tag 1.4.13rc2

git-svn-id: file:///svn/unbound/trunk@2489 be551aaa-1e26-0410-a405-d3ace91eadb9
revert earlier commit.
2026-08-17 21:25:50 +02:00 · 2011-09-12 11:58:29 +00:00 · 2011-09-12 11:28:14 +00:00 · 2011-09-07 14:34:10 +00:00 · 2011-09-07 05:34:22 +00:00 · 2011-09-05 11:48:26 +00:00
52 changed files with 4976 additions and 3958 deletions
@@ -192,8 +192,6 @@ ifeq "$(UB_ON_WINDOWS)" "yes"

 $(BUILD)%.o:      $(srcdir)/%.rc $(srcdir)/config.h
 	$(INFO) Resource $<
-	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
-		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(WINDRES) $(CPPFLAGS) $< $@
 endif
@@ -202,12 +200,10 @@ COMPILE=$(LIBTOOL) --tag=CC --mode=compile $(CC) $(CPPFLAGS) $(CFLAGS)
 LINK=$(LIBTOOL) --tag=CC --mode=link $(strip $(CC) $(staticexe) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS))
 LINK_LIB=$(LIBTOOL) --tag=CC --mode=link $(strip $(CC) $(RUNTIME_PATH) $(CFLAGS) $(LDFLAGS) $(staticexe) -version-number @LIBUNBOUND_CURRENT@:@LIBUNBOUND_REVISION@:@LIBUNBOUND_AGE@ -no-undefined)

-.PHONY:	clean realclean doc lint all install uninstall tests test download_ldns strip lib longtest longcheck check
+.PHONY:	clean realclean doc lint all install uninstall tests test strip lib longtest longcheck check

 $(BUILD)%.lo:    $(srcdir)/%.c 
 	$(INFO) Build $<
-	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
-		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(COMPILE) -o $@ -c $<

@@ -231,16 +227,6 @@ longtest:	tests

 lib:	libunbound.la

-ifeq ($(patsubst ldns-src%,ldns-src,$(ldnsdir)),ldns-src)
-ldnslib=$(ldnsdir)/lib/libldns.a
-$(ldnslib):	$(ldnsdir)/lib
-$(ldnsdir)/lib:
-	@if test ! -z "$(ldnsdir)"; \
-	then (cd $(ldnsdir) && $(MAKE)); fi
-else
-ldnslib=
-endif
-
 UBSYMS+=-export-symbols $(srcdir)/libunbound/ubsyms.def
 CLUBSYMS=-export-symbols $(BUILD)clubsyms.def
 EXTRALINK=
@@ -250,7 +236,7 @@ CLUBSYMS=
 EXTRALINK=-L. -L.libs -lunbound
 endif

-libunbound.la:	$(LIBUNBOUND_OBJ) $(ldnslib)
+libunbound.la:	$(LIBUNBOUND_OBJ)
 	$(INFO) Link $@
 ifeq ($(CHECKLOCK_SRC),)
 	$Q$(LINK_LIB) $(UBSYMS) -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
@@ -269,23 +255,23 @@ else
 	$Q$(LINK_LIB) $(CLUBSYMS) -o $@ $(sort $(LIBUNBOUND_OBJ)) -rpath $(libdir) $(LIBS)
 endif

-unbound$(EXEEXT):	$(DAEMON_OBJ) libunbound.la $(ldnslib)
+unbound$(EXEEXT):	$(DAEMON_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(DAEMON_OBJ)) $(EXTRALINK) -lssl $(LIBS)

-unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ) libunbound.la $(ldnslib)
+unbound-checkconf$(EXEEXT):	$(CHECKCONF_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(CHECKCONF_OBJ)) $(EXTRALINK) -lssl $(LIBS)

-unbound-control$(EXEEXT):	$(CONTROL_OBJ) libunbound.la $(ldnslib)
+unbound-control$(EXEEXT):	$(CONTROL_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(CONTROL_OBJ)) $(EXTRALINK) -lssl $(LIBS)

-unbound-host$(EXEEXT):	$(HOST_OBJ) libunbound.la $(ldnslib)
+unbound-host$(EXEEXT):	$(HOST_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(HOST_OBJ)) -L. -L.libs -lunbound $(LIBS)

-unbound-anchor$(EXEEXT):	$(UBANCHOR_OBJ) libunbound.la $(ldnslib)
+unbound-anchor$(EXEEXT):	$(UBANCHOR_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(UBANCHOR_OBJ)) -L. -L.libs -lunbound -lexpat -lssl $(LIBS)

@@ -297,19 +283,19 @@ unbound-service-remove$(EXEEXT):	$(SVCUNINST_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SVCUNINST_OBJ)) $(LIBS)

-anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ) libunbound.la $(ldnslib)
+anchor-update$(EXEEXT):  $(ANCHORUPD_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(ANCHORUPD_OBJ)) -L. -L.libs -lunbound $(LIBS)

-unittest$(EXEEXT):	$(UNITTEST_OBJ) $(ldnslib)
+unittest$(EXEEXT):	$(UNITTEST_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(UNITTEST_OBJ)) $(LIBS)

-testbound$(EXEEXT):	$(TESTBOUND_OBJ) $(ldnslib)
+testbound$(EXEEXT):	$(TESTBOUND_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(TESTBOUND_OBJ)) -lssl $(LIBS)

-lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ) $(ldnslib)
+lock-verify$(EXEEXT):	$(LOCKVERIFY_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(LOCKVERIFY_OBJ)) $(LIBS)

@@ -317,35 +303,35 @@ petal$(EXEEXT):	$(PETAL_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PETAL_OBJ)) -lssl $(LIBS)

-pktview$(EXEEXT):	$(PKTVIEW_OBJ) $(ldnslib)
+pktview$(EXEEXT):	$(PKTVIEW_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PKTVIEW_OBJ)) $(LIBS)

-signit$(EXEEXT):	$(SIGNIT_OBJ) $(ldnslib)
+signit$(EXEEXT):	$(SIGNIT_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(SIGNIT_OBJ)) $(LIBS)

-memstats$(EXEEXT):	$(MEMSTATS_OBJ) $(ldnslib)
+memstats$(EXEEXT):	$(MEMSTATS_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(MEMSTATS_OBJ)) $(LIBS)

-asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ) $(ldnslib) libunbound.la
+asynclook$(EXEEXT):	$(ASYNCLOOK_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(ASYNCLOOK_OBJ)) $(LIBS) -L. -L.libs -lunbound

-streamtcp$(EXEEXT):	$(STREAMTCP_OBJ) $(ldnslib)
+streamtcp$(EXEEXT):	$(STREAMTCP_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(STREAMTCP_OBJ)) $(LIBS)

-perf$(EXEEXT):	$(PERF_OBJ) $(ldnslib)
+perf$(EXEEXT):	$(PERF_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(PERF_OBJ)) $(LIBS)

-delayer$(EXEEXT):	$(DELAYER_OBJ) $(ldnslib)
+delayer$(EXEEXT):	$(DELAYER_OBJ)
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(DELAYER_OBJ)) $(LIBS)

-harvest$(EXEEXT):	$(HARVEST_OBJ) $(ldnslib) libunbound.la
+harvest$(EXEEXT):	$(HARVEST_OBJ) libunbound.la
 	$(INFO) Link $@
 	$Q$(LINK) -o $@ $(sort $(HARVEST_OBJ)) $(LIBS) -L. -L.libs -lunbound

@@ -406,7 +392,6 @@ realclean: clean
 	rm -f configure config.sub config.guess ltmain.sh aclocal.m4 libtool
 	rm -f util/configlexer.c util/configparser.c util/configparser.h
 	rm -f $(TEST_BIN)
-	if test -d ldns-src; then rm -rf ldns-src; fi
 	rm -f Makefile 

 $(BUILD)%.lint:    $(srcdir)/%.c 
@@ -490,23 +475,14 @@ endif
 	@echo
 	@echo "You still need to remove "`dirname $(DESTDIR)$(configfile)`" , $(DESTDIR)$(configfile) by hand"

-download_ldns:
-	svn export https://www.nlnetlabs.nl/svn/ldns/trunk/makedist.sh ldns_makedist.sh
-	./ldns_makedist.sh -s -d https://www.nlnetlabs.nl/svn/ldns/trunk
-	mv ldns-[0-9]*.tar.gz ldns-src.tar.gz
-	rm ldns-*.tar.gz.sha1 ldns_makedist.sh
-
 iana_update:
-	curl -o port-numbers.tmp http://www.iana.org/assignments/port-numbers
-	awk '/Unassigned|Reserved/ {next;} { match($$0, "[0-9]+/udp"); if (RLENGTH > 0) print substr($$0, RSTART, RLENGTH - 4) ","}' port-numbers.tmp | sort -nu > portslist.tmp
-	cat portslist.tmp > util/iana_ports.inc
+	curl -o port-numbers.tmp http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml
+	awk '/<record>/ {p=0;} /<protocol>udp/ {p=1;} /<protocol>[^u]/ {p=0;} /Decomissioned|Decommissioned|Removed|De-registered|unassigned|Unassigned|Reserved/ {u=1;} /<number>/ { if(u==1) {u=0;} else { if(p==1) { match($$0,/[0-9]+/); print substr($$0, RSTART, RLENGTH) ","}}}' port-numbers.tmp | sort -nu > util/iana_ports.inc  
 	rm -f port-numbers.tmp portslist.tmp

 # Automatic dependencies.
 $(BUILD)%.d: $(srcdir)/%.c
 	$(INFO) Depend $<
-	@if test ! -z "$(ldnsdir)" -a ! -e $(ldnsdir)/include/ldns/ldns.h; \
-		then (cd $(ldnsdir); $(MAKE) copy-headers); fi
 	@-if test ! -d $(dir $@); then $(INSTALL) -d $(patsubst %/,%,$(dir $@)); fi
 	$Q$(SHELL) -ec '$(CC) $(DEPFLAG) $(CPPFLAGS) $(CFLAGS) $< | sed '\''s!\(.*\)\.o[ :]*!$(dir $@)\1.lo $@ : !g'\'' > $@; [ -s $@ ] || rm -f $@'

@@ -2,7 +2,9 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 12
+# Version 14
+# 2011-08-01 Fix nonblock test (broken at v13).
+# 2011-08-01 Fix autoconf 2.68 warnings
 # 2011-06-23 Add ACX_CHECK_FLTO to check -flto.
 # 2010-08-16 Fix FLAG_OMITTED for AS_TR_CPP changes in autoconf-2.66.
 # 2010-07-02 Add check for ss_family (for minix).
@@ -766,7 +768,7 @@ AC_DEFUN([ACX_CHECK_GETADDRINFO_WITH_INCLUDES],
 AC_MSG_CHECKING(for getaddrinfo)
 ac_cv_func_getaddrinfo=no
 AC_LINK_IFELSE(
-[
+[AC_LANG_SOURCE([[
 #ifdef __cplusplus
 extern "C"
 {
@@ -780,14 +782,14 @@ int main() {
        ;
        return 0;
 }
-],
+]])],
 dnl this case on linux, solaris, bsd
 [ac_cv_func_getaddrinfo="yes"],
 dnl no quick getaddrinfo, try mingw32 and winsock2 library.
 ORIGLIBS="$LIBS"
 LIBS="$LIBS -lws2_32"
 AC_LINK_IFELSE(
-AC_LANG_PROGRAM(
+[AC_LANG_PROGRAM(
 [
 #ifdef HAVE_WS2TCPIP_H
 #include <ws2tcpip.h>
@@ -796,7 +798,7 @@ AC_LANG_PROGRAM(
 [
        (void)getaddrinfo(NULL, NULL, NULL, NULL);
 ]
-),
+)],
 [
 ac_cv_func_getaddrinfo="yes"
 dnl already: LIBS="$LIBS -lws2_32"
@@ -860,7 +862,8 @@ if echo $target | grep mingw32 >/dev/null; then
 	AC_MSG_RESULT([no (windows)])
 	AC_DEFINE([NONBLOCKING_IS_BROKEN], 1, [Define if the network stack does not fully support nonblocking io (causes lower performance).])
 else
-AC_RUN_IFELSE(AC_LANG_PROGRAM([
+AC_RUN_IFELSE([
+AC_LANG_SOURCE([[
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
@@ -884,7 +887,9 @@ AC_RUN_IFELSE(AC_LANG_PROGRAM([
 #ifdef HAVE_TIME_H
 #include <time.h>
 #endif
-],[[
+
+int main(void)
+{
 	int port;
 	int sfd, cfd;
 	int num = 10;
@@ -977,7 +982,9 @@ AC_RUN_IFELSE(AC_LANG_PROGRAM([

 	close(sfd);
 	close(cfd);
-]]), [
+	return 0;
+}
+]])], [
 	AC_MSG_RESULT([yes])
 ], [
 	AC_MSG_RESULT([no])
@@ -1017,13 +1024,13 @@ AC_DEFUN([ACX_FUNC_IOCTLSOCKET],
 [
 # check ioctlsocket
 AC_MSG_CHECKING(for ioctlsocket)
-AC_LINK_IFELSE(AC_LANG_PROGRAM([
+AC_LINK_IFELSE([AC_LANG_PROGRAM([
 #ifdef HAVE_WINSOCK2_H
 #include <winsock2.h>
 #endif
 ], [
 	(void)ioctlsocket(0, 0, NULL);
-]), [
+])], [
 AC_MSG_RESULT(yes)
 AC_DEFINE(HAVE_IOCTLSOCKET, 1, [if the function 'ioctlsocket' is available])
 ],[AC_MSG_RESULT(no)])
@@ -129,7 +129,7 @@ $ac_distutils_result])
        AC_MSG_CHECKING([for Python site-packages path])
        if test -z "$PYTHON_SITE_PKG"; then
                PYTHON_SITE_PKG=`$PYTHON -c "import distutils.sysconfig; \
-                        print distutils.sysconfig.get_python_lib(0,0);"`
+                        print distutils.sysconfig.get_python_lib(1,0);"`
        fi
        AC_MSG_RESULT([$PYTHON_SITE_PKG])
        AC_SUBST([PYTHON_SITE_PKG])
@@ -1,10 +1,10 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
 #   Free Software Foundation, Inc.

-timestamp='2009-04-27'
+timestamp='2009-11-20'

 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -27,16 +27,16 @@ timestamp='2009-04-27'
 # the same distribution terms that you use for the rest of that program.


-# Originally written by Per Bothner <per@bothner.com>.
-# Please send patches to <config-patches@gnu.org>.  Submit a context
-# diff and a properly formatted ChangeLog entry.
+# Originally written by Per Bothner.  Please send patches (context
+# diff format) to <config-patches@gnu.org> and include a ChangeLog
+# entry.
 #
 # This script attempts to guess a canonical system name similar to
 # config.sub.  If it succeeds, it prints the system name on stdout, and
 # exits with 0.  Otherwise, it exits with 1.
 #
-# The plan is that this can be called by configure scripts if you
-# don't specify an explicit build system type.
+# You can get the latest version of this script from:
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD

 me=`echo "$0" | sed -e 's,.*/,,'`

@@ -170,7 +170,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	    arm*|i386|m68k|ns32k|sh3*|sparc|vax)
 		eval $set_cc_for_build
 		if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
-			| grep __ELF__ >/dev/null
+			| grep -q __ELF__
 		then
 		    # Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout).
 		    # Return netbsd for either.  FIX?
@@ -333,6 +333,9 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
    sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
 	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
+    i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*)
+	echo i386-pc-auroraux${UNAME_RELEASE}
+	exit ;;
    i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
 	eval $set_cc_for_build
 	SUN_ARCH="i386"
@@ -656,7 +659,7 @@ EOF
 	    # => hppa64-hp-hpux11.23

 	    if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) |
-		grep __LP64__ >/dev/null
+		grep -q __LP64__
 	    then
 		HP_ARCH="hppa2.0w"
 	    else
@@ -807,12 +810,12 @@ EOF
    i*:PW*:*)
 	echo ${UNAME_MACHINE}-pc-pw32
 	exit ;;
-    *:Interix*:[3456]*)
+    *:Interix*:*)
    	case ${UNAME_MACHINE} in
 	    x86)
 		echo i586-pc-interix${UNAME_RELEASE}
 		exit ;;
-	    EM64T | authenticamd | genuineintel)
+	    authenticamd | genuineintel | EM64T)
 		echo x86_64-unknown-interix${UNAME_RELEASE}
 		exit ;;
 	    IA64)
@@ -822,6 +825,9 @@ EOF
    [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
 	echo i${UNAME_MACHINE}-pc-mks
 	exit ;;
+    8664:Windows_NT:*)
+	echo x86_64-pc-mks
+	exit ;;
    i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
 	# How do we know it's Interix rather than the generic POSIX subsystem?
 	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
@@ -851,6 +857,20 @@ EOF
    i*86:Minix:*:*)
 	echo ${UNAME_MACHINE}-pc-minix
 	exit ;;
+    alpha:Linux:*:*)
+	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
+	  EV5)   UNAME_MACHINE=alphaev5 ;;
+	  EV56)  UNAME_MACHINE=alphaev56 ;;
+	  PCA56) UNAME_MACHINE=alphapca56 ;;
+	  PCA57) UNAME_MACHINE=alphapca56 ;;
+	  EV6)   UNAME_MACHINE=alphaev6 ;;
+	  EV67)  UNAME_MACHINE=alphaev67 ;;
+	  EV68*) UNAME_MACHINE=alphaev68 ;;
+        esac
+	objdump --private-headers /bin/sh | grep -q ld.so.1
+	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
+	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
+	exit ;;
    arm*:Linux:*:*)
 	eval $set_cc_for_build
 	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
@@ -873,6 +893,17 @@ EOF
    frv:Linux:*:*)
    	echo frv-unknown-linux-gnu
 	exit ;;
+    i*86:Linux:*:*)
+	LIBC=gnu
+	eval $set_cc_for_build
+	sed 's/^	//' << EOF >$dummy.c
+	#ifdef __dietlibc__
+	LIBC=dietlibc
+	#endif
+EOF
+	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
+	echo "${UNAME_MACHINE}-pc-linux-${LIBC}"
+	exit ;;
    ia64:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
@@ -882,78 +913,34 @@ EOF
    m68*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
-    mips:Linux:*:*)
+    mips:Linux:*:* | mips64:Linux:*:*)
 	eval $set_cc_for_build
 	sed 's/^	//' << EOF >$dummy.c
 	#undef CPU
-	#undef mips
-	#undef mipsel
+	#undef ${UNAME_MACHINE}
+	#undef ${UNAME_MACHINE}el
 	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
-	CPU=mipsel
+	CPU=${UNAME_MACHINE}el
 	#else
 	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
-	CPU=mips
+	CPU=${UNAME_MACHINE}
 	#else
 	CPU=
 	#endif
 	#endif
 EOF
-	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
-	    /^CPU/{
-		s: ::g
-		p
-	    }'`"
-	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
-	;;
-    mips64:Linux:*:*)
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
-	#undef CPU
-	#undef mips64
-	#undef mips64el
-	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
-	CPU=mips64el
-	#else
-	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
-	CPU=mips64
-	#else
-	CPU=
-	#endif
-	#endif
-EOF
-	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
-	    /^CPU/{
-		s: ::g
-		p
-	    }'`"
+	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
 	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
 	;;
    or32:Linux:*:*)
 	echo or32-unknown-linux-gnu
 	exit ;;
-    ppc:Linux:*:*)
-	echo powerpc-unknown-linux-gnu
-	exit ;;
-    ppc64:Linux:*:*)
-	echo powerpc64-unknown-linux-gnu
-	exit ;;
-    alpha:Linux:*:*)
-	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
-	  EV5)   UNAME_MACHINE=alphaev5 ;;
-	  EV56)  UNAME_MACHINE=alphaev56 ;;
-	  PCA56) UNAME_MACHINE=alphapca56 ;;
-	  PCA57) UNAME_MACHINE=alphapca56 ;;
-	  EV6)   UNAME_MACHINE=alphaev6 ;;
-	  EV67)  UNAME_MACHINE=alphaev67 ;;
-	  EV68*) UNAME_MACHINE=alphaev68 ;;
-        esac
-	objdump --private-headers /bin/sh | grep ld.so.1 >/dev/null
-	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
-	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
-	exit ;;
    padre:Linux:*:*)
 	echo sparc-unknown-linux-gnu
 	exit ;;
+    parisc64:Linux:*:* | hppa64:Linux:*:*)
+	echo hppa64-unknown-linux-gnu
+	exit ;;
    parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
 	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
@@ -962,8 +949,11 @@ EOF
 	  *)    echo hppa-unknown-linux-gnu ;;
 	esac
 	exit ;;
-    parisc64:Linux:*:* | hppa64:Linux:*:*)
-	echo hppa64-unknown-linux-gnu
+    ppc64:Linux:*:*)
+	echo powerpc64-unknown-linux-gnu
+	exit ;;
+    ppc:Linux:*:*)
+	echo powerpc-unknown-linux-gnu
 	exit ;;
    s390:Linux:*:* | s390x:Linux:*:*)
 	echo ${UNAME_MACHINE}-ibm-linux
@@ -986,66 +976,6 @@ EOF
    xtensa*:Linux:*:*)
    	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
-    i*86:Linux:*:*)
-	# The BFD linker knows what the default object file format is, so
-	# first see if it will tell us. cd to the root directory to prevent
-	# problems with other programs or directories called `ld' in the path.
-	# Set LC_ALL=C to ensure ld outputs messages in English.
-	ld_supported_targets=`cd /; LC_ALL=C ld --help 2>&1 \
-			 | sed -ne '/supported targets:/!d
-				    s/[ 	][ 	]*/ /g
-				    s/.*supported targets: *//
-				    s/ .*//
-				    p'`
-        case "$ld_supported_targets" in
-	  elf32-i386)
-		TENTATIVE="${UNAME_MACHINE}-pc-linux-gnu"
-		;;
-	  a.out-i386-linux)
-		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
-		exit ;;
-	  "")
-		# Either a pre-BFD a.out linker (linux-gnuoldld) or
-		# one that does not give us useful --help.
-		echo "${UNAME_MACHINE}-pc-linux-gnuoldld"
-		exit ;;
-	esac
-	# Determine whether the default compiler is a.out or elf
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
-	#include <features.h>
-	#ifdef __ELF__
-	# ifdef __GLIBC__
-	#  if __GLIBC__ >= 2
-	LIBC=gnu
-	#  else
-	LIBC=gnulibc1
-	#  endif
-	# else
-	LIBC=gnulibc1
-	# endif
-	#else
-	#if defined(__INTEL_COMPILER) || defined(__PGI) || defined(__SUNPRO_C) || defined(__SUNPRO_CC)
-	LIBC=gnu
-	#else
-	LIBC=gnuaout
-	#endif
-	#endif
-	#ifdef __dietlibc__
-	LIBC=dietlibc
-	#endif
-EOF
-	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
-	    /^LIBC/{
-		s: ::g
-		p
-	    }'`"
-	test x"${LIBC}" != x && {
-		echo "${UNAME_MACHINE}-pc-linux-${LIBC}"
-		exit
-	}
-	test x"${TENTATIVE}" != x && { echo "${TENTATIVE}"; exit; }
-	;;
    i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
 	# earlier versions are messed up and put the nodename in both
@@ -1074,7 +1004,7 @@ EOF
    i*86:syllable:*:*)
 	echo ${UNAME_MACHINE}-pc-syllable
 	exit ;;
-    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.0*:*)
+    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.[02]*:*)
 	echo i386-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
    i*86:*DOS:*:*)
@@ -1182,7 +1112,7 @@ EOF
    rs6000:LynxOS:2.*:*)
 	echo rs6000-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
-    PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.0*:*)
+    PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.[02]*:*)
 	echo powerpc-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
    SM[BE]S:UNIX_SV:*:*)
@@ -1275,6 +1205,16 @@ EOF
    *:Darwin:*:*)
 	UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
 	case $UNAME_PROCESSOR in
+	    i386)
+		eval $set_cc_for_build
+		if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+		  if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
+		      (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+		      grep IS_64BIT_ARCH >/dev/null
+		  then
+		      UNAME_PROCESSOR="x86_64"
+		  fi
+		fi ;;
 	    unknown) UNAME_PROCESSOR=powerpc ;;
 	esac
 	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}
@@ -1,10 +1,10 @@
 #! /bin/sh
 # Configuration validation subroutine script.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
 #   Free Software Foundation, Inc.

-timestamp='2009-04-17'
+timestamp='2009-11-20'

 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -32,13 +32,16 @@ timestamp='2009-04-17'


 # Please send patches to <config-patches@gnu.org>.  Submit a context
-# diff and a properly formatted ChangeLog entry.
+# diff and a properly formatted GNU ChangeLog entry.
 #
 # Configuration subroutine to validate and canonicalize a configuration type.
 # Supply the specified configuration type as an argument.
 # If it is invalid, we print an error message on stderr and exit with code 1.
 # Otherwise, we print the canonical config type on stdout and succeed.

+# You can get the latest version of this script from:
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
+
 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
 # that are meaningful with *any* GNU software.
@@ -149,10 +152,13 @@ case $os in
 	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
 	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
 	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple | -axis | -knuth | -cray)
+	-apple | -axis | -knuth | -cray | -microblaze)
 		os=
 		basic_machine=$1
 		;;
+        -bluegene*)
+	        os=-cnk
+		;;
 	-sim | -cisco | -oki | -wec | -winbond)
 		os=
 		basic_machine=$1
@@ -281,6 +287,7 @@ case $basic_machine in
 	| pdp10 | pdp11 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \
 	| pyramid \
+	| rx \
 	| score \
 	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
 	| sh64 | sh64le \
@@ -288,13 +295,14 @@ case $basic_machine in
 	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
 	| spu | strongarm \
 	| tahoe | thumb | tic4x | tic80 | tron \
+	| ubicom32 \
 	| v850 | v850e \
 	| we32k \
 	| x86 | xc16x | xscale | xscalee[bl] | xstormy16 | xtensa \
 	| z8k | z80)
 		basic_machine=$basic_machine-unknown
 		;;
-	m6811 | m68hc11 | m6812 | m68hc12)
+	m6811 | m68hc11 | m6812 | m68hc12 | picochip)
 		# Motorola 68HC11/12.
 		basic_machine=$basic_machine-unknown
 		os=-none
@@ -337,7 +345,7 @@ case $basic_machine in
 	| lm32-* \
 	| m32c-* | m32r-* | m32rle-* \
 	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* \
+	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* | microblaze-* \
 	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
 	| mips16-* \
 	| mips64-* | mips64el-* \
@@ -365,7 +373,7 @@ case $basic_machine in
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
 	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
 	| pyramid-* \
-	| romp-* | rs6000-* \
+	| romp-* | rs6000-* | rx-* \
 	| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
 	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
 	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
@@ -374,6 +382,7 @@ case $basic_machine in
 	| tahoe-* | thumb-* \
 	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* | tile-* \
 	| tron-* \
+	| ubicom32-* \
 	| v850-* | v850e-* | vax-* \
 	| we32k-* \
 	| x86-* | x86_64-* | xc16x-* | xps100-* | xscale-* | xscalee[bl]-* \
@@ -467,6 +476,10 @@ case $basic_machine in
 		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
+	bluegene*)
+		basic_machine=powerpc-ibm
+		os=-cnk
+		;;
 	c90)
 		basic_machine=c90-cray
 		os=-unicos
@@ -719,6 +732,9 @@ case $basic_machine in
 		basic_machine=ns32k-utek
 		os=-sysv
 		;;
+        microblaze)
+		basic_machine=microblaze-xilinx
+		;;
 	mingw32)
 		basic_machine=i386-pc
 		os=-mingw32
@@ -1240,6 +1256,9 @@ case $os in
        # First match some system type aliases
        # that might get confused with valid system types.
 	# -solaris* is a basic system type, with this one exception.
+        -auroraux)
+	        os=-auroraux
+		;;
 	-solaris1 | -solaris1.*)
 		os=`echo $os | sed -e 's|solaris1|sunos4|'`
 		;;
@@ -1260,9 +1279,9 @@ case $os in
 	# Each alternative MUST END IN A *, to match a version number.
 	# -sysv* is not here because it comes later, after sysvr4.
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
-	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -sunos | -sunos[34]*\
-	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -solaris* | -sym* \
-	      | -kopensolaris* \
+	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\
+	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
+	      | -sym* | -kopensolaris* \
 	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
 	      | -aos* | -aros* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
@@ -1283,7 +1302,7 @@ case $os in
 	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
 	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
 	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
-	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops*)
+	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1613,7 +1632,7 @@ case $basic_machine in
 			-sunos*)
 				vendor=sun
 				;;
-			-aix*)
+			-cnk*|-aix*)
 				vendor=ibm
 				;;
 			-beos*)
@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)

-AC_INIT(unbound, 1.4.11, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.4.13, unbound-bugs@nlnetlabs.nl, unbound)

 LIBUNBOUND_CURRENT=2
-LIBUNBOUND_REVISION=11
+LIBUNBOUND_REVISION=13
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -36,6 +36,8 @@ LIBUNBOUND_AGE=0
 # 1.4.9 had 2:9:0
 # 1.4.10 had 2:10:0
 # 1.4.11 had 2:11:0
+# 1.4.12 had 2:12:0
+# 1.4.13 had 2:13:0

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -297,13 +299,13 @@ if test "$on_mingw" = "yes"; then
 # check windows threads
 	AC_CHECK_HEADERS([windows.h],,, [AC_INCLUDES_DEFAULT])
 	AC_MSG_CHECKING([for CreateThread])
-	AC_TRY_COMPILE([
+	AC_COMPILE_IFELSE([AC_LANG_PROGRAM([
 #ifdef HAVE_WINDOWS_H
 #include <windows.h>
 #endif
 ], [
 	HANDLE t = CreateThread(NULL, 0, NULL, NULL, 0, NULL);
-],
+])],
 	AC_MSG_RESULT(yes)
 	AC_DEFINE(HAVE_WINDOWS_THREADS, 1, [Using Windows threads])
 ,	
@@ -584,7 +586,7 @@ AC_CHECK_HEADERS([expat.h],,, [AC_INCLUDES_DEFAULT])
 # set static linking if requested
 AC_SUBST(staticexe)
 staticexe=""
-AC_ARG_ENABLE(staticexe, AC_HELP_STRING([--enable-static-exe],
+AC_ARG_ENABLE(static-exe, AC_HELP_STRING([--enable-static-exe],
 	[ enable to compile executables statically against event, ldns libs, for debug purposes ]), 
 	, )
 if test x_$enable_static_exe = x_yes; then
@@ -661,13 +663,13 @@ AC_DEFUN([AC_CHECK_STRPTIME_WORKS],
 [AC_REQUIRE([AC_PROG_CC])
 AC_MSG_CHECKING(whether strptime works)
 if test c${cross_compiling} = cno; then
-AC_TRY_RUN([
+AC_RUN_IFELSE([AC_LANG_SOURCE([[
 #define _XOPEN_SOURCE
 #include <time.h>
 int main(void) { struct tm tm; char *res;
 res = strptime("20070207111842", "%Y%m%d%H%M%S", &tm);
 if (!res) return 1; return 0; }
-] , [eval "ac_cv_c_strptime_works=yes"], [eval "ac_cv_c_strptime_works=no"])
+]])] , [eval "ac_cv_c_strptime_works=yes"], [eval "ac_cv_c_strptime_works=no"])
 else
 eval "ac_cv_c_strptime_works=maybe"
 fi
@@ -710,10 +712,9 @@ AC_SUBST(EXPORT_ALL_SYMBOLS)

 # check this after all other compilation checks, since the linking of the lib
 # may break checks after this.
-use_ldns_builtin="no"
 AC_ARG_WITH(ldns, AC_HELP_STRING([--with-ldns=PATH], 
 	[specify prefix of path of ldns library to use]), 
-	[ specialldnsdir="$withval"
+	[
 	if test "$withval" != "yes"; then
 		if test "$withval" != "/usr" -a "$withval" != ""; then
 			CPPFLAGS="-I$withval/include $CPPFLAGS"
@@ -725,24 +726,23 @@ AC_ARG_WITH(ldns, AC_HELP_STRING([--with-ldns=PATH],
 	fi
 ])

-AC_ARG_WITH(ldns-builtin, AC_HELP_STRING([--with-ldns-builtin], 
-	[forces use of package included with this one]), [ 
-	use_ldns_builtin="yes"
-])
-
 # check if ldns is good enough
-if test "$use_ldns_builtin" = "no"; then
-	AC_CHECK_LIB(ldns, ldns_buffer_copy)
-	AC_CHECK_FUNC(ldns_key_buf2rsa_raw)
-	AC_CHECK_FUNC(ldns_get_random)
-	AC_CHECK_FUNC(ldns_b32_ntop_extended_hex)
-	if test x$use_gost = xyes; then
-	    AC_CHECK_FUNC(ldns_key_EVP_load_gost_id)
-	    AC_CHECK_FUNCS([ldns_key_EVP_unload_gost])
-	else
-	    ac_cv_func_ldns_key_EVP_load_gost_id="yes"
-	fi
-	AC_CHECK_HEADERS([ldns/ldns.h],,, [AC_INCLUDES_DEFAULT
+AC_CHECK_LIB(ldns, ldns_rr_new,,[
+	AC_MSG_ERROR([No ldns library found, install the ldns library into system lib dir or use --with-ldns=path to other location.  The --with-ldns can point to the make-dir of ldns.  Install the package ldns or download source http://www.nlnetlabs.nl/projects/ldns])
+])
+AC_CHECK_FUNC(ldns_buffer_copy)
+AC_CHECK_FUNC(ldns_key_buf2rsa_raw)
+AC_CHECK_FUNC(ldns_get_random)
+AC_CHECK_FUNC(ldns_b32_ntop_extended_hex)
+if test x$use_gost = xyes; then
+    AC_CHECK_FUNC(ldns_key_EVP_load_gost_id)
+    AC_CHECK_FUNCS([ldns_key_EVP_unload_gost])
+else
+    ac_cv_func_ldns_key_EVP_load_gost_id="yes"
+fi
+AC_CHECK_HEADERS([ldns/ldns.h],,[
+	AC_MSG_ERROR([No ldns include file found, install the ldns library development files.  Install package ldns-dev or ldns-devel or download source http://www.nlnetlabs.nl/projects/ldns])
+	], [AC_INCLUDES_DEFAULT
 #ifdef HAVE_SYS_SOCKET_H
 #include <sys/socket.h>
 #endif
@@ -763,39 +763,18 @@ if test "$use_ldns_builtin" = "no"; then
 #include <ws2tcpip.h>
 #endif
 ])
-	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes \
-	    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
-	    -a $ac_cv_func_ldns_get_random = yes \
-	    -a $ac_cv_header_ldns_ldns_h = yes \
-	    -a $ac_cv_func_ldns_b32_ntop_extended_hex = yes \
-	    -a $ac_cv_func_ldns_key_EVP_load_gost_id = yes; then
-	    dnl ldns was found
-	    :
-	else
-	    AC_MSG_ERROR([No ldns library found (or not recent); install or update ldns library, use --with-ldns=path or --with-ldns-builtin])
-	fi
+if test $ac_cv_func_ldns_buffer_copy = yes \
+    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
+    -a $ac_cv_func_ldns_get_random = yes \
+    -a $ac_cv_header_ldns_ldns_h = yes \
+    -a $ac_cv_func_ldns_b32_ntop_extended_hex = yes \
+    -a $ac_cv_func_ldns_key_EVP_load_gost_id = yes; then
+    dnl ldns was found
+    :
+else
+    AC_MSG_ERROR([ldns library is not recent, update the ldns library, install it into system lib dir or use --with-ldns=path to other location.  The --with-ldns can point to the make-dir of ldns.  Package libldns or download source http://www.nlnetlabs.nl/projects/ldns])
 fi

-if test "$use_ldns_builtin" = "yes"; then
-dnl use the builtin ldns-src.tar.gz file to build ldns.
-if test ! -f $srcdir/ldns-src.tar.gz; then
-	AC_MSG_ERROR([No ldns library found and no ldns-src.tar.gz, use --with-ldns=path.])
-fi
-echo "****************************************************************"
-echo "***                                                          ***"
-echo "*** Building ldns library from package included in this one. ***"
-echo "***                                                          ***"
-echo "****************************************************************"
-if test -d $srcdir/ldns-src; then rm -rf $srcdir/ldns-src; fi
-mkdir $srcdir/ldns-src; cp $srcdir/ldns-src.tar.gz $srcdir/ldns-src/ldns-src.tar.gz; (cd $srcdir/ldns-src; gzip -cd ldns-src.tar.gz | tar xf -); rm -f $srcdir/ldns-src/ldns-src.tar.gz; mv $srcdir/ldns-src $srcdir/ldns-srcb; mv $srcdir/ldns-srcb/ldns* $srcdir/ldns-src; rmdir $srcdir/ldns-srcb
-ldnsdir="ldns-src"
-AC_MSG_NOTICE([Configure $ldnsdir scheduled after config.status])
-AC_CONFIG_SUBDIRS([ldns-src])
-CPPFLAGS="-I$ldnsdir/include $CPPFLAGS"
-LDFLAGS="$LDFLAGS $ldnsdir/*.lo"
-AC_SUBST(ldnsdir)
-fi  dnl end of use_ldns_builtin == yes
-
 ACX_STRIP_EXT_FLAGS
 LDFLAGS="$LATE_LDFLAGS $LDFLAGS"

@@ -7,8 +7,9 @@ Url: http://www.nlnetlabs.nl/unbound/
 Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
 #Source1: unbound.init
 Group: System Environment/Daemons
+Requires: ldns
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
-BuildRequires: flex, openssl-devel, expat-devel
+BuildRequires: flex, openssl-devel, expat-devel, ldns-devel

 %description
 Unbound is a validating, recursive, and caching DNS resolver.
@@ -28,11 +29,7 @@ The source code is under a BSD License.

 # configure with /var/unbound/unbound.conf so that all default chroot, 
 # pidfile and config file are in /var/unbound, ready for chroot jail set up.
-#
-# This is a build using libldns builtin version, the resulting binaries
-# do not require libldns and this package does not have version dependencies.
-# Could be smaller using a dependency on libldns (use --with-ldns=).
-%configure --with-conf-file=%{_localstatedir}/%{name}/unbound.conf --disable-rpath --with-ldns-builtin
+%configure --with-conf-file=%{_localstatedir}/%{name}/unbound.conf --disable-rpath

 %build
 #%{__make} %{?_smp_mflags}
@@ -92,6 +89,9 @@ if [ "$1" -ge "1" ]; then
 fi

 %changelog
+* Thu Jul 13 2011 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.4.8
+- ldns required and ldns-devel required for build, no more ldns-builtin.
+
 * Thu Mar 17 2011 Wouter Wijngaards <wouter@nlnetlabs.nl> - 1.4.8
 - removed --disable-gost, assume recent openssl on the destination platform.

@@ -8,7 +8,7 @@

 Summary: Validating, recursive, and caching DNS(SEC) resolver
 Name: unbound
-Version: 1.4.2
+Version: 1.4.13
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
@@ -16,16 +16,20 @@ Source: http://www.unbound.net/downloads/%{name}-%{version}.tar.gz
 Source1: unbound.init
 Source2: unbound.conf
 Source3: unbound.munin
-Source4: dlv.isc.org.key
+Source4: unbound_munin_
+Source5: root.key
+Source6: dlv.isc.org.key
 Patch1: unbound-1.2-glob.patch

 Group: System Environment/Daemons
 BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires: flex, openssl-devel , ldns-devel >= 1.5.0, 
-BuildRequires: libevent-devel 
+BuildRequires: libevent-devel expat-devel
 %if %{with_python}
-BuildRequires:  python-devel
+BuildRequires:  python-devel swig
 %endif
+# Required for SVN versions
+# BuildRequires: bison

 Requires(post): chkconfig
 Requires(preun): chkconfig
@@ -34,6 +38,9 @@ Requires(postun): initscripts
 Requires: ldns >= 1.5.0
 Requires(pre): shadow-utils

+Obsoletes:      dnssec-conf < 1.27-2
+Provides:       dnssec-conf = 1.27-1
+
 %description
 Unbound is a validating, recursive, and caching DNS(SEC) resolver.

@@ -67,7 +74,7 @@ Summary: Libraries used by the unbound server and client applications
 Group: Applications/System
 Requires(post): /sbin/ldconfig
 Requires(postun): /sbin/ldconfig
-Requires: openssl >= 0.9.8g-12
+Requires: openssl 

 %description libs
 Contains libraries used by the unbound server and client applications
@@ -88,14 +95,14 @@ Python modules and extensions for unbound

 %build
 %configure  --with-ldns= --with-libevent --with-pthreads --with-ssl \
-            --disable-rpath --enable-debug --disable-static \
+            --disable-rpath --disable-static \
            --with-conf-file=%{_sysconfdir}/%{name}/unbound.conf \
            --with-pidfile=%{_localstatedir}/run/%{name}/%{name}.pid \
 %if %{with_python}
            --with-pythonmodule --with-pyunbound \
 %endif
-            --enable-sha2 
-%{__make} 
+            --enable-sha2 --disable-gost
+%{__make} %{?_smp_mflags}

 %install
 rm -rf %{buildroot}
@@ -107,16 +114,19 @@ install -m 0755 %{SOURCE2} %{buildroot}%{_sysconfdir}/unbound
 install -d 0755 %{buildroot}%{_sysconfdir}/munin/plugin-conf.d
 install -m 0644 %{SOURCE3} %{buildroot}%{_sysconfdir}/munin/plugin-conf.d/unbound
 install -d 0755 %{buildroot}%{_datadir}/munin/plugins/
-install -m 0755 contrib/unbound_munin_ %{buildroot}%{_datadir}/munin/plugins/unbound
+install -m 0755 %{SOURCE4} %{buildroot}%{_datadir}/munin/plugins/unbound
 for plugin in unbound_munin_hits unbound_munin_queue unbound_munin_memory unbound_munin_by_type unbound_munin_by_class unbound_munin_by_opcode unbound_munin_by_rcode unbound_munin_by_flags unbound_munin_histogram; do
    ln -s unbound %{buildroot}%{_datadir}/munin/plugins/$plugin
 done 

-# install DLV key
-install -m 0644 %{SOURCE4} %{buildroot}%{_sysconfdir}/unbound/
+# install root and DLV key
+install -m 0644 %{SOURCE5} %{SOURCE6} %{buildroot}%{_sysconfdir}/unbound/

 # remove static library from install (fedora packaging guidelines)
-rm -rf %{buildroot}%{_libdir}/*.la
+rm %{buildroot}%{_libdir}/*.la
+%if %{with_python}
+rm %{buildroot}%{python_sitearch}/*.la
+%endif

 mkdir -p %{buildroot}%{_localstatedir}/run/unbound

@@ -128,15 +138,19 @@ rm -rf ${RPM_BUILD_ROOT}
 %doc doc/README doc/CREDITS doc/LICENSE doc/FEATURES
 %attr(0755,root,root) %{_initrddir}/%{name}
 %attr(0755,root,root) %dir %{_sysconfdir}/%{name}
-%attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
+%ghost %attr(0755,unbound,unbound) %dir %{_localstatedir}/run/%{name}
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/unbound.conf
 %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/dlv.isc.org.key
+%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/%{name}/root.key
 %{_sbindir}/*
 %{_mandir}/*/*

 %if %{with_python}
 %files python
-%{python_sitelib}/*
+%defattr(-,root,root,-)
+%{python_sitearch}/*
+%doc libunbound/python/examples/*
+%doc pythonmod/examples/*
 %endif

 %files munin
@@ -186,10 +200,90 @@ fi
 %postun libs -p /sbin/ldconfig

 %changelog
+* Tue Sep 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.13-1
+- Updated to 1.4.13
+- Fix install location of pythonmod from sitelib to sitearch
+- Removed patches merged in by upstream
+- Removed versioned openssl dep, it differs per branch
+ 
+* Mon Aug 08 2011 Paul Wouters <paul@xelerance.com> - 1.4.12-3
+- Added pythonmod docs and examples
+- Fix for python module load in the server (Tom Hendrikx)
+- No longer enable --enable-debug as it causes degraded  performance
+  under load.
+
+* Mon Jul 18 2011 Paul Wouters <paul@xelerance.com> - 1.4.12-1
+- Updated to 1.4.12
+
+* Sun Jul 03 2011 Paul Wouters <paul@xelerance.com> - 1.4.11-1
+- Updated to 1.4.11
+- removed integrated CVE patch
+- updated stock unbound.conf for new options introduced
+
+* Mon Jun 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.10-1
+- Added ghost for /var/run/unbound (bz#656710)
+
+* Mon Jun 06 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-3
+- rebuilt
+
+* Wed May 25 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-2
+- Applied patch for CVE-2011-1922 DoS vulnerability
+
+* Sun Mar 27 2011 Paul Wouters <paul@xelerance.com> - 1.4.9-1
+- Updated to 1.4.9
+
+* Sat Feb 12 2011 Paul Wouters <paul@xelerance.com> - 1.4.8-2
+- rebuilt
+
+* Tue Jan 25 2011 Paul Wouters <paul@xelerance.com> - 1.4.8-1
+- Updated to 1.4.8
+- Enable root key for DNSSEC
+- Fix unbound-munin to use proper file (could cause excessive logging)
+- Build unbound-python per default
+- Disable gost as Fedora/EPEL does not allow ECC and has mangled openssl
+
+* Tue Oct 26 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-4
+- Revert last build - it was on the wrong branch
+
+* Tue Oct 26 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-3
+- Disable do-ipv6 per default - causes severe degradation on non-ipv6 machines
+  (see comments in inbound.conf)
+
+* Tue Jun 15 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-2
+- Bump release - forgot to upload the new tar ball.
+
+* Tue Jun 15 2010 Paul Wouters <paul@xelerance.com> - 1.4.5-1
+- Upgraded to 1.4.5
+
+* Mon May 31 2010 Paul Wouters <paul@xelerance.com> - 1.4.4-2
+- Added accidentally omitted svn patches to cvs 
+
+* Mon May 31 2010 Paul Wouters <paul@xelerance.com> - 1.4.4-1
+- Upgraded to 1.4.4 with svn patches
+- Obsolete dnssec-conf to ensure it is de-installed
+
+* Thu Mar 11 2010 Paul Wouters <paul@xelerance.com> - 1.4.3-1
+- Update to 1.4.3 that fixes 64bit crasher
+
+* Tue Mar 09 2010 Paul Wouters <paul@xelerance.com> - 1.4.2-1
+- Updated to 1.4.2 
+- Updated unbound.conf with new options
+- Enabled pre-fetching DNSKEY records (DNSSEC speedup)
+- Enabled re-fetching popular records before they expire
+- Enabled logging of DNSSEC validation errors
+
+* Mon Mar 01 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-5
+- Overriding -D_GNU_SOURCE is no longer needed. This fixes DSO issues
+  with pthreads
+
+* Wed Feb 24 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-3
+- Change make/configure lines to attempt to fix -lphtread linking issue
+
 * Thu Feb 18 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-2
 - Removed dependancy for dnssec-conf
 - Added ISC DLV key (formerly in dnssec-conf)
 - Fixup old DLV locations in unbound.conf file via %%post
+- Fix parent child disagreement handling and no-ipv6 present [svn r1953]

 * Tue Jan 05 2010 Paul Wouters <paul@xelerance.com> - 1.4.1-1
 - Updated to 1.4.1
@@ -326,7 +326,7 @@ daemon_create_workers(struct daemon* daemon)
 	numport = daemon_get_shufport(daemon, shufport);
 	verbose(VERB_ALGO, "total of %d outgoing ports available", numport);
 	
-	daemon->num = daemon->cfg->num_threads;
+	daemon->num = (daemon->cfg->num_threads?daemon->cfg->num_threads:1);
 	daemon->workers = (struct worker**)calloc((size_t)daemon->num, 
 		sizeof(struct worker*));
 	for(i=0; i<daemon->num; i++) {
@@ -395,7 +395,6 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	/* create new commpoint unless we are servicing already */
 	if(rc->active >= rc->max_active) {
 		log_warn("drop incoming remote control: too many connections");
-		comm_point_stop_listening(c);
 	close_exit:
 #ifndef USE_WINSOCK
 		close(newfd);
@@ -429,6 +428,7 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	n->ssl = SSL_new(rc->ctx);
 	if(!n->ssl) {
 		log_crypto_err("could not SSL_new");
+		comm_point_delete(n->c);
 		free(n);
 		goto close_exit;
 	}
@@ -437,6 +437,7 @@ int remote_accept_callback(struct comm_point* c, void* arg, int err,
 	if(!SSL_set_fd(n->ssl, newfd)) {
 		log_crypto_err("could not SSL_set_fd");
 		SSL_free(n->ssl);
+		comm_point_delete(n->c);
 		free(n);
 		goto close_exit;
 	}
@@ -199,7 +199,7 @@ checkrlimits(struct config_file* cfg)
 #if !defined(HAVE_PTHREAD) && !defined(HAVE_SOLARIS_THREADS)
 	int numthread = 1; /* it forks */
 #else
-	int numthread = cfg->num_threads;
+	int numthread = (cfg->num_threads?cfg->num_threads:1);
 #endif
 	size_t total = numthread * perthread + misc;
 	size_t avail;
@@ -739,17 +739,21 @@ worker_handle_request(struct comm_point* c, void* arg, int error,
 			worker->stats.unwanted_queries++;
 		return 0;
 	} else if(acl == acl_refuse) {
+		log_addr(VERB_ALGO, "refused query from",
+			&repinfo->addr, repinfo->addrlen);
+		log_buf(VERB_ALGO, "refuse", c->buffer);
+		if(worker->stats.extended)
+			worker->stats.unwanted_queries++;
+		if(worker_check_request(c->buffer, worker) == -1) {
+			comm_point_drop_reply(repinfo);
+			return 0; /* discard this */
+		}
 		ldns_buffer_set_limit(c->buffer, LDNS_HEADER_SIZE);
 		ldns_buffer_write_at(c->buffer, 4, 
 			(uint8_t*)"\0\0\0\0\0\0\0\0", 8);
 		LDNS_QR_SET(ldns_buffer_begin(c->buffer));
 		LDNS_RCODE_SET(ldns_buffer_begin(c->buffer), 
 			LDNS_RCODE_REFUSED);
-		log_addr(VERB_ALGO, "refused query from",
-			&repinfo->addr, repinfo->addrlen);
-		log_buf(VERB_ALGO, "refuse", c->buffer);
-		if(worker->stats.extended)
-			worker->stats.unwanted_queries++;
 		return 1;
 	}
 	if((ret=worker_check_request(c->buffer, worker)) != 0) {
@@ -1251,8 +1255,9 @@ worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(worker->back, qname,
 		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
-		addr, addrlen, worker_handle_service_reply, e, 
-		worker->back->udp_buff, &outbound_entry_compare);
+		q->env->cfg->tcp_upstream, addr, addrlen,
+		worker_handle_service_reply, e, worker->back->udp_buff,
+		&outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -1,3 +1,97 @@
+12 September 2011: Wouter
+	- Reverted dns EDNS backoff fix, it did not help and needs
+	  fragmentation fixes instead.
+	- tag 1.4.13rc2
+
+7 September 2011: Wouter
+	- Fix operation in ipv6 only (do-ip4: no) mode.
+
+6 September 2011: Wouter
+	- fedora specfile updated.
+
+5 September 2011: Wouter
+	- tag 1.4.13rc1
+
+2 September 2011: Wouter
+	- iana portlist updated.
+
+26 August 2011: Wouter
+	- Fix num-threads 0 does not segfault, reported by Simon Deziel.
+	- Fix validation failures due to EDNS backoff retries, the retry
+	  for fetch of data has want_dnssec because the iter_indicate_dnssec
+	  function returns true when validation failure retry happens, and
+	  then the serviced query code does not fallback to noEDNS, even if
+	  the cache says it has this.  This helps for DLV deployment when
+	  the DNSSEC status is not known for sure before the lookup concludes.
+
+24 August 2011: Wouter
+	- Applied patch from Karel Slany that fixes a memory leak in the
+	  unbound python module, in string conversions.
+
+22 August 2011: Wouter
+	- Fix validation of qtype ANY responses with CNAMEs (thanks Cathy
+	  Zhang and Luo Ce).  Unbound responds with the RR types that are
+	  available at the name for qtype ANY and validates those RR types.
+	  It does not test for completeness (i.e. with NSEC or NSEC3 query),
+	  and it does not follow the CNAME or DNAME to another name (with
+	  even more data for the already large response).
+	- Fix that internally, CNAMEs with NXDOMAIN have that as rcode.
+	- Documented the options that work with control set_option command.
+	- tcp-upstream yes/no option (works with set_option) for tunnels.
+
+18 August 2011: Wouter
+	- fix autoconf call in makedist crosscompile to RC or snapshot.
+
+17 August 2011: Wouter
+	- Fix validation of . DS query.
+	- new xml format at IANA, new awk for iana_update.
+	- iana portlist updated.
+
+10 August 2011: Wouter
+	- Fix python site-packages path to /usr/lib64.
+	- updated patch from Tom.
+	- fix memory and fd leak after out-of-memory condition.
+
+9 August 2011: Wouter
+	- patch from Tom Hendrikx fixes load of python modules.
+
+8 August 2011: Wouter
+	- make clean had ldns-src reference, removed.
+
+1 August 2011: Wouter
+	- Fix autoconf 2.68 warnings
+
+14 July 2011: Wouter
+	- Unbound implements RFC6303 (since version 1.4.7).
+	- tag 1.4.12rc1 is released as 1.4.12 (without the other fixes in the
+	  meantime, those are for 1.4.13).
+	- iana portlist updated.
+
+13 July 2011: Wouter
+	- Quick fix for contrib/unbound.spec example, no ldns-builtin any more.
+
+11 July 2011: Wouter
+	- Fix wildcard expansion no-data reply under an optout NSEC3 zone is
+	  validated as insecure, reported by Jia Li (lijia@cnnic.cn).
+
+4 July 2011: Wouter
+	- 1.4.12rc1 tag created.
+
+1 July 2011: Wouter
+	- version number in example config file.
+	- fix that --enable-static-exe does not complain about it unknown.
+
+30 June 2011: Wouter
+	- tag relase 1.4.11, trunk is 1.4.12 development.
+	- iana portlist updated.
+	- fix bug#395: id bits of other query may leak out under conditions
+	- fix replyaddr count wrong after jostled queries, which leads to
+	  eventual starvation where the daemon has no replyaddrs left to use.
+	- fix comment about rndc port, that referred to the old port number.
+	- fix that the listening socket is not closed when too many remote
+	  control connections are made at the same time.
+	- removed ldns-src tarball inside the unbound tarball.
+
 23 June 2011: Wouter
 	- Changed -flto check to support clang compiler.
 	- tag 1.4.11rc3 created.
@@ -11,16 +11,14 @@ This software is under BSD license, see LICENSE for details.

 * Uses the following libraries; 
  * ldns	http://www.nlnetlabs.nl/ldns/			(BSD license)
-    (required) can use tarball from source directory.
+    (required) can use ldns build directory directly with --with-ldns=path.
  * libevent	http://www.monkey.org/~provos/libevent/		(BSD license)
    (optional) can use builtin alternative instead.

 * Make and install: ./configure; make; make install
  * Use GNU make; default on linux, often called 'gmake' on BSD and Solaris.
  * --with-ldns=/path/to/ldns
-  	If ldns is not detected on the system, a prepackaged tarball
-	of the ldns library is used to compile and statically link against.
-	If detected on the system, it will dynamically link against it.
+	It will dynamically link against it.
  * --with-libevent=/path/to/libevent
  	Can be set to either the system install or the build directory.
 	--with-libevent=no (default) gives a builtin alternative 
@@ -1,7 +1,7 @@
 #
 # Example configuration file.
 #
-# See unbound.conf(5) man page.
+# See unbound.conf(5) man page, version @version@.
 #
 # this is a comment.

@@ -153,6 +153,10 @@ server:
 	# Enable TCP, "yes" or "no".
 	# do-tcp: yes

+	# upstream connections use TCP only (and no UDP), "yes" or "no"
+	# useful for tunneling scenarios, default no.
+	# tcp-upstream: no
+
 	# Detach from the terminal, run in background, "yes" or "no".
 	# do-daemonize: yes

@@ -151,17 +151,31 @@ and lameness data.
 Show the contents of the infra cache.
 .TP
 .B set_option \fIopt: val
-Set the option to the given value without a reload.  The cache is therefore
-not flushed.  The option must end with a ':' and whitespace must be between the
-option and the value.  Some values may not have an effect if set this way,
-the new values are not written to the config file, not all options are supported.
+Set the option to the given value without a reload.  The cache is
+therefore not flushed.  The option must end with a ':' and whitespace
+must be between the option and the value.  Some values may not have an
+effect if set this way, the new values are not written to the config file,
+not all options are supported.  This is different from the set_option call
+in libunbound, where all values work because unbound has not been inited.
+.IP
+The values that work are: statistics\-interval, statistics\-cumulative,
+do\-not\-query\-localhost, harden\-short\-bufsize, harden\-large\-queries,
+harden\-glue, harden\-dnssec\-stripped, harden\-below\-nxdomain,
+harden\-referral\-path, prefetch, prefetch\-key, log\-queries,
+hide\-identity, hide\-version, identity, version, val\-log\-level,
+val\-log\-squelch, ignore\-cd\-flag, add\-holddown, del\-holddown,
+keep\-missing, tcp\-upstream.
 .TP
 .B get_option \fIopt
 Get the value of the option.  Give the option name without a trailing ':'.
-The value is printed.  If the value is "", nothing is printed and the
-connection closes.  On error 'error ...' is printed (it gives a syntax
-error on unknown option).  For some options a list of values, one on
-each line, is printed.  Not all options are supported.
+The value is printed.  If the value is "", nothing is printed
+and the connection closes.  On error 'error ...' is printed (it gives
+a syntax error on unknown option).  For some options a list of values,
+one on each line, is printed.  The options are shown from the config file
+as modified with set_option.  For some options an override may have been
+taken that does not show up with this command, not results from e.g. the
+verbosity and forward control commands.  Not all options work, see list_stubs,
+list_forwards, list_local_zones and list_local_data for those.
 .TP
 .B list_stubs
 List the stub zones in use.  These are printed one by one to the output.
@@ -300,6 +300,10 @@ Enable or disable whether UDP queries are answered or issued. Default is yes.
 .B do\-tcp: \fI<yes or no>
 Enable or disable whether TCP queries are answered or issued. Default is yes.
 .TP
+.B tcp\-upstream: \fI<yes or no>
+Enable or disable whether the upstream queries use TCP only for transport.
+Default is no.  Useful in tunneling scenarios.
+.TP
 .B do\-daemonize: \fI<yes or no>
 Enable or disable whether the unbound server forks into the background as
 a daemon. Default is yes.
@@ -894,10 +898,9 @@ By default localhost (127.0.0.1 and ::1) is listened to.
 Use 0.0.0.0 and ::0 to listen to all interfaces.
 .TP 5
 .B control\-port: <port number>
-The port number to listen on for control commands, default is 8953
-(that is the same port number named uses to listen to rndc).
-If you change this port number, and permissions have been dropped, a
-reload is not sufficient to open the port again, you must then restart.
+The port number to listen on for control commands, default is 8953.
+If you change this port number, and permissions have been dropped,
+a reload is not sufficient to open the port again, you must then restart.
 .TP 5
 .B server\-key\-file: "<private key file>"
 Path to the server private key, by default unbound_server.key.
@@ -482,3 +482,13 @@ void delegpt_no_ipv6(struct delegpt* dp)
 			ns->resolved = 1;
 	}
 }
+
+void delegpt_no_ipv4(struct delegpt* dp)
+{
+	struct delegpt_ns* ns;
+	for(ns = dp->nslist; ns; ns = ns->next) {
+		/* no ipv4, so only ipv6 is enough to resolve a nameserver */
+		if(ns->got6)
+			ns->resolved = 1;
+	}
+}
@@ -339,4 +339,11 @@ void delegpt_add_neg_msg(struct delegpt* dp, struct msgreply_entry* msg);
 */
 void delegpt_no_ipv6(struct delegpt* dp);

+/**
+ * Register the fact that there is no ipv4 and thus As are not going 
+ * to be queried for or be useful.
+ * @param dp: the delegation point. Updated to reflect no ipv4.
+ */
+void delegpt_no_ipv4(struct delegpt* dp);
+
 #endif /* ITERATOR_ITER_DELEGPT_H */
@@ -54,6 +54,8 @@ response_type_from_cache(struct dns_msg* msg,
 	/* If the message is NXDOMAIN, then it is an ANSWER. */
 	if(FLAGS_GET_RCODE(msg->rep->flags) == LDNS_RCODE_NXDOMAIN)
 		return RESPONSE_TYPE_ANSWER;
+	if(request->qtype == LDNS_RR_TYPE_ANY)
+		return RESPONSE_TYPE_ANSWER;
 	
 	/* First we look at the answer section. This can tell us if this is
 	 * CNAME or positive ANSWER. */
@@ -117,6 +119,15 @@ response_type_from_server(int rdset,
 		if( (msg->rep->flags&BIT_RA) &&
 			!(msg->rep->flags&BIT_AA) && !rdset)
 				return RESPONSE_TYPE_REC_LAME;
+		/* it could be a CNAME with NXDOMAIN rcode */
+		for(i=0; i<msg->rep->an_numrrsets; i++) {
+			s = msg->rep->rrsets[i];
+			if(ntohs(s->rk.type) == LDNS_RR_TYPE_CNAME &&
+				query_dname_compare(request->qname,
+				s->rk.dname) == 0) {
+				return RESPONSE_TYPE_CNAME;
+			}
+		}
 		return RESPONSE_TYPE_ANSWER;
 	}
 	
@@ -179,6 +190,9 @@ response_type_from_server(int rdset,
 				get_cname_target(s, &mname, &mname_len);
 			}
 		}
+		/* not a referral, and qtype any, thus an answer */
+		if(request->qtype == LDNS_RR_TYPE_ANY)
+			return RESPONSE_TYPE_ANSWER;
 		/* if we encountered a CNAME (or a bunch of CNAMEs), and 
 		 * still got to here, then it is a CNAME response. 
 		 * (This is regardless of the AA bit at this point) */
@@ -363,10 +363,6 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 					"too long");
 				return 0;
 			}
-			/* internally we have CNAME'd/DNAME'd chains ending
-			 * in nxdomain with NOERROR rcode, change rcode
-			 * to reflect this (if needed) */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_NOERROR);
 			if(nx && nx->type == LDNS_RR_TYPE_CNAME && 
 			   dname_pkt_compare(pkt, sname, nx->dname) == 0) {
 				/* check next cname */
@@ -405,14 +401,21 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,

 		/* Follow the CNAME chain. */
 		if(rrset->type == LDNS_RR_TYPE_CNAME) {
+			uint8_t* oldsname = sname;
 			if(!parse_get_cname_target(rrset, &sname, &snamelen))
 				return 0;
 			prev = rrset;
 			rrset = rrset->rrset_all_next;
-			/* internally we have CNAME'd/DNAME'd chains ending
-			 * in nxdomain with NOERROR rcode, change rcode
-			 * to reflect this (if needed) */
-			FLAGS_SET_RCODE(msg->flags, LDNS_RCODE_NOERROR);
+			/* in CNAME ANY response, can have data after CNAME */
+			if(qinfo->qtype == LDNS_RR_TYPE_ANY) {
+				while(rrset && rrset->section ==
+					LDNS_SECTION_ANSWER &&
+					dname_pkt_compare(pkt, oldsname,
+					rrset->dname) == 0) {
+					prev = rrset;
+					rrset = rrset->rrset_all_next;
+				}
+			}
 			continue;
 		}

@@ -132,6 +132,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 		return 0;
 	}
 	iter_env->supports_ipv6 = cfg->do_ip6;
+	iter_env->supports_ipv4 = cfg->do_ip4;
 	return 1;
 }

@@ -150,6 +151,7 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
 *		o The address is bogus (DNSSEC validation failure).
 *		o Listed as donotquery
 *		o is ipv6 but no ipv6 support (in operating system).
+ *		o is ipv4 but no ipv4 support (in operating system).
 *		o is lame
 *	Otherwise, an rtt in milliseconds.
 *	0 .. USEFUL_SERVER_TOP_TIMEOUT-1
@@ -194,6 +196,9 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 	if(!iter_env->supports_ipv6 && addr_is_ip6(&a->addr, a->addrlen)) {
 		return -1; /* there is no ip6 available */
 	}
+	if(!iter_env->supports_ipv4 && !addr_is_ip6(&a->addr, a->addrlen)) {
+		return -1; /* there is no ip4 available */
+	}
 	/* check lameness - need zone , class info */
 	if(infra_get_lame_rtt(env->infra_cache, &a->addr, a->addrlen, 
 		name, namelen, qtype, &lame, &dnsseclame, &reclame, 
@@ -1367,7 +1367,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 			query_count++;
 		}
 		/* Send the A request. */
-		if(!ns->got4) {
+		if(ie->supports_ipv4 && !ns->got4) {
 			if(!generate_target_query(qstate, iq, id, 
 				ns->name, ns->namelen, 
 				LDNS_RR_TYPE_A, iq->qchase.qclass)) {
@@ -1476,7 +1476,7 @@ processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
 			ns->done_pside6 = 1;
 			query_count++;
 		}
-		if(!ns->done_pside4) {
+		if(ie->supports_ipv4 && !ns->done_pside4) {
 			/* Send the A request. */
 			if(!generate_parentside_target_query(qstate, iq, id, 
 				ns->name, ns->namelen, 
@@ -1556,6 +1556,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	}
 	if(!ie->supports_ipv6)
 		delegpt_no_ipv6(iq->dp);
+	if(!ie->supports_ipv4)
+		delegpt_no_ipv4(iq->dp);
 	delegpt_log(VERB_ALGO, iq->dp);

 	if(iq->num_current_queries>0) {
@@ -93,6 +93,9 @@ struct iter_env {
 	/** A flag to indicate whether or not we have an IPv6 route */
 	int supports_ipv6;

+	/** A flag to indicate whether or not we have an IPv4 route */
+	int supports_ipv4;
+
 	/** A set of inetaddrs that should never be queried. */
 	struct iter_donotq* donotq;

@@ -694,8 +694,9 @@ struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(w->back, qname,
 		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
-		addr, addrlen, libworker_handle_service_reply, e, 
-		w->back->udp_buff, &outbound_entry_compare);
+		q->env->cfg->tcp_upstream, addr, addrlen,
+		libworker_handle_service_reply, e, w->back->udp_buff,
+		&outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -56,6 +56,7 @@ Generate a distribution tar file for unbound.
    -l ldnsdir   Directory where ldns resides. Detected from Makefile.
    -wssl openssl.xx.tar.gz Also build openssl from tarball for windows dist.
    -wxp expat.xx.tar.gz Also build expat from tarball for windows dist.
+    -wldns ldns.xx.tar.gz Also build libldns from tarball for windows dist.
    -w ...       Build windows binary dist. last args passed to configure.
 EOF
    exit 1
@@ -137,6 +138,7 @@ LDNSDIR=""
 DOWIN="no"
 WINSSL=""
 WINEXPAT=""
+WINLDNS=""

 # Parse the command line arguments.
 while [ "$1" ]; do
@@ -151,6 +153,10 @@ while [ "$1" ]; do
        "-s")
            SNAPSHOT="yes"
            ;;
+        "-wldns")
+	    WINLDNS="$2"
+	    shift
+	    ;;
        "-wssl")
 	    WINSSL="$2"
 	    shift
@@ -187,8 +193,8 @@ if [ "$DOWIN" = "yes" ]; then
 	configure="mingw32-configure"
 	strip="i686-pc-mingw32-strip"
 	makensis="makensis"	# from mingw32-nsis package
-	# in crosscompile no installed ldns, use builtin (not linux-ldns)
-	cross_flag="--with-ldns-builtin"
+	# flags for crosscompiled dependency libraries
+	cross_flag=""

 	check_svn_root
 	create_temp_dir
@@ -214,6 +220,21 @@ if [ "$DOWIN" = "yes" ]; then
 		cd ..
 	fi

+	if test -n "$WINLDNS"; then
+		info "Cross compile $WINLDNS"
+		info "ldns tar unpack"
+		(cd ..; gzip -cd $WINLDNS) | tar xf - || error_cleanup "tar unpack of $WINLDNS failed"
+		cd ldns-* || error_cleanup "no ldns-X dir in tarball"
+		# we can use the cross_flag with openssl in it
+		info "ldns: Configure $cross_flag"
+		mingw32-configure  $cross_flag || error_cleanup "ldns configure failed"
+		info "ldns: make"
+		make || error_cleanup "ldns crosscompile failed"
+		# use from the build directory.
+		cross_flag="$cross_flag --with-ldns=`pwd`"
+		cd ..
+	fi
+
 	if test -n "$WINEXPAT"; then
 		info "Cross compile $WINEXPAT"
 		info "wxp: tar unpack"
@@ -259,7 +280,8 @@ if [ "$DOWIN" = "yes" ]; then
    	replace_text "configure.ac" "AC_INIT(unbound, $version" "AC_INIT(unbound, $version2"
    	version="$version2"
    	info "Rebuilding configure script (autoconf) snapshot."
-    	autoconf || autoheader || error_cleanup "Autoconf failed."
+    	autoconf || error_cleanup "Autoconf failed."
+    	autoheader || error_cleanup "Autoheader failed."
    	rm -r autom4te* || echo "ignored"
    fi

@@ -410,6 +432,7 @@ replace_all doc/unbound-checkconf.8.in
 replace_all doc/unbound-control.8.in
 replace_all doc/unbound-anchor.8.in
 replace_all doc/unbound-host.1
+replace_all doc/example.conf.in
 replace_all doc/libunbound.3.in

 info "Renaming Unbound directory to unbound-$version."
@@ -868,6 +868,15 @@ void log_dns_msg(const char* str, struct query_info* qinfo, struct reply_info* r
 void log_query_info(enum verbosity_value v, const char* str, struct query_info* qinf);
 void regional_log_stats(struct regional *r);

+// Free allocated memory from marked sources returning corresponding types
+%typemap(newfree, noblock = 1) char * {
+  free($1);
+}
+
+// Mark as source returning newly allocated memory
+%newobject ldns_rr_type2str;
+%newobject ldns_rr_class2str;
+
 // LDNS functions
 char *ldns_rr_type2str(const uint16_t atype);
 char *ldns_rr_class2str(const uint16_t aclass);
@@ -153,6 +153,8 @@ int pythonmod_init(struct module_env* env, int id)
   }
   PyRun_SimpleString("sys.path.append('"RUN_DIR"') \n");
   PyRun_SimpleString("sys.path.append('"SHARE_DIR"') \n");
+   PyRun_SimpleString("import distutils.sysconfig \n");
+   PyRun_SimpleString("sys.path.append(distutils.sysconfig.get_python_lib(1,0)) \n");
   if (PyRun_SimpleString("from unboundmodule import *\n") < 0)
   {
      log_err("pythonmod: cannot initialize core module: unboundmodule.py"); 
@@ -612,6 +612,8 @@ lz_enter_defaults(struct local_zones* zones, struct config_file* cfg,
 {
 	struct local_zone* z;

+	/* this list of zones is from RFC 6303 */
+
 	/* localhost. zone */
 	if(!lz_exists(zones, "localhost.") &&
 		!lz_nodefault(cfg, "localhost.")) {
@@ -528,22 +528,24 @@ mesh_state_cleanup(struct mesh_state* mstate)
 	int i;
 	if(!mstate)
 		return;
+	mesh = mstate->s.env->mesh;
 	/* drop unsent replies */
 	if(!mstate->replies_sent) {
 		struct mesh_reply* rep;
 		struct mesh_cb* cb;
 		for(rep=mstate->reply_list; rep; rep=rep->next) {
 			comm_point_drop_reply(&rep->query_reply);
+			mesh->num_reply_addrs--;
 		}
 		for(cb=mstate->cb_list; cb; cb=cb->next) {
 			fptr_ok(fptr_whitelist_mesh_cb(cb->cb));
 			(*cb->cb)(cb->cb_arg, LDNS_RCODE_SERVFAIL, NULL,
 				sec_status_unchecked, NULL);
+			mesh->num_reply_addrs--;
 		}
 	}

 	/* de-init modules */
-	mesh = mstate->s.env->mesh;
 	for(i=0; i<mesh->mods.num; i++) {
 		fptr_ok(fptr_whitelist_mod_clear(mesh->mods.mod[i]->clear));
 		(*mesh->mods.mod[i]->clear)(&mstate->s, i);
@@ -1693,7 +1693,7 @@ callback_list_find(struct serviced_query* sq, void* cb_arg,
 struct serviced_query* 
 outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, int want_dnssec,
+	uint16_t flags, int dnssec, int want_dnssec, int tcp_upstream,
 	struct sockaddr_storage* addr, socklen_t addrlen, 
 	comm_point_callback_t* callback, void* callback_arg, 
 	ldns_buffer* buff, int (*arg_compare)(void*,void*))
@@ -1719,7 +1719,7 @@ outnet_serviced_query(struct outside_network* outnet,
 			return NULL;
 		}
 		/* perform first network action */
-		if(outnet->do_udp) {
+		if(outnet->do_udp && !tcp_upstream) {
 			if(!serviced_udp_send(sq, buff)) {
 				(void)rbtree_delete(outnet->serviced, sq);
 				free(sq->qbuf);
@@ -435,6 +435,7 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
 *	If the value includes BIT_DO, DO bit is set when in EDNS queries.
 * @param want_dnssec: signatures are needed, without EDNS the answer is
 * 	likely to be useless.
+ * @param tcp_upstream: use TCP for upstream queries.
 * @param callback: callback function.
 * @param callback_arg: user argument to callback function.
 * @param addr: to which server to send the query.
@@ -447,7 +448,7 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
 */
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, int want_dnssec,
+	uint16_t flags, int dnssec, int want_dnssec, int tcp_upstream,
 	struct sockaddr_storage* addr, socklen_t addrlen, 
 	comm_point_callback_t* callback, void* callback_arg, 
 	ldns_buffer* buff, int (*arg_compare)(void*,void*));
@@ -318,7 +318,7 @@ morechecks(struct config_file* cfg, const char* fname)

 	if(cfg->verbosity < 0)
 		fatal_exit("verbosity value < 0");
-	if(cfg->num_threads < 0 || cfg->num_threads > 10000)
+	if(cfg->num_threads <= 0 || cfg->num_threads > 10000)
 		fatal_exit("num_threads value weird");
 	if(!cfg->do_ip4 && !cfg->do_ip6)
 		fatal_exit("ip4 and ip6 are both disabled, pointless");
@@ -81,7 +81,7 @@ while test $# -ne 0; do
 	echo "	-d dir	use directory to store keys and certificates."
 	echo "		default: $DESTDIR"
 	echo "please run this command using the same user id that the "
-	echo "unboun daemon uses, it needs read privileges."
+	echo "unbound daemon uses, it needs read privileges."
 	exit 1
 	;;
 	esac
@@ -1007,8 +1007,8 @@ pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
        uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
 	uint16_t flags, int dnssec, int ATTR_UNUSED(want_dnssec),
-	struct sockaddr_storage* addr, socklen_t addrlen, 
-	comm_point_callback_t* callback, void* callback_arg, 
+	int ATTR_UNUSED(tcp_upstream), struct sockaddr_storage* addr,
+	socklen_t addrlen, comm_point_callback_t* callback, void* callback_arg, 
 	ldns_buffer* ATTR_UNUSED(buff), int (*arg_compare)(void*,void*))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
@@ -0,0 +1,161 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with response to qtype ANY that includes CNAME
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN ANY
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN ANY
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN ANY
+SECTION ANSWER
+www.example.com.	3600	IN	CNAME	serf.example.com.
+www.example.com.	3600	IN	RRSIG	CNAME 3 3 3600 20070926134150 20070829134150 2854 example.com. AH/qSA7et6tXS08u4UUsWmXbIedGFpBKhiCqqVAgV8Z95dgn/vrB5ag= ;{id = 2854}
+www.example.com.	18000	IN	NSEC	example.com. CNAME RRSIG NSEC 
+www.example.com.	18000	IN	RRSIG	NSEC 3 3 18000 20070926134150 20070829134150 2854 example.com. ACqeCl/aLq90zkeSfneQY+HnvJTUAeyTF03HWdXr3WhnYzupKAdnuQ4= ;{id = 2854}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+serf.example.com. IN ANY
+SECTION ANSWER
+serf.example.com.	3600	IN	A	192.0.2.1
+serf.example.com.	3600	IN	RRSIG	A 3 3 3600 20070926134150 20070829134150 2854 example.com. AGLOiUcDNkSCplT07hT8szlUfMHNfPh6/104ydBt4bJ6UcfXUiM3pV8= ;{id = 2854}
+serf.example.com.	18000	IN	NSEC	www.example.com. A RRSIG NSEC 
+serf.example.com.	18000	IN	RRSIG	NSEC 3 3 18000 20070926134150 20070829134150 2854 example.com. AEBNiqg7Uz+NfNvoyA4KjkqJPb7hrjyS7oPE2MGNgVwUgQrcRIxd7DA= ;{id = 2854}
+SECTION AUTHORITY
+SECTION ADDITIONAL
+ENTRY_END
+
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+MATCH TCP
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN ANY
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.example.com. IN ANY
+SECTION ANSWER
+www.example.com.	3600	IN	CNAME	serf.example.com.
+www.example.com.	3600	IN	RRSIG	CNAME 3 3 3600 20070926134150 20070829134150 2854 example.com. AH/qSA7et6tXS08u4UUsWmXbIedGFpBKhiCqqVAgV8Z95dgn/vrB5ag= ;{id = 2854}
+www.example.com.	18000	IN	NSEC	example.com. CNAME RRSIG NSEC 
+www.example.com.	18000	IN	RRSIG	NSEC 3 3 18000 20070926134150 20070829134150 2854 example.com. ACqeCl/aLq90zkeSfneQY+HnvJTUAeyTF03HWdXr3WhnYzupKAdnuQ4= ;{id = 2854}
+ENTRY_END
+
+SCENARIO_END
@@ -133,7 +133,7 @@ ENTRY_END
 STEP 10 CHECK_ANSWER
 ENTRY_BEGIN
 MATCH all
-REPLY QR RD RA AD NOERROR
+REPLY QR RD RA NOERROR
 SECTION QUESTION
 a.z.w.example.      IN AAAA
 SECTION ANSWER
@@ -172,6 +172,52 @@ onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070
 22bqk3tb4foaenfbp1v0pdk6mor3r7vo.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jk6EYU9qTrmNeeKuQRG7iKyfNJnBt45MToPVpAQ+LoGDC3muy4bkWeKspj68cN9E5wNijfmm1eFK3khSSEnM50mfJbpiwlbKgL0VZz33Zn+Wu8b7sTtdDwDH7MUBLRwHeb7W+NtQIEXPLs4Z3BXHzAXy5ZpSjQ3PJZn6zBx4/dw= ;{id = 57024}
 SECTION ADDITIONAL
 ENTRY_END
+
+; wildcard expansion
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.wild.example.com. IN A
+SECTION ANSWER
+; *.wild.example.com. IN A 77.88.99.0
+a.wild.example.com. IN A 77.88.99.0
+a.wild.example.com.	3600	IN	RRSIG	A 7 3 3600 20070926134150 20070829134150 57024 example.com. GWV6cQprrpAsaYla5z7N9tppdb+X0ZjOsiWBuBueSACHU8CzsYPMbwKUZlTNbQ4mSVRRDa0rM1niYoZF9oqyAfbn5HBLi62TRjrBLHfvatDgSiZCa4mauUfzUS+U7FfUXikNIigG0aN0xdpJ//urmecjNSKg2aW4M0DYsm7keMI= ;{id = 57024}
+SECTION AUTHORITY
+; a.wild.example.com -> ad1535hlgg914unuuaei9jfh4ofr44uo.  covered by optout
+ac1535hlgg914unuuaei9jfh4ofr44uo.example.com. IN NSEC3 1 1 0 - ae1535hlgg914unuuaei9jfh4ofr44uo NS RRSIG
+ac1535hlgg914unuuaei9jfh4ofr44uo.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. imoxsXE1c3FaXu6uSantJfMPGBgsauf1GhmNpS1lLuaNRjXOhf1PDXwt/GoD/dm2GXJAlWT8u6EK3RXkFwlDIsP7vYFuDfUNCQ/hvYq300sXl1nfW0O1bsoBJahQJuNM+xcbwbnQf0krCTxNthyi2cuiY7RYug6ZTZ3gz4DMkhU= ;{id = 57024}
+; for wild.example.com the closest encloser
+; wild.example.com -> 8aeigskl5tmraedgji7v1lqbmqs8qv7u.
+8aeigskl5tmraedgji7v1lqbmqs8qv7u.example.com. IN NSEC3 1 1 0 - 9aeigskl5tmraedgji7v1lqbmqs8qv7u
+8aeigskl5tmraedgji7v1lqbmqs8qv7u.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. afV7c9knpxmD5c6UKrqw5J/06eokPwSb3HZi3TI63tzFcswuMjj4d7NKJmdpA+uo0aweVZgcOp+O+v9urgNYNYbxOy02qqOetLph8YWH7MQTftaGBwKD7gZMbnUArryPCtrlJz0i0GzoWvVTZnsjrrlDtP/ogLDnCKyi7Q0si+k= ;{id = 57024}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+a.wild.example.com. IN MX
+SECTION ANSWER
+SECTION AUTHORITY
+; wildcard no data
+example.com. IN SOA ns.example.com. noc.example.com. 2009310622 1800 900 604800 86400
+example.com.	3600	IN	RRSIG	SOA 7 2 3600 20070926134150 20070829134150 57024 example.com. HlyER7bYPiSJ9jdjjRBucQexYr932Oor1TvxSLPWw5fuWvr/fFitKVnLqC+lqBIeOby44KiDr0rIk+ZqYjWWKNjaLm5wMfhQzbsAgGTQxmO07jnYOGQG9SI6DSbR9GJdZ7imu5sx5oo5dze73MxgLMZIethGaFMkktYN53+AzG0= ;{id = 57024}
+; wild.example.com -> 8aeigskl5tmraedgji7v1lqbmqs8qv7u.
+; *.wild.example.com. -> nvec78au1hpuma9eebeji5n06eq33gbk.
+; the NSEC3 for the wildcard *.wild.example.com. , with optout, A RRSIG
+nvec78au1hpuma9eebeji5n06eq33gbk.example.com. IN NSEC3 1 1 0 - ovec78au1hpuma9eebeji5n06eq33gbk A RRSIG
+nvec78au1hpuma9eebeji5n06eq33gbk.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jE+b5p+stQumm+tLZdaBT+KBpwYI7wRXijRHWcqiUp2SY1uV7HxBdW8aedVTqpFe8kYbMUgI3pCOAitmiI9R6SJg3q7022QOb9y+0/xSmIDqxATVPTJbkzVBInfWrulRtn7o3HmOyoIc9/w7NnNxFYpwtFL08jTBRr8XRTWDM7Q= ;{id = 57024}
+; NSEC3 for the closest encloser, wild.example.com. (an empty nonterminal)
+8aeigskl5tmraedgji7v1lqbmqs8qv7u.example.com. IN NSEC3 1 1 0 - 9aeigskl5tmraedgji7v1lqbmqs8qv7u
+8aeigskl5tmraedgji7v1lqbmqs8qv7u.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. afV7c9knpxmD5c6UKrqw5J/06eokPwSb3HZi3TI63tzFcswuMjj4d7NKJmdpA+uo0aweVZgcOp+O+v9urgNYNYbxOy02qqOetLph8YWH7MQTftaGBwKD7gZMbnUArryPCtrlJz0i0GzoWvVTZnsjrrlDtP/ogLDnCKyi7Q0si+k= ;{id = 57024}
+; a.wild.example.com -> ad1535hlgg914unuuaei9jfh4ofr44uo.  covered by optout
+ac1535hlgg914unuuaei9jfh4ofr44uo.example.com. IN NSEC3 1 1 0 - ae1535hlgg914unuuaei9jfh4ofr44uo NS RRSIG
+ac1535hlgg914unuuaei9jfh4ofr44uo.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. imoxsXE1c3FaXu6uSantJfMPGBgsauf1GhmNpS1lLuaNRjXOhf1PDXwt/GoD/dm2GXJAlWT8u6EK3RXkFwlDIsP7vYFuDfUNCQ/hvYq300sXl1nfW0O1bsoBJahQJuNM+xcbwbnQf0krCTxNthyi2cuiY7RYug6ZTZ3gz4DMkhU= ;{id = 57024}
+ENTRY_END
+
 RANGE_END

 STEP 1 QUERY
@@ -254,4 +300,60 @@ onib9mgub9h0rml3cdf5bgrj59dkjhvk.example.com.   3600    IN      RRSIG   NSEC3 7
 SECTION ADDITIONAL
 ENTRY_END

+STEP 60 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+a.wild.example.com. IN A
+ENTRY_END
+
+; query is a wildcard expansion, covered by optout.
+; hence it is without AD flag (even though we are sure this wildcard exists,
+; we are not sure that there is no delegation covered by the optout span
+; with the name a.wild.example.com).
+STEP 70 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+a.wild.example.com. IN A
+SECTION ANSWER
+a.wild.example.com. IN A 77.88.99.0
+a.wild.example.com.	3600	IN	RRSIG	A 7 3 3600 20070926134150 20070829134150 57024 example.com. GWV6cQprrpAsaYla5z7N9tppdb+X0ZjOsiWBuBueSACHU8CzsYPMbwKUZlTNbQ4mSVRRDa0rM1niYoZF9oqyAfbn5HBLi62TRjrBLHfvatDgSiZCa4mauUfzUS+U7FfUXikNIigG0aN0xdpJ//urmecjNSKg2aW4M0DYsm7keMI= ;{id = 57024}
+SECTION AUTHORITY
+ac1535hlgg914unuuaei9jfh4ofr44uo.example.com. IN NSEC3 1 1 0 - ae1535hlgg914unuuaei9jfh4ofr44uo NS RRSIG
+ac1535hlgg914unuuaei9jfh4ofr44uo.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. imoxsXE1c3FaXu6uSantJfMPGBgsauf1GhmNpS1lLuaNRjXOhf1PDXwt/GoD/dm2GXJAlWT8u6EK3RXkFwlDIsP7vYFuDfUNCQ/hvYq300sXl1nfW0O1bsoBJahQJuNM+xcbwbnQf0krCTxNthyi2cuiY7RYug6ZTZ3gz4DMkhU= ;{id = 57024}
+8aeigskl5tmraedgji7v1lqbmqs8qv7u.example.com. IN NSEC3 1 1 0 - 9aeigskl5tmraedgji7v1lqbmqs8qv7u
+8aeigskl5tmraedgji7v1lqbmqs8qv7u.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. afV7c9knpxmD5c6UKrqw5J/06eokPwSb3HZi3TI63tzFcswuMjj4d7NKJmdpA+uo0aweVZgcOp+O+v9urgNYNYbxOy02qqOetLph8YWH7MQTftaGBwKD7gZMbnUArryPCtrlJz0i0GzoWvVTZnsjrrlDtP/ogLDnCKyi7Q0si+k= ;{id = 57024}
+ENTRY_END
+
+STEP 80 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+a.wild.example.com. IN MX
+ENTRY_END
+
+; nodata wildcard expansion, we are sure that the wildcard does not have
+; the data that is requested, but there an optout flag set on the wildcard
+; expansion denial, thus we are not sure of a.wild.example.com delegation
+; under the optout.
+STEP 90 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA NOERROR
+SECTION QUESTION
+a.wild.example.com. IN MX
+SECTION ANSWER
+SECTION AUTHORITY
+example.com. IN SOA ns.example.com. noc.example.com. 2009310622 1800 900 604800 86400
+example.com.	3600	IN	RRSIG	SOA 7 2 3600 20070926134150 20070829134150 57024 example.com. HlyER7bYPiSJ9jdjjRBucQexYr932Oor1TvxSLPWw5fuWvr/fFitKVnLqC+lqBIeOby44KiDr0rIk+ZqYjWWKNjaLm5wMfhQzbsAgGTQxmO07jnYOGQG9SI6DSbR9GJdZ7imu5sx5oo5dze73MxgLMZIethGaFMkktYN53+AzG0= ;{id = 57024}
+nvec78au1hpuma9eebeji5n06eq33gbk.example.com. IN NSEC3 1 1 0 - ovec78au1hpuma9eebeji5n06eq33gbk A RRSIG
+nvec78au1hpuma9eebeji5n06eq33gbk.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. jE+b5p+stQumm+tLZdaBT+KBpwYI7wRXijRHWcqiUp2SY1uV7HxBdW8aedVTqpFe8kYbMUgI3pCOAitmiI9R6SJg3q7022QOb9y+0/xSmIDqxATVPTJbkzVBInfWrulRtn7o3HmOyoIc9/w7NnNxFYpwtFL08jTBRr8XRTWDM7Q= ;{id = 57024}
+8aeigskl5tmraedgji7v1lqbmqs8qv7u.example.com. IN NSEC3 1 1 0 - 9aeigskl5tmraedgji7v1lqbmqs8qv7u
+8aeigskl5tmraedgji7v1lqbmqs8qv7u.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. afV7c9knpxmD5c6UKrqw5J/06eokPwSb3HZi3TI63tzFcswuMjj4d7NKJmdpA+uo0aweVZgcOp+O+v9urgNYNYbxOy02qqOetLph8YWH7MQTftaGBwKD7gZMbnUArryPCtrlJz0i0GzoWvVTZnsjrrlDtP/ogLDnCKyi7Q0si+k= ;{id = 57024}
+ac1535hlgg914unuuaei9jfh4ofr44uo.example.com. IN NSEC3 1 1 0 - ae1535hlgg914unuuaei9jfh4ofr44uo NS RRSIG
+ac1535hlgg914unuuaei9jfh4ofr44uo.example.com.	3600	IN	RRSIG	NSEC3 7 3 3600 20070926134150 20070829134150 57024 example.com. imoxsXE1c3FaXu6uSantJfMPGBgsauf1GhmNpS1lLuaNRjXOhf1PDXwt/GoD/dm2GXJAlWT8u6EK3RXkFwlDIsP7vYFuDfUNCQ/hvYq300sXl1nfW0O1bsoBJahQJuNM+xcbwbnQf0krCTxNthyi2cuiY7RYug6ZTZ3gz4DMkhU= ;{id = 57024}
+ENTRY_END
+
 SCENARIO_END
@@ -87,6 +87,7 @@ config_create(void)
 	cfg->do_ip6 = 1;
 	cfg->do_udp = 1;
 	cfg->do_tcp = 1;
+	cfg->tcp_upstream = 0;
 	cfg->use_syslog = 1;
 	cfg->log_time_ascii = 0;
 	cfg->log_queries = 0;
@@ -326,6 +327,7 @@ int config_set_option(struct config_file* cfg, const char* opt,
 	else S_YNO("do-ip6:", do_ip6)
 	else S_YNO("do-udp:", do_udp)
 	else S_YNO("do-tcp:", do_tcp)
+	else S_YNO("tcp-upstream:", tcp_upstream)
 	else S_YNO("interface-automatic:", if_automatic)
 	else S_YNO("do-daemonize:", do_daemonize)
 	else S_NUMBER_NONZERO("port:", port)
@@ -577,6 +579,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_YNO(opt, "do-ip6", do_ip6)
 	else O_YNO(opt, "do-udp", do_udp)
 	else O_YNO(opt, "do-tcp", do_tcp)
+	else O_YNO(opt, "tcp-upstream", tcp_upstream)
 	else O_YNO(opt, "do-daemonize", do_daemonize)
 	else O_STR(opt, "chroot", chrootdir)
 	else O_STR(opt, "username", username)
@@ -76,6 +76,8 @@ struct config_file {
 	int do_udp;
 	/** do tcp query support. */
 	int do_tcp;
+	/** tcp upstream queries (no UDP upstream queries) */
+	int tcp_upstream;

 	/** outgoing port range number of ports (per thread) */
 	int outgoing_num_ports;
@@ -136,6 +136,7 @@ do-ip4{COLON}			{ YDVAR(1, VAR_DO_IP4) }
 do-ip6{COLON}			{ YDVAR(1, VAR_DO_IP6) }
 do-udp{COLON}			{ YDVAR(1, VAR_DO_UDP) }
 do-tcp{COLON}			{ YDVAR(1, VAR_DO_TCP) }
+tcp-upstream{COLON}		{ YDVAR(1, VAR_TCP_UPSTREAM) }
 do-daemonize{COLON}		{ YDVAR(1, VAR_DO_DAEMONIZE) }
 interface{COLON}		{ YDVAR(1, VAR_INTERFACE) }
 outgoing-interface{COLON}	{ YDVAR(1, VAR_OUTGOING_INTERFACE) }
@@ -155,7 +155,8 @@
     VAR_SO_SNDBUF = 372,
     VAR_HARDEN_BELOW_NXDOMAIN = 373,
     VAR_IGNORE_CD_FLAG = 374,
-     VAR_LOG_QUERIES = 375
+     VAR_LOG_QUERIES = 375,
+     VAR_TCP_UPSTREAM = 376
   };
 #endif
 /* Tokens.  */
@@ -277,6 +278,7 @@
 #define VAR_HARDEN_BELOW_NXDOMAIN 373
 #define VAR_IGNORE_CD_FLAG 374
 #define VAR_LOG_QUERIES 375
+#define VAR_TCP_UPSTREAM 376



@@ -293,7 +295,7 @@ typedef union YYSTYPE


 /* Line 1685 of yacc.c  */
-#line 297 "util/configparser.h"
+#line 299 "util/configparser.h"
 } YYSTYPE;
 # define YYSTYPE_IS_TRIVIAL 1
 # define yystype YYSTYPE /* obsolescent; will be withdrawn */
@@ -102,7 +102,7 @@ extern struct config_parser_state* cfg_parser;
 %token VAR_AUTO_TRUST_ANCHOR_FILE VAR_KEEP_MISSING VAR_ADD_HOLDDOWN 
 %token VAR_DEL_HOLDDOWN VAR_SO_RCVBUF VAR_EDNS_BUFFER_SIZE VAR_PREFETCH
 %token VAR_PREFETCH_KEY VAR_SO_SNDBUF VAR_HARDEN_BELOW_NXDOMAIN
-%token VAR_IGNORE_CD_FLAG VAR_LOG_QUERIES
+%token VAR_IGNORE_CD_FLAG VAR_LOG_QUERIES VAR_TCP_UPSTREAM

 %%
 toplevelvars: /* empty */ | toplevelvars toplevelvar ;
@@ -157,7 +157,7 @@ content_server: server_num_threads | server_verbosity | server_port |
 	server_del_holddown | server_keep_missing | server_so_rcvbuf |
 	server_edns_buffer_size | server_prefetch | server_prefetch_key |
 	server_so_sndbuf | server_harden_below_nxdomain | server_ignore_cd_flag |
-	server_log_queries
+	server_log_queries | server_tcp_upstream
 	;
 stubstart: VAR_STUB_ZONE
 	{
@@ -365,6 +365,15 @@ server_do_tcp: VAR_DO_TCP STRING_ARG
 		free($2);
 	}
 	;
+server_tcp_upstream: VAR_TCP_UPSTREAM STRING_ARG
+	{
+		OUTYY(("P(server_tcp_upstream:%s)\n", $2));
+		if(strcmp($2, "yes") != 0 && strcmp($2, "no") != 0)
+			yyerror("expected yes or no.");
+		else cfg_parser->cfg->tcp_upstream = (strcmp($2, "yes")==0);
+		free($2);
+	}
+	;
 server_do_daemonize: VAR_DO_DAEMONIZE STRING_ARG
 	{
 		OUTYY(("P(server_do_daemonize:%s)\n", $2));
@@ -680,7 +680,6 @@
 991,
 992,
 993,
-994,
 995,
 996,
 997,
@@ -1908,7 +1907,6 @@
 2256,
 2257,
 2258,
-2259,
 2260,
 2261,
 2262,
@@ -2330,7 +2328,6 @@
 2690,
 2691,
 2692,
-2693,
 2694,
 2695,
 2696,
@@ -2539,7 +2536,6 @@
 2902,
 2903,
 2904,
-2905,
 2906,
 2907,
 2908,
@@ -4333,7 +4329,7 @@
 5991,
 5992,
 5999,
-6063,
+6000,
 6064,
 6065,
 6066,
@@ -4375,6 +4371,7 @@
 6147,
 6148,
 6149,
+6160,
 6161,
 6162,
 6163,
@@ -4447,7 +4444,6 @@
 6551,
 6558,
 6566,
-6567,
 6568,
 6579,
 6580,
@@ -4463,7 +4459,6 @@
 6627,
 6628,
 6657,
-6669,
 6670,
 6671,
 6672,
@@ -4471,7 +4466,7 @@
 6678,
 6679,
 6689,
-6697,
+6696,
 6701,
 6702,
 6703,
@@ -4603,12 +4598,12 @@
 7547,
 7548,
 7549,
+7550,
 7560,
 7566,
 7570,
 7588,
 7624,
-7626,
 7627,
 7628,
 7629,
@@ -4777,6 +4772,7 @@
 8770,
 8786,
 8787,
+8793,
 8800,
 8804,
 8873,
@@ -5275,6 +5271,7 @@
 34963,
 34964,
 34980,
+35355,
 36001,
 36865,
 37475,
@@ -5302,8 +5299,11 @@
 44321,
 44322,
 44323,
+44544,
 44553,
+44600,
 44818,
+45000,
 45054,
 45678,
 45825,
@@ -368,7 +368,8 @@ int nsec_proves_nodata(struct ub_packed_rrset_key* nsec,
 		!nsec_has_type(nsec, LDNS_RR_TYPE_SOA)) {
 		return 0;
 	} else if(qinfo->qtype == LDNS_RR_TYPE_DS &&
-		nsec_has_type(nsec, LDNS_RR_TYPE_SOA)) {
+		nsec_has_type(nsec, LDNS_RR_TYPE_SOA &&
+		!dname_is_root(qinfo->qname))) {
 		return 0;
 	}

@@ -435,7 +435,8 @@ filter_init(struct nsec3_filter* filter, struct ub_packed_rrset_key** list,
 			dname_subdomain_c(nm, filter->zone))) {
 			/* for a type DS do not accept a zone equal to qname*/
 			if(qinfo->qtype == LDNS_RR_TYPE_DS && 
-				query_dname_compare(qinfo->qname, nm) == 0)
+				query_dname_compare(qinfo->qname, nm) == 0 &&
+				!dname_is_root(qinfo->qname))
 				continue;
 			filter->zone = nm;
 			filter->zone_len = nmlen;
@@ -1127,7 +1128,8 @@ nsec3_do_prove_nodata(struct module_env* env, struct nsec3_filter* flt,
 		 * If not type DS: matching nsec3 must not be a delegation.
 		 */
 		if(qinfo->qtype == LDNS_RR_TYPE_DS && qinfo->qname_len != 1 
-			&& nsec3_has_type(rrset, rr, LDNS_RR_TYPE_SOA)) {
+			&& nsec3_has_type(rrset, rr, LDNS_RR_TYPE_SOA &&
+			!dname_is_root(qinfo->qname))) {
 			verbose(VERB_ALGO, "proveNodata: apex NSEC3 "
 				"abused for no DS proof, bogus");
 			return sec_status_bogus;
@@ -1188,6 +1190,13 @@ nsec3_do_prove_nodata(struct module_env* env, struct nsec3_filter* flt,
 				"wilcard is a delegation, bogus");
 			return sec_status_bogus;
 		}
+		/* everything is peachy keen, except for optout spans */
+		log_assert(ce.nc_rrset);
+		if(nsec3_has_optout(ce.nc_rrset, ce.nc_rr)) {
+			verbose(VERB_ALGO, "nsec3 nodata proof: matching "
+				"wildcard is in optout range, insecure");
+			return sec_status_insecure;
+		}
 		return sec_status_secure;
 	}
Author	SHA1	Message	Date
Wouter Wijngaards	1daad9d9c0	tag 1.4.13rc2 git-svn-id: file:///svn/unbound/trunk@2489 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-09-12 11:58:29 +00:00
Wouter Wijngaards	af93d6033c	revert earlier commit. git-svn-id: file:///svn/unbound/trunk@2488 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-09-12 11:28:14 +00:00
Wouter Wijngaards	46eeced066	- Fix operation in ipv6 only (do-ip4: no) mode. git-svn-id: file:///svn/unbound/trunk@2487 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-09-07 14:34:10 +00:00
Wouter Wijngaards	70c8f304c2	fedora specfile updated (from Paul Wouters). git-svn-id: file:///svn/unbound/trunk@2486 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-09-07 05:34:22 +00:00
Wouter Wijngaards	1a2b78e51a	tag 1.4.13rc1 git-svn-id: file:///svn/unbound/trunk@2485 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-09-05 11:48:26 +00:00
Wouter Wijngaards	54d0ed9a70	iana portlist updated. git-svn-id: file:///svn/unbound/trunk@2484 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-09-02 15:05:31 +00:00
Wouter Wijngaards	d56aef7b33	- Fix validation failures due to EDNS backoff retries, the retry for fetch of data has want_dnssec because the iter_indicate_dnssec function returns true when validation failure retry happens, and then the serviced query code does not fallback to noEDNS, even if the cache says it has this. This helps for DLV deployment when the DNSSEC status is not known for sure before the lookup concludes. git-svn-id: file:///svn/unbound/trunk@2483 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-26 09:00:43 +00:00
Wouter Wijngaards	accc4a6f68	Fix numthreads 0 handling. git-svn-id: file:///svn/unbound/trunk@2482 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-26 06:50:23 +00:00
Wouter Wijngaards	39de97e176	- Applied patch from Karel Slany that fixes a memory leak in the unbound python module, in string conversions. git-svn-id: file:///svn/unbound/trunk@2481 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-24 11:03:29 +00:00
Wouter Wijngaards	05e118b7d5	tcp upstream option. git-svn-id: file:///svn/unbound/trunk@2480 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-22 13:58:40 +00:00
Wouter Wijngaards	174604914f	- Documented the options that work with control set_option command. git-svn-id: file:///svn/unbound/trunk@2479 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-22 13:22:05 +00:00
Wouter Wijngaards	d265c02f69	- Fix that internally, CNAMEs with NXDOMAIN have that as rcode. git-svn-id: file:///svn/unbound/trunk@2478 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-22 12:11:54 +00:00
Wouter Wijngaards	17e5bba504	Fix validation of qtype ANY responses with CNAMEs (thanks Cathy Zhang and Luo Ce). git-svn-id: file:///svn/unbound/trunk@2477 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-22 12:02:50 +00:00
Wouter Wijngaards	5ab9b9c8f9	Fix autoconf for makedist crosscompile RC or snapshot. git-svn-id: file:///svn/unbound/trunk@2476 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-18 16:01:42 +00:00
Wouter Wijngaards	09375e16e7	iana portlist updated. new xml format at iana. git-svn-id: file:///svn/unbound/trunk@2475 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-17 15:12:39 +00:00
Wouter Wijngaards	22290ac234	- Fix validation of . DS query. git-svn-id: file:///svn/unbound/trunk@2474 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-17 14:28:32 +00:00
Wouter Wijngaards	86c4c11ca2	- fix memory and fd leak after out-of-memory condition. git-svn-id: file:///svn/unbound/trunk@2473 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-10 14:03:06 +00:00
Wouter Wijngaards	63c07d13ce	updated patch from Tom. git-svn-id: file:///svn/unbound/trunk@2472 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-10 07:37:57 +00:00
Wouter Wijngaards	e8ec432579	- Fix python site-packages path to /usr/lib64. git-svn-id: file:///svn/unbound/trunk@2471 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-10 06:05:09 +00:00
Wouter Wijngaards	ad864b0f7e	- patch from Tom Hendrikx fixes load of python modules. git-svn-id: file:///svn/unbound/trunk@2470 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-09 07:28:22 +00:00
Wouter Wijngaards	cafc73a74f	- make clean had ldns-src reference, removed. git-svn-id: file:///svn/unbound/trunk@2469 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-08 13:17:37 +00:00
Wouter Wijngaards	8c04c2e187	acx v14. git-svn-id: file:///svn/unbound/trunk@2468 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-01 14:56:38 +00:00
Wouter Wijngaards	27b5d25703	Fix autoconf 2.68 warnings git-svn-id: file:///svn/unbound/trunk@2467 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-08-01 11:14:33 +00:00
Wouter Wijngaards	dbd816fafb	iana portlist updated. git-svn-id: file:///svn/unbound/trunk@2466 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-07-14 09:10:26 +00:00
Wouter Wijngaards	47653ae679	release 1.4.12 noted. 1.4.13 developed in svn trunk. git-svn-id: file:///svn/unbound/trunk@2465 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-07-14 08:33:12 +00:00
Wouter Wijngaards	3d2156dacc	- Unbound implements RFC6303 (since version 1.4.7). git-svn-id: file:///svn/unbound/trunk@2463 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-07-14 08:17:11 +00:00
Wouter Wijngaards	25319e6737	- Quick fix for contrib/unbound.spec example, no ldns-builtin any more. git-svn-id: file:///svn/unbound/trunk@2462 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-07-13 12:17:13 +00:00
Wouter Wijngaards	7359d84e2f	- Fix wildcard expansion no-data reply under an optout NSEC3 zone is validated as insecure, reported by Jia Li (lijia@cnnic.cn). git-svn-id: file:///svn/unbound/trunk@2461 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-07-11 09:03:18 +00:00
Wouter Wijngaards	5f08751b3b	changelog entry tag. git-svn-id: file:///svn/unbound/trunk@2460 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-07-04 10:44:10 +00:00
Wouter Wijngaards	60e8c22040	- fix that --enable-static-exe does not complain about it unknown. git-svn-id: file:///svn/unbound/trunk@2458 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-07-01 08:58:34 +00:00
Wouter Wijngaards	a742415b5c	version number in example config file. git-svn-id: file:///svn/unbound/trunk@2457 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-07-01 07:12:08 +00:00
Wouter Wijngaards	7b5262ccd2	autoconf git-svn-id: file:///svn/unbound/trunk@2456 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:31:08 +00:00
Matthijs Mekking	c3da97fb35	suggested change git-svn-id: file:///svn/unbound/trunk@2455 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:26:58 +00:00
Wouter Wijngaards	844b5e71b1	nicer text git-svn-id: file:///svn/unbound/trunk@2454 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:22:06 +00:00
Wouter Wijngaards	172260232e	nicer text git-svn-id: file:///svn/unbound/trunk@2453 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:19:23 +00:00
Wouter Wijngaards	c155cfc8bc	fixup. git-svn-id: file:///svn/unbound/trunk@2452 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:15:41 +00:00
Wouter Wijngaards	447b6a1149	compile fix. git-svn-id: file:///svn/unbound/trunk@2451 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:14:42 +00:00
Wouter Wijngaards	7070c35e11	nicer error messages. git-svn-id: file:///svn/unbound/trunk@2450 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:13:48 +00:00
Wouter Wijngaards	dd03b668c5	fix neater. git-svn-id: file:///svn/unbound/trunk@2449 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 14:02:16 +00:00
Wouter Wijngaards	1dff4206d5	fix makedist for crosscompile to windows without ldns tarball builtin. git-svn-id: file:///svn/unbound/trunk@2448 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 13:24:10 +00:00
Wouter Wijngaards	bbe76430fe	- removed ldns-src tarball inside the unbound tarball. git-svn-id: file:///svn/unbound/trunk@2447 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 12:59:27 +00:00
Wouter Wijngaards	2c9bf883c9	- fix comment about rndc port, that referred to the old port number. - fix that the listening socket is not closed when too many remote control connections are made at the same time. git-svn-id: file:///svn/unbound/trunk@2446 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 12:13:55 +00:00
Wouter Wijngaards	59f5480df1	- fix replyaddr count wrong after jostled queries, which leads to eventual starvation where the daemon has no replyaddrs left to use. git-svn-id: file:///svn/unbound/trunk@2445 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 11:01:44 +00:00
Wouter Wijngaards	bc06ab0377	fix bug#395: id bits of other query may leak out under conditions git-svn-id: file:///svn/unbound/trunk@2444 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 09:42:20 +00:00
Wouter Wijngaards	668bcfc499	iana portlist updated git-svn-id: file:///svn/unbound/trunk@2443 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 09:10:53 +00:00
Wouter Wijngaards	9229c58c2f	1.4.12 in trunk and configure updated. git-svn-id: file:///svn/unbound/trunk@2442 be551aaa-1e26-0410-a405-d3ace91eadb9	2011-06-30 08:56:56 +00:00