP 200 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.net. IN A
-ENTRY_END
-
-STEP 210 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.net. IN A
-SECTION ANSWER
-www.example.net.	10	IN	A	10.20.30.40
-SECTION AUTHORITY
-example.net.    IN NS   ns.example.net.
-SECTION ADDITIONAL
-ns.example.net.         IN      A       1.2.3.5
-ENTRY_END
-
-STEP 220 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-net. IN NS
-ENTRY_END
-
-STEP 230 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-net. IN NS
-SECTION ANSWER
-net.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-SCENARIO_END
@@ -1,131 +0,0 @@
-; config options
-; The island of trust is at example.com
-server:
-	trust-anchor: "dlv.isc.org. 5072    IN      DNSKEY  256 3 5 BEAAAAOlYGw53D+f01yCL5JsP0SB6EjYrnd0JYRBooAaGPT+Q0kpiN+7GviFh+nIazoB8e2Yv7mupgqkmIjObdcbGstYpUltdECdNpNmBvASKB9SBdtGeRvXXpORi3Qyxb9kHGG7SpzyYbc+KDVKnzYHB94pvqu3ZZpPFPBFtCibp/mkhw=="
-	val-override-date: "20090617133009"
-	target-fetch-policy: "0 0 0 0 0"
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test parse of packet when forwarding and dlv are in use
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-org. IN NS
-SECTION AUTHORITY
-org.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net. (for ORG)
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-org. IN NS
-SECTION ANSWER
-org.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-dlv.isc.org. IN NS
-SECTION AUTHORITY
-dlv.isc.org. IN NS ns.org.
-SECTION ADDITIONAL
-ns.org.	IN A 1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.org for dlv.isc.org
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-dlv.isc.org.	IN	DNSKEY
-SECTION ANSWER
-dlv.isc.org.	5072	IN	DNSKEY	256 3 5 BEAAAAOlYGw53D+f01yCL5JsP0SB6EjYrnd0JYRBooAaGPT+Q0kpiN+7GviFh+nIazoB8e2Yv7mupgqkmIjObdcbGstYpUltdECdNpNmBvASKB9SBdtGeRvXXpORi3Qyxb9kHGG7SpzyYbc+KDVKnzYHB94pvqu3ZZpPFPBFtCibp/mkhw== ;{id = 64263 (zsk), size = 1024b}
-dlv.isc.org.	5072	IN	DNSKEY	257 3 5 BEAAAAPHMu/5onzrEE7z1egmhg/WPO0+juoZrW3euWEn4MxDCE1+lLy2brhQv5rN32RKtMzX6Mj70jdzeND4XknW58dnJNPCxn8+jAGl2FZLK8t+1uq4W+nnA3qO2+DL+k6BD4mewMLbIYFwe0PG73Te9fZ2kJb56dhgMde5ymX4BI/oQ+cAK50/xvJv00Frf8kw6ucMTwFlgPe+jnGxPPEmHAte/URkY62ZfkLoBAADLHQ9IrS2tryAe7mbBZVcOwIeU/Rw/mRx/vwwMCTgNboMQKtUdvNXDrYJDSHZws3xiRXF1Rf+al9UmZfSav/4NWLKjHzpT59k/VStTDN0YUuWrBNh ;{id = 19297 (ksk), size = 2048b}
-dlv.isc.org.	5072	IN	RRSIG	DNSKEY 5 3 7200 20090717133009 20090617133009 19297 dlv.isc.org. iqGOzsIQKFHcPLbJHLb/kNzcm7TlHiyT4kzTknCjKsC7DCB86YCOhnZZjvZQyA+D0N0KDgNWY8v5czbyX57qR6qORciT2zmPSTGj7CIOe4zrq60n8HzsChKgvk+RSYQrzf6vRfnZhce6Y1waXQd4wh1buPAUw/l46Ovt74ALXzcWSgfMNyx6PBz7rbusuePKeSv0GZL9+M2qhXKe9LJmnzD9uCwnbV/Y5yu+xLfxLdm9q4IKp6Rn50CeHYKf3tO2jI9dkWqFR94XHSTNGfhC02i5UsfP1HRPnk49bX7OMstuuCq9zMX+qTt602MVFYdTSHTy/5+Yw5DvOA9JgOqO4w== ;{id = 19297}
-dlv.isc.org.	5072	IN	RRSIG	DNSKEY 5 3 7200 20090717133009 20090617133009 64263 dlv.isc.org. W1KX1PagXsaWWmxkaOfnLetnw1hhSw7ym91S4rSu14QfFbYi5iN9ZkSuKa21M7Do52S9om/2hDllMF7EFfnv9l4e4/rMOc59vKGVojpHOvZyRVhIiMyh1H9NfLTYUovORRvKO0Cnp65gBXspVf1WhzoY3pC1NZ+5pscPWLeD1rw= ;{id = 64263}
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NXDOMAIN
-SECTION QUESTION
-www.example.com.dlv.isc.org.	IN	DLV
-SECTION ANSWER
-SECTION AUTHORITY
-dlv.isc.org.	2776	IN	SOA	ns-int.isc.org. hostmaster.isc.org. 2009061702 7200 3600 2419200 3600
-dlv.isc.org.	2776	IN	RRSIG	SOA 5 3 3600 20090717133009 20090617133009 64263 dlv.isc.org. S5iTFqF8k9XWoGq4Wajo1GQF6Oc1e5lI1kGFWyaKf3oM2asbzCbVk2aZLtyDCGjYA4euZWXD0q2vol7/1cPB5Ds4SteCuo5Jkpa/mw7mPAcbNu8mYexq1RaodVCbWrW8KSxEyVd8X5mZx2OBaSyK8zns/W5I3ZPNNLf4Kz6Zpo0= ;{id = 64263}
-seatex.com.cn.dlv.isc.org.	2776	IN	RRSIG	NSEC 5 6 3600 20090717133009 20090617133009 64263 dlv.isc.org. Rxv7gVdu8rpWbJ3fJm7cY66IKV+C94I4/HYiDQke1m2P7hXo5bpDBBShKpIvME34ANN8Lb0cZQK9XT7NYpWjE5rjW7CaMiVjiR6U1LyDGQyK4X3wdkbv3aJcHLSg7sWsxyZXj5iVUxkU5JO3JBjo412oKQ3bh+RGi1BxTIIq09g= ;{id = 64263}
-seatex.com.cn.dlv.isc.org.	2776	IN	NSEC	absolight.com.dlv.isc.org. RRSIG NSEC DLV 
-ericgermann.com.dlv.isc.org.	2776	IN	RRSIG	NSEC 5 5 3600 20090717133009 20090617133009 64263 dlv.isc.org. OEUizWAXsWFBzt4rN5+AUTaND8phZc4ezux06LA/Ua5N/B/LQQ1cb42eEqCQHwnGK8BsRhbsRiVywPNgnnPlL1Gy8n25gi+0qWOpA27fOwZJbO3n944gKvPDWZoDeCbdJr6AQG5Z9/Ka0ERRtHC6uI2Xn6KCQPjgTEihqhoayYg= ;{id = 64263}
-ericgermann.com.dlv.isc.org.	2776	IN	NSEC	fayengineering.com.dlv.isc.org. RRSIG NSEC DLV 
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com.dlv.isc.org. IN DLV
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD NXDOMAIN
-SECTION QUESTION
-www.example.com.dlv.isc.org. IN DLV
-SECTION ANSWER
-SECTION AUTHORITY
-dlv.isc.org.    2776    IN      SOA     ns-int.isc.org. hostmaster.isc.org. 2009061702 7200 3600 2419200 3600
-dlv.isc.org.    2776    IN      RRSIG   SOA 5 3 3600 20090717133009 20090617133009 64263 dlv.isc.org. S5iTFqF8k9XWoGq4Wajo1GQF6Oc1e5lI1kGFWyaKf3oM2asbzCbVk2aZLtyDCGjYA4euZWXD0q2vol7/1cPB5Ds4SteCuo5Jkpa/mw7mPAcbNu8mYexq1RaodVCbWrW8KSxEyVd8X5mZx2OBaSyK8zns/W5I3ZPNNLf4Kz6Zpo0= ;{id = 64263}
-seatex.com.cn.dlv.isc.org.      2776    IN      NSEC    absolight.com.dlv.isc.org. RRSIG NSEC DLV
-seatex.com.cn.dlv.isc.org.      2776    IN      RRSIG   NSEC 5 6 3600 20090717133009 20090617133009 64263 dlv.isc.org. Rxv7gVdu8rpWbJ3fJm7cY66IKV+C94I4/HYiDQke1m2P7hXo5bpDBBShKpIvME34ANN8Lb0cZQK9XT7NYpWjE5rjW7CaMiVjiR6U1LyDGQyK4X3wdkbv3aJcHLSg7sWsxyZXj5iVUxkU5JO3JBjo412oKQ3bh+RGi1BxTIIq09g= ;{id = 64263}
-ericgermann.com.dlv.isc.org.    2776    IN      NSEC    fayengineering.com.dlv.isc.org. RRSIG NSEC DLV
-ericgermann.com.dlv.isc.org.    2776    IN      RRSIG   NSEC 5 5 3600 20090717133009 20090617133009 64263 dlv.isc.org. OEUizWAXsWFBzt4rN5+AUTaND8phZc4ezux06LA/Ua5N/B/LQQ1cb42eEqCQHwnGK8BsRhbsRiVywPNgnnPlL1Gy8n25gi+0qWOpA27fOwZJbO3n944gKvPDWZoDeCbdJr6AQG5Z9/Ka0ERRtHC6uI2Xn6KCQPjgTEihqhoayYg= ;{id = 64263}
-ENTRY_END
-
-SCENARIO_END
@@ -1,218 +0,0 @@
-; config options
-server:
-	target-fetch-policy: "0 0 0 0 0"
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-forward-zone:
-	name: "example.com"
-	forward-addr: 10.0.0.1
-stub-zone:
-	name: "sub.example.com"
-	stub-addr: 10.0.0.2
-CONFIG_END
-
-SCENARIO_BEGIN Test iterative resolve with a stub under a forward zone
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; forwarder for example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 10.0.0.1
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.0.0.4
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-; fail all other queries
-ENTRY_BEGIN
-MATCH opcode 
-ADJUST copy_id copy_query
-REPLY QR SERVFAIL
-SECTION QUESTION
-example.com. IN A
-ENTRY_END
-RANGE_END
-
-; stub for sub.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 10.0.0.2
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN NS
-SECTION ANSWER
-sub.example.com.	IN NS	ns.sub.example.com.
-SECTION ADDITIONAL
-ns.sub.example.com.		IN 	A	1.2.3.44
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.sub.example.com. IN A
-SECTION ANSWER
-www.sub.example.com. IN A	10.0.0.5
-SECTION AUTHORITY
-sub.example.com.	IN NS	ns.sub.example.com.
-SECTION ADDITIONAL
-ns.sub.example.com.		IN 	A	1.2.3.44
-ENTRY_END
-RANGE_END
-
-
-; check if forwarder is honored
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.0.0.4
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-
-; try to resolve from stub zone
-STEP 20 QUERY
-ENTRY_BEGIN
-REPLY RD
-SECTION QUESTION
-www.sub.example.com. IN A
-ENTRY_END
-
-STEP 30 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA NOERROR
-SECTION QUESTION
-www.sub.example.com. IN A
-SECTION ANSWER
-www.sub.example.com. IN A	10.0.0.5
-SECTION AUTHORITY
-sub.example.com.	IN NS	ns.sub.example.com.
-SECTION ADDITIONAL
-ns.sub.example.com.		IN 	A	1.2.3.44
-ENTRY_END
-
-SCENARIO_END
@@ -15,7 +15,7 @@ ENTRY_END
 ; entry to test
 ENTRY_BEGIN
 SECTION QUESTION
-secure.example.com.       IN      SOA
+bogus.example.com.       IN      SOA
 SECTION ANSWER
 example.com.  43200   IN      SOA     home.kuroiwa.eng.br. hostmaster.cesar.sec3.br. 2008040903 86400 86400 8640000 600
 example.com.	43200	IN	RRSIG	SOA 5 2 43200 20081010000000 20080410122550 31027 example.com. af7nqRak6cEeQLytqLHMIUKPsOECA4Cu/Zpm7vdnKSh2q2+/8ZwIxwHLyCEGdiu/mTYffZEHTZytJyzxnB0oxA== ;{id = 31027}
@@ -1,258 +0,0 @@
-; config options
-; The island of trust is at example.com
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test pickup of DS NSEC from the cache.
-; make sure unbound does not pick up the wrong nsec.
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response for   tub.example.com
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NXDOMAIN
-SECTION QUESTION
-tub.example.com. IN DNSKEY
-SECTION ANSWER
-SECTION AUTHORITY
-; SOA record
-example.com IN SOA ns.iana.org. NSTLD.iana.org. 2009061200 1800 900 604800 86400
-example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AAvpEruGS0UJzMoO6ou/+y8ZyHjjrFC6HKDWU8a61Ru9qtl4R66fC1c= ;{id = 2854}
-; qname denial
-sub.example.com. IN	NSEC wub.example.com. NS DS RRSIG NSEC
-sub.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. AA4+SSCI8kQZ2/iGj+9rxpNZyaIJNNRZ4eM0fEw2D5fVR/+WLUZ9GdE= ;{id = 2854}
-; wildcard denial
-example.com. IN NSEC blub.example.com. NS SOA RRSIG NSEC DNSKEY
-example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AARheDFiRjrnKHzsPloUJ0FC+8aAM6H49Lnm2AJrgxE9RlBlH2E4sRo= ;{id = 2854}
-SECTION ADDITIONAL
-ENTRY_END
-
-; DS query for sub.example.com
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN DS
-SECTION ANSWER
-sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-; response for delegation to sub.example.com.
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN DNSKEY
-SECTION ANSWER
-SECTION AUTHORITY
-sub.example.com. IN	NS ns.sub.example.com.
-;sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-;sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ENTRY_END
-RANGE_END
-
-; ns.sub.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.6
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN NS
-SECTION ANSWER
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
-ENTRY_END
-
-; response to DNSKEY priming query
-; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN DNSKEY
-SECTION ANSWER
-sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.sub.example.com. IN A
-SECTION ANSWER
-www.sub.example.com. IN A	11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-; query for a domain next to it, so the wrong NSEC gets in the cache.
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.tub.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD NXDOMAIN
-SECTION QUESTION
-www.tub.example.com. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-example.com.    3600    IN      SOA     ns.iana.org. NSTLD.iana.org. 2009061200 1800 900 604800 86400
-example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. AAvpEruGS0UJzMoO6ou/+y8ZyHjjrFC6HKDWU8a61Ru9qtl4R66fC1c= ;{id = 2854}
-sub.example.com.        3600    IN      NSEC    wub.example.com. NS DS RRSIG NSEC 
-sub.example.com.        3600    IN      RRSIG   NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. AA4+SSCI8kQZ2/iGj+9rxpNZyaIJNNRZ4eM0fEw2D5fVR/+WLUZ9GdE= ;{id = 2854}
-example.com.    3600    IN      NSEC    blub.example.com. NS SOA RRSIG NSEC DNSKEY 
-example.com.    3600    IN      RRSIG   NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AARheDFiRjrnKHzsPloUJ0FC+8aAM6H49Lnm2AJrgxE9RlBlH2E4sRo= ;{id = 2854}
-SECTION ADDITIONAL
-ENTRY_END
-
-; query of interest.
-STEP 30 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.sub.example.com. IN A
-ENTRY_END
-
-STEP 40 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD NOERROR
-SECTION QUESTION
-www.sub.example.com. IN A
-SECTION ANSWER
-www.sub.example.com. 	3600	IN	A	11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-
-SCENARIO_END
@@ -1,457 +0,0 @@
-; config options
-; The island of trust is at example.com
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-forward-zone:
-	name: "sub.example.com"
-	forward-addr: 1.2.3.6
-CONFIG_END
-
-SCENARIO_BEGIN Test forward-zone with DS query
-; The fwd zone is linked validly with a DS to the public internet zone.
-; unbound just has to be able to ask the DS from the right server (not 
-; from the fwd).
-; Here the fwd is not even recursive, just the plain server for sub.example.com
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response for DS of sub.example.com.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN DS
-SECTION ANSWER
-sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-; response for delegation to sub.example.com.
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ENTRY_END
-
-RANGE_END
-
-; ns.sub.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.6
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN NS
-SECTION ANSWER
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
-ENTRY_END
-
-; response to DNSKEY priming query
-; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN DNSKEY
-SECTION ANSWER
-sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
-ENTRY_END
-
-; response for qtype DS.  This is not available here.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR SERVFAIL
-SECTION QUESTION
-sub.example.com. IN DS
-SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.sub.example.com. IN A
-SECTION ANSWER
-www.sub.example.com. IN A	11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.sub.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD NOERROR
-SECTION QUESTION
-www.sub.example.com. IN A
-SECTION ANSWER
-www.sub.example.com. 	3600	IN	A	11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-SCENARIO_END
-; config options
-; The island of trust is at example.com
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-stub-zone:
-	name: "sub.example.com"
-	stub-addr: 1.2.3.6
-CONFIG_END
-
-SCENARIO_BEGIN Test stub with DS query
-; The stub zone is linked validly with a DS to the public internet zone.
-; unbound just has to be able to ask the DS from the right server (not 
-; from the stub).
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response for DS of sub.example.com.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN DS
-SECTION ANSWER
-sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-; response for delegation to sub.example.com.
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ENTRY_END
-
-RANGE_END
-
-; ns.sub.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.6
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN NS
-SECTION ANSWER
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
-ENTRY_END
-
-; response to DNSKEY priming query
-; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN DNSKEY
-SECTION ANSWER
-sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
-ENTRY_END
-
-; response for qtype DS.  This is not available here.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR SERVFAIL
-SECTION QUESTION
-sub.example.com. IN DS
-SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.sub.example.com. IN A
-SECTION ANSWER
-www.sub.example.com. IN A	11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.sub.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD NOERROR
-SECTION QUESTION
-www.sub.example.com. IN A
-SECTION ANSWER
-www.sub.example.com. 	3600	IN	A	11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-SCENARIO_END
@@ -1,148 +0,0 @@
-; config options
-; The island of trust is at example.com
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-CONFIG_END
-
-SCENARIO_BEGIN Test validator with badly truncated positive response
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-
-; Truncated, no signature for NS record.
-;;;example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-;;;SECTION ADDITIONAL
-;;;ns.example.com.		IN 	A	1.2.3.4
-;;;ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD NOERROR
-SECTION QUESTION
-www.example.com. IN A
-SECTION ANSWER
-www.example.com. IN A	10.20.30.40
-www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-SCENARIO_END
@@ -1,456 +0,0 @@
-; config options
-; The island of trust is at example.com
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-stub-zone:
-	name: "sub.example.com"
-	stub-addr: 1.2.3.6
-CONFIG_END
-
-SCENARIO_BEGIN Test stub with DS query
-; The stub zone is linked validly with a DS to the public internet zone.
-; unbound just has to be able to ask the DS from the right server (not 
-; from the stub).
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response for DS of sub.example.com.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN DS
-SECTION ANSWER
-sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-; response for delegation to sub.example.com.
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ENTRY_END
-
-RANGE_END
-
-; ns.sub.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.6
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN NS
-SECTION ANSWER
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
-ENTRY_END
-
-; response to DNSKEY priming query
-; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN DNSKEY
-SECTION ANSWER
-sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
-ENTRY_END
-
-; response for qtype DS.  This is not available here.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR SERVFAIL
-SECTION QUESTION
-sub.example.com. IN DS
-SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.sub.example.com. IN A
-SECTION ANSWER
-www.sub.example.com. IN A	11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.sub.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD NOERROR
-SECTION QUESTION
-www.sub.example.com. IN A
-SECTION ANSWER
-www.sub.example.com. 	3600	IN	A	11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-SCENARIO_END
-; config options
-; The island of trust is at example.com
-server:
-	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
-	val-override-date: "20070916134226"
-	target-fetch-policy: "0 0 0 0 0"
-
-stub-zone:
-	name: "."
-	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
-stub-zone:
-	name: "sub.example.com"
-	stub-addr: 1.2.3.6
-CONFIG_END
-
-SCENARIO_BEGIN Test stub with DS query
-; The stub zone is linked validly with a DS to the public internet zone.
-; unbound just has to be able to ask the DS from the right server (not 
-; from the stub).
-
-; K.ROOT-SERVERS.NET.
-RANGE_BEGIN 0 100
-	ADDRESS 193.0.14.129 
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-. IN NS
-SECTION ANSWER
-. IN NS	K.ROOT-SERVERS.NET.
-SECTION ADDITIONAL
-K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION AUTHORITY
-com.	IN NS	a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.	IN 	A	192.5.6.30
-ENTRY_END
-RANGE_END
-
-; a.gtld-servers.net.
-RANGE_BEGIN 0 100
-	ADDRESS 192.5.6.30
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-com. IN NS
-SECTION ANSWER
-com.    IN NS   a.gtld-servers.net.
-SECTION ADDITIONAL
-a.gtld-servers.net.     IN      A       192.5.6.30
-ENTRY_END
-
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN A
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ENTRY_END
-RANGE_END
-
-; ns.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.4
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN NS
-SECTION ANSWER
-example.com.    IN NS   ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.         IN      A       1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response to DNSKEY priming query
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-example.com. IN DNSKEY
-SECTION ANSWER
-example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
-example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
-SECTION AUTHORITY
-example.com.	IN NS	ns.example.com.
-example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
-SECTION ADDITIONAL
-ns.example.com.		IN 	A	1.2.3.4
-ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
-ENTRY_END
-
-; response for DS of sub.example.com.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN DS
-SECTION ANSWER
-sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-; response for delegation to sub.example.com.
-ENTRY_BEGIN
-MATCH opcode subdomain
-ADJUST copy_id copy_query
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN A
-SECTION ANSWER
-SECTION AUTHORITY
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ENTRY_END
-
-RANGE_END
-
-; ns.sub.example.com.
-RANGE_BEGIN 0 100
-	ADDRESS 1.2.3.6
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN NS
-SECTION ANSWER
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
-ENTRY_END
-
-; response to DNSKEY priming query
-; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-sub.example.com. IN DNSKEY
-SECTION ANSWER
-sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
-sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
-SECTION AUTHORITY
-sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
-SECTION ADDITIONAL
-ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
-ENTRY_END
-
-; response for qtype DS.  This is not available here.
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR SERVFAIL
-SECTION QUESTION
-sub.example.com. IN DS
-SECTION ANSWER
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-; response to query of interest
-ENTRY_BEGIN
-MATCH opcode qtype qname
-ADJUST copy_id
-REPLY QR NOERROR
-SECTION QUESTION
-www.sub.example.com. IN A
-SECTION ANSWER
-www.sub.example.com. IN A	11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-RANGE_END
-
-STEP 1 QUERY
-ENTRY_BEGIN
-REPLY RD DO
-SECTION QUESTION
-www.sub.example.com. IN A
-ENTRY_END
-
-; recursion happens here.
-STEP 10 CHECK_ANSWER
-ENTRY_BEGIN
-MATCH all
-REPLY QR RD RA AD NOERROR
-SECTION QUESTION
-www.sub.example.com. IN A
-SECTION ANSWER
-www.sub.example.com. 	3600	IN	A	11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
-SECTION AUTHORITY
-SECTION ADDITIONAL
-ENTRY_END
-
-SCENARIO_END
@@ -1034,7 +1034,7 @@ char* cfg_ptr_reverse(char* str)
 	 * IPv6: (h.){32}.ip6.arpa.  */

 	if(addr_is_ip6(&addr, addrlen)) {
-		void* ad = &((struct sockaddr_in6*)&addr)->sin6_addr;
+		struct in6_addr* ad = &((struct sockaddr_in6*)&addr)->sin6_addr;
 		const char* hex = "0123456789abcdef";
 		char *p = buf;
 		int i;
@@ -1,23 +1,24 @@
-
-/* A Bison parser, made by GNU Bison 2.4.1.  */
+/* A Bison parser, made by GNU Bison 2.3.  */

 /* Skeleton interface for Bison's Yacc-like parsers in C
-   
-      Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
+
+   Copyright (C) 1984, 1989, 1990, 2000, 2001, 2002, 2003, 2004, 2005, 2006
   Free Software Foundation, Inc.
-   
-   This program is free software: you can redistribute it and/or modify
+
+   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation, either version 3 of the License, or
-   (at your option) any later version.
-   
+   the Free Software Foundation; either version 2, or (at your option)
+   any later version.
+
   This program is distributed in the hope that it will be useful,
   but WITHOUT ANY WARRANTY; without even the implied warranty of
   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
   GNU General Public License for more details.
-   
+
   You should have received a copy of the GNU General Public License
-   along with this program.  If not, see <http://www.gnu.org/licenses/>.  */
+   along with this program; if not, write to the Free Software
+   Foundation, Inc., 51 Franklin Street, Fifth Floor,
+   Boston, MA 02110-1301, USA.  */

 /* As a special exception, you may create a larger work that contains
   part or all of the Bison parser skeleton and distribute that work
@@ -28,11 +29,10 @@
   special exception, which will cause the skeleton and the resulting
   Bison output files to be licensed under the GNU General Public
   License without this special exception.
-   
+
   This special exception was added by the Free Software Foundation in
   version 2.2 of Bison.  */

-
 /* Tokens.  */
 #ifndef YYTOKENTYPE
 # define YYTOKENTYPE
@@ -258,23 +258,17 @@

 #if ! defined YYSTYPE && ! defined YYSTYPE_IS_DECLARED
 typedef union YYSTYPE
-{
-
-/* Line 1676 of yacc.c  */
 #line 64 "util/configparser.y"
-
+{
 	char*	str;
-
-
-
-/* Line 1676 of yacc.c  */
-#line 272 "util/configparser.h"
-} YYSTYPE;
-# define YYSTYPE_IS_TRIVIAL 1
+}
+/* Line 1489 of yacc.c.  */
+#line 267 "util/configparser.h"
+	YYSTYPE;
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
 # define YYSTYPE_IS_DECLARED 1
+# define YYSTYPE_IS_TRIVIAL 1
 #endif

 extern YYSTYPE yylval;

-
@@ -490,8 +490,6 @@ find_rrset(struct msg_parse* msg, ldns_buffer* pkt, uint8_t* dname,
 			*rrset_prev = msgparse_hashtable_lookup(msg, pkt, 
 				*hash, *rrset_flags, dname, dnamelen, covtype, 
 				dclass);
-			if(!*rrset_prev) /* untwiddle if not found */
-				*rrset_flags ^= PACKED_RRSET_NSEC_AT_APEX;
 		}
 		if(*rrset_prev) {
 			*prev_dname_first = (*rrset_prev)->dname;
@@ -506,9 +504,9 @@ find_rrset(struct msg_parse* msg, ldns_buffer* pkt, uint8_t* dname,
 		int hasother = 0;
 		/* find matching rrsig */
 		*hash = pkt_hash_rrset_rest(dname_h, LDNS_RR_TYPE_RRSIG, 
-			dclass, 0);
+			dclass, *rrset_flags);
 		*rrset_prev = msgparse_hashtable_lookup(msg, pkt, *hash, 
-			0, dname, dnamelen, LDNS_RR_TYPE_RRSIG, 
+			*rrset_flags, dname, dnamelen, LDNS_RR_TYPE_RRSIG, 
 			dclass);
 		if(*rrset_prev && rrset_has_sigover(pkt, *rrset_prev, type,
 			&hasother)) {
@@ -816,17 +814,17 @@ parse_section(ldns_buffer* pkt, struct msg_parse* msg,
 		ldns_buffer_read(pkt, &dclass, sizeof(dclass));

 		if(0) { /* debug show what is being parsed. */
-			fprintf(stderr, "parse of %s(%d)",
+			printf("parse of %s(%d)",
 				ldns_rr_descript(type)?
 				ldns_rr_descript(type)->_name: "??",
 				(int)type);
-			fprintf(stderr, " %s(%d) ",
+			printf(" %s(%d) ",
 				ldns_lookup_by_id(ldns_rr_classes, 
 				(int)ntohs(dclass))?ldns_lookup_by_id(
 				ldns_rr_classes, (int)ntohs(dclass))->name: 
 				"??", (int)ntohs(dclass));
-			dname_print(stderr, pkt, dname);
-			fprintf(stderr, "\n");
+			dname_print(stdout, pkt, dname);
+			printf("\n");
 		}

 		/* see if it is part of an existing RR set */
@@ -844,9 +842,9 @@ parse_section(ldns_buffer* pkt, struct msg_parse* msg,
 				return LDNS_RCODE_SERVFAIL;
 		}
 		else if(0)	{ 
-			fprintf(stderr, "is part of existing: ");
-			dname_print(stderr, pkt, rrset->dname);
-			fprintf(stderr, " type %s(%d)\n",
+			printf("is part of existing: ");
+			dname_print(stdout, pkt, rrset->dname);
+			printf(" type %s(%d)\n",
 				ldns_rr_descript(rrset->type)?
 				ldns_rr_descript(rrset->type)->_name: "??",
 				(int)rrset->type);
@@ -790,40 +790,3 @@ log_query_info(enum verbosity_value v, const char* str,
 {
 	log_nametypeclass(v, str, qinf->qname, qinf->qtype, qinf->qclass);
 }
-
-int
-reply_check_cname_chain(struct reply_info* rep) 
-{
-	/* check only answer section rrs for matching cname chain.
-	 * the cache may return changed rdata, but owner names are untouched.*/
-	size_t i;
-	uint8_t* sname = rep->rrsets[0]->rk.dname;
-	size_t snamelen = rep->rrsets[0]->rk.dname_len;
-	for(i=0; i<rep->an_numrrsets; i++) {
-		uint16_t t = ntohs(rep->rrsets[i]->rk.type);
-		if(t == LDNS_RR_TYPE_DNAME)
-			continue; /* skip dnames; note TTL 0 not cached */
-		/* verify that owner matches current sname */
-		if(query_dname_compare(sname, rep->rrsets[i]->rk.dname) != 0){
-			/* cname chain broken */
-			return 0;
-		}
-		/* if this is a cname; move on */
-		if(t == LDNS_RR_TYPE_CNAME) {
-			get_cname_target(rep->rrsets[i], &sname, &snamelen);
-		}
-	}
-	return 1;
-}
-
-int
-reply_all_rrsets_secure(struct reply_info* rep) 
-{
-	size_t i;
-	for(i=0; i<rep->rrset_count; i++) {
-		if( ((struct packed_rrset_data*)rep->rrsets[i]->entry.data)
-			->security != sec_status_secure )
-		return 0;
-	}
-	return 1;
-}
@@ -329,21 +329,6 @@ int parse_copy_decompress_rrset(ldns_buffer* pkt, struct msg_parse* msg,
 uint8_t* reply_find_final_cname_target(struct query_info* qinfo,
 	struct reply_info* rep);

-/**
- * Check if cname chain in cached reply is still valid.
- * @param rep: reply to check.
- * @return: true if valid, false if invalid.
- */
-int reply_check_cname_chain(struct reply_info* rep);
-
-/**
- * Check security status of all RRs in the message.
- * @param rep: reply to check
- * @return: true if all RRs are secure. False if not.
- *    True if there are zero RRs.
- */
-int reply_all_rrsets_secure(struct reply_info* rep);
-
 /**
 * Find answer rrset in reply, the one matching qinfo. Follows CNAMEs, so the
 * result may have a different owner name.
@@ -376,10 +376,3 @@ int fptr_whitelist_tube_listen(tube_callback_t* fptr)
 	else if(fptr == &libworker_handle_control_cmd) return 1;
 	return 0;
 }
-
-int fptr_whitelist_mesh_cb(mesh_cb_func_t fptr)
-{
-	if(fptr == &libworker_fg_done_cb) return 1;
-	else if(fptr == &libworker_bg_done_cb) return 1;
-	return 0;
-}
@@ -58,7 +58,6 @@
 #include "util/storage/lruhash.h"
 #include "util/module.h"
 #include "util/tube.h"
-#include "services/mesh.h"

 /**
 * Macro to perform an assertion check for fptr wlist checks.
@@ -308,14 +307,6 @@ int fptr_whitelist_alloc_cleanup(void (*fptr)(void*));
 */
 int fptr_whitelist_tube_listen(tube_callback_t* fptr);

-/**
- * Check function pointer whitelist for mesh state callback values.
- *
- * @param fptr: function pointer to check.
- * @return false if not in whitelist.
- */
-int fptr_whitelist_mesh_cb(mesh_cb_func_t fptr);
-
 /** Due to module breakage by fptr wlist, these test app declarations
 * are presented here */
 /** 
@@ -3374,6 +3374,7 @@
 3763,
 3764,
 3765,
+3766,
 3767,
 3768,
 3769,
@@ -3877,8 +3878,6 @@
 4554,
 4555,
 4556,
-4557,
-4558,
 4559,
 4566,
 4567,
@@ -4021,7 +4020,6 @@
 5025,
 5026,
 5027,
-5029,
 5030,
 5042,
 5043,
@@ -4502,7 +4500,6 @@
 7200,
 7201,
 7227,
-7262,
 7272,
 7273,
 7274,
@@ -4764,7 +4761,6 @@
 9102,
 9103,
 9104,
-9105,
 9119,
 9131,
 9160,
@@ -5125,7 +5121,6 @@
 25793,
 25900,
 25901,
-25902,
 25903,
 26000,
 26133,
@@ -5211,7 +5206,6 @@
 44818,
 45054,
 45678,
-45825,
 45966,
 46999,
 47000,
@@ -522,6 +522,9 @@ dnskeyset_verify_rrset_sig(struct module_env* env, struct val_env* ve,
 			tag != dnskey_calc_keytag(dnskey, i))
 			continue;
 		numchecked ++;
+		/* skip revoked keys */
+		if(dnskey_get_flags(dnskey, i) & LDNS_KEY_REVOKE_KEY)
+			continue;

 		/* see if key verifies */
 		sec = dnskey_verify_rrset_sig(env->scratch, 
@@ -663,21 +663,6 @@ val_check_nonsecure(struct val_env* ve, struct reply_info* rep)
 			 * But this rrset did not verify.
 			 * Therefore the message is bogus.
 			 */
-
-			/* check if authority consists of only an NS record
-			 * which is bad, and there is an answer section with
-			 * data.  In that case, delete NS and additional to 
-			 * be lenient and make a minimal response */
-			if(rep->an_numrrsets != 0 && rep->ns_numrrsets == 1 &&
-				ntohs(rep->rrsets[i]->rk.type) 
-				== LDNS_RR_TYPE_NS) {
-				verbose(VERB_ALGO, "truncate to minimal");
-				rep->ns_numrrsets = 0;
-				rep->ar_numrrsets = 0;
-				rep->rrset_count = rep->an_numrrsets;
-				return;
-			}
-
 			log_nametypeclass(VERB_QUERY, "message is bogus, "
 				"non secure rrset",
 				rep->rrsets[i]->rk.dname, 
@@ -251,8 +251,9 @@ val_error(struct module_qstate* qstate, int id)
 /** 
 * Check to see if a given response needs to go through the validation
 * process. Typical reasons for this routine to return false are: CD bit was
- * on in the original request, or the response is a kind of message that 
- * is unvalidatable (i.e., SERVFAIL, REFUSED, etc.)
+ * on in the original request, the response was already validated, or the
+ * response is a kind of message that is unvalidatable (i.e., SERVFAIL,
+ * REFUSED, etc.)
 *
 * @param qstate: query state.
 * @param ret_rc: rcode for this message (if noerror - examine ret_msg).
@@ -291,25 +292,14 @@ needs_validation(struct module_qstate* qstate, int ret_rc,
 		verbose(VERB_ALGO, "cannot validate RRSIG, no sigs on sigs.");
 		return 0;
 	}
-	return 1;
-}

-/**
- * Check to see if the response has already been validated.
- * @param ret_msg: return msg, can be NULL
- * @return true if the response has already been validated
- */
-static int
-already_validated(struct dns_msg* ret_msg)
-{
 	/* validate unchecked, and re-validate bogus messages */
 	if (ret_msg && ret_msg->rep->security > sec_status_bogus)
 	{
-		verbose(VERB_ALGO, "response has already been validated: %s",
-			sec_status_to_string(ret_msg->rep->security));
-		return 1;
+		verbose(VERB_ALGO, "response has already been validated");
+		return 0;
 	}
-	return 0;
+	return 1;
 }

 /**
@@ -478,37 +468,6 @@ validate_msg_signatures(struct module_env* env, struct val_env* ve,
 	return 1;
 }

-/**
- * Detect wrong truncated response (say from BIND 9.6.1 that is forwarding
- * and saw the NS record without signatures from a referral).
- * The positive response has a mangled authority section.
- * Remove that authority section and the additional section.
- * @param rep: reply
- * @return true if a wrongly truncated response.
- */
-static int
-detect_wrongly_truncated(struct reply_info* rep)
-{
-	size_t i;
-	/* only NS in authority, and it is bogus */
-	if(rep->ns_numrrsets != 1 || rep->an_numrrsets == 0)
-		return 0;
-	if(ntohs(rep->rrsets[ rep->an_numrrsets ]->rk.type) != LDNS_RR_TYPE_NS)
-		return 0;
-	if(((struct packed_rrset_data*)rep->rrsets[ rep->an_numrrsets ]
-		->entry.data)->security == sec_status_secure)
-		return 0;
-	/* answer section is present and secure */
-	for(i=0; i<rep->an_numrrsets; i++) {
-		if(((struct packed_rrset_data*)rep->rrsets[ i ]
-			->entry.data)->security != sec_status_secure)
-			return 0;
-	}
-	verbose(VERB_ALGO, "truncating to minimal response");
-	return 1;
-}
-
-
 /**
 * Given a "positive" response -- a response that contains an answer to the
 * question, and no CNAME chain, validate this response. 
@@ -1480,36 +1439,17 @@ processValidate(struct module_qstate* qstate, struct val_qstate* vq,
 		vq->chase_reply->security = sec_status_bogus;
 		return 1;
 	}
-	subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
-		&vq->qchase, vq->orig_msg->rep, vq->rrset_skip);

 	/* check signatures in the message; 
 	 * answer and authority must be valid, additional is only checked. */
 	if(!validate_msg_signatures(qstate->env, ve, &vq->qchase, 
 		vq->chase_reply, vq->key_entry)) {
-		/* workaround bad recursor out there that truncates (even
-		 * with EDNS4k) to 512 by removing RRSIG from auth section
-		 * for positive replies*/
-		if((subtype == VAL_CLASS_POSITIVE || subtype == VAL_CLASS_ANY
-			|| subtype == VAL_CLASS_CNAME) &&
-			detect_wrongly_truncated(vq->orig_msg->rep)) {
-			/* truncate the message some more */
-			vq->orig_msg->rep->ns_numrrsets = 0;
-			vq->orig_msg->rep->ar_numrrsets = 0;
-			vq->orig_msg->rep->rrset_count = 
-				vq->orig_msg->rep->an_numrrsets;
-			vq->chase_reply->ns_numrrsets = 0;
-			vq->chase_reply->ar_numrrsets = 0;
-			vq->chase_reply->rrset_count = 
-				vq->chase_reply->an_numrrsets;
-		}
-		else {
-			verbose(VERB_DETAIL, "Validate: message contains "
-				"bad rrsets");
-			return 1;
-		}
+		verbose(VERB_DETAIL, "Validate: message contains bad rrsets");
+		return 1;
 	}

+	subtype = val_classify_response(qstate->query_flags, &qstate->qinfo,
+		&vq->qchase, vq->orig_msg->rep, vq->rrset_skip);
 	switch(subtype) {
 		case VAL_CLASS_POSITIVE:
 			verbose(VERB_ALGO, "Validating a positive response");
@@ -1997,10 +1937,6 @@ val_operate(struct module_qstate* qstate, enum module_ev event, int id,
 			qstate->ext_state[id] = module_finished;
 			return;
 		}
-		if(already_validated(qstate->return_msg)) {
-			qstate->ext_state[id] = module_finished;
-			return;
-		}
 		/* create state to start validation */
 		qstate->ext_state[id] = module_error; /* override this */
 		if(!vq) {
@@ -2461,8 +2397,7 @@ process_dlv_response(struct module_qstate* qstate, struct val_qstate* vq,
 	}
 	if(msg->rep->security != sec_status_secure) {
 		vq->dlv_status = dlv_error;
-		verbose(VERB_ALGO, "response is not secure, %s",
-			sec_status_to_string(msg->rep->security));
+		verbose(VERB_ALGO, "response is not secure");
 		return;
 	}
 	/* was the lookup a success? validated DLV? */
@@ -109,7 +109,7 @@ event_reg_install(FILE* out, const char* pathname)
 	if(out) fprintf(out, "installed reg entries\n");
 }

-/** remove registry entries for eventlog */
+/** remove regisytry entries for eventlog */
 static void
 event_reg_remove(FILE* out)
 {
@@ -48,7 +48,6 @@
 #include "winrc/w_inst.h"
 #include "daemon/daemon.h"
 #include "daemon/worker.h"
-#include "daemon/remote.h"
 #include "util/config_file.h"
 #include "util/netevent.h"
 #include "util/winsock_event.h"
@@ -284,15 +283,7 @@ service_init(int r, struct daemon** d, struct config_file** c)
 	if(!r) report_status(SERVICE_START_PENDING, NO_ERROR, 2400);
 	verbose(VERB_QUERY, "winservice - apply cfg");
 	daemon_apply_cfg(daemon, cfg);
-
-	if(!r) report_status(SERVICE_START_PENDING, NO_ERROR, 2300);
-	if(!(daemon->rc = daemon_remote_create(cfg))) {
-		log_err("could not set up remote-control");
-		daemon_delete(daemon);
-		config_delete(cfg);
-		return 0;
-	}
-
+	
 	/* open ports */
 	/* keep reporting that we are busy starting */
 	if(!r) report_status(SERVICE_START_PENDING, NO_ERROR, 2200);
Author	SHA1	Message	Date
Wouter Wijngaards	ee8ea8c5c1	Review comments Matthijs. git-svn-id: file:///svn/unbound/tags/release-1.3.0@1638 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-03 08:06:56 +00:00
Wouter Wijngaards	74f380880d	Fixup bad free. git-svn-id: file:///svn/unbound/tags/release-1.3.0@1636 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-03 07:57:39 +00:00
Wouter Wijngaards	e654d9f4a7	Updated 1.3.0 tag git-svn-id: file:///svn/unbound/tags/release-1.3.0@1634 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-06-02 13:49:22 +00:00
Wouter Wijngaards	6775b5c275	Keeping ldns testpkts the same. git-svn-id: file:///svn/unbound/tags/release-1.3.0@1621 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-04-28 09:07:29 +00:00
Wouter Wijngaards	7860941b38	1.3.0 svn tag. git-svn-id: file:///svn/unbound/tags/release-1.3.0@1619 be551aaa-1e26-0410-a405-d3ace91eadb9	2009-04-28 08:28:45 +00:00