tag 1.4.4rc1

git-svn-id: file:///svn/unbound/trunk@2084 be551aaa-1e26-0410-a405-d3ace91eadb9

Makefile.in

@@ -74,6 +74,14 @@ LINT=splint
 LINTFLAGS=+quiet -weak -warnposix -unrecog -Din_addr_t=uint32_t -Du_int=unsigned -Du_char=uint8_t -preproc -Drlimit=rlimit64 -D__gnuc_va_list=va_list -Dglob64=glob -Dglobfree64=globfree
 # compat with openssl linux edition.
 LINTFLAGS+="-DBN_ULONG=unsigned long" -Dkrb5_int32=int "-Dkrb5_ui_4=unsigned int" -DPQ_64BIT=uint64_t -DRC4_INT=unsigned -fixedformalarray
+# compat with NetBSD
+ifeq "$(shell uname)" "NetBSD"
+LINTFLAGS+="-D__RENAME(x)=" -D_NETINET_IN_H_
+endif
+# compat with OpenBSD
+LINTFLAGS+="-Dsigset_t=long"
+# FreeBSD8
+LINTFLAGS+="-D__uint16_t=uint16_t"
 
 INSTALL=$(srcdir)/install-sh
 ifeq "$(WITH_PYTHONMODULE)" "yes"

config.h.in

@@ -653,26 +653,6 @@
 #include <ws2tcpip.h>
 #endif
 
-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ERR_H
-#include <openssl/err.h>
-#endif
-
-#ifdef HAVE_OPENSSL_RAND_H
-#include <openssl/rand.h>
-#endif
-
-#ifdef HAVE_OPENSSL_CONF_H
-#include <openssl/conf.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ENGINE_H
-#include <openssl/engine.h>
-#endif
-
 
  
 #ifdef HAVE_ATTR_FORMAT
@@ -819,8 +799,6 @@ struct sockaddr_storage;
 #include "compat/fake-rfc2553.h"
 #endif
 
-#include "ldns/ldns.h"
-
 #ifdef UNBOUND_ALLOC_STATS
 #  define malloc(s) unbound_stat_malloc_log(s, __FILE__, __LINE__, __func__)
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)

configure.ac

@@ -6,10 +6,10 @@ sinclude(acx_pthread.m4)
 sinclude(acx_python.m4)
 sinclude(ac_pkg_swig.m4)
 
-AC_INIT(unbound, 1.4.3, unbound-bugs@nlnetlabs.nl, unbound)
+AC_INIT(unbound, 1.4.4, unbound-bugs@nlnetlabs.nl, unbound)
 
 LIBUNBOUND_CURRENT=2
-LIBUNBOUND_REVISION=3
+LIBUNBOUND_REVISION=4
 LIBUNBOUND_AGE=0
 # 1.0.0 had 0:12:0
 # 1.0.1 had 0:13:0
@@ -28,6 +28,7 @@ LIBUNBOUND_AGE=0
 # 1.4.1 had 2:1:0
 # 1.4.2 had 2:2:0
 # 1.4.3 had 2:3:0
+# 1.4.4 had 2:4:0
 
 #   Current  -- the number of the binary API that we're implementing
 #   Revision -- which iteration of the implementation of the binary
@@ -231,6 +232,20 @@ ACX_CHECK_MEMCMP_SIGNED
 
 # add option to disable the evil rpath
 ACX_ARG_RPATH
+AC_SUBST(RUNTIME_PATH)
+
+# check to see if libraries are needed for these functions.
+AC_SEARCH_LIBS([inet_pton], [nsl])
+AC_SEARCH_LIBS([socket], [socket])
+
+# check some functions of the OS before linking libs (while still runnable).
+AC_FUNC_CHOWN
+AC_FUNC_FORK
+AC_TYPE_SIGNAL
+AC_FUNC_FSEEKO
+ACX_SYS_LARGEFILE
+ACX_CHECK_NONBLOCKING_BROKEN
+ACX_MKDIR_ONE_ARG
 
 # check for thread library.
 # check this first, so that the pthread lib does not get linked in via
@@ -320,6 +335,7 @@ if test x_$ub_test_python != x_no; then
 
    # Check for Python
    ub_have_python=no
+   ac_save_LIBS="$LIBS" dnl otherwise AC_PYTHON_DEVEL thrashes $LIBS
    AC_PYTHON_DEVEL
    if test ! -z "$PYTHON_VERSION"; then
 	if test `$PYTHON -c "print '$PYTHON_VERSION' >= '2.4.0'"` = "False"; then
@@ -404,19 +420,13 @@ esac
 AC_ARG_ENABLE(gost, AC_HELP_STRING([--enable-gost], [Enable GOST support, experimental]))
 case "$enable_gost" in
 	yes)
-	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL >= 1.0.0 is needed for GOST support])])
+	AC_CHECK_FUNC(EVP_PKEY_set_type_str, [:],[AC_MSG_ERROR([OpenSSL >= 1.0.0 is needed for GOST support, upgrade openssl or rerun with --disable-gost])])
 	AC_DEFINE([USE_GOST], [1], [Define this to enable GOST support.])
 	;;
 	no|*)
 	;;
 esac
 
-# check to see if libraries are needed for these functions.
-AC_SEARCH_LIBS([inet_pton], [nsl])
-AC_SEARCH_LIBS([socket], [socket])
-
-AC_SUBST(RUNTIME_PATH)
-
 # check for libevent
 AC_ARG_WITH(libevent, AC_HELP_STRING([--with-libevent=pathname],
     [use libevent (will check /usr/local /opt/local /usr/lib /usr/pkg /usr/sfw /usr  or you can specify an explicit path). Slower, but allows use of large outgoing port ranges.]),
@@ -537,12 +547,6 @@ else
 	fi
 fi
 
-AC_FUNC_CHOWN
-AC_FUNC_FORK
-AC_TYPE_SIGNAL
-AC_FUNC_FSEEKO
-ACX_SYS_LARGEFILE
-
 ACX_CHECK_GETADDRINFO_WITH_INCLUDES
 if test "$USE_WINSOCK" = 1; then
 	AC_DEFINE(UB_ON_WINDOWS, 1, [Use win32 resources and API])
@@ -557,6 +561,8 @@ fi
 if test $ac_cv_func_getaddrinfo = no; then
 	AC_LIBOBJ([fake-rfc2553])
 fi
+# check after getaddrinfo for its libraries
+ACX_FUNC_IOCTLSOCKET
 
 # see if daemon(3) exists, and if it is deprecated.
 AC_CHECK_FUNCS([daemon])
@@ -567,15 +573,14 @@ if test $ac_cv_func_daemon = yes; then
 fi
 
 AC_SEARCH_LIBS([setusercontext], [util])
-AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev setresuid setreuid setresgid setregid glob initgroups strftime localtime_r setusercontext _beginthreadex])
+AC_CHECK_FUNCS([tzset sigprocmask fcntl getpwnam getrlimit setsid sbrk chroot kill sleep usleep random srandom recvmsg sendmsg writev glob initgroups strftime localtime_r setusercontext _beginthreadex])
+AC_CHECK_FUNCS([setresuid],,[AC_CHECK_FUNCS([setreuid])])
+AC_CHECK_FUNCS([setresgid],,[AC_CHECK_FUNCS([setregid])])
 
 # check if setreuid en setregid fail, on MacOSX10.4(darwin8).
 if echo $build_os | grep darwin8 > /dev/null; then
 	AC_DEFINE(DARWIN_BROKEN_SETREUID, 1, [Define this if on macOSX10.4-darwin8 and setreuid and setregid do not work])
 fi
-ACX_CHECK_NONBLOCKING_BROKEN
-ACX_MKDIR_ONE_ARG
-ACX_FUNC_IOCTLSOCKET
 AC_REPLACE_FUNCS(inet_aton)
 AC_REPLACE_FUNCS(inet_pton)
 AC_REPLACE_FUNCS(inet_ntop)
@@ -699,26 +704,6 @@ dnl includes
 #ifdef HAVE_WS2TCPIP_H
 #include <ws2tcpip.h>
 #endif
-
-#ifdef HAVE_GETOPT_H
-#include <getopt.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ERR_H
-#include <openssl/err.h>
-#endif
-
-#ifdef HAVE_OPENSSL_RAND_H
-#include <openssl/rand.h>
-#endif
-
-#ifdef HAVE_OPENSSL_CONF_H
-#include <openssl/conf.h>
-#endif
-
-#ifdef HAVE_OPENSSL_ENGINE_H
-#include <openssl/engine.h>
-#endif
 ]
 
 AHX_CONFIG_FORMAT_ATTRIBUTE
@@ -767,8 +752,6 @@ struct sockaddr_storage;
 #include "compat/fake-rfc2553.h"
 #endif
 
-#include "ldns/ldns.h"
-
 #ifdef UNBOUND_ALLOC_STATS
 #  define malloc(s) unbound_stat_malloc_log(s, __FILE__, __LINE__, __func__)
 #  define calloc(n,s) unbound_stat_calloc_log(n, s, __FILE__, __LINE__, __func__)

contrib/unbound.spec

@@ -1,6 +1,6 @@
 Summary: Validating, recursive, and caching DNS resolver
 Name: unbound
-Version: 1.0.1
+Version: 1.4.4
 Release: 1%{?dist}
 License: BSD
 Url: http://www.nlnetlabs.nl/unbound/

daemon/cachedump.c

@@ -40,6 +40,7 @@
  * to text format.
  */
 #include "config.h"
+#include "ldns/ldns.h"
 #include "daemon/cachedump.h"
 #include "daemon/remote.h"
 #include "daemon/worker.h"

daemon/daemon.c

@@ -40,6 +40,22 @@
  */
 
 #include "config.h"
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
+
+#ifdef HAVE_OPENSSL_CONF_H
+#include <openssl/conf.h>
+#endif
+
+#ifdef HAVE_OPENSSL_ENGINE_H
+#include <openssl/engine.h>
+#endif
+#include "ldns/ldns.h"
 #include "daemon/daemon.h"
 #include "daemon/worker.h"
 #include "daemon/remote.h"
@@ -276,7 +292,7 @@ int daemon_get_shufport(struct daemon* daemon, int* shufport)
         /* Knuth shuffle */
 	n = avail;
 	while(--n > 0) {
-		k = ub_random(daemon->rand) % (n+1); /* 0<= k<= n */
+		k = ub_random_max(daemon->rand, n+1); /* 0<= k<= n */
 		temp = shufport[k];
 		shufport[k] = shufport[n];
 		shufport[n] = temp;

daemon/remote.c

@@ -43,6 +43,11 @@
  * Both the server and the client(control tool) have their own keys.
  */
 #include "config.h"
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+#include <ctype.h>
+#include "ldns/ldns.h"
 #include "daemon/remote.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"
@@ -1111,6 +1116,8 @@ struct del_info {
 	size_t len;
 	/** labels */
 	int labs;
+	/** now */
+	uint32_t now;
 	/** time to invalidate to */
 	uint32_t expired;
 	/** number of rrsets removed */
@@ -1131,8 +1138,10 @@ zone_del_rrset(struct lruhash_entry* e, void* arg)
 	if(dname_subdomain_c(k->rk.dname, inf->name)) {
 		struct packed_rrset_data* d = 
 			(struct packed_rrset_data*)e->data;
-		d->ttl = inf->expired;
-		inf->num_rrsets++;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_rrsets++;
+		}
 	}
 }
 
@@ -1145,8 +1154,10 @@ zone_del_msg(struct lruhash_entry* e, void* arg)
 	struct msgreply_entry* k = (struct msgreply_entry*)e->key;
 	if(dname_subdomain_c(k->key.qname, inf->name)) {
 		struct reply_info* d = (struct reply_info*)e->data;
-		d->ttl = inf->expired;
-		inf->num_msgs++;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_msgs++;
+		}
 	}
 }
 
@@ -1159,8 +1170,10 @@ zone_del_kcache(struct lruhash_entry* e, void* arg)
 	struct key_entry_key* k = (struct key_entry_key*)e->key;
 	if(dname_subdomain_c(k->name, inf->name)) {
 		struct key_entry_data* d = (struct key_entry_data*)e->data;
-		d->ttl = inf->expired;
-		inf->num_keys++;
+		if(d->ttl >= inf->now) {
+			d->ttl = inf->expired;
+			inf->num_keys++;
+		}
 	}
 }
 
@@ -1180,6 +1193,7 @@ do_flush_zone(SSL* ssl, struct worker* worker, char* arg)
 	inf.name = nm;
 	inf.len = nmlen;
 	inf.labs = nmlabs;
+	inf.now = *worker->env.now;
 	inf.expired = *worker->env.now;
 	inf.expired -= 3; /* handle 3 seconds skew between threads */
 	inf.num_rrsets = 0;

daemon/remote.h

@@ -45,6 +45,9 @@
 
 #ifndef DAEMON_REMOTE_H
 #define DAEMON_REMOTE_H
+#ifdef HAVE_OPENSSL_SSL_H
+#include "openssl/ssl.h"
+#endif
 struct config_file;
 struct listen_list;
 struct listen_port;

daemon/stats.c

@@ -40,6 +40,7 @@
  * numbers. These 'statistics' may be of interest to the operator.
  */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "daemon/stats.h"
 #include "daemon/worker.h"
 #include "daemon/daemon.h"

daemon/stats.h

@@ -43,6 +43,7 @@
 #ifndef DAEMON_STATS_H
 #define DAEMON_STATS_H
 #include "util/timehist.h"
+#include "ldns/buffer.h"
 struct worker;
 struct config_file;
 struct comm_point;

daemon/unbound.c

@@ -41,6 +41,9 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 #include "util/log.h"
 #include "daemon/daemon.h"
 #include "daemon/remote.h"

daemon/worker.c

@@ -40,6 +40,7 @@
  * pending requests.
  */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/random.h"
@@ -1247,7 +1248,7 @@ outbound_entry_compare(void* a, void* b)
 
 struct outbound_entry*
 worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
-	uint16_t qclass, uint16_t flags, int dnssec,
+	uint16_t qclass, uint16_t flags, int dnssec, int want_dnssec,
 	struct sockaddr_storage* addr, socklen_t addrlen,
 	struct module_qstate* q)
 {
@@ -1258,9 +1259,9 @@ worker_send_query(uint8_t* qname, size_t qnamelen, uint16_t qtype,
 		return NULL;
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(worker->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, addr, addrlen, 
-		worker_handle_service_reply, e, worker->back->udp_buff,
-		&outbound_entry_compare);
+		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
+		addr, addrlen, worker_handle_service_reply, e, 
+		worker->back->udp_buff, &outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -1295,7 +1296,8 @@ int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);

daemon/worker.h

@@ -189,6 +189,7 @@ int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  * @param qclass: query class. (host order)
  * @param flags: host order flags word, with opcode and CD bit.
  * @param dnssec: if set, EDNS record will have DO bit set.
+ * @param want_dnssec: signatures needed.
  * @param addr: where to.
  * @param addrlen: length of addr.
  * @param q: wich query state to reactivate upon return.
@@ -197,7 +198,7 @@ int worker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  */
 struct outbound_entry* worker_send_query(uint8_t* qname, size_t qnamelen, 
 	uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec, 
-	struct sockaddr_storage* addr, socklen_t addrlen,
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
 	struct module_qstate* q);
 
 /** 

doc/Changelog

@@ -1,3 +1,71 @@
+16 April 2010: Wouter
+	- more portability defines for CMSG_SPACE, CMSG_ALIGN, CMSG_LEN.
+	- tag 1.4.4rc1.
+
+15 April 2010: Wouter
+	- ECC-GOST algorithm number 12 that is assigned by IANA.  New test
+	  example key and signatures for GOST.  GOST requires openssl-1.0.0.
+	  GOST is still disabled by default.
+
+9 April 2010: Wouter
+	- Fix bug#305: pkt_dname_tolower could read beyond end of buffer or
+	  get into an endless loop, if 0x20 was enabled, and buffers are small
+	  or particular broken packets are received.
+	- Fix chain of trust with CNAME at an intermediate step, for the DS
+	  processing proof.
+
+8 April 2010: Wouter
+	- Fix validation of queries with wildcard names (*.example).
+
+6 April 2010: Wouter
+	- Fix EDNS probe for .de DNSSEC testbed failure, where the infra
+	  cache timeout coincided with a server update, the current EDNS 
+	  backoff is less sensitive, and does not cache the backoff unless 
+	  the backoff actually works and the domain is not expecting DNSSEC.
+	- GOST support with correct algorithm numbers.
+
+1 April 2010: Wouter
+	- iana portlist updated.
+
+24 March 2010: Wouter
+	- unbound control flushed items are not counted when flushed again.
+
+23 March 2010: Wouter
+	- iana portlist updated.
+
+22 March 2010: Wouter
+	- unbound-host disables use-syslog from config file so that the
+	  config file for the main server can be used more easily.
+	- fix bug#301: unbound-checkconf could not parse interface
+	  '0.0.0.0@5353', even though unbound itself worked fine.
+
+19 March 2010: Wouter
+	- fix fwd_ancil test to pass if the socket options are not supported.
+
+18 March 2010: Wouter
+	- Fixed random numbers for port, interface and server selection.
+	  Removed very small bias.
+	- Refer to the listing in unbound-control man page in the extended
+	  statistics entry in the unbound.conf man page.
+
+16 March 2010: Wouter
+	- Fix interface-automatic for OpenBSD: msg.controllen was too small,
+	  also assertions on ancillary data buffer.
+	- check for IP_SENDSRCADDR for interface-automatic or IP_PKTINFO.
+	- for NSEC3 check if signatures are cached.
+
+15 March 2010: Wouter
+	- unit test for util/regional.c.
+
+12 March 2010: Wouter
+	- Reordered configure checks so fork and -lnsl -lsocket checks are
+	  earlier, and thus later checks benefit from and do not hinder them.
+	- iana portlist updated.
+	- ldns tarball updated.
+	- Fix python use when multithreaded.
+	- Fix solaris python compile.
+	- Include less in config.h and include per code file for ldns, ssl.
+
 11 March 2010: Wouter
 	- another memory allocation option: --enable-alloc-nonregional.
 	  exposes the regional allocations to other memory purifiers.
@@ -5,6 +73,9 @@
 	- Fix for MacPorts ldns without ssl default, unbound checks if ldns
 	  has dnssec functionality and uses the builtin if not.
 	- Fix daemonize on Solaris 10, it did not detach from terminal.
+	- tag 1.4.3 created.
+	- trunk is 1.4.4 in development.
+	- spelling fix in validation error involving cnames.
 
 10 March 2010: Wouter
 	- --enable-alloc-lite works with test set.

doc/README.tests

@@ -6,6 +6,7 @@ To make and run the tests. The results are summarized at the end.
 
 You need to have the following programs installed and in your PATH.
 * dig - from the bind-tools package. Used to send DNS queries.
+* wdiff - used for word-by-word comparisons.
 * splint (optional) - for lint test
 * doxygen (optional) - for doc completeness test
 * ldns-testns (optional) - from ldns examples. Used as DNS auth server.

doc/TODO

@@ -69,3 +69,8 @@ later
   document high scalable, high available unbound setup onepager.
 - prefetch DNSKEY when DS in delegation seen (nonCD, underTA).
 - use libevent if available on system by default(?), default outgoing 256to1024
+
+[1] BIND-like query logging to see who's looking up what and when
+[2] more logging about stuff like SERVFAIL and REFUSED responses
+[3] a Makefile that works without gnumake
+

doc/control_proto_spec.txt

@@ -62,5 +62,4 @@ local_data <resource record string>
 	local_data_add www.example.com. IN A 192.0.2.2
 	if no local_zone exists for it; a transparent zone with the same
 	name as the data is created.
-
-
+Other commands in the unbound-control manual page.

doc/example.conf.in

@@ -344,7 +344,7 @@ server:
 	# val-bogus-ttl: 60
 
 	# The signature inception and expiration dates are allowed to be off
-	# by 10% of the lifetime of the signature from our local clock.
+	# by 10% of the signature lifetime (expir-incep) from our local clock.
 	# This leeway is capped with a minimum and a maximum.  In seconds.
 	# val-sig-skew-min: 3600
 	# val-sig-skew-max: 86400

doc/unbound.conf.5.in

@@ -100,7 +100,8 @@ the statistics counters after logging the statistics. Default is no.
 .TP
 .B extended\-statistics: \fI<yes or no>
 If enabled, extended statistics are printed from \fIunbound\-control\fR(8). 
-Default is off, because keeping track of more statistics takes time.
+Default is off, because keeping track of more statistics takes time.  The
+counters are listed in \fIunbound\-control\fR(8).
 .TP
 .B num\-threads: \fI<number>
 The number of threads to create to serve clients. Use 1 for no threading.
@@ -581,17 +582,19 @@ you are debugging signature inception and expiration.
 .TP
 .B val\-sig\-skew\-min: \fI<seconds>
 Minimum number of seconds of clock skew to apply to validated signatures.
-A value of 10% of the signature lifetime is used, capped by this setting.  
-Default is 3600 (1 hour) which allows for daylight savings differences.  
-Lower this value for more strict checking of short lived signatures.
+A value of 10% of the signature lifetime (expiration \- inception) is
+used, capped by this setting.  Default is 3600 (1 hour) which allows for
+daylight savings differences.  Lower this value for more strict checking
+of short lived signatures.
 .TP
 .B val\-sig\-skew\-max: \fI<seconds>
 Maximum number of seconds of clock skew to apply to validated signatures.
-A value of 10% of the signature lifetime is used, capped by this setting.  
-Default is 86400 (24 hours) which allows for timezone setting problems in 
-stable domains.  Setting both min and max very low disables the clock skew 
-allowances.  Setting both min and max very high makes the validator check
-the signature timestamps less strictly.
+A value of 10% of the signature lifetime (expiration \- inception)
+is used, capped by this setting.  Default is 86400 (24 hours) which
+allows for timezone setting problems in stable domains.  Setting both
+min and max very low disables the clock skew allowances.  Setting both
+min and max very high makes the validator check the signature timestamps
+less strictly.
 .TP
 .B val\-bogus\-ttl: \fI<number>
 The time to live for bogus data. This is data that has failed validation;

iterator/iter_fwd.c

@@ -40,6 +40,9 @@
  * Keep track of forward zones and config settings.
  */
 #include "config.h"
+#include "ldns/rdata.h"
+#include "ldns/dname.h"
+#include "ldns/rr.h"
 #include "iterator/iter_fwd.h"
 #include "iterator/iter_delegpt.h"
 #include "util/regional.h"

iterator/iter_hints.c

@@ -40,6 +40,8 @@
  * Keep track of stub and root hints, and read those from config.
  */
 #include "config.h"
+#include "ldns/dname.h"
+#include "ldns/rr.h"
 #include "iterator/iter_hints.h"
 #include "iterator/iter_delegpt.h"
 #include "util/regional.h"

iterator/iter_priv.c

@@ -41,6 +41,7 @@
  */
 
 #include "config.h"
+#include "ldns/dname.h"
 #include "iterator/iter_priv.h"
 #include "util/regional.h"
 #include "util/log.h"

iterator/iter_priv.h

@@ -43,6 +43,7 @@
 #ifndef ITERATOR_ITER_PRIV_H
 #define ITERATOR_ITER_PRIV_H
 #include "util/rbtree.h"
+#include "ldns/buffer.h"
 struct iter_env;
 struct config_file;
 struct regional;

iterator/iter_resptype.c

@@ -40,6 +40,7 @@
  * one of the response types.
  */
 #include "config.h"
+#include "ldns/packet.h"
 #include "iterator/iter_resptype.h"
 #include "iterator/iter_delegpt.h"
 #include "services/cache/dns.h"

iterator/iter_scrub.h

@@ -42,6 +42,7 @@
 
 #ifndef ITERATOR_ITER_SCRUB_H
 #define ITERATOR_ITER_SCRUB_H
+#include "ldns/buffer.h"
 struct msg_parse;
 struct query_info;
 struct regional;

iterator/iter_utils.c

@@ -350,9 +350,9 @@ iter_server_selection(struct iter_env* iter_env,
 
 	/* randomly select a target from the list */
 	log_assert(num > 1);
-	/* we do not need secure random numbers here, but
-	 * we do need it to be threadsafe, so we use this */
-	sel = ub_random(env->rnd) % num; 
+	/* grab secure random number, to pick unexpected server.
+	 * also we need it to be threadsafe. */
+	sel = ub_random_max(env->rnd, num); 
 	a = dp->result_list;
 	prev = NULL;
 	while(sel > 0 && a) {
@@ -418,7 +418,7 @@ iter_ns_probability(struct ub_randstate* rnd, int n, int m)
 		return 1;
 	/* we do not need secure random numbers here, but
 	 * we do need it to be threadsafe, so we use this */
-	sel = ub_random(rnd) % m; 
+	sel = ub_random_max(rnd, m); 
 	return (sel < n);
 }
 

iterator/iter_utils.h

@@ -43,6 +43,7 @@
 #ifndef ITERATOR_ITER_UTILS_H
 #define ITERATOR_ITER_UTILS_H
 #include "iterator/iter_resptype.h"
+#include "ldns/buffer.h"
 struct iter_env;
 struct iter_hints;
 struct iter_forwards;

iterator/iterator.c

@@ -41,6 +41,7 @@
  */
 
 #include "config.h"
+#include "ldns/ldns.h"
 #include "iterator/iterator.h"
 #include "iterator/iter_utils.h"
 #include "iterator/iter_hints.h"
@@ -1520,7 +1521,7 @@ processQueryTargets(struct module_qstate* qstate, struct iter_qstate* iq,
 		iq->qchase.qname, iq->qchase.qname_len, 
 		iq->qchase.qtype, iq->qchase.qclass, 
 		iq->chase_flags | (iq->chase_to_rd?BIT_RD:0), EDNS_DO|BIT_CD, 
-		&target->addr, target->addrlen, qstate);
+		iq->dnssec_expected, &target->addr, target->addrlen, qstate);
 	if(!outq) {
 		log_addr(VERB_DETAIL, "error sending query to auth server", 
 			&target->addr, target->addrlen);

libunbound/libunbound.c

@@ -44,6 +44,7 @@
 /* include the public api first, it should be able to stand alone */
 #include "libunbound/unbound.h"
 #include "config.h"
+#include <ctype.h>
 #include "libunbound/context.h"
 #include "libunbound/libworker.h"
 #include "util/locks.h"

libunbound/libworker.c

@@ -42,6 +42,8 @@
  * returns from the procedure when done.
  */
 #include "config.h"
+#include <ldns/dname.h>
+#include <ldns/wire2host.h>
 #include "libunbound/libworker.h"
 #include "libunbound/context.h"
 #include "libunbound/unbound.h"
@@ -694,7 +696,7 @@ outbound_entry_compare(void* a, void* b)
 
 struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
         uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-        struct sockaddr_storage* addr, socklen_t addrlen,
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
         struct module_qstate* q)
 {
 	struct libworker* w = (struct libworker*)q->env->worker;
@@ -704,9 +706,9 @@ struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
 		return NULL;
 	e->qstate = q;
 	e->qsent = outnet_serviced_query(w->back, qname,
-		qnamelen, qtype, qclass, flags, dnssec, addr, addrlen,
-		libworker_handle_service_reply, e, w->back->udp_buff,
-		&outbound_entry_compare);
+		qnamelen, qtype, qclass, flags, dnssec, want_dnssec,
+		addr, addrlen, libworker_handle_service_reply, e, 
+		w->back->udp_buff, &outbound_entry_compare);
 	if(!e->qsent) {
 		return NULL;
 	}
@@ -833,7 +835,8 @@ int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);

libunbound/libworker.h

@@ -129,6 +129,7 @@ int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  * @param qclass: query class. (host order)
  * @param flags: host order flags word, with opcode and CD bit.
  * @param dnssec: if set, EDNS record will have DO bit set.
+ * @param want_dnssec: signatures needed.
  * @param addr: where to.
  * @param addrlen: length of addr.
  * @param q: wich query state to reactivate upon return.
@@ -137,7 +138,7 @@ int libworker_send_packet(ldns_buffer* pkt, struct sockaddr_storage* addr,
  */
 struct outbound_entry* libworker_send_query(uint8_t* qname, size_t qnamelen,
         uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec,
-        struct sockaddr_storage* addr, socklen_t addrlen,
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen,
         struct module_qstate* q);
 
 /** process incoming replies from the network */

pythonmod/pythonmod.c

@@ -44,6 +44,7 @@
 #endif
 
 #include "config.h"
+#include "ldns/ldns.h"
 
 #undef _POSIX_C_SOURCE
 #undef _XOPEN_SOURCE
@@ -56,6 +57,8 @@
 
 #ifdef S_SPLINT_S
 typedef struct PyObject PyObject;
+typedef struct PyThreadState PyThreadState;
+typedef void* PyGILState_STATE;
 #endif
 
 /**
@@ -66,6 +69,8 @@ struct pythonmod_env {
 	/** Python script filename. */
 	const char* fname;
 
+	/** Python main thread */
+	PyThreadState* mainthr;
 	/** Python module. */
 	PyObject* module;
 
@@ -107,6 +112,7 @@ int pythonmod_init(struct module_env* env, int id)
    /* Initialize module */
    FILE* script_py = NULL;
    PyObject* py_cfg, *res;
+   PyGILState_STATE gil;
    struct pythonmod_env* pe = (struct pythonmod_env*)calloc(1, sizeof(struct pythonmod_env));
    if (!pe) 
    {
@@ -130,11 +136,11 @@ int pythonmod_init(struct module_env* env, int id)
       Py_NoSiteFlag = 1;
       Py_Initialize();
       PyEval_InitThreads();
-      PyEval_ReleaseLock();
       SWIG_init();
+      pe->mainthr = PyEval_SaveThread();
    }
 
-   PyEval_AcquireLock();
+   gil = PyGILState_Ensure();
 
    /* Initialize Python */
    PyRun_SimpleString("import sys \n");
@@ -150,7 +156,7 @@ int pythonmod_init(struct module_env* env, int id)
    if (PyRun_SimpleString("from unboundmodule import *\n") < 0)
    {
       log_err("pythonmod: cannot initialize core module: unboundmodule.py"); 
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
 
@@ -158,7 +164,7 @@ int pythonmod_init(struct module_env* env, int id)
    if ((script_py = fopen(pe->fname, "r")) == NULL) 
    {
       log_err("pythonmod: can't open file %s for reading", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
 
@@ -174,7 +180,7 @@ int pythonmod_init(struct module_env* env, int id)
    if (PyRun_SimpleFile(script_py, pe->fname) < 0) 
    {
       log_err("pythonmod: can't parse Python script %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
 
@@ -183,25 +189,25 @@ int pythonmod_init(struct module_env* env, int id)
    if ((pe->func_init = PyDict_GetItemString(pe->dict, "init")) == NULL) 
    {
       log_err("pythonmod: function init is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
    if ((pe->func_deinit = PyDict_GetItemString(pe->dict, "deinit")) == NULL) 
    {
       log_err("pythonmod: function deinit is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
    if ((pe->func_operate = PyDict_GetItemString(pe->dict, "operate")) == NULL) 
    {
       log_err("pythonmod: function operate is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
    if ((pe->func_inform = PyDict_GetItemString(pe->dict, "inform_super")) == NULL) 
    {
       log_err("pythonmod: function inform_super is missing in %s", pe->fname);
-      PyEval_ReleaseLock();
+      PyGILState_Release(gil);
       return 0;
    }
 
@@ -215,7 +221,7 @@ int pythonmod_init(struct module_env* env, int id)
 
    Py_XDECREF(res);
    Py_XDECREF(py_cfg);
-   PyEval_ReleaseLock();
+   PyGILState_Release(gil);
 
    return 1;
 }
@@ -230,9 +236,9 @@ void pythonmod_deinit(struct module_env* env, int id)
    if(pe->module != NULL)
    {
       PyObject* res;
+      PyGILState_STATE gil = PyGILState_Ensure();
 
       /* Deinit module */
-      PyEval_AcquireLock();
       res = PyObject_CallFunction(pe->func_deinit, "i", id);
       if (PyErr_Occurred()) {
          log_err("pythonmod: Exception occurred in function deinit");
@@ -242,8 +248,11 @@ void pythonmod_deinit(struct module_env* env, int id)
       Py_XDECREF(res);
       /* Free shared data if any */
       Py_XDECREF(pe->data);
+      PyGILState_Release(gil);
 
+      PyEval_RestoreThread(pe->mainthr);
       Py_Finalize();
+      pe->mainthr = NULL;
    }
    pe->fname = NULL;
    free(pe);
@@ -257,6 +266,7 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
    struct pythonmod_env* pe = (struct pythonmod_env*)qstate->env->modinfo[id];
    struct pythonmod_qstate* pq = (struct pythonmod_qstate*)qstate->minfo[id];
    PyObject* py_qstate, *py_sqstate, *res;
+   PyGILState_STATE gil = PyGILState_Ensure();
 
    log_query_info(VERB_ALGO, "pythonmod: inform_super, sub is", &qstate->qinfo);
    log_query_info(VERB_ALGO, "super is", &super->qinfo);
@@ -264,7 +274,6 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
    py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
    py_sqstate = SWIG_NewPointerObj((void*) super, SWIGTYPE_p_module_qstate, 0);
 
-   PyEval_AcquireLock();
    res = PyObject_CallFunction(pe->func_inform, "iOOO", id, py_qstate, 
 	py_sqstate, pq->data);
 
@@ -284,7 +293,7 @@ void pythonmod_inform_super(struct module_qstate* qstate, int id, struct module_
    Py_XDECREF(py_sqstate);
    Py_XDECREF(py_qstate);
 
-   PyEval_ReleaseLock();
+   PyGILState_Release(gil);
 }
 
 void pythonmod_operate(struct module_qstate* qstate, enum module_ev event, 
@@ -293,6 +302,7 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
    struct pythonmod_env* pe = (struct pythonmod_env*)qstate->env->modinfo[id];
    struct pythonmod_qstate* pq = (struct pythonmod_qstate*)qstate->minfo[id];
    PyObject* py_qstate, *res;
+   PyGILState_STATE gil = PyGILState_Ensure();
 
    if ( pq == NULL)
    { 
@@ -304,9 +314,6 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
       Py_INCREF(pq->data);
    }
 
-   /* Lock Python */
-   PyEval_AcquireLock();
-
    /* Call operate */
    py_qstate = SWIG_NewPointerObj((void*) qstate, SWIGTYPE_p_module_qstate, 0);
    res = PyObject_CallFunction(pe->func_operate, "iiOO", id, (int) event, 
@@ -325,8 +332,7 @@ void pythonmod_operate(struct module_qstate* qstate, enum module_ev event,
    Py_XDECREF(res);
    Py_XDECREF(py_qstate);
 
-   /* Unlock Python */
-   PyEval_ReleaseLock();
+   PyGILState_Release(gil);
 }
 
 void pythonmod_clear(struct module_qstate* qstate, int id)
@@ -340,7 +346,9 @@ void pythonmod_clear(struct module_qstate* qstate, int id)
    	(unsigned long int)pq);
    if(pq != NULL)
    {
+      PyGILState_STATE gil = PyGILState_Ensure();
       Py_DECREF(pq->data);
+      PyGILState_Release(gil);
       /* Free qstate */
       free(pq);
    }

services/cache/infra.c

@@ -39,6 +39,7 @@
  * This file contains the infrastructure cache.
  */
 #include "config.h"
+#include "ldns/rr.h"
 #include "services/cache/infra.h"
 #include "util/storage/slabhash.h"
 #include "util/storage/lookup3.h"

services/listen_dnsport.c

@@ -39,6 +39,10 @@
  * This file has functions to get queries from clients.
  */
 #include "config.h"
+#ifdef HAVE_SYS_TYPES_H
+#  include <sys/types.h>
+#endif
+#include <sys/time.h>
 #include "services/listen_dnsport.h"
 #include "services/outside_network.h"
 #include "util/netevent.h"
@@ -46,9 +50,6 @@
 #include "util/config_file.h"
 #include "util/net_help.h"
 
-#ifdef HAVE_SYS_TYPES_H
-#  include <sys/types.h>
-#endif
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -490,7 +491,7 @@ port_insert(struct listen_port** list, int s, enum listen_type ftype)
 static int
 set_recvpktinfo(int s, int family) 
 {
-#if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || defined(IP_RECVDSTADDR) || defined(IP_PKTINFO)
+#if defined(IPV6_RECVPKTINFO) || defined(IPV6_PKTINFO) || (defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)) || defined(IP_PKTINFO)
 	int on = 1;
 #else
 	(void)s;
@@ -517,22 +518,22 @@ set_recvpktinfo(int s, int family)
 #           endif /* defined IPV6_RECVPKTINFO */
 
 	} else if(family == AF_INET) {
-#           ifdef IP_RECVDSTADDR
-		if(setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR,
-			(void*)&on, (socklen_t)sizeof(on)) < 0) {
-			log_err("setsockopt(..., IP_RECVDSTADDR, ...) failed: %s",
-				strerror(errno));
-			return 0;
-		}
-#           elif defined(IP_PKTINFO)
+#           ifdef IP_PKTINFO
 		if(setsockopt(s, IPPROTO_IP, IP_PKTINFO,
 			(void*)&on, (socklen_t)sizeof(on)) < 0) {
 			log_err("setsockopt(..., IP_PKTINFO, ...) failed: %s",
 				strerror(errno));
 			return 0;
 		}
+#           elif defined(IP_RECVDSTADDR) && defined(IP_SENDSRCADDR)
+		if(setsockopt(s, IPPROTO_IP, IP_RECVDSTADDR,
+			(void*)&on, (socklen_t)sizeof(on)) < 0) {
+			log_err("setsockopt(..., IP_RECVDSTADDR, ...) failed: %s",
+				strerror(errno));
+			return 0;
+		}
 #           else
-		log_err("no IP_RECVDSTADDR or IP_PKTINFO option, please disable "
+		log_err("no IP_SENDSRCADDR or IP_PKTINFO option, please disable "
 			"interface-automatic in config");
 		return 0;
 #           endif /* IP_PKTINFO */

services/localzone.c

@@ -39,6 +39,8 @@
  * This file contains functions to enable local zone authority service.
  */
 #include "config.h"
+#include "ldns/dname.h"
+#include "ldns/host2wire.h"
 #include "services/localzone.h"
 #include "util/regional.h"
 #include "util/config_file.h"

services/mesh.c

@@ -43,6 +43,7 @@
  * send back to clients.
  */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "services/mesh.h"
 #include "services/outbound_list.h"
 #include "services/cache/dns.h"

services/modstack.c

@@ -39,6 +39,7 @@
  * This file contains functions to help maintain a stack of modules.
  */
 #include "config.h"
+#include <ctype.h>
 #include "services/modstack.h"
 #include "util/module.h"
 #include "util/fptr_wlist.h"

services/outbound_list.c

@@ -40,6 +40,7 @@
  * queries it has outstanding to authoritative servers.
  */
 #include "config.h"
+#include <sys/time.h>
 #include "services/outbound_list.h"
 #include "services/outside_network.h"
 

services/outside_network.c

@@ -40,6 +40,12 @@
  * wait for the pending answer events.
  */
 #include "config.h"
+#include <ctype.h>
+#ifdef HAVE_SYS_TYPES_H
+#  include <sys/types.h>
+#endif
+#include <sys/time.h>
+#include "ldns/wire2host.h"
 #include "services/outside_network.h"
 #include "services/listen_dnsport.h"
 #include "services/cache/infra.h"
@@ -53,9 +59,6 @@
 #include "util/random.h"
 #include "util/fptr_wlist.h"
 
-#ifdef HAVE_SYS_TYPES_H
-#  include <sys/types.h>
-#endif
 #ifdef HAVE_NETDB_H
 #include <netdb.h>
 #endif
@@ -807,9 +810,9 @@ select_ifport(struct outside_network* outnet, struct pending* pend,
 	log_assert(outnet->unused_fds);
 	tries = 0;
 	while(1) {
-		my_if = ub_random(outnet->rnd) % num_if;
+		my_if = ub_random_max(outnet->rnd, num_if);
 		pif = &ifs[my_if];
-		my_port = ub_random(outnet->rnd) % pif->avail_total;
+		my_port = ub_random_max(outnet->rnd, pif->avail_total);
 		if(my_port < pif->inuse) {
 			/* port already open */
 			pend->pc = pif->out[my_port];
@@ -1075,7 +1078,7 @@ lookup_serviced(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
 /** Create new serviced entry */
 static struct serviced_query*
 serviced_create(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
-        struct sockaddr_storage* addr, socklen_t addrlen)
+	int want_dnssec, struct sockaddr_storage* addr, socklen_t addrlen)
 {
 	struct serviced_query* sq = (struct serviced_query*)malloc(sizeof(*sq));
 	rbnode_t* ins;
@@ -1089,6 +1092,7 @@ serviced_create(struct outside_network* outnet, ldns_buffer* buff, int dnssec,
 	}
 	sq->qbuflen = ldns_buffer_limit(buff);
 	sq->dnssec = dnssec;
+	sq->want_dnssec = want_dnssec;
 	memcpy(&sq->addr, addr, addrlen);
 	sq->addrlen = addrlen;
 	sq->outnet = outnet;
@@ -1130,7 +1134,8 @@ serviced_delete(struct serviced_query* sq)
 		/* clear up the pending query */
 		if(sq->status == serviced_query_UDP_EDNS ||
 			sq->status == serviced_query_UDP ||
-			sq->status == serviced_query_PROBE_EDNS) {
+			sq->status == serviced_query_PROBE_EDNS ||
+			sq->status == serviced_query_UDP_EDNS_fallback) {
 			struct pending* p = (struct pending*)sq->pending;
 			if(p->pc)
 				portcomm_loweruse(sq->outnet, p->pc);
@@ -1407,12 +1412,25 @@ serviced_tcp_callback(struct comm_point* c, void* arg, int error,
 		(LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
 		LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(ldns_buffer_begin(
 		c->buffer)) == LDNS_RCODE_NOTIMPL) ) {
-		if(!infra_edns_update(sq->outnet->infra, &sq->addr, 
+		/* attempt to fallback to nonEDNS */
+		sq->status = serviced_query_TCP_EDNS_fallback;
+		serviced_tcp_initiate(sq->outnet, sq, c->buffer);
+		return 0;
+	} else if(error==NETEVENT_NOERROR && 
+		sq->status == serviced_query_TCP_EDNS_fallback &&
+			(LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
+			LDNS_RCODE_NOERROR || LDNS_RCODE_WIRE(
+			ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NXDOMAIN 
+			|| LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) 
+			== LDNS_RCODE_YXDOMAIN)) {
+		/* the fallback produced a result that looks promising, note
+		 * that this server should be approached without EDNS */
+		/* only store noEDNS in cache if domain is noDNSSEC */
+		if(!sq->want_dnssec)
+		  if(!infra_edns_update(sq->outnet->infra, &sq->addr, 
 			sq->addrlen, -1, *sq->outnet->now_secs))
 			log_err("Out of memory caching no edns for host");
 		sq->status = serviced_query_TCP;
-		serviced_tcp_initiate(sq->outnet, sq, c->buffer);
-		return 0;
 	}
 	/* insert address into reply info */
 	if(!rep) {
@@ -1502,43 +1520,33 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			serviced_callbacks(sq, NETEVENT_TIMEOUT, c, rep);
 			return 0;
 		}
+	} else if(error != NETEVENT_NOERROR) {
+		/* udp returns error (due to no ID or interface available) */
+		serviced_callbacks(sq, error, c, rep);
+		return 0;
 	}
-	if(error == NETEVENT_NOERROR && sq->status == serviced_query_UDP_EDNS 
+	if(sq->status == serviced_query_UDP_EDNS 
 		&& (LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) 
 			== LDNS_RCODE_FORMERR || LDNS_RCODE_WIRE(
 			ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOTIMPL)) {
-		/* note no EDNS, fallback without EDNS */
-		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
-			-1, (uint32_t)now.tv_sec)) {
-			log_err("Out of memory caching no edns for host");
-		}
-		sq->status = serviced_query_UDP;
+		/* try to get an answer by falling back without EDNS */
+		sq->status = serviced_query_UDP_EDNS_fallback;
 		sq->retry = 0;
 		if(!serviced_udp_send(sq, c->buffer)) {
 			serviced_callbacks(sq, NETEVENT_CLOSED, c, rep);
 		}
 		return 0;
-	}
-	if(LDNS_TC_WIRE(ldns_buffer_begin(c->buffer)) ||
-		(error != NETEVENT_NOERROR && fallback_tcp)  ) {
-		/* fallback to TCP */
-		/* this discards partial UDP contents */
-		if(sq->status == serviced_query_UDP_EDNS)
-			sq->status = serviced_query_TCP_EDNS;
-		else	sq->status = serviced_query_TCP;
-		serviced_tcp_initiate(outnet, sq, c->buffer);
-		return 0;
-	}
-	/* yay! an answer */
-	if(sq->status == serviced_query_PROBE_EDNS) {
+	} else if(sq->status == serviced_query_PROBE_EDNS) {
 		/* probe without EDNS succeeds, so we conclude that this
 		 * host likely has EDNS packets dropped */
 		log_addr(VERB_DETAIL, "timeouts, concluded that connection to "
 			"host drops EDNS packets", &sq->addr, sq->addrlen);
-		if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
+		/* only store noEDNS in cache if domain is noDNSSEC */
+		if(!sq->want_dnssec)
+		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
 			-1, (uint32_t)now.tv_sec)) {
 			log_err("Out of memory caching no edns for host");
-		}
+		  }
 		sq->status = serviced_query_UDP;
 	} else if(sq->status == serviced_query_UDP_EDNS && 
 		!sq->edns_lame_known) {
@@ -1548,6 +1556,21 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			log_err("Out of memory caching edns works");
 		}
 		sq->edns_lame_known = 1;
+	} else if(sq->status == serviced_query_UDP_EDNS_fallback &&
+		!sq->edns_lame_known && (LDNS_RCODE_WIRE(
+		ldns_buffer_begin(c->buffer)) == LDNS_RCODE_NOERROR || 
+		LDNS_RCODE_WIRE(ldns_buffer_begin(c->buffer)) == 
+		LDNS_RCODE_NXDOMAIN || LDNS_RCODE_WIRE(ldns_buffer_begin(
+		c->buffer)) == LDNS_RCODE_YXDOMAIN)) {
+		/* the fallback produced a result that looks promising, note
+		 * that this server should be approached without EDNS */
+		/* only store noEDNS in cache if domain is noDNSSEC */
+		if(!sq->want_dnssec)
+		  if(!infra_edns_update(outnet->infra, &sq->addr, sq->addrlen,
+			-1, (uint32_t)now.tv_sec)) {
+			log_err("Out of memory caching no edns for host");
+		  }
+		sq->status = serviced_query_UDP;
 	}
 	if(now.tv_sec > sq->last_sent_time.tv_sec ||
 		(now.tv_sec == sq->last_sent_time.tv_sec &&
@@ -1561,6 +1584,20 @@ serviced_udp_callback(struct comm_point* c, void* arg, int error,
 			roundtime, sq->last_rtt, (uint32_t)now.tv_sec))
 			log_err("out of memory noting rtt.");
 	}
+	/* perform TC flag check and TCP fallback after updating our
+	 * cache entries for EDNS status and RTT times */
+	if(LDNS_TC_WIRE(ldns_buffer_begin(c->buffer)) || fallback_tcp) {
+		/* fallback to TCP */
+		/* this discards partial UDP contents */
+		if(sq->status == serviced_query_UDP_EDNS ||
+			sq->status == serviced_query_UDP_EDNS_fallback)
+			/* if we have unfinished EDNS_fallback, start again */
+			sq->status = serviced_query_TCP_EDNS;
+		else	sq->status = serviced_query_TCP;
+		serviced_tcp_initiate(outnet, sq, c->buffer);
+		return 0;
+	}
+	/* yay! an answer */
 	serviced_callbacks(sq, error, c, rep);
 	return 0;
 }
@@ -1581,10 +1618,10 @@ callback_list_find(struct serviced_query* sq, void* cb_arg,
 struct serviced_query* 
 outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr,
-	socklen_t addrlen, comm_point_callback_t* callback,
-	void* callback_arg, ldns_buffer* buff, 
-	int (*arg_compare)(void*,void*))
+	uint16_t flags, int dnssec, int want_dnssec,
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	comm_point_callback_t* callback, void* callback_arg, 
+	ldns_buffer* buff, int (*arg_compare)(void*,void*))
 {
 	struct serviced_query* sq;
 	struct service_callback* cb;
@@ -1600,7 +1637,8 @@ outnet_serviced_query(struct outside_network* outnet,
 		return NULL;
 	if(!sq) {
 		/* make new serviced query entry */
-		sq = serviced_create(outnet, buff, dnssec, addr, addrlen);
+		sq = serviced_create(outnet, buff, dnssec, want_dnssec,
+			addr, addrlen);
 		if(!sq) {
 			free(cb);
 			return NULL;
@@ -1752,7 +1790,8 @@ serviced_get_mem(struct serviced_query* sq)
 		s += sizeof(*sb);
 	if(sq->status == serviced_query_UDP_EDNS ||
 		sq->status == serviced_query_UDP ||
-		sq->status == serviced_query_PROBE_EDNS) {
+		sq->status == serviced_query_PROBE_EDNS ||
+		sq->status == serviced_query_UDP_EDNS_fallback) {
 		s += sizeof(struct pending);
 		s += comm_timer_get_mem(NULL);
 	} else {

services/outside_network.h

@@ -291,6 +291,8 @@ struct serviced_query {
 	size_t qbuflen;
 	/** If an EDNS section is included, the DO/CD bit will be turned on. */
 	int dnssec;
+	/** We want signatures, or else the answer is likely useless */
+	int want_dnssec;
 	/** where to send it */
 	struct sockaddr_storage addr;
 	/** length of addr field in use. */
@@ -308,7 +310,11 @@ struct serviced_query {
 		/** TCP without EDNS sent */
 		serviced_query_TCP,
 		/** probe to test EDNS lameness (EDNS is dropped) */
-		serviced_query_PROBE_EDNS
+		serviced_query_PROBE_EDNS,
+		/** probe to test noEDNS0 (EDNS gives FORMERRorNOTIMP) */
+		serviced_query_UDP_EDNS_fallback,
+		/** probe to test TCP noEDNS0 (EDNS gives FORMERRorNOTIMP) */
+		serviced_query_TCP_EDNS_fallback
 	} 	
 		/** variable with current status */ 
 		status;
@@ -427,6 +433,8 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
  * @param dnssec: if set, DO bit is set in EDNS queries.
  *	If the value includes BIT_CD, CD bit is set when in EDNS queries.
  *	If the value includes BIT_DO, DO bit is set when in EDNS queries.
+ * @param want_dnssec: signatures are needed, without EDNS the answer is
+ * 	likely to be useless.
  * @param callback: callback function.
  * @param callback_arg: user argument to callback function.
  * @param addr: to which server to send the query.
@@ -439,10 +447,10 @@ void pending_delete(struct outside_network* outnet, struct pending* p);
  */
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr, 
-	socklen_t addrlen, comm_point_callback_t* callback, 
-	void* callback_arg, ldns_buffer* buff, 
-	int (*arg_compare)(void*,void*));
+	uint16_t flags, int dnssec, int want_dnssec,
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	comm_point_callback_t* callback, void* callback_arg, 
+	ldns_buffer* buff, int (*arg_compare)(void*,void*));
 
 /**
  * Remove service query callback.

smallapp/unbound-checkconf.c

@@ -52,6 +52,9 @@
 #include "iterator/iter_fwd.h"
 #include "validator/validator.h"
 #include "services/localzone.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 #ifdef HAVE_PWD_H
 #include <pwd.h>
 #endif
@@ -154,7 +157,7 @@ interfacechecks(struct config_file* cfg)
 	socklen_t alen;
 	int i, j;
 	for(i=0; i<cfg->num_ifs; i++) {
-		if(!ipstrtoaddr(cfg->ifs[i], UNBOUND_DNS_PORT, &a, &alen)) {
+		if(!extstrtoaddr(cfg->ifs[i], &a, &alen)) {
 			fatal_exit("cannot parse interface specified as '%s'",
 				cfg->ifs[i]);
 		}

smallapp/unbound-control.c

@@ -42,6 +42,18 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#ifdef HAVE_OPENSSL_SSL_H
+#include <openssl/ssl.h>
+#endif
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/locks.h"

smallapp/unbound-host.c

@@ -41,6 +41,9 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 /* remove alloc checks, not in this part of the code */
 #ifdef UNBOUND_ALLOC_STATS
 #undef malloc
@@ -494,6 +497,12 @@ int main(int argc, char* argv[])
 	}
 	if(debuglevel != 0) /* set after possible -C options */
 		check_ub_res(ub_ctx_debuglevel(ctx, debuglevel));
+	if(ub_ctx_get_option(ctx, "use-syslog", &optarg) == 0) {
+		if(strcmp(optarg, "yes") == 0) /* disable use-syslog */
+			check_ub_res(ub_ctx_set_option(ctx, 
+				"use-syslog:", "no"));
+		free(optarg);
+	}
 	argc -= optind;
 	argv += optind;
 	if(argc != 1)

smallapp/worker_cb.c

@@ -112,7 +112,8 @@ int worker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* worker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec), 
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);
@@ -151,7 +152,8 @@ int libworker_send_packet(ldns_buffer* ATTR_UNUSED(pkt),
 struct outbound_entry* libworker_send_query(uint8_t* ATTR_UNUSED(qname), 
 	size_t ATTR_UNUSED(qnamelen), uint16_t ATTR_UNUSED(qtype), 
 	uint16_t ATTR_UNUSED(qclass), uint16_t ATTR_UNUSED(flags), 
-	int ATTR_UNUSED(dnssec), struct sockaddr_storage* ATTR_UNUSED(addr), 
+	int ATTR_UNUSED(dnssec), int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* ATTR_UNUSED(addr), 
 	socklen_t ATTR_UNUSED(addrlen), struct module_qstate* ATTR_UNUSED(q))
 {
 	log_assert(0);

testcode/asynclook.c

@@ -41,6 +41,9 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
 #include "libunbound/unbound.h"
 #include "libunbound/context.h"
 #include "util/locks.h"

testcode/delayer.c

@@ -41,6 +41,13 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+#include <sys/time.h>
 #include "util/net_help.h"
 #include "util/config_file.h"
 #include <signal.h>

testcode/fake_event.c

@@ -988,10 +988,10 @@ pending_tcp_query(struct outside_network* outnet, ldns_buffer* packet,
 
 struct serviced_query* outnet_serviced_query(struct outside_network* outnet,
         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr,
-	socklen_t addrlen, comm_point_callback_t* callback,
-	void* callback_arg, ldns_buffer* ATTR_UNUSED(buff),
-	int (*arg_compare)(void*,void*))
+	uint16_t flags, int dnssec, int ATTR_UNUSED(want_dnssec),
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	comm_point_callback_t* callback, void* callback_arg, 
+	ldns_buffer* ATTR_UNUSED(buff), int (*arg_compare)(void*,void*))
 {
 	struct replay_runtime* runtime = (struct replay_runtime*)outnet->base;
 	struct fake_pending* pend = (struct fake_pending*)calloc(1,

testcode/harvest.c

@@ -69,6 +69,10 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#include "ldns/ldns.h"
 #include <signal.h>
 #include "libunbound/unbound.h"
 #ifdef HAVE_SYS_STAT_H

testcode/perf.c

@@ -40,6 +40,10 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#include "ldns/ldns.h"
 #include <signal.h>
 #include "util/log.h"
 #include "util/locks.h"

testcode/pktview.c

@@ -40,6 +40,7 @@
  */
 
 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/log.h"
 #include "util/data/dname.h"
 #include "util/data/msgparse.h"

testcode/readhex.c

@@ -38,6 +38,7 @@
  * Declarations useful for the unit tests.
  */
 #include "config.h"
+#include <ctype.h>
 #include "testcode/readhex.h"
 #include "util/log.h"
 

testcode/readhex.h

@@ -40,6 +40,7 @@
 
 #ifndef TESTCODE_READHEX_H
 #define TESTCODE_READHEX_H
+#include "ldns/buffer.h"
 
 /** 
  * Helper to convert hex string to packet buffer.

testcode/signit.c

@@ -40,6 +40,7 @@
  * construct input to test the validator with.
  */
 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/log.h"
 #include "util/config_file.h"
 #include "util/net_help.h"

testcode/streamtcp.c

@@ -40,6 +40,10 @@
  */
 
 #include "config.h"
+#ifdef HAVE_GETOPT_H
+#include <getopt.h>
+#endif
+#include "ldns/ldns.h"
 #include <signal.h>
 #include "util/locks.h"
 #include "util/log.h"

testcode/unitanchor.c

@@ -39,6 +39,7 @@
  */
 
 #include "config.h"
+#include "ldns/rr.h"
 #include "util/log.h"
 #include "util/data/dname.h"
 #include "testcode/unitmain.h"

testcode/unitdname.c

@@ -39,6 +39,8 @@
  */
 
 #include "config.h"
+#include "ldns/dname.h"
+#include "ldns/host2wire.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"
 #include "util/data/dname.h"
@@ -793,12 +795,53 @@ dname_test_valid()
 		, 4096) == 0);
 }
 
+/** test pkt_dname_tolower */
+static void
+dname_test_pdtl(ldns_buffer* loopbuf, ldns_buffer* boundbuf)
+{
+	unit_show_func("util/data/dname.c", "pkt_dname_tolower");
+	pkt_dname_tolower(loopbuf, ldns_buffer_at(loopbuf, 12));
+	pkt_dname_tolower(boundbuf, ldns_buffer_at(boundbuf, 12));
+}
+
+/** setup looped dname and out-of-bounds dname ptr */
+static void
+dname_setup_bufs(ldns_buffer* loopbuf, ldns_buffer* boundbuf)
+{
+	ldns_buffer_write_u16(loopbuf, 0xd54d);  /* id */
+	ldns_buffer_write_u16(loopbuf, 0x12);    /* flags  */
+	ldns_buffer_write_u16(loopbuf, 1);       /* qdcount */
+	ldns_buffer_write_u16(loopbuf, 0);       /* ancount */
+	ldns_buffer_write_u16(loopbuf, 0);       /* nscount */
+	ldns_buffer_write_u16(loopbuf, 0);       /* arcount */
+	ldns_buffer_write_u8(loopbuf, 0xc0); /* PTR back at itself */
+	ldns_buffer_write_u8(loopbuf, 0x0c);
+	ldns_buffer_flip(loopbuf);
+
+	ldns_buffer_write_u16(boundbuf, 0xd54d);  /* id */
+	ldns_buffer_write_u16(boundbuf, 0x12);    /* flags  */
+	ldns_buffer_write_u16(boundbuf, 1);       /* qdcount */
+	ldns_buffer_write_u16(boundbuf, 0);       /* ancount */
+	ldns_buffer_write_u16(boundbuf, 0);       /* nscount */
+	ldns_buffer_write_u16(boundbuf, 0);       /* arcount */
+	ldns_buffer_write_u8(boundbuf, 0x01); /* len=1 */
+	ldns_buffer_write_u8(boundbuf, (uint8_t)'A'); /* A. label */
+	ldns_buffer_write_u8(boundbuf, 0xc0); /* PTR out of bounds */
+	ldns_buffer_write_u8(boundbuf, 0xcc);
+	ldns_buffer_flip(boundbuf);
+}
+
 void dname_test()
 {
+	ldns_buffer* loopbuf = ldns_buffer_new(14);
+	ldns_buffer* boundbuf = ldns_buffer_new(16);
 	ldns_buffer* buff = ldns_buffer_new(65800);
+	unit_assert(loopbuf && boundbuf && buff);
 	ldns_buffer_flip(buff);
+	dname_setup_bufs(loopbuf, boundbuf);
 	dname_test_qdl(buff);
 	dname_test_qdtl(buff);
+	dname_test_pdtl(loopbuf, boundbuf);
 	dname_test_query_dname_compare();
 	dname_test_count_labels();
 	dname_test_count_size_labels();
@@ -814,4 +857,6 @@ void dname_test()
 	dname_test_topdomain();
 	dname_test_valid();
 	ldns_buffer_free(buff);
+	ldns_buffer_free(loopbuf);
+	ldns_buffer_free(boundbuf);
 }

testcode/unitmain.c

@@ -40,6 +40,22 @@
  */
 
 #include "config.h"
+#ifdef HAVE_OPENSSL_ERR_H
+#include <openssl/err.h>
+#endif
+
+#ifdef HAVE_OPENSSL_RAND_H
+#include <openssl/rand.h>
+#endif
+
+#ifdef HAVE_OPENSSL_CONF_H
+#include <openssl/conf.h>
+#endif
+
+#ifdef HAVE_OPENSSL_ENGINE_H
+#include <openssl/engine.h>
+#endif
+#include "ldns/ldns.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"
 
@@ -431,10 +447,12 @@ static void
 rnd_test()
 {
 	struct ub_randstate* r;
-	int num = 100, i;
-	long int a[100];
+	int num = 1000, i;
+	long int a[1000];
+	unsigned int seed = (unsigned)time(NULL);
 	unit_show_feature("ub_random");
-	unit_assert( (r = ub_initstate((unsigned)time(NULL), NULL)) );
+	printf("ub_random seed is %u\n", seed);
+	unit_assert( (r = ub_initstate(seed, NULL)) );
 	for(i=0; i<num; i++) {
 		a[i] = ub_random(r);
 		unit_assert(a[i] >= 0);
@@ -444,6 +462,14 @@ rnd_test()
 				a[i] != a[i-3] || a[i] != a[i-4] ||
 				a[i] != a[i-5] || a[i] != a[i-6]);
 	}
+	a[0] = ub_random_max(r, 1);
+	unit_assert(a[0] >= 0 && a[0] < 1);
+	a[0] = ub_random_max(r, 10000);
+	unit_assert(a[0] >= 0 && a[0] < 10000);
+	for(i=0; i<num; i++) {
+		a[i] = ub_random_max(r, 10);
+		unit_assert(a[i] >= 0 && a[i] < 10);
+	}
 	ub_randfree(r);
 }
 
@@ -489,6 +515,7 @@ main(int argc, char* argv[])
 	rtt_test();
 	anchors_test();
 	alloc_test();
+	regional_test();
 	lruhash_test();
 	slabhash_test();
 	infra_test();
@@ -497,7 +524,7 @@ main(int argc, char* argv[])
 	printf("%d checks ok.\n", testcount);
 #ifdef HAVE_OPENSSL_CONFIG
 	EVP_cleanup();
-	/*ENGINE_cleanup();*/
+	ENGINE_cleanup();
 	CONF_modules_free();
 #endif
 	CRYPTO_cleanup_all_ex_data();

testcode/unitmain.h

@@ -70,5 +70,7 @@ void anchors_test();
 void verify_test();
 /** unit test for negative cache functions */
 void neg_test();
+/** unit test for regional allocator functions */
+void regional_test();
 
 #endif /* TESTCODE_UNITMAIN_H */

testcode/unitmsgparse.c

@@ -39,6 +39,7 @@
  */
 
 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/log.h"
 #include "testcode/unitmain.h"
 #include "util/data/msgparse.h"

testcode/unitregional.c

@@ -0,0 +1,244 @@
+/*
+ * testcode/unitregional.c - unit test for regional allocator.
+ *
+ * Copyright (c) 2010, NLnet Labs. All rights reserved.
+ *
+ * This software is open source.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * Redistributions of source code must retain the above copyright notice,
+ * this list of conditions and the following disclaimer.
+ *
+ * Redistributions in binary form must reproduce the above copyright notice,
+ * this list of conditions and the following disclaimer in the documentation
+ * and/or other materials provided with the distribution.
+ *
+ * Neither the name of the NLNET LABS nor the names of its contributors may
+ * be used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+ * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+ * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ * POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+/**
+ * \file
+ * Tests the regional special purpose allocator.
+ */
+
+#include "config.h"
+#include "testcode/unitmain.h"
+#include "util/log.h"
+#include "util/regional.h"
+
+/** test regional corner cases, zero, one, end of structure */
+static void
+corner_cases(struct regional* r)
+{
+	size_t s; /* shadow count of allocated memory */
+	void* a;
+	size_t minsize = sizeof(uint64_t);
+	size_t mysize;
+	char* str;
+	unit_assert(r);
+	/* alloc cases:
+	 * 0, 1, 2.
+	 * smaller than LARGE_OBJECT_SIZE.
+	 * smaller but does not fit in remainder in regional.
+	 * smaller but exactly fits in remainder of regional.
+	 * size is remainder of regional - 8.
+	 * size is remainder of regional + 8.
+	 * larger than LARGE_OBJECT_SIZE.
+	 */
+	s = sizeof(struct regional);
+	unit_assert((s % minsize) == 0);
+	unit_assert(r->available == r->first_size - s);
+	unit_assert(r->large_list == NULL);
+	unit_assert(r->next == NULL);
+
+	/* Note an alloc of 0 gets a pointer to current last
+	 * position (where you should then use 0 bytes) */
+	a = regional_alloc(r, 0);
+	unit_assert(a);
+	s+=0;
+	unit_assert(r->available == r->first_size - s);
+
+	a = regional_alloc(r, 1);
+	unit_assert(a);
+	memset(a, 0x42, 1);
+	s+=minsize;
+	unit_assert(r->available == r->first_size - s);
+
+	a = regional_alloc(r, 2);
+	unit_assert(a);
+	memset(a, 0x42, 2);
+	s+=minsize;
+	unit_assert(r->available == r->first_size - s);
+
+	a = regional_alloc(r, 128);
+	unit_assert(a);
+	memset(a, 0x42, 128);
+	s+=128;
+	unit_assert(r->available == r->first_size - s);
+
+	unit_assert(r->large_list == NULL);
+	a = regional_alloc(r, 10240);
+	unit_assert(a);
+	unit_assert(r->large_list != NULL);
+	memset(a, 0x42, 10240);
+	/* s does not change */
+	unit_assert(r->available == r->first_size - s);
+	unit_assert(r->total_large == 10240+minsize);
+
+	/* go towards the end of the current chunk */
+	while(r->available > 1024) {
+		a = regional_alloc(r, 1024);
+		unit_assert(a);
+		memset(a, 0x42, 1024);
+		s += 1024;
+		unit_assert(r->available == r->first_size - s);
+	}
+
+	unit_assert(r->next == NULL);
+	mysize = 1280; /* does not fit in current chunk */
+	a = regional_alloc(r, mysize);
+	memset(a, 0x42, mysize);
+	unit_assert(r->next != NULL);
+	unit_assert(a);
+
+	/* go towards the end of the current chunk */
+	while(r->available > 864) {
+		a = regional_alloc(r, 864);
+		unit_assert(a);
+		memset(a, 0x42, 864);
+		s += 864;
+	}
+
+	mysize = r->available; /* exactly fits */
+	a = regional_alloc(r, mysize);
+	memset(a, 0x42, mysize);
+	unit_assert(a);
+	unit_assert(r->available == 0); /* implementation does not go ahead*/
+
+	a = regional_alloc(r, 8192); /* another large allocation */
+	unit_assert(a);
+	memset(a, 0x42, 8192);
+	unit_assert(r->available == 0);
+	unit_assert(r->total_large == 10240 + 8192 + 2*minsize);
+
+	a = regional_alloc(r, 32); /* make new chunk */
+	unit_assert(a);
+	memset(a, 0x42, 32);
+	unit_assert(r->available > 0);
+	unit_assert(r->total_large == 10240 + 8192 + 2*minsize);
+
+	/* go towards the end of the current chunk */
+	while(r->available > 1320) {
+		a = regional_alloc(r, 1320);
+		unit_assert(a);
+		memset(a, 0x42, 1320);
+		s += 1320;
+	}
+
+	mysize = r->available + 8; /* exact + 8 ; does not fit */
+	a = regional_alloc(r, mysize);
+	memset(a, 0x42, mysize);
+	unit_assert(a);
+	unit_assert(r->available > 0); /* new chunk */
+
+	/* go towards the end of the current chunk */
+	while(r->available > 1480) {
+		a = regional_alloc(r, 1480);
+		unit_assert(a);
+		memset(a, 0x42, 1480);
+		s += 1480;
+	}
+
+	mysize = r->available - 8; /* exact - 8 ; fits. */
+	a = regional_alloc(r, mysize);
+	memset(a, 0x42, mysize);
+	unit_assert(a);
+	unit_assert(r->available == 8);
+
+	/* test if really copied over */
+	str = "test12345";
+	a = regional_alloc_init(r, str, 8);
+	unit_assert(a);
+	unit_assert(memcmp(a, str, 8) == 0);
+
+	/* test if really zeroed */
+	a = regional_alloc_zero(r, 32);
+	str="\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
+	unit_assert(a);
+	unit_assert(memcmp(a, str, 32) == 0);
+
+	/* test if copied over (and null byte) */
+	str = "an interesting string";
+	a = regional_strdup(r, str);
+	unit_assert(a);
+	unit_assert(memcmp(a, str, strlen(str)+1) == 0);
+
+	regional_free_all(r);
+}
+
+/** test specific cases */
+static void
+specific_cases()
+{
+	struct regional* r = regional_create();
+	corner_cases(r);
+	regional_destroy(r);
+	r = regional_create_custom(2048); /* a small regional */
+	unit_assert(r->first_size == 2048);
+	unit_assert(regional_get_mem(r) == 2048);
+	corner_cases(r);
+	unit_assert(regional_get_mem(r) == 2048);
+	regional_destroy(r);
+}
+
+/** put random stuff in a region and free it */
+static void
+burden_test(size_t max)
+{
+	size_t get;
+	void* a;
+	int i;
+	struct regional* r = regional_create_custom(2048);
+	for(i=0; i<1000; i++) {
+		get = random() % max;
+		a = regional_alloc(r, get);
+		unit_assert(a);
+		memset(a, 0x54, get);
+	}
+	regional_free_all(r);
+	regional_destroy(r);
+}
+
+/** randomly allocate stuff */
+static void
+random_burden()
+{
+	size_t max_alloc = 2048 + 128; /* small chance of LARGE */
+	int i;
+	for(i=0; i<100; i++)
+		burden_test(max_alloc);
+}
+
+void regional_test()
+{
+	unit_show_feature("regional");
+	specific_cases();
+	random_burden();
+}

testdata/Kexample.com.+012+60385.ds

@@ -0,0 +1 @@
+example.com.	3600	IN	DS	60385 12 3 c93b6fd6893d42ae60acd15088c2aeea0e0f013e535961855f17299507f70e0d ; xudef-ririt-kidaf-tebyp-vemep-segih-bydes-dyriv-pofab-zibaf-vigyh-numom-halac-lypin-hycaz-lofub-taxex

testdata/Kexample.com.+012+60385.key

@@ -0,0 +1 @@
+example.com.	3600	IN	DNSKEY	256 3 12 9SZY+xB3wKtrLoRHzkBs9L3fjcvazjnk5HF3gMaD1PVp4pthrwgHIm0TUaLrd3YCa2VCl5wj+MzbhZi8NEJ/Cg== ;{id = 60385 (zsk), size = 512b}

testdata/Kexample.com.+012+60385.private

@@ -0,0 +1,3 @@
+Private-key-format: v1.2
+Algorithm: 12 (ECC-GOST)
+GostAsn1: MEUCAQAwHAYGKoUDAgITMBIGByqFAwICIwEGByqFAwICHgEEIgIge0NaZG76WD9K6vNRD1yDuVPtKlEtFQbHIjoB106B6Hc=

testdata/Kexample.com.+249+41929.ds

@@ -1 +0,0 @@
-example.com.	3600	IN	DS	41929 249 203 10e2bc48d0301d16858bd040ee7d5c1983122d6cec0e3324fcdb94ba5ac0f748 ; xegav-dozog-mugef-bolyc-kicem-rygug-borel-tulyc-nibuc-dyryk-serub-vasud-gazut-rihyr-pykis-bytyg-myxyx

testdata/Kexample.com.+249+41929.key

@@ -1 +0,0 @@
-example.com.    3600    IN      DNSKEY  256 3 249 AAB7oZ5Ox8mcGrhB4vh41LdJQ5i+MVbn0KVe1a0CU2Akdwbp1qZ2khQTJZ0wOFkEsmgU2wfggXTpU8rp745IDVUb ;{id = 41929 (zsk), size = 512b}

testdata/Kexample.com.+249+41929.private

@@ -1,3 +0,0 @@
-Private-key-format: v1.2
-Algorithm: 249 (GOST)
-GostAsn1: MEUCAQAwHAYGKoUDAgITMBIGByqFAwICIwEGByqFAwICHgEEIgIgZdfQ+s3ASjjFsne42OdGYxav0QKoL3p/wOX/3kySQ3Q=

testdata/test_sigs.gost

@@ -3,13 +3,13 @@
 ; first entry is a DNSKEY answer, with the DNSKEY rrset used for verification. 
 ; later entries are verified with it.
 
-; Test GOST signatures using algo number 249.
+; Test GOST signatures using algo number 12.
 
 ENTRY_BEGIN
 SECTION QUESTION
 nlnetlabs.nl.	IN DNSKEY
 SECTION ANSWER
-nlnetlabs.nl.    3600    IN      DNSKEY  256 3 249 AAB7oZ5Ox8mcGrhB4vh41LdJQ5i+MVbn0KVe1a0CU2Akdwbp1qZ2khQTJZ0wOFkEsmgU2wfggXTpU8rp745IDVUb ;{id = 41929 (zsk), size = 512b}
+nlnetlabs.nl.   3600	IN	DNSKEY	256 3 12 9SZY+xB3wKtrLoRHzkBs9L3fjcvazjnk5HF3gMaD1PVp4pthrwgHIm0TUaLrd3YCa2VCl5wj+MzbhZi8NEJ/Cg== ;{id = 60385 (zsk), size = 512b}
 ENTRY_END
 
 ; entry to test
@@ -18,7 +18,7 @@ SECTION QUESTION
 open.nlnetlabs.nl. IN A
 SECTION ANSWER
 open.nlnetlabs.nl.      600     IN      A       213.154.224.1
-open.nlnetlabs.nl.	600	IN	RRSIG	A 249 3 600 20090903100515 20090806100515 41929 nlnetlabs.nl. jHGE+RPMlJtQBrmSEbw6ERLkuYR5hjiVMuj7HbxpfGi63A/Tm5zRZaEgx9AK+gvEXMo2d9TN44OaBxPNyxgQNA== ;{id = 41929}
+open.nlnetlabs.nl.	600	IN	RRSIG	A 12 3 600 20090903100515 20090806100515 60385 nlnetlabs.nl. XVxDmt7/gRk13Yv+U+RPuEZ86iCGSVPmTcpMZYJs14Yn6Y/On8X+vgLV6IzxQTxAwGb+D35/dUfT55p6pFo8YQ== ;{id = 60385}
 ENTRY_END
 
 ENTRY_BEGIN
@@ -27,7 +27,7 @@ open.nlnetlabs.nl. IN AAAA
 SECTION ANSWER
 open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::1
 open.nlnetlabs.nl.      600     IN      AAAA    2001:7b8:206:1::53
-open.nlnetlabs.nl.	600	IN	RRSIG	AAAA 249 3 600 20090903100515 20090806100515 41929 nlnetlabs.nl. Pod5ouQTmulD8rmOOERVhhD3wsu7tD2VRej+Puph61T/vEry0CTnosHkd4fg2xohnx9i6m09LhPeOdaCJJIRAQ== ;{id = 41929}
+open.nlnetlabs.nl.	600	IN	RRSIG	AAAA 12 3 600 20090903100515 20090806100515 60385 nlnetlabs.nl. +tdW+Uhkl2dBsD3zjGFGg1UtkBgfEhM6aXzERl0gWElgoJ4pCpXTV7VhZQ4yjibpMYjcXsBhQLcN7AuG20Ps9Q== ;{id = 60385}
 ENTRY_END
 
 ENTRY_BEGIN
@@ -35,6 +35,6 @@ SECTION QUESTION
 open.nlnetlabs.nl. IN NSEC
 SECTION ANSWER
 open.nlnetlabs.nl.      3600    IN      NSEC    nlnetlabs.nl. A AAAA RRSIG NSEC 
-open.nlnetlabs.nl.	3600	IN	RRSIG	NSEC 249 3 3600 20090903100515 20090806100515 41929 nlnetlabs.nl. qWNarmPDHjv+ctxYCbxWrJc+LPjKW+RkP17bK6idfzcqGxK95fnsduphbmEZlQQiruO1OeZ1VlF9Btg+qS2T3A== ;{id = 41929}
+open.nlnetlabs.nl.	3600	IN	RRSIG	NSEC 12 3 3600 20090903100515 20090806100515 60385 nlnetlabs.nl. vOzQQh9ITdgD74ohIE37L8mAZcgDt7V+HrrPjCdalsFYw9dvGwuEvc0MfSDmzrFQ7OhL0elwI/A1AfK57M7emQ== ;{id = 60385}
 ENTRY_END
 

testdata/val_ds_cname.rpl

@@ -0,0 +1,186 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with CNAME response to DS 
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+; nothing here, not even NSECs
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+; DS query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+www.example.com. IN DS
+SECTION ANSWER
+www.example.com. IN CNAME zzz.example.com.
+www.example.com.	3600	IN	RRSIG	CNAME 3 2 3600 20070926134150 20070829134150 2854 example.com. AERsv3PiBObAEhZ/dKyamie0sjvYLn7YaEKgv9ExB14KKLgWvzCaOWo= ;{id = 2854}
+;*.example.com. IN CNAME zzz.example.com.
+;*.example.com.	3600	IN	RRSIG	CNAME 3 2 3600 20070926134150 20070829134150 2854 example.com. AERsv3PiBObAEhZ/dKyamie0sjvYLn7YaEKgv9ExB14KKLgWvzCaOWo= ;{id = 2854}
+
+SECTION AUTHORITY
+*.example.com. IN NSEC zzz.example.com. CNAME RRSIG NSEC
+*.example.com.	3600	IN	RRSIG	NSEC 3 2 3600 20070926134150 20070829134150 2854 example.com. AJxl2TXciyhbKqSakVNtjlt8Bbkco02zpl5RlY88iqVmSa6ts+/guU4= ;{id = 2854}
+zzz.example.com. IN NSEC *.zzz.example.com. A RRSIG NSEC
+zzz.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. ACtgx/h0YfGEK79zg4G16jB/0oRWH0nxrMzUc/4hCY3oprsP8DrdjqU= ;{id = 2854}
+example.com. IN SOA alfa.ns.example.com.cz. hostmaster.example.com. 2010030800 10800 86400 604800 86400
+example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. ADsxLOHjxFzwFmwIiGOubqD9nKWAp4RccRIXQ0+EAUGfSDZMCB0ZiFA= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR AA NOERROR
+SECTION QUESTION
+zzz.example.com. IN DS
+SECTION ANSWER
+SECTION AUTHORITY
+zzz.example.com. IN NSEC *.zzz.example.com. A RRSIG NSEC
+zzz.example.com.	3600	IN	RRSIG	NSEC 3 3 3600 20070926134150 20070829134150 2854 example.com. ACtgx/h0YfGEK79zg4G16jB/0oRWH0nxrMzUc/4hCY3oprsP8DrdjqU= ;{id = 2854}
+example.com. IN SOA alfa.ns.example.com.cz. hostmaster.example.com. 2010030800 10800 86400 604800 86400
+example.com.	3600	IN	RRSIG	SOA 3 2 3600 20070926134150 20070829134150 2854 example.com. ADsxLOHjxFzwFmwIiGOubqD9nKWAp4RccRIXQ0+EAUGfSDZMCB0ZiFA= ;{id = 2854}
+SECTION ADDITIONAL
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+www.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA SERVFAIL
+SECTION QUESTION
+www.example.com. IN A
+SECTION ANSWER
+ENTRY_END
+
+SCENARIO_END

testdata/val_ds_gost.rpl

@@ -115,11 +115,13 @@ SECTION AUTHORITY
 sub.example.com. IN	NS ns.sub.example.com.
 
 ; GOST DS for sub.example.com.
-sub.example.com.	3600	IN	DS	41930 249 203 1940ede41068d30064a092a4fbf50b95071497a6c96616d647023c2e31951c59 ; xekeg-beryv-gygek-mugab-benup-bugop-gyvoz-hidin-hicec-gohap-keduk-kyhet-kucob-duzed-vason-halih-noxox
-sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926135752 20070829135752 2854 example.com. AE9dudjtl6lDkd56NGXQrsT9OsYXKJBipHfdnX+UyR10CydCRFju8Mk= ;{id = 2854}
+sub.example.com.	3600	IN	DS	60385 12 3 2be04f63b3d069fd65f81a3b810b661a00d39be3ff00d1c7481a150b93b0d027 ; xepov-bofek-fuset-bipiz-tunoz-mukyf-rybyb-ranic-pobet-fakov-fozob-bagus-ludac-pyheb-rygor-bygyd-lyxyx
 
 ; SHA DS for sub.example.com.
-;sub.example.com.	3600	IN	DS	41930 249 1 ea843e16f46363ad869661a7e88fe5d4bfd63796 ; xupim-gyzoc-kutek-femup-tucen-kemyp-lopym-zanit-gizet-kotyn-kuxyx
+;sub.example.com.	3600	IN	DS	60385 12 1 0a66f7923318bb1e208bfd975ffa2e30cfcdf962 ; xedik-katin-dasec-myvic-vumum-rizan-luluz-paraf-befas-tovek-dyxax
+;sub.example.com.	3600	IN	DS	60385 12 2 cd3290b84b457d02ca29846a005a5eba61640256ced8deca0ef8345d2cd34a58 ; xufef-dugir-modog-hyzyb-dadod-nicuk-pubyh-polor-pomuk-gobuh-kufet-mulus-pofyz-metoh-tarit-fudih-moxex
+
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926135752 20070829135752 2854 example.com. ADwjiGkzrz8RPRJ6LAB37cNEQxTXSaR6Stu/GwGvcQ7KVGH/Qw76ktI= ;{id = 2854}
 
 SECTION ADDITIONAL
 ns.sub.example.com. IN A 1.2.3.6
@@ -138,10 +140,10 @@ SECTION QUESTION
 sub.example.com. IN NS
 SECTION ANSWER
 sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.	3600	IN	RRSIG	NS 249 3 3600 20070926134150 20070829134150 41930 sub.example.com. +RqxwrGqIOwgZit1MNe3oEPEvoTRppVylmLFXAT7tg2MxWBdqXwH1Pby3sbAy6T3Syk07LMEjZJ/qd5HYJO0+w== ;{id = 41930}
+sub.example.com.	3600	IN	RRSIG	NS 12 3 3600 20070926134150 20070829134150 60385 sub.example.com. LAgerMKnwGgapo7tDs2jV8kjA+RminByvkR6qHineRDv4SYbRdDlCtYcFR4CoYo9aigLPej1WBmaZjFV+/7AVA== ;{id = 60385}
 SECTION ADDITIONAL
 ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.	3600	IN	RRSIG	A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. T7CSlknnb6GnM8hS9riryi9G06nr/2nJUfep97igb+aPgrLziF0UUVj3DjcISgmrCw0Pdegm2jJkVliFYm4PLQ== ;{id = 41930}
+ns.sub.example.com.	3600	IN	RRSIG	A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. qYVQEwiVNWwRRoDJxK3c3LaXtfvOm/YzOEzXbN2MxPHZXHaa2nCzWLsILNstot/wTAbrk4wNcT16gKxF5JguNw== ;{id = 60385}
 ENTRY_END
 
 ; response to DNSKEY priming query
@@ -152,15 +154,16 @@ REPLY QR NOERROR
 SECTION QUESTION
 sub.example.com. IN DNSKEY
 SECTION ANSWER
-sub.example.com.    3600    IN      DNSKEY  257 3 249 AAB7oZ5Ox8mcGrhB4vh41LdJQ5i+MVbn0KVe1a0CU2Akdwbp1qZ2khQTJZ0wOFkEsmgU2wfggXTpU8rp745IDVUb ;{id = 41930 (zsk), size = 512b}
-sub.example.com.	3600	IN	RRSIG	DNSKEY 249 3 3600 20070926134150 20070829134150 41930 sub.example.com. AEZeCPrvG8ueQYicdYhBUMORPH8VHlbcO0GvsRl5xLFqc8femC2qPRk7SpIOSRxZXdu4liL9O5FFYaymThfFCA== ;{id = 41930}
+sub.example.com.	3600	IN	DNSKEY	256 3 12 9SZY+xB3wKtrLoRHzkBs9L3fjcvazjnk5HF3gMaD1PVp4pthrwgHIm0TUaLrd3YCa2VCl5wj+MzbhZi8NEJ/Cg== ;{id = 60385 (zsk), size = 512b}
+sub.example.com.	3600	IN	RRSIG	DNSKEY 12 3 3600 20070926134150 20070829134150 60385 sub.example.com. zyZCppfMjlMS9xs3pJfbWkdA6EgV5MqI11AdVRV8pBsyI7diYLWm8RAHlhEI5MT59A6IT6Di9YjOCvWJjzZ9tA== ;{id = 60385}
 SECTION AUTHORITY
 sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.	3600	IN	RRSIG	NS 249 3 3600 20070926134150 20070829134150 41930 sub.example.com. +RqxwrGqIOwgZit1MNe3oEPEvoTRppVylmLFXAT7tg2MxWBdqXwH1Pby3sbAy6T3Syk07LMEjZJ/qd5HYJO0+w== ;{id = 41930}
+sub.example.com.	3600	IN	RRSIG	NS 12 3 3600 20070926134150 20070829134150 60385 sub.example.com. 3y6qmOn5GIytQQtXmdhkyL0+8Um7uNzOA0m0CkWFtzN81T98jHdGcCGNC3CIGMyhKaWKqPlOoSwIfm55fa4qRA== ;{id = 60385}
 
 SECTION ADDITIONAL
 ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.	3600	IN	RRSIG	A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. T7CSlknnb6GnM8hS9riryi9G06nr/2nJUfep97igb+aPgrLziF0UUVj3DjcISgmrCw0Pdegm2jJkVliFYm4PLQ== ;{id = 41930}
+ns.sub.example.com.	3600	IN	RRSIG	A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. VS97UxG9Kn7DIYFCnBDJQ3n7sQ+aYF42/cU6s8jF1Y4nHSorKPFa0KHn0WVmaW33hA+Vs4BWTvJ1/JOpbiJskA== ;{id = 60385}
+
 ENTRY_END
 
 ; response to query of interest
@@ -172,7 +175,7 @@ SECTION QUESTION
 www.sub.example.com. IN A
 SECTION ANSWER
 www.sub.example.com. IN A	11.11.11.11
-www.sub.example.com.	3600	IN	RRSIG	A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. UUeLd4U/s4Bp2772GGbjFGc+JiiqL9VCSCRkSIPPIzCm7ECWNhpi+a3eG4oC4Z99ufpcP+v67FuAWlAGXyeW0A== ;{id = 41930}
+www.sub.example.com.	3600	IN	RRSIG	A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. KVDpNBH83UM8l1e9yAdXA1fV+wFJSJF4NtOnDLTtbpfyVbndNW3tvPc2YfLBxTEZeUCns2QrqcmIMdZ086frOQ== ;{id = 60385}
 
 SECTION AUTHORITY
 SECTION ADDITIONAL
@@ -195,7 +198,7 @@ SECTION QUESTION
 www.sub.example.com. IN A
 SECTION ANSWER
 www.sub.example.com. 	3600	IN	A	11.11.11.11
-www.sub.example.com.	3600	IN	RRSIG	A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. UUeLd4U/s4Bp2772GGbjFGc+JiiqL9VCSCRkSIPPIzCm7ECWNhpi+a3eG4oC4Z99ufpcP+v67FuAWlAGXyeW0A== ;{id = 41930}
+www.sub.example.com.	3600	IN	RRSIG	A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. KVDpNBH83UM8l1e9yAdXA1fV+wFJSJF4NtOnDLTtbpfyVbndNW3tvPc2YfLBxTEZeUCns2QrqcmIMdZ086frOQ== ;{id = 60385}
 SECTION AUTHORITY
 SECTION ADDITIONAL
 ENTRY_END

testdata/val_ds_gost_downgrade.rpl

@@ -124,19 +124,19 @@ sub.example.com. IN	NS ns.sub.example.com.
 
 ; downgrade: false GOST, correct SHA
 
-sub.example.com.        3600    IN      DS      41930 249 203 1940ede41068d30064a092a4fbf50b95071497a6c96616d647023c2e31951c58 ; xekeg-beryv-gygek-mugab-benup-bugop-gyvoz-hidin-hicec-gohap-keduk-kyhet-kucob-duzed-vason-halih-noxox
+
+sub.example.com.        3600    IN      DS      60385 12 3 2be04f63b3d069fd65f81a3b810b661a00d39be3ff00d1c7481a150b93b0d028 
 
 ; correct GOST DS for sub.example.com.
-; sub.example.com.        3600    IN      DS      41930 249 203 1940ede41068d30064a092a4fbf50b95071497a6c96616d647023c2e31951c59 ; xekeg-beryv-gygek-mugab-benup-bugop-gyvoz-hidin-hicec-gohap-keduk-kyhet-kucob-duzed-vason-halih-noxox
+; sub.example.com.        3600    IN      DS      60385 12 3 2be04f63b3d069fd65f81a3b810b661a00d39be3ff00d1c7481a150b93b0d027 ; xepov-bofek-fuset-bipiz-tunoz-mukyf-rybyb-ranic-pobet-fakov-fozob-bagus-ludac-pyheb-rygor-bygyd-lyxyx
 
 ; SHA1 DS for sub.example.com.
-sub.example.com.	3600	IN	DS	41930 249 1 ea843e16f46363ad869661a7e88fe5d4bfd63796 ; xupim-gyzoc-kutek-femup-tucen-kemyp-lopym-zanit-gizet-kotyn-kuxyx
+sub.example.com.       3600    IN      DS      60385 12 1 0a66f7923318bb1e208bfd975ffa2e30cfcdf962 ; xedik-katin-dasec-myvic-vumum-rizan-luluz-paraf-befas-tovek-dyxax
 ; SHA256 DS for sub.example.com.
-sub.example.com.	3600	IN	DS	41930 249 2 0ae431b6bbb6ded8547428517c0912aab06150e3fe3e0bb64755e6baa4e33bb5 ; xediv-gosor-kiver-kalat-muhyl-gypah-cozub-nygep-pysak-cegiv-fuzyf-voder-kycih-hyner-piniv-fevir-hyxux
-
+sub.example.com.       3600    IN      DS      60385 12 2 cd3290b84b457d02ca29846a005a5eba61640256ced8deca0ef8345d2cd34a58 ; xufef-dugir-modog-hyzyb-dadod-nicuk-pubyh-polor-pomuk-gobuh-kufet-mulus-pofyz-metoh-tarit-fudih-moxex
 
 ; signs SHA1, SHA2 and GOST DSes
-sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926135752 20070829135752 2854 example.com. AEEGV20ThZAE523wZe4idjxcv/wHBgA/UUWk+H5V5c1bRGa2VzLLuDM= ;{id = 2854}
+sub.example.com.	3600	IN	RRSIG	DS 3 3 3600 20070926135752 20070829135752 2854 example.com. ADB1PPtGoPKRrhNtRtkqeqpgnZdbPOdJMgjdZVxPfgGCoMTu3JFQVbo= ;{id = 2854}
 
 SECTION ADDITIONAL
 ns.sub.example.com. IN A 1.2.3.6
@@ -155,10 +155,11 @@ SECTION QUESTION
 sub.example.com. IN NS
 SECTION ANSWER
 sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 249 3 3600 20070926134150 20070829134150 41930 sub.example.com. +RqxwrGqIOwgZit1MNe3oEPEvoTRppVylmLFXAT7tg2MxWBdqXwH1Pby3sbAy6T3Syk07LMEjZJ/qd5HYJO0+w== ;{id = 41930}
+sub.example.com.	3600	IN	RRSIG	NS 12 3 3600 20070926134150 20070829134150 60385 sub.example.com. 6mNrX32/DC2RU1A+yWCccn5H6wnsbNYTlf8e/LyF1fsuNfw6tH12sKGBCtk1mp4HpDIgH02HDHplJskSFOvzTw== ;{id = 60385}
+
 SECTION ADDITIONAL
 ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. T7CSlknnb6GnM8hS9riryi9G06nr/2nJUfep97igb+aPgrLziF0UUVj3DjcISgmrCw0Pdegm2jJkVliFYm4PLQ== ;{id = 41930}
+ns.sub.example.com.	3600	IN	RRSIG	A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. kJEyinL7BkpiPW2HxmFHRLAi68EdrLXToJiK83a5cedDe5ABL7c/k+nFHd3WjATUtVoueY3pSnCDVCJaFmd+/A== ;{id = 60385}
 ENTRY_END
 
 ; response to DNSKEY priming query
@@ -169,14 +170,14 @@ REPLY QR NOERROR
 SECTION QUESTION
 sub.example.com. IN DNSKEY
 SECTION ANSWER
-sub.example.com.    3600    IN      DNSKEY  257 3 249 AAB7oZ5Ox8mcGrhB4vh41LdJQ5i+MVbn0KVe1a0CU2Akdwbp1qZ2khQTJZ0wOFkEsmgU2wfggXTpU8rp745IDVUb ;{id = 41930 (zsk), size = 512b}
-sub.example.com.        3600    IN      RRSIG   DNSKEY 249 3 3600 20070926134150 20070829134150 41930 sub.example.com. AEZeCPrvG8ueQYicdYhBUMORPH8VHlbcO0GvsRl5xLFqc8femC2qPRk7SpIOSRxZXdu4liL9O5FFYaymThfFCA== ;{id = 41930}
+sub.example.com.        3600    IN      DNSKEY  256 3 12 9SZY+xB3wKtrLoRHzkBs9L3fjcvazjnk5HF3gMaD1PVp4pthrwgHIm0TUaLrd3YCa2VCl5wj+MzbhZi8NEJ/Cg== ;{id = 60385 (zsk), size = 512b}
+sub.example.com.        3600    IN      RRSIG   DNSKEY 12 3 3600 20070926134150 20070829134150 60385 sub.example.com. zyZCppfMjlMS9xs3pJfbWkdA6EgV5MqI11AdVRV8pBsyI7diYLWm8RAHlhEI5MT59A6IT6Di9YjOCvWJjzZ9tA== ;{id = 60385}
 SECTION AUTHORITY
 sub.example.com. IN	NS ns.sub.example.com.
-sub.example.com.        3600    IN      RRSIG   NS 249 3 3600 20070926134150 20070829134150 41930 sub.example.com. +RqxwrGqIOwgZit1MNe3oEPEvoTRppVylmLFXAT7tg2MxWBdqXwH1Pby3sbAy6T3Syk07LMEjZJ/qd5HYJO0+w== ;{id = 41930}
+sub.example.com.	3600	IN	RRSIG	NS 12 3 3600 20070926134150 20070829134150 60385 sub.example.com. 6mNrX32/DC2RU1A+yWCccn5H6wnsbNYTlf8e/LyF1fsuNfw6tH12sKGBCtk1mp4HpDIgH02HDHplJskSFOvzTw== ;{id = 60385}
 SECTION ADDITIONAL
 ns.sub.example.com. IN A 1.2.3.6
-ns.sub.example.com.     3600    IN      RRSIG   A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. T7CSlknnb6GnM8hS9riryi9G06nr/2nJUfep97igb+aPgrLziF0UUVj3DjcISgmrCw0Pdegm2jJkVliFYm4PLQ== ;{id = 41930}
+ns.sub.example.com.	3600	IN	RRSIG	A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. kJEyinL7BkpiPW2HxmFHRLAi68EdrLXToJiK83a5cedDe5ABL7c/k+nFHd3WjATUtVoueY3pSnCDVCJaFmd+/A== ;{id = 60385}
 ENTRY_END
 
 ; response to query of interest
@@ -188,7 +189,7 @@ SECTION QUESTION
 www.sub.example.com. IN A
 SECTION ANSWER
 www.sub.example.com. IN A	11.11.11.11
-www.sub.example.com.    3600    IN      RRSIG   A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. UUeLd4U/s4Bp2772GGbjFGc+JiiqL9VCSCRkSIPPIzCm7ECWNhpi+a3eG4oC4Z99ufpcP+v67FuAWlAGXyeW0A== ;{id = 41930}
+www.sub.example.com.    3600    IN      RRSIG   A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. KVDpNBH83UM8l1e9yAdXA1fV+wFJSJF4NtOnDLTtbpfyVbndNW3tvPc2YfLBxTEZeUCns2QrqcmIMdZ086frOQ== ;{id = 60385}
 
 SECTION AUTHORITY
 SECTION ADDITIONAL
@@ -221,7 +222,7 @@ SECTION QUESTION
 www.sub.example.com. IN A
 SECTION ANSWER
 ;www.sub.example.com. 	3600	IN	A	11.11.11.11
-;www.sub.example.com.    3600    IN      RRSIG   A 249 4 3600 20070926134150 20070829134150 41930 sub.example.com. UUeLd4U/s4Bp2772GGbjFGc+JiiqL9VCSCRkSIPPIzCm7ECWNhpi+a3eG4oC4Z99ufpcP+v67FuAWlAGXyeW0A== ;{id = 41930}
+;www.sub.example.com.    3600    IN      RRSIG   A 12 4 3600 20070926134150 20070829134150 60385 sub.example.com. KVDpNBH83UM8l1e9yAdXA1fV+wFJSJF4NtOnDLTtbpfyVbndNW3tvPc2YfLBxTEZeUCns2QrqcmIMdZ086frOQ== ;{id = 60385}
 SECTION AUTHORITY
 SECTION ADDITIONAL
 ENTRY_END

testdata/val_wild_pos.rpl

@@ -0,0 +1,159 @@
+; config options
+; The island of trust is at example.com
+server:
+	trust-anchor: "example.com.    3600    IN      DS      2854 3 1 46e4ffc6e9a4793b488954bd3f0cc6af0dfb201b"
+	val-override-date: "20070916134226"
+	target-fetch-policy: "0 0 0 0 0"
+
+stub-zone:
+	name: "."
+	stub-addr: 193.0.14.129 	# K.ROOT-SERVERS.NET.
+CONFIG_END
+
+SCENARIO_BEGIN Test validator with direct wildcard positive response
+
+; K.ROOT-SERVERS.NET.
+RANGE_BEGIN 0 100
+	ADDRESS 193.0.14.129 
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+. IN NS
+SECTION ANSWER
+. IN NS	K.ROOT-SERVERS.NET.
+SECTION ADDITIONAL
+K.ROOT-SERVERS.NET.	IN	A	193.0.14.129
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+*.example.com. IN A
+SECTION AUTHORITY
+com.	IN NS	a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.	IN 	A	192.5.6.30
+ENTRY_END
+RANGE_END
+
+; a.gtld-servers.net.
+RANGE_BEGIN 0 100
+	ADDRESS 192.5.6.30
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+com. IN NS
+SECTION ANSWER
+com.    IN NS   a.gtld-servers.net.
+SECTION ADDITIONAL
+a.gtld-servers.net.     IN      A       192.5.6.30
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+*.example.com. IN A
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ENTRY_END
+
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+ns.example.com. IN AAAA
+SECTION ANSWER
+ENTRY_END
+RANGE_END
+
+; ns.example.com.
+RANGE_BEGIN 0 100
+	ADDRESS 1.2.3.4
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN NS
+SECTION ANSWER
+example.com.    IN NS   ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.         IN      A       1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to DNSKEY priming query
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+example.com. IN DNSKEY
+SECTION ANSWER
+example.com.    3600    IN      DNSKEY  256 3 3 ALXLUsWqUrY3JYER3T4TBJII s70j+sDS/UT2QRp61SE7S3E EXopNXoFE73JLRmvpi/UrOO/Vz4Se 6wXv/CYCKjGw06U4WRgR YXcpEhJROyNapmdIKSx hOzfLVE1gqA0PweZR8d tY3aNQSRn3sPpwJr6Mi /PqQKAMMrZ9ckJpf1+b QMOOvxgzz2U1GS18b3y ZKcgTMEaJzd/GZYzi/B N2DzQ0MsrSwYXfsNLFO Bbs8PJMW4LYIxeeOe6rUgkWOF 7CC9Dh/dduQ1QrsJhmZAEFfd6ByYV+ ;{id = 2854 (zsk), size = 1688b}
+example.com.    3600    IN      RRSIG   DNSKEY 3 2 3600 20070926134802 20070829134802 2854 example.com. MCwCFG1yhRNtTEa3Eno2zhVVuy2EJX3wAhQeLyUp6+UXcpC5qGNu9tkrTEgPUg== ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926135752 20070829135752 2854 example.com. MC0CFQCMSWxVehgOQLoYclB9PIAbNP229AIUeH0vNNGJhjnZiqgIOKvs1EhzqAo= ;{id = 2854}
+ENTRY_END
+
+; response to query of interest
+ENTRY_BEGIN
+MATCH opcode qtype qname
+ADJUST copy_id
+REPLY QR NOERROR
+SECTION QUESTION
+*.example.com. IN A
+SECTION ANSWER
+*.example.com. IN A	10.20.30.40
+*.example.com.	3600	IN	RRSIG	A 3 2 3600 20070926134150 20070829134150 2854 example.com. AG3iIIzflgRHsIlOKiSHADHIn/NmfNgESAslc1wIjxys5r9w4CxNIGs= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ENTRY_END
+RANGE_END
+
+STEP 1 QUERY
+ENTRY_BEGIN
+REPLY RD DO
+SECTION QUESTION
+*.example.com. IN A
+ENTRY_END
+
+; recursion happens here.
+STEP 10 CHECK_ANSWER
+ENTRY_BEGIN
+MATCH all
+REPLY QR RD RA AD NOERROR
+SECTION QUESTION
+*.example.com. IN A
+SECTION ANSWER
+*.example.com. IN A	10.20.30.40
+*.example.com.	3600	IN	RRSIG	A 3 2 3600 20070926134150 20070829134150 2854 example.com. AG3iIIzflgRHsIlOKiSHADHIn/NmfNgESAslc1wIjxys5r9w4CxNIGs= ;{id = 2854}
+SECTION AUTHORITY
+example.com.	IN NS	ns.example.com.
+example.com.    3600    IN      RRSIG   NS 3 2 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCN+qHdJxoI/2tNKwsb08pra/G7aAIUAWA5sDdJTbrXA1/3OaesGBAO3sI= ;{id = 2854}
+SECTION ADDITIONAL
+ns.example.com.		IN 	A	1.2.3.4
+ns.example.com. 3600    IN      RRSIG   A 3 3 3600 20070926134150 20070829134150 2854 example.com. MC0CFQCQMyTjn7WWwpwAR1LlVeLpRgZGuQIUCcJDEkwAuzytTDRlYK7nIMwH1CM= ;{id = 2854}
+ENTRY_END
+
+SCENARIO_END

util/alloc.h

@@ -177,6 +177,8 @@ void alloc_set_id_cleanup(struct alloc_cache* alloc, void (*cleanup)(void*),
 	void* arg);
 
 #ifdef UNBOUND_ALLOC_LITE
+#  include "ldns/packet.h"
+#  include "openssl/ssl.h"
 #  define malloc(s) unbound_stat_malloc_lite(s, __FILE__, __LINE__, __func__)
 #  define calloc(n,s) unbound_stat_calloc_lite(n, s, __FILE__, __LINE__, __func__)
 #  define free(p) unbound_stat_free_lite(p, __FILE__, __LINE__, __func__)

util/config_file.c

@@ -40,6 +40,8 @@
  */
 
 #include "config.h"
+#include <ctype.h>
+#include "ldns/ldns.h"
 #include "util/log.h"
 
 #include "util/configyyrename.h"
@@ -528,6 +530,7 @@ config_get_option(struct config_file* cfg, const char* opt,
 	else O_DEC(opt, "statistics-interval", stat_interval)
 	else O_YNO(opt, "statistics-cumulative", stat_cumulative)
 	else O_YNO(opt, "extended-statistics", stat_extended)
+	else O_YNO(opt, "use-syslog", use_syslog)
 	else O_DEC(opt, "num-threads", num_threads)
 	else O_IFC(opt, "interface", num_ifs, ifs)
 	else O_IFC(opt, "outgoing-interface", num_out_ifs, out_ifs)

util/data/dname.c

@@ -40,6 +40,7 @@
  */
 
 #include "config.h"
+#include <ctype.h>
 #include "util/data/dname.h"
 #include "util/data/msgparse.h"
 #include "util/log.h"
@@ -147,17 +148,29 @@ void
 pkt_dname_tolower(ldns_buffer* pkt, uint8_t* dname)
 {
 	uint8_t lablen;
+	int count = 0;
+	if(dname >= ldns_buffer_end(pkt))
+		return;
 	lablen = *dname++;
 	while(lablen) {
 		if(LABEL_IS_PTR(lablen)) {
+			if((size_t)PTR_OFFSET(lablen, *dname) 
+				>= ldns_buffer_limit(pkt))
+				return;
 			dname = ldns_buffer_at(pkt, PTR_OFFSET(lablen, *dname));
 			lablen = *dname++;
+			if(count++ > MAX_COMPRESS_PTRS)
+				return;
 			continue;
 		}
+		if(dname+lablen >= ldns_buffer_end(pkt))
+			return;
 		while(lablen--) {
 			*dname = (uint8_t)tolower((int)*dname);
 			dname++;
 		}
+		if(dname >= ldns_buffer_end(pkt))
+			return;
 		lablen = *dname++;
 	}
 }

util/data/msgencode.c

@@ -40,6 +40,7 @@
  */
 
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "util/data/msgencode.h"
 #include "util/data/msgreply.h"
 #include "util/data/msgparse.h"

util/data/msgparse.c

@@ -37,6 +37,7 @@
  * Routines for message parsing a packet buffer to a descriptive structure.
  */
 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/data/msgparse.h"
 #include "util/net_help.h"
 #include "util/data/dname.h"

util/data/msgparse.h

@@ -63,6 +63,7 @@
 #ifndef UTIL_DATA_MSGPARSE_H
 #define UTIL_DATA_MSGPARSE_H
 #include "util/storage/lruhash.h"
+#include "ldns/packet.h"
 struct rrset_parse;
 struct rr_parse;
 struct regional;

util/data/msgreply.c

@@ -40,6 +40,7 @@
  */
 
 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/data/msgreply.h"
 #include "util/storage/lookup3.h"
 #include "util/log.h"

util/data/packed_rrset.c

@@ -40,6 +40,7 @@
  */
 
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "util/data/packed_rrset.h"
 #include "util/data/dname.h"
 #include "util/storage/lookup3.h"

util/data/packed_rrset.h

@@ -42,6 +42,7 @@
 #ifndef UTIL_DATA_PACKED_RRSET_H
 #define UTIL_DATA_PACKED_RRSET_H
 #include "util/storage/lruhash.h"
+#include "ldns/rr.h"
 struct alloc_cache;
 struct regional;
 

util/fptr_wlist.c

@@ -255,11 +255,13 @@ fptr_whitelist_modenv_send_packet(int (*fptr)(ldns_buffer* pkt,
 	return 0;
 }
 
+/** whitelist env->send_query callbacks */
 int 
 fptr_whitelist_modenv_send_query(struct outbound_entry* (*fptr)(
         uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass,
-        uint16_t flags, int dnssec, struct sockaddr_storage* addr,
-        socklen_t addrlen, struct module_qstate* q))
+        uint16_t flags, int dnssec, int want_dnssec, 
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	struct module_qstate* q))
 {
 	if(fptr == &worker_send_query) return 1;
 	else if(fptr == &libworker_send_query) return 1;

util/fptr_wlist.h

@@ -201,8 +201,9 @@ int fptr_whitelist_modenv_send_packet(int (*fptr)(ldns_buffer* pkt,
  */
 int fptr_whitelist_modenv_send_query(struct outbound_entry* (*fptr)(
 	uint8_t* qname, size_t qnamelen, uint16_t qtype, uint16_t qclass, 
-	uint16_t flags, int dnssec, struct sockaddr_storage* addr, 
-	socklen_t addrlen, struct module_qstate* q));
+	uint16_t flags, int dnssec, int want_dnssec,
+	struct sockaddr_storage* addr, socklen_t addrlen, 
+	struct module_qstate* q));
 
 /**
  * Check function pointer whitelist for module_env detach_subs callback values.

util/iana_ports.inc

@@ -3981,6 +3981,8 @@
 4869,
 4870,
 4871,
+4881,
+4882,
 4884,
 4885,
 4894,
@@ -4117,6 +4119,7 @@
 5265,
 5269,
 5270,
+5271,
 5272,
 5282,
 5298,
@@ -4192,6 +4195,8 @@
 5433,
 5434,
 5435,
+5436,
+5437,
 5443,
 5453,
 5454,
@@ -4263,6 +4268,7 @@
 5722,
 5723,
 5724,
+5728,
 5729,
 5730,
 5741,
@@ -5043,6 +5049,7 @@
 17007,
 17185,
 17219,
+17234,
 17235,
 17500,
 17729,

util/log.h

@@ -41,6 +41,7 @@
 
 #ifndef UTIL_LOG_H
 #define UTIL_LOG_H
+#include "ldns/buffer.h"
 
 /**
  * verbosity value:

util/mini_event.c

@@ -41,6 +41,10 @@
  */
 
 #include "config.h"
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+#include <sys/time.h>
 
 #if defined(USE_MINI_EVENT) && !defined(USE_WINSOCK)
 #include <signal.h>

util/module.h

@@ -114,6 +114,8 @@ struct module_env {
 	 * @param dnssec: if set, EDNS record will have bits set.
 	 *	If EDNS_DO bit is set, DO bit is set in EDNS records.
 	 *	If BIT_CD is set, CD bit is set in queries with EDNS records.
+	 * @param want_dnssec: if set, the validator wants DNSSEC.  Without
+	 * 	EDNS, the answer is likely to be useless for this domain.
 	 * @param addr: where to.
 	 * @param addrlen: length of addr.
 	 * @param q: wich query state to reactivate upon return.
@@ -124,8 +126,8 @@ struct module_env {
 	 */
 	struct outbound_entry* (*send_query)(uint8_t* qname, size_t qnamelen, 
 		uint16_t qtype, uint16_t qclass, uint16_t flags, int dnssec, 
-		struct sockaddr_storage* addr, socklen_t addrlen, 
-		struct module_qstate* q);
+		int want_dnssec, struct sockaddr_storage* addr, 
+		socklen_t addrlen, struct module_qstate* q);
 
 	/**
 	 * Detach-subqueries.

util/net_help.c

@@ -38,6 +38,7 @@
  */
 
 #include "config.h"
+#include "ldns/ldns.h"
 #include "util/net_help.h"
 #include "util/log.h"
 #include "util/data/dname.h"

util/netevent.c

@@ -39,12 +39,36 @@
  * This file contains event notification functions.
  */
 #include "config.h"
+#include "ldns/wire2host.h"
 #include "util/netevent.h"
 #include "util/log.h"
 #include "util/net_help.h"
 #include "util/fptr_wlist.h"
 
 /* -------- Start of local definitions -------- */
+/** if CMSG_ALIGN is not defined on this platform, a workaround */
+#ifndef CMSG_ALIGN
+#  ifdef _CMSG_DATA_ALIGN
+#    define CMSG_ALIGN _CMSG_DATA_ALIGN
+#  else
+#    define CMSG_ALIGN(len) (((len)+sizeof(long)-1) & ~(sizeof(long)-1))
+#  endif
+#endif
+
+/** if CMSG_LEN is not defined on this platform, a workaround */
+#ifndef CMSG_LEN
+#  define CMSG_LEN(len) (CMSG_ALIGN(sizeof(struct cmsghdr))+(len))
+#endif
+
+/** if CMSG_SPACE is not defined on this platform, a workaround */
+#ifndef CMSG_SPACE
+#  ifdef _CMSG_HDR_ALIGN
+#    define CMSG_SPACE(l) (CMSG_ALIGN(l)+_CMSG_HDR_ALIGN(sizeof(struct cmsghdr)))
+#  else
+#    define CMSG_SPACE(l) (CMSG_ALIGN(l)+CMSG_ALIGN(sizeof(struct cmsghdr)))
+#  endif
+#endif
+
 /** The TCP reading or writing query timeout in seconds */
 #define TCP_QUERY_TIMEOUT 120 
 
@@ -294,11 +318,6 @@ comm_point_send_udp_msg(struct comm_point *c, ldns_buffer* packet,
 	return 1;
 }
 
-/** if no CMSG_LEN (Solaris 9) define something reasonable for one element */
-#ifndef CMSG_LEN
-#define CMSG_LEN(x) (sizeof(struct cmsghdr)+(x))
-#endif
-
 /** print debug ancillary info */
 void p_ancil(const char* str, struct comm_reply* r)
 {
@@ -316,15 +335,7 @@ void p_ancil(const char* str, struct comm_reply* r)
 		buf[sizeof(buf)-1]=0;
 		log_info("%s: %s %d", str, buf, r->pktinfo.v6info.ipi6_ifindex);
 	} else if(r->srctype == 4) {
-#ifdef IP_RECVDSTADDR
-		char buf1[1024];
-		if(inet_ntop(AF_INET, &r->pktinfo.v4addr, 
-			buf1, (socklen_t)sizeof(buf1)) == 0) {
-			strncpy(buf1, "(inet_ntop error)", sizeof(buf1));
-		}
-		buf1[sizeof(buf1)-1]=0;
-		log_info("%s: %s", str, buf1);
-#elif defined(IP_PKTINFO)
+#ifdef IP_PKTINFO
 		char buf1[1024], buf2[1024];
 		if(inet_ntop(AF_INET, &r->pktinfo.v4info.ipi_addr, 
 			buf1, (socklen_t)sizeof(buf1)) == 0) {
@@ -338,6 +349,14 @@ void p_ancil(const char* str, struct comm_reply* r)
 		buf2[sizeof(buf2)-1]=0;
 		log_info("%s: %d %s %s", str, r->pktinfo.v4info.ipi_ifindex,
 			buf1, buf2);
+#elif defined(IP_RECVDSTADDR)
+		char buf1[1024];
+		if(inet_ntop(AF_INET, &r->pktinfo.v4addr, 
+			buf1, (socklen_t)sizeof(buf1)) == 0) {
+			strncpy(buf1, "(inet_ntop error)", sizeof(buf1));
+		}
+		buf1[sizeof(buf1)-1]=0;
+		log_info("%s: %s", str, buf1);
 #endif
 	}
 #else
@@ -379,20 +398,29 @@ comm_point_send_udp_msg_if(struct comm_point *c, ldns_buffer* packet,
 #ifndef S_SPLINT_S
 	cmsg = CMSG_FIRSTHDR(&msg);
 	if(r->srctype == 4) {
-#ifdef IP_RECVDSTADDR
-		cmsg->cmsg_level = IPPROTO_IP;
-		cmsg->cmsg_type = IP_RECVDSTADDR;
-		memmove(CMSG_DATA(cmsg), &r->pktinfo.v4addr,
-			sizeof(struct in_addr));
-		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
-#elif defined(IP_PKTINFO)
+#ifdef IP_PKTINFO
+		msg.msg_controllen = CMSG_SPACE(sizeof(struct in_pktinfo));
+		log_assert(msg.msg_controllen <= sizeof(control));
 		cmsg->cmsg_level = IPPROTO_IP;
 		cmsg->cmsg_type = IP_PKTINFO;
 		memmove(CMSG_DATA(cmsg), &r->pktinfo.v4info,
 			sizeof(struct in_pktinfo));
 		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_pktinfo));
+#elif defined(IP_SENDSRCADDR)
+		msg.msg_controllen = CMSG_SPACE(sizeof(struct in_addr));
+		log_assert(msg.msg_controllen <= sizeof(control));
+		cmsg->cmsg_level = IPPROTO_IP;
+		cmsg->cmsg_type = IP_SENDSRCADDR;
+		memmove(CMSG_DATA(cmsg), &r->pktinfo.v4addr,
+			sizeof(struct in_addr));
+		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in_addr));
+#else
+		verbose(VERB_ALGO, "no IP_PKTINFO or IP_SENDSRCADDR");
+		msg.msg_control = NULL;
 #endif
 	} else if(r->srctype == 6) {
+		msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
+		log_assert(msg.msg_controllen <= sizeof(control));
 		cmsg->cmsg_level = IPPROTO_IPV6;
 		cmsg->cmsg_type = IPV6_PKTINFO;
 		memmove(CMSG_DATA(cmsg), &r->pktinfo.v6info,
@@ -400,14 +428,14 @@ comm_point_send_udp_msg_if(struct comm_point *c, ldns_buffer* packet,
 		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
 	} else {
 		/* try to pass all 0 to use default route */
+		msg.msg_controllen = CMSG_SPACE(sizeof(struct in6_pktinfo));
+		log_assert(msg.msg_controllen <= sizeof(control));
 		cmsg->cmsg_level = IPPROTO_IPV6;
 		cmsg->cmsg_type = IPV6_PKTINFO;
 		memset(CMSG_DATA(cmsg), 0, sizeof(struct in6_pktinfo));
 		cmsg->cmsg_len = CMSG_LEN(sizeof(struct in6_pktinfo));
 	}
-	msg.msg_controllen = cmsg->cmsg_len;
 #endif /* S_SPLINT_S */
-
 	if(verbosity >= VERB_ALGO)
 		p_ancil("send_udp over interface", r);
 	sent = sendmsg(c->fd, &msg, 0);
@@ -490,20 +518,20 @@ comm_point_udp_ancil_callback(int fd, short event, void* arg)
 				memmove(&rep.pktinfo.v6info, CMSG_DATA(cmsg),
 					sizeof(struct in6_pktinfo));
 				break;
-#ifdef IP_RECVDSTADDR
-			} else if( cmsg->cmsg_level == IPPROTO_IP &&
-				cmsg->cmsg_type == IP_RECVDSTADDR) {
-				rep.srctype = 4;
-				memmove(&rep.pktinfo.v4addr, CMSG_DATA(cmsg),
-					sizeof(struct in_addr));
-				break;
-#elif defined(IP_PKTINFO)
+#ifdef IP_PKTINFO
 			} else if( cmsg->cmsg_level == IPPROTO_IP &&
 				cmsg->cmsg_type == IP_PKTINFO) {
 				rep.srctype = 4;
 				memmove(&rep.pktinfo.v4info, CMSG_DATA(cmsg),
 					sizeof(struct in_pktinfo));
 				break;
+#elif defined(IP_RECVDSTADDR)
+			} else if( cmsg->cmsg_level == IPPROTO_IP &&
+				cmsg->cmsg_type == IP_RECVDSTADDR) {
+				rep.srctype = 4;
+				memmove(&rep.pktinfo.v4addr, CMSG_DATA(cmsg),
+					sizeof(struct in_addr));
+				break;
 #endif
 			}
 		}

util/netevent.h

@@ -60,6 +60,7 @@
 #ifndef NET_EVENT_H
 #define NET_EVENT_H
 
+#include "ldns/buffer.h"
 struct comm_point;
 struct comm_reply;
 struct event_base;
@@ -107,10 +108,10 @@ struct comm_reply {
 #ifdef IPV6_PKTINFO
 		struct in6_pktinfo v6info;
 #endif
-#ifdef IP_RECVDSTADDR
-		struct in_addr v4addr;
-#elif defined(IP_PKTINFO)
+#ifdef IP_PKTINFO
 		struct in_pktinfo v4info;
+#elif defined(IP_RECVDSTADDR)
+		struct in_addr v4addr;
 #endif
 	} 	
 		/** variable with return source data */

util/random.c

@@ -177,6 +177,18 @@ ub_random(struct ub_randstate* s)
 	return (long int)((r) % (((unsigned)MAX_VALUE + 1)));
 }
 
+long int
+ub_random_max(struct ub_randstate* state, long int x)
+{
+	/* make sure we fetch in a range that is divisible by x. ignore
+	 * values from d .. MAX_VALUE, instead draw a new number */
+	long int d = MAX_VALUE - (MAX_VALUE % x); /* d is divisible by x */
+	long int v = ub_random(state);
+	while(d <= v)
+		v = ub_random(state);
+	return (v % x);
+}
+
 void 
 ub_randfree(struct ub_randstate* s)
 {

util/random.h

@@ -75,6 +75,15 @@ struct ub_randstate* ub_initstate(unsigned int seed,
  */
 long int ub_random(struct ub_randstate* state);
 
+/**
+ * Generate random number between 0 and x-1.  No modulo bias.
+ * @param state: must have been initialised with ub_initstate.
+ * @param x: an upper limit. not (negative or zero). must be smaller than 2**31.
+ * @return: random value between 0..x-1. Possibly more than one
+ * random number is picked from the random stream to satisfy this.
+ */
+long int ub_random_max(struct ub_randstate* state, long int x);
+
 /**
  * Delete the random state.
  * @param state: to delete.

util/timehist.c

@@ -39,6 +39,10 @@
  * This file contains functions to make a histogram of time values.
  */
 #include "config.h"
+#ifdef HAVE_TIME_H
+#include <time.h>
+#endif
+#include <sys/time.h>
 #include "util/timehist.h"
 #include "util/log.h"
 

validator/autotrust.c

@@ -41,6 +41,7 @@
  * It was modified to fit into unbound. The state table process is the same.
  */
 #include "config.h"
+#include "ldns/ldns.h"
 #include "validator/autotrust.h"
 #include "validator/val_anchor.h"
 #include "validator/val_utils.h"
@@ -1684,7 +1685,7 @@ calc_next_probe(struct module_env* env, uint32_t wait)
 		wait = 3600;
 	rnd = wait/10;
 	rest = wait-rnd;
-	rnd = (uint32_t)ub_random(env->rnd) % rnd;
+	rnd = (uint32_t)ub_random_max(env->rnd, (long int)rnd);
 	return (time_t)(*env->now + rest + rnd);
 }