iana portlist updated.

git-svn-id: file:///svn/unbound/trunk@1741 be551aaa-1e26-0410-a405-d3ace91eadb9

Makefile.in

@@ -35,6 +35,7 @@ doxygen=@doxygen@
 libtool=@libtool@
 ldnsdir=@ldnsdir@
 staticexe=@staticexe@
+EXEEXT=@EXEEXT@
 configfile=@ub_conf_file@
 UNBOUND_RUN_DIR=@UNBOUND_RUN_DIR@
 CHECKLOCK_SRC=@CHECKLOCK_SRC@
@@ -46,6 +47,7 @@ PYTHON_SITE_PKG=@PYTHON_SITE_PKG@
 SWIG=@SWIG@
 YACC=@YACC@
 LEX=@LEX@
+STRIP=@STRIP@
 CC=@CC@
 CPPFLAGS=-I. @CPPFLAGS@
 ifneq "$(srcdir)" "."
@@ -65,7 +67,7 @@ ifeq "$(QUIET)" "yes"
 endif
 BUILD=build/
 
-WINDRES=windres
+WINDRES=@WINDRES@
 LINT=splint
 LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list -Dglob64=glob -Dglobfree64=globfree
 # compat with openssl linux edition.
@@ -82,6 +84,7 @@ COMMON_SRC=$(patsubst $(srcdir)/%,%, $(wildcard $(srcdir)/services/*.c \
 	$(srcdir)/iterator/*.c $(srcdir)/validator/*.c $(PYTHONMOD_SRC))) \
 	util/configparser.c util/configlexer.c $(CHECKLOCK_SRC)
 COMMON_OBJ=$(addprefix $(BUILD),$(COMMON_SRC:.c=.lo))
+COMPAT_SRC=$(addprefix compat/,$(LIBOBJS:.o=.c))
 COMPAT_OBJ=$(addprefix $(BUILD)compat/,$(LIBOBJS:.o=.lo))
 UNITTEST_SRC=$(patsubst $(srcdir)/%,%, \
 	$(wildcard $(srcdir)/testcode/unit*.c)) \
@@ -139,7 +142,8 @@ ifeq "$(UB_ON_WINDOWS)" "yes"
   CONTROL_OBJ+=$(BUILD)winrc/rsrc_unbound_control.o
   CHECKCONF_OBJ+=$(BUILD)winrc/rsrc_unbound_checkconf.o
 
-  WINAPPS=unbound-service-install unbound-service-remove anchor-update
+  WINAPPS=$(addsuffix $(EXEEXT), unbound-service-install \
+  	unbound-service-remove anchor-update)
   SVCINST_SRC=winrc/unbound-service-install.c winrc/w_inst.c
   SVCINST_OBJ=$(addprefix $(BUILD),$(SVCINST_SRC:.c=.lo)) $(COMPAT_OBJ) \
 	$(BUILD)winrc/rsrc_svcinst.o
@@ -173,10 +177,10 @@ $(BUILD)%.lo:    $(srcdir)/%.c
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(COMPILE) -c $< -o $@
 
-all:	$(COMMON_OBJ) unbound unbound-checkconf lib unbound-host unbound-control unbound-control-setup $(WINAPPS)
+all:	$(COMMON_OBJ) unbound$(EXEEXT) unbound-checkconf$(EXEEXT) lib unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-control-setup $(WINAPPS)
 
-TEST_BIN=asynclook delayer harvest lock-verify memstats perf pktview signit \
-	streamtcp testbound unittest
+TEST_BIN=$(addsuffix $(EXEEXT),asynclook delayer harvest lock-verify \
+	memstats perf pktview signit streamtcp testbound unittest)
 tests:	all $(TEST_BIN)
 
 test:	tests
@@ -190,82 +194,83 @@ libunbound.la:	$(LIBUNBOUND_OBJ)
 
 ifeq ($(patsubst ldns-src%,ldns-src,$(ldnsdir)),ldns-src)
 ldnslib=$(ldnsdir)/lib/libldns.a
-$(ldnslib):
+$(ldnslib):	$(ldnsdir)/lib
+$(ldnsdir)/lib:
 	@if test ! -z "$(ldnsdir)"; \
 	then (cd $(ldnsdir) && $(MAKE)); fi
 else
 ldnslib=
 endif
 
-unbound:	$(DAEMON_OBJ) $(ldnslib)
+unbound$(EXEEXT):	$(DAEMON_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(DAEMON_OBJ)) -lssl $(LIBS)
 
-unbound-checkconf:	$(CHECKCONF_OBJ) $(ldnslib)
+unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(CHECKCONF_OBJ)) $(LIBS)
 
-unbound-control:	$(CONTROL_OBJ) $(ldnslib)
+unbound-control$(EXEEXT):	$(CONTROL_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(CONTROL_OBJ)) -lssl $(LIBS)
 
-unbound-host:	$(HOST_OBJ) libunbound.la $(ldnslib)
+unbound-host$(EXEEXT):	$(HOST_OBJ) libunbound.la $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(HOST_OBJ)) -L. -L.libs -lunbound $(LIBS)
 
-unbound-service-install:	$(SVCINST_OBJ)
+unbound-service-install$(EXEEXT):	$(SVCINST_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SVCINST_OBJ)) $(LIBS)
 
-unbound-service-remove:	$(SVCUNINST_OBJ)
+unbound-service-remove$(EXEEXT):	$(SVCUNINST_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SVCUNINST_OBJ)) $(LIBS)
 
-anchor-update:  $(ANCHORUPD_OBJ) libunbound.la $(ldnslib)
+anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ) libunbound.la $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(ANCHORUPD_OBJ)) -L. -L.libs -lunbound $(LIBS)
 
-unittest:	$(UNITTEST_OBJ) $(ldnslib)
+unittest$(EXEEXT):	$(UNITTEST_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(UNITTEST_OBJ)) $(LIBS)
 
-testbound:	$(TESTBOUND_OBJ) $(ldnslib)
+testbound$(EXEEXT):	$(TESTBOUND_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(TESTBOUND_OBJ)) -lssl $(LIBS)
 
-lock-verify:	$(LOCKVERIFY_OBJ) $(ldnslib)
+lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(LOCKVERIFY_OBJ)) $(LIBS)
 
-pktview:	$(PKTVIEW_OBJ) $(ldnslib)
+pktview$(EXEEXT):	$(PKTVIEW_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PKTVIEW_OBJ)) $(LIBS)
 
-signit:	$(SIGNIT_OBJ) $(ldnslib)
+signit$(EXEEXT):	$(SIGNIT_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SIGNIT_OBJ)) $(LIBS)
 
-memstats:	$(MEMSTATS_OBJ) $(ldnslib)
+memstats$(EXEEXT):	$(MEMSTATS_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(MEMSTATS_OBJ)) $(LIBS)
 
-asynclook:	$(ASYNCLOOK_OBJ) $(ldnslib) libunbound.la
+asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ) $(ldnslib) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(ASYNCLOOK_OBJ)) $(LIBS) -L. -L.libs -lunbound
 
-streamtcp:	$(STREAMTCP_OBJ) $(ldnslib)
+streamtcp$(EXEEXT):	$(STREAMTCP_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(STREAMTCP_OBJ)) $(LIBS)
 
-perf:	$(PERF_OBJ) $(ldnslib)
+perf$(EXEEXT):	$(PERF_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PERF_OBJ)) $(LIBS)
 
-delayer:	$(DELAYER_OBJ) $(ldnslib)
+delayer$(EXEEXT):	$(DELAYER_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(DELAYER_OBJ)) $(LIBS)
 
-harvest:	$(HARVEST_OBJ) $(ldnslib) libunbound.la
+harvest$(EXEEXT):	$(HARVEST_OBJ) $(ldnslib) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(HARVEST_OBJ)) $(LIBS) -L. -L.libs -lunbound
 
@@ -318,7 +323,7 @@ util/configparser.c util/configparser.h:  $(srcdir)/util/configparser.y
 
 clean:
 	rm -f *.o *.d *.lo *~ tags
-	rm -f unbound unbound-checkconf unbound-host unbound-control unbound-control-setup libunbound.la
+	rm -f unbound$(EXEEXT) unbound-checkconf$(EXEEXT) unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-control-setup libunbound.la
 	rm -rf autom4te.cache .libs build doc/html doc/xml
 
 realclean: clean
@@ -349,10 +354,10 @@ doc:
 	fi
 
 strip:
-	strip unbound
-	strip unbound-checkconf
-	strip unbound-control
-	strip unbound-host
+	$(STRIP) unbound$(EXEEXT)
+	$(STRIP) unbound-checkconf$(EXEEXT)
+	$(STRIP) unbound-control$(EXEEXT)
+	$(STRIP) unbound-host$(EXEEXT)
 
 install:
 	$(INSTALL) -m 755 -d $(DESTDIR)$(sbindir)
@@ -363,10 +368,10 @@ install:
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man1
 	$(INSTALL) -m 755 -d $(DESTDIR)$(libdir)
 	$(INSTALL) -m 755 -d $(DESTDIR)$(includedir)
-	$(LIBTOOL) --mode=install cp unbound $(DESTDIR)$(sbindir)/unbound
-	$(LIBTOOL) --mode=install cp unbound-checkconf $(DESTDIR)$(sbindir)/unbound-checkconf
-	$(LIBTOOL) --mode=install cp unbound-control $(DESTDIR)$(sbindir)/unbound-control
-	$(LIBTOOL) --mode=install cp unbound-host $(DESTDIR)$(sbindir)/unbound-host
+	$(LIBTOOL) --mode=install cp unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound$(EXEEXT)
+	$(LIBTOOL) --mode=install cp unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT)
+	$(LIBTOOL) --mode=install cp unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT)
+	$(LIBTOOL) --mode=install cp unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT)
 ifeq "$(WITH_PYTHONMODULE)" "yes"
 	$(INSTALL) -m 755 -d $(DESTDIR)$(PYTHON_SITE_PKG)
 	$(INSTALL) -c -m 644 pythonmod/unboundmodule.py $(DESTDIR)$(PYTHON_SITE_PKG)/unboundmodule.py
@@ -389,7 +394,7 @@ endif
 	$(LIBTOOL) --mode=finish $(DESTDIR)$(libdir)
 
 uninstall:
-	rm -f -- $(DESTDIR)$(sbindir)/unbound $(DESTDIR)$(sbindir)/unbound-checkconf $(DESTDIR)$(sbindir)/unbound-host $(DESTDIR)$(sbindir)/unbound-control $(DESTDIR)$(sbindir)/unbound-control-setup
+	rm -f -- $(DESTDIR)$(sbindir)/unbound$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-checkconf$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-host$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control$(EXEEXT) $(DESTDIR)$(sbindir)/unbound-control-setup
 	rm -f -- $(DESTDIR)$(mandir)/man8/unbound.8 $(DESTDIR)$(mandir)/man8/unbound-checkconf.8 $(DESTDIR)$(mandir)/man5/unbound.conf.5 $(DESTDIR)$(mandir)/man8/unbound-control.8
 	rm -f -- $(DESTDIR)$(mandir)/man1/unbound-host.1 $(DESTDIR)$(mandir)/man3/libunbound.3
 	rm -f -- $(DESTDIR)$(includedir)/unbound.h
@@ -427,7 +432,7 @@ $(BUILD)%.d: $(srcdir)/%.c
 ifneq ($(MAKECMDGOALS),clean)
 ifneq ($(MAKECMDGOALS),realclean)
 ifeq ($(debug_enabled),yes)
--include $(addprefix $(BUILD),$(ALL_SRC:.c=.d))
+-include $(addprefix $(BUILD),$(ALL_SRC:.c=.d) $(COMPAT_SRC:.c=.d))
 endif
 endif
 endif

acx_nlnetlabs.m4

@@ -2,10 +2,14 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 2
-# 2009-07-03
+# Version 4
 # Changelog
-# - fixup LDFLAGS for empty ssl dir.
+# 2009-07-14 U_CHAR detection improved for windows crosscompile.
+#            added ACX_FUNC_MALLOC
+#            fixup some #if to #ifdef
+#            NONBLOCKING test for mingw crosscompile.
+# 2009-07-13 added ACX_WITH_SSL_OPTIONAL
+# 2009-07-03 fixup LDFLAGS for empty ssl dir.
 #
 # Automates some of the checking constructs.  Aims at portability for POSIX.
 # Documentation for functions is below.
@@ -30,6 +34,8 @@
 # ACX_TYPE_IN_PORT_T		- in_port_t type.
 # ACX_ARG_RPATH			- add --disable-rpath option.
 # ACX_WITH_SSL			- add --with-ssl option, link -lcrypto.
+# ACX_WITH_SSL_OPTIONAL		- add --with-ssl option, link -lcrypto,
+				  where --without-ssl is also accepted
 # ACX_LIB_SSL			- setup to link -lssl.
 # ACX_SYS_LARGEFILE		- improved sys_largefile, fseeko, >2G files.
 # ACX_CHECK_GETADDRINFO_WITH_INCLUDES - find getaddrinfo, portably.
@@ -37,6 +43,7 @@
 # ACX_CHECK_NONBLOCKING_BROKEN	- see if nonblocking sockets really work.
 # ACX_MKDIR_ONE_ARG		- determine mkdir(2) number of arguments.
 # ACX_FUNC_IOCTLSOCKET		- find ioctlsocket, portably.
+# ACX_FUNC_MALLOC		- check malloc, define replacement .
 # AHX_CONFIG_FORMAT_ATTRIBUTE	- config.h text for format.
 # AHX_CONFIG_UNUSED_ATTRIBUTE	- config.h text for unused.
 # AHX_CONFIG_FSEEKO		- define fseeko, ftello fallback.
@@ -480,14 +487,20 @@ AC_PROG_LIBTOOL
 
 dnl Detect if u_char type is defined, otherwise define it.
 AC_DEFUN([ACX_TYPE_U_CHAR], 
-	[AC_CHECK_TYPE(u_char, unsigned char)])
+[AC_CHECK_TYPE([u_char], ,
+	[AC_DEFINE([u_char], [unsigned char], [Define to 'unsigned char if not defined])], [
+AC_INCLUDES_DEFAULT
+#ifdef HAVE_WINSOCK2_H
+#  include <winsock2.h>
+#endif
+]) ])
 
 dnl Detect if rlim_t type is defined, otherwise define it.
 AC_DEFUN([ACX_TYPE_RLIM_T],
 [AC_CHECK_TYPE(rlim_t, , 
 	[AC_DEFINE([rlim_t], [unsigned long], [Define to 'int' if not defined])], [
 AC_INCLUDES_DEFAULT
-#if HAVE_SYS_RESOURCE_H
+#ifdef HAVE_SYS_RESOURCE_H
 #  include <sys/resource.h>
 #endif
 ]) ])
@@ -498,31 +511,34 @@ AC_DEFUN([ACX_TYPE_SOCKLEN_T],
 AC_CHECK_TYPE(socklen_t, , 
 	[AC_DEFINE([socklen_t], [int], [Define to 'int' if not defined])], [
 AC_INCLUDES_DEFAULT
-#if HAVE_SYS_SOCKET_H
+#ifdef HAVE_SYS_SOCKET_H
 #  include <sys/socket.h>
 #endif
+#ifdef HAVE_WS2TCPIP_H
+#  include <ws2tcpip.h>
+#endif
 ]) ])
 
-dnl Detect if socklen_t type is defined, otherwise define it.
+dnl Detect if in_addr_t type is defined, otherwise define it.
 AC_DEFUN([ACX_TYPE_IN_ADDR_T],
 [ AC_CHECK_TYPE(in_addr_t, [], [AC_DEFINE([in_addr_t], [uint32_t], [in_addr_t])], [
 AC_INCLUDES_DEFAULT
-#if HAVE_SYS_TYPES_H
+#ifdef HAVE_SYS_TYPES_H
 # include <sys/types.h>
 #endif
-#if HAVE_NETINET_IN_H
+#ifdef HAVE_NETINET_IN_H
 # include <netinet/in.h>
 #endif
 ]) ])
 
-dnl Detect if socklen_t type is defined, otherwise define it.
+dnl Detect if in_port_t type is defined, otherwise define it.
 AC_DEFUN([ACX_TYPE_IN_PORT_T],
 [ AC_CHECK_TYPE(in_port_t, [], [AC_DEFINE([in_port_t], [uint16_t], [in_port_t])], [
 AC_INCLUDES_DEFAULT
-#if HAVE_SYS_TYPES_H
+#ifdef HAVE_SYS_TYPES_H
 # include <sys/types.h>
 #endif
-#if HAVE_NETINET_IN_H
+#ifdef HAVE_NETINET_IN_H
 # include <netinet/in.h>
 #endif
 ]) ])
@@ -555,7 +571,89 @@ AC_DEFUN([ACX_RUNTIME_PATH_ADD], [
 	fi
 ])
 
-dnl Check for SSL. 
+dnl Common code for both ACX_WITH_SSL and ACX_WITH_SSL_OPTIONAL
+dnl Takes one argument; the withval checked in those 2 functions
+dnl sets up the environment for the given openssl path
+AC_DEFUN([ACX_SSL_CHECKS], [
+    withval=$1
+    if test x_$withval != x_no; then
+        AC_MSG_CHECKING(for SSL)
+        if test x_$withval = x_ -o x_$withval = x_yes; then
+            withval="/usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr"
+        fi
+        for dir in $withval; do
+            ssldir="$dir"
+            if test -f "$dir/include/openssl/ssl.h"; then
+                found_ssl="yes"
+                AC_DEFINE_UNQUOTED([HAVE_SSL], [], [Define if you have the SSL libraries installed.])
+                dnl assume /usr/include is already in the include-path.
+                if test "$ssldir" != "/usr"; then
+                        CPPFLAGS="$CPPFLAGS -I$ssldir/include"
+                fi
+                break;
+            fi
+        done
+        if test x_$found_ssl != x_yes; then
+            AC_MSG_ERROR(Cannot find the SSL libraries in $withval)
+        else
+            AC_MSG_RESULT(found in $ssldir)
+            HAVE_SSL=yes
+            dnl assume /usr is already in the lib and dynlib paths.
+            if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
+                LDFLAGS="$LDFLAGS -L$ssldir/lib"
+                ACX_RUNTIME_PATH_ADD([$ssldir/lib])
+            fi
+        
+            AC_MSG_CHECKING([for HMAC_CTX_init in -lcrypto])
+            LIBS="$LIBS -lcrypto"
+            AC_TRY_LINK(, [
+                int HMAC_CTX_init(void);
+                (void)HMAC_CTX_init();
+              ], [
+                AC_MSG_RESULT(yes)
+                AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
+                          [If you have HMAC_CTX_init])
+              ], [
+                AC_MSG_RESULT(no)
+                # check if -lwsock32 or -lgdi32 are needed.	
+                BAKLIBS="$LIBS"
+                LIBS="$LIBS -lgdi32"
+                AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
+                AC_TRY_LINK([], [
+                    int HMAC_CTX_init(void);
+                    (void)HMAC_CTX_init();
+                  ],[
+                    AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
+                        [If you have HMAC_CTX_init])
+                    AC_MSG_RESULT(yes) 
+                  ],[
+                    AC_MSG_RESULT(no)
+                    LIBS="$BAKLIBS"
+                    LIBS="$LIBS -ldl"
+                    AC_MSG_CHECKING([if -lcrypto needs -ldl])
+                    AC_TRY_LINK([], [
+                        int HMAC_CTX_init(void);
+                        (void)HMAC_CTX_init();
+                      ],[
+                        AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
+                            [If you have HMAC_CTX_init])
+                        AC_MSG_RESULT(yes) 
+                      ],[
+                        AC_MSG_RESULT(no)
+                    AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
+                    ])
+                ])
+            ])
+        fi
+        AC_SUBST(HAVE_SSL)
+        AC_SUBST(RUNTIME_PATH)
+    fi
+AC_CHECK_HEADERS([openssl/ssl.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([openssl/err.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([openssl/rand.h],,, [AC_INCLUDES_DEFAULT])
+])dnl End of ACX_SSL_CHECKS
+
+dnl Check for SSL, where SSL is mandatory
 dnl Adds --with-ssl option, searches for openssl and defines HAVE_SSL if found
 dnl Setup of CPPFLAGS, CFLAGS.  Adds -lcrypto to LIBS. 
 dnl Checks main header files of SSL.
@@ -571,83 +669,25 @@ AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
     if test x_$withval = x_no; then
 	AC_MSG_ERROR([Need SSL library to do digital signature cryptography])
     fi
-    if test x_$withval != x_no; then
-        AC_MSG_CHECKING(for SSL)
-        if test x_$withval = x_ -o x_$withval = x_yes; then
-            withval="/usr/local/ssl /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr"
-        fi
-        for dir in $withval; do
-            ssldir="$dir"
-            if test -f "$dir/include/openssl/ssl.h"; then
-                found_ssl="yes"
-                AC_DEFINE_UNQUOTED([HAVE_SSL], [], [Define if you have the SSL libraries installed.])
-		dnl assume /usr/include is already in the include-path.
-		if test "$ssldir" != "/usr"; then
-			CPPFLAGS="$CPPFLAGS -I$ssldir/include"
-		fi
-                break;
-            fi
-        done
-        if test x_$found_ssl != x_yes; then
-            AC_MSG_ERROR(Cannot find the SSL libraries in $withval)
-        else
-            AC_MSG_RESULT(found in $ssldir)
-            HAVE_SSL=yes
-	    dnl assume /usr is already in the lib and dynlib paths.
-	    if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
-                LDFLAGS="$LDFLAGS -L$ssldir/lib"
-		ACX_RUNTIME_PATH_ADD([$ssldir/lib])
-	    fi
-	
-	    AC_MSG_CHECKING([for HMAC_CTX_init in -lcrypto])
-	    LIBS="$LIBS -lcrypto"
-	    AC_TRY_LINK(, [
-		int HMAC_CTX_init(void);
-		(void)HMAC_CTX_init();
-	      ], [
-		AC_MSG_RESULT(yes)
-		AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
-			[If you have HMAC_CTX_init])
-	      ], [
-		AC_MSG_RESULT(no)
-	    	# check if -lwsock32 or -lgdi32 are needed.	
-		BAKLIBS="$LIBS"
-		LIBS="$LIBS -lgdi32"
-		AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
-		AC_TRY_LINK([], [
-		    int HMAC_CTX_init(void);
-		    (void)HMAC_CTX_init();
-		  ],[
-		    AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
-			[If you have HMAC_CTX_init])
-		    AC_MSG_RESULT(yes) 
-		  ],[
-		    AC_MSG_RESULT(no)
-		    LIBS="$BAKLIBS"
-		    LIBS="$LIBS -ldl"
-		    AC_MSG_CHECKING([if -lcrypto needs -ldl])
-		    AC_TRY_LINK([], [
-			int HMAC_CTX_init(void);
-			(void)HMAC_CTX_init();
-		      ],[
-			AC_DEFINE([HAVE_HMAC_CTX_INIT], 1, 
-			    [If you have HMAC_CTX_init])
-			AC_MSG_RESULT(yes) 
-		      ],[
-			AC_MSG_RESULT(no)
-                    AC_MSG_ERROR([OpenSSL found in $ssldir, but version 0.9.7 or higher is required])
-		    ])
-		])
-            ])
-        fi
-        AC_SUBST(HAVE_SSL)
-	AC_SUBST(RUNTIME_PATH)
-    fi
-AC_CHECK_HEADERS([openssl/ssl.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_HEADERS([openssl/err.h],,, [AC_INCLUDES_DEFAULT])
-AC_CHECK_HEADERS([openssl/rand.h],,, [AC_INCLUDES_DEFAULT])
+    ACX_SSL_CHECKS($withval)
 ])dnl End of ACX_WITH_SSL
 
+dnl Check for SSL, where ssl is optional (--without-ssl is allowed)
+dnl Adds --with-ssl option, searches for openssl and defines HAVE_SSL if found
+dnl Setup of CPPFLAGS, CFLAGS.  Adds -lcrypto to LIBS. 
+dnl Checks main header files of SSL.
+dnl
+AC_DEFUN([ACX_WITH_SSL_OPTIONAL],
+[
+AC_ARG_WITH(ssl, AC_HELP_STRING([--with-ssl=pathname],
+                                [enable SSL (will check /usr/local/ssl
+                                /usr/lib/ssl /usr/ssl /usr/pkg /usr/local /opt/local /usr/sfw /usr)]),[
+        ],[
+            withval="yes"
+        ])
+    ACX_SSL_CHECKS($withval)
+])dnl End of ACX_WITH_SSL_OPTIONAL
+
 dnl Setup to use -lssl
 dnl To use -lcrypto, use the ACX_WITH_SSL setup (before this one).
 AC_DEFUN([ACX_LIB_SSL],
@@ -779,6 +819,10 @@ dnl a nonblocking socket do not work, a new call to select is necessary.
 AC_DEFUN([ACX_CHECK_NONBLOCKING_BROKEN],
 [
 AC_MSG_CHECKING([if nonblocking sockets work])
+if echo $target | grep mingw32 >/dev/null; then 
+	AC_MSG_RESULT([no (windows)])
+	AC_DEFINE([NONBLOCKING_IS_BROKEN], 1, [Define if the network stack does not fully support nonblocking io (causes lower performance).])
+else
 AC_RUN_IFELSE(AC_LANG_PROGRAM([
 #include <stdio.h>
 #include <string.h>
@@ -904,6 +948,7 @@ AC_RUN_IFELSE(AC_LANG_PROGRAM([
 ], [
 	AC_MSG_RESULT([crosscompile(yes)])
 ])
+fi
 ])dnl End of ACX_CHECK_NONBLOCKING_BROKEN
 
 dnl Check if mkdir has one or two arguments.
@@ -947,6 +992,16 @@ AC_DEFINE(HAVE_IOCTLSOCKET, 1, [if the function 'ioctlsocket' is available])
 ],[AC_MSG_RESULT(no)])
 ])dnl end of ACX_FUNC_IOCTLSOCKET
 
+dnl detect malloc and provide malloc compat prototype.
+dnl $1: unique name for compat code
+AC_DEFUN([ACX_FUNC_MALLOC],
+[
+	AC_FUNC_MALLOC
+	if test "$ac_cv_func_malloc_0_nonnull" = no; then
+		AC_DEFINE_UNQUOTED([malloc], [rpl_malloc_$1], [Define if  replacement function should be used.])
+	fi
+])
+
 dnl Define fallback for fseeko and ftello if needed.
 AC_DEFUN([AHX_CONFIG_FSEEKO],
 [

compat/malloc.c

@@ -3,7 +3,6 @@
 
 #include "config.h"
 #undef malloc
-
 #include <sys/types.h>
 
 void *malloc ();
@@ -12,7 +11,7 @@ void *malloc ();
    If N is zero, allocate a 1-byte block.  */
 
 void *
-rpl_malloc (size_t n)
+rpl_malloc_unbound (size_t n)
 {
   if (n == 0)
     n = 1;

config.h.in

@@ -494,7 +494,7 @@
 /* Define to `signed char' if <sys/types.h> does not define. */
 #undef int8_t
 
-/* Define to rpl_malloc if the replacement function should be used. */
+/* Define if replacement function should be used. */
 #undef malloc
 
 /* Define to `long int' if <sys/types.h> does not define. */
@@ -515,7 +515,7 @@
 /* Define to `int' if <sys/types.h> does not define. */
 #undef ssize_t
 
-/* Define to `unsigned char' if <sys/types.h> does not define. */
+/* Define to 'unsigned char if not defined */
 #undef u_char
 
 /* Define to `int' if <sys/types.h> doesn't define. */
@@ -658,11 +658,6 @@
 #endif /* HAVE_FSEEKO */
 
 
-#ifndef RAND_MAX
-#define RAND_MAX	2147483647
-#endif
-
-
 #ifndef MAXHOSTNAMELEN
 #define MAXHOSTNAMELEN 256
 #endif

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.63 for unbound 1.3.2.
+# Generated by GNU Autoconf 2.63 for unbound 1.3.3.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -745,8 +745,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.3.2'
-PACKAGE_STRING='unbound 1.3.2'
+PACKAGE_VERSION='1.3.3'
+PACKAGE_STRING='unbound 1.3.3'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 
 # Factoring default headers for most tests.
@@ -789,6 +789,7 @@ enable_option_checking=no
 ac_subst_vars='LTLIBOBJS
 subdirs
 ldnsdir
+WINDRES
 UB_ON_WINDOWS
 LIBOBJS
 CHECKLOCK_SRC
@@ -818,7 +819,6 @@ NMEDIT
 DSYMUTIL
 lt_ECHO
 RANLIB
-STRIP
 OBJDUMP
 LN_S
 NM
@@ -838,6 +838,7 @@ build_vendor
 build_cpu
 build
 libtool
+STRIP
 doxygen
 YFLAGS
 YACC
@@ -1497,7 +1498,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.3.2 to adapt to many kinds of systems.
+\`configure' configures unbound 1.3.3 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1562,7 +1563,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.3.2:";;
+     short | recursive ) echo "Configuration of unbound 1.3.3:";;
    esac
   cat <<\_ACEOF
 
@@ -1707,7 +1708,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.3.2
+unbound configure 1.3.3
 generated by GNU Autoconf 2.63
 
 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1721,7 +1722,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.3.2, which was
+It was created by unbound $as_me 1.3.3, which was
 generated by GNU Autoconf 2.63.  Invocation command line was
 
   $ $0 $@
@@ -2091,7 +2092,7 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
 LIBUNBOUND_CURRENT=1
-LIBUNBOUND_REVISION=2
+LIBUNBOUND_REVISION=3
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2103,6 +2104,7 @@ LIBUNBOUND_AGE=0
 # 1.3.0 had 1:0:0   # ub_cancel and -export-symbols.
 # 1.3.1 had 1:1:0
 # 1.3.2 had 1:2:0
+# 1.3.3 had 1:3:0
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -3926,7 +3928,10 @@ esac
 
 # are we on MinGW?
 if uname -s 2>&1 | grep MINGW32 >/dev/null; then on_mingw="yes"
-else on_mingw="no"; fi
+else
+	if echo $target | grep mingw32 >/dev/null; then on_mingw="yes"
+	else on_mingw="no"; fi
+fi
 
 #
 # Determine configuration file
@@ -6440,6 +6445,98 @@ $as_echo "no" >&6; }
 fi
 
 
+if test -n "$ac_tool_prefix"; then
+  # Extract the first word of "${ac_tool_prefix}strip", so it can be a program name with args.
+set dummy ${ac_tool_prefix}strip; ac_word=$2
+{ $as_echo "$as_me:$LINENO: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if test "${ac_cv_prog_STRIP+set}" = set; then
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$STRIP"; then
+  ac_cv_prog_STRIP="$STRIP" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+  for ac_exec_ext in '' $ac_executable_extensions; do
+  if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+    ac_cv_prog_STRIP="${ac_tool_prefix}strip"
+    $as_echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+done
+IFS=$as_save_IFS
+
+fi
+fi
+STRIP=$ac_cv_prog_STRIP
+if test -n "$STRIP"; then
+  { $as_echo "$as_me:$LINENO: result: $STRIP" >&5
+$as_echo "$STRIP" >&6; }
+else
+  { $as_echo "$as_me:$LINENO: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+fi
+if test -z "$ac_cv_prog_STRIP"; then
+  ac_ct_STRIP=$STRIP
+  # Extract the first word of "strip", so it can be a program name with args.
+set dummy strip; ac_word=$2
+{ $as_echo "$as_me:$LINENO: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if test "${ac_cv_prog_ac_ct_STRIP+set}" = set; then
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$ac_ct_STRIP"; then
+  ac_cv_prog_ac_ct_STRIP="$ac_ct_STRIP" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+  for ac_exec_ext in '' $ac_executable_extensions; do
+  if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+    ac_cv_prog_ac_ct_STRIP="strip"
+    $as_echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+done
+IFS=$as_save_IFS
+
+fi
+fi
+ac_ct_STRIP=$ac_cv_prog_ac_ct_STRIP
+if test -n "$ac_ct_STRIP"; then
+  { $as_echo "$as_me:$LINENO: result: $ac_ct_STRIP" >&5
+$as_echo "$ac_ct_STRIP" >&6; }
+else
+  { $as_echo "$as_me:$LINENO: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+  if test "x$ac_ct_STRIP" = x; then
+    STRIP=""
+  else
+    case $cross_compiling:$ac_tool_warned in
+yes:)
+{ $as_echo "$as_me:$LINENO: WARNING: using cross tools not prefixed with host triplet" >&5
+$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+ac_tool_warned=yes ;;
+esac
+    STRIP=$ac_ct_STRIP
+  fi
+else
+  STRIP="$ac_cv_prog_STRIP"
+fi
+
 ac_aux_dir=
 for ac_dir in "$srcdir" "$srcdir/.." "$srcdir/../.."; do
   if test -f "$ac_dir/install-sh"; then
@@ -7162,13 +7259,13 @@ if test "${lt_cv_nm_interface+set}" = set; then
 else
   lt_cv_nm_interface="BSD nm"
   echo "int some_variable = 0;" > conftest.$ac_ext
-  (eval echo "\"\$as_me:7165: $ac_compile\"" >&5)
+  (eval echo "\"\$as_me:7262: $ac_compile\"" >&5)
   (eval "$ac_compile" 2>conftest.err)
   cat conftest.err >&5
-  (eval echo "\"\$as_me:7168: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
+  (eval echo "\"\$as_me:7265: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
   (eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out)
   cat conftest.err >&5
-  (eval echo "\"\$as_me:7171: output\"" >&5)
+  (eval echo "\"\$as_me:7268: output\"" >&5)
   cat conftest.out >&5
   if $GREP 'External.*some_variable' conftest.out > /dev/null; then
     lt_cv_nm_interface="MS dumpbin"
@@ -8373,7 +8470,7 @@ ia64-*-hpux*)
   ;;
 *-*-irix6*)
   # Find out which ABI we are using.
-  echo '#line 8376 "configure"' > conftest.$ac_ext
+  echo '#line 8473 "configure"' > conftest.$ac_ext
   if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -9740,11 +9837,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9743: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9840: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:9747: \$? = $ac_status" >&5
+   echo "$as_me:9844: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -10079,11 +10176,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:10082: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:10179: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:10086: \$? = $ac_status" >&5
+   echo "$as_me:10183: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -10184,11 +10281,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:10187: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:10284: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:10191: \$? = $ac_status" >&5
+   echo "$as_me:10288: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -10239,11 +10336,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:10242: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:10339: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:10246: \$? = $ac_status" >&5
+   echo "$as_me:10343: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -13042,7 +13139,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 13045 "configure"
+#line 13142 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -13138,7 +13235,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 13141 "configure"
+#line 13238 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -14747,7 +14844,13 @@ _ACEOF
 cat confdefs.h >>conftest.$ac_ext
 cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
+
 $ac_includes_default
+#ifdef HAVE_WINSOCK2_H
+#  include <winsock2.h>
+#endif
+
+
 int
 main ()
 {
@@ -14781,7 +14884,13 @@ _ACEOF
 cat confdefs.h >>conftest.$ac_ext
 cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
+
 $ac_includes_default
+#ifdef HAVE_WINSOCK2_H
+#  include <winsock2.h>
+#endif
+
+
 int
 main ()
 {
@@ -14833,7 +14942,7 @@ if test "x$ac_cv_type_u_char" = x""yes; then
   :
 else
 
-cat >>confdefs.h <<_ACEOF
+cat >>confdefs.h <<\_ACEOF
 #define u_char unsigned char
 _ACEOF
 
@@ -14853,7 +14962,7 @@ cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
 
 $ac_includes_default
-#if HAVE_SYS_RESOURCE_H
+#ifdef HAVE_SYS_RESOURCE_H
 #  include <sys/resource.h>
 #endif
 
@@ -14893,7 +15002,7 @@ cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
 
 $ac_includes_default
-#if HAVE_SYS_RESOURCE_H
+#ifdef HAVE_SYS_RESOURCE_H
 #  include <sys/resource.h>
 #endif
 
@@ -14970,9 +15079,12 @@ cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
 
 $ac_includes_default
-#if HAVE_SYS_SOCKET_H
+#ifdef HAVE_SYS_SOCKET_H
 #  include <sys/socket.h>
 #endif
+#ifdef HAVE_WS2TCPIP_H
+#  include <ws2tcpip.h>
+#endif
 
 
 int
@@ -15010,9 +15122,12 @@ cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
 
 $ac_includes_default
-#if HAVE_SYS_SOCKET_H
+#ifdef HAVE_SYS_SOCKET_H
 #  include <sys/socket.h>
 #endif
+#ifdef HAVE_WS2TCPIP_H
+#  include <ws2tcpip.h>
+#endif
 
 
 int
@@ -15086,10 +15201,10 @@ cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
 
 $ac_includes_default
-#if HAVE_SYS_TYPES_H
+#ifdef HAVE_SYS_TYPES_H
 # include <sys/types.h>
 #endif
-#if HAVE_NETINET_IN_H
+#ifdef HAVE_NETINET_IN_H
 # include <netinet/in.h>
 #endif
 
@@ -15129,10 +15244,10 @@ cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
 
 $ac_includes_default
-#if HAVE_SYS_TYPES_H
+#ifdef HAVE_SYS_TYPES_H
 # include <sys/types.h>
 #endif
-#if HAVE_NETINET_IN_H
+#ifdef HAVE_NETINET_IN_H
 # include <netinet/in.h>
 #endif
 
@@ -15208,10 +15323,10 @@ cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
 
 $ac_includes_default
-#if HAVE_SYS_TYPES_H
+#ifdef HAVE_SYS_TYPES_H
 # include <sys/types.h>
 #endif
-#if HAVE_NETINET_IN_H
+#ifdef HAVE_NETINET_IN_H
 # include <netinet/in.h>
 #endif
 
@@ -15251,10 +15366,10 @@ cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
 
 $ac_includes_default
-#if HAVE_SYS_TYPES_H
+#ifdef HAVE_SYS_TYPES_H
 # include <sys/types.h>
 #endif
-#if HAVE_NETINET_IN_H
+#ifdef HAVE_NETINET_IN_H
 # include <netinet/in.h>
 #endif
 
@@ -16863,6 +16978,8 @@ fi
 $as_echo "$as_me: error: Need SSL library to do digital signature cryptography" >&2;}
    { (exit 1); exit 1; }; }
     fi
+
+    withval=$withval
     if test x_$withval != x_no; then
         { $as_echo "$as_me:$LINENO: checking for SSL" >&5
 $as_echo_n "checking for SSL... " >&6; }
@@ -16878,9 +16995,9 @@ cat >>confdefs.h <<_ACEOF
 #define HAVE_SSL /**/
 _ACEOF
 
-				if test "$ssldir" != "/usr"; then
-			CPPFLAGS="$CPPFLAGS -I$ssldir/include"
-		fi
+                                if test "$ssldir" != "/usr"; then
+                        CPPFLAGS="$CPPFLAGS -I$ssldir/include"
+                fi
                 break;
             fi
         done
@@ -16892,7 +17009,7 @@ $as_echo "$as_me: error: Cannot find the SSL libraries in $withval" >&2;}
             { $as_echo "$as_me:$LINENO: result: found in $ssldir" >&5
 $as_echo "found in $ssldir" >&6; }
             HAVE_SSL=yes
-	    	    if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
+                        if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
                 LDFLAGS="$LDFLAGS -L$ssldir/lib"
 
 	if test "x$enable_rpath" = xyes; then
@@ -16901,12 +17018,12 @@ $as_echo "found in $ssldir" >&6; }
 		fi
 	fi
 
-	    fi
+            fi
 
-	    { $as_echo "$as_me:$LINENO: checking for HMAC_CTX_init in -lcrypto" >&5
+            { $as_echo "$as_me:$LINENO: checking for HMAC_CTX_init in -lcrypto" >&5
 $as_echo_n "checking for HMAC_CTX_init in -lcrypto... " >&6; }
-	    LIBS="$LIBS -lcrypto"
-	    cat >conftest.$ac_ext <<_ACEOF
+            LIBS="$LIBS -lcrypto"
+            cat >conftest.$ac_ext <<_ACEOF
 /* confdefs.h.  */
 _ACEOF
 cat confdefs.h >>conftest.$ac_ext
@@ -16917,8 +17034,8 @@ int
 main ()
 {
 
-		int HMAC_CTX_init(void);
-		(void)HMAC_CTX_init();
+                int HMAC_CTX_init(void);
+                (void)HMAC_CTX_init();
 
   ;
   return 0;
@@ -16946,7 +17063,7 @@ $as_echo "$ac_try_echo") >&5
 	 $as_test_x conftest$ac_exeext
        }; then
 
-		{ $as_echo "$as_me:$LINENO: result: yes" >&5
+                { $as_echo "$as_me:$LINENO: result: yes" >&5
 $as_echo "yes" >&6; }
 
 cat >>confdefs.h <<\_ACEOF
@@ -16959,14 +17076,14 @@ else
 sed 's/^/| /' conftest.$ac_ext >&5
 
 
-		{ $as_echo "$as_me:$LINENO: result: no" >&5
+                { $as_echo "$as_me:$LINENO: result: no" >&5
 $as_echo "no" >&6; }
-	    	# check if -lwsock32 or -lgdi32 are needed.
-		BAKLIBS="$LIBS"
-		LIBS="$LIBS -lgdi32"
-		{ $as_echo "$as_me:$LINENO: checking if -lcrypto needs -lgdi32" >&5
+                # check if -lwsock32 or -lgdi32 are needed.
+                BAKLIBS="$LIBS"
+                LIBS="$LIBS -lgdi32"
+                { $as_echo "$as_me:$LINENO: checking if -lcrypto needs -lgdi32" >&5
 $as_echo_n "checking if -lcrypto needs -lgdi32... " >&6; }
-		cat >conftest.$ac_ext <<_ACEOF
+                cat >conftest.$ac_ext <<_ACEOF
 /* confdefs.h.  */
 _ACEOF
 cat confdefs.h >>conftest.$ac_ext
@@ -16977,8 +17094,8 @@ int
 main ()
 {
 
-		    int HMAC_CTX_init(void);
-		    (void)HMAC_CTX_init();
+                    int HMAC_CTX_init(void);
+                    (void)HMAC_CTX_init();
 
   ;
   return 0;
@@ -17011,7 +17128,7 @@ cat >>confdefs.h <<\_ACEOF
 #define HAVE_HMAC_CTX_INIT 1
 _ACEOF
 
-		    { $as_echo "$as_me:$LINENO: result: yes" >&5
+                    { $as_echo "$as_me:$LINENO: result: yes" >&5
 $as_echo "yes" >&6; }
 
 else
@@ -17019,13 +17136,13 @@ else
 sed 's/^/| /' conftest.$ac_ext >&5
 
 
-		    { $as_echo "$as_me:$LINENO: result: no" >&5
+                    { $as_echo "$as_me:$LINENO: result: no" >&5
 $as_echo "no" >&6; }
-		    LIBS="$BAKLIBS"
-		    LIBS="$LIBS -ldl"
-		    { $as_echo "$as_me:$LINENO: checking if -lcrypto needs -ldl" >&5
+                    LIBS="$BAKLIBS"
+                    LIBS="$LIBS -ldl"
+                    { $as_echo "$as_me:$LINENO: checking if -lcrypto needs -ldl" >&5
 $as_echo_n "checking if -lcrypto needs -ldl... " >&6; }
-		    cat >conftest.$ac_ext <<_ACEOF
+                    cat >conftest.$ac_ext <<_ACEOF
 /* confdefs.h.  */
 _ACEOF
 cat confdefs.h >>conftest.$ac_ext
@@ -17036,8 +17153,8 @@ int
 main ()
 {
 
-			int HMAC_CTX_init(void);
-			(void)HMAC_CTX_init();
+                        int HMAC_CTX_init(void);
+                        (void)HMAC_CTX_init();
 
   ;
   return 0;
@@ -17070,7 +17187,7 @@ cat >>confdefs.h <<\_ACEOF
 #define HAVE_HMAC_CTX_INIT 1
 _ACEOF
 
-			{ $as_echo "$as_me:$LINENO: result: yes" >&5
+                        { $as_echo "$as_me:$LINENO: result: yes" >&5
 $as_echo "yes" >&6; }
 
 else
@@ -17078,7 +17195,7 @@ else
 sed 's/^/| /' conftest.$ac_ext >&5
 
 
-			{ $as_echo "$as_me:$LINENO: result: no" >&5
+                        { $as_echo "$as_me:$LINENO: result: no" >&5
 $as_echo "no" >&6; }
                     { { $as_echo "$as_me:$LINENO: error: OpenSSL found in $ssldir, but version 0.9.7 or higher is required" >&5
 $as_echo "$as_me: error: OpenSSL found in $ssldir, but version 0.9.7 or higher is required" >&2;}
@@ -17293,6 +17410,7 @@ done
 
 
 
+
 # check if libssl needs libdl
 BAKLIBS="$LIBS"
 LIBS="-lssl $LIBS"
@@ -18583,6 +18701,10 @@ if test x_$enable_static_exe = x_yes; then
 	staticexe="-static"
 	if test "$on_mingw" = yes; then
 		staticexe="-all-static"
+		# for static crosscompile, include gdi32 and zlib here.
+		if test "`uname`" = "Linux"; then
+			LIBS="$LIBS -lgdi32 -lz"
+		fi
 	fi
 fi
 
@@ -18616,6 +18738,7 @@ _ACEOF
 
 else
 
+
 for ac_header in stdlib.h
 do
 as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
@@ -18859,6 +18982,14 @@ fi
 
 
 
+	if test "$ac_cv_func_malloc_0_nonnull" = no; then
+
+cat >>confdefs.h <<_ACEOF
+#define malloc rpl_malloc_unbound
+_ACEOF
+
+	fi
+
 fi
 
 
@@ -20358,6 +20489,98 @@ _ACEOF
 
 	UB_ON_WINDOWS=yes
 
+	if test -n "$ac_tool_prefix"; then
+  # Extract the first word of "${ac_tool_prefix}windres", so it can be a program name with args.
+set dummy ${ac_tool_prefix}windres; ac_word=$2
+{ $as_echo "$as_me:$LINENO: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if test "${ac_cv_prog_WINDRES+set}" = set; then
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$WINDRES"; then
+  ac_cv_prog_WINDRES="$WINDRES" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+  for ac_exec_ext in '' $ac_executable_extensions; do
+  if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+    ac_cv_prog_WINDRES="${ac_tool_prefix}windres"
+    $as_echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+done
+IFS=$as_save_IFS
+
+fi
+fi
+WINDRES=$ac_cv_prog_WINDRES
+if test -n "$WINDRES"; then
+  { $as_echo "$as_me:$LINENO: result: $WINDRES" >&5
+$as_echo "$WINDRES" >&6; }
+else
+  { $as_echo "$as_me:$LINENO: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+fi
+if test -z "$ac_cv_prog_WINDRES"; then
+  ac_ct_WINDRES=$WINDRES
+  # Extract the first word of "windres", so it can be a program name with args.
+set dummy windres; ac_word=$2
+{ $as_echo "$as_me:$LINENO: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if test "${ac_cv_prog_ac_ct_WINDRES+set}" = set; then
+  $as_echo_n "(cached) " >&6
+else
+  if test -n "$ac_ct_WINDRES"; then
+  ac_cv_prog_ac_ct_WINDRES="$ac_ct_WINDRES" # Let the user override the test.
+else
+as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+  for ac_exec_ext in '' $ac_executable_extensions; do
+  if { test -f "$as_dir/$ac_word$ac_exec_ext" && $as_test_x "$as_dir/$ac_word$ac_exec_ext"; }; then
+    ac_cv_prog_ac_ct_WINDRES="windres"
+    $as_echo "$as_me:$LINENO: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+done
+IFS=$as_save_IFS
+
+fi
+fi
+ac_ct_WINDRES=$ac_cv_prog_ac_ct_WINDRES
+if test -n "$ac_ct_WINDRES"; then
+  { $as_echo "$as_me:$LINENO: result: $ac_ct_WINDRES" >&5
+$as_echo "$ac_ct_WINDRES" >&6; }
+else
+  { $as_echo "$as_me:$LINENO: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+  if test "x$ac_ct_WINDRES" = x; then
+    WINDRES=""
+  else
+    case $cross_compiling:$ac_tool_warned in
+yes:)
+{ $as_echo "$as_me:$LINENO: WARNING: using cross tools not prefixed with host triplet" >&5
+$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+ac_tool_warned=yes ;;
+esac
+    WINDRES=$ac_ct_WINDRES
+  fi
+else
+  WINDRES="$ac_cv_prog_WINDRES"
+fi
+
 fi
 if test $ac_cv_func_getaddrinfo = no; then
 	case " $LIBOBJS " in
@@ -20737,6 +20960,15 @@ fi
 
 { $as_echo "$as_me:$LINENO: checking if nonblocking sockets work" >&5
 $as_echo_n "checking if nonblocking sockets work... " >&6; }
+if echo $target | grep mingw32 >/dev/null; then
+	{ $as_echo "$as_me:$LINENO: result: no (windows)" >&5
+$as_echo "no (windows)" >&6; }
+
+cat >>confdefs.h <<\_ACEOF
+#define NONBLOCKING_IS_BROKEN 1
+_ACEOF
+
+else
 if test "$cross_compiling" = yes; then
 
 	{ $as_echo "$as_me:$LINENO: result: crosscompile(yes)" >&5
@@ -20922,6 +21154,7 @@ rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$a
 fi
 
 
+fi
 
 
 { $as_echo "$as_me:$LINENO: checking whether mkdir has one arg" >&5
@@ -22572,7 +22805,7 @@ exec 6>&1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.3.2, which was
+This file was extended by unbound $as_me 1.3.3, which was
 generated by GNU Autoconf 2.63.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -22635,7 +22868,7 @@ Report bugs to <bug-autoconf@gnu.org>."
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_version="\\
-unbound config.status 1.3.2
+unbound config.status 1.3.3
 configured by $0, generated by GNU Autoconf 2.63,
   with options \\"`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
 

configure.ac

@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)
 
-AC_INIT(unbound, 1.3.2, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.3.3, unbound-bugs@nlnetlabs.nl, unbound)
 
 LIBUNBOUND_CURRENT=1
-LIBUNBOUND_REVISION=2
+LIBUNBOUND_REVISION=3
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -21,6 +21,7 @@ LIBUNBOUND_AGE=0
 # 1.3.0 had 1:0:0   # ub_cancel and -export-symbols.
 # 1.3.1 had 1:1:0
 # 1.3.2 had 1:2:0
+# 1.3.3 had 1:3:0
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -58,7 +59,10 @@ esac
 
 # are we on MinGW?
 if uname -s 2>&1 | grep MINGW32 >/dev/null; then on_mingw="yes"
-else on_mingw="no"; fi
+else 
+	if echo $target | grep mingw32 >/dev/null; then on_mingw="yes"
+	else on_mingw="no"; fi
+fi
 
 #
 # Determine configuration file
@@ -180,6 +184,7 @@ fi
 AC_PROG_LEX
 AC_PROG_YACC
 AC_CHECK_PROG(doxygen, doxygen, doxygen)
+AC_CHECK_TOOL(STRIP, strip)
 ACX_LIBTOOL_C_ONLY
 
 # Checks for header files.
@@ -442,6 +447,10 @@ if test x_$enable_static_exe = x_yes; then
 	staticexe="-static"
 	if test "$on_mingw" = yes; then
 		staticexe="-all-static"
+		# for static crosscompile, include gdi32 and zlib here.
+		if test "`uname`" = "Linux"; then
+			LIBS="$LIBS -lgdi32 -lz"
+		fi
 	fi
 fi
 
@@ -462,7 +471,7 @@ AC_ARG_ENABLE(alloc-checks, AC_HELP_STRING([--enable-alloc-checks],
 if test x_$enable_alloc_checks = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
 else
-	AC_FUNC_MALLOC
+	ACX_FUNC_MALLOC([unbound])
 fi
 
 AC_FUNC_CHOWN
@@ -476,6 +485,7 @@ if test "$USE_WINSOCK" = 1; then
 	AC_DEFINE(UB_ON_WINDOWS, 1, [Use win32 resources and API])
 	UB_ON_WINDOWS=yes
 	AC_SUBST(UB_ON_WINDOWS)
+	AC_CHECK_TOOL(WINDRES, windres)
 fi
 if test $ac_cv_func_getaddrinfo = no; then
 	AC_LIBOBJ([fake-rfc2553])
@@ -634,7 +644,6 @@ dnl includes
 AHX_CONFIG_FORMAT_ATTRIBUTE
 AHX_CONFIG_UNUSED_ATTRIBUTE
 AHX_CONFIG_FSEEKO
-AHX_CONFIG_RAND_MAX
 AHX_CONFIG_MAXHOSTNAMELEN
 AHX_CONFIG_SNPRINTF(unbound)
 AHX_CONFIG_INET_PTON(unbound)

contrib/update-anchor.sh

@@ -8,7 +8,7 @@ ubhost=unbound-host
 
 usage ( )
 {
-	echo "usage: update-anchor [-b] <zone name> <trust anchor file>"
+	echo "usage: update-anchor [-r hs] [-b] <zone name> <trust anchor file>"
 	echo "    performs an update of trust anchor file"
 	echo "    the trust anchor file is overwritten with the latest keys"
 	echo "    the trust anchor file should contain only keys for one zone"
@@ -16,13 +16,15 @@ usage ( )
 	echo "       without -b the file is made in unbound format."
 	echo "    "
 	echo "alternate:"
-	echo "    update-anchor [-b] -d directory"
+	echo "    update-anchor [-r hints] [-b] -d directory"
 	echo "    update all <zone>.anchor files in the directory."
 	echo "    "
 	echo "    name the files br.anchor se.anchor ..., and include them in"
 	echo "    the validating resolver config file."
 	echo "    put keys for the root in a file with the name root.anchor."
 	echo ""
+	echo "-r root.hints	use different root hints. Strict option order."
+	echo ""
 	echo "Exit code 0 means anchors updated, 1 no changes, others are errors."
 	exit 2
 }
@@ -32,6 +34,12 @@ if test $# -eq 0; then
 fi
 bindformat="no"
 filearg='-f'
+roothints=""
+if test X"$1" = "X-r"; then
+	shift
+	roothints="$1"
+	shift
+fi
 if test X"$1" = "X-b"; then
 	shift
 	bindformat="yes"
@@ -46,10 +54,15 @@ do_update ( ) {
 	# arguments: <zonename> <keyfile>
 	zonename="$1"
 	keyfile="$2"
-	tmp2=$tmpfile.2
-
 	tmpfile="/tmp/update-anchor.$$"
-	$ubhost -v $filearg "$keyfile" -t DNSKEY "$zonename" >$tmpfile
+	tmp2=$tmpfile.2
+	tmp3=$tmpfile.3
+	rh=""
+	if test -n "$roothints"; then
+		echo "server: root-hints: '$roothints'" > $tmp3
+		rh="-C $tmp3"
+	fi
+	$ubhost -v $rh $filearg "$keyfile" -t DNSKEY "$zonename" >$tmpfile
 	if test $? -ne 0; then
 		rm -f $tmpfile
 		echo "Error: Could not update zone $zonename anchor file $keyfile"
@@ -65,7 +78,7 @@ do_update ( ) {
 		rm -f $tmpfile
 		echo "Error: Could not update zone $zonename anchor file $keyfile"
 		echo "Cause: result of lookup was not secure" 
-		echo "    (keys too far out of date? domain changed ownership?)"
+		echo "    (keys too far out of date? domain changed ownership? need root hints?)"
 		return 3
 	fi
 
@@ -115,7 +128,7 @@ do_update ( ) {
 		echo "$zonename key file $keyfile unchanged."
 	fi
 
-	rm -f $tmpfile $tmp2
+	rm -f $tmpfile $tmp2 $tmp3
 }
 
 no_updated=1

doc/Changelog

@@ -1,5 +1,50 @@
+3 August 2009: Wouter
+	- nicer warning when algorithm not supported, tells you to upgrade.
+	- iana portlist updated.
+
+27 July 2009: Wouter
+	- Updated unbound-cacti contribution from Dmitriy Demidov, with
+	  the queue statistics displayed in its own graph.
+	- iana portlist updated.
+
+22 July 2009: Wouter
+	- Fix bug found by Michael Tokarev where unbound would try to
+	  prime the root servers even though forwarders are configured for
+	  the root.
+	- tagged 1.3.3rc1
+
+21 July 2009: Wouter
+	- Fix server selection, so that it waits for open target queries when
+	  faced with lameness.
+
+20 July 2009: Wouter
+	- Ignore transient sendto errors, no route to host, and host, net down.
+	- contrib/update-anchor.sh has -r option for root-hints.
+	- feature val-log-level: 1 prints validation failures so you can
+	  keep track of them during dnssec deployment.
+
+16 July 2009: Wouter
+	- fix replacement malloc code.  Used in crosscompile.
+	- makedist -w creates crosscompiled setup.exe on fedora11.
+
+15 July 2009: Wouter
+	- dependencies for compat items, for crosscompile.
+	- mingw32 crosscompile changes, dependencies and zipfile creation.
+	  and with System.dll from the windows NSIS you can make setup.exe.
+	- package libgcc_s_sjlj exception handler for NSISdl.dll.
+
+14 July 2009: Wouter
+	- updated ldns tarball for solaris x64 compile assistance.
+	- no need to define RAND_MAX from config.h.
+	- iana portlist updated.
+	- configure changes and ldns update for mingw32 crosscompile.
+
 13 July 2009: Wouter
 	- Fix for crash at start on windows.
+	- tag for release 1.3.2.
+	- trunk has version 1.3.3.
+	- Fix for ID bits on windows to use all 16. RAND_MAX was not
+	  defined like you'd expect on mingw. Reported by Mees de Roo.
 
 9 July 2009: Wouter
 	- tag for release 1.3.1.

doc/README

@@ -95,6 +95,9 @@ o If unbound-control (or munin graphs) do not work, this can often be because
   the unbound-control-setup script creates the keys with restricted 
   permissions, and the files need to be made readable or ownered by both the
   unbound daemon and unbound-control.
+o Crosscompile seems to hang.  You tried to install unbound under wine.
+  wine regedit and remove all the unbound entries from the registry or
+  delete .wine/drive_c.
 
 Acknowledgements
 ----------------

doc/TODO

@@ -142,6 +142,7 @@ Triggered by a trust anchor or by a signed DS record for a zone.
     The dnssec retry scheme works without this cache entry.
   * If the key cache entry 'being-backed-off' is true and isdata then:
 	The parent is backedoff, it must be the childs fault. Retry to child.
+	if the child-dnskey is bogus, then retry is useless, stop.
 	Perform a child-retry - purge dataonly, childside, mark
 	data-IPaddress from child as to avoid-forquery. counterperquery,
 	max is 3, if reached, set this data element RRset&msg to the 

doc/example.conf.in

@@ -342,6 +342,10 @@ server:
 	# replies if the message is found secure. The default is off.
 	# val-permissive-mode: no
 
+	# Have the validator log failed validations for your diagnosis.
+	# 0: off. 1: A line per failed user query.
+	# val-log-level: 0
+
 	# It is possible to configure NSEC3 maximum iteration counts per
 	# keysize. Keep this table very short, as linear search is done.
 	# A message with an NSEC3 with larger count is marked insecure.

doc/unbound.conf.5.in

@@ -563,6 +563,13 @@ indeterminate or unchecked are not affected. Default is yes. Use this setting
 to protect the users that rely on this validator for authentication from 
 protentially bad data in the additional section.
 .TP
+.B val\-log\-level: \fI<number>
+Have the validator print validation failures to the log.  Regardless of the
+verbosity setting.  Default is 0, off. At 1, for every user query that fails
+a line is printed to the logs.  This way you can monitor what happens with
+validation.  Use a diagnosis tool, such as dig or drill, to find out why 
+validation is failing for these queries.
+.TP
 .B val\-permissive\-mode: \fI<yes or no>
 Instruct the validator to mark bogus messages as indeterminate. The security
 checks are performed, but if the result is bogus (failed security), the

iterator/iter_fwd.c

@@ -345,6 +345,13 @@ forwards_lookup(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
 	return NULL;
 }
 
+struct delegpt* 
+forwards_lookup_root(struct iter_forwards* fwd, uint16_t qclass)
+{
+	uint8_t root = 0;
+	return forwards_lookup(fwd, &root, qclass);
+}
+
 size_t 
 forwards_get_mem(struct iter_forwards* fwd)
 {

iterator/iter_fwd.h

@@ -119,6 +119,15 @@ int forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg);
 struct delegpt* forwards_lookup(struct iter_forwards* fwd, 
 	uint8_t* qname, uint16_t qclass);
 
+/**
+ * Same as forwards_lookup, but for the root only
+ * @param fwd: forward storage.
+ * @param qclass: The qclass of the query.
+ * @return: A delegation point if root forward exists, otherwise null.
+ */
+struct delegpt* forwards_lookup_root(struct iter_forwards* fwd, 
+	uint16_t qclass);
+
 /**
  * Get memory in use by forward storage
  * @param fwd: forward storage.

iterator/iter_utils.c

@@ -233,7 +233,7 @@ iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
 static int
 iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
-	struct delegpt* dp, int* selected_rtt)
+	struct delegpt* dp, int* selected_rtt, int open_target)
 {
 	int got_num = 0, low_rtt = 0, swap_to_front;
 	struct delegpt_addr* a, *n, *prev=NULL;
@@ -244,7 +244,7 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 	if(got_num == 0) 
 		return 0;
 	if(low_rtt >= USEFUL_SERVER_TOP_TIMEOUT &&
-		delegpt_count_missing_targets(dp) > 0)
+		(delegpt_count_missing_targets(dp) > 0 || open_target > 0))
 		return 0; /* we want more choice. The best choice is a bad one.
 			     return 0 to force the caller to fetch more */
 
@@ -286,13 +286,13 @@ struct delegpt_addr*
 iter_server_selection(struct iter_env* iter_env, 
 	struct module_env* env, struct delegpt* dp, 
 	uint8_t* name, size_t namelen, uint16_t qtype, int* dnssec_expected,
-	int* chase_to_rd)
+	int* chase_to_rd, int open_target)
 {
 	int sel;
 	int selrtt;
 	struct delegpt_addr* a, *prev;
 	int num = iter_filter_order(iter_env, env, name, namelen, qtype,
-		*env->now, dp, &selrtt);
+		*env->now, dp, &selrtt, open_target);
 
 	if(num == 0)
 		return NULL;

iterator/iter_utils.h

@@ -79,13 +79,15 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
  *	these are not preferred, but are used as a last resort.
  * @param chase_to_rd: set to 1 if a known recursion lame server is selected
  * 	these are not preferred, but are used as a last resort.
+ * @param open_target: number of currently outstanding target queries.
+ * 	If we wait for these, perhaps more server addresses become available.
  * @return best target or NULL if no target.
  *	if not null, that target is removed from the result list in the dp.
  */
 struct delegpt_addr* iter_server_selection(struct iter_env* iter_env, 
 	struct module_env* env, struct delegpt* dp, uint8_t* name, 
 	size_t namelen, uint16_t qtype, int* dnssec_expected,
-	int* chase_to_rd);
+	int* chase_to_rd, int open_target);
 
 /**
  * Allocate dns_msg from parsed msg, in regional.

iterator/iterator.c

@@ -951,6 +951,25 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* If the cache has returned nothing, then we have a 
 		 * root priming situation. */
 		if(iq->dp == NULL) {
+			if(forwards_lookup_root(qstate->env->fwds, 
+				iq->qchase.qclass)) {
+				/* forward zone root, no root prime needed */
+				/* fill in some dp - safety belt */
+				iq->dp = hints_lookup_root(ie->hints, 
+					iq->qchase.qclass);
+				if(!iq->dp) {
+					log_err("internal error: no hints dp");
+					return error_response(qstate, id, 
+						LDNS_RCODE_SERVFAIL);
+				}
+				iq->dp = delegpt_copy(iq->dp, qstate->region);
+				if(!iq->dp) {
+					log_err("out of memory in safety belt");
+					return error_response(qstate, id, 
+						LDNS_RCODE_SERVFAIL);
+				}
+				return next_state(iq, INIT_REQUEST_2_STATE);
+			}
 			/* Note that the result of this will set a new
 			 * DelegationPoint based on the result of priming. */
 			if(!prime_root(qstate, iq, ie, id, iq->qchase.qclass))
@@ -1326,7 +1345,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	/* Select the next usable target, filtering out unsuitable targets. */
 	target = iter_server_selection(ie, qstate->env, iq->dp, 
 		iq->dp->name, iq->dp->namelen, iq->qchase.qtype,
-		&iq->dnssec_expected, &iq->chase_to_rd);
+		&iq->dnssec_expected, &iq->chase_to_rd, iq->num_target_queries);
 
 	/* If no usable target was selected... */
 	if(!target) {

makedist.sh

@@ -107,6 +107,27 @@ replace_all () {
     replace_text "$1" "@date@" "`date +'%b %e, %Y'`"
 }
     
+check_svn_root () {
+    # Check if SVNROOT is specified.
+    if [ -z "$SVNROOT" ]; then
+	if test -f .svn/entries; then
+	      eval `svn info | grep 'URL:' | sed -e 's/URL: /url=/' | head -1`
+	      SVNROOT="$url"
+	fi
+	if test -z "$SVNROOT"; then
+	    error "SVNROOT must be specified (using -d)"
+	fi
+    fi
+}
+
+create_temp_dir () {
+    # Creating temp directory
+    info "Creating temporary working directory"
+    temp_dir=`mktemp -d unbound-dist-XXXXXX`
+    info "Directory '$temp_dir' created."
+    cd $temp_dir
+}
+
 
 SNAPSHOT="no"
 RC="no"
@@ -147,6 +168,30 @@ while [ "$1" ]; do
 done
 
 if [ "$DOWIN" = "yes" ]; then
+    # detect crosscompile, from Fedora11 at this point.
+    if test "`uname`" = "Linux"; then 
+	info "Crosscompile windows dist"
+        cross="yes"
+	configure="mingw32-configure"
+	strip="i686-pc-mingw32-strip"
+	makensis="makensis"	# from mingw32-nsis package
+
+	check_svn_root
+	create_temp_dir
+	info "Exporting source from SVN."
+	svn export "$SVNROOT" unbound || error_cleanup "SVN command failed"
+	cd unbound || error_cleanup "Unbound not exported correctly from SVN"
+
+	# on a re-configure the cache may no longer be valid...
+	if test -f mingw32-config.cache; then rm mingw32-config.cache; fi
+    else 
+	cross="no"	# mingw and msys
+	configure="./configure"
+	strip="strip"
+	makensis="c:/Program Files/NSIS/makensis.exe" # http://nsis.sf.net
+    fi
+
+    # version gets compiled into source, edit the configure to set  it
     version=`./configure --version | head -1 | awk '{ print $3 }'` \
 	|| error_cleanup "Cannot determine version number."
     if [ "$RC" != "no" -o "$SNAPSHOT" != "no" ]; then
@@ -168,8 +213,8 @@ if [ "$DOWIN" = "yes" ]; then
     # procedure for making unbound installer on mingw. 
     info "Creating windows dist unbound $version"
     info "Calling configure"
-    echo './configure --enable-debug --enable-static-exe '"$*"
-    ./configure --enable-debug --enable-static-exe $* \
+    echo "$configure"' --enable-debug --enable-static-exe '"$*"
+    $configure --enable-debug --enable-static-exe $* \
 	|| error_cleanup "Could not configure"
     info "Calling make"
     make || error_cleanup "Could not make"
@@ -180,13 +225,13 @@ if [ "$DOWIN" = "yes" ]; then
     rm -f $file
     info "Creating $file"
     mkdir tmp.$$
-    strip unbound.exe
-    strip anchor-update.exe
-    strip unbound-control.exe
-    strip unbound-host.exe
-    strip unbound-checkconf.exe
-    strip unbound-service-install.exe
-    strip unbound-service-remove.exe
+    $strip unbound.exe
+    $strip anchor-update.exe
+    $strip unbound-control.exe
+    $strip unbound-host.exe
+    $strip unbound-checkconf.exe
+    $strip unbound-service-install.exe
+    $strip unbound-service-remove.exe
     cd tmp.$$
     cp ../doc/example.conf example.conf
     cp ../unbound.exe ../unbound-host.exe ../unbound-control.exe ../unbound-checkconf.exe ../unbound-service-install.exe ../unbound-service-remove.exe ../LICENSE ../winrc/unbound-website.url ../winrc/service.conf ../winrc/README.txt .
@@ -198,28 +243,23 @@ if [ "$DOWIN" = "yes" ]; then
     info "Creating installer"
     quadversion=`cat ../config.h | grep RSRC_PACKAGE_VERSION | sed -e 's/#define RSRC_PACKAGE_VERSION //' -e 's/,/\\./g'`
     cat ../winrc/setup.nsi | sed -e 's/define VERSION.*$/define VERSION "'$version'"/' -e 's/define QUADVERSION.*$/define QUADVERSION "'$quadversion'"/' > ../winrc/setup_ed.nsi
-    # get tool from http://nsis.sf.net
-    c:/Program\ Files/NSIS/makensis.exe ../winrc/setup_ed.nsi
+    "$makensis" ../winrc/setup_ed.nsi
     info "Created installer"
     cd ..
     rm -rf tmp.$$
     mv winrc/unbound_setup_$version.exe .
+    if test "$cross" = "yes"; then
+	    mv unbound_setup_$version.exe $cwd/.
+	    mv unbound-$version.zip $cwd/.
+	    cleanup
+    fi
     ls -lG unbound_setup_$version.exe
     ls -lG unbound-$version.zip
     info "Done"
     exit 0
 fi
 
-# Check if SVNROOT is specified.
-if [ -z "$SVNROOT" ]; then
-    if test -f .svn/entries; then
-	  eval `svn info | grep 'URL:' | sed -e 's/URL: /url=/' | head -1`
-	  SVNROOT="$url"
-    fi
-    if test -z "$SVNROOT"; then
-	error "SVNROOT must be specified (using -d)"
-    fi
-fi
+check_svn_root
 # Check if LDNSDIR is specified.
 if test -z "$LDNSDIR"; then
     # try to autodetect from Makefile (if present)
@@ -237,12 +277,7 @@ info "SNAPSHOT is $SNAPSHOT"
 
 #question "Do you wish to continue with these settings?" || error "User abort."
 
-
-# Creating temp directory
-info "Creating temporary working directory"
-temp_dir=`mktemp -d unbound-dist-XXXXXX`
-info "Directory '$temp_dir' created."
-cd $temp_dir
+create_temp_dir
 
 info "Exporting source from SVN."
 svn export "$SVNROOT" unbound || error_cleanup "SVN command failed"

smallapp/unbound-checkconf.c

@@ -175,6 +175,7 @@ print_option(struct config_file* cfg, const char* opt)
 	else O_STR(opt, "dlv-anchor-file", dlv_anchor_file)
 	else O_DEC(opt, "val-bogus-ttl", bogus_ttl)
 	else O_YNO(opt, "val-clean-additional", val_clean_additional)
+	else O_DEC(opt, "val-log-level", val_log_level)
 	else O_YNO(opt, "val-permissive-mode", val_permissive_mode)
 	else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
 	else O_MEM(opt, "key-cache-size", key_cache_size)

testcode/delayer.c

@@ -360,7 +360,7 @@ service_send(struct ringbuf* ring, struct timeval* now, ldns_buffer* pkt,
 			(unsigned)tv.tv_sec, (unsigned)tv.tv_usec);
 		log_addr(1, "from client", &p->addr, p->addr_len);
 		/* send it */
-		sent = sendto(p->s, ldns_buffer_begin(pkt), 
+		sent = sendto(p->s, (void*)ldns_buffer_begin(pkt), 
 			ldns_buffer_limit(pkt), 0, 
 			(struct sockaddr*)srv_addr, srv_len);
 		if(sent == -1) {
@@ -384,7 +384,7 @@ do_proxy(struct proxy* p, int retsock, ldns_buffer* pkt)
 	int i;
 	ssize_t r;
 	for(i=0; i<TRIES_PER_SELECT; i++) {
-		r = recv(p->s, ldns_buffer_begin(pkt), 
+		r = recv(p->s, (void*)ldns_buffer_begin(pkt), 
 			ldns_buffer_capacity(pkt), 0);
 		if(r == -1) {
 #ifndef USE_WINSOCK
@@ -403,8 +403,8 @@ do_proxy(struct proxy* p, int retsock, ldns_buffer* pkt)
 		log_addr(1, "return reply to client", &p->addr, p->addr_len);
 		/* send reply back to the real client */
 		p->numreturn++;
-		r = sendto(retsock, ldns_buffer_begin(pkt), (size_t)r, 0,
-			(struct sockaddr*)&p->addr, p->addr_len);
+		r = sendto(retsock, (void*)ldns_buffer_begin(pkt), (size_t)r, 
+			0, (struct sockaddr*)&p->addr, p->addr_len);
 		if(r == -1) {
 #ifndef USE_WINSOCK
 			log_err("sendto: %s", strerror(errno));
@@ -492,7 +492,7 @@ service_recv(int s, struct ringbuf* ring, ldns_buffer* pkt,
 	struct proxy* p;
 	for(i=0; i<TRIES_PER_SELECT; i++) {
 		from_len = (socklen_t)sizeof(from);
-		len = recvfrom(s, ldns_buffer_begin(pkt),
+		len = recvfrom(s, (void*)ldns_buffer_begin(pkt),
 			ldns_buffer_capacity(pkt), 0,
 			(struct sockaddr*)&from, &from_len);
 		if(len < 0) {
@@ -636,7 +636,7 @@ tcp_relay_read(int s, struct tcp_send_list** first,
 	struct timeval* delay, ldns_buffer* pkt)
 {
 	struct tcp_send_list* item;
-	ssize_t r = recv(s, ldns_buffer_begin(pkt), 
+	ssize_t r = recv(s, (void*)ldns_buffer_begin(pkt), 
 		ldns_buffer_capacity(pkt), 0);
 	if(r == -1) {
 #ifndef USE_WINSOCK

testcode/perf.c

@@ -272,7 +272,7 @@ static void
 perfsend(struct perfinfo* info, size_t n, struct timeval* now)
 {
 	ssize_t r;
-	r = sendto(info->io[n].fd, info->qlist_data[info->qlist_idx],
+	r = sendto(info->io[n].fd, (void*)info->qlist_data[info->qlist_idx],
 		info->qlist_len[info->qlist_idx], 0,
 		(struct sockaddr*)&info->dest, info->destlen);
 	/*log_hex("send", info->qlist_data[info->qlist_idx],
@@ -299,7 +299,7 @@ static void
 perfreply(struct perfinfo* info, size_t n, struct timeval* now)
 {
 	ssize_t r;
-	r = recv(info->io[n].fd, ldns_buffer_begin(info->buf),
+	r = recv(info->io[n].fd, (void*)ldns_buffer_begin(info->buf),
 		ldns_buffer_capacity(info->buf), 0);
 	if(r == -1) {
 #ifndef USE_WINSOCK

testcode/streamtcp.c

@@ -137,7 +137,7 @@ write_q(int fd, int udp, ldns_buffer* buf, int id,
 			exit(1);
 		}
 	}
-	if(send(fd, ldns_buffer_begin(buf), ldns_buffer_limit(buf), 0) < 
+	if(send(fd, (void*)ldns_buffer_begin(buf), ldns_buffer_limit(buf), 0) < 
 		(ssize_t)ldns_buffer_limit(buf)) {
 #ifndef USE_WINSOCK
 		perror("send() data failed");
@@ -170,7 +170,8 @@ recv_one(int fd, int udp, ldns_buffer* buf)
 		len = ntohs(len);
 		ldns_buffer_clear(buf);
 		ldns_buffer_set_limit(buf, len);
-		if(recv(fd, ldns_buffer_begin(buf), len, 0) < (ssize_t)len) {
+		if(recv(fd, (void*)ldns_buffer_begin(buf), len, 0) < 
+			(ssize_t)len) {
 #ifndef USE_WINSOCK
 			perror("read() data failed");
 #else
@@ -182,7 +183,7 @@ recv_one(int fd, int udp, ldns_buffer* buf)
 	} else {
 		ssize_t l;
 		ldns_buffer_clear(buf);
-		if((l=recv(fd, ldns_buffer_begin(buf), 
+		if((l=recv(fd, (void*)ldns_buffer_begin(buf), 
 			ldns_buffer_capacity(buf), 0)) < 0) {
 #ifndef USE_WINSOCK
 			perror("read() data failed");

testcode/unitmain.c

@@ -407,7 +407,7 @@ rnd_test()
 	for(i=0; i<num; i++) {
 		a[i] = ub_random(r);
 		unit_assert(a[i] >= 0);
-		unit_assert((size_t)a[i] <= (size_t)RAND_MAX);
+		unit_assert((size_t)a[i] <= (size_t)0x7fffffff);
 		if(i > 5)
 			unit_assert(a[i] != a[i-1] || a[i] != a[i-2] ||
 				a[i] != a[i-3] || a[i] != a[i-4] ||

testdata/iter_dnsseclame_bug.rpl

@@ -0,0 +1,465 @@
+; config options
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+
+CONFIG_END
+
+SCENARIO_BEGIN Bug test dnssec-lame detection at ds point with target queries.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN A
+SECTION AUTHORITY
+net.	IN NS	e.gtld-servers.net.
+SECTION ADDITIONAL
+e.gtld-servers.net.	IN 	A	192.12.94.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.net. IN AAAA
+SECTION AUTHORITY
+net.	IN NS	e.gtld-servers.net.
+SECTION ADDITIONAL
+e.gtld-servers.net.	IN 	A	192.12.94.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com. IN A	1.2.3.55
+ENTRY_END
+RANGE_END
+
+; e.gtld-servers.net.
+; Note this timing is so it will provide answers at the beginning.
+RANGE_BEGIN 0 30
+	ADDRESS 192.12.94.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN NS
+SECTION ANSWER
+net.	IN NS	e.gtld-servers.net.
+SECTION ADDITIONAL
+e.gtld-servers.net.	IN 	A	192.12.94.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+e.gtld-servers.net. IN AAAA
+SECTION ANSWER
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.gtld-servers.net. IN AAAA
+SECTION ANSWER
+ENTRY_END
+
+; no example.net delegation answers yet.
+
+RANGE_END
+
+; e.gtld-servers.net.
+; Note this timing is so it will not provide answers at the beginning,
+; but only later on.
+RANGE_BEGIN 30 100
+	ADDRESS 192.12.94.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN NS
+SECTION ANSWER
+net.	IN NS	e.gtld-servers.net.
+SECTION ADDITIONAL
+e.gtld-servers.net.	IN 	A	192.12.94.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+e.gtld-servers.net. IN AAAA
+SECTION ANSWER
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.gtld-servers.net. IN AAAA
+SECTION ANSWER
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.net. IN A
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.net. IN AAAA
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.44
+ENTRY_END
+RANGE_END
+
+; ns.example.net.
+; Note this timing is so it will not provide answers at the beginning,
+; but only later on.
+RANGE_BEGIN 30 100
+	ADDRESS 1.2.3.44
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN NS
+SECTION ANSWER
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.net. IN A
+SECTION ANSWER
+ns.example.net. IN A	1.2.3.44
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.net. IN AAAA
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net. IN A	1.2.3.44
+ENTRY_END
+
+; response to DNSKEY priming query
+; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
+SECTION AUTHORITY
+; no NS set. not needed for this test.
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN NS ns.sub.example.com.
+sub.example.com. IN NS ns.example.net.
+sub.example.com.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. C/0b+sqlsdSTkhd+aDXb6ELyuQreosIGBzLCtWxYGD+Q9QGB5rN8uB+4+48yhw36pd3MfeAn06AgAnJ6eu8tJg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A       11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN AAAA
+SECTION ANSWER
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.55
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com. IN A	1.2.3.55
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.com. IN A
+SECTION ANSWER
+ns.example.com. IN A	1.2.3.55
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+ENTRY_END
+
+; fine DNSKEY response.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION 
+example.com. IN DNSKEY  
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+ENTRY_END
+
+
+; correct delegation with DS
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN NS ns.sub.example.com.
+sub.example.com. IN NS ns.example.net.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+; response for delegation to sub.example.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION 
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN NS ns.sub.example.com.
+sub.example.com. IN NS ns.example.net.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+RANGE_END
+
+; This server is DNSSEC LAME!
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+        ADDRESS 1.2.3.6
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN NS ns.sub.example.com.
+sub.example.com. IN NS ns.example.net.
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+
+; response to DNSKEY priming query
+; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+SECTION AUTHORITY
+sub.example.com. IN     NS ns.sub.example.com.
+sub.example.com. IN     NS ns.example.net.
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN AAAA
+SECTION ANSWER
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A       11.11.11.11
+SECTION AUTHORITY
+; dnssec-lameness detection depends on this information
+sub.example.com. IN     NS ns.sub.example.com.
+sub.example.com. IN     NS ns.example.net.
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+RANGE_END
+
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+STEP 10 NOTHING
+; recursion at time 10.
+; first recursion with answers in 0-30 time
+; with bug it now resolves to the bad version
+; fixed, it stops waiting for more target queries.
+
+STEP 40 NOTHING
+; next recursion with more answers at time 40.
+
+; recursion happens here.
+STEP 50 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD DO NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A       11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+ENTRY_END
+SCENARIO_END

testdata/iter_fwdstubroot.rpl

@@ -0,0 +1,175 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+forward-zone:
+	name: "."
+	forward-addr: 10.0.0.1
+stub-zone:
+	name: "sub.example.com"
+	stub-addr: 10.0.0.2
+CONFIG_END
+
+SCENARIO_BEGIN Test iterative resolve with a stub under a forward root zone
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+
+; No answers from the actual root, blocked.
+
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; forwarder for example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 10.0.0.1
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.0.0.4
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+; fail all other queries
+ENTRY_BEGIN
+MATCH opcode 
+ADJUST copy_id copy_query
+REPLY QR SERVFAIL
+SECTION QUESTION
+example.com. IN A
+ENTRY_END
+RANGE_END
+
+; stub for sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 10.0.0.2
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com.	IN NS	ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com.		IN 	A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	10.0.0.5
+SECTION AUTHORITY
+sub.example.com.	IN NS	ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com.		IN 	A	1.2.3.44
+ENTRY_END
+RANGE_END
+
+; try to resolve from stub zone
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	10.0.0.5
+SECTION AUTHORITY
+sub.example.com.	IN NS	ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com.		IN 	A	1.2.3.44
+ENTRY_END
+
+SCENARIO_END

util/config_file.c

@@ -155,6 +155,7 @@ config_create()
 	cfg->val_sig_skew_min = 3600; /* at least daylight savings trouble */
 	cfg->val_sig_skew_max = 86400; /* at most timezone settings trouble */
 	cfg->val_clean_additional = 1;
+	cfg->val_log_level = 0;
 	cfg->val_permissive_mode = 0;
 	cfg->key_cache_size = 4 * 1024 * 1024;
 	cfg->key_cache_slabs = 4;
@@ -375,6 +376,9 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	} else if(strcmp(opt, "val-clean-additional:") == 0) {
 		IS_YES_OR_NO;
 		cfg->val_clean_additional = (strcmp(val, "yes") == 0);
+	} else if(strcmp(opt, "val-log-level:") == 0) {
+		IS_NUMBER_OR_ZERO;
+		cfg->val_log_level = atoi(val);
 	} else if(strcmp(opt, "val-permissive-mode:") == 0) {
 		IS_YES_OR_NO;
 		cfg->val_permissive_mode = (strcmp(val, "yes") == 0);
@@ -1034,12 +1038,14 @@ char* cfg_ptr_reverse(char* str)
 	 * IPv6: (h.){32}.ip6.arpa.  */
 
 	if(addr_is_ip6(&addr, addrlen)) {
-		void* ad = &((struct sockaddr_in6*)&addr)->sin6_addr;
+		uint8_t ad[16];
 		const char* hex = "0123456789abcdef";
 		char *p = buf;
 		int i;
+		memmove(ad, &((struct sockaddr_in6*)&addr)->sin6_addr, 
+			sizeof(ad));
 		for(i=15; i>=0; i--) {
-			uint8_t b = ((uint8_t*)ad)[i];
+			uint8_t b = ad[i];
 			*p++ = hex[ (b&0x0f) ];
 			*p++ = '.';
 			*p++ = hex[ (b&0xf0) >> 4 ];
@@ -1047,10 +1053,12 @@ char* cfg_ptr_reverse(char* str)
 		}
 		snprintf(buf+16*4, sizeof(buf)-16*4, "ip6.arpa. ");
 	} else {
-		struct in_addr* ad = &((struct sockaddr_in*)&addr)->sin_addr;
+		uint8_t ad[4];
+		memmove(ad, &((struct sockaddr_in*)&addr)->sin_addr, 
+			sizeof(ad));
 		snprintf(buf, sizeof(buf), "%u.%u.%u.%u.in-addr.arpa. ",
-		(unsigned)((uint8_t*)ad)[3], (unsigned)((uint8_t*)ad)[2],
-		(unsigned)((uint8_t*)ad)[1], (unsigned)((uint8_t*)ad)[0]);
+			(unsigned)ad[3], (unsigned)ad[2],
+			(unsigned)ad[1], (unsigned)ad[0]);
 	}
 
 	/* printed the reverse address, now the between goop and name on end */

util/config_file.h

@@ -213,6 +213,8 @@ struct config_file {
 	int bogus_ttl; 
 	/** should validator clean additional section for secure msgs */
 	int val_clean_additional;
+	/** log bogus messages by the validator */
+	int val_log_level;
 	/** should validator allow bogus messages to go through */
 	int val_permissive_mode;
 	/** nsec3 maximum iterations per key size, string */

util/configlexer.lex

@@ -199,6 +199,7 @@ val-sig-skew-max{COLON}		{ YDVAR(1, VAR_VAL_SIG_SKEW_MAX) }
 val-bogus-ttl{COLON}		{ YDVAR(1, VAR_BOGUS_TTL) }
 val-clean-additional{COLON}	{ YDVAR(1, VAR_VAL_CLEAN_ADDITIONAL) }
 val-permissive-mode{COLON}	{ YDVAR(1, VAR_VAL_PERMISSIVE_MODE) }
+val-log-level{COLON}		{ YDVAR(1, VAR_VAL_LOG_LEVEL) }
 key-cache-size{COLON}		{ YDVAR(1, VAR_KEY_CACHE_SIZE) }
 key-cache-slabs{COLON}		{ YDVAR(1, VAR_KEY_CACHE_SLABS) }
 neg-cache-size{COLON}		{ YDVAR(1, VAR_NEG_CACHE_SIZE) }

util/configparser.h

@@ -143,7 +143,8 @@
      VAR_PYTHON_SCRIPT = 359,
      VAR_VAL_SIG_SKEW_MIN = 360,
      VAR_VAL_SIG_SKEW_MAX = 361,
-     VAR_CACHE_MIN_TTL = 362
+     VAR_CACHE_MIN_TTL = 362,
+     VAR_VAL_LOG_LEVEL = 363
    };
 #endif
 /* Tokens.  */
@@ -252,6 +253,7 @@
 #define VAR_VAL_SIG_SKEW_MIN 360
 #define VAR_VAL_SIG_SKEW_MAX 361
 #define VAR_CACHE_MIN_TTL 362
+#define VAR_VAL_LOG_LEVEL 363
 
 
 
@@ -268,7 +270,7 @@ typedef union YYSTYPE
 
 
 /* Line 1676 of yacc.c  */
-#line 272 "util/configparser.h"
+#line 274 "util/configparser.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */

util/configparser.y

@@ -98,7 +98,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_EXTENDED_STATISTICS VAR_LOCAL_DATA_PTR VAR_JOSTLE_TIMEOUT
 %token VAR_STUB_PRIME VAR_UNWANTED_REPLY_THRESHOLD VAR_LOG_TIME_ASCII
 %token VAR_DOMAIN_INSECURE VAR_PYTHON VAR_PYTHON_SCRIPT VAR_VAL_SIG_SKEW_MIN
-%token VAR_VAL_SIG_SKEW_MAX VAR_CACHE_MIN_TTL
+%token VAR_VAL_SIG_SKEW_MAX VAR_CACHE_MIN_TTL VAR_VAL_LOG_LEVEL
 
 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -148,7 +148,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_local_data_ptr | server_jostle_timeout | 
 	server_unwanted_reply_threshold | server_log_time_ascii | 
 	server_domain_insecure | server_val_sig_skew_min | 
-	server_val_sig_skew_max | server_cache_min_ttl
+	server_val_sig_skew_max | server_cache_min_ttl | server_val_log_level
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -846,6 +846,14 @@ server_val_permissive_mode: VAR_VAL_PERMISSIVE_MODE STRING_ARG
 		free($2);
 	}
 	;
+server_val_log_level: VAR_VAL_LOG_LEVEL STRING_ARG
+	{
+		OUTYY(("P(server_val_log_level:%s)\n", $2));
+		if(atoi($2) == 0 && strcmp($2, "0") != 0)
+			yyerror("number expected");
+		else cfg_parser->cfg->val_log_level = atoi($2);
+	}
+	;
 server_val_nsec3_keysize_iterations: VAR_VAL_NSEC3_KEYSIZE_ITERATIONS STRING_ARG
 	{
 		OUTYY(("P(server_val_nsec3_keysize_iterations:%s)\n", $2));

util/iana_ports.inc

@@ -223,6 +223,7 @@
 267,
 268,
 269,
+270,
 280,
 281,
 282,
@@ -5003,6 +5004,7 @@
 16367,
 16368,
 16384,
+16900,
 16950,
 16991,
 16992,
@@ -5053,6 +5055,7 @@
 20005,
 20014,
 20034,
+20046,
 20049,
 20167,
 20202,

util/netevent.c

@@ -246,13 +246,30 @@ comm_point_send_udp_msg(struct comm_point *c, ldns_buffer* packet,
 		log_err("error: send empty UDP packet");
 #endif
 	log_assert(addr && addrlen > 0);
-	sent = sendto(c->fd, ldns_buffer_begin(packet), 
+	sent = sendto(c->fd, (void*)ldns_buffer_begin(packet), 
 		ldns_buffer_remaining(packet), 0,
 		addr, addrlen);
 	if(sent == -1) {
-#ifdef ENETUNREACH
-		if(errno == ENETUNREACH && verbosity < VERB_ALGO)
-			return 0;
+		/* do not log transient errors (unless high verbosity) */
+#if defined(ENETUNREACH) || defined(EHOSTDOWN) || defined(EHOSTUNREACH) || defined(ENETDOWN)
+		switch(errno) {
+#  ifdef ENETUNREACH
+			case ENETUNREACH:
+#  endif
+#  ifdef EHOSTDOWN
+			case EHOSTDOWN:
+#  endif
+#  ifdef EHOSTUNREACH
+			case EHOSTUNREACH:
+#  endif
+#  ifdef ENETDOWN
+			case ENETDOWN:
+#  endif
+				if(verbosity < VERB_ALGO)
+					return 0;
+			default:
+				break;
+		}
 #endif
 		/* squelch errors where people deploy AAAA ::ffff:bla for
 		 * authority servers, which we try for intranets. */
@@ -530,7 +547,7 @@ comm_point_udp_callback(int fd, short event, void* arg)
 		rep.addrlen = (socklen_t)sizeof(rep.addr);
 		log_assert(fd != -1);
 		log_assert(ldns_buffer_remaining(rep.c->buffer) > 0);
-		recv = recvfrom(fd, ldns_buffer_begin(rep.c->buffer), 
+		recv = recvfrom(fd, (void*)ldns_buffer_begin(rep.c->buffer), 
 			ldns_buffer_remaining(rep.c->buffer), 0, 
 			(struct sockaddr*)&rep.addr, &rep.addrlen);
 		if(recv == -1) {
@@ -711,7 +728,7 @@ comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok)
 	log_assert(fd != -1);
 	if(c->tcp_byte_count < sizeof(uint16_t)) {
 		/* read length bytes */
-		r = recv(fd, ldns_buffer_at(c->buffer, c->tcp_byte_count), 
+		r = recv(fd,(void*)ldns_buffer_at(c->buffer,c->tcp_byte_count),
 			sizeof(uint16_t)-c->tcp_byte_count, 0);
 		if(r == 0)
 			return 0;
@@ -760,7 +777,7 @@ comm_point_tcp_handle_read(int fd, struct comm_point* c, int short_ok)
 	}
 
 	log_assert(ldns_buffer_remaining(c->buffer) > 0);
-	r = recv(fd, ldns_buffer_current(c->buffer), 
+	r = recv(fd, (void*)ldns_buffer_current(c->buffer), 
 		ldns_buffer_remaining(c->buffer), 0);
 	if(r == 0) {
 		return 0;
@@ -902,7 +919,7 @@ comm_point_tcp_handle_write(int fd, struct comm_point* c)
 		}
 	}
 	log_assert(ldns_buffer_remaining(c->buffer) > 0);
-	r = send(fd, ldns_buffer_current(c->buffer), 
+	r = send(fd, (void*)ldns_buffer_current(c->buffer), 
 		ldns_buffer_remaining(c->buffer), 0);
 	if(r == -1) {
 #ifndef USE_WINSOCK

util/random.c

@@ -78,6 +78,12 @@ struct ub_randstate {
 /** Size of key to use */
 #define SEED_SIZE 20
 
+/** 
+ * Max random value.  Similar to RAND_MAX, but more portable
+ * (mingw uses only 15 bits random).
+ */
+#define MAX_VALUE 0x7fffffff
+
 /** Number of bytes to reseed after */
 #define REKEY_BYTES	(1 << 24)
 
@@ -168,7 +174,7 @@ ub_random(struct ub_randstate* s)
 	RC4(&s->rc4, sizeof(r), 
 		(unsigned char *)&r, (unsigned char *)&r);
 	s->rc4_ready -= sizeof(r);
-	return (long int)((r) % (((unsigned)RAND_MAX + 1)));
+	return (long int)((r) % (((unsigned)MAX_VALUE + 1)));
 }
 
 void 

util/winsock_event.c

@@ -76,6 +76,7 @@ settime(struct event_base* base)
         return 0;
 }
 
+#ifdef UNBOUND_DEBUG
 /**
  * Find a fd in the list of items.
  * Note that not all items have a fd associated (those are -1).
@@ -94,9 +95,10 @@ find_fd(struct event_base* base, int fd)
 	}
 	return -1;
 }
+#endif
 
 /** Find ptr in base array */
-static int
+static void
 zero_waitfor(WSAEVENT waitfor[], WSAEVENT x)
 {
 	int i;

validator/val_anchor.c

@@ -915,7 +915,8 @@ anchors_assemble_rrsets(struct val_anchors* anchors)
 			char b[257];
 			dname_str(ta->name, b);
 			log_warn("trust anchor %s has no supported algorithms,"
-				" the anchor is ignored", b);
+				" the anchor is ignored (check if you need to"
+				" upgrade unbound and openssl)", b);
 			(void)rbtree_delete(anchors->tree, &ta->node);
 		}
 		ta = next;

validator/validator.c

@@ -1796,6 +1796,9 @@ processFinished(struct module_qstate* qstate, struct val_qstate* vq,
 	 * endless bogus revalidation */
 	if(vq->orig_msg->rep->security == sec_status_bogus) {
 		vq->orig_msg->rep->ttl = *qstate->env->now + ve->bogus_ttl;
+		if(qstate->env->cfg->val_log_level >= 1) {
+			log_query_info(0, "validation failure", &qstate->qinfo);
+		}
 		/* If we are in permissive mode, bogus gets indeterminate */
 		if(ve->permissive_mode)
 			vq->orig_msg->rep->security = sec_status_indeterminate;
@@ -2102,7 +2105,7 @@ primeResponseToKE(int rcode, struct dns_msg* msg, struct trust_anchor* ta,
 
 	if(sec != sec_status_secure) {
 		log_nametypeclass(VERB_OPS, "failed to prime trust anchor -- "
-			"could not fetch secure DNSKEY rrset", 
+			"DNSKEY rrset is not secure", 
 			ta->name, LDNS_RR_TYPE_DNSKEY, ta->dclass);
 		/* NOTE: in this case, we should probably reject the trust 
 		 * anchor for longer, perhaps forever. */

winrc/README.txt

@@ -79,6 +79,28 @@ Unbound and its utilities also work from the commandline (like on unix) if
 you prefer.
 
 
++++ Cross compile
+
+You can crosscompile unbound.  This results in .exe files.
+Install the packages: mingw32-binutils mingw32-cpp mingw32-filesystem 
+mingw32-gcc mingw32-openssl mingw32-openssl-static mingw32-runtime zip
+mingw32-termcap mingw32-w32api mingw32-zlib mingw32-zlib-static mingw32-nsis
+(package names for fedora 11).
+
+For dynamic linked executables
+$ mingw32-configure
+$ make
+$ mkdir /home/user/installdir
+$ make install DESTDIR=/home/user/installdir
+Find the dlls and exes in /home/user/installdir and
+crypto in /usr/i686-pc-mingw32/sys-root/mingw/bin
+
+For static linked executables
+Use --enable-staticexe for mingw32-configure, see above. Or use makedist.sh,
+copy System.dll from the windows dist of NSIS to /usr/share/nsis/Plugins/
+Then do ./makedist.sh -w and the setup.exe is created using nsis.
+
+
 +++ CREDITS
 
 Unbound was written in portable C by Wouter Wijngaards (NLnet Labs).

winrc/setup.nsi

@@ -4,7 +4,6 @@ SetCompressor /solid /final lzma
 
 !include LogicLib.nsh
 !include MUI2.nsh
-!include setup_servicelib.nsh
 
 !define VERSION "0.0.0"
 !define QUADVERSION "0.0.0.0"
@@ -33,8 +32,8 @@ Var StartMenuFolder
 #ReserveFile "System.dll"
 #ReserveFile "NsExec.dll"
 
-!define MUI_ICON "${NSISDIR}\contrib\graphics\icons\orange-install-nsis.ico"
-!define MUI_UNICON "${NSISDIR}\contrib\graphics\icons\orange-uninstall-nsis.ico"
+!define MUI_ICON "${NSISDIR}\Contrib\Graphics\Icons\orange-install-nsis.ico"
+!define MUI_UNICON "${NSISDIR}\Contrib\Graphics\Icons\orange-uninstall-nsis.ico"
 
 !define MUI_HEADERIMAGE
 !define MUI_HEADERIMAGE_RIGHT
@@ -75,6 +74,10 @@ section "DLV - dlv.isc.org" SectionDLV
 	# add estimated size for key (Kb)
 	AddSize 2
 	SetOutPath $INSTDIR
+
+	# libgcc exception lib used by NSISdl plugin (in crosscompile).
+	File /nonfatal "/oname=$PLUGINSDIR\libgcc_s_sjlj-1.dll" "/usr/i686-pc-mingw32/sys-root/mingw/bin/libgcc_s_sjlj-1.dll"
+
 	NSISdl::download "http://ftp.isc.org/www/dlv/dlv.isc.org.key" "$INSTDIR\dlv.isc.org.key"
 	Pop $R0 # result from Inetc::get
 	${If} $R0 != "success"
@@ -144,7 +147,7 @@ section "-hidden.postinstall"
 	# install service entry
 	nsExec::ExecToLog '"$INSTDIR\unbound-service-install.exe"'
 	# start unbound service
-	!insertmacro SERVICE "start" "unbound" ""
+	nsExec::ExecToLog '"$INSTDIR\unbound-service-install.exe" start'
 sectionEnd
 
 # set section descriptions
@@ -157,13 +160,15 @@ LangString DESC_dlv ${LANG_ENGLISH} "Set up to use DLV with dlv.isc.org. Downloa
 !insertmacro MUI_FUNCTION_DESCRIPTION_END
 
 # setup macros for uninstall functions.
+!ifdef UN
 !undef UN
+!endif
 !define UN "un."
 
 # uninstaller section
 section "un.Unbound"
 	# stop unbound service
-	!insertmacro SERVICE "stop" "unbound" ""
+	nsExec::ExecToLog '"$INSTDIR\unbound-service-remove.exe" stop'
 	# uninstall service entry
 	nsExec::ExecToLog '"$INSTDIR\unbound-service-remove.exe"'
 	# deregister uninstall

winrc/setup_servicelib.nsh

@@ -1,372 +0,0 @@
-; Taken from http://nsis.sourceforge.net/NSIS_Service_Lib on 10-mar-2009
-;
-
-; NSIS SERVICE LIBRARY - servicelib.nsh
-; Version 1.5 - Jun 25th, 2008
-; Questions/Comments - dselkirk@hotmail.com
-;
-; Description:
-;   Provides an interface to window services
-;
-; Inputs:
-;   action     - systemlib action ie. create, delete, start, stop, pause,
-;              continue, installed, running, status
-;   name       - name of service to manipulate
-;   param      - action parameters; usage: var1=value1;var2=value2;...etc.
-;                 (don't forget to add a ';' after the last value!)
-;
-; Actions:
-;   create     - creates a new windows service
-;              Parameters:
-;                path        - path to service executable
-;                autostart   - automatically start with system ie. 1|0
-;                interact    - interact with the desktop ie. 1|0
-;                depend      - service dependencies
-;                user        - user that runs the service
-;                password    - password of the above user
-;                display     - display name in service's console
-;                description - Description of service
-;
-;   delete     - deletes a windows service
-;   start      - start a stopped windows service
-;   stop       - stops a running windows service
-;   pause      - pauses a running windows service
-;   continue   - continues a paused windows service
-;   installed  - is the provided service installed
-;              Parameters:
-;                action      - if true then invokes the specified action
-;   running    - is the provided service running
-;              Parameters:
-;                action      - if true then invokes the specified action
-;   status     - check the status of the provided service
-;
-; If run from uninstall define "UN" as "un." before running.
-;
-; Usage:
-;   Method 1:
-;     Push "action"
-;     Push "name"
-;     Push "param"
-;     Call Service
-;     Pop $0 ;response
-;
-;   Method 2:
-;     !insertmacro SERVICE "action" "name" "param"
-;
-; History:
-;   1.0 - 09/15/2003 - Initial release
-;   1.1 - 09/16/2003 - Changed &l to i, thx brainsucker
-;   1.2 - 02/29/2004 - Fixed documentation.
-;   1.3 - 01/05/2006 - Fixed interactive flag and pop order (Kichik)
-;   1.4 - 12/07/2006 - Added display and depend, fixed datatypes (Vitoco)
-;   1.5 - 06/25/2008 - Added description of service.(DeSafe.com/liuqixing#gmail.com)
- 
-!ifndef SERVICELIB
-  !define SERVICELIB
- 
-  !define SC_MANAGER_ALL_ACCESS 0x3F
-  !define SERVICE_ALL_ACCESS 0xF01FF
- 
-  !define SERVICE_CONTROL_STOP  1
-  !define SERVICE_CONTROL_PAUSE  2
-  !define SERVICE_CONTROL_CONTINUE  3
- 
-  !define SERVICE_STOPPED 0x1
-  !define SERVICE_START_PENDING 0x2
-  !define SERVICE_STOP_PENDING 0x3
-  !define SERVICE_RUNNING 0x4
-  !define SERVICE_CONTINUE_PENDING 0x5
-  !define SERVICE_PAUSE_PENDING 0x6
-  !define SERVICE_PAUSED 0x7
- 
-  !ifndef UN
-    !define UN ""
-  !endif
- 
-  !macro SERVICE ACTION NAME PARAM
-    Push '${ACTION}'
-    Push '${NAME}'
-    Push '${PARAM}'
-    Call ${UN}Service
-  !macroend
- 
-  !macro FUNC_GETPARAM
-    Push $0
-    Push $1
-    Push $2
-    Push $3
-    Push $4
-    Push $5
-    Push $6
-    Push $7
-    Exch 8
-    Pop $1 ;name
-    Exch 8
-    Pop $2 ;source
-    StrCpy $0 ""
-    StrLen $7 $2
-    StrCpy $3 0
-    lbl_loop:
-      IntCmp $3 $7 0 0 lbl_done
-      StrLen $4 "$1="
-      StrCpy $5 $2 $4 $3
-      StrCmp $5 "$1=" 0 lbl_next
-      IntOp $5 $3 + $4
-      StrCpy $3 $5
-      lbl_loop2:
-        IntCmp $3 $7 0 0 lbl_done
-        StrCpy $6 $2 1 $3
-        StrCmp $6 ";" 0 lbl_next2
-        IntOp $6 $3 - $5
-        StrCpy $0 $2 $6 $5
-        Goto lbl_done
-        lbl_next2:
-        IntOp $3 $3 + 1
-        Goto lbl_loop2
-      lbl_next:
-      IntOp $3 $3 + 1
-      Goto lbl_loop
-    lbl_done:
-    Pop $5
-    Pop $4
-    Pop $3
-    Pop $2
-    Pop $1
-    Exch 2
-    Pop $6
-    Pop $7
-    Exch $0
-  !macroend
- 
-  !macro CALL_GETPARAM VAR NAME DEFAULT LABEL
-    Push $1
-    Push ${NAME}
-    Call ${UN}GETPARAM
-    Pop $6
-    StrCpy ${VAR} "${DEFAULT}"
-    StrCmp $6 "" "${LABEL}" 0
-    StrCpy ${VAR} $6
-  !macroend
- 
-  !macro FUNC_SERVICE UN
-    Push $0
-    Push $1
-    Push $2
-    Push $3
-    Push $4
-    Push $5
-    Push $6
-    Push $7
-    Exch 8
-    Pop $1 ;param
-    Exch 8
-    Pop $2 ;name
-    Exch 8
-    Pop $3 ;action
-    ;$0 return
-    ;$4 OpenSCManager
-    ;$5 OpenService
- 
-    StrCpy $0 "false"
-    System::Call 'advapi32::OpenSCManagerA(n, n, i ${SC_MANAGER_ALL_ACCESS}) i.r4'
-    IntCmp $4 0 lbl_done
-    StrCmp $3 "create" lbl_create
-    System::Call 'advapi32::OpenServiceA(i r4, t r2, i ${SERVICE_ALL_ACCESS}) i.r5'
-    IntCmp $5 0 lbl_done
- 
-    lbl_select:
-    StrCmp $3 "delete" lbl_delete
-    StrCmp $3 "start" lbl_start
-    StrCmp $3 "stop" lbl_stop
-    StrCmp $3 "pause" lbl_pause
-    StrCmp $3 "continue" lbl_continue
-    StrCmp $3 "installed" lbl_installed
-    StrCmp $3 "running" lbl_running
-    StrCmp $3 "status" lbl_status
-    Goto lbl_done
- 
-    ; create service
-    lbl_create:
-      Push $R1 ;depend
-      Push $R2 ;user
-      Push $R3 ;password
-      Push $R4 ;interact
-      Push $R5 ;autostart
-      Push $R6 ;path
-      Push $R7 ;display
-      Push $R8 ;description
- 
-      !insertmacro CALL_GETPARAM $R1 "depend" "n" "lbl_depend"
-        StrCpy $R1 't "$R1"'
-      lbl_depend:
-      StrCmp $R1 "n" 0 lbl_machine ;old name of depend param
-      !insertmacro CALL_GETPARAM $R1 "machine" "n" "lbl_machine"
-        StrCpy $R1 't "$R1"'
-      lbl_machine:
- 
-      !insertmacro CALL_GETPARAM $R2 "user" "n" "lbl_user"
-        StrCpy $R2 't "$R2"'
-      lbl_user:
- 
-      !insertmacro CALL_GETPARAM $R3 "password" "n" "lbl_password"
-        StrCpy $R3 't "$R3"'
-      lbl_password:
- 
-      !insertmacro CALL_GETPARAM $R4 "interact" "0x10" "lbl_interact"
-        StrCpy $6 0x10
-        IntCmp $R4 0 +2
-        IntOp $6 $6 | 0x100
-        StrCpy $R4 $6
-      lbl_interact:
- 
-      !insertmacro CALL_GETPARAM $R5 "autostart" "0x3" "lbl_autostart"
-        StrCpy $6 0x3
-        IntCmp $R5 0 +2
-        StrCpy $6 0x2
-        StrCpy $R5 $6
-      lbl_autostart:
- 
-      !insertmacro CALL_GETPARAM $R6 "path" "n" "lbl_path"
-      lbl_path:
- 
-      !insertmacro CALL_GETPARAM $R7 "display" "$2" "lbl_display"
-      lbl_display:
- 
-      !insertmacro CALL_GETPARAM $R8 "description" "$2" "lbl_description"
-      lbl_description:
- 
-      System::Call 'advapi32::CreateServiceA(i r4, t r2, t R7, i ${SERVICE_ALL_ACCESS}, \
-                                             i R4, i R5, i 0, t R6, n, n, $R1, $R2, $R3) i.r6'
- 
-      ;	write description of service
-      WriteRegStr HKLM "SYSTEM\ControlSet001\Services\$2" "Description" $R8
- 
-      Pop $R8
-      Pop $R7
-      Pop $R6
-      Pop $R5
-      Pop $R4
-      Pop $R3
-      Pop $R2
-      Pop $R1
-      StrCmp $6 0 lbl_done lbl_good
- 
-    ; delete service
-    lbl_delete:
-      System::Call 'advapi32::DeleteService(i r5) i.r6'
-      StrCmp $6 0 lbl_done lbl_good
- 
-    ; start service
-    lbl_start:
-      System::Call 'advapi32::StartServiceA(i r5, i 0, i 0) i.r6'
-      StrCmp $6 0 lbl_done lbl_good
- 
-    ; stop service
-    lbl_stop:
-      Push $R1
-      System::Call '*(i,i,i,i,i,i,i) i.R1'
-      System::Call 'advapi32::ControlService(i r5, i ${SERVICE_CONTROL_STOP}, i $R1) i'
-      System::Free $R1
-      Pop $R1
-      StrCmp $6 0 lbl_done lbl_good
- 
-    ; pause service
-    lbl_pause:
-      Push $R1
-      System::Call '*(i,i,i,i,i,i,i) i.R1'
-      System::Call 'advapi32::ControlService(i r5, i ${SERVICE_CONTROL_PAUSE}, i $R1) i'
-      System::Free $R1
-      Pop $R1
-      StrCmp $6 0 lbl_done lbl_good
- 
-    ; continue service
-    lbl_continue:
-      Push $R1
-      System::Call '*(i,i,i,i,i,i,i) i.R1'
-      System::Call 'advapi32::ControlService(i r5, i ${SERVICE_CONTROL_CONTINUE}, i $R1) i'
-      System::Free $R1
-      Pop $R1
-      StrCmp $6 0 lbl_done lbl_good
- 
-    ; is installed
-    lbl_installed:
-      !insertmacro CALL_GETPARAM $7 "action" "" "lbl_good"
-        StrCpy $3 $7
-        Goto lbl_select
- 
-    ; is service running
-    lbl_running:
-      Push $R1
-      System::Call '*(i,i,i,i,i,i,i) i.R1'
-      System::Call 'advapi32::QueryServiceStatus(i r5, i $R1) i'
-      System::Call '*$R1(i, i.r6)'
-      System::Free $R1
-      Pop $R1
-      IntFmt $6 "0x%X" $6
-      StrCmp $6 ${SERVICE_RUNNING} 0 lbl_done
-      !insertmacro CALL_GETPARAM $7 "action" "" "lbl_good"
-        StrCpy $3 $7
-        Goto lbl_select
- 
-    lbl_status:
-      Push $R1
-      System::Call '*(i,i,i,i,i,i,i) i.R1'
-      System::Call 'advapi32::QueryServiceStatus(i r5, i $R1) i'
-      System::Call '*$R1(i, i .r6)'
-      System::Free $R1
-      Pop $R1
-      IntFmt $6 "0x%X" $6
-      StrCpy $0 "running"
-      IntCmp $6 ${SERVICE_RUNNING} lbl_done
-      StrCpy $0 "stopped"
-      IntCmp $6 ${SERVICE_STOPPED} lbl_done
-      StrCpy $0 "start_pending"
-      IntCmp $6 ${SERVICE_START_PENDING} lbl_done
-      StrCpy $0 "stop_pending"
-      IntCmp $6 ${SERVICE_STOP_PENDING} lbl_done
-      StrCpy $0 "running"
-      IntCmp $6 ${SERVICE_RUNNING} lbl_done
-      StrCpy $0 "continue_pending"
-      IntCmp $6 ${SERVICE_CONTINUE_PENDING} lbl_done
-      StrCpy $0 "pause_pending"
-      IntCmp $6 ${SERVICE_PAUSE_PENDING} lbl_done
-      StrCpy $0 "paused"
-      IntCmp $6 ${SERVICE_PAUSED} lbl_done
-      StrCpy $0 "unknown"
-      Goto lbl_done
- 
-    lbl_good:
-    StrCpy $0 "true"
-    lbl_done:
-    IntCmp $5 0 +2
-    System::Call 'advapi32::CloseServiceHandle(i r5) n'
-    IntCmp $4 0 +2
-    System::Call 'advapi32::CloseServiceHandle(i r4) n'
-    Pop $4
-    Pop $3
-    Pop $2
-    Pop $1
-    Exch 3
-    Pop $5
-    Pop $7
-    Pop $6
-    Exch $0
-  !macroend
- 
-  Function Service
-    !insertmacro FUNC_SERVICE ""
-  FunctionEnd
- 
-  Function un.Service
-    !insertmacro FUNC_SERVICE "un."
-  FunctionEnd
- 
-  Function GetParam
-    !insertmacro FUNC_GETPARAM
-  FunctionEnd
- 
-  Function un.GetParam
-    !insertmacro FUNC_GETPARAM
-  FunctionEnd
- 
-!endif

winrc/unbound-service-install.c

@@ -47,9 +47,19 @@
 #include "winrc/w_inst.h"
 
 /** Install service main */
-int main(int ATTR_UNUSED(argc), char** ATTR_UNUSED(argv))
+int main(int argc, char** argv)
 {
-	/*FILE* out = fopen("unbound-service-install.log", "w");*/
-	wsvc_install(NULL, "unbound-service-install.exe");
+	FILE* out = stdout;
+	/* out = fopen("unbound-service-install.log", "w");*/
+	if(argc == 2 && strcmp(argv[1], "start")==0) {
+		wsvc_rc_start(out);
+		return 0;
+	}
+	if(argc != 1) {
+		if(out) fprintf(out, "Usage: %s [start]\n", argv[0]);
+		else	printf("Usage: %s [start]\n", argv[0]);
+		return 1;
+	}
+	wsvc_install(out, "unbound-service-install.exe");
 	return 0;
 }

winrc/unbound-service-remove.c

@@ -1,5 +1,5 @@
 /*
- * winrc/unbound-service-install.c - windows services installation util
+ * winrc/unbound-service-remove.c - windows services installation util
  *
  * Copyright (c) 2009, NLnet Labs. All rights reserved.
  *
@@ -46,10 +46,20 @@
 #include "config.h"
 #include "winrc/w_inst.h"
 
-/** Install service main */
-int main(int ATTR_UNUSED(argc), char** ATTR_UNUSED(argv))
+/** Remove service main */
+int main(int argc, char** argv)
 {
-	/*FILE* out = fopen("unbound-service-remove.log", "w");*/
+	FILE* out = stdout;
+	/* out = fopen("unbound-service-remove.log", "w");*/
+	if(argc == 2 && strcmp(argv[1], "stop")==0) {
+		wsvc_rc_stop(out);
+		return 0;
+	}
+	if(argc != 1) {
+		if(out) fprintf(out, "Usage: %s [stop]\n", argv[0]);
+		else	printf("Usage: %s [stop]\n", argv[0]);
+		return 1;
+	}
 	wsvc_remove(NULL);
 	return 0;
 }

winrc/w_inst.c

@@ -43,11 +43,28 @@
 #include "winrc/w_inst.h"
 #include "winrc/win_svc.h"
 
+void wsvc_err2str(char* str, size_t len, const char* fixed, DWORD err)
+{
+	LPTSTR buf;
+	if(FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | 
+		FORMAT_MESSAGE_IGNORE_INSERTS | FORMAT_MESSAGE_ALLOCATE_BUFFER, 
+		NULL, err, 0, (LPTSTR)&buf, 0, NULL) == 0) {
+		/* could not format error message */
+		snprintf(str, len, "%s GetLastError=%d", fixed, (int)err);
+		return;
+	}
+	snprintf(str, len, "%s (err=%d): %s", fixed, (int)err, buf);
+	LocalFree(buf);
+}
+
 /** exit with windows error */
 static void
 fatal_win(FILE* out, const char* str)
 {
-        if(out) fprintf(out, "%s (%d)\n", str, (int)GetLastError());
+	char e[256];
+	wsvc_err2str(e, sizeof(e), str, (int)GetLastError());
+        if(out) fprintf(out, "%s\n", e);
+        else fprintf(stderr, "%s\n", e);
         exit(1);
 }
 
@@ -75,7 +92,7 @@ event_reg_install(FILE* out, const char* pathname)
 	if(RegSetValueEx(hk, (LPCTSTR)"EventMessageFile", 
 		0, /* reserved, mustbezero */
 		REG_EXPAND_SZ, /* value type (string w env subst) */
-		pathname, /* data */
+		(BYTE*)pathname, /* data */
 		(DWORD)strlen(pathname)+1)) /* length of data */
 	{
 		RegCloseKey(hk);
@@ -93,7 +110,7 @@ event_reg_install(FILE* out, const char* pathname)
 
 	/* category message file */
 	if(RegSetValueEx(hk, (LPCTSTR)"CategoryMessageFile", 0, REG_EXPAND_SZ, 
-		pathname, (DWORD)strlen(pathname)+1)) {
+		(BYTE*)pathname, (DWORD)strlen(pathname)+1)) {
 		RegCloseKey(hk);
 		fatal_win(out, "could not registry set CategoryMessageFile");
 	}
@@ -213,6 +230,7 @@ wsvc_install(FILE* out, const char* rename)
         if(out) fprintf(out, "unbound service installed\n");
 }
 
+
 /* Remove installed service from servicecontrolmanager */
 void
 wsvc_remove(FILE* out)
@@ -228,6 +246,8 @@ wsvc_remove(FILE* out)
                 fatal_win(out, "could not OpenService");
         }
         if(!DeleteService(sv)) {
+		CloseServiceHandle(sv);
+		CloseServiceHandle(scm);
                 fatal_win(out, "could not DeleteService");
         }
         CloseServiceHandle(sv);
@@ -235,3 +255,54 @@ wsvc_remove(FILE* out)
 	event_reg_remove(out);
         if(out) fprintf(out, "unbound service removed\n");
 }
+
+
+/* Start daemon */
+void
+wsvc_rc_start(FILE* out)
+{
+	SC_HANDLE scm;
+	SC_HANDLE sv;
+        if(out) fprintf(out, "start unbound service\n");
+	scm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
+	if(!scm) fatal_win(out, "could not OpenSCManager");
+	sv = OpenService(scm, SERVICE_NAME, SERVICE_START);
+	if(!sv) {
+		CloseServiceHandle(scm);
+		fatal_win(out, "could not OpenService");
+	}
+	if(!StartService(sv, 0, NULL)) {
+		CloseServiceHandle(sv);
+		CloseServiceHandle(scm);
+		fatal_win(out, "could not StartService");
+	}
+	CloseServiceHandle(sv);
+	CloseServiceHandle(scm);
+        if(out) fprintf(out, "unbound service started\n");
+}
+
+
+/* Stop daemon */
+void
+wsvc_rc_stop(FILE* out)
+{
+	SC_HANDLE scm;
+	SC_HANDLE sv;
+	SERVICE_STATUS st;
+        if(out) fprintf(out, "stop unbound service\n");
+	scm = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
+	if(!scm) fatal_win(out, "could not OpenSCManager");
+	sv = OpenService(scm, SERVICE_NAME, SERVICE_STOP);
+	if(!sv) {
+		CloseServiceHandle(scm);
+		fatal_win(out, "could not OpenService");
+	}
+	if(!ControlService(sv, SERVICE_CONTROL_STOP, &st)) {
+		CloseServiceHandle(sv);
+		CloseServiceHandle(scm);
+		fatal_win(out, "could not ControlService");
+	}
+	CloseServiceHandle(sv);
+	CloseServiceHandle(scm);
+        if(out) fprintf(out, "unbound service stopped\n");
+}

winrc/w_inst.h

@@ -56,4 +56,25 @@ void wsvc_install(FILE* out, const char* rename);
  */
 void wsvc_remove(FILE* out);
 
+/**
+ * Start the service from servicecontrolmanager, tells OS to start daemon.
+ * @param out: debug output printed here (errors). or NULL.
+ */
+void wsvc_rc_start(FILE* out);
+
+/**
+ * Stop the service from servicecontrolmanager, tells OS to stop daemon.
+ * @param out: debug output printed here (errors). or NULL.
+ */
+void wsvc_rc_stop(FILE* out);
+
+/** 
+ * Convert windows GetLastError() value to a neat string.
+ * @param str: destination buffer
+ * @param len: length of dest buffer
+ * @param fixed: fixed text to prepend to string.
+ * @param err: the GetLastError() value.
+ */
+void wsvc_err2str(char* str, size_t len, const char* fixed, DWORD err);
+
 #endif /* WINRC_W_INST_H */

winrc/win_svc.c

@@ -127,11 +127,12 @@ static void
 reportev(const char* str)
 {
 	char b[256];
+	char e[256];
 	HANDLE* s;
 	LPCTSTR msg = b;
 	/* print quickly to keep GetLastError value */
-	snprintf(b, sizeof(b), "%s: %s (%d)", SERVICE_NAME, 
-		str, (int)GetLastError());
+	wsvc_err2str(e, sizeof(e), str, GetLastError());
+	snprintf(b, sizeof(b), "%s: %s", SERVICE_NAME, e);
 	s = RegisterEventSource(NULL, SERVICE_NAME);
 	if(!s) return;
 	ReportEvent(s, /* event log */
@@ -181,7 +182,7 @@ lookup_reg_str(const char* key, const char* name)
 	if(type == REG_SZ || type == REG_MULTI_SZ || type == REG_EXPAND_SZ) {
 		buf[sizeof(buf)-1] = 0;
 		buf[sizeof(buf)-2] = 0; /* for multi_sz */
-		result = strdup(buf);
+		result = strdup((char*)buf);
 		if(!result) reportev("out of memory");
 	}
 	return result;
@@ -221,9 +222,11 @@ lookup_reg_int(const char* key, const char* name)
 	if(type == REG_SZ || type == REG_MULTI_SZ || type == REG_EXPAND_SZ) {
 		buf[sizeof(buf)-1] = 0;
 		buf[sizeof(buf)-2] = 0; /* for multi_sz */
-		result = atoi(buf);
+		result = atoi((char*)buf);
 	} else if(type == REG_DWORD) {
-		result = *(DWORD*)buf;
+		DWORD r;
+		memmove(&r, buf, sizeof(r));
+		result = r;
 	} 
 	return result;
 }