fix

git-svn-id: file:///svn/unbound/trunk@2146 be551aaa-1e26-0410-a405-d3ace91eadb9

Makefile.in

@@ -73,7 +73,15 @@ WINDRES=@WINDRES@
 LINT=splint
 LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list -Dglob64=glob -Dglobfree64=globfree
 # compat with openssl linux edition.
-LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray
+LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray -D"ENGINE=unsigned" -D"RSA=unsigned" -D"DSA=unsigned" -D"EVP_PKEY=unsigned" -D"EVP_MD=unsigned" -D"SSL=unsigned" -D"SSL_CTX=unsigned" -D"X509=unsigned" -D"RC4_KEY=unsigned" -D"EVP_MD_CTX=unsigned"
+# compat with NetBSD
+ifeq "$(shell uname)" "NetBSD"
+LINTFLAGS+="-D__RENAME(x)=" -D_NETINET_IN_H_
+endif
+# compat with OpenBSD
+LINTFLAGS+="-Dsigset_t=long"
+# FreeBSD8
+LINTFLAGS+="-D__uint16_t=uint16_t"
 
 INSTALL=$(srcdir)/install-sh
 ifeq "$(WITH_PYTHONMODULE)" "yes"
@@ -101,7 +109,7 @@ CHECKCONF_OBJ=$(addprefix $(BUILD),$(CHECKCONF_SRC:.c=.lo)) $(COMPAT_OBJ)
 CONTROL_SRC=smallapp/unbound-control.c smallapp/worker_cb.c $(COMMON_SRC)
 CONTROL_OBJ=$(addprefix $(BUILD),$(CONTROL_SRC:.c=.lo)) $(COMPAT_OBJ)
 HOST_SRC=smallapp/unbound-host.c
-HOST_OBJ=$(addprefix $(BUILD),$(HOST_SRC:.c=.lo)) $(COMPAT_OBJ)
+HOST_OBJ=$(addprefix $(BUILD),$(HOST_SRC:.c=.lo)) $(filter-out $(BUILD)compat/ctime_r.lo, $(COMPAT_OBJ))
 TESTBOUND_SRC=testcode/testbound.c testcode/ldns-testpkts.c \
 	daemon/worker.c daemon/acl_list.c daemon/daemon.c daemon/stats.c \
 	testcode/replay.c testcode/fake_event.c $(filter-out util/netevent.c \

acx_nlnetlabs.m4

@@ -2,7 +2,8 @@
 # Copyright 2009, Wouter Wijngaards, NLnet Labs.   
 # BSD licensed.
 #
-# Version 8
+# Version 9
+# 2010-04-26 Fix to use CPPFLAGS for CHECK_COMPILER_FLAGS.
 # 2010-03-01 Fix RPATH using CONFIG_COMMANDS to run at the very end.
 # 2010-02-18 WITH_SSL outputs the LIBSSL_LDFLAGS, LIBS, CPPFLAGS seperate, -ldl
 # 2010-02-01 added ACX_CHECK_MEMCMP_SIGNED, AHX_MEMCMP_BROKEN
@@ -102,7 +103,7 @@ cache=`echo $1 | sed 'y%.=/+-%___p_%'`
 AC_CACHE_VAL(cv_prog_cc_flag_$cache,
 [
 echo 'void f(){}' >conftest.c
-if test -z "`$CC -$1 -c conftest.c 2>&1`"; then
+if test -z "`$CC $CPPFLAGS $CFLAGS -$1 -c conftest.c 2>&1`"; then
 eval "cv_prog_cc_flag_$cache=yes"
 else
 eval "cv_prog_cc_flag_$cache=no"
@@ -146,18 +147,18 @@ AC_CACHE_VAL(cv_prog_cc_flag_needed_$cache,
 [
 echo '$2' > conftest.c
 echo 'void f(){}' >>conftest.c
-if test -z "`$CC $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
+if test -z "`$CC $CPPFLAGS $CFLAGS $ERRFLAG -c conftest.c 2>&1`"; then
 eval "cv_prog_cc_flag_needed_$cache=no"
 else
 [
-if test -z "`$CC $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1`"; then
+if test -z "`$CC $CPPFLAGS $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1`"; then
 eval "cv_prog_cc_flag_needed_$cache=yes"
 else
 eval "cv_prog_cc_flag_needed_$cache=fail"
 #echo 'Test with flag fails too!'
 #cat conftest.c
-#echo "$CC $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1"
-#echo `$CC $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1`
+#echo "$CC $CPPFLAGS $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1"
+#echo `$CC $CPPFLAGS $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1`
 #exit 1
 fi
 ]
@@ -173,8 +174,8 @@ if eval "test \"`echo '$cv_prog_cc_flag_needed_'$cache`\" = no"; then
 AC_MSG_RESULT(no)
 #echo 'Test with flag is no!'
 #cat conftest.c
-#echo "$CC $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1"
-#echo `$CC $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1`
+#echo "$CC $CPPFLAGS $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1"
+#echo `$CC $CPPFLAGS $CFLAGS $1 $ERRFLAG -c conftest.c 2>&1`
 #exit 1
 :
 $4

config.guess

@@ -1,10 +1,10 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
 #   Free Software Foundation, Inc.
 
-timestamp='2009-04-27'
+timestamp='2009-11-20'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -27,16 +27,16 @@ timestamp='2009-04-27'
 # the same distribution terms that you use for the rest of that program.
 
 
-# Originally written by Per Bothner <per@bothner.com>.
-# Please send patches to <config-patches@gnu.org>.  Submit a context
-# diff and a properly formatted ChangeLog entry.
+# Originally written by Per Bothner.  Please send patches (context
+# diff format) to <config-patches@gnu.org> and include a ChangeLog
+# entry.
 #
 # This script attempts to guess a canonical system name similar to
 # config.sub.  If it succeeds, it prints the system name on stdout, and
 # exits with 0.  Otherwise, it exits with 1.
 #
-# The plan is that this can be called by configure scripts if you
-# don't specify an explicit build system type.
+# You can get the latest version of this script from:
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD
 
 me=`echo "$0" | sed -e 's,.*/,,'`
 
@@ -170,7 +170,7 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
 	    arm*|i386|m68k|ns32k|sh3*|sparc|vax)
 		eval $set_cc_for_build
 		if echo __ELF__ | $CC_FOR_BUILD -E - 2>/dev/null \
-			| grep __ELF__ >/dev/null
+			| grep -q __ELF__
 		then
 		    # Once all utilities can be ECOFF (netbsdecoff) or a.out (netbsdaout).
 		    # Return netbsd for either.  FIX?
@@ -333,6 +333,9 @@ case "${UNAME_MACHINE}:${UNAME_SYSTEM}:${UNAME_RELEASE}:${UNAME_VERSION}" in
     sun4*:SunOS:5.*:* | tadpole*:SunOS:5.*:*)
 	echo sparc-sun-solaris2`echo ${UNAME_RELEASE}|sed -e 's/[^.]*//'`
 	exit ;;
+    i86pc:AuroraUX:5.*:* | i86xen:AuroraUX:5.*:*)
+	echo i386-pc-auroraux${UNAME_RELEASE}
+	exit ;;
     i86pc:SunOS:5.*:* | i86xen:SunOS:5.*:*)
 	eval $set_cc_for_build
 	SUN_ARCH="i386"
@@ -656,7 +659,7 @@ EOF
 	    # => hppa64-hp-hpux11.23
 
 	    if echo __LP64__ | (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) |
-		grep __LP64__ >/dev/null
+		grep -q __LP64__
 	    then
 		HP_ARCH="hppa2.0w"
 	    else
@@ -807,12 +810,12 @@ EOF
     i*:PW*:*)
 	echo ${UNAME_MACHINE}-pc-pw32
 	exit ;;
-    *:Interix*:[3456]*)
+    *:Interix*:*)
     	case ${UNAME_MACHINE} in
 	    x86)
 		echo i586-pc-interix${UNAME_RELEASE}
 		exit ;;
-	    EM64T | authenticamd | genuineintel)
+	    authenticamd | genuineintel | EM64T)
 		echo x86_64-unknown-interix${UNAME_RELEASE}
 		exit ;;
 	    IA64)
@@ -822,6 +825,9 @@ EOF
     [345]86:Windows_95:* | [345]86:Windows_98:* | [345]86:Windows_NT:*)
 	echo i${UNAME_MACHINE}-pc-mks
 	exit ;;
+    8664:Windows_NT:*)
+	echo x86_64-pc-mks
+	exit ;;
     i*:Windows_NT*:* | Pentium*:Windows_NT*:*)
 	# How do we know it's Interix rather than the generic POSIX subsystem?
 	# It also conflicts with pre-2.0 versions of AT&T UWIN. Should we
@@ -851,6 +857,20 @@ EOF
     i*86:Minix:*:*)
 	echo ${UNAME_MACHINE}-pc-minix
 	exit ;;
+    alpha:Linux:*:*)
+	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
+	  EV5)   UNAME_MACHINE=alphaev5 ;;
+	  EV56)  UNAME_MACHINE=alphaev56 ;;
+	  PCA56) UNAME_MACHINE=alphapca56 ;;
+	  PCA57) UNAME_MACHINE=alphapca56 ;;
+	  EV6)   UNAME_MACHINE=alphaev6 ;;
+	  EV67)  UNAME_MACHINE=alphaev67 ;;
+	  EV68*) UNAME_MACHINE=alphaev68 ;;
+        esac
+	objdump --private-headers /bin/sh | grep -q ld.so.1
+	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
+	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
+	exit ;;
     arm*:Linux:*:*)
 	eval $set_cc_for_build
 	if echo __ARM_EABI__ | $CC_FOR_BUILD -E - 2>/dev/null \
@@ -873,6 +893,17 @@ EOF
     frv:Linux:*:*)
     	echo frv-unknown-linux-gnu
 	exit ;;
+    i*86:Linux:*:*)
+	LIBC=gnu
+	eval $set_cc_for_build
+	sed 's/^	//' << EOF >$dummy.c
+	#ifdef __dietlibc__
+	LIBC=dietlibc
+	#endif
+EOF
+	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^LIBC'`
+	echo "${UNAME_MACHINE}-pc-linux-${LIBC}"
+	exit ;;
     ia64:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
@@ -882,78 +913,34 @@ EOF
     m68*:Linux:*:*)
 	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
-    mips:Linux:*:*)
+    mips:Linux:*:* | mips64:Linux:*:*)
 	eval $set_cc_for_build
 	sed 's/^	//' << EOF >$dummy.c
 	#undef CPU
-	#undef mips
-	#undef mipsel
+	#undef ${UNAME_MACHINE}
+	#undef ${UNAME_MACHINE}el
 	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
-	CPU=mipsel
+	CPU=${UNAME_MACHINE}el
 	#else
 	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
-	CPU=mips
+	CPU=${UNAME_MACHINE}
 	#else
 	CPU=
 	#endif
 	#endif
 EOF
-	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
-	    /^CPU/{
-		s: ::g
-		p
-	    }'`"
-	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
-	;;
-    mips64:Linux:*:*)
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
-	#undef CPU
-	#undef mips64
-	#undef mips64el
-	#if defined(__MIPSEL__) || defined(__MIPSEL) || defined(_MIPSEL) || defined(MIPSEL)
-	CPU=mips64el
-	#else
-	#if defined(__MIPSEB__) || defined(__MIPSEB) || defined(_MIPSEB) || defined(MIPSEB)
-	CPU=mips64
-	#else
-	CPU=
-	#endif
-	#endif
-EOF
-	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
-	    /^CPU/{
-		s: ::g
-		p
-	    }'`"
+	eval `$CC_FOR_BUILD -E $dummy.c 2>/dev/null | grep '^CPU'`
 	test x"${CPU}" != x && { echo "${CPU}-unknown-linux-gnu"; exit; }
 	;;
     or32:Linux:*:*)
 	echo or32-unknown-linux-gnu
 	exit ;;
-    ppc:Linux:*:*)
-	echo powerpc-unknown-linux-gnu
-	exit ;;
-    ppc64:Linux:*:*)
-	echo powerpc64-unknown-linux-gnu
-	exit ;;
-    alpha:Linux:*:*)
-	case `sed -n '/^cpu model/s/^.*: \(.*\)/\1/p' < /proc/cpuinfo` in
-	  EV5)   UNAME_MACHINE=alphaev5 ;;
-	  EV56)  UNAME_MACHINE=alphaev56 ;;
-	  PCA56) UNAME_MACHINE=alphapca56 ;;
-	  PCA57) UNAME_MACHINE=alphapca56 ;;
-	  EV6)   UNAME_MACHINE=alphaev6 ;;
-	  EV67)  UNAME_MACHINE=alphaev67 ;;
-	  EV68*) UNAME_MACHINE=alphaev68 ;;
-        esac
-	objdump --private-headers /bin/sh | grep ld.so.1 >/dev/null
-	if test "$?" = 0 ; then LIBC="libc1" ; else LIBC="" ; fi
-	echo ${UNAME_MACHINE}-unknown-linux-gnu${LIBC}
-	exit ;;
     padre:Linux:*:*)
 	echo sparc-unknown-linux-gnu
 	exit ;;
+    parisc64:Linux:*:* | hppa64:Linux:*:*)
+	echo hppa64-unknown-linux-gnu
+	exit ;;
     parisc:Linux:*:* | hppa:Linux:*:*)
 	# Look for CPU level
 	case `grep '^cpu[^a-z]*:' /proc/cpuinfo 2>/dev/null | cut -d' ' -f2` in
@@ -962,8 +949,11 @@ EOF
 	  *)    echo hppa-unknown-linux-gnu ;;
 	esac
 	exit ;;
-    parisc64:Linux:*:* | hppa64:Linux:*:*)
-	echo hppa64-unknown-linux-gnu
+    ppc64:Linux:*:*)
+	echo powerpc64-unknown-linux-gnu
+	exit ;;
+    ppc:Linux:*:*)
+	echo powerpc-unknown-linux-gnu
 	exit ;;
     s390:Linux:*:* | s390x:Linux:*:*)
 	echo ${UNAME_MACHINE}-ibm-linux
@@ -986,66 +976,6 @@ EOF
     xtensa*:Linux:*:*)
     	echo ${UNAME_MACHINE}-unknown-linux-gnu
 	exit ;;
-    i*86:Linux:*:*)
-	# The BFD linker knows what the default object file format is, so
-	# first see if it will tell us. cd to the root directory to prevent
-	# problems with other programs or directories called `ld' in the path.
-	# Set LC_ALL=C to ensure ld outputs messages in English.
-	ld_supported_targets=`cd /; LC_ALL=C ld --help 2>&1 \
-			 | sed -ne '/supported targets:/!d
-				    s/[ 	][ 	]*/ /g
-				    s/.*supported targets: *//
-				    s/ .*//
-				    p'`
-        case "$ld_supported_targets" in
-	  elf32-i386)
-		TENTATIVE="${UNAME_MACHINE}-pc-linux-gnu"
-		;;
-	  a.out-i386-linux)
-		echo "${UNAME_MACHINE}-pc-linux-gnuaout"
-		exit ;;
-	  "")
-		# Either a pre-BFD a.out linker (linux-gnuoldld) or
-		# one that does not give us useful --help.
-		echo "${UNAME_MACHINE}-pc-linux-gnuoldld"
-		exit ;;
-	esac
-	# Determine whether the default compiler is a.out or elf
-	eval $set_cc_for_build
-	sed 's/^	//' << EOF >$dummy.c
-	#include <features.h>
-	#ifdef __ELF__
-	# ifdef __GLIBC__
-	#  if __GLIBC__ >= 2
-	LIBC=gnu
-	#  else
-	LIBC=gnulibc1
-	#  endif
-	# else
-	LIBC=gnulibc1
-	# endif
-	#else
-	#if defined(__INTEL_COMPILER) || defined(__PGI) || defined(__SUNPRO_C) || defined(__SUNPRO_CC)
-	LIBC=gnu
-	#else
-	LIBC=gnuaout
-	#endif
-	#endif
-	#ifdef __dietlibc__
-	LIBC=dietlibc
-	#endif
-EOF
-	eval "`$CC_FOR_BUILD -E $dummy.c 2>/dev/null | sed -n '
-	    /^LIBC/{
-		s: ::g
-		p
-	    }'`"
-	test x"${LIBC}" != x && {
-		echo "${UNAME_MACHINE}-pc-linux-${LIBC}"
-		exit
-	}
-	test x"${TENTATIVE}" != x && { echo "${TENTATIVE}"; exit; }
-	;;
     i*86:DYNIX/ptx:4*:*)
 	# ptx 4.0 does uname -s correctly, with DYNIX/ptx in there.
 	# earlier versions are messed up and put the nodename in both
@@ -1074,7 +1004,7 @@ EOF
     i*86:syllable:*:*)
 	echo ${UNAME_MACHINE}-pc-syllable
 	exit ;;
-    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.0*:*)
+    i*86:LynxOS:2.*:* | i*86:LynxOS:3.[01]*:* | i*86:LynxOS:4.[02]*:*)
 	echo i386-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
     i*86:*DOS:*:*)
@@ -1182,7 +1112,7 @@ EOF
     rs6000:LynxOS:2.*:*)
 	echo rs6000-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
-    PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.0*:*)
+    PowerPC:LynxOS:2.*:* | PowerPC:LynxOS:3.[01]*:* | PowerPC:LynxOS:4.[02]*:*)
 	echo powerpc-unknown-lynxos${UNAME_RELEASE}
 	exit ;;
     SM[BE]S:UNIX_SV:*:*)
@@ -1275,6 +1205,16 @@ EOF
     *:Darwin:*:*)
 	UNAME_PROCESSOR=`uname -p` || UNAME_PROCESSOR=unknown
 	case $UNAME_PROCESSOR in
+	    i386)
+		eval $set_cc_for_build
+		if [ "$CC_FOR_BUILD" != 'no_compiler_found' ]; then
+		  if (echo '#ifdef __LP64__'; echo IS_64BIT_ARCH; echo '#endif') | \
+		      (CCOPTS= $CC_FOR_BUILD -E - 2>/dev/null) | \
+		      grep IS_64BIT_ARCH >/dev/null
+		  then
+		      UNAME_PROCESSOR="x86_64"
+		  fi
+		fi ;;
 	    unknown) UNAME_PROCESSOR=powerpc ;;
 	esac
 	echo ${UNAME_PROCESSOR}-apple-darwin${UNAME_RELEASE}

config.h.in

@@ -389,6 +389,9 @@
 /* Define to the one symbol short name of this package. */
 #undef PACKAGE_TARNAME
 
+/* Define to the home page for this package. */
+#undef PACKAGE_URL
+
 /* Define to the version of this package. */
 #undef PACKAGE_VERSION
 
@@ -420,6 +423,12 @@
 /* default username */
 #undef UB_USERNAME
 
+/* use to enable lightweight alloc assertions, for debug use */
+#undef UNBOUND_ALLOC_LITE
+
+/* use malloc not regions, for debug use */
+#undef UNBOUND_ALLOC_NONREGIONAL
+
 /* use statistics for allocs and frees, for debug use */
 #undef UNBOUND_ALLOC_STATS
 
@@ -647,26 +656,6 @@
 #include <ws2tcpip.h>
 #endif
 
-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ERR_H
-#include <openssl/err.h>
-#endif
-
-#ifdef HAVE_OPENSSL_RAND_H
-#include <openssl/rand.h>
-#endif
-
-#ifdef HAVE_OPENSSL_CONF_H
-#include <openssl/conf.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ENGINE_H
-#include <openssl/engine.h>
-#endif
-
 
  
 #ifdef HAVE_ATTR_FORMAT
@@ -813,8 +802,6 @@ struct sockaddr_storage;
 #include "compat/fake-rfc2553.h"
 #endif
 
-#include "ldns/ldns.h"
-
 #ifdef UNBOUND_ALLOC_STATS
 #  define malloc(s) unbound_stat_malloc_log(s, __FILE__, __LINE__, __func__)
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
@@ -832,7 +819,9 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-#endif /* UNBOUND_ALLOC_STATS */
+#elif defined(UNBOUND_ALLOC_LITE)
+#  include "util/alloc.h"
+#endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53

config.sub

@@ -1,10 +1,10 @@
 #! /bin/sh
 # Configuration validation subroutine script.
 #   Copyright (C) 1992, 1993, 1994, 1995, 1996, 1997, 1998, 1999,
-#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008
+#   2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008, 2009
 #   Free Software Foundation, Inc.
 
-timestamp='2009-04-17'
+timestamp='2009-11-20'
 
 # This file is (in principle) common to ALL GNU software.
 # The presence of a machine in this file suggests that SOME GNU software
@@ -32,13 +32,16 @@ timestamp='2009-04-17'
 
 
 # Please send patches to <config-patches@gnu.org>.  Submit a context
-# diff and a properly formatted ChangeLog entry.
+# diff and a properly formatted GNU ChangeLog entry.
 #
 # Configuration subroutine to validate and canonicalize a configuration type.
 # Supply the specified configuration type as an argument.
 # If it is invalid, we print an error message on stderr and exit with code 1.
 # Otherwise, we print the canonical config type on stdout and succeed.
 
+# You can get the latest version of this script from:
+# http://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD
+
 # This file is supposed to be the same for all GNU packages
 # and recognize all the CPU types, system types and aliases
 # that are meaningful with *any* GNU software.
@@ -149,10 +152,13 @@ case $os in
 	-convergent* | -ncr* | -news | -32* | -3600* | -3100* | -hitachi* |\
 	-c[123]* | -convex* | -sun | -crds | -omron* | -dg | -ultra | -tti* | \
 	-harris | -dolphin | -highlevel | -gould | -cbm | -ns | -masscomp | \
-	-apple | -axis | -knuth | -cray)
+	-apple | -axis | -knuth | -cray | -microblaze)
 		os=
 		basic_machine=$1
 		;;
+        -bluegene*)
+	        os=-cnk
+		;;
 	-sim | -cisco | -oki | -wec | -winbond)
 		os=
 		basic_machine=$1
@@ -281,6 +287,7 @@ case $basic_machine in
 	| pdp10 | pdp11 | pj | pjl \
 	| powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \
 	| pyramid \
+	| rx \
 	| score \
 	| sh | sh[1234] | sh[24]a | sh[24]aeb | sh[23]e | sh[34]eb | sheb | shbe | shle | sh[1234]le | sh3ele \
 	| sh64 | sh64le \
@@ -288,13 +295,14 @@ case $basic_machine in
 	| sparcv8 | sparcv9 | sparcv9b | sparcv9v \
 	| spu | strongarm \
 	| tahoe | thumb | tic4x | tic80 | tron \
+	| ubicom32 \
 	| v850 | v850e \
 	| we32k \
 	| x86 | xc16x | xscale | xscalee[bl] | xstormy16 | xtensa \
 	| z8k | z80)
 		basic_machine=$basic_machine-unknown
 		;;
-	m6811 | m68hc11 | m6812 | m68hc12)
+	m6811 | m68hc11 | m6812 | m68hc12 | picochip)
 		# Motorola 68HC11/12.
 		basic_machine=$basic_machine-unknown
 		os=-none
@@ -337,7 +345,7 @@ case $basic_machine in
 	| lm32-* \
 	| m32c-* | m32r-* | m32rle-* \
 	| m68000-* | m680[012346]0-* | m68360-* | m683?2-* | m68k-* \
-	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* \
+	| m88110-* | m88k-* | maxq-* | mcore-* | metag-* | microblaze-* \
 	| mips-* | mipsbe-* | mipseb-* | mipsel-* | mipsle-* \
 	| mips16-* \
 	| mips64-* | mips64el-* \
@@ -365,7 +373,7 @@ case $basic_machine in
 	| pdp10-* | pdp11-* | pj-* | pjl-* | pn-* | power-* \
 	| powerpc-* | powerpc64-* | powerpc64le-* | powerpcle-* | ppcbe-* \
 	| pyramid-* \
-	| romp-* | rs6000-* \
+	| romp-* | rs6000-* | rx-* \
 	| sh-* | sh[1234]-* | sh[24]a-* | sh[24]aeb-* | sh[23]e-* | sh[34]eb-* | sheb-* | shbe-* \
 	| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
 	| sparc-* | sparc64-* | sparc64b-* | sparc64v-* | sparc86x-* | sparclet-* \
@@ -374,6 +382,7 @@ case $basic_machine in
 	| tahoe-* | thumb-* \
 	| tic30-* | tic4x-* | tic54x-* | tic55x-* | tic6x-* | tic80-* | tile-* \
 	| tron-* \
+	| ubicom32-* \
 	| v850-* | v850e-* | vax-* \
 	| we32k-* \
 	| x86-* | x86_64-* | xc16x-* | xps100-* | xscale-* | xscalee[bl]-* \
@@ -467,6 +476,10 @@ case $basic_machine in
 		basic_machine=bfin-`echo $basic_machine | sed 's/^[^-]*-//'`
 		os=-linux
 		;;
+	bluegene*)
+		basic_machine=powerpc-ibm
+		os=-cnk
+		;;
 	c90)
 		basic_machine=c90-cray
 		os=-unicos
@@ -719,6 +732,9 @@ case $basic_machine in
 		basic_machine=ns32k-utek
 		os=-sysv
 		;;
+        microblaze)
+		basic_machine=microblaze-xilinx
+		;;
 	mingw32)
 		basic_machine=i386-pc
 		os=-mingw32
@@ -1240,6 +1256,9 @@ case $os in
         # First match some system type aliases
         # that might get confused with valid system types.
 	# -solaris* is a basic system type, with this one exception.
+        -auroraux)
+	        os=-auroraux
+		;;
 	-solaris1 | -solaris1.*)
 		os=`echo $os | sed -e 's|solaris1|sunos4|'`
 		;;
@@ -1260,9 +1279,9 @@ case $os in
 	# Each alternative MUST END IN A *, to match a version number.
 	# -sysv* is not here because it comes later, after sysvr4.
 	-gnu* | -bsd* | -mach* | -minix* | -genix* | -ultrix* | -irix* \
-	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -sunos | -sunos[34]*\
-	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -solaris* | -sym* \
-	      | -kopensolaris* \
+	      | -*vms* | -sco* | -esix* | -isc* | -aix* | -cnk* | -sunos | -sunos[34]*\
+	      | -hpux* | -unos* | -osf* | -luna* | -dgux* | -auroraux* | -solaris* \
+	      | -sym* | -kopensolaris* \
 	      | -amigaos* | -amigados* | -msdos* | -newsos* | -unicos* | -aof* \
 	      | -aos* | -aros* \
 	      | -nindy* | -vxsim* | -vxworks* | -ebmon* | -hms* | -mvs* \
@@ -1283,7 +1302,7 @@ case $os in
 	      | -os2* | -vos* | -palmos* | -uclinux* | -nucleus* \
 	      | -morphos* | -superux* | -rtmk* | -rtmk-nova* | -windiss* \
 	      | -powermax* | -dnix* | -nx6 | -nx7 | -sei* | -dragonfly* \
-	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops*)
+	      | -skyos* | -haiku* | -rdos* | -toppers* | -drops* | -es*)
 	# Remember, each alternative MUST END IN *, to match a version number.
 		;;
 	-qnx*)
@@ -1613,7 +1632,7 @@ case $basic_machine in
 			-sunos*)
 				vendor=sun
 				;;
-			-aix*)
+			-cnk*|-aix*)
 				vendor=ibm
 				;;
 			-beos*)

configure.ac

@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)
 
-AC_INIT(unbound, 1.4.2, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.4.5, unbound-bugs@nlnetlabs.nl, unbound)
 
 LIBUNBOUND_CURRENT=2
-LIBUNBOUND_REVISION=2
+LIBUNBOUND_REVISION=5
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -27,6 +27,9 @@ LIBUNBOUND_AGE=0
 # 1.4.0 had 1:5:0 (not 2:0:0)   # ub_result.why_bogus
 # 1.4.1 had 2:1:0
 # 1.4.2 had 2:2:0
+# 1.4.3 had 2:3:0
+# 1.4.4 had 2:4:0
+# 1.4.5 had 2:5:0
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -230,6 +233,41 @@ ACX_CHECK_MEMCMP_SIGNED
 
 # add option to disable the evil rpath
 ACX_ARG_RPATH
+AC_SUBST(RUNTIME_PATH)
+
+# check to see if libraries are needed for these functions.
+AC_SEARCH_LIBS([inet_pton], [nsl])
+AC_SEARCH_LIBS([socket], [socket])
+
+# check some functions of the OS before linking libs (while still runnable).
+AC_FUNC_CHOWN
+AC_FUNC_FORK
+AC_TYPE_SIGNAL
+AC_FUNC_FSEEKO
+ACX_SYS_LARGEFILE
+ACX_CHECK_NONBLOCKING_BROKEN
+ACX_MKDIR_ONE_ARG
+
+# check windows threads (we use them, not pthreads, on windows).
+if test "$on_mingw" = "yes"; then
+# check windows threads
+	AC_CHECK_HEADERS([windows.h],,, [AC_INCLUDES_DEFAULT])
+	AC_MSG_CHECKING([for CreateThread])
+	AC_TRY_COMPILE([
+#ifdef HAVE_WINDOWS_H
+#include <windows.h>
+#endif
+], [
+	HANDLE t = CreateThread(NULL, 0, NULL, NULL, 0, NULL);
+],
+	AC_MSG_RESULT(yes)
+	AC_DEFINE(HAVE_WINDOWS_THREADS, 1, [Using Windows threads])
+,	
+	AC_MSG_RESULT(no)
+)
+
+else
+# not on mingw, check thread libraries.
 
 # check for thread library.
 # check this first, so that the pthread lib does not get linked in via
@@ -271,23 +309,7 @@ if test x_$withval != x_no; then
 	fi
 fi
 
-# check windows threads
-if test x_$ub_have_pthreads = x_no -a x_$ub_have_sol_threads = x_no; then
-	AC_CHECK_HEADERS([windows.h],,, [AC_INCLUDES_DEFAULT])
-	AC_MSG_CHECKING([for CreateThread])
-	AC_TRY_COMPILE([
-#ifdef HAVE_WINDOWS_H
-#include <windows.h>
-#endif
-], [
-	HANDLE t = CreateThread(NULL, 0, NULL, NULL, 0, NULL);
-],
-	AC_MSG_RESULT(yes)
-	AC_DEFINE(HAVE_WINDOWS_THREADS, 1, [Using Windows threads])
-,	
-	AC_MSG_RESULT(no)
-)
-fi
+fi # end of non-mingw check of thread libraries
 
 # Check for PyUnbound
 AC_ARG_WITH(pyunbound,
@@ -319,6 +341,7 @@ if test x_$ub_test_python != x_no; then
 
    # Check for Python
    ub_have_python=no
+   ac_save_LIBS="$LIBS" dnl otherwise AC_PYTHON_DEVEL thrashes $LIBS
    AC_PYTHON_DEVEL
    if test ! -z "$PYTHON_VERSION"; then
 	if test `$PYTHON -c "print '$PYTHON_VERSION' >= '2.4.0'"` = "False"; then
@@ -401,21 +424,23 @@ case "$enable_sha2" in
 esac
 
 AC_ARG_ENABLE(gost, AC_HELP_STRING([--enable-gost], [Enable GOST support, experimental]))
+use_gost="no"
 case "$enable_gost" in
 	yes)
-	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL >= 1.0.0 is needed for GOST support])])
+	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL 1.0.0 is needed for GOST support])])
+	use_gost="yes"
 	AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])
 	;;
-	no|*)
+	no)
+	;;
+	*) dnl default
+dnl   Disabled-by-default, RFC not ready.
+dnl	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [
+dnl	  use_gost="yes"
+dnl	  AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])])
 	;;
 esac
 
-# check to see if libraries are needed for these functions.
-AC_SEARCH_LIBS([inet_pton], [nsl])
-AC_SEARCH_LIBS([socket], [socket])
-
-AC_SUBST(RUNTIME_PATH)
-
 # check for libevent
 AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
     [use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr  or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
@@ -472,8 +497,15 @@ large outgoing port ranges.  ])
 	# check for library used by libevent after 1.3c
 	AC_SEARCH_LIBS([clock_gettime], [rt])
 
-	AC_SEARCH_LIBS(event_set, [event])
+	# is the event.h header libev or libevent?
 	AC_CHECK_HEADERS([event.h],,, [AC_INCLUDES_DEFAULT])
+	AC_CHECK_DECL(EV_VERSION_MAJOR, [
+		AC_SEARCH_LIBS(event_set, [ev])
+	],[
+		AC_SEARCH_LIBS(event_set, [event])
+	],[AC_INCLUDES_DEFAULT
+#include <event.h>
+	])
 	AC_CHECK_FUNCS([event_base_free]) # only in libevent 1.2 and later
 	AC_CHECK_FUNCS([event_base_once]) # only in libevent 1.4.1 and later
 	AC_CHECK_FUNCS([event_base_new]) # only in libevent 1.4.1 and later
@@ -515,20 +547,27 @@ fi
 
 # set memory allocation checking if requested
 AC_ARG_ENABLE(alloc-checks, AC_HELP_STRING([--enable-alloc-checks],
-	[ enable to check memory allocation, for debug purposes ]), 
+	[ enable to memory allocation statistics, for debug purposes ]), 
 	, )
+AC_ARG_ENABLE(alloc-lite, AC_HELP_STRING([--enable-alloc-lite],
+	[ enable for lightweight alloc assertions, for debug purposes ]), 
+	, )
+AC_ARG_ENABLE(alloc-nonregional, AC_HELP_STRING([--enable-alloc-nonregional],
+	[ enable nonregional allocs, slow but exposes regional allocations to other memory purifiers, for debug purposes ]), 
+	, )
+if test x_$enable_alloc_nonregional = x_yes; then
+	AC_DEFINE(UNBOUND_ALLOC_NONREGIONAL, 1, [use malloc not regions, for debug use])
+fi
 if test x_$enable_alloc_checks = x_yes; then
 	AC_DEFINE(UNBOUND_ALLOC_STATS, 1, [use statistics for allocs and frees, for debug use])
 else
-	ACX_FUNC_MALLOC([unbound])
+	if test x_$enable_alloc_lite = x_yes; then
+		AC_DEFINE(UNBOUND_ALLOC_LITE, 1, [use to enable lightweight alloc assertions, for debug use])
+	else
+		ACX_FUNC_MALLOC([unbound])
+	fi
 fi
 
-AC_FUNC_CHOWN
-AC_FUNC_FORK
-AC_TYPE_SIGNAL
-AC_FUNC_FSEEKO
-ACX_SYS_LARGEFILE
-
 ACX_CHECK_GETADDRINFO_WITH_INCLUDES
 if test "$USE_WINSOCK" = 1; then
 	AC_DEFINE(UB_ON_WINDOWS, 1, [Use win32 resources and API])
@@ -543,6 +582,8 @@ fi
 if test $ac_cv_func_getaddrinfo = no; then
 	AC_LIBOBJ([fake-rfc2553])
 fi
+# check after getaddrinfo for its libraries
+ACX_FUNC_IOCTLSOCKET
 
 # see if daemon(3) exists, and if it is deprecated.
 AC_CHECK_FUNCS([daemon])
@@ -553,15 +594,14 @@ if test $ac_cv_func_daemon = yes; then
 fi
 
 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev setresuid setreuid setresgid setregid glob initgroups strftime localtime_r setusercontext _beginthreadex])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev glob initgroups strftime localtime_r setusercontext _beginthreadex])
+AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
+AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 
 # check if setreuid en setregid fail, on MacOSX10.4(darwin8).
 if echo $build_os | grep darwin8 > /dev/null; then
 	AC_DEFINE(DARWIN_BROKEN_SETREUID, 1, [Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work])
 fi
-ACX_CHECK_NONBLOCKING_BROKEN
-ACX_MKDIR_ONE_ARG
-ACX_FUNC_IOCTLSOCKET
 AC_REPLACE_FUNCS(inet_aton)
 AC_REPLACE_FUNCS(inet_pton)
 AC_REPLACE_FUNCS(inet_ntop)
@@ -594,12 +634,21 @@ AC_ARG_WITH(ldns-builtin, AC_HELP_STRING([--with-ldns-builtin],
 # check if ldns is good enough
 if test "$use_ldns_builtin" = "no"; then
 	AC_CHECK_LIB(ldns, ldns_buffer_copy)
+	AC_CHECK_FUNC(ldns_key_buf2rsa_raw)
+	AC_CHECK_FUNC(ldns_b32_ntop_extended_hex)
+	if test x$use_gost = xyes; then
+	    AC_CHECK_FUNC(ldns_key_EVP_load_gost_id)
+	else
+	    ac_cv_func_ldns_key_EVP_load_gost_id="yes"
+	fi
 	AC_CHECK_HEADERS([ldns/ldns.h],,, [AC_INCLUDES_DEFAULT])
 	if test $ac_cv_lib_ldns_ldns_buffer_copy = yes \
-	    -a $ac_cv_header_ldns_ldns_h = yes; then
-	    dnl ldns was found, check compat functions
-	    AC_CHECK_FUNC([ldns_b32_ntop_extended_hex],, [
-		AC_MSG_ERROR([ldns version too old, need >=1.4.0])])
+	    -a $ac_cv_func_ldns_key_buf2rsa_raw = yes \
+	    -a $ac_cv_header_ldns_ldns_h = yes \
+	    -a $ac_cv_func_ldns_b32_ntop_extended_hex = yes \
+	    -a $ac_cv_func_ldns_key_EVP_load_gost_id = yes; then
+	    dnl ldns was found
+	    :
 	else
 	    use_ldns_builtin="yes"
 	fi
@@ -683,26 +732,6 @@ dnl includes
 #ifdef HAVE_WS2TCPIP_H
 #include <ws2tcpip.h>
 #endif
-
-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ERR_H
-#include <openssl/err.h>
-#endif
-
-#ifdef HAVE_OPENSSL_RAND_H
-#include <openssl/rand.h>
-#endif
-
-#ifdef HAVE_OPENSSL_CONF_H
-#include <openssl/conf.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ENGINE_H
-#include <openssl/engine.h>
-#endif
 ]
 
 AHX_CONFIG_FORMAT_ATTRIBUTE
@@ -751,8 +780,6 @@ struct sockaddr_storage;
 #include "compat/fake-rfc2553.h"
 #endif
 
-#include "ldns/ldns.h"
-
 #ifdef UNBOUND_ALLOC_STATS
 #  define malloc(s) unbound_stat_malloc_log(s, __FILE__, __LINE__, __func__)
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)
@@ -770,7 +797,9 @@ void unbound_stat_free_log(void *ptr, const char* file, int line,
 	const char* func);
 void *unbound_stat_realloc_log(void *ptr, size_t size, const char* file,
 	int line, const char* func);
-#endif /* UNBOUND_ALLOC_STATS */
+#elif defined(UNBOUND_ALLOC_LITE)
+#  include "util/alloc.h"
+#endif /* UNBOUND_ALLOC_LITE and UNBOUND_ALLOC_STATS */
 
 /** default port for DNS traffic. */
 #define UNBOUND_DNS_PORT 53

contrib/README

@@ -16,3 +16,5 @@ distribution but may be helpful.
 * unbound.plist: launchd configuration file for MacOSX.
 * build-unbound-localzone-from-hosts.pl: perl script to turn /etc/hosts into
 	a local-zone and local-data include file for unbound.conf.
+* unbound-host.nagios.patch: makes unbound-host return status that fits right
+	in with the nagios monitoring framework.  Contributed by Migiel de Vos.

contrib/unbound-host.nagios.patch

@@ -0,0 +1,134 @@
+Index: smallapp/unbound-host.c
+===================================================================
+--- smallapp/unbound-host.c	(revision 2115)
++++ smallapp/unbound-host.c	(working copy)
+@@ -62,9 +62,18 @@
+ #include "libunbound/unbound.h"
+ #include <ldns/ldns.h>
+ 
++/** status variable ala nagios */
++#define FINAL_STATUS_OK		0
++#define FINAL_STATUS_WARNING	1
++#define FINAL_STATUS_CRITICAL	2
++#define FINAL_STATUS_UNKNOWN	3
++
+ /** verbosity for unbound-host app */
+ static int verb = 0;
+ 
++/** variable to determine final output */
++static int final_status = FINAL_STATUS_UNKNOWN;
++
+ /** Give unbound-host usage, and exit (1). */
+ static void
+ usage()
+@@ -93,7 +102,7 @@
+ 	printf("Version %s\n", PACKAGE_VERSION);
+ 	printf("BSD licensed, see LICENSE in source package for details.\n");
+ 	printf("Report bugs to %s\n", PACKAGE_BUGREPORT);
+-	exit(1);
++	exit(FINAL_STATUS_UNKNOWN);
+ }
+ 
+ /** determine if str is ip4 and put into reverse lookup format */
+@@ -138,7 +147,7 @@
+ 	*res = strdup(buf);
+ 	if(!*res) {
+ 		fprintf(stderr, "error: out of memory\n");
+-		exit(1);
++		exit(FINAL_STATUS_UNKNOWN);
+ 	}
+ 	return 1;
+ }
+@@ -158,7 +167,7 @@
+ 	}
+ 	if(!res) {
+ 		fprintf(stderr, "error: out of memory\n");
+-		exit(1);
++		exit(FINAL_STATUS_UNKNOWN);
+ 	}
+ 	return res;
+ }
+@@ -172,7 +181,7 @@
+ 		if(r == 0 && strcasecmp(t, "TYPE0") != 0 && 
+ 			strcmp(t, "") != 0) {
+ 			fprintf(stderr, "error unknown type %s\n", t);
+-			exit(1);
++			exit(FINAL_STATUS_UNKNOWN);
+ 		}
+ 		return r;
+ 	}
+@@ -191,7 +200,7 @@
+ 		if(r == 0 && strcasecmp(c, "CLASS0") != 0 && 
+ 			strcmp(c, "") != 0) {
+ 			fprintf(stderr, "error unknown class %s\n", c);
+-			exit(1);
++			exit(FINAL_STATUS_UNKNOWN);
+ 		}
+ 		return r;
+ 	}
+@@ -207,6 +216,19 @@
+ 	return "(insecure)";
+ }
+ 
++/** update the final status for the exit code */
++void
++update_final_status(struct ub_result* result)
++{
++	if (final_status == FINAL_STATUS_UNKNOWN || final_status == FINAL_STATUS_OK) {
++		if (result->secure) final_status = FINAL_STATUS_OK;
++		else if (result->bogus) final_status = FINAL_STATUS_CRITICAL;
++		else final_status = FINAL_STATUS_WARNING;
++	}
++	else if (final_status == FINAL_STATUS_WARNING && result->bogus)
++		final_status = FINAL_STATUS_CRITICAL;
++}
++
+ /** nice string for type */
+ static void
+ pretty_type(char* s, size_t len, int t)
+@@ -353,7 +375,7 @@
+ 				} else {
+ 					fprintf(stderr, "could not parse "
+ 						"reply packet to ANY query\n");
+-					exit(1);
++					exit(FINAL_STATUS_UNKNOWN);
+ 				}
+ 				ldns_pkt_free(p);
+ 
+@@ -388,9 +410,10 @@
+ 	ret = ub_resolve(ctx, q, t, c, &result);
+ 	if(ret != 0) {
+ 		fprintf(stderr, "resolve error: %s\n", ub_strerror(ret));
+-		exit(1);
++		exit(FINAL_STATUS_UNKNOWN);
+ 	}
+ 	pretty_output(q, t, c, result, docname);
++	update_final_status(result);
+ 	ret = result->nxdomain;
+ 	ub_resolve_free(result);
+ 	return ret;
+@@ -427,7 +450,7 @@
+ {
+ 	if(r != 0) {
+ 		fprintf(stderr, "error: %s\n", ub_strerror(r));
+-		exit(1);
++		exit(FINAL_STATUS_UNKNOWN);
+ 	}
+ }
+ 
+@@ -448,7 +471,7 @@
+ 	ctx = ub_ctx_create();
+ 	if(!ctx) {
+ 		fprintf(stderr, "error: out of memory\n");
+-		exit(1);
++		exit(FINAL_STATUS_UNKNOWN);
+ 	}
+ 
+ 	/* parse the options */
+@@ -509,5 +532,5 @@
+ 		usage();
+ 
+ 	lookup(ctx, argv[0], qtype, qclass);
+-	return 0;
++	return final_status;
+ }

contrib/unbound.spec

@@ -1,6 +1,6 @@
 Summary: Validating, recursive, and caching DNS resolver
 Name: unbound
-Version: 1.0.1
+Version: 1.4.4
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/

daemon/cachedump.c

@@ -40,6 +40,7 @@
  * to text format.
  */
 #include "config.h"
+#include "ldns/ldns.h"
 #include "daemon/cachedump.h"
 #include "daemon/remote.h"
 #include "daemon/worker.h"
@@ -403,7 +404,7 @@ load_rr(SSL* ssl, ldns_buffer* buf, struct regional* region,
 	status = ldns_rr_new_frm_str(&rr, (char*)ldns_buffer_begin(buf),
 		LDNS_DEFAULT_TTL, NULL, NULL);
 	if(status != LDNS_STATUS_OK) {
-		log_warn("error cannot parse rr :%s: %s",
+		log_warn("error cannot parse rr: %s: %s",
 			ldns_get_errorstr_by_id(status),
 			(char*)ldns_buffer_begin(buf));
 		return 0;
@@ -420,7 +421,7 @@ load_rr(SSL* ssl, ldns_buffer* buf, struct regional* region,
 	ldns_buffer_skip(buf, 2);
 	status = ldns_rr_rdata2buffer_wire(buf, rr);
 	if(status != LDNS_STATUS_OK) {
-		log_warn("error cannot rr2wire :%s",
+		log_warn("error cannot rr2wire: %s",
 			ldns_get_errorstr_by_id(status));
 		ldns_rr_free(rr);
 		return 0;
@@ -443,6 +444,12 @@ load_rr(SSL* ssl, ldns_buffer* buf, struct regional* region,
 		rk->rk.rrset_class = htons(ldns_rr_get_class(rr));
 		ldns_buffer_clear(buf);
 		status = ldns_dname2buffer_wire(buf, ldns_rr_owner(rr));
+		if(status != LDNS_STATUS_OK) {
+			log_warn("error cannot dname2buffer: %s",
+				ldns_get_errorstr_by_id(status));
+			ldns_rr_free(rr);
+			return 0;
+		}
 		ldns_buffer_flip(buf);
 		rk->rk.dname_len = ldns_buffer_limit(buf);
 		rk->rk.dname = regional_alloc_init(region, 

daemon/daemon.c

@@ -40,6 +40,22 @@
  */
 
 #include "config.h"
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
+
+#ifdef HAVE_OPENSSL_CONF_H
+#include <openssl/conf.h>
+#endif
+
+#ifdef HAVE_OPENSSL_ENGINE_H
+#include <openssl/engine.h>
+#endif
+#include "ldns/ldns.h"
 #include "daemon/daemon.h"
 #include "daemon/worker.h"
 #include "daemon/remote.h"
@@ -276,7 +292,7 @@ int daemon_get_shufport(struct daemon* daemon, int* shufport)
         /* Knuth shuffle */
 	n = avail;
 	while(--n > 0) {
-		k = ub_random(daemon->rand) % (n+1); /* 0<= k<= n */
+		k = ub_random_max(daemon->rand, n+1); /* 0<= k<= n */
 		temp = shufport[k];
 		shufport[k] = shufport[n];
 		shufport[n] = temp;

daemon/remote.c

@@ -43,6 +43,11 @@
  * Both the server and the client(control tool) have their own keys.
  */
 #include "config.h"
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+#include <ctype.h>
+#include "ldns/ldns.h"
 #include "daemon/remote.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"
@@ -312,7 +317,7 @@ struct listen_port* daemon_remote_open_ports(struct config_file* cfg)
 	struct listen_port* l = NULL;
 	log_assert(cfg->remote_control_enable && cfg->control_port);
 	if(cfg->control_ifs) {
-		struct config_strlist* p = cfg->control_ifs;
+		struct config_strlist* p;
 		for(p = cfg->control_ifs; p; p = p->next) {
 			if(!add_open(p->str, cfg->control_port, &l, 1)) {
 				listening_ports_free(l);
@@ -872,6 +877,7 @@ do_stats(SSL* ssl, struct daemon_remote* rc, int reset)
 	struct stats_info total;
 	struct stats_info s;
 	int i;
+	log_assert(daemon->num > 0);
 	/* gather all thread statistics in one place */
 	for(i=0; i<daemon->num; i++) {
 		server_stats_obtain(rc->worker, daemon->workers[i], &s, reset);
@@ -1111,6 +1117,8 @@ struct del_info {
 	size_t len;
 	/** labels */
 	int labs;
+	/** now */
+	uint32_t now;
 	/** time to invalidate to */
 	uint32_t expired;
 	/** number of rrsets removed */
@@ -1131,8 +1139,10 @@ zone_del_rrset(struct lruhash_entry* e, void* arg)
 	if(dname_subdomain_c(k->rk.dname, inf->name)) {
 		struct packed_rrset_data* d = 
 			(struct packed_rrset_data*)e->data;
-		d->ttl = inf->expired;
-		inf->num_rrsets++;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_rrsets++;
+		}
 	}
 }
 
@@ -1145,8 +1155,10 @@ zone_del_msg(struct lruhash_entry* e, void* arg)
 	struct msgreply_entry* k = (struct msgreply_entry*)e->key;
 	if(dname_subdomain_c(k->key.qname, inf->name)) {
 		struct reply_info* d = (struct reply_info*)e->data;
-		d->ttl = inf->expired;
-		inf->num_msgs++;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_msgs++;
+		}
 	}
 }
 
@@ -1159,8 +1171,10 @@ zone_del_kcache(struct lruhash_entry* e, void* arg)
 	struct key_entry_key* k = (struct key_entry_key*)e->key;
 	if(dname_subdomain_c(k->name, inf->name)) {
 		struct key_entry_data* d = (struct key_entry_data*)e->data;
-		d->ttl = inf->expired;
-		inf->num_keys++;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_keys++;
+		}
 	}
 }
 
@@ -1180,6 +1194,7 @@ do_flush_zone(SSL* ssl, struct worker* worker, char* arg)
 	inf.name = nm;
 	inf.len = nmlen;
 	inf.labs = nmlabs;
+	inf.now = *worker->env.now;
 	inf.expired = *worker->env.now;
 	inf.expired -= 3; /* handle 3 seconds skew between threads */
 	inf.num_rrsets = 0;

daemon/remote.h

@@ -45,6 +45,9 @@
 
 #ifndef DAEMON_REMOTE_H
 #define DAEMON_REMOTE_H
+#ifdef HAVE_OPENSSL_SSL_H
+#include "openssl/ssl.h"
+#endif
 struct config_file;
 struct listen_list;
 struct listen_port;

daemon/stats.c

@@ -40,6 +40,7 @@
  * numbers. These 'statistics' may be of interest to the operator.
  */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "daemon/stats.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"

daemon/stats.h

@@ -43,6 +43,7 @@
 #ifndef DAEMON_STATS_H
 #define DAEMON_STATS_H
 #include "util/timehist.h"
+#include "ldns/buffer.h"
 struct worker;
 struct config_file;
 struct comm_point;

daemon/unbound.c

@@ -41,6 +41,9 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 #include "util/log.h"
 #include "daemon/daemon.h"
 #include "daemon/remote.h"
@@ -313,7 +316,7 @@ detach(void)
 	if(daemon(1, 0) != 0)
 		fatal_exit("daemon failed: %s", strerror(errno));
 #else /* no HAVE_DAEMON */
-#ifdef HAVE_WORKING_FORK
+#ifdef HAVE_FORK
 	int fd;
 	/* Take off... */
 	switch (fork()) {
@@ -337,7 +340,7 @@ detach(void)
 		if (fd > 2)
 			(void)close(fd);
 	}
-#endif /* HAVE_WORKING_FORK */
+#endif /* HAVE_FORK */
 #endif /* HAVE_DAEMON */
 }
 
@@ -607,7 +610,9 @@ main(int argc, char* argv[])
 	const char* winopt = NULL;
 	int cmdline_verbose = 0;
 	int debug_mode = 0;
+#ifdef UB_ON_WINDOWS
 	int cmdline_cfg = 0;
+#endif
 
 #ifdef HAVE_SBRK
 	/* take debug snapshot of heap */
@@ -620,7 +625,9 @@ main(int argc, char* argv[])
 		switch(c) {
 		case 'c':
 			cfgfile = optarg;
+#ifdef UB_ON_WINDOWS
 			cmdline_cfg = 1;
+#endif
 			break;
 		case 'v':
 			cmdline_verbose ++;

daemon/worker.c

@@ -40,6 +40,7 @@
  * pending requests.
  */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/random.h"
@@ -1247,7 +1248,7 @@ outbound_entry_compare(void* a, void* b)
 
 struct outbound_entry*
 worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
-	uint16_t qclass, uint16_t flags, int dnssec,
+	uint16_t qclass, uint16_t flags, int dnssec, int want_dnssec,
 	struct sockaddr_storage* addr, socklen_t addrlen,
 	struct module_qstate* q)
 {
@@ -1258,9 +1259,9 @@ worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		return NULL;
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(worker->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, addr, addrlen, 
-		worker_handle_service_reply, e, worker->back->udp_buff,
-		&outbound_entry_compare);
+		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
+		addr, addrlen, worker_handle_service_reply, e, 
+		worker->back->udp_buff, &outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -1295,7 +1296,8 @@ int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);

daemon/worker.h

@@ -189,6 +189,7 @@ int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  * @param qclass: query class. (host order)
  * @param flags: host order flags word, with opcode and CD bit.
  * @param dnssec: if set, EDNS record will have DO bit set.
+ * @param want_dnssec: signatures needed.
  * @param addr: where to.
  * @param addrlen: length of addr.
  * @param q: wich query state to reactivate upon return.
@@ -197,7 +198,7 @@ int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  */
 struct outbound_entry* worker_send_query(uint8_t* qname, size_t qnamelen, 
 	uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec, 
-	struct sockaddr_storage* addr, socklen_t addrlen,
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
 	struct module_qstate* q);
 
 /** 

doc/Changelog

@@ -1,3 +1,226 @@
+11 June 2010: Wouter
+	- When retry to parent the retrycount is not wiped, so failed 
+	  nameservers are not tried again.
+	- iana portlist updated.
+
+10 June 2010: Wouter
+	- Fix bug where a long loop could be entered, now cycle detection
+	  has a loop-counter and maximum search amount.
+
+4 June 2010: Wouter
+	- iana portlist updated.
+	- 1.4.5rc1 tag created.
+
+3 June 2010: Wouter
+	- ldns tarball updated, 1.6.5.
+	- review comments, split dependency cycle tracking for parentside
+	  last resort lookups for A and AAAA so there are more lookup options.
+
+2 June 2010: Wouter
+	- Fix compile warning if compiled without threads.
+	- updated ldns-tarball with current ldns svn (pre 1.6.5).
+	- GOST disabled-by-default, the algorithm number is allocated but the
+	  RFC is still has to pass AUTH48 at the IETF.
+
+1 June 2010: Wouter
+	- Ignore Z flag in incoming messages too.
+	- Fix storage of negative parent glue if that last resort fails.
+	- libtoolize 2.2.6b, autoconf 2.65 applied to configure.
+	- new splint flags for newer splint install.
+
+31 May 2010: Wouter
+	- Fix AD flag handling, it could in some cases mistakenly copy the AD 
+	  flag from upstream servers.
+	- alloc_special_obtain out of memory is not a fatal error any more,
+	  enabling unbound to continue longer in out of memory conditions.
+	- parentside names are dispreferred but not said to be dnssec-lame.
+	- parentside check for cached newname glue.
+	- fix parentside and querytargets modulestate, for dump_requestlist.
+	- unbound-control-setup makes keys -rw-r--- so not all users permitted.
+	- fix parentside from cache to be marked dispreferred for bad names.
+
+28 May 2010: Wouter
+	- iana portlist updated.
+	- parent-child disagreement approach altered.  Older fixes are
+	  removed in place of a more exhaustive search for misconfigured data
+	  available via the parent of a delegation.
+	  This is designed to be throttled by cache entries, with TTL from the
+	  parent if possible.  Additionally the loop-counter is used.
+	  It also tests for NS RRset differences between parent and child.
+	  The fetch of misconfigured data should be more reliable and thorough.
+	  It should work reliably even with no or only partial data in cache.
+	  Data received from the child (as always) is deemed more
+	  authoritative than information received from the delegation parent.
+	  The search for misconfigured data is not performed normally.
+
+26 May 2010: Wouter
+	- Contribution from Migiel de Vos (Surfnet): nagios patch for
+	  unbound-host, in contrib/ (in the source tarball).  Makes
+	  unbound-host suitable for monitoring dnssec(-chain) status.
+
+21 May 2010: Wouter
+	- EDNS timeout code will not fire if EDNS status already known.
+	- EDNS failure not stored if EDNS status known to work.
+
+19 May 2010: Wouter
+	- Fix resolution for domains like safesvc.com.cn.  If the iterator
+	  can not recurse further and it finds the delegation in a state
+	  where it would otherwise have rejected it outhand if so received
+	  from a cache lookup, then it can try to ask higherup (with loop
+	  protection).
+	- Fix comments in iter_utils:dp_is_useless.
+
+18 May 2010: Wouter
+	- Fix various compiler warnings from the clang llvm compiler.
+	- iana portlist updated.
+
+6 May 2010: Wouter
+	- Fix bug#308: spelling error in variable name in parser and lexer.
+
+4 May 2010: Wouter
+	- Fix dnssec-missing detection that was turned off by server selection.
+	- Conforms to draft-ietf-dnsop-default-local-zones-13.  Added default
+	  reverse lookup blocks for IPv4 test nets 100.51.198.in-addr.arpa,
+	  113.0.203.in-addr.arpa and Orchid prefix 0.1.1.0.0.2.ip6.arpa.
+
+29 April 2010: Wouter
+	- Fix for dnssec lameness detection to use the key cache.
+	- infra cache entries that are expired are wiped clean.  Previously
+	  it was possible to not expire host data (if accessed often).
+
+28 April 2010: Wouter
+	- ldns tarball updated and GOST support is detected and then enabled. 
+	- iana portlist updated.
+	- Fix detection of gost support in ldns (reported by Chris Smith).
+
+27 April 2010: Wouter
+	- unbound-control get_option domain-insecure shows config file items.
+	- fix retry sequence if prime hints are recursion-lame.
+	- autotrust anchor file can be initialized with a ZSK key as well.
+	- harden-referral-path does not result in failures due to max-depth.
+	  You can increase the max-depth by adding numbers (' 0') after the
+	  target-fetch-policy, this increases the depth to which is checked.
+
+26 April 2010: Wouter
+	- Compile fix using Sun Studio 12 compiler on Solaris 5.9, use
+	  CPPFLAGS during configure process.
+	- if libev is installed on the base system (not libevent), detect
+	  it from the event.h header file and link with -lev.
+	- configlexer.lex gets config.h, and configyyrename.h added by make,
+	  no more double include.
+	- More strict scrubber (Thanks to George Barwood for the idea):
+	  NS set must be pertinent to the query (qname subdomain nsname).
+	- Fix bug#307: In 0x20 backoff fix fallback so the number of 
+	  outstanding queries does not become -1 and block the request.
+	  Fixed handling of recursion-lame in combination with 0x20 fallback.
+	  Fix so RRsets are compared canonicalized and sorted if the immediate
+	  comparison fails, this makes it work around round-robin sites.
+
+23 April 2010: Wouter
+	- Squelch log message: sendto failed permission denied for
+	  255.255.255.255, it is visible in VERB_DETAIL (verbosity 2).
+	- Fix to fetch data as last resort more tenaciously.  When cycle
+	  targets cause the server selection to believe there are more options
+	  when they really are not there, the server selection is reinitiated.
+	- Fix fetch from blacklisted dnssec lame servers as last resort.  The
+	  server's IP address is then given in validator errors as well.
+	- Fix local-zone type redirect that did not use the query name for
+	  the answer rrset.
+
+22 April 2010: Wouter
+	- tag 1.4.4.
+	- trunk contains 1.4.5 in development.
+	- Fix validation failure for qtype ANY caused by a RRSIG parse failure.
+	  The validator error message was 'no signatures from ...'.
+
+16 April 2010: Wouter
+	- more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN.
+	- tag 1.4.4rc1.
+
+15 April 2010: Wouter
+	- ECC-GOST algorithm number 12 that is assigned by IANA.  New test
+	  example key and signatures for GOST.  GOST requires openssl-1.0.0.
+	  GOST is still disabled by default.
+
+9 April 2010: Wouter
+	- Fix bug#305: pkt_dname_tolower could read beyond end of buffer or
+	  get into an endless loop, if 0x20 was enabled, and buffers are small
+	  or particular broken packets are received.
+	- Fix chain of trust with CNAME at an intermediate step, for the DS
+	  processing proof.
+
+8 April 2010: Wouter
+	- Fix validation of queries with wildcard names (*.example).
+
+6 April 2010: Wouter
+	- Fix EDNS probe for .de DNSSEC testbed failure, where the infra
+	  cache timeout coincided with a server update, the current EDNS 
+	  backoff is less sensitive, and does not cache the backoff unless 
+	  the backoff actually works and the domain is not expecting DNSSEC.
+	- GOST support with correct algorithm numbers.
+
+1 April 2010: Wouter
+	- iana portlist updated.
+
+24 March 2010: Wouter
+	- unbound control flushed items are not counted when flushed again.
+
+23 March 2010: Wouter
+	- iana portlist updated.
+
+22 March 2010: Wouter
+	- unbound-host disables use-syslog from config file so that the
+	  config file for the main server can be used more easily.
+	- fix bug#301: unbound-checkconf could not parse interface
+	  '0.0.0.0@5353', even though unbound itself worked fine.
+
+19 March 2010: Wouter
+	- fix fwd_ancil test to pass if the socket options are not supported.
+
+18 March 2010: Wouter
+	- Fixed random numbers for port, interface and server selection.
+	  Removed very small bias.
+	- Refer to the listing in unbound-control man page in the extended
+	  statistics entry in the unbound.conf man page.
+
+16 March 2010: Wouter
+	- Fix interface-automatic for OpenBSD: msg.controllen was too small,
+	  also assertions on ancillary data buffer.
+	- check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO.
+	- for NSEC3 check if signatures are cached.
+
+15 March 2010: Wouter
+	- unit test for util/regional.c.
+
+12 March 2010: Wouter
+	- Reordered configure checks so fork and -lnsl -lsocket checks are
+	  earlier, and thus later checks benefit from and do not hinder them.
+	- iana portlist updated.
+	- ldns tarball updated.
+	- Fix python use when multithreaded.
+	- Fix solaris python compile.
+	- Include less in config.h and include per code file for ldns, ssl.
+
+11 March 2010: Wouter
+	- another memory allocation option: --enable-alloc-nonregional.
+	  exposes the regional allocations to other memory purifiers.
+	- fix for memory alignment in struct sock_list allocation.
+	- Fix for MacPorts ldns without ssl default, unbound checks if ldns
+	  has dnssec functionality and uses the builtin if not.
+	- Fix daemonize on Solaris 10, it did not detach from terminal.
+	- tag 1.4.3 created.
+	- trunk is 1.4.4 in development.
+	- spelling fix in validation error involving cnames.
+
+10 March 2010: Wouter
+	- --enable-alloc-lite works with test set.
+	- portability in the testset: printf format conversions, prototypes.
+
+9 March 2010: Wouter
+	- tag 1.4.2 created.
+	- trunk is 1.4.3 in development.
+	- --enable-alloc-lite debug option.
+
 8 March 2010: Wouter
 	- iana portlist updated.
 

doc/README.tests

@@ -6,6 +6,7 @@ To make and run the tests. The results are summarized at the end.
 
 You need to have the following programs installed and in your PATH.
 * dig - from the bind-tools package. Used to send DNS queries.
+* wdiff - used for word-by-word comparisons.
 * splint (optional) - for lint test
 * doxygen (optional) - for doc completeness test
 * ldns-testns (optional) - from ldns examples. Used as DNS auth server.

doc/TODO

@@ -69,3 +69,8 @@ later
   document high scalable, high available unbound setup onepager.
 - prefetch DNSKEY when DS in delegation seen (nonCD, underTA).
 - use libevent if available on system by default(?), default outgoing 256to1024
+
+[1] BIND-like query logging to see who's looking up what and when
+[2] more logging about stuff like SERVFAIL and REFUSED responses
+[3] a Makefile that works without gnumake
+

doc/control_proto_spec.txt

@@ -62,5 +62,4 @@ local_data <resource record string>
 	local_data_add www.example.com. IN A 192.0.2.2
 	if no local_zone exists for it; a transparent zone with the same
 	name as the data is created.
-
-
+Other commands in the unbound-control manual page.

doc/example.conf.in

@@ -344,7 +344,7 @@ server:
 	# val-bogus-ttl: 60
 
 	# The signature inception and expiration dates are allowed to be off
-	# by 10% of the lifetime of the signature from our local clock.
+	# by 10% of the signature lifetime (expir-incep) from our local clock.
 	# This leeway is capped with a minimum and a maximum.  In seconds.
 	# val-sig-skew-min: 3600
 	# val-sig-skew-max: 86400

doc/unbound-control.8.in

@@ -194,8 +194,10 @@ The unbound\-control program exits with status code 1 on error, 0 on success.
 The setup requires a self\-signed certificate and private keys for both 
 the server and client.  The script \fIunbound\-control\-setup\fR generates
 these in the default run directory, or with \-d in another directory.
+If you change the access control permissions on the key files you can decide
+who can use unbound\-control, by default owner and group but not all users.
 Run the script under the same username as you have configured in unbound.conf
-so that the daemon is permitted to read the files, for example with:
+or as root, so that the daemon is permitted to read the files, for example with:
 .nf
     sudo \-u unbound unbound\-control\-setup
 .fi

doc/unbound.conf.5.in

@@ -100,7 +100,8 @@ the statistics counters after logging the statistics. Default is no.
 .TP
 .B extended\-statistics: \fI<yes or no>
 If enabled, extended statistics are printed from \fIunbound\-control\fR(8). 
-Default is off, because keeping track of more statistics takes time.
+Default is off, because keeping track of more statistics takes time.  The
+counters are listed in \fIunbound\-control\fR(8).
 .TP
 .B num\-threads: \fI<number>
 The number of threads to create to serve clients. Use 1 for no threading.
@@ -455,6 +456,8 @@ path to the answer.
 Default off, because it burdens the authority servers, and it is
 not RFC standard, and could lead to performance problems because of the
 extra query load that is generated.  Experimental option.
+If you enable it consider adding more numbers after the target\-fetch\-policy
+to increase the max depth that is checked to.
 .TP
 .B use\-caps\-for\-id: \fI<yes or no>
 Use 0x20\-encoded random bits in the query to foil spoof attempts.
@@ -581,17 +584,19 @@ you are debugging signature inception and expiration.
 .TP
 .B val\-sig\-skew\-min: \fI<seconds>
 Minimum number of seconds of clock skew to apply to validated signatures.
-A value of 10% of the signature lifetime is used, capped by this setting.  
-Default is 3600 (1 hour) which allows for daylight savings differences.  
-Lower this value for more strict checking of short lived signatures.
+A value of 10% of the signature lifetime (expiration \- inception) is
+used, capped by this setting.  Default is 3600 (1 hour) which allows for
+daylight savings differences.  Lower this value for more strict checking
+of short lived signatures.
 .TP
 .B val\-sig\-skew\-max: \fI<seconds>
 Maximum number of seconds of clock skew to apply to validated signatures.
-A value of 10% of the signature lifetime is used, capped by this setting.  
-Default is 86400 (24 hours) which allows for timezone setting problems in 
-stable domains.  Setting both min and max very low disables the clock skew 
-allowances.  Setting both min and max very high makes the validator check
-the signature timestamps less strictly.
+A value of 10% of the signature lifetime (expiration \- inception)
+is used, capped by this setting.  Default is 86400 (24 hours) which
+allows for timezone setting problems in stable domains.  Setting both
+min and max very low disables the clock skew allowances.  Setting both
+min and max very high makes the validator check the signature timestamps
+less strictly.
 .TP
 .B val\-bogus\-ttl: \fI<number>
 The time to live for bogus data. This is data that has failed validation;
@@ -773,7 +778,8 @@ records are provided.
 .TP 10
 \h'5'\fIreverse RFC3330 IP4 this, link\-local, testnet and broadcast\fR 
 Reverse data for zones 0.in\-addr.arpa, 254.169.in\-addr.arpa, 
-2.0.192.in\-addr.arpa, 255.255.255.255.in\-addr.arpa.
+2.0.192.in\-addr.arpa (TEST NET 1), 100.51.198.in\-addr.arpa (TEST NET 2),
+113.0.203.in\-addr.arpa (TEST NET 3), 255.255.255.255.in\-addr.arpa.
 .TP 10
 \h'5'\fIreverse RFC4291 IP6 unspecified\fR
 Reverse data for zone 
@@ -788,12 +794,17 @@ Reverse data for zone D.F.ip6.arpa.
 \h'5'\fIreverse RFC4291 IPv6 Link Local Addresses\fR
 Reverse data for zones 8.E.F.ip6.arpa to B.E.F.ip6.arpa.
 .TP 10
+\h'5'\fIreverse RFC4843 Orchid Prefix\fR
+Reverse data for zone 0.1.1.0.0.2.ip6.arpa.
+.TP 10
 \h'5'\fIreverse IPv6 Example Prefix\fR
 Reverse data for zone 8.B.D.0.1.0.0.2.ip6.arpa. This zone is used for
 tutorials and examples. You can remove the block on this zone with:
 .nf
   local\-zone: 8.B.D.0.1.0.0.2.ip6.arpa. nodefault
 .fi
+You can also selectively unblock a part of the zone by making that part
+transparent with a local\-zone statement.
 This also works with the other default zones.
 .\" End of local-zone listing.
 .TP 5

iterator/iter_delegpt.c

@@ -69,12 +69,15 @@ struct delegpt* delegpt_copy(struct delegpt* dp, struct regional* region)
 	if(!delegpt_set_name(copy, region, dp->name))
 		return NULL;
 	copy->bogus = dp->bogus;
+	copy->has_parent_side_NS = dp->has_parent_side_NS;
 	for(ns = dp->nslist; ns; ns = ns->next) {
-		if(!delegpt_add_ns(copy, region, ns->name))
+		if(!delegpt_add_ns(copy, region, ns->name, (int)ns->lame))
 			return NULL;
 		copy->nslist->resolved = ns->resolved;
 		copy->nslist->got4 = ns->got4;
 		copy->nslist->got6 = ns->got6;
+		copy->nslist->done_pside4 = ns->done_pside4;
+		copy->nslist->done_pside6 = ns->done_pside6;
 	}
 	for(a = dp->target_list; a; a = a->next_target) {
 		if(!delegpt_add_addr(copy, region, &a->addr, a->addrlen, 
@@ -93,7 +96,8 @@ delegpt_set_name(struct delegpt* dp, struct regional* region, uint8_t* name)
 }
 
 int 
-delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name)
+delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name,
+	int lame)
 {
 	struct delegpt_ns* ns;
 	size_t len;
@@ -113,6 +117,9 @@ delegpt_add_ns(struct delegpt* dp, struct regional* region, uint8_t* name)
 	ns->resolved = 0;
 	ns->got4 = 0;
 	ns->got6 = 0;
+	ns->lame = (uint8_t)lame;
+	ns->done_pside4 = 0;
+	ns->done_pside6 = 0;
 	return 1;
 }
 
@@ -245,15 +252,19 @@ void delegpt_log(enum verbosity_value v, struct delegpt* dp)
 	delegpt_count_ns(dp, &numns, &missing);
 	delegpt_count_addr(dp, &numaddr, &numres, &numavail);
 	log_info("DelegationPoint<%s>: %u names (%u missing), "
-		"%u addrs (%u result, %u avail)", 
+		"%u addrs (%u result, %u avail)%s", 
 		buf, (unsigned)numns, (unsigned)missing, 
-		(unsigned)numaddr, (unsigned)numres, (unsigned)numavail);
+		(unsigned)numaddr, (unsigned)numres, (unsigned)numavail,
+		(dp->has_parent_side_NS?" parentNS":" cacheNS"));
 	if(verbosity >= VERB_ALGO) {
 		for(ns = dp->nslist; ns; ns = ns->next) {
 			dname_str(ns->name, buf);
-			log_info("  %s %s%s%s%s", buf, (ns->resolved?"*":""),
+			log_info("  %s %s%s%s%s%s%s%s", buf, 
+			(ns->resolved?"*":""),
 			(ns->got4?" A":""), (ns->got6?" AAAA":""),
-			(dp->bogus?" BOGUS":"") );
+			(dp->bogus?" BOGUS":""), (ns->lame?" PARENTSIDE":""),
+			(ns->done_pside4?" PSIDE_A":""),
+			(ns->done_pside6?" PSIDE_AAAA":""));
 		}
 		for(a = dp->target_list; a; a = a->next_target) {
 			const char* str = "  ";
@@ -277,6 +288,16 @@ delegpt_add_unused_targets(struct delegpt* dp)
 	}
 }
 
+size_t
+delegpt_count_targets(struct delegpt* dp)
+{
+	struct delegpt_addr* a;
+	size_t n = 0;
+	for(a = dp->target_list; a; a = a->next_target)
+		n++;
+	return n;
+}
+
 size_t 
 delegpt_count_missing_targets(struct delegpt* dp)
 {
@@ -325,9 +346,10 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 	dp = delegpt_create(region);
 	if(!dp)
 		return NULL;
+	dp->has_parent_side_NS = 1; /* created from message */
 	if(!delegpt_set_name(dp, region, ns_rrset->rk.dname))
 		return NULL;
-	if(!delegpt_rrset_add_ns(dp, region, ns_rrset))
+	if(!delegpt_rrset_add_ns(dp, region, ns_rrset, 0))
 		return NULL;
 
 	/* add glue, A and AAAA in answer and additional section */
@@ -351,7 +373,7 @@ delegpt_from_message(struct dns_msg* msg, struct regional* region)
 
 int 
 delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
-        struct ub_packed_rrset_key* ns_rrset)
+        struct ub_packed_rrset_key* ns_rrset, int lame)
 {
 	struct packed_rrset_data* nsdata = (struct packed_rrset_data*)
 		ns_rrset->entry.data;
@@ -364,7 +386,7 @@ delegpt_rrset_add_ns(struct delegpt* dp, struct regional* region,
 			(size_t)ldns_read_uint16(nsdata->rr_data[i]))
 			continue; /* bad format */
 		/* add rdata of NS (= wirefmt dname), skip rdatalen bytes */
-		if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2))
+		if(!delegpt_add_ns(dp, region, nsdata->rr_data[i]+2, lame))
 			return 0;
 	}
 	return 1;
@@ -418,16 +440,16 @@ delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* region,
 
 int 
 delegpt_add_rrset(struct delegpt* dp, struct regional* region,
-        struct ub_packed_rrset_key* rrset)
+        struct ub_packed_rrset_key* rrset, int lame)
 {
 	if(!rrset)
 		return 1;
 	if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_NS)
-		return delegpt_rrset_add_ns(dp, region, rrset);
+		return delegpt_rrset_add_ns(dp, region, rrset, lame);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_A)
-		return delegpt_add_rrset_A(dp, region, rrset, 0, 1);
+		return delegpt_add_rrset_A(dp, region, rrset, lame, 1);
 	else if(ntohs(rrset->rk.type) == LDNS_RR_TYPE_AAAA)
-		return delegpt_add_rrset_AAAA(dp, region, rrset, 0, 1);
+		return delegpt_add_rrset_AAAA(dp, region, rrset, lame, 1);
 	log_warn("Unknown rrset type added to delegpt");
 	return 1;
 }

iterator/iter_delegpt.h

@@ -74,6 +74,11 @@ struct delegpt {
 
 	/** if true, the NS RRset was bogus. All info is bad. */
 	int bogus;
+	/** if true, the parent-side NS record has been applied:
+	 * its names have been added and their addresses can follow later.
+	 * Also true if the delegationpoint was created from a delegation
+	 * message and thus contains the parent-side-info already. */
+	uint8_t has_parent_side_NS;
 };
 
 /**
@@ -90,13 +95,26 @@ struct delegpt_ns {
 	 * If the name has been resolved. false if not queried for yet.
 	 * true if the A, AAAA queries have been generated.
 	 * marked true if those queries fail.
-	 * and marked true is got4 and got6 are both true.
+	 * and marked true if got4 and got6 are both true.
 	 */
 	int resolved;
 	/** if the ipv4 address is in the delegpt */
 	uint8_t got4;
 	/** if the ipv6 address is in the delegpt */
 	uint8_t got6;
+	/**
+	 * If the name is parent-side only and thus dispreferred.
+	 * Its addresses become dispreferred as well
+	 */
+	uint8_t lame;
+	/** if the parent-side ipv4 address has been looked up (last resort).
+	 * Also enabled if a parent-side cache entry exists, or a parent-side
+	 * negative-cache entry exists. */
+	uint8_t done_pside4;
+	/** if the parent-side ipv6 address has been looked up (last resort).
+	 * Also enabled if a parent-side cache entry exists, or a parent-side
+	 * negative-cache entry exists. */
+	uint8_t done_pside6;
 };
 
 /**
@@ -155,20 +173,22 @@ int delegpt_set_name(struct delegpt* dp, struct regional* regional,
  * @param dp: delegation point.
  * @param regional: where to allocate the info.
  * @param name: domain name in wire format.
+ * @param lame: name is lame, disprefer it.
  * @return false on error.
  */
 int delegpt_add_ns(struct delegpt* dp, struct regional* regional, 
-	uint8_t* name);
+	uint8_t* name, int lame);
 
 /**
  * Add NS rrset; calls add_ns repeatedly.
  * @param dp: delegation point.
  * @param regional: where to allocate the info.
  * @param ns_rrset: NS rrset.
+ * @param lame: rrset is lame, disprefer it.
  * return 0 on alloc error.
  */
 int delegpt_rrset_add_ns(struct delegpt* dp, struct regional* regional,
-	struct ub_packed_rrset_key* ns_rrset);
+	struct ub_packed_rrset_key* ns_rrset, int lame);
 
 /**
  * Add target address to the delegation point.
@@ -219,10 +239,11 @@ int delegpt_add_rrset_AAAA(struct delegpt* dp, struct regional* regional,
  * @param dp: delegation point.
  * @param regional: where to allocate the info.
  * @param rrset: RRset to add, NS, A, AAAA.
+ * @param lame: rrset is lame, disprefer it.
  * @return 0 on alloc error.
  */
 int delegpt_add_rrset(struct delegpt* dp, struct regional* regional, 
-	struct ub_packed_rrset_key* rrset);
+	struct ub_packed_rrset_key* rrset, int lame);
 
 /**
  * Add address to the delegation point. No servername is associated or checked.
@@ -286,6 +307,9 @@ void delegpt_add_unused_targets(struct delegpt* dp);
  */
 size_t delegpt_count_missing_targets(struct delegpt* dp);
 
+/** count total number of targets in dp */
+size_t delegpt_count_targets(struct delegpt* dp);
+
 /**
  * Create new delegation point from a dns message
  *

iterator/iter_fwd.c

@@ -40,6 +40,9 @@
  * Keep track of forward zones and config settings.
  */
 #include "config.h"
+#include "ldns/rdata.h"
+#include "ldns/dname.h"
+#include "ldns/rr.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_delegpt.h"
 #include "util/regional.h"
@@ -187,7 +190,7 @@ read_fwds_host(struct iter_forwards* fwd, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_ns(dp, fwd->region, ldns_rdf_data(rdf))) {
+		if(!delegpt_add_ns(dp, fwd->region, ldns_rdf_data(rdf), 0)) {
 			ldns_rdf_deep_free(rdf);
 			log_err("out of memory");
 			return 0;
@@ -232,6 +235,9 @@ read_forwards(struct iter_forwards* fwd, struct config_file* cfg)
 			log_err("out of memory");
 			return 0;
 		}
+		/* set flag that parent side NS information is included.
+		 * Asking a (higher up) server on the internet is not useful */
+		dp->has_parent_side_NS = 1;
 		if(!read_fwds_name(fwd, s, dp) ||
 			!read_fwds_host(fwd, s, dp) ||
 			!read_fwds_addr(fwd, s, dp))

iterator/iter_hints.c

@@ -40,6 +40,8 @@
  * Keep track of stub and root hints, and read those from config.
  */
 #include "config.h"
+#include "ldns/dname.h"
+#include "ldns/rr.h"
 #include "iterator/iter_hints.h"
 #include "iterator/iter_delegpt.h"
 #include "util/regional.h"
@@ -83,7 +85,7 @@ ah(struct delegpt* dp, struct regional* r, const char* sv, const char* ip)
 		log_err("could not parse %s", sv);
 		return 0;
 	}
-	if(!delegpt_add_ns(dp, r, ldns_rdf_data(rdf)) ||
+	if(!delegpt_add_ns(dp, r, ldns_rdf_data(rdf), 0) ||
 	   !extstrtoaddr(ip, &addr, &addrlen) ||
 	   !delegpt_add_target(dp, r, ldns_rdf_data(rdf), ldns_rdf_size(rdf),
 		&addr, addrlen, 0, 0, 1)) {
@@ -110,6 +112,7 @@ compile_time_root_prime(struct regional* r, int do_ip4, int do_ip6)
 	struct delegpt* dp = delegpt_create(r);
 	if(!dp)
 		return NULL;
+	dp->has_parent_side_NS = 1;
 	if(!delegpt_set_name(dp, r, (uint8_t*)"\000"))
 		return NULL;
       if(do_ip4) {
@@ -200,7 +203,7 @@ read_stubs_host(struct iter_hints* hints, struct config_stub* s,
 				s->name, p->str);
 			return 0;
 		}
-		if(!delegpt_add_ns(dp, hints->region, ldns_rdf_data(rdf))) {
+		if(!delegpt_add_ns(dp, hints->region, ldns_rdf_data(rdf), 0)) {
 			ldns_rdf_deep_free(rdf);
 			log_err("out of memory");
 			return 0;
@@ -245,6 +248,7 @@ read_stubs(struct iter_hints* hints, struct config_file* cfg)
 			log_err("out of memory");
 			return 0;
 		}
+		dp->has_parent_side_NS = 1;
 		if(!read_stubs_name(hints, s, dp) ||
 			!read_stubs_host(hints, s, dp) ||
 			!read_stubs_addr(hints, s, dp))
@@ -281,6 +285,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 		return 0;
 	}
 	verbose(VERB_QUERY, "Reading root hints from %s", fname);
+	dp->has_parent_side_NS = 1;
 	while(!feof(f)) {
 		status = ldns_rr_new_frm_fp_l(&rr, f, 
 			&default_ttl, &origin, &prev_rr, &lineno);
@@ -295,7 +300,7 @@ read_root_hints(struct iter_hints* hints, char* fname)
 		}
 		if(ldns_rr_get_type(rr) == LDNS_RR_TYPE_NS) {
 			if(!delegpt_add_ns(dp, hints->region,
-				ldns_rdf_data(ldns_rr_rdf(rr, 0)))) {
+				ldns_rdf_data(ldns_rr_rdf(rr, 0)), 0)) {
 				log_err("out of memory reading root hints");
 				goto stop_read;
 			}

iterator/iter_priv.c

@@ -41,6 +41,7 @@
  */
 
 #include "config.h"
+#include "ldns/dname.h"
 #include "iterator/iter_priv.h"
 #include "util/regional.h"
 #include "util/log.h"

iterator/iter_priv.h

@@ -43,6 +43,7 @@
 #ifndef ITERATOR_ITER_PRIV_H
 #define ITERATOR_ITER_PRIV_H
 #include "util/rbtree.h"
+#include "ldns/buffer.h"
 struct iter_env;
 struct config_file;
 struct regional;

iterator/iter_resptype.c

@@ -40,6 +40,7 @@
  * one of the response types.
  */
 #include "config.h"
+#include "ldns/packet.h"
 #include "iterator/iter_resptype.h"
 #include "iterator/iter_delegpt.h"
 #include "services/cache/dns.h"
@@ -105,7 +106,6 @@ response_type_from_server(int rdset,
 {
 	uint8_t* origzone = (uint8_t*)"\000"; /* the default */
 	struct ub_packed_rrset_key* s;
-	size_t origzonelen = 1;
 	size_t i;
 
 	if(!msg || !request)
@@ -129,7 +129,6 @@ response_type_from_server(int rdset,
 
 	if(dp) {
 		origzone = dp->name;
-		origzonelen = dp->namelen;
 	}
 
 	/* First we look at the answer section. This can tell us if this is a

iterator/iter_scrub.c

@@ -446,6 +446,12 @@ scrub_normalize(ldns_buffer* pkt, struct msg_parse* msg,
 		}
 		/* only one NS set allowed in authority section */
 		if(rrset->type==LDNS_RR_TYPE_NS) {
+			/* NS set must be pertinent to the query */
+			if(!sub_of_pkt(pkt, qinfo->qname, rrset->dname)) {
+				remove_rrset("normalize: removing irrelevant "
+					"RRset:", pkt, msg, prev, &rrset);
+				continue;
+			}
 			if(nsset == NULL) {
 				nsset = rrset;
 			} else {
@@ -555,7 +561,7 @@ static int sanitize_nsec_is_overreach(struct rrset_parse* rrset,
 	for(rr = rrset->rr_first; rr; rr = rr->next) {
 		rhs = rr->ttl_data+4+2;
 		len = ldns_read_uint16(rr->ttl_data+4);
-		if(!(len=dname_valid(rhs, len))) {
+		if(!dname_valid(rhs, len)) {
 			/* malformed domain name in rdata */
 			return 1;
 		}
@@ -711,6 +717,7 @@ scrub_message(ldns_buffer* pkt, struct msg_parse* msg,
 		return 0;
 	if( !(msg->flags&BIT_QR) )
 		return 0;
+	msg->flags &= ~(BIT_AD|BIT_Z); /* force off bit AD and Z */
 	
 	/* make sure that a query is echoed back when NOERROR or NXDOMAIN */
 	/* this is not required for basic operation but is a forgery 

iterator/iter_scrub.h

@@ -42,6 +42,7 @@
 
 #ifndef ITERATOR_ITER_SCRUB_H
 #define ITERATOR_ITER_SCRUB_H
+#include "ldns/buffer.h"
 struct msg_parse;
 struct query_info;
 struct regional;

iterator/iter_utils.c

@@ -60,11 +60,13 @@
 #include "util/random.h"
 #include "util/fptr_wlist.h"
 #include "validator/val_anchor.h"
+#include "validator/val_kcache.h"
+#include "validator/val_kentry.h"
 
 /** time when nameserver glue is said to be 'recent' */
 #define SUSPICION_RECENT_EXPIRY 86400
 /** penalty to validation failed blacklisted IPs */
-#define BLACKLIST_PENALTY (USEFUL_SERVER_TOP_TIMEOUT*3)
+#define BLACKLIST_PENALTY (USEFUL_SERVER_TOP_TIMEOUT*4)
 
 /** fillup fetch policy array */
 static void
@@ -158,15 +160,17 @@ iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg)
  *		This value exactly is given for unresponsive blacklisted.
  *	USEFUL_SERVER_TOP_TIMEOUT+1
  *		For non-blacklisted servers: huge timeout, but has traffic.
- *	USEFUL_SERVER_TOP_TIMEOUT ..
- *		dnsseclame servers get penalty
- *		also for parent-side lame servers (lame in delegpt).
+ *	USEFUL_SERVER_TOP_TIMEOUT*1 ..
+ *		parent-side lame servers get this penalty. A dispreferential
+ *		server. (lame in delegpt).
  *	USEFUL_SERVER_TOP_TIMEOUT*2 ..
+ *		dnsseclame servers get penalty
+ *	USEFUL_SERVER_TOP_TIMEOUT*3 ..
  *		recursion lame servers get penalty
  *	UNKNOWN_SERVER_NICENESS 
  *		If no information is known about the server, this is
  *		returned. 376 msec or so.
- *	+BLACKLIST_PENALTY (of USEFUL_TOP_TIMEOUT*3) for dnssec failed IPs.
+ *	+BLACKLIST_PENALTY (of USEFUL_TOP_TIMEOUT*4) for dnssec failed IPs.
  *
  * When a final value is chosen that is dnsseclame ; dnsseclameness checking
  * is turned off (so we do not discard the reply).
@@ -204,19 +208,20 @@ iter_filter_unsuitable(struct iter_env* iter_env, struct module_env* env,
 			lost >= USEFUL_SERVER_MAX_LOST)
 			/* server is unresponsive, but keep trying slowly */
 			return USEFUL_SERVER_TOP_TIMEOUT+1;
+		/* select remainder from worst to best */
+		else if(reclame)
+			return rtt+USEFUL_SERVER_TOP_TIMEOUT*3; /* nonpref */
+		else if(dnsseclame )
+			return rtt+USEFUL_SERVER_TOP_TIMEOUT*2; /* nonpref */
 		else if(a->lame)
 			return rtt+USEFUL_SERVER_TOP_TIMEOUT+1; /* nonpref */
 		else if(rtt >= USEFUL_SERVER_TOP_TIMEOUT) /* not blacklisted*/
-			return USEFUL_SERVER_TOP_TIMEOUT+1; 
-		else if(reclame)
-			return rtt+USEFUL_SERVER_TOP_TIMEOUT*2; /* nonpref */
-		else if(dnsseclame )
-			return rtt+USEFUL_SERVER_TOP_TIMEOUT; /* nonpref */
+			return USEFUL_SERVER_TOP_TIMEOUT+1;
 		else	return rtt;
 	}
 	/* no server information present */
 	if(a->lame)
-		return USEFUL_SERVER_TOP_TIMEOUT+1; /* nonpref */
+		return USEFUL_SERVER_TOP_TIMEOUT+1+UNKNOWN_SERVER_NICENESS; /* nonpref */
 	return UNKNOWN_SERVER_NICENESS;
 }
 
@@ -308,7 +313,7 @@ iter_filter_order(struct iter_env* iter_env, struct module_env* env,
 struct delegpt_addr* 
 iter_server_selection(struct iter_env* iter_env, 
 	struct module_env* env, struct delegpt* dp, 
-	uint8_t* name, size_t namelen, uint16_t qtype, int* dnssec_expected,
+	uint8_t* name, size_t namelen, uint16_t qtype, int* dnssec_lame,
 	int* chase_to_rd, int open_target, struct sock_list* blacklist)
 {
 	int sel;
@@ -321,18 +326,24 @@ iter_server_selection(struct iter_env* iter_env,
 		return NULL;
 	verbose(VERB_ALGO, "selrtt %d", selrtt);
 	if(selrtt > BLACKLIST_PENALTY) {
-		if(selrtt-BLACKLIST_PENALTY > USEFUL_SERVER_TOP_TIMEOUT*2) {
-			verbose(VERB_ALGO, "chase to recursion lame server");
+		if(selrtt-BLACKLIST_PENALTY > USEFUL_SERVER_TOP_TIMEOUT*3) {
+			verbose(VERB_ALGO, "chase to "
+				"blacklisted recursion lame server");
 			*chase_to_rd = 1;
 		}
+		if(selrtt-BLACKLIST_PENALTY > USEFUL_SERVER_TOP_TIMEOUT*2) {
+			verbose(VERB_ALGO, "chase to "
+				"blacklisted dnssec lame server");
+			*dnssec_lame = 1;
+		}
 	} else {
-		if(selrtt > USEFUL_SERVER_TOP_TIMEOUT*2) {
+		if(selrtt > USEFUL_SERVER_TOP_TIMEOUT*3) {
 			verbose(VERB_ALGO, "chase to recursion lame server");
 			*chase_to_rd = 1;
 		}
-		if(selrtt > USEFUL_SERVER_TOP_TIMEOUT) {
+		if(selrtt > USEFUL_SERVER_TOP_TIMEOUT*2) {
 			verbose(VERB_ALGO, "chase to dnssec lame server");
-			*dnssec_expected = 0;
+			*dnssec_lame = 1;
 		}
 		if(selrtt == USEFUL_SERVER_TOP_TIMEOUT) {
 			verbose(VERB_ALGO, "chase to blacklisted lame server");
@@ -350,9 +361,9 @@ iter_server_selection(struct iter_env* iter_env,
 
 	/* randomly select a target from the list */
 	log_assert(num > 1);
-	/* we do not need secure random numbers here, but
-	 * we do need it to be threadsafe, so we use this */
-	sel = ub_random(env->rnd) % num; 
+	/* grab secure random number, to pick unexpected server.
+	 * also we need it to be threadsafe. */
+	sel = ub_random_max(env->rnd, num); 
 	a = dp->result_list;
 	prev = NULL;
 	while(sel > 0 && a) {
@@ -418,58 +429,10 @@ iter_ns_probability(struct ub_randstate* rnd, int n, int m)
 		return 1;
 	/* we do not need secure random numbers here, but
 	 * we do need it to be threadsafe, so we use this */
-	sel = ub_random(rnd) % m; 
+	sel = ub_random_max(rnd, m); 
 	return (sel < n);
 }
 
-int iter_suspect_exists(struct query_info* qinfo, struct delegpt* dp,
-        struct module_env* env)
-{
-	struct ub_packed_rrset_key* r;
-	if(qinfo->qtype != LDNS_RR_TYPE_A && qinfo->qtype != LDNS_RR_TYPE_AAAA)
-		return 0; /* not glue type */
-	if(!dname_subdomain_c(qinfo->qname, dp->name))
-		return 0; /* not in-zone */
-	if(!delegpt_find_ns(dp, qinfo->qname, qinfo->qname_len))
-		return 0; /* not glue */
-
-	/* do we suspect that it exists? lookup with time=0 */
-	r = rrset_cache_lookup(env->rrset_cache, qinfo->qname, 
-		qinfo->qname_len, qinfo->qtype, qinfo->qclass, 0, 0, 0);
-	if(r) {
-		struct packed_rrset_data* d = (struct packed_rrset_data*)
-			r->entry.data;
-		/* if it is valid, no need for queries to parent zone */
-		if(*env->now <= d->ttl) {
-			lock_rw_unlock(&r->entry.lock);
-			return 0;
-		}
-		/* was it recently expired? */
-		if( (*env->now - d->ttl) <= SUSPICION_RECENT_EXPIRY) {
-			verbose(VERB_ALGO, "suspect glue at parent: "
-				"rrset recently expired");
-			lock_rw_unlock(&r->entry.lock);
-			return 1;
-		}
-		lock_rw_unlock(&r->entry.lock);
-	}
-
-	/* so, qinfo not there, does the other A/AAAA type exist in cache? */
-	r=rrset_cache_lookup(env->rrset_cache, qinfo->qname, qinfo->qname_len,
-	  (qinfo->qtype==LDNS_RR_TYPE_A)?LDNS_RR_TYPE_AAAA:LDNS_RR_TYPE_A,
-	  qinfo->qclass, 0, *env->now, 0);
-	if(r) {
-		/* it exists and explains why the glue is there */
-		lock_rw_unlock(&r->entry.lock);
-		return 0;
-	}
-
-	/* neither exist, so logically, one should exist for a nameserver */
-	verbose(VERB_ALGO, "suspect glue at parent: "
-		"neither A nor AAAA exist in cache");
-	return 1;
-}
-
 /** detect dependency cycle for query and target */
 static int
 causes_cycle(struct module_qstate* qstate, uint8_t* name, size_t namelen,
@@ -508,17 +471,42 @@ iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
 	}
 }
 
+void 
+iter_mark_pside_cycle_targets(struct module_qstate* qstate, struct delegpt* dp)
+{
+	struct delegpt_ns* ns;
+	for(ns = dp->nslist; ns; ns = ns->next) {
+		if(ns->done_pside4 && ns->done_pside6)
+			continue;
+		/* see if this ns as target causes dependency cycle */
+		if(causes_cycle(qstate, ns->name, ns->namelen, 
+			LDNS_RR_TYPE_A, qstate->qinfo.qclass)) {
+			log_nametypeclass(VERB_QUERY, "skipping target due "
+			 	"to dependency cycle", ns->name,
+				LDNS_RR_TYPE_A, qstate->qinfo.qclass);
+			ns->done_pside4 = 1;
+		}
+		if(causes_cycle(qstate, ns->name, ns->namelen, 
+			LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass)) {
+			log_nametypeclass(VERB_QUERY, "skipping target due "
+			 	"to dependency cycle", ns->name,
+				LDNS_RR_TYPE_AAAA, qstate->qinfo.qclass);
+			ns->done_pside6 = 1;
+		}
+	}
+}
+
 int 
 iter_dp_is_useless(struct query_info* qinfo, uint16_t qflags, 
 	struct delegpt* dp)
 {
 	struct delegpt_ns* ns;
 	/* check:
-	 *      o RD qflag is off.
+	 *      o RD qflag is on.
 	 *      o no addresses are provided.
 	 *      o all NS items are required glue.
 	 * OR
-	 *      o RD qflag is off.
+	 *      o RD qflag is on.
 	 *      o no addresses are provided.
 	 *      o the query is for one of the nameservers in dp,
 	 *        and that nameserver is a glue-name for this dp.
@@ -564,6 +552,23 @@ iter_indicates_dnssec(struct module_env* env, struct delegpt* dp,
 		reply_find_rrset_section_ns(msg->rep, dp->name, dp->namelen,
 		LDNS_RR_TYPE_DS, dclass))
 		return 1;
+	/* look in key cache */
+	if(env->key_cache) {
+		struct key_entry_key* kk = key_cache_obtain(env->key_cache,
+			dp->name, dp->namelen, dclass, env->scratch, *env->now);
+		if(kk) {
+			if(query_dname_compare(kk->name, dp->name) == 0) {
+			  if(key_entry_isgood(kk) || key_entry_isbad(kk)) {
+				regional_free_all(env->scratch);
+				return 1;
+			  } else if(key_entry_isnull(kk)) {
+				regional_free_all(env->scratch);
+				return 0;
+			  }
+			}
+			regional_free_all(env->scratch);
+		}
+	}
 	return 0;
 }
 
@@ -668,7 +673,7 @@ rrset_equal(struct ub_packed_rrset_key* k1, struct ub_packed_rrset_key* k2)
 }
 
 int 
-reply_equal(struct reply_info* p, struct reply_info* q)
+reply_equal(struct reply_info* p, struct reply_info* q, ldns_buffer* scratch)
 {
 	size_t i;
 	if(p->flags != q->flags ||
@@ -682,63 +687,190 @@ reply_equal(struct reply_info* p, struct reply_info* q)
 		p->rrset_count != q->rrset_count)
 		return 0;
 	for(i=0; i<p->rrset_count; i++) {
-		if(!rrset_equal(p->rrsets[i], q->rrsets[i]))
-			return 0;
+		if(!rrset_equal(p->rrsets[i], q->rrsets[i])) {
+			/* fallback procedure: try to sort and canonicalize */
+			ldns_rr_list* pl, *ql;
+			pl = packed_rrset_to_rr_list(p->rrsets[i], scratch);
+			ql = packed_rrset_to_rr_list(q->rrsets[i], scratch);
+			if(!pl || !ql) {
+				ldns_rr_list_deep_free(pl);
+				ldns_rr_list_deep_free(ql);
+				return 0;
+			}
+			ldns_rr_list2canonical(pl);
+			ldns_rr_list2canonical(ql);
+			ldns_rr_list_sort(pl);
+			ldns_rr_list_sort(ql);
+			if(ldns_rr_list_compare(pl, ql) != 0) {
+				ldns_rr_list_deep_free(pl);
+				ldns_rr_list_deep_free(ql);
+				return 0;
+			}
+			ldns_rr_list_deep_free(pl);
+			ldns_rr_list_deep_free(ql);
+			continue;
+		}
 	}
 	return 1;
 }
 
 void 
-iter_store_inzone_glue(struct module_env* env, struct query_info* qinfo,
-	struct reply_info* rep)
+iter_store_parentside_rrset(struct module_env* env, 
+	struct ub_packed_rrset_key* rrset)
 {
 	struct rrset_ref ref;
-	struct ub_packed_rrset_key* rrset;
-	if(qinfo->qtype != LDNS_RR_TYPE_A && qinfo->qtype != LDNS_RR_TYPE_AAAA)
-		return;
-	rrset = reply_find_rrset(rep, qinfo->qname, qinfo->qname_len,
-		qinfo->qtype, qinfo->qclass);
-	if(!rrset)
-		return;
-	/* got A or AAAA glue rrset. store it in case its handy */
 	rrset = packed_rrset_copy_alloc(rrset, env->alloc, *env->now);
 	if(!rrset) {
-		log_err("malloc failure in store_inzone_glue");
+		log_err("malloc failure in store_parentside_rrset");
 		return;
 	}
 	rrset->rk.flags |= PACKED_RRSET_PARENT_SIDE;
 	rrset->entry.hash = rrset_key_hash(&rrset->rk);
 	ref.key = rrset;
 	ref.id = rrset->id;
-	/* ignore ret: it was in the cache, ref updated */
+	/* ignore ret: if it was in the cache, ref updated */
 	(void)rrset_cache_update(env->rrset_cache, &ref, env->alloc, *env->now);
 }
 
+/** fetch NS record from reply, if any */
+static struct ub_packed_rrset_key*
+reply_get_NS_rrset(struct reply_info* rep)
+{
+	size_t i;
+	for(i=0; i<rep->rrset_count; i++) {
+		if(rep->rrsets[i]->rk.type == htons(LDNS_RR_TYPE_NS)) {
+			return rep->rrsets[i];
+		}
+	}
+	return NULL;
+}
+
+void
+iter_store_parentside_NS(struct module_env* env, struct reply_info* rep)
+{
+	struct ub_packed_rrset_key* rrset = reply_get_NS_rrset(rep);
+	if(rrset) {
+		log_rrset_key(VERB_ALGO, "store parent-side NS", rrset);
+		iter_store_parentside_rrset(env, rrset);
+	}
+}
+
+void iter_store_parentside_neg(struct module_env* env, 
+        struct query_info* qinfo, struct reply_info* rep)
+{
+	/* TTL: NS from referral in iq->deleg_msg,
+	 *      or first RR from iq->response,
+	 *      or servfail5secs if !iq->response */ 
+	uint32_t ttl = NORR_TTL;
+	struct ub_packed_rrset_key* neg;
+	struct packed_rrset_data* newd;
+	if(rep) {
+		struct ub_packed_rrset_key* rrset = reply_get_NS_rrset(rep);
+		if(!rrset && rep->rrset_count != 0) rrset = rep->rrsets[0];
+		if(rrset) ttl = ub_packed_rrset_ttl(rrset);
+	}
+	/* create empty rrset to store */
+	neg = (struct ub_packed_rrset_key*)regional_alloc(env->scratch,
+	                sizeof(struct ub_packed_rrset_key));
+	if(!neg) {
+		log_err("out of memory in store_parentside_neg");
+		return;
+	}
+	memset(&neg->entry, 0, sizeof(neg->entry));
+	neg->entry.key = neg;
+	neg->rk.type = htons(qinfo->qtype);
+	neg->rk.rrset_class = htons(qinfo->qclass);
+	neg->rk.flags = 0;
+	neg->rk.dname = regional_alloc_init(env->scratch, qinfo->qname, 
+		qinfo->qname_len);
+	if(!neg->rk.dname) {
+		log_err("out of memory in store_parentside_neg");
+		return;
+	}
+	neg->rk.dname_len = qinfo->qname_len;
+	neg->entry.hash = rrset_key_hash(&neg->rk);
+	newd = (struct packed_rrset_data*)regional_alloc_zero(env->scratch, 
+		sizeof(struct packed_rrset_data) + sizeof(size_t) +
+		sizeof(uint8_t*) + sizeof(uint32_t) + sizeof(uint16_t));
+	if(!newd) {
+		log_err("out of memory in store_parentside_neg");
+		return;
+	}
+	neg->entry.data = newd;
+	newd->ttl = ttl;
+	/* entry must have one RR, otherwise not valid in cache.
+	 * put in one RR with empty rdata: those are ignored as nameserver */
+	newd->count = 1;
+	newd->rrsig_count = 0;
+	newd->trust = rrset_trust_ans_noAA;
+	newd->rr_len = (size_t*)((uint8_t*)newd +
+		sizeof(struct packed_rrset_data));
+	newd->rr_len[0] = 0 /* zero len rdata */ + sizeof(uint16_t);
+	packed_rrset_ptr_fixup(newd);
+	newd->rr_ttl[0] = newd->ttl;
+	ldns_write_uint16(newd->rr_data[0], 0 /* zero len rdata */);
+	/* store it */
+	log_rrset_key(VERB_ALGO, "store parent-side negative", neg);
+	iter_store_parentside_rrset(env, neg);
+}
+
 int 
-iter_lookup_inzone_glue(struct module_env* env, struct delegpt* dp,
+iter_lookup_parent_NS_from_cache(struct module_env* env, struct delegpt* dp,
 	struct regional* region, struct query_info* qinfo)
 {
 	struct ub_packed_rrset_key* akey;
-	akey = rrset_cache_lookup(env->rrset_cache, qinfo->qname, 
-		qinfo->qname_len, qinfo->qtype, qinfo->qclass, 
+	akey = rrset_cache_lookup(env->rrset_cache, dp->name, 
+		dp->namelen, LDNS_RR_TYPE_NS, qinfo->qclass, 
 		PACKED_RRSET_PARENT_SIDE, *env->now, 0);
 	if(akey) {
-		if(qinfo->qtype == LDNS_RR_TYPE_A) {
-			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1)) {
-				lock_rw_unlock(&akey->entry.lock);
-				return 0;
-			}
-		} else if(qinfo->qtype == LDNS_RR_TYPE_AAAA) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1)) {
-				lock_rw_unlock(&akey->entry.lock);
-				return 0;
-			}
+		log_rrset_key(VERB_ALGO, "found parent-side NS in cache", akey);
+		dp->has_parent_side_NS = 1;
+		/* and mark the new names as lame */
+		if(!delegpt_rrset_add_ns(dp, region, akey, 1)) {
+			lock_rw_unlock(&akey->entry.lock);
+			return 0;
 		}
 		lock_rw_unlock(&akey->entry.lock);
 	}
 	return 1;
 }
 
+int iter_lookup_parent_glue_from_cache(struct module_env* env,
+        struct delegpt* dp, struct regional* region, struct query_info* qinfo)
+{
+	struct ub_packed_rrset_key* akey;
+	struct delegpt_ns* ns;
+	size_t num = delegpt_count_targets(dp);
+	for(ns = dp->nslist; ns; ns = ns->next) {
+		/* get cached parentside A */
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+			ns->namelen, LDNS_RR_TYPE_A, qinfo->qclass, 
+			PACKED_RRSET_PARENT_SIDE, *env->now, 0);
+		if(akey) {
+			log_rrset_key(VERB_ALGO, "found parent-side", akey);
+			ns->done_pside4 = 1;
+			/* a negative-cache-element has no addresses it adds */
+			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1))
+				log_err("malloc failure in lookup_parent_glue");
+			lock_rw_unlock(&akey->entry.lock);
+		}
+		/* get cached parentside AAAA */
+		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
+			ns->namelen, LDNS_RR_TYPE_AAAA, qinfo->qclass, 
+			PACKED_RRSET_PARENT_SIDE, *env->now, 0);
+		if(akey) {
+			log_rrset_key(VERB_ALGO, "found parent-side", akey);
+			ns->done_pside6 = 1;
+			/* a negative-cache-element has no addresses it adds */
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1))
+				log_err("malloc failure in lookup_parent_glue");
+			lock_rw_unlock(&akey->entry.lock);
+		}
+	}
+	/* see if new (but lame) addresses have become available */
+	return delegpt_count_targets(dp) != num;
+}
+
 int 
 iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd, 
 	uint16_t* c)
@@ -786,3 +918,48 @@ iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns, uint8_t* z)
 		i++;
 	}
 }
+
+void iter_dec_attempts(struct delegpt* dp, int d)
+{
+	struct delegpt_addr* a;
+	for(a=dp->target_list; a; a = a->next_target) {
+		if(a->attempts >= OUTBOUND_MSG_RETRY) {
+			/* add back to result list */
+			a->next_result = dp->result_list;
+			dp->result_list = a;
+		}
+		if(a->attempts > d)
+			a->attempts -= d;
+		else a->attempts = 0;
+	}
+}
+
+void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old)
+{
+	struct delegpt_addr* a, *o, *prev;
+	for(a=dp->target_list; a; a = a->next_target) {
+		o = delegpt_find_addr(old, &a->addr, a->addrlen);
+		if(o) {
+			log_addr(VERB_ALGO, "copy attempt count previous dp",
+				&a->addr, a->addrlen);
+			a->attempts = o->attempts;
+		}
+	}
+	prev = NULL;
+	a = dp->usable_list;
+	while(a) {
+		if(a->attempts >= OUTBOUND_MSG_RETRY) {
+			log_addr(VERB_ALGO, "remove from usable list dp",
+				&a->addr, a->addrlen);
+			/* remove from result list */
+			if(prev)
+				prev->next_usable = a->next_usable;
+			else	dp->usable_list = a->next_usable;
+			/* prev stays the same */
+			a = a->next_usable;
+			continue;
+		}
+		prev = a;
+		a = a->next_usable;
+	}
+}

iterator/iter_utils.h

@@ -43,6 +43,7 @@
 #ifndef ITERATOR_ITER_UTILS_H
 #define ITERATOR_ITER_UTILS_H
 #include "iterator/iter_resptype.h"
+#include "ldns/buffer.h"
 struct iter_env;
 struct iter_hints;
 struct iter_forwards;
@@ -79,7 +80,7 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
  * @param name: zone name (for lameness check).
  * @param namelen: length of name.
  * @param qtype: query type that we want to send.
- * @param dnssec_expected: set to 0, if a known dnssec-lame server is selected
+ * @param dnssec_lame: set to 1, if a known dnssec-lame server is selected
  *	these are not preferred, but are used as a last resort.
  * @param chase_to_rd: set to 1 if a known recursion lame server is selected
  * 	these are not preferred, but are used as a last resort.
@@ -91,7 +92,7 @@ int iter_apply_cfg(struct iter_env* iter_env, struct config_file* cfg);
  */
 struct delegpt_addr* iter_server_selection(struct iter_env* iter_env, 
 	struct module_env* env, struct delegpt* dp, uint8_t* name, 
-	size_t namelen, uint16_t qtype, int* dnssec_expected,
+	size_t namelen, uint16_t qtype, int* dnssec_lame,
 	int* chase_to_rd, int open_target, struct sock_list* blacklist);
 
 /**
@@ -144,17 +145,13 @@ int iter_ns_probability(struct ub_randstate* rnd, int n, int m);
 void iter_mark_cycle_targets(struct module_qstate* qstate, struct delegpt* dp);
 
 /**
- * See if query is in-zone glue and we suspect that it exists.
- * Suspicion that it exists, is if there is no A or AAAA in cache (since
- * one of them is expected for an NS record) or the qtype is in cache but
- * was recently expired (so we have seen this data recently).
- * @param qinfo: query info.
- * @param dp: delegation point we are at.
- * @param env: environment with rrset cache.
- * @return true if suspect that this glue exists.
+ * Mark targets that result in a dependency cycle as done, so they
+ * will not get selected as targets.  For the parent-side lookups.
+ * @param qstate: query state.
+ * @param dp: delegpt to mark ns in.
  */
-int iter_suspect_exists(struct query_info* qinfo, struct delegpt* dp,
-	struct module_env* env);
+void iter_mark_pside_cycle_targets(struct module_qstate* qstate,
+	struct delegpt* dp);
 
 /**
  * See if delegation is useful or offers immediately no targets for 
@@ -210,31 +207,69 @@ int iter_msg_from_zone(struct dns_msg* msg, struct delegpt* dp,
  * @param p: reply one. The reply has rrset data pointers in region.
  * 	Does not check rrset-IDs
  * @param q: reply two
+ * @param buf: scratch buffer.
  * @return if one and two are equal.
  */
-int reply_equal(struct reply_info* p, struct reply_info* q);
+int reply_equal(struct reply_info* p, struct reply_info* q, ldns_buffer* buf);
 
 /**
- * Store in-zone glue in seperate rrset cache entries for later last-resort
- * lookups in case the child-side versions of this information fails.
+ * Store parent-side rrset in seperate rrset cache entries for later 
+ * last-resort * lookups in case the child-side versions of this information 
+ * fails.
  * @param env: environment with cache, time, ...
- * @param qinfo: query info. must match the information stored to avoid
- * 	Kaminsky-style trouble.
- * @param rep: reply with possibly A or AAAA content to store.
+ * @param rrset: the rrset to store (copied).
+ * Failure to store is logged, but otherwise ignored.
  */
-void iter_store_inzone_glue(struct module_env* env, struct query_info* qinfo,
-	struct reply_info* rep);
+void iter_store_parentside_rrset(struct module_env* env, 
+	struct ub_packed_rrset_key* rrset);
 
 /**
- * Find in-zone glue from rrset cache again.
- * @param env: query env with rrset cache and time.
- * @param dp: delegation point to store result in.
- * @param region: region to alloc result in.
- * @param qinfo: query into that is pertinent.
- * @return false on malloc failure.
+ * Store parent-side NS records from a referral message
+ * @param env: environment with cache, time, ...
+ * @param rep: response with NS rrset.
+ * Failure to store is logged, but otherwise ignored.
  */
-int iter_lookup_inzone_glue(struct module_env* env, struct delegpt* dp,
-	struct regional* region, struct query_info* qinfo);
+void iter_store_parentside_NS(struct module_env* env, struct reply_info* rep);
+
+/**
+ * Store parent-side negative element, the parentside rrset does not exist,
+ * creates an rrset with empty rdata in the rrset cache with PARENTSIDE flag.
+ * @param env: environment with cache, time, ...
+ * @param qinfo: the identity of the rrset that is missing.
+ * @param rep: delegation response or answer response, to glean TTL from.
+ * (malloc) failure is logged but otherwise ignored.
+ */
+void iter_store_parentside_neg(struct module_env* env, 
+	struct query_info* qinfo, struct reply_info* rep);
+
+/**
+ * Add parent NS record if that exists in the cache.  This is both new
+ * information and acts like a timeout throttle on retries.
+ * @param env: query env with rrset cache and time.
+ * @param dp: delegation point to store result in.  Also this dp is used to
+ *	see which NS name is needed.
+ * @param region: region to alloc result in.
+ * @param qinfo: pertinent information, the qclass.
+ * @return false on malloc failure.
+ *	if true, the routine worked and if such cached information 
+ *	existed dp->has_parent_side_NS is set true.
+ */
+int iter_lookup_parent_NS_from_cache(struct module_env* env,
+	struct delegpt* dp, struct regional* region, struct query_info* qinfo);
+
+/**
+ * Add parent-side glue if that exists in the cache.  This is both new
+ * information and acts like a timeout throttle on retries to fetch them.
+ * @param env: query env with rrset cache and time.
+ * @param dp: delegation point to store result in.  Also this dp is used to
+ *	see which NS name is needed.
+ * @param region: region to alloc result in.
+ * @param qinfo: pertinent information, the qclass.
+ * @return: true, it worked, no malloc failures, and new addresses (lame)
+ *	have been added, giving extra options as query targets.
+ */
+int iter_lookup_parent_glue_from_cache(struct module_env* env,
+	struct delegpt* dp, struct regional* region, struct query_info* qinfo);
 
 /**
  * Lookup next root-hint or root-forward entry.
@@ -256,4 +291,19 @@ int iter_get_next_root(struct iter_hints* hints, struct iter_forwards* fwd,
 void iter_scrub_ds(struct dns_msg* msg, struct ub_packed_rrset_key* ns,
 	uint8_t* z);
 
+/**
+ * Remove query attempts from all available ips. For 0x20.
+ * @param dp: delegpt.
+ * @param d: decrease.
+ */
+void iter_dec_attempts(struct delegpt* dp, int d);
+
+/**
+ * Add retry counts from older delegpt to newer delegpt.
+ * Does not waste time on timeout'd (or other failing) addresses.
+ * @param dp: new delegationpoint.
+ * @param old: old delegationpoint.
+ */
+void iter_merge_retry_counts(struct delegpt* dp, struct delegpt* old);
+
 #endif /* ITERATOR_ITER_UTILS_H */

iterator/iterator.c

@@ -41,6 +41,7 @@
  */
 
 #include "config.h"
+#include "ldns/ldns.h"
 #include "iterator/iterator.h"
 #include "iterator/iter_utils.h"
 #include "iterator/iter_hints.h"
@@ -119,6 +120,7 @@ iter_new(struct module_qstate* qstate, int id)
 	iq->wait_priming_stub = 0;
 	iq->refetch_glue = 0;
 	iq->dnssec_expected = 0;
+	iq->dnssec_lame_query = 0;
 	iq->chase_flags = qstate->query_flags;
 	/* Start with the (current) qname. */
 	iq->qchase = qstate->qinfo;
@@ -495,13 +497,6 @@ generate_sub_request(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 	if(!v)
 		qflags |= BIT_CD;
 	
-	fptr_ok(fptr_whitelist_modenv_detect_cycle(
-		qstate->env->detect_cycle));
-	if((*qstate->env->detect_cycle)(qstate, &qinf, qflags, prime)){
-		log_query_info(VERB_DETAIL, "cycle detected", &qinf);
-		return 0;
-	}
-
 	/* attach subquery, lookup existing or make a new one */
 	fptr_ok(fptr_whitelist_modenv_attach_sub(qstate->env->attach_sub));
 	if(!(*qstate->env->attach_sub)(qstate, &qinf, qflags, prime, &subq)) {
@@ -694,12 +689,15 @@ static void
 generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq, 
 	int id)
 {
+	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
 	struct module_qstate* subq;
 	size_t i;
 	struct reply_info* rep = iq->response->rep;
 	struct ub_packed_rrset_key* s;
 	log_assert(iq->dp);
 
+	if(iq->depth == ie->max_dependency_depth)
+		return;
 	/* walk through additional, and check if in-zone,
 	 * only relevant A, AAAA are left after scrub anyway */
 	for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) {
@@ -745,9 +743,12 @@ generate_a_aaaa_check(struct module_qstate* qstate, struct iter_qstate* iq,
 static void
 generate_ns_check(struct module_qstate* qstate, struct iter_qstate* iq, int id)
 {
+	struct iter_env* ie = (struct iter_env*)qstate->env->modinfo[id];
 	struct module_qstate* subq;
 	log_assert(iq->dp);
 
+	if(iq->depth == ie->max_dependency_depth)
+		return;
 	/* is this query the same as the nscheck? */
 	if(qstate->qinfo.qtype == LDNS_RR_TYPE_NS &&
 		query_dname_compare(iq->dp->name, qstate->qinfo.qname)==0 &&
@@ -1202,6 +1203,58 @@ processInitRequest3(struct module_qstate* qstate, struct iter_qstate* iq,
 	return next_state(iq, QUERYTARGETS_STATE);
 }
 
+/**
+ * Given a basic query, generate a parent-side "target" query. 
+ * These are subordinate queries for missing delegation point target addresses,
+ * for which only the parent of the delegation provides correct IP addresses.
+ *
+ * @param qstate: query state.
+ * @param iq: iterator query state.
+ * @param id: module id.
+ * @param name: target qname.
+ * @param namelen: target qname length.
+ * @param qtype: target qtype (either A or AAAA).
+ * @param qclass: target qclass.
+ * @return true on success, false on failure.
+ */
+static int
+generate_parentside_target_query(struct module_qstate* qstate, 
+	struct iter_qstate* iq, int id, uint8_t* name, size_t namelen, 
+	uint16_t qtype, uint16_t qclass)
+{
+	struct module_qstate* subq;
+	if(!generate_sub_request(name, namelen, qtype, qclass, qstate, 
+		id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0))
+		return 0;
+	if(subq) {
+		struct iter_qstate* subiq = 
+			(struct iter_qstate*)subq->minfo[id];
+		/* blacklist the cache - we want to fetch parent stuff */
+		sock_list_insert(&subq->blacklist, NULL, 0, subq->region);
+		subiq->query_for_pside_glue = 1;
+		if(dname_subdomain_c(name, iq->dp->name)) {
+			subiq->dp = delegpt_copy(iq->dp, subq->region);
+			subiq->dnssec_expected = iter_indicates_dnssec(
+				qstate->env, subiq->dp, NULL, 
+				subq->qinfo.qclass);
+			subiq->refetch_glue = 1;
+		} else {
+			subiq->dp = dns_cache_find_delegation(qstate->env, 
+				name, namelen, qtype, qclass, subq->region,
+				&subiq->deleg_msg, *qstate->env->now); 
+			/* if no dp, then it's from root, refetch unneeded */
+			if(subiq->dp) { 
+				subiq->dnssec_expected = iter_indicates_dnssec(
+					qstate->env, subiq->dp, NULL, 
+					subq->qinfo.qclass);
+				subiq->refetch_glue = 1;
+			}
+		}
+	}
+	log_nametypeclass(VERB_QUERY, "new pside target", name, qtype, qclass);
+	return 1;
+}
+
 /**
  * Given a basic query, generate a "target" query. These are subordinate
  * queries for missing delegation point target addresses.
@@ -1223,18 +1276,6 @@ generate_target_query(struct module_qstate* qstate, struct iter_qstate* iq,
 	if(!generate_sub_request(name, namelen, qtype, qclass, qstate, 
 		id, iq, INIT_REQUEST_STATE, FINISHED_STATE, &subq, 0))
 		return 0;
-	if(subq) {
-		struct iter_qstate* subiq = 
-			(struct iter_qstate*)subq->minfo[id];
-		if(dname_subdomain_c(name, iq->dp->name)) {
-			verbose(VERB_ALGO, "refetch of target glue");
-			subiq->refetch_glue = 1;
-			subiq->dp = delegpt_copy(iq->dp, subq->region);
-			subiq->dnssec_expected = iter_indicates_dnssec(
-				qstate->env, subiq->dp, NULL, 
-				subq->qinfo.qclass);
-		}
-	}
 	log_nametypeclass(VERB_QUERY, "new target", name, qtype, qclass);
 	return 1;
 }
@@ -1258,7 +1299,7 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
         struct iter_env* ie, int id, int maxtargets, int* num)
 {
 	int query_count = 0;
-	struct delegpt_ns* ns = iq->dp->nslist;
+	struct delegpt_ns* ns;
 	int missing;
 	int toget = 0;
 
@@ -1296,16 +1337,24 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 			/* Send the AAAA request. */
 			if(!generate_target_query(qstate, iq, id, 
 				ns->name, ns->namelen,
-				LDNS_RR_TYPE_AAAA, iq->qchase.qclass))
+				LDNS_RR_TYPE_AAAA, iq->qchase.qclass)) {
+				*num = query_count;
+				if(query_count > 0)
+					qstate->ext_state[id] = module_wait_subquery;
 				return 0;
+			}
 			query_count++;
 		}
 		/* Send the A request. */
 		if(!ns->got4) {
 			if(!generate_target_query(qstate, iq, id, 
 				ns->name, ns->namelen, 
-				LDNS_RR_TYPE_A, iq->qchase.qclass))
+				LDNS_RR_TYPE_A, iq->qchase.qclass)) {
+				*num = query_count;
+				if(query_count > 0)
+					qstate->ext_state[id] = module_wait_subquery;
 				return 0;
+			}
 			query_count++;
 		}
 
@@ -1323,6 +1372,117 @@ query_for_targets(struct module_qstate* qstate, struct iter_qstate* iq,
 	return 1;
 }
 
+/**
+ * Called by processQueryTargets when it would like extra targets to query
+ * but it seems to be out of options.  At last resort some less appealing
+ * options are explored.  If there are no more options, the result is SERVFAIL
+ *
+ * @param qstate: query state.
+ * @param iq: iterator query state.
+ * @param ie: iterator shared global environment.
+ * @param id: module id.
+ * @return true if the event requires more request processing immediately,
+ *         false if not. 
+ */
+static int
+processLastResort(struct module_qstate* qstate, struct iter_qstate* iq,
+	struct iter_env* ie, int id)
+{
+	struct delegpt_ns* ns;
+	int query_count = 0;
+	verbose(VERB_ALGO, "No more query targets, attempting last resort");
+	log_assert(iq->dp);
+
+	if(!iq->dp->has_parent_side_NS) {
+		if(!iter_lookup_parent_NS_from_cache(qstate->env, iq->dp,
+			qstate->region, &qstate->qinfo) 
+			|| !iq->dp->has_parent_side_NS) {
+			/* if: malloc failure in lookup go up to try */
+			/* if: no parent NS in cache - go up one level */
+			verbose(VERB_ALGO, "try to grab parent NS");
+			iq->store_parent_NS = 1;
+			iq->parent_NS_old_dp = iq->dp;
+			iq->deleg_msg = NULL;
+			iq->refetch_glue = 1;
+			iq->query_restart_count++;
+			return next_state(iq, INIT_REQUEST_STATE);
+		}
+	}
+	/* see if that makes new names available */
+	if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 
+		qstate->region, iq->dp))
+		log_err("out of memory in cache_fill_missing");
+	if(iq->dp->usable_list) {
+		verbose(VERB_ALGO, "try parent-side-name, w. glue from cache");
+		return next_state(iq, QUERYTARGETS_STATE);
+	}
+	/* try to fill out parent glue from cache */
+	if(iter_lookup_parent_glue_from_cache(qstate->env, iq->dp,
+		qstate->region, &qstate->qinfo)) {
+		/* got parent stuff from cache, see if we can continue */
+		verbose(VERB_ALGO, "try parent-side glue from cache");
+		return next_state(iq, QUERYTARGETS_STATE);
+	}
+	/* query for an extra name added by the parent-NS record */
+	if(delegpt_count_missing_targets(iq->dp) > 0) {
+		int qs = 0;
+		verbose(VERB_ALGO, "try parent-side target name");
+		if(!query_for_targets(qstate, iq, ie, id, 1, &qs)) {
+			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+		}
+		iq->num_target_queries += qs;
+		if(qs != 0) {
+			qstate->ext_state[id] = module_wait_subquery;
+			return 0; /* and wait for them */
+		}
+	}
+	/* mark cycle targets for parent-side lookups */
+	iter_mark_pside_cycle_targets(qstate, iq->dp);
+	/* see if we can issue queries to get nameserver addresses */
+	/* this lookup is not randomized, but sequential. */
+	for(ns = iq->dp->nslist; ns; ns = ns->next) {
+		/* query for parent-side A and AAAA for nameservers */
+		if(ie->supports_ipv6 && !ns->done_pside6) {
+			/* Send the AAAA request. */
+			if(!generate_parentside_target_query(qstate, iq, id, 
+				ns->name, ns->namelen,
+				LDNS_RR_TYPE_AAAA, iq->qchase.qclass))
+				return error_response(qstate, id,
+					LDNS_RCODE_SERVFAIL);
+			ns->done_pside6 = 1;
+			query_count++;
+		}
+		if(!ns->done_pside4) {
+			/* Send the A request. */
+			if(!generate_parentside_target_query(qstate, iq, id, 
+				ns->name, ns->namelen, 
+				LDNS_RR_TYPE_A, iq->qchase.qclass))
+				return error_response(qstate, id,
+					LDNS_RCODE_SERVFAIL);
+			ns->done_pside4 = 1;
+			query_count++;
+		}
+		if(query_count != 0) { /* suspend to await results */
+			verbose(VERB_ALGO, "try parent-side glue lookup");
+			iq->num_target_queries += query_count;
+			qstate->ext_state[id] = module_wait_subquery;
+			return 0;
+		}
+	}
+
+	/* if this was a parent-side glue query itself, then store that
+	 * failure in cache. */
+	if(iq->query_for_pside_glue && !iq->pside_glue)
+		iter_store_parentside_neg(qstate->env, &qstate->qinfo,
+			iq->deleg_msg?iq->deleg_msg->rep:
+			(iq->response?iq->response->rep:NULL));
+
+	verbose(VERB_QUERY, "out of query targets -- returning SERVFAIL");
+	/* fail -- no more targets, no more hope of targets, no hope 
+	 * of a response. */
+	return error_response_cache(qstate, id, LDNS_RCODE_SERVFAIL);
+}
+
 /** 
  * This is the request event state where the request will be sent to one of
  * its current query targets. This state also handles issuing target lookup
@@ -1355,7 +1515,6 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	verbose(VERB_ALGO, "processQueryTargets: targetqueries %d, "
 		"currentqueries %d", iq->num_target_queries, 
 		iq->num_current_queries);
-	qstate->ext_state[id] = module_wait_reply;
 
 	/* Make sure that we haven't run away */
 	/* FIXME: is this check even necessary? */
@@ -1380,6 +1539,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * more delegpt addrs became available, wait for existing
 		 * query. */
 		verbose(VERB_ALGO, "woke up, but wait for outstanding query");
+		qstate->ext_state[id] = module_wait_reply;
 		return 0;
 	}
 
@@ -1402,6 +1562,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(iq->num_target_queries > 0) {
 			/* wait to get all targets, we want to try em */
 			verbose(VERB_ALGO, "wait for all targets for fallback");
+			qstate->ext_state[id] = module_wait_reply;
 			return 0;
 		}
 		/* did we do enough fallback queries already? */
@@ -1415,6 +1576,9 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 				"match for %d wanted, done.", 
 				(int)iq->caps_server+1, (int)naddr*3);
 			iq->caps_fallback = 0;
+			iter_dec_attempts(iq->dp, 3); /* space for fallback */
+			iq->num_current_queries++; /* RespState decrements it*/
+			iq->referral_count++; /* make sure we don't loop */
 			iq->state = QUERY_RESP_STATE;
 			return 1;
 		}
@@ -1441,8 +1605,8 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 	/* Select the next usable target, filtering out unsuitable targets. */
 	target = iter_server_selection(ie, qstate->env, iq->dp, 
 		iq->dp->name, iq->dp->namelen, iq->qchase.qtype,
-		&iq->dnssec_expected, &iq->chase_to_rd, iq->num_target_queries,
-		qstate->blacklist);
+		&iq->dnssec_lame_query, &iq->chase_to_rd, 
+		iq->num_target_queries, qstate->blacklist);
 
 	/* If no usable target was selected... */
 	if(!target) {
@@ -1468,59 +1632,61 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 					return error_response(qstate, id,
 						LDNS_RCODE_SERVFAIL);
 				}
+				if(qs == 0 && 
+				   delegpt_count_missing_targets(iq->dp) == 0){
+					/* it looked like there were missing
+					 * targets, but they did not turn up.
+					 * Try the bad choices again (if any),
+					 * when we get back here missing==0,
+					 * so this is not a loop. */
+					return 1;
+				}
 				iq->num_target_queries += qs;
 			}
 			/* Since a target query might have been made, we 
 			 * need to check again. */
 			if(iq->num_target_queries == 0) {
-				/* is it glue and we suspect that it exists?*/
-				if(iter_suspect_exists(&iq->qchase, iq->dp, 
-					qstate->env)) {
-					/* try at parent */
-					iq->deleg_msg = NULL;
-					iq->refetch_glue = 1;
-					iq->query_restart_count++;
-					return next_state(iq, 
-						INIT_REQUEST_STATE);
-				}
-
-				verbose(VERB_QUERY, "out of query targets -- "
-					"returning SERVFAIL");
-				/* fail -- no more targets, no more hope 
-				 * of targets, no hope of a response. */
-				return error_response_cache(qstate, id,
-					LDNS_RCODE_SERVFAIL);
+				return processLastResort(qstate, iq, ie, id);
 			}
 		}
 
 		/* otherwise, we have no current targets, so submerge 
 		 * until one of the target or direct queries return. */
-		if(iq->num_target_queries>0 && iq->num_current_queries>0)
+		if(iq->num_target_queries>0 && iq->num_current_queries>0) {
 			verbose(VERB_ALGO, "no current targets -- waiting "
 				"for %d targets to resolve or %d outstanding"
 				" queries to respond", iq->num_target_queries, 
 				iq->num_current_queries);
-		else if(iq->num_target_queries>0)
+			qstate->ext_state[id] = module_wait_reply;
+		} else if(iq->num_target_queries>0) {
 			verbose(VERB_ALGO, "no current targets -- waiting "
 				"for %d targets to resolve.",
 				iq->num_target_queries);
-		else 	verbose(VERB_ALGO, "no current targets -- waiting "
+			qstate->ext_state[id] = module_wait_subquery;
+		} else {
+			verbose(VERB_ALGO, "no current targets -- waiting "
 				"for %d outstanding queries to respond.",
 				iq->num_current_queries);
+			qstate->ext_state[id] = module_wait_reply;
+		}
 		return 0;
 	}
 
 	/* We have a valid target. */
-	if(iq->dnssec_expected) verbose(VERB_ALGO, "dnssec is expected");
-	log_query_info(VERB_QUERY, "sending query:", &iq->qchase);
-	log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, 
-		&target->addr, target->addrlen);
+	if(verbosity >= VERB_QUERY) {
+		log_query_info(VERB_QUERY, "sending query:", &iq->qchase);
+		log_name_addr(VERB_QUERY, "sending to target:", iq->dp->name, 
+			&target->addr, target->addrlen);
+		verbose(VERB_ALGO, "dnssec status: %s%s",
+			iq->dnssec_expected?"expected": "not expected",
+			iq->dnssec_lame_query?" but lame_query anyway": "");
+	}
 	fptr_ok(fptr_whitelist_modenv_send_query(qstate->env->send_query));
 	outq = (*qstate->env->send_query)(
 		iq->qchase.qname, iq->qchase.qname_len, 
 		iq->qchase.qtype, iq->qchase.qclass, 
 		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), EDNS_DO|BIT_CD, 
-		&target->addr, target->addrlen, qstate);
+		iq->dnssec_expected, &target->addr, target->addrlen, qstate);
 	if(!outq) {
 		log_addr(VERB_DETAIL, "error sending query to auth server", 
 			&target->addr, target->addrlen);
@@ -1568,6 +1734,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 	iq->num_current_queries--;
 	if(iq->response == NULL) {
 		iq->chase_to_rd = 0;
+		iq->dnssec_lame_query = 0;
 		verbose(VERB_ALGO, "query response was timeout");
 		return next_state(iq, QUERYTARGETS_STATE);
 	}
@@ -1580,7 +1747,8 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		 * differently. No queries should be sent elsewhere */
 		type = RESPONSE_TYPE_ANSWER;
 	}
-	if(iq->dnssec_expected && !(iq->chase_flags&BIT_RD) 
+	if(iq->dnssec_expected && !iq->dnssec_lame_query &&
+		!(iq->chase_flags&BIT_RD) 
 		&& type != RESPONSE_TYPE_LAME 
 		&& type != RESPONSE_TYPE_REC_LAME 
 		&& type != RESPONSE_TYPE_THROWAWAY 
@@ -1596,7 +1764,7 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 			type = RESPONSE_TYPE_LAME;
 			dnsseclame = 1;
 		}
-	}
+	} else iq->dnssec_lame_query = 0;
 	/* see if referral brings us close to the target */
 	if(type == RESPONSE_TYPE_REFERRAL) {
 		struct ub_packed_rrset_key* ns = find_NS(
@@ -1667,15 +1835,24 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 				iq->response->rep, 1, 0))
 				return error_response(qstate, id, 
 					LDNS_RCODE_SERVFAIL);
+			if(iq->store_parent_NS)
+				iter_store_parentside_NS(qstate->env, 
+					iq->response->rep);
 			if(qstate->env->neg_cache)
 				val_neg_addreferral(qstate->env->neg_cache, 
 					iq->response->rep, iq->dp->name);
 		}
 		/* store parent-side-in-zone-glue, if directly queried for */
-		if((qstate->qinfo.qtype == LDNS_RR_TYPE_A
-			|| qstate->qinfo.qtype == LDNS_RR_TYPE_AAAA)) {
-			iter_store_inzone_glue(qstate->env,
-				&iq->response->qinfo, iq->response->rep);
+		if(iq->query_for_pside_glue && !iq->pside_glue) {
+			iq->pside_glue = reply_find_rrset(iq->response->rep, 
+				iq->qchase.qname, iq->qchase.qname_len, 
+				iq->qchase.qtype, iq->qchase.qclass);
+			if(iq->pside_glue) {
+				log_rrset_key(VERB_ALGO, "found parent-side "
+					"glue", iq->pside_glue);
+				iter_store_parentside_rrset(qstate->env,
+					iq->pside_glue);
+			}
 		}
 
 		/* Reset the event state, setting the current delegation 
@@ -1687,6 +1864,9 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		if(!cache_fill_missing(qstate->env, iq->qchase.qclass, 
 			qstate->region, iq->dp))
 			return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
+		if(iq->store_parent_NS && query_dname_compare(iq->dp->name,
+			iq->parent_NS_old_dp->name) == 0)
+			iter_merge_retry_counts(iq->dp, iq->parent_NS_old_dp);
 		delegpt_log(VERB_ALGO, iq->dp);
 		/* Count this as a referral. */
 		iq->referral_count++;
@@ -1745,7 +1925,6 @@ processQueryResponse(struct module_qstate* qstate, struct iter_qstate* iq,
 		/* Clear the query state, since this is a query restart. */
 		iq->deleg_msg = NULL;
 		iq->dp = NULL;
-		iq->dnssec_expected = 0;
 		/* Note the query restart. */
 		iq->query_restart_count++;
 
@@ -1884,8 +2063,11 @@ static int
 processPrimeResponse(struct module_qstate* qstate, int id)
 {
 	struct iter_qstate* iq = (struct iter_qstate*)qstate->minfo[id];
-	enum response_type type = response_type_from_server(0, iq->response, 
-		&iq->qchase, iq->dp);
+	enum response_type type;
+	iq->response->rep->flags &= ~(BIT_RD|BIT_RA); /* ignore rec-lame */
+	type = response_type_from_server(
+		(int)((iq->chase_flags&BIT_RD) || iq->chase_to_rd), 
+		iq->response, &iq->qchase, iq->dp);
 	if(type == RESPONSE_TYPE_ANSWER) {
 		qstate->return_rcode = LDNS_RCODE_NOERROR;
 		qstate->return_msg = iq->response;
@@ -1963,10 +2145,17 @@ processTargetResponse(struct module_qstate* qstate, int id,
 	 * (regardless if it succeeded or not). */
 	foriq->num_target_queries--;
 
-	/* perhaps we picked up interested cached addressed, like lame ones */
-	if(!iter_lookup_inzone_glue(forq->env, foriq->dp, forq->region, 
-		&iq->qchase))
-		log_err("out of memory adding lame glue");
+	/* if iq->query_for_pside_glue then add the pside_glue (marked lame) */
+	if(iq->pside_glue) {
+		/* if the pside_glue is NULL, then it could not be found,
+		 * the done_pside is already set when created and a cache
+		 * entry created in processFinished so nothing to do here */
+		log_rrset_key(VERB_ALGO, "add parentside glue to dp", 
+			iq->pside_glue);
+		if(!delegpt_add_rrset(foriq->dp, forq->region, 
+			iq->pside_glue, 1))
+			log_err("out of memory adding pside glue");
+	}
 
 	/* This response is relevant to the current query, so we 
 	 * add (attempt to add, anyway) this target(s) and reactivate 
@@ -1979,11 +2168,14 @@ processTargetResponse(struct module_qstate* qstate, int id,
 		/* BTW. RFC 1918 says NS should not have got CNAMEs. Robust. */
 		if(!delegpt_find_ns(foriq->dp, rrset->rk.dname, 
 			rrset->rk.dname_len)) {
+			/* if dpns->lame then set newcname ns lame too */
 			if(!delegpt_add_ns(foriq->dp, forq->region, 
-				rrset->rk.dname))
+				rrset->rk.dname, (int)dpns->lame))
 				log_err("out of memory adding cnamed-ns");
 		}
-		if(!delegpt_add_rrset(foriq->dp, forq->region, rrset))
+		/* if dpns->lame then set the address(es) lame too */
+		if(!delegpt_add_rrset(foriq->dp, forq->region, rrset, 
+			(int)dpns->lame))
 			log_err("out of memory adding targets");
 		verbose(VERB_ALGO, "added target response");
 		delegpt_log(VERB_ALGO, foriq->dp);
@@ -2158,6 +2350,11 @@ processFinished(struct module_qstate* qstate, struct iter_qstate* iq,
 	log_query_info(VERB_QUERY, "finishing processing for", 
 		&qstate->qinfo);
 
+	/* store negative cache element for parent side glue. */
+	if(iq->query_for_pside_glue && !iq->pside_glue)
+		iter_store_parentside_neg(qstate->env, &qstate->qinfo,
+			iq->deleg_msg?iq->deleg_msg->rep:
+			(iq->response?iq->response->rep:NULL));
 	if(!iq->response) {
 		verbose(VERB_ALGO, "No response is set, servfail");
 		return error_response(qstate, id, LDNS_RCODE_SERVFAIL);
@@ -2217,7 +2414,7 @@ void
 iter_inform_super(struct module_qstate* qstate, int id, 
 	struct module_qstate* super)
 {
-	if(super->qinfo.qclass == LDNS_RR_CLASS_ANY)
+	if(!qstate->is_priming && super->qinfo.qclass == LDNS_RR_CLASS_ANY)
 		processClassResponse(qstate, id, super);
 	else if(qstate->return_rcode != LDNS_RCODE_NOERROR)
 		error_supers(qstate, id, super);
@@ -2374,7 +2571,8 @@ process_response(struct module_qstate* qstate, struct iter_qstate* iq,
 			goto handle_it;
 		} else {
 			/* check if reply is the same, otherwise, fail */
-			if(!reply_equal(iq->response->rep, iq->caps_reply)) {
+			if(!reply_equal(iq->response->rep, iq->caps_reply,
+				qstate->env->scratch_buffer)) {
 				verbose(VERB_DETAIL, "Capsforid fallback: "
 					"getting different replies, failed");
 				outbound_list_remove(&iq->outlist, outbound);

iterator/iterator.h

@@ -247,6 +247,26 @@ struct iter_qstate {
 	/** the number of times this query as followed a referral. */
 	int referral_count;
 
+	/**
+	 * The query must store NS records from referrals as parentside RRs
+	 * Enabled once it hits resolution problems, to throttle retries.
+	 */
+	int store_parent_NS;
+	/** the old delegation point with retry counts */
+	struct delegpt* parent_NS_old_dp;
+
+	/**
+	 * The query is for parent-side glue(A or AAAA) for a nameserver.
+	 * If the item is seen as glue in a referral, and pside_glue is NULL,
+	 * then it is stored in pside_glue for later.
+	 * If it was never seen, at the end, then a negative caching element 
+	 * must be created.  
+	 * The (data or negative) RR cache element then throttles retries.
+	 */
+	int query_for_pside_glue;
+	/** the parent-side-glue element (NULL if none, its first match) */
+	struct ub_packed_rrset_key* pside_glue;
+
 	/** 
 	 * expected dnssec information for this iteration step. 
 	 * If dnssec rrsigs are expected and not given, the server is marked
@@ -254,6 +274,12 @@ struct iter_qstate {
 	 */
 	int dnssec_expected;
 
+	/**
+	 * We are expecting dnssec information, but we also know the server
+	 * is DNSSEC lame.  The response need not be marked dnssec-lame again.
+	 */
+	int dnssec_lame_query;
+
 	/**
 	 * This is flag that, if true, means that this event is 
 	 * waiting for a stub priming query. 

libunbound/libunbound.c

@@ -44,6 +44,7 @@
 /* include the public api first, it should be able to stand alone */
 #include "libunbound/unbound.h"
 #include "config.h"
+#include <ctype.h>
 #include "libunbound/context.h"
 #include "libunbound/libworker.h"
 #include "util/locks.h"

libunbound/libworker.c

@@ -42,6 +42,8 @@
  * returns from the procedure when done.
  */
 #include "config.h"
+#include <ldns/dname.h>
+#include <ldns/wire2host.h>
 #include "libunbound/libworker.h"
 #include "libunbound/context.h"
 #include "libunbound/unbound.h"
@@ -484,8 +486,15 @@ setup_qinfo_edns(struct libworker* w, struct ctx_query* q,
 	if(!rdf) {
 		return 0;
 	}
+#ifdef UNBOUND_ALLOC_LITE
+	qinfo->qname = memdup(ldns_rdf_data(rdf), ldns_rdf_size(rdf));
+	qinfo->qname_len = ldns_rdf_size(rdf);
+	ldns_rdf_deep_free(rdf);
+	rdf = 0;
+#else
 	qinfo->qname = ldns_rdf_data(rdf);
 	qinfo->qname_len = ldns_rdf_size(rdf);
+#endif
 	edns->edns_present = 1;
 	edns->ext_rcode = 0;
 	edns->edns_version = 0;
@@ -687,7 +696,7 @@ outbound_entry_compare(void* a, void* b)
 
 struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
         uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-        struct sockaddr_storage* addr, socklen_t addrlen,
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
         struct module_qstate* q)
 {
 	struct libworker* w = (struct libworker*)q->env->worker;
@@ -697,9 +706,9 @@ struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
 		return NULL;
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(w->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, addr, addrlen,
-		libworker_handle_service_reply, e, w->back->udp_buff,
-		&outbound_entry_compare);
+		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
+		addr, addrlen, libworker_handle_service_reply, e, 
+		w->back->udp_buff, &outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -826,7 +835,8 @@ int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);

libunbound/libworker.h

@@ -129,6 +129,7 @@ int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  * @param qclass: query class. (host order)
  * @param flags: host order flags word, with opcode and CD bit.
  * @param dnssec: if set, EDNS record will have DO bit set.
+ * @param want_dnssec: signatures needed.
  * @param addr: where to.
  * @param addrlen: length of addr.
  * @param q: wich query state to reactivate upon return.
@@ -137,7 +138,7 @@ int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  */
 struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
         uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-        struct sockaddr_storage* addr, socklen_t addrlen,
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
         struct module_qstate* q);
 
 /** process incoming replies from the network */

makedist.sh

@@ -293,9 +293,11 @@ autoreconf || error_cleanup "Autoconf failed."
 rm -r autom4te* || error_cleanup "Failed to remove autoconf cache directory."
 
 info "Building lexer and parser."
-echo "#include \"util/configyyrename.h\"" > util/configlexer.c || error_cleanup "Failed to create configlexer"
+echo "#include \"config.h\"" > util/configlexer.c || error_cleanup "Failed to create configlexer"
+echo "#include \"util/configyyrename.h\"" >> util/configlexer.c || error_cleanup "Failed to create configlexer"
 flex -i -t util/configlexer.lex >> util/configlexer.c  || error_cleanup "Failed to create configlexer"
-bison -y -d -o util/configparser.c util/configparser.y || error_cleanup "Failed to create configparser"
+if test -x `which bison` 2>&1; then YACC=bison; else YACC=yacc; fi
+$YACC -y -d -o util/configparser.c util/configparser.y || error_cleanup "Failed to create configparser"
 
 # check shared code, ldns-testpkts from ldns examples, if possible.
 cd ../..

pythonmod/pythonmod.c

@@ -44,6 +44,7 @@
 #endif
 
 #include "config.h"
+#include "ldns/ldns.h"
 
 #undef _POSIX_C_SOURCE
 #undef _XOPEN_SOURCE
@@ -56,6 +57,8 @@
 
 #ifdef S_SPLINT_S
 typedef struct PyObject PyObject;
+typedef struct PyThreadState PyThreadState;
+typedef void* PyGILState_STATE;
 #endif
 
 /**
@@ -66,6 +69,8 @@ struct pythonmod_env {
 	/** Python script filename. */
 	const char* fname;
 
+	/** Python main thread */
+	PyThreadState* mainthr;
 	/** Python module. */
 	PyObject* module;
 
@@ -107,6 +112,7 @@ int pythonmod_init(struct module_env* env, int id)
    /* Initialize module */
    FILE* script_py = NULL;
    PyObject* py_cfg, *res;
+   PyGILState_STATE gil;
    struct pythonmod_env* pe = (struct pythonmod_env*)calloc(1, sizeof(struct pythonmod_env));
    if (!pe) 
    {
@@ -130,11 +136,11 @@ int pythonmod_init(struct module_env* env, int id)
       Py_NoSiteFlag = 1;
       Py_Initialize();
       PyEval_InitThreads();
-      PyEval_ReleaseLock();
       SWIG_init();
+      pe->mainthr = PyEval_SaveThread();
    }
 
-   PyEval_AcquireLock();
+   gil = PyGILState_Ensure();
 
    /* Initialize Python */
    PyRun_SimpleString("import sys \n");
@@ -150,7 +156,7 @@ int pythonmod_init(struct module_env* env, int id)
    if (PyRun_SimpleString("from unboundmodule import *\n") < 0)
    {
       log_err("pythonmod: cannot initialize core module: unboundmodule.py"); 
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
 
@@ -158,7 +164,7 @@ int pythonmod_init(struct module_env* env, int id)
    if ((script_py = fopen(pe->fname, "r")) == NULL) 
    {
       log_err("pythonmod: can't open file %s for reading", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
 
@@ -174,7 +180,7 @@ int pythonmod_init(struct module_env* env, int id)
    if (PyRun_SimpleFile(script_py, pe->fname) < 0) 
    {
       log_err("pythonmod: can't parse Python script %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
 
@@ -183,25 +189,25 @@ int pythonmod_init(struct module_env* env, int id)
    if ((pe->func_init = PyDict_GetItemString(pe->dict, "init")) == NULL) 
    {
       log_err("pythonmod: function init is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
    if ((pe->func_deinit = PyDict_GetItemString(pe->dict, "deinit")) == NULL) 
    {
       log_err("pythonmod: function deinit is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
    if ((pe->func_operate = PyDict_GetItemString(pe->dict, "operate")) == NULL) 
    {
       log_err("pythonmod: function operate is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
    if ((pe->func_inform = PyDict_GetItemString(pe->dict, "inform_super")) == NULL) 
    {
       log_err("pythonmod: function inform_super is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
 
@@ -215,7 +221,7 @@ int pythonmod_init(struct module_env* env, int id)
 
    Py_XDECREF(res);
    Py_XDECREF(py_cfg);
-   PyEval_ReleaseLock();
+   PyGILState_Release(gil);
 
    return 1;
 }
@@ -230,9 +236,9 @@ void pythonmod_deinit(struct module_env* env, int id)
    if(pe->module != NULL)
    {
       PyObject* res;
+      PyGILState_STATE gil = PyGILState_Ensure();
 
       /* Deinit module */
-      PyEval_AcquireLock();
       res = PyObject_CallFunction(pe->func_deinit, "i", id);
       if (PyErr_Occurred()) {
          log_err("pythonmod: Exception occurred in function deinit");
@@ -242,8 +248,11 @@ void pythonmod_deinit(struct module_env* env, int id)
       Py_XDECREF(res);
       /* Free shared data if any */
       Py_XDECREF(pe->data);
+      PyGILState_Release(gil);
 
+      PyEval_RestoreThread(pe->mainthr);
       Py_Finalize();
+      pe->mainthr = NULL;
    }
    pe->fname = NULL;
    free(pe);
@@ -257,6 +266,7 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
    struct pythonmod_env* pe = (struct pythonmod_env*)qstate->env->modinfo[id];
    struct pythonmod_qstate* pq = (struct pythonmod_qstate*)qstate->minfo[id];
    PyObject* py_qstate, *py_sqstate, *res;
+   PyGILState_STATE gil = PyGILState_Ensure();
 
    log_query_info(VERB_ALGO, "pythonmod: inform_super, sub is", &qstate->qinfo);
    log_query_info(VERB_ALGO, "super is", &super->qinfo);
@@ -264,7 +274,6 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
    py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
    py_sqstate = SWIG_NewPointerObj((void*) super, SWIGTYPE_p_module_qstate, 0);
 
-   PyEval_AcquireLock();
    res = PyObject_CallFunction(pe->func_inform, "iOOO", id, py_qstate, 
 	py_sqstate, pq->data);
 
@@ -284,7 +293,7 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
    Py_XDECREF(py_sqstate);
    Py_XDECREF(py_qstate);
 
-   PyEval_ReleaseLock();
+   PyGILState_Release(gil);
 }
 
 void pythonmod_operate(struct module_qstate* qstate, enum module_ev event, 
@@ -293,6 +302,7 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
    struct pythonmod_env* pe = (struct pythonmod_env*)qstate->env->modinfo[id];
    struct pythonmod_qstate* pq = (struct pythonmod_qstate*)qstate->minfo[id];
    PyObject* py_qstate, *res;
+   PyGILState_STATE gil = PyGILState_Ensure();
 
    if ( pq == NULL)
    { 
@@ -304,9 +314,6 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
       Py_INCREF(pq->data);
    }
 
-   /* Lock Python */
-   PyEval_AcquireLock();
-
    /* Call operate */
    py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
    res = PyObject_CallFunction(pe->func_operate, "iiOO", id, (int) event, 
@@ -325,8 +332,7 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
    Py_XDECREF(res);
    Py_XDECREF(py_qstate);
 
-   /* Unlock Python */
-   PyEval_ReleaseLock();
+   PyGILState_Release(gil);
 }
 
 void pythonmod_clear(struct module_qstate* qstate, int id)
@@ -340,7 +346,9 @@ void pythonmod_clear(struct module_qstate* qstate, int id)
    	(unsigned long int)pq);
    if(pq != NULL)
    {
+      PyGILState_STATE gil = PyGILState_Ensure();
       Py_DECREF(pq->data);
+      PyGILState_Release(gil);
       /* Free qstate */
       free(pq);
    }

services/cache/dns.c

@@ -213,27 +213,6 @@ find_add_addrs(struct module_env* env, uint16_t qclass,
 				lock_rw_unlock(&neg->entry.lock);
 			}
 		}
-		/* see if we have parent-side-glue (dispreferred) */
-		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
-			ns->namelen, LDNS_RR_TYPE_A, qclass, 
-			PACKED_RRSET_PARENT_SIDE, now, 0);
-		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1)) {
-				lock_rw_unlock(&akey->entry.lock);
-				return 0;
-			}
-			lock_rw_unlock(&akey->entry.lock);
-		}
-		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
-			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 
-			PACKED_RRSET_PARENT_SIDE, now, 0);
-		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1)) {
-				lock_rw_unlock(&akey->entry.lock);
-				return 0;
-			}
-			lock_rw_unlock(&akey->entry.lock);
-		}
 	}
 	return 1;
 }
@@ -251,7 +230,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_A, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, 0, 1)) {
+			if(!delegpt_add_rrset_A(dp, region, akey, (int)ns->lame, 1)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -269,7 +248,7 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
 			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 0, now, 0);
 		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 0, 1)) {
+			if(!delegpt_add_rrset_AAAA(dp, region, akey, (int)ns->lame, 1)) {
 				lock_rw_unlock(&akey->entry.lock);
 				return 0;
 			}
@@ -284,27 +263,6 @@ cache_fill_missing(struct module_env* env, uint16_t qclass,
 				lock_rw_unlock(&neg->entry.lock);
 			}
 		}
-		/* see if we have parent-side-glue (dispreferred) */
-		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
-			ns->namelen, LDNS_RR_TYPE_A, qclass, 
-			PACKED_RRSET_PARENT_SIDE, now, 0);
-		if(akey) {
-			if(!delegpt_add_rrset_A(dp, region, akey, 1, 1)) {
-				lock_rw_unlock(&akey->entry.lock);
-				return 0;
-			}
-			lock_rw_unlock(&akey->entry.lock);
-		}
-		akey = rrset_cache_lookup(env->rrset_cache, ns->name, 
-			ns->namelen, LDNS_RR_TYPE_AAAA, qclass, 
-			PACKED_RRSET_PARENT_SIDE, now, 0);
-		if(akey) {
-			if(!delegpt_add_rrset_AAAA(dp, region, akey, 1, 1)) {
-				lock_rw_unlock(&akey->entry.lock);
-				return 0;
-			}
-			lock_rw_unlock(&akey->entry.lock);
-		}
 	}
 	return 1;
 }
@@ -420,7 +378,7 @@ dns_cache_find_delegation(struct module_env* env, uint8_t* qname,
 			return NULL;
 		}
 	}
-	if(!delegpt_rrset_add_ns(dp, region, nskey))
+	if(!delegpt_rrset_add_ns(dp, region, nskey, 0))
 		log_err("find_delegation: addns out of memory");
 	lock_rw_unlock(&nskey->entry.lock); /* first unlock before next lookup*/
 	/* find and add DS/NSEC (if any) */

services/cache/infra.c

@@ -39,6 +39,7 @@
  * This file contains the infrastructure cache.
  */
 #include "config.h"
+#include "ldns/rr.h"
 #include "services/cache/infra.h"
 #include "util/storage/slabhash.h"
 #include "util/storage/lookup3.h"
@@ -186,6 +187,19 @@ infra_lookup_host(struct infra_cache* infra,
 	return data;
 }
 
+/** init the host elements (not lame elems) */
+static void
+host_entry_init(struct infra_cache* infra, struct lruhash_entry* e, 
+	uint32_t timenow)
+{
+	struct infra_host_data* data = (struct infra_host_data*)e->data;
+	data->ttl = timenow + infra->host_ttl;
+	rtt_init(&data->rtt);
+	data->edns_version = 0;
+	data->edns_lame_known = 0;
+	data->num_timeouts = 0;
+}
+
 /** 
  * Create and init a new entry for a host 
  * @param infra: infra structure with config parameters.
@@ -215,12 +229,8 @@ new_host_entry(struct infra_cache* infra, struct sockaddr_storage* addr,
 	key->entry.data = (void*)data;
 	key->addrlen = addrlen;
 	memcpy(&key->addr, addr, addrlen);
-	data->ttl = tm + infra->host_ttl;
 	data->lameness = NULL;
-	data->edns_version = 0;
-	data->edns_lame_known = 0;
-	data->num_timeouts = 0;
-	rtt_init(&data->rtt);
+	host_entry_init(infra, &key->entry, tm);
 	return &key->entry;
 }
 
@@ -239,12 +249,8 @@ infra_host(struct infra_cache* infra, struct sockaddr_storage* addr,
 		if(e) {
 			/* if its still there we have a writelock, init */
 			/* re-initialise */
-			data = (struct infra_host_data*)e->data;
-			data->ttl = timenow + infra->host_ttl;
-			rtt_init(&data->rtt);
 			/* do not touch lameness, it may be valid still */
-			data->edns_version = 0;
-			data->edns_lame_known = 0;
+			host_entry_init(infra, e, timenow);
 		}
 	}
 	if(!e) {
@@ -468,10 +474,11 @@ infra_rtt_update(struct infra_cache* infra,
 		if(!(e = new_host_entry(infra, addr, addrlen, timenow)))
 			return 0;
 		needtoinsert = 1;
-	}
-	/* have an entry, update the rtt, and the ttl */
+	} else if(((struct infra_host_data*)e->data)->ttl < timenow) {
+		host_entry_init(infra, e, timenow);
+	} 
+	/* have an entry, update the rtt */
 	data = (struct infra_host_data*)e->data;
-	data->ttl = timenow + infra->host_ttl;
 	if(roundtrip == -1) {
 		rtt_lost(&data->rtt, orig_rtt);
 		if(data->num_timeouts<255)
@@ -502,12 +509,16 @@ infra_edns_update(struct infra_cache* infra,
 		if(!(e = new_host_entry(infra, addr, addrlen, timenow)))
 			return 0;
 		needtoinsert = 1;
-	}
+	} else if(((struct infra_host_data*)e->data)->ttl < timenow) {
+		host_entry_init(infra, e, timenow);
+	} 
 	/* have an entry, update the rtt, and the ttl */
 	data = (struct infra_host_data*)e->data;
-	data->ttl = timenow + infra->host_ttl;
-	data->edns_version = edns_version;
-	data->edns_lame_known = 1;
+	/* do not update if noEDNS and stored is yesEDNS */
+	if(!(edns_version == -1 && data->edns_version != -1)) {
+		data->edns_version = edns_version;
+		data->edns_lame_known = 1;
+	}
 
 	if(needtoinsert)
 		slabhash_insert(infra->hosts, e->hash, e, e->data, NULL);

services/cache/infra.h

@@ -251,6 +251,7 @@ void infra_update_tcp_works(struct infra_cache* infra,
  * @param addr: host address.
  * @param addrlen: length of addr.
  * @param edns_version: the version that it publishes.
+ * 	If it is known to support EDNS then no-EDNS is not stored over it.
  * @param timenow: what time it is now.
  * @return: 0 on error.
  */

services/listen_dnsport.c

@@ -39,6 +39,10 @@
  * This file has functions to get queries from clients.
  */
 #include "config.h"
+#ifdef HAVE_SYS_TYPES_H
+#  include <sys/types.h>
+#endif
+#include <sys/time.h>
 #include "services/listen_dnsport.h"
 #include "services/outside_network.h"
 #include "util/netevent.h"
@@ -46,9 +50,6 @@
 #include "util/config_file.h"
 #include "util/net_help.h"
 
-#ifdef HAVE_SYS_TYPES_H
-#  include <sys/types.h>
-#endif
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -490,7 +491,7 @@ port_insert(struct listen_port** list, int s, enum listen_type ftype)
 static int
 set_recvpktinfo(int s, int family) 
 {
-#if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || defined(IP_RECVDSTADDR) || defined(IP_PKTINFO)
+#if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || (defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)) || defined(IP_PKTINFO)
 	int on = 1;
 #else
 	(void)s;
@@ -517,22 +518,22 @@ set_recvpktinfo(int s, int family)
 #           endif /* defined IPV6_RECVPKTINFO */
 
 	} else if(family == AF_INET) {
-#           ifdef IP_RECVDSTADDR
-		if(setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR,
-			(void*)&on, (socklen_t)sizeof(on)) < 0) {
-			log_err("setsockopt(..., IP_RECVDSTADDR, ...) failed: %s",
-				strerror(errno));
-			return 0;
-		}
-#           elif defined(IP_PKTINFO)
+#           ifdef IP_PKTINFO
 		if(setsockopt(s, IPPROTO_IP, IP_PKTINFO,
 			(void*)&on, (socklen_t)sizeof(on)) < 0) {
 			log_err("setsockopt(..., IP_PKTINFO, ...) failed: %s",
 				strerror(errno));
 			return 0;
 		}
+#           elif defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)
+		if(setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR,
+			(void*)&on, (socklen_t)sizeof(on)) < 0) {
+			log_err("setsockopt(..., IP_RECVDSTADDR, ...) failed: %s",
+				strerror(errno));
+			return 0;
+		}
 #           else
-		log_err("no IP_RECVDSTADDR or IP_PKTINFO option, please disable "
+		log_err("no IP_SENDSRCADDR or IP_PKTINFO option, please disable "
 			"interface-automatic in config");
 		return 0;
 #           endif /* IP_PKTINFO */

services/localzone.c

@@ -39,6 +39,8 @@
  * This file contains functions to enable local zone authority service.
  */
 #include "config.h"
+#include "ldns/dname.h"
+#include "ldns/host2wire.h"
 #include "services/localzone.h"
 #include "util/regional.h"
 #include "util/config_file.h"
@@ -687,6 +689,8 @@ lz_enter_defaults(struct local_zones* zones, struct config_file* cfg,
 		!add_as112_default(zones, cfg, buf, "0.in-addr.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "254.169.in-addr.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "2.0.192.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "100.51.198.in-addr.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "113.0.203.in-addr.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "255.255.255.255.in-addr.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "d.f.ip6.arpa.") ||
@@ -694,6 +698,7 @@ lz_enter_defaults(struct local_zones* zones, struct config_file* cfg,
 		!add_as112_default(zones, cfg, buf, "9.e.f.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "a.e.f.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "b.e.f.ip6.arpa.") ||
+		!add_as112_default(zones, cfg, buf, "0.1.1.0.0.2.ip6.arpa.") ||
 		!add_as112_default(zones, cfg, buf, "8.b.d.0.1.0.0.2.ip6.arpa.")) {
 		log_err("out of memory adding default zone");
 		return 0;
@@ -1038,10 +1043,10 @@ local_data_answer(struct local_zone* z, struct query_info* qinfo,
 	if(!lr)
 		return 0;
 	if(z->type == local_zone_redirect) {
-		/* convert rrset name to zone name; like a wildcard */
+		/* convert rrset name to query name; like a wildcard */
 		struct ub_packed_rrset_key r = *lr->rrset;
-		r.rk.dname = z->name;
-		r.rk.dname_len = z->namelen;
+		r.rk.dname = qinfo->qname;
+		r.rk.dname_len = qinfo->qname_len;
 		return local_encode(qinfo, edns, buf, temp, &r, 1, 
 			LDNS_RCODE_NOERROR);
 	}

services/mesh.c

@@ -43,6 +43,7 @@
  * send back to clients.
  */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "services/mesh.h"
 #include "services/outbound_list.h"
 #include "services/cache/dns.h"
@@ -575,6 +576,36 @@ mesh_state_delete(struct module_qstate* qstate)
 	mesh_state_cleanup(mstate);
 }
 
+/** helper recursive rbtree find routine */
+static int
+find_in_subsub(struct mesh_state* m, struct mesh_state* tofind, size_t *c)
+{
+	struct mesh_state_ref* r;
+	if((*c)++ > MESH_MAX_SUBSUB)
+		return 1;
+	RBTREE_FOR(r, struct mesh_state_ref*, &m->sub_set) {
+		if(r->s == tofind || find_in_subsub(r->s, tofind, c))
+			return 1;
+	}
+	return 0;
+}
+
+/** find cycle for already looked up mesh_state */
+static int 
+mesh_detect_cycle_found(struct module_qstate* qstate, struct mesh_state* dep_m)
+{
+	struct mesh_state* cyc_m = qstate->mesh_info;
+	size_t counter = 0;
+	if(!dep_m)
+		return 0;
+	if(dep_m == cyc_m || find_in_subsub(dep_m, cyc_m, &counter)) {
+		if(counter > MESH_MAX_SUBSUB)
+			return 2;
+		return 1;
+	}
+	return 0;
+}
+
 void mesh_detach_subs(struct module_qstate* qstate)
 {
 	struct mesh_area* mesh = qstate->env->mesh;
@@ -601,6 +632,10 @@ int mesh_attach_sub(struct module_qstate* qstate, struct query_info* qinfo,
 	/* find it, if not, create it */
 	struct mesh_area* mesh = qstate->env->mesh;
 	struct mesh_state* sub = mesh_area_find(mesh, qinfo, qflags, prime);
+	if(mesh_detect_cycle_found(qstate, sub)) {
+		verbose(VERB_ALGO, "attach failed, cycle detected");
+		return 0;
+	}
 	if(!sub) {
 		struct rbnode_t* n;
 		/* create a new one */
@@ -1056,30 +1091,13 @@ mesh_get_mem(struct mesh_area* mesh)
 	return s;
 }
 
-/** helper recursive rbtree find routine */
-static int
-find_in_subsub(struct mesh_state* m, struct mesh_state* tofind)
-{
-	struct mesh_state_ref* r;
-	RBTREE_FOR(r, struct mesh_state_ref*, &m->sub_set) {
-		if(r->s == tofind || find_in_subsub(r->s, tofind))
-			return 1;
-	}
-	return 0;
-}
-
 int 
 mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
 	uint16_t flags, int prime)
 {
 	struct mesh_area* mesh = qstate->env->mesh;
-	struct mesh_state* cyc_m = qstate->mesh_info;
 	struct mesh_state* dep_m = mesh_area_find(mesh, qinfo, flags, prime);
-	if(!dep_m)
-		return 0;
-	if(dep_m == cyc_m || find_in_subsub(dep_m, cyc_m))
-		return 1;
-	return 0;
+	return mesh_detect_cycle_found(qstate, dep_m);
 }
 
 void mesh_list_insert(struct mesh_state* m, struct mesh_state** fp,

services/mesh.h

@@ -65,6 +65,13 @@ struct timehist;
  */
 #define MESH_MAX_ACTIVATION 1000
 
+/**
+ * Max number of references-to-references-to-references.. search size.
+ * Any more is treated like 'too large', and the creation of a new
+ * dependency is failed (so that no loops can be created).
+ */
+#define MESH_MAX_SUBSUB 1024
+
 /** 
  * Mesh of query states
  */
@@ -326,6 +333,8 @@ void mesh_detach_subs(struct module_qstate* qstate);
  * Attach subquery.
  * Creates it if it does not exist already.
  * Keeps sub and super references correct.
+ * Performs a cycle detection - for double check - and fails if there is one.
+ * Also fails if the sub-sub-references become too large.
  * Updates stat items in mesh_area structure.
  * Pass if it is priming query or not.
  * return:
@@ -503,13 +512,15 @@ size_t mesh_get_mem(struct mesh_area* mesh);
 /**
  * Find cycle; see if the given mesh is in the targets sub, or sub-sub, ...
  * trees.
+ * If the sub-sub structure is too large, it returns 'a cycle'=2.
  * @param qstate: given mesh querystate.
  * @param qinfo: query info for dependency.
  * @param flags: query flags of dependency.
  * @param prime: if dependency is a priming query or not.
  * @return true if the name,type,class exists and the given qstate mesh exists
  * 	as a dependency of that name. Thus if qstate becomes dependent on
- * 	name,type,class then a cycle is created.
+ * 	name,type,class then a cycle is created, this is return value 1.
+ * 	Too large to search is value 2 (also true).
  */
 int mesh_detect_cycle(struct module_qstate* qstate, struct query_info* qinfo,
 	uint16_t flags, int prime);

services/modstack.c

@@ -39,6 +39,7 @@
  * This file contains functions to help maintain a stack of modules.
  */
 #include "config.h"
+#include <ctype.h>
 #include "services/modstack.h"
 #include "util/module.h"
 #include "util/fptr_wlist.h"

services/outbound_list.c

@@ -40,6 +40,7 @@
  * queries it has outstanding to authoritative servers.
  */
 #include "config.h"
+#include <sys/time.h>
 #include "services/outbound_list.h"
 #include "services/outside_network.h"
 

services/outside_network.c

@@ -40,6 +40,12 @@
  * wait for the pending answer events.
  */
 #include "config.h"
+#include <ctype.h>
+#ifdef HAVE_SYS_TYPES_H
+#  include <sys/types.h>
+#endif
+#include <sys/time.h>
+#include "ldns/wire2host.h"
 #include "services/outside_network.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/infra.h"
@@ -53,9 +59,6 @@
 #include "util/random.h"
 #include "util/fptr_wlist.h"
 
-#ifdef HAVE_SYS_TYPES_H
-#  include <sys/types.h>
-#endif
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -807,9 +810,9 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 	log_assert(outnet->unused_fds);
 	tries = 0;
 	while(1) {
-		my_if = ub_random(outnet->rnd) % num_if;
+		my_if = ub_random_max(outnet->rnd, num_if);
 		pif = &ifs[my_if];
-		my_port = ub_random(outnet->rnd) % pif->avail_total;
+		my_port = ub_random_max(outnet->rnd, pif->avail_total);
 		if(my_port < pif->inuse) {
 			/* port already open */
 			pend->pc = pif->out[my_port];
@@ -1075,7 +1078,7 @@ lookup_serviced(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
 /** Create new serviced entry */
 static struct serviced_query*
 serviced_create(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
-        struct sockaddr_storage* addr, socklen_t addrlen)
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen)
 {
 	struct serviced_query* sq = (struct serviced_query*)malloc(sizeof(*sq));
 	rbnode_t* ins;
@@ -1089,6 +1092,7 @@ serviced_create(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
 	}
 	sq->qbuflen = ldns_buffer_limit(buff);
 	sq->dnssec = dnssec;
+	sq->want_dnssec = want_dnssec;
 	memcpy(&sq->addr, addr, addrlen);
 	sq->addrlen = addrlen;
 	sq->outnet = outnet;
@@ -1130,7 +1134,8 @@ serviced_delete(struct serviced_query* sq)
 		/* clear up the pending query */
 		if(sq->status == serviced_query_UDP_EDNS ||
 			sq->status == serviced_query_UDP ||
-			sq->status == serviced_query_PROBE_EDNS) {
+			sq->status == serviced_query_PROBE_EDNS ||
+			sq->status == serviced_query_UDP_EDNS_fallback) {
 			struct pending* p = (struct pending*)sq->pending;
 			if(p->pc)
 				portcomm_loweruse(sq->outnet, p->pc);
@@ -1239,8 +1244,7 @@ serviced_udp_send(struct serviced_query* sq, ldns_buffer* buff)
 		&edns_lame_known, &rtt))
 		return 0;
 	if(sq->status == serviced_initial) {
-		if((vs != -1 || edns_lame_known == 0) && 
-			rtt > 5000 && rtt < 10001) {
+		if(edns_lame_known == 0 && rtt > 5000 && rtt < 10001) {
 			/* perform EDNS lame probe - check if server is
 			 * EDNS lame (EDNS queries to it are dropped) */
 			verbose(VERB_ALGO, "serviced query: send probe to see "
@@ -1407,12 +1411,25 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 		(LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
 		LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(ldns_buffer_begin(
 		c->buffer)) == LDNS_RCODE_NOTIMPL) ) {
-		if(!infra_edns_update(sq->outnet->infra, &sq->addr, 
+		/* attempt to fallback to nonEDNS */
+		sq->status = serviced_query_TCP_EDNS_fallback;
+		serviced_tcp_initiate(sq->outnet, sq, c->buffer);
+		return 0;
+	} else if(error==NETEVENT_NOERROR && 
+		sq->status == serviced_query_TCP_EDNS_fallback &&
+			(LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
+			LDNS_RCODE_NOERROR || LDNS_RCODE_WIRE(
+			ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NXDOMAIN 
+			|| LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) 
+			== LDNS_RCODE_YXDOMAIN)) {
+		/* the fallback produced a result that looks promising, note
+		 * that this server should be approached without EDNS */
+		/* only store noEDNS in cache if domain is noDNSSEC */
+		if(!sq->want_dnssec)
+		  if(!infra_edns_update(sq->outnet->infra, &sq->addr, 
 			sq->addrlen, -1, *sq->outnet->now_secs))
 			log_err("Out of memory caching no edns for host");
 		sq->status = serviced_query_TCP;
-		serviced_tcp_initiate(sq->outnet, sq, c->buffer);
-		return 0;
 	}
 	/* insert address into reply info */
 	if(!rep) {
@@ -1476,11 +1493,9 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 	if(error == NETEVENT_TIMEOUT) {
 		int rto = 0;
 		if(sq->status == serviced_query_PROBE_EDNS) {
-			/* non-EDNS probe failed; not an EDNS lame server */
-			if(!infra_edns_update(outnet->infra, &sq->addr, 
-				sq->addrlen, 0, (uint32_t)now.tv_sec)) {
-				log_err("Out of memory caching edns works");
-			}
+			/* non-EDNS probe failed; we do not know its status,
+			 * keep trying with EDNS, timeout may not be caused
+			 * by EDNS. */
 			sq->status = serviced_query_UDP_EDNS;
 		}
 		sq->retry++;
@@ -1502,43 +1517,33 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			serviced_callbacks(sq, NETEVENT_TIMEOUT, c, rep);
 			return 0;
 		}
+	} else if(error != NETEVENT_NOERROR) {
+		/* udp returns error (due to no ID or interface available) */
+		serviced_callbacks(sq, error, c, rep);
+		return 0;
 	}
-	if(error == NETEVENT_NOERROR && sq->status == serviced_query_UDP_EDNS 
+	if(sq->status == serviced_query_UDP_EDNS 
 		&& (LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) 
 			== LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(
 			ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOTIMPL)) {
-		/* note no EDNS, fallback without EDNS */
-		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
-			-1, (uint32_t)now.tv_sec)) {
-			log_err("Out of memory caching no edns for host");
-		}
-		sq->status = serviced_query_UDP;
+		/* try to get an answer by falling back without EDNS */
+		sq->status = serviced_query_UDP_EDNS_fallback;
 		sq->retry = 0;
 		if(!serviced_udp_send(sq, c->buffer)) {
 			serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
 		}
 		return 0;
-	}
-	if(LDNS_TC_WIRE(ldns_buffer_begin(c->buffer)) ||
-		(error != NETEVENT_NOERROR && fallback_tcp)  ) {
-		/* fallback to TCP */
-		/* this discards partial UDP contents */
-		if(sq->status == serviced_query_UDP_EDNS)
-			sq->status = serviced_query_TCP_EDNS;
-		else	sq->status = serviced_query_TCP;
-		serviced_tcp_initiate(outnet, sq, c->buffer);
-		return 0;
-	}
-	/* yay! an answer */
-	if(sq->status == serviced_query_PROBE_EDNS) {
+	} else if(sq->status == serviced_query_PROBE_EDNS) {
 		/* probe without EDNS succeeds, so we conclude that this
 		 * host likely has EDNS packets dropped */
 		log_addr(VERB_DETAIL, "timeouts, concluded that connection to "
 			"host drops EDNS packets", &sq->addr, sq->addrlen);
-		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
+		/* only store noEDNS in cache if domain is noDNSSEC */
+		if(!sq->want_dnssec)
+		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
 			-1, (uint32_t)now.tv_sec)) {
 			log_err("Out of memory caching no edns for host");
-		}
+		  }
 		sq->status = serviced_query_UDP;
 	} else if(sq->status == serviced_query_UDP_EDNS && 
 		!sq->edns_lame_known) {
@@ -1548,6 +1553,21 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			log_err("Out of memory caching edns works");
 		}
 		sq->edns_lame_known = 1;
+	} else if(sq->status == serviced_query_UDP_EDNS_fallback &&
+		!sq->edns_lame_known && (LDNS_RCODE_WIRE(
+		ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOERROR || 
+		LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
+		LDNS_RCODE_NXDOMAIN || LDNS_RCODE_WIRE(ldns_buffer_begin(
+		c->buffer)) == LDNS_RCODE_YXDOMAIN)) {
+		/* the fallback produced a result that looks promising, note
+		 * that this server should be approached without EDNS */
+		/* only store noEDNS in cache if domain is noDNSSEC */
+		if(!sq->want_dnssec)
+		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
+			-1, (uint32_t)now.tv_sec)) {
+			log_err("Out of memory caching no edns for host");
+		  }
+		sq->status = serviced_query_UDP;
 	}
 	if(now.tv_sec > sq->last_sent_time.tv_sec ||
 		(now.tv_sec == sq->last_sent_time.tv_sec &&
@@ -1561,6 +1581,20 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			roundtime, sq->last_rtt, (uint32_t)now.tv_sec))
 			log_err("out of memory noting rtt.");
 	}
+	/* perform TC flag check and TCP fallback after updating our
+	 * cache entries for EDNS status and RTT times */
+	if(LDNS_TC_WIRE(ldns_buffer_begin(c->buffer)) || fallback_tcp) {
+		/* fallback to TCP */
+		/* this discards partial UDP contents */
+		if(sq->status == serviced_query_UDP_EDNS ||
+			sq->status == serviced_query_UDP_EDNS_fallback)
+			/* if we have unfinished EDNS_fallback, start again */
+			sq->status = serviced_query_TCP_EDNS;
+		else	sq->status = serviced_query_TCP;
+		serviced_tcp_initiate(outnet, sq, c->buffer);
+		return 0;
+	}
+	/* yay! an answer */
 	serviced_callbacks(sq, error, c, rep);
 	return 0;
 }
@@ -1581,10 +1615,10 @@ callback_list_find(struct serviced_query* sq, void* cb_arg,
 struct serviced_query* 
 outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr,
-	socklen_t addrlen, comm_point_callback_t* callback,
-	void* callback_arg, ldns_buffer* buff, 
-	int (*arg_compare)(void*,void*))
+	uint16_t flags, int dnssec, int want_dnssec,
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	comm_point_callback_t* callback, void* callback_arg, 
+	ldns_buffer* buff, int (*arg_compare)(void*,void*))
 {
 	struct serviced_query* sq;
 	struct service_callback* cb;
@@ -1600,7 +1634,8 @@ outnet_serviced_query(struct outside_network* outnet,
 		return NULL;
 	if(!sq) {
 		/* make new serviced query entry */
-		sq = serviced_create(outnet, buff, dnssec, addr, addrlen);
+		sq = serviced_create(outnet, buff, dnssec, want_dnssec,
+			addr, addrlen);
 		if(!sq) {
 			free(cb);
 			return NULL;
@@ -1752,7 +1787,8 @@ serviced_get_mem(struct serviced_query* sq)
 		s += sizeof(*sb);
 	if(sq->status == serviced_query_UDP_EDNS ||
 		sq->status == serviced_query_UDP ||
-		sq->status == serviced_query_PROBE_EDNS) {
+		sq->status == serviced_query_PROBE_EDNS ||
+		sq->status == serviced_query_UDP_EDNS_fallback) {
 		s += sizeof(struct pending);
 		s += comm_timer_get_mem(NULL);
 	} else {

services/outside_network.h

@@ -291,6 +291,8 @@ struct serviced_query {
 	size_t qbuflen;
 	/** If an EDNS section is included, the DO/CD bit will be turned on. */
 	int dnssec;
+	/** We want signatures, or else the answer is likely useless */
+	int want_dnssec;
 	/** where to send it */
 	struct sockaddr_storage addr;
 	/** length of addr field in use. */
@@ -308,7 +310,11 @@ struct serviced_query {
 		/** TCP without EDNS sent */
 		serviced_query_TCP,
 		/** probe to test EDNS lameness (EDNS is dropped) */
-		serviced_query_PROBE_EDNS
+		serviced_query_PROBE_EDNS,
+		/** probe to test noEDNS0 (EDNS gives FORMERRorNOTIMP) */
+		serviced_query_UDP_EDNS_fallback,
+		/** probe to test TCP noEDNS0 (EDNS gives FORMERRorNOTIMP) */
+		serviced_query_TCP_EDNS_fallback
 	} 	
 		/** variable with current status */ 
 		status;
@@ -427,6 +433,8 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
  * @param dnssec: if set, DO bit is set in EDNS queries.
  *	If the value includes BIT_CD, CD bit is set when in EDNS queries.
  *	If the value includes BIT_DO, DO bit is set when in EDNS queries.
+ * @param want_dnssec: signatures are needed, without EDNS the answer is
+ * 	likely to be useless.
  * @param callback: callback function.
  * @param callback_arg: user argument to callback function.
  * @param addr: to which server to send the query.
@@ -439,10 +447,10 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
  */
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr, 
-	socklen_t addrlen, comm_point_callback_t* callback, 
-	void* callback_arg, ldns_buffer* buff, 
-	int (*arg_compare)(void*,void*));
+	uint16_t flags, int dnssec, int want_dnssec,
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	comm_point_callback_t* callback, void* callback_arg, 
+	ldns_buffer* buff, int (*arg_compare)(void*,void*));
 
 /**
  * Remove service query callback.

smallapp/unbound-checkconf.c

@@ -52,6 +52,9 @@
 #include "iterator/iter_fwd.h"
 #include "validator/validator.h"
 #include "services/localzone.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 #ifdef HAVE_PWD_H
 #include <pwd.h>
 #endif
@@ -154,7 +157,7 @@ interfacechecks(struct config_file* cfg)
 	socklen_t alen;
 	int i, j;
 	for(i=0; i<cfg->num_ifs; i++) {
-		if(!ipstrtoaddr(cfg->ifs[i], UNBOUND_DNS_PORT, &a, &alen)) {
+		if(!extstrtoaddr(cfg->ifs[i], &a, &alen)) {
 			fatal_exit("cannot parse interface specified as '%s'",
 				cfg->ifs[i]);
 		}

smallapp/unbound-control-setup.sh

@@ -57,6 +57,9 @@ SVR_BASE=unbound_server
 # base name for unbound-control keys
 CTL_BASE=unbound_control
 
+# we want -rw-r--- access (say you run this as root: grp=yes (server), all=no).
+umask 0026
+
 # end of options
 
 # functions:

smallapp/unbound-control.c

@@ -42,6 +42,18 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#ifdef HAVE_OPENSSL_SSL_H
+#include <openssl/ssl.h>
+#endif
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/locks.h"

smallapp/unbound-host.c

@@ -41,6 +41,9 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 /* remove alloc checks, not in this part of the code */
 #ifdef UNBOUND_ALLOC_STATS
 #undef malloc
@@ -48,6 +51,14 @@
 #undef free
 #undef realloc
 #endif
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef free
+#undef realloc
+#undef strdup
+#define unbound_lite_wrapstr(s) s
+#endif
 #include "libunbound/unbound.h"
 #include <ldns/ldns.h>
 
@@ -486,6 +497,12 @@ int main(int argc, char* argv[])
 	}
 	if(debuglevel != 0) /* set after possible -C options */
 		check_ub_res(ub_ctx_debuglevel(ctx, debuglevel));
+	if(ub_ctx_get_option(ctx, "use-syslog", &optarg) == 0) {
+		if(strcmp(optarg, "yes") == 0) /* disable use-syslog */
+			check_ub_res(ub_ctx_set_option(ctx, 
+				"use-syslog:", "no"));
+		free(optarg);
+	}
 	argc -= optind;
 	argv += optind;
 	if(argc != 1)

smallapp/worker_cb.c

@@ -112,7 +112,8 @@ int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec), 
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
@@ -151,7 +152,8 @@ int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);

testcode/asynclook.c

@@ -41,10 +41,20 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 #include "libunbound/unbound.h"
 #include "libunbound/context.h"
 #include "util/locks.h"
 #include "util/log.h"
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef realloc
+#undef free
+#undef strdup
+#endif
 
 /** keeping track of the async ids */
 struct track_id {

testcode/delayer.c

@@ -41,6 +41,13 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+#include <sys/time.h>
 #include "util/net_help.h"
 #include "util/config_file.h"
 #include <signal.h>

testcode/do-tests.sh

@@ -7,9 +7,14 @@ NEED_XXD='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_NC='fwd_compress_c00c.tpkg fwd_zero.tpkg'
 NEED_CURL='06-ianaports.tpkg'
 NEED_WHOAMI='07-confroot.tpkg'
-NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg'
+NEED_IPV6='fwd_ancil.tpkg fwd_tcp_tc6.tpkg stub_udp6.tpkg'
 NEED_NOMINGW='tcp_sigpipe.tpkg 07-confroot.tpkg 08-host-lib.tpkg fwd_ancil.tpkg'
 
+# test if dig, wdiff and ldns-testns are available.
+if test ! -x "`which dig 2>&1`"; then echo No 'dig' in path; exit 1; fi
+if test ! -x "`which wdiff 2>&1`"; then echo No 'wdiff' in path; exit 1; fi
+if test ! -x "`which ldns-testns 2>&1`"; then echo No 'ldns-testns' in path; exit 1; fi
+
 # test for ipv6, uses streamptcp peculiarity.
 if ./streamtcp -f ::1 2>&1 | grep "not supported" >/dev/null 2>&1; then
 	HAVE_IPV6=no

testcode/fake_event.c

@@ -347,7 +347,6 @@ answer_check_it(struct replay_runtime* runtime)
 			&runtime->now->addr, runtime->now->addrlen,
 			&ans->repinfo.addr, ans->repinfo.addrlen) == 0) &&
 			find_match(runtime->now->match, ans->pkt, tr)) {
-			struct replay_answer *n = ans->next;
 			log_info("testbound matched event entry from line %d",
 				runtime->now->match->lineno);
 			log_info("testbound: do STEP %d %s", 
@@ -359,7 +358,6 @@ answer_check_it(struct replay_runtime* runtime)
 			if(!ans->next)
 				runtime->answer_last = prev;
 			delete_replay_answer(ans);
-			ans = n;
 			return;
 		} else {
 			prev = ans;
@@ -988,10 +986,10 @@ pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr,
-	socklen_t addrlen, comm_point_callback_t* callback,
-	void* callback_arg, ldns_buffer* ATTR_UNUSED(buff),
-	int (*arg_compare)(void*,void*))
+	uint16_t flags, int dnssec, int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	comm_point_callback_t* callback, void* callback_arg, 
+	ldns_buffer* ATTR_UNUSED(buff), int (*arg_compare)(void*,void*))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,

testcode/harvest.c

@@ -69,11 +69,23 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#include "ldns/ldns.h"
 #include <signal.h>
 #include "libunbound/unbound.h"
 #ifdef HAVE_SYS_STAT_H
 #include <sys/stat.h>
 #endif
+#ifdef UNBOUND_ALLOC_LITE
+#undef malloc
+#undef calloc
+#undef realloc
+#undef free
+#undef strdup
+#define unbound_lite_wrapstr(s) s
+#endif
 struct todo_item;
 struct labdata;
 

testcode/ldns-testpkts.c

@@ -31,8 +31,12 @@ struct sockaddr_storage;
 /** string to show in warnings and errors */
 static const char* prog_name = "ldns-testpkts";
 
+#ifndef UTIL_LOG_H
+/** verbosity definition for compat */
+enum verbosity_value { NO_VERBOSE=0 };
+#endif
 /** logging routine, provided by caller */
-void verbose(int lvl, const char* msg, ...);
+void verbose(enum verbosity_value lvl, const char* msg, ...) ATTR_FORMAT(printf, 2, 3);
 
 /** print error and exit */
 static void error(const char* msg, ...)
@@ -589,12 +593,12 @@ match_list(ldns_rr_list* q, ldns_rr_list *p, bool mttl)
 	{
 		if(ldns_rr_compare(ldns_rr_list_rr(q, i), 
 			ldns_rr_list_rr(p, i)) != 0) {
-			verbose(3, "rr %d different", i);
+			verbose(3, "rr %d different", (int)i);
 			return 0;
 		}
 		if(mttl && ldns_rr_ttl(ldns_rr_list_rr(q, i)) !=
 			ldns_rr_ttl(ldns_rr_list_rr(p, i))) {
-			verbose(3, "rr %d ttl different", i);
+			verbose(3, "rr %d ttl different", (int)i);
 			return 0;
 		}
 	}
@@ -768,7 +772,7 @@ handle_query(uint8_t* inbuf, ssize_t inlen, struct entry* entries, int* count,
 	
 	query_rr = ldns_rr_list_rr(ldns_pkt_question(query_pkt), 0);
 	verbose(1, "query %d: id %d: %s %d bytes: ", ++(*count), (int)ldns_pkt_id(query_pkt), 
-		(transport==transport_tcp)?"TCP":"UDP", inlen);
+		(transport==transport_tcp)?"TCP":"UDP", (int)inlen);
 	if(verbose_out) ldns_rr_print(verbose_out, query_rr);
 	if(verbose_out) ldns_pkt_print(verbose_out, query_pkt);
 

testcode/perf.c

@@ -40,6 +40,10 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#include "ldns/ldns.h"
 #include <signal.h>
 #include "util/log.h"
 #include "util/locks.h"

testcode/pktview.c

@@ -40,6 +40,7 @@
  */
 
 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/log.h"
 #include "util/data/dname.h"
 #include "util/data/msgparse.h"

testcode/readhex.c

@@ -38,6 +38,7 @@
  * Declarations useful for the unit tests.
  */
 #include "config.h"
+#include <ctype.h>
 #include "testcode/readhex.h"
 #include "util/log.h"
 

testcode/readhex.h

@@ -40,6 +40,7 @@
 
 #ifndef TESTCODE_READHEX_H
 #define TESTCODE_READHEX_H
+#include "ldns/buffer.h"
 
 /** 
  * Helper to convert hex string to packet buffer.

testcode/signit.c

@@ -40,6 +40,7 @@
  * construct input to test the validator with.
  */
 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/net_help.h"

testcode/streamtcp.c

@@ -40,6 +40,10 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#include "ldns/ldns.h"
 #include <signal.h>
 #include "util/locks.h"
 #include "util/log.h"
@@ -106,7 +110,6 @@ write_q(int fd, int udp, ldns_buffer* buf, int id,
 {
 	struct query_info qinfo;
 	ldns_rdf* rdf;
-	int labs;
 	uint16_t len;
 	/* qname */
 	rdf = ldns_dname_new_frm_str(strname);
@@ -115,7 +118,7 @@ write_q(int fd, int udp, ldns_buffer* buf, int id,
 		exit(1);
 	}
 	qinfo.qname = memdup(ldns_rdf_data(rdf), ldns_rdf_size(rdf));
-	labs = dname_count_size_labels(qinfo.qname, &qinfo.qname_len);
+	(void)dname_count_size_labels(qinfo.qname, &qinfo.qname_len);
 	ldns_rdf_deep_free(rdf);
 	if(!qinfo.qname) fatal_exit("out of memory");
 

testcode/unitanchor.c

@@ -39,6 +39,7 @@
  */
 
 #include "config.h"
+#include "ldns/rr.h"
 #include "util/log.h"
 #include "util/data/dname.h"
 #include "testcode/unitmain.h"

testcode/unitdname.c

@@ -39,6 +39,8 @@
  */
 
 #include "config.h"
+#include "ldns/dname.h"
+#include "ldns/host2wire.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"
 #include "util/data/dname.h"
@@ -793,12 +795,53 @@ dname_test_valid()
 		, 4096) == 0);
 }
 
+/** test pkt_dname_tolower */
+static void
+dname_test_pdtl(ldns_buffer* loopbuf, ldns_buffer* boundbuf)
+{
+	unit_show_func("util/data/dname.c", "pkt_dname_tolower");
+	pkt_dname_tolower(loopbuf, ldns_buffer_at(loopbuf, 12));
+	pkt_dname_tolower(boundbuf, ldns_buffer_at(boundbuf, 12));
+}
+
+/** setup looped dname and out-of-bounds dname ptr */
+static void
+dname_setup_bufs(ldns_buffer* loopbuf, ldns_buffer* boundbuf)
+{
+	ldns_buffer_write_u16(loopbuf, 0xd54d);  /* id */
+	ldns_buffer_write_u16(loopbuf, 0x12);    /* flags  */
+	ldns_buffer_write_u16(loopbuf, 1);       /* qdcount */
+	ldns_buffer_write_u16(loopbuf, 0);       /* ancount */
+	ldns_buffer_write_u16(loopbuf, 0);       /* nscount */
+	ldns_buffer_write_u16(loopbuf, 0);       /* arcount */
+	ldns_buffer_write_u8(loopbuf, 0xc0); /* PTR back at itself */
+	ldns_buffer_write_u8(loopbuf, 0x0c);
+	ldns_buffer_flip(loopbuf);
+
+	ldns_buffer_write_u16(boundbuf, 0xd54d);  /* id */
+	ldns_buffer_write_u16(boundbuf, 0x12);    /* flags  */
+	ldns_buffer_write_u16(boundbuf, 1);       /* qdcount */
+	ldns_buffer_write_u16(boundbuf, 0);       /* ancount */
+	ldns_buffer_write_u16(boundbuf, 0);       /* nscount */
+	ldns_buffer_write_u16(boundbuf, 0);       /* arcount */
+	ldns_buffer_write_u8(boundbuf, 0x01); /* len=1 */
+	ldns_buffer_write_u8(boundbuf, (uint8_t)'A'); /* A. label */
+	ldns_buffer_write_u8(boundbuf, 0xc0); /* PTR out of bounds */
+	ldns_buffer_write_u8(boundbuf, 0xcc);
+	ldns_buffer_flip(boundbuf);
+}
+
 void dname_test()
 {
+	ldns_buffer* loopbuf = ldns_buffer_new(14);
+	ldns_buffer* boundbuf = ldns_buffer_new(16);
 	ldns_buffer* buff = ldns_buffer_new(65800);
+	unit_assert(loopbuf && boundbuf && buff);
 	ldns_buffer_flip(buff);
+	dname_setup_bufs(loopbuf, boundbuf);
 	dname_test_qdl(buff);
 	dname_test_qdtl(buff);
+	dname_test_pdtl(loopbuf, boundbuf);
 	dname_test_query_dname_compare();
 	dname_test_count_labels();
 	dname_test_count_size_labels();
@@ -814,4 +857,6 @@ void dname_test()
 	dname_test_topdomain();
 	dname_test_valid();
 	ldns_buffer_free(buff);
+	ldns_buffer_free(loopbuf);
+	ldns_buffer_free(boundbuf);
 }

testcode/unitmain.c

@@ -40,6 +40,22 @@
  */
 
 #include "config.h"
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
+
+#ifdef HAVE_OPENSSL_CONF_H
+#include <openssl/conf.h>
+#endif
+
+#ifdef HAVE_OPENSSL_ENGINE_H
+#include <openssl/engine.h>
+#endif
+#include "ldns/ldns.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"
 
@@ -391,7 +407,7 @@ infra_test()
 	unit_assert( infra_edns_update(slab, &one, onelen, -1, now) );
 	unit_assert( infra_host(slab, &one, onelen, 
 			now, &vs, &edns_lame, &to) );
-	unit_assert( vs == -1 && to == init*2  && edns_lame == 1);
+	unit_assert( vs == 0 && to == init*2  && edns_lame == 0);
 
 	now += cfg->host_ttl + 10;
 	unit_assert( infra_host(slab, &one, onelen, 
@@ -431,10 +447,12 @@ static void
 rnd_test()
 {
 	struct ub_randstate* r;
-	int num = 100, i;
-	long int a[100];
+	int num = 1000, i;
+	long int a[1000];
+	unsigned int seed = (unsigned)time(NULL);
 	unit_show_feature("ub_random");
-	unit_assert( (r = ub_initstate((unsigned)time(NULL), NULL)) );
+	printf("ub_random seed is %u\n", seed);
+	unit_assert( (r = ub_initstate(seed, NULL)) );
 	for(i=0; i<num; i++) {
 		a[i] = ub_random(r);
 		unit_assert(a[i] >= 0);
@@ -444,6 +462,14 @@ rnd_test()
 				a[i] != a[i-3] || a[i] != a[i-4] ||
 				a[i] != a[i-5] || a[i] != a[i-6]);
 	}
+	a[0] = ub_random_max(r, 1);
+	unit_assert(a[0] >= 0 && a[0] < 1);
+	a[0] = ub_random_max(r, 10000);
+	unit_assert(a[0] >= 0 && a[0] < 10000);
+	for(i=0; i<num; i++) {
+		a[i] = ub_random_max(r, 10);
+		unit_assert(a[i] >= 0 && a[i] < 10);
+	}
 	ub_randfree(r);
 }
 
@@ -489,6 +515,7 @@ main(int argc, char* argv[])
 	rtt_test();
 	anchors_test();
 	alloc_test();
+	regional_test();
 	lruhash_test();
 	slabhash_test();
 	infra_test();
@@ -497,7 +524,7 @@ main(int argc, char* argv[])
 	printf("%d checks ok.\n", testcount);
 #ifdef HAVE_OPENSSL_CONFIG
 	EVP_cleanup();
-	/*ENGINE_cleanup();*/
+	ENGINE_cleanup();
 	CONF_modules_free();
 #endif
 	CRYPTO_cleanup_all_ex_data();

testcode/unitmain.h

@@ -70,5 +70,7 @@ void anchors_test();
 void verify_test();
 /** unit test for negative cache functions */
 void neg_test();
+/** unit test for regional allocator functions */
+void regional_test();
 
 #endif /* TESTCODE_UNITMAIN_H */

testcode/unitmsgparse.c

@@ -39,11 +39,13 @@
  */
 
 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"
 #include "util/data/msgparse.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgencode.h"
+#include "util/data/dname.h"
 #include "util/alloc.h"
 #include "util/regional.h"
 #include "util/net_help.h"
@@ -53,6 +55,8 @@
 static int vbmp = 0;
 /** if matching within a section should disregard the order of RRs. */
 static int matches_nolocation = 0;
+/** see if RRSIGs are properly matched to RRsets. */
+static int check_rrsigs = 0;
 
 /** match two rr lists */
 static int
@@ -317,6 +321,76 @@ perftestpkt(ldns_buffer* pkt, struct alloc_cache* alloc, ldns_buffer* out,
 	regional_destroy(region);
 }
 
+/** debug print a packet that failed */
+static void
+print_packet_rrsets(struct query_info* qinfo, struct reply_info* rep)
+{
+	size_t i;
+	ldns_rr_list* l;
+	ldns_buffer* buf = ldns_buffer_new(65536);
+	log_query_info(0, "failed query", qinfo);
+	printf(";; ANSWER SECTION (%d rrsets)\n", (int)rep->an_numrrsets);
+	for(i=0; i<rep->an_numrrsets; i++) {
+		l = packed_rrset_to_rr_list(rep->rrsets[i], buf);
+		printf("; rrset %d\n", (int)i);
+		ldns_rr_list_print(stdout, l);
+		ldns_rr_list_deep_free(l);
+	}
+	printf(";; AUTHORITY SECTION (%d rrsets)\n", (int)rep->ns_numrrsets);
+	for(i=rep->an_numrrsets; i<rep->an_numrrsets+rep->ns_numrrsets; i++) {
+		l = packed_rrset_to_rr_list(rep->rrsets[i], buf);
+		printf("; rrset %d\n", (int)i);
+		ldns_rr_list_print(stdout, l);
+		ldns_rr_list_deep_free(l);
+	}
+	printf(";; ADDITIONAL SECTION (%d rrsets)\n", (int)rep->ar_numrrsets);
+	for(i=rep->an_numrrsets+rep->ns_numrrsets; i<rep->rrset_count; i++) {
+		l = packed_rrset_to_rr_list(rep->rrsets[i], buf);
+		printf("; rrset %d\n", (int)i);
+		ldns_rr_list_print(stdout, l);
+		ldns_rr_list_deep_free(l);
+	}
+	printf(";; packet end\n");
+	ldns_buffer_free(buf);
+}
+
+/** check that there is no data element that matches the RRSIG */
+static int
+no_data_for_rrsig(struct reply_info* rep, struct ub_packed_rrset_key* rrsig)
+{
+	size_t i;
+	for(i=0; i<rep->rrset_count; i++) {
+		if(ntohs(rep->rrsets[i]->rk.type) == LDNS_RR_TYPE_RRSIG)
+			continue;
+		if(query_dname_compare(rep->rrsets[i]->rk.dname, 
+			rrsig->rk.dname) == 0)
+			/* only name is compared right now */
+			return 0;
+	}
+	return 1;
+}
+
+/** check RRSIGs in packet */
+static void
+check_the_rrsigs(struct query_info* qinfo, struct reply_info* rep)
+{
+	/* every RRSIG must be matched to an RRset */
+	size_t i;
+	for(i=0; i<rep->rrset_count; i++) {
+		struct ub_packed_rrset_key* s = rep->rrsets[i];
+		if(ntohs(s->rk.type) == LDNS_RR_TYPE_RRSIG) {
+			/* see if really a problem, i.e. is there a data
+			 * element. */
+			if(no_data_for_rrsig(rep, rep->rrsets[i]))
+				continue;
+			log_dns_msg("rrsig failed for packet", qinfo, rep);
+			print_packet_rrsets(qinfo, rep);
+			printf("failed rrset is nr %d\n", (int)i);
+			unit_assert(0);
+		}
+	}
+}
+
 /** test a packet */
 static void
 testpkt(ldns_buffer* pkt, struct alloc_cache* alloc, ldns_buffer* out, 
@@ -354,6 +428,8 @@ testpkt(ldns_buffer* pkt, struct alloc_cache* alloc, ldns_buffer* out,
 			(unsigned)ldns_buffer_limit(pkt),
 			(unsigned)ldns_buffer_limit(out));
 		test_buffers(pkt, out);
+		if(check_rrsigs)
+			check_the_rrsigs(&qi, rep);
 
 		if(ldns_buffer_limit(out) > lim) {
 			ret = reply_info_encode(&qi, rep, id, flags, out, 
@@ -518,7 +594,9 @@ void msgparse_test()
 
 	matches_nolocation = 1; /* RR order not important for the next test */
 	testfromdrillfile(pkt, &alloc, out, "testdata/test_packets.6");
+	check_rrsigs = 1;
 	testfromdrillfile(pkt, &alloc, out, "testdata/test_packets.7");
+	check_rrsigs = 0;
 	matches_nolocation = 0; 
 
 	/* cleanup */

testcode/unitregional.c

@@ -0,0 +1,244 @@
+/*
+ * testcode/unitregional.c - unit test for regional allocator.
+ *
+ * Copyright (c) 2010, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+/**
+ * \file
+ * Tests the regional special purpose allocator.
+ */
+
+#include "config.h"
+#include "testcode/unitmain.h"
+#include "util/log.h"
+#include "util/regional.h"
+
+/** test regional corner cases, zero, one, end of structure */
+static void
+corner_cases(struct regional* r)
+{
+	size_t s; /* shadow count of allocated memory */
+	void* a;
+	size_t minsize = sizeof(uint64_t);
+	size_t mysize;
+	char* str;
+	unit_assert(r);
+	/* alloc cases:
+	 * 0, 1, 2.
+	 * smaller than LARGE_OBJECT_SIZE.
+	 * smaller but does not fit in remainder in regional.
+	 * smaller but exactly fits in remainder of regional.
+	 * size is remainder of regional - 8.
+	 * size is remainder of regional + 8.
+	 * larger than LARGE_OBJECT_SIZE.
+	 */
+	s = sizeof(struct regional);
+	unit_assert((s % minsize) == 0);
+	unit_assert(r->available == r->first_size - s);
+	unit_assert(r->large_list == NULL);
+	unit_assert(r->next == NULL);
+
+	/* Note an alloc of 0 gets a pointer to current last
+	 * position (where you should then use 0 bytes) */
+	a = regional_alloc(r, 0);
+	unit_assert(a);
+	s+=0;
+	unit_assert(r->available == r->first_size - s);
+
+	a = regional_alloc(r, 1);
+	unit_assert(a);
+	memset(a, 0x42, 1);
+	s+=minsize;
+	unit_assert(r->available == r->first_size - s);
+
+	a = regional_alloc(r, 2);
+	unit_assert(a);
+	memset(a, 0x42, 2);
+	s+=minsize;
+	unit_assert(r->available == r->first_size - s);
+
+	a = regional_alloc(r, 128);
+	unit_assert(a);
+	memset(a, 0x42, 128);
+	s+=128;
+	unit_assert(r->available == r->first_size - s);
+
+	unit_assert(r->large_list == NULL);
+	a = regional_alloc(r, 10240);
+	unit_assert(a);
+	unit_assert(r->large_list != NULL);
+	memset(a, 0x42, 10240);
+	/* s does not change */
+	unit_assert(r->available == r->first_size - s);
+	unit_assert(r->total_large == 10240+minsize);
+
+	/* go towards the end of the current chunk */
+	while(r->available > 1024) {
+		a = regional_alloc(r, 1024);
+		unit_assert(a);
+		memset(a, 0x42, 1024);
+		s += 1024;
+		unit_assert(r->available == r->first_size - s);
+	}
+
+	unit_assert(r->next == NULL);
+	mysize = 1280; /* does not fit in current chunk */
+	a = regional_alloc(r, mysize);
+	memset(a, 0x42, mysize);
+	unit_assert(r->next != NULL);
+	unit_assert(a);
+
+	/* go towards the end of the current chunk */
+	while(r->available > 864) {
+		a = regional_alloc(r, 864);
+		unit_assert(a);
+		memset(a, 0x42, 864);
+		s += 864;
+	}
+
+	mysize = r->available; /* exactly fits */
+	a = regional_alloc(r, mysize);
+	memset(a, 0x42, mysize);
+	unit_assert(a);
+	unit_assert(r->available == 0); /* implementation does not go ahead*/
+
+	a = regional_alloc(r, 8192); /* another large allocation */
+	unit_assert(a);
+	memset(a, 0x42, 8192);
+	unit_assert(r->available == 0);
+	unit_assert(r->total_large == 10240 + 8192 + 2*minsize);
+
+	a = regional_alloc(r, 32); /* make new chunk */
+	unit_assert(a);
+	memset(a, 0x42, 32);
+	unit_assert(r->available > 0);
+	unit_assert(r->total_large == 10240 + 8192 + 2*minsize);
+
+	/* go towards the end of the current chunk */
+	while(r->available > 1320) {
+		a = regional_alloc(r, 1320);
+		unit_assert(a);
+		memset(a, 0x42, 1320);
+		s += 1320;
+	}
+
+	mysize = r->available + 8; /* exact + 8 ; does not fit */
+	a = regional_alloc(r, mysize);
+	memset(a, 0x42, mysize);
+	unit_assert(a);
+	unit_assert(r->available > 0); /* new chunk */
+
+	/* go towards the end of the current chunk */
+	while(r->available > 1480) {
+		a = regional_alloc(r, 1480);
+		unit_assert(a);
+		memset(a, 0x42, 1480);
+		s += 1480;
+	}
+
+	mysize = r->available - 8; /* exact - 8 ; fits. */
+	a = regional_alloc(r, mysize);
+	memset(a, 0x42, mysize);
+	unit_assert(a);
+	unit_assert(r->available == 8);
+
+	/* test if really copied over */
+	str = "test12345";
+	a = regional_alloc_init(r, str, 8);
+	unit_assert(a);
+	unit_assert(memcmp(a, str, 8) == 0);
+
+	/* test if really zeroed */
+	a = regional_alloc_zero(r, 32);
+	str="\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
+	unit_assert(a);
+	unit_assert(memcmp(a, str, 32) == 0);
+
+	/* test if copied over (and null byte) */
+	str = "an interesting string";
+	a = regional_strdup(r, str);
+	unit_assert(a);
+	unit_assert(memcmp(a, str, strlen(str)+1) == 0);
+
+	regional_free_all(r);
+}
+
+/** test specific cases */
+static void
+specific_cases()
+{
+	struct regional* r = regional_create();
+	corner_cases(r);
+	regional_destroy(r);
+	r = regional_create_custom(2048); /* a small regional */
+	unit_assert(r->first_size == 2048);
+	unit_assert(regional_get_mem(r) == 2048);
+	corner_cases(r);
+	unit_assert(regional_get_mem(r) == 2048);
+	regional_destroy(r);
+}
+
+/** put random stuff in a region and free it */
+static void
+burden_test(size_t max)
+{
+	size_t get;
+	void* a;
+	int i;
+	struct regional* r = regional_create_custom(2048);
+	for(i=0; i<1000; i++) {
+		get = random() % max;
+		a = regional_alloc(r, get);
+		unit_assert(a);
+		memset(a, 0x54, get);
+	}
+	regional_free_all(r);
+	regional_destroy(r);
+}
+
+/** randomly allocate stuff */
+static void
+random_burden()
+{
+	size_t max_alloc = 2048 + 128; /* small chance of LARGE */
+	int i;
+	for(i=0; i<100; i++)
+		burden_test(max_alloc);
+}
+
+void regional_test()
+{
+	unit_show_feature("regional");
+	specific_cases();
+	random_burden();
+}

testdata/Kexample.com.+012+60385.ds

@@ -0,0 +1 @@
+example.com.	3600	IN	DS	60385 12 3 c93b6fd6893d42ae60acd15088c2aeea0e0f013e535961855f17299507f70e0d ; xudef-ririt-kidaf-tebyp-vemep-segih-bydes-dyriv-pofab-zibaf-vigyh-numom-halac-lypin-hycaz-lofub-taxex

testdata/Kexample.com.+012+60385.key

@@ -0,0 +1 @@
+example.com.	3600	IN	DNSKEY	256 3 12 9SZY+xB3wKtrLoRHzkBs9L3fjcvazjnk5HF3gMaD1PVp4pthrwgHIm0TUaLrd3YCa2VCl5wj+MzbhZi8NEJ/Cg== ;{id = 60385 (zsk), size = 512b}

testdata/Kexample.com.+012+60385.private

@@ -0,0 +1,3 @@
+Private-key-format: v1.2
+Algorithm: 12 (ECC-GOST)
+GostAsn1: MEUCAQAwHAYGKoUDAgITMBIGByqFAwICIwEGByqFAwICHgEEIgIge0NaZG76WD9K6vNRD1yDuVPtKlEtFQbHIjoB106B6Hc=

testdata/Kexample.com.+249+41929.ds

@@ -1 +0,0 @@
-example.com.	3600	IN	DS	41929 249 203 10e2bc48d0301d16858bd040ee7d5c1983122d6cec0e3324fcdb94ba5ac0f748 ; xegav-dozog-mugef-bolyc-kicem-rygug-borel-tulyc-nibuc-dyryk-serub-vasud-gazut-rihyr-pykis-bytyg-myxyx

testdata/Kexample.com.+249+41929.key

@@ -1 +0,0 @@
-example.com.    3600    IN      DNSKEY  256 3 249 AAB7oZ5Ox8mcGrhB4vh41LdJQ5i+MVbn0KVe1a0CU2Akdwbp1qZ2khQTJZ0wOFkEsmgU2wfggXTpU8rp745IDVUb ;{id = 41929 (zsk), size = 512b}

testdata/Kexample.com.+249+41929.private

@@ -1,3 +0,0 @@
-Private-key-format: v1.2
-Algorithm: 249 (GOST)
-GostAsn1: MEUCAQAwHAYGKoUDAgITMBIGByqFAwICIwEGByqFAwICHgEEIgIgZdfQ+s3ASjjFsne42OdGYxav0QKoL3p/wOX/3kySQ3Q=

testdata/autotrust_addpend_early.rpl

@@ -138,6 +138,14 @@ example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20091024111500 20090921111500 30899
 example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20091024111500 20090921111500 60946 example.com. qBHDZu0XQmr6kpt51r1DxT5tuyfwSHcoL8qLpwwhyyNFF13OPlvxgmCVl+1v27A9+h8tcuqaNls5f+tcFBwtRg== ;{id = 60946}
 ENTRY_END
 
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA REFUSED
+SECTION QUESTION
+ns.example.com. IN A
+ENTRY_END
+
 ENTRY_BEGIN
 MATCH opcode qname qtype
 ADJUST copy_id

testdata/autotrust_addpend_nosign.rpl

@@ -142,6 +142,14 @@ example.com.    10800   IN      RRSIG   DNSKEY 5 2 10800 20091024111500 20090921
 example.com.    10800   IN      RRSIG   DNSKEY 5 2 10800 20091024111500 20090921111500 60946 example.com. o+Cbs7DcYPYlSLd4hi3vkSVQpXGnKgKSi9MpHGfu1Uahv5190U2DUOxP1du/HOYbf+IHYL8zLbMZjVEG5wgnTg== ;{id = 60946}
 ENTRY_END
 
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA REFUSED
+SECTION QUESTION
+ns.example.com. IN A
+ENTRY_END
+
 ENTRY_BEGIN
 MATCH opcode qname qtype
 ADJUST copy_id

testdata/autotrust_addpend_nosignnew.rpl

@@ -143,6 +143,14 @@ example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20091024111500 20090921111500 30899
 example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20091024111500 20090921111500 60946 example.com. rOxbAROwiW21OR8HjINk3IBs9bsxJKjipQ5EU4wWutiF/jr6KNT6LgtZv0TaFSiBHN/Jqz1wB2ODD2HXwLQ4DQ== ;{id = 60946}
 ENTRY_END
 
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA REFUSED
+SECTION QUESTION
+ns.example.com. IN A
+ENTRY_END
+
 ENTRY_BEGIN
 MATCH opcode qname qtype
 ADJUST copy_id

testdata/autotrust_addpend_once.rpl

@@ -141,6 +141,14 @@ example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20091124111500 20091018111500 30899
 example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20091124111500 20091018111500 60946 example.com. HgXol1hdvbomOM1CFRW8qsHd3D0qOnN72EeMHTcpxIBBiuNLKZn4n1M14Voxj3vo0eAMNuG/y7EjQkxKvSsaDA== ;{id = 60946}
 ENTRY_END
 
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA REFUSED
+SECTION QUESTION
+ns.example.com. IN A
+ENTRY_END
+
 ENTRY_BEGIN
 MATCH opcode qname qtype
 ADJUST copy_id

testdata/autotrust_init_fail.rpl

@@ -76,6 +76,21 @@ example.com.	3600	IN	RRSIG	NS 5 2 3600 20090924111500 20090821111500 30899 examp
 SECTION ADDITIONAL
 ENTRY_END
 
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA
+SECTION QUESTION
+ns.example.com. IN A
+SECTION ANSWER
+ns.example.com.	3600	IN	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20090924111500 20090821111500 30899 example.com. JsXbS18oyc0zkVaOWGSFdIQuOsZKflT0GraT9afDPoWLCgH4ApF7jNgfJV7Pqy1sTBRajME5IUAhpANwGBuW4A== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	3600	IN	NS	ns.example.com.
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20090924111500 20090821111500 30899 example.com. J5wxRq0jgwQL6yy530kvo9cHqNAUHV8IF4dvaYZL0bNraO2Oe6dVXqlJl4+cxNHI2TMsstwFPr2Zz8tv6Az2mQ== ;{id = 30899}
+SECTION ADDITIONAL
+ENTRY_END
+
 ENTRY_BEGIN
 MATCH opcode qname qtype
 ADJUST copy_id

testdata/autotrust_init_zsk.rpl

@@ -0,0 +1,180 @@
+; config options
+server:
+	target-fetch-policy: "0 0 0 0 0"
+	log-time-ascii: yes
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129         # K.ROOT-SERVERS.NET.
+; initial content (say from dig example.com DNSKEY > example.com.key) 
+AUTOTRUST_FILE example.com
+example.com.	10800	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (zsk), size = 512b}
+AUTOTRUST_END
+CONFIG_END
+
+SCENARIO_BEGIN Test autotrust with initial trust anchor ZSK
+
+; K-ROOT
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id copy_query
+REPLY QR AA
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS k.root-servers.net.
+SECTION ADDITIONAL
+k.root-servers.net IN A 193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR
+SECTION QUESTION
+com. IN NS
+SECTION AUTHORITY
+com. IN NS a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net. IN A 192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode subdomain
+ADJUST copy_id copy_query
+REPLY QR
+SECTION QUESTION
+example.com. IN NS
+SECTION AUTHORITY
+example.com. IN NS ns.example.com.
+SECTION ADDITIONAL
+ns.example.com. IN A 1.2.3.4
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com.	3600	IN	A	10.20.30.40
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20090924111500 20090821111500 30899 example.com. pYGxVLsWUvOp1wSf0iwPap+JnECfC5GAm1lRqy3YEqecNGld7U7x/5Imo3CerbdZrVptUQs2oH0lcjwYJXMnsw== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	3600	IN	NS	ns.example.com.
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20090924111500 20090821111500 30899 example.com. J5wxRq0jgwQL6yy530kvo9cHqNAUHV8IF4dvaYZL0bNraO2Oe6dVXqlJl4+cxNHI2TMsstwFPr2Zz8tv6Az2mQ== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.	3600	IN	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20090924111500 20090821111500 30899 example.com. JsXbS18oyc0zkVaOWGSFdIQuOsZKflT0GraT9afDPoWLCgH4ApF7jNgfJV7Pqy1sTBRajME5IUAhpANwGBuW4A== ;{id = 30899}
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+; KSK 1
+example.com.	10800	IN	DNSKEY	257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b}
+; ZSK 1
+example.com.	10800	IN	DNSKEY	256 3 5 AQPQ41chR9DEHt/aIzIFAqanbDlRflJoRs5yz1jFsoRIT7dWf0r+PeDuewdxkszNH6wnU4QL8pfKFRh5PIYVBLK3 ;{id = 30899 (ksk), size = 512b}
+; signatures
+example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20090924111500 20090821111500 30899 example.com. b/HK231jIQLX8IhlZfup3r0yhpXaasbPE6LzxoEVVvWaTZWcLmeV8jDIcn0qO7Yvs7bIJN20lwVAV0GcHH3hWQ== ;{id = 30899}
+example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20090924111500 20090821111500 55582 example.com. PCHme1QLoULxqjhg5tMlpR0qJlBfstEUVq18TtNoKQe9le1YhJ9caheXcTWoK+boLhXxg9u6Yyvq8FboQh0OjA== ;{id = 55582}
+
+ENTRY_END
+RANGE_END
+
+; set date/time to Aug 24 09:46:40  (2009).
+STEP 5 TIME_PASSES ELAPSE 1251100000
+STEP 6 ASSIGN t0 = ${time}
+; get probe time and check it. 4800 is about 10% less than 5400. And more than
+; the 3600 that a failure timeout would have.
+STEP 7 ASSIGN probe = ${range 4800 ${timeout} 5400}
+
+
+; the auto probing should have been done now.
+STEP 8 CHECK_AUTOTRUST example.com
+FILE_BEGIN
+; autotrust trust anchor file
+;;id: example.com. 1
+;;last_queried: 1251100000 ;;Mon Aug 24 09:46:40 2009
+;;last_success: 1251100000 ;;Mon Aug 24 09:46:40 2009
+;;next_probe_time: ${$t0 + $probe} ;;${ctime $t0 + $probe}
+;;query_failed: 0
+;;query_interval: 5400
+;;retry_time: 3600
+example.com.	10800	IN	DNSKEY	257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1251100000 ;;Mon Aug 24 09:46:40 2009
+FILE_END
+
+
+STEP 10 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+STEP 20 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+www.example.com.	3600	IN	A	10.20.30.40
+www.example.com.	3600	IN	RRSIG	A 5 3 3600 20090924111500 20090821111500 30899 example.com. pYGxVLsWUvOp1wSf0iwPap+JnECfC5GAm1lRqy3YEqecNGld7U7x/5Imo3CerbdZrVptUQs2oH0lcjwYJXMnsw== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	3600	IN	NS	ns.example.com.
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20090924111500 20090821111500 30899 example.com. J5wxRq0jgwQL6yy530kvo9cHqNAUHV8IF4dvaYZL0bNraO2Oe6dVXqlJl4+cxNHI2TMsstwFPr2Zz8tv6Az2mQ== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.	3600	IN	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20090924111500 20090821111500 30899 example.com. JsXbS18oyc0zkVaOWGSFdIQuOsZKflT0GraT9afDPoWLCgH4ApF7jNgfJV7Pqy1sTBRajME5IUAhpANwGBuW4A== ;{id = 30899}
+ENTRY_END
+
+; The autotrust anchor was probed due to the query.
+
+STEP 30 CHECK_AUTOTRUST example.com
+FILE_BEGIN
+; autotrust trust anchor file
+;;id: example.com. 1
+;;last_queried: 1251100000 ;;Mon Aug 24 09:46:40 2009
+;;last_success: 1251100000 ;;Mon Aug 24 09:46:40 2009
+;;next_probe_time: ${$t0 + $probe} ;;${ctime $t0 + $probe}
+;;query_failed: 0
+;;query_interval: 5400
+;;retry_time: 3600
+example.com.	10800	IN	DNSKEY	257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1251100000 ;;Mon Aug 24 09:46:40 2009
+FILE_END
+
+; wait and see if autotrust probes (the unchanged) domain again.
+STEP 40 TIME_PASSES EVAL ${$probe}
+
+STEP 50 TRAFFIC
+
+STEP 65 ASSIGN probe2 = ${range 4800 ${timeout} 5400}
+
+STEP 70 CHECK_AUTOTRUST example.com
+FILE_BEGIN
+; autotrust trust anchor file
+;;id: example.com. 1
+;;last_queried: ${time} ;;${ctime ${time}}
+;;last_success: ${time} ;;${ctime ${time}}
+;;next_probe_time: ${$t0 + $probe + $probe2} ;;${ctime $t0 + $probe + $probe2}
+;;query_failed: 0
+;;query_interval: 5400
+;;retry_time: 3600
+example.com.	10800	IN	DNSKEY	257 3 5 AwEAAc3Z5DQDJpH4oPdNtC4BUQHk50XMD+dHr4r8psHmivIa83hxR5CRgCtd9sENCW9Ae8OIO19xw9t/RPaEAqQa+OE= ;{id = 55582 (ksk), size = 512b} ;;state=2 [  VALID  ] ;;count=0 ;;lastchange=1251100000 ;;Mon Aug 24 09:46:40 2009
+FILE_END
+
+SCENARIO_END

testdata/autotrust_probefail.rpl

@@ -77,6 +77,21 @@ ns.example.com. IN AAAA
 SECTION ANSWER
 ENTRY_END
 
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA
+SECTION QUESTION
+ns.example.com. IN A
+SECTION ANSWER
+ns.example.com.	3600	IN	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20090924111500 20090821111500 30899 example.com. JsXbS18oyc0zkVaOWGSFdIQuOsZKflT0GraT9afDPoWLCgH4ApF7jNgfJV7Pqy1sTBRajME5IUAhpANwGBuW4A== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	3600	IN	NS	ns.example.com.
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20090924111500 20090821111500 30899 example.com. J5wxRq0jgwQL6yy530kvo9cHqNAUHV8IF4dvaYZL0bNraO2Oe6dVXqlJl4+cxNHI2TMsstwFPr2Zz8tv6Az2mQ== ;{id = 30899}
+SECTION ADDITIONAL
+ENTRY_END
+
 ENTRY_BEGIN
 MATCH opcode qname qtype
 ADJUST copy_id

testdata/autotrust_probefailsig.rpl

@@ -96,7 +96,7 @@ example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20090101011500 20090101011500 16614
 ENTRY_END
 
 ENTRY_BEGIN
-MATCH opcode subdomain
+MATCH opcode qtype qname
 ADJUST copy_id copy_query
 REPLY QR
 SECTION QUESTION
@@ -104,7 +104,14 @@ www.example.com. IN A
 SECTION ANSWER
 www.example.com. IN A 10.20.30.40
 ENTRY_END
-RANGE_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA REFUSED
+SECTION QUESTION
+ns.example.com. IN A
+ENTRY_END
 
 ENTRY_BEGIN
 MATCH opcode qname qtype

testdata/autotrust_revoked_use.rpl

@@ -189,6 +189,14 @@ example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20091224111500 20091118111500 55582
 
 ENTRY_END
 
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA REFUSED
+SECTION QUESTION
+ns.example.com. IN A
+ENTRY_END
+
 ENTRY_BEGIN
 MATCH opcode qname qtype
 ADJUST copy_id
@@ -220,6 +228,14 @@ example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20091224111500 20091118111500 30899
 example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20091224111500 20091118111500 55582 example.com. NsC5s2quifzA7yQBnbroWHJ9rHfSrBo0V7+c+kZoii2cViOm8636uqcWlaNTqNtD5UI6vzQ5zXF4P8JGoac6ZQ== ;{id = 55582}
 ENTRY_END
 
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA REFUSED
+SECTION QUESTION
+ns.example.com. IN A
+ENTRY_END
+
 ENTRY_BEGIN
 MATCH opcode qname qtype
 ADJUST copy_id

testdata/autotrust_revoked_with_invalid.rpl

@@ -86,6 +86,14 @@ example.com.	10800	IN	RRSIG	DNSKEY 5 2 10800 20091124111500 20091018111500 16486
 
 ENTRY_END
 
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA REFUSED
+SECTION QUESTION
+ns.example.com. IN A
+ENTRY_END
+
 ENTRY_BEGIN
 MATCH opcode qname qtype
 ADJUST copy_id

testdata/autotrust_valid_use.rpl

@@ -141,6 +141,35 @@ RANGE_END
 ; ns.example.com.  KSK 55582 and 60946 (signatures updated)
 RANGE_BEGIN 41 50
 	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA
+SECTION QUESTION
+ns.example.com. IN A
+SECTION ANSWER
+ns.example.com.	3600	IN	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20090924111500 20090821111500 30899 example.com. JsXbS18oyc0zkVaOWGSFdIQuOsZKflT0GraT9afDPoWLCgH4ApF7jNgfJV7Pqy1sTBRajME5IUAhpANwGBuW4A== ;{id = 30899}
+SECTION AUTHORITY
+example.com.	3600	IN	NS	ns.example.com.
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20090924111500 20090821111500 30899 example.com. J5wxRq0jgwQL6yy530kvo9cHqNAUHV8IF4dvaYZL0bNraO2Oe6dVXqlJl4+cxNHI2TMsstwFPr2Zz8tv6Az2mQ== ;{id = 30899}
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qname qtype
+ADJUST copy_id
+REPLY QR AA
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+SECTION AUTHORITY
+example.com.	3600	IN	NS	ns.example.com.
+example.com.	3600	IN	RRSIG	NS 5 2 3600 20090924111500 20090821111500 30899 example.com. J5wxRq0jgwQL6yy530kvo9cHqNAUHV8IF4dvaYZL0bNraO2Oe6dVXqlJl4+cxNHI2TMsstwFPr2Zz8tv6Az2mQ== ;{id = 30899}
+SECTION ADDITIONAL
+ns.example.com.	3600	IN	A	1.2.3.4
+ns.example.com.	3600	IN	RRSIG	A 5 3 3600 20090924111500 20090821111500 30899 example.com. JsXbS18oyc0zkVaOWGSFdIQuOsZKflT0GraT9afDPoWLCgH4ApF7jNgfJV7Pqy1sTBRajME5IUAhpANwGBuW4A== ;{id = 30899}
+ENTRY_END
 
 ENTRY_BEGIN
 MATCH opcode qname qtype