Fix daemonize on Solaris 10.

git-svn-id: file:///svn/unbound/trunk@2026 be551aaa-1e26-0410-a405-d3ace91eadb9

Makefile.in

@@ -364,7 +364,7 @@ strip:
 	$(STRIP) unbound-control$(EXEEXT)
 	$(STRIP) unbound-host$(EXEEXT)
 
-install:
+install:	all
 	$(INSTALL) -m 755 -d $(DESTDIR)$(sbindir)
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)
 	$(INSTALL) -m 755 -d $(DESTDIR)$(mandir)/man8
@@ -385,6 +385,7 @@ ifeq "$(WITH_PYUNBOUND)" "yes"
 	$(INSTALL) -m 755 -d $(DESTDIR)$(PYTHON_SITE_PKG)
 	$(INSTALL) -c -m 644 libunbound/python/unbound.py $(DESTDIR)$(PYTHON_SITE_PKG)/unbound.py
 	$(LIBTOOL) --mode=install cp _unbound.la $(DESTDIR)$(PYTHON_SITE_PKG)
+	$(LIBTOOL) --mode=finish $(DESTDIR)$(PYTHON_SITE_PKG)
 endif
 	$(INSTALL) -c -m 644 doc/unbound.8 $(DESTDIR)$(mandir)/man8
 	$(INSTALL) -c -m 644 doc/unbound-checkconf.8 $(DESTDIR)$(mandir)/man8

aclocal.m4

@@ -1,4 +1,4 @@
-# generated automatically by aclocal 1.11 -*- Autoconf -*-
+# generated automatically by aclocal 1.11.1 -*- Autoconf -*-
 
 # Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004,
 # 2005, 2006, 2007, 2008, 2009  Free Software Foundation, Inc.
@@ -7854,15 +7854,15 @@ m4_define([lt_dict_filter],
 
 # Generated from ltversion.in.
 
-# serial 3012 ltversion.m4
+# serial 3017 ltversion.m4
 # This file is part of GNU Libtool
 
-m4_define([LT_PACKAGE_VERSION], [2.2.6])
-m4_define([LT_PACKAGE_REVISION], [1.3012])
+m4_define([LT_PACKAGE_VERSION], [2.2.6b])
+m4_define([LT_PACKAGE_REVISION], [1.3017])
 
 AC_DEFUN([LTVERSION_VERSION],
-[macro_version='2.2.6'
-macro_revision='1.3012'
+[macro_version='2.2.6b'
+macro_revision='1.3017'
 _LT_DECL(, macro_version, 0, [Which release of libtool.m4 was used?])
 _LT_DECL(, macro_revision, 0)
 ])

acx_nlnetlabs.m4

@@ -2,8 +2,11 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 4
-# Changelog
+# Version 8
+# 2010-03-01 Fix RPATH using CONFIG_COMMANDS to run at the very end.
+# 2010-02-18 WITH_SSL outputs the LIBSSL_LDFLAGS, LIBS, CPPFLAGS seperate, -ldl
+# 2010-02-01 added ACX_CHECK_MEMCMP_SIGNED, AHX_MEMCMP_BROKEN
+# 2010-01-20 added AHX_COONFIG_STRLCAT
 # 2009-07-14 U_CHAR detection improved for windows crosscompile.
 #            added ACX_FUNC_MALLOC
 #            fixup some #if to #ifdef
@@ -55,6 +58,7 @@
 # AHX_CONFIG_INET_NTOP		- inet_ntop compat prototype
 # AHX_CONFIG_INET_ATON		- inet_aton compat prototype
 # AHX_CONFIG_MEMMOVE		- memmove compat prototype
+# AHX_CONFIG_STRLCAT		- strlcat compat prototype
 # AHX_CONFIG_STRLCPY		- strlcpy compat prototype
 # AHX_CONFIG_GMTIME_R		- gmtime_r compat prototype
 # AHX_CONFIG_W32_SLEEP		- w32 compat for sleep
@@ -67,6 +71,8 @@
 # AHX_CONFIG_FLAG_OMITTED	- define omitted flag
 # AHX_CONFIG_FLAG_EXT		- define omitted extension flag
 # AHX_CONFIG_EXT_FLAGS		- define the stripped extension flags
+# ACX_CHECK_MEMCMP_SIGNED	- check if memcmp uses signed characters.
+# AHX_MEMCMP_BROKEN		- replace memcmp func for CHECK_MEMCMP_SIGNED.
 #
 
 dnl Escape backslashes as \\, for C:\ paths, for the C preprocessor defines.
@@ -551,12 +557,14 @@ AC_ARG_ENABLE(rpath,
         [  --disable-rpath         disable hardcoded rpath (default=enabled)],
 	enable_rpath=$enableval, enable_rpath=yes)
 if test "x$enable_rpath" = xno; then
-	AC_MSG_RESULT([Fixing libtool for -rpath problems.])
+	dnl AC_MSG_RESULT([Fixing libtool for -rpath problems.])
+	AC_CONFIG_COMMANDS([disable-rpath], [
 	sed < libtool > libtool-2 \
 	's/^hardcode_libdir_flag_spec.*$'/'hardcode_libdir_flag_spec=" -D__LIBTOOL_RPATH_SED__ "/'
 	mv libtool-2 libtool
 	chmod 755 libtool
 	libtool="./libtool"
+	])
 fi
 ])
 
@@ -589,6 +597,7 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                 dnl assume /usr/include is already in the include-path.
                 if test "$ssldir" != "/usr"; then
                         CPPFLAGS="$CPPFLAGS -I$ssldir/include"
+                        LIBSSL_CPPFLAGS="$LIBSSL_CPPFLAGS -I$ssldir/include"
                 fi
                 break;
             fi
@@ -601,11 +610,13 @@ AC_DEFUN([ACX_SSL_CHECKS], [
             dnl assume /usr is already in the lib and dynlib paths.
             if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
                 LDFLAGS="$LDFLAGS -L$ssldir/lib"
+                LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib"
                 ACX_RUNTIME_PATH_ADD([$ssldir/lib])
             fi
         
             AC_MSG_CHECKING([for HMAC_CTX_init in -lcrypto])
             LIBS="$LIBS -lcrypto"
+            LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
             AC_TRY_LINK(, [
                 int HMAC_CTX_init(void);
                 (void)HMAC_CTX_init();
@@ -617,7 +628,9 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                 AC_MSG_RESULT(no)
                 # check if -lwsock32 or -lgdi32 are needed.	
                 BAKLIBS="$LIBS"
+                BAKSSLLIBS="$LIBSSL_LIBS"
                 LIBS="$LIBS -lgdi32"
+                LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32"
                 AC_MSG_CHECKING([if -lcrypto needs -lgdi32])
                 AC_TRY_LINK([], [
                     int HMAC_CTX_init(void);
@@ -629,7 +642,9 @@ AC_DEFUN([ACX_SSL_CHECKS], [
                   ],[
                     AC_MSG_RESULT(no)
                     LIBS="$BAKLIBS"
+                    LIBSSL_LIBS="$BAKSSLLIBS"
                     LIBS="$LIBS -ldl"
+                    LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
                     AC_MSG_CHECKING([if -lcrypto needs -ldl])
                     AC_TRY_LINK([], [
                         int HMAC_CTX_init(void);
@@ -647,6 +662,12 @@ AC_DEFUN([ACX_SSL_CHECKS], [
         fi
         AC_SUBST(HAVE_SSL)
         AC_SUBST(RUNTIME_PATH)
+	# openssl engine functionality needs dlopen().
+	BAKLIBS="$LIBS"
+	AC_SEARCH_LIBS([dlopen], [dl])
+	if test "$LIBS" != "$BAKLIBS"; then
+		LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
+	fi
     fi
 AC_CHECK_HEADERS([openssl/ssl.h],,, [AC_INCLUDES_DEFAULT])
 AC_CHECK_HEADERS([openssl/err.h],,, [AC_INCLUDES_DEFAULT])
@@ -1088,6 +1109,16 @@ void *memmove(void *dest, const void *src, size_t n);
 #endif
 ])
 
+dnl provide strlcat compat prototype.
+dnl $1: unique name for compat code
+AC_DEFUN([AHX_CONFIG_STRLCAT],
+[
+#ifndef HAVE_STRLCAT
+#define strlcat strlcat_$1
+size_t strlcat(char *dst, const char *src, size_t siz);
+#endif
+])
+
 dnl provide strlcpy compat prototype.
 dnl $1: unique name for compat code
 AC_DEFUN([AHX_CONFIG_STRLCPY],
@@ -1204,4 +1235,38 @@ AHX_CONFIG_FLAG_EXT(-D_ALL_SOURCE)
 AHX_CONFIG_FLAG_EXT(-D_LARGEFILE_SOURCE=1)
 ])
 
+dnl check if memcmp is using signed characters and replace if so.
+AC_DEFUN([ACX_CHECK_MEMCMP_SIGNED],
+[AC_MSG_CHECKING([if memcmp compares unsigned])
+AC_RUN_IFELSE([AC_LANG_SOURCE([[
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+int main(void)
+{
+	char a = 255, b = 0;
+	if(memcmp(&a, &b, 1) < 0)
+		return 1;
+	return 0;
+}
+]])], [AC_MSG_RESULT([yes]) ],
+[ AC_MSG_RESULT([no])
+  AC_DEFINE([MEMCMP_IS_BROKEN], [1], [Define if memcmp() does not compare unsigned bytes])
+  AC_LIBOBJ([memcmp])
+], [ AC_MSG_RESULT([cross-compile no])
+  AC_DEFINE([MEMCMP_IS_BROKEN], [1], [Define if memcmp() does not compare unsigned bytes])
+  AC_LIBOBJ([memcmp]) 
+]) ])
+
+dnl define memcmp to its replacement, pass unique id for program as arg
+AC_DEFUN([AHX_MEMCMP_BROKEN], [
+#ifdef MEMCMP_IS_BROKEN
+#  ifdef memcmp
+#  undef memcmp
+#  endif
+#define memcmp memcmp_$1
+int memcmp(const void *x, const void *y, size_t n);
+#endif
+])
+
 dnl End of file

compat/memcmp.c

@@ -0,0 +1,25 @@
+/*
+ *	memcmp.c: memcmp compat implementation.
+ *
+ *	Copyright (c) 2010, NLnet Labs. All rights reserved.
+ *
+ * See LICENSE for the license.
+*/
+
+#include <config.h>
+
+int memcmp(const void *x, const void *y, size_t n);
+
+int memcmp(const void *x, const void *y, size_t n)
+{
+	const uint8_t* x8 = (const uint8_t*)x;
+	const uint8_t* y8 = (const uint8_t*)y;
+	size_t i;
+	for(i=0; i<n; i++) {
+		if(x8[i] < y8[i])
+			return -1;
+		else if(x8[i] > y8[i])
+			return 1;
+	}
+	return 0;
+}

compat/snprintf.c

@@ -40,6 +40,9 @@
  *           gcc -DTEST_SNPRINTF -o snprintf snprintf.c -lm
  *    and run snprintf for results.
  *
+ *  Wouter Wijngaards(wouter@nlnetlabs.nl) 2/09/2010 for unbound.
+ *    Limited support for %g.  Does not do the exponents for the before-dot.
+ *
  **************************************************************/
 
 
@@ -75,7 +78,7 @@ static void fmtstr (char *buffer, size_t *currlen, size_t maxlen,
 static void fmtint (char *buffer, size_t *currlen, size_t maxlen,
 		    long value, int base, int min, int max, int flags);
 static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
-		   long double fvalue, int min, int max, int flags);
+		   long double fvalue, int min, int max, int flags, int conv);
 static void dopr_outch (char *buffer, size_t *currlen, size_t maxlen, char c );
 
 int vsnprintf (char *str, size_t count, const char *fmt, va_list args)
@@ -313,7 +316,7 @@ static void dopr (char *buffer, size_t maxlen, const char *format, va_list args)
 	else
 	  fvalue = va_arg (args, double);
 	/* um, floating point? */
-	fmtfp (buffer, &currlen, maxlen, fvalue, min, max, flags);
+	fmtfp (buffer, &currlen, maxlen, fvalue, min, max, flags, 'f');
 	break;
       case 'E':
 	flags |= DP_F_UP;
@@ -330,6 +333,7 @@ static void dopr (char *buffer, size_t maxlen, const char *format, va_list args)
 	  fvalue = va_arg (args, long double);
 	else
 	  fvalue = va_arg (args, double);
+	fmtfp (buffer, &currlen, maxlen, fvalue, min, max, flags, 'g');
 	break;
       case 'c':
 	dopr_outch (buffer, &currlen, maxlen, va_arg (args, int));
@@ -554,7 +558,7 @@ static long compat_round (long double value)
 }
 
 static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
-		   long double fvalue, int min, int max, int flags)
+		   long double fvalue, int min, int max, int flags, int conv)
 {
   int signvalue = 0;
   long double ufvalue;
@@ -628,13 +632,26 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
     fconvert[fplace++] =
       (caps? "0123456789ABCDEF":"0123456789abcdef")[fracpart % 10];
     fracpart = (fracpart / 10);
+    if(conv == 'g' && fplace == 1 && fconvert[0] == '0') {
+      fplace = 0; /* skip trailing zeroes for %g */
+      zpadlen ++;
+    }
   } while(fracpart && (fplace < 20));
   if (fplace == 20) fplace--;
   fconvert[fplace] = 0;
 
-  /* -1 for decimal point, another -1 if we are printing a sign */
-  padlen = min - iplace - max - 1 - ((signvalue) ? 1 : 0); 
-  zpadlen = max - fplace;
+  if(conv == 'f') {
+    /* -1 for decimal point, another -1 if we are printing a sign */
+    padlen = min - iplace - max - 1 - ((signvalue) ? 1 : 0); 
+    zpadlen = max - fplace;
+  } else if(conv == 'g') {
+    /* zpadlen contains number of trailing zeroes removed */
+    padlen = min - iplace - (max-zpadlen) - 1 - ((signvalue) ? 1 : 0); 
+    if(fplace == 0) {
+      padlen += 1; /* add the decimal dot suppressed */
+      zpadlen = 0;
+    } else zpadlen = (max-zpadlen) - fplace;
+  }
   if (zpadlen < 0)
     zpadlen = 0;
   if (padlen < 0) 
@@ -667,14 +684,14 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
   while (iplace > 0) 
     dopr_outch (buffer, currlen, maxlen, iconvert[--iplace]);
 
-  /*
-   * Decimal point.  This should probably use locale to find the correct
-   * char to print out.
-   */
-  dopr_outch (buffer, currlen, maxlen, '.');
-
-  while (fplace > 0) 
-    dopr_outch (buffer, currlen, maxlen, fconvert[--fplace]);
+  /* for %g do not output decimal point if no fraction is present */
+  if(conv == 'f' || (conv == 'g' && fplace > 0)) {
+    /*
+     * Decimal point.  This should probably use locale to find the correct
+     * char to print out.
+     */
+    dopr_outch (buffer, currlen, maxlen, '.');
+  }
 
   while (zpadlen > 0)
   {
@@ -682,6 +699,9 @@ static void fmtfp (char *buffer, size_t *currlen, size_t maxlen,
     --zpadlen;
   }
 
+  while (fplace > 0) 
+    dopr_outch (buffer, currlen, maxlen, fconvert[--fplace]);
+
   while (padlen < 0) 
   {
     dopr_outch (buffer, currlen, maxlen, ' ');

config.h.in

@@ -131,6 +131,9 @@
 /* Define to 1 if you have the `kill' function. */
 #undef HAVE_KILL
 
+/* Define to 1 if you have the <ldns/ldns.h> header file. */
+#undef HAVE_LDNS_LDNS_H
+
 /* Define to 1 if you have the `ldns' library (-lldns). */
 #undef HAVE_LIBLDNS
 
@@ -340,6 +343,9 @@
 /* Define to the maximum message length to pass to syslog. */
 #undef MAXSYSLOGMSGLEN
 
+/* Define if memcmp() does not compare unsigned bytes */
+#undef MEMCMP_IS_BROKEN
+
 /* Define if mkdir has one argument. */
 #undef MKDIR_HAS_ONE_ARG
 
@@ -414,6 +420,12 @@
 /* default username */
 #undef UB_USERNAME
 
+/* use to enable lightweight alloc assertions, for debug use */
+#undef UNBOUND_ALLOC_LITE
+
+/* use malloc not regions, for debug use */
+#undef UNBOUND_ALLOC_NONREGIONAL
+
 /* use statistics for allocs and frees, for debug use */
 #undef UNBOUND_ALLOC_STATS
 
@@ -771,6 +783,15 @@ struct tm *gmtime_r(const time_t *timep, struct tm *result);
 #endif /* IPV6_MIN_MTU */
 
 
+#ifdef MEMCMP_IS_BROKEN
+#  ifdef memcmp
+#  undef memcmp
+#  endif
+#define memcmp memcmp_unbound
+int memcmp(const void *x, const void *y, size_t n);
+#endif
+
+
 
 #ifndef HAVE_CTIME_R
 #define ctime_r unbound_ctime_r
@@ -817,7 +838,9 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-#endif /* UNBOUND_ALLOC_STATS */
+#elif defined(UNBOUND_ALLOC_LITE)
+#  include "util/alloc.h"
+#endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53

configure

@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.63 for unbound 1.4.0.
+# Generated by GNU Autoconf 2.63 for unbound 1.4.3.
 #
 # Report bugs to <unbound-bugs@nlnetlabs.nl>.
 #
@@ -745,8 +745,8 @@ SHELL=${CONFIG_SHELL-/bin/sh}
 # Identity of this package.
 PACKAGE_NAME='unbound'
 PACKAGE_TARNAME='unbound'
-PACKAGE_VERSION='1.4.0'
-PACKAGE_STRING='unbound 1.4.0'
+PACKAGE_VERSION='1.4.3'
+PACKAGE_STRING='unbound 1.4.3'
 PACKAGE_BUGREPORT='unbound-bugs@nlnetlabs.nl'
 
 # Factoring default headers for most tests.
@@ -791,7 +791,6 @@ subdirs
 ldnsdir
 WINDRES
 UB_ON_WINDOWS
-LIBOBJS
 CHECKLOCK_SRC
 staticexe
 RUNTIME_PATH
@@ -812,6 +811,7 @@ PTHREAD_CFLAGS
 PTHREAD_LIBS
 PTHREAD_CC
 acx_pthread_config
+LIBOBJS
 OTOOL64
 OTOOL
 LIPO
@@ -912,6 +912,7 @@ with_chroot_dir
 with_share_dir
 with_pidfile
 with_username
+enable_checking
 enable_debug
 enable_shared
 enable_static
@@ -931,6 +932,8 @@ with_libevent
 enable_staticexe
 enable_lock_checks
 enable_alloc_checks
+enable_alloc_lite
+enable_alloc_nonregional
 enable_largefile
 with_ldns
 with_ldns_builtin
@@ -1499,7 +1502,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures unbound 1.4.0 to adapt to many kinds of systems.
+\`configure' configures unbound 1.4.3 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1564,7 +1567,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of unbound 1.4.0:";;
+     short | recursive ) echo "Configuration of unbound 1.4.3:";;
    esac
   cat <<\_ACEOF
 
@@ -1572,8 +1575,8 @@ Optional Features:
   --disable-option-checking  ignore unrecognized --enable/--with options
   --disable-FEATURE       do not include FEATURE (same as --enable-FEATURE=no)
   --enable-FEATURE[=ARG]  include FEATURE [ARG=yes]
-  --enable-debug          Enable debug warnings, asserts,
-                          makefile-dependencies
+  --enable-checking       Enable warnings, asserts, makefile-dependencies
+  --enable-debug          same as enable-checking
   --enable-shared[=PKGS]  build shared libraries [default=yes]
   --enable-static[=PKGS]  build static libraries [default=yes]
   --enable-fast-install[=PKGS]
@@ -1586,7 +1589,13 @@ Optional Features:
                           event, ldns libs, for debug purposes
   --enable-lock-checks    enable to check lock and unlock calls, for debug
                           purposes
-  --enable-alloc-checks   enable to check memory allocation, for debug
+  --enable-alloc-checks   enable to memory allocation statistics, for debug
+                          purposes
+  --enable-alloc-lite     enable for lightweight alloc assertions, for debug
+                          purposes
+  --enable-alloc-nonregional
+                          enable nonregional allocs, slow but exposes regional
+                          allocations to other memory purifiers, for debug
                           purposes
   --disable-largefile     omit support for large files
 
@@ -1710,7 +1719,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-unbound configure 1.4.0
+unbound configure 1.4.3
 generated by GNU Autoconf 2.63
 
 Copyright (C) 1992, 1993, 1994, 1995, 1996, 1998, 1999, 2000, 2001,
@@ -1724,7 +1733,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by unbound $as_me 1.4.0, which was
+It was created by unbound $as_me 1.4.3, which was
 generated by GNU Autoconf 2.63.  Invocation command line was
 
   $ $0 $@
@@ -2093,8 +2102,8 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
 
-LIBUNBOUND_CURRENT=1
-LIBUNBOUND_REVISION=5
+LIBUNBOUND_CURRENT=2
+LIBUNBOUND_REVISION=3
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -2109,7 +2118,10 @@ LIBUNBOUND_AGE=0
 # 1.3.3 had 1:3:0
 # 1.3.4 had 1:4:0
 # 1.4.0-snapshots had 1:5:0
-# 1.4.0 had 2:0:0   # ub_result.why_bogus
+# 1.4.0 had 1:5:0 (not 2:0:0)   # ub_result.why_bogus
+# 1.4.1 had 2:1:0
+# 1.4.2 had 2:2:0
+# 1.4.3 had 2:3:0
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -5801,14 +5813,20 @@ fi
 
 
 # debug mode flags warnings
+# Check whether --enable-checking was given.
+if test "${enable_checking+set}" = set; then
+  enableval=$enable_checking;
+fi
+
 # Check whether --enable-debug was given.
 if test "${enable_debug+set}" = set; then
   enableval=$enable_debug;
 fi
 
-debug_enabled="$enable_debug"
+if test "$enable_debug" = "yes"; then debug_enabled="$enable_debug";
+else debug_enabled="$enable_checking"; fi
 
-case "$enable_debug" in
+case "$debug_enabled" in
         yes)
 
 
@@ -6803,8 +6821,8 @@ esac
 
 
 
-macro_version='2.2.6'
-macro_revision='1.3012'
+macro_version='2.2.6b'
+macro_revision='1.3017'
 
 
 
@@ -7280,13 +7298,13 @@ if test "${lt_cv_nm_interface+set}" = set; then
 else
   lt_cv_nm_interface="BSD nm"
   echo "int some_variable = 0;" > conftest.$ac_ext
-  (eval echo "\"\$as_me:7283: $ac_compile\"" >&5)
+  (eval echo "\"\$as_me:7301: $ac_compile\"" >&5)
   (eval "$ac_compile" 2>conftest.err)
   cat conftest.err >&5
-  (eval echo "\"\$as_me:7286: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
+  (eval echo "\"\$as_me:7304: $NM \\\"conftest.$ac_objext\\\"\"" >&5)
   (eval "$NM \"conftest.$ac_objext\"" 2>conftest.err > conftest.out)
   cat conftest.err >&5
-  (eval echo "\"\$as_me:7289: output\"" >&5)
+  (eval echo "\"\$as_me:7307: output\"" >&5)
   cat conftest.out >&5
   if $GREP 'External.*some_variable' conftest.out > /dev/null; then
     lt_cv_nm_interface="MS dumpbin"
@@ -8491,7 +8509,7 @@ ia64-*-hpux*)
   ;;
 *-*-irix6*)
   # Find out which ABI we are using.
-  echo '#line 8494 "configure"' > conftest.$ac_ext
+  echo '#line 8512 "configure"' > conftest.$ac_ext
   if { (eval echo "$as_me:$LINENO: \"$ac_compile\"") >&5
   (eval $ac_compile) 2>&5
   ac_status=$?
@@ -9858,11 +9876,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:9861: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:9879: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:9865: \$? = $ac_status" >&5
+   echo "$as_me:9883: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -10197,11 +10215,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:10200: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:10218: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>conftest.err)
    ac_status=$?
    cat conftest.err >&5
-   echo "$as_me:10204: \$? = $ac_status" >&5
+   echo "$as_me:10222: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s "$ac_outfile"; then
      # The compiler can only warn and ignore the option if not recognized
      # So say no if there are warnings other than the usual output.
@@ -10302,11 +10320,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:10305: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:10323: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:10309: \$? = $ac_status" >&5
+   echo "$as_me:10327: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -10357,11 +10375,11 @@ else
    -e 's:.*FLAGS}\{0,1\} :&$lt_compiler_flag :; t' \
    -e 's: [^ ]*conftest\.: $lt_compiler_flag&:; t' \
    -e 's:$: $lt_compiler_flag:'`
-   (eval echo "\"\$as_me:10360: $lt_compile\"" >&5)
+   (eval echo "\"\$as_me:10378: $lt_compile\"" >&5)
    (eval "$lt_compile" 2>out/conftest.err)
    ac_status=$?
    cat out/conftest.err >&5
-   echo "$as_me:10364: \$? = $ac_status" >&5
+   echo "$as_me:10382: \$? = $ac_status" >&5
    if (exit $ac_status) && test -s out/conftest2.$ac_objext
    then
      # The compiler can only warn and ignore the option if not recognized
@@ -13160,7 +13178,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 13163 "configure"
+#line 13181 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -13256,7 +13274,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat > conftest.$ac_ext <<_LT_EOF
-#line 13259 "configure"
+#line 13277 "configure"
 #include "confdefs.h"
 
 #if HAVE_DLFCN_H
@@ -15452,6 +15470,93 @@ _ACEOF
 
 fi
 
+{ $as_echo "$as_me:$LINENO: checking if memcmp compares unsigned" >&5
+$as_echo_n "checking if memcmp compares unsigned... " >&6; }
+if test "$cross_compiling" = yes; then
+   { $as_echo "$as_me:$LINENO: result: cross-compile no" >&5
+$as_echo "cross-compile no" >&6; }
+
+cat >>confdefs.h <<\_ACEOF
+#define MEMCMP_IS_BROKEN 1
+_ACEOF
+
+  case " $LIBOBJS " in
+  *" memcmp.$ac_objext "* ) ;;
+  *) LIBOBJS="$LIBOBJS memcmp.$ac_objext"
+ ;;
+esac
+
+
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+int main(void)
+{
+	char a = 255, b = 0;
+	if(memcmp(&a, &b, 1) < 0)
+		return 1;
+	return 0;
+}
+
+_ACEOF
+rm -f conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
+$as_echo "$ac_try_echo") >&5
+  (eval "$ac_link") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && { ac_try='./conftest$ac_exeext'
+  { (case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
+$as_echo "$ac_try_echo") >&5
+  (eval "$ac_try") 2>&5
+  ac_status=$?
+  $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); }; }; then
+  { $as_echo "$as_me:$LINENO: result: yes" >&5
+$as_echo "yes" >&6; }
+else
+  $as_echo "$as_me: program exited with status $ac_status" >&5
+$as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+( exit $ac_status )
+ { $as_echo "$as_me:$LINENO: result: no" >&5
+$as_echo "no" >&6; }
+
+cat >>confdefs.h <<\_ACEOF
+#define MEMCMP_IS_BROKEN 1
+_ACEOF
+
+  case " $LIBOBJS " in
+  *" memcmp.$ac_objext "* ) ;;
+  *) LIBOBJS="$LIBOBJS memcmp.$ac_objext"
+ ;;
+esac
+
+
+fi
+rm -rf conftest.dSYM
+rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext
+fi
+
+
 
 # add option to disable the evil rpath
 
@@ -15463,13 +15568,8 @@ else
 fi
 
 if test "x$enable_rpath" = xno; then
-	{ $as_echo "$as_me:$LINENO: result: Fixing libtool for -rpath problems." >&5
-$as_echo "Fixing libtool for -rpath problems." >&6; }
-	sed < libtool > libtool-2 \
-	's/^hardcode_libdir_flag_spec.*$'/'hardcode_libdir_flag_spec=" -D__LIBTOOL_RPATH_SED__ "/'
-	mv libtool-2 libtool
-	chmod 755 libtool
-	libtool="./libtool"
+		ac_config_commands="$ac_config_commands disable-rpath"
+
 fi
 
 
@@ -17018,6 +17118,7 @@ _ACEOF
 
                                 if test "$ssldir" != "/usr"; then
                         CPPFLAGS="$CPPFLAGS -I$ssldir/include"
+                        LIBSSL_CPPFLAGS="$LIBSSL_CPPFLAGS -I$ssldir/include"
                 fi
                 break;
             fi
@@ -17032,6 +17133,7 @@ $as_echo "found in $ssldir" >&6; }
             HAVE_SSL=yes
                         if test "$ssldir" != "/usr" -a "$ssldir" != ""; then
                 LDFLAGS="$LDFLAGS -L$ssldir/lib"
+                LIBSSL_LDFLAGS="$LIBSSL_LDFLAGS -L$ssldir/lib"
 
 	if test "x$enable_rpath" = xyes; then
 		if echo "$ssldir/lib" | grep "^/" >/dev/null; then
@@ -17044,6 +17146,7 @@ $as_echo "found in $ssldir" >&6; }
             { $as_echo "$as_me:$LINENO: checking for HMAC_CTX_init in -lcrypto" >&5
 $as_echo_n "checking for HMAC_CTX_init in -lcrypto... " >&6; }
             LIBS="$LIBS -lcrypto"
+            LIBSSL_LIBS="$LIBSSL_LIBS -lcrypto"
             cat >conftest.$ac_ext <<_ACEOF
 /* confdefs.h.  */
 _ACEOF
@@ -17101,7 +17204,9 @@ sed 's/^/| /' conftest.$ac_ext >&5
 $as_echo "no" >&6; }
                 # check if -lwsock32 or -lgdi32 are needed.
                 BAKLIBS="$LIBS"
+                BAKSSLLIBS="$LIBSSL_LIBS"
                 LIBS="$LIBS -lgdi32"
+                LIBSSL_LIBS="$LIBSSL_LIBS -lgdi32"
                 { $as_echo "$as_me:$LINENO: checking if -lcrypto needs -lgdi32" >&5
 $as_echo_n "checking if -lcrypto needs -lgdi32... " >&6; }
                 cat >conftest.$ac_ext <<_ACEOF
@@ -17160,7 +17265,9 @@ sed 's/^/| /' conftest.$ac_ext >&5
                     { $as_echo "$as_me:$LINENO: result: no" >&5
 $as_echo "no" >&6; }
                     LIBS="$BAKLIBS"
+                    LIBSSL_LIBS="$BAKSSLLIBS"
                     LIBS="$LIBS -ldl"
+                    LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
                     { $as_echo "$as_me:$LINENO: checking if -lcrypto needs -ldl" >&5
 $as_echo_n "checking if -lcrypto needs -ldl... " >&6; }
                     cat >conftest.$ac_ext <<_ACEOF
@@ -17242,6 +17349,98 @@ rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
         fi
 
 
+	# openssl engine functionality needs dlopen().
+	BAKLIBS="$LIBS"
+	{ $as_echo "$as_me:$LINENO: checking for library containing dlopen" >&5
+$as_echo_n "checking for library containing dlopen... " >&6; }
+if test "${ac_cv_search_dlopen+set}" = set; then
+  $as_echo_n "(cached) " >&6
+else
+  ac_func_search_save_LIBS=$LIBS
+cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char dlopen ();
+int
+main ()
+{
+return dlopen ();
+  ;
+  return 0;
+}
+_ACEOF
+for ac_lib in '' dl; do
+  if test -z "$ac_lib"; then
+    ac_res="none required"
+  else
+    ac_res=-l$ac_lib
+    LIBS="-l$ac_lib  $ac_func_search_save_LIBS"
+  fi
+  rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
+$as_echo "$ac_try_echo") >&5
+  (eval "$ac_link") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest$ac_exeext && {
+	 test "$cross_compiling" = yes ||
+	 $as_test_x conftest$ac_exeext
+       }; then
+  ac_cv_search_dlopen=$ac_res
+else
+  $as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+
+fi
+
+rm -rf conftest.dSYM
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+      conftest$ac_exeext
+  if test "${ac_cv_search_dlopen+set}" = set; then
+  break
+fi
+done
+if test "${ac_cv_search_dlopen+set}" = set; then
+  :
+else
+  ac_cv_search_dlopen=no
+fi
+rm conftest.$ac_ext
+LIBS=$ac_func_search_save_LIBS
+fi
+{ $as_echo "$as_me:$LINENO: result: $ac_cv_search_dlopen" >&5
+$as_echo "$ac_cv_search_dlopen" >&6; }
+ac_res=$ac_cv_search_dlopen
+if test "$ac_res" != no; then
+  test "$ac_res" = "none required" || LIBS="$ac_res $LIBS"
+
+fi
+
+	if test "$LIBS" != "$BAKLIBS"; then
+		LIBSSL_LIBS="$LIBSSL_LIBS -ldl"
+	fi
     fi
 
 for ac_header in openssl/ssl.h
@@ -17928,19 +18127,33 @@ fi
 
 case "$enable_gost" in
 	yes)
-	{ $as_echo "$as_me:$LINENO: checking for EVP_PKEY_set_type_str in -lcrypto" >&5
-$as_echo_n "checking for EVP_PKEY_set_type_str in -lcrypto... " >&6; }
-if test "${ac_cv_lib_crypto_EVP_PKEY_set_type_str+set}" = set; then
+	{ $as_echo "$as_me:$LINENO: checking for EVP_PKEY_set_type_str" >&5
+$as_echo_n "checking for EVP_PKEY_set_type_str... " >&6; }
+if test "${ac_cv_func_EVP_PKEY_set_type_str+set}" = set; then
   $as_echo_n "(cached) " >&6
 else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lcrypto  $LIBS"
-cat >conftest.$ac_ext <<_ACEOF
+  cat >conftest.$ac_ext <<_ACEOF
 /* confdefs.h.  */
 _ACEOF
 cat confdefs.h >>conftest.$ac_ext
 cat >>conftest.$ac_ext <<_ACEOF
 /* end confdefs.h.  */
+/* Define EVP_PKEY_set_type_str to an innocuous variant, in case <limits.h> declares EVP_PKEY_set_type_str.
+   For example, HP-UX 11i <limits.h> declares gettimeofday.  */
+#define EVP_PKEY_set_type_str innocuous_EVP_PKEY_set_type_str
+
+/* System header to define __stub macros and hopefully few prototypes,
+    which can conflict with char EVP_PKEY_set_type_str (); below.
+    Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+    <limits.h> exists even on freestanding compilers.  */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef EVP_PKEY_set_type_str
 
 /* Override any GCC internal prototype to avoid an error.
    Use char because int might match the return type of a GCC
@@ -17949,6 +18162,13 @@ cat >>conftest.$ac_ext <<_ACEOF
 extern "C"
 #endif
 char EVP_PKEY_set_type_str ();
+/* The GNU C library defines this for functions which it implements
+    to always fail with ENOSYS.  Some functions are actually named
+    something starting with __ and the normal name is an alias.  */
+#if defined __stub_EVP_PKEY_set_type_str || defined __stub___EVP_PKEY_set_type_str
+choke me
+#endif
+
 int
 main ()
 {
@@ -17978,22 +18198,21 @@ $as_echo "$ac_try_echo") >&5
 	 test "$cross_compiling" = yes ||
 	 $as_test_x conftest$ac_exeext
        }; then
-  ac_cv_lib_crypto_EVP_PKEY_set_type_str=yes
+  ac_cv_func_EVP_PKEY_set_type_str=yes
 else
   $as_echo "$as_me: failed program was:" >&5
 sed 's/^/| /' conftest.$ac_ext >&5
 
-	ac_cv_lib_crypto_EVP_PKEY_set_type_str=no
+	ac_cv_func_EVP_PKEY_set_type_str=no
 fi
 
 rm -rf conftest.dSYM
 rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
       conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
 fi
-{ $as_echo "$as_me:$LINENO: result: $ac_cv_lib_crypto_EVP_PKEY_set_type_str" >&5
-$as_echo "$ac_cv_lib_crypto_EVP_PKEY_set_type_str" >&6; }
-if test "x$ac_cv_lib_crypto_EVP_PKEY_set_type_str" = x""yes; then
+{ $as_echo "$as_me:$LINENO: result: $ac_cv_func_EVP_PKEY_set_type_str" >&5
+$as_echo "$ac_cv_func_EVP_PKEY_set_type_str" >&6; }
+if test "x$ac_cv_func_EVP_PKEY_set_type_str" = x""yes; then
   :
 else
   { { $as_echo "$as_me:$LINENO: error: OpenSSL >= 1.0.0 is needed for GOST support" >&5
@@ -19054,6 +19273,23 @@ if test "${enable_alloc_checks+set}" = set; then
   enableval=$enable_alloc_checks;
 fi
 
+# Check whether --enable-alloc-lite was given.
+if test "${enable_alloc_lite+set}" = set; then
+  enableval=$enable_alloc_lite;
+fi
+
+# Check whether --enable-alloc-nonregional was given.
+if test "${enable_alloc_nonregional+set}" = set; then
+  enableval=$enable_alloc_nonregional;
+fi
+
+if test x_$enable_alloc_nonregional = x_yes; then
+
+cat >>confdefs.h <<\_ACEOF
+#define UNBOUND_ALLOC_NONREGIONAL 1
+_ACEOF
+
+fi
 if test x_$enable_alloc_checks = x_yes; then
 
 cat >>confdefs.h <<\_ACEOF
@@ -19061,6 +19297,13 @@ cat >>confdefs.h <<\_ACEOF
 _ACEOF
 
 else
+	if test x_$enable_alloc_lite = x_yes; then
+
+cat >>confdefs.h <<\_ACEOF
+#define UNBOUND_ALLOC_LITE 1
+_ACEOF
+
+	else
 
 
 for ac_header in stdlib.h
@@ -19314,6 +19557,7 @@ _ACEOF
 
 	fi
 
+	fi
 fi
 
 
@@ -22661,7 +22905,157 @@ _ACEOF
 
 fi
 
-	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes; then
+	{ $as_echo "$as_me:$LINENO: checking for ldns_key_buf2rsa_raw" >&5
+$as_echo_n "checking for ldns_key_buf2rsa_raw... " >&6; }
+if test "${ac_cv_func_ldns_key_buf2rsa_raw+set}" = set; then
+  $as_echo_n "(cached) " >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+/* Define ldns_key_buf2rsa_raw to an innocuous variant, in case <limits.h> declares ldns_key_buf2rsa_raw.
+   For example, HP-UX 11i <limits.h> declares gettimeofday.  */
+#define ldns_key_buf2rsa_raw innocuous_ldns_key_buf2rsa_raw
+
+/* System header to define __stub macros and hopefully few prototypes,
+    which can conflict with char ldns_key_buf2rsa_raw (); below.
+    Prefer <limits.h> to <assert.h> if __STDC__ is defined, since
+    <limits.h> exists even on freestanding compilers.  */
+
+#ifdef __STDC__
+# include <limits.h>
+#else
+# include <assert.h>
+#endif
+
+#undef ldns_key_buf2rsa_raw
+
+/* Override any GCC internal prototype to avoid an error.
+   Use char because int might match the return type of a GCC
+   builtin and then its argument prototype would still apply.  */
+#ifdef __cplusplus
+extern "C"
+#endif
+char ldns_key_buf2rsa_raw ();
+/* The GNU C library defines this for functions which it implements
+    to always fail with ENOSYS.  Some functions are actually named
+    something starting with __ and the normal name is an alias.  */
+#if defined __stub_ldns_key_buf2rsa_raw || defined __stub___ldns_key_buf2rsa_raw
+choke me
+#endif
+
+int
+main ()
+{
+return ldns_key_buf2rsa_raw ();
+  ;
+  return 0;
+}
+_ACEOF
+rm -f conftest.$ac_objext conftest$ac_exeext
+if { (ac_try="$ac_link"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
+$as_echo "$ac_try_echo") >&5
+  (eval "$ac_link") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest$ac_exeext && {
+	 test "$cross_compiling" = yes ||
+	 $as_test_x conftest$ac_exeext
+       }; then
+  ac_cv_func_ldns_key_buf2rsa_raw=yes
+else
+  $as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	ac_cv_func_ldns_key_buf2rsa_raw=no
+fi
+
+rm -rf conftest.dSYM
+rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \
+      conftest$ac_exeext conftest.$ac_ext
+fi
+{ $as_echo "$as_me:$LINENO: result: $ac_cv_func_ldns_key_buf2rsa_raw" >&5
+$as_echo "$ac_cv_func_ldns_key_buf2rsa_raw" >&6; }
+
+
+for ac_header in ldns/ldns.h
+do
+as_ac_Header=`$as_echo "ac_cv_header_$ac_header" | $as_tr_sh`
+{ $as_echo "$as_me:$LINENO: checking for $ac_header" >&5
+$as_echo_n "checking for $ac_header... " >&6; }
+if { as_var=$as_ac_Header; eval "test \"\${$as_var+set}\" = set"; }; then
+  $as_echo_n "(cached) " >&6
+else
+  cat >conftest.$ac_ext <<_ACEOF
+/* confdefs.h.  */
+_ACEOF
+cat confdefs.h >>conftest.$ac_ext
+cat >>conftest.$ac_ext <<_ACEOF
+/* end confdefs.h.  */
+$ac_includes_default
+
+#include <$ac_header>
+_ACEOF
+rm -f conftest.$ac_objext
+if { (ac_try="$ac_compile"
+case "(($ac_try" in
+  *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;;
+  *) ac_try_echo=$ac_try;;
+esac
+eval ac_try_echo="\"\$as_me:$LINENO: $ac_try_echo\""
+$as_echo "$ac_try_echo") >&5
+  (eval "$ac_compile") 2>conftest.er1
+  ac_status=$?
+  grep -v '^ *+' conftest.er1 >conftest.err
+  rm -f conftest.er1
+  cat conftest.err >&5
+  $as_echo "$as_me:$LINENO: \$? = $ac_status" >&5
+  (exit $ac_status); } && {
+	 test -z "$ac_c_werror_flag" ||
+	 test ! -s conftest.err
+       } && test -s conftest.$ac_objext; then
+  eval "$as_ac_Header=yes"
+else
+  $as_echo "$as_me: failed program was:" >&5
+sed 's/^/| /' conftest.$ac_ext >&5
+
+	eval "$as_ac_Header=no"
+fi
+
+rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
+fi
+ac_res=`eval 'as_val=${'$as_ac_Header'}
+		 $as_echo "$as_val"'`
+	       { $as_echo "$as_me:$LINENO: result: $ac_res" >&5
+$as_echo "$ac_res" >&6; }
+as_val=`eval 'as_val=${'$as_ac_Header'}
+		 $as_echo "$as_val"'`
+   if test "x$as_val" = x""yes; then
+  cat >>confdefs.h <<_ACEOF
+#define `$as_echo "HAVE_$ac_header" | $as_tr_cpp` 1
+_ACEOF
+
+fi
+
+done
+
+	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes \
+	    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
+	    -a $ac_cv_header_ldns_ldns_h = yes; then
 	    	    { $as_echo "$as_me:$LINENO: checking for ldns_b32_ntop_extended_hex" >&5
 $as_echo_n "checking for ldns_b32_ntop_extended_hex... " >&6; }
 if test "${ac_cv_func_ldns_b32_ntop_extended_hex+set}" = set; then
@@ -23303,7 +23697,7 @@ exec 6>&1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by unbound $as_me 1.4.0, which was
+This file was extended by unbound $as_me 1.4.3, which was
 generated by GNU Autoconf 2.63.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -23366,7 +23760,7 @@ Report bugs to <bug-autoconf@gnu.org>."
 _ACEOF
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_version="\\
-unbound config.status 1.4.0
+unbound config.status 1.4.3
 configured by $0, generated by GNU Autoconf 2.63,
   with options \\"`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`\\"
 
@@ -23741,6 +24135,7 @@ for ac_config_target in $ac_config_targets
 do
   case $ac_config_target in
     "libtool") CONFIG_COMMANDS="$CONFIG_COMMANDS libtool" ;;
+    "disable-rpath") CONFIG_COMMANDS="$CONFIG_COMMANDS disable-rpath" ;;
     "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;;
     "doc/example.conf") CONFIG_FILES="$CONFIG_FILES doc/example.conf" ;;
     "doc/libunbound.3") CONFIG_FILES="$CONFIG_FILES doc/libunbound.3" ;;
@@ -24993,6 +25388,13 @@ _LT_EOF
   chmod +x "$ofile"
 
  ;;
+    "disable-rpath":C)
+	sed < libtool > libtool-2 \
+	's/^hardcode_libdir_flag_spec.*$'/'hardcode_libdir_flag_spec=" -D__LIBTOOL_RPATH_SED__ "/'
+	mv libtool-2 libtool
+	chmod 755 libtool
+	libtool="./libtool"
+	 ;;
 
   esac
 done # for ac_tag

configure.ac

@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)
 
-AC_INIT(unbound, 1.4.0, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.4.3, unbound-bugs@nlnetlabs.nl, unbound)
 
-LIBUNBOUND_CURRENT=1
-LIBUNBOUND_REVISION=5
+LIBUNBOUND_CURRENT=2
+LIBUNBOUND_REVISION=3
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -24,7 +24,10 @@ LIBUNBOUND_AGE=0
 # 1.3.3 had 1:3:0
 # 1.3.4 had 1:4:0
 # 1.4.0-snapshots had 1:5:0
-# 1.4.0 had 2:0:0   # ub_result.why_bogus
+# 1.4.0 had 1:5:0 (not 2:0:0)   # ub_result.why_bogus
+# 1.4.1 had 2:1:0
+# 1.4.2 had 2:2:0
+# 1.4.3 had 2:3:0
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -160,10 +163,12 @@ ACX_CHECK_COMPILER_FLAG(xO4, [CFLAGS="$CFLAGS -xO4"])
 ACX_CHECK_COMPILER_FLAG(xtarget=generic, [CFLAGS="$CFLAGS -xtarget=generic"])
 
 # debug mode flags warnings
-AC_ARG_ENABLE(debug, AC_HELP_STRING([--enable-debug], [Enable debug warnings, asserts, makefile-dependencies]))
-debug_enabled="$enable_debug"
+AC_ARG_ENABLE(checking, AC_HELP_STRING([--enable-checking], [Enable warnings, asserts, makefile-dependencies]))
+AC_ARG_ENABLE(debug, AC_HELP_STRING([--enable-debug], [same as enable-checking]))
+if test "$enable_debug" = "yes"; then debug_enabled="$enable_debug"; 
+else debug_enabled="$enable_checking"; fi
 AC_SUBST(debug_enabled)
-case "$enable_debug" in
+case "$debug_enabled" in
         yes)
 		ACX_CHECK_COMPILER_FLAG(W, [CFLAGS="$CFLAGS -W"])
 		ACX_CHECK_COMPILER_FLAG(Wall, [CFLAGS="$CFLAGS -Wall"])
@@ -222,6 +227,7 @@ ACX_TYPE_RLIM_T
 ACX_TYPE_SOCKLEN_T
 ACX_TYPE_IN_ADDR_T
 ACX_TYPE_IN_PORT_T
+ACX_CHECK_MEMCMP_SIGNED
 
 # add option to disable the evil rpath
 ACX_ARG_RPATH
@@ -398,7 +404,7 @@ esac
 AC_ARG_ENABLE(gost, AC_HELP_STRING([--enable-gost], [Enable GOST support, experimental]))
 case "$enable_gost" in
 	yes)
-	AC_CHECK_LIB(crypto, EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL >= 1.0.0 is needed for GOST support])])
+	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL >= 1.0.0 is needed for GOST support])])
 	AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])
 	;;
 	no|*)
@@ -510,12 +516,25 @@ fi
 
 # set memory allocation checking if requested
 AC_ARG_ENABLE(alloc-checks, AC_HELP_STRING([--enable-alloc-checks],
-	[ enable to check memory allocation, for debug purposes ]), 
+	[ enable to memory allocation statistics, for debug purposes ]), 
 	, )
+AC_ARG_ENABLE(alloc-lite, AC_HELP_STRING([--enable-alloc-lite],
+	[ enable for lightweight alloc assertions, for debug purposes ]), 
+	, )
+AC_ARG_ENABLE(alloc-nonregional, AC_HELP_STRING([--enable-alloc-nonregional],
+	[ enable nonregional allocs, slow but exposes regional allocations to other memory purifiers, for debug purposes ]), 
+	, )
+if test x_$enable_alloc_nonregional = x_yes; then
+	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
+fi
 if test x_$enable_alloc_checks = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
 else
-	ACX_FUNC_MALLOC([unbound])
+	if test x_$enable_alloc_lite = x_yes; then
+		AC_DEFINE(UNBOUND_ALLOC_LITE, 1, [use to enable lightweight alloc assertions, for debug use])
+	else
+		ACX_FUNC_MALLOC([unbound])
+	fi
 fi
 
 AC_FUNC_CHOWN
@@ -589,7 +608,11 @@ AC_ARG_WITH(ldns-builtin, AC_HELP_STRING([--with-ldns-builtin],
 # check if ldns is good enough
 if test "$use_ldns_builtin" = "no"; then
 	AC_CHECK_LIB(ldns, ldns_buffer_copy)
-	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes; then
+	AC_CHECK_FUNC(ldns_key_buf2rsa_raw)
+	AC_CHECK_HEADERS([ldns/ldns.h],,, [AC_INCLUDES_DEFAULT])
+	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes \
+	    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
+	    -a $ac_cv_header_ldns_ldns_h = yes; then
 	    dnl ldns was found, check compat functions
 	    AC_CHECK_FUNC([ldns_b32_ntop_extended_hex],, [
 		AC_MSG_ERROR([ldns version too old, need >=1.4.0])])
@@ -715,6 +738,7 @@ AHX_CONFIG_W32_RANDOM
 AHX_CONFIG_W32_SRANDOM
 AHX_CONFIG_W32_FD_SET_T
 AHX_CONFIG_IPV6_MIN_MTU
+AHX_MEMCMP_BROKEN(unbound)
 
 [
 #ifndef HAVE_CTIME_R
@@ -762,7 +786,9 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-#endif /* UNBOUND_ALLOC_STATS */
+#elif defined(UNBOUND_ALLOC_LITE)
+#  include "util/alloc.h"
+#endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53

contrib/unbound.spec_fedora

@@ -1,5 +1,5 @@
-# initial python set up
-%{?!with_python:      %define with_python      0}
+# not ready yet
+%{?!with_python:      %global with_python      1}
 
 %if %{with_python}
 %{!?python_sitelib: %global python_sitelib %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib()")}
@@ -8,7 +8,7 @@
 
 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.3.1rc2
+Version: 1.4.2
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
@@ -16,8 +16,8 @@ Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
 Source1: unbound.init
 Source2: unbound.conf
 Source3: unbound.munin
-# See the unbound svn repository for further documentation on these
-Patch0: unbound-1.2-glob.patch
+Source4: dlv.isc.org.key
+Patch1: unbound-1.2-glob.patch
 
 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -31,7 +31,7 @@ Requires(post): chkconfig
 Requires(preun): chkconfig
 Requires(preun): initscripts
 Requires(postun): initscripts
-Requires: ldns >= 1.5.0, dnssec-conf >= 1.19
+Requires: ldns >= 1.5.0
 Requires(pre): shadow-utils
 
 %description
@@ -84,7 +84,7 @@ Python modules and extensions for unbound
 
 %prep
 %setup -q 
-%patch0 -p1
+%patch1 -p1
 
 %build
 %configure  --with-ldns= --with-libevent --with-pthreads --with-ssl \
@@ -95,7 +95,7 @@ Python modules and extensions for unbound
             --with-pythonmodule --with-pyunbound \
 %endif
             --enable-sha2 
-%{__make} CFLAGS="$RPM_OPT_FLAGS -D_GNU_SOURCE" QUIET=no %{?_smp_mflags}
+%{__make} 
 
 %install
 rm -rf %{buildroot}
@@ -112,6 +112,9 @@ for plugin in unbound_munin_hits unbound_munin_queue unbound_munin_memory unboun
     ln -s unbound %{buildroot}%{_datadir}/munin/plugins/$plugin
 done 
 
+# install DLV key
+install -m 0644 %{SOURCE4} %{buildroot}%{_sysconfdir}/unbound/
+
 # remove static library from install (fedora packaging guidelines)
 rm -rf %{buildroot}%{_libdir}/*.la
 
@@ -127,6 +130,7 @@ rm -rf ${RPM_BUILD_ROOT}
 %attr(0755,root,root) %dir %{_sysconfdir}/%{name}
 %attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dlv.isc.org.key
 %{_sbindir}/*
 %{_mandir}/*/*
 
@@ -160,15 +164,11 @@ exit 0
 
 %post
 /sbin/chkconfig --add %{name}
-# Check DNSSEC settings if this is a fresh install
-if [ "$1" -eq 1 ]; then
-  if [ -r /etc/sysconfig/dnssec ]; then
-    . /etc/sysconfig/dnssec
-    [ -x /usr/sbin/dnssec-configure ] && \
-      dnssec-configure -u --norestart --nocheck --dnssec="$DNSSEC" --dlv="$DLV" > \
-        /dev/null 2>&1
-  fi;
-fi
+# dnssec-conf used to contain our DLV key, but now we include it via unbound
+# If unbound had previously been configured with dnssec-configure, we need
+# to migrate the location of the DLV key file (to keep DLV enabled, and because
+# unbound won't start with a bad location for a DLV key file.
+sed -i "s:/etc/pki/dnssec-keys[/]*dlv:/etc/unbound:" %{_sysconfdir}/unbound/unbound.conf
 
 %post libs -p /sbin/ldconfig
 
@@ -186,6 +186,30 @@ fi
 %postun libs -p /sbin/ldconfig
 
 %changelog
+* Thu Feb 18 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-2
+- Removed dependancy for dnssec-conf
+- Added ISC DLV key (formerly in dnssec-conf)
+- Fixup old DLV locations in unbound.conf file via %%post
+
+* Tue Jan 05 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-1
+- Updated to 1.4.1
+- Changed %%define to %%global
+
+* Thu Oct 08 2009 Paul Wouters <paul@xelerance.com> - 1.3.4-2
+- Bump version
+
+* Thu Oct 08 2009 Paul Wouters <paul@xelerance.com> - 1.3.4-1
+- Upgraded to 1.3.4. Security fix with validating NSEC3 records
+
+* Fri Aug 21 2009 Tomas Mraz <tmraz@redhat.com> - 1.3.3-2
+- rebuilt with new openssl
+
+* Mon Aug 17 2009 Paul Wouters <paul@xelerance.com> - 1.3.3-1
+- Updated to 1.3.3
+
+* Sun Jul 26 2009 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.3.0-3
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild
+
 * Sat Jun 20 2009 Paul Wouters <paul@xelerance.com> - 1.3.0-2
 - Added missing glob patch to cvs
 - Place python macros within the %%with_python check

contrib/unbound_munin_

@@ -235,6 +235,7 @@ if test "$1" = "config" ; then
 		done
 		p_config "total.num.queries" "total queries from clients"
 		p_config "total.num.cachehits" "cache hits"
+		p_config "total.num.prefetch" "cache prefetch"
 		p_config "num.query.tcp" "TCP queries"
 		p_config "num.query.ipv6" "IPv6 queries"
 		p_config "unwanted.queries" "queries that failed acl"
@@ -423,8 +424,8 @@ hits)
 	for x in thread0.num.queries thread1.num.queries thread2.num.queries \
 		thread3.num.queries thread4.num.queries thread5.num.queries \
 		thread6.num.queries thread7.num.queries total.num.queries \
-		total.num.cachehits num.query.tcp num.query.ipv6 \
-		unwanted.queries unwanted.replies; do
+		total.num.cachehits total.num.prefetch num.query.tcp \
+		num.query.ipv6 unwanted.queries unwanted.replies; do
 		if grep "^"$x"=" $state >/dev/null 2>&1; then
 			print_qps $x
 		fi

contrib/update-itar.sh

@@ -10,9 +10,9 @@ thedir="."
 # where is the file that unbound is going to read
 ub_ta_file="$thedir/anchors.mf"
 # where is the itar master file format
-itar_url="ftp://iana.org/itar/anchors.mf"
+itar_url="ftp://ftp.iana.org/itar/anchors.mf"
 # where is the itar PGP signature
-itar_sig="ftp://iana.org/itar/anchors.mf.sig"
+itar_sig="ftp://ftp.iana.org/itar/anchors.mf.sig"
 
 # which command to fetch urls, cmd $dest $url. "wget -O" "curl -o"
 fetch_cmd="wget -O"

daemon/cachedump.c

@@ -738,6 +738,7 @@ load_msg(SSL* ssl, ldns_buffer* buf, struct worker* worker)
 	rep.flags = (uint16_t)flags;
 	rep.qdcount = (uint16_t)qdcount;
 	rep.ttl = (uint32_t)ttl;
+	rep.prefetch_ttl = PREFETCH_TTL_CALC(rep.ttl);
 	rep.security = (enum sec_status)security;
 	rep.an_numrrsets = (size_t)an;
 	rep.ns_numrrsets = (size_t)ns;
@@ -757,7 +758,7 @@ load_msg(SSL* ssl, ldns_buffer* buf, struct worker* worker)
 	if(!go_on) 
 		return 1; /* skip this one, not all references satisfied */
 
-	if(!dns_cache_store(&worker->env, &qinf, &rep, 0)) {
+	if(!dns_cache_store(&worker->env, &qinf, &rep, 0, 0)) {
 		log_warn("error out of memory");
 		return 0;
 	}
@@ -815,8 +816,9 @@ print_dp_details(SSL* ssl, struct worker* worker, struct delegpt* dp)
 				return;
 			continue; /* skip stuff not in infra cache */
 		}
-		if(!ssl_printf(ssl, "%s%s%srtt %d msec, %d lost. ",
+		if(!ssl_printf(ssl, "%s%s%s%srtt %d msec, %d lost. ",
 			lame?"LAME ":"", dlame?"NoDNSSEC ":"",
+			a->lame?"AddrWasParentSide ":"",
 			rlame?"NoAuthButRecursive ":"", rtt, lost))
 			return;
 		if(infra_host(worker->env.infra_cache, &a->addr, a->addrlen,

daemon/daemon.c

@@ -69,7 +69,7 @@ static void* comp_meth = NULL;
 #endif
 #ifdef LEX_HAS_YYLEX_DESTROY
 /** remove buffers for parsing and init */
-void ub_c_lex_destroy(void);
+int ub_c_lex_destroy(void);
 #endif
 
 /** used when no other sighandling happens, so we don't die

daemon/remote.c

@@ -64,6 +64,7 @@
 #include "validator/val_kentry.h"
 #include "iterator/iterator.h"
 #include "iterator/iter_fwd.h"
+#include "iterator/iter_hints.h"
 #include "iterator/iter_delegpt.h"
 #include "services/outbound_list.h"
 #include "services/outside_network.h"
@@ -599,12 +600,15 @@ print_stats(SSL* ssl, const char* nm, struct stats_info* s)
 			- s->svr.num_queries_missed_cache))) return 0;
 	if(!ssl_printf(ssl, "%s.num.cachemiss"SQ"%u\n", nm, 
 		(unsigned)s->svr.num_queries_missed_cache)) return 0;
+	if(!ssl_printf(ssl, "%s.num.prefetch"SQ"%u\n", nm, 
+		(unsigned)s->svr.num_queries_prefetch)) return 0;
 	if(!ssl_printf(ssl, "%s.num.recursivereplies"SQ"%u\n", nm, 
 		(unsigned)s->mesh_replies_sent)) return 0;
 	if(!ssl_printf(ssl, "%s.requestlist.avg"SQ"%g\n", nm,
-		s->svr.num_queries_missed_cache?
+		(s->svr.num_queries_missed_cache+s->svr.num_queries_prefetch)?
 			(double)s->svr.sum_query_list_size/
-			s->svr.num_queries_missed_cache : 0.0)) return 0;
+			(s->svr.num_queries_missed_cache+
+			s->svr.num_queries_prefetch) : 0.0)) return 0;
 	if(!ssl_printf(ssl, "%s.requestlist.max"SQ"%u\n", nm,
 		(unsigned)s->svr.max_query_list_size)) return 0;
 	if(!ssl_printf(ssl, "%s.requestlist.overwritten"SQ"%u\n", nm,
@@ -1223,20 +1227,24 @@ do_flush_name(SSL* ssl, struct worker* w, char* arg)
 	send_ok(ssl);
 }
 
-/** print root forwards */
+/** printout a delegation point info */
 static int
-print_root_fwds(SSL* ssl, struct iter_forwards* fwds, uint8_t* root)
+ssl_print_name_dp(SSL* ssl, char* str, uint8_t* nm, uint16_t dclass,
+	struct delegpt* dp)
 {
 	char buf[257];
-	struct delegpt* dp;
 	struct delegpt_ns* ns;
 	struct delegpt_addr* a;
 	int f = 0;
-	dp = forwards_lookup(fwds, root, LDNS_RR_CLASS_IN);
-	if(!dp) 
-		return ssl_printf(ssl, "off (using root hints)\n");
-	/* if dp is returned it must be the root */
-	log_assert(query_dname_compare(dp->name, root)==0);
+	if(str) { /* print header for forward, stub */
+		char* c = ldns_rr_class2str(dclass);
+		dname_str(nm, buf);
+		if(!ssl_printf(ssl, "%s %s %s: ", buf, c, str)) {
+			free(c);
+			return 0;
+		}
+		free(c);
+	}
 	for(ns = dp->nslist; ns; ns = ns->next) {
 		dname_str(ns->name, buf);
 		if(!ssl_printf(ssl, "%s%s", (f?" ":""), buf))
@@ -1252,6 +1260,20 @@ print_root_fwds(SSL* ssl, struct iter_forwards* fwds, uint8_t* root)
 	return ssl_printf(ssl, "\n");
 }
 
+
+/** print root forwards */
+static int
+print_root_fwds(SSL* ssl, struct iter_forwards* fwds, uint8_t* root)
+{
+	struct delegpt* dp;
+	dp = forwards_lookup(fwds, root, LDNS_RR_CLASS_IN);
+	if(!dp)
+		return ssl_printf(ssl, "off (using root hints)\n");
+	/* if dp is returned it must be the root */
+	log_assert(query_dname_compare(dp->name, root)==0);
+	return ssl_print_name_dp(ssl, NULL, root, LDNS_RR_CLASS_IN, dp);
+}
+
 /** parse args into delegpt */
 static struct delegpt*
 parse_delegpt(SSL* ssl, struct regional* region, char* args, uint8_t* root)
@@ -1280,7 +1302,7 @@ parse_delegpt(SSL* ssl, struct regional* region, char* args, uint8_t* root)
 			return NULL;
 		}
 		/* add address */
-		if(!delegpt_add_addr(dp, region, &addr, addrlen, 0, 1)) {
+		if(!delegpt_add_addr(dp, region, &addr, addrlen, 0, 0, 1)) {
 			(void)ssl_printf(ssl, "error out of memory\n");
 			return NULL;
 		}
@@ -1457,6 +1479,129 @@ do_dump_requestlist(SSL* ssl, struct worker* worker)
 	}
 }
 
+/** do the log_reopen command */
+static void
+do_log_reopen(SSL* ssl, struct worker* worker)
+{
+	struct config_file* cfg = worker->env.cfg;
+	send_ok(ssl);
+	log_init(cfg->logfile, cfg->use_syslog, cfg->chrootdir);
+}
+
+/** do the set_option command */
+static void
+do_set_option(SSL* ssl, struct worker* worker, char* arg)
+{
+	char* arg2;
+	if(!find_arg2(ssl, arg, &arg2))
+		return;
+	if(!config_set_option(worker->env.cfg, arg, arg2)) {
+		(void)ssl_printf(ssl, "error setting option\n");
+		return;
+	}
+	send_ok(ssl);
+}
+
+/* routine to printout option values over SSL */
+void remote_get_opt_ssl(char* line, void* arg)
+{
+	SSL* ssl = (SSL*)arg;
+	(void)ssl_printf(ssl, "%s\n", line);
+}
+
+/** do the get_option command */
+static void
+do_get_option(SSL* ssl, struct worker* worker, char* arg)
+{
+	int r;
+	r = config_get_option(worker->env.cfg, arg, remote_get_opt_ssl, ssl);
+	if(!r) {
+		(void)ssl_printf(ssl, "error unknown option\n");
+		return;
+	}
+}
+
+/** do the list_forwards command */
+static void
+do_list_forwards(SSL* ssl, struct worker* worker)
+{
+	/* since its a per-worker structure no locks needed */
+	struct iter_forwards* fwds = worker->env.fwds;
+	struct iter_forward_zone* z;
+	RBTREE_FOR(z, struct iter_forward_zone*, fwds->tree) {
+		if(!z->dp) continue; /* skip empty marker for stub */
+		if(!ssl_print_name_dp(ssl, "forward", z->name, z->dclass,
+			z->dp))
+			return;
+	}
+}
+
+/** do the list_stubs command */
+static void
+do_list_stubs(SSL* ssl, struct worker* worker)
+{
+	/* readonly structure */
+	int m;
+	struct iter_hints_stub* z;
+	struct iter_env* ie;
+	m = modstack_find(&worker->env.mesh->mods, "iterator");
+	if(m == -1) {
+		(void)ssl_printf(ssl, "error no iterator module\n");
+		return;
+	}
+	ie = (struct iter_env*)worker->env.modinfo[m];
+	RBTREE_FOR(z, struct iter_hints_stub*, &ie->hints->tree) {
+		if(!ssl_print_name_dp(ssl, 
+			z->noprime?"stub noprime":"stub prime", z->node.name,
+			z->node.dclass, z->dp))
+			return;
+	}
+}
+
+/** do the list_local_zones command */
+static void
+do_list_local_zones(SSL* ssl, struct worker* worker)
+{
+	struct local_zones* zones = worker->daemon->local_zones;
+	struct local_zone* z;
+	char buf[257];
+	lock_quick_lock(&zones->lock);
+	RBTREE_FOR(z, struct local_zone*, &zones->ztree) {
+		lock_rw_rdlock(&z->lock);
+		dname_str(z->name, buf);
+		(void)ssl_printf(ssl, "%s %s\n", buf, 
+			local_zone_type2str(z->type));
+		lock_rw_unlock(&z->lock);
+	}
+	lock_quick_unlock(&zones->lock);
+}
+
+/** do the list_local_data command */
+static void
+do_list_local_data(SSL* ssl, struct worker* worker)
+{
+	struct local_zones* zones = worker->daemon->local_zones;
+	struct local_zone* z;
+	struct local_data* d;
+	struct local_rrset* p;
+	lock_quick_lock(&zones->lock);
+	RBTREE_FOR(z, struct local_zone*, &zones->ztree) {
+		lock_rw_rdlock(&z->lock);
+		RBTREE_FOR(d, struct local_data*, &z->data) {
+			for(p = d->rrsets; p; p = p->next) {
+				ldns_rr_list* rr = packed_rrset_to_rr_list(
+					p->rrset, worker->env.scratch_buffer);
+				char* str = ldns_rr_list2str(rr);
+				(void)ssl_printf(ssl, "%s", str);
+				free(str);
+				ldns_rr_list_free(rr);
+			}
+		}
+		lock_rw_unlock(&z->lock);
+	}
+	lock_quick_unlock(&zones->lock);
+}
+
 /** tell other processes to execute the command */
 void
 distribute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd)
@@ -1504,6 +1649,18 @@ execute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd,
 	} else if(strncmp(p, "load_cache", 10) == 0) {
 		if(load_cache(ssl, worker)) send_ok(ssl);
 		return;
+	} else if(strncmp(p, "list_forwards", 13) == 0) {
+		do_list_forwards(ssl, worker);
+		return;
+	} else if(strncmp(p, "list_stubs", 10) == 0) {
+		do_list_stubs(ssl, worker);
+		return;
+	} else if(strncmp(p, "list_local_zones", 16) == 0) {
+		do_list_local_zones(ssl, worker);
+		return;
+	} else if(strncmp(p, "list_local_data", 15) == 0) {
+		do_list_local_data(ssl, worker);
+		return;
 	} else if(strncmp(p, "forward", 7) == 0) {
 		/* must always distribute this cmd */
 		if(rc) distribute_cmd(rc, ssl, cmd);
@@ -1550,6 +1707,12 @@ execute_cmd(struct daemon_remote* rc, SSL* ssl, char* cmd,
 		do_flush_name(ssl, worker, skipwhite(p+5));
 	} else if(strncmp(p, "dump_requestlist", 16) == 0) {
 		do_dump_requestlist(ssl, worker);
+	} else if(strncmp(p, "log_reopen", 10) == 0) {
+		do_log_reopen(ssl, worker);
+	} else if(strncmp(p, "set_option", 10) == 0) {
+		do_set_option(ssl, worker, skipwhite(p+10));
+	} else if(strncmp(p, "get_option", 10) == 0) {
+		do_get_option(ssl, worker, skipwhite(p+10));
 	} else {
 		(void)ssl_printf(ssl, "error unknown command '%s'\n", p);
 	}

daemon/remote.h

@@ -171,4 +171,7 @@ int ssl_printf(SSL* ssl, const char* format, ...)
  */
 int ssl_read_line(SSL* ssl, char* buf, size_t max);
 
+/** routine to printout option values over SSL */
+void remote_get_opt_ssl(char* line, void* arg);
+
 #endif /* DAEMON_REMOTE_H */

daemon/stats.c

@@ -79,20 +79,31 @@ void server_stats_querymiss(struct server_stats* stats, struct worker* worker)
 		stats->max_query_list_size = worker->env.mesh->all.count;
 }
 
+void server_stats_prefetch(struct server_stats* stats, struct worker* worker)
+{
+	stats->num_queries_prefetch++;
+	/* changes the query list size so account that, like a querymiss */
+	stats->sum_query_list_size += worker->env.mesh->all.count;
+	if(worker->env.mesh->all.count > stats->max_query_list_size)
+		stats->max_query_list_size = worker->env.mesh->all.count;
+}
+
 void server_stats_log(struct server_stats* stats, struct worker* worker,
 	int threadnum)
 {
 	log_info("server stats for thread %d: %u queries, "
-		"%u answers from cache, %u recursions", 
+		"%u answers from cache, %u recursions, %u prefetch", 
 		threadnum, (unsigned)stats->num_queries, 
 		(unsigned)(stats->num_queries - 
 			stats->num_queries_missed_cache),
-		(unsigned)stats->num_queries_missed_cache);
+		(unsigned)stats->num_queries_missed_cache,
+		(unsigned)stats->num_queries_prefetch);
 	log_info("server stats for thread %d: requestlist max %u avg %g "
 		"exceeded %u", threadnum, (unsigned)stats->max_query_list_size,
-		stats->num_queries_missed_cache?
+		(stats->num_queries_missed_cache+stats->num_queries_prefetch)?
 			(double)stats->sum_query_list_size/
-			stats->num_queries_missed_cache : 0.0,
+			(stats->num_queries_missed_cache+
+			stats->num_queries_prefetch) : 0.0,
 		(unsigned)worker->env.mesh->stats_dropped);
 }
 
@@ -187,6 +198,7 @@ void server_stats_add(struct stats_info* total, struct stats_info* a)
 {
 	total->svr.num_queries += a->svr.num_queries;
 	total->svr.num_queries_missed_cache += a->svr.num_queries_missed_cache;
+	total->svr.num_queries_prefetch += a->svr.num_queries_prefetch;
 	total->svr.sum_query_list_size += a->svr.sum_query_list_size;
 	/* the max size reached is upped to higher of both */
 	if(a->svr.max_query_list_size > total->svr.max_query_list_size)

daemon/stats.h

@@ -64,6 +64,8 @@ struct server_stats {
 	size_t num_queries;
 	/** number of queries that had a cache-miss. */
 	size_t num_queries_missed_cache;
+	/** number of prefetch queries - cachehits with prefetch */
+	size_t num_queries_prefetch;
 
 	/**
 	 * Sum of the querylistsize of the worker for 
@@ -166,6 +168,9 @@ void server_stats_init(struct server_stats* stats, struct config_file* cfg);
 /** add query if it missed the cache */
 void server_stats_querymiss(struct server_stats* stats, struct worker* worker);
 
+/** add query if was cached and also resulted in a prefetch */
+void server_stats_prefetch(struct server_stats* stats, struct worker* worker);
+
 /** display the stats to the log */
 void server_stats_log(struct server_stats* stats, struct worker* worker,
 	int threadnum);

daemon/unbound.c

@@ -313,7 +313,7 @@ detach(void)
 	if(daemon(1, 0) != 0)
 		fatal_exit("daemon failed: %s", strerror(errno));
 #else /* no HAVE_DAEMON */
-#ifdef HAVE_WORKING_FORK
+#ifdef HAVE_FORK
 	int fd;
 	/* Take off... */
 	switch (fork()) {
@@ -337,7 +337,7 @@ detach(void)
 		if (fd > 2)
 			(void)close(fd);
 	}
-#endif /* HAVE_WORKING_FORK */
+#endif /* HAVE_FORK */
 #endif /* HAVE_DAEMON */
 }
 

daemon/worker.c

@@ -82,6 +82,18 @@
 /** Size of an UDP datagram */
 #define NORMAL_UDP_SIZE	512 /* bytes */
 
+/** 
+ * seconds to add to prefetch leeway.  This is a TTL that expires old rrsets
+ * earlier than they should in order to put the new update into the cache.
+ * This additional value is to make sure that if not all TTLs are equal in
+ * the message to be updated(and replaced), that rrsets with up to this much
+ * extra TTL are also replaced.  This means that the resulting new message
+ * will have (most likely) this TTL at least, avoiding very small 'split
+ * second' TTLs due to operators choosing relative primes for TTLs (or so).
+ * Also has to be at least one to break ties (and overwrite cached entry).
+ */
+#define PREFETCH_EXPIRY_ADD 60
+
 #ifdef UNBOUND_ALLOC_STATS
 /** measure memory leakage */
 static void
@@ -589,6 +601,24 @@ answer_from_cache(struct worker* worker, struct query_info* qinfo,
 	return 1;
 }
 
+/** Reply to client and perform prefetch to keep cache up to date */
+static void
+reply_and_prefetch(struct worker* worker, struct query_info* qinfo, 
+	uint16_t flags, struct comm_reply* repinfo, uint32_t leeway)
+{
+	/* first send answer to client to keep its latency 
+	 * as small as a cachereply */
+	comm_point_send_reply(repinfo);
+	server_stats_prefetch(&worker->stats, worker);
+	
+	/* create the prefetch in the mesh as a normal lookup without
+	 * client addrs waiting, which has the cache blacklisted (to bypass
+	 * the cache and go to the network for the data). */
+	/* this (potentially) runs the mesh for the new query */
+	mesh_new_prefetch(worker->env.mesh, qinfo, flags, leeway + 
+		PREFETCH_EXPIRY_ADD);
+}
+
 /**
  * Fill CH class answer into buffer. Keeps query.
  * @param pkt: buffer
@@ -836,6 +866,17 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			*(uint16_t*)ldns_buffer_begin(c->buffer), 
 			ldns_buffer_read_u16_at(c->buffer, 2), repinfo, 
 			&edns)) {
+			/* prefetch it if the prefetch TTL expired */
+			if(worker->env.cfg->prefetch && *worker->env.now >=
+				((struct reply_info*)e->data)->prefetch_ttl) {
+				uint32_t leeway = ((struct reply_info*)e->
+					data)->ttl - *worker->env.now;
+				lock_rw_unlock(&e->lock);
+				reply_and_prefetch(worker, &qinfo, 
+					ldns_buffer_read_u16_at(c->buffer, 2),
+					repinfo, leeway);
+				return 0;
+			}
 			lock_rw_unlock(&e->lock);
 			return 1;
 		}

doc/Changelog

@@ -1,3 +1,210 @@
+11 March 2010: Wouter
+	- another memory allocation option: --enable-alloc-nonregional.
+	  exposes the regional allocations to other memory purifiers.
+	- fix for memory alignment in struct sock_list allocation.
+	- Fix for MacPorts ldns without ssl default, unbound checks if ldns
+	  has dnssec functionality and uses the builtin if not.
+	- Fix daemonize on Solaris 10, it did not detach from terminal.
+
+10 March 2010: Wouter
+	- --enable-alloc-lite works with test set.
+	- portability in the testset: printf format conversions, prototypes.
+
+9 March 2010: Wouter
+	- tag 1.4.2 created.
+	- trunk is 1.4.3 in development.
+	- --enable-alloc-lite debug option.
+
+8 March 2010: Wouter
+	- iana portlist updated.
+
+4 March 2010: Wouter
+	- Fix crash in control channel code.
+
+3 March 2010: Wouter
+	- better casts in pipe code, brackets placed wrongly.
+	- iana portlist updated.
+
+1 March 2010: Wouter
+	- make install depends on make all.
+	- Fix 5011 auto-trust-anchor-file initial read to skip RRSIGs.
+	- --enable-checking: enables assertions but does not look nonproduction.
+	- nicer VERB_DETAIL (verbosity 2, unbound-host -d) output, with
+	  nxdomain and nodata distinguished.
+	- ldns tarball updated.
+	- --disable-rpath fixed for libtool not found errors.
+	- new fedora specfile from Fedora13 in contrib from Paul Wouters.
+
+26 February 2010: Wouter
+	- Fixup prototype for lexer cleanup in daemon code.
+	- unbound-control list_stubs, list_forwards, list_local_zones and
+	  list_local_data.
+
+24 February 2010: Wouter
+	- Fix scrubber bug that potentially let NS records through.  Reported
+	  by Amanda Constant.
+	- Also delete potential poison references from additional.
+	- Fix: no classification of a forwarder as lame, throw away instead.
+
+23 February 2010: Wouter
+	- libunbound ub_ctx_get_option() added.
+	- unbound-control set_option and get_option commands.
+	- iana portlist updated.
+
+18 February 2010: Wouter
+	- A little more strict DS scrubbing.
+	- No more blacklisting of unresponsive servers, a 2 minute timeout
+	  is backed off to.
+	- RD flag not enabled for dnssec-blacklisted tries, unless necessary.
+	- pickup ldns compile fix, libdl for libcrypto.
+	- log 'tcp connect: connection timed out' only in high verbosity.
+	- unbound-control log_reopen command.
+	- moved get_option code from unbound-checkconf to util/config_file.c
+
+17 February 2010: Wouter
+	- Disregard DNSKEY from authority section for chain of trust.
+	  DS records that are irrelevant to a referral scrubbed.  Anti-poison.
+	- iana portlist updated.
+
+16 February 2010: Wouter
+	- Check for 'no space left on device' (or other errors) when 
+	  writing updated autotrust anchors and print errno to log.
+
+15 February 2010: Wouter
+	- Fixed the requery protection, the TTL was 0, it is now 900 seconds,
+	  hardcoded.  We made the choice to send out more conservatively,
+	  protecting against an aggregate effect more than protecting a
+	  single user (from their own folly, perhaps in case of misconfig).
+
+12 February 2010: Wouter
+	- Re-query pattern changed on validation failure.  To protect troubled
+	  authority servers, unbound caches a failure for the DNSKEY or DS
+	  records for the entire zone, and only retries that 900 seconds later.
+	  This implies that only a handful of packets are sent extra to the
+	  authority if the zone fails.
+
+11 February 2010: Wouter
+	- ldns tarball update for long label length syntax error fix.
+	- iana portlist updated.
+
+9 February 2010: Wouter
+	- Fixup in compat snprintf routine, %f 1.02 and %g support.
+	- include math.h for testbound test compile portability.
+
+2 February 2010: Wouter
+	- Updated url of IANA itar, interim trust anchor repository, in script.
+
+1 February 2010: Wouter
+	- iana portlist updated.
+	- configure test for memcmp portability.
+
+27 January 2010: Wouter
+	- removed warning on format string in validator error log statement.
+	- iana portlist updated.
+
+22 January 2010: Wouter
+	- libtool finish the install of unbound python dynamic library.
+
+21 January 2010: Wouter
+	- acx_nlnetlabs.m4 synchronised with nsd's version.
+
+20 January 2010: Wouter
+	- Fixup lookup trouble for parent-child domains on the first query.
+
+14 January 2010: Wouter
+	- Fixup ldns detection to also check for header files.
+
+13 January 2010: Wouter
+	- prefetch-key option that performs DNSKEY queries earlier in the
+	  validation process, and that could halve the latency on DNSSEC
+	  queries.  It takes some extra processing (CPU, a cache is needed).
+
+12 January 2010: Wouter
+	- Fix unbound-checkconf for auto-trust-anchor-file present checks.
+
+8 January 2010: Wouter
+	- Fix for parent-child disagreement code which could have trouble
+	  when (a) ipv6 was disabled and (b) the TTL for parent and child
+	  were different.  There were two bugs, the parent-side information
+	  is fixed to no longer block lookup of child side information and
+	  the iterator is fixed to no longer attempt to get ipv6 when it is
+	  not enabled and then give up in failure.
+	- test and fixes to make prefetch actually store the answer in the
+	  cache.  Considers some rrsets 'already expired' but does not allow
+	  overwriting of rrsets considered more secure.
+
+7 January 2010: Wouter
+	- Fixup python documentation (thanks Leo Vandewoestijne).
+	- Work on cache prefetch feature.
+	- Stats for prefetch, in log print stats, unbound-control stats
+	  and in unbound_munin plugin.
+
+6 January 2010: Wouter
+	- iana portlist updated.
+	- bug#291: DNS wireformat max is 255. dname_valid allowed 256 length.
+	- verbose output includes parent-side-address notion for lameness.
+	- documented val-log-level: 2 setting in example.conf and man page.
+	- change unbound-control-setup from 1024(sha1) to 1536(sha256).
+
+1 January 2010: Wouter
+	- iana portlist updated.
+
+22 December 2009: Wouter
+	- configure with newer libtool 2.2.6b.
+
+17 December 2009: Wouter
+	- review comments.
+	- tag 1.4.1.
+	- trunk to version 1.4.2.
+	
+15 December 2009: Wouter
+	- Answer to qclass=ANY queries, with class IN contents.
+	  Test that validation also works.
+	- updated ldns snapshot tarball with latest fixes (parsing records).
+
+11 December 2009: Wouter
+	- on IPv4 UDP turn off DF flag.
+
+10 December 2009: Wouter
+	- requirements.txt updated with design choice explanations.
+	- Reading fixes: fix to set unlame when child confirms parent glue,
+	  and fix to avoid duplicate addresses in delegation point.
+	- verify_rrsig routine checks expiration last.
+
+9 December 2009: Wouter
+	- Fix Bug#287(reopened): update of ldns tarball with fix for parse
+	  errors generated for domain names like '.example.com'.
+	- Fix SOA excluded from negative DS responses.  Reported by Hauke
+	  Lampe.  The negative cache did not include proper SOA records for
+	  negative qtype DS responses which makes BIND barf on it, such
+	  responses are now only used internally.
+	- Fix negative cache lookup of closestencloser check of DS type bit.
+
+8 December 2009: Wouter
+	- Fix for lookup of parent-child disagreement domains, where the
+	  parent-side glue works but it does not provide proper NS, A or AAAA
+	  for itself, fixing domains such as motorcaravanners.eu.
+	- Feature: you can specify a port number in the interface: line, so
+	  you can bind the same interface multiple times at different ports.
+
+7 December 2009: Wouter
+	- Bug#287: Fix segfault when unbound-control remove nonexistent local
+	  data.  Added check to tests.
+
+1 December 2009: Wouter
+	- Fix crash with module-config "iterator".
+	- Added unit test that has "iterator" module-config.
+
+30 November 2009: Wouter
+	- bug#284: fix parse of # without end-of-line at end-of-file.
+
+26 November 2009: Wouter
+	- updated ldns with release candidate for version 1.6.3.
+	- tag for 1.4.0 release.
+	- 1.4.1 version in trunk.
+	- Fixup major libtool version to 2 because of why_bogus change.
+	  It was 1:5:0 but should have been 2:0:0.
+
 23 November 2009: Wouter
 	- Patch from David Hubbard for libunbound manual page.
 	- Fixup endless spinning in unbound-control stats reported by

doc/README

@@ -32,6 +32,10 @@ This software is under BSD license, see LICENSE for details.
 	This disables pthreads. Without this option the pthreads library 
 	is detected automatically. Use this option to disable threading
 	altogether, or, on Solaris, also use --with(out)-solaris-threads.
+  * --enable-checking
+  	This enables assertions in the code that guard against a variety of
+	programming errors, among which buffer overflows.  The program exits
+	with an error if an assertion fails (but the buffer did not overflow).
   * --enable-static-exe
 	This enables a debug option to statically link, against ldns and 
 	libevent libraries.

doc/example.conf.in

@@ -32,10 +32,11 @@ server:
 	# specify the interfaces to answer queries from by ip-address.
 	# The default is to listen to localhost (127.0.0.1 and ::1).
 	# specify 0.0.0.0 and ::0 to bind to all available interfaces.
-	# specify every interface on a new 'interface:' labelled line.
+	# specify every interface[@port] on a new 'interface:' labelled line.
 	# The listen interfaces are not changed on reload, only on restart.
 	# interface: 192.0.2.153
 	# interface: 192.0.2.154
+	# interface: 192.0.2.154@5003
 	# interface: 2001:DB8::5
 
 	# enable this feature to copy the source address of queries to reply.
@@ -293,6 +294,12 @@ server:
 	# if no, localhost can be queried (for testing and debugging).
 	# do-not-query-localhost: yes
 
+	# if yes, perform prefetching of almost expired message cache entries.
+	# prefetch: no
+
+	# if yes, perform key lookups adjacent to normal lookups.
+	# prefetch-key: no
+
 	# module configuration of the server. A string with identifiers
 	# separated by spaces. "iterator" or "validator iterator"
 	# module-config: "validator iterator"
@@ -356,7 +363,7 @@ server:
 	# val-permissive-mode: no
 
 	# Have the validator log failed validations for your diagnosis.
-	# 0: off. 1: A line per failed user query.
+	# 0: off. 1: A line per failed user query. 2: With reason and bad IP.
 	# val-log-level: 0
 
 	# It is possible to configure NSEC3 maximum iteration counts per

doc/libunbound.3.in

@@ -17,6 +17,7 @@
 .B ub_ctx_create,
 .B ub_ctx_delete,
 .B ub_ctx_set_option,
+.B ub_ctx_get_option,
 .B ub_ctx_config,
 .B ub_ctx_set_fwd,
 .B ub_ctx_resolvconf,
@@ -56,6 +57,9 @@
 \fBub_ctx_set_option\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR opt, \fIchar*\fR val);
 .LP
 \fIint\fR
+\fBub_ctx_get_option\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR opt, \fIchar**\fR val);
+.LP
+\fIint\fR
 \fBub_ctx_config\fR(\fIstruct ub_ctx*\fR ctx, \fIchar*\fR fname);
 .LP
 \fIint\fR
@@ -178,6 +182,11 @@ config file format, see \fIunbound.conf\fR(5). Not all options are
 relevant. For some specific options, such as adding trust anchors, special
 routines exist. Pass the option name with the trailing ':'.
 .TP
+.B ub_ctx_get_option
+A power\-user interface that gets an option value.  Some options cannot be
+gotten, and others return a newline separated list.  Pass the option name
+without trailing ':'.  The returned value must be free(2)d by the caller.
+.TP
 .B ub_ctx_config
 A power\-user interface that lets you specify an unbound config file, see
 \fIunbound.conf\fR(5), which is read for configuration. Not all options are

doc/requirements.txt

@@ -260,3 +260,35 @@ o NXDOMAIN and SOA serial numbers.
   updated more carefully.  If one of the NSEC records in an NXDOMAIN is
   updated from another query, the NXDOMAIN is dropped from the cache,
   and queried for again, so that its proof can be checked again.
+
+o SOA records in negative cached answers for DS queries.
+  The current unbound code uses a negative cache for queries for type DS.
+  This speeds up building chains of trust, and uses NSEC and NSEC3
+  (optout) information to speed up lookups.  When used internally,
+  the bare NSEC(3) information is sufficient, probably picked up from
+  a referral.  When answering to clients, a SOA record is needed for
+  the correct message format, a SOA record is picked from the cache
+  (and may not actually match the serial number of the SOA for which the
+  NSEC and NSEC3 records were obtained) if available otherwise network
+  queries are performed to get the data.
+
+o Parent and child with different nameserver information.
+  A misconfiguration that sometimes happens is where the parent and child
+  have different NS, glue information.  The child is authoritative, and
+  unbound will not trust information from the parent nameservers as the
+  final answer.  To help lookups, unbound will however use the parent-side
+  version of the glue as a last resort lookup.  This resolves lookups for
+  those misconfigured domains where the servers reported by the parent
+  are the only ones working, and servers reported by the child do not.
+
+o Failure of validation and probing.
+  Retries on a validation failure are now 5x to a different nameserver IP
+  (if possible), and then it gives up, for one name, type, class entry in
+  the message cache.  If a DNSKEY or DS fails in the chain of trust in the
+  key cache additionally, after the probing, a bad key entry is created that
+  makes the entire zone bogus for 900 seconds.  This is a fixed value at
+  this time and is conservative in sending probes.  It makes the compound
+  effect of many resolvers less and easier to handle, but penalizes
+  individual resolvers by having less probes and a longer time before fixes
+  are picked up.
+

doc/unbound-control.8.in

@@ -57,6 +57,11 @@ Change verbosity value for logging. Same values as \fBverbosity\fR keyword in
 \fIunbound.conf\fR(5).  This new setting lasts until the server is issued
 a reload (taken from config file again), or the next verbosity control command.
 .TP
+.B log_reopen
+Reopen the logfile, close and open it.  Useful for logrotation to make the
+daemon release the file it is logging to.  If you are using syslog it will
+attempt to close and open the syslog (which may not work if chrooted).
+.TP
 .B stats
 Print statistics. Resets the internal counters to zero, this can be 
 controlled using the \fBstatistics\-cumulative\fR config statement. 
@@ -137,7 +142,33 @@ Show what is worked on.  Prints all queries that the server is currently
 working on.  Prints the time that users have been waiting.  For internal
 requests, no time is printed.  And then prints out the module status.
 .TP
-.B forward [off | addr ... ]
+.B set_option \fIopt: val
+Set the option to the given value without a reload.  The cache is therefore
+not flushed.  The option must end with a ':' and whitespace must be between the
+option and the value.  Some values may not have an effect if set this way,
+the new values are not written to the config file, not all options are supported.
+.TP
+.B get_option \fIopt
+Get the value of the option.  Give the option name without a trailing ':'.
+The value is printed.  If the value is "", nothing is printed and the
+connection closes.  On error 'error ...' is printed (it gives a syntax
+error on unknown option).  For some options a list of values, one on
+each line, is printed.  Not all options are supported.
+.TP
+.B list_stubs
+List the stub zones in use.  These are printed one by one to the output.
+This includes the root hints in use.
+.TP
+.B list_forwards
+List the forward zones in use.  These are printed zone by zone to the output.
+.TP
+.B list_local_zones
+List the local zones in use.  These are printed one per line with zone type.
+.TP
+.B list_local_data
+List the local data RRs in use.  The resource records are printed.
+.TP
+.B forward \fR[\fIoff\fR | \fIaddr ...\fR ]
 Setup forwarding mode.  Configures if the server should ask other upstream
 nameservers, should go to the internet root nameservers itself, or show 
 the current config.  You could pass the nameservers after a DHCP update.
@@ -186,6 +217,13 @@ number of queries that were successfully answered using a cache lookup
 .I threadX.num.cachemiss
 number of queries that needed recursive processing
 .TP
+.I threadX.num.prefetch
+number of cache prefetches performed.  This number is included in
+cachehits, as the original query had the unprefetched answer from cache,
+and resulted in recursive processing, taking a slot in the requestlist.
+Not part of the recursivereplies (or the histogram thereof) or cachemiss,
+as a cache response was sent.
+.TP
 .I threadX.num.recursivereplies
 The number of replies sent to queries that needed recursive processing. Could be smaller than threadX.num.cachemiss if due to timeouts no replies were sent for some queries.
 .TP
@@ -227,6 +265,9 @@ summed over threads.
 .I total.num.cachemiss
 summed over threads.
 .TP
+.I total.num.prefetch
+summed over threads.
+.TP
 .I total.num.recursivereplies
 summed over threads.
 .TP

doc/unbound.conf.5.in

@@ -108,12 +108,15 @@ The number of threads to create to serve clients. Use 1 for no threading.
 .B port: \fI<port number>
 The port number, default 53, on which the server responds to queries.
 .TP
-.B interface: \fI<ip address>
+.B interface: \fI<ip address[@port]>
 Interface to use to connect to the network. This interface is listened to
 for queries from clients, and answers to clients are given from it.
 Can be given multiple times to work on several interfaces. If none are 
 given the default is to listen to localhost.
 The interfaces are not changed on a reload (kill \-HUP) but only on restart.
+A port number can be specified with @port (without spaces between
+interface and port number), if not specified the default port (from
+\fBport\fR) is used.
 .TP
 .B interface\-automatic: \fI<yes or no>
 Detect source interface on UDP queries and copy them to replies.  This 
@@ -500,6 +503,17 @@ If yes, localhost is added to the do\-not\-query\-address entries, both
 IP6 ::1 and IP4 127.0.0.1/8. If no, then localhost can be used to send
 queries to. Default is yes.
 .TP
+.B prefetch: \fI<yes or no>
+If yes, message cache elements are prefetched before they expire to
+keep the cache up to date.  Default is no.  Turning it on gives about
+10 percent more traffic and load on the machine, but popular items do
+not expire from the cache.
+.TP
+.B prefetch-key: \fI<yes or no>
+If yes, fetch the DNSKEYs earlier in the validation process, when a DS
+record is encountered.  This lowers the latency of requests.  It does use
+a little more CPU.  Also if the cache is set to 0, it is no use. Default is no.
+.TP
 .B module\-config: \fI<"module names">
 Module configuration, a list of module names separated by spaces, surround
 the string with quotes (""). The modules can be validator, iterator.
@@ -593,11 +607,13 @@ to protect the users that rely on this validator for authentication from
 protentially bad data in the additional section.
 .TP
 .B val\-log\-level: \fI<number>
-Have the validator print validation failures to the log.  Regardless of the
-verbosity setting.  Default is 0, off. At 1, for every user query that fails
-a line is printed to the logs.  This way you can monitor what happens with
-validation.  Use a diagnosis tool, such as dig or drill, to find out why 
-validation is failing for these queries.
+Have the validator print validation failures to the log.  Regardless of
+the verbosity setting.  Default is 0, off.  At 1, for every user query
+that fails a line is printed to the logs.  This way you can monitor what
+happens with validation.  Use a diagnosis tool, such as dig or drill,
+to find out why validation is failing for these queries.  At 2, not only
+the query that failed is printed but also the reason why unbound thought
+it was wrong and which server sent the faulty data.
 .TP
 .B val\-permissive\-mode: \fI<yes or no>
 Instruct the validator to mark bogus messages as indeterminate. The security
@@ -917,7 +933,7 @@ The
 clause gives the settings for the \fIpython\fR(1) script module.  This module
 acts like the iterator and validator modules do, on queries and answers.
 To enable the script module it has to be compiled into the daemon,
-and the word "python" has to be put in the \fBmodule\-conf:\fR option
+and the word "python" has to be put in the \fBmodule\-config:\fR option
 (usually first, or between the validator and iterator).
 .TP
 .B python\-script: \fI<python file>\fR

install-sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # install - install a program, script, or datafile
 
-scriptversion=2006-12-25.00
+scriptversion=2009-04-28.21; # UTC
 
 # This originates from X11R5 (mit/util/scripts/install.sh), which was
 # later released in X11R6 (xc/config/util/install.sh) with the
@@ -515,5 +515,6 @@ done
 # eval: (add-hook 'write-file-hooks 'time-stamp)
 # time-stamp-start: "scriptversion="
 # time-stamp-format: "%:y-%02m-%02d.%02H"
-# time-stamp-end: "$"
+# time-stamp-time-zone: "UTC"
+# time-stamp-end: "; # UTC"
 # End:

iterator/iter_delegpt.c

@@ -78,7 +78,7 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 	}
 	for(a = dp->target_list; a; a = a->next_target) {
 		if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen, 
-			a->bogus, 0))
+			a->bogus, a->lame, 0))
 			return NULL;
 	}
 	return copy;
@@ -147,30 +147,35 @@ delegpt_find_addr(struct delegpt* dp, struct sockaddr_storage* addr,
 int 
 delegpt_add_target(struct delegpt* dp, struct regional* region, 
 	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
-	socklen_t addrlen, int bogus, int nodup)
+	socklen_t addrlen, int bogus, int lame, int nodup)
 {
 	struct delegpt_ns* ns = delegpt_find_ns(dp, name, namelen);
 	if(!ns) {
 		/* ignore it */
 		return 1;
 	}
-	if(addr_is_ip6(addr, addrlen))
-		ns->got6 = 1;
-	else	ns->got4 = 1;
-	if(ns->got4 && ns->got6)
-		ns->resolved = 1;
-	return delegpt_add_addr(dp, region, addr, addrlen, bogus, nodup);
+	if(!lame) {
+		if(addr_is_ip6(addr, addrlen))
+			ns->got6 = 1;
+		else	ns->got4 = 1;
+		if(ns->got4 && ns->got6)
+			ns->resolved = 1;
+	}
+	return delegpt_add_addr(dp, region, addr, addrlen, bogus, lame, nodup);
 }
 
 int 
 delegpt_add_addr(struct delegpt* dp, struct regional* region, 
-	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, int nodup)
+	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, 
+	int lame, int nodup)
 {
 	struct delegpt_addr* a;
 	if(nodup) {
 		if((a = delegpt_find_addr(dp, addr, addrlen))) {
 			if(bogus)
 				a->bogus = bogus;
+			if(!lame)
+				a->lame = 0;
 			return 1;
 		}
 	}
@@ -188,6 +193,7 @@ delegpt_add_addr(struct delegpt* dp, struct regional* region,
 	a->addrlen = addrlen;
 	a->attempts = 0;
 	a->bogus = bogus;
+	a->lame = lame;
 	return 1;
 }
 
@@ -250,10 +256,11 @@ void delegpt_log(enum verbosity_value v, struct delegpt* dp)
 			(dp->bogus?" BOGUS":"") );
 		}
 		for(a = dp->target_list; a; a = a->next_target) {
-			if(a->bogus) 
-				log_addr(VERB_ALGO, "  BOGUS ", 
-					&a->addr, a->addrlen);
-			else log_addr(VERB_ALGO, "  ", &a->addr, a->addrlen);
+			const char* str = "  ";
+			if(a->bogus && a->lame) str = "  BOGUS ADDR_LAME ";
+			else if(a->bogus) str = "  BOGUS ";
+			else if(a->lame) str = "  ADDR_LAME ";
+			log_addr(VERB_ALGO, str, &a->addr, a->addrlen);
 		}
 	}
 }
@@ -332,10 +339,10 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 			continue;
 
 		if(ntohs(s->rk.type) == LDNS_RR_TYPE_A) {
-			if(!delegpt_add_rrset_A(dp, region, s, 0))
+			if(!delegpt_add_rrset_A(dp, region, s, 0, 0))
 				return NULL;
 		} else if(ntohs(s->rk.type) == LDNS_RR_TYPE_AAAA) {
-			if(!delegpt_add_rrset_AAAA(dp, region, s, 0))
+			if(!delegpt_add_rrset_AAAA(dp, region, s, 0, 0))
 				return NULL;
 		}
 	}
@@ -365,7 +372,7 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
-	struct ub_packed_rrset_key* ak, int nodup)
+	struct ub_packed_rrset_key* ak, int lame, int nodup)
 {
         struct packed_rrset_data* d=(struct packed_rrset_data*)ak->entry.data;
         size_t i;
@@ -380,7 +387,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
                 memmove(&sa.sin_addr, d->rr_data[i]+2, INET_SIZE);
                 if(!delegpt_add_target(dp, region, ak->rk.dname,
                         ak->rk.dname_len, (struct sockaddr_storage*)&sa,
-                        len, (d->security==sec_status_bogus), nodup))
+                        len, (d->security==sec_status_bogus), lame, nodup))
                         return 0;
         }
         return 1;
@@ -388,7 +395,7 @@ delegpt_add_rrset_A(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
-	struct ub_packed_rrset_key* ak, int nodup)
+	struct ub_packed_rrset_key* ak, int lame, int nodup)
 {
         struct packed_rrset_data* d=(struct packed_rrset_data*)ak->entry.data;
         size_t i;
@@ -403,7 +410,7 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
                 memmove(&sa.sin6_addr, d->rr_data[i]+2, INET6_SIZE);
                 if(!delegpt_add_target(dp, region, ak->rk.dname,
                         ak->rk.dname_len, (struct sockaddr_storage*)&sa,
-                        len, (d->security==sec_status_bogus), nodup))
+                        len, (d->security==sec_status_bogus), lame, nodup))
                         return 0;
         }
         return 1;
@@ -418,9 +425,9 @@ delegpt_add_rrset(struct delegpt* dp, struct regional* region,
 	if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_NS)
 		return delegpt_rrset_add_ns(dp, region, rrset);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_A)
-		return delegpt_add_rrset_A(dp, region, rrset, 0);
+		return delegpt_add_rrset_A(dp, region, rrset, 0, 1);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_AAAA)
-		return delegpt_add_rrset_AAAA(dp, region, rrset, 0);
+		return delegpt_add_rrset_AAAA(dp, region, rrset, 0, 1);
 	log_warn("Unknown rrset type added to delegpt");
 	return 1;
 }
@@ -444,3 +451,13 @@ void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg)
 		}
 	}
 }
+
+void delegpt_no_ipv6(struct delegpt* dp)
+{
+	struct delegpt_ns* ns;
+	for(ns = dp->nslist; ns; ns = ns->next) {
+		/* no ipv6, so only ipv4 is enough to resolve a nameserver */
+		if(ns->got4)
+			ns->resolved = 1;
+	}
+}

iterator/iter_delegpt.h

@@ -121,6 +121,8 @@ struct delegpt_addr {
 	/** if true, the A or AAAA RR was bogus, so this address is bad.
 	 * Also check the dp->bogus to see if everything is bogus. */
 	int bogus;
+	/** if true, this address is dispreferred: it is a lame IP address */
+	int lame;
 };
 
 /**
@@ -178,35 +180,38 @@ int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
  * @param addr: the address.
  * @param addrlen: the length of addr.
  * @param bogus: security status for the address, pass true if bogus.
+ * @param lame: address is lame.
  * @param nodup: if true, no address duplicates are made by this add. 
  *	name duplicates are always filtered.
  * @return false on error.
  */
 int delegpt_add_target(struct delegpt* dp, struct regional* regional, 
 	uint8_t* name, size_t namelen, struct sockaddr_storage* addr, 
-	socklen_t addrlen, int bogus, int nodup);
+	socklen_t addrlen, int bogus, int lame, int nodup);
 
 /**
  * Add A RRset to delegpt.
  * @param dp: delegation point.
  * @param regional: where to allocate the info.
  * @param rrset: RRset A to add.
+ * @param lame: rrset is lame, disprefer it.
  * @param nodup: if true, no duplicates are made by this add. takes time.
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset_A(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, int nodup);
+	struct ub_packed_rrset_key* rrset, int lame, int nodup);
 
 /**
  * Add AAAA RRset to delegpt.
  * @param dp: delegation point.
  * @param regional: where to allocate the info.
  * @param rrset: RRset AAAA to add.
+ * @param lame: rrset is lame, disprefer it.
  * @param nodup: if true, no duplicates are made by this add. takes time.
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset, int nodup);
+	struct ub_packed_rrset_key* rrset, int lame, int nodup);
 
 /**
  * Add any RRset to delegpt.
@@ -226,11 +231,13 @@ int delegpt_add_rrset(struct delegpt* dp, struct regional* regional,
  * @param addr: the address.
  * @param addrlen: the length of addr.
  * @param bogus: if address is bogus.
+ * @param lame: if address is lame.
  * @param nodup: if true, no duplicates are made by this add. takes time.
  * @return false on error.
  */
 int delegpt_add_addr(struct delegpt* dp, struct regional* regional, 
-	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, int nodup);
+	struct sockaddr_storage* addr, socklen_t addrlen, int bogus, 
+	int lame, int nodup);
 
 /** 
  * Find NS record in name list of delegation point.
@@ -307,4 +314,11 @@ struct delegpt* delegpt_from_message(struct dns_msg* msg,
  */
 void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg);
 
+/**
+ * Register the fact that there is no ipv6 and thus AAAAs are not going 
+ * to be queried for or be useful.
+ * @param dp: the delegation point. Updated to reflect no ipv6.
+ */
+void delegpt_no_ipv6(struct delegpt* dp);
+
 #endif /* ITERATOR_ITER_DELEGPT_H */

iterator/iter_fwd.c

@@ -212,7 +212,8 @@ read_fwds_addr(struct iter_forwards* fwd, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_addr(dp, fwd->region, &addr, addrlen, 0, 1)) {
+		if(!delegpt_add_addr(dp, fwd->region, &addr, addrlen, 
+			0, 0, 1)) {
 			log_err("out of memory");
 			return 0;
 		}
@@ -352,6 +353,56 @@ forwards_lookup_root(struct iter_forwards* fwd, uint16_t qclass)
 	return forwards_lookup(fwd, &root, qclass);
 }
 
+int
+forwards_next_root(struct iter_forwards* fwd, uint16_t* dclass)
+{
+	struct iter_forward_zone key;
+	rbnode_t* n;
+	struct iter_forward_zone* p;
+	if(*dclass == 0) {
+		/* first root item is first item in tree */
+		n = rbtree_first(fwd->tree);
+		if(n == RBTREE_NULL)
+			return 0;
+		p = (struct iter_forward_zone*)n;
+		if(dname_is_root(p->name)) {
+			*dclass = p->dclass;
+			return 1;
+		}
+		/* root not first item? search for higher items */
+		*dclass = p->dclass + 1;
+		return forwards_next_root(fwd, dclass);
+	}
+	/* find class n in tree, we may get a direct hit, or if we don't
+	 * this is the last item of the previous class so rbtree_next() takes
+	 * us to the next root (if any) */
+	key.node.key = &key;
+	key.name = (uint8_t*)"\000";
+	key.namelen = 1;
+	key.namelabs = 0;
+	key.dclass = *dclass;
+	n = NULL;
+	if(rbtree_find_less_equal(fwd->tree, &key, &n)) {
+		/* exact */
+		return 1;
+	} else {
+		/* smaller element */
+		if(!n || n == RBTREE_NULL)
+			return 0; /* nothing found */
+		n = rbtree_next(n);
+		if(n == RBTREE_NULL)
+			return 0; /* no higher */
+		p = (struct iter_forward_zone*)n;
+		if(dname_is_root(p->name)) {
+			*dclass = p->dclass;
+			return 1;
+		}
+		/* not a root node, return next higher item */
+		*dclass = p->dclass+1;
+		return forwards_next_root(fwd, dclass);
+	}
+}
+
 size_t 
 forwards_get_mem(struct iter_forwards* fwd)
 {

iterator/iter_fwd.h

@@ -55,7 +55,7 @@ struct iter_forwards {
 	struct regional* region;
 	/** 
 	 * Zones are stored in this tree. Sort order is specially chosen.
-	 * first sorted on qtype. Then on dname in nsec-like order, so that
+	 * first sorted on qclass. Then on dname in nsec-like order, so that
 	 * a lookup on class, name will return an exact match or the closest
 	 * match which gives the ancestor needed.
 	 * contents of type iter_forward_zone.
@@ -128,6 +128,14 @@ struct delegpt* forwards_lookup(struct iter_forwards* fwd,
 struct delegpt* forwards_lookup_root(struct iter_forwards* fwd, 
 	uint16_t qclass);
 
+/**
+ * Find next root item in forwards lookup tree.
+ * @param fwd: the forward storage
+ * @param qclass: class to look at next, or higher.
+ * @return false if none found, or if true stored in qclass.
+ */
+int forwards_next_root(struct iter_forwards* fwd, uint16_t* qclass);
+
 /**
  * Get memory in use by forward storage
  * @param fwd: forward storage.

iterator/iter_hints.c

@@ -86,7 +86,7 @@ ah(struct delegpt* dp, struct regional* r, const char* sv, const char* ip)
 	if(!delegpt_add_ns(dp, r, ldns_rdf_data(rdf)) ||
 	   !extstrtoaddr(ip, &addr, &addrlen) ||
 	   !delegpt_add_target(dp, r, ldns_rdf_data(rdf), ldns_rdf_size(rdf),
-		&addr, addrlen, 0, 1)) {
+		&addr, addrlen, 0, 0, 1)) {
 		ldns_rdf_deep_free(rdf);
 		return 0;
 	}
@@ -225,7 +225,8 @@ read_stubs_addr(struct iter_hints* hints, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_addr(dp, hints->region, &addr, addrlen, 0, 1)) {
+		if(!delegpt_add_addr(dp, hints->region, &addr, addrlen, 
+			0, 0, 1)) {
 			log_err("out of memory");
 			return 0;
 		}
@@ -318,7 +319,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 					ldns_rdf_data(ldns_rr_owner(rr)),
 					ldns_rdf_size(ldns_rr_owner(rr)),
 					(struct sockaddr_storage*)&sa, len, 
-					0, 1)) {
+					0, 0, 1)) {
 				log_err("out of memory reading root hints");
 				goto stop_read;
 			}
@@ -334,7 +335,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 					ldns_rdf_data(ldns_rr_owner(rr)),
 					ldns_rdf_size(ldns_rr_owner(rr)),
 					(struct sockaddr_storage*)&sa, len,
-					0, 1)) {
+					0, 0, 1)) {
 				log_err("out of memory reading root hints");
 				goto stop_read;
 			}
@@ -461,6 +462,11 @@ hints_lookup_stub(struct iter_hints* hints, uint8_t* qname,
 	return NULL;
 }
 
+int hints_next_root(struct iter_hints* hints, uint16_t* qclass)
+{
+	return name_tree_next_root(&hints->tree, qclass);
+}
+
 size_t 
 hints_get_mem(struct iter_hints* hints)
 {

iterator/iter_hints.h

@@ -56,7 +56,7 @@ struct iter_hints {
 	struct regional* region;
 	/** 
 	 * Hints are stored in this tree. Sort order is specially chosen.
-	 * first sorted on qtype. Then on dname in nsec-like order, so that
+	 * first sorted on qclass. Then on dname in nsec-like order, so that
 	 * a lookup on class, name will return an exact match or the closest
 	 * match which gives the ancestor needed.
 	 * contents of type iter_hints_stub. The class IN root is in here.
@@ -105,6 +105,18 @@ int hints_apply_cfg(struct iter_hints* hints, struct config_file* cfg);
  */
 struct delegpt* hints_lookup_root(struct iter_hints* hints, uint16_t qclass);
 
+/**
+ * Find next root hints (to cycle through all root hints).
+ * @param hints: hint storage
+ * @param qclass: class for which root hints are sought.
+ * 	0 means give the first available root hints class.
+ * 	x means, give class x or a higher class if any.
+ * 	returns the found class in this variable.
+ * @return true if a root hint class is found.
+ * 	false if not root hint class is found (qclass may have been changed).
+ */
+int hints_next_root(struct iter_hints* hints, uint16_t* qclass);
+
 /**
  * Given a qname/qclass combination, and the delegation point from the cache
  * for this qname/qclass, determine if this combination indicates that a

iterator/iter_resptype.c

@@ -234,6 +234,8 @@ response_type_from_server(int rdset,
 			/* If we are getting a referral upwards (or to 
 			 * the same zone), then the server is 'lame'. */
 			if(dname_subdomain_c(origzone, s->rk.dname)) {
+				if(rdset) /* forward or reclame not LAME */
+					return RESPONSE_TYPE_THROWAWAY;
 				return RESPONSE_TYPE_LAME;
 			}
 			/* If the NS set is below the delegation point we 

iterator/iter_scrub.c

@@ -303,6 +303,15 @@ pkt_sub(ldns_buffer* pkt, uint8_t* comprname, uint8_t* zone)
 	return dname_subdomain_c(buf, zone);
 }
 
+/** check subdomain with decompression, compressed is parent */
+static int
+sub_of_pkt(ldns_buffer* pkt, uint8_t* zone, uint8_t* comprname)
+{
+	uint8_t buf[LDNS_MAX_DOMAINLEN+1];
+	dname_pkt_copy(pkt, buf, comprname);
+	return dname_subdomain_c(zone, buf);
+}
+
 /**
  * This routine normalizes a response. This includes removing "irrelevant"
  * records from the answer and additional sections and (re)synthesizing
@@ -518,6 +527,18 @@ store_rrset(ldns_buffer* pkt, struct msg_parse* msg, struct module_env* env,
 		env->alloc, now);
 }
 
+/** Check if there are SOA records in the authority section (negative) */
+static int
+soa_in_auth(struct msg_parse* msg)
+{
+	struct rrset_parse* rrset;
+	for(rrset = msg->rrset_first; rrset; rrset = rrset->rrset_all_next)
+		if(rrset->type == LDNS_RR_TYPE_SOA &&
+			rrset->section == LDNS_SECTION_AUTHORITY) 
+			return 1;
+	return 0;
+}
+ 
 /**
  * Check if right hand name in NSEC is within zone
  * @param rrset: the NSEC rrset
@@ -566,6 +587,8 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 	struct query_info* qinfo, uint8_t* zonename, struct module_env* env,
 	struct iter_env* ie)
 {
+	int del_addi = 0; /* if additional-holding rrsets are deleted, we
+		do not trust the normalized additional-A-AAAA any more */
 	struct rrset_parse* rrset, *prev;
 	prev = NULL;
 	rrset = msg->rrset_first;
@@ -590,6 +613,7 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 	 * Remainders of CNAME chains are cut off and resolved by iterator. */
 	while(rrset && rrset->section == LDNS_SECTION_ANSWER) {
 		if(dname_pkt_compare(pkt, qinfo->qname, rrset->dname) != 0) {
+			if(has_additional(rrset->type)) del_addi = 1;
 			remove_rrset("sanitize: removing extraneous answer "
 				"RRset:", pkt, msg, prev, &rrset);
 			continue;
@@ -633,10 +657,15 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 				rrset->type == LDNS_RR_TYPE_NS && 
 				rrset->section == LDNS_SECTION_AUTHORITY &&
 				FLAGS_GET_RCODE(msg->flags) == 
-				LDNS_RCODE_NOERROR) {
+				LDNS_RCODE_NOERROR && !soa_in_auth(msg) &&
+				sub_of_pkt(pkt, zonename, rrset->dname)) {
 				/* noerror, nodata and this NS rrset is above
 				 * the zone. This is LAME! 
 				 * Leave in the NS for lame classification. */
+				/* remove everything from the additional
+				 * (we dont want its glue that was approved
+				 * during the normalize action) */
+				del_addi = 1;
 			} else if(!env->cfg->harden_glue) {
 				/* store in cache! Since it is relevant
 				 * (from normalize) it will be picked up 
@@ -646,11 +675,17 @@ scrub_sanitize(ldns_buffer* pkt, struct msg_parse* msg,
 				"poison RRset:", pkt, msg, prev, &rrset);
 				continue;
 			} else {
+				if(has_additional(rrset->type)) del_addi = 1;
 				remove_rrset("sanitize: removing potential "
 				"poison RRset:", pkt, msg, prev, &rrset);
 				continue;
 			}
 		}
+		if(del_addi && rrset->section == LDNS_SECTION_ADDITIONAL) {
+			remove_rrset("sanitize: removing potential "
+			"poison reference RRset:", pkt, msg, prev, &rrset);
+			continue;
+		}
 		/* check if right hand side of NSEC is within zone */
 		if(rrset->type == LDNS_RR_TYPE_NSEC &&
 			sanitize_nsec_is_overreach(rrset, zonename)) {

iterator/iter_utils.c

@@ -160,6 +160,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
  *		For non-blacklisted servers: huge timeout, but has traffic.
  *	USEFUL_SERVER_TOP_TIMEOUT ..
  *		dnsseclame servers get penalty
+ *		also for parent-side lame servers (lame in delegpt).
  *	USEFUL_SERVER_TOP_TIMEOUT*2 ..
  *		recursion lame servers get penalty
  *	UNKNOWN_SERVER_NICENESS 
@@ -192,16 +193,19 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 		name, namelen, qtype, &lame, &dnsseclame, &reclame, 
 		&rtt, &lost, now)) {
 		log_addr(VERB_ALGO, "servselect", &a->addr, a->addrlen);
-		verbose(VERB_ALGO, "   rtt=%d%s%s%s", rtt,
+		verbose(VERB_ALGO, "   rtt=%d lost=%d%s%s%s%s", rtt, lost,
 			lame?" LAME":"",
 			dnsseclame?" DNSSEC_LAME":"",
-			reclame?" REC_LAME":"");
+			reclame?" REC_LAME":"",
+			a->lame?" ADDR_LAME":"");
 		if(lame)
 			return -1; /* server is lame */
 		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT && 
 			lost >= USEFUL_SERVER_MAX_LOST)
-				/* server is unresponsive */
-			return USEFUL_SERVER_TOP_TIMEOUT; 
+			/* server is unresponsive, but keep trying slowly */
+			return USEFUL_SERVER_TOP_TIMEOUT+1;
+		else if(a->lame)
+			return rtt+USEFUL_SERVER_TOP_TIMEOUT+1; /* nonpref */
 		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT) /* not blacklisted*/
 			return USEFUL_SERVER_TOP_TIMEOUT+1; 
 		else if(reclame)
@@ -211,6 +215,8 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 		else	return rtt;
 	}
 	/* no server information present */
+	if(a->lame)
+		return USEFUL_SERVER_TOP_TIMEOUT+1; /* nonpref */
 	return UNKNOWN_SERVER_NICENESS;
 }
 
@@ -314,20 +320,22 @@ iter_server_selection(struct iter_env* iter_env,
 	if(num == 0)
 		return NULL;
 	verbose(VERB_ALGO, "selrtt %d", selrtt);
-	if(selrtt > USEFUL_SERVER_TOP_TIMEOUT*2) {
-		verbose(VERB_ALGO, "chase to recursion lame server");
-		*chase_to_rd = 1;
-	}
-	if(selrtt > USEFUL_SERVER_TOP_TIMEOUT) {
-		verbose(VERB_ALGO, "chase to dnssec lame server");
-		*dnssec_expected = 0;
-	}
-	if(selrtt == USEFUL_SERVER_TOP_TIMEOUT) {
-		verbose(VERB_ALGO, "chase to blacklisted lame server");
-		/* the best choice is a blacklisted, unresponsive server,
-		 * we need to throttle down our traffic towards it */
-		if(ub_random(env->rnd) % 100 != 1) {
-			/* 99% of the time, drop query */
+	if(selrtt > BLACKLIST_PENALTY) {
+		if(selrtt-BLACKLIST_PENALTY > USEFUL_SERVER_TOP_TIMEOUT*2) {
+			verbose(VERB_ALGO, "chase to recursion lame server");
+			*chase_to_rd = 1;
+		}
+	} else {
+		if(selrtt > USEFUL_SERVER_TOP_TIMEOUT*2) {
+			verbose(VERB_ALGO, "chase to recursion lame server");
+			*chase_to_rd = 1;
+		}
+		if(selrtt > USEFUL_SERVER_TOP_TIMEOUT) {
+			verbose(VERB_ALGO, "chase to dnssec lame server");
+			*dnssec_expected = 0;
+		}
+		if(selrtt == USEFUL_SERVER_TOP_TIMEOUT) {
+			verbose(VERB_ALGO, "chase to blacklisted lame server");
 			return NULL;
 		}
 	}
@@ -397,9 +405,9 @@ dns_copy_msg(struct dns_msg* from, struct regional* region)
 
 int 
 iter_dns_store(struct module_env* env, struct query_info* msgqinf,
-	struct reply_info* msgrep, int is_referral)
+	struct reply_info* msgrep, int is_referral, uint32_t leeway)
 {
-	return dns_cache_store(env, msgqinf, msgrep, is_referral);
+	return dns_cache_store(env, msgqinf, msgrep, is_referral, leeway);
 }
 
 int 
@@ -666,6 +674,7 @@ reply_equal(struct reply_info* p, struct reply_info* q)
 	if(p->flags != q->flags ||
 		p->qdcount != q->qdcount ||
 		p->ttl != q->ttl ||
+		p->prefetch_ttl != q->prefetch_ttl ||
 		p->security != q->security ||
 		p->an_numrrsets != q->an_numrrsets ||
 		p->ns_numrrsets != q->ns_numrrsets ||
@@ -678,3 +687,102 @@ reply_equal(struct reply_info* p, struct reply_info* q)
 	}
 	return 1;
 }
+
+void 
+iter_store_inzone_glue(struct module_env* env, struct query_info* qinfo,
+	struct reply_info* rep)
+{
+	struct rrset_ref ref;
+	struct ub_packed_rrset_key* rrset;
+	if(qinfo->qtype != LDNS_RR_TYPE_A && qinfo->qtype != LDNS_RR_TYPE_AAAA)
+		return;
+	rrset = reply_find_rrset(rep, qinfo->qname, qinfo->qname_len,
+		qinfo->qtype, qinfo->qclass);
+	if(!rrset)
+		return;
+	/* got A or AAAA glue rrset. store it in case its handy */
+	rrset = packed_rrset_copy_alloc(rrset, env->alloc, *env->now);
+	if(!rrset) {
+		log_err("malloc failure in store_inzone_glue");
+		return;
+	}
+	rrset->rk.flags |= PACKED_RRSET_PARENT_SIDE;
+	rrset->entry.hash = rrset_key_hash(&rrset->rk);
+	ref.key = rrset;
+	ref.id = rrset->id;
+	/* ignore ret: it was in the cache, ref updated */
+	(void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, *env->now);
+}
+
+int 
+iter_lookup_inzone_glue(struct module_env* env, struct delegpt* dp,
+	struct regional* region, struct query_info* qinfo)
+{
+	struct ub_packed_rrset_key* akey;
+	akey = rrset_cache_lookup(env->rrset_cache, qinfo->qname, 
+		qinfo->qname_len, qinfo->qtype, qinfo->qclass, 
+		PACKED_RRSET_PARENT_SIDE, *env->now, 0);
+	if(akey) {
+		if(qinfo->qtype == LDNS_RR_TYPE_A) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1)) {
+				lock_rw_unlock(&akey->entry.lock);
+				return 0;
+			}
+		} else if(qinfo->qtype == LDNS_RR_TYPE_AAAA) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1)) {
+				lock_rw_unlock(&akey->entry.lock);
+				return 0;
+			}
+		}
+		lock_rw_unlock(&akey->entry.lock);
+	}
+	return 1;
+}
+
+int 
+iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd, 
+	uint16_t* c)
+{
+	uint16_t c1 = *c, c2 = *c;
+	int r1 = hints_next_root(hints, &c1);
+	int r2 = forwards_next_root(fwd, &c2);
+	if(!r1 && !r2) /* got none, end of list */
+		return 0;
+	else if(!r1) /* got one, return that */
+		*c = c2;
+	else if(!r2)
+		*c = c1;
+	else if(c1 < c2) /* got both take smallest */
+		*c = c1;
+	else	*c = c2;
+	return 1;
+}
+
+void
+iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns, uint8_t* z)
+{
+	/* Only the DS record for the delegation itself is expected.
+	 * We allow DS for everything between the bailiwick and the 
+	 * zonecut, thus DS records must be at or above the zonecut.
+	 * And the DS records must be below the server authority zone.
+	 * The answer section is already scrubbed. */
+	size_t i = msg->rep->an_numrrsets;
+	while(i < (msg->rep->an_numrrsets + msg->rep->ns_numrrsets)) {
+		struct ub_packed_rrset_key* s = msg->rep->rrsets[i];
+		if(ntohs(s->rk.type) == LDNS_RR_TYPE_DS &&
+			(!ns || !dname_subdomain_c(ns->rk.dname, s->rk.dname)
+			|| query_dname_compare(z, s->rk.dname) == 0)) {
+			log_nametypeclass(VERB_ALGO, "removing irrelevant DS",
+				s->rk.dname, ntohs(s->rk.type),
+				ntohs(s->rk.rrset_class));
+			memmove(msg->rep->rrsets+i, msg->rep->rrsets+i+1,
+				sizeof(struct ub_packed_rrset_key*) * 
+				(msg->rep->rrset_count-i-1));
+			msg->rep->ns_numrrsets--;
+			msg->rep->rrset_count--;
+			/* stay at same i, but new record */
+			continue;
+		}
+		i++;
+	}
+}

iterator/iter_utils.h

@@ -44,6 +44,8 @@
 #define ITERATOR_ITER_UTILS_H
 #include "iterator/iter_resptype.h"
 struct iter_env;
+struct iter_hints;
+struct iter_forwards;
 struct config_file;
 struct module_env;
 struct delegpt_addr;
@@ -55,6 +57,7 @@ struct query_info;
 struct reply_info;
 struct module_qstate;
 struct sock_list;
+struct ub_packed_rrset_key;
 
 /**
  * Process config options and set iterator module state.
@@ -116,10 +119,11 @@ struct dns_msg* dns_copy_msg(struct dns_msg* from, struct regional* regional);
  * @param rep: reply in dns_msg from dns_alloc_msg for example.
  * @param is_referral: If true, then the given message to be stored is a
  *	referral. The cache implementation may use this as a hint.
+ * @param leeway: prefetch TTL leeway to expire old rrsets quicker.
  * @return 0 on alloc error (out of memory).
  */
 int iter_dns_store(struct module_env* env, struct query_info* qinf,
-	struct reply_info* rep, int is_referral);
+	struct reply_info* rep, int is_referral, uint32_t leeway);
 
 /**
  * Select randomly with n/m probability.
@@ -210,4 +214,46 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
  */
 int reply_equal(struct reply_info* p, struct reply_info* q);
 
+/**
+ * Store in-zone glue in seperate rrset cache entries for later last-resort
+ * lookups in case the child-side versions of this information fails.
+ * @param env: environment with cache, time, ...
+ * @param qinfo: query info. must match the information stored to avoid
+ * 	Kaminsky-style trouble.
+ * @param rep: reply with possibly A or AAAA content to store.
+ */
+void iter_store_inzone_glue(struct module_env* env, struct query_info* qinfo,
+	struct reply_info* rep);
+
+/**
+ * Find in-zone glue from rrset cache again.
+ * @param env: query env with rrset cache and time.
+ * @param dp: delegation point to store result in.
+ * @param region: region to alloc result in.
+ * @param qinfo: query into that is pertinent.
+ * @return false on malloc failure.
+ */
+int iter_lookup_inzone_glue(struct module_env* env, struct delegpt* dp,
+	struct regional* region, struct query_info* qinfo);
+
+/**
+ * Lookup next root-hint or root-forward entry.
+ * @param hints: the hints.
+ * @param fwd: the forwards.
+ * @param c: the class to start searching at. 0 means find first one.
+ * @return false if no classes found, true if found and returned in c.
+ */
+int iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd,
+	uint16_t* c);
+
+/**
+ * Remove DS records that are inappropriate before they are cached.
+ * @param msg: the response to scrub.
+ * @param ns: RRSET that is the NS record for the referral.
+ * 	if NULL, then all DS records are removed from the authority section.
+ * @param z: zone name that the response is from.
+ */
+void iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns,
+	uint8_t* z);
+
 #endif /* ITERATOR_ITER_UTILS_H */

iterator/iterator.c

@@ -195,6 +195,12 @@ error_supers(struct module_qstate* qstate, int id, struct module_qstate* super)
 				delegpt_log(VERB_ALGO, super_iq->dp);
 			log_assert(0);
 			return;
+		} else {
+			/* see if the failure did get (parent-lame) info */
+			if(!cache_fill_missing(super->env, 
+				super_iq->qchase.qclass, super->region, 
+				super_iq->dp))
+				log_err("out of memory adding missing");
 		}
 		dpns->resolved = 1; /* mark as failed */
 		super_iq->num_target_queries--; 
@@ -247,10 +253,11 @@ error_response_cache(struct module_qstate* qstate, int id, int rcode)
 	FLAGS_SET_RCODE(err.flags, rcode);
 	err.qdcount = 1;
 	err.ttl = NORR_TTL;
+	err.prefetch_ttl = PREFETCH_TTL_CALC(err.ttl);
 	/* do not waste time trying to validate this servfail */
 	err.security = sec_status_indeterminate;
 	verbose(VERB_ALGO, "store error response in message cache");
-	if(!iter_dns_store(qstate->env, &qstate->qinfo, &err, 0)) {
+	if(!iter_dns_store(qstate->env, &qstate->qinfo, &err, 0, 0)) {
 		log_err("error_response_cache: could not store error (nomem)");
 	}
 	return error_response(qstate, id, rcode);
@@ -776,6 +783,56 @@ generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id)
 	}
 }
 
+/**
+ * Generate a DNSKEY prefetch query to get the DNSKEY for the DS record we
+ * just got in a referral (where we have dnssec_expected, thus have trust
+ * anchors above it).  Note that right after calling this routine the
+ * iterator detached subqueries (because of following the referral), and thus
+ * the DNSKEY query becomes detached, its return stored in the cache for
+ * later lookup by the validator.  This cache lookup by the validator avoids
+ * the roundtrip incurred by the DNSKEY query.  The DNSKEY query is now
+ * performed at about the same time the original query is sent to the domain,
+ * thus the two answers are likely to be returned at about the same time,
+ * saving a roundtrip from the validated lookup.
+ *
+ * @param qstate: the qtstate that triggered the need to prime.
+ * @param iq: iterator query state.
+ * @param id: module id.
+ */
+static void
+generate_dnskey_prefetch(struct module_qstate* qstate, 
+	struct iter_qstate* iq, int id)
+{
+	struct module_qstate* subq;
+	log_assert(iq->dp);
+
+	/* is this query the same as the prefetch? */
+	if(qstate->qinfo.qtype == LDNS_RR_TYPE_DNSKEY &&
+		query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 &&
+		(qstate->query_flags&BIT_RD) && !(qstate->query_flags&BIT_CD)){
+		return;
+	}
+
+	/* if the DNSKEY is in the cache this lookup will stop quickly */
+	log_nametypeclass(VERB_ALGO, "schedule dnskey prefetch", 
+		iq->dp->name, LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass);
+	if(!generate_sub_request(iq->dp->name, iq->dp->namelen, 
+		LDNS_RR_TYPE_DNSKEY, iq->qchase.qclass, qstate, id, iq,
+		INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0)) {
+		/* we'll be slower, but it'll work */
+		verbose(VERB_ALGO, "could not generate dnskey prefetch");
+		return;
+	}
+	if(subq) {
+		struct iter_qstate* subiq = 
+			(struct iter_qstate*)subq->minfo[id];
+		/* this qstate has the right delegation for the dnskey lookup*/
+		/* make copy to avoid use of stub dp by different qs/threads */
+		subiq->dp = delegpt_copy(iq->dp, subq->region);
+		/* if !subiq->dp, it'll start from the cache, no problem */
+	}
+}
+
 /**
  * See if the query needs forwarding.
  * 
@@ -853,6 +910,12 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
 
+	/* If the request is qclass=ANY, setup to generate each class */
+	if(qstate->qinfo.qclass == LDNS_RR_CLASS_ANY) {
+		iq->qchase.qclass = 0;
+		return next_state(iq, COLLECT_CLASS_STATE);
+	}
+
 	/* Resolver Algorithm Step 1 -- Look for the answer in local data. */
 
 	/* This either results in a query restart (CNAME cache response), a
@@ -872,7 +935,8 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 			 * NOERROR/NODATA or NXDOMAIN answers that need validation */
 			msg = val_neg_getmsg(qstate->env->neg_cache, &iq->qchase,
 				qstate->region, qstate->env->rrset_cache,
-				qstate->env->scratch_buffer, *qstate->env->now);
+				qstate->env->scratch_buffer, 
+				*qstate->env->now, 1/*add SOA*/);
 		}
 	}
 	if(msg) {
@@ -882,7 +946,9 @@ processInitRequest(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(verbosity >= VERB_ALGO) {
 			log_dns_msg("msg from cache lookup", &msg->qinfo, 
 				msg->rep);
-			verbose(VERB_ALGO, "msg ttl is %d", (int)msg->rep->ttl);
+			verbose(VERB_ALGO, "msg ttl is %d, prefetch ttl %d", 
+				(int)msg->rep->ttl, 
+				(int)msg->rep->prefetch_ttl);
 		}
 
 		if(type == RESPONSE_TYPE_CNAME) {
@@ -1094,10 +1160,12 @@ processInitRequest2(struct module_qstate* qstate, struct iter_qstate* iq,
  *
  * @param qstate: query state.
  * @param iq: iterator query state.
+ * @param id: module id.
  * @return true, advancing the event to the QUERYTARGETS_STATE.
  */
 static int
-processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq)
+processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq, 
+	int id)
 {
 	log_query_info(VERB_QUERY, "resolving (init part 3): ", 
 		&qstate->qinfo);
@@ -1117,11 +1185,19 @@ processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq)
 			sock_list_insert(&qstate->reply_origin, NULL, 0, qstate->region);
 		return final_state(iq);
 	}
-
 	/* After this point, unset the RD flag -- this query is going to 
 	 * be sent to an auth. server. */
 	iq->chase_flags &= ~BIT_RD;
 
+	/* if dnssec expected, fetch key for the trust-anchor or cached-DS */
+	if(iq->dnssec_expected && qstate->env->cfg->prefetch_key &&
+		!(qstate->query_flags&BIT_CD)) {
+		generate_dnskey_prefetch(qstate, iq, id);
+		fptr_ok(fptr_whitelist_modenv_detach_subs(
+			qstate->env->detach_subs));
+		(*qstate->env->detach_subs)(qstate);
+	}
+
 	/* Jump to the next state. */
 	return next_state(iq, QUERYTARGETS_STATE);
 }
@@ -1295,6 +1371,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		verbose(VERB_QUERY, "Failed to get a delegation, giving up");
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 	}
+	if(!ie->supports_ipv6)
+		delegpt_no_ipv6(iq->dp);
 	delegpt_log(VERB_ALGO, iq->dp);
 
 	if(iq->num_current_queries>0) {
@@ -1531,16 +1609,23 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			|| !dname_subdomain_c(iq->qchase.qname, ns->rk.dname)){
 			verbose(VERB_ALGO, "bad referral, throwaway");
 			type = RESPONSE_TYPE_THROWAWAY;
-		}
-	}
+		} else
+			iter_scrub_ds(iq->response, ns, iq->dp->name);
+	} else iter_scrub_ds(iq->response, NULL, NULL);
 
 	/* handle each of the type cases */
 	if(type == RESPONSE_TYPE_ANSWER) {
 		/* ANSWER type responses terminate the query algorithm, 
 		 * so they sent on their */
-		verbose(VERB_DETAIL, "query response was ANSWER");
+		if(verbosity >= VERB_DETAIL) {
+			verbose(VERB_DETAIL, "query response was %s",
+				FLAGS_GET_RCODE(iq->response->rep->flags)
+				==LDNS_RCODE_NXDOMAIN?"NXDOMAIN ANSWER":
+				(iq->response->rep->an_numrrsets?"ANSWER":
+				"nodata ANSWER"));
+		}
 		if(!iter_dns_store(qstate->env, &iq->response->qinfo,
-			iq->response->rep, 0))
+			iq->response->rep, 0, qstate->prefetch_leeway))
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		/* close down outstanding requests to be discarded */
 		outbound_list_clear(&iq->outlist);
@@ -1569,22 +1654,29 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			    * see if that equals the query name... */
 			&& ( /* auth section, but sometimes in answer section*/
 			  reply_find_rrset_section_ns(iq->response->rep,
-				qstate->qinfo.qname, qstate->qinfo.qname_len,
-				LDNS_RR_TYPE_NS, qstate->qinfo.qclass)
+				iq->qchase.qname, iq->qchase.qname_len,
+				LDNS_RR_TYPE_NS, iq->qchase.qclass)
 			  || reply_find_rrset_section_an(iq->response->rep,
-				qstate->qinfo.qname, qstate->qinfo.qname_len,
-				LDNS_RR_TYPE_NS, qstate->qinfo.qclass)
+				iq->qchase.qname, iq->qchase.qname_len,
+				LDNS_RR_TYPE_NS, iq->qchase.qclass)
 			  )
 		    )) {
 			/* Store the referral under the current query */
+			/* no prefetch-leeway, since its not the answer */
 			if(!iter_dns_store(qstate->env, &iq->response->qinfo,
-				iq->response->rep, 1))
+				iq->response->rep, 1, 0))
 				return error_response(qstate, id, 
 					LDNS_RCODE_SERVFAIL);
 			if(qstate->env->neg_cache)
 				val_neg_addreferral(qstate->env->neg_cache, 
 					iq->response->rep, iq->dp->name);
 		}
+		/* store parent-side-in-zone-glue, if directly queried for */
+		if((qstate->qinfo.qtype == LDNS_RR_TYPE_A
+			|| qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)) {
+			iter_store_inzone_glue(qstate->env,
+				&iq->response->qinfo, iq->response->rep);
+		}
 
 		/* Reset the event state, setting the current delegation 
 		 * point to the referral. */
@@ -1602,6 +1694,10 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * along, indicating dnssec is expected for next zone */
 		iq->dnssec_expected = iter_indicates_dnssec(qstate->env, 
 			iq->dp, iq->response, iq->qchase.qclass);
+		/* if dnssec, validating then also fetch the key for the DS */
+		if(iq->dnssec_expected && qstate->env->cfg->prefetch_key &&
+			!(qstate->query_flags&BIT_CD))
+			generate_dnskey_prefetch(qstate, iq, id);
 
 		/* spawn off NS and addr to auth servers for the NS we just
 		 * got in the referral. This gets authoritative answer
@@ -1639,8 +1735,9 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* cache the CNAME response under the current query */
 		/* NOTE : set referral=1, so that rrsets get stored but not 
 		 * the partial query answer (CNAME only). */
+		/* prefetchleeway applied because this updates answer parts */
 		if(!iter_dns_store(qstate->env, &iq->response->qinfo,
-			iq->response->rep, 1))
+			iq->response->rep, 1, qstate->prefetch_leeway))
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
 		/* set the current request's qname to the new value. */
 		iq->qchase.qname = sname;
@@ -1866,6 +1963,11 @@ processTargetResponse(struct module_qstate* qstate, int id,
 	 * (regardless if it succeeded or not). */
 	foriq->num_target_queries--;
 
+	/* perhaps we picked up interested cached addressed, like lame ones */
+	if(!iter_lookup_inzone_glue(forq->env, foriq->dp, forq->region, 
+		&iq->qchase))
+		log_err("out of memory adding lame glue");
+
 	/* This response is relevant to the current query, so we 
 	 * add (attempt to add, anyway) this target(s) and reactivate 
 	 * the original event. 
@@ -1891,6 +1993,154 @@ processTargetResponse(struct module_qstate* qstate, int id,
 	}
 }
 
+/**
+ * Process response for qclass=ANY queries for a particular class.
+ * Append to result or error-exit.
+ *
+ * @param qstate: query state.
+ * @param id: module id.
+ * @param forq: super query state.
+ */
+static void
+processClassResponse(struct module_qstate* qstate, int id,
+	struct module_qstate* forq)
+{
+	struct iter_qstate* foriq = (struct iter_qstate*)forq->minfo[id];
+	struct dns_msg* from = qstate->return_msg;
+	log_query_info(VERB_ALGO, "processClassResponse", &qstate->qinfo);
+	log_query_info(VERB_ALGO, "processClassResponse super", &forq->qinfo);
+	if(qstate->return_rcode != LDNS_RCODE_NOERROR) {
+		/* cause servfail for qclass ANY query */
+		foriq->response = NULL;
+		foriq->state = FINISHED_STATE;
+		return;
+	}
+	/* append result */
+	if(!foriq->response) {
+		/* allocate the response: copy RCODE, sec_state */
+		foriq->response = dns_copy_msg(from, forq->region);
+		if(!foriq->response) {
+			log_err("malloc failed for qclass ANY response"); 
+			foriq->state = FINISHED_STATE;
+			return;
+		}
+		foriq->response->qinfo.qclass = forq->qinfo.qclass;
+		/* qclass ANY does not receive the AA flag on replies */
+		foriq->response->rep->authoritative = 0; 
+	} else {
+		struct dns_msg* to = foriq->response;
+		/* add _from_ this response _to_ existing collection */
+		/* if there are records, copy RCODE */
+		/* lower sec_state if this message is lower */
+		if(from->rep->rrset_count != 0) {
+			size_t n = from->rep->rrset_count+to->rep->rrset_count;
+			struct ub_packed_rrset_key** dest, **d;
+			/* copy appropriate rcode */
+			to->rep->flags = from->rep->flags;
+			/* copy rrsets */
+			dest = regional_alloc(forq->region, sizeof(dest[0])*n);
+			if(!dest) {
+				log_err("malloc failed in collect ANY"); 
+				foriq->state = FINISHED_STATE;
+				return;
+			}
+			d = dest;
+			/* copy AN */
+			memcpy(dest, to->rep->rrsets, to->rep->an_numrrsets
+				* sizeof(dest[0]));
+			dest += to->rep->an_numrrsets;
+			memcpy(dest, from->rep->rrsets, from->rep->an_numrrsets
+				* sizeof(dest[0]));
+			dest += from->rep->an_numrrsets;
+			/* copy NS */
+			memcpy(dest, to->rep->rrsets+to->rep->an_numrrsets,
+				to->rep->ns_numrrsets * sizeof(dest[0]));
+			dest += to->rep->ns_numrrsets;
+			memcpy(dest, from->rep->rrsets+from->rep->an_numrrsets,
+				from->rep->ns_numrrsets * sizeof(dest[0]));
+			dest += from->rep->ns_numrrsets;
+			/* copy AR */
+			memcpy(dest, to->rep->rrsets+to->rep->an_numrrsets+
+				to->rep->ns_numrrsets,
+				to->rep->ar_numrrsets * sizeof(dest[0]));
+			dest += to->rep->ar_numrrsets;
+			memcpy(dest, from->rep->rrsets+from->rep->an_numrrsets+
+				from->rep->ns_numrrsets,
+				from->rep->ar_numrrsets * sizeof(dest[0]));
+			/* update counts */
+			to->rep->rrsets = d;
+			to->rep->an_numrrsets += from->rep->an_numrrsets;
+			to->rep->ns_numrrsets += from->rep->ns_numrrsets;
+			to->rep->ar_numrrsets += from->rep->ar_numrrsets;
+			to->rep->rrset_count = n;
+		}
+		if(from->rep->security < to->rep->security) /* lowest sec */
+			to->rep->security = from->rep->security;
+		if(from->rep->qdcount != 0) /* insert qd if appropriate */
+			to->rep->qdcount = from->rep->qdcount;
+		if(from->rep->ttl < to->rep->ttl) /* use smallest TTL */
+			to->rep->ttl = from->rep->ttl;
+		if(from->rep->prefetch_ttl < to->rep->prefetch_ttl)
+			to->rep->prefetch_ttl = from->rep->prefetch_ttl;
+	}
+	/* are we done? */
+	foriq->num_current_queries --;
+	if(foriq->num_current_queries == 0)
+		foriq->state = FINISHED_STATE;
+}
+	
+/** 
+ * Collect class ANY responses and make them into one response.  This
+ * state is started and it creates queries for all classes (that have
+ * root hints).  The answers are then collected.
+ *
+ * @param qstate: query state.
+ * @param id: module id.
+ * @return true if the event needs more immediate processing, false if not.
+ */
+static int
+processCollectClass(struct module_qstate* qstate, int id)
+{
+	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
+	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
+	struct module_qstate* subq;
+	/* If qchase.qclass == 0 then send out queries for all classes.
+	 * Otherwise, do nothing (wait for all answers to arrive and the
+	 * processClassResponse to put them together, and that moves us
+	 * towards the Finished state when done. */
+	if(iq->qchase.qclass == 0) {
+		uint16_t c = 0;
+		iq->qchase.qclass = LDNS_RR_CLASS_ANY;
+		while(iter_get_next_root(ie->hints, qstate->env->fwds, &c)) {
+			/* generate query for this class */
+			log_nametypeclass(VERB_ALGO, "spawn collect query",
+				qstate->qinfo.qname, qstate->qinfo.qtype, c);
+			if(!generate_sub_request(qstate->qinfo.qname,
+				qstate->qinfo.qname_len, qstate->qinfo.qtype,
+				c, qstate, id, iq, INIT_REQUEST_STATE,
+				FINISHED_STATE, &subq, 
+				(int)!(qstate->query_flags&BIT_CD))) {
+				return error_response(qstate, id, 
+					LDNS_RCODE_SERVFAIL);
+			}
+			/* ignore subq, no special init required */
+			iq->num_current_queries ++;
+			if(c == 0xffff)
+				break;
+			else c++;
+		}
+		/* if no roots are configured at all, return */
+		if(iq->num_current_queries == 0) {
+			verbose(VERB_ALGO, "No root hints or fwds, giving up "
+				"on qclass ANY");
+			return error_response(qstate, id, LDNS_RCODE_REFUSED);
+		}
+		/* return false, wait for queries to return */
+	}
+	/* if woke up here because of an answer, wait for more answers */
+	return 0;
+}
+
 /** 
  * This handles the final state for first-tier responses (i.e., responses to
  * externally generated queries).
@@ -1943,7 +2193,7 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * from cache does not need to be stored in the msg cache. */
 		if(qstate->query_flags&BIT_RD) {
 			if(!iter_dns_store(qstate->env, &qstate->qinfo, 
-				iq->response->rep, 0))
+				iq->response->rep, 0, qstate->prefetch_leeway))
 				return error_response(qstate, id, 
 					LDNS_RCODE_SERVFAIL);
 		}
@@ -1967,7 +2217,9 @@ void
 iter_inform_super(struct module_qstate* qstate, int id, 
 	struct module_qstate* super)
 {
-	if(qstate->return_rcode != LDNS_RCODE_NOERROR)
+	if(super->qinfo.qclass == LDNS_RR_CLASS_ANY)
+		processClassResponse(qstate, id, super);
+	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
 		error_supers(qstate, id, super);
 	else if(qstate->is_priming)
 		prime_supers(qstate, id, super);
@@ -2002,7 +2254,7 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
 				cont = processInitRequest2(qstate, iq, ie, id);
 				break;
 			case INIT_REQUEST_3_STATE:
-				cont = processInitRequest3(qstate, iq);
+				cont = processInitRequest3(qstate, iq, id);
 				break;
 			case QUERYTARGETS_STATE:
 				cont = processQueryTargets(qstate, iq, ie, id);
@@ -2013,6 +2265,9 @@ iter_handle(struct module_qstate* qstate, struct iter_qstate* iq,
 			case PRIME_RESP_STATE:
 				cont = processPrimeResponse(qstate, id);
 				break;
+			case COLLECT_CLASS_STATE:
+				cont = processCollectClass(qstate, id);
+				break;
 			case FINISHED_STATE:
 				cont = processFinished(qstate, iq, id);
 				break;
@@ -2240,6 +2495,8 @@ iter_state_to_string(enum iter_state state)
 		return "QUERY TARGETS STATE";
 	case PRIME_RESP_STATE :
 		return "PRIME RESPONSE STATE";
+	case COLLECT_CLASS_STATE :
+		return "COLLECT CLASS STATE";
 	case QUERY_RESP_STATE :
 		return "QUERY RESPONSE STATE";
 	case FINISHED_STATE :
@@ -2257,6 +2514,7 @@ iter_state_is_responsestate(enum iter_state s)
 		case INIT_REQUEST_2_STATE :
 		case INIT_REQUEST_3_STATE :
 		case QUERYTARGETS_STATE :
+		case COLLECT_CLASS_STATE :
 			return 0;
 		default:
 			break;

iterator/iterator.h

@@ -150,6 +150,10 @@ enum iter_state {
 	/** Responses to priming queries finish at this state. */
 	PRIME_RESP_STATE,
 
+	/** Collecting query class information, for qclass=ANY, when
+	 * it spawns off queries for every class, it returns here. */
+	COLLECT_CLASS_STATE,
+
 	/** Responses that are to be returned upstream end at this state. 
 	 * As well as responses to target queries. */
 	FINISHED_STATE

libunbound/libunbound.c

@@ -243,6 +243,19 @@ ub_ctx_set_option(struct ub_ctx* ctx, char* opt, char* val)
 	return UB_NOERROR;
 }
 
+int
+ub_ctx_get_option(struct ub_ctx* ctx, char* opt, char** str)
+{
+	int r;
+	lock_basic_lock(&ctx->cfglock);
+	r = config_get_option_collate(ctx->env->cfg, opt, str);
+	lock_basic_unlock(&ctx->cfglock);
+	if(r == 0) r = UB_NOERROR;
+	else if(r == 1) r = UB_SYNTAX;
+	else if(r == 2) r = UB_NOMEM;
+	return r;
+}
+
 int 
 ub_ctx_config(struct ub_ctx* ctx, char* fname)
 {

libunbound/libworker.c

@@ -484,8 +484,15 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 	if(!rdf) {
 		return 0;
 	}
+#ifdef UNBOUND_ALLOC_LITE
+	qinfo->qname = memdup(ldns_rdf_data(rdf), ldns_rdf_size(rdf));
+	qinfo->qname_len = ldns_rdf_size(rdf);
+	ldns_rdf_deep_free(rdf);
+	rdf = 0;
+#else
 	qinfo->qname = ldns_rdf_data(rdf);
 	qinfo->qname_len = ldns_rdf_size(rdf);
+#endif
 	edns->edns_present = 1;
 	edns->ext_rcode = 0;
 	edns->edns_version = 0;
@@ -868,6 +875,11 @@ int replay_var_compare(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
         return 0;
 }
 
+void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
+{
+        log_assert(0);
+}
+
 #ifdef UB_ON_WINDOWS
 void
 worker_win_stop_cb(int ATTR_UNUSED(fd), short ATTR_UNUSED(ev), void* 

libunbound/python/Makefile

@@ -56,9 +56,9 @@ clean:
 	rm -f _unbound.so libunbound_wrap.o
 	$(MAKE) -C ../.. clean
 
-testenv: ../../.libs/libunbound.so.1 ../../ldns-src/lib/libldns.so ../../.libs/_unbound.so
+testenv: ../../.libs/libunbound.so.2 ../../ldns-src/lib/libldns.so ../../.libs/_unbound.so
 	rm -rdf examples/unbound
-	cd examples && mkdir unbound && ln -s ../../unbound.py unbound/__init__.py && ln -s ../../_unbound.so unbound/_unbound.so && ln -s ../../../../.libs/libunbound.so.1 unbound/libunbound.so.1 && ln -s ../../../../ldns-src/lib/libldns.so.1 unbound/libldns.so.1 && ls -la
+	cd examples && mkdir unbound && ln -s ../../unbound.py unbound/__init__.py && ln -s ../../_unbound.so unbound/_unbound.so && ln -s ../../../../.libs/libunbound.so.2 unbound/libunbound.so.2 && ln -s ../../../../ldns-src/lib/libldns.so.1 unbound/libldns.so.1 && ls -la
 	cd examples && if test -f ../../../.libs/_unbound.so; then cp ../../../.libs/_unbound.so . ; fi
 	@echo "Run a script by typing ./script_name.py"
 	cd examples && LD_LIBRARY_PATH=unbound bash

libunbound/python/doc/install.rst

@@ -5,22 +5,18 @@ Installation
 
 Python 2.4 or higher, SWIG 1.3 or higher, GNU make
 
-**Download**
-
-You can download the source codes `here`_.
-The latest release is 1.1.1, Jan 15, 2009.
-
-.. _here: unbound-1.1.1-py.tar.gz
-
 **Compiling**
 
 After downloading, you can compile the pyUnbound library by doing::
 
-	> tar -xzf unbound-1.1.1-py.tar.gz
-	> cd unbound-1.1.1
+	> tar -xzf unbound-x.x.x-py.tar.gz
+	> cd unbound-x.x.x
 	> ./configure --with-pyunbound
 	> make
 
+You may want to --with-pythonmodule as well if you want to use python as
+a module in the resolver.
+
 You need GNU make to compile sources; SWIG and Python devel libraries to compile extension module. 
 
 
@@ -32,4 +28,4 @@ If the compilation is successfull, you can test the python LDNS extension module
 	> make testenv
 	> ./dns-lookup.py
 
-In contrib/examples you can find simple applications written in Python using the Unbound extension.
+You may want to make install in the main directory since make testenv is for debugging.  In contrib/examples you can find simple applications written in Python using the Unbound extension.

libunbound/ubsyms.def

@@ -1,5 +1,6 @@
 ub_ctx_create
 ub_ctx_delete
+ub_ctx_get_option
 ub_ctx_set_option
 ub_ctx_config
 ub_ctx_set_fwd

libunbound/unbound.h

@@ -227,7 +227,7 @@ void ub_ctx_delete(struct ub_ctx* ctx);
  * @param ctx: context.
  * @param opt: option name from the unbound.conf config file format.
  *	(not all settings applicable). The name includes the trailing ':'
- *	for example ub_ctx_set_option("logfile:", "mylog.txt");
+ *	for example ub_ctx_set_option(ctx, "logfile:", "mylog.txt");
  * 	This is a power-users interface that lets you specify all sorts
  * 	of options.
  * 	For some specific options, such as adding trust anchors, special
@@ -237,6 +237,22 @@ void ub_ctx_delete(struct ub_ctx* ctx);
  */
 int ub_ctx_set_option(struct ub_ctx* ctx, char* opt, char* val);
 
+/**
+ * Get an option from the context.
+ * @param ctx: context.
+ * @param opt: option name from the unbound.conf config file format.
+ *	(not all settings applicable). The name excludes the trailing ':'
+ *	for example ub_ctx_get_option(ctx, "logfile", &result);
+ * 	This is a power-users interface that lets you specify all sorts
+ * 	of options.
+ * @param str: the string is malloced and returned here. NULL on error.
+ * 	The caller must free() the string.  In cases with multiple 
+ * 	entries (auto-trust-anchor-file), a newline delimited list is 
+ * 	returned in the string.
+ * @return 0 if OK else an error code (malloc failure, syntax error).
+ */
+int ub_ctx_get_option(struct ub_ctx* ctx, char* opt, char** str);
+
 /**
  * setup configuration for the given context.
  * @param ctx: context.

ltmain.sh

@@ -1,6 +1,6 @@
 # Generated from ltmain.m4sh.
 
-# ltmain.sh (GNU libtool) 2.2.6
+# ltmain.sh (GNU libtool) 2.2.6b
 # Written by Gordon Matzigkeit <gord@gnu.ai.mit.edu>, 1996
 
 # Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2003, 2004, 2005, 2006, 2007 2008 Free Software Foundation, Inc.
@@ -65,7 +65,7 @@
 #       compiler:		$LTCC
 #       compiler flags:		$LTCFLAGS
 #       linker:		$LD (gnu? $with_gnu_ld)
-#       $progname:		(GNU libtool) 2.2.6
+#       $progname:		(GNU libtool) 2.2.6b
 #       automake:		$automake_version
 #       autoconf:		$autoconf_version
 #
@@ -73,9 +73,9 @@
 
 PROGRAM=ltmain.sh
 PACKAGE=libtool
-VERSION=2.2.6
+VERSION=2.2.6b
 TIMESTAMP=""
-package_revision=1.3012
+package_revision=1.3017
 
 # Be Bourne compatible
 if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then

pythonmod/interface.i

@@ -345,6 +345,7 @@ struct reply_info {
    uint16_t flags;
    uint16_t qdcount;
    uint32_t ttl;
+   uint32_t prefetch_ttl;
 
    uint16_t authoritative;
    enum sec_status security;

pythonmod/pythonmod_utils.c

@@ -65,7 +65,8 @@ int storeQueryInCache(struct module_qstate* qstate, struct query_info* qinfo, st
        return 0;
     }
 
-    return dns_cache_store(qstate->env, qinfo, msgrep, is_referral);
+    return dns_cache_store(qstate->env, qinfo, msgrep, is_referral, 
+	qstate->prefetch_leeway);
 }
 
 /*  Invalidate the message associated with query_info stored in message cache */

services/cache/dns.c

@@ -71,7 +71,7 @@ store_rrsets(struct module_env* env, struct reply_info* rep, uint32_t now)
 
 void 
 dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
-	hashvalue_t hash, struct reply_info* rep)
+	hashvalue_t hash, struct reply_info* rep, uint32_t leeway)
 {
 	struct msgreply_entry* e;
 	uint32_t ttl = rep->ttl;
@@ -84,7 +84,7 @@ dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
 	}
 	reply_info_sortref(rep);
 	reply_info_set_ttls(rep, *env->now);
-	store_rrsets(env, rep, *env->now);
+	store_rrsets(env, rep, *env->now+leeway);
 	if(ttl == 0) {
 		/* we do not store the message, but we did store the RRs,
 		 * which could be useful for delegation information */
@@ -180,7 +180,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, 0)) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 0, 0)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -198,7 +198,7 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0)) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, 0)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -213,6 +213,27 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 				lock_rw_unlock(&neg->entry.lock);
 			}
 		}
+		/* see if we have parent-side-glue (dispreferred) */
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+			ns->namelen, LDNS_RR_TYPE_A, qclass, 
+			PACKED_RRSET_PARENT_SIDE, now, 0);
+		if(akey) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1)) {
+				lock_rw_unlock(&akey->entry.lock);
+				return 0;
+			}
+			lock_rw_unlock(&akey->entry.lock);
+		}
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 
+			PACKED_RRSET_PARENT_SIDE, now, 0);
+		if(akey) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1)) {
+				lock_rw_unlock(&akey->entry.lock);
+				return 0;
+			}
+			lock_rw_unlock(&akey->entry.lock);
+		}
 	}
 	return 1;
 }
@@ -227,12 +248,10 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 	struct ub_packed_rrset_key* akey;
 	uint32_t now = *env->now;
 	for(ns = dp->nslist; ns; ns = ns->next) {
-		if(ns->resolved)
-			continue;
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, 1)) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 0, 1)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -250,7 +269,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1)) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, 1)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -265,6 +284,27 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 				lock_rw_unlock(&neg->entry.lock);
 			}
 		}
+		/* see if we have parent-side-glue (dispreferred) */
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+			ns->namelen, LDNS_RR_TYPE_A, qclass, 
+			PACKED_RRSET_PARENT_SIDE, now, 0);
+		if(akey) {
+			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1)) {
+				lock_rw_unlock(&akey->entry.lock);
+				return 0;
+			}
+			lock_rw_unlock(&akey->entry.lock);
+		}
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 
+			PACKED_RRSET_PARENT_SIDE, now, 0);
+		if(akey) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1)) {
+				lock_rw_unlock(&akey->entry.lock);
+				return 0;
+			}
+			lock_rw_unlock(&akey->entry.lock);
+		}
 	}
 	return 1;
 }
@@ -432,6 +472,9 @@ tomsg(struct module_env* env, struct msgreply_entry* e, struct reply_info* r,
 	msg->rep->flags = r->flags;
 	msg->rep->qdcount = r->qdcount;
 	msg->rep->ttl = r->ttl - now;
+	if(r->prefetch_ttl - now > 0)
+		msg->rep->prefetch_ttl = r->prefetch_ttl - now;
+	else	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(r->prefetch_ttl);
 	msg->rep->security = r->security;
 	msg->rep->an_numrrsets = r->an_numrrsets;
 	msg->rep->ns_numrrsets = r->ns_numrrsets;
@@ -482,6 +525,7 @@ rrset_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 	msg->rep->qdcount = 1;
 	msg->rep->ttl = d->ttl - now;
+	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->security = sec_status_unchecked;
 	msg->rep->an_numrrsets = 1;
 	msg->rep->ns_numrrsets = 0;
@@ -517,6 +561,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
         msg->rep->authoritative = 0; /* reply stored in cache can't be authoritative */
 	msg->rep->qdcount = 1;
 	msg->rep->ttl = d->ttl - now;
+	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(msg->rep->ttl);
 	msg->rep->security = sec_status_unchecked;
 	msg->rep->an_numrrsets = 1;
 	msg->rep->ns_numrrsets = 0;
@@ -574,6 +619,7 @@ synth_dname_msg(struct ub_packed_rrset_key* rrset, struct regional* region,
 	packed_rrset_ptr_fixup(newd);
 	newd->rr_ttl[0] = newd->ttl;
 	msg->rep->ttl = newd->ttl;
+	msg->rep->prefetch_ttl = PREFETCH_TTL_CALC(newd->ttl);
 	ldns_write_uint16(newd->rr_data[0], newlen);
 	memmove(newd->rr_data[0] + sizeof(uint16_t), newname, newlen);
 	msg->rep->an_numrrsets ++;
@@ -652,7 +698,10 @@ dns_cache_lookup(struct module_env* env,
 		struct packed_rrset_data *d = (struct packed_rrset_data*)
 			rrset->entry.data;
 		if(d->trust != rrset_trust_add_noAA && 
-			d->trust != rrset_trust_add_AA) {
+			d->trust != rrset_trust_add_AA && 
+			(qtype == LDNS_RR_TYPE_DS || 
+				(d->trust != rrset_trust_auth_noAA 
+				&& d->trust != rrset_trust_auth_AA) )) {
 			struct dns_msg* msg = rrset_msg(rrset, region, now, &k);
 			if(msg) {
 				lock_rw_unlock(&rrset->entry.lock);
@@ -666,7 +715,7 @@ dns_cache_lookup(struct module_env* env,
 
 int 
 dns_cache_store(struct module_env* env, struct query_info* msgqinf,
-        struct reply_info* msgrep, int is_referral)
+        struct reply_info* msgrep, int is_referral, uint32_t leeway)
 {
 	struct reply_info* rep = NULL;
 	/* alloc, malloc properly (not in region, like msg is) */
@@ -675,6 +724,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 		return 0;
 	/* ttl must be relative ;i.e. 0..86400 not  time(0)+86400. 
 	 * the env->now is added to message and RRsets in this routine. */
+	/* the leeway is used to invalidate other rrsets earlier */
 
 	if(is_referral) {
 		/* store rrsets */
@@ -687,7 +737,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 			ref.id = rep->rrsets[i]->id;
 			/*ignore ret: it was in the cache, ref updated */
 			(void)rrset_cache_update(env->rrset_cache, &ref, 
-				env->alloc, *env->now);
+				env->alloc, *env->now + leeway);
 		}
 		free(rep);
 		return 1;
@@ -708,7 +758,7 @@ dns_cache_store(struct module_env* env, struct query_info* msgqinf,
 		rep->flags |= (BIT_RA | BIT_QR);
 		rep->flags &= ~(BIT_AA | BIT_CD);
 		h = query_info_hash(&qinf);
-		dns_cache_store_msg(env, &qinf, h, rep);
+		dns_cache_store_msg(env, &qinf, h, rep, leeway);
 		/* qname is used inside query_info_entrysetup, and set to 
 		 * NULL. If it has not been used, free it. free(0) is safe. */
 		free(qinf.qname);

services/cache/dns.h

@@ -72,10 +72,12 @@ struct dns_msg {
  * @param is_referral: If true, then the given message to be stored is a
  *      referral. The cache implementation may use this as a hint.
  *      It will store only the RRsets, not the message.
+ * @param leeway: TTL value, if not 0, other rrsets are considered expired
+ *	that many seconds before actual TTL expiry.
  * @return 0 on alloc error (out of memory).
  */
 int dns_cache_store(struct module_env* env, struct query_info* qinf,
-        struct reply_info* rep, int is_referral); 
+        struct reply_info* rep, int is_referral, uint32_t leeway); 
 
 /**
  * Store message in the cache. Stores in message cache and rrset cache.
@@ -88,9 +90,11 @@ int dns_cache_store(struct module_env* env, struct query_info* qinf,
  * @param hash: hash over qinfo.
  * @param rep: reply info, together with qinfo makes up the message.
  *	Adjusts the reply info TTLs to absolute time.
+ * @param leeway: TTL value, if not 0, other rrsets are considered expired
+ *	that many seconds before actual TTL expiry.
  */
 void dns_cache_store_msg(struct module_env* env, struct query_info* qinfo,
-	hashvalue_t hash, struct reply_info* rep);
+	hashvalue_t hash, struct reply_info* rep, uint32_t leeway);
 
 /**
  * Find a delegation from the cache.

services/listen_dnsport.c

@@ -251,6 +251,25 @@ create_udp_sock(int family, int socktype, struct sockaddr* addr,
 			return -1;
 		}
 # endif /* IPv6 MTU */
+	} else if(family == AF_INET) {
+#  if defined(IP_MTU_DISCOVER) && defined(IP_PMTUDISC_DONT)
+		int action = IP_PMTUDISC_DONT;
+		if (setsockopt(s, IPPROTO_IP, IP_MTU_DISCOVER, 
+			&action, (socklen_t)sizeof(action)) < 0) {
+			log_err("setsockopt(..., IP_MTU_DISCOVER, "
+				"IP_PMTUDISC_DONT...) failed: %s",
+				strerror(errno));
+			return -1;
+		}
+#  elif defined(IP_DONTFRAG)
+		int off = 0;
+		if (setsockopt(s, IPPROTO_IP, IP_DONTFRAG, 
+			&off, (socklen_t)sizeof(off)) < 0) {
+			log_err("setsockopt(..., IP_DONTFRAG, ...) failed: %s",
+				strerror(errno));
+			return -1;
+		}
+#  endif /* IPv4 MTU */
 	}
 	if(bind(s, (struct sockaddr*)addr, addrlen) != 0) {
 		*noproto = 0;
@@ -417,6 +436,35 @@ make_sock(int stype, const char* ifname, const char* port,
 	return s;
 }
 
+/** make socket and first see if ifname contains port override info */
+static int
+make_sock_port(int stype, const char* ifname, const char* port, 
+	struct addrinfo *hints, int v6only, int* noip6, size_t rcv)
+{
+	char* s = strchr(ifname, '@');
+	if(s) {
+		/* override port with ifspec@port */
+		char p[16];
+		char newif[128];
+		if((size_t)(s-ifname) >= sizeof(newif)) {
+			log_err("ifname too long: %s", ifname);
+			*noip6 = 0;
+			return -1;
+		}
+		if(strlen(s+1) >= sizeof(p)) {
+			log_err("portnumber too long: %s", ifname);
+			*noip6 = 0;
+			return -1;
+		}
+		strncpy(newif, ifname, sizeof(newif));
+		newif[s-ifname] = 0;
+		strncpy(p, s+1, sizeof(p));
+		p[strlen(s+1)]=0;
+		return make_sock(stype, newif, p, hints, v6only, noip6, rcv);
+	}
+	return make_sock(stype, ifname, port, hints, v6only, noip6, rcv);
+}
+
 /**
  * Add port to open ports list.
  * @param list: list head. changed.
@@ -515,7 +563,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 	if(!do_udp && !do_tcp)
 		return 0;
 	if(do_auto) {
-		if((s = make_sock(SOCK_DGRAM, ifname, port, hints, 1, 
+		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
 			&noip6, rcv)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
@@ -536,7 +584,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 		}
 	} else if(do_udp) {
 		/* regular udp socket */
-		if((s = make_sock(SOCK_DGRAM, ifname, port, hints, 1, 
+		if((s = make_sock_port(SOCK_DGRAM, ifname, port, hints, 1, 
 			&noip6, rcv)) == -1) {
 			if(noip6) {
 				log_warn("IPv6 protocol not available");
@@ -554,7 +602,7 @@ ports_create_if(const char* ifname, int do_auto, int do_udp, int do_tcp,
 		}
 	}
 	if(do_tcp) {
-		if((s = make_sock(SOCK_STREAM, ifname, port, hints, 1, 
+		if((s = make_sock_port(SOCK_STREAM, ifname, port, hints, 1, 
 			&noip6, 0)) == -1) {
 			if(noip6) {
 				/*log_warn("IPv6 protocol not available");*/

services/localzone.c

@@ -1141,6 +1141,19 @@ local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
 	return r;
 }
 
+const char* local_zone_type2str(enum localzone_type t)
+{
+	switch(t) {
+		case local_zone_deny: return "deny";
+		case local_zone_refuse: return "refuse";
+		case local_zone_redirect: return "redirect";
+		case local_zone_transparent: return "transparent";
+		case local_zone_static: return "static";
+		case local_zone_nodefault: return "nodefault";
+	}
+	return "badtyped"; 
+}
+
 int local_zone_str2type(const char* type, enum localzone_type* t)
 {
 	if(strcmp(type, "deny") == 0)
@@ -1309,14 +1322,16 @@ void local_zones_del_data(struct local_zones* zones,
 
 	/* find the domain */
 	d = lz_find_node(z, name, len, labs);
-	/* no memory recycling for zone deletions ... */
-	d->rrsets = NULL;
-	/* did we delete the soa record ? */
-	if(query_dname_compare(d->name, z->name) == 0)
-		z->soa = NULL;
+	if(d) {
+		/* no memory recycling for zone deletions ... */
+		d->rrsets = NULL;
+		/* did we delete the soa record ? */
+		if(query_dname_compare(d->name, z->name) == 0)
+			z->soa = NULL;
 
-	/* cleanup the empty nonterminals for this name */
-	del_empty_term(z, d, name, len, labs);
+		/* cleanup the empty nonterminals for this name */
+		del_empty_term(z, d, name, len, labs);
+	}
 
 	lock_rw_unlock(&z->lock);
 }

services/localzone.h

@@ -233,6 +233,14 @@ int local_zones_answer(struct local_zones* zones, struct query_info* qinfo,
  */
 int local_zone_str2type(const char* str, enum localzone_type* t);
 
+/**
+ * Print localzone type to a string.  Pointer to a constant string.
+ *
+ * @param t: local zone type.
+ * @return constant string that describes type.
+ */
+const char* local_zone_type2str(enum localzone_type t);
+
 /**
  * Find zone that with exactly given name, class.
  * User must lock the tree or result zone.

services/mesh.c

@@ -286,7 +286,7 @@ void mesh_new_client(struct mesh_area* mesh, struct query_info* qinfo,
 	/* see if it already exists, if not, create one */
 	if(!s) {
 		struct rbnode_t* n;
-		s = mesh_state_create(mesh->env,qinfo, qflags, 0);
+		s = mesh_state_create(mesh->env, qinfo, qflags, 0);
 		if(!s) {
 			log_err("mesh_state_create: out of memory; SERVFAIL");
 			error_encode(rep->c->buffer, LDNS_RCODE_SERVFAIL,
@@ -354,7 +354,7 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	/* see if it already exists, if not, create one */
 	if(!s) {
 		struct rbnode_t* n;
-		s = mesh_state_create(mesh->env,qinfo, qflags, 0);
+		s = mesh_state_create(mesh->env, qinfo, qflags, 0);
 		if(!s) {
 			return 0;
 		}
@@ -388,6 +388,55 @@ mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	return 1;
 }
 
+void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
+        uint16_t qflags, uint32_t leeway)
+{
+	struct mesh_state* s = mesh_area_find(mesh, qinfo, qflags, 0);
+	struct rbnode_t* n;
+	/* already exists, and for a different purpose perhaps.
+	 * if mesh_no_list, keep it that way. */
+	if(s) {
+		/* make it ignore the cache from now on */
+		if(!s->s.blacklist)
+			sock_list_insert(&s->s.blacklist, NULL, 0, s->s.region);
+		if(s->s.prefetch_leeway < leeway)
+			s->s.prefetch_leeway = leeway;
+		return;
+	}
+	if(!mesh_make_new_space(mesh)) {
+		verbose(VERB_ALGO, "Too many queries. dropped prefetch.");
+		mesh->stats_dropped ++;
+		return;
+	}
+	s = mesh_state_create(mesh->env, qinfo, qflags, 0);
+	if(!s) {
+		log_err("prefetch mesh_state_create: out of memory");
+		return;
+	}
+	n = rbtree_insert(&mesh->all, &s->node);
+	log_assert(n != NULL);
+	/* set detached (it is now) */
+	mesh->num_detached_states++;
+	/* make it ignore the cache */
+	sock_list_insert(&s->s.blacklist, NULL, 0, s->s.region);
+	s->s.prefetch_leeway = leeway;
+
+	if(s->list_select == mesh_no_list) {
+		/* move to either the forever or the jostle_list */
+		if(mesh->num_forever_states < mesh->max_forever_states) {
+			mesh->num_forever_states ++;
+			mesh_list_insert(s, &mesh->forever_first, 
+				&mesh->forever_last);
+			s->list_select = mesh_forever_list;
+		} else {
+			mesh_list_insert(s, &mesh->jostle_first, 
+				&mesh->jostle_last);
+			s->list_select = mesh_jostle_list;
+		}
+	}
+	mesh_run(mesh, s, module_event_new, NULL);
+}
+
 void mesh_report_reply(struct mesh_area* mesh, struct outbound_entry* e,
         struct comm_reply* reply, int what)
 {
@@ -447,6 +496,7 @@ mesh_state_create(struct module_env* env, struct query_info* qinfo,
 	mstate->s.return_rcode = LDNS_RCODE_NOERROR;
 	mstate->s.env = env;
 	mstate->s.mesh_info = mstate;
+	mstate->s.prefetch_leeway = 0;
 	/* init modules */
 	for(i=0; i<env->mesh->mods.num; i++) {
 		mstate->s.minfo[i] = NULL;

services/mesh.h

@@ -286,6 +286,18 @@ int mesh_new_callback(struct mesh_area* mesh, struct query_info* qinfo,
 	uint16_t qflags, struct edns_data* edns, ldns_buffer* buf, 
 	uint16_t qid, mesh_cb_func_t cb, void* cb_arg);
 
+/**
+ * New prefetch message. Create new query state if needed.
+ * Will run the mesh area queries to process if a new query state is created.
+ *
+ * @param mesh: the mesh.
+ * @param qinfo: query from client.
+ * @param qflags: flags from client query.
+ * @param leeway: TTL leeway what to expire earlier for this update.
+ */
+void mesh_new_prefetch(struct mesh_area* mesh, struct query_info* qinfo,
+	uint16_t qflags, uint32_t leeway);
+
 /**
  * Handle new event from the wire. A serviced query has returned.
  * The query state will be made runnable, and the mesh_area will process

smallapp/unbound-checkconf.c

@@ -80,40 +80,6 @@ usage()
 	exit(1);
 }
 
-/** compare and print decimal option */
-#define O_DEC(opt, str, var) if(strcmp(opt, str)==0) \
-	{printf("%d\n", (int)cfg->var);}
-/** compare and print unsigned option */
-#define O_UNS(opt, str, var) if(strcmp(opt, str)==0) \
-	{printf("%u\n", (unsigned)cfg->var);}
-/** compare and print yesno option */
-#define O_YNO(opt, str, var) if(strcmp(opt, str)==0) \
-	{printf("%s\n", cfg->var?"yes":"no");}
-/** compare and print string option */
-#define O_STR(opt, str, var) if(strcmp(opt, str)==0) \
-	{printf("%s\n", cfg->var?cfg->var:"");}
-/** compare and print array option */
-#define O_IFC(opt, str, num, arr) if(strcmp(opt, str)==0) \
-	{int i; for(i=0; i<cfg->num; i++) printf("%s\n", cfg->arr[i]);}
-/** compare and print memorysize option */
-#define O_MEM(opt, str, var) if(strcmp(opt, str)==0) { \
-	if(cfg->var > 1024*1024*1024) {	\
-	  size_t f=cfg->var/(size_t)1000000, b=cfg->var%(size_t)1000000; \
-	  printf("%u%6.6u\n", (unsigned)f, (unsigned)b); \
-	} else printf("%u\n", (unsigned)cfg->var);}
-/** compare and print list option */
-#define O_LST(opt, name, lst) if(strcmp(opt, name)==0) { \
-	struct config_strlist* p = cfg->lst; \
-	for(p = cfg->lst; p; p = p->next) \
-		printf("%s\n", p->str); \
-	}
-/** compare and print list option */
-#define O_LS2(opt, name, lst) if(strcmp(opt, name)==0) { \
-	struct config_str2list* p = cfg->lst; \
-	for(p = cfg->lst; p; p = p->next) \
-		printf("%s %s\n", p->str, p->str2); \
-	}
-
 /** 
  * Print given option to stdout 
  * @param cfg: config
@@ -123,96 +89,8 @@ usage()
 static void
 print_option(struct config_file* cfg, const char* opt)
 {
-	O_DEC(opt, "verbosity", verbosity)
-	else O_DEC(opt, "statistics-interval", stat_interval)
-	else O_YNO(opt, "statistics-cumulative", stat_interval)
-	else O_YNO(opt, "extended-statistics", stat_extended)
-	else O_DEC(opt, "num-threads", num_threads)
-	else O_IFC(opt, "interface", num_ifs, ifs)
-	else O_IFC(opt, "outgoing-interface", num_out_ifs, out_ifs)
-	else O_YNO(opt, "interface-automatic", if_automatic)
-	else O_DEC(opt, "port", port)
-	else O_DEC(opt, "outgoing-range", outgoing_num_ports)
-	else O_DEC(opt, "outgoing-num-tcp", outgoing_num_tcp)
-	else O_DEC(opt, "incoming-num-tcp", incoming_num_tcp)
-	else O_DEC(opt, "edns-buffer-size", edns_buffer_size)
-	else O_DEC(opt, "msg-buffer-size", msg_buffer_size)
-	else O_MEM(opt, "msg-cache-size", msg_cache_size)
-	else O_DEC(opt, "msg-cache-slabs", msg_cache_slabs)
-	else O_DEC(opt, "num-queries-per-thread", num_queries_per_thread)
-	else O_UNS(opt, "jostle-timeout", jostle_time)
-	else O_MEM(opt, "so-rcvbuf", socket_rcvbuf)
-	else O_MEM(opt, "rrset-cache-size", rrset_cache_size)
-	else O_DEC(opt, "rrset-cache-slabs", rrset_cache_slabs)
-	else O_DEC(opt, "cache-max-ttl", max_ttl)
-	else O_DEC(opt, "infra-host-ttl", host_ttl)
-	else O_DEC(opt, "infra-lame-ttl", lame_ttl)
-	else O_DEC(opt, "infra-cache-slabs", infra_cache_slabs)
-	else O_MEM(opt, "infra-cache-numhosts", infra_cache_numhosts)
-	else O_MEM(opt, "infra-cache-lame-size", infra_cache_lame_size)
-	else O_YNO(opt, "do-ip4", do_ip4)
-	else O_YNO(opt, "do-ip6", do_ip6)
-	else O_YNO(opt, "do-udp", do_udp)
-	else O_YNO(opt, "do-tcp", do_tcp)
-	else O_YNO(opt, "do-daemonize", do_daemonize)
-	else O_STR(opt, "chroot", chrootdir)
-	else O_STR(opt, "username", username)
-	else O_STR(opt, "directory", directory)
-	else O_STR(opt, "logfile", logfile)
-	else O_STR(opt, "pidfile", pidfile)
-	else O_YNO(opt, "hide-identity", hide_identity)
-	else O_YNO(opt, "hide-version", hide_version)
-	else O_STR(opt, "identity", identity)
-	else O_STR(opt, "version", version)
-	else O_STR(opt, "target-fetch-policy", target_fetch_policy)
-	else O_YNO(opt, "harden-short-bufsize", harden_short_bufsize)
-	else O_YNO(opt, "harden-large-queries", harden_large_queries)
-	else O_YNO(opt, "harden-glue", harden_glue)
-	else O_YNO(opt, "harden-dnssec-stripped", harden_dnssec_stripped)
-	else O_YNO(opt, "harden-referral-path", harden_referral_path)
-	else O_YNO(opt, "use-caps-for-id", use_caps_bits_for_id)
-	else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold)
-	else O_YNO(opt, "do-not-query-localhost", donotquery_localhost)
-	else O_STR(opt, "module-config", module_conf)
-	else O_STR(opt, "dlv-anchor-file", dlv_anchor_file)
-	else O_DEC(opt, "val-bogus-ttl", bogus_ttl)
-	else O_YNO(opt, "val-clean-additional", val_clean_additional)
-	else O_DEC(opt, "val-log-level", val_log_level)
-	else O_YNO(opt, "val-permissive-mode", val_permissive_mode)
-	else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
-	else O_UNS(opt, "add-holddown", add_holddown)
-	else O_UNS(opt, "del-holddown", del_holddown)
-	else O_UNS(opt, "keep-missing", keep_missing)
-	else O_MEM(opt, "key-cache-size", key_cache_size)
-	else O_DEC(opt, "key-cache-slabs", key_cache_slabs)
-	else O_MEM(opt, "neg-cache-size", neg_cache_size)
-	else O_YNO(opt, "control-enable", remote_control_enable)
-	else O_DEC(opt, "control-port", control_port)
-	else O_STR(opt, "server-key-file", server_key_file)
-	else O_STR(opt, "server-cert-file", server_cert_file)
-	else O_STR(opt, "control-key-file", control_key_file)
-	else O_STR(opt, "control-cert-file", control_cert_file)
-	else O_LST(opt, "root-hints", root_hints)
-	else O_LS2(opt, "access-control", acls)
-	else O_LST(opt, "do-not-query-address", donotqueryaddrs)
-	else O_LST(opt, "private-address", private_address)
-	else O_LST(opt, "private-domain", private_domain)
-	else O_LST(opt, "auto-trust-anchor-file", auto_trust_anchor_file_list)
-	else O_LST(opt, "trust-anchor-file", trust_anchor_file_list)
-	else O_LST(opt, "trust-anchor", trust_anchor_list)
-	else O_LST(opt, "trusted-keys-file", trusted_keys_file_list)
-	else O_LST(opt, "dlv-anchor", dlv_anchor_list)
-	else O_LST(opt, "control-interface", control_ifs)
-	else O_UNS(opt, "val-override-date", val_date_override)
-	/* not here:
-	 * outgoing-permit, outgoing-avoid - have list of ports
-	 * local-zone - zones and nodefault variables
-	 * local-data - see below
-	 * local-data-ptr - converted to local-data entries
-	 * stub-zone, name, stub-addr, stub-host, stub-prime
-	 * forward-zone, name, forward-addr, forward-host
-	 */
-	else fatal_exit("cannot print option '%s'", opt);
+	if(!config_get_option(cfg, opt, config_print_func, stdout))
+		fatal_exit("cannot print option '%s'", opt);
 }
 
 /** check if module works with config */
@@ -497,6 +375,8 @@ morechecks(struct config_file* cfg, const char* fname)
 		cfg->root_hints, cfg->chrootdir, cfg);
 	check_chroot_filelist("trust-anchor-file", 
 		cfg->trust_anchor_file_list, cfg->chrootdir, cfg);
+	check_chroot_filelist("auto-trust-anchor-file", 
+		cfg->auto_trust_anchor_file_list, cfg->chrootdir, cfg);
 	check_chroot_filelist_wild("trusted-keys-file", 
 		cfg->trusted_keys_file_list, cfg->chrootdir, cfg);
 	check_chroot_string("dlv-anchor-file", &cfg->dlv_anchor_file, 

smallapp/unbound-control-setup.sh

@@ -46,7 +46,10 @@ CLIENTNAME=unbound-control
 DAYS=7200
 
 # size of keys in bits
-BITS=1024
+BITS=1536
+
+# hash algorithm
+HASH=sha256
 
 # base name for unbound server keys
 SVR_BASE=unbound_server
@@ -84,7 +87,7 @@ done
 
 # go!:
 echo "setup in directory $DESTDIR"
-cd "$DESTDIR" || error "could not cd"
+cd "$DESTDIR" || error "could not cd to $DESTDIR"
 
 # create certificate keys; do not recreate if they already exist.
 if test -f $SVR_BASE.key; then
@@ -104,7 +107,7 @@ fi
 cat >request.cfg <<EOF
 [req]
 default_bits=$BITS
-default_md=sha1
+default_md=$HASH
 prompt=no
 distinguished_name=req_distinguished_name
 
@@ -122,7 +125,7 @@ openssl x509 -in $SVR_BASE.pem -addtrust serverAuth -out $SVR_BASE"_trust.pem"
 cat >request.cfg <<EOF
 [req]
 default_bits=$BITS
-default_md=sha1
+default_md=$HASH
 prompt=no
 distinguished_name=req_distinguished_name
 
@@ -132,7 +135,7 @@ EOF
 test -f request.cfg || error "could not create request.cfg"
 
 echo "create $CTL_BASE.pem (signed client certificate)"
-openssl req -key $CTL_BASE.key -config request.cfg -new | openssl x509 -req -days $DAYS -CA $SVR_BASE"_trust.pem" -CAkey $SVR_BASE.key -CAcreateserial -out $CTL_BASE.pem
+openssl req -key $CTL_BASE.key -config request.cfg -new | openssl x509 -req -days $DAYS -CA $SVR_BASE"_trust.pem" -CAkey $SVR_BASE.key -CAcreateserial -$HASH -out $CTL_BASE.pem
 test -f $CTL_BASE.pem || error "could not create $CTL_BASE.pem"
 # create trusted usage pem
 # openssl x509 -in $CTL_BASE.pem -addtrust clientAuth -out $CTL_BASE"_trust.pem"

smallapp/unbound-control.c

@@ -66,6 +66,7 @@ usage()
 	printf("  stats_noreset			peek at statistics\n");
 	printf("  status			display status of server\n");
 	printf("  verbosity <number>		change logging detail\n");
+	printf("  log_reopen			close and open the logfile\n");
 	printf("  local_zone <name> <type>	add new local zone\n");
 	printf("  local_zone_remove <name>	remove local zone and its contents\n");
 	printf("  local_data <RR data...>	add local data, for example\n");
@@ -83,6 +84,12 @@ usage()
 	printf("  flush_stats 			flush statistics, make zero\n");
 	printf("  flush_requestlist 		drop queries that are worked on\n");
 	printf("  dump_requestlist		show what is worked on\n");
+	printf("  set_option opt: val		set option to value, no reload\n");
+	printf("  get_option opt		get option value\n");
+	printf("  list_stubs			list stub-zones and root hints in use\n");
+	printf("  list_forwards			list forward-zones in use\n");
+	printf("  list_local_zones		list local-zones in use\n");
+	printf("  list_local_data		list local-data RRs in use\n");
 	printf("  forward [off | addr ...]	without arg show forward setup\n");
 	printf("				or off to turn off root forwarding\n");
 	printf("				or give list of ip addresses\n");

smallapp/unbound-host.c

@@ -48,6 +48,14 @@
 #undef free
 #undef realloc
 #endif
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef free
+#undef realloc
+#undef strdup
+#define unbound_lite_wrapstr(s) s
+#endif
 #include "libunbound/unbound.h"
 #include <ldns/ldns.h>
 

smallapp/worker_cb.c

@@ -241,3 +241,8 @@ int replay_var_compare(const void* ATTR_UNUSED(a), const void* ATTR_UNUSED(b))
         log_assert(0);
         return 0;
 }
+
+void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
+{
+        log_assert(0);
+}

testcode/asynclook.c

@@ -45,6 +45,13 @@
 #include "libunbound/context.h"
 #include "util/locks.h"
 #include "util/log.h"
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef realloc
+#undef free
+#undef strdup
+#endif
 
 /** keeping track of the async ids */
 struct track_id {

testcode/do-tests.sh

@@ -7,9 +7,14 @@ NEED_XXD='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_CURL='06-ianaports.tpkg'
 NEED_WHOAMI='07-confroot.tpkg'
-NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg'
+NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg stub_udp6.tpkg'
 NEED_NOMINGW='tcp_sigpipe.tpkg 07-confroot.tpkg 08-host-lib.tpkg fwd_ancil.tpkg'
 
+# test if dig, wdiff and ldns-testns are available.
+if test ! -x "`which dig 2>&1`"; then echo No 'dig' in path; exit 1; fi
+if test ! -x "`which wdiff 2>&1`"; then echo No 'wdiff' in path; exit 1; fi
+if test ! -x "`which ldns-testns 2>&1`"; then echo No 'ldns-testns' in path; exit 1; fi
+
 # test for ipv6, uses streamptcp peculiarity.
 if ./streamtcp -f ::1 2>&1 | grep "not supported" >/dev/null 2>&1; then
 	HAVE_IPV6=no

testcode/harvest.c

@@ -74,6 +74,14 @@
 #ifdef HAVE_SYS_STAT_H
 #include <sys/stat.h>
 #endif
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef realloc
+#undef free
+#undef strdup
+#define unbound_lite_wrapstr(s) s
+#endif
 struct todo_item;
 struct labdata;
 

testcode/ldns-testpkts.c

@@ -31,8 +31,12 @@ struct sockaddr_storage;
 /** string to show in warnings and errors */
 static const char* prog_name = "ldns-testpkts";
 
+#ifndef UTIL_LOG_H
+/** verbosity definition for compat */
+enum verbosity_value { NO_VERBOSE=0 };
+#endif
 /** logging routine, provided by caller */
-void verbose(int lvl, const char* msg, ...);
+void verbose(enum verbosity_value lvl, const char* msg, ...) ATTR_FORMAT(printf, 2, 3);
 
 /** print error and exit */
 static void error(const char* msg, ...)
@@ -589,12 +593,12 @@ match_list(ldns_rr_list* q, ldns_rr_list *p, bool mttl)
 	{
 		if(ldns_rr_compare(ldns_rr_list_rr(q, i), 
 			ldns_rr_list_rr(p, i)) != 0) {
-			verbose(3, "rr %d different", i);
+			verbose(3, "rr %d different", (int)i);
 			return 0;
 		}
 		if(mttl && ldns_rr_ttl(ldns_rr_list_rr(q, i)) !=
 			ldns_rr_ttl(ldns_rr_list_rr(p, i))) {
-			verbose(3, "rr %d ttl different", i);
+			verbose(3, "rr %d ttl different", (int)i);
 			return 0;
 		}
 	}
@@ -768,7 +772,7 @@ handle_query(uint8_t* inbuf, ssize_t inlen, struct entry* entries, int* count,
 	
 	query_rr = ldns_rr_list_rr(ldns_pkt_question(query_pkt), 0);
 	verbose(1, "query %d: id %d: %s %d bytes: ", ++(*count), (int)ldns_pkt_id(query_pkt), 
-		(transport==transport_tcp)?"TCP":"UDP", inlen);
+		(transport==transport_tcp)?"TCP":"UDP", (int)inlen);
 	if(verbose_out) ldns_rr_print(verbose_out, query_rr);
 	if(verbose_out) ldns_pkt_print(verbose_out, query_pkt);
 

testcode/replay.c

@@ -40,6 +40,8 @@
  */
 
 #include "config.h"
+/* for strtod prototype */
+#include <math.h>
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/config_file.h"

testcode/streamtcp.c

@@ -48,6 +48,11 @@
 #include "util/data/msgreply.h"
 #include "util/data/dname.h"
 
+#ifndef PF_INET6
+/** define in case streamtcp is compiled on legacy systems */
+#define PF_INET6 10
+#endif
+
 /** usage information for streamtcp */
 void usage(char* argv[])
 {

testcode/testbound.c

@@ -389,6 +389,11 @@ int remote_control_callback(struct comm_point* ATTR_UNUSED(c),
 	return 0;
 }
 
+void remote_get_opt_ssl(char* ATTR_UNUSED(str), void* ATTR_UNUSED(arg))
+{
+        log_assert(0);
+}
+
 void wsvc_command_option(const char* ATTR_UNUSED(wopt), 
 	const char* ATTR_UNUSED(cfgfile), int ATTR_UNUSED(v), 
 	int ATTR_UNUSED(c))

testcode/unitanchor.c

@@ -124,6 +124,7 @@ void anchors_test()
 {
 	ldns_buffer* buff = ldns_buffer_new(65800);
 	struct val_anchors* a;
+	unit_show_feature("trust anchor store");
 	unit_assert(a = anchors_create());
 	ldns_buffer_flip(buff);
 	test_anchor_empty(a);

testcode/unitdname.c

@@ -64,6 +64,7 @@ dname_to_buf(ldns_buffer* b, const char* str)
 static void 
 dname_test_qdl(ldns_buffer* buff)
 {
+	unit_show_func("util/data/dname.c", "query_dname_len");
 	unit_assert( query_dname_len(buff) == 0);
 	unit_assert( query_dname_len(dname_to_buf(buff, ".")) == 1 );
 	unit_assert( query_dname_len(dname_to_buf(buff, "bla.foo.")) == 9 );
@@ -75,6 +76,7 @@ dname_test_qdl(ldns_buffer* buff)
 static void
 dname_test_qdtl(ldns_buffer* buff)
 {
+	unit_show_func("util/data/dname.c", "query_dname_tolower");
 	ldns_buffer_write_at(buff, 0, "\012abCDeaBCde\003cOm\000", 16);
 	query_dname_tolower(ldns_buffer_begin(buff));
 	unit_assert( memcmp(ldns_buffer_begin(buff), 
@@ -98,6 +100,7 @@ dname_test_qdtl(ldns_buffer* buff)
 static void
 dname_test_query_dname_compare()
 {
+	unit_show_func("util/data/dname.c", "query_dname_compare");
 	unit_assert(query_dname_compare((uint8_t*)"", (uint8_t*)"") == 0);
 	unit_assert(query_dname_compare((uint8_t*)"\001a", 
 					(uint8_t*)"\001a") == 0);
@@ -127,6 +130,7 @@ dname_test_query_dname_compare()
 static void
 dname_test_count_labels()
 {
+	unit_show_func("util/data/dname.c", "dname_count_labels");
 	unit_assert(dname_count_labels((uint8_t*)"") == 1);
 	unit_assert(dname_count_labels((uint8_t*)"\003com") == 2);
 	unit_assert(dname_count_labels((uint8_t*)"\003org") == 2);
@@ -140,6 +144,7 @@ static void
 dname_test_count_size_labels()
 {
 	size_t sz = 0;
+	unit_show_func("util/data/dname.c", "dname_count_size_labels");
 	unit_assert(dname_count_size_labels((uint8_t*)"", &sz) == 1);
 	unit_assert(sz == 1);
 	unit_assert(dname_count_size_labels((uint8_t*)"\003com", &sz) == 2);
@@ -159,6 +164,7 @@ dname_test_count_size_labels()
 static void
 dname_test_pkt_dname_len(ldns_buffer* buff)
 {
+	unit_show_func("util/data/dname.c", "pkt_dname_len");
 	ldns_buffer_clear(buff);
 	ldns_buffer_write(buff, "\000", 1);
 	ldns_buffer_flip(buff);
@@ -265,6 +271,7 @@ static void
 dname_test_dname_lab_cmp()
 {
 	int ml = 0; /* number of labels that matched exactly */
+	unit_show_func("util/data/dname.c", "dname_lab_cmp");
 
 	/* test for equality succeeds */
 	unit_assert(dname_lab_cmp((uint8_t*)"", 1, (uint8_t*)"", 1, &ml) == 0);
@@ -365,6 +372,7 @@ dname_test_dname_lab_cmp()
 static void
 dname_test_subdomain()
 {
+	unit_show_func("util/data/dname.c", "dname_subdomain");
 	unit_assert(dname_subdomain_c(
 		(uint8_t*)"",
 		(uint8_t*)""));
@@ -401,6 +409,7 @@ dname_test_subdomain()
 static void
 dname_test_strict_subdomain()
 {
+	unit_show_func("util/data/dname.c", "dname_strict_subdomain");
 	unit_assert(!dname_strict_subdomain(
 		(uint8_t*)"", 1,
 		(uint8_t*)"", 1));
@@ -437,6 +446,7 @@ dname_test_strict_subdomain()
 static void
 dname_test_isroot()
 {
+	unit_show_func("util/data/dname.c", "dname_isroot");
 	unit_assert(dname_is_root((uint8_t*)"\000"));
 	unit_assert(!dname_is_root((uint8_t*)"\001a\000"));
 	unit_assert(!dname_is_root((uint8_t*)"\005abvcd\003com\000"));
@@ -452,6 +462,7 @@ dname_test_removelabel()
 	uint8_t* orig = (uint8_t*)"\007example\003com\000";
 	uint8_t* n = orig;
 	size_t l = 13;
+	unit_show_func("util/data/dname.c", "dname_remove_label");
 	dname_remove_label(&n, &l);
 	unit_assert( n == orig+8 );
 	unit_assert( l == 5 );
@@ -467,6 +478,7 @@ dname_test_removelabel()
 static void
 dname_test_sigcount()
 {
+	unit_show_func("util/data/dname.c", "dname_signame_label_count");
 	unit_assert(dname_signame_label_count((uint8_t*)"\000") == 0);
 	unit_assert(dname_signame_label_count((uint8_t*)"\001*\000") == 0);
 	unit_assert(dname_signame_label_count((uint8_t*)"\003xom\000") == 1);
@@ -486,6 +498,7 @@ dname_test_sigcount()
 static void
 dname_test_iswild()
 {
+	unit_show_func("util/data/dname.c", "dname_iswild");
 	unit_assert( !dname_is_wild((uint8_t*)"\000") );
 	unit_assert( dname_is_wild((uint8_t*)"\001*\000") );
 	unit_assert( !dname_is_wild((uint8_t*)"\003net\000") );
@@ -496,6 +509,7 @@ dname_test_iswild()
 static void
 dname_test_canoncmp()
 {
+	unit_show_func("util/data/dname.c", "dname_canonical_compare");
 	/* equality */
 	unit_assert( dname_canonical_compare(
 		(uint8_t*)"\000",
@@ -715,6 +729,7 @@ dname_test_canoncmp()
 static void
 dname_test_topdomain()
 {
+	unit_show_func("util/data/dname.c", "dname_get_shared_topdomain");
 	unit_assert( query_dname_compare(
 		dname_get_shared_topdomain(
 			(uint8_t*)"",
@@ -732,6 +747,52 @@ dname_test_topdomain()
 		(uint8_t*)"\007example\003com") == 0);
 }
 
+/** Test dname_valid */
+static void
+dname_test_valid()
+{
+	unit_show_func("util/data/dname.c", "dname_valid");
+	unit_assert( dname_valid( 
+			(uint8_t*)"\003www\007example\003com", 255) == 17);
+	unit_assert( dname_valid((uint8_t*)"", 255) == 1);
+	unit_assert( dname_valid( (uint8_t*)
+		"\020a1cdef5555544444"
+		"\020a2cdef5555544444"
+		"\020a3cdef5555544444"
+		"\020a4cdef5555544444"
+		"\020a5cdef5555544444"
+		"\020a6cdef5555544444"
+		"\020a7cdef5555544444"
+		"\020a8cdef5555544444"
+		"\020a9cdef5555544444"
+		"\020aAcdef5555544444"
+		"\020aBcdef5555544444"
+		"\020aCcdef5555544444"
+		"\020aDcdef5555544444"
+		"\020aEcdef5555544444"	/* 238 up to here */
+		"\007aabbccd"		/* 246 up to here */
+		"\007example\000"	/* 255 to here */
+		, 255) == 255);
+	unit_assert( dname_valid( (uint8_t*)
+		"\020a1cdef5555544444"
+		"\020a2cdef5555544444"
+		"\020a3cdef5555544444"
+		"\020a4cdef5555544444"
+		"\020a5cdef5555544444"
+		"\020a6cdef5555544444"
+		"\020a7cdef5555544444"
+		"\020a8cdef5555544444"
+		"\020a9cdef5555544444"
+		"\020aAcdef5555544444"
+		"\020aBcdef5555544444"
+		"\020aCcdef5555544444"
+		"\020aDcdef5555544444"
+		"\020aEcdef5555544444"	/* 238 up to here */
+		"\007aabbccd"		/* 246 up to here */
+		"\010exampleX\000"	/* 256 to here */
+		, 4096) == 0);
+}
+
 void dname_test()
 {
 	ldns_buffer* buff = ldns_buffer_new(65800);
@@ -751,5 +812,6 @@ void dname_test()
 	dname_test_iswild();
 	dname_test_canoncmp();
 	dname_test_topdomain();
+	dname_test_valid();
 	ldns_buffer_free(buff);
 }

testcode/unitlruhash.c

@@ -482,8 +482,8 @@ void lruhash_test()
 	/* start very very small array, so it can do lots of table_grow() */
 	/* also small in size so that reclaim has to be done quickly. */
 	struct lruhash* table ;
-	printf("lruhash test\n");
-	table = lruhash_create(2, 4096, 
+	unit_show_feature("lruhash");
+	table = lruhash_create(2, 8192, 
 		test_slabhash_sizefunc, test_slabhash_compfunc, 
 		test_slabhash_delkey, test_slabhash_deldata, NULL);
 	test_bin_find_entry(table);
@@ -491,7 +491,7 @@ void lruhash_test()
 	test_short_table(table);
 	test_long_table(table);
 	lruhash_delete(table);
-	table = lruhash_create(2, 4096, 
+	table = lruhash_create(2, 8192, 
 		test_slabhash_sizefunc, test_slabhash_compfunc, 
 		test_slabhash_delkey, test_slabhash_deldata, NULL);
 	test_threaded_table(table);

testcode/unitmain.c

@@ -54,6 +54,7 @@ alloc_test() {
 	struct alloc_cache major, minor1, minor2;
 	int i;
 
+	unit_show_feature("alloc_special_obtain");
 	alloc_init(&major, NULL, 0);
 	alloc_init(&minor1, &major, 0);
 	alloc_init(&minor2, &major, 1);
@@ -125,6 +126,7 @@ net_test()
 		"\377\377\377\377",
 		"\377\377\377\377",
 	};
+	unit_show_func("util/net_help.c", "str_is_ip6");
 	unit_assert( str_is_ip6("::") );
 	unit_assert( str_is_ip6("::1") );
 	unit_assert( str_is_ip6("2001:7b8:206:1:240:f4ff:fe37:8810") );
@@ -133,6 +135,7 @@ net_test()
 	unit_assert( !str_is_ip6("213.154.224.12") );
 	unit_assert( !str_is_ip6("213.154.224.255") );
 	unit_assert( !str_is_ip6("255.255.255.0") );
+	unit_show_func("util/net_help.c", "is_pow2");
 	unit_assert( is_pow2(0) );
 	unit_assert( is_pow2(1) );
 	unit_assert( is_pow2(2) );
@@ -155,6 +158,7 @@ net_test()
 	unit_assert( !is_pow2(259) );
 
 	/* test addr_mask */
+	unit_show_func("util/net_help.c", "addr_mask");
 	if(1) {
 		struct sockaddr_in a4;
 		struct sockaddr_in6 a6;
@@ -183,6 +187,7 @@ net_test()
 	}
 
 	/* test addr_in_common */
+	unit_show_func("util/net_help.c", "addr_in_common");
 	if(1) {
 		struct sockaddr_in a4, b4;
 		struct sockaddr_in6 a6, b6;
@@ -238,7 +243,29 @@ net_test()
 				(struct sockaddr_storage*)&b6, i, l6) == i);
 		}
 	}
+	/* test sockaddr_cmp_addr */
+	unit_show_func("util/net_help.c", "sockaddr_cmp_addr");
+	if(1) {
+		struct sockaddr_storage a, b;
+		socklen_t alen = (socklen_t)sizeof(a);
+		socklen_t blen = (socklen_t)sizeof(b);
+		unit_assert(ipstrtoaddr("127.0.0.0", 53, &a, &alen));
+		unit_assert(ipstrtoaddr("127.255.255.255", 53, &b, &blen));
+		unit_assert(sockaddr_cmp_addr(&a, alen, &b, blen) < 0);
+		unit_assert(sockaddr_cmp_addr(&b, blen, &a, alen) > 0);
+		unit_assert(sockaddr_cmp_addr(&a, alen, &a, alen) == 0);
+		unit_assert(sockaddr_cmp_addr(&b, blen, &b, blen) == 0);
+		unit_assert(ipstrtoaddr("192.168.121.5", 53, &a, &alen));
+		unit_assert(sockaddr_cmp_addr(&a, alen, &b, blen) > 0);
+		unit_assert(sockaddr_cmp_addr(&b, blen, &a, alen) < 0);
+		unit_assert(sockaddr_cmp_addr(&a, alen, &a, alen) == 0);
+		unit_assert(ipstrtoaddr("2001:3578:ffeb::99", 53, &b, &blen));
+		unit_assert(sockaddr_cmp_addr(&b, blen, &b, blen) == 0);
+		unit_assert(sockaddr_cmp_addr(&a, alen, &b, blen) < 0);
+		unit_assert(sockaddr_cmp_addr(&b, blen, &a, alen) > 0);
+	}
 	/* test addr_is_ip4mapped */
+	unit_show_func("util/net_help.c", "addr_is_ip4mapped");
 	if(1) {
 		struct sockaddr_storage a;
 		socklen_t l = (socklen_t)sizeof(a);
@@ -269,6 +296,7 @@ static void
 config_memsize_test() 
 {
 	size_t v = 0;
+	unit_show_func("util/config_file.c", "cfg_parse_memsize");
 	if(0) {
 		/* these emit errors */
 		unit_assert( cfg_parse_memsize("", &v) == 0);
@@ -309,6 +337,7 @@ rtt_test()
 	int init = 376;
 	int i;
 	struct rtt_info r;
+	unit_show_func("util/rtt.c", "rtt_timeout");
 	rtt_init(&r);
 	/* initial value sensible */
 	unit_assert( rtt_timeout(&r) == init );
@@ -346,6 +375,7 @@ infra_test()
 	int init = 376;
 	int dlame, rlame, alame, olame;
 
+	unit_show_feature("infra cache");
 	unit_assert(ipstrtoaddr("127.0.0.1", 53, &one, &onelen));
 
 	slab = infra_create(cfg);
@@ -403,6 +433,7 @@ rnd_test()
 	struct ub_randstate* r;
 	int num = 100, i;
 	long int a[100];
+	unit_show_feature("ub_random");
 	unit_assert( (r = ub_initstate((unsigned)time(NULL), NULL)) );
 	for(i=0; i<num; i++) {
 		a[i] = ub_random(r);
@@ -416,6 +447,16 @@ rnd_test()
 	ub_randfree(r);
 }
 
+void unit_show_func(const char* file, const char* func)
+{
+	printf("test %s:%s\n", file, func);
+}
+
+void unit_show_feature(const char* feature)
+{
+	printf("test %s functions\n", feature);
+}
+
 /**
  * Main unit test program. Setup, teardown and report errors.
  * @param argc: arg count.
@@ -445,8 +486,8 @@ main(int argc, char* argv[])
 	net_test();
 	config_memsize_test();
 	dname_test();
-	anchors_test();
 	rtt_test();
+	anchors_test();
 	alloc_test();
 	lruhash_test();
 	slabhash_test();

testcode/unitmain.h

@@ -51,6 +51,11 @@ extern int testcount;
 #define unit_assert(x) do {testcount++; if(!(x)) { fprintf(stderr, "assertion failure %s:%d\n", __FILE__, __LINE__); exit(1);}} while(0)
 #endif
 
+/** we are now testing this function */
+void unit_show_func(const char* file, const char* func);
+/** we are testing this functionality */
+void unit_show_feature(const char* feature);
+
 /** unit test lruhashtable implementation */
 void lruhash_test();
 /** unit test slabhashtable implementation */

testcode/unitmsgparse.c

@@ -506,7 +506,7 @@ void msgparse_test()
 	alloc_init(&super_a, NULL, 0);
 	alloc_init(&alloc, &super_a, 2);
 
-	printf("testmsgparse\n");
+	unit_show_feature("message parse");
 	simpletest(pkt, &alloc, out);
 	/* plain hex dumps, like pcat */
 	testfromfile(pkt, &alloc, out, "testdata/test_packets.1");

testcode/unitneg.c

@@ -530,6 +530,7 @@ void neg_test()
 {
 	struct val_neg_cache* neg;
 	srandom(48);
+	unit_show_feature("negative cache");
 
 	/* create with defaults */
 	neg = val_neg_create(NULL, 1500);

testcode/unitslabhash.c

@@ -361,14 +361,14 @@ void slabhash_test()
 	/* start very very small array, so it can do lots of table_grow() */
 	/* also small in size so that reclaim has to be done quickly. */
 	struct slabhash* table;
-	printf("slabhash test\n");
-	table = slabhash_create(4, 2, 5200, 
+	unit_show_feature("slabhash");
+	table = slabhash_create(4, 2, 10400, 
 		test_slabhash_sizefunc, test_slabhash_compfunc, 
 		test_slabhash_delkey, test_slabhash_deldata, NULL);
 	test_short_table(table);
 	test_long_table(table);
 	slabhash_delete(table);
-	table = slabhash_create(4, 2, 5200, 
+	table = slabhash_create(4, 2, 10400, 
 		test_slabhash_sizefunc, test_slabhash_compfunc, 
 		test_slabhash_delkey, test_slabhash_deldata, NULL);
 	test_threaded_table(table);

testcode/unitverify.c

@@ -467,7 +467,7 @@ nsec3_hash_test(const char* fname)
 void 
 verify_test()
 {
-	printf("verify test\n");
+	unit_show_feature("signature verify");
 	verifytest_file("testdata/test_signatures.1", "20070818005004");
 	verifytest_file("testdata/test_signatures.2", "20080414005004");
 	verifytest_file("testdata/test_signatures.3", "20080416005004");

testdata/autotrust_init_sigs.rpl

@@ -0,0 +1,183 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	log-time-ascii: yes
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
+; initial content (say from dig example.com DNSKEY > example.com.key) 
+AUTOTRUST_FILE example.com
+example.com.	10800	IN	DNSKEY	257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b}
+example.com.	10800	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20070926134150 20070829134150 55582 example.com. sT5Se0rwBm0oAOcrX37oidl3zxK9QwvgAyOH+08Jq3V8KS4iPehBjNqXi9OITLgos4dHU/up4Z1BwgwTNYJIgg== ;{id = 55582}
+example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20070926134150 20070829134150 30899 example.com. DnrdGYsSAjAX1z93FQvPL8eX66uS9ip7A21gPTkvGBDwDoNB8JTNdRlEyWeXlipatbcQoZeG8mo87Wgp9eT/PA== ;{id = 30899}
+AUTOTRUST_END
+CONFIG_END
+
+SCENARIO_BEGIN Test autotrust with initial trust anchor with RRSIGs
+
+; K-ROOT
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id copy_query
+REPLY QR AA
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS k.root-servers.net.
+SECTION ADDITIONAL
+k.root-servers.net IN A 193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com. IN NS a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net. IN A 192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com. IN NS ns.example.com.
+SECTION ADDITIONAL
+ns.example.com. IN A 1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com.	3600	IN	A	10.20.30.40
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20090924111500 20090821111500 30899 example.com. pYGxVLsWUvOp1wSf0iwPap+JnECfC5GAm1lRqy3YEqecNGld7U7x/5Imo3CerbdZrVptUQs2oH0lcjwYJXMnsw== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	3600	IN	NS	ns.example.com.
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20090924111500 20090821111500 30899 example.com. J5wxRq0jgwQL6yy530kvo9cHqNAUHV8IF4dvaYZL0bNraO2Oe6dVXqlJl4+cxNHI2TMsstwFPr2Zz8tv6Az2mQ== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.	3600	IN	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20090924111500 20090821111500 30899 example.com. JsXbS18oyc0zkVaOWGSFdIQuOsZKflT0GraT9afDPoWLCgH4ApF7jNgfJV7Pqy1sTBRajME5IUAhpANwGBuW4A== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+; KSK 1
+example.com.	10800	IN	DNSKEY	257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b}
+; ZSK 1
+example.com.	10800	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (ksk), size = 512b}
+; signatures
+example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20090924111500 20090821111500 30899 example.com. b/HK231jIQLX8IhlZfup3r0yhpXaasbPE6LzxoEVVvWaTZWcLmeV8jDIcn0qO7Yvs7bIJN20lwVAV0GcHH3hWQ== ;{id = 30899}
+example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20090924111500 20090821111500 55582 example.com. PCHme1QLoULxqjhg5tMlpR0qJlBfstEUVq18TtNoKQe9le1YhJ9caheXcTWoK+boLhXxg9u6Yyvq8FboQh0OjA== ;{id = 55582}
+
+ENTRY_END
+RANGE_END
+
+; set date/time to Aug 24 09:46:40  (2009).
+STEP 5 TIME_PASSES ELAPSE 1251100000
+STEP 6 ASSIGN t0 = ${time}
+; get probe time and check it. 4800 is about 10% less than 5400. And more than
+; the 3600 that a failure timeout would have.
+STEP 7 ASSIGN probe = ${range 4800 ${timeout} 5400}
+
+
+; the auto probing should have been done now.
+STEP 8 CHECK_AUTOTRUST example.com
+FILE_BEGIN
+; autotrust trust anchor file
+;;id: example.com. 1
+;;last_queried: 1251100000 ;;Mon Aug 24 09:46:40 2009
+;;last_success: 1251100000 ;;Mon Aug 24 09:46:40 2009
+;;next_probe_time: ${$t0 + $probe} ;;${ctime $t0 + $probe}
+;;query_failed: 0
+;;query_interval: 5400
+;;retry_time: 3600
+example.com.	10800	IN	DNSKEY	257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1251100000 ;;Mon Aug 24 09:46:40 2009
+FILE_END
+
+
+STEP 10 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 20 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com.	3600	IN	A	10.20.30.40
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20090924111500 20090821111500 30899 example.com. pYGxVLsWUvOp1wSf0iwPap+JnECfC5GAm1lRqy3YEqecNGld7U7x/5Imo3CerbdZrVptUQs2oH0lcjwYJXMnsw== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	3600	IN	NS	ns.example.com.
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20090924111500 20090821111500 30899 example.com. J5wxRq0jgwQL6yy530kvo9cHqNAUHV8IF4dvaYZL0bNraO2Oe6dVXqlJl4+cxNHI2TMsstwFPr2Zz8tv6Az2mQ== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.	3600	IN	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20090924111500 20090821111500 30899 example.com. JsXbS18oyc0zkVaOWGSFdIQuOsZKflT0GraT9afDPoWLCgH4ApF7jNgfJV7Pqy1sTBRajME5IUAhpANwGBuW4A== ;{id = 30899}
+ENTRY_END
+
+; The autotrust anchor was probed due to the query.
+
+STEP 30 CHECK_AUTOTRUST example.com
+FILE_BEGIN
+; autotrust trust anchor file
+;;id: example.com. 1
+;;last_queried: 1251100000 ;;Mon Aug 24 09:46:40 2009
+;;last_success: 1251100000 ;;Mon Aug 24 09:46:40 2009
+;;next_probe_time: ${$t0 + $probe} ;;${ctime $t0 + $probe}
+;;query_failed: 0
+;;query_interval: 5400
+;;retry_time: 3600
+example.com.	10800	IN	DNSKEY	257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1251100000 ;;Mon Aug 24 09:46:40 2009
+FILE_END
+
+; wait and see if autotrust probes (the unchanged) domain again.
+STEP 40 TIME_PASSES EVAL ${$probe}
+
+STEP 50 TRAFFIC
+
+STEP 65 ASSIGN probe2 = ${range 4800 ${timeout} 5400}
+
+STEP 70 CHECK_AUTOTRUST example.com
+FILE_BEGIN
+; autotrust trust anchor file
+;;id: example.com. 1
+;;last_queried: ${time} ;;${ctime ${time}}
+;;last_success: ${time} ;;${ctime ${time}}
+;;next_probe_time: ${$t0 + $probe + $probe2} ;;${ctime $t0 + $probe + $probe2}
+;;query_failed: 0
+;;query_interval: 5400
+;;retry_time: 3600
+example.com.	10800	IN	DNSKEY	257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1251100000 ;;Mon Aug 24 09:46:40 2009
+FILE_END
+
+SCENARIO_END

testdata/black_ds_entry.rpl

@@ -0,0 +1,626 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with blacked key entry for DS and further queries
+; a DS record fails.
+; the blacklist action does not help.
+; the further queries should not generate traffic to the authority any more.
+; until the key entry expires.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.blabla.com. IN A
+SECTION ANSWER
+ns.blabla.com. IN A 1.2.3.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.blabla.com. IN AAAA
+SECTION AUTHORITY
+com. IN SOA com. com. 2009100100 28800 7200 604800 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.foo.com. IN A
+SECTION ANSWER
+ns.foo.com. IN A 1.2.4.7
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.foo.com. IN AAAA
+SECTION AUTHORITY
+com. IN SOA com. com. 2009100100 28800 7200 604800 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+;example.com.	IN NS	ns.blabla.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+;example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20030926134150 20030829134150 2854 example.com. AKJ3xUBdSrCiOFkYajsy93d+h06rewpbmBHItTkL8R/26rw57b1gCIg= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AHNj99mBmP4np19V01nSq990ZIFlIiLWoeHijm/HcOG/o8+DuIp4fL8= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN A
+SECTION ANSWER
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AHNj99mBmP4np19V01nSq990ZIFlIiLWoeHijm/HcOG/o8+DuIp4fL8= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION ADDITIONAL
+ns.example.com. IN NSEC oof.example.com. NSEC RRSIG A
+ns.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20030926134150 20030829134150 2854 example.com. ACFVLLBtuSX/1z3461tbOwDz9zTHe5S9DbVtwnSO1f2x06fYbMpzSDE= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+; make priming query succeed
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+;example.com.	3600	IN	RRSIG	DNSKEY 3 2 3600 20030926134150 20030829134150 2854 example.com. AG21xE8CFQzTq6XtHErg28b9EAmqPsoYCUcFPEAoAjFybM6AY4/bMOo= ;{id = 2854}
+SECTION AUTHORITY
+;example.com.    IN NS   ns.example.com.
+;example.com.    IN NS   ns.blabla.com.
+;example.com.	3600	IN	RRSIG	NS 3 2 3600 20030926134150 20030829134150 2854 example.com. ACiWu7zjBHqgEX3iUoOF7rfpOmIAHj1npKQ+XDIaNlmdkfJxoCwFl04= ;{id = 2854}
+SECTION ADDITIONAL
+;ns.example.com.		IN 	A	1.2.3.4
+;ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. ACmAsKTf7hqDaYK8CQ7FL1cGYPW+blTCnzZGkExFtEUAGrHeze87o+A= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AGj9kE8oW3OhOLhkmJ3HBaNIOpvGf3S8zSd5gWmhpxAMc5hh6cxZfpQ= ;{id = 2854}
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+;example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20030926134150 20030829134150 2854 example.com. ACHETweBNPgbmRoNRdKvxuw4X9qNUUTEpSuwV+HhuiBE83gbB98asAc= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AGvu9A/nGsbatxJCmnObioIhKg2Tm0Apr0eo+DO1kIDrAHco/bt/EdY= ;{id = 2854}
+ENTRY_END
+
+; DS request
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+;sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AKslZ9oXcoyeOkPfGkTB3/hxnpdgU5ahzElLyK6B0n6+BdIXeirIEtE= ;{id = 2854}
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20030926134150 20030829134150 2854 example.com. AAT/7XwtMjHiT1GFHfV6Wvv4n+oOkqxllNdf9bLnpTHw/8h586yBgwg= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION AUTHORITY
+sub.example.com. IN NS ns.sub.example.com.
+;sub.example.com. IN NS ns.foo.com.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+;sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AKslZ9oXcoyeOkPfGkTB3/hxnpdgU5ahzElLyK6B0n6+BdIXeirIEtE= ;{id = 2854}
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20030926134150 20030829134150 2854 example.com. AAT/7XwtMjHiT1GFHfV6Wvv4n+oOkqxllNdf9bLnpTHw/8h586yBgwg= ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.4.6
+ENTRY_END
+
+RANGE_END
+
+; ns.blabla.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20070926134150 20070829134150 2854 example.com. AAJHNhPYVG6+550zQga9ZgV8McQZHLboOWjfbdiq2ZC+gUcQeQDDlFs= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN A
+SECTION ANSWER
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION ADDITIONAL
+ns.example.com. IN NSEC oof.example.com. NSEC RRSIG A
+ns.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. ABhDNtJramb2a4R1SK5gb/CTYJybQts6mZ++z3kLiwsrUSZInA4ikeQ= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20070926134150 20070829134150 2854 example.com. AAJHNhPYVG6+550zQga9ZgV8McQZHLboOWjfbdiq2ZC+gUcQeQDDlFs= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20070926134150 20070829134150 2854 example.com. AAJHNhPYVG6+550zQga9ZgV8McQZHLboOWjfbdiq2ZC+gUcQeQDDlFs= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+
+; DS request
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AKslZ9oXcoyeOkPfGkTB3/hxnpdgU5ahzElLyK6B0n6+BdIXeirIEtE= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION AUTHORITY
+sub.example.com. IN NS ns.sub.example.com.
+;sub.example.com. IN NS ns.foo.com.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AKslZ9oXcoyeOkPfGkTB3/hxnpdgU5ahzElLyK6B0n6+BdIXeirIEtE= ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.4.6
+ENTRY_END
+
+RANGE_END
+
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.4.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.	3600	IN	RRSIG	DNSKEY 5 3 3600 20030926134150 20030829134150 30899 sub.example.com. g+YoDwrCF75YCFyqYoxlF+/mNfcscnuZ6LfmfBgPLohlvCCC7jYj/wkc2fxAl3MEK0CriWkHp1hw0QQYkmbbKw== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN NS ns.sub.example.com.
+;sub.example.com. IN NS ns.foo.com.
+sub.example.com.	3600	IN	RRSIG	NS 5 3 3600 20030926134150 20030829134150 30899 sub.example.com. VCDq+gfZHuziE81Uypxm2va4eXCtoD8F8YKkwNo8laMNUcXh/hvGdbHKXMMghwuJXgxLh89Diu5kywBVwb/AIg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.4.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20030926134150 20030829134150 30899 sub.example.com. l3wjlbDU2y7ECix6t1pp5Rtz+qFlADRMohcRsCrnD9b99IoOL0/cTpvvf2V1VTJveIibFGhbcHTuCqAQ4G4FKA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN A
+SECTION ANSWER
+ns.sub.example.com. IN A 1.2.4.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20030926134150 20030829134150 30899 sub.example.com. l3wjlbDU2y7ECix6t1pp5Rtz+qFlADRMohcRsCrnD9b99IoOL0/cTpvvf2V1VTJveIibFGhbcHTuCqAQ4G4FKA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN AAAA
+SECTION AUTHORITY
+ns.sub.example.com. IN NSEC nt.sub.example.com. NSEC RRSIG A
+ns.sub.example.com.	3600	IN	RRSIG	NSEC 5 4 3600 20030926134150 20030829134150 30899 sub.example.com. eVe3iQS2/a1Y57AA2QSlMU/z31xaJ2mwUU36PZh8vlv6shPpQywAT70JdX6+ZsuliRpsbY6crkVXTXJ2qpKTiQ== ;{id = 30899}
+sub.example.com. IN SOA sub.example.com. hostmaster.sub.example.com. 1 2 3 4 5
+sub.example.com.	3600	IN	RRSIG	SOA 5 3 3600 20030926134150 20030829134150 30899 sub.example.com. vEX2n1CksMr5jPq9d2BQJMIDwxaXdWlY5mYg+PBmOFI4xngFMKTsXa/+SfJy2SiqAgHTDI6joIo30AdQJsjdHA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A 10.20.30.40
+www.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20030926134150 20030829134150 30899 sub.example.com. dBK6JOkKlp2G+f7mhInKnQM6DUBnEziTS+KpXzQ/5HT8/h9XkryOt4vAJKGCz0Ew3qRqjLgylsbGrcuxmIO9jA== ;{id = 30899}
+ENTRY_END
+
+RANGE_END
+
+; ns.foo.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.4.7
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.	3600	IN	RRSIG	DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN NS ns.sub.example.com.
+;sub.example.com. IN NS ns.foo.com.
+sub.example.com.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. hJ3nkrfyBwPcfpwc9wEwzhF5+ZKUddKBHQuZuHPZBjBwb1BsT7B7ryadttbGE3keQJiwNmK9AqvE0Zb+WkDceg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.4.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. fMRshSYDWgvGAwc24Lzg6746jnoG5shlK+o9CgzU7CQbkeNWmj3oO/0TJGP/zxp52JiDBpzRuTmBlrcJYV/gBA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN A
+SECTION ANSWER
+ns.sub.example.com. IN A 1.2.4.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. fMRshSYDWgvGAwc24Lzg6746jnoG5shlK+o9CgzU7CQbkeNWmj3oO/0TJGP/zxp52JiDBpzRuTmBlrcJYV/gBA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN AAAA
+SECTION AUTHORITY
+ns.sub.example.com. IN NSEC nt.sub.example.com. NSEC RRSIG A
+ns.sub.example.com.	3600	IN	RRSIG	NSEC 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. qwUibvlPTFnxgiyCNtEJCYqJIgA8WFDqypmsO6TSYje2Rqhq4AaWEVxQwU4bdjmipCGVqtlP8mMyMQHaYNMGKA== ;{id = 30899}
+sub.example.com. IN SOA sub.example.com. hostmaster.sub.example.com. 1 2 3 4 5
+sub.example.com.	3600	IN	RRSIG	SOA 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. sZQEMd0ys2mxPRajzBuvy4XdLNVvXMmJSnmfTHUL41d9IxbGN/ifpiIWs2MXOFPnbab05aYadrzZpT/cpDTxmQ== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A 10.20.30.40
+www.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. deNzEy9Hq+6gDZhafC0M7UDuRBm51AA1/FAIauAitNuQlYUzOvWLVHFQ95bn308rCVPqrb4rFDV+gNzxkzm1rw== ;{id = 30899}
+ENTRY_END
+RANGE_END
+
+; ns.sub.example.com.
+; This is for after, so only new queries, no requeries allowed.
+RANGE_BEGIN 100 200
+	ADDRESS 1.2.4.6
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ftp.sub.example.com. IN A
+SECTION ANSWER
+ftp.sub.example.com. IN A 10.20.30.46
+ftp.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20030926134150 20030829134150 30899 sub.example.com. nbxk6SiooKsUeVm/ZGskrxKwhOSWdJt9ly9X6Hqji4DKpBskM6bqulmTt/xZ/3G4ZOguYBeiTp8qwlWjl7VoSQ== ;{id = 30899}
+ENTRY_END
+
+RANGE_END
+
+; ns.example.com.
+; fixed version
+RANGE_BEGIN 200 300
+	ADDRESS 1.2.3.4
+; DS request
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AKslZ9oXcoyeOkPfGkTB3/hxnpdgU5ahzElLyK6B0n6+BdIXeirIEtE= ;{id = 2854}
+ENTRY_END
+
+RANGE_END
+
+; ns.sub.example.com.
+; fixed version
+RANGE_BEGIN 200 300
+	ADDRESS 1.2.4.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.	3600	IN	RRSIG	DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN NS ns.sub.example.com.
+;sub.example.com. IN NS ns.foo.com.
+sub.example.com.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. hJ3nkrfyBwPcfpwc9wEwzhF5+ZKUddKBHQuZuHPZBjBwb1BsT7B7ryadttbGE3keQJiwNmK9AqvE0Zb+WkDceg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.4.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. fMRshSYDWgvGAwc24Lzg6746jnoG5shlK+o9CgzU7CQbkeNWmj3oO/0TJGP/zxp52JiDBpzRuTmBlrcJYV/gBA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN A
+SECTION ANSWER
+ns.sub.example.com. IN A 1.2.4.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. fMRshSYDWgvGAwc24Lzg6746jnoG5shlK+o9CgzU7CQbkeNWmj3oO/0TJGP/zxp52JiDBpzRuTmBlrcJYV/gBA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN AAAA
+SECTION AUTHORITY
+ns.sub.example.com. IN NSEC nt.sub.example.com. NSEC RRSIG A
+ns.sub.example.com.	3600	IN	RRSIG	NSEC 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. qwUibvlPTFnxgiyCNtEJCYqJIgA8WFDqypmsO6TSYje2Rqhq4AaWEVxQwU4bdjmipCGVqtlP8mMyMQHaYNMGKA== ;{id = 30899}
+sub.example.com. IN SOA sub.example.com. hostmaster.sub.example.com. 1 2 3 4 5
+sub.example.com.	3600	IN	RRSIG	SOA 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. sZQEMd0ys2mxPRajzBuvy4XdLNVvXMmJSnmfTHUL41d9IxbGN/ifpiIWs2MXOFPnbab05aYadrzZpT/cpDTxmQ== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A 10.20.30.40
+www.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. deNzEy9Hq+6gDZhafC0M7UDuRBm51AA1/FAIauAitNuQlYUzOvWLVHFQ95bn308rCVPqrb4rFDV+gNzxkzm1rw== ;{id = 30899}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+ENTRY_END
+
+; no more outgoing traffic possible.
+STEP 110 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+ftp.sub.example.com. IN A
+ENTRY_END
+
+STEP 120 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+ftp.sub.example.com. IN A
+SECTION ANSWER
+ENTRY_END
+
+; wait for timeout seconds.
+STEP 130 TIME_PASSES ELAPSE 901
+
+STEP 210 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 220 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A 10.20.30.40
+www.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. deNzEy9Hq+6gDZhafC0M7UDuRBm51AA1/FAIauAitNuQlYUzOvWLVHFQ95bn308rCVPqrb4rFDV+gNzxkzm1rw== ;{id = 30899}
+ENTRY_END
+
+
+SCENARIO_END

testdata/black_key_entry.rpl

@@ -0,0 +1,608 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with blacked key entry and further queries
+; DNSKEY not for prime but further down the chain of trust
+; the blacklist action does not help.
+; the further queries should not generate traffic to the authority any more.
+; until the key entry expires.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.blabla.com. IN A
+SECTION ANSWER
+ns.blabla.com. IN A 1.2.3.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.blabla.com. IN AAAA
+SECTION AUTHORITY
+com. IN SOA com. com. 2009100100 28800 7200 604800 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.foo.com. IN A
+SECTION ANSWER
+ns.foo.com. IN A 1.2.4.7
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.foo.com. IN AAAA
+SECTION AUTHORITY
+com. IN SOA com. com. 2009100100 28800 7200 604800 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.	IN NS	ns.blabla.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20030926134150 20030829134150 2854 example.com. AKJ3xUBdSrCiOFkYajsy93d+h06rewpbmBHItTkL8R/26rw57b1gCIg= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AHNj99mBmP4np19V01nSq990ZIFlIiLWoeHijm/HcOG/o8+DuIp4fL8= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN A
+SECTION ANSWER
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AHNj99mBmP4np19V01nSq990ZIFlIiLWoeHijm/HcOG/o8+DuIp4fL8= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION ADDITIONAL
+ns.example.com. IN NSEC oof.example.com. NSEC RRSIG A
+ns.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20030926134150 20030829134150 2854 example.com. ACFVLLBtuSX/1z3461tbOwDz9zTHe5S9DbVtwnSO1f2x06fYbMpzSDE= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+; make priming query succeed
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+;example.com.	3600	IN	RRSIG	DNSKEY 3 2 3600 20030926134150 20030829134150 2854 example.com. AG21xE8CFQzTq6XtHErg28b9EAmqPsoYCUcFPEAoAjFybM6AY4/bMOo= ;{id = 2854}
+SECTION AUTHORITY
+;example.com.    IN NS   ns.example.com.
+;example.com.    IN NS   ns.blabla.com.
+;example.com.	3600	IN	RRSIG	NS 3 2 3600 20030926134150 20030829134150 2854 example.com. ACiWu7zjBHqgEX3iUoOF7rfpOmIAHj1npKQ+XDIaNlmdkfJxoCwFl04= ;{id = 2854}
+SECTION ADDITIONAL
+;ns.example.com.		IN 	A	1.2.3.4
+;ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. ACmAsKTf7hqDaYK8CQ7FL1cGYPW+blTCnzZGkExFtEUAGrHeze87o+A= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AGj9kE8oW3OhOLhkmJ3HBaNIOpvGf3S8zSd5gWmhpxAMc5hh6cxZfpQ= ;{id = 2854}
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20030926134150 20030829134150 2854 example.com. ACHETweBNPgbmRoNRdKvxuw4X9qNUUTEpSuwV+HhuiBE83gbB98asAc= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AGvu9A/nGsbatxJCmnObioIhKg2Tm0Apr0eo+DO1kIDrAHco/bt/EdY= ;{id = 2854}
+ENTRY_END
+
+; DS request
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AKslZ9oXcoyeOkPfGkTB3/hxnpdgU5ahzElLyK6B0n6+BdIXeirIEtE= ;{id = 2854}
+;sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20030926134150 20030829134150 2854 example.com. AAT/7XwtMjHiT1GFHfV6Wvv4n+oOkqxllNdf9bLnpTHw/8h586yBgwg= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION AUTHORITY
+sub.example.com. IN NS ns.sub.example.com.
+;sub.example.com. IN NS ns.foo.com.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AKslZ9oXcoyeOkPfGkTB3/hxnpdgU5ahzElLyK6B0n6+BdIXeirIEtE= ;{id = 2854}
+;sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20030926134150 20030829134150 2854 example.com. AAT/7XwtMjHiT1GFHfV6Wvv4n+oOkqxllNdf9bLnpTHw/8h586yBgwg= ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.4.6
+ENTRY_END
+
+RANGE_END
+
+; ns.blabla.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20070926134150 20070829134150 2854 example.com. AAJHNhPYVG6+550zQga9ZgV8McQZHLboOWjfbdiq2ZC+gUcQeQDDlFs= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN A
+SECTION ANSWER
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION ADDITIONAL
+ns.example.com. IN NSEC oof.example.com. NSEC RRSIG A
+ns.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. ABhDNtJramb2a4R1SK5gb/CTYJybQts6mZ++z3kLiwsrUSZInA4ikeQ= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20070926134150 20070829134150 2854 example.com. AAJHNhPYVG6+550zQga9ZgV8McQZHLboOWjfbdiq2ZC+gUcQeQDDlFs= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20070926134150 20070829134150 2854 example.com. AAJHNhPYVG6+550zQga9ZgV8McQZHLboOWjfbdiq2ZC+gUcQeQDDlFs= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+
+; DS request
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AKslZ9oXcoyeOkPfGkTB3/hxnpdgU5ahzElLyK6B0n6+BdIXeirIEtE= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION AUTHORITY
+sub.example.com. IN NS ns.sub.example.com.
+;sub.example.com. IN NS ns.foo.com.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926134150 20070829134150 2854 example.com. AKslZ9oXcoyeOkPfGkTB3/hxnpdgU5ahzElLyK6B0n6+BdIXeirIEtE= ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.4.6
+ENTRY_END
+
+RANGE_END
+
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.4.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.	3600	IN	RRSIG	DNSKEY 5 3 3600 20030926134150 20030829134150 30899 sub.example.com. g+YoDwrCF75YCFyqYoxlF+/mNfcscnuZ6LfmfBgPLohlvCCC7jYj/wkc2fxAl3MEK0CriWkHp1hw0QQYkmbbKw== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN NS ns.sub.example.com.
+;sub.example.com. IN NS ns.foo.com.
+sub.example.com.	3600	IN	RRSIG	NS 5 3 3600 20030926134150 20030829134150 30899 sub.example.com. VCDq+gfZHuziE81Uypxm2va4eXCtoD8F8YKkwNo8laMNUcXh/hvGdbHKXMMghwuJXgxLh89Diu5kywBVwb/AIg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.4.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20030926134150 20030829134150 30899 sub.example.com. l3wjlbDU2y7ECix6t1pp5Rtz+qFlADRMohcRsCrnD9b99IoOL0/cTpvvf2V1VTJveIibFGhbcHTuCqAQ4G4FKA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN A
+SECTION ANSWER
+ns.sub.example.com. IN A 1.2.4.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20030926134150 20030829134150 30899 sub.example.com. l3wjlbDU2y7ECix6t1pp5Rtz+qFlADRMohcRsCrnD9b99IoOL0/cTpvvf2V1VTJveIibFGhbcHTuCqAQ4G4FKA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN AAAA
+SECTION AUTHORITY
+ns.sub.example.com. IN NSEC nt.sub.example.com. NSEC RRSIG A
+ns.sub.example.com.	3600	IN	RRSIG	NSEC 5 4 3600 20030926134150 20030829134150 30899 sub.example.com. eVe3iQS2/a1Y57AA2QSlMU/z31xaJ2mwUU36PZh8vlv6shPpQywAT70JdX6+ZsuliRpsbY6crkVXTXJ2qpKTiQ== ;{id = 30899}
+sub.example.com. IN SOA sub.example.com. hostmaster.sub.example.com. 1 2 3 4 5
+sub.example.com.	3600	IN	RRSIG	SOA 5 3 3600 20030926134150 20030829134150 30899 sub.example.com. vEX2n1CksMr5jPq9d2BQJMIDwxaXdWlY5mYg+PBmOFI4xngFMKTsXa/+SfJy2SiqAgHTDI6joIo30AdQJsjdHA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A 10.20.30.40
+www.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20030926134150 20030829134150 30899 sub.example.com. dBK6JOkKlp2G+f7mhInKnQM6DUBnEziTS+KpXzQ/5HT8/h9XkryOt4vAJKGCz0Ew3qRqjLgylsbGrcuxmIO9jA== ;{id = 30899}
+ENTRY_END
+
+RANGE_END
+
+; ns.foo.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.4.7
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.	3600	IN	RRSIG	DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN NS ns.sub.example.com.
+;sub.example.com. IN NS ns.foo.com.
+sub.example.com.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. hJ3nkrfyBwPcfpwc9wEwzhF5+ZKUddKBHQuZuHPZBjBwb1BsT7B7ryadttbGE3keQJiwNmK9AqvE0Zb+WkDceg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.4.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. fMRshSYDWgvGAwc24Lzg6746jnoG5shlK+o9CgzU7CQbkeNWmj3oO/0TJGP/zxp52JiDBpzRuTmBlrcJYV/gBA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN A
+SECTION ANSWER
+ns.sub.example.com. IN A 1.2.4.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. fMRshSYDWgvGAwc24Lzg6746jnoG5shlK+o9CgzU7CQbkeNWmj3oO/0TJGP/zxp52JiDBpzRuTmBlrcJYV/gBA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN AAAA
+SECTION AUTHORITY
+ns.sub.example.com. IN NSEC nt.sub.example.com. NSEC RRSIG A
+ns.sub.example.com.	3600	IN	RRSIG	NSEC 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. qwUibvlPTFnxgiyCNtEJCYqJIgA8WFDqypmsO6TSYje2Rqhq4AaWEVxQwU4bdjmipCGVqtlP8mMyMQHaYNMGKA== ;{id = 30899}
+sub.example.com. IN SOA sub.example.com. hostmaster.sub.example.com. 1 2 3 4 5
+sub.example.com.	3600	IN	RRSIG	SOA 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. sZQEMd0ys2mxPRajzBuvy4XdLNVvXMmJSnmfTHUL41d9IxbGN/ifpiIWs2MXOFPnbab05aYadrzZpT/cpDTxmQ== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A 10.20.30.40
+www.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. deNzEy9Hq+6gDZhafC0M7UDuRBm51AA1/FAIauAitNuQlYUzOvWLVHFQ95bn308rCVPqrb4rFDV+gNzxkzm1rw== ;{id = 30899}
+ENTRY_END
+RANGE_END
+
+; ns.sub.example.com.
+; This is for after, so only new queries, no requeries allowed.
+RANGE_BEGIN 100 200
+	ADDRESS 1.2.4.6
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ftp.sub.example.com. IN A
+SECTION ANSWER
+ftp.sub.example.com. IN A 10.20.30.46
+ftp.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20030926134150 20030829134150 30899 sub.example.com. nbxk6SiooKsUeVm/ZGskrxKwhOSWdJt9ly9X6Hqji4DKpBskM6bqulmTt/xZ/3G4ZOguYBeiTp8qwlWjl7VoSQ== ;{id = 30899}
+ENTRY_END
+
+RANGE_END
+
+; ns.sub.example.com.
+; fixed version
+RANGE_BEGIN 200 300
+	ADDRESS 1.2.4.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.	3600	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.	3600	IN	RRSIG	DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN NS ns.sub.example.com.
+;sub.example.com. IN NS ns.foo.com.
+sub.example.com.	3600	IN	RRSIG	NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. hJ3nkrfyBwPcfpwc9wEwzhF5+ZKUddKBHQuZuHPZBjBwb1BsT7B7ryadttbGE3keQJiwNmK9AqvE0Zb+WkDceg== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.4.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. fMRshSYDWgvGAwc24Lzg6746jnoG5shlK+o9CgzU7CQbkeNWmj3oO/0TJGP/zxp52JiDBpzRuTmBlrcJYV/gBA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN A
+SECTION ANSWER
+ns.sub.example.com. IN A 1.2.4.6
+ns.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. fMRshSYDWgvGAwc24Lzg6746jnoG5shlK+o9CgzU7CQbkeNWmj3oO/0TJGP/zxp52JiDBpzRuTmBlrcJYV/gBA== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.sub.example.com. IN AAAA
+SECTION AUTHORITY
+ns.sub.example.com. IN NSEC nt.sub.example.com. NSEC RRSIG A
+ns.sub.example.com.	3600	IN	RRSIG	NSEC 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. qwUibvlPTFnxgiyCNtEJCYqJIgA8WFDqypmsO6TSYje2Rqhq4AaWEVxQwU4bdjmipCGVqtlP8mMyMQHaYNMGKA== ;{id = 30899}
+sub.example.com. IN SOA sub.example.com. hostmaster.sub.example.com. 1 2 3 4 5
+sub.example.com.	3600	IN	RRSIG	SOA 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. sZQEMd0ys2mxPRajzBuvy4XdLNVvXMmJSnmfTHUL41d9IxbGN/ifpiIWs2MXOFPnbab05aYadrzZpT/cpDTxmQ== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A 10.20.30.40
+www.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. deNzEy9Hq+6gDZhafC0M7UDuRBm51AA1/FAIauAitNuQlYUzOvWLVHFQ95bn308rCVPqrb4rFDV+gNzxkzm1rw== ;{id = 30899}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+ENTRY_END
+
+; no more outgoing traffic possible.
+STEP 110 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+ftp.sub.example.com. IN A
+ENTRY_END
+
+STEP 120 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+ftp.sub.example.com. IN A
+SECTION ANSWER
+ENTRY_END
+
+; wait for timeout seconds.
+STEP 130 TIME_PASSES ELAPSE 901
+
+STEP 210 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 220 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A 10.20.30.40
+www.sub.example.com.	3600	IN	RRSIG	A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. deNzEy9Hq+6gDZhafC0M7UDuRBm51AA1/FAIauAitNuQlYUzOvWLVHFQ95bn308rCVPqrb4rFDV+gNzxkzm1rw== ;{id = 30899}
+ENTRY_END
+
+
+SCENARIO_END

testdata/black_prime_entry.rpl

@@ -0,0 +1,311 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with blacklist prime gives bad key entry
+; the data response needs a blacklist action as well, since it also
+; comes from an 'expired signatures' name server.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.blabla.com. IN A
+SECTION ANSWER
+ns.blabla.com. IN A 1.2.3.5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.blabla.com. IN AAAA
+SECTION AUTHORITY
+com. IN SOA com. com. 2009100100 28800 7200 604800 3600
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+;example.com.	IN NS	ns.blabla.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+; no ns.blabla.com, try that later
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20030926134150 20030829134150 2854 example.com. AKJ3xUBdSrCiOFkYajsy93d+h06rewpbmBHItTkL8R/26rw57b1gCIg= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AHNj99mBmP4np19V01nSq990ZIFlIiLWoeHijm/HcOG/o8+DuIp4fL8= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN A
+SECTION ANSWER
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AHNj99mBmP4np19V01nSq990ZIFlIiLWoeHijm/HcOG/o8+DuIp4fL8= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION ADDITIONAL
+ns.example.com. IN NSEC oof.example.com. NSEC RRSIG A
+ns.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20030926134150 20030829134150 2854 example.com. ACFVLLBtuSX/1z3461tbOwDz9zTHe5S9DbVtwnSO1f2x06fYbMpzSDE= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.	3600	IN	RRSIG	DNSKEY 3 2 3600 20030926134150 20030829134150 2854 example.com. AG21xE8CFQzTq6XtHErg28b9EAmqPsoYCUcFPEAoAjFybM6AY4/bMOo= ;{id = 2854}
+SECTION AUTHORITY
+;example.com.    IN NS   ns.example.com.
+;example.com.    IN NS   ns.blabla.com.
+;example.com.	3600	IN	RRSIG	NS 3 2 3600 20030926134150 20030829134150 2854 example.com. ACiWu7zjBHqgEX3iUoOF7rfpOmIAHj1npKQ+XDIaNlmdkfJxoCwFl04= ;{id = 2854}
+SECTION ADDITIONAL
+;ns.example.com.		IN 	A	1.2.3.4
+;ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. ACmAsKTf7hqDaYK8CQ7FL1cGYPW+blTCnzZGkExFtEUAGrHeze87o+A= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AGj9kE8oW3OhOLhkmJ3HBaNIOpvGf3S8zSd5gWmhpxAMc5hh6cxZfpQ= ;{id = 2854}
+SECTION AUTHORITY
+;example.com.    IN NS   ns.example.com.
+;example.com.    IN NS   ns.blabla.com.
+;example.com.	3600	IN	RRSIG	NS 3 2 3600 20030926134150 20030829134150 2854 example.com. ACHETweBNPgbmRoNRdKvxuw4X9qNUUTEpSuwV+HhuiBE83gbB98asAc= ;{id = 2854}
+SECTION ADDITIONAL
+;ns.example.com.		IN 	A	1.2.3.4
+;ns.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AGvu9A/nGsbatxJCmnObioIhKg2Tm0Apr0eo+DO1kIDrAHco/bt/EdY= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+; ns.blabla.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.5
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20070926134150 20070829134150 2854 example.com. AAJHNhPYVG6+550zQga9ZgV8McQZHLboOWjfbdiq2ZC+gUcQeQDDlFs= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN A
+SECTION ANSWER
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION ADDITIONAL
+ns.example.com. IN NSEC oof.example.com. NSEC RRSIG A
+ns.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. ABhDNtJramb2a4R1SK5gb/CTYJybQts6mZ++z3kLiwsrUSZInA4ikeQ= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20070926134150 20070829134150 2854 example.com. AAJHNhPYVG6+550zQga9ZgV8McQZHLboOWjfbdiq2ZC+gUcQeQDDlFs= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+SECTION AUTHORITY
+example.com.    IN NS   ns.example.com.
+example.com.    IN NS   ns.blabla.com.
+example.com.	3600	IN	RRSIG	NS 3 2 3600 20070926134150 20070829134150 2854 example.com. AAJHNhPYVG6+550zQga9ZgV8McQZHLboOWjfbdiq2ZC+gUcQeQDDlFs= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+; later on, making sure DNSKEY primes give testbound failure.
+RANGE_BEGIN 100 200
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ftp.example.com. IN A
+SECTION ANSWER
+ftp.example.com. IN A 10.20.33.33
+; very bad signature
+ftp.example.com.	3600	IN	RRSIG	A 3 3 3600 20030926134150 20030829134150 2854 example.com. AHNj99mBmP4np19V01nSq990ZIFlIiLWoeHijm/HcOG/o8+DuIp4fL8= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 100 TIME_PASSES ELAPSE 10
+
+; second query should not result in going to the network.
+STEP 110 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+ftp.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 120 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+ftp.example.com. IN A
+ENTRY_END
+
+
+SCENARIO_END

testdata/iter_class_any.rpl

@@ -0,0 +1,150 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test lookup of class any response
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. ANY A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.example.com. ANY A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+www.example.com.        3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFC99iE9K5y2WNgI0gFvBWaTi9wm6AhUAoUqOpDtG5Zct+Qr9F3mSdnbc6V4= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ENTRY_END
+
+SCENARIO_END

testdata/iter_mod.rpl

@@ -0,0 +1,121 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	module-config: "iterator"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test basic iterative resolve without validator module
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+SCENARIO_END

testdata/iter_pcdiff.rpl

@@ -0,0 +1,213 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test resolution with recursion and parent child differ.
+; and the child gives bad information.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN NS
+SECTION AUTHORITY
+net.	IN NS	e.gtld-servers.net.
+SECTION ADDITIONAL
+e.gtld-servers.net.	IN 	A	192.12.94.30
+ENTRY_END
+
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.net.
+ENTRY_END
+RANGE_END
+
+; e.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.12.94.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN NS
+SECTION ANSWER
+net.	IN NS	e.gtld-servers.net.
+SECTION ADDITIONAL
+e.gtld-servers.net.	IN 	A	192.12.94.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.net. IN NS
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.44
+ENTRY_END
+
+RANGE_END
+
+; ns.example.net.
+; The parent-IP version
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.44
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY AA QR NOERROR
+SECTION QUESTION
+example.net. IN NS
+SECTION ANSWER
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net.		IN 	A	1.2.3.55
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY AA QR NOERROR
+SECTION QUESTION
+ns.example.net. IN A
+SECTION ANSWER
+ns.example.net. IN A	1.2.3.55
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY AA QR NOERROR
+SECTION QUESTION
+ns.example.net. IN AAAA
+SECTION AUTHORITY
+example.net.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net. IN A	1.2.3.55
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY AA QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.net.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY AA QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.net.
+SECTION ADDITIONAL
+ns.example.net 	IN A 	1.2.3.55
+ENTRY_END
+RANGE_END
+
+; ns.example.net
+; The child IP version.   Does not respond to anything (servfail instead
+; of timeouts since this is easier to encode in .rpl file format).
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.55
+ENTRY_BEGIN
+MATCH opcode 
+ADJUST copy_id copy_query
+REPLY QR SERVFAIL
+SECTION QUESTION
+example.net. IN NS
+SECTION ANSWER
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 20 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.net.
+; scrubbed off
+;SECTION ADDITIONAL
+;ns.example.net 	IN A 	1.2.3.44
+ENTRY_END
+
+SCENARIO_END

testdata/iter_pcdirect.rpl

@@ -0,0 +1,246 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test resolver with parent-child diff for direct impact
+; the trouble is resolving this right away.
+; otherwise it gets picked out of the cache.
+; i.e. on a failed lookup, pickup lame stuff from the cache.
+; the nameserver lookup may have failed but produced some (lame) addresses.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+org. IN A
+SECTION AUTHORITY
+org. IN NS a0.org.afilias-nst.org.
+SECTION ADDITIONAL
+a0.org.afilias-nst.org. IN A 199.19.56.1
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.org.
+ENTRY_END
+RANGE_END
+
+; a0.org.afilias-nst.org.
+RANGE_BEGIN 0 100
+	ADDRESS 199.19.56.1
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+org. IN NS
+SECTION ANSWER
+org. IN NS a0.org.afilias-nst.org.
+SECTION ADDITIONAL
+a0.org.afilias-nst.org. IN A 199.19.56.1
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.org. IN A
+SECTION AUTHORITY
+example.org.	IN NS	ns.example.org.
+SECTION ADDITIONAL
+; parent-side working address.
+ns.example.org. IN A 1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.org.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.org.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.org. IN NS
+SECTION ANSWER
+example.org.	IN NS	ns.example.org.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.org.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA RA NOERROR
+SECTION QUESTION
+mail.example.com. IN A
+SECTION ANSWER
+mail.example.com. IN A	10.20.30.50
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.org.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RA NOERROR
+SECTION QUESTION
+ns.example.org. IN A
+SECTION ANSWER
+; correct answer: ns.example.org. IN A	1.2.3.4
+SECTION AUTHORITY
+ns.example.org. IN NS 1.2.3.4.example.org.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR RA NOERROR
+SECTION QUESTION
+ns.example.org. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+ns.example.org. IN NS 1.2.3.4.example.org.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA RA NXDOMAIN
+SECTION QUESTION
+1.2.3.4.example.org. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+example.org. IN SOA ns.example.org. root.example.org. 2009111400 14400 3600 1209600 86400
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA RA NXDOMAIN
+SECTION QUESTION
+1.2.3.4.example.org. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+example.org. IN SOA ns.example.org. root.example.org. 2009111400 14400 3600 1209600 86400
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.org.
+ENTRY_END
+
+; perhaps some messages are still pending - allow those to resolve.
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+mail.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+mail.example.com. IN A
+SECTION ANSWER
+mail.example.com. IN A	10.20.30.50
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.org.
+ENTRY_END
+
+SCENARIO_END

testdata/iter_pcttl.rpl

@@ -0,0 +1,245 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	do-ip6: no
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test cache ttls where parent child differ in ttl
+; and the lameness for parent suddenly becomes the only information point.
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN NS
+SECTION AUTHORITY
+net.	IN NS	e.gtld-servers.net.
+SECTION ADDITIONAL
+e.gtld-servers.net.	IN 	A	192.12.94.30
+ENTRY_END
+
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com.	IN NS	ns.foo.com.
+SECTION ADDITIONAL
+;ns.foo.com.	200 	IN 	A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR NOERROR
+SECTION QUESTION
+foo.com. IN NS
+SECTION AUTHORITY
+foo.com.	200 IN NS	ns.foo.com.
+SECTION ADDITIONAL
+ns.foo.com.	200 	IN 	A	1.2.3.44
+ENTRY_END
+
+RANGE_END
+
+; e.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.12.94.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+net. IN NS
+SECTION ANSWER
+net.	IN NS	e.gtld-servers.net.
+SECTION ADDITIONAL
+e.gtld-servers.net.	IN 	A	192.12.94.30
+ENTRY_END
+
+RANGE_END
+
+; ns.foo.com.
+; The parent-IP version
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.44
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY AA QR NOERROR
+SECTION QUESTION
+foo.com. IN NS
+SECTION ANSWER
+foo.com.	200 IN NS	ns.foo.com.
+SECTION ADDITIONAL
+ns.foo.com.	100 	IN 	A	1.2.3.44
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY AA QR NOERROR
+SECTION QUESTION
+ns.foo.com. IN A
+SECTION ANSWER
+ns.foo.com. 100 IN A	1.2.3.44
+SECTION AUTHORITY
+foo.com.	200 IN NS	ns.foo.com.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY AA QR NOERROR
+SECTION QUESTION
+ns.foo.com. IN AAAA
+SECTION AUTHORITY
+foo.com.    100 IN SOA . . 1 2 3 4 5
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY AA QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	200 IN NS	ns.foo.com.
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY AA QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 100 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	200 IN NS	ns.foo.com.
+SECTION ADDITIONAL
+ns.foo.com 	100 IN A 	1.2.3.44
+ENTRY_END
+RANGE_END
+
+; NOT USED.  The parent side equals child side but not in the cache.
+; and they have different TTLs only.
+; ns.foo.com
+; The child IP version.   Does not respond to anything (servfail instead
+; of timeouts since this is easier to encode in .rpl file format).
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.55
+ENTRY_BEGIN
+MATCH opcode 
+ADJUST copy_id copy_query
+REPLY QR SERVFAIL
+SECTION QUESTION
+foo.com. IN NS
+SECTION ANSWER
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 20 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 100 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	100 IN NS	ns.foo.com.
+; scrubbed off
+;SECTION ADDITIONAL
+;ns.foo.com 	IN A 	1.2.3.44
+ENTRY_END
+
+; Now we wait 101 seconds, and the child data is gone,
+; but the parent-side was cached for 200 and it still there.
+
+STEP 30 TIME_PASSES ELAPSE 101
+
+STEP 40 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 50 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 100 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	100 IN NS	ns.foo.com.
+; scrubbed off
+;SECTION ADDITIONAL
+;ns.foo.com 	IN A 	1.2.3.44
+ENTRY_END
+
+SCENARIO_END

testdata/iter_prefetch.rpl

@@ -0,0 +1,225 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	prefetch: "yes"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test resolver prefetch of almost expired data
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 40
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 50 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+
+; after 1800 secs still the cached answer
+STEP 20 TIME_PASSES ELAPSE 1800
+
+STEP 30 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 40 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 1800 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	1800 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	1800 	IN 	A	1.2.3.4
+ENTRY_END
+
+; after 1440 we are 360 seconds before the expiry
+; (the authority changes behind the scenes to detect new lookup)
+STEP 50 TIME_PASSES ELAPSE 1440
+
+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 70 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 360 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	360 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	360 	IN 	A	1.2.3.4
+ENTRY_END
+STEP 80 TRAFFIC
+; let traffic flow for prefetch to happen
+
+; above a cache reply with 10% of the original TTL
+; but the actual cache is changed, try to get that
+STEP 120 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+; recursion happens here.
+STEP 130 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all ttl
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com. 3600 IN A	10.20.30.40
+SECTION AUTHORITY
+example.com.	3600 IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.	3600 	IN 	A	1.2.3.4
+ENTRY_END
+
+SCENARIO_END

testdata/iter_scrub_ns.rpl

@@ -0,0 +1,103 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+
+stub-zone:
+	name: "example.com"
+	stub-addr: 1.2.3.4
+CONFIG_END
+
+SCENARIO_BEGIN Test scrubber to scrub NS record for lamelike reply from stub
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+; must be scrubbed
+www.burritolovers.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example1234.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+mail.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+; LAME
+com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+mail.example.com. IN A
+ENTRY_END
+
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+mail.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END

testdata/iter_scrub_ns_fwd.rpl

@@ -0,0 +1,103 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+
+forward-zone:
+	name: "example.com"
+	forward-addr: 1.2.3.4
+CONFIG_END
+
+SCENARIO_BEGIN Test scrubber to scrub NS record for lamelike reply from fwd
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY RD RA QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+; must be scrubbed
+www.burritolovers.com. IN A	10.20.30.40
+SECTION AUTHORITY
+example1234.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY RD RA QR NOERROR
+SECTION QUESTION
+mail.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+; LAME
+com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD
+SECTION QUESTION
+mail.example.com. IN A
+ENTRY_END
+
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+mail.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END

testdata/val_keyprefetch.rpl

@@ -0,0 +1,212 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+	prefetch-key: yes
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with key prefetch
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response for delegation to sub.example.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+; response for delegation to sub.example.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+sub.example.com.        3600    IN      RRSIG   DS 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFCW3ix0GD4BSvNLWIbROCJt5DAW9AhRt/kg9kBKJ20UBUdumrBUHqnskdA== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+RANGE_END
+
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response to DNSKEY priming query
+; sub.example.com.        3600    IN      DS      30899 RSASHA1 1 f7ed618f24d5e5202927e1d27bc2e84a141cb4b3
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DNSKEY
+SECTION ANSWER
+sub.example.com.        3600    IN      DNSKEY  256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+sub.example.com.        3600    IN      RRSIG   DNSKEY 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. uNGp99iznjD7oOX02XnQbDnbg75UwBHRvZSKYUorTKvPUnCWMHKdRsQ+mf+Fx3GZ+Fz9BVjoCmQqpnfgXLEYqw== ;{id = 30899}
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com.        3600    IN      RRSIG   NS 5 3 3600 20070926134150 20070829134150 30899 sub.example.com. wcpHeBILHfo8C9uxMhcW03gcURZeUffiKdSTb50ZjzTHgMNhRyMfpcvSpXEd9548A9UTmWKeLZChfr5Z/glONw== ;{id = 30899}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ns.sub.example.com.     3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. UF7shD/gt1FOp2UHgLTNbPzVykklSXFMEtJ1xD+Hholwf/PIzd7zoaIttIYibNa4fUXCqMg22H9P7MRhfmFe6g== ;{id = 30899}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. 	3600	IN	A	11.11.11.11
+www.sub.example.com.    3600    IN      RRSIG   A 5 4 3600 20070926134150 20070829134150 30899 sub.example.com. 0DqqRfRtm7VSEQ4mmBbzrKRqQAay3JAE8DPDGmjtokrrjN9F1G/HxozDV7bjdIh2EChlQea8FPwf/GepJMUVxg== ;{id = 30899}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+SCENARIO_END

testdata/val_negcache_ds.rpl

@@ -0,0 +1,213 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with negative cache DS response
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response for delegation to sub.example.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com. IN	NSEC www.example.com. NS RRSIG NSEC
+sub.example.com.        3600    IN      RRSIG   NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFDCaiDM6G+glwNW276HWdH+McmjgAhRSwF5OfimNQCqkWgnYotLOwUghKQ== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+; query for missing DS record.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.	IN	SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
+example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFC5uwIHSehZtetK2CMNXttSFUB0XAhROFDAgy/FaxR8zFXJzyPdpQG93Sw== ;{id = 2854}
+sub.example.com. IN	NSEC www.example.com. NS RRSIG NSEC
+sub.example.com.        3600    IN      RRSIG   NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFDCaiDM6G+glwNW276HWdH+McmjgAhRSwF5OfimNQCqkWgnYotLOwUghKQ== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+
+RANGE_END
+
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN	NS ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	11.11.11.11
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. 	3600	IN	A	11.11.11.11
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; the downstream validator wants the DS record.
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+sub.example.com. IN DS
+ENTRY_END
+
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.	IN	SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
+example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFC5uwIHSehZtetK2CMNXttSFUB0XAhROFDAgy/FaxR8zFXJzyPdpQG93Sw== ;{id = 2854}
+sub.example.com. IN	NSEC www.example.com. NS RRSIG NSEC
+sub.example.com.        3600    IN      RRSIG   NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFDCaiDM6G+glwNW276HWdH+McmjgAhRSwF5OfimNQCqkWgnYotLOwUghKQ== ;{id = 2854}
+ENTRY_END
+
+SCENARIO_END

testdata/val_negcache_dssoa.rpl

@@ -0,0 +1,245 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with negative cache DS response with cached SOA
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com. 3600    IN      RRSIG   DNSKEY DSA 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFBQRtlR4BEv9ohi+PGFjp+AHsJuHAhRCvz0shggvnvI88DFnBDCczHUcVA== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response for delegation to sub.example.com.
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN	NS ns.sub.example.com.
+sub.example.com. IN	NSEC www.example.com. NS RRSIG NSEC
+sub.example.com.        3600    IN      RRSIG   NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFDCaiDM6G+glwNW276HWdH+McmjgAhRSwF5OfimNQCqkWgnYotLOwUghKQ== ;{id = 2854}
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+; query for missing DS record.
+; commented out, this query should not happen as negative cache works.
+;ENTRY_BEGIN
+;MATCH opcode qtype qname
+;ADJUST copy_id
+;REPLY QR NOERROR
+;SECTION QUESTION
+;sub.example.com. IN DS
+;SECTION ANSWER
+;SECTION AUTHORITY
+;example.com.	IN	SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
+;example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFC5uwIHSehZtetK2CMNXttSFUB0XAhROFDAgy/FaxR8zFXJzyPdpQG93Sw== ;{id = 2854}
+;sub.example.com. IN	NSEC www.example.com. NS RRSIG NSEC
+;sub.example.com.        3600    IN      RRSIG   NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFDCaiDM6G+glwNW276HWdH+McmjgAhRSwF5OfimNQCqkWgnYotLOwUghKQ== ;{id = 2854}
+;SECTION ADDITIONAL
+;ns.sub.example.com. IN A 1.2.3.6
+;ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+example.com.	IN	SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
+example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFC5uwIHSehZtetK2CMNXttSFUB0XAhROFDAgy/FaxR8zFXJzyPdpQG93Sw== ;{id = 2854}
+ENTRY_END
+
+RANGE_END
+
+; ns.sub.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.6
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+sub.example.com. IN NS
+SECTION ANSWER
+sub.example.com. IN	NS ns.sub.example.com.
+SECTION ADDITIONAL
+ns.sub.example.com. IN A 1.2.3.6
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. IN A	11.11.11.11
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.sub.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+www.sub.example.com. IN A
+SECTION ANSWER
+www.sub.example.com. 	3600	IN	A	11.11.11.11
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; put the SOA into the cache
+STEP 14 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+example.com. IN SOA
+ENTRY_END
+
+STEP 15 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+example.com. IN SOA
+SECTION ANSWER
+example.com.	IN	SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
+example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFC5uwIHSehZtetK2CMNXttSFUB0XAhROFDAgy/FaxR8zFXJzyPdpQG93Sw== ;{id = 2854}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+; the downstream validator wants the DS record.
+STEP 20 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+sub.example.com. IN DS
+ENTRY_END
+
+STEP 30 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+sub.example.com. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+sub.example.com. IN	NSEC www.example.com. NS RRSIG NSEC
+sub.example.com.        3600    IN      RRSIG   NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. MCwCFDCaiDM6G+glwNW276HWdH+McmjgAhRSwF5OfimNQCqkWgnYotLOwUghKQ== ;{id = 2854}
+example.com.	IN	SOA ns.example.com. h.example.com. 2007090504 1800 1800 2419200 7200
+example.com.    3600    IN      RRSIG   SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. MCwCFC5uwIHSehZtetK2CMNXttSFUB0XAhROFDAgy/FaxR8zFXJzyPdpQG93Sw== ;{id = 2854}
+ENTRY_END
+
+SCENARIO_END

util/alloc.c

@@ -472,3 +472,168 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 }
 
 #endif /* UNBOUND_ALLOC_STATS */
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef free
+#undef realloc
+/** length of prefix and suffix */
+static size_t lite_pad = 16;
+/** prefix value to check */
+static char* lite_pre = "checkfront123456";
+/** suffix value to check */
+static char* lite_post= "checkafter123456";
+
+void *unbound_stat_malloc_lite(size_t size, const char* file, int line,
+        const char* func)
+{
+	/*  [prefix .. len .. actual data .. suffix] */
+	void* res = malloc(size+lite_pad*2+sizeof(size_t));
+	if(!res) return NULL;
+	memmove(res, lite_pre, lite_pad);
+	memmove(res+lite_pad, &size, sizeof(size_t));
+	memset(res+lite_pad+sizeof(size_t), 0x1a, size); /* init the memory */
+	memmove(res+lite_pad+size+sizeof(size_t), lite_post, lite_pad);
+	return res+lite_pad+sizeof(size_t);
+}
+
+void *unbound_stat_calloc_lite(size_t nmemb, size_t size, const char* file,
+        int line, const char* func)
+{
+	size_t req = nmemb * size;
+	void* res = malloc(req+lite_pad*2+sizeof(size_t));
+	if(!res) return NULL;
+	memmove(res, lite_pre, lite_pad);
+	memmove(res+lite_pad, &req, sizeof(size_t));
+	memset(res+lite_pad+sizeof(size_t), 0, req);
+	memmove(res+lite_pad+req+sizeof(size_t), lite_post, lite_pad);
+	return res+lite_pad+sizeof(size_t);
+}
+
+void unbound_stat_free_lite(void *ptr, const char* file, int line,
+        const char* func)
+{
+	void* real;
+	size_t orig = 0;
+	if(!ptr) return;
+	real = ptr-lite_pad-sizeof(size_t);
+	if(memcmp(real, lite_pre, lite_pad) != 0) {
+		log_err("free(): prefix failed %s:%d %s", file, line, func);
+		log_hex("prefix here", real, lite_pad);
+		log_hex("  should be", lite_pre, lite_pad);
+		fatal_exit("alloc assertion failed");
+	}
+	memmove(&orig, real+lite_pad, sizeof(size_t));
+	if(memcmp(real+lite_pad+orig+sizeof(size_t), lite_post, lite_pad)!=0){
+		log_err("free(): suffix failed %s:%d %s", file, line, func);
+		log_err("alloc size is %d", (int)orig);
+		log_hex("suffix here", real+lite_pad+orig+sizeof(size_t), 
+			lite_pad);
+		log_hex("  should be", lite_post, lite_pad);
+		fatal_exit("alloc assertion failed");
+	}
+	memset(real, 0xdd, orig+lite_pad*2+sizeof(size_t)); /* mark it */
+	free(real);
+}
+
+void *unbound_stat_realloc_lite(void *ptr, size_t size, const char* file,
+        int line, const char* func)
+{
+	/* always free and realloc (no growing) */
+	void* real, *newa;
+	size_t orig = 0;
+	if(!ptr) {
+		/* like malloc() */
+		return unbound_stat_malloc_lite(size, file, line, func);
+	}
+	if(!size) {
+		/* like free() */
+		unbound_stat_free_lite(ptr, file, line, func);
+		return NULL;
+	}
+	/* change allocation size and copy */
+	real = ptr-lite_pad-sizeof(size_t);
+	if(memcmp(real, lite_pre, lite_pad) != 0) {
+		log_err("realloc(): prefix failed %s:%d %s", file, line, func);
+		log_hex("prefix here", real, lite_pad);
+		log_hex("  should be", lite_pre, lite_pad);
+		fatal_exit("alloc assertion failed");
+	}
+	memmove(&orig, real+lite_pad, sizeof(size_t));
+	if(memcmp(real+lite_pad+orig+sizeof(size_t), lite_post, lite_pad)!=0){
+		log_err("realloc(): suffix failed %s:%d %s", file, line, func);
+		log_err("alloc size is %d", (int)orig);
+		log_hex("suffix here", real+lite_pad+orig+sizeof(size_t), 
+			lite_pad);
+		log_hex("  should be", lite_post, lite_pad);
+		fatal_exit("alloc assertion failed");
+	}
+	/* new alloc and copy over */
+	newa = unbound_stat_malloc_lite(size, file, line, func);
+	if(!newa)
+		return NULL;
+	if(orig < size)
+		memmove(newa, ptr, orig);
+	else	memmove(newa, ptr, size);
+	memset(real, 0xdd, orig+lite_pad*2+sizeof(size_t)); /* mark it */
+	free(real);
+	return newa;
+}
+
+char* unbound_strdup_lite(const char* s, const char* file, int line, 
+        const char* func)
+{
+	/* this routine is made to make sure strdup() uses the malloc_lite */
+	size_t l = strlen(s)+1;
+	char* n = (char*)unbound_stat_malloc_lite(l, file, line, func);
+	if(!n) return NULL;
+	memmove(n, s, l);
+	return n;
+}
+
+char* unbound_lite_wrapstr(char* s)
+{
+	char* n = unbound_strdup_lite(s, __FILE__, __LINE__, __func__);
+	free(s);
+	return n;
+}
+
+#undef ldns_pkt2wire
+ldns_status unbound_lite_pkt2wire(uint8_t **dest, const ldns_pkt *p, 
+	size_t *size)
+{
+	uint8_t* md = NULL;
+	size_t ms = 0;
+	ldns_status s = ldns_pkt2wire(&md, p, &ms);
+	if(md) {
+		*dest = unbound_stat_malloc_lite(ms, __FILE__, __LINE__, 
+			__func__);
+		*size = ms;
+		if(!*dest) { free(md); return LDNS_STATUS_MEM_ERR; }
+		memcpy(*dest, md, ms);
+		free(md);
+	} else {
+		*dest = NULL;
+		*size = 0;
+	}
+	return s;
+}
+
+#undef i2d_DSA_SIG
+int unbound_lite_i2d_DSA_SIG(DSA_SIG* dsasig, unsigned char** sig)
+{
+	unsigned char* n = NULL;
+	int r= i2d_DSA_SIG(dsasig, &n);
+	if(n) {
+		*sig = unbound_stat_malloc_lite((size_t)r, __FILE__, __LINE__, 
+			__func__);
+		if(!*sig) return -1;
+		memcpy(*sig, n, (size_t)r);
+		free(n);
+		return r;
+	}
+	*sig = NULL;
+	return r;
+}
+
+#endif /* UNBOUND_ALLOC_LITE */

util/alloc.h

@@ -176,4 +176,37 @@ void alloc_reg_release(struct alloc_cache* alloc, struct regional* r);
 void alloc_set_id_cleanup(struct alloc_cache* alloc, void (*cleanup)(void*),
 	void* arg);
 
+#ifdef UNBOUND_ALLOC_LITE
+#  define malloc(s) unbound_stat_malloc_lite(s, __FILE__, __LINE__, __func__)
+#  define calloc(n,s) unbound_stat_calloc_lite(n, s, __FILE__, __LINE__, __func__)
+#  define free(p) unbound_stat_free_lite(p, __FILE__, __LINE__, __func__)
+#  define realloc(p,s) unbound_stat_realloc_lite(p, s, __FILE__, __LINE__, __func__)
+void *unbound_stat_malloc_lite(size_t size, const char* file, int line,
+	const char* func);
+void *unbound_stat_calloc_lite(size_t nmemb, size_t size, const char* file,
+	int line, const char* func);
+void unbound_stat_free_lite(void *ptr, const char* file, int line,
+	const char* func);
+void *unbound_stat_realloc_lite(void *ptr, size_t size, const char* file,
+	int line, const char* func);
+#  ifdef strdup
+#    undef strdup
+#  endif
+#  define strdup(s) unbound_strdup_lite(s, __FILE__, __LINE__, __func__)
+char* unbound_strdup_lite(const char* s, const char* file, int line, 
+	const char* func);
+char* unbound_lite_wrapstr(char* s);
+#  define ldns_rr2str(rr) unbound_lite_wrapstr(ldns_rr2str(rr))
+#  define ldns_rdf2str(rdf) unbound_lite_wrapstr(ldns_rdf2str(rdf))
+#  define ldns_rr_type2str(t) unbound_lite_wrapstr(ldns_rr_type2str(t))
+#  define ldns_rr_class2str(c) unbound_lite_wrapstr(ldns_rr_class2str(c))
+#  define ldns_rr_list2str(r) unbound_lite_wrapstr(ldns_rr_list2str(r))
+#  define ldns_pkt2str(p) unbound_lite_wrapstr(ldns_pkt2str(p))
+#  define ldns_pkt_rcode2str(r) unbound_lite_wrapstr(ldns_pkt_rcode2str(r))
+#  define ldns_pkt2wire(a, r, s) unbound_lite_pkt2wire(a, r, s)
+ldns_status unbound_lite_pkt2wire(uint8_t **dest, const ldns_pkt *p, size_t *size);
+#  define i2d_DSA_SIG(d, s) unbound_lite_i2d_DSA_SIG(d, s)
+int unbound_lite_i2d_DSA_SIG(DSA_SIG* dsasig, unsigned char** sig);
+#endif /* UNBOUND_ALLOC_LITE */
+
 #endif /* UTIL_ALLOC_H */

util/config_file.c

@@ -49,6 +49,7 @@
 #include "util/data/msgparse.h"
 #include "util/module.h"
 #include "util/regional.h"
+#include "util/fptr_wlist.h"
 #include "util/data/dname.h"
 /** global config during parsing */
 struct config_parser_state* cfg_parser = 0;
@@ -108,6 +109,8 @@ config_create()
 	cfg->bogus_ttl = 60;
 	cfg->min_ttl = 0;
 	cfg->max_ttl = 3600 * 24;
+	cfg->prefetch = 0;
+	cfg->prefetch_key = 0;
 	cfg->infra_cache_slabs = 4;
 	cfg->infra_cache_numhosts = 10000;
 	cfg->infra_cache_lame_size = 10240; /* easily 40 or more entries */
@@ -232,14 +235,42 @@ struct config_file* config_create_forlib()
 /** check that the value passed is yes or no */
 #define IS_YES_OR_NO \
 	if(strcmp(val, "yes") != 0 && strcmp(val, "no") != 0) return 0
+/** put integer_or_zero into variable */
+#define S_NUMBER_OR_ZERO(str, var) if(strcmp(opt, str) == 0) \
+	{ IS_NUMBER_OR_ZERO; cfg->var = atoi(val); }
+/** put integer_nonzero into variable */
+#define S_NUMBER_NONZERO(str, var) if(strcmp(opt, str) == 0) \
+	{ IS_NONZERO_NUMBER; cfg->var = atoi(val); }
+/** put integer_or_zero into unsigned */
+#define S_UNSIGNED_OR_ZERO(str, var) if(strcmp(opt, str) == 0) \
+	{ IS_NUMBER_OR_ZERO; cfg->var = (unsigned)atoi(val); }
+/** put integer_or_zero into size_t */
+#define S_SIZET_OR_ZERO(str, var) if(strcmp(opt, str) == 0) \
+	{ IS_NUMBER_OR_ZERO; cfg->var = (size_t)atoi(val); }
+/** put integer_nonzero into size_t */
+#define S_SIZET_NONZERO(str, var) if(strcmp(opt, str) == 0) \
+	{ IS_NONZERO_NUMBER; cfg->var = (size_t)atoi(val); }
+/** put yesno into variable */
+#define S_YNO(str, var) if(strcmp(opt, str) == 0) \
+	{ IS_YES_OR_NO; cfg->var = (strcmp(val, "yes") == 0); }
+/** put memsize into variable */
+#define S_MEMSIZE(str, var) if(strcmp(opt, str)==0) \
+	{ return cfg_parse_memsize(val, &cfg->var); }
+/** put pow2 number into variable */
+#define S_POW2(str, var) if(strcmp(opt, str)==0) \
+	{ IS_POW2_NUMBER; cfg->var = (size_t)atoi(val); }
+/** put string into variable */
+#define S_STR(str, var) if(strcmp(opt, str)==0) \
+	{ free(cfg->var); return (cfg->var = strdup(val)) != NULL; }
+/** put string into strlist */
+#define S_STRLIST(str, var) if(strcmp(opt, str)==0) \
+	{ return cfg_strlist_insert(&cfg->var, strdup(val)); }
 
 int config_set_option(struct config_file* cfg, const char* opt,
         const char* val)
 {
-	if(strcmp(opt, "verbosity:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->verbosity = atoi(val);
-	} else if(strcmp(opt, "statistics-interval:") == 0) {
+	S_NUMBER_OR_ZERO("verbosity:", verbosity)
+	else if(strcmp(opt, "statistics-interval:") == 0) {
 		if(strcmp(val, "0") == 0 || strcmp(val, "") == 0)
 			cfg->stat_interval = 0;
 		else if(atoi(val) == 0)
@@ -248,136 +279,14 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	} else if(strcmp(opt, "num_threads:") == 0) {
 		/* not supported, library must have 1 thread in bgworker */
 		return 0;
-	} else if(strcmp(opt, "extended-statistics:") == 0) {
-		IS_YES_OR_NO;
-		cfg->stat_extended = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "do-ip4:") == 0) {
-		IS_YES_OR_NO;
-		cfg->do_ip4 = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "do-ip6:") == 0) {
-		IS_YES_OR_NO;
-		cfg->do_ip6 = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "do-udp:") == 0) {
-		IS_YES_OR_NO;
-		cfg->do_udp = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "do-tcp:") == 0) {
-		IS_YES_OR_NO;
-		cfg->do_tcp = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "outgoing-range:") == 0) {
-		IS_NONZERO_NUMBER;
-		cfg->outgoing_num_ports = atoi(val);
 	} else if(strcmp(opt, "outgoing-port-permit:") == 0) {
 		return cfg_mark_ports(val, 1, 
 			cfg->outgoing_avail_ports, 65536);
 	} else if(strcmp(opt, "outgoing-port-avoid:") == 0) {
 		return cfg_mark_ports(val, 0, 
 			cfg->outgoing_avail_ports, 65536);
-	} else if(strcmp(opt, "outgoing-num-tcp:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->outgoing_num_tcp = (size_t)atoi(val);
-	} else if(strcmp(opt, "incoming-num-tcp:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->incoming_num_tcp = (size_t)atoi(val);
-	} else if(strcmp(opt, "edns-buffer-size:") == 0) {
-		IS_NONZERO_NUMBER;
-		cfg->edns_buffer_size = (size_t)atoi(val);
-	} else if(strcmp(opt, "msg-buffer-size:") == 0) {
-		IS_NONZERO_NUMBER;
-		cfg->msg_buffer_size = (size_t)atoi(val);
-	} else if(strcmp(opt, "msg-cache-size:") == 0) {
-		return cfg_parse_memsize(val, &cfg->msg_cache_size);
-	} else if(strcmp(opt, "msg-cache-slabs:") == 0) {
-		IS_POW2_NUMBER;
-		cfg->msg_cache_slabs = (size_t)atoi(val);
-	} else if(strcmp(opt, "num-queries-per-thread:") == 0) {
-		IS_NONZERO_NUMBER;
-		cfg->num_queries_per_thread = (size_t)atoi(val);
-	} else if(strcmp(opt, "jostle-timeout:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->jostle_time = (size_t)atoi(val);
-	} else if(strcmp(opt, "so-rcvbuf:") == 0) {
-		return cfg_parse_memsize(val, &cfg->socket_rcvbuf);
-	} else if(strcmp(opt, "rrset-cache-size:") == 0) {
-		return cfg_parse_memsize(val, &cfg->rrset_cache_size);
-	} else if(strcmp(opt, "rrset-cache-slabs:") == 0) {
-		IS_POW2_NUMBER;
-		cfg->rrset_cache_slabs = (size_t)atoi(val);
-	} else if(strcmp(opt, "cache-max-ttl:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->max_ttl = atoi(val);
-	} else if(strcmp(opt, "infra-host-ttl:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->host_ttl = atoi(val);
-	} else if(strcmp(opt, "infra-lame-ttl:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->lame_ttl = atoi(val);
-	} else if(strcmp(opt, "infra-cache-slabs:") == 0) {
-		IS_POW2_NUMBER;
-		cfg->infra_cache_slabs = (size_t)atoi(val);
-	} else if(strcmp(opt, "infra-cache-numhosts:") == 0) {
-		IS_NONZERO_NUMBER;
-		cfg->infra_cache_numhosts = (size_t)atoi(val);
-	} else if(strcmp(opt, "infra-cache-lame-size:") == 0) {
-		return cfg_parse_memsize(val, &cfg->infra_cache_lame_size);
-	} else if(strcmp(opt, "logfile:") == 0) {
-		cfg->use_syslog = 0;
-		free(cfg->logfile);
-		return (cfg->logfile = strdup(val)) != NULL;
-	} else if(strcmp(opt, "use-syslog:") == 0) {
-		IS_YES_OR_NO;
-		cfg->use_syslog = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "root-hints:") == 0) {
-		return cfg_strlist_insert(&cfg->root_hints, strdup(val));
-	} else if(strcmp(opt, "target-fetch-policy:") == 0) {
-		free(cfg->target_fetch_policy);
-		return (cfg->target_fetch_policy = strdup(val)) != NULL;
-	} else if(strcmp(opt, "harden-glue:") == 0) {
-		IS_YES_OR_NO;
-		cfg->harden_glue = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "harden-short-bufsize:") == 0) {
-		IS_YES_OR_NO;
-		cfg->harden_short_bufsize = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "harden-large-queries:") == 0) {
-		IS_YES_OR_NO;
-		cfg->harden_large_queries = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "harden-dnssec-stripped:") == 0) {
-		IS_YES_OR_NO;
-		cfg->harden_dnssec_stripped = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "harden-referral-path:") == 0) {
-		IS_YES_OR_NO;
-		cfg->harden_referral_path = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "private-address:") == 0) {
-		return cfg_strlist_insert(&cfg->private_address, strdup(val));
-	} else if(strcmp(opt, "private-domain:") == 0) {
-		return cfg_strlist_insert(&cfg->private_domain, strdup(val));
-	} else if(strcmp(opt, "unwanted-reply-threshold:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->unwanted_threshold = (size_t)atoi(val);
-	} else if(strcmp(opt, "do-not-query-localhost:") == 0) {
-		IS_YES_OR_NO;
-		cfg->donotquery_localhost = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "do-not-query-address:") == 0) {
-		return cfg_strlist_insert(&cfg->donotqueryaddrs, strdup(val));
-	} else if(strcmp(opt, "auto-trust-anchor-file:") == 0) {
-		return cfg_strlist_insert(&cfg->auto_trust_anchor_file_list, 
-			strdup(val));
-	} else if(strcmp(opt, "trust-anchor-file:") == 0) {
-		return cfg_strlist_insert(&cfg->trust_anchor_file_list, 
-			strdup(val));
-	} else if(strcmp(opt, "trust-anchor:") == 0) {
-		return cfg_strlist_insert(&cfg->trust_anchor_list, 
-			strdup(val));
-	} else if(strcmp(opt, "trusted-keys-file:") == 0) {
-		return cfg_strlist_insert(&cfg->trusted_keys_file_list, 
-			strdup(val));
-	} else if(strcmp(opt, "dlv-anchor-file:") == 0) {
-		free(cfg->dlv_anchor_file);
-		return (cfg->dlv_anchor_file = strdup(val)) != NULL;
-	} else if(strcmp(opt, "dlv-anchor:") == 0) {
-		return cfg_strlist_insert(&cfg->dlv_anchor_list, 
-			strdup(val));
-	} else if(strcmp(opt, "domain-insecure:") == 0) {
-		return cfg_strlist_insert(&cfg->domain_insecure, strdup(val));
+	} else if(strcmp(opt, "local-zone:") == 0) {
+		return cfg_parse_local_zone(cfg, val);
 	} else if(strcmp(opt, "val-override-date:") == 0) {
 		if(strcmp(val, "") == 0 || strcmp(val, "0") == 0) {
 			cfg->val_date_override = 0;
@@ -388,77 +297,328 @@ int config_set_option(struct config_file* cfg, const char* opt,
 			if(atoi(val) == 0) return 0;
 			cfg->val_date_override = (uint32_t)atoi(val);
 		}
-	} else if(strcmp(opt, "val-bogus-ttl:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->bogus_ttl = atoi(val);
-	} else if(strcmp(opt, "val-clean-additional:") == 0) {
-		IS_YES_OR_NO;
-		cfg->val_clean_additional = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "val-log-level:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->val_log_level = atoi(val);
-	} else if(strcmp(opt, "val-log-squelch:") == 0) {
-		IS_YES_OR_NO;
-		cfg->val_log_squelch = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "val-permissive-mode:") == 0) {
-		IS_YES_OR_NO;
-		cfg->val_permissive_mode = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "val-nsec3-keysize-iterations:") == 0) {
-		free(cfg->val_nsec3_key_iterations);
-		return (cfg->val_nsec3_key_iterations = strdup(val)) != NULL;
-	} else if(strcmp(opt, "add-holddown:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->add_holddown = (unsigned)atoi(val);
-	} else if(strcmp(opt, "del-holddown:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->del_holddown = (unsigned)atoi(val);
-	} else if(strcmp(opt, "keep-missing:") == 0) {
-		IS_NUMBER_OR_ZERO;
-		cfg->keep_missing = (unsigned)atoi(val);
-	} else if(strcmp(opt, "key-cache-size:") == 0) {
-		return cfg_parse_memsize(val, &cfg->key_cache_size);
-	} else if(strcmp(opt, "key-cache-slabs:") == 0) {
-		IS_POW2_NUMBER;
-		cfg->key_cache_slabs = (size_t)atoi(val);
-	} else if(strcmp(opt, "neg-cache-size:") == 0) {
-		return cfg_parse_memsize(val, &cfg->neg_cache_size);
-	} else if(strcmp(opt, "local-data:") == 0) {
-		return cfg_strlist_insert(&cfg->local_data, strdup(val));
-	} else if(strcmp(opt, "local-zone:") == 0) {
-		return cfg_parse_local_zone(cfg, val);
-	} else if(strcmp(opt, "control-enable:") == 0) {
-		IS_YES_OR_NO;
-		cfg->remote_control_enable = (strcmp(val, "yes") == 0);
-	} else if(strcmp(opt, "control-interface:") == 0) {
-		return cfg_strlist_insert(&cfg->control_ifs, strdup(val));
-	} else if(strcmp(opt, "control-port:") == 0) {
-		IS_NONZERO_NUMBER;
-		cfg->control_port = atoi(val);
-	} else if(strcmp(opt, "server-key-file:") == 0) {
-		free(cfg->server_key_file);
-		return (cfg->server_key_file = strdup(val)) != NULL;
-	} else if(strcmp(opt, "server-cert-file:") == 0) {
-		free(cfg->server_cert_file);
-		return (cfg->server_cert_file = strdup(val)) != NULL;
-	} else if(strcmp(opt, "control-key-file:") == 0) {
-		free(cfg->control_key_file);
-		return (cfg->control_key_file = strdup(val)) != NULL;
-	} else if(strcmp(opt, "control-cert-file:") == 0) {
-		free(cfg->control_cert_file);
-		return (cfg->control_cert_file = strdup(val)) != NULL;
-	} else if(strcmp(opt, "module-config:") == 0) {
-		free(cfg->module_conf);
-		return (cfg->module_conf = strdup(val)) != NULL;
-	} else if(strcmp(opt, "python-script:") == 0) {
-		free(cfg->python_script);
-		return (cfg->python_script = strdup(val)) != NULL;
-	} else {
-		/* unknown or unsupported (from the library interface) */
+	} else if(strcmp(opt, "local-data-ptr:") == 0) { 
+		char* ptr = cfg_ptr_reverse((char*)opt);
+		return cfg_strlist_insert(&cfg->local_data, ptr);
+	} else if(strcmp(opt, "logfile:") == 0) {
+		cfg->use_syslog = 0;
+		free(cfg->logfile);
+		return (cfg->logfile = strdup(val)) != NULL;
+	} 
+	else S_YNO("use-syslog:", use_syslog)
+	else S_YNO("extended-statistics:", stat_extended)
+	else S_YNO("statistics-cumulative:", stat_cumulative)
+	else S_YNO("do-ip4:", do_ip4)
+	else S_YNO("do-ip6:", do_ip6)
+	else S_YNO("do-udp:", do_udp)
+	else S_YNO("do-tcp:", do_tcp)
+	else S_YNO("interface-automatic:", if_automatic)
+	else S_YNO("do-daemonize:", do_daemonize)
+	else S_NUMBER_NONZERO("port:", port)
+	else S_NUMBER_NONZERO("outgoing-range:", outgoing_num_ports)
+	else S_SIZET_OR_ZERO("outgoing-num-tcp:", outgoing_num_tcp)
+	else S_SIZET_OR_ZERO("incoming-num-tcp:", incoming_num_tcp)
+	else S_SIZET_NONZERO("edns-buffer-size:", edns_buffer_size)
+	else S_SIZET_NONZERO("msg-buffer-size:", msg_buffer_size)
+	else S_MEMSIZE("msg-cache-size:", msg_cache_size)
+	else S_POW2("msg-cache-slabs:", msg_cache_slabs)
+	else S_SIZET_NONZERO("num-queries-per-thread:",num_queries_per_thread)
+	else S_SIZET_OR_ZERO("jostle-timeout:", jostle_time)
+	else S_MEMSIZE("so-rcvbuf:", socket_rcvbuf)
+	else S_MEMSIZE("rrset-cache-size:", rrset_cache_size)
+	else S_POW2("rrset-cache-slabs:", rrset_cache_slabs)
+	else S_YNO("prefetch:", prefetch)
+	else S_YNO("prefetch-key:", prefetch_key)
+	else S_NUMBER_OR_ZERO("cache-max-ttl:", max_ttl)
+	else S_NUMBER_OR_ZERO("infra-host-ttl:", host_ttl)
+	else S_NUMBER_OR_ZERO("infra-lame-ttl:", lame_ttl)
+	else S_POW2("infra-cache-slabs:", infra_cache_slabs)
+	else S_SIZET_NONZERO("infra-cache-numhosts:", infra_cache_numhosts)
+	else S_MEMSIZE("infra-cache-lame-size:", infra_cache_lame_size)
+	else S_STR("chroot:", chrootdir)
+	else S_STR("username:", username)
+	else S_STR("directory:", directory)
+	else S_STR("pidfile:", pidfile)
+	else S_YNO("hide-identity:", hide_identity)
+	else S_YNO("hide-version:", hide_version)
+	else S_STR("identity:", identity)
+	else S_STR("version:", version)
+	else S_STRLIST("root-hints:", root_hints)
+	else S_STR("target-fetch-policy:", target_fetch_policy)
+	else S_YNO("harden-glue:", harden_glue)
+	else S_YNO("harden-short-bufsize:", harden_short_bufsize)
+	else S_YNO("harden-large-queries:", harden_large_queries)
+	else S_YNO("harden-dnssec-stripped:", harden_dnssec_stripped)
+	else S_YNO("harden-referral-path:", harden_referral_path)
+	else S_YNO("use-caps-for-id", use_caps_bits_for_id)
+	else S_SIZET_OR_ZERO("unwanted-reply-threshold:", unwanted_threshold)
+	else S_STRLIST("private-address:", private_address)
+	else S_STRLIST("private-domain:", private_domain)
+	else S_YNO("do-not-query-localhost:", donotquery_localhost)
+	else S_STRLIST("do-not-query-address:", donotqueryaddrs)
+	else S_STRLIST("auto-trust-anchor-file:", auto_trust_anchor_file_list)
+	else S_STRLIST("trust-anchor-file:", trust_anchor_file_list)
+	else S_STRLIST("trust-anchor:", trust_anchor_list)
+	else S_STRLIST("trusted-keys-file:", trusted_keys_file_list)
+	else S_STR("dlv-anchor-file:", dlv_anchor_file)
+	else S_STRLIST("dlv-anchor:", dlv_anchor_list)
+	else S_STRLIST("domain-insecure:", domain_insecure)
+	else S_NUMBER_OR_ZERO("val-bogus-ttl:", bogus_ttl)
+	else S_YNO("val-clean-additional:", val_clean_additional)
+	else S_NUMBER_OR_ZERO("val-log-level:", val_log_level)
+	else S_YNO("val-log-squelch:", val_log_squelch)
+	else S_YNO("val-permissive-mode:", val_permissive_mode)
+	else S_STR("val-nsec3-keysize-iterations:", val_nsec3_key_iterations)
+	else S_UNSIGNED_OR_ZERO("add-holddown:", add_holddown)
+	else S_UNSIGNED_OR_ZERO("del-holddown:", del_holddown)
+	else S_UNSIGNED_OR_ZERO("keep-missing:", keep_missing)
+	else S_MEMSIZE("key-cache-size:", key_cache_size)
+	else S_POW2("key-cache-slabs:", key_cache_slabs)
+	else S_MEMSIZE("neg-cache-size:", neg_cache_size)
+	else S_STRLIST("local-data:", local_data)
+	else S_YNO("control-enable:", remote_control_enable)
+	else S_STRLIST("control-interface:", control_ifs)
+	else S_NUMBER_NONZERO("control-port:", control_port)
+	else S_STR("server-key-file:", server_key_file)
+	else S_STR("server-cert-file:", server_cert_file)
+	else S_STR("control-key-file:", control_key_file)
+	else S_STR("control-cert-file:", control_cert_file)
+	else S_STR("module-config:", module_conf)
+	else S_STR("python-script:", python_script)
+	else {
+		/* unknown or unsupported (from the set_option interface):
+		 * interface, outgoing-interface, access-control, 
+		 * stub-zone, name, stub-addr, stub-host, stub-prime
+		 * forward-zone, name, forward-addr, forward-host */
 		return 0;
 	}
 	return 1;
 }
 
+void config_print_func(char* line, void* arg)
+{
+	FILE* f = (FILE*)arg;
+	(void)fprintf(f, "%s\n", line);
+}
+
+/** collate func arg */
+struct config_collate_arg {
+	/** list of result items */
+	struct config_strlist_head list;
+	/** if a malloc error occurred, 0 is OK */
+	int status;
+};
+
+void config_collate_func(char* line, void* arg)
+{
+	struct config_collate_arg* m = (struct config_collate_arg*)arg;
+	if(m->status)
+		return;
+	if(!cfg_strlist_append(&m->list, strdup(line)))
+		m->status = 1;
+}
+
+int config_get_option_list(struct config_file* cfg, const char* opt,
+        struct config_strlist** list)
+{
+	struct config_collate_arg m;
+	memset(&m, 0, sizeof(m));
+	*list = NULL;
+	if(!config_get_option(cfg, opt, config_collate_func, &m))
+		return 1;
+	if(m.status) {
+		config_delstrlist(m.list.first);
+		return 2;
+	}
+	*list = m.list.first;
+	return 0;
+}
+
+int
+config_get_option_collate(struct config_file* cfg, const char* opt, char** str)
+{
+	struct config_strlist* list = NULL;
+	int r;
+	*str = NULL;
+	if((r = config_get_option_list(cfg, opt, &list)) != 0)
+		return r;
+	*str = config_collate_cat(list);
+	config_delstrlist(list);
+	if(!*str) return 2;
+	return 0;
+}
+
+char*
+config_collate_cat(struct config_strlist* list)
+{
+	size_t total = 0, left;
+	struct config_strlist* s;
+	char *r, *w;
+	if(!list) /* no elements */
+		return strdup("");
+	if(list->next == NULL) /* one element , no newline at end. */
+		return strdup(list->str);
+	/* count total length */
+	for(s=list; s; s=s->next)
+		total += strlen(s->str) + 1; /* len + newline */
+	left = total+1; /* one extra for nul at end */
+	r = malloc(left); 
+	if(!r)
+		return NULL;
+	w = r;
+	for(s=list; s; s=s->next) {
+		size_t this = strlen(s->str);
+		if(this+2 > left) { /* sanity check */
+			free(r);
+			return NULL;
+		}
+		snprintf(w, left, "%s\n", s->str);
+		w += this+1;
+		left -= this+1;
+	}
+	return r;
+}
+
+/** compare and print decimal option */
+#define O_DEC(opt, str, var) if(strcmp(opt, str)==0) \
+	{snprintf(buf, len, "%d", (int)cfg->var); \
+	func(buf, arg);}
+/** compare and print unsigned option */
+#define O_UNS(opt, str, var) if(strcmp(opt, str)==0) \
+	{snprintf(buf, len, "%u", (unsigned)cfg->var); \
+	func(buf, arg);}
+/** compare and print yesno option */
+#define O_YNO(opt, str, var) if(strcmp(opt, str)==0) \
+	{func(cfg->var?"yes":"no", arg);}
+/** compare and print string option */
+#define O_STR(opt, str, var) if(strcmp(opt, str)==0) \
+	{func(cfg->var?cfg->var:"", arg);}
+/** compare and print array option */
+#define O_IFC(opt, str, num, arr) if(strcmp(opt, str)==0) \
+	{int i; for(i=0; i<cfg->num; i++) func(cfg->arr[i], arg);}
+/** compare and print memorysize option */
+#define O_MEM(opt, str, var) if(strcmp(opt, str)==0) { \
+	if(cfg->var > 1024*1024*1024) {	\
+	  size_t f=cfg->var/(size_t)1000000, b=cfg->var%(size_t)1000000; \
+	  snprintf(buf, len, "%u%6.6u\n", (unsigned)f, (unsigned)b); \
+	} else snprintf(buf, len, "%u\n", (unsigned)cfg->var); \
+	func(buf, arg);}
+/** compare and print list option */
+#define O_LST(opt, name, lst) if(strcmp(opt, name)==0) { \
+	struct config_strlist* p = cfg->lst; \
+	for(p = cfg->lst; p; p = p->next) \
+		func(p->str, arg); \
+	}
+/** compare and print list option */
+#define O_LS2(opt, name, lst) if(strcmp(opt, name)==0) { \
+	struct config_str2list* p = cfg->lst; \
+	for(p = cfg->lst; p; p = p->next) \
+		snprintf(buf, len, "%s %s\n", p->str, p->str2); \
+		func(buf, arg); \
+	}
+
+int
+config_get_option(struct config_file* cfg, const char* opt, 
+	void (*func)(char*,void*), void* arg)
+{
+	char buf[1024];
+	size_t len = sizeof(buf);
+	fptr_ok(fptr_whitelist_print_func(func));
+	O_DEC(opt, "verbosity", verbosity)
+	else O_DEC(opt, "statistics-interval", stat_interval)
+	else O_YNO(opt, "statistics-cumulative", stat_cumulative)
+	else O_YNO(opt, "extended-statistics", stat_extended)
+	else O_DEC(opt, "num-threads", num_threads)
+	else O_IFC(opt, "interface", num_ifs, ifs)
+	else O_IFC(opt, "outgoing-interface", num_out_ifs, out_ifs)
+	else O_YNO(opt, "interface-automatic", if_automatic)
+	else O_DEC(opt, "port", port)
+	else O_DEC(opt, "outgoing-range", outgoing_num_ports)
+	else O_DEC(opt, "outgoing-num-tcp", outgoing_num_tcp)
+	else O_DEC(opt, "incoming-num-tcp", incoming_num_tcp)
+	else O_DEC(opt, "edns-buffer-size", edns_buffer_size)
+	else O_DEC(opt, "msg-buffer-size", msg_buffer_size)
+	else O_MEM(opt, "msg-cache-size", msg_cache_size)
+	else O_DEC(opt, "msg-cache-slabs", msg_cache_slabs)
+	else O_DEC(opt, "num-queries-per-thread", num_queries_per_thread)
+	else O_UNS(opt, "jostle-timeout", jostle_time)
+	else O_MEM(opt, "so-rcvbuf", socket_rcvbuf)
+	else O_MEM(opt, "rrset-cache-size", rrset_cache_size)
+	else O_DEC(opt, "rrset-cache-slabs", rrset_cache_slabs)
+	else O_YNO(opt, "prefetch-key", prefetch_key)
+	else O_YNO(opt, "prefetch", prefetch)
+	else O_DEC(opt, "cache-max-ttl", max_ttl)
+	else O_DEC(opt, "infra-host-ttl", host_ttl)
+	else O_DEC(opt, "infra-lame-ttl", lame_ttl)
+	else O_DEC(opt, "infra-cache-slabs", infra_cache_slabs)
+	else O_MEM(opt, "infra-cache-numhosts", infra_cache_numhosts)
+	else O_MEM(opt, "infra-cache-lame-size", infra_cache_lame_size)
+	else O_YNO(opt, "do-ip4", do_ip4)
+	else O_YNO(opt, "do-ip6", do_ip6)
+	else O_YNO(opt, "do-udp", do_udp)
+	else O_YNO(opt, "do-tcp", do_tcp)
+	else O_YNO(opt, "do-daemonize", do_daemonize)
+	else O_STR(opt, "chroot", chrootdir)
+	else O_STR(opt, "username", username)
+	else O_STR(opt, "directory", directory)
+	else O_STR(opt, "logfile", logfile)
+	else O_STR(opt, "pidfile", pidfile)
+	else O_YNO(opt, "hide-identity", hide_identity)
+	else O_YNO(opt, "hide-version", hide_version)
+	else O_STR(opt, "identity", identity)
+	else O_STR(opt, "version", version)
+	else O_STR(opt, "target-fetch-policy", target_fetch_policy)
+	else O_YNO(opt, "harden-short-bufsize", harden_short_bufsize)
+	else O_YNO(opt, "harden-large-queries", harden_large_queries)
+	else O_YNO(opt, "harden-glue", harden_glue)
+	else O_YNO(opt, "harden-dnssec-stripped", harden_dnssec_stripped)
+	else O_YNO(opt, "harden-referral-path", harden_referral_path)
+	else O_YNO(opt, "use-caps-for-id", use_caps_bits_for_id)
+	else O_DEC(opt, "unwanted-reply-threshold", unwanted_threshold)
+	else O_YNO(opt, "do-not-query-localhost", donotquery_localhost)
+	else O_STR(opt, "module-config", module_conf)
+	else O_STR(opt, "dlv-anchor-file", dlv_anchor_file)
+	else O_DEC(opt, "val-bogus-ttl", bogus_ttl)
+	else O_YNO(opt, "val-clean-additional", val_clean_additional)
+	else O_DEC(opt, "val-log-level", val_log_level)
+	else O_YNO(opt, "val-permissive-mode", val_permissive_mode)
+	else O_STR(opt, "val-nsec3-keysize-iterations",val_nsec3_key_iterations)
+	else O_UNS(opt, "add-holddown", add_holddown)
+	else O_UNS(opt, "del-holddown", del_holddown)
+	else O_UNS(opt, "keep-missing", keep_missing)
+	else O_MEM(opt, "key-cache-size", key_cache_size)
+	else O_DEC(opt, "key-cache-slabs", key_cache_slabs)
+	else O_MEM(opt, "neg-cache-size", neg_cache_size)
+	else O_YNO(opt, "control-enable", remote_control_enable)
+	else O_DEC(opt, "control-port", control_port)
+	else O_STR(opt, "server-key-file", server_key_file)
+	else O_STR(opt, "server-cert-file", server_cert_file)
+	else O_STR(opt, "control-key-file", control_key_file)
+	else O_STR(opt, "control-cert-file", control_cert_file)
+	else O_LST(opt, "root-hints", root_hints)
+	else O_LS2(opt, "access-control", acls)
+	else O_LST(opt, "do-not-query-address", donotqueryaddrs)
+	else O_LST(opt, "private-address", private_address)
+	else O_LST(opt, "private-domain", private_domain)
+	else O_LST(opt, "auto-trust-anchor-file", auto_trust_anchor_file_list)
+	else O_LST(opt, "trust-anchor-file", trust_anchor_file_list)
+	else O_LST(opt, "trust-anchor", trust_anchor_list)
+	else O_LST(opt, "trusted-keys-file", trusted_keys_file_list)
+	else O_LST(opt, "dlv-anchor", dlv_anchor_list)
+	else O_LST(opt, "control-interface", control_ifs)
+	else O_UNS(opt, "val-override-date", val_date_override)
+	/* not here:
+	 * outgoing-permit, outgoing-avoid - have list of ports
+	 * local-zone - zones and nodefault variables
+	 * local-data - see below
+	 * local-data-ptr - converted to local-data entries
+	 * stub-zone, name, stub-addr, stub-host, stub-prime
+	 * forward-zone, name, forward-addr, forward-host
+	 */
+	else return 0;
+	return 1;
+}
+
 /** initialize the global cfg_parser object */
 static void
 create_cfg_parser(struct config_file* cfg, char* filename, const char* chroot)
@@ -714,6 +874,24 @@ int ub_c_wrap()
 	return 1;
 }
 
+int cfg_strlist_append(struct config_strlist_head* list, char* item)
+{
+	struct config_strlist *s;
+	if(!item || !list)
+		return 0;
+	s = (struct config_strlist*)calloc(1, sizeof(struct config_strlist));
+	if(!s)
+		return 0;
+	s->str = item;
+	s->next = NULL;
+	if(list->last)
+		list->last->next = s;
+	else
+		list->first = s;
+	list->last = s;
+	return 1;
+}
+
 int 
 cfg_strlist_insert(struct config_strlist** head, char* item)
 {

util/config_file.h

@@ -164,6 +164,14 @@ struct config_file {
 	struct config_strlist* private_domain;
 	/** what threshold for unwanted action. */
 	size_t unwanted_threshold;
+	/** the number of seconds maximal TTL used for RRsets and messages */
+	int max_ttl;
+	/** the number of seconds minimum TTL used for RRsets and messages */
+	int min_ttl;
+	/** if prefetching of messages should be performed. */
+	int prefetch;
+	/** if prefetching of DNSKEYs should be performed. */
+	int prefetch_key;
 
 	/** chrootdir, if not "" or chroot will be done */
 	char* chrootdir;
@@ -208,10 +216,6 @@ struct config_file {
 	/** insecure domain list */
 	struct config_strlist* domain_insecure;
 
-	/** the number of seconds maximal TTL used for RRsets and messages */
-	int max_ttl;
-	/** the number of seconds minimum TTL used for RRsets and messages */
-	int min_ttl;
 	/** if not 0, this value is the validation date for RRSIGs */
 	int32_t val_date_override;
 	/** the minimum for signature clock skew */
@@ -311,6 +315,14 @@ struct config_str2list {
 	char* str2;
 };
 
+/** List head for strlist processing, used for append operation. */
+struct config_strlist_head {
+	/** first in list of text items */
+	struct config_strlist* first;
+	/** last in list of text items */
+	struct config_strlist* last;
+};
+
 /**
  * Create config file structure. Filled with default values.
  * @return: the new structure or NULL on memory error.
@@ -357,6 +369,67 @@ void config_apply(struct config_file* config);
 int config_set_option(struct config_file* config, const char* option,
 	const char* value);
 
+/** 
+ * Call print routine for the given option.
+ * @param cfg: config.
+ * @param opt: option name without trailing :. 
+ *	This is different from config_set_option.
+ * @param func: print func, called as (str, arg) for every data element.
+ * @param arg: user argument for print func.
+ * @return false if the option name is not supported (syntax error).
+ */
+int config_get_option(struct config_file* cfg, const char* opt, 
+	void (*func)(char*,void*), void* arg);
+
+/**
+ * Get an option and return strlist
+ * @param cfg: config file
+ * @param opt: option name.
+ * @param list: list is returned here. malloced, caller must free it.
+ * @return 0=OK, 1=syntax error, 2=malloc failed.
+ */
+int config_get_option_list(struct config_file* cfg, const char* opt,
+	struct config_strlist** list);
+
+/**
+ * Get an option and collate results into string
+ * @param cfg: config file
+ * @param opt: option name.
+ * @param str: string. malloced, caller must free it.
+ * @return 0=OK, 1=syntax error, 2=malloc failed.
+ */
+int config_get_option_collate(struct config_file* cfg, const char* opt, 
+	char** str);
+
+/**
+ * function to print to a file, use as func with config_get_option.
+ * @param line: text to print. \n appended.
+ * @param arg: pass a FILE*, like stdout.
+ */
+void config_print_func(char* line, void* arg);
+
+/**
+ * function to collate the text strings into a strlist_head.
+ * @param line: text to append.
+ * @param arg: pass a strlist_head structure. zeroed on start.
+ */
+void config_collate_func(char* line, void* arg);
+
+/**
+ * take a strlist_head list and return a malloc string. separated with newline.
+ * @param list: strlist first to collate. zeroes return "".
+ * @return NULL on malloc failure. Or if malloc failure happened in strlist.
+ */
+char* config_collate_cat(struct config_strlist* list);
+
+/**
+ * Append text at end of list.
+ * @param list: list head. zeroed at start.
+ * @param item: new item. malloced by caller. if NULL the insertion fails.
+ * @return true on success.
+ */
+int cfg_strlist_append(struct config_strlist_head* list, char* item);
+
 /**
  * Insert string into strlist.
  * @param head: pointer to strlist head variable.

util/configlexer.lex

@@ -123,7 +123,8 @@ SQANY     [^\'\n\r\\]|\\.
 %%
 <INITIAL,val>{SPACE}*	{ 
 	LEXOUT(("SP ")); /* ignore */ }
-<INITIAL,val>{SPACE}*{COMMENT}.*$	{ 
+<INITIAL,val>{SPACE}*{COMMENT}.*	{ 
+	/* note that flex makes the longest match and '.' is any but not nl */
 	LEXOUT(("comment(%s) ", yytext)); /* ignore */ }
 server{COLON}			{ YDVAR(0, VAR_SERVER) }
 num-threads{COLON}		{ YDVAR(1, VAR_NUM_THREADS) }
@@ -174,6 +175,8 @@ use-caps-for-id{COLON}		{ YDVAR(1, VAR_USE_CAPS_FOR_ID) }
 unwanted-reply-threshold{COLON}	{ YDVAR(1, VAR_UNWANTED_REPLY_THRESHOLD) }
 private-address{COLON}		{ YDVAR(1, VAR_PRIVATE_ADDRESS) }
 private-domain{COLON}		{ YDVAR(1, VAR_PRIVATE_DOMAIN) }
+prefetch-key{COLON}		{ YDVAR(1, VAR_PREFETCH_KEY) }
+prefetch{COLON}			{ YDVAR(1, VAR_PREFETCH) }
 stub-zone{COLON}		{ YDVAR(0, VAR_STUB_ZONE) }
 name{COLON}			{ YDVAR(1, VAR_NAME) }
 stub-addr{COLON}		{ YDVAR(1, VAR_STUB_ADDR) }