tag 1.4.4rc1

git-svn-id: file:///svn/unbound/trunk@2084 be551aaa-1e26-0410-a405-d3ace91eadb9
and include ldns for windows anchor update
2026-08-17 21:25:50 +02:00 · 2010-04-16 11:21:06 +00:00 · 2010-04-16 09:33:41 +00:00 · 2010-04-16 09:27:12 +00:00 · 2010-04-16 08:41:08 +00:00 · 2010-04-15 14:53:55 +00:00
114 changed files with 4055 additions and 2154 deletions
@@ -74,6 +74,14 @@ LINT=splint
 LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list -Dglob64=glob -Dglobfree64=globfree
 # compat with openssl linux edition.
 LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray
+# compat with NetBSD
+ifeq "$(shell uname)" "NetBSD"
+LINTFLAGS+="-D__RENAME(x)=" -D_NETINET_IN_H_
+endif
+# compat with OpenBSD
+LINTFLAGS+="-Dsigset_t=long"
+# FreeBSD8
+LINTFLAGS+="-D__uint16_t=uint16_t"

 INSTALL=$(srcdir)/install-sh
 ifeq "$(WITH_PYTHONMODULE)" "yes"
@@ -420,6 +420,12 @@
 /* default username */
 #undef UB_USERNAME

+/* use to enable lightweight alloc assertions, for debug use */
+#undef UNBOUND_ALLOC_LITE
+
+/* use malloc not regions, for debug use */
+#undef UNBOUND_ALLOC_NONREGIONAL
+
 /* use statistics for allocs and frees, for debug use */
 #undef UNBOUND_ALLOC_STATS

@@ -647,26 +653,6 @@
 #include <ws2tcpip.h>
 #endif

-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ERR_H
-#include <openssl/err.h>
-#endif
-
-#ifdef HAVE_OPENSSL_RAND_H
-#include <openssl/rand.h>
-#endif
-
-#ifdef HAVE_OPENSSL_CONF_H
-#include <openssl/conf.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ENGINE_H
-#include <openssl/engine.h>
-#endif
-

 
 #ifdef HAVE_ATTR_FORMAT
@@ -813,8 +799,6 @@ struct sockaddr_storage;
 #include "compat/fake-rfc2553.h"
 #endif

-#include "ldns/ldns.h"
-
 #ifdef UNBOUND_ALLOC_STATS
 #  define malloc(s) unbound_stat_malloc_log(s, __FILE__, __LINE__, __func__)
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
@@ -832,7 +816,9 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-#endif /* UNBOUND_ALLOC_STATS */
+#elif defined(UNBOUND_ALLOC_LITE)
+#  include "util/alloc.h"
+#endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */

 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53
@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)

-AC_INIT(unbound, 1.4.2, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.4.4, unbound-bugs@nlnetlabs.nl, unbound)

 LIBUNBOUND_CURRENT=2
-LIBUNBOUND_REVISION=2
+LIBUNBOUND_REVISION=4
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -27,6 +27,8 @@ LIBUNBOUND_AGE=0
 # 1.4.0 had 1:5:0 (not 2:0:0)   # ub_result.why_bogus
 # 1.4.1 had 2:1:0
 # 1.4.2 had 2:2:0
+# 1.4.3 had 2:3:0
+# 1.4.4 had 2:4:0

 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -230,6 +232,20 @@ ACX_CHECK_MEMCMP_SIGNED

 # add option to disable the evil rpath
 ACX_ARG_RPATH
+AC_SUBST(RUNTIME_PATH)
+
+# check to see if libraries are needed for these functions.
+AC_SEARCH_LIBS([inet_pton], [nsl])
+AC_SEARCH_LIBS([socket], [socket])
+
+# check some functions of the OS before linking libs (while still runnable).
+AC_FUNC_CHOWN
+AC_FUNC_FORK
+AC_TYPE_SIGNAL
+AC_FUNC_FSEEKO
+ACX_SYS_LARGEFILE
+ACX_CHECK_NONBLOCKING_BROKEN
+ACX_MKDIR_ONE_ARG

 # check for thread library.
 # check this first, so that the pthread lib does not get linked in via
@@ -319,6 +335,7 @@ if test x_$ub_test_python != x_no; then

   # Check for Python
   ub_have_python=no
+   ac_save_LIBS="$LIBS" dnl otherwise AC_PYTHON_DEVEL thrashes $LIBS
   AC_PYTHON_DEVEL
   if test ! -z "$PYTHON_VERSION"; then
 	if test `$PYTHON -c "print '$PYTHON_VERSION' >= '2.4.0'"` = "False"; then
@@ -403,19 +420,13 @@ esac
 AC_ARG_ENABLE(gost, AC_HELP_STRING([--enable-gost], [Enable GOST support, experimental]))
 case "$enable_gost" in
 	yes)
-	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL >= 1.0.0 is needed for GOST support])])
+	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL >= 1.0.0 is needed for GOST support, upgrade openssl or rerun with --disable-gost])])
 	AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])
 	;;
 	no|*)
 	;;
 esac

-# check to see if libraries are needed for these functions.
-AC_SEARCH_LIBS([inet_pton], [nsl])
-AC_SEARCH_LIBS([socket], [socket])
-
-AC_SUBST(RUNTIME_PATH)
-
 # check for libevent
 AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
    [use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr  or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
@@ -515,20 +526,27 @@ fi

 # set memory allocation checking if requested
 AC_ARG_ENABLE(alloc-checks, AC_HELP_STRING([--enable-alloc-checks],
-	[ enable to check memory allocation, for debug purposes ]), 
+	[ enable to memory allocation statistics, for debug purposes ]), 
 	, )
+AC_ARG_ENABLE(alloc-lite, AC_HELP_STRING([--enable-alloc-lite],
+	[ enable for lightweight alloc assertions, for debug purposes ]), 
+	, )
+AC_ARG_ENABLE(alloc-nonregional, AC_HELP_STRING([--enable-alloc-nonregional],
+	[ enable nonregional allocs, slow but exposes regional allocations to other memory purifiers, for debug purposes ]), 
+	, )
+if test x_$enable_alloc_nonregional = x_yes; then
+	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
+fi
 if test x_$enable_alloc_checks = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
 else
-	ACX_FUNC_MALLOC([unbound])
+	if test x_$enable_alloc_lite = x_yes; then
+		AC_DEFINE(UNBOUND_ALLOC_LITE, 1, [use to enable lightweight alloc assertions, for debug use])
+	else
+		ACX_FUNC_MALLOC([unbound])
+	fi
 fi

-AC_FUNC_CHOWN
-AC_FUNC_FORK
-AC_TYPE_SIGNAL
-AC_FUNC_FSEEKO
-ACX_SYS_LARGEFILE
-
 ACX_CHECK_GETADDRINFO_WITH_INCLUDES
 if test "$USE_WINSOCK" = 1; then
 	AC_DEFINE(UB_ON_WINDOWS, 1, [Use win32 resources and API])
@@ -543,6 +561,8 @@ fi
 if test $ac_cv_func_getaddrinfo = no; then
 	AC_LIBOBJ([fake-rfc2553])
 fi
+# check after getaddrinfo for its libraries
+ACX_FUNC_IOCTLSOCKET

 # see if daemon(3) exists, and if it is deprecated.
 AC_CHECK_FUNCS([daemon])
@@ -553,15 +573,14 @@ if test $ac_cv_func_daemon = yes; then
 fi

 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev setresuid setreuid setresgid setregid glob initgroups strftime localtime_r setusercontext _beginthreadex])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev glob initgroups strftime localtime_r setusercontext _beginthreadex])
+AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
+AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])

 # check if setreuid en setregid fail, on MacOSX10.4(darwin8).
 if echo $build_os | grep darwin8 > /dev/null; then
 	AC_DEFINE(DARWIN_BROKEN_SETREUID, 1, [Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work])
 fi
-ACX_CHECK_NONBLOCKING_BROKEN
-ACX_MKDIR_ONE_ARG
-ACX_FUNC_IOCTLSOCKET
 AC_REPLACE_FUNCS(inet_aton)
 AC_REPLACE_FUNCS(inet_pton)
 AC_REPLACE_FUNCS(inet_ntop)
@@ -594,8 +613,10 @@ AC_ARG_WITH(ldns-builtin, AC_HELP_STRING([--with-ldns-builtin],
 # check if ldns is good enough
 if test "$use_ldns_builtin" = "no"; then
 	AC_CHECK_LIB(ldns, ldns_buffer_copy)
+	AC_CHECK_FUNC(ldns_key_buf2rsa_raw)
 	AC_CHECK_HEADERS([ldns/ldns.h],,, [AC_INCLUDES_DEFAULT])
 	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes \
+	    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
 	    -a $ac_cv_header_ldns_ldns_h = yes; then
 	    dnl ldns was found, check compat functions
 	    AC_CHECK_FUNC([ldns_b32_ntop_extended_hex],, [
@@ -683,26 +704,6 @@ dnl includes
 #ifdef HAVE_WS2TCPIP_H
 #include <ws2tcpip.h>
 #endif
-
-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ERR_H
-#include <openssl/err.h>
-#endif
-
-#ifdef HAVE_OPENSSL_RAND_H
-#include <openssl/rand.h>
-#endif
-
-#ifdef HAVE_OPENSSL_CONF_H
-#include <openssl/conf.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ENGINE_H
-#include <openssl/engine.h>
-#endif
 ]

 AHX_CONFIG_FORMAT_ATTRIBUTE
@@ -751,8 +752,6 @@ struct sockaddr_storage;
 #include "compat/fake-rfc2553.h"
 #endif

-#include "ldns/ldns.h"
-
 #ifdef UNBOUND_ALLOC_STATS
 #  define malloc(s) unbound_stat_malloc_log(s, __FILE__, __LINE__, __func__)
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
@@ -770,7 +769,9 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-#endif /* UNBOUND_ALLOC_STATS */
+#elif defined(UNBOUND_ALLOC_LITE)
+#  include "util/alloc.h"
+#endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */

 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53
@@ -1,6 +1,6 @@
 Summary: Validating, recursive, and caching DNS resolver
 Name: unbound
-Version: 1.0.1
+Version: 1.4.4
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/
@@ -40,6 +40,7 @@
 * to text format.
 */
 #include "config.h"
+#include "ldns/ldns.h"
 #include "daemon/cachedump.h"
 #include "daemon/remote.h"
 #include "daemon/worker.h"
@@ -40,6 +40,22 @@
 */

 #include "config.h"
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
+
+#ifdef HAVE_OPENSSL_CONF_H
+#include <openssl/conf.h>
+#endif
+
+#ifdef HAVE_OPENSSL_ENGINE_H
+#include <openssl/engine.h>
+#endif
+#include "ldns/ldns.h"
 #include "daemon/daemon.h"
 #include "daemon/worker.h"
 #include "daemon/remote.h"
@@ -276,7 +292,7 @@ int daemon_get_shufport(struct daemon* daemon, int* shufport)
        /* Knuth shuffle */
 	n = avail;
 	while(--n > 0) {
-		k = ub_random(daemon->rand) % (n+1); /* 0<= k<= n */
+		k = ub_random_max(daemon->rand, n+1); /* 0<= k<= n */
 		temp = shufport[k];
 		shufport[k] = shufport[n];
 		shufport[n] = temp;
@@ -43,6 +43,11 @@
 * Both the server and the client(control tool) have their own keys.
 */
 #include "config.h"
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+#include <ctype.h>
+#include "ldns/ldns.h"
 #include "daemon/remote.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"
@@ -1111,6 +1116,8 @@ struct del_info {
 	size_t len;
 	/** labels */
 	int labs;
+	/** now */
+	uint32_t now;
 	/** time to invalidate to */
 	uint32_t expired;
 	/** number of rrsets removed */
@@ -1131,8 +1138,10 @@ zone_del_rrset(struct lruhash_entry* e, void* arg)
 	if(dname_subdomain_c(k->rk.dname, inf->name)) {
 		struct packed_rrset_data* d = 
 			(struct packed_rrset_data*)e->data;
-		d->ttl = inf->expired;
-		inf->num_rrsets++;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_rrsets++;
+		}
 	}
 }

@@ -1145,8 +1154,10 @@ zone_del_msg(struct lruhash_entry* e, void* arg)
 	struct msgreply_entry* k = (struct msgreply_entry*)e->key;
 	if(dname_subdomain_c(k->key.qname, inf->name)) {
 		struct reply_info* d = (struct reply_info*)e->data;
-		d->ttl = inf->expired;
-		inf->num_msgs++;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_msgs++;
+		}
 	}
 }

@@ -1159,8 +1170,10 @@ zone_del_kcache(struct lruhash_entry* e, void* arg)
 	struct key_entry_key* k = (struct key_entry_key*)e->key;
 	if(dname_subdomain_c(k->name, inf->name)) {
 		struct key_entry_data* d = (struct key_entry_data*)e->data;
-		d->ttl = inf->expired;
-		inf->num_keys++;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_keys++;
+		}
 	}
 }

@@ -1180,6 +1193,7 @@ do_flush_zone(SSL* ssl, struct worker* worker, char* arg)
 	inf.name = nm;
 	inf.len = nmlen;
 	inf.labs = nmlabs;
+	inf.now = *worker->env.now;
 	inf.expired = *worker->env.now;
 	inf.expired -= 3; /* handle 3 seconds skew between threads */
 	inf.num_rrsets = 0;
@@ -45,6 +45,9 @@

 #ifndef DAEMON_REMOTE_H
 #define DAEMON_REMOTE_H
+#ifdef HAVE_OPENSSL_SSL_H
+#include "openssl/ssl.h"
+#endif
 struct config_file;
 struct listen_list;
 struct listen_port;
@@ -40,6 +40,7 @@
 * numbers. These 'statistics' may be of interest to the operator.
 */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "daemon/stats.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"
@@ -43,6 +43,7 @@
 #ifndef DAEMON_STATS_H
 #define DAEMON_STATS_H
 #include "util/timehist.h"
+#include "ldns/buffer.h"
 struct worker;
 struct config_file;
 struct comm_point;
@@ -41,6 +41,9 @@
 */

 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 #include "util/log.h"
 #include "daemon/daemon.h"
 #include "daemon/remote.h"
@@ -313,7 +316,7 @@ detach(void)
 	if(daemon(1, 0) != 0)
 		fatal_exit("daemon failed: %s", strerror(errno));
 #else /* no HAVE_DAEMON */
-#ifdef HAVE_WORKING_FORK
+#ifdef HAVE_FORK
 	int fd;
 	/* Take off... */
 	switch (fork()) {
@@ -337,7 +340,7 @@ detach(void)
 		if (fd > 2)
 			(void)close(fd);
 	}
-#endif /* HAVE_WORKING_FORK */
+#endif /* HAVE_FORK */
 #endif /* HAVE_DAEMON */
 }

@@ -40,6 +40,7 @@
 * pending requests.
 */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/random.h"
@@ -1247,7 +1248,7 @@ outbound_entry_compare(void* a, void* b)

 struct outbound_entry*
 worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
-	uint16_t qclass, uint16_t flags, int dnssec,
+	uint16_t qclass, uint16_t flags, int dnssec, int want_dnssec,
 	struct sockaddr_storage* addr, socklen_t addrlen,
 	struct module_qstate* q)
 {
@@ -1258,9 +1259,9 @@ worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		return NULL;
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(worker->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, addr, addrlen, 
-		worker_handle_service_reply, e, worker->back->udp_buff,
-		&outbound_entry_compare);
+		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
+		addr, addrlen, worker_handle_service_reply, e, 
+		worker->back->udp_buff, &outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -1295,7 +1296,8 @@ int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
@@ -189,6 +189,7 @@ int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
 * @param qclass: query class. (host order)
 * @param flags: host order flags word, with opcode and CD bit.
 * @param dnssec: if set, EDNS record will have DO bit set.
+ * @param want_dnssec: signatures needed.
 * @param addr: where to.
 * @param addrlen: length of addr.
 * @param q: wich query state to reactivate upon return.
@@ -197,7 +198,7 @@ int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
 */
 struct outbound_entry* worker_send_query(uint8_t* qname, size_t qnamelen, 
 	uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec, 
-	struct sockaddr_storage* addr, socklen_t addrlen,
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
 	struct module_qstate* q);

 /** 
@@ -1,3 +1,91 @@
+16 April 2010: Wouter
+	- more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN.
+	- tag 1.4.4rc1.
+
+15 April 2010: Wouter
+	- ECC-GOST algorithm number 12 that is assigned by IANA.  New test
+	  example key and signatures for GOST.  GOST requires openssl-1.0.0.
+	  GOST is still disabled by default.
+
+9 April 2010: Wouter
+	- Fix bug#305: pkt_dname_tolower could read beyond end of buffer or
+	  get into an endless loop, if 0x20 was enabled, and buffers are small
+	  or particular broken packets are received.
+	- Fix chain of trust with CNAME at an intermediate step, for the DS
+	  processing proof.
+
+8 April 2010: Wouter
+	- Fix validation of queries with wildcard names (*.example).
+
+6 April 2010: Wouter
+	- Fix EDNS probe for .de DNSSEC testbed failure, where the infra
+	  cache timeout coincided with a server update, the current EDNS 
+	  backoff is less sensitive, and does not cache the backoff unless 
+	  the backoff actually works and the domain is not expecting DNSSEC.
+	- GOST support with correct algorithm numbers.
+
+1 April 2010: Wouter
+	- iana portlist updated.
+
+24 March 2010: Wouter
+	- unbound control flushed items are not counted when flushed again.
+
+23 March 2010: Wouter
+	- iana portlist updated.
+
+22 March 2010: Wouter
+	- unbound-host disables use-syslog from config file so that the
+	  config file for the main server can be used more easily.
+	- fix bug#301: unbound-checkconf could not parse interface
+	  '0.0.0.0@5353', even though unbound itself worked fine.
+
+19 March 2010: Wouter
+	- fix fwd_ancil test to pass if the socket options are not supported.
+
+18 March 2010: Wouter
+	- Fixed random numbers for port, interface and server selection.
+	  Removed very small bias.
+	- Refer to the listing in unbound-control man page in the extended
+	  statistics entry in the unbound.conf man page.
+
+16 March 2010: Wouter
+	- Fix interface-automatic for OpenBSD: msg.controllen was too small,
+	  also assertions on ancillary data buffer.
+	- check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO.
+	- for NSEC3 check if signatures are cached.
+
+15 March 2010: Wouter
+	- unit test for util/regional.c.
+
+12 March 2010: Wouter
+	- Reordered configure checks so fork and -lnsl -lsocket checks are
+	  earlier, and thus later checks benefit from and do not hinder them.
+	- iana portlist updated.
+	- ldns tarball updated.
+	- Fix python use when multithreaded.
+	- Fix solaris python compile.
+	- Include less in config.h and include per code file for ldns, ssl.
+
+11 March 2010: Wouter
+	- another memory allocation option: --enable-alloc-nonregional.
+	  exposes the regional allocations to other memory purifiers.
+	- fix for memory alignment in struct sock_list allocation.
+	- Fix for MacPorts ldns without ssl default, unbound checks if ldns
+	  has dnssec functionality and uses the builtin if not.
+	- Fix daemonize on Solaris 10, it did not detach from terminal.
+	- tag 1.4.3 created.
+	- trunk is 1.4.4 in development.
+	- spelling fix in validation error involving cnames.
+
+10 March 2010: Wouter
+	- --enable-alloc-lite works with test set.
+	- portability in the testset: printf format conversions, prototypes.
+
+9 March 2010: Wouter
+	- tag 1.4.2 created.
+	- trunk is 1.4.3 in development.
+	- --enable-alloc-lite debug option.
+
 8 March 2010: Wouter
 	- iana portlist updated.

@@ -6,6 +6,7 @@ To make and run the tests. The results are summarized at the end.

 You need to have the following programs installed and in your PATH.
 * dig - from the bind-tools package. Used to send DNS queries.
+* wdiff - used for word-by-word comparisons.
 * splint (optional) - for lint test
 * doxygen (optional) - for doc completeness test
 * ldns-testns (optional) - from ldns examples. Used as DNS auth server.
@@ -69,3 +69,8 @@ later
  document high scalable, high available unbound setup onepager.
 - prefetch DNSKEY when DS in delegation seen (nonCD, underTA).
 - use libevent if available on system by default(?), default outgoing 256to1024
+
+[1] BIND-like query logging to see who's looking up what and when
+[2] more logging about stuff like SERVFAIL and REFUSED responses
+[3] a Makefile that works without gnumake
+
@@ -62,5 +62,4 @@ local_data <resource record string>
 	local_data_add www.example.com. IN A 192.0.2.2
 	if no local_zone exists for it; a transparent zone with the same
 	name as the data is created.
-
-
+Other commands in the unbound-control manual page.
@@ -344,7 +344,7 @@ server:
 	# val-bogus-ttl: 60

 	# The signature inception and expiration dates are allowed to be off
-	# by 10% of the lifetime of the signature from our local clock.
+	# by 10% of the signature lifetime (expir-incep) from our local clock.
 	# This leeway is capped with a minimum and a maximum.  In seconds.
 	# val-sig-skew-min: 3600
 	# val-sig-skew-max: 86400
@@ -100,7 +100,8 @@ the statistics counters after logging the statistics. Default is no.
 .TP
 .B extended\-statistics: \fI<yes or no>
 If enabled, extended statistics are printed from \fIunbound\-control\fR(8). 
-Default is off, because keeping track of more statistics takes time.
+Default is off, because keeping track of more statistics takes time.  The
+counters are listed in \fIunbound\-control\fR(8).
 .TP
 .B num\-threads: \fI<number>
 The number of threads to create to serve clients. Use 1 for no threading.
@@ -581,17 +582,19 @@ you are debugging signature inception and expiration.
 .TP
 .B val\-sig\-skew\-min: \fI<seconds>
 Minimum number of seconds of clock skew to apply to validated signatures.
-A value of 10% of the signature lifetime is used, capped by this setting.  
-Default is 3600 (1 hour) which allows for daylight savings differences.  
-Lower this value for more strict checking of short lived signatures.
+A value of 10% of the signature lifetime (expiration \- inception) is
+used, capped by this setting.  Default is 3600 (1 hour) which allows for
+daylight savings differences.  Lower this value for more strict checking
+of short lived signatures.
 .TP
 .B val\-sig\-skew\-max: \fI<seconds>
 Maximum number of seconds of clock skew to apply to validated signatures.
-A value of 10% of the signature lifetime is used, capped by this setting.  
-Default is 86400 (24 hours) which allows for timezone setting problems in 
-stable domains.  Setting both min and max very low disables the clock skew 
-allowances.  Setting both min and max very high makes the validator check
-the signature timestamps less strictly.
+A value of 10% of the signature lifetime (expiration \- inception)
+is used, capped by this setting.  Default is 86400 (24 hours) which
+allows for timezone setting problems in stable domains.  Setting both
+min and max very low disables the clock skew allowances.  Setting both
+min and max very high makes the validator check the signature timestamps
+less strictly.
 .TP
 .B val\-bogus\-ttl: \fI<number>
 The time to live for bogus data. This is data that has failed validation;
@@ -40,6 +40,9 @@
 * Keep track of forward zones and config settings.
 */
 #include "config.h"
+#include "ldns/rdata.h"
+#include "ldns/dname.h"
+#include "ldns/rr.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_delegpt.h"
 #include "util/regional.h"
@@ -40,6 +40,8 @@
 * Keep track of stub and root hints, and read those from config.
 */
 #include "config.h"
+#include "ldns/dname.h"
+#include "ldns/rr.h"
 #include "iterator/iter_hints.h"
 #include "iterator/iter_delegpt.h"
 #include "util/regional.h"
@@ -41,6 +41,7 @@
 */

 #include "config.h"
+#include "ldns/dname.h"
 #include "iterator/iter_priv.h"
 #include "util/regional.h"
 #include "util/log.h"
@@ -43,6 +43,7 @@
 #ifndef ITERATOR_ITER_PRIV_H
 #define ITERATOR_ITER_PRIV_H
 #include "util/rbtree.h"
+#include "ldns/buffer.h"
 struct iter_env;
 struct config_file;
 struct regional;
@@ -40,6 +40,7 @@
 * one of the response types.
 */
 #include "config.h"
+#include "ldns/packet.h"
 #include "iterator/iter_resptype.h"
 #include "iterator/iter_delegpt.h"
 #include "services/cache/dns.h"
@@ -42,6 +42,7 @@

 #ifndef ITERATOR_ITER_SCRUB_H
 #define ITERATOR_ITER_SCRUB_H
+#include "ldns/buffer.h"
 struct msg_parse;
 struct query_info;
 struct regional;
@@ -350,9 +350,9 @@ iter_server_selection(struct iter_env* iter_env,

 	/* randomly select a target from the list */
 	log_assert(num > 1);
-	/* we do not need secure random numbers here, but
-	 * we do need it to be threadsafe, so we use this */
-	sel = ub_random(env->rnd) % num; 
+	/* grab secure random number, to pick unexpected server.
+	 * also we need it to be threadsafe. */
+	sel = ub_random_max(env->rnd, num); 
 	a = dp->result_list;
 	prev = NULL;
 	while(sel > 0 && a) {
@@ -418,7 +418,7 @@ iter_ns_probability(struct ub_randstate* rnd, int n, int m)
 		return 1;
 	/* we do not need secure random numbers here, but
 	 * we do need it to be threadsafe, so we use this */
-	sel = ub_random(rnd) % m; 
+	sel = ub_random_max(rnd, m); 
 	return (sel < n);
 }

@@ -43,6 +43,7 @@
 #ifndef ITERATOR_ITER_UTILS_H
 #define ITERATOR_ITER_UTILS_H
 #include "iterator/iter_resptype.h"
+#include "ldns/buffer.h"
 struct iter_env;
 struct iter_hints;
 struct iter_forwards;
@@ -41,6 +41,7 @@
 */

 #include "config.h"
+#include "ldns/ldns.h"
 #include "iterator/iterator.h"
 #include "iterator/iter_utils.h"
 #include "iterator/iter_hints.h"
@@ -1520,7 +1521,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		iq->qchase.qname, iq->qchase.qname_len, 
 		iq->qchase.qtype, iq->qchase.qclass, 
 		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), EDNS_DO|BIT_CD, 
-		&target->addr, target->addrlen, qstate);
+		iq->dnssec_expected, &target->addr, target->addrlen, qstate);
 	if(!outq) {
 		log_addr(VERB_DETAIL, "error sending query to auth server", 
 			&target->addr, target->addrlen);
@@ -44,6 +44,7 @@
 /* include the public api first, it should be able to stand alone */
 #include "libunbound/unbound.h"
 #include "config.h"
+#include <ctype.h>
 #include "libunbound/context.h"
 #include "libunbound/libworker.h"
 #include "util/locks.h"
@@ -42,6 +42,8 @@
 * returns from the procedure when done.
 */
 #include "config.h"
+#include <ldns/dname.h>
+#include <ldns/wire2host.h>
 #include "libunbound/libworker.h"
 #include "libunbound/context.h"
 #include "libunbound/unbound.h"
@@ -484,8 +486,15 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 	if(!rdf) {
 		return 0;
 	}
+#ifdef UNBOUND_ALLOC_LITE
+	qinfo->qname = memdup(ldns_rdf_data(rdf), ldns_rdf_size(rdf));
+	qinfo->qname_len = ldns_rdf_size(rdf);
+	ldns_rdf_deep_free(rdf);
+	rdf = 0;
+#else
 	qinfo->qname = ldns_rdf_data(rdf);
 	qinfo->qname_len = ldns_rdf_size(rdf);
+#endif
 	edns->edns_present = 1;
 	edns->ext_rcode = 0;
 	edns->edns_version = 0;
@@ -687,7 +696,7 @@ outbound_entry_compare(void* a, void* b)

 struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
        uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-        struct sockaddr_storage* addr, socklen_t addrlen,
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
        struct module_qstate* q)
 {
 	struct libworker* w = (struct libworker*)q->env->worker;
@@ -697,9 +706,9 @@ struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
 		return NULL;
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(w->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, addr, addrlen,
-		libworker_handle_service_reply, e, w->back->udp_buff,
-		&outbound_entry_compare);
+		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
+		addr, addrlen, libworker_handle_service_reply, e, 
+		w->back->udp_buff, &outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -826,7 +835,8 @@ int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
@@ -129,6 +129,7 @@ int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
 * @param qclass: query class. (host order)
 * @param flags: host order flags word, with opcode and CD bit.
 * @param dnssec: if set, EDNS record will have DO bit set.
+ * @param want_dnssec: signatures needed.
 * @param addr: where to.
 * @param addrlen: length of addr.
 * @param q: wich query state to reactivate upon return.
@@ -137,7 +138,7 @@ int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
 */
 struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
        uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-        struct sockaddr_storage* addr, socklen_t addrlen,
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
        struct module_qstate* q);

 /** process incoming replies from the network */
@@ -44,6 +44,7 @@
 #endif

 #include "config.h"
+#include "ldns/ldns.h"

 #undef _POSIX_C_SOURCE
 #undef _XOPEN_SOURCE
@@ -56,6 +57,8 @@

 #ifdef S_SPLINT_S
 typedef struct PyObject PyObject;
+typedef struct PyThreadState PyThreadState;
+typedef void* PyGILState_STATE;
 #endif

 /**
@@ -66,6 +69,8 @@ struct pythonmod_env {
 	/** Python script filename. */
 	const char* fname;

+	/** Python main thread */
+	PyThreadState* mainthr;
 	/** Python module. */
 	PyObject* module;

@@ -107,6 +112,7 @@ int pythonmod_init(struct module_env* env, int id)
   /* Initialize module */
   FILE* script_py = NULL;
   PyObject* py_cfg, *res;
+   PyGILState_STATE gil;
   struct pythonmod_env* pe = (struct pythonmod_env*)calloc(1, sizeof(struct pythonmod_env));
   if (!pe) 
   {
@@ -130,11 +136,11 @@ int pythonmod_init(struct module_env* env, int id)
      Py_NoSiteFlag = 1;
      Py_Initialize();
      PyEval_InitThreads();
-      PyEval_ReleaseLock();
      SWIG_init();
+      pe->mainthr = PyEval_SaveThread();
   }

-   PyEval_AcquireLock();
+   gil = PyGILState_Ensure();

   /* Initialize Python */
   PyRun_SimpleString("import sys \n");
@@ -150,7 +156,7 @@ int pythonmod_init(struct module_env* env, int id)
   if (PyRun_SimpleString("from unboundmodule import *\n") < 0)
   {
      log_err("pythonmod: cannot initialize core module: unboundmodule.py"); 
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
      return 0;
   }

@@ -158,7 +164,7 @@ int pythonmod_init(struct module_env* env, int id)
   if ((script_py = fopen(pe->fname, "r")) == NULL) 
   {
      log_err("pythonmod: can't open file %s for reading", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
      return 0;
   }

@@ -174,7 +180,7 @@ int pythonmod_init(struct module_env* env, int id)
   if (PyRun_SimpleFile(script_py, pe->fname) < 0) 
   {
      log_err("pythonmod: can't parse Python script %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
      return 0;
   }

@@ -183,25 +189,25 @@ int pythonmod_init(struct module_env* env, int id)
   if ((pe->func_init = PyDict_GetItemString(pe->dict, "init")) == NULL) 
   {
      log_err("pythonmod: function init is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
      return 0;
   }
   if ((pe->func_deinit = PyDict_GetItemString(pe->dict, "deinit")) == NULL) 
   {
      log_err("pythonmod: function deinit is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
      return 0;
   }
   if ((pe->func_operate = PyDict_GetItemString(pe->dict, "operate")) == NULL) 
   {
      log_err("pythonmod: function operate is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
      return 0;
   }
   if ((pe->func_inform = PyDict_GetItemString(pe->dict, "inform_super")) == NULL) 
   {
      log_err("pythonmod: function inform_super is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
      return 0;
   }

@@ -215,7 +221,7 @@ int pythonmod_init(struct module_env* env, int id)

   Py_XDECREF(res);
   Py_XDECREF(py_cfg);
-   PyEval_ReleaseLock();
+   PyGILState_Release(gil);

   return 1;
 }
@@ -230,9 +236,9 @@ void pythonmod_deinit(struct module_env* env, int id)
   if(pe->module != NULL)
   {
      PyObject* res;
+      PyGILState_STATE gil = PyGILState_Ensure();

      /* Deinit module */
-      PyEval_AcquireLock();
      res = PyObject_CallFunction(pe->func_deinit, "i", id);
      if (PyErr_Occurred()) {
         log_err("pythonmod: Exception occurred in function deinit");
@@ -242,8 +248,11 @@ void pythonmod_deinit(struct module_env* env, int id)
      Py_XDECREF(res);
      /* Free shared data if any */
      Py_XDECREF(pe->data);
+      PyGILState_Release(gil);

+      PyEval_RestoreThread(pe->mainthr);
      Py_Finalize();
+      pe->mainthr = NULL;
   }
   pe->fname = NULL;
   free(pe);
@@ -257,6 +266,7 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
   struct pythonmod_env* pe = (struct pythonmod_env*)qstate->env->modinfo[id];
   struct pythonmod_qstate* pq = (struct pythonmod_qstate*)qstate->minfo[id];
   PyObject* py_qstate, *py_sqstate, *res;
+   PyGILState_STATE gil = PyGILState_Ensure();

   log_query_info(VERB_ALGO, "pythonmod: inform_super, sub is", &qstate->qinfo);
   log_query_info(VERB_ALGO, "super is", &super->qinfo);
@@ -264,7 +274,6 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
   py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
   py_sqstate = SWIG_NewPointerObj((void*) super, SWIGTYPE_p_module_qstate, 0);

-   PyEval_AcquireLock();
   res = PyObject_CallFunction(pe->func_inform, "iOOO", id, py_qstate, 
 	py_sqstate, pq->data);

@@ -284,7 +293,7 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
   Py_XDECREF(py_sqstate);
   Py_XDECREF(py_qstate);

-   PyEval_ReleaseLock();
+   PyGILState_Release(gil);
 }

 void pythonmod_operate(struct module_qstate* qstate, enum module_ev event, 
@@ -293,6 +302,7 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
   struct pythonmod_env* pe = (struct pythonmod_env*)qstate->env->modinfo[id];
   struct pythonmod_qstate* pq = (struct pythonmod_qstate*)qstate->minfo[id];
   PyObject* py_qstate, *res;
+   PyGILState_STATE gil = PyGILState_Ensure();

   if ( pq == NULL)
   { 
@@ -304,9 +314,6 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
      Py_INCREF(pq->data);
   }

-   /* Lock Python */
-   PyEval_AcquireLock();
-
   /* Call operate */
   py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
   res = PyObject_CallFunction(pe->func_operate, "iiOO", id, (int) event, 
@@ -325,8 +332,7 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
   Py_XDECREF(res);
   Py_XDECREF(py_qstate);

-   /* Unlock Python */
-   PyEval_ReleaseLock();
+   PyGILState_Release(gil);
 }

 void pythonmod_clear(struct module_qstate* qstate, int id)
@@ -340,7 +346,9 @@ void pythonmod_clear(struct module_qstate* qstate, int id)
   	(unsigned long int)pq);
   if(pq != NULL)
   {
+      PyGILState_STATE gil = PyGILState_Ensure();
      Py_DECREF(pq->data);
+      PyGILState_Release(gil);
      /* Free qstate */
      free(pq);
   }
@@ -39,6 +39,7 @@
 * This file contains the infrastructure cache.
 */
 #include "config.h"
+#include "ldns/rr.h"
 #include "services/cache/infra.h"
 #include "util/storage/slabhash.h"
 #include "util/storage/lookup3.h"
@@ -39,6 +39,10 @@
 * This file has functions to get queries from clients.
 */
 #include "config.h"
+#ifdef HAVE_SYS_TYPES_H
+#  include <sys/types.h>
+#endif
+#include <sys/time.h>
 #include "services/listen_dnsport.h"
 #include "services/outside_network.h"
 #include "util/netevent.h"
@@ -46,9 +50,6 @@
 #include "util/config_file.h"
 #include "util/net_help.h"

-#ifdef HAVE_SYS_TYPES_H
-#  include <sys/types.h>
-#endif
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -490,7 +491,7 @@ port_insert(struct listen_port** list, int s, enum listen_type ftype)
 static int
 set_recvpktinfo(int s, int family) 
 {
-#if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || defined(IP_RECVDSTADDR) || defined(IP_PKTINFO)
+#if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || (defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)) || defined(IP_PKTINFO)
 	int on = 1;
 #else
 	(void)s;
@@ -517,22 +518,22 @@ set_recvpktinfo(int s, int family)
 #           endif /* defined IPV6_RECVPKTINFO */

 	} else if(family == AF_INET) {
-#           ifdef IP_RECVDSTADDR
-		if(setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR,
-			(void*)&on, (socklen_t)sizeof(on)) < 0) {
-			log_err("setsockopt(..., IP_RECVDSTADDR, ...) failed: %s",
-				strerror(errno));
-			return 0;
-		}
-#           elif defined(IP_PKTINFO)
+#           ifdef IP_PKTINFO
 		if(setsockopt(s, IPPROTO_IP, IP_PKTINFO,
 			(void*)&on, (socklen_t)sizeof(on)) < 0) {
 			log_err("setsockopt(..., IP_PKTINFO, ...) failed: %s",
 				strerror(errno));
 			return 0;
 		}
+#           elif defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)
+		if(setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR,
+			(void*)&on, (socklen_t)sizeof(on)) < 0) {
+			log_err("setsockopt(..., IP_RECVDSTADDR, ...) failed: %s",
+				strerror(errno));
+			return 0;
+		}
 #           else
-		log_err("no IP_RECVDSTADDR or IP_PKTINFO option, please disable "
+		log_err("no IP_SENDSRCADDR or IP_PKTINFO option, please disable "
 			"interface-automatic in config");
 		return 0;
 #           endif /* IP_PKTINFO */
@@ -39,6 +39,8 @@
 * This file contains functions to enable local zone authority service.
 */
 #include "config.h"
+#include "ldns/dname.h"
+#include "ldns/host2wire.h"
 #include "services/localzone.h"
 #include "util/regional.h"
 #include "util/config_file.h"
@@ -43,6 +43,7 @@
 * send back to clients.
 */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "services/mesh.h"
 #include "services/outbound_list.h"
 #include "services/cache/dns.h"
@@ -39,6 +39,7 @@
 * This file contains functions to help maintain a stack of modules.
 */
 #include "config.h"
+#include <ctype.h>
 #include "services/modstack.h"
 #include "util/module.h"
 #include "util/fptr_wlist.h"
@@ -40,6 +40,7 @@
 * queries it has outstanding to authoritative servers.
 */
 #include "config.h"
+#include <sys/time.h>
 #include "services/outbound_list.h"
 #include "services/outside_network.h"

@@ -40,6 +40,12 @@
 * wait for the pending answer events.
 */
 #include "config.h"
+#include <ctype.h>
+#ifdef HAVE_SYS_TYPES_H
+#  include <sys/types.h>
+#endif
+#include <sys/time.h>
+#include "ldns/wire2host.h"
 #include "services/outside_network.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/infra.h"
@@ -53,9 +59,6 @@
 #include "util/random.h"
 #include "util/fptr_wlist.h"

-#ifdef HAVE_SYS_TYPES_H
-#  include <sys/types.h>
-#endif
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -807,9 +810,9 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 	log_assert(outnet->unused_fds);
 	tries = 0;
 	while(1) {
-		my_if = ub_random(outnet->rnd) % num_if;
+		my_if = ub_random_max(outnet->rnd, num_if);
 		pif = &ifs[my_if];
-		my_port = ub_random(outnet->rnd) % pif->avail_total;
+		my_port = ub_random_max(outnet->rnd, pif->avail_total);
 		if(my_port < pif->inuse) {
 			/* port already open */
 			pend->pc = pif->out[my_port];
@@ -1075,7 +1078,7 @@ lookup_serviced(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
 /** Create new serviced entry */
 static struct serviced_query*
 serviced_create(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
-        struct sockaddr_storage* addr, socklen_t addrlen)
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen)
 {
 	struct serviced_query* sq = (struct serviced_query*)malloc(sizeof(*sq));
 	rbnode_t* ins;
@@ -1089,6 +1092,7 @@ serviced_create(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
 	}
 	sq->qbuflen = ldns_buffer_limit(buff);
 	sq->dnssec = dnssec;
+	sq->want_dnssec = want_dnssec;
 	memcpy(&sq->addr, addr, addrlen);
 	sq->addrlen = addrlen;
 	sq->outnet = outnet;
@@ -1130,7 +1134,8 @@ serviced_delete(struct serviced_query* sq)
 		/* clear up the pending query */
 		if(sq->status == serviced_query_UDP_EDNS ||
 			sq->status == serviced_query_UDP ||
-			sq->status == serviced_query_PROBE_EDNS) {
+			sq->status == serviced_query_PROBE_EDNS ||
+			sq->status == serviced_query_UDP_EDNS_fallback) {
 			struct pending* p = (struct pending*)sq->pending;
 			if(p->pc)
 				portcomm_loweruse(sq->outnet, p->pc);
@@ -1407,12 +1412,25 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 		(LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
 		LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(ldns_buffer_begin(
 		c->buffer)) == LDNS_RCODE_NOTIMPL) ) {
-		if(!infra_edns_update(sq->outnet->infra, &sq->addr, 
+		/* attempt to fallback to nonEDNS */
+		sq->status = serviced_query_TCP_EDNS_fallback;
+		serviced_tcp_initiate(sq->outnet, sq, c->buffer);
+		return 0;
+	} else if(error==NETEVENT_NOERROR && 
+		sq->status == serviced_query_TCP_EDNS_fallback &&
+			(LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
+			LDNS_RCODE_NOERROR || LDNS_RCODE_WIRE(
+			ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NXDOMAIN 
+			|| LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) 
+			== LDNS_RCODE_YXDOMAIN)) {
+		/* the fallback produced a result that looks promising, note
+		 * that this server should be approached without EDNS */
+		/* only store noEDNS in cache if domain is noDNSSEC */
+		if(!sq->want_dnssec)
+		  if(!infra_edns_update(sq->outnet->infra, &sq->addr, 
 			sq->addrlen, -1, *sq->outnet->now_secs))
 			log_err("Out of memory caching no edns for host");
 		sq->status = serviced_query_TCP;
-		serviced_tcp_initiate(sq->outnet, sq, c->buffer);
-		return 0;
 	}
 	/* insert address into reply info */
 	if(!rep) {
@@ -1502,43 +1520,33 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			serviced_callbacks(sq, NETEVENT_TIMEOUT, c, rep);
 			return 0;
 		}
+	} else if(error != NETEVENT_NOERROR) {
+		/* udp returns error (due to no ID or interface available) */
+		serviced_callbacks(sq, error, c, rep);
+		return 0;
 	}
-	if(error == NETEVENT_NOERROR && sq->status == serviced_query_UDP_EDNS 
+	if(sq->status == serviced_query_UDP_EDNS 
 		&& (LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) 
 			== LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(
 			ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOTIMPL)) {
-		/* note no EDNS, fallback without EDNS */
-		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
-			-1, (uint32_t)now.tv_sec)) {
-			log_err("Out of memory caching no edns for host");
-		}
-		sq->status = serviced_query_UDP;
+		/* try to get an answer by falling back without EDNS */
+		sq->status = serviced_query_UDP_EDNS_fallback;
 		sq->retry = 0;
 		if(!serviced_udp_send(sq, c->buffer)) {
 			serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
 		}
 		return 0;
-	}
-	if(LDNS_TC_WIRE(ldns_buffer_begin(c->buffer)) ||
-		(error != NETEVENT_NOERROR && fallback_tcp)  ) {
-		/* fallback to TCP */
-		/* this discards partial UDP contents */
-		if(sq->status == serviced_query_UDP_EDNS)
-			sq->status = serviced_query_TCP_EDNS;
-		else	sq->status = serviced_query_TCP;
-		serviced_tcp_initiate(outnet, sq, c->buffer);
-		return 0;
-	}
-	/* yay! an answer */
-	if(sq->status == serviced_query_PROBE_EDNS) {
+	} else if(sq->status == serviced_query_PROBE_EDNS) {
 		/* probe without EDNS succeeds, so we conclude that this
 		 * host likely has EDNS packets dropped */
 		log_addr(VERB_DETAIL, "timeouts, concluded that connection to "
 			"host drops EDNS packets", &sq->addr, sq->addrlen);
-		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
+		/* only store noEDNS in cache if domain is noDNSSEC */
+		if(!sq->want_dnssec)
+		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
 			-1, (uint32_t)now.tv_sec)) {
 			log_err("Out of memory caching no edns for host");
-		}
+		  }
 		sq->status = serviced_query_UDP;
 	} else if(sq->status == serviced_query_UDP_EDNS && 
 		!sq->edns_lame_known) {
@@ -1548,6 +1556,21 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			log_err("Out of memory caching edns works");
 		}
 		sq->edns_lame_known = 1;
+	} else if(sq->status == serviced_query_UDP_EDNS_fallback &&
+		!sq->edns_lame_known && (LDNS_RCODE_WIRE(
+		ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOERROR || 
+		LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
+		LDNS_RCODE_NXDOMAIN || LDNS_RCODE_WIRE(ldns_buffer_begin(
+		c->buffer)) == LDNS_RCODE_YXDOMAIN)) {
+		/* the fallback produced a result that looks promising, note
+		 * that this server should be approached without EDNS */
+		/* only store noEDNS in cache if domain is noDNSSEC */
+		if(!sq->want_dnssec)
+		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
+			-1, (uint32_t)now.tv_sec)) {
+			log_err("Out of memory caching no edns for host");
+		  }
+		sq->status = serviced_query_UDP;
 	}
 	if(now.tv_sec > sq->last_sent_time.tv_sec ||
 		(now.tv_sec == sq->last_sent_time.tv_sec &&
@@ -1561,6 +1584,20 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			roundtime, sq->last_rtt, (uint32_t)now.tv_sec))
 			log_err("out of memory noting rtt.");
 	}
+	/* perform TC flag check and TCP fallback after updating our
+	 * cache entries for EDNS status and RTT times */
+	if(LDNS_TC_WIRE(ldns_buffer_begin(c->buffer)) || fallback_tcp) {
+		/* fallback to TCP */
+		/* this discards partial UDP contents */
+		if(sq->status == serviced_query_UDP_EDNS ||
+			sq->status == serviced_query_UDP_EDNS_fallback)
+			/* if we have unfinished EDNS_fallback, start again */
+			sq->status = serviced_query_TCP_EDNS;
+		else	sq->status = serviced_query_TCP;
+		serviced_tcp_initiate(outnet, sq, c->buffer);
+		return 0;
+	}
+	/* yay! an answer */
 	serviced_callbacks(sq, error, c, rep);
 	return 0;
 }
@@ -1581,10 +1618,10 @@ callback_list_find(struct serviced_query* sq, void* cb_arg,
 struct serviced_query* 
 outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr,
-	socklen_t addrlen, comm_point_callback_t* callback,
-	void* callback_arg, ldns_buffer* buff, 
-	int (*arg_compare)(void*,void*))
+	uint16_t flags, int dnssec, int want_dnssec,
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	comm_point_callback_t* callback, void* callback_arg, 
+	ldns_buffer* buff, int (*arg_compare)(void*,void*))
 {
 	struct serviced_query* sq;
 	struct service_callback* cb;
@@ -1600,7 +1637,8 @@ outnet_serviced_query(struct outside_network* outnet,
 		return NULL;
 	if(!sq) {
 		/* make new serviced query entry */
-		sq = serviced_create(outnet, buff, dnssec, addr, addrlen);
+		sq = serviced_create(outnet, buff, dnssec, want_dnssec,
+			addr, addrlen);
 		if(!sq) {
 			free(cb);
 			return NULL;
@@ -1752,7 +1790,8 @@ serviced_get_mem(struct serviced_query* sq)
 		s += sizeof(*sb);
 	if(sq->status == serviced_query_UDP_EDNS ||
 		sq->status == serviced_query_UDP ||
-		sq->status == serviced_query_PROBE_EDNS) {
+		sq->status == serviced_query_PROBE_EDNS ||
+		sq->status == serviced_query_UDP_EDNS_fallback) {
 		s += sizeof(struct pending);
 		s += comm_timer_get_mem(NULL);
 	} else {
@@ -291,6 +291,8 @@ struct serviced_query {
 	size_t qbuflen;
 	/** If an EDNS section is included, the DO/CD bit will be turned on. */
 	int dnssec;
+	/** We want signatures, or else the answer is likely useless */
+	int want_dnssec;
 	/** where to send it */
 	struct sockaddr_storage addr;
 	/** length of addr field in use. */
@@ -308,7 +310,11 @@ struct serviced_query {
 		/** TCP without EDNS sent */
 		serviced_query_TCP,
 		/** probe to test EDNS lameness (EDNS is dropped) */
-		serviced_query_PROBE_EDNS
+		serviced_query_PROBE_EDNS,
+		/** probe to test noEDNS0 (EDNS gives FORMERRorNOTIMP) */
+		serviced_query_UDP_EDNS_fallback,
+		/** probe to test TCP noEDNS0 (EDNS gives FORMERRorNOTIMP) */
+		serviced_query_TCP_EDNS_fallback
 	} 	
 		/** variable with current status */ 
 		status;
@@ -427,6 +433,8 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
 * @param dnssec: if set, DO bit is set in EDNS queries.
 *	If the value includes BIT_CD, CD bit is set when in EDNS queries.
 *	If the value includes BIT_DO, DO bit is set when in EDNS queries.
+ * @param want_dnssec: signatures are needed, without EDNS the answer is
+ * 	likely to be useless.
 * @param callback: callback function.
 * @param callback_arg: user argument to callback function.
 * @param addr: to which server to send the query.
@@ -439,10 +447,10 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
 */
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr, 
-	socklen_t addrlen, comm_point_callback_t* callback, 
-	void* callback_arg, ldns_buffer* buff, 
-	int (*arg_compare)(void*,void*));
+	uint16_t flags, int dnssec, int want_dnssec,
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	comm_point_callback_t* callback, void* callback_arg, 
+	ldns_buffer* buff, int (*arg_compare)(void*,void*));

 /**
 * Remove service query callback.
@@ -52,6 +52,9 @@
 #include "iterator/iter_fwd.h"
 #include "validator/validator.h"
 #include "services/localzone.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 #ifdef HAVE_PWD_H
 #include <pwd.h>
 #endif
@@ -154,7 +157,7 @@ interfacechecks(struct config_file* cfg)
 	socklen_t alen;
 	int i, j;
 	for(i=0; i<cfg->num_ifs; i++) {
-		if(!ipstrtoaddr(cfg->ifs[i], UNBOUND_DNS_PORT, &a, &alen)) {
+		if(!extstrtoaddr(cfg->ifs[i], &a, &alen)) {
 			fatal_exit("cannot parse interface specified as '%s'",
 				cfg->ifs[i]);
 		}
@@ -42,6 +42,18 @@
 */

 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#ifdef HAVE_OPENSSL_SSL_H
+#include <openssl/ssl.h>
+#endif
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/locks.h"
@@ -41,6 +41,9 @@
 */

 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 /* remove alloc checks, not in this part of the code */
 #ifdef UNBOUND_ALLOC_STATS
 #undef malloc
@@ -48,6 +51,14 @@
 #undef free
 #undef realloc
 #endif
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef free
+#undef realloc
+#undef strdup
+#define unbound_lite_wrapstr(s) s
+#endif
 #include "libunbound/unbound.h"
 #include <ldns/ldns.h>

@@ -486,6 +497,12 @@ int main(int argc, char* argv[])
 	}
 	if(debuglevel != 0) /* set after possible -C options */
 		check_ub_res(ub_ctx_debuglevel(ctx, debuglevel));
+	if(ub_ctx_get_option(ctx, "use-syslog", &optarg) == 0) {
+		if(strcmp(optarg, "yes") == 0) /* disable use-syslog */
+			check_ub_res(ub_ctx_set_option(ctx, 
+				"use-syslog:", "no"));
+		free(optarg);
+	}
 	argc -= optind;
 	argv += optind;
 	if(argc != 1)
@@ -112,7 +112,8 @@ int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec), 
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
@@ -151,7 +152,8 @@ int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
@@ -41,10 +41,20 @@
 */

 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 #include "libunbound/unbound.h"
 #include "libunbound/context.h"
 #include "util/locks.h"
 #include "util/log.h"
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef realloc
+#undef free
+#undef strdup
+#endif

 /** keeping track of the async ids */
 struct track_id {
@@ -41,6 +41,13 @@
 */

 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+#include <sys/time.h>
 #include "util/net_help.h"
 #include "util/config_file.h"
 #include <signal.h>
@@ -7,9 +7,14 @@ NEED_XXD='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_CURL='06-ianaports.tpkg'
 NEED_WHOAMI='07-confroot.tpkg'
-NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg'
+NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg stub_udp6.tpkg'
 NEED_NOMINGW='tcp_sigpipe.tpkg 07-confroot.tpkg 08-host-lib.tpkg fwd_ancil.tpkg'

+# test if dig, wdiff and ldns-testns are available.
+if test ! -x "`which dig 2>&1`"; then echo No 'dig' in path; exit 1; fi
+if test ! -x "`which wdiff 2>&1`"; then echo No 'wdiff' in path; exit 1; fi
+if test ! -x "`which ldns-testns 2>&1`"; then echo No 'ldns-testns' in path; exit 1; fi
+
 # test for ipv6, uses streamptcp peculiarity.
 if ./streamtcp -f ::1 2>&1 | grep "not supported" >/dev/null 2>&1; then
 	HAVE_IPV6=no
@@ -988,10 +988,10 @@ pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,

 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
        uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr,
-	socklen_t addrlen, comm_point_callback_t* callback,
-	void* callback_arg, ldns_buffer* ATTR_UNUSED(buff),
-	int (*arg_compare)(void*,void*))
+	uint16_t flags, int dnssec, int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	comm_point_callback_t* callback, void* callback_arg, 
+	ldns_buffer* ATTR_UNUSED(buff), int (*arg_compare)(void*,void*))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,
@@ -69,11 +69,23 @@
 */

 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#include "ldns/ldns.h"
 #include <signal.h>
 #include "libunbound/unbound.h"
 #ifdef HAVE_SYS_STAT_H
 #include <sys/stat.h>
 #endif
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef realloc
+#undef free
+#undef strdup
+#define unbound_lite_wrapstr(s) s
+#endif
 struct todo_item;
 struct labdata;

@@ -31,8 +31,12 @@ struct sockaddr_storage;
 /** string to show in warnings and errors */
 static const char* prog_name = "ldns-testpkts";

+#ifndef UTIL_LOG_H
+/** verbosity definition for compat */
+enum verbosity_value { NO_VERBOSE=0 };
+#endif
 /** logging routine, provided by caller */
-void verbose(int lvl, const char* msg, ...);
+void verbose(enum verbosity_value lvl, const char* msg, ...) ATTR_FORMAT(printf, 2, 3);

 /** print error and exit */
 static void error(const char* msg, ...)
@@ -589,12 +593,12 @@ match_list(ldns_rr_list* q, ldns_rr_list *p, bool mttl)
 	{
 		if(ldns_rr_compare(ldns_rr_list_rr(q, i), 
 			ldns_rr_list_rr(p, i)) != 0) {
-			verbose(3, "rr %d different", i);
+			verbose(3, "rr %d different", (int)i);
 			return 0;
 		}
 		if(mttl && ldns_rr_ttl(ldns_rr_list_rr(q, i)) !=
 			ldns_rr_ttl(ldns_rr_list_rr(p, i))) {
-			verbose(3, "rr %d ttl different", i);
+			verbose(3, "rr %d ttl different", (int)i);
 			return 0;
 		}
 	}
@@ -768,7 +772,7 @@ handle_query(uint8_t* inbuf, ssize_t inlen, struct entry* entries, int* count,
 	
 	query_rr = ldns_rr_list_rr(ldns_pkt_question(query_pkt), 0);
 	verbose(1, "query %d: id %d: %s %d bytes: ", ++(*count), (int)ldns_pkt_id(query_pkt), 
-		(transport==transport_tcp)?"TCP":"UDP", inlen);
+		(transport==transport_tcp)?"TCP":"UDP", (int)inlen);
 	if(verbose_out) ldns_rr_print(verbose_out, query_rr);
 	if(verbose_out) ldns_pkt_print(verbose_out, query_pkt);

@@ -40,6 +40,10 @@
 */

 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#include "ldns/ldns.h"
 #include <signal.h>
 #include "util/log.h"
 #include "util/locks.h"
@@ -40,6 +40,7 @@
 */

 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/log.h"
 #include "util/data/dname.h"
 #include "util/data/msgparse.h"
@@ -38,6 +38,7 @@
 * Declarations useful for the unit tests.
 */
 #include "config.h"
+#include <ctype.h>
 #include "testcode/readhex.h"
 #include "util/log.h"

@@ -40,6 +40,7 @@

 #ifndef TESTCODE_READHEX_H
 #define TESTCODE_READHEX_H
+#include "ldns/buffer.h"

 /** 
 * Helper to convert hex string to packet buffer.
@@ -40,6 +40,7 @@
 * construct input to test the validator with.
 */
 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/net_help.h"
@@ -40,6 +40,10 @@
 */

 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#include "ldns/ldns.h"
 #include <signal.h>
 #include "util/locks.h"
 #include "util/log.h"
@@ -39,6 +39,7 @@
 */

 #include "config.h"
+#include "ldns/rr.h"
 #include "util/log.h"
 #include "util/data/dname.h"
 #include "testcode/unitmain.h"
@@ -39,6 +39,8 @@
 */

 #include "config.h"
+#include "ldns/dname.h"
+#include "ldns/host2wire.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"
 #include "util/data/dname.h"
@@ -793,12 +795,53 @@ dname_test_valid()
 		, 4096) == 0);
 }

+/** test pkt_dname_tolower */
+static void
+dname_test_pdtl(ldns_buffer* loopbuf, ldns_buffer* boundbuf)
+{
+	unit_show_func("util/data/dname.c", "pkt_dname_tolower");
+	pkt_dname_tolower(loopbuf, ldns_buffer_at(loopbuf, 12));
+	pkt_dname_tolower(boundbuf, ldns_buffer_at(boundbuf, 12));
+}
+
+/** setup looped dname and out-of-bounds dname ptr */
+static void
+dname_setup_bufs(ldns_buffer* loopbuf, ldns_buffer* boundbuf)
+{
+	ldns_buffer_write_u16(loopbuf, 0xd54d);  /* id */
+	ldns_buffer_write_u16(loopbuf, 0x12);    /* flags  */
+	ldns_buffer_write_u16(loopbuf, 1);       /* qdcount */
+	ldns_buffer_write_u16(loopbuf, 0);       /* ancount */
+	ldns_buffer_write_u16(loopbuf, 0);       /* nscount */
+	ldns_buffer_write_u16(loopbuf, 0);       /* arcount */
+	ldns_buffer_write_u8(loopbuf, 0xc0); /* PTR back at itself */
+	ldns_buffer_write_u8(loopbuf, 0x0c);
+	ldns_buffer_flip(loopbuf);
+
+	ldns_buffer_write_u16(boundbuf, 0xd54d);  /* id */
+	ldns_buffer_write_u16(boundbuf, 0x12);    /* flags  */
+	ldns_buffer_write_u16(boundbuf, 1);       /* qdcount */
+	ldns_buffer_write_u16(boundbuf, 0);       /* ancount */
+	ldns_buffer_write_u16(boundbuf, 0);       /* nscount */
+	ldns_buffer_write_u16(boundbuf, 0);       /* arcount */
+	ldns_buffer_write_u8(boundbuf, 0x01); /* len=1 */
+	ldns_buffer_write_u8(boundbuf, (uint8_t)'A'); /* A. label */
+	ldns_buffer_write_u8(boundbuf, 0xc0); /* PTR out of bounds */
+	ldns_buffer_write_u8(boundbuf, 0xcc);
+	ldns_buffer_flip(boundbuf);
+}
+
 void dname_test()
 {
+	ldns_buffer* loopbuf = ldns_buffer_new(14);
+	ldns_buffer* boundbuf = ldns_buffer_new(16);
 	ldns_buffer* buff = ldns_buffer_new(65800);
+	unit_assert(loopbuf && boundbuf && buff);
 	ldns_buffer_flip(buff);
+	dname_setup_bufs(loopbuf, boundbuf);
 	dname_test_qdl(buff);
 	dname_test_qdtl(buff);
+	dname_test_pdtl(loopbuf, boundbuf);
 	dname_test_query_dname_compare();
 	dname_test_count_labels();
 	dname_test_count_size_labels();
@@ -814,4 +857,6 @@ void dname_test()
 	dname_test_topdomain();
 	dname_test_valid();
 	ldns_buffer_free(buff);
+	ldns_buffer_free(loopbuf);
+	ldns_buffer_free(boundbuf);
 }
@@ -40,6 +40,22 @@
 */

 #include "config.h"
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
+
+#ifdef HAVE_OPENSSL_CONF_H
+#include <openssl/conf.h>
+#endif
+
+#ifdef HAVE_OPENSSL_ENGINE_H
+#include <openssl/engine.h>
+#endif
+#include "ldns/ldns.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"

@@ -431,10 +447,12 @@ static void
 rnd_test()
 {
 	struct ub_randstate* r;
-	int num = 100, i;
-	long int a[100];
+	int num = 1000, i;
+	long int a[1000];
+	unsigned int seed = (unsigned)time(NULL);
 	unit_show_feature("ub_random");
-	unit_assert( (r = ub_initstate((unsigned)time(NULL), NULL)) );
+	printf("ub_random seed is %u\n", seed);
+	unit_assert( (r = ub_initstate(seed, NULL)) );
 	for(i=0; i<num; i++) {
 		a[i] = ub_random(r);
 		unit_assert(a[i] >= 0);
@@ -444,6 +462,14 @@ rnd_test()
 				a[i] != a[i-3] || a[i] != a[i-4] ||
 				a[i] != a[i-5] || a[i] != a[i-6]);
 	}
+	a[0] = ub_random_max(r, 1);
+	unit_assert(a[0] >= 0 && a[0] < 1);
+	a[0] = ub_random_max(r, 10000);
+	unit_assert(a[0] >= 0 && a[0] < 10000);
+	for(i=0; i<num; i++) {
+		a[i] = ub_random_max(r, 10);
+		unit_assert(a[i] >= 0 && a[i] < 10);
+	}
 	ub_randfree(r);
 }

@@ -489,6 +515,7 @@ main(int argc, char* argv[])
 	rtt_test();
 	anchors_test();
 	alloc_test();
+	regional_test();
 	lruhash_test();
 	slabhash_test();
 	infra_test();
@@ -497,7 +524,7 @@ main(int argc, char* argv[])
 	printf("%d checks ok.\n", testcount);
 #ifdef HAVE_OPENSSL_CONFIG
 	EVP_cleanup();
-	/*ENGINE_cleanup();*/
+	ENGINE_cleanup();
 	CONF_modules_free();
 #endif
 	CRYPTO_cleanup_all_ex_data();
@@ -70,5 +70,7 @@ void anchors_test();
 void verify_test();
 /** unit test for negative cache functions */
 void neg_test();
+/** unit test for regional allocator functions */
+void regional_test();

 #endif /* TESTCODE_UNITMAIN_H */
@@ -39,6 +39,7 @@
 */

 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"
 #include "util/data/msgparse.h"
@@ -0,0 +1,244 @@
+/*
+ * testcode/unitregional.c - unit test for regional allocator.
+ *
+ * Copyright (c) 2010, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+/**
+ * \file
+ * Tests the regional special purpose allocator.
+ */
+
+#include "config.h"
+#include "testcode/unitmain.h"
+#include "util/log.h"
+#include "util/regional.h"
+
+/** test regional corner cases, zero, one, end of structure */
+static void
+corner_cases(struct regional* r)
+{
+	size_t s; /* shadow count of allocated memory */
+	void* a;
+	size_t minsize = sizeof(uint64_t);
+	size_t mysize;
+	char* str;
+	unit_assert(r);
+	/* alloc cases:
+	 * 0, 1, 2.
+	 * smaller than LARGE_OBJECT_SIZE.
+	 * smaller but does not fit in remainder in regional.
+	 * smaller but exactly fits in remainder of regional.
+	 * size is remainder of regional - 8.
+	 * size is remainder of regional + 8.
+	 * larger than LARGE_OBJECT_SIZE.
+	 */
+	s = sizeof(struct regional);
+	unit_assert((s % minsize) == 0);
+	unit_assert(r->available == r->first_size - s);
+	unit_assert(r->large_list == NULL);
+	unit_assert(r->next == NULL);
+
+	/* Note an alloc of 0 gets a pointer to current last
+	 * position (where you should then use 0 bytes) */
+	a = regional_alloc(r, 0);
+	unit_assert(a);
+	s+=0;
+	unit_assert(r->available == r->first_size - s);
+
+	a = regional_alloc(r, 1);
+	unit_assert(a);
+	memset(a, 0x42, 1);
+	s+=minsize;
+	unit_assert(r->available == r->first_size - s);
+
+	a = regional_alloc(r, 2);
+	unit_assert(a);
+	memset(a, 0x42, 2);
+	s+=minsize;
+	unit_assert(r->available == r->first_size - s);
+
+	a = regional_alloc(r, 128);
+	unit_assert(a);
+	memset(a, 0x42, 128);
+	s+=128;
+	unit_assert(r->available == r->first_size - s);
+
+	unit_assert(r->large_list == NULL);
+	a = regional_alloc(r, 10240);
+	unit_assert(a);
+	unit_assert(r->large_list != NULL);
+	memset(a, 0x42, 10240);
+	/* s does not change */
+	unit_assert(r->available == r->first_size - s);
+	unit_assert(r->total_large == 10240+minsize);
+
+	/* go towards the end of the current chunk */
+	while(r->available > 1024) {
+		a = regional_alloc(r, 1024);
+		unit_assert(a);
+		memset(a, 0x42, 1024);
+		s += 1024;
+		unit_assert(r->available == r->first_size - s);
+	}
+
+	unit_assert(r->next == NULL);
+	mysize = 1280; /* does not fit in current chunk */
+	a = regional_alloc(r, mysize);
+	memset(a, 0x42, mysize);
+	unit_assert(r->next != NULL);
+	unit_assert(a);
+
+	/* go towards the end of the current chunk */
+	while(r->available > 864) {
+		a = regional_alloc(r, 864);
+		unit_assert(a);
+		memset(a, 0x42, 864);
+		s += 864;
+	}
+
+	mysize = r->available; /* exactly fits */
+	a = regional_alloc(r, mysize);
+	memset(a, 0x42, mysize);
+	unit_assert(a);
+	unit_assert(r->available == 0); /* implementation does not go ahead*/
+
+	a = regional_alloc(r, 8192); /* another large allocation */
+	unit_assert(a);
+	memset(a, 0x42, 8192);
+	unit_assert(r->available == 0);
+	unit_assert(r->total_large == 10240 + 8192 + 2*minsize);
+
+	a = regional_alloc(r, 32); /* make new chunk */
+	unit_assert(a);
+	memset(a, 0x42, 32);
+	unit_assert(r->available > 0);
+	unit_assert(r->total_large == 10240 + 8192 + 2*minsize);
+
+	/* go towards the end of the current chunk */
+	while(r->available > 1320) {
+		a = regional_alloc(r, 1320);
+		unit_assert(a);
+		memset(a, 0x42, 1320);
+		s += 1320;
+	}
+
+	mysize = r->available + 8; /* exact + 8 ; does not fit */
+	a = regional_alloc(r, mysize);
+	memset(a, 0x42, mysize);
+	unit_assert(a);
+	unit_assert(r->available > 0); /* new chunk */
+
+	/* go towards the end of the current chunk */
+	while(r->available > 1480) {
+		a = regional_alloc(r, 1480);
+		unit_assert(a);
+		memset(a, 0x42, 1480);
+		s += 1480;
+	}
+
+	mysize = r->available - 8; /* exact - 8 ; fits. */
+	a = regional_alloc(r, mysize);
+	memset(a, 0x42, mysize);
+	unit_assert(a);
+	unit_assert(r->available == 8);
+
+	/* test if really copied over */
+	str = "test12345";
+	a = regional_alloc_init(r, str, 8);
+	unit_assert(a);
+	unit_assert(memcmp(a, str, 8) == 0);
+
+	/* test if really zeroed */
+	a = regional_alloc_zero(r, 32);
+	str="\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
+	unit_assert(a);
+	unit_assert(memcmp(a, str, 32) == 0);
+
+	/* test if copied over (and null byte) */
+	str = "an interesting string";
+	a = regional_strdup(r, str);
+	unit_assert(a);
+	unit_assert(memcmp(a, str, strlen(str)+1) == 0);
+
+	regional_free_all(r);
+}
+
+/** test specific cases */
+static void
+specific_cases()
+{
+	struct regional* r = regional_create();
+	corner_cases(r);
+	regional_destroy(r);
+	r = regional_create_custom(2048); /* a small regional */
+	unit_assert(r->first_size == 2048);
+	unit_assert(regional_get_mem(r) == 2048);
+	corner_cases(r);
+	unit_assert(regional_get_mem(r) == 2048);
+	regional_destroy(r);
+}
+
+/** put random stuff in a region and free it */
+static void
+burden_test(size_t max)
+{
+	size_t get;
+	void* a;
+	int i;
+	struct regional* r = regional_create_custom(2048);
+	for(i=0; i<1000; i++) {
+		get = random() % max;
+		a = regional_alloc(r, get);
+		unit_assert(a);
+		memset(a, 0x54, get);
+	}
+	regional_free_all(r);
+	regional_destroy(r);
+}
+
+/** randomly allocate stuff */
+static void
+random_burden()
+{
+	size_t max_alloc = 2048 + 128; /* small chance of LARGE */
+	int i;
+	for(i=0; i<100; i++)
+		burden_test(max_alloc);
+}
+
+void regional_test()
+{
+	unit_show_feature("regional");
+	specific_cases();
+	random_burden();
+}
@@ -0,0 +1 @@
+example.com.	3600	IN	DS	60385 12 3 c93b6fd6893d42ae60acd15088c2aeea0e0f013e535961855f17299507f70e0d ; xudef-ririt-kidaf-tebyp-vemep-segih-bydes-dyriv-pofab-zibaf-vigyh-numom-halac-lypin-hycaz-lofub-taxex
@@ -0,0 +1 @@
+example.com.	3600	IN	DNSKEY	256 3 12 9SZY+xB3wKtrLoRHzkBs9L3fjcvazjnk5HF3gMaD1PVp4pthrwgHIm0TUaLrd3YCa2VCl5wj+MzbhZi8NEJ/Cg== ;{id = 60385 (zsk), size = 512b}
@@ -0,0 +1,3 @@
+Private-key-format: v1.2
+Algorithm: 12 (ECC-GOST)
+GostAsn1: MEUCAQAwHAYGKoUDAgITMBIGByqFAwICIwEGByqFAwICHgEEIgIge0NaZG76WD9K6vNRD1yDuVPtKlEtFQbHIjoB106B6Hc=
@@ -1 +0,0 @@
-example.com.	3600	IN	DS	41929 249 203 10e2bc48d0301d16858bd040ee7d5c1983122d6cec0e3324fcdb94ba5ac0f748 ; xegav-dozog-mugef-bolyc-kicem-rygug-borel-tulyc-nibuc-dyryk-serub-vasud-gazut-rihyr-pykis-bytyg-myxyx
@@ -1 +0,0 @@
-example.com.    3600    IN      DNSKEY  256 3 249 AAB7oZ5Ox8mcGrhB4vh41LdJQ5i+MVbn0KVe1a0CU2Akdwbp1qZ2khQTJZ0wOFkEsmgU2wfggXTpU8rp745IDVUb ;{id = 41929 (zsk), size = 512b}
@@ -1,3 +0,0 @@
-Private-key-format: v1.2
-Algorithm: 249 (GOST)
-GostAsn1: MEUCAQAwHAYGKoUDAgITMBIGByqFAwICIwEGByqFAwICHgEEIgIgZdfQ+s3ASjjFsne42OdGYxav0QKoL3p/wOX/3kySQ3Q=
@@ -3,13 +3,13 @@
 ; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
 ; later entries are verified with it.

-; Test GOST signatures using algo number 249.
+; Test GOST signatures using algo number 12.

 ENTRY_BEGIN
 SECTION QUESTION
 nlnetlabs.nl.	IN DNSKEY
 SECTION ANSWER
-nlnetlabs.nl.    3600    IN      DNSKEY  256 3 249 AAB7oZ5Ox8mcGrhB4vh41LdJQ5i+MVbn0KVe1a0CU2Akdwbp1qZ2khQTJZ0wOFkEsmgU2wfggXTpU8rp745IDVUb ;{id = 41929 (zsk), size = 512b}
+nlnetlabs.nl.   3600	IN	DNSKEY	256 3 12 9SZY+xB3wKtrLoRHzkBs9L3fjcvazjnk5HF3gMaD1PVp4pthrwgHIm0TUaLrd3YCa2VCl5wj+MzbhZi8NEJ/Cg== ;{id = 60385 (zsk), size = 512b}
 ENTRY_END

 ; entry to test
@@ -18,7 +18,7 @@ SECTION QUESTION
 open.nlnetlabs.nl. IN A
 SECTION ANSWER
 open.nlnetlabs.nl.      600     IN      A       213.154.224.1
-open.nlnetlabs.nl.	600	IN	RRSIG	A 249 3 600 20090903100515 20090806100515 41929 nlnetlabs.nl. jHGE+RPMlJtQBrmSEbw6ERLkuYR5hjiVMuj7HbxpfGi63A/Tm5zRZaEgx9AK+gvEXMo2d9TN44OaBxPNyxgQNA== ;{id = 41929}
+open.nlnetlabs.nl.	600	IN	RRSIG	A 12 3 600 20090903100515 20090806100515 60385 nlnetlabs.nl. XVxDmt7/gRk13Yv+U+RPuEZ86iCGSVPmTcpMZYJs14Yn6Y/On8X+vgLV6IzxQTxAwGb+D35/dUfT55p6pFo8YQ== ;{id = 60385}
 ENTRY_END

 ENTRY_BEGIN
@@ -27,7 +27,7 @@ open.nlnetlabs.nl. IN AAAA
 SECTION ANSWER
 open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::1
 open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::53
-open.nlnetlabs.nl.	600	IN	RRSIG	AAAA 249 3 600 20090903100515 20090806100515 41929 nlnetlabs.nl. Pod5ouQTmulD8rmOOERVhhD3wsu7tD2VRej+Puph61T/vEry0CTnosHkd4fg2xohnx9i6m09LhPeOdaCJJIRAQ== ;{id = 41929}
+open.nlnetlabs.nl.	600	IN	RRSIG	AAAA 12 3 600 20090903100515 20090806100515 60385 nlnetlabs.nl. +tdW+Uhkl2dBsD3zjGFGg1UtkBgfEhM6aXzERl0gWElgoJ4pCpXTV7VhZQ4yjibpMYjcXsBhQLcN7AuG20Ps9Q== ;{id = 60385}
 ENTRY_END

 ENTRY_BEGIN
@@ -35,6 +35,6 @@ SECTION QUESTION
 open.nlnetlabs.nl. IN NSEC
 SECTION ANSWER
 open.nlnetlabs.nl.      3600    IN      NSEC    nlnetlabs.nl. A AAAA RRSIG NSEC 
-open.nlnetlabs.nl.	3600	IN	RRSIG	NSEC 249 3 3600 20090903100515 20090806100515 41929 nlnetlabs.nl. qWNarmPDHjv+ctxYCbxWrJc+LPjKW+RkP17bK6idfzcqGxK95fnsduphbmEZlQQiruO1OeZ1VlF9Btg+qS2T3A== ;{id = 41929}
+open.nlnetlabs.nl.	3600	IN	RRSIG	NSEC 12 3 3600 20090903100515 20090806100515 60385 nlnetlabs.nl. vOzQQh9ITdgD74ohIE37L8mAZcgDt7V+HrrPjCdalsFYw9dvGwuEvc0MfSDmzrFQ7OhL0elwI/A1AfK57M7emQ== ;{id = 60385}
 ENTRY_END

@@ -0,0 +1,186 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with CNAME response to DS 
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+; nothing here, not even NSECs
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+; DS query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN DS
+SECTION ANSWER
+www.example.com. IN CNAME zzz.example.com.
+www.example.com.	3600	IN	RRSIG	CNAME 3 2 3600 20070926134150 20070829134150 2854 example.com. AERsv3PiBObAEhZ/dKyamie0sjvYLn7YaEKgv9ExB14KKLgWvzCaOWo= ;{id = 2854}
+;*.example.com. IN CNAME zzz.example.com.
+;*.example.com.	3600	IN	RRSIG	CNAME 3 2 3600 20070926134150 20070829134150 2854 example.com. AERsv3PiBObAEhZ/dKyamie0sjvYLn7YaEKgv9ExB14KKLgWvzCaOWo= ;{id = 2854}
+
+SECTION AUTHORITY
+*.example.com. IN NSEC zzz.example.com. CNAME RRSIG NSEC
+*.example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AJxl2TXciyhbKqSakVNtjlt8Bbkco02zpl5RlY88iqVmSa6ts+/guU4= ;{id = 2854}
+zzz.example.com. IN NSEC *.zzz.example.com. A RRSIG NSEC
+zzz.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. ACtgx/h0YfGEK79zg4G16jB/0oRWH0nxrMzUc/4hCY3oprsP8DrdjqU= ;{id = 2854}
+example.com. IN SOA alfa.ns.example.com.cz. hostmaster.example.com. 2010030800 10800 86400 604800 86400
+example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. ADsxLOHjxFzwFmwIiGOubqD9nKWAp4RccRIXQ0+EAUGfSDZMCB0ZiFA= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+zzz.example.com. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+zzz.example.com. IN NSEC *.zzz.example.com. A RRSIG NSEC
+zzz.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. ACtgx/h0YfGEK79zg4G16jB/0oRWH0nxrMzUc/4hCY3oprsP8DrdjqU= ;{id = 2854}
+example.com. IN SOA alfa.ns.example.com.cz. hostmaster.example.com. 2010030800 10800 86400 604800 86400
+example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. ADsxLOHjxFzwFmwIiGOubqD9nKWAp4RccRIXQ0+EAUGfSDZMCB0ZiFA= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+ENTRY_END
+
+SCENARIO_END
@@ -115,11 +115,13 @@ SECTION AUTHORITY
 sub.example.com. IN	NS ns.sub.example.com.

 ; GOST DS for sub.example.com.
-sub.example.com.	3600	IN	DS	41930 249 203 1940ede41068d30064a092a4fbf50b95071497a6c96616d647023c2e31951c59 ; xekeg-beryv-gygek-mugab-benup-bugop-gyvoz-hidin-hicec-gohap-keduk-kyhet-kucob-duzed-vason-halih-noxox
-sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926135752 20070829135752 2854 example.com. AE9dudjtl6lDkd56NGXQrsT9OsYXKJBipHfdnX+UyR10CydCRFju8Mk= ;{id = 2854}
+sub.example.com.	3600	IN	DS	60385 12 3 2be04f63b3d069fd65f81a3b810b661a00d39be3ff00d1c7481a150b93b0d027 ; xepov-bofek-fuset-bipiz-tunoz-mukyf-rybyb-ranic-pobet-fakov-fozob-bagus-ludac-pyheb-rygor-bygyd-lyxyx

 ; SHA DS for sub.example.com.
-;sub.example.com.	3600	IN	DS	41930 249 1 ea843e16f46363ad869661a7e88fe5d4bfd63796 ; xupim-gyzoc-kutek-femup-tucen-kemyp-lopym-zanit-gizet-kotyn-kuxyx
+;sub.example.com.	3600	IN	DS	60385 12 1 0a66f7923318bb1e208bfd975ffa2e30cfcdf962 ; xedik-katin-dasec-myvic-vumum-rizan-luluz-paraf-befas-tovek-dyxax
+;sub.example.com.	3600	IN	DS	60385 12 2 cd3290b84b457d02ca29846a005a5eba61640256ced8deca0ef8345d2cd34a58 ; xufef-dugir-modog-hyzyb-dadod-nicuk-pubyh-polor-pomuk-gobuh-kufet-mulus-pofyz-metoh-tarit-fudih-moxex
+
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926135752 20070829135752 2854 example.com. ADwjiGkzrz8RPRJ6LAB37cNEQxTXSaR6Stu/GwGvcQ7KVGH/Qw76ktI= ;{id = 2854}

 SECTION ADDITIONAL
 ns.sub.example.com. IN A 1.2.3.6
@@ -138,10 +140,10 @@ SECTION QUESTION
 sub.example.com. IN NS
 SECTION ANSWER
 sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.	3600	IN	RRSIG	NS 249 3 3600 20070926134150 20070829134150 41930 sub.example.com. +RqxwrGqIOwgZit1MNe3oEPEvoTRppVylmLFXAT7tg2MxWBdqXwH1Pby3sbAy6T3Syk07LMEjZJ/qd5HYJO0+w== ;{id = 41930}
+sub.example.com.	3600	IN	RRSIG	NS 12 3 3600 20070926134150 20070829134150 60385 sub.example.com. LAgerMKnwGgapo7tDs2jV8kjA+RminByvkR6qHineRDv4SYbRdDlCtYcFR4CoYo9aigLPej1WBmaZjFV+/7AVA== ;{id = 60385}
 SECTION ADDITIONAL
 ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.	3600	IN	RRSIG	A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. T7CSlknnb6GnM8hS9riryi9G06nr/2nJUfep97igb+aPgrLziF0UUVj3DjcISgmrCw0Pdegm2jJkVliFYm4PLQ== ;{id = 41930}
+ns.sub.example.com.	3600	IN	RRSIG	A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. qYVQEwiVNWwRRoDJxK3c3LaXtfvOm/YzOEzXbN2MxPHZXHaa2nCzWLsILNstot/wTAbrk4wNcT16gKxF5JguNw== ;{id = 60385}
 ENTRY_END

 ; response to DNSKEY priming query
@@ -152,15 +154,16 @@ REPLY QR NOERROR
 SECTION QUESTION
 sub.example.com. IN DNSKEY
 SECTION ANSWER
-sub.example.com.    3600    IN      DNSKEY  257 3 249 AAB7oZ5Ox8mcGrhB4vh41LdJQ5i+MVbn0KVe1a0CU2Akdwbp1qZ2khQTJZ0wOFkEsmgU2wfggXTpU8rp745IDVUb ;{id = 41930 (zsk), size = 512b}
-sub.example.com.	3600	IN	RRSIG	DNSKEY 249 3 3600 20070926134150 20070829134150 41930 sub.example.com. AEZeCPrvG8ueQYicdYhBUMORPH8VHlbcO0GvsRl5xLFqc8femC2qPRk7SpIOSRxZXdu4liL9O5FFYaymThfFCA== ;{id = 41930}
+sub.example.com.	3600	IN	DNSKEY	256 3 12 9SZY+xB3wKtrLoRHzkBs9L3fjcvazjnk5HF3gMaD1PVp4pthrwgHIm0TUaLrd3YCa2VCl5wj+MzbhZi8NEJ/Cg== ;{id = 60385 (zsk), size = 512b}
+sub.example.com.	3600	IN	RRSIG	DNSKEY 12 3 3600 20070926134150 20070829134150 60385 sub.example.com. zyZCppfMjlMS9xs3pJfbWkdA6EgV5MqI11AdVRV8pBsyI7diYLWm8RAHlhEI5MT59A6IT6Di9YjOCvWJjzZ9tA== ;{id = 60385}
 SECTION AUTHORITY
 sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.	3600	IN	RRSIG	NS 249 3 3600 20070926134150 20070829134150 41930 sub.example.com. +RqxwrGqIOwgZit1MNe3oEPEvoTRppVylmLFXAT7tg2MxWBdqXwH1Pby3sbAy6T3Syk07LMEjZJ/qd5HYJO0+w== ;{id = 41930}
+sub.example.com.	3600	IN	RRSIG	NS 12 3 3600 20070926134150 20070829134150 60385 sub.example.com. 3y6qmOn5GIytQQtXmdhkyL0+8Um7uNzOA0m0CkWFtzN81T98jHdGcCGNC3CIGMyhKaWKqPlOoSwIfm55fa4qRA== ;{id = 60385}

 SECTION ADDITIONAL
 ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.	3600	IN	RRSIG	A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. T7CSlknnb6GnM8hS9riryi9G06nr/2nJUfep97igb+aPgrLziF0UUVj3DjcISgmrCw0Pdegm2jJkVliFYm4PLQ== ;{id = 41930}
+ns.sub.example.com.	3600	IN	RRSIG	A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. VS97UxG9Kn7DIYFCnBDJQ3n7sQ+aYF42/cU6s8jF1Y4nHSorKPFa0KHn0WVmaW33hA+Vs4BWTvJ1/JOpbiJskA== ;{id = 60385}
+
 ENTRY_END

 ; response to query of interest
@@ -172,7 +175,7 @@ SECTION QUESTION
 www.sub.example.com. IN A
 SECTION ANSWER
 www.sub.example.com. IN A	11.11.11.11
-www.sub.example.com.	3600	IN	RRSIG	A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. UUeLd4U/s4Bp2772GGbjFGc+JiiqL9VCSCRkSIPPIzCm7ECWNhpi+a3eG4oC4Z99ufpcP+v67FuAWlAGXyeW0A== ;{id = 41930}
+www.sub.example.com.	3600	IN	RRSIG	A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. KVDpNBH83UM8l1e9yAdXA1fV+wFJSJF4NtOnDLTtbpfyVbndNW3tvPc2YfLBxTEZeUCns2QrqcmIMdZ086frOQ== ;{id = 60385}

 SECTION AUTHORITY
 SECTION ADDITIONAL
@@ -195,7 +198,7 @@ SECTION QUESTION
 www.sub.example.com. IN A
 SECTION ANSWER
 www.sub.example.com. 	3600	IN	A	11.11.11.11
-www.sub.example.com.	3600	IN	RRSIG	A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. UUeLd4U/s4Bp2772GGbjFGc+JiiqL9VCSCRkSIPPIzCm7ECWNhpi+a3eG4oC4Z99ufpcP+v67FuAWlAGXyeW0A== ;{id = 41930}
+www.sub.example.com.	3600	IN	RRSIG	A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. KVDpNBH83UM8l1e9yAdXA1fV+wFJSJF4NtOnDLTtbpfyVbndNW3tvPc2YfLBxTEZeUCns2QrqcmIMdZ086frOQ== ;{id = 60385}
 SECTION AUTHORITY
 SECTION ADDITIONAL
 ENTRY_END
@@ -124,19 +124,19 @@ sub.example.com. IN	NS ns.sub.example.com.

 ; downgrade: false GOST, correct SHA

-sub.example.com.        3600    IN      DS      41930 249 203 1940ede41068d30064a092a4fbf50b95071497a6c96616d647023c2e31951c58 ; xekeg-beryv-gygek-mugab-benup-bugop-gyvoz-hidin-hicec-gohap-keduk-kyhet-kucob-duzed-vason-halih-noxox
+
+sub.example.com.        3600    IN      DS      60385 12 3 2be04f63b3d069fd65f81a3b810b661a00d39be3ff00d1c7481a150b93b0d028 

 ; correct GOST DS for sub.example.com.
-; sub.example.com.        3600    IN      DS      41930 249 203 1940ede41068d30064a092a4fbf50b95071497a6c96616d647023c2e31951c59 ; xekeg-beryv-gygek-mugab-benup-bugop-gyvoz-hidin-hicec-gohap-keduk-kyhet-kucob-duzed-vason-halih-noxox
+; sub.example.com.        3600    IN      DS      60385 12 3 2be04f63b3d069fd65f81a3b810b661a00d39be3ff00d1c7481a150b93b0d027 ; xepov-bofek-fuset-bipiz-tunoz-mukyf-rybyb-ranic-pobet-fakov-fozob-bagus-ludac-pyheb-rygor-bygyd-lyxyx

 ; SHA1 DS for sub.example.com.
-sub.example.com.	3600	IN	DS	41930 249 1 ea843e16f46363ad869661a7e88fe5d4bfd63796 ; xupim-gyzoc-kutek-femup-tucen-kemyp-lopym-zanit-gizet-kotyn-kuxyx
+sub.example.com.       3600    IN      DS      60385 12 1 0a66f7923318bb1e208bfd975ffa2e30cfcdf962 ; xedik-katin-dasec-myvic-vumum-rizan-luluz-paraf-befas-tovek-dyxax
 ; SHA256 DS for sub.example.com.
-sub.example.com.	3600	IN	DS	41930 249 2 0ae431b6bbb6ded8547428517c0912aab06150e3fe3e0bb64755e6baa4e33bb5 ; xediv-gosor-kiver-kalat-muhyl-gypah-cozub-nygep-pysak-cegiv-fuzyf-voder-kycih-hyner-piniv-fevir-hyxux
-
+sub.example.com.       3600    IN      DS      60385 12 2 cd3290b84b457d02ca29846a005a5eba61640256ced8deca0ef8345d2cd34a58 ; xufef-dugir-modog-hyzyb-dadod-nicuk-pubyh-polor-pomuk-gobuh-kufet-mulus-pofyz-metoh-tarit-fudih-moxex

 ; signs SHA1, SHA2 and GOST DSes
-sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926135752 20070829135752 2854 example.com. AEEGV20ThZAE523wZe4idjxcv/wHBgA/UUWk+H5V5c1bRGa2VzLLuDM= ;{id = 2854}
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926135752 20070829135752 2854 example.com. ADB1PPtGoPKRrhNtRtkqeqpgnZdbPOdJMgjdZVxPfgGCoMTu3JFQVbo= ;{id = 2854}

 SECTION ADDITIONAL
 ns.sub.example.com. IN A 1.2.3.6
@@ -155,10 +155,11 @@ SECTION QUESTION
 sub.example.com. IN NS
 SECTION ANSWER
 sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 249 3 3600 20070926134150 20070829134150 41930 sub.example.com. +RqxwrGqIOwgZit1MNe3oEPEvoTRppVylmLFXAT7tg2MxWBdqXwH1Pby3sbAy6T3Syk07LMEjZJ/qd5HYJO0+w== ;{id = 41930}
+sub.example.com.	3600	IN	RRSIG	NS 12 3 3600 20070926134150 20070829134150 60385 sub.example.com. 6mNrX32/DC2RU1A+yWCccn5H6wnsbNYTlf8e/LyF1fsuNfw6tH12sKGBCtk1mp4HpDIgH02HDHplJskSFOvzTw== ;{id = 60385}
+
 SECTION ADDITIONAL
 ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. T7CSlknnb6GnM8hS9riryi9G06nr/2nJUfep97igb+aPgrLziF0UUVj3DjcISgmrCw0Pdegm2jJkVliFYm4PLQ== ;{id = 41930}
+ns.sub.example.com.	3600	IN	RRSIG	A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. kJEyinL7BkpiPW2HxmFHRLAi68EdrLXToJiK83a5cedDe5ABL7c/k+nFHd3WjATUtVoueY3pSnCDVCJaFmd+/A== ;{id = 60385}
 ENTRY_END

 ; response to DNSKEY priming query
@@ -169,14 +170,14 @@ REPLY QR NOERROR
 SECTION QUESTION
 sub.example.com. IN DNSKEY
 SECTION ANSWER
-sub.example.com.    3600    IN      DNSKEY  257 3 249 AAB7oZ5Ox8mcGrhB4vh41LdJQ5i+MVbn0KVe1a0CU2Akdwbp1qZ2khQTJZ0wOFkEsmgU2wfggXTpU8rp745IDVUb ;{id = 41930 (zsk), size = 512b}
-sub.example.com.        3600    IN      RRSIG   DNSKEY 249 3 3600 20070926134150 20070829134150 41930 sub.example.com. AEZeCPrvG8ueQYicdYhBUMORPH8VHlbcO0GvsRl5xLFqc8femC2qPRk7SpIOSRxZXdu4liL9O5FFYaymThfFCA== ;{id = 41930}
+sub.example.com.        3600    IN      DNSKEY  256 3 12 9SZY+xB3wKtrLoRHzkBs9L3fjcvazjnk5HF3gMaD1PVp4pthrwgHIm0TUaLrd3YCa2VCl5wj+MzbhZi8NEJ/Cg== ;{id = 60385 (zsk), size = 512b}
+sub.example.com.        3600    IN      RRSIG   DNSKEY 12 3 3600 20070926134150 20070829134150 60385 sub.example.com. zyZCppfMjlMS9xs3pJfbWkdA6EgV5MqI11AdVRV8pBsyI7diYLWm8RAHlhEI5MT59A6IT6Di9YjOCvWJjzZ9tA== ;{id = 60385}
 SECTION AUTHORITY
 sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 249 3 3600 20070926134150 20070829134150 41930 sub.example.com. +RqxwrGqIOwgZit1MNe3oEPEvoTRppVylmLFXAT7tg2MxWBdqXwH1Pby3sbAy6T3Syk07LMEjZJ/qd5HYJO0+w== ;{id = 41930}
+sub.example.com.	3600	IN	RRSIG	NS 12 3 3600 20070926134150 20070829134150 60385 sub.example.com. 6mNrX32/DC2RU1A+yWCccn5H6wnsbNYTlf8e/LyF1fsuNfw6tH12sKGBCtk1mp4HpDIgH02HDHplJskSFOvzTw== ;{id = 60385}
 SECTION ADDITIONAL
 ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. T7CSlknnb6GnM8hS9riryi9G06nr/2nJUfep97igb+aPgrLziF0UUVj3DjcISgmrCw0Pdegm2jJkVliFYm4PLQ== ;{id = 41930}
+ns.sub.example.com.	3600	IN	RRSIG	A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. kJEyinL7BkpiPW2HxmFHRLAi68EdrLXToJiK83a5cedDe5ABL7c/k+nFHd3WjATUtVoueY3pSnCDVCJaFmd+/A== ;{id = 60385}
 ENTRY_END

 ; response to query of interest
@@ -188,7 +189,7 @@ SECTION QUESTION
 www.sub.example.com. IN A
 SECTION ANSWER
 www.sub.example.com. IN A	11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. UUeLd4U/s4Bp2772GGbjFGc+JiiqL9VCSCRkSIPPIzCm7ECWNhpi+a3eG4oC4Z99ufpcP+v67FuAWlAGXyeW0A== ;{id = 41930}
+www.sub.example.com.    3600    IN      RRSIG   A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. KVDpNBH83UM8l1e9yAdXA1fV+wFJSJF4NtOnDLTtbpfyVbndNW3tvPc2YfLBxTEZeUCns2QrqcmIMdZ086frOQ== ;{id = 60385}

 SECTION AUTHORITY
 SECTION ADDITIONAL
@@ -221,7 +222,7 @@ SECTION QUESTION
 www.sub.example.com. IN A
 SECTION ANSWER
 ;www.sub.example.com. 	3600	IN	A	11.11.11.11
-;www.sub.example.com.    3600    IN      RRSIG   A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. UUeLd4U/s4Bp2772GGbjFGc+JiiqL9VCSCRkSIPPIzCm7ECWNhpi+a3eG4oC4Z99ufpcP+v67FuAWlAGXyeW0A== ;{id = 41930}
+;www.sub.example.com.    3600    IN      RRSIG   A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. KVDpNBH83UM8l1e9yAdXA1fV+wFJSJF4NtOnDLTtbpfyVbndNW3tvPc2YfLBxTEZeUCns2QrqcmIMdZ086frOQ== ;{id = 60385}
 SECTION AUTHORITY
 SECTION ADDITIONAL
 ENTRY_END
@@ -0,0 +1,159 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with direct wildcard positive response
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+*.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+*.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+*.example.com. IN A
+SECTION ANSWER
+*.example.com. IN A	10.20.30.40
+*.example.com.	3600	IN	RRSIG	A 3 2 3600 20070926134150 20070829134150 2854 example.com. AG3iIIzflgRHsIlOKiSHADHIn/NmfNgESAslc1wIjxys5r9w4CxNIGs= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+*.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+*.example.com. IN A
+SECTION ANSWER
+*.example.com. IN A	10.20.30.40
+*.example.com.	3600	IN	RRSIG	A 3 2 3600 20070926134150 20070829134150 2854 example.com. AG3iIIzflgRHsIlOKiSHADHIn/NmfNgESAslc1wIjxys5r9w4CxNIGs= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ENTRY_END
+
+SCENARIO_END
@@ -472,3 +472,168 @@ void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 }

 #endif /* UNBOUND_ALLOC_STATS */
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef free
+#undef realloc
+/** length of prefix and suffix */
+static size_t lite_pad = 16;
+/** prefix value to check */
+static char* lite_pre = "checkfront123456";
+/** suffix value to check */
+static char* lite_post= "checkafter123456";
+
+void *unbound_stat_malloc_lite(size_t size, const char* file, int line,
+        const char* func)
+{
+	/*  [prefix .. len .. actual data .. suffix] */
+	void* res = malloc(size+lite_pad*2+sizeof(size_t));
+	if(!res) return NULL;
+	memmove(res, lite_pre, lite_pad);
+	memmove(res+lite_pad, &size, sizeof(size_t));
+	memset(res+lite_pad+sizeof(size_t), 0x1a, size); /* init the memory */
+	memmove(res+lite_pad+size+sizeof(size_t), lite_post, lite_pad);
+	return res+lite_pad+sizeof(size_t);
+}
+
+void *unbound_stat_calloc_lite(size_t nmemb, size_t size, const char* file,
+        int line, const char* func)
+{
+	size_t req = nmemb * size;
+	void* res = malloc(req+lite_pad*2+sizeof(size_t));
+	if(!res) return NULL;
+	memmove(res, lite_pre, lite_pad);
+	memmove(res+lite_pad, &req, sizeof(size_t));
+	memset(res+lite_pad+sizeof(size_t), 0, req);
+	memmove(res+lite_pad+req+sizeof(size_t), lite_post, lite_pad);
+	return res+lite_pad+sizeof(size_t);
+}
+
+void unbound_stat_free_lite(void *ptr, const char* file, int line,
+        const char* func)
+{
+	void* real;
+	size_t orig = 0;
+	if(!ptr) return;
+	real = ptr-lite_pad-sizeof(size_t);
+	if(memcmp(real, lite_pre, lite_pad) != 0) {
+		log_err("free(): prefix failed %s:%d %s", file, line, func);
+		log_hex("prefix here", real, lite_pad);
+		log_hex("  should be", lite_pre, lite_pad);
+		fatal_exit("alloc assertion failed");
+	}
+	memmove(&orig, real+lite_pad, sizeof(size_t));
+	if(memcmp(real+lite_pad+orig+sizeof(size_t), lite_post, lite_pad)!=0){
+		log_err("free(): suffix failed %s:%d %s", file, line, func);
+		log_err("alloc size is %d", (int)orig);
+		log_hex("suffix here", real+lite_pad+orig+sizeof(size_t), 
+			lite_pad);
+		log_hex("  should be", lite_post, lite_pad);
+		fatal_exit("alloc assertion failed");
+	}
+	memset(real, 0xdd, orig+lite_pad*2+sizeof(size_t)); /* mark it */
+	free(real);
+}
+
+void *unbound_stat_realloc_lite(void *ptr, size_t size, const char* file,
+        int line, const char* func)
+{
+	/* always free and realloc (no growing) */
+	void* real, *newa;
+	size_t orig = 0;
+	if(!ptr) {
+		/* like malloc() */
+		return unbound_stat_malloc_lite(size, file, line, func);
+	}
+	if(!size) {
+		/* like free() */
+		unbound_stat_free_lite(ptr, file, line, func);
+		return NULL;
+	}
+	/* change allocation size and copy */
+	real = ptr-lite_pad-sizeof(size_t);
+	if(memcmp(real, lite_pre, lite_pad) != 0) {
+		log_err("realloc(): prefix failed %s:%d %s", file, line, func);
+		log_hex("prefix here", real, lite_pad);
+		log_hex("  should be", lite_pre, lite_pad);
+		fatal_exit("alloc assertion failed");
+	}
+	memmove(&orig, real+lite_pad, sizeof(size_t));
+	if(memcmp(real+lite_pad+orig+sizeof(size_t), lite_post, lite_pad)!=0){
+		log_err("realloc(): suffix failed %s:%d %s", file, line, func);
+		log_err("alloc size is %d", (int)orig);
+		log_hex("suffix here", real+lite_pad+orig+sizeof(size_t), 
+			lite_pad);
+		log_hex("  should be", lite_post, lite_pad);
+		fatal_exit("alloc assertion failed");
+	}
+	/* new alloc and copy over */
+	newa = unbound_stat_malloc_lite(size, file, line, func);
+	if(!newa)
+		return NULL;
+	if(orig < size)
+		memmove(newa, ptr, orig);
+	else	memmove(newa, ptr, size);
+	memset(real, 0xdd, orig+lite_pad*2+sizeof(size_t)); /* mark it */
+	free(real);
+	return newa;
+}
+
+char* unbound_strdup_lite(const char* s, const char* file, int line, 
+        const char* func)
+{
+	/* this routine is made to make sure strdup() uses the malloc_lite */
+	size_t l = strlen(s)+1;
+	char* n = (char*)unbound_stat_malloc_lite(l, file, line, func);
+	if(!n) return NULL;
+	memmove(n, s, l);
+	return n;
+}
+
+char* unbound_lite_wrapstr(char* s)
+{
+	char* n = unbound_strdup_lite(s, __FILE__, __LINE__, __func__);
+	free(s);
+	return n;
+}
+
+#undef ldns_pkt2wire
+ldns_status unbound_lite_pkt2wire(uint8_t **dest, const ldns_pkt *p, 
+	size_t *size)
+{
+	uint8_t* md = NULL;
+	size_t ms = 0;
+	ldns_status s = ldns_pkt2wire(&md, p, &ms);
+	if(md) {
+		*dest = unbound_stat_malloc_lite(ms, __FILE__, __LINE__, 
+			__func__);
+		*size = ms;
+		if(!*dest) { free(md); return LDNS_STATUS_MEM_ERR; }
+		memcpy(*dest, md, ms);
+		free(md);
+	} else {
+		*dest = NULL;
+		*size = 0;
+	}
+	return s;
+}
+
+#undef i2d_DSA_SIG
+int unbound_lite_i2d_DSA_SIG(DSA_SIG* dsasig, unsigned char** sig)
+{
+	unsigned char* n = NULL;
+	int r= i2d_DSA_SIG(dsasig, &n);
+	if(n) {
+		*sig = unbound_stat_malloc_lite((size_t)r, __FILE__, __LINE__, 
+			__func__);
+		if(!*sig) return -1;
+		memcpy(*sig, n, (size_t)r);
+		free(n);
+		return r;
+	}
+	*sig = NULL;
+	return r;
+}
+
+#endif /* UNBOUND_ALLOC_LITE */
@@ -176,4 +176,39 @@ void alloc_reg_release(struct alloc_cache* alloc, struct regional* r);
 void alloc_set_id_cleanup(struct alloc_cache* alloc, void (*cleanup)(void*),
 	void* arg);

+#ifdef UNBOUND_ALLOC_LITE
+#  include "ldns/packet.h"
+#  include "openssl/ssl.h"
+#  define malloc(s) unbound_stat_malloc_lite(s, __FILE__, __LINE__, __func__)
+#  define calloc(n,s) unbound_stat_calloc_lite(n, s, __FILE__, __LINE__, __func__)
+#  define free(p) unbound_stat_free_lite(p, __FILE__, __LINE__, __func__)
+#  define realloc(p,s) unbound_stat_realloc_lite(p, s, __FILE__, __LINE__, __func__)
+void *unbound_stat_malloc_lite(size_t size, const char* file, int line,
+	const char* func);
+void *unbound_stat_calloc_lite(size_t nmemb, size_t size, const char* file,
+	int line, const char* func);
+void unbound_stat_free_lite(void *ptr, const char* file, int line,
+	const char* func);
+void *unbound_stat_realloc_lite(void *ptr, size_t size, const char* file,
+	int line, const char* func);
+#  ifdef strdup
+#    undef strdup
+#  endif
+#  define strdup(s) unbound_strdup_lite(s, __FILE__, __LINE__, __func__)
+char* unbound_strdup_lite(const char* s, const char* file, int line, 
+	const char* func);
+char* unbound_lite_wrapstr(char* s);
+#  define ldns_rr2str(rr) unbound_lite_wrapstr(ldns_rr2str(rr))
+#  define ldns_rdf2str(rdf) unbound_lite_wrapstr(ldns_rdf2str(rdf))
+#  define ldns_rr_type2str(t) unbound_lite_wrapstr(ldns_rr_type2str(t))
+#  define ldns_rr_class2str(c) unbound_lite_wrapstr(ldns_rr_class2str(c))
+#  define ldns_rr_list2str(r) unbound_lite_wrapstr(ldns_rr_list2str(r))
+#  define ldns_pkt2str(p) unbound_lite_wrapstr(ldns_pkt2str(p))
+#  define ldns_pkt_rcode2str(r) unbound_lite_wrapstr(ldns_pkt_rcode2str(r))
+#  define ldns_pkt2wire(a, r, s) unbound_lite_pkt2wire(a, r, s)
+ldns_status unbound_lite_pkt2wire(uint8_t **dest, const ldns_pkt *p, size_t *size);
+#  define i2d_DSA_SIG(d, s) unbound_lite_i2d_DSA_SIG(d, s)
+int unbound_lite_i2d_DSA_SIG(DSA_SIG* dsasig, unsigned char** sig);
+#endif /* UNBOUND_ALLOC_LITE */
+
 #endif /* UTIL_ALLOC_H */
@@ -40,6 +40,8 @@
 */

 #include "config.h"
+#include <ctype.h>
+#include "ldns/ldns.h"
 #include "util/log.h"

 #include "util/configyyrename.h"
@@ -528,6 +530,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_DEC(opt, "statistics-interval", stat_interval)
 	else O_YNO(opt, "statistics-cumulative", stat_cumulative)
 	else O_YNO(opt, "extended-statistics", stat_extended)
+	else O_YNO(opt, "use-syslog", use_syslog)
 	else O_DEC(opt, "num-threads", num_threads)
 	else O_IFC(opt, "interface", num_ifs, ifs)
 	else O_IFC(opt, "outgoing-interface", num_out_ifs, out_ifs)
@@ -40,6 +40,7 @@
 */

 #include "config.h"
+#include <ctype.h>
 #include "util/data/dname.h"
 #include "util/data/msgparse.h"
 #include "util/log.h"
@@ -147,17 +148,29 @@ void
 pkt_dname_tolower(ldns_buffer* pkt, uint8_t* dname)
 {
 	uint8_t lablen;
+	int count = 0;
+	if(dname >= ldns_buffer_end(pkt))
+		return;
 	lablen = *dname++;
 	while(lablen) {
 		if(LABEL_IS_PTR(lablen)) {
+			if((size_t)PTR_OFFSET(lablen, *dname) 
+				>= ldns_buffer_limit(pkt))
+				return;
 			dname = ldns_buffer_at(pkt, PTR_OFFSET(lablen, *dname));
 			lablen = *dname++;
+			if(count++ > MAX_COMPRESS_PTRS)
+				return;
 			continue;
 		}
+		if(dname+lablen >= ldns_buffer_end(pkt))
+			return;
 		while(lablen--) {
 			*dname = (uint8_t)tolower((int)*dname);
 			dname++;
 		}
+		if(dname >= ldns_buffer_end(pkt))
+			return;
 		lablen = *dname++;
 	}
 }
@@ -40,6 +40,7 @@
 */

 #include "config.h"
+#include "ldns/wire2host.h"
 #include "util/data/msgencode.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgparse.h"
@@ -37,6 +37,7 @@
 * Routines for message parsing a packet buffer to a descriptive structure.
 */
 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/data/msgparse.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"
@@ -63,6 +63,7 @@
 #ifndef UTIL_DATA_MSGPARSE_H
 #define UTIL_DATA_MSGPARSE_H
 #include "util/storage/lruhash.h"
+#include "ldns/packet.h"
 struct rrset_parse;
 struct rr_parse;
 struct regional;
@@ -40,6 +40,7 @@
 */

 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/data/msgreply.h"
 #include "util/storage/lookup3.h"
 #include "util/log.h"
@@ -40,6 +40,7 @@
 */

 #include "config.h"
+#include "ldns/wire2host.h"
 #include "util/data/packed_rrset.h"
 #include "util/data/dname.h"
 #include "util/storage/lookup3.h"
@@ -42,6 +42,7 @@
 #ifndef UTIL_DATA_PACKED_RRSET_H
 #define UTIL_DATA_PACKED_RRSET_H
 #include "util/storage/lruhash.h"
+#include "ldns/rr.h"
 struct alloc_cache;
 struct regional;

@@ -255,11 +255,13 @@ fptr_whitelist_modenv_send_packet(int (*fptr)(ldns_buffer* pkt,
 	return 0;
 }

+/** whitelist env->send_query callbacks */
 int 
 fptr_whitelist_modenv_send_query(struct outbound_entry* (*fptr)(
        uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-        uint16_t flags, int dnssec, struct sockaddr_storage* addr,
-        socklen_t addrlen, struct module_qstate* q))
+        uint16_t flags, int dnssec, int want_dnssec, 
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	struct module_qstate* q))
 {
 	if(fptr == &worker_send_query) return 1;
 	else if(fptr == &libworker_send_query) return 1;
@@ -201,8 +201,9 @@ int fptr_whitelist_modenv_send_packet(int (*fptr)(ldns_buffer* pkt,
 */
 int fptr_whitelist_modenv_send_query(struct outbound_entry* (*fptr)(
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr, 
-	socklen_t addrlen, struct module_qstate* q));
+	uint16_t flags, int dnssec, int want_dnssec,
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	struct module_qstate* q));

 /**
 * Check function pointer whitelist for module_env detach_subs callback values.
@@ -3981,6 +3981,8 @@
 4869,
 4870,
 4871,
+4881,
+4882,
 4884,
 4885,
 4894,
@@ -4117,6 +4119,7 @@
 5265,
 5269,
 5270,
+5271,
 5272,
 5282,
 5298,
@@ -4192,6 +4195,8 @@
 5433,
 5434,
 5435,
+5436,
+5437,
 5443,
 5453,
 5454,
@@ -4263,6 +4268,7 @@
 5722,
 5723,
 5724,
+5728,
 5729,
 5730,
 5741,
@@ -5043,6 +5049,7 @@
 17007,
 17185,
 17219,
+17234,
 17235,
 17500,
 17729,
@@ -41,6 +41,7 @@

 #ifndef UTIL_LOG_H
 #define UTIL_LOG_H
+#include "ldns/buffer.h"

 /**
 * verbosity value:
@@ -41,6 +41,10 @@
 */

 #include "config.h"
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+#include <sys/time.h>

 #if defined(USE_MINI_EVENT) && !defined(USE_WINSOCK)
 #include <signal.h>
@@ -114,6 +114,8 @@ struct module_env {
 	 * @param dnssec: if set, EDNS record will have bits set.
 	 *	If EDNS_DO bit is set, DO bit is set in EDNS records.
 	 *	If BIT_CD is set, CD bit is set in queries with EDNS records.
+	 * @param want_dnssec: if set, the validator wants DNSSEC.  Without
+	 * 	EDNS, the answer is likely to be useless for this domain.
 	 * @param addr: where to.
 	 * @param addrlen: length of addr.
 	 * @param q: wich query state to reactivate upon return.
@@ -124,8 +126,8 @@ struct module_env {
 	 */
 	struct outbound_entry* (*send_query)(uint8_t* qname, size_t qnamelen, 
 		uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec, 
-		struct sockaddr_storage* addr, socklen_t addrlen, 
-		struct module_qstate* q);
+		int want_dnssec, struct sockaddr_storage* addr, 
+		socklen_t addrlen, struct module_qstate* q);

 	/**
 	 * Detach-subqueries.
@@ -38,6 +38,7 @@
 */

 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/net_help.h"
 #include "util/log.h"
 #include "util/data/dname.h"
@@ -497,7 +498,7 @@ void sock_list_insert(struct sock_list** list, struct sockaddr_storage* addr,
 	socklen_t len, struct regional* region)
 {
 	struct sock_list* add = (struct sock_list*)regional_alloc(region,
-		sizeof(add->next) + sizeof(add->len) + (size_t)len);
+		sizeof(*add) - sizeof(add->addr) + (size_t)len);
 	if(!add) {
 		log_err("out of memory in socketlist insert");
 		return;
@@ -39,12 +39,36 @@
 * This file contains event notification functions.
 */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "util/netevent.h"
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/fptr_wlist.h"

 /* -------- Start of local definitions -------- */
+/** if CMSG_ALIGN is not defined on this platform, a workaround */
+#ifndef CMSG_ALIGN
+#  ifdef _CMSG_DATA_ALIGN
+#    define CMSG_ALIGN _CMSG_DATA_ALIGN
+#  else
+#    define CMSG_ALIGN(len) (((len)+sizeof(long)-1) & ~(sizeof(long)-1))
+#  endif
+#endif
+
+/** if CMSG_LEN is not defined on this platform, a workaround */
+#ifndef CMSG_LEN
+#  define CMSG_LEN(len) (CMSG_ALIGN(sizeof(struct cmsghdr))+(len))
+#endif
+
+/** if CMSG_SPACE is not defined on this platform, a workaround */
+#ifndef CMSG_SPACE
+#  ifdef _CMSG_HDR_ALIGN
+#    define CMSG_SPACE(l) (CMSG_ALIGN(l)+_CMSG_HDR_ALIGN(sizeof(struct cmsghdr)))
+#  else
+#    define CMSG_SPACE(l) (CMSG_ALIGN(l)+CMSG_ALIGN(sizeof(struct cmsghdr)))
+#  endif
+#endif
+
 /** The TCP reading or writing query timeout in seconds */
 #define TCP_QUERY_TIMEOUT 120 

@@ -294,11 +318,6 @@ comm_point_send_udp_msg(struct comm_point *c, ldns_buffer* packet,
 	return 1;
 }

-/** if no CMSG_LEN (Solaris 9) define something reasonable for one element */
-#ifndef CMSG_LEN
-#define CMSG_LEN(x) (sizeof(struct cmsghdr)+(x))
-#endif
-
 /** print debug ancillary info */
 void p_ancil(const char* str, struct comm_reply* r)
 {
@@ -316,15 +335,7 @@ void p_ancil(const char* str, struct comm_reply* r)
 		buf[sizeof(buf)-1]=0;
 		log_info("%s: %s %d", str, buf, r->pktinfo.v6info.ipi6_ifindex);
 	} else if(r->srctype == 4) {
-#ifdef IP_RECVDSTADDR
-		char buf1[1024];
-		if(inet_ntop(AF_INET, &r->pktinfo.v4addr, 
-			buf1, (socklen_t)sizeof(buf1)) == 0) {
-			strncpy(buf1, "(inet_ntop error)", sizeof(buf1));
-		}
-		buf1[sizeof(buf1)-1]=0;
-		log_info("%s: %s", str, buf1);
-#elif defined(IP_PKTINFO)
+#ifdef IP_PKTINFO
 		char buf1[1024], buf2[1024];
 		if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_addr, 
 			buf1, (socklen_t)sizeof(buf1)) == 0) {
@@ -338,6 +349,14 @@ void p_ancil(const char* str, struct comm_reply* r)
 		buf2[sizeof(buf2)-1]=0;
 		log_info("%s: %d %s %s", str, r->pktinfo.v4info.ipi_ifindex,
 			buf1, buf2);
+#elif defined(IP_RECVDSTADDR)
+		char buf1[1024];
+		if(inet_ntop(AF_INET, &r->pktinfo.v4addr, 
+			buf1, (socklen_t)sizeof(buf1)) == 0) {
+			strncpy(buf1, "(inet_ntop error)", sizeof(buf1));
+		}
+		buf1[sizeof(buf1)-1]=0;
+		log_info("%s: %s", str, buf1);
 #endif
 	}
 #else
@@ -379,20 +398,29 @@ comm_point_send_udp_msg_if(struct comm_point *c, ldns_buffer* packet,
 #ifndef S_SPLINT_S
 	cmsg = CMSG_FIRSTHDR(&msg);
 	if(r->srctype == 4) {
-#ifdef IP_RECVDSTADDR
-		cmsg->cmsg_level = IPPROTO_IP;
-		cmsg->cmsg_type = IP_RECVDSTADDR;
-		memmove(CMSG_DATA(cmsg), &r->pktinfo.v4addr,
-			sizeof(struct in_addr));
-		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
-#elif defined(IP_PKTINFO)
+#ifdef IP_PKTINFO
+		msg.msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo));
+		log_assert(msg.msg_controllen <= sizeof(control));
 		cmsg->cmsg_level = IPPROTO_IP;
 		cmsg->cmsg_type = IP_PKTINFO;
 		memmove(CMSG_DATA(cmsg), &r->pktinfo.v4info,
 			sizeof(struct in_pktinfo));
 		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
+#elif defined(IP_SENDSRCADDR)
+		msg.msg_controllen = CMSG_SPACE(sizeof(struct in_addr));
+		log_assert(msg.msg_controllen <= sizeof(control));
+		cmsg->cmsg_level = IPPROTO_IP;
+		cmsg->cmsg_type = IP_SENDSRCADDR;
+		memmove(CMSG_DATA(cmsg), &r->pktinfo.v4addr,
+			sizeof(struct in_addr));
+		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
+#else
+		verbose(VERB_ALGO, "no IP_PKTINFO or IP_SENDSRCADDR");
+		msg.msg_control = NULL;
 #endif
 	} else if(r->srctype == 6) {
+		msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
+		log_assert(msg.msg_controllen <= sizeof(control));
 		cmsg->cmsg_level = IPPROTO_IPV6;
 		cmsg->cmsg_type = IPV6_PKTINFO;
 		memmove(CMSG_DATA(cmsg), &r->pktinfo.v6info,
@@ -400,14 +428,14 @@ comm_point_send_udp_msg_if(struct comm_point *c, ldns_buffer* packet,
 		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
 	} else {
 		/* try to pass all 0 to use default route */
+		msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
+		log_assert(msg.msg_controllen <= sizeof(control));
 		cmsg->cmsg_level = IPPROTO_IPV6;
 		cmsg->cmsg_type = IPV6_PKTINFO;
 		memset(CMSG_DATA(cmsg), 0, sizeof(struct in6_pktinfo));
 		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
 	}
-	msg.msg_controllen = cmsg->cmsg_len;
 #endif /* S_SPLINT_S */
-
 	if(verbosity >= VERB_ALGO)
 		p_ancil("send_udp over interface", r);
 	sent = sendmsg(c->fd, &msg, 0);
@@ -490,20 +518,20 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 				memmove(&rep.pktinfo.v6info, CMSG_DATA(cmsg),
 					sizeof(struct in6_pktinfo));
 				break;
-#ifdef IP_RECVDSTADDR
-			} else if( cmsg->cmsg_level == IPPROTO_IP &&
-				cmsg->cmsg_type == IP_RECVDSTADDR) {
-				rep.srctype = 4;
-				memmove(&rep.pktinfo.v4addr, CMSG_DATA(cmsg),
-					sizeof(struct in_addr));
-				break;
-#elif defined(IP_PKTINFO)
+#ifdef IP_PKTINFO
 			} else if( cmsg->cmsg_level == IPPROTO_IP &&
 				cmsg->cmsg_type == IP_PKTINFO) {
 				rep.srctype = 4;
 				memmove(&rep.pktinfo.v4info, CMSG_DATA(cmsg),
 					sizeof(struct in_pktinfo));
 				break;
+#elif defined(IP_RECVDSTADDR)
+			} else if( cmsg->cmsg_level == IPPROTO_IP &&
+				cmsg->cmsg_type == IP_RECVDSTADDR) {
+				rep.srctype = 4;
+				memmove(&rep.pktinfo.v4addr, CMSG_DATA(cmsg),
+					sizeof(struct in_addr));
+				break;
 #endif
 			}
 		}
@@ -60,6 +60,7 @@
 #ifndef NET_EVENT_H
 #define NET_EVENT_H

+#include "ldns/buffer.h"
 struct comm_point;
 struct comm_reply;
 struct event_base;
@@ -107,10 +108,10 @@ struct comm_reply {
 #ifdef IPV6_PKTINFO
 		struct in6_pktinfo v6info;
 #endif
-#ifdef IP_RECVDSTADDR
-		struct in_addr v4addr;
-#elif defined(IP_PKTINFO)
+#ifdef IP_PKTINFO
 		struct in_pktinfo v4info;
+#elif defined(IP_RECVDSTADDR)
+		struct in_addr v4addr;
 #endif
 	} 	
 		/** variable with return source data */
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Wouter Wijngaards	8e772c37b2	tag 1.4.4rc1 git-svn-id: file:///svn/unbound/trunk@2084 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-16 11:21:06 +00:00
Wouter Wijngaards	0a8c4943f5	and include ldns for windows anchor update git-svn-id: file:///svn/unbound/trunk@2083 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-16 09:33:41 +00:00
Wouter Wijngaards	ac59d6d96a	windows ioctlsocket detection fix git-svn-id: file:///svn/unbound/trunk@2082 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-16 09:27:12 +00:00
Wouter Wijngaards	1085e72135	portability of CMSG_SPACE git-svn-id: file:///svn/unbound/trunk@2081 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-16 08:41:08 +00:00
Wouter Wijngaards	8452c8cd5d	Includes for BSD4. git-svn-id: file:///svn/unbound/trunk@2080 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-15 14:53:55 +00:00
Wouter Wijngaards	3352f687cd	GOST algorithm number 12. git-svn-id: file:///svn/unbound/trunk@2079 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-15 11:29:43 +00:00
Wouter Wijngaards	4d10a37247	suggested todo items git-svn-id: file:///svn/unbound/trunk@2078 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-15 07:12:43 +00:00
Wouter Wijngaards	c79d732647	please doxygens parser git-svn-id: file:///svn/unbound/trunk@2077 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-09 15:05:58 +00:00
Wouter Wijngaards	601355d9b0	please lint git-svn-id: file:///svn/unbound/trunk@2076 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-09 14:46:09 +00:00
Wouter Wijngaards	0720e1a9a1	- Fix chain of trust with CNAME at an intermediate step, for the DS processing proof. git-svn-id: file:///svn/unbound/trunk@2075 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-09 14:28:32 +00:00
Wouter Wijngaards	fa21f6e524	please lint git-svn-id: file:///svn/unbound/trunk@2074 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-09 09:20:20 +00:00
Wouter Wijngaards	df9db1a0ee	Fix bug#305: pkt_dname_tolower could read beyond end of buffer or get into an endless loop, if 0x20 was enabled, and buffers are small or particular broken packets are received. git-svn-id: file:///svn/unbound/trunk@2073 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-09 09:04:20 +00:00
Wouter Wijngaards	36c46a8f71	Fix bug#305: pkt_dname_tolower could read beyond end of buffer or get into an endless loop, if 0x20 was enabled, and buffers are small or particular broken packets are received. git-svn-id: file:///svn/unbound/trunk@2072 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-09 09:04:07 +00:00
Wouter Wijngaards	560f4aab03	Fix validation of queries with wildcard names (*.example). git-svn-id: file:///svn/unbound/trunk@2071 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-08 13:22:35 +00:00
Wouter Wijngaards	bec7e7a552	Fix validation of queries with wildcard names (*.example). git-svn-id: file:///svn/unbound/trunk@2070 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-08 13:22:29 +00:00
Wouter Wijngaards	553e2de09b	nit2 git-svn-id: file:///svn/unbound/trunk@2069 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-08 08:05:41 +00:00
Wouter Wijngaards	e36a4b1bc5	nit1 git-svn-id: file:///svn/unbound/trunk@2068 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-08 08:03:36 +00:00
Wouter Wijngaards	8c8667d9f7	and change the ldns tarball git-svn-id: file:///svn/unbound/trunk@2067 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-07 19:27:53 +00:00
Wouter Wijngaards	f13263d045	ECC-GOST may not be 11, moved to experimental again, and not default on git-svn-id: file:///svn/unbound/trunk@2066 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-07 17:46:32 +00:00
Wouter Wijngaards	77f49a5510	GOST support. git-svn-id: file:///svn/unbound/trunk@2065 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-06 12:15:19 +00:00
Wouter Wijngaards	8413dd946e	- Fix EDNS probe for .de DNSSEC testbed failure, where the infra cache timeout coincided with a server update, the current EDNS backoff is less sensitive, and does not cache the backoff unless the backoff actually works and the domain is not expecting DNSSEC. git-svn-id: file:///svn/unbound/trunk@2064 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-06 08:35:50 +00:00
Wouter Wijngaards	18a7df3d5c	- Fix EDNS probe for .de DNSSEC testbed failure, where the infra cache timeout coincided with a server update, the current EDNS backoff is less sensitive, and does not cache the backoff unless the backoff actually works and the domain is not expecting DNSSEC. git-svn-id: file:///svn/unbound/trunk@2063 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-06 08:35:37 +00:00
Wouter Wijngaards	9717ad2be8	iana portlist updated git-svn-id: file:///svn/unbound/trunk@2062 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-04-01 14:53:25 +00:00
Wouter Wijngaards	efb19fd26a	unbound control removed items are not counted again. git-svn-id: file:///svn/unbound/trunk@2061 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-24 14:44:35 +00:00
Wouter Wijngaards	bc4770ea7d	iana portlist updated git-svn-id: file:///svn/unbound/trunk@2060 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-23 15:29:06 +00:00
Wouter Wijngaards	01792e928e	update version number in contrib/unbound.spec to more recent git-svn-id: file:///svn/unbound/trunk@2059 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-23 15:21:13 +00:00
Wouter Wijngaards	11ecb5183b	review of NSEC and NSEC3 zones results git-svn-id: file:///svn/unbound/trunk@2058 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-22 14:40:45 +00:00
Wouter Wijngaards	ad620622a5	Fix bug#301. git-svn-id: file:///svn/unbound/trunk@2057 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-22 09:38:06 +00:00
Wouter Wijngaards	5e9b6092d0	Fixup unbound-host. git-svn-id: file:///svn/unbound/trunk@2056 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-22 09:23:30 +00:00
Wouter Wijngaards	1e503c6430	comment git-svn-id: file:///svn/unbound/trunk@2055 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-19 15:26:25 +00:00
Wouter Wijngaards	5e1e389a15	compat lint sparc64/FreeBSD git-svn-id: file:///svn/unbound/trunk@2054 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-19 15:25:40 +00:00
Wouter Wijngaards	8a3ef34194	More compat lint. git-svn-id: file:///svn/unbound/trunk@2053 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-19 14:47:54 +00:00
Wouter Wijngaards	e7939029f8	lint more compatible git-svn-id: file:///svn/unbound/trunk@2052 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-19 14:41:57 +00:00
Wouter Wijngaards	ac4534f3e0	fix fwd_ancil for platforms that do not support the option. git-svn-id: file:///svn/unbound/trunk@2051 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-19 13:44:02 +00:00
Wouter Wijngaards	dd8dcfb317	Make extended statistics counter documentation easier to find. git-svn-id: file:///svn/unbound/trunk@2050 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-18 14:53:28 +00:00
Wouter Wijngaards	75565262f7	Fixed random numbers for port, interface and server selection. Removed very small bias. Also some lint fixes. git-svn-id: file:///svn/unbound/trunk@2049 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-18 14:42:22 +00:00
Wouter Wijngaards	cd57530efd	includes git-svn-id: file:///svn/unbound/trunk@2048 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-17 09:50:12 +00:00
Wouter Wijngaards	091050add6	cache verify work for nsec and nsec3. git-svn-id: file:///svn/unbound/trunk@2047 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-17 09:49:18 +00:00
Wouter Wijngaards	42599b7044	and store sec status git-svn-id: file:///svn/unbound/trunk@2046 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-17 09:27:53 +00:00
Wouter Wijngaards	ecd677ebbe	compile fix for alloc-lite. git-svn-id: file:///svn/unbound/trunk@2045 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-16 18:17:19 +00:00
Wouter Wijngaards	367c2abbf3	Faster nsec3. git-svn-id: file:///svn/unbound/trunk@2044 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-16 16:52:56 +00:00
Wouter Wijngaards	6fb53c7c93	fix p_ancil git-svn-id: file:///svn/unbound/trunk@2043 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-16 15:20:40 +00:00
Wouter Wijngaards	62228ae450	fix header git-svn-id: file:///svn/unbound/trunk@2042 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-16 15:19:06 +00:00
Wouter Wijngaards	5dd34e6145	Check for SENDSRCADDR socket option. git-svn-id: file:///svn/unbound/trunk@2041 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-16 15:11:58 +00:00
Wouter Wijngaards	776643e6d7	time.h include git-svn-id: file:///svn/unbound/trunk@2040 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-16 10:32:47 +00:00
Wouter Wijngaards	50336bddbe	Fix interface automatic to work for ipv6 on openbsd. git-svn-id: file:///svn/unbound/trunk@2039 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-16 08:37:50 +00:00
Wouter Wijngaards	e3d6aaf697	Various documentation fixes. git-svn-id: file:///svn/unbound/trunk@2038 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-15 13:42:55 +00:00
Wouter Wijngaards	788cd9d6ee	unit test for util/regional.c. git-svn-id: file:///svn/unbound/trunk@2037 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-15 13:18:49 +00:00
Wouter Wijngaards	10880d861f	cleaner allocs in unit test git-svn-id: file:///svn/unbound/trunk@2036 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-15 09:50:56 +00:00
Wouter Wijngaards	147d47eee7	Move includes to code files. git-svn-id: file:///svn/unbound/trunk@2035 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-12 15:17:48 +00:00
Wouter Wijngaards	e56a5b72cb	Fix solaris python compile. git-svn-id: file:///svn/unbound/trunk@2034 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-12 13:21:20 +00:00
Wouter Wijngaards	c6b987a816	Fixup pymod thread test to not call valgrind. git-svn-id: file:///svn/unbound/trunk@2033 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-12 12:48:52 +00:00
Wouter Wijngaards	e652a69a69	Fix python if threaded. git-svn-id: file:///svn/unbound/trunk@2032 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-12 12:44:44 +00:00
Wouter Wijngaards	3668d64b47	ldns tarball updated (earlier -lnsl -lsocket checks), iana portlist updated. git-svn-id: file:///svn/unbound/trunk@2031 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-12 09:36:19 +00:00
Wouter Wijngaards	6c7526f53b	Reorder config checks. git-svn-id: file:///svn/unbound/trunk@2030 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-12 09:20:40 +00:00
Wouter Wijngaards	8c7781fb24	spelling fix git-svn-id: file:///svn/unbound/trunk@2029 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-11 16:17:45 +00:00
Wouter Wijngaards	590facc3d8	trunk is 1.4.4 development. git-svn-id: file:///svn/unbound/trunk@2028 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-11 14:29:32 +00:00
Wouter Wijngaards	03e53f14b0	Tag 1.4.3 created. git-svn-id: file:///svn/unbound/trunk@2027 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-11 14:26:20 +00:00
Wouter Wijngaards	4642bcb0bc	Fix daemonize on Solaris 10. git-svn-id: file:///svn/unbound/trunk@2026 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-11 13:28:53 +00:00
Wouter Wijngaards	698b9df9de	MacPorts fix. git-svn-id: file:///svn/unbound/trunk@2025 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-11 12:52:58 +00:00
Wouter Wijngaards	ae83a2b706	- fix for memory alignment in struct sock_list allocation. git-svn-id: file:///svn/unbound/trunk@2024 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-11 11:19:14 +00:00
Wouter Wijngaards	6cf3327d8d	- fix for memory alignment in struct sock_list allocation. git-svn-id: file:///svn/unbound/trunk@2023 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-11 11:18:40 +00:00
Wouter Wijngaards	62298b8bfc	--enable-alloc-nonregional git-svn-id: file:///svn/unbound/trunk@2022 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-11 09:35:08 +00:00
Wouter Wijngaards	c12752d6fc	more userfriendly make test git-svn-id: file:///svn/unbound/trunk@2021 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-10 13:01:52 +00:00
Wouter Wijngaards	0f90647174	Add ipv6 stub test. git-svn-id: file:///svn/unbound/trunk@2020 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-10 12:36:59 +00:00
Wouter Wijngaards	d1df3df96a	nicer printf format conversion. git-svn-id: file:///svn/unbound/trunk@2019 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-10 12:11:54 +00:00
Wouter Wijngaards	6b5f246343	Portability of alloc-lite git-svn-id: file:///svn/unbound/trunk@2018 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-10 12:05:14 +00:00
Wouter Wijngaards	b1c920bc8a	and mark realloc freed data git-svn-id: file:///svn/unbound/trunk@2017 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-10 12:01:56 +00:00
Wouter Wijngaards	6f1c044381	fix for proto git-svn-id: file:///svn/unbound/trunk@2016 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-10 11:39:07 +00:00
Wouter Wijngaards	46df44f321	alloc_lite works git-svn-id: file:///svn/unbound/trunk@2015 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-10 11:01:33 +00:00
Wouter Wijngaards	0000843c32	--enable-alloc-lite git-svn-id: file:///svn/unbound/trunk@2014 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-09 16:26:53 +00:00
Wouter Wijngaards	99eb762c24	trunk moves to 1.4.3 git-svn-id: file:///svn/unbound/trunk@2013 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-09 09:40:48 +00:00
Wouter Wijngaards	18b9d266d5	tag 1.4.2 release. git-svn-id: file:///svn/unbound/trunk@2012 be551aaa-1e26-0410-a405-d3ace91eadb9	2010-03-09 08:55:50 +00:00
				`@@ -0,0 +1 @@`
				`example.com. 3600 IN DS 60385 12 3 c93b6fd6893d42ae60acd15088c2aeea0e0f013e535961855f17299507f70e0d ; xudef-ririt-kidaf-tebyp-vemep-segih-bydes-dyriv-pofab-zibaf-vigyh-numom-halac-lypin-hycaz-lofub-taxex`
				`@@ -0,0 +1 @@`
				`example.com. 3600 IN DNSKEY 256 3 12 9SZY+xB3wKtrLoRHzkBs9L3fjcvazjnk5HF3gMaD1PVp4pthrwgHIm0TUaLrd3YCa2VCl5wj+MzbhZi8NEJ/Cg== ;{id = 60385 (zsk), size = 512b}`
				`@@ -1 +0,0 @@`
				`example.com. 3600 IN DS 41929 249 203 10e2bc48d0301d16858bd040ee7d5c1983122d6cec0e3324fcdb94ba5ac0f748 ; xegav-dozog-mugef-bolyc-kicem-rygug-borel-tulyc-nibuc-dyryk-serub-vasud-gazut-rihyr-pykis-bytyg-myxyx`
				`@@ -1 +0,0 @@`
				`example.com. 3600 IN DNSKEY 256 3 249 AAB7oZ5Ox8mcGrhB4vh41LdJQ5i+MVbn0KVe1a0CU2Akdwbp1qZ2khQTJZ0wOFkEsmgU2wfggXTpU8rp745IDVUb ;{id = 41929 (zsk), size = 512b}`