tag 1.4.4rc1

git-svn-id: file:///svn/unbound/trunk@2084 be551aaa-1e26-0410-a405-d3ace91eadb9

Makefile.in

@@ -5,8 +5,10 @@ debug_enabled=@debug_enabled@
 ifeq "$(QUIET)" ""
 ifeq ($(debug_enabled),yes)
   QUIET=yes
+  LIBTOOLQUIET=yes
 else
   QUIET=no
+  LIBTOOLQUIET=yes
 endif
 endif
 
@@ -62,7 +64,7 @@ RUNTIME_PATH=@RUNTIME_PATH@
 DEPFLAG=@DEPFLAG@
 DATE=$(shell date +%Y%m%d)
 LIBTOOL=$(libtool)
-ifeq "$(QUIET)" "yes"
+ifeq "$(LIBTOOLQUIET)" "yes"
   LIBTOOL+=--quiet
 endif
 BUILD=build/
@@ -72,6 +74,14 @@ LINT=splint
 LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list -Dglob64=glob -Dglobfree64=globfree
 # compat with openssl linux edition.
 LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray
+# compat with NetBSD
+ifeq "$(shell uname)" "NetBSD"
+LINTFLAGS+="-D__RENAME(x)=" -D_NETINET_IN_H_
+endif
+# compat with OpenBSD
+LINTFLAGS+="-Dsigset_t=long"
+# FreeBSD8
+LINTFLAGS+="-D__uint16_t=uint16_t"
 
 INSTALL=$(srcdir)/install-sh
 ifeq "$(WITH_PYTHONMODULE)" "yes"
@@ -144,14 +154,15 @@ ifeq "$(UB_ON_WINDOWS)" "yes"
 
   WINAPPS=$(addsuffix $(EXEEXT), unbound-service-install \
   	unbound-service-remove anchor-update)
+  COMPAT_WINAPP=$(filter-out $(BUILD)compat/ctime_r.lo, $(COMPAT_OBJ))
   SVCINST_SRC=winrc/unbound-service-install.c winrc/w_inst.c
-  SVCINST_OBJ=$(addprefix $(BUILD),$(SVCINST_SRC:.c=.lo)) $(COMPAT_OBJ) \
+  SVCINST_OBJ=$(addprefix $(BUILD),$(SVCINST_SRC:.c=.lo)) $(COMPAT_WINAPP) \
 	$(BUILD)winrc/rsrc_svcinst.o
   SVCUNINST_SRC=winrc/unbound-service-remove.c winrc/w_inst.c
-  SVCUNINST_OBJ=$(addprefix $(BUILD),$(SVCUNINST_SRC:.c=.lo)) $(COMPAT_OBJ) \
+  SVCUNINST_OBJ=$(addprefix $(BUILD),$(SVCUNINST_SRC:.c=.lo)) $(COMPAT_WINAPP) \
 	$(BUILD)winrc/rsrc_svcuninst.o
   ANCHORUPD_SRC=winrc/anchor-update.c
-  ANCHORUPD_OBJ=$(addprefix $(BUILD),$(ANCHORUPD_SRC:.c=.lo)) $(COMPAT_OBJ) \
+  ANCHORUPD_OBJ=$(addprefix $(BUILD),$(ANCHORUPD_SRC:.c=.lo)) $(COMPAT_WINAPP) \
         $(BUILD)winrc/rsrc_anchorupd.o
   ALL_SRC:=$(sort $(ALL_SRC) $(SVCINST_SRC) $(SVCUNINST_SRC) $(ANCHORUPD_SRC))
   ALL_OBJ:=$(sort $(ALL_OBJ) $(SVCINST_OBJ) $(SVCUNINST_OBJ) $(ANCHORUPD_OBJ))
@@ -175,7 +186,7 @@ $(BUILD)%.lo:    $(srcdir)/%.c
 	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
 		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
-	$Q$(COMPILE) -c $< -o $@
+	$Q$(COMPILE) -o $@ -c $<
 
 all:	$(COMMON_OBJ) unbound$(EXEEXT) unbound-checkconf$(EXEEXT) lib unbound-host$(EXEEXT) unbound-control$(EXEEXT) unbound-control-setup $(WINAPPS)
 
@@ -188,10 +199,6 @@ test:	tests
 
 lib:	libunbound.la
 
-libunbound.la:	$(LIBUNBOUND_OBJ)
-	$(INFO) Link $@
-	$Q$(LINK_LIB) -export-symbols $(srcdir)/libunbound/ubsyms.def -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
-
 ifeq ($(patsubst ldns-src%,ldns-src,$(ldnsdir)),ldns-src)
 ldnslib=$(ldnsdir)/lib/libldns.a
 $(ldnslib):	$(ldnsdir)/lib
@@ -202,6 +209,10 @@ else
 ldnslib=
 endif
 
+libunbound.la:	$(LIBUNBOUND_OBJ) $(ldnslib)
+	$(INFO) Link $@
+	$Q$(LINK_LIB) -export-symbols $(srcdir)/libunbound/ubsyms.def -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
+
 unbound$(EXEEXT):	$(DAEMON_OBJ) $(ldnslib)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(DAEMON_OBJ)) -lssl $(LIBS)
@@ -348,10 +359,12 @@ tags:	$(srcdir)/*.[ch] $(srcdir)/*/*.[ch]
 doc:
 	if test -n "$(doxygen)"; then \
 		$(doxygen) $(srcdir)/doc/unbound.doxygen; fi
+ifeq "$(findstring yes,$(WITH_PYUNBOUND)$(WITH_PYTHONMODULE))" "yes"
 	if test -x "`which sphinx-build 2>&1`"; then \
 		sphinx-build -b html pythonmod/doc doc/html/pythonmod; \
 		sphinx-build -b html libunbound/python/doc doc/html/pyunbound;\
 	fi
+endif
 
 strip:
 	$(STRIP) unbound$(EXEEXT)
@@ -359,7 +372,7 @@ strip:
 	$(STRIP) unbound-control$(EXEEXT)
 	$(STRIP) unbound-host$(EXEEXT)
 
-install:
+install:	all
 	$(INSTALL) -m 755 -d $(DESTDIR)$(sbindir)
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man8
@@ -380,6 +393,7 @@ ifeq "$(WITH_PYUNBOUND)" "yes"
 	$(INSTALL) -m 755 -d $(DESTDIR)$(PYTHON_SITE_PKG)
 	$(INSTALL) -c -m 644 libunbound/python/unbound.py $(DESTDIR)$(PYTHON_SITE_PKG)/unbound.py
 	$(LIBTOOL) --mode=install cp _unbound.la $(DESTDIR)$(PYTHON_SITE_PKG)
+	$(LIBTOOL) --mode=finish $(DESTDIR)$(PYTHON_SITE_PKG)
 endif
 	$(INSTALL) -c -m 644 doc/unbound.8 $(DESTDIR)$(mandir)/man8
 	$(INSTALL) -c -m 644 doc/unbound-checkconf.8 $(DESTDIR)$(mandir)/man8

aclocal.m4

@@ -1,4 +1,4 @@
-# generated automatically by aclocal 1.11 -*- Autoconf -*-
+# generated automatically by aclocal 1.11.1 -*- Autoconf -*-
 
 # Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004,
 # 2005, 2006, 2007, 2008, 2009  Free Software Foundation, Inc.
@@ -7854,15 +7854,15 @@ m4_define([lt_dict_filter],
 
 # Generated from ltversion.in.
 
-# serial 3012 ltversion.m4
+# serial 3017 ltversion.m4
 # This file is part of GNU Libtool
 
-m4_define([LT_PACKAGE_VERSION], [2.2.6])
-m4_define([LT_PACKAGE_REVISION], [1.3012])
+m4_define([LT_PACKAGE_VERSION], [2.2.6b])
+m4_define([LT_PACKAGE_REVISION], [1.3017])
 
 AC_DEFUN([LTVERSION_VERSION],
-[macro_version='2.2.6'
-macro_revision='1.3012'
+[macro_version='2.2.6b'
+macro_revision='1.3017'
 _LT_DECL(, macro_version, 0, [Which release of libtool.m4 was used?])
 _LT_DECL(, macro_revision, 0)
 ])

acx_nlnetlabs.m4

@@ -2,8 +2,11 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 4
-# Changelog
+# Version 8
+# 2010-03-01 Fix RPATH using CONFIG_COMMANDS to run at the very end.
+# 2010-02-18 WITH_SSL outputs the LIBSSL_LDFLAGS, LIBS, CPPFLAGS seperate, -ldl
+# 2010-02-01 added ACX_CHECK_MEMCMP_SIGNED, AHX_MEMCMP_BROKEN
+# 2010-01-20 added AHX_COONFIG_STRLCAT
 # 2009-07-14 U_CHAR detection improved for windows crosscompile.
 #            added ACX_FUNC_MALLOC
 #            fixup some #if to #ifdef
@@ -35,7 +38,7 @@
 # ACX_ARG_RPATH			- add --disable-rpath option.
 # ACX_WITH_SSL			- add --with-ssl option, link -lcrypto.
 # ACX_WITH_SSL_OPTIONAL		- add --with-ssl option, link -lcrypto,
-				  where --without-ssl is also accepted
+#				  where --without-ssl is also accepted
 # ACX_LIB_SSL			- setup to link -lssl.
 # ACX_SYS_LARGEFILE		- improved sys_largefile, fseeko, >2G files.
 # ACX_CHECK_GETADDRINFO_WITH_INCLUDES - find getaddrinfo, portably.
@@ -55,6 +58,7 @@
 # AHX_CONFIG_INET_NTOP		- inet_ntop compat prototype
 # AHX_CONFIG_INET_ATON		- inet_aton compat prototype
 # AHX_CONFIG_MEMMOVE		- memmove compat prototype
+# AHX_CONFIG_STRLCAT		- strlcat compat prototype
 # AHX_CONFIG_STRLCPY		- strlcpy compat prototype
 # AHX_CONFIG_GMTIME_R		- gmtime_r compat prototype
 # AHX_CONFIG_W32_SLEEP		- w32 compat for sleep
@@ -67,6 +71,8 @@
 # AHX_CONFIG_FLAG_OMITTED	- define omitted flag
 # AHX_CONFIG_FLAG_EXT		- define omitted extension flag
 # AHX_CONFIG_EXT_FLAGS		- define the stripped extension flags
+# ACX_CHECK_MEMCMP_SIGNED	- check if memcmp uses signed characters.
+# AHX_MEMCMP_BROKEN		- replace memcmp func for CHECK_MEMCMP_SIGNED.
 #
 
 dnl Escape backslashes as \\, for C:\ paths, for the C preprocessor defines.
@@ -551,12 +557,14 @@ AC_ARG_ENABLE(rpath,
         [  --disable-rpath         disable hardcoded rpath (default=enabled)],
 	enable_rpath=$enableval, enable_rpath=yes)
 if test "x$enable_rpath" = xno; then
-	AC_MSG_RESULT([Fixing libtool for -rpath problems.])
+	dnl AC_MSG_RESULT([Fixing libtool for -rpath problems.])
+	AC_CONFIG_COMMANDS([disable-rpath], [
 	sed < libtool > libtool-2 \
 	's/^hardcode_libdir_flag_spec.*$'/'hardcode_libdir_flag_spec=" -D__LIBTOOL_RPATH_SED__ "/'
 	mv libtool-2 libtool
 	chmod 755 libtool
 	libtool="./libtool"
+	])
 fi
 ])
 
@@ -589,6 +597,7 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                 dnl assume /usr/include is already in the include-path.
                 if test "$ssldir" != "/usr"; then
                         CPPFLAGS="$CPPFLAGS -I$ssldir/include"
+                        LIBSSL_CPPFLAGS="$LIBSSL_CPPFLAGS -I$ssldir/include"
                 fi
                 break;
             fi
@@ -601,11 +610,13 @@ AC_DEFUN([ACX_SSL_CHECKS], [
             dnl assume /usr is already in the lib and dynlib paths.
             if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
                 LDFLAGS="$LDFLAGS -L$ssldir/lib"
+                LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib"
                 ACX_RUNTIME_PATH_ADD([$ssldir/lib])
             fi
         
             AC_MSG_CHECKING([for HMAC_CTX_init in -lcrypto])
             LIBS="$LIBS -lcrypto"
+            LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
             AC_TRY_LINK(, [
                 int HMAC_CTX_init(void);
                 (void)HMAC_CTX_init();
@@ -617,7 +628,9 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                 AC_MSG_RESULT(no)
                 # check if -lwsock32 or -lgdi32 are needed.	
                 BAKLIBS="$LIBS"
+                BAKSSLLIBS="$LIBSSL_LIBS"
                 LIBS="$LIBS -lgdi32"
+                LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32"
                 AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
                 AC_TRY_LINK([], [
                     int HMAC_CTX_init(void);
@@ -629,7 +642,9 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                   ],[
                     AC_MSG_RESULT(no)
                     LIBS="$BAKLIBS"
+                    LIBSSL_LIBS="$BAKSSLLIBS"
                     LIBS="$LIBS -ldl"
+                    LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
                     AC_MSG_CHECKING([if -lcrypto needs -ldl])
                     AC_TRY_LINK([], [
                         int HMAC_CTX_init(void);
@@ -647,6 +662,12 @@ AC_DEFUN([ACX_SSL_CHECKS], [
         fi
         AC_SUBST(HAVE_SSL)
         AC_SUBST(RUNTIME_PATH)
+	# openssl engine functionality needs dlopen().
+	BAKLIBS="$LIBS"
+	AC_SEARCH_LIBS([dlopen], [dl])
+	if test "$LIBS" != "$BAKLIBS"; then
+		LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
+	fi
     fi
 AC_CHECK_HEADERS([openssl/ssl.h],,, [AC_INCLUDES_DEFAULT])
 AC_CHECK_HEADERS([openssl/err.h],,, [AC_INCLUDES_DEFAULT])
@@ -1088,6 +1109,16 @@ void *memmove(void *dest, const void *src, size_t n);
 #endif
 ])
 
+dnl provide strlcat compat prototype.
+dnl $1: unique name for compat code
+AC_DEFUN([AHX_CONFIG_STRLCAT],
+[
+#ifndef HAVE_STRLCAT
+#define strlcat strlcat_$1
+size_t strlcat(char *dst, const char *src, size_t siz);
+#endif
+])
+
 dnl provide strlcpy compat prototype.
 dnl $1: unique name for compat code
 AC_DEFUN([AHX_CONFIG_STRLCPY],
@@ -1204,4 +1235,38 @@ AHX_CONFIG_FLAG_EXT(-D_ALL_SOURCE)
 AHX_CONFIG_FLAG_EXT(-D_LARGEFILE_SOURCE=1)
 ])
 
+dnl check if memcmp is using signed characters and replace if so.
+AC_DEFUN([ACX_CHECK_MEMCMP_SIGNED],
+[AC_MSG_CHECKING([if memcmp compares unsigned])
+AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+int main(void)
+{
+	char a = 255, b = 0;
+	if(memcmp(&a, &b, 1) < 0)
+		return 1;
+	return 0;
+}
+]])], [AC_MSG_RESULT([yes]) ],
+[ AC_MSG_RESULT([no])
+  AC_DEFINE([MEMCMP_IS_BROKEN], [1], [Define if memcmp() does not compare unsigned bytes])
+  AC_LIBOBJ([memcmp])
+], [ AC_MSG_RESULT([cross-compile no])
+  AC_DEFINE([MEMCMP_IS_BROKEN], [1], [Define if memcmp() does not compare unsigned bytes])
+  AC_LIBOBJ([memcmp]) 
+]) ])
+
+dnl define memcmp to its replacement, pass unique id for program as arg
+AC_DEFUN([AHX_MEMCMP_BROKEN], [
+#ifdef MEMCMP_IS_BROKEN
+#  ifdef memcmp
+#  undef memcmp
+#  endif
+#define memcmp memcmp_$1
+int memcmp(const void *x, const void *y, size_t n);
+#endif
+])
+
 dnl End of file

compat/ctime_r.c

@@ -0,0 +1,39 @@
+/* taken from ldns 1.6.1 */
+#include "config.h"
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+#include "util/locks.h"
+
+/** the lock for ctime buffer */
+static lock_basic_t ctime_lock;
+/** has it been inited */
+static int ctime_r_init = 0;
+
+/** cleanup ctime_r on exit */
+static void
+ctime_r_cleanup(void)
+{
+	if(ctime_r_init) {
+		ctime_r_init = 0;
+		lock_basic_destroy(&ctime_lock);
+	}
+}
+
+char *ctime_r(const time_t *timep, char *buf)
+{
+	char* result;
+	if(!ctime_r_init) {
+		/* still small race where this init can be done twice,
+		 * which is mostly harmless */
+		ctime_r_init = 1;
+		lock_basic_init(&ctime_lock);
+		atexit(&ctime_r_cleanup);
+	}
+	lock_basic_lock(&ctime_lock);
+	result = ctime(timep);
+	if(buf && result)
+		strcpy(buf, result);
+	lock_basic_unlock(&ctime_lock);
+	return result;
+}

compat/memcmp.c

@@ -0,0 +1,25 @@
+/*
+ *	memcmp.c: memcmp compat implementation.
+ *
+ *	Copyright (c) 2010, NLnet Labs. All rights reserved.
+ *
+ * See LICENSE for the license.
+*/
+
+#include <config.h>
+
+int memcmp(const void *x, const void *y, size_t n);
+
+int memcmp(const void *x, const void *y, size_t n)
+{
+	const uint8_t* x8 = (const uint8_t*)x;
+	const uint8_t* y8 = (const uint8_t*)y;
+	size_t i;
+	for(i=0; i<n; i++) {
+		if(x8[i] < y8[i])
+			return -1;
+		else if(x8[i] > y8[i])
+			return 1;
+	}
+	return 0;
+}

compat/snprintf.c

@@ -40,6 +40,9 @@
  *           gcc -DTEST_SNPRINTF -o snprintf snprintf.c -lm
  *    and run snprintf for results.
  *
+ *  Wouter Wijngaards(wouter@nlnetlabs.nl) 2/09/2010 for unbound.
+ *    Limited support for %g.  Does not do the exponents for the before-dot.
+ *
  **************************************************************/
 
 
@@ -75,7 +78,7 @@ static void fmtstr (char *buffer, size_t *currlen, size_t maxlen,
 static void fmtint (char *buffer, size_t *currlen, size_t maxlen,
 		    long value, int base, int min, int max, int flags);
 static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
-		   long double fvalue, int min, int max, int flags);
+		   long double fvalue, int min, int max, int flags, int conv);
 static void dopr_outch (char *buffer, size_t *currlen, size_t maxlen, char c );
 
 int vsnprintf (char *str, size_t count, const char *fmt, va_list args)
@@ -313,7 +316,7 @@ static void dopr (char *buffer, size_t maxlen, const char *format, va_list args)
 	else
 	  fvalue = va_arg (args, double);
 	/* um, floating point? */
-	fmtfp (buffer, &currlen, maxlen, fvalue, min, max, flags);
+	fmtfp (buffer, &currlen, maxlen, fvalue, min, max, flags, 'f');
 	break;
       case 'E':
 	flags |= DP_F_UP;
@@ -330,6 +333,7 @@ static void dopr (char *buffer, size_t maxlen, const char *format, va_list args)
 	  fvalue = va_arg (args, long double);
 	else
 	  fvalue = va_arg (args, double);
+	fmtfp (buffer, &currlen, maxlen, fvalue, min, max, flags, 'g');
 	break;
       case 'c':
 	dopr_outch (buffer, &currlen, maxlen, va_arg (args, int));
@@ -554,7 +558,7 @@ static long compat_round (long double value)
 }
 
 static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
-		   long double fvalue, int min, int max, int flags)
+		   long double fvalue, int min, int max, int flags, int conv)
 {
   int signvalue = 0;
   long double ufvalue;
@@ -628,13 +632,26 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
     fconvert[fplace++] =
       (caps? "0123456789ABCDEF":"0123456789abcdef")[fracpart % 10];
     fracpart = (fracpart / 10);
+    if(conv == 'g' && fplace == 1 && fconvert[0] == '0') {
+      fplace = 0; /* skip trailing zeroes for %g */
+      zpadlen ++;
+    }
   } while(fracpart && (fplace < 20));
   if (fplace == 20) fplace--;
   fconvert[fplace] = 0;
 
-  /* -1 for decimal point, another -1 if we are printing a sign */
-  padlen = min - iplace - max - 1 - ((signvalue) ? 1 : 0); 
-  zpadlen = max - fplace;
+  if(conv == 'f') {
+    /* -1 for decimal point, another -1 if we are printing a sign */
+    padlen = min - iplace - max - 1 - ((signvalue) ? 1 : 0); 
+    zpadlen = max - fplace;
+  } else if(conv == 'g') {
+    /* zpadlen contains number of trailing zeroes removed */
+    padlen = min - iplace - (max-zpadlen) - 1 - ((signvalue) ? 1 : 0); 
+    if(fplace == 0) {
+      padlen += 1; /* add the decimal dot suppressed */
+      zpadlen = 0;
+    } else zpadlen = (max-zpadlen) - fplace;
+  }
   if (zpadlen < 0)
     zpadlen = 0;
   if (padlen < 0) 
@@ -667,14 +684,14 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
   while (iplace > 0) 
     dopr_outch (buffer, currlen, maxlen, iconvert[--iplace]);
 
-  /*
-   * Decimal point.  This should probably use locale to find the correct
-   * char to print out.
-   */
-  dopr_outch (buffer, currlen, maxlen, '.');
-
-  while (fplace > 0) 
-    dopr_outch (buffer, currlen, maxlen, fconvert[--fplace]);
+  /* for %g do not output decimal point if no fraction is present */
+  if(conv == 'f' || (conv == 'g' && fplace > 0)) {
+    /*
+     * Decimal point.  This should probably use locale to find the correct
+     * char to print out.
+     */
+    dopr_outch (buffer, currlen, maxlen, '.');
+  }
 
   while (zpadlen > 0)
   {
@@ -682,6 +699,9 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
     --zpadlen;
   }
 
+  while (fplace > 0) 
+    dopr_outch (buffer, currlen, maxlen, fconvert[--fplace]);
+
   while (padlen < 0) 
   {
     dopr_outch (buffer, currlen, maxlen, ' ');

config.guess

@@ -4,7 +4,7 @@
 #   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
 #   Free Software Foundation, Inc.
 
-timestamp='2008-11-15'
+timestamp='2009-04-27'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -324,6 +324,9 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	case `/usr/bin/uname -p` in
 	    sparc) echo sparc-icl-nx7; exit ;;
 	esac ;;
+    s390x:SunOS:*:*)
+	echo ${UNAME_MACHINE}-ibm-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
+	exit ;;
     sun4H:SunOS:5.*:*)
 	echo sparc-hal-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
@@ -337,7 +340,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	# Note that the Sun cc does not turn __LP64__ into 1 like gcc does.
 	# This test works for both compilers.
 	if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
-	    if echo '\n#ifdef __amd64\nIS_64BIT_ARCH\n#endif' | \
+	    if (echo '#ifdef __amd64'; echo IS_64BIT_ARCH; echo '#endif') | \
 		(CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
 		grep IS_64BIT_ARCH >/dev/null
 	    then
@@ -1115,8 +1118,11 @@ EOF
     pc:*:*:*)
 	# Left here for compatibility:
         # uname -m prints for DJGPP always 'pc', but it prints nothing about
-        # the processor, so we play safe by assuming i386.
-	echo i386-pc-msdosdjgpp
+        # the processor, so we play safe by assuming i586.
+	# Note: whatever this is, it MUST be the same as what config.sub
+	# prints for the "djgpp" host, or else GDB configury will decide that
+	# this is a cross-build.
+	echo i586-pc-msdosdjgpp
         exit ;;
     Intel:Mach:3*:*)
 	echo i386-pc-mach3
@@ -1154,6 +1160,16 @@ EOF
     3[34]??:*:4.0:* | 3[34]??,*:*:4.0:*)
         /bin/uname -p 2>/dev/null | grep 86 >/dev/null \
           && { echo i486-ncr-sysv4; exit; } ;;
+    NCR*:*:4.2:* | MPRAS*:*:4.2:*)
+	OS_REL='.3'
+	test -r /etc/.relid \
+	    && OS_REL=.`sed -n 's/[^ ]* [^ ]* \([0-9][0-9]\).*/\1/p' < /etc/.relid`
+	/bin/uname -p 2>/dev/null | grep 86 >/dev/null \
+	    && { echo i486-ncr-sysv4.3${OS_REL}; exit; }
+	/bin/uname -p 2>/dev/null | /bin/grep entium >/dev/null \
+	    && { echo i586-ncr-sysv4.3${OS_REL}; exit; }
+	/bin/uname -p 2>/dev/null | /bin/grep pteron >/dev/null \
+	    && { echo i586-ncr-sysv4.3${OS_REL}; exit; } ;;
     m68*:LynxOS:2.*:* | m68*:LynxOS:3.0*:*)
 	echo m68k-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
@@ -1340,6 +1356,9 @@ EOF
     i*86:rdos:*:*)
 	echo ${UNAME_MACHINE}-pc-rdos
 	exit ;;
+    i*86:AROS:*:*)
+	echo ${UNAME_MACHINE}-pc-aros
+	exit ;;
 esac
 
 #echo '(No uname command or uname output not recognized.)' 1>&2

config.h.in

@@ -31,15 +31,19 @@
 /* Define to 1 if you have the `chroot' function. */
 #undef HAVE_CHROOT
 
+/* Define to 1 if you have the `ctime_r' function. */
+#undef HAVE_CTIME_R
+
 /* Define to 1 if you have the `daemon' function. */
 #undef HAVE_DAEMON
 
+/* Define to 1 if you have the declaration of
+   `SSL_COMP_get_compression_methods', and to 0 if you don't. */
+#undef HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
+
 /* Define to 1 if you have the <dlfcn.h> header file. */
 #undef HAVE_DLFCN_H
 
-/* Define to 1 if you have the `ENGINE_load_gost' function. */
-#undef HAVE_ENGINE_LOAD_GOST
-
 /* Define to 1 if you have the `event_base_free' function. */
 #undef HAVE_EVENT_BASE_FREE
 
@@ -121,9 +125,15 @@
 /* if the function 'ioctlsocket' is available */
 #undef HAVE_IOCTLSOCKET
 
+/* Define to 1 if you have the <iphlpapi.h> header file. */
+#undef HAVE_IPHLPAPI_H
+
 /* Define to 1 if you have the `kill' function. */
 #undef HAVE_KILL
 
+/* Define to 1 if you have the <ldns/ldns.h> header file. */
+#undef HAVE_LDNS_LDNS_H
+
 /* Define to 1 if you have the `ldns' library (-lldns). */
 #undef HAVE_LIBLDNS
 
@@ -149,6 +159,15 @@
 /* Define to 1 if you have the <netinet/in.h> header file. */
 #undef HAVE_NETINET_IN_H
 
+/* Define to 1 if you have the `OPENSSL_config' function. */
+#undef HAVE_OPENSSL_CONFIG
+
+/* Define to 1 if you have the <openssl/conf.h> header file. */
+#undef HAVE_OPENSSL_CONF_H
+
+/* Define to 1 if you have the <openssl/engine.h> header file. */
+#undef HAVE_OPENSSL_ENGINE_H
+
 /* Define to 1 if you have the <openssl/err.h> header file. */
 #undef HAVE_OPENSSL_ERR_H
 
@@ -314,6 +333,9 @@
 /* Define to 1 if you have the `_beginthreadex' function. */
 #undef HAVE__BEGINTHREADEX
 
+/* if lex has yylex_destroy */
+#undef LEX_HAS_YYLEX_DESTROY
+
 /* Define to the sub-directory in which libtool stores uninstalled libraries.
    */
 #undef LT_OBJDIR
@@ -321,6 +343,9 @@
 /* Define to the maximum message length to pass to syslog. */
 #undef MAXSYSLOGMSGLEN
 
+/* Define if memcmp() does not compare unsigned bytes */
+#undef MEMCMP_IS_BROKEN
+
 /* Define if mkdir has one argument. */
 #undef MKDIR_HAS_ONE_ARG
 
@@ -395,12 +420,21 @@
 /* default username */
 #undef UB_USERNAME
 
+/* use to enable lightweight alloc assertions, for debug use */
+#undef UNBOUND_ALLOC_LITE
+
+/* use malloc not regions, for debug use */
+#undef UNBOUND_ALLOC_NONREGIONAL
+
 /* use statistics for allocs and frees, for debug use */
 #undef UNBOUND_ALLOC_STATS
 
 /* define this to enable debug checks. */
 #undef UNBOUND_DEBUG
 
+/* Define this to enable GOST support. */
+#undef USE_GOST
+
 /* Define if you want to use internal select based events */
 #undef USE_MINI_EVENT
 
@@ -619,18 +653,6 @@
 #include <ws2tcpip.h>
 #endif
 
-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ERR_H
-#include <openssl/err.h>
-#endif
-
-#ifdef HAVE_OPENSSL_RAND_H
-#include <openssl/rand.h>
-#endif
-
 
  
 #ifdef HAVE_ATTR_FORMAT
@@ -741,6 +763,20 @@ struct tm *gmtime_r(const time_t *timep, struct tm *result);
 #endif /* IPV6_MIN_MTU */
 
 
+#ifdef MEMCMP_IS_BROKEN
+#  ifdef memcmp
+#  undef memcmp
+#  endif
+#define memcmp memcmp_unbound
+int memcmp(const void *x, const void *y, size_t n);
+#endif
+
+
+
+#ifndef HAVE_CTIME_R
+#define ctime_r unbound_ctime_r
+char *ctime_r(const time_t *timep, char *buf);
+#endif
 
 #if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && (defined(HAVE_PTHREAD) || defined(HAVE_SOLARIS_THREADS))
    /* using version of libevent that is not threadsafe. */
@@ -763,8 +799,6 @@ struct sockaddr_storage;
 #include "compat/fake-rfc2553.h"
 #endif
 
-#include "ldns/ldns.h"
-
 #ifdef UNBOUND_ALLOC_STATS
 #  define malloc(s) unbound_stat_malloc_log(s, __FILE__, __LINE__, __func__)
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
@@ -782,7 +816,9 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-#endif /* UNBOUND_ALLOC_STATS */
+#elif defined(UNBOUND_ALLOC_LITE)
+#  include "util/alloc.h"
+#endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53

config.sub

@@ -4,7 +4,7 @@
 #   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
 #   Free Software Foundation, Inc.
 
-timestamp='2008-09-08'
+timestamp='2009-04-17'
 
 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -122,6 +122,7 @@ maybe_os=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\2/'`
 case $maybe_os in
   nto-qnx* | linux-gnu* | linux-dietlibc | linux-newlib* | linux-uclibc* | \
   uclinux-uclibc* | uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* | \
+  kopensolaris*-gnu* | \
   storm-chaos* | os2-emx* | rtmk-nova*)
     os=-$maybe_os
     basic_machine=`echo $1 | sed 's/^\(.*\)-\([^-]*-[^-]*\)$/\1/'`
@@ -249,6 +250,7 @@ case $basic_machine in
 	| h8300 | h8500 | hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
 	| i370 | i860 | i960 | ia64 \
 	| ip2k | iq2000 \
+	| lm32 \
 	| m32c | m32r | m32rle | m68000 | m68k | m88k \
 	| maxq | mb | microblaze | mcore | mep | metag \
 	| mips | mipsbe | mipseb | mipsel | mipsle \
@@ -270,6 +272,7 @@ case $basic_machine in
 	| mipsisa64sr71k | mipsisa64sr71kel \
 	| mipstx39 | mipstx39el \
 	| mn10200 | mn10300 \
+	| moxie \
 	| mt \
 	| msp430 \
 	| nios | nios2 \
@@ -279,7 +282,7 @@ case $basic_machine in
 	| powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \
 	| pyramid \
 	| score \
-	| sh | sh[1234] | sh[24]a | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
+	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
 	| sh64 | sh64le \
 	| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet | sparclite \
 	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
@@ -331,6 +334,7 @@ case $basic_machine in
 	| hppa-* | hppa1.[01]-* | hppa2.0-* | hppa2.0[nw]-* | hppa64-* \
 	| i*86-* | i860-* | i960-* | ia64-* \
 	| ip2k-* | iq2000-* \
+	| lm32-* \
 	| m32c-* | m32r-* | m32rle-* \
 	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
 	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* \
@@ -362,7 +366,7 @@ case $basic_machine in
 	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
 	| pyramid-* \
 	| romp-* | rs6000-* \
-	| sh-* | sh[1234]-* | sh[24]a-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
+	| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
 	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
 	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
 	| sparclite-* \
@@ -443,6 +447,10 @@ case $basic_machine in
 		basic_machine=m68k-apollo
 		os=-bsd
 		;;
+	aros)
+		basic_machine=i386-pc
+		os=-aros
+		;;
 	aux)
 		basic_machine=m68k-apple
 		os=-aux
@@ -1182,7 +1190,7 @@ case $basic_machine in
 	we32k)
 		basic_machine=we32k-att
 		;;
-	sh[1234] | sh[24]a | sh[34]eb | sh[1234]le | sh[23]ele)
+	sh[1234] | sh[24]a | sh[24]aeb | sh[34]eb | sh[1234]le | sh[23]ele)
 		basic_machine=sh-unknown
 		;;
 	sparc | sparcv8 | sparcv9 | sparcv9b | sparcv9v)
@@ -1254,8 +1262,9 @@ case $os in
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
 	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -sunos | -sunos[34]*\
 	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -solaris* | -sym* \
+	      | -kopensolaris* \
 	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
-	      | -aos* \
+	      | -aos* | -aros* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
 	      | -clix* | -riscos* | -uniplus* | -iris* | -rtu* | -xenix* \
 	      | -hiux* | -386bsd* | -knetbsd* | -mirbsd* | -netbsd* \

configure.ac

@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)
 
-AC_INIT(unbound, 1.3.3, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.4.4, unbound-bugs@nlnetlabs.nl, unbound)
 
-LIBUNBOUND_CURRENT=1
-LIBUNBOUND_REVISION=3
+LIBUNBOUND_CURRENT=2
+LIBUNBOUND_REVISION=4
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -22,6 +22,13 @@ LIBUNBOUND_AGE=0
 # 1.3.1 had 1:1:0
 # 1.3.2 had 1:2:0
 # 1.3.3 had 1:3:0
+# 1.3.4 had 1:4:0
+# 1.4.0-snapshots had 1:5:0
+# 1.4.0 had 1:5:0 (not 2:0:0)   # ub_result.why_bogus
+# 1.4.1 had 2:1:0
+# 1.4.2 had 2:2:0
+# 1.4.3 had 2:3:0
+# 1.4.4 had 2:4:0
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -157,10 +164,12 @@ ACX_CHECK_COMPILER_FLAG(xO4, [CFLAGS="$CFLAGS -xO4"])
 ACX_CHECK_COMPILER_FLAG(xtarget=generic, [CFLAGS="$CFLAGS -xtarget=generic"])
 
 # debug mode flags warnings
-AC_ARG_ENABLE(debug, AC_HELP_STRING([--enable-debug], [Enable debug warnings, asserts, makefile-dependencies]))
-debug_enabled="$enable_debug"
+AC_ARG_ENABLE(checking, AC_HELP_STRING([--enable-checking], [Enable warnings, asserts, makefile-dependencies]))
+AC_ARG_ENABLE(debug, AC_HELP_STRING([--enable-debug], [same as enable-checking]))
+if test "$enable_debug" = "yes"; then debug_enabled="$enable_debug"; 
+else debug_enabled="$enable_checking"; fi
 AC_SUBST(debug_enabled)
-case "$enable_debug" in
+case "$debug_enabled" in
         yes)
 		ACX_CHECK_COMPILER_FLAG(W, [CFLAGS="$CFLAGS -W"])
 		ACX_CHECK_COMPILER_FLAG(Wall, [CFLAGS="$CFLAGS -Wall"])
@@ -181,7 +190,16 @@ if test "$srcdir" != "."; then
 	CPPFLAGS="$CPPFLAGS -I$srcdir"
 fi
 
+AC_DEFUN([ACX_YYLEX_DESTROY], [
+	AC_MSG_CHECKING([for yylex_destroy])
+	if echo %% | $LEX -t 2>&1 | grep yylex_destroy >/dev/null 2>&1; then
+		AC_DEFINE(LEX_HAS_YYLEX_DESTROY, 1, [if lex has yylex_destroy])
+		AC_MSG_RESULT(yes)
+	else AC_MSG_RESULT(no); fi
+])
+
 AC_PROG_LEX
+ACX_YYLEX_DESTROY
 AC_PROG_YACC
 AC_CHECK_PROG(doxygen, doxygen, doxygen)
 AC_CHECK_TOOL(STRIP, strip)
@@ -210,9 +228,24 @@ ACX_TYPE_RLIM_T
 ACX_TYPE_SOCKLEN_T
 ACX_TYPE_IN_ADDR_T
 ACX_TYPE_IN_PORT_T
+ACX_CHECK_MEMCMP_SIGNED
 
 # add option to disable the evil rpath
 ACX_ARG_RPATH
+AC_SUBST(RUNTIME_PATH)
+
+# check to see if libraries are needed for these functions.
+AC_SEARCH_LIBS([inet_pton], [nsl])
+AC_SEARCH_LIBS([socket], [socket])
+
+# check some functions of the OS before linking libs (while still runnable).
+AC_FUNC_CHOWN
+AC_FUNC_FORK
+AC_TYPE_SIGNAL
+AC_FUNC_FSEEKO
+ACX_SYS_LARGEFILE
+ACX_CHECK_NONBLOCKING_BROKEN
+ACX_MKDIR_ONE_ARG
 
 # check for thread library.
 # check this first, so that the pthread lib does not get linked in via
@@ -302,6 +335,7 @@ if test x_$ub_test_python != x_no; then
 
    # Check for Python
    ub_have_python=no
+   ac_save_LIBS="$LIBS" dnl otherwise AC_PYTHON_DEVEL thrashes $LIBS
    AC_PYTHON_DEVEL
    if test ! -z "$PYTHON_VERSION"; then
 	if test `$PYTHON -c "print '$PYTHON_VERSION' >= '2.4.0'"` = "False"; then
@@ -350,23 +384,49 @@ fi
 # Checks for libraries.
 ACX_WITH_SSL
 ACX_LIB_SSL
-AC_CHECK_FUNCS([EVP_sha1 EVP_sha256 EVP_sha512 ENGINE_load_gost])
+AC_CHECK_HEADERS([openssl/conf.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_HEADERS([openssl/engine.h],,, [AC_INCLUDES_DEFAULT])
+AC_CHECK_FUNCS([OPENSSL_config EVP_sha1 EVP_sha256 EVP_sha512])
+AC_CHECK_DECLS([SSL_COMP_get_compression_methods], [], [], [
+AC_INCLUDES_DEFAULT
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
 
-AC_ARG_ENABLE(sha2, AC_HELP_STRING([--enable-sha2], [Enable SHA256 and SHA512 RRSIG support]))
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
+
+#ifdef HAVE_OPENSSL_CONF_H
+#include <openssl/conf.h>
+#endif
+
+#ifdef HAVE_OPENSSL_ENGINE_H
+#include <openssl/engine.h>
+#endif
+#include <openssl/ssl.h>
+#include <openssl/evp.h>
+])
+
+AC_ARG_ENABLE(sha2, AC_HELP_STRING([--disable-sha2], [Disable SHA256 and SHA512 RRSIG support]))
 case "$enable_sha2" in
+	no)
+	;;
+	yes|*)
+	AC_DEFINE([USE_SHA2], [1], [Define this to enable SHA256 and SHA512 support.])
+	;;
+esac
+
+AC_ARG_ENABLE(gost, AC_HELP_STRING([--enable-gost], [Enable GOST support, experimental]))
+case "$enable_gost" in
 	yes)
-	AC_DEFINE_UNQUOTED([USE_SHA2], [], [Define this to enable SHA256 and SHA512 support.])
+	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL >= 1.0.0 is needed for GOST support, upgrade openssl or rerun with --disable-gost])])
+	AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])
 	;;
 	no|*)
 	;;
 esac
 
-# check to see if libraries are needed for these functions.
-AC_SEARCH_LIBS([inet_pton], [nsl])
-AC_SEARCH_LIBS([socket], [socket])
-
-AC_SUBST(RUNTIME_PATH)
-
 # check for libevent
 AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
     [use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr  or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
@@ -398,9 +458,9 @@ if test x_$withval = x_yes -o x_$withval != x_no; then
 			mkdir build >/dev/null 2>&1
 			mkdir build/libevent >/dev/null 2>&1
 			mkdir build/libevent/.libs >/dev/null 2>&1
-			ev_files_o=`ls $thedir/*.o | grep -v evdns\.o`
-			ev_files_lo=`ls $thedir/*.lo | grep -v evdns\.lo`
-			ev_files_libso=`ls $thedir/.libs/*.o | grep -v evdns\.o`
+			ev_files_o=`ls $thedir/*.o | grep -v evdns\.o | grep -v bufferevent_openssl\.o`
+			ev_files_lo=`ls $thedir/*.lo | grep -v evdns\.lo | grep -v bufferevent_openssl\.lo`
+			ev_files_libso=`ls $thedir/.libs/*.o | grep -v evdns\.o | grep -v bufferevent_openssl\.o`
 			cp $ev_files_o build/libevent
 			cp $ev_files_lo build/libevent
 			cp $ev_files_libso build/libevent/.libs
@@ -466,30 +526,43 @@ fi
 
 # set memory allocation checking if requested
 AC_ARG_ENABLE(alloc-checks, AC_HELP_STRING([--enable-alloc-checks],
-	[ enable to check memory allocation, for debug purposes ]), 
+	[ enable to memory allocation statistics, for debug purposes ]), 
 	, )
+AC_ARG_ENABLE(alloc-lite, AC_HELP_STRING([--enable-alloc-lite],
+	[ enable for lightweight alloc assertions, for debug purposes ]), 
+	, )
+AC_ARG_ENABLE(alloc-nonregional, AC_HELP_STRING([--enable-alloc-nonregional],
+	[ enable nonregional allocs, slow but exposes regional allocations to other memory purifiers, for debug purposes ]), 
+	, )
+if test x_$enable_alloc_nonregional = x_yes; then
+	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
+fi
 if test x_$enable_alloc_checks = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
 else
-	ACX_FUNC_MALLOC([unbound])
+	if test x_$enable_alloc_lite = x_yes; then
+		AC_DEFINE(UNBOUND_ALLOC_LITE, 1, [use to enable lightweight alloc assertions, for debug use])
+	else
+		ACX_FUNC_MALLOC([unbound])
+	fi
 fi
 
-AC_FUNC_CHOWN
-AC_FUNC_FORK
-AC_TYPE_SIGNAL
-AC_FUNC_FSEEKO
-ACX_SYS_LARGEFILE
-
 ACX_CHECK_GETADDRINFO_WITH_INCLUDES
 if test "$USE_WINSOCK" = 1; then
 	AC_DEFINE(UB_ON_WINDOWS, 1, [Use win32 resources and API])
 	UB_ON_WINDOWS=yes
 	AC_SUBST(UB_ON_WINDOWS)
+	AC_CHECK_HEADERS([iphlpapi.h],,, [AC_INCLUDES_DEFAULT
+#include <windows.h>
+	])
 	AC_CHECK_TOOL(WINDRES, windres)
+	LIBS="$LIBS -liphlpapi"
 fi
 if test $ac_cv_func_getaddrinfo = no; then
 	AC_LIBOBJ([fake-rfc2553])
 fi
+# check after getaddrinfo for its libraries
+ACX_FUNC_IOCTLSOCKET
 
 # see if daemon(3) exists, and if it is deprecated.
 AC_CHECK_FUNCS([daemon])
@@ -500,15 +573,14 @@ if test $ac_cv_func_daemon = yes; then
 fi
 
 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev setresuid setreuid setresgid setregid glob initgroups strftime localtime_r setusercontext _beginthreadex])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev glob initgroups strftime localtime_r setusercontext _beginthreadex])
+AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
+AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 
 # check if setreuid en setregid fail, on MacOSX10.4(darwin8).
 if echo $build_os | grep darwin8 > /dev/null; then
 	AC_DEFINE(DARWIN_BROKEN_SETREUID, 1, [Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work])
 fi
-ACX_CHECK_NONBLOCKING_BROKEN
-ACX_MKDIR_ONE_ARG
-ACX_FUNC_IOCTLSOCKET
 AC_REPLACE_FUNCS(inet_aton)
 AC_REPLACE_FUNCS(inet_pton)
 AC_REPLACE_FUNCS(inet_ntop)
@@ -516,6 +588,7 @@ AC_REPLACE_FUNCS(snprintf)
 AC_REPLACE_FUNCS(strlcpy)
 AC_REPLACE_FUNCS(memmove)
 AC_REPLACE_FUNCS(gmtime_r)
+AC_REPLACE_FUNCS(ctime_r)
 
 # check this after all other compilation checks, since the linking of the lib
 # may break checks after this.
@@ -540,7 +613,11 @@ AC_ARG_WITH(ldns-builtin, AC_HELP_STRING([--with-ldns-builtin],
 # check if ldns is good enough
 if test "$use_ldns_builtin" = "no"; then
 	AC_CHECK_LIB(ldns, ldns_buffer_copy)
-	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes; then
+	AC_CHECK_FUNC(ldns_key_buf2rsa_raw)
+	AC_CHECK_HEADERS([ldns/ldns.h],,, [AC_INCLUDES_DEFAULT])
+	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes \
+	    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
+	    -a $ac_cv_header_ldns_ldns_h = yes; then
 	    dnl ldns was found, check compat functions
 	    AC_CHECK_FUNC([ldns_b32_ntop_extended_hex],, [
 		AC_MSG_ERROR([ldns version too old, need >=1.4.0])])
@@ -572,7 +649,7 @@ fi  dnl end of use_ldns_builtin == yes
 ACX_STRIP_EXT_FLAGS
 LDFLAGS="$LATE_LDFLAGS $LDFLAGS"
 
-AC_DEFINE_UNQUOTED([MAXSYSLOGMSGLEN], [5120], [Define to the maximum message length to pass to syslog.])
+AC_DEFINE_UNQUOTED([MAXSYSLOGMSGLEN], [10240], [Define to the maximum message length to pass to syslog.])
 
 AH_BOTTOM(
 dnl this must be first AH_CONFIG, to define the flags before any includes.
@@ -627,18 +704,6 @@ dnl includes
 #ifdef HAVE_WS2TCPIP_H
 #include <ws2tcpip.h>
 #endif
-
-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ERR_H
-#include <openssl/err.h>
-#endif
-
-#ifdef HAVE_OPENSSL_RAND_H
-#include <openssl/rand.h>
-#endif
 ]
 
 AHX_CONFIG_FORMAT_ATTRIBUTE
@@ -658,8 +723,14 @@ AHX_CONFIG_W32_RANDOM
 AHX_CONFIG_W32_SRANDOM
 AHX_CONFIG_W32_FD_SET_T
 AHX_CONFIG_IPV6_MIN_MTU
+AHX_MEMCMP_BROKEN(unbound)
 
 [
+#ifndef HAVE_CTIME_R
+#define ctime_r unbound_ctime_r
+char *ctime_r(const time_t *timep, char *buf);
+#endif
+
 #if defined(HAVE_EVENT_H) && !defined(HAVE_EVENT_BASE_ONCE) && (defined(HAVE_PTHREAD) || defined(HAVE_SOLARIS_THREADS))
    /* using version of libevent that is not threadsafe. */
 #  define LIBEVENT_SIGNAL_PROBLEM 1
@@ -681,8 +752,6 @@ struct sockaddr_storage;
 #include "compat/fake-rfc2553.h"
 #endif
 
-#include "ldns/ldns.h"
-
 #ifdef UNBOUND_ALLOC_STATS
 #  define malloc(s) unbound_stat_malloc_log(s, __FILE__, __LINE__, __func__)
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
@@ -700,7 +769,9 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-#endif /* UNBOUND_ALLOC_STATS */
+#elif defined(UNBOUND_ALLOC_LITE)
+#  include "util/alloc.h"
+#endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53

contrib/README

@@ -8,6 +8,8 @@ distribution but may be helpful.
 * update-anchor.sh: shell script that uses unbound-host to update a set
 	of trust anchor files. Run from cron twice a month.
 * update-itar.sh: shell script that updates from itar.iana.org. Run from cron.
+* split-itar.sh: shell script to split anchors.mf from itar.iana.org into
+	multiple key files so it can be used with auto-trust-anchor-file.
 * unbound_munin_ : plugin for munin statistics report
 * unbound_cacti.tar.gz : setup files for cacti statistics report
 * selinux: the .fc and .te files for SElinux protection of the unbound daemon

contrib/split-itar.sh

@@ -0,0 +1,46 @@
+#/usr/bin/env bash
+# Contributed by Tom Hendrikx <tom@whyscream.net>
+
+PROGNAME=$(basename $0)
+
+usage() {
+	echo "$PROGNAME: split the anchors.mf file from IANA into separate files." >&2
+	echo "" >&2
+	echo "$PROGNAME uses 2 arguments:" >&2
+	echo "  - the path to the anchors.mf, available at: https://itar.iana.org/" >&2
+	echo "  - the directory to leave the files, defaults to '.' (current working dir)" >&2
+	exit 1
+}
+
+if [ -n "$1" ] && [ -r "$1" ]; then
+	itar="$1"
+	echo "Reading from: $itar"
+else 
+	echo "Error: no anchors file given" >&2
+	usage
+fi
+
+if [ -n "$2" ]; then
+	dir="$2"
+else 
+	dir=$(pwd)
+fi
+
+if [ ! -d "$dir" ]; then
+	echo "Error: $dir is not a directory" >&2
+	usage
+fi
+
+while read cn line; do
+	if [ $(expr match "$cn" '[a-zA-Z0-9-]*\.') -gt 0 ]; then
+		# first line of key
+		out="$dir/$cn"anchor
+		echo "writing key for $cn to: $out"
+		echo "$cn	$line" > $out
+	elif [ "$cn" == "DS" ]; then
+		# second or later line of earlier defined key
+		echo "	$cn	$line" >> $out
+	fi
+done < "$itar"
+
+echo "Done."

contrib/unbound.spec

@@ -1,6 +1,6 @@
 Summary: Validating, recursive, and caching DNS resolver
 Name: unbound
-Version: 1.0.1
+Version: 1.4.4
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/

contrib/unbound.spec_fedora

@@ -1,5 +1,5 @@
-# initial python set up
-%{?!with_python:      %define with_python      0}
+# not ready yet
+%{?!with_python:      %global with_python      1}
 
 %if %{with_python}
 %{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")}
@@ -8,7 +8,7 @@
 
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.3.1rc2
+Version: 1.4.2
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
@@ -16,8 +16,8 @@ Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
 Source1: unbound.init
 Source2: unbound.conf
 Source3: unbound.munin
-# See the unbound svn repository for further documentation on these
-Patch0: unbound-1.2-glob.patch
+Source4: dlv.isc.org.key
+Patch1: unbound-1.2-glob.patch
 
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -31,7 +31,7 @@ Requires(post): chkconfig
 Requires(preun): chkconfig
 Requires(preun): initscripts
 Requires(postun): initscripts
-Requires: ldns >= 1.5.0, dnssec-conf >= 1.19
+Requires: ldns >= 1.5.0
 Requires(pre): shadow-utils
 
 %description
@@ -84,7 +84,7 @@ Python modules and extensions for unbound
 
 %prep
 %setup -q 
-%patch0 -p1
+%patch1 -p1
 
 %build
 %configure  --with-ldns= --with-libevent --with-pthreads --with-ssl \
@@ -95,7 +95,7 @@ Python modules and extensions for unbound
             --with-pythonmodule --with-pyunbound \
 %endif
             --enable-sha2 
-%{__make} CFLAGS="$RPM_OPT_FLAGS -D_GNU_SOURCE" QUIET=no %{?_smp_mflags}
+%{__make} 
 
 %install
 rm -rf %{buildroot}
@@ -112,6 +112,9 @@ for plugin in unbound_munin_hits unbound_munin_queue unbound_munin_memory unboun
     ln -s unbound %{buildroot}%{_datadir}/munin/plugins/$plugin
 done 
 
+# install DLV key
+install -m 0644 %{SOURCE4} %{buildroot}%{_sysconfdir}/unbound/
+
 # remove static library from install (fedora packaging guidelines)
 rm -rf %{buildroot}%{_libdir}/*.la
 
@@ -127,6 +130,7 @@ rm -rf ${RPM_BUILD_ROOT}
 %attr(0755,root,root) %dir %{_sysconfdir}/%{name}
 %attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dlv.isc.org.key
 %{_sbindir}/*
 %{_mandir}/*/*
 
@@ -160,15 +164,11 @@ exit 0
 
 %post
 /sbin/chkconfig --add %{name}
-# Check DNSSEC settings if this is a fresh install
-if [ "$1" -eq 1 ]; then
-  if [ -r /etc/sysconfig/dnssec ]; then
-    . /etc/sysconfig/dnssec
-    [ -x /usr/sbin/dnssec-configure ] && \
-      dnssec-configure -u --norestart --nocheck --dnssec="$DNSSEC" --dlv="$DLV" > \
-        /dev/null 2>&1
-  fi;
-fi
+# dnssec-conf used to contain our DLV key, but now we include it via unbound
+# If unbound had previously been configured with dnssec-configure, we need
+# to migrate the location of the DLV key file (to keep DLV enabled, and because
+# unbound won't start with a bad location for a DLV key file.
+sed -i "s:/etc/pki/dnssec-keys[/]*dlv:/etc/unbound:" %{_sysconfdir}/unbound/unbound.conf
 
 %post libs -p /sbin/ldconfig
 
@@ -186,6 +186,30 @@ fi
 %postun libs -p /sbin/ldconfig
 
 %changelog
+* Thu Feb 18 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-2
+- Removed dependancy for dnssec-conf
+- Added ISC DLV key (formerly in dnssec-conf)
+- Fixup old DLV locations in unbound.conf file via %%post
+
+* Tue Jan 05 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-1
+- Updated to 1.4.1
+- Changed %%define to %%global
+
+* Thu Oct 08 2009 Paul Wouters <paul@xelerance.com> - 1.3.4-2
+- Bump version
+
+* Thu Oct 08 2009 Paul Wouters <paul@xelerance.com> - 1.3.4-1
+- Upgraded to 1.3.4. Security fix with validating NSEC3 records
+
+* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 1.3.3-2
+- rebuilt with new openssl
+
+* Mon Aug 17 2009 Paul Wouters <paul@xelerance.com> - 1.3.3-1
+- Updated to 1.3.3
+
+* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
 * Sat Jun 20 2009 Paul Wouters <paul@xelerance.com> - 1.3.0-2
 - Added missing glob patch to cvs
 - Place python macros within the %%with_python check

contrib/unbound_munin_

@@ -235,6 +235,7 @@ if test "$1" = "config" ; then
 		done
 		p_config "total.num.queries" "total queries from clients"
 		p_config "total.num.cachehits" "cache hits"
+		p_config "total.num.prefetch" "cache prefetch"
 		p_config "num.query.tcp" "TCP queries"
 		p_config "num.query.ipv6" "IPv6 queries"
 		p_config "unwanted.queries" "queries that failed acl"
@@ -423,8 +424,8 @@ hits)
 	for x in thread0.num.queries thread1.num.queries thread2.num.queries \
 		thread3.num.queries thread4.num.queries thread5.num.queries \
 		thread6.num.queries thread7.num.queries total.num.queries \
-		total.num.cachehits num.query.tcp num.query.ipv6 \
-		unwanted.queries unwanted.replies; do
+		total.num.cachehits total.num.prefetch num.query.tcp \
+		num.query.ipv6 unwanted.queries unwanted.replies; do
 		if grep "^"$x"=" $state >/dev/null 2>&1; then
 			print_qps $x
 		fi

contrib/update-itar.sh

@@ -10,9 +10,9 @@ thedir="."
 # where is the file that unbound is going to read
 ub_ta_file="$thedir/anchors.mf"
 # where is the itar master file format
-itar_url="ftp://iana.org/itar/anchors.mf"
+itar_url="ftp://ftp.iana.org/itar/anchors.mf"
 # where is the itar PGP signature
-itar_sig="ftp://iana.org/itar/anchors.mf.sig"
+itar_sig="ftp://ftp.iana.org/itar/anchors.mf.sig"
 
 # which command to fetch urls, cmd $dest $url. "wget -O" "curl -o"
 fetch_cmd="wget -O"

daemon/cachedump.c

@@ -40,17 +40,24 @@
  * to text format.
  */
 #include "config.h"
+#include "ldns/ldns.h"
 #include "daemon/cachedump.h"
 #include "daemon/remote.h"
 #include "daemon/worker.h"
+#include "daemon/daemon.h"
 #include "services/cache/rrset.h"
 #include "services/cache/dns.h"
+#include "services/cache/infra.h"
+#include "services/modstack.h"
 #include "util/data/msgreply.h"
 #include "util/regional.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
+#include "iterator/iterator.h"
 #include "iterator/iter_delegpt.h"
 #include "iterator/iter_utils.h"
+#include "iterator/iter_fwd.h"
+#include "iterator/iter_hints.h"
 
 /** convert to ldns rr */
 static ldns_rr*
@@ -394,17 +401,16 @@ load_rr(SSL* ssl, ldns_buffer* buf, struct regional* region,
 		*go_on = 0;
 		return 1;
 	}
-	log_info("rd %s", (char*)ldns_buffer_begin(buf));
 	status = ldns_rr_new_frm_str(&rr, (char*)ldns_buffer_begin(buf),
 		LDNS_DEFAULT_TTL, NULL, NULL);
 	if(status != LDNS_STATUS_OK) {
-		(void)ssl_printf(ssl, "error cannot parse rr :%s: %s\n",
+		log_warn("error cannot parse rr :%s: %s",
 			ldns_get_errorstr_by_id(status),
 			(char*)ldns_buffer_begin(buf));
 		return 0;
 	}
 	if(is_rrsig && ldns_rr_get_type(rr) != LDNS_RR_TYPE_RRSIG) {
-		(void)ssl_printf(ssl, "error expected rrsig but got %s\n",
+		log_warn("error expected rrsig but got %s",
 			(char*)ldns_buffer_begin(buf));
 		return 0;
 	}
@@ -415,7 +421,7 @@ load_rr(SSL* ssl, ldns_buffer* buf, struct regional* region,
 	ldns_buffer_skip(buf, 2);
 	status = ldns_rr_rdata2buffer_wire(buf, rr);
 	if(status != LDNS_STATUS_OK) {
-		(void)ssl_printf(ssl, "error cannot rr2wire :%s\n",
+		log_warn("error cannot rr2wire :%s",
 			ldns_get_errorstr_by_id(status));
 		ldns_rr_free(rr);
 		return 0;
@@ -428,7 +434,7 @@ load_rr(SSL* ssl, ldns_buffer* buf, struct regional* region,
 		ldns_buffer_begin(buf), ldns_buffer_limit(buf));
 	if(!d->rr_data[i]) {
 		ldns_rr_free(rr);
-		(void)ssl_printf(ssl, "error out of memory\n");
+		log_warn("error out of memory");
 		return 0;
 	}
 
@@ -443,7 +449,7 @@ load_rr(SSL* ssl, ldns_buffer* buf, struct regional* region,
 		rk->rk.dname = regional_alloc_init(region, 
 			ldns_buffer_begin(buf), ldns_buffer_limit(buf));
 		if(!rk->rk.dname) {
-			(void)ssl_printf(ssl, "error out of memory\n");
+			log_warn("error out of memory");
 			ldns_rr_free(rr);
 			return 0;
 		}
@@ -455,7 +461,7 @@ load_rr(SSL* ssl, ldns_buffer* buf, struct regional* region,
 
 /** move entry into cache */
 static int
-move_into_cache(SSL* ssl, struct ub_packed_rrset_key* k, 
+move_into_cache(struct ub_packed_rrset_key* k, 
 	struct packed_rrset_data* d, struct worker* worker)
 {
 	struct ub_packed_rrset_key* ak;
@@ -466,7 +472,7 @@ move_into_cache(SSL* ssl, struct ub_packed_rrset_key* k,
 
 	ak = alloc_special_obtain(&worker->alloc);
 	if(!ak) {
-		(void)ssl_printf(ssl, "error out of memory\n");
+		log_warn("error out of memory");
 		return 0;
 	}
 	ak->entry.data = NULL;
@@ -474,7 +480,7 @@ move_into_cache(SSL* ssl, struct ub_packed_rrset_key* k,
 	ak->entry.hash = rrset_key_hash(&k->rk);
 	ak->rk.dname = (uint8_t*)memdup(k->rk.dname, k->rk.dname_len);
 	if(!ak->rk.dname) {
-		(void)ssl_printf(ssl, "error out of memory\n");
+		log_warn("error out of memory");
 		ub_packed_rrset_parsedelete(ak, &worker->alloc);
 		return 0;
 	}
@@ -484,6 +490,7 @@ move_into_cache(SSL* ssl, struct ub_packed_rrset_key* k,
 		s += d->rr_len[i];
 	ad = (struct packed_rrset_data*)malloc(s);
 	if(!ad) {
+		log_warn("error out of memory");
 		ub_packed_rrset_parsedelete(ak, &worker->alloc);
 		return 0;
 	}
@@ -528,13 +535,12 @@ load_rrset(SSL* ssl, ldns_buffer* buf, struct worker* worker)
 		sizeof(*rk));
 	d = (struct packed_rrset_data*)regional_alloc_zero(region, sizeof(*d));
 	if(!rk || !d) {
-		(void) ssl_printf(ssl, "error out of memory\n");
+		log_warn("error out of memory");
 		return 0;
 	}
 
 	if(strncmp(s, ";rrset", 6) != 0) {
-		(void)ssl_printf(ssl, "error expected ';rrset' but got %s\n",
-			s);
+		log_warn("error expected ';rrset' but got %s", s);
 		return 0;
 	}
 	s += 6;
@@ -544,11 +550,13 @@ load_rrset(SSL* ssl, ldns_buffer* buf, struct worker* worker)
 	}
 	if(sscanf(s, " %u %u %u %u %u", &ttl, &rr_count, &rrsig_count,
 		&trust, &security) != 5) {
-		(void)ssl_printf(ssl, "error bad rrset spec %s\n", s);
+		log_warn("error bad rrset spec %s", s);
 		return 0;
 	}
-	if(rr_count == 0 && rrsig_count == 0)
+	if(rr_count == 0 && rrsig_count == 0) {
+		log_warn("bad rrset without contents");
 		return 0;
+	}
 	d->count = (size_t)rr_count;
 	d->rrsig_count = (size_t)rrsig_count;
 	d->security = (enum sec_status)security;
@@ -562,7 +570,7 @@ load_rrset(SSL* ssl, ldns_buffer* buf, struct worker* worker)
 	d->rr_data = regional_alloc_zero(region, 
 		sizeof(uint8_t*)*(d->count+d->rrsig_count));
 	if(!d->rr_len || !d->rr_ttl || !d->rr_data) {
-		(void) ssl_printf(ssl, "error out of memory\n");
+		log_warn("error out of memory");
 		return 0;
 	}
 	
@@ -570,12 +578,14 @@ load_rrset(SSL* ssl, ldns_buffer* buf, struct worker* worker)
 	for(i=0; i<rr_count; i++) {
 		if(!load_rr(ssl, buf, region, rk, d, i, 0, 
 			&go_on, *worker->env.now)) {
+			log_warn("could not read rr %u", i);
 			return 0;
 		}
 	}
 	for(i=0; i<rrsig_count; i++) {
 		if(!load_rr(ssl, buf, region, rk, d, i+rr_count, 1, 
 			&go_on, *worker->env.now)) {
+			log_warn("could not read rrsig %u", i);
 			return 0;
 		}
 	}
@@ -584,7 +594,7 @@ load_rrset(SSL* ssl, ldns_buffer* buf, struct worker* worker)
 		return 1;
 	}
 
-	return move_into_cache(ssl, rk, d, worker);
+	return move_into_cache(rk, d, worker);
 }
 
 /** load rrset cache */
@@ -604,7 +614,7 @@ load_rrset_cache(SSL* ssl, struct worker* worker)
 /** read qinfo from next three words */
 static char*
 load_qinfo(char* str, struct query_info* qinfo, ldns_buffer* buf, 
-	struct regional* region, SSL* ssl)
+	struct regional* region)
 {
 	/* s is part of the buf */
 	char* s = str;
@@ -616,7 +626,7 @@ load_qinfo(char* str, struct query_info* qinfo, ldns_buffer* buf,
 	if(s) s = strchr(s+1, ' ');
 	if(s) s = strchr(s+1, ' ');
 	if(!s) {
-		(void)ssl_printf(ssl, "error line too short, %s\n", str);
+		log_warn("error line too short, %s", str);
 		return NULL;
 	}
 	s[0] = 0;
@@ -625,7 +635,7 @@ load_qinfo(char* str, struct query_info* qinfo, ldns_buffer* buf,
 	/* parse them */
 	status = ldns_rr_new_question_frm_str(&rr, str, NULL, NULL);
 	if(status != LDNS_STATUS_OK) {
-		(void)ssl_printf(ssl, "error cannot parse: %s %s\n",
+		log_warn("error cannot parse: %s %s",
 			ldns_get_errorstr_by_id(status), str);
 		return NULL;
 	}
@@ -635,7 +645,7 @@ load_qinfo(char* str, struct query_info* qinfo, ldns_buffer* buf,
 	status = ldns_dname2buffer_wire(buf, ldns_rr_owner(rr));
 	ldns_rr_free(rr);
 	if(status != LDNS_STATUS_OK) {
-		(void)ssl_printf(ssl, "error cannot dname2wire: %s\n", 
+		log_warn("error cannot dname2wire: %s", 
 			ldns_get_errorstr_by_id(status));
 		return NULL;
 	}
@@ -644,7 +654,7 @@ load_qinfo(char* str, struct query_info* qinfo, ldns_buffer* buf,
 	qinfo->qname = (uint8_t*)regional_alloc_init(region, 
 		ldns_buffer_begin(buf), ldns_buffer_limit(buf));
 	if(!qinfo->qname) {
-		(void)ssl_printf(ssl, "error out of memory\n");
+		log_warn("error out of memory");
 		return NULL;
 	}
 
@@ -670,12 +680,12 @@ load_ref(SSL* ssl, ldns_buffer* buf, struct worker* worker,
 		return 1;
 	}
 
-	s = load_qinfo(s, &qinfo, buf, region, ssl);
+	s = load_qinfo(s, &qinfo, buf, region);
 	if(!s) {
 		return 0;
 	}
 	if(sscanf(s, " %u", &flags) != 1) {
-		(void)ssl_printf(ssl, "error cannot parse flags: %s\n", s);
+		log_warn("error cannot parse flags: %s", s);
 		return 0;
 	}
 
@@ -711,11 +721,11 @@ load_msg(SSL* ssl, ldns_buffer* buf, struct worker* worker)
 	regional_free_all(region);
 
 	if(strncmp(s, "msg ", 4) != 0) {
-		(void)ssl_printf(ssl, "error expected msg but got %s\n", s);
+		log_warn("error expected msg but got %s", s);
 		return 0;
 	}
 	s += 4;
-	s = load_qinfo(s, &qinf, buf, region, ssl);
+	s = load_qinfo(s, &qinf, buf, region);
 	if(!s) {
 		return 0;
 	}
@@ -723,12 +733,13 @@ load_msg(SSL* ssl, ldns_buffer* buf, struct worker* worker)
 	/* read remainder of line */
 	if(sscanf(s, " %u %u %u %u %u %u %u", &flags, &qdcount, &ttl, 
 		&security, &an, &ns, &ar) != 7) {
-		(void)ssl_printf(ssl, "error cannot parse numbers: %s\n", s);
+		log_warn("error cannot parse numbers: %s", s);
 		return 0;
 	}
 	rep.flags = (uint16_t)flags;
 	rep.qdcount = (uint16_t)qdcount;
 	rep.ttl = (uint32_t)ttl;
+	rep.prefetch_ttl = PREFETCH_TTL_CALC(rep.ttl);
 	rep.security = (enum sec_status)security;
 	rep.an_numrrsets = (size_t)an;
 	rep.ns_numrrsets = (size_t)ns;
@@ -748,8 +759,8 @@ load_msg(SSL* ssl, ldns_buffer* buf, struct worker* worker)
 	if(!go_on) 
 		return 1; /* skip this one, not all references satisfied */
 
-	if(!dns_cache_store(&worker->env, &qinf, &rep, 0)) {
-		(void)ssl_printf(ssl, "error out of memory\n");
+	if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0)) {
+		log_warn("error out of memory");
 		return 0;
 	}
 	return 1;
@@ -779,6 +790,85 @@ load_cache(SSL* ssl, struct worker* worker)
 	return read_fixed(ssl, worker->env.scratch_buffer, "EOF");
 }
 
+/** print details on a delegation point */
+static void
+print_dp_details(SSL* ssl, struct worker* worker, struct delegpt* dp)
+{
+	char buf[257];
+	struct delegpt_addr* a;
+	int lame, dlame, rlame, rtt, edns_vs, to, lost;
+	uint8_t edns_lame_known;
+	for(a = dp->target_list; a; a = a->next_target) {
+		addr_to_str(&a->addr, a->addrlen, buf, sizeof(buf));
+		if(!ssl_printf(ssl, "%-16s\t", buf))
+			return;
+		if(a->bogus) {
+			if(!ssl_printf(ssl, "Address is BOGUS. ")) 
+				return;
+		}
+		/* lookup in infra cache */
+		/* uses type_A because most often looked up, but other
+		 * lameness won't be reported then */
+		if(!infra_get_lame_rtt(worker->env.infra_cache, 
+			&a->addr, a->addrlen, dp->name, dp->namelen,
+			LDNS_RR_TYPE_A, &lame, &dlame, &rlame, &rtt, &lost,
+			*worker->env.now)) {
+			if(!ssl_printf(ssl, "not in infra cache.\n"))
+				return;
+			continue; /* skip stuff not in infra cache */
+		}
+		if(!ssl_printf(ssl, "%s%s%s%srtt %d msec, %d lost. ",
+			lame?"LAME ":"", dlame?"NoDNSSEC ":"",
+			a->lame?"AddrWasParentSide ":"",
+			rlame?"NoAuthButRecursive ":"", rtt, lost))
+			return;
+		if(infra_host(worker->env.infra_cache, &a->addr, a->addrlen,
+			*worker->env.now, &edns_vs, &edns_lame_known, &to)) {
+			if(edns_vs == -1) {
+				if(!ssl_printf(ssl, "noEDNS%s.",
+					edns_lame_known?" probed":""))
+					return;
+			} else {
+				if(!ssl_printf(ssl, "EDNS %d%s.",
+					edns_vs, edns_lame_known?" probed":""))
+					return;
+			}
+		}
+		if(!ssl_printf(ssl, "\n"))
+			return;
+	}
+}
+
+/** print main dp info */
+static void
+print_dp_main(SSL* ssl, struct delegpt* dp, struct dns_msg* msg)
+{
+	size_t i, n_ns, n_miss, n_addr, n_res, n_avail;
+
+	/* print the dp */
+	if(msg)
+	    for(i=0; i<msg->rep->rrset_count; i++) {
+		struct ub_packed_rrset_key* k = msg->rep->rrsets[i];
+		struct packed_rrset_data* d = 
+			(struct packed_rrset_data*)k->entry.data;
+		if(d->security == sec_status_bogus) {
+			if(!ssl_printf(ssl, "Address is BOGUS:\n"))
+				return;
+		}
+		if(!dump_rrset(ssl, k, d, 0))
+			return;
+	    }
+	delegpt_count_ns(dp, &n_ns, &n_miss);
+	delegpt_count_addr(dp, &n_addr, &n_res, &n_avail);
+	/* since dp has not been used by iterator, all are available*/
+	if(!ssl_printf(ssl, "Delegation with %d names, of which %d "
+		"can be examined to query further addresses.\n"
+		"%sIt provides %d IP addresses.\n", 
+		(int)n_ns, (int)n_miss, (dp->bogus?"It is BOGUS. ":""),
+		(int)n_addr))
+		return;
+}
+
 int print_deleg_lookup(SSL* ssl, struct worker* worker, uint8_t* nm,
 	size_t nmlen, int ATTR_UNUSED(nmlabs))
 {
@@ -788,18 +878,34 @@ int print_deleg_lookup(SSL* ssl, struct worker* worker, uint8_t* nm,
 	struct regional* region = worker->scratchpad;
 	char b[260];
 	struct query_info qinfo;
-	size_t i, n_ns, n_miss, n_addr, n_res, n_avail;
+	struct iter_hints_stub* stub;
+	struct iter_env* ie;
 	regional_free_all(region);
 	qinfo.qname = nm;
 	qinfo.qname_len = nmlen;
 	qinfo.qtype = LDNS_RR_TYPE_A;
 	qinfo.qclass = LDNS_RR_CLASS_IN;
 
+	if(modstack_find(&worker->daemon->mods, "iterator") == -1) {
+		return ssl_printf(ssl, "error: no iterator module\n");
+	}
+	ie = (struct iter_env*)worker->env.modinfo[modstack_find(&worker->
+		daemon->mods, "iterator")];
+
 	dname_str(nm, b);
 	if(!ssl_printf(ssl, "The following name servers are used for lookup "
 		"of %s\n", b)) 
 		return 0;
 	
+	dp = forwards_lookup(worker->env.fwds, nm, qinfo.qclass);
+	if(dp) {
+		if(!ssl_printf(ssl, "forwarding request:\n"))
+			return 0;
+		print_dp_main(ssl, dp, NULL);
+		print_dp_details(ssl, worker, dp);
+		return 1;
+	}
+	
 	while(1) {
 		dp = dns_cache_find_delegation(&worker->env, nm, nmlen, 
 			qinfo.qtype, qinfo.qclass, region, &msg, 
@@ -808,29 +914,10 @@ int print_deleg_lookup(SSL* ssl, struct worker* worker, uint8_t* nm,
 			return ssl_printf(ssl, "no delegation from "
 				"cache; goes to configured roots\n");
 		}
-		/* print the dp */
-		for(i=0; i<msg->rep->rrset_count; i++) {
-			struct ub_packed_rrset_key* k = msg->rep->rrsets[i];
-			struct packed_rrset_data* d = 
-				(struct packed_rrset_data*)k->entry.data;
-			if(d->security == sec_status_bogus) {
-				if(!ssl_printf(ssl, "Address is BOGUS:\n"))
-					return 0;
-			}
-			if(!dump_rrset(ssl, k, d, 0))
-				return 0;
-		}
-		delegpt_count_ns(dp, &n_ns, &n_miss);
-		delegpt_count_addr(dp, &n_addr, &n_res, &n_avail);
-		/* since dp has not been used by iterator, all are available*/
-		if(!ssl_printf(ssl, "Delegation with %d names, of which %d "
-			"have no addresses in cache.\n"
-			"It provides %d IP addresses. %s\n", 
-			(int)n_ns, (int)n_miss, (int)n_addr, 
-			(dp->bogus?"It is BOGUS":"") ))
-			return 0;
 		/* go up? */
 		if(iter_dp_is_useless(&qinfo, BIT_RD, dp)) {
+			print_dp_main(ssl, dp, msg);
+			print_dp_details(ssl, worker, dp);
 			if(!ssl_printf(ssl, "cache delegation was "
 				"useless (no IP addresses)\n"))
 				return 0;
@@ -848,8 +935,25 @@ int print_deleg_lookup(SSL* ssl, struct worker* worker, uint8_t* nm,
 					return 0;
 				continue;
 			}
-		} else
-			break;
+		} 
+		stub = hints_lookup_stub(ie->hints, nm, qinfo.qclass, dp);
+		if(stub) {
+			if(stub->noprime) {
+				if(!ssl_printf(ssl, "The noprime stub servers "
+					"are used:\n"))
+					return 0;
+			} else {
+				if(!ssl_printf(ssl, "The stub is primed "
+						"with servers:\n"))
+					return 0;
+			}
+			print_dp_main(ssl, stub->dp, NULL);
+			print_dp_details(ssl, worker, stub->dp);
+		} else {
+			print_dp_main(ssl, dp, msg);
+			print_dp_details(ssl, worker, dp);
+		}
+		break;
 	}
 
 	return 1;

daemon/daemon.c

@@ -40,6 +40,22 @@
  */
 
 #include "config.h"
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
+
+#ifdef HAVE_OPENSSL_CONF_H
+#include <openssl/conf.h>
+#endif
+
+#ifdef HAVE_OPENSSL_ENGINE_H
+#include <openssl/engine.h>
+#endif
+#include "ldns/ldns.h"
 #include "daemon/daemon.h"
 #include "daemon/worker.h"
 #include "daemon/remote.h"
@@ -63,6 +79,15 @@ static int sig_record_quit = 0;
 /** How many reload requests happened. */
 static int sig_record_reload = 0;
 
+#if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
+/** cleaner ssl memory freeup */
+static void* comp_meth = NULL;
+#endif
+#ifdef LEX_HAS_YYLEX_DESTROY
+/** remove buffers for parsing and init */
+int ub_c_lex_destroy(void);
+#endif
+
 /** used when no other sighandling happens, so we don't die
   * when multiple signals in quick succession are sent to us. 
   * @param sig: signal number.
@@ -165,7 +190,17 @@ daemon_init()
 	checklock_start();
 	ERR_load_crypto_strings();
 	ERR_load_SSL_strings();
+#ifdef HAVE_OPENSSL_CONFIG
+	OPENSSL_config("unbound");
+#endif
+#ifdef USE_GOST
+	(void)ldns_key_EVP_load_gost_id();
+#endif
 	OpenSSL_add_all_algorithms();
+#if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
+	/* grab the COMP method ptr because openssl leaks it */
+	comp_meth = (void*)SSL_COMP_get_compression_methods();
+#endif
 	(void)SSL_library_init();
 #ifdef HAVE_TZSET
 	/* init timezone info while we are not chrooted yet */
@@ -257,7 +292,7 @@ int daemon_get_shufport(struct daemon* daemon, int* shufport)
         /* Knuth shuffle */
 	n = avail;
 	while(--n > 0) {
-		k = ub_random(daemon->rand) % (n+1); /* 0<= k<= n */
+		k = ub_random_max(daemon->rand, n+1); /* 0<= k<= n */
 		temp = shufport[k];
 		shufport[k] = shufport[n];
 		shufport[n] = temp;
@@ -492,10 +527,19 @@ daemon_delete(struct daemon* daemon)
 	free(daemon->pidfile);
 	free(daemon->env);
 	free(daemon);
+#ifdef LEX_HAS_YYLEX_DESTROY
+	/* lex cleanup */
+	ub_c_lex_destroy();
+#endif
 	/* libcrypto cleanup */
-	/* CONF_modules_unload(1); */
+#if HAVE_DECL_SSL_COMP_GET_COMPRESSION_METHODS
+	sk_SSL_COMP_free(comp_meth);
+#endif
+#ifdef HAVE_OPENSSL_CONFIG
 	EVP_cleanup();
-	/* ENGINE_cleanup(); */
+	ENGINE_cleanup();
+	CONF_modules_free();
+#endif
 	CRYPTO_cleanup_all_ex_data(); /* safe, no more threads right now */
 	ERR_remove_state(0);
 	ERR_free_strings();

daemon/remote.c

@@ -43,6 +43,11 @@
  * Both the server and the client(control tool) have their own keys.
  */
 #include "config.h"
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+#include <ctype.h>
+#include "ldns/ldns.h"
 #include "daemon/remote.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"
@@ -64,6 +69,7 @@
 #include "validator/val_kentry.h"
 #include "iterator/iterator.h"
 #include "iterator/iter_fwd.h"
+#include "iterator/iter_hints.h"
 #include "iterator/iter_delegpt.h"
 #include "services/outbound_list.h"
 #include "services/outside_network.h"
@@ -106,9 +112,9 @@ timeval_subtract(struct timeval* d, const struct timeval* end,
 	const struct timeval* start)
 {
 #ifndef S_SPLINT_S
-	time_t end_usec = end->tv_usec;;
+	time_t end_usec = end->tv_usec;
 	d->tv_sec = end->tv_sec - start->tv_sec;
-	while(end_usec < start->tv_usec) {
+	if(end_usec < start->tv_usec) {
 		end_usec += 1000000;
 		d->tv_sec--;
 	}
@@ -599,12 +605,15 @@ print_stats(SSL* ssl, const char* nm, struct stats_info* s)
 			- s->svr.num_queries_missed_cache))) return 0;
 	if(!ssl_printf(ssl, "%s.num.cachemiss"SQ"%u\n", nm, 
 		(unsigned)s->svr.num_queries_missed_cache)) return 0;
+	if(!ssl_printf(ssl, "%s.num.prefetch"SQ"%u\n", nm, 
+		(unsigned)s->svr.num_queries_prefetch)) return 0;
 	if(!ssl_printf(ssl, "%s.num.recursivereplies"SQ"%u\n", nm, 
 		(unsigned)s->mesh_replies_sent)) return 0;
 	if(!ssl_printf(ssl, "%s.requestlist.avg"SQ"%g\n", nm,
-		s->svr.num_queries_missed_cache?
+		(s->svr.num_queries_missed_cache+s->svr.num_queries_prefetch)?
 			(double)s->svr.sum_query_list_size/
-			s->svr.num_queries_missed_cache : 0.0)) return 0;
+			(s->svr.num_queries_missed_cache+
+			s->svr.num_queries_prefetch) : 0.0)) return 0;
 	if(!ssl_printf(ssl, "%s.requestlist.max"SQ"%u\n", nm,
 		(unsigned)s->svr.max_query_list_size)) return 0;
 	if(!ssl_printf(ssl, "%s.requestlist.overwritten"SQ"%u\n", nm,
@@ -1107,6 +1116,8 @@ struct del_info {
 	size_t len;
 	/** labels */
 	int labs;
+	/** now */
+	uint32_t now;
 	/** time to invalidate to */
 	uint32_t expired;
 	/** number of rrsets removed */
@@ -1127,8 +1138,10 @@ zone_del_rrset(struct lruhash_entry* e, void* arg)
 	if(dname_subdomain_c(k->rk.dname, inf->name)) {
 		struct packed_rrset_data* d = 
 			(struct packed_rrset_data*)e->data;
-		d->ttl = inf->expired;
-		inf->num_rrsets++;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_rrsets++;
+		}
 	}
 }
 
@@ -1141,8 +1154,10 @@ zone_del_msg(struct lruhash_entry* e, void* arg)
 	struct msgreply_entry* k = (struct msgreply_entry*)e->key;
 	if(dname_subdomain_c(k->key.qname, inf->name)) {
 		struct reply_info* d = (struct reply_info*)e->data;
-		d->ttl = inf->expired;
-		inf->num_msgs++;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_msgs++;
+		}
 	}
 }
 
@@ -1155,8 +1170,10 @@ zone_del_kcache(struct lruhash_entry* e, void* arg)
 	struct key_entry_key* k = (struct key_entry_key*)e->key;
 	if(dname_subdomain_c(k->name, inf->name)) {
 		struct key_entry_data* d = (struct key_entry_data*)e->data;
-		d->ttl = inf->expired;
-		inf->num_keys++;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_keys++;
+		}
 	}
 }
 
@@ -1168,7 +1185,6 @@ do_flush_zone(SSL* ssl, struct worker* worker, char* arg)
 	int nmlabs;
 	size_t nmlen;
 	struct del_info inf;
-	int idx;
 	if(!parse_arg_name(ssl, arg, &nm, &nmlen, &nmlabs))
 		return;
 	/* delete all RRs and key entries from zone */
@@ -1177,6 +1193,7 @@ do_flush_zone(SSL* ssl, struct worker* worker, char* arg)
 	inf.name = nm;
 	inf.len = nmlen;
 	inf.labs = nmlabs;
+	inf.now = *worker->env.now;
 	inf.expired = *worker->env.now;
 	inf.expired -= 3; /* handle 3 seconds skew between threads */
 	inf.num_rrsets = 0;
@@ -1188,10 +1205,9 @@ do_flush_zone(SSL* ssl, struct worker* worker, char* arg)
 	slabhash_traverse(worker->env.msg_cache, 1, &zone_del_msg, &inf);
 
 	/* and validator cache */
-	idx = modstack_find(&worker->daemon->mods, "validator");
-	if(idx != -1) {
-		struct val_env* ve = (struct val_env*)worker->env.modinfo[idx];
-		slabhash_traverse(ve->kcache->slab, 1, &zone_del_kcache, &inf);
+	if(worker->env.key_cache) {
+		slabhash_traverse(worker->env.key_cache->slab, 1, 
+			&zone_del_kcache, &inf);
 	}
 
 	free(nm);
@@ -1225,20 +1241,24 @@ do_flush_name(SSL* ssl, struct worker* w, char* arg)
 	send_ok(ssl);
 }
 
-/** print root forwards */
+/** printout a delegation point info */
 static int
-print_root_fwds(SSL* ssl, struct iter_forwards* fwds, uint8_t* root)
+ssl_print_name_dp(SSL* ssl, char* str, uint8_t* nm, uint16_t dclass,
+	struct delegpt* dp)
 {
 	char buf[257];
-	struct delegpt* dp;
 	struct delegpt_ns* ns;
 	struct delegpt_addr* a;
 	int f = 0;
-	dp = forwards_lookup(fwds, root, LDNS_RR_CLASS_IN);
-	if(!dp) 
-		return ssl_printf(ssl, "off (using root hints)\n");
-	/* if dp is returned it must be the root */
-	log_assert(query_dname_compare(dp->name, root)==0);
+	if(str) { /* print header for forward, stub */
+		char* c = ldns_rr_class2str(dclass);
+		dname_str(nm, buf);
+		if(!ssl_printf(ssl, "%s %s %s: ", buf, c, str)) {
+			free(c);
+			return 0;
+		}
+		free(c);
+	}
 	for(ns = dp->nslist; ns; ns = ns->next) {
 		dname_str(ns->name, buf);
 		if(!ssl_printf(ssl, "%s%s", (f?" ":""), buf))
@@ -1254,6 +1274,20 @@ print_root_fwds(SSL* ssl, struct iter_forwards* fwds, uint8_t* root)
 	return ssl_printf(ssl, "\n");
 }
 
+
+/** print root forwards */
+static int
+print_root_fwds(SSL* ssl, struct iter_forwards* fwds, uint8_t* root)
+{
+	struct delegpt* dp;
+	dp = forwards_lookup(fwds, root, LDNS_RR_CLASS_IN);
+	if(!dp)
+		return ssl_printf(ssl, "off (using root hints)\n");
+	/* if dp is returned it must be the root */
+	log_assert(query_dname_compare(dp->name, root)==0);
+	return ssl_print_name_dp(ssl, NULL, root, LDNS_RR_CLASS_IN, dp);
+}
+
 /** parse args into delegpt */
 static struct delegpt*
 parse_delegpt(SSL* ssl, struct regional* region, char* args, uint8_t* root)
@@ -1282,7 +1316,7 @@ parse_delegpt(SSL* ssl, struct regional* region, char* args, uint8_t* root)
 			return NULL;
 		}
 		/* add address */
-		if(!delegpt_add_addr(dp, region, &addr, addrlen, 0, 1)) {
+		if(!delegpt_add_addr(dp, region, &addr, addrlen, 0, 0, 1)) {
 			(void)ssl_printf(ssl, "error out of memory\n");
 			return NULL;
 		}
@@ -1459,6 +1493,129 @@ do_dump_requestlist(SSL* ssl, struct worker* worker)
 	}
 }
 
+/** do the log_reopen command */
+static void
+do_log_reopen(SSL* ssl, struct worker* worker)
+{
+	struct config_file* cfg = worker->env.cfg;
+	send_ok(ssl);
+	log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
+}
+
+/** do the set_option command */
+static void
+do_set_option(SSL* ssl, struct worker* worker, char* arg)
+{
+	char* arg2;
+	if(!find_arg2(ssl, arg, &arg2))
+		return;
+	if(!config_set_option(worker->env.cfg, arg, arg2)) {
+		(void)ssl_printf(ssl, "error setting option\n");
+		return;
+	}
+	send_ok(ssl);
+}
+
+/* routine to printout option values over SSL */
+void remote_get_opt_ssl(char* line, void* arg)
+{
+	SSL* ssl = (SSL*)arg;
+	(void)ssl_printf(ssl, "%s\n", line);
+}
+
+/** do the get_option command */
+static void
+do_get_option(SSL* ssl, struct worker* worker, char* arg)
+{
+	int r;
+	r = config_get_option(worker->env.cfg, arg, remote_get_opt_ssl, ssl);
+	if(!r) {
+		(void)ssl_printf(ssl, "error unknown option\n");
+		return;
+	}
+}
+
+/** do the list_forwards command */
+static void
+do_list_forwards(SSL* ssl, struct worker* worker)
+{
+	/* since its a per-worker structure no locks needed */
+	struct iter_forwards* fwds = worker->env.fwds;
+	struct iter_forward_zone* z;
+	RBTREE_FOR(z, struct iter_forward_zone*, fwds->tree) {
+		if(!z->dp) continue; /* skip empty marker for stub */
+		if(!ssl_print_name_dp(ssl, "forward", z->name, z->dclass,
+			z->dp))
+			return;
+	}
+}
+
+/** do the list_stubs command */
+static void
+do_list_stubs(SSL* ssl, struct worker* worker)
+{
+	/* readonly structure */
+	int m;
+	struct iter_hints_stub* z;
+	struct iter_env* ie;
+	m = modstack_find(&worker->env.mesh->mods, "iterator");
+	if(m == -1) {
+		(void)ssl_printf(ssl, "error no iterator module\n");
+		return;
+	}
+	ie = (struct iter_env*)worker->env.modinfo[m];
+	RBTREE_FOR(z, struct iter_hints_stub*, &ie->hints->tree) {
+		if(!ssl_print_name_dp(ssl, 
+			z->noprime?"stub noprime":"stub prime", z->node.name,
+			z->node.dclass, z->dp))
+			return;
+	}
+}
+
+/** do the list_local_zones command */
+static void
+do_list_local_zones(SSL* ssl, struct worker* worker)
+{
+	struct local_zones* zones = worker->daemon->local_zones;
+	struct local_zone* z;
+	char buf[257];
+	lock_quick_lock(&zones->lock);
+	RBTREE_FOR(z, struct local_zone*, &zones->ztree) {
+		lock_rw_rdlock(&z->lock);
+		dname_str(z->name, buf);
+		(void)ssl_printf(ssl, "%s %s\n", buf, 
+			local_zone_type2str(z->type));
+		lock_rw_unlock(&z->lock);
+	}
+	lock_quick_unlock(&zones->lock);
+}
+
+/** do the list_local_data command */
+static void
+do_list_local_data(SSL* ssl, struct worker* worker)
+{
+	struct local_zones* zones = worker->daemon->local_zones;
+	struct local_zone* z;
+	struct local_data* d;
+	struct local_rrset* p;
+	lock_quick_lock(&zones->lock);
+	RBTREE_FOR(z, struct local_zone*, &zones->ztree) {
+		lock_rw_rdlock(&z->lock);
+		RBTREE_FOR(d, struct local_data*, &z->data) {
+			for(p = d->rrsets; p; p = p->next) {
+				ldns_rr_list* rr = packed_rrset_to_rr_list(
+					p->rrset, worker->env.scratch_buffer);
+				char* str = ldns_rr_list2str(rr);
+				(void)ssl_printf(ssl, "%s", str);
+				free(str);
+				ldns_rr_list_free(rr);
+			}
+		}
+		lock_rw_unlock(&z->lock);
+	}
+	lock_quick_unlock(&zones->lock);
+}
+
 /** tell other processes to execute the command */
 void
 distribute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd)
@@ -1506,6 +1663,18 @@ execute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd,
 	} else if(strncmp(p, "load_cache", 10) == 0) {
 		if(load_cache(ssl, worker)) send_ok(ssl);
 		return;
+	} else if(strncmp(p, "list_forwards", 13) == 0) {
+		do_list_forwards(ssl, worker);
+		return;
+	} else if(strncmp(p, "list_stubs", 10) == 0) {
+		do_list_stubs(ssl, worker);
+		return;
+	} else if(strncmp(p, "list_local_zones", 16) == 0) {
+		do_list_local_zones(ssl, worker);
+		return;
+	} else if(strncmp(p, "list_local_data", 15) == 0) {
+		do_list_local_data(ssl, worker);
+		return;
 	} else if(strncmp(p, "forward", 7) == 0) {
 		/* must always distribute this cmd */
 		if(rc) distribute_cmd(rc, ssl, cmd);
@@ -1552,6 +1721,12 @@ execute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd,
 		do_flush_name(ssl, worker, skipwhite(p+5));
 	} else if(strncmp(p, "dump_requestlist", 16) == 0) {
 		do_dump_requestlist(ssl, worker);
+	} else if(strncmp(p, "log_reopen", 10) == 0) {
+		do_log_reopen(ssl, worker);
+	} else if(strncmp(p, "set_option", 10) == 0) {
+		do_set_option(ssl, worker, skipwhite(p+10));
+	} else if(strncmp(p, "get_option", 10) == 0) {
+		do_get_option(ssl, worker, skipwhite(p+10));
 	} else {
 		(void)ssl_printf(ssl, "error unknown command '%s'\n", p);
 	}

daemon/remote.h

@@ -45,6 +45,9 @@
 
 #ifndef DAEMON_REMOTE_H
 #define DAEMON_REMOTE_H
+#ifdef HAVE_OPENSSL_SSL_H
+#include "openssl/ssl.h"
+#endif
 struct config_file;
 struct listen_list;
 struct listen_port;
@@ -171,4 +174,7 @@ int ssl_printf(SSL* ssl, const char* format, ...)
  */
 int ssl_read_line(SSL* ssl, char* buf, size_t max);
 
+/** routine to printout option values over SSL */
+void remote_get_opt_ssl(char* line, void* arg);
+
 #endif /* DAEMON_REMOTE_H */

daemon/stats.c

@@ -40,6 +40,7 @@
  * numbers. These 'statistics' may be of interest to the operator.
  */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "daemon/stats.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"
@@ -58,7 +59,7 @@ timeval_add(struct timeval* d, const struct timeval* add)
 #ifndef S_SPLINT_S
 	d->tv_sec += add->tv_sec;
 	d->tv_usec += add->tv_usec;
-	while(d->tv_usec > 1000000 ) {
+	if(d->tv_usec > 1000000) {
 		d->tv_usec -= 1000000;
 		d->tv_sec++;
 	}
@@ -79,20 +80,31 @@ void server_stats_querymiss(struct server_stats* stats, struct worker* worker)
 		stats->max_query_list_size = worker->env.mesh->all.count;
 }
 
+void server_stats_prefetch(struct server_stats* stats, struct worker* worker)
+{
+	stats->num_queries_prefetch++;
+	/* changes the query list size so account that, like a querymiss */
+	stats->sum_query_list_size += worker->env.mesh->all.count;
+	if(worker->env.mesh->all.count > stats->max_query_list_size)
+		stats->max_query_list_size = worker->env.mesh->all.count;
+}
+
 void server_stats_log(struct server_stats* stats, struct worker* worker,
 	int threadnum)
 {
 	log_info("server stats for thread %d: %u queries, "
-		"%u answers from cache, %u recursions", 
+		"%u answers from cache, %u recursions, %u prefetch", 
 		threadnum, (unsigned)stats->num_queries, 
 		(unsigned)(stats->num_queries - 
 			stats->num_queries_missed_cache),
-		(unsigned)stats->num_queries_missed_cache);
+		(unsigned)stats->num_queries_missed_cache,
+		(unsigned)stats->num_queries_prefetch);
 	log_info("server stats for thread %d: requestlist max %u avg %g "
 		"exceeded %u", threadnum, (unsigned)stats->max_query_list_size,
-		stats->num_queries_missed_cache?
+		(stats->num_queries_missed_cache+stats->num_queries_prefetch)?
 			(double)stats->sum_query_list_size/
-			stats->num_queries_missed_cache : 0.0,
+			(stats->num_queries_missed_cache+
+			stats->num_queries_prefetch) : 0.0,
 		(unsigned)worker->env.mesh->stats_dropped);
 }
 
@@ -187,6 +199,7 @@ void server_stats_add(struct stats_info* total, struct stats_info* a)
 {
 	total->svr.num_queries += a->svr.num_queries;
 	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
+	total->svr.num_queries_prefetch += a->svr.num_queries_prefetch;
 	total->svr.sum_query_list_size += a->svr.sum_query_list_size;
 	/* the max size reached is upped to higher of both */
 	if(a->svr.max_query_list_size > total->svr.max_query_list_size)

daemon/stats.h

@@ -43,6 +43,7 @@
 #ifndef DAEMON_STATS_H
 #define DAEMON_STATS_H
 #include "util/timehist.h"
+#include "ldns/buffer.h"
 struct worker;
 struct config_file;
 struct comm_point;
@@ -64,6 +65,8 @@ struct server_stats {
 	size_t num_queries;
 	/** number of queries that had a cache-miss. */
 	size_t num_queries_missed_cache;
+	/** number of prefetch queries - cachehits with prefetch */
+	size_t num_queries_prefetch;
 
 	/**
 	 * Sum of the querylistsize of the worker for 
@@ -166,6 +169,9 @@ void server_stats_init(struct server_stats* stats, struct config_file* cfg);
 /** add query if it missed the cache */
 void server_stats_querymiss(struct server_stats* stats, struct worker* worker);
 
+/** add query if was cached and also resulted in a prefetch */
+void server_stats_prefetch(struct server_stats* stats, struct worker* worker);
+
 /** display the stats to the log */
 void server_stats_log(struct server_stats* stats, struct worker* worker,
 	int threadnum);

daemon/unbound.c

@@ -41,6 +41,9 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 #include "util/log.h"
 #include "daemon/daemon.h"
 #include "daemon/remote.h"
@@ -120,6 +123,14 @@ static void usage()
 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
 }
 
+#ifndef unbound_testbound
+int replay_var_compare(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
+{
+        log_assert(0);
+        return 0;
+}
+#endif
+
 /** check file descriptor count */
 static void
 checkrlimits(struct config_file* cfg)
@@ -305,7 +316,7 @@ detach(void)
 	if(daemon(1, 0) != 0)
 		fatal_exit("daemon failed: %s", strerror(errno));
 #else /* no HAVE_DAEMON */
-#ifdef HAVE_WORKING_FORK
+#ifdef HAVE_FORK
 	int fd;
 	/* Take off... */
 	switch (fork()) {
@@ -329,7 +340,7 @@ detach(void)
 		if (fd > 2)
 			(void)close(fd);
 	}
-#endif /* HAVE_WORKING_FORK */
+#endif /* HAVE_FORK */
 #endif /* HAVE_DAEMON */
 }
 

daemon/worker.c

@@ -40,6 +40,7 @@
  * pending requests.
  */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/random.h"
@@ -66,6 +67,7 @@
 #include "util/fptr_wlist.h"
 #include "util/tube.h"
 #include "iterator/iter_fwd.h"
+#include "validator/autotrust.h"
 
 #ifdef HAVE_SYS_TYPES_H
 #  include <sys/types.h>
@@ -81,6 +83,18 @@
 /** Size of an UDP datagram */
 #define NORMAL_UDP_SIZE	512 /* bytes */
 
+/** 
+ * seconds to add to prefetch leeway.  This is a TTL that expires old rrsets
+ * earlier than they should in order to put the new update into the cache.
+ * This additional value is to make sure that if not all TTLs are equal in
+ * the message to be updated(and replaced), that rrsets with up to this much
+ * extra TTL are also replaced.  This means that the resulting new message
+ * will have (most likely) this TTL at least, avoiding very small 'split
+ * second' TTLs due to operators choosing relative primes for TTLs (or so).
+ * Also has to be at least one to break ties (and overwrite cached entry).
+ */
+#define PREFETCH_EXPIRY_ADD 60
+
 #ifdef UNBOUND_ALLOC_STATS
 /** measure memory leakage */
 static void
@@ -588,6 +602,24 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	return 1;
 }
 
+/** Reply to client and perform prefetch to keep cache up to date */
+static void
+reply_and_prefetch(struct worker* worker, struct query_info* qinfo, 
+	uint16_t flags, struct comm_reply* repinfo, uint32_t leeway)
+{
+	/* first send answer to client to keep its latency 
+	 * as small as a cachereply */
+	comm_point_send_reply(repinfo);
+	server_stats_prefetch(&worker->stats, worker);
+	
+	/* create the prefetch in the mesh as a normal lookup without
+	 * client addrs waiting, which has the cache blacklisted (to bypass
+	 * the cache and go to the network for the data). */
+	/* this (potentially) runs the mesh for the new query */
+	mesh_new_prefetch(worker->env.mesh, qinfo, flags, leeway + 
+		PREFETCH_EXPIRY_ADD);
+}
+
 /**
  * Fill CH class answer into buffer. Keeps query.
  * @param pkt: buffer
@@ -805,6 +837,7 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 	}
 	if(local_zones_answer(worker->daemon->local_zones, &qinfo, &edns, 
 		c->buffer, worker->scratchpad)) {
+		regional_free_all(worker->scratchpad);
 		if(ldns_buffer_limit(c->buffer) == 0) {
 			comm_point_drop_reply(repinfo);
 			return 0;
@@ -834,6 +867,17 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			*(uint16_t*)ldns_buffer_begin(c->buffer), 
 			ldns_buffer_read_u16_at(c->buffer, 2), repinfo, 
 			&edns)) {
+			/* prefetch it if the prefetch TTL expired */
+			if(worker->env.cfg->prefetch && *worker->env.now >=
+				((struct reply_info*)e->data)->prefetch_ttl) {
+				uint32_t leeway = ((struct reply_info*)e->
+					data)->ttl - *worker->env.now;
+				lock_rw_unlock(&e->lock);
+				reply_and_prefetch(worker, &qinfo, 
+					ldns_buffer_read_u16_at(c->buffer, 2),
+					repinfo, leeway);
+				return 0;
+			}
 			lock_rw_unlock(&e->lock);
 			return 1;
 		}
@@ -921,8 +965,10 @@ worker_restart_timer(struct worker* worker)
 {
 	if(worker->env.cfg->stat_interval > 0) {
 		struct timeval tv;
+#ifndef S_SPLINT_S
 		tv.tv_sec = worker->env.cfg->stat_interval;
 		tv.tv_usec = 0;
+#endif
 		comm_timer_set(worker->stat_timer, &tv);
 	}
 }
@@ -940,6 +986,18 @@ void worker_stat_timer_cb(void* arg)
 	worker_restart_timer(worker);
 }
 
+void worker_probe_timer_cb(void* arg)
+{
+	struct worker* worker = (struct worker*)arg;
+	struct timeval tv;
+#ifndef S_SPLINT_S
+	tv.tv_sec = (time_t)autr_probe_timer(&worker->env);
+	tv.tv_usec = 0;
+#endif
+	if(tv.tv_sec != 0)
+		comm_timer_set(worker->env.probe_timer, &tv);
+}
+
 struct worker* 
 worker_create(struct daemon* daemon, int id, int* ports, int n)
 {
@@ -1036,7 +1094,8 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		cfg->do_tcp?cfg->outgoing_num_tcp:0, 
 		worker->daemon->env->infra_cache, worker->rndstate,
 		cfg->use_caps_bits_for_id, worker->ports, worker->numports,
-		cfg->unwanted_threshold, &worker_alloc_cleanup, worker);
+		cfg->unwanted_threshold, &worker_alloc_cleanup, worker,
+		cfg->do_udp);
 	if(!worker->back) {
 		log_err("could not create outgoing sockets");
 		worker_delete(worker);
@@ -1091,6 +1150,24 @@ worker_init(struct worker* worker, struct config_file *cfg,
 		worker_delete(worker);
 		return 0;
 	}
+	/* one probe timer per process -- if we have 5011 anchors */
+	if(autr_get_num_anchors(worker->env.anchors) > 0
+#ifndef THREADS_DISABLED
+		&& worker->thread_num == 0
+#endif
+		) {
+		struct timeval tv;
+		tv.tv_sec = 0;
+		tv.tv_usec = 0;
+		worker->env.probe_timer = comm_timer_create(worker->base,
+			worker_probe_timer_cb, worker);
+		if(!worker->env.probe_timer) {
+			log_err("could not create 5011-probe timer");
+		} else {
+			/* let timer fire, then it can reset itself */
+			comm_timer_set(worker->env.probe_timer, &tv);
+		}
+	}
 	if(!worker->env.mesh || !worker->env.scratch_buffer) {
 		worker_delete(worker);
 		return 0;
@@ -1130,6 +1207,7 @@ worker_delete(struct worker* worker)
 	comm_signal_delete(worker->comsig);
 	tube_delete(worker->cmd);
 	comm_timer_delete(worker->stat_timer);
+	comm_timer_delete(worker->env.probe_timer);
 	free(worker->ports);
 	if(worker->thread_num == 0) {
 		log_set_time(NULL);
@@ -1170,7 +1248,7 @@ outbound_entry_compare(void* a, void* b)
 
 struct outbound_entry*
 worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
-	uint16_t qclass, uint16_t flags, int dnssec,
+	uint16_t qclass, uint16_t flags, int dnssec, int want_dnssec,
 	struct sockaddr_storage* addr, socklen_t addrlen,
 	struct module_qstate* q)
 {
@@ -1181,9 +1259,9 @@ worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		return NULL;
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(worker->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, addr, addrlen, 
-		worker_handle_service_reply, e, worker->back->udp_buff,
-		&outbound_entry_compare);
+		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
+		addr, addrlen, worker_handle_service_reply, e, 
+		worker->back->udp_buff, &outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -1218,7 +1296,8 @@ int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
@@ -1249,13 +1328,15 @@ void libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
 }
 
 void libworker_fg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
-        ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s))
+        ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
+	char* ATTR_UNUSED(why_bogus))
 {
 	log_assert(0);
 }
 
 void libworker_bg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode),
-        ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s))
+        ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
+	char* ATTR_UNUSED(why_bogus))
 {
 	log_assert(0);
 }
@@ -1277,3 +1358,4 @@ int codeline_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
         log_assert(0);
         return 0;
 }
+

daemon/worker.h

@@ -189,6 +189,7 @@ int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  * @param qclass: query class. (host order)
  * @param flags: host order flags word, with opcode and CD bit.
  * @param dnssec: if set, EDNS record will have DO bit set.
+ * @param want_dnssec: signatures needed.
  * @param addr: where to.
  * @param addrlen: length of addr.
  * @param q: wich query state to reactivate upon return.
@@ -197,7 +198,7 @@ int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  */
 struct outbound_entry* worker_send_query(uint8_t* qname, size_t qnamelen, 
 	uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec, 
-	struct sockaddr_storage* addr, socklen_t addrlen,
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
 	struct module_qstate* q);
 
 /** 
@@ -236,4 +237,7 @@ void worker_stats_clear(struct worker* worker);
 /** statistics timer callback handler */
 void worker_stat_timer_cb(void* arg);
 
+/** probe timer callback handler */
+void worker_probe_timer_cb(void* arg);
+
 #endif /* DAEMON_WORKER_H */

doc/CREDITS

@@ -16,3 +16,5 @@ Alexander Gall - multihomed, anycast testing of unbound resolver server.
 Zdenek Vasicek and Marek Vavrusa - python module.
 cz.nic - sponsoring 'summer of code' development by Zdenek and Marek.
 Brett Carr - windows beta testing.
+Luca Bruno - patch for windows support in libunbound hosts and resolvconf().
+Tom Hendrikx - contributed split-itar.sh a useful script to 5011-track ITAR.

doc/Changelog

@@ -1,3 +1,587 @@
+16 April 2010: Wouter
+	- more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN.
+	- tag 1.4.4rc1.
+
+15 April 2010: Wouter
+	- ECC-GOST algorithm number 12 that is assigned by IANA.  New test
+	  example key and signatures for GOST.  GOST requires openssl-1.0.0.
+	  GOST is still disabled by default.
+
+9 April 2010: Wouter
+	- Fix bug#305: pkt_dname_tolower could read beyond end of buffer or
+	  get into an endless loop, if 0x20 was enabled, and buffers are small
+	  or particular broken packets are received.
+	- Fix chain of trust with CNAME at an intermediate step, for the DS
+	  processing proof.
+
+8 April 2010: Wouter
+	- Fix validation of queries with wildcard names (*.example).
+
+6 April 2010: Wouter
+	- Fix EDNS probe for .de DNSSEC testbed failure, where the infra
+	  cache timeout coincided with a server update, the current EDNS 
+	  backoff is less sensitive, and does not cache the backoff unless 
+	  the backoff actually works and the domain is not expecting DNSSEC.
+	- GOST support with correct algorithm numbers.
+
+1 April 2010: Wouter
+	- iana portlist updated.
+
+24 March 2010: Wouter
+	- unbound control flushed items are not counted when flushed again.
+
+23 March 2010: Wouter
+	- iana portlist updated.
+
+22 March 2010: Wouter
+	- unbound-host disables use-syslog from config file so that the
+	  config file for the main server can be used more easily.
+	- fix bug#301: unbound-checkconf could not parse interface
+	  '0.0.0.0@5353', even though unbound itself worked fine.
+
+19 March 2010: Wouter
+	- fix fwd_ancil test to pass if the socket options are not supported.
+
+18 March 2010: Wouter
+	- Fixed random numbers for port, interface and server selection.
+	  Removed very small bias.
+	- Refer to the listing in unbound-control man page in the extended
+	  statistics entry in the unbound.conf man page.
+
+16 March 2010: Wouter
+	- Fix interface-automatic for OpenBSD: msg.controllen was too small,
+	  also assertions on ancillary data buffer.
+	- check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO.
+	- for NSEC3 check if signatures are cached.
+
+15 March 2010: Wouter
+	- unit test for util/regional.c.
+
+12 March 2010: Wouter
+	- Reordered configure checks so fork and -lnsl -lsocket checks are
+	  earlier, and thus later checks benefit from and do not hinder them.
+	- iana portlist updated.
+	- ldns tarball updated.
+	- Fix python use when multithreaded.
+	- Fix solaris python compile.
+	- Include less in config.h and include per code file for ldns, ssl.
+
+11 March 2010: Wouter
+	- another memory allocation option: --enable-alloc-nonregional.
+	  exposes the regional allocations to other memory purifiers.
+	- fix for memory alignment in struct sock_list allocation.
+	- Fix for MacPorts ldns without ssl default, unbound checks if ldns
+	  has dnssec functionality and uses the builtin if not.
+	- Fix daemonize on Solaris 10, it did not detach from terminal.
+	- tag 1.4.3 created.
+	- trunk is 1.4.4 in development.
+	- spelling fix in validation error involving cnames.
+
+10 March 2010: Wouter
+	- --enable-alloc-lite works with test set.
+	- portability in the testset: printf format conversions, prototypes.
+
+9 March 2010: Wouter
+	- tag 1.4.2 created.
+	- trunk is 1.4.3 in development.
+	- --enable-alloc-lite debug option.
+
+8 March 2010: Wouter
+	- iana portlist updated.
+
+4 March 2010: Wouter
+	- Fix crash in control channel code.
+
+3 March 2010: Wouter
+	- better casts in pipe code, brackets placed wrongly.
+	- iana portlist updated.
+
+1 March 2010: Wouter
+	- make install depends on make all.
+	- Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs.
+	- --enable-checking: enables assertions but does not look nonproduction.
+	- nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with
+	  nxdomain and nodata distinguished.
+	- ldns tarball updated.
+	- --disable-rpath fixed for libtool not found errors.
+	- new fedora specfile from Fedora13 in contrib from Paul Wouters.
+
+26 February 2010: Wouter
+	- Fixup prototype for lexer cleanup in daemon code.
+	- unbound-control list_stubs, list_forwards, list_local_zones and
+	  list_local_data.
+
+24 February 2010: Wouter
+	- Fix scrubber bug that potentially let NS records through.  Reported
+	  by Amanda Constant.
+	- Also delete potential poison references from additional.
+	- Fix: no classification of a forwarder as lame, throw away instead.
+
+23 February 2010: Wouter
+	- libunbound ub_ctx_get_option() added.
+	- unbound-control set_option and get_option commands.
+	- iana portlist updated.
+
+18 February 2010: Wouter
+	- A little more strict DS scrubbing.
+	- No more blacklisting of unresponsive servers, a 2 minute timeout
+	  is backed off to.
+	- RD flag not enabled for dnssec-blacklisted tries, unless necessary.
+	- pickup ldns compile fix, libdl for libcrypto.
+	- log 'tcp connect: connection timed out' only in high verbosity.
+	- unbound-control log_reopen command.
+	- moved get_option code from unbound-checkconf to util/config_file.c
+
+17 February 2010: Wouter
+	- Disregard DNSKEY from authority section for chain of trust.
+	  DS records that are irrelevant to a referral scrubbed.  Anti-poison.
+	- iana portlist updated.
+
+16 February 2010: Wouter
+	- Check for 'no space left on device' (or other errors) when 
+	  writing updated autotrust anchors and print errno to log.
+
+15 February 2010: Wouter
+	- Fixed the requery protection, the TTL was 0, it is now 900 seconds,
+	  hardcoded.  We made the choice to send out more conservatively,
+	  protecting against an aggregate effect more than protecting a
+	  single user (from their own folly, perhaps in case of misconfig).
+
+12 February 2010: Wouter
+	- Re-query pattern changed on validation failure.  To protect troubled
+	  authority servers, unbound caches a failure for the DNSKEY or DS
+	  records for the entire zone, and only retries that 900 seconds later.
+	  This implies that only a handful of packets are sent extra to the
+	  authority if the zone fails.
+
+11 February 2010: Wouter
+	- ldns tarball update for long label length syntax error fix.
+	- iana portlist updated.
+
+9 February 2010: Wouter
+	- Fixup in compat snprintf routine, %f 1.02 and %g support.
+	- include math.h for testbound test compile portability.
+
+2 February 2010: Wouter
+	- Updated url of IANA itar, interim trust anchor repository, in script.
+
+1 February 2010: Wouter
+	- iana portlist updated.
+	- configure test for memcmp portability.
+
+27 January 2010: Wouter
+	- removed warning on format string in validator error log statement.
+	- iana portlist updated.
+
+22 January 2010: Wouter
+	- libtool finish the install of unbound python dynamic library.
+
+21 January 2010: Wouter
+	- acx_nlnetlabs.m4 synchronised with nsd's version.
+
+20 January 2010: Wouter
+	- Fixup lookup trouble for parent-child domains on the first query.
+
+14 January 2010: Wouter
+	- Fixup ldns detection to also check for header files.
+
+13 January 2010: Wouter
+	- prefetch-key option that performs DNSKEY queries earlier in the
+	  validation process, and that could halve the latency on DNSSEC
+	  queries.  It takes some extra processing (CPU, a cache is needed).
+
+12 January 2010: Wouter
+	- Fix unbound-checkconf for auto-trust-anchor-file present checks.
+
+8 January 2010: Wouter
+	- Fix for parent-child disagreement code which could have trouble
+	  when (a) ipv6 was disabled and (b) the TTL for parent and child
+	  were different.  There were two bugs, the parent-side information
+	  is fixed to no longer block lookup of child side information and
+	  the iterator is fixed to no longer attempt to get ipv6 when it is
+	  not enabled and then give up in failure.
+	- test and fixes to make prefetch actually store the answer in the
+	  cache.  Considers some rrsets 'already expired' but does not allow
+	  overwriting of rrsets considered more secure.
+
+7 January 2010: Wouter
+	- Fixup python documentation (thanks Leo Vandewoestijne).
+	- Work on cache prefetch feature.
+	- Stats for prefetch, in log print stats, unbound-control stats
+	  and in unbound_munin plugin.
+
+6 January 2010: Wouter
+	- iana portlist updated.
+	- bug#291: DNS wireformat max is 255. dname_valid allowed 256 length.
+	- verbose output includes parent-side-address notion for lameness.
+	- documented val-log-level: 2 setting in example.conf and man page.
+	- change unbound-control-setup from 1024(sha1) to 1536(sha256).
+
+1 January 2010: Wouter
+	- iana portlist updated.
+
+22 December 2009: Wouter
+	- configure with newer libtool 2.2.6b.
+
+17 December 2009: Wouter
+	- review comments.
+	- tag 1.4.1.
+	- trunk to version 1.4.2.
+	
+15 December 2009: Wouter
+	- Answer to qclass=ANY queries, with class IN contents.
+	  Test that validation also works.
+	- updated ldns snapshot tarball with latest fixes (parsing records).
+
+11 December 2009: Wouter
+	- on IPv4 UDP turn off DF flag.
+
+10 December 2009: Wouter
+	- requirements.txt updated with design choice explanations.
+	- Reading fixes: fix to set unlame when child confirms parent glue,
+	  and fix to avoid duplicate addresses in delegation point.
+	- verify_rrsig routine checks expiration last.
+
+9 December 2009: Wouter
+	- Fix Bug#287(reopened): update of ldns tarball with fix for parse
+	  errors generated for domain names like '.example.com'.
+	- Fix SOA excluded from negative DS responses.  Reported by Hauke
+	  Lampe.  The negative cache did not include proper SOA records for
+	  negative qtype DS responses which makes BIND barf on it, such
+	  responses are now only used internally.
+	- Fix negative cache lookup of closestencloser check of DS type bit.
+
+8 December 2009: Wouter
+	- Fix for lookup of parent-child disagreement domains, where the
+	  parent-side glue works but it does not provide proper NS, A or AAAA
+	  for itself, fixing domains such as motorcaravanners.eu.
+	- Feature: you can specify a port number in the interface: line, so
+	  you can bind the same interface multiple times at different ports.
+
+7 December 2009: Wouter
+	- Bug#287: Fix segfault when unbound-control remove nonexistent local
+	  data.  Added check to tests.
+
+1 December 2009: Wouter
+	- Fix crash with module-config "iterator".
+	- Added unit test that has "iterator" module-config.
+
+30 November 2009: Wouter
+	- bug#284: fix parse of # without end-of-line at end-of-file.
+
+26 November 2009: Wouter
+	- updated ldns with release candidate for version 1.6.3.
+	- tag for 1.4.0 release.
+	- 1.4.1 version in trunk.
+	- Fixup major libtool version to 2 because of why_bogus change.
+	  It was 1:5:0 but should have been 2:0:0.
+
+23 November 2009: Wouter
+	- Patch from David Hubbard for libunbound manual page.
+	- Fixup endless spinning in unbound-control stats reported by
+	  Attila Nagy.  Probably caused by clock reversal.
+
+20 November 2009: Wouter
+	- contrib/split-itar.sh contributed by Tom Hendrikx.
+
+19 November 2009: Wouter
+	- better argument help for unbound-control.
+	- iana portlist updated.
+
+17 November 2009: Wouter
+	- noted multiple entries for multiple domain names in example.conf.
+	- iana portlist updated.
+
+16 November 2009: Wouter
+	- Fixed signer detection of CNAME responses without signatures.
+	- Fix#282 libunbound memleak on error condition by Eric Sesterhenn.
+	- Tests for CNAMEs to deeper trust anchors, secure and bogus.
+	- svn tag 1.4.0rc1 made.
+
+13 November 2009: Wouter
+	- Fixed validation failure for CNAME to optout NSEC3 nodata answer.
+	- unbound-host does not fail on type ANY.
+	- Fixed wireparse failure to put RRSIGs together with data in some
+	  long ANY mix cases, which fixes validation failures.
+
+12 November 2009: Wouter
+	- iana portlist updated.
+	- fix manpage errors reported by debian lintian.
+	- review comments.
+	- fixup very long vallog2 level error strings.
+	
+11 November 2009: Wouter
+	- ldns tarball updated (to 1.6.2).
+	- review comments.
+
+10 November 2009: Wouter
+	- Thanks to Surfnet found bug in new dnssec-retry code that failed
+	  to combine well when combined with DLV and a particular failure. 
+	- Fixed unbound-control -h output about argument optionality.
+	- review comments.
+
+5 November 2009: Wouter
+	- lint fixes and portability tests.
+	- better error text for multiple domain keys in one autotrust file.
+
+2 November 2009: Wouter
+	- Fix bug where autotrust does not work when started with a DS.
+	- Updated GOST unit tests for unofficial algorithm number 249
+	  and DNSKEY-format changes in draft version -01.
+
+29 October 2009: Wouter
+	- iana portlist updated.
+	- edns-buffer-size option, default 4096.
+	- fixed do-udp: no.
+
+28 October 2009: Wouter
+	- removed abort on prealloc failure, error still printed but softfail.
+	- iana portlist updated.
+	- RFC 5702: RSASHA256 and RSASHA512 support enabled by default.
+	- ldns tarball updated (which also enables rsasha256 support).
+
+27 October 2009: Wouter
+	- iana portlist updated.
+
+8 October 2009: Wouter
+	- please doxygen
+	- add val-log-level print to corner case (nameserver.epost.bg).
+	- more detail to errors from insecure delegation checks.
+	- Fix double time subtraction in negative cache reported by 
+	  Amanda Constant and Hugh Mahon.
+	- Made new validator error string available from libunbound for
+	  applications.  It is in result->why_bogus, a zero-terminated string.
+	  unbound-host prints it by default if a result is bogus.
+	  Also the errinf is public in module_qstate (for other modules).
+
+7 October 2009: Wouter
+	- retry for validation failure in DS and prime results. Less mem use.
+	  unit test.  Provisioning in other tests for requeries.
+	- retry for validation failure in DNSKEY in middle of chain of trust.
+	  unit test.
+	- retry for empty non terminals in chain of trust and unit test.
+	- Fixed security bug where the signatures for NSEC3 records were not
+	  checked when checking for absence of DS records.  This could have
+	  enabled the substitution of an insecure delegation.
+	- moved version number to 1.4.0 because of 1.3.4 release with only
+	  the NSEC3 patch from the entry above.
+	- val-log-level: 2 shows extended error information for validation
+	  failures, but still one (longish) line per failure.  For example:
+	  validation failure <example.com. DNSKEY IN>: signature expired from
+	  192.0.2.4 for trust anchor example.com. while building chain of trust
+	  validation failure <www.example.com. A IN>: no signatures from
+	  192.0.2.6 for key example.com. while building chain of trust
+
+6 October 2009: Wouter
+	- Test set updated to provide additional ns lookup result.
+	  The retry would attempt to fetch the data from other nameservers
+	  for bogus data, and this needed to be provisioned in the tests.
+
+5 October 2009: Wouter
+	- first validation failure retry code.  Retries for data failures.
+	  And unit test.
+
+2 October 2009: Wouter
+	- improve 5011 modularization.
+	- fix unbound-host so -d can be given before -C.
+	- iana portlist updated.
+
+28 September 2009: Wouter
+	- autotrust-anchor-file can read multiline input and $ORIGIN.
+	- prevent integer overflow in holddown calculation. review fixes.
+	- fixed race condition in trust point revocation. review fix.
+	- review fixes to comments, removed unused code.
+
+25 September 2009: Wouter
+	- so-rcvbuf: 4m option added.  Set this on large busy servers to not
+	  drop the occasional packet in spikes due to full socket buffers.
+	  netstat -su keeps a counter of UDP dropped due to full buffers.
+	- review of validator/autotrust.c, small fixes and comments.
+
+23 September 2009: Wouter
+	- 5011 query failed counts verification failures, not lookup failures.
+	- 5011 probe failure handling fixup.
+	- test unbound reading of original autotrust data.
+	  The metadata per-key, such as key state (PENDING, MISSING, VALID) is
+	  picked up, otherwise performs initial probe like usual.
+
+22 September 2009: Wouter
+	- autotrust test with algorithm rollover, new ordering of checks
+	  assists in orderly rollover.
+	- autotrust test with algorithm rollover to unknown algorithm.
+	  checks if new keys are supported before adding them.
+	- autotrust test with trust point revocation, becomes unsigned.
+	- fix DNSSEC-missing-signature detection for minimal responses
+	  for qtype DNSKEY (assumes DNSKEY occurs at zone apex).
+
+18 September 2009: Wouter
+	- autotrust tests, fix trustpoint timer deletion code.
+	  fix count of valid anchors during missing remove.
+	- autotrust: pick up REVOKE even if not signed with known other keys.
+
+17 September 2009: Wouter
+	- fix compile of unbound-host when --enable-alloc-checks.
+	- Fix lookup problem reported by Koh-ichi Ito and Jaap Akkerhuis.
+	- Manual page fixes reported by Tony Finch.
+
+16 September 2009: Wouter
+	- Fix memory leak reported by Tao Ma.
+	- Fix memstats test tool for log-time-ascii log format.
+
+15 September 2009: Wouter
+	- iana portlist updated.
+
+10 September 2009: Wouter
+	- increased MAXSYSLOGLEN so .bg key can be printed in debug output.
+	- use linebuffering for log-file: output, this can be significantly
+	  faster than the previous fflush method and enable some class of
+	  resolvers to use high verbosity (for short periods).
+	  Not on windows, because line buffering does not work there.
+
+9 September 2009: Wouter
+	- Fix bug where DNSSEC-bogus messages were marked with too high TTL.
+	  The RRsets would still expire at the normal time, but this would
+	  keep messages bogus in the cache for too long.
+	- regression test for that bug.
+	- documented that load_cache is meant for debugging.
+
+8 September 2009: Wouter
+	- fixup printing errors when load_cache, they were printed to the
+	  SSL connection which broke, now to the log.
+	- new ldns - with fixed parse of large SOA values.
+
+7 September 2009: Wouter
+	- autotrust testbound scenarios.
+	- autotrust fix that failure count is written to file.
+	- autotrust fix that keys may become valid after add holddown time
+	  alone, before the probe returns.
+
+4 September 2009: Wouter
+	- Changes to make unbound work with libevent-2.0.3 alpha. (in
+	  configure detection due to new ssl dependency in libevent)
+	- do not call sphinx for documentation when python is disabled.
+	- remove EV_PERSIST from libevent timeout code to make the code
+	  compatible with the libevent-2.0.  Works with older libevent too.
+	- fix memory leak in python code.
+
+3 September 2009: Wouter
+	- Got a patch from Luca Bruno for libunbound support on windows to
+	  pick up the system resolvconf nameservers and hosts there.
+	- included ldns updated (enum warning fixed).
+	- makefile fix for parallel makes.
+	- Patch from Zdenek Vasicek and Attila Nagy for using the source IP
+	  from python scripts.  See pythonmod/examples/resip.py.
+	- doxygen comment fixes.
+
+2 September 2009: Wouter
+	- TRAFFIC keyword for testbound. Simplifies test generation.
+	  ${range lower val upper} to check probe timeout values.
+	- test with 5011-prepublish rollover and revocation.
+	- fix revocation of RR for autotrust, stray exclamation mark.
+
+1 September 2009: Wouter
+	- testbound variable arithmetic.
+	- autotrust probe time is randomised.
+	- autotrust: the probe is active and does not fetch from cache.
+
+31 August 2009: Wouter
+	- testbound variable processing.
+
+28 August 2009: Wouter
+	- fixup unbound-control lookup to print forward and stub servers.
+
+27 August 2009: Wouter
+	- autotrust: mesh answer callback is empty.
+
+26 August 2009: Wouter
+	- autotrust probing.
+	- iana portlist updated.
+
+25 August 2009: Wouter
+	- fixup memleak in trust anchor unsupported algorithm check.
+	- iana portlist updated.
+	- autotrust options: add-holddown, del-holddown, keep-missing.
+	- autotrust store revoked status of trust points.
+	- ctime_r compat definition.
+	- detect yylex_destroy() in configure.
+	- detect SSL_get_compression_methods declaration in configure.
+	- fixup DS lookup at anchor point with unsigned parent.
+	- fixup DLV lookup for DS queries to unsigned domains.
+
+24 August 2009: Wouter
+	- cleaner memory allocation on exit. autotrust test routines.
+	- free all memory on program exit, fix for ssl and flex.
+
+21 August 2009: Wouter
+	- autotrust: debug routines. Read,write and conversions work.
+
+20 August 2009: Wouter
+	- autotrust: save and read trustpoint variables.
+
+19 August 2009: Wouter
+	- autotrust: state table updates.
+	- iana portlist updated.
+
+17 August 2009: Wouter
+	- autotrust: process events.
+
+17 August 2009: Wouter
+	- Fix so that servers are only blacklisted if they fail to reply 
+	  to 16 queries in a row and the timeout gets above 2 minutes.
+	- autotrust work, split up DS verification of DNSKEYs.
+
+14 August 2009: Wouter
+	- unbound-control lookup prints out infra cache information, like RTT.
+	- Fix bug in DLV lookup reported by Amanda from Secure64.
+	  It could sometimes wrongly classify a domain as unsigned, which
+	  does not give the AD bit on replies.
+
+13 August 2009: Wouter
+	- autotrust read anchor files. locked trust anchors.
+
+12 August 2009: Wouter
+	- autotrust import work.
+
+11 August 2009: Wouter
+	- Check for openssl compatible with gost if enabled.
+	- updated unit test for GOST=211 code.
+	  Nicer naming of test files.
+	- iana portlist updated.
+
+7 August 2009: Wouter
+	- call OPENSSL_config() in unbound and unit test so that the
+	  operator can use openssl.cnf for configuration options.
+	- removed small memory leak from config file reader.
+
+6 August 2009: Wouter
+	- configure --enable-gost for GOST support, experimental
+	  implementation of draft-dolmatov-dnsext-dnssec-gost-01.
+	- iana portlist updated.
+	- ldns tarball updated (with GOST support).
+
+5 August 2009: Wouter
+	- trunk moved to 1.3.4.
+
+4 August 2009: Wouter
+	- Added test that the examples from draft rsasha256-14 verify.
+	- iana portlist updated.
+	- tagged 1.3.3
+
+3 August 2009: Wouter
+	- nicer warning when algorithm not supported, tells you to upgrade.
+	- iana portlist updated.
+
+27 July 2009: Wouter
+	- Updated unbound-cacti contribution from Dmitriy Demidov, with
+	  the queue statistics displayed in its own graph.
+	- iana portlist updated.
+
+22 July 2009: Wouter
+	- Fix bug found by Michael Tokarev where unbound would try to
+	  prime the root servers even though forwarders are configured for
+	  the root.
+	- tagged 1.3.3rc1
+
 21 July 2009: Wouter
 	- Fix server selection, so that it waits for open target queries when
 	  faced with lameness.

doc/README

@@ -32,6 +32,10 @@ This software is under BSD license, see LICENSE for details.
 	This disables pthreads. Without this option the pthreads library 
 	is detected automatically. Use this option to disable threading
 	altogether, or, on Solaris, also use --with(out)-solaris-threads.
+  * --enable-checking
+  	This enables assertions in the code that guard against a variety of
+	programming errors, among which buffer overflows.  The program exits
+	with an error if an assertion fails (but the buffer did not overflow).
   * --enable-static-exe
 	This enables a debug option to statically link, against ldns and 
 	libevent libraries.
@@ -63,8 +67,10 @@ This software is under BSD license, see LICENSE for details.
 	Needs python-devel and swig development tools.
   * --with-pythonmodule
   	Compile the python module that processes responses in the server.
-  * --enable-sha2
-  	Enable draft support for RSASHA256 and RSASHA512.
+  * --disable-sha2
+  	Disable support for RSASHA256 and RSASHA512 crypto.
+  * --enable-gost
+  	Enable draft support for GOST crypto.
 
 * 'make test' attempts to run a series of tests, depending on the support
   programs that are installed.

doc/README.tests

@@ -6,6 +6,7 @@ To make and run the tests. The results are summarized at the end.
 
 You need to have the following programs installed and in your PATH.
 * dig - from the bind-tools package. Used to send DNS queries.
+* wdiff - used for word-by-word comparisons.
 * splint (optional) - for lint test
 * doxygen (optional) - for doc completeness test
 * ldns-testns (optional) - from ldns examples. Used as DNS auth server.

doc/TODO

@@ -62,170 +62,15 @@ o infra and lame cache: easier size config (in Mb), show usage in graphs.
 - store time of dump in cachedumps, so that on a load the ttls can be
   compared to the absolute time, and now-expired items can be dealt with.
 
-1.3.x:
-- spoofed delegpt fixes - if DNSKEY prime fails
-	- set DNSKEY bogus and DNSKEY query msg bogus.
-	- make NS set bogus too - if not validated as secure.
-	- check where queries go - otherwise reduce TTL on NS.
-	- also make DS NSEC bogus. Also DS msg cache entry.
-- mark bogus under stringent conditions
-	- if DS at parent and validly signed. Then DNSKEY must exist.
-	- Also for trust anchor points themselves. DNSKEY must exist.
-	- so if then DNSKEY keyprime fails
-	  - then it is not simply a server that only answers qtype A.
-	  - then parent is agreeing (somewhat) with the DS record
-	  - but it could still be a lame domain, these exist 
-	    The objective is to keep tries for genuinely lame domains to a
-	    minimum, while detecting forgeries quickly. exponential backoff.
-	- for unbound we can check if we got something to verify while
-	  building that chain of trust.  If so - not lame, agressive retry.
-	  - but security-lame zones also exist and should not pose 
-	    too high a burden. Exponential backoff again.
-	    (fe. badly signed or dnskey reply too large fails).
-	- the delegation NS for the domain is bogus.
-	  The referral retried, with exponential backoff.
-	  This exponential backoff should go towards values which are close
-	  to the TTLs that are used now (on lame delegations for example).
-	  so that the extra traffic is manageable.
-	- for unbound, reset the TTL on the NS rrset. Let it timeout.
-	  Set NS rrset bogus - no more queries to the domain are done.
-	  Also set DNSKEY and DS (rrset, NSEC, msg) bogus and ttl like that.
-	  (to the same absolute value, so a clean retry is done).
-	  TTL of NS is (rounddown) timeout in seconds.
-	  Until the NS times out and referral is done again.
-	  Make sure multiple validations for chains of trust do not result
-	  in a flood of queries or backoff too quickly.
-- bogus exponential backoff cache. hash(name,t,c), size(1M, 5%).
-	TTL of 24h.  Backoff from 200msec to 24h.
-	x2 on bogus(18 tries), x8 backoff on lameness(6 tries), 
-	  when servfail for DNSKEY.
-	remove entry when validated as secure.
-	delegptspoofrecheck on lameness when harden-referral-path NS
-	query has servfail, then build chain of trust down (check DS,
-	then perform DNSKEY query) if that DNSKEY query fails servfail,
-	perform the x8 lameness retry fallback.
-
-* keep a list of guilty IP addresses in the qstate, which contains both
-  the child side guilty IPs and the parent guilty IPs.  Valid signed DSes
-  are not made guilty in the global cache.  The child IP is made guilty
-  in the global cache.
-* Retry to higher trust anchors.
-  * option not to retry to higher from this ta.
-  * keep longest must-be-secure name. Do no accept insecure above this point.
-  * if failed ta, blame all lower tas for their DNSKEY (get IP from cached
-    rrset),  if failure is insecure - nothing, if at bogus - blame that too.
-    lower tas have isdata=false, so the IP address for the dnskeyrrset in
-    the cache is set to avoid in qstate. Nothing in infracache, no childretry.
-
-Retry harder to get valid DNSSEC data.
-Triggered by a trust anchor or by a signed DS record for a zone.
-* If data is fetched and validation fails for it
-  or DNSKEY is fetched and validated into chain-of-trust fails for it
-  or DS is fetched and validated into chain-of-trust fails for it
-  Then
-  	blame(signer zone, IP origin of the data/DNSKEY/DS, x2, isdata)
-* If data was not fetched (SERVFAIL, lame, ...), and the data
-  is under a signed DS then:
-  	blame(thatDSname, IP origin of the data/DNSKEY/DS, x8)
-  x8 because the zone may be lame.
-  This means a chain of trust is built also for unfetched data, to
-  determine if a signed DS is present.  If insecure, nothing is done.
-* If DNSKEY was not fetched for chain of trust (SERVFAIL, lame, ...),
-  Then
-  	blame(DNSKEYname, IP origin of the data/DNSKEY/DS, x8)
-  x8 because the zone may be lame.
-* blame(zonename, guiltyIP, multiplier, isdata):
-  * if isdata:
-    Set the guiltyIP,zonename as DNSSEC-bogus-data=true in lameness cache.
-    Thusly marked servers are avoided if possible, used as last resort.
-    The guilt TTL is the infra cache ttl (15 minutes).  
-    The dnssec retry scheme works without this cache entry.
-  * If the key cache entry 'being-backed-off' is true and isdata then:
-	The parent is backedoff, it must be the childs fault. Retry to child.
-	if the child-dnskey is bogus, then retry is useless, stop.
-	Perform a child-retry - purge dataonly, childside, mark
-	data-IPaddress from child as to avoid-forquery. counterperquery,
-	max is 3, if reached, set this data element RRset&msg to the 
-	current backoff TTL end-time or bogus-ttl(60 seconds) whichever is less
-	and done.
-  * if no retry entry exists for the zone key, create one with 24h TTL, 10 ms.
-    else the backoff *= multiplier.
-  * If the backoff is less than a second, remove entries from cache and
-    restart query.  Else set the TTL for the entries to that value.
-  * Entries to set or remove: DNSKEY RRset&msg, DS RRset&msg, NS RRset&msg, 
-  	in-zone glue (A and AAAA) RRset&msg, and key-cache-entry TTL.
-	The the data element RRset&msg to the backoff TTL or bogusttl.
-	If TTL>1sec set key-cache-entry flag 'being-backed-off' to true.
-	when entry times out that flag is reset to false again.
-* Storage extra is:
-  IP address per RRset and message.  A lot of memory really, since that is
-  132 bytes per RRset and per message.  Store plain IP: 4/16 bytes, len byte.
-  port number 2bytes. +19bytes per RRset, per msg.
-  guilt flag in infra(lameness) cache.
-  being-backed-off flag for key cache, also backoff time value and its TTL.
-  child-retry-count and guilty-ip-list in qstate.
-* Load on authorities:
-  For lame servers: 7 tries per day (one per three hours on average).
-  Others get up to 23 tries per day (one per hour on average).
-  +1 for original try makes 8/24 hours and 24/24 hours.
-  Unless the cache entry falls out of the cache due to memory. In that
-  case it can be tried more often, this is similar to the NS entry falling
-  out of the cache due to memory, in that case it also has to be retried.
-* Performance analysis:
-  * domain is sold.  Unbound sees invalid signature (expired) or the old
-    servers refuse the queries.  Retry within the second, if parent has
-    new DS and NS available instantly works again (no downtime).
-  * domain is bogus signed.  Parent gets 1 query per hour.
-	Domain itself gets couple tries per queryname, per minute.
-  * domain partly bogus.  Parent gets 1 query per hour.
-	Domain itself gets couple tries per bogus queryname, per minute.
-  * spoof attempt.  Unbound tries a couple times.  If not spoofed again,
-    it works, if spoofed every time unbound backs off and stops trying.
-	But childretry is attempted more often, once per minute.
-  * parent has inconsistently signed DS records.  Together with a subzone that
-    is badly managed.  Unbound backs up to the root once per hour.
-  * parent has bad DS records, different sets on different servers, but they
-    are signed ok.  Works as for every query a list of bad nameserver, parent
-    and child side is kept, walks through them.  But as backoff increases
-    and becomes bigger than the TTL on the DS records, unbound will blackout.
-    The parent really has to be fixed...
-    The issue is that it is validly signed, but bad data. Unbound will very
-    conservatively retry it.
-  * domain is sold, but decommission is faster than the setup of new server.
-    Unbound does exponential backoff, if new setup is fast, it'll pickup the
-    new data fast.
-  * key rollover failed.  The zone has bad keys.  Like it was bogus signed.
-  * one nameserver has bad data.  Unbound goes back to the parent but also
-    marks that server as guilty.  Picks data from other server right after,
-    retry without blackout for the user.  
-    When parent starts to get backed off, if the nameserver is childside,
-    queryretries for childservers are made when queries fail.
-  * domain was sold, but unbound has old entries in the cache.  These somehow
-    need (re)validation (were queried with +cd, now -cd).  The entries are
-    bogus.  
-    Unbound performs childretry for these entries.  Works once the keys
-    have been successfully reprimed with parentretry.
-  * unbound is configured to talk to upstream caches.  These caches have
-    inconsistent bad data.  If one is bad, it is marked bad for that zone.  
-    If all are bad, there may not be any way for unbound to remove the
-    bad entries from the upstream caches.  It simply fails.
-    Recommendation: make the upstream caches validate as well.
-  * Old data that was valid with a long TTL remains in the cache.
-    Valid data has a TTL and this is the protocol.
-  * listing bad servers and trying again may not be good enough, since
-    a combinatorial explosion for DSxDNSKEYxdata is possible for every
-    signature validation (using different nameservers for DS, DNSKEY and
-    data, assuming only the right combination has a chain of trust to data).
-    The parentretries perform DS and DNSKEY searching.
-    childretries perform data searching.
-
-
 later
 - selective verbosity; ubcontrol trace example.com
-- option to log only bogus domainname encountered, for demos
 - cache fork-dump, pre-load
 - for fwds, send queries to N servers in fwd-list, use first reply.
   document high scalable, high available unbound setup onepager.
 - prefetch DNSKEY when DS in delegation seen (nonCD, underTA).
 - use libevent if available on system by default(?), default outgoing 256to1024
 
+[1] BIND-like query logging to see who's looking up what and when
+[2] more logging about stuff like SERVFAIL and REFUSED responses
+[3] a Makefile that works without gnumake
+

doc/control_proto_spec.txt

@@ -62,5 +62,4 @@ local_data <resource record string>
 	local_data_add www.example.com. IN A 192.0.2.2
 	if no local_zone exists for it; a transparent zone with the same
 	name as the data is created.
-
-
+Other commands in the unbound-control manual page.

doc/example.conf.in

@@ -32,10 +32,11 @@ server:
 	# specify the interfaces to answer queries from by ip-address.
 	# The default is to listen to localhost (127.0.0.1 and ::1).
 	# specify 0.0.0.0 and ::0 to bind to all available interfaces.
-	# specify every interface on a new 'interface:' labelled line.
+	# specify every interface[@port] on a new 'interface:' labelled line.
 	# The listen interfaces are not changed on reload, only on restart.
 	# interface: 192.0.2.153
 	# interface: 192.0.2.154
+	# interface: 192.0.2.154@5003
 	# interface: 2001:DB8::5
 
 	# enable this feature to copy the source address of queries to reply.
@@ -73,6 +74,14 @@ server:
 	# number of incoming simultaneous tcp buffers to hold per thread.
 	# incoming-num-tcp: 10
 
+	# buffer size for UDP port 53 incoming (SO_RCVBUF socket option).
+	# 0 is system default.  Use 4m to catch query spikes for busy servers.
+	# so-rcvbuf: 0
+
+	# EDNS reassembly buffer to advertise to UDP peers (the actual buffer
+	# is set with msg-buffer-size). 1480 can solve fragmentation (timeouts).
+	# edns-buffer-size: 4096
+
 	# buffer size for handling DNS data. No messages larger than this
 	# size can be sent or received, by UDP or TCP. In bytes.
 	# msg-buffer-size: 65552
@@ -285,6 +294,12 @@ server:
 	# if no, localhost can be queried (for testing and debugging).
 	# do-not-query-localhost: yes
 
+	# if yes, perform prefetching of almost expired message cache entries.
+	# prefetch: no
+
+	# if yes, perform key lookups adjacent to normal lookups.
+	# prefetch-key: no
+
 	# module configuration of the server. A string with identifiers
 	# separated by spaces. "iterator" or "validator iterator"
 	# module-config: "validator iterator"
@@ -298,6 +313,11 @@ server:
 	# with several entries, one file per entry.
 	# Zone file format, with DS and DNSKEY entries.
 	# trust-anchor-file: ""
+	
+	# File with trusted keys, kept uptodate using RFC5011 probes,
+	# initial file like trust-anchor-file, then it stores metadata.
+	# Use several entries, one per domain name, to track multiple zones.
+	# auto-trust-anchor-file: ""
 
 	# Trusted key for validation. DS or DNSKEY. specify the RR on a
 	# single line, surrounded by "". TTL is ignored. class is IN default.
@@ -324,7 +344,7 @@ server:
 	# val-bogus-ttl: 60
 
 	# The signature inception and expiration dates are allowed to be off
-	# by 10% of the lifetime of the signature from our local clock.
+	# by 10% of the signature lifetime (expir-incep) from our local clock.
 	# This leeway is capped with a minimum and a maximum.  In seconds.
 	# val-sig-skew-min: 3600
 	# val-sig-skew-max: 86400
@@ -343,7 +363,7 @@ server:
 	# val-permissive-mode: no
 
 	# Have the validator log failed validations for your diagnosis.
-	# 0: off. 1: A line per failed user query.
+	# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
 	# val-log-level: 0
 
 	# It is possible to configure NSEC3 maximum iteration counts per
@@ -351,6 +371,16 @@ server:
 	# A message with an NSEC3 with larger count is marked insecure.
 	# List in ascending order the keysize and count values.
 	# val-nsec3-keysize-iterations: "1024 150 2048 500 4096 2500"
+	
+	# instruct the auto-trust-anchor-file probing to add anchors after ttl.
+	# add-holddown: 2592000 # 30 days
+
+	# instruct the auto-trust-anchor-file probing to del anchors after ttl.
+	# del-holddown: 2592000 # 30 days
+
+	# auto-trust-anchor-file probing removes missing anchors after ttl.
+	# If the value 0 is given, missing anchors are not removed.
+	# keep-missing: 31622400 # 366 days
 
 	# the amount of memory to use for the key cache.
 	# plain value in bytes or you can append k, m or G. default is "4Mb". 

doc/libunbound.3.in

@@ -17,6 +17,7 @@
 .B ub_ctx_create,
 .B ub_ctx_delete,
 .B ub_ctx_set_option,
+.B ub_ctx_get_option,
 .B ub_ctx_config,
 .B ub_ctx_set_fwd,
 .B ub_ctx_resolvconf,
@@ -56,6 +57,9 @@
 \fBub_ctx_set_option\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR opt, \fIchar*\fR val);
 .LP
 \fIint\fR
+\fBub_ctx_get_option\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR opt, \fIchar**\fR val);
+.LP
+\fIint\fR
 \fBub_ctx_config\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
 .LP
 \fIint\fR
@@ -100,9 +104,7 @@
 \fIint\fR
 \fBub_resolve\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
 .br
-           \fIint\fR rrtype, \fIint\fR rrclass, \fIint*\fR secure, 
-.br
-           \fIint*\fR data, \fIstruct ub_result**\fR result);
+           \fIint\fR rrtype, \fIint\fR rrclass, \fIstruct ub_result**\fR result);
 .LP
 \fIint\fR
 \fBub_resolve_async\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR name, 
@@ -180,6 +182,11 @@ config file format, see \fIunbound.conf\fR(5). Not all options are
 relevant. For some specific options, such as adding trust anchors, special
 routines exist. Pass the option name with the trailing ':'.
 .TP
+.B ub_ctx_get_option
+A power\-user interface that gets an option value.  Some options cannot be
+gotten, and others return a newline separated list.  Pass the option name
+without trailing ':'.  The returned value must be free(2)d by the caller.
+.TP
 .B ub_ctx_config
 A power\-user interface that lets you specify an unbound config file, see
 \fIunbound.conf\fR(5), which is read for configuration. Not all options are
@@ -201,14 +208,16 @@ Usually "/etc/resolv.conf". Uses those nameservers as caching proxies.
 If they do not support DNSSEC, validation may fail.
 Only nameservers are picked up, the searchdomain, ndots and other
 settings from \fIresolv.conf\fR(5) are ignored.
-If fname NULL is passed, "/etc/resolv.conf" is used.
+If fname NULL is passed, "/etc/resolv.conf" is used (if on Windows, 
+the system\-wide configured nameserver is picked instead).
 At this time it is only possible to set configuration before the
 first resolve is done.
 .TP
 .B ub_ctx_hosts
 Read list of hosts from the filename given.
 Usually "/etc/hosts". When queried for, these addresses are not marked 
-DNSSEC secure. If fname NULL is passed, "/etc/hosts" is used.
+DNSSEC secure. If fname NULL is passed, "/etc/hosts" is used 
+(if on Windows, etc/hosts from WINDIR is picked instead).
 At this time it is only possible to set configuration before the
 first resolve is done.
 .TP
@@ -217,7 +226,7 @@ ub_ctx_add_ta
 Add a trust anchor to the given context.
 At this time it is only possible to add trusted keys before the
 first resolve is done.
-The format is a string, similar to the zone-file format,
+The format is a string, similar to the zone\-file format,
 [domainname] [type] [rdata contents]. Both DS and DNSKEY records are accepted.
 .TP
 .B ub_ctx_add_ta_file
@@ -228,13 +237,13 @@ first resolve is done.
 .TP
 .B ub_ctx_trustedkeys
 Add trust anchors to the given context.
-Pass the name of a bind-style config file with trusted-keys{}.
+Pass the name of a bind\-style config file with trusted\-keys{}.
 At this time it is only possible to add trusted keys before the
 first resolve is done.
 .TP
 .B ub_ctx_debugout
 Set debug and error log output to the given stream. Pass NULL to disable
-output. Default is stderr. File-names or using syslog can be enabled
+output. Default is stderr. File\-names or using syslog can be enabled
 using config options, this routine is for using your own stream.
 .TP
 .B ub_ctx_debuglevel
@@ -281,8 +290,6 @@ Will perform necessary callbacks.
 Perform resolution and validation of the target name.
 The name is a domain name in a zero terminated text string.
 The rrtype and rrclass are DNS type and class codes.
-The value secure returns true if the answer validated securely.
-The value data returns true if there was data.
 The result structure is newly allocated with the resulting data.
 .TP
 .B ub_resolve_async
@@ -349,6 +356,7 @@ The result of the DNS resolution and validation is returned as
 		int nxdomain; /* true if nodata because name does not exist */
 		int secure;  /* true if result is secure */
 		int bogus;   /* true if a security failure happened */
+		char* why_bogus; /* string with error if bogus */
 	};
 .fi
 .P
@@ -366,7 +374,7 @@ returns NULL on an error (a malloc failure).
 .B ub_poll
 returns true if some information may be available, false otherwise.
 .B ub_fd
-returns a file descriptor or -1 on error.
+returns a file descriptor or \-1 on error.
 .SH "SEE ALSO"
 \fIunbound.conf\fR(5), 
 \fIunbound\fR(8).

doc/requirements.txt

@@ -260,3 +260,35 @@ o NXDOMAIN and SOA serial numbers.
   updated more carefully.  If one of the NSEC records in an NXDOMAIN is
   updated from another query, the NXDOMAIN is dropped from the cache,
   and queried for again, so that its proof can be checked again.
+
+o SOA records in negative cached answers for DS queries.
+  The current unbound code uses a negative cache for queries for type DS.
+  This speeds up building chains of trust, and uses NSEC and NSEC3
+  (optout) information to speed up lookups.  When used internally,
+  the bare NSEC(3) information is sufficient, probably picked up from
+  a referral.  When answering to clients, a SOA record is needed for
+  the correct message format, a SOA record is picked from the cache
+  (and may not actually match the serial number of the SOA for which the
+  NSEC and NSEC3 records were obtained) if available otherwise network
+  queries are performed to get the data.
+
+o Parent and child with different nameserver information.
+  A misconfiguration that sometimes happens is where the parent and child
+  have different NS, glue information.  The child is authoritative, and
+  unbound will not trust information from the parent nameservers as the
+  final answer.  To help lookups, unbound will however use the parent-side
+  version of the glue as a last resort lookup.  This resolves lookups for
+  those misconfigured domains where the servers reported by the parent
+  are the only ones working, and servers reported by the child do not.
+
+o Failure of validation and probing.
+  Retries on a validation failure are now 5x to a different nameserver IP
+  (if possible), and then it gives up, for one name, type, class entry in
+  the message cache.  If a DNSKEY or DS fails in the chain of trust in the
+  key cache additionally, after the probing, a bad key entry is created that
+  makes the entire zone bogus for 900 seconds.  This is a fixed value at
+  this time and is conservative in sending probes.  It makes the compound
+  effect of many resolvers less and easier to handle, but penalizes
+  individual resolvers by having less probes and a longer time before fixes
+  are picked up.
+

doc/unbound-checkconf.8.in

@@ -9,16 +9,16 @@
 .\"
 .SH "NAME"
 .LP
-unbound-checkconf
+unbound\-checkconf
 \- Check unbound configuration file for errors.
 .SH "SYNOPSIS"
-.B unbound-checkconf
+.B unbound\-checkconf
 .RB [ \-h ]
 .RB [ \-o
 .IR option ]
 .RI [ cfgfile ]
 .SH "DESCRIPTION"
-.B Unbound-checkconf
+.B Unbound\-checkconf
 checks the configuration file for the
 \fIunbound\fR(8)
 DNS resolver for syntax and other errors. 
@@ -38,7 +38,7 @@ printed to stdout.  For "" (disabled) options an empty line is printed.
 The config file to read with settings for unbound. It is checked.
 If omitted, the config file at the default location is checked.
 .SH "EXIT CODE"
-The unbound-checkconf program exits with status code 1 on error, 
+The unbound\-checkconf program exits with status code 1 on error, 
 0 for a correct config file.
 .SH "FILES"
 .TP

doc/unbound-control.8.in

@@ -9,10 +9,11 @@
 .\"
 .SH "NAME"
 .LP
-unbound-control
+.B unbound\-control,
+.B unbound\-control\-setup
 \- Unbound remote server control utility.
 .SH "SYNOPSIS"
-.B unbound-control
+.B unbound\-control
 .RB [ \-h ]
 .RB [ \-c 
 .IR cfgfile ]
@@ -20,7 +21,7 @@ unbound-control
 .IR server ]
 .IR command
 .SH "DESCRIPTION"
-.B Unbound-control
+.B Unbound\-control
 performs remote administration on the \fIunbound\fR(8) DNS server.
 It reads the configuration file, contacts the unbound server over SSL
 sends the command and displays the result.
@@ -56,6 +57,11 @@ Change verbosity value for logging. Same values as \fBverbosity\fR keyword in
 \fIunbound.conf\fR(5).  This new setting lasts until the server is issued
 a reload (taken from config file again), or the next verbosity control command.
 .TP
+.B log_reopen
+Reopen the logfile, close and open it.  Useful for logrotation to make the
+daemon release the file it is logging to.  If you are using syslog it will
+attempt to close and open the syslog (which may not work if chrooted).
+.TP
 .B stats
 Print statistics. Resets the internal counters to zero, this can be 
 controlled using the \fBstatistics\-cumulative\fR config statement. 
@@ -98,7 +104,8 @@ redirect it to a file to store the cache in a file.
 .B load_cache
 The contents of the cache is loaded from stdin.  Uses the same format as
 dump_cache uses.  Loading the cache with old, or wrong data can result
-in old or wrong data returned to clients.
+in old or wrong data returned to clients.  Loading data into the cache
+in this way is supported in order to aid with debugging.
 .TP
 .B lookup \fIname
 Print to stdout the name servers that would be used to look up the 
@@ -135,17 +142,43 @@ Show what is worked on.  Prints all queries that the server is currently
 working on.  Prints the time that users have been waiting.  For internal
 requests, no time is printed.  And then prints out the module status.
 .TP
-.B forward [off | addr ... ]
+.B set_option \fIopt: val
+Set the option to the given value without a reload.  The cache is therefore
+not flushed.  The option must end with a ':' and whitespace must be between the
+option and the value.  Some values may not have an effect if set this way,
+the new values are not written to the config file, not all options are supported.
+.TP
+.B get_option \fIopt
+Get the value of the option.  Give the option name without a trailing ':'.
+The value is printed.  If the value is "", nothing is printed and the
+connection closes.  On error 'error ...' is printed (it gives a syntax
+error on unknown option).  For some options a list of values, one on
+each line, is printed.  Not all options are supported.
+.TP
+.B list_stubs
+List the stub zones in use.  These are printed one by one to the output.
+This includes the root hints in use.
+.TP
+.B list_forwards
+List the forward zones in use.  These are printed zone by zone to the output.
+.TP
+.B list_local_zones
+List the local zones in use.  These are printed one per line with zone type.
+.TP
+.B list_local_data
+List the local data RRs in use.  The resource records are printed.
+.TP
+.B forward \fR[\fIoff\fR | \fIaddr ...\fR ]
 Setup forwarding mode.  Configures if the server should ask other upstream
 nameservers, should go to the internet root nameservers itself, or show 
 the current config.  You could pass the nameservers after a DHCP update.
 .IP
 Without arguments the current list of addresses used to forward all queries
-to is printed.  On startup this is from the forward-zone "." configuration.
+to is printed.  On startup this is from the forward\-zone "." configuration.
 Afterwards it shows the status.  It prints off when no forwarding is used.
 .IP
 If \fIoff\fR is passed, forwarding is disabled and the root nameservers
-are used.  This can be used to avoid to avoid buggy or non-DNSSEC supporting
+are used.  This can be used to avoid to avoid buggy or non\-DNSSEC supporting
 nameservers returned from DHCP.  But may not work in hotels or hotspots.
 .IP
 If one or more IPv4 or IPv6 addresses are given, those are then used to forward
@@ -156,7 +189,7 @@ By default the forwarder information from the config file for the root "." is
 used.  The config file is not changed, so after a reload these changes are
 gone.  Other forward zones from the config file are not affected by this command.
 .SH "EXIT CODE"
-The unbound-control program exits with status code 1 on error, 0 on success.
+The unbound\-control program exits with status code 1 on error, 0 on success.
 .SH "SET UP"
 The setup requires a self\-signed certificate and private keys for both 
 the server and client.  The script \fIunbound\-control\-setup\fR generates
@@ -170,7 +203,7 @@ If you have not configured
 a username in unbound.conf, the keys need read permission for the user
 credentials under which the daemon is started.
 The script preserves private keys present in the directory.
-After running the script as root, turn on \fBcontrol-enable\fR in 
+After running the script as root, turn on \fBcontrol\-enable\fR in 
 \fIunbound.conf\fR.
 .SH "STATISTIC COUNTERS"
 The \fIstats\fR command shows a number of statistic counters.
@@ -184,6 +217,13 @@ number of queries that were successfully answered using a cache lookup
 .I threadX.num.cachemiss
 number of queries that needed recursive processing
 .TP
+.I threadX.num.prefetch
+number of cache prefetches performed.  This number is included in
+cachehits, as the original query had the unprefetched answer from cache,
+and resulted in recursive processing, taking a slot in the requestlist.
+Not part of the recursivereplies (or the histogram thereof) or cachemiss,
+as a cache response was sent.
+.TP
 .I threadX.num.recursivereplies
 The number of replies sent to queries that needed recursive processing. Could be smaller than threadX.num.cachemiss if due to timeouts no replies were sent for some queries.
 .TP
@@ -225,6 +265,9 @@ summed over threads.
 .I total.num.cachemiss
 summed over threads.
 .TP
+.I total.num.prefetch
+summed over threads.
+.TP
 .I total.num.recursivereplies
 summed over threads.
 .TP
@@ -284,13 +327,13 @@ Printed for the other query types as well, but only for the types for which
 queries were received, thus =0 entries are omitted for brevity.
 .TP
 .I num.query.type.other
-Number of queries with query types 256-65535.
+Number of queries with query types 256\-65535.
 .TP
 .I num.query.class.IN
 The total number of queries over all threads with query class IN (internet).
 Also printed for other classes (such as CH (CHAOS) sometimes used for
 debugging), or NONE, ANY, used by dynamic update.
-num.query.class.other is printed for classes 256-65535.
+num.query.class.other is printed for classes 256\-65535.
 .TP
 .I num.query.opcode.QUERY
 The total number of queries over all threads with query opcode QUERY.
@@ -356,7 +399,7 @@ unbound configuration file.
 .TP
 .I @UNBOUND_RUN_DIR@
 directory with private keys (unbound_server.key and unbound_control.key) and
-self-signed certificates (unbound_server.pem and unbound_control.pem).
+self\-signed certificates (unbound_server.pem and unbound_control.pem).
 .SH "SEE ALSO"
 \fIunbound.conf\fR(5), 
 \fIunbound\fR(8).

doc/unbound.conf.5.in

@@ -52,8 +52,8 @@ server:
 	username: unbound
 	# make sure unbound can access entropy from inside the chroot.
 	# e.g. on linux the use these commands (on BSD, devfs(8) is used):
-	#      mount --bind -n /dev/random /etc/unbound/dev/random
-	# and  mount --bind -n /dev/log /etc/unbound/dev/log
+	#      mount \-\-bind \-n /dev/random /etc/unbound/dev/random
+	# and  mount \-\-bind \-n /dev/log /etc/unbound/dev/log
 	chroot: "/etc/unbound"
 	# logfile: "/etc/unbound/unbound.log"  #uncomment to use logfile.
 	pidfile: "/etc/unbound/unbound.pid"
@@ -100,7 +100,8 @@ the statistics counters after logging the statistics. Default is no.
 .TP
 .B extended\-statistics: \fI<yes or no>
 If enabled, extended statistics are printed from \fIunbound\-control\fR(8). 
-Default is off, because keeping track of more statistics takes time.
+Default is off, because keeping track of more statistics takes time.  The
+counters are listed in \fIunbound\-control\fR(8).
 .TP
 .B num\-threads: \fI<number>
 The number of threads to create to serve clients. Use 1 for no threading.
@@ -108,17 +109,20 @@ The number of threads to create to serve clients. Use 1 for no threading.
 .B port: \fI<port number>
 The port number, default 53, on which the server responds to queries.
 .TP
-.B interface: \fI<ip address>
+.B interface: \fI<ip address[@port]>
 Interface to use to connect to the network. This interface is listened to
 for queries from clients, and answers to clients are given from it.
 Can be given multiple times to work on several interfaces. If none are 
 given the default is to listen to localhost.
 The interfaces are not changed on a reload (kill \-HUP) but only on restart.
+A port number can be specified with @port (without spaces between
+interface and port number), if not specified the default port (from
+\fBport\fR) is used.
 .TP
-.B interface-automatic: \fI<yes or no>
+.B interface\-automatic: \fI<yes or no>
 Detect source interface on UDP queries and copy them to replies.  This 
 feature is experimental, and needs support in your OS for IPv6 
-(and its socket options) and IPv4 (and have source-interface socket options). 
+(and its socket options) and IPv4 (and have source\-interface socket options). 
 Default value is no.
 .TP
 .B outgoing\-interface: \fI<ip address>
@@ -142,7 +146,7 @@ Permit unbound to open this port or range of ports for use to send queries.
 A larger number of permitted outgoing ports increases resilience against
 spoofing attempts. Make sure these ports are not needed by other daemons. 
 By default only ports above 1024 that have not been assigned by IANA are used.
-Give a port number or a range of the form "low-high", without spaces.
+Give a port number or a range of the form "low\-high", without spaces.
 .IP
 The \fBoutgoing\-port\-permit\fR and \fBoutgoing\-port\-avoid\fR statements 
 are processed in the line order of the config file, adding the permitted ports 
@@ -155,7 +159,7 @@ Do not permit unbound to open this port or range of ports for use to send
 queries. Use this to make sure unbound does not grab a port that another
 daemon needs. The port is avoided on all outgoing interfaces, both IP4 and IP6.
 By default only ports above 1024 that have not been assigned by IANA are used.
-Give a port number or a range of the form "low-high", without spaces.
+Give a port number or a range of the form "low\-high", without spaces.
 .TP
 .B outgoing\-num\-tcp: \fI<number>
 Number of outgoing TCP buffers to allocate per thread. Default is 10. If set
@@ -165,6 +169,17 @@ to 0, or if do_tcp is "no", no TCP queries to authoritative servers are done.
 Number of incoming TCP buffers to allocate per thread. Default is 10. If set
 to 0, or if do_tcp is "no", no TCP queries from clients are accepted.
 .TP
+.B edns\-buffer\-size: \fI<number>
+Number of bytes size to advertise as the EDNS reassembly buffer size.
+This is the value put into datagrams over UDP towards peers.  The actual
+buffer size is determined by msg\-buffer\-size (both for TCP and UDP).  Do
+not set lower than that value.  Default is 4096 which is RFC recommended.
+If you have fragmentation reassembly problems, usually seen as timeouts,
+then a value of 1480 can fix it.  Setting to 512 bypasses even the most
+stringent path MTU problems, but is seen as extreme, since the amount
+of TCP fallback generated is excessive (probably also for this resolver,
+consider tuning the outgoing tcp number).
+.TP
 .B msg\-buffer\-size: \fI<number>
 Number of bytes size of the message buffers. Default is 65552 bytes, enough
 for 64 Kb packets, the maximum DNS message size. No message larger than this
@@ -197,6 +212,17 @@ the other 50% are replaced with the new incoming query if they have already
 spent more than their allowed time.  This protects against denial of 
 service by slow queries or high query rates.  Default 200 milliseconds.
 .TP
+.B so\-rcvbuf: \fI<number>
+If not 0, then set the SO_RCVBUF socket option to get more buffer
+space on UDP port 53 incoming queries.  So that short spikes on busy
+servers do not drop packets (see counter in netstat \-su).  Default is
+0 (use system value).  Otherwise, the number of bytes to ask for, try
+"4m" on a busy server.  The OS caps it at a maximum, on linux unbound
+needs root permission to bypass the limit, or the admin can use sysctl
+net.core.rmem_max.  On BSD change kern.ipc.maxsockbuf in /etc/sysctl.conf.
+On OpenBSD change header and recompile kernel. On Solaris ndd \-set
+/dev/udp udp_max_buf 8388608.
+.TP
 .B rrset\-cache\-size: \fI<number>
 Number of bytes size of the RRset cache. Default is 4 megabytes.
 A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
@@ -432,7 +458,7 @@ not RFC standard, and could lead to performance problems because of the
 extra query load that is generated.  Experimental option.
 .TP
 .B use\-caps\-for\-id: \fI<yes or no>
-Use 0x20-encoded random bits in the query to foil spoof attempts.
+Use 0x20\-encoded random bits in the query to foil spoof attempts.
 This perturbs the lowercase and uppercase of query names sent to 
 authority servers and checks if the reply still has the correct casing. 
 Disabled by default. 
@@ -443,7 +469,7 @@ Give IPv4 of IPv6 addresses or classless subnets. These are addresses
 on your private network, and are not allowed to be returned for public
 internet names.  Any occurence of such addresses are removed from
 DNS answers. Additionally, the DNSSEC validator may mark the answers
-bogus. This protects against so-called DNS Rebinding, where a user browser
+bogus. This protects against so\-called DNS Rebinding, where a user browser
 is turned into a network proxy, allowing remote access through the browser
 to other parts of your private network.  Some names can be allowed to
 contain your private addresses, by default all the \fBlocal\-data\fR
@@ -478,6 +504,17 @@ If yes, localhost is added to the do\-not\-query\-address entries, both
 IP6 ::1 and IP4 127.0.0.1/8. If no, then localhost can be used to send
 queries to. Default is yes.
 .TP
+.B prefetch: \fI<yes or no>
+If yes, message cache elements are prefetched before they expire to
+keep the cache up to date.  Default is no.  Turning it on gives about
+10 percent more traffic and load on the machine, but popular items do
+not expire from the cache.
+.TP
+.B prefetch-key: \fI<yes or no>
+If yes, fetch the DNSKEYs earlier in the validation process, when a DS
+record is encountered.  This lowers the latency of requests.  It does use
+a little more CPU.  Also if the cache is set to 0, it is no use. Default is no.
+.TP
 .B module\-config: \fI<"module names">
 Module configuration, a list of module names separated by spaces, surround
 the string with quotes (""). The modules can be validator, iterator.
@@ -491,6 +528,13 @@ File with trusted keys for validation. Both DS and DNSKEY entries can appear
 in the file. The format of the file is the standard DNS Zone file format.
 Default is "", or no trust anchor file.
 .TP
+.B auto\-trust\-anchor\-file: \fI<filename>
+File with trust anchor for one zone, which is tracked with RFC5011 probes.
+The probes are several times per month, thus the machine must be online
+frequently.  The initial file can be one with contents as described in
+\fBtrust\-anchor\-file\fR.  The file is written to when the anchor is updated,
+so the unbound user must have write permission.
+.TP
 .B trust\-anchor: \fI<"Resource Record">
 A DS or DNSKEY RR for a key to use for validation. Multiple entries can be
 given to specify multiple trusted keys, in addition to the trust\-anchor\-files.
@@ -538,17 +582,19 @@ you are debugging signature inception and expiration.
 .TP
 .B val\-sig\-skew\-min: \fI<seconds>
 Minimum number of seconds of clock skew to apply to validated signatures.
-A value of 10% of the signature lifetime is used, capped by this setting.  
-Default is 3600 (1 hour) which allows for daylight savings differences.  
-Lower this value for more strict checking of short lived signatures.
+A value of 10% of the signature lifetime (expiration \- inception) is
+used, capped by this setting.  Default is 3600 (1 hour) which allows for
+daylight savings differences.  Lower this value for more strict checking
+of short lived signatures.
 .TP
 .B val\-sig\-skew\-max: \fI<seconds>
 Maximum number of seconds of clock skew to apply to validated signatures.
-A value of 10% of the signature lifetime is used, capped by this setting.  
-Default is 86400 (24 hours) which allows for timezone setting problems in 
-stable domains.  Setting both min and max very low disables the clock skew 
-allowances.  Setting both min and max very high makes the validator check
-the signature timestamps less strictly.
+A value of 10% of the signature lifetime (expiration \- inception)
+is used, capped by this setting.  Default is 86400 (24 hours) which
+allows for timezone setting problems in stable domains.  Setting both
+min and max very low disables the clock skew allowances.  Setting both
+min and max very high makes the validator check the signature timestamps
+less strictly.
 .TP
 .B val\-bogus\-ttl: \fI<number>
 The time to live for bogus data. This is data that has failed validation;
@@ -564,11 +610,13 @@ to protect the users that rely on this validator for authentication from
 protentially bad data in the additional section.
 .TP
 .B val\-log\-level: \fI<number>
-Have the validator print validation failures to the log.  Regardless of the
-verbosity setting.  Default is 0, off. At 1, for every user query that fails
-a line is printed to the logs.  This way you can monitor what happens with
-validation.  Use a diagnosis tool, such as dig or drill, to find out why 
-validation is failing for these queries.
+Have the validator print validation failures to the log.  Regardless of
+the verbosity setting.  Default is 0, off.  At 1, for every user query
+that fails a line is printed to the logs.  This way you can monitor what
+happens with validation.  Use a diagnosis tool, such as dig or drill,
+to find out why validation is failing for these queries.  At 2, not only
+the query that failed is printed but also the reason why unbound thought
+it was wrong and which server sent the faulty data.
 .TP
 .B val\-permissive\-mode: \fI<yes or no>
 Instruct the validator to mark bogus messages as indeterminate. The security
@@ -587,6 +635,26 @@ be in ascending order and have at least one entry. If you set it to
 "1024 65535" there is no restriction to NSEC3 iteration values.
 This table must be kept short; a very long list could cause slower operation.
 .TP
+.B add\-holddown: \fI<seconds>
+Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011
+autotrust updates to add new trust anchors only after they have been
+visible for this time.  Default is 30 days as per the RFC.
+.TP
+.B del\-holddown: \fI<seconds>
+Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011
+autotrust updates to remove revoked trust anchors after they have been
+kept in the revoked list for this long.  Default is 30 days as per
+the RFC.
+.TP
+.B keep\-missing: \fI<seconds>
+Instruct the \fBauto\-trust\-anchor\-file\fR probe mechanism for RFC5011
+autotrust updates to remove missing trust anchors after they have been
+unseen for this long.  This cleans up the state file if the target zone
+does not perform trust anchor revocation, so this makes the auto probe
+mechanism work with zones that perform regular (non\-5011) rollovers.
+The default is 366 days.  The value 0 does not remove missing anchors,
+as per the RFC.
+.TP
 .B key\-cache\-size: \fI<number>
 Number of bytes size of the key cache. Default is 4 megabytes.
 A plain number is in bytes, append 'k', 'm' or 'g' for kilobytes, megabytes
@@ -636,14 +704,16 @@ If no local\-zone is given local\-data causes a transparent zone
 to be created by default.
 .TP 10
 \h'5'\fIredirect\fR 
-The query is answered from the local data for the zone name. 
+The query is answered from the local data for the zone name.
 There may be no local data beneath the zone name.
 This answers queries for the zone, and all subdomains of the zone
 with the local data for the zone.
-It can be used to redirect a domain to a different address, with 
+It can be used to redirect a domain to return a different address record
+to the end user, with 
 local\-zone: "example.com." redirect and 
 local\-data: "example.com. A 127.0.0.1"
-queries for www.example.com and www.foo.example.com are redirected.
+queries for www.example.com and www.foo.example.com are redirected, so
+that users with web browsers cannot access sites with suffix example.com.
 .TP 10
 \h'5'\fInodefault\fR 
 Used to turn off default contents for AS112 zones. The other types
@@ -725,7 +795,7 @@ Reverse data for zones 8.E.F.ip6.arpa to B.E.F.ip6.arpa.
 Reverse data for zone 8.B.D.0.1.0.0.2.ip6.arpa. This zone is used for
 tutorials and examples. You can remove the block on this zone with:
 .nf
-  local-zone: 8.B.D.0.1.0.0.2.ip6.arpa. nodefault
+  local\-zone: 8.B.D.0.1.0.0.2.ip6.arpa. nodefault
 .fi
 This also works with the other default zones.
 .\" End of local-zone listing.
@@ -755,7 +825,7 @@ enabled, the \fIunbound\-control\fR(8) utility can be used to send
 commands to the running unbound server.  The server uses these clauses
 to setup SSLv3 / TLSv1 security for the connection.  The
 \fIunbound\-control\fR(8) utility also reads the \fBremote\-control\fR
-section for options.  To setup the correct self-signed certificates use the
+section for options.  To setup the correct self\-signed certificates use the
 \fIunbound\-control\-setup\fR(8) utility.
 .TP 5
 .B control\-enable:     \fI<yes or no>
@@ -799,6 +869,8 @@ There may be multiple
 .B stub\-zone:
 clauses. Each with a name: and zero or more hostnames or IP addresses.
 For the stub zone this list of nameservers is used. Class IN is assumed.
+The servers should be authority servers, not recursors; unbound performs
+the recursive processing itself for stub zones.
 .P
 The stub zone can be used to configure authoritative data to be used
 by the resolver that cannot be accessed using the public internet servers.
@@ -837,11 +909,16 @@ the resolver picks up a correct list online.
 .LP
 There may be multiple
 .B forward\-zone:
-clauses. Each with a name: and zero or more hostnames or IP addresses.
-For the forward zone this list of nameservers is used to forward the queries
-to. The servers have to handle further recursion for the query. Class IN is 
-assumed. A forward\-zone entry with name "." and a forward\-addr target will 
-forward all queries to that other server (unless it can answer from the cache).
+clauses. Each with a \fBname:\fR and zero or more hostnames or IP
+addresses.  For the forward zone this list of nameservers is used to
+forward the queries to. The servers listed as \fBforward\-host:\fR and
+\fBforward\-addr:\fR have to handle further recursion for the query.  Thus,
+those servers are not authority servers, but are (just like unbound is)
+recursive servers too; unbound does not perform recursion itself for the
+forward zone, it lets the remote server do it.  Class IN is assumed.
+A forward\-zone entry with name "." and a forward\-addr target will
+forward all queries to that other server (unless it can answer from
+the cache).
 .TP
 .B name: \fI<domain name>
 Name of the forward zone.
@@ -859,7 +936,7 @@ The
 clause gives the settings for the \fIpython\fR(1) script module.  This module
 acts like the iterator and validator modules do, on queries and answers.
 To enable the script module it has to be compiled into the daemon,
-and the word "python" has to be put in the \fBmodule\-conf:\fR option
+and the word "python" has to be put in the \fBmodule\-config:\fR option
 (usually first, or between the validator and iterator).
 .TP
 .B python\-script: \fI<python file>\fR
@@ -871,7 +948,7 @@ supported. Very large data and high TCP loads are exceptional for the DNS.
 DNSSEC validation is enabled, just add trust anchors.
 If you do not have to worry about programs using more than 3 Mb of memory,
 the below example is not for you. Use the defaults to receive full service,
-which on BSD-32bit tops out at 30-40 Mb after heavy usage. 
+which on BSD\-32bit tops out at 30\-40 Mb after heavy usage. 
 .P
 .nf
 # example settings that reduce memory usage

doc/unbound.doxygen

@@ -499,6 +499,7 @@ EXCLUDE                = ./build \
 			 pythonmod/interface.h \
 			 pythonmod/examples/resgen.py \
 			 pythonmod/examples/resmod.py \
+			 pythonmod/examples/resip.py \
 			 libunbound/python/unbound.py \
 			 libunbound/python/libunbound_wrap.c \
 			 ./ldns-src

install-sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2006-12-25.00
+scriptversion=2009-04-28.21; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -515,5 +515,6 @@ done
 # eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-end: "$"
+# time-stamp-time-zone: "UTC"
+# time-stamp-end: "; # UTC"
 # End:

iterator/iter_delegpt.c

@@ -78,7 +78,7 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 	}
 	for(a = dp->target_list; a; a = a->next_target) {
 		if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen, 
-			a->bogus, 0))
+			a->bogus, a->lame, 0))
 			return NULL;
 	}
 	return copy;
@@ -147,30 +147,35 @@ delegpt_find_addr(struct delegpt* dp, struct sockaddr_storage* addr,
 int 
 delegpt_add_target(struct delegpt* dp, struct regional* region, 
 	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
-	socklen_t addrlen, int bogus, int nodup)
+	socklen_t addrlen, int bogus, int lame, int nodup)
 {
 	struct delegpt_ns* ns = delegpt_find_ns(dp, name, namelen);
 	if(!ns) {
 		/* ignore it */
 		return 1;
 	}
-	if(addr_is_ip6(addr, addrlen))
-		ns->got6 = 1;
-	else	ns->got4 = 1;
-	if(ns->got4 && ns->got6)
-		ns->resolved = 1;
-	return delegpt_add_addr(dp, region, addr, addrlen, bogus, nodup);
+	if(!lame) {
+		if(addr_is_ip6(addr, addrlen))
+			ns->got6 = 1;
+		else	ns->got4 = 1;
+		if(ns->got4 && ns->got6)
+			ns->resolved = 1;
+	}
+	return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame, nodup);
 }
 
 int 
 delegpt_add_addr(struct delegpt* dp, struct regional* region, 
-	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, int nodup)
+	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, 
+	int lame, int nodup)
 {
 	struct delegpt_addr* a;
 	if(nodup) {
 		if((a = delegpt_find_addr(dp, addr, addrlen))) {
 			if(bogus)
 				a->bogus = bogus;
+			if(!lame)
+				a->lame = 0;
 			return 1;
 		}
 	}
@@ -188,6 +193,7 @@ delegpt_add_addr(struct delegpt* dp, struct regional* region,
 	a->addrlen = addrlen;
 	a->attempts = 0;
 	a->bogus = bogus;
+	a->lame = lame;
 	return 1;
 }
 
@@ -250,10 +256,11 @@ void delegpt_log(enum verbosity_value v, struct delegpt* dp)
 			(dp->bogus?" BOGUS":"") );
 		}
 		for(a = dp->target_list; a; a = a->next_target) {
-			if(a->bogus) 
-				log_addr(VERB_ALGO, "  BOGUS ", 
-					&a->addr, a->addrlen);
-			else log_addr(VERB_ALGO, "  ", &a->addr, a->addrlen);
+			const char* str = "  ";
+			if(a->bogus && a->lame) str = "  BOGUS ADDR_LAME ";
+			else if(a->bogus) str = "  BOGUS ";
+			else if(a->lame) str = "  ADDR_LAME ";
+			log_addr(VERB_ALGO, str, &a->addr, a->addrlen);
 		}
 	}
 }
@@ -332,10 +339,10 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 			continue;
 
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_A) {
-			if(!delegpt_add_rrset_A(dp, region, s, 0))
+			if(!delegpt_add_rrset_A(dp, region, s, 0, 0))
 				return NULL;
 		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_AAAA) {
-			if(!delegpt_add_rrset_AAAA(dp, region, s, 0))
+			if(!delegpt_add_rrset_AAAA(dp, region, s, 0, 0))
 				return NULL;
 		}
 	}
@@ -365,7 +372,7 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
-	struct ub_packed_rrset_key* ak, int nodup)
+	struct ub_packed_rrset_key* ak, int lame, int nodup)
 {
         struct packed_rrset_data* d=(struct packed_rrset_data*)ak->entry.data;
         size_t i;
@@ -380,7 +387,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
                 memmove(&sa.sin_addr, d->rr_data[i]+2, INET_SIZE);
                 if(!delegpt_add_target(dp, region, ak->rk.dname,
                         ak->rk.dname_len, (struct sockaddr_storage*)&sa,
-                        len, (d->security==sec_status_bogus), nodup))
+                        len, (d->security==sec_status_bogus), lame, nodup))
                         return 0;
         }
         return 1;
@@ -388,7 +395,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
-	struct ub_packed_rrset_key* ak, int nodup)
+	struct ub_packed_rrset_key* ak, int lame, int nodup)
 {
         struct packed_rrset_data* d=(struct packed_rrset_data*)ak->entry.data;
         size_t i;
@@ -403,7 +410,7 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
                 memmove(&sa.sin6_addr, d->rr_data[i]+2, INET6_SIZE);
                 if(!delegpt_add_target(dp, region, ak->rk.dname,
                         ak->rk.dname_len, (struct sockaddr_storage*)&sa,
-                        len, (d->security==sec_status_bogus), nodup))
+                        len, (d->security==sec_status_bogus), lame, nodup))
                         return 0;
         }
         return 1;
@@ -418,9 +425,9 @@ delegpt_add_rrset(struct delegpt* dp, struct regional* region,
 	if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_NS)
 		return delegpt_rrset_add_ns(dp, region, rrset);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_A)
-		return delegpt_add_rrset_A(dp, region, rrset, 0);
+		return delegpt_add_rrset_A(dp, region, rrset, 0, 1);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_AAAA)
-		return delegpt_add_rrset_AAAA(dp, region, rrset, 0);
+		return delegpt_add_rrset_AAAA(dp, region, rrset, 0, 1);
 	log_warn("Unknown rrset type added to delegpt");
 	return 1;
 }
@@ -444,3 +451,13 @@ void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg)
 		}
 	}
 }
+
+void delegpt_no_ipv6(struct delegpt* dp)
+{
+	struct delegpt_ns* ns;
+	for(ns = dp->nslist; ns; ns = ns->next) {
+		/* no ipv6, so only ipv4 is enough to resolve a nameserver */
+		if(ns->got4)
+			ns->resolved = 1;
+	}
+}

iterator/iter_delegpt.h

@@ -121,6 +121,8 @@ struct delegpt_addr {
 	/** if true, the A or AAAA RR was bogus, so this address is bad.
 	 * Also check the dp->bogus to see if everything is bogus. */
 	int bogus;
+	/** if true, this address is dispreferred: it is a lame IP address */
+	int lame;
 };
 
 /**
@@ -178,35 +180,38 @@ int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
  * @param addr: the address.
  * @param addrlen: the length of addr.
  * @param bogus: security status for the address, pass true if bogus.
+ * @param lame: address is lame.
  * @param nodup: if true, no address duplicates are made by this add. 
  *	name duplicates are always filtered.
  * @return false on error.
  */
 int delegpt_add_target(struct delegpt* dp, struct regional* regional, 
 	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
-	socklen_t addrlen, int bogus, int nodup);
+	socklen_t addrlen, int bogus, int lame, int nodup);
 
 /**
  * Add A RRset to delegpt.
  * @param dp: delegation point.
  * @param regional: where to allocate the info.
  * @param rrset: RRset A to add.
+ * @param lame: rrset is lame, disprefer it.
  * @param nodup: if true, no duplicates are made by this add. takes time.
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset_A(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, int nodup);
+	struct ub_packed_rrset_key* rrset, int lame, int nodup);
 
 /**
  * Add AAAA RRset to delegpt.
  * @param dp: delegation point.
  * @param regional: where to allocate the info.
  * @param rrset: RRset AAAA to add.
+ * @param lame: rrset is lame, disprefer it.
  * @param nodup: if true, no duplicates are made by this add. takes time.
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, int nodup);
+	struct ub_packed_rrset_key* rrset, int lame, int nodup);
 
 /**
  * Add any RRset to delegpt.
@@ -226,11 +231,13 @@ int delegpt_add_rrset(struct delegpt* dp, struct regional* regional,
  * @param addr: the address.
  * @param addrlen: the length of addr.
  * @param bogus: if address is bogus.
+ * @param lame: if address is lame.
  * @param nodup: if true, no duplicates are made by this add. takes time.
  * @return false on error.
  */
 int delegpt_add_addr(struct delegpt* dp, struct regional* regional, 
-	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, int nodup);
+	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, 
+	int lame, int nodup);
 
 /** 
  * Find NS record in name list of delegation point.
@@ -307,4 +314,11 @@ struct delegpt* delegpt_from_message(struct dns_msg* msg,
  */
 void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg);
 
+/**
+ * Register the fact that there is no ipv6 and thus AAAAs are not going 
+ * to be queried for or be useful.
+ * @param dp: the delegation point. Updated to reflect no ipv6.
+ */
+void delegpt_no_ipv6(struct delegpt* dp);
+
 #endif /* ITERATOR_ITER_DELEGPT_H */

iterator/iter_fwd.c

@@ -40,6 +40,9 @@
  * Keep track of forward zones and config settings.
  */
 #include "config.h"
+#include "ldns/rdata.h"
+#include "ldns/dname.h"
+#include "ldns/rr.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_delegpt.h"
 #include "util/regional.h"
@@ -212,7 +215,8 @@ read_fwds_addr(struct iter_forwards* fwd, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_addr(dp, fwd->region, &addr, addrlen, 0, 1)) {
+		if(!delegpt_add_addr(dp, fwd->region, &addr, addrlen, 
+			0, 0, 1)) {
 			log_err("out of memory");
 			return 0;
 		}
@@ -345,6 +349,63 @@ forwards_lookup(struct iter_forwards* fwd, uint8_t* qname, uint16_t qclass)
 	return NULL;
 }
 
+struct delegpt* 
+forwards_lookup_root(struct iter_forwards* fwd, uint16_t qclass)
+{
+	uint8_t root = 0;
+	return forwards_lookup(fwd, &root, qclass);
+}
+
+int
+forwards_next_root(struct iter_forwards* fwd, uint16_t* dclass)
+{
+	struct iter_forward_zone key;
+	rbnode_t* n;
+	struct iter_forward_zone* p;
+	if(*dclass == 0) {
+		/* first root item is first item in tree */
+		n = rbtree_first(fwd->tree);
+		if(n == RBTREE_NULL)
+			return 0;
+		p = (struct iter_forward_zone*)n;
+		if(dname_is_root(p->name)) {
+			*dclass = p->dclass;
+			return 1;
+		}
+		/* root not first item? search for higher items */
+		*dclass = p->dclass + 1;
+		return forwards_next_root(fwd, dclass);
+	}
+	/* find class n in tree, we may get a direct hit, or if we don't
+	 * this is the last item of the previous class so rbtree_next() takes
+	 * us to the next root (if any) */
+	key.node.key = &key;
+	key.name = (uint8_t*)"\000";
+	key.namelen = 1;
+	key.namelabs = 0;
+	key.dclass = *dclass;
+	n = NULL;
+	if(rbtree_find_less_equal(fwd->tree, &key, &n)) {
+		/* exact */
+		return 1;
+	} else {
+		/* smaller element */
+		if(!n || n == RBTREE_NULL)
+			return 0; /* nothing found */
+		n = rbtree_next(n);
+		if(n == RBTREE_NULL)
+			return 0; /* no higher */
+		p = (struct iter_forward_zone*)n;
+		if(dname_is_root(p->name)) {
+			*dclass = p->dclass;
+			return 1;
+		}
+		/* not a root node, return next higher item */
+		*dclass = p->dclass+1;
+		return forwards_next_root(fwd, dclass);
+	}
+}
+
 size_t 
 forwards_get_mem(struct iter_forwards* fwd)
 {

iterator/iter_fwd.h

@@ -55,7 +55,7 @@ struct iter_forwards {
 	struct regional* region;
 	/** 
 	 * Zones are stored in this tree. Sort order is specially chosen.
-	 * first sorted on qtype. Then on dname in nsec-like order, so that
+	 * first sorted on qclass. Then on dname in nsec-like order, so that
 	 * a lookup on class, name will return an exact match or the closest
 	 * match which gives the ancestor needed.
 	 * contents of type iter_forward_zone.
@@ -119,6 +119,23 @@ int forwards_apply_cfg(struct iter_forwards* fwd, struct config_file* cfg);
 struct delegpt* forwards_lookup(struct iter_forwards* fwd, 
 	uint8_t* qname, uint16_t qclass);
 
+/**
+ * Same as forwards_lookup, but for the root only
+ * @param fwd: forward storage.
+ * @param qclass: The qclass of the query.
+ * @return: A delegation point if root forward exists, otherwise null.
+ */
+struct delegpt* forwards_lookup_root(struct iter_forwards* fwd, 
+	uint16_t qclass);
+
+/**
+ * Find next root item in forwards lookup tree.
+ * @param fwd: the forward storage
+ * @param qclass: class to look at next, or higher.
+ * @return false if none found, or if true stored in qclass.
+ */
+int forwards_next_root(struct iter_forwards* fwd, uint16_t* qclass);
+
 /**
  * Get memory in use by forward storage
  * @param fwd: forward storage.

iterator/iter_hints.c

@@ -40,6 +40,8 @@
  * Keep track of stub and root hints, and read those from config.
  */
 #include "config.h"
+#include "ldns/dname.h"
+#include "ldns/rr.h"
 #include "iterator/iter_hints.h"
 #include "iterator/iter_delegpt.h"
 #include "util/regional.h"
@@ -86,7 +88,7 @@ ah(struct delegpt* dp, struct regional* r, const char* sv, const char* ip)
 	if(!delegpt_add_ns(dp, r, ldns_rdf_data(rdf)) ||
 	   !extstrtoaddr(ip, &addr, &addrlen) ||
 	   !delegpt_add_target(dp, r, ldns_rdf_data(rdf), ldns_rdf_size(rdf),
-		&addr, addrlen, 0, 1)) {
+		&addr, addrlen, 0, 0, 1)) {
 		ldns_rdf_deep_free(rdf);
 		return 0;
 	}
@@ -225,7 +227,8 @@ read_stubs_addr(struct iter_hints* hints, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_addr(dp, hints->region, &addr, addrlen, 0, 1)) {
+		if(!delegpt_add_addr(dp, hints->region, &addr, addrlen, 
+			0, 0, 1)) {
 			log_err("out of memory");
 			return 0;
 		}
@@ -318,7 +321,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 					ldns_rdf_data(ldns_rr_owner(rr)),
 					ldns_rdf_size(ldns_rr_owner(rr)),
 					(struct sockaddr_storage*)&sa, len, 
-					0, 1)) {
+					0, 0, 1)) {
 				log_err("out of memory reading root hints");
 				goto stop_read;
 			}
@@ -334,7 +337,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 					ldns_rdf_data(ldns_rr_owner(rr)),
 					ldns_rdf_size(ldns_rr_owner(rr)),
 					(struct sockaddr_storage*)&sa, len,
-					0, 1)) {
+					0, 0, 1)) {
 				log_err("out of memory reading root hints");
 				goto stop_read;
 			}
@@ -461,6 +464,11 @@ hints_lookup_stub(struct iter_hints* hints, uint8_t* qname,
 	return NULL;
 }
 
+int hints_next_root(struct iter_hints* hints, uint16_t* qclass)
+{
+	return name_tree_next_root(&hints->tree, qclass);
+}
+
 size_t 
 hints_get_mem(struct iter_hints* hints)
 {

iterator/iter_hints.h

@@ -56,7 +56,7 @@ struct iter_hints {
 	struct regional* region;
 	/** 
 	 * Hints are stored in this tree. Sort order is specially chosen.
-	 * first sorted on qtype. Then on dname in nsec-like order, so that
+	 * first sorted on qclass. Then on dname in nsec-like order, so that
 	 * a lookup on class, name will return an exact match or the closest
 	 * match which gives the ancestor needed.
 	 * contents of type iter_hints_stub. The class IN root is in here.
@@ -105,6 +105,18 @@ int hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg);
  */
 struct delegpt* hints_lookup_root(struct iter_hints* hints, uint16_t qclass);
 
+/**
+ * Find next root hints (to cycle through all root hints).
+ * @param hints: hint storage
+ * @param qclass: class for which root hints are sought.
+ * 	0 means give the first available root hints class.
+ * 	x means, give class x or a higher class if any.
+ * 	returns the found class in this variable.
+ * @return true if a root hint class is found.
+ * 	false if not root hint class is found (qclass may have been changed).
+ */
+int hints_next_root(struct iter_hints* hints, uint16_t* qclass);
+
 /**
  * Given a qname/qclass combination, and the delegation point from the cache
  * for this qname/qclass, determine if this combination indicates that a

iterator/iter_priv.c

@@ -41,6 +41,7 @@
  */
 
 #include "config.h"
+#include "ldns/dname.h"
 #include "iterator/iter_priv.h"
 #include "util/regional.h"
 #include "util/log.h"

iterator/iter_priv.h

@@ -43,6 +43,7 @@
 #ifndef ITERATOR_ITER_PRIV_H
 #define ITERATOR_ITER_PRIV_H
 #include "util/rbtree.h"
+#include "ldns/buffer.h"
 struct iter_env;
 struct config_file;
 struct regional;

iterator/iter_resptype.c

@@ -40,6 +40,7 @@
  * one of the response types.
  */
 #include "config.h"
+#include "ldns/packet.h"
 #include "iterator/iter_resptype.h"
 #include "iterator/iter_delegpt.h"
 #include "services/cache/dns.h"
@@ -234,6 +235,8 @@ response_type_from_server(int rdset,
 			/* If we are getting a referral upwards (or to 
 			 * the same zone), then the server is 'lame'. */
 			if(dname_subdomain_c(origzone, s->rk.dname)) {
+				if(rdset) /* forward or reclame not LAME */
+					return RESPONSE_TYPE_THROWAWAY;
 				return RESPONSE_TYPE_LAME;
 			}
 			/* If the NS set is below the delegation point we 

iterator/iter_scrub.c

@@ -303,6 +303,15 @@ pkt_sub(ldns_buffer* pkt, uint8_t* comprname, uint8_t* zone)
 	return dname_subdomain_c(buf, zone);
 }
 
+/** check subdomain with decompression, compressed is parent */
+static int
+sub_of_pkt(ldns_buffer* pkt, uint8_t* zone, uint8_t* comprname)
+{
+	uint8_t buf[LDNS_MAX_DOMAINLEN+1];
+	dname_pkt_copy(pkt, buf, comprname);
+	return dname_subdomain_c(zone, buf);
+}
+
 /**
  * This routine normalizes a response. This includes removing "irrelevant"
  * records from the answer and additional sections and (re)synthesizing
@@ -518,6 +527,18 @@ store_rrset(ldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
 		env->alloc, now);
 }
 
+/** Check if there are SOA records in the authority section (negative) */
+static int
+soa_in_auth(struct msg_parse* msg)
+{
+	struct rrset_parse* rrset;
+	for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
+		if(rrset->type == LDNS_RR_TYPE_SOA &&
+			rrset->section == LDNS_SECTION_AUTHORITY) 
+			return 1;
+	return 0;
+}
+ 
 /**
  * Check if right hand name in NSEC is within zone
  * @param rrset: the NSEC rrset
@@ -566,6 +587,8 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
 	struct iter_env* ie)
 {
+	int del_addi = 0; /* if additional-holding rrsets are deleted, we
+		do not trust the normalized additional-A-AAAA any more */
 	struct rrset_parse* rrset, *prev;
 	prev = NULL;
 	rrset = msg->rrset_first;
@@ -590,6 +613,7 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 	 * Remainders of CNAME chains are cut off and resolved by iterator. */
 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
 		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) != 0) {
+			if(has_additional(rrset->type)) del_addi = 1;
 			remove_rrset("sanitize: removing extraneous answer "
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
@@ -633,10 +657,15 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 				rrset->type == LDNS_RR_TYPE_NS && 
 				rrset->section == LDNS_SECTION_AUTHORITY &&
 				FLAGS_GET_RCODE(msg->flags) == 
-				LDNS_RCODE_NOERROR) {
+				LDNS_RCODE_NOERROR && !soa_in_auth(msg) &&
+				sub_of_pkt(pkt, zonename, rrset->dname)) {
 				/* noerror, nodata and this NS rrset is above
 				 * the zone. This is LAME! 
 				 * Leave in the NS for lame classification. */
+				/* remove everything from the additional
+				 * (we dont want its glue that was approved
+				 * during the normalize action) */
+				del_addi = 1;
 			} else if(!env->cfg->harden_glue) {
 				/* store in cache! Since it is relevant
 				 * (from normalize) it will be picked up 
@@ -646,11 +675,17 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 				"poison RRset:", pkt, msg, prev, &rrset);
 				continue;
 			} else {
+				if(has_additional(rrset->type)) del_addi = 1;
 				remove_rrset("sanitize: removing potential "
 				"poison RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
 		}
+		if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
+			remove_rrset("sanitize: removing potential "
+			"poison reference RRset:", pkt, msg, prev, &rrset);
+			continue;
+		}
 		/* check if right hand side of NSEC is within zone */
 		if(rrset->type == LDNS_RR_TYPE_NSEC &&
 			sanitize_nsec_is_overreach(rrset, zonename)) {

iterator/iter_scrub.h

@@ -42,6 +42,7 @@
 
 #ifndef ITERATOR_ITER_SCRUB_H
 #define ITERATOR_ITER_SCRUB_H
+#include "ldns/buffer.h"
 struct msg_parse;
 struct query_info;
 struct regional;

iterator/iter_utils.c

@@ -61,6 +61,11 @@
 #include "util/fptr_wlist.h"
 #include "validator/val_anchor.h"
 
+/** time when nameserver glue is said to be 'recent' */
+#define SUSPICION_RECENT_EXPIRY 86400
+/** penalty to validation failed blacklisted IPs */
+#define BLACKLIST_PENALTY (USEFUL_SERVER_TOP_TIMEOUT*3)
+
 /** fillup fetch policy array */
 static void
 fetch_fill(struct iter_env* ie, const char* str)
@@ -151,13 +156,17 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
  *		values 0 .. 49 are not used, unless that is changed.
  *	USEFUL_SERVER_TOP_TIMEOUT
  *		This value exactly is given for unresponsive blacklisted.
+ *	USEFUL_SERVER_TOP_TIMEOUT+1
+ *		For non-blacklisted servers: huge timeout, but has traffic.
  *	USEFUL_SERVER_TOP_TIMEOUT ..
  *		dnsseclame servers get penalty
+ *		also for parent-side lame servers (lame in delegpt).
  *	USEFUL_SERVER_TOP_TIMEOUT*2 ..
  *		recursion lame servers get penalty
  *	UNKNOWN_SERVER_NICENESS 
  *		If no information is known about the server, this is
  *		returned. 376 msec or so.
+ *	+BLACKLIST_PENALTY (of USEFUL_TOP_TIMEOUT*3) for dnssec failed IPs.
  *
  * When a final value is chosen that is dnsseclame ; dnsseclameness checking
  * is turned off (so we do not discard the reply).
@@ -170,7 +179,7 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
 	struct delegpt_addr* a)
 {
-	int rtt, lame, reclame, dnsseclame;
+	int rtt, lame, reclame, dnsseclame, lost;
 	if(a->bogus)
 		return -1; /* address of server is bogus */
 	if(donotq_lookup(iter_env->donotq, &a->addr, a->addrlen)) {
@@ -182,17 +191,23 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	/* check lameness - need zone , class info */
 	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen, 
 		name, namelen, qtype, &lame, &dnsseclame, &reclame, 
-		&rtt, now)) {
+		&rtt, &lost, now)) {
 		log_addr(VERB_ALGO, "servselect", &a->addr, a->addrlen);
-		verbose(VERB_ALGO, "   rtt=%d%s%s%s", rtt,
+		verbose(VERB_ALGO, "   rtt=%d lost=%d%s%s%s%s", rtt, lost,
 			lame?" LAME":"",
 			dnsseclame?" DNSSEC_LAME":"",
-			reclame?" REC_LAME":"");
+			reclame?" REC_LAME":"",
+			a->lame?" ADDR_LAME":"");
 		if(lame)
 			return -1; /* server is lame */
-		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT)
-				/* server is unresponsive */
-			return USEFUL_SERVER_TOP_TIMEOUT; 
+		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT && 
+			lost >= USEFUL_SERVER_MAX_LOST)
+			/* server is unresponsive, but keep trying slowly */
+			return USEFUL_SERVER_TOP_TIMEOUT+1;
+		else if(a->lame)
+			return rtt+USEFUL_SERVER_TOP_TIMEOUT+1; /* nonpref */
+		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT) /* not blacklisted*/
+			return USEFUL_SERVER_TOP_TIMEOUT+1; 
 		else if(reclame)
 			return rtt+USEFUL_SERVER_TOP_TIMEOUT*2; /* nonpref */
 		else if(dnsseclame )
@@ -200,6 +215,8 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 		else	return rtt;
 	}
 	/* no server information present */
+	if(a->lame)
+		return USEFUL_SERVER_TOP_TIMEOUT+1; /* nonpref */
 	return UNKNOWN_SERVER_NICENESS;
 }
 
@@ -207,7 +224,7 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 static int
 iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
 	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
-	struct delegpt* dp, int* best_rtt)
+	struct delegpt* dp, int* best_rtt, struct sock_list* blacklist)
 {
 	int got_it = 0;
 	struct delegpt_addr* a;
@@ -217,6 +234,9 @@ iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
 		a->sel_rtt = iter_filter_unsuitable(iter_env, env, 
 			name, namelen, qtype, now, a);
 		if(a->sel_rtt != -1) {
+			if(sock_list_find(blacklist, &a->addr, a->addrlen))
+				a->sel_rtt += BLACKLIST_PENALTY;
+
 			if(!got_it) {
 				*best_rtt = a->sel_rtt;
 				got_it = 1;
@@ -233,20 +253,23 @@ iter_fill_rtt(struct iter_env* iter_env, struct module_env* env,
 static int
 iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 	uint8_t* name, size_t namelen, uint16_t qtype, uint32_t now, 
-	struct delegpt* dp, int* selected_rtt, int open_target)
+	struct delegpt* dp, int* selected_rtt, int open_target, 
+	struct sock_list* blacklist)
 {
 	int got_num = 0, low_rtt = 0, swap_to_front;
 	struct delegpt_addr* a, *n, *prev=NULL;
 
 	/* fillup sel_rtt and find best rtt in the bunch */
 	got_num = iter_fill_rtt(iter_env, env, name, namelen, qtype, now, dp, 
-		&low_rtt);
+		&low_rtt, blacklist);
 	if(got_num == 0) 
 		return 0;
 	if(low_rtt >= USEFUL_SERVER_TOP_TIMEOUT &&
-		(delegpt_count_missing_targets(dp) > 0 || open_target > 0))
+		(delegpt_count_missing_targets(dp) > 0 || open_target > 0)) {
+		verbose(VERB_ALGO, "Bad choices, trying to get more choice");
 		return 0; /* we want more choice. The best choice is a bad one.
 			     return 0 to force the caller to fetch more */
+	}
 
 	got_num = 0;
 	a = dp->result_list;
@@ -286,31 +309,33 @@ struct delegpt_addr*
 iter_server_selection(struct iter_env* iter_env, 
 	struct module_env* env, struct delegpt* dp, 
 	uint8_t* name, size_t namelen, uint16_t qtype, int* dnssec_expected,
-	int* chase_to_rd, int open_target)
+	int* chase_to_rd, int open_target, struct sock_list* blacklist)
 {
 	int sel;
 	int selrtt;
 	struct delegpt_addr* a, *prev;
 	int num = iter_filter_order(iter_env, env, name, namelen, qtype,
-		*env->now, dp, &selrtt, open_target);
+		*env->now, dp, &selrtt, open_target, blacklist);
 
 	if(num == 0)
 		return NULL;
 	verbose(VERB_ALGO, "selrtt %d", selrtt);
-	if(selrtt > USEFUL_SERVER_TOP_TIMEOUT*2) {
-		verbose(VERB_ALGO, "chase to recursion lame server");
-		*chase_to_rd = 1;
-	}
-	if(selrtt > USEFUL_SERVER_TOP_TIMEOUT) {
-		verbose(VERB_ALGO, "chase to dnssec lame server");
-		*dnssec_expected = 0;
-	}
-	if(selrtt == USEFUL_SERVER_TOP_TIMEOUT) {
-		verbose(VERB_ALGO, "chase to blacklisted lame server");
-		/* the best choice is a blacklisted, unresponsive server,
-		 * we need to throttle down our traffic towards it */
-		if(ub_random(env->rnd) % 100 != 1) {
-			/* 99% of the time, drop query */
+	if(selrtt > BLACKLIST_PENALTY) {
+		if(selrtt-BLACKLIST_PENALTY > USEFUL_SERVER_TOP_TIMEOUT*2) {
+			verbose(VERB_ALGO, "chase to recursion lame server");
+			*chase_to_rd = 1;
+		}
+	} else {
+		if(selrtt > USEFUL_SERVER_TOP_TIMEOUT*2) {
+			verbose(VERB_ALGO, "chase to recursion lame server");
+			*chase_to_rd = 1;
+		}
+		if(selrtt > USEFUL_SERVER_TOP_TIMEOUT) {
+			verbose(VERB_ALGO, "chase to dnssec lame server");
+			*dnssec_expected = 0;
+		}
+		if(selrtt == USEFUL_SERVER_TOP_TIMEOUT) {
+			verbose(VERB_ALGO, "chase to blacklisted lame server");
 			return NULL;
 		}
 	}
@@ -325,9 +350,9 @@ iter_server_selection(struct iter_env* iter_env,
 
 	/* randomly select a target from the list */
 	log_assert(num > 1);
-	/* we do not need secure random numbers here, but
-	 * we do need it to be threadsafe, so we use this */
-	sel = ub_random(env->rnd) % num; 
+	/* grab secure random number, to pick unexpected server.
+	 * also we need it to be threadsafe. */
+	sel = ub_random_max(env->rnd, num); 
 	a = dp->result_list;
 	prev = NULL;
 	while(sel > 0 && a) {
@@ -380,9 +405,9 @@ dns_copy_msg(struct dns_msg* from, struct regional* region)
 
 int 
 iter_dns_store(struct module_env* env, struct query_info* msgqinf,
-	struct reply_info* msgrep, int is_referral)
+	struct reply_info* msgrep, int is_referral, uint32_t leeway)
 {
-	return dns_cache_store(env, msgqinf, msgrep, is_referral);
+	return dns_cache_store(env, msgqinf, msgrep, is_referral, leeway);
 }
 
 int 
@@ -393,10 +418,58 @@ iter_ns_probability(struct ub_randstate* rnd, int n, int m)
 		return 1;
 	/* we do not need secure random numbers here, but
 	 * we do need it to be threadsafe, so we use this */
-	sel = ub_random(rnd) % m; 
+	sel = ub_random_max(rnd, m); 
 	return (sel < n);
 }
 
+int iter_suspect_exists(struct query_info* qinfo, struct delegpt* dp,
+        struct module_env* env)
+{
+	struct ub_packed_rrset_key* r;
+	if(qinfo->qtype != LDNS_RR_TYPE_A && qinfo->qtype != LDNS_RR_TYPE_AAAA)
+		return 0; /* not glue type */
+	if(!dname_subdomain_c(qinfo->qname, dp->name))
+		return 0; /* not in-zone */
+	if(!delegpt_find_ns(dp, qinfo->qname, qinfo->qname_len))
+		return 0; /* not glue */
+
+	/* do we suspect that it exists? lookup with time=0 */
+	r = rrset_cache_lookup(env->rrset_cache, qinfo->qname, 
+		qinfo->qname_len, qinfo->qtype, qinfo->qclass, 0, 0, 0);
+	if(r) {
+		struct packed_rrset_data* d = (struct packed_rrset_data*)
+			r->entry.data;
+		/* if it is valid, no need for queries to parent zone */
+		if(*env->now <= d->ttl) {
+			lock_rw_unlock(&r->entry.lock);
+			return 0;
+		}
+		/* was it recently expired? */
+		if( (*env->now - d->ttl) <= SUSPICION_RECENT_EXPIRY) {
+			verbose(VERB_ALGO, "suspect glue at parent: "
+				"rrset recently expired");
+			lock_rw_unlock(&r->entry.lock);
+			return 1;
+		}
+		lock_rw_unlock(&r->entry.lock);
+	}
+
+	/* so, qinfo not there, does the other A/AAAA type exist in cache? */
+	r=rrset_cache_lookup(env->rrset_cache, qinfo->qname, qinfo->qname_len,
+	  (qinfo->qtype==LDNS_RR_TYPE_A)?LDNS_RR_TYPE_AAAA:LDNS_RR_TYPE_A,
+	  qinfo->qclass, 0, *env->now, 0);
+	if(r) {
+		/* it exists and explains why the glue is there */
+		lock_rw_unlock(&r->entry.lock);
+		return 0;
+	}
+
+	/* neither exist, so logically, one should exist for a nameserver */
+	verbose(VERB_ALGO, "suspect glue at parent: "
+		"neither A nor AAAA exist in cache");
+	return 1;
+}
+
 /** detect dependency cycle for query and target */
 static int
 causes_cycle(struct module_qstate* qstate, uint8_t* name, size_t namelen,
@@ -441,19 +514,19 @@ iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags,
 {
 	struct delegpt_ns* ns;
 	/* check:
+	 *      o RD qflag is off.
+	 *      o no addresses are provided.
 	 *      o all NS items are required glue.
-	 *      o no addresses are provided.
-	 *      o RD qflag is on.
 	 * OR
+	 *      o RD qflag is off.
 	 *      o no addresses are provided.
-	 *      o RD qflag is on.
 	 *      o the query is for one of the nameservers in dp,
 	 *        and that nameserver is a glue-name for this dp.
 	 */
 	if(!(qflags&BIT_RD))
 		return 0;
 	/* either available or unused targets */
-	if(dp->usable_list || dp->result_list) 
+	if(dp->usable_list || dp->result_list)
 		return 0;
 	
 	/* see if query is for one of the nameservers, which is glue */
@@ -476,13 +549,16 @@ int
 iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
         struct dns_msg* msg, uint16_t dclass)
 {
+	struct trust_anchor* a;
 	/* information not available, !env->anchors can be common */
 	if(!env || !env->anchors || !dp || !dp->name)
 		return 0;
 	/* a trust anchor exists with this name, RRSIGs expected */
-	if(anchor_find(env->anchors, dp->name, dp->namelabs, dp->namelen,
-		dclass))
+	if((a=anchor_find(env->anchors, dp->name, dp->namelabs, dp->namelen,
+		dclass))) {
+		lock_basic_unlock(&a->lock);
 		return 1;
+	}
 	/* see if DS rrset was given, in AUTH section */
 	if(msg && msg->rep &&
 		reply_find_rrset_section_ns(msg->rep, dp->name, dp->namelen,
@@ -546,6 +622,11 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
 	   reply_find_rrset_section_ns(msg->rep, dp->name, dp->namelen,
 		LDNS_RR_TYPE_NS, dclass))
 		return 1;
+	/* a DNSKEY set is expected at the zone apex as well */
+	/* this is for 'minimal responses' for DNSKEYs */
+	if(reply_find_rrset_section_an(msg->rep, dp->name, dp->namelen,
+		LDNS_RR_TYPE_DNSKEY, dclass))
+		return 1;
 	return 0;
 }
 
@@ -593,6 +674,7 @@ reply_equal(struct reply_info* p, struct reply_info* q)
 	if(p->flags != q->flags ||
 		p->qdcount != q->qdcount ||
 		p->ttl != q->ttl ||
+		p->prefetch_ttl != q->prefetch_ttl ||
 		p->security != q->security ||
 		p->an_numrrsets != q->an_numrrsets ||
 		p->ns_numrrsets != q->ns_numrrsets ||
@@ -605,3 +687,102 @@ reply_equal(struct reply_info* p, struct reply_info* q)
 	}
 	return 1;
 }
+
+void 
+iter_store_inzone_glue(struct module_env* env, struct query_info* qinfo,
+	struct reply_info* rep)
+{
+	struct rrset_ref ref;
+	struct ub_packed_rrset_key* rrset;
+	if(qinfo->qtype != LDNS_RR_TYPE_A && qinfo->qtype != LDNS_RR_TYPE_AAAA)
+		return;
+	rrset = reply_find_rrset(rep, qinfo->qname, qinfo->qname_len,
+		qinfo->qtype, qinfo->qclass);
+	if(!rrset)
+		return;
+	/* got A or AAAA glue rrset. store it in case its handy */
+	rrset = packed_rrset_copy_alloc(rrset, env->alloc, *env->now);
+	if(!rrset) {
+		log_err("malloc failure in store_inzone_glue");
+		return;
+	}
+	rrset->rk.flags |= PACKED_RRSET_PARENT_SIDE;
+	rrset->entry.hash = rrset_key_hash(&rrset->rk);
+	ref.key = rrset;
+	ref.id = rrset->id;
+	/* ignore ret: it was in the cache, ref updated */
+	(void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, *env->now);
+}
+
+int 
+iter_lookup_inzone_glue(struct module_env* env, struct delegpt* dp,
+	struct regional* region, struct query_info* qinfo)
+{
+	struct ub_packed_rrset_key* akey;
+	akey = rrset_cache_lookup(env->rrset_cache, qinfo->qname, 
+		qinfo->qname_len, qinfo->qtype, qinfo->qclass, 
+		PACKED_RRSET_PARENT_SIDE, *env->now, 0);
+	if(akey) {
+		if(qinfo->qtype == LDNS_RR_TYPE_A) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1)) {
+				lock_rw_unlock(&akey->entry.lock);
+				return 0;
+			}
+		} else if(qinfo->qtype == LDNS_RR_TYPE_AAAA) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1)) {
+				lock_rw_unlock(&akey->entry.lock);
+				return 0;
+			}
+		}
+		lock_rw_unlock(&akey->entry.lock);
+	}
+	return 1;
+}
+
+int 
+iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd, 
+	uint16_t* c)
+{
+	uint16_t c1 = *c, c2 = *c;
+	int r1 = hints_next_root(hints, &c1);
+	int r2 = forwards_next_root(fwd, &c2);
+	if(!r1 && !r2) /* got none, end of list */
+		return 0;
+	else if(!r1) /* got one, return that */
+		*c = c2;
+	else if(!r2)
+		*c = c1;
+	else if(c1 < c2) /* got both take smallest */
+		*c = c1;
+	else	*c = c2;
+	return 1;
+}
+
+void
+iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns, uint8_t* z)
+{
+	/* Only the DS record for the delegation itself is expected.
+	 * We allow DS for everything between the bailiwick and the 
+	 * zonecut, thus DS records must be at or above the zonecut.
+	 * And the DS records must be below the server authority zone.
+	 * The answer section is already scrubbed. */
+	size_t i = msg->rep->an_numrrsets;
+	while(i < (msg->rep->an_numrrsets + msg->rep->ns_numrrsets)) {
+		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
+		if(ntohs(s->rk.type) == LDNS_RR_TYPE_DS &&
+			(!ns || !dname_subdomain_c(ns->rk.dname, s->rk.dname)
+			|| query_dname_compare(z, s->rk.dname) == 0)) {
+			log_nametypeclass(VERB_ALGO, "removing irrelevant DS",
+				s->rk.dname, ntohs(s->rk.type),
+				ntohs(s->rk.rrset_class));
+			memmove(msg->rep->rrsets+i, msg->rep->rrsets+i+1,
+				sizeof(struct ub_packed_rrset_key*) * 
+				(msg->rep->rrset_count-i-1));
+			msg->rep->ns_numrrsets--;
+			msg->rep->rrset_count--;
+			/* stay at same i, but new record */
+			continue;
+		}
+		i++;
+	}
+}

iterator/iter_utils.h

@@ -43,7 +43,10 @@
 #ifndef ITERATOR_ITER_UTILS_H
 #define ITERATOR_ITER_UTILS_H
 #include "iterator/iter_resptype.h"
+#include "ldns/buffer.h"
 struct iter_env;
+struct iter_hints;
+struct iter_forwards;
 struct config_file;
 struct module_env;
 struct delegpt_addr;
@@ -54,6 +57,8 @@ struct ub_randstate;
 struct query_info;
 struct reply_info;
 struct module_qstate;
+struct sock_list;
+struct ub_packed_rrset_key;
 
 /**
  * Process config options and set iterator module state.
@@ -81,13 +86,14 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
  * 	these are not preferred, but are used as a last resort.
  * @param open_target: number of currently outstanding target queries.
  * 	If we wait for these, perhaps more server addresses become available.
+ * @param blacklist: the IP blacklist to use.
  * @return best target or NULL if no target.
  *	if not null, that target is removed from the result list in the dp.
  */
 struct delegpt_addr* iter_server_selection(struct iter_env* iter_env, 
 	struct module_env* env, struct delegpt* dp, uint8_t* name, 
 	size_t namelen, uint16_t qtype, int* dnssec_expected,
-	int* chase_to_rd, int open_target);
+	int* chase_to_rd, int open_target, struct sock_list* blacklist);
 
 /**
  * Allocate dns_msg from parsed msg, in regional.
@@ -114,10 +120,11 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
  * @param rep: reply in dns_msg from dns_alloc_msg for example.
  * @param is_referral: If true, then the given message to be stored is a
  *	referral. The cache implementation may use this as a hint.
+ * @param leeway: prefetch TTL leeway to expire old rrsets quicker.
  * @return 0 on alloc error (out of memory).
  */
 int iter_dns_store(struct module_env* env, struct query_info* qinf,
-	struct reply_info* rep, int is_referral);
+	struct reply_info* rep, int is_referral, uint32_t leeway);
 
 /**
  * Select randomly with n/m probability.
@@ -137,6 +144,19 @@ int iter_ns_probability(struct ub_randstate* rnd, int n, int m);
  */
 void iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp);
 
+/**
+ * See if query is in-zone glue and we suspect that it exists.
+ * Suspicion that it exists, is if there is no A or AAAA in cache (since
+ * one of them is expected for an NS record) or the qtype is in cache but
+ * was recently expired (so we have seen this data recently).
+ * @param qinfo: query info.
+ * @param dp: delegation point we are at.
+ * @param env: environment with rrset cache.
+ * @return true if suspect that this glue exists.
+ */
+int iter_suspect_exists(struct query_info* qinfo, struct delegpt* dp,
+	struct module_env* env);
+
 /**
  * See if delegation is useful or offers immediately no targets for 
  * further recursion.
@@ -195,4 +215,46 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
  */
 int reply_equal(struct reply_info* p, struct reply_info* q);
 
+/**
+ * Store in-zone glue in seperate rrset cache entries for later last-resort
+ * lookups in case the child-side versions of this information fails.
+ * @param env: environment with cache, time, ...
+ * @param qinfo: query info. must match the information stored to avoid
+ * 	Kaminsky-style trouble.
+ * @param rep: reply with possibly A or AAAA content to store.
+ */
+void iter_store_inzone_glue(struct module_env* env, struct query_info* qinfo,
+	struct reply_info* rep);
+
+/**
+ * Find in-zone glue from rrset cache again.
+ * @param env: query env with rrset cache and time.
+ * @param dp: delegation point to store result in.
+ * @param region: region to alloc result in.
+ * @param qinfo: query into that is pertinent.
+ * @return false on malloc failure.
+ */
+int iter_lookup_inzone_glue(struct module_env* env, struct delegpt* dp,
+	struct regional* region, struct query_info* qinfo);
+
+/**
+ * Lookup next root-hint or root-forward entry.
+ * @param hints: the hints.
+ * @param fwd: the forwards.
+ * @param c: the class to start searching at. 0 means find first one.
+ * @return false if no classes found, true if found and returned in c.
+ */
+int iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd,
+	uint16_t* c);
+
+/**
+ * Remove DS records that are inappropriate before they are cached.
+ * @param msg: the response to scrub.
+ * @param ns: RRSET that is the NS record for the referral.
+ * 	if NULL, then all DS records are removed from the authority section.
+ * @param z: zone name that the response is from.
+ */
+void iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns,
+	uint8_t* z);
+
 #endif /* ITERATOR_ITER_UTILS_H */

iterator/iterator.c

@@ -41,6 +41,7 @@
  */
 
 #include "config.h"
+#include "ldns/ldns.h"
 #include "iterator/iterator.h"
 #include "iterator/iter_utils.h"
 #include "iterator/iter_hints.h"
@@ -195,6 +196,12 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 				delegpt_log(VERB_ALGO, super_iq->dp);
 			log_assert(0);
 			return;
+		} else {
+			/* see if the failure did get (parent-lame) info */
+			if(!cache_fill_missing(super->env, 
+				super_iq->qchase.qclass, super->region, 
+				super_iq->dp))
+				log_err("out of memory adding missing");
 		}
 		dpns->resolved = 1; /* mark as failed */
 		super_iq->num_target_queries--; 
@@ -247,10 +254,11 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 	FLAGS_SET_RCODE(err.flags, rcode);
 	err.qdcount = 1;
 	err.ttl = NORR_TTL;
+	err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl);
 	/* do not waste time trying to validate this servfail */
 	err.security = sec_status_indeterminate;
 	verbose(VERB_ALGO, "store error response in message cache");
-	if(!iter_dns_store(qstate->env, &qstate->qinfo, &err, 0)) {
+	if(!iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0)) {
 		log_err("error_response_cache: could not store error (nomem)");
 	}
 	return error_response(qstate, id, rcode);
@@ -776,6 +784,56 @@ generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id)
 	}
 }
 
+/**
+ * Generate a DNSKEY prefetch query to get the DNSKEY for the DS record we
+ * just got in a referral (where we have dnssec_expected, thus have trust
+ * anchors above it).  Note that right after calling this routine the
+ * iterator detached subqueries (because of following the referral), and thus
+ * the DNSKEY query becomes detached, its return stored in the cache for
+ * later lookup by the validator.  This cache lookup by the validator avoids
+ * the roundtrip incurred by the DNSKEY query.  The DNSKEY query is now
+ * performed at about the same time the original query is sent to the domain,
+ * thus the two answers are likely to be returned at about the same time,
+ * saving a roundtrip from the validated lookup.
+ *
+ * @param qstate: the qtstate that triggered the need to prime.
+ * @param iq: iterator query state.
+ * @param id: module id.
+ */
+static void
+generate_dnskey_prefetch(struct module_qstate* qstate, 
+	struct iter_qstate* iq, int id)
+{
+	struct module_qstate* subq;
+	log_assert(iq->dp);
+
+	/* is this query the same as the prefetch? */
+	if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
+		query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 &&
+		(qstate->query_flags&BIT_RD) && !(qstate->query_flags&BIT_CD)){
+		return;
+	}
+
+	/* if the DNSKEY is in the cache this lookup will stop quickly */
+	log_nametypeclass(VERB_ALGO, "schedule dnskey prefetch", 
+		iq->dp->name, LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass);
+	if(!generate_sub_request(iq->dp->name, iq->dp->namelen, 
+		LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass, qstate, id, iq,
+		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0)) {
+		/* we'll be slower, but it'll work */
+		verbose(VERB_ALGO, "could not generate dnskey prefetch");
+		return;
+	}
+	if(subq) {
+		struct iter_qstate* subiq = 
+			(struct iter_qstate*)subq->minfo[id];
+		/* this qstate has the right delegation for the dnskey lookup*/
+		/* make copy to avoid use of stub dp by different qs/threads */
+		subiq->dp = delegpt_copy(iq->dp, subq->region);
+		/* if !subiq->dp, it'll start from the cache, no problem */
+	}
+}
+
 /**
  * See if the query needs forwarding.
  * 
@@ -853,20 +911,34 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 
+	/* If the request is qclass=ANY, setup to generate each class */
+	if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
+		iq->qchase.qclass = 0;
+		return next_state(iq, COLLECT_CLASS_STATE);
+	}
+
 	/* Resolver Algorithm Step 1 -- Look for the answer in local data. */
 
 	/* This either results in a query restart (CNAME cache response), a
 	 * terminating response (ANSWER), or a cache miss (null). */
 	
-	msg = dns_cache_lookup(qstate->env, iq->qchase.qname, 
-		iq->qchase.qname_len, iq->qchase.qtype, 
-		iq->qchase.qclass, qstate->region, qstate->env->scratch);
-	if(!msg && qstate->env->neg_cache) {
-		/* lookup in negative cache; may result in 
-		 * NOERROR/NODATA or NXDOMAIN answers that need validation */
-		msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase,
-			qstate->region, qstate->env->rrset_cache,
-			qstate->env->scratch_buffer, *qstate->env->now);
+	if(qstate->blacklist) {
+		/* if cache, or anything else, was blacklisted then
+		 * getting older results from cache is a bad idea, no cache */
+		verbose(VERB_ALGO, "cache blacklisted, going to the network");
+		msg = NULL;
+	} else {
+		msg = dns_cache_lookup(qstate->env, iq->qchase.qname, 
+			iq->qchase.qname_len, iq->qchase.qtype, 
+			iq->qchase.qclass, qstate->region, qstate->env->scratch);
+		if(!msg && qstate->env->neg_cache) {
+			/* lookup in negative cache; may result in 
+			 * NOERROR/NODATA or NXDOMAIN answers that need validation */
+			msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase,
+				qstate->region, qstate->env->rrset_cache,
+				qstate->env->scratch_buffer, 
+				*qstate->env->now, 1/*add SOA*/);
+		}
 	}
 	if(msg) {
 		/* handle positive cache response */
@@ -875,7 +947,9 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(verbosity >= VERB_ALGO) {
 			log_dns_msg("msg from cache lookup", &msg->qinfo, 
 				msg->rep);
-			verbose(VERB_ALGO, "msg ttl is %d", (int)msg->rep->ttl);
+			verbose(VERB_ALGO, "msg ttl is %d, prefetch ttl %d", 
+				(int)msg->rep->ttl, 
+				(int)msg->rep->prefetch_ttl);
 		}
 
 		if(type == RESPONSE_TYPE_CNAME) {
@@ -894,9 +968,13 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			iq->dp = NULL;
 			iq->refetch_glue = 0;
 			iq->query_restart_count++;
+			sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
 			return next_state(iq, INIT_REQUEST_STATE);
 		}
 
+		/* if from cache, NULL, else insert 'cache IP' len=0 */
+		if(qstate->reply_origin)
+			sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
 		/* it is an answer, response, to final state */
 		verbose(VERB_ALGO, "returning answer from cache.");
 		iq->response = msg;
@@ -934,23 +1012,47 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		delname = iq->qchase.qname;
 		delnamelen = iq->qchase.qname_len;
 	}
-	if((iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue)
-		&& !dname_is_root(delname)) {
-		/* do not adjust root label, remove first label from delname */
-		dname_remove_label(&delname, &delnamelen);
+	if(iq->qchase.qtype == LDNS_RR_TYPE_DS || iq->refetch_glue) {
+		/* remove first label from delname, root goes to hints,
+		 * but only to fetch glue, not for qtype=DS. */
+		if(dname_is_root(delname) && iq->refetch_glue)
+			delname = NULL; /* go to root priming */
+		else 	dname_remove_label(&delname, &delnamelen);
 		iq->refetch_glue = 0; /* if CNAME causes restart, no refetch */
 	}
+	/* delname is the name to lookup a delegation for. If NULL rootprime */
 	while(1) {
 		
 		/* Lookup the delegation in the cache. If null, then the 
 		 * cache needs to be primed for the qclass. */
-		iq->dp = dns_cache_find_delegation(qstate->env, delname, 
+		if(delname)
+		     iq->dp = dns_cache_find_delegation(qstate->env, delname, 
 			delnamelen, iq->qchase.qtype, iq->qchase.qclass, 
 			qstate->region, &iq->deleg_msg, *qstate->env->now);
+		else iq->dp = NULL;
 
 		/* If the cache has returned nothing, then we have a 
 		 * root priming situation. */
 		if(iq->dp == NULL) {
+			if(forwards_lookup_root(qstate->env->fwds, 
+				iq->qchase.qclass)) {
+				/* forward zone root, no root prime needed */
+				/* fill in some dp - safety belt */
+				iq->dp = hints_lookup_root(ie->hints, 
+					iq->qchase.qclass);
+				if(!iq->dp) {
+					log_err("internal error: no hints dp");
+					return error_response(qstate, id, 
+						LDNS_RCODE_SERVFAIL);
+				}
+				iq->dp = delegpt_copy(iq->dp, qstate->region);
+				if(!iq->dp) {
+					log_err("out of memory in safety belt");
+					return error_response(qstate, id, 
+						LDNS_RCODE_SERVFAIL);
+				}
+				return next_state(iq, INIT_REQUEST_2_STATE);
+			}
 			/* Note that the result of this will set a new
 			 * DelegationPoint based on the result of priming. */
 			if(!prime_root(qstate, iq, ie, id, iq->qchase.qclass))
@@ -1059,10 +1161,12 @@ processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq,
  *
  * @param qstate: query state.
  * @param iq: iterator query state.
+ * @param id: module id.
  * @return true, advancing the event to the QUERYTARGETS_STATE.
  */
 static int
-processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq)
+processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq, 
+	int id)
 {
 	log_query_info(VERB_QUERY, "resolving (init part 3): ", 
 		&qstate->qinfo);
@@ -1078,13 +1182,23 @@ processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq)
 		if(verbosity >= VERB_ALGO)
 			log_dns_msg("no RD requested, using delegation msg", 
 				&iq->response->qinfo, iq->response->rep);
+		if(qstate->reply_origin)
+			sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
 		return final_state(iq);
 	}
-
 	/* After this point, unset the RD flag -- this query is going to 
 	 * be sent to an auth. server. */
 	iq->chase_flags &= ~BIT_RD;
 
+	/* if dnssec expected, fetch key for the trust-anchor or cached-DS */
+	if(iq->dnssec_expected && qstate->env->cfg->prefetch_key &&
+		!(qstate->query_flags&BIT_CD)) {
+		generate_dnskey_prefetch(qstate, iq, id);
+		fptr_ok(fptr_whitelist_modenv_detach_subs(
+			qstate->env->detach_subs));
+		(*qstate->env->detach_subs)(qstate);
+	}
+
 	/* Jump to the next state. */
 	return next_state(iq, QUERYTARGETS_STATE);
 }
@@ -1258,6 +1372,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_QUERY, "Failed to get a delegation, giving up");
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
+	if(!ie->supports_ipv6)
+		delegpt_no_ipv6(iq->dp);
 	delegpt_log(VERB_ALGO, iq->dp);
 
 	if(iq->num_current_queries>0) {
@@ -1326,7 +1442,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	/* Select the next usable target, filtering out unsuitable targets. */
 	target = iter_server_selection(ie, qstate->env, iq->dp, 
 		iq->dp->name, iq->dp->namelen, iq->qchase.qtype,
-		&iq->dnssec_expected, &iq->chase_to_rd, iq->num_target_queries);
+		&iq->dnssec_expected, &iq->chase_to_rd, iq->num_target_queries,
+		qstate->blacklist);
 
 	/* If no usable target was selected... */
 	if(!target) {
@@ -1357,6 +1474,17 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* Since a target query might have been made, we 
 			 * need to check again. */
 			if(iq->num_target_queries == 0) {
+				/* is it glue and we suspect that it exists?*/
+				if(iter_suspect_exists(&iq->qchase, iq->dp, 
+					qstate->env)) {
+					/* try at parent */
+					iq->deleg_msg = NULL;
+					iq->refetch_glue = 1;
+					iq->query_restart_count++;
+					return next_state(iq, 
+						INIT_REQUEST_STATE);
+				}
+
 				verbose(VERB_QUERY, "out of query targets -- "
 					"returning SERVFAIL");
 				/* fail -- no more targets, no more hope 
@@ -1384,6 +1512,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 
 	/* We have a valid target. */
+	if(iq->dnssec_expected) verbose(VERB_ALGO, "dnssec is expected");
 	log_query_info(VERB_QUERY, "sending query:", &iq->qchase);
 	log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, 
 		&target->addr, target->addrlen);
@@ -1392,7 +1521,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		iq->qchase.qname, iq->qchase.qname_len, 
 		iq->qchase.qtype, iq->qchase.qclass, 
 		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), EDNS_DO|BIT_CD, 
-		&target->addr, target->addrlen, qstate);
+		iq->dnssec_expected, &target->addr, target->addrlen, qstate);
 	if(!outq) {
 		log_addr(VERB_DETAIL, "error sending query to auth server", 
 			&target->addr, target->addrlen);
@@ -1481,16 +1610,23 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			|| !dname_subdomain_c(iq->qchase.qname, ns->rk.dname)){
 			verbose(VERB_ALGO, "bad referral, throwaway");
 			type = RESPONSE_TYPE_THROWAWAY;
-		}
-	}
+		} else
+			iter_scrub_ds(iq->response, ns, iq->dp->name);
+	} else iter_scrub_ds(iq->response, NULL, NULL);
 
 	/* handle each of the type cases */
 	if(type == RESPONSE_TYPE_ANSWER) {
 		/* ANSWER type responses terminate the query algorithm, 
 		 * so they sent on their */
-		verbose(VERB_DETAIL, "query response was ANSWER");
+		if(verbosity >= VERB_DETAIL) {
+			verbose(VERB_DETAIL, "query response was %s",
+				FLAGS_GET_RCODE(iq->response->rep->flags)
+				==LDNS_RCODE_NXDOMAIN?"NXDOMAIN ANSWER":
+				(iq->response->rep->an_numrrsets?"ANSWER":
+				"nodata ANSWER"));
+		}
 		if(!iter_dns_store(qstate->env, &iq->response->qinfo,
-			iq->response->rep, 0))
+			iq->response->rep, 0, qstate->prefetch_leeway))
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		/* close down outstanding requests to be discarded */
 		outbound_list_clear(&iq->outlist);
@@ -1499,6 +1635,10 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			qstate->env->detach_subs));
 		(*qstate->env->detach_subs)(qstate);
 		iq->num_target_queries = 0;
+		if(qstate->reply)
+			sock_list_insert(&qstate->reply_origin, 
+				&qstate->reply->addr, qstate->reply->addrlen, 
+				qstate->region);
 		return final_state(iq);
 	} else if(type == RESPONSE_TYPE_REFERRAL) {
 		/* REFERRAL type responses get a reset of the 
@@ -1515,22 +1655,29 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			    * see if that equals the query name... */
 			&& ( /* auth section, but sometimes in answer section*/
 			  reply_find_rrset_section_ns(iq->response->rep,
-				qstate->qinfo.qname, qstate->qinfo.qname_len,
-				LDNS_RR_TYPE_NS, qstate->qinfo.qclass)
+				iq->qchase.qname, iq->qchase.qname_len,
+				LDNS_RR_TYPE_NS, iq->qchase.qclass)
 			  || reply_find_rrset_section_an(iq->response->rep,
-				qstate->qinfo.qname, qstate->qinfo.qname_len,
-				LDNS_RR_TYPE_NS, qstate->qinfo.qclass)
+				iq->qchase.qname, iq->qchase.qname_len,
+				LDNS_RR_TYPE_NS, iq->qchase.qclass)
 			  )
 		    )) {
 			/* Store the referral under the current query */
+			/* no prefetch-leeway, since its not the answer */
 			if(!iter_dns_store(qstate->env, &iq->response->qinfo,
-				iq->response->rep, 1))
+				iq->response->rep, 1, 0))
 				return error_response(qstate, id, 
 					LDNS_RCODE_SERVFAIL);
 			if(qstate->env->neg_cache)
 				val_neg_addreferral(qstate->env->neg_cache, 
 					iq->response->rep, iq->dp->name);
 		}
+		/* store parent-side-in-zone-glue, if directly queried for */
+		if((qstate->qinfo.qtype == LDNS_RR_TYPE_A
+			|| qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)) {
+			iter_store_inzone_glue(qstate->env,
+				&iq->response->qinfo, iq->response->rep);
+		}
 
 		/* Reset the event state, setting the current delegation 
 		 * point to the referral. */
@@ -1548,6 +1695,10 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * along, indicating dnssec is expected for next zone */
 		iq->dnssec_expected = iter_indicates_dnssec(qstate->env, 
 			iq->dp, iq->response, iq->qchase.qclass);
+		/* if dnssec, validating then also fetch the key for the DS */
+		if(iq->dnssec_expected && qstate->env->cfg->prefetch_key &&
+			!(qstate->query_flags&BIT_CD))
+			generate_dnskey_prefetch(qstate, iq, id);
 
 		/* spawn off NS and addr to auth servers for the NS we just
 		 * got in the referral. This gets authoritative answer
@@ -1585,8 +1736,9 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* cache the CNAME response under the current query */
 		/* NOTE : set referral=1, so that rrsets get stored but not 
 		 * the partial query answer (CNAME only). */
+		/* prefetchleeway applied because this updates answer parts */
 		if(!iter_dns_store(qstate->env, &iq->response->qinfo,
-			iq->response->rep, 1))
+			iq->response->rep, 1, qstate->prefetch_leeway))
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		/* set the current request's qname to the new value. */
 		iq->qchase.qname = sname;
@@ -1608,6 +1760,10 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			qstate->env->detach_subs));
 		(*qstate->env->detach_subs)(qstate);
 		iq->num_target_queries = 0;
+		if(qstate->reply)
+			sock_list_insert(&qstate->reply_origin, 
+				&qstate->reply->addr, qstate->reply->addrlen, 
+				qstate->region);
 		verbose(VERB_ALGO, "cleared outbound list for query restart");
 		/* go to INIT_REQUEST_STATE for new qname. */
 		return next_state(iq, INIT_REQUEST_STATE);
@@ -1808,6 +1964,11 @@ processTargetResponse(struct module_qstate* qstate, int id,
 	 * (regardless if it succeeded or not). */
 	foriq->num_target_queries--;
 
+	/* perhaps we picked up interested cached addressed, like lame ones */
+	if(!iter_lookup_inzone_glue(forq->env, foriq->dp, forq->region, 
+		&iq->qchase))
+		log_err("out of memory adding lame glue");
+
 	/* This response is relevant to the current query, so we 
 	 * add (attempt to add, anyway) this target(s) and reactivate 
 	 * the original event. 
@@ -1833,6 +1994,154 @@ processTargetResponse(struct module_qstate* qstate, int id,
 	}
 }
 
+/**
+ * Process response for qclass=ANY queries for a particular class.
+ * Append to result or error-exit.
+ *
+ * @param qstate: query state.
+ * @param id: module id.
+ * @param forq: super query state.
+ */
+static void
+processClassResponse(struct module_qstate* qstate, int id,
+	struct module_qstate* forq)
+{
+	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];
+	struct dns_msg* from = qstate->return_msg;
+	log_query_info(VERB_ALGO, "processClassResponse", &qstate->qinfo);
+	log_query_info(VERB_ALGO, "processClassResponse super", &forq->qinfo);
+	if(qstate->return_rcode != LDNS_RCODE_NOERROR) {
+		/* cause servfail for qclass ANY query */
+		foriq->response = NULL;
+		foriq->state = FINISHED_STATE;
+		return;
+	}
+	/* append result */
+	if(!foriq->response) {
+		/* allocate the response: copy RCODE, sec_state */
+		foriq->response = dns_copy_msg(from, forq->region);
+		if(!foriq->response) {
+			log_err("malloc failed for qclass ANY response"); 
+			foriq->state = FINISHED_STATE;
+			return;
+		}
+		foriq->response->qinfo.qclass = forq->qinfo.qclass;
+		/* qclass ANY does not receive the AA flag on replies */
+		foriq->response->rep->authoritative = 0; 
+	} else {
+		struct dns_msg* to = foriq->response;
+		/* add _from_ this response _to_ existing collection */
+		/* if there are records, copy RCODE */
+		/* lower sec_state if this message is lower */
+		if(from->rep->rrset_count != 0) {
+			size_t n = from->rep->rrset_count+to->rep->rrset_count;
+			struct ub_packed_rrset_key** dest, **d;
+			/* copy appropriate rcode */
+			to->rep->flags = from->rep->flags;
+			/* copy rrsets */
+			dest = regional_alloc(forq->region, sizeof(dest[0])*n);
+			if(!dest) {
+				log_err("malloc failed in collect ANY"); 
+				foriq->state = FINISHED_STATE;
+				return;
+			}
+			d = dest;
+			/* copy AN */
+			memcpy(dest, to->rep->rrsets, to->rep->an_numrrsets
+				* sizeof(dest[0]));
+			dest += to->rep->an_numrrsets;
+			memcpy(dest, from->rep->rrsets, from->rep->an_numrrsets
+				* sizeof(dest[0]));
+			dest += from->rep->an_numrrsets;
+			/* copy NS */
+			memcpy(dest, to->rep->rrsets+to->rep->an_numrrsets,
+				to->rep->ns_numrrsets * sizeof(dest[0]));
+			dest += to->rep->ns_numrrsets;
+			memcpy(dest, from->rep->rrsets+from->rep->an_numrrsets,
+				from->rep->ns_numrrsets * sizeof(dest[0]));
+			dest += from->rep->ns_numrrsets;
+			/* copy AR */
+			memcpy(dest, to->rep->rrsets+to->rep->an_numrrsets+
+				to->rep->ns_numrrsets,
+				to->rep->ar_numrrsets * sizeof(dest[0]));
+			dest += to->rep->ar_numrrsets;
+			memcpy(dest, from->rep->rrsets+from->rep->an_numrrsets+
+				from->rep->ns_numrrsets,
+				from->rep->ar_numrrsets * sizeof(dest[0]));
+			/* update counts */
+			to->rep->rrsets = d;
+			to->rep->an_numrrsets += from->rep->an_numrrsets;
+			to->rep->ns_numrrsets += from->rep->ns_numrrsets;
+			to->rep->ar_numrrsets += from->rep->ar_numrrsets;
+			to->rep->rrset_count = n;
+		}
+		if(from->rep->security < to->rep->security) /* lowest sec */
+			to->rep->security = from->rep->security;
+		if(from->rep->qdcount != 0) /* insert qd if appropriate */
+			to->rep->qdcount = from->rep->qdcount;
+		if(from->rep->ttl < to->rep->ttl) /* use smallest TTL */
+			to->rep->ttl = from->rep->ttl;
+		if(from->rep->prefetch_ttl < to->rep->prefetch_ttl)
+			to->rep->prefetch_ttl = from->rep->prefetch_ttl;
+	}
+	/* are we done? */
+	foriq->num_current_queries --;
+	if(foriq->num_current_queries == 0)
+		foriq->state = FINISHED_STATE;
+}
+	
+/** 
+ * Collect class ANY responses and make them into one response.  This
+ * state is started and it creates queries for all classes (that have
+ * root hints).  The answers are then collected.
+ *
+ * @param qstate: query state.
+ * @param id: module id.
+ * @return true if the event needs more immediate processing, false if not.
+ */
+static int
+processCollectClass(struct module_qstate* qstate, int id)
+{
+	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
+	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
+	struct module_qstate* subq;
+	/* If qchase.qclass == 0 then send out queries for all classes.
+	 * Otherwise, do nothing (wait for all answers to arrive and the
+	 * processClassResponse to put them together, and that moves us
+	 * towards the Finished state when done. */
+	if(iq->qchase.qclass == 0) {
+		uint16_t c = 0;
+		iq->qchase.qclass = LDNS_RR_CLASS_ANY;
+		while(iter_get_next_root(ie->hints, qstate->env->fwds, &c)) {
+			/* generate query for this class */
+			log_nametypeclass(VERB_ALGO, "spawn collect query",
+				qstate->qinfo.qname, qstate->qinfo.qtype, c);
+			if(!generate_sub_request(qstate->qinfo.qname,
+				qstate->qinfo.qname_len, qstate->qinfo.qtype,
+				c, qstate, id, iq, INIT_REQUEST_STATE,
+				FINISHED_STATE, &subq, 
+				(int)!(qstate->query_flags&BIT_CD))) {
+				return error_response(qstate, id, 
+					LDNS_RCODE_SERVFAIL);
+			}
+			/* ignore subq, no special init required */
+			iq->num_current_queries ++;
+			if(c == 0xffff)
+				break;
+			else c++;
+		}
+		/* if no roots are configured at all, return */
+		if(iq->num_current_queries == 0) {
+			verbose(VERB_ALGO, "No root hints or fwds, giving up "
+				"on qclass ANY");
+			return error_response(qstate, id, LDNS_RCODE_REFUSED);
+		}
+		/* return false, wait for queries to return */
+	}
+	/* if woke up here because of an answer, wait for more answers */
+	return 0;
+}
+
 /** 
  * This handles the final state for first-tier responses (i.e., responses to
  * externally generated queries).
@@ -1885,7 +2194,7 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * from cache does not need to be stored in the msg cache. */
 		if(qstate->query_flags&BIT_RD) {
 			if(!iter_dns_store(qstate->env, &qstate->qinfo, 
-				iq->response->rep, 0))
+				iq->response->rep, 0, qstate->prefetch_leeway))
 				return error_response(qstate, id, 
 					LDNS_RCODE_SERVFAIL);
 		}
@@ -1909,7 +2218,9 @@ void
 iter_inform_super(struct module_qstate* qstate, int id, 
 	struct module_qstate* super)
 {
-	if(qstate->return_rcode != LDNS_RCODE_NOERROR)
+	if(super->qinfo.qclass == LDNS_RR_CLASS_ANY)
+		processClassResponse(qstate, id, super);
+	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
 		error_supers(qstate, id, super);
 	else if(qstate->is_priming)
 		prime_supers(qstate, id, super);
@@ -1944,7 +2255,7 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
 				cont = processInitRequest2(qstate, iq, ie, id);
 				break;
 			case INIT_REQUEST_3_STATE:
-				cont = processInitRequest3(qstate, iq);
+				cont = processInitRequest3(qstate, iq, id);
 				break;
 			case QUERYTARGETS_STATE:
 				cont = processQueryTargets(qstate, iq, ie, id);
@@ -1955,6 +2266,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
 			case PRIME_RESP_STATE:
 				cont = processPrimeResponse(qstate, id);
 				break;
+			case COLLECT_CLASS_STATE:
+				cont = processCollectClass(qstate, id);
+				break;
 			case FINISHED_STATE:
 				cont = processFinished(qstate, iq, id);
 				break;
@@ -2182,6 +2496,8 @@ iter_state_to_string(enum iter_state state)
 		return "QUERY TARGETS STATE";
 	case PRIME_RESP_STATE :
 		return "PRIME RESPONSE STATE";
+	case COLLECT_CLASS_STATE :
+		return "COLLECT CLASS STATE";
 	case QUERY_RESP_STATE :
 		return "QUERY RESPONSE STATE";
 	case FINISHED_STATE :
@@ -2199,6 +2515,7 @@ iter_state_is_responsestate(enum iter_state s)
 		case INIT_REQUEST_2_STATE :
 		case INIT_REQUEST_3_STATE :
 		case QUERYTARGETS_STATE :
+		case COLLECT_CLASS_STATE :
 			return 0;
 		default:
 			break;

iterator/iterator.h

@@ -65,6 +65,10 @@ struct iter_priv;
  * Equals RTT_MAX_TIMEOUT
  */
 #define USEFUL_SERVER_TOP_TIMEOUT	120000
+/** Number of lost messages in a row that get a host blacklisted.
+ * With 16, a couple different queries have to time out and no working
+ * queries are happening */
+#define USEFUL_SERVER_MAX_LOST	16
 /** number of retries on outgoing queries */
 #define OUTBOUND_MSG_RETRY 5
 /** RTT band, within this amount from the best, servers are chosen randomly.
@@ -146,6 +150,10 @@ enum iter_state {
 	/** Responses to priming queries finish at this state. */
 	PRIME_RESP_STATE,
 
+	/** Collecting query class information, for qclass=ANY, when
+	 * it spawns off queries for every class, it returns here. */
+	COLLECT_CLASS_STATE,
+
 	/** Responses that are to be returned upstream end at this state. 
 	 * As well as responses to target queries. */
 	FINISHED_STATE

libunbound/context.c

@@ -288,20 +288,27 @@ context_serialize_answer(struct ctx_query* q, int err, ldns_buffer* pkt,
 	 * 	o uint32 id
 	 * 	o uint32 error_code
 	 * 	o uint32 msg_security
+	 * 	o uint32 length of why_bogus string (+1 for eos); 0 absent.
+	 * 	o why_bogus_string
 	 * 	o the remainder is the answer msg from resolver lookup.
 	 * 	  remainder can be length 0.
 	 */
 	size_t pkt_len = pkt?ldns_buffer_remaining(pkt):0;
+	size_t wlen = (pkt&&q->res->why_bogus)?strlen(q->res->why_bogus)+1:0;
 	uint8_t* p;
-	*len = sizeof(uint32_t)*4 + pkt_len;
+	*len = sizeof(uint32_t)*5 + pkt_len + wlen;
 	p = (uint8_t*)malloc(*len);
 	if(!p) return NULL;
 	ldns_write_uint32(p, UB_LIBCMD_ANSWER);
 	ldns_write_uint32(p+sizeof(uint32_t), (uint32_t)q->querynum);
 	ldns_write_uint32(p+2*sizeof(uint32_t), (uint32_t)err);
 	ldns_write_uint32(p+3*sizeof(uint32_t), (uint32_t)q->msg_security);
+	ldns_write_uint32(p+4*sizeof(uint32_t), (uint32_t)wlen);
+	if(wlen > 0)
+		memmove(p+5*sizeof(uint32_t), q->res->why_bogus, wlen);
 	if(pkt_len > 0)
-		memmove(p+4*sizeof(uint32_t), ldns_buffer_begin(pkt), pkt_len);
+		memmove(p+5*sizeof(uint32_t)+wlen, 
+			ldns_buffer_begin(pkt), pkt_len);
 	return p;
 }
 
@@ -311,16 +318,31 @@ context_deserialize_answer(struct ub_ctx* ctx,
 {
 	struct ctx_query* q = NULL ;
 	int id;
-	if(len < 4*sizeof(uint32_t)) return NULL;
+	size_t wlen;
+	if(len < 5*sizeof(uint32_t)) return NULL;
 	log_assert( ldns_read_uint32(p) == UB_LIBCMD_ANSWER);
 	id = (int)ldns_read_uint32(p+sizeof(uint32_t));
 	q = (struct ctx_query*)rbtree_search(&ctx->queries, &id);
 	if(!q) return NULL; 
 	*err = (int)ldns_read_uint32(p+2*sizeof(uint32_t));
 	q->msg_security = ldns_read_uint32(p+3*sizeof(uint32_t));
-	if(len > 4*sizeof(uint32_t)) {
-		q->msg_len = len - 4*sizeof(uint32_t);
-		q->msg = (uint8_t*)memdup(p+4*sizeof(uint32_t), q->msg_len);
+	wlen = (size_t)ldns_read_uint32(p+4*sizeof(uint32_t));
+	if(len > 5*sizeof(uint32_t) && wlen > 0) {
+		if(len >= 5*sizeof(uint32_t)+wlen)
+			q->res->why_bogus = (char*)memdup(
+				p+5*sizeof(uint32_t), wlen);
+		if(!q->res->why_bogus) {
+			/* pass malloc failure to the user callback */
+			q->msg_len = 0;
+			*err = UB_NOMEM;
+			return q;
+		}
+		q->res->why_bogus[wlen-1] = 0; /* zero terminated for sure */
+	}
+	if(len > 5*sizeof(uint32_t)+wlen) {
+		q->msg_len = len - 5*sizeof(uint32_t) - wlen;
+		q->msg = (uint8_t*)memdup(p+5*sizeof(uint32_t)+wlen, 
+			q->msg_len);
 		if(!q->msg) {
 			/* pass malloc failure to the user callback */
 			q->msg_len = 0;

libunbound/libunbound.c

@@ -44,6 +44,7 @@
 /* include the public api first, it should be able to stand alone */
 #include "libunbound/unbound.h"
 #include "config.h"
+#include <ctype.h>
 #include "libunbound/context.h"
 #include "libunbound/libworker.h"
 #include "util/locks.h"
@@ -60,6 +61,11 @@
 #include "services/cache/infra.h"
 #include "services/cache/rrset.h"
 
+#if defined(UB_ON_WINDOWS) && defined (HAVE_WINDOWS_H)
+#include <windows.h>
+#include <iphlpapi.h>
+#endif /* UB_ON_WINDOWS */
+
 struct ub_ctx* 
 ub_ctx_create()
 {
@@ -238,6 +244,19 @@ ub_ctx_set_option(struct ub_ctx* ctx, char* opt, char* val)
 	return UB_NOERROR;
 }
 
+int
+ub_ctx_get_option(struct ub_ctx* ctx, char* opt, char** str)
+{
+	int r;
+	lock_basic_lock(&ctx->cfglock);
+	r = config_get_option_collate(ctx->env->cfg, opt, str);
+	lock_basic_unlock(&ctx->cfglock);
+	if(r == 0) r = UB_NOERROR;
+	else if(r == 1) r = UB_SYNTAX;
+	else if(r == 2) r = UB_NOMEM;
+	return r;
+}
+
 int 
 ub_ctx_config(struct ub_ctx* ctx, char* fname)
 {
@@ -262,6 +281,7 @@ ub_ctx_add_ta(struct ub_ctx* ctx, char* ta)
 	lock_basic_lock(&ctx->cfglock);
 	if(ctx->finalized) {
 		lock_basic_unlock(&ctx->cfglock);
+		free(dup);
 		return UB_AFTERFINAL;
 	}
 	if(!cfg_strlist_insert(&ctx->env->cfg->trust_anchor_list, dup)) {
@@ -281,6 +301,7 @@ ub_ctx_add_ta_file(struct ub_ctx* ctx, char* fname)
 	lock_basic_lock(&ctx->cfglock);
 	if(ctx->finalized) {
 		lock_basic_unlock(&ctx->cfglock);
+		free(dup);
 		return UB_AFTERFINAL;
 	}
 	if(!cfg_strlist_insert(&ctx->env->cfg->trust_anchor_file_list, dup)) {
@@ -300,6 +321,7 @@ ub_ctx_trustedkeys(struct ub_ctx* ctx, char* fname)
 	lock_basic_lock(&ctx->cfglock);
 	if(ctx->finalized) {
 		lock_basic_unlock(&ctx->cfglock);
+		free(dup);
 		return UB_AFTERFINAL;
 	}
 	if(!cfg_strlist_insert(&ctx->env->cfg->trusted_keys_file_list, dup)) {
@@ -686,6 +708,7 @@ ub_resolve_free(struct ub_result* result)
 	free(result->data);
 	free(result->len);
 	free(result->answer_packet);
+	free(result->why_bogus);
 	free(result);
 }
 
@@ -788,8 +811,47 @@ ub_ctx_resolvconf(struct ub_ctx* ctx, char* fname)
 	char buf[1024];
 	char* parse, *addr;
 	int r;
-	if(fname == NULL)
+
+	if(fname == NULL) {
+#if !defined(UB_ON_WINDOWS) || !defined(HAVE_WINDOWS_H)
 		fname = "/etc/resolv.conf";
+#else
+		FIXED_INFO *info;
+		ULONG buflen = sizeof(*info);
+		IP_ADDR_STRING *ptr;
+
+		info = (FIXED_INFO *) malloc(sizeof (FIXED_INFO));
+		if (info == NULL) 
+			return UB_READFILE;
+
+		if (GetNetworkParams(info, &buflen) == ERROR_BUFFER_OVERFLOW) {
+			free(info);
+			info = (FIXED_INFO *) malloc(buflen);
+			if (info == NULL)
+				return UB_READFILE;
+		}
+
+		if (GetNetworkParams(info, &buflen) == NO_ERROR) {
+			int retval=0;
+			ptr = &(info->DnsServerList);
+			while (ptr) {
+				numserv++;
+				if((retval=ub_ctx_set_fwd(ctx, 
+					ptr->IpAddress.String)!=0)) {
+					free(info);
+					return retval;
+				}
+				ptr = ptr->Next;
+			}
+			free(info);
+			if (numserv==0)
+				return UB_READFILE;
+			return UB_NOERROR;
+		}
+		free(info);
+		return UB_READFILE;
+#endif /* WINDOWS */
+	}
 	in = fopen(fname, "r");
 	if(!in) {
 		/* error in errno! perror(fname) */
@@ -840,8 +902,31 @@ ub_ctx_hosts(struct ub_ctx* ctx, char* fname)
 		return UB_AFTERFINAL;
 	}
 	lock_basic_unlock(&ctx->cfglock);
-	if(fname == NULL)
+	if(fname == NULL) {
+#if defined(UB_ON_WINDOWS) && defined(HAVE_WINDOWS_H)
+		/*
+		 * If this is Windows NT/XP/2K it's in
+		 * %WINDIR%\system32\drivers\etc\hosts.
+		 * If this is Windows 95/98/Me it's in %WINDIR%\hosts.
+		 */
+		name = getenv("WINDIR");
+		if (name != NULL) {
+			int retval=0;
+			snprintf(buf, sizeof(buf), "%s%s", name, 
+				"\\system32\\drivers\\etc\\hosts");
+			if((retval=ub_ctx_hosts(ctx, buf)) !=0 ) {
+				snprintf(buf, sizeof(buf), "%s%s", name, 
+					"\\hosts");
+				retval=ub_ctx_hosts(ctx, buf);
+			}
+			free(name);
+			return retval;
+		}
+		return UB_READFILE;
+#else
 		fname = "/etc/hosts";
+#endif /* WIN32 */
+	}
 	in = fopen(fname, "r");
 	if(!in) {
 		/* error in errno! perror(fname) */

libunbound/libworker.c

@@ -42,6 +42,8 @@
  * returns from the procedure when done.
  */
 #include "config.h"
+#include <ldns/dname.h>
+#include <ldns/wire2host.h>
 #include "libunbound/libworker.h"
 #include "libunbound/context.h"
 #include "libunbound/unbound.h"
@@ -130,6 +132,7 @@ libworker_setup(struct ub_ctx* ctx, int is_bg)
 		return NULL;
 	}
 	w->env->worker = (struct worker*)w;
+	w->env->probe_timer = NULL;
 	seed = (unsigned int)time(NULL) ^ (unsigned int)getpid() ^
 		(((unsigned int)w->thread_num)<<17);
 	seed ^= (unsigned int)w->env->alloc->next_id;
@@ -168,7 +171,7 @@ libworker_setup(struct ub_ctx* ctx, int is_bg)
 		cfg->do_tcp?cfg->outgoing_num_tcp:0,
 		w->env->infra_cache, w->env->rnd, cfg->use_caps_bits_for_id,
 		ports, numports, cfg->unwanted_threshold,
-		&libworker_alloc_cleanup, w);
+		&libworker_alloc_cleanup, w, cfg->do_udp);
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);
 	}
@@ -437,8 +440,10 @@ libworker_enter_result(struct ub_result* res, ldns_buffer* buf,
 /** fillup fg results */
 static void
 libworker_fillup_fg(struct ctx_query* q, int rcode, ldns_buffer* buf, 
-	enum sec_status s)
+	enum sec_status s, char* why_bogus)
 {
+	if(why_bogus)
+		q->res->why_bogus = strdup(why_bogus);
 	if(rcode != 0) {
 		q->res->rcode = rcode;
 		q->msg_security = s;
@@ -459,13 +464,14 @@ libworker_fillup_fg(struct ctx_query* q, int rcode, ldns_buffer* buf,
 }
 
 void
-libworker_fg_done_cb(void* arg, int rcode, ldns_buffer* buf, enum sec_status s)
+libworker_fg_done_cb(void* arg, int rcode, ldns_buffer* buf, enum sec_status s,
+	char* why_bogus)
 {
 	struct ctx_query* q = (struct ctx_query*)arg;
 	/* fg query is done; exit comm base */
 	comm_base_exit(q->w->base);
 
-	libworker_fillup_fg(q, rcode, buf, s);
+	libworker_fillup_fg(q, rcode, buf, s, why_bogus);
 }
 
 /** setup qinfo and edns */
@@ -480,8 +486,15 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 	if(!rdf) {
 		return 0;
 	}
+#ifdef UNBOUND_ALLOC_LITE
+	qinfo->qname = memdup(ldns_rdf_data(rdf), ldns_rdf_size(rdf));
+	qinfo->qname_len = ldns_rdf_size(rdf);
+	ldns_rdf_deep_free(rdf);
+	rdf = 0;
+#else
 	qinfo->qname = ldns_rdf_data(rdf);
 	qinfo->qname_len = ldns_rdf_size(rdf);
+#endif
 	edns->edns_present = 1;
 	edns->ext_rcode = 0;
 	edns->edns_version = 0;
@@ -514,8 +527,9 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
 	ldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
 	if(local_zones_answer(ctx->local_zones, &qinfo, &edns, 
 		w->back->udp_buff, w->env->scratch)) {
+		regional_free_all(w->env->scratch);
 		libworker_fillup_fg(q, LDNS_RCODE_NOERROR, 
-			w->back->udp_buff, sec_status_insecure);
+			w->back->udp_buff, sec_status_insecure, NULL);
 		libworker_delete(w);
 		free(qinfo.qname);
 		return UB_NOERROR;
@@ -538,7 +552,7 @@ int libworker_fg(struct ub_ctx* ctx, struct ctx_query* q)
 /** add result to the bg worker result queue */
 static void
 add_bg_result(struct libworker* w, struct ctx_query* q, ldns_buffer* pkt, 
-	int err)
+	int err, char* reason)
 {
 	uint8_t* msg = NULL;
 	uint32_t len = 0;
@@ -546,6 +560,8 @@ add_bg_result(struct libworker* w, struct ctx_query* q, ldns_buffer* pkt,
 	/* serialize and delete unneeded q */
 	if(w->is_bg_thread) {
 		lock_basic_lock(&w->ctx->cfglock);
+		if(reason)
+			q->res->why_bogus = strdup(reason);
 		if(pkt) {
 			q->msg_len = ldns_buffer_remaining(pkt);
 			q->msg = memdup(ldns_buffer_begin(pkt), q->msg_len);
@@ -557,6 +573,8 @@ add_bg_result(struct libworker* w, struct ctx_query* q, ldns_buffer* pkt,
 		} else msg = context_serialize_answer(q, err, NULL, &len);
 		lock_basic_unlock(&w->ctx->cfglock);
 	} else {
+		if(reason)
+			q->res->why_bogus = strdup(reason);
 		msg = context_serialize_answer(q, err, pkt, &len);
 		(void)rbtree_delete(&w->ctx->queries, q->node.key);
 		w->ctx->num_async--;
@@ -574,7 +592,8 @@ add_bg_result(struct libworker* w, struct ctx_query* q, ldns_buffer* pkt,
 }
 
 void
-libworker_bg_done_cb(void* arg, int rcode, ldns_buffer* buf, enum sec_status s)
+libworker_bg_done_cb(void* arg, int rcode, ldns_buffer* buf, enum sec_status s,
+	char* why_bogus)
 {
 	struct ctx_query* q = (struct ctx_query*)arg;
 
@@ -595,7 +614,7 @@ libworker_bg_done_cb(void* arg, int rcode, ldns_buffer* buf, enum sec_status s)
 	if(rcode != 0) {
 		error_encode(buf, rcode, NULL, 0, BIT_RD, NULL);
 	}
-	add_bg_result(q->w, q, buf, UB_NOERROR);
+	add_bg_result(q->w, q, buf, UB_NOERROR, why_bogus);
 }
 
 
@@ -620,7 +639,7 @@ handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
 		return;
 	}
 	if(!setup_qinfo_edns(w, q, &qinfo, &edns)) {
-		add_bg_result(w, q, NULL, UB_SYNTAX);
+		add_bg_result(w, q, NULL, UB_SYNTAX, NULL);
 		return;
 	}
 	qid = 0;
@@ -630,8 +649,9 @@ handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
 	ldns_buffer_write_u16_at(w->back->udp_buff, 2, qflags);
 	if(local_zones_answer(w->ctx->local_zones, &qinfo, &edns, 
 		w->back->udp_buff, w->env->scratch)) {
+		regional_free_all(w->env->scratch);
 		q->msg_security = sec_status_insecure;
-		add_bg_result(w, q, w->back->udp_buff, UB_NOERROR);
+		add_bg_result(w, q, w->back->udp_buff, UB_NOERROR, NULL);
 		free(qinfo.qname);
 		return;
 	}
@@ -639,7 +659,7 @@ handle_newq(struct libworker* w, uint8_t* buf, uint32_t len)
 	/* process new query */
 	if(!mesh_new_callback(w->env->mesh, &qinfo, qflags, &edns, 
 		w->back->udp_buff, qid, libworker_bg_done_cb, q)) {
-		add_bg_result(w, q, NULL, UB_NOMEM);
+		add_bg_result(w, q, NULL, UB_NOMEM, NULL);
 	}
 	free(qinfo.qname);
 }
@@ -676,7 +696,7 @@ outbound_entry_compare(void* a, void* b)
 
 struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
         uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-        struct sockaddr_storage* addr, socklen_t addrlen,
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
         struct module_qstate* q)
 {
 	struct libworker* w = (struct libworker*)q->env->worker;
@@ -686,9 +706,9 @@ struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
 		return NULL;
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(w->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, addr, addrlen,
-		libworker_handle_service_reply, e, w->back->udp_buff,
-		&outbound_entry_compare);
+		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
+		addr, addrlen, libworker_handle_service_reply, e, 
+		w->back->udp_buff, &outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -815,7 +835,8 @@ int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
@@ -833,6 +854,11 @@ void worker_stat_timer_cb(void* ATTR_UNUSED(arg))
 	log_assert(0);
 }
 
+void worker_probe_timer_cb(void* ATTR_UNUSED(arg))
+{
+	log_assert(0);
+}
+
 int order_lock_cmp(const void* ATTR_UNUSED(e1), const void* ATTR_UNUSED(e2))
 {
 	log_assert(0);
@@ -846,6 +872,17 @@ codeline_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 	return 0;
 }
 
+int replay_var_compare(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
+{
+        log_assert(0);
+        return 0;
+}
+
+void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
+{
+        log_assert(0);
+}
+
 #ifdef UB_ON_WINDOWS
 void
 worker_win_stop_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev), void* 

libunbound/libworker.h

@@ -129,6 +129,7 @@ int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  * @param qclass: query class. (host order)
  * @param flags: host order flags word, with opcode and CD bit.
  * @param dnssec: if set, EDNS record will have DO bit set.
+ * @param want_dnssec: signatures needed.
  * @param addr: where to.
  * @param addrlen: length of addr.
  * @param q: wich query state to reactivate upon return.
@@ -137,7 +138,7 @@ int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  */
 struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
         uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-        struct sockaddr_storage* addr, socklen_t addrlen,
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
         struct module_qstate* q);
 
 /** process incoming replies from the network */
@@ -158,11 +159,11 @@ void libworker_handle_result_write(struct tube* tube, uint8_t* msg, size_t len,
 
 /** mesh callback with fg results */
 void libworker_fg_done_cb(void* arg, int rcode, ldns_buffer* buf, 
-	enum sec_status s);
+	enum sec_status s, char* why_bogus);
 
 /** mesh callback with bg results */
 void libworker_bg_done_cb(void* arg, int rcode, ldns_buffer* buf, 
-	enum sec_status s);
+	enum sec_status s, char* why_bogus);
 
 /** 
  * fill result from parsed message, on error fills servfail 

libunbound/python/Makefile

@@ -56,9 +56,9 @@ clean:
 	rm -f _unbound.so libunbound_wrap.o
 	$(MAKE) -C ../.. clean
 
-testenv: ../../.libs/libunbound.so.1 ../../ldns-src/lib/libldns.so ../../.libs/_unbound.so
+testenv: ../../.libs/libunbound.so.2 ../../ldns-src/lib/libldns.so ../../.libs/_unbound.so
 	rm -rdf examples/unbound
-	cd examples && mkdir unbound && ln -s ../../unbound.py unbound/__init__.py && ln -s ../../_unbound.so unbound/_unbound.so && ln -s ../../../../.libs/libunbound.so.1 unbound/libunbound.so.1 && ln -s ../../../../ldns-src/lib/libldns.so.1 unbound/libldns.so.1 && ls -la
+	cd examples && mkdir unbound && ln -s ../../unbound.py unbound/__init__.py && ln -s ../../_unbound.so unbound/_unbound.so && ln -s ../../../../.libs/libunbound.so.2 unbound/libunbound.so.2 && ln -s ../../../../ldns-src/lib/libldns.so.1 unbound/libldns.so.1 && ls -la
 	cd examples && if test -f ../../../.libs/_unbound.so; then cp ../../../.libs/_unbound.so . ; fi
 	@echo "Run a script by typing ./script_name.py"
 	cd examples && LD_LIBRARY_PATH=unbound bash

libunbound/python/doc/install.rst

@@ -5,22 +5,18 @@ Installation
 
 Python 2.4 or higher, SWIG 1.3 or higher, GNU make
 
-**Download**
-
-You can download the source codes `here`_.
-The latest release is 1.1.1, Jan 15, 2009.
-
-.. _here: unbound-1.1.1-py.tar.gz
-
 **Compiling**
 
 After downloading, you can compile the pyUnbound library by doing::
 
-	> tar -xzf unbound-1.1.1-py.tar.gz
-	> cd unbound-1.1.1
+	> tar -xzf unbound-x.x.x-py.tar.gz
+	> cd unbound-x.x.x
 	> ./configure --with-pyunbound
 	> make
 
+You may want to --with-pythonmodule as well if you want to use python as
+a module in the resolver.
+
 You need GNU make to compile sources; SWIG and Python devel libraries to compile extension module. 
 
 
@@ -32,4 +28,4 @@ If the compilation is successfull, you can test the python LDNS extension module
 	> make testenv
 	> ./dns-lookup.py
 
-In contrib/examples you can find simple applications written in Python using the Unbound extension.
+You may want to make install in the main directory since make testenv is for debugging.  In contrib/examples you can find simple applications written in Python using the Unbound extension.

libunbound/ubsyms.def

@@ -1,5 +1,6 @@
 ub_ctx_create
 ub_ctx_delete
+ub_ctx_get_option
 ub_ctx_set_option
 ub_ctx_config
 ub_ctx_set_fwd

libunbound/unbound.h

@@ -181,6 +181,14 @@ struct ub_result {
 	 * This means the data is from a domain where data is not signed.
 	 */
 	int bogus;
+	
+	/**
+	 * If the result is bogus this contains a string (zero terminated)
+	 * that describes the failure.  There may be other errors as well
+	 * as the one described, the description may not be perfectly accurate.
+	 * Is NULL if the result is not bogus.
+	 */
+	char* why_bogus;
 };
 
 /**
@@ -219,7 +227,7 @@ void ub_ctx_delete(struct ub_ctx* ctx);
  * @param ctx: context.
  * @param opt: option name from the unbound.conf config file format.
  *	(not all settings applicable). The name includes the trailing ':'
- *	for example ub_ctx_set_option("logfile:", "mylog.txt");
+ *	for example ub_ctx_set_option(ctx, "logfile:", "mylog.txt");
  * 	This is a power-users interface that lets you specify all sorts
  * 	of options.
  * 	For some specific options, such as adding trust anchors, special
@@ -229,6 +237,22 @@ void ub_ctx_delete(struct ub_ctx* ctx);
  */
 int ub_ctx_set_option(struct ub_ctx* ctx, char* opt, char* val);
 
+/**
+ * Get an option from the context.
+ * @param ctx: context.
+ * @param opt: option name from the unbound.conf config file format.
+ *	(not all settings applicable). The name excludes the trailing ':'
+ *	for example ub_ctx_get_option(ctx, "logfile", &result);
+ * 	This is a power-users interface that lets you specify all sorts
+ * 	of options.
+ * @param str: the string is malloced and returned here. NULL on error.
+ * 	The caller must free() the string.  In cases with multiple 
+ * 	entries (auto-trust-anchor-file), a newline delimited list is 
+ * 	returned in the string.
+ * @return 0 if OK else an error code (malloc failure, syntax error).
+ */
+int ub_ctx_get_option(struct ub_ctx* ctx, char* opt, char** str);
+
 /**
  * setup configuration for the given context.
  * @param ctx: context.

ltmain.sh

@@ -1,6 +1,6 @@
 # Generated from ltmain.m4sh.
 
-# ltmain.sh (GNU libtool) 2.2.6
+# ltmain.sh (GNU libtool) 2.2.6b
 # Written by Gordon Matzigkeit <gord@gnu.ai.mit.edu>, 1996
 
 # Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2003, 2004, 2005, 2006, 2007 2008 Free Software Foundation, Inc.
@@ -65,7 +65,7 @@
 #       compiler:		$LTCC
 #       compiler flags:		$LTCFLAGS
 #       linker:		$LD (gnu? $with_gnu_ld)
-#       $progname:		(GNU libtool) 2.2.6
+#       $progname:		(GNU libtool) 2.2.6b
 #       automake:		$automake_version
 #       autoconf:		$autoconf_version
 #
@@ -73,9 +73,9 @@
 
 PROGRAM=ltmain.sh
 PACKAGE=libtool
-VERSION=2.2.6
+VERSION=2.2.6b
 TIMESTAMP=""
-package_revision=1.3012
+package_revision=1.3017
 
 # Be Bourne compatible
 if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then

pythonmod/Makefile

@@ -34,7 +34,7 @@
 
 SUEXEC  = sudo
 UNBOUND = ../unbound
-SCRIPT  = ./test-dict.conf
+SCRIPT  = ./test-resip.conf
 
 UNBOUND_OPTS = -dv -c $(SCRIPT)
 

pythonmod/examples/resip.py

@@ -0,0 +1,96 @@
+'''
+ resip.py: This example shows how to generate authoritative response
+           and how to find out the IP address of a client
+
+ Copyright (c) 2009, Zdenek Vasicek (vasicek AT fit.vutbr.cz)
+                     Marek Vavrusa  (xvavru00 AT stud.fit.vutbr.cz)
+
+ This software is open source.
+ 
+ Redistribution and use in source and binary forms, with or without
+ modification, are permitted provided that the following conditions
+ are met:
+ 
+    * Redistributions of source code must retain the above copyright notice,
+      this list of conditions and the following disclaimer.
+ 
+    * Redistributions in binary form must reproduce the above copyright notice,
+      this list of conditions and the following disclaimer in the documentation
+      and/or other materials provided with the distribution.
+ 
+    * Neither the name of the organization nor the names of its
+      contributors may be used to endorse or promote products derived from this
+      software without specific prior written permission.
+
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ POSSIBILITY OF SUCH DAMAGE.
+
+
+ Usage:
+
+   dig @127.0.0.1 -t TXT what.is.my.ip.
+'''
+
+def init(id, cfg): return True
+
+def deinit(id): return True
+
+def inform_super(id, qstate, superqstate, qdata): return True
+
+def operate(id, event, qstate, qdata):
+    print "Operate", event,"state:",qstate
+
+    # Please note that if this module blocks, by moving to the validator
+    # to validate or iterator to lookup or spawn a subquery to look up,
+    # then, other incoming queries are queued up onto this module and
+    # all of them receive the same reply.
+    # You can inspect the cache.
+
+    if (event == MODULE_EVENT_NEW) or (event == MODULE_EVENT_PASS):
+        if (qstate.qinfo.qname_str.endswith("what.is.my.ip.")): #query name ends with localdomain
+            #create instance of DNS message (packet) with given parameters
+            msg = DNSMessage(qstate.qinfo.qname_str, RR_TYPE_TXT, RR_CLASS_IN, PKT_QR | PKT_RA | PKT_AA)
+            #append RR
+            if (qstate.qinfo.qtype == RR_TYPE_TXT) or (qstate.qinfo.qtype == RR_TYPE_ANY):
+               rl = qstate.mesh_info.reply_list
+               while (rl):
+                   if rl.query_reply:
+                      q = rl.query_reply
+		      # The TTL of 0 is mandatory, otherwise it ends up in
+		      # the cache, and is returned to other IP addresses.
+                      msg.answer.append("%s 0 IN TXT \"%s %d (%s)\"" % (qstate.qinfo.qname_str, q.addr,q.port,q.family))
+                   rl = rl.next
+
+            #set qstate.return_msg 
+            if not msg.set_return_msg(qstate):
+                qstate.ext_state[id] = MODULE_ERROR 
+                return True
+
+            #we don't need validation, result is valid
+            qstate.return_msg.rep.security = 2
+
+            qstate.return_rcode = RCODE_NOERROR
+            qstate.ext_state[id] = MODULE_FINISHED 
+            return True
+        else:
+            #pass the query to validator
+            qstate.ext_state[id] = MODULE_WAIT_MODULE 
+            return True
+
+    if event == MODULE_EVENT_MODDONE:
+        log_info("pythonmod: iterator module done")
+        qstate.ext_state[id] = MODULE_FINISHED 
+        return True
+      
+    log_err("pythonmod: bad event")
+    qstate.ext_state[id] = MODULE_ERROR
+    return True

pythonmod/interface.i

@@ -17,6 +17,7 @@
    #include "config.h"
    #include "util/log.h"
    #include "util/module.h"
+   #include "util/netevent.h"
    #include "util/regional.h"
    #include "util/config_file.h"
    #include "util/data/msgreply.h"
@@ -24,6 +25,7 @@
    #include "util/data/dname.h"
    #include "util/storage/lruhash.h"
    #include "services/cache/dns.h"
+   #include "services/mesh.h"
 %}
 
 %include "stdint.i" // uint_16_t can be known type now
@@ -343,6 +345,7 @@ struct reply_info {
    uint16_t flags;
    uint16_t qdcount;
    uint32_t ttl;
+   uint32_t prefetch_ttl;
 
    uint16_t authoritative;
    enum sec_status security;
@@ -408,6 +411,68 @@ struct dns_msg {
    %}
 }
 
+/* ************************************************************************************ * 
+   Structure mesh_state
+ * ************************************************************************************ */
+struct mesh_state {
+   struct mesh_reply* reply_list;
+};
+
+struct mesh_reply {
+   struct mesh_reply* next;
+   struct comm_reply query_reply;
+};
+
+struct comm_reply {
+   
+};
+
+%inline %{
+
+  PyObject* _comm_reply_addr_get(struct comm_reply* reply) {
+     char dest[64];
+     reply_addr2str(reply, dest, 64);
+     if (dest[0] == 0)
+        return Py_None;
+     return PyString_FromString(dest);
+  }
+
+  PyObject* _comm_reply_family_get(struct comm_reply* reply) {
+
+        int af = (int)((struct sockaddr_in*) &(reply->addr))->sin_family;
+
+        switch(af) {
+           case AF_INET: return PyString_FromString("ip4");
+           case AF_INET6: return PyString_FromString("ip6"); 
+           case AF_UNIX: return PyString_FromString("unix");
+        }
+
+        return Py_None;
+  }
+
+  PyObject* _comm_reply_port_get(struct comm_reply* reply) {
+     uint16_t port;
+     port = ntohs(((struct sockaddr_in*)&(reply->addr))->sin_port);
+     return PyInt_FromLong(port);
+  }
+
+%}
+
+%extend comm_reply {
+   %pythoncode %{
+        def _addr_get(self): return _comm_reply_addr_get(self)
+        __swig_getmethods__["addr"] = _addr_get
+        if _newclass:addr = _swig_property(_addr_get)
+
+        def _port_get(self): return _comm_reply_port_get(self)
+        __swig_getmethods__["port"] = _port_get
+        if _newclass:port = _swig_property(_port_get)
+
+        def _family_get(self): return _comm_reply_family_get(self)
+        __swig_getmethods__["family"] = _family_get
+        if _newclass:family = _swig_property(_family_get)
+   %}
+}
 /* ************************************************************************************ * 
    Structure module_qstate
  * ************************************************************************************ */
@@ -715,7 +780,7 @@ int set_return_msg(struct module_qstate* qstate,
 {
      ldns_pkt* pkt = 0;
      ldns_status status;
-     ldns_rr_list* rr_list1 = 0,*rr_list2 = 0,*rr_list3 = 0,*rr_list4 = 0;
+     ldns_rr_list* rr_list = 0;
      ldns_buffer *qb = 0;
      int res = 1;
      
@@ -726,14 +791,18 @@ int set_return_msg(struct module_qstate* qstate,
      if ((status != LDNS_STATUS_OK) || (pkt == 0))
         return 0;
 
-     rr_list1 = createRRList(question, default_ttl);
-     if ((rr_list1) && (res)) res = ldns_pkt_push_rr_list(pkt, LDNS_SECTION_QUESTION, rr_list1);
-     rr_list2 = createRRList(answer, default_ttl);
-     if ((rr_list2) && (res)) res = ldns_pkt_push_rr_list(pkt, LDNS_SECTION_ANSWER, rr_list2);
-     rr_list3 = createRRList(authority, default_ttl);
-     if ((rr_list3) && (res)) res = ldns_pkt_push_rr_list(pkt, LDNS_SECTION_AUTHORITY, rr_list3);
-     rr_list4 = createRRList(additional, default_ttl);
-     if ((rr_list4) && (res)) res = ldns_pkt_push_rr_list(pkt, LDNS_SECTION_ADDITIONAL, rr_list4);
+     rr_list = createRRList(question, default_ttl);
+     if ((rr_list) && (res)) res = ldns_pkt_push_rr_list(pkt, LDNS_SECTION_QUESTION, rr_list);
+     ldns_rr_list_free(rr_list);
+     rr_list = createRRList(answer, default_ttl);
+     if ((rr_list) && (res)) res = ldns_pkt_push_rr_list(pkt, LDNS_SECTION_ANSWER, rr_list);
+     ldns_rr_list_free(rr_list);
+     rr_list = createRRList(authority, default_ttl);
+     if ((rr_list) && (res)) res = ldns_pkt_push_rr_list(pkt, LDNS_SECTION_AUTHORITY, rr_list);
+     ldns_rr_list_free(rr_list);
+     rr_list = createRRList(additional, default_ttl);
+     if ((rr_list) && (res)) res = ldns_pkt_push_rr_list(pkt, LDNS_SECTION_ADDITIONAL, rr_list);
+     ldns_rr_list_free(rr_list);
 
      if ((res) && ((qb = ldns_buffer_new(LDNS_MIN_BUFLEN)) == 0)) res = 0;
      if ((res) && (ldns_pkt2buffer_wire(qb, pkt) != LDNS_STATUS_OK)) res = 0;
@@ -742,7 +811,7 @@ int set_return_msg(struct module_qstate* qstate,
 
      if (qb) ldns_buffer_free(qb);
 
-     ldns_pkt_free(pkt); //this function dealocates pkt as well as rr_lists
+     ldns_pkt_free(pkt); //this function dealocates pkt as well as rrs
      return res;
 }
 %}

pythonmod/pythonmod.c

@@ -44,6 +44,7 @@
 #endif
 
 #include "config.h"
+#include "ldns/ldns.h"
 
 #undef _POSIX_C_SOURCE
 #undef _XOPEN_SOURCE
@@ -56,6 +57,8 @@
 
 #ifdef S_SPLINT_S
 typedef struct PyObject PyObject;
+typedef struct PyThreadState PyThreadState;
+typedef void* PyGILState_STATE;
 #endif
 
 /**
@@ -66,6 +69,8 @@ struct pythonmod_env {
 	/** Python script filename. */
 	const char* fname;
 
+	/** Python main thread */
+	PyThreadState* mainthr;
 	/** Python module. */
 	PyObject* module;
 
@@ -107,6 +112,7 @@ int pythonmod_init(struct module_env* env, int id)
    /* Initialize module */
    FILE* script_py = NULL;
    PyObject* py_cfg, *res;
+   PyGILState_STATE gil;
    struct pythonmod_env* pe = (struct pythonmod_env*)calloc(1, sizeof(struct pythonmod_env));
    if (!pe) 
    {
@@ -130,11 +136,11 @@ int pythonmod_init(struct module_env* env, int id)
       Py_NoSiteFlag = 1;
       Py_Initialize();
       PyEval_InitThreads();
-      PyEval_ReleaseLock();
       SWIG_init();
+      pe->mainthr = PyEval_SaveThread();
    }
 
-   PyEval_AcquireLock();
+   gil = PyGILState_Ensure();
 
    /* Initialize Python */
    PyRun_SimpleString("import sys \n");
@@ -150,7 +156,7 @@ int pythonmod_init(struct module_env* env, int id)
    if (PyRun_SimpleString("from unboundmodule import *\n") < 0)
    {
       log_err("pythonmod: cannot initialize core module: unboundmodule.py"); 
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
 
@@ -158,7 +164,7 @@ int pythonmod_init(struct module_env* env, int id)
    if ((script_py = fopen(pe->fname, "r")) == NULL) 
    {
       log_err("pythonmod: can't open file %s for reading", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
 
@@ -174,7 +180,7 @@ int pythonmod_init(struct module_env* env, int id)
    if (PyRun_SimpleFile(script_py, pe->fname) < 0) 
    {
       log_err("pythonmod: can't parse Python script %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
 
@@ -183,25 +189,25 @@ int pythonmod_init(struct module_env* env, int id)
    if ((pe->func_init = PyDict_GetItemString(pe->dict, "init")) == NULL) 
    {
       log_err("pythonmod: function init is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
    if ((pe->func_deinit = PyDict_GetItemString(pe->dict, "deinit")) == NULL) 
    {
       log_err("pythonmod: function deinit is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
    if ((pe->func_operate = PyDict_GetItemString(pe->dict, "operate")) == NULL) 
    {
       log_err("pythonmod: function operate is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
    if ((pe->func_inform = PyDict_GetItemString(pe->dict, "inform_super")) == NULL) 
    {
       log_err("pythonmod: function inform_super is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
 
@@ -215,7 +221,7 @@ int pythonmod_init(struct module_env* env, int id)
 
    Py_XDECREF(res);
    Py_XDECREF(py_cfg);
-   PyEval_ReleaseLock();
+   PyGILState_Release(gil);
 
    return 1;
 }
@@ -230,9 +236,9 @@ void pythonmod_deinit(struct module_env* env, int id)
    if(pe->module != NULL)
    {
       PyObject* res;
+      PyGILState_STATE gil = PyGILState_Ensure();
 
       /* Deinit module */
-      PyEval_AcquireLock();
       res = PyObject_CallFunction(pe->func_deinit, "i", id);
       if (PyErr_Occurred()) {
          log_err("pythonmod: Exception occurred in function deinit");
@@ -242,9 +248,14 @@ void pythonmod_deinit(struct module_env* env, int id)
       Py_XDECREF(res);
       /* Free shared data if any */
       Py_XDECREF(pe->data);
+      PyGILState_Release(gil);
 
+      PyEval_RestoreThread(pe->mainthr);
       Py_Finalize();
+      pe->mainthr = NULL;
    }
+   pe->fname = NULL;
+   free(pe);
 
    /* Module is deallocated in Python */
    env->modinfo[id] = NULL;
@@ -255,6 +266,7 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
    struct pythonmod_env* pe = (struct pythonmod_env*)qstate->env->modinfo[id];
    struct pythonmod_qstate* pq = (struct pythonmod_qstate*)qstate->minfo[id];
    PyObject* py_qstate, *py_sqstate, *res;
+   PyGILState_STATE gil = PyGILState_Ensure();
 
    log_query_info(VERB_ALGO, "pythonmod: inform_super, sub is", &qstate->qinfo);
    log_query_info(VERB_ALGO, "super is", &super->qinfo);
@@ -262,7 +274,6 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
    py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
    py_sqstate = SWIG_NewPointerObj((void*) super, SWIGTYPE_p_module_qstate, 0);
 
-   PyEval_AcquireLock();
    res = PyObject_CallFunction(pe->func_inform, "iOOO", id, py_qstate, 
 	py_sqstate, pq->data);
 
@@ -282,7 +293,7 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
    Py_XDECREF(py_sqstate);
    Py_XDECREF(py_qstate);
 
-   PyEval_ReleaseLock();
+   PyGILState_Release(gil);
 }
 
 void pythonmod_operate(struct module_qstate* qstate, enum module_ev event, 
@@ -291,6 +302,7 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
    struct pythonmod_env* pe = (struct pythonmod_env*)qstate->env->modinfo[id];
    struct pythonmod_qstate* pq = (struct pythonmod_qstate*)qstate->minfo[id];
    PyObject* py_qstate, *res;
+   PyGILState_STATE gil = PyGILState_Ensure();
 
    if ( pq == NULL)
    { 
@@ -302,9 +314,6 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
       Py_INCREF(pq->data);
    }
 
-   /* Lock Python */
-   PyEval_AcquireLock();
-
    /* Call operate */
    py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
    res = PyObject_CallFunction(pe->func_operate, "iiOO", id, (int) event, 
@@ -323,8 +332,7 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
    Py_XDECREF(res);
    Py_XDECREF(py_qstate);
 
-   /* Unlock Python */
-   PyEval_ReleaseLock();
+   PyGILState_Release(gil);
 }
 
 void pythonmod_clear(struct module_qstate* qstate, int id)
@@ -338,7 +346,9 @@ void pythonmod_clear(struct module_qstate* qstate, int id)
    	(unsigned long int)pq);
    if(pq != NULL)
    {
+      PyGILState_STATE gil = PyGILState_Ensure();
       Py_DECREF(pq->data);
+      PyGILState_Release(gil);
       /* Free qstate */
       free(pq);
    }

pythonmod/pythonmod_utils.c

@@ -40,6 +40,7 @@
  */
 #include "config.h"
 #include "util/module.h"
+#include "util/netevent.h"
 #include "util/net_help.h"
 #include "services/cache/dns.h"
 #include "services/cache/rrset.h"
@@ -52,22 +53,23 @@
 #undef _XOPEN_SOURCE
 #include <Python.h>
 
-/** Store the reply_info and query_info pair in message cache (qstate->msg_cache) */
+/* Store the reply_info and query_info pair in message cache (qstate->msg_cache) */
 int storeQueryInCache(struct module_qstate* qstate, struct query_info* qinfo, struct reply_info* msgrep, int is_referral)
 {
     if (!msgrep) 
        return 0;
 
-    if (msgrep->authoritative)  //authoritative answer can't be stored in cache
+    if (msgrep->authoritative) /*authoritative answer can't be stored in cache*/
     {
        PyErr_SetString(PyExc_ValueError, "Authoritative answer can't be stored");
        return 0;
     }
 
-    return dns_cache_store(qstate->env, qinfo, msgrep, is_referral);
+    return dns_cache_store(qstate->env, qinfo, msgrep, is_referral, 
+	qstate->prefetch_leeway);
 }
 
-/**  Invalidate the message associated with query_info stored in message cache */
+/*  Invalidate the message associated with query_info stored in message cache */
 void invalidateQueryInCache(struct module_qstate* qstate, struct query_info* qinfo)
 { 
     hashvalue_t h;
@@ -78,10 +80,10 @@ void invalidateQueryInCache(struct module_qstate* qstate, struct query_info* qin
     h = query_info_hash(qinfo);
     if ((e=slabhash_lookup(qstate->env->msg_cache, h, qinfo, 0))) 
     {
-        r = (struct reply_info*)(e->data);
-        if (r) 
-        {
-           r->ttl = 0;
+	r = (struct reply_info*)(e->data);
+	if (r) 
+	{
+	   r->ttl = 0;
 	   if(rrset_array_lock(r->ref, r->rrset_count, *qstate->env->now)) {
 		   for(i=0; i< r->rrset_count; i++) 
 		   {
@@ -96,14 +98,14 @@ void invalidateQueryInCache(struct module_qstate* qstate, struct query_info* qin
 		   }
 		   rrset_array_unlock(r->ref, r->rrset_count);
 	   }
-        }
-        lock_rw_unlock(&e->lock);
+	}
+	lock_rw_unlock(&e->lock);
     } else {
-        log_info("invalidateQueryInCache: qinfo is not in cache");
+	log_info("invalidateQueryInCache: qinfo is not in cache");
     }
 }
 
-/** Create response according to the ldns packet content */
+/* Create response according to the ldns packet content */
 int createResponse(struct module_qstate* qstate, ldns_buffer* pkt)
 {
     struct msg_parse* prs;
@@ -112,8 +114,8 @@ int createResponse(struct module_qstate* qstate, ldns_buffer* pkt)
     /* parse message */
     prs = (struct msg_parse*) regional_alloc(qstate->env->scratch, sizeof(struct msg_parse));
     if (!prs) {
-        log_err("storeResponse: out of memory on incoming message");
-        return 0;
+	log_err("storeResponse: out of memory on incoming message");
+	return 0;
     }
 
     memset(prs, 0, sizeof(*prs));
@@ -121,12 +123,12 @@ int createResponse(struct module_qstate* qstate, ldns_buffer* pkt)
 
     ldns_buffer_set_position(pkt, 0);
     if (parse_packet(pkt, prs, qstate->env->scratch) != LDNS_RCODE_NOERROR) {
-        verbose(VERB_ALGO, "storeResponse: parse error on reply packet");
-        return 0;
+	verbose(VERB_ALGO, "storeResponse: parse error on reply packet");
+	return 0;
     }
     /* edns is not examined, but removed from message to help cache */
     if(parse_extract_edns(prs, &edns) != LDNS_RCODE_NOERROR)
-        return 0;
+	return 0;
 
     /* remove CD-bit, we asked for in case we handle validation ourself */
     prs->flags &= ~BIT_CD;
@@ -138,23 +140,38 @@ int createResponse(struct module_qstate* qstate, ldns_buffer* pkt)
 
     memset(qstate->return_msg, 0, sizeof(*qstate->return_msg));
     if(!parse_create_msg(pkt, prs, NULL, &(qstate->return_msg)->qinfo, &(qstate->return_msg)->rep, qstate->region)) {
-        log_err("storeResponse: malloc failure: allocating incoming dns_msg");
-        return 0;
+	log_err("storeResponse: malloc failure: allocating incoming dns_msg");
+	return 0;
     }
     
     /* Make sure that the RA flag is set (since the presence of 
      * this module means that recursion is available) */
-    //qstate->return_msg->rep->flags |= BIT_RA;
+    /* qstate->return_msg->rep->flags |= BIT_RA; */
 
     /* Clear the AA flag */
     /* FIXME: does this action go here or in some other module? */
-    //qstate->return_msg->rep->flags &= ~BIT_AA;
+    /*qstate->return_msg->rep->flags &= ~BIT_AA; */
 
     /* make sure QR flag is on */
-    //qstate->return_msg->rep->flags |= BIT_QR;
+    /*qstate->return_msg->rep->flags |= BIT_QR; */
 
     if(verbosity >= VERB_ALGO)
-        log_dns_msg("storeResponse: packet:", &qstate->return_msg->qinfo, qstate->return_msg->rep);
+	log_dns_msg("storeResponse: packet:", &qstate->return_msg->qinfo, qstate->return_msg->rep);
 
     return 1;
 }
+
+
+/* Convert reply->addr to string */
+void reply_addr2str(struct comm_reply* reply, char* dest, int maxlen)
+{
+	int af = (int)((struct sockaddr_in*) &(reply->addr))->sin_family;
+	void* sinaddr = &((struct sockaddr_in*) &(reply->addr))->sin_addr;
+
+	if(af == AF_INET6)
+		sinaddr = &((struct sockaddr_in6*)&(reply->addr))->sin6_addr;
+	dest[0] = 0;
+	if (inet_ntop(af, sinaddr, dest, (socklen_t)maxlen) == 0)
+	   return;
+	dest[maxlen-1] = 0;
+}

pythonmod/pythonmod_utils.h

@@ -77,4 +77,12 @@ void invalidateQueryInCache(struct module_qstate* qstate, struct query_info* qin
  */
 int createResponse(struct module_qstate* qstate, ldns_buffer* pkt);
 
+/**
+ *  Convert reply->addr to string
+ *  @param reply: comm reply with address in it.
+ *  @param dest: destination string.
+ *  @param maxlen: length of string buffer.
+ */
+void reply_addr2str(struct comm_reply* reply, char* dest, int maxlen);
+
 #endif /* PYTHONMOD_UTILS_H */

pythonmod/test-resip.conf

@@ -0,0 +1,18 @@
+# Example configuration file for resip.py
+server:
+	verbosity: 1
+	#interface: 0.0.0.0
+	do-daemonize: no
+	#access-control: 0.0.0.0/0 allow
+	chroot: ""
+	username: ""
+	directory: ""
+	logfile: ""
+	pidfile: "unbound.pid"
+	module-config: "validator python iterator"
+
+# Python config section
+python:
+	# Script file to load
+	python-script: "./examples/resip.py"
+

services/cache/dns.c

@@ -71,7 +71,7 @@ store_rrsets(struct module_env* env, struct reply_info* rep, uint32_t now)
 
 void 
 dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
-	hashvalue_t hash, struct reply_info* rep)
+	hashvalue_t hash, struct reply_info* rep, uint32_t leeway)
 {
 	struct msgreply_entry* e;
 	uint32_t ttl = rep->ttl;
@@ -84,7 +84,7 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 	}
 	reply_info_sortref(rep);
 	reply_info_set_ttls(rep, *env->now);
-	store_rrsets(env, rep, *env->now);
+	store_rrsets(env, rep, *env->now+leeway);
 	if(ttl == 0) {
 		/* we do not store the message, but we did store the RRs,
 		 * which could be useful for delegation information */
@@ -180,7 +180,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, 0)) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 0, 0)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -198,7 +198,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0)) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, 0)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -213,6 +213,27 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 				lock_rw_unlock(&neg->entry.lock);
 			}
 		}
+		/* see if we have parent-side-glue (dispreferred) */
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+			ns->namelen, LDNS_RR_TYPE_A, qclass, 
+			PACKED_RRSET_PARENT_SIDE, now, 0);
+		if(akey) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1)) {
+				lock_rw_unlock(&akey->entry.lock);
+				return 0;
+			}
+			lock_rw_unlock(&akey->entry.lock);
+		}
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 
+			PACKED_RRSET_PARENT_SIDE, now, 0);
+		if(akey) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1)) {
+				lock_rw_unlock(&akey->entry.lock);
+				return 0;
+			}
+			lock_rw_unlock(&akey->entry.lock);
+		}
 	}
 	return 1;
 }
@@ -227,12 +248,10 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 	struct ub_packed_rrset_key* akey;
 	uint32_t now = *env->now;
 	for(ns = dp->nslist; ns; ns = ns->next) {
-		if(ns->resolved)
-			continue;
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, 1)) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 0, 1)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -250,7 +269,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1)) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, 1)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -265,6 +284,27 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 				lock_rw_unlock(&neg->entry.lock);
 			}
 		}
+		/* see if we have parent-side-glue (dispreferred) */
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+			ns->namelen, LDNS_RR_TYPE_A, qclass, 
+			PACKED_RRSET_PARENT_SIDE, now, 0);
+		if(akey) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1)) {
+				lock_rw_unlock(&akey->entry.lock);
+				return 0;
+			}
+			lock_rw_unlock(&akey->entry.lock);
+		}
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 
+			PACKED_RRSET_PARENT_SIDE, now, 0);
+		if(akey) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1)) {
+				lock_rw_unlock(&akey->entry.lock);
+				return 0;
+			}
+			lock_rw_unlock(&akey->entry.lock);
+		}
 	}
 	return 1;
 }
@@ -432,6 +472,9 @@ tomsg(struct module_env* env, struct msgreply_entry* e, struct reply_info* r,
 	msg->rep->flags = r->flags;
 	msg->rep->qdcount = r->qdcount;
 	msg->rep->ttl = r->ttl - now;
+	if(r->prefetch_ttl - now > 0)
+		msg->rep->prefetch_ttl = r->prefetch_ttl - now;
+	else	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(r->prefetch_ttl);
 	msg->rep->security = r->security;
 	msg->rep->an_numrrsets = r->an_numrrsets;
 	msg->rep->ns_numrrsets = r->ns_numrrsets;
@@ -482,6 +525,7 @@ rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 	msg->rep->qdcount = 1;
 	msg->rep->ttl = d->ttl - now;
+	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->security = sec_status_unchecked;
 	msg->rep->an_numrrsets = 1;
 	msg->rep->ns_numrrsets = 0;
@@ -517,6 +561,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 	msg->rep->qdcount = 1;
 	msg->rep->ttl = d->ttl - now;
+	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->security = sec_status_unchecked;
 	msg->rep->an_numrrsets = 1;
 	msg->rep->ns_numrrsets = 0;
@@ -574,6 +619,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	packed_rrset_ptr_fixup(newd);
 	newd->rr_ttl[0] = newd->ttl;
 	msg->rep->ttl = newd->ttl;
+	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl);
 	ldns_write_uint16(newd->rr_data[0], newlen);
 	memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen);
 	msg->rep->an_numrrsets ++;
@@ -652,7 +698,10 @@ dns_cache_lookup(struct module_env* env,
 		struct packed_rrset_data *d = (struct packed_rrset_data*)
 			rrset->entry.data;
 		if(d->trust != rrset_trust_add_noAA && 
-			d->trust != rrset_trust_add_AA) {
+			d->trust != rrset_trust_add_AA && 
+			(qtype == LDNS_RR_TYPE_DS || 
+				(d->trust != rrset_trust_auth_noAA 
+				&& d->trust != rrset_trust_auth_AA) )) {
 			struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 			if(msg) {
 				lock_rw_unlock(&rrset->entry.lock);
@@ -666,13 +715,16 @@ dns_cache_lookup(struct module_env* env,
 
 int 
 dns_cache_store(struct module_env* env, struct query_info* msgqinf,
-        struct reply_info* msgrep, int is_referral)
+        struct reply_info* msgrep, int is_referral, uint32_t leeway)
 {
 	struct reply_info* rep = NULL;
 	/* alloc, malloc properly (not in region, like msg is) */
 	rep = reply_info_copy(msgrep, env->alloc, NULL);
 	if(!rep)
 		return 0;
+	/* ttl must be relative ;i.e. 0..86400 not  time(0)+86400. 
+	 * the env->now is added to message and RRsets in this routine. */
+	/* the leeway is used to invalidate other rrsets earlier */
 
 	if(is_referral) {
 		/* store rrsets */
@@ -685,7 +737,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 			ref.id = rep->rrsets[i]->id;
 			/*ignore ret: it was in the cache, ref updated */
 			(void)rrset_cache_update(env->rrset_cache, &ref, 
-				env->alloc, *env->now);
+				env->alloc, *env->now + leeway);
 		}
 		free(rep);
 		return 1;
@@ -706,7 +758,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 		rep->flags |= (BIT_RA | BIT_QR);
 		rep->flags &= ~(BIT_AA | BIT_CD);
 		h = query_info_hash(&qinf);
-		dns_cache_store_msg(env, &qinf, h, rep);
+		dns_cache_store_msg(env, &qinf, h, rep, leeway);
 		/* qname is used inside query_info_entrysetup, and set to 
 		 * NULL. If it has not been used, free it. free(0) is safe. */
 		free(qinf.qname);

services/cache/dns.h

@@ -72,10 +72,12 @@ struct dns_msg {
  * @param is_referral: If true, then the given message to be stored is a
  *      referral. The cache implementation may use this as a hint.
  *      It will store only the RRsets, not the message.
+ * @param leeway: TTL value, if not 0, other rrsets are considered expired
+ *	that many seconds before actual TTL expiry.
  * @return 0 on alloc error (out of memory).
  */
 int dns_cache_store(struct module_env* env, struct query_info* qinf,
-        struct reply_info* rep, int is_referral); 
+        struct reply_info* rep, int is_referral, uint32_t leeway); 
 
 /**
  * Store message in the cache. Stores in message cache and rrset cache.
@@ -88,9 +90,11 @@ int dns_cache_store(struct module_env* env, struct query_info* qinf,
  * @param hash: hash over qinfo.
  * @param rep: reply info, together with qinfo makes up the message.
  *	Adjusts the reply info TTLs to absolute time.
+ * @param leeway: TTL value, if not 0, other rrsets are considered expired
+ *	that many seconds before actual TTL expiry.
  */
 void dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
-	hashvalue_t hash, struct reply_info* rep);
+	hashvalue_t hash, struct reply_info* rep, uint32_t leeway);
 
 /**
  * Find a delegation from the cache.

services/cache/infra.c

@@ -39,6 +39,7 @@
  * This file contains the infrastructure cache.
  */
 #include "config.h"
+#include "ldns/rr.h"
 #include "services/cache/infra.h"
 #include "util/storage/slabhash.h"
 #include "util/storage/lookup3.h"
@@ -219,6 +220,7 @@ new_host_entry(struct infra_cache* infra, struct sockaddr_storage* addr,
 	data->lameness = NULL;
 	data->edns_version = 0;
 	data->edns_lame_known = 0;
+	data->num_timeouts = 0;
 	rtt_init(&data->rtt);
 	return &key->entry;
 }
@@ -471,9 +473,14 @@ infra_rtt_update(struct infra_cache* infra,
 	/* have an entry, update the rtt, and the ttl */
 	data = (struct infra_host_data*)e->data;
 	data->ttl = timenow + infra->host_ttl;
-	if(roundtrip == -1)
+	if(roundtrip == -1) {
 		rtt_lost(&data->rtt, orig_rtt);
-	else	rtt_update(&data->rtt, roundtrip);
+		if(data->num_timeouts<255)
+			data->num_timeouts++; 
+	} else {
+		rtt_update(&data->rtt, roundtrip);
+		data->num_timeouts = 0;
+	}
 	if(data->rtt.rto > 0)
 		rto = data->rtt.rto;
 
@@ -513,7 +520,8 @@ int
 infra_get_lame_rtt(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen,
         uint8_t* name, size_t namelen, uint16_t qtype, 
-	int* lame, int* dnsseclame, int* reclame, int* rtt, uint32_t timenow)
+	int* lame, int* dnsseclame, int* reclame, int* rtt, int* lost,
+	uint32_t timenow)
 {
 	struct infra_host_data* host;
 	struct lruhash_entry* e = infra_lookup_host_nottl(infra, addr, 
@@ -523,6 +531,7 @@ infra_get_lame_rtt(struct infra_cache* infra,
 		return 0;
 	host = (struct infra_host_data*)e->data;
 	*rtt = rtt_unclamped(&host->rtt);
+	*lost = (int)host->num_timeouts;
 	/* check lameness first, if so, ttl on host does not matter anymore */
 	if(infra_lookup_lame(host, name, namelen, timenow, 
 		&dlm, &rlm, &alm, &olm)) {

services/cache/infra.h

@@ -74,6 +74,8 @@ struct infra_host_data {
 	 * EDNS lame is when EDNS queries or replies are dropped, 
 	 * and cause a timeout */
 	uint8_t edns_lame_known;
+	/** Number of consequtive timeouts; reset when reply arrives OK. */
+	uint8_t num_timeouts;
 };
 
 /**
@@ -270,13 +272,16 @@ int infra_edns_update(struct infra_cache* infra,
  * @param reclame: if function returns true, this is if it is recursion lame.
  * @param rtt: if function returns true, this returns avg rtt of the server.
  * 	The rtt value is unclamped and reflects recent timeouts.
+ * @param lost: number of queries lost in a row.  Reset to 0 when an answer
+ * 	gets back.  Gives a connectivity number.
  * @param timenow: what time it is now.
  * @return if found in cache, or false if not (or TTL bad).
  */
 int infra_get_lame_rtt(struct infra_cache* infra,
         struct sockaddr_storage* addr, socklen_t addrlen, 
 	uint8_t* name, size_t namelen, uint16_t qtype, 
-	int* lame, int* dnsseclame, int* reclame, int* rtt, uint32_t timenow);
+	int* lame, int* dnsseclame, int* reclame, int* rtt, int* lost,
+	uint32_t timenow);
 
 /**
  * Get memory used by the infra cache.

services/listen_dnsport.c

@@ -39,6 +39,10 @@
  * This file has functions to get queries from clients.
  */
 #include "config.h"
+#ifdef HAVE_SYS_TYPES_H
+#  include <sys/types.h>
+#endif
+#include <sys/time.h>
 #include "services/listen_dnsport.h"
 #include "services/outside_network.h"
 #include "util/netevent.h"
@@ -46,9 +50,6 @@
 #include "util/config_file.h"
 #include "util/net_help.h"
 
-#ifdef HAVE_SYS_TYPES_H
-#  include <sys/types.h>
-#endif
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -89,7 +90,7 @@ verbose_print_addr(struct addrinfo *addr)
 
 int
 create_udp_sock(int family, int socktype, struct sockaddr* addr,
-        socklen_t addrlen, int v6only, int* inuse, int* noproto)
+        socklen_t addrlen, int v6only, int* inuse, int* noproto, int rcv)
 {
 	int s;
 #if defined(IPV6_USE_MIN_MTU)
@@ -98,6 +99,9 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 #ifdef IPV6_MTU
 	int mtu = IPV6_MIN_MTU;
 #endif
+#if !defined(SO_RCVBUFFORCE) && !defined(SO_RCVBUF)
+	(void)rcv;
+#endif
 #ifndef IPV6_V6ONLY
 	(void)v6only;
 #endif
@@ -121,6 +125,64 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 		*noproto = 0;
 		return -1;
 	}
+	if(rcv) {
+#ifdef SO_RCVBUF
+		int got;
+		socklen_t slen = (socklen_t)sizeof(got);
+#  ifdef SO_RCVBUFFORCE
+		/* Linux specific: try to use root permission to override
+		 * system limits on rcvbuf. The limit is stored in 
+		 * /proc/sys/net/core/rmem_max or sysctl net.core.rmem_max */
+		if(setsockopt(s, SOL_SOCKET, SO_RCVBUFFORCE, (void*)&rcv, 
+			(socklen_t)sizeof(rcv)) < 0) {
+			if(errno != EPERM) {
+#    ifndef USE_WINSOCK
+				log_err("setsockopt(..., SO_RCVBUFFORCE, "
+					"...) failed: %s", strerror(errno));
+				close(s);
+#    else
+				log_err("setsockopt(..., SO_RCVBUFFORCE, "
+					"...) failed: %s", 
+					wsa_strerror(WSAGetLastError()));
+				closesocket(s);
+#    endif
+				*noproto = 0;
+				*inuse = 0;
+				return -1;
+			}
+#  endif /* SO_RCVBUFFORCE */
+			if(setsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&rcv, 
+				(socklen_t)sizeof(rcv)) < 0) {
+#  ifndef USE_WINSOCK
+				log_err("setsockopt(..., SO_RCVBUF, "
+					"...) failed: %s", strerror(errno));
+				close(s);
+#  else
+				log_err("setsockopt(..., SO_RCVBUF, "
+					"...) failed: %s", 
+					wsa_strerror(WSAGetLastError()));
+				closesocket(s);
+#  endif
+				*noproto = 0;
+				*inuse = 0;
+				return -1;
+			}
+			/* check if we got the right thing or if system
+			 * reduced to some system max.  Warn if so */
+			if(getsockopt(s, SOL_SOCKET, SO_RCVBUF, (void*)&got, 
+				&slen) >= 0 && got < rcv/2) {
+				log_warn("so-rcvbuf %u was not granted. "
+					"Got %u. To fix: start with "
+					"root permissions(linux) or sysctl "
+					"bigger net.core.rmem_max(linux) or "
+					"kern.ipc.maxsockbuf(bsd) values.",
+					(unsigned)rcv, (unsigned)got);
+			}
+#  ifdef SO_RCVBUFFORCE
+		}
+#  endif
+#endif /* SO_RCVBUF */
+	}
 	if(family == AF_INET6) {
 # if defined(IPV6_V6ONLY)
 		if(v6only) {
@@ -190,6 +252,25 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			return -1;
 		}
 # endif /* IPv6 MTU */
+	} else if(family == AF_INET) {
+#  if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
+		int action = IP_PMTUDISC_DONT;
+		if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER, 
+			&action, (socklen_t)sizeof(action)) < 0) {
+			log_err("setsockopt(..., IP_MTU_DISCOVER, "
+				"IP_PMTUDISC_DONT...) failed: %s",
+				strerror(errno));
+			return -1;
+		}
+#  elif defined(IP_DONTFRAG)
+		int off = 0;
+		if (setsockopt(s, IPPROTO_IP, IP_DONTFRAG, 
+			&off, (socklen_t)sizeof(off)) < 0) {
+			log_err("setsockopt(..., IP_DONTFRAG, ...) failed: %s",
+				strerror(errno));
+			return -1;
+		}
+#  endif /* IPv4 MTU */
 	}
 	if(bind(s, (struct sockaddr*)addr, addrlen) != 0) {
 		*noproto = 0;
@@ -313,7 +394,7 @@ create_tcp_accept_sock(struct addrinfo *addr, int v6only, int* noproto)
  */
 static int
 make_sock(int stype, const char* ifname, const char* port, 
-	struct addrinfo *hints, int v6only, int* noip6)
+	struct addrinfo *hints, int v6only, int* noip6, size_t rcv)
 {
 	struct addrinfo *res = NULL;
 	int r, s, inuse, noproto;
@@ -339,8 +420,8 @@ make_sock(int stype, const char* ifname, const char* port,
 	if(stype == SOCK_DGRAM) {
 		verbose_print_addr(res);
 		s = create_udp_sock(res->ai_family, res->ai_socktype,
-			(struct sockaddr*)res->ai_addr, 
-			res->ai_addrlen, v6only, &inuse, &noproto);
+			(struct sockaddr*)res->ai_addr,
+			res->ai_addrlen, v6only, &inuse, &noproto, (int)rcv);
 		if(s == -1 && inuse) {
 			log_err("bind: address already in use");
 		} else if(s == -1 && noproto && hints->ai_family == AF_INET6){
@@ -356,6 +437,35 @@ make_sock(int stype, const char* ifname, const char* port,
 	return s;
 }
 
+/** make socket and first see if ifname contains port override info */
+static int
+make_sock_port(int stype, const char* ifname, const char* port, 
+	struct addrinfo *hints, int v6only, int* noip6, size_t rcv)
+{
+	char* s = strchr(ifname, '@');
+	if(s) {
+		/* override port with ifspec@port */
+		char p[16];
+		char newif[128];
+		if((size_t)(s-ifname) >= sizeof(newif)) {
+			log_err("ifname too long: %s", ifname);
+			*noip6 = 0;
+			return -1;
+		}
+		if(strlen(s+1) >= sizeof(p)) {
+			log_err("portnumber too long: %s", ifname);
+			*noip6 = 0;
+			return -1;
+		}
+		strncpy(newif, ifname, sizeof(newif));
+		newif[s-ifname] = 0;
+		strncpy(p, s+1, sizeof(p));
+		p[strlen(s+1)]=0;
+		return make_sock(stype, newif, p, hints, v6only, noip6, rcv);
+	}
+	return make_sock(stype, ifname, port, hints, v6only, noip6, rcv);
+}
+
 /**
  * Add port to open ports list.
  * @param list: list head. changed.
@@ -381,7 +491,7 @@ port_insert(struct listen_port** list, int s, enum listen_type ftype)
 static int
 set_recvpktinfo(int s, int family) 
 {
-#if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || defined(IP_RECVDSTADDR) || defined(IP_PKTINFO)
+#if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || (defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)) || defined(IP_PKTINFO)
 	int on = 1;
 #else
 	(void)s;
@@ -408,22 +518,22 @@ set_recvpktinfo(int s, int family)
 #           endif /* defined IPV6_RECVPKTINFO */
 
 	} else if(family == AF_INET) {
-#           ifdef IP_RECVDSTADDR
-		if(setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR,
-			(void*)&on, (socklen_t)sizeof(on)) < 0) {
-			log_err("setsockopt(..., IP_RECVDSTADDR, ...) failed: %s",
-				strerror(errno));
-			return 0;
-		}
-#           elif defined(IP_PKTINFO)
+#           ifdef IP_PKTINFO
 		if(setsockopt(s, IPPROTO_IP, IP_PKTINFO,
 			(void*)&on, (socklen_t)sizeof(on)) < 0) {
 			log_err("setsockopt(..., IP_PKTINFO, ...) failed: %s",
 				strerror(errno));
 			return 0;
 		}
+#           elif defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)
+		if(setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR,
+			(void*)&on, (socklen_t)sizeof(on)) < 0) {
+			log_err("setsockopt(..., IP_RECVDSTADDR, ...) failed: %s",
+				strerror(errno));
+			return 0;
+		}
 #           else
-		log_err("no IP_RECVDSTADDR or IP_PKTINFO option, please disable "
+		log_err("no IP_SENDSRCADDR or IP_PKTINFO option, please disable "
 			"interface-automatic in config");
 		return 0;
 #           endif /* IP_PKTINFO */
@@ -442,18 +552,20 @@ set_recvpktinfo(int s, int family)
  * @param hints: for getaddrinfo. family and flags have to be set by caller.
  * @param port: Port number to use (as string).
  * @param list: list of open ports, appended to, changed to point to list head.
+ * @param rcv: receive buffer size for UDP
  * @return: returns false on error.
  */
 static int
 ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp, 
-	struct addrinfo *hints, const char* port, struct listen_port** list)
+	struct addrinfo *hints, const char* port, struct listen_port** list,
+	size_t rcv)
 {
 	int s, noip6=0;
 	if(!do_udp && !do_tcp)
 		return 0;
 	if(do_auto) {
-		if((s = make_sock(SOCK_DGRAM, ifname, port, hints, 1, 
-			&noip6)) == -1) {
+		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
+			&noip6, rcv)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
 				return 1;
@@ -473,8 +585,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 		}
 	} else if(do_udp) {
 		/* regular udp socket */
-		if((s = make_sock(SOCK_DGRAM, ifname, port, hints, 1, 
-			&noip6)) == -1) {
+		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
+			&noip6, rcv)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
 				return 1;
@@ -491,8 +603,8 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 		}
 	}
 	if(do_tcp) {
-		if((s = make_sock(SOCK_STREAM, ifname, port, hints, 1, 
-			&noip6)) == -1) {
+		if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1, 
+			&noip6, 0)) == -1) {
 			if(noip6) {
 				/*log_warn("IPv6 protocol not available");*/
 				return 1;
@@ -668,7 +780,7 @@ listening_ports_open(struct config_file* cfg)
 			hints.ai_family = AF_INET6;
 			if(!ports_create_if(do_auto?"::0":"::1", 
 				do_auto, cfg->do_udp, do_tcp, 
-				&hints, portbuf, &list)) {
+				&hints, portbuf, &list, cfg->socket_rcvbuf)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -677,7 +789,7 @@ listening_ports_open(struct config_file* cfg)
 			hints.ai_family = AF_INET;
 			if(!ports_create_if(do_auto?"0.0.0.0":"127.0.0.1", 
 				do_auto, cfg->do_udp, do_tcp, 
-				&hints, portbuf, &list)) {
+				&hints, portbuf, &list, cfg->socket_rcvbuf)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -688,7 +800,8 @@ listening_ports_open(struct config_file* cfg)
 				continue;
 			hints.ai_family = AF_INET6;
 			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
-				do_tcp, &hints, portbuf, &list)) {
+				do_tcp, &hints, portbuf, &list, 
+				cfg->socket_rcvbuf)) {
 				listening_ports_free(list);
 				return NULL;
 			}
@@ -697,7 +810,8 @@ listening_ports_open(struct config_file* cfg)
 				continue;
 			hints.ai_family = AF_INET;
 			if(!ports_create_if(cfg->ifs[i], 0, cfg->do_udp, 
-				do_tcp, &hints, portbuf, &list)) {
+				do_tcp, &hints, portbuf, &list, 
+				cfg->socket_rcvbuf)) {
 				listening_ports_free(list);
 				return NULL;
 			}

services/listen_dnsport.h

@@ -180,10 +180,11 @@ size_t listen_get_mem(struct listen_dnsport* listen);
  * @param inuse: on error, this is set true if the port was in use.
  * @param noproto: on error, this is set true if cause is that the
 	IPv6 proto (family) is not available.
+ * @param rcv: set size on rcvbuf with socket option, if 0 it is not set.
  * @return: the socket. -1 on error.
  */
 int create_udp_sock(int family, int socktype, struct sockaddr* addr, 
-	socklen_t addrlen, int v6only, int* inuse, int* noproto);
+	socklen_t addrlen, int v6only, int* inuse, int* noproto, int rcv);
 
 /**
  * Create and bind TCP listening socket

services/localzone.c

@@ -39,6 +39,8 @@
  * This file contains functions to enable local zone authority service.
  */
 #include "config.h"
+#include "ldns/dname.h"
+#include "ldns/host2wire.h"
 #include "services/localzone.h"
 #include "util/regional.h"
 #include "util/config_file.h"
@@ -1141,6 +1143,19 @@ local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
 	return r;
 }
 
+const char* local_zone_type2str(enum localzone_type t)
+{
+	switch(t) {
+		case local_zone_deny: return "deny";
+		case local_zone_refuse: return "refuse";
+		case local_zone_redirect: return "redirect";
+		case local_zone_transparent: return "transparent";
+		case local_zone_static: return "static";
+		case local_zone_nodefault: return "nodefault";
+	}
+	return "badtyped"; 
+}
+
 int local_zone_str2type(const char* type, enum localzone_type* t)
 {
 	if(strcmp(type, "deny") == 0)
@@ -1309,14 +1324,16 @@ void local_zones_del_data(struct local_zones* zones,
 
 	/* find the domain */
 	d = lz_find_node(z, name, len, labs);
-	/* no memory recycling for zone deletions ... */
-	d->rrsets = NULL;
-	/* did we delete the soa record ? */
-	if(query_dname_compare(d->name, z->name) == 0)
-		z->soa = NULL;
+	if(d) {
+		/* no memory recycling for zone deletions ... */
+		d->rrsets = NULL;
+		/* did we delete the soa record ? */
+		if(query_dname_compare(d->name, z->name) == 0)
+			z->soa = NULL;
 
-	/* cleanup the empty nonterminals for this name */
-	del_empty_term(z, d, name, len, labs);
+		/* cleanup the empty nonterminals for this name */
+		del_empty_term(z, d, name, len, labs);
+	}
 
 	lock_rw_unlock(&z->lock);
 }

services/localzone.h

@@ -233,6 +233,14 @@ int local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
  */
 int local_zone_str2type(const char* str, enum localzone_type* t);
 
+/**
+ * Print localzone type to a string.  Pointer to a constant string.
+ *
+ * @param t: local zone type.
+ * @return constant string that describes type.
+ */
+const char* local_zone_type2str(enum localzone_type t);
+
 /**
  * Find zone that with exactly given name, class.
  * User must lock the tree or result zone.

services/mesh.c

@@ -43,6 +43,7 @@
  * send back to clients.
  */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "services/mesh.h"
 #include "services/outbound_list.h"
 #include "services/cache/dns.h"
@@ -61,9 +62,9 @@ static void
 timeval_subtract(struct timeval* d, const struct timeval* end, const struct timeval* start)
 {
 #ifndef S_SPLINT_S
-	time_t end_usec = end->tv_usec;;
+	time_t end_usec = end->tv_usec;
 	d->tv_sec = end->tv_sec - start->tv_sec;
-	while(end_usec < start->tv_usec) {
+	if(end_usec < start->tv_usec) {
 		end_usec += 1000000;
 		d->tv_sec--;
 	}
@@ -78,7 +79,7 @@ timeval_add(struct timeval* d, const struct timeval* add)
 #ifndef S_SPLINT_S
 	d->tv_sec += add->tv_sec;
 	d->tv_usec += add->tv_usec;
-	while(d->tv_usec > 1000000 ) {
+	if(d->tv_usec > 1000000 ) {
 		d->tv_usec -= 1000000;
 		d->tv_sec++;
 	}
@@ -286,7 +287,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	/* see if it already exists, if not, create one */
 	if(!s) {
 		struct rbnode_t* n;
-		s = mesh_state_create(mesh->env,qinfo, qflags, 0);
+		s = mesh_state_create(mesh->env, qinfo, qflags, 0);
 		if(!s) {
 			log_err("mesh_state_create: out of memory; SERVFAIL");
 			error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
@@ -354,7 +355,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	/* see if it already exists, if not, create one */
 	if(!s) {
 		struct rbnode_t* n;
-		s = mesh_state_create(mesh->env,qinfo, qflags, 0);
+		s = mesh_state_create(mesh->env, qinfo, qflags, 0);
 		if(!s) {
 			return 0;
 		}
@@ -388,6 +389,55 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	return 1;
 }
 
+void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
+        uint16_t qflags, uint32_t leeway)
+{
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags, 0);
+	struct rbnode_t* n;
+	/* already exists, and for a different purpose perhaps.
+	 * if mesh_no_list, keep it that way. */
+	if(s) {
+		/* make it ignore the cache from now on */
+		if(!s->s.blacklist)
+			sock_list_insert(&s->s.blacklist, NULL, 0, s->s.region);
+		if(s->s.prefetch_leeway < leeway)
+			s->s.prefetch_leeway = leeway;
+		return;
+	}
+	if(!mesh_make_new_space(mesh)) {
+		verbose(VERB_ALGO, "Too many queries. dropped prefetch.");
+		mesh->stats_dropped ++;
+		return;
+	}
+	s = mesh_state_create(mesh->env, qinfo, qflags, 0);
+	if(!s) {
+		log_err("prefetch mesh_state_create: out of memory");
+		return;
+	}
+	n = rbtree_insert(&mesh->all, &s->node);
+	log_assert(n != NULL);
+	/* set detached (it is now) */
+	mesh->num_detached_states++;
+	/* make it ignore the cache */
+	sock_list_insert(&s->s.blacklist, NULL, 0, s->s.region);
+	s->s.prefetch_leeway = leeway;
+
+	if(s->list_select == mesh_no_list) {
+		/* move to either the forever or the jostle_list */
+		if(mesh->num_forever_states < mesh->max_forever_states) {
+			mesh->num_forever_states ++;
+			mesh_list_insert(s, &mesh->forever_first, 
+				&mesh->forever_last);
+			s->list_select = mesh_forever_list;
+		} else {
+			mesh_list_insert(s, &mesh->jostle_first, 
+				&mesh->jostle_last);
+			s->list_select = mesh_jostle_list;
+		}
+	}
+	mesh_run(mesh, s, module_event_new, NULL);
+}
+
 void mesh_report_reply(struct mesh_area* mesh, struct outbound_entry* e,
         struct comm_reply* reply, int what)
 {
@@ -447,6 +497,7 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
 	mstate->s.return_rcode = LDNS_RCODE_NOERROR;
 	mstate->s.env = env;
 	mstate->s.mesh_info = mstate;
+	mstate->s.prefetch_leeway = 0;
 	/* init modules */
 	for(i=0; i<env->mesh->mods.num; i++) {
 		mstate->s.minfo[i] = NULL;
@@ -472,7 +523,7 @@ mesh_state_cleanup(struct mesh_state* mstate)
 		for(cb=mstate->cb_list; cb; cb=cb->next) {
 			fptr_ok(fptr_whitelist_mesh_cb(cb->cb));
 			(*cb->cb)(cb->cb_arg, LDNS_RCODE_SERVFAIL, NULL,
-				sec_status_unchecked);
+				sec_status_unchecked, NULL);
 		}
 	}
 
@@ -615,6 +666,7 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 	struct mesh_cb* r)
 {
 	int secure;
+	char* reason = NULL;
 	/* bogus messages are not made into servfail, sec_status passed 
 	 * to the callback function */
 	if(rep && rep->security == sec_status_secure)
@@ -622,10 +674,14 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 	else	secure = 0;
 	if(!rep && rcode == LDNS_RCODE_NOERROR)
 		rcode = LDNS_RCODE_SERVFAIL;
+	if(!rcode && rep->security == sec_status_bogus) {
+		if(!(reason = errinf_to_str(&m->s)))
+			rcode = LDNS_RCODE_SERVFAIL;
+	}
 	/* send the reply */
 	if(rcode) {
 		fptr_ok(fptr_whitelist_mesh_cb(r->cb));
-		(*r->cb)(r->cb_arg, rcode, r->buf, sec_status_unchecked);
+		(*r->cb)(r->cb_arg, rcode, r->buf, sec_status_unchecked, NULL);
 	} else {
 		size_t udp_size = r->edns.udp_size;
 		ldns_buffer_clear(r->buf);
@@ -640,13 +696,14 @@ mesh_do_callback(struct mesh_state* m, int rcode, struct reply_info* rep,
 		{
 			fptr_ok(fptr_whitelist_mesh_cb(r->cb));
 			(*r->cb)(r->cb_arg, LDNS_RCODE_SERVFAIL, r->buf,
-				sec_status_unchecked);
+				sec_status_unchecked, NULL);
 		} else {
 			fptr_ok(fptr_whitelist_mesh_cb(r->cb));
 			(*r->cb)(r->cb_arg, LDNS_RCODE_NOERROR, r->buf,
-				rep->security);
+				rep->security, reason);
 		}
 	}
+	free(reason);
 	m->s.env->mesh->num_reply_addrs--;
 }
 
@@ -851,7 +908,7 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate,
 			&mstate->s.qinfo);
 		s = module_error;
 	}
-	if(s == module_wait_module) {
+	if(s == module_wait_module || s == module_restart_next) {
 		/* start next module */
 		mstate->s.curmod++;
 		if(mesh->mods.num == mstate->s.curmod) {
@@ -861,6 +918,13 @@ mesh_continue(struct mesh_area* mesh, struct mesh_state* mstate,
 			mstate->s.curmod--;
 			return mesh_continue(mesh, mstate, module_error, ev);
 		}
+		if(s == module_restart_next) {
+			fptr_ok(fptr_whitelist_mod_clear(
+				mesh->mods.mod[mstate->s.curmod]->clear));
+			(*mesh->mods.mod[mstate->s.curmod]->clear)
+				(&mstate->s, mstate->s.curmod);
+			mstate->s.minfo[mstate->s.curmod] = NULL;
+		}
 		*ev = module_event_pass;
 		return 1;
 	}

services/mesh.h

@@ -206,9 +206,10 @@ struct mesh_reply {
 
 /** 
  * Mesh result callback func.
- * called as func(cb_arg, rcode, buffer_with_reply, security);
- * */
-typedef void (*mesh_cb_func_t)(void*, int, ldns_buffer*, enum sec_status);
+ * called as func(cb_arg, rcode, buffer_with_reply, security, why_bogus);
+ */
+typedef void (*mesh_cb_func_t)(void*, int, ldns_buffer*, enum sec_status, 
+	char*);
 
 /**
  * Callback to result routine
@@ -285,6 +286,18 @@ int mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	uint16_t qflags, struct edns_data* edns, ldns_buffer* buf, 
 	uint16_t qid, mesh_cb_func_t cb, void* cb_arg);
 
+/**
+ * New prefetch message. Create new query state if needed.
+ * Will run the mesh area queries to process if a new query state is created.
+ *
+ * @param mesh: the mesh.
+ * @param qinfo: query from client.
+ * @param qflags: flags from client query.
+ * @param leeway: TTL leeway what to expire earlier for this update.
+ */
+void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
+	uint16_t qflags, uint32_t leeway);
+
 /**
  * Handle new event from the wire. A serviced query has returned.
  * The query state will be made runnable, and the mesh_area will process

services/modstack.c

@@ -39,6 +39,7 @@
  * This file contains functions to help maintain a stack of modules.
  */
 #include "config.h"
+#include <ctype.h>
 #include "services/modstack.h"
 #include "util/module.h"
 #include "util/fptr_wlist.h"

services/outbound_list.c

@@ -40,6 +40,7 @@
  * queries it has outstanding to authoritative servers.
  */
 #include "config.h"
+#include <sys/time.h>
 #include "services/outbound_list.h"
 #include "services/outside_network.h"
 

services/outside_network.c

@@ -40,6 +40,12 @@
  * wait for the pending answer events.
  */
 #include "config.h"
+#include <ctype.h>
+#ifdef HAVE_SYS_TYPES_H
+#  include <sys/types.h>
+#endif
+#include <sys/time.h>
+#include "ldns/wire2host.h"
 #include "services/outside_network.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/infra.h"
@@ -53,9 +59,6 @@
 #include "util/random.h"
 #include "util/fptr_wlist.h"
 
-#ifdef HAVE_SYS_TYPES_H
-#  include <sys/types.h>
-#endif
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -470,7 +473,7 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	int do_ip6, size_t num_tcp, struct infra_cache* infra,
 	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
 	int numavailports, size_t unwanted_threshold,
-	void (*unwanted_action)(void*), void* unwanted_param)
+	void (*unwanted_action)(void*), void* unwanted_param, int do_udp)
 {
 	struct outside_network* outnet = (struct outside_network*)
 		calloc(1, sizeof(struct outside_network));
@@ -490,6 +493,7 @@ outside_network_create(struct comm_base *base, size_t bufsize,
 	outnet->unwanted_action = unwanted_action;
 	outnet->unwanted_param = unwanted_param;
 	outnet->use_caps_for_id = use_caps_for_id;
+	outnet->do_udp = do_udp;
 	if(numavailports == 0) {
 		log_err("no outgoing ports available");
 		outside_network_delete(outnet);
@@ -754,12 +758,12 @@ udp_sockport(struct sockaddr_storage* addr, socklen_t addrlen, int port,
 		struct sockaddr_in6* sa = (struct sockaddr_in6*)addr;
 		sa->sin6_port = (in_port_t)htons((uint16_t)port);
 		fd = create_udp_sock(AF_INET6, SOCK_DGRAM, 
-			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto);
+			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto, 0);
 	} else {
 		struct sockaddr_in* sa = (struct sockaddr_in*)addr;
 		sa->sin_port = (in_port_t)htons((uint16_t)port);
 		fd = create_udp_sock(AF_INET, SOCK_DGRAM, 
-			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto);
+			(struct sockaddr*)addr, addrlen, 1, inuse, &noproto, 0);
 	}
 	return fd;
 }
@@ -806,9 +810,9 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 	log_assert(outnet->unused_fds);
 	tries = 0;
 	while(1) {
-		my_if = ub_random(outnet->rnd) % num_if;
+		my_if = ub_random_max(outnet->rnd, num_if);
 		pif = &ifs[my_if];
-		my_port = ub_random(outnet->rnd) % pif->avail_total;
+		my_port = ub_random_max(outnet->rnd, pif->avail_total);
 		if(my_port < pif->inuse) {
 			/* port already open */
 			pend->pc = pif->out[my_port];
@@ -892,8 +896,10 @@ randomize_and_send_udp(struct outside_network* outnet, struct pending* pend,
 
 	/* system calls to set timeout after sending UDP to make roundtrip
 	   smaller. */
+#ifndef S_SPLINT_S
 	tv.tv_sec = timeout/1000;
 	tv.tv_usec = (timeout%1000)*1000;
+#endif
 	comm_timer_set(pend->timer, &tv);
 	return 1;
 }
@@ -1009,8 +1015,10 @@ pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 	w->outnet = outnet;
 	w->cb = callback;
 	w->cb_arg = callback_arg;
+#ifndef S_SPLINT_S
 	tv.tv_sec = timeout;
 	tv.tv_usec = 0;
+#endif
 	comm_timer_set(w->timer, &tv);
 	if(pend) {
 		/* we have a buffer available right now */
@@ -1070,7 +1078,7 @@ lookup_serviced(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
 /** Create new serviced entry */
 static struct serviced_query*
 serviced_create(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
-        struct sockaddr_storage* addr, socklen_t addrlen)
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen)
 {
 	struct serviced_query* sq = (struct serviced_query*)malloc(sizeof(*sq));
 	rbnode_t* ins;
@@ -1084,6 +1092,7 @@ serviced_create(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
 	}
 	sq->qbuflen = ldns_buffer_limit(buff);
 	sq->dnssec = dnssec;
+	sq->want_dnssec = want_dnssec;
 	memcpy(&sq->addr, addr, addrlen);
 	sq->addrlen = addrlen;
 	sq->outnet = outnet;
@@ -1125,7 +1134,8 @@ serviced_delete(struct serviced_query* sq)
 		/* clear up the pending query */
 		if(sq->status == serviced_query_UDP_EDNS ||
 			sq->status == serviced_query_UDP ||
-			sq->status == serviced_query_PROBE_EDNS) {
+			sq->status == serviced_query_PROBE_EDNS ||
+			sq->status == serviced_query_UDP_EDNS_fallback) {
 			struct pending* p = (struct pending*)sq->pending;
 			if(p->pc)
 				portcomm_loweruse(sq->outnet, p->pc);
@@ -1402,12 +1412,25 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 		(LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
 		LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(ldns_buffer_begin(
 		c->buffer)) == LDNS_RCODE_NOTIMPL) ) {
-		if(!infra_edns_update(sq->outnet->infra, &sq->addr, 
+		/* attempt to fallback to nonEDNS */
+		sq->status = serviced_query_TCP_EDNS_fallback;
+		serviced_tcp_initiate(sq->outnet, sq, c->buffer);
+		return 0;
+	} else if(error==NETEVENT_NOERROR && 
+		sq->status == serviced_query_TCP_EDNS_fallback &&
+			(LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
+			LDNS_RCODE_NOERROR || LDNS_RCODE_WIRE(
+			ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NXDOMAIN 
+			|| LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) 
+			== LDNS_RCODE_YXDOMAIN)) {
+		/* the fallback produced a result that looks promising, note
+		 * that this server should be approached without EDNS */
+		/* only store noEDNS in cache if domain is noDNSSEC */
+		if(!sq->want_dnssec)
+		  if(!infra_edns_update(sq->outnet->infra, &sq->addr, 
 			sq->addrlen, -1, *sq->outnet->now_secs))
 			log_err("Out of memory caching no edns for host");
 		sq->status = serviced_query_TCP;
-		serviced_tcp_initiate(sq->outnet, sq, c->buffer);
-		return 0;
 	}
 	/* insert address into reply info */
 	if(!rep) {
@@ -1425,6 +1448,8 @@ static void
 serviced_tcp_initiate(struct outside_network* outnet, 
 	struct serviced_query* sq, ldns_buffer* buff)
 {
+	verbose(VERB_ALGO, "initiate TCP query %s", 
+		sq->status==serviced_query_TCP_EDNS?"EDNS":"");
 	serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS);
 	sq->pending = pending_tcp_query(outnet, buff, &sq->addr,
 		sq->addrlen, TCP_AUTH_QUERY_TIMEOUT, serviced_tcp_callback, 
@@ -1437,6 +1462,25 @@ serviced_tcp_initiate(struct outside_network* outnet,
 	}
 }
 
+/** Send serviced query over TCP return false on initial failure */
+static int
+serviced_tcp_send(struct serviced_query* sq, ldns_buffer* buff)
+{
+	int vs, rtt;
+	uint8_t edns_lame_known;
+	if(!infra_host(sq->outnet->infra, &sq->addr, sq->addrlen, 
+		*sq->outnet->now_secs, &vs, &edns_lame_known, &rtt))
+		return 0;
+	if(vs != -1)
+		sq->status = serviced_query_TCP_EDNS;
+	else 	sq->status = serviced_query_TCP;
+	serviced_encode(sq, buff, sq->status == serviced_query_TCP_EDNS);
+	sq->pending = pending_tcp_query(sq->outnet, buff, &sq->addr,
+		sq->addrlen, TCP_AUTH_QUERY_TIMEOUT, serviced_tcp_callback, 
+		sq);
+	return sq->pending != NULL;
+}
+
 int 
 serviced_udp_callback(struct comm_point* c, void* arg, int error,
         struct comm_reply* rep)
@@ -1476,43 +1520,33 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			serviced_callbacks(sq, NETEVENT_TIMEOUT, c, rep);
 			return 0;
 		}
+	} else if(error != NETEVENT_NOERROR) {
+		/* udp returns error (due to no ID or interface available) */
+		serviced_callbacks(sq, error, c, rep);
+		return 0;
 	}
-	if(error == NETEVENT_NOERROR && sq->status == serviced_query_UDP_EDNS 
+	if(sq->status == serviced_query_UDP_EDNS 
 		&& (LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) 
 			== LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(
 			ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOTIMPL)) {
-		/* note no EDNS, fallback without EDNS */
-		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
-			-1, (uint32_t)now.tv_sec)) {
-			log_err("Out of memory caching no edns for host");
-		}
-		sq->status = serviced_query_UDP;
+		/* try to get an answer by falling back without EDNS */
+		sq->status = serviced_query_UDP_EDNS_fallback;
 		sq->retry = 0;
 		if(!serviced_udp_send(sq, c->buffer)) {
 			serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
 		}
 		return 0;
-	}
-	if(LDNS_TC_WIRE(ldns_buffer_begin(c->buffer)) ||
-		(error != NETEVENT_NOERROR && fallback_tcp)  ) {
-		/* fallback to TCP */
-		/* this discards partial UDP contents */
-		if(sq->status == serviced_query_UDP_EDNS)
-			sq->status = serviced_query_TCP_EDNS;
-		else	sq->status = serviced_query_TCP;
-		serviced_tcp_initiate(outnet, sq, c->buffer);
-		return 0;
-	}
-	/* yay! an answer */
-	if(sq->status == serviced_query_PROBE_EDNS) {
+	} else if(sq->status == serviced_query_PROBE_EDNS) {
 		/* probe without EDNS succeeds, so we conclude that this
 		 * host likely has EDNS packets dropped */
 		log_addr(VERB_DETAIL, "timeouts, concluded that connection to "
 			"host drops EDNS packets", &sq->addr, sq->addrlen);
-		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
+		/* only store noEDNS in cache if domain is noDNSSEC */
+		if(!sq->want_dnssec)
+		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
 			-1, (uint32_t)now.tv_sec)) {
 			log_err("Out of memory caching no edns for host");
-		}
+		  }
 		sq->status = serviced_query_UDP;
 	} else if(sq->status == serviced_query_UDP_EDNS && 
 		!sq->edns_lame_known) {
@@ -1522,12 +1556,27 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			log_err("Out of memory caching edns works");
 		}
 		sq->edns_lame_known = 1;
+	} else if(sq->status == serviced_query_UDP_EDNS_fallback &&
+		!sq->edns_lame_known && (LDNS_RCODE_WIRE(
+		ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOERROR || 
+		LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
+		LDNS_RCODE_NXDOMAIN || LDNS_RCODE_WIRE(ldns_buffer_begin(
+		c->buffer)) == LDNS_RCODE_YXDOMAIN)) {
+		/* the fallback produced a result that looks promising, note
+		 * that this server should be approached without EDNS */
+		/* only store noEDNS in cache if domain is noDNSSEC */
+		if(!sq->want_dnssec)
+		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
+			-1, (uint32_t)now.tv_sec)) {
+			log_err("Out of memory caching no edns for host");
+		  }
+		sq->status = serviced_query_UDP;
 	}
 	if(now.tv_sec > sq->last_sent_time.tv_sec ||
 		(now.tv_sec == sq->last_sent_time.tv_sec &&
 		now.tv_usec > sq->last_sent_time.tv_usec)) {
 		/* convert from microseconds to milliseconds */
-		int roundtime = (now.tv_sec - sq->last_sent_time.tv_sec)*1000
+		int roundtime = ((int)now.tv_sec - (int)sq->last_sent_time.tv_sec)*1000
 		  + ((int)now.tv_usec - (int)sq->last_sent_time.tv_usec)/1000;
 		verbose(VERB_ALGO, "measured roundtrip at %d msec", roundtime);
 		log_assert(roundtime >= 0);
@@ -1535,6 +1584,20 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			roundtime, sq->last_rtt, (uint32_t)now.tv_sec))
 			log_err("out of memory noting rtt.");
 	}
+	/* perform TC flag check and TCP fallback after updating our
+	 * cache entries for EDNS status and RTT times */
+	if(LDNS_TC_WIRE(ldns_buffer_begin(c->buffer)) || fallback_tcp) {
+		/* fallback to TCP */
+		/* this discards partial UDP contents */
+		if(sq->status == serviced_query_UDP_EDNS ||
+			sq->status == serviced_query_UDP_EDNS_fallback)
+			/* if we have unfinished EDNS_fallback, start again */
+			sq->status = serviced_query_TCP_EDNS;
+		else	sq->status = serviced_query_TCP;
+		serviced_tcp_initiate(outnet, sq, c->buffer);
+		return 0;
+	}
+	/* yay! an answer */
 	serviced_callbacks(sq, error, c, rep);
 	return 0;
 }
@@ -1555,10 +1618,10 @@ callback_list_find(struct serviced_query* sq, void* cb_arg,
 struct serviced_query* 
 outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr,
-	socklen_t addrlen, comm_point_callback_t* callback,
-	void* callback_arg, ldns_buffer* buff, 
-	int (*arg_compare)(void*,void*))
+	uint16_t flags, int dnssec, int want_dnssec,
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	comm_point_callback_t* callback, void* callback_arg, 
+	ldns_buffer* buff, int (*arg_compare)(void*,void*))
 {
 	struct serviced_query* sq;
 	struct service_callback* cb;
@@ -1574,18 +1637,29 @@ outnet_serviced_query(struct outside_network* outnet,
 		return NULL;
 	if(!sq) {
 		/* make new serviced query entry */
-		sq = serviced_create(outnet, buff, dnssec, addr, addrlen);
+		sq = serviced_create(outnet, buff, dnssec, want_dnssec,
+			addr, addrlen);
 		if(!sq) {
 			free(cb);
 			return NULL;
 		}
 		/* perform first network action */
-		if(!serviced_udp_send(sq, buff)) {
-			(void)rbtree_delete(outnet->serviced, sq);
-			free(sq->qbuf);
-			free(sq);
-			free(cb);
-			return NULL;
+		if(outnet->do_udp) {
+			if(!serviced_udp_send(sq, buff)) {
+				(void)rbtree_delete(outnet->serviced, sq);
+				free(sq->qbuf);
+				free(sq);
+				free(cb);
+				return NULL;
+			}
+		} else {
+			if(!serviced_tcp_send(sq, buff)) {
+				(void)rbtree_delete(outnet->serviced, sq);
+				free(sq->qbuf);
+				free(sq);
+				free(cb);
+				return NULL;
+			}
 		}
 	}
 	/* add callback to list of callbacks */
@@ -1716,7 +1790,8 @@ serviced_get_mem(struct serviced_query* sq)
 		s += sizeof(*sb);
 	if(sq->status == serviced_query_UDP_EDNS ||
 		sq->status == serviced_query_UDP ||
-		sq->status == serviced_query_PROBE_EDNS) {
+		sq->status == serviced_query_PROBE_EDNS ||
+		sq->status == serviced_query_UDP_EDNS_fallback) {
 		s += sizeof(struct pending);
 		s += comm_timer_get_mem(NULL);
 	} else {

services/outside_network.h

@@ -92,6 +92,8 @@ struct outside_network {
 	/** linked list of available commpoints, unused file descriptors,
 	 * for use as outgoing UDP ports. cp.fd=-1 in them. */
 	struct port_comm* unused_fds;
+	/** if udp is done */
+	int do_udp;
 
 	/** array of outgoing IP4 interfaces */
 	struct port_if* ip4_ifs;
@@ -289,6 +291,8 @@ struct serviced_query {
 	size_t qbuflen;
 	/** If an EDNS section is included, the DO/CD bit will be turned on. */
 	int dnssec;
+	/** We want signatures, or else the answer is likely useless */
+	int want_dnssec;
 	/** where to send it */
 	struct sockaddr_storage addr;
 	/** length of addr field in use. */
@@ -306,7 +310,11 @@ struct serviced_query {
 		/** TCP without EDNS sent */
 		serviced_query_TCP,
 		/** probe to test EDNS lameness (EDNS is dropped) */
-		serviced_query_PROBE_EDNS
+		serviced_query_PROBE_EDNS,
+		/** probe to test noEDNS0 (EDNS gives FORMERRorNOTIMP) */
+		serviced_query_UDP_EDNS_fallback,
+		/** probe to test TCP noEDNS0 (EDNS gives FORMERRorNOTIMP) */
+		serviced_query_TCP_EDNS_fallback
 	} 	
 		/** variable with current status */ 
 		status;
@@ -347,6 +355,7 @@ struct serviced_query {
  * @param unwanted_threshold: when to take defensive action.
  * @param unwanted_action: the action to take.
  * @param unwanted_param: user parameter to action.
+ * @param do_udp: if udp is done.
  * @return: the new structure (with no pending answers) or NULL on error.
  */
 struct outside_network* outside_network_create(struct comm_base* base,
@@ -354,7 +363,7 @@ struct outside_network* outside_network_create(struct comm_base* base,
 	int do_ip4, int do_ip6, size_t num_tcp, struct infra_cache* infra, 
 	struct ub_randstate* rnd, int use_caps_for_id, int* availports, 
 	int numavailports, size_t unwanted_threshold,
-	void (*unwanted_action)(void*), void* unwanted_param);
+	void (*unwanted_action)(void*), void* unwanted_param, int do_udp);
 
 /**
  * Delete outside_network structure.
@@ -424,6 +433,8 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
  * @param dnssec: if set, DO bit is set in EDNS queries.
  *	If the value includes BIT_CD, CD bit is set when in EDNS queries.
  *	If the value includes BIT_DO, DO bit is set when in EDNS queries.
+ * @param want_dnssec: signatures are needed, without EDNS the answer is
+ * 	likely to be useless.
  * @param callback: callback function.
  * @param callback_arg: user argument to callback function.
  * @param addr: to which server to send the query.
@@ -436,10 +447,10 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
  */
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr, 
-	socklen_t addrlen, comm_point_callback_t* callback, 
-	void* callback_arg, ldns_buffer* buff, 
-	int (*arg_compare)(void*,void*));
+	uint16_t flags, int dnssec, int want_dnssec,
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	comm_point_callback_t* callback, void* callback_arg, 
+	ldns_buffer* buff, int (*arg_compare)(void*,void*));
 
 /**
  * Remove service query callback.

smallapp/unbound-checkconf.c

@@ -52,6 +52,9 @@
 #include "iterator/iter_fwd.h"
 #include "validator/validator.h"
 #include "services/localzone.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 #ifdef HAVE_PWD_H
 #include <pwd.h>
 #endif
@@ -80,40 +83,6 @@ usage()
 	exit(1);
 }
 
-/** compare and print decimal option */
-#define O_DEC(opt, str, var) if(strcmp(opt, str)==0) \
-	{printf("%d\n", (int)cfg->var);}
-/** compare and print unsigned option */
-#define O_UNS(opt, str, var) if(strcmp(opt, str)==0) \
-	{printf("%u\n", (unsigned)cfg->var);}
-/** compare and print yesno option */
-#define O_YNO(opt, str, var) if(strcmp(opt, str)==0) \
-	{printf("%s\n", cfg->var?"yes":"no");}
-/** compare and print string option */
-#define O_STR(opt, str, var) if(strcmp(opt, str)==0) \
-	{printf("%s\n", cfg->var?cfg->var:"");}
-/** compare and print array option */
-#define O_IFC(opt, str, num, arr) if(strcmp(opt, str)==0) \
-	{int i; for(i=0; i<cfg->num; i++) printf("%s\n", cfg->arr[i]);}
-/** compare and print memorysize option */
-#define O_MEM(opt, str, var) if(strcmp(opt, str)==0) { \
-	if(cfg->var > 1024*1024*1024) {	\
-	  size_t f=cfg->var/(size_t)1000000, b=cfg->var%(size_t)1000000; \
-	  printf("%u%6.6u\n", (unsigned)f, (unsigned)b); \
-	} else printf("%u\n", (unsigned)cfg->var);}
-/** compare and print list option */
-#define O_LST(opt, name, lst) if(strcmp(opt, name)==0) { \
-	struct config_strlist* p = cfg->lst; \
-	for(p = cfg->lst; p; p = p->next) \
-		printf("%s\n", p->str); \
-	}
-/** compare and print list option */
-#define O_LS2(opt, name, lst) if(strcmp(opt, name)==0) { \
-	struct config_str2list* p = cfg->lst; \
-	for(p = cfg->lst; p; p = p->next) \
-		printf("%s %s\n", p->str, p->str2); \
-	}
-
 /** 
  * Print given option to stdout 
  * @param cfg: config
@@ -123,90 +92,8 @@ usage()
 static void
 print_option(struct config_file* cfg, const char* opt)
 {
-	O_DEC(opt, "verbosity", verbosity)
-	else O_DEC(opt, "statistics-interval", stat_interval)
-	else O_YNO(opt, "statistics-cumulative", stat_interval)
-	else O_YNO(opt, "extended-statistics", stat_extended)
-	else O_DEC(opt, "num-threads", num_threads)
-	else O_IFC(opt, "interface", num_ifs, ifs)
-	else O_IFC(opt, "outgoing-interface", num_out_ifs, out_ifs)
-	else O_YNO(opt, "interface-automatic", if_automatic)
-	else O_DEC(opt, "port", port)
-	else O_DEC(opt, "outgoing-range", outgoing_num_ports)
-	else O_DEC(opt, "outgoing-num-tcp", outgoing_num_tcp)
-	else O_DEC(opt, "incoming-num-tcp", incoming_num_tcp)
-	else O_DEC(opt, "msg-buffer-size", msg_buffer_size)
-	else O_MEM(opt, "msg-cache-size", msg_cache_size)
-	else O_DEC(opt, "msg-cache-slabs", msg_cache_slabs)
-	else O_DEC(opt, "num-queries-per-thread", num_queries_per_thread)
-	else O_UNS(opt, "jostle-timeout", jostle_time)
-	else O_MEM(opt, "rrset-cache-size", rrset_cache_size)
-	else O_DEC(opt, "rrset-cache-slabs", rrset_cache_slabs)
-	else O_DEC(opt, "cache-max-ttl", max_ttl)
-	else O_DEC(opt, "infra-host-ttl", host_ttl)
-	else O_DEC(opt, "infra-lame-ttl", lame_ttl)
-	else O_DEC(opt, "infra-cache-slabs", infra_cache_slabs)
-	else O_MEM(opt, "infra-cache-numhosts", infra_cache_numhosts)
-	else O_MEM(opt, "infra-cache-lame-size", infra_cache_lame_size)
-	else O_YNO(opt, "do-ip4", do_ip4)
-	else O_YNO(opt, "do-ip6", do_ip6)
-	else O_YNO(opt, "do-udp", do_udp)
-	else O_YNO(opt, "do-tcp", do_tcp)
-	else O_YNO(opt, "do-daemonize", do_daemonize)
-	else O_STR(opt, "chroot", chrootdir)
-	else O_STR(opt, "username", username)
-	else O_STR(opt, "directory", directory)
-	else O_STR(opt, "logfile", logfile)
-	else O_STR(opt, "pidfile", pidfile)
-	else O_YNO(opt, "hide-identity", hide_identity)
-	else O_YNO(opt, "hide-version", hide_version)
-	else O_STR(opt, "identity", identity)
-	else O_STR(opt, "version", version)
-	else O_STR(opt, "target-fetch-policy", target_fetch_policy)
-	else O_YNO(opt, "harden-short-bufsize", harden_short_bufsize)
-	else O_YNO(opt, "harden-large-queries", harden_large_queries)
-	else O_YNO(opt, "harden-glue", harden_glue)
-	else O_YNO(opt, "harden-dnssec-stripped", harden_dnssec_stripped)
-	else O_YNO(opt, "harden-referral-path", harden_referral_path)
-	else O_YNO(opt, "use-caps-for-id", use_caps_bits_for_id)
-	else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold)
-	else O_YNO(opt, "do-not-query-localhost", donotquery_localhost)
-	else O_STR(opt, "module-config", module_conf)
-	else O_STR(opt, "dlv-anchor-file", dlv_anchor_file)
-	else O_DEC(opt, "val-bogus-ttl", bogus_ttl)
-	else O_YNO(opt, "val-clean-additional", val_clean_additional)
-	else O_DEC(opt, "val-log-level", val_log_level)
-	else O_YNO(opt, "val-permissive-mode", val_permissive_mode)
-	else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
-	else O_MEM(opt, "key-cache-size", key_cache_size)
-	else O_DEC(opt, "key-cache-slabs", key_cache_slabs)
-	else O_MEM(opt, "neg-cache-size", neg_cache_size)
-	else O_YNO(opt, "control-enable", remote_control_enable)
-	else O_DEC(opt, "control-port", control_port)
-	else O_STR(opt, "server-key-file", server_key_file)
-	else O_STR(opt, "server-cert-file", server_cert_file)
-	else O_STR(opt, "control-key-file", control_key_file)
-	else O_STR(opt, "control-cert-file", control_cert_file)
-	else O_LST(opt, "root-hints", root_hints)
-	else O_LS2(opt, "access-control", acls)
-	else O_LST(opt, "do-not-query-address", donotqueryaddrs)
-	else O_LST(opt, "private-address", private_address)
-	else O_LST(opt, "private-domain", private_domain)
-	else O_LST(opt, "trust-anchor-file", trust_anchor_file_list)
-	else O_LST(opt, "trust-anchor", trust_anchor_list)
-	else O_LST(opt, "trusted-keys-file", trusted_keys_file_list)
-	else O_LST(opt, "dlv-anchor", dlv_anchor_list)
-	else O_LST(opt, "control-interface", control_ifs)
-	else O_UNS(opt, "val-override-date", val_date_override)
-	/* not here:
-	 * outgoing-permit, outgoing-avoid - have list of ports
-	 * local-zone - zones and nodefault variables
-	 * local-data - see below
-	 * local-data-ptr - converted to local-data entries
-	 * stub-zone, name, stub-addr, stub-host, stub-prime
-	 * forward-zone, name, forward-addr, forward-host
-	 */
-	else fatal_exit("cannot print option '%s'", opt);
+	if(!config_get_option(cfg, opt, config_print_func, stdout))
+		fatal_exit("cannot print option '%s'", opt);
 }
 
 /** check if module works with config */
@@ -270,7 +157,7 @@ interfacechecks(struct config_file* cfg)
 	socklen_t alen;
 	int i, j;
 	for(i=0; i<cfg->num_ifs; i++) {
-		if(!ipstrtoaddr(cfg->ifs[i], UNBOUND_DNS_PORT, &a, &alen)) {
+		if(!extstrtoaddr(cfg->ifs[i], &a, &alen)) {
 			fatal_exit("cannot parse interface specified as '%s'",
 				cfg->ifs[i]);
 		}
@@ -437,6 +324,9 @@ morechecks(struct config_file* cfg, const char* fname)
 		fatal_exit("ip4 and ip6 are both disabled, pointless");
 	if(!cfg->do_udp && !cfg->do_tcp)
 		fatal_exit("udp and tcp are both disabled, pointless");
+	if(cfg->edns_buffer_size > cfg->msg_buffer_size)
+		fatal_exit("edns-buffer-size larger than msg-buffer-size, "
+			"answers will not fit in processing buffer");
 
 	if(cfg->chrootdir && cfg->chrootdir[0] && 
 		cfg->chrootdir[strlen(cfg->chrootdir)-1] == '/')
@@ -488,6 +378,8 @@ morechecks(struct config_file* cfg, const char* fname)
 		cfg->root_hints, cfg->chrootdir, cfg);
 	check_chroot_filelist("trust-anchor-file", 
 		cfg->trust_anchor_file_list, cfg->chrootdir, cfg);
+	check_chroot_filelist("auto-trust-anchor-file", 
+		cfg->auto_trust_anchor_file_list, cfg->chrootdir, cfg);
 	check_chroot_filelist_wild("trusted-keys-file", 
 		cfg->trusted_keys_file_list, cfg->chrootdir, cfg);
 	check_chroot_string("dlv-anchor-file", &cfg->dlv_anchor_file, 

smallapp/unbound-control-setup.sh

@@ -46,7 +46,10 @@ CLIENTNAME=unbound-control
 DAYS=7200
 
 # size of keys in bits
-BITS=1024
+BITS=1536
+
+# hash algorithm
+HASH=sha256
 
 # base name for unbound server keys
 SVR_BASE=unbound_server
@@ -84,7 +87,7 @@ done
 
 # go!:
 echo "setup in directory $DESTDIR"
-cd "$DESTDIR" || error "could not cd"
+cd "$DESTDIR" || error "could not cd to $DESTDIR"
 
 # create certificate keys; do not recreate if they already exist.
 if test -f $SVR_BASE.key; then
@@ -104,7 +107,7 @@ fi
 cat >request.cfg <<EOF
 [req]
 default_bits=$BITS
-default_md=sha1
+default_md=$HASH
 prompt=no
 distinguished_name=req_distinguished_name
 
@@ -122,7 +125,7 @@ openssl x509 -in $SVR_BASE.pem -addtrust serverAuth -out $SVR_BASE"_trust.pem"
 cat >request.cfg <<EOF
 [req]
 default_bits=$BITS
-default_md=sha1
+default_md=$HASH
 prompt=no
 distinguished_name=req_distinguished_name
 
@@ -132,7 +135,7 @@ EOF
 test -f request.cfg || error "could not create request.cfg"
 
 echo "create $CTL_BASE.pem (signed client certificate)"
-openssl req -key $CTL_BASE.key -config request.cfg -new | openssl x509 -req -days $DAYS -CA $SVR_BASE"_trust.pem" -CAkey $SVR_BASE.key -CAcreateserial -out $CTL_BASE.pem
+openssl req -key $CTL_BASE.key -config request.cfg -new | openssl x509 -req -days $DAYS -CA $SVR_BASE"_trust.pem" -CAkey $SVR_BASE.key -CAcreateserial -$HASH -out $CTL_BASE.pem
 test -f $CTL_BASE.pem || error "could not create $CTL_BASE.pem"
 # create trusted usage pem
 # openssl x509 -in $CTL_BASE.pem -addtrust clientAuth -out $CTL_BASE"_trust.pem"

smallapp/unbound-control.c

@@ -42,6 +42,18 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#ifdef HAVE_OPENSSL_SSL_H
+#include <openssl/ssl.h>
+#endif
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/locks.h"
@@ -65,24 +77,31 @@ usage()
 	printf("  stats				print statistics\n");
 	printf("  stats_noreset			peek at statistics\n");
 	printf("  status			display status of server\n");
-	printf("  verbosity [number]		change logging detail\n");
-	printf("  local_zone [name] [type] 	add new local zone\n");
-	printf("  local_zone_remove [name]	remove local zone and its contents\n");
-	printf("  local_data [RR data...]	add local data, for example\n");
+	printf("  verbosity <number>		change logging detail\n");
+	printf("  log_reopen			close and open the logfile\n");
+	printf("  local_zone <name> <type>	add new local zone\n");
+	printf("  local_zone_remove <name>	remove local zone and its contents\n");
+	printf("  local_data <RR data...>	add local data, for example\n");
 	printf("				local_data www.example.com A 192.0.2.1\n");
-	printf("  local_data_remove [name]	remove local RR data from name\n");
+	printf("  local_data_remove <name>	remove local RR data from name\n");
 	printf("  dump_cache			print cache to stdout\n");
 	printf("  load_cache			load cache from stdin\n");
-	printf("  lookup [name]			print nameservers for name\n");
-	printf("  flush [name]			flushes common types for name from cache\n");
+	printf("  lookup <name>			print nameservers for name\n");
+	printf("  flush <name>			flushes common types for name from cache\n");
 	printf("  				types:  A, AAAA, MX, PTR, NS,\n");
 	printf("					SOA, CNAME, DNAME, SRV, NAPTR\n");
-	printf("  flush_type [name] [type]	flush name, type from cache\n");
-	printf("  flush_zone [name]		flush everything at or under name\n");
+	printf("  flush_type <name> <type>	flush name, type from cache\n");
+	printf("  flush_zone <name>		flush everything at or under name\n");
 	printf("  				from rr and dnssec caches\n");
 	printf("  flush_stats 			flush statistics, make zero\n");
 	printf("  flush_requestlist 		drop queries that are worked on\n");
 	printf("  dump_requestlist		show what is worked on\n");
+	printf("  set_option opt: val		set option to value, no reload\n");
+	printf("  get_option opt		get option value\n");
+	printf("  list_stubs			list stub-zones and root hints in use\n");
+	printf("  list_forwards			list forward-zones in use\n");
+	printf("  list_local_zones		list local-zones in use\n");
+	printf("  list_local_data		list local-data RRs in use\n");
 	printf("  forward [off | addr ...]	without arg show forward setup\n");
 	printf("				or off to turn off root forwarding\n");
 	printf("				or give list of ip addresses\n");

smallapp/unbound-host.c

@@ -41,6 +41,24 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+/* remove alloc checks, not in this part of the code */
+#ifdef UNBOUND_ALLOC_STATS
+#undef malloc
+#undef calloc
+#undef free
+#undef realloc
+#endif
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef free
+#undef realloc
+#undef strdup
+#define unbound_lite_wrapstr(s) s
+#endif
 #include "libunbound/unbound.h"
 #include <ldns/ldns.h>
 
@@ -193,24 +211,18 @@ secure_str(struct ub_result* result)
 static void
 pretty_type(char* s, size_t len, int t)
 {
-	const ldns_rr_descriptor *d = ldns_rr_descript((uint16_t)t);
-	if(d) {
-		snprintf(s, len, "%s", d->_name);
-	} else {
-		snprintf(s, len, "TYPE%d", t);
-	}
+	char* d = ldns_rr_type2str(t);
+	snprintf(s, len, "%s", d);
+	free(d);
 }
 
 /** nice string for class */
 static void
 pretty_class(char* s, size_t len, int c)
 {
-	ldns_lookup_table *cl = ldns_lookup_by_id(ldns_rr_classes, c);
-	if(cl) {
-		snprintf(s, len, "%s", cl->name);
-	} else {
-		snprintf(s, len, "CLASS%d", c);
-	}
+	char* d = ldns_rr_class2str(c);
+	snprintf(s, len, "%s", d);
+	free(d);
 }
 
 /** nice string for rcode */
@@ -297,6 +309,8 @@ pretty_output(char* q, int t, int c, struct ub_result* result, int docname)
 		if(verb > 0)
 			printf(" %s", secstatus);
 		printf("\n");
+		if(result->bogus && result->why_bogus)
+			printf("%s\n", result->why_bogus);
 		return;
 	}
 	if(docname && result->canonname &&
@@ -324,10 +338,31 @@ pretty_output(char* q, int t, int c, struct ub_result* result, int docname)
 				printf(" has no domain name ptr");
 			else if(t == LDNS_RR_TYPE_MX)
 				printf(" has no mail handler record");
-			else	printf(" has no %s record", tstr);
+			else if(t == LDNS_RR_TYPE_ANY) {
+				ldns_pkt* p = NULL;
+				if(ldns_wire2pkt(&p, result->answer_packet,
+				  (size_t)result->answer_len)==LDNS_STATUS_OK){
+					if(ldns_rr_list_rr_count(
+						ldns_pkt_answer(p)) == 0)
+						printf(" has no records\n");
+					else {
+						printf(" ANY:\n");
+						ldns_rr_list_print(stdout,
+							ldns_pkt_answer(p));
+					}
+				} else {
+					fprintf(stderr, "could not parse "
+						"reply packet to ANY query\n");
+					exit(1);
+				}
+				ldns_pkt_free(p);
+
+			} else	printf(" has no %s record", tstr);
 			printf(" %s\n", secstatus);
 		}
 		/* else: emptiness to indicate no data */
+		if(result->bogus && result->why_bogus)
+			printf("%s\n", result->why_bogus);
 		return;
 	}
 	i=0;
@@ -339,6 +374,8 @@ pretty_output(char* q, int t, int c, struct ub_result* result, int docname)
 			(size_t)result->len[i]);
 		i++;
 	}
+	if(result->bogus && result->why_bogus)
+		printf("%s\n", result->why_bogus);
 }
 
 /** perform a lookup and printout return if domain existed */
@@ -433,7 +470,6 @@ int main(int argc, char* argv[])
 			debuglevel++;
 			if(debuglevel < 2) 
 				debuglevel = 2; /* at least VERB_DETAIL */
-			check_ub_res(ub_ctx_debuglevel(ctx, debuglevel));
 			break;
 		case 'r':
 			check_ub_res(ub_ctx_resolvconf(ctx, "/etc/resolv.conf"));
@@ -459,6 +495,14 @@ int main(int argc, char* argv[])
 			usage();
 		}
 	}
+	if(debuglevel != 0) /* set after possible -C options */
+		check_ub_res(ub_ctx_debuglevel(ctx, debuglevel));
+	if(ub_ctx_get_option(ctx, "use-syslog", &optarg) == 0) {
+		if(strcmp(optarg, "yes") == 0) /* disable use-syslog */
+			check_ub_res(ub_ctx_set_option(ctx, 
+				"use-syslog:", "no"));
+		free(optarg);
+	}
 	argc -= optind;
 	argv += optind;
 	if(argc != 1)

smallapp/worker_cb.c

@@ -112,7 +112,8 @@ int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec), 
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
@@ -151,7 +152,8 @@ int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
@@ -182,13 +184,15 @@ void libworker_handle_control_cmd(struct tube* ATTR_UNUSED(tube),
 }
 
 void libworker_fg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode), 
-	ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s))
+	ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
+	char* ATTR_UNUSED(why_bogus))
 {
 	log_assert(0);
 }
 
 void libworker_bg_done_cb(void* ATTR_UNUSED(arg), int ATTR_UNUSED(rcode), 
-	ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s))
+	ldns_buffer* ATTR_UNUSED(buf), enum sec_status ATTR_UNUSED(s),
+	char* ATTR_UNUSED(why_bogus))
 {
 	log_assert(0);
 }
@@ -204,6 +208,11 @@ void worker_stat_timer_cb(void* ATTR_UNUSED(arg))
 	log_assert(0);
 }
 
+void worker_probe_timer_cb(void* ATTR_UNUSED(arg))
+{
+	log_assert(0);
+}
+
 /** keep track of lock id in lock-verify application */
 struct order_id {
         /** the thread id that created it */
@@ -228,3 +237,14 @@ codeline_cmp(const void* a, const void* b)
 {
         return strcmp((const char*)a, (const char*)b);
 }
+
+int replay_var_compare(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
+{
+        log_assert(0);
+        return 0;
+}
+
+void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
+{
+        log_assert(0);
+}

testcode/asynclook.c

@@ -41,10 +41,20 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 #include "libunbound/unbound.h"
 #include "libunbound/context.h"
 #include "util/locks.h"
 #include "util/log.h"
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef realloc
+#undef free
+#undef strdup
+#endif
 
 /** keeping track of the async ids */
 struct track_id {

testcode/delayer.c

@@ -41,6 +41,13 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+#include <sys/time.h>
 #include "util/net_help.h"
 #include "util/config_file.h"
 #include <signal.h>
@@ -991,8 +998,10 @@ service(const char* bind_str, int bindport, const char* serv_str,
 	struct timeval delay, reuse;
 	ldns_buffer* pkt;
 	int i, s, listen_s;
+#ifndef S_SPLINT_S
 	delay.tv_sec = delay_msec / 1000;
 	delay.tv_usec = (delay_msec % 1000)*1000;
+#endif
 	reuse = delay; /* reuse is max(4*delay, 1 second) */
 	dl_tv_add(&reuse, &delay);
 	dl_tv_add(&reuse, &delay);

testcode/do-tests.sh

@@ -7,9 +7,14 @@ NEED_XXD='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_CURL='06-ianaports.tpkg'
 NEED_WHOAMI='07-confroot.tpkg'
-NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg'
+NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg stub_udp6.tpkg'
 NEED_NOMINGW='tcp_sigpipe.tpkg 07-confroot.tpkg 08-host-lib.tpkg fwd_ancil.tpkg'
 
+# test if dig, wdiff and ldns-testns are available.
+if test ! -x "`which dig 2>&1`"; then echo No 'dig' in path; exit 1; fi
+if test ! -x "`which wdiff 2>&1`"; then echo No 'wdiff' in path; exit 1; fi
+if test ! -x "`which ldns-testns 2>&1`"; then echo No 'ldns-testns' in path; exit 1; fi
+
 # test for ipv6, uses streamptcp peculiarity.
 if ./streamtcp -f ::1 2>&1 | grep "not supported" >/dev/null 2>&1; then
 	HAVE_IPV6=no

testcode/fake_event.c

@@ -51,11 +51,13 @@
 #include "util/data/msgparse.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgencode.h"
+#include "util/config_file.h"
 #include "services/listen_dnsport.h"
 #include "services/outside_network.h"
 #include "testcode/replay.h"
 #include "testcode/ldns-testpkts.h"
 #include "util/log.h"
+#include "util/fptr_wlist.h"
 #include <signal.h>
 struct worker;
 
@@ -69,13 +71,25 @@ timeval_add(struct timeval* d, const struct timeval* add)
 #ifndef S_SPLINT_S
 	d->tv_sec += add->tv_sec;
 	d->tv_usec += add->tv_usec;
-	while(d->tv_usec > 1000000 ) {
+	if(d->tv_usec > 1000000) {
 		d->tv_usec -= 1000000;
 		d->tv_sec++;
 	}
 #endif
 }
 
+void 
+fake_temp_file(const char* adj, const char* id, char* buf, size_t len)
+{
+#ifdef USE_WINSOCK
+	snprintf(buf, len, "testbound_%u%s%s.tmp",
+		(unsigned)getpid(), adj, id);
+#else
+	snprintf(buf, len, "/tmp/testbound_%u%s%s.tmp",
+		(unsigned)getpid(), adj, id);
+#endif
+}
+
 void 
 fake_event_init(struct replay_scenario* scen)
 {
@@ -116,7 +130,10 @@ repevt_string(enum replay_event_type t)
 	case repevt_time_passes: return "TIME_PASSES";
 	case repevt_back_reply:  return "REPLY";
 	case repevt_back_query:  return "CHECK_OUT_QUERY";
+	case repevt_autotrust_check: return "CHECK_AUTOTRUST";
 	case repevt_error:	 return "ERROR";
+	case repevt_assign:	 return "ASSIGN";
+	case repevt_traffic:	 return "TRAFFIC";
 	default:		 return "UNKNOWN";
 	}
 }
@@ -424,17 +441,106 @@ fake_pending_callback(struct replay_runtime* runtime,
 	ldns_buffer_free(c.buffer);
 }
 
+/** pass time */
+static void
+moment_assign(struct replay_runtime* runtime, struct replay_moment* mom)
+{
+	char* value = macro_process(runtime->vars, runtime, mom->string);
+	if(!value)
+		fatal_exit("could not process macro step %d", mom->time_step);
+	log_info("assign %s = %s", mom->variable, value);
+	if(!macro_assign(runtime->vars, mom->variable, value))
+		fatal_exit("out of memory storing macro");
+	free(value);
+	if(verbosity >= VERB_ALGO)
+		macro_print_debug(runtime->vars);
+}
+
 /** pass time */
 static void
 time_passes(struct replay_runtime* runtime, struct replay_moment* mom)
 {
-	timeval_add(&runtime->now_tv, &mom->elapse);
+	struct fake_timer *t;
+	struct timeval tv = mom->elapse;
+	if(mom->string) {
+		char* xp = macro_process(runtime->vars, runtime, mom->string);
+		double sec;
+		if(!xp) fatal_exit("could not macro expand %s", mom->string);
+		verbose(VERB_ALGO, "EVAL %s", mom->string);
+		sec = atof(xp);
+		free(xp);
+#ifndef S_SPLINT_S
+		tv.tv_sec = sec;
+		tv.tv_usec = (int)((sec - (double)tv.tv_sec) *1000000. + 0.5);
+#endif
+	}
+	timeval_add(&runtime->now_tv, &tv);
 	runtime->now_secs = (uint32_t)runtime->now_tv.tv_sec;
 #ifndef S_SPLINT_S
 	log_info("elapsed %d.%6.6d  now %d.%6.6d", 
-		(int)mom->elapse.tv_sec, (int)mom->elapse.tv_usec,
+		(int)tv.tv_sec, (int)tv.tv_usec,
 		(int)runtime->now_tv.tv_sec, (int)runtime->now_tv.tv_usec);
 #endif
+	/* see if any timers have fired; and run them */
+	while( (t=replay_get_oldest_timer(runtime)) ) {
+		t->enabled = 0;
+		log_info("fake_timer callback");
+		fptr_ok(fptr_whitelist_comm_timer(t->cb));
+		(*t->cb)(t->cb_arg);
+	}
+}
+
+/** check autotrust file contents */
+static void
+autotrust_check(struct replay_runtime* runtime, struct replay_moment* mom)
+{
+	char name[1024], line[1024];
+	FILE *in;
+	int lineno = 0, oke=1;
+	char* expanded;
+	struct config_strlist* p;
+	line[sizeof(line)-1] = 0;
+	log_assert(mom->autotrust_id);
+	fake_temp_file("_auto_", mom->autotrust_id, name, sizeof(name));
+	in = fopen(name, "r");
+	if(!in) fatal_exit("could not open %s: %s", name, strerror(errno));
+	for(p=mom->file_content; p; p=p->next) {
+		lineno++;
+		if(!fgets(line, (int)sizeof(line)-1, in)) {
+			log_err("autotrust check failed, could not read line");
+			log_err("file %s, line %d", name, lineno);
+			log_err("should be: %s", p->str);
+			fatal_exit("autotrust_check failed");
+		}
+		if(line[0]) line[strlen(line)-1] = 0; /* remove newline */
+		expanded = macro_process(runtime->vars, runtime, p->str);
+		if(!expanded) 
+			fatal_exit("could not expand macro line %d", lineno);
+		if(verbosity >= 7 && strcmp(p->str, expanded) != 0)
+			log_info("expanded '%s' to '%s'", p->str, expanded);
+		if(strcmp(expanded, line) != 0) {
+			log_err("mismatch in file %s, line %d", name, lineno);
+			log_err("file has : %s", line);
+			log_err("should be: %s", expanded);
+			free(expanded);
+			oke = 0;
+			continue;
+		}
+		free(expanded);
+		fprintf(stderr, "%s:%2d ok : %s\n", name, lineno, line);
+	}
+	if(fgets(line, (int)sizeof(line)-1, in)) {
+		log_err("autotrust check failed, extra lines in %s after %d",
+			name, lineno);
+		do {
+			fprintf(stderr, "file has: %s", line);
+		} while(fgets(line, (int)sizeof(line)-1, in));
+		oke = 0;
+	}
+	fclose(in);
+	if(!oke)
+		fatal_exit("autotrust_check STEP %d failed", mom->time_step);
+	log_info("autotrust %s is OK", mom->autotrust_id);
 }
 
 /**
@@ -504,6 +610,17 @@ do_moment_and_advance(struct replay_runtime* runtime)
 		time_passes(runtime, runtime->now);
 		advance_moment(runtime);
 		break;
+	case repevt_autotrust_check:
+		autotrust_check(runtime, runtime->now);
+		advance_moment(runtime);
+		break;
+	case repevt_assign:
+		moment_assign(runtime, runtime->now);
+		advance_moment(runtime);
+		break;
+	case repevt_traffic:
+		advance_moment(runtime);
+		break;
 	default:
 		fatal_exit("testbound: unknown event type %d", 
 			runtime->now->evt_type);
@@ -516,7 +633,7 @@ run_scenario(struct replay_runtime* runtime)
 {
 	struct entry* entry = NULL;
 	struct fake_pending* pending = NULL;
-	int max_rounds = 50;
+	int max_rounds = 5000;
 	int rounds = 0;
 	runtime->now = runtime->scenario->mom_first;
 	log_info("testbound: entering fake runloop");
@@ -602,6 +719,8 @@ comm_base_create(int ATTR_UNUSED(sigs))
 	struct replay_runtime* runtime = (struct replay_runtime*)
 		calloc(1, sizeof(struct replay_runtime));
 	runtime->scenario = saved_scenario;
+	runtime->vars = macro_store_create();
+	if(!runtime->vars) fatal_exit("out of memory");
 	return (struct comm_base*)runtime;
 }
 
@@ -611,6 +730,7 @@ comm_base_delete(struct comm_base* b)
 	struct replay_runtime* runtime = (struct replay_runtime*)b;
 	struct fake_pending* p, *np;
 	struct replay_answer* a, *na;
+	struct fake_timer* t, *nt;
 	if(!runtime)
 		return;
 	runtime->scenario= NULL;
@@ -626,6 +746,13 @@ comm_base_delete(struct comm_base* b)
 		delete_replay_answer(a);
 		a = na;
 	}
+	t = runtime->timer_list;
+	while(t) {
+		nt = t->next;
+		free(t);
+		t = nt;
+	}
+	macro_store_delete(runtime->vars);
 	free(runtime);
 }
 
@@ -726,7 +853,8 @@ outside_network_create(struct comm_base* base, size_t bufsize,
 	struct ub_randstate* ATTR_UNUSED(rnd), 
 	int ATTR_UNUSED(use_caps_for_id), int* ATTR_UNUSED(availports),
 	int ATTR_UNUSED(numavailports), size_t ATTR_UNUSED(unwanted_threshold),
-	void (*unwanted_action)(void*), void* ATTR_UNUSED(unwanted_param))
+	void (*unwanted_action)(void*), void* ATTR_UNUSED(unwanted_param),
+	int ATTR_UNUSED(do_udp))
 {
 	struct outside_network* outnet =  calloc(1, 
 		sizeof(struct outside_network));
@@ -860,10 +988,10 @@ pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr,
-	socklen_t addrlen, comm_point_callback_t* callback,
-	void* callback_arg, ldns_buffer* ATTR_UNUSED(buff),
-	int (*arg_compare)(void*,void*))
+	uint16_t flags, int dnssec, int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	comm_point_callback_t* callback, void* callback_arg, 
+	ldns_buffer* ATTR_UNUSED(buff), int (*arg_compare)(void*,void*))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,
@@ -1138,25 +1266,57 @@ int serviced_cmp(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
 	return 0;
 }
 
-/* no statistics timers in testbound */
-struct comm_timer* comm_timer_create(struct comm_base* ATTR_UNUSED(base), 
-	void (*cb)(void*), void* ATTR_UNUSED(cb_arg))
+/* timers in testbound for autotrust. statistics tested in tpkg. */
+struct comm_timer* comm_timer_create(struct comm_base* base, 
+	void (*cb)(void*), void* cb_arg)
 {
-	(void)cb;
-	return malloc(1);
+	struct replay_runtime* runtime = (struct replay_runtime*)base;
+	struct fake_timer* t = (struct fake_timer*)calloc(1, sizeof(*t));
+	t->cb = cb;
+	t->cb_arg = cb_arg;
+	fptr_ok(fptr_whitelist_comm_timer(t->cb)); /* check in advance */
+	t->runtime = runtime;
+	t->next = runtime->timer_list;
+	runtime->timer_list = t;
+	return (struct comm_timer*)t;
 }
 
-void comm_timer_disable(struct comm_timer* ATTR_UNUSED(timer))
+void comm_timer_disable(struct comm_timer* timer)
 {
+	struct fake_timer* t = (struct fake_timer*)timer;
+	log_info("fake timer disabled");
+	t->enabled = 0;
 }
 
-void comm_timer_set(struct comm_timer* ATTR_UNUSED(timer), 
-	struct timeval* ATTR_UNUSED(tv))
+void comm_timer_set(struct comm_timer* timer, struct timeval* tv)
 {
+	struct fake_timer* t = (struct fake_timer*)timer;
+	t->enabled = 1;
+	t->tv = *tv;
+	log_info("fake timer set %d.%6.6d", 
+		(int)t->tv.tv_sec, (int)t->tv.tv_usec);
+	timeval_add(&t->tv, &t->runtime->now_tv);
 }
 
 void comm_timer_delete(struct comm_timer* timer)
 {
+	struct fake_timer* t = (struct fake_timer*)timer;
+	struct fake_timer** pp, *p;
+	if(!t) return;
+
+	/* remove from linked list */
+	pp = &t->runtime->timer_list;
+	p = t->runtime->timer_list;
+	while(p) {
+		if(p == t) {
+			/* snip from list */
+			*pp = p->next;
+			break;
+		}
+		pp = &p->next;
+		p = p->next;
+	}
+
 	free(timer);
 }
 

testcode/fake_event.h

@@ -63,4 +63,13 @@ void fake_event_init(struct replay_scenario* scen);
  */
 void fake_event_cleanup();
 
+/**
+ * Get filename to store temporary config stuff. The pid is added. in /tmp.
+ * @param adj: adjective, like "_cfg_", "_auto_"
+ * @param id: identifier, like "example.com".
+ * @param buf: where to store.
+ * @param len: length of buf.
+ */
+void fake_temp_file(const char* adj, const char* id, char* buf, size_t len);
+
 #endif /* TESTCODE_FAKE_EVENT_H */

testcode/harvest.c

@@ -69,11 +69,23 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#include "ldns/ldns.h"
 #include <signal.h>
 #include "libunbound/unbound.h"
 #ifdef HAVE_SYS_STAT_H
 #include <sys/stat.h>
 #endif
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef realloc
+#undef free
+#undef strdup
+#define unbound_lite_wrapstr(s) s
+#endif
 struct todo_item;
 struct labdata;
 

testcode/ldns-testpkts.c

@@ -31,8 +31,12 @@ struct sockaddr_storage;
 /** string to show in warnings and errors */
 static const char* prog_name = "ldns-testpkts";
 
+#ifndef UTIL_LOG_H
+/** verbosity definition for compat */
+enum verbosity_value { NO_VERBOSE=0 };
+#endif
 /** logging routine, provided by caller */
-void verbose(int lvl, const char* msg, ...);
+void verbose(enum verbosity_value lvl, const char* msg, ...) ATTR_FORMAT(printf, 2, 3);
 
 /** print error and exit */
 static void error(const char* msg, ...)
@@ -589,12 +593,12 @@ match_list(ldns_rr_list* q, ldns_rr_list *p, bool mttl)
 	{
 		if(ldns_rr_compare(ldns_rr_list_rr(q, i), 
 			ldns_rr_list_rr(p, i)) != 0) {
-			verbose(3, "rr %d different", i);
+			verbose(3, "rr %d different", (int)i);
 			return 0;
 		}
 		if(mttl && ldns_rr_ttl(ldns_rr_list_rr(q, i)) !=
 			ldns_rr_ttl(ldns_rr_list_rr(p, i))) {
-			verbose(3, "rr %d ttl different", i);
+			verbose(3, "rr %d ttl different", (int)i);
 			return 0;
 		}
 	}
@@ -768,7 +772,7 @@ handle_query(uint8_t* inbuf, ssize_t inlen, struct entry* entries, int* count,
 	
 	query_rr = ldns_rr_list_rr(ldns_pkt_question(query_pkt), 0);
 	verbose(1, "query %d: id %d: %s %d bytes: ", ++(*count), (int)ldns_pkt_id(query_pkt), 
-		(transport==transport_tcp)?"TCP":"UDP", inlen);
+		(transport==transport_tcp)?"TCP":"UDP", (int)inlen);
 	if(verbose_out) ldns_rr_print(verbose_out, query_rr);
 	if(verbose_out) ldns_pkt_print(verbose_out, query_pkt);
 

testcode/memstats.c

@@ -80,16 +80,18 @@ match(char* line)
 	/* f.e.:
 	 * [1187340064] unbound[24604:0] info: ul/rb.c:81 r_create malloc(12)
 	 * 0123456789 123456789 123456789 123456789
+	 * But now also:
+	 * Sep 16 15:18:20 unbound[1:0] info: ul/nh.c:143 memdup malloc(11)
 	 */
-	if(strlen(line) < 36) /* up to 'info: ' */
+	if(strlen(line) < 32) /* up to 'info: ' */
 		return 0;
-	if(strncmp(line+30, "info: ", 6) != 0)
+	if(!strstr(line, " info: "))
 		return 0;
-	if(strncmp(line+36, "stat ", 5) == 0)
+	if(strstr(line, "info: stat "))
 		return 0; /* skip the hex dumps */
-	if(strstr(line+36, "malloc("))
+	if(strstr(line+30, "malloc("))
 		return 1;
-	else if(strstr(line+36, "calloc("))
+	else if(strstr(line+30, "calloc("))
 		return 1;
 	/* skip reallocs */
 	return 0;
@@ -123,12 +125,13 @@ read_malloc_stat(char* line, rbtree_t* tree)
 	int skip = 0;
 	long num = 0;
 	struct codeline* cl = 0;
-	if(sscanf(line+36, "%s %s %n", codeline, name, &skip) != 2) {
-		printf("%s\n%s\n", line, line+36);
+	line = strstr(line, "info: ")+6;
+	if(sscanf(line, "%s %s %n", codeline, name, &skip) != 2) {
+		printf("%s\n", line);
 		fatal_exit("unhandled malloc");
 	}
-	if(sscanf(line+36+skip+7, "%ld", &num) != 1) {
-		printf("%s\n%s\n", line, line+36+skip+7);
+	if(sscanf(line+skip+7, "%ld", &num) != 1) {
+		printf("%s\n%s\n", line, line+skip+7);
 		fatal_exit("unhandled malloc");
 	}
 	cl = get_codeline(tree, codeline, name);
@@ -147,12 +150,13 @@ read_calloc_stat(char* line, rbtree_t* tree)
 	int skip = 0;
 	long num = 0, sz = 0;
 	struct codeline* cl = 0;
-	if(sscanf(line+36, "%s %s %n", codeline, name, &skip) != 2) {
-		printf("%s\n%s\n", line, line+36);
+	line = strstr(line, "info: ")+6;
+	if(sscanf(line, "%s %s %n", codeline, name, &skip) != 2) {
+		printf("%s\n", line);
 		fatal_exit("unhandled calloc");
 	}
-	if(sscanf(line+36+skip+7, "%ld, %ld", &num, &sz) != 2) {
-		printf("%s\n%s\n", line, line+36+skip+7);
+	if(sscanf(line+skip+7, "%ld, %ld", &num, &sz) != 2) {
+		printf("%s\n%s\n", line, line+skip+7);
 		fatal_exit("unhandled calloc");
 	}
 
@@ -197,9 +201,9 @@ readfile(rbtree_t* tree, const char* fname)
 
 		if(!match(buf))
 			continue;
-		else if(strstr(buf+36, "malloc("))
+		else if(strstr(buf+30, "malloc("))
 			read_malloc_stat(buf, tree);
-		else if(strstr(buf+36, "calloc("))
+		else if(strstr(buf+30, "calloc("))
 			read_calloc_stat(buf, tree);
 		else {
 			printf("%s\n", buf);